@gjermundgaraba/clankerauth 0.24.0 → 0.25.0

package/README.md

@@ -12,7 +12,7 @@ clankerauth create-api-key --name "notes sync" \
 clankerauth logout
 ```
 
-`login <url>` signs in to the resource `url` identifies, reading it from its `/.well-known/oauth-protected-resource`: the issuer's own origin, `CLANKERAUTH_BASE_URL`, publishes administration, and an application's URL publishes its resource. It then discovers the issuer that resource names; registers the command there as a native OAuth client, a new one for each sign-in; prints the approval URL on stderr for the owner to open; and listens for the redirect on a loopback port. It asks for every scope the resource publishes, `clankerauth:read clankerauth:write` for administration, unless `--scope` names fewer: `--scope clankerauth:read` lists and never changes. Beside them it asks for `offline_access`, alone for a resource that publishes no scopes. A resource must publish that document, and so be identified by an `http:` or `https:` URL, to be signed in to.
+`login <url>` signs in to the resource `url` identifies, reading it from its `/.well-known/oauth-protected-resource`: the issuer's own origin, `CLANKERAUTH_BASE_URL`, publishes administration, and an application's URL publishes its resource. It then discovers the issuer that resource names; registers the command there as a native OAuth client, a new one for each sign-in; opens the approval page in the browser and prints its URL on stderr, for a terminal with no browser to open, or alone with `--no-browser`; and listens for the redirect on a loopback port. It asks for every scope the resource publishes, `clankerauth:read clankerauth:write` for administration, unless `--scope` names fewer: `--scope clankerauth:read` lists and never changes. Beside them it asks for `offline_access`, alone for a resource that publishes no scopes. A resource must publish that document, and so be identified by an `http:` or `https:` URL, to be signed in to.
 
 The sign-ins are kept in `$XDG_CONFIG_HOME/clankerauth/sign-ins.json`, `~/.config/clankerauth/sign-ins.json` by default, readable by their owner alone: one per resource, each with its own issuer, so signing in at a second issuer leaves the first's alone. A file the command cannot read, such as one another version wrote, counts as signed out and the next `login` replaces it. A `login` to a resource already signed in to replaces that sign-in and revokes it. A command refreshes an access token as it is about to expire and saves the rotated refresh token, so a sign-in lasts while it is used at least every 30 days; when the issuer refuses a refresh, the error names the `login` that asks for the same scopes again. Every change to the file holds its lock, so commands and programs running at once refresh an expired sign-in once, and `logout` revokes the refresh token that is current. `logout` revokes every sign-in and deletes the file, and `logout <url>` the one whose resource that URL is under alone.
 

package/dist/main.mjs

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { spawn } from "node:child_process";
 import { Config, Console, Context, Effect, Option, Redacted, Schema } from "effect";
 import { Argument, CliError, Command, Flag } from "effect/cli";
 import { FetchHttpClient, HttpClient } from "effect/http";
@@ -399,7 +400,7 @@ const OwnerHttp = ActionHttp.make(Administration, {
 });
 //#endregion
 //#region package.json
-var version = "0.24.0";
+var version = "0.25.0";
 //#endregion
 //#region src/main.ts
 const refused = (error) => new CliError.UserError({
@@ -408,14 +409,29 @@ const refused = (error) => new CliError.UserError({
 });
 const json = (value) => Console.log(JSON.stringify(value, null, 2));
 const urlArgument = (description) => Argument.String("url").pipe(Argument.withDescription(description), Argument.optional);
-const approve = (page) => Effect.sync(() => process.stderr.write(`Open this URL in your browser to approve the sign-in:\n\n  ${page.href}\n\n`));
+const browserOpener = (url) => {
+	switch (process.platform) {
+		case "darwin": return ["open", [url]];
+		case "win32": return ["rundll32", ["url.dll,FileProtocolHandler", url]];
+		default: return ["xdg-open", [url]];
+	}
+};
+const openInBrowser = (page) => Effect.sync(() => {
+	const [command, args] = browserOpener(page.href);
+	spawn(command, args, {
+		stdio: "ignore",
+		detached: true
+	}).on("error", () => void 0).unref();
+});
+const approve = (browser) => (page) => browser ? Effect.andThen(Effect.sync(() => process.stderr.write(`Approve the sign-in in your browser. If it did not open, open this URL:\n\n  ${page.href}\n\n`)), openInBrowser(page)) : Effect.sync(() => process.stderr.write(`Open this URL in your browser to approve the sign-in:\n\n  ${page.href}\n\n`));
 const loginCommand = Command.make("login", {
 	url: Argument.String("url").pipe(Argument.withDescription("The resource to sign in to: an application's URL, such as https://notes.example, or the issuer's origin, its CLANKERAUTH_BASE_URL, for administration")),
-	scope: Flag.String("scope").pipe(Flag.withDescription("The scopes to ask for, space-separated: every scope the resource publishes by default"), Flag.optional)
-}, ({ url, scope }) => Credentials.signIn(url, {
+	scope: Flag.String("scope").pipe(Flag.withDescription("The scopes to ask for, space-separated: every scope the resource publishes by default"), Flag.optional),
+	noBrowser: Flag.Boolean("no-browser").pipe(Flag.withDescription("Print the approval URL without opening it in the browser"), Flag.withDefault(false))
+}, ({ url, scope, noBrowser }) => Credentials.signIn(url, {
 	scope: Option.getOrUndefined(scope),
-	approve
-}).pipe(Effect.mapError(refused), Effect.flatMap(json))).pipe(Command.withDescription("Sign in as the issuer's owner to a resource: approve the URL it prints in the browser. The resource's issuer and scopes are read from its /.well-known/oauth-protected-resource. Sign-ins are kept in ~/.config/clankerauth, each beside the others, whatever its issuer."));
+	approve: approve(!noBrowser)
+}).pipe(Effect.mapError(refused), Effect.flatMap(json))).pipe(Command.withDescription("Sign in as the issuer's owner to a resource: approve the page it opens in the browser, or the URL it prints. The resource's issuer and scopes are read from its /.well-known/oauth-protected-resource. Sign-ins are kept in ~/.config/clankerauth, each beside the others, whatever its issuer."));
 const logoutCommand = Command.make("logout", { url: urlArgument("Sign out of the resource this URL is under alone") }, ({ url }) => Credentials.signOut(Option.getOrUndefined(url)).pipe(Effect.mapError(refused), Effect.flatMap(json))).pipe(Command.withDescription("Revoke the sign-ins, or the one to the resource a URL is under, and forget them."));
 const notSignedIn = new CliError.UserError({
 	cause: "not signed in",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gjermundgaraba/clankerauth",
-  "version": "0.24.0",
+  "version": "0.25.0",
   "description": "The clankerauth command line: sign in to an issuer as its owner and administer it over HTTP.",
   "license": "MIT",
   "repository": {
@@ -19,19 +19,19 @@
     "access": "public"
   },
   "dependencies": {
-    "@effect/platform-node": "4.0.4",
-    "@effect/platform-node-shared": "4.0.4",
-    "@gjermundgaraba/clankerauth-sdk": "0.24.0",
-    "@gjermundgaraba/effect-actions": "0.18.0",
-    "effect": "4.0.4"
+    "@effect/platform-node": "4.0.5",
+    "@effect/platform-node-shared": "4.0.5",
+    "@gjermundgaraba/clankerauth-sdk": "0.25.0",
+    "@gjermundgaraba/effect-actions": "0.18.2",
+    "effect": "4.0.5"
   },
   "devDependencies": {
-    "@gjermundgaraba/clankerauth-admin-api": "0.24.0",
-    "@gjermundgaraba/clankerauth-dev": "0.24.0",
-    "@types/node": "26.6.4",
+    "@gjermundgaraba/clankerauth-admin-api": "0.25.0",
+    "@gjermundgaraba/clankerauth-dev": "0.25.0",
+    "@types/node": "26.6.5",
     "typescript": "7.0.2",
-    "vite": "npm:@voidzero-dev/vite-plus-core@1.2.0",
-    "vite-plus": "1.2.0"
+    "vite": "npm:@voidzero-dev/vite-plus-core@1.3.0",
+    "vite-plus": "1.3.0"
   },
   "engines": {
     "node": ">=26"