@cwe-platform/plugin-cli 0.1.0 → 0.1.1

package/README.md

@@ -4,25 +4,32 @@ The CWE plugin developer loop. Thin by design: `build` runs your plugin's own ts
 `validate` talk to a dev runtime's harness endpoints.
 
 ```bash
+npx @cwe-platform/plugin-cli login      # staff login → saves devToken into cwe-plugin.json
 npx @cwe-platform/plugin-cli build      # tsup + local validateManifest (doctor-lite)
 npx @cwe-platform/plugin-cli push       # build once + sideload to the dev runtime
 npx @cwe-platform/plugin-cli dev        # watch src/ → rebuild → hot-reload sideload
 npx @cwe-platform/plugin-cli validate   # full plugin doctor on the runtime
 ```
 
-Config — `cwe-plugin.json` in your plugin repo:
+Config — `cwe-plugin.json` in your plugin repo (`login` fills in `devToken` for you):
 
 ```json
 {
   "runtimeUrl": "http://localhost:3000",
   "pluginKey": "player-favorites",
-  "devToken": "<staff bearer token>",
   "bundle": "dist/index.js"
 }
 ```
 
+## Auth
+
+`devToken` is a staff access token holding the `plugin:manage` permission. `cwe-plugin login`
+prompts for staff credentials, calls `POST /staff/auth/login` on the runtime and stores the
+token. Tokens are short-lived (default 15 min); for long `dev` sessions export
+`CWE_STAFF_EMAIL` / `CWE_STAFF_PASSWORD` and the watcher re-logs-in automatically on 401.
+
 The sideload endpoint (`PUT /dev/plugins/:key/bundle`) exists only on runtimes with the dev
-harness enabled (`docker compose -f docker-compose.plugindev.yml up` in the platform repo);
-production runtimes reject the harness at config time, so the endpoint 404s there.
+harness enabled; production runtimes reject the harness at config time, so the endpoint 404s
+there. Ask your CWE platform contact for a dev runtime.
 
 MIT © CasinoWebEngine

package/bin/cwe-plugin.mjs

@@ -9,13 +9,63 @@
  * Config: cwe-plugin.json (runtimeUrl, pluginKey, devToken, bundle?).
  */
 import { watch } from "node:fs";
+import { createInterface } from "node:readline";
 import { pathToFileURL } from "node:url";
 import { resolve } from "node:path";
 import { Command } from "commander";
-import { fetchTrace, loadConfig, runBuild, sideload, validateOnRuntime } from "../src/lib.mjs";
+import {
+  fetchTrace,
+  loadConfig,
+  reloginFromEnv,
+  runBuild,
+  saveDevToken,
+  sideload,
+  staffLogin,
+  validateOnRuntime,
+} from "../src/lib.mjs";
 
 const program = new Command();
-program.name("cwe-plugin").description("CasinoWebEngine plugin developer CLI").version("0.1.0");
+program.name("cwe-plugin").description("CasinoWebEngine plugin developer CLI").version("0.1.1");
+
+/** Interactive prompt; `hidden` masks the input (password entry). */
+function prompt(question, { hidden = false } = {}) {
+  return new Promise((resolvePrompt) => {
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    if (hidden) {
+      // Mask by rewriting the line with asterisks on every keypress echo.
+      const write = rl._writeToOutput.bind(rl);
+      rl._writeToOutput = (str) => {
+        if (str.includes(question)) write(str);
+        else write("*");
+      };
+    }
+    rl.question(question, (answer) => {
+      rl.close();
+      if (hidden) process.stdout.write("\n");
+      resolvePrompt(answer.trim());
+    });
+  });
+}
+
+program
+  .command("login")
+  .description("staff login against the dev runtime; saves devToken into cwe-plugin.json")
+  .option("--email <email>", "staff email (prompted if omitted)")
+  .option("--password <password>", "staff password (prompted if omitted — prefer the prompt: flags land in shell history)")
+  .action(async (opts) => {
+    const config = await loadConfig();
+    const email = opts.email ?? (await prompt("staff email: "));
+    const password = opts.password ?? (await prompt("staff password: ", { hidden: true }));
+    const token = await staffLogin(config.runtimeUrl, email, password);
+    const path = await saveDevToken(token);
+    console.log(`  ✓ logged in — devToken saved to ${path}`);
+    console.log(
+      "  ℹ staff tokens are short-lived (default 15 min). For long `dev` sessions, export",
+    );
+    console.log(
+      "    CWE_STAFF_EMAIL / CWE_STAFF_PASSWORD and the watcher re-logs-in on 401 automatically.",
+    );
+  });
 
 async function validateLocal() {
   // Import the built bundle + the SDK's doctor-lite from the PLUGIN's own
@@ -58,13 +108,31 @@ program
     console.log(`\n${report.plugin}@${report.version}: doctor OK`);
   });
 
+/** Sideload with one 401 → env-credential re-login retry. */
+async function sideloadWithRelogin(config) {
+  try {
+    return await sideload(config);
+  } catch (error) {
+    if (error?.unauthorized && (await reloginFromEnv(config))) {
+      console.log("  ↻ devToken expired — re-logged-in from CWE_STAFF_EMAIL/PASSWORD");
+      return sideload(config);
+    }
+    if (error?.unauthorized) {
+      throw new Error(
+        "devToken missing/expired — run `cwe-plugin login` (or export CWE_STAFF_EMAIL/CWE_STAFF_PASSWORD for auto re-login)",
+      );
+    }
+    throw error;
+  }
+}
+
 program
   .command("push")
   .description("build once and sideload to the dev runtime")
   .action(async () => {
     const config = await loadConfig();
     await runBuild();
-    const result = await sideload(config);
+    const result = await sideloadWithRelogin(config);
     console.log(`  ✓ sideloaded ${result.plugin}@${result.version} (dev channel, hot-reloaded)`);
     for (const warning of result.warnings ?? []) console.warn(`  ⚠ ${warning}`);
   });
@@ -86,7 +154,9 @@ program
       const startedAt = Date.now();
       try {
         await runBuild();
-        const result = await sideload(config);
+        // 401s re-login from env credentials and retry once, so the 15-min
+        // token TTL never interrupts a watch session.
+        const result = await sideloadWithRelogin(config);
         console.log(
           `  ✓ ${result.plugin}@${result.version} reloaded in ${Date.now() - startedAt}ms`,
         );

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cwe-platform/plugin-cli",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "CasinoWebEngine plugin developer CLI — build, validate and hot-reload plugins against a dev runtime.",
   "license": "MIT",
   "private": false,

package/src/lib.mjs

@@ -4,10 +4,12 @@
  * Plain ESM JS — the CLI ships source, no build step of its own.
  */
 import { createHash } from "node:crypto";
-import { readFile } from "node:fs/promises";
+import { readFile, writeFile } from "node:fs/promises";
 import { spawn } from "node:child_process";
 import { join, resolve } from "node:path";
 
+export const STAFF_ACCESS_COOKIE = "cwe_staff_access_token";
+
 /** cwe-plugin.json: { runtimeUrl, devToken, pluginKey, bundle? } */
 export async function loadConfig(cwd = process.cwd()) {
   const path = join(cwd, "cwe-plugin.json");
@@ -60,11 +62,76 @@ async function api(config, method, path, body) {
   }
   if (!response.ok) {
     const message = json?.error?.message ?? json?.message ?? text.slice(0, 300);
-    throw new Error(`${method} ${path} → HTTP ${response.status}: ${message}`);
+    const error = new Error(`${method} ${path} → HTTP ${response.status}: ${message}`);
+    // Marker for callers: 401 = missing/expired devToken → try a re-login.
+    error.unauthorized = response.status === 401;
+    throw error;
   }
   return json;
 }
 
+/**
+ * Staff login → staff access token. The API deliberately never returns the
+ * JWT in the response body — it arrives as the HttpOnly staff cookie — so
+ * this parses it out of Set-Cookie. Tokens are tenant-bound and short-lived
+ * (AUTH_ACCESS_TOKEN_TTL_SECONDS, default 15 min).
+ */
+export async function staffLogin(runtimeUrl, email, password) {
+  const response = await fetch(`${runtimeUrl.replace(/\/$/, "")}/staff/auth/login`, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ email, password }),
+  });
+  if (!response.ok) {
+    let message = `HTTP ${response.status}`;
+    try {
+      const json = await response.json();
+      message = json?.error?.message ?? json?.message ?? message;
+    } catch {
+      // keep the status-only message
+    }
+    throw new Error(`staff login failed: ${message}`);
+  }
+  const cookies = response.headers.getSetCookie?.() ?? [];
+  const tokenCookie = cookies.find((c) => c.startsWith(`${STAFF_ACCESS_COOKIE}=`));
+  if (!tokenCookie) {
+    throw new Error("login succeeded but the staff access token cookie was not returned");
+  }
+  const token = tokenCookie.split(";")[0].slice(STAFF_ACCESS_COOKIE.length + 1);
+  if (!token) throw new Error("staff access token cookie was empty");
+  return token;
+}
+
+/** Persist the devToken into cwe-plugin.json (preserving other fields). */
+export async function saveDevToken(token, cwd = process.cwd()) {
+  const path = join(cwd, "cwe-plugin.json");
+  let config = {};
+  try {
+    config = JSON.parse(await readFile(path, "utf8"));
+  } catch {
+    throw new Error(`Missing cwe-plugin.json in ${cwd} — create it first (see README)`);
+  }
+  config.devToken = token;
+  await writeFile(path, `${JSON.stringify(config, null, 2)}\n`, "utf8");
+  return path;
+}
+
+/**
+ * Re-login with credentials from CWE_STAFF_EMAIL / CWE_STAFF_PASSWORD env
+ * vars (for unattended `dev` sessions — the 15-min token TTL otherwise
+ * interrupts the loop). Returns the fresh token, or null when the env vars
+ * are not both set.
+ */
+export async function reloginFromEnv(config, env = process.env) {
+  const email = env.CWE_STAFF_EMAIL;
+  const password = env.CWE_STAFF_PASSWORD;
+  if (!email || !password) return null;
+  const token = await staffLogin(config.runtimeUrl, email, password);
+  await saveDevToken(token);
+  config.devToken = token;
+  return token;
+}
+
 /** Upload the built bundle to the dev runtime (checksum-verified sideload). */
 export async function sideload(config, cwd = process.cwd()) {
   const bundlePath = resolve(cwd, config.bundle);