@amodalai/amodal 0.1.2

package/src/commands/login.test.ts

@@ -0,0 +1,195 @@
+/**
+ * @license
+ * Copyright 2025 Amodal Labs, Inc.
+ * SPDX-License-Identifier: MIT
+ */
+
+import {describe, it, expect, vi, beforeEach, afterEach} from 'vitest';
+import {createServer} from 'node:http';
+import type {Server} from 'node:http';
+
+const mockReadFile = vi.fn();
+const mockWriteFile = vi.fn();
+const mockMkdir = vi.fn();
+const mockOpen = vi.fn();
+
+vi.mock('node:fs/promises', () => ({
+  readFile: mockReadFile,
+  writeFile: mockWriteFile,
+  mkdir: mockMkdir,
+}));
+
+vi.mock('open', () => ({
+  default: mockOpen,
+}));
+
+describe('runLogin', () => {
+  let stderrOutput: string;
+  let mockPlatformServer: Server;
+  let platformPort: number;
+
+  beforeEach(async () => {
+    vi.clearAllMocks();
+    mockReadFile.mockRejectedValue(new Error('ENOENT'));
+    mockWriteFile.mockResolvedValue(undefined);
+    mockMkdir.mockResolvedValue(undefined);
+    stderrOutput = '';
+    vi.spyOn(process.stderr, 'write').mockImplementation((chunk) => {
+      stderrOutput += String(chunk);
+      return true;
+    });
+
+    // Start a mock platform API server (for /api/me verification)
+    await new Promise<void>((resolve) => {
+      mockPlatformServer = createServer((req, res) => {
+        if (req.url === '/api/me') {
+          res.writeHead(200, {'Content-Type': 'application/json'});
+          res.end(JSON.stringify({
+            user: {email: 'test@example.com', name: 'Test User'},
+            org: {name: 'Test Org'},
+          }));
+          return;
+        }
+        res.writeHead(404);
+        res.end('Not found');
+      });
+      mockPlatformServer.listen(0, '127.0.0.1', () => {
+        const addr = mockPlatformServer.address();
+        if (addr && typeof addr !== 'string') {
+          platformPort = addr.port;
+        }
+        resolve();
+      });
+    });
+  });
+
+  afterEach(() => {
+    mockPlatformServer?.close();
+  });
+
+  it('should skip login when already authenticated', async () => {
+    const url = `http://127.0.0.1:${platformPort}`;
+    mockReadFile.mockResolvedValue(JSON.stringify({
+      platform: {url, token: 'existing-token'},
+    }));
+
+    const {runLogin} = await import('./login.js');
+    const result = await runLogin({platformUrl: url});
+    expect(result).toBe(0);
+    expect(stderrOutput).toContain('Already logged in');
+  });
+
+  it('should open browser and complete login on callback', async () => {
+    // Mock open to simulate browser: extract port from URL and call callback
+    mockOpen.mockImplementation(async (loginUrl: string) => {
+      const url = new URL(loginUrl);
+      const port = url.searchParams.get('port');
+      const state = url.searchParams.get('state');
+      // Simulate browser redirect to callback
+      await fetch(
+        `http://127.0.0.1:${port}/callback?token=test-jwt-token&refresh_token=test-refresh&state=${state}`,
+      );
+    });
+
+    const {runLogin} = await import('./login.js');
+    const result = await runLogin({
+      platformUrl: `http://127.0.0.1:${platformPort}`,
+      adminUrl: 'http://localhost:9999', // Not actually hit — open is mocked
+    });
+    expect(result).toBe(0);
+    expect(stderrOutput).toContain('Logged in as test@example.com');
+    expect(stderrOutput).toContain('org: Test Org');
+    expect(mockWriteFile).toHaveBeenCalled();
+
+    // Verify the saved content
+    const writeCall = mockWriteFile.mock.calls[0];
+     
+    const content = writeCall[1] as string;
+    expect(content).toContain('test-jwt-token');
+    expect(content).toContain('test-refresh');
+  });
+
+  it('should open admin UI URL, not platform API', async () => {
+    mockOpen.mockImplementation(async (loginUrl: string) => {
+      const url = new URL(loginUrl);
+      // Verify it opens the admin UI
+      expect(url.origin).toBe('http://localhost:3333');
+      expect(url.pathname).toBe('/cli-auth');
+      expect(url.searchParams.get('port')).toBeTruthy();
+      expect(url.searchParams.get('state')).toBeTruthy();
+
+      const port = url.searchParams.get('port');
+      const state = url.searchParams.get('state');
+      await fetch(
+        `http://127.0.0.1:${port}/callback?token=jwt&state=${state}`,
+      );
+    });
+
+    const {runLogin} = await import('./login.js');
+    await runLogin({
+      platformUrl: `http://127.0.0.1:${platformPort}`,
+      adminUrl: 'http://localhost:3333',
+    });
+
+    expect(mockOpen).toHaveBeenCalledOnce();
+  });
+
+  it('should return 1 when state mismatches', async () => {
+    mockOpen.mockImplementation(async (loginUrl: string) => {
+      const url = new URL(loginUrl);
+      const port = url.searchParams.get('port');
+      // Send back wrong state
+      await fetch(
+        `http://127.0.0.1:${port}/callback?token=test-jwt&state=wrong-state`,
+      );
+    });
+
+    const {runLogin} = await import('./login.js');
+    const result = await runLogin({
+      platformUrl: `http://127.0.0.1:${platformPort}`,
+      adminUrl: 'http://localhost:9999',
+    });
+    expect(result).toBe(1);
+    expect(stderrOutput).toContain('State mismatch');
+  });
+
+  it('should handle callback error from browser', async () => {
+    mockOpen.mockImplementation(async (loginUrl: string) => {
+      const url = new URL(loginUrl);
+      const port = url.searchParams.get('port');
+      await fetch(
+        `http://127.0.0.1:${port}/callback?error=access_denied`,
+      );
+    });
+
+    const {runLogin} = await import('./login.js');
+    const result = await runLogin({
+      platformUrl: `http://127.0.0.1:${platformPort}`,
+      adminUrl: 'http://localhost:9999',
+    });
+    expect(result).toBe(1);
+    expect(stderrOutput).toContain('access_denied');
+  });
+
+  it('should save credentials with restricted file permissions', async () => {
+    mockOpen.mockImplementation(async (loginUrl: string) => {
+      const url = new URL(loginUrl);
+      const port = url.searchParams.get('port');
+      const state = url.searchParams.get('state');
+      await fetch(
+        `http://127.0.0.1:${port}/callback?token=jwt123&state=${state}`,
+      );
+    });
+
+    const {runLogin} = await import('./login.js');
+    await runLogin({
+      platformUrl: `http://127.0.0.1:${platformPort}`,
+      adminUrl: 'http://localhost:9999',
+    });
+
+    const writeCall = mockWriteFile.mock.calls[0];
+     
+    const options = writeCall[2] as {mode: number};
+    expect(options.mode).toBe(0o600);
+  });
+});

package/src/commands/login.ts

@@ -0,0 +1,258 @@
+/**
+ * @license
+ * Copyright 2025 Amodal Labs, Inc.
+ * SPDX-License-Identifier: MIT
+ */
+
+import {writeFile, readFile, mkdir} from 'node:fs/promises';
+import {createServer} from 'node:http';
+import type {Server} from 'node:http';
+import {homedir} from 'node:os';
+import * as path from 'node:path';
+import {randomUUID} from 'node:crypto';
+
+import type {CommandModule} from 'yargs';
+import open from 'open';
+
+const DEFAULT_PLATFORM_URL = 'https://api.amodalai.com';
+const DEFAULT_ADMIN_UI_URL = 'https://app.amodalai.com';
+const RC_FILE = '.amodalrc';
+const LOGIN_TIMEOUT_MS = 120_000;
+
+export interface LoginOptions {
+  platformUrl?: string;
+  adminUrl?: string;
+}
+
+interface RcFile {
+  platform?: {
+    url: string;
+    token: string;
+    refreshToken?: string;
+  };
+}
+
+export async function readRcFile(): Promise<RcFile> {
+  const rcPath = path.join(homedir(), RC_FILE);
+  try {
+    const content = await readFile(rcPath, 'utf-8');
+    // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
+    return JSON.parse(content) as RcFile;
+  } catch {
+    return {};
+  }
+}
+
+async function writeRcFile(rc: RcFile): Promise<void> {
+  const rcPath = path.join(homedir(), RC_FILE);
+  await mkdir(path.dirname(rcPath), {recursive: true});
+  await writeFile(rcPath, JSON.stringify(rc, null, 2) + '\n', {mode: 0o600});
+}
+
+/**
+ * Start a local callback server that receives the token from the browser.
+ */
+function startCallbackServer(): Promise<{
+  server: Server;
+  port: number;
+  tokenPromise: Promise<{token: string; refreshToken: string; state: string}>;
+}> {
+  return new Promise((resolve, reject) => {
+    let resolveToken: (value: {token: string; refreshToken: string; state: string}) => void;
+    let rejectToken: (reason: Error) => void;
+    const tokenPromise = new Promise<{token: string; refreshToken: string; state: string}>(
+      (res, rej) => {
+        resolveToken = res;
+        rejectToken = rej;
+      },
+    );
+
+    const server = createServer((req, res) => {
+      try {
+        const url = new URL(req.url ?? '/', 'http://localhost');
+        if (url.pathname !== '/callback') {
+          res.writeHead(404);
+          res.end('Not found');
+          return;
+        }
+
+        const token = url.searchParams.get('token');
+        const refreshToken = url.searchParams.get('refresh_token') ?? '';
+        const state = url.searchParams.get('state');
+        const error = url.searchParams.get('error');
+
+        if (error) {
+          res.writeHead(200, {'Content-Type': 'text/html'});
+          res.end(
+            '<html><body style="background:#0a0a0a;color:#fff;font-family:sans-serif;display:flex;align-items:center;justify-content:center;height:100vh">' +
+              '<div><h1>Login Failed</h1><p>You can close this window.</p></div></body></html>',
+          );
+          rejectToken(new Error(`Login error: ${error}`));
+          return;
+        }
+
+        if (!token || !state) {
+          res.writeHead(400, {'Content-Type': 'text/html'});
+          res.end(
+            '<html><body style="background:#0a0a0a;color:#fff;font-family:sans-serif;display:flex;align-items:center;justify-content:center;height:100vh">' +
+              '<div><h1>Missing Parameters</h1></div></body></html>',
+          );
+          rejectToken(new Error('Missing token or state parameter'));
+          return;
+        }
+
+        res.writeHead(200, {'Content-Type': 'text/html'});
+        res.end(
+          '<html><body style="background:#0a0a0a;color:#fff;font-family:sans-serif;display:flex;align-items:center;justify-content:center;height:100vh">' +
+            '<div><h1>Login Successful</h1><p>You can close this window and return to the terminal.</p></div></body></html>',
+        );
+        resolveToken({token, refreshToken, state});
+      } catch (err) {
+        res.writeHead(500);
+        res.end('Internal error');
+        rejectToken(err instanceof Error ? err : new Error(String(err)));
+      }
+    });
+
+    server.listen(0, '127.0.0.1', () => {
+      const addr = server.address();
+      if (!addr || typeof addr === 'string') {
+        server.close();
+        reject(new Error('Failed to get callback server port'));
+        return;
+      }
+      resolve({server, port: addr.port, tokenPromise});
+    });
+
+    server.on('error', (err) => {
+      reject(new Error(`Failed to start callback server: ${err.message}`));
+    });
+  });
+}
+
+/**
+ * Log in to the amodal platform via browser OAuth.
+ *
+ * Opens the admin UI's /cli-auth page in the browser. After the user
+ * authenticates via Supabase, the admin UI redirects the token back
+ * to a local callback server.
+ *
+ * Returns 0 on success, 1 on error.
+ */
+export async function runLogin(options: LoginOptions = {}): Promise<number> {
+  const platformUrl = options.platformUrl ?? process.env['PLATFORM_API_URL'] ?? DEFAULT_PLATFORM_URL;
+  const adminUrl = options.adminUrl ?? process.env['ADMIN_UI_URL'] ?? DEFAULT_ADMIN_UI_URL;
+
+  // Check if already logged in
+  const rc = await readRcFile();
+  if (rc.platform?.url === platformUrl && rc.platform.token) {
+    process.stderr.write(`[login] Already logged in to ${platformUrl}\n`);
+    process.stderr.write('[login] Run `amodal logout` first, or use --platform-url for a different instance.\n');
+    return 0;
+  }
+
+  // Start local callback server
+  let server: Server | undefined;
+  try {
+    const {server: srv, port, tokenPromise} = await startCallbackServer();
+    server = srv;
+    // Prevent unhandled rejection if tokenPromise rejects after we've moved on
+    tokenPromise.catch(() => {});
+
+    const state = randomUUID();
+
+    // Build the admin UI login page URL
+    const loginUrl = new URL(`${adminUrl}/cli-auth`);
+    loginUrl.searchParams.set('port', String(port));
+    loginUrl.searchParams.set('state', state);
+
+    // Open browser
+    process.stderr.write('[login] Opening browser for authentication...\n');
+    try {
+      await open(loginUrl.toString());
+    } catch {
+      process.stderr.write(`\nOpen this URL in your browser to log in:\n${loginUrl.toString()}\n\n`);
+    }
+
+    process.stderr.write('[login] Waiting for browser login...\n');
+
+    // Wait for callback or timeout
+    const timeoutPromise = new Promise<never>((_resolve, reject) => {
+      setTimeout(() => {
+        reject(new Error(`Login timed out after ${LOGIN_TIMEOUT_MS / 1000}s`));
+      }, LOGIN_TIMEOUT_MS);
+    });
+
+    const result = await Promise.race([tokenPromise, timeoutPromise]);
+
+    // Verify CSRF state
+    if (result.state !== state) {
+      process.stderr.write('[login] State mismatch — possible CSRF attack. Login aborted.\n');
+      return 1;
+    }
+
+    // Verify the token works by calling /api/me
+    process.stderr.write('[login] Verifying credentials...\n');
+    const meResponse = await fetch(`${platformUrl}/api/me`, {
+      headers: {Authorization: `Bearer ${result.token}`},
+    });
+
+    if (!meResponse.ok) {
+      process.stderr.write('[login] Token verification failed. Please try again.\n');
+      return 1;
+    }
+
+    // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
+    const me = (await meResponse.json()) as Record<string, unknown>;
+    // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
+    const user = me['user'] as Record<string, string> | null;
+    // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
+    const org = me['org'] as Record<string, string> | null;
+
+    // Save credentials
+    rc.platform = {
+      url: platformUrl,
+      token: result.token,
+      refreshToken: result.refreshToken || undefined,
+    };
+    await writeRcFile(rc);
+
+    const identity = user?.['email'] ?? user?.['name'] ?? 'unknown';
+    const orgName = org?.['name'] ?? '';
+    process.stderr.write(
+      `[login] Logged in as ${identity}${orgName ? ` (org: ${orgName})` : ''}\n`,
+    );
+    return 0;
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    process.stderr.write(`[login] ${msg}\n`);
+    return 1;
+  } finally {
+    if (server) {
+      server.close();
+    }
+  }
+}
+
+export const loginCommand: CommandModule = {
+  command: 'login',
+  describe: 'Log in to the amodal platform',
+  builder: (yargs) =>
+    yargs
+      .option('platform-url', {
+        type: 'string',
+        describe: 'Platform API URL (default: $PLATFORM_API_URL or https://api.amodalai.com)',
+      })
+      .option('admin-url', {
+        type: 'string',
+        describe: 'Admin UI URL (default: $ADMIN_UI_URL or https://app.amodalai.com)',
+      }),
+  handler: async (argv) => {
+    // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
+    const platformUrl = argv['platformUrl'] as string | undefined;
+    // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
+    const adminUrl = argv['adminUrl'] as string | undefined;
+    const code = await runLogin({platformUrl, adminUrl});
+    process.exit(code);
+  },
+};

package/src/commands/promote.ts

@@ -0,0 +1,64 @@
+/**
+ * @license
+ * Copyright 2025 Amodal Labs, Inc.
+ * SPDX-License-Identifier: MIT
+ */
+
+import type {CommandModule} from 'yargs';
+import {PlatformClient} from '../shared/platform-client.js';
+
+export interface PromoteOptions {
+  fromEnv: string;
+  toEnv?: string;
+}
+
+/**
+ * Promote a deployment from one environment to another.
+ */
+export async function runPromote(options: PromoteOptions): Promise<number> {
+  let client: PlatformClient;
+  try {
+    client = new PlatformClient();
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    process.stderr.write(`[promote] ${msg}\n`);
+    return 1;
+  }
+
+  const toEnv = options.toEnv ?? 'production';
+
+  try {
+    const result = await client.promote(options.fromEnv, toEnv);
+    process.stderr.write(`[promote] Promoted from ${options.fromEnv} to ${toEnv}: ${result.id}\n`);
+    return 0;
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    process.stderr.write(`[promote] Failed: ${msg}\n`);
+    return 1;
+  }
+}
+
+export const promoteCommand: CommandModule = {
+  command: 'promote <from-env>',
+  describe: 'Promote a deployment to production',
+  builder: (yargs) =>
+    yargs
+      .positional('from-env', {
+        type: 'string',
+        demandOption: true,
+        describe: 'Source environment to promote from',
+      })
+      .option('to', {
+        type: 'string',
+        describe: 'Target environment (default: production)',
+      }),
+  handler: async (argv) => {
+    const code = await runPromote({
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
+      fromEnv: argv['fromEnv'] as string,
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion
+      toEnv: argv['to'] as string | undefined,
+    });
+    process.exit(code);
+  },
+};