@edgestore/cli 1.0.0-next.2 → 1.0.0-next.3

package/README.md

@@ -14,9 +14,10 @@ edgestore login
 edgestore init
 ```
 
-Use `edgestore login --token` or `EDGESTORE_TOKEN` for automation and other
-non-browser environments. Persisted credentials are stored in the operating
-system credential store and are never written to a plaintext config file.
+Use `edgestore login --device` when a local browser callback is unavailable.
+Use `edgestore login --token` or `EDGESTORE_TOKEN` for automation. Persisted
+credentials are stored in the operating system credential store and are never
+written to a plaintext config file.
 
 The CLI manages accounts, projects and their keys, management tokens, buckets,
 files, uploads, team members, and invitations. Secrets are returned only when

package/dist/bin.mjs

@@ -414,12 +414,21 @@ const oauthCredentialSchema = z.object({
     resource: z.string().url(),
     scope: z.string().optional()
 }).strict();
-const oauthClientRegistrationSchema = z.object({
-    version: z.literal(1),
-    clientId: z.string().min(1),
-    issuer: z.string().url(),
-    redirectUri: z.string().url()
-}).strict();
+const oauthClientRegistrationSchema = z.discriminatedUnion('flow', [
+    z.object({
+        version: z.literal(2),
+        flow: z.literal('browser'),
+        clientId: z.string().min(1),
+        issuer: z.string().url(),
+        redirectUri: z.string().url()
+    }).strict(),
+    z.object({
+        version: z.literal(2),
+        flow: z.literal('device'),
+        clientId: z.string().min(1),
+        issuer: z.string().url()
+    }).strict()
+]);
 class KeyringCredentialStore {
     async get(apiOrigin) {
         const entry = await createEntry(CREDENTIAL_NAME, apiOrigin);
@@ -735,6 +744,7 @@ const resourceMetadataSchema = z.object({
     scopes_supported: z.array(z.string().min(1)).min(1),
     bearer_methods_supported: z.array(z.string()).optional()
 }).passthrough();
+const deviceGrantType = 'urn:ietf:params:oauth:grant-type:device_code';
 class DefaultOAuthService {
     fetchImplementation;
     constructor(fetchImplementation = fetch){
@@ -753,6 +763,19 @@ class DefaultOAuthService {
             });
         }
     }
+    async loginWithDeviceCode(input) {
+        try {
+            return await this.performDeviceLoginWithRecovery(input);
+        } catch (error) {
+            if (input.signal.aborted || error instanceof CliError) throw error;
+            throw new CliError('oauth_login_failed', oauthErrorMessage(error), {
+                suggestions: [
+                    'edgestore login --device',
+                    'edgestore login --token'
+                ]
+            });
+        }
+    }
     async performLoginWithRecovery(input) {
         try {
             return await this.performLogin(input);
@@ -764,6 +787,17 @@ class DefaultOAuthService {
             });
         }
     }
+    async performDeviceLoginWithRecovery(input) {
+        try {
+            return await this.performDeviceLogin(input);
+        } catch (error) {
+            if (!input.client || !isInvalidClientError(error)) throw error;
+            return await this.performDeviceLogin({
+                ...input,
+                client: undefined
+            });
+        }
+    }
     async refresh(credential, signal) {
         try {
             const config = await this.discover(new URL(credential.issuer), {
@@ -782,10 +816,11 @@ class DefaultOAuthService {
             });
         } catch (error) {
             if (signal.aborted || error instanceof CliError) throw error;
-            throw new CliError('oauth_refresh_failed', 'The browser login could not be refreshed.', {
+            throw new CliError('oauth_refresh_failed', 'The OAuth login could not be refreshed.', {
                 details: oauthErrorMessage(error),
                 suggestions: [
                     'edgestore login',
+                    'edgestore login --device',
                     'edgestore login --token'
                 ]
             });
@@ -819,7 +854,8 @@ class DefaultOAuthService {
                 throw new CliError('oauth_registration_failed', 'The OAuth server did not return a client ID.');
             }
             const clientRegistration = {
-                version: 1,
+                version: 2,
+                flow: 'browser',
                 clientId,
                 issuer: issuerIdentifier,
                 redirectUri: callback.redirectUri
@@ -864,13 +900,69 @@ class DefaultOAuthService {
             await callback.close();
         }
     }
+    async performDeviceLogin(input) {
+        const metadata = await this.protectedResourceMetadata(input.apiOrigin, input.resource, input.signal);
+        const issuer = new URL(metadata.authorization_servers[0]);
+        const issuerIdentifier = normalizeUrl(issuer.toString());
+        const reusableClient = reusableDeviceClientRegistration(input.client, issuer);
+        const config = reusableClient ? await this.discover(issuer, {
+            clientId: reusableClient.clientId,
+            signal: input.signal
+        }) : await this.registerDeviceClient(issuer, input.signal);
+        const clientId = config.clientMetadata().client_id;
+        if (!clientId) {
+            throw new CliError('oauth_registration_failed', 'The OAuth server did not return a client ID.');
+        }
+        const clientRegistration = reusableClient ?? {
+            version: 2,
+            flow: 'device',
+            clientId,
+            issuer: issuerIdentifier
+        };
+        if (!reusableClient) {
+            await input.onClientRegistered?.(clientRegistration);
+        }
+        const authorization = await oauth.initiateDeviceAuthorization(config, {
+            resource: metadata.resource,
+            scope: [
+                ...new Set(metadata.scopes_supported)
+            ].join(' ')
+        });
+        input.onDeviceAuthorization?.({
+            userCode: authorization.user_code,
+            verificationUri: authorization.verification_uri,
+            ...authorization.verification_uri_complete ? {
+                verificationUriComplete: authorization.verification_uri_complete
+            } : {},
+            expiresIn: authorization.expires_in
+        });
+        const verificationUrl = authorization.verification_uri_complete ?? authorization.verification_uri;
+        try {
+            await input.openUrl(verificationUrl);
+        } catch (error) {
+            input.onBrowserOpenFailed?.(verificationUrl, error);
+        }
+        const tokens = await oauth.pollDeviceAuthorizationGrant(config, authorization, {
+            resource: metadata.resource
+        }, {
+            signal: input.signal
+        });
+        return {
+            credential: credentialFromTokens(tokens, {
+                clientId,
+                issuer: issuerIdentifier,
+                resource: metadata.resource
+            }),
+            client: clientRegistration
+        };
+    }
     async protectedResourceMetadata(apiOrigin, expectedResource, signal) {
         const metadataUrl = new URL('/.well-known/oauth-protected-resource/v2', apiOrigin);
         const response = await this.fetchImplementation(metadataUrl, {
             signal
         });
         if (!response.ok) {
-            throw new CliError('oauth_metadata_unavailable', `The EdgeStore API does not advertise browser login (${response.status}).`, {
+            throw new CliError('oauth_metadata_unavailable', `The EdgeStore API does not advertise OAuth login (${response.status}).`, {
                 suggestions: [
                     'edgestore login --token'
                 ]
@@ -904,6 +996,19 @@ class DefaultOAuthService {
             ]
         }, oauth.None(), this.discoveryOptions(issuer, signal));
     }
+    async registerDeviceClient(issuer, signal) {
+        return await oauth.dynamicClientRegistration(issuer, {
+            application_type: 'native',
+            client_name: 'EdgeStore CLI',
+            redirect_uris: [],
+            token_endpoint_auth_method: 'none',
+            grant_types: [
+                deviceGrantType,
+                'refresh_token'
+            ],
+            response_types: []
+        }, oauth.None(), this.discoveryOptions(issuer, signal));
+    }
     async discover(issuer, options) {
         return await oauth.discovery(issuer, options.clientId, {
             token_endpoint_auth_method: 'none',
@@ -950,7 +1055,13 @@ async function openCallback(state, signal, preferredRedirectUri) {
     }
 }
 function reusableClientRegistration(client, issuer) {
-    return client && normalizeUrl(client.issuer) === normalizeUrl(issuer.toString()) && isReusableOAuthRedirectUri(client.redirectUri) ? client : undefined;
+    if (client?.flow !== 'browser' || normalizeUrl(client.issuer) !== normalizeUrl(issuer.toString()) || !isReusableOAuthRedirectUri(client.redirectUri)) {
+        return undefined;
+    }
+    return client;
+}
+function reusableDeviceClientRegistration(client, issuer) {
+    return client?.flow === 'device' && normalizeUrl(client.issuer) === normalizeUrl(issuer.toString()) ? client : undefined;
 }
 function credentialFromTokens(tokens, context) {
     const refreshToken = tokens.refresh_token ?? context.fallbackRefreshToken;
@@ -973,7 +1084,7 @@ function normalizeUrl(value) {
     return new URL(value).toString().replace(/\/$/, '');
 }
 function isInvalidClientError(error) {
-    return (error instanceof oauth.AuthorizationResponseError || error instanceof oauth.ResponseBodyError) && error.error === 'invalid_client';
+    return (error instanceof oauth.AuthorizationResponseError || error instanceof oauth.ResponseBodyError) && (error.error === 'invalid_client' || error.error === 'unauthorized_client');
 }
 function isLoopback(url) {
     return url.hostname === 'localhost' || url.hostname === '127.0.0.1';
@@ -983,7 +1094,7 @@ function isAddressInUse(error) {
 }
 function oauthErrorMessage(error) {
     if (error instanceof Error && error.message) return error.message;
-    return 'Browser login failed.';
+    return 'OAuth login failed.';
 }
 
 class DefaultCliPrompts {
@@ -1470,10 +1581,21 @@ async function exists(candidate) {
 }
 
 async function loginCommand(runtime, flags, options) {
-    if (!options.token) return await browserLogin(runtime, flags);
-    if (flags.json && runtime.io.inputIsTty) {
-        throw usageError('interactive_input_disabled', 'Interactive token input is disabled with --json.', [
-            'printf %s "$EDGESTORE_TOKEN" | edgestore login --token --json'
+    if (options.device && options.token) {
+        throw usageError('conflicting_login_modes', '--device and --token cannot be used together.');
+    }
+    const machineOutputFlag = flags.json ? '--json' : flags.plain ? '--plain' : undefined;
+    if (!options.token && machineOutputFlag) {
+        throw usageError('interactive_input_disabled', `OAuth login is interactive and cannot be used with ${machineOutputFlag}.`, [
+            'edgestore login',
+            'edgestore login --device'
+        ]);
+    }
+    if (options.device) return await oauthLogin(runtime, flags, 'device');
+    if (!options.token) return await oauthLogin(runtime, flags, 'browser');
+    if (machineOutputFlag && runtime.io.inputIsTty) {
+        throw usageError('interactive_input_disabled', `Interactive token input is disabled with ${machineOutputFlag}.`, [
+            `printf %s "$EDGESTORE_TOKEN" | edgestore login --token ${machineOutputFlag}`
         ]);
     }
     const token = await runtime.prompts.readToken(runtime.io.stdin, runtime.io.inputIsTty);
@@ -1633,24 +1755,34 @@ function actorLabel(actor) {
     }
     return actor.user.email;
 }
-async function browserLogin(runtime, flags) {
+async function oauthLogin(runtime, flags, mode) {
     const apiUrl = apiUrlFor(runtime, flags);
     const output = outputFor(runtime, flags);
-    const result = await runtime.oauth.login({
+    const sharedInput = {
         apiOrigin: apiUrl.displayUrl,
         resource: apiUrl.sdkBaseUrl,
         client: await runtime.credentials.getCachedOAuthClient(apiUrl.displayUrl),
         signal: runtime.signal,
         openUrl: (url)=>runtime.openUrl(url),
-        onAuthorizationUrl: (url)=>{
-            if (output.options.mode === 'human') {
-                runtime.io.stderr.write(`Opening a browser to continue login...\nIf it does not open, visit:\n  ${url}\n`);
-            }
-        },
         onBrowserOpenFailed: (url)=>{
             output.warning(`Could not open a browser automatically. Open this URL:\n  ${url}`);
         },
         onClientRegistered: (client)=>runtime.credentials.setCachedOAuthClient(apiUrl.displayUrl, client)
+    };
+    const result = mode === 'device' ? await runtime.oauth.loginWithDeviceCode({
+        ...sharedInput,
+        onDeviceAuthorization: (authorization)=>{
+            if (output.options.mode !== 'human') return;
+            const url = authorization.verificationUriComplete ?? authorization.verificationUri;
+            runtime.io.stderr.write(`Confirm this one-time code in your browser:\n  ${authorization.userCode}\nOpening a browser to continue login...\nIf it does not open, visit:\n  ${url}\n`);
+        }
+    }) : await runtime.oauth.login({
+        ...sharedInput,
+        onAuthorizationUrl: (url)=>{
+            if (output.options.mode === 'human') {
+                runtime.io.stderr.write(`Opening a browser to continue login...\nIf it does not open, visit:\n  ${url}\n`);
+            }
+        }
     });
     let identity;
     let credentialStored = false;
@@ -5068,7 +5200,7 @@ Common workflows:
         }
         outputFor(runtime, globalFlags(program));
     });
-    program.command('login').description('Log in to EdgeStore').option('--token', 'read and securely store a management token').action(async (options)=>{
+    program.command('login').description('Log in to EdgeStore').option('--device', 'log in with a device code').option('--token', 'read and securely store a management token').action(async (options)=>{
         await loginCommand(runtime, globalFlags(program), options);
     });
     program.command('logout').description('Remove the stored login').action(async ()=>{

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@edgestore/cli",
-  "version": "1.0.0-next.2",
+  "version": "1.0.0-next.3",
   "description": "Command-line interface for EdgeStore accounts and projects",
   "homepage": "https://edgestore.dev",
   "license": "MIT",
@@ -36,7 +36,7 @@
   ],
   "dependencies": {
     "@clack/prompts": "1.7.0",
-    "@edgestore/sdk": "1.0.0-next.2",
+    "@edgestore/sdk": "1.0.0-next.3",
     "@manypkg/find-root": "3.1.0",
     "@manypkg/get-packages": "3.1.0",
     "@napi-rs/keyring": "1.3.0",