@moda-ai/cli 1.1.0 → 1.2.0

package/dist/auth.js

@@ -1,40 +1,160 @@
 // src/auth.ts — Browser-based authentication for moda init via frontend
 import { createServer } from 'node:http';
-import { readFileSync, writeFileSync, mkdirSync, chmodSync, existsSync } from 'node:fs';
-import { join } from 'node:path';
-import { homedir } from 'node:os';
-import { MODA_BASE_URL } from './config.js';
+import { existsSync, readFileSync, rmSync } from 'node:fs';
+import { randomBytes, timingSafeEqual } from 'node:crypto';
+import { resolveModaBaseUrl } from './config.js';
+import { getModaPaths, loadProfileConfig, saveProfileConfig, secretFilePathFromRef, writeSecretJsonFile, } from './profiles.js';
 const CALLBACK_PORT = 8432;
 const AUTH_TIMEOUT_MS = 120_000;
-const MODA_DIR = join(homedir(), '.moda');
-const TOKEN_PATH = join(MODA_DIR, 'auth.json');
-export function loadToken() {
+function escapeHtml(value) {
+    return value
+        .replace(/&/g, '&')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&#39;');
+}
+function safeEqual(a, b) {
+    const aBuf = Buffer.from(a);
+    const bBuf = Buffer.from(b);
+    if (aBuf.length !== bBuf.length)
+        return false;
+    return timingSafeEqual(aBuf, bBuf);
+}
+function tokenPath(options = {}) {
+    return getModaPaths(options).legacyAuthPath;
+}
+function authTokenRefForProfile(profile) {
+    return `file:secrets/auth/${profile}.json`;
+}
+function parseStoredAuth(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        return null;
+    }
+    const data = value;
+    if (typeof data.access_token !== 'string' ||
+        typeof data.expires_at !== 'number') {
+        return null;
+    }
+    return {
+        access_token: data.access_token,
+        expires_at: data.expires_at,
+        profile: typeof data.profile === 'string' ? data.profile : undefined,
+        token_type: data.token_type === 'bearer' ? 'bearer' : undefined,
+    };
+}
+export function isAuthSessionValid(data, now = Date.now()) {
+    if (!data)
+        return false;
+    return now / 1000 <= data.expires_at - 60;
+}
+function readStoredAuth(path) {
     try {
-        if (!existsSync(TOKEN_PATH))
+        if (!existsSync(path))
             return null;
-        const data = JSON.parse(readFileSync(TOKEN_PATH, 'utf8'));
-        if (data.expires_at && Date.now() / 1000 > data.expires_at - 60) {
-            return null; // Expired or about to expire
-        }
-        return data.access_token || null;
+        return parseStoredAuth(JSON.parse(readFileSync(path, 'utf8')));
     }
     catch {
         return null;
     }
 }
-function saveToken(accessToken, expiresIn) {
-    mkdirSync(MODA_DIR, { recursive: true });
+export function loadToken(options = {}) {
+    return loadAuthSession(options)?.access_token ?? null;
+}
+export function loadAuthSession(options = {}) {
+    const profileSession = loadProfileAuthSession(options);
+    if (profileSession)
+        return profileSession;
+    const legacy = readStoredAuth(tokenPath(options));
+    if (!legacy)
+        return null;
+    if (!options.includeExpired && !isAuthSessionValid(legacy)) {
+        return null;
+    }
+    return legacy;
+}
+function loadProfileAuthSession(options) {
+    const profileName = options.profile ?? (options.env ?? process.env).MODA_PROFILE;
+    if (!profileName)
+        return null;
+    try {
+        const profile = loadProfileConfig(options).profiles[profileName];
+        const tokenRef = profile?.auth_token_ref;
+        if (!tokenRef)
+            return null;
+        const path = secretFilePathFromRef(tokenRef, options);
+        if (!path)
+            return null;
+        const session = readStoredAuth(path);
+        if (!session)
+            return null;
+        if (!options.includeExpired && !isAuthSessionValid(session))
+            return null;
+        return session;
+    }
+    catch {
+        return null;
+    }
+}
+export function saveAuthSession(accessToken, expiresIn, options = {}) {
+    const profile = options.profile ?? (options.env ?? process.env).MODA_PROFILE;
     const data = {
         access_token: accessToken,
         expires_at: Math.floor(Date.now() / 1000) + expiresIn,
+        profile,
+        token_type: 'bearer',
     };
-    writeFileSync(TOKEN_PATH, JSON.stringify(data, null, 2), { mode: 0o600 });
-    try {
-        chmodSync(TOKEN_PATH, 0o600);
+    if (profile) {
+        const ref = authTokenRefForProfile(profile);
+        const path = secretFilePathFromRef(ref, options);
+        if (!path)
+            throw new Error(`Unsupported auth token reference: ${ref}`);
+        const config = loadProfileConfig(options);
+        const existing = config.profiles[profile];
+        if (!existing) {
+            throw new Error(`Moda profile '${profile}' does not exist.`);
+        }
+        writeSecretJsonFile(path, data);
+        saveProfileConfig({
+            ...config,
+            profiles: {
+                ...config.profiles,
+                [profile]: {
+                    ...existing,
+                    auth_token_ref: ref,
+                },
+            },
+        }, options);
+        return data;
     }
-    catch {
-        // chmod may fail on some systems, the mode flag above handles it
+    writeSecretJsonFile(tokenPath(options), data);
+    return data;
+}
+export function clearAuthSession(options = {}) {
+    const profile = options.profile ?? (options.env ?? process.env).MODA_PROFILE;
+    if (profile) {
+        const ref = authTokenRefForProfile(profile);
+        const path = secretFilePathFromRef(ref, options);
+        if (path)
+            rmSync(path, { force: true });
+        const config = loadProfileConfig(options);
+        const existing = config.profiles[profile];
+        if (existing) {
+            const { auth_token_ref: _drop, ...profileWithoutToken } = existing;
+            saveProfileConfig({
+                ...config,
+                profiles: {
+                    ...config.profiles,
+                    [profile]: profileWithoutToken,
+                },
+            }, options);
+        }
+        return;
     }
+    rmSync(tokenPath(options), { force: true });
+}
+function saveToken(accessToken, expiresIn) {
+    saveAuthSession(accessToken, expiresIn);
 }
 // --- Login Flow ---
 const SUCCESS_HTML = `<!DOCTYPE html>
@@ -58,97 +178,141 @@ if (h) {
 }
 </script>
 </body></html>`;
-export async function login(screen = 'login') {
+async function openAuthUrl(authUrl) {
+    const open = (await import('open')).default;
+    await open(authUrl);
+}
+function closeAuthServer(server) {
+    server.close((err) => {
+        if (err && err.code !== 'ERR_SERVER_NOT_RUNNING') {
+            // Nothing useful to surface to users during auth teardown.
+        }
+    });
+    // Node 18 keeps idle keep-alive sockets open after server.close(). The browser
+    // auth callback is single-use, so close idle sockets aggressively.
+    server.closeIdleConnections?.();
+}
+export async function login(screen = 'login', options = {}) {
     return new Promise((resolve, reject) => {
         let settled = false;
+        let localPort = options.callbackPort ?? CALLBACK_PORT;
+        let timeout;
+        const state = randomBytes(16).toString('hex');
         const server = createServer(async (req, res) => {
             if (settled)
                 return;
-            const url = new URL(req.url || '/', `http://localhost:${CALLBACK_PORT}`);
+            const url = new URL(req.url || '/', `http://localhost:${localPort}`);
             // Serve fragment extractor at /callback — the frontend redirects here
             // with token in the URL fragment (#token=...) which never reaches the server.
             // This page extracts it client-side and forwards to /callback-token as query params.
             if (url.pathname === '/callback') {
-                res.writeHead(200, { 'Content-Type': 'text/html' });
+                res.writeHead(200, { 'Content-Type': 'text/html', Connection: 'close' });
                 res.end(FRAGMENT_EXTRACTOR_HTML);
                 return;
             }
             if (url.pathname !== '/callback-token') {
-                res.writeHead(404);
+                res.writeHead(404, { Connection: 'close' });
                 res.end('Not found');
                 return;
             }
             const token = url.searchParams.get('token');
             const expiresIn = url.searchParams.get('expires_in');
             const error = url.searchParams.get('error');
+            const callbackState = url.searchParams.get('state');
+            // Bind the callback to this login session: any page in the browser (or
+            // any process on localhost) could POST to this endpoint, so a missing or
+            // mismatched state value means we must reject before touching `token`.
+            if (!callbackState || !safeEqual(callbackState, state)) {
+                res.writeHead(400, { 'Content-Type': 'text/html', Connection: 'close' });
+                res.end('<html><body><h2>Error</h2><p>Invalid authentication state.</p></body></html>', () => {
+                    fail(new Error('Invalid authentication state.'));
+                });
+                return;
+            }
             if (error) {
-                res.writeHead(400, { 'Content-Type': 'text/html' });
-                res.end(`<html><body><h2>Error</h2><p>${error}</p></body></html>`);
-                settled = true;
-                server.close();
-                reject(new Error(`Authentication error: ${error}`));
+                res.writeHead(400, { 'Content-Type': 'text/html', Connection: 'close' });
+                res.end(`<html><body><h2>Error</h2><p>${escapeHtml(error)}</p></body></html>`, () => {
+                    fail(new Error(`Authentication error: ${error}`));
+                });
                 return;
             }
             if (!token) {
-                res.writeHead(400, { 'Content-Type': 'text/html' });
-                res.end('<html><body><h2>Error</h2><p>No token received.</p></body></html>');
-                settled = true;
-                server.close();
-                reject(new Error('No token received'));
+                res.writeHead(400, { 'Content-Type': 'text/html', Connection: 'close' });
+                res.end('<html><body><h2>Error</h2><p>No token received.</p></body></html>', () => {
+                    fail(new Error('No token received'));
+                });
                 return;
             }
             saveToken(token, parseInt(expiresIn || '86400', 10));
-            res.writeHead(200, { 'Content-Type': 'text/html' });
-            res.end(SUCCESS_HTML);
-            settled = true;
-            server.close();
-            resolve(token);
+            res.writeHead(200, { 'Content-Type': 'text/html', Connection: 'close' });
+            res.end(SUCCESS_HTML, () => {
+                succeed(token);
+            });
         });
-        // Timeout
-        const timeout = setTimeout(() => {
-            if (!settled) {
-                settled = true;
-                server.close();
-                reject(new Error('Authentication timed out. Please try again.'));
-            }
-        }, AUTH_TIMEOUT_MS);
-        server.on('close', () => clearTimeout(timeout));
+        function removeSignalHandlers() {
+            process.off('SIGINT', handleSigint);
+            process.off('SIGTERM', handleSigterm);
+        }
+        function finish(callback) {
+            if (settled)
+                return;
+            settled = true;
+            if (timeout)
+                clearTimeout(timeout);
+            removeSignalHandlers();
+            // Always attempt to close the server: if SIGINT arrives between
+            // server.listen() and its listening callback, the socket may already be
+            // bound by the OS. closeAuthServer ignores ERR_SERVER_NOT_RUNNING.
+            closeAuthServer(server);
+            callback();
+        }
+        function succeed(token) {
+            finish(() => resolve(token));
+        }
+        function fail(error) {
+            finish(() => reject(error));
+        }
+        function handleSigint() {
+            fail(new Error('Authentication cancelled.'));
+        }
+        function handleSigterm() {
+            fail(new Error('Authentication terminated.'));
+        }
+        timeout = setTimeout(() => {
+            fail(new Error('Authentication timed out. Please try again.'));
+        }, options.timeoutMs ?? AUTH_TIMEOUT_MS);
         server.on('error', (err) => {
             if (err.code === 'EADDRINUSE') {
-                reject(new Error(`Port ${CALLBACK_PORT} is in use. Close the process using it and try again.`));
+                fail(new Error(`Port ${localPort} is in use. Close the process using it and try again.`));
             }
             else {
-                reject(err);
+                fail(err);
             }
         });
-        server.listen(CALLBACK_PORT, async () => {
-            const authUrl = `${MODA_BASE_URL}/auth/cli?port=${CALLBACK_PORT}&screen=${screen}`;
+        server.listen(localPort, '127.0.0.1', async () => {
+            const address = server.address();
+            if (address && typeof address === 'object') {
+                localPort = address.port;
+            }
+            const authUrl = `${resolveModaBaseUrl()}/auth/cli?port=${localPort}&screen=${screen}&state=${state}`;
             try {
-                const open = (await import('open')).default;
-                await open(authUrl);
+                await (options.openUrl ?? openAuthUrl)(authUrl);
             }
             catch {
                 console.error(`  Open this URL in your browser:\n  ${authUrl}`);
             }
         });
-        // Clean up on process exit
-        const cleanup = () => {
-            if (!settled) {
-                settled = true;
-                server.close();
-            }
-        };
-        process.on('SIGINT', cleanup);
-        process.on('SIGTERM', cleanup);
+        process.once('SIGINT', handleSigint);
+        process.once('SIGTERM', handleSigterm);
     });
 }
 // --- Authenticated Fetch ---
-export async function authFetch(path, options = {}) {
-    const token = loadToken();
+export async function authFetch(path, options = {}, authOptions = {}) {
+    const token = loadToken(authOptions);
     if (!token) {
         throw new Error('Not authenticated. Run "moda init" to log in.');
     }
-    const url = `${MODA_BASE_URL}${path}`;
+    const url = `${resolveModaBaseUrl()}${path}`;
     const headers = new Headers(options.headers);
     headers.set('Authorization', `Bearer ${token}`);
     if (!headers.has('Content-Type') && options.body) {

package/dist/cli.d.ts

@@ -1,11 +1,28 @@
 #!/usr/bin/env node
-interface ParsedArgs {
+import { type TelemetryErrorType } from './telemetry.js';
+import { type CommandContext } from './command-context.js';
+import { type CommandDefinition } from './command-registry.js';
+export { CliInputError } from './errors.js';
+export interface ParsedArgs {
     command: string;
     positional: string | undefined;
+    positionals: string[];
     flags: Record<string, string>;
 }
 export declare function parseArgs(argv: string[]): ParsedArgs;
 export declare function flagsToArgs(flags: Record<string, string>, positionalKey?: string, positionalValue?: string): Record<string, unknown>;
-export declare function runCommand(command: string, positional: string | undefined, flags: Record<string, string>): Promise<void>;
-export {};
+export declare function runCommand(command: string, positional: string | undefined, flags: Record<string, string>, positionals?: string[], context?: CommandContext): Promise<void>;
+interface CommandDispatchResult {
+    exitCode: number;
+    apiKey?: string;
+}
+interface CliCommandDefinition extends CommandDefinition<CommandContext, CommandDispatchResult> {
+    validateConfigBeforeRun: boolean;
+    resetApiRequestCountBeforeRun: boolean;
+    telemetry: 'none' | 'result' | 'result-and-error';
+}
+export declare const commandRegistry: import("./command-registry.js").CommandRegistry<CommandContext, CommandDispatchResult, CliCommandDefinition>;
+export declare function classifyCliError(error: unknown): TelemetryErrorType;
+export declare function printCliError(error: unknown): void;
+export declare function dispatchParsedCommand(parsed: ParsedArgs, startedAt?: number): Promise<number>;
 //# sourceMappingURL=cli.d.ts.map