@vellumai/assistant 0.8.0 → 0.8.2

package/src/cli/commands/oauth/connect.ts

@@ -1,81 +1,24 @@
-import { createServer, type Server } from "node:http";
-
 import type { Command } from "commander";
 
-import { getIsContainerized } from "../../../config/env-registry.js";
-import { cliIpcCall } from "../../../ipc/cli-client.js";
-import {
-  getAppByProviderAndClientId,
-  getMostRecentAppByProvider,
-  getProvider,
-} from "../../../oauth/oauth-store.js";
-import { renderOAuthCompletionPage } from "../../../security/oauth-completion-page.js";
-import { getSecureKeyAsync } from "../../../security/secure-keys.js";
-import { openInHostBrowser } from "../../../util/browser.js";
+import { cliIpcCall, exitFromIpcResult } from "../../../ipc/cli-client.js";
+import { openInHostBrowser } from "../../lib/open-browser.js";
 import { getCliLogger } from "../../logger.js";
 import { shouldOutputJson, writeOutput } from "../../output.js";
-import {
-  fetchActiveConnections,
-  isManagedMode,
-  requirePlatformClient,
-} from "./shared.js";
 
 const log = getCliLogger("cli");
 
-/**
- * Start a temporary loopback server to serve a nice completion page after the
- * platform redirects the user's browser following a managed OAuth flow.
- * Returns the base URL and a cleanup function.
- */
-function startManagedRedirectServer(provider: string): Promise<{
-  redirectUrl: string;
-  cleanup: () => void;
-}> {
-  return new Promise((resolve, reject) => {
-    const server: Server = createServer((req, res) => {
-      const url = new URL(req.url ?? "/", "http://127.0.0.1");
-      const error = url.searchParams.get("error");
-      const errorDesc = url.searchParams.get("error_description");
-      const providerHint = url.searchParams.get("provider") ?? provider;
-
-      if (error) {
-        const message = errorDesc ?? error;
-        res.writeHead(200, { "Content-Type": "text/html" });
-        res.end(renderOAuthCompletionPage(message, false, providerHint));
-      } else {
-        res.writeHead(200, { "Content-Type": "text/html" });
-        res.end(
-          renderOAuthCompletionPage(
-            "You can close this tab and return to your assistant.",
-            true,
-            providerHint,
-          ),
-        );
-      }
-    });
-
-    server.listen(0, "localhost", () => {
-      const addr = server.address() as { port: number };
-      const redirectUrl = `http://localhost:${addr.port}/oauth/complete`;
-      resolve({
-        redirectUrl,
-        cleanup: () => server.close(),
-      });
-    });
-
-    server.on("error", (err) => {
-      reject(new Error(`Failed to start redirect server: ${err.message}`));
-    });
-  });
-}
-
 // ---------------------------------------------------------------------------
 // IPC polling helpers
 // ---------------------------------------------------------------------------
 
 type OAuthConnectStatusResponse =
   | { status: "pending"; service: string }
-  | { status: "complete"; service: string; account_info?: string; granted_scopes?: string[] }
+  | {
+      status: "complete";
+      service: string;
+      account_info?: string;
+      granted_scopes?: string[];
+    }
   | { status: "error"; service: string; error?: string };
 
 async function pollOAuthConnectStatus(
@@ -95,11 +38,19 @@ async function pollOAuthConnectStatus(
       }
     }
     if (!r.ok && r.statusCode !== undefined) {
-      return { status: "error", service: "?", error: r.error ?? "assistant error during OAuth status poll" };
+      return {
+        status: "error",
+        service: "?",
+        error: r.error ?? "assistant error during OAuth status poll",
+      };
     }
     await new Promise<void>((res) => setTimeout(res, opts.intervalMs));
   }
-  return { status: "error", service: "?", error: "Timed out waiting for OAuth callback" };
+  return {
+    status: "error",
+    service: "?",
+    error: "Timed out waiting for OAuth callback",
+  };
 }
 
 // ---------------------------------------------------------------------------
@@ -171,208 +122,185 @@ Examples:
 
         try {
           // ---------------------------------------------------------------
-          // 1. Validate provider exists
+          // 1. Validate provider exists via IPC
           // ---------------------------------------------------------------
-          const providerRow = getProvider(provider);
-          if (!providerRow) {
-            writeError(
-              `Unknown provider "${provider}". ` +
-                `Run 'assistant oauth providers list' to see available providers.`,
-            );
-            return;
+          const providerCheck = await cliIpcCall<{
+            provider: Record<string, unknown>;
+          }>("oauth_providers_by_providerKey_get", {
+            pathParams: { providerKey: provider },
+          });
+
+          if (!providerCheck.ok) {
+            if (providerCheck.statusCode === 404) {
+              writeError(
+                `Unknown provider "${provider}". ` +
+                  `Run 'assistant oauth providers list' to see available providers.`,
+              );
+              return;
+            }
+            return exitFromIpcResult(providerCheck);
           }
 
+          const providerRow = providerCheck.result?.provider as
+            | Record<string, unknown>
+            | undefined;
+          const authorizeUrl = providerRow?.authUrl as string | undefined;
+
           // ---------------------------------------------------------------
-          // 3. Detect mode
+          // 2. Detect mode via IPC
           // ---------------------------------------------------------------
-          const managed = isManagedMode(provider);
+          const modeResult = await cliIpcCall<{
+            ok: boolean;
+            mode: string;
+          }>("oauth_mode_get", {
+            queryParams: { provider },
+          });
+
+          if (!modeResult.ok) return exitFromIpcResult(modeResult);
+
+          const managed = modeResult.result?.mode === "managed";
 
           if (managed) {
             // =============================================================
             // MANAGED PATH
             // =============================================================
 
-            // Warn about --client-id being ignored in managed mode
             if (opts.clientId) {
               log.info(
                 `Warning: --client-id is ignored for platform-managed providers. The platform manages OAuth apps for "${provider}".`,
               );
             }
 
-            const client = await requirePlatformClient(cmd);
-            if (!client) return;
-
-            // Call the platform's OAuth start endpoint
-            const startPath = `/v1/assistants/${encodeURIComponent(client.platformAssistantId)}/oauth/${encodeURIComponent(provider)}/start/`;
-
-            const body: Record<string, unknown> = {};
+            const startBody: Record<string, unknown> = { provider };
             if (opts.scopes && opts.scopes.length > 0) {
-              body.requested_scopes = opts.scopes;
-            }
-
-            // When opening the browser, start a local server to show a nice
-            // completion page instead of redirecting to the platform website.
-            //
-            // In containerized mode the loopback server is unreachable from
-            // the host browser, so redirect to the platform's own completion
-            // page instead.
-            let redirectServer:
-              | { redirectUrl: string; cleanup: () => void }
-              | undefined;
-            if (opts.browser !== false) {
-              if (getIsContainerized()) {
-                body.redirect_after_connect = "/account/oauth/desktop-complete";
-              } else {
-                try {
-                  redirectServer = await startManagedRedirectServer(provider);
-                  body.redirect_after_connect = redirectServer.redirectUrl;
-                } catch {
-                  // Non-fatal — fall back to platform default redirect
-                }
-              }
+              startBody.scopes = opts.scopes;
             }
 
-            try {
-              const response = await client.fetch(startPath, {
-                method: "POST",
-                headers: { "Content-Type": "application/json" },
-                body: JSON.stringify(body),
-              });
+            const startResult = await cliIpcCall<{
+              ok: boolean;
+              connect_url: string;
+            }>("oauth_managed_connect_start", {
+              body: startBody,
+            });
 
-              if (!response.ok) {
-                const errorText = await response.text().catch(() => "");
-                const baseMsg = `Platform returned HTTP ${response.status}${errorText ? `: ${errorText}` : ""}`;
-                if (response.status === 401 || response.status === 403) {
-                  writeError(
-                    `${baseMsg}. Your platform session may have expired. Run \`vellum platform connect\` to reconnect.`,
-                  );
-                } else {
-                  writeError(baseMsg);
-                }
-                return;
-              }
+            if (!startResult.ok) return exitFromIpcResult(startResult);
 
-              const result = (await response.json()) as {
-                connect_url?: string;
-              };
+            const connectUrl = startResult.result!.connect_url;
 
-              if (!result.connect_url) {
-                writeError(
-                  "Platform did not return a connect URL — the OAuth flow could not be started",
-                );
-                return;
-              }
+            if (opts.browser !== false) {
+              // Snapshot existing connection IDs before opening browser
+              const snapshotResult = await cliIpcCall<{
+                ok: boolean;
+                connections: Array<{
+                  id: string;
+                  account_label?: string;
+                  scopes_granted?: string[];
+                }>;
+              }>("oauth_managed_connect_poll", {
+                queryParams: { provider },
+              });
 
-              if (opts.browser !== false) {
-                // Snapshot existing connection IDs before opening browser
-                const snapshotEntries = await fetchActiveConnections(
-                  client,
-                  provider,
-                  cmd,
-                );
-                if (!snapshotEntries) {
-                  // fetchActiveConnections already wrote the error output
-                  return;
-                }
-                const snapshotIds = new Set(snapshotEntries.map((e) => e.id));
+              if (!snapshotResult.ok) return exitFromIpcResult(snapshotResult);
 
-                await openInHostBrowser(result.connect_url);
+              const snapshotIds = new Set(
+                (snapshotResult.result?.connections ?? []).map((e) => e.id),
+              );
 
-                if (!jsonMode) {
-                  log.info(
-                    `Opening browser to connect ${provider}. Waiting for authorization...`,
-                  );
-                }
+              openInHostBrowser(connectUrl);
 
-                // Poll for a new connection every 2s for up to 5 minutes
-                const pollIntervalMs = 2000;
-                const timeoutMs = 5 * 60 * 1000;
-                const deadline = Date.now() + timeoutMs;
-                let newConnection: {
-                  id: string;
-                  account_label?: string;
-                  scopes_granted?: string[];
-                } | null = null;
+              if (!jsonMode) {
+                log.info(
+                  `Opening browser to connect ${provider}. Waiting for authorization...`,
+                );
+              }
 
-                while (Date.now() < deadline) {
-                  await new Promise((r) => setTimeout(r, pollIntervalMs));
+              // Poll for a new connection every 2s for up to 5 minutes
+              const pollIntervalMs = 2000;
+              const timeoutMs = 5 * 60 * 1000;
+              const deadline = Date.now() + timeoutMs;
+              let newConnection: {
+                id: string;
+                account_label?: string;
+                scopes_granted?: string[];
+              } | null = null;
+
+              while (Date.now() < deadline) {
+                await new Promise((r) => setTimeout(r, pollIntervalMs));
+
+                const currentResult = await cliIpcCall<{
+                  ok: boolean;
+                  connections: Array<{
+                    id: string;
+                    account_label?: string;
+                    scopes_granted?: string[];
+                  }>;
+                }>("oauth_managed_connect_poll", {
+                  queryParams: { provider },
+                });
 
-                  const currentEntries = await fetchActiveConnections(
-                    client,
-                    provider,
-                    cmd,
-                    { silent: true },
-                  );
-                  if (!currentEntries) continue;
+                if (!currentResult.ok || !currentResult.result) continue;
 
-                  const found = currentEntries.find(
-                    (e) => !snapshotIds.has(e.id),
-                  );
-                  if (found) {
-                    newConnection = found;
-                    break;
-                  }
+                const found = currentResult.result.connections.find(
+                  (e) => !snapshotIds.has(e.id),
+                );
+                if (found) {
+                  newConnection = found;
+                  break;
                 }
+              }
 
-                if (newConnection) {
-                  // Success — new connection found
-                  if (jsonMode) {
-                    writeOutput(cmd, {
-                      ok: true,
-                      provider: provider,
-                      connectionId: newConnection.id,
-                      accountLabel: newConnection.account_label ?? null,
-                      scopesGranted: newConnection.scopes_granted ?? [],
-                    });
-                  } else {
-                    const label = newConnection.account_label
-                      ? ` as ${newConnection.account_label}`
-                      : "";
-                    process.stdout.write(`Connected to ${provider}${label}\n`);
-                  }
+              if (newConnection) {
+                if (jsonMode) {
+                  writeOutput(cmd, {
+                    ok: true,
+                    provider: provider,
+                    connectionId: newConnection.id,
+                    accountLabel: newConnection.account_label ?? null,
+                    scopesGranted: newConnection.scopes_granted ?? [],
+                  });
                 } else {
-                  // Timeout — authorization may still be in progress
-                  if (jsonMode) {
-                    writeOutput(cmd, {
-                      ok: true,
-                      deferred: true,
-                      provider: provider,
-                      connectUrl: result.connect_url,
-                      message:
-                        "Authorization may still be in progress. Check with 'assistant oauth status <provider>'.",
-                    });
-                  } else {
-                    process.stdout.write(
-                      `Timed out waiting for authorization. It may still be in progress.\n` +
-                        `Check with: assistant oauth status ${provider}\n`,
-                    );
-                  }
+                  const label = newConnection.account_label
+                    ? ` as ${newConnection.account_label}`
+                    : "";
+                  process.stdout.write(`Connected to ${provider}${label}\n`);
                 }
               } else {
-                // --no-browser: output the connect URL
                 if (jsonMode) {
                   writeOutput(cmd, {
                     ok: true,
                     deferred: true,
-                    connectUrl: result.connect_url,
                     provider: provider,
+                    connectUrl,
+                    message:
+                      "Authorization may still be in progress. Check with 'assistant oauth status <provider>'.",
                   });
                 } else {
-                  process.stdout.write(result.connect_url + "\n");
+                  process.stdout.write(
+                    `Timed out waiting for authorization. It may still be in progress.\n` +
+                      `Check with: assistant oauth status ${provider}\n`,
+                  );
                 }
               }
-            } finally {
-              redirectServer?.cleanup();
+            } else {
+              // --no-browser: output the connect URL
+              if (jsonMode) {
+                writeOutput(cmd, {
+                  ok: true,
+                  deferred: true,
+                  connectUrl,
+                  provider: provider,
+                });
+              } else {
+                process.stdout.write(connectUrl + "\n");
+              }
             }
           } else {
             // =============================================================
             // BYO PATH
             // =============================================================
 
-            // Manual-token providers (slack_channel, telegram) don't use
-            // OAuth2 browser flows — credentials are configured via
-            // `assistant credentials` or chat setup instead.
-            if (providerRow.authorizeUrl === "urn:manual-token") {
+            // Manual-token providers don't use OAuth2 browser flows
+            if (authorizeUrl === "urn:manual-token") {
               writeError(
                 `"${provider}" uses manual token configuration, not an OAuth browser flow. ` +
                   `Set the token with: assistant credentials set <token_value> --service ${provider} --field <field_name>`,
@@ -380,77 +308,35 @@ Examples:
               return;
             }
 
-            // a. Resolve client credentials from the DB
-            const dbApp = opts.clientId
-              ? getAppByProviderAndClientId(provider, opts.clientId)
-              : getMostRecentAppByProvider(provider);
-
-            let clientId = opts.clientId;
-            let clientSecret: string | undefined;
-
-            if (dbApp) {
-              if (!clientId) clientId = dbApp.clientId;
-              const storedSecret = await getSecureKeyAsync(
-                dbApp.clientSecretCredentialPath,
-              );
-              if (storedSecret) clientSecret = storedSecret;
-            } else if (opts.clientId) {
-              // --client-id was explicitly provided but no matching app exists
-              writeError(
-                `No registered app found for "${provider}" with client ID "${opts.clientId}". ` +
-                  `Register one with 'assistant oauth apps upsert'.`,
-              );
-              return;
-            }
-
-            // c. Validate client_id exists
-            if (!clientId) {
-              writeError(
-                `No client_id found for "${provider}". ` +
-                  `Register one with 'assistant oauth apps upsert'.`,
-              );
-              return;
-            }
-
-            // d. Check if client_secret is required but missing
-            if (clientSecret === undefined) {
-              const requiresSecret = !!providerRow?.requiresClientSecret;
-
-              if (requiresSecret) {
-                writeError(
-                  `client_secret is required for ${provider} but not found. ` +
-                    `Store it with 'assistant oauth apps upsert --client-secret'.`,
-                );
-                return;
-              }
-            }
-
-            // e. Try daemon-orchestrated path first (fixes heap-split for gateway transport).
-            const startResult = await cliIpcCall<{ auth_url: string; state: string }>(
-              "internal_oauth_connect_start",
-              {
-                body: {
-                  service: provider,
-                  clientId,
-                  ...(clientSecret !== undefined ? { clientSecret } : {}),
-                  callbackTransport: opts.callbackTransport,
-                  ...(opts.scopes ? { requestedScopes: opts.scopes } : {}),
-                },
-              },
-            );
+            // Use daemon-orchestrated path via existing internal routes
+            const startBody: Record<string, unknown> = {
+              service: provider,
+              callbackTransport: opts.callbackTransport,
+            };
+            if (opts.clientId) startBody.clientId = opts.clientId;
+            if (opts.scopes) startBody.requestedScopes = opts.scopes;
+
+            const startResult = await cliIpcCall<{
+              auth_url: string;
+              state: string;
+            }>("internal_oauth_connect_start", {
+              body: startBody,
+            });
 
             if (startResult.ok && startResult.result?.auth_url) {
               const { auth_url, state } = startResult.result;
 
               if (opts.browser !== false) {
-                await openInHostBrowser(auth_url);
+                openInHostBrowser(auth_url);
 
                 if (!jsonMode) {
-                  log.info("Waiting for authorization in browser... (press Ctrl+C to cancel)");
+                  log.info(
+                    "Waiting for authorization in browser... (press Ctrl+C to cancel)",
+                  );
                 }
                 const final = await pollOAuthConnectStatus(state, {
                   intervalMs: 2000,
-                  timeoutMs: 5 * 60 * 1000, // match LOOPBACK_TIMEOUT_MS in oauth2.ts (5 min)
+                  timeoutMs: 5 * 60 * 1000,
                 });
 
                 if (final.status === "complete") {
@@ -469,17 +355,16 @@ Examples:
                 }
 
                 if (final.status === "error") {
-                  // Includes the timeout sentinel emitted by pollOAuthConnectStatus.
                   writeError(final.error ?? "OAuth connect failed");
                   return;
                 }
 
-                // Defensive: pollOAuthConnectStatus should never return pending,
-                // but TS narrowing requires us to handle it.
-                writeError("OAuth connect ended in an unexpected pending state");
+                writeError(
+                  "OAuth connect ended in an unexpected pending state",
+                );
                 return;
               } else {
-                // --no-browser: return the URL immediately, matching existing deferred behavior.
+                // --no-browser: return the URL immediately
                 if (jsonMode) {
                   writeOutput(cmd, {
                     ok: true,
@@ -497,26 +382,20 @@ Examples:
               }
             }
 
-            // ok:true but no auth_url means a malformed daemon response — surface an error rather
-            // than falling back to in-process (which would re-introduce the heap-split bug for
-            // gateway transport).
             if (startResult.ok && !startResult.result?.auth_url) {
-              writeError("assistant returned unexpected response for OAuth connect start");
+              writeError(
+                "assistant returned unexpected response for OAuth connect start",
+              );
               return;
             }
 
-            // If the daemon was reachable but returned an error, surface it rather than
-            // falling back to in-process (which would re-introduce the heap-split bug for
-            // gateway transport).
             if (!startResult.ok && startResult.statusCode !== undefined) {
-              writeError(startResult.error ?? "OAuth connect failed (assistant error)");
+              writeError(
+                startResult.error ?? "OAuth connect failed (assistant error)",
+              );
               return;
             }
 
-            // IPC unavailable: the assistant must be running for OAuth connect. The
-            // gateway-routed callback lands in the assistant's process, and any tokens
-            // acquired need the assistant to store and use them — so an unreachable
-            // assistant is a fatal precondition. Surface a clear error and exit 1.
             writeError(
               startResult.error
                 ? `Could not reach the assistant: ${startResult.error}. Is the assistant running?`