@thinremote/thinr-cli 1.3.5 → 1.4.0

package/lib/auth.js

@@ -1,428 +0,0 @@
-import { Buffer } from 'node:buffer';
-import { input, select } from '@inquirer/prompts';
-import ora from 'ora';
-import open, { apps } from 'open';
-import { writeConfig, readConfig, mergeConfig } from './config.js';
-import { label, success, warning, error as errorStyle, info } from './format.js';
-
-import api, { setBaseURL } from './api.js';
-import { OAUTH, TIMEOUTS } from './constants.js';
-import { v1 } from './paths.js';
-
-const OAUTH_CLIENT_ID = OAUTH.CLIENT_ID;
-const OAUTH_DEVICE_CODE_TIMEOUT_MS = TIMEOUTS.OAUTH_DEVICE_CODE_MS;
-
-/**
- * Authenticate user
- * @returns {Promise<void>}
- */
-export async function authenticate() {
-    // When re-authenticating an existing profile, default the server prompt
-    // to the one already stored so `thinr login` is a couple of keystrokes.
-    const existing = readConfig();
-
-    // Ask for authentication method
-    const method = await select({
-        message: 'How would you like to authenticate?',
-        choices: [
-            { name: 'OAuth', value: 'oauth' },
-            { name: 'Token', value: 'token' },
-            { name: 'Username and password', value: 'userpass' },
-        ],
-    });
-
-    // Ask for server URL
-    const server = await input({
-        message: 'Enter server URL:',
-        default: existing?.server || 'console.thinr.io',
-        validate: (input) => {
-            return input ? true : 'Server URL is required';
-        },
-    });
-
-    setBaseURL(`https://${server}`);
-
-    writeConfig({
-        server,
-    });
-
-    if (method === 'userpass') {
-        // Authenticate with username and password
-        await authenticateWithUserPass();
-    } else if (method === 'oauth') {
-        await authenticateWithOAuth();
-    } else {
-        // Authenticate with token
-        await authenticateWithToken();
-    }
-}
-
-/**
- * Authenticate with username and password using OAuth2 password flow
- * @returns {Promise<void>}
- */
-async function authenticateWithUserPass() {
-    // Ask for credentials
-    const username = await input({
-        message: 'Enter username:',
-        validate: (input) => (input ? true : 'Username is required'),
-    });
-    const password = await input({
-        message: 'Enter password:',
-        type: 'password',
-        mask: '*',
-        validate: (input) => (input ? true : 'Password is required'),
-    });
-
-    const spinner = ora('Authenticating...').start();
-
-    try {
-        // OAuth2 password grant
-        const formData = new URLSearchParams();
-        formData.append('grant_type', 'password');
-        formData.append('username', username);
-        formData.append('password', password);
-
-        await api.post(`/oauth/token`, formData, {
-            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-        });
-
-        // Replace any existing token with a fresh permanent one
-        spinner.text = 'Preparing user token...';
-        try {
-            await api.delete(`${v1(username)}/tokens/ThinRemote`);
-        } catch (error) {
-            if (error.response && error.response.status !== 404) throw error;
-        }
-
-        spinner.text = 'Creating new user token...';
-        const createTokenResponse = await api.post(
-            `${v1(username)}/tokens`,
-            {
-                enabled: true,
-                allow: { '*': { '*': '*' } },
-                deny: {},
-                token: 'ThinRemote',
-                name: 'ThinRemote',
-                description: '',
-            },
-            { headers: { 'Content-Type': 'application/json' } },
-        );
-        const permanentToken = createTokenResponse.data.access_token;
-
-        // server was already persisted by the outer authenticate(); only
-        // username + token need to be merged here.
-        mergeConfig({ username, token: permanentToken });
-        spinner.succeed('Authentication successful');
-    } catch (error) {
-        spinner.fail('Authentication failed');
-        if (error.response && error.response.status === 401) {
-            throw new Error('Invalid username or password', { cause: error });
-        }
-        if (error.response && error.response.status === 404) {
-            throw new Error('Authentication endpoint not found. Please check the server URL.', {
-                cause: error,
-            });
-        }
-        throw error;
-    }
-}
-
-/**
- * Exchange the saved refresh_token for a fresh access_token. Throws a
- * tagged `code: 'unauthorized'` Error when no refresh_token is on
- * record (e.g. logins made with username/password don't get one) or
- * when the OAuth server rejects the refresh — both cases mean the
- * caller has to re-authenticate.
- *
- * Concurrent callers share a single in-flight refresh: refresh tokens
- * are rotated on use, so issuing two refreshes in parallel makes the
- * second one fail against an already-consumed token. The shared
- * promise lets every awaiter see the same result and lets the next
- * caller (after completion) start a new refresh against the freshly
- * persisted token.
- *
- * @returns {Promise<string>} The new access token.
- */
-let inFlightRefresh = null;
-
-export async function refreshToken() {
-    if (inFlightRefresh) return inFlightRefresh;
-    inFlightRefresh = doRefresh().finally(() => {
-        inFlightRefresh = null;
-    });
-    return inFlightRefresh;
-}
-
-async function doRefresh() {
-    const config = readConfig();
-    if (!config.refresh_token) {
-        const err = new Error('Session expired. Run `thinr login` to sign in again.');
-        err.code = 'unauthorized';
-        throw err;
-    }
-
-    const formData = new URLSearchParams();
-    formData.append('grant_type', 'refresh_token');
-    formData.append('client_id', OAUTH_CLIENT_ID);
-    formData.append('refresh_token', config.refresh_token);
-
-    let response;
-    try {
-        // `_isRefresh` flags this request so the response interceptor
-        // skips its own refresh-on-401 logic — otherwise a refresh that
-        // returned 401 would recurse back here forever.
-        response = await api.post('/oauth/token', formData, {
-            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-            _isRefresh: true,
-        });
-    } catch (_error) {
-        const err = new Error('Session expired. Run `thinr login` to sign in again.');
-        err.code = 'unauthorized';
-        throw err;
-    }
-
-    mergeConfig({
-        token: response.data.access_token,
-        refresh_token: response.data.refresh_token,
-    });
-    return response.data.access_token;
-}
-
-/**
- * Milliseconds-since-epoch expiry of a JWT access token, or null when
- * the token is not a decodable JWT (permanent API tokens have no exp).
- */
-function jwtExpiryMs(token) {
-    try {
-        const payload = JSON.parse(Buffer.from(token.split('.')[1], 'base64').toString());
-        return typeof payload.exp === 'number' ? payload.exp * 1000 : null;
-    } catch {
-        return null;
-    }
-}
-
-/**
- * Return a currently-valid access token, refreshing first when the
- * stored one is an expired (or about-to-expire) JWT. HTTP requests
- * recover from expiry through the api.js response interceptor, but
- * WebSocket handshakes have no retry layer: callers opening a WS use
- * this to start from a valid token. Tokens without a decodable `exp`
- * and profiles without a refresh_token pass through untouched.
- */
-export async function ensureFreshToken() {
-    const config = readConfig();
-    if (!config?.token || !config.refresh_token) return config?.token ?? null;
-    const expiresAt = jwtExpiryMs(config.token);
-    if (expiresAt === null || expiresAt - Date.now() > TIMEOUTS.TOKEN_EXPIRY_SLACK_MS) {
-        return config.token;
-    }
-    return refreshToken();
-}
-
-/**
- * Delete user token from server
- * @returns {Promise<void>}
- */
-export async function deleteToken() {
-    try {
-        const config = readConfig();
-        if (!config || !config.username || !config.server || !config.token) {
-            console.log(warning('No configuration found'));
-            return;
-        }
-
-        const spinner = ora('Deleting user token...').start();
-
-        try {
-            await api.delete(`${v1(config.username)}/tokens/ThinRemote`);
-            spinner.succeed('Token deleted successfully');
-        } catch (error) {
-            if (error.response && error.response.status === 404) {
-                spinner.succeed('Token was already deleted');
-            } else {
-                spinner.fail('Failed to delete token');
-                console.error(errorStyle(`Error: ${error.message}`));
-            }
-        }
-    } catch (error) {
-        console.error(errorStyle(`Error: ${error.message}`));
-    }
-}
-
-/**
- * Authenticate with token
- * @returns {Promise<void>}
- */
-async function authenticateWithToken() {
-    const username = await input({
-        message: 'Enter username:',
-        validate: (input) => (input ? true : 'Username is required'),
-    });
-    const token = await input({
-        message: 'Enter token:',
-        type: 'password',
-        mask: '*',
-        validate: (input) => (input ? true : 'Token is required'),
-    });
-
-    const spinner = ora('Validating token...').start();
-    try {
-        // The api interceptor attaches Authorization from the saved
-        // config; at this point we haven't persisted the token yet, so
-        // the header has to be passed explicitly for the probe request.
-        await api.get(`/v1/proxies`, {
-            headers: { Authorization: `Bearer ${token}` },
-        });
-    } catch (error) {
-        spinner.fail('Token validation failed');
-        if (error.response && error.response.status === 401) {
-            throw new Error('Invalid token', { cause: error });
-        }
-        throw error;
-    }
-    mergeConfig({ username, token });
-    spinner.succeed('Token validation successful');
-}
-
-/**
- * Authenticate with OAuth token
- * @returns {Promise<void>}
- */
-async function authenticateWithOAuth() {
-    const client_id = OAUTH_CLIENT_ID;
-    let oauth_tokens = {};
-
-    const spinner = ora('Requesting OAuth User Code...').start();
-    let data;
-    try {
-        ({ data } = await api.post(
-            `/oauth/device/authorize`,
-            { client_id },
-            { headers: { 'content-type': 'application/x-www-form-urlencoded' } },
-        ));
-        spinner.succeed('OAuth User Code received');
-    } catch (error) {
-        spinner.fail('OAuth device-code request failed');
-        throw error;
-    }
-
-    console.log('\nYour one time device code is: ' + label(data.user_code));
-    console.log(
-        info('Press ' + label('ENTER')) +
-            ' to open your browser or submit your device code here: ' +
-            data.verification_uri +
-            '\n',
-    );
-
-    const device_code = data.device_code;
-    let pollDeviceIntervalId;
-    let interval = 5000;
-    let pollError = null; // captured by polling, surfaced after the await
-    const controller = new AbortController();
-
-    function setPollingInterval(ms) {
-        if (pollDeviceIntervalId) clearInterval(pollDeviceIntervalId);
-        pollDeviceIntervalId = setInterval(pollDevice, ms);
-    }
-
-    async function pollDevice() {
-        try {
-            const response = await api.post(
-                `/oauth/token`,
-                {
-                    grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
-                    client_id,
-                    device_code,
-                },
-                { headers: { 'content-type': 'application/x-www-form-urlencoded' } },
-            );
-            if (response.status === 200) {
-                oauth_tokens = response.data;
-                controller.abort('validated');
-            }
-        } catch (e) {
-            if (e.response && e.response.status === 400) {
-                const err = e.response.data && e.response.data.error;
-                if (err === 'authorization_pending') return;
-                if (err === 'slow_down') {
-                    interval += 1000;
-                    setPollingInterval(interval);
-                    return;
-                }
-                if (err === 'access_denied') {
-                    pollError = new Error('User denied the authorization request');
-                    controller.abort('error');
-                    return;
-                }
-                if (err === 'expired_token') {
-                    pollError = new Error('Device code expired');
-                    controller.abort('error');
-                    return;
-                }
-                pollError = new Error(`OAuth error: ${err}`);
-                controller.abort('error');
-            }
-        }
-    }
-
-    setPollingInterval(interval);
-
-    // 10-minute hard ceiling on the user finishing in the browser
-    const timeoutId = setTimeout(() => {
-        clearInterval(pollDeviceIntervalId);
-        controller.abort('timeout');
-    }, OAUTH_DEVICE_CODE_TIMEOUT_MS);
-
-    try {
-        await input(
-            {
-                message: 'Press ENTER to continue or wait for authentication...',
-                waitUserInput: true,
-                validate: () => {
-                    open(data.verification_uri_complete, {
-                        app: [{ name: apps.browser }, 'firefox-developer-edition'],
-                    });
-                    return '';
-                },
-            },
-            {
-                signal: controller.signal,
-            },
-        ).catch((error) => {
-            if (error.cause === 'timeout') {
-                console.log(warning('Polling aborted due to timeout'));
-            } else if (error.cause === 'validated') {
-                console.log(success('Device authenticated successfully'));
-            }
-            // 'error' cause falls through; we surface pollError below.
-        });
-    } finally {
-        clearInterval(pollDeviceIntervalId);
-        clearTimeout(timeoutId);
-    }
-
-    if (pollError) throw pollError;
-    if (!oauth_tokens.access_token) throw new Error('OAuth flow ended without a token');
-
-    const token = oauth_tokens.access_token;
-    const refresh_token = oauth_tokens.refresh_token;
-    const decodedJWT = JSON.parse(Buffer.from(token.split('.')[1], 'base64').toString());
-    const username = decodedJWT.usr;
-
-    mergeConfig({ username, token, refresh_token });
-    console.log(success('OAuth token validation successful\n'));
-}
-
-/**
- * Get access token from configuration
- * @returns {string|axios.CancelToken|*|null}
- */
-export function getAccessToken() {
-    const config = readConfig();
-    if (!config || !config.token) {
-        console.log(warning('No token found in configuration'));
-        return null;
-    }
-    return config.token;
-}

package/lib/bucket.js

@@ -1,82 +0,0 @@
-import api from './api.js';
-import { apiError } from './errors.js';
-import { v2, v3 } from './paths.js';
-
-/**
- * Query an arbitrary time-series bucket declared in a product profile.
- * When `device` is provided, scopes to that device's bucket; otherwise
- * queries the user-level bucket across every device of the account.
- *
- * Buckets are the mechanism products use to persist structured samples
- * over time — the platform ships a `monitoring` bucket by default, and
- * users can declare custom ones for their own metrics.
- *
- * Time range:
- *   - `minutes`: shortcut for "last N minutes" (sets min_ts to
- *     `Date.now() - minutes * 60_000`, max_ts to 0).
- *   - `min_ts` / `max_ts`: explicit unix-millis range when `minutes`
- *     is not supplied; either may be omitted for an open bound.
- *
- * Aggregation: `agg` is the time-window size (e.g. "5m"), `agg_type`
- * the reducer (e.g. "mean"), and `fields` a comma-separated allowlist
- * to trim the response down.
- *
- * `group_by` is passed through verbatim — no default. Custom buckets
- * may not even expose a `device` tag, so the caller decides whether
- * to group (e.g. `group_by=device` for a fleet view) or read raw
- * interleaved samples.
- *
- * @param {{
- *   bucket: string,
- *   device?: string | null,
- *   user?: string | null,
- *   items?: number,
- *   sort?: string,
- *   minutes?: number,
- *   min_ts?: number,
- *   max_ts?: number,
- *   agg?: string,
- *   agg_type?: string,
- *   fields?: string,
- *   group_by?: string | null,
- * }} opts
- */
-export async function getBucketData({
-    bucket,
-    device = null,
-    user = null,
-    items = 10,
-    sort = 'desc',
-    minutes,
-    min_ts,
-    max_ts,
-    agg,
-    agg_type,
-    fields,
-    group_by,
-} = {}) {
-    if (!bucket) throw new Error('bucket is required');
-    const params = { items, sort };
-    if (minutes) {
-        params.min_ts = Date.now() - minutes * 60 * 1000;
-        params.max_ts = 0;
-    } else {
-        if (min_ts) params.min_ts = min_ts;
-        if (max_ts !== undefined) params.max_ts = max_ts;
-    }
-    if (agg) params.agg = agg;
-    if (agg_type) params.agg_type = agg_type;
-    if (group_by) params.group_by = group_by;
-    if (fields) params.fields = fields;
-
-    const url = device
-        ? `${v3(user)}/devices/${device}/buckets/${bucket}/data`
-        : `${v2(user)}/buckets/${bucket}/data`;
-
-    try {
-        const res = await api.get(url, { params });
-        return res.data;
-    } catch (e) {
-        throw apiError(e);
-    }
-}

package/lib/concurrency.js

@@ -1,52 +0,0 @@
-// @ts-check
-
-/**
- * Run `worker(item, index)` over `items` with at most `limit` invocations
- * in flight at any time. Returns an array parallel to `items` describing
- * the outcome of each task as `{ ok: true, value }` or `{ ok: false, error }`.
- *
- * By default, a rejection from one worker does not stop the others — the
- * caller inspects the results array. Set `failFast: true` to stop dequeueing
- * new work as soon as any worker rejects; in-flight tasks still finish and
- * their results are included. The first rejection is rethrown after the
- * in-flight tasks settle.
- *
- * @template T, R
- * @param {T[]} items
- * @param {number} limit
- * @param {(item: T, index: number) => Promise<R>} worker
- * @param {{ failFast?: boolean }} [opts]
- * @returns {Promise<Array<{ ok: true, value: R } | { ok: false, error: unknown }>>}
- */
-export async function runPool(items, limit, worker, { failFast = false } = {}) {
-    const results = new Array(items.length);
-    let nextIndex = 0;
-    let aborted = false;
-    /** @type {unknown} */
-    let abortError = null;
-
-    const effectiveLimit = Math.max(1, Math.min(limit, items.length));
-
-    async function runner() {
-        while (!aborted) {
-            const i = nextIndex++;
-            if (i >= items.length) return;
-            try {
-                results[i] = { ok: true, value: await worker(items[i], i) };
-            } catch (error) {
-                results[i] = { ok: false, error };
-                if (failFast && !aborted) {
-                    aborted = true;
-                    abortError = error;
-                }
-            }
-        }
-    }
-
-    const runners = [];
-    for (let i = 0; i < effectiveLimit; i++) runners.push(runner());
-    await Promise.all(runners);
-
-    if (aborted && abortError) throw abortError;
-    return results;
-}