@thinremote/thinr-cli 1.0.2-alpha.2 → 1.1.0-alpha.1

package/lib/auth.js

@@ -7,7 +7,13 @@ import { writeConfig, readConfig, mergeConfig } from './config.js';
 
 import api, { setBaseURL } from './api.js';
 
+// OAuth device-flow client identifier registered for this CLI on the
+// ThinRemote OAuth provider. Stable across versions.
+const OAUTH_CLIENT_ID = '3b40164d28730e416cbd';
 
+// Hard ceiling on how long to keep polling for the user to finish the
+// device-code flow in the browser before we give up (10 minutes).
+const OAUTH_DEVICE_CODE_TIMEOUT_MS = 10 * 60 * 1000;
 
 /**
  * Authenticate user
@@ -21,7 +27,7 @@ export async function authenticate() {
             { name: 'OAuth', value: 'oauth' },
             { name: 'Token', value: 'token' },
             { name: 'Username and password', value: 'userpass' },
-        ]
+        ],
     });
 
     // Ask for server URL
@@ -30,7 +36,7 @@ export async function authenticate() {
         default: 'console.thinr.io',
         validate: (input) => {
             return input ? true : 'Server URL is required';
-        }
+        },
     });
 
     setBaseURL(`https://${server}`);
@@ -48,7 +54,6 @@ export async function authenticate() {
         // Authenticate with token
         await authenticateWithToken();
     }
-
 }
 
 /**
@@ -56,150 +61,114 @@ export async function authenticate() {
  * @returns {Promise<void>}
  */
 async function authenticateWithUserPass() {
+    // Ask for credentials
+    const username = await input({
+        message: 'Enter username:',
+        validate: (input) => (input ? true : 'Username is required'),
+    });
+    const password = await input({
+        message: 'Enter password:',
+        type: 'password',
+        mask: '*',
+        validate: (input) => (input ? true : 'Password is required'),
+    });
+
+    const spinner = ora('Authenticating...').start();
+
     try {
-        // Ask for credentials
-        const username = await input({
-            message: 'Enter username:',
-            validate: (input) => {
-                return input ? true : 'Username is required';
-            }
-        });
-        const password = await input({
-            message: 'Enter password:',
-            type: 'password',
-            mask: '*',
-            validate: (input) => {
-                return input ? true : 'Password is required';
-            }
+        // OAuth2 password grant
+        const formData = new URLSearchParams();
+        formData.append('grant_type', 'password');
+        formData.append('username', username);
+        formData.append('password', password);
+
+        await api.post(`/oauth/token`, formData, {
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
         });
 
-        // Show spinner
-        const spinner = ora('Authenticating...').start();
-
+        // Replace any existing token with a fresh permanent one
+        spinner.text = 'Preparing user token...';
         try {
-            // Prepare OAuth2 password grant form data
-            const formData = new URLSearchParams();
-            formData.append('grant_type', 'password');
-            formData.append('username', username);
-            formData.append('password', password);
-
-            // Authenticate with server using OAuth2 password flow
-            const response = await api.post(
-                `/oauth/token`,
-                formData,
-                {
-                    headers: {
-                        'Content-Type': 'application/x-www-form-urlencoded'
-                    }
-                }
-            );
-
-            // Update spinner message
-            spinner.text = 'Preparing user token...';
-
-            // Delete existing token if it exists
-            try {
-                await api.delete(
-                    `/v1/users/${username}/tokens/ThinRemote`,
-                );
-            } catch (error) {
-                // Ignore 404 errors (token doesn't exist)
-                if (error.response && error.response.status !== 404) {
-                    throw error;
-                }
-            }
-
-            // Create new token
-            spinner.text = 'Creating new user token...';
-            const createTokenResponse = await api.post(
-                `/v1/users/${username}/tokens`,
-                {
-                    "enabled": true,
-                    "allow": {"*": {"*": "*"}},
-                    "deny": {},
-                    "token": "ThinRemote",
-                    "name": "ThinRemote",
-                    "description": ""
-                },
-                {
-                    headers: {
-                        'Content-Type': 'application/json'
-                    }
-                }
-            );
-            const permanentToken = createTokenResponse.data.access_token;
-
-            // Save configuration with permanent token
-            writeConfig({
-                username,
-                server,
-                token: permanentToken
-            });
-
-            spinner.succeed('Authentication successful');
+            await api.delete(`/v1/users/${username}/tokens/ThinRemote`);
         } catch (error) {
-            spinner.fail('Authentication failed');
-
-            if (error.response && error.response.status === 401) {
-                console.error(chalk.red('Invalid username or password'));
-            } else if (error.response && error.response.status === 404) {
-                console.error(chalk.red('Authentication endpoint not found. Please check the server URL.'));
-            } else {
-                console.error(chalk.red(`Error: ${error.message}`));
-            }
-
-            process.exit(1);
+            if (error.response && error.response.status !== 404) throw error;
         }
+
+        spinner.text = 'Creating new user token...';
+        const createTokenResponse = await api.post(
+            `/v1/users/${username}/tokens`,
+            {
+                enabled: true,
+                allow: { '*': { '*': '*' } },
+                deny: {},
+                token: 'ThinRemote',
+                name: 'ThinRemote',
+                description: '',
+            },
+            { headers: { 'Content-Type': 'application/json' } },
+        );
+        const permanentToken = createTokenResponse.data.access_token;
+
+        // server was already persisted by the outer authenticate(); only
+        // username + token need to be merged here.
+        mergeConfig({ username, token: permanentToken });
+        spinner.succeed('Authentication successful');
     } catch (error) {
-        console.error(chalk.red(`Error: ${error.message}`));
-        process.exit(1);
+        spinner.fail('Authentication failed');
+        if (error.response && error.response.status === 401) {
+            throw new Error('Invalid username or password', { cause: error });
+        }
+        if (error.response && error.response.status === 404) {
+            throw new Error('Authentication endpoint not found. Please check the server URL.', {
+                cause: error,
+            });
+        }
+        throw error;
     }
 }
 
+/**
+ * Exchange the saved refresh_token for a fresh access_token. Throws a
+ * tagged `code: 'unauthorized'` Error when no refresh_token is on
+ * record (e.g. logins made with username/password don't get one) or
+ * when the OAuth server rejects the refresh — both cases mean the
+ * caller has to re-authenticate.
+ *
+ * @returns {Promise<string>} The new access token.
+ */
 export async function refreshToken() {
-    try {
-        const config = readConfig();
-        if (!config || !config.username || !config.server || !config.refresh_token) {
-            console.log(chalk.yellow('No configuration found'));
-            return;
-        }
-
-        //const spinner = ora('Refreshing user token...').start();
-
-        try {
-            // Prepare OAuth2 refresh token form data
-            const formData = new URLSearchParams();
-            formData.append('grant_type', 'refresh_token');
-            formData.append('client_id', '3b40164d28730e416cbd');
-            formData.append('refresh_token', config.refresh_token);
-
-            // Refresh token using OAuth2 refresh flow
-            const response = await api.post(
-                `/oauth/token`,
-                formData,
-                {
-                    headers: {
-                        'Content-Type': 'application/x-www-form-urlencoded'
-                    }
-                }
-            );
-
-            // Save new token in configuration
-            mergeConfig({
-                token: response.data.access_token,
-                refresh_token: response.data.refresh_token
-            });
+    const config = readConfig();
+    if (!config.refresh_token) {
+        const err = new Error('No refresh token available; re-authenticate with `thinr`.');
+        err.code = 'unauthorized';
+        throw err;
+    }
 
-            //spinner.succeed('Token refreshed successfully');
-            return response.data.access_token;
+    const formData = new URLSearchParams();
+    formData.append('grant_type', 'refresh_token');
+    formData.append('client_id', OAUTH_CLIENT_ID);
+    formData.append('refresh_token', config.refresh_token);
 
-        } catch (error) {
-            //spinner.fail('Failed to refresh token');
-            console.error(chalk.red(`Error: ${error.message}`));
-        }
-    } catch (error) {
-        console.error(chalk.red(`Error: ${error.message}`));
+    let response;
+    try {
+        // `_isRefresh` flags this request so the response interceptor
+        // skips its own refresh-on-401 logic — otherwise a refresh that
+        // returned 401 would recurse back here forever.
+        response = await api.post('/oauth/token', formData, {
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            _isRefresh: true,
+        });
+    } catch (_error) {
+        const err = new Error('Token refresh failed; re-authenticate with `thinr`.');
+        err.code = 'unauthorized';
+        throw err;
     }
+
+    mergeConfig({
+        token: response.data.access_token,
+        refresh_token: response.data.refresh_token,
+    });
+    return response.data.access_token;
 }
 
 /**
@@ -217,9 +186,7 @@ export async function deleteToken() {
         const spinner = ora('Deleting user token...').start();
 
         try {
-            await api.delete(
-                `/v1/users/${config.username}/tokens/ThinRemote`,
-            );
+            await api.delete(`/v1/users/${config.username}/tokens/ThinRemote`);
             spinner.succeed('Token deleted successfully');
         } catch (error) {
             if (error.response && error.response.status === 404) {
@@ -239,54 +206,34 @@ export async function deleteToken() {
  * @returns {Promise<void>}
  */
 async function authenticateWithToken() {
+    const username = await input({
+        message: 'Enter username:',
+        validate: (input) => (input ? true : 'Username is required'),
+    });
+    const token = await input({
+        message: 'Enter token:',
+        type: 'password',
+        mask: '*',
+        validate: (input) => (input ? true : 'Token is required'),
+    });
+
+    const spinner = ora('Validating token...').start();
     try {
-        // Ask for username and token
-        const username = await input({
-            message: 'Enter username:',
-            validate: (input) => {
-                return input ? true : 'Username is required';
-            }
-        });
-        const token = await input({
-            message: 'Enter token:',
-            type: 'password',
-            mask: '*',
-            validate: (input) => {
-                return input ? true : 'Token is required';
-            }
+        // The api interceptor attaches Authorization from the saved
+        // config; at this point we haven't persisted the token yet, so
+        // the header has to be passed explicitly for the probe request.
+        await api.get(`/v1/proxies`, {
+            headers: { Authorization: `Bearer ${token}` },
         });
-
-        // Show spinner
-        const spinner = ora('Validating token...').start();
-
-        try {
-            // Validate token by making a request to the proxies API
-            await api.get(
-                `/v1/proxies`,
-            );
-
-            // Save configuration
-            mergeConfig({
-                username,
-                token
-            });
-
-            spinner.succeed('Token validation successful');
-        } catch (error) {
-            spinner.fail('Token validation failed');
-
-            if (error.response && error.response.status === 401) {
-                console.error(chalk.red('Invalid token'));
-            } else {
-                console.error(chalk.red(`Error: ${error.message}`));
-            }
-
-            process.exit(1);
-        }
     } catch (error) {
-        console.error(chalk.red(`Error: ${error.message}`));
-        process.exit(1);
+        spinner.fail('Token validation failed');
+        if (error.response && error.response.status === 401) {
+            throw new Error('Invalid token', { cause: error });
+        }
+        throw error;
     }
+    mergeConfig({ username, token });
+    spinner.succeed('Token validation successful');
 }
 
 /**
@@ -294,159 +241,128 @@ async function authenticateWithToken() {
  * @returns {Promise<void>}
  */
 async function authenticateWithOAuth() {
-
-    const client_id = '3b40164d28730e416cbd';
-    let device_code = '';
+    const client_id = OAUTH_CLIENT_ID;
     let oauth_tokens = {};
 
+    const spinner = ora('Requesting OAuth User Code...').start();
+    let data;
     try {
+        ({ data } = await api.post(
+            `/oauth/device/authorize`,
+            { client_id },
+            { headers: { 'content-type': 'application/x-www-form-urlencoded' } },
+        ));
+        spinner.succeed('OAuth User Code received');
+    } catch (error) {
+        spinner.fail('OAuth device-code request failed');
+        throw error;
+    }
 
-        // Show spinner
-        const spinner = ora('Requesting OAuth User Code...').start();
+    console.log('\nYour one time device code is: ' + chalk.bold(data.user_code));
+    console.log(
+        chalk.blue('Press ' + chalk.bold('ENTER')) +
+            ' to open your browser or submit your device code here: ' +
+            data.verification_uri +
+            '\n',
+    );
+
+    const device_code = data.device_code;
+    let pollDeviceIntervalId;
+    let interval = 5000;
+    let pollError = null; // captured by polling, surfaced after the await
+    const controller = new AbortController();
+
+    function setPollingInterval(ms) {
+        if (pollDeviceIntervalId) clearInterval(pollDeviceIntervalId);
+        pollDeviceIntervalId = setInterval(pollDevice, ms);
+    }
 
+    async function pollDevice() {
         try {
-            // Validate OAuth token by making a request to the proxies API
-            const { data } = await api.post(
-                `/oauth/device/authorize`,
+            const response = await api.post(
+                `/oauth/token`,
                 {
-                    client_id: client_id
+                    grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
+                    client_id,
+                    device_code,
                 },
-                {
-                    headers: {
-                        'content-type': 'application/x-www-form-urlencoded'
-                    }
-                }
+                { headers: { 'content-type': 'application/x-www-form-urlencoded' } },
             );
-
-            spinner.succeed('OAuth User Code received');
-
-            console.log('\nYour one time device code is: ' + chalk.bold(data.user_code));
-
-            console.log(chalk.blue('Press ' + chalk.bold('ENTER')) + ' to open your browser or submit your device code here: ' + data.verification_uri + '\n');
-
-            device_code = data.device_code;
-
-            let validated = false;
-            let pollDeviceIntervalId;
-            let interval = 5000; // Default polling interval
-            const controller = new AbortController();
-
-            function setPollingInterval(interval) {
-                if (pollDeviceIntervalId) {
-                    clearInterval(pollDeviceIntervalId);
-                }
-                pollDeviceIntervalId = setInterval(pollDevice, interval);
+            if (response.status === 200) {
+                oauth_tokens = response.data;
+                controller.abort('validated');
             }
-
-            async function pollDevice () {
-                api.post(
-                    `/oauth/token`,
-                    {
-                        grant_type: "urn:ietf:params:oauth:grant-type:device_code",
-                        client_id: client_id,
-                        device_code: device_code
-                    },
-                     {
-                        headers: {
-                            'content-type': 'application/x-www-form-urlencoded'
-                        }
-                    }
-                )
-                .then((response) => {
-                    if (response.status === 200) {
-                        console.log(response);
-                        validated = true;
-                        oauth_tokens = response.data;
-                        controller.abort("validated");
-                    }
-                }).catch((e) => {
-                    if (e.status === 400) {
-                        // Check for specific OAuth error messages
-                        if ( e.response.data.error === 'authorization_pending' ) {
-                            //console.debug("Authorization pending, continuing to poll...");
-                        } else if ( e.response.data.error === 'slow_down' ) {
-                            //console.debug("Received slow_down, increasing polling interval");
-                            // Increase polling interval to avoid hitting rate limits
-                            clearInterval(pollDeviceIntervalId);
-                            interval = 5000+1000;
-                            setPollingInterval(interval); // Increase to 10 seconds
-                        } else if ( e.response.data.error === 'access_denied' ) {
-                            console.error(chalk.red('User denied the authorization request'));
-                            process.exit(1);
-                        } else if ( e.response.data.error === 'expired_token' ) {
-                            console.error(chalk.red('Device code expired'));
-                            process.exit(1);
-                        } else {
-                           console.error(chalk.red(`OAuth error: ${e.response.data.error}`));
-                        }
-                    }
-                });
-
+        } catch (e) {
+            if (e.response && e.response.status === 400) {
+                const err = e.response.data && e.response.data.error;
+                if (err === 'authorization_pending') return;
+                if (err === 'slow_down') {
+                    interval += 1000;
+                    setPollingInterval(interval);
+                    return;
+                }
+                if (err === 'access_denied') {
+                    pollError = new Error('User denied the authorization request');
+                    controller.abort('error');
+                    return;
+                }
+                if (err === 'expired_token') {
+                    pollError = new Error('Device code expired');
+                    controller.abort('error');
+                    return;
+                }
+                pollError = new Error(`OAuth error: ${err}`);
+                controller.abort('error');
             }
+        }
+    }
 
-            // Poll every 5 seconds
-            setPollingInterval(interval);
-            //pollDeviceIntervalId = setInterval(pollDevice, 5000, client_id, data.device_code);
-
-            // Timeout after 10 minutes
-            setTimeout(() => {
-                clearInterval(pollDeviceIntervalId)
-                controller.abort("timeout");
-            }, 600000);
+    setPollingInterval(interval);
 
+    // 10-minute hard ceiling on the user finishing in the browser
+    const timeoutId = setTimeout(() => {
+        clearInterval(pollDeviceIntervalId);
+        controller.abort('timeout');
+    }, OAUTH_DEVICE_CODE_TIMEOUT_MS);
 
-            // Wait for validation
-            await input({
+    try {
+        await input(
+            {
                 message: 'Press ENTER to continue or wait for authentication...',
                 waitUserInput: true,
-                validate: function (input) {
-                    open(data.verification_uri_complete, {app: [{name: apps.browser}, 'firefox-developer-edition']});
+                validate: () => {
+                    open(data.verification_uri_complete, {
+                        app: [{ name: apps.browser }, 'firefox-developer-edition'],
+                    });
                     return '';
                 },
             },
             {
-                    signal: controller.signal
-            }).catch((error) => {
-                if (error.cause === 'timeout') {
-                    console.log(chalk.yellow('Polling aborted due to timeout'));
-                    // Polling was aborted
-                } else if (error.cause === 'validated') {
-                    console.log(chalk.green('Device authenticated successfully'));
-                }
-            });
-
-            clearInterval(pollDeviceIntervalId);
-
-            const token = oauth_tokens.access_token;
-            const refresh_token = oauth_tokens.refresh_token;
-            const decodedJWT = JSON.parse(Buffer.from(oauth_tokens.access_token.split('.')[1], 'base64').toString());
-            const username = decodedJWT.usr;
-
-            // Save configuration
-            mergeConfig({
-                username,
-                token,
-                refresh_token,
-            });
-
-            spinner.succeed('OAuth token validation successful\n');
-        } catch (error) {
-            spinner.fail('OAuth token validation failed');
-
-            if (error.response && error.response.status === 401) {
-                console.error(chalk.red('Invalid OAuth token'));
-            } else {
-                console.error(chalk.red(`Error: ${error.message}`));
+                signal: controller.signal,
+            },
+        ).catch((error) => {
+            if (error.cause === 'timeout') {
+                console.log(chalk.yellow('Polling aborted due to timeout'));
+            } else if (error.cause === 'validated') {
+                console.log(chalk.green('Device authenticated successfully'));
             }
+            // 'error' cause falls through; we surface pollError below.
+        });
+    } finally {
+        clearInterval(pollDeviceIntervalId);
+        clearTimeout(timeoutId);
+    }
 
-            process.exit(1);
-        }
+    if (pollError) throw pollError;
+    if (!oauth_tokens.access_token) throw new Error('OAuth flow ended without a token');
 
-    } catch (error) {
-        console.error(chalk.red(`Error: ${error.message}`));
-        process.exit(1);
-    }
+    const token = oauth_tokens.access_token;
+    const refresh_token = oauth_tokens.refresh_token;
+    const decodedJWT = JSON.parse(Buffer.from(token.split('.')[1], 'base64').toString());
+    const username = decodedJWT.usr;
 
+    mergeConfig({ username, token, refresh_token });
+    console.log(chalk.green('OAuth token validation successful\n'));
 }
 
 /**