@softr/cli 0.1.2 → 0.1.3

package/README.md

@@ -27,15 +27,17 @@ the environment, one login per environment). In a terminal, `login` asks which o
 ```bash
 softr login                         # asks: 1. browser (recommended, OAuth + PKCE) or 2. paste a personal API token
 softr login --no-browser            # browser login, but prints the URL to open elsewhere; the CLI waits for the answer
-softr login --token pat_...         # a personal API token created in the studio (API tokens), no questions asked
+softr login --token                 # a personal API token created in the studio (API tokens), typed in with the input hidden
+pbpaste | softr login --token       # the same token from stdin, for scripts
 softr whoami                        # who the stored token belongs to and what it grants
 softr logout
 ```
 
 The browser login grants the scopes registered for the CLI in the studio, on every workspace you can reach; the consent
 page lists them. The access token renews itself, and a login is needed again after 30 days without use. A personal API
-token needs a `workflows:*` action in its statements; `login` warns when it has none. `SOFTR_TOKEN` overrides the
-stored token for scripts and CI. The studio session cookie is not accepted.
+token needs a `workflows:*` action in its statements; `login` warns when it has none. `--token` takes no value: a token
+on the command line ends up in the shell history, so `login` reads it from stdin when piped and asks for it otherwise.
+`SOFTR_TOKEN` overrides the stored token for scripts and CI. The studio session cookie is not accepted.
 
 The CLI targets Softr production. For development, `SOFTR_WORKFLOWS_API_URL`, `SOFTR_STUDIO_API_URL` and
 `SOFTR_STUDIO_URL` point it at another workflows service, studio API and studio, for example locally running
@@ -43,11 +45,11 @@ ones. A workflow directory remembers the target it was pulled from.
 
 ## Global commands
 
-| Command                                                          | What it does                                                                                                                                                                                                                                                       |
-| ---------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| `login [--token <pat_...>] [--no-browser]` / `whoami` / `logout` | Log in through the browser (OAuth with PKCE), or store a personal API token after confirming it with the studio; show the stored identity and its grants; forget the token.                                                                                        |
-| `workspaces`                                                     | The workspaces the stored token reaches, with your role in each and the default one. Commands that take `--workspace` default to `SOFTR_WORKSPACE_ID` when it is set, else to your only or default workspace.                                                      |
-| `integrations [--workspace <id>] [--type <TYPE>]`                | List the workspace's connected integrations (id, name, type, account, auth kind) from the studio API; the id goes into a node's `integrationId` input. Inside a workflow directory the workspace is the workflow's; `--type` filters. Credentials are never shown. |
+| Command                                                | What it does                                                                                                                                                                                                                                                       |
+| ------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `login [--token] [--no-browser]` / `whoami` / `logout` | Log in through the browser (OAuth with PKCE), or store a personal API token (piped to stdin or typed in hidden) after confirming it with the studio; show the stored identity and its grants; forget the token.                                                    |
+| `workspaces`                                           | The workspaces the stored token reaches, with your role in each and the default one. Commands that take `--workspace` default to `SOFTR_WORKSPACE_ID` when it is set, else to your only or default workspace.                                                      |
+| `integrations [--workspace <id>] [--type <TYPE>]`      | List the workspace's connected integrations (id, name, type, account, auth kind) from the studio API; the id goes into a node's `integrationId` input. Inside a workflow directory the workspace is the workflow's; `--type` filters. Credentials are never shown. |
 
 Every command accepts `--json`. `SOFTR_TOKEN` overrides the stored token; `SOFTR_WORKSPACE_ID` is the default workspace.
 

package/dist/cli.mjs

@@ -15423,6 +15423,7 @@ ${renderIntegrations(rows)}`, {
 import { execFile } from "node:child_process";
 import { createServer } from "node:http";
 import { stderr, stdin } from "node:process";
+import { emitKeypressEvents } from "node:readline";
 import { createInterface } from "node:readline/promises";
 var CALLBACK_TIMEOUT_MS = 5 * 60 * 1e3;
 async function identify(client) {
@@ -15439,10 +15440,11 @@ async function interactiveLogin(target) {
   if (!stdin.isTTY) {
     throw new CliError(
       "No login method given and stdin is not a terminal.",
-      `Pass --token <pat_...>, set ${TOKEN_ENV_VAR}, or run "login --no-browser" and open the printed URL.`
+      `Pipe a personal API token to "login --token", set ${TOKEN_ENV_VAR}, or run "login --no-browser" and open the printed URL.`
     );
   }
   const rl = createInterface({ input: stdin, output: stderr });
+  let answer = "";
   try {
     stderr.write(
       `How do you want to log in to ${target.studioUrl}?
@@ -15450,7 +15452,6 @@ async function interactiveLogin(target) {
   2. Personal API token: paste a pat_... created in the studio under API tokens
 `
     );
-    let answer = "";
     for (; ; ) {
       answer = (await rl.question("Choose 1 or 2 [1]: ")).trim();
       if (answer === "" || answer === "1" || answer === "2") {
@@ -15458,17 +15459,59 @@ async function interactiveLogin(target) {
       }
       stderr.write("Please answer 1 or 2.\n");
     }
-    if (answer === "2") {
-      const token = (await rl.question("Personal API token: ")).trim();
-      if (!token) {
-        throw new CliError("No token given.", 'Run "softr login" again.');
-      }
-      return pastedToken(token);
-    }
   } finally {
     rl.close();
   }
-  return browserLogin(target, false);
+  return answer === "2" ? pastedToken(await promptToken()) : browserLogin(target, false);
+}
+function promptToken() {
+  stderr.write("Personal API token: ");
+  emitKeypressEvents(stdin);
+  stdin.setRawMode(true);
+  stdin.resume();
+  return new Promise((resolve, reject) => {
+    let token = "";
+    const finish = (error) => {
+      stdin.off("keypress", onKey);
+      stdin.setRawMode(false);
+      stdin.pause();
+      stderr.write("\n");
+      if (error) {
+        reject(error);
+      } else if (token.trim()) {
+        resolve(token.trim());
+      } else {
+        reject(new CliError("No token given.", 'Run "softr login" again.'));
+      }
+    };
+    const onKey = (text, key = {}) => {
+      if (key.ctrl && (key.name === "c" || key.name === "d")) {
+        finish(new CliError("Login cancelled."));
+      } else if (key.name === "return" || key.name === "enter") {
+        finish();
+      } else if (key.name === "backspace") {
+        if (token) {
+          token = token.slice(0, -1);
+          stderr.write("\b \b");
+        }
+      } else if (text && !key.ctrl && !key.meta && text >= " ") {
+        token += text;
+        stderr.write("*".repeat(text.length));
+      }
+    };
+    stdin.on("keypress", onKey);
+  });
+}
+async function readTokenFromStdin() {
+  let input = "";
+  for await (const chunk of stdin) {
+    input += chunk;
+  }
+  const token = input.trim();
+  if (!token) {
+    throw new CliError("No token on stdin.", 'Pipe the token in, for example "pbpaste | softr login --token".');
+  }
+  return token;
 }
 function openBrowser(url) {
   const [command, args] = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["rundll32", ["url.dll,FileProtocolHandler", url]] : ["xdg-open", [url]];
@@ -15568,17 +15611,26 @@ function registerLogin(program3) {
   program3.command("login").description(
     "Log in through the browser (recommended) or with a personal API token; asks which when run in a terminal"
   ).option(
-    "--token <value>",
-    `a personal API token (pat_...) from the studio, no questions asked; defaults to $${TOKEN_ENV_VAR}`
-  ).option("--no-browser", "browser login, but print the URL instead of opening it (for remote shells and agents)").action(async (opts, command) => {
+    "--token",
+    `log in with a personal API token (pat_...) from the studio: read from stdin when piped, else asked for with the input hidden; without the flag, $${TOKEN_ENV_VAR} is used when set`
+  ).option("--no-browser", "browser login, but print the URL instead of opening it (for remote shells and agents)").allowExcessArguments().allowUnknownOption().action(async (opts, command) => {
     const options = globalOptions(command);
     const target = resolveTarget();
+    if (command.args.length > 0) {
+      throw opts.token || command.args.some((arg) => arg.startsWith("--token=")) ? new CliError(
+        '"--token" takes no value any more: a token on the command line ends up in the shell history.',
+        'Pipe it in ("pbpaste | softr login --token") or run "softr login --token" and paste it at the prompt. Revoke the token you passed in the studio (API tokens) and create a new one.'
+      ) : new CliError(
+        '"login" takes no arguments and knows only the options its help lists.',
+        'Run "softr login --help".'
+      );
+    }
     if (isProxyAuth()) {
       throw new CliError(
         `Login is not needed: the target authenticates the requests itself ($${AUTH_ENV_VAR}=proxy).`
       );
     }
-    const token = (opts.token ?? process.env[TOKEN_ENV_VAR] ?? "").trim();
+    const token = opts.token ? stdin.isTTY ? await promptToken() : await readTokenFromStdin() : (process.env[TOKEN_ENV_VAR] ?? "").trim();
     const saved = token ? pastedToken(token) : opts.browser ? await interactiveLogin(target) : await browserLogin(target, true);
     const identity = await identify({ target, token: saved.token, kind: saved.kind });
     await report(options, target, saved, identity);
@@ -16766,7 +16818,7 @@ Pass --workspace <id> to a command, or set SOFTR_WORKSPACE_ID, to work in one of
 // package.json
 var package_default = {
   name: "@softr/cli",
-  version: "0.1.2",
+  version: "0.1.3",
   description: "The Softr command line: build, test and publish Softr workflows from local files; more Softr APIs to come",
   keywords: [
     "softr",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@softr/cli",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "The Softr command line: build, test and publish Softr workflows from local files; more Softr APIs to come",
   "keywords": [
     "softr",