@amerged/ohmyhost-mcp 0.1.19 → 0.1.20

package/src/apps/product-cli/project-link-store.ts

@@ -1,37 +1,166 @@
-import { appendFile, chmod, mkdir, readFile, rename, stat, writeFile } from "node:fs/promises";
+import {
+  appendFile,
+  chmod,
+  mkdir,
+  readFile,
+  readdir,
+  rename,
+  stat,
+  unlink,
+  writeFile,
+} from "node:fs/promises";
 import { join } from "node:path";
 
+/**
+ * Which project this working copy deploys to for one organization. The same checkout may be linked
+ * once per organization, so a second account never overwrites or inherits the first one's link.
+ */
 export interface ProjectLinkMetadata {
-  readonly version: 1;
+  readonly version: 2;
   readonly api_origin: string;
+  readonly organization_id: string;
   readonly project_id: string;
   readonly installation_id: string;
   readonly repository_full_name: string;
-  readonly commit_sha?: string;
+}
+
+/** A link written before links named their organization; it is verified before any use. */
+export interface LegacyProjectLink {
+  readonly project_id: string;
+  readonly installation_id: string;
+  readonly repository_full_name: string;
+}
+
+export interface DirectoryLinks {
+  readonly links: readonly ProjectLinkMetadata[];
+  readonly legacy: LegacyProjectLink | null;
 }
 
 export interface ProjectLinkStore {
   save(metadata: ProjectLinkMetadata): Promise<void>;
 }
 
-/** The project this directory was linked to for this API, or null when there is no usable link. */
-export async function readLinkedProjectId(
+const ULID = /^[0-7][0-9A-HJKMNP-TV-Z]{25}$/u;
+const LINKS = "links";
+const LEGACY_LINK = "link.json";
+
+/** Every usable link of this directory for this API; unreadable files are not links. */
+export async function readProjectLinks(
   directory: string,
   apiOrigin: string,
-): Promise<string | null> {
+): Promise<DirectoryLinks> {
+  let names: string[] = [];
   try {
-    const link = JSON.parse(await readFile(join(directory, "link.json"), "utf8")) as unknown;
-    if (typeof link !== "object" || link === null) return null;
-    const { version, api_origin, project_id } = link as Record<string, unknown>;
-    return version === 1 &&
-      api_origin === apiOrigin &&
-      typeof project_id === "string" &&
-      /^[0-9A-HJKMNP-TV-Z]{26}$/u.test(project_id)
-      ? project_id
-      : null;
+    names = await readdir(join(directory, LINKS));
   } catch {
-    return null;
+    names = [];
+  }
+  const links: ProjectLinkMetadata[] = [];
+  for (const name of names.sort()) {
+    const organizationId = /^([0-7][0-9A-HJKMNP-TV-Z]{25})\.json$/u.exec(name)?.[1];
+    if (organizationId === undefined) continue;
+    const link = await readJson(join(directory, LINKS, name));
+    if (
+      isRecord(link, [
+        "version",
+        "api_origin",
+        "organization_id",
+        "project_id",
+        "installation_id",
+        "repository_full_name",
+      ]) &&
+      link["version"] === 2 &&
+      link["api_origin"] === apiOrigin &&
+      link["organization_id"] === organizationId &&
+      typeof link["project_id"] === "string" &&
+      ULID.test(link["project_id"]) &&
+      typeof link["installation_id"] === "string" &&
+      typeof link["repository_full_name"] === "string"
+    )
+      links.push(link as unknown as ProjectLinkMetadata);
   }
+  const legacy = await readJson(join(directory, LEGACY_LINK));
+  return {
+    links,
+    legacy:
+      typeof legacy === "object" &&
+      legacy !== null &&
+      legacy["version"] === 1 &&
+      legacy["api_origin"] === apiOrigin &&
+      typeof legacy["project_id"] === "string" &&
+      ULID.test(legacy["project_id"]) &&
+      typeof legacy["installation_id"] === "string" &&
+      typeof legacy["repository_full_name"] === "string"
+        ? {
+            project_id: legacy["project_id"],
+            installation_id: legacy["installation_id"],
+            repository_full_name: legacy["repository_full_name"],
+          }
+        : null,
+  };
+}
+
+export type LinkedProject =
+  | {
+      readonly outcome: "linked";
+      readonly projectId: string;
+      /** Null for a legacy link, whose organization is still to be verified. */
+      readonly organizationId: string | null;
+    }
+  | { readonly outcome: "none" }
+  | { readonly outcome: "ambiguous"; readonly organizationIds: readonly string[] };
+
+/**
+ * The project a command in this directory means when it names none. With a known organization only
+ * that organization's link counts; otherwise exactly one link must exist.
+ */
+export function chooseLinkedProject(
+  directory: DirectoryLinks,
+  organizationId: string | undefined,
+): LinkedProject {
+  if (organizationId !== undefined) {
+    const link = directory.links.find((candidate) => candidate.organization_id === organizationId);
+    if (link !== undefined)
+      return { outcome: "linked", projectId: link.project_id, organizationId };
+    return directory.legacy === null
+      ? { outcome: "none" }
+      : { outcome: "linked", projectId: directory.legacy.project_id, organizationId: null };
+  }
+  const candidates = [
+    ...directory.links.map((link) => ({
+      projectId: link.project_id,
+      organizationId: link.organization_id as string | null,
+    })),
+    ...(directory.legacy === null
+      ? []
+      : [{ projectId: directory.legacy.project_id, organizationId: null }]),
+  ];
+  const [only] = candidates;
+  if (candidates.length === 1 && only !== undefined) return { outcome: "linked", ...only };
+  if (candidates.length === 0) return { outcome: "none" };
+  return {
+    outcome: "ambiguous",
+    organizationIds: directory.links.map((link) => link.organization_id),
+  };
+}
+
+/** The organization a directory link records for this project, if one does. */
+export function linkedOrganization(
+  directory: DirectoryLinks,
+  projectId: string,
+): string | undefined {
+  const organizations = new Set(
+    directory.links
+      .filter((link) => link.project_id === projectId)
+      .map((link) => link.organization_id),
+  );
+  const [organizationId] = organizations;
+  return organizations.size === 1 ? organizationId : undefined;
+}
+
+/** Drops the pre-organization link once its replacement is written; it is never guessed at. */
+export async function removeLegacyProjectLink(directory: string): Promise<void> {
+  await unlink(join(directory, LEGACY_LINK));
 }
 
 export class OwnerOnlyProjectLinkStore implements ProjectLinkStore {
@@ -42,10 +171,14 @@ export class OwnerOnlyProjectLinkStore implements ProjectLinkStore {
   ) {}
 
   public async save(metadata: ProjectLinkMetadata): Promise<void> {
-    await mkdir(this.directory, { mode: 0o700, recursive: true });
-    await chmod(this.directory, 0o700);
-    const target = join(this.directory, "link.json");
-    const temporary = join(this.directory, `.link-${process.pid}.tmp`);
+    if (!ULID.test(metadata.organization_id)) throw new TypeError("Invalid linked organization");
+    const links = join(this.directory, LINKS);
+    for (const directory of [this.directory, links]) {
+      await mkdir(directory, { mode: 0o700, recursive: true });
+      await chmod(directory, 0o700);
+    }
+    const target = join(links, `${metadata.organization_id}.json`);
+    const temporary = join(links, `.link-${process.pid}.tmp`);
     await writeFile(temporary, `${JSON.stringify(metadata)}\n`, { encoding: "utf8", mode: 0o600 });
     await chmod(temporary, 0o600);
     await rename(temporary, target);
@@ -54,6 +187,22 @@ export class OwnerOnlyProjectLinkStore implements ProjectLinkStore {
   }
 }
 
+async function readJson(path: string): Promise<Record<string, unknown> | null> {
+  try {
+    const value: unknown = JSON.parse(await readFile(path, "utf8"));
+    return typeof value === "object" && value !== null && !Array.isArray(value)
+      ? (value as Record<string, unknown>)
+      : null;
+  } catch {
+    return null;
+  }
+}
+
+const isRecord = (value: unknown, keys: readonly string[]): value is Record<string, unknown> =>
+  typeof value === "object" &&
+  value !== null &&
+  Object.keys(value).sort().join(",") === [...keys].sort().join(",");
+
 async function ignoreLinkDirectory(root: string): Promise<void> {
   try {
     await stat(join(root, ".git"));

package/src/apps/product-cli/runtime-contract.ts

@@ -34,7 +34,7 @@ export const PROBLEM_POLICY = {
     status: 409,
     retryable: false,
     action:
-      "Run 'ohmyhost github connect --organization ULID --idempotency-key KEY --json' for this workspace, complete its browser link, then repeat the original source link.",
+      "This workspace has no GitHub connection yet. Run 'ohmyhost github connect --organization ULID --idempotency-key KEY --json' for it, complete its browser link, then repeat the original source link. If the project belongs to another account, use that account's login instead; error.acting_as names the login this ran as.",
   },
   github_connection_revoked: {
     status: 409,
@@ -120,7 +120,12 @@ export const PROBLEM_POLICY = {
     action:
       "Run 'ohmyhost organization list --json' and select one with 'ohmyhost organization use --organization ULID --json', or create the first workspace.",
   },
-  resource_not_found: { status: 404, retryable: false, action: "Check the resource identifier." },
+  resource_not_found: {
+    status: 404,
+    retryable: false,
+    action:
+      "Check the resource identifier and the account: a project is visible only to its own organization, and error.acting_as names the login this ran as. Use the login of the account that owns it.",
+  },
   idempotency_key_reused: {
     status: 409,
     retryable: false,
@@ -889,7 +894,13 @@ export const parseCurrentIdentity = (value: unknown): PublicCurrentIdentity => {
   return input as unknown as PublicCurrentIdentity;
 };
 
-export const parseAccountProfile = (value: unknown): readonly PublicWorkspace[] => {
+/** The signed-in user and the workspaces it belongs to, as `GET /v1/me/profile` reports them. */
+export interface PublicAccount {
+  readonly userId: string;
+  readonly organizations: readonly PublicWorkspace[];
+}
+
+export const parseAccountProfile = (value: unknown): PublicAccount => {
   const input = exactRecord(value, [
     "user_id",
     "name",
@@ -927,7 +938,7 @@ export const parseAccountProfile = (value: unknown): readonly PublicWorkspace[]
   });
   if (new Set(workspaces.map((workspace) => workspace.id)).size !== organizationIds.length)
     throw new ResponseContractError();
-  return workspaces;
+  return { userId: input["user_id"] as string, organizations: workspaces };
 };
 
 export interface PublicProject {

package/src/apps/product-cli/workspace.ts

@@ -1,11 +1,14 @@
 import type { TokenRefresher } from "./cli.js";
 import type { CredentialStore, StoredCredential } from "./credential-store.js";
-import type { PublicWorkspace } from "./runtime-contract.js";
+import type { LocalProfile, ProfileRegistry } from "./profile-store.js";
+import { parseCurrentIdentity, type PublicWorkspace } from "./runtime-contract.js";
 
-/** The credential material a workspace selection needs; absent for a user API token. */
+/** The saved login a workspace selection works on; absent for a user API token. */
 export interface WorkspaceSession {
   readonly store: CredentialStore;
   readonly refresher: TokenRefresher;
+  readonly profiles: ProfileRegistry;
+  readonly profile: LocalProfile;
 }
 
 /** A user API token carries a fixed scope and can never select another workspace. */
@@ -16,6 +19,28 @@ export class InteractiveSessionRequiredError extends Error {
   }
 }
 
+/**
+ * A saved login keeps the organization it was signed in to. Another organization is its own login,
+ * so switching one login between organizations can never retarget another agent's work.
+ */
+export class ProfileOrganizationFixedError extends Error {
+  public constructor(
+    readonly profile: LocalProfile,
+    readonly organization: { readonly id: string },
+  ) {
+    super("The saved login is bound to another organization");
+    this.name = "ProfileOrganizationFixedError";
+  }
+}
+
+/** The provider answered with an identity other than the one that was requested. */
+export class AccountVerificationError extends Error {
+  public constructor() {
+    super("The signed-in account does not match the requested one");
+    this.name = "AccountVerificationError";
+  }
+}
+
 export type WorkspaceSelection =
   | { readonly outcome: "selected"; readonly organization: PublicWorkspace }
   | { readonly outcome: "no_workspace" }
@@ -43,15 +68,45 @@ export const chooseWorkspace = (
   return { outcome: "choice_required", organizations };
 };
 
+/** The user a verified identity answer names; only interactive users and their keys have one. */
+export const verifiedUserId = (identity: unknown): string => {
+  const actor = parseCurrentIdentity(identity).actor_id;
+  if (!actor.startsWith("user:") || actor.length === 5) throw new AccountVerificationError();
+  return actor.slice(5);
+};
+
 /**
- * Put the chosen workspace into the stored credential. The organization lives in the access token,
- * so selecting means asking the provider for a token scoped to it and keeping both identifiers.
+ * Check that a token belongs to the expected user and organization before anything is stored.
+ * A null organization means the token must not carry one.
+ */
+export const assertVerifiedLogin = (
+  identity: unknown,
+  userId: string,
+  organizationId: string | null,
+): void => {
+  const organizations = parseCurrentIdentity(identity).organization_ids;
+  if (
+    verifiedUserId(identity) !== userId ||
+    (organizationId === null
+      ? organizations.length !== 0
+      : organizations.length !== 1 || organizations[0] !== organizationId)
+  )
+    throw new AccountVerificationError();
+};
+
+/**
+ * Bind a saved login that has no organization yet to one of its user's organizations. The provider
+ * scopes the session to that organization and the result is verified before it replaces the login.
  */
 export const selectWorkspace = async (
   session: WorkspaceSession,
   organization: PublicWorkspace,
   signal: AbortSignal,
-): Promise<void> => {
+  identity: (accessToken: string) => Promise<unknown>,
+): Promise<LocalProfile> => {
+  if (session.profile.organizationId === organization.id) return session.profile;
+  if (session.profile.organizationId !== null)
+    throw new ProfileOrganizationFixedError(session.profile, organization);
   const stored = await session.store.read();
   if (stored === undefined) throw new InteractiveSessionRequiredError();
   const refreshed = await session.refresher.refresh(
@@ -59,17 +114,24 @@ export const selectWorkspace = async (
     signal,
     organization.workos_id,
   );
-  await session.store.replace({
-    ...refreshed,
-    workosOrganizationId: organization.workos_id,
+  assertVerifiedLogin(
+    await identity(refreshed.accessToken),
+    session.profile.userId,
+    organization.id,
+  );
+  const bound: LocalProfile = {
+    ...session.profile,
     organizationId: organization.id,
-  });
+    organizationName: organization.name,
+  };
+  await session.profiles.save(
+    bound,
+    { ...refreshed, workosOrganizationId: organization.workos_id, organizationId: organization.id },
+    session.profile,
+  );
+  return bound;
 };
 
-/** The workspace the stored credential is scoped to, or null while none was selected. */
-export const selectedWorkspaceId = async (session: WorkspaceSession): Promise<string | null> =>
-  (await session.store.read())?.organizationId ?? null;
-
 /**
  * The workspace fields of a credential, present only once one has been selected. A refresh returns
  * a bare credential, so carrying these forward is what keeps the selection alive.