@compilr-dev/cli 0.5.0 → 0.5.2

package/dist/auth/index.js

@@ -0,0 +1,545 @@
+/**
+ * Auth Manager Module
+ *
+ * Singleton authentication manager for the CLI.
+ * Handles login, logout, token refresh, and session management.
+ *
+ * Usage:
+ *   const auth = getAuthManager();
+ *   if (!await auth.isAuthenticated()) {
+ *     // Show login prompt
+ *   }
+ */
+import { v4 as uuidv4 } from 'uuid';
+import * as os from 'os';
+import { loadAuthData, saveAuthData, clearAuthData, updateSession, hasAuthData, checkAuthFilePermissions, } from './storage.js';
+import { refreshToken as apiRefreshToken, sendHeartbeat, getProfile, updateProfile, requestDeviceCode, pollDeviceToken, getAuthorizationUrl, } from './api-client.js';
+import { isTelemetryEnabled } from '../settings/index.js';
+import * as fs from 'fs';
+import * as path from 'path';
+// Get version from package.json to avoid circular import with index.ts
+function getVersion() {
+    try {
+        const dir = path.dirname(new URL(import.meta.url).pathname);
+        const pkgPath = path.join(dir, '../../package.json');
+        const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf-8'));
+        return pkg.version;
+    }
+    catch {
+        return '0.0.0';
+    }
+}
+// =============================================================================
+// Auth Manager Class
+// =============================================================================
+class AuthManager {
+    authData = null;
+    profileData = null;
+    sessionInfo = null;
+    heartbeatInterval = null;
+    constructor() {
+        // Load cached auth data
+        this.authData = loadAuthData();
+        // Check for insecure permissions
+        const warning = checkAuthFilePermissions();
+        if (warning) {
+            console.warn(warning);
+        }
+    }
+    // ===========================================================================
+    // Authentication Status
+    // ===========================================================================
+    /**
+     * Check if user is authenticated with a valid session.
+     *
+     * If an API token (tok_xxx) is present, authentication is immediate —
+     * no expiry check or refresh needed (server validates on each call).
+     *
+     * Falls back to JWT refresh for pre-v2 users who don't have an API token yet.
+     */
+    async isAuthenticated() {
+        if (!this.authData) {
+            return false;
+        }
+        // API token: server validates on each request, no local expiry check needed
+        if (this.authData.session.apiToken) {
+            return true;
+        }
+        // Legacy JWT fallback: check expiry and refresh if needed
+        const expiresAt = new Date(this.authData.session.expiresAt);
+        const now = new Date();
+        // If token expires in less than 5 minutes, try to refresh
+        const fiveMinutes = 5 * 60 * 1000;
+        if (expiresAt.getTime() - now.getTime() < fiveMinutes) {
+            const refreshed = await this.refreshToken();
+            if (!refreshed) {
+                // Refresh failed — clear in-memory state but preserve auth.json on disk.
+                // The refresh token may still be valid (transient error, cold start, etc.)
+                // Only explicit logout() should delete stored credentials.
+                this.authData = null;
+                this.profileData = null;
+                return false;
+            }
+        }
+        return true;
+    }
+    /**
+     * Check if any auth data exists (quick check without validation).
+     */
+    hasStoredAuth() {
+        return hasAuthData();
+    }
+    /**
+     * Get cached email from local auth data (no network call).
+     * Returns null if not authenticated.
+     */
+    getEmail() {
+        return this.authData?.user.email ?? null;
+    }
+    // ===========================================================================
+    // User Operations
+    // ===========================================================================
+    /**
+     * Get the current user.
+     * Throws if not authenticated.
+     */
+    async getUser() {
+        if (!await this.isAuthenticated()) {
+            throw new Error('Not authenticated');
+        }
+        // After isAuthenticated(), authData is guaranteed to exist
+        const authData = this.authData;
+        if (!authData) {
+            throw new Error('Authentication state inconsistent');
+        }
+        // Return cached user if available
+        if (this.profileData) {
+            return {
+                id: authData.user.id,
+                email: authData.user.email,
+                accountType: this.profileData.account_type,
+                createdAt: new Date(authData.user.createdAt),
+            };
+        }
+        // Fetch profile to get account type
+        await this.fetchProfile();
+        // Get account type from fetched profile
+        // Cast to work around TypeScript control flow narrowing issue
+        const profile = this.profileData;
+        return {
+            id: authData.user.id,
+            email: authData.user.email,
+            accountType: profile?.account_type ?? 'free',
+            createdAt: new Date(authData.user.createdAt),
+        };
+    }
+    /**
+     * Get the access token (auto-refreshes if needed).
+     * Prefers API token (tok_xxx) over JWT when available.
+     */
+    async getAccessToken() {
+        if (!await this.isAuthenticated()) {
+            throw new Error('Not authenticated');
+        }
+        const authData = this.authData;
+        if (!authData) {
+            throw new Error('Authentication state inconsistent');
+        }
+        // Prefer long-lived API token over short-lived JWT
+        return authData.session.apiToken ?? authData.session.accessToken;
+    }
+    // ===========================================================================
+    // Login / Logout
+    // ===========================================================================
+    /**
+     * Login using device flow (browser-based authentication).
+     * This is the recommended way to authenticate the CLI.
+     *
+     * @param callbacks - Callbacks for progress updates
+     * @param signal - AbortSignal for cancellation
+     */
+    async loginWithDeviceFlow(callbacks, signal) {
+        // Step 1: Request device code
+        const codeResult = await requestDeviceCode();
+        if (!codeResult.success || !codeResult.data) {
+            return {
+                success: false,
+                error: codeResult.error ?? 'Failed to get device code',
+            };
+        }
+        const { device_code, user_code, expires_in, interval } = codeResult.data;
+        // Use client-side URL (respects COMPILR_WEB_URL env var for testing)
+        const authUrl = getAuthorizationUrl(user_code);
+        // Step 2: Notify callback with code and URL
+        callbacks.onCodeReady(user_code, authUrl);
+        // Step 3: Try to open browser
+        if (callbacks.onOpenBrowser) {
+            await callbacks.onOpenBrowser(authUrl);
+        }
+        // Step 4: Poll for token
+        const startTime = Date.now();
+        const expiresAt = startTime + (expires_in * 1000);
+        let pollInterval = interval * 1000; // Convert to milliseconds
+        while (Date.now() < expiresAt) {
+            // Check for cancellation
+            if (signal?.aborted) {
+                return {
+                    success: false,
+                    error: 'Login cancelled',
+                };
+            }
+            // Wait before polling (with cancellation support)
+            const cancelled = await new Promise((resolve) => {
+                const timeout = setTimeout(() => {
+                    cleanup();
+                    resolve(false);
+                }, pollInterval);
+                const onAbort = () => {
+                    clearTimeout(timeout);
+                    resolve(true);
+                };
+                const cleanup = () => {
+                    signal?.removeEventListener('abort', onAbort);
+                };
+                signal?.addEventListener('abort', onAbort, { once: true });
+            });
+            if (cancelled || signal?.aborted) {
+                return {
+                    success: false,
+                    error: 'Login cancelled',
+                };
+            }
+            // Poll for token
+            callbacks.onStatusUpdate?.('polling');
+            const tokenResult = await pollDeviceToken(device_code);
+            if (tokenResult.success && tokenResult.data) {
+                // Success! Save the tokens
+                callbacks.onStatusUpdate?.('authorized');
+                const { access_token, refresh_token, api_token, expires_in: tokenExpiresIn, user } = tokenResult.data;
+                const expiresAt = new Date(Date.now() + (tokenExpiresIn * 1000)).toISOString();
+                const authData = {
+                    version: 1,
+                    user: {
+                        id: user.id,
+                        email: user.email,
+                        createdAt: new Date().toISOString(), // We don't get this from device flow
+                    },
+                    session: {
+                        accessToken: access_token,
+                        refreshToken: refresh_token,
+                        expiresAt,
+                        apiToken: api_token, // Long-lived CLI token (tok_xxx)
+                    },
+                };
+                saveAuthData(authData);
+                this.authData = authData;
+                // Fetch profile to get account type
+                await this.fetchProfile();
+                return {
+                    success: true,
+                    user: {
+                        id: user.id,
+                        email: user.email,
+                        accountType: this.profileData?.account_type ?? 'free',
+                        createdAt: new Date(),
+                    },
+                };
+            }
+            // Handle errors
+            if (tokenResult.error) {
+                switch (tokenResult.error.error) {
+                    case 'authorization_pending':
+                        // Keep polling
+                        continue;
+                    case 'slow_down':
+                        // Increase poll interval
+                        pollInterval = Math.min(pollInterval + 5000, 30000);
+                        continue;
+                    case 'expired_token':
+                        callbacks.onStatusUpdate?.('expired');
+                        return {
+                            success: false,
+                            error: 'Authorization expired. Please try again.',
+                        };
+                    case 'access_denied':
+                        callbacks.onStatusUpdate?.('denied');
+                        return {
+                            success: false,
+                            error: 'Authorization denied.',
+                        };
+                    default:
+                        return {
+                            success: false,
+                            error: tokenResult.error.error_description,
+                        };
+                }
+            }
+            // Network error - retry
+            if (tokenResult.networkError) {
+                // Wait a bit longer on network errors
+                await new Promise(resolve => setTimeout(resolve, 2000));
+                continue;
+            }
+        }
+        // Expired
+        callbacks.onStatusUpdate?.('expired');
+        return {
+            success: false,
+            error: 'Authorization timed out. Please try again.',
+        };
+    }
+    /**
+     * Logout (clear local session).
+     * Tokens expire naturally (1 hour). No server call needed.
+     */
+    logout() {
+        // Stop heartbeat
+        this.stopHeartbeat();
+        // Clear local data
+        clearAuthData();
+        this.authData = null;
+        this.profileData = null;
+        this.sessionInfo = null;
+    }
+    // ===========================================================================
+    // Token Management
+    // ===========================================================================
+    /**
+     * Refresh the access token using the refresh token.
+     * Calls the server-side Netlify function (no direct Supabase SDK).
+     */
+    async refreshToken() {
+        if (!this.authData?.session.refreshToken) {
+            return false;
+        }
+        const result = await apiRefreshToken(this.authData.session.refreshToken);
+        if (!result.success || !result.access_token || !result.refresh_token) {
+            // Debug: log refresh failure details
+            console.error('[auth] Token refresh failed:', result.error ?? 'missing token fields');
+            console.error('[auth] API_BASE_URL:', process.env.COMPILR_API_URL ?? '(not set, using compilr.dev)');
+            return false;
+        }
+        // Calculate expiry from expires_in (seconds), default to 1 hour
+        const expiresIn = result.expires_in ?? 3600;
+        const expiresAt = new Date(Date.now() + expiresIn * 1000).toISOString();
+        const newSession = {
+            accessToken: result.access_token,
+            refreshToken: result.refresh_token,
+            expiresAt,
+        };
+        updateSession(newSession);
+        this.authData.session = newSession;
+        return true;
+    }
+    // ===========================================================================
+    // Profile Management
+    // ===========================================================================
+    /**
+     * Get the best available token for API calls.
+     * Prefers API token (tok_xxx) over short-lived JWT.
+     */
+    getBestToken() {
+        if (!this.authData)
+            return null;
+        return this.authData.session.apiToken ?? this.authData.session.accessToken;
+    }
+    /**
+     * Fetch user profile from server.
+     */
+    async fetchProfile() {
+        const token = this.getBestToken();
+        if (!token)
+            return;
+        const result = await getProfile(token);
+        if (result.success && result.profile) {
+            this.profileData = result.profile;
+        }
+    }
+    /**
+     * Get cached profile data.
+     */
+    getProfile() {
+        return this.profileData;
+    }
+    /**
+     * Update profile settings on server.
+     */
+    async updateProfileSettings(updates) {
+        if (!await this.isAuthenticated()) {
+            return false;
+        }
+        const token = this.getBestToken();
+        if (!token) {
+            return false;
+        }
+        const result = await updateProfile(token, updates);
+        if (result.success && result.profile) {
+            this.profileData = result.profile;
+        }
+        return result.success;
+    }
+    // ===========================================================================
+    // Session / Telemetry
+    // ===========================================================================
+    /**
+     * Start a new CLI session and begin heartbeat.
+     */
+    async startSession(projectId) {
+        this.sessionInfo = {
+            sessionId: uuidv4(),
+            startedAt: new Date(),
+            projectId,
+            messageCount: 0,
+            tokensIn: 0,
+            tokensOut: 0,
+            commandsUsed: {},
+            agentsUsed: new Set(),
+            toolsUsed: new Set(),
+        };
+        // Send initial heartbeat
+        await this.sendHeartbeat();
+        // Start periodic heartbeat (every 60 seconds)
+        this.heartbeatInterval = setInterval(() => {
+            void this.sendHeartbeat();
+        }, 60 * 1000);
+    }
+    /**
+     * Stop the current session.
+     */
+    stopHeartbeat() {
+        if (this.heartbeatInterval) {
+            clearInterval(this.heartbeatInterval);
+            this.heartbeatInterval = null;
+        }
+        // Send final heartbeat
+        if (this.sessionInfo) {
+            void this.sendHeartbeat();
+        }
+    }
+    /**
+     * Record a message in the current session.
+     */
+    recordMessage(tokensIn, tokensOut) {
+        if (this.sessionInfo) {
+            this.sessionInfo.messageCount++;
+            this.sessionInfo.tokensIn += tokensIn;
+            this.sessionInfo.tokensOut += tokensOut;
+        }
+    }
+    /**
+     * Record command usage.
+     */
+    recordCommand(command) {
+        if (this.sessionInfo) {
+            this.sessionInfo.commandsUsed[command] = (this.sessionInfo.commandsUsed[command] ?? 0) + 1;
+        }
+    }
+    /**
+     * Record agent usage.
+     */
+    recordAgent(agentId) {
+        if (this.sessionInfo) {
+            this.sessionInfo.agentsUsed.add(agentId);
+        }
+    }
+    /**
+     * Record tool usage.
+     */
+    recordTool(toolName) {
+        if (this.sessionInfo) {
+            this.sessionInfo.toolsUsed.add(toolName);
+        }
+    }
+    /**
+     * Set LLM provider/model for session.
+     */
+    setLLMInfo(provider, model) {
+        if (this.sessionInfo) {
+            this.sessionInfo.llmProvider = provider;
+            this.sessionInfo.llmModel = model;
+        }
+    }
+    /**
+     * Send a single heartbeat regardless of telemetry setting.
+     * Called once at login to register the CLI connection with the server
+     * (sets first_session_at on cli_users_extended). This is account metadata,
+     * not telemetry data.
+     */
+    async sendForcedHeartbeat() {
+        const token = this.getBestToken();
+        if (!token)
+            return;
+        const sessionId = this.sessionInfo?.sessionId ?? uuidv4();
+        const data = {
+            session_id: sessionId,
+            cli_version: getVersion(),
+            os: os.platform(),
+            node_version: process.version,
+        };
+        try {
+            await sendHeartbeat(token, data);
+        }
+        catch {
+            // Silently ignore - this is best-effort
+        }
+    }
+    /**
+     * Send heartbeat to server (if telemetry enabled).
+     */
+    async sendHeartbeat() {
+        // Check local telemetry setting
+        if (!isTelemetryEnabled()) {
+            return;
+        }
+        // Check if authenticated
+        const token = this.getBestToken();
+        if (!token || !this.sessionInfo) {
+            return;
+        }
+        const data = {
+            session_id: this.sessionInfo.sessionId,
+            cli_version: getVersion(),
+            os: os.platform(),
+            node_version: process.version,
+            project_id: this.sessionInfo.projectId,
+            total_messages: this.sessionInfo.messageCount,
+            total_tokens_in: this.sessionInfo.tokensIn,
+            total_tokens_out: this.sessionInfo.tokensOut,
+            commands_used: this.sessionInfo.commandsUsed,
+            agents_used: Array.from(this.sessionInfo.agentsUsed),
+            tools_used: Array.from(this.sessionInfo.toolsUsed),
+            llm_provider: this.sessionInfo.llmProvider,
+            llm_model: this.sessionInfo.llmModel,
+        };
+        try {
+            await sendHeartbeat(token, data);
+        }
+        catch {
+            // Silently ignore heartbeat failures
+        }
+    }
+}
+// =============================================================================
+// Singleton
+// =============================================================================
+let authManagerInstance = null;
+/**
+ * Get the AuthManager singleton instance.
+ */
+export function getAuthManager() {
+    if (!authManagerInstance) {
+        authManagerInstance = new AuthManager();
+    }
+    return authManagerInstance;
+}
+/**
+ * Reset AuthManager (for testing).
+ */
+export function resetAuthManager() {
+    if (authManagerInstance) {
+        authManagerInstance.stopHeartbeat();
+    }
+    authManagerInstance = null;
+}
+// Re-export device flow utilities
+export { getAuthorizationUrl } from './api-client.js';

package/dist/auth/storage.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Auth Storage Module
+ *
+ * Manages persistent storage of authentication credentials.
+ * File: ~/.compilr-dev/auth.json
+ *
+ * Security:
+ * - File permissions set to 0600 (owner read/write only)
+ * - Tokens are JWTs from Supabase Auth
+ */
+export interface AuthUser {
+    id: string;
+    email: string;
+    createdAt: string;
+}
+export interface AuthSession {
+    accessToken: string;
+    refreshToken: string;
+    expiresAt: string;
+    apiToken?: string;
+}
+export interface AuthData {
+    version: number;
+    user: AuthUser;
+    session: AuthSession;
+}
+/**
+ * Load auth data from disk.
+ * Returns null if file doesn't exist or is invalid.
+ */
+export declare function loadAuthData(): AuthData | null;
+/**
+ * Save auth data to disk with secure permissions.
+ */
+export declare function saveAuthData(data: AuthData): void;
+/**
+ * Clear auth data (logout).
+ */
+export declare function clearAuthData(): void;
+/**
+ * Update just the session tokens (after refresh).
+ */
+export declare function updateSession(session: AuthSession): boolean;
+/**
+ * Check if auth data exists (quick check without loading).
+ */
+export declare function hasAuthData(): boolean;
+/**
+ * Check if stored auth file has insecure permissions.
+ * Returns warning message if insecure, null if OK.
+ */
+export declare function checkAuthFilePermissions(): string | null;