@pyai/sdk 0.3.1 → 0.5.0

package/src/cli-web-auth.ts

@@ -0,0 +1,148 @@
+/** Browser approval with outbound-only polling, suitable for local and SSH terminals. */
+import { createHash, randomBytes } from "node:crypto";
+import { spawn } from "node:child_process";
+import { CliError, type CliHttp } from "./cli-http.ts";
+import { normalizeBaseURL, validateApiKey } from "./cli-config.ts";
+
+export interface AuthorizationNotice {
+  event: "authorization_required";
+  verification_uri: string;
+  verification_uri_complete: string;
+  user_code: string;
+  expires_in: number;
+}
+
+export interface BrowserCredential {
+  api_key: string;
+  key_id: string;
+  org_id: string;
+  project_id: string;
+  environment: "live" | "test";
+  scopes: string[];
+  expires_at: number;
+}
+
+export interface BrowserLoginOptions {
+  http: Pick<CliHttp, "json">;
+  baseURL: string;
+  noBrowser?: boolean;
+  timeoutMs?: number;
+  requestTimeoutMs?: number;
+  onAuthorization: (notice: AuthorizationNotice) => void;
+  onBrowserUnavailable?: () => void;
+  onSecret?: (secret: string) => void;
+  // Injectable boundaries keep protocol tests offline and deterministic.
+  open?: (url: string) => Promise<boolean>;
+  now?: () => number;
+  sleep?: (ms: number) => Promise<void>;
+}
+
+/** No shell interpolation, URL handlers, or incoming callback listener. */
+export async function openBrowser(url: string): Promise<boolean> {
+  const command = process.platform === "darwin" ? "open" : process.platform === "win32" ? "rundll32.exe" : "xdg-open";
+  const args = process.platform === "win32" ? ["url.dll,FileProtocolHandler", url] : [url];
+  return new Promise(resolve => {
+    try {
+      const child = spawn(command, args, { detached: true, stdio: "ignore", shell: false });
+      child.once("error", () => resolve(false));
+      child.once("spawn", () => { child.unref(); resolve(true); });
+    } catch { resolve(false); }
+  });
+}
+
+function invalidResponse(): never {
+  throw new CliError("invalid_response", "The API returned an invalid browser authorization response", 1);
+}
+
+function verificationURLs(data: Record<string, unknown>, baseURL: string): AuthorizationNotice {
+  const code = data.user_code;
+  if (typeof code !== "string" || !/^[A-Za-z0-9-]{6,24}$/.test(code)) invalidResponse();
+  if (typeof data.expires_in !== "number" || !Number.isFinite(data.expires_in) || data.expires_in <= 0 || data.expires_in > 3600) invalidResponse();
+  let plain: URL; let complete: URL;
+  try { plain = new URL(String(data.verification_uri)); complete = new URL(String(data.verification_uri_complete)); }
+  catch { invalidResponse(); }
+  // Never hand a custom protocol or a credential-bearing URL to the OS browser launcher.
+  try { normalizeBaseURL(plain!.origin); normalizeBaseURL(complete!.origin); } catch { invalidResponse(); }
+  if (plain!.username || plain!.password || plain!.search || plain!.hash || plain!.pathname !== "/cli/login"
+    || complete!.username || complete!.password || complete!.hash || complete!.origin !== plain!.origin
+    || complete!.pathname !== "/cli/login" || complete!.searchParams.get("user_code") !== code
+    || [...complete!.searchParams.keys()].some(key => key !== "user_code")
+    || complete!.searchParams.getAll("user_code").length !== 1) invalidResponse();
+  if (new URL(baseURL).origin === "https://api.pyai.com" && plain!.origin !== "https://console.pyai.com") invalidResponse();
+  return { event: "authorization_required", verification_uri: plain!.href,
+    verification_uri_complete: complete!.href, user_code: code, expires_in: data.expires_in };
+}
+
+function redact(error: unknown, secrets: string[]): unknown {
+  if (!(error instanceof CliError)) return error;
+  const safe = (value: unknown): unknown => {
+    if (typeof value === "string") return secrets.reduce((v, s) => s ? v.split(s).join("[REDACTED]").split(encodeURIComponent(s)).join("[REDACTED]") : v, value);
+    if (Array.isArray(value)) return value.map(safe);
+    if (value && typeof value === "object") return Object.fromEntries(Object.entries(value).map(([k, v]) => [k, safe(v)]));
+    return value;
+  };
+  return new CliError(safe(error.code) as string, safe(error.message) as string, error.exitCode, safe(error.details) as Record<string, unknown> | undefined);
+}
+
+export async function browserLogin(options: BrowserLoginOptions): Promise<BrowserCredential> {
+  const now = options.now ?? Date.now;
+  const sleep = options.sleep ?? (ms => new Promise(resolve => setTimeout(resolve, ms)));
+  const duration = options.timeoutMs ?? 600_000;
+  if (!Number.isFinite(duration) || duration <= 0 || duration > 3_600_000) throw new CliError("invalid_arguments", "Login timeout must be between 0 and 3600 seconds", 2);
+  const started = now();
+  const verifier = randomBytes(32).toString("base64url");
+  const secrets = [verifier];
+  options.onSecret?.(verifier);
+  const challenge = createHash("sha256").update(verifier).digest("base64url");
+  try {
+    let grant;
+    try {
+      grant = await options.http.json("POST", "/auth/cli/device", { auth: false,
+        timeoutMs: Math.min(duration, options.requestTimeoutMs ?? 30_000),
+        json: { client_name: "PyAI CLI", code_challenge: challenge, code_challenge_method: "S256" } });
+    } catch (error) {
+      if (error instanceof CliError && error.details?.status === 404) {
+        throw new CliError("browser_login_unavailable", "Browser login is not available on this deployment yet. Use auth login --key-stdin or deploy the CLI login API and console page.", 1);
+      }
+      throw error;
+    }
+    if (!grant || typeof grant !== "object" || typeof grant.device_code !== "string"
+      || grant.device_code.length < 32 || grant.device_code.length > 512 || /[\s\x00-\x1f\x7f]/.test(grant.device_code)) invalidResponse();
+    secrets.push(grant.device_code); options.onSecret?.(grant.device_code);
+    const notice = verificationURLs(grant, options.baseURL);
+    if (typeof grant.interval !== "number" || !Number.isFinite(grant.interval) || grant.interval < 1 || grant.interval > 60) invalidResponse();
+    let interval = grant.interval * 1000;
+    const deadline = Math.min(started + duration, now() + notice.expires_in * 1000);
+    options.onAuthorization(notice);
+    if (!options.noBrowser && !(await (options.open ?? openBrowser)(notice.verification_uri_complete))) options.onBrowserUnavailable?.();
+    for (;;) {
+      const remaining = deadline - now();
+      if (remaining <= interval) {
+        if (remaining > 0) await sleep(remaining);
+        throw new CliError("login_timeout", "Browser login expired before completion. Run pyai auth login again.", 4);
+      }
+      await sleep(interval);
+      try {
+        const result = await options.http.json("POST", "/auth/cli/device/token", { auth: false,
+          timeoutMs: Math.min(deadline - now(), options.requestTimeoutMs ?? 30_000),
+          json: { device_code: grant.device_code, code_verifier: verifier } });
+        if (!result || typeof result.api_key !== "string") invalidResponse();
+        secrets.push(result.api_key); options.onSecret?.(result.api_key);
+        validateApiKey(result.api_key);
+        if (!["key_id", "org_id", "project_id"].every(key => typeof result[key] === "string" && result[key].length > 0)
+          || !["test", "live"].includes(result.environment) || !Array.isArray(result.scopes) || !result.scopes.every((s: unknown) => typeof s === "string")
+          || typeof result.expires_at !== "number" || !Number.isFinite(result.expires_at) || result.expires_at <= now()) invalidResponse();
+        return result as BrowserCredential;
+      } catch (error) {
+        if (!(error instanceof CliError)) throw error;
+        // Only protocol-level pending responses are safe to poll again. A lost
+        // success is ambiguous: do not replay a potentially consumed grant.
+        if (error.details?.status === 400 && error.code === "authorization_pending") continue;
+        if (error.details?.status === 400 && error.code === "slow_down") { interval += 5000; continue; }
+        if (error.code === "access_denied") throw new CliError("access_denied", "Browser login was declined. No credentials were saved.", 3);
+        if (["expired_token", "invalid_grant"].includes(error.code)) throw new CliError(error.code, "This login request has expired or was already used. Run pyai auth login again.", 3);
+        throw error;
+      }
+    }
+  } catch (error) { throw redact(error, secrets); }
+}