@buildinternet/uploads 0.6.0 → 0.8.0

package/dist/commands/login.js

@@ -1,15 +1,26 @@
+import { hostname } from "node:os";
+import { spawn } from "node:child_process";
 import { stdin, stdout } from "node:process";
 import { loadConfigFile, redactToken, resolveConfigPath, writeConfigKeys, workspaceFromToken, } from "../config.js";
-import { exchangeEnrollment, createUploadsClient } from "../client.js";
+import { createUploadsClient, exchangeEnrollment, listMintWorkspaces, mintWorkspaceToken, requestDeviceCode, requestDeviceToken, } from "../client.js";
 import { flagBool, flagString, parseCommandArgs, UsageError } from "../cli-args.js";
+import { parseScopes } from "./admin-enrollment.js";
 const HELP = `uploads login [options]
 
-Exchange a one-time enrollment code for workspace credentials, save them, and
-verify access. Ask your uploads.sh administrator for an enrollment code.
+Sign in and save workspace credentials. With no flags, opens a browser to
+authorize this device — the recommended way to sign in. Pass an enrollment
+code only if you were given one from before device login (fallback path).
 
 Options:
-  --code <code>       Code in argv (may be visible in shell history/process lists)
-  --code-stdin        Read one line from stdin
+  --workspace <name>  Workspace to mint a token for (device flow; required if
+                      your account can access more than one)
+  --scopes <list>     Comma-separated scopes (default: files:read,files:write)
+  --label <text>      Token label (default: this machine's hostname)
+  --auth-url <url>    Auth base (default: https://auth.uploads.sh)
+  --no-open           Don't try to open a browser automatically
+  --code <code>       Fallback: use a pre-existing enrollment code instead of
+                      device login (visible in shell history)
+  --code-stdin        Fallback: read a pre-existing enrollment code from stdin
   --non-interactive   Never prompt
   --api-url <url>     API base (default: https://api.uploads.sh)
   --path <file>       Config destination
@@ -17,10 +28,10 @@ Options:
   --no-check          Skip doctor verification
 
 Examples:
-  uploads login --code upe_…
-  uploads login --code-stdin --non-interactive < code.txt
+  uploads login
+  uploads login --workspace acme
+  uploads login --code upe_… --force              # fallback: pre-existing invite
   printf '%s' upe_… | uploads login --code-stdin --non-interactive
-  uploads login --code upe_… --force --no-check
 `;
 export function validateEnrollmentCode(raw) {
     const code = raw.trim();
@@ -104,7 +115,143 @@ export async function resolveEnrollmentCode(parsed, io = {
         return validateEnrollmentCode(await io.readLine());
     return validateEnrollmentCode(await io.hiddenPrompt());
 }
-export async function runLogin(args, opts, help = false) {
+/** True when the caller supplied an enrollment code (via flag, stdin, or env). */
+function hasEnrollmentSource(parsed) {
+    return (Boolean(flagString(parsed.flags, "--code")) ||
+        flagBool(parsed.flags, "--code-stdin") ||
+        Boolean(process.env.UPLOADS_ENROLLMENT_CODE));
+}
+/**
+ * Auth worker base URL: explicit flag > UPLOADS_AUTH_URL > swap an `api.` host
+ * label for `auth.` > the production default. Local multi-worker dev (where
+ * auth runs on a different loopback port than the API) needs an explicit
+ * --auth-url / UPLOADS_AUTH_URL.
+ */
+export function resolveAuthUrl(parsed, apiUrl) {
+    const explicit = flagString(parsed.flags, "--auth-url") ?? process.env.UPLOADS_AUTH_URL;
+    if (explicit)
+        return explicit.replace(/\/$/, "");
+    try {
+        const url = new URL(apiUrl);
+        if (url.hostname.startsWith("api.")) {
+            url.hostname = `auth.${url.hostname.slice(4)}`;
+            return url.origin;
+        }
+    }
+    catch {
+        // fall through to the default
+    }
+    return "https://auth.uploads.sh";
+}
+/** Best-effort browser open. The URL is always printed too, so failures are silent. */
+function openUrl(url) {
+    try {
+        const isWin = process.platform === "win32";
+        const command = process.platform === "darwin" ? "open" : isWin ? "cmd" : "xdg-open";
+        const args = isWin ? ["/c", "start", "", url] : [url];
+        const child = spawn(command, args, { stdio: "ignore", detached: true });
+        child.on("error", () => { });
+        child.unref();
+    }
+    catch {
+        // ignore — the URL is printed for manual navigation.
+    }
+}
+export const defaultDeviceIo = {
+    sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+    now: () => Date.now(),
+    openUrl,
+    write: (text) => {
+        process.stderr.write(text);
+    },
+};
+/**
+ * Browser device-authorization session only (no workspace token mint).
+ * Shared by `uploads login` and `uploads invite create`.
+ */
+export async function obtainDeviceAccessToken(authUrl, opts = {}, io = defaultDeviceIo) {
+    const code = await requestDeviceCode(authUrl);
+    const verifyUrl = code.verification_uri_complete ?? code.verification_uri;
+    const prompt = opts.prompt ?? "To sign in, open:";
+    io.write(`${prompt}\n\n  ${verifyUrl}\n\nand confirm this code:\n\n  ${code.user_code}\n\n`);
+    if (!opts.noOpen)
+        io.openUrl(verifyUrl);
+    io.write("Waiting for approval…\n");
+    return pollForDeviceToken(authUrl, code, io);
+}
+/**
+ * Device-authorization login (RFC 8628): request a code, have the user approve
+ * it in a browser, poll for the session token, then mint a workspace token.
+ */
+async function runDeviceLogin(parsed, opts, io) {
+    const scopes = parseScopes(flagString(parsed.flags, "--scopes"));
+    const label = flagString(parsed.flags, "--label") ?? safeHostname();
+    const requestedWorkspace = flagString(parsed.flags, "--workspace");
+    const accessToken = await obtainDeviceAccessToken(opts.authUrl, { noOpen: opts.noOpen }, io);
+    const workspace = await resolveMintWorkspace(opts.apiUrl, accessToken, requestedWorkspace);
+    const minted = await mintWorkspaceToken(opts.apiUrl, accessToken, { workspace, scopes, label });
+    return { workspace: minted.workspace, token: minted.token, apiUrl: opts.apiUrl };
+}
+function safeHostname() {
+    try {
+        return hostname() || "cli";
+    }
+    catch {
+        return "cli";
+    }
+}
+/** Poll device/token honoring interval / slow_down / pending until approved or expired. */
+export async function pollForDeviceToken(authUrl, code, io) {
+    let intervalMs = Math.max(1, code.interval) * 1000;
+    const deadline = io.now() + Math.max(1, code.expires_in) * 1000;
+    while (io.now() < deadline) {
+        await io.sleep(intervalMs);
+        let result;
+        try {
+            result = await requestDeviceToken(authUrl, { deviceCode: code.device_code });
+        }
+        catch {
+            // A transient network blip mid-poll shouldn't abort a login the user may
+            // already have approved — keep polling until the device code's deadline.
+            continue;
+        }
+        switch (result.status) {
+            case "ok":
+                return result.accessToken;
+            case "pending":
+                continue;
+            case "slow_down":
+                // RFC 8628 §3.5: back off by 5s and keep polling.
+                intervalMs += 5000;
+                continue;
+            case "denied":
+                throw new UsageError("device authorization was denied");
+            case "expired":
+                throw new UsageError("the device code expired before it was approved");
+            default:
+                throw new UsageError(`device authorization failed: ${result.error}${result.description ? ` — ${result.description}` : ""}`);
+        }
+    }
+    throw new UsageError("timed out waiting for device authorization");
+}
+/**
+ * Pick the workspace to mint for. An explicit --workspace wins; otherwise, if
+ * the account can access exactly one workspace, use it — and if it can access
+ * several, require the flag rather than guessing.
+ */
+async function resolveMintWorkspace(apiUrl, accessToken, requested) {
+    if (requested)
+        return requested;
+    const { workspaces } = await listMintWorkspaces(apiUrl, accessToken);
+    if (workspaces.length === 1)
+        return workspaces[0].workspace;
+    if (workspaces.length === 0) {
+        throw new UsageError("your account has no workspace access yet — ask an administrator for an invitation");
+    }
+    const names = workspaces.map((w) => w.workspace).join(", ");
+    throw new UsageError(`multiple workspaces available (${names}); pass --workspace <name>`);
+}
+export async function runLogin(args, opts, help = false, deviceIo = defaultDeviceIo) {
     const parsed = parseCommandArgs(args);
     if (help || parsed.help) {
         process.stderr.write(HELP);
@@ -118,11 +265,24 @@ export async function runLogin(args, opts, help = false) {
         throw new UsageError(`credentials already exist in ${path}; use --force to replace them`);
     if (process.env.UPLOADS_TOKEN && !force)
         throw new UsageError("UPLOADS_TOKEN is already set in the environment; unset it or use --force");
-    const code = await resolveEnrollmentCode(parsed);
-    const result = await exchangeEnrollment(apiUrl, code);
+    let result;
+    if (hasEnrollmentSource(parsed)) {
+        const code = await resolveEnrollmentCode(parsed);
+        result = await exchangeEnrollment(apiUrl, code);
+    }
+    else {
+        // The device flow is inherently interactive (browser approval, then a poll
+        // that runs to the device code's ~30-min deadline). Fail fast rather than
+        // hanging a non-interactive/CI invocation that has no code to fall back on.
+        if (flagBool(parsed.flags, "--non-interactive")) {
+            throw new UsageError("device login requires a browser; run interactively, or pass --code for the enrollment path");
+        }
+        const authUrl = resolveAuthUrl(parsed, apiUrl);
+        result = await runDeviceLogin(parsed, { apiUrl, authUrl, noOpen: flagBool(parsed.flags, "--no-open") }, deviceIo);
+    }
     const encoded = workspaceFromToken(result.token);
     if (!encoded || encoded !== result.workspace || /[\r\n]/.test(result.token))
-        throw new UsageError("enrollment returned invalid credentials");
+        throw new UsageError("login returned invalid credentials");
     const savedApiUrl = result.apiUrl ?? apiUrl;
     const write = writeConfigKeys(path, {
         UPLOADS_API_URL: savedApiUrl,

package/dist/commands/setup.js

@@ -64,8 +64,10 @@ function formatWizard(status) {
     lines.push("");
     if (!status.token) {
         lines.push("Step 1 — Sign in");
-        lines.push("  Ask your uploads.sh administrator for a one-time enrollment code, then run:");
+        lines.push("  Run:");
         lines.push("    uploads login");
+        lines.push("  This opens a browser to authorize this device.");
+        lines.push("  Have a pre-existing enrollment code instead? uploads login --code upe_…");
         lines.push("  If you already have a bearer token:");
         lines.push("    uploads setup --token up_<workspace>_…");
         lines.push("");
@@ -207,7 +209,7 @@ export async function runSetup(args, opts, help = false) {
         process.stderr.write("hint: run uploads doctor to verify\n");
     }
     else {
-        process.stderr.write("hint: run uploads login with an admin-provided enrollment code\n");
+        process.stderr.write("hint: run uploads login (or uploads login --code <code> if you have one)\n");
     }
     return doctorOk === false ? 1 : 0;
 }

package/dist/commands.d.ts

@@ -13,6 +13,8 @@ export interface CliContext {
     quiet: boolean;
     envFile?: string;
 }
+/** Read a local file (or `-` for stdin). Missing path → FILE_NOT_FOUND (exit 2). */
+export declare function readFileArg(fileArg: string): Uint8Array;
 /**
  * Turns a pr/issue pair (+ optional repo) into a GhTarget; undefined when
  * neither is present. Shared by the CLI flags and the MCP tool arguments.
@@ -43,6 +45,8 @@ export declare function runAttach(ctx: CliContext, args: string[], help?: boolea
 export declare function runPut(ctx: CliContext, args: string[], help?: boolean, run?: CommandRunner): Promise<number>;
 export declare function runGallery(ctx: CliContext, args: string[], help?: boolean): Promise<number>;
 export declare function runList(ctx: CliContext, args: string[], help?: boolean, run?: CommandRunner): Promise<number>;
+export declare function runFind(ctx: CliContext, args: string[], help?: boolean): Promise<number>;
+export declare function runMeta(ctx: CliContext, args: string[], help?: boolean): Promise<number>;
 export declare function runDelete(ctx: CliContext, args: string[], help?: boolean): Promise<number>;
 export declare function runComment(ctx: CliContext, args: string[], help?: boolean, run?: CommandRunner): Promise<number>;
 export declare function runUsage(ctx: CliContext, args: string[], help?: boolean): Promise<number>;