@credibledata/cred-cli 0.0.6

package/src/commands/misc/login.spec.ts

@@ -0,0 +1,213 @@
+import axios from "axios";
+import { expect } from "chai";
+import fs from "fs";
+import os from "os";
+import { join } from "path";
+import sinon from "sinon";
+import * as credConstants from "../../constants";
+import { ClientConfiguration } from "../../clientconfiguration";
+import { login } from "./login";
+import { OrganizationsApi } from "../../client/api";
+import * as loopbackOAuth from "./loopbackOAuth";
+
+function createFakeIdToken(payload: Record<string, unknown>): string {
+   const header = Buffer.from(
+      JSON.stringify({ alg: "none", typ: "JWT" }),
+   ).toString("base64url");
+   const body = Buffer.from(JSON.stringify(payload)).toString("base64url");
+   return `${header}.${body}.`;
+}
+
+describe("login", () => {
+   let tmpConfigFilePath: string;
+   let axiosStub: sinon.SinonStub;
+   let orgPermissionsStub: sinon.SinonStub;
+
+   const mockDeviceCodeResponse = {
+      data: {
+         verification_uri_complete: "https://example.com",
+         user_code: "123456",
+         device_code: "device-code-123",
+         interval: 1,
+      },
+   };
+
+   const fakeJwtPayload = {
+      name: "Test User",
+      email: "test@example.com",
+   };
+
+   const mockedAccessTokenResponse = {
+      data: {
+         id_token: createFakeIdToken(fakeJwtPayload),
+         access_token: "mock-access-token",
+         refresh_token: "mock-refresh-token",
+      },
+   };
+
+   const mockOrgPermissionsResponse = {
+      status: 200,
+      data: {},
+   };
+
+   beforeEach(() => {
+      tmpConfigFilePath = join(os.tmpdir(), "cred.json");
+      fs.writeFileSync(tmpConfigFilePath, "{}");
+      axiosStub = sinon.stub(axios, "request");
+      orgPermissionsStub = sinon
+         .stub(OrganizationsApi.prototype, "getOrganization")
+         .resolves(mockOrgPermissionsResponse as any);
+   });
+
+   afterEach(() => {
+      fs.rmSync(tmpConfigFilePath);
+      sinon.restore();
+   });
+
+   it("should not delete config properties on login", async function () {
+      this.timeout(2000);
+      const config = new ClientConfiguration(tmpConfigFilePath);
+      config.setEnvironment("localhost");
+      config.setOrganization("foo");
+      config.setProject("bar");
+      axiosStub
+         .onFirstCall()
+         .resolves(mockDeviceCodeResponse)
+         .onSecondCall()
+         .resolves(mockedAccessTokenResponse);
+      await login("foo", "http://localhost", tmpConfigFilePath);
+      expect(config.getOrganization()).to.equal("foo");
+      expect(config.getProject()).to.equal("bar");
+   });
+
+   it("should change the active organization when login succeeds", async function () {
+      this.timeout(2000);
+      axiosStub
+         .onFirstCall()
+         .resolves(mockDeviceCodeResponse)
+         .onSecondCall()
+         .resolves(mockedAccessTokenResponse);
+      const config = new ClientConfiguration(tmpConfigFilePath);
+      config.setEnvironment("localhost");
+      config.setOrganization("foo");
+      config.setProject("bar");
+      await login("test", "http://localhost", tmpConfigFilePath);
+      expect(config.getOrganization()).to.equal("test");
+   });
+
+   it("should set an access token when login succeeds", async function () {
+      this.timeout(2000);
+      axiosStub
+         .onFirstCall()
+         .resolves(mockDeviceCodeResponse)
+         .onSecondCall()
+         .resolves(mockedAccessTokenResponse);
+      const config = new ClientConfiguration(tmpConfigFilePath);
+      config.setEnvironment("localhost");
+      await login("test", "http://localhost", tmpConfigFilePath);
+      expect(config.getAccessToken()).to.equal(
+         mockedAccessTokenResponse.data.access_token,
+      );
+   });
+
+   it("should unset the project field when switching organizations", async function () {
+      this.timeout(2000);
+      axiosStub
+         .onFirstCall()
+         .resolves(mockDeviceCodeResponse)
+         .onSecondCall()
+         .resolves(mockedAccessTokenResponse);
+      const config = new ClientConfiguration(tmpConfigFilePath);
+      config.setEnvironment("localhost");
+      config.setOrganization("foo");
+      config.setProject("bar");
+      await login("not-foo", "http://localhost", tmpConfigFilePath);
+      expect(config.getProject()).to.equal(undefined);
+   });
+
+   it("should not unset the project field when logging in with the same organization", async function () {
+      this.timeout(2000);
+      axiosStub
+         .onFirstCall()
+         .resolves(mockDeviceCodeResponse)
+         .onSecondCall()
+         .resolves(mockedAccessTokenResponse);
+      const config = new ClientConfiguration(tmpConfigFilePath);
+      config.setEnvironment("localhost");
+      config.setOrganization("foo");
+      config.setProject("bar");
+      await login("foo", "http://localhost", tmpConfigFilePath);
+      expect(config.getProject()).to.equal("bar");
+   });
+
+   it("uses auth-code + PKCE with organization in authorize URL for mapped CLI orgs", async function () {
+      this.timeout(2000);
+      const orgIdStub = sinon
+         .stub(credConstants, "getAuth0OrganizationIdForCliLogin")
+         .returns("org_nMRKafeSuxOiuJeG");
+      const loopbackStub = sinon
+         .stub(loopbackOAuth, "authorizationCodeViaLoopback")
+         .callsFake(async (opts) => {
+            opts.onListening?.();
+            return { code: "test-pkce-auth-code" };
+         });
+      axiosStub.onFirstCall().resolves(mockedAccessTokenResponse);
+      const config = new ClientConfiguration(tmpConfigFilePath);
+      config.setEnvironment("videoamp");
+      await login(
+         "videoamp",
+         "https://admin.videoamp-aws-us-east-1.credibledata.com/api/v0",
+         tmpConfigFilePath,
+      );
+      expect(orgIdStub.calledOnceWithExactly("videoamp")).to.be.true;
+      expect(loopbackStub.calledOnce).to.be.true;
+      const call = loopbackStub.getCall(0);
+      expect(call.args[0].authorizeUrl).to.contain(
+         "organization=org_nMRKafeSuxOiuJeG",
+      );
+   });
+
+   it("uses mapped org id for PKCE flow regardless of org name casing", async function () {
+      this.timeout(2000);
+      const orgIdStub = sinon
+         .stub(credConstants, "getAuth0OrganizationIdForCliLogin")
+         .callsFake((name: string) =>
+            name.toLowerCase() === "videoamp"
+               ? "org_nMRKafeSuxOiuJeG"
+               : undefined,
+         );
+      const loopbackStub = sinon
+         .stub(loopbackOAuth, "authorizationCodeViaLoopback")
+         .callsFake(async (opts) => {
+            opts.onListening?.();
+            return { code: "test-pkce-auth-code" };
+         });
+      axiosStub.onFirstCall().resolves(mockedAccessTokenResponse);
+      const config = new ClientConfiguration(tmpConfigFilePath);
+      config.setEnvironment("videoamp");
+      await login(
+         "VideoAmp",
+         "https://admin.videoamp-aws-us-east-1.credibledata.com/api/v0",
+         tmpConfigFilePath,
+      );
+      expect(orgIdStub.calledOnceWithExactly("VideoAmp")).to.be.true;
+      expect(loopbackStub.getCall(0).args[0].authorizeUrl).to.contain(
+         "organization=org_nMRKafeSuxOiuJeG",
+      );
+   });
+
+   it("should not pass Auth0 organization for unmapped org names", async function () {
+      this.timeout(2000);
+      axiosStub
+         .onFirstCall()
+         .resolves(mockDeviceCodeResponse)
+         .onSecondCall()
+         .resolves(mockedAccessTokenResponse);
+      const config = new ClientConfiguration(tmpConfigFilePath);
+      config.setEnvironment("localhost");
+      await login("test", "http://localhost", tmpConfigFilePath);
+      expect(axiosStub.getCall(0).args[0].data).to.not.have.property(
+         "organization",
+      );
+   });
+});

package/src/commands/misc/login.ts

@@ -0,0 +1,325 @@
+import axios, { isAxiosError } from "axios";
+import { jwtDecode } from "jwt-decode";
+import { URLSearchParams } from "url";
+import { OrganizationsApi } from "../../client/api";
+import { Configuration } from "../../client/configuration";
+import { ClientConfiguration } from "../../clientconfiguration";
+import {
+   auth0ConfigsByEnv,
+   AUTH_CLI_LOOPBACK_REDIRECT_URI,
+   Environment,
+   getAuth0OrganizationIdForCliLogin,
+   LOGIN_TIMEOUT_MS,
+} from "../../constants";
+import { logger } from "../../logger";
+import { printOutError, sleep } from "../../utils";
+import * as loopbackOAuth from "./loopbackOAuth";
+
+const organizationsApi = new OrganizationsApi(new Configuration());
+
+export async function login(
+   organizationName: string,
+   controlPlaneBaseURL?: string,
+   configPath?: string,
+) {
+   const config = new ClientConfiguration(configPath);
+   const environment = config.getEnvironment();
+
+   if (environment === "e2e-test") {
+      return loginM2M(organizationName, config);
+   }
+
+   const auth0OrganizationId =
+      getAuth0OrganizationIdForCliLogin(organizationName);
+   if (auth0OrganizationId) {
+      return loginWithAuthCodePkceOrganization(
+         environment,
+         organizationName,
+         controlPlaneBaseURL,
+         config,
+         auth0OrganizationId,
+      );
+   }
+
+   return loginWithDeviceCode(
+      environment,
+      organizationName,
+      controlPlaneBaseURL,
+      config,
+   );
+}
+
+async function persistTokensAndVerifyOrganization(
+   tokenPayload: {
+      id_token?: string;
+      access_token: string;
+      refresh_token?: string;
+   },
+   organizationName: string,
+   controlPlaneBaseURL: string,
+   config: ClientConfiguration,
+): Promise<void> {
+   if (tokenPayload.id_token) {
+      const decoded = jwtDecode(tokenPayload.id_token);
+      if (
+         typeof decoded === "object" &&
+         decoded !== null &&
+         "email" in decoded &&
+         "name" in decoded
+      ) {
+         const user = decoded as { email?: string; name?: string };
+         config.setVSCodeUser(user.name, user.email);
+      }
+   }
+
+   config.setAccessToken(true, tokenPayload.access_token);
+   config.setJwtAccessToken(tokenPayload.access_token);
+   if (tokenPayload.refresh_token) {
+      config.setRefreshToken(tokenPayload.refresh_token);
+   }
+
+   try {
+      const response = await organizationsApi.getOrganization(
+         organizationName,
+         {
+            baseURL: controlPlaneBaseURL,
+            headers: config.getHeaders(),
+         },
+      );
+
+      if (response.status === 200) {
+         if (organizationName !== config.getOrganization()) {
+            config.setOrganization(organizationName);
+            config.setProject(undefined);
+         }
+         logger.info("Login successful");
+      }
+   } catch (error) {
+      if (!controlPlaneBaseURL.startsWith("https://")) {
+         const errorMsg =
+            error instanceof Error ? error.message : String(error);
+         logger.warn(
+            "Error with organziation check- might be bootstrapping. Ignoring: " +
+               errorMsg,
+         );
+         config.setOrganization(organizationName);
+         config.setProject(undefined);
+         return;
+      }
+
+      if (isAxiosError(error)) {
+         if (error.response?.status === 403 || error.response?.status === 404) {
+            logger.error(
+               `The organization "${organizationName}" does not exist, or you do not have permission to access it.`,
+            );
+            process.exit(1);
+         }
+      }
+      throw error;
+   }
+}
+
+async function loginWithAuthCodePkceOrganization(
+   environment: Environment,
+   organizationName: string,
+   controlPlaneBaseURL: string,
+   config: ClientConfiguration,
+   auth0OrganizationId: string,
+): Promise<void> {
+   const auth0Domain = auth0ConfigsByEnv[environment].domain;
+   const auth0ClientId = auth0ConfigsByEnv[environment].clientId;
+   const audience = auth0ConfigsByEnv[environment].audience;
+
+   const { codeVerifier, codeChallenge } = loopbackOAuth.generatePkcePair();
+   const state = loopbackOAuth.generateOAuthState();
+
+   const authorizeParams = new URLSearchParams({
+      response_type: "code",
+      client_id: auth0ClientId,
+      redirect_uri: AUTH_CLI_LOOPBACK_REDIRECT_URI,
+      scope: "openid profile email offline_access",
+      audience,
+      organization: auth0OrganizationId,
+      code_challenge: codeChallenge,
+      code_challenge_method: "S256",
+      state,
+   });
+   const authorizeUrl = `${auth0Domain}/authorize?${authorizeParams.toString()}`;
+
+   try {
+      const { code } = await loopbackOAuth.authorizationCodeViaLoopback({
+         redirectUri: AUTH_CLI_LOOPBACK_REDIRECT_URI,
+         expectedState: state,
+         authorizeUrl,
+         timeoutMs: LOGIN_TIMEOUT_MS,
+         onListening: () => {
+            logger.info(
+               `Please visit the following URL to login ${authorizeUrl}`,
+            );
+            logger.info("Waiting for login...");
+         },
+      });
+
+      const tokenResponse = await axios.request({
+         method: "POST",
+         url: `${auth0Domain}/oauth/token`,
+         headers: { "content-type": "application/x-www-form-urlencoded" },
+         data: new URLSearchParams({
+            grant_type: "authorization_code",
+            client_id: auth0ClientId,
+            code,
+            redirect_uri: AUTH_CLI_LOOPBACK_REDIRECT_URI,
+            code_verifier: codeVerifier,
+         }),
+      });
+
+      await persistTokensAndVerifyOrganization(
+         tokenResponse.data,
+         organizationName,
+         controlPlaneBaseURL,
+         config,
+      );
+   } catch (e) {
+      if (isAxiosError(e)) {
+         const d = e.response?.data;
+         if (
+            typeof d === "object" &&
+            d !== null &&
+            "error" in d &&
+            d.error === "redirect_uri_mismatch"
+         ) {
+            logger.error(
+               `Auth0 rejected the CLI callback URL. Add ${AUTH_CLI_LOOPBACK_REDIRECT_URI} to this application's Allowed Callback URLs in Auth0.`,
+            );
+         }
+         printOutError(e, false);
+      } else {
+         const msg = e instanceof Error ? e.message : String(e);
+         logger.error(msg);
+      }
+      process.exit(1);
+   }
+}
+
+async function loginWithDeviceCode(
+   environment: Environment,
+   organizationName: string,
+   controlPlaneBaseURL: string,
+   config: ClientConfiguration,
+) {
+   const auth0Domain = auth0ConfigsByEnv[environment].domain;
+   const auth0ClientId = auth0ConfigsByEnv[environment].clientId;
+   let deviceCodeData = null;
+
+   try {
+      const deviceCode = await axios.request({
+         method: "POST",
+         url: `${auth0Domain}/oauth/device/code`,
+         headers: { "content-type": "application/x-www-form-urlencoded" },
+         data: {
+            client_id: auth0ClientId,
+            audience: auth0ConfigsByEnv[environment].audience,
+            scope: "openid profile email offline_access",
+         },
+      });
+      deviceCodeData = deviceCode.data;
+
+      logger.info(
+         `Please visit the following URL to login ${deviceCode.data.verification_uri_complete} and verify user code ${deviceCode.data.user_code}.`,
+      );
+      logger.info("Waiting for login...");
+   } catch (e) {
+      printOutError(e, false);
+      process.exit(1);
+   }
+
+   const startTime = Date.now();
+
+   while (true) {
+      try {
+         const accessToken = await axios.request({
+            method: "POST",
+            url: `${auth0Domain}/oauth/token`,
+            headers: { "content-type": "application/x-www-form-urlencoded" },
+            data: new URLSearchParams({
+               grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+               device_code: deviceCodeData.device_code,
+               client_id: auth0ClientId,
+            }),
+         });
+         await persistTokensAndVerifyOrganization(
+            accessToken.data,
+            organizationName,
+            controlPlaneBaseURL,
+            config,
+         );
+         break;
+      } catch (error) {
+         if (
+            isAxiosError(error) &&
+            error.response?.data?.error !== "authorization_pending"
+         ) {
+            const errorData = error.response?.data;
+            if (errorData) {
+               if (typeof errorData === "string") {
+                  logger.error(errorData);
+               } else if (errorData.error_description) {
+                  logger.error(errorData.error_description);
+               } else if (errorData.error) {
+                  logger.error(errorData.error);
+               } else {
+                  logger.error(JSON.stringify(errorData));
+               }
+            } else {
+               const errorMsg =
+                  error instanceof Error ? error.message : String(error);
+               logger.error(errorMsg || "Unknown error occurred");
+            }
+         }
+         if (Date.now() - startTime > LOGIN_TIMEOUT_MS) {
+            logger.info("Login timed out after 5 minutes");
+            process.exit(1);
+         }
+
+         await sleep(deviceCodeData.interval * 1000);
+      }
+   }
+}
+
+async function loginM2M(
+   organizationName: string,
+   config: ClientConfiguration,
+): Promise<void> {
+   const auth0Config = auth0ConfigsByEnv["e2e-test"];
+
+   if (!auth0Config) {
+      throw new Error("No environment variables present for e2e");
+   }
+
+   try {
+      const response = await axios.request({
+         method: "POST",
+         url: `${auth0Config.domain}/oauth/token`,
+         headers: { "content-type": "application/x-www-form-urlencoded" },
+         data: {
+            grant_type: "client_credentials",
+            client_id: auth0Config.clientId,
+            client_secret: auth0Config.clientSecret,
+            audience: auth0Config.audience,
+         },
+      });
+
+      const token = response.data.access_token;
+
+      if (!token) {
+         throw new Error("No access token received");
+      }
+
+      config.destroyConfig();
+      config.setAccessToken(true, token);
+      config.setOrganization(organizationName);
+   } catch (e) {
+      printOutError(e, false);
+      process.exit(1);
+   }
+}

package/src/commands/misc/logout.spec.ts

@@ -0,0 +1,32 @@
+import { expect } from "chai";
+import sinon from "sinon";
+import { ClientConfiguration } from "../../clientconfiguration";
+import { logger } from "../../logger";
+import { logout } from "./logout";
+
+describe("logout", () => {
+   let sandbox: sinon.SinonSandbox;
+   let destroyConfigStub: sinon.SinonStub;
+   let loggerStub: sinon.SinonStubbedInstance<typeof logger>;
+
+   beforeEach(() => {
+      sandbox = sinon.createSandbox();
+      loggerStub = sandbox.stub(logger);
+      destroyConfigStub = sandbox.stub(
+         ClientConfiguration.prototype,
+         "destroyConfig",
+      );
+   });
+
+   afterEach(() => {
+      sandbox.restore();
+   });
+
+   it("should destroy config and log success message", () => {
+      logout();
+
+      expect(destroyConfigStub.calledOnce).to.be.true;
+      expect(loggerStub.info.calledWith(sinon.match("Credentials reset"))).to.be
+         .true;
+   });
+});

package/src/commands/misc/logout.ts

@@ -0,0 +1,9 @@
+import { ClientConfiguration } from "../../clientconfiguration";
+import { logger } from "../../logger";
+
+export function logout() {
+   const config = new ClientConfiguration();
+   config.destroyConfig();
+
+   logger.info("Credentials reset");
+}

package/src/commands/misc/loopbackOAuth.ts

@@ -0,0 +1,127 @@
+import { createHash, randomBytes } from "crypto";
+import http from "http";
+import { URL } from "url";
+
+export function generatePkcePair(): {
+   codeVerifier: string;
+   codeChallenge: string;
+} {
+   const codeVerifier = randomBytes(32).toString("base64url");
+   const codeChallenge = createHash("sha256")
+      .update(codeVerifier)
+      .digest("base64url");
+   return { codeVerifier, codeChallenge };
+}
+
+export function generateOAuthState(): string {
+   return randomBytes(24).toString("base64url");
+}
+
+/**
+ * Listens on loopback `redirectUri` for the OAuth redirect, then exchanges are done by the caller.
+ * Caller should print `authorizeUrl` as plain text (e.g. in {@link onListening}) — no browser auto-open.
+ * Used when the CLI must send `organization` on `/authorize` (Auth0 Organizations); the documented
+ * device-code endpoint does not list an `organization` parameter
+ * (https://auth0.com/docs/get-started/authentication-and-authorization-flow/device-authorization-flow/call-your-api-using-the-device-authorization-flow#device-code-parameters).
+ */
+export async function authorizationCodeViaLoopback(options: {
+   redirectUri: string;
+   expectedState: string;
+   authorizeUrl: string;
+   timeoutMs: number;
+   /** Invoked once the loopback server is ready (safe to tell the user to open the URL). */
+   onListening?: () => void;
+}): Promise<{ code: string }> {
+   const {
+      redirectUri,
+      expectedState,
+      authorizeUrl: _authorizeUrl,
+      timeoutMs,
+      onListening,
+   } = options;
+   const parsed = new URL(redirectUri);
+   const port = Number(parsed.port);
+   const pathname = parsed.pathname;
+
+   if (!Number.isFinite(port) || port <= 0) {
+      throw new Error(
+         `Invalid redirect URI (need explicit port): ${redirectUri}`,
+      );
+   }
+
+   return new Promise((resolve, reject) => {
+      let settled = false;
+      // eslint-disable-next-line prefer-const -- assign after finish/timer (handler may run before `const` bindings exist)
+      let server: http.Server | undefined;
+
+      const finish = (err: Error | null, result?: { code: string }) => {
+         if (settled) {
+            return;
+         }
+         settled = true;
+         clearTimeout(timer);
+         server?.close();
+         if (err) {
+            reject(err);
+         } else {
+            resolve(result!);
+         }
+      };
+
+      const timer = setTimeout(() => {
+         finish(
+            new Error(
+               `Login timed out after ${Math.round(timeoutMs / 1000)} seconds`,
+            ),
+         );
+      }, timeoutMs);
+
+      server = http.createServer((req, res) => {
+         if (settled || !req.url) {
+            return;
+         }
+         try {
+            const reqUrl = new URL(req.url, `http://127.0.0.1:${port}`);
+            if (reqUrl.pathname !== pathname) {
+               res.writeHead(404);
+               res.end();
+               return;
+            }
+            const code = reqUrl.searchParams.get("code");
+            const state = reqUrl.searchParams.get("state");
+            const error = reqUrl.searchParams.get("error");
+
+            res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+            res.end(
+               "<!DOCTYPE html><html><body><p>You can close this tab and return to the terminal.</p></body></html>",
+            );
+
+            if (error) {
+               finish(
+                  new Error(
+                     reqUrl.searchParams.get("error_description") || error,
+                  ),
+               );
+               return;
+            }
+            if (!code || state !== expectedState) {
+               finish(new Error("Invalid authorization response"));
+               return;
+            }
+            finish(null, { code });
+         } catch (e) {
+            finish(e instanceof Error ? e : new Error(String(e)));
+         }
+      });
+
+      server.on("error", (err) => finish(err));
+
+      server.listen(port, "127.0.0.1", () => {
+         try {
+            onListening?.();
+         } catch (e) {
+            finish(e instanceof Error ? e : new Error(String(e)));
+         }
+      });
+   });
+}