@transloadit/node 4.7.2 → 4.7.4

package/src/cli/commands/auth.ts

@@ -7,8 +7,9 @@ import {
   assemblyInstructionsSchema,
 } from '../../alphalib/types/template.ts'
 import type { OptionalAuthParams } from '../../apiTypes.ts'
+import { mintBearerTokenWithCredentials } from '../../bearerToken.ts'
 import { Transloadit } from '../../Transloadit.ts'
-import { getEnvCredentials, readCliInput } from '../helpers.ts'
+import { readCliInput, requireEnvCredentials } from '../helpers.ts'
 import { UnauthenticatedCommand } from './BaseCommand.ts'
 
 type UrlParamPrimitive = string | number | boolean
@@ -68,40 +69,51 @@ function normalizeUrlParams(params?: Record<string, unknown>): NormalizedUrlPara
   return normalized
 }
 
-const getCredentials = getEnvCredentials
+type OutputResult = { ok: true; output: string } | { ok: false; error: string }
 
-// Result type for signature operations
-type SigResult = { ok: true; output: string } | { ok: false; error: string }
+type Result<T> = { ok: true; value: T } | { ok: false; error: string }
+
+function parseJsonObject<TSchema extends z.ZodTypeAny>(
+  input: string,
+  schema: TSchema,
+): Result<z.infer<TSchema>> {
+  let parsed: unknown
+  try {
+    parsed = JSON.parse(input)
+  } catch (error) {
+    return { ok: false, error: `Failed to parse JSON from stdin: ${(error as Error).message}` }
+  }
+
+  if (parsed == null || typeof parsed !== 'object' || Array.isArray(parsed)) {
+    return { ok: false, error: 'Invalid params provided via stdin. Expected a JSON object.' }
+  }
+
+  const parsedResult = schema.safeParse(parsed)
+  if (!parsedResult.success) {
+    return { ok: false, error: `Invalid params: ${formatIssues(parsedResult.error.issues)}` }
+  }
+
+  return { ok: true, value: parsedResult.data }
+}
 
 // Core logic for signature generation
 function generateSignature(
   input: string,
   credentials: { authKey: string; authSecret: string },
   algorithm?: string,
-): SigResult {
+): OutputResult {
   const { authKey, authSecret } = credentials
   let params: CliSignatureParams
 
   if (input === '') {
     params = { auth: { key: authKey } }
   } else {
-    let parsed: unknown
-    try {
-      parsed = JSON.parse(input)
-    } catch (error) {
-      return { ok: false, error: `Failed to parse JSON from stdin: ${(error as Error).message}` }
-    }
-
-    if (parsed == null || typeof parsed !== 'object' || Array.isArray(parsed)) {
-      return { ok: false, error: 'Invalid params provided via stdin. Expected a JSON object.' }
-    }
-
-    const parsedResult = cliSignatureParamsSchema.safeParse(parsed)
-    if (!parsedResult.success) {
-      return { ok: false, error: `Invalid params: ${formatIssues(parsedResult.error.issues)}` }
+    const parsedResult = parseJsonObject(input, cliSignatureParamsSchema)
+    if (!parsedResult.ok) {
+      return { ok: false, error: parsedResult.error }
     }
 
-    const parsedParams = parsedResult.data
+    const parsedParams = parsedResult.value
     const existingAuth = parsedParams.auth ?? {}
 
     params = {
@@ -126,7 +138,7 @@ function generateSignature(
 function generateSmartCdnUrl(
   input: string,
   credentials: { authKey: string; authSecret: string },
-): SigResult {
+): OutputResult {
   const { authKey, authSecret } = credentials
 
   if (input === '') {
@@ -137,23 +149,12 @@ function generateSmartCdnUrl(
     }
   }
 
-  let parsed: unknown
-  try {
-    parsed = JSON.parse(input)
-  } catch (error) {
-    return { ok: false, error: `Failed to parse JSON from stdin: ${(error as Error).message}` }
-  }
-
-  if (parsed == null || typeof parsed !== 'object' || Array.isArray(parsed)) {
-    return { ok: false, error: 'Invalid params provided via stdin. Expected a JSON object.' }
-  }
-
-  const parsedResult = smartCdnParamsSchema.safeParse(parsed)
-  if (!parsedResult.success) {
-    return { ok: false, error: `Invalid params: ${formatIssues(parsedResult.error.issues)}` }
+  const parsedResult = parseJsonObject(input, smartCdnParamsSchema)
+  if (!parsedResult.ok) {
+    return { ok: false, error: parsedResult.error }
   }
 
-  const { workspace, template, input: inputFieldRaw, url_params, expire_at_ms } = parsedResult.data
+  const { workspace, template, input: inputFieldRaw, url_params, expire_at_ms } = parsedResult.value
   const urlParams = normalizeUrlParams(url_params)
 
   let expiresAt: number | undefined
@@ -195,14 +196,13 @@ export interface RunSmartSigOptions {
 }
 
 export async function runSig(options: RunSigOptions = {}): Promise<void> {
-  const credentials = getCredentials()
-  if (credentials == null) {
-    console.error(
-      'Missing credentials. Please set TRANSLOADIT_KEY and TRANSLOADIT_SECRET environment variables.',
-    )
+  const credentialsResult = requireEnvCredentials()
+  if (!credentialsResult.ok) {
+    console.error(credentialsResult.error)
     process.exitCode = 1
     return
   }
+  const credentials = credentialsResult.credentials
 
   const { content } = await readCliInput({
     providedInput: options.providedInput,
@@ -220,14 +220,13 @@ export async function runSig(options: RunSigOptions = {}): Promise<void> {
 }
 
 export async function runSmartSig(options: RunSmartSigOptions = {}): Promise<void> {
-  const credentials = getCredentials()
-  if (credentials == null) {
-    console.error(
-      'Missing credentials. Please set TRANSLOADIT_KEY and TRANSLOADIT_SECRET environment variables.',
-    )
+  const credentialsResult = requireEnvCredentials()
+  if (!credentialsResult.ok) {
+    console.error(credentialsResult.error)
     process.exitCode = 1
     return
   }
+  const credentials = credentialsResult.credentials
 
   const { content } = await readCliInput({
     providedInput: options.providedInput,
@@ -274,13 +273,12 @@ export class SignatureCommand extends UnauthenticatedCommand {
   })
 
   protected async run(): Promise<number | undefined> {
-    const credentials = getCredentials()
-    if (credentials == null) {
-      this.output.error(
-        'Missing credentials. Please set TRANSLOADIT_KEY and TRANSLOADIT_SECRET environment variables.',
-      )
+    const credentialsResult = requireEnvCredentials()
+    if (!credentialsResult.ok) {
+      this.output.error(credentialsResult.error)
       return 1
     }
+    const credentials = credentialsResult.credentials
 
     const { content } = await readCliInput({ allowStdinWhenNoPath: true })
     const rawInput = (content ?? '').trim()
@@ -328,13 +326,12 @@ export class SmartCdnSignatureCommand extends UnauthenticatedCommand {
   })
 
   protected async run(): Promise<number | undefined> {
-    const credentials = getCredentials()
-    if (credentials == null) {
-      this.output.error(
-        'Missing credentials. Please set TRANSLOADIT_KEY and TRANSLOADIT_SECRET environment variables.',
-      )
+    const credentialsResult = requireEnvCredentials()
+    if (!credentialsResult.ok) {
+      this.output.error(credentialsResult.error)
       return 1
     }
+    const credentials = credentialsResult.credentials
 
     const { content } = await readCliInput({ allowStdinWhenNoPath: true })
     const rawInput = (content ?? '').trim()
@@ -349,3 +346,56 @@ export class SmartCdnSignatureCommand extends UnauthenticatedCommand {
     return 1
   }
 }
+
+/**
+ * Mint a short-lived bearer token via POST /token (HTTP Basic Auth).
+ *
+ * This is intentionally stdout-clean JSON so it can be used by agents and scripts.
+ */
+export class TokenCommand extends UnauthenticatedCommand {
+  static override paths = [['auth', 'token']]
+
+  static override usage = Command.Usage({
+    category: 'Auth',
+    description: 'Mint a short-lived bearer token',
+    details: `
+      Calls POST /token using HTTP Basic Auth (TRANSLOADIT_KEY + TRANSLOADIT_SECRET) and prints the
+      JSON response to stdout.
+    `,
+    examples: [
+      ['Mint an MCP token (default aud)', 'transloadit auth token'],
+      ['Override audience', 'transloadit auth token --aud api2'],
+    ],
+  })
+
+  aud = Option.String('--aud', {
+    description: 'Token audience (default: mcp).',
+  })
+
+  scope = Option.String('--scope', {
+    description:
+      'Comma-separated list of scopes to request (defaults to auth key scopes). Example: assemblies:write,templates:read',
+  })
+
+  protected override async run(): Promise<number | undefined> {
+    const credentialsResult = requireEnvCredentials()
+    if (!credentialsResult.ok) {
+      this.output.error(credentialsResult.error)
+      return 1
+    }
+
+    const result = await mintBearerTokenWithCredentials(credentialsResult.credentials, {
+      endpoint: this.endpoint,
+      aud: this.aud,
+      scope: this.scope,
+    })
+
+    if (result.ok) {
+      process.stdout.write(`${result.raw}\n`)
+      return undefined
+    }
+
+    this.output.error(result.error)
+    return 1
+  }
+}

package/src/cli/commands/index.ts

@@ -11,7 +11,7 @@ import {
   AssembliesReplayCommand,
 } from './assemblies.ts'
 
-import { SignatureCommand, SmartCdnSignatureCommand } from './auth.ts'
+import { SignatureCommand, SmartCdnSignatureCommand, TokenCommand } from './auth.ts'
 
 import { BillsGetCommand } from './bills.ts'
 import { DocsRobotsGetCommand, DocsRobotsListCommand } from './docs.ts'
@@ -40,6 +40,7 @@ export function createCli(): Cli {
   // Auth commands (signature generation)
   cli.register(SignatureCommand)
   cli.register(SmartCdnSignatureCommand)
+  cli.register(TokenCommand)
 
   // Assemblies commands
   cli.register(AssembliesCreateCommand)

package/src/cli/helpers.ts

@@ -3,7 +3,12 @@ import fsp from 'node:fs/promises'
 import type { Readable } from 'node:stream'
 import { isAPIError } from './types.ts'
 
-export function getEnvCredentials(): { authKey: string; authSecret: string } | null {
+const MISSING_CREDENTIALS_MESSAGE =
+  'Missing credentials. Please set TRANSLOADIT_KEY and TRANSLOADIT_SECRET environment variables.'
+
+type EnvCredentials = { authKey: string; authSecret: string }
+
+function getEnvCredentials(): { authKey: string; authSecret: string } | null {
   const authKey = process.env.TRANSLOADIT_KEY ?? process.env.TRANSLOADIT_AUTH_KEY
   const authSecret = process.env.TRANSLOADIT_SECRET ?? process.env.TRANSLOADIT_AUTH_SECRET
 
@@ -12,6 +17,16 @@ export function getEnvCredentials(): { authKey: string; authSecret: string } | n
   return { authKey, authSecret }
 }
 
+type RequireEnvCredentialsResult =
+  | { ok: true; credentials: EnvCredentials }
+  | { ok: false; error: string }
+
+export function requireEnvCredentials(): RequireEnvCredentialsResult {
+  const credentials = getEnvCredentials()
+  if (credentials == null) return { ok: false, error: MISSING_CREDENTIALS_MESSAGE }
+  return { ok: true, credentials }
+}
+
 export function createReadStream(file: string): Readable {
   if (file === '-') return process.stdin
   return fs.createReadStream(file)