@lindblad/complai-mcp 0.1.0

package/dist/auth/device-auth.js

@@ -0,0 +1,274 @@
+import { createCipheriv, createDecipheriv, randomBytes } from 'node:crypto';
+import { readFileSync, writeFileSync, existsSync, mkdirSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+const CREDENTIALS_DIR = join(homedir(), '.complai');
+const CREDENTIALS_FILE = join(CREDENTIALS_DIR, '.credentials.enc');
+const ENCRYPTION_KEY_FILE = join(CREDENTIALS_DIR, '.key');
+/**
+ * Device Authorization Manager
+ * Handles the device code flow and token storage
+ */
+export class DeviceAuthManager {
+    config;
+    cachedAccessToken = null;
+    constructor(config) {
+        this.config = {
+            ...config,
+            scope: config.scope || 'openid profile email offline_access',
+        };
+    }
+    /**
+     * Get a valid access token, prompting for login if needed
+     */
+    async getAccessToken() {
+        // Check cached token
+        if (this.cachedAccessToken && this.cachedAccessToken.expiresAt > Date.now() + 60000) {
+            return this.cachedAccessToken.token;
+        }
+        // Try to use stored refresh token
+        const stored = this.loadStoredCredentials();
+        if (stored && stored.refreshToken) {
+            try {
+                const tokens = await this.refreshAccessToken(stored.refreshToken);
+                this.cacheToken(tokens);
+                // Update stored refresh token if a new one was issued
+                if (tokens.refresh_token) {
+                    this.storeCredentials(tokens.refresh_token);
+                }
+                return tokens.access_token;
+            }
+            catch (error) {
+                // Refresh token expired or invalid - need to re-authenticate
+                console.error('Stored credentials expired. Please re-authenticate.');
+            }
+        }
+        // No valid credentials - need device authorization
+        throw new AuthenticationRequiredError('Authentication required. Run the login command first.', this.config.domain, this.config.clientId);
+    }
+    /**
+     * Initiate device authorization flow
+     * Returns user instructions for completing authentication
+     */
+    async initiateDeviceAuthorization() {
+        const response = await fetch(`https://${this.config.domain}/oauth/device/code`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: new URLSearchParams({
+                client_id: this.config.clientId,
+                scope: this.config.scope,
+                audience: this.config.audience,
+            }),
+        });
+        if (!response.ok) {
+            const error = await response.text();
+            throw new Error(`Failed to initiate device authorization: ${error}`);
+        }
+        const deviceCode = (await response.json());
+        return {
+            userCode: deviceCode.user_code,
+            verificationUri: deviceCode.verification_uri,
+            verificationUriComplete: deviceCode.verification_uri_complete,
+            expiresIn: deviceCode.expires_in,
+            pollForToken: () => this.pollForToken(deviceCode),
+        };
+    }
+    /**
+     * Poll Auth0 for token after user completes authentication
+     */
+    async pollForToken(deviceCode) {
+        const startTime = Date.now();
+        const expiresAt = startTime + deviceCode.expires_in * 1000;
+        const interval = (deviceCode.interval || 5) * 1000;
+        while (Date.now() < expiresAt) {
+            await this.sleep(interval);
+            const response = await fetch(`https://${this.config.domain}/oauth/token`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+                body: new URLSearchParams({
+                    grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
+                    device_code: deviceCode.device_code,
+                    client_id: this.config.clientId,
+                }),
+            });
+            if (response.ok) {
+                const tokens = (await response.json());
+                // Store refresh token for future use
+                if (tokens.refresh_token) {
+                    this.storeCredentials(tokens.refresh_token);
+                }
+                this.cacheToken(tokens);
+                return tokens;
+            }
+            const error = await response.json();
+            if (error.error === 'authorization_pending') {
+                // User hasn't completed authorization yet - keep polling
+                continue;
+            }
+            else if (error.error === 'slow_down') {
+                // Need to slow down polling
+                await this.sleep(interval);
+                continue;
+            }
+            else if (error.error === 'expired_token') {
+                throw new Error('Device code expired. Please try again.');
+            }
+            else if (error.error === 'access_denied') {
+                throw new Error('Authorization was denied by the user.');
+            }
+            else {
+                throw new Error(`Token error: ${error.error_description || error.error}`);
+            }
+        }
+        throw new Error('Device authorization timed out. Please try again.');
+    }
+    /**
+     * Refresh the access token using a refresh token
+     */
+    async refreshAccessToken(refreshToken) {
+        const response = await fetch(`https://${this.config.domain}/oauth/token`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: new URLSearchParams({
+                grant_type: 'refresh_token',
+                client_id: this.config.clientId,
+                refresh_token: refreshToken,
+            }),
+        });
+        if (!response.ok) {
+            const error = await response.text();
+            throw new Error(`Failed to refresh token: ${error}`);
+        }
+        return (await response.json());
+    }
+    /**
+     * Cache access token in memory
+     */
+    cacheToken(tokens) {
+        this.cachedAccessToken = {
+            token: tokens.access_token,
+            expiresAt: Date.now() + tokens.expires_in * 1000,
+        };
+    }
+    /**
+     * Store refresh token encrypted on disk
+     */
+    storeCredentials(refreshToken) {
+        const credentials = {
+            refreshToken,
+            domain: this.config.domain,
+            clientId: this.config.clientId,
+            audience: this.config.audience,
+        };
+        const encrypted = this.encrypt(JSON.stringify(credentials));
+        // Ensure directory exists
+        if (!existsSync(CREDENTIALS_DIR)) {
+            mkdirSync(CREDENTIALS_DIR, { mode: 0o700 });
+        }
+        writeFileSync(CREDENTIALS_FILE, encrypted, { mode: 0o600 });
+    }
+    /**
+     * Load stored credentials from disk
+     */
+    loadStoredCredentials() {
+        if (!existsSync(CREDENTIALS_FILE)) {
+            return null;
+        }
+        try {
+            const encrypted = readFileSync(CREDENTIALS_FILE, 'utf-8');
+            const decrypted = this.decrypt(encrypted);
+            const credentials = JSON.parse(decrypted);
+            // Verify credentials match current config
+            if (credentials.domain !== this.config.domain ||
+                credentials.clientId !== this.config.clientId ||
+                credentials.audience !== this.config.audience) {
+                // Config changed - credentials no longer valid
+                return null;
+            }
+            return credentials;
+        }
+        catch {
+            return null;
+        }
+    }
+    /**
+     * Clear stored credentials (logout)
+     */
+    clearCredentials() {
+        this.cachedAccessToken = null;
+        if (existsSync(CREDENTIALS_FILE)) {
+            writeFileSync(CREDENTIALS_FILE, '', { mode: 0o600 });
+        }
+    }
+    /**
+     * Check if user is authenticated
+     */
+    isAuthenticated() {
+        console.error(`[DEBUG] Checking credentials at ${CREDENTIALS_FILE}`);
+        const stored = this.loadStoredCredentials();
+        console.error(`[DEBUG] Stored credentials: ${stored ? 'found' : 'not found'}`);
+        return stored !== null && !!stored.refreshToken;
+    }
+    /**
+     * Get or create encryption key
+     */
+    getEncryptionKey() {
+        if (!existsSync(CREDENTIALS_DIR)) {
+            mkdirSync(CREDENTIALS_DIR, { mode: 0o700 });
+        }
+        if (existsSync(ENCRYPTION_KEY_FILE)) {
+            return Buffer.from(readFileSync(ENCRYPTION_KEY_FILE, 'utf-8'), 'hex');
+        }
+        // Generate new key
+        const key = randomBytes(32);
+        writeFileSync(ENCRYPTION_KEY_FILE, key.toString('hex'), { mode: 0o600 });
+        return key;
+    }
+    /**
+     * Encrypt data using AES-256-GCM
+     */
+    encrypt(data) {
+        const key = this.getEncryptionKey();
+        const iv = randomBytes(16);
+        const cipher = createCipheriv('aes-256-gcm', key, iv);
+        let encrypted = cipher.update(data, 'utf8', 'hex');
+        encrypted += cipher.final('hex');
+        const authTag = cipher.getAuthTag();
+        return iv.toString('hex') + ':' + authTag.toString('hex') + ':' + encrypted;
+    }
+    /**
+     * Decrypt data using AES-256-GCM
+     */
+    decrypt(data) {
+        const key = this.getEncryptionKey();
+        const parts = data.split(':');
+        if (parts.length !== 3) {
+            throw new Error('Invalid encrypted data format');
+        }
+        const iv = Buffer.from(parts[0], 'hex');
+        const authTag = Buffer.from(parts[1], 'hex');
+        const encrypted = parts[2];
+        const decipher = createDecipheriv('aes-256-gcm', key, iv);
+        decipher.setAuthTag(authTag);
+        let decrypted = decipher.update(encrypted, 'hex', 'utf8');
+        decrypted += decipher.final('utf8');
+        return decrypted;
+    }
+    sleep(ms) {
+        return new Promise(resolve => setTimeout(resolve, ms));
+    }
+}
+/**
+ * Error thrown when authentication is required
+ */
+export class AuthenticationRequiredError extends Error {
+    domain;
+    clientId;
+    constructor(message, domain, clientId) {
+        super(message);
+        this.domain = domain;
+        this.clientId = clientId;
+        this.name = 'AuthenticationRequiredError';
+    }
+}
+//# sourceMappingURL=device-auth.js.map

package/dist/auth/device-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-auth.js","sourceRoot":"","sources":["../../src/auth/device-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACxF,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAqCjC,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,CAAC,CAAC;AACpD,MAAM,gBAAgB,GAAG,IAAI,CAAC,eAAe,EAAE,kBAAkB,CAAC,CAAC;AACnE,MAAM,mBAAmB,GAAG,IAAI,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;AAE1D;;;GAGG;AACH,MAAM,OAAO,iBAAiB;IACpB,MAAM,CAAmB;IACzB,iBAAiB,GAAgD,IAAI,CAAC;IAE9E,YAAY,MAAwB;QAClC,IAAI,CAAC,MAAM,GAAG;YACZ,GAAG,MAAM;YACT,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,qCAAqC;SAC7D,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc;QAClB,qBAAqB;QACrB,IAAI,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,iBAAiB,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;YACpF,OAAO,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC;QACtC,CAAC;QAED,kCAAkC;QAClC,MAAM,MAAM,GAAG,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC5C,IAAI,MAAM,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YAClC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;gBAClE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;gBAExB,sDAAsD;gBACtD,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;oBACzB,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;gBAC9C,CAAC;gBAED,OAAO,MAAM,CAAC,YAAY,CAAC;YAC7B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,6DAA6D;gBAC7D,OAAO,CAAC,KAAK,CAAC,qDAAqD,CAAC,CAAC;YACvE,CAAC;QACH,CAAC;QAED,mDAAmD;QACnD,MAAM,IAAI,2BAA2B,CACnC,uDAAuD,EACvD,IAAI,CAAC,MAAM,CAAC,MAAM,EAClB,IAAI,CAAC,MAAM,CAAC,QAAQ,CACrB,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,2BAA2B;QAO/B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,MAAM,oBAAoB,EAAE;YAC9E,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;gBAC/B,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAM;gBACzB,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;aAC/B,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,4CAA4C,KAAK,EAAE,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,UAAU,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAuB,CAAC;QAEjE,OAAO;YACL,QAAQ,EAAE,UAAU,CAAC,SAAS;YAC9B,eAAe,EAAE,UAAU,CAAC,gBAAgB;YAC5C,uBAAuB,EAAE,UAAU,CAAC,yBAAyB;YAC7D,SAAS,EAAE,UAAU,CAAC,UAAU;YAChC,YAAY,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC;SAClD,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,YAAY,CAAC,UAA8B;QACvD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,SAAS,GAAG,UAAU,CAAC,UAAU,GAAG,IAAI,CAAC;QAC3D,MAAM,QAAQ,GAAG,CAAC,UAAU,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;QAEnD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,CAAC;YAC9B,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAE3B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,MAAM,cAAc,EAAE;gBACxE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;gBAChE,IAAI,EAAE,IAAI,eAAe,CAAC;oBACxB,UAAU,EAAE,8CAA8C;oBAC1D,WAAW,EAAE,UAAU,CAAC,WAAW;oBACnC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;iBAChC,CAAC;aACH,CAAC,CAAC;YAEH,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;gBAChB,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAkB,CAAC;gBAExD,qCAAqC;gBACrC,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;oBACzB,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;gBAC9C,CAAC;gBAED,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;gBACxB,OAAO,MAAM,CAAC;YAChB,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAmD,CAAC;YAErF,IAAI,KAAK,CAAC,KAAK,KAAK,uBAAuB,EAAE,CAAC;gBAC5C,yDAAyD;gBACzD,SAAS;YACX,CAAC;iBAAM,IAAI,KAAK,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;gBACvC,4BAA4B;gBAC5B,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBAC3B,SAAS;YACX,CAAC;iBAAM,IAAI,KAAK,CAAC,KAAK,KAAK,eAAe,EAAE,CAAC;gBAC3C,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;YAC5D,CAAC;iBAAM,IAAI,KAAK,CAAC,KAAK,KAAK,eAAe,EAAE,CAAC;gBAC3C,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;YAC3D,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,KAAK,CAAC,gBAAgB,KAAK,CAAC,iBAAiB,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;YAC5E,CAAC;QACH,CAAC;QAED,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,kBAAkB,CAAC,YAAoB;QACnD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,MAAM,cAAc,EAAE;YACxE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,UAAU,EAAE,eAAe;gBAC3B,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;gBAC/B,aAAa,EAAE,YAAY;aAC5B,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,4BAA4B,KAAK,EAAE,CAAC,CAAC;QACvD,CAAC;QAED,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAkB,CAAC;IAClD,CAAC;IAED;;OAEG;IACK,UAAU,CAAC,MAAqB;QACtC,IAAI,CAAC,iBAAiB,GAAG;YACvB,KAAK,EAAE,MAAM,CAAC,YAAY;YAC1B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI;SACjD,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,gBAAgB,CAAC,YAAoB;QAC3C,MAAM,WAAW,GAAsB;YACrC,YAAY;YACZ,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;YAC1B,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC9B,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;SAC/B,CAAC;QAEF,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC;QAE5D,0BAA0B;QAC1B,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;YACjC,SAAS,CAAC,eAAe,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9C,CAAC;QAED,aAAa,CAAC,gBAAgB,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED;;OAEG;IACK,qBAAqB;QAC3B,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,YAAY,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;YAC1D,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAC1C,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAsB,CAAC;YAE/D,0CAA0C;YAC1C,IACE,WAAW,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,CAAC,MAAM;gBACzC,WAAW,CAAC,QAAQ,KAAK,IAAI,CAAC,MAAM,CAAC,QAAQ;gBAC7C,WAAW,CAAC,QAAQ,KAAK,IAAI,CAAC,MAAM,CAAC,QAAQ,EAC7C,CAAC;gBACD,+CAA+C;gBAC/C,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO,WAAW,CAAC;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACH,gBAAgB;QACd,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;QAC9B,IAAI,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACjC,aAAa,CAAC,gBAAgB,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAED;;OAEG;IACH,eAAe;QACb,OAAO,CAAC,KAAK,CAAC,mCAAmC,gBAAgB,EAAE,CAAC,CAAC;QACrE,MAAM,MAAM,GAAG,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC5C,OAAO,CAAC,KAAK,CAAC,+BAA+B,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QAC/E,OAAO,MAAM,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC;IAClD,CAAC;IAED;;OAEG;IACK,gBAAgB;QACtB,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;YACjC,SAAS,CAAC,eAAe,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9C,CAAC;QAED,IAAI,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;YACpC,OAAO,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,mBAAmB,EAAE,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC;QACxE,CAAC;QAED,mBAAmB;QACnB,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC5B,aAAa,CAAC,mBAAmB,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACzE,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;OAEG;IACK,OAAO,CAAC,IAAY;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACpC,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QAEtD,IAAI,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QACnD,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAEjC,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAEpC,OAAO,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,GAAG,GAAG,SAAS,CAAC;IAC9E,CAAC;IAED;;OAEG;IACK,OAAO,CAAC,IAAY;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAE9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACnD,CAAC;QAED,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACxC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC7C,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAE3B,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QAC1D,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAE7B,IAAI,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QAC1D,SAAS,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAEpC,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,KAAK,CAAC,EAAU;QACtB,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;IACzD,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,2BAA4B,SAAQ,KAAK;IAGlC;IACA;IAHlB,YACE,OAAe,EACC,MAAc,EACd,QAAgB;QAEhC,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,WAAM,GAAN,MAAM,CAAQ;QACd,aAAQ,GAAR,QAAQ,CAAQ;QAGhC,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;IAC5C,CAAC;CACF"}

package/dist/auth/pkce-auth.d.ts

@@ -0,0 +1,67 @@
+export interface PkceAuthConfig {
+    domain: string;
+    clientId: string;
+    audience: string;
+    organizationId?: string;
+    scope?: string;
+}
+/**
+ * PKCE Authentication Manager
+ * Uses Authorization Code Flow with PKCE for secure browser-based login
+ */
+export declare class PkceAuthManager {
+    private config;
+    private cachedToken;
+    constructor(config: PkceAuthConfig);
+    /**
+     * Get id_token for API auth (like webapp pattern)
+     */
+    getAccessToken(): Promise<string>;
+    /**
+     * Check if user is authenticated (has valid or refreshable tokens)
+     */
+    isAuthenticated(): boolean;
+    /**
+     * Perform interactive PKCE login
+     * Opens browser, starts local server for callback, exchanges code for tokens
+     */
+    login(): Promise<void>;
+    /**
+     * Perform interactive PKCE login with a specific organization
+     * This ensures the token has org_id claim for org-scoped access
+     */
+    loginWithOrganization(organizationId: string): Promise<void>;
+    /**
+     * Clear stored credentials
+     */
+    logout(): void;
+    /**
+     * Generate PKCE verifier and challenge
+     */
+    private generatePkce;
+    /**
+     * Find an available port for the callback server
+     */
+    private findAvailablePort;
+    /**
+     * Start a temporary HTTP server to receive the OAuth callback
+     */
+    private startCallbackServer;
+    /**
+     * Exchange authorization code for tokens
+     */
+    private exchangeCodeForTokens;
+    /**
+     * Refresh access token using refresh token
+     */
+    private refreshAccessToken;
+    /**
+     * Cache token in memory and store to disk
+     */
+    private cacheAndStore;
+    /**
+     * Load stored tokens from disk
+     */
+    private loadStoredTokens;
+}
+//# sourceMappingURL=pkce-auth.d.ts.map

package/dist/auth/pkce-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce-auth.d.ts","sourceRoot":"","sources":["../../src/auth/pkce-auth.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAmBD;;;GAGG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,MAAM,CAAiB;IAC/B,OAAO,CAAC,WAAW,CAAqD;gBAE5D,MAAM,EAAE,cAAc;IAOlC;;OAEG;IACG,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC;IAiCvC;;OAEG;IACH,eAAe,IAAI,OAAO;IAQ1B;;;OAGG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IA+B5B;;;OAGG;IACG,qBAAqB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA2BlE;;OAEG;IACH,MAAM,IAAI,IAAI;IAOd;;OAEG;IACH,OAAO,CAAC,YAAY;IAMpB;;OAEG;YACW,iBAAiB;IAe/B;;OAEG;YACW,mBAAmB;IA2EjC;;OAEG;YACW,qBAAqB;IAyBnC;;OAEG;YACW,kBAAkB;IAmBhC;;OAEG;IACH,OAAO,CAAC,aAAa;IAyBrB;;OAEG;IACH,OAAO,CAAC,gBAAgB;CAqBzB"}

package/dist/auth/pkce-auth.js

@@ -0,0 +1,311 @@
+import { createServer } from 'node:http';
+import { randomBytes, createHash } from 'node:crypto';
+import { URL } from 'node:url';
+import open from 'open';
+import { writeFileSync, readFileSync, existsSync, mkdirSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+const CREDENTIALS_DIR = join(homedir(), '.complai');
+const TOKEN_FILE = join(CREDENTIALS_DIR, 'tokens.json');
+/**
+ * PKCE Authentication Manager
+ * Uses Authorization Code Flow with PKCE for secure browser-based login
+ */
+export class PkceAuthManager {
+    config;
+    cachedToken = null;
+    constructor(config) {
+        this.config = {
+            ...config,
+            scope: config.scope || 'openid profile email offline_access',
+        };
+    }
+    /**
+     * Get id_token for API auth (like webapp pattern)
+     */
+    async getAccessToken() {
+        // Check memory cache
+        if (this.cachedToken && this.cachedToken.expiresAt > Date.now() + 60000) {
+            return this.cachedToken.token;
+        }
+        // Check stored tokens
+        const stored = this.loadStoredTokens();
+        if (stored) {
+            // Use id_token like webapp does (aud = client_id, accepted by API)
+            const token = stored.idToken || stored.accessToken;
+            // Check if token is still valid
+            if (stored.expiresAt > Date.now() + 60000) {
+                this.cachedToken = { token, expiresAt: stored.expiresAt };
+                return token;
+            }
+            // Try to refresh
+            if (stored.refreshToken) {
+                try {
+                    const tokens = await this.refreshAccessToken(stored.refreshToken);
+                    this.cacheAndStore(tokens);
+                    return tokens.id_token || tokens.access_token;
+                }
+                catch (error) {
+                    console.error('[PKCE] Refresh failed, need to re-authenticate');
+                }
+            }
+        }
+        throw new Error('Not authenticated. Please run login first.');
+    }
+    /**
+     * Check if user is authenticated (has valid or refreshable tokens)
+     */
+    isAuthenticated() {
+        const stored = this.loadStoredTokens();
+        if (!stored)
+            return false;
+        // Either access token is valid, or we have a refresh token
+        return stored.expiresAt > Date.now() || !!stored.refreshToken;
+    }
+    /**
+     * Perform interactive PKCE login
+     * Opens browser, starts local server for callback, exchanges code for tokens
+     */
+    async login() {
+        const { verifier, challenge } = this.generatePkce();
+        const state = randomBytes(16).toString('hex');
+        const port = 8374; // Fixed port for Auth0 callback URL matching
+        const redirectUri = `http://localhost:${port}/callback`;
+        // Build authorization URL (no audience - use id_token like webapp)
+        const authUrl = new URL(`https://${this.config.domain}/authorize`);
+        authUrl.searchParams.set('response_type', 'code');
+        authUrl.searchParams.set('client_id', this.config.clientId);
+        authUrl.searchParams.set('redirect_uri', redirectUri);
+        authUrl.searchParams.set('scope', this.config.scope);
+        authUrl.searchParams.set('state', state);
+        authUrl.searchParams.set('code_challenge', challenge);
+        authUrl.searchParams.set('code_challenge_method', 'S256');
+        // Include organization if configured (required for org_id in token)
+        if (this.config.organizationId) {
+            authUrl.searchParams.set('organization', this.config.organizationId);
+        }
+        // Start local server to receive callback and open browser
+        const code = await this.startCallbackServer(port, state, authUrl.toString());
+        // Exchange code for tokens
+        const tokens = await this.exchangeCodeForTokens(code, verifier, redirectUri);
+        this.cacheAndStore(tokens);
+        console.error('✓ Login successful!');
+    }
+    /**
+     * Perform interactive PKCE login with a specific organization
+     * This ensures the token has org_id claim for org-scoped access
+     */
+    async loginWithOrganization(organizationId) {
+        const { verifier, challenge } = this.generatePkce();
+        const state = randomBytes(16).toString('hex');
+        const port = 8374; // Fixed port for Auth0 callback URL matching
+        const redirectUri = `http://localhost:${port}/callback`;
+        // Build authorization URL with organization
+        const authUrl = new URL(`https://${this.config.domain}/authorize`);
+        authUrl.searchParams.set('response_type', 'code');
+        authUrl.searchParams.set('client_id', this.config.clientId);
+        authUrl.searchParams.set('redirect_uri', redirectUri);
+        authUrl.searchParams.set('scope', this.config.scope);
+        authUrl.searchParams.set('state', state);
+        authUrl.searchParams.set('code_challenge', challenge);
+        authUrl.searchParams.set('code_challenge_method', 'S256');
+        authUrl.searchParams.set('organization', organizationId); // Always include org
+        // Start local server to receive callback and open browser
+        const code = await this.startCallbackServer(port, state, authUrl.toString());
+        // Exchange code for tokens
+        const tokens = await this.exchangeCodeForTokens(code, verifier, redirectUri);
+        this.cacheAndStore(tokens);
+        console.error(`✓ Login successful for organization ${organizationId}!`);
+    }
+    /**
+     * Clear stored credentials
+     */
+    logout() {
+        this.cachedToken = null;
+        if (existsSync(TOKEN_FILE)) {
+            writeFileSync(TOKEN_FILE, '', { mode: 0o600 });
+        }
+    }
+    /**
+     * Generate PKCE verifier and challenge
+     */
+    generatePkce() {
+        const verifier = randomBytes(32).toString('base64url');
+        const challenge = createHash('sha256').update(verifier).digest('base64url');
+        return { verifier, challenge };
+    }
+    /**
+     * Find an available port for the callback server
+     */
+    async findAvailablePort() {
+        return new Promise((resolve, reject) => {
+            const server = createServer();
+            server.listen(0, () => {
+                const address = server.address();
+                if (address && typeof address === 'object') {
+                    const port = address.port;
+                    server.close(() => resolve(port));
+                }
+                else {
+                    reject(new Error('Could not find available port'));
+                }
+            });
+        });
+    }
+    /**
+     * Start a temporary HTTP server to receive the OAuth callback
+     */
+    async startCallbackServer(port, expectedState, authUrl) {
+        return new Promise((resolve, reject) => {
+            const server = createServer((req, res) => {
+                const url = new URL(req.url || '/', `http://localhost:${port}`);
+                if (url.pathname === '/callback') {
+                    const code = url.searchParams.get('code');
+                    const state = url.searchParams.get('state');
+                    const error = url.searchParams.get('error');
+                    if (error) {
+                        const errorDesc = url.searchParams.get('error_description') || 'No description';
+                        console.error(`Auth0 error: ${error} - ${errorDesc}`);
+                        res.writeHead(400, { 'Content-Type': 'text/html' });
+                        res.end(`<html><body><h1>Login Failed</h1><p>${error}: ${errorDesc}</p><p>You can close this window.</p></body></html>`);
+                        server.close();
+                        reject(new Error(`Auth error: ${error} - ${errorDesc}`));
+                        return;
+                    }
+                    if (state !== expectedState) {
+                        res.writeHead(400, { 'Content-Type': 'text/html' });
+                        res.end('<html><body><h1>Invalid State</h1><p>You can close this window.</p></body></html>');
+                        server.close();
+                        reject(new Error('State mismatch - possible CSRF attack'));
+                        return;
+                    }
+                    if (!code) {
+                        res.writeHead(400, { 'Content-Type': 'text/html' });
+                        res.end('<html><body><h1>No Code</h1><p>You can close this window.</p></body></html>');
+                        server.close();
+                        reject(new Error('No authorization code received'));
+                        return;
+                    }
+                    res.writeHead(200, { 'Content-Type': 'text/html' });
+                    res.end(`
+            <html>
+              <body style="font-family: system-ui; display: flex; justify-content: center; align-items: center; height: 100vh; margin: 0; background: #f0f0f0;">
+                <div style="background: white; padding: 40px; border-radius: 8px; text-align: center; box-shadow: 0 2px 10px rgba(0,0,0,0.1);">
+                  <h1 style="color: #22c55e;">✓ Login Successful!</h1>
+                  <p>You can close this window and return to your terminal.</p>
+                </div>
+              </body>
+            </html>
+          `);
+                    server.close();
+                    resolve(code);
+                }
+                else {
+                    res.writeHead(404);
+                    res.end('Not found');
+                }
+            });
+            server.listen(port, async () => {
+                console.error(`\nOpening browser for login...`);
+                try {
+                    await open(authUrl);
+                }
+                catch {
+                    console.error('Could not open browser automatically.');
+                    console.error(`Please open this URL manually:\n${authUrl}\n`);
+                }
+            });
+            // Timeout after 5 minutes
+            setTimeout(() => {
+                server.close();
+                reject(new Error('Login timed out after 5 minutes'));
+            }, 5 * 60 * 1000);
+        });
+    }
+    /**
+     * Exchange authorization code for tokens
+     */
+    async exchangeCodeForTokens(code, verifier, redirectUri) {
+        const response = await fetch(`https://${this.config.domain}/oauth/token`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+                grant_type: 'authorization_code',
+                client_id: this.config.clientId,
+                code,
+                code_verifier: verifier,
+                redirect_uri: redirectUri,
+            }),
+        });
+        if (!response.ok) {
+            const error = await response.text();
+            throw new Error(`Token exchange failed: ${error}`);
+        }
+        return (await response.json());
+    }
+    /**
+     * Refresh access token using refresh token
+     */
+    async refreshAccessToken(refreshToken) {
+        const response = await fetch(`https://${this.config.domain}/oauth/token`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+                grant_type: 'refresh_token',
+                client_id: this.config.clientId,
+                refresh_token: refreshToken,
+            }),
+        });
+        if (!response.ok) {
+            const error = await response.text();
+            throw new Error(`Token refresh failed: ${error}`);
+        }
+        return (await response.json());
+    }
+    /**
+     * Cache token in memory and store to disk
+     */
+    cacheAndStore(tokens) {
+        const expiresAt = Date.now() + tokens.expires_in * 1000;
+        // Use id_token like webapp does
+        this.cachedToken = {
+            token: tokens.id_token || tokens.access_token,
+            expiresAt,
+        };
+        const stored = {
+            accessToken: tokens.access_token,
+            idToken: tokens.id_token,
+            refreshToken: tokens.refresh_token,
+            expiresAt,
+            domain: this.config.domain,
+            clientId: this.config.clientId,
+        };
+        if (!existsSync(CREDENTIALS_DIR)) {
+            mkdirSync(CREDENTIALS_DIR, { mode: 0o700 });
+        }
+        writeFileSync(TOKEN_FILE, JSON.stringify(stored, null, 2), { mode: 0o600 });
+    }
+    /**
+     * Load stored tokens from disk
+     */
+    loadStoredTokens() {
+        if (!existsSync(TOKEN_FILE)) {
+            return null;
+        }
+        try {
+            const content = readFileSync(TOKEN_FILE, 'utf-8');
+            if (!content.trim())
+                return null;
+            const stored = JSON.parse(content);
+            // Verify config matches
+            if (stored.domain !== this.config.domain || stored.clientId !== this.config.clientId) {
+                return null;
+            }
+            return stored;
+        }
+        catch {
+            return null;
+        }
+    }
+}
+//# sourceMappingURL=pkce-auth.js.map