@videan/cli 0.4.3 → 0.5.1

package/dist/index.js

@@ -872,6 +872,104 @@ function installPromptCrashGuard() {
   });
 }
 
+// src/browser-login.ts
+import http from "node:http";
+import crypto from "node:crypto";
+import { spawn } from "node:child_process";
+var LANDING = (title, sub) => `<!doctype html>
+<meta charset="utf-8"><title>${title}</title>
+<body style="font-family:system-ui;background:#101014;color:#e8e8ea;display:grid;place-items:center;min-height:90vh">
+<div style="text-align:center"><h1 style="font-weight:600">${title}</h1><p style="color:#9a9aa2">${sub}</p></div>`;
+function createCallbackServer(state, timeoutMs = 5 * 60 * 1e3, redirectOrigin) {
+  return new Promise((resolveServer, rejectServer) => {
+    let settle;
+    const waitForToken = new Promise((resolve, reject) => {
+      settle = { resolve, reject };
+    });
+    waitForToken.catch(() => {
+    });
+    const server = http.createServer((req, res) => {
+      const url = new URL(req.url || "/", "http://127.0.0.1");
+      if (url.pathname !== "/callback") {
+        res.writeHead(404).end();
+        return;
+      }
+      if (url.searchParams.get("state") !== state) {
+        res.writeHead(403, { "Content-Type": "text/html" });
+        res.end(LANDING("Request refused", "This authorization was not started by this CLI."));
+        return;
+      }
+      const land = (done2, status, title, sub) => {
+        if (redirectOrigin) {
+          res.writeHead(302, { Location: `${redirectOrigin}/cli-auth?done=${done2}` });
+          res.end();
+        } else {
+          res.writeHead(status, { "Content-Type": "text/html" });
+          res.end(LANDING(title, sub));
+        }
+      };
+      if (url.searchParams.get("error")) {
+        land("denied", 200, "Login cancelled", "You can close this tab.");
+        finish(() => settle.reject(new Error("Authorization was declined in the browser.")));
+        return;
+      }
+      const token = url.searchParams.get("token");
+      if (!token) {
+        res.writeHead(400, { "Content-Type": "text/html" });
+        res.end(LANDING("Something went wrong", "No token arrived. Run `videan login` again."));
+        finish(() => settle.reject(new Error("The browser sent no token.")));
+        return;
+      }
+      land("ok", 200, "You're logged in", "Return to your terminal \u2014 you can close this tab.");
+      finish(() => settle.resolve(token));
+    });
+    const timer = setTimeout(() => {
+      finish(() => settle.reject(new Error("Timed out waiting for the browser (5 minutes).")));
+    }, timeoutMs);
+    timer.unref();
+    let done = false;
+    function finish(outcome) {
+      if (done) return;
+      done = true;
+      clearTimeout(timer);
+      outcome();
+      setTimeout(() => server.close(), 100).unref();
+    }
+    server.on("error", (e) => rejectServer(e));
+    server.listen(0, "127.0.0.1", () => {
+      const address = server.address();
+      if (!address || typeof address === "string") {
+        rejectServer(new Error("Could not bind a loopback port."));
+        return;
+      }
+      resolveServer({
+        port: address.port,
+        waitForToken,
+        close: () => finish(() => settle.reject(new Error("closed")))
+      });
+    });
+  });
+}
+function randomState() {
+  return crypto.randomBytes(16).toString("hex");
+}
+function consoleOriginFor(baseUrl) {
+  try {
+    const url = new URL(baseUrl);
+    if (url.protocol !== "https:" || !url.hostname.startsWith("api.")) return null;
+    return `https://${url.hostname.slice(4)}`;
+  } catch {
+    return null;
+  }
+}
+function openBrowser(url) {
+  const [cmd, args] = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["cmd", ["/c", "start", "", url]] : ["xdg-open", [url]];
+  try {
+    spawn(cmd, args, { stdio: "ignore", detached: true }).unref();
+  } catch {
+  }
+}
+
 // src/commands/login.ts
 async function completeTwoFactor(spinner, baseUrl, login) {
   if (!process.stdin.isTTY) {
@@ -917,35 +1015,86 @@ async function completeTwoFactor(spinner, baseUrl, login) {
   spinner.fail("Too many wrong codes. Run `videan login` again to get a new one.");
   process.exit(1);
 }
-var loginCommand = new Command("login").description("Log in to Cloud").option("-e, --email <email>", "Email (skips the prompt)").option("-p, --password <password>", "Password (skips the prompt; prefer VIDEAN_PASSWORD)").option("-o, --org <id>", "Organization to scope the key to (skips the picker)").option("--api-url <url>", "API base URL to use and remember (default: the public API)").action(async (opts) => {
-  const password = opts.password || process.env.VIDEAN_PASSWORD || process.env.CLOUD_PASSWORD;
-  if ((!opts.email || !password) && !process.stdin.isTTY) {
-    console.error(
-      chalk2.red(
-        "login needs a terminal to prompt. Non-interactively, pass --email and --password (or VIDEAN_PASSWORD), or skip login entirely by setting VIDEAN_API_KEY."
-      )
-    );
+async function pickOrg(spinner, session, orgOpt, resume) {
+  let orgs;
+  try {
+    orgs = await session.orgs.list();
+  } catch (e) {
+    spinner.fail(`Logged in, but could not list organizations: ${e?.message}`);
     process.exit(1);
   }
-  const prompts = [
-    ...opts.email ? [] : [{ type: "input", name: "email", message: "Email:" }],
-    ...password ? [] : [{ type: "password", name: "password", message: "Password:" }]
-  ];
-  const answers = {
-    email: opts.email,
-    password,
-    ...prompts.length ? await inquirer2.prompt(prompts) : {}
-  };
-  if (opts.apiUrl) setBaseUrl(opts.apiUrl.replace(/\/$/, ""));
-  const baseUrl = (getBaseUrl() || DEFAULT_API_URL2).replace(/\/$/, "");
-  const spinner = ora("Logging in...").start();
-  let token;
+  if (orgOpt) {
+    const match = orgs.find((o) => o.id === orgOpt || o.name === orgOpt);
+    if (!match) {
+      spinner.fail(`No organization ${orgOpt} for this account.`);
+      process.exit(1);
+    }
+    return match.id;
+  }
+  if (orgs.length > 1 && !process.stdin.isTTY) {
+    spinner.fail(`Several organizations (${orgs.map((o) => o.id).join(", ")}). Pass --org <id>.`);
+    process.exit(1);
+  }
+  if (orgs.length > 1) {
+    spinner.stop();
+    const pick = await inquirer2.prompt([
+      {
+        type: "list",
+        name: "orgId",
+        message: "Organization:",
+        choices: orgs.map((o) => ({ name: `${o.name} (${o.id})`, value: o.id }))
+      }
+    ]);
+    spinner.start(resume);
+    return pick.orgId;
+  }
+  return orgs[0]?.id;
+}
+async function finishWithToken(spinner, baseUrl, token, orgOpt) {
+  const session = new CloudClient({ apiKey: token, baseUrl });
+  const orgId = await pickOrg(spinner, session, orgOpt, "Creating CLI key...");
+  if (!orgId) {
+    setApiKey(token);
+    spinner.warn(
+      chalk2.yellow("Logged in, but you have no organization yet. Run `videan orgs create <name>`.")
+    );
+    return;
+  }
+  try {
+    const key = await session.apiKeys.create({
+      name: `cli@${os.hostname()}`,
+      orgId
+    });
+    setApiKey(key.key);
+    setDefaultOrg(orgId);
+    spinner.succeed(chalk2.green("Logged in."));
+    console.log(chalk2.gray(`  Org:  ${orgId}`));
+    console.log(chalk2.gray(`  Key:  ${key.keyPrefix}\u2026 (revoke with \`videan keys revoke ${key.id}\`)`));
+  } catch (e) {
+    setApiKey(token);
+    setDefaultOrg(orgId);
+    spinner.warn(
+      chalk2.yellow(`Logged in with a temporary session (key creation failed: ${e?.message}).`)
+    );
+  }
+}
+async function browserLogin(consoleOrigin) {
+  const state = randomState();
+  const server = await createCallbackServer(state, void 0, consoleOrigin);
+  const url = `${consoleOrigin}/cli-auth?port=${server.port}&state=${state}`;
+  console.log("Opening your browser to sign in (password, Google or SSO all work):");
+  console.log(chalk2.cyan(`  ${url}`));
+  console.log(chalk2.gray("  Waiting for the browser\u2026 (Ctrl-C to cancel)"));
+  openBrowser(url);
+  return server.waitForToken;
+}
+async function passwordLogin(spinner, baseUrl, email, password) {
   let login;
   try {
     const response = await fetch(`${baseUrl}/auth/login`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ email: answers.email, password: answers.password })
+      body: JSON.stringify({ email, password })
     });
     if (!response.ok) {
       if (response.status === 401) {
@@ -965,69 +1114,59 @@ var loginCommand = new Command("login").description("Log in to Cloud").option("-
     process.exit(1);
   }
   if (login.requires_2fa) {
-    token = await completeTwoFactor(spinner, baseUrl, login);
-  } else {
-    token = login.token;
+    return completeTwoFactor(spinner, baseUrl, login);
   }
-  const session = new CloudClient({ apiKey: token, baseUrl });
-  let orgId;
-  try {
-    const orgs = await session.orgs.list();
-    if (opts.org) {
-      const match = orgs.find((o) => o.id === opts.org || o.name === opts.org);
-      if (!match) {
-        spinner.fail(`No organization ${opts.org} for this account.`);
-        process.exit(1);
-      }
-      orgId = match.id;
-    } else if (orgs.length > 1 && !process.stdin.isTTY) {
-      spinner.fail(
-        `Several organizations (${orgs.map((o) => o.id).join(", ")}). Pass --org <id>.`
-      );
+  return login.token;
+}
+var loginCommand = new Command("login").description("Log in to Cloud (opens your browser; --email/--password for the prompt flow)").option("-e, --email <email>", "Email \u2014 switches to the email/password flow").option("-p, --password <password>", "Password (skips the prompt; prefer VIDEAN_PASSWORD)").option("-o, --org <id>", "Organization to scope the key to (skips the picker)").option("-k, --key <api-key>", "Use an existing API key instead of signing in").option("--no-browser", "Never open a browser; prompt for email and password").option("--api-url <url>", "API base URL to use and remember (default: the public API)").action(async (opts) => {
+  if (opts.apiUrl) setBaseUrl(opts.apiUrl.replace(/\/$/, ""));
+  const baseUrl = (getBaseUrl() || DEFAULT_API_URL2).replace(/\/$/, "");
+  if (opts.key) {
+    const spinner2 = ora("Checking the key...").start();
+    const session = new CloudClient({ apiKey: opts.key, baseUrl });
+    const orgId = await pickOrg(spinner2, session, opts.org, "Saving...");
+    setApiKey(opts.key);
+    if (orgId) setDefaultOrg(orgId);
+    spinner2.succeed(chalk2.green("Logged in with the provided key."));
+    if (orgId) console.log(chalk2.gray(`  Org:  ${orgId}`));
+    return;
+  }
+  const password = opts.password || process.env.VIDEAN_PASSWORD || process.env.CLOUD_PASSWORD;
+  const wantsPasswordFlow = Boolean(opts.email || password || opts.browser === false);
+  const consoleOrigin = consoleOriginFor(baseUrl);
+  if (!wantsPasswordFlow && process.stdin.isTTY && consoleOrigin) {
+    let token2;
+    try {
+      token2 = await browserLogin(consoleOrigin);
+    } catch (e) {
+      console.error(chalk2.red(`Browser sign-in failed: ${e?.message || e}`));
+      console.error(chalk2.gray("  For the prompt flow instead: videan login --no-browser"));
       process.exit(1);
-    } else if (orgs.length > 1) {
-      spinner.stop();
-      const pick = await inquirer2.prompt([
-        {
-          type: "list",
-          name: "orgId",
-          message: "Organization:",
-          choices: orgs.map((o) => ({ name: `${o.name} (${o.id})`, value: o.id }))
-        }
-      ]);
-      orgId = pick.orgId;
-      spinner.start("Creating CLI key...");
-    } else {
-      orgId = orgs[0]?.id;
     }
-  } catch (e) {
-    spinner.fail(`Logged in, but could not list organizations: ${e?.message}`);
-    process.exit(1);
-  }
-  if (!orgId) {
-    setApiKey(token);
-    spinner.warn(
-      chalk2.yellow("Logged in, but you have no organization yet. Run `videan orgs create <name>`.")
-    );
+    const spinner2 = ora("Finishing up...").start();
+    await finishWithToken(spinner2, baseUrl, token2, opts.org);
     return;
   }
-  try {
-    const key = await session.apiKeys.create({
-      name: `cli@${os.hostname()}`,
-      orgId
-    });
-    setApiKey(key.key);
-    setDefaultOrg(orgId);
-    spinner.succeed(chalk2.green("Logged in."));
-    console.log(chalk2.gray(`  Org:  ${orgId}`));
-    console.log(chalk2.gray(`  Key:  ${key.keyPrefix}\u2026 (revoke with \`videan keys revoke ${key.id}\`)`));
-  } catch (e) {
-    setApiKey(token);
-    setDefaultOrg(orgId);
-    spinner.warn(
-      chalk2.yellow(`Logged in with a temporary session (key creation failed: ${e?.message}).`)
+  if ((!opts.email || !password) && !process.stdin.isTTY) {
+    console.error(
+      chalk2.red(
+        "login needs a terminal to prompt. Non-interactively, pass --email and --password (or VIDEAN_PASSWORD), pass --key <api-key>, or skip login entirely by setting VIDEAN_API_KEY."
+      )
     );
+    process.exit(1);
   }
+  const prompts = [
+    ...opts.email ? [] : [{ type: "input", name: "email", message: "Email:" }],
+    ...password ? [] : [{ type: "password", name: "password", message: "Password:" }]
+  ];
+  const answers = {
+    email: opts.email,
+    password,
+    ...prompts.length ? await inquirer2.prompt(prompts) : {}
+  };
+  const spinner = ora("Logging in...").start();
+  const token = await passwordLogin(spinner, baseUrl, answers.email, answers.password);
+  await finishWithToken(spinner, baseUrl, token, opts.org);
 });
 
 // src/commands/logout.ts
@@ -2388,7 +2527,7 @@ function period(start, end) {
 // src/index.ts
 installPromptCrashGuard();
 var program = new Command18();
-program.name("videan").description("Videan CLI \u2014 deploy apps in seconds").version("0.4.3");
+program.name("videan").description("Videan CLI \u2014 deploy apps in seconds").version("0.5.1");
 program.addCommand(loginCommand);
 program.addCommand(logoutCommand);
 program.addCommand(initCommand);