@cobinar/dalus 0.1.1 → 0.1.3

package/README.md

@@ -46,11 +46,19 @@ time — `dalus login --api-base <url>` to skip that prompt.
 Mechanically: dalus starts a one-shot local server on an ephemeral port,
 opens `https://cobinar.com/cli-login?port=<port>&ls=<random>`, and waits.
 That page runs the exact same auth.cobinar.com round trip as a normal
-sign-in; once it succeeds, cobinar.com's own `/auth/callback` page POSTs
-the result straight to dalus's local server (proving it's genuinely that
-page, not some other local process, via the `ls` value) and dalus takes
-it from there. No separate OAuth client, no manually copying a token out
-of a browser session.
+sign-in; once it succeeds, cobinar.com's own `/auth/callback` page POSTs a
+short-lived, single-use code to dalus's local server (proving it's
+genuinely that page, not some other local process, via the `ls` value).
+dalus then redeems that code itself, directly against
+`cobinar-developers-worker`'s `/auth/redeem-code` (override with
+`--developers-base` for staging), which is what actually mints the
+signed token dashboard-worker checks — cobinar.com's callback never
+holds or sees that token, only the one-time code. No separate OAuth
+client, no manually copying anything out of a browser session.
+
+The stored token lasts 2 hours (`cobinar-developers-worker` sets that
+expiry) — `dalus login` again once a command starts failing with a
+session-expired error.
 
 `--token <token> [--api-base <url>]` is kept as a manual fallback for a
 CI runner or a headless box with no browser to open — get a token some

package/bin/dalus.js

@@ -60,6 +60,10 @@ async function main() {
 }
 
 main().catch((err) => {
-  console.error(err.message || err);
+  if (err && err.status === 401) {
+    console.error('Your Cobinar session expired or was rejected. Run "dalus login" again.');
+  } else {
+    console.error(err.message || err);
+  }
   process.exitCode = 1;
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cobinar/dalus",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "Deploy Cobinar projects (Edge Compute, Static Hosting, Object Storage, Document DB, Vault) from the command line.",
   "bin": {
     "dalus": "./bin/dalus.js"

package/src/commands/login.js

@@ -6,6 +6,13 @@ const { execFile } = require('child_process');
 const { saveCredentials, clearCredentials, loadCredentials, CREDENTIALS_PATH } = require('../config');
 
 const DEFAULT_WEB_BASE = 'https://cobinar.com';
+// cobinar-developers-worker — mints the actual bearer token dashboard-worker
+// checks (a signed "workerToken"), from the one-time code cobinar.com's
+// callback hands us. Not the same thing as cobinar.com itself or as
+// auth.cobinar.com (Cobinar's general sign-in provider, which cobinar.com
+// is a client of) — those are three separate services. See the comment on
+// exchangeSsoCode below for the exact handoff.
+const DEFAULT_DEVELOPERS_BASE = 'https://worker.dashboard.cobinar.com';
 const LOGIN_TIMEOUT_MS = 5 * 60 * 1000;
 
 function ask(question) {
@@ -24,15 +31,62 @@ function openBrowser(url) {
   else execFile('xdg-open', [url], done);
 }
 
+function postJson(urlString, body) {
+  return new Promise((resolve, reject) => {
+    const url = new URL(urlString);
+    const data = JSON.stringify(body);
+    const req = require(url.protocol === 'http:' ? 'http' : 'https').request(
+      {
+        hostname: url.hostname,
+        port: url.port || (url.protocol === 'http:' ? 80 : 443),
+        path: url.pathname + url.search,
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(data) },
+      },
+      (res) => {
+        let out = '';
+        res.on('data', (c) => (out += c));
+        res.on('end', () => {
+          let parsed = null;
+          try { parsed = JSON.parse(out); } catch { /* leaves parsed null below */ }
+          resolve({ status: res.statusCode, json: parsed });
+        });
+      },
+    );
+    req.on('error', reject);
+    req.write(data);
+    req.end();
+  });
+}
+
+// The other half of cobinar-developers-worker's POST /auth/redeem-code:
+// cobinar.com's callback page writes { uid, email, name, picture } to a KV
+// namespace it shares with cobinar-developers-worker, keyed by a one-time
+// code, and hands US that code (over the loopback server below, once the
+// browser gets there). Redeeming it here — not on cobinar.com's server, and
+// not in the browser — is what actually mints the workerToken dashboard-
+// worker will accept; nothing before this point has needed dashboard-worker
+// to trust anything, since a workerToken is the first credential in this
+// whole flow it actually checks.
+async function exchangeSsoCode(developersBase, code) {
+  const { status, json } = await postJson(`${developersBase}/auth/redeem-code`, { code });
+  if (status !== 200 || !json || typeof json.workerToken !== 'string') {
+    const detail = json && json.error ? json.error : `HTTP ${status}`;
+    throw new Error(`Could not finish signing in (${detail}). Run "dalus login" again.`);
+  }
+  return json;
+}
+
 // Starts a one-shot local server, opens the browser to Cobinar's own web
-// login (cobinar-main's public/cli-login/ page), and waits for that page
-// to POST the result back here once the normal auth.cobinar.com round
-// trip finishes. dalus never talks to auth.cobinar.com directly and
-// never gets its own client_id/secret — it rides along on cobinar.com's
-// existing one, same as any other visitor signing in there. See
-// cobinar-main's public/cli-login/index.html and public/auth/callback.html
-// for the other half of this handshake.
-function browserLogin(webBase) {
+// login (cobinar-main's public/cli-login/ page), and waits for that page to
+// POST a one-time SSO code back here once the normal auth.cobinar.com round
+// trip finishes. dalus never talks to auth.cobinar.com directly and never
+// gets its own client_id/secret — it rides along on cobinar.com's existing
+// one, same as any other visitor signing in there. See cobinar-main's
+// public/cli-login/index.html and public/auth/callback.html for the other
+// half of this handshake, and exchangeSsoCode above for what happens to the
+// code once it arrives.
+function browserLogin(webBase, developersBase) {
   // "ls" (local state): proves the browser tab that finishes is the one
   // THIS process opened, not some other local process guessing the port
   // and racing it — the port alone isn't a secret (any local process can
@@ -55,21 +109,31 @@ function browserLogin(webBase) {
       let body = '';
       req.on('data', (chunk) => {
         body += chunk;
-        if (body.length > 1e6) req.destroy(); // this payload is a token + a small profile, never anywhere near this size
+        if (body.length > 1e6) req.destroy(); // this payload is a short code + a small profile, never anywhere near this size
       });
-      req.on('end', () => {
+      req.on('end', async () => {
         let parsed = null;
         try { parsed = JSON.parse(body); } catch { /* falls through to the ok:false below */ }
 
-        if (!parsed || parsed.ls !== ls || typeof parsed.token !== 'string' || !parsed.token) {
+        if (!parsed || parsed.ls !== ls || typeof parsed.code !== 'string' || !parsed.code) {
           res.writeHead(400, { 'Content-Type': 'application/json' });
           res.end(JSON.stringify({ ok: false }));
           return; // deliberately not finish()/reject() here — a stray or malicious request to this port shouldn't cancel a login still in progress
         }
 
-        res.writeHead(200, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({ ok: true }));
-        finish(null, parsed);
+        try {
+          const redeemed = await exchangeSsoCode(developersBase, parsed.code);
+          res.writeHead(200, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({ ok: true }));
+          finish(null, {
+            token: redeemed.workerToken,
+            user: parsed.user || { email: redeemed.cobinarEmail, name: redeemed.displayName, picture: redeemed.photoURL },
+          });
+        } catch (err) {
+          res.writeHead(502, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({ ok: false, error: err.message }));
+          finish(err);
+        }
       });
     });
 
@@ -109,6 +173,7 @@ async function loginCommand(args) {
     console.log(`API base: ${creds.apiBase}`);
     if (creds.user && creds.user.email) console.log(`Signed in as: ${creds.user.email}`);
     console.log(`Token:    ${creds.token.slice(0, 8)}...${creds.token.slice(-4)} (stored in ${CREDENTIALS_PATH})`);
+    console.log('Note: this token expires 2 hours after signing in — "dalus login" again once it does.');
     return;
   }
 
@@ -134,10 +199,12 @@ async function loginCommand(args) {
 
   const webBaseArgIdx = args.indexOf('--web-base');
   const webBase = (webBaseArgIdx !== -1 ? args[webBaseArgIdx + 1] : DEFAULT_WEB_BASE).replace(/\/$/, '');
+  const developersBaseArgIdx = args.indexOf('--developers-base');
+  const developersBase = (developersBaseArgIdx !== -1 ? args[developersBaseArgIdx + 1] : DEFAULT_DEVELOPERS_BASE).replace(/\/$/, '');
 
   let result;
   try {
-    result = await browserLogin(webBase);
+    result = await browserLogin(webBase, developersBase);
   } catch (err) {
     console.error(err.message);
     process.exitCode = 1;
@@ -155,7 +222,8 @@ async function loginCommand(args) {
 
   saveCredentials({ apiBase: apiBase.replace(/\/$/, ''), token: result.token, user: result.user || null });
   console.log(`Signed in${result.user && result.user.email ? ' as ' + result.user.email : ''}. Saved to ${CREDENTIALS_PATH}.`);
+  console.log('This session lasts 2 hours — "dalus login" again once it expires.');
   console.log('Run "dalus forge" from a project directory to deploy.');
 }
 
-module.exports = { loginCommand, browserLogin };
+module.exports = { loginCommand, browserLogin, exchangeSsoCode };