@stackframe/stack 2.8.2 → 2.8.5

package/dist/esm/lib/stack-app/apps/implementations/client-app-impl.js

@@ -18,6 +18,7 @@ import * as cookie from "cookie";
 import { constructRedirectUrl } from "../../../../utils/url";
 import { addNewOAuthProviderOrScope, callOAuthCallback, signInWithOAuth } from "../../../auth";
 import { createBrowserCookieHelper, createCookieHelper, createPlaceholderCookieHelper, deleteCookieClient, getCookieClient, setOrDeleteCookie, setOrDeleteCookieClient } from "../../../cookie";
+import { apiKeyCreationOptionsToCrud } from "../../api-keys";
 import { stackAppInternalsSymbol } from "../../common";
 import { contactChannelCreateOptionsToCrud, contactChannelUpdateOptionsToCrud } from "../../contact-channels";
 import { adminProjectCreateOptionsToCrud } from "../../projects";
@@ -109,6 +110,18 @@ var __StackClientAppImplIncomplete = class __StackClientAppImplIncomplete {
         return await this._interface.listClientContactChannels(session);
       }
     );
+    this._userApiKeysCache = createCacheBySession(
+      async (session) => {
+        const results = await this._interface.listProjectApiKeys({ user_id: "me" }, session, "client");
+        return results;
+      }
+    );
+    this._teamApiKeysCache = createCacheBySession(
+      async (session, [teamId]) => {
+        const results = await this._interface.listProjectApiKeys({ team_id: teamId }, session, "client");
+        return results;
+      }
+    );
     this._anonymousSignUpInProgress = null;
     this._memoryTokenStore = createEmptyTokenStore();
     this._nextServerCookiesTokenStores = /* @__PURE__ */ new WeakMap();
@@ -445,6 +458,8 @@ var __StackClientAppImplIncomplete = class __StackClientAppImplIncomplete {
         passkeyEnabled: crud.config.passkey_enabled,
         clientTeamCreationEnabled: crud.config.client_team_creation_enabled,
         clientUserDeletionEnabled: crud.config.client_user_deletion_enabled,
+        allowTeamApiKeys: crud.config.allow_team_api_keys,
+        allowUserApiKeys: crud.config.allow_user_api_keys,
         oauthProviders: crud.config.enabled_oauth_providers.map((p) => ({
           id: p.id
         }))
@@ -476,6 +491,47 @@ var __StackClientAppImplIncomplete = class __StackClientAppImplIncomplete {
       }
     };
   }
+  _baseApiKeyFromCrud(crud) {
+    return {
+      id: crud.id,
+      description: crud.description,
+      expiresAt: crud.expires_at_millis ? new Date(crud.expires_at_millis) : void 0,
+      manuallyRevokedAt: crud.manually_revoked_at_millis ? new Date(crud.manually_revoked_at_millis) : null,
+      createdAt: new Date(crud.created_at_millis),
+      ...crud.type === "team" ? { type: "team", teamId: crud.team_id } : { type: "user", userId: crud.user_id },
+      value: typeof crud.value === "string" ? crud.value : {
+        lastFour: crud.value.last_four
+      },
+      isValid: function() {
+        return this.whyInvalid() === null;
+      },
+      whyInvalid: function() {
+        if (this.manuallyRevokedAt) {
+          return "manually-revoked";
+        }
+        if (this.expiresAt && this.expiresAt < /* @__PURE__ */ new Date()) {
+          return "expired";
+        }
+        return null;
+      }
+    };
+  }
+  _clientApiKeyFromCrud(session, crud) {
+    return {
+      ...this._baseApiKeyFromCrud(crud),
+      async revoke() {
+        await this.update({ revoked: true });
+      },
+      update: async (options) => {
+        await this._interface.updateProjectApiKey(crud.type === "team" ? { team_id: crud.team_id } : { user_id: crud.user_id }, crud.id, options, session, "client");
+        if (crud.type === "team") {
+          await this._teamApiKeysCache.refresh([session, crud.team_id]);
+        } else {
+          await this._userApiKeysCache.refresh([session]);
+        }
+      }
+    };
+  }
   _clientTeamFromCrud(crud, session) {
     const app = this;
     return {
@@ -516,6 +572,23 @@ var __StackClientAppImplIncomplete = class __StackClientAppImplIncomplete {
       async delete() {
         await app._interface.deleteTeam(crud.id, session);
         await app._currentUserTeamsCache.refresh([session]);
+      },
+      useApiKeys() {
+        const result = useAsyncCache(app._teamApiKeysCache, [session, crud.id], "team.useApiKeys()");
+        return result.map((crud2) => app._clientApiKeyFromCrud(session, crud2));
+      },
+      async listApiKeys() {
+        const results = Result.orThrow(await app._teamApiKeysCache.getOrWait([session, crud.id], "write-only"));
+        return results.map((crud2) => app._clientApiKeyFromCrud(session, crud2));
+      },
+      async createApiKey(options) {
+        const result = await app._interface.createProjectApiKey(
+          await apiKeyCreationOptionsToCrud("team", crud.id, options),
+          session,
+          "client"
+        );
+        await app._teamApiKeysCache.refresh([session, crud.id]);
+        return app._clientApiKeyFromCrud(session, result);
       }
     };
   }
@@ -803,6 +876,23 @@ var __StackClientAppImplIncomplete = class __StackClientAppImplIncomplete {
         const crud2 = await app._interface.createClientContactChannel(contactChannelCreateOptionsToCrud("me", data), session);
         await app._clientContactChannelsCache.refresh([session]);
         return app._clientContactChannelFromCrud(crud2, session);
+      },
+      useApiKeys() {
+        const result = useAsyncCache(app._userApiKeysCache, [session], "user.useApiKeys()");
+        return result.map((crud2) => app._clientApiKeyFromCrud(session, crud2));
+      },
+      async listApiKeys() {
+        const results = await app._interface.listProjectApiKeys({ user_id: "me" }, session, "client");
+        return results.map((crud2) => app._clientApiKeyFromCrud(session, crud2));
+      },
+      async createApiKey(options) {
+        const result = await app._interface.createProjectApiKey(
+          await apiKeyCreationOptionsToCrud("user", "me", options),
+          session,
+          "client"
+        );
+        await app._userApiKeysCache.refresh([session]);
+        return app._clientApiKeyFromCrud(session, result);
       }
     };
   }
@@ -1238,6 +1328,85 @@ var __StackClientAppImplIncomplete = class __StackClientAppImplIncomplete {
       return Result.error(result.error);
     }
   }
+  /**
+   * Initiates a CLI authentication process that allows a command line application
+   * to get a refresh token for a user's account.
+   *
+   * This process works as follows:
+   * 1. The CLI app calls this method, which initiates the auth process with the server
+   * 2. The server returns a polling code and a login code
+   * 3. The CLI app opens a browser window to the appUrl with the login code as a parameter
+   * 4. The user logs in through the browser and confirms the authorization
+   * 5. The CLI app polls for the refresh token using the polling code
+   *
+   * @param options Options for the CLI login
+   * @param options.appUrl The URL of the app that will handle the CLI auth confirmation
+   * @param options.expiresInMillis Optional duration in milliseconds before the auth attempt expires (default: 2 hours)
+   * @param options.maxAttempts Optional maximum number of polling attempts (default: Infinity)
+   * @param options.waitTimeMillis Optional time to wait between polling attempts (default: 2 seconds)
+   * @param options.promptLink Optional function to call with the login URL to prompt the user to open the browser
+   * @returns Result containing either the refresh token or an error
+   */
+  async promptCliLogin(options) {
+    const response = await this._interface.sendClientRequest(
+      "/auth/cli",
+      {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json"
+        },
+        body: JSON.stringify({
+          expires_in_millis: options.expiresInMillis
+        })
+      },
+      null
+    );
+    if (!response.ok) {
+      return Result.error(new KnownErrors.CliAuthError(`Failed to initiate CLI auth: ${response.status} ${await response.text()}`));
+    }
+    const initResult = await response.json();
+    const pollingCode = initResult.polling_code;
+    const loginCode = initResult.login_code;
+    const url = `${options.appUrl}/handler/cli-auth-confirm?login_code=${encodeURIComponent(loginCode)}`;
+    if (options.promptLink) {
+      options.promptLink(url);
+    } else {
+      console.log(`Please visit the following URL to authenticate:
+${url}`);
+    }
+    let attempts = 0;
+    while (attempts < (options.maxAttempts ?? Infinity)) {
+      attempts++;
+      const pollResponse = await this._interface.sendClientRequest("/auth/cli/poll", {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json"
+        },
+        body: JSON.stringify({
+          polling_code: pollingCode
+        })
+      }, null);
+      if (!pollResponse.ok) {
+        return Result.error(new KnownErrors.CliAuthError(`Failed to initiate CLI auth: ${pollResponse.status} ${await pollResponse.text()}`));
+      }
+      const pollResult = await pollResponse.json();
+      if (pollResponse.status === 201 && pollResult.status === "success") {
+        return Result.ok(pollResult.refresh_token);
+      }
+      if (pollResult.status === "waiting") {
+        await wait(options.waitTimeMillis ?? 2e3);
+        continue;
+      }
+      if (pollResult.status === "expired") {
+        return Result.error(new KnownErrors.CliAuthExpiredError("CLI authentication request expired. Please try again."));
+      }
+      if (pollResult.status === "used") {
+        return Result.error(new KnownErrors.CliAuthUsedError("This authentication token has already been used."));
+      }
+      return Result.error(new KnownErrors.CliAuthError(`Unexpected status from CLI auth polling: ${pollResult.status}`));
+    }
+    return Result.error(new KnownErrors.CliAuthError("Timed out waiting for CLI authentication."));
+  }
   async signInWithPasskey() {
     this._ensurePersistentTokenStore();
     const session = await this._getSession();