@moda-ai/cli 1.22.1 → 1.23.0

package/dist/init/tenant.js

@@ -1,421 +0,0 @@
-// src/init/tenant.ts — Tenant selection and API key provisioning
-import { randomUUID } from 'node:crypto';
-import { existsSync, readFileSync, rmSync } from 'node:fs';
-import { hostname } from 'node:os';
-import { join } from 'node:path';
-import { select } from '@inquirer/prompts';
-import { authFetch, getCachedLoginContext } from '../auth.js';
-import { embeddedTenantIdFromApiKey, loadCliConfig, resolveIngestUrl, resolveModaBaseUrl, saveCliConfig, } from '../config.js';
-import { getModaDir, resolveApiKeyFromActiveProfile, resolveTenantIdFromActiveProfile, writeSecretJsonFile, } from '../profiles.js';
-import { CliAccessError, CliInputError, CliInputRequiredError } from '../errors.js';
-/**
- * Classify a failed /api/cli/context (or bootstrap) response so moda init
- * distinguishes retryable infra outages (Postgres pool exhaustion → 503
- * `database_unavailable`) from auth failures. Auth itself can succeed from
- * a cached moda_ct_ token even when this hydrate call 500s (MODA-742).
- */
-export function formatControlPlaneFetchError(action, status, body) {
-    let parsed;
-    try {
-        parsed = JSON.parse(body);
-    }
-    catch {
-        // Non-JSON body — fall through to generic formatting.
-    }
-    const isDbUnavailable = status === 503 &&
-        (parsed?.error === 'database_unavailable' ||
-            parsed?.retryable === true ||
-            /database_unavailable|too many database connections|rds_reserved|connection pool/i.test(body));
-    if (isDbUnavailable) {
-        return (`Failed to ${action} (${status}): Moda control-plane database is temporarily unavailable ` +
-            `(connection pool exhausted). This is not an authentication failure — your session token ` +
-            `is fine. Retry in a few seconds.` +
-            (parsed?.message ? ` (${parsed.message})` : ''));
-    }
-    if (status >= 500 &&
-        /too many database connections|rds_reserved|remaining connection slots/i.test(body)) {
-        return (`Failed to ${action} (${status}): Moda control-plane database ran out of connections. ` +
-            `This is a retryable infra outage, not an auth failure. Retry in a few seconds. Body: ${body}`);
-    }
-    return `Failed to ${action} (${status}): ${body}`;
-}
-// Mirrors the backend's checkAdminAccess: only the viewer role is denied.
-const ADMIN_ACCESS_MESSAGE = 'You need admin or owner access to create API keys.';
-const ADMIN_ACCESS_GUIDANCE = 'Ask your organization owner to upgrade your role.';
-// Bound the pre-bootstrap liveness probe tightly: a slow or unreachable
-// endpoint must never block init — we just mint a fresh key instead.
-const VALIDATE_TIMEOUT_MS = 3_000;
-/**
- * Post-bootstrap validate-retry schedule (WP-2.3): key provisioning spans
- * Postgres + Cloudflare KV, so a freshly minted key can lag a moment before
- * it validates. Retry the liveness probe at these delays (3 attempts after
- * the initial call, ~3.5s of retry sleeps plus up to VALIDATE_TIMEOUT_MS per
- * probe against a hanging endpoint) before warning and moving on.
- */
-const POST_BOOTSTRAP_VALIDATE_DELAYS_MS = [
-    500, 1_000, 2_000,
-];
-const defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
-// The backend truncates the bootstrap label to 60 printable chars; clip the
-// hostname client-side too so what we send is what lands on the key name.
-const MAX_LABEL_LENGTH = 60;
-// Backend contract for the Idempotency-Key header (UUIDs match this too).
-const IDEMPOTENCY_KEY_PATTERN = /^[A-Za-z0-9_-]{16,128}$/;
-/**
- * State file backing bootstrap idempotency across process restarts:
- * ~/.moda/pending-bootstrap.json maps tenant id -> the Idempotency-Key of an
- * in-flight (or failed) bootstrap POST. Written BEFORE the POST and cleared
- * on success, so a retry after a network failure reuses the same key and the
- * backend replays the original response instead of minting another ApiKey.
- *
- * Deliberately global (~/.moda, like config.json) and shared across
- * profiles: the server scopes keys to the authenticated user, so the worst
- * case of cross-profile sharing is one extra key minted — not worth
- * profile-scoping the file.
- */
-function pendingBootstrapPath(options = {}) {
-    return join(getModaDir(options), 'pending-bootstrap.json');
-}
-function loadPendingBootstrapState(options = {}) {
-    try {
-        const path = pendingBootstrapPath(options);
-        if (!existsSync(path))
-            return {};
-        const parsed = JSON.parse(readFileSync(path, 'utf8'));
-        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
-            return {};
-        }
-        const state = {};
-        for (const [tenantId, entry] of Object.entries(parsed)) {
-            if (entry &&
-                typeof entry === 'object' &&
-                typeof entry.idempotency_key === 'string') {
-                state[tenantId] = entry;
-            }
-        }
-        return state;
-    }
-    catch {
-        // A corrupt state file must never block init; fresh keys are always safe.
-        return {};
-    }
-}
-/**
- * Return the Idempotency-Key to use for this tenant's bootstrap POST,
- * persisting it before the network call. A key left over from a previous
- * failed attempt is reused so the retry replays instead of double-minting.
- * File-system failures degrade to an in-memory key (init must never block).
- */
-function reserveBootstrapIdempotencyKey(tenantId, options = {}) {
-    const state = loadPendingBootstrapState(options);
-    const existing = state[tenantId]?.idempotency_key;
-    if (existing && IDEMPOTENCY_KEY_PATTERN.test(existing)) {
-        return existing;
-    }
-    const key = randomUUID();
-    state[tenantId] = {
-        idempotency_key: key,
-        created_at: new Date().toISOString(),
-    };
-    try {
-        writeSecretJsonFile(pendingBootstrapPath(options), state);
-    }
-    catch {
-        // Best-effort persistence: without it a retry mints a fresh key, which
-        // is the pre-idempotency behavior, not a failure.
-    }
-    return key;
-}
-/** Clear the tenant's pending key after a successful bootstrap. */
-function clearBootstrapIdempotencyKey(tenantId, options = {}) {
-    try {
-        const state = loadPendingBootstrapState(options);
-        if (!(tenantId in state))
-            return;
-        delete state[tenantId];
-        const path = pendingBootstrapPath(options);
-        if (Object.keys(state).length === 0) {
-            rmSync(path, { force: true });
-        }
-        else {
-            writeSecretJsonFile(path, state);
-        }
-    }
-    catch {
-        // Leftover state is harmless: the key replays the stored response.
-    }
-}
-/** Label sent in the bootstrap body; the backend sanitizes it further. */
-function bootstrapLabel(custom) {
-    const clipped = custom?.trim().slice(0, MAX_LABEL_LENGTH);
-    if (clipped)
-        return clipped;
-    try {
-        return hostname().slice(0, MAX_LABEL_LENGTH) || 'moda init';
-    }
-    catch {
-        return 'moda init';
-    }
-}
-/**
- * Signed CLI keys embed their tenant (moda_sk_<base64url("v1:keyId:tenantId:
- * timestamp:signature")>). Decoding locally lets dedup reject a cross-tenant
- * or malformed key structurally, with no network call. Shared with the
- * pre-upload identity banner via `embeddedTenantIdFromApiKey` in config.ts;
- * liveness (not revoked) is probed separately by isStoredKeyLive().
- */
-const embeddedTenantId = embeddedTenantIdFromApiKey;
-/**
- * Liveness probe for a stored key. Deliberately NOT the backend's public
- * POST /api/api-keys/validate: the CLI's resolved base URL is the FRONTEND
- * origin (moda.dev in prod, localhost:3000 in dev), which has no
- * /api/api-keys/validate route and no rewrite for it — only /api/v1/data/* is
- * proxied to the backend. Probing the Data API is the only path that reaches
- * key validation from here; revisit when a validate proxy is added. Only a
- * 200 with a JSON body counts as live; 401/403 (revoked/invalid), any other
- * status, a non-JSON 200 (e.g. a frontend error page), a network error, or a
- * timeout all return false so init falls through to minting — never block.
- * The key value must never appear in logs, errors, or telemetry.
- */
-async function isStoredKeyLive(key, options = {}) {
-    try {
-        // Resolve the base URL with the same profile/env context as the stored-key
-        // lookup, or a valid key for a non-active profile (e.g. `init --profile
-        // staging` while prod is active) is probed against the wrong origin, read
-        // as dead, and re-minted on every run.
-        const response = await fetch(`${resolveModaBaseUrl(options)}/api/v1/data/overview`, {
-            method: 'GET',
-            headers: { 'x-api-key': key },
-            signal: AbortSignal.timeout(VALIDATE_TIMEOUT_MS),
-        });
-        if (response.status !== 200)
-            return false;
-        await response.json();
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-/**
- * A CLI key previously stored for this tenant, if any: the legacy
- * ~/.moda/config.json first, then the active profile's key reference. Only a
- * key whose stored tenant_id matches the selected tenant is a candidate.
- */
-function findStoredKeyForTenant(tenantId, options = {}) {
-    const legacy = loadCliConfig(options);
-    if (legacy.api_key && legacy.tenant_id === tenantId) {
-        return legacy.api_key;
-    }
-    // Honors options.profile when init was run with --profile; otherwise the
-    // active profile / MODA_PROFILE resolution applies.
-    if (resolveTenantIdFromActiveProfile(options) === tenantId) {
-        const profileKey = resolveApiKeyFromActiveProfile(options);
-        if (profileKey)
-            return profileKey;
-    }
-    return undefined;
-}
-/**
- * Post-bootstrap verification (WP-2.3): confirm a freshly minted key is live
- * before declaring success, reusing the same Data API probe as dedup.
- * Provisioning spans Postgres + Cloudflare KV (eventual consistency), so
- * failures are retried at the POST_BOOTSTRAP_VALIDATE_DELAYS_MS schedule.
- * Exhaustion is a stderr warning, never an init failure: init's final doctor
- * step surfaces persistent problems, and blocking here past the retry
- * schedule would punish every user for a transient propagation delay.
- */
-async function verifyFreshKeyLive(key, probeOptions, overrides) {
-    const delays = overrides?.delaysMs ?? POST_BOOTSTRAP_VALIDATE_DELAYS_MS;
-    const sleep = overrides?.sleep ?? defaultSleep;
-    if (await isStoredKeyLive(key, probeOptions))
-        return;
-    for (const delayMs of delays) {
-        await sleep(delayMs);
-        if (await isStoredKeyLive(key, probeOptions))
-            return;
-    }
-    console.error('  Warning: API key created but not yet active; propagation can take a few seconds. moda doctor --online will confirm.');
-}
-export async function selectTenantAndCreateKey(options = {}) {
-    const log = (message) => {
-        if (!options.silent)
-            console.log(message);
-    };
-    // Auth-session reads and stored-key lookups must honor init's --profile, or
-    // a profile-scoped login (secrets/auth/<profile>.json) is invisible here and
-    // init fails with "Not authenticated" despite a fresh token.
-    const authOptions = {
-        profile: options.profile,
-        env: options.env,
-    };
-    // 1. Fetch CLI context. A PKCE login that just ran in this process already
-    // returned the user + tenants in the exchange response; reuse it and skip
-    // one /api/cli/context round-trip. The cache is profile-keyed (a login for
-    // a different profile returns null here), and the fetch stays as the
-    // fallback for cached-token runs (no login happened) and legacy logins.
-    let ctx;
-    const cachedContext = getCachedLoginContext(authOptions);
-    if (cachedContext) {
-        ctx = cachedContext;
-    }
-    else {
-        const contextRes = await authFetch('/api/cli/context', {}, authOptions);
-        if (!contextRes.ok) {
-            const body = await contextRes.text();
-            throw new Error(formatControlPlaneFetchError('fetch context', contextRes.status, body));
-        }
-        ctx = (await contextRes.json());
-    }
-    log(`  Authenticated as ${ctx.user.email}`);
-    // 2. Select tenant
-    if (ctx.tenants.length === 0) {
-        throw new CliAccessError('No organizations found. Create one at https://moda.dev');
-    }
-    let selected;
-    if (options.tenantId !== undefined) {
-        // Exact id match only (case-sensitive; never slug/name, never a silent
-        // fallback to another tenant).
-        const match = ctx.tenants.find((tenant) => tenant.id === options.tenantId);
-        if (!match) {
-            const valid = ctx.tenants
-                .map((tenant) => `  ${tenant.id}  ${tenant.name} (${tenant.role})`)
-                .join('\n');
-            throw new CliInputError(`No organization with id '${options.tenantId}'. Valid organizations:\n${valid}`, 'Re-run with --tenant-id=<id> using one of the ids listed above.');
-        }
-        selected = match;
-        log(`  Organization: ${selected.name}`);
-    }
-    else if (ctx.tenants.length === 1) {
-        selected = ctx.tenants[0];
-        log(`  Organization: ${selected.name}`);
-    }
-    else if (options.nonInteractive) {
-        throw new CliInputRequiredError('Multiple Moda organizations are available; choose one and re-run with --tenant-id.', {
-            id: 'init_tenant_selection',
-            question: 'Select organization',
-            kind: 'select',
-            choices: ctx.tenants.map((tenant) => ({
-                value: tenant.id,
-                label: `${tenant.name} (${tenant.role})`,
-                resume_flags: ['--tenant-id', tenant.id],
-            })),
-            resume_command: options.resumeCommand,
-        }, 'Re-run `moda init --tenant-id <tenant_id>`.');
-    }
-    else {
-        selected = await select({
-            message: 'Select organization',
-            choices: ctx.tenants.map((tenant) => ({
-                name: `${tenant.name} (${tenant.role})`,
-                value: tenant,
-            })),
-        });
-    }
-    // Role pre-check: the backend's bootstrap endpoint 403s viewers, so fail
-    // before creating anything. The 403 handler below stays as a backstop.
-    if (selected.role.toLowerCase() === 'viewer') {
-        throw new CliAccessError(ADMIN_ACCESS_MESSAGE, { guidance: ADMIN_ACCESS_GUIDANCE });
-    }
-    // 3. Reuse a previously minted key for this tenant when it structurally
-    // belongs to it (embedded tenant id) AND still works against the Data API,
-    // so re-running init does not accumulate one CLI key per run. A failed
-    // decode, tenant mismatch, or probe failure falls through to minting.
-    let result;
-    let reused = false;
-    const storedKey = findStoredKeyForTenant(selected.id, authOptions);
-    if (storedKey &&
-        embeddedTenantId(storedKey) === selected.id &&
-        (await isStoredKeyLive(storedKey, authOptions))) {
-        log(`  Using existing CLI key for ${selected.name} (created earlier)`);
-        // A pending idempotency key left by an earlier failed bootstrap is moot
-        // once the stored key is reused; clear it so it does not linger.
-        clearBootstrapIdempotencyKey(selected.id, authOptions);
-        reused = true;
-        result = {
-            apiKey: storedKey,
-            tenantId: selected.id,
-            tenantName: selected.name,
-            tenantSlug: selected.slug,
-        };
-    }
-    // 4. Create API key via bootstrap endpoint. The Idempotency-Key is
-    // persisted to ~/.moda/pending-bootstrap.json BEFORE the POST, so a retry
-    // after a network failure reuses the same key and the backend replays the
-    // original response instead of minting a second ApiKey.
-    if (!result) {
-        const idempotencyKey = reserveBootstrapIdempotencyKey(selected.id, authOptions);
-        const bootstrapRes = await authFetch('/api/cli/bootstrap', {
-            method: 'POST',
-            headers: {
-                'Content-Type': 'application/json',
-                'Idempotency-Key': idempotencyKey,
-            },
-            body: JSON.stringify({
-                tenantId: selected.id,
-                label: bootstrapLabel(options.label),
-            }),
-        }, authOptions);
-        if (bootstrapRes.status === 403) {
-            throw new CliAccessError(ADMIN_ACCESS_MESSAGE, { guidance: ADMIN_ACCESS_GUIDANCE });
-        }
-        if (bootstrapRes.status === 409) {
-            const body = await bootstrapRes.text();
-            let parsed;
-            try {
-                parsed = JSON.parse(body);
-            }
-            catch {
-                // Fall through to the generic error below.
-            }
-            if (parsed?.error === 'cli_key_cap_reached') {
-                throw new CliAccessError(parsed.message ||
-                    'This organization has reached its CLI API key limit.', {
-                    // Command-agnostic: this path is shared by `moda init` and
-                    // `moda provision`. Prefer asking an admin to raise the
-                    // per-tenant cap; revoke/reuse remain valid escape hatches.
-                    guidance: 'Ask your organization admin to raise the CLI key limit in the dashboard ' +
-                        '(Settings → API Keys → CLI key limit), or revoke unused "CLI - ..." keys, ' +
-                        'or reuse the existing key already saved in ~/.moda/config.json from a previous ' +
-                        'moda init / moda provision --save, then retry.',
-                });
-            }
-            throw new Error(`Failed to create API key (409): ${body}`);
-        }
-        if (!bootstrapRes.ok) {
-            const body = await bootstrapRes.text();
-            throw new Error(formatControlPlaneFetchError('create API key', bootstrapRes.status, body));
-        }
-        result = (await bootstrapRes.json());
-        clearBootstrapIdempotencyKey(selected.id, authOptions);
-        // Fresh mints only: the reused-key path above already proved liveness
-        // via the dedup probe, so re-validating there would be a wasted call.
-        await verifyFreshKeyLive(result.apiKey, authOptions, options.validateRetry);
-    }
-    // Persist to ~/.moda/config.json (mode 0600) so the snapshot/session-end
-    // hook can authenticate (api_key) and the local dev orchestrator can scope
-    // ClickHouse (tenant_id) without the user exporting env vars into the shell
-    // that launches Claude. Env still wins over the file at read time.
-    //
-    // Headless callers (persistConfig: false) skip this block entirely: they
-    // own their credential storage, and the env-shadow warning below only
-    // makes sense when a selection was actually saved.
-    if (options.persistConfig !== false) {
-        saveCliConfig({
-            api_key: result.apiKey,
-            tenant_id: result.tenantId,
-            ingest_url: resolveIngestUrl(authOptions),
-        }, authOptions);
-        // resolveTenantId() prefers MODA_TENANT_ID over the config file, so a stale
-        // env var silently shadows the selection we just saved. Warn unless the env
-        // var was itself the source of the selection.
-        const envTenantId = (options.env ?? process.env).MODA_TENANT_ID;
-        if (envTenantId && options.tenantIdSource !== 'env' && envTenantId !== result.tenantId) {
-            console.error(`  Warning: MODA_TENANT_ID is set to a different organization id and will shadow the saved selection (${result.tenantId}) for later commands. Unset it or set it to the selected organization id.`);
-        }
-        log('  API key + tenant saved to ~/.moda/config.json\n');
-        log('  (Set MODA_API_KEY / MODA_TENANT_ID to override for scripts/CI.)\n');
-    }
-    return { ...result, reused };
-}
-//# sourceMappingURL=tenant.js.map