@danypops/tickets 0.4.0 → 0.4.1

package/README.md

@@ -171,6 +171,22 @@ tickets auth status
 tickets auth logout github
 ```
 
+### Static token instead (API key/PAT, no OAuth)
+
+For a backend with no OAuth app to register against (e.g. a plain Atlassian
+API token from `id.atlassian.com/manage-profile/security/api-tokens`),
+store it directly -- same 0600 local file `auth login` writes to, checked
+ahead of any `token`/`token_env` config-file or plain env-var fallback:
+
+```bash
+tickets auth set-token jira
+# Paste the "jira" token (input hidden): ****
+
+# or non-interactively, e.g. from a password manager (piped stdin works too,
+# since a non-TTY stdin is read as-is with nothing to mask):
+pass show jira-api-token | tickets auth set-token jira
+```
+
 ### GitHub: reuse an already-authenticated `gh` CLI session
 
 `tickets auth login --backend github --gh-cli [account]` skips the device

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@danypops/tickets",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "description": "Unified CLI, daemon, and TypeScript library for issue tracking across GitHub, GitLab, and Jira.",
   "type": "module",
   "license": "MIT",

package/src/auth/masked-prompt.ts

@@ -0,0 +1,54 @@
+/**
+ * Reads a secret from a real TTY with keystrokes masked -- never echoed to
+ * the terminal, so it can't land in scrollback or a screen share the way a
+ * typed-and-visible value would. Falls back to reading one line from stdin
+ * unmasked when stdin isn't a TTY (piped input, e.g. `pass show jira |
+ * tickets auth set-token jira`) -- there is nothing to mask once the value
+ * never touched an interactive terminal in the first place.
+ */
+import { createInterface } from "node:readline";
+
+export function promptMaskedSecret(
+  promptText: string,
+  input: NodeJS.ReadableStream = process.stdin,
+  output: NodeJS.WritableStream = process.stdout,
+): Promise<string> {
+  const isTTY = (input as NodeJS.ReadStream).isTTY === true;
+
+  if (!isTTY) {
+    return new Promise((resolve, reject) => {
+      let data = "";
+      input.setEncoding?.("utf8");
+      input.on("data", (chunk) => {
+        data += chunk;
+      });
+      input.on("end", () => resolve(data.split("\n")[0]?.trim() ?? ""));
+      input.on("error", reject);
+    });
+  }
+
+  return new Promise((resolve, reject) => {
+    const rl = createInterface({ input, output, terminal: true });
+    // readline has no public masking option; overriding the internal
+    // _writeToOutput hook (long-standing, widely-used pattern for exactly
+    // this) is the only way to suppress echoed keystrokes while still
+    // letting the prompt text itself render once.
+    // biome-ignore lint/suspicious/noExplicitAny: readline's internal _writeToOutput has no public type
+    const rlInternal = rl as any;
+    const originalWriteToOutput = rlInternal._writeToOutput.bind(rl);
+    let promptShown = false;
+    rlInternal._writeToOutput = (stringToWrite: string) => {
+      if (!promptShown) {
+        originalWriteToOutput(stringToWrite);
+        if (stringToWrite.includes(promptText)) promptShown = true;
+      }
+      // Every keystroke after the prompt itself is swallowed -- masked.
+    };
+    rl.question(promptText, (answer) => {
+      rl.close();
+      output.write("\n");
+      resolve(answer.trim());
+    });
+    rl.on("error", reject);
+  });
+}

package/src/cli/index.ts

@@ -15,6 +15,7 @@ import { readGhCliToken } from "../auth/gh-cli.js";
 import { gitlabDeviceEndpoints, loginWithGitLabDeviceFlow } from "../auth/gitlab-oauth.js";
 import { loginWithJiraAuthorizationCode } from "../auth/jira-oauth.js";
 import { deleteToken, isTokenFresh, listStoredBackends, loadToken, saveToken } from "../auth/token-store.js";
+import { promptMaskedSecret } from "../auth/masked-prompt.js";
 import { installTicketsService, systemctlTickets, systemdUnitPath } from "./systemd-service.js";
 
 function printJson(value: unknown): void {
@@ -422,6 +423,23 @@ auth
     }
   });
 
+auth
+  .command("set-token <backend>")
+  .description("store a plain static token (API key/PAT, no OAuth) for a backend -- e.g. an Atlassian API token for jira")
+  .action(async (backend: string) => {
+    // TICKETS_TOKEN_VALUE remains for non-interactive/scripted use (a provisioning
+    // script, `pass show jira | tickets auth set-token jira`) -- never accepted as a
+    // plain CLI argument, which would land in shell history the way this would not.
+    const value = process.env.TICKETS_TOKEN_VALUE ?? (await promptMaskedSecret(`Paste the "${backend}" token (input hidden): `));
+    if (!value) {
+      process.stderr.write("no token value provided — paste one at the prompt, or set TICKETS_TOKEN_VALUE for non-interactive use\n");
+      process.exitCode = 1;
+      return;
+    }
+    saveToken(backend, { accessToken: value });
+    printJson({ backend, status: "stored", note: "restart the tickets daemon (or run `tickets daemon-status` after a fresh start) to pick up the new token" });
+  });
+
 auth
   .command("status")
   .description("list backends with a locally stored delegated token")