@happier-dev/stack 0.1.0-preview.5.1

package/scripts/utils/auth/orchestrated_stack_auth_flow.mjs

@@ -0,0 +1,291 @@
+import { join } from 'node:path';
+
+import { createStepPrinter } from '../cli/progress.mjs';
+import { createFileLogForwarder } from '../cli/log_forwarder.mjs';
+import { getComponentDir, resolveStackEnvPath } from '../paths/paths.mjs';
+import { getStackRuntimeStatePath, isPidAlive, readStackRuntimeStateFile } from '../stack/runtime_state.mjs';
+import { readEnvObjectFromFile } from '../env/read.mjs';
+import { getWebappUrlEnvOverride, resolveServerUrls } from '../server/urls.mjs';
+import { readLastLines } from '../fs/tail.mjs';
+import { run } from '../proc/proc.mjs';
+
+import { guidedStackAuthLoginNow, assertExpoWebappBundlesOrThrow, resolveStackWebappUrlForAuth } from './stack_guided_login.mjs';
+import { checkDaemonState, startLocalDaemonWithAuth } from '../../daemon.mjs';
+
+function appendCauseText(baseMessage, cause) {
+  const msg = String(baseMessage ?? '').trim();
+  const c = String(cause ?? '').trim();
+  if (!c) return msg;
+  return `${msg}\n\n[auth] Cause: ${c}`;
+}
+
+async function appendRunnerLogTailDiagnostics({ message, stackName, lines = 140 }) {
+  const base = String(message ?? '').trim();
+  const logPath = await resolveRunnerLogPathFromRuntime({ stackName, waitMs: 1000, pollMs: 100 }).catch(() => '');
+  if (!logPath) return base;
+  const tail = await readLastLines(logPath, lines).catch(() => null);
+  if (!tail || !String(tail).trim()) {
+    return `${base}\n\n[auth] Stack runner log: ${logPath}`;
+  }
+  return `${base}\n\n[auth] Stack runner log: ${logPath}\n\n[auth] Last runner log lines:\n${String(tail).trimEnd()}`;
+}
+
+async function tryStartStackUiInBackgroundForAuth({ rootDir, stackName, env = process.env } = {}) {
+  const name = String(stackName ?? '').trim() || 'main';
+  try {
+    await run(
+      process.execPath,
+      [join(rootDir, 'scripts', 'stack.mjs'), 'dev', name, '--background', '--no-daemon', '--no-browser'],
+      {
+        cwd: rootDir,
+        env: {
+          ...process.env,
+          ...(env ?? {}),
+          HAPPIER_STACK_AUTH_FLOW: '1',
+        },
+      }
+    );
+    return { ok: true };
+  } catch (e) {
+    return {
+      ok: false,
+      error: e instanceof Error ? e.message : String(e),
+    };
+  }
+}
+
+export async function resolveRunnerLogPathFromRuntime({ stackName, waitMs = 10_000, pollMs = 200 } = {}) {
+  const name = String(stackName ?? '').trim() || 'main';
+  const runtimeStatePath = getStackRuntimeStatePath(name);
+  const deadline = Date.now() + (Number.isFinite(Number(waitMs)) ? Number(waitMs) : 10_000);
+
+  while (Date.now() < deadline) {
+    // eslint-disable-next-line no-await-in-loop
+    const st = await readStackRuntimeStateFile(runtimeStatePath);
+    // Returning '' here is intentional: log forwarding is optional best-effort telemetry.
+    // Callers must treat this as "no runner log available", not as a hard failure.
+    const ownerPid = Number(st?.ownerPid);
+    if (Number.isFinite(ownerPid) && ownerPid > 1 && !isPidAlive(ownerPid)) return '';
+    const logPath = String(st?.logs?.runner ?? '').trim();
+    if (logPath) return logPath;
+    // eslint-disable-next-line no-await-in-loop
+    await new Promise((r) => setTimeout(r, pollMs));
+  }
+
+  return '';
+}
+
+export async function prepareGuidedLoginWebapp({ rootDir, stackName, env, steps } = {}) {
+  const name = String(stackName ?? '').trim() || 'main';
+  const label = 'prepare login (waiting for web UI)';
+  const printer = steps && typeof steps.start === 'function' && typeof steps.stop === 'function' ? steps : null;
+
+  if (printer) printer.start(label);
+  try {
+    const resolveAndAssert = async () => {
+      const webappUrl = await resolveStackWebappUrlForAuth({ rootDir, stackName: name, env });
+      await assertExpoWebappBundlesOrThrow({ rootDir, stackName: name, webappUrl });
+      return webappUrl;
+    };
+
+    try {
+      const webappUrl = await resolveAndAssert();
+      if (printer) printer.stop('✓', label);
+      return webappUrl;
+    } catch (initialErr) {
+      const recovery = await tryStartStackUiInBackgroundForAuth({
+        rootDir,
+        stackName: name,
+        env,
+      });
+      if (recovery.ok) {
+        try {
+          const webappUrl = await resolveAndAssert();
+          if (printer) printer.stop('✓', label);
+          return webappUrl;
+        } catch (retryErr) {
+          const enriched = await appendRunnerLogTailDiagnostics({
+            stackName: name,
+            message: appendCauseText(
+              '[auth] attempted to start stack UI in background, but guided login web UI is still not ready.',
+              retryErr instanceof Error ? retryErr.message : String(retryErr)
+            ),
+          });
+          throw new Error(enriched);
+        }
+      }
+      const enriched = await appendRunnerLogTailDiagnostics({
+        stackName: name,
+        message: appendCauseText(
+          '[auth] attempted to start stack UI in background, but startup failed.',
+          recovery.error || (initialErr instanceof Error ? initialErr.message : String(initialErr))
+        ),
+      });
+      throw new Error(enriched);
+    }
+  } catch (e) {
+    if (printer) printer.stop('x', label);
+    throw e;
+  }
+}
+
+export async function runGuidedLogin({ rootDir, stackName, env, webappUrl, forwarder } = {}) {
+  const name = String(stackName ?? '').trim() || 'main';
+  const url = String(webappUrl ?? '').trim();
+  if (!url) {
+    throw new Error('[auth] guided login requires a webappUrl');
+  }
+
+  try {
+    forwarder?.pause?.();
+  } catch {
+    // ignore
+  }
+  try {
+    await guidedStackAuthLoginNow({
+      rootDir,
+      stackName: name,
+      env: { ...(env ?? process.env), HAPPIER_STACK_AUTH_SKIP_BUNDLE_CHECK: '1' },
+      webappUrl: url,
+    });
+  } finally {
+    try {
+      forwarder?.resume?.();
+    } catch {
+      // ignore
+    }
+  }
+}
+
+export async function resolveServerPortForPostAuthDaemonStart({ stackName, env = process.env } = {}) {
+  const name = String(stackName ?? '').trim() || 'main';
+  const runtimeStatePath = getStackRuntimeStatePath(name);
+  const st = await readStackRuntimeStateFile(runtimeStatePath);
+  const runtimePort = Number(st?.ports?.server);
+  const ownerPid = Number(st?.ownerPid);
+  const runtimeOwnerAlive = !Number.isFinite(ownerPid) || ownerPid <= 1 || isPidAlive(ownerPid);
+  if (runtimeOwnerAlive && Number.isFinite(runtimePort) && runtimePort > 0) {
+    return runtimePort;
+  }
+
+  const envPort = Number((env?.HAPPIER_STACK_SERVER_PORT ?? '').toString().trim());
+  if (Number.isFinite(envPort) && envPort > 0) {
+    return envPort;
+  }
+
+  throw new Error('[auth] post-auth daemon start failed: could not resolve server port from stack.runtime.json');
+}
+
+export async function startDaemonPostAuth({
+  rootDir,
+  stackName,
+  env = process.env,
+  forceRestart = true,
+  webappUrl = '',
+} = {}) {
+  const name = String(stackName ?? '').trim() || 'main';
+  const serverPort = await resolveServerPortForPostAuthDaemonStart({ stackName: name, env });
+
+  const { envPath, baseDir } = resolveStackEnvPath(name, env);
+  const stackEnv = await readEnvObjectFromFile(envPath);
+  const mergedEnv = { ...process.env, ...(stackEnv ?? {}), ...(env ?? {}) };
+
+  const cliHomeDir =
+    (mergedEnv.HAPPIER_STACK_CLI_HOME_DIR ?? '').toString().trim() ||
+    join(baseDir, 'cli');
+  const cliDir = getComponentDir(rootDir, 'happier-cli', mergedEnv);
+  const cliBin = join(cliDir, 'bin', 'happier.mjs');
+
+  const internalServerUrl = `http://127.0.0.1:${serverPort}`;
+  const explicitWebappUrl = String(webappUrl ?? '').trim();
+  const { publicServerUrl: resolvedPublicServerUrl } = await resolveServerUrls({
+    env: mergedEnv,
+    serverPort,
+    allowEnable: false,
+  });
+  const { envWebappUrl } = getWebappUrlEnvOverride({ env: mergedEnv, stackName: name });
+  const publicServerUrl = explicitWebappUrl || envWebappUrl || resolvedPublicServerUrl;
+
+  await startLocalDaemonWithAuth({
+    cliBin,
+    cliHomeDir,
+    internalServerUrl,
+    publicServerUrl,
+    isShuttingDown: () => false,
+    forceRestart: Boolean(forceRestart),
+    env: mergedEnv,
+    stackName: name,
+  });
+
+  // Verify (best-effort): daemon wrote state.
+  const deadline = Date.now() + 10_000;
+  while (Date.now() < deadline) {
+    const s = checkDaemonState(cliHomeDir, { serverUrl: internalServerUrl, env: mergedEnv });
+    if (s.status === 'running') {
+      return {
+        ok: true,
+        cliHomeDir,
+        internalServerUrl,
+        publicServerUrl,
+        pid: s.pid,
+      };
+    }
+    // eslint-disable-next-line no-await-in-loop
+    await new Promise((r) => setTimeout(r, 250));
+  }
+  return {
+    ok: false,
+    cliHomeDir,
+    internalServerUrl,
+    publicServerUrl,
+    pid: null,
+    error: '[auth] post-auth daemon start verification timed out (daemon did not report running)',
+  };
+}
+
+export async function runOrchestratedGuidedAuthFlow({
+  rootDir,
+  stackName,
+  env = process.env,
+  verbosity = 0,
+  json = false,
+  webappUrl = '',
+} = {}) {
+  const name = String(stackName ?? '').trim() || 'main';
+
+  const steps = createStepPrinter({ enabled: Boolean(process.stdout.isTTY && !json) });
+
+  let forwarder = null;
+  if (!json && verbosity > 0) {
+    try {
+      const logPath = await resolveRunnerLogPathFromRuntime({ stackName: name, waitMs: 10_000 });
+      if (logPath) {
+        forwarder = createFileLogForwarder({
+          path: logPath,
+          enabled: true,
+          label: 'stack',
+          startFromEnd: false,
+        });
+        await forwarder.start();
+      }
+    } catch {
+      forwarder = null;
+    }
+  }
+
+  let resolved = String(webappUrl ?? '').trim();
+  try {
+    if (!resolved) {
+      resolved = await prepareGuidedLoginWebapp({ rootDir, stackName: name, env, steps });
+    }
+    await runGuidedLogin({ rootDir, stackName: name, env, webappUrl: resolved, forwarder });
+  } finally {
+    try {
+      await forwarder?.stop?.();
+    } catch {
+      // ignore
+    }
+  }
+
+  return { ok: true, webappUrl: resolved };
+}

package/scripts/utils/auth/sources.mjs

@@ -0,0 +1,28 @@
+import { join } from 'node:path';
+import { existsSync } from 'node:fs';
+
+import { resolveStackEnvPath } from '../paths/paths.mjs';
+import { findAnyCredentialPathInCliHome } from './credentials_paths.mjs';
+
+export function stackHasAccessKey(stackName) {
+  try {
+    const { baseDir, envPath } = resolveStackEnvPath(stackName);
+    if (!existsSync(envPath)) return false;
+    return Boolean(findAnyCredentialPathInCliHome({ cliHomeDir: join(baseDir, 'cli') }));
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Seed sources that are safe to reuse locally.
+ *
+ * Note: deliberately does NOT include legacy ~/.happy sources; in many contexts we cannot reliably
+ * seed DB Account rows, which leads to broken stacks.
+ */
+export function detectSeedableAuthSources() {
+  const out = [];
+  if (stackHasAccessKey('dev-auth')) out.push('dev-auth');
+  if (stackHasAccessKey('main')) out.push('main');
+  return out;
+}

package/scripts/utils/auth/stable_scope_id.mjs

@@ -0,0 +1,91 @@
+const SERVER_ID_SAFE_RE = /^[A-Za-z0-9._-]{1,64}$/;
+
+function isScopeIdSafe(raw) {
+  const value = String(raw ?? '').trim();
+  if (!value) return false;
+  if (value === '.' || value === '..') return false;
+  if (value.includes('/') || value.includes('\\')) return false;
+  return SERVER_ID_SAFE_RE.test(value);
+}
+
+function normalizeScopePart(raw, fallback) {
+  const base = String(raw ?? '')
+    .trim()
+    .toLowerCase()
+    .replace(/[^a-z0-9._-]+/g, '-')
+    .replace(/-+/g, '-')
+    .replace(/^[-._]+/, '')
+    .replace(/[-._]+$/, '');
+  return base || fallback;
+}
+
+function hashFNV1a32(value) {
+  const text = String(value ?? '');
+  let h = 2166136261;
+  for (let i = 0; i < text.length; i += 1) {
+    h ^= text.charCodeAt(i);
+    h = Math.imul(h, 16777619);
+  }
+  return (h >>> 0).toString(16);
+}
+
+function clipPart(value, maxLength) {
+  const v = String(value ?? '').trim();
+  if (!v) return '';
+  if (v.length <= maxLength) return v;
+  return v.slice(0, maxLength).replace(/[-._]+$/, '');
+}
+
+export function buildStackStableScopeId({ stackName = 'main', cliIdentity = 'default' } = {}) {
+  const stack = normalizeScopePart(stackName, 'main');
+  const identity = normalizeScopePart(cliIdentity, 'default');
+
+  const base = `stack_${stack}__id_${identity}`;
+  if (isScopeIdSafe(base)) return base;
+
+  const hash = hashFNV1a32(`${stack}::${identity}`);
+  const stackShort = clipPart(stack, 20) || 'main';
+  const identityShort = clipPart(identity, 20) || 'default';
+  const compact = `stack_${stackShort}__id_${identityShort}__${hash}`;
+  if (isScopeIdSafe(compact)) return compact;
+
+  const fallback = `stack_${hash}`;
+  return isScopeIdSafe(fallback) ? fallback : 'cloud';
+}
+
+export function isStableScopeDisabled(env = process.env) {
+  const raw = String(env?.HAPPIER_STACK_DISABLE_STABLE_SCOPE ?? '').trim().toLowerCase();
+  return raw === '1' || raw === 'true' || raw === 'yes' || raw === 'y';
+}
+
+export function resolveStackActiveServerId({ env = process.env, stackName = null, cliIdentity = null } = {}) {
+  if (isStableScopeDisabled(env)) return '';
+  const explicit = String(env?.HAPPIER_ACTIVE_SERVER_ID ?? '').trim();
+  const inStackContext =
+    Boolean((stackName ?? '').toString().trim()) ||
+    Boolean((cliIdentity ?? '').toString().trim()) ||
+    Boolean((env?.HAPPIER_STACK_STACK ?? '').toString().trim()) ||
+    Boolean((env?.HAPPIER_STACK_CLI_IDENTITY ?? '').toString().trim());
+  if (!inStackContext && isScopeIdSafe(explicit)) return explicit;
+
+  const name =
+    (stackName ?? '').toString().trim() ||
+    (env?.HAPPIER_STACK_STACK ?? '').toString().trim() ||
+    'main';
+  const identity =
+    (cliIdentity ?? '').toString().trim() ||
+    (env?.HAPPIER_STACK_CLI_IDENTITY ?? '').toString().trim() ||
+    'default';
+  return buildStackStableScopeId({ stackName: name, cliIdentity: identity });
+}
+
+export function applyStackActiveServerScopeEnv({ env = process.env, stackName = null, cliIdentity = null } = {}) {
+  const base = { ...(env ?? {}) };
+  const activeServerId = resolveStackActiveServerId({ env: base, stackName, cliIdentity });
+  if (!activeServerId) {
+    delete base.HAPPIER_ACTIVE_SERVER_ID;
+    return base;
+  }
+  base.HAPPIER_ACTIVE_SERVER_ID = activeServerId;
+  return base;
+}

package/scripts/utils/auth/stable_scope_id.test.mjs

@@ -0,0 +1,51 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+
+import {
+  applyStackActiveServerScopeEnv,
+  buildStackStableScopeId,
+  resolveStackActiveServerId,
+} from './stable_scope_id.mjs';
+
+test('buildStackStableScopeId is deterministic for stack + identity', () => {
+  const a = buildStackStableScopeId({ stackName: 'main', cliIdentity: 'default' });
+  const b = buildStackStableScopeId({ stackName: 'main', cliIdentity: 'default' });
+  assert.equal(a, b);
+  assert.equal(a, 'stack_main__id_default');
+});
+
+test('buildStackStableScopeId isolates identities within the same stack', () => {
+  const a = buildStackStableScopeId({ stackName: 'dev-auth', cliIdentity: 'default' });
+  const b = buildStackStableScopeId({ stackName: 'dev-auth', cliIdentity: 'account-b' });
+  assert.notEqual(a, b);
+});
+
+test('resolveStackActiveServerId honors explicit env override when enabled', () => {
+  const env = { HAPPIER_ACTIVE_SERVER_ID: 'custom_scope_1' };
+  const id = resolveStackActiveServerId({ env, stackName: null, cliIdentity: null });
+  assert.equal(id, 'custom_scope_1');
+});
+
+test('applyStackActiveServerScopeEnv overwrites leaked active server id for stack scope', () => {
+  const env = {
+    HAPPIER_ACTIVE_SERVER_ID: 'stack_other__id_default',
+  };
+  const next = applyStackActiveServerScopeEnv({ env, stackName: 'dev-auth', cliIdentity: 'default' });
+  assert.equal(next.HAPPIER_ACTIVE_SERVER_ID, 'stack_dev-auth__id_default');
+});
+
+test('applyStackActiveServerScopeEnv unsets active scope when stable scope is disabled', () => {
+  const env = {
+    HAPPIER_STACK_STACK: 'main',
+    HAPPIER_STACK_DISABLE_STABLE_SCOPE: '1',
+    HAPPIER_ACTIVE_SERVER_ID: 'stack_main__id_default',
+  };
+  const next = applyStackActiveServerScopeEnv({ env, stackName: 'main', cliIdentity: 'default' });
+  assert.equal(next.HAPPIER_ACTIVE_SERVER_ID, undefined);
+});
+
+test('applyStackActiveServerScopeEnv sets generated stable scope id by default', () => {
+  const env = { HAPPIER_STACK_STACK: 'feature-123' };
+  const next = applyStackActiveServerScopeEnv({ env, stackName: 'feature-123', cliIdentity: 'account-b' });
+  assert.equal(next.HAPPIER_ACTIVE_SERVER_ID, 'stack_feature-123__id_account-b');
+});