@credibledata/cred-cli 0.0.103 → 0.0.105

package/src/commands/misc/login.ts

@@ -1,343 +0,0 @@
-import axios, { isAxiosError } from "axios";
-import { jwtDecode } from "jwt-decode";
-import { URLSearchParams } from "url";
-import { OrganizationsApi } from "../../client/api";
-import { Configuration } from "../../client/configuration";
-import { ClientConfiguration } from "../../clientconfiguration";
-import {
-   auth0ConfigsByEnv,
-   AUTH_CLI_LOOPBACK_REDIRECT_URI,
-   Cluster,
-   Environment,
-   getAuth0OrganizationIdForCliLogin,
-   LOGIN_TIMEOUT_MS,
-} from "../../constants";
-import { logger } from "../../logger";
-import { printOutError, sleep } from "../../utils";
-import * as loopbackOAuth from "./loopbackOAuth";
-
-const organizationsApi = new OrganizationsApi(new Configuration());
-
-/**
- * True when argv is a `cred login ...` invocation (argv = [node, script,
- * command, ...args]).
- *
- * Recovery from a corrupt `~/.cred` is scoped to this command only and must run
- * at startup (see index.ts), before the eager config reads there. `cred login`
- * is the one command whose job is to (re)establish config and the documented
- * reset path; every other command must stay fail-loud so a stray read never
- * silently resets a user's tokens.
- */
-export function isLoginInvocation(argv: string[]): boolean {
-   return argv[2] === "login";
-}
-
-export async function login(
-   organizationName: string,
-   controlPlaneBaseURL?: string,
-   configPath?: string,
-   cluster?: Cluster,
-) {
-   const config = new ClientConfiguration(configPath);
-   const environment = config.getEnvironment();
-
-   if (environment === "e2e-test") {
-      return loginM2M(organizationName, config);
-   }
-
-   const auth0OrganizationId = getAuth0OrganizationIdForCliLogin(
-      organizationName,
-      cluster,
-   );
-   if (auth0OrganizationId) {
-      return loginWithAuthCodePkceOrganization(
-         environment,
-         organizationName,
-         controlPlaneBaseURL,
-         config,
-         auth0OrganizationId,
-      );
-   }
-
-   return loginWithDeviceCode(
-      environment,
-      organizationName,
-      controlPlaneBaseURL,
-      config,
-   );
-}
-
-async function persistTokensAndVerifyOrganization(
-   tokenPayload: {
-      id_token?: string;
-      access_token: string;
-      refresh_token?: string;
-   },
-   organizationName: string,
-   controlPlaneBaseURL: string,
-   config: ClientConfiguration,
-): Promise<void> {
-   if (tokenPayload.id_token) {
-      const decoded = jwtDecode(tokenPayload.id_token);
-      if (
-         typeof decoded === "object" &&
-         decoded !== null &&
-         "email" in decoded &&
-         "name" in decoded
-      ) {
-         const user = decoded as { email?: string; name?: string };
-         config.setVSCodeUser(user.name, user.email);
-      }
-   }
-
-   config.setAccessToken(true, tokenPayload.access_token);
-   config.setJwtAccessToken(tokenPayload.access_token);
-   if (tokenPayload.refresh_token) {
-      config.setRefreshToken(tokenPayload.refresh_token);
-   }
-
-   try {
-      const response = await organizationsApi.getOrganization(
-         organizationName,
-         {
-            baseURL: controlPlaneBaseURL,
-            headers: config.getHeaders(),
-         },
-      );
-
-      if (response.status === 200) {
-         if (organizationName !== config.getOrganization()) {
-            config.setOrganization(organizationName);
-            config.setProject(undefined);
-         }
-         logger.info("Login successful");
-      }
-   } catch (error) {
-      if (!controlPlaneBaseURL.startsWith("https://")) {
-         const errorMsg =
-            error instanceof Error ? error.message : String(error);
-         logger.warn(
-            "Error with organziation check- might be bootstrapping. Ignoring: " +
-               errorMsg,
-         );
-         config.setOrganization(organizationName);
-         config.setProject(undefined);
-         return;
-      }
-
-      if (isAxiosError(error)) {
-         if (error.response?.status === 403 || error.response?.status === 404) {
-            logger.error(
-               `The organization "${organizationName}" does not exist, or you do not have permission to access it.`,
-            );
-            process.exit(1);
-         }
-      }
-      throw error;
-   }
-}
-
-async function loginWithAuthCodePkceOrganization(
-   environment: Environment,
-   organizationName: string,
-   controlPlaneBaseURL: string,
-   config: ClientConfiguration,
-   auth0OrganizationId: string,
-): Promise<void> {
-   const auth0Domain = auth0ConfigsByEnv[environment].domain;
-   const auth0ClientId = auth0ConfigsByEnv[environment].clientId;
-   const audience = auth0ConfigsByEnv[environment].audience;
-
-   const { codeVerifier, codeChallenge } = loopbackOAuth.generatePkcePair();
-   const state = loopbackOAuth.generateOAuthState();
-
-   const authorizeParams = new URLSearchParams({
-      response_type: "code",
-      client_id: auth0ClientId,
-      redirect_uri: AUTH_CLI_LOOPBACK_REDIRECT_URI,
-      scope: "openid profile email offline_access",
-      audience,
-      organization: auth0OrganizationId,
-      code_challenge: codeChallenge,
-      code_challenge_method: "S256",
-      state,
-   });
-   const authorizeUrl = `${auth0Domain}/authorize?${authorizeParams.toString()}`;
-
-   try {
-      const { code } = await loopbackOAuth.authorizationCodeViaLoopback({
-         redirectUri: AUTH_CLI_LOOPBACK_REDIRECT_URI,
-         expectedState: state,
-         authorizeUrl,
-         timeoutMs: LOGIN_TIMEOUT_MS,
-         onListening: () => {
-            logger.info(
-               `Please visit the following URL to login ${authorizeUrl}`,
-            );
-            logger.info("Waiting for login...");
-         },
-      });
-
-      const tokenResponse = await axios.request({
-         method: "POST",
-         url: `${auth0Domain}/oauth/token`,
-         headers: { "content-type": "application/x-www-form-urlencoded" },
-         data: new URLSearchParams({
-            grant_type: "authorization_code",
-            client_id: auth0ClientId,
-            code,
-            redirect_uri: AUTH_CLI_LOOPBACK_REDIRECT_URI,
-            code_verifier: codeVerifier,
-         }),
-      });
-
-      await persistTokensAndVerifyOrganization(
-         tokenResponse.data,
-         organizationName,
-         controlPlaneBaseURL,
-         config,
-      );
-   } catch (e) {
-      if (isAxiosError(e)) {
-         const d = e.response?.data;
-         if (
-            typeof d === "object" &&
-            d !== null &&
-            "error" in d &&
-            d.error === "redirect_uri_mismatch"
-         ) {
-            logger.error(
-               `Auth0 rejected the CLI callback URL. Add ${AUTH_CLI_LOOPBACK_REDIRECT_URI} to this application's Allowed Callback URLs in Auth0.`,
-            );
-         }
-         printOutError(e, false);
-      } else {
-         const msg = e instanceof Error ? e.message : String(e);
-         logger.error(msg);
-      }
-      process.exit(1);
-   }
-}
-
-async function loginWithDeviceCode(
-   environment: Environment,
-   organizationName: string,
-   controlPlaneBaseURL: string,
-   config: ClientConfiguration,
-) {
-   const auth0Domain = auth0ConfigsByEnv[environment].domain;
-   const auth0ClientId = auth0ConfigsByEnv[environment].clientId;
-   let deviceCodeData = null;
-
-   try {
-      const deviceCode = await axios.request({
-         method: "POST",
-         url: `${auth0Domain}/oauth/device/code`,
-         headers: { "content-type": "application/x-www-form-urlencoded" },
-         data: {
-            client_id: auth0ClientId,
-            audience: auth0ConfigsByEnv[environment].audience,
-            scope: "openid profile email offline_access",
-         },
-      });
-      deviceCodeData = deviceCode.data;
-
-      logger.info(
-         `Please visit the following URL to login ${deviceCode.data.verification_uri_complete} and verify user code ${deviceCode.data.user_code}.`,
-      );
-      logger.info("Waiting for login...");
-   } catch (e) {
-      printOutError(e, false);
-      process.exit(1);
-   }
-
-   const startTime = Date.now();
-
-   while (true) {
-      try {
-         const accessToken = await axios.request({
-            method: "POST",
-            url: `${auth0Domain}/oauth/token`,
-            headers: { "content-type": "application/x-www-form-urlencoded" },
-            data: new URLSearchParams({
-               grant_type: "urn:ietf:params:oauth:grant-type:device_code",
-               device_code: deviceCodeData.device_code,
-               client_id: auth0ClientId,
-            }),
-         });
-         await persistTokensAndVerifyOrganization(
-            accessToken.data,
-            organizationName,
-            controlPlaneBaseURL,
-            config,
-         );
-         break;
-      } catch (error) {
-         if (
-            isAxiosError(error) &&
-            error.response?.data?.error !== "authorization_pending"
-         ) {
-            const errorData = error.response?.data;
-            if (errorData) {
-               if (typeof errorData === "string") {
-                  logger.error(errorData);
-               } else if (errorData.error_description) {
-                  logger.error(errorData.error_description);
-               } else if (errorData.error) {
-                  logger.error(errorData.error);
-               } else {
-                  logger.error(JSON.stringify(errorData));
-               }
-            } else {
-               const errorMsg =
-                  error instanceof Error ? error.message : String(error);
-               logger.error(errorMsg || "Unknown error occurred");
-            }
-         }
-         if (Date.now() - startTime > LOGIN_TIMEOUT_MS) {
-            logger.info("Login timed out after 5 minutes");
-            process.exit(1);
-         }
-
-         await sleep(deviceCodeData.interval * 1000);
-      }
-   }
-}
-
-async function loginM2M(
-   organizationName: string,
-   config: ClientConfiguration,
-): Promise<void> {
-   const auth0Config = auth0ConfigsByEnv["e2e-test"];
-
-   if (!auth0Config) {
-      throw new Error("No environment variables present for e2e");
-   }
-
-   try {
-      const response = await axios.request({
-         method: "POST",
-         url: `${auth0Config.domain}/oauth/token`,
-         headers: { "content-type": "application/x-www-form-urlencoded" },
-         data: {
-            grant_type: "client_credentials",
-            client_id: auth0Config.clientId,
-            client_secret: auth0Config.clientSecret,
-            audience: auth0Config.audience,
-         },
-      });
-
-      const token = response.data.access_token;
-
-      if (!token) {
-         throw new Error("No access token received");
-      }
-
-      config.destroyConfig();
-      config.setAccessToken(true, token);
-      config.setOrganization(organizationName);
-   } catch (e) {
-      printOutError(e, false);
-      process.exit(1);
-   }
-}

package/src/commands/misc/logout.spec.ts

@@ -1,32 +0,0 @@
-import { expect } from "chai";
-import sinon from "sinon";
-import { ClientConfiguration } from "../../clientconfiguration";
-import { logger } from "../../logger";
-import { logout } from "./logout";
-
-describe("logout", () => {
-   let sandbox: sinon.SinonSandbox;
-   let destroyConfigStub: sinon.SinonStub;
-   let loggerStub: sinon.SinonStubbedInstance<typeof logger>;
-
-   beforeEach(() => {
-      sandbox = sinon.createSandbox();
-      loggerStub = sandbox.stub(logger);
-      destroyConfigStub = sandbox.stub(
-         ClientConfiguration.prototype,
-         "destroyConfig",
-      );
-   });
-
-   afterEach(() => {
-      sandbox.restore();
-   });
-
-   it("should destroy config and log success message", () => {
-      logout();
-
-      expect(destroyConfigStub.calledOnce).to.be.true;
-      expect(loggerStub.info.calledWith(sinon.match("Credentials reset"))).to.be
-         .true;
-   });
-});

package/src/commands/misc/logout.ts

@@ -1,9 +0,0 @@
-import { ClientConfiguration } from "../../clientconfiguration";
-import { logger } from "../../logger";
-
-export function logout() {
-   const config = new ClientConfiguration();
-   config.destroyConfig();
-
-   logger.info("Credentials reset");
-}

package/src/commands/misc/loopbackOAuth.ts

@@ -1,127 +0,0 @@
-import { createHash, randomBytes } from "crypto";
-import http from "http";
-import { URL } from "url";
-
-export function generatePkcePair(): {
-   codeVerifier: string;
-   codeChallenge: string;
-} {
-   const codeVerifier = randomBytes(32).toString("base64url");
-   const codeChallenge = createHash("sha256")
-      .update(codeVerifier)
-      .digest("base64url");
-   return { codeVerifier, codeChallenge };
-}
-
-export function generateOAuthState(): string {
-   return randomBytes(24).toString("base64url");
-}
-
-/**
- * Listens on loopback `redirectUri` for the OAuth redirect, then exchanges are done by the caller.
- * Caller should print `authorizeUrl` as plain text (e.g. in {@link onListening}) — no browser auto-open.
- * Used when the CLI must send `organization` on `/authorize` (Auth0 Organizations); the documented
- * device-code endpoint does not list an `organization` parameter
- * (https://auth0.com/docs/get-started/authentication-and-authorization-flow/device-authorization-flow/call-your-api-using-the-device-authorization-flow#device-code-parameters).
- */
-export async function authorizationCodeViaLoopback(options: {
-   redirectUri: string;
-   expectedState: string;
-   authorizeUrl: string;
-   timeoutMs: number;
-   /** Invoked once the loopback server is ready (safe to tell the user to open the URL). */
-   onListening?: () => void;
-}): Promise<{ code: string }> {
-   const {
-      redirectUri,
-      expectedState,
-      authorizeUrl: _authorizeUrl,
-      timeoutMs,
-      onListening,
-   } = options;
-   const parsed = new URL(redirectUri);
-   const port = Number(parsed.port);
-   const pathname = parsed.pathname;
-
-   if (!Number.isFinite(port) || port <= 0) {
-      throw new Error(
-         `Invalid redirect URI (need explicit port): ${redirectUri}`,
-      );
-   }
-
-   return new Promise((resolve, reject) => {
-      let settled = false;
-      // eslint-disable-next-line prefer-const -- assign after finish/timer (handler may run before `const` bindings exist)
-      let server: http.Server | undefined;
-
-      const finish = (err: Error | null, result?: { code: string }) => {
-         if (settled) {
-            return;
-         }
-         settled = true;
-         clearTimeout(timer);
-         server?.close();
-         if (err) {
-            reject(err);
-         } else {
-            resolve(result!);
-         }
-      };
-
-      const timer = setTimeout(() => {
-         finish(
-            new Error(
-               `Login timed out after ${Math.round(timeoutMs / 1000)} seconds`,
-            ),
-         );
-      }, timeoutMs);
-
-      server = http.createServer((req, res) => {
-         if (settled || !req.url) {
-            return;
-         }
-         try {
-            const reqUrl = new URL(req.url, `http://127.0.0.1:${port}`);
-            if (reqUrl.pathname !== pathname) {
-               res.writeHead(404);
-               res.end();
-               return;
-            }
-            const code = reqUrl.searchParams.get("code");
-            const state = reqUrl.searchParams.get("state");
-            const error = reqUrl.searchParams.get("error");
-
-            res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
-            res.end(
-               "<!DOCTYPE html><html><body><p>You can close this tab and return to the terminal.</p></body></html>",
-            );
-
-            if (error) {
-               finish(
-                  new Error(
-                     reqUrl.searchParams.get("error_description") || error,
-                  ),
-               );
-               return;
-            }
-            if (!code || state !== expectedState) {
-               finish(new Error("Invalid authorization response"));
-               return;
-            }
-            finish(null, { code });
-         } catch (e) {
-            finish(e instanceof Error ? e : new Error(String(e)));
-         }
-      });
-
-      server.on("error", (err) => finish(err));
-
-      server.listen(port, "127.0.0.1", () => {
-         try {
-            onListening?.();
-         } catch (e) {
-            finish(e instanceof Error ? e : new Error(String(e)));
-         }
-      });
-   });
-}

package/src/commands/misc/set-access-token.spec.ts

@@ -1,95 +0,0 @@
-import { expect } from "chai";
-import sinon from "sinon";
-import { ClientConfiguration } from "../../clientconfiguration";
-import { logger } from "../../logger";
-import { setAccessToken } from "./set-access-token";
-
-describe("set-access-token", () => {
-   let sandbox: sinon.SinonSandbox;
-   let setAccessTokenStub: sinon.SinonStub;
-   let setJwtAccessTokenStub: sinon.SinonStub;
-   let setOrganizationStub: sinon.SinonStub;
-   let loggerStub: sinon.SinonStubbedInstance<typeof logger>;
-
-   beforeEach(() => {
-      sandbox = sinon.createSandbox();
-      loggerStub = sandbox.stub(logger);
-      setAccessTokenStub = sandbox.stub(
-         ClientConfiguration.prototype,
-         "setAccessToken",
-      );
-      setJwtAccessTokenStub = sandbox.stub(
-         ClientConfiguration.prototype,
-         "setJwtAccessToken",
-      );
-      setOrganizationStub = sandbox.stub(
-         ClientConfiguration.prototype,
-         "setOrganization",
-      );
-   });
-
-   afterEach(() => {
-      sandbox.restore();
-   });
-
-   it("should set access token successfully", () => {
-      const jwtToken = "test-jwt-token";
-
-      setAccessToken(jwtToken);
-
-      expect(setAccessTokenStub.calledOnce).to.be.true;
-      expect(setAccessTokenStub.firstCall.args).to.deep.equal([
-         false,
-         jwtToken,
-      ]);
-      expect(setJwtAccessTokenStub.calledOnce).to.be.true;
-      expect(setJwtAccessTokenStub.firstCall.args[0]).to.equal(jwtToken);
-      expect(
-         loggerStub.info.calledWith(
-            sinon.match("Access token set successfully"),
-         ),
-      ).to.be.true;
-   });
-
-   it("should set access token and organization when provided", () => {
-      const jwtToken = "test-jwt-token";
-      const organizationName = "test-org";
-
-      setAccessToken(jwtToken, organizationName);
-
-      expect(setAccessTokenStub.calledOnce).to.be.true;
-      expect(setJwtAccessTokenStub.calledOnce).to.be.true;
-      expect(setOrganizationStub.calledOnce).to.be.true;
-      expect(setOrganizationStub.firstCall.args[0]).to.equal(organizationName);
-      expect(
-         loggerStub.info.calledWith(
-            sinon.match("Access token set successfully"),
-         ),
-      ).to.be.true;
-      expect(
-         loggerStub.info.calledWith(
-            sinon.match(`Organization set to: ${organizationName}`),
-         ),
-      ).to.be.true;
-   });
-
-   it("should not set organization when not provided", () => {
-      const jwtToken = "test-jwt-token";
-
-      setAccessToken(jwtToken);
-
-      expect(setOrganizationStub.called).to.be.false;
-      expect(loggerStub.info.calledWith(sinon.match(/Organization set to:/))).to
-         .be.false;
-   });
-
-   it("should handle custom config path", () => {
-      const jwtToken = "test-jwt-token";
-      const configPath = "/custom/path/config.json";
-
-      setAccessToken(jwtToken, undefined, configPath);
-
-      expect(setAccessTokenStub.calledOnce).to.be.true;
-      expect(setJwtAccessTokenStub.calledOnce).to.be.true;
-   });
-});

package/src/commands/misc/set-access-token.ts

@@ -1,32 +0,0 @@
-import { ClientConfiguration } from "../../clientconfiguration";
-import { logger } from "../../logger";
-
-/**
- * Sets a service account JWT token for CLI authentication.
- *
- * @param jwtToken The JWT token to use for authentication
- * @param organizationName Optional organization name to set
- * @param configPath Optional custom config path
- */
-export function setAccessToken(
-   jwtToken: string,
-   organizationName?: string,
-   configPath?: string,
-) {
-   const config = new ClientConfiguration(configPath);
-
-   // Set the JWT token as both access token and JWT access token
-   config.setAccessToken(false, jwtToken);
-   config.setJwtAccessToken(jwtToken);
-
-   // Set organization if provided
-   if (organizationName) {
-      config.setOrganization(organizationName);
-   }
-
-   logger.info("Access token set successfully");
-
-   if (organizationName) {
-      logger.info(`Organization set to: ${organizationName}`);
-   }
-}