@dutodev/cli 1.0.0 → 1.1.0

package/README.md

@@ -124,7 +124,7 @@ People get in one of these ways:
 
 Without credentials, a browser is sent to the sign-in page and other clients get `401`. Your local app never receives Duto's credentials: the `Authorization: Basic` that matched, `X-Duto-Auth` and the tunnel cookie are stripped before the request is forwarded (other cookies pass through). An `Authorization: Bearer` from your own app passes unchanged.
 
-**Logging out and sessions.** In a browser, signing in sets a cookie that is valid for that tunnel only. To log out, open `/__duto/logout`: it clears the cookie and returns to the sign-in page. The cookie lasts until the browser closes or the CLI stops. Restarting the CLI signs everyone out, because the key that signs the cookies is new every session. The cookie only counts on requests to the tunnel itself: a page on another origin (another tunnel, another site) that calls the tunnel has to send `X-Duto-Auth` or `Authorization: Basic`. So opening the tunnel from a link on another `*.duto.dev` address (the dashboard or another tunnel) asks for the password again; a link from outside (email, chat) or a typed URL gets straight in.
+**Signing out and sessions.** In a browser, signing in sets a cookie that is valid for that tunnel only. To sign out, open `/__duto/logout`: it clears the cookie and returns to the sign-in page. The cookie lasts until the browser closes or the CLI stops. Restarting the CLI signs everyone out, because the key that signs the cookies is new every session. The cookie only counts on requests to the tunnel itself: a page on another origin (another tunnel, another site) that calls the tunnel has to send `X-Duto-Auth` or `Authorization: Basic`. So opening the tunnel from a link on another `*.duto.dev` address (the dashboard or another tunnel) asks for the password again; a link from outside (email, chat) or a typed URL gets straight in.
 
 **QR code.** With the full screen open, key `m` shows the QR of the selected tunnel in place of the request list. On a tunnel without a password, the QR points to the tunnel URL. On a tunnel with a password, it points to a link that signs in directly, as the first user in the `auth` list. That link is valid for 5 minutes and for one device only: once opened, or after it expires, it falls back to the sign-in page. On the QR screen, `g` generates a new link (and invalidates the previous one) and `esc` goes back to the list.
 

package/dist/{chunk-BPOXISIM.js → chunk-76YCOMXH.js}

@@ -95,6 +95,7 @@ function localLabel(t) {
 }
 
 export {
+  MAX_NAME,
   normalizeName,
   validateName,
   C,

package/dist/{fullscreen-IWZCH3IP.js → fullscreen-ECEH3R2V.js}

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 import {
   C,
+  MAX_NAME,
   TRUNCATED_NOTE,
   bodyNote,
   fit,
@@ -12,7 +13,7 @@ import {
   statusColor,
   tunnelColor,
   validateName
-} from "./chunk-BPOXISIM.js";
+} from "./chunk-76YCOMXH.js";
 
 // src/ui/fullscreen.tsx
 import { render } from "ink";
@@ -369,7 +370,7 @@ function App({ session, version, system, onExit, inspector = null, inspectorErro
     const name = raw ? normalizeName(raw) : null;
     if (name !== null) {
       const v = validateName(name);
-      if (!v.ok) return setMessage({ text: v.reason === "reserved" ? `Reserved name: "${raw}"` : "Invalid name: use lowercase letters and numbers only (no hyphens)", tone: "err" });
+      if (!v.ok) return setMessage({ text: v.reason === "reserved" ? `"${raw}" is reserved. Pick another name.` : `Invalid name. Use only lowercase letters and digits (no hyphens), up to ${MAX_NAME} characters.`, tone: "err" });
     }
     setMode({ kind: "list" });
     void session.add({ name, port });

package/dist/index.js

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 import {
   C,
+  MAX_NAME,
   TRUNCATED_NOTE,
   bodyNote,
   formatBytes,
@@ -10,7 +11,7 @@ import {
   normalizeName,
   statusColor,
   validateName
-} from "./chunk-BPOXISIM.js";
+} from "./chunk-76YCOMXH.js";
 
 // src/ui/brand.ts
 function colorOn(stream = process.stdout) {
@@ -35,7 +36,7 @@ var fail = (msg) => `${paint("err", "\u2716", process.stderr)} ${msg}`;
 var warn = (msg) => `${paint("warn", "\u26A0")} ${msg}`;
 
 // src/index.ts
-import { hostname } from "os";
+import { hostname as hostname2 } from "os";
 import { join as join6, relative } from "path";
 import cac from "cac";
 
@@ -51,9 +52,10 @@ var DutoApiError = class extends Error {
   code;
 };
 var MESSAGES = {
-  unauthorized: "Invalid authtoken. Generate a new one at https://duto.dev and run: duto login <token>",
+  unauthorized: "This machine is not logged in. Run: duto login",
   suspended: "Your account is suspended.",
-  network: "Could not reach duto.dev. Check your connection."
+  network: "Could not reach duto.dev. Check your connection.",
+  loginExpired: "The login code expired. Run duto login again."
 };
 function createApiClient(o) {
   const doFetch = o.fetchImpl ?? fetch;
@@ -63,7 +65,7 @@ function createApiClient(o) {
       res = await doFetch(`${o.baseUrl}${path}`, {
         method,
         headers: {
-          authorization: `Bearer ${o.token}`,
+          ...o.token === void 0 ? {} : { authorization: `Bearer ${o.token}` },
           ...body === void 0 ? {} : { "content-type": "application/json" },
           "user-agent": "duto-cli"
         },
@@ -98,6 +100,12 @@ function createApiClient(o) {
       const res = await call("DELETE", `/api/tunnels/${encodeURIComponent(id)}`);
       if (!res.ok && res.status !== 404) await fail3(res);
     },
+    startLogin: (r) => json("POST", "/api/cli/login", r),
+    pollLogin: (deviceCode) => json("POST", "/api/cli/login/poll", { deviceCode }),
+    async revokeSelf() {
+      const res = await call("DELETE", "/api/cli/token");
+      if (!res.ok && res.status !== 401 && res.status !== 404) await fail3(res);
+    },
     me: () => json("GET", "/api/me"),
     endpoints: () => json("GET", "/api/endpoints")
   };
@@ -417,7 +425,7 @@ function parseConfig(text, file = CONFIG_FILES[0], env = process.env) {
     const v = validateName(name);
     if (!v.ok) {
       throw fail3(
-        v.reason === "reserved" ? `reserved name: "${raw}". Choose another.` : `invalid name: "${raw}" (use only lowercase letters and digits, no hyphen)`,
+        v.reason === "reserved" ? `"${raw}" is reserved. Pick another name.` : `invalid name: "${raw}" (use only lowercase letters and digits, no hyphen)`,
         line
       );
     }
@@ -522,6 +530,92 @@ function findConfig(cwd) {
   }
 }
 
+// src/login.ts
+import { spawn } from "child_process";
+import { hostname } from "os";
+var SLOW_DOWN_MS = 5e3;
+var MAX_NETWORK_ERRORS_IN_A_ROW = 3;
+async function browserLogin(o) {
+  const api = createApiClient({ baseUrl: o.baseUrl, fetchImpl: o.fetchImpl });
+  const start = await api.startLogin({
+    deviceId: o.deviceId,
+    deviceName: hostname(),
+    cliVersion: "1.1.0",
+    nodeVersion: process.version,
+    os: process.platform,
+    arch: process.arch
+  });
+  o.out(`  Visit ${start.verificationUrl}`);
+  tryOpen(o.open, start.verificationUrl);
+  let waitMs = start.interval * 1e3;
+  let networkErrors = 0;
+  for (; ; ) {
+    await o.sleep(waitMs);
+    let poll;
+    try {
+      poll = await api.pollLogin(start.deviceCode);
+      networkErrors = 0;
+    } catch (err) {
+      const isNetwork = err instanceof DutoApiError && err.code === "network";
+      if (!isNetwork || ++networkErrors > MAX_NETWORK_ERRORS_IN_A_ROW) throw err;
+      continue;
+    }
+    if (poll.status === "approved") return { token: poll.token, username: poll.username };
+    if (poll.status === "expired") throw new DutoApiError(MESSAGES.loginExpired, 410, "expired");
+    if (poll.status === "slow_down") waitMs += SLOW_DOWN_MS;
+  }
+}
+function tryOpen(open, url) {
+  try {
+    open(url);
+  } catch {
+    return;
+  }
+}
+function openCommand(url) {
+  if (process.platform === "darwin") return { command: "open", args: [url] };
+  if (process.platform === "win32") return { command: "cmd", args: ["/c", "start", '""', url] };
+  return { command: "xdg-open", args: [url] };
+}
+function loggedInLine(username) {
+  return ok(`Logged in as ${username}.`);
+}
+function loginSuccessLines(username) {
+  return [
+    loggedInLine(username),
+    "",
+    "To open a tunnel, run `duto 3000`, or `duto` in a folder with a duto.yml."
+  ];
+}
+function openBrowser(url) {
+  try {
+    const { command, args } = openCommand(url);
+    const child = spawn(command, args, { detached: true, stdio: "ignore" });
+    child.on("error", () => {
+    });
+    child.unref();
+  } catch {
+    return;
+  }
+}
+var FRAMES = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
+function startSpinner(label, stream = process.stderr) {
+  if (!stream.isTTY) {
+    stream.write(`${label}
+`);
+    return () => {
+    };
+  }
+  let frame = 0;
+  const draw = () => stream.write(`\r${FRAMES[frame++ % FRAMES.length]} ${label}`);
+  draw();
+  const timer = setInterval(draw, 80);
+  return () => {
+    clearInterval(timer);
+    stream.write("\r\x1B[K");
+  };
+}
+
 // src/inspector/jsonView.ts
 function countLabel(n, one, many) {
   return n + " " + (n === 1 ? one : many);
@@ -1431,7 +1525,7 @@ data: ${JSON.stringify({ ids })}
 }
 
 // src/session/session.ts
-import { spawn } from "child_process";
+import { spawn as spawn2 } from "child_process";
 
 // src/portcheck.ts
 import { connect } from "net";
@@ -1455,7 +1549,7 @@ async function isPortListening(port, timeoutMs = 500) {
 // src/session/auth.ts
 import { createHash as createHash3, createHmac, randomBytes as randomBytes2, timingSafeEqual as timingSafeEqual2 } from "crypto";
 var TUNNEL_COOKIE = "__Host-duto_tunnel";
-var SAME_SITE_SIBLING_TUNNEL_COOKIE_REJECTED = "same-site";
+var SEC_FETCH_SITE_SAME_SITE = "same-site";
 var QR_TTL_MS = 5 * 6e4;
 var sha2 = (s) => createHash3("sha256").update(s).digest();
 var constantTimeEqual2 = (a, b) => timingSafeEqual2(sha2(a), sha2(b));
@@ -1470,7 +1564,7 @@ function parseBasic(value) {
 var first2 = (v) => Array.isArray(v) ? v[0] : v;
 var bareHost = (s) => s.replace(/:\d+$/, "").toLowerCase();
 function sameHostOrigin(h) {
-  if (first2(h["sec-fetch-site"])?.toLowerCase() === SAME_SITE_SIBLING_TUNNEL_COOKIE_REJECTED) return false;
+  if (first2(h["sec-fetch-site"])?.toLowerCase() === SEC_FETCH_SITE_SAME_SITE) return false;
   const origin = first2(h.origin);
   if (origin === void 0) return true;
   let host;
@@ -1694,7 +1788,7 @@ function loginPage(o) {
 ${o.error ? `<p class="error" role="alert">Wrong username or password.</p>
 ` : ""}<button type="submit">Sign in</button>
 </form>
-<div class="retry">You stay signed in until the tunnel closes.</div>
+<div class="retry">You stay signed in until you close the browser or the tunnel closes.</div>
 </main>`,
     CSS
   );
@@ -2390,7 +2484,7 @@ var Session = class {
     if (this.child && this.token === token) return;
     if (this.child) this.child.kill("SIGTERM");
     this.token = token;
-    const c = spawn(this.o.cloudflaredPath, ["tunnel", "--no-autoupdate", "run"], {
+    const c = spawn2(this.o.cloudflaredPath, ["tunnel", "--no-autoupdate", "run"], {
       env: { ...process.env, TUNNEL_TOKEN: token },
       stdio: ["ignore", "ignore", "pipe"]
     });
@@ -2519,7 +2613,7 @@ function runPlain(session, out) {
 }
 
 // src/index.ts
-var LOGIN_HINT = "Log in first: duto login <token> (get your token at https://duto.dev)";
+var LOGIN_HINT = "Log in first: duto login";
 function fail2(message2) {
   console.error(fail(message2));
   process.exit(1);
@@ -2534,7 +2628,7 @@ function parseName(raw) {
   if (raw === void 0 || raw === true || raw === "") return void 0;
   const name = normalizeName(String(raw));
   const v = validateName(name);
-  if (!v.ok) fail2(v.reason === "reserved" ? `Reserved name: "${name}". Pick another.` : "Invalid name: use lowercase letters and numbers only (no hyphens)");
+  if (!v.ok) fail2(v.reason === "reserved" ? `"${name}" is reserved. Pick another name.` : `Invalid name. Use only lowercase letters and digits (no hyphens), up to ${MAX_NAME} characters.`);
   return name;
 }
 function parseHostFlag(raw) {
@@ -2574,7 +2668,7 @@ async function runSession(specs, source, flags) {
   } catch (err) {
     fail2(err instanceof Error ? err.message : String(err));
   }
-  const session = new Session({ api, deviceId: config.deviceId, deviceName: hostname(), cloudflaredPath, source, runDir: join6(dutoHome(), "run") });
+  const session = new Session({ api, deviceId: config.deviceId, deviceName: hostname2(), cloudflaredPath, source, runDir: join6(dutoHome(), "run") });
   let inspector = null;
   let inspectorError;
   if (flags.inspect !== false) {
@@ -2585,12 +2679,12 @@ async function runSession(specs, source, flags) {
     }
   }
   if (wantsUi(flags)) {
-    const { runFullscreen } = await import("./fullscreen-IWZCH3IP.js");
-    const code = await runFullscreen(session, specs, "1.0.0", inspector, inspectorError);
+    const { runFullscreen } = await import("./fullscreen-ECEH3R2V.js");
+    const code = await runFullscreen(session, specs, "1.1.0", inspector, inspectorError);
     await inspector?.close().catch(() => void 0);
     process.exit(code);
   }
-  console.log(`${mark()} ${paint("muted", `${"1.0.0"} \xB7 ${source} \xB7 Ctrl+C to stop`)}`);
+  console.log(`${mark()} ${paint("muted", `${"1.1.0"} \xB7 ${source} \xB7 Ctrl+C to stop`)}`);
   if (inspector) console.log(paint("muted", `inspector: ${inspector.openUrl}`));
   if (inspectorError) console.log(warn(`inspector failed to start: ${inspectorError}`));
   const stopLog = runPlain(session, (l) => console.log(l));
@@ -2649,19 +2743,56 @@ ${paint("signal", "Tip:")} create a duto.yml with your project's tunnels and jus
 var cli = cac("duto");
 cli.command("[port]", "No port: open the tunnels in duto.yml. With a port: open a tunnel to it").option("--name <name>", "Fixed address name (e.g. web \u2192 https://web-<user>.duto.dev)").option("--host <host>", "Host the local service receives instead of the public one (e.g. myapp.test)").option("--no-rewrite-redirects", "With --host: do not swap the local host for the public one in redirects").option("--auth <user:password>", "Ask for a username and password to open the address (repeatable)").option("--allow <range>", "With --auth: IP, CIDR range or name (stripe, github) that gets in without a password (repeatable)").option("--no-ui", "No full screen: just a request log (useful in scripts)").option("--no-inspect", "Do not start the browser inspector (127.0.0.1:4141)").option("--ui", "Force full screen (off by default on Windows)").action((port, opts) => tunnel(port, opts));
 cli.command("http <port>", "Same as duto <port> (for people coming from ngrok)").option("--name <name>", "Fixed address name").option("--host <host>", "Host the local service receives instead of the public one").option("--no-rewrite-redirects", "With --host: keep redirects as the service sent them").option("--auth <user:password>", "Ask for a username and password to open the address (repeatable)").option("--allow <range>", "With --auth: IP, CIDR range or name (stripe, github) that gets in without a password (repeatable)").option("--no-ui", "No full screen").option("--no-inspect", "Do not start the browser inspector (127.0.0.1:4141)").action((port, opts) => tunnel(port, opts));
-cli.command("login <token>", "Save your authtoken (get it at https://duto.dev)").action(async (token) => {
+cli.command("login [token]", "Log in through the browser, or save an authtoken").action(async (token) => {
   try {
+    if (token === void 0) return await loginWithBrowser();
     const me = await createApiClient({ baseUrl: apiUrl(), token: String(token) }).me();
     saveConfig({ ...loadConfig(), authtoken: String(token) });
-    console.log(ok(`Logged in as ${paint("strong", me.username ?? me.email)}`));
+    console.log(loggedInLine(me.username ?? me.email));
   } catch (err) {
     fail2(err instanceof Error ? err.message : String(err));
   }
 });
-cli.command("logout", "Remove the authtoken from this machine").action(() => {
-  const { authtoken: _removed, ...rest } = loadConfig();
+async function loginWithBrowser() {
+  const config = loadConfig();
+  let stopSpinner = () => {
+  };
+  try {
+    const { token, username } = await browserLogin({
+      baseUrl: apiUrl(),
+      deviceId: config.deviceId,
+      open: openBrowser,
+      sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+      out: (line) => {
+        console.log(line);
+        stopSpinner = startSpinner("Waiting for authentication...");
+      }
+    });
+    stopSpinner();
+    saveConfig({ ...config, authtoken: token });
+    for (const line of loginSuccessLines(username)) console.log(line);
+  } catch (err) {
+    stopSpinner();
+    throw err;
+  }
+}
+cli.command("logout", "Remove the authtoken from this machine").action(async () => {
+  const { authtoken, ...rest } = loadConfig();
+  let reachable = true;
   saveConfig(rest);
-  console.log(ok("Authtoken removed"));
+  if (authtoken) {
+    try {
+      await createApiClient({ baseUrl: apiUrl(), token: authtoken }).revokeSelf();
+    } catch (err) {
+      if (!(err instanceof DutoApiError) || err.code !== "network") fail2(err instanceof Error ? err.message : String(err));
+      reachable = false;
+    }
+  }
+  console.log(
+    ok(
+      reachable ? "Authtoken removed" : "Authtoken removed from this machine. Could not reach duto.dev; revoke it on the Machines page."
+    )
+  );
 });
 cli.command("status", "Show your account and live tunnels").action(async () => {
   const config = loadConfig();
@@ -2681,7 +2812,7 @@ cli.command("status", "Show your account and live tunnels").action(async () => {
   }
 });
 cli.help();
-cli.version("1.0.0");
+cli.version("1.1.0");
 try {
   cli.parse(process.argv, { run: false });
   await cli.runMatchedCommand();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dutodev/cli",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "description": "Expose a local port at https://<name>-<user>.duto.dev with one command.",
   "license": "MIT",
   "type": "module",