@astris-labs/cli 0.0.0-stage → 0.1.1

package/src/key.mjs

@@ -0,0 +1,126 @@
+import { randomBytes } from "node:crypto";
+import { Buffer } from "node:buffer";
+import { closeSync, mkdirSync, openSync, readFileSync, renameSync, unlinkSync, writeSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+export class NoApiKeyError extends Error {
+  constructor() {
+    super("ASTRIS_API_KEY is not set");
+    this.name = "NoApiKeyError";
+  }
+}
+
+// A usable directory is a non-empty absolute string. The trimmed string is the path.
+function absolute(value) {
+  if (typeof value !== "string") return null;
+  const trimmed = value.trim();
+  if (trimmed === "" || !path.isAbsolute(trimmed)) return null;
+  return trimmed;
+}
+
+function configDir(env) {
+  const platform = os.platform();
+  if (platform === "win32") {
+    const appData = absolute(env.APPDATA);
+    if (appData) return appData;
+    const profile = absolute(env.USERPROFILE);
+    if (profile) return path.join(profile, "AppData", "Roaming");
+    return null;
+  }
+  if (platform === "darwin") {
+    const home = absolute(env.HOME);
+    if (home) return path.join(home, "Library", "Application Support");
+    return null;
+  }
+  const xdg = absolute(env.XDG_CONFIG_HOME);
+  if (xdg) return xdg;
+  const home = absolute(env.HOME);
+  if (home) return path.join(home, ".config");
+  return null;
+}
+
+export function apiKeyPath(env = process.env) {
+  const dir = configDir(env);
+  if (!dir) return null;
+  return path.join(dir, "astris", "key");
+}
+
+export function readApiKey(env = process.env) {
+  const value = env.ASTRIS_API_KEY;
+  if (typeof value === "string" && value.trim() !== "") return value;
+  const file = apiKeyPath(env);
+  if (file === null) throw new NoApiKeyError();
+  let text;
+  try {
+    // eslint-disable-next-line security/detect-non-literal-fs-filename -- path is the env argument's config file
+    text = readFileSync(file, "utf8");
+  } catch {
+    // A missing, forbidden, or non-file path uses the same sentence. The fs error carries the path.
+    throw new NoApiKeyError();
+  }
+  if (text.trim() === "") throw new NoApiKeyError();
+  return text.trim();
+}
+
+function writeAll(fd, text) {
+  const data = Buffer.from(text, "utf8");
+  let offset = 0;
+  while (offset < data.length) {
+    const written = writeSync(fd, data, offset, data.length - offset, null);
+    if (written === 0) throw new Error("Could not write the key file");
+    offset += written;
+  }
+}
+
+export function saveApiKey(env = process.env, key) {
+  const file = apiKeyPath(env);
+  if (file === null) throw new Error("No config path");
+  const dir = path.dirname(file);
+  // eslint-disable-next-line security/detect-non-literal-fs-filename -- path is the env argument's config directory
+  mkdirSync(dir, { recursive: true });
+  const temp = path.join(dir, `.${randomBytes(8).toString("hex")}`);
+  // ponytail: mode is only this open (0o600). Windows stat of a writable file is 0o666 (C1); no ACL.
+  let fd;
+  let created = false;
+  try {
+    // eslint-disable-next-line security/detect-non-literal-fs-filename -- temp file is in the same config directory
+    fd = openSync(temp, "wx", 0o600);
+    created = true;
+    writeAll(fd, key);
+    closeSync(fd);
+    fd = undefined;
+    // eslint-disable-next-line security/detect-non-literal-fs-filename -- rename stays inside the config directory
+    renameSync(temp, file);
+  } catch (error) {
+    if (fd !== undefined) {
+      try {
+        closeSync(fd);
+      } catch {
+        // The write error is the one to report.
+      }
+    }
+    if (created) {
+      try {
+        // eslint-disable-next-line security/detect-non-literal-fs-filename -- temp file this open created
+        unlinkSync(temp);
+      } catch {
+        // Already gone.
+      }
+    }
+    throw error;
+  }
+}
+
+export function removeApiKey(env = process.env) {
+  const file = apiKeyPath(env);
+  if (file === null) return { removed: false };
+  try {
+    // eslint-disable-next-line security/detect-non-literal-fs-filename -- unlinks only astris/key
+    unlinkSync(file);
+  } catch (error) {
+    if (error.code === "ENOENT") return { removed: false };
+    throw error;
+  }
+  return { removed: true };
+}

package/src/main.mjs

@@ -0,0 +1,50 @@
+#!/usr/bin/env node
+import { realpathSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { DEFAULT_BASE_URL } from "./client.mjs";
+import { database, deploy, diagnose, domains, env, list, login, logout, logs, plans, restart, rollback, status, storage, usage, whoami } from "./commands.mjs";
+
+export async function main(argv, io) {
+  const command = argv?.[2];
+  const args = Array.isArray(argv) ? argv.slice(3) : [];
+  if (command === "deploy") return (await deploy(args, io)).exitCode;
+  if (command === "status") return (await status(args, io)).exitCode;
+  if (command === "diagnose") return (await diagnose(args, io)).exitCode;
+  if (command === "database") return (await database(args, io)).exitCode;
+  if (command === "storage") return (await storage(args, io)).exitCode;
+  if (command === "env") return (await env(args, io)).exitCode;
+  if (command === "domains") return (await domains(args, io)).exitCode;
+  if (command === "restart") return (await restart(args, io)).exitCode;
+  if (command === "logs") return (await logs(args, io)).exitCode;
+  if (command === "list") return (await list(args, io)).exitCode;
+  if (command === "usage") return (await usage(args, io)).exitCode;
+  if (command === "plans") return (await plans(args, io)).exitCode;
+  if (command === "whoami") return (await whoami(args, io)).exitCode;
+  if (command === "rollback") return rollback(args, io).exitCode;
+  if (command === "login") return (await login(args, io)).exitCode;
+  if (command === "logout") return (await logout(args, io)).exitCode;
+  io.stderr.write("Unknown command.\n");
+  return 1;
+}
+
+async function readStdin() {
+  if (process.stdin.isTTY) return "";
+  const chunks = [];
+  for await (const chunk of process.stdin) {
+    chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+  }
+  return Buffer.concat(chunks).toString("utf8");
+}
+
+if (process.argv[1] && realpathSync(process.argv[1]) === realpathSync(fileURLToPath(import.meta.url))) {
+  const stdin = (process.argv[2] === "env" || process.argv[2] === "login") && !process.stdin.isTTY ? await readStdin() : "";
+  const code = await main(process.argv, {
+    env: process.env,
+    fetchImpl: globalThis.fetch,
+    baseUrl: DEFAULT_BASE_URL,
+    stdin,
+    stdout: process.stdout,
+    stderr: process.stderr,
+  });
+  process.exit(code);
+}