@vendure/cloud 0.4.0 → 0.5.0-dev.20261016123507.ge07a06e

package/dist/cli/lib/auth.d.ts

@@ -1,151 +1,10 @@
 import type { CredentialOptions } from "../root-options.js";
-import { type FileLockOptions } from "./file-lock.js";
-export interface AuthOrganization {
-    id: string;
-    workosOrgId: string;
-    name: string;
-    slug: string;
-    role: string;
-}
-export interface AuthConfig {
-    accessToken: string;
-    refreshToken: string;
-    user: {
-        id: string;
-        email: string;
-        name: string | null;
-    };
-    activeOrganizationId: string | null;
-    organizations: AuthOrganization[];
-}
-export interface TokenPair {
-    accessToken: string;
-    refreshToken: string;
-}
-export declare const API_AUTH_CONFIG_TIMEOUT_MS = 15000;
-export declare const WORKOS_AUTH_REQUEST_TIMEOUT_MS = 60000;
-/**
- * The credential a single CLI invocation runs under.
- *
- * `apiKey` covers both `--token` and `VENDURE_CLOUD_TOKEN`: the control plane
- * validates those as WorkOS API keys, resolves the organization they belong to
- * itself, and never issues a refresh token for them. `session` is the stored
- * browser login, which does have a refresh token and does carry an active
- * organization the CLI selected locally.
- *
- * `consoleSession` is the shared Vendure Console CLI Session that Vendure
- * Platform stores in `~/.vendure/console-credentials.json`. It carries no
- * organization of its own here: the control plane resolves that server-side
- * from Console, so there is nothing for this machine to select and nothing for
- * it to assert (CLO-641).
- */
 export type CliCredential = {
     kind: "apiKey";
-    token: string;
+    key: string;
 } | {
-    kind: "session";
-    token: string;
-    organizationId: string | null;
-} | {
-    kind: "consoleSession";
-    token: string;
+    kind: "userLogin";
+    accessToken: string;
 };
-/**
- * Precedence: the explicit `--token`, then `VENDURE_CLOUD_TOKEN`, then the
- * shared Console session, then the stored Cloud login. Returns null when the
- * machine has no credential at all, so each caller can word its own "not logged
- * in" response.
- *
- * The shared session comes before the stored Cloud login because it is the one
- * a developer just approved, and reusing it is the point of CLO-641. It comes
- * after an explicit token for the same reason the stored login does: a
- * credential someone named on the command line is the one they meant.
- *
- * `~/.vendure-cloud/auth.json` keeps working underneath it. A machine that has
- * only that file resolves exactly as it did before, and so does every machine
- * while the shared path stays switched off.
- *
- * An explicitly supplied credential is never mixed with the stored session:
- * spending the session's single-use refresh token on a credential that does
- * not own it strands the login (CLO-164), and sending the locally selected
- * organization alongside a key that resolves its own would contradict it.
- *
- * Throws rather than returns null for a credential another Vendure product
- * issued. Someone who set `--token` to their project's environment credential
- * has made a specific mistake, and falling back to the stored session would
- * answer it with whatever that session happens to be — or with "not logged in",
- * which is not what went wrong. Refusing here is also what keeps the value on
- * the machine; the control plane refuses it again for callers that are not
- * this CLI.
- */
-export declare function resolveCredential(options: CredentialOptions): CliCredential | null;
-export declare function readAuthConfig(): AuthConfig | null;
-/**
- * Write via a temp file + rename so the config is replaced atomically.
- * A plain `writeFileSync` truncates in place: a crash mid-write leaves
- * unparseable JSON, which reads back as "not logged in" while the rotated
- * refresh token — already consumed at the authentication service — is gone
- * for good. Rename is atomic within a directory, so a reader sees either the
- * whole old config or the whole new one.
- */
-export declare function writeAuthConfig(config: AuthConfig): void;
-export declare function clearAuthConfig(): void;
-/**
- * Exchange a refresh token for a fresh access/refresh token pair via WorkOS.
- *
- * Pass `workosOrgId` to scope the new token to a specific organization:
- * WorkOS bakes the user's role + permissions for that org into the access
- * token's claims at issue time. Without it, WorkOS returns a token for the
- * user's current/default org. This is the mechanism that keeps the JWT's
- * `org_id` + `permissions` in step with the CLI's active org — see
- * `org switch` and the multi-org branch of `login`.
- *
- * Note: `workosOrgId` is the WorkOS organization id (`org_…`), NOT the
- * internal DB UUID stored in `AuthConfig.activeOrganizationId`.
- */
-export declare function exchangeRefreshToken(refreshToken: string, workosOrgId?: string): Promise<TokenPair>;
-/**
- * Exported so the `waitMs >= staleMs` invariant below can be asserted — it is
- * the load-bearing relationship in this whole mechanism and nothing else
- * enforces it.
- *
- * `staleMs` covers the worst case of both refresh requests timing out, so a
- * waiter never breaks a lock that is still doing useful work.
- *
- * `waitMs` must not be shorter. A waiter that gives up early goes down the
- * unlocked path *before* the holder has written its rotated pair, so the
- * already-rotated checks below still see the old token and spend it a second
- * time — the single-use double-spend this lock exists to prevent (CLO-164).
- * Equality is what makes "gave up" and "the holder is dead" the same condition.
- */
-export declare const SESSION_LOCK_OPTIONS: FileLockOptions;
-/**
- * Serializes everything that spends the single-use refresh token or rewrites
- * `auth.json`, across processes. Every such call site must go through this —
- * guarding one of them leaves the double-spend fully reachable via the others.
- *
- * The callback receives whether the lock was actually held; see `withFileLock`.
- */
-export declare function withSessionLock<T>(fn: (held: boolean) => Promise<T>): Promise<T>;
-/**
- * Pass the access token that got the 401. If the stored config has moved on
- * from it, another process (or an earlier command) already rotated the pair and
- * its access token is reused — refresh tokens are single-use, so spending ours
- * on a redundant exchange is what strands sessions. Reuse requires provable
- * lifetime left; see `hasUsableLifetime`.
- */
-export declare function refreshAccessToken(failedAccessToken?: string): Promise<string>;
-/**
- * Re-mint the stored session scoped to a different organization, then persist
- * it. The read-exchange-write runs as one locked unit and re-reads inside the
- * lock: a concurrent refresh may have rotated the pair since the caller last
- * looked, and spreading a stale snapshot over it would write back a refresh
- * token the authentication service has already retired. Atomic rename stops
- * torn files; it does nothing about lost updates.
- */
-export declare function rotateActiveOrganization(target: {
-    organizationId: string;
-    workosOrgId: string;
-    organizations: AuthOrganization[];
-}): Promise<AuthConfig>;
+export declare function resolveCredential(options: CredentialOptions): Promise<CliCredential>;
 //# sourceMappingURL=auth.d.ts.map

package/dist/cli/lib/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/cli/lib/auth.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAiB5D,OAAO,EAAE,KAAK,eAAe,EAAgB,MAAM,gBAAgB,CAAC;AAIpE,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,UAAU;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACzD,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,aAAa,EAAE,gBAAgB,EAAE,CAAC;CACnC;AAED,MAAM,WAAW,SAAS;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,eAAO,MAAM,0BAA0B,QAAS,CAAC;AACjD,eAAO,MAAM,8BAA8B,QAAS,CAAC;AAErD;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,aAAa,GACrB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACjC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GACjE;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9C;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,iBAAiB,GAAG,aAAa,GAAG,IAAI,CA2BlF;AAED,wBAAgB,cAAc,IAAI,UAAU,GAAG,IAAI,CAUlD;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,CAexD;AAmFD,wBAAgB,eAAe,IAAI,IAAI,CAItC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,oBAAoB,CACxC,YAAY,EAAE,MAAM,EACpB,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,SAAS,CAAC,CAiCpB;AAwFD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,oBAAoB,EAAE,eAYlC,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAEhF;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CAAC,iBAAiB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAUpF;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE;IAC/C,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,gBAAgB,EAAE,CAAC;CACnC,GAAG,OAAO,CAAC,UAAU,CAAC,CAyCtB"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/cli/lib/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAO5D,MAAM,MAAM,aAAa,GACrB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC/B;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC;AAK/C,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,aAAa,CAAC,CAU1F"}