@usesocial/cli 0.11.0 → 0.11.1

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @usesocial/cli
 
+## 0.11.1
+
+### Patch Changes
+
+- [#45](https://github.com/usesocial/monorepo/pull/45) [`940ff35`](https://github.com/usesocial/monorepo/commit/940ff356c07cd1f1a01be059b022eafcb5a82a1b) Thanks [@CyrusNuevoDia](https://github.com/CyrusNuevoDia)! - Create the server-side CLI session grant after non-TTY device login approval so read/write device sessions are not reported locally as write-capable while the API still treats them as read-only.
+
 ## 0.11.0
 
 ### Minor Changes

package/dist/index.mjs

@@ -21414,7 +21414,7 @@ function createEnv(opts) {
 }
 //#endregion
 //#region package.json
-var version$1 = "0.11.0";
+var version$1 = "0.11.1";
 //#endregion
 //#region src/lib/env.ts
 const URLWithTrailingSlash = url().transform(ensureTrailingSlash);
@@ -28783,13 +28783,16 @@ const errorOutput = (error) => ({
 const isInteractiveTerminal = () => process.stdin.isTTY === true && process.stdout.isTTY === true;
 const nextCommands = ["social account connect linkedin", "social account connect x"];
 const deviceExpiredMessage = "Sign-in expired before approval. Run `social account login` again to restart.";
+const scopeUpgradeRequiresReauthorization = "Existing CLI session is read-only. Run `social account logout`, then `social account login` to approve a new write-capable session.";
+const scopeAliasIncludes = (granted, requested) => granted === requested || granted === "read,write";
 /**
 * Drive one step of the non-TTY device-authorization login and map it onto the
 * login output union. The first call starts the device flow and returns
 * `pending_approval`; later calls poll until `logged_in` or `expired`.
 */
-const deviceLoginOutput = async (loginArgs) => {
-	const state = await advanceDeviceLogin(parseScopeAlias(loginArgs.scope));
+const deviceLoginOutput = async (client, loginArgs) => {
+	const scope = parseScopeAlias(loginArgs.scope);
+	const state = await advanceDeviceLogin(scope);
 	switch (state.status) {
 		case "pending_approval": return {
 			status: "pending_approval",
@@ -28801,7 +28804,10 @@ const deviceLoginOutput = async (loginArgs) => {
 		};
 		case "logged_in": return {
 			status: "logged_in",
-			account: state.account,
+			account: {
+				...state.account,
+				scope: (await client.cli.session.upsert({ scopeAlias: scope })).scopeAlias
+			},
 			nextCommands
 		};
 		case "expired": return {
@@ -28891,23 +28897,30 @@ const loginCommand = defineCommand({
 		try {
 			const client = createORPCAPIClient();
 			const existing = await readExistingAuthSession(client);
-			if (existing.kind === "existing") if (billingReady(await client.billing.status())) output = alreadyLoggedInOutput(existing.session);
-			else if (isInteractiveTerminal()) output = await runLogin({
-				ui: createUI(true),
-				client,
-				args: loginArgs
-			}, [{
-				name: "seat",
-				run: seatPhase
-			}], { authenticated: true });
-			else output = alreadyLoggedInOutput(existing.session);
-			else if (existing.kind === "offline") output = offlineOutput();
+			if (existing.kind === "existing") {
+				const requestedScope = parseScopeAlias(loginArgs.scope);
+				if (!scopeAliasIncludes(existing.session.session.scope, requestedScope)) output = {
+					status: "error",
+					code: "scope_upgrade_requires_reauthorization",
+					message: scopeUpgradeRequiresReauthorization
+				};
+				else if (billingReady(await client.billing.status())) output = alreadyLoggedInOutput(existing.session);
+				else if (isInteractiveTerminal()) output = await runLogin({
+					ui: createUI(true),
+					client,
+					args: loginArgs
+				}, [{
+					name: "seat",
+					run: seatPhase
+				}], { authenticated: true });
+				else output = alreadyLoggedInOutput(existing.session);
+			} else if (existing.kind === "offline") output = offlineOutput();
 			else if (isInteractiveTerminal()) output = await runLogin({
 				ui: createUI(true),
 				client,
 				args: loginArgs
 			});
-			else output = await deviceLoginOutput(loginArgs);
+			else output = await deviceLoginOutput(client, loginArgs);
 		} catch (error) {
 			output = errorOutput(error);
 			exitCode = exitCodeFor(error);