@spekn/cli 1.0.0

package/dist/bridge-login.js

@@ -0,0 +1,277 @@
+#!/usr/bin/env node
+"use strict";
+/**
+ * bridge login CLI command
+ *
+ * Authenticates the CLI user via the Keycloak Device Authorization Grant,
+ * then registers the bridge device with the Spekn SaaS API. This combines
+ * `auth login` (credentials) with bridge device registration in a single step.
+ *
+ * Usage: spekn bridge login [--name <device-name>] [--api-url <url>] [--force]
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runBridgeLoginCli = runBridgeLoginCli;
+exports.main = main;
+exports.parseArgs = parseArgs;
+exports.decodeJwtPayload = decodeJwtPayload;
+const os = __importStar(require("node:os"));
+const client_1 = require("@trpc/client");
+const device_flow_js_1 = require("./auth/device-flow.js");
+const credentials_store_js_1 = require("./auth/credentials-store.js");
+const bridge_1 = require("@spekn/bridge");
+const trpc_url_1 = require("./utils/trpc-url");
+const help_error_1 = require("./utils/help-error");
+const structured_log_1 = require("./utils/structured-log");
+const defaultDeps = {
+    stdout: process.stdout,
+    stderr: process.stderr,
+    performDeviceFlow: device_flow_js_1.performDeviceFlow,
+    credentialsStore: new credentials_store_js_1.CredentialsStore(),
+    bridgeConfigStore: new bridge_1.BridgeConfigStore(),
+};
+function resolveDeps(deps) {
+    return {
+        stdout: deps?.stdout ?? defaultDeps.stdout,
+        stderr: deps?.stderr ?? defaultDeps.stderr,
+        performDeviceFlow: deps?.performDeviceFlow ?? defaultDeps.performDeviceFlow,
+        credentialsStore: deps?.credentialsStore ?? defaultDeps.credentialsStore,
+        bridgeConfigStore: deps?.bridgeConfigStore ?? defaultDeps.bridgeConfigStore,
+    };
+}
+function printHelp(stderr) {
+    stderr.write(`
+bridge login - Authenticate and register the bridge with Spekn SaaS
+
+USAGE:
+  spekn bridge login [options]
+
+OPTIONS:
+  --name <name>          Device name (default: system hostname)
+  --api-url <url>        API base URL (default: SPEKN_API_URL or https://app.spekn.com)
+  --keycloak-url <url>   Keycloak base URL (default: KEYCLOAK_URL or https://auth.spekn.com)
+  --realm <realm>        Keycloak realm name (default: KEYCLOAK_REALM or spekn)
+  --force                Re-register even if bridge is already paired
+  --help                 Show this help message
+
+ENVIRONMENT:
+  SPEKN_API_URL          API base URL
+  KEYCLOAK_URL           Keycloak base URL
+  KEYCLOAK_REALM         Keycloak realm name
+
+EXAMPLES:
+  spekn bridge login
+  spekn bridge login --name my-dev-machine
+  spekn bridge login --api-url https://api.spekn.dev --force
+`);
+}
+function parseArgs(args) {
+    let deviceName = os.hostname();
+    let apiUrl = process.env["SPEKN_API_URL"] ?? "https://app.spekn.com";
+    let keycloakUrl = process.env["KEYCLOAK_URL"] ?? "https://auth.spekn.com";
+    let realm = process.env["KEYCLOAK_REALM"] ?? "spekn";
+    let force = false;
+    for (let index = 0; index < args.length; index++) {
+        const arg = args[index];
+        if (arg === "--help" || arg === "-h") {
+            throw new help_error_1.HelpRequestedError();
+        }
+        if (arg === "--name" && args[index + 1]) {
+            deviceName = args[++index];
+            continue;
+        }
+        if (arg?.startsWith("--name=")) {
+            deviceName = arg.slice("--name=".length);
+            continue;
+        }
+        if (arg === "--api-url" && args[index + 1]) {
+            apiUrl = args[++index];
+            continue;
+        }
+        if (arg?.startsWith("--api-url=")) {
+            apiUrl = arg.slice("--api-url=".length);
+            continue;
+        }
+        if (arg === "--keycloak-url" && args[index + 1]) {
+            keycloakUrl = args[++index];
+            continue;
+        }
+        if (arg?.startsWith("--keycloak-url=")) {
+            keycloakUrl = arg.slice("--keycloak-url=".length);
+            continue;
+        }
+        if (arg === "--realm" && args[index + 1]) {
+            realm = args[++index];
+            continue;
+        }
+        if (arg?.startsWith("--realm=")) {
+            realm = arg.slice("--realm=".length);
+            continue;
+        }
+        if (arg === "--force") {
+            force = true;
+            continue;
+        }
+    }
+    return { deviceName, apiUrl, keycloakUrl, realm, force };
+}
+/**
+ * Decode the payload of a JWT access token without verification.
+ * Returns the raw claims object, or null if decoding fails.
+ */
+function decodeJwtPayload(token) {
+    try {
+        const parts = token.split(".");
+        if (parts.length !== 3) {
+            return null;
+        }
+        const base64 = parts[1]
+            .replace(/-/g, "+")
+            .replace(/_/g, "/");
+        const padded = base64.padEnd(base64.length + ((4 - (base64.length % 4)) % 4), "=");
+        const json = Buffer.from(padded, "base64").toString("utf-8");
+        return JSON.parse(json);
+    }
+    catch {
+        return null;
+    }
+}
+async function runBridgeLoginCli(args, deps) {
+    const resolved = resolveDeps(deps);
+    try {
+        const options = parseArgs(args);
+        (0, structured_log_1.appendCliStructuredLog)({
+            source: "cli.bridge.login",
+            level: "info",
+            message: "Starting bridge login",
+            details: { deviceName: options.deviceName, apiUrl: options.apiUrl, force: options.force },
+        });
+        // Load bridge config
+        resolved.bridgeConfigStore.load();
+        // Check if already paired — require --force to re-register
+        if (resolved.bridgeConfigStore.isPaired() && !options.force) {
+            resolved.stderr.write("Bridge is already registered. Use --force to re-register.\n");
+            return 1;
+        }
+        // Step 1: Check for existing valid token; if none, run device flow
+        let accessToken = await resolved.credentialsStore.getValidToken();
+        if (!accessToken) {
+            resolved.stdout.write("No valid credentials found. Starting login...\n");
+            const result = await resolved.performDeviceFlow(options.keycloakUrl, options.realm, "spekn-cli", { stdout: resolved.stdout, stderr: resolved.stderr });
+            // Step 2: Save Keycloak credentials (bridge login doubles as auth login)
+            const claims = decodeJwtPayload(result.accessToken);
+            const sub = typeof claims?.["sub"] === "string" ? claims["sub"] : "unknown";
+            const email = typeof claims?.["email"] === "string" ? claims["email"] : "unknown";
+            const name = typeof claims?.["name"] === "string"
+                ? claims["name"]
+                : typeof claims?.["preferred_username"] === "string"
+                    ? claims["preferred_username"]
+                    : undefined;
+            const credentials = {
+                accessToken: result.accessToken,
+                refreshToken: result.refreshToken,
+                expiresAt: Date.now() + result.expiresIn * 1000,
+                keycloakUrl: options.keycloakUrl,
+                realm: options.realm,
+                user: { sub, email, name },
+            };
+            resolved.credentialsStore.save(credentials);
+            resolved.stdout.write(`Authenticated as ${email}\n`);
+            accessToken = result.accessToken;
+        }
+        else {
+            const storedCreds = resolved.credentialsStore.load();
+            const email = storedCreds?.user?.email ?? "unknown";
+            resolved.stdout.write(`Using existing credentials (${email})\n`);
+        }
+        // Resolve organization ID from credentials store or env
+        const storedCreds = resolved.credentialsStore.load();
+        const organizationId = storedCreds?.organizationId ?? process.env["SPEKN_ORGANIZATION_ID"] ?? "";
+        // Step 3: POST to bridge.registerWithToken
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        const client = (0, client_1.createTRPCProxyClient)({
+            links: [
+                (0, client_1.httpBatchLink)({
+                    url: (0, trpc_url_1.normalizeTrpcUrl)(options.apiUrl),
+                    headers: {
+                        authorization: `Bearer ${accessToken}`,
+                        "x-organization-id": organizationId,
+                    },
+                }),
+            ],
+        });
+        const result = await client.bridge.registerWithToken.mutate({
+            deviceName: options.deviceName,
+        });
+        // Step 4: Save result to BridgeConfigStore
+        resolved.bridgeConfigStore.setPairing({
+            deviceId: result.deviceId,
+            deviceName: options.deviceName,
+            credential: result.credential,
+            pairedAt: new Date().toISOString(),
+            saasOrigin: result.saasOrigin,
+        });
+        resolved.bridgeConfigStore.update({ saasWsUrl: result.saasWsUrl });
+        resolved.stdout.write(`\nBridge registered as '${options.deviceName}'. Run: spekn bridge start\n`);
+        (0, structured_log_1.appendCliStructuredLog)({
+            source: "cli.bridge.login",
+            level: "info",
+            message: "Bridge login completed",
+            details: { deviceId: result.deviceId, organizationId: result.organizationId },
+        });
+        return 0;
+    }
+    catch (error) {
+        if (error instanceof help_error_1.HelpRequestedError) {
+            printHelp(resolved.stderr);
+            return 0;
+        }
+        const message = error instanceof Error ? error.message : String(error);
+        resolved.stderr.write(`Error: ${message}\n`);
+        (0, structured_log_1.appendCliStructuredLog)({
+            source: "cli.bridge.login",
+            level: "error",
+            message,
+        });
+        return 1;
+    }
+}
+async function main() {
+    const exitCode = await runBridgeLoginCli(process.argv.slice(2));
+    process.exit(exitCode);
+}
+if (require.main === module) {
+    void main();
+}