@isaacthoman/pulpo 0.51.2 → 0.52.0

package/README.md

@@ -6,6 +6,9 @@ Operator-first command-line client for a Pulpo instance.
 npm install --global @isaacthoman/pulpo
 pulpo context add production --url https://pulpo.example.com
 pulpo auth login --email admin@example.com
+pulpo auth 2fa status
+pulpo auth 2fa setup
+pulpo auth 2fa confirm
 pulpo settings export --output pulpo-settings.json
 ```
 
@@ -32,6 +35,9 @@ lives in the platform config directory. Session tokens use Keychain on macOS or
 Secret Service on Linux when available, with a mode-`0600` file and warning as
 the fallback. Passwords are read from a hidden prompt, stdin, or
 `PULPO_PASSWORD`; no secret-bearing password/token option is accepted.
+Authenticator and recovery codes use the hidden prompt or `PULPO_2FA_CODE`.
+Enrollment secrets and recovery codes are printed only when created; store them
+securely before continuing.
 
 Settings exports use `apiVersion: pulpo.dev/management/v1` and carry an opaque
 revision. `settings diff` exits with status 2 when changes exist. A stale

package/dist/index.js

@@ -16304,7 +16304,8 @@ var userSchema = external_exports.object({
 });
 var loginInputSchema = external_exports.object({
   email: external_exports.email(),
-  password: external_exports.string().min(1).max(1024)
+  password: external_exports.string().min(1).max(1024),
+  twoFactorCode: external_exports.string().trim().min(6).max(32).optional()
 });
 var signupInputSchema = external_exports.object({
   name: external_exports.string().trim().min(1).max(120),
@@ -16344,9 +16345,34 @@ var mobileConfigSchema = external_exports.object({
     chatDuplication: external_exports.literal(true),
     publicSharing: external_exports.literal(true),
     attachments: external_exports.literal(true),
-    folders: external_exports.literal(true)
+    folders: external_exports.literal(true),
+    twoFactorAuth: external_exports.boolean().optional().default(false)
   })
 });
+var twoFactorStatusSchema = external_exports.object({
+  enabled: external_exports.boolean(),
+  recoveryCodesRemaining: external_exports.number().int().nonnegative()
+});
+var beginTwoFactorEnrollmentInputSchema = external_exports.object({
+  currentPassword: external_exports.string().min(1).max(1024),
+  verificationCode: external_exports.string().trim().min(6).max(32).optional()
+});
+var twoFactorEnrollmentSchema = external_exports.object({
+  manualKey: external_exports.string().min(16),
+  otpauthUri: external_exports.string().startsWith("otpauth://totp/"),
+  qrCodeDataUrl: external_exports.string().startsWith("data:image/"),
+  expiresAt: isoDateSchema
+});
+var confirmTwoFactorEnrollmentInputSchema = external_exports.object({
+  code: external_exports.string().trim().regex(/^\d{6}$/, "Enter a six-digit authenticator code")
+});
+var verifyTwoFactorChangeInputSchema = external_exports.object({
+  currentPassword: external_exports.string().min(1).max(1024),
+  verificationCode: external_exports.string().trim().min(6).max(32)
+});
+var twoFactorRecoveryCodesSchema = external_exports.object({
+  recoveryCodes: external_exports.array(external_exports.string()).length(10)
+});
 var updateProfileInputSchema = external_exports.object({
   name: external_exports.string().trim().min(1).max(120)
 });
@@ -17033,8 +17059,8 @@ var PulpoManagementClient = class {
   info() {
     return this.request("/api/management/v1/info");
   }
-  login(email3, password, deviceLabel = "Pulpo CLI") {
-    return this.request("/api/management/v1/auth/login", { method: "POST", body: { email: email3, password, deviceLabel } });
+  login(email3, password, deviceLabel = "Pulpo CLI", twoFactorCode) {
+    return this.request("/api/management/v1/auth/login", { method: "POST", body: { email: email3, password, deviceLabel, twoFactorCode } });
   }
   logout() {
     return this.request("/api/management/v1/auth/logout", { method: "POST" });
@@ -17042,6 +17068,21 @@ var PulpoManagementClient = class {
   me() {
     return this.request("/api/management/v1/auth/me");
   }
+  twoFactorStatus() {
+    return this.request("/api/me/two-factor");
+  }
+  beginTwoFactorEnrollment(input) {
+    return this.request("/api/me/two-factor/enrollment", { method: "POST", body: input });
+  }
+  confirmTwoFactorEnrollment(code) {
+    return this.request("/api/me/two-factor/enrollment/confirm", { method: "POST", body: { code } });
+  }
+  regenerateTwoFactorRecoveryCodes(input) {
+    return this.request("/api/me/two-factor/recovery-codes", { method: "POST", body: input });
+  }
+  disableTwoFactor(input) {
+    return this.request("/api/me/two-factor", { method: "DELETE", body: input });
+  }
   tokens() {
     return this.request("/api/management/v1/tokens");
   }
@@ -17344,7 +17385,7 @@ async function confirmExact(io, expected, yes, json2) {
 }
 
 // src/index.ts
-var CLI_VERSION = true ? "0.51.2" : "0.1.0";
+var CLI_VERSION = true ? "0.52.0" : "0.1.0";
 var CLI_BUNDLED = true;
 var commandIo = /* @__PURE__ */ new WeakMap();
 var commandClientFactory = /* @__PURE__ */ new WeakMap();
@@ -17464,7 +17505,31 @@ async function clientFor(command, authenticated = true) {
   if (capability && !info.capabilities.includes(capability)) {
     throw new Error(`The selected Pulpo instance does not advertise the ${capability} capability`);
   }
-  return { client, contextName: connection.contextName, context: connection.context };
+  return { client, contextName: connection.contextName, context: connection.context, info };
+}
+async function twoFactorSecret(io, json2, prompt = "Authenticator or recovery code: ") {
+  const value = process.env.PULPO_2FA_CODE;
+  if (value !== void 0) return value;
+  if (!io.stdin.isTTY) throw new Error("Noninteractive two-factor verification requires PULPO_2FA_CODE");
+  if (json2) throw new Error("Machine-mode two-factor verification requires PULPO_2FA_CODE");
+  return readSecret(io, prompt);
+}
+async function currentPassword(io, json2) {
+  const value = process.env.PULPO_PASSWORD;
+  if (value !== void 0) return value;
+  if (!io.stdin.isTTY) throw new Error("Noninteractive account security changes require PULPO_PASSWORD");
+  if (json2) throw new Error("Machine-mode account security changes require PULPO_PASSWORD");
+  return readSecret(io, "Current password: ");
+}
+function requireTwoFactorCapability(info) {
+  if (!info.capabilities.includes("twoFactor")) throw new Error("The selected Pulpo instance does not support two-factor authentication");
+}
+function emitRecoveryCodes(io, command, recoveryCodes) {
+  io.stderr.write("Save these recovery codes now. They will not be shown again.\n");
+  if (globalOptions(command).json) emit(io, command, { recoveryCodes });
+  else {
+    writeOutput(io, recoveryCodes.map((recoveryCode) => ({ recoveryCode })), false);
+  }
 }
 function emit(io, command, value) {
   writeOutput(io, value, Boolean(globalOptions(command).json));
@@ -17563,7 +17628,14 @@ function createProgram(io = processIo, dependencies = {}) {
       throw new Error("Machine-mode login requires the password on stdin or in PULPO_PASSWORD");
     }
     const password = process.env.PULPO_PASSWORD ?? await readSecret(io, "Password: ");
-    const result = await client.login(email3, password);
+    let result;
+    try {
+      result = await client.login(email3, password);
+    } catch (error51) {
+      if (!(error51 instanceof ManagementApiError) || error51.code !== "two_factor_required") throw error51;
+      const code = await twoFactorSecret(io, Boolean(globalOptions(command).json));
+      result = await client.login(email3, password, "Pulpo CLI", code);
+    }
     await setCredential(contextName, result.session.token, (message) => io.stderr.write(`${message}
 `));
     const config2 = await loadConfig();
@@ -17581,6 +17653,48 @@ function createProgram(io = processIo, dependencies = {}) {
     const { client } = await clientFor(command);
     emit(io, command, await client.me());
   });
+  const twoFactor = auth.command("2fa").description("Manage authenticator-app two-factor authentication");
+  twoFactor.command("status").action(async (_options, command) => {
+    const { client, info } = await clientFor(command);
+    requireTwoFactorCapability(info);
+    emit(io, command, await client.twoFactorStatus());
+  });
+  twoFactor.command("setup").description("Start or replace authenticator enrollment").action(async (_options, command) => {
+    const { client, info } = await clientFor(command);
+    requireTwoFactorCapability(info);
+    const status = await client.twoFactorStatus();
+    const password = await currentPassword(io, Boolean(globalOptions(command).json));
+    const verificationCode = status.enabled ? await twoFactorSecret(io, Boolean(globalOptions(command).json), "Current authenticator or recovery code: ") : void 0;
+    const enrollment = await client.beginTwoFactorEnrollment({ currentPassword: password, verificationCode });
+    io.stderr.write("Save this enrollment secret now. It will not be shown again.\n");
+    if (globalOptions(command).json) emit(io, command, enrollment);
+    else {
+      io.stderr.write("Add this account to your authenticator, then run `pulpo auth 2fa confirm`.\n");
+      writeOutput(io, [{ manualKey: enrollment.manualKey, otpauthUri: enrollment.otpauthUri, expiresAt: enrollment.expiresAt }], false);
+    }
+  });
+  twoFactor.command("confirm").description("Confirm a pending enrollment").action(async (_options, command) => {
+    const { client, info } = await clientFor(command);
+    requireTwoFactorCapability(info);
+    const code = await twoFactorSecret(io, Boolean(globalOptions(command).json), "New six-digit authenticator code: ");
+    emitRecoveryCodes(io, command, (await client.confirmTwoFactorEnrollment(code)).recoveryCodes);
+  });
+  twoFactor.command("regenerate-recovery-codes").description("Replace all recovery codes").action(async (_options, command) => {
+    const { client, info } = await clientFor(command);
+    requireTwoFactorCapability(info);
+    const password = await currentPassword(io, Boolean(globalOptions(command).json));
+    const verificationCode = await twoFactorSecret(io, Boolean(globalOptions(command).json));
+    emitRecoveryCodes(io, command, (await client.regenerateTwoFactorRecoveryCodes({ currentPassword: password, verificationCode })).recoveryCodes);
+  });
+  twoFactor.command("disable").description("Disable two-factor authentication").action(async (_options, command) => {
+    await confirmExact(io, "DISABLE", Boolean(globalOptions(command).yes), Boolean(globalOptions(command).json));
+    const { client, info } = await clientFor(command);
+    requireTwoFactorCapability(info);
+    const password = await currentPassword(io, Boolean(globalOptions(command).json));
+    const verificationCode = await twoFactorSecret(io, Boolean(globalOptions(command).json));
+    await client.disableTwoFactor({ currentPassword: password, verificationCode });
+    emit(io, command, { enabled: false });
+  });
   const token = program.command("token").description("Manage scoped automation tokens");
   token.command("list").action(async (_options, command) => {
     const { client } = await clientFor(command);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@isaacthoman/pulpo",
-  "version": "0.51.2",
+  "version": "0.52.0",
   "description": "Operator-first command-line client for Pulpo",
   "type": "module",
   "bin": {