@mnemom/mnemom 0.14.5 → 0.15.0

package/dist/lib/auth.js

@@ -3,13 +3,19 @@
  *
  * Stores auth tokens in ~/.mnemom/auth.json (UC-9: no more config.json).
  * License JWTs are stored alongside auth tokens.
+ *
+ * As of MNE-806, `mnemom login` authenticates against the Mnemom OAuth
+ * Authorization Server (see lib/oauth.ts) and persists SCOPED OAuth tokens
+ * (access + optional refresh, scope, token_type, and the registered client_id
+ * needed to refresh) rather than a full Supabase session. The stored shape
+ * stays backward-compatible: `email`/`userId` are optional (opaque OAuth access
+ * tokens don't carry identity) and pre-existing Supabase sessions on disk
+ * continue to resolve until they expire.
  */
 import * as fs from "node:fs";
 import * as path from "node:path";
-import * as http from "node:http";
-import * as crypto from "node:crypto";
-import { exec } from "node:child_process";
-import { getApiUrl, getWebsiteUrl, MNEMOM_DIR } from "./config.js";
+import { MNEMOM_DIR } from "./config.js";
+import { loginWithLoopback, loginWithDevice, refreshTokens as oauthRefreshTokens, } from "./oauth.js";
 // ============================================================================
 // Auth Store (persisted to ~/.mnemom/auth.json)
 // ============================================================================
@@ -27,12 +33,22 @@ function loadAuthStore() {
 }
 function saveAuthStore(store) {
     if (!fs.existsSync(MNEMOM_DIR)) {
-        fs.mkdirSync(MNEMOM_DIR, { recursive: true });
+        // 0700: the directory holds bearer credentials — owner-only.
+        fs.mkdirSync(MNEMOM_DIR, { recursive: true, mode: 0o700 });
     }
     const resolvedPath = path.resolve(AUTH_FILE);
     const sanitized = JSON.parse(JSON.stringify(store));
     const tmpFile = `${resolvedPath}.${process.pid}.tmp`;
-    fs.writeFileSync(tmpFile, JSON.stringify(sanitized, null, 2));
+    // 0600 from creation — the temp file already contains the secret, so the
+    // restrictive mode must be set at write time, not after rename.
+    fs.writeFileSync(tmpFile, JSON.stringify(sanitized, null, 2), { mode: 0o600 });
+    // Belt-and-suspenders: if the file pre-existed with looser perms, tighten it.
+    try {
+        fs.chmodSync(tmpFile, 0o600);
+    }
+    catch {
+        /* best effort on platforms without POSIX perms */
+    }
     fs.renameSync(tmpFile, resolvedPath);
 }
 // ============================================================================
@@ -71,40 +87,16 @@ export function clearLicenseJwt() {
 export function getLicenseJwt() {
     return loadAuthStore()?.licenseJwt ?? null;
 }
-/** Sanitize file-sourced data before use in outbound HTTP requests. */
-function sanitizeForHttp(data) {
-    return String(data).trim();
-}
-/**
- * Decode a JWT's `exp` claim (unix seconds), or null if the token can't be
- * parsed. We use the JWT's own exp as the source of truth for expiry rather
- * than `expires_in` returned by the auth endpoint — the two can disagree
- * (Supabase has been observed reporting expires_in values longer than the
- * JWT's actual exp), and a divergence makes `whoami` cheerfully report a
- * "valid" token while every authenticated API call gets 401.
- */
-function jwtExpSeconds(accessToken) {
-    const parts = accessToken.split(".");
-    if (parts.length !== 3)
-        return null;
-    try {
-        const payload = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf-8"));
-        if (typeof payload.exp !== "number" || !Number.isFinite(payload.exp)) {
-            return null;
-        }
-        return payload.exp;
-    }
-    catch {
-        return null;
-    }
-}
-/**
- * Compute the effective expiresAt for a freshly issued access token.
- * Prefers the JWT's own `exp` claim; falls back to `now + expires_in` if the
- * token can't be parsed (e.g. an opaque token).
- */
-export function computeExpiresAt(accessToken, expiresInSeconds) {
-    return jwtExpSeconds(accessToken) ?? Math.floor(Date.now() / 1000) + expiresInSeconds;
+/** Convert OAuth tokens (lib/oauth.ts) into the persisted auth-store shape. */
+function fromOAuthTokens(tokens, clientId) {
+    return {
+        accessToken: tokens.accessToken,
+        refreshToken: tokens.refreshToken,
+        expiresAt: tokens.expiresAt,
+        scope: tokens.scope,
+        tokenType: tokens.tokenType,
+        clientId,
+    };
 }
 /**
  * Get a valid access token, or null if not authenticated.
@@ -126,7 +118,7 @@ export async function getAccessToken() {
         return auth.accessToken;
     }
     // Auto-refresh
-    const refreshed = await refreshAccessToken(auth.refreshToken);
+    const refreshed = await refreshStoredTokens(auth);
     if (refreshed)
         return refreshed.accessToken;
     return null;
@@ -147,7 +139,7 @@ export async function forceRefreshAccessToken() {
     const auth = getAuthInfo();
     if (!auth?.refreshToken)
         return null;
-    const refreshed = await refreshAccessToken(auth.refreshToken);
+    const refreshed = await refreshStoredTokens(auth);
     return refreshed?.accessToken ?? null;
 }
 /**
@@ -203,171 +195,49 @@ export async function isLoggedIn() {
     return cred.type !== "none";
 }
 // ============================================================================
-// Browser login flow
+// Interactive login (OAuth 2.1 against the Mnemom Authorization Server)
 // ============================================================================
+/**
+ * Interactive browser login: OAuth 2.1 authorization-code + PKCE with a
+ * loopback redirect (the `wrangler login` pattern). Persists the resulting
+ * SCOPED tokens (plus the client_id needed to refresh) to ~/.mnemom/auth.json.
+ */
 export async function loginWithBrowser() {
-    const state = crypto.randomBytes(16).toString("hex");
-    const { port, tokenPromise, close } = await startCallbackServer(state);
-    const callbackUrl = `http://127.0.0.1:${port}/callback`;
-    const loginUrl = `${getWebsiteUrl()}/login?cli_callback=${encodeURIComponent(callbackUrl)}&state=${encodeURIComponent(state)}`;
-    console.log("Opening browser to authenticate...");
-    console.log(`If the browser doesn't open, visit:\n  ${loginUrl}\n`);
-    openBrowser(loginUrl);
-    console.log("Waiting for authentication...");
-    try {
-        const tokens = await tokenPromise;
-        saveAuthTokens(tokens);
-        return tokens;
-    }
-    finally {
-        close();
-    }
-}
-async function startCallbackServer(expectedState) {
-    let resolveTokens;
-    let rejectTokens;
-    const tokenPromise = new Promise((resolve, reject) => {
-        resolveTokens = resolve;
-        rejectTokens = reject;
-    });
-    const server = http.createServer((req, res) => {
-        if (req.method === "OPTIONS") {
-            res.writeHead(200, {
-                "Access-Control-Allow-Origin": "*",
-                "Access-Control-Allow-Methods": "POST, OPTIONS",
-                "Access-Control-Allow-Headers": "Content-Type",
-            });
-            res.end();
-            return;
-        }
-        if (req.method !== "POST" || req.url !== "/callback") {
-            res.writeHead(404, { "Content-Type": "text/plain" });
-            res.end("Not found");
-            return;
-        }
-        let body = "";
-        req.on("data", (chunk) => {
-            body += chunk.toString();
-            if (body.length > 1_000_000) {
-                req.destroy();
-                rejectTokens(new Error("Callback body too large"));
-            }
-        });
-        req.on("end", () => {
-            try {
-                const data = JSON.parse(body);
-                if (data.state !== expectedState) {
-                    res.writeHead(403, {
-                        "Content-Type": "text/html",
-                        "Access-Control-Allow-Origin": "*",
-                    });
-                    res.end("<html><body><h2>Authentication failed</h2><p>State mismatch.</p></body></html>");
-                    rejectTokens(new Error("State mismatch — possible CSRF attack"));
-                    return;
-                }
-                const tokens = {
-                    accessToken: data.access_token,
-                    refreshToken: data.refresh_token,
-                    expiresAt: computeExpiresAt(data.access_token, data.expires_in),
-                    userId: data.user_id,
-                    email: data.user_email,
-                };
-                res.writeHead(200, {
-                    "Content-Type": "text/html",
-                    "Access-Control-Allow-Origin": "*",
-                });
-                res.end(`<html><body style="font-family:system-ui;text-align:center;padding:60px">
-<h2>Authenticated!</h2>
-<p>You can close this tab and return to the terminal.</p>
-</body></html>`);
-                resolveTokens(tokens);
-            }
-            catch {
-                res.writeHead(400, {
-                    "Content-Type": "text/html",
-                    "Access-Control-Allow-Origin": "*",
-                });
-                res.end("<html><body><h2>Authentication failed</h2><p>Invalid callback data.</p></body></html>");
-                rejectTokens(new Error("Invalid callback data"));
-            }
-        });
-    });
-    const port = await new Promise((resolve) => {
-        server.listen(0, "127.0.0.1", () => {
-            resolve(server.address().port);
-        });
-    });
-    const timeout = setTimeout(() => {
-        rejectTokens(new Error("Login timed out. Please try again."));
-        server.close();
-    }, 5 * 60 * 1000);
-    return {
-        port,
-        tokenPromise,
-        close: () => {
-            clearTimeout(timeout);
-            server.close();
-        },
-    };
+    const { tokens, clientId } = await loginWithLoopback();
+    const stored = fromOAuthTokens(tokens, clientId);
+    saveAuthTokens(stored);
+    return stored;
 }
-function openBrowser(url) {
-    const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
-    exec(`${cmd} ${JSON.stringify(url)}`);
-}
-// ============================================================================
-// Password login
-// ============================================================================
-export async function loginWithPassword(email, password) {
-    const url = `${getApiUrl()}/v1/auth/login`;
-    const res = await fetch(url, {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ email, password }),
-    });
-    if (!res.ok) {
-        const body = (await res.json().catch(() => ({})));
-        throw new Error(body.error || body.message || "Login failed");
-    }
-    const data = (await res.json());
-    const tokens = {
-        accessToken: data.access_token,
-        refreshToken: data.refresh_token,
-        expiresAt: computeExpiresAt(data.access_token, data.expires_in),
-        userId: data.user.id,
-        email: data.user.email,
-    };
-    saveAuthTokens(tokens);
-    return tokens;
+/**
+ * Headless login: RFC 8628 device authorization grant. Shows a user_code +
+ * verification_uri for the user to approve in any browser (possibly on another
+ * device), polls until approval, and persists the scoped tokens.
+ */
+export async function loginWithDeviceFlow() {
+    const { tokens, clientId } = await loginWithDevice();
+    const stored = fromOAuthTokens(tokens, clientId);
+    saveAuthTokens(stored);
+    return stored;
 }
 // ============================================================================
-// Token refresh
+// Token refresh (OAuth refresh_token grant)
 // ============================================================================
-async function refreshAccessToken(refreshToken) {
-    if (!refreshToken || typeof refreshToken !== "string") {
+/**
+ * Refresh the stored tokens via the OAuth refresh_token grant. Requires both a
+ * refresh token and the client_id they were issued to; returns null (rather
+ * than throwing) when refresh isn't possible so callers degrade to re-login.
+ */
+async function refreshStoredTokens(auth) {
+    if (!auth.refreshToken || !auth.clientId)
         return null;
-    }
-    const url = new URL(`${getApiUrl()}/v1/auth/refresh`).href;
-    try {
-        const res = await fetch(url, {
-            method: "POST",
-            headers: { "Content-Type": "application/json" },
-            body: sanitizeForHttp(JSON.stringify({ refresh_token: String(refreshToken) })),
-        });
-        if (!res.ok)
-            return null;
-        const data = (await res.json());
-        const existing = getAuthInfo();
-        const tokens = {
-            accessToken: data.access_token,
-            refreshToken: data.refresh_token,
-            expiresAt: computeExpiresAt(data.access_token, data.expires_in),
-            userId: existing?.userId ?? "",
-            email: existing?.email ?? "",
-        };
-        saveAuthTokens(tokens);
-        return tokens;
-    }
-    catch {
+    const refreshed = await oauthRefreshTokens(auth.refreshToken, auth.clientId);
+    if (!refreshed)
         return null;
-    }
+    const stored = fromOAuthTokens(refreshed, auth.clientId);
+    // Preserve any legacy identity fields so whoami/status keep working across a
+    // refresh of a token set that still carries them.
+    stored.userId = auth.userId;
+    stored.email = auth.email;
+    saveAuthTokens(stored);
+    return stored;
 }

package/dist/lib/oauth.d.ts

@@ -0,0 +1,121 @@
+/**
+ * OAuth 2.1 client for the Mnemom Authorization Server.
+ *
+ * `mnemom login` authenticates against the Mnemom OAuth AS (the same AS that
+ * fronts the MCP control plane) instead of doing a raw Supabase session login.
+ * This yields SCOPED access tokens (`mcp:read` / `mcp:write`) — not the full
+ * Supabase god-token — so a leaked CLI credential can only do what the CLI was
+ * granted, and grants are independently revocable server-side (MNE-805/806).
+ *
+ * Two interactive flows, both standards-based:
+ *   - Authorization Code + PKCE with a loopback redirect (the `wrangler login`
+ *     pattern): open the browser to /authorize, catch the redirect on a
+ *     localhost listener, exchange code+verifier at /token.
+ *   - RFC 8628 Device Authorization Grant (`--no-browser` / headless): POST
+ *     /device_authorization, print the user_code + verification_uri, poll
+ *     /token honoring `authorization_pending` and `slow_down`.
+ *
+ * Everything is driven off RFC 8414 discovery
+ * (/.well-known/oauth-authorization-server) — endpoint paths are NOT hardcoded.
+ * The public client_id is obtained via RFC 7591 Dynamic Client Registration and
+ * cached, so there is no client secret to embed (the AS advertises
+ * token_endpoint_auth_method "none" — public clients only).
+ */
+export interface AuthServerMetadata {
+    issuer: string;
+    authorization_endpoint: string;
+    token_endpoint: string;
+    device_authorization_endpoint?: string;
+    registration_endpoint?: string;
+    revocation_endpoint?: string;
+    scopes_supported?: string[];
+    grant_types_supported?: string[];
+    code_challenge_methods_supported?: string[];
+    token_endpoint_auth_methods_supported?: string[];
+}
+/**
+ * Fetch (and process-cache) the AS metadata document. We resolve it relative to
+ * the active API base URL so staging/local point at their own AS.
+ */
+export declare function discover(): Promise<AuthServerMetadata>;
+/** Reset the process-level discovery cache (used by tests). */
+export declare function _resetDiscoveryCache(): void;
+/**
+ * Register a public client for the CLI and return its client_id. The AS issues
+ * public clients (token_endpoint_auth_method "none"), so there is no secret to
+ * persist. The caller is responsible for caching the returned id.
+ */
+export declare function registerClient(redirectUris: string[]): Promise<string>;
+export interface Pkce {
+    verifier: string;
+    challenge: string;
+    method: "S256";
+}
+/**
+ * Generate a PKCE verifier/challenge pair. The verifier is a high-entropy
+ * URL-safe string (RFC 7636 §4.1: 43–128 chars from the unreserved set); the
+ * challenge is BASE64URL(SHA256(verifier)) for the S256 method (the only method
+ * the AS advertises, and the only one allowed under OAuth 2.1).
+ */
+export declare function generatePkce(): Pkce;
+export interface OAuthTokenResponse {
+    access_token: string;
+    token_type?: string;
+    expires_in?: number;
+    refresh_token?: string;
+    scope?: string;
+}
+export interface OAuthTokens {
+    accessToken: string;
+    tokenType: string;
+    refreshToken?: string;
+    scope?: string;
+    /** Unix seconds. */
+    expiresAt: number;
+}
+export interface LoopbackResult {
+    tokens: OAuthTokens;
+    clientId: string;
+}
+/**
+ * Run the interactive authorization-code + PKCE login. Returns the issued
+ * scoped tokens plus the client_id that was used (so the caller can persist it
+ * for refresh). `openUrl` is injectable so tests can drive the flow without
+ * spawning a real browser.
+ */
+export declare function loginWithLoopback(openUrl?: (url: string) => void): Promise<LoopbackResult>;
+export interface DeviceResult {
+    tokens: OAuthTokens;
+    clientId: string;
+}
+/**
+ * Run the RFC 8628 device authorization grant. Registers a client (the device
+ * flow needs no redirect, but the AS's DCR validation requires a valid
+ * redirect_uri — HTTPS or a loopback — so we register a loopback placeholder it
+ * will never redirect to), requests a device code, prints the user_code +
+ * verification_uri for the user to approve in any browser, then polls the token
+ * endpoint until approval — honoring `authorization_pending` and `slow_down`
+ * per the spec.
+ *
+ * `display` and `sleep` are injectable so tests can drive the poll loop
+ * deterministically without real timers or stdout.
+ */
+export declare function loginWithDevice(opts?: {
+    display?: (line: string) => void;
+    sleep?: (ms: number) => Promise<void>;
+}): Promise<DeviceResult>;
+/**
+ * Exchange a refresh token for a fresh access token. Returns null if refresh is
+ * not possible (no refresh token, or the AS rejects it — e.g. revoked/expired),
+ * so callers can fall back to prompting for re-login rather than crashing.
+ */
+export declare function refreshTokens(refreshToken: string, clientId: string): Promise<OAuthTokens | null>;
+/**
+ * Open `url` in the user's default browser WITHOUT a shell. The URL is always
+ * passed as a separate argv element (never concatenated into a command string),
+ * so shell metacharacters — `$(...)`, backticks, `\` — in the URL can never be
+ * interpreted as a command. Fire-and-forget: any failure (no opener installed,
+ * headless host) is swallowed because callers already print a manual-URL
+ * fallback, so a missing browser must not crash login.
+ */
+export declare function openBrowser(url: string): void;