@cobinar/dalus 0.1.0 → 0.1.3

package/README.md

@@ -18,27 +18,53 @@ relying on this day to day.
 
 ## Install
 
+```
+npm install -g @cobinar/dalus
+```
+
+Or from source, for working on dalus itself:
+
 ```
 cd dalus
 npm install
 npm link   # makes the `dalus` command available globally
 ```
 
-(Not published to npm — this is source you own and can change.)
-
 ## Log in
 
 ```
-dalus login --api-base https://worker.lobby.cobinar.com --token <your bearer token>
+dalus login
 ```
 
-dalus doesn't implement Cobinar's own signup/login flow — that lives in
-`cobinar-developers-worker`, a separate system. This command stores a
-token you've already obtained from wherever that flow gives you one, the
-same way `gh auth login --with-token` accepts a token instead of
-reimplementing GitHub's own login. Omit `--api-base`/`--token` to be
-prompted instead. Credentials are stored in `~/.dalus/credentials.json`
-(mode 0600), never inside a project directory.
+Opens your browser to sign in with Cobinar (the same sign-in every
+cobinar.com visitor uses — dalus doesn't have, and doesn't need, its own
+separate login), then stores what it gets back in
+`~/.dalus/credentials.json` (mode 0600), never inside a project
+directory. You'll also be asked for your dashboard-worker URL the first
+time — `dalus login --api-base <url>` to skip that prompt.
+
+Mechanically: dalus starts a one-shot local server on an ephemeral port,
+opens `https://cobinar.com/cli-login?port=<port>&ls=<random>`, and waits.
+That page runs the exact same auth.cobinar.com round trip as a normal
+sign-in; once it succeeds, cobinar.com's own `/auth/callback` page POSTs a
+short-lived, single-use code to dalus's local server (proving it's
+genuinely that page, not some other local process, via the `ls` value).
+dalus then redeems that code itself, directly against
+`cobinar-developers-worker`'s `/auth/redeem-code` (override with
+`--developers-base` for staging), which is what actually mints the
+signed token dashboard-worker checks — cobinar.com's callback never
+holds or sees that token, only the one-time code. No separate OAuth
+client, no manually copying anything out of a browser session.
+
+The stored token lasts 2 hours (`cobinar-developers-worker` sets that
+expiry) — `dalus login` again once a command starts failing with a
+session-expired error.
+
+`--token <token> [--api-base <url>]` is kept as a manual fallback for a
+CI runner or a headless box with no browser to open — get a token some
+other way and hand it to dalus directly, the same way `gh auth login
+--with-token` works. A real headless flow (a one-time code, email
+verification) is planned but not built yet.
 
 `dalus login --whoami` shows what's currently stored (token
 redacted). `dalus login --logout` clears it.

package/bin/dalus.js

@@ -8,13 +8,18 @@ const { initCommand } = require('../src/commands/init');
 const HELP = `dalus — deploy Cobinar projects from the command line
 
 Usage:
-  dalus login [--api-base <url>] [--token <token>]
+  dalus login [--web-base <url>] [--api-base <url>]
+  dalus login --token <token> [--api-base <url>]
   dalus login --whoami
   dalus login --logout
   dalus init [--force]
   dalus forge [--pages] [--workers] [--storage] [--database] [--vault]
               [--env <name>] [--name <resourceName>] [--yes]
 
+  Bare "dalus login" opens your browser to sign in with Cobinar and stores
+  what it gets back. --token accepts one you already have some other way
+  (CI, a headless box with no browser) instead.
+
   Bare "dalus forge" deploys every resource in dalus.jsonc / dalus.toml /
   dalus.json found in the current directory. Passing one or more of
   --pages/--workers/--storage/--database/--vault narrows it to just
@@ -55,6 +60,10 @@ async function main() {
 }
 
 main().catch((err) => {
-  console.error(err.message || err);
+  if (err && err.status === 401) {
+    console.error('Your Cobinar session expired or was rejected. Run "dalus login" again.');
+  } else {
+    console.error(err.message || err);
+  }
   process.exitCode = 1;
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cobinar/dalus",
-  "version": "0.1.0",
+  "version": "0.1.3",
   "description": "Deploy Cobinar projects (Edge Compute, Static Hosting, Object Storage, Document DB, Vault) from the command line.",
   "bin": {
     "dalus": "./bin/dalus.js"

package/src/commands/login.js

@@ -1,7 +1,20 @@
 'use strict';
+const http = require('http');
+const crypto = require('crypto');
 const readline = require('readline');
+const { execFile } = require('child_process');
 const { saveCredentials, clearCredentials, loadCredentials, CREDENTIALS_PATH } = require('../config');
 
+const DEFAULT_WEB_BASE = 'https://cobinar.com';
+// cobinar-developers-worker — mints the actual bearer token dashboard-worker
+// checks (a signed "workerToken"), from the one-time code cobinar.com's
+// callback hands us. Not the same thing as cobinar.com itself or as
+// auth.cobinar.com (Cobinar's general sign-in provider, which cobinar.com
+// is a client of) — those are three separate services. See the comment on
+// exchangeSsoCode below for the exact handoff.
+const DEFAULT_DEVELOPERS_BASE = 'https://worker.dashboard.cobinar.com';
+const LOGIN_TIMEOUT_MS = 5 * 60 * 1000;
+
 function ask(question) {
   return new Promise((resolve) => {
     const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
@@ -9,13 +22,145 @@ function ask(question) {
   });
 }
 
-// dalus does not implement Cobinar's own signup/login flow itself — that
-// lives in cobinar-developers-worker (a separate system) and issues the
-// bearer token the dashboard's browser session already uses. This
-// command just stores a token you've already obtained (from that flow,
-// wherever it prompts you for one) so dalus can send it on every
-// request, the same way `gh auth login --with-token` accepts a token
-// you got some other way rather than reimplementing GitHub's own login.
+function openBrowser(url) {
+  // execFile, not exec — no shell involved, so the URL can't be
+  // misinterpreted as shell syntax no matter what's in it.
+  const done = () => {}; // best-effort; the URL is always printed too
+  if (process.platform === 'darwin') execFile('open', [url], done);
+  else if (process.platform === 'win32') execFile('cmd', ['/c', 'start', '""', url], done);
+  else execFile('xdg-open', [url], done);
+}
+
+function postJson(urlString, body) {
+  return new Promise((resolve, reject) => {
+    const url = new URL(urlString);
+    const data = JSON.stringify(body);
+    const req = require(url.protocol === 'http:' ? 'http' : 'https').request(
+      {
+        hostname: url.hostname,
+        port: url.port || (url.protocol === 'http:' ? 80 : 443),
+        path: url.pathname + url.search,
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(data) },
+      },
+      (res) => {
+        let out = '';
+        res.on('data', (c) => (out += c));
+        res.on('end', () => {
+          let parsed = null;
+          try { parsed = JSON.parse(out); } catch { /* leaves parsed null below */ }
+          resolve({ status: res.statusCode, json: parsed });
+        });
+      },
+    );
+    req.on('error', reject);
+    req.write(data);
+    req.end();
+  });
+}
+
+// The other half of cobinar-developers-worker's POST /auth/redeem-code:
+// cobinar.com's callback page writes { uid, email, name, picture } to a KV
+// namespace it shares with cobinar-developers-worker, keyed by a one-time
+// code, and hands US that code (over the loopback server below, once the
+// browser gets there). Redeeming it here — not on cobinar.com's server, and
+// not in the browser — is what actually mints the workerToken dashboard-
+// worker will accept; nothing before this point has needed dashboard-worker
+// to trust anything, since a workerToken is the first credential in this
+// whole flow it actually checks.
+async function exchangeSsoCode(developersBase, code) {
+  const { status, json } = await postJson(`${developersBase}/auth/redeem-code`, { code });
+  if (status !== 200 || !json || typeof json.workerToken !== 'string') {
+    const detail = json && json.error ? json.error : `HTTP ${status}`;
+    throw new Error(`Could not finish signing in (${detail}). Run "dalus login" again.`);
+  }
+  return json;
+}
+
+// Starts a one-shot local server, opens the browser to Cobinar's own web
+// login (cobinar-main's public/cli-login/ page), and waits for that page to
+// POST a one-time SSO code back here once the normal auth.cobinar.com round
+// trip finishes. dalus never talks to auth.cobinar.com directly and never
+// gets its own client_id/secret — it rides along on cobinar.com's existing
+// one, same as any other visitor signing in there. See cobinar-main's
+// public/cli-login/index.html and public/auth/callback.html for the other
+// half of this handshake, and exchangeSsoCode above for what happens to the
+// code once it arrives.
+function browserLogin(webBase, developersBase) {
+  // "ls" (local state): proves the browser tab that finishes is the one
+  // THIS process opened, not some other local process guessing the port
+  // and racing it — the port alone isn't a secret (any local process can
+  // see what's listening), this is.
+  const ls = crypto.randomBytes(24).toString('hex');
+  const allowedOrigin = new URL(webBase).origin;
+
+  return new Promise((resolve, reject) => {
+    let settled = false;
+
+    const server = http.createServer((req, res) => {
+      const url = new URL(req.url, 'http://127.0.0.1');
+      res.setHeader('Access-Control-Allow-Origin', allowedOrigin);
+      res.setHeader('Access-Control-Allow-Methods', 'POST, OPTIONS');
+      res.setHeader('Access-Control-Allow-Headers', 'Content-Type');
+
+      if (req.method === 'OPTIONS') { res.writeHead(204); res.end(); return; }
+      if (url.pathname !== '/complete' || req.method !== 'POST') { res.writeHead(404); res.end(); return; }
+
+      let body = '';
+      req.on('data', (chunk) => {
+        body += chunk;
+        if (body.length > 1e6) req.destroy(); // this payload is a short code + a small profile, never anywhere near this size
+      });
+      req.on('end', async () => {
+        let parsed = null;
+        try { parsed = JSON.parse(body); } catch { /* falls through to the ok:false below */ }
+
+        if (!parsed || parsed.ls !== ls || typeof parsed.code !== 'string' || !parsed.code) {
+          res.writeHead(400, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({ ok: false }));
+          return; // deliberately not finish()/reject() here — a stray or malicious request to this port shouldn't cancel a login still in progress
+        }
+
+        try {
+          const redeemed = await exchangeSsoCode(developersBase, parsed.code);
+          res.writeHead(200, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({ ok: true }));
+          finish(null, {
+            token: redeemed.workerToken,
+            user: parsed.user || { email: redeemed.cobinarEmail, name: redeemed.displayName, picture: redeemed.photoURL },
+          });
+        } catch (err) {
+          res.writeHead(502, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({ ok: false, error: err.message }));
+          finish(err);
+        }
+      });
+    });
+
+    function finish(err, result) {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      server.close();
+      if (err) reject(err); else resolve(result);
+    }
+
+    const timer = setTimeout(() => {
+      finish(new Error(`Timed out waiting for sign-in (${LOGIN_TIMEOUT_MS / 1000}s). Run "dalus login" again.`));
+    }, LOGIN_TIMEOUT_MS);
+
+    server.on('error', (err) => finish(err));
+
+    server.listen(0, '127.0.0.1', () => {
+      const port = server.address().port;
+      const loginUrl = `${webBase}/cli-login?port=${port}&ls=${ls}`;
+      console.log('Opening your browser to sign in with Cobinar...');
+      console.log(`If it doesn't open automatically, visit:\n  ${loginUrl}\n`);
+      openBrowser(loginUrl);
+    });
+  });
+}
+
 async function loginCommand(args) {
   if (args.includes('--logout')) {
     clearCredentials();
@@ -26,29 +171,59 @@ async function loginCommand(args) {
     const creds = loadCredentials();
     if (!creds) { console.log('Not logged in.'); return; }
     console.log(`API base: ${creds.apiBase}`);
+    if (creds.user && creds.user.email) console.log(`Signed in as: ${creds.user.email}`);
     console.log(`Token:    ${creds.token.slice(0, 8)}...${creds.token.slice(-4)} (stored in ${CREDENTIALS_PATH})`);
+    console.log('Note: this token expires 2 hours after signing in — "dalus login" again once it does.');
     return;
   }
 
-  const apiBaseArgIdx = args.indexOf('--api-base');
   const tokenArgIdx = args.indexOf('--token');
-  const apiBase = apiBaseArgIdx !== -1 ? args[apiBaseArgIdx + 1] : await ask('Cobinar dashboard-worker URL (e.g. https://worker.lobby.cobinar.com): ');
-  // Visible input, deliberately — Node's readline has no built-in masked
-  // prompt, and a hand-rolled no-echo hack is the kind of thing that's
-  // easy to get subtly wrong (garbled input, doesn't work across
-  // terminals) without a real TTY to test it against. --token on the
-  // command line, or piping the value in, avoids the prompt entirely if
-  // that matters more than a visible paste in a scrollback buffer.
-  const token = tokenArgIdx !== -1 ? args[tokenArgIdx + 1] : await ask('Bearer token (visible as you type/paste — see the note in README.md): ');
-
-  if (!apiBase || !token) {
-    console.error('Both a worker URL and a token are required.');
+  const apiBaseArgIdx = args.indexOf('--api-base');
+
+  // --token stays as a manual escape hatch for CI/headless boxes that
+  // can't open a browser at all — not the default anymore, but not worth
+  // removing until there's a real headless flow (one-time code / email,
+  // planned later) to replace it with.
+  if (tokenArgIdx !== -1) {
+    const token = args[tokenArgIdx + 1];
+    const apiBase = apiBaseArgIdx !== -1 ? args[apiBaseArgIdx + 1] : await ask('Cobinar dashboard-worker URL: ');
+    if (!token || !apiBase) {
+      console.error('Both a worker URL and a token are required.');
+      process.exitCode = 1;
+      return;
+    }
+    saveCredentials({ apiBase: apiBase.replace(/\/$/, ''), token });
+    console.log(`Saved to ${CREDENTIALS_PATH}. Run "dalus forge" from a project directory to deploy.`);
+    return;
+  }
+
+  const webBaseArgIdx = args.indexOf('--web-base');
+  const webBase = (webBaseArgIdx !== -1 ? args[webBaseArgIdx + 1] : DEFAULT_WEB_BASE).replace(/\/$/, '');
+  const developersBaseArgIdx = args.indexOf('--developers-base');
+  const developersBase = (developersBaseArgIdx !== -1 ? args[developersBaseArgIdx + 1] : DEFAULT_DEVELOPERS_BASE).replace(/\/$/, '');
+
+  let result;
+  try {
+    result = await browserLogin(webBase, developersBase);
+  } catch (err) {
+    console.error(err.message);
+    process.exitCode = 1;
+    return;
+  }
+
+  const apiBase = apiBaseArgIdx !== -1
+    ? args[apiBaseArgIdx + 1]
+    : await ask('Cobinar dashboard-worker URL (e.g. https://worker.lobby.cobinar.com): ');
+  if (!apiBase) {
+    console.error('A dashboard-worker URL is required.');
     process.exitCode = 1;
     return;
   }
 
-  saveCredentials({ apiBase: apiBase.replace(/\/$/, ''), token });
-  console.log(`Saved to ${CREDENTIALS_PATH}. Run "dalus forge" from a project directory to deploy.`);
+  saveCredentials({ apiBase: apiBase.replace(/\/$/, ''), token: result.token, user: result.user || null });
+  console.log(`Signed in${result.user && result.user.email ? ' as ' + result.user.email : ''}. Saved to ${CREDENTIALS_PATH}.`);
+  console.log('This session lasts 2 hours — "dalus login" again once it expires.');
+  console.log('Run "dalus forge" from a project directory to deploy.');
 }
 
-module.exports = { loginCommand };
+module.exports = { loginCommand, browserLogin, exchangeSsoCode };