@poetic-ai/poetic 1.42.0

package/dist/chunk-4VJITV4P.js

@@ -0,0 +1,445 @@
+import {
+  expandHomeDir
+} from "./chunk-C57KJOUQ.js";
+import {
+  getDefaultPaths
+} from "./chunk-UUH2RVKS.js";
+import {
+  POETIC_ALLOW_SKIP_AUTH,
+  POETIC_SKIP_AUTH,
+  readEnv
+} from "./chunk-5DLKYTQX.js";
+
+// src/core/providers/shared/base-auth.ts
+import { existsSync, readFileSync } from "fs";
+import { chmod, copyFile, mkdir, readdir, rm, stat, writeFile } from "fs/promises";
+import { homedir } from "os";
+import * as path from "path";
+import { execa } from "execa";
+function readBooleanEnvFrom(env, name) {
+  const raw = env ? env[name] : process.env[name];
+  if (raw === void 0 || raw === "") return void 0;
+  const lower = raw.toLowerCase();
+  if (["1", "true", "yes", "on"].includes(lower)) return true;
+  if (["0", "false", "no", "off"].includes(lower)) return false;
+  throw new Error(
+    `Invalid boolean value for ${name}: "${raw}". Expected one of: 1, true, yes, on, 0, false, no, off`
+  );
+}
+function assertSkipAuthAllowed(env) {
+  const allowed = env === void 0 ? readEnv(POETIC_ALLOW_SKIP_AUTH).value : readBooleanEnvFrom(env, POETIC_ALLOW_SKIP_AUTH.name) ?? POETIC_ALLOW_SKIP_AUTH.default;
+  if (!allowed) {
+    throw new Error(
+      "POETIC_SKIP_AUTH is disabled unless POETIC_ALLOW_SKIP_AUTH=1 is explicitly set for a controlled test environment."
+    );
+  }
+}
+function isSkipAuthEnvActive(skipEnvVar = POETIC_SKIP_AUTH.name, env) {
+  const value = skipEnvVar === POETIC_SKIP_AUTH.name ? readBooleanEnvFrom(env, POETIC_SKIP_AUTH.name) ?? POETIC_SKIP_AUTH.default : (env ? env[skipEnvVar] : process.env[skipEnvVar]) === "1";
+  if (!value) return false;
+  assertSkipAuthAllowed(env);
+  return true;
+}
+function resolveCredential(params) {
+  const { cliOverride, configFileValue, envValue } = params;
+  const trim = (s) => typeof s === "string" ? s.trim() || null : null;
+  return trim(cliOverride) ?? trim(configFileValue) ?? trim(envValue) ?? null;
+}
+var PROVIDER_CREDENTIALS_FILENAME = "provider-credentials.json";
+function loadProviderCredentialsConfig() {
+  try {
+    const { userConfigDir } = getDefaultPaths();
+    const filePath = path.join(userConfigDir, PROVIDER_CREDENTIALS_FILENAME);
+    if (!existsSync(filePath)) return null;
+    const raw = readFileSync(filePath, "utf8");
+    const parsed = JSON.parse(raw);
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return null;
+    const result = {};
+    for (const [provider, entry] of Object.entries(parsed)) {
+      if (entry !== null && typeof entry === "object" && !Array.isArray(entry)) {
+        const inner = {};
+        for (const [k, v] of Object.entries(entry)) {
+          if (typeof v === "string") inner[k] = v;
+        }
+        if (Object.keys(inner).length > 0) result[provider] = inner;
+      }
+    }
+    return result;
+  } catch {
+    return null;
+  }
+}
+async function isCliInstalled(command) {
+  try {
+    const result = await execa(command, ["--version"], {
+      timeout: 3e3,
+      reject: false
+    });
+    if (typeof result.exitCode === "number" && result.exitCode === 0) return true;
+    const out = `${result.stdout ?? ""}
+${result.stderr ?? ""}`;
+    if (/not recognized as an internal or external command/i.test(out)) return false;
+    if (/command not found/i.test(out)) return false;
+    if (/No such file or directory/i.test(out)) return false;
+    return false;
+  } catch {
+    return false;
+  }
+}
+var BaseProviderAuth = class {
+  /**
+   * Get environment variable names for provider credentials
+   * Override in subclass to specify which env vars to check
+   */
+  getCredentialEnvVars() {
+    return [];
+  }
+  /**
+   * Resolve credentials from multiple sources with priority ordering:
+   * 1. CLI arguments (highest priority)
+   * 2. Config file
+   * 3. Environment variables (lowest priority)
+   *
+   * @param options - Auth options including potential CLI credentials
+   * @returns Resolved credential value or undefined
+   */
+  resolveCredentials(options) {
+    if (options?.cliCredentials) {
+      const cliValue = options.cliCredentials.apiKey || options.cliCredentials.token;
+      if (cliValue) {
+        return { source: "cli", value: cliValue };
+      }
+    }
+    const configDir = this.resolveConfigDir(options);
+    const authFilePath = this.getAuthFilePath(configDir);
+    if (existsSync(authFilePath)) {
+      return { source: "config", value: authFilePath };
+    }
+    const envVars = this.getCredentialEnvVars();
+    for (const envVar of envVars) {
+      const envValue = process.env[envVar];
+      if (envValue && envValue.trim().length > 0) {
+        return { source: "env", value: envValue, envVar };
+      }
+    }
+    return { source: "none" };
+  }
+  /**
+   * Resolves the provider config directory
+   * Now uses XDG-compliant paths: ~/.config/poetic/providers/{provider}
+   */
+  resolveConfigDir(options) {
+    if (options?.configDir !== void 0) {
+      return expandHomeDir(options.configDir);
+    }
+    const envDir = process.env[this.configDirEnvVar];
+    if (envDir) {
+      return expandHomeDir(envDir);
+    }
+    const { userConfigDir } = getDefaultPaths();
+    return path.join(userConfigDir, "providers", this.defaultConfigSubdir);
+  }
+  /**
+   * Gets the legacy (pre-XDG) config directory path
+   * Used for migration from old location to new location
+   */
+  getLegacyConfigDir() {
+    return path.join(homedir(), ".poetic", this.defaultConfigSubdir);
+  }
+  /**
+   * Migrates provider authentication from legacy location to XDG-compliant location
+   * Uses copy-verify-deprecate pattern for safety
+   */
+  async migrateFromLegacy(options) {
+    const legacyDir = this.getLegacyConfigDir();
+    const modernDir = this.resolveConfigDir(options);
+    if (!existsSync(legacyDir)) {
+      return false;
+    }
+    if (existsSync(modernDir)) {
+      return false;
+    }
+    try {
+      console.log(`
+Migrating ${this.metadata.name} credentials to XDG-compliant location...`);
+      console.log(`   From: ${legacyDir}`);
+      console.log(`   To:   ${modernDir}
+`);
+      await mkdir(modernDir, { recursive: true });
+      const files = await readdir(legacyDir);
+      for (const file of files) {
+        const srcPath = path.join(legacyDir, file);
+        const destPath = path.join(modernDir, file);
+        const srcStat = await stat(srcPath);
+        if (srcStat.isFile()) {
+          await copyFile(srcPath, destPath);
+          await this.enforceFilePermissions(destPath);
+        }
+      }
+      const authPath = this.getAuthFilePath(modernDir);
+      await stat(authPath);
+      const deprecatedMarker = path.join(legacyDir, ".DEPRECATED");
+      const deprecationMessage = `This directory has been migrated to ${modernDir} on ${(/* @__PURE__ */ new Date()).toISOString()}
+
+The new location follows the XDG Base Directory Specification.
+This directory is safe to delete after verifying the new location works.
+
+To clean up deprecated locations, run:
+  poetic config cleanup-deprecated
+`;
+      await writeFile(deprecatedMarker, deprecationMessage, { encoding: "utf8" });
+      console.log(`Successfully migrated ${this.metadata.name} credentials
+`);
+      return true;
+    } catch (error) {
+      console.error(`Warning: migration failed for ${this.metadata.name}:`, error);
+      console.error(`   Falling back to legacy location: ${legacyDir}
+`);
+      try {
+        if (existsSync(modernDir)) {
+          await rm(modernDir, { recursive: true, force: true });
+        }
+      } catch {
+      }
+      return false;
+    }
+  }
+  /**
+   * Checks if authenticated by verifying credentials from any source
+   * Override to add custom validation logic
+   */
+  async isAuthenticated(options) {
+    const credentialResolution = this.resolveCredentials(options);
+    if (credentialResolution.source === "cli" || credentialResolution.source === "env") {
+      return true;
+    }
+    if (credentialResolution.source === "config") {
+      const configDir = this.resolveConfigDir(options);
+      const authPath = this.getAuthFilePath(configDir);
+      try {
+        const stats = await stat(authPath);
+        if (stats.size === 0) {
+          return false;
+        }
+        await this.verifyFilePermissions(authPath);
+        return true;
+      } catch {
+        return false;
+      }
+    }
+    if (credentialResolution.source === "none") {
+      const configDir = this.resolveConfigDir(options);
+      const authPath = this.getAuthFilePath(configDir);
+      try {
+        const stats = await stat(authPath);
+        if (stats.size === 0) {
+          return false;
+        }
+        await this.verifyFilePermissions(authPath);
+        return true;
+      } catch {
+        return false;
+      }
+    }
+    return false;
+  }
+  /**
+   * Creates a placeholder auth file for testing/dry-run mode
+   * Override to customize placeholder content
+   */
+  async createPlaceholder(configDir) {
+    const authPath = this.getAuthFilePath(configDir);
+    const dir = path.dirname(authPath);
+    await mkdir(dir, { recursive: true });
+    await writeFile(authPath, "{}", { encoding: "utf8" });
+    await this.enforceFilePermissions(authPath);
+  }
+  /**
+   * Enforces secure file permissions (0600) on credential files
+   * Only owner can read/write, no access for group or others
+   */
+  async enforceFilePermissions(filePath) {
+    try {
+      await chmod(filePath, 384);
+    } catch (error) {
+      if (process.platform !== "win32") {
+        console.warn(`Warning: Could not set permissions on ${filePath}:`, error);
+      }
+    }
+  }
+  /**
+   * Verifies that credential file has secure permissions
+   * Throws error if permissions are too permissive (on Unix systems)
+   */
+  async verifyFilePermissions(filePath) {
+    if (process.platform === "win32") {
+      return;
+    }
+    try {
+      const stats = await stat(filePath);
+      const mode = stats.mode;
+      const hasInsecurePermissions = (mode & 63) !== 0;
+      if (hasInsecurePermissions) {
+        throw new Error(
+          `Insecure permissions on ${filePath}. Credentials must be readable only by owner. Run: chmod 600 ${filePath}`
+        );
+      }
+    } catch (error) {
+      if (error.code === "ENOENT") {
+        return;
+      }
+      throw error;
+    }
+  }
+  /**
+   * Runs the CLI authentication command
+   * Override to customize authentication flow
+   */
+  async runAuthCommand(_configDir) {
+    throw new Error("runAuthCommand must be implemented by subclass");
+  }
+  /**
+   * Checks if CLI is installed and shows helpful error if not
+   */
+  async checkCliInstalled() {
+    const cliInstalled = await isCliInstalled(this.metadata.cliBinary);
+    if (!cliInstalled) {
+      this.showCliNotInstalledError();
+      throw new Error(`${this.metadata.name} CLI is not installed.`);
+    }
+  }
+  /**
+   * Shows a formatted error message when CLI is not installed
+   */
+  showCliNotInstalledError(additionalInstructions) {
+    console.error("\n");
+    console.error(`  Warning: ${this.metadata.name} CLI not installed`);
+    console.error("");
+    console.error(`
+The '${this.metadata.cliBinary}' command is not available.`);
+    console.error(`Please install ${this.metadata.name} CLI first:
+`);
+    console.error(`  ${this.metadata.installCommand}
+`);
+    if (additionalInstructions) {
+      console.error(additionalInstructions);
+    }
+    console.error("\n");
+  }
+  /**
+   * Handles errors from CLI command execution
+   * Returns true if error was ENOENT/command not found, false otherwise
+   */
+  handleCliError(_error) {
+    const err = _error;
+    const stderr = err?.stderr ?? "";
+    const message = err?.message ?? "";
+    const notFound = err?.code === "ENOENT" || /not recognized as an internal or external command/i.test(stderr || message) || /command not found/i.test(stderr || message) || /No such file or directory/i.test(stderr || message);
+    if (notFound) {
+      console.error("\n");
+      console.error(`  Warning: ${this.metadata.name} CLI not found`);
+      console.error("");
+      console.error(`
+'${this.metadata.cliBinary}' command failed because the CLI is missing.`);
+      console.error(`Please install ${this.metadata.name} CLI before trying again:
+`);
+      console.error(`  ${this.metadata.installCommand}
+`);
+      console.error("\n");
+      throw new Error(`${this.metadata.name} CLI is not installed.`);
+    }
+    return false;
+  }
+  /**
+   * Ensures authentication, running setup if needed
+   * Main entry point for authentication flow
+   */
+  async ensureAuth(options) {
+    await this.migrateFromLegacy(options);
+    const configDir = this.resolveConfigDir(options);
+    if (await this.isAuthenticated(options)) {
+      return true;
+    }
+    if (readEnv(POETIC_SKIP_AUTH).value) {
+      assertSkipAuthAllowed();
+      try {
+        await this.createPlaceholder(configDir);
+        return true;
+      } catch (_error) {
+        this.showAuthSetupInstructions();
+        throw new Error("Authentication incomplete");
+      }
+    }
+    try {
+      await this.checkCliInstalled();
+    } catch (_error) {
+      this.showAuthSetupInstructions();
+      throw new Error("Authentication incomplete");
+    }
+    try {
+      await this.runAuthCommand(configDir);
+    } catch (_error) {
+      this.showAuthSetupInstructions();
+      throw new Error("Authentication incomplete");
+    }
+    const authPath = this.getAuthFilePath(configDir);
+    await this.enforceFilePermissions(authPath);
+    if (await this.isAuthenticated(options)) {
+      return true;
+    }
+    this.showAuthSetupInstructions();
+    throw new Error("Authentication incomplete. Auth file was not created.");
+  }
+  /**
+   * Shows helpful authentication setup instructions
+   * Override in subclass to provide provider-specific instructions
+   */
+  showAuthSetupInstructions() {
+    console.error("\n");
+    console.error(`  Warning: ${this.metadata.name} authentication required`);
+    console.error("");
+    console.error(`
+To use ${this.metadata.name}, you need to set up authentication first.`);
+    console.error("\nSetup:");
+    if (this.metadata.setupCommand) {
+      console.error(`  Run: ${this.metadata.setupCommand}`);
+    }
+    console.error(`  1. Install ${this.metadata.name} CLI:`);
+    console.error(`     ${this.metadata.installCommand}`);
+    console.error("\n  2. Follow the authentication guide:");
+    console.error("     See: docs/PROVIDER_SETUP.md");
+    console.error("\n  3. Verify authentication:");
+    console.error("     Run your command again after setup");
+    console.error("\n\n");
+  }
+  /**
+   * Clears all authentication data
+   */
+  async clearAuth(options) {
+    const configDir = this.resolveConfigDir(options);
+    const authPaths = this.getAuthPaths(configDir);
+    await Promise.all(
+      authPaths.map(async (authPath) => {
+        try {
+          await rm(authPath, { force: true, recursive: true });
+        } catch {
+        }
+      })
+    );
+  }
+  /**
+   * Returns the next auth menu action based on current auth state
+   */
+  async nextAuthMenuAction(options) {
+    return await this.isAuthenticated(options) ? "logout" : "login";
+  }
+};
+
+export {
+  assertSkipAuthAllowed,
+  isSkipAuthEnvActive,
+  resolveCredential,
+  loadProviderCredentialsConfig,
+  BaseProviderAuth
+};
+//# sourceMappingURL=chunk-4VJITV4P.js.map