@vectorplane/ctrl-cli 0.1.2 → 0.1.4

package/README.md

@@ -25,6 +25,7 @@ vp sync
 - abre o navegador para autenticação
 - conclui o login com callback local seguro
 - salva a sessão localmente
+- em ambientes remotos ou isolados, o loopback local pode exigir um fluxo alternativo
 
 ### `vp sync`
 
@@ -72,3 +73,8 @@ vp sync
 - tokens nunca são enviados por query string
 - o callback valida o `state`
 - a sessão fica no diretório do usuário
+
+## Notas de fluxo
+
+O plano de endurecimento do login local está em [docs/cli-auth-hardening-phases.md](/home/developer/Documentos/Projetos/vectorplane-ctrl-cli/docs/cli-auth-hardening-phases.md).
+O desenho multicanal atual do login está em [docs/cli-login-multichannel.md](/home/developer/Documentos/Projetos/vectorplane-ctrl-cli/docs/cli-login-multichannel.md).

package/dist/core/api.d.ts

@@ -1,5 +1,5 @@
 import type { Logger } from "./logger.js";
-import type { CurrentUserResponse, AuthCodeExchangeRequest, AuthTokenExchangeResponse, RefreshTokenRequest } from "../types/auth.js";
+import type { CurrentUserResponse, AuthCodeExchangeRequest, AuthTokenExchangeResponse, CreateLoginAttemptRequest, CreateLoginAttemptResponse, LoginAttemptStatusResponse, RefreshTokenRequest } from "../types/auth.js";
 import type { AgentCheckoutRequest, AgentHeartbeatRequest, AgentSessionRequest, AgentSessionResponse, EventRequest, ResolveWorkspaceRequest, ResolveWorkspaceResponse, SyncRequest, SyncResponse } from "../types/api.js";
 export declare class VectorPlaneApiClient {
     private readonly apiBaseUrl;
@@ -7,6 +7,8 @@ export declare class VectorPlaneApiClient {
     private readonly logger;
     constructor(apiBaseUrl: string, timeoutMs: number, logger: Logger);
     exchangeToken(payload: AuthCodeExchangeRequest): Promise<AuthTokenExchangeResponse>;
+    createLoginAttempt(payload: CreateLoginAttemptRequest): Promise<CreateLoginAttemptResponse>;
+    getLoginAttemptStatus(attemptId: string, pollToken: string): Promise<LoginAttemptStatusResponse>;
     refreshToken(payload: RefreshTokenRequest): Promise<AuthTokenExchangeResponse>;
     getCurrentUser(accessToken: string): Promise<CurrentUserResponse>;
     sync(accessToken: string, payload: SyncRequest): Promise<SyncResponse>;

package/dist/core/api.js

@@ -71,6 +71,20 @@ export class VectorPlaneApiClient {
             body: JSON.stringify(payload),
         }, this.timeoutMs, this.logger);
     }
+    async createLoginAttempt(payload) {
+        return requestJson(`${this.apiBaseUrl}/cli/login/attempts`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify(payload),
+        }, this.timeoutMs, this.logger);
+    }
+    async getLoginAttemptStatus(attemptId, pollToken) {
+        const url = new URL(`${this.apiBaseUrl}/cli/login/attempts/${attemptId}`);
+        url.searchParams.set("poll_token", pollToken);
+        return requestJson(url.toString(), {
+            method: "GET",
+        }, this.timeoutMs, this.logger);
+    }
     async refreshToken(payload) {
         return requestJson(`${this.apiBaseUrl}/cli/token/refresh`, {
             method: "POST",

package/dist/core/auth.js

@@ -1,14 +1,8 @@
 import { randomBytes } from "node:crypto";
 import { spawn } from "node:child_process";
-import { CALLBACK_TIMEOUT_MS, CLI_CLIENT_ID } from "./constants.js";
+import { CALLBACK_TIMEOUT_MS, CLI_CLIENT_ID, LOGIN_ATTEMPT_POLL_INTERVAL_MS } from "./constants.js";
 import { AuthError } from "./errors.js";
 import { createCallbackServer } from "./server.js";
-function buildLoginUrl(profile, callbackUrl, state) {
-    const url = new URL("/cli/login", profile.appBaseUrl);
-    url.searchParams.set("redirect_uri", callbackUrl);
-    url.searchParams.set("state", state);
-    return url.toString();
-}
 export function generateLoginState() {
     return randomBytes(24).toString("hex");
 }
@@ -35,7 +29,12 @@ export async function runLoginFlow(params) {
     const state = generateLoginState();
     const callbackServer = await createCallbackServer(params.config.callbackHost, params.config.callbackPort, params.config.callbackPath, state);
     try {
-        const loginUrl = buildLoginUrl(params.profile, callbackServer.callbackUrl, state);
+        const loginAttempt = await params.apiClient.createLoginAttempt({
+            redirectUri: callbackServer.callbackUrl,
+            state,
+            client: CLI_CLIENT_ID,
+        });
+        const loginUrl = loginAttempt.loginUrl;
         params.logger.info("abrindo navegador para autenticação...");
         const opened = await openBrowser(loginUrl);
         if (!opened) {
@@ -43,9 +42,20 @@ export async function runLoginFlow(params) {
             process.stdout.write(`${loginUrl}\n`);
         }
         params.logger.info("aguardando confirmação...");
-        const callback = await callbackServer.waitForCallback(CALLBACK_TIMEOUT_MS);
+        const code = await Promise.any([
+            callbackServer.waitForCallback(CALLBACK_TIMEOUT_MS).then((callback) => callback.code),
+            waitForAuthorizedAttempt({
+                apiClient: params.apiClient,
+                attemptId: loginAttempt.attemptId,
+                pollToken: loginAttempt.pollToken,
+                timeoutMs: CALLBACK_TIMEOUT_MS,
+                logger: params.logger,
+            }),
+        ]).catch((error) => {
+            throw new AuthError("Não foi possível concluir o login do CLI.", error);
+        });
         const payload = {
-            code: callback.code,
+            code,
             client: CLI_CLIENT_ID,
             device: params.machine,
             runtime: params.runtime,
@@ -68,4 +78,32 @@ export async function runLoginFlow(params) {
         await callbackServer.close();
     }
 }
+async function waitForAuthorizedAttempt(params) {
+    const startedAt = Date.now();
+    let announcedAuthorization = false;
+    while (Date.now() - startedAt < params.timeoutMs) {
+        const status = await params.apiClient.getLoginAttemptStatus(params.attemptId, params.pollToken);
+        const code = pickAuthorizedCode(status);
+        if (code) {
+            return code;
+        }
+        if (status.status === "authorized" && !announcedAuthorization) {
+            announcedAuthorization = true;
+            params.logger.info("autorização recebida pela API. finalizando sessão...");
+        }
+        await delay(LOGIN_ATTEMPT_POLL_INTERVAL_MS);
+    }
+    throw new AuthError("Tempo esgotado aguardando a confirmação do login do CLI.");
+}
+function pickAuthorizedCode(status) {
+    if ((status.status === "authorized" || status.status === "completed") && typeof status.code === "string" && status.code.length > 0) {
+        return status.code;
+    }
+    return null;
+}
+function delay(ms) {
+    return new Promise((resolve) => {
+        setTimeout(resolve, ms);
+    });
+}
 //# sourceMappingURL=auth.js.map

package/dist/core/constants.d.ts

@@ -18,5 +18,6 @@ export declare const DEFAULT_STATE: CliState;
 export declare const DEFAULT_QUEUE: QueueStore;
 export declare const DEFAULT_WORKSPACE_BINDINGS: WorkspaceBindingStore;
 export declare const CALLBACK_TIMEOUT_MS = 120000;
+export declare const LOGIN_ATTEMPT_POLL_INTERVAL_MS = 1000;
 export declare const SENSITIVE_KEYS: string[];
 export declare const SAFE_ENV_KEYS: string[];

package/dist/core/constants.js

@@ -56,6 +56,7 @@ export const DEFAULT_WORKSPACE_BINDINGS = {
     bindings: {},
 };
 export const CALLBACK_TIMEOUT_MS = 120_000;
+export const LOGIN_ATTEMPT_POLL_INTERVAL_MS = 1_000;
 export const SENSITIVE_KEYS = ["token", "authorization", "refresh", "secret", "password", "cookie"];
 export const SAFE_ENV_KEYS = [
     "SHELL",

package/dist/core/server.js

@@ -4,6 +4,8 @@ export async function createCallbackServer(host, port, callbackPath, expectedSta
     let resolveCallback = null;
     let rejectCallback = null;
     let settled = false;
+    let pendingResult = null;
+    let pendingError = null;
     const server = http.createServer((request, response) => {
         try {
             const url = new URL(request.url ?? "/", `http://${host}:${port}`);
@@ -36,7 +38,9 @@ export async function createCallbackServer(host, port, callbackPath, expectedSta
             response.end("<html><body><p>VectorPlane: autenticação recebida. Você já pode voltar ao terminal.</p></body></html>");
             if (!settled) {
                 settled = true;
-                resolveCallback?.({ code, state });
+                const result = { code, state };
+                pendingResult = result;
+                resolveCallback?.(result);
             }
         }
         catch (error) {
@@ -44,6 +48,7 @@ export async function createCallbackServer(host, port, callbackPath, expectedSta
             response.end("VectorPlane callback error.");
             if (!settled) {
                 settled = true;
+                pendingError = error;
                 rejectCallback?.(error);
             }
         }
@@ -65,6 +70,14 @@ export async function createCallbackServer(host, port, callbackPath, expectedSta
             return new Promise((resolve, reject) => {
                 resolveCallback = resolve;
                 rejectCallback = reject;
+                if (pendingError) {
+                    reject(pendingError);
+                    return;
+                }
+                if (pendingResult) {
+                    resolve(pendingResult);
+                    return;
+                }
                 const timer = setTimeout(() => {
                     if (!settled) {
                         settled = true;

package/dist/types/auth.d.ts

@@ -5,6 +5,26 @@ export interface AuthCodeExchangeRequest {
     device: MachineContext;
     runtime: RuntimeContext;
 }
+export interface CreateLoginAttemptRequest {
+    redirectUri: string;
+    state: string;
+    client: "vp-cli";
+}
+export interface CreateLoginAttemptResponse {
+    attemptId: string;
+    pollToken: string;
+    expiresAt: string;
+    loginUrl: string;
+}
+export interface LoginAttemptStatusResponse {
+    attemptId: string;
+    status: "pending" | "authorized" | "completed";
+    code: string | null;
+    workspace: string | null;
+    expiresAt: string;
+    authorizedAt: string | null;
+    completedAt: string | null;
+}
 export interface AuthTokenExchangeResponse {
     access_token: string;
     refresh_token: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vectorplane/ctrl-cli",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "description": "Official VectorPlane CLI.",
   "type": "module",
   "main": "./dist/index.js",