@prisma/cli 8.0.0-rc.1 → 8.0.0-rc.2-dev.49

package/dist/auth/login.js

@@ -1,471 +0,0 @@
-import { getApiBaseUrl } from "./client.js";
-import { FileTokenStorage } from "./token-storage.js";
-import { AuthError, createManagementApiSdk } from "@prisma/management-api-sdk";
-import events from "node:events";
-import http from "node:http";
-import readline from "node:readline/promises";
-import open from "open";
-//#region src/auth/login.ts
-var AuthError$1 = class extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "AuthError";
-	}
-};
-async function login(options = {}) {
-	const hostname = options.hostname ?? "localhost";
-	const port = options.port ?? 0;
-	const input = options.input ?? process.stdin;
-	const output = options.output ?? process.stderr;
-	const interactive = input.isTTY === true;
-	const server = http.createServer();
-	server.listen({
-		host: hostname,
-		port
-	});
-	const pasteAbort = new AbortController();
-	try {
-		const state = new LoginState({
-			hostname,
-			port: (await events.once(server, "listening").then(() => server.address())).port,
-			tokenStorage: options.tokenStorage,
-			clientId: options.clientId,
-			apiBaseUrl: options.apiBaseUrl,
-			authBaseUrl: options.authBaseUrl,
-			openUrl: options.openUrl,
-			onVerificationUrl: options.onVerificationUrl,
-			env: options.env,
-			signal: options.signal,
-			output
-		});
-		let completed = false;
-		let completion;
-		const completeOnce = (url) => {
-			if (!completion) completion = state.handleCallback(url).then(() => {
-				completed = true;
-			}, (error) => {
-				completion = void 0;
-				throw error;
-			});
-			return completion;
-		};
-		const httpResult = new Promise((resolve, reject) => {
-			const onAbort = () => {
-				reject(options.signal?.reason);
-			};
-			options.signal?.addEventListener("abort", onAbort, { once: true });
-			const settle = (callback) => {
-				options.signal?.removeEventListener("abort", onAbort);
-				callback();
-			};
-			server.on("request", async (req, res) => {
-				const url = new URL(`http://${state.host}${req.url}`);
-				if (url.pathname !== "/auth/callback") {
-					res.statusCode = 404;
-					res.end("Not found");
-					return;
-				}
-				if (completed) {
-					const workspaceName = await state.resolveWorkspaceName();
-					res.setHeader("Content-Type", "text/html; charset=utf-8");
-					res.end(renderSuccessPage(workspaceName));
-					return;
-				}
-				try {
-					await completeOnce(url);
-					const workspaceName = await state.resolveWorkspaceName();
-					res.setHeader("Content-Type", "text/html; charset=utf-8");
-					res.end(renderSuccessPage(workspaceName));
-					settle(resolve);
-				} catch (error) {
-					res.statusCode = 400;
-					res.setHeader("Content-Type", "text/plain; charset=utf-8");
-					res.end("Sign-in could not be completed. Return to your terminal.");
-					settle(() => reject(error));
-					return;
-				}
-			});
-		});
-		options.signal?.throwIfAborted();
-		const callbackResult = interactive ? Promise.race([httpResult, consumePastedCallback({
-			input,
-			output,
-			signal: pasteAbort.signal,
-			complete: completeOnce
-		})]) : httpResult;
-		await Promise.all([state.openLoginPage(interactive), callbackResult]);
-	} finally {
-		pasteAbort.abort();
-		if (server.listening) await new Promise((resolve) => server.close(() => resolve()));
-	}
-}
-async function consumePastedCallback(options) {
-	if (!options.input.isTTY) return;
-	const rl = readline.createInterface({
-		input: options.input,
-		output: options.output
-	});
-	try {
-		for (;;) {
-			const url = await readPastedCallbackUrl(rl, options);
-			if (url === null) return;
-			if (url === void 0) continue;
-			if (await tryCompletePastedCallback(url, options)) return;
-		}
-	} finally {
-		rl.close();
-	}
-}
-async function readPastedCallbackUrl(rl, options) {
-	let answer;
-	try {
-		answer = await rl.question("Paste the callback URL here: ", { signal: options.signal });
-	} catch (error) {
-		if (error?.name === "AbortError") return null;
-		throw error;
-	}
-	const trimmed = answer.trim().replace(/^["']|["']$/g, "");
-	try {
-		if (!trimmed) throw new Error("empty input");
-		return new URL(trimmed);
-	} catch {
-		options.output.write("That didn't look like a URL. Paste the full localhost callback URL and try again.\n");
-		return;
-	}
-}
-async function tryCompletePastedCallback(url, options) {
-	try {
-		await options.complete(url);
-		return true;
-	} catch (error) {
-		const message = error instanceof Error ? error.message : String(error);
-		options.output.write(`Sign-in didn't complete (${message}). Paste the callback URL to try again.\n`);
-		return false;
-	}
-}
-var LoginState = class {
-	latestVerifier;
-	latestState;
-	sdk;
-	openUrl;
-	tokenStorage;
-	output;
-	constructor(options) {
-		this.options = options;
-		this.tokenStorage = options.tokenStorage ?? new FileTokenStorage(options.env, options.signal, { activateOnSetTokens: true });
-		this.sdk = createManagementApiSdk({
-			clientId: options.clientId ?? "cmm3lndn701oo0uefvxzo0ivw",
-			redirectUri: `http://${options.hostname}:${options.port}/auth/callback`,
-			tokenStorage: this.tokenStorage,
-			apiBaseUrl: options.apiBaseUrl ?? getApiBaseUrl(options.env),
-			authBaseUrl: options.authBaseUrl
-		});
-		this.openUrl = options.openUrl ?? open;
-		this.output = options.output;
-	}
-	async openLoginPage(interactive) {
-		this.options.signal?.throwIfAborted();
-		const { url, state, verifier } = await this.sdk.getLoginUrl({
-			scope: "workspace:admin offline_access",
-			additionalParams: {
-				utm_source: "prisma-cli",
-				utm_medium: "command-login",
-				utm_campaign: "prisma-cli"
-			}
-		});
-		this.latestState = state;
-		this.latestVerifier = verifier;
-		try {
-			this.options.onVerificationUrl?.(url);
-		} catch {}
-		this.options.signal?.throwIfAborted();
-		if (interactive) this.printLoginInstructions(url);
-		try {
-			await this.openUrl(url);
-		} catch (error) {
-			if (!interactive) throw error;
-		}
-		this.options.signal?.throwIfAborted();
-	}
-	printLoginInstructions(url) {
-		const output = this.output;
-		if (!output) return;
-		output.write(`\nOpen this URL to sign in: ${url}\n\nIf the browser opens on another machine, finish sign-in there. When it\nredirects to localhost, copy the full localhost URL from the address bar\nand paste it here.\n\n`);
-	}
-	async handleCallback(url) {
-		if (url.pathname !== "/auth/callback") throw new AuthError$1("Not a callback URL");
-		const params = url.searchParams;
-		const error = params.get("error");
-		if (error) {
-			const desc = params.get("error_description");
-			throw new AuthError$1(desc ? `${error}: ${desc}` : error);
-		}
-		if (!this.latestVerifier) throw new AuthError$1("No verifier found");
-		if (!this.latestState) throw new AuthError$1("No state found");
-		try {
-			await this.sdk.handleCallback({
-				callbackUrl: url,
-				verifier: this.latestVerifier,
-				expectedState: this.latestState
-			});
-		} catch (error) {
-			if (error instanceof AuthError) throw new AuthError$1(error.message);
-			throw new AuthError$1(error instanceof Error ? error.message : "Unknown error during login");
-		}
-	}
-	async resolveWorkspaceName() {
-		try {
-			const tokens = await this.tokenStorage.getTokens();
-			if (!tokens?.workspaceId) return null;
-			const { data } = await this.sdk.client.GET("/v1/workspaces/{id}", {
-				params: { path: { id: tokens.workspaceId } },
-				signal: this.options.signal
-			});
-			const name = data?.data?.name;
-			return typeof name === "string" && name.trim().length > 0 ? name.trim() : null;
-		} catch {
-			this.options.signal?.throwIfAborted();
-			return null;
-		}
-	}
-	get host() {
-		return `${this.options.hostname}:${this.options.port}`;
-	}
-};
-function renderSuccessPage(workspaceName) {
-	return `<!doctype html>
-<html lang="en">
-<head>
-  <meta charset="utf-8">
-  <meta name="viewport" content="width=device-width, initial-scale=1">
-  <title>Prisma Developer Platform</title>
-  <style>
-    :root {
-      color-scheme: light dark;
-      --background: #ffffff;
-      --foreground: #1f2430;
-      --muted: #4f5665;
-      --mark-color: #050812;
-      --surface: #f6f7fb;
-      --border: #e4e7ee;
-      --success: #15803d;
-    }
-
-    @media (prefers-color-scheme: dark) {
-      :root {
-        --background: #050812;
-        --foreground: #f6f7fb;
-        --muted: #c5cad6;
-        --mark-color: #ffffff;
-        --surface: #0d1322;
-        --border: #232a3d;
-        --success: #4ade80;
-      }
-    }
-
-    * {
-      box-sizing: border-box;
-    }
-
-    body {
-      min-height: 100vh;
-      margin: 0;
-      background: var(--background);
-      color: var(--foreground);
-      font-family: system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
-      display: grid;
-      grid-template-rows: 128px 1fr;
-    }
-
-    .mark {
-      align-self: end;
-      justify-self: center;
-      width: 36px;
-      height: 36px;
-      color: var(--mark-color);
-    }
-
-    .mark path {
-      fill: currentColor !important;
-    }
-
-    main {
-      align-self: center;
-      justify-self: center;
-      width: min(520px, calc(100vw - 48px));
-      margin-top: -128px;
-      text-align: center;
-    }
-
-    h1 {
-      margin: 0 0 12px;
-      font-size: 26px;
-      line-height: 1.2;
-      font-weight: 700;
-      letter-spacing: 0;
-    }
-
-    p {
-      margin: 0 auto;
-      max-width: 480px;
-      color: var(--muted);
-      font-size: 15px;
-      line-height: 1.55;
-      letter-spacing: 0;
-    }
-
-    .skills {
-      margin-top: 40px;
-      padding-top: 28px;
-      border-top: 1px solid var(--border);
-      text-align: left;
-    }
-
-    .skills-lead {
-      display: flex;
-      align-items: center;
-      gap: 8px;
-      margin: 0 0 12px;
-      font-size: 15px;
-      color: var(--foreground);
-    }
-
-    .skills-lead svg {
-      flex: none;
-      color: var(--muted);
-    }
-
-    .command {
-      display: flex;
-      align-items: center;
-      gap: 8px;
-      padding: 10px 8px 10px 16px;
-      background: var(--surface);
-      border: 1px solid var(--border);
-      border-radius: 8px;
-    }
-
-    .command code {
-      flex: 1;
-      overflow-x: auto;
-      font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
-      font-size: 13.5px;
-      white-space: nowrap;
-    }
-
-    .command .prompt {
-      color: var(--muted);
-      user-select: none;
-    }
-
-    .copy {
-      flex: none;
-      display: grid;
-      place-items: center;
-      padding: 6px;
-      border: 0;
-      border-radius: 6px;
-      background: transparent;
-      color: var(--muted);
-      cursor: pointer;
-    }
-
-    .copy:hover {
-      background: var(--border);
-      color: var(--foreground);
-    }
-
-    .copy .icon-check,
-    .copy.copied .icon-copy {
-      display: none;
-    }
-
-    .copy.copied .icon-check {
-      display: block;
-    }
-
-    .copy.copied,
-    .copy.copied:hover {
-      color: var(--success);
-    }
-
-    .visually-hidden {
-      position: absolute;
-      width: 1px;
-      height: 1px;
-      margin: -1px;
-      padding: 0;
-      overflow: hidden;
-      clip: rect(0 0 0 0);
-      white-space: nowrap;
-      border: 0;
-    }
-  </style>
-</head>
-<body>
-  <svg class="mark" width="36" height="36" viewBox="0 0 32 32" xmlns="http://www.w3.org/2000/svg"><path d="M25.21,24.21,12.739,27.928a.525.525,0,0,1-.667-.606L16.528,5.811a.43.43,0,0,1,.809-.094l8.249,17.661A.6.6,0,0,1,25.21,24.21Zm2.139-.878L17.8,2.883h0A1.531,1.531,0,0,0,16.491,2a1.513,1.513,0,0,0-1.4.729L4.736,19.648a1.592,1.592,0,0,0,.018,1.7l5.064,7.909a1.628,1.628,0,0,0,1.83.678l14.7-4.383a1.6,1.6,0,0,0,1-2.218Z" style="fill:#0c344b;fill-rule:evenodd"/></svg>
-  <main>
-    <h1>You're all set.</h1>
-    <p>${workspaceName ? `Your terminal is now connected to your ${escapeHtml(workspaceName)} workspace. Head back to your terminal to continue.` : "Your terminal is now connected to your Prisma workspace. Head back to your terminal to continue."}</p>
-    <section class="skills">
-      <div class="skills-lead">
-        <svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M9.937 15.5A2 2 0 0 0 8.5 14.063l-6.135-1.582a.5.5 0 0 1 0-.962L8.5 9.936A2 2 0 0 0 9.937 8.5l1.582-6.135a.5.5 0 0 1 .963 0L14.063 8.5A2 2 0 0 0 15.5 9.937l6.135 1.581a.5.5 0 0 1 0 .964L15.5 14.063a2 2 0 0 0-1.437 1.437l-1.582 6.135a.5.5 0 0 1-.963 0z"/><path d="M20 3v4"/><path d="M22 5h-4"/></svg>
-        Using an AI coding agent? Add the Prisma skills:
-      </div>
-      <div class="command">
-        <code><span class="prompt">$ </span><span class="command-text">npx skills add prisma/skills</span></code>
-        <button class="copy" type="button" aria-label="Copy command to clipboard">
-          <svg class="icon-copy" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><rect width="14" height="14" x="8" y="8" rx="2" ry="2"/><path d="M4 16c-1.1 0-2-.9-2-2V4c0-1.1.9-2 2-2h10c1.1 0 2 .9 2 2"/></svg>
-          <svg class="icon-check" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><polyline points="20 6 9 17 4 12"/></svg>
-        </button>
-      </div>
-      <span class="visually-hidden skills-status" role="status"></span>
-    </section>
-  </main>
-  <script>
-    (() => {
-      const command = "npx skills add prisma/skills";
-      const button = document.querySelector(".copy");
-      const status = document.querySelector(".skills-status");
-      let timer;
-      button.addEventListener("click", async () => {
-        try {
-          await navigator.clipboard.writeText(command);
-        } catch {
-          // Clipboard access denied: select the command so Cmd/Ctrl+C works.
-          const range = document.createRange();
-          range.selectNodeContents(document.querySelector(".command-text"));
-          const selection = window.getSelection();
-          selection.removeAllRanges();
-          selection.addRange(range);
-          status.textContent =
-            "Copying failed. The command is selected; press Ctrl+C or Cmd+C to copy it.";
-          return;
-        }
-        button.classList.add("copied");
-        status.textContent = "Command copied to clipboard.";
-        clearTimeout(timer);
-        timer = setTimeout(() => {
-          button.classList.remove("copied");
-          status.textContent = "";
-        }, 2000);
-      });
-    })();
-  <\/script>
-</body>
-</html>`;
-}
-function escapeHtml(value) {
-	return value.replace(/[&<>"']/g, (char) => {
-		switch (char) {
-			case "&": return "&amp;";
-			case "<": return "&lt;";
-			case ">": return "&gt;";
-			case "\"": return "&quot;";
-			case "'": return "&#39;";
-			default: return char;
-		}
-	});
-}
-//#endregion
-export { AuthError$1 as AuthError, login };

package/dist/auth/operations.js

@@ -1,208 +0,0 @@
-import { FileTokenStorage } from "./token-storage.js";
-import { authenticatedManagementApiClient } from "./guard.js";
-import { AuthError, login } from "./login.js";
-import { SERVICE_TOKEN_ENV_VAR, claimedExpiresAt, credentialWorkspaceId } from "@prisma/cli-engine";
-//#region src/auth/operations.ts
-const WORKSPACE_SUB_PREFIX = "workspace:";
-/** Thrown when PRISMA_SERVICE_TOKEN is set to an empty/blank value. */
-var EmptyServiceTokenError = class extends Error {
-	code = "EMPTY_SERVICE_TOKEN";
-	constructor() {
-		super(`${SERVICE_TOKEN_ENV_VAR} is set but empty. Provide a valid token or unset the variable.`);
-		this.name = "EmptyServiceTokenError";
-	}
-};
-/** Matches by the code discriminator, not instanceof, so the check
-*  survives duplicate module instances. */
-function isEmptyServiceTokenError(error) {
-	return typeof error === "object" && error !== null && error.code === "EMPTY_SERVICE_TOKEN";
-}
-function decodeJwtPayload(token) {
-	try {
-		const payload = token.split(".")[1];
-		if (!payload) return {};
-		return JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
-	} catch {
-		return {};
-	}
-}
-function emailFromClaims(claims) {
-	const email = claims.email;
-	return typeof email === "string" && email.trim().length > 0 ? email.trim() : null;
-}
-function workspaceIdFromClaims(claims) {
-	const sub = claims.sub;
-	if (typeof sub !== "string") return null;
-	if (!sub.startsWith(WORKSPACE_SUB_PREFIX)) return null;
-	const id = sub.slice(10).trim();
-	return id.length > 0 ? id : null;
-}
-/** Holds the tokens the SDK writes at callback time and nothing else:
-*  minting and custody stay separate, so a login never writes through
-*  the credential manager. */
-var ThrowawayTokenStorage = class {
-	tokens = null;
-	async getTokens() {
-		return this.tokens;
-	}
-	async setTokens(tokens) {
-		this.tokens = tokens;
-	}
-	async clearTokens() {
-		this.tokens = null;
-	}
-};
-/** Runs the browser consent flow and RETURNS the minted credential.
-*  Storing it is the caller's job. */
-async function performLogin(env, signal, options) {
-	const tokenStorage = new ThrowawayTokenStorage();
-	await login({
-		tokenStorage,
-		env,
-		signal,
-		onVerificationUrl: options?.onVerificationUrl
-	});
-	const tokens = tokenStorage.tokens;
-	if (!tokens) throw new AuthError("Sign-in finished without producing a credential.");
-	return {
-		token: tokens.accessToken,
-		refreshToken: tokens.refreshToken,
-		expiresAt: claimedExpiresAt(tokens.accessToken)
-	};
-}
-/** Writes a minted credential into the legacy store, which the legacy
-*  shell still reads. Dies with the legacy shell. */
-async function storeLegacyCredential(env, credential, signal) {
-	const workspaceId = credentialWorkspaceId(credential.token);
-	if (workspaceId === void 0) return;
-	await new FileTokenStorage(env, signal, { activateOnSetTokens: true }).setTokens({
-		workspaceId,
-		accessToken: credential.token,
-		...credential.refreshToken === void 0 ? {} : { refreshToken: credential.refreshToken }
-	});
-}
-async function readAuthState(env, signal) {
-	const rawServiceToken = env[SERVICE_TOKEN_ENV_VAR];
-	if (rawServiceToken !== void 0) {
-		const serviceToken = rawServiceToken.trim();
-		if (serviceToken.length === 0) throw new EmptyServiceTokenError();
-		return readServiceTokenAuthState(serviceToken, env, signal);
-	}
-	const tokenStorage = new FileTokenStorage(env, signal);
-	const tokens = await tokenStorage.getTokens();
-	if (!tokens) return {
-		authenticated: false,
-		provider: null,
-		user: null,
-		workspace: null,
-		credential: null
-	};
-	const client = await authenticatedManagementApiClient(env, signal);
-	const currentPrincipal = await readCurrentPrincipalAuthState(client, signal);
-	if (currentPrincipal) {
-		if (currentPrincipal.authenticated && currentPrincipal.workspace) await tokenStorage.rememberWorkspace?.(tokens.workspaceId, currentPrincipal.workspace);
-		return currentPrincipal;
-	}
-	const claims = decodeJwtPayload(tokens.accessToken);
-	const authState = await buildAuthState({
-		workspaceIdFromCredential: tokens.workspaceId,
-		claims,
-		env,
-		client,
-		signal
-	});
-	if (authState.authenticated && authState.workspace) await tokenStorage.rememberWorkspace?.(tokens.workspaceId, authState.workspace);
-	return authState;
-}
-async function readServiceTokenAuthState(token, env, signal) {
-	const client = await authenticatedManagementApiClient(env, signal);
-	const currentPrincipal = await readCurrentPrincipalAuthState(client, signal);
-	if (currentPrincipal) return currentPrincipal;
-	const claims = decodeJwtPayload(token);
-	const workspaceId = workspaceIdFromClaims(claims);
-	if (!workspaceId) return {
-		authenticated: false,
-		provider: null,
-		user: null,
-		workspace: null,
-		credential: null
-	};
-	return buildAuthState({
-		workspaceIdFromCredential: workspaceId,
-		claims,
-		env,
-		client,
-		signal
-	});
-}
-async function buildAuthState({ workspaceIdFromCredential, claims, env, client, signal }) {
-	let workspaceId = workspaceIdFromCredential;
-	let workspaceName = workspaceIdFromCredential;
-	client ??= await authenticatedManagementApiClient(env, signal);
-	if (client) try {
-		const { data, response } = await client.GET("/v1/workspaces/{id}", {
-			params: { path: { id: workspaceIdFromCredential } },
-			signal
-		});
-		if (response?.status === 401) return {
-			authenticated: false,
-			provider: null,
-			user: null,
-			workspace: null,
-			credential: null
-		};
-		if (data?.data?.id) {
-			workspaceId = data.data.id;
-			workspaceName = data.data.id;
-		}
-		if (data?.data?.name) workspaceName = data.data.name;
-	} catch {
-		signal?.throwIfAborted();
-	}
-	const email = emailFromClaims(claims);
-	return {
-		authenticated: true,
-		provider: null,
-		user: email ? { email } : null,
-		workspace: {
-			id: workspaceId,
-			name: workspaceName
-		},
-		credential: null
-	};
-}
-async function readCurrentPrincipalAuthState(client, signal) {
-	if (!client) return null;
-	try {
-		const { data, response } = await client.GET("/v1/me", { signal });
-		if (response?.status === 401) return {
-			authenticated: false,
-			provider: null,
-			user: null,
-			workspace: null,
-			credential: null
-		};
-		const principal = data?.data;
-		if (!principal) return null;
-		if (!principal.credential) return null;
-		return {
-			authenticated: true,
-			provider: null,
-			user: principal.user ? {
-				id: principal.user.id,
-				email: principal.user.email,
-				name: principal.user.name
-			} : null,
-			workspace: principal.workspace,
-			credential: principal.credential
-		};
-	} catch {
-		signal?.throwIfAborted();
-		return null;
-	}
-}
-async function performLogout(env, signal) {
-	await new FileTokenStorage(env, signal).clearTokens();
-}
-//#endregion
-export { isEmptyServiceTokenError, performLogin, performLogout, readAuthState, storeLegacyCredential };