@ctrl-spc/cli 1.1.14 → 1.2.0

package/dist/commands/login.js

@@ -0,0 +1,332 @@
+import { createServer } from 'node:http';
+import { spawn } from 'node:child_process';
+import { randomBytes, timingSafeEqual } from 'node:crypto';
+import { SUPABASE_URL, SUPABASE_KEY } from '../env.js';
+import { writeSession } from '../config.js';
+import { getClient } from '../supabase.js';
+const LOGIN_TIMEOUT_MS = 5 * 60 * 1000;
+/** POST /callback bodies larger than this are rejected before JSON parsing. */
+const MAX_CALLBACK_BODY_BYTES = 64 * 1024;
+/**
+ * Browser device-flow login (spec §4): starts a localhost callback server,
+ * opens the sign-in page in the user's browser, and waits for the page to
+ * POST back the tokens it obtained from Supabase Auth.
+ */
+export async function login() {
+    const outcome = await runLoginServer();
+    if (outcome.ok) {
+        console.log(`Signed in as ${outcome.email}`);
+        process.exitCode = 0;
+    }
+    else {
+        console.error(outcome.message);
+        process.exitCode = 1;
+    }
+}
+function runLoginServer() {
+    return new Promise((resolve) => {
+        let settled = false;
+        // Anti-fixation nonce (spec §4): the served page must echo this back on
+        // POST /callback. Without it, any cross-origin request that guesses the
+        // ephemeral port during the 5-minute login window could inject its own
+        // tokens (session fixation) — the state ties the callback to the exact
+        // page this server rendered.
+        const state = randomBytes(32).toString('hex');
+        const server = createServer((req, res) => {
+            void handleRequest(req, res, state, finish);
+        });
+        const timeout = setTimeout(() => {
+            finish({ ok: false, message: 'Login timed out after 5 minutes. Run `ctrl-spc login` again.' });
+        }, LOGIN_TIMEOUT_MS);
+        function finish(outcome) {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timeout);
+            server.close();
+            resolve(outcome);
+        }
+        server.on('error', (err) => {
+            finish({ ok: false, message: `Local login server failed: ${err.message}` });
+        });
+        server.listen(0, '127.0.0.1', () => {
+            const address = server.address();
+            if (!address) {
+                finish({ ok: false, message: 'Failed to start local login server.' });
+                return;
+            }
+            const url = `http://localhost:${address.port}/`;
+            console.log(`Opening browser to sign in — if it doesn't open automatically, visit ${url}`);
+            openBrowser(url);
+        });
+    });
+}
+async function handleRequest(req, res, state, finish) {
+    const path = (req.url ?? '/').split('?')[0];
+    if (req.method === 'GET' && path === '/') {
+        res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+        res.end(renderLoginPage(SUPABASE_URL, SUPABASE_KEY, state));
+        return;
+    }
+    if (req.method === 'POST' && path === '/callback') {
+        await handleCallback(req, res, state, finish);
+        return;
+    }
+    res.writeHead(404, { 'Content-Type': 'text/plain' });
+    res.end('Not found');
+}
+async function handleCallback(req, res, state, finish) {
+    let body;
+    try {
+        body = JSON.parse(await readBody(req));
+    }
+    catch (err) {
+        if (err instanceof PayloadTooLargeError) {
+            res.writeHead(413, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ ok: false, error: 'Request body too large' }));
+            // Flush the response before tearing down the connection so the
+            // client actually observes the 413 instead of a reset socket.
+            res.on('finish', () => req.destroy());
+            return;
+        }
+        res.writeHead(400, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ ok: false, error: 'Invalid JSON body' }));
+        return;
+    }
+    const { access_token, refresh_token, state: providedState } = (body ?? {});
+    if (typeof access_token !== 'string' ||
+        typeof refresh_token !== 'string' ||
+        typeof providedState !== 'string') {
+        res.writeHead(400, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ ok: false, error: 'Missing access_token/refresh_token/state' }));
+        return;
+    }
+    // Reject unless the page echoes back the exact nonce this server minted
+    // (see the `state` comment in runLoginServer). Constant-time compare so a
+    // timing side-channel can't be used to guess the state byte-by-byte.
+    if (!constantTimeEqual(providedState, state)) {
+        res.writeHead(400, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ ok: false, error: 'Invalid or missing state' }));
+        return;
+    }
+    // Write unconditionally: this is the CLI's durable record of the tokens
+    // the browser obtained, even if the verification step below fails. Only
+    // reached once the state check above has proven this callback came from
+    // the page we served, not an arbitrary cross-origin request.
+    writeSession({ access_token, refresh_token });
+    try {
+        const client = await getClient();
+        const { data, error } = await client.auth.getUser();
+        if (error || !data.user?.email) {
+            throw new Error(error?.message ?? 'No user returned for this session.');
+        }
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ ok: true }));
+        finish({ ok: true, email: data.user.email });
+    }
+    catch (err) {
+        const message = `Signed-in session could not be verified: ${err.message}`;
+        res.writeHead(500, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ ok: false, error: message }));
+        finish({ ok: false, message });
+    }
+}
+/** Thrown by {@link readBody} when the request exceeds {@link MAX_CALLBACK_BODY_BYTES}. */
+class PayloadTooLargeError extends Error {
+}
+function readBody(req) {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        let size = 0;
+        req.on('data', (chunk) => {
+            size += chunk.length;
+            if (size > MAX_CALLBACK_BODY_BYTES) {
+                req.pause();
+                reject(new PayloadTooLargeError());
+                return;
+            }
+            chunks.push(chunk);
+        });
+        req.on('end', () => resolve(Buffer.concat(chunks).toString('utf8')));
+        req.on('error', reject);
+    });
+}
+/** Constant-time comparison for the login `state` nonce (equal-length only; length mismatch is a reject, not a throw). */
+function constantTimeEqual(a, b) {
+    const bufA = Buffer.from(a, 'utf8');
+    const bufB = Buffer.from(b, 'utf8');
+    if (bufA.length !== bufB.length)
+        return false;
+    return timingSafeEqual(bufA, bufB);
+}
+function openBrowser(url) {
+    const platform = process.platform;
+    const [command, args] = platform === 'darwin'
+        ? ['open', [url]]
+        : platform === 'win32'
+            ? ['cmd', ['/c', 'start', '""', url]]
+            : ['xdg-open', [url]];
+    try {
+        const child = spawn(command, args, { stdio: 'ignore', detached: true });
+        // A missing opener binary (e.g. no `xdg-open` on a headless box) surfaces
+        // as an async 'error' event, not a thrown exception — an unhandled one
+        // would crash the process. The URL is already printed above, so this is
+        // non-fatal either way.
+        child.on('error', () => { });
+        child.unref();
+    }
+    catch {
+        // Non-fatal: the URL was already printed to the console above.
+    }
+}
+function renderLoginPage(url, key, state) {
+    return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8" />
+<meta name="viewport" content="width=device-width, initial-scale=1" />
+<title>Sign in — CTRL+SPC</title>
+<style>
+  :root { color-scheme: light dark; }
+  body {
+    font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
+    max-width: 360px;
+    margin: 10vh auto 0;
+    padding: 0 24px;
+    color: #1a1a1a;
+    background: #fff;
+  }
+  h1 { font-size: 20px; margin-bottom: 4px; }
+  p.sub { color: #666; margin-top: 0; font-size: 14px; }
+  .tabs { display: flex; gap: 8px; margin-bottom: 16px; border-bottom: 1px solid #ddd; }
+  .tabs button {
+    background: none; border: none; padding: 8px 4px; font-size: 14px; cursor: pointer;
+    color: #666; border-bottom: 2px solid transparent;
+  }
+  .tabs button.active { color: #111; border-bottom-color: #111; font-weight: 600; }
+  form { display: none; flex-direction: column; gap: 10px; }
+  form.active { display: flex; }
+  label { font-size: 13px; color: #333; display: flex; flex-direction: column; gap: 4px; }
+  input {
+    padding: 8px 10px; font-size: 14px; border: 1px solid #ccc; border-radius: 6px;
+  }
+  button[type=submit] {
+    margin-top: 6px; padding: 9px; font-size: 14px; border: none; border-radius: 6px;
+    background: #111; color: #fff; cursor: pointer;
+  }
+  button[type=submit]:disabled { opacity: 0.6; cursor: default; }
+  .error { color: #c0392b; font-size: 13px; min-height: 16px; }
+  .success { text-align: center; padding-top: 20vh; }
+  @media (prefers-color-scheme: dark) {
+    body { background: #111; color: #eee; }
+    p.sub { color: #999; }
+    .tabs { border-bottom-color: #333; }
+    .tabs button { color: #999; }
+    .tabs button.active { color: #fff; border-bottom-color: #fff; }
+    label { color: #ccc; }
+    input { background: #1c1c1c; border-color: #333; color: #eee; }
+    button[type=submit] { background: #eee; color: #111; }
+  }
+</style>
+</head>
+<body>
+  <div id="app">
+    <h1>CTRL+SPC</h1>
+    <p class="sub">Sign in to link this machine.</p>
+    <div class="tabs">
+      <button type="button" id="tab-signin" class="active">Sign in</button>
+      <button type="button" id="tab-signup">Sign up</button>
+    </div>
+    <form id="form-signin" class="active">
+      <label>Email<input type="email" id="signin-email" required autocomplete="email" /></label>
+      <label>Password<input type="password" id="signin-password" required autocomplete="current-password" /></label>
+      <div class="error" id="signin-error"></div>
+      <button type="submit">Sign in</button>
+    </form>
+    <form id="form-signup">
+      <label>Name<input type="text" id="signup-name" required autocomplete="name" /></label>
+      <label>Email<input type="email" id="signup-email" required autocomplete="email" /></label>
+      <label>Password<input type="password" id="signup-password" required autocomplete="new-password" minlength="6" /></label>
+      <div class="error" id="signup-error"></div>
+      <button type="submit">Sign up</button>
+    </form>
+  </div>
+  <script type="module">
+    import { createClient } from 'https://esm.sh/@supabase/supabase-js@2'
+
+    const supabase = createClient(${JSON.stringify(url)}, ${JSON.stringify(key)})
+    const LOGIN_STATE = ${JSON.stringify(state)}
+
+    const tabSignin = document.getElementById('tab-signin')
+    const tabSignup = document.getElementById('tab-signup')
+    const formSignin = document.getElementById('form-signin')
+    const formSignup = document.getElementById('form-signup')
+
+    tabSignin.addEventListener('click', () => {
+      tabSignin.classList.add('active'); tabSignup.classList.remove('active')
+      formSignin.classList.add('active'); formSignup.classList.remove('active')
+    })
+    tabSignup.addEventListener('click', () => {
+      tabSignup.classList.add('active'); tabSignin.classList.remove('active')
+      formSignup.classList.add('active'); formSignin.classList.remove('active')
+    })
+
+    async function completeLogin(session) {
+      const res = await fetch('/callback', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+          access_token: session.access_token,
+          refresh_token: session.refresh_token,
+          state: LOGIN_STATE,
+        }),
+      })
+      const body = await res.json().catch(() => ({}))
+      if (!res.ok) throw new Error(body.error || 'Local CLI did not accept the session.')
+      document.getElementById('app').innerHTML =
+        '<div class="success"><h1>Signed in — you can close this tab.</h1></div>'
+    }
+
+    formSignin.addEventListener('submit', async (e) => {
+      e.preventDefault()
+      const errorEl = document.getElementById('signin-error')
+      errorEl.textContent = ''
+      const email = document.getElementById('signin-email').value
+      const password = document.getElementById('signin-password').value
+      try {
+        const { data, error } = await supabase.auth.signInWithPassword({ email, password })
+        if (error) throw error
+        await completeLogin(data.session)
+      } catch (err) {
+        errorEl.textContent = err.message || String(err)
+      }
+    })
+
+    formSignup.addEventListener('submit', async (e) => {
+      e.preventDefault()
+      const errorEl = document.getElementById('signup-error')
+      errorEl.textContent = ''
+      const name = document.getElementById('signup-name').value
+      const email = document.getElementById('signup-email').value
+      const password = document.getElementById('signup-password').value
+      try {
+        const { data, error } = await supabase.auth.signUp({
+          email,
+          password,
+          options: { data: { name } },
+        })
+        if (error) throw error
+        if (!data.session) {
+          errorEl.textContent = 'Account created. Check your email to confirm, then sign in.'
+          return
+        }
+        await completeLogin(data.session)
+      } catch (err) {
+        errorEl.textContent = err.message || String(err)
+      }
+    })
+  </script>
+</body>
+</html>
+`;
+}

package/dist/commands/logout.js

@@ -0,0 +1,14 @@
+import { clearSession } from '../config.js';
+/**
+ * `ctrl-spc logout`: deletes the stored session. Local-only — the refresh
+ * token is discarded, not revoked server-side (Supabase revokes it on next
+ * rotation attempt; fine for v1's single-session CLI).
+ */
+export function logout() {
+    if (clearSession()) {
+        console.log('Logged out — stored session removed.');
+    }
+    else {
+        console.log('No stored session — already logged out.');
+    }
+}