@mondaydotcomorg/z2h-cli 0.6.0 → 0.6.1

package/src/util/npm/ensure-token.ts

@@ -0,0 +1,28 @@
+import { tryReadAuthTokenSync } from '../auth/auth-store';
+import { info } from '../logger';
+import { generateZ2HTokenCommand } from '../../commands/generate-z2h-token';
+
+export interface EnsureZ2hTokenOptions {
+  /**
+   * Re-run the token flow even if a token already exists on disk. Used after a
+   * broker 401, where the stored token is present but expired/invalid.
+   */
+  forceRefresh?: boolean;
+}
+
+/**
+ * Ensure a z2h JWT exists at `~/.zth/auth.json` before an install-bearing
+ * command runs. If none is present (or `forceRefresh` is set), drive the
+ * existing `generate-z2h-token` flow — loopback capture with manual-paste
+ * fallback — which writes the token. No-ops when a token already exists and no
+ * refresh was requested.
+ *
+ * This is the install preflight: it keeps a friendly auth prompt in front of
+ * the raw npm error a non-technical user would otherwise hit.
+ */
+export async function ensureZ2hToken(opts: EnsureZ2hTokenOptions = {}): Promise<void> {
+  if (opts.forceRefresh || !tryReadAuthTokenSync()) {
+    info('you need to sign in to install monday packages — opening the sign-in page');
+    await generateZ2HTokenCommand();
+  }
+}

package/src/util/npm/install.ts

@@ -0,0 +1,84 @@
+import { execa, type Options as ExecaOptions } from 'execa';
+import { info, warn } from '../logger';
+import { tryReadAuthTokenSync } from '../auth/auth-store';
+import { Z2H_NPM_TOKEN_ENV } from '../../constants';
+import { ensureZ2hToken } from './ensure-token';
+
+// Substrings that, in a failed install's output, indicate the broker rejected
+// the z2h JWT (expired/invalid). npm surfaces `E401`/`code E401`; yarn berry
+// surfaces an HTTP 401 line. We re-auth on any of these rather than dumping a
+// raw npm error on a non-technical user.
+const AUTH_FAILURE_MARKERS = ['401', 'e401', 'unauthorized', 'authentication'];
+
+function looksLikeAuthFailure(text: string): boolean {
+  const haystack = text.toLowerCase();
+  return AUTH_FAILURE_MARKERS.some(marker => haystack.includes(marker));
+}
+
+export interface RunYarnInstallOptions {
+  /** Directory to run `yarn install` in. */
+  cwd: string;
+  /** Extra env to merge on top of `process.env` + the broker token. */
+  extraEnv?: NodeJS.ProcessEnv;
+}
+
+/**
+ * Spawn `yarn install` in `cwd` with the npm-broker credential injected, while
+ * streaming yarn's output live to the user. stdout is inherited; stderr is
+ * piped so we can both echo it and inspect it for a broker auth failure.
+ *
+ * Returns the captured stderr on success; throws an Error tagged
+ * `isAuthFailure` when the failure output looks like a broker 401 so the
+ * caller can re-auth, or rethrows the raw execa error otherwise.
+ */
+async function spawnYarnInstall(opts: RunYarnInstallOptions): Promise<void> {
+  const token = tryReadAuthTokenSync();
+  const env = { ...process.env, ...(token && { [Z2H_NPM_TOKEN_ENV]: token }), ...opts.extraEnv };
+  const child = execa('yarn', ['install'], {
+    cwd: opts.cwd,
+    stdout: 'inherit',
+    stderr: ['inherit', 'pipe'],
+    env,
+  } satisfies ExecaOptions);
+
+  try {
+    await child;
+  } catch (err) {
+    const e = err as Error & { stderr?: string };
+    const combined = `${e.stderr}\n${e.message ?? ''}`;
+    if (looksLikeAuthFailure(combined)) {
+      const authErr = new Error('broker rejected the z2h token during install') as Error & {
+        isAuthFailure: true;
+      };
+      authErr.isAuthFailure = true;
+      throw authErr;
+    }
+    throw err;
+  }
+}
+
+/**
+ * Run `yarn install` for an install-bearing command:
+ *   1. Preflight — ensure a z2h token exists (prompt `generate-z2h-token` if not).
+ *   2. Install through the broker.
+ *   3. On a broker 401, surface a friendly "your access expired — refreshing it"
+ *      message, re-auth, and retry the install exactly once.
+ *
+ * A non-auth failure (real dependency error, network, etc.) propagates as-is so
+ * the command's normal error path reports it.
+ */
+export async function runYarnInstall(opts: RunYarnInstallOptions): Promise<void> {
+  await ensureZ2hToken();
+
+  try {
+    await spawnYarnInstall(opts);
+  } catch (err) {
+    if (!(err as { isAuthFailure?: boolean }).isAuthFailure) {
+      throw err;
+    }
+    warn('your access expired — refreshing it now…');
+    await ensureZ2hToken({ forceRefresh: true });
+    info('access refreshed — retrying install');
+    await spawnYarnInstall(opts);
+  }
+}