@gpdoc/cli 1.1.0 → 1.2.0

package/bin/gpdoc.js

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 // @spec CLI-001, CLI-002, CLI-003, CLI-004, CLI-005, CLI-006, CLI-007, CLI-008, CLI-009, CLI-014, CLI-015
+import { realpathSync } from 'node:fs';
 import { access, readFile, rename, stat, unlink, writeFile } from 'node:fs/promises';
 import { spawn } from 'node:child_process';
 import path from 'node:path';
@@ -251,7 +252,16 @@ export async function run(argv, runtime = {}) {
   else if (warnings.length) process.stderr.write(`${warnings.join('\n')}\n`);
 }
 
-if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+function isCliEntrypoint() {
+  if (!process.argv[1]) return false;
+  try {
+    return realpathSync(process.argv[1]) === realpathSync(fileURLToPath(import.meta.url));
+  } catch {
+    return path.resolve(process.argv[1]) === fileURLToPath(import.meta.url);
+  }
+}
+
+if (isCliEntrypoint()) {
   try {
     await run(process.argv.slice(2));
   } catch (error) {

package/lib/auth.js

@@ -11,7 +11,10 @@ export class AuthError extends Error {
 
 const DEFAULT_ISSUER = 'https://auth.gpdoc.io/';
 const DEFAULT_AUDIENCE = 'https://gpdoc.us.auth0.com/api/v2/';
-const DEFAULT_CLIENT_ID = 'diSOuWs44rqN7SaDLdE2csL4S0efgI1l';
+// This is GPDoc's public native client. Unlike the browser client, it is
+// explicitly approved for Auth0's Device Authorization Grant.
+const DEFAULT_CLIENT_ID = 'hSllIhEMtrPrLtPZpYnNf0MOQbreziL8';
+const DEFAULT_SCOPE = 'openid profile email offline_access';
 
 function credentialPath(env) {
   if (env.GPDOC_CREDENTIALS_PATH) return path.resolve(env.GPDOC_CREDENTIALS_PATH);
@@ -64,6 +67,7 @@ function configuration(env) {
     issuer,
     audience: env.GPDOC_AUTH0_AUDIENCE || DEFAULT_AUDIENCE,
     clientId: env.GPDOC_AUTH0_CLIENT_ID || DEFAULT_CLIENT_ID,
+    scope: env.GPDOC_AUTH0_SCOPE || DEFAULT_SCOPE,
     deviceAuthorizationEndpoint: new URL('oauth/device/code', issuer).toString(),
     tokenEndpoint: new URL('oauth/token', issuer).toString(),
   };
@@ -112,9 +116,16 @@ export async function createAuthManager({ env = process.env, fetchImpl = globalT
     const { response, payload } = await requestJson(fetchImpl, config.deviceAuthorizationEndpoint, {
       method: 'POST',
       headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-      body: new URLSearchParams({ client_id: config.clientId, audience: config.audience }),
+      body: new URLSearchParams({
+        client_id: config.clientId,
+        audience: config.audience,
+        scope: config.scope,
+      }),
     });
     if (!response.ok || typeof payload.device_code !== 'string' || typeof payload.user_code !== 'string' || typeof payload.verification_uri !== 'string') {
+      if (payload.error === 'unauthorized_client') {
+        throw new AuthError('AUTH_DEVICE_FLOW_UNAVAILABLE', 'The configured GPDoc Auth0 client does not support terminal device authorization.');
+      }
       throw new AuthError('AUTH_FAILED', 'GPDoc could not start device authorization.');
     }
     const intervalSeconds = Math.max(1, Number(payload.interval || 5));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gpdoc/cli",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "type": "module",
   "description": "GPDoc command-line file conversion and validation tools",
   "repository": "https://github.com/repetere/gpdoc.git",