@hexclave/cli 1.0.64 → 1.0.66

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hexclave/cli",
-  "version": "1.0.64",
+  "version": "1.0.66",
   "repository": "https://github.com/hexclave/hexclave",
   "description": "The CLI for Hexclave. https://hexclave.com",
   "main": "dist/index.js",
@@ -25,9 +25,9 @@
     "commander": "^13.1.0",
     "extract-zip": "^2.0.1",
     "jiti": "^2.4.2",
-    "@hexclave/shared-backend": "1.0.64",
-    "@hexclave/shared": "1.0.64",
-    "@hexclave/js": "1.0.64"
+    "@hexclave/shared-backend": "1.0.66",
+    "@hexclave/shared": "1.0.66",
+    "@hexclave/js": "1.0.66"
   },
   "devDependencies": {
     "@types/node": "20.17.6",

package/src/lib/app.test.ts

@@ -0,0 +1,68 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { AuthError } from "./errors.js";
+
+const { getUser } = vi.hoisted(() => ({
+  getUser: vi.fn(),
+}));
+
+vi.mock("@hexclave/js", () => ({
+  StackClientApp: class {
+    getUser = getUser;
+  },
+}));
+
+import { getInternalUser } from "./app.js";
+
+const auth = {
+  apiUrl: "https://api.hexclave.com",
+  dashboardUrl: "https://app.hexclave.com",
+  publishableClientKey: "pck_test",
+  refreshToken: "refresh-token",
+};
+
+describe("getInternalUser", () => {
+  beforeEach(() => {
+    getUser.mockReset();
+  });
+
+  it("throws a friendly auth error when there is no signed-in user", async () => {
+    getUser.mockResolvedValue(null);
+
+    const result = getInternalUser(auth);
+    await expect(result).rejects.toBeInstanceOf(AuthError);
+    await expect(result).rejects.toThrowErrorMatchingInlineSnapshot(
+      `[AuthError: Your session is invalid or expired. Run \`hexclave login\` again.]`,
+    );
+    await expect(result).rejects.not.toThrow("User is not signed in but getUser was called with");
+    expect(getUser).toHaveBeenCalledWith({ includeRestricted: true });
+  });
+
+  it("throws a friendly onboarding error for restricted users", async () => {
+    getUser.mockResolvedValue({ isRestricted: true });
+
+    const result = getInternalUser(auth);
+    await expect(result).rejects.toBeInstanceOf(AuthError);
+    await expect(result).rejects.toThrowErrorMatchingInlineSnapshot(
+      `[AuthError: Finish setting up your account at https://app.hexclave.com/onboarding before using the CLI.]`,
+    );
+  });
+
+  it("keeps the onboarding auth error friendly for malformed and nested dashboard URLs", async () => {
+    getUser.mockResolvedValue({ isRestricted: true });
+
+    const malformedResult = getInternalUser({ ...auth, dashboardUrl: "not-a-url" });
+    await expect(malformedResult).rejects.toBeInstanceOf(AuthError);
+    await expect(malformedResult).rejects.toThrowErrorMatchingInlineSnapshot(
+      `[AuthError: Finish setting up your account at not-a-url/onboarding before using the CLI.]`,
+    );
+
+    const nestedResult = getInternalUser({
+      ...auth,
+      dashboardUrl: "https://app.hexclave.com/console?tenant=one#settings",
+    });
+    await expect(nestedResult).rejects.toBeInstanceOf(AuthError);
+    await expect(nestedResult).rejects.toThrowErrorMatchingInlineSnapshot(
+      `[AuthError: Finish setting up your account at https://app.hexclave.com/console/onboarding before using the CLI.]`,
+    );
+  });
+});

package/src/lib/app.ts

@@ -1,8 +1,21 @@
 import { StackClientApp } from "@hexclave/js";
 import type { CurrentInternalUser, AdminOwnedProject } from "@hexclave/js";
+import { createUrlIfValid } from "@hexclave/shared/dist/utils/urls";
 import { AuthError } from "./errors.js";
 import type { SessionAuth, ProjectAuthWithRefreshToken } from "./auth.js";
 
+function onboardingUrlFor(dashboardUrl: string): string {
+  const parsedDashboardUrl = createUrlIfValid(dashboardUrl);
+  if (parsedDashboardUrl == null) {
+    // Configured dashboard URLs are unvalidated, so this fallback must not throw.
+    return `${dashboardUrl.replace(/\/+$/, "")}/onboarding`;
+  }
+  parsedDashboardUrl.pathname = `${parsedDashboardUrl.pathname.replace(/\/+$/, "")}/onboarding`;
+  parsedDashboardUrl.search = "";
+  parsedDashboardUrl.hash = "";
+  return parsedDashboardUrl.toString();
+}
+
 export function getInternalApp(auth: SessionAuth): StackClientApp<true, "internal"> {
   return new StackClientApp({
     projectId: "internal",
@@ -18,7 +31,15 @@ export function getInternalApp(auth: SessionAuth): StackClientApp<true, "interna
 
 export async function getInternalUser(auth: SessionAuth): Promise<CurrentInternalUser> {
   const app = getInternalApp(auth);
-  const user = await app.getUser({ or: "throw" });
+  // Avoid `or: "throw"` here: its internal error message leaked to CLI users
+  // and was reported as a fatal Sentry event instead of a normal auth error.
+  const user = await app.getUser({ includeRestricted: true });
+  if (user == null) {
+    throw new AuthError("Your session is invalid or expired. Run `hexclave login` again.");
+  }
+  if (user.isRestricted) {
+    throw new AuthError(`Finish setting up your account at ${onboardingUrlFor(auth.dashboardUrl)} before using the CLI.`);
+  }
   return user as CurrentInternalUser;
 }