@aopslabs/aops 0.2.0

package/dist/commands/auth/device-login.js

@@ -0,0 +1 @@
+export { REMOTE_SESSION_DEVICE_GRANT_TYPE, runRemoteSessionDeviceLogin, } from '@aopslabs/api-client';

package/dist/commands/auth/legacy-export.js

@@ -0,0 +1,177 @@
+import { createHash } from 'node:crypto';
+import { closeSync, constants, existsSync, fsyncSync, openSync, writeFileSync, } from 'node:fs';
+import path from 'node:path';
+import { readAopsServerEnvFileContent } from '@aopslabs/aops-runtime-config';
+import { Client } from 'pg';
+import { parseDotEnvAssignments } from '../../lib/server-bootstrap.js';
+const LEGACY_RELATIONS = Object.freeze([
+    'authv2_users',
+    'authv2_roles',
+    'authv2_user_roles',
+]);
+function normalizeNonEmpty(value) {
+    if (typeof value !== 'string')
+        return undefined;
+    const normalized = value.trim();
+    return normalized || undefined;
+}
+function normalizeValue(value) {
+    if (value instanceof Date)
+        return value.toISOString();
+    if (Array.isArray(value))
+        return value.map(normalizeValue);
+    if (value && typeof value === 'object') {
+        return Object.fromEntries(Object.entries(value)
+            .sort(([left], [right]) => left.localeCompare(right))
+            .map(([key, entry]) => [key, normalizeValue(entry)]));
+    }
+    return value;
+}
+function stableJson(value) {
+    return `${JSON.stringify(normalizeValue(value), null, 2)}\n`;
+}
+function resolveLegacyRepoUrl(options) {
+    const processUrl = normalizeNonEmpty(process.env.AOPS_PG_URL);
+    if (processUrl)
+        return processUrl;
+    const snapshot = readAopsServerEnvFileContent(process.env, options.envPath);
+    const assignments = parseDotEnvAssignments(snapshot.content);
+    const saved = normalizeNonEmpty(assignments.AOPS_PG_URL);
+    if (!saved) {
+        throw new Error('legacy_auth_export_pg_url_required:set_AOPS_PG_URL_or_select_the_private_server_env');
+    }
+    return saved;
+}
+function writeExclusivePrivateFile(target, content) {
+    if (!path.isAbsolute(target) || /[\0\r\n]/.test(target)) {
+        throw new Error('legacy_auth_export_output_path_invalid');
+    }
+    const parent = path.dirname(target);
+    if (!existsSync(parent))
+        throw new Error('legacy_auth_export_output_parent_missing');
+    let descriptor;
+    try {
+        descriptor = openSync(target, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY, 0o600);
+        writeFileSync(descriptor, content, 'utf8');
+        fsyncSync(descriptor);
+    }
+    catch (error) {
+        if (error.code === 'EEXIST') {
+            throw new Error('legacy_auth_export_output_exists:choose_a_new_path');
+        }
+        throw error;
+    }
+    finally {
+        if (descriptor !== undefined)
+            closeSync(descriptor);
+    }
+}
+export async function buildLegacyAuthExport(repoUrl, dependencies = {}) {
+    const client = dependencies.clientFactory?.(repoUrl) ?? new Client({ connectionString: repoUrl });
+    let transactionOpen = false;
+    try {
+        await client.connect();
+        await client.query('BEGIN ISOLATION LEVEL REPEATABLE READ READ ONLY');
+        transactionOpen = true;
+        const relationResult = await client.query(`SELECT c.relname AS "table"
+         FROM pg_catalog.pg_class c
+         JOIN pg_catalog.pg_namespace n ON n.oid = c.relnamespace
+        WHERE n.nspname = 'public'
+          AND c.relkind IN ('r', 'p')
+          AND c.relname = ANY($1::text[])
+        ORDER BY c.relname`, [LEGACY_RELATIONS]);
+        const present = relationResult.rows.map((row) => String(row.table));
+        if (present.length === 0) {
+            await client.query('COMMIT');
+            transactionOpen = false;
+            const data = {
+                schemaVersion: 1,
+                source: 'aops-community-authv2-historical',
+                status: 'not-present',
+                generatedAt: (dependencies.now ?? (() => new Date()))().toISOString(),
+                tenants: [],
+                roles: [],
+                users: [],
+                roleAssignments: [],
+            };
+            return {
+                ...data,
+                sha256: createHash('sha256').update(stableJson(data)).digest('hex'),
+            };
+        }
+        if (present.length !== LEGACY_RELATIONS.length) {
+            throw new Error(`legacy_auth_export_schema_incomplete:${present.join(',')}`);
+        }
+        const users = await client.query(`SELECT id::text AS id, "tenantId", email, "fullName", "emailVerified",
+              COALESCE(roles, ARRAY[]::text[]) AS "legacyRoleKeys",
+              COALESCE(permissions, ARRAY[]::text[]) AS permissions,
+              "createdAt", "updatedAt"
+         FROM public.authv2_users
+        ORDER BY "tenantId", lower(email), id`);
+        const roles = await client.query(`SELECT id::text AS id, "tenantId", "roleKey", "displayName",
+              description, "isSystem", source, "createdAt", "updatedAt"
+         FROM public.authv2_roles
+        ORDER BY "tenantId", "roleKey", id`);
+        const assignments = await client.query(`SELECT links."tenantId", links."userId"::text AS "userId",
+              links."roleId"::text AS "roleId", roles."roleKey",
+              links."assignedAt", links."expiresAt"
+         FROM public.authv2_user_roles links
+         JOIN public.authv2_roles roles
+           ON roles.id = links."roleId" AND roles."tenantId" = links."tenantId"
+        ORDER BY links."tenantId", links."userId", roles."roleKey", links."roleId"`);
+        await client.query('COMMIT');
+        transactionOpen = false;
+        const tenantIds = [...new Set([
+                ...users.rows.map((row) => String(row.tenantId)),
+                ...roles.rows.map((row) => String(row.tenantId)),
+            ])].sort();
+        const data = {
+            schemaVersion: 1,
+            source: 'aops-community-authv2-historical',
+            status: 'historical-read-only',
+            generatedAt: (dependencies.now ?? (() => new Date()))().toISOString(),
+            tenants: tenantIds.map((tenantId) => ({ tenantId })),
+            roles: roles.rows,
+            users: users.rows,
+            roleAssignments: assignments.rows,
+            reauthentication: {
+                required: true,
+                credentialMaterialExported: false,
+                nextAction: 'create-a-new-remote-session-through-the-South-device-flow',
+            },
+        };
+        return {
+            ...data,
+            sha256: createHash('sha256').update(stableJson(data)).digest('hex'),
+        };
+    }
+    catch (error) {
+        if (transactionOpen)
+            await client.query('ROLLBACK').catch(() => undefined);
+        throw error;
+    }
+    finally {
+        await client.end().catch(() => undefined);
+    }
+}
+export async function runLegacyAuthExport(options = {}, dependencies = {}) {
+    if (options.out && (options.apply !== true || options.confirm !== true)) {
+        throw new Error('legacy_auth_export_write_requires_--apply_and_--confirm');
+    }
+    const exported = await buildLegacyAuthExport(resolveLegacyRepoUrl(options), dependencies);
+    const content = stableJson(exported);
+    if (options.out) {
+        const outputPath = path.resolve(options.out);
+        writeExclusivePrivateFile(outputPath, content);
+        process.stdout.write(`${JSON.stringify({
+            ok: true,
+            action: 'auth.legacy-export',
+            status: 'written',
+            outputPath,
+            sha256: exported.sha256,
+            credentialMaterialExported: false,
+        }, null, options.json ? 2 : 0)}\n`);
+        return;
+    }
+    process.stdout.write(content);
+}

package/dist/commands/auth/login.js

@@ -0,0 +1,426 @@
+import { Command } from 'commander';
+import { banner, logError, logInfo, logSuccess } from '@aopslabs/xf-cli-ui';
+import { createAopsApiClient, xfMessage } from '@aopslabs/api-client';
+import { clearApiTokensInConfig, getActiveApiTarget, getApiTarget, isRemoteSessionAuthProvider, setApiTokensInConfig, } from '../../utils/config.js';
+import { createCliApiClientFromOptions, probeCliRuntimeMode, resolveCliApiBaseUrl, } from '../../utils/api.js';
+import { openApprovedHttpsUrl } from '../../lib/external-url.js';
+import { runRemoteSessionDeviceLogin } from './device-login.js';
+function normalizeNonEmpty(value) {
+    if (typeof value !== 'string')
+        return undefined;
+    const trimmed = value.trim();
+    return trimmed.length > 0 ? trimmed : undefined;
+}
+function resultErrorCode(result, fallback) {
+    const direct = normalizeNonEmpty(result?.error);
+    return direct ?? xfMessage(result, fallback);
+}
+function safePrincipal(value) {
+    const userId = normalizeNonEmpty(value?.userId);
+    if (!userId)
+        return null;
+    const normalizedStrings = (items) => {
+        if (!Array.isArray(items))
+            return undefined;
+        const values = items.map(normalizeNonEmpty).filter((item) => Boolean(item));
+        return values.length > 0 ? values : [];
+    };
+    return {
+        userId,
+        ...(normalizeNonEmpty(value?.email) ? { email: normalizeNonEmpty(value?.email) } : {}),
+        ...(normalizeNonEmpty(value?.fullName) ? { fullName: normalizeNonEmpty(value?.fullName) } : {}),
+        ...(value?.roles !== undefined ? { roles: normalizedStrings(value.roles) ?? [] } : {}),
+        ...(value?.permissions !== undefined ? { permissions: normalizedStrings(value.permissions) ?? [] } : {}),
+        ...(value?.capabilities !== undefined ? { capabilities: normalizedStrings(value.capabilities) ?? [] } : {}),
+    };
+}
+export async function verifyAuthSessionWithTokenPair(input) {
+    const accessToken = normalizeNonEmpty(input.accessToken);
+    const refreshToken = normalizeNonEmpty(input.refreshToken);
+    if (!accessToken || !refreshToken)
+        throw new Error('auth_token_pair_missing');
+    const api = createAopsApiClient({
+        baseUrl: input.apiBaseUrl,
+        defaultTimeoutMs: input.timeoutMs,
+        getAccessToken: () => accessToken,
+        getRefreshToken: () => refreshToken,
+    });
+    const response = await api.requestXfJson('/api/auth/me', { method: 'GET' }, { retry401: false, timeoutMs: input.timeoutMs });
+    const principal = safePrincipal(response.result?.data?.principal);
+    const providerVerified = isRemoteSessionAuthProvider(response.result?.data?.authProvider);
+    const authRequiredVerified = response.result?.data?.authRequired === true;
+    if (response.status !== 200 ||
+        response.result?.ok !== true ||
+        !principal?.userId ||
+        !providerVerified ||
+        !authRequiredVerified) {
+        throw new Error(`auth_session_verification_failed:${response.status}:${resultErrorCode(response.result, 'auth_principal_missing')}`);
+    }
+    const expectedUserId = normalizeNonEmpty(input.expectedUserId);
+    if (expectedUserId && principal.userId !== expectedUserId) {
+        throw new Error('auth_session_principal_mismatch');
+    }
+    return {
+        userId: principal.userId,
+        principal,
+        authProvider: 'remote-session',
+        authRequired: response.result.data?.authRequired,
+    };
+}
+function printLoginJson(params) {
+    console.log(JSON.stringify({
+        schemaVersion: 1,
+        action: 'auth.device-login',
+        status: params.status,
+        ok: params.ok,
+        target: params.target ?? null,
+        userId: params.userId ?? null,
+        stored: params.stored,
+        browserOpened: params.browserOpened ?? false,
+    }, null, 2));
+}
+export async function runAuthLogin(options = {}, dependencies = {}) {
+    const interactive = !options.yes && !options.json;
+    const browserFlow = options.browser === true;
+    const deviceLogin = dependencies.deviceLogin ?? runRemoteSessionDeviceLogin;
+    const openApprovedUrl = dependencies.openApprovedUrl ?? openApprovedHttpsUrl;
+    const apiBaseUrl = resolveCliApiBaseUrl(options.apiBaseUrl, options.target);
+    const apiState = await createCliApiClientFromOptions({
+        apiBaseUrl,
+        targetName: options.target,
+        timeoutMs: options.timeoutMs,
+    });
+    const runtime = await probeCliRuntimeMode(apiState, { timeoutMs: options.timeoutMs });
+    if (runtime.authRequired === false) {
+        if (options.json) {
+            printLoginJson({
+                status: 200,
+                ok: true,
+                target: apiState.targetName,
+                userId: runtime.principalUserId,
+                stored: false,
+            });
+            return;
+        }
+        if (interactive) {
+            banner('AOPS CLI Auth Login');
+            logInfo(`API: ${apiBaseUrl}`);
+        }
+        logSuccess('Trusted-local auth is active. Login is disabled and the local principal is already available.');
+        return;
+    }
+    if (runtime.authProvider === 'remote-session') {
+        if (!interactive && !browserFlow) {
+            if (options.json) {
+                printLoginJson({
+                    status: 400,
+                    ok: false,
+                    target: apiState.targetName,
+                    stored: false,
+                });
+            }
+            else {
+                logError('Remote-session login requires interactive approval or the explicit --browser flow.');
+            }
+            process.exitCode = 1;
+            return;
+        }
+        if (interactive) {
+            banner('AOPS CLI Remote Session');
+            logInfo(`API: ${apiBaseUrl}`);
+        }
+        let browserOpened = false;
+        let tokens;
+        try {
+            tokens = await deviceLogin({
+                apiBaseUrl,
+                timeoutMs: options.timeoutMs,
+                onChallenge: async ({ verificationUriComplete, userCode, expiresIn }) => {
+                    if (browserFlow) {
+                        await openApprovedUrl(verificationUriComplete, new URL(apiBaseUrl).origin);
+                        browserOpened = true;
+                    }
+                    if (interactive) {
+                        logInfo(browserFlow
+                            ? 'The same-origin approval page was opened in your browser.'
+                            : `Open: ${verificationUriComplete}`);
+                        logInfo(`Confirm code: ${userCode}`);
+                        logInfo(`Waiting for browser approval (expires in ${expiresIn} seconds)…`);
+                    }
+                },
+            });
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            if (options.json) {
+                printLoginJson({
+                    status: 401,
+                    ok: false,
+                    target: apiState.targetName,
+                    stored: false,
+                    browserOpened,
+                });
+            }
+            else {
+                logError(`Remote-session login failed: ${message}`);
+            }
+            process.exitCode = 1;
+            return;
+        }
+        let verified;
+        try {
+            verified = await verifyAuthSessionWithTokenPair({
+                apiBaseUrl,
+                accessToken: tokens.accessToken,
+                refreshToken: tokens.refreshToken,
+                expectedUserId: tokens.userId,
+                timeoutMs: options.timeoutMs,
+            });
+            await setApiTokensInConfig({
+                accessToken: tokens.accessToken,
+                refreshToken: tokens.refreshToken,
+                userId: verified.userId,
+                apiServer: apiBaseUrl,
+                targetName: apiState.targetName,
+                verifiedAuthProvider: 'remote-session',
+            });
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            if (options.json) {
+                printLoginJson({
+                    status: 401,
+                    ok: false,
+                    target: apiState.targetName,
+                    stored: false,
+                    browserOpened,
+                });
+            }
+            else {
+                logError(`Remote-session tokens were not stored because verification failed: ${message}`);
+            }
+            process.exitCode = 1;
+            return;
+        }
+        if (options.json) {
+            printLoginJson({
+                status: 200,
+                ok: true,
+                target: apiState.targetName,
+                userId: verified.userId,
+                stored: true,
+                browserOpened,
+            });
+        }
+        else {
+            logSuccess(`Remote session ready (userId: ${verified.userId}).`);
+        }
+        return;
+    }
+    logError('The target does not expose the supported remote-session contract. ' +
+        'Local password sessions were retired; configure a South remote-session target and authenticate again.');
+    process.exitCode = 1;
+}
+function selectedTarget(apiState) {
+    return apiState.targetName ? getApiTarget(apiState.targetName) : getActiveApiTarget();
+}
+export async function inspectAuthStatus(options = {}) {
+    const apiState = await createCliApiClientFromOptions({
+        targetName: options.target,
+        timeoutMs: options.timeoutMs,
+    });
+    const target = selectedTarget(apiState);
+    try {
+        const response = await apiState.client.requestXfJson('/api/auth/me', { method: 'GET' }, { timeoutMs: options.timeoutMs });
+        const principal = safePrincipal(response.result?.data?.principal);
+        const observedAuthProvider = response.result?.data?.authProvider === 'trusted-local' ||
+            isRemoteSessionAuthProvider(response.result?.data?.authProvider)
+            ? 'remote-session'
+            : undefined;
+        const observedAuthRequired = typeof response.result?.data?.authRequired === 'boolean'
+            ? response.result.data.authRequired
+            : undefined;
+        const expectedAuthRequired = isRemoteSessionAuthProvider(target?.authProvider);
+        const providerKnown = observedAuthProvider !== undefined;
+        const authRequiredKnown = observedAuthRequired !== undefined;
+        const providerMatches = providerKnown && (!target || observedAuthProvider === target.authProvider);
+        const authRequiredMatches = authRequiredKnown && (!target || observedAuthRequired === expectedAuthRequired);
+        const contractKnown = providerKnown && authRequiredKnown;
+        const contractMatches = providerMatches && authRequiredMatches;
+        const authenticated = response.status === 200 &&
+            response.result?.ok === true &&
+            Boolean(principal) &&
+            contractMatches;
+        const status = !contractKnown
+            ? 'auth-contract-unknown'
+            : !contractMatches
+                ? 'provider-mismatch'
+                : authenticated
+                    ? 'authenticated'
+                    : 'unauthenticated';
+        const reason = !contractKnown
+            ? 'auth_contract_missing'
+            : !providerMatches
+                ? 'target_auth_provider_mismatch'
+                : !authRequiredMatches
+                    ? 'target_auth_required_mismatch'
+                    : authenticated
+                        ? null
+                        : resultErrorCode(response.result, 'auth_required');
+        return {
+            status,
+            ok: authenticated,
+            target: target ?? null,
+            endpointSource: apiState.endpointSource,
+            apiBaseUrl: apiState.baseUrl,
+            authProvider: observedAuthProvider ?? null,
+            authRequired: observedAuthRequired ?? null,
+            credentialsStored: target?.hasCredentials ?? false,
+            authenticated,
+            principal,
+            httpStatus: response.status,
+            contractKnown,
+            providerMatches,
+            authRequiredMatches,
+            reason,
+        };
+    }
+    catch (error) {
+        return {
+            status: 'unavailable',
+            ok: false,
+            target: target ?? null,
+            endpointSource: apiState.endpointSource,
+            apiBaseUrl: apiState.baseUrl,
+            authProvider: target?.authProvider ?? null,
+            authRequired: isRemoteSessionAuthProvider(target?.authProvider),
+            credentialsStored: target?.hasCredentials ?? false,
+            authenticated: null,
+            principal: null,
+            httpStatus: null,
+            reason: error instanceof Error ? error.message : String(error),
+        };
+    }
+}
+export async function runAuthStatus(options = {}) {
+    const result = await inspectAuthStatus(options);
+    if (options.json)
+        console.log(JSON.stringify(result, null, 2));
+    else if (result.ok) {
+        const target = result.target;
+        const principal = result.principal;
+        logSuccess(`Authenticated${target ? ` to ${target.name}` : ''} as ${principal?.email ?? principal?.userId ?? 'current principal'}.`);
+        logInfo(`API: ${String(result.apiBaseUrl)}`);
+    }
+    else {
+        logError(`Auth status: ${String(result.status)} (${String(result.reason ?? 'auth_required')})`);
+    }
+    if (!result.ok)
+        process.exitCode = 1;
+}
+export async function runAuthLogout(options = {}) {
+    const target = options.target ? getApiTarget(options.target) : getActiveApiTarget();
+    if (!target) {
+        logError('No selected target. Add and select a target before logging out.');
+        process.exitCode = 1;
+        return;
+    }
+    if (!target.hasCredentials) {
+        const result = { ok: true, target: target.name, remote: 'not-attempted', cleared: false };
+        if (options.json)
+            console.log(JSON.stringify(result, null, 2));
+        else
+            logInfo('No stored auth tokens were present for the selected target.');
+        return;
+    }
+    if (!options.localOnly && isRemoteSessionAuthProvider(target.authProvider)) {
+        let apiState;
+        try {
+            apiState = await createCliApiClientFromOptions({
+                targetName: target.name,
+                timeoutMs: options.timeoutMs,
+            });
+        }
+        catch (error) {
+            const reason = error instanceof Error ? error.message : String(error);
+            logError(`Remote logout could not load the stored session; local credentials were preserved. ${reason}`);
+            logInfo('Use `aops auth logout --local-only` only if you intentionally want offline local cleanup.');
+            process.exitCode = 1;
+            return;
+        }
+        let response;
+        try {
+            response = await apiState.client.requestXfJson('/api/auth/logout', { method: 'POST', body: {} }, { timeoutMs: options.timeoutMs });
+        }
+        catch (error) {
+            const reason = error instanceof Error ? error.message : String(error);
+            logError(`Remote logout failed; local credentials were preserved. ${reason}`);
+            logInfo('Use `aops auth logout --local-only` only if you intentionally want offline local cleanup.');
+            process.exitCode = 1;
+            return;
+        }
+        if (response.status !== 200 ||
+            response.result?.ok !== true ||
+            response.result.data?.loggedOut !== true) {
+            const reason = resultErrorCode(response.result, 'logout_failed');
+            logError(`Remote logout failed (${response.status}); local credentials were preserved. ${reason}`);
+            logInfo('Use `aops auth logout --local-only` only if you intentionally want offline local cleanup.');
+            process.exitCode = 1;
+            return;
+        }
+    }
+    const cleared = clearApiTokensInConfig(target.name);
+    if (options.json) {
+        console.log(JSON.stringify({
+            ok: true,
+            target: target.name,
+            remote: options.localOnly
+                ? 'skipped-local-only'
+                : isRemoteSessionAuthProvider(target.authProvider) ? 'revoked' : 'not-applicable',
+            cleared,
+        }, null, 2));
+        return;
+    }
+    if (cleared) {
+        logSuccess(options.localOnly
+            ? 'Local auth tokens cleared without contacting the server.'
+            : 'Remote session revoked and local auth tokens cleared.');
+    }
+    else
+        logInfo('No stored auth tokens were present for the selected target.');
+}
+export function makeAuthLoginCommand() {
+    const cmd = new Command('login').description('Login and store API tokens locally');
+    cmd
+        .option('--target <name>', 'Named target (must match --api-base-url when both are supplied)')
+        .option('--api-base-url <url>', 'API base URL (default: AOPS_API_BASE_URL or http://localhost:5900)')
+        .option('--email <email>', 'User email')
+        .option('--timeout-ms <ms>', 'Request timeout in milliseconds', (v) => Number.parseInt(String(v), 10))
+        .option('--yes', 'Non-interactive (fail if required args are missing)')
+        .option('--browser', 'Open the same-origin approval page and wait headlessly')
+        .option('--json', 'Output JSON only')
+        .action(async (options) => {
+        await runAuthLogin(options);
+    });
+    return cmd;
+}
+export function makeAuthLogoutCommand() {
+    const cmd = new Command('logout').description('Revoke the remote session, then clear stored API tokens');
+    cmd.option('--target <name>', 'Named target; default is the active target')
+        .option('--timeout-ms <ms>', 'Request timeout in milliseconds', (v) => Number.parseInt(String(v), 10))
+        .option('--local-only', 'Skip remote revocation and explicitly clear only local credentials')
+        .option('--json', 'Output JSON only').action(async (options) => {
+        await runAuthLogout(options);
+    });
+    return cmd;
+}
+export function makeAuthStatusCommand() {
+    const cmd = new Command('status').description('Verify the selected target and current authenticated principal');
+    cmd.option('--target <name>', 'Named target; default is the active target')
+        .option('--timeout-ms <ms>', 'Request timeout in milliseconds', (v) => Number.parseInt(String(v), 10))
+        .option('--json', 'Output JSON only')
+        .action(async (options) => {
+        await runAuthStatus(options);
+    });
+    return cmd;
+}