@meistrari/tela-cli 0.1.1 → 0.3.0

package/src/config.ts

@@ -1,24 +1,66 @@
 import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'
 import { homedir } from 'node:os'
 import { isAbsolute, join } from 'node:path'
-import type { TelaCliConfig } from './types.ts'
+import { listOrganizations, provisionForgejoUser } from './agent-api.ts'
+import type { FetchLike } from './auth.ts'
+import { createUserFacingError } from './errors.ts'
+import {
+    ensureForgejoUserAccess,
+    listDiscoveredSshPublicKeys,
+    loadSshPublicKey,
+    validateSshPublicKeyPath,
+    type SelectedSshPublicKey,
+} from './forgejo.ts'
+import type {
+    TelaCliAuthState,
+    TelaCliConfig,
+    TelaCliForgejoOrganization,
+    TelaEnvironment,
+} from './types.ts'
 
 const CONFIG_FILENAME = 'tela-cli.json'
-export const AGENT_API_PRESET_URLS = {
-    production: 'https://agent-api.tela.com',
-    staging: 'https://agent-api-staging.tela.com',
-} as const
-export type AgentApiPreset = keyof typeof AGENT_API_PRESET_URLS | 'custom'
-export const DEFAULT_AGENT_API_URL = AGENT_API_PRESET_URLS.production
-export const AGENT_API_BROWSER_HELP = 'API-only endpoint; browser navigation is not expected.'
-const AGENT_API_PRESET_ALIASES: Record<Exclude<AgentApiPreset, 'custom'>, string[]> = {
-    production: [AGENT_API_PRESET_URLS.production],
-    staging: [
-        AGENT_API_PRESET_URLS.staging,
-        'https://agent-api-staging.tela.com',
-    ],
-}
 const DEFAULT_CLONE_ROOT_SEGMENTS = ['Code', 'Tela']
+const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i
+
+const PLACEHOLDER_APPLICATION_IDS = new Set([
+    '00000000-0000-4000-8000-000000000001',
+    '00000000-0000-4000-8000-000000000002',
+    '00000000-0000-4000-8000-000000000003',
+    '00000000-0000-4000-8000-000000000004',
+])
+
+export const DEFAULT_SETUP_AUTH_TIMEOUT_MS = 15 * 60 * 1000
+export const DEVICE_FLOW_BROWSER_HELP = 'Tela sign-in uses a browser-based device flow and continues polling until you approve the request.'
+const CUSTOM_SSH_KEY_OPTION = '__custom__'
+
+export interface SetupEnvironmentConfig {
+    environment: TelaEnvironment
+    agentApiUrl: string
+    authApiUrl: string
+    authDashboardUrl: string
+    telaApiUrl: string
+    requesterApplicationId: string
+    targetApplicationId: string
+}
+
+export const ENVIRONMENT_PRESETS: Record<Exclude<TelaEnvironment, 'custom'>, Omit<SetupEnvironmentConfig, 'environment'>> = {
+    production: {
+        agentApiUrl: 'https://agent-api-production-81c9.up.railway.app',
+        authApiUrl: 'https://auth.tela.com',
+        authDashboardUrl: 'https://accounts.tela.com',
+        telaApiUrl: 'https://api.tela.com',
+        requesterApplicationId: '860d5506-cab2-4b8b-b08b-fb4222b65bb2',
+        targetApplicationId: 'fe9fa028-4d34-407c-b27a-2ecc4779ae69',
+    },
+    staging: {
+        agentApiUrl: 'https://agent-api.telastaging.com',
+        authApiUrl: 'https://auth-api.telastaging.com',
+        authDashboardUrl: 'https://accounts.telastaging.com',
+        telaApiUrl: 'https://api.telastaging.com',
+        requesterApplicationId: 'c5cda347-835e-497c-bdeb-a464f5a1beb0',
+        targetApplicationId: '1c021ec1-b7d1-4d72-8733-ac69d930b2df',
+    },
+}
 
 export interface TextPromptOptions {
     message: string
@@ -27,10 +69,6 @@ export interface TextPromptOptions {
     validate?: (value: string) => string | undefined
 }
 
-export interface PasswordPromptOptions extends TextPromptOptions {
-    mask?: string
-}
-
 export interface Option<T> {
     value: T
     label: string
@@ -59,74 +97,37 @@ export interface PromptModule {
     note?(message: string, title?: string): void
     select<T>(options: SelectOptions<T>): Promise<T | symbol>
     text(options: TextPromptOptions): Promise<string | symbol>
-    password(options: PasswordPromptOptions): Promise<string | symbol>
 }
 
-function promptValue<T>(value: T | symbol): T {
-    return value as T
+export interface SetupConfigInput extends SetupEnvironmentConfig {
+    cloneRoot: string
 }
 
-export function ensureAbsoluteUrl(value: string, label: string): string {
-    let url: URL
-    try {
-        url = new URL(value)
-    }
-    catch {
-        throw new Error(`${label} must be a valid URL`)
-    }
-
-    return url.toString().replace(/\/$/, '')
-}
+export type SetupAuthenticateFn = (
+    input: SetupConfigInput,
+    notify: (message: string, title?: string) => void,
+) => Promise<TelaCliAuthState>
 
-export const AGENT_API_PRESET_OPTIONS: Array<Option<AgentApiPreset>> = [
+export const ENVIRONMENT_PRESET_OPTIONS: Array<Option<TelaEnvironment>> = [
     {
         value: 'production',
         label: 'Production',
-        hint: AGENT_API_PRESET_URLS.production,
+        hint: ENVIRONMENT_PRESETS.production.agentApiUrl,
     },
     {
         value: 'staging',
         label: 'Staging',
-        hint: AGENT_API_PRESET_URLS.staging,
+        hint: ENVIRONMENT_PRESETS.staging.agentApiUrl,
     },
     {
         value: 'custom',
         label: 'Custom',
-        hint: 'Enter a custom API origin URL',
+        hint: 'Enter custom Tela service URLs and app IDs',
     },
 ]
 
-export function inferAgentApiPreset(agentApiUrl: string | null | undefined): AgentApiPreset {
-    if (!agentApiUrl) {
-        return 'production'
-    }
-
-    let normalized = agentApiUrl.trim()
-    try {
-        normalized = ensureAbsoluteUrl(normalized, 'Agent API origin URL')
-    }
-    catch {
-        return 'custom'
-    }
-
-    for (const preset of ['production', 'staging'] as const) {
-        if (AGENT_API_PRESET_ALIASES[preset].includes(normalized)) {
-            return preset
-        }
-    }
-
-    return 'custom'
-}
-
-export function resolveAgentApiUrlForPreset(preset: AgentApiPreset, customUrl = ''): string {
-    switch (preset) {
-        case 'production':
-            return AGENT_API_PRESET_URLS.production
-        case 'staging':
-            return AGENT_API_PRESET_URLS.staging
-        case 'custom':
-            return ensureAbsoluteUrl(customUrl, 'Agent API origin URL')
-    }
+function promptValue<T>(value: T | symbol): T {
+    return value as T
 }
 
 function ensureNonEmpty(value: string, label: string): string {
@@ -138,63 +139,124 @@ function ensureNonEmpty(value: string, label: string): string {
     return normalized
 }
 
-function getHomeDir(): string {
-    return process.env.HOME || homedir()
-}
+function ensureEnvironment(value: string): TelaEnvironment {
+    if (value === 'production' || value === 'staging' || value === 'custom') {
+        return value
+    }
 
-function getTelaDir(): string {
-    return join(getHomeDir(), '.tela')
+    throw new Error('Environment must be production, staging, or custom')
 }
 
-export function getDefaultCloneRoot(): string {
-    return join(getHomeDir(), ...DEFAULT_CLONE_ROOT_SEGMENTS)
-}
+function ensureAbsoluteUrl(value: string, label: string): string {
+    let url: URL
+    try {
+        url = new URL(value)
+    }
+    catch {
+        throw new Error(`${label} must be a valid URL`)
+    }
 
-export function resolveCloneRoot(value: string): string {
-    const expanded = expandHome(ensureNonEmpty(value, 'Clone root'))
-    return isAbsolute(expanded) ? expanded : join(process.cwd(), expanded)
+    return url.toString().replace(/\/$/, '')
 }
 
-export function validateAgentApiUrl(value: string): string | undefined {
-    try {
-        ensureAbsoluteUrl(value, 'Agent API origin URL')
-        return undefined
-    }
-    catch (error) {
-        return error instanceof Error ? error.message : 'Invalid URL'
+function ensureUuid(value: string, label: string): string {
+    const normalized = ensureNonEmpty(value, label)
+    if (!UUID_PATTERN.test(normalized)) {
+        throw new Error(`${label} must be a UUID`)
     }
+
+    return normalized
 }
 
-export function validateCloneRoot(value: string): string | undefined {
-    try {
-        resolveCloneRoot(value)
-        return undefined
+function normalizeAuth(auth: TelaCliConfig['auth']): TelaCliConfig['auth'] {
+    if (!auth) {
+        return null
     }
-    catch (error) {
-        return error instanceof Error ? error.message : 'Invalid directory'
+
+    const user = auth.user ?? {} as TelaCliAuthState['user']
+    const workspace = auth.workspace ?? {} as TelaCliAuthState['workspace']
+    const session = auth.session ?? {} as TelaCliAuthState['session']
+
+    const expiresAt = Number(session.expiresAt)
+    if (!Number.isFinite(expiresAt) || expiresAt <= 0) {
+        throw new Error('Auth session expiration must be a valid timestamp')
+    }
+
+    return {
+        user: {
+            id: ensureNonEmpty(String(user.id ?? ''), 'Authenticated user ID'),
+            email: ensureNonEmpty(String(user.email ?? ''), 'Authenticated user email'),
+            name: ensureNonEmpty(String(user.name ?? user.email ?? ''), 'Authenticated user name'),
+        },
+        workspace: {
+            id: ensureNonEmpty(String(workspace.id ?? ''), 'Authenticated workspace ID'),
+            title: ensureNonEmpty(String(workspace.title ?? ''), 'Authenticated workspace title'),
+        },
+        session: {
+            accessToken: ensureNonEmpty(String(session.accessToken ?? ''), 'Auth access token'),
+            refreshToken: ensureNonEmpty(String(session.refreshToken ?? ''), 'Auth refresh token'),
+            expiresAt,
+        },
     }
 }
 
-export function validateApiKey(value: string, existingApiKey?: string): string | undefined {
-    const nextValue = value.trim() || existingApiKey || ''
-    return nextValue ? undefined : 'API key is required'
+function normalizeForgejoOrganization(
+    organization: TelaCliConfig['forgejoOrganization'],
+): TelaCliForgejoOrganization | null {
+    if (!organization) {
+        return null
+    }
+
+    return {
+        id: ensureNonEmpty(String(organization.id ?? ''), 'Forgejo organization ID'),
+        name: ensureNonEmpty(String(organization.name ?? ''), 'Forgejo organization name'),
+    }
 }
 
 function normalizeConfig(config: TelaCliConfig): TelaCliConfig {
+    const environment = ensureEnvironment(config.environment)
+    const auth = normalizeAuth(config.auth)
+
     return {
+        environment,
         agentApiUrl: ensureAbsoluteUrl(config.agentApiUrl, 'Agent API origin URL'),
+        authApiUrl: ensureAbsoluteUrl(config.authApiUrl, 'Auth API URL'),
+        authDashboardUrl: ensureAbsoluteUrl(config.authDashboardUrl, 'Auth dashboard URL'),
+        telaApiUrl: ensureAbsoluteUrl(config.telaApiUrl, 'Tela API URL'),
         cloneRoot: resolveCloneRoot(config.cloneRoot),
-        apiKey: ensureNonEmpty(config.apiKey, 'API key'),
+        requesterApplicationId: ensureUuid(config.requesterApplicationId, 'Requester application ID'),
+        targetApplicationId: ensureUuid(config.targetApplicationId, 'Target application ID'),
+        auth,
+        forgejoOrganization: auth ? normalizeForgejoOrganization(config.forgejoOrganization) : null,
+        forgejoUserRegistered: Boolean(config.forgejoUserRegistered),
     }
 }
 
 function parseJsonConfig(input: string): TelaCliConfig {
-    const parsed = JSON.parse(input) as Partial<Record<keyof TelaCliConfig, unknown>>
+    const parsed = JSON.parse(input) as Partial<Record<keyof TelaCliConfig, unknown>> & {
+        auth?: Partial<Record<'user' | 'workspace' | 'session', unknown>> | null
+    }
+
+    const auth = parsed.auth == null
+        ? null
+        : {
+            user: parsed.auth.user as TelaCliAuthState['user'],
+            workspace: parsed.auth.workspace as TelaCliAuthState['workspace'],
+            session: parsed.auth.session as TelaCliAuthState['session'],
+        }
 
     return normalizeConfig({
+        environment: String(parsed.environment ?? '') as TelaEnvironment,
         agentApiUrl: String(parsed.agentApiUrl ?? ''),
+        authApiUrl: String(parsed.authApiUrl ?? ''),
+        authDashboardUrl: String(parsed.authDashboardUrl ?? ''),
+        telaApiUrl: String(parsed.telaApiUrl ?? ''),
         cloneRoot: String(parsed.cloneRoot ?? ''),
-        apiKey: String(parsed.apiKey ?? ''),
+        requesterApplicationId: String(parsed.requesterApplicationId ?? ''),
+        targetApplicationId: String(parsed.targetApplicationId ?? ''),
+        auth,
+        forgejoOrganization: parsed.forgejoOrganization as TelaCliConfig['forgejoOrganization'] ?? null,
+        forgejoUserRegistered: Boolean(parsed.forgejoUserRegistered ?? false),
     })
 }
 
@@ -212,6 +274,57 @@ function cancelSetup(prompts: PromptModule): never {
     throw new Error('Setup cancelled')
 }
 
+async function promptForSshPublicKey(prompts: PromptModule): Promise<SelectedSshPublicKey> {
+    const discoveredKeys = listDiscoveredSshPublicKeys()
+    if (discoveredKeys.length === 0) {
+        prompts.note?.('No SSH public keys were found under ~/.ssh. Enter a custom public key path to continue.', 'SSH key')
+    }
+
+    const selection = await prompts.select<string>({
+        message: 'SSH public key to send',
+        initialValue: discoveredKeys[0]?.path ?? CUSTOM_SSH_KEY_OPTION,
+        options: [
+            ...discoveredKeys.map(key => ({
+                value: key.path,
+                label: key.title,
+                hint: key.path,
+            })),
+            {
+                value: CUSTOM_SSH_KEY_OPTION,
+                label: 'Custom path…',
+                hint: 'Load another public key file',
+            },
+        ],
+    })
+    if (prompts.isCancel(selection)) {
+        cancelSetup(prompts)
+    }
+
+    const selectedValue = promptValue(selection)
+    if (selectedValue !== CUSTOM_SSH_KEY_OPTION) {
+        return discoveredKeys.find(key => key.path === selectedValue) ?? loadSshPublicKey(selectedValue)
+    }
+
+    const customPath = await prompts.text({
+        message: 'SSH public key path',
+        placeholder: '~/.ssh/id_ed25519.pub',
+        validate: validateSshPublicKeyPath,
+    })
+    if (prompts.isCancel(customPath)) {
+        cancelSetup(prompts)
+    }
+
+    return loadSshPublicKey(promptValue(customPath))
+}
+
+function getHomeDir(): string {
+    return process.env.HOME || homedir()
+}
+
+function getTelaDir(): string {
+    return join(getHomeDir(), '.tela')
+}
+
 export function getConfigPath(): string {
     return join(getTelaDir(), CONFIG_FILENAME)
 }
@@ -228,8 +341,77 @@ export function expandHome(input: string): string {
     return input
 }
 
-export function redactApiKey(apiKey: string): string {
-    const trimmed = apiKey.trim()
+export function getDefaultCloneRoot(): string {
+    return join(getHomeDir(), ...DEFAULT_CLONE_ROOT_SEGMENTS)
+}
+
+export function resolveCloneRoot(value: string): string {
+    const expanded = expandHome(ensureNonEmpty(value, 'Clone root'))
+    return isAbsolute(expanded) ? expanded : join(process.cwd(), expanded)
+}
+
+export function validateCloneRoot(value: string): string | undefined {
+    try {
+        resolveCloneRoot(value)
+        return undefined
+    }
+    catch (error) {
+        return error instanceof Error ? error.message : 'Invalid directory'
+    }
+}
+
+export function validateAgentApiUrl(value: string): string | undefined {
+    try {
+        ensureAbsoluteUrl(value, 'Agent API origin URL')
+        return undefined
+    }
+    catch (error) {
+        return error instanceof Error ? error.message : 'Invalid URL'
+    }
+}
+
+export function validateAuthApiUrl(value: string): string | undefined {
+    try {
+        ensureAbsoluteUrl(value, 'Auth API URL')
+        return undefined
+    }
+    catch (error) {
+        return error instanceof Error ? error.message : 'Invalid URL'
+    }
+}
+
+export function validateAuthDashboardUrl(value: string): string | undefined {
+    try {
+        ensureAbsoluteUrl(value, 'Auth dashboard URL')
+        return undefined
+    }
+    catch (error) {
+        return error instanceof Error ? error.message : 'Invalid URL'
+    }
+}
+
+export function validateTelaApiUrl(value: string): string | undefined {
+    try {
+        ensureAbsoluteUrl(value, 'Tela API URL')
+        return undefined
+    }
+    catch (error) {
+        return error instanceof Error ? error.message : 'Invalid URL'
+    }
+}
+
+export function validateApplicationId(value: string, label = 'Application ID'): string | undefined {
+    try {
+        ensureUuid(value, label)
+        return undefined
+    }
+    catch (error) {
+        return error instanceof Error ? error.message : 'Invalid application ID'
+    }
+}
+
+export function redactSecret(secret: string): string {
+    const trimmed = secret.trim()
     if (!trimmed) {
         return '<missing>'
     }
@@ -241,6 +423,37 @@ export function redactApiKey(apiKey: string): string {
     return `${trimmed.slice(0, 4)}***${trimmed.slice(-4)}`
 }
 
+export function resolveEnvironmentConfigForPreset(
+    environment: TelaEnvironment,
+    custom: Partial<Omit<SetupEnvironmentConfig, 'environment'>> = {},
+): SetupEnvironmentConfig {
+    if (environment === 'custom') {
+        return {
+            environment,
+            agentApiUrl: ensureAbsoluteUrl(String(custom.agentApiUrl ?? ''), 'Agent API origin URL'),
+            authApiUrl: ensureAbsoluteUrl(String(custom.authApiUrl ?? ''), 'Auth API URL'),
+            authDashboardUrl: ensureAbsoluteUrl(String(custom.authDashboardUrl ?? ''), 'Auth dashboard URL'),
+            telaApiUrl: ensureAbsoluteUrl(String(custom.telaApiUrl ?? ''), 'Tela API URL'),
+            requesterApplicationId: ensureUuid(String(custom.requesterApplicationId ?? ''), 'Requester application ID'),
+            targetApplicationId: ensureUuid(String(custom.targetApplicationId ?? ''), 'Target application ID'),
+        }
+    }
+
+    const preset = ENVIRONMENT_PRESETS[environment]
+    return {
+        environment,
+        ...preset,
+    }
+}
+
+export function isPlaceholderApplicationId(value: string): boolean {
+    return PLACEHOLDER_APPLICATION_IDS.has(value.trim())
+}
+
+export function hasSavedAuth(config: TelaCliConfig | null | undefined): boolean {
+    return Boolean(config?.auth?.session.accessToken && config.auth?.session.refreshToken)
+}
+
 export function loadConfig(): TelaCliConfig | null {
     const configPath = getConfigPath()
     if (!existsSync(configPath)) {
@@ -290,50 +503,191 @@ export function saveConfig(config: TelaCliConfig): void {
     chmodSync(configPath, 0o600)
 }
 
+export function clearSavedAuth(config: TelaCliConfig): TelaCliConfig {
+    const cleared = normalizeConfig({
+        ...config,
+        auth: null,
+        forgejoOrganization: null,
+        forgejoUserRegistered: false,
+    })
+    saveConfig(cleared)
+    return cleared
+}
+
+function createMissingForgejoOrganizationsError(workspaceTitle: string): ReturnType<typeof createUserFacingError> {
+    return createUserFacingError({
+        code: 'workspace_organization_required',
+        summary: 'No Forgejo organizations are registered for this workspace.',
+        details: `Tela authenticated successfully for ${workspaceTitle}, but the workspace does not have any registered organizations yet.`,
+        fixes: [
+            'Ask the Tela team to register at least one organization for this workspace, then rerun `tela setup`.',
+        ],
+    })
+}
+
+export function getPreferredForgejoOrganization(
+    existingConfig: TelaCliConfig | null | undefined,
+    auth: TelaCliAuthState,
+    organizations: TelaCliForgejoOrganization[],
+): TelaCliForgejoOrganization | null {
+    if (!existingConfig?.forgejoOrganization) {
+        return null
+    }
+
+    if (existingConfig.auth?.workspace.id !== auth.workspace.id) {
+        return null
+    }
+
+    return organizations.find(organization => organization.id === existingConfig.forgejoOrganization?.id) ?? null
+}
+
+async function resolveForgejoOrganizationInteractive(options: {
+    prompts: PromptModule
+    existingConfig: TelaCliConfig | null
+    auth: TelaCliAuthState
+    config: TelaCliConfig
+    fetchFn?: FetchLike
+}): Promise<TelaCliForgejoOrganization> {
+    const organizations = await listOrganizations(options.config, options.fetchFn)
+    if (organizations.length === 0) {
+        throw createMissingForgejoOrganizationsError(options.auth.workspace.title)
+    }
+
+    const preferredOrganization = getPreferredForgejoOrganization(
+        options.existingConfig,
+        options.auth,
+        organizations,
+    )
+
+    if (organizations.length === 1) {
+        const organization = organizations[0]!
+        options.prompts.note?.(`Using workspace organization ${organization.name}.`, 'Organization')
+        return organization
+    }
+
+    const selection = await options.prompts.select<string>({
+        message: 'Forgejo organization',
+        initialValue: preferredOrganization?.id ?? organizations[0]?.id,
+        options: organizations.map(organization => ({
+            value: organization.id,
+            label: organization.name,
+            hint: organization.id === preferredOrganization?.id ? 'saved from previous setup' : undefined,
+        })),
+    })
+    if (options.prompts.isCancel(selection)) {
+        cancelSetup(options.prompts)
+    }
+
+    const selectedId = promptValue(selection)
+    const selectedOrganization = organizations.find(organization => organization.id === selectedId)
+    if (!selectedOrganization) {
+        throw new Error(`Unknown organization selection: ${selectedId}`)
+    }
+
+    options.prompts.note?.(`Selected workspace organization ${selectedOrganization.name}.`, 'Organization')
+    return selectedOrganization
+}
+
 export async function setupConfigInteractive(options: {
     prompts?: PromptModule
     existingConfig?: TelaCliConfig | null
     skipLifecycle?: boolean
-} = {}): Promise<TelaCliConfig> {
+    authenticate: SetupAuthenticateFn
+    fetchFn?: FetchLike
+    provisionForgejoUser?: typeof provisionForgejoUser
+}): Promise<TelaCliConfig> {
     const prompts = options.prompts
     if (!prompts) {
         throw new Error('Interactive prompts are not available without a prompt implementation.')
     }
-    const existingConfig = options.existingConfig ?? tryLoadConfig()
 
+    const existingConfig = options.existingConfig ?? tryLoadConfig()
     if (!options.skipLifecycle) {
         prompts.intro('Tela CLI setup')
     }
 
-    prompts.note?.(AGENT_API_BROWSER_HELP, 'Agent API')
-    const initialAgentApiPreset = inferAgentApiPreset(existingConfig?.agentApiUrl ?? DEFAULT_AGENT_API_URL)
-    const agentApiPresetResult = await prompts.select<AgentApiPreset>({
-        message: 'Agent API target',
-        initialValue: initialAgentApiPreset,
-        options: AGENT_API_PRESET_OPTIONS,
-    })
+    prompts.note?.(DEVICE_FLOW_BROWSER_HELP, 'Authentication')
 
-    if (prompts.isCancel(agentApiPresetResult)) {
+    const environmentResult = await prompts.select<TelaEnvironment>({
+        message: 'Tela environment',
+        initialValue: existingConfig?.environment ?? 'production',
+        options: ENVIRONMENT_PRESET_OPTIONS,
+    })
+    if (prompts.isCancel(environmentResult)) {
         cancelSetup(prompts)
     }
 
-    const agentApiPreset = promptValue(agentApiPresetResult)
-    let agentApiUrl = agentApiPreset === 'custom'
-        ? (initialAgentApiPreset === 'custom' ? (existingConfig?.agentApiUrl ?? '') : '')
-        : resolveAgentApiUrlForPreset(agentApiPreset)
-    if (agentApiPreset === 'custom') {
-        prompts.note?.(AGENT_API_BROWSER_HELP, 'Agent API origin')
-        const customAgentApiUrlResult = await prompts.text({
-            message: 'Custom Agent API origin URL',
-            defaultValue: initialAgentApiPreset === 'custom' ? existingConfig?.agentApiUrl : undefined,
-            validate: validateAgentApiUrl,
-        })
-
-        if (prompts.isCancel(customAgentApiUrlResult)) {
-            cancelSetup(prompts)
+    const environment = promptValue(environmentResult)
+    const customDefaults = environment === 'custom' && existingConfig?.environment === 'custom'
+        ? existingConfig
+        : null
+
+    const customValues: Partial<Omit<SetupEnvironmentConfig, 'environment'>> = {}
+    if (environment === 'custom') {
+        const promptsByField: Array<{
+            key: keyof Omit<SetupEnvironmentConfig, 'environment'>
+            message: string
+            placeholder: string
+            defaultValue?: string
+            validate: (value: string) => string | undefined
+        }> = [
+            {
+                key: 'agentApiUrl',
+                message: 'Custom Agent API origin URL',
+                placeholder: 'https://agent-api.example.com',
+                defaultValue: customDefaults?.agentApiUrl,
+                validate: validateAgentApiUrl,
+            },
+            {
+                key: 'authApiUrl',
+                message: 'Custom Auth API URL',
+                placeholder: 'https://auth.example.com',
+                defaultValue: customDefaults?.authApiUrl,
+                validate: validateAuthApiUrl,
+            },
+            {
+                key: 'authDashboardUrl',
+                message: 'Custom Auth dashboard URL',
+                placeholder: 'https://accounts.example.com',
+                defaultValue: customDefaults?.authDashboardUrl,
+                validate: validateAuthDashboardUrl,
+            },
+            {
+                key: 'telaApiUrl',
+                message: 'Custom Tela API URL',
+                placeholder: 'https://api.example.com',
+                defaultValue: customDefaults?.telaApiUrl,
+                validate: validateTelaApiUrl,
+            },
+            {
+                key: 'requesterApplicationId',
+                message: 'Requester application ID',
+                placeholder: '00000000-0000-0000-0000-000000000000',
+                defaultValue: customDefaults?.requesterApplicationId,
+                validate: value => validateApplicationId(value, 'Requester application ID'),
+            },
+            {
+                key: 'targetApplicationId',
+                message: 'Target application ID',
+                placeholder: '00000000-0000-0000-0000-000000000000',
+                defaultValue: customDefaults?.targetApplicationId,
+                validate: value => validateApplicationId(value, 'Target application ID'),
+            },
+        ]
+
+        for (const field of promptsByField) {
+            const response = await prompts.text({
+                message: field.message,
+                placeholder: field.placeholder,
+                defaultValue: field.defaultValue,
+                validate: field.validate,
+            })
+            if (prompts.isCancel(response)) {
+                cancelSetup(prompts)
+            }
+
+            customValues[field.key] = promptValue(response)
         }
-
-        agentApiUrl = resolveAgentApiUrlForPreset('custom', promptValue(customAgentApiUrlResult))
     }
 
     const cloneRootResult = await prompts.text({
@@ -341,44 +695,65 @@ export async function setupConfigInteractive(options: {
         defaultValue: existingConfig?.cloneRoot ?? getDefaultCloneRoot(),
         validate: validateCloneRoot,
     })
-
     if (prompts.isCancel(cloneRootResult)) {
         cancelSetup(prompts)
     }
 
-    const apiKeyResult = await prompts.password({
-        message: existingConfig?.apiKey ? 'API key' : 'API key',
-        placeholder: existingConfig?.apiKey ? 'Leave blank to keep the current API key' : undefined,
-        mask: '*',
-        validate: value => validateApiKey(value, existingConfig?.apiKey),
-    })
+    const sshKey = await promptForSshPublicKey(prompts)
 
-    if (prompts.isCancel(apiKeyResult)) {
-        cancelSetup(prompts)
+    const resolvedSetup = {
+        ...resolveEnvironmentConfigForPreset(environment, customValues),
+        cloneRoot: resolveCloneRoot(promptValue(cloneRootResult)),
     }
 
+    const auth = await options.authenticate(
+        resolvedSetup,
+        (message, title) => {
+            prompts.note?.(message, title)
+        },
+    )
+
     const config = normalizeConfig({
-        agentApiUrl,
-        cloneRoot: promptValue(cloneRootResult),
-        apiKey: promptValue(apiKeyResult).trim() || existingConfig?.apiKey || '',
+        ...resolvedSetup,
+        auth,
+        forgejoOrganization: null,
+        forgejoUserRegistered: false,
+    })
+    const organization = await resolveForgejoOrganizationInteractive({
+        prompts,
+        existingConfig,
+        auth,
+        config,
+        fetchFn: options.fetchFn,
+    })
+    const provisioned = await ensureForgejoUserAccess({
+        config,
+        organization,
+        sshKey,
+        fetchFn: options.fetchFn,
+        onProgress: (message, title) => {
+            prompts.note?.(message, title)
+        },
+        provisionFn: options.provisionForgejoUser,
+        saveConfig,
     })
 
-    saveConfig(config)
     if (!options.skipLifecycle) {
         prompts.outro('Tela CLI configured')
     }
-    return config
+
+    return provisioned.config
 }
 
-export async function ensureConfigInteractive(
-    options: {
-        prompts?: PromptModule
-    } = {},
-): Promise<TelaCliConfig> {
+export async function ensureConfigInteractive(): Promise<TelaCliConfig> {
     const existing = tryLoadConfig()
-    if (existing) {
+    if (existing?.auth) {
         return existing
     }
 
-    return await setupConfigInteractive(options)
+    throw createUserFacingError({
+        code: 'config_required',
+        summary: 'Tela CLI is not authenticated.',
+        fixes: ['Run `tela setup` in an interactive terminal first.'],
+    })
 }