@sailresearch/code 0.1.0

package/src/login.js

@@ -0,0 +1,453 @@
+/**
+ * Browser device-flow login against the Sail dashboard's `/cli-auth` page.
+ *
+ * We open `{app}/cli-auth?name=…&redirect_uri=http://127.0.0.1:{port}/callback&state=…`
+ * in the user's browser. After the user authenticates, the page mints an API
+ * key and form-POSTs `api_key`, `state`, `mode`, and `api_url` back to our
+ * loopback listener. The key is validated against the returned API URL with a
+ * cheap authenticated call (`GET /v1/models`) before being stored.
+ */
+
+import crypto from "node:crypto";
+import http from "node:http";
+import { spawn } from "node:child_process";
+
+import { DEFAULT_APP_URL, MODE_API_URLS, MODE_VALUES } from "./constants.js";
+import {
+  authPath,
+  maskSecret,
+  saveAuthKey,
+  saveLoginSettings,
+} from "./credentials.js";
+
+const LOGIN_TIMEOUT_MS = 10 * 60 * 1000;
+const MAX_CALLBACK_BODY_BYTES = 64 * 1024;
+
+/**
+ * Reject a login callback that landed on a different environment than the
+ * one the invocation explicitly requested (via --mode, SAIL_MODE,
+ * SAIL_API_URL, or a stored config target). Without this, `SAIL_API_URL=…
+ * sail-code` with no stored key would let the default (prod) browser login
+ * silently retarget the session and store a key tagged for the wrong
+ * environment. The implicit prod default is not enforced, so SAIL_APP_URL
+ * driven logins against other environments stay possible. Exported for tests.
+ */
+export function assertLoginTargetMatches({
+  expectedTarget,
+  expectedSource,
+  apiUrl,
+}) {
+  if (!expectedTarget || expectedSource === "default") return;
+  const expected = expectedTarget.trim().replace(/\/+$/, "");
+  if (expected !== "" && expected !== apiUrl) {
+    throw new Error(
+      `this login is for ${apiUrl}, but ${expectedSource} requests ${expected}; ` +
+        `set SAIL_APP_URL to that environment's web app and try again`,
+    );
+  }
+}
+
+/**
+ * Fail *before* opening the browser when the dashboard we'd open cannot mint a
+ * key for the requested environment. The only unambiguous case is the default
+ * (prod) web app paired with an explicit non-prod/custom target (`--mode dev`,
+ * `SAIL_MODE=staging`, a non-prod `SAIL_API_URL`, or a stored non-prod target):
+ * that app can only mint a production key, which `assertLoginTargetMatches`
+ * would later reject — but only after the dashboard already minted an unused
+ * prod credential. Preflighting here avoids that orphan key. A custom
+ * `SAIL_APP_URL` is left alone: it may legitimately mint the requested
+ * environment's key, and the loopback callback + `assertLoginTargetMatches`
+ * adjudicate it. Exported for tests. `appUrl` is the normalized dashboard URL.
+ */
+export function assertLoginAppCanMintTarget({
+  expectedTarget,
+  expectedSource,
+  appUrl,
+}) {
+  if (!expectedTarget || expectedSource === "default") return;
+  const expected = expectedTarget.trim().replace(/\/+$/, "");
+  const defaultApp = DEFAULT_APP_URL.replace(/\/+$/, "");
+  const prod = MODE_API_URLS.prod.replace(/\/+$/, "");
+  if (appUrl === defaultApp && expected !== "" && expected !== prod) {
+    throw new Error(
+      `logging in at ${defaultApp} can only mint a production key, but ` +
+        `${expectedSource} requests ${expected}. Set SAIL_APP_URL to that ` +
+        `environment's web app, or set SAIL_API_KEY to a key for it.`,
+    );
+  }
+}
+
+/**
+ * Run the browser login flow and persist the credential. Returns
+ * `{ apiKey, apiUrl }`. `expectedTarget`/`expectedSource` (from
+ * `resolveTarget`) pin the environment this invocation asked for: a callback
+ * for a different one fails loudly rather than storing a key tagged for the
+ * wrong target.
+ */
+export async function browserLogin({
+  expectedTarget,
+  expectedSource,
+  _readPastedKey = readPastedKeyFromStdin,
+} = {}) {
+  const appUrl = (process.env.SAIL_APP_URL?.trim() || DEFAULT_APP_URL).replace(
+    /\/+$/,
+    "",
+  );
+  // Bail before minting an unusable key if the dashboard can't serve the
+  // requested environment (e.g. `--mode dev` with the default prod app).
+  assertLoginAppCanMintTarget({ expectedTarget, expectedSource, appUrl });
+  const state = crypto.randomBytes(32).toString("hex");
+
+  const { server, port, callback } = await startCallbackServer(state);
+  const loginUrl =
+    `${appUrl}/cli-auth?name=sail-code` +
+    `&redirect_uri=${encodeURIComponent(`http://127.0.0.1:${port}/callback`)}` +
+    `&state=${state}`;
+  // Same page without redirect_uri/state renders the key as copyable text
+  // instead of auto-POSTing it — the manual path for when the browser can't
+  // reach this machine's loopback (SSH, WSL, a container).
+  const manualUrl = `${appUrl}/cli-auth?name=sail-code`;
+
+  console.error(`Opening browser to log in to Sail…\n  ${loginUrl}\n`);
+  openBrowser(loginUrl);
+  console.error(
+    "If your browser opened on a different machine (SSH/WSL/container) and " +
+      "the login doesn't complete on its own, open this URL instead, then " +
+      "paste the key here and press Enter:\n" +
+      `  ${manualUrl}\n`,
+  );
+
+  // The manual paste yields only the key; its environment is this invocation's
+  // resolved target (or prod by default). validateKey below rejects a paste
+  // for the wrong environment, so a mismatch fails loudly rather than storing
+  // a mis-tagged key.
+  const manualApiUrl = manualPasteApiUrl(expectedTarget);
+  // Only SAIL_APP_URL customized the dashboard (no --mode / SAIL_API_URL): the
+  // loopback callback would learn that app's API URL from the POST, but the
+  // paste path has no such signal and manualApiUrl falls back to prod. Storing
+  // a key minted by a custom dashboard as prod is wrong, so the paste path
+  // fails closed here and asks for an explicit SAIL_API_URL. (The loopback
+  // path is unaffected and still works for a local browser.)
+  const pasteTargetAmbiguous = pasteTargetIsAmbiguous({
+    appUrl,
+    expectedSource,
+  });
+  const paste = _readPastedKey();
+
+  let result;
+  try {
+    result = await Promise.race([
+      callback,
+      paste.promise.then((apiKey) => {
+        if (pasteTargetAmbiguous) {
+          throw new Error(
+            `SAIL_APP_URL points at ${appUrl}, but no SAIL_API_URL was set, so ` +
+              "a pasted key's environment can't be determined (it would be " +
+              "stored as production). Re-run with SAIL_API_URL set to that " +
+              "environment's API endpoint, or complete the login in a local " +
+              "browser.",
+          );
+        }
+        return {
+          api_key: apiKey,
+          // Recover the named mode from the resolved target so a pasted login
+          // for `--mode dev`/SAIL_MODE=staging persists the mode (not just the
+          // api_url override) to ~/.sail — otherwise the Sail CLI/SDK keep prod
+          // defaults for sibling endpoints (sailbox/imagebuilder). The loopback
+          // path gets this from the page; the paste path has only the URL.
+          mode: modeForApiUrl(manualApiUrl),
+          api_url: manualApiUrl,
+        };
+      }),
+    ]);
+  } finally {
+    server.close();
+    // Node 18's close() leaves idle keep-alive sockets (e.g. the browser's)
+    // open for their timeout, which would keep the process alive post-login.
+    server.closeAllConnections?.();
+    paste.cancel();
+  }
+
+  const apiUrl = result.api_url?.trim().replace(/\/+$/, "");
+  if (!apiUrl) {
+    throw new Error("login callback did not include an API URL — try again");
+  }
+  const mode = MODE_VALUES.includes(result.mode) ? result.mode : null;
+
+  assertLoginTargetMatches({ expectedTarget, expectedSource, apiUrl });
+
+  await validateKey(result.api_key, apiUrl);
+
+  saveAuthKey(result.api_key);
+  saveLoginSettings({ target: apiUrl, mode });
+  console.error(
+    `Logged in. Credential ${maskSecret(result.api_key)} saved to ${authPath()}.`,
+  );
+  return { apiKey: result.api_key, apiUrl };
+}
+
+/** A cheap authenticated call proves the key works before we store it. */
+async function validateKey(apiKey, apiUrl) {
+  let res;
+  try {
+    res = await fetch(`${apiUrl}/v1/models`, {
+      headers: { Authorization: `Bearer ${apiKey}` },
+      signal: AbortSignal.timeout(30_000),
+    });
+  } catch (err) {
+    throw new Error(
+      `could not validate the API key against ${apiUrl} (${err.message})`,
+    );
+  }
+  if (res.status === 401 || res.status === 403) {
+    throw new Error(`API key rejected by ${apiUrl} (HTTP ${res.status})`);
+  }
+  if (!res.ok) {
+    throw new Error(
+      `could not validate the API key against ${apiUrl} (HTTP ${res.status})`,
+    );
+  }
+}
+
+/**
+ * Loopback listener for the `/cli-auth` form POST. Requests with a wrong
+ * state or shape get an error response and the listener keeps waiting, so a
+ * stray request cannot hijack or kill the login.
+ */
+function startCallbackServer(expectedState) {
+  return new Promise((resolveServer, rejectServer) => {
+    let settle;
+    const callback = new Promise((resolve, reject) => {
+      settle = { resolve, reject };
+      setTimeout(
+        () =>
+          reject(
+            new Error(
+              "timed out waiting for the browser login — run `sail-code login` to retry, " +
+                "or create a key at the Sail dashboard and export SAIL_API_KEY",
+            ),
+          ),
+        LOGIN_TIMEOUT_MS,
+      ).unref();
+    });
+
+    // Any throw in here must answer the request, never kill the process: a
+    // stray or hostile local request may not end the login flow.
+    const reject400 = (res) => {
+      try {
+        res
+          .writeHead(400, { "Content-Type": "text/plain" })
+          .end("invalid login callback");
+      } catch {
+        // Socket already gone; nothing to answer.
+      }
+    };
+    const server = http.createServer((req, res) => {
+      try {
+        handleCallbackRequest(req, res);
+      } catch {
+        reject400(res);
+      }
+    });
+
+    function handleCallbackRequest(req, res) {
+      if (
+        req.method !== "POST" ||
+        new URL(req.url, "http://127.0.0.1").pathname !== "/callback"
+      ) {
+        res.writeHead(404, { "Content-Type": "text/plain" }).end("not found");
+        return;
+      }
+      let body = "";
+      let overflow = false;
+      req.on("data", (chunk) => {
+        body += chunk;
+        if (body.length > MAX_CALLBACK_BODY_BYTES) {
+          overflow = true;
+          req.destroy();
+        }
+      });
+      req.on("end", () => {
+        if (overflow) return;
+        try {
+          const params = new URLSearchParams(body);
+          const state = params.get("state") ?? "";
+          const apiKey = params.get("api_key") ?? "";
+          // Compare byte buffers: timingSafeEqual throws on unequal lengths,
+          // and multibyte characters make string length ≠ byte length.
+          const stateBuf = Buffer.from(state);
+          const expectedBuf = Buffer.from(expectedState);
+          const stateOk =
+            stateBuf.length === expectedBuf.length &&
+            crypto.timingSafeEqual(stateBuf, expectedBuf);
+          if (!stateOk || apiKey === "") {
+            reject400(res);
+            return;
+          }
+          res
+            .writeHead(200, { "Content-Type": "text/html; charset=utf-8" })
+            .end(
+              "<!doctype html><title>Sail login complete</title>" +
+                '<body style="font-family:system-ui;display:grid;place-items:center;height:90vh">' +
+                "<p>Login complete — return to your terminal.</p></body>",
+            );
+          settle.resolve({
+            api_key: apiKey,
+            mode: params.get("mode") ?? "",
+            api_url: params.get("api_url") ?? "",
+          });
+        } catch {
+          reject400(res);
+        }
+      });
+    }
+
+    server.on("error", (err) => {
+      rejectServer(
+        new Error(`could not start the login listener: ${err.message}`),
+      );
+      settle.reject(err);
+    });
+    server.listen(0, "127.0.0.1", () => {
+      resolveServer({ server, port: server.address().port, callback });
+    });
+  });
+}
+
+/** Open a URL in the default browser, best effort (the URL is also printed). */
+function openBrowser(url) {
+  const platform = process.platform;
+  let cmd;
+  let args;
+  if (platform === "darwin") {
+    cmd = "open";
+    args = [url];
+  } else if (platform === "win32") {
+    // Not `cmd /c start`: cmd.exe applies %VAR% expansion and &-parsing to the
+    // command string, which can corrupt the login URL's percent-encoded
+    // redirect_uri / query before `start` ever sees it. explorer.exe hands the
+    // URL straight to ShellExecute (the default browser) with no shell
+    // parsing, so % and & survive intact. (It exits 1 even on success, but we
+    // ignore the exit code — this is best effort and the URL is also printed.)
+    cmd = "explorer.exe";
+    args = [url];
+  } else {
+    cmd = "xdg-open";
+    args = [url];
+  }
+  try {
+    const child = spawn(cmd, args, { stdio: "ignore", detached: true });
+    child.on("error", () => {});
+    child.unref();
+  } catch {
+    // The URL is printed; the user can open it by hand.
+  }
+}
+
+/**
+ * The environment a manually pasted key is validated/stored against. The
+ * manual `/cli-auth` page only hands back the key, not its API URL, so we use
+ * the invocation's resolved target (trailing slash normalized), falling back
+ * to prod when none was requested. Exported for tests.
+ */
+export function manualPasteApiUrl(expectedTarget) {
+  const target = expectedTarget?.trim().replace(/\/+$/, "");
+  return target || MODE_API_URLS.prod;
+}
+
+/**
+ * Whether a manually pasted key's environment can't be determined: only
+ * `SAIL_APP_URL` pointed the browser at a non-default dashboard, with no
+ * `--mode`/`SAIL_API_URL` to say which API endpoint minted the key. The
+ * loopback path learns that from the callback POST; the paste path can't, so
+ * it must fail closed rather than store the key against prod. Exported for
+ * tests. `appUrl` is the already-normalized dashboard URL browserLogin opens.
+ */
+export function pasteTargetIsAmbiguous({ appUrl, expectedSource }) {
+  const defaultApp = DEFAULT_APP_URL.replace(/\/+$/, "");
+  return appUrl !== defaultApp && expectedSource === "default";
+}
+
+/**
+ * The mode name whose API URL equals `apiUrl`, or "" for a custom/self-hosted
+ * URL with no named mode. Lets the paste path persist the mode the same way
+ * the loopback callback does. Exported for tests.
+ */
+export function modeForApiUrl(apiUrl) {
+  for (const [mode, url] of Object.entries(MODE_API_URLS)) {
+    if (url === apiUrl) return mode;
+  }
+  return "";
+}
+
+/**
+ * Read a pasted API key from stdin, concurrently with the loopback callback,
+ * so remote sessions whose browser can't reach 127.0.0.1 still finish login.
+ * Returns `{ promise, cancel }`: `promise` resolves with the first non-empty
+ * line; `cancel` stops reading (called once the race settles). Non-interactive
+ * stdin has no paste path, so the promise never resolves and the loopback
+ * timeout governs.
+ */
+export function readPastedKeyFromStdin(input = process.stdin) {
+  if (!input.isTTY) {
+    return { promise: new Promise(() => {}), cancel: () => {} };
+  }
+  // Read with echo disabled: the pasted value is a secret API key, and a
+  // cooked-mode TTY (what readline uses) echoes it into the terminal
+  // scrollback and any session log. Raw mode stops the TTY driver from
+  // echoing; we consume the bytes ourselves and never write them back.
+  let settled = false;
+  let buf = "";
+  let onData;
+  const restore = () => {
+    if (onData) input.removeListener("data", onData);
+    try {
+      input.setRawMode?.(false);
+    } catch {
+      // Not a real TTY (e.g. tests); nothing to restore.
+    }
+  };
+  const promise = new Promise((resolve, reject) => {
+    try {
+      input.setRawMode?.(true);
+    } catch {
+      // Best effort — fall back to the stream's current mode.
+    }
+    input.resume?.();
+    onData = (chunk) => {
+      if (settled) return;
+      buf += chunk.toString("utf8");
+      // Ctrl-C / Ctrl-D: raw mode swallows the terminal's own SIGINT/EOF, so
+      // we must act on them ourselves — restore the terminal and reject so the
+      // login aborts now instead of hanging until the loopback timeout (the
+      // race would otherwise keep waiting for the callback for 10 minutes).
+      if (buf.includes("\x03") || buf.includes("\x04")) {
+        const eof = !buf.includes("\x03");
+        settled = true;
+        restore();
+        reject(new Error(eof ? "login canceled (EOF)" : "login canceled"));
+        return;
+      }
+      let nl;
+      while ((nl = buf.search(/[\r\n]/)) !== -1) {
+        const line = buf.slice(0, nl).trim();
+        buf = buf.slice(nl + 1);
+        if (line && !settled) {
+          settled = true;
+          restore();
+          resolve(line);
+          return;
+        }
+      }
+    };
+    input.on("data", onData);
+  });
+  const cancel = () => {
+    settled = true;
+    restore();
+    // Release the stream so it can't keep the process alive or steal input
+    // from a subsequently spawned `claude`.
+    input.pause?.();
+  };
+  return { promise, cancel };
+}