@fourier-labs/harbour 0.1.6 → 0.1.7

package/dist/packages/harbour-cli/src/auth.js

@@ -0,0 +1,158 @@
+import { createHash, randomBytes } from "node:crypto";
+import { createServer } from "node:http";
+import { chmod, mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { homedir, platform } from "node:os";
+import { dirname, join } from "node:path";
+import { spawn } from "node:child_process";
+const scopes = "harbour:operate harbour:source-save offline_access";
+export function tokenStorePath(env = process.env) {
+    return join(env.XDG_CONFIG_HOME?.trim() || join(homedir(), ".config"), "harbour", "tokens.json");
+}
+export function tokenStoreKey(mcpUrl, tenant) { return `${new URL(mcpUrl).toString()}|${tenant}`; }
+export async function loadStoredToken(mcpUrl, tenant, path = tokenStorePath()) {
+    try {
+        const parsed = JSON.parse(await readFile(path, "utf8"));
+        const token = parsed.version === 1 ? parsed.tokens?.[tokenStoreKey(mcpUrl, tenant)] : undefined;
+        return validToken(token) ? token : undefined;
+    }
+    catch (error) {
+        if (isMissing(error))
+            return undefined;
+        throw new Error("Harbour could not read its local sign-in record. Run `harbour logout` and sign in again.");
+    }
+}
+export async function saveStoredToken(mcpUrl, tenant, token, path = tokenStorePath()) {
+    if (!validToken(token))
+        throw new Error("Harbour received an incomplete sign-in response.");
+    let store = { version: 1, tokens: {} };
+    try {
+        store = JSON.parse(await readFile(path, "utf8"));
+    }
+    catch (error) {
+        if (!isMissing(error))
+            throw error;
+    }
+    if (store.version !== 1 || !store.tokens || typeof store.tokens !== "object")
+        store = { version: 1, tokens: {} };
+    store.tokens[tokenStoreKey(mcpUrl, tenant)] = token;
+    await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+    await chmod(dirname(path), 0o700);
+    await writeFile(path, JSON.stringify(store), { mode: 0o600 });
+    await chmod(path, 0o600);
+}
+export async function clearStoredToken(mcpUrl, tenant, path = tokenStorePath()) {
+    const token = await loadStoredToken(mcpUrl, tenant, path);
+    if (!token)
+        return undefined;
+    const store = JSON.parse(await readFile(path, "utf8"));
+    delete store.tokens[tokenStoreKey(mcpUrl, tenant)];
+    if (Object.keys(store.tokens).length)
+        await writeFile(path, JSON.stringify(store), { mode: 0o600 });
+    else
+        await rm(path, { force: true });
+    return token;
+}
+export async function login(mcpUrl, tenant, output) {
+    const metadata = await discover(mcpUrl);
+    if (!metadata.registration_endpoint || !metadata.authorization_endpoint || !metadata.token_endpoint)
+        throw new Error("Harbour sign-in is not available on this endpoint yet.");
+    const callback = await loopbackCallback();
+    try {
+        const registered = await json(metadata.registration_endpoint, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ client_name: "Harbour CLI", redirect_uris: [callback.redirectUri], grant_types: ["authorization_code", "refresh_token"], response_types: ["code"], token_endpoint_auth_method: "none" }) });
+        if (!registered.client_id)
+            throw new Error("Harbour did not register this sign-in session.");
+        const verifier = randomBytes(32).toString("base64url");
+        const state = randomBytes(24).toString("base64url");
+        const challenge = createHash("sha256").update(verifier).digest("base64url");
+        const authorize = new URL(metadata.authorization_endpoint);
+        authorize.search = new URLSearchParams({ response_type: "code", client_id: registered.client_id, redirect_uri: callback.redirectUri, scope: scopes, state, resource: mcpUrl, code_challenge: challenge, code_challenge_method: "S256" }).toString();
+        output("Harbour is opening your browser to sign in.");
+        openBrowser(authorize.toString());
+        output(`If it does not open, visit: ${authorize}`);
+        const code = await callback.wait(state);
+        const response = await token(metadata.token_endpoint, { grant_type: "authorization_code", client_id: registered.client_id, code, redirect_uri: callback.redirectUri, code_verifier: verifier });
+        await saveStoredToken(mcpUrl, tenant, { ...response, clientId: registered.client_id, tokenEndpoint: metadata.token_endpoint, ...(metadata.revocation_endpoint ? { revocationEndpoint: metadata.revocation_endpoint } : {}) });
+        output("Harbour sign-in is complete.");
+    }
+    finally {
+        callback.close();
+    }
+}
+export async function refreshStoredToken(mcpUrl, tenant, path = tokenStorePath()) {
+    const stored = await loadStoredToken(mcpUrl, tenant, path);
+    if (!stored)
+        return undefined;
+    if (!stored.refreshToken)
+        return stored.accessToken;
+    try {
+        const refreshed = await token(stored.tokenEndpoint, { grant_type: "refresh_token", client_id: stored.clientId, refresh_token: stored.refreshToken });
+        await saveStoredToken(mcpUrl, tenant, { ...stored, ...refreshed, refreshToken: refreshed.refreshToken ?? stored.refreshToken }, path);
+        return refreshed.accessToken;
+    }
+    catch {
+        throw new Error("Harbour sign-in expired or was revoked. Run `harbour login` again.");
+    }
+}
+export async function logout(mcpUrl, tenant) {
+    const stored = await clearStoredToken(mcpUrl, tenant);
+    if (stored?.refreshToken && stored.revocationEndpoint) {
+        try {
+            await fetch(stored.revocationEndpoint, { method: "POST", headers: { "content-type": "application/x-www-form-urlencoded" }, body: new URLSearchParams({ token: stored.refreshToken, client_id: stored.clientId }), redirect: "error" });
+        }
+        catch { /* Local credentials are removed even if offline revocation cannot complete. */ }
+    }
+}
+async function discover(mcpUrl) {
+    const resource = new URL(mcpUrl);
+    resource.pathname = `${resource.pathname.replace(/\/mcp$/, "")}/.well-known/oauth-protected-resource`.replace(/\/\//g, "/");
+    const protectedResource = await json(resource.toString());
+    const server = protectedResource.authorization_servers?.[0];
+    if (!server)
+        throw new Error("Harbour did not advertise a sign-in service.");
+    const wellKnown = new URL("/.well-known/oauth-authorization-server", server).toString();
+    const metadata = await json(wellKnown);
+    if (!metadata.authorization_endpoint || !metadata.token_endpoint || !metadata.registration_endpoint)
+        throw new Error("Harbour sign-in metadata is incomplete.");
+    return { authorization_endpoint: metadata.authorization_endpoint, token_endpoint: metadata.token_endpoint, registration_endpoint: metadata.registration_endpoint, revocation_endpoint: metadata.revocation_endpoint ?? "" };
+}
+async function token(endpoint, values) {
+    const response = await json(endpoint, { method: "POST", headers: { "content-type": "application/x-www-form-urlencoded" }, body: new URLSearchParams(values), redirect: "error" });
+    if (!response.access_token)
+        throw new Error("Harbour sign-in did not return an access token.");
+    return { accessToken: response.access_token, ...(response.refresh_token ? { refreshToken: response.refresh_token } : {}) };
+}
+async function json(url, init) { const response = await fetch(url, { ...init, redirect: "error" }); if (!response.ok)
+    throw new Error(`Harbour sign-in request failed (${response.status}).`); return response.json(); }
+function validToken(value) { return Boolean(value && typeof value === "object" && typeof value.accessToken === "string" && typeof value.clientId === "string" && typeof value.tokenEndpoint === "string"); }
+function isMissing(error) { return Boolean(error && typeof error === "object" && error.code === "ENOENT"); }
+function loopbackCallback() {
+    return new Promise((resolve, reject) => {
+        const server = createServer();
+        const timer = setTimeout(() => { server.close(); reject(new Error("Harbour sign-in timed out. Run `harbour login` again.")); }, 5 * 60_000);
+        server.on("request", (request, response) => {
+            const requestUrl = new URL(request.url ?? "/", "http://127.0.0.1");
+            const code = requestUrl.searchParams.get("code");
+            const state = requestUrl.searchParams.get("state");
+            response.writeHead(code && state ? 200 : 400, { "content-type": "text/plain; charset=utf-8" });
+            response.end(code && state ? "Harbour sign-in complete. You can close this tab." : "Harbour sign-in could not be completed.");
+            if (code && state)
+                server.callback = { code, state };
+        });
+        server.listen(0, "127.0.0.1", () => {
+            const address = server.address();
+            if (!address || typeof address === "string") {
+                reject(new Error("Harbour could not start local sign-in."));
+                return;
+            }
+            resolve({ redirectUri: `http://127.0.0.1:${address.port}/callback`, wait: expected => new Promise((done, fail) => {
+                    const poll = setInterval(() => { const callback = server.callback; if (!callback)
+                        return; clearInterval(poll); clearTimeout(timer); if (callback.state !== expected)
+                        fail(new Error("Harbour sign-in returned an invalid state."));
+                    else
+                        done(callback.code); }, 25);
+                }), close: () => { clearTimeout(timer); server.close(); } });
+        });
+        server.on("error", reject);
+    });
+}
+function openBrowser(url) { const command = platform() === "darwin" ? "open" : platform() === "win32" ? "cmd" : "xdg-open"; const args = platform() === "win32" ? ["/c", "start", "", url] : [url]; const child = spawn(command, args, { detached: true, stdio: "ignore" }); child.unref(); child.on("error", () => { }); }

package/dist/packages/harbour-cli/src/cli.js

@@ -3,6 +3,7 @@ import { RemoteMcpClient } from "./remote-mcp-client.js";
 import { productionise } from "./productionise.js";
 import { safeError, CliError } from "./output.js";
 import { CLI_VERSION } from "./version.js";
+import { login, logout, refreshStoredToken } from "./auth.js";
 const args = process.argv.slice(2);
 const command = args[0];
 const rootIndex = args.indexOf("--app-root");
@@ -21,27 +22,42 @@ for (let index = 0; index < args.length; index += 1) {
     }
 }
 const url = process.env.HARBOUR_MCP_URL;
-const token = process.env.HARBOUR_TOKEN ?? "";
+const explicitToken = process.env.HARBOUR_TOKEN?.trim() ?? "";
 const tenant = process.env.HARBOUR_TENANT ?? "";
-const usage = "Usage: harbour productionise --app-root <path> [--include <relative-path>]... [--json]\nSet HARBOUR_MCP_URL, HARBOUR_TENANT, and HARBOUR_TOKEN before running.\n";
+const usage = "Usage: harbour login | logout | productionise --app-root <path> [--include <relative-path>]... [--json]\nSet HARBOUR_MCP_URL and HARBOUR_TENANT. HARBOUR_TOKEN is a controlled non-production override.\n";
 if (command === "--version" || command === "version") {
     process.stdout.write(`${CLI_VERSION}\n`);
 }
 else if (!command || command === "help" || command === "--help" || args.includes("-h")) {
     process.stdout.write(usage);
 }
-else if (optionError || command !== "productionise" || !root || root.startsWith("--") || !url || !tenant || !token) {
+else if (!url || !tenant || !["login", "logout", "productionise"].includes(command) || (command === "productionise" && (optionError || !root || root.startsWith("--")))) {
     if (optionError)
         process.stderr.write(`${optionError}\n`);
     process.stderr.write(usage);
     process.exitCode = 2;
 }
 else {
-    const client = new RemoteMcpClient(url, token, tenant);
     try {
-        const result = await productionise(root, client, message => { process.stderr.write(`${message}\n`); }, tenant, includePaths);
-        const envelope = { schema: "harbour.cli-result/1.0", cliVersion: CLI_VERSION, status: "SUCCEEDED", operationStarted: true, operationRef: result.operationRef, result: result.result };
-        process.stdout.write(`${JSON.stringify(envelope)}\n`);
+        if (command === "login") {
+            await login(url, tenant, message => process.stderr.write(`${message}\n`));
+            process.stdout.write("Harbour sign-in complete.\n");
+            process.exitCode = 0;
+        }
+        else if (command === "logout") {
+            await logout(url, tenant);
+            process.stdout.write("Harbour sign-in removed from this device.\n");
+            process.exitCode = 0;
+        }
+        else {
+            const token = explicitToken || await refreshStoredToken(url, tenant);
+            if (!token)
+                throw new CliError("AUTH_REQUIRED", "Sign in with `harbour login` before productionising an app.");
+            const client = new RemoteMcpClient(url, token, tenant);
+            const result = await productionise(root, client, message => { process.stderr.write(`${message}\n`); }, tenant, includePaths);
+            const envelope = { schema: "harbour.cli-result/1.0", cliVersion: CLI_VERSION, status: "SUCCEEDED", operationStarted: true, operationRef: result.operationRef, result: result.result };
+            process.stdout.write(`${JSON.stringify(envelope)}\n`);
+        }
     }
     catch (error) {
         const safe = safeError(error);

package/dist/packages/harbour-cli/src/version.js

@@ -1 +1 @@
-export const CLI_VERSION = "0.1.6";
+export const CLI_VERSION = "0.1.7";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fourier-labs/harbour",
-  "version": "0.1.6",
+  "version": "0.1.7",
   "description": "Harbour productionisation helper",
   "type": "module",
   "bin": { "harbour": "./dist/packages/harbour-cli/src/cli.js" },