@motherbase/cli 0.2.6 → 0.2.9

package/src/commands/signing.js

@@ -1,130 +1,130 @@
-'use strict';
-
-// Local key material, the halves of `gen` that need no server: signing keys
-// (`gen signing-key`), tokens signed with them (`gen bearer-jwt`) and a fresh
-// set of stack secrets (`gen keys`). Node's crypto does all of it; the CLI has
-// no dependencies and this does not add one.
-
-const crypto = require('crypto');
-const fs = require('fs');
-const path = require('path');
-const api = require('../api');
-const { output } = require('./_util');
-const { CliError } = require('../context');
-
-const DEFAULT_KEY_FILE = path.join('motherbase', 'signing_keys.json');
-const ALGORITHMS = {
-  ES256: () => crypto.generateKeyPairSync('ec', { namedCurve: 'P-256' }),
-  RS256: () => crypto.generateKeyPairSync('rsa', { modulusLength: 2048 }),
-  EdDSA: () => crypto.generateKeyPairSync('ed25519'),
-};
-
-/** A private JWK with the kid and alg the server keeps when it is imported. */
-function generateSigningKey(algorithm = 'ES256') {
-  const generate = ALGORITHMS[algorithm];
-  if (!generate) throw new CliError(`--algorithm must be one of: ${Object.keys(ALGORITHMS).join(', ')}`);
-  const { privateKey } = generate();
-  return { ...privateKey.export({ format: 'jwk' }), kid: crypto.randomUUID(), alg: algorithm, use: 'sig' };
-}
-
-function algorithmOf(jwk) {
-  if (jwk.kty === 'EC' && jwk.crv === 'P-256') return 'ES256';
-  if (jwk.kty === 'RSA') return 'RS256';
-  if (jwk.kty === 'OKP' && jwk.crv === 'Ed25519') return 'EdDSA';
-  throw new CliError('The signing key must be an ES256, RS256 or EdDSA private JWK.');
-}
-
-const b64url = value => Buffer.from(typeof value === 'string' ? value : JSON.stringify(value)).toString('base64url');
-
-/** A compact JWS over `claims`, signed with a private JWK. */
-function signJwt(jwk, claims) {
-  const alg = algorithmOf(jwk);
-  const input = `${b64url({ alg, kid: jwk.kid, typ: 'JWT' })}.${b64url(claims)}`;
-  const key = crypto.createPrivateKey({ key: jwk, format: 'jwk' });
-  const signature = alg === 'EdDSA'
-    ? crypto.sign(null, Buffer.from(input), key)
-    : crypto.sign('sha256', Buffer.from(input), alg === 'ES256' ? { key, dsaEncoding: 'ieee-p1363' } : key);
-  return `${input}.${signature.toString('base64url')}`;
-}
-
-/** `30s`, `15m`, `2h`, `7d`, or plain seconds. */
-function parseDuration(value) {
-  const match = /^(\d+)([smhd]?)$/.exec(String(value).trim());
-  if (!match) throw new CliError(`invalid duration "${value}" (use e.g. 30m, 2h, 7d)`);
-  return Number(match[1]) * { '': 1, s: 1, m: 60, h: 3600, d: 86400 }[match[2]];
-}
-
-function readKeys(file) {
-  if (!fs.existsSync(file)) {
-    throw new CliError(`${file} does not exist. Run \`motherbase gen signing-key --append\` first.`);
-  }
-  const keys = JSON.parse(fs.readFileSync(file, 'utf8'));
-  if (!Array.isArray(keys) || !keys.length) throw new CliError(`${file} holds no keys.`);
-  return keys;
-}
-
-const signingKey = {
-  summary: 'Generate a JWT signing key (a private JWK) to import into a project',
-  usage: 'motherbase gen signing-key [--algorithm ES256|RS256|EdDSA] [--append] [--key-file motherbase/signing_keys.json]',
-  async run(ctx, _args, flags) {
-    const key = generateSigningKey(flags.algorithm || 'ES256');
-    if (!flags.append) {
-      output(ctx, key, (d, ui) => ui.print(JSON.stringify(d, null, 2)));
-      return;
-    }
-    const file = path.resolve(ctx.cwd, flags['key-file'] || DEFAULT_KEY_FILE);
-    const keys = fs.existsSync(file) ? JSON.parse(fs.readFileSync(file, 'utf8')) : [];
-    fs.mkdirSync(path.dirname(file), { recursive: true });
-    // Private keys: readable by the owner only.
-    fs.writeFileSync(file, JSON.stringify([...keys, key], null, 2) + '\n', { mode: 0o600 });
-    output(ctx, { kid: key.kid, alg: key.alg, file }, (d, ui) => {
-      ui.success(`Appended ${d.alg} key ${d.kid} to ${d.file}`);
-      ui.info('Import it in Studio (Project Settings > JWT Keys) to have the project accept its tokens.');
-    });
-  },
-};
-
-const bearerJwt = {
-  summary: 'Sign an access token with a local signing key, for calling the API as a user',
-  usage: 'motherbase gen bearer-jwt --sub <user id> [--role authenticated] [--valid-for 1h | --exp <unix>] [--payload <json>] [--issuer <url>] [--key-file <file>]',
-  async run(ctx, _args, flags) {
-    const [jwk] = readKeys(path.resolve(ctx.cwd, flags['key-file'] || DEFAULT_KEY_FILE));
-    if (!flags.sub) throw new CliError('--sub is required: the project resolves the token to that user.');
-    // The project verifies iss and aud against its own URL; ask it rather than guess.
-    const issuer = flags.issuer || (await api.adminRequest(ctx, 'GET', '/auth/signing-keys')).issuer;
-    const now = Math.floor(Date.now() / 1000);
-    const extra = flags.payload ? JSON.parse(String(flags.payload)) : {};
-    const claims = {
-      ...extra,
-      sub: String(flags.sub),
-      role: flags.role || extra.role || 'authenticated',
-      iss: issuer,
-      aud: flags.audience || issuer,
-      iat: now,
-      exp: flags.exp ? Number(flags.exp) : now + parseDuration(flags['valid-for'] || '1h'),
-    };
-    const token = signJwt(jwk, claims);
-    output(ctx, { token, kid: jwk.kid, claims }, d => process.stdout.write(`${d.token}\n`));
-  },
-};
-
-const hex = n => crypto.randomBytes(n).toString('hex');
-
-const keys = {
-  summary: 'Generate a fresh set of secrets for a local stack (use -o env)',
-  usage: 'motherbase gen keys [-o env]',
-  async run(ctx) {
-    const data = {
-      JWT_SECRET: hex(32),
-      CONFIG_ENCRYPTION_KEY: crypto.randomBytes(32).toString('base64'),
-      PLATFORM_SERVICE_TOKEN: hex(32),
-      EDGE_RUNTIME_TOKEN: hex(32),
-      POSTGRES_PASSWORD: hex(16),
-      S3_ACCESS_KEY_ID: hex(8),
-      S3_SECRET_ACCESS_KEY: hex(20),
-    };
-    output(ctx, data, (d, ui) => ui.keyValue(d));
-  },
-};
-
-module.exports = { signingKey, bearerJwt, keys, generateSigningKey, signJwt, parseDuration };
+'use strict';
+
+// Local key material, the halves of `gen` that need no server: signing keys
+// (`gen signing-key`), tokens signed with them (`gen bearer-jwt`) and a fresh
+// set of stack secrets (`gen keys`). Node's crypto does all of it; the CLI has
+// no dependencies and this does not add one.
+
+const crypto = require('crypto');
+const fs = require('fs');
+const path = require('path');
+const api = require('../api');
+const { output } = require('./_util');
+const { CliError } = require('../context');
+
+const DEFAULT_KEY_FILE = path.join('motherbase', 'signing_keys.json');
+const ALGORITHMS = {
+  ES256: () => crypto.generateKeyPairSync('ec', { namedCurve: 'P-256' }),
+  RS256: () => crypto.generateKeyPairSync('rsa', { modulusLength: 2048 }),
+  EdDSA: () => crypto.generateKeyPairSync('ed25519'),
+};
+
+/** A private JWK with the kid and alg the server keeps when it is imported. */
+function generateSigningKey(algorithm = 'ES256') {
+  const generate = ALGORITHMS[algorithm];
+  if (!generate) throw new CliError(`--algorithm must be one of: ${Object.keys(ALGORITHMS).join(', ')}`);
+  const { privateKey } = generate();
+  return { ...privateKey.export({ format: 'jwk' }), kid: crypto.randomUUID(), alg: algorithm, use: 'sig' };
+}
+
+function algorithmOf(jwk) {
+  if (jwk.kty === 'EC' && jwk.crv === 'P-256') return 'ES256';
+  if (jwk.kty === 'RSA') return 'RS256';
+  if (jwk.kty === 'OKP' && jwk.crv === 'Ed25519') return 'EdDSA';
+  throw new CliError('The signing key must be an ES256, RS256 or EdDSA private JWK.');
+}
+
+const b64url = value => Buffer.from(typeof value === 'string' ? value : JSON.stringify(value)).toString('base64url');
+
+/** A compact JWS over `claims`, signed with a private JWK. */
+function signJwt(jwk, claims) {
+  const alg = algorithmOf(jwk);
+  const input = `${b64url({ alg, kid: jwk.kid, typ: 'JWT' })}.${b64url(claims)}`;
+  const key = crypto.createPrivateKey({ key: jwk, format: 'jwk' });
+  const signature = alg === 'EdDSA'
+    ? crypto.sign(null, Buffer.from(input), key)
+    : crypto.sign('sha256', Buffer.from(input), alg === 'ES256' ? { key, dsaEncoding: 'ieee-p1363' } : key);
+  return `${input}.${signature.toString('base64url')}`;
+}
+
+/** `30s`, `15m`, `2h`, `7d`, or plain seconds. */
+function parseDuration(value) {
+  const match = /^(\d+)([smhd]?)$/.exec(String(value).trim());
+  if (!match) throw new CliError(`invalid duration "${value}" (use e.g. 30m, 2h, 7d)`);
+  return Number(match[1]) * { '': 1, s: 1, m: 60, h: 3600, d: 86400 }[match[2]];
+}
+
+function readKeys(file) {
+  if (!fs.existsSync(file)) {
+    throw new CliError(`${file} does not exist. Run \`motherbase gen signing-key --append\` first.`);
+  }
+  const keys = JSON.parse(fs.readFileSync(file, 'utf8'));
+  if (!Array.isArray(keys) || !keys.length) throw new CliError(`${file} holds no keys.`);
+  return keys;
+}
+
+const signingKey = {
+  summary: 'Generate a JWT signing key (a private JWK) to import into a project',
+  usage: 'motherbase gen signing-key [--algorithm ES256|RS256|EdDSA] [--append] [--key-file motherbase/signing_keys.json]',
+  async run(ctx, _args, flags) {
+    const key = generateSigningKey(flags.algorithm || 'ES256');
+    if (!flags.append) {
+      output(ctx, key, (d, ui) => ui.print(JSON.stringify(d, null, 2)));
+      return;
+    }
+    const file = path.resolve(ctx.cwd, flags['key-file'] || DEFAULT_KEY_FILE);
+    const keys = fs.existsSync(file) ? JSON.parse(fs.readFileSync(file, 'utf8')) : [];
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    // Private keys: readable by the owner only.
+    fs.writeFileSync(file, JSON.stringify([...keys, key], null, 2) + '\n', { mode: 0o600 });
+    output(ctx, { kid: key.kid, alg: key.alg, file }, (d, ui) => {
+      ui.success(`Appended ${d.alg} key ${d.kid} to ${d.file}`);
+      ui.info('Import it in Studio (Project Settings > JWT Keys) to have the project accept its tokens.');
+    });
+  },
+};
+
+const bearerJwt = {
+  summary: 'Sign an access token with a local signing key, for calling the API as a user',
+  usage: 'motherbase gen bearer-jwt --sub <user id> [--role authenticated] [--valid-for 1h | --exp <unix>] [--payload <json>] [--issuer <url>] [--key-file <file>]',
+  async run(ctx, _args, flags) {
+    const [jwk] = readKeys(path.resolve(ctx.cwd, flags['key-file'] || DEFAULT_KEY_FILE));
+    if (!flags.sub) throw new CliError('--sub is required: the project resolves the token to that user.');
+    // The project verifies iss and aud against its own URL; ask it rather than guess.
+    const issuer = flags.issuer || (await api.adminRequest(ctx, 'GET', '/auth/signing-keys')).issuer;
+    const now = Math.floor(Date.now() / 1000);
+    const extra = flags.payload ? JSON.parse(String(flags.payload)) : {};
+    const claims = {
+      ...extra,
+      sub: String(flags.sub),
+      role: flags.role || extra.role || 'authenticated',
+      iss: issuer,
+      aud: flags.audience || issuer,
+      iat: now,
+      exp: flags.exp ? Number(flags.exp) : now + parseDuration(flags['valid-for'] || '1h'),
+    };
+    const token = signJwt(jwk, claims);
+    output(ctx, { token, kid: jwk.kid, claims }, d => process.stdout.write(`${d.token}\n`));
+  },
+};
+
+const hex = n => crypto.randomBytes(n).toString('hex');
+
+const keys = {
+  summary: 'Generate a fresh set of secrets for a local stack (use -o env)',
+  usage: 'motherbase gen keys [-o env]',
+  async run(ctx) {
+    const data = {
+      JWT_SECRET: hex(32),
+      CONFIG_ENCRYPTION_KEY: crypto.randomBytes(32).toString('base64'),
+      PLATFORM_SERVICE_TOKEN: hex(32),
+      EDGE_RUNTIME_TOKEN: hex(32),
+      POSTGRES_PASSWORD: hex(16),
+      S3_ACCESS_KEY_ID: hex(8),
+      S3_SECRET_ACCESS_KEY: hex(20),
+    };
+    output(ctx, data, (d, ui) => ui.keyValue(d));
+  },
+};
+
+module.exports = { signingKey, bearerJwt, keys, generateSigningKey, signJwt, parseDuration };

package/src/commands/snippets.js

@@ -1,44 +1,44 @@
-'use strict';
-
-const api = require('../api');
-const { output, requireArg } = require('./_util');
-
-// SQL Editor snippets, kept by the project (see the Studio's SQL Editor). Like
-// `supabase snippets`: list what you can see, download one as plain SQL.
-const subcommands = {
-  list: {
-    summary: 'List SQL snippets (yours and the ones shared with the project)',
-    usage: 'motherbase snippets list',
-    async run(ctx) {
-      const data = await api.adminRequest(ctx, 'GET', '/content', { query: { type: 'sql' } });
-      const items = (data && data.items) || [];
-      output(ctx, data, (_d, ui) =>
-        ui.table(items.map(item => ({ ...item, visibility: item.visibility === 'project' ? 'shared' : 'private' })), [
-          { key: 'id', label: 'ID' },
-          { key: 'name', label: 'NAME' },
-          { key: 'visibility', label: 'VISIBILITY' },
-          { key: 'ownerId', label: 'OWNER' },
-          { key: 'updatedAt', label: 'UPDATED' },
-        ]),
-      );
-    },
-  },
-  download: {
-    summary: 'Print a snippet as plain SQL (redirect it to a file to save it)',
-    usage: 'motherbase snippets download <id>',
-    async run(ctx, args) {
-      const id = requireArg(args[0], 'id');
-      const data = await api.adminRequest(ctx, 'GET', `/content/${encodeURIComponent(id)}`);
-      const item = data && data.item;
-      // Structured output keeps the whole record; the default is the bare SQL,
-      // with no decoration, so `> query.sql` writes a runnable file.
-      output(ctx, item, () => process.stdout.write(`${item.content.sql}\n`));
-    },
-  },
-};
-
-module.exports = {
-  summary: 'SQL Editor snippets',
-  usage: 'motherbase snippets <list|download> ...',
-  subcommands,
-};
+'use strict';
+
+const api = require('../api');
+const { output, requireArg } = require('./_util');
+
+// SQL Editor snippets, kept by the project (see the Studio's SQL Editor). Like
+// `supabase snippets`: list what you can see, download one as plain SQL.
+const subcommands = {
+  list: {
+    summary: 'List SQL snippets (yours and the ones shared with the project)',
+    usage: 'motherbase snippets list',
+    async run(ctx) {
+      const data = await api.adminRequest(ctx, 'GET', '/content', { query: { type: 'sql' } });
+      const items = (data && data.items) || [];
+      output(ctx, data, (_d, ui) =>
+        ui.table(items.map(item => ({ ...item, visibility: item.visibility === 'project' ? 'shared' : 'private' })), [
+          { key: 'id', label: 'ID' },
+          { key: 'name', label: 'NAME' },
+          { key: 'visibility', label: 'VISIBILITY' },
+          { key: 'ownerId', label: 'OWNER' },
+          { key: 'updatedAt', label: 'UPDATED' },
+        ]),
+      );
+    },
+  },
+  download: {
+    summary: 'Print a snippet as plain SQL (redirect it to a file to save it)',
+    usage: 'motherbase snippets download <id>',
+    async run(ctx, args) {
+      const id = requireArg(args[0], 'id');
+      const data = await api.adminRequest(ctx, 'GET', `/content/${encodeURIComponent(id)}`);
+      const item = data && data.item;
+      // Structured output keeps the whole record; the default is the bare SQL,
+      // with no decoration, so `> query.sql` writes a runnable file.
+      output(ctx, item, () => process.stdout.write(`${item.content.sql}\n`));
+    },
+  },
+};
+
+module.exports = {
+  summary: 'SQL Editor snippets',
+  usage: 'motherbase snippets <list|download> ...',
+  subcommands,
+};

package/src/commands/status.js

@@ -1,42 +1,42 @@
-'use strict';
-
-const api = require('../api');
-const { output } = require('./_util');
-
-module.exports = {
-  summary: 'Show connection status: console, link, and a project health probe',
-  usage: 'motherbase status',
-  async run(ctx) {
-    const data = {
-      console: ctx.consoleUrl || null,
-      loggedIn: Boolean(ctx.token),
-      mode: ctx.mode,
-      project: ctx.projectId || null,
-      reachable: null,
-      api: null,
-    };
-
-    if (ctx.projectId || ctx.mode === 'direct') {
-      try {
-        const info = await api.adminRequest(ctx, 'GET', '/connect-info');
-        data.reachable = true;
-        data.api = info && info.apiUrl;
-      } catch (err) {
-        data.reachable = false;
-        data.error = err.message;
-      }
-    }
-
-    output(ctx, data, (d, ui) => {
-      ui.keyValue({
-        Console: d.console || '(none)',
-        'Logged in': d.loggedIn ? 'yes' : 'no',
-        Mode: d.mode,
-        Project: d.project || '(not linked)',
-        Reachable: d.reachable === null ? 'n/a' : d.reachable ? 'yes' : 'no',
-        'API URL': d.api || '',
-      });
-      if (d.error) ui.warn(d.error);
-    });
-  },
-};
+'use strict';
+
+const api = require('../api');
+const { output } = require('./_util');
+
+module.exports = {
+  summary: 'Show connection status: console, link, and a project health probe',
+  usage: 'motherbase status',
+  async run(ctx) {
+    const data = {
+      console: ctx.consoleUrl || null,
+      loggedIn: Boolean(ctx.token),
+      mode: ctx.mode,
+      project: ctx.projectId || null,
+      reachable: null,
+      api: null,
+    };
+
+    if (ctx.projectId || ctx.mode === 'direct') {
+      try {
+        const info = await api.adminRequest(ctx, 'GET', '/connect-info');
+        data.reachable = true;
+        data.api = info && info.apiUrl;
+      } catch (err) {
+        data.reachable = false;
+        data.error = err.message;
+      }
+    }
+
+    output(ctx, data, (d, ui) => {
+      ui.keyValue({
+        Console: d.console || '(none)',
+        'Logged in': d.loggedIn ? 'yes' : 'no',
+        Mode: d.mode,
+        Project: d.project || '(not linked)',
+        Reachable: d.reachable === null ? 'n/a' : d.reachable ? 'yes' : 'no',
+        'API URL': d.api || '',
+      });
+      if (d.error) ui.warn(d.error);
+    });
+  },
+};