@openma/cli 0.1.0-beta.0 → 0.1.0-beta.2

package/dist/index.js

@@ -3,16 +3,76 @@
 // src/index.ts
 import { createServer } from "node:http";
 import { execSync } from "node:child_process";
+import { homedir, hostname } from "node:os";
+import { join, dirname } from "node:path";
+import { mkdirSync, readFileSync, writeFileSync, unlinkSync, existsSync, chmodSync } from "node:fs";
+import { randomBytes } from "node:crypto";
+function credentialsPath() {
+  const xdg = process.env.XDG_CONFIG_HOME;
+  const base = xdg && xdg.length > 0 ? xdg : join(homedir(), ".config");
+  return join(base, "oma", "credentials.json");
+}
+function readCredentials() {
+  const path = credentialsPath();
+  try {
+    if (!existsSync(path)) return null;
+    const raw = readFileSync(path, "utf8");
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+function writeCredentials(creds) {
+  const path = credentialsPath();
+  mkdirSync(dirname(path), { recursive: true, mode: 448 });
+  writeFileSync(path, JSON.stringify(creds, null, 2), { mode: 384 });
+  try {
+    chmodSync(path, 384);
+  } catch {
+  }
+}
+function clearCredentials() {
+  const path = credentialsPath();
+  if (!existsSync(path)) return false;
+  unlinkSync(path);
+  return true;
+}
 function loadConfig() {
-  const baseUrl = process.env.OMA_BASE_URL || "http://localhost:8787";
-  const apiKey = process.env.OMA_API_KEY || "";
-  if (!apiKey) {
-    console.error("Error: OMA_API_KEY environment variable is required");
-    console.error("  export OMA_API_KEY=your-api-key");
-    console.error("\n  Generate one at: " + baseUrl + " \u2192 API Keys");
-    process.exit(1);
+  const envBase = process.env.OMA_BASE_URL;
+  const envKey = process.env.OMA_API_KEY;
+  const stored = readCredentials();
+  if (envKey) {
+    return {
+      baseUrl: envBase || stored?.base_url || "https://openma.dev",
+      apiKey: envKey,
+      json: false,
+      source: "env"
+    };
+  }
+  if (stored) {
+    return {
+      baseUrl: envBase || stored.base_url,
+      apiKey: stored.token,
+      json: false,
+      source: "stored"
+    };
   }
-  return { baseUrl, apiKey, json: false };
+  console.error("Error: not authenticated.");
+  console.error("  Run: oma auth login");
+  console.error("  Or:  export OMA_API_KEY=<your-key>  (mint at /api-keys page)");
+  process.exit(1);
+}
+function loadConfigOptional() {
+  const envBase = process.env.OMA_BASE_URL;
+  const envKey = process.env.OMA_API_KEY;
+  const stored = readCredentials();
+  if (envKey) {
+    return { baseUrl: envBase || stored?.base_url || "https://openma.dev", apiKey: envKey, json: false, source: "env" };
+  }
+  if (stored) {
+    return { baseUrl: envBase || stored.base_url, apiKey: stored.token, json: false, source: "stored" };
+  }
+  return { baseUrl: envBase || "https://openma.dev", apiKey: "", json: false, source: "missing" };
 }
 async function apiFetch(config, path, init) {
   const url = `${config.baseUrl}${path}`;
@@ -62,7 +122,201 @@ function isPubliclyReachable(url) {
     return true;
   }
 }
+async function authLogin(baseUrl, requestedTenant) {
+  const state = randomBytes(16).toString("hex");
+  const port = 19500 + Math.floor(Math.random() * 500);
+  const callback = `http://127.0.0.1:${port}/callback`;
+  const params = new URLSearchParams({
+    callback,
+    state,
+    hostname: hostname()
+  });
+  if (requestedTenant) params.set("tenant", requestedTenant);
+  const loginUrl = `${baseUrl}/cli/login?${params.toString()}`;
+  const result = await new Promise((resolve, reject) => {
+    const timeout = setTimeout(() => {
+      server.close();
+      reject(new Error("Timed out after 5 minutes waiting for browser approval."));
+    }, 5 * 6e4);
+    const server = createServer((req, res) => {
+      try {
+        const u = new URL(req.url || "/", `http://127.0.0.1:${port}`);
+        if (u.pathname !== "/callback") {
+          res.writeHead(404).end();
+          return;
+        }
+        const got = u.searchParams;
+        if (got.get("error")) {
+          const err = String(got.get("error"));
+          res.writeHead(400, { "Content-Type": "text/html" }).end(approvalPage("Cancelled", `Login was cancelled: ${err}. You can close this tab.`));
+          clearTimeout(timeout);
+          server.close();
+          reject(new Error(`Login cancelled: ${err}`));
+          return;
+        }
+        if (got.get("state") !== state) {
+          res.writeHead(400, { "Content-Type": "text/html" }).end(approvalPage("State mismatch", "The login response didn't match what this CLI session expected. Please try again."));
+          clearTimeout(timeout);
+          server.close();
+          reject(new Error("State mismatch \u2014 refusing the callback"));
+          return;
+        }
+        const token = got.get("token");
+        const tenant = got.get("tenant");
+        const user = got.get("user");
+        const key_id = got.get("key_id");
+        if (!token || !tenant || !user || !key_id) {
+          res.writeHead(400, { "Content-Type": "text/html" }).end(approvalPage("Incomplete callback", "The browser handoff is missing required fields."));
+          clearTimeout(timeout);
+          server.close();
+          reject(new Error("Callback missing required fields"));
+          return;
+        }
+        res.writeHead(200, { "Content-Type": "text/html" }).end(approvalPage("Signed in", "You can close this tab and return to your terminal."));
+        clearTimeout(timeout);
+        server.close();
+        resolve({ token, tenant, user, key_id });
+      } catch (err) {
+        res.writeHead(500).end();
+        clearTimeout(timeout);
+        server.close();
+        reject(err);
+      }
+    });
+    server.listen(port, "127.0.0.1");
+    console.log(`Opening browser to authorize CLI\u2026`);
+    console.log(`  ${loginUrl}
+`);
+    console.log(`(If the browser doesn't open, copy the URL above into one manually.)`);
+    openBrowser(loginUrl);
+  });
+  const tempConfig = { baseUrl, apiKey: result.token, json: false, source: "stored" };
+  const me = await apiFetch(tempConfig, "/v1/me");
+  writeCredentials({
+    version: 1,
+    base_url: baseUrl,
+    user: me.user ?? { id: result.user, email: "", name: null },
+    tenant: me.tenant,
+    tenants: me.tenants,
+    token: result.token,
+    key_id: result.key_id,
+    created_at: (/* @__PURE__ */ new Date()).toISOString()
+  });
+  console.log(`\u2713 Signed in as ${me.user?.email ?? me.user?.id}`);
+  console.log(`  Tenant : ${me.tenant.name || me.tenant.id} (${me.tenant.id})`);
+  console.log(`  Stored : ${credentialsPath()}`);
+  if (me.tenants.length > 1) {
+    console.log(`  ${me.tenants.length} tenants available \u2014 switch with: oma auth tenant use <id>`);
+  }
+}
+function openBrowser(url) {
+  try {
+    const p = process.platform;
+    if (p === "darwin") execSync(`open "${url}"`);
+    else if (p === "linux") execSync(`xdg-open "${url}"`);
+    else if (p === "win32") execSync(`start "" "${url}"`);
+  } catch {
+  }
+}
+function approvalPage(title, body) {
+  return `<!DOCTYPE html><html><head><meta charset="utf-8"><title>oma \u2014 ${title}</title><style>
+body{font-family:-apple-system,system-ui,sans-serif;max-width:480px;margin:80px auto;padding:0 24px;color:#222}
+h1{font-size:20px;margin-bottom:12px} p{color:#555;line-height:1.5}
+.card{border:1px solid #e5e5e5;border-radius:12px;padding:32px;background:#fff;box-shadow:0 1px 3px rgba(0,0,0,0.04)}
+</style></head><body><div class="card"><h1>${title}</h1><p>${body}</p></div></body></html>`;
+}
 var commands = [
+  // Auth
+  {
+    group: "Auth",
+    match: ["auth", "login"],
+    usage: "oma auth login [--base-url <url>]",
+    desc: "Open browser to authenticate; stores ~/.config/oma/credentials.json",
+    http: "POST   /v1/me/cli-tokens (browser handoff via /cli/login)",
+    async run(_config, args) {
+      const baseUrl = (flag(args, "--base-url") ?? process.env.OMA_BASE_URL ?? "https://openma.dev").replace(/\/+$/, "");
+      await authLogin(baseUrl);
+    }
+  },
+  {
+    group: "Auth",
+    match: ["auth", "logout"],
+    usage: "oma auth logout",
+    desc: "Delete stored credentials (does not revoke the token; use `oma keys revoke <id>` for that)",
+    http: "(local file delete)",
+    async run() {
+      const removed = clearCredentials();
+      console.log(removed ? `Cleared ${credentialsPath()}` : "No stored credentials.");
+    }
+  },
+  {
+    group: "Auth",
+    match: ["whoami"],
+    usage: "oma whoami",
+    desc: "Show current user, tenant, and base URL",
+    http: "GET    /v1/me",
+    async run(config) {
+      try {
+        const me = await apiFetch(config, "/v1/me");
+        if (config.json) {
+          console.log(JSON.stringify({ ...me, base_url: config.baseUrl, source: config.source }, null, 2));
+          return;
+        }
+        console.log(`Base URL : ${config.baseUrl}`);
+        console.log(`Source   : ${config.source === "env" ? "OMA_API_KEY env var" : "stored credentials"}`);
+        console.log(`User     : ${me.user?.email ?? me.user?.id ?? "(unknown \u2014 legacy key without user_id)"}`);
+        console.log(`Tenant   : ${me.tenant.name || me.tenant.id} (${me.tenant.id})`);
+        if (me.tenants.length > 1) {
+          console.log(`Available: ${me.tenants.map((t) => t.id).join(", ")}`);
+        }
+      } catch (err) {
+        console.error(`whoami failed: ${err.message}`);
+        if (config.source === "stored") {
+          console.error("Stored token may have been revoked. Try: oma auth login");
+        }
+        process.exit(1);
+      }
+    }
+  },
+  {
+    group: "Auth",
+    match: ["auth", "tenant", "ls"],
+    usage: "oma auth tenant ls",
+    desc: "List tenants the current user belongs to",
+    http: "GET    /v1/me/tenants",
+    async run(config) {
+      const { data } = await apiFetch(config, "/v1/me/tenants");
+      if (!data.length) {
+        console.log("No tenants on this account.");
+        return;
+      }
+      const stored = readCredentials();
+      const current = stored?.tenant.id;
+      table([["", "ID", "NAME", "ROLE"], ...data.map((t) => [t.id === current ? "*" : " ", t.id, t.name || "\u2014", t.role])]);
+    }
+  },
+  {
+    group: "Auth",
+    match: ["auth", "tenant", "use"],
+    needsArg: true,
+    usage: "oma auth tenant use <tenant-id>",
+    desc: "Switch active tenant (mints a new CLI token for that tenant)",
+    http: "POST   /v1/me/cli-tokens {tenant_id}",
+    async run(config, args) {
+      const tenantId = args[0];
+      if (!tenantId) {
+        console.error("Usage: oma auth tenant use <tenant-id>");
+        process.exit(1);
+      }
+      const stored = readCredentials();
+      if (!stored) {
+        console.error("No stored credentials. Run: oma auth login");
+        process.exit(1);
+      }
+      console.log(`Switching to tenant ${tenantId} \u2014 opening browser to confirm\u2026`);
+      await authLogin(stored.base_url, tenantId);
+    }
+  },
   // Agents
   {
     group: "Agents",
@@ -1413,8 +1667,12 @@ Usage:`);
     oma api <resource>                         Show endpoints for a resource
 
 Environment:
-  OMA_BASE_URL   API base (default: http://localhost:8787)
-  OMA_API_KEY    API key (required)
+  OMA_BASE_URL   API base (default: https://openma.dev)
+  OMA_API_KEY    API key \u2014 overrides stored credentials when set
+  XDG_CONFIG_HOME  Base dir for credentials (default: ~/.config)
+
+Stored credentials live at ~/.config/oma/credentials.json (created by
+'oma auth login', mode 0600). Delete with 'oma auth logout'.
 `);
 }
 async function main() {
@@ -1429,7 +1687,8 @@ async function main() {
   }
   const wantJson = args.includes("--json");
   args = args.filter((a) => a !== "--json");
-  const config = loadConfig();
+  const isPreAuth = args[0] === "auth" && (args[1] === "login" || args[1] === "logout");
+  const config = isPreAuth ? loadConfigOptional() : loadConfig();
   config.json = wantJson;
   let needsArgMatch = null;
   for (const c of commands) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openma/cli",
-  "version": "0.1.0-beta.0",
+  "version": "0.1.0-beta.2",
   "description": "CLI for the openma managed agents platform",
   "type": "module",
   "bin": {