@lukoweb/apitogo 0.2.23 → 0.2.24

package/dist/cli/cli.js

@@ -459,8 +459,9 @@ function syncAuthentication(normalized) {
   }
   const auth = authentication ?? {};
   auth.enabled = userPanelEnabled;
-  auth.type = "dev-portal";
-  if (userPanelEnabled) {
+  const keepsOpenId = auth.type === "openid";
+  if (!keepsOpenId) auth.type = "dev-portal";
+  if (userPanelEnabled && !keepsOpenId) {
     const native = asRecord(auth.native) ?? {};
     if (native.enabled === void 0) {
       native.enabled = true;
@@ -483,7 +484,7 @@ function syncAuthentication(normalized) {
       }
     }
   }
-  if (normalized.demoMode !== void 0) {
+  if (normalized.demoMode !== void 0 && !keepsOpenId) {
     auth.demoMode = normalized.demoMode !== false;
   }
   normalized.authentication = auth;
@@ -8021,7 +8022,11 @@ function buildSiteConfig(resolved, plan2, theme, extras = {}) {
     },
     modules: {
       docs: { enabled: plan2.docs },
-      userPanel: { enabled: plan2.userPanel }
+      // The plans pages (pricing, choosing a plan) exist only when billing is on, and the plans service is what makes it so.
+      userPanel: {
+        enabled: plan2.userPanel,
+        ...plan2.plansPlugin ? { plans: { enabled: true } } : {}
+      }
     },
     ...plan2.docs ? {
       docs: {
@@ -8042,10 +8047,21 @@ function buildSiteConfig(resolved, plan2, theme, extras = {}) {
     ...navigation.length > 0 ? { navigation } : {},
     ...redirects.length > 0 ? { redirects } : {},
     ...theme !== void 0 ? { theme } : {},
-    ...plan2.auth ? { authentication: { type: "openid", ...plan2.auth } } : {},
+    ...plan2.auth ? { authentication: authenticationFor(plan2) } : {},
     ...plan2.preview ? { preview: true } : {}
   };
 }
+function authenticationFor(plan2) {
+  if (plan2.plansPlugin)
+    return {
+      type: "dev-portal",
+      apiBaseUrl: plan2.plansPlugin.apiBaseUrl,
+      demoMode: false,
+      // Accounts are made at the identity (its own sign-up page), never at the plans backend.
+      native: { enabled: false }
+    };
+  return { type: "openid", ...plan2.auth };
+}
 var PREVIEW_BANNER_MESSAGE = "Preview mode: sign-in and plans use a stand-in manifest. Run `apitogo deploy` for the real services.";
 function renderWrapper(plan2) {
   const imports = [
@@ -8194,9 +8210,27 @@ async function preparePortal(resolved, manifest, mode, options = {}) {
 
 // src/config/v2/workspace.ts
 import { createHash as createHash2 } from "node:crypto";
-import { access as access2, lstat, readFile as readFile7, rm as rm3, symlink } from "node:fs/promises";
+import { access as access2, lstat, readFile as readFile7, rm as rm3 } from "node:fs/promises";
 import path13 from "node:path";
 import { glob as glob3 } from "glob";
+
+// src/config/v2/link-directory.ts
+import { symlink } from "node:fs/promises";
+async function linkDirectory(target, link, options = {}) {
+  const create = options.symlinkFn ?? symlink;
+  const platform = options.platform ?? process.platform;
+  try {
+    await create(target, link, "dir");
+    return "symlink";
+  } catch (error) {
+    if (platform !== "win32" || error.code !== "EPERM")
+      throw error;
+    await create(target, link, "junction");
+    return "junction";
+  }
+}
+
+// src/config/v2/workspace.ts
 var exists2 = (file) => access2(file).then(
   () => true,
   () => false
@@ -8207,7 +8241,7 @@ async function relink(target, link) {
     () => false
   ))
     await rm3(link, { recursive: true, force: true });
-  await symlink(target, link, "dir");
+  await linkDirectory(target, link);
 }
 async function materializeWorkspace(resolved, prepared) {
   const root = path13.dirname(prepared.wrapperPath);
@@ -9332,6 +9366,34 @@ var PlatformApiClient = class {
       }
     );
   }
+  /**
+   * Adds or updates an upstream login connection of the project's Active identity. The same request twice changes
+   * nothing. The answer carries the redirect address to register with the provider.
+   */
+  putProjectIdentityConnection(projectId, connectionId2, body) {
+    return this.request(
+      "PUT",
+      `/api/v1/projects/${projectId}/identity/connections/${encodeURIComponent(connectionId2)}`,
+      {
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(body)
+      }
+    );
+  }
+  /** The upstream login connections of the project's identity (never their secrets). */
+  listProjectIdentityConnections(projectId) {
+    return this.request(
+      "GET",
+      `/api/v1/projects/${projectId}/identity/connections`
+    );
+  }
+  /** Removes a connection. One that is not there is a success. Users who signed in through it keep their accounts. */
+  async deleteProjectIdentityConnection(projectId, connectionId2) {
+    await this.request(
+      "DELETE",
+      `/api/v1/projects/${projectId}/identity/connections/${encodeURIComponent(connectionId2)}`
+    );
+  }
   /** The state of the project's identity, or null when it has none. */
   async getProjectIdentity(projectId) {
     try {
@@ -9905,7 +9967,7 @@ import {
 // package.json
 var package_default = {
   name: "@lukoweb/apitogo",
-  version: "0.2.23",
+  version: "0.2.24",
   type: "module",
   sideEffects: [
     "**/*.css",
@@ -27480,6 +27542,52 @@ var IdentityDeployError = class extends ApitogoError {
   }
 };
 var IDENTITY_STEPS = ["request", "activate"];
+var IDENTITY_CONNECTIONS_STEP = "connections";
+var SECRET_PREFIX = "secret:";
+function normalizedConnections(resolved) {
+  return [...resolved.identity?.connections ?? []].map((connection) => ({
+    ...connection,
+    authority: connection.authority.trim().replace(/\/+$/, "")
+  })).sort((a, b) => a.id.localeCompare(b.id));
+}
+function identityConnectionsHash(projectId, resolved) {
+  return stableJson({
+    projectId,
+    connections: normalizedConnections(resolved)
+  });
+}
+async function recordedConnectionIds(resolved) {
+  const ids = stepOf(
+    await readLedger(resolved.state),
+    "identity",
+    IDENTITY_CONNECTIONS_STEP
+  )?.output?.ids;
+  return ids ? ids.split(",").filter(Boolean) : [];
+}
+function redirectAddressesOf(output4) {
+  return Object.entries(output4 ?? {}).filter(([key]) => key.startsWith("redirect.")).map(([key, redirectUri]) => ({
+    id: key.slice("redirect.".length),
+    redirectUri
+  }));
+}
+function connectionBody(connection) {
+  return {
+    authority: connection.authority,
+    clientId: connection.clientId,
+    clientSecret: connection.clientSecret,
+    scopes: connection.scopes,
+    displayName: connection.displayName
+  };
+}
+function referencedSecretNames(connections) {
+  return [
+    ...new Set(
+      connections.map(
+        (connection) => connection.clientSecret.slice(SECRET_PREFIX.length)
+      )
+    )
+  ];
+}
 var PORTAL_CALLBACK_PATH = "/oauth/callback";
 var defaultSleep2 = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 function identityNotDeployableReason(resolved) {
@@ -27534,6 +27642,25 @@ function rejected2(error) {
   }
   throw error;
 }
+function connectionRejected(error, id) {
+  if (error instanceof PlatformApiError && error.status === 409) {
+    throw new IdentityDeployError(
+      "IDENTITY_CONNECTION_REJECTED",
+      `The identity is not active yet, so connection "${id}" cannot be saved.`,
+      "Run deploy again once the identity is Active."
+    );
+  }
+  if (error instanceof PlatformApiError && error.status === 400) {
+    const lines = describePlatformProblem(error);
+    throw new IdentityDeployError(
+      "IDENTITY_CONNECTION_REJECTED",
+      `The platform refused login connection "${id}":
+  ${lines.join("\n  ") || error.message}`,
+      "Fix the connection in apitogo.config.json (identity.connections) and run deploy again."
+    );
+  }
+  throw error;
+}
 async function recordOwnProvider(resolved, projectId) {
   const identity = resolved.identity;
   const issuer = identity?.issuer?.replace(/\/+$/, "");
@@ -27623,10 +27750,14 @@ async function deployIdentity(resolved, projectId, deps, options = {}) {
     },
     stillValid: async () => (await client.getProjectIdentity(projectId))?.status === "Active"
   };
+  const wanted = normalizedConnections(resolved);
+  const steps = [requestStep, activateStep];
+  if (wanted.length > 0 || (await recordedConnectionIds(resolved)).length > 0)
+    steps.push(connectionsStep(resolved, projectId, client, wanted));
   const outcomes = await runPipeline(
     resolved.state,
     "identity",
-    [requestStep, activateStep],
+    steps,
     { force: options.force }
   );
   const activate = outcomes.find((outcome) => outcome.step === "activate");
@@ -27649,14 +27780,103 @@ async function deployIdentity(resolved, projectId, deps, options = {}) {
       );
     }
   }
+  const connectionsRan = outcomes.some(
+    (outcome) => outcome.step === IDENTITY_CONNECTIONS_STEP && !outcome.skipped
+  );
   return {
-    status: ran ? "deployed" : "unchanged",
+    status: ran || connectionsRan ? "deployed" : "unchanged",
     steps: outcomes.map((outcome) => ({
       step: outcome.step,
       skipped: outcome.skipped
     })),
     issuer: learned?.issuer ?? known?.issuer,
-    clientId: learned?.clientId ?? known?.clientId
+    clientId: learned?.clientId ?? known?.clientId,
+    connections: redirectAddressesOf(
+      stepOf(
+        await readLedger(resolved.state),
+        "identity",
+        IDENTITY_CONNECTIONS_STEP
+      )?.output
+    )
+  };
+}
+function connectionsStep(resolved, projectId, client, wanted) {
+  const {
+    putProjectIdentityConnection,
+    listProjectIdentityConnections,
+    deleteProjectIdentityConnection,
+    listSecrets
+  } = client;
+  if (!putProjectIdentityConnection || !listProjectIdentityConnections || !deleteProjectIdentityConnection || !listSecrets)
+    throw new Error("The platform client has no login connection calls.");
+  const stamps = async () => {
+    const names = referencedSecretNames(wanted);
+    if (names.length === 0) return {};
+    const listed = await listSecrets.call(client, projectId);
+    const byName2 = new Map(listed.secrets.map((s) => [s.name, s.updatedAtUtc]));
+    const missing = names.filter((name) => !byName2.has(name));
+    if (missing.length > 0)
+      throw new IdentityDeployError(
+        "IDENTITY_SECRET_MISSING",
+        `The secret ${missing.join(", ")} is not set for this project, and a login connection needs it.`,
+        `Run \`apitogo secrets set ${missing[0]}\` with the value from the provider, then deploy again.`
+      );
+    return Object.fromEntries(
+      names.map((name) => [name, byName2.get(name)])
+    );
+  };
+  const sameAddress = (a, b) => a.replace(/\/+$/, "").toLowerCase() === b.replace(/\/+$/, "").toLowerCase();
+  return {
+    name: IDENTITY_CONNECTIONS_STEP,
+    hash: () => identityConnectionsHash(projectId, resolved),
+    run: async () => {
+      const recorded = await stamps();
+      const existing = await listProjectIdentityConnections.call(
+        client,
+        projectId
+      );
+      const redirects = {};
+      for (const connection of wanted) {
+        try {
+          const saved = await putProjectIdentityConnection.call(
+            client,
+            projectId,
+            connection.id,
+            connectionBody(connection)
+          );
+          redirects[`redirect.${connection.id}`] = saved.redirectUri;
+        } catch (error) {
+          return connectionRejected(error, connection.id);
+        }
+      }
+      for (const old of existing)
+        if (!wanted.some((connection) => connection.id === old.id))
+          await deleteProjectIdentityConnection.call(client, projectId, old.id);
+      return {
+        ids: wanted.map((connection) => connection.id).join(","),
+        secretsStamp: stableJson(recorded),
+        ...redirects
+      };
+    },
+    // The platform still has exactly these connections, and none of the secrets was changed since.
+    stillValid: async () => {
+      const found = await listProjectIdentityConnections.call(
+        client,
+        projectId
+      );
+      if (found.length !== wanted.length) return false;
+      for (const connection of wanted) {
+        const there = found.find((f) => f.id === connection.id);
+        if (!there || there.clientId !== connection.clientId || !sameAddress(there.authority, connection.authority))
+          return false;
+      }
+      const before = stepOf(
+        await readLedger(resolved.state),
+        "identity",
+        IDENTITY_CONNECTIONS_STEP
+      )?.output?.secretsStamp;
+      return before === void 0 || before === stableJson(await stamps());
+    }
   };
 }
 
@@ -27938,9 +28158,30 @@ async function planIdentityService(resolved, ledger, manifest) {
       (name) => `step ${name}: ${stepState(stepOf(ledger, "identity", name), hash2)}`
     )
   ];
+  const connections = normalizedConnections(resolved);
+  const leftOnPlatform = (await recordedConnectionIds(resolved)).length > 0;
+  const connectionsHash = projectId ? identityConnectionsHash(projectId, resolved) : void 0;
+  const connectionsRecord = stepOf(
+    ledger,
+    "identity",
+    IDENTITY_CONNECTIONS_STEP
+  );
+  if (connections.length > 0 || leftOnPlatform) {
+    for (const connection of connections)
+      details.push(
+        `login connection ${connection.id}: ${connection.displayName ?? connection.id} (${connection.authority})` + (known?.issuer ? `, register this redirect address with the provider: ${known.issuer.replace(/\/+$/, "")}/account/external/${connection.id}/callback` : "")
+      );
+    if (connections.length === 0)
+      details.push(
+        "login connections: the last deploy's connections will be removed"
+      );
+    details.push(
+      `step ${IDENTITY_CONNECTIONS_STEP}: ${stepState(connectionsRecord, connectionsHash)}`
+    );
+  }
   const allDone = IDENTITY_STEPS.every(
     (name) => isDone(stepOf(ledger, "identity", name), hash2)
-  );
+  ) && (connections.length === 0 && !leftOnPlatform ? true : isDone(connectionsRecord, connectionsHash));
   return {
     ...base,
     action: allDone ? "skip" : "deploy",
@@ -28006,7 +28247,7 @@ async function planPlansService(resolved, ledger) {
 }
 var failedStep = (ledger, service, names) => names.map((name) => ({ name, record: stepOf(ledger, service, name) })).find((step2) => step2.record?.status === "failed");
 var unreachable = (error) => `platform: not reachable (${error instanceof Error ? error.message : String(error)}); showing local records only`;
-async function identityStatus(resolved, ledger, manifest, remote) {
+async function identityStatus(resolved, ledger, manifest, remote, connectionsRemote) {
   const entry = manifest?.services.identity;
   const failed = failedStep(ledger, "identity", IDENTITY_STEPS);
   const details = [];
@@ -28040,6 +28281,15 @@ async function identityStatus(resolved, ledger, manifest, remote) {
           );
           state = "drift";
         }
+        if (connectionsRemote && platform.status === "Active") {
+          const drift = await connectionLines(
+            resolved,
+            projectId,
+            connectionsRemote,
+            details
+          );
+          if (drift && state === "ready") state = "drift";
+        }
       }
     } catch (error) {
       details.push(unreachable(error));
@@ -28055,6 +28305,36 @@ async function identityStatus(resolved, ledger, manifest, remote) {
   }
   return { service: "identity", state, details };
 }
+async function connectionLines(resolved, projectId, remote, details) {
+  const configured = normalizedConnections(resolved);
+  let there;
+  try {
+    there = await remote(projectId);
+  } catch (error) {
+    details.push(unreachable(error));
+    return false;
+  }
+  for (const connection of there)
+    details.push(
+      `login connection ${connection.id}: ${connection.displayName} (${connection.authority}), register this redirect address with the provider: ${connection.redirectUri}`
+    );
+  let differ = false;
+  for (const connection of configured)
+    if (!there.some((t) => t.id === connection.id)) {
+      details.push(
+        `drift: login connection ${connection.id} is in the config but not on the platform; run deploy`
+      );
+      differ = true;
+    }
+  for (const connection of there)
+    if (!configured.some((c) => c.id === connection.id)) {
+      details.push(
+        `drift: login connection ${connection.id} is on the platform but not in the config; deploy removes it`
+      );
+      differ = true;
+    }
+  return differ;
+}
 async function plansStatus(resolved, ledger, manifest, remote, wantedSkus2) {
   const entry = manifest?.services.plans;
   const failed = failedStep(ledger, "plans", PLANS_STEPS);
@@ -28490,7 +28770,8 @@ async function statusV2(dir, only, options = {}) {
           resolved,
           ledger,
           manifest,
-          options.identityRemote
+          options.identityRemote,
+          options.identityConnectionsRemote
         )
       );
       continue;
@@ -28727,7 +29008,10 @@ async function deployIdentityService(options, deps, projectId, named) {
     service: "identity",
     status: result.status,
     steps: result.steps,
-    url: result.issuer
+    url: result.issuer,
+    notes: (result.connections ?? []).map(
+      (connection) => `login connection ${connection.id}: register this redirect address with the provider: ${connection.redirectUri}`
+    )
   };
 }
 async function deployPlansService(options, deps, projectId, named) {
@@ -28824,7 +29108,8 @@ function formatDeploy(output4) {
       head,
       ...result.steps.map(
         (step2) => `  ${step2.step}: ${step2.skipped ? "skipped (unchanged)" : "ran"}`
-      )
+      ),
+      ...(result.notes ?? []).map((note) => `  ${note}`)
     ];
   });
 }
@@ -29396,14 +29681,14 @@ async function discoverAndWireDocs(siteDirectory) {
       directory.sourceDirectory,
       usedNames
     );
-    const linkDirectory = path89.join(pagesDir, linkName);
+    const linkDirectory2 = path89.join(pagesDir, linkName);
     const linked = [];
     const skipped = [];
     for (const sourcePath of directory.files) {
       const relativeSource = toPosix3(
         path89.relative(directory.sourceDirectory, sourcePath)
       );
-      const linkPath = path89.join(linkDirectory, relativeSource);
+      const linkPath = path89.join(linkDirectory2, relativeSource);
       const relativeLink = toPosix3(path89.relative(site, linkPath));
       const route = toRoutePath(relativeLink, PAGES_DIR);
       if (routes.includes(route)) {
@@ -29426,7 +29711,7 @@ async function discoverAndWireDocs(siteDirectory) {
     }
     sources.push({
       sourceDirectory: directory.sourceDirectory,
-      linkDirectory,
+      linkDirectory: linkDirectory2,
       linkName,
       files: linked,
       skipped
@@ -30166,6 +30451,14 @@ function identityRemote() {
     return void 0;
   }
 }
+function identityConnectionsRemote() {
+  try {
+    const client = new PlatformApiClient(loadConfig());
+    return (projectId) => client.listProjectIdentityConnections(projectId);
+  } catch {
+    return void 0;
+  }
+}
 function plansRemote() {
   try {
     const client = new PlatformApiClient(loadConfig());
@@ -30185,6 +30478,7 @@ var statusOfProject = (argv) => run2(
   (dir, only) => statusV2(dir, only, {
     gatewayRemote: gatewayRemote(),
     identityRemote: identityRemote(),
+    identityConnectionsRemote: identityConnectionsRemote(),
     plansRemote: plansRemote()
   }),
   formatStatus
@@ -30249,7 +30543,9 @@ async function createProjectV2(options, deps) {
     modules,
     wait: options.wait !== false,
     projectId: linkedProjectId,
-    onProjectResolved: (projectId) => setProjectId(options.dir, projectId)
+    onProjectResolved: async (projectId) => {
+      await setProjectId(options.dir, projectId);
+    }
   });
   const outcome = parse4(raw);
   if (outcome.requiresPlatformPlanSelection) {

package/dist/declarations/cli/platform/client/platform-api.d.ts

@@ -423,6 +423,21 @@ export interface ProjectIdentityDto {
     errorMessage?: string | null;
     nativeSignup: boolean;
 }
+export interface ProjectIdentityConnectionDto {
+    id: string;
+    authority: string;
+    clientId: string;
+    scopes: string[];
+    displayName: string;
+    redirectUri: string;
+}
+export interface ProjectIdentityConnectionBody {
+    authority: string;
+    clientId: string;
+    clientSecret?: string;
+    scopes?: string[];
+    displayName?: string;
+}
 export interface ProjectIdentityRequestBody {
     audience?: string;
     portalRedirectUris: string[];
@@ -540,6 +555,9 @@ export declare class PlatformApiClient {
     }): Promise<GatewayDryRunDto>;
     deleteGateway(projectId: string): Promise<GatewayTeardownAcceptedDto>;
     putProjectIdentity(projectId: string, body: ProjectIdentityRequestBody): Promise<ProjectIdentityDto>;
+    putProjectIdentityConnection(projectId: string, connectionId: string, body: ProjectIdentityConnectionBody): Promise<ProjectIdentityConnectionDto>;
+    listProjectIdentityConnections(projectId: string): Promise<ProjectIdentityConnectionDto[]>;
+    deleteProjectIdentityConnection(projectId: string, connectionId: string): Promise<void>;
     getProjectIdentity(projectId: string): Promise<ProjectIdentityDto | null>;
     deleteProjectIdentity(projectId: string): Promise<ProjectIdentityDto | null>;
     linkDevPortalIdentity(projectId: string): Promise<DevPortalIdentityLinkDto>;