@baseworks/auth 0.2.3 → 0.2.5

package/dist/cli.d.ts

@@ -0,0 +1,16 @@
+import { Command } from 'commander';
+
+interface AuthCliDeps {
+    /** Origin of the auth mount, e.g. `http://127.0.0.1:3003` (no `/v1/auth`). */
+    authBase: string | (() => string);
+    cliName?: string;
+    /** Persist the identity token (app decides where). */
+    onToken: (token: string) => void | Promise<void>;
+    /** Clear persisted credentials/context. */
+    onLogout?: () => void | Promise<void>;
+    /** Open the browser automatically (default true). */
+    openBrowser?: boolean;
+}
+declare function addAuthCommands(program: Command, deps: AuthCliDeps): void;
+
+export { type AuthCliDeps, addAuthCommands };

package/dist/cli.js

@@ -0,0 +1,62 @@
+import {
+  pollCliAuth,
+  startCliAuth
+} from "./chunk-C4V5LCFA.js";
+
+// src/cli.ts
+import { spawn } from "child_process";
+import { Command } from "commander";
+import { clr, kv, success, warn, fatal } from "@baseworks/cli/display";
+function resolveBase(b) {
+  return (typeof b === "function" ? b() : b).replace(/\/+$/, "");
+}
+function openInBrowser(url) {
+  const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open";
+  const args = process.platform === "win32" ? ["/c", "start", "", url] : [url];
+  try {
+    spawn(cmd, args, { stdio: "ignore", detached: true }).unref();
+  } catch {
+  }
+}
+function jwtSub(token) {
+  try {
+    const seg = token.split(".")[1];
+    if (!seg) return void 0;
+    const json = Buffer.from(seg.replace(/-/g, "+").replace(/_/g, "/"), "base64").toString("utf8");
+    return JSON.parse(json).sub;
+  } catch {
+    return void 0;
+  }
+}
+function addAuthCommands(program, deps) {
+  const cli = deps.cliName ?? "cli";
+  program.addCommand(
+    new Command("login").description("Log in via browser (OIDC/PKCE)").option("--no-open", "Do not open the browser automatically").action(async (opts) => {
+      const base = resolveBase(deps.authBase);
+      const start = await startCliAuth(base).catch((e) => fatal(`Could not reach auth service at ${base}: ${e.message}`));
+      console.log(`
+  ${clr.dim}Opening your browser to sign in\u2026${clr.reset}`);
+      console.log(`  ${clr.dim}If it does not open, visit:${clr.reset}
+  ${clr.cyan}${start.url}${clr.reset}
+`);
+      if (deps.openBrowser !== false && opts.open !== false) openInBrowser(start.url);
+      const { token } = await pollCliAuth(base, start.state).catch((e) => fatal(e.message));
+      await deps.onToken(token);
+      const sub = jwtSub(token);
+      success("Logged in.");
+      if (sub) kv([["user id", sub]]);
+      console.log(`  ${clr.dim}Next: ${cli} use  \xB7  ${cli} orgs${clr.reset}
+`);
+    })
+  );
+  program.addCommand(
+    new Command("logout").description("Clear saved credentials and active context").action(async () => {
+      if (deps.onLogout) await deps.onLogout();
+      else warn("No logout handler configured.");
+      success("Logged out.");
+    })
+  );
+}
+export {
+  addAuthCommands
+};

package/dist/edge.js

@@ -1,14 +1,14 @@
 import {
   getSessionFromCookies
-} from "./chunk-5W4TEXCT.js";
-import {
-  parseJwtPayload
-} from "./chunk-OD5XLL3O.js";
-import "./chunk-34E5PYNA.js";
+} from "./chunk-JS5Y2DTW.js";
 import {
   buildPublicUrl,
   normalizeUrlLike
 } from "./chunk-3NJASEF4.js";
+import {
+  parseJwtPayload
+} from "./chunk-OD5XLL3O.js";
+import "./chunk-34E5PYNA.js";
 
 // src/edge.ts
 import { headers } from "next/headers";

package/dist/index.d.ts

@@ -3,5 +3,5 @@ export { OidcHumanResolverConfig, createOidcHumanResolver } from './oidc-human.j
 export { OidcAuthUrlConfig, PkceChallenge, buildOidcAuthUrl, generatePkce } from './pkce.js';
 export { CliAuthResult, CliAuthStart, PollOptions, pollCliAuth, startCliAuth } from './cli-auth.js';
 export { hashToken, looksLikeJwt, stripBearer } from './token.js';
-export { JwtClaims, verifyHs256Jwt } from './jwt.js';
+export { JwtClaims, signHs256Jwt, verifyHs256Jwt } from './jwt.js';
 export { buildAccountProfileUrl, buildAuthLoginUrl, buildAuthLogoutUrl, buildPublicUrl, getAccountPublicUrl, getAppBasePath, getAuthPublicUrl, getPublicSiteUrl, normalizeUrlLike } from './url-helpers.js';

package/dist/index.js

@@ -13,13 +13,6 @@ import {
   looksLikeJwt,
   stripBearer
 } from "./chunk-VBIQJKUU.js";
-import {
-  verifyHs256Jwt
-} from "./chunk-OD5XLL3O.js";
-import {
-  buildOidcAuthUrl,
-  generatePkce
-} from "./chunk-34E5PYNA.js";
 import {
   buildAccountProfileUrl,
   buildAuthLoginUrl,
@@ -31,6 +24,14 @@ import {
   getPublicSiteUrl,
   normalizeUrlLike
 } from "./chunk-3NJASEF4.js";
+import {
+  signHs256Jwt,
+  verifyHs256Jwt
+} from "./chunk-OD5XLL3O.js";
+import {
+  buildOidcAuthUrl,
+  generatePkce
+} from "./chunk-34E5PYNA.js";
 export {
   buildAccountProfileUrl,
   buildAuthLoginUrl,
@@ -47,6 +48,7 @@ export {
   looksLikeJwt,
   normalizeUrlLike,
   pollCliAuth,
+  signHs256Jwt,
   startCliAuth,
   stripBearer,
   verifyHs256Jwt,

package/dist/session.js

@@ -9,10 +9,10 @@ import {
   handleAuthorizationCallback,
   hasServerOidcSession,
   oidcCookies
-} from "./chunk-5W4TEXCT.js";
+} from "./chunk-JS5Y2DTW.js";
+import "./chunk-3NJASEF4.js";
 import "./chunk-OD5XLL3O.js";
 import "./chunk-34E5PYNA.js";
-import "./chunk-3NJASEF4.js";
 export {
   buildAuthorizationRedirect,
   buildLogoutResponse,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@baseworks/auth",
-  "version": "0.2.3",
+  "version": "0.2.5",
   "type": "module",
   "exports": {
     ".": "./dist/index.js",
@@ -8,6 +8,7 @@
     "./oidc-human": "./dist/oidc-human.js",
     "./pkce": "./dist/pkce.js",
     "./cli-auth": "./dist/cli-auth.js",
+    "./cli": "./dist/cli.js",
     "./token": "./dist/token.js",
     "./session": "./dist/session.js",
     "./url-helpers": "./dist/url-helpers.js",
@@ -40,8 +41,10 @@
     }
   },
   "devDependencies": {
+    "@baseworks/cli": "workspace:*",
     "@baseworks/tsconfig": "workspace:*",
     "@types/node": "^26.0.1",
+    "commander": "^15.0.0",
     "hono": "^4.12.27",
     "tsup": "^8.5.1",
     "typescript": "^5.6.0"

package/src/cli.ts

@@ -0,0 +1,89 @@
+/**
+ * Importable `login` / `logout` commands for any CLI that authenticates through
+ * an auth-service (OIDC/PKCE device flow). Mirrors the `@baseworks/org/cli` and
+ * `@baseworks/iam/cli` pattern — the commands live in auth's own package; the
+ * app composes them:
+ *
+ *   import { addAuthCommands } from '@baseworks/auth/cli'
+ *   addAuthCommands(program, { authBase, cliName: 'dtab', onToken, onLogout })
+ *
+ * The device flow is auth-service's `/v1/auth/start` + `/v1/auth/poll/:state`
+ * (see `@baseworks/auth/cli-auth`). auth mints an identity JWT (`{ sub, type }`,
+ * HS256) that org-service and iam-service verify with the shared realm secret —
+ * so ONE login token works across the whole plane. Org context is not in the
+ * token; the app resolves it via org-service (`use` / `ls`).
+ */
+import { spawn } from 'node:child_process'
+import { Command } from 'commander'
+import { clr, kv, success, warn, fatal } from '@baseworks/cli/display'
+import { startCliAuth, pollCliAuth } from './cli-auth.js'
+
+export interface AuthCliDeps {
+  /** Origin of the auth mount, e.g. `http://127.0.0.1:3003` (no `/v1/auth`). */
+  authBase: string | (() => string)
+  cliName?: string
+  /** Persist the identity token (app decides where). */
+  onToken: (token: string) => void | Promise<void>
+  /** Clear persisted credentials/context. */
+  onLogout?: () => void | Promise<void>
+  /** Open the browser automatically (default true). */
+  openBrowser?: boolean
+}
+
+function resolveBase(b: AuthCliDeps['authBase']): string {
+  return (typeof b === 'function' ? b() : b).replace(/\/+$/, '')
+}
+
+function openInBrowser(url: string): void {
+  const cmd = process.platform === 'darwin' ? 'open'
+    : process.platform === 'win32' ? 'cmd'
+    : 'xdg-open'
+  const args = process.platform === 'win32' ? ['/c', 'start', '', url] : [url]
+  try { spawn(cmd, args, { stdio: 'ignore', detached: true }).unref() } catch { /* print fallback below */ }
+}
+
+/** Decode a JWT payload without verifying (display only). */
+function jwtSub(token: string): string | undefined {
+  try {
+    const seg = token.split('.')[1]
+    if (!seg) return undefined
+    const json = Buffer.from(seg.replace(/-/g, '+').replace(/_/g, '/'), 'base64').toString('utf8')
+    return (JSON.parse(json) as { sub?: string }).sub
+  } catch { return undefined }
+}
+
+export function addAuthCommands(program: Command, deps: AuthCliDeps): void {
+  const cli = deps.cliName ?? 'cli'
+
+  program.addCommand(
+    new Command('login')
+      .description('Log in via browser (OIDC/PKCE)')
+      .option('--no-open', 'Do not open the browser automatically')
+      .action(async (opts: { open?: boolean }) => {
+        const base = resolveBase(deps.authBase)
+        const start = await startCliAuth(base).catch((e: Error) => fatal(`Could not reach auth service at ${base}: ${e.message}`))
+
+        console.log(`\n  ${clr.dim}Opening your browser to sign in…${clr.reset}`)
+        console.log(`  ${clr.dim}If it does not open, visit:${clr.reset}\n  ${clr.cyan}${start.url}${clr.reset}\n`)
+        if (deps.openBrowser !== false && opts.open !== false) openInBrowser(start.url)
+
+        const { token } = await pollCliAuth(base, start.state).catch((e: Error) => fatal(e.message))
+        await deps.onToken(token)
+
+        const sub = jwtSub(token)
+        success('Logged in.')
+        if (sub) kv([['user id', sub]])
+        console.log(`  ${clr.dim}Next: ${cli} use  ·  ${cli} orgs${clr.reset}\n`)
+      }),
+  )
+
+  program.addCommand(
+    new Command('logout')
+      .description('Clear saved credentials and active context')
+      .action(async () => {
+        if (deps.onLogout) await deps.onLogout()
+        else warn('No logout handler configured.')
+        success('Logged out.')
+      }),
+  )
+}

package/src/index.ts

@@ -17,8 +17,8 @@ export type { CliAuthStart, CliAuthResult, PollOptions } from './cli-auth';
 // Token utilities
 export { hashToken, looksLikeJwt, stripBearer } from './token';
 
-// HS256 JWT verification (Node.js)
-export { verifyHs256Jwt } from './jwt';
+// HS256 JWT sign + verify (Node.js)
+export { signHs256Jwt, verifyHs256Jwt } from './jwt';
 export type { JwtClaims } from './jwt';
 
 // URL helpers (auth/account public URLs, login/logout URL builders)

package/dist/{chunk-5W4TEXCT.js → chunk-JS5Y2DTW.js}

@@ -1,13 +1,13 @@
+import {
+  getAuthPublicUrl,
+  normalizeUrlLike
+} from "./chunk-3NJASEF4.js";
 import {
   parseJwtPayload
 } from "./chunk-OD5XLL3O.js";
 import {
   generatePkce
 } from "./chunk-34E5PYNA.js";
-import {
-  getAuthPublicUrl,
-  normalizeUrlLike
-} from "./chunk-3NJASEF4.js";
 
 // src/session.ts
 import { cookies } from "next/headers";