@scrthq/runlog 0.0.38 → 0.0.39

package/README.md

@@ -12,6 +12,9 @@ npx @scrthq/runlog sign my-game.yaml --key my-key.json --as "Your Name"
 npx @scrthq/runlog issue my-game.yaml --to "Buyer" --ref order-1 --key my-key.json --seal
 ```
 
+`npx @scrthq/runlog login` signs in through your browser, so that `claim`
+can tie a signing key to your account and the app names you beside what you
+sign. In CI, set `RUNLOG_API_KEY` to a key from your profile page instead.
 `npx @scrthq/runlog help` lists everything.
 
 The same package is a library for a seller's own backend: `seal`, `open`,

package/dist/runlog.js

@@ -28214,11 +28214,14 @@ import { resolve as resolve2 } from "node:path";
 
 // packages/cli/src/account.ts
 var import_yaml2 = __toESM(require_dist(), 1);
+import { spawn } from "node:child_process";
 import { chmodSync, existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join, resolve } from "node:path";
 import { createInterface } from "node:readline";
 var DEFAULT_API = "https://runlog.scrthq.com/api";
+var RENEW_MARGIN_MS = 6e4;
+var DEVICE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
 function configDir() {
   const base = process.env["RUNLOG_CONFIG_DIR"] ?? (process.platform === "win32" ? join(process.env["APPDATA"] ?? join(homedir(), "AppData", "Roaming"), "runlog") : join(process.env["XDG_CONFIG_HOME"] ?? join(homedir(), ".config"), "runlog"));
   return base;
@@ -28229,12 +28232,31 @@ function credentials() {
   if (fromEnv) return { api: process.env["RUNLOG_API"] ?? DEFAULT_API, key: fromEnv, savedAt: "" };
   try {
     const raw = JSON.parse(readFileSync(credentialsPath(), "utf8"));
-    if (typeof raw.key !== "string" || typeof raw.api !== "string") return null;
-    return { api: raw.api, key: raw.key, savedAt: raw.savedAt ?? "" };
+    if (typeof raw.api !== "string") return null;
+    if (typeof raw.key === "string") return { api: raw.api, key: raw.key, savedAt: raw.savedAt ?? "" };
+    const s = raw.session;
+    if (s && typeof s.accessToken === "string" && typeof s.refreshToken === "string" && typeof s.clientId === "string") {
+      return {
+        api: raw.api,
+        session: { clientId: s.clientId, issuer: s.issuer ?? WORKOS, accessToken: s.accessToken, refreshToken: s.refreshToken, expiresAt: s.expiresAt ?? "" },
+        savedAt: raw.savedAt ?? ""
+      };
+    }
+    return null;
   } catch {
     return null;
   }
 }
+function save(creds) {
+  const dir = configDir();
+  mkdirSync(dir, { recursive: true });
+  writeFileSync(credentialsPath(), `${JSON.stringify(creds, null, 2)}
+`, "utf8");
+  try {
+    chmodSync(credentialsPath(), 384);
+  } catch {
+  }
+}
 async function ask(prompt, hidden = false) {
   const rl = createInterface({ input: process.stdin, output: process.stdout, terminal: true });
   return new Promise((done) => {
@@ -28260,60 +28282,182 @@ async function ask(prompt, hidden = false) {
     }
   });
 }
-async function api(method, path, body) {
-  const creds = credentials();
-  if (!creds) throw new Error("not signed in: run `runlog login` with a key from your profile page");
-  const response = await fetch(`${creds.api.replace(/\/$/, "")}${path}`, {
-    method,
-    headers: { authorization: `Bearer ${creds.key}`, ...body !== void 0 ? { "content-type": "application/json" } : {} },
-    ...body !== void 0 ? { body: JSON.stringify(body) } : {}
+var WORKOS = "https://api.workos.com";
+var realDeps = {
+  fetch: (input2, init) => fetch(input2, init),
+  sleep: (ms) => new Promise((r) => setTimeout(r, ms)),
+  say: (line) => console.log(line),
+  open: (url2) => {
+    try {
+      const [cmd, args] = process.platform === "win32" ? ["cmd", ["/c", "start", "", url2]] : process.platform === "darwin" ? ["open", [url2]] : ["xdg-open", [url2]];
+      spawn(cmd, args, { detached: true, stdio: "ignore" }).on("error", () => {
+      }).unref();
+    } catch {
+    }
+  },
+  now: () => Date.now()
+};
+async function postForm(deps, url2, form) {
+  const response = await deps.fetch(url2, {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json" },
+    body: new URLSearchParams(form).toString()
   });
   const text = await response.text();
-  let parsed = null;
   try {
-    parsed = JSON.parse(text);
+    return { status: response.status, body: JSON.parse(text) };
+  } catch {
+    throw new Error(`WorkOS did not answer as expected (${response.status})`);
+  }
+}
+function expiryOf(accessToken, now) {
+  try {
+    const payload = JSON.parse(Buffer.from(accessToken.split(".")[1] ?? "", "base64url").toString("utf8"));
+    if (typeof payload.exp === "number") return new Date(payload.exp * 1e3).toISOString();
   } catch {
-    throw new Error(`the API at ${creds.api} did not answer as expected (${response.status})`);
   }
-  if (response.status === 401) throw new Error("that key is not accepted; make a new one on your profile page and `runlog login` again");
-  if (response.status >= 400) {
-    const said = parsed?.error;
-    throw new Error(said ?? `the API said ${response.status}`);
+  return new Date(now + 5 * 6e4).toISOString();
+}
+async function deviceFlow(clientId, issuer, deps = realDeps) {
+  const start = await postForm(deps, `${issuer}/user_management/authorize/device`, { client_id: clientId });
+  const s = start.body;
+  if (start.status >= 400 || !s.device_code || !s.user_code || !s.verification_uri) {
+    throw new Error(s.error_description ?? `WorkOS would not start a sign-in (${start.status})`);
+  }
+  deps.say("");
+  deps.say(`  Open  ${s.verification_uri}`);
+  deps.say(`  Code  ${s.user_code}`);
+  deps.say("");
+  deps.say("Waiting for you to confirm it there. Ctrl-C gives up.");
+  if (s.verification_uri_complete) deps.open(s.verification_uri_complete);
+  let interval = Math.max(1, s.interval ?? 5);
+  const deadline = deps.now() + (s.expires_in ?? 300) * 1e3;
+  while (deps.now() < deadline) {
+    await deps.sleep(interval * 1e3);
+    const poll = await postForm(deps, `${issuer}/user_management/authenticate`, { grant_type: DEVICE_GRANT, device_code: s.device_code, client_id: clientId });
+    const a = poll.body;
+    if (a.access_token && a.refresh_token) {
+      return { clientId, issuer, accessToken: a.access_token, refreshToken: a.refresh_token, expiresAt: expiryOf(a.access_token, deps.now()) };
+    }
+    switch (a.error) {
+      case "authorization_pending":
+        continue;
+      case "slow_down":
+        interval += 1;
+        continue;
+      case "access_denied":
+        throw new Error("the sign-in was refused in the browser");
+      case "expired_token":
+        throw new Error("the code expired before it was confirmed; run `runlog login` again");
+      default:
+        throw new Error(a.error_description ?? a.error ?? `WorkOS answered ${poll.status}`);
+    }
+  }
+  throw new Error("the code expired before it was confirmed; run `runlog login` again");
+}
+async function renew(session, deps = realDeps) {
+  const answer = await postForm(deps, `${session.issuer}/user_management/authenticate`, {
+    grant_type: "refresh_token",
+    refresh_token: session.refreshToken,
+    client_id: session.clientId
+  });
+  const a = answer.body;
+  if (!a.access_token || !a.refresh_token) {
+    throw new Error("your sign-in has lapsed; run `runlog login` again");
+  }
+  return { ...session, accessToken: a.access_token, refreshToken: a.refresh_token, expiresAt: expiryOf(a.access_token, deps.now()) };
+}
+async function bearer(creds, force = false, deps = realDeps) {
+  if (creds.key) return creds.key;
+  if (!creds.session) throw new Error("not signed in: run `runlog login`");
+  const lapsing = !creds.session.expiresAt || Date.parse(creds.session.expiresAt) - deps.now() < RENEW_MARGIN_MS;
+  if (!force && !lapsing) return creds.session.accessToken;
+  const session = await renew(creds.session, deps);
+  creds.session = session;
+  if (!process.env["RUNLOG_API_KEY"]) save(creds);
+  return session.accessToken;
+}
+async function api(method, path, body) {
+  const creds = credentials();
+  if (!creds) throw new Error("not signed in: run `runlog login`");
+  const once = async (token) => {
+    const response = await fetch(`${creds.api.replace(/\/$/, "")}${path}`, {
+      method,
+      headers: { authorization: `Bearer ${token}`, ...body !== void 0 ? { "content-type": "application/json" } : {} },
+      ...body !== void 0 ? { body: JSON.stringify(body) } : {}
+    });
+    const text = await response.text();
+    let parsed = null;
+    try {
+      parsed = JSON.parse(text);
+    } catch {
+      throw new Error(`the API at ${creds.api} did not answer as expected (${response.status})`);
+    }
+    return { status: response.status, parsed };
+  };
+  let answer = await once(await bearer(creds));
+  if (answer.status === 401 && creds.session) answer = await once(await bearer(creds, true));
+  if (answer.status === 401) {
+    throw new Error(creds.key ? "that key is not accepted; make a new one on your profile page and `runlog login --key` again" : "your sign-in has lapsed; run `runlog login` again");
+  }
+  if (answer.status >= 400) {
+    const said = answer.parsed?.error;
+    throw new Error(said ?? `the API said ${answer.status}`);
   }
-  return parsed;
+  return answer.parsed;
 }
-async function cmdLogin(args) {
-  const apiUrl = flag(args, "--api") ?? process.env["RUNLOG_API"] ?? DEFAULT_API;
-  console.log("Paste a command-line key from your profile page in Runlog. It is not shown as you type.");
-  const key = await ask("key: ", true);
-  if (!key.startsWith("rl_")) {
-    console.error("that does not look like a Runlog key; they begin with rl_");
+async function greet(apiUrl) {
+  const me = await api("GET", "/me");
+  const who = me.profile?.name ?? me.profile?.email ?? "you";
+  console.log(`signed in as ${who} at ${apiUrl}`);
+}
+async function cmdLogin(args, deps = realDeps) {
+  const apiUrl = (flag(args, "--api") ?? process.env["RUNLOG_API"] ?? DEFAULT_API).replace(/\/$/, "");
+  if (process.env["RUNLOG_API_KEY"]) {
+    console.error("RUNLOG_API_KEY is set, so that is what every command will use; unset it to sign in as yourself");
     return 1;
   }
-  const dir = configDir();
-  mkdirSync(dir, { recursive: true });
-  const saved = { api: apiUrl, key, savedAt: (/* @__PURE__ */ new Date()).toISOString() };
-  writeFileSync(credentialsPath(), `${JSON.stringify(saved, null, 2)}
-`, "utf8");
-  try {
-    chmodSync(credentialsPath(), 384);
-  } catch {
+  if (args.includes("--key")) {
+    console.log("Paste a command-line key from your profile page in Runlog. It is not shown as you type.");
+    const key = await ask("key: ", true);
+    if (!key.startsWith("rl_")) {
+      console.error("that does not look like a Runlog key; they begin with rl_");
+      return 1;
+    }
+    save({ api: apiUrl, key, savedAt: (/* @__PURE__ */ new Date()).toISOString() });
+    try {
+      await greet(apiUrl);
+      return 0;
+    } catch (error61) {
+      unlinkSync(credentialsPath());
+      console.error(error61 instanceof Error ? error61.message : String(error61));
+      return 1;
+    }
   }
   try {
-    const me = await api("GET", "/me");
-    const who = me.profile?.name ?? me.profile?.email ?? "you";
-    console.log(`signed in as ${who} at ${apiUrl}`);
+    const response = await deps.fetch(`${apiUrl}/auth/cli`, { headers: { accept: "application/json" } });
+    const text = await response.text();
+    let about = {};
+    try {
+      about = JSON.parse(text);
+    } catch {
+      throw new Error(`the API at ${apiUrl} did not answer as expected (${response.status})`);
+    }
+    if (!about.clientId) throw new Error(`the API at ${apiUrl} cannot sign in a terminal yet; use \`runlog login --key\` with a key from your profile page`);
+    const session = await deviceFlow(about.clientId, about.issuer ?? WORKOS, deps);
+    save({ api: apiUrl, session, savedAt: (/* @__PURE__ */ new Date()).toISOString() });
+    await greet(apiUrl);
     return 0;
   } catch (error61) {
-    unlinkSync(credentialsPath());
     console.error(error61 instanceof Error ? error61.message : String(error61));
     return 1;
   }
 }
 function cmdLogout() {
+  const creds = credentials();
   if (existsSync(credentialsPath())) {
     unlinkSync(credentialsPath());
-    console.log("signed out; the key is still valid until you revoke it on your profile page");
+    console.log(creds?.key ? "signed out; the key is still valid until you revoke it on your profile page" : "signed out");
   } else {
     console.log("not signed in");
   }
@@ -28321,9 +28465,12 @@ function cmdLogout() {
 }
 async function cmdWhoami() {
   try {
+    const creds = credentials();
     const me = await api("GET", "/me");
     const claims = await api("GET", "/claims");
+    const how = process.env["RUNLOG_API_KEY"] ? "with RUNLOG_API_KEY" : creds?.key ? "with a key from the profile page" : "from the browser";
     console.log(`${me.profile?.name ?? "(no name)"} <${me.profile?.email ?? "?"}>  ${me.sub}`);
+    console.log(`signed in ${how} at ${creds?.api ?? DEFAULT_API}`);
     console.log(claims.claims.length > 0 ? `claimed signing keys: ${claims.claims.map((c) => c.fingerprint).join(", ")}` : "no claimed signing keys yet: `runlog claim key.json`");
     return 0;
   } catch (error61) {
@@ -28835,14 +28982,16 @@ usage:
   runlog issue    <pack> --to "Name"     stamp a copy with a buyer's name and sign it
                     [--seal]             \u2026and seal it, so it needs a license key to open
 
-  runlog login    [--api URL]            paste a key from your profile page, once
+  runlog login    [--api URL]            sign in: a code to confirm in your browser
+                    [--key]              \u2026or paste a key from your profile page, for a machine with no browser
   runlog whoami                          who the command line is acting as
   runlog claim    key.json               prove a signing key is yours; the app then names you
   runlog publish  <pack>                 put a pack in your library, on every device
-  runlog logout                          forget the saved key
+  runlog logout                          forget the sign-in
 
 --strict makes warnings fail, which is what you want in CI. In CI, set
-RUNLOG_API_KEY instead of running login.
+RUNLOG_API_KEY to a key from your profile page instead of running login;
+nobody is there to confirm a code.
 
 Signing proves authorship. It does not restrict copying and cannot: the app
 has to read every word of a pack to play it. What it gives you is that an

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@scrthq/runlog",
-  "version": "0.0.38",
+  "version": "0.0.39",
   "description": "Validate, lint, bundle and test Runlog rule packs.",
   "type": "module",
   "license": "MIT",