@monster-orange/den 0.0.0 → 0.2.0

package/src/shared/auth/headless-login.ts

@@ -0,0 +1,265 @@
+/**
+ * Headless browser login
+ *
+ * Two exported functions:
+ *   getCredentials()  — resolves email+password from ENV vars or the secrets backend
+ *   headlessLogin()   — performs a full browser-based login and saves the session
+ *
+ * Credential priority:
+ *   1. ENV vars  — E2E_ADMIN_EMAIL / E2E_ADMIN_PASSWORD  (CI only)
+ *                  E2E_USER_EMAIL  / E2E_USER_PASSWORD
+ *                  E2E_BETA_EMAIL  / E2E_BETA_PASSWORD
+ *                  E2E_ROOT_ADMIN_EMAIL / E2E_ROOT_ADMIN_PASSWORD
+ *   2. Shared account — `test_accounts.roles.<role>` in the org config
+ *                  (email + secrets-backend item; see ./test-accounts.ts)
+ *   3. admin / root_admin only — the per-engineer account written by
+ *                  `make auth-configure [env=<env>]` (email + secret ref)
+ */
+
+import { chromium } from "@playwright/test";
+import * as fs from "fs";
+import * as path from "path";
+import type { BrowserLoginConfig, Environment } from "../types/index.js";
+import { getDistRoot } from "../paths.js";
+import { getSecretsProvider } from "../secrets/index.js";
+import { sharedTestAccount } from "./test-accounts.js";
+
+import { product } from "../product.js";
+// Anchored to the den checkout, NEVER process.cwd(): AUTH_DIR below is
+// WRITTEN (saved browser sessions are secrets), and the "scripts always run
+// from the repo root" assumption is false — bin/den never cds and
+// test-runner-spawned playwright children inherit the user's cwd.
+const PROJECT_ROOT = getDistRoot();
+
+const AUTH_DIR = path.resolve(PROJECT_ROOT, "playwright/.auth");
+
+// Per-engineer admin config — stores email + secret reference (no password)
+// Created by: make auth-configure [env=<env>]
+// Lookup order: config/local/admin-auth-{env}.json → config/local/admin-auth.json
+const LOCAL_CONFIG_DIR = path.resolve(PROJECT_ROOT, "config/local");
+
+interface AdminAuthConfig {
+  email: string;
+  opRef: string;
+  // Saved by auth-configure for robust lookup by ID (avoids op:// URI parsing
+  // issues with special characters in vault/item names)
+  itemId?: string;
+  vaultId?: string;
+  fieldLabel?: string;
+}
+
+function loadAdminConfig(environment: Environment): AdminAuthConfig | null {
+  const candidates = [
+    path.join(LOCAL_CONFIG_DIR, `admin-auth-${environment}.json`),
+    path.join(LOCAL_CONFIG_DIR, "admin-auth.json"),
+  ];
+  for (const configPath of candidates) {
+    try {
+      if (!fs.existsSync(configPath)) continue;
+      return JSON.parse(
+        fs.readFileSync(configPath, "utf-8"),
+      ) as AdminAuthConfig;
+    } catch {
+      continue;
+    }
+  }
+  return null;
+}
+
+/**
+ * Read a secret through the configured secrets strategy (Doppler, 1Password,
+ * or env — see src/shared/secrets). Name kept for call-site stability.
+ */
+async function opGetField(opts: {
+  item: string; // item ID or name
+  vault?: string; // vault ID or name
+  field: string; // field label (e.g. "password")
+}): Promise<string> {
+  return getSecretsProvider().get({
+    vault: opts.vault ?? "",
+    item: opts.item,
+    field: opts.field,
+  });
+}
+
+const ENV_PREFIX: Record<"admin" | "user" | "beta" | "root_admin", string> = {
+  admin: "E2E_ADMIN",
+  user: "E2E_USER",
+  beta: "E2E_BETA",
+  root_admin: "E2E_ROOT_ADMIN",
+};
+
+/**
+ * Retrieve credentials for a role.
+ *
+ * Priority:
+ *   1. ENV vars  — CI-friendly, never used on local dev
+ *   2. The shared account from `test_accounts` in the org config
+ *   3. admin / root_admin: config/local/admin-auth[-<env>].json
+ *      (email + secret ref, set via make auth-configure)
+ *
+ * Returns null if no credentials are available.
+ */
+export async function getCredentials(
+  role: "admin" | "user" | "beta" | "root_admin",
+  environment: Environment,
+): Promise<{ email: string; password: string } | null> {
+  // 1. ENV vars — CI only
+  const prefix = ENV_PREFIX[role];
+  const envEmail = process.env[`${prefix}_EMAIL`];
+  const envPassword = process.env[`${prefix}_PASSWORD`];
+  if (envEmail && envPassword) {
+    console.log(`  Using ENV var credentials for ${role}`);
+    return { email: envEmail, password: envPassword };
+  }
+
+  // 2/3. Secrets backend — local dev (dynamic, nothing written to disk)
+  try {
+    const shared = sharedTestAccount(role, environment);
+    if (shared) {
+      const password = await opGetField({
+        item: shared.ref.item,
+        vault: shared.ref.vault,
+        field: shared.ref.field,
+      });
+      console.log(
+        `  Using secrets-backend credentials for ${role} (${shared.email})`,
+      );
+      return { email: shared.email, password };
+    }
+
+    if (role === "admin" || role === "root_admin") {
+      // No shared account here: use the per-engineer personal account
+      // (personal accounts serve both admin and root_admin).
+      const adminConfig = loadAdminConfig(environment);
+      if (adminConfig?.email && adminConfig?.opRef) {
+        const password = await opGetField({
+          item: adminConfig.itemId ?? adminConfig.opRef,
+          vault: adminConfig.vaultId,
+          field: adminConfig.fieldLabel ?? "password",
+        });
+        console.log(
+          `  Using secrets-backend credentials for ${role} (${adminConfig.email})`,
+        );
+        return { email: adminConfig.email, password };
+      }
+      console.log(
+        `  No admin config for ${environment} — run: make auth-configure env=${environment}`,
+      );
+    } else {
+      console.log(
+        `  No shared ${role} account for ${environment} — set test_accounts.roles.${role} in the org config`,
+      );
+    }
+  } catch (err) {
+    const msg = (err as Error).message ?? String(err);
+    if (
+      msg.includes("not signed in") ||
+      msg.includes("sign in") ||
+      msg.includes("ENOENT") ||
+      msg.includes("not found") ||
+      msg.includes("command not found")
+    ) {
+      console.log(
+        `  Secrets backend unavailable — sign in (make ${product().cli}-setup-secrets)`,
+      );
+    } else {
+      console.log(`  Secrets backend error: ${msg.split("\n")[0]}`);
+    }
+  }
+
+  return null;
+}
+
+/**
+ * Perform a fully headless browser login using email+password credentials.
+ *
+ * Navigates to the app's login path → follows the redirect to the IdP →
+ * fills email/password → waits for the redirect back to the app origin →
+ * saves context.storageState() to authFile.
+ *
+ * `login.loginPath` (environment config `auth.browser.loginPath`, default
+ * "/") is where the app starts its login redirect. Success is "back on the
+ * app origin", which holds for any IdP host (hosted domain or vanity CNAME).
+ *
+ * Sessions are ephemeral — written fresh on each test run by global-setup.
+ *
+ * @istanbul ignore next - Browser automation tested via E2E tests
+ */
+/* istanbul ignore next */
+export async function headlessLogin(
+  role: "admin" | "user" | "beta",
+  baseUrl: string,
+  email: string,
+  password: string,
+  outputPath?: string,
+  login: BrowserLoginConfig = {},
+): Promise<void> {
+  const env = process.env.E2E_ENVIRONMENT || "local";
+  const authFile = outputPath ?? path.join(AUTH_DIR, `${role}-${env}.json`);
+
+  console.log(`  Logging in: ${role} (${email})`);
+
+  const browser = await chromium.launch({ headless: true });
+  const context = await browser.newContext();
+  const page = await context.newPage();
+
+  try {
+    const loginPath = login.loginPath ?? "/";
+    const loginUrl = `${baseUrl.replace(/\/$/, "")}${loginPath.startsWith("/") ? "" : "/"}${loginPath}`;
+    const appOrigin = new URL(baseUrl).origin;
+    await page.goto(loginUrl, {
+      waitUntil: "domcontentloaded",
+      timeout: 30000,
+    });
+
+    // Wait for the IdP redirect: "navigated away from the app origin",
+    // never a hard-coded IdP host, so hosted and vanity domains both work.
+    await page.waitForURL((url) => url.origin !== appOrigin, {
+      timeout: 15000,
+    });
+
+    // Fill email
+    await page.fill('input[name="username"], input[type="email"]', email, {
+      timeout: 10000,
+    });
+
+    // Some IdPs show a "Continue" step before the password
+    const continueBtn = page.locator(
+      'button:has-text("Continue"), button[name="action"][value="default"]',
+    );
+    if ((await continueBtn.count()) > 0) {
+      await continueBtn.first().click();
+      await page.waitForTimeout(500);
+    }
+
+    // Fill password
+    await page.fill(
+      'input[name="password"], input[type="password"]',
+      password,
+      { timeout: 10000 },
+    );
+
+    // Submit
+    await page.click('button[type="submit"], button[name="action"]', {
+      timeout: 10000,
+    });
+
+    // Wait for the redirect back to the app: "back on the app origin" is
+    // the IdP-agnostic signal.
+    await page.waitForURL((url) => url.origin === appOrigin, {
+      timeout: 30000,
+    });
+
+    console.log(`  ✓ ${role} authenticated → ${page.url()}`);
+
+    if (!fs.existsSync(AUTH_DIR)) {
+      fs.mkdirSync(AUTH_DIR, { recursive: true, mode: 0o700 });
+    }
+    await context.storageState({ path: authFile });
+    // The saved session is a secret — Playwright writes it 0644, so restrict it.
+    fs.chmodSync(authFile, 0o600);
+  } finally {
+    await browser.close();
+  }
+}

package/src/shared/auth/jwt-helper.ts

@@ -0,0 +1,186 @@
+/**
+ * JWT Helper
+ * Handles JWT token operations
+ */
+
+import jwt from "jsonwebtoken";
+
+export interface JWTPayload {
+  sub?: string;
+  email?: string;
+  name?: string;
+  roles?: string[];
+  permissions?: string[];
+  exp?: number;
+  iat?: number;
+  [key: string]: unknown;
+}
+
+export class JWTHelper {
+  /**
+   * Decode JWT token without verification
+   */
+  decode(token: string): JWTPayload {
+    try {
+      const decoded = jwt.decode(token);
+      if (!decoded || typeof decoded === "string") {
+        throw new Error("Invalid token format");
+      }
+      return decoded as JWTPayload;
+    } catch (error) {
+      throw new Error(`Failed to decode JWT: ${(error as Error).message}`);
+    }
+  }
+
+  /**
+   * Check if token is expired
+   */
+  isExpired(token: string): boolean {
+    try {
+      const decoded = this.decode(token);
+
+      if (!decoded.exp) {
+        // If no expiration, consider it as never expires
+        return false;
+      }
+
+      const now = Math.floor(Date.now() / 1000);
+      return decoded.exp < now;
+    } catch {
+      // If we can't decode, consider it expired
+      return true;
+    }
+  }
+
+  /**
+   * Get remaining time in seconds
+   */
+  getRemainingTime(token: string): number {
+    try {
+      const decoded = this.decode(token);
+
+      if (!decoded.exp) {
+        return Infinity;
+      }
+
+      const now = Math.floor(Date.now() / 1000);
+      const remaining = decoded.exp - now;
+
+      return remaining > 0 ? remaining : 0;
+    } catch {
+      return 0;
+    }
+  }
+
+  /**
+   * Extract claims from token
+   */
+  extractClaims(token: string): Record<string, unknown> {
+    return this.decode(token);
+  }
+
+  /**
+   * Extract roles from token
+   */
+  extractRoles(token: string): string[] {
+    const decoded = this.decode(token);
+
+    // Try common role claim names
+    if (decoded.roles && Array.isArray(decoded.roles)) {
+      return decoded.roles;
+    }
+
+    if (
+      decoded["https://example.app/roles"] &&
+      Array.isArray(decoded["https://example.app/roles"])
+    ) {
+      return decoded["https://example.app/roles"] as string[];
+    }
+
+    if (decoded.role && Array.isArray(decoded.role)) {
+      return decoded.role as string[];
+    }
+
+    if (typeof decoded.role === "string") {
+      return [decoded.role];
+    }
+
+    return [];
+  }
+
+  /**
+   * Extract permissions from token
+   */
+  extractPermissions(token: string): string[] {
+    const decoded = this.decode(token);
+
+    // Try common permission claim names
+    if (decoded.permissions && Array.isArray(decoded.permissions)) {
+      return decoded.permissions;
+    }
+
+    if (
+      decoded["https://example.app/permissions"] &&
+      Array.isArray(decoded["https://example.app/permissions"])
+    ) {
+      return decoded["https://example.app/permissions"] as string[];
+    }
+
+    if (decoded.scope) {
+      // Handle space-separated scopes (common in OAuth)
+      if (typeof decoded.scope === "string") {
+        return decoded.scope.split(" ");
+      }
+      if (Array.isArray(decoded.scope)) {
+        return decoded.scope as string[];
+      }
+    }
+
+    return [];
+  }
+
+  /**
+   * Check if token has specific role
+   */
+  hasRole(token: string, role: string): boolean {
+    const roles = this.extractRoles(token);
+    return roles.includes(role);
+  }
+
+  /**
+   * Check if token has specific permission
+   */
+  hasPermission(token: string, permission: string): boolean {
+    const permissions = this.extractPermissions(token);
+    return permissions.includes(permission);
+  }
+
+  /**
+   * Get token expiration date
+   */
+  getExpirationDate(token: string): Date | null {
+    const decoded = this.decode(token);
+
+    if (!decoded.exp) {
+      return null;
+    }
+
+    return new Date(decoded.exp * 1000);
+  }
+
+  /**
+   * Get token issue date
+   */
+  getIssueDate(token: string): Date | null {
+    const decoded = this.decode(token);
+
+    if (!decoded.iat) {
+      return null;
+    }
+
+    return new Date(decoded.iat * 1000);
+  }
+}
+
+// Export singleton instance
+export const jwtHelper = new JWTHelper();

package/src/shared/auth/sudo-vault.ts

@@ -0,0 +1,69 @@
+/**
+ * Secrets-backed persistence for the local-dev sudo password.
+ *
+ * Goes through the configured secrets strategy (Doppler, 1Password or env —
+ * see src/shared/secrets), addressing the named ref `sudo` (default
+ * OP_API_KEYS_VAULT / OP_DEV_KEYS_ITEM / OP_DEN_SUDO_FIELD; an org
+ * moves it with `secrets.refs.sudo` in its config) — flat key
+ * DEN_LOCAL_ADMIN_PWD for key/value backends.
+ *
+ * All read helpers fail *soft*: if the backend isn't installed, the user isn't
+ * signed in, or the value is missing, they return null/false so the server can
+ * fall back to the manual unlock banner without surfacing CLI noise.
+ */
+
+import {
+  OP_API_KEYS_VAULT,
+  OP_DEV_KEYS_ITEM,
+  OP_DEN_SUDO_FIELD,
+} from "../constants.js";
+import {
+  getSecretsProvider,
+  namedSecretRef,
+  type SecretRef,
+} from "../secrets/index.js";
+
+/** The built-in default for the `sudo` named ref. */
+export const SUDO_SECRET_REF: SecretRef = {
+  vault: OP_API_KEYS_VAULT,
+  item: OP_DEV_KEYS_ITEM,
+  field: OP_DEN_SUDO_FIELD,
+};
+
+/** The effective sudo ref (`secrets.refs.sudo` over the default). */
+function sudoRef(): SecretRef {
+  return namedSecretRef("sudo", SUDO_SECRET_REF);
+}
+
+/** True when the secrets backend is installed AND authenticated. */
+export async function isSecretsBackendReady(): Promise<boolean> {
+  return getSecretsProvider().isReady();
+}
+
+/** @deprecated use isSecretsBackendReady */
+export const isOpSignedIn = isSecretsBackendReady;
+
+/** Read the stored sudo password. Null when unavailable or empty. */
+export async function readSudoFromVault(): Promise<string | null> {
+  return getSecretsProvider().tryGet(sudoRef());
+}
+
+/** Whether a non-empty sudo password is stored (without returning it). */
+export async function hasSudoInVault(): Promise<boolean> {
+  return (await readSudoFromVault()) !== null;
+}
+
+/** Save (or overwrite) the sudo password. Throws on backend errors. */
+export async function saveSudoToVault(password: string): Promise<void> {
+  await getSecretsProvider().set(sudoRef(), password);
+}
+
+/** Name of the active backend, for UI copy ("Save to Doppler"). */
+export function secretsBackendLabel(): string {
+  const n = getSecretsProvider().name;
+  return n === "1password"
+    ? "1Password"
+    : n === "doppler"
+      ? "Doppler"
+      : "environment";
+}

package/src/shared/auth/test-accounts.ts

@@ -0,0 +1,98 @@
+/**
+ * Shared test accounts, from the org config.
+ *
+ * Which accounts a team logs in as, and where their passwords live in the
+ * secrets backend, are org data, so the engine reads them from
+ * `test_accounts` in the org config instead of hard-wiring any:
+ *
+ *   test_accounts:
+ *     vault: QA                 # secrets vault holding the items (default "test-accounts")
+ *     roles:
+ *       user:  { email: user@example.com,  item: Web Test User }
+ *       beta:  { email: beta@example.com,  item: Web Test Beta }
+ *       admin:                  # shared only in these environments; elsewhere
+ *         email: admin@example.com     # each engineer runs `make auth-configure`
+ *         item: Web Test Admin
+ *         environments: [local, dev]
+ *
+ * A role with no entry (or outside its `environments`) has no shared
+ * account; admin and root_admin then fall back to the per-engineer config
+ * written by `make auth-configure`.
+ */
+
+import { readDenConfig } from "../den-config.js";
+import type { SecretRef } from "../secrets/index.js";
+
+export type TestRole = "admin" | "user" | "beta" | "root_admin";
+
+export interface TestAccountConfig {
+  /** Login email (or username) of the shared account. */
+  email: string;
+  /** Secrets-backend item holding the password. */
+  item: string;
+  /** Field within the item (default "password"). */
+  field?: string;
+  /** Vault override for this account (default: `test_accounts.vault`). */
+  vault?: string;
+  /** Environments the account is shared in; omitted = every environment. */
+  environments?: string[];
+}
+
+export interface TestAccountsConfig {
+  /** Default vault for every account (default "test-accounts"). */
+  vault?: string;
+  roles?: Partial<Record<TestRole, TestAccountConfig>>;
+}
+
+/** Vault used when `test_accounts.vault` is not set. */
+export const DEFAULT_TEST_ACCOUNTS_VAULT = "test-accounts";
+
+/** The configured `test_accounts` block ({} when absent or unreadable). */
+export function readTestAccountsConfig(): TestAccountsConfig {
+  try {
+    return readDenConfig().test_accounts ?? {};
+  } catch {
+    return {};
+  }
+}
+
+/** The vault test-account items live in. */
+export function testAccountsVault(
+  cfg: TestAccountsConfig = readTestAccountsConfig(),
+): string {
+  return cfg.vault?.trim() || DEFAULT_TEST_ACCOUNTS_VAULT;
+}
+
+/** A shared account resolved for one role and environment. */
+export interface SharedTestAccount {
+  email: string;
+  ref: SecretRef;
+}
+
+/**
+ * The shared account for `role` in `environment`, or undefined when the
+ * org config declares none there (no entry, incomplete entry, or an
+ * `environments` list that excludes it).
+ */
+export function sharedTestAccount(
+  role: TestRole,
+  environment: string,
+  cfg: TestAccountsConfig = readTestAccountsConfig(),
+): SharedTestAccount | undefined {
+  const account = cfg.roles?.[role];
+  if (!account?.email?.trim() || !account.item?.trim()) return undefined;
+  if (
+    Array.isArray(account.environments) &&
+    !account.environments.includes(environment)
+  ) {
+    return undefined;
+  }
+  return {
+    email: account.email.trim(),
+    ref: {
+      vault: account.vault?.trim() || testAccountsVault(cfg),
+      item: account.item.trim(),
+      field: account.field?.trim() || "password",
+    },
+  };
+}