@tiangong-lca/cli 0.1.3 → 0.1.6

package/dist/src/lib/supabase-session.js

@@ -1,14 +1,17 @@
-import { chmodSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { chmodSync, mkdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync, } from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { createClient } from '@supabase/supabase-js';
 import { CliError } from './errors.js';
+import { openSystemBrowser, receiveOAuthLoopbackCallback, SYSTEM_BROWSER_OPTIONS, } from './oauth-loopback.js';
+import { buildOAuthAuthorizationUrl, createOAuthPkceValues, DEFAULT_OAUTH_SCOPES, exchangeOAuthAuthorizationCode, fetchOAuthUserInfo, refreshOAuthTokens, } from './oauth-pkce.js';
 import { withStateFileLock } from './state-lock.js';
 import { createSupabaseFetch, deriveSupabaseProjectBaseUrl, } from './supabase-client.js';
 import { fingerprintSecret, fingerprintUserApiKey, requireUserApiKeyCredentials, } from './user-api-key.js';
 const DEFAULT_TIMEOUT_MS = 10_000;
 const SESSION_REFRESH_WINDOW_SECONDS = 300;
 const SESSION_MEMORY_CACHE = new Map();
+const ACCESS_TOKEN_MEMORY_CACHE = new Map();
 const SESSION_OPERATION_CHAINS = new Map();
 function trimToken(value) {
     return typeof value === 'string' ? value.trim() : '';
@@ -32,12 +35,19 @@ function parseCachedSessionRecord(value) {
     if (!isRecord(value)) {
         return null;
     }
-    if (value.schema_version !== 1) {
+    if (value.schema_version !== 1 && value.schema_version !== 2) {
         return null;
     }
     const supabaseUrl = trimToken(value.supabase_url);
     const publishableKeyFingerprint = trimToken(value.publishable_key_fingerprint);
-    const userApiKeyFingerprint = trimToken(value.user_api_key_fingerprint);
+    const authMethod = value.schema_version === 1
+        ? 'legacy_user_api_key'
+        : value.auth_method === 'oauth' || value.auth_method === 'legacy_user_api_key'
+            ? value.auth_method
+            : null;
+    const authBindingFingerprint = value.schema_version === 1
+        ? trimToken(value.user_api_key_fingerprint)
+        : trimToken(value.auth_binding_fingerprint);
     const userEmail = trimToken(value.user_email);
     const accessToken = trimToken(value.access_token);
     const refreshToken = trimToken(value.refresh_token);
@@ -47,25 +57,35 @@ function parseCachedSessionRecord(value) {
         : value.expires_at === null
             ? null
             : NaN;
+    const grantedScopes = value.schema_version === 1
+        ? []
+        : Array.isArray(value.granted_scopes) &&
+            value.granted_scopes.every((scope) => typeof scope === 'string' && scope.trim())
+            ? [...new Set(value.granted_scopes.map((scope) => scope.trim()))].sort((left, right) => left.localeCompare(right))
+            : null;
     if (!supabaseUrl ||
         !publishableKeyFingerprint ||
-        !userApiKeyFingerprint ||
+        !authMethod ||
+        !authBindingFingerprint ||
         !userEmail ||
         !accessToken ||
         !refreshToken ||
         !updatedAtUtc ||
-        Number.isNaN(expiresAt)) {
+        Number.isNaN(expiresAt) ||
+        grantedScopes === null) {
         return null;
     }
     return {
-        schema_version: 1,
+        schema_version: 2,
+        auth_method: authMethod,
         supabase_url: supabaseUrl,
         publishable_key_fingerprint: publishableKeyFingerprint,
-        user_api_key_fingerprint: userApiKeyFingerprint,
+        auth_binding_fingerprint: authBindingFingerprint,
         user_email: userEmail,
         access_token: accessToken,
         refresh_token: refreshToken,
         expires_at: expiresAt,
+        granted_scopes: grantedScopes,
         updated_at_utc: updatedAtUtc,
     };
 }
@@ -85,7 +105,7 @@ function resolveDefaultSessionFilePath(options) {
     return path.resolve('.tiangong-lca-session.json');
 }
 function resolveSessionFilePath(runtime) {
-    if (runtime.disableSessionCache) {
+    if (runtime.authMode === 'access_token' || runtime.disableSessionCache) {
         return null;
     }
     if (runtime.sessionFile) {
@@ -101,17 +121,23 @@ function resolveSessionFilePath(runtime) {
 function buildRuntimeIdentity(runtime) {
     const projectBaseUrl = deriveSupabaseProjectBaseUrl(runtime.apiBaseUrl);
     const publishableKeyFingerprint = fingerprintSecret(runtime.publishableKey);
-    const userApiKeyFingerprint = fingerprintUserApiKey(runtime.userApiKey);
+    const authBindingFingerprint = runtime.authMode === 'oauth'
+        ? fingerprintSecret(`oauth-client:${runtime.oauthClientId}`)
+        : runtime.authMode === 'access_token'
+            ? fingerprintSecret(runtime.accessToken)
+            : fingerprintUserApiKey(runtime.userApiKey);
     const sessionFilePath = resolveSessionFilePath(runtime);
     return {
         projectBaseUrl,
         publishableKeyFingerprint,
-        userApiKeyFingerprint,
+        authMethod: runtime.authMode,
+        authBindingFingerprint,
         sessionFilePath,
         memoKey: [
             projectBaseUrl,
             publishableKeyFingerprint,
-            userApiKeyFingerprint,
+            runtime.authMode,
+            authBindingFingerprint,
             sessionFilePath ?? 'memory-only',
         ].join('|'),
     };
@@ -119,7 +145,8 @@ function buildRuntimeIdentity(runtime) {
 function recordMatchesRuntime(record, runtime) {
     return (record.supabase_url === runtime.projectBaseUrl &&
         record.publishable_key_fingerprint === runtime.publishableKeyFingerprint &&
-        record.user_api_key_fingerprint === runtime.userApiKeyFingerprint);
+        record.auth_method === runtime.authMethod &&
+        record.auth_binding_fingerprint === runtime.authBindingFingerprint);
 }
 function isSessionFresh(record, now) {
     return (typeof record.expires_at === 'number' &&
@@ -136,14 +163,16 @@ function buildCachedSessionRecord(options) {
         });
     }
     return {
-        schema_version: 1,
+        schema_version: 2,
+        auth_method: options.runtime.authMethod === 'oauth' ? 'oauth' : 'legacy_user_api_key',
         supabase_url: options.runtime.projectBaseUrl,
         publishable_key_fingerprint: options.runtime.publishableKeyFingerprint,
-        user_api_key_fingerprint: options.runtime.userApiKeyFingerprint,
+        auth_binding_fingerprint: options.runtime.authBindingFingerprint,
         user_email: options.userEmail,
         access_token: accessToken,
         refresh_token: refreshToken,
         expires_at: computeExpiresAt(options.session, options.now),
+        granted_scopes: [...new Set(options.grantedScopes ?? [])].sort(),
         updated_at_utc: options.now.toISOString(),
     };
 }
@@ -155,11 +184,16 @@ function toResolvedSession(record, runtime, source) {
         userEmail: record.user_email,
         projectBaseUrl: runtime.projectBaseUrl,
         sessionFile: runtime.sessionFilePath,
+        authMethod: runtime.authMethod,
         source,
     };
 }
-function readCachedSessionRecord(sessionFilePath) {
+function readCachedSessionRecord(sessionFilePath, platform = process.platform) {
     try {
+        const stat = statSync(sessionFilePath);
+        if (!stat.isFile() || (platform !== 'win32' && (stat.mode & 0o077) !== 0)) {
+            return null;
+        }
         const text = readFileSync(sessionFilePath, 'utf8').trim();
         if (!text) {
             return null;
@@ -170,15 +204,19 @@ function readCachedSessionRecord(sessionFilePath) {
         return null;
     }
 }
-function writeCachedSessionRecord(sessionFilePath, record) {
+function writeCachedSessionRecord(sessionFilePath, record, platform = process.platform) {
     mkdirSync(path.dirname(sessionFilePath), {
         recursive: true,
         mode: 0o700,
     });
+    if (platform !== 'win32') {
+        chmodSync(path.dirname(sessionFilePath), 0o700);
+    }
     const tempPath = `${sessionFilePath}.${process.pid}.${Date.now()}.tmp`;
     try {
         writeFileSync(tempPath, `${JSON.stringify(record, null, 2)}\n`, {
             encoding: 'utf8',
+            flag: 'wx',
             mode: 0o600,
         });
         renameSync(tempPath, sessionFilePath);
@@ -247,6 +285,7 @@ async function signInWithUserApiKey(options) {
         runtime: options.runtimeIdentity,
         session: data.session,
         userEmail: trimToken(data.user?.email) || credentials.email,
+        grantedScopes: [],
         now: options.now,
     });
 }
@@ -256,6 +295,36 @@ async function refreshWithRefreshToken(options) {
         return null;
     }
     try {
+        if (options.runtime.authMode === 'oauth') {
+            const tokens = await refreshOAuthTokens({
+                projectBaseUrl: options.runtimeIdentity.projectBaseUrl,
+                clientId: options.runtime.oauthClientId,
+                refreshToken: normalizedRefreshToken,
+                fetchImpl: options.fetchImpl,
+                timeoutMs: options.timeoutMs,
+            });
+            const userInfo = await fetchOAuthUserInfo({
+                projectBaseUrl: options.runtimeIdentity.projectBaseUrl,
+                accessToken: tokens.accessToken,
+                fetchImpl: options.fetchImpl,
+                timeoutMs: options.timeoutMs,
+            });
+            return buildCachedSessionRecord({
+                runtime: options.runtimeIdentity,
+                session: {
+                    access_token: tokens.accessToken,
+                    refresh_token: tokens.refreshToken,
+                    expires_at: undefined,
+                    expires_in: tokens.expiresIn,
+                },
+                userEmail: userInfo.email,
+                grantedScopes: tokens.scope,
+                now: options.now,
+            });
+        }
+        if (options.runtime.authMode !== 'legacy_user_api_key') {
+            return null;
+        }
         const authClient = createSupabaseAuthClient(options.runtimeIdentity, options.runtime.publishableKey, options.fetchImpl, options.timeoutMs);
         const { data, error } = await authClient.auth.refreshSession({
             refresh_token: normalizedRefreshToken,
@@ -267,6 +336,7 @@ async function refreshWithRefreshToken(options) {
             runtime: options.runtimeIdentity,
             session: data.session,
             userEmail: trimToken(data.user?.email) || options.userEmail,
+            grantedScopes: [],
             now: options.now,
         });
     }
@@ -274,8 +344,45 @@ async function refreshWithRefreshToken(options) {
         return null;
     }
 }
+async function resolveExplicitAccessToken(options) {
+    const cached = ACCESS_TOKEN_MEMORY_CACHE.get(options.runtimeIdentity.memoKey);
+    if (cached) {
+        return cached;
+    }
+    const accessToken = trimToken(options.runtime.accessToken);
+    const authClient = createSupabaseAuthClient(options.runtimeIdentity, options.runtime.publishableKey, options.fetchImpl, options.timeoutMs);
+    const { data, error } = await authClient.auth.getUser(accessToken);
+    const userEmail = trimToken(data.user?.email);
+    if (error || !data.user?.id || data.user.role !== 'authenticated' || !userEmail) {
+        throw new CliError('TIANGONG_LCA_ACCESS_TOKEN did not resolve to an authenticated user.', {
+            code: 'SUPABASE_ACCESS_TOKEN_INVALID',
+            exitCode: 1,
+            details: error?.message ?? 'Authenticated user identity missing from access token.',
+        });
+    }
+    const resolved = {
+        accessToken,
+        refreshToken: '',
+        expiresAt: null,
+        userEmail,
+        projectBaseUrl: options.runtimeIdentity.projectBaseUrl,
+        sessionFile: null,
+        authMethod: 'access_token',
+        source: 'access_token',
+    };
+    ACCESS_TOKEN_MEMORY_CACHE.set(options.runtimeIdentity.memoKey, resolved);
+    return resolved;
+}
 async function resolveAndPersistSession(options) {
     const { runtime, runtimeIdentity } = options;
+    if (runtime.authMode === 'access_token') {
+        return resolveExplicitAccessToken({
+            runtime,
+            runtimeIdentity,
+            fetchImpl: options.fetchImpl,
+            timeoutMs: options.timeoutMs,
+        });
+    }
     const memoized = getMemoizedRecord(runtimeIdentity);
     if (!options.forceRefresh &&
         !runtime.forceReauth &&
@@ -324,6 +431,13 @@ async function resolveAndPersistSession(options) {
             }
         }
     }
+    if (runtime.authMode === 'oauth') {
+        dropMemoizedRecord(runtimeIdentity);
+        throw new CliError('No usable OAuth session is available. Run `tiangong-lca auth login` in a trusted terminal.', {
+            code: 'SUPABASE_OAUTH_LOGIN_REQUIRED',
+            exitCode: 1,
+        });
+    }
     const signedIn = await signInWithUserApiKey({
         runtime,
         runtimeIdentity,
@@ -335,13 +449,21 @@ async function resolveAndPersistSession(options) {
         writeCachedSessionRecord(runtimeIdentity.sessionFilePath, signedIn);
     }
     memoizeRecord(runtimeIdentity, signedIn);
-    return toResolvedSession(signedIn, runtimeIdentity, 'signin');
+    return toResolvedSession(signedIn, runtimeIdentity, 'legacy_signin');
 }
 export async function resolveSupabaseUserSession(options) {
     const runtimeIdentity = buildRuntimeIdentity(options.runtime);
     const now = options.now ?? new Date();
     const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
     const forceRefresh = Boolean(options.forceRefresh);
+    if (options.runtime.authMode === 'access_token') {
+        return resolveExplicitAccessToken({
+            runtime: options.runtime,
+            runtimeIdentity,
+            fetchImpl: options.fetchImpl,
+            timeoutMs,
+        });
+    }
     if (!forceRefresh && !options.runtime.forceReauth) {
         const memoized = getMemoizedRecord(runtimeIdentity);
         if (memoized &&
@@ -380,8 +502,176 @@ export async function resolveSupabaseUserSession(options) {
         });
     });
 }
-export function createSupabaseDataRuntime(options) {
+export function inspectSupabaseAuthStatus(options) {
+    const runtimeIdentity = buildRuntimeIdentity(options.runtime);
+    const now = options.now ?? new Date();
+    if (options.runtime.authMode === 'access_token') {
+        return {
+            schemaVersion: 'tiangong.cli-auth-status.v1',
+            status: 'ready',
+            authMethod: 'access_token',
+            sessionState: 'memory-only',
+            sessionCache: 'memory-only',
+            expiresAt: null,
+            grantedScopes: [],
+            onlineVerified: false,
+        };
+    }
+    if (options.runtime.authMode === 'legacy_user_api_key') {
+        return {
+            schemaVersion: 'tiangong.cli-auth-status.v1',
+            status: 'ready',
+            authMethod: 'legacy_user_api_key',
+            sessionState: 'transition-only',
+            sessionCache: runtimeIdentity.sessionFilePath ? 'private-file' : 'disabled',
+            expiresAt: null,
+            grantedScopes: [],
+            onlineVerified: false,
+        };
+    }
+    const memoized = getMemoizedRecord(runtimeIdentity);
+    const cached = memoized && recordMatchesRuntime(memoized, runtimeIdentity)
+        ? memoized
+        : runtimeIdentity.sessionFilePath
+            ? readCachedSessionRecord(runtimeIdentity.sessionFilePath)
+            : null;
+    const matching = cached && recordMatchesRuntime(cached, runtimeIdentity) ? cached : null;
+    if (!matching || !trimToken(matching.refresh_token)) {
+        return {
+            schemaVersion: 'tiangong.cli-auth-status.v1',
+            status: 'login-required',
+            authMethod: 'oauth',
+            sessionState: 'missing',
+            sessionCache: runtimeIdentity.sessionFilePath ? 'private-file' : 'disabled',
+            expiresAt: null,
+            grantedScopes: [],
+            onlineVerified: false,
+        };
+    }
     return {
+        schemaVersion: 'tiangong.cli-auth-status.v1',
+        status: 'ready',
+        authMethod: 'oauth',
+        sessionState: isSessionFresh(matching, now) ? 'fresh' : 'refresh-required',
+        sessionCache: 'private-file',
+        expiresAt: matching.expires_at,
+        grantedScopes: matching.granted_scopes,
+        onlineVerified: false,
+    };
+}
+export async function loginWithSupabaseOAuth(options) {
+    if (options.runtime.authMode !== 'oauth' ||
+        !options.runtime.oauthClientId ||
+        !options.runtime.oauthRedirectUri) {
+        throw new CliError('OAuth login requires TIANGONG_LCA_AUTH_MODE=oauth and a client ID.', {
+            code: 'SUPABASE_OAUTH_RUNTIME_REQUIRED',
+            exitCode: 2,
+        });
+    }
+    const runtimeIdentity = buildRuntimeIdentity(options.runtime);
+    if (!runtimeIdentity.sessionFilePath) {
+        throw new CliError('OAuth login requires the private session cache to be enabled.', {
+            code: 'SUPABASE_OAUTH_SESSION_CACHE_REQUIRED',
+            exitCode: 2,
+        });
+    }
+    const requestTimeoutMs = options.requestTimeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const loginTimeoutMs = options.loginTimeoutMs ?? 180_000;
+    const now = options.now ?? new Date();
+    const createPkceValuesImpl = options.createPkceValuesImpl ?? createOAuthPkceValues;
+    const receiveCallbackImpl = options.receiveCallbackImpl ?? receiveOAuthLoopbackCallback;
+    const browserOptions = options.browserOptions ?? SYSTEM_BROWSER_OPTIONS;
+    const openBrowserImpl = options.openBrowserImpl ??
+        ((authorizationUrl) => openSystemBrowser(authorizationUrl, browserOptions));
+    const exchangeCodeImpl = options.exchangeCodeImpl ?? exchangeOAuthAuthorizationCode;
+    const fetchUserInfoImpl = options.fetchUserInfoImpl ?? fetchOAuthUserInfo;
+    return withSessionOperationLock(runtimeIdentity.memoKey, () => withStateFileLock(runtimeIdentity.sessionFilePath, { reason: 'supabase_oauth_pkce_login' }, async () => {
+        const pkce = createPkceValuesImpl();
+        const authorizationUrl = buildOAuthAuthorizationUrl({
+            projectBaseUrl: runtimeIdentity.projectBaseUrl,
+            clientId: options.runtime.oauthClientId,
+            redirectUri: options.runtime.oauthRedirectUri,
+            codeChallenge: pkce.codeChallenge,
+            state: pkce.state,
+        });
+        const authorizationCode = await receiveCallbackImpl({
+            redirectUri: options.runtime.oauthRedirectUri,
+            expectedState: pkce.state,
+            timeoutMs: loginTimeoutMs,
+            onListening: () => openBrowserImpl(authorizationUrl),
+        });
+        const tokens = await exchangeCodeImpl({
+            projectBaseUrl: runtimeIdentity.projectBaseUrl,
+            clientId: options.runtime.oauthClientId,
+            redirectUri: options.runtime.oauthRedirectUri,
+            authorizationCode,
+            codeVerifier: pkce.codeVerifier,
+            fetchImpl: options.fetchImpl,
+            timeoutMs: requestTimeoutMs,
+        });
+        const userInfo = await fetchUserInfoImpl({
+            projectBaseUrl: runtimeIdentity.projectBaseUrl,
+            accessToken: tokens.accessToken,
+            fetchImpl: options.fetchImpl,
+            timeoutMs: requestTimeoutMs,
+        });
+        const grantedScopes = tokens.scope.length > 0 ? tokens.scope : [...DEFAULT_OAUTH_SCOPES];
+        const record = buildCachedSessionRecord({
+            runtime: runtimeIdentity,
+            session: {
+                access_token: tokens.accessToken,
+                refresh_token: tokens.refreshToken,
+                expires_at: undefined,
+                expires_in: tokens.expiresIn,
+            },
+            userEmail: userInfo.email,
+            grantedScopes,
+            now,
+        });
+        writeCachedSessionRecord(runtimeIdentity.sessionFilePath, record);
+        memoizeRecord(runtimeIdentity, record);
+        return {
+            schemaVersion: 'tiangong.cli-oauth-login.v1',
+            status: 'authenticated',
+            authMethod: 'oauth',
+            expiresAt: record.expires_at,
+            grantedScopes: record.granted_scopes,
+            sessionCache: 'private-file',
+        };
+    }));
+}
+export async function logoutSupabaseUserSession(options) {
+    const runtimeIdentity = buildRuntimeIdentity(options.runtime);
+    return withSessionOperationLock(runtimeIdentity.memoKey, async () => {
+        let removed = false;
+        const removeCurrent = () => {
+            const cached = runtimeIdentity.sessionFilePath
+                ? readCachedSessionRecord(runtimeIdentity.sessionFilePath)
+                : null;
+            if (runtimeIdentity.sessionFilePath &&
+                cached &&
+                recordMatchesRuntime(cached, runtimeIdentity)) {
+                rmSync(runtimeIdentity.sessionFilePath, { force: true });
+                removed = true;
+            }
+            dropMemoizedRecord(runtimeIdentity);
+            ACCESS_TOKEN_MEMORY_CACHE.delete(runtimeIdentity.memoKey);
+        };
+        if (runtimeIdentity.sessionFilePath) {
+            await withStateFileLock(runtimeIdentity.sessionFilePath, { reason: 'supabase_oauth_local_logout' }, removeCurrent);
+        }
+        else {
+            removeCurrent();
+        }
+        return {
+            schemaVersion: 'tiangong.cli-oauth-logout.v1',
+            status: 'logged-out',
+            removed,
+        };
+    });
+}
+export function createSupabaseDataRuntime(options) {
+    const runtime = {
         apiBaseUrl: options.runtime.apiBaseUrl,
         publishableKey: options.runtime.publishableKey,
         getAccessToken: async () => (await resolveSupabaseUserSession({
@@ -390,17 +680,21 @@ export function createSupabaseDataRuntime(options) {
             timeoutMs: options.timeoutMs,
             now: options.now,
         })).accessToken,
-        refreshAccessToken: async () => (await resolveSupabaseUserSession({
+    };
+    if (options.runtime.authMode !== 'access_token') {
+        runtime.refreshAccessToken = async () => (await resolveSupabaseUserSession({
             runtime: options.runtime,
             fetchImpl: options.fetchImpl,
             timeoutMs: options.timeoutMs,
             now: options.now,
             forceRefresh: true,
-        })).accessToken,
-    };
+        })).accessToken;
+    }
+    return runtime;
 }
 export const __testInternals = {
     SESSION_MEMORY_CACHE,
+    ACCESS_TOKEN_MEMORY_CACHE,
     SESSION_OPERATION_CHAINS,
     buildCachedSessionRecord,
     buildRuntimeIdentity,