npm - @mediamonks/canopy-cli - Versions diffs - 0.7.18 → 0.7.20 - Mend

@mediamonks/canopy-cli 0.7.18 → 0.7.20

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (29) hide show

package/dist/login-CU0pev0k.mjs DELETED Viewed

@@ -1,401 +0,0 @@
-import { _ as writeConfigFile, f as clearAllProfileTokens, g as upsertProfileAuth, h as setActiveProfile, m as readConfigFile, n as siteConfig, p as listBakedProfiles, v as getBakedProfile, y as isProfileId } from "./site-BFaWfSVu.mjs";
-import { n as openBrowser, r as reportErrors } from "./ui-DLZNEen6.mjs";
-import { defineCommand } from "citty";
-import * as p from "@clack/prompts";
-import { createHash, randomBytes } from "node:crypto";
-import { createServer } from "node:http";
-//#region src/login-page.ts
-/**
-* Branded HTML for the local OneLogin PKCE callback (127.0.0.1:8976).
-* Visual language matches apps/gateway/src/auth-page.ts.
-*/
-function loginCallbackPage(ok) {
-	const title = ok ? "You're signed in" : "Sign-in didn’t finish";
-	return `<!doctype html>
-<html lang="en">
-<head>
-<meta charset="utf-8">
-<meta name="viewport" content="width=device-width, initial-scale=1">
-<title>${title} · Canopy</title>
-<style>
-  :root {
-    color-scheme: light dark;
-    --ink: #14201a;
-    --muted: #4a5c52;
-    --line: #d5ddd7;
-    --panel: rgba(255, 255, 255, 0.82);
-    --field: rgba(255, 255, 255, 0.7);
-    --accent: #2f6b4f;
-    --mark-ink: #f4faf6;
-    --shadow: 0 18px 40px -28px rgba(20, 32, 26, 0.45);
-    --bg: radial-gradient(900px 480px at 12% -10%, #dfece3, transparent 60%),
-      radial-gradient(700px 420px at 100% 0%, #e7efe4, transparent 55%),
-      linear-gradient(165deg, #e8f0ea, #f7f5f0 55%, #eef2ef);
-    --mark-bg: ${ok ? "var(--accent)" : "#8a4b3a"};
-  }
-  @media (prefers-color-scheme: dark) {
-    :root {
-      --ink: #e9f0ec;
-      --muted: #a2b3aa;
-      --line: rgba(233, 240, 236, 0.14);
-      --panel: rgba(24, 31, 27, 0.72);
-      --field: rgba(233, 240, 236, 0.06);
-      --accent: #7cc39d;
-      --mark-ink: #0d1410;
-      --shadow: 0 18px 44px -26px rgba(0, 0, 0, 0.7);
-      --bg: radial-gradient(900px 480px at 12% -10%, #16261d, transparent 60%),
-        radial-gradient(700px 420px at 100% 0%, #16221c, transparent 55%),
-        linear-gradient(165deg, #0e1512, #121a15 55%, #0d130f);
-      --mark-bg: ${ok ? "var(--accent)" : "#e0a292"};
-    }
-  }
-  * { box-sizing: border-box; }
-  body {
-    margin: 0;
-    min-height: 100vh;
-    font-family: "Segoe UI", "Helvetica Neue", ui-sans-serif, system-ui, sans-serif;
-    color: var(--ink);
-    background: var(--bg);
-    display: grid;
-    place-items: center;
-    padding: 1.5rem;
-  }
-  main {
-    width: min(100%, 26rem);
-    background: var(--panel);
-    border: 1px solid var(--line);
-    border-radius: 1.25rem;
-    padding: 2rem 1.75rem 1.75rem;
-    backdrop-filter: blur(10px);
-    box-shadow: var(--shadow);
-  }
-  .mark {
-    width: 2.75rem;
-    height: 2.75rem;
-    border-radius: 0.85rem;
-    display: grid;
-    place-items: center;
-    background: var(--mark-bg);
-    color: var(--mark-ink);
-    margin-bottom: 1.25rem;
-  }
-  .mark svg { width: 1.4rem; height: 1.4rem; display: block; }
-  .brand {
-    margin: 0 0 0.35rem;
-    font-size: 0.8rem;
-    font-weight: 600;
-    letter-spacing: 0.04em;
-    text-transform: uppercase;
-    color: var(--accent);
-  }
-  h1 {
-    margin: 0 0 0.75rem;
-    font-size: 1.45rem;
-    line-height: 1.25;
-    letter-spacing: -0.02em;
-    font-weight: 650;
-  }
-  p {
-    margin: 0;
-    color: var(--muted);
-    font-size: 0.975rem;
-    line-height: 1.55;
-  }
-  .hint {
-    margin-top: 1.35rem;
-    padding-top: 1rem;
-    border-top: 1px solid var(--line);
-    font-size: 0.8rem;
-    color: var(--muted);
-  }
-  kbd {
-    font: inherit;
-    font-size: 0.85em;
-    padding: 0.1em 0.35em;
-    border: 1px solid var(--line);
-    border-radius: 0.35rem;
-    background: var(--field);
-  }
-</style>
-</head>
-<body>
-<main>
-  <div class="mark">${ok ? `<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true">
-      <path d="M20 6 9 17l-5-5"/>
-    </svg>` : `<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true">
-      <circle cx="12" cy="12" r="9"/>
-      <path d="M12 8v5"/>
-      <path d="M12 16h.01"/>
-    </svg>`}</div>
-  <p class="brand">Canopy CLI</p>
-  <h1>${title}</h1>
-  <p>${ok ? "You can close this tab and return to the terminal — the CLI has your code." : "Return to the terminal and run canopy login again. Reloading this page won’t help."}</p>
-  <p class="hint">${ok ? "This tab only finishes the browser step — keep using the terminal for the rest." : "If the terminal still says it’s waiting, cancel with <kbd>Ctrl</kbd>+<kbd>C</kbd> and try again."}</p>
-</main>
-</body>
-</html>`;
-}
-//#endregion
-//#region src/login.ts
-/**
-* canopy login | whoami | logout — browser PKCE flow against OneLogin (public
-* client), then trade the ID token for platform CLI tokens via POST
-* /control/v1/auth/cli-token on every baked site (docs/10-cli-sites.md D17).
-*/
-const CALLBACK_PORT = 8976;
-const REDIRECT_URI = `http://127.0.0.1:${CALLBACK_PORT}/callback`;
-const LOGIN_TIMEOUT_MS = 300 * 1e3;
-const base64url = (buf) => buf.toString("base64url");
-const whoamiCommand = defineCommand({
-	meta: {
-		name: "whoami",
-		description: "Show the current Canopy login"
-	},
-	run: reportErrors("whoami", async () => {
-		const config = siteConfig();
-		if (!config.token) throw new Error("Not logged in — run `canopy login`.");
-		console.log(config.email ?? "<unknown email>");
-		if (config.cloud) console.log(`Cloud: ${config.cloud}`);
-		console.log(`API: ${config.apiUrl}`);
-		if (config.tokenExpiresAt !== void 0) {
-			const expired = Date.parse(config.tokenExpiresAt) < Date.now();
-			console.log(expired ? `Token EXPIRED ${config.tokenExpiresAt} — run \`canopy login\` again.` : `Token expires ${config.tokenExpiresAt}.`);
-		}
-	})
-});
-const logoutCommand = defineCommand({
-	meta: {
-		name: "logout",
-		description: "Sign out: forget all local CLI tokens"
-	},
-	run: reportErrors("logout", async () => {
-		const file = readConfigFile();
-		if (!Object.values(file.profiles ?? {}).some((p) => p?.token)) {
-			console.log("Not logged in.");
-			return;
-		}
-		clearAllProfileTokens();
-		console.log("Logged out — all site tokens removed from ~/.canopy/config.json.");
-	})
-});
-/** Wait for OneLogin to redirect back to the local loopback server. */
-function waitForCallback(expectedState) {
-	return new Promise((resolve, reject) => {
-		const server = createServer((req, res) => {
-			const url = new URL(req.url ?? "/", REDIRECT_URI);
-			if (url.pathname !== "/callback") {
-				res.writeHead(404).end();
-				return;
-			}
-			const code = url.searchParams.get("code");
-			const state = url.searchParams.get("state");
-			const ok = Boolean(code) && state === expectedState;
-			res.writeHead(ok ? 200 : 400, {
-				"content-type": "text/html; charset=utf-8",
-				"cache-control": "no-store"
-			}).end(loginCallbackPage(ok));
-			server.close();
-			clearTimeout(timer);
-			if (ok) resolve(code);
-			else reject(new Error(url.searchParams.get("error_description") ?? "Login rejected"));
-		});
-		const timer = setTimeout(() => {
-			server.close();
-			reject(/* @__PURE__ */ new Error("Timed out waiting for the browser login (5 minutes)."));
-		}, LOGIN_TIMEOUT_MS);
-		server.on("error", (err) => reject(err.message.includes("EADDRINUSE") ? /* @__PURE__ */ new Error(`Port ${CALLBACK_PORT} is in use — close the other process and retry.`) : err));
-		server.listen(CALLBACK_PORT, "127.0.0.1");
-	});
-}
-async function pickActiveProfile(json, flag) {
-	if (flag) {
-		if (!isProfileId(flag)) throw new Error(`Unknown profile "${flag}". Choose one of: ${listBakedProfiles().map((p) => p.id).join(", ")}.`);
-		return flag;
-	}
-	const env = process.env["CANOPY_PROFILE"]?.trim();
-	if (env) {
-		if (!isProfileId(env)) throw new Error(`Unknown CANOPY_PROFILE "${env}".`);
-		return env;
-	}
-	const profiles = listBakedProfiles();
-	if (!process.stdin.isTTY || json) throw new Error(`Pass --profile <id> (or CANOPY_PROFILE) when not on a TTY. Options: ${profiles.map((p) => p.id).join(", ")}.`);
-	const choice = await p.select({
-		message: "Which Canopy site should be your default?",
-		options: profiles.map((prof) => ({
-			value: prof.id,
-			label: prof.label,
-			hint: prof.cloud
-		})),
-		initialValue: "main"
-	});
-	if (p.isCancel(choice)) {
-		p.cancel("Login cancelled.");
-		process.exit(1);
-	}
-	p.note(`Using profile "${choice}". Agents/non-TTY: canopy login --profile ${choice}`, "Active profile");
-	return choice;
-}
-async function mintForProfile(id, idToken) {
-	const baked = getBakedProfile(id);
-	try {
-		const cliTokenRes = await fetch(`${baked.apiUrl}/control/v1/auth/cli-token`, {
-			method: "POST",
-			headers: { "content-type": "application/json" },
-			body: JSON.stringify({ id_token: idToken })
-		});
-		if (!cliTokenRes.ok) return {
-			ok: false,
-			error: `${cliTokenRes.status} ${await cliTokenRes.text()}`
-		};
-		const { token, expires_at, user } = await cliTokenRes.json();
-		upsertProfileAuth(id, {
-			token,
-			tokenExpiresAt: expires_at,
-			email: user.email
-		});
-		return {
-			ok: true,
-			email: user.email,
-			expiresAt: expires_at
-		};
-	} catch (err) {
-		return {
-			ok: false,
-			error: err instanceof Error ? err.message : String(err)
-		};
-	}
-}
-async function login(json, profileFlag) {
-	if (!json) p.intro("canopy login");
-	const active = await pickActiveProfile(json, profileFlag);
-	const file = readConfigFile();
-	const { issuer, cliClientId } = {
-		issuer: process.env["CANOPY_OIDC_ISSUER"] ?? file.issuer ?? "https://s4capital.onelogin.com/oidc/2",
-		cliClientId: process.env["CANOPY_OIDC_CLIENT_ID"] ?? file.cliClientId ?? "b69755d0-6678-013f-b5ce-09fe44a57aa0180501"
-	};
-	if (cliClientId.includes("REPLACE")) throw new Error("The CLI's OneLogin app is not configured yet (set CANOPY_OIDC_CLIENT_ID or packages/cli/src/config.ts).");
-	writeConfigFile({
-		...file,
-		issuer,
-		cliClientId,
-		activeProfile: active
-	});
-	const discoveryRes = await fetch(`${issuer}/.well-known/openid-configuration`);
-	if (!discoveryRes.ok) throw new Error(`OIDC discovery failed: ${discoveryRes.status}`);
-	const discovery = await discoveryRes.json();
-	const state = base64url(randomBytes(32));
-	const codeVerifier = base64url(randomBytes(32));
-	const authorizeUrl = new URL(discovery.authorization_endpoint);
-	authorizeUrl.search = new URLSearchParams({
-		response_type: "code",
-		client_id: cliClientId,
-		redirect_uri: REDIRECT_URI,
-		scope: "openid profile email",
-		state,
-		code_challenge: base64url(createHash("sha256").update(codeVerifier).digest()),
-		code_challenge_method: "S256"
-	}).toString();
-	const authorizeHref = authorizeUrl.toString();
-	openBrowser(authorizeHref);
-	const spin = json ? void 0 : p.spinner();
-	if (json) console.log(JSON.stringify({
-		status: "waiting",
-		url: authorizeHref
-	}));
-	else {
-		p.log.step("Opening OneLogin in your browser");
-		p.log.message("If nothing opens, visit:");
-		console.log(authorizeHref);
-		spin?.start("Waiting for you to sign in in the browser…");
-	}
-	let code;
-	try {
-		code = await waitForCallback(state);
-	} catch (err) {
-		spin?.error("Sign-in failed.");
-		throw err;
-	}
-	spin?.stop("Signed in with OneLogin.");
-	const tokenRes = await fetch(discovery.token_endpoint, {
-		method: "POST",
-		headers: { "content-type": "application/x-www-form-urlencoded" },
-		body: new URLSearchParams({
-			grant_type: "authorization_code",
-			client_id: cliClientId,
-			code,
-			redirect_uri: REDIRECT_URI,
-			code_verifier: codeVerifier
-		})
-	});
-	if (!tokenRes.ok) throw new Error(`Token exchange failed: ${tokenRes.status} ${await tokenRes.text()}`);
-	const { id_token: idToken } = await tokenRes.json();
-	if (!idToken) throw new Error("OneLogin returned no id_token.");
-	const mintSpin = json ? void 0 : p.spinner();
-	mintSpin?.start("Minting CLI tokens for each site…");
-	const results = [];
-	for (const prof of listBakedProfiles()) {
-		const result = await mintForProfile(prof.id, idToken);
-		results.push({
-			id: prof.id,
-			ok: result.ok,
-			detail: result.ok ? `expires ${result.expiresAt}` : result.error
-		});
-	}
-	mintSpin?.stop("Token mint finished.");
-	if (!results.find((r) => r.id === active)?.ok) {
-		const summary = results.map((r) => `${r.id} ${r.ok ? "✓" : "✗"}`).join("  ");
-		throw new Error(`Could not mint a token for active profile "${active}". ${summary}. Re-run \`canopy login\`.`);
-	}
-	setActiveProfile(active);
-	const email = readConfigFile().profiles?.[active]?.email;
-	const summary = results.map((r) => `${r.id} ${r.ok ? "✓" : `✗ (${r.detail})`}`).join("\n");
-	if (json) console.log(JSON.stringify({
-		status: "ok",
-		email,
-		activeProfile: active,
-		profiles: Object.fromEntries(results.map((r) => [r.id, {
-			ok: r.ok,
-			detail: r.detail
-		}]))
-	}));
-	else {
-		p.note(summary, "Sites");
-		p.outro(`Logged in as ${email ?? "unknown"} — default profile "${active}".`);
-		for (const r of results.filter((x) => !x.ok)) p.log.warn(`${r.id} failed — re-run \`canopy login\` to retry all sites.`);
-	}
-}
-const loginCommand = defineCommand({
-	meta: {
-		name: "login",
-		description: "Sign in to Canopy via OneLogin"
-	},
-	args: {
-		json: {
-			type: "boolean",
-			default: false,
-			description: "Emit machine-readable status to stdout (for agents/CI)"
-		},
-		profile: {
-			type: "string",
-			description: "Active default profile (main | staging | gcp-pilot); required non-TTY"
-		}
-	},
-	run: reportErrors("login", async ({ args }) => {
-		const json = args.json;
-		try {
-			await login(json, args.profile);
-		} catch (err) {
-			if (json) {
-				console.log(JSON.stringify({
-					status: "error",
-					message: err instanceof Error ? err.message : String(err)
-				}));
-				process.exitCode = 1;
-				return;
-			}
-			throw err;
-		}
-	})
-});
-//#endregion
-export { loginCommand, logoutCommand, whoamiCommand };