@gjermundgaraba/clankerauth 0.26.3 → 0.28.0

package/README.md

@@ -1,6 +1,6 @@
 # @gjermundgaraba/clankerauth
 
-The `clankerauth` command: sign in to a [clankerauth](https://github.com/gjermundgaraba/clankerauth) issuer as its owner, run every administration action over HTTP, and hand other commands access tokens for the issuer's resources. It needs Node 26 or newer and an issuer at 0.24.0 or later.
+The `clankerauth` command: sign in to a [clankerauth](https://github.com/gjermundgaraba/clankerauth) issuer as its owner, run every administration action over HTTP, and hand other commands access tokens for the issuer's resources. It needs Node 26 or newer and an issuer at 0.24.0 or later, or 0.28.0 for an administration key in `CLANKERAUTH_TOKEN`.
 
 ```sh
 npm install --global @gjermundgaraba/clankerauth
@@ -18,6 +18,18 @@ The sign-ins are kept in `$XDG_CONFIG_HOME/clankerauth/sign-ins.json`, `~/.confi
 
 Administration commands act at the issuer of the one administration sign-in kept. Signed in to administration at several issuers, name one with `CLANKERAUTH_URL`, its origin; a value that is no URL is refused.
 
+Unattended, such as in a container with no browser or disk to keep a sign-in on, the commands take an administration key, an API key granted on the issuer's origin root, from `CLANKERAUTH_TOKEN` instead, and then act at the issuer `CLANKERAUTH_URL` names, which they require. No sign-in is read or written. The owner creates the key once, signed in:
+
+```sh
+clankerauth create-api-key --name deployer --expires-at null \
+  --permissions '{"https://clankerauth.home.example/":["clankerauth:read","clankerauth:write"]}'
+
+CLANKERAUTH_URL=https://clankerauth.home.example CLANKERAUTH_TOKEN=clankerauth_… \
+  clankerauth list-api-keys
+```
+
+The issuer checks the key on every request, so disabling or deleting it ends its access at once. With `clankerauth:write` it may create and delete administration keys too, itself among them.
+
 ## Tokens for other commands
 
 `token <url>` prints a current access token for the resource signed in to that the URL is under, the most specific when several are, and nothing else, refreshing it first when it is about to expire; without a URL it prints administration's. Another command, or a script, gets its bearer token from there instead of keeping a key; a program written with Effect uses `token` of [`@gjermundgaraba/clankerauth-sdk/credentials`](../../packages/sdk/README.md) instead, which reads and refreshes the same sign-in:

package/dist/main.mjs

@@ -400,7 +400,7 @@ const OwnerHttp = ActionHttp.make(Administration, {
 });
 //#endregion
 //#region package.json
-var version = "0.26.3";
+var version = "0.28.0";
 //#endregion
 //#region src/main.ts
 const refused = (error) => new CliError.UserError({
@@ -437,12 +437,12 @@ const notSignedIn = new CliError.UserError({
 	cause: "not signed in",
 	userMessage: "Not signed in: run `clankerauth login <url>` first."
 });
+const issuerNamed = Config.option(Config.String("CLANKERAUTH_URL")).pipe(Effect.mapError(refused), Effect.flatMap((named) => Option.exists(named, (url) => !URL.canParse(url)) ? Effect.fail(new CliError.UserError({
+	cause: "CLANKERAUTH_URL",
+	userMessage: "CLANKERAUTH_URL is no URL: set it to the issuer's origin, its CLANKERAUTH_BASE_URL."
+})) : Effect.succeed(named)));
 const administrationSignIn = Effect.gen(function* () {
-	const named = yield* Config.option(Config.String("CLANKERAUTH_URL")).pipe(Effect.mapError(refused));
-	if (Option.exists(named, (url) => !URL.canParse(url))) return yield* new CliError.UserError({
-		cause: "CLANKERAUTH_URL",
-		userMessage: "CLANKERAUTH_URL is no URL: set it to the issuer's origin, its CLANKERAUTH_BASE_URL."
-	});
+	const named = yield* issuerNamed;
 	const kept = (yield* Credentials.list().pipe(Effect.mapError(refused))).filter((signIn) => signIn.resource === administrationIdentifier(signIn.url)).filter((signIn) => Option.match(named, {
 		onNone: () => true,
 		onSome: (url) => new URL(url).origin === signIn.url
@@ -455,14 +455,32 @@ const administrationSignIn = Effect.gen(function* () {
 	});
 	return only;
 });
+const administrationKey = Config.Redacted("CLANKERAUTH_TOKEN");
+const administrationTarget = Effect.gen(function* () {
+	const given = yield* Config.option(administrationKey).pipe(Effect.mapError(refused));
+	if (Option.isNone(given)) return yield* administrationSignIn;
+	const named = yield* issuerNamed;
+	if (Option.isNone(named)) return yield* new CliError.UserError({
+		cause: "CLANKERAUTH_URL",
+		userMessage: "CLANKERAUTH_TOKEN is set without CLANKERAUTH_URL: set it to the issuer's origin, its CLANKERAUTH_BASE_URL."
+	});
+	const url = new URL(named.value).origin;
+	return {
+		url,
+		resource: administrationIdentifier(url)
+	};
+});
 const tokenCommand = Command.make("token", { url: urlArgument("An address under the resource whose token to print, such as the application's URL; administration by default") }, ({ url }) => Effect.gen(function* () {
 	const named = Option.isSome(url) ? url.value : (yield* administrationSignIn).resource;
 	const token = yield* Credentials.token({ url: named }).pipe(Effect.mapError(refused));
 	yield* Effect.sync(() => process.stdout.write(`${Redacted.value(token)}\n`));
 })).pipe(Command.withDescription("Print a current access token for the resource signed in to that a URL is under, refreshing it first when it has expired."));
-const administrationClient = Effect.flatMap(administrationSignIn, (signIn) => ActionHttp.client(OwnerHttp, {
-	baseUrl: signIn.url,
-	transformClient: (client) => HttpClient.catchTag(Credentials.authorizing({ url: signIn.resource })(client), ["SignInRequired", "TokenUnavailable"], (error) => Effect.fail(refused(error)))
+const administrationClient = Effect.flatMap(administrationTarget, (target) => ActionHttp.client(OwnerHttp, {
+	baseUrl: target.url,
+	transformClient: (client) => HttpClient.catchTag(Credentials.authorizing({
+		url: target.resource,
+		token: administrationKey
+	})(client), ["SignInRequired", "TokenUnavailable"], (error) => Effect.fail(refused(error)))
 }));
 const administration = Administration.map((action) => ActionCli.remoteCommand(OwnerHttp, action, { client: administrationClient }));
 const cli = Command.make("clankerauth").pipe(Command.withDescription("Administer a clankerauth issuer as its owner, and hand other commands its tokens. Results are JSON on stdout; a created key or client secret is in it once."), Command.withSubcommands([

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gjermundgaraba/clankerauth",
-  "version": "0.26.3",
+  "version": "0.28.0",
   "description": "The clankerauth command line: sign in to an issuer as its owner and administer it over HTTP.",
   "license": "MIT",
   "repository": {
@@ -21,13 +21,13 @@
   "dependencies": {
     "@effect/platform-node": "4.0.5",
     "@effect/platform-node-shared": "4.0.5",
-    "@gjermundgaraba/clankerauth-sdk": "0.26.3",
-    "@gjermundgaraba/effect-actions": "0.18.2",
+    "@gjermundgaraba/clankerauth-sdk": "0.28.0",
+    "@gjermundgaraba/effect-actions": "0.19.0",
     "effect": "4.0.5"
   },
   "devDependencies": {
-    "@gjermundgaraba/clankerauth-admin-api": "0.26.3",
-    "@gjermundgaraba/clankerauth-dev": "0.26.3",
+    "@gjermundgaraba/clankerauth-admin-api": "0.28.0",
+    "@gjermundgaraba/clankerauth-dev": "0.28.0",
     "@types/node": "26.6.5",
     "typescript": "7.0.2",
     "vite": "npm:@voidzero-dev/vite-plus-core@1.3.0",