@cobinar/dalus 0.1.0 → 0.1.1

package/README.md

@@ -18,27 +18,45 @@ relying on this day to day.
 
 ## Install
 
+```
+npm install -g @cobinar/dalus
+```
+
+Or from source, for working on dalus itself:
+
 ```
 cd dalus
 npm install
 npm link   # makes the `dalus` command available globally
 ```
 
-(Not published to npm — this is source you own and can change.)
-
 ## Log in
 
 ```
-dalus login --api-base https://worker.lobby.cobinar.com --token <your bearer token>
+dalus login
 ```
 
-dalus doesn't implement Cobinar's own signup/login flow — that lives in
-`cobinar-developers-worker`, a separate system. This command stores a
-token you've already obtained from wherever that flow gives you one, the
-same way `gh auth login --with-token` accepts a token instead of
-reimplementing GitHub's own login. Omit `--api-base`/`--token` to be
-prompted instead. Credentials are stored in `~/.dalus/credentials.json`
-(mode 0600), never inside a project directory.
+Opens your browser to sign in with Cobinar (the same sign-in every
+cobinar.com visitor uses — dalus doesn't have, and doesn't need, its own
+separate login), then stores what it gets back in
+`~/.dalus/credentials.json` (mode 0600), never inside a project
+directory. You'll also be asked for your dashboard-worker URL the first
+time — `dalus login --api-base <url>` to skip that prompt.
+
+Mechanically: dalus starts a one-shot local server on an ephemeral port,
+opens `https://cobinar.com/cli-login?port=<port>&ls=<random>`, and waits.
+That page runs the exact same auth.cobinar.com round trip as a normal
+sign-in; once it succeeds, cobinar.com's own `/auth/callback` page POSTs
+the result straight to dalus's local server (proving it's genuinely that
+page, not some other local process, via the `ls` value) and dalus takes
+it from there. No separate OAuth client, no manually copying a token out
+of a browser session.
+
+`--token <token> [--api-base <url>]` is kept as a manual fallback for a
+CI runner or a headless box with no browser to open — get a token some
+other way and hand it to dalus directly, the same way `gh auth login
+--with-token` works. A real headless flow (a one-time code, email
+verification) is planned but not built yet.
 
 `dalus login --whoami` shows what's currently stored (token
 redacted). `dalus login --logout` clears it.

package/bin/dalus.js

@@ -8,13 +8,18 @@ const { initCommand } = require('../src/commands/init');
 const HELP = `dalus — deploy Cobinar projects from the command line
 
 Usage:
-  dalus login [--api-base <url>] [--token <token>]
+  dalus login [--web-base <url>] [--api-base <url>]
+  dalus login --token <token> [--api-base <url>]
   dalus login --whoami
   dalus login --logout
   dalus init [--force]
   dalus forge [--pages] [--workers] [--storage] [--database] [--vault]
               [--env <name>] [--name <resourceName>] [--yes]
 
+  Bare "dalus login" opens your browser to sign in with Cobinar and stores
+  what it gets back. --token accepts one you already have some other way
+  (CI, a headless box with no browser) instead.
+
   Bare "dalus forge" deploys every resource in dalus.jsonc / dalus.toml /
   dalus.json found in the current directory. Passing one or more of
   --pages/--workers/--storage/--database/--vault narrows it to just

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cobinar/dalus",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Deploy Cobinar projects (Edge Compute, Static Hosting, Object Storage, Document DB, Vault) from the command line.",
   "bin": {
     "dalus": "./bin/dalus.js"

package/src/commands/login.js

@@ -1,7 +1,13 @@
 'use strict';
+const http = require('http');
+const crypto = require('crypto');
 const readline = require('readline');
+const { execFile } = require('child_process');
 const { saveCredentials, clearCredentials, loadCredentials, CREDENTIALS_PATH } = require('../config');
 
+const DEFAULT_WEB_BASE = 'https://cobinar.com';
+const LOGIN_TIMEOUT_MS = 5 * 60 * 1000;
+
 function ask(question) {
   return new Promise((resolve) => {
     const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
@@ -9,13 +15,88 @@ function ask(question) {
   });
 }
 
-// dalus does not implement Cobinar's own signup/login flow itself — that
-// lives in cobinar-developers-worker (a separate system) and issues the
-// bearer token the dashboard's browser session already uses. This
-// command just stores a token you've already obtained (from that flow,
-// wherever it prompts you for one) so dalus can send it on every
-// request, the same way `gh auth login --with-token` accepts a token
-// you got some other way rather than reimplementing GitHub's own login.
+function openBrowser(url) {
+  // execFile, not exec — no shell involved, so the URL can't be
+  // misinterpreted as shell syntax no matter what's in it.
+  const done = () => {}; // best-effort; the URL is always printed too
+  if (process.platform === 'darwin') execFile('open', [url], done);
+  else if (process.platform === 'win32') execFile('cmd', ['/c', 'start', '""', url], done);
+  else execFile('xdg-open', [url], done);
+}
+
+// Starts a one-shot local server, opens the browser to Cobinar's own web
+// login (cobinar-main's public/cli-login/ page), and waits for that page
+// to POST the result back here once the normal auth.cobinar.com round
+// trip finishes. dalus never talks to auth.cobinar.com directly and
+// never gets its own client_id/secret — it rides along on cobinar.com's
+// existing one, same as any other visitor signing in there. See
+// cobinar-main's public/cli-login/index.html and public/auth/callback.html
+// for the other half of this handshake.
+function browserLogin(webBase) {
+  // "ls" (local state): proves the browser tab that finishes is the one
+  // THIS process opened, not some other local process guessing the port
+  // and racing it — the port alone isn't a secret (any local process can
+  // see what's listening), this is.
+  const ls = crypto.randomBytes(24).toString('hex');
+  const allowedOrigin = new URL(webBase).origin;
+
+  return new Promise((resolve, reject) => {
+    let settled = false;
+
+    const server = http.createServer((req, res) => {
+      const url = new URL(req.url, 'http://127.0.0.1');
+      res.setHeader('Access-Control-Allow-Origin', allowedOrigin);
+      res.setHeader('Access-Control-Allow-Methods', 'POST, OPTIONS');
+      res.setHeader('Access-Control-Allow-Headers', 'Content-Type');
+
+      if (req.method === 'OPTIONS') { res.writeHead(204); res.end(); return; }
+      if (url.pathname !== '/complete' || req.method !== 'POST') { res.writeHead(404); res.end(); return; }
+
+      let body = '';
+      req.on('data', (chunk) => {
+        body += chunk;
+        if (body.length > 1e6) req.destroy(); // this payload is a token + a small profile, never anywhere near this size
+      });
+      req.on('end', () => {
+        let parsed = null;
+        try { parsed = JSON.parse(body); } catch { /* falls through to the ok:false below */ }
+
+        if (!parsed || parsed.ls !== ls || typeof parsed.token !== 'string' || !parsed.token) {
+          res.writeHead(400, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({ ok: false }));
+          return; // deliberately not finish()/reject() here — a stray or malicious request to this port shouldn't cancel a login still in progress
+        }
+
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ ok: true }));
+        finish(null, parsed);
+      });
+    });
+
+    function finish(err, result) {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      server.close();
+      if (err) reject(err); else resolve(result);
+    }
+
+    const timer = setTimeout(() => {
+      finish(new Error(`Timed out waiting for sign-in (${LOGIN_TIMEOUT_MS / 1000}s). Run "dalus login" again.`));
+    }, LOGIN_TIMEOUT_MS);
+
+    server.on('error', (err) => finish(err));
+
+    server.listen(0, '127.0.0.1', () => {
+      const port = server.address().port;
+      const loginUrl = `${webBase}/cli-login?port=${port}&ls=${ls}`;
+      console.log('Opening your browser to sign in with Cobinar...');
+      console.log(`If it doesn't open automatically, visit:\n  ${loginUrl}\n`);
+      openBrowser(loginUrl);
+    });
+  });
+}
+
 async function loginCommand(args) {
   if (args.includes('--logout')) {
     clearCredentials();
@@ -26,29 +107,55 @@ async function loginCommand(args) {
     const creds = loadCredentials();
     if (!creds) { console.log('Not logged in.'); return; }
     console.log(`API base: ${creds.apiBase}`);
+    if (creds.user && creds.user.email) console.log(`Signed in as: ${creds.user.email}`);
     console.log(`Token:    ${creds.token.slice(0, 8)}...${creds.token.slice(-4)} (stored in ${CREDENTIALS_PATH})`);
     return;
   }
 
-  const apiBaseArgIdx = args.indexOf('--api-base');
   const tokenArgIdx = args.indexOf('--token');
-  const apiBase = apiBaseArgIdx !== -1 ? args[apiBaseArgIdx + 1] : await ask('Cobinar dashboard-worker URL (e.g. https://worker.lobby.cobinar.com): ');
-  // Visible input, deliberately — Node's readline has no built-in masked
-  // prompt, and a hand-rolled no-echo hack is the kind of thing that's
-  // easy to get subtly wrong (garbled input, doesn't work across
-  // terminals) without a real TTY to test it against. --token on the
-  // command line, or piping the value in, avoids the prompt entirely if
-  // that matters more than a visible paste in a scrollback buffer.
-  const token = tokenArgIdx !== -1 ? args[tokenArgIdx + 1] : await ask('Bearer token (visible as you type/paste — see the note in README.md): ');
-
-  if (!apiBase || !token) {
-    console.error('Both a worker URL and a token are required.');
+  const apiBaseArgIdx = args.indexOf('--api-base');
+
+  // --token stays as a manual escape hatch for CI/headless boxes that
+  // can't open a browser at all — not the default anymore, but not worth
+  // removing until there's a real headless flow (one-time code / email,
+  // planned later) to replace it with.
+  if (tokenArgIdx !== -1) {
+    const token = args[tokenArgIdx + 1];
+    const apiBase = apiBaseArgIdx !== -1 ? args[apiBaseArgIdx + 1] : await ask('Cobinar dashboard-worker URL: ');
+    if (!token || !apiBase) {
+      console.error('Both a worker URL and a token are required.');
+      process.exitCode = 1;
+      return;
+    }
+    saveCredentials({ apiBase: apiBase.replace(/\/$/, ''), token });
+    console.log(`Saved to ${CREDENTIALS_PATH}. Run "dalus forge" from a project directory to deploy.`);
+    return;
+  }
+
+  const webBaseArgIdx = args.indexOf('--web-base');
+  const webBase = (webBaseArgIdx !== -1 ? args[webBaseArgIdx + 1] : DEFAULT_WEB_BASE).replace(/\/$/, '');
+
+  let result;
+  try {
+    result = await browserLogin(webBase);
+  } catch (err) {
+    console.error(err.message);
+    process.exitCode = 1;
+    return;
+  }
+
+  const apiBase = apiBaseArgIdx !== -1
+    ? args[apiBaseArgIdx + 1]
+    : await ask('Cobinar dashboard-worker URL (e.g. https://worker.lobby.cobinar.com): ');
+  if (!apiBase) {
+    console.error('A dashboard-worker URL is required.');
     process.exitCode = 1;
     return;
   }
 
-  saveCredentials({ apiBase: apiBase.replace(/\/$/, ''), token });
-  console.log(`Saved to ${CREDENTIALS_PATH}. Run "dalus forge" from a project directory to deploy.`);
+  saveCredentials({ apiBase: apiBase.replace(/\/$/, ''), token: result.token, user: result.user || null });
+  console.log(`Signed in${result.user && result.user.email ? ' as ' + result.user.email : ''}. Saved to ${CREDENTIALS_PATH}.`);
+  console.log('Run "dalus forge" from a project directory to deploy.');
 }
 
-module.exports = { loginCommand };
+module.exports = { loginCommand, browserLogin };