@kora-platform/cli 0.8.0-rc1 → 0.8.0-rc10

package/dist/session-store.js

@@ -1,5 +1,10 @@
+import { mkdir, open, rm, stat } from "node:fs/promises";
+import { dirname } from "node:path";
 import { readSessionFile, removeSessionFile, writeSessionFile } from "./session.js";
+const REFRESH_LOCK_STALE_MS = 30_000;
+const REFRESH_LOCK_RETRY_MS = 25;
 export function createFileSessionStore(path) {
+    const refreshLockPath = `${path}.refresh.lock`;
     return {
         async clear() {
             await removeSessionFile(path);
@@ -9,11 +14,15 @@ export function createFileSessionStore(path) {
         },
         async write(session) {
             await writeSessionFile(path, session);
+        },
+        async withRefreshLock(operation) {
+            return withFileRefreshLock(refreshLockPath, operation);
         }
     };
 }
 export function createMemorySessionStore(initial = null) {
     let current = initial;
+    let refreshLock = Promise.resolve();
     return {
         async clear() {
             current = null;
@@ -23,6 +32,77 @@ export function createMemorySessionStore(initial = null) {
         },
         async write(session) {
             current = session;
+        },
+        async withRefreshLock(operation) {
+            const previous = refreshLock;
+            let release;
+            refreshLock = new Promise((resolve) => {
+                release = resolve;
+            });
+            await previous;
+            try {
+                return await operation();
+            }
+            finally {
+                release();
+            }
         }
     };
 }
+async function withFileRefreshLock(lockPath, operation) {
+    const release = await acquireFileRefreshLock(lockPath);
+    try {
+        return await operation();
+    }
+    finally {
+        await release();
+    }
+}
+async function acquireFileRefreshLock(lockPath) {
+    await mkdir(dirname(lockPath), { recursive: true });
+    while (true) {
+        try {
+            const handle = await open(lockPath, "wx", 0o600);
+            try {
+                await handle.writeFile(`${String(process.pid)} ${new Date().toISOString()}\n`);
+            }
+            finally {
+                await handle.close();
+            }
+            return async () => {
+                await rm(lockPath, { force: true });
+            };
+        }
+        catch (error) {
+            if (!isFileExistsError(error)) {
+                throw error;
+            }
+            await removeStaleFileRefreshLock(lockPath);
+            await sleep(REFRESH_LOCK_RETRY_MS);
+        }
+    }
+}
+async function removeStaleFileRefreshLock(lockPath) {
+    try {
+        const fileStat = await stat(lockPath);
+        if (Date.now() - fileStat.mtimeMs > REFRESH_LOCK_STALE_MS) {
+            await rm(lockPath, { force: true });
+        }
+    }
+    catch (error) {
+        if (!isMissingFileError(error)) {
+            throw error;
+        }
+    }
+}
+async function sleep(ms) {
+    await new Promise((resolve) => {
+        setTimeout(resolve, ms);
+    });
+}
+function isFileExistsError(error) {
+    return Boolean(error && typeof error === "object" && "code" in error && error.code === "EEXIST");
+}
+function isMissingFileError(error) {
+    return Boolean(error && typeof error === "object" && "code" in error && error.code === "ENOENT");
+}

package/dist/transport-refresh.d.ts

@@ -0,0 +1,10 @@
+import type { CliSessionState } from "./session.js";
+import type { SessionStore } from "./transport.js";
+export declare function refreshSessionWithCoordination(input: {
+    isRefreshTokenInvalidError: (error: unknown) => boolean;
+    refreshSessionDirect: (session: CliSessionState) => Promise<CliSessionState>;
+    session: CliSessionState;
+    sessionStore: SessionStore;
+    shouldRefresh: (session: CliSessionState) => boolean;
+}): Promise<CliSessionState>;
+export declare function resolveEffectiveSession(requestSession: CliSessionState | null, sessionStore: SessionStore): Promise<CliSessionState | null>;

package/dist/transport-refresh.js

@@ -0,0 +1,51 @@
+export async function refreshSessionWithCoordination(input) {
+    return withRefreshLock(input.sessionStore, async () => {
+        const effectiveSession = (await resolveEffectiveSession(input.session, input.sessionStore)) ?? input.session;
+        if (isSessionNewer(effectiveSession, input.session) && !input.shouldRefresh(effectiveSession)) {
+            return effectiveSession;
+        }
+        try {
+            return await input.refreshSessionDirect(effectiveSession);
+        }
+        catch (error) {
+            if (input.isRefreshTokenInvalidError(error)) {
+                const recoveredSession = await resolveEffectiveSession(input.session, input.sessionStore);
+                if (recoveredSession &&
+                    isSessionNewer(recoveredSession, input.session) &&
+                    !input.shouldRefresh(recoveredSession)) {
+                    return recoveredSession;
+                }
+            }
+            throw error;
+        }
+    });
+}
+async function withRefreshLock(sessionStore, operation) {
+    return sessionStore.withRefreshLock
+        ? sessionStore.withRefreshLock(operation)
+        : operation();
+}
+export async function resolveEffectiveSession(requestSession, sessionStore) {
+    if (!requestSession) {
+        return null;
+    }
+    const storedSession = await sessionStore.read();
+    if (!storedSession || !isSameSessionIdentity(storedSession, requestSession)) {
+        return requestSession;
+    }
+    return isSessionNewer(storedSession, requestSession) ? storedSession : requestSession;
+}
+function isSameSessionIdentity(candidate, current) {
+    return candidate.baseUrl === current.baseUrl
+        && candidate.user.id === current.user.id
+        && candidate.accessTokenPayload.sub === current.accessTokenPayload.sub;
+}
+function isSessionNewer(candidate, current) {
+    if (candidate.accessToken === current.accessToken && candidate.refreshToken === current.refreshToken) {
+        return false;
+    }
+    if (candidate.accessTokenPayload.exp !== current.accessTokenPayload.exp) {
+        return candidate.accessTokenPayload.exp > current.accessTokenPayload.exp;
+    }
+    return candidate.accessTokenPayload.iat >= current.accessTokenPayload.iat;
+}

package/dist/transport.d.ts

@@ -2,6 +2,7 @@ import { type CliSessionState } from "./session.js";
 export interface SessionStore {
     clear(): Promise<void>;
     read(): Promise<CliSessionState | null>;
+    withRefreshLock?<T>(operation: () => Promise<T>): Promise<T>;
     write(session: CliSessionState): Promise<void>;
 }
 export interface CliAuthSettings {
@@ -10,6 +11,19 @@ export interface CliAuthSettings {
     oidcEnabled: boolean;
     selfServiceOrgCreationEnabled: boolean;
 }
+export interface CliDeviceLoginStart {
+    deviceCode: string;
+    expiresAt: string;
+    pollIntervalSeconds: number;
+    userCode: string;
+    verificationPath: string;
+}
+export type CliDeviceLoginClaim = {
+    session: CliSessionState;
+    status: "approved";
+} | {
+    status: "denied" | "expired" | "pending";
+};
 export type ApiErrorDetails = Record<string, unknown>;
 type RequestBody = unknown | ((session: CliSessionState) => unknown);
 type BytesRequest = {
@@ -26,6 +40,7 @@ type BytesRequest = {
     validateHeaders?: (headers: Headers) => void;
 };
 export declare class ApiError extends Error {
+    readonly code: string;
     readonly detail: string;
     readonly details?: ApiErrorDetails;
     readonly instance: string;
@@ -34,6 +49,7 @@ export declare class ApiError extends Error {
     readonly title: string;
     readonly type: string;
     constructor(input: {
+        code?: string;
         detail: string;
         details?: ApiErrorDetails;
         instance: string;
@@ -59,6 +75,11 @@ export declare function createPlatformTransport(input: {
         name: string;
         password: string;
     }): Promise<CliSessionState>;
+    startDeviceLogin(baseUrl: string): Promise<CliDeviceLoginStart>;
+    claimDeviceLogin(claim: {
+        baseUrl: string;
+        deviceCode: string;
+    }): Promise<CliDeviceLoginClaim>;
     refreshSession(session: CliSessionState): Promise<CliSessionState>;
     requestJson<T>(request: {
         body?: RequestBody;

package/dist/transport.js

@@ -1,5 +1,8 @@
+import { normalizePublicErrorCode, readPublicErrorCodeFromType } from "./error-code.js";
 import { extractRefreshTokenFromHeaders } from "./session.js";
+import { refreshSessionWithCoordination, resolveEffectiveSession } from "./transport-refresh.js";
 export class ApiError extends Error {
+    code;
     detail;
     details;
     instance;
@@ -10,6 +13,7 @@ export class ApiError extends Error {
     constructor(input) {
         super(input.detail);
         this.name = "ApiError";
+        this.code = normalizePublicErrorCode(input.code ?? readPublicErrorCodeFromType(input.type));
         this.detail = input.detail;
         if (input.details) {
             this.details = input.details;
@@ -25,6 +29,13 @@ export class ApiError extends Error {
 }
 export function createPlatformTransport(input) {
     const now = input.now ?? Date.now;
+    const refreshSession = async (session) => refreshSessionWithCoordination({
+        isRefreshTokenInvalidError,
+        refreshSessionDirect: async (effectiveSession) => refreshSessionDirect(input.sessionStore, effectiveSession),
+        session,
+        sessionStore: input.sessionStore,
+        shouldRefresh: (effectiveSession) => shouldRefresh(effectiveSession, now)
+    });
     return {
         async getAuthSettings(baseUrl) {
             const normalizedBaseUrl = normalizeBaseUrl(baseUrl);
@@ -66,19 +77,54 @@ export function createPlatformTransport(input) {
             await input.sessionStore.write(session);
             return session;
         },
-        async refreshSession(session) {
-            const response = await fetch(joinBaseUrl(session.baseUrl, "/api/v1/auth/refresh"), {
+        async startDeviceLogin(baseUrl) {
+            const normalizedBaseUrl = normalizeBaseUrl(baseUrl);
+            const path = "/api/v1/auth/device/start";
+            const response = await fetch(joinBaseUrl(normalizedBaseUrl, path), {
+                method: "POST"
+            });
+            return handleJsonResponse(response, path);
+        },
+        async claimDeviceLogin(claim) {
+            const normalizedBaseUrl = normalizeBaseUrl(claim.baseUrl);
+            const path = "/api/v1/auth/device/claim";
+            const response = await fetch(joinBaseUrl(normalizedBaseUrl, path), {
                 body: JSON.stringify({
-                    refreshToken: session.refreshToken
+                    deviceCode: claim.deviceCode
                 }),
                 headers: {
                     "content-type": "application/json"
                 },
                 method: "POST"
             });
-            const nextSession = await parseSessionResponse(response, session.baseUrl, "/api/v1/auth/refresh", session.activeOrg);
-            await input.sessionStore.write(nextSession);
-            return nextSession;
+            if (!response.ok) {
+                throw await toApiError(response, path);
+            }
+            const payload = await response.json();
+            if (payload.status !== "approved") {
+                return { status: payload.status };
+            }
+            if (!payload.tokens || !payload.user) {
+                throw new Error("Device login approval response did not include a session.");
+            }
+            const refreshToken = extractRefreshTokenFromHeaders(response.headers);
+            if (!refreshToken) {
+                throw new Error("Refresh token cookie was not returned by the Platform API.");
+            }
+            const session = {
+                accessToken: payload.tokens.accessToken,
+                accessTokenPayload: payload.tokens.accessTokenPayload,
+                activeOrg: null,
+                baseUrl: normalizedBaseUrl,
+                refreshToken,
+                refreshTokenExpiresAt: payload.tokens.refreshTokenExpiresAt,
+                user: payload.user
+            };
+            await input.sessionStore.write(session);
+            return { session, status: "approved" };
+        },
+        async refreshSession(session) {
+            return refreshSession(session);
         },
         async requestJson(request) {
             let session = await resolveEffectiveSession(request.session, input.sessionStore);
@@ -92,11 +138,11 @@ export function createPlatformTransport(input) {
                 });
             }
             if (shouldRefresh(session, now) && canRefresh(session)) {
-                session = await this.refreshSession(session);
+                session = await refreshSession(session);
             }
             const firstResponse = await authenticatedFetch(session, request);
             if (firstResponse.status === 401 && canRefresh(session)) {
-                session = await this.refreshSession(session);
+                session = await refreshSession(session);
                 return handleJsonResponse(await authenticatedFetch(session, request), request.path);
             }
             return handleJsonResponse(firstResponse, request.path);
@@ -113,17 +159,36 @@ export function createPlatformTransport(input) {
                 });
             }
             if (shouldRefresh(session, now) && canRefresh(session)) {
-                session = await this.refreshSession(session);
+                session = await refreshSession(session);
             }
             const firstResponse = await authenticatedFetch(session, request);
             if (firstResponse.status === 401 && canRefresh(session)) {
-                session = await this.refreshSession(session);
+                session = await refreshSession(session);
                 return handleBytesResponse(await authenticatedFetch(session, request), request);
             }
             return handleBytesResponse(firstResponse, request);
         }
     };
 }
+async function refreshSessionDirect(sessionStore, session) {
+    const response = await fetch(joinBaseUrl(session.baseUrl, "/api/v1/auth/refresh"), {
+        body: JSON.stringify({
+            refreshToken: session.refreshToken
+        }),
+        headers: {
+            "content-type": "application/json"
+        },
+        method: "POST"
+    });
+    const nextSession = await parseSessionResponse(response, session.baseUrl, "/api/v1/auth/refresh", session.activeOrg);
+    await sessionStore.write(nextSession);
+    return nextSession;
+}
+function isRefreshTokenInvalidError(error) {
+    return error instanceof ApiError &&
+        error.code === "auth/token_invalid" &&
+        error.instance === "/api/v1/auth/refresh";
+}
 async function authenticatedFetch(session, request) {
     const body = resolveRequestBody(request.body, session);
     const hasJsonBody = body !== undefined;
@@ -243,11 +308,12 @@ async function readResponseBytes(response, request) {
 }
 function createMaxBytesError(request, actualBytes, maxBytes) {
     return request.createMaxBytesError?.({ actualBytes, maxBytes }) ?? new ApiError({
+        code: "request/too_large",
         detail: `Response body is ${String(actualBytes)} bytes, which exceeds the limit of ${String(maxBytes)} bytes.`,
         instance: request.path,
         status: 413,
         title: "Payload Too Large",
-        type: "https://errors.kora.dev/request/too-large"
+        type: "https://errors.kora.dev/request/too_large"
     });
 }
 function concatBytes(chunks, totalBytes) {
@@ -271,10 +337,11 @@ async function toApiError(response, path) {
     if (contentType.includes("application/json")) {
         const rawBody = await response.text();
         const parsed = tryParseJsonErrorBody(rawBody);
-        const code = parsed?.error?.code ?? "internal/error";
+        const code = normalizePublicErrorCode(parsed?.error?.code ?? "internal/error");
         const rawDetail = (parsed?.error?.message ?? rawBody) || response.statusText;
         const detail = relabelBackendText(rawDetail || response.statusText);
         return new ApiError({
+            code,
             detail,
             ...(parsed?.error?.details ? { details: parsed.error.details } : {}),
             instance: path,
@@ -286,6 +353,7 @@ async function toApiError(response, path) {
     }
     const rawDetail = await response.text();
     return new ApiError({
+        code: "internal/error",
         detail: relabelBackendText(rawDetail),
         instance: path,
         ...(rawDetail ? { rawDetail } : {}),
@@ -337,27 +405,3 @@ function shouldRefresh(session, now) {
 function canRefresh(session) {
     return session.refreshToken.trim().length > 0;
 }
-async function resolveEffectiveSession(requestSession, sessionStore) {
-    if (!requestSession) {
-        return null;
-    }
-    const storedSession = await sessionStore.read();
-    if (!storedSession || !isSameSessionIdentity(storedSession, requestSession)) {
-        return requestSession;
-    }
-    return isSessionNewer(storedSession, requestSession) ? storedSession : requestSession;
-}
-function isSameSessionIdentity(candidate, current) {
-    return candidate.baseUrl === current.baseUrl
-        && candidate.user.id === current.user.id
-        && candidate.accessTokenPayload.sub === current.accessTokenPayload.sub;
-}
-function isSessionNewer(candidate, current) {
-    if (candidate.accessToken === current.accessToken && candidate.refreshToken === current.refreshToken) {
-        return false;
-    }
-    if (candidate.accessTokenPayload.exp !== current.accessTokenPayload.exp) {
-        return candidate.accessTokenPayload.exp > current.accessTokenPayload.exp;
-    }
-    return candidate.accessTokenPayload.iat >= current.accessTokenPayload.iat;
-}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kora-platform/cli",
-  "version": "0.8.0-rc1",
+  "version": "0.8.0-rc10",
   "private": false,
   "type": "module",
   "main": "dist/library.js",

package/dist/dotenv.d.ts

@@ -1 +0,0 @@
-export declare function parseDotEnv(source: string): Record<string, string>;

package/dist/dotenv.js

@@ -1,26 +0,0 @@
-const ENV_NAME_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/u;
-export function parseDotEnv(source) {
-    const parsed = {};
-    const lines = source.split(/\r?\n/u);
-    for (const rawLine of lines) {
-        const line = rawLine.trim();
-        if (line.length === 0 || line.startsWith("#")) {
-            continue;
-        }
-        const separatorIndex = line.indexOf("=");
-        if (separatorIndex <= 0) {
-            continue;
-        }
-        const rawName = line.slice(0, separatorIndex).trim();
-        if (!ENV_NAME_PATTERN.test(rawName)) {
-            continue;
-        }
-        let value = line.slice(separatorIndex + 1).trim();
-        if ((value.startsWith("\"") && value.endsWith("\"")) ||
-            (value.startsWith("'") && value.endsWith("'"))) {
-            value = value.slice(1, -1);
-        }
-        parsed[rawName] = value;
-    }
-    return parsed;
-}