@tempoxyz/example-auth-cli 0.0.0-pr-5.sha-cd892ce

package/dist/Credentials.js

@@ -0,0 +1,81 @@
+/**
+ * The tokens and access key the CLI keeps between runs, in a file only the current user can read.
+ * Access tokens expire after minutes, so `active` refreshes them, and refresh tokens rotate on
+ * every refresh.
+ * @module
+ */
+import * as Fs from 'node:fs/promises';
+import * as Os from 'node:os';
+import * as Path from 'node:path';
+import { z } from 'incur';
+import { KeyAuthorization } from 'ox/tempo';
+/** Where Tempo Auth runs, the CLI's Connect app, and where tokens live. */
+export const env = z.object({
+    TEMPO_AUTH_CREDENTIALS: z
+        .string()
+        .default(Path.join(Os.homedir(), '.config', 'tempo-auth', 'credentials.json')),
+    TEMPO_AUTH_URL: z.string().default('http://localhost:5173'),
+    // The `tempo-cli` Connect app in the staging environment, which refreshes with its client ID alone.
+    CLI_CLIENT_ID: z.string().default('client_01M4N1K6HAT9QWVT2V59NNY48J'),
+});
+/**
+ * Returns the saved tokens, refreshing the access token when it has expired, or `undefined`.
+ * Credentials without an access key, from an older CLI, or whose key has expired count as signed
+ * out, so `login` authorizes a new key.
+ */
+export async function active(env) {
+    const saved = await Fs.readFile(env.TEMPO_AUTH_CREDENTIALS, 'utf8')
+        // An older CLI saved no `key`, which this check catches at runtime.
+        .then((text) => JSON.parse(text))
+        .catch(() => undefined);
+    if (!saved?.key || expired(saved.key))
+        return undefined;
+    if (saved.expiresAt - 30_000 > Date.now())
+        return saved;
+    const response = await fetch(new URL('/oauth2/token', env.TEMPO_AUTH_URL), {
+        body: new URLSearchParams({
+            client_id: env.CLI_CLIENT_ID,
+            grant_type: 'refresh_token',
+            refresh_token: saved.refreshToken,
+        }),
+        method: 'POST',
+    });
+    if (!response.ok)
+        return undefined;
+    return save(env, {
+        key: saved.key,
+        tokens: (await response.json()),
+    });
+}
+/** Reads the signed-in person's email from Tempo Auth's userinfo endpoint. */
+export async function email(env, options) {
+    const response = await fetch(new URL('/oauth2/userinfo', env.TEMPO_AUTH_URL), {
+        headers: { authorization: `Bearer ${options.credentials.accessToken}` },
+    });
+    if (!response.ok)
+        throw new Error(`userinfo answered ${response.status}.`);
+    return (await response.json()).email;
+}
+/** Whether the key's authorization has expired. */
+function expired(key) {
+    const { expiry } = KeyAuthorization.fromRpc(key.keyAuthorization);
+    return Boolean(expiry) && expiry * 1000 <= Date.now();
+}
+/** Forgets the saved tokens. */
+export async function remove(env) {
+    await Fs.rm(env.TEMPO_AUTH_CREDENTIALS, { force: true });
+}
+/** Saves a token response and the access key, readable only by the current user. */
+export async function save(env, options) {
+    const credentials = {
+        accessToken: options.tokens.access_token,
+        expiresAt: Date.now() + options.tokens.expires_in * 1000,
+        key: options.key,
+        refreshToken: options.tokens.refresh_token,
+    };
+    await Fs.mkdir(Path.dirname(env.TEMPO_AUTH_CREDENTIALS), { recursive: true });
+    await Fs.writeFile(env.TEMPO_AUTH_CREDENTIALS, JSON.stringify(credentials), {
+        mode: 0o600,
+    });
+    return credentials;
+}

package/dist/TempoAccount.js

@@ -0,0 +1,39 @@
+/**
+ * The app's access key on a person's Tempo Account. The app holds the key, asks Tempo Auth for a
+ * key authorization for it, and sends with it on Tempo testnet. The first transaction carries the
+ * authorization, which registers the key.
+ * @module
+ */
+import { Hex } from 'ox';
+import { KeyAuthorization } from 'ox/tempo';
+import { Account, Addresses, KeyAuthorizationManager } from 'viem/tempo';
+import { client } from './viem.config.js';
+/**
+ * The key authorization request for `accessKey`, in the Accounts SDK's `wallet_connect` format: up
+ * to 10 pathUSD in transfers, for a day.
+ */
+export function getKeyAuthorizationRequest(accessKey) {
+    return {
+        address: accessKey.address,
+        chainId: Hex.fromNumber(client.chain.id),
+        expiry: Math.floor(Date.now() / 1000) + 24 * 60 * 60,
+        keyType: 'secp256k1',
+        limits: [{ limit: Hex.fromNumber(10000000n), token: Addresses.pathUsd }],
+        scopes: [
+            { address: Addresses.pathUsd, selector: 'transfer(address,uint256)' },
+        ],
+    };
+}
+/** The key as a viem account acting for the Tempo Account. viem attaches the authorization until the chain registers the key. */
+export function from(key) {
+    const keyAuthorizationManager = KeyAuthorizationManager.memory();
+    keyAuthorizationManager.set({
+        accessKey: Account.fromSecp256k1(key.privateKey).address,
+        address: key.account,
+        chainId: client.chain.id,
+    }, KeyAuthorization.fromRpc(key.keyAuthorization));
+    return Account.fromSecp256k1(key.privateKey, {
+        access: key.account,
+        keyAuthorizationManager,
+    });
+}

package/dist/commands/fund.js

@@ -0,0 +1,18 @@
+/** Funds the person's Tempo Account from the Tempo testnet faucet, including pathUSD for fees. @module */
+import { Cli } from 'incur';
+import * as Credentials from '../Credentials.js';
+import { client } from '../viem.config.js';
+export default Cli.command({
+    description: 'Fund your Tempo Account with testnet tokens',
+    env: Credentials.env,
+    async run(c) {
+        const credentials = await Credentials.active(c.env);
+        if (!credentials)
+            return c.error({
+                code: 'SIGNED_OUT',
+                message: 'Not signed in. Run `login`.',
+            });
+        await client.faucet.fundSync({ account: credentials.key.account });
+        return { account: credentials.key.account, funded: true };
+    },
+});

package/dist/commands/login.js

@@ -0,0 +1,68 @@
+/**
+ * Signs in: shows a code to approve in any browser, waits for approval, and saves the tokens with
+ * the CLI's new access key and its authorization.
+ * @module
+ */
+import * as Os from 'node:os';
+import { Cli } from 'incur';
+import * as Credentials from '../Credentials.js';
+import { Account, Secp256k1 } from 'viem/tempo';
+import * as TempoAccount from '../TempoAccount.js';
+export default Cli.command({
+    description: 'Sign in by approving a code in any browser',
+    env: Credentials.env,
+    async *run(c) {
+        // The approval page shows the key's limits beside the device.
+        const privateKey = Secp256k1.randomPrivateKey();
+        const authorized = await fetch(new URL('/api/device/authorize', c.env.TEMPO_AUTH_URL), {
+            body: JSON.stringify({
+                device: Os.hostname(),
+                keyAuthorization: TempoAccount.getKeyAuthorizationRequest(Account.fromSecp256k1(privateKey)),
+            }),
+            headers: { 'content-type': 'application/json' },
+            method: 'POST',
+        });
+        if (!authorized.ok)
+            return c.error({ code: 'AUTHORIZE', message: 'Could not start sign-in.' });
+        const code = (await authorized.json());
+        yield `Open ${code.verification_uri_complete}`;
+        yield `and confirm the code ${code.user_code}.`;
+        let interval = code.interval;
+        const deadline = Date.now() + code.expires_in * 1000;
+        while (Date.now() < deadline) {
+            await new Promise((resolve) => setTimeout(resolve, interval * 1000));
+            const response = await fetch(new URL('/api/device/token', c.env.TEMPO_AUTH_URL), {
+                body: JSON.stringify({ device_code: code.device_code }),
+                headers: { 'content-type': 'application/json' },
+                method: 'POST',
+            });
+            const body = (await response.json());
+            if ('access_token' in body) {
+                const credentials = await Credentials.save(c.env, {
+                    key: {
+                        account: body.account,
+                        keyAuthorization: body.key_authorization,
+                        privateKey,
+                    },
+                    tokens: body,
+                });
+                const email = await Credentials.email(c.env, { credentials });
+                // A streaming command prints what it yields, not what it returns.
+                yield `Signed in as ${email}.`;
+                return c.ok({ email });
+            }
+            // RFC 8628 asks a client told to slow down to add 5 seconds to its interval.
+            if (body.error === 'slow_down')
+                interval += 5;
+            else if (body.error !== 'authorization_pending')
+                return c.error({
+                    code: 'DENIED',
+                    message: `Sign-in failed: ${body.error}.`,
+                });
+        }
+        return c.error({
+            code: 'EXPIRED',
+            message: 'The code expired. Sign in again.',
+        });
+    },
+});

package/dist/commands/logout.js

@@ -0,0 +1,11 @@
+/** Forgets the saved tokens. @module */
+import { Cli } from 'incur';
+import * as Credentials from '../Credentials.js';
+export default Cli.command({
+    description: 'Sign out on this machine',
+    env: Credentials.env,
+    async run(c) {
+        await Credentials.remove(c.env);
+        return { signedOut: true };
+    },
+});

package/dist/commands/send.js

@@ -0,0 +1,36 @@
+/** Sends pathUSD from the person's Tempo Account with the CLI's access key. @module */
+import { Cli, z } from 'incur';
+import { Value } from 'ox';
+import { Addresses } from 'viem/tempo';
+import * as Credentials from '../Credentials.js';
+import * as TempoAccount from '../TempoAccount.js';
+import { client } from '../viem.config.js';
+export default Cli.command({
+    args: z.object({
+        to: z
+            .string()
+            .regex(/^0x[0-9a-fA-F]{40}$/)
+            .describe('Recipient address'),
+        amount: z
+            .string()
+            .regex(/^\d+(\.\d{1,6})?$/)
+            .describe('Amount of pathUSD, such as 0.01'),
+    }),
+    description: 'Send pathUSD from your Tempo Account',
+    env: Credentials.env,
+    async run(c) {
+        const credentials = await Credentials.active(c.env);
+        if (!credentials)
+            return c.error({
+                code: 'SIGNED_OUT',
+                message: 'Not signed in. Run `login`.',
+            });
+        const { receipt } = await client.token.transferSync({
+            account: TempoAccount.from(credentials.key),
+            amount: Value.from(c.args.amount, 6),
+            to: c.args.to,
+            token: Addresses.pathUsd,
+        });
+        return { status: receipt.status, transactionHash: receipt.transactionHash };
+    },
+});

package/dist/commands/whoami.js

@@ -0,0 +1,19 @@
+/** Prints the signed-in person's email and Tempo Account, refreshing the saved tokens when needed. @module */
+import { Cli } from 'incur';
+import * as Credentials from '../Credentials.js';
+export default Cli.command({
+    description: 'Show who is signed in',
+    env: Credentials.env,
+    async run(c) {
+        const credentials = await Credentials.active(c.env);
+        if (!credentials)
+            return c.error({
+                code: 'SIGNED_OUT',
+                message: 'Not signed in. Run `login`.',
+            });
+        return {
+            account: credentials.key.account,
+            email: await Credentials.email(c.env, { credentials }),
+        };
+    },
+});

package/dist/index.js

@@ -0,0 +1,20 @@
+#!/usr/bin/env node
+/**
+ * An internal CLI that signs in through Tempo Auth's device grant. Each command is a file in
+ * `commands/`, which incur loads by name.
+ *
+ * ```sh
+ * node index.ts login
+ * node index.ts whoami
+ * node index.ts fund
+ * node index.ts send 0x000000000000000000000000000000000000dEaD 0.01
+ * node index.ts logout
+ * ```
+ * @module
+ */
+import { Cli } from 'incur';
+await Cli.create('tempo', {
+    description: "Signs in to Tempo through Tempo Auth's device grant.",
+})
+    .fs(new URL('./commands/', import.meta.url))
+    .serve();

package/dist/viem.config.js

@@ -0,0 +1,7 @@
+/** The viem client the example shares: Tempo testnet, paying fees in pathUSD. @module */
+import { Addresses, createClient } from 'viem/tempo';
+import { tempoTestnet } from 'viem/tempo/chains';
+export const client = createClient({
+    chain: tempoTestnet,
+    feeToken: Addresses.pathUsd,
+});

package/package.json

@@ -0,0 +1,29 @@
+{
+  "name": "@tempoxyz/example-auth-cli",
+  "version": "0.0.0-pr-5.sha-cd892ce",
+  "description": "Signs in to Tempo through Tempo Auth's device grant.",
+  "type": "module",
+  "bin": {
+    "tempo": "./dist/index.js"
+  },
+  "files": [
+    "dist"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "incur": "0.5.1",
+    "ox": "0.14.56",
+    "viem": "https://pkg.pr.new/viem@0872b53"
+  },
+  "devDependencies": {
+    "@types/node": "26.6.4",
+    "typescript": "7.0.2"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "check:types": "tsc",
+    "start": "node index.ts"
+  }
+}