@nodii/dev 0.0.0-stage → 0.3.1

package/dist/oauth.js

@@ -0,0 +1,195 @@
+import { spawn } from "node:child_process";
+import { open, rm, stat } from "node:fs/promises";
+import { platform } from "node:os";
+import { dirname, join } from "node:path";
+import { CliError, configPath, readConfig, writeConfig } from "./core.js";
+
+// nodii-auth is reached through the platform edge (/oauth/device/authorize and
+// /oauth/token are public there), so auth and API calls share one host.
+export const DEFAULT_EDGE_URL = "https://platform.nucleus-cloud.in";
+export const DEFAULT_AUTH_URL = DEFAULT_EDGE_URL;
+// The public client id of the nodii-dev OAuth app in the platform tenant
+// (tenant-service #843, D1368). Public by design: it carries no secret.
+export const DEFAULT_CLIENT_ID = "nodii_app_gPo9hUo5bb88AZD3inz7c7";
+export const PLATFORM_TENANT = "5914ae43-2af1-4755-bfa4-96b14301f036";
+export const DEVICE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
+export const FORBIDDEN_SCOPE = "devops.releases.promote";
+
+/**
+ * The scope sent at device authorization. By default none is sent, and
+ * nodii-auth grants the app's provisioned ceiling (every live devops.* key
+ * except promotion, D1368). An explicit --scope narrows it; promotion is
+ * refused locally as well as by auth and the hub.
+ */
+export function requestedScope(scope) {
+  const keys = (scope ?? "").split(/[\s,]+/).filter(Boolean);
+  if (keys.includes(FORBIDDEN_SCOPE)) throw new CliError("OAUTH_SCOPE_FORBIDDEN", `${FORBIDDEN_SCOPE} is never granted to nodii-dev.`, 2);
+  return keys.length ? keys.join(" ") : undefined;
+}
+
+const service = "dev.nodii.cli.oauth";
+const account = (clientId) => `refresh:${clientId}`;
+const wait = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+
+function run(command, args, { input } = {}) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(command, args, { stdio: [input ? "pipe" : "ignore", "pipe", "pipe"] });
+    let stdout = "";
+    child.stdout.on("data", (chunk) => { stdout += chunk; });
+    child.stderr.on("data", () => {}); // Credential helpers can echo secrets in diagnostics.
+    child.on("error", reject);
+    child.on("close", (code) => code === 0 ? resolve(stdout) : reject(new Error(`${command} failed`)));
+    if (input) child.stdin.end(input);
+  });
+}
+
+export async function storeRefreshToken(clientId, token, os = platform()) {
+  if (os === "darwin") {
+    await run("security", ["add-generic-password", "-U", "-a", account(clientId), "-s", service, "-w", token]);
+    return "macOS Keychain";
+  }
+  if (os === "linux") {
+    try {
+      await run("secret-tool", ["store", "--label=nodii-dev OAuth", "service", service, "account", account(clientId)], { input: token });
+      return "Secret Service";
+    } catch {}
+  }
+  throw new CliError("KEYCHAIN_UNAVAILABLE", "OAuth refresh tokens require macOS Keychain or Linux Secret Service. No credential was stored; re-run login when a keychain is available.", 2);
+}
+
+export async function loadRefreshToken(clientId, os = platform()) {
+  try {
+    if (os === "darwin") return (await run("security", ["find-generic-password", "-a", account(clientId), "-s", service, "-w"])).trim();
+    if (os === "linux") return (await run("secret-tool", ["lookup", "service", service, "account", account(clientId)])).trim();
+  } catch {}
+  throw new CliError("OAUTH_LOGIN_REQUIRED", "OAuth credentials are unavailable; run `nodii-dev login` again.", 2);
+}
+
+export async function deleteRefreshToken(clientId, os = platform()) {
+  try {
+    if (os === "darwin") await run("security", ["delete-generic-password", "-a", account(clientId), "-s", service]);
+    else if (os === "linux") await run("secret-tool", ["clear", "service", service, "account", account(clientId)]);
+  } catch {}
+}
+
+async function oauthPost(authUrl, path, fields, fetchImpl = fetch) {
+  let response;
+  try {
+    response = await fetchImpl(`${authUrl.replace(/\/$/, "")}${path}`, {
+      method: "POST",
+      headers: { accept: "application/json", "content-type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams(fields),
+    });
+  } catch (error) {
+    throw new CliError("AUTH_UNREACHABLE", `Cannot reach nodii-auth: ${error.message}`, 1);
+  }
+  const raw = await response.text();
+  let body = {};
+  try { body = raw ? JSON.parse(raw) : {}; } catch {}
+  return { ok: response.ok, status: response.status, body };
+}
+
+export async function pollDeviceToken({ authUrl, clientId, deviceCode, interval, expiresIn, fetchImpl = fetch, sleep = wait, now = Date.now }) {
+  const deadline = now() + expiresIn * 1000;
+  let delay = Math.max(1, interval) * 1000;
+  while (now() < deadline) {
+    await sleep(delay);
+    const result = await oauthPost(authUrl, "/oauth/token", { grant_type: DEVICE_GRANT, device_code: deviceCode, client_id: clientId }, fetchImpl);
+    if (result.ok) return result.body;
+    const code = result.body.error;
+    if (code === "authorization_pending") continue;
+    if (code === "slow_down") { delay += 5000; continue; }
+    if (code === "access_denied") throw new CliError("ACCESS_DENIED", "The sign-in request was denied.", 2);
+    if (code === "expired_token") throw new CliError("DEVICE_CODE_EXPIRED", "The sign-in code expired; run `nodii-dev login` again.", 2);
+    throw new CliError("OAUTH_TOKEN_FAILED", result.body.error_description ?? "OAuth token exchange failed.", 1);
+  }
+  throw new CliError("DEVICE_CODE_EXPIRED", "The sign-in code expired; run `nodii-dev login` again.", 2);
+}
+
+function openBrowser(url) {
+  const command = platform() === "darwin" ? "open" : "xdg-open";
+  const child = spawn(command, [url], { detached: true, stdio: "ignore" });
+  child.unref();
+}
+
+export async function deviceLogin({ clientId, authUrl = DEFAULT_AUTH_URL, edgeUrl = DEFAULT_EDGE_URL, tenantHint = PLATFORM_TENANT, noBrowser = false, scope, fetchImpl = fetch, output = console.log }) {
+  const requested = requestedScope(scope);
+  const start = await oauthPost(authUrl, "/oauth/device/authorize", {
+    client_id: clientId, tenant_hint: tenantHint, ...(requested ? { scope: requested } : {}),
+  }, fetchImpl);
+  if (!start.ok) throw new CliError("OAUTH_DEVICE_AUTHORIZE_FAILED", start.body.error_description ?? "Could not start device sign-in.", 1);
+  const d = start.body;
+  output(`Open ${d.verification_uri} and enter code ${d.user_code}`);
+  if (!noBrowser && process.stdout.isTTY) openBrowser(d.verification_uri_complete ?? d.verification_uri);
+  const token = await pollDeviceToken({ authUrl, clientId, deviceCode: d.device_code, interval: d.interval, expiresIn: d.expires_in, fetchImpl });
+  if (!token.refresh_token) throw new CliError("OAUTH_REFRESH_MISSING", "nodii-auth did not return a refresh token.", 1);
+  const storage = await storeRefreshToken(clientId, token.refresh_token);
+  const claims = decodeClaims(token.access_token);
+  await writeConfig({ authProvider: "oauth", authUrl, edgeUrl, clientId, tenantHint, agentId: null, person: claims.sub ?? null, installationId: claims.metadata?.oauth_app_installation_id ?? claims.oauth_app_installation_id ?? null });
+  return { storage, claims };
+}
+
+export function decodeClaims(token) {
+  try { return JSON.parse(Buffer.from(token.split(".")[1], "base64url").toString("utf8")); } catch { return {}; }
+}
+
+export async function withRefreshLock(fn, { sleep = wait } = {}) {
+  const path = join(dirname(configPath()), "oauth-refresh.lock");
+  for (let attempt = 0; attempt < 300; attempt++) {
+    try {
+      const handle = await open(path, "wx", 0o600);
+      try { return await fn(); } finally { await handle.close(); await rm(path, { force: true }); }
+    } catch (error) {
+      if (error.code !== "EEXIST") throw error;
+      try {
+        if (Date.now() - (await stat(path)).mtimeMs > 60_000) {
+          await rm(path, { force: true });
+          continue;
+        }
+      } catch (statError) {
+        if (statError.code !== "ENOENT") throw statError;
+      }
+      await sleep(100);
+    }
+  }
+  throw new CliError("OAUTH_REFRESH_BUSY", "Timed out waiting for another nodii-dev token refresh.", 1);
+}
+
+export class OAuthAuthProvider {
+  #accessToken;
+  #expiresAt = 0;
+  #refreshPromise;
+  constructor({ fetchImpl = fetch, loadToken = loadRefreshToken, storeToken = storeRefreshToken, deleteToken = deleteRefreshToken, lock = withRefreshLock } = {}) {
+    Object.assign(this, { fetchImpl, loadToken, storeToken, deleteToken, lock });
+  }
+  async accessToken() {
+    if (this.#accessToken && Date.now() < this.#expiresAt - 30_000) return this.#accessToken;
+    this.#refreshPromise ??= this.lock(async () => {
+      const config = await readConfig();
+      const refresh = await this.loadToken(config.clientId);
+      const result = await oauthPost(config.authUrl, "/oauth/token", { grant_type: "refresh_token", client_id: config.clientId, refresh_token: refresh }, this.fetchImpl);
+      if (!result.ok || !result.body.refresh_token) {
+        await this.deleteToken(config.clientId);
+        throw new CliError("OAUTH_LOGIN_REQUIRED", "OAuth refresh failed and the saved credential was cleared; run `nodii-dev login` again.", 2);
+      }
+      await this.storeToken(config.clientId, result.body.refresh_token);
+      this.#accessToken = result.body.access_token;
+      this.#expiresAt = Date.now() + result.body.expires_in * 1000;
+      return this.#accessToken;
+    }).finally(() => { this.#refreshPromise = undefined; });
+    return this.#refreshPromise;
+  }
+  async headers() {
+    const config = await readConfig();
+    return { authorization: `Bearer ${await this.accessToken()}`, ...(config.agentId ? { "x-agent-id": config.agentId } : {}) };
+  }
+}
+
+export async function revokeOAuth(config, fetchImpl = fetch) {
+  const token = await loadRefreshToken(config.clientId);
+  try {
+    await oauthPost(config.authUrl, "/oauth/revoke", { token, token_type_hint: "refresh_token", client_id: config.clientId }, fetchImpl);
+  } finally {
+    await deleteRefreshToken(config.clientId);
+  }
+}

package/package.json

@@ -1,6 +1,27 @@
 {
   "name": "@nodii/dev",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.3.1",
+  "description": "Agent CLI for the Nodii development hub",
+  "type": "module",
+  "bin": {
+    "nodii-dev": "bin/nodii-dev"
+  },
+  "files": [
+    "bin",
+    "dist",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "scripts": {
+    "build": "node build.mjs",
+    "test": "node --test test/*.test.js",
+    "pack:smoke": "node scripts/pack-smoke.mjs",
+    "openapi:snapshot": "curl -sf https://planning.dev.nucleus-cloud.in/openapi.json -o test/fixtures/devops-openapi.snapshot.json"
+  },
+  "license": "UNLICENSED",
+  "publishConfig": {
+    "access": "public"
+  }
+}