@notis_ai/cli 0.2.10 → 0.2.12

package/src/runtime/oauth.js

@@ -18,6 +18,7 @@ import { spawn } from 'node:child_process';
 import { createInterface } from 'node:readline/promises';
 
 import { CliError, EXIT_CODES } from './errors.js';
+import { getAuthRecovery, quoteShellArgument } from './auth-recovery.js';
 import {
   credentialIsExpired,
   ensureProfile,
@@ -42,14 +43,15 @@ const DEFAULT_REFRESH_EXPIRES_IN = 30 * 24 * 60 * 60;
 // still have to sign up, verify an email, and consent before pasting the code.
 const PENDING_LOGIN_TTL_SECONDS = 30 * 60;
 const OAUTH_HTTP_TIMEOUT_MS = 10_000;
+const RESPONSE_FLUSH_GRACE_MS = 2_000;
 
-function oauthError(code, message, details = {}) {
+function oauthError(code, message, hints = null, details = {}) {
   return new CliError({
     code,
     message,
     exitCode: EXIT_CODES.auth,
     details,
-    hints: [
+    hints: hints || [
       { command: 'notis login', reason: 'Start a new browser authorization' },
       { command: 'notis doctor', reason: 'Inspect the active credential state' },
     ],
@@ -82,6 +84,7 @@ async function fetchJson(url, init = {}, fetchImpl = fetch) {
       throw oauthError(
         payload.error || 'oauth_request_failed',
         payload.error_description || payload.message || `OAuth request failed with status ${response.status}`,
+        null,
         payload,
       );
     }
@@ -459,11 +462,22 @@ export async function createLoopbackReceiver({
   let rejectCode;
   let timeout;
   let pendingResponse = null;
+  // Browsers routinely park speculative connections that never send a request.
+  // `server.close()` waits for every socket it accepted, so the sockets have to
+  // be tracked and dropped by hand or a finished login would keep waiting.
+  const sockets = new Set();
+  let responseFlushed = Promise.resolve();
   const result = new Promise((resolve, reject) => {
     resolveCode = resolve;
     rejectCode = reject;
   });
 
+  const endResponse = (response, body) => {
+    responseFlushed = new Promise((resolve) => {
+      response.end(body, resolve);
+    });
+  };
+
   const server = createServer((request, response) => {
     const address = server.address();
     const expectedHost = address && typeof address === 'object'
@@ -476,18 +490,18 @@ export async function createLoopbackReceiver({
 
     if (request.headers.host !== expectedHost) {
       response.writeHead(400, { 'Content-Type': 'text/html; charset=utf-8' });
-      response.end(callbackHtml('Invalid callback', 'The callback host was not accepted.'));
+      endResponse(response, callbackHtml('Invalid callback', 'The callback host was not accepted.'));
       return;
     }
     const url = new URL(request.url || '/', `http://${expectedHost}`);
     if (request.method !== 'GET' || url.pathname !== '/callback') {
       response.writeHead(404, { 'Content-Type': 'text/html; charset=utf-8' });
-      response.end(callbackHtml('Not found', 'This callback path does not exist.'));
+      endResponse(response, callbackHtml('Not found', 'This callback path does not exist.'));
       return;
     }
     if (consumed) {
       response.writeHead(410, { 'Content-Type': 'text/html; charset=utf-8' });
-      response.end(callbackHtml('Already used', 'This authorization callback was already handled.'));
+      endResponse(response, callbackHtml('Already used', 'This authorization callback was already handled.'));
       return;
     }
     consumed = true;
@@ -497,14 +511,14 @@ export async function createLoopbackReceiver({
     const error = url.searchParams.get('error');
     if (!stateMatches(state, returnedState)) {
       response.writeHead(400, { 'Content-Type': 'text/html; charset=utf-8' });
-      response.end(callbackHtml('Authorization failed', 'The callback state did not match.'));
+      endResponse(response, callbackHtml('Authorization failed', 'The callback state did not match.'));
       rejectCode(oauthError('oauth_state_mismatch', 'The OAuth callback state did not match.'));
       return;
     }
     if (error || !code) {
       const description = url.searchParams.get('error_description') || 'Authorization was not completed.';
       response.writeHead(400, { 'Content-Type': 'text/html; charset=utf-8' });
-      response.end(callbackHtml('Authorization not completed', description));
+      endResponse(response, callbackHtml('Authorization not completed', description));
       rejectCode(oauthError(error || 'oauth_code_missing', description));
       return;
     }
@@ -515,6 +529,11 @@ export async function createLoopbackReceiver({
     resolveCode(code);
   });
 
+  server.on('connection', (socket) => {
+    sockets.add(socket);
+    socket.on('close', () => sockets.delete(socket));
+  });
+
   await new Promise((resolve, reject) => {
     server.once('error', reject);
     server.listen(0, '127.0.0.1', () => {
@@ -537,12 +556,24 @@ export async function createLoopbackReceiver({
     clearTimeout(timeout);
     if (pendingResponse && !pendingResponse.writableEnded) {
       pendingResponse.writeHead(500, { 'Content-Type': 'text/html; charset=utf-8' });
-      pendingResponse.end(callbackHtml(
+      endResponse(pendingResponse, callbackHtml(
         'Authorization did not finish',
         'Return to the terminal for details, then retry sign in.',
       ));
       pendingResponse = null;
     }
+    // The browser answer is already written; wait only for the kernel to take
+    // it so tearing the socket down cannot truncate the connected page.
+    await Promise.race([
+      responseFlushed,
+      new Promise((resolve) => { setTimeout(resolve, RESPONSE_FLUSH_GRACE_MS).unref?.(); }),
+    ]);
+    // Chrome parks a speculative connection next to the one that carried the
+    // callback. It never sends a request, so Node counts it as active and
+    // `server.close()` waits for a socket only the browser will ever release:
+    // a login that already succeeded would sit in the terminal for minutes.
+    for (const socket of sockets) socket.destroy();
+    sockets.clear();
     if (!server.listening) return;
     await new Promise((resolve) => server.close(resolve));
   };
@@ -561,13 +592,13 @@ export async function createLoopbackReceiver({
         'Content-Type': 'text/html; charset=utf-8',
         Location: connectedUrl.toString(),
       });
-      pendingResponse.end(connectedCallbackHtml({ portalOrigin }));
+      endResponse(pendingResponse, connectedCallbackHtml({ portalOrigin }));
       pendingResponse = null;
     },
     fail: () => {
       if (!pendingResponse || pendingResponse.writableEnded) return;
       pendingResponse.writeHead(400, { 'Content-Type': 'text/html; charset=utf-8' });
-      pendingResponse.end(callbackHtml(
+      endResponse(pendingResponse, callbackHtml(
         'Authorization failed',
         'The CLI could not finish signing in. Return to the terminal for details.',
       ));
@@ -682,13 +713,11 @@ function persistOAuthTokenResponse(runtime, metadata, tokenResponse) {
     const profile = next.profiles[runtime.profileName];
     next.profiles[runtime.profileName] = {
       ...profile,
-      // Keep Desktop's api_base intact when an independent OAuth grant refreshes.
-      // Only seed api_base from OAuth when the profile has no live API yet.
-      api_base:
-        profile.api_base && !/^https?:\/\/(localhost|127\.0\.0\.1|::1)(:|\/|$)/i.test(profile.api_base)
-          ? profile.api_base
-          : (oauthApiBase || profile.api_base),
-      beta: typeof profile.beta === 'boolean' ? profile.beta : beta,
+      // The grant defines this profile's endpoint. A profile is one account on
+      // one API, and the environment the user just authorized against is the
+      // only endpoint the resulting token is accepted by.
+      api_base: oauthApiBase || profile.api_base,
+      beta: beta ?? profile.beta,
       oauth_api_base: oauthApiBase || profile.oauth_api_base,
       oauth_resource: metadata.resource,
       oauth_access_token: tokenResponse.access_token,
@@ -702,7 +731,7 @@ function persistOAuthTokenResponse(runtime, metadata, tokenResponse) {
       oauth_user_id: payload.sub || payload.notis_user_id,
     };
     return next;
-  }, runtime.worktreeRuntime);
+  });
   return config.profiles[runtime.profileName];
 }
 
@@ -711,11 +740,11 @@ function pendingAuthorizationFile(runtime) {
     .update(String(runtime.profileName || 'default'))
     .digest('hex')
     .slice(0, 16);
-  return `${resolveConfigFile(runtime)}.pending-login.${profileKey}`;
+  return `${resolveConfigFile()}.pending-login.${profileKey}`;
 }
 
 function legacyPendingAuthorizationFile(runtime) {
-  return `${resolveConfigFile(runtime)}.pending-login`;
+  return `${resolveConfigFile()}.pending-login`;
 }
 
 // The PKCE verifier outlives the process that created it whenever the browser
@@ -755,10 +784,6 @@ function clearPendingAuthorization(runtime, file = pendingAuthorizationFile(runt
   }
 }
 
-function quoteShellArgument(value) {
-  return `'${String(value).replace(/'/g, `'"'"'`)}'`;
-}
-
 function redeemCommand(profileName) {
   return [
     'npx --package @notis_ai/cli@latest -- notis',
@@ -803,7 +828,7 @@ export async function ensureFreshOAuthCredential(runtime, fetchImpl = fetch) {
     return Boolean(runtime.jwt);
   }
 
-  const profile = getProfile(loadConfig(runtime.worktreeRuntime), runtime.profileName);
+  const profile = getProfile(loadConfig(), runtime.profileName);
   assertOAuthApiTarget(runtime, profile);
   if (!credentialIsExpired({ credentialKind: 'oauth' }, profile)) {
     updateRuntimeFromOAuthProfile(runtime, profile);
@@ -869,20 +894,29 @@ async function redeemAuthorizationCode(runtime, code, fetchImpl) {
 }
 
 export async function loginWithOAuth(runtime, options = {}, output, fetchImpl = fetch) {
+  // A worktree profile is authenticated by the running `./dev.sh`, not by a
+  // browser grant. Authorizing over it would replace a scoped test identity
+  // with a real account and quietly point local testing at the wrong user.
+  // Check before both starting and redeeming authorization: a copy-paste flow
+  // may have started before the worktree lease claimed this profile.
+  if (runtime.credentialKind === 'worktree') {
+    throw oauthError(
+      'oauth_profile_is_dev_managed',
+      `Profile "${runtime.profileName}" is managed by ./dev.sh and cannot be authorized in a browser.`,
+      [
+        {
+          command: `notis login --profile ${quoteShellArgument(runtime.profileName === 'default' ? 'personal' : 'default')}`,
+          reason: 'Authorize a real account under a different profile name',
+        },
+        { command: 'notis profile list', reason: 'See the profiles this machine already has' },
+      ],
+    );
+  }
   if (options.code) {
     return redeemAuthorizationCode(runtime, String(options.code).trim(), fetchImpl);
   }
-  if (
-    !options.force
-    && ['desktop', 'worktree'].includes(runtime.credentialKind)
-    && !credentialIsExpired(runtime, getProfile(runtime.config, runtime.profileName))
-  ) {
-    return { desktopFastPath: true, credentialSource: runtime.credentialKind };
-  }
 
   const metadata = await discoverCliOAuth(runtime.apiBase, fetchImpl);
-  const { verifier, challenge } = createPkce();
-  const state = base64url(randomBytes(32));
   const scopes = options.scope?.length
     ? [...new Set(options.scope)]
     : DEFAULT_CLI_OAUTH_SCOPES;
@@ -898,6 +932,44 @@ export async function loginWithOAuth(runtime, options = {}, output, fetchImpl =
   let receiver;
   let redirectUri;
 
+  if (pasteCode) {
+    const pending = readPendingAuthorization(runtime);
+    const pendingScopes = Array.isArray(pending?.scopes) && pending.scopes.length > 0
+      ? pending.scopes
+      : DEFAULT_CLI_OAUTH_SCOPES;
+    const sameAuthorization = Boolean(
+      pending
+      && pending.state
+      && pending.api_base === runtime.apiBase
+      && pending.issuer === metadata.issuer
+      && pending.resource === metadata.resource
+      && pending.client_id === metadata.clientId
+      && pending.token_endpoint === metadata.tokenEndpoint
+      && pending.redirect_uri === metadata.copyPasteRedirectUri
+      && JSON.stringify(pendingScopes) === JSON.stringify(scopes),
+    );
+    if (sameAuthorization) {
+      const challenge = createHash('sha256')
+        .update(pending.verifier, 'ascii')
+        .digest('base64url');
+      return {
+        agentAuthorization: {
+          authorize_url: buildAuthorizeUrl(metadata, {
+            redirectUri: pending.redirect_uri,
+            challenge,
+            state: pending.state,
+            scopes: pendingScopes,
+          }),
+          expires_in: Math.max(0, Number(pending.expires_at) - Math.floor(Date.now() / 1000)),
+          redeem_command: redeemCommand(runtime.profileName),
+        },
+      };
+    }
+  }
+
+  const { verifier, challenge } = createPkce();
+  const state = base64url(randomBytes(32));
+
   if (pasteCode) {
     redirectUri = metadata.copyPasteRedirectUri;
     if (!redirectUri) {
@@ -937,6 +1009,8 @@ export async function loginWithOAuth(runtime, options = {}, output, fetchImpl =
       resource: metadata.resource,
       client_id: metadata.clientId,
       token_endpoint: metadata.tokenEndpoint,
+      authorization_endpoint: metadata.authorizationEndpoint,
+      scopes,
       expires_at: Math.floor(Date.now() / 1000) + PENDING_LOGIN_TTL_SECONDS,
     });
   }
@@ -995,7 +1069,7 @@ async function acquireRefreshLock(runtime, waitMs = 60_000) {
       return true;
     } catch (error) {
       if (error?.code !== 'EEXIST') throw error;
-      const profile = getProfile(loadConfig(runtime.worktreeRuntime), runtime.profileName);
+      const profile = getProfile(loadConfig(), runtime.profileName);
       if (
         profile.oauth_access_token
         && profile.oauth_access_token !== runtime.oauthAccessToken
@@ -1021,10 +1095,11 @@ async function acquireRefreshLock(runtime, waitMs = 60_000) {
 }
 
 export async function refreshOAuthCredential(runtime, fetchImpl = fetch) {
-  const ownsLock = await acquireRefreshLock(runtime);
-  if (!ownsLock) return true;
+  let ownsLock = false;
   try {
-    const config = loadConfig(runtime.worktreeRuntime);
+    ownsLock = await acquireRefreshLock(runtime);
+    if (!ownsLock) return true;
+    const config = loadConfig();
     const profile = getProfile(config, runtime.profileName);
     assertOAuthApiTarget(runtime, profile);
     if (
@@ -1057,17 +1132,46 @@ export async function refreshOAuthCredential(runtime, fetchImpl = fetch) {
     const updated = persistOAuthTokenResponse(runtime, metadata, response);
     updateRuntimeFromOAuthProfile(runtime, updated);
     return true;
+  } catch (error) {
+    if (error instanceof CliError) {
+      throw new CliError({
+        code: error.code,
+        message: error.message,
+        exitCode: error.exitCode,
+        retryable: error.retryable,
+        details: error.details,
+        hints: getAuthRecovery(runtime).hints,
+        warnings: error.warnings,
+        cause: error,
+      });
+    }
+    throw error;
   } finally {
-    try {
-      rmdirSync(OAUTH_LOCK_DIR);
-    } catch {
-      // A process exit or external cleanup may already have removed the lock.
+    if (ownsLock) {
+      try {
+        rmdirSync(OAUTH_LOCK_DIR);
+      } catch {
+        // A process exit or external cleanup may already have removed the lock.
+      }
     }
   }
 }
 
 export async function logoutOAuth(runtime, { allProfiles = false } = {}, fetchImpl = fetch) {
-  const config = loadConfig(runtime.worktreeRuntime);
+  if (runtime.credentialKind === 'worktree' && !allProfiles) {
+    throw oauthError(
+      'oauth_profile_is_dev_managed',
+      `Profile "${runtime.profileName}" is managed by ./dev.sh and has no OAuth grant to remove.`,
+      [
+        {
+          command: 'notis logout --profile <name>',
+          reason: 'Name a stored OAuth profile to disconnect it',
+        },
+        { command: 'notis profile list', reason: 'See the stored account profiles on this machine' },
+      ],
+    );
+  }
+  const config = loadConfig();
   const profileNames = allProfiles
     ? Object.keys(config.profiles)
     : [runtime.profileName];
@@ -1116,6 +1220,6 @@ export async function logoutOAuth(runtime, { allProfiles = false } = {}, fetchIm
       };
     }
     return latest;
-  }, runtime.worktreeRuntime);
+  });
   return { profiles: profileNames };
 }