@glassly/cli 2.0.0-dev.0

package/src/credentials.ts

@@ -0,0 +1,216 @@
+import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+const SERVICE = "glassly-cli-v2";
+const LEGACY_NAME = "credentials";
+const GLASSLY_DIR = join(homedir(), ".glassly");
+const CREDS_DIR = join(GLASSLY_DIR, "cli-v2");
+const LEGACY_CREDS_FILE = join(CREDS_DIR, "credentials.json");
+const SIGNING_KEY_SERVICE = "glassly-cli-v2-signing";
+
+export type CliJwk = Record<string, unknown> & {
+  kty?: string;
+  crv?: string;
+  x?: string;
+  d?: string;
+};
+
+export interface CliCredentials {
+  token: string;
+  refreshToken?: string;
+  workosUserId: string;
+  email: string;
+  organizationId?: string | null;
+  authenticationMethod?: string;
+  coreUrl: string;
+  storedAt: string;
+  expiresAt?: string;
+}
+
+export interface CliSigningKey {
+  coreUrl: string;
+  signingKeyId: string;
+  publicKeyJwk: CliJwk;
+  privateKeyJwk: CliJwk;
+  createdAt: string;
+}
+
+export async function saveCredentials(credentials: CliCredentials): Promise<"keychain" | "file"> {
+  const payload = JSON.stringify(credentials);
+  const name = credentialName(credentials.coreUrl);
+
+  try {
+    if (typeof Bun !== "undefined" && Bun.secrets) {
+      await Bun.secrets.set({
+        service: SERVICE,
+        name,
+        value: payload,
+      });
+      return "keychain";
+    }
+  } catch {
+    // Fall through to file storage.
+  }
+
+  mkdirSync(CREDS_DIR, { recursive: true });
+  writeFileSync(credentialsFile(credentials.coreUrl), `${payload}\n`, { mode: 0o600 });
+  return "file";
+}
+
+export async function loadCredentials(coreUrl?: string): Promise<CliCredentials | null> {
+  const targetCoreUrl = coreUrl ? normalizeCoreUrl(coreUrl) : undefined;
+  if (process.env.GLASSLY_CLI_TOKEN) {
+    return {
+      token: process.env.GLASSLY_CLI_TOKEN,
+      workosUserId: process.env.GLASSLY_CLI_WORKOS_USER_ID || "unknown",
+      email: process.env.GLASSLY_CLI_EMAIL || "unknown",
+      organizationId: process.env.GLASSLY_CLI_ORGANIZATION_ID,
+      coreUrl: targetCoreUrl || process.env.GLASSLY_CORE_URL || "http://localhost:3000",
+      storedAt: new Date().toISOString(),
+    };
+  }
+
+  const scoped = targetCoreUrl ? await loadScopedCredentials(targetCoreUrl) : null;
+  if (scoped) return scoped;
+
+  try {
+    if (typeof Bun !== "undefined" && Bun.secrets) {
+      const value = await Bun.secrets.get({
+        service: SERVICE,
+        name: LEGACY_NAME,
+      });
+      if (value) {
+        const legacy = JSON.parse(value) as CliCredentials;
+        if (!targetCoreUrl || normalizeCoreUrl(legacy.coreUrl) === targetCoreUrl) return legacy;
+      }
+    }
+  } catch {
+    // Fall through.
+  }
+
+  try {
+    if (existsSync(LEGACY_CREDS_FILE)) {
+      const legacy = JSON.parse(readFileSync(LEGACY_CREDS_FILE, "utf8")) as CliCredentials;
+      if (!targetCoreUrl || normalizeCoreUrl(legacy.coreUrl) === targetCoreUrl) return legacy;
+    }
+  } catch {
+    // Treat corrupt credentials as logged out.
+  }
+
+  return null;
+}
+
+export async function clearCredentials(coreUrl?: string): Promise<void> {
+  const targetCoreUrl = coreUrl ? normalizeCoreUrl(coreUrl) : undefined;
+
+  try {
+    if (typeof Bun !== "undefined" && Bun.secrets) {
+      await Bun.secrets.set({
+        service: SERVICE,
+        name: targetCoreUrl ? credentialName(targetCoreUrl) : LEGACY_NAME,
+        value: "",
+      });
+    }
+  } catch {
+    // Ignore keychain failures; remove file fallback below.
+  }
+
+  const path = targetCoreUrl ? credentialsFile(targetCoreUrl) : LEGACY_CREDS_FILE;
+  if (existsSync(path)) {
+    rmSync(path);
+  }
+}
+
+export async function saveSigningKey(key: CliSigningKey): Promise<"keychain" | "file"> {
+  const payload = JSON.stringify(key);
+  const name = credentialName(key.coreUrl);
+
+  try {
+    if (typeof Bun !== "undefined" && Bun.secrets) {
+      await Bun.secrets.set({
+        service: SIGNING_KEY_SERVICE,
+        name,
+        value: payload,
+      });
+      return "keychain";
+    }
+  } catch {
+    // Fall through to file storage.
+  }
+
+  mkdirSync(CREDS_DIR, { recursive: true });
+  writeFileSync(signingKeyFile(key.coreUrl), `${payload}\n`, { mode: 0o600 });
+  return "file";
+}
+
+export async function loadSigningKey(coreUrl: string): Promise<CliSigningKey | null> {
+  const targetCoreUrl = normalizeCoreUrl(coreUrl);
+  try {
+    if (typeof Bun !== "undefined" && Bun.secrets) {
+      const value = await Bun.secrets.get({
+        service: SIGNING_KEY_SERVICE,
+        name: credentialName(targetCoreUrl),
+      });
+      if (value) return JSON.parse(value) as CliSigningKey;
+    }
+  } catch {
+    // Fall through.
+  }
+
+  try {
+    const path = signingKeyFile(targetCoreUrl);
+    if (existsSync(path)) return JSON.parse(readFileSync(path, "utf8")) as CliSigningKey;
+  } catch {
+    // Treat corrupt key storage as missing.
+  }
+
+  return null;
+}
+
+async function loadScopedCredentials(coreUrl: string): Promise<CliCredentials | null> {
+  try {
+    if (typeof Bun !== "undefined" && Bun.secrets) {
+      const value = await Bun.secrets.get({
+        service: SERVICE,
+        name: credentialName(coreUrl),
+      });
+      if (value) return JSON.parse(value) as CliCredentials;
+    }
+  } catch {
+    // Fall through.
+  }
+
+  try {
+    const path = credentialsFile(coreUrl);
+    if (existsSync(path)) return JSON.parse(readFileSync(path, "utf8")) as CliCredentials;
+  } catch {
+    // Treat corrupt credentials as logged out.
+  }
+
+  return null;
+}
+
+function credentialName(coreUrl: string): string {
+  return `credentials:${credentialKey(coreUrl)}`;
+}
+
+function credentialsFile(coreUrl: string): string {
+  return join(CREDS_DIR, `credentials-${credentialKey(coreUrl)}.json`);
+}
+
+function signingKeyFile(coreUrl: string): string {
+  return join(CREDS_DIR, `signing-key-${credentialKey(coreUrl)}.json`);
+}
+
+function credentialKey(coreUrl: string): string {
+  return Buffer.from(normalizeCoreUrl(coreUrl)).toString("base64url");
+}
+
+function normalizeCoreUrl(coreUrl: string): string {
+  const url = new URL(coreUrl);
+  url.pathname = url.pathname.replace(/\/+$/, "");
+  url.search = "";
+  url.hash = "";
+  return url.toString().replace(/\/$/, "");
+}