@ornncompute/cli 0.2.24 → 1.0.34

package/src/session-commands.mjs

@@ -0,0 +1,565 @@
+import { createInterface } from "node:readline/promises";
+
+import { CliApiError, cliRequest, resolveApiBaseUrl } from "./api-client.mjs";
+import {
+  bindAuthUser,
+  clearAuthSession,
+  getAuthConfigPath,
+  loadAuthSession,
+  saveAuthSession,
+  saveOrganizationHint,
+} from "./auth-store.mjs";
+import {
+  DeviceAuthError,
+  openBrowser,
+  resolveAuthBaseUrl,
+  startDeviceFlow,
+  waitForDeviceApproval,
+} from "./device-auth.mjs";
+
+const CANONICAL_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+
+export class SessionCommandError extends Error {
+  constructor(
+    message,
+    {
+      action = null,
+      code = "session_command_failed",
+      exitCode = 1,
+      outcomeClass = "failed",
+      retryable = false,
+    } = {}
+  ) {
+    super(message);
+    this.name = "SessionCommandError";
+    this.action = action;
+    this.code = code;
+    this.exitCode = exitCode;
+    this.outcomeClass = outcomeClass;
+    this.retryable = retryable;
+  }
+}
+
+function usage(message) {
+  throw new SessionCommandError(message, { code: "usage_error", exitCode: 2 });
+}
+
+function parseOptions(argv, { booleans = [], values = [], usageText }) {
+  const booleanNames = new Set(booleans);
+  const valueNames = new Set(values);
+  const parsed = {};
+  for (let index = 0; index < argv.length; index += 1) {
+    const argument = argv[index];
+    if (!argument.startsWith("--")) usage(usageText);
+    const equals = argument.indexOf("=");
+    const name = equals === -1 ? argument : argument.slice(0, equals);
+    const inlineValue = equals === -1 ? null : argument.slice(equals + 1);
+    if (booleanNames.has(name)) {
+      if (inlineValue !== null) usage(`${name} does not accept a value.\n${usageText}`);
+      parsed[name.slice(2)] = true;
+      continue;
+    }
+    if (!valueNames.has(name)) usage(`Unsupported option: ${name}.\n${usageText}`);
+    const value = inlineValue ?? argv[index + 1];
+    if (!value || (inlineValue === null && value.startsWith("--"))) {
+      usage(`Missing value for ${name}.\n${usageText}`);
+    }
+    if (inlineValue === null) index += 1;
+    if (parsed[name.slice(2)] !== undefined)
+      usage(`${name} may be supplied only once.\n${usageText}`);
+    parsed[name.slice(2)] = value;
+  }
+  return parsed;
+}
+
+function positiveNumberOption(value, name, usageText) {
+  if (value === undefined) return undefined;
+  const parsed = Number(value);
+  if (!Number.isFinite(parsed) || parsed <= 0) {
+    usage(`${name} must be a positive number.\n${usageText}`);
+  }
+  return parsed;
+}
+
+export function parseSessionCommandInput(capabilityId, argv) {
+  if (capabilityId === "identity.login") {
+    const usageText =
+      "Usage: ornn login [--organization <exact-name>] [--no-browser] [--timeout <seconds>]";
+    const parsed = parseOptions(argv, {
+      booleans: ["--no-browser"],
+      values: ["--auth-base", "--organization", "--poll-interval", "--timeout"],
+      usageText,
+    });
+    return {
+      authBase: parsed["auth-base"],
+      noBrowser: parsed["no-browser"],
+      organization: parsed.organization,
+      pollInterval: positiveNumberOption(parsed["poll-interval"], "--poll-interval", usageText),
+      timeout: positiveNumberOption(parsed.timeout, "--timeout", usageText),
+    };
+  }
+  if (capabilityId === "identity.context") {
+    return parseOptions(argv, {
+      values: ["--organization"],
+      usageText: "Usage: ornn context [--organization <exact-name-or-id>]",
+    });
+  }
+  if (capabilityId === "identity.logout") {
+    return parseOptions(argv, { usageText: "Usage: ornn logout" });
+  }
+  return {};
+}
+
+function organization(value) {
+  if (!value || typeof value !== "object") return null;
+  const id = typeof value.id === "string" ? value.id : "";
+  const name = typeof value.name === "string" ? value.name : "";
+  if (!id || !name) return null;
+  return { id, name, approved: value.approved === true };
+}
+
+function sessionContext(value) {
+  if (!value || typeof value !== "object" || !value.user || typeof value.user !== "object") {
+    throw new SessionCommandError("Ornn returned an invalid session context.", {
+      code: "invalid_session_context",
+      exitCode: 6,
+      retryable: true,
+    });
+  }
+  const organizations = Array.isArray(value.organizations)
+    ? value.organizations.map(organization).filter(Boolean)
+    : [];
+  const selectedOrganization = organization(
+    value.selectedOrganization ?? value.selected_organization
+  );
+  return {
+    user: {
+      id: typeof value.user.id === "string" ? value.user.id : null,
+      email: typeof value.user.email === "string" ? value.user.email : null,
+    },
+    selected_organization: selectedOrganization,
+    organizations,
+  };
+}
+
+async function readServerContext({ env, fetchImpl, session: suppliedSession }) {
+  const session = suppliedSession === undefined ? await loadAuthSession({ env }) : suppliedSession;
+  try {
+    return sessionContext(
+      await cliRequest({
+        endpoint: "/v1/cli/session",
+        env,
+        fetchImpl,
+        method: "GET",
+        ...(session ? { session } : {}),
+      })
+    );
+  } catch (error) {
+    if (
+      !(error instanceof CliApiError) ||
+      error.status !== 403 ||
+      !session?.accessToken ||
+      !session.selectedOrganizationId
+    ) {
+      throw error;
+    }
+    const unscopedSession = { ...session };
+    delete unscopedSession.selectedOrganizationId;
+    return sessionContext(
+      await cliRequest({
+        endpoint: "/v1/cli/session",
+        env,
+        fetchImpl,
+        method: "GET",
+        session: unscopedSession,
+      })
+    );
+  }
+}
+
+function selectionAction(machine) {
+  return {
+    type: "command",
+    command: machine
+      ? "ornn context --organization <canonical-id> --format json"
+      : "ornn context --organization <exact-name>",
+    description: machine
+      ? "Select one approved organization by canonical identifier."
+      : "Select one approved organization by its exact displayed name.",
+  };
+}
+
+function findApprovedOrganization(organizations, selector, machine) {
+  if (machine && !CANONICAL_ID.test(selector)) {
+    throw new SessionCommandError(
+      "Automation must select an organization by canonical identifier.",
+      {
+        action: selectionAction(true),
+        code: "organization_id_required",
+        exitCode: 2,
+      }
+    );
+  }
+  const matches = organizations.filter((candidate) =>
+    machine ? candidate.id === selector : candidate.id === selector || candidate.name === selector
+  );
+  if (matches.length === 0) {
+    throw new SessionCommandError("The requested organization is not a current membership.", {
+      action: selectionAction(machine),
+      code: "organization_not_available",
+      exitCode: 5,
+    });
+  }
+  if (matches.length > 1) {
+    throw new SessionCommandError(
+      "More than one organization has that name; select by canonical identifier.",
+      {
+        action: selectionAction(true),
+        code: "organization_ambiguous",
+        exitCode: 2,
+      }
+    );
+  }
+  if (!matches[0].approved) {
+    throw new SessionCommandError(`Organization ${matches[0].name} is not approved.`, {
+      code: "organization_not_approved",
+      exitCode: 5,
+    });
+  }
+  return matches[0];
+}
+
+async function promptForOrganization(organizations, { stdin, stdout }) {
+  stdout.write("Choose an approved organization by typing its exact name:\n");
+  for (const candidate of organizations) stdout.write(`  ${candidate.name}\n`);
+  const readline = createInterface({ input: stdin, output: stdout, terminal: false });
+  try {
+    return await readline.question("Organization: ");
+  } finally {
+    readline.close();
+  }
+}
+
+function updateSnapshotOrganization(sessionSnapshot, selectedOrganizationId) {
+  if (!sessionSnapshot?.current) return;
+  const next = { ...sessionSnapshot.current };
+  if (selectedOrganizationId) next.selectedOrganizationId = selectedOrganizationId;
+  else delete next.selectedOrganizationId;
+  sessionSnapshot.current = next;
+}
+
+async function selectAndRevalidate(
+  selector,
+  context,
+  { env, fetchImpl, machine, sessionSnapshot }
+) {
+  const selected = findApprovedOrganization(context.organizations, selector, machine);
+  const expectedAccessToken = sessionSnapshot?.current?.accessToken;
+  await saveOrganizationHint(selected.id, { env, expectedAccessToken });
+  updateSnapshotOrganization(sessionSnapshot, selected.id);
+  const revalidated = await readServerContext({
+    env,
+    fetchImpl,
+    session: sessionSnapshot?.current,
+  });
+  if (revalidated.selected_organization?.id !== selected.id) {
+    await saveOrganizationHint(null, { env, expectedAccessToken });
+    updateSnapshotOrganization(sessionSnapshot, null);
+    throw new SessionCommandError(
+      "Organization membership changed before selection could be verified.",
+      {
+        action: selectionAction(machine),
+        code: "organization_membership_changed",
+        exitCode: 5,
+      }
+    );
+  }
+  return revalidated;
+}
+
+async function resolveContext(
+  input,
+  {
+    eligibleHuman,
+    env,
+    fetchImpl,
+    machine,
+    promptIfMultiple = false,
+    sessionSnapshot,
+    stdin,
+    stdout,
+  }
+) {
+  const localSession =
+    sessionSnapshot?.current === undefined
+      ? await loadAuthSession({ env })
+      : sessionSnapshot.current;
+  if (sessionSnapshot && sessionSnapshot.current === undefined) {
+    sessionSnapshot.current = localSession;
+  }
+  let context = await readServerContext({ env, fetchImpl, session: localSession });
+  await bindAuthUser(context.user, {
+    env,
+    expectedAccessToken: localSession?.accessToken,
+  });
+  if (sessionSnapshot?.current && context.user?.id) {
+    sessionSnapshot.current = {
+      ...sessionSnapshot.current,
+      user: { ...(sessionSnapshot.current.user ?? {}), ...context.user },
+    };
+  }
+  const localHint = localSession?.selectedOrganizationId;
+  const hintIsCurrent =
+    context.selected_organization && context.selected_organization.id === localHint;
+  if (localHint && !hintIsCurrent) {
+    await saveOrganizationHint(null, {
+      env,
+      expectedAccessToken: localSession?.accessToken,
+    });
+    updateSnapshotOrganization(sessionSnapshot, null);
+  }
+
+  const selectionRuntime = { env, fetchImpl, machine, sessionSnapshot };
+  if (input.organization) {
+    return {
+      context: await selectAndRevalidate(input.organization, context, selectionRuntime),
+      action: null,
+      exitCode: 0,
+      outcome: { class: "ready", phase: "complete" },
+    };
+  }
+
+  if (hintIsCurrent) {
+    return {
+      context,
+      action: null,
+      exitCode: 0,
+      outcome: { class: "ready", phase: "complete" },
+    };
+  }
+
+  const approved = context.organizations.filter((candidate) => candidate.approved);
+  if (approved.length === 1) {
+    context = await selectAndRevalidate(approved[0].id, context, {
+      ...selectionRuntime,
+      machine: true,
+    });
+    return {
+      context,
+      action: null,
+      exitCode: 0,
+      outcome: { class: "ready", phase: "complete" },
+    };
+  }
+  if (approved.length > 1 && promptIfMultiple && eligibleHuman) {
+    const answer = await promptForOrganization(approved, { stdin, stdout });
+    context = await selectAndRevalidate(answer, context, {
+      ...selectionRuntime,
+      machine: false,
+    });
+    return {
+      context,
+      action: null,
+      exitCode: 0,
+      outcome: { class: "ready", phase: "complete" },
+    };
+  }
+  if (approved.length > 1) {
+    return {
+      context,
+      action: selectionAction(machine),
+      exitCode: 3,
+      outcome: { class: "action_required", phase: "organization_selection" },
+    };
+  }
+  return {
+    context,
+    action: null,
+    exitCode: 0,
+    outcome: { class: "ready", phase: "complete" },
+  };
+}
+
+function loginAction(started) {
+  return {
+    type: "browser",
+    url: started.verificationUri,
+    code: started.userCode,
+    description: "Complete device authorization in a browser.",
+  };
+}
+
+function deviceFailure(error) {
+  const action = {
+    type: "command",
+    command: "ornn login",
+    description: "Start a new browser login.",
+  };
+  if (!(error instanceof DeviceAuthError)) {
+    return new SessionCommandError(error?.message ?? "Could not reach Ornn for browser login.", {
+      action,
+      code: "login_unavailable",
+      exitCode: 6,
+      retryable: true,
+    });
+  }
+  if (error.detail?.code === "interrupted") {
+    return new SessionCommandError("Local browser login waiting was interrupted.", {
+      action,
+      code: "login_interrupted",
+      exitCode: 130,
+      outcomeClass: "working",
+      retryable: true,
+    });
+  }
+  const expired = /expired|timed out/i.test(error.message);
+  const denied = /denied/i.test(error.message);
+  const message = expired ? "Device login expired or timed out." : error.message;
+  return new SessionCommandError(message, {
+    action,
+    code: expired ? "login_expired" : denied ? "login_denied" : "login_failed",
+    exitCode: expired || denied ? 3 : error.status >= 500 || error.status === undefined ? 6 : 1,
+    outcomeClass: expired || denied ? "action_required" : "failed",
+    retryable: expired || denied || error.status >= 500 || error.status === undefined,
+  });
+}
+
+async function login(input, runtime) {
+  const authBaseUrl = resolveAuthBaseUrl({ env: runtime.env, explicit: input.authBase });
+  const apiBaseUrl = resolveApiBaseUrl({ env: runtime.env, session: { authBaseUrl } });
+  if (runtime.eligibleHuman && !runtime.machine) {
+    runtime.stderr.write(`Starting Ornn browser login through ${apiBaseUrl}\n`);
+  }
+
+  let started;
+  try {
+    started = await startDeviceFlow({ apiBaseUrl, authBaseUrl, fetchImpl: runtime.fetchImpl });
+  } catch (error) {
+    throw deviceFailure(error);
+  }
+
+  if (!runtime.eligibleHuman || runtime.machine) {
+    return {
+      data: {
+        verification_uri: started.verificationUri,
+        user_code: started.userCode,
+        expires_in_seconds: started.expiresIn,
+      },
+      action: loginAction(started),
+      exitCode: 3,
+      outcome: { class: "action_required", phase: "browser_authorization" },
+    };
+  }
+
+  runtime.stderr.write(
+    `Open this URL to continue:\n${started.verificationUri}\nCode: ${started.userCode}\n`
+  );
+  if (!input.noBrowser) {
+    const opened = await (runtime.openBrowserImpl ?? openBrowser)(started.verificationUri);
+    if (!opened)
+      runtime.stderr.write(
+        "Could not open the browser automatically. Open the URL above manually.\n"
+      );
+  }
+  runtime.stderr.write("Waiting for browser approval");
+
+  let session;
+  try {
+    session = await waitForDeviceApproval({
+      apiBaseUrl,
+      authBaseUrl,
+      deviceCode: started.deviceCode,
+      expiresIn: started.expiresIn,
+      fetchImpl: runtime.fetchImpl,
+      now: runtime.now,
+      signal: runtime.signal,
+      sleepImpl: runtime.sleep,
+      interval: input.pollInterval ?? started.interval,
+      onPending: () => runtime.stderr.write("."),
+      timeoutSeconds: input.timeout,
+    });
+  } catch (error) {
+    runtime.stderr.write("\n");
+    throw deviceFailure(error);
+  }
+
+  await saveAuthSession(session, { env: runtime.env });
+  runtime.stderr.write(`\nSession saved to ${getAuthConfigPath(runtime.env)}\n`);
+  const resolved = await resolveContext(
+    { organization: input.organization },
+    { ...runtime, machine: false, promptIfMultiple: true }
+  );
+  return {
+    data: { ...resolved.context, session_saved: true },
+    action: resolved.action,
+    exitCode: resolved.exitCode,
+    outcome: resolved.outcome,
+  };
+}
+
+async function context(input, runtime) {
+  const resolved = await resolveContext(input, { ...runtime, promptIfMultiple: false });
+  return {
+    data: resolved.context,
+    action: resolved.action,
+    exitCode: resolved.exitCode,
+    outcome: resolved.outcome,
+  };
+}
+
+async function logout(runtime) {
+  let session = null;
+  let revocationError = null;
+  let attempted = false;
+  try {
+    session = await loadAuthSession({ env: runtime.env });
+  } catch (error) {
+    revocationError = error;
+  }
+  try {
+    if (!revocationError && session?.accessToken) {
+      attempted = true;
+      await cliRequest({
+        endpoint: "/v1/cli/session",
+        env: runtime.env,
+        fetchImpl: runtime.fetchImpl,
+        method: "DELETE",
+        raw: true,
+        session,
+      });
+    }
+  } catch (error) {
+    revocationError = error;
+  } finally {
+    await clearAuthSession({ env: runtime.env });
+  }
+
+  const data = {
+    local_session_cleared: true,
+    remote_revocation: revocationError ? "unconfirmed" : attempted ? "confirmed" : "not_applicable",
+    remote_session_revoked: attempted && !revocationError,
+  };
+  if (!revocationError) {
+    return {
+      data,
+      action: null,
+      exitCode: 0,
+      outcome: { class: "ended", phase: "logged_out" },
+    };
+  }
+  const message = `Local session cleared, but Ornn could not confirm remote revocation: ${revocationError.message}`;
+  return {
+    data,
+    action: null,
+    errors: [{ code: "remote_revocation_unconfirmed", message, retryable: false }],
+    exitCode: 4,
+    outcome: { class: "partial", phase: "remote_revocation_unconfirmed" },
+  };
+}
+
+export async function executeSessionCommand(command, input, runtime) {
+  if (command === "login") return login(input, runtime);
+  if (command === "context") return context(input, runtime);
+  if (command === "logout") return logout(runtime);
+  throw new CliApiError(`Unsupported session capability: ${command}`);
+}