@ralphkrauss/codex-account-switcher 0.1.4 → 0.1.6

package/src/remote.ts

@@ -17,7 +17,9 @@ import {
   getCodexPaths,
   listAccountNames,
   resolveExecutable,
+  useAccount,
   validateAccountName,
+  writebackCurrentAccount,
   type CodexPaths,
 } from './accounts.js';
 
@@ -112,6 +114,23 @@ export interface SyncStatus {
   readonly accounts: readonly SyncStatusAccount[];
 }
 
+export interface SetupOnePasswordProfilesInput extends ConfigureOnePasswordRemoteInput {
+  readonly pull?: boolean;
+  readonly force?: boolean;
+  readonly use?: string;
+}
+
+export interface SetupOnePasswordProfilesResult {
+  readonly configPath: string;
+  readonly remoteConfigured: boolean;
+  readonly opAvailable: boolean;
+  readonly vault: string;
+  readonly itemPrefix: string;
+  readonly remoteAccounts: readonly string[];
+  readonly pulledAccounts: readonly string[];
+  readonly usedAccount: string | null;
+}
+
 interface OpResult {
   readonly exitCode: number;
   readonly stdout: string;
@@ -414,6 +433,68 @@ function itemTitle(config: RemoteConfig, account: string): string {
   return `${config.itemPrefix}${account}`;
 }
 
+function accountNameFromItemTitle(config: RemoteConfig, title: string): string | null {
+  if (!title.startsWith(config.itemPrefix)) {
+    return null;
+  }
+  const account = title.slice(config.itemPrefix.length);
+  try {
+    const safeAccount = validateAccountName(account);
+    return safeAccount === 'default' ? null : safeAccount;
+  } catch {
+    return null;
+  }
+}
+
+function sortedUnique(values: Iterable<string>): string[] {
+  return [...new Set(values)].sort((left, right) => left.localeCompare(right));
+}
+
+function parseOnePasswordItemTitles(stdout: string, action: string): string[] {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(stdout) as unknown;
+  } catch (error) {
+    throw new CxError(`1Password item list JSON could not be parsed while ${action}: ${errorMessage(error)}`, 1);
+  }
+  if (!Array.isArray(parsed)) {
+    throw new CxError(`1Password item list did not return an array while ${action}`, 1);
+  }
+  return parsed
+    .map((item) => (isRecord(item) && typeof item.title === 'string' ? item.title : null))
+    .filter((title): title is string => title !== null);
+}
+
+async function listOnePasswordAccountNames(
+  config: RemoteConfig,
+  env: NodeJS.ProcessEnv,
+): Promise<string[]> {
+  const result = await runOp([
+    'item',
+    'list',
+    '--vault',
+    config.vault,
+    '--format',
+    'json',
+  ], env, `listing 1Password items in vault '${config.vault}'`);
+
+  return sortedUnique(
+    parseOnePasswordItemTitles(result.stdout, `listing 1Password items in vault '${config.vault}'`)
+      .map((title) => accountNameFromItemTitle(config, title))
+      .filter((account): account is string => account !== null),
+  );
+}
+
+async function verifyOnePasswordVault(config: RemoteConfig, env: NodeJS.ProcessEnv): Promise<void> {
+  await runOp([
+    'vault',
+    'get',
+    config.vault,
+    '--format',
+    'json',
+  ], env, `checking 1Password vault '${config.vault}'`);
+}
+
 function validateRemoteSyncAccountName(account: string): string {
   const safeAccount = validateAccountName(account);
   if (safeAccount === 'default') {
@@ -518,12 +599,64 @@ function decodeAuthJsonField(stdout: string, item: string): string {
   }
 }
 
+function decodeAuthJsonFieldFromItemJson(stdout: string, item: string): string {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(stdout) as unknown;
+  } catch (error) {
+    throw new CxError(`1Password item '${item}' JSON could not be parsed: ${errorMessage(error)}`, 1);
+  }
+
+  if (!isRecord(parsed) || !Array.isArray(parsed.fields)) {
+    throw new CxError(`1Password item '${item}' does not contain fields metadata`, 1);
+  }
+
+  const field = parsed.fields.find((candidate: unknown): candidate is Record<string, unknown> => (
+    isRecord(candidate) && candidate.label === ONEPASSWORD_AUTH_FIELD
+  ));
+  if (!field) {
+    throw new CxError(`1Password item '${item}' does not contain a revealable '${ONEPASSWORD_AUTH_FIELD}' field`, 1);
+  }
+  if (typeof field.value !== 'string') {
+    throw new CxError(`1Password item '${item}' field '${ONEPASSWORD_AUTH_FIELD}' did not contain a string value`, 1);
+  }
+
+  parseAuthJsonString(field.value, `auth_json field in 1Password item '${item}'`);
+  return field.value;
+}
+
 async function readOnePasswordAuthJson(
   config: RemoteConfig,
   item: string,
   env: NodeJS.ProcessEnv,
 ): Promise<string> {
-  const result = await runOpRaw([
+  const jsonResult = await runOpRaw([
+    'item',
+    'get',
+    item,
+    '--vault',
+    config.vault,
+    '--format',
+    'json',
+  ], env);
+
+  if (jsonResult.exitCode === 0) {
+    try {
+      return decodeAuthJsonFieldFromItemJson(jsonResult.stdout, item);
+    } catch (error) {
+      if (!errorMessage(error).includes(`'${ONEPASSWORD_AUTH_FIELD}'`)) {
+        throw error;
+      }
+      // Fall through to the field-specific command for older op/item shapes.
+    }
+  } else {
+    if (looksLikeMissingItem(jsonResult)) {
+      throw new CxError(`remote account item '${item}' was not found in 1Password vault '${config.vault}'`, 1);
+    }
+    throwOpFailure(`reading 1Password item '${item}'`, jsonResult);
+  }
+
+  const fieldResult = await runOpRaw([
     'item',
     'get',
     item,
@@ -534,16 +667,16 @@ async function readOnePasswordAuthJson(
     '--reveal',
   ], env);
 
-  if (result.exitCode === 0) {
-    return decodeAuthJsonField(result.stdout, item);
+  if (fieldResult.exitCode === 0) {
+    return decodeAuthJsonField(fieldResult.stdout, item);
   }
-  if (looksLikeMissingField(result)) {
+  if (looksLikeMissingField(fieldResult)) {
     throw new CxError(`1Password item '${item}' does not contain a revealable '${ONEPASSWORD_AUTH_FIELD}' field`, 1);
   }
-  if (looksLikeMissingItem(result)) {
+  if (looksLikeMissingItem(fieldResult)) {
     throw new CxError(`remote account item '${item}' was not found in 1Password vault '${config.vault}'`, 1);
   }
-  throwOpFailure(`reading '${ONEPASSWORD_AUTH_FIELD}' from 1Password item '${item}'`, result);
+  throwOpFailure(`reading '${ONEPASSWORD_AUTH_FIELD}' from 1Password item '${item}'`, fieldResult);
 }
 
 async function readLocalAccountAuthJson(
@@ -590,10 +723,13 @@ export async function syncPushAccount(
 ): Promise<SyncPushResult> {
   const env = options.env ?? process.env;
   const paths = remotePaths(options);
-  const [config, local] = await Promise.all([
-    requireRemoteConfig({ paths }),
-    readLocalAccountAuthJson(account, paths),
-  ]);
+  const config = await requireRemoteConfig({ paths });
+  const safeAccount = validateRemoteSyncAccountName(account);
+  const writeback = await writebackCurrentAccount({ paths });
+  if (writeback.performed === true && writeback.account !== safeAccount) {
+    throw new CxError(`unexpected writeback account '${writeback.account}' while syncing '${safeAccount}'`, 1);
+  }
+  const local = await readLocalAccountAuthJson(safeAccount, paths);
   const item = itemTitle(config, local.account);
   const operation = await upsertOnePasswordAuthJson(config, item, local.authJson, env);
 
@@ -629,6 +765,73 @@ export async function syncPullAccount(
   };
 }
 
+export async function listRemoteAccountNames(options: RemoteCliOptions = {}): Promise<string[]> {
+  const env = options.env ?? process.env;
+  const paths = remotePaths(options);
+  const config = await requireRemoteConfig({ paths });
+  return await listOnePasswordAccountNames(config, env);
+}
+
+export async function syncPullAllAccounts(options: RemoteForceOptions = {}): Promise<SyncPullResult[]> {
+  const paths = remotePaths(options);
+  const accounts = await listRemoteAccountNames(options);
+  const results: SyncPullResult[] = [];
+  for (const account of accounts) {
+    const accountFile = accountPathForName(paths, account);
+    if (options.force !== true && await pathExists(accountFile)) {
+      continue;
+    }
+    results.push(await syncPullAccount(account, options));
+  }
+  return results;
+}
+
+export async function syncPushAllAccounts(options: RemoteCliOptions = {}): Promise<SyncPushResult[]> {
+  const paths = remotePaths(options);
+  const accounts = await listRemoteSyncAccountNames(paths);
+  const results: SyncPushResult[] = [];
+  for (const account of accounts) {
+    results.push(await syncPushAccount(account, options));
+  }
+  return results;
+}
+
+export async function setupOnePasswordProfiles(
+  input: SetupOnePasswordProfilesInput,
+  options: RemoteCliOptions = {},
+): Promise<SetupOnePasswordProfilesResult> {
+  const env = options.env ?? process.env;
+  const paths = remotePaths(options);
+  const configured = await configureOnePasswordRemote(input, { paths });
+  await verifyOnePasswordVault(configured.config, env);
+  const remoteAccounts = await listOnePasswordAccountNames(configured.config, env);
+  const pulled = input.pull === true
+    ? await syncPullAllAccounts({ paths, env, force: input.force })
+    : [];
+  let usedAccount: string | null = null;
+
+  if (input.use) {
+    const account = validateRemoteSyncAccountName(input.use);
+    const accountFile = accountPathForName(paths, account);
+    if (!await pathExists(accountFile)) {
+      await syncPullAccount(account, { paths, env, force: input.force });
+    }
+    await useAccount(account, { paths });
+    usedAccount = account;
+  }
+
+  return {
+    configPath: configured.configPath,
+    remoteConfigured: true,
+    opAvailable: true,
+    vault: configured.config.vault,
+    itemPrefix: configured.config.itemPrefix,
+    remoteAccounts,
+    pulledAccounts: pulled.map((entry) => entry.account),
+    usedAccount,
+  };
+}
+
 export async function inspectSyncStatus(
   account?: string,
   options: RemoteCliOptions = {},
@@ -637,9 +840,17 @@ export async function inspectSyncStatus(
   const paths = remotePaths(options);
   const config = await readRemoteConfig({ paths });
   const opPath = await resolveExecutable('op', env);
-  const accounts = account ? [validateRemoteSyncAccountName(account)] : await listRemoteSyncAccountNames(paths);
+  let accounts = account ? [validateRemoteSyncAccountName(account)] : await listRemoteSyncAccountNames(paths);
   const statuses: SyncStatusAccount[] = [];
 
+  if (!account && config && opPath) {
+    try {
+      accounts = sortedUnique([...accounts, ...await listOnePasswordAccountNames(config, env)]);
+    } catch {
+      // Keep local status useful; per-account remote errors are reported below.
+    }
+  }
+
   for (const accountName of accounts) {
     const accountFile = accountPathForName(paths, accountName);
     let presence: RemotePresence = 'unknown';