@credibledata/cred-cli 0.1.4 → 0.1.5

package/src/commands/misc/login.ts

@@ -1,28 +1,210 @@
 import axios, { isAxiosError } from "axios";
 import { jwtDecode } from "jwt-decode";
+import { URLSearchParams } from "url";
+import { OrganizationsApi } from "../../client/api";
+import { Configuration } from "../../client/configuration";
 import { ClientConfiguration } from "../../clientconfiguration";
 import {
    auth0ConfigsByEnv,
+   AUTH_CLI_LOOPBACK_REDIRECT_URI,
    Environment,
+   getAuth0OrganizationIdForCliLogin,
    LOGIN_TIMEOUT_MS,
 } from "../../constants";
 import { logger } from "../../logger";
-import { prettifyJson, printOutError, sleep } from "../../utils";
+import { printOutError, sleep } from "../../utils";
+import * as loopbackOAuth from "./loopbackOAuth";
 
-export async function login(organizationName: string, configPath?: string) {
+const organizationsApi = new OrganizationsApi(new Configuration());
+
+export async function login(
+   organizationName: string,
+   controlPlaneBaseURL?: string,
+   configPath?: string,
+) {
    const config = new ClientConfiguration(configPath);
    const environment = config.getEnvironment();
 
    if (environment === "e2e-test") {
       return loginM2M(organizationName, config);
-   } else {
-      return loginWithDeviceCode(environment, organizationName, config);
+   }
+
+   const auth0OrganizationId =
+      getAuth0OrganizationIdForCliLogin(organizationName);
+   if (auth0OrganizationId) {
+      return loginWithAuthCodePkceOrganization(
+         environment,
+         organizationName,
+         controlPlaneBaseURL,
+         config,
+         auth0OrganizationId,
+      );
+   }
+
+   return loginWithDeviceCode(
+      environment,
+      organizationName,
+      controlPlaneBaseURL,
+      config,
+   );
+}
+
+async function persistTokensAndVerifyOrganization(
+   tokenPayload: {
+      id_token?: string;
+      access_token: string;
+      refresh_token?: string;
+   },
+   organizationName: string,
+   controlPlaneBaseURL: string,
+   config: ClientConfiguration,
+): Promise<void> {
+   if (tokenPayload.id_token) {
+      const decoded = jwtDecode(tokenPayload.id_token);
+      if (
+         typeof decoded === "object" &&
+         decoded !== null &&
+         "email" in decoded &&
+         "name" in decoded
+      ) {
+         const user = decoded as { email?: string; name?: string };
+         config.setVSCodeUser(user.name, user.email);
+      }
+   }
+
+   config.setAccessToken(true, tokenPayload.access_token);
+   config.setJwtAccessToken(tokenPayload.access_token);
+   if (tokenPayload.refresh_token) {
+      config.setRefreshToken(tokenPayload.refresh_token);
+   }
+
+   try {
+      const response = await organizationsApi.getOrganization(
+         organizationName,
+         {
+            baseURL: controlPlaneBaseURL,
+            headers: config.getHeaders(),
+         },
+      );
+
+      if (response.status === 200) {
+         if (organizationName !== config.getOrganization()) {
+            config.setOrganization(organizationName);
+            config.setProject(undefined);
+         }
+         logger.info("Login successful");
+      }
+   } catch (error) {
+      if (!controlPlaneBaseURL.startsWith("https://")) {
+         const errorMsg =
+            error instanceof Error ? error.message : String(error);
+         logger.warn(
+            "Error with organziation check- might be bootstrapping. Ignoring: " +
+               errorMsg,
+         );
+         config.setOrganization(organizationName);
+         config.setProject(undefined);
+         return;
+      }
+
+      if (isAxiosError(error)) {
+         if (error.response?.status === 403 || error.response?.status === 404) {
+            logger.error(
+               `The organization "${organizationName}" does not exist, or you do not have permission to access it.`,
+            );
+            process.exit(1);
+         }
+      }
+      throw error;
+   }
+}
+
+async function loginWithAuthCodePkceOrganization(
+   environment: Environment,
+   organizationName: string,
+   controlPlaneBaseURL: string,
+   config: ClientConfiguration,
+   auth0OrganizationId: string,
+): Promise<void> {
+   const auth0Domain = auth0ConfigsByEnv[environment].domain;
+   const auth0ClientId = auth0ConfigsByEnv[environment].clientId;
+   const audience = auth0ConfigsByEnv[environment].audience;
+
+   const { codeVerifier, codeChallenge } = loopbackOAuth.generatePkcePair();
+   const state = loopbackOAuth.generateOAuthState();
+
+   const authorizeParams = new URLSearchParams({
+      response_type: "code",
+      client_id: auth0ClientId,
+      redirect_uri: AUTH_CLI_LOOPBACK_REDIRECT_URI,
+      scope: "openid profile email offline_access",
+      audience,
+      organization: auth0OrganizationId,
+      code_challenge: codeChallenge,
+      code_challenge_method: "S256",
+      state,
+   });
+   const authorizeUrl = `${auth0Domain}/authorize?${authorizeParams.toString()}`;
+
+   try {
+      const { code } = await loopbackOAuth.authorizationCodeViaLoopback({
+         redirectUri: AUTH_CLI_LOOPBACK_REDIRECT_URI,
+         expectedState: state,
+         authorizeUrl,
+         timeoutMs: LOGIN_TIMEOUT_MS,
+         onListening: () => {
+            logger.info(
+               `Please visit the following URL to login ${authorizeUrl}`,
+            );
+            logger.info("Waiting for login...");
+         },
+      });
+
+      const tokenResponse = await axios.request({
+         method: "POST",
+         url: `${auth0Domain}/oauth/token`,
+         headers: { "content-type": "application/x-www-form-urlencoded" },
+         data: new URLSearchParams({
+            grant_type: "authorization_code",
+            client_id: auth0ClientId,
+            code,
+            redirect_uri: AUTH_CLI_LOOPBACK_REDIRECT_URI,
+            code_verifier: codeVerifier,
+         }),
+      });
+
+      await persistTokensAndVerifyOrganization(
+         tokenResponse.data,
+         organizationName,
+         controlPlaneBaseURL,
+         config,
+      );
+   } catch (e) {
+      if (isAxiosError(e)) {
+         const d = e.response?.data;
+         if (
+            typeof d === "object" &&
+            d !== null &&
+            "error" in d &&
+            d.error === "redirect_uri_mismatch"
+         ) {
+            logger.error(
+               `Auth0 rejected the CLI callback URL. Add ${AUTH_CLI_LOOPBACK_REDIRECT_URI} to this application's Allowed Callback URLs in Auth0.`,
+            );
+         }
+         printOutError(e, false);
+      } else {
+         const msg = e instanceof Error ? e.message : String(e);
+         logger.error(msg);
+      }
+      process.exit(1);
    }
 }
 
 async function loginWithDeviceCode(
    environment: Environment,
    organizationName: string,
+   controlPlaneBaseURL: string,
    config: ClientConfiguration,
 ) {
    const auth0Domain = auth0ConfigsByEnv[environment].domain;
@@ -65,33 +247,34 @@ async function loginWithDeviceCode(
                client_id: auth0ClientId,
             }),
          });
-         const decoded = jwtDecode(accessToken.data.id_token);
-         if (
-            typeof decoded === "object" &&
-            decoded !== null &&
-            "email" in decoded &&
-            "name" in decoded
-         ) {
-            const user = decoded as { email?: string; name?: string };
-            config.setVSCodeUser(user.name, user.email);
-         }
-
-         config.setAccessToken(true, accessToken.data.access_token);
-         config.setJwtAccessToken(accessToken.data.access_token);
-         config.setRefreshToken(accessToken.data.refresh_token);
-         if (organizationName !== config.getOrganization()) {
-            config.setOrganization(organizationName);
-            config.setProject(undefined);
-         }
-
-         logger.info("Login successful");
+         await persistTokensAndVerifyOrganization(
+            accessToken.data,
+            organizationName,
+            controlPlaneBaseURL,
+            config,
+         );
          break;
       } catch (error) {
          if (
             isAxiosError(error) &&
             error.response?.data?.error !== "authorization_pending"
          ) {
-            logger.error(prettifyJson(error.response?.data));
+            const errorData = error.response?.data;
+            if (errorData) {
+               if (typeof errorData === "string") {
+                  logger.error(errorData);
+               } else if (errorData.error_description) {
+                  logger.error(errorData.error_description);
+               } else if (errorData.error) {
+                  logger.error(errorData.error);
+               } else {
+                  logger.error(JSON.stringify(errorData));
+               }
+            } else {
+               const errorMsg =
+                  error instanceof Error ? error.message : String(error);
+               logger.error(errorMsg || "Unknown error occurred");
+            }
          }
          if (Date.now() - startTime > LOGIN_TIMEOUT_MS) {
             logger.info("Login timed out after 5 minutes");

package/src/commands/misc/logout.spec.ts

@@ -0,0 +1,32 @@
+import { expect } from "chai";
+import sinon from "sinon";
+import { ClientConfiguration } from "../../clientconfiguration";
+import { logger } from "../../logger";
+import { logout } from "./logout";
+
+describe("logout", () => {
+   let sandbox: sinon.SinonSandbox;
+   let destroyConfigStub: sinon.SinonStub;
+   let loggerStub: sinon.SinonStubbedInstance<typeof logger>;
+
+   beforeEach(() => {
+      sandbox = sinon.createSandbox();
+      loggerStub = sandbox.stub(logger);
+      destroyConfigStub = sandbox.stub(
+         ClientConfiguration.prototype,
+         "destroyConfig",
+      );
+   });
+
+   afterEach(() => {
+      sandbox.restore();
+   });
+
+   it("should destroy config and log success message", () => {
+      logout();
+
+      expect(destroyConfigStub.calledOnce).to.be.true;
+      expect(loggerStub.info.calledWith(sinon.match("Credentials reset"))).to.be
+         .true;
+   });
+});

package/src/commands/misc/loopbackOAuth.ts

@@ -0,0 +1,127 @@
+import { createHash, randomBytes } from "crypto";
+import http from "http";
+import { URL } from "url";
+
+export function generatePkcePair(): {
+   codeVerifier: string;
+   codeChallenge: string;
+} {
+   const codeVerifier = randomBytes(32).toString("base64url");
+   const codeChallenge = createHash("sha256")
+      .update(codeVerifier)
+      .digest("base64url");
+   return { codeVerifier, codeChallenge };
+}
+
+export function generateOAuthState(): string {
+   return randomBytes(24).toString("base64url");
+}
+
+/**
+ * Listens on loopback `redirectUri` for the OAuth redirect, then exchanges are done by the caller.
+ * Caller should print `authorizeUrl` as plain text (e.g. in {@link onListening}) — no browser auto-open.
+ * Used when the CLI must send `organization` on `/authorize` (Auth0 Organizations); the documented
+ * device-code endpoint does not list an `organization` parameter
+ * (https://auth0.com/docs/get-started/authentication-and-authorization-flow/device-authorization-flow/call-your-api-using-the-device-authorization-flow#device-code-parameters).
+ */
+export async function authorizationCodeViaLoopback(options: {
+   redirectUri: string;
+   expectedState: string;
+   authorizeUrl: string;
+   timeoutMs: number;
+   /** Invoked once the loopback server is ready (safe to tell the user to open the URL). */
+   onListening?: () => void;
+}): Promise<{ code: string }> {
+   const {
+      redirectUri,
+      expectedState,
+      authorizeUrl: _authorizeUrl,
+      timeoutMs,
+      onListening,
+   } = options;
+   const parsed = new URL(redirectUri);
+   const port = Number(parsed.port);
+   const pathname = parsed.pathname;
+
+   if (!Number.isFinite(port) || port <= 0) {
+      throw new Error(
+         `Invalid redirect URI (need explicit port): ${redirectUri}`,
+      );
+   }
+
+   return new Promise((resolve, reject) => {
+      let settled = false;
+      // eslint-disable-next-line prefer-const -- assign after finish/timer (handler may run before `const` bindings exist)
+      let server: http.Server | undefined;
+
+      const finish = (err: Error | null, result?: { code: string }) => {
+         if (settled) {
+            return;
+         }
+         settled = true;
+         clearTimeout(timer);
+         server?.close();
+         if (err) {
+            reject(err);
+         } else {
+            resolve(result!);
+         }
+      };
+
+      const timer = setTimeout(() => {
+         finish(
+            new Error(
+               `Login timed out after ${Math.round(timeoutMs / 1000)} seconds`,
+            ),
+         );
+      }, timeoutMs);
+
+      server = http.createServer((req, res) => {
+         if (settled || !req.url) {
+            return;
+         }
+         try {
+            const reqUrl = new URL(req.url, `http://127.0.0.1:${port}`);
+            if (reqUrl.pathname !== pathname) {
+               res.writeHead(404);
+               res.end();
+               return;
+            }
+            const code = reqUrl.searchParams.get("code");
+            const state = reqUrl.searchParams.get("state");
+            const error = reqUrl.searchParams.get("error");
+
+            res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+            res.end(
+               "<!DOCTYPE html><html><body><p>You can close this tab and return to the terminal.</p></body></html>",
+            );
+
+            if (error) {
+               finish(
+                  new Error(
+                     reqUrl.searchParams.get("error_description") || error,
+                  ),
+               );
+               return;
+            }
+            if (!code || state !== expectedState) {
+               finish(new Error("Invalid authorization response"));
+               return;
+            }
+            finish(null, { code });
+         } catch (e) {
+            finish(e instanceof Error ? e : new Error(String(e)));
+         }
+      });
+
+      server.on("error", (err) => finish(err));
+
+      server.listen(port, "127.0.0.1", () => {
+         try {
+            onListening?.();
+         } catch (e) {
+            finish(e instanceof Error ? e : new Error(String(e)));
+         }
+      });
+   });
+}

package/src/commands/misc/set-access-token.spec.ts

@@ -0,0 +1,95 @@
+import { expect } from "chai";
+import sinon from "sinon";
+import { ClientConfiguration } from "../../clientconfiguration";
+import { logger } from "../../logger";
+import { setAccessToken } from "./set-access-token";
+
+describe("set-access-token", () => {
+   let sandbox: sinon.SinonSandbox;
+   let setAccessTokenStub: sinon.SinonStub;
+   let setJwtAccessTokenStub: sinon.SinonStub;
+   let setOrganizationStub: sinon.SinonStub;
+   let loggerStub: sinon.SinonStubbedInstance<typeof logger>;
+
+   beforeEach(() => {
+      sandbox = sinon.createSandbox();
+      loggerStub = sandbox.stub(logger);
+      setAccessTokenStub = sandbox.stub(
+         ClientConfiguration.prototype,
+         "setAccessToken",
+      );
+      setJwtAccessTokenStub = sandbox.stub(
+         ClientConfiguration.prototype,
+         "setJwtAccessToken",
+      );
+      setOrganizationStub = sandbox.stub(
+         ClientConfiguration.prototype,
+         "setOrganization",
+      );
+   });
+
+   afterEach(() => {
+      sandbox.restore();
+   });
+
+   it("should set access token successfully", () => {
+      const jwtToken = "test-jwt-token";
+
+      setAccessToken(jwtToken);
+
+      expect(setAccessTokenStub.calledOnce).to.be.true;
+      expect(setAccessTokenStub.firstCall.args).to.deep.equal([
+         false,
+         jwtToken,
+      ]);
+      expect(setJwtAccessTokenStub.calledOnce).to.be.true;
+      expect(setJwtAccessTokenStub.firstCall.args[0]).to.equal(jwtToken);
+      expect(
+         loggerStub.info.calledWith(
+            sinon.match("Access token set successfully"),
+         ),
+      ).to.be.true;
+   });
+
+   it("should set access token and organization when provided", () => {
+      const jwtToken = "test-jwt-token";
+      const organizationName = "test-org";
+
+      setAccessToken(jwtToken, organizationName);
+
+      expect(setAccessTokenStub.calledOnce).to.be.true;
+      expect(setJwtAccessTokenStub.calledOnce).to.be.true;
+      expect(setOrganizationStub.calledOnce).to.be.true;
+      expect(setOrganizationStub.firstCall.args[0]).to.equal(organizationName);
+      expect(
+         loggerStub.info.calledWith(
+            sinon.match("Access token set successfully"),
+         ),
+      ).to.be.true;
+      expect(
+         loggerStub.info.calledWith(
+            sinon.match(`Organization set to: ${organizationName}`),
+         ),
+      ).to.be.true;
+   });
+
+   it("should not set organization when not provided", () => {
+      const jwtToken = "test-jwt-token";
+
+      setAccessToken(jwtToken);
+
+      expect(setOrganizationStub.called).to.be.false;
+      expect(loggerStub.info.calledWith(sinon.match(/Organization set to:/))).to
+         .be.false;
+   });
+
+   it("should handle custom config path", () => {
+      const jwtToken = "test-jwt-token";
+      const configPath = "/custom/path/config.json";
+
+      setAccessToken(jwtToken, undefined, configPath);
+
+      expect(setAccessTokenStub.calledOnce).to.be.true;
+      expect(setJwtAccessTokenStub.calledOnce).to.be.true;
+   });
+});

package/src/commands/misc/set-access-token.ts

@@ -3,30 +3,30 @@ import { logger } from "../../logger";
 
 /**
  * Sets a service account JWT token for CLI authentication.
- * 
+ *
  * @param jwtToken The JWT token to use for authentication
  * @param organizationName Optional organization name to set
  * @param configPath Optional custom config path
  */
 export function setAccessToken(
-    jwtToken: string,
-    organizationName?: string,
-    configPath?: string
+   jwtToken: string,
+   organizationName?: string,
+   configPath?: string,
 ) {
-    const config = new ClientConfiguration(configPath);
+   const config = new ClientConfiguration(configPath);
 
-    // Set the JWT token as both access token and JWT access token
-    config.setAccessToken(false, jwtToken);
-    config.setJwtAccessToken(jwtToken);
+   // Set the JWT token as both access token and JWT access token
+   config.setAccessToken(false, jwtToken);
+   config.setJwtAccessToken(jwtToken);
 
-    // Set organization if provided
-    if (organizationName) {
-        config.setOrganization(organizationName);
-    }
+   // Set organization if provided
+   if (organizationName) {
+      config.setOrganization(organizationName);
+   }
 
-    logger.info("Access token set successfully");
+   logger.info("Access token set successfully");
 
-    if (organizationName) {
-        logger.info(`Organization set to: ${organizationName}`);
-    }
+   if (organizationName) {
+      logger.info(`Organization set to: ${organizationName}`);
+   }
 }