@ornncompute/cli 0.2.24 → 1.0.25

package/src/connect-mode-handlers.mjs

@@ -0,0 +1,170 @@
+/**
+ * Continue the shared `connect` journey after ticket 10 has proved private
+ * network and VPN readiness. Access-mode modules add ordered handlers with:
+ *
+ *   { mode, matches(state), connect(state) }
+ *
+ * `connect` returns interaction-runtime result options (`data`, `outcome`, and
+ * optional `presentation`), not a rendered envelope. A handler must match from
+ * authoritative server facts; target spelling is never a mode selector.
+ */
+
+function resolverErrorPriority(error) {
+  if (Number(error?.exitCode) === 2) return 2;
+  const status = Number(error?.status);
+  const code = typeof error?.code === "string" ? error.code.toLowerCase() : "";
+  if (status === 404 || /(?:not_found|not_supported|unsupported|mode_unavailable)$/.test(code)) {
+    return 0;
+  }
+  return 1;
+}
+async function validateConnectModeInput(state, handler, resolved) {
+  const input = state.input ?? {};
+  const mode = resolved?.mode ?? handler.mode;
+  if (mode === "vm" || mode === "bare-metal" || mode === "slurm") {
+    if (input.output || input.overwrite) {
+      state.interaction.usage(
+        `${mode === "slurm" ? "Slurm" : mode === "vm" ? "VM" : "Bare Metal"} connect uses native SSH and does not write a kubeconfig or other output file.`,
+        {
+          code: mode === "slurm" ? "slurm_output_unsupported" : "direct_machine_output_unsupported",
+          field: input.output ? "output" : "overwrite",
+        }
+      );
+    }
+    return;
+  }
+  if (mode !== "kubernetes") return;
+  if (input.identityFile || input.user) {
+    state.interaction.usage(
+      "Kubernetes connect writes a kubeconfig and does not accept SSH identity or user options.",
+      {
+        code: "kubernetes_ssh_options_unsupported",
+        field: input.identityFile ? "identityFile" : "user",
+      }
+    );
+  }
+  if (input.print === true) {
+    state.interaction.usage(
+      "Kubernetes connect writes only to an explicit --output path; ordinary output never contains credential bytes.",
+      {
+        code: "kubeconfig_output_required",
+        field: "output",
+      }
+    );
+  }
+  if (
+    !input.output &&
+    input.guided === true &&
+    state.interaction?.eligibleHuman === true &&
+    state.interaction?.machine !== true
+  ) {
+    input.output = await state.interaction.ask({ label: "Kubeconfig output path" });
+  }
+  if (!input.output) {
+    state.interaction.usage("Kubernetes connect requires --output <path>.", {
+      code: "kubeconfig_output_required",
+      field: "output",
+    });
+  }
+}
+
+export async function resolveConnectTargetWithHandlers(state, handlers = []) {
+  for (const handler of handlers) {
+    if (
+      !handler ||
+      typeof handler.matches !== "function" ||
+      typeof handler.connect !== "function"
+    ) {
+      throw new TypeError("Connect mode handlers require matches(state) and connect(state).");
+    }
+    if (handler.resolve !== undefined && typeof handler.resolve !== "function") {
+      throw new TypeError("A connect mode handler resolve member must be a function.");
+    }
+    if (handler.candidates !== undefined && typeof handler.candidates !== "function") {
+      throw new TypeError("A connect mode handler candidates member must be a function.");
+    }
+  }
+
+  if (
+    !state.reference &&
+    state.interaction?.eligibleHuman === true &&
+    state.interaction?.machine !== true
+  ) {
+    const candidates = [];
+    for (const handler of handlers) {
+      if (typeof handler.candidates !== "function") continue;
+      const available = await handler.candidates(state);
+      if (!Array.isArray(available)) {
+        throw new TypeError("A connect mode handler candidates member must return an array.");
+      }
+      for (const candidate of available) {
+        if (
+          !candidate ||
+          typeof candidate.label !== "string" ||
+          typeof candidate.reference !== "string"
+        ) {
+          throw new TypeError("Connect candidates require label and reference strings.");
+        }
+        candidates.push({ ...candidate, handler });
+      }
+    }
+    if (candidates.length > 0) {
+      let selected = candidates[0];
+      if (candidates.length > 1) {
+        const value = await state.interaction.ask({
+          label: "Compute target",
+          choices: candidates.map((candidate, index) => ({
+            label: candidate.label,
+            value: String(index),
+          })),
+        });
+        selected = candidates[Number(value)];
+        if (!selected) {
+          state.interaction.usage("Choose one exact compute target.", {
+            code: "connect_target_required",
+          });
+        }
+      }
+      const resolved = await selected.handler.resolve({
+        ...state,
+        reference: selected.reference,
+      });
+      if (resolved) await validateConnectModeInput(state, selected.handler, resolved);
+      return resolved;
+    }
+  }
+
+  let strongestError = null;
+  let strongestPriority = 0;
+  for (const handler of handlers) {
+    if (handler.resolve === undefined) continue;
+    try {
+      const resolved = await handler.resolve(state);
+      if (resolved) {
+        await validateConnectModeInput(state, handler, resolved);
+        return resolved;
+      }
+    } catch (error) {
+      const priority = resolverErrorPriority(error);
+      if (priority > strongestPriority) {
+        strongestError = error;
+        strongestPriority = priority;
+      }
+    }
+  }
+  if (strongestError) throw strongestError;
+  return null;
+}
+export async function continueConnectWithHandlers(state, handlers = []) {
+  for (const handler of handlers) {
+    if (
+      !handler ||
+      typeof handler.matches !== "function" ||
+      typeof handler.connect !== "function"
+    ) {
+      throw new TypeError("Connect mode handlers require matches(state) and connect(state).");
+    }
+    if (await handler.matches(state)) return handler.connect(state);
+  }
+  return null;
+}

package/src/device-auth.mjs

@@ -1,6 +1,7 @@
 import { spawn } from "node:child_process";
 
 import { configuredAuthBaseUrl } from "./auth-store.mjs";
+import { readUntilDeadline, waitForDelay } from "./wait-runtime.mjs";
 
 const DEFAULT_AUTH_BASE_URL = "http://localhost:3000";
 const DEFAULT_POLL_INTERVAL_SECONDS = 2;
@@ -27,18 +28,61 @@ export function resolveAuthBaseUrl({ explicit, env = process.env } = {}) {
   return value.replace(/\/+$/, "");
 }
 
-export async function openBrowser(url, { platform = process.platform, spawnImpl = spawn } = {}) {
-  const command =
-    platform === "darwin" ? "open" : platform === "win32" ? "cmd" : "xdg-open";
-  const args = platform === "win32" ? ["/c", "start", "", url] : [url];
+function browserUrl(value, expectedBaseUrl) {
+  if (
+    typeof value !== "string" ||
+    value !== value.trim() ||
+    /[\u0000-\u001f\u007f]|%(?:0[0-9a-f]|1[0-9a-f]|7f)/i.test(value)
+  ) {
+    throw new DeviceAuthError("Auth server returned an unsafe browser URL.");
+  }
+  let parsed;
+  try {
+    parsed = new URL(value);
+  } catch {
+    throw new DeviceAuthError("Auth server returned an invalid browser URL.");
+  }
+  if (
+    !["http:", "https:"].includes(parsed.protocol) ||
+    parsed.username ||
+    parsed.password ||
+    (expectedBaseUrl && parsed.origin !== new URL(expectedBaseUrl).origin)
+  ) {
+    throw new DeviceAuthError("Auth server returned an unexpected browser URL.");
+  }
+  return parsed.href;
+}
 
+export async function openBrowser(url, { platform = process.platform, spawnImpl = spawn } = {}) {
   try {
+    const target = browserUrl(url);
+    const command =
+      platform === "darwin" ? "open" : platform === "win32" ? "powershell.exe" : "xdg-open";
+    // The script is constant. The URL is environment data, never cmd.exe or
+    // PowerShell source, even when its query contains shell metacharacters.
+    const script = "Start-Process -FilePath $env:ORNN_BROWSER_URL";
+    const args =
+      platform === "win32"
+        ? [
+            "-NoProfile",
+            "-NonInteractive",
+            "-EncodedCommand",
+            Buffer.from(script, "utf16le").toString("base64"),
+          ]
+        : [target];
     const child = spawnImpl(command, args, {
       detached: true,
       stdio: "ignore",
+      shell: false,
+      ...(platform === "win32" ? { env: { ...process.env, ORNN_BROWSER_URL: target } } : {}),
+    });
+    return await new Promise((resolve) => {
+      child.once("error", () => resolve(false));
+      child.once("spawn", () => {
+        child.unref?.();
+        resolve(true);
+      });
     });
-    child.unref?.();
-    return true;
   } catch {
     return false;
   }
@@ -50,9 +94,14 @@ export async function startDeviceFlow({ apiBaseUrl, authBaseUrl, fetchImpl = fet
 
   const deviceCode = pickString(data, "deviceCode", "device_code");
   const userCode = pickString(data, "userCode", "user_code");
-  const verificationUri =
-    pickString(data, "verificationUriComplete", "verification_uri_complete") ||
-    pickString(data, "verificationUri", "verification_uri");
+  const verificationUri = [
+    "verificationUriComplete",
+    "verification_uri_complete",
+    "verificationUri",
+    "verification_uri",
+  ]
+    .map((key) => data?.[key])
+    .find((value) => typeof value === "string" && value.length > 0);
 
   if (!deviceCode || !userCode || !verificationUri) {
     throw new DeviceAuthError("Auth server returned an invalid device login response.", {
@@ -65,15 +114,24 @@ export async function startDeviceFlow({ apiBaseUrl, authBaseUrl, fetchImpl = fet
     expiresIn: pickNumber(data, "expiresIn", "expires_in") ?? DEFAULT_TIMEOUT_SECONDS,
     interval: pickNumber(data, "interval") ?? DEFAULT_POLL_INTERVAL_SECONDS,
     userCode,
-    verificationUri,
+    verificationUri: browserUrl(verificationUri, authBaseUrl || apiBaseUrl),
   };
 }
 
-export async function pollDeviceFlow({ apiBaseUrl, authBaseUrl, deviceCode, fetchImpl = fetch } = {}) {
+export async function pollDeviceFlow({
+  apiBaseUrl,
+  authBaseUrl,
+  deviceCode,
+  fetchImpl = fetch,
+  signal,
+} = {}) {
   const requestBaseUrl = apiBaseUrl || authBaseUrl;
-  return postJson(fetchImpl, `${requestBaseUrl}/v1/cli/device/poll`, {
-    device_code: deviceCode,
-  });
+  return postJson(
+    fetchImpl,
+    `${requestBaseUrl}/v1/cli/device/poll`,
+    { device_code: deviceCode },
+    { signal }
+  );
 }
 
 export async function waitForDeviceApproval({
@@ -83,60 +141,124 @@ export async function waitForDeviceApproval({
   expiresIn,
   fetchImpl = fetch,
   interval,
+  now = () => Date.now(),
   onPending,
+  signal: suppliedSignal,
+  sleepImpl,
   timeoutSeconds,
 } = {}) {
-  const pollIntervalMs = Math.max(1, Number(interval) || DEFAULT_POLL_INTERVAL_SECONDS) * 1000;
-  const timeoutMs =
-    Math.max(1, Number(timeoutSeconds) || Number(expiresIn) || DEFAULT_TIMEOUT_SECONDS) * 1000;
-  const deadline = Date.now() + timeoutMs;
-
-  while (Date.now() < deadline) {
-    await sleep(pollIntervalMs);
-    const data = await pollDeviceFlow({ apiBaseUrl, authBaseUrl, deviceCode, fetchImpl });
-    const status = pickString(data, "status") || "pending";
-
-    if (status === "pending") {
-      onPending?.();
-      continue;
-    }
+  const suppliedInterval = Number(interval);
+  const suppliedTimeout = Number(timeoutSeconds ?? expiresIn);
+  const pollIntervalMs = Math.max(
+    1,
+    (Number.isFinite(suppliedInterval) && suppliedInterval > 0
+      ? suppliedInterval
+      : DEFAULT_POLL_INTERVAL_SECONDS) * 1_000
+  );
+  const timeoutMs = Math.max(
+    1,
+    (Number.isFinite(suppliedTimeout) && suppliedTimeout > 0
+      ? suppliedTimeout
+      : DEFAULT_TIMEOUT_SECONDS) * 1_000
+  );
+  const startedAt = now();
+  let scheduledElapsedMs = 0;
+  const localController = suppliedSignal ? null : new AbortController();
+  const signal = suppliedSignal ?? localController.signal;
+  const onSigint = localController ? () => localController.abort() : null;
+  if (onSigint) process.once("SIGINT", onSigint);
+
+  const remainingTime = () =>
+    timeoutMs - Math.max(scheduledElapsedMs, Math.max(0, now() - startedAt));
+
+  try {
+    for (;;) {
+      const remainingBeforeSleep = remainingTime();
+      if (remainingBeforeSleep <= 0) {
+        throw new DeviceAuthError("Timed out waiting for browser login approval.");
+      }
+      const delay = Math.min(pollIntervalMs, remainingBeforeSleep);
+      const waited = await waitForDelay(delay, sleepImpl, signal);
+      if (waited === "interrupted" || signal.aborted) {
+        throw new DeviceAuthError("Browser login wait was interrupted.", {
+          detail: { code: "interrupted" },
+        });
+      }
+      scheduledElapsedMs += delay;
+      const remaining = remainingTime();
+      if (remaining <= 0) {
+        throw new DeviceAuthError("Timed out waiting for browser login approval.");
+      }
+      const polled = await readUntilDeadline(
+        ({ signal: requestSignal }) =>
+          pollDeviceFlow({
+            apiBaseUrl,
+            authBaseUrl,
+            deviceCode,
+            fetchImpl,
+            signal: requestSignal,
+          }),
+        { signal, timeoutMs: remaining }
+      );
+      if (polled.kind === "interrupted") {
+        throw new DeviceAuthError("Browser login wait was interrupted.", {
+          detail: { code: "interrupted" },
+        });
+      }
+      if (polled.kind === "timeout") {
+        throw new DeviceAuthError("Timed out waiting for browser login approval.");
+      }
+      const data = polled.value;
+      const status = pickString(data, "status") || "pending";
+
+      if (status === "pending") {
+        onPending?.();
+        continue;
+      }
+
+      if (status === "approved") {
+        const token = pickString(
+          data,
+          "accessToken",
+          "access_token",
+          "sessionToken",
+          "session_token"
+        );
+        const user = data.user && typeof data.user === "object" ? data.user : null;
 
-    if (status === "approved") {
-      const token = pickString(data, "accessToken", "access_token", "sessionToken", "session_token");
-      const user = data.user && typeof data.user === "object" ? data.user : null;
+        if (!token || !user?.email) {
+          throw new DeviceAuthError("Auth server approved login without a usable session.");
+        }
 
-      if (!token || !user?.email) {
-        throw new DeviceAuthError("Auth server approved login without a usable session.");
+        return {
+          accessToken: token,
+          apiBaseUrl: apiBaseUrl || authBaseUrl,
+          authBaseUrl,
+          tokenType: pickString(data, "tokenType", "token_type") || "bearer",
+          user: {
+            email: String(user.email),
+            id: user.id ? String(user.id) : null,
+            name: user.name ? String(user.name) : null,
+          },
+        };
       }
 
-      return {
-        accessToken: token,
-        apiBaseUrl: apiBaseUrl || authBaseUrl,
-        authBaseUrl,
-        tokenType: pickString(data, "tokenType", "token_type") || "bearer",
-        user: {
-          email: String(user.email),
-          id: user.id ? String(user.id) : null,
-          name: user.name ? String(user.name) : null,
-        },
-      };
-    }
+      if (status === "denied") {
+        throw new DeviceAuthError("Device login was denied in the browser.");
+      }
 
-    if (status === "denied") {
-      throw new DeviceAuthError("Device login was denied in the browser.");
-    }
+      if (status === "expired") {
+        throw new DeviceAuthError("Device login expired. Run `ornn login` again.");
+      }
 
-    if (status === "expired") {
-      throw new DeviceAuthError("Device login expired. Run `ornn login` again.");
+      throw new DeviceAuthError(`Auth server returned unexpected status: ${status}`);
     }
-
-    throw new DeviceAuthError(`Auth server returned unexpected status: ${status}`);
+  } finally {
+    if (onSigint) process.removeListener("SIGINT", onSigint);
   }
-
-  throw new DeviceAuthError("Timed out waiting for browser login approval.");
 }
 
-async function postJson(fetchImpl, url, body) {
+async function postJson(fetchImpl, url, body, { signal } = {}) {
   const response = await fetchImpl(url, {
     body: JSON.stringify(body),
     headers: {
@@ -144,6 +266,7 @@ async function postJson(fetchImpl, url, body) {
       "Content-Type": "application/json",
     },
     method: "POST",
+    ...(signal ? { signal } : {}),
   });
   const text = await response.text();
   const data = text ? parseJson(text, url) : {};
@@ -186,9 +309,3 @@ function pickNumber(value, ...keys) {
   }
   return null;
 }
-
-function sleep(ms) {
-  return new Promise((resolve) => {
-    setTimeout(resolve, ms);
-  });
-}