@nodii/dev 0.4.1 → 0.6.1

package/dist/core.js

@@ -1,36 +1,22 @@
 import { spawn } from "node:child_process";
-import { createHash, createHmac } from "node:crypto";
+import { createHash } from "node:crypto";
 import { chmod, mkdir, readFile, rm, writeFile } from "node:fs/promises";
 import { homedir, platform } from "node:os";
 import { dirname, join } from "node:path";
 
-export const VERSION = "0.4.1";
-export const DEFAULT_HUB_URL = "https://planning.dev.nucleus-cloud.in";
-export const OPERATOR_AGENT_ID = "00000000-0000-0000-0000-000000000001";
+export const VERSION = "0.6.1";
 export const configPath = () =>
   process.env.NODII_DEV_CONFIG_PATH ??
   join(homedir(), ".config/nodii-dev/config.json");
-export const secretPath = () =>
+// Where releases before 0.5.0 kept a shared signing secret. Read by nothing;
+// kept only so an upgrade can delete what an old login left behind.
+export const legacySecretPath = () =>
   process.env.NODII_DEV_SECRET_PATH ??
   join(dirname(configPath()), "hmac-secret");
 
-export function signRequest({
-  secret,
-  agentId,
-  method,
-  path,
-  body = "",
-  timestamp = Math.floor(Date.now() / 1000),
-}) {
-  const upper = method.toUpperCase();
-  const bodyHash = createHash("sha256").update(body).digest("hex");
-  const payload = `${timestamp}.${upper}.${new URL(path, "http://local").pathname}.${bodyHash}`;
-  return {
-    "x-agent-id": agentId,
-    "x-timestamp": String(timestamp),
-    "x-signature": createHmac("sha256", secret).update(payload).digest("hex"),
-  };
-}
+export const LEGACY_LOGIN_MESSAGE =
+  "nodii-dev 0.5.0 talks only to Dev, through the platform edge, signed in as the platform tenant's OAuth app. " +
+  "Your old shared-secret login was removed from this machine. Run `nodii-dev login`.";
 
 export function requestHash({ toService, kind, specMd, at = new Date() }) {
   const minute = at.toISOString().slice(0, 16);
@@ -40,13 +26,25 @@ export function requestHash({ toService, kind, specMd, at = new Date() }) {
     .slice(0, 16);
 }
 
+/** A config is current only when it was written by the OAuth device login. */
+export const isOAuthConfig = (config) =>
+  config?.authProvider === "oauth" && typeof config.edgeUrl === "string" && config.edgeUrl !== "";
+
 export async function readConfig(required = true) {
+  let config;
   try {
-    return JSON.parse(await readFile(configPath(), "utf8"));
+    config = JSON.parse(await readFile(configPath(), "utf8"));
   } catch (error) {
     if (!required && error?.code === "ENOENT") return null;
     throw new CliError("NOT_LOGGED_IN", "Run `nodii-dev login` first.", 2);
   }
+  if (isOAuthConfig(config)) return config;
+  // A config from before 0.5.0 (shared-secret signing). It cannot be used:
+  // delete it and its stored secret, then point at the OAuth login.
+  await deleteCredentials();
+  if (required) throw new CliError("LOGIN_REQUIRED", LEGACY_LOGIN_MESSAGE, 2);
+  process.stderr.write(`${LEGACY_LOGIN_MESSAGE}\n`);
+  return null;
 }
 
 export async function writeConfig(value) {
@@ -56,133 +54,26 @@ export async function writeConfig(value) {
   await chmod(file, 0o600);
 }
 
-function run(command, args, options = {}) {
+function run(command, args) {
   return new Promise((resolve, reject) => {
-    const child = spawn(command, args, {
-      ...options,
-      stdio: options.stdio ?? ["ignore", "pipe", "pipe"],
-    });
-    let stdout = "";
-    let stderr = "";
-    child.stdout?.on("data", (x) => {
-      stdout += x;
-    });
-    child.stderr?.on("data", (x) => {
-      stderr += x;
-    });
+    const child = spawn(command, args, { stdio: ["ignore", "ignore", "ignore"] });
     child.on("error", reject);
-    child.on("close", (code) =>
-      code === 0
-        ? resolve(stdout)
-        : reject(new Error(stderr.trim() || `${command} exited ${code}`)),
-    );
+    child.on("close", (code) => (code === 0 ? resolve() : reject(new Error(`${command} exited ${code}`))));
   });
 }
 
-const keychainService = "dev.nodii.cli";
-export async function storeSecret(secret) {
-  if (
-    platform() === "darwin" &&
-    process.env.NODII_DEV_DISABLE_KEYCHAIN !== "1"
-  ) {
-    try {
-      await run("security", [
-        "add-generic-password",
-        "-U",
-        "-a",
-        "hmac",
-        "-s",
-        keychainService,
-        "-w",
-        secret,
-      ]);
-      await rm(secretPath(), { force: true });
-      return "keychain";
-    } catch {
-      /* fall through for minimal/non-interactive macOS images */
-    }
-  }
-  const file = secretPath();
-  await mkdir(dirname(file), { recursive: true, mode: 0o700 });
-  await writeFile(file, secret, { mode: 0o600 });
-  await chmod(file, 0o600);
-  return "file";
-}
-
-export async function loadSecret() {
-  if (process.env.PLANNING_HUB_HMAC_SECRET)
-    return process.env.PLANNING_HUB_HMAC_SECRET;
-  if (
-    platform() === "darwin" &&
-    process.env.NODII_DEV_DISABLE_KEYCHAIN !== "1"
-  ) {
-    try {
-      return (
-        await run("security", [
-          "find-generic-password",
-          "-a",
-          "hmac",
-          "-s",
-          keychainService,
-          "-w",
-        ])
-      ).trim();
-    } catch {
-      /* try fallback file */
-    }
-  }
-  try {
-    return (await readFile(secretPath(), "utf8")).trim();
-  } catch {
-    throw new CliError(
-      "SECRET_NOT_FOUND",
-      "No HMAC credential is stored; run `nodii-dev login`.",
-      2,
-    );
-  }
-}
-
-export async function deleteCredentials() {
-  if (
-    platform() === "darwin" &&
-    process.env.NODII_DEV_DISABLE_KEYCHAIN !== "1"
-  ) {
+/** Delete a shared secret stored by a release before 0.5.0, wherever it lives. */
+export async function deleteLegacySecret() {
+  if (platform() === "darwin" && process.env.NODII_DEV_DISABLE_KEYCHAIN !== "1") {
     try {
-      await run("security", [
-        "delete-generic-password",
-        "-a",
-        "hmac",
-        "-s",
-        keychainService,
-      ]);
+      await run("security", ["delete-generic-password", "-a", "hmac", "-s", "dev.nodii.cli"]);
     } catch {}
   }
-  await Promise.all([
-    rm(configPath(), { force: true }),
-    rm(secretPath(), { force: true }),
-  ]);
+  await rm(legacySecretPath(), { force: true });
 }
 
-export async function secretFromAws() {
-  const raw = await run("aws", [
-    "secretsmanager",
-    "get-secret-value",
-    "--secret-id",
-    "nodii/dev/app/planning_hub",
-    "--region",
-    "ap-south-1",
-    "--query",
-    "SecretString",
-    "--output",
-    "text",
-  ]);
-  const value = JSON.parse(raw);
-  if (!value.PLANNING_HUB_HMAC_SECRET)
-    throw new CliError(
-      "AWS_SECRET_KEY_MISSING",
-      "The AWS secret does not contain PLANNING_HUB_HMAC_SECRET.",
-    );
-  return value.PLANNING_HUB_HMAC_SECRET;
+export async function deleteCredentials() {
+  await Promise.all([deleteLegacySecret(), rm(configPath(), { force: true })]);
 }
 
 export class CliError extends Error {
@@ -195,64 +86,43 @@ export class CliError extends Error {
 }
 
 /** @typedef {{headers(input: {method:string, path:string, body:string}): Promise<Record<string,string>>}} AuthProvider */
-/** HMAC v1 provider. A nodii-auth OAuth provider can implement the same boundary. */
-export class HmacAuthProvider {
-  async headers({ method, path, body }) {
-    const config = await readConfig();
-    return signRequest({
-      secret: await loadSecret(),
-      agentId: config.agentId,
-      method,
-      path,
-      body,
-    });
-  }
-}
-
 let oauthAuthProvider;
-export async function authProvider(config) {
-  config ??= await readConfig();
-  if (config.authProvider === "oauth") {
+export async function authProvider() {
+  if (!oauthAuthProvider) {
     const { OAuthAuthProvider } = await import("./oauth.js");
-    oauthAuthProvider ??= new OAuthAuthProvider();
-    return oauthAuthProvider;
+    oauthAuthProvider = new OAuthAuthProvider();
   }
-  return new HmacAuthProvider();
+  return oauthAuthProvider;
+}
+/** Replace the process-wide OAuth provider (tests inject one with fake token storage). */
+export function setAuthProvider(provider) {
+  oauthAuthProvider = provider;
 }
 
+/** Every Dev call goes to the platform edge's /devops prefix; there is no other host. */
 export function requestUrl(config, path) {
-  if (config.authProvider === "oauth")
-    return `${config.edgeUrl.replace(/\/$/, "")}/devops${path}`;
-  return `${config.hubUrl.replace(/\/$/, "")}${path}`;
+  if (!path.startsWith("/")) throw new CliError("USAGE", `Dev paths start with /: ${path}`, 2);
+  return `${config.edgeUrl.replace(/\/$/, "")}/devops${path}`;
 }
 
-export async function hubRequest(
-  method,
-  path,
-  body,
-  { auth } = {},
-) {
+async function devFetch(method, path, bodyText, contentType, accept) {
   const config = await readConfig();
-  auth ??= await authProvider(config);
-  const text = body === undefined ? "" : JSON.stringify(body);
-  const headers = { accept: "application/json" };
-  if (body !== undefined) headers["content-type"] = "application/json";
-  if (config.authProvider === "oauth" || !["GET", "HEAD", "OPTIONS"].includes(method))
-    Object.assign(headers, await auth.headers({ method, path, body: text }));
+  const auth = await authProvider();
+  const headers = { accept };
+  if (bodyText !== undefined) headers["content-type"] = contentType;
+  Object.assign(headers, await auth.headers({ method, path, body: bodyText ?? "" }));
+  const url = requestUrl(config, path);
   let response;
   try {
-    response = await fetch(requestUrl(config, path), {
-      method,
-      headers,
-      body: body === undefined ? undefined : text,
-    });
+    response = await fetch(url, { method, headers, body: bodyText });
   } catch (error) {
-    throw new CliError(
-      "HUB_UNREACHABLE",
-      `Cannot reach the hub: ${error.message}`,
-    );
+    throw new CliError("DEV_UNREACHABLE", `Cannot reach Dev at ${new URL(url).origin}: ${error.message}`);
   }
-  const raw = await response.text();
+  return { response, raw: await response.text() };
+}
+
+export async function devRawRequest(method, path, bodyText, contentType = "application/json") {
+  const { response, raw } = await devFetch(method, path, bodyText, contentType, "application/json");
   let payload;
   try {
     payload = raw ? JSON.parse(raw) : {};
@@ -262,39 +132,37 @@ export async function hubRequest(
   if (!response.ok)
     throw new CliError(
       payload.code ?? `HTTP_${response.status}`,
-      payload.message ?? `Hub returned HTTP ${response.status}`,
+      payload.message ?? `Dev returned HTTP ${response.status}`,
       1,
       payload.details,
     );
   return payload;
 }
 
-export async function hubRawRequest(method, path, bodyText, contentType = "application/json") {
+/** A Dev route that answers with text (e.g. a document body as text/markdown). Errors are Dev's JSON. */
+export async function devTextRequest(method, path) {
+  const { response, raw } = await devFetch(method, path, undefined, undefined, "text/markdown, text/plain, application/json");
+  if (response.ok) return raw;
+  let payload = {};
+  try { payload = JSON.parse(raw); } catch { payload = { message: raw }; }
+  throw new CliError(payload.code ?? `HTTP_${response.status}`, payload.message ?? `Dev returned HTTP ${response.status}`, 1, payload.details);
+}
+
+export const devRequest = (method, path, body) =>
+  devRawRequest(method, path, body === undefined ? undefined : JSON.stringify(body));
+
+/** Proves the stored OAuth login works: a token refresh, then the agent read once registered. */
+export async function checkLogin() {
   const config = await readConfig();
-  const auth = await authProvider(config);
-  const headers = { accept: "application/json" };
-  if (bodyText !== undefined) headers["content-type"] = contentType;
-  if (config.authProvider === "oauth" || !["GET", "HEAD", "OPTIONS"].includes(method))
-    Object.assign(headers, await auth.headers({ method, path, body: bodyText ?? "" }));
-  let response;
-  try {
-    response = await fetch(requestUrl(config, path), {
-      method,
-      headers,
-      body: bodyText === undefined ? undefined : bodyText,
-    });
-  } catch (error) {
-    throw new CliError("HUB_UNREACHABLE", `Cannot reach the hub: ${error.message}`);
-  }
-  const raw = await response.text();
-  let payload;
-  try { payload = raw ? JSON.parse(raw) : {}; } catch { payload = { message: raw }; }
-  if (!response.ok)
-    throw new CliError(payload.code ?? `HTTP_${response.status}`, payload.message ?? `Hub returned HTTP ${response.status}`, 1, payload.details);
-  return payload;
+  await (await authProvider()).headers({ method: "GET", path: "/", body: "" });
+  if (config.agentId) await devRequest("GET", `/api/v1/agents/${encode(config.agentId)}`);
+  return config;
 }
 
 export const encode = (value) => encodeURIComponent(value);
+// Switches never take the next token as their value, so
+// `docs upload --wait rulebook/` keeps rulebook/ as a path.
+const SWITCHES = new Set(["json", "wait", "dry-run", "check", "all", "fleet", "help", "yes", "mine", "no-browser", "include-drafts"]);
 export function parseArgs(argv) {
   const flags = {};
   const args = [];
@@ -304,11 +172,13 @@ export function parseArgs(argv) {
       args.push(token);
       continue;
     }
-    const [key, inline] = token.slice(2).split("=", 2);
+    const at = token.indexOf("=");
+    const key = at === -1 ? token.slice(2) : token.slice(2, at);
+    const inline = at === -1 ? undefined : token.slice(at + 1);
     const value =
       inline !== undefined
         ? inline
-        : argv[i + 1] && !argv[i + 1].startsWith("--")
+        : !SWITCHES.has(key) && argv[i + 1] && !argv[i + 1].startsWith("--")
           ? argv[++i]
           : true;
     flags[key] =