@symbo.ls/cli 2.33.34 → 2.33.35

package/bin/login.js

@@ -2,6 +2,8 @@
 
 import inquirer from 'inquirer'
 import chalk from 'chalk'
+import crypto from 'crypto'
+import { spawn } from 'child_process'
 import { program } from './program.js'
 import { getApiUrl, saveCliConfig, loadCliConfig } from '../helpers/config.js'
 import { CredentialManager } from '../helpers/credentialManager.js'
@@ -10,7 +12,7 @@ function websiteFromApi(apiBaseUrl) {
   try {
     const u = new URL(apiBaseUrl)
     const host = u.host
-    if (apiBaseUrl.startsWith('http://localhost')) return 'http://localhost:1024'
+    if (apiBaseUrl.startsWith('http://localhost')) return 'https://2dd379117f83.ngrok-free.app'
     if (host === 'api.dev.symbols.app') return 'https://dev.symbols.app'
     if (host === 'api.staging.symbols.app') return 'https://staging.symbols.app'
     if (host === 'api.test.symbols.app') return 'https://test.symbols.app'
@@ -23,6 +25,82 @@ function websiteFromApi(apiBaseUrl) {
   }
 }
 
+function openBrowser(url) {
+  try {
+    const platform = process.platform
+    if (platform === 'darwin') {
+      spawn('open', [url], { stdio: 'ignore', detached: true }).unref()
+      return true
+    }
+    if (platform === 'win32') {
+      // Use cmd's "start" to open default browser
+      spawn('cmd', ['/c', 'start', '', url], { stdio: 'ignore', detached: true }).unref()
+      return true
+    }
+    // linux, etc.
+    spawn('xdg-open', [url], { stdio: 'ignore', detached: true }).unref()
+    return true
+  } catch (_) {
+    return false
+  }
+}
+
+function extractAuthFromResponse(data) {
+  const user = data?.data?.user || data?.user
+  const tokens = data?.data?.tokens || data?.tokens || {}
+  const accessToken =
+    tokens?.accessToken ||
+    data?.token ||
+    data?.accessToken ||
+    data?.jwt ||
+    data?.data?.token ||
+    data?.data?.accessToken ||
+    data?.data?.jwt
+  const refreshToken = tokens?.refreshToken || null
+  const accessTokenExp = tokens?.accessTokenExp?.expiresAt || tokens?.accessTokenExp || null
+  return { user, accessToken, refreshToken, accessTokenExp }
+}
+
+function randomVerifier(len = 64) {
+  const chars = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~'
+  let out = ''
+  for (let i = 0; i < len; i++) out += chars.charAt(Math.floor(Math.random() * chars.length))
+  return out
+}
+
+function base64urlFromBuffer(buf) {
+  return Buffer.from(buf)
+    .toString('base64')
+    .replace(/\+/g, '-')
+    .replace(/\//g, '_')
+    .replace(/=+$/g, '')
+}
+
+function sha256Base64url(input) {
+  const digest = crypto.createHash('sha256').update(input).digest()
+  return base64urlFromBuffer(digest)
+}
+
+function extractSessionStatus(data) {
+  return (
+    data?.status ||
+    data?.data?.status ||
+    data?.state ||
+    data?.data?.state ||
+    null
+  )
+}
+
+function extractConfirmToken(data) {
+  return (
+    data?.access_token ||
+    data?.data?.access_token ||
+    data?.token ||
+    data?.data?.token ||
+    null
+  )
+}
+
 program
   .command('login')
   .description('Sign in to Symbols')
@@ -33,7 +111,7 @@ program
 
     // Prompt for credentials
     const currentConfig = loadCliConfig()
-    const answers = await inquirer.prompt([
+    const first = await inquirer.prompt([
       {
         type: 'input',
         name: 'apiBaseUrl',
@@ -42,72 +120,160 @@ program
         validate: input => /^https?:\/\//.test(input) || '❌ Please enter a valid URL'
       },
       {
-        type: 'input',
-        name: 'email',
-        message: 'Email:',
-        validate: input => input.includes('@') || '❌ Please enter a valid email address'
+        type: 'list',
+        name: 'method',
+        message: 'Sign in method:',
+        choices: [
+          { name: 'Email + Password', value: 'password' },
+          // Uses plugin-style PKCE session flow so providers don't need localhost redirects
+          { name: 'Continue with Google (opens browser)', value: 'google_browser' },
+          { name: 'Continue with GitHub (opens browser)', value: 'github_browser' },
+        ],
+        default: 'password',
       },
-      {
-        type: 'password',
-        name: 'password',
-        message: 'Password:',
-        validate: input => input.length >= 6 || '❌ Password must be at least 6 characters'
-      }
     ])
 
     try {
-      // Make login request
-      console.log(chalk.dim('\nAuthenticating...'))
-      const response = await fetch(`${answers.apiBaseUrl}/core/auth/login`, {
-        method: 'POST',
-        headers: {
-          'Content-Type': 'application/json'
-        },
-        body: JSON.stringify({
-          email: answers.email,
-          password: answers.password
+      let data
+      let apiBaseUrl = first.apiBaseUrl
+
+      if (first.method === 'password') {
+        const answers = await inquirer.prompt([
+          {
+            type: 'input',
+            name: 'email',
+            message: 'Email:',
+            validate: input => input.includes('@') || '❌ Please enter a valid email address'
+          },
+          {
+            type: 'password',
+            name: 'password',
+            message: 'Password:',
+            validate: input => input.length >= 6 || '❌ Password must be at least 6 characters'
+          }
+        ])
+
+        // Make login request
+        console.log(chalk.dim('\nAuthenticating...'))
+        const response = await fetch(`${apiBaseUrl}/core/auth/login`, {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({ email: answers.email, password: answers.password })
         })
-      })
 
-      const data = await response.json()
+        data = await response.json()
+
+        if (!response.ok) {
+          const msg = data?.message || data?.error || `Authentication failed (${response.status})`
+          const err = new Error(msg)
+          err.response = { status: response.status, data }
+          throw err
+        }
+      } else if (first.method === 'google_browser' || first.method === 'github_browser') {
+        const sessionId = crypto.randomUUID()
+        const codeVerifier = randomVerifier(64)
+        const codeChallenge = sha256Base64url(codeVerifier)
+
+        console.log(chalk.dim('\nCreating secure sign-in session...'))
+        const sessionResp = await fetch(`${apiBaseUrl}/core/auth/session`, {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({
+            session_id: sessionId,
+            code_challenge: codeChallenge,
+            plugin_info: { version: 'cli', figma_env: 'cli' }
+          })
+        })
+
+        const sessionData = await sessionResp.json().catch(async () => ({ message: await sessionResp.text() }))
+        if (!sessionResp.ok) {
+          const msg = sessionData?.message || sessionData?.error || `Failed to create session (${sessionResp.status})`
+          throw new Error(msg)
+        }
+
+        const website = websiteFromApi(apiBaseUrl)
+        const signinUrl = `${website.replace(/\/+$/,'')}/signin?session=${encodeURIComponent(sessionId)}`
+
+        console.log(chalk.dim('\nOpening your browser to complete sign-in...'))
+        if (!openBrowser(signinUrl)) {
+          console.log(chalk.yellow('\nCould not auto-open a browser. Please open this URL manually:\n'))
+          console.log(chalk.cyan(signinUrl) + '\n')
+        }
+
+        console.log(chalk.gray('Waiting for you to finish signing in (Ctrl+C to cancel)...'))
+
+        const startedAt = Date.now()
+        const timeoutMs = 3 * 60 * 1000
+        const pollMs = 1500
+
+        // Poll until server says session is ready_for_confirm
+        // (Website login/register will attach ?session=... to mark the session ready)
+        while (true) {
+          if (Date.now() - startedAt > timeoutMs) {
+            throw new Error('Timed out waiting for sign-in to complete in the browser')
+          }
+
+          const statusResp = await fetch(
+            `${apiBaseUrl}/core/auth/session/status?session=${encodeURIComponent(sessionId)}`
+          )
+          const statusData = await statusResp.json().catch(async () => ({ message: await statusResp.text() }))
+
+          if (!statusResp.ok) {
+            const msg = statusData?.message || statusData?.error || `Failed to check session status (${statusResp.status})`
+            throw new Error(msg)
+          }
+
+          const status = extractSessionStatus(statusData)
+          if (status === 'ready_for_confirm') break
+          if (status === 'expired' || status === 'revoked' || status === 'invalid') {
+            throw new Error(`Session became unusable (${status})`)
+          }
+
+          await new Promise(resolve => setTimeout(resolve, pollMs))
+        }
+
+        console.log(chalk.dim('Confirming session...'))
+        const confirmResp = await fetch(`${apiBaseUrl}/core/auth/session/confirm`, {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({ session_id: sessionId, code_verifier: codeVerifier })
+        })
+
+        const confirmData = await confirmResp.json().catch(async () => ({ message: await confirmResp.text() }))
+        if (!confirmResp.ok) {
+          const msg = confirmData?.message || confirmData?.error || `Failed to confirm session (${confirmResp.status})`
+          throw new Error(msg)
+        }
+
+        const token = extractConfirmToken(confirmData)
+        if (!token) {
+          throw new Error('Sign-in succeeded but no access token was returned by the server')
+        }
 
-      if (!response.ok) {
-        const msg = data?.message || data?.error || `Authentication failed (${response.status})`
-        const err = new Error(msg)
-        err.response = { status: response.status, data }
-        throw err
+        // Normalize shape to reuse existing credential save logic
+        data = { token }
+      } else {
+        throw new Error('Unknown login method')
       }
 
-      // Extract token from various possible shapes
-      const user = data?.data?.user || data?.user
-      const tokens = data?.data?.tokens || data?.tokens || {}
-      const token =
-        tokens?.accessToken ||
-        data?.token ||
-        data?.accessToken ||
-        data?.jwt ||
-        data?.data?.token ||
-        data?.data?.accessToken ||
-        data?.data?.jwt
-      if (!token) {
+      const { user, accessToken, refreshToken, accessTokenExp } = extractAuthFromResponse(data)
+      if (!accessToken) {
         throw new Error('Login succeeded but no token was returned by the server')
       }
-      const refreshToken = tokens?.refreshToken || null
-      const accessTokenExp = tokens?.accessTokenExp?.expiresAt || null
 
       // Save credentials
       const credManager = new CredentialManager()
       credManager.saveCredentials({
-        apiBaseUrl: answers.apiBaseUrl,
-        authToken: token,
+        apiBaseUrl,
+        authToken: accessToken,
         refreshToken,
         authTokenExpiresAt: accessTokenExp,
         userId: user?.id || data?.userId,
-        email: user?.email || answers.email
+        email: user?.email || null
       })
 
       // Persist API base URL to local config for this project as well
-      saveCliConfig({ apiBaseUrl: answers.apiBaseUrl })
+      saveCliConfig({ apiBaseUrl })
 
       console.log(chalk.green('\n✨ Successfully logged in!'))
       console.log(chalk.white('\nYou can now use Symbols CLI commands:'))
@@ -120,7 +286,7 @@ program
       console.log(chalk.dim('For more commands, run: smbls --help\n'))
 
     } catch (error) {
-      const website = websiteFromApi(answers.apiBaseUrl)
+      const website = websiteFromApi(first.apiBaseUrl)
       console.log(chalk.red('\n❌ Login failed'))
       console.log(chalk.white('\nError:'))
       console.log(chalk.yellow(error.message || 'Unknown error'))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@symbo.ls/cli",
-  "version": "2.33.34",
+  "version": "2.33.35",
   "description": "Fetch your Symbols configuration",
   "main": "bin/fetch.js",
   "author": "Symbols",
@@ -15,9 +15,9 @@
     "vpatch": "npm version patch && npm publish"
   },
   "dependencies": {
-    "@symbo.ls/fetch": "^2.33.34",
-    "@symbo.ls/init": "^2.33.34",
-    "@symbo.ls/socket": "^2.33.34",
+    "@symbo.ls/fetch": "^2.33.35",
+    "@symbo.ls/init": "^2.33.35",
+    "@symbo.ls/socket": "^2.33.35",
     "chalk": "^5.4.1",
     "chokidar": "^4.0.3",
     "commander": "^13.1.0",
@@ -28,5 +28,5 @@
     "socket.io-client": "^4.8.1",
     "v8-compile-cache": "^2.4.0"
   },
-  "gitHead": "14a204110bf402fb4bb09d449ccc9abd1b19ef48"
+  "gitHead": "3ad860e75a24c41afaac79d639f7a9162c2f4c81"
 }