@gscdump/cli 0.37.3 → 0.37.4

package/dist/_chunks/auth.mjs

@@ -0,0 +1,476 @@
+import { getConfigDir, loadConfig } from "./config.mjs";
+import { pickCliEnvironmentValue, resolveCliEnvironment } from "./environment.mjs";
+import { displayPath, logger } from "./utils.mjs";
+import { getAppliedEnvKeys, getLoadedEnvPath } from "./env-file.mjs";
+import process from "node:process";
+import fs from "node:fs/promises";
+import path from "node:path";
+import { isCancel, text } from "@clack/prompts";
+import { err, ok, unwrapResult } from "gscdump/result";
+import { createAuth } from "gscdump/api";
+import { createServer } from "node:http";
+import { JWT, OAuth2Client } from "google-auth-library";
+import { ofetch } from "ofetch";
+function authErrorToException(error) {
+	const exception = new Error(error.message);
+	if ("cause" in error && error.cause !== void 0) exception.cause = error.cause;
+	exception.authError = error;
+	return exception;
+}
+const SCOPES = [
+	"https://www.googleapis.com/auth/webmasters",
+	"https://www.googleapis.com/auth/indexing",
+	"https://www.googleapis.com/auth/siteverification"
+];
+async function loadServiceAccountResult(jsonPath) {
+	const raw = await fs.readFile(jsonPath, "utf-8");
+	const key = JSON.parse(raw);
+	if (key.type !== "service_account") return err({
+		kind: "not-service-account",
+		path: jsonPath,
+		accountType: key.type,
+		message: `${jsonPath} is not a service-account key (type=${key.type})`
+	});
+	return ok(new JWT({
+		email: key.client_email,
+		key: key.private_key,
+		scopes: SCOPES
+	}));
+}
+async function loadServiceAccount(jsonPath) {
+	return unwrapResult(await loadServiceAccountResult(jsonPath), authErrorToException);
+}
+async function resolveServiceAccount(opts = {}) {
+	let p = opts.path || resolveCliEnvironment().serviceAccountPath;
+	if (!p) p = (await loadConfig().catch(() => null))?.serviceAccountPath;
+	if (!p) return null;
+	return loadServiceAccount(p);
+}
+async function authenticateDeviceCode(credentials) {
+	return unwrapResult(await authenticateDeviceCodeResult(credentials), authErrorToException);
+}
+async function authenticateDeviceCodeResult(credentials) {
+	const init = await ofetch("https://oauth2.googleapis.com/device/code", {
+		method: "POST",
+		body: new URLSearchParams({
+			client_id: credentials.clientId,
+			scope: SCOPES.join(" ")
+		})
+	}).then(ok).catch((e) => err({
+		kind: "device-code-request-failed",
+		message: `Device-code request failed: ${e.message}`,
+		cause: e
+	}));
+	if (!init.ok) return init;
+	return pollDeviceCode(credentials, init.value);
+}
+async function pollDeviceCode(credentials, init) {
+	console.log();
+	console.log(`  \x1B[1mDevice-code OAuth\x1B[0m`);
+	console.log(`  1. On any device, open: \x1B[36m${init.verification_url}\x1B[0m`);
+	console.log(`  2. Enter this code:     \x1B[1m${init.user_code}\x1B[0m`);
+	console.log(`  3. Approve the requested scopes`);
+	console.log();
+	logger.info(`Polling for completion (expires in ${Math.floor(init.expires_in / 60)}m)...`);
+	const intervalMs = init.interval * 1e3;
+	const deadline = Date.now() + init.expires_in * 1e3;
+	while (Date.now() < deadline) {
+		await new Promise((r) => setTimeout(r, intervalMs));
+		const res = await ofetch("https://oauth2.googleapis.com/token", {
+			method: "POST",
+			body: new URLSearchParams({
+				client_id: credentials.clientId,
+				client_secret: credentials.clientSecret,
+				device_code: init.device_code,
+				grant_type: "urn:ietf:params:oauth:grant-type:device_code"
+			})
+		}).catch((e) => e?.data ?? { error: "request_failed" });
+		if (res.access_token) return ok({
+			access_token: res.access_token,
+			refresh_token: res.refresh_token,
+			expiry_date: res.expires_in ? Date.now() + res.expires_in * 1e3 : void 0
+		});
+		if (res.error === "authorization_pending" || res.error === "slow_down") continue;
+		if (res.error === "access_denied") return err({
+			kind: "device-code-denied",
+			message: "User denied authorization."
+		});
+		if (res.error === "expired_token") return err({
+			kind: "device-code-expired",
+			message: "Device code expired. Re-run `gscdump auth login --no-browser`."
+		});
+		if (res.error) return err({
+			kind: "device-code-failed",
+			reason: res.error,
+			message: `Device-code poll failed: ${res.error_description || res.error}`
+		});
+	}
+	return err({
+		kind: "device-code-timed-out",
+		message: "Device-code flow timed out."
+	});
+}
+function resolveBYOK(opts = {}) {
+	const env = resolveCliEnvironment();
+	const accessToken = opts.accessToken || env.accessToken;
+	const clientId = opts.clientId || env.clientId;
+	const clientSecret = opts.clientSecret || env.clientSecret;
+	const refreshToken = opts.refreshToken || env.refreshToken;
+	if (clientId && clientSecret && refreshToken) return createAuth({
+		clientId,
+		clientSecret,
+		refreshToken
+	});
+	if (accessToken) return accessToken;
+	return null;
+}
+const REDIRECT_URI_RE = /redirect_uri=[^&]+/;
+function getTokensPath() {
+	return path.join(getConfigDir(), "tokens.json");
+}
+async function loadTokens() {
+	return fs.readFile(getTokensPath(), "utf-8").then((data) => JSON.parse(data)).catch(() => null);
+}
+async function saveTokens(tokens) {
+	await fs.mkdir(getConfigDir(), {
+		recursive: true,
+		mode: 448
+	});
+	await fs.writeFile(getTokensPath(), JSON.stringify(tokens, null, 2), { mode: 384 });
+}
+async function clearTokens() {
+	await fs.rm(getTokensPath(), { force: true });
+	logger.success("Logged out, tokens cleared");
+}
+async function getAuthCredentials(interactive) {
+	const env = resolveCliEnvironment();
+	const envClientId = env.clientId;
+	const envClientSecret = env.clientSecret;
+	if (envClientId && envClientSecret) {
+		if (interactive) {
+			logger.info("Using OAuth client from env");
+			console.log(`  \x1B[90m${envClientId}\x1B[0m`);
+		}
+		return {
+			clientId: envClientId,
+			clientSecret: envClientSecret
+		};
+	}
+	const config = await loadConfig();
+	if (config.clientId && config.clientSecret) {
+		if (interactive) {
+			logger.info(`Using OAuth client from ${displayPath(`${getConfigDir()}/config.json`)}`);
+			console.log(`  \x1B[90m${config.clientId}\x1B[0m`);
+		}
+		return {
+			clientId: config.clientId,
+			clientSecret: config.clientSecret
+		};
+	}
+	if (!interactive) {
+		logger.error("GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET required for non-interactive mode");
+		process.exit(1);
+	}
+	console.log();
+	console.log("  \x1B[1mOAuth 2.0 Setup Required\x1B[0m");
+	console.log("  \x1B[90mThe Google Search Console API requires OAuth 2.0 credentials.\x1B[0m");
+	console.log();
+	console.log("  \x1B[1mSteps:\x1B[0m");
+	console.log("  \x1B[90m1.\x1B[0m Go to \x1B[36mhttps://console.developers.google.com/apis/credentials\x1B[0m");
+	console.log("  \x1B[90m2.\x1B[0m Create credentials > OAuth client ID > Desktop application");
+	console.log("  \x1B[90m3.\x1B[0m Enable \"Search Console API\" and \"Web Search Indexing API\" for your project");
+	console.log("  \x1B[90m4.\x1B[0m Copy the Client ID and Client Secret");
+	console.log();
+	const clientIdResult = await text({
+		message: "Enter your Google OAuth Client ID:",
+		placeholder: "your-client-id.googleusercontent.com",
+		validate: (v) => v ? void 0 : "Required"
+	});
+	if (isCancel(clientIdResult)) process.exit(1);
+	const clientSecretResult = await text({
+		message: "Enter your Google OAuth Client Secret:",
+		validate: (v) => v ? void 0 : "Required"
+	});
+	if (isCancel(clientSecretResult)) process.exit(1);
+	console.log();
+	logger.info("Tip: Set GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET env vars to skip prompts");
+	return {
+		clientId: clientIdResult,
+		clientSecret: clientSecretResult
+	};
+}
+async function getAuthCodeViaLoopback(authUrl) {
+	return new Promise((resolve, reject) => {
+		let resolvedRedirectUri = "";
+		let timeoutId;
+		let server;
+		const settle = (fn) => {
+			if (timeoutId) clearTimeout(timeoutId);
+			server.closeAllConnections?.();
+			server.close();
+			fn();
+		};
+		server = createServer((req, res) => {
+			const url = new URL(req.url || "", `http://127.0.0.1`);
+			const code = url.searchParams.get("code");
+			const error = url.searchParams.get("error");
+			if (error) {
+				res.writeHead(400, { "Content-Type": "text/html" });
+				res.end(`<html><body><h1>Authorization Failed</h1><p>${error}</p><p>You can close this window.</p></body></html>`);
+				settle(() => reject(/* @__PURE__ */ new Error(`OAuth error: ${error}`)));
+				return;
+			}
+			if (code) {
+				res.writeHead(200, { "Content-Type": "text/html" });
+				res.end(`<html><body><h1>Authorization Successful</h1><p>You can close this window and return to the terminal.</p></body></html>`);
+				settle(() => resolve({
+					code,
+					redirectUri: resolvedRedirectUri
+				}));
+				return;
+			}
+			res.writeHead(400, { "Content-Type": "text/html" });
+			res.end(`<html><body><h1>Missing authorization code</h1></body></html>`);
+		});
+		server.listen(0, "127.0.0.1", () => {
+			const addr = server.address();
+			if (!addr || typeof addr === "string") {
+				settle(() => reject(/* @__PURE__ */ new Error("Failed to start local server")));
+				return;
+			}
+			resolvedRedirectUri = `http://127.0.0.1:${addr.port}`;
+			const fullAuthUrl = authUrl.replace(REDIRECT_URI_RE, `redirect_uri=${encodeURIComponent(resolvedRedirectUri)}`);
+			console.log();
+			console.log("  \x1B[1mOpening browser for authorization...\x1B[0m");
+			console.log(`  \x1B[90mIf browser doesn't open, visit:\x1B[0m`);
+			console.log(`  \x1B[36m${fullAuthUrl}\x1B[0m`);
+			console.log();
+			console.log(`  \x1B[90mIf Google says "redirect_uri_mismatch", your OAuth client is`);
+			console.log(`  not a "Desktop application" type. Create a Desktop client at`);
+			console.log(`  https://console.cloud.google.com/apis/credentials, then run`);
+			console.log(`  \`gscdump init --force\` with the new ID/secret.\x1B[0m`);
+			console.log();
+			import("open").then(({ default: open }) => open(fullAuthUrl)).catch(() => {
+				logger.warn("Could not open browser automatically");
+			});
+		});
+		server.on("error", (err) => settle(() => reject(err)));
+		timeoutId = setTimeout(() => {
+			settle(() => reject(/* @__PURE__ */ new Error("Authorization timed out. If Google showed \"redirect_uri_mismatch\", your OAuth client must be type \"Desktop application\" (create one at https://console.cloud.google.com/apis/credentials and run `gscdump init --force`).")));
+		}, 300 * 1e3);
+	});
+}
+async function authenticate(credentials, interactive, opts = {}) {
+	const oauth2Client = new OAuth2Client(credentials.clientId, credentials.clientSecret, "http://127.0.0.1");
+	const env = resolveCliEnvironment();
+	const envAccessToken = !opts.force ? env.accessToken : void 0;
+	const envRefreshToken = !opts.force ? env.refreshToken : void 0;
+	if (envAccessToken || envRefreshToken) {
+		oauth2Client.setCredentials({
+			access_token: envAccessToken,
+			refresh_token: envRefreshToken
+		});
+		if (envRefreshToken) {
+			const { credentials: newTokens } = await oauth2Client.refreshAccessToken().catch(() => ({ credentials: null }));
+			if (newTokens) oauth2Client.setCredentials(newTokens);
+		}
+		return oauth2Client;
+	}
+	const existingTokens = !opts.force ? await loadTokens() : null;
+	let refreshFailed = false;
+	let refreshError = null;
+	if (existingTokens) {
+		oauth2Client.setCredentials(existingTokens);
+		if (existingTokens.expiry_date && existingTokens.expiry_date < Date.now()) {
+			const result = await oauth2Client.refreshAccessToken().then((r) => ({
+				credentials: r.credentials,
+				error: null
+			})).catch((e) => ({
+				credentials: null,
+				error: e
+			}));
+			if (result.credentials) {
+				await saveTokens(result.credentials);
+				oauth2Client.setCredentials(result.credentials);
+				if (interactive) logger.success("Token refreshed");
+				return oauth2Client;
+			}
+			refreshFailed = true;
+			refreshError = result.error;
+		} else {
+			if (interactive) logger.success("Using saved credentials");
+			return oauth2Client;
+		}
+	}
+	if (!interactive) {
+		if (refreshFailed) {
+			logger.error(`Token refresh failed${refreshError ? `: ${refreshError.message}` : ""}`);
+			logger.info("Refresh token may be revoked or expired. Run `gscdump auth login` to re-authenticate.");
+		} else {
+			logger.error("Not authenticated");
+			logger.info("Run `gscdump auth login` (or `gscdump init` for full setup).");
+		}
+		process.exit(1);
+	}
+	if (opts.noBrowser) {
+		const tokens = await authenticateDeviceCode(credentials);
+		oauth2Client.setCredentials(tokens);
+		await saveTokens(tokens);
+		logger.success(`Tokens saved to ${displayPath(getTokensPath())}`);
+		return oauth2Client;
+	}
+	const authUrl = oauth2Client.generateAuthUrl({
+		access_type: "offline",
+		scope: SCOPES,
+		prompt: "consent"
+	});
+	logger.info("Waiting for authorization...");
+	const { code, redirectUri } = await getAuthCodeViaLoopback(authUrl);
+	const { tokens } = await new OAuth2Client(credentials.clientId, credentials.clientSecret, redirectUri).getToken(code);
+	oauth2Client.setCredentials(tokens);
+	await saveTokens(tokens);
+	logger.success(`Tokens saved to ${displayPath(getTokensPath())}`);
+	return oauth2Client;
+}
+async function getAuth(opts = {}) {
+	const { interactive = true, noBrowser = false, force = false } = opts;
+	return authenticate(await getAuthCredentials(interactive), interactive, {
+		noBrowser,
+		force
+	});
+}
+async function resolveAuth(opts = {}) {
+	const sa = await resolveServiceAccount({ path: opts.serviceAccount });
+	if (sa) {
+		logger.success("Using service-account credentials");
+		return sa;
+	}
+	const byok = resolveBYOK(opts.byok);
+	if (byok) {
+		if (typeof byok !== "string") logger.success("Using BYOK credentials");
+		return byok;
+	}
+	return getAuth(opts);
+}
+function envSourceLabel(envVar) {
+	return getAppliedEnvKeys().has(envVar) ? `.env (${envVar})` : `shell env (${envVar})`;
+}
+function pickEnvSource(...envVars) {
+	return pickCliEnvironmentValue(envVars);
+}
+function redactCred(v, keepTail = 6) {
+	if (!v) return "<unset>";
+	if (v.length <= keepTail) return "***";
+	return `***${v.slice(-keepTail)}`;
+}
+async function describeAuthProvenance() {
+	const rows = [];
+	const warnings = [];
+	const env = resolveCliEnvironment();
+	const saEnvPath = env.serviceAccountPath;
+	const saConfigPath = !saEnvPath ? (await loadConfig().catch(() => null))?.serviceAccountPath : void 0;
+	const saPath = saEnvPath || saConfigPath;
+	if (saEnvPath) {
+		const saEnv = env.values.GSC_SERVICE_ACCOUNT_JSON ? "GSC_SERVICE_ACCOUNT_JSON" : "GOOGLE_APPLICATION_CREDENTIALS";
+		rows.push({
+			field: "service_account",
+			source: envSourceLabel(saEnv),
+			value: displayPath(saEnvPath)
+		});
+	} else if (saConfigPath) rows.push({
+		field: "service_account",
+		source: `${displayPath(`${getConfigDir()}/config.json`)}`,
+		value: displayPath(saConfigPath)
+	});
+	const clientId = pickEnvSource("GSC_CLIENT_ID", "GOOGLE_CLIENT_ID");
+	const clientSecret = pickEnvSource("GSC_CLIENT_SECRET", "GOOGLE_CLIENT_SECRET");
+	const config = await loadConfig().catch(() => null);
+	if (clientId) rows.push({
+		field: "client_id",
+		source: envSourceLabel(clientId.envVar),
+		value: clientId.value
+	});
+	else if (config?.clientId) rows.push({
+		field: "client_id",
+		source: `${displayPath(`${getConfigDir()}/config.json`)}`,
+		value: config.clientId
+	});
+	else rows.push({
+		field: "client_id",
+		source: "<none>",
+		value: null
+	});
+	if (clientSecret) rows.push({
+		field: "client_secret",
+		source: envSourceLabel(clientSecret.envVar),
+		value: redactCred(clientSecret.value)
+	});
+	else if (config?.clientSecret) rows.push({
+		field: "client_secret",
+		source: `${displayPath(`${getConfigDir()}/config.json`)}`,
+		value: redactCred(config.clientSecret)
+	});
+	else rows.push({
+		field: "client_secret",
+		source: "<none>",
+		value: null
+	});
+	const accessTok = pickEnvSource("GSC_ACCESS_TOKEN", "GOOGLE_ACCESS_TOKEN");
+	const refreshTok = pickEnvSource("GSC_REFRESH_TOKEN", "GOOGLE_REFRESH_TOKEN");
+	if (accessTok) rows.push({
+		field: "access_token",
+		source: envSourceLabel(accessTok.envVar),
+		value: redactCred(accessTok.value)
+	});
+	if (refreshTok) rows.push({
+		field: "refresh_token",
+		source: envSourceLabel(refreshTok.envVar),
+		value: redactCred(refreshTok.value)
+	});
+	const tokens = await loadTokens();
+	if (tokens) {
+		const expiry = tokens.expiry_date ? new Date(tokens.expiry_date).toISOString() : "no expiry";
+		rows.push({
+			field: "saved_tokens",
+			source: displayPath(getTokensPath()),
+			value: `access=${tokens.access_token ? "present" : "missing"}, refresh=${tokens.refresh_token ? "present" : "missing"}, expiry=${expiry}`
+		});
+	}
+	let effective;
+	if (saPath) effective = "service-account";
+	else if (clientId && clientSecret && refreshTok) effective = "byok-refresh-token";
+	else if (accessTok) effective = "byok-access-token";
+	else if (tokens) effective = "saved-tokens";
+	else effective = "none";
+	if ((effective === "byok-refresh-token" || effective === "byok-access-token") && tokens) warnings.push("BYOK env vars shadow saved tokens. If you just ran `auth login --force`, the env tokens are stale; unset them or update them.");
+	if (effective === "byok-refresh-token" && clientId && refreshTok) {
+		if (getAppliedEnvKeys().has(clientId.envVar) !== getAppliedEnvKeys().has(refreshTok.envVar)) warnings.push(`client_id and refresh_token come from different sources (${envSourceLabel(clientId.envVar)} vs ${envSourceLabel(refreshTok.envVar)}); they may not match.`);
+	}
+	const envFile = getLoadedEnvPath();
+	if (envFile && getAppliedEnvKeys().size > 0) warnings.push(`Loaded ${getAppliedEnvKeys().size} var(s) from ${displayPath(envFile)}.`);
+	return {
+		rows,
+		effective,
+		warnings
+	};
+}
+async function formatAuthProvenance() {
+	const { rows, effective, warnings } = await describeAuthProvenance();
+	const lines = [];
+	lines.push(`  \x1B[1mAuth config sources\x1B[0m \x1B[90m(effective: ${effective})\x1B[0m`);
+	for (const r of rows) {
+		const val = r.value ? ` \x1B[90m${r.value}\x1B[0m` : "";
+		lines.push(`    ${r.field.padEnd(16)} \x1B[36m${r.source}\x1B[0m${val}`);
+	}
+	if (warnings.length > 0) {
+		lines.push("");
+		for (const w of warnings) lines.push(`  \x1B[33m!\x1B[0m ${w}`);
+	}
+	return lines.join("\n");
+}
+function isAuthError(err) {
+	const msg = (err instanceof Error ? err.message : String(err ?? "")).toLowerCase();
+	if (!msg) return false;
+	return /\b(?:401|403|unauthorized|forbidden|invalid_grant|invalid_token|insufficient.*scope|invalid_client|token has been expired|token has been revoked)\b/.test(msg) || msg.includes("oauth2.googleapis.com/token");
+}
+export { authenticate, clearTokens, formatAuthProvenance, getAuth, getAuthCredentials, isAuthError, loadServiceAccount, loadTokens, resolveAuth, resolveBYOK, resolveServiceAccount, saveTokens };