@sun-asterisk/sungen 3.2.3 → 3.2.4

package/src/tools/sungen-auth/pkce.ts

@@ -0,0 +1,27 @@
+/**
+ * PKCE-S256 + correlation generation for the CLI login flow.
+ *
+ * The backend mandates S256 (plain is rejected). The verifier never leaves the
+ * process except inside the server-to-server `exchange` POST; the challenge is
+ * what travels to the browser side.
+ */
+
+import { randomBytes, createHash } from 'crypto';
+import type { PkceMaterial } from './sungen-auth-types';
+
+/** base64url with padding stripped, per RFC 7636 §A. */
+function base64url(buf: Buffer): string {
+  return buf.toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+
+/** Generate a fresh PKCE verifier + S256 challenge pair. */
+export function generatePkce(): PkceMaterial {
+  const verifier = base64url(randomBytes(32));
+  const challenge = base64url(createHash('sha256').update(verifier).digest());
+  return { verifier, challenge };
+}
+
+/** Random opaque value used to bind the loopback callback to this attempt (CSRF guard). */
+export function randomCorrelation(): string {
+  return randomBytes(16).toString('hex');
+}

package/src/tools/sungen-auth/sungen-auth-types.ts

@@ -0,0 +1,45 @@
+/**
+ * Shared types for the sungen CLI login flow (RFC 8252 native-app login against
+ * a FastSchema v0.13.0 backend: PKCE-S256 + loopback redirect + one-time code).
+ */
+
+/** Persisted, user-level credentials at ~/.sungen/credentials.json (mode 0600). */
+export interface Credentials {
+  /** Bearer JWT minted by the backend exchange step. */
+  token: string;
+  /** Authenticated account email (from /api/auth/me). */
+  email: string;
+  /** Backend base URL the token was issued against (so `feedback` knows where to POST). */
+  api_base_url: string;
+  /** Unix epoch seconds when the token expires, if the backend reports it (single token, no refresh). */
+  expires_at?: number;
+}
+
+/** Response of POST /api/auth/cli/initiate (unwrapped from the {data} envelope). */
+export interface InitiateResponse {
+  /** Signed carrier the dashboard login page consumes. */
+  carrier: string;
+  /** Path (not absolute) to open in the browser, e.g. /dash/login?cli=<carrier>. */
+  authorize_url: string;
+}
+
+/** Response of POST /api/auth/exchange (unwrapped from the {data} envelope). */
+export interface ExchangeResponse {
+  /** Bearer JWT. */
+  token: string;
+  /** ISO expiry string the backend returns (e.g. "2026-07-08T06:42:30Z"). */
+  expires?: string;
+  /** Numeric epoch-seconds expiry, if a build reports it instead. */
+  expires_at?: number;
+}
+
+/** Response of GET /api/auth/me (subset we rely on, unwrapped from {data}). */
+export interface MeResponse {
+  email: string;
+}
+
+/** PKCE material generated per login attempt; never persisted to disk. */
+export interface PkceMaterial {
+  verifier: string;
+  challenge: string;
+}