@asteroidai/cli 1.9.27 → 1.9.30

package/src/auth/credentials.ts

@@ -1,179 +0,0 @@
-import {
-  type Config,
-  type Env,
-  findOrg,
-  mergeOrgs,
-  type Org,
-  orgLabel,
-  saveConfig,
-} from "../config";
-import { clean } from "../output";
-import { CredentialStore, type Login, type StaffToken } from "./store";
-import { refresh, tokenClaims, WorkosError } from "./workos";
-
-export class AuthError extends Error {}
-
-/** The sign-in is fine, but the person is not a member of the org. */
-export class NotMemberError extends AuthError {}
-
-export const API_KEY_OVERRIDES =
-  "ASTEROID_API_KEY is set, so the CLI uses that key and ignores `asteroid login`.";
-export const UNSET_API_KEY =
-  "Run `unset ASTEROID_API_KEY` to use your login instead.";
-
-export interface Auth {
-  kind: "api-key" | "bearer";
-  headers: Record<string, string>;
-  org?: Org;
-  expiresAt?: number;
-  /** Set when the token is a staff token from `asteroid use <org> --reason`. */
-  staff?: { grantId: string; reason: string };
-}
-
-/** An Asteroid sign-in. It only decides which hints to show: the server checks the admin list. */
-export function isStaffLogin(login: Login | undefined): boolean {
-  return login?.email?.toLowerCase().endsWith("@asteroid.ai") ?? false;
-}
-
-/** The `--reason` hint, for staff only. Empty for everyone else. */
-export function staffHint(ref: string, staff: boolean): string {
-  return staff
-    ? ` Asteroid staff: run \`asteroid use ${clean(ref)} --reason <why>\`.`
-    : "";
-}
-
-function staffAuth(held: StaffToken): Auth {
-  return {
-    kind: "bearer",
-    headers: { Authorization: `Bearer ${held.token}` },
-    org: held.org,
-    expiresAt: held.expiresAt,
-    staff: { grantId: held.grantId, reason: held.reason },
-  };
-}
-
-export function orgFromToken(token: string): Org | undefined {
-  const claims = tokenClaims(token);
-  if (!claims.org_id) return undefined;
-  return {
-    workosId: claims.org_id,
-    id: claims.org?.id,
-    name: claims.org?.name,
-  };
-}
-
-export function rememberOrg(env: Env, config: Config, org: Org | undefined) {
-  if (!org) return;
-  config.orgs = mergeOrgs(config.orgs, [org]);
-  if (!config.org || config.org.workosId === org.workosId) {
-    config.org = config.orgs.find((o) => o.workosId === org.workosId);
-  }
-  saveConfig(env, config);
-}
-
-function bearer(token: string, expiresAt: number): Auth {
-  return {
-    kind: "bearer",
-    headers: { Authorization: `Bearer ${token}` },
-    org: orgFromToken(token),
-    expiresAt,
-  };
-}
-
-const SSO_OR_MFA =
-  /^(sso_required|mfa_.*|organization_authentication_methods_required)$/;
-
-function refreshError(error: WorkosError, org: Org, login: Login): AuthError {
-  if (error.code === "invalid_grant") {
-    return new AuthError("your sign-in has expired. Run `asteroid login`.");
-  }
-  if (SSO_OR_MFA.test(error.code)) {
-    return new AuthError(
-      `${orgLabel(org)} requires SSO or MFA. Run \`asteroid login\` and sign in to it again.`,
-    );
-  }
-  if (error.code === "organization_membership_not_found") {
-    return new NotMemberError(
-      `you are not a member of ${orgLabel(org)}.${staffHint(org.id ?? org.workosId, isStaffLogin(login))}`,
-    );
-  }
-  return new AuthError(
-    `signing in to ${orgLabel(org)} failed: ${error.message}`,
-  );
-}
-
-export async function resolveAuth(
-  env: Env,
-  config: Config,
-  orgRef: string | undefined,
-  fetchImpl: typeof fetch = fetch,
-): Promise<Auth> {
-  if (env.apiKey)
-    return { kind: "api-key", headers: { "X-Api-Key": env.apiKey } };
-
-  const store = new CredentialStore(env);
-  const login = await store.readLogin();
-  if (!login) {
-    throw new AuthError(
-      "not signed in. Run `asteroid login`, or set ASTEROID_API_KEY.",
-    );
-  }
-
-  const target = orgRef ?? config.org?.workosId;
-  const held = target ? await store.staffToken(target) : undefined;
-  if (held) {
-    if (held.expiresAt - 30_000 > Date.now()) return staffAuth(held);
-    throw new AuthError(
-      `your staff access to ${orgLabel(held.org)} has expired.${staffHint(held.org.id ?? held.org.workosId, true)}`,
-    );
-  }
-
-  const org = orgRef ? findOrg(orgRef, config.orgs ?? []) : config.org;
-  if (orgRef && !org) {
-    throw new AuthError(
-      `unknown organization ${clean(orgRef)}. Run \`asteroid orgs\` to list yours.${staffHint(orgRef, isStaffLogin(login))}`,
-    );
-  }
-  if (!org) {
-    throw new AuthError(
-      "no organization. Run `asteroid use <org>`, or pass --org.",
-    );
-  }
-
-  const cached = store.cachedToken(org.workosId);
-  if (cached) return bearer(cached.accessToken, cached.expiresAt);
-
-  return store.withRefreshLock(async () => {
-    const fresh = store.cachedToken(org.workosId);
-    if (fresh) return bearer(fresh.accessToken, fresh.expiresAt);
-    const login = await store.readLogin();
-    if (!login) {
-      throw new AuthError("not signed in. Run `asteroid login`.");
-    }
-    try {
-      const session = await refresh(
-        {
-          clientId: env.workosClientId,
-          apiUrl: env.workosApiUrl,
-          fetch: fetchImpl,
-        },
-        login.refreshToken,
-        org.workosId,
-      );
-      await store.writeLogin({ ...login, refreshToken: session.refreshToken });
-      const expiresAt =
-        (tokenClaims(session.accessToken).exp ?? 0) * 1000 ||
-        Date.now() + 60_000;
-      const auth = bearer(session.accessToken, expiresAt);
-      store.cacheToken(auth.org?.workosId ?? org.workosId, {
-        accessToken: session.accessToken,
-        expiresAt,
-      });
-      rememberOrg(env, config, auth.org);
-      return auth;
-    } catch (error) {
-      if (error instanceof WorkosError) throw refreshError(error, org, login);
-      throw error;
-    }
-  });
-}

package/src/auth/store.ts

@@ -1,253 +0,0 @@
-import { mkdirSync, rmSync } from "node:fs";
-import { join } from "node:path";
-import lockfile from "proper-lockfile";
-
-import { type Env, type Org, readJson, writePrivateJson } from "../config";
-import { WorkosError } from "./workos";
-
-const SERVICE = "asteroid-cli";
-const LOCK_STALE_MS = 30_000;
-const ACCOUNT = "refresh-token";
-const STAFF_ACCOUNT = "staff-tokens";
-
-export interface Login {
-  refreshToken: string;
-  email?: string;
-}
-
-export interface CachedToken {
-  accessToken: string;
-  expiresAt: number;
-}
-
-/** A staff token for one org that is not yours. It lasts 8 h and is audited. */
-export interface StaffToken {
-  token: string;
-  grantId: string;
-  org: Org;
-  reason: string;
-  expiresAt: number;
-  /** The default org before `asteroid use` took staff access. */
-  from?: Org;
-}
-
-type StaffTokens = Record<string, StaffToken>;
-
-interface Keyring {
-  get(): string | null;
-  set(value: string): void;
-  delete(): void;
-}
-
-async function keyring(account = ACCOUNT): Promise<Keyring | undefined> {
-  if (process.env.ASTEROID_NO_KEYCHAIN) return undefined;
-  try {
-    const { Entry } = await import("@napi-rs/keyring");
-    const entry = new Entry(SERVICE, account);
-    entry.getPassword();
-    return {
-      get: () => entry.getPassword() ?? null,
-      set: (value) => entry.setPassword(value),
-      delete: () => {
-        entry.deletePassword();
-      },
-    };
-  } catch {
-    return undefined;
-  }
-}
-
-function tryGet(ring: Keyring): { ok: boolean; value: string | null } {
-  try {
-    return { ok: true, value: ring.get() };
-  } catch {
-    return { ok: false, value: null };
-  }
-}
-
-function trySet(ring: Keyring, value: string | null): boolean {
-  try {
-    if (value === null) ring.delete();
-    else ring.set(value);
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-export class CredentialStore {
-  constructor(private readonly env: Env) {}
-
-  private get loginFile() {
-    return join(this.env.configDir, "credentials.json");
-  }
-
-  private get tokenFile() {
-    return join(this.env.configDir, "tokens.json");
-  }
-
-  private get staffFile() {
-    return join(this.env.configDir, "staff-tokens.json");
-  }
-
-  async readLogin(): Promise<Login | undefined> {
-    const ring = await keyring();
-    const raw = ring ? tryGet(ring).value : null;
-    if (raw) return JSON.parse(raw) as Login;
-    return readJson<Login | undefined>(this.loginFile, undefined);
-  }
-
-  async writeLogin(login: Login): Promise<"keychain" | "file"> {
-    const ring = await keyring();
-    if (ring && trySet(ring, JSON.stringify(login))) {
-      rmSync(this.loginFile, { force: true });
-      return "keychain";
-    }
-    const stale = ring ? tryGet(ring) : { ok: true, value: null };
-    if (!stale.ok || (stale.value && !trySet(ring!, null))) {
-      throw new WorkosError(
-        "keychain",
-        "could not update the sign-in in the OS keychain. Unlock it, or run `asteroid logout` and sign in again.",
-      );
-    }
-    writePrivateJson(this.loginFile, login);
-    return "file";
-  }
-
-  async clear(): Promise<boolean> {
-    const ring = await keyring();
-    const current = ring ? tryGet(ring) : { ok: true, value: null };
-    const cleared = current.ok && (!current.value || trySet(ring!, null));
-    rmSync(this.loginFile, { force: true });
-    rmSync(this.tokenFile, { force: true });
-    const staffCleared = await this.withStaffLock(() =>
-      this.writeStaffTokens({}),
-    );
-    return staffCleared && cleared;
-  }
-
-  /** Every staff token held, expired ones included. */
-  async staffTokens(): Promise<StaffToken[]> {
-    const ring = await keyring(STAFF_ACCOUNT);
-    const raw = ring ? tryGet(ring).value : null;
-    const tokens = raw
-      ? (JSON.parse(raw) as StaffTokens)
-      : readJson<StaffTokens>(this.staffFile, {});
-    return Object.values(tokens);
-  }
-
-  /** The staff token for an org, matched by WorkOS id, id or name. */
-  async staffToken(ref: string): Promise<StaffToken | undefined> {
-    const lower = ref.toLowerCase();
-    return (await this.staffTokens()).find(
-      ({ org }) =>
-        org.workosId.toLowerCase() === lower ||
-        org.id?.toLowerCase() === lower ||
-        org.name?.toLowerCase() === lower,
-    );
-  }
-
-  /** Saves a staff token and drops expired ones. `replaces` is dropped too. */
-  async saveStaffToken(token: StaffToken, replaces?: string) {
-    await this.withStaffLock(async () => {
-      const tokens: StaffTokens = {};
-      for (const held of await this.staffTokens())
-        if (held.expiresAt > Date.now() && held.grantId !== replaces)
-          tokens[held.org.workosId] = held;
-      tokens[token.org.workosId] = token;
-      if (!(await this.writeStaffTokens(tokens)))
-        throw new WorkosError(
-          "keychain",
-          "could not save the staff token in the OS keychain. Unlock it and try again.",
-        );
-    });
-  }
-
-  async dropStaffToken(grantId: string) {
-    await this.withStaffLock(async () => {
-      const tokens: StaffTokens = {};
-      for (const held of await this.staffTokens())
-        if (held.grantId !== grantId) tokens[held.org.workosId] = held;
-      if (!(await this.writeStaffTokens(tokens)))
-        throw new WorkosError(
-          "keychain",
-          "could not remove the staff token from the OS keychain. Unlock it and try again.",
-        );
-    });
-  }
-
-  private async writeStaffTokens(tokens: StaffTokens): Promise<boolean> {
-    const empty = Object.keys(tokens).length === 0;
-    const ring = await keyring(STAFF_ACCOUNT);
-    if (ring && trySet(ring, empty ? null : JSON.stringify(tokens))) {
-      rmSync(this.staffFile, { force: true });
-      return true;
-    }
-    const stale = ring ? tryGet(ring) : { ok: true, value: null };
-    if (!stale.ok || (stale.value && !trySet(ring!, null))) return false;
-    if (empty) rmSync(this.staffFile, { force: true });
-    else writePrivateJson(this.staffFile, tokens);
-    return true;
-  }
-
-  async withRefreshLock<T>(work: () => Promise<T>): Promise<T> {
-    return this.withLock(
-      "refresh",
-      "another asteroid command is refreshing the sign-in.",
-      work,
-    );
-  }
-
-  /** Two commands at once must not lose a grant they could still revoke. */
-  private async withStaffLock<T>(work: () => Promise<T>): Promise<T> {
-    return this.withLock(
-      "staff",
-      "another asteroid command is saving staff access.",
-      work,
-    );
-  }
-
-  private async withLock<T>(
-    name: string,
-    busy: string,
-    work: () => Promise<T>,
-  ): Promise<T> {
-    mkdirSync(this.env.configDir, { recursive: true, mode: 0o700 });
-    const lockfilePath = join(this.env.configDir, `${name}.lock`);
-    let release: () => Promise<void>;
-    try {
-      // Each lock names its own target: proper-lockfile tracks locks by target.
-      release = await lockfile.lock(join(this.env.configDir, name), {
-        lockfilePath,
-        realpath: false,
-        stale: LOCK_STALE_MS,
-        retries: { retries: 60, minTimeout: 100, maxTimeout: 500 },
-      });
-    } catch {
-      throw new WorkosError(
-        "locked",
-        `${busy} Try again, or delete ${lockfilePath} if none is running.`,
-      );
-    }
-    try {
-      return await work();
-    } finally {
-      await release();
-    }
-  }
-
-  cachedToken(orgId: string): CachedToken | undefined {
-    const tokens = readJson<Record<string, CachedToken>>(this.tokenFile, {});
-    const token = tokens[orgId];
-    return token && token.expiresAt - 30_000 > Date.now() ? token : undefined;
-  }
-
-  cacheToken(orgId: string, token: CachedToken) {
-    const tokens = readJson<Record<string, CachedToken>>(this.tokenFile, {});
-    for (const [id, cached] of Object.entries(tokens)) {
-      if (cached.expiresAt <= Date.now()) delete tokens[id];
-    }
-    tokens[orgId] = token;
-    writePrivateJson(this.tokenFile, tokens);
-  }
-}

package/src/auth/workos.ts

@@ -1,171 +0,0 @@
-export interface DeviceAuthorization {
-  device_code: string;
-  user_code: string;
-  verification_uri: string;
-  verification_uri_complete?: string;
-  expires_in: number;
-  interval: number;
-}
-
-export interface WorkosOrg {
-  id: string;
-  name: string;
-}
-
-export interface Session {
-  accessToken: string;
-  refreshToken: string;
-  organizationId?: string;
-  email?: string;
-}
-
-export class WorkosError extends Error {
-  constructor(
-    readonly code: string,
-    message: string,
-    readonly body: Record<string, unknown> = {},
-  ) {
-    super(message);
-  }
-}
-
-export interface WorkosClient {
-  clientId: string;
-  apiUrl: string;
-  fetch?: typeof fetch;
-  sleep?: (ms: number) => Promise<void>;
-}
-
-const AUTHENTICATE = "/user_management/authenticate";
-const TIMEOUT_MS = 15_000;
-
-async function post(
-  client: WorkosClient,
-  path: string,
-  body: Record<string, string>,
-): Promise<Record<string, unknown>> {
-  const response = await (client.fetch ?? fetch)(`${client.apiUrl}${path}`, {
-    method: "POST",
-    headers: { Accept: "application/json" },
-    body: new URLSearchParams({ client_id: client.clientId, ...body }),
-    signal: AbortSignal.timeout(TIMEOUT_MS),
-  });
-  const json = (await response.json().catch(() => ({}))) as Record<
-    string,
-    unknown
-  >;
-  if (!response.ok) {
-    const code = String(json.error ?? json.code ?? response.status);
-    const message = String(json.error_description ?? json.message ?? code);
-    throw new WorkosError(code, message, json);
-  }
-  return json;
-}
-
-function pollOnce(client: WorkosClient, deviceCode: string) {
-  return post(client, AUTHENTICATE, {
-    grant_type: "urn:ietf:params:oauth:grant-type:device_code",
-    device_code: deviceCode,
-  });
-}
-
-function selectOrg(
-  client: WorkosClient,
-  pendingAuthenticationToken: string,
-  organizationId: string,
-) {
-  return post(client, AUTHENTICATE, {
-    grant_type: "urn:workos:oauth:grant-type:organization-selection",
-    pending_authentication_token: pendingAuthenticationToken,
-    organization_id: organizationId,
-  });
-}
-
-function session(json: Record<string, unknown>): Session {
-  const user = json.user as { email?: string } | undefined;
-  return {
-    accessToken: String(json.access_token),
-    refreshToken: String(json.refresh_token),
-    organizationId: (json.organization_id as string | undefined) ?? undefined,
-    email: user?.email,
-  };
-}
-
-export async function authorizeDevice(
-  client: WorkosClient,
-): Promise<DeviceAuthorization> {
-  return (await post(
-    client,
-    "/user_management/authorize/device",
-    {},
-  )) as unknown as DeviceAuthorization;
-}
-
-export async function pollDevice(
-  client: WorkosClient,
-  device: DeviceAuthorization,
-  chooseOrg: (orgs: WorkosOrg[]) => Promise<WorkosOrg>,
-): Promise<Session> {
-  const sleep = client.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
-  let interval = (device.interval || 5) * 1000;
-  const deadline = Date.now() + device.expires_in * 1000;
-  while (Date.now() < deadline) {
-    await sleep(interval);
-    try {
-      return session(await pollOnce(client, device.device_code));
-    } catch (error) {
-      if (!(error instanceof WorkosError)) throw error;
-      if (error.code === "authorization_pending") continue;
-      if (error.code === "slow_down") {
-        interval += 5000;
-        continue;
-      }
-      if (error.code === "organization_selection_required") {
-        const orgs =
-          (error.body.organizations as WorkosOrg[] | undefined) ?? [];
-        const org = await chooseOrg(orgs);
-        return session(
-          await selectOrg(
-            client,
-            String(error.body.pending_authentication_token),
-            org.id,
-          ),
-        );
-      }
-      throw error;
-    }
-  }
-  throw new WorkosError(
-    "expired_token",
-    "the sign-in code expired; run asteroid login again",
-  );
-}
-
-export async function refresh(
-  client: WorkosClient,
-  refreshToken: string,
-  organizationId?: string,
-): Promise<Session> {
-  return session(
-    await post(client, AUTHENTICATE, {
-      grant_type: "refresh_token",
-      refresh_token: refreshToken,
-      ...(organizationId ? { organization_id: organizationId } : {}),
-    }),
-  );
-}
-
-export interface Claims {
-  exp?: number;
-  org_id?: string;
-  org?: { id?: string; name?: string };
-}
-
-export function tokenClaims(token: string): Claims {
-  try {
-    const payload = token.split(".")[1];
-    return JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
-  } catch {
-    return {};
-  }
-}

package/src/commands.ts

@@ -1,13 +0,0 @@
-import { COMMANDS } from "./generated/commands";
-import { SYNC_COMMANDS } from "./sync/commands";
-import type { CliCommand } from "./types";
-
-export function withSyncCommands(
-  commands: readonly CliCommand[],
-): CliCommand[] {
-  return [...commands, ...SYNC_COMMANDS].sort((a, b) =>
-    a.command.localeCompare(b.command),
-  );
-}
-
-export const ALL_COMMANDS = withSyncCommands(COMMANDS);