@amerged/ohmyhost-mcp 0.1.48 → 0.1.50

package/src/apps/product-cli/src/command.ts

@@ -26,6 +26,8 @@ import {
   type ProjectDataChangeKind,
 } from "@ohmyhost/contracts/project-data-changes";
 import type { ManagedMailCommand, SharedMailCommand } from "@ohmyhost/sdk-ts";
+import type { NativeAuthCommand } from "./native-auth.js";
+import { isNativeAuthRedirectPath } from "@ohmyhost/contracts/native-auth";
 import { USER_API_KEY_ID } from "@ohmyhost/contracts/user-api-keys";
 import { WORKOS_USER_API_KEY_PATTERN } from "@ohmyhost/workos-auth-contracts/user-api-keys";
 import { isProfileName, isProfileUserId } from "./profile-store.js";
@@ -86,6 +88,14 @@ export type SourceCliCommand =
     };
 export type ProductCliCommand =
   | SourceCliCommand
+  | {
+      readonly kind: "native-auth";
+      readonly request: NativeAuthCommand;
+      readonly stdin: boolean;
+      readonly credentialStore: "native";
+      readonly environmentToken?: HandedAccount;
+      readonly profileAccount?: HandedAccount;
+    }
   | {
       readonly kind: "project-data-plan";
       readonly projectId: string;
@@ -978,6 +988,7 @@ function parseSourceCommand(values: string[], wait: boolean): SourceCliCommand {
 }
 
 export type RecognizedCommandLabel =
+  | "auth"
   | "source inspect"
   | "source status"
   | "source files"
@@ -1291,6 +1302,7 @@ export const recognizedCommandLabel = (argv: readonly string[]): RecognizedComma
       if (values[0] === "set") return "secret set";
       if (values[0] === "delete") return "secret delete";
     }
+    if (value === "auth") return "auth";
     if (value === "function" && values[0] === "runs") return "function runs";
     if (value === "mail") {
       if (["workspace", "binding", "identity"].includes(values[0] ?? "")) {
@@ -1350,6 +1362,229 @@ export const parseProductCliCommand = (argv: readonly string[]): ProductCliComma
   const follow = removeFlag(values, "--follow");
   const stdin = removeFlag(values, "--stdin");
   const first = values.shift();
+  if (first === "auth") {
+    if (dryRun || revoke || yes || wait || follow) throw new InvalidCommandError();
+    const area = values.shift();
+    const action = values.shift();
+    const actionKey = `${area}_${action}`;
+    const options = parseOptionalOptions(values, [
+      "--project",
+      "--environment",
+      "--idempotency-key",
+      "--revision",
+      "--enabled",
+      "--signup-policy",
+      "--application-name",
+      "--canonical-origin",
+      "--allowed-redirect-paths",
+      "--reset-password-path",
+      "--invitation-path",
+      "--provider",
+      "--client-id",
+      "--user",
+      "--email",
+      "--limit",
+      "--cursor",
+      "--search",
+      "--token-user",
+      "--token-organization",
+      "--profile-user",
+      "--profile-organization",
+    ]);
+    const actionOptions: Readonly<Record<string, readonly string[]>> = {
+      config_get: [],
+      config_set: [
+        "--idempotency-key",
+        "--revision",
+        "--enabled",
+        "--signup-policy",
+        "--application-name",
+        "--canonical-origin",
+        "--allowed-redirect-paths",
+        "--reset-password-path",
+        "--invitation-path",
+      ],
+      provider_get: ["--provider"],
+      provider_set: [
+        "--provider",
+        "--idempotency-key",
+        "--revision",
+        "--enabled",
+        "--client-id",
+        "--token-user",
+        "--token-organization",
+        "--profile-user",
+        "--profile-organization",
+      ],
+      users_list: ["--limit", "--cursor", "--search"],
+      user_create: ["--idempotency-key", "--email"],
+      user_get: ["--user"],
+      user_delete: ["--user", "--idempotency-key"],
+      user_invite: ["--user", "--idempotency-key"],
+      user_suspend: ["--user", "--idempotency-key"],
+      user_reactivate: ["--user", "--idempotency-key"],
+      "user_revoke-sessions": ["--user", "--idempotency-key"],
+    };
+    const admittedOptions = actionOptions[actionKey];
+    if (
+      !admittedOptions ||
+      Object.keys(options).some(
+        (key) => key !== "--project" && key !== "--environment" && !admittedOptions.includes(key),
+      )
+    )
+      throw new InvalidCommandError();
+    const projectId = options["--project"],
+      environmentId = options["--environment"];
+    if (!projectId || !environmentId) throw new InvalidCommandError();
+    const scope = { projectId, environmentId };
+    const idempotencyKey = options["--idempotency-key"];
+    const revision = Number(options["--revision"]);
+    const enabled =
+      options["--enabled"] === "true" ? true : options["--enabled"] === "false" ? false : null;
+    const provider = options["--provider"];
+    const userId = options["--user"];
+    let request: NativeAuthCommand;
+    if (actionKey === "config_get") request = { ...scope, action: "config_get" };
+    else if (
+      actionKey === "config_set" &&
+      idempotencyKey &&
+      Number.isSafeInteger(revision) &&
+      revision >= 0 &&
+      enabled !== null &&
+      (options["--signup-policy"] === "open" || options["--signup-policy"] === "invite-only") &&
+      options["--application-name"]
+    ) {
+      const rawPaths = options["--allowed-redirect-paths"];
+      let paths: unknown;
+      if (rawPaths !== undefined) {
+        try {
+          paths = JSON.parse(rawPaths);
+        } catch {
+          throw new InvalidCommandError();
+        }
+        if (
+          !Array.isArray(paths) ||
+          paths.length < 1 ||
+          paths.length > 16 ||
+          !paths.every(isNativeAuthRedirectPath) ||
+          new Set(paths).size !== paths.length
+        )
+          throw new InvalidCommandError();
+      }
+      for (const path of [options["--reset-password-path"], options["--invitation-path"]]) {
+        if (
+          path !== undefined &&
+          (!isNativeAuthRedirectPath(path) || (Array.isArray(paths) && !paths.includes(path)))
+        )
+          throw new InvalidCommandError();
+      }
+      const origin = options["--canonical-origin"];
+      if (origin !== undefined && origin !== "primary") {
+        try {
+          const url = new URL(origin);
+          if (url.protocol !== "https:" || url.origin !== origin || url.username || url.password)
+            throw new InvalidCommandError();
+        } catch {
+          throw new InvalidCommandError();
+        }
+      }
+      request = {
+        ...scope,
+        action: "config_set",
+        idempotencyKey,
+        configurationRevision: revision,
+        enabled,
+        signupPolicy: options["--signup-policy"],
+        applicationName: options["--application-name"],
+        ...(options["--canonical-origin"] === undefined
+          ? {}
+          : {
+              canonicalOrigin:
+                options["--canonical-origin"] === "primary" ? null : options["--canonical-origin"],
+            }),
+        ...(paths === undefined ? {} : { allowedRedirectPaths: paths as string[] }),
+        ...(options["--reset-password-path"] === undefined
+          ? {}
+          : { resetPasswordPath: options["--reset-password-path"] }),
+        ...(options["--invitation-path"] === undefined
+          ? {}
+          : { invitationPath: options["--invitation-path"] }),
+      };
+    } else if (actionKey === "provider_get" && (provider === "google" || provider === "github"))
+      request = { ...scope, action: "provider_get", provider };
+    else if (
+      actionKey === "provider_set" &&
+      idempotencyKey &&
+      Number.isSafeInteger(revision) &&
+      revision >= 0 &&
+      enabled !== null &&
+      (provider === "google" || provider === "github")
+    )
+      request = {
+        ...scope,
+        action: "provider_set",
+        provider,
+        idempotencyKey,
+        configurationRevision: revision,
+        enabled,
+        ...(options["--client-id"] ? { clientId: options["--client-id"] } : {}),
+      };
+    else if (actionKey === "users_list") {
+      const limit = options["--limit"] === undefined ? undefined : Number(options["--limit"]);
+      if (limit !== undefined && (!Number.isInteger(limit) || limit < 1 || limit > 100))
+        throw new InvalidCommandError();
+      request = {
+        ...scope,
+        action: "users_list",
+        ...(limit === undefined ? {} : { limit }),
+        ...(options["--cursor"] ? { cursor: options["--cursor"] } : {}),
+        ...(options["--search"] ? { search: options["--search"] } : {}),
+      };
+    } else if (actionKey === "user_create" && idempotencyKey && options["--email"])
+      request = { ...scope, action: "user_create", idempotencyKey, email: options["--email"] };
+    else if (actionKey === "user_get" && userId) request = { ...scope, action: "user_get", userId };
+    else if (
+      idempotencyKey &&
+      userId &&
+      [
+        "user_delete",
+        "user_invite",
+        "user_suspend",
+        "user_reactivate",
+        "user_revoke-sessions",
+      ].includes(actionKey)
+    )
+      request = {
+        ...scope,
+        action: (actionKey === "user_revoke-sessions" ? "user_revoke_sessions" : actionKey) as
+          | "user_delete"
+          | "user_invite"
+          | "user_suspend"
+          | "user_reactivate"
+          | "user_revoke_sessions",
+        userId,
+        idempotencyKey,
+      };
+    else throw new InvalidCommandError();
+    if (stdin && request.action !== "provider_set") throw new InvalidCommandError();
+    const environmentToken = handedAccount(
+      options["--token-user"],
+      options["--token-organization"],
+    );
+    const profileAccount = handedAccount(
+      options["--profile-user"],
+      options["--profile-organization"],
+    );
+    if (environmentToken && profileAccount) throw new InvalidCommandError();
+    return {
+      kind: "native-auth",
+      request,
+      stdin,
+      credentialStore,
+      ...(environmentToken ? { environmentToken } : {}),
+      ...(profileAccount ? { profileAccount } : {}),
+    };
+  }
   if (first === "source" && values[0] !== "auto-deploy") {
     if (dryRun || revoke || yes || follow || stdin) throw new InvalidCommandError();
     return parseSourceCommand(values, wait);

package/src/apps/product-cli/src/composition.ts

@@ -746,11 +746,16 @@ export const runProductionCli = async (
   }
   // A command handed over from an OHMYHOST_TOKEN process runs only with a key of that account,
   // never with a saved login, even one of the same user.
-  const requiredToken = command.kind === "secret-set" ? command.environmentToken : undefined;
+  const requiredToken =
+    command.kind === "secret-set" || command.kind === "native-auth"
+      ? command.environmentToken
+      : undefined;
   // Either handed form names its account; the login or key that would run it must be exactly that
   // account, so a login of the same name on another computer is refused before anything is read.
   const handedAccount =
-    command.kind === "secret-set" ? (requiredToken ?? command.profileAccount) : undefined;
+    command.kind === "secret-set" || command.kind === "native-auth"
+      ? (requiredToken ?? command.profileAccount)
+      : undefined;
   if (requiredToken !== undefined && apiToken === undefined)
     return written(
       errorDocument(

package/src/apps/product-cli/src/index.ts

@@ -33,3 +33,4 @@ export {
 } from "./runtime-contract.js";
 
 export * from "./user-token-file.js";
+export * from "./native-auth.js";

package/src/apps/product-cli/src/native-auth.ts

@@ -0,0 +1,172 @@
+import * as sdk from "@ohmyhost/sdk-ts";
+
+type Scope = { readonly projectId: string; readonly environmentId: string };
+type Write = { readonly idempotencyKey: string };
+export type NativeAuthCommand = Scope &
+  (
+    | { action: "config_get" }
+    | (Write & {
+        action: "config_set";
+        configurationRevision: number;
+        enabled: boolean;
+        signupPolicy: "open" | "invite-only";
+        applicationName: string;
+        canonicalOrigin?: string | null;
+        allowedRedirectPaths?: readonly string[];
+        resetPasswordPath?: string;
+        invitationPath?: string;
+      })
+    | { action: "provider_get"; provider: "google" | "github" }
+    | (Write & {
+        action: "provider_set";
+        provider: "google" | "github";
+        configurationRevision: number;
+        enabled: boolean;
+        clientId?: string;
+        clientSecret?: string;
+      })
+    | { action: "users_list"; limit?: number; cursor?: string; search?: string }
+    | (Write & { action: "user_create"; email: string })
+    | { action: "user_get"; userId: string }
+    | (Write & {
+        action:
+          | "user_delete"
+          | "user_invite"
+          | "user_suspend"
+          | "user_reactivate"
+          | "user_revoke_sessions";
+        userId: string;
+      })
+  );
+
+/** All local clients use the generated SDK and never return provider input secrets. */
+export async function executeNativeAuth(
+  client: sdk.OhMyHostClient,
+  command: NativeAuthCommand,
+): Promise<unknown> {
+  const scope = { project_id: command.projectId, environment_id: command.environmentId };
+  const options = { client };
+  switch (command.action) {
+    case "config_get":
+      return sdk.getNativeAuthConfiguration(scope, options);
+    case "config_set":
+      return sdk.updateNativeAuthConfiguration(
+        {
+          ...scope,
+          "Idempotency-Key": command.idempotencyKey,
+          nativeAuthConfigurationUpdate: {
+            configurationRevision: command.configurationRevision,
+            enabled: command.enabled,
+            signupPolicy: command.signupPolicy,
+            applicationName: command.applicationName,
+            ...(command.canonicalOrigin === undefined
+              ? {}
+              : { canonicalOrigin: command.canonicalOrigin }),
+            ...(command.allowedRedirectPaths === undefined
+              ? {}
+              : { allowedRedirectPaths: [...command.allowedRedirectPaths] }),
+            ...(command.resetPasswordPath === undefined
+              ? {}
+              : { resetPasswordPath: command.resetPasswordPath }),
+            ...(command.invitationPath === undefined
+              ? {}
+              : { invitationPath: command.invitationPath }),
+          },
+        },
+        options,
+      );
+    case "provider_get": {
+      const result = await sdk.getNativeAuthProvider(
+        { ...scope, provider: command.provider },
+        options,
+      );
+      return providerStatus(result);
+    }
+    case "provider_set": {
+      const result = await sdk.updateNativeAuthProvider(
+        {
+          ...scope,
+          provider: command.provider,
+          "Idempotency-Key": command.idempotencyKey,
+          nativeAuthProviderUpdateWritable: {
+            configurationRevision: command.configurationRevision,
+            enabled: command.enabled,
+            ...(command.clientId === undefined ? {} : { clientId: command.clientId }),
+            ...(command.clientSecret === undefined ? {} : { clientSecret: command.clientSecret }),
+          },
+        },
+        options,
+      );
+      return providerStatus(result);
+    }
+    case "users_list":
+      return sdk.listNativeAuthUsers(
+        {
+          ...scope,
+          ...(command.limit === undefined ? {} : { limit: command.limit }),
+          ...(command.cursor === undefined ? {} : { cursor: command.cursor }),
+          ...(command.search === undefined ? {} : { search: command.search }),
+        },
+        options,
+      );
+    case "user_create":
+      return sdk.createNativeAuthUser(
+        {
+          ...scope,
+          "Idempotency-Key": command.idempotencyKey,
+          nativeAuthUserCreate: { email: command.email },
+        },
+        options,
+      );
+    case "user_get":
+      return sdk.getNativeAuthUser({ ...scope, user_id: command.userId }, options);
+    case "user_delete":
+      return sdk.deleteNativeAuthUser(
+        { ...scope, user_id: command.userId, "Idempotency-Key": command.idempotencyKey },
+        options,
+      );
+    case "user_invite":
+      return sdk.resendNativeAuthInvitation(
+        { ...scope, user_id: command.userId, "Idempotency-Key": command.idempotencyKey },
+        options,
+      );
+    case "user_suspend":
+      return sdk.suspendNativeAuthUser(
+        { ...scope, user_id: command.userId, "Idempotency-Key": command.idempotencyKey },
+        options,
+      );
+    case "user_reactivate":
+      return sdk.reactivateNativeAuthUser(
+        { ...scope, user_id: command.userId, "Idempotency-Key": command.idempotencyKey },
+        options,
+      );
+    case "user_revoke_sessions":
+      return sdk.revokeNativeAuthUserSessions(
+        { ...scope, user_id: command.userId, "Idempotency-Key": command.idempotencyKey },
+        options,
+      );
+  }
+}
+
+function providerStatus(result: sdk.NativeAuthProviderStatus): sdk.NativeAuthProviderStatus {
+  const {
+    provider,
+    enabled,
+    configured,
+    clientId,
+    secretPresent,
+    callbackUrl,
+    scopes,
+    lastSuccessfulFlowAt,
+  } = result;
+  return {
+    provider,
+    enabled,
+    configured,
+    clientId,
+    secretPresent,
+    callbackUrl,
+    scopes,
+    lastSuccessfulFlowAt,
+  };
+}

package/src/apps/product-cli/src/product-api.ts

@@ -4,6 +4,7 @@ import {
   type ManagedMailCommand,
   type SharedMailCommand,
 } from "@ohmyhost/sdk-ts";
+import { executeNativeAuth, type NativeAuthCommand } from "./native-auth.js";
 import type {
   ProjectDataChangeKind,
   ProjectDataChangePlan,
@@ -257,6 +258,7 @@ export interface DatabaseTableAnswer {
 }
 
 export interface ProductApi {
+  nativeAuth?(input: NativeAuthCommand): Promise<unknown>;
   readonly managedSource?: ManagedSourceApi;
   planProjectDataChange(input: {
     projectId: string;
@@ -1810,4 +1812,8 @@ export class GeneratedSdkProductApi implements ProductApi {
   public managedMail(input: ManagedMailCommand) {
     return executeManagedMail(this.#client, input);
   }
+
+  public nativeAuth(input: NativeAuthCommand) {
+    return executeNativeAuth(this.#client, input);
+  }
 }