@empirical-gauzza/cli 1.0.22 → 1.0.24

package/lib/oauthClient.js

@@ -1,222 +1,222 @@
-'use strict';
-
-const fs = require('fs');
-const os = require('os');
-const path = require('path');
-const { readJsonIfExists, writeFile, ensureDir } = require('./fsUtils');
-const { getEnv } = require('./env');
-const { runResolvedCommand } = require('./fsUtils');
-
-function getLocalOAuthClientPath() {
-  return path.join(os.homedir(), '.empirical', 'oauth-client.json');
-}
-
-function readStoredOAuthClient() {
-  const stored = readJsonIfExists(getLocalOAuthClientPath());
-  if (!stored || typeof stored !== 'object') return null;
-  const clientId = String(stored.clientId || '').trim();
-  if (!clientId) return null;
-  return {
-    clientId,
-    clientSecret: String(stored.clientSecret || '')
-  };
-}
-
-function writeStoredOAuthClient(clientId, clientSecret) {
-  const payload = {
-    clientId: String(clientId || '').trim(),
-    clientSecret: String(clientSecret || '').trim(),
-    updatedAt: new Date().toISOString()
-  };
-  writeFile(getLocalOAuthClientPath(), `${JSON.stringify(payload, null, 2)}\n`);
-}
-
-function clearStoredOAuthClient() {
-  const storePath = getLocalOAuthClientPath();
-  if (fs.existsSync(storePath)) {
-    fs.unlinkSync(storePath);
-  }
-}
-
-function maskSecret(value) {
-  const raw = String(value || '');
-  if (!raw) return '(not set)';
-  if (raw.length <= 8) return '*'.repeat(raw.length);
-  return `${raw.slice(0, 4)}...${raw.slice(-4)}`;
-}
-
-function generateRandomString(length = 32) {
-  const chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~';
-  let result = '';
-  for (let i = 0; i < length; i += 1) {
-    result += chars.charAt(Math.floor(Math.random() * chars.length));
-  }
-  return result;
-}
-
-function base64url(buf) {
-  return buf.toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '');
-}
-
-function generatePKCE() {
-  const crypto = require('crypto');
-  const codeVerifier = generateRandomString(128);
-  const codeChallenge = base64url(crypto.createHash('sha256').update(codeVerifier).digest());
-  return { codeVerifier, codeChallenge };
-}
-
-function decodeJwtPayload(token) {
-  try {
-    const parts = String(token).split('.');
-    if (parts.length !== 3) return null;
-    return JSON.parse(Buffer.from(parts[1], 'base64url').toString());
-  } catch (_error) {
-    return null;
-  }
-}
-
-function isJwtToken(token) {
-  return typeof token === 'string' && token.split('.').length === 3;
-}
-
-function isJwtExpired(token, skewSeconds = 30) {
-  const payload = decodeJwtPayload(token);
-  if (!payload || typeof payload.exp !== 'number') return true;
-  return payload.exp < Math.floor(Date.now() / 1000) + skewSeconds;
-}
-
-function getHeadlessTokenPath() {
-  return path.resolve(getEnv('EMPIRICAL_TOKEN_OUTPUT', '.empirical/headless-token.json'));
-}
-
-function getOAuthSessionPath() {
-  return path.join(os.homedir(), '.empirical', 'oauth-session.json');
-}
-
-function readOAuthSession() {
-  const session = readJsonIfExists(getOAuthSessionPath());
-  if (!session || typeof session !== 'object') return null;
-  return session;
-}
-
-function writeOAuthSession(session) {
-  if (!session?.accessToken) return;
-  writeFile(getOAuthSessionPath(), `${JSON.stringify(session, null, 2)}\n`);
-}
-
-function clearOAuthSession() {
-  const sessionPath = getOAuthSessionPath();
-  if (fs.existsSync(sessionPath)) fs.unlinkSync(sessionPath);
-}
-
-function readHeadlessToken() {
-  const tokenPath = getHeadlessTokenPath();
-  if (!fs.existsSync(tokenPath)) return null;
-  try {
-    const parsed = JSON.parse(fs.readFileSync(tokenPath, 'utf8'));
-    if (!parsed || typeof parsed !== 'object') {
-      return null;
-    }
-
-    const normalized = { ...parsed };
-    if (!normalized.clientId && normalized.authClientId) {
-      normalized.clientId = normalized.authClientId;
-    }
-    if (!normalized.clientSecret && normalized.authClientSecret) {
-      normalized.clientSecret = normalized.authClientSecret;
-    }
-    if (!normalized.apiKey) {
-      normalized.apiKey = normalized.clientSecret || normalized.authClientSecret || null;
-    }
-    return normalized;
-  } catch (_error) {
-    return null;
-  }
-}
-
-function getAccessTokenExpiryMs(token) {
-  if (!token || !token.accessToken) return 0;
-  const obtainedAtMs = Date.parse(String(token.obtainedAt || ''));
-  const expiresInSeconds = Number(token.expiresIn || 0);
-  if (!Number.isFinite(obtainedAtMs) || !Number.isFinite(expiresInSeconds) || expiresInSeconds <= 0) {
-    return 0;
-  }
-  return obtainedAtMs + (expiresInSeconds * 1000);
-}
-
-function hasFreshAccessToken(token, skewSeconds = 120) {
-  const expiryMs = getAccessTokenExpiryMs(token);
-  if (!expiryMs) return false;
-  return expiryMs > (Date.now() + (skewSeconds * 1000));
-}
-
-function persistAccessToken(accessToken) {
-  if (!accessToken) return;
-  process.env.EMPIRICAL_ACCESS_TOKEN = accessToken;
-  if (process.platform !== 'win32') {
-    return;
-  }
-  // `setx` writes permanently into the user's Windows environment, surviving
-  // every future shell/process. Only do that for a genuinely permanent
-  // credential (a plain apiKey) — a short-lived session JWT written here
-  // would silently outlive its own expiry and shadow a valid apiKey in the
-  // token file for good, forcing a manual env-var reset roughly every hour.
-  if (isJwtToken(accessToken)) {
-    return;
-  }
-  const escaped = String(accessToken).replace(/\"/g, '""');
-  runResolvedCommand('setx', ['EMPIRICAL_ACCESS_TOKEN', escaped], { stdio: 'ignore' });
-}
-
-function toEnvSafe(value) {
-  return String(value ?? '')
-    .replace(/\\/g, '\\\\')
-    .replace(/\n/g, '\\n')
-    .replace(/\r/g, '\\r')
-    .replace(/"/g, '\\"');
-}
-
-function writeHeadlessEnvFile(result, outputPath) {
-  ensureDir(path.dirname(path.resolve(outputPath)));
-  // Prefer the API key as the access token — it never expires and works as a
-  // permanent Bearer credential with the MCP endpoint.
-  const permanentToken = result.apiKey || result.accessToken;
-  const lines = [
-    '# Generated by empirical cli',
-    `EMPIRICAL_BASE_URL="${toEnvSafe(result.baseUrl)}"`,
-    `EMPIRICAL_ACCESS_TOKEN="${toEnvSafe(permanentToken)}"`,
-    `EMPIRICAL_API_KEY="${toEnvSafe(result.apiKey || '')}"`,
-    `EMPIRICAL_REFRESH_TOKEN="${toEnvSafe(result.refreshToken || '')}"`,
-    `EMPIRICAL_CLIENT_ID="${toEnvSafe(result.clientId || '')}"`,
-    `EMPIRICAL_CLIENT_SECRET="${toEnvSafe(result.clientSecret || '')}"`,
-    `EMPIRICAL_TOKEN_TYPE="${toEnvSafe(result.tokenType || 'Bearer')}"`,
-    `EMPIRICAL_TOKEN_OBTAINED_AT="${toEnvSafe(result.obtainedAt || '')}"`,
-    `EMPIRICAL_TOKEN_EXPIRES_IN="${toEnvSafe(result.expiresIn || '')}"`
-  ];
-  fs.writeFileSync(path.resolve(outputPath), `${lines.join('\n')}\n`, 'utf8');
-}
-
-module.exports = {
-  getLocalOAuthClientPath,
-  readStoredOAuthClient,
-  writeStoredOAuthClient,
-  clearStoredOAuthClient,
-  maskSecret,
-  generateRandomString,
-  base64url,
-  generatePKCE,
-  decodeJwtPayload,
-  isJwtToken,
-  isJwtExpired,
-  getHeadlessTokenPath,
-  getOAuthSessionPath,
-  readOAuthSession,
-  writeOAuthSession,
-  clearOAuthSession,
-  readHeadlessToken,
-  getAccessTokenExpiryMs,
-  hasFreshAccessToken,
-  persistAccessToken,
-  toEnvSafe,
-  writeHeadlessEnvFile
-};
+'use strict';
+
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { readJsonIfExists, writeFile, ensureDir } = require('./fsUtils');
+const { getEnv } = require('./env');
+const { runResolvedCommand } = require('./fsUtils');
+
+function getLocalOAuthClientPath() {
+  return path.join(os.homedir(), '.empirical', 'oauth-client.json');
+}
+
+function readStoredOAuthClient() {
+  const stored = readJsonIfExists(getLocalOAuthClientPath());
+  if (!stored || typeof stored !== 'object') return null;
+  const clientId = String(stored.clientId || '').trim();
+  if (!clientId) return null;
+  return {
+    clientId,
+    clientSecret: String(stored.clientSecret || '')
+  };
+}
+
+function writeStoredOAuthClient(clientId, clientSecret) {
+  const payload = {
+    clientId: String(clientId || '').trim(),
+    clientSecret: String(clientSecret || '').trim(),
+    updatedAt: new Date().toISOString()
+  };
+  writeFile(getLocalOAuthClientPath(), `${JSON.stringify(payload, null, 2)}\n`);
+}
+
+function clearStoredOAuthClient() {
+  const storePath = getLocalOAuthClientPath();
+  if (fs.existsSync(storePath)) {
+    fs.unlinkSync(storePath);
+  }
+}
+
+function maskSecret(value) {
+  const raw = String(value || '');
+  if (!raw) return '(not set)';
+  if (raw.length <= 8) return '*'.repeat(raw.length);
+  return `${raw.slice(0, 4)}...${raw.slice(-4)}`;
+}
+
+function generateRandomString(length = 32) {
+  const chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~';
+  let result = '';
+  for (let i = 0; i < length; i += 1) {
+    result += chars.charAt(Math.floor(Math.random() * chars.length));
+  }
+  return result;
+}
+
+function base64url(buf) {
+  return buf.toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '');
+}
+
+function generatePKCE() {
+  const crypto = require('crypto');
+  const codeVerifier = generateRandomString(128);
+  const codeChallenge = base64url(crypto.createHash('sha256').update(codeVerifier).digest());
+  return { codeVerifier, codeChallenge };
+}
+
+function decodeJwtPayload(token) {
+  try {
+    const parts = String(token).split('.');
+    if (parts.length !== 3) return null;
+    return JSON.parse(Buffer.from(parts[1], 'base64url').toString());
+  } catch (_error) {
+    return null;
+  }
+}
+
+function isJwtToken(token) {
+  return typeof token === 'string' && token.split('.').length === 3;
+}
+
+function isJwtExpired(token, skewSeconds = 30) {
+  const payload = decodeJwtPayload(token);
+  if (!payload || typeof payload.exp !== 'number') return true;
+  return payload.exp < Math.floor(Date.now() / 1000) + skewSeconds;
+}
+
+function getHeadlessTokenPath() {
+  return path.resolve(getEnv('EMPIRICAL_TOKEN_OUTPUT', '.empirical/headless-token.json'));
+}
+
+function getOAuthSessionPath() {
+  return path.join(os.homedir(), '.empirical', 'oauth-session.json');
+}
+
+function readOAuthSession() {
+  const session = readJsonIfExists(getOAuthSessionPath());
+  if (!session || typeof session !== 'object') return null;
+  return session;
+}
+
+function writeOAuthSession(session) {
+  if (!session?.accessToken) return;
+  writeFile(getOAuthSessionPath(), `${JSON.stringify(session, null, 2)}\n`);
+}
+
+function clearOAuthSession() {
+  const sessionPath = getOAuthSessionPath();
+  if (fs.existsSync(sessionPath)) fs.unlinkSync(sessionPath);
+}
+
+function readHeadlessToken() {
+  const tokenPath = getHeadlessTokenPath();
+  if (!fs.existsSync(tokenPath)) return null;
+  try {
+    const parsed = JSON.parse(fs.readFileSync(tokenPath, 'utf8'));
+    if (!parsed || typeof parsed !== 'object') {
+      return null;
+    }
+
+    const normalized = { ...parsed };
+    if (!normalized.clientId && normalized.authClientId) {
+      normalized.clientId = normalized.authClientId;
+    }
+    if (!normalized.clientSecret && normalized.authClientSecret) {
+      normalized.clientSecret = normalized.authClientSecret;
+    }
+    if (!normalized.apiKey) {
+      normalized.apiKey = normalized.clientSecret || normalized.authClientSecret || null;
+    }
+    return normalized;
+  } catch (_error) {
+    return null;
+  }
+}
+
+function getAccessTokenExpiryMs(token) {
+  if (!token || !token.accessToken) return 0;
+  const obtainedAtMs = Date.parse(String(token.obtainedAt || ''));
+  const expiresInSeconds = Number(token.expiresIn || 0);
+  if (!Number.isFinite(obtainedAtMs) || !Number.isFinite(expiresInSeconds) || expiresInSeconds <= 0) {
+    return 0;
+  }
+  return obtainedAtMs + (expiresInSeconds * 1000);
+}
+
+function hasFreshAccessToken(token, skewSeconds = 120) {
+  const expiryMs = getAccessTokenExpiryMs(token);
+  if (!expiryMs) return false;
+  return expiryMs > (Date.now() + (skewSeconds * 1000));
+}
+
+function persistAccessToken(accessToken) {
+  if (!accessToken) return;
+  process.env.EMPIRICAL_ACCESS_TOKEN = accessToken;
+  if (process.platform !== 'win32') {
+    return;
+  }
+  // `setx` writes permanently into the user's Windows environment, surviving
+  // every future shell/process. Only do that for a genuinely permanent
+  // credential (a plain apiKey) — a short-lived session JWT written here
+  // would silently outlive its own expiry and shadow a valid apiKey in the
+  // token file for good, forcing a manual env-var reset roughly every hour.
+  if (isJwtToken(accessToken)) {
+    return;
+  }
+  const escaped = String(accessToken).replace(/\"/g, '""');
+  runResolvedCommand('setx', ['EMPIRICAL_ACCESS_TOKEN', escaped], { stdio: 'ignore' });
+}
+
+function toEnvSafe(value) {
+  return String(value ?? '')
+    .replace(/\\/g, '\\\\')
+    .replace(/\n/g, '\\n')
+    .replace(/\r/g, '\\r')
+    .replace(/"/g, '\\"');
+}
+
+function writeHeadlessEnvFile(result, outputPath) {
+  ensureDir(path.dirname(path.resolve(outputPath)));
+  // Prefer the API key as the access token — it never expires and works as a
+  // permanent Bearer credential with the MCP endpoint.
+  const permanentToken = result.apiKey || result.accessToken;
+  const lines = [
+    '# Generated by empirical cli',
+    `EMPIRICAL_BASE_URL="${toEnvSafe(result.baseUrl)}"`,
+    `EMPIRICAL_ACCESS_TOKEN="${toEnvSafe(permanentToken)}"`,
+    `EMPIRICAL_API_KEY="${toEnvSafe(result.apiKey || '')}"`,
+    `EMPIRICAL_REFRESH_TOKEN="${toEnvSafe(result.refreshToken || '')}"`,
+    `EMPIRICAL_CLIENT_ID="${toEnvSafe(result.clientId || '')}"`,
+    `EMPIRICAL_CLIENT_SECRET="${toEnvSafe(result.clientSecret || '')}"`,
+    `EMPIRICAL_TOKEN_TYPE="${toEnvSafe(result.tokenType || 'Bearer')}"`,
+    `EMPIRICAL_TOKEN_OBTAINED_AT="${toEnvSafe(result.obtainedAt || '')}"`,
+    `EMPIRICAL_TOKEN_EXPIRES_IN="${toEnvSafe(result.expiresIn || '')}"`
+  ];
+  fs.writeFileSync(path.resolve(outputPath), `${lines.join('\n')}\n`, 'utf8');
+}
+
+module.exports = {
+  getLocalOAuthClientPath,
+  readStoredOAuthClient,
+  writeStoredOAuthClient,
+  clearStoredOAuthClient,
+  maskSecret,
+  generateRandomString,
+  base64url,
+  generatePKCE,
+  decodeJwtPayload,
+  isJwtToken,
+  isJwtExpired,
+  getHeadlessTokenPath,
+  getOAuthSessionPath,
+  readOAuthSession,
+  writeOAuthSession,
+  clearOAuthSession,
+  readHeadlessToken,
+  getAccessTokenExpiryMs,
+  hasFreshAccessToken,
+  persistAccessToken,
+  toEnvSafe,
+  writeHeadlessEnvFile
+};