@moda-ai/cli 1.13.0 → 1.13.1

package/dist/auth-storage.d.ts

@@ -0,0 +1,35 @@
+import { type ProfileIOOptions } from './profiles.js';
+/**
+ * Kind of credential stored in the auth session file. Absent means a legacy
+ * Auth0 access token: legacy save paths deliberately leave the field out so
+ * a downgraded CLI reading the same file sees a byte-identical shape (the
+ * safest downgrade-compat choice). Only the PKCE exchange path writes
+ * 'moda_ct'.
+ */
+export type StoredAuthTokenKind = 'moda_ct' | 'auth0';
+export interface StoredAuth {
+    access_token: string;
+    expires_at: number;
+    profile?: string;
+    token_type?: 'bearer';
+    token_kind?: StoredAuthTokenKind;
+    user_email?: string;
+}
+export interface AuthSessionOptions extends ProfileIOOptions {
+    includeExpired?: boolean;
+}
+/** moda_ct CLI session tokens get renewal + revocation semantics. */
+export declare function isModaCtSession(session: StoredAuth): boolean;
+export declare function isAuthSessionValid(data: StoredAuth | null, now?: number): data is StoredAuth;
+export declare function loadToken(options?: AuthSessionOptions): string | null;
+export declare function loadAuthSession(options?: AuthSessionOptions): StoredAuth | null;
+export declare function resolveStorageProfile(options: ProfileIOOptions): string | undefined;
+export declare function saveAuthSession(accessToken: string, expiresIn: number, options?: ProfileIOOptions, extras?: Pick<StoredAuth, 'token_kind' | 'user_email'>): StoredAuth;
+/**
+ * Write a fully-formed session to disk, honoring the profile named on the
+ * session itself (so renewals rewrite exactly the file the session was
+ * loaded from, profile-scoped or legacy).
+ */
+export declare function persistAuthSession(data: StoredAuth, options?: ProfileIOOptions): StoredAuth;
+export declare function clearAuthSession(options?: ProfileIOOptions): void;
+//# sourceMappingURL=auth-storage.d.ts.map

package/dist/auth-storage.js

@@ -0,0 +1,159 @@
+// src/auth-storage.ts — StoredAuth model and on-disk auth session persistence
+// (legacy ~/.moda/auth.json and profile-scoped ~/.moda/secrets/auth/<profile>.json).
+import { existsSync, readFileSync, rmSync } from 'node:fs';
+import { getModaPaths, loadProfileConfig, saveProfileConfig, secretFilePathFromRef, writeSecretJsonFile, } from './profiles.js';
+function tokenPath(options = {}) {
+    return getModaPaths(options).legacyAuthPath;
+}
+function authTokenRefForProfile(profile) {
+    return `file:secrets/auth/${profile}.json`;
+}
+function parseStoredAuth(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        return null;
+    }
+    const data = value;
+    if (typeof data.access_token !== 'string' ||
+        typeof data.expires_at !== 'number') {
+        return null;
+    }
+    return {
+        access_token: data.access_token,
+        expires_at: data.expires_at,
+        profile: typeof data.profile === 'string' ? data.profile : undefined,
+        token_type: data.token_type === 'bearer' ? 'bearer' : undefined,
+        // Additive fields: old files simply lack them (-> undefined).
+        token_kind: data.token_kind === 'moda_ct' || data.token_kind === 'auth0'
+            ? data.token_kind
+            : undefined,
+        user_email: typeof data.user_email === 'string' ? data.user_email : undefined,
+    };
+}
+/** moda_ct CLI session tokens get renewal + revocation semantics. */
+export function isModaCtSession(session) {
+    return (session.token_kind === 'moda_ct' ||
+        session.access_token.startsWith('moda_ct_'));
+}
+export function isAuthSessionValid(data, now = Date.now()) {
+    if (!data)
+        return false;
+    return now / 1000 <= data.expires_at - 60;
+}
+function readStoredAuth(path) {
+    try {
+        if (!existsSync(path))
+            return null;
+        return parseStoredAuth(JSON.parse(readFileSync(path, 'utf8')));
+    }
+    catch {
+        return null;
+    }
+}
+export function loadToken(options = {}) {
+    return loadAuthSession(options)?.access_token ?? null;
+}
+export function loadAuthSession(options = {}) {
+    const profileSession = loadProfileAuthSession(options);
+    if (profileSession)
+        return profileSession;
+    const legacy = readStoredAuth(tokenPath(options));
+    if (!legacy)
+        return null;
+    if (!options.includeExpired && !isAuthSessionValid(legacy)) {
+        return null;
+    }
+    return legacy;
+}
+function loadProfileAuthSession(options) {
+    const profileName = options.profile ?? (options.env ?? process.env).MODA_PROFILE;
+    if (!profileName)
+        return null;
+    try {
+        const profile = loadProfileConfig(options).profiles[profileName];
+        const tokenRef = profile?.auth_token_ref;
+        if (!tokenRef)
+            return null;
+        const path = secretFilePathFromRef(tokenRef, options);
+        if (!path)
+            return null;
+        const session = readStoredAuth(path);
+        if (!session)
+            return null;
+        if (!options.includeExpired && !isAuthSessionValid(session))
+            return null;
+        return session;
+    }
+    catch {
+        return null;
+    }
+}
+export function resolveStorageProfile(options) {
+    return options.profile ?? (options.env ?? process.env).MODA_PROFILE;
+}
+export function saveAuthSession(accessToken, expiresIn, options = {}, extras = {}) {
+    return persistAuthSession({
+        access_token: accessToken,
+        expires_at: Math.floor(Date.now() / 1000) + expiresIn,
+        profile: resolveStorageProfile(options),
+        token_type: 'bearer',
+        ...(extras.token_kind ? { token_kind: extras.token_kind } : {}),
+        ...(extras.user_email ? { user_email: extras.user_email } : {}),
+    }, options);
+}
+/**
+ * Write a fully-formed session to disk, honoring the profile named on the
+ * session itself (so renewals rewrite exactly the file the session was
+ * loaded from, profile-scoped or legacy).
+ */
+export function persistAuthSession(data, options = {}) {
+    const profile = data.profile;
+    if (profile) {
+        const ref = authTokenRefForProfile(profile);
+        const path = secretFilePathFromRef(ref, options);
+        if (!path)
+            throw new Error(`Unsupported auth token reference: ${ref}`);
+        const config = loadProfileConfig(options);
+        const existing = config.profiles[profile];
+        if (!existing) {
+            throw new Error(`Moda profile '${profile}' does not exist.`);
+        }
+        writeSecretJsonFile(path, data);
+        saveProfileConfig({
+            ...config,
+            profiles: {
+                ...config.profiles,
+                [profile]: {
+                    ...existing,
+                    auth_token_ref: ref,
+                },
+            },
+        }, options);
+        return data;
+    }
+    writeSecretJsonFile(tokenPath(options), data);
+    return data;
+}
+export function clearAuthSession(options = {}) {
+    const profile = options.profile ?? (options.env ?? process.env).MODA_PROFILE;
+    if (profile) {
+        const ref = authTokenRefForProfile(profile);
+        const path = secretFilePathFromRef(ref, options);
+        if (path)
+            rmSync(path, { force: true });
+        const config = loadProfileConfig(options);
+        const existing = config.profiles[profile];
+        if (existing) {
+            const { auth_token_ref: _drop, ...profileWithoutToken } = existing;
+            saveProfileConfig({
+                ...config,
+                profiles: {
+                    ...config.profiles,
+                    [profile]: profileWithoutToken,
+                },
+            }, options);
+        }
+        return;
+    }
+    rmSync(tokenPath(options), { force: true });
+}
+//# sourceMappingURL=auth-storage.js.map

package/dist/auth.d.ts

@@ -1,18 +1,22 @@
 import { type ProfileIOOptions } from './profiles.js';
-export interface StoredAuth {
-    access_token: string;
-    expires_at: number;
-    profile?: string;
-    token_type?: 'bearer';
+import { type AuthSessionOptions } from './auth-storage.js';
+export { clearAuthSession, isAuthSessionValid, loadAuthSession, loadToken, saveAuthSession, type AuthSessionOptions, type StoredAuth, type StoredAuthTokenKind, } from './auth-storage.js';
+export { revokeCliSessionToken } from './cli-session.js';
+/** base64url(sha256(verifier)) — the S256 code challenge for a verifier. */
+export declare function computePkceChallenge(codeVerifier: string): string;
+export interface CliLoginContext {
+    user: {
+        email: string;
+        name: string | null;
+    };
+    tenants: {
+        id: string;
+        name: string;
+        slug: string;
+        role: string;
+    }[];
 }
-export interface AuthSessionOptions extends ProfileIOOptions {
-    includeExpired?: boolean;
-}
-export declare function isAuthSessionValid(data: StoredAuth | null, now?: number): data is StoredAuth;
-export declare function loadToken(options?: AuthSessionOptions): string | null;
-export declare function loadAuthSession(options?: AuthSessionOptions): StoredAuth | null;
-export declare function saveAuthSession(accessToken: string, expiresIn: number, options?: ProfileIOOptions): StoredAuth;
-export declare function clearAuthSession(options?: ProfileIOOptions): void;
+export declare function getCachedLoginContext(options?: ProfileIOOptions): CliLoginContext | null;
 export interface LoginOptions extends ProfileIOOptions {
     /** Use this exact port for the localhost callback (no fallback ladder). */
     callbackPort?: number;