@clearlysh/beehaven 0.8.16

package/dist/setup-relay.js

@@ -0,0 +1,363 @@
+#!/usr/bin/env node
+// ============================================================================
+// Beehaven Office - Relay Setup (Login)
+// Browser-based OAuth login flow for Clearly account
+// ============================================================================
+import http from 'http';
+import crypto from 'crypto';
+import { createInterface } from 'readline';
+import { existsSync, readFileSync, writeFileSync, mkdirSync, chmodSync } from 'fs';
+import { homedir } from 'os';
+import { join } from 'path';
+import { spawnSync } from 'child_process';
+import { Relay, CLEARLY_RELAY_URL } from './relay.js';
+import { resolveRelaySelection } from './relay-presets.js';
+import { SESSION_KEYCHAIN_ACCOUNTS, KEYCHAIN_SERVICE } from './keychain.js';
+import { withUtm } from './utm.js';
+const CONFIG_DIR = join(homedir(), '.beehaven');
+const CONFIG_FILE = join(CONFIG_DIR, 'config.json');
+const AUTH_BASE_URL = 'https://clearly.sh/auth/beehaven';
+const LOGIN_TIMEOUT_MS = 120_000; // 2 minutes
+/**
+ * The raw config, for questions that must be answered BEFORE a token exists.
+ * `Relay.loadConfig()` returns null without one, which is the state a first login is in.
+ */
+function readConfigFile() {
+    if (!existsSync(CONFIG_FILE))
+        return {};
+    try {
+        return JSON.parse(readFileSync(CONFIG_FILE, 'utf8'));
+    }
+    catch {
+        return {};
+    }
+}
+function saveRelayConfig(token, endpoint) {
+    mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 });
+    let existing = {};
+    if (existsSync(CONFIG_FILE)) {
+        try {
+            existing = JSON.parse(readFileSync(CONFIG_FILE, 'utf8'));
+        }
+        catch (err) {
+            console.warn(`[config] Failed to parse ${CONFIG_FILE}:`, err.message);
+        }
+    }
+    existing.token = token;
+    // ⚠ BOTH KEYS, as `beehaven env` writes them — `endpoint` is dialled, `relayUrl` is the alias
+    // other surfaces read. Updating one leaves the other naming a different environment.
+    existing.endpoint = endpoint;
+    existing.relayUrl = endpoint;
+    existing.tier = 'connected';
+    writeFileSync(CONFIG_FILE, JSON.stringify(existing, null, 2));
+    chmodSync(CONFIG_FILE, 0o600);
+}
+function prompt(question) {
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    return new Promise((resolve) => {
+        rl.question(question, (answer) => {
+            rl.close();
+            resolve(answer.trim());
+        });
+    });
+}
+/**
+ * Start a local HTTP server on a random port to receive the OAuth callback.
+ * Returns a promise for the token, plus helpers to get the port and close.
+ */
+function startCallbackServer() {
+    let resolveToken;
+    let rejectToken;
+    let serverRef;
+    let settled = false;
+    const oauthState = crypto.randomBytes(32).toString('hex');
+    const promise = new Promise((resolve, reject) => {
+        resolveToken = resolve;
+        rejectToken = reject;
+        serverRef = http.createServer((req, res) => {
+            if (settled)
+                return;
+            const url = new URL(req.url, `http://localhost`);
+            if (url.pathname === '/callback') {
+                // Validate OAuth state parameter to prevent CSRF (skip if server doesn't echo it back yet)
+                const returnedState = url.searchParams.get('state');
+                if (returnedState && returnedState !== oauthState) {
+                    res.writeHead(403, { 'Content-Type': 'text/html' });
+                    res.end('<!DOCTYPE html><html><body><h1>Invalid state parameter</h1></body></html>');
+                    return;
+                }
+                const token = url.searchParams.get('token');
+                if (token) {
+                    settled = true;
+                    res.writeHead(200, { 'Content-Type': 'text/html' });
+                    res.end([
+                        '<!DOCTYPE html><html><head>',
+                        '<meta charset="utf-8">',
+                        '<title>Beehaven - Logged In</title>',
+                        '<style>',
+                        'body{font-family:system-ui,-apple-system,sans-serif;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0;background:#fef9ef}',
+                        '.card{text-align:center;padding:48px;border-radius:16px;background:white;box-shadow:0 2px 12px rgba(0,0,0,0.08)}',
+                        'h1{margin:0 0 8px;font-size:24px}',
+                        'p{margin:0;color:#666;font-size:15px}',
+                        '.bee{font-size:48px;margin-bottom:16px}',
+                        '</style>',
+                        '</head><body>',
+                        '<div class="card">',
+                        '<div class="bee">&#x1F41D;</div>',
+                        '<h1>Logged in!</h1>',
+                        '<p>You can close this tab and return to your terminal.</p>',
+                        '</div>',
+                        '</body></html>',
+                    ].join(''));
+                    serverRef.close();
+                    resolve(token);
+                }
+                else {
+                    res.writeHead(400, { 'Content-Type': 'text/html' });
+                    res.end('<!DOCTYPE html><html><body><h1>Missing token</h1></body></html>');
+                }
+            }
+            else {
+                res.writeHead(404);
+                res.end();
+            }
+        });
+        serverRef.listen(0, '127.0.0.1');
+        // Timeout after 2 minutes
+        const timer = setTimeout(() => {
+            if (!settled) {
+                settled = true;
+                serverRef.close();
+                reject(new Error('Login timed out after 2 minutes.'));
+            }
+        }, LOGIN_TIMEOUT_MS);
+        serverRef.on('close', () => clearTimeout(timer));
+    });
+    return {
+        promise,
+        getPort: () => serverRef.address()?.port || 0,
+        close: () => {
+            settled = true;
+            serverRef?.close();
+        },
+        state: oauthState,
+    };
+}
+export async function login() {
+    console.log('');
+    console.log('  Clearly account required to use Beehaven.');
+    console.log('');
+    // Check for existing valid config
+    const existing = Relay.loadConfig();
+    if (existing) {
+        console.log('  Checking existing session...');
+        const relay = new Relay();
+        const profile = await relay.verifyToken(existing.token, existing.endpoint || CLEARLY_RELAY_URL);
+        if (profile) {
+            if (profile.displayName) {
+                console.log(`  Already logged in as ${profile.displayName} (${profile.subscriptionPlan})`);
+            }
+            else {
+                console.log('  Already logged in.');
+            }
+            return true;
+        }
+        console.log('  Session expired. Please log in again.');
+        console.log('');
+    }
+    // Start local callback server
+    const callbackServer = startCallbackServer();
+    // Small delay to let server bind
+    await new Promise((r) => setTimeout(r, 100));
+    const port = callbackServer.getPort();
+    if (!port) {
+        console.log('  Failed to start auth server.');
+        callbackServer.close();
+        return false;
+    }
+    const callbackUrl = `http://localhost:${port}/callback`;
+    const authUrl = withUtm(`${AUTH_BASE_URL}?callback=${encodeURIComponent(callbackUrl)}&state=${callbackServer.state}`);
+    // Try to open browser
+    let browserOpened = false;
+    try {
+        const openModule = await import('open');
+        await openModule.default(authUrl);
+        browserOpened = true;
+    }
+    catch {
+        browserOpened = false;
+    }
+    if (browserOpened) {
+        console.log('  Opening browser to sign in with Google...');
+        console.log('');
+        console.log('  Waiting for login... (press Ctrl+C to cancel)');
+    }
+    else {
+        // Fallback: show URL and offer manual token paste
+        console.log('  Could not open browser. Sign in manually:');
+        console.log('');
+        console.log(`  1. Open: ${authUrl}`);
+        console.log('  2. Sign in with Google');
+        console.log('');
+        console.log('  Waiting for login callback...');
+        console.log('  Or paste your relay token below:');
+        console.log('');
+        // Race: callback server vs manual token paste
+        const manualToken = prompt('  Relay token: ').then((token) => {
+            if (token) {
+                callbackServer.close();
+                return token;
+            }
+            return null;
+        });
+        try {
+            const token = await Promise.race([
+                callbackServer.promise,
+                manualToken.then((t) => {
+                    if (t)
+                        return t;
+                    return new Promise(() => { });
+                }),
+            ]);
+            if (token) {
+                return await verifyAndSave(token);
+            }
+        }
+        catch (err) {
+            console.log(`  ${err.message}`);
+            return false;
+        }
+    }
+    // Wait for callback
+    try {
+        const token = await callbackServer.promise;
+        return await verifyAndSave(token);
+    }
+    catch (err) {
+        console.log(`  ${err.message}`);
+        return false;
+    }
+}
+async function verifyAndSave(token) {
+    // Validate token format before sending to server
+    if (!token || !/^[a-zA-Z0-9_\-.]{20,}$/.test(token)) {
+        console.log('  Invalid token format.');
+        return false;
+    }
+    console.log('');
+    console.log('  Verifying...');
+    const relay = new Relay();
+    /**
+     * ⚠⚠ THE ACTIVE RELAY, NOT A HARDCODED PROD CONSTANT. Both of these were `CLEARLY_RELAY_URL`, so
+     * a staging or dev user who signed in here was VERIFIED against prod and then had `endpoint`
+     * OVERWRITTEN to prod — silently moving them to another environment as a side effect of logging
+     * in. `beehaven env staging` writes the target; a login must honour it, never redefine it.
+     *
+     * ⚠ Read from the file rather than `Relay.loadConfig()`: that returns null without a token, which
+     * is exactly the state a first login is in. `resolveRelaySelection` defaults to prod when the
+     * config names nothing, so the no-config case is unchanged.
+     */
+    const dialUrl = resolveRelaySelection(readConfigFile()).url;
+    const profile = await relay.verifyToken(token, dialUrl);
+    if (profile) {
+        saveRelayConfig(token, dialUrl);
+        if (profile.displayName) {
+            console.log(`  Logged in as ${profile.displayName} (${profile.subscriptionPlan})`);
+        }
+        else {
+            console.log('  Logged in.');
+        }
+        console.log('  Config saved to ~/.beehaven/config.json');
+        console.log('');
+        return true;
+    }
+    else {
+        console.log('  Token verification failed. Please try again.');
+        console.log('');
+        return false;
+    }
+}
+export function logout() {
+    // Clear the daemon's keychain entries first — without this, the
+    // next daemon start finds the still-valid token via
+    // `security find-generic-password -s beehaven -a daemon-token`
+    // (Relay.loadConfig reads keychain when tokenStorage='keychain'),
+    // surfacing as "I signed out and the app auto-signed back in
+    // on launch." We catch every error path so a missing /usr/bin/
+    // security or a not-found entry doesn't bail us out before the
+    // config-file clear below.
+    try {
+        /**
+         * ⚠⚠ THIS USED A BARE `require('child_process')` AND THEREFORE CLEARED NOTHING, EVER.
+         *
+         * This package is `"type": "module"`, so `require` is not defined and the call threw on its
+         * first line — straight into the catch below, which logs and moves on. Every logout and every
+         * uninstall reported success while leaving the daemon token, the Firebase refresh token and
+         * the IPC secret sitting in the login keychain.
+         *
+         * ⚠ AND THE COMMENT THAT WAS HERE EXPLAINED WHY, USING A PREMISE THAT WAS ITSELF A BUG: it
+         * said this file "is required from the Electron main process via CommonJS `require()`", which
+         * was TRUE and was not supposed to be — `loadBeehavenModule` intended `import()` and had been
+         * silently downleveled to `require()` by `"module": "CommonJS"`. So a workaround was written
+         * to fit broken behaviour, and it only surfaced when that was repaired. The two had to be
+         * fixed together, and neither is visible from the other's file.
+         */
+        const cleared = [];
+        for (const account of SESSION_KEYCHAIN_ACCOUNTS) {
+            const r = spawnSync('/usr/bin/security', ['delete-generic-password', '-s', KEYCHAIN_SERVICE, '-a', account], { stdio: 'ignore' });
+            if (r.status === 0)
+                cleared.push(account);
+        }
+        console.log('[logout] keychain-cleared accounts=' + JSON.stringify(cleared));
+    }
+    catch (err) {
+        console.log('[logout] keychain-clear-failed err=' + ((err && err.message) || String(err)));
+    }
+    if (!existsSync(CONFIG_FILE)) {
+        console.log('  Not logged in.');
+        console.log('[logout] config-missing path=' + CONFIG_FILE);
+        return;
+    }
+    try {
+        const config = JSON.parse(readFileSync(CONFIG_FILE, 'utf8'));
+        // Capture what we're about to clear so the log line lets us
+        // diagnose "tray sign-out didn't take" without a debugger.
+        const had = {
+            token: !!config.token,
+            refreshToken: !!config.refreshToken,
+            endpoint: !!config.endpoint,
+            user: !!config.user,
+            tokenStorage: config.tokenStorage ?? null,
+        };
+        delete config.token;
+        delete config.endpoint;
+        delete config.user;
+        // Clear the refresh token too — without this, the tray's
+        // hasRefreshToken check stays true and the "Sign in to Hive"
+        // menu item never reappears after sign-out (so the user can't
+        // re-auth from the tray; they'd have to quit + relaunch).
+        delete config.refreshToken;
+        // tokenStorage is just a hint to loadConfig() — clearing it
+        // belt-and-braces: even if a stale keychain entry survived
+        // the spawnSync above, the next loadConfig will read the
+        // (now-empty) `parsed.token` instead of falling through to
+        // `security find-generic-password`.
+        delete config.tokenStorage;
+        config.tier = 'local';
+        writeFileSync(CONFIG_FILE, JSON.stringify(config, null, 2));
+        chmodSync(CONFIG_FILE, 0o600);
+        console.log('[logout] cleared had=' + JSON.stringify(had));
+        console.log('  Logged out. Sign in again from the Clearly Dev Mac app tray.');
+    }
+    catch (err) {
+        console.log('  Failed to update config.');
+        console.log('[logout] update-failed err=' + ((err && err.message) || String(err)));
+    }
+}
+// Allow running directly: tsx src/setup-relay.ts
+if (process.argv[1]?.endsWith('setup-relay.ts') || process.argv[1]?.endsWith('setup-relay.js')) {
+    login().catch((err) => {
+        console.error('Login failed:', err.message);
+        process.exit(1);
+    });
+}