@formigio/fazemos-cli 0.10.78 → 0.10.79

package/dist/index.js

@@ -7,7 +7,8 @@ getActiveProjectId, setActiveProjectId, clearActiveProjectId, findProjectBySlug,
 // Directory-scoped context override (.fazemos.json)
 setOrgOverride, setProjectOverride, setDirContextSource, getDirContextSource, } from './config.js';
 import { findDirContextFile, readDirContextFile, writeDirContextFile, removeDirContextFile, DIR_CONFIG_FILENAME, } from './dircontext.js';
-import { login, signup, confirmSignup, adminLogin } from './auth.js';
+import { loginWithBrowser, hostedLogoutUrl, signup, confirmSignup, adminLogin } from './auth.js';
+import { fetchAuthConfig } from './authConfig.js';
 import { api, ApiError, refreshAuthMeCache, invalidateAuthMeCache, resolveOrgIdMaybeSlug, resolveProjectIdBySlug, patchProjectDocsRepo, patchOrgWorkspace } from './api.js';
 import { isProjectConnectionUnavailable, renderProjectConnectionUnavailableCopy, } from './connectionErrorCopy.js';
 import { loadYaml, summarize } from './yaml/load.js';
@@ -328,55 +329,70 @@ program.hook('preAction', async (_thisCommand, actionCommand) => {
 // ── Init ────────────────────────────────────────────────────
 program
     .command('init')
-    .description('Configure an environment (auto-discovers Cognito settings from the API)')
+    .description('Configure an environment (discovers Cognito settings from the API)')
     .argument('<name>', 'Environment name (e.g., dev, prod, local)')
     .requiredOption('--api-url <url>', 'API base URL')
-    .option('--cognito-pool <id>', 'Cognito User Pool ID (auto-discovered if omitted)')
-    .option('--cognito-client <id>', 'Cognito Client ID (auto-discovered if omitted)')
-    .option('--cognito-region <region>', 'Cognito region (auto-discovered if omitted)')
+    .option('--cognito-pool <id>', 'Cognito User Pool ID (discovered if omitted)')
+    .option('--cognito-client <id>', 'Cognito app client ID for the web console (discovered if omitted)')
+    .option('--cognito-cli-client <id>', 'Cognito app client ID for the CLI (discovered if omitted)')
+    .option('--hosted-ui <domain>', 'Cognito hosted-UI origin, e.g. https://jj-auth-dev.auth.us-west-2.amazoncognito.com (discovered if omitted)')
+    .option('--cognito-region <region>', 'Cognito region (discovered if omitted)')
     .action(async (name, opts) => {
+    const apiUrl = opts.apiUrl.replace(/\/$/, '');
     let poolId = opts.cognitoPool;
     let clientId = opts.cognitoClient;
+    let cliClientId = opts.cognitoCliClient;
+    let hostedUiDomain = opts.hostedUi;
     let region = opts.cognitoRegion;
-    // Auto-discover from API if not provided
-    if (!poolId || !clientId) {
+    // Discovery is the normal path; the flags exist for an API that predates
+    // GET /auth/config, or for pointing at a stack whose config endpoint is
+    // temporarily degraded. Anything supplied by flag wins — the operator has
+    // more context than the endpoint does about why they typed it.
+    const needsDiscovery = !poolId || !cliClientId || !hostedUiDomain || !region;
+    if (needsDiscovery) {
         try {
-            console.log(chalk.cyan('Discovering auth config...'));
-            const res = await fetch(`${opts.apiUrl}/auth/config`);
-            if (res.ok) {
-                const data = await res.json();
-                poolId = poolId || data.cognitoPoolId || data.userPoolId;
-                clientId = clientId || data.cognitoClientId || data.clientId;
-                region = region || data.cognitoRegion || data.region;
-                console.log(chalk.green('Auto-discovered Cognito settings'));
-            }
-            else {
-                console.log(chalk.yellow('Auto-discovery not available — provide --cognito-pool and --cognito-client'));
-                process.exit(1);
-            }
+            console.log(chalk.cyan(`Discovering auth config from ${apiUrl}/auth/config ...`));
+            const cfg = await fetchAuthConfig(apiUrl);
+            poolId = poolId || cfg.cognito.userPoolId;
+            clientId = clientId || cfg.cognito.clients.web.clientId;
+            cliClientId = cliClientId || cfg.cognito.clients.cli.clientId;
+            hostedUiDomain = hostedUiDomain || cfg.cognito.hostedUiDomain;
+            region = region || cfg.cognito.region;
+            console.log(chalk.green('Discovered Cognito settings'));
         }
-        catch {
-            console.error(chalk.red('Could not reach API for auto-discovery. Provide --cognito-pool and --cognito-client manually.'));
+        catch (err) {
+            console.error(chalk.red(err.message));
             process.exit(1);
         }
     }
-    if (!poolId || !clientId) {
-        console.error(chalk.red('Missing Cognito Pool ID or Client ID'));
+    if (!poolId) {
+        console.error(chalk.red('Missing Cognito Pool ID — pass --cognito-pool.'));
         process.exit(1);
     }
     addEnvironment(name, {
-        apiUrl: opts.apiUrl.replace(/\/$/, ''),
+        apiUrl,
         cognitoPoolId: poolId,
-        cognitoClientId: clientId,
+        cognitoClientId: clientId || '',
         cognitoRegion: region || 'us-west-2',
+        cognitoCliClientId: cliClientId || undefined,
+        hostedUiDomain: hostedUiDomain || undefined,
     });
     console.log(chalk.green(`Environment "${name}" configured`));
-    console.log(`  API:      ${opts.apiUrl}`);
-    console.log(`  Pool:     ${poolId}`);
-    console.log(`  Client:   ${clientId}`);
-    console.log(`  Region:   ${region || 'us-west-2'}`);
+    console.log(`  API:        ${apiUrl}`);
+    console.log(`  Pool:       ${poolId}`);
+    console.log(`  Region:     ${region || 'us-west-2'}`);
+    console.log(`  Web client: ${clientId || chalk.yellow('(none)')}`);
+    console.log(`  CLI client: ${cliClientId || chalk.yellow('(none)')}`);
+    console.log(`  Hosted UI:  ${hostedUiDomain || chalk.yellow('(none)')}`);
+    // `auth login` needs both of these and refetches /auth/config anyway, so
+    // this is a warning rather than a failure — the environment is still
+    // usable for anything that runs on an existing token.
+    if (!cliClientId || !hostedUiDomain) {
+        console.log(chalk.yellow(`\nNo CLI app client or hosted-UI domain: \`fazemos auth login\` will not work ` +
+            `against this environment until the API's /auth/config advertises them.`));
+    }
     if (config.get('activeEnv') === name) {
-        console.log(chalk.cyan(`  Active:   yes`));
+        console.log(chalk.cyan(`  Active:     yes`));
     }
 });
 // ── Environment ─────────────────────────────────────────────
@@ -418,6 +434,10 @@ program
     console.log(`  Environment: ${chalk.cyan(env.name)}${srcLabel}`);
     console.log(`  API:         ${env.apiUrl}`);
     console.log(`  Cognito:     ${env.cognitoPoolId}`);
+    // `auth login` needs both of these; showing them here is how you tell a
+    // stale environment (configured before OIDC login) from a broken one.
+    console.log(`  CLI client:  ${env.cognitoCliClientId || chalk.yellow('(not discovered — run: fazemos auth login)')}`);
+    console.log(`  Hosted UI:   ${env.hostedUiDomain || chalk.yellow('(not discovered — run: fazemos auth login)')}`);
     const token = getToken();
     console.log(`  Auth:        ${token ? chalk.green('authenticated') : chalk.yellow('not logged in')}`);
 });
@@ -425,12 +445,12 @@ program
 const auth = program.command('auth').description('Authentication commands');
 auth
     .command('login')
-    .description('Login with email and password')
-    .requiredOption('-e, --email <email>', 'Email address')
-    .requiredOption('-p, --password <password>', 'Password')
+    .description('Sign in through your browser (Cognito hosted UI, auth-code + PKCE)')
+    .option('--no-browser', 'Print the sign-in URL instead of launching a browser')
     .action(async (opts) => {
     try {
-        const result = await login(opts.email, opts.password);
+        // Commander turns `--no-browser` into `opts.browser === false`.
+        const result = await loginWithBrowser({ noBrowser: opts.browser === false });
         console.log(chalk.green(`Logged in as ${result.email}`));
     }
     catch (err) {
@@ -496,13 +516,28 @@ auth
 });
 auth
     .command('logout')
-    .description('Clear stored credentials')
+    .description('Clear stored credentials (prints the URL to end the browser session too)')
     .action(() => {
     const env = getActiveEnvName();
     const auths = config.get('auth');
     delete auths[env];
     config.set('auth', auths);
     console.log(chalk.green(`Logged out of ${env}`));
+    // Clearing local tokens does NOT end the Cognito hosted-UI session — the
+    // browser still holds it, so the next `auth login` signs straight back in
+    // with no prompt. That is usually what you want; when it is not (shared
+    // machine, switching accounts) this URL is how you actually sign out.
+    let url = null;
+    try {
+        url = hostedLogoutUrl();
+    }
+    catch {
+        // No environment configured — nothing further to offer.
+    }
+    if (url) {
+        console.log(chalk.gray(`\nStill signed in to the browser session. To end it too, open:`));
+        console.log(chalk.gray(`  ${url}`));
+    }
 });
 // ── Whoami ──────────────────────────────────────────────────
 program