@credibledata/cred-cli 0.0.103 → 0.0.105

package/dist/commands/misc/login.spec.js

@@ -45,6 +45,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+const environments_1 = require("../../setup-core/environments");
 const child_process_1 = require("child_process");
 const axios_1 = __importDefault(require("axios"));
 const chai_1 = require("chai");
@@ -52,11 +53,15 @@ const fs_1 = __importDefault(require("fs"));
 const os_1 = __importDefault(require("os"));
 const path_1 = require("path");
 const sinon_1 = __importDefault(require("sinon"));
-const credConstants = __importStar(require("../../constants"));
+const credEnvironments = __importStar(require("../../setup-core/environments"));
 const clientconfiguration_1 = require("../../clientconfiguration");
+const logger_1 = require("../../logger");
 const login_1 = require("./login");
 const api_1 = require("../../client/api");
 const loopbackOAuth = __importStar(require("./loopbackOAuth"));
+const utils = __importStar(require("../../utils"));
+const browser = __importStar(require("../../browser"));
+const refresh = __importStar(require("../../setup-core/refresh"));
 function createFakeIdToken(payload) {
     const header = Buffer.from(JSON.stringify({ alg: "none", typ: "JWT" })).toString("base64url");
     const body = Buffer.from(JSON.stringify(payload)).toString("base64url");
@@ -67,6 +72,8 @@ describe("login", () => {
     let tmpConfigFilePath;
     let axiosStub;
     let orgPermissionsStub;
+    let openStub;
+    let shouldOpenStub;
     const mockDeviceCodeResponse = {
         data: {
             verification_uri_complete: "https://example.com",
@@ -109,6 +116,9 @@ describe("login", () => {
             activeEnvironment: "production",
         }));
         axiosStub = sinon_1.default.stub(axios_1.default, "request");
+        // Never a real browser from a test run, even one started at a terminal.
+        openStub = sinon_1.default.stub(browser, "openInBrowser").resolves(true);
+        shouldOpenStub = sinon_1.default.stub(browser, "shouldOpenBrowser").returns(false);
         orgPermissionsStub = sinon_1.default
             .stub(api_1.OrganizationsApi.prototype, "getOrganization")
             .resolves(mockOrgPermissionsResponse);
@@ -134,6 +144,98 @@ describe("login", () => {
             (0, chai_1.expect)(config.getProject()).to.equal("bar");
         });
     });
+    it("opens the sign-in page for a person at a terminal, after printing it", function () {
+        return __awaiter(this, void 0, void 0, function* () {
+            this.timeout(2000);
+            shouldOpenStub.returns(true);
+            const info = sinon_1.default.stub(logger_1.logger, "info");
+            axiosStub
+                .onFirstCall()
+                .resolves(mockDeviceCodeResponse)
+                .onSecondCall()
+                .resolves(mockedAccessTokenResponse);
+            yield (0, login_1.login)("foo", "http://localhost", tmpConfigFilePath);
+            (0, chai_1.expect)(openStub.calledOnceWith("https://example.com")).to.equal(true);
+            // Printed first, so the link is there when the browser does not open.
+            const printed = info
+                .getCalls()
+                .findIndex((call) => String(call.args[0]) ===
+                "Please visit the following URL to login https://example.com and verify user code 123456.");
+            (0, chai_1.expect)(printed).to.be.greaterThan(-1);
+            (0, chai_1.expect)(info.calledWith(sinon_1.default.match("Opened your browser to sign in."))).to.equal(true);
+        });
+    });
+    it("only prints the link when no one is at a terminal", function () {
+        return __awaiter(this, void 0, void 0, function* () {
+            this.timeout(2000);
+            shouldOpenStub.returns(false);
+            axiosStub
+                .onFirstCall()
+                .resolves(mockDeviceCodeResponse)
+                .onSecondCall()
+                .resolves(mockedAccessTokenResponse);
+            yield (0, login_1.login)("foo", "http://localhost", tmpConfigFilePath);
+            (0, chai_1.expect)(openStub.called).to.equal(false);
+        });
+    });
+    it("stops polling on a final Auth0 answer instead of running out the clock", function () {
+        return __awaiter(this, void 0, void 0, function* () {
+            // `access_denied`, `expired_token`, `invalid_grant` are final for a
+            // device code; re-POSTing it can only fail again. The loop used to log
+            // and keep going for five minutes.
+            this.timeout(2000);
+            const exit = sinon_1.default.stub(process, "exit").callsFake(() => {
+                throw new Error("exited");
+            });
+            const errorLog = sinon_1.default.stub(logger_1.logger, "error");
+            axiosStub
+                .onFirstCall()
+                .resolves(mockDeviceCodeResponse)
+                .onSecondCall()
+                .rejects({
+                isAxiosError: true,
+                response: {
+                    status: 403,
+                    data: {
+                        error: "access_denied",
+                        error_description: "User denied the request",
+                    },
+                },
+            });
+            yield (0, login_1.login)("foo", "http://localhost", tmpConfigFilePath).catch((error) => (0, chai_1.expect)(error.message).to.equal("exited"));
+            (0, chai_1.expect)(axiosStub.callCount, "no re-poll with a spent device code").to.equal(2);
+            (0, chai_1.expect)(exit.calledOnceWith(1)).to.equal(true);
+            (0, chai_1.expect)(errorLog.calledWith(sinon_1.default.match("User denied the request"))).to.equal(true);
+        });
+    });
+    it("keeps polling through a 5xx that carries no OAuth error code", function () {
+        return __awaiter(this, void 0, void 0, function* () {
+            // A proxy's 503 page says nothing about the device code, so it is a
+            // transport blip to retry, not a final answer to exit on.
+            this.timeout(4000);
+            const exit = sinon_1.default.stub(process, "exit").callsFake(() => {
+                throw new Error("exited");
+            });
+            sinon_1.default.stub(logger_1.logger, "error");
+            axiosStub
+                .onFirstCall()
+                .resolves(mockDeviceCodeResponse)
+                .onSecondCall()
+                .rejects({
+                isAxiosError: true,
+                message: "Request failed with status code 503",
+                response: { status: 503, data: "<html>Service Unavailable</html>" },
+            })
+                .onThirdCall()
+                .resolves(mockedAccessTokenResponse);
+            const config = new clientconfiguration_1.ClientConfiguration(tmpConfigFilePath);
+            config.setEnvironment("localhost");
+            yield (0, login_1.login)("test", "http://localhost", tmpConfigFilePath);
+            (0, chai_1.expect)(exit.called).to.equal(false);
+            (0, chai_1.expect)(axiosStub.callCount).to.equal(3);
+            (0, chai_1.expect)(config.getAccessToken()).to.equal(mockedAccessTokenResponse.data.access_token);
+        });
+    });
     it("should change the active organization when login succeeds", function () {
         return __awaiter(this, void 0, void 0, function* () {
             this.timeout(2000);
@@ -150,6 +252,297 @@ describe("login", () => {
             (0, chai_1.expect)(config.getOrganization()).to.equal("test");
         });
     });
+    /** An access token for localhost's API that expires `seconds` from now. */
+    function apiTokenExpiringIn(seconds) {
+        return createFakeIdToken({
+            aud: environments_1.auth0ConfigsByEnv.localhost.audience,
+            exp: Math.floor(Date.now() / 1000) + seconds,
+        });
+    }
+    function refreshResponse(body) {
+        return { status: 200, json: () => __awaiter(this, void 0, void 0, function* () { return body; }) };
+    }
+    // A live user session is not tied to an organization, so naming one is a
+    // switch. Signing in again asked for a second device code seconds after
+    // the first.
+    it("switches organization without signing in again when already signed in", function () {
+        return __awaiter(this, void 0, void 0, function* () {
+            const config = new clientconfiguration_1.ClientConfiguration(tmpConfigFilePath);
+            config.setEnvironment("localhost");
+            config.setOrganization("old-org");
+            config.setTokenPair({
+                accessToken: apiTokenExpiringIn(3600),
+                refreshToken: "refresh",
+            });
+            const fetchStub = sinon_1.default.stub(globalThis, "fetch");
+            yield (0, login_1.login)("new-org", "http://localhost", tmpConfigFilePath);
+            (0, chai_1.expect)(axiosStub.called, "no device-code request").to.equal(false);
+            (0, chai_1.expect)(orgPermissionsStub.firstCall.args[0]).to.equal("new-org");
+            (0, chai_1.expect)(new clientconfiguration_1.ClientConfiguration(tmpConfigFilePath).getOrganization()).to.equal("new-org");
+            // The token had an hour left, so there was nothing to renew.
+            (0, chai_1.expect)(fetchStub.called, "no refresh request").to.equal(false);
+        });
+    });
+    it("renews an expired token before switching, instead of signing in again", function () {
+        return __awaiter(this, void 0, void 0, function* () {
+            const config = new clientconfiguration_1.ClientConfiguration(tmpConfigFilePath);
+            config.setEnvironment("localhost");
+            config.setOrganization("old-org");
+            config.setTokenPair({
+                accessToken: apiTokenExpiringIn(-60),
+                refreshToken: "refresh",
+            });
+            const renewed = apiTokenExpiringIn(7200);
+            sinon_1.default
+                .stub(globalThis, "fetch")
+                .resolves(refreshResponse({ access_token: renewed }));
+            yield (0, login_1.login)("new-org", "http://localhost", tmpConfigFilePath);
+            (0, chai_1.expect)(axiosStub.called, "no device-code request").to.equal(false);
+            const after = new clientconfiguration_1.ClientConfiguration(tmpConfigFilePath);
+            (0, chai_1.expect)(after.getOrganization()).to.equal("new-org");
+            (0, chai_1.expect)(after.getApiAccessToken()).to.equal(renewed);
+        });
+    });
+    // A refresh token Auth0 refuses means the saved session is over. The
+    // switch must not report "already signed in" over it, and the sign-in that
+    // replaces it keeps the organization and environment the user had chosen.
+    it("signs in again when the saved session cannot be renewed, keeping the organization and environment", function () {
+        return __awaiter(this, void 0, void 0, function* () {
+            this.timeout(4000);
+            const config = new clientconfiguration_1.ClientConfiguration(tmpConfigFilePath);
+            config.setEnvironment("localhost");
+            config.setOrganization("acme");
+            config.setProject("analytics");
+            config.setTokenPair({
+                accessToken: apiTokenExpiringIn(-60),
+                refreshToken: "dead",
+            });
+            sinon_1.default
+                .stub(globalThis, "fetch")
+                .resolves(refreshResponse({ error: "invalid_grant" }));
+            let storedAtSignIn;
+            axiosStub.onFirstCall().callsFake(() => __awaiter(this, void 0, void 0, function* () {
+                storedAtSignIn = JSON.parse(fs_1.default.readFileSync(tmpConfigFilePath, "utf-8")).configPerEnvironment.localhost;
+                return mockDeviceCodeResponse;
+            }));
+            axiosStub.onSecondCall().resolves(mockedAccessTokenResponse);
+            const warnStub = sinon_1.default.stub(logger_1.logger, "warn");
+            yield (0, login_1.login)("acme", "https://admin.example", tmpConfigFilePath);
+            (0, chai_1.expect)(axiosStub.called, "fell through to the device sign-in").to.equal(true);
+            // Not the refresh's own "Run `cred login`": that is what is running.
+            (0, chai_1.expect)(warnStub.firstCall.args[0]).to.equal("Your saved session can no longer be renewed, so signing in again.");
+            // When the device-code sign-in started, only the tokens were gone.
+            (0, chai_1.expect)(storedAtSignIn).to.deep.equal({
+                organization: "acme",
+                project: "analytics",
+            });
+            const after = new clientconfiguration_1.ClientConfiguration(tmpConfigFilePath);
+            (0, chai_1.expect)(after.getEnvironment()).to.equal("localhost");
+            (0, chai_1.expect)(after.getOrganization()).to.equal("acme");
+            (0, chai_1.expect)(after.getProject()).to.equal("analytics");
+            (0, chai_1.expect)(after.getRefreshToken()).to.equal("mock-refresh-token");
+        });
+    });
+    // Auth0 unreachable is not a dead session. The token on disk is still
+    // valid, and a device-code sign-in would need the same Auth0.
+    it("switches on the token on disk when Auth0 cannot be reached and it is still valid", function () {
+        return __awaiter(this, void 0, void 0, function* () {
+            const config = new clientconfiguration_1.ClientConfiguration(tmpConfigFilePath);
+            config.setEnvironment("localhost");
+            config.setOrganization("old-org");
+            // Inside the renewal window, so a refresh is attempted, but still valid.
+            const onDisk = apiTokenExpiringIn(60);
+            config.setTokenPair({ accessToken: onDisk, refreshToken: "refresh" });
+            sinon_1.default
+                .stub(globalThis, "fetch")
+                .rejects(Object.assign(new Error("fetch failed"), { code: "ECONNREFUSED" }));
+            const warnStub = sinon_1.default.stub(logger_1.logger, "warn");
+            yield (0, login_1.login)("new-org", "http://localhost", tmpConfigFilePath);
+            (0, chai_1.expect)(axiosStub.called, "no device-code request").to.equal(false);
+            (0, chai_1.expect)(warnStub.firstCall.args[0]).to.equal(`Could not reach ${environments_1.auth0ConfigsByEnv.localhost.domain} to refresh your session. Continuing with the token on disk, which is still valid.`);
+            const after = new clientconfiguration_1.ClientConfiguration(tmpConfigFilePath);
+            (0, chai_1.expect)(after.getOrganization()).to.equal("new-org");
+            (0, chai_1.expect)(after.getApiAccessToken()).to.equal(onDisk);
+        });
+    });
+    it("signs in again when Auth0 cannot be reached and the token on disk has expired", function () {
+        return __awaiter(this, void 0, void 0, function* () {
+            this.timeout(4000);
+            const config = new clientconfiguration_1.ClientConfiguration(tmpConfigFilePath);
+            config.setEnvironment("localhost");
+            config.setTokenPair({
+                accessToken: apiTokenExpiringIn(-60),
+                refreshToken: "refresh",
+            });
+            sinon_1.default
+                .stub(globalThis, "fetch")
+                .rejects(Object.assign(new Error("fetch failed"), { code: "ECONNREFUSED" }));
+            axiosStub
+                .onFirstCall()
+                .resolves(mockDeviceCodeResponse)
+                .onSecondCall()
+                .resolves(mockedAccessTokenResponse);
+            yield (0, login_1.login)("new-org", "https://admin.example", tmpConfigFilePath);
+            (0, chai_1.expect)(axiosStub.called, "fell through to the device sign-in").to.equal(true);
+        });
+    });
+    // Another `cred` process holds the refresh lock past the wait. A device-code
+    // sign-in would race it for the same `~/.cred`, so stop and say to rerun.
+    it("stops instead of signing in when the renewal says to retry and the token on disk has expired", function () {
+        return __awaiter(this, void 0, void 0, function* () {
+            const config = new clientconfiguration_1.ClientConfiguration(tmpConfigFilePath);
+            config.setEnvironment("localhost");
+            config.setTokenPair({
+                accessToken: apiTokenExpiringIn(-60),
+                refreshToken: "refresh",
+            });
+            sinon_1.default.stub(refresh, "ensureFreshTokens").resolves({
+                status: "offline",
+                reason: "Another cred process has been renewing your session for over 25s.",
+                retry: "Run the command again in a moment.",
+            });
+            const errorStub = sinon_1.default.stub(logger_1.logger, "error");
+            const exitStub = sinon_1.default.stub(process, "exit").callsFake(() => {
+                throw new Error("exit");
+            });
+            yield (0, login_1.login)("new-org", "https://admin.example", tmpConfigFilePath).catch((error) => (0, chai_1.expect)(error.message).to.equal("exit"));
+            (0, chai_1.expect)(exitStub.calledOnceWithExactly(1)).to.equal(true);
+            (0, chai_1.expect)(errorStub.firstCall.args[0]).to.equal("Another cred process has been renewing your session for over 25s. Run the command again in a moment.");
+            (0, chai_1.expect)(axiosStub.called, "no device-code request").to.equal(false);
+        });
+    });
+    describe("with a saved session on localhost", () => {
+        let logStub;
+        beforeEach(() => {
+            logStub = sinon_1.default.stub(console, "log");
+            const config = new clientconfiguration_1.ClientConfiguration(tmpConfigFilePath);
+            config.setEnvironment("localhost");
+            config.setOrganization("old-org");
+            const payload = Buffer.from(JSON.stringify({
+                aud: environments_1.auth0ConfigsByEnv.localhost.audience,
+                exp: Math.floor(Date.now() / 1000) + 3600,
+            })).toString("base64url");
+            config.setTokenPair({
+                accessToken: `e30.${payload}.sig`,
+                refreshToken: "refresh",
+            });
+        });
+        const said = () => logStub.getCalls().map((call) => String(call.args[0]));
+        it("names the cell and says it switched only when the organization changed", function () {
+            return __awaiter(this, void 0, void 0, function* () {
+                yield (0, login_1.login)("new-org", "http://localhost", tmpConfigFilePath);
+                (0, chai_1.expect)(said()).to.eql([
+                    "Already signed in to localhost, so this switched to new-org without signing in again. To sign in as someone else, pass --force.",
+                ]);
+            });
+        });
+        it("does not claim a switch when the organization was already selected", function () {
+            return __awaiter(this, void 0, void 0, function* () {
+                yield (0, login_1.login)("old-org", "http://localhost", tmpConfigFilePath);
+                (0, chai_1.expect)(said()).to.eql([
+                    "Already signed in to localhost with old-org selected; nothing changed. To sign in as someone else, pass --force.",
+                ]);
+            });
+        });
+        it("does not claim a switch when the unreachable-server path writes the same organization", function () {
+            return __awaiter(this, void 0, void 0, function* () {
+                orgPermissionsStub.rejects(new Error("connection refused"));
+                yield (0, login_1.login)("old-org", "http://localhost", tmpConfigFilePath);
+                (0, chai_1.expect)(said().join("\n")).to.not.contain("switched");
+                (0, chai_1.expect)(said().join("\n")).to.contain("nothing changed");
+            });
+        });
+        it("keeps the selected environment when the unreachable-server path sees the same organization", function () {
+            return __awaiter(this, void 0, void 0, function* () {
+                new clientconfiguration_1.ClientConfiguration(tmpConfigFilePath).setProject("old-env");
+                orgPermissionsStub.rejects(new Error("connection refused"));
+                yield (0, login_1.login)("old-org", "http://localhost", tmpConfigFilePath);
+                (0, chai_1.expect)(new clientconfiguration_1.ClientConfiguration(tmpConfigFilePath).getProject()).to.equal("old-env");
+            });
+        });
+        it("--force signs in again instead of reusing the saved session", function () {
+            return __awaiter(this, void 0, void 0, function* () {
+                this.timeout(2000);
+                axiosStub
+                    .onFirstCall()
+                    .resolves(mockDeviceCodeResponse)
+                    .onSecondCall()
+                    .resolves(mockedAccessTokenResponse);
+                yield (0, login_1.login)("new-org", "http://localhost", tmpConfigFilePath, undefined, undefined, { force: true });
+                (0, chai_1.expect)(axiosStub.called, "a device-code sign-in").to.equal(true);
+                const stored = new clientconfiguration_1.ClientConfiguration(tmpConfigFilePath);
+                (0, chai_1.expect)(stored.getAccessToken()).to.equal("mock-access-token");
+                (0, chai_1.expect)(stored.getOrganization()).to.equal("new-org");
+                (0, chai_1.expect)(said()).to.eql([
+                    "Login successful. Signed in to new-org on localhost.",
+                ]);
+            });
+        });
+        it("--force leaves the other cells' credentials alone", function () {
+            return __awaiter(this, void 0, void 0, function* () {
+                this.timeout(2000);
+                new clientconfiguration_1.ClientConfiguration(tmpConfigFilePath, "staging").setTokenPair({
+                    accessToken: "staging-token",
+                });
+                axiosStub
+                    .onFirstCall()
+                    .resolves(mockDeviceCodeResponse)
+                    .onSecondCall()
+                    .resolves(mockedAccessTokenResponse);
+                yield (0, login_1.login)("new-org", "http://localhost", tmpConfigFilePath, undefined, "localhost", { force: true });
+                (0, chai_1.expect)(new clientconfiguration_1.ClientConfiguration(tmpConfigFilePath, "staging").getAccessToken()).to.equal("staging-token");
+            });
+        });
+    });
+    describe("bareCellWarning", () => {
+        it("names the global cell and both ways to stop depending on it", () => {
+            (0, chai_1.expect)((0, login_1.bareCellWarning)("staging", {
+                deployment: "videoamp",
+                from: "global",
+            })).to.equal("Your global cell is still videoamp; pass --cell staging on every command or run `cred set cell staging`.");
+        });
+        it("points at re-pinning, not `set cell`, in a pinned directory", () => {
+            (0, chai_1.expect)((0, login_1.bareCellWarning)("staging", {
+                deployment: "videoamp",
+                from: "folder",
+            })).to.equal("This directory is pinned to videoamp; pass --cell staging on every command here, or re-pin with `cred --cell staging init`.");
+        });
+        it("says nothing when bare commands already resolve to the cell logged in to", () => {
+            (0, chai_1.expect)((0, login_1.bareCellWarning)("staging", {
+                deployment: "staging",
+                from: "folder",
+            })).to.equal(undefined);
+        });
+    });
+    // The saved token passed its local checks but the server refused it: the
+    // switch must fall back to a real sign-in, or every retry fails the same way.
+    it("signs in again when the server rejects the saved session", function () {
+        return __awaiter(this, void 0, void 0, function* () {
+            this.timeout(4000);
+            const config = new clientconfiguration_1.ClientConfiguration(tmpConfigFilePath);
+            config.setEnvironment("localhost");
+            config.setTokenPair({
+                accessToken: apiTokenExpiringIn(3600),
+                refreshToken: "r",
+            });
+            orgPermissionsStub
+                .onFirstCall()
+                .rejects(Object.assign(new Error("Request failed with status code 401"), {
+                isAxiosError: true,
+                response: { status: 401 },
+            }))
+                .onSecondCall()
+                .resolves(mockOrgPermissionsResponse);
+            axiosStub
+                .onFirstCall()
+                .resolves(mockDeviceCodeResponse)
+                .onSecondCall()
+                .resolves(mockedAccessTokenResponse);
+            yield (0, login_1.login)("new-org", "https://admin.example", tmpConfigFilePath);
+            (0, chai_1.expect)(axiosStub.called, "fell through to the device sign-in").to.equal(true);
+            (0, chai_1.expect)(new clientconfiguration_1.ClientConfiguration(tmpConfigFilePath).getOrganization()).to.equal("new-org");
+        });
+    });
     it("should set an access token when login succeeds", function () {
         return __awaiter(this, void 0, void 0, function* () {
             this.timeout(2000);
@@ -200,7 +593,7 @@ describe("login", () => {
         return __awaiter(this, void 0, void 0, function* () {
             this.timeout(2000);
             const orgIdStub = sinon_1.default
-                .stub(credConstants, "getAuth0OrganizationIdForCliLogin")
+                .stub(credEnvironments, "getAuth0OrganizationIdForCliLogin")
                 .returns("org_nMRKafeSuxOiuJeG");
             const loopbackStub = sinon_1.default
                 .stub(loopbackOAuth, "authorizationCodeViaLoopback")
@@ -223,7 +616,7 @@ describe("login", () => {
         return __awaiter(this, void 0, void 0, function* () {
             this.timeout(2000);
             const orgIdStub = sinon_1.default
-                .stub(credConstants, "getAuth0OrganizationIdForCliLogin")
+                .stub(credEnvironments, "getAuth0OrganizationIdForCliLogin")
                 .callsFake((name) => name.toLowerCase() === "videoamp"
                 ? "org_nMRKafeSuxOiuJeG"
                 : undefined);
@@ -246,7 +639,7 @@ describe("login", () => {
         return __awaiter(this, void 0, void 0, function* () {
             this.timeout(2000);
             const orgIdStub = sinon_1.default
-                .stub(credConstants, "getAuth0OrganizationIdForCliLogin")
+                .stub(credEnvironments, "getAuth0OrganizationIdForCliLogin")
                 .returns("org_nMRKafeSuxOiuJeG");
             sinon_1.default
                 .stub(loopbackOAuth, "authorizationCodeViaLoopback")
@@ -282,10 +675,23 @@ describe("isLoginInvocation", () => {
         (0, chai_1.expect)((0, login_1.isLoginInvocation)(["node", "/x/index.js", "login", "myorg"])).to.be
             .true;
     });
+    // The global flag comes before the command, so it is argv[2].
+    it("is true when --non-interactive comes before login", () => {
+        (0, chai_1.expect)((0, login_1.isLoginInvocation)([
+            "node",
+            "/x/index.js",
+            "--non-interactive",
+            "login",
+            "myorg",
+        ])).to.be.true;
+    });
     it("is false for other commands (they stay fail-loud on a corrupt config)", () => {
         (0, chai_1.expect)((0, login_1.isLoginInvocation)(["node", "/x/index.js", "status"])).to.be.false;
         (0, chai_1.expect)((0, login_1.isLoginInvocation)(["node", "/x/index.js", "publish"])).to.be.false;
         (0, chai_1.expect)((0, login_1.isLoginInvocation)(["node", "/x/index.js"])).to.be.false;
+        // An argument to another command is not the command.
+        (0, chai_1.expect)((0, login_1.isLoginInvocation)(["node", "/x/index.js", "get", "login"])).to.be
+            .false;
     });
 });
 // Drives the real binary entrypoint (src/index.ts), not recoverIfCorrupt() in
@@ -324,18 +730,23 @@ describe("entrypoint recovery for a corrupt ~/.cred (real index.ts)", () => {
             let output = "";
             child.stdout.on("data", (d) => (output += d.toString()));
             child.stderr.on("data", (d) => (output += d.toString()));
+            // Registered now so it cannot be missed if the child exits on its own.
+            const closed = new Promise((r) => child.on("close", () => r()));
             // Recovery runs synchronously at module load, before login() touches the
             // network. It renames the corrupt file aside (.cred.corrupt-*) and THEN
             // rewrites .cred to a valid default. Gate on the rewrite, not the backup:
             // the backup appears first, so killing the instant it shows can catch the
             // child in the gap before .cred is rewritten — a flaky ENOENT on the read
             // below. resetComplete() only goes true once .cred is the valid default
-            // (which implies the backup already happened). Then stop the process
-            // (login otherwise blocks on the device-code flow).
+            // (which implies the backup already happened). The report is printed AFTER
+            // that rewrite, so also wait for it: a loaded CI runner can pause the child
+            // between the two, and killing it there leaves `output` empty. Then stop
+            // the process (login otherwise blocks on the device-code flow).
             const resetComplete = () => {
                 try {
                     return (JSON.parse(fs_1.default.readFileSync(credPath, "utf8"))
-                        .activeEnvironment === "production");
+                        .activeEnvironment === "production" &&
+                        /reset to defaults/.test(output));
                 }
                 catch (_a) {
                     return false; // .cred absent or mid-rewrite
@@ -355,6 +766,8 @@ describe("entrypoint recovery for a corrupt ~/.cred (real index.ts)", () => {
                 });
             });
             child.kill("SIGKILL");
+            // Let the stdio streams drain so everything the child wrote is in `output`.
+            yield closed;
             const backup = findBackup();
             (0, chai_1.expect)(backup, "corrupt config should be backed up aside").to.be.a("string");
             // The bad contents are preserved in the backup, not destroyed.
@@ -365,6 +778,111 @@ describe("entrypoint recovery for a corrupt ~/.cred (real index.ts)", () => {
             (0, chai_1.expect)(reset.configPerEnvironment).to.be.an("object");
             // The startup read no longer dead-ends on the structure error.
             (0, chai_1.expect)(output).to.not.match(/Invalid config structure/);
+            // And it SAYS so. `recoverIfCorrupt` returns the backup path instead of
+            // logging (setup-core owns no logger), which makes reporting the caller's
+            // job — and a caller that drops the return value resets a user's tokens
+            // and moves their file with no output at all. Asserting the absence of an
+            // error above cannot catch that; only asserting the presence of this can.
+            (0, chai_1.expect)(output, "the reset must be reported, not silent").to.match(/reset to defaults/);
+            (0, chai_1.expect)(output).to.contain(backup);
+        });
+    });
+});
+describe("login without an organization argument", () => {
+    let tmpConfigFilePath;
+    let axiosStub;
+    let listOrgsStub;
+    let selectStub;
+    const mockDeviceCode = {
+        data: {
+            verification_uri_complete: "https://example.com",
+            user_code: "123456",
+            device_code: "device-code-123",
+            interval: 1,
+        },
+    };
+    const mockTokens = {
+        data: {
+            id_token: createFakeIdToken({ name: "T", email: "t@example.com" }),
+            access_token: "mock-access-token",
+            refresh_token: "mock-refresh-token",
+        },
+    };
+    beforeEach(() => {
+        // Never a real browser from a test run, even one started at a terminal.
+        sinon_1.default.stub(browser, "shouldOpenBrowser").returns(false);
+        tmpConfigFilePath = (0, path_1.join)(fs_1.default.mkdtempSync((0, path_1.join)(os_1.default.tmpdir(), "cred-orgless-")), "cred.json");
+        fs_1.default.writeFileSync(tmpConfigFilePath, JSON.stringify({
+            configPerEnvironment: { localhost: {} },
+            activeEnvironment: "localhost",
+        }));
+        axiosStub = sinon_1.default
+            .stub(axios_1.default, "request")
+            .onFirstCall()
+            .resolves(mockDeviceCode)
+            .onSecondCall()
+            .resolves(mockTokens);
+        sinon_1.default
+            .stub(api_1.OrganizationsApi.prototype, "getOrganization")
+            .resolves({ status: 200, data: {} });
+        listOrgsStub = sinon_1.default.stub(api_1.OrganizationsApi.prototype, "listOrganizations");
+        selectStub = sinon_1.default.stub(utils, "selectFromList");
+    });
+    afterEach(() => {
+        sinon_1.default.restore();
+        fs_1.default.rmSync(tmpConfigFilePath, { force: true });
+    });
+    it("auto-selects when the user belongs to exactly one organization", function () {
+        return __awaiter(this, void 0, void 0, function* () {
+            this.timeout(2000);
+            listOrgsStub.resolves({ data: [{ name: "only-org" }] });
+            // selectFromList returns a single choice without prompting; assert the
+            // stored org rather than trusting the prompt was skipped by accident.
+            selectStub.callsFake((_msg, choices) => __awaiter(this, void 0, void 0, function* () { return choices.length === 1 ? choices[0].value : undefined; }));
+            yield (0, login_1.login)(undefined, "http://admin.ms2.localhost/api/v0", tmpConfigFilePath);
+            const config = new clientconfiguration_1.ClientConfiguration(tmpConfigFilePath);
+            (0, chai_1.expect)(config.getOrganization()).to.equal("only-org");
+        });
+    });
+    it("prompts when the user belongs to several organizations, and shows display names", function () {
+        return __awaiter(this, void 0, void 0, function* () {
+            this.timeout(2000);
+            listOrgsStub.resolves({
+                data: [{ name: "alpha", displayName: "Alpha Inc" }, { name: "beta" }],
+            });
+            selectStub.resolves("beta");
+            yield (0, login_1.login)(undefined, "http://admin.ms2.localhost/api/v0", tmpConfigFilePath);
+            (0, chai_1.expect)(selectStub.calledOnce).to.equal(true);
+            (0, chai_1.expect)(selectStub.getCall(0).args[1]).to.eql([
+                { name: "alpha (Alpha Inc)", value: "alpha" },
+                { name: "beta", value: "beta" },
+            ]);
+            (0, chai_1.expect)(new clientconfiguration_1.ClientConfiguration(tmpConfigFilePath).getOrganization()).to.equal("beta");
+        });
+    });
+    it("skips entries the control plane returned without a name", function () {
+        return __awaiter(this, void 0, void 0, function* () {
+            this.timeout(2000);
+            listOrgsStub.resolves({
+                data: [{ displayName: "No name" }, { name: "real" }],
+            });
+            selectStub.callsFake((_msg, choices) => __awaiter(this, void 0, void 0, function* () { return choices.length === 1 ? choices[0].value : undefined; }));
+            yield (0, login_1.login)(undefined, "http://admin.ms2.localhost/api/v0", tmpConfigFilePath);
+            (0, chai_1.expect)(selectStub.getCall(0).args[1]).to.eql([
+                { name: "real", value: "real" },
+            ]);
+        });
+    });
+    it("does not list organizations when one was named (scripted use stays one call)", function () {
+        return __awaiter(this, void 0, void 0, function* () {
+            this.timeout(2000);
+            yield (0, login_1.login)("given-org", "http://admin.ms2.localhost/api/v0", tmpConfigFilePath);
+            (0, chai_1.expect)(listOrgsStub.called).to.equal(false);
+            (0, chai_1.expect)(selectStub.called).to.equal(false);
+            // Assert the login actually completed, so this test cannot pass by
+            // failing early before it would have listed organizations.
+            (0, chai_1.expect)(new clientconfiguration_1.ClientConfiguration(tmpConfigFilePath).getOrganization()).to.equal("given-org");
+            (0, chai_1.expect)(axiosStub.called).to.equal(true);
         });
     });
 });