@volter/supercode-teams 0.2.20

package/bin/workspace/volter-login.mjs

@@ -0,0 +1,185 @@
+// `supercode teams login` with Volter and no --team: signing in is never refused for being on several teams. The
+// person signs in once; the teams server says which teams that identity may use; the person chooses which of them
+// this computer signs into (in the browser tab they signed in from, else at the terminal), and each becomes a
+// workspace context. Commands act on the current context; `supercode teams context use NAME` switches it.
+import { hostname } from 'node:os';
+import { createInterface } from 'node:readline/promises';
+import { WorkspaceContexts, contextNameOf, loginContext } from '../../context.mjs';
+import { TeamsClient } from '../../workspace-client.mjs';
+
+/** The teams an identity may sign in to: `[{ id, name, role, joined }]`, or null from a server that cannot say. */
+export async function teamsForIdentity({ origin, identityToken, fetch = globalThis.fetch }) {
+  const response = await fetch(new URL('/api/v1/login/volter/teams', origin), { method: 'POST', redirect: 'manual', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ access_token: identityToken }) });
+  // A server from before the listing answers 404, or 401 since its other routes all need a credential. A token that
+  // does not verify fails again, saying so, at the sign-in that follows.
+  if (response.status === 404 || response.status === 401) return null;
+  if (response.type === 'opaqueredirect' || (response.status >= 300 && response.status < 400)) throw new Error('cross-origin redirects are refused');
+  const value = await response.json().catch(() => null);
+  if (!response.ok) throw new Error(`sign-in failed: ${value?.error?.message ?? `HTTP ${response.status}`}`);
+  return value.teams;
+}
+
+/**
+ * Sign this computer into the teams the person chooses. Returns `{ result: { saved, current, failed }, page }`:
+ * the contexts made, the current context, the teams that could not be signed into, and the page the tab ends on.
+ */
+export async function signInToTeams({ supercodeHome, origin, identityToken, ask, as = null, fetch = globalThis.fetch, input = process.stdin, prompt = process.stderr }) {
+  const store = new WorkspaceContexts(supercodeHome), before = store.read().current;
+  const login = (teamId, name) => loginContext({ supercodeHome, name, origin, teamId, token: null, invite: null, identityToken, as, fetch });
+  let teams = await teamsForIdentity({ origin, identityToken, fetch });
+  if (teams === null) {
+    // A server from before the listing signs a person on one team straight in and names several in its refusal,
+    // without saying which of them they are a member of.
+    try {
+      return finished(store, before, [await login(null, as)], []);
+    } catch (error) {
+      const several = /you belong to several teams \((.+)\); name one with --team/u.exec(error.message);
+      if (!several) throw error;
+      teams = several[1].split(', ').map((name) => ({ id: name, name, role: null, joined: null }));
+    }
+  }
+  if (!teams.length) throw new Error('you are not a member of a team on this server; ask a teammate for an invitation');
+  if (teams.length > 1 && as) throw new Error('--as names one team\'s context; add --team to choose which');
+  const chosen = teams.length === 1 ? [teams[0]] : await choose(teams, { ask, input, prompt, store, origin });
+  const nameFor = (team) => as ?? freeName(store, contextNameOf(team.name), origin, team.id);
+  // One sign-in, one credential: it is the person's on every team they are a member of, so the other teams' contexts
+  // share it. A team they join through their organization is signed into on its own, which joins it.
+  const first = await login(chosen[0].id, nameFor(chosen[0])), saved = [first], failed = [];
+  if (chosen.length > 1) {
+    let me;
+    try {
+      me = await new TeamsClient({ server: first.origin, credential: store.credential(first.credential_ref).token, fetch }).me();
+    } catch (error) {
+      for (const team of chosen.slice(1)) failed.push({ team: team.name, reason: error.message });
+      return finished(store, before, saved, failed);
+    }
+    for (const team of chosen.slice(1)) {
+      const membership = me.teams.find((item) => item.team.id === team.id || item.team.name === team.id);
+      try {
+        saved.push(membership
+          ? store.upsert(freeName(store, contextNameOf(membership.team.name), origin, membership.team.id), { origin: first.origin, server_id: first.server_id, team_id: membership.team.id, team_name: membership.team.name, principal_id: first.principal_id, credential_ref: first.credential_ref, label: null })
+          : await login(team.id, nameFor(team)));
+      } catch (error) {
+        failed.push({ team: team.name, reason: error.message });
+      }
+    }
+  }
+  return finished(store, before, saved, failed);
+}
+
+/**
+ * A context name for a team: its own, unless another server's or another team's context holds it, then the first
+ * free `-2`, `-3`… (two teams named "Acme Inc" and "acme-inc" are two contexts).
+ */
+function freeName(store, base, origin, teamId) {
+  const contexts = store.read().contexts;
+  for (let index = 1; ; index += 1) {
+    const name = index === 1 ? base : `${base.slice(0, 60)}-${index}`;
+    const held = contexts[name];
+    // Against an older server a team is known by its name until it is signed into.
+    if (!held || (held.origin === origin && (held.team_id === teamId || held.team_name === teamId))) return name;
+  }
+}
+
+/**
+ * What the sign-in did. The current context changes only when there was none, as a single login's does, or when it
+ * named a context that no longer exists (`local` is never a stored context, and stays).
+ */
+function finished(store, before, saved, failed) {
+  const contexts = store.read().contexts;
+  const named = saved.map((context) => ({ ...context, name: Object.entries(contexts).find(([, value]) => value.credential_ref === context.credential_ref && value.team_id === context.team_id)[0] }));
+  if (!before || (before !== 'local' && !contexts[before])) store.use(named[0].name);
+  const current = store.read().current, ours = named.find((context) => context.name === current);
+  const teamName = (context) => context.team_name ?? context.team_id;
+  const lede = [
+    `supercode on ${hostname()} can use ${list(named.map(teamName))}.`,
+    ...failed.map(({ team, reason }) => `${team} was not signed in: ${reason}.`),
+    `Back in the terminal, run supercode teams connect to put this computer on ${ours ? teamName(ours) : 'a team'}.`,
+  ].join(' ');
+  return {
+    result: { saved: named, current, failed },
+    page: {
+      ok: true,
+      title: "You're signed in",
+      lede,
+      items: named.map((context) => ({ label: teamName(context), detail: context.name === current ? 'commands use this team' : `switch with: supercode teams context use ${context.name}` })),
+    },
+  };
+}
+
+/** What the terminal says after a login that did not name its team. */
+export function loginSummary({ saved, current, failed }, origin) {
+  const teamName = (context) => context.team_name ?? context.team_id, ours = saved.find((context) => context.name === current);
+  const lines = [`Signed in to ${saved.length === 1 ? `team ${teamName(saved[0])}` : `${saved.length} teams: ${saved.map(teamName).join(', ')}`} (${new URL(origin).host}).`];
+  for (const { team, reason } of failed) lines.push(`Not signed in to ${team}: ${reason}`);
+  const other = saved.find((context) => context.name !== current);
+  if (!ours) lines.push(`Commands still use the context ${current}; switch with: supercode teams context use ${saved[0].name}`);
+  else if (other) lines.push(`Commands use ${teamName(ours)}; switch with: supercode teams context use ${other.name}`);
+  lines.push('Next, from the folder you work in: supercode teams connect');
+  return `${lines.join('\n')}\n`;
+}
+
+const list = (names) => names.length < 2 ? names.join('') : `${names.slice(0, -1).join(', ')} and ${names.at(-1)}`;
+
+function roleOf(team) {
+  if (team.joined === false) return 'you join through your organization';
+  return team.role ?? undefined;
+}
+
+/**
+ * Which teams to sign into: asked in the browser tab when there is one, and at the terminal as well when it is one
+ * (whichever answers first, so a closed tab does not leave the login waiting); with nobody to ask, every team the
+ * person is a member of, never joining one for them.
+ */
+async function choose(teams, { ask, input, prompt, store, origin }) {
+  const already = new Set(Object.values(store.read().contexts).filter((context) => context.origin === origin).map((context) => context.team_id));
+  const preselected = (team) => team.joined !== false && (already.size === 0 || already.has(team.id));
+  const terminal = Boolean(input.isTTY && prompt.isTTY);
+  if (!ask && !terminal) {
+    const joined = teams.filter((team) => team.joined === true);
+    if (!joined.length) throw new Error(`you may sign in to several teams (${teams.map((team) => team.name).join(', ')}); name one with --team`);
+    return joined;
+  }
+  const stop = new AbortController(), answers = [];
+  if (ask) {
+    prompt.write(terminal ? 'Choose your teams in the browser tab, or here.\n' : 'Choose your teams in the browser tab.\n');
+    const asked = ask({
+      title: 'Choose your teams',
+      lede: `You belong to ${teams.length} teams. Sign in to the ones you work in on this computer; you can add the others later.`,
+      options: teams.map((team) => ({ id: team.id, label: team.name, detail: roleOf(team), checked: preselected(team) })),
+      submit: 'Sign in on this computer',
+    });
+    // Answered at the terminal first, the tab's question is abandoned when the sign-in ends.
+    asked.catch(() => {});
+    answers.push(asked.then((ids) => teams.filter((team) => ids.includes(team.id))));
+  }
+  if (terminal) answers.push(askTerminal(teams, { input, prompt, preselected, signal: stop.signal }));
+  try {
+    return await Promise.race(answers);
+  } finally {
+    stop.abort();
+  }
+}
+
+/** The terminal's question; once `signal` aborts (the tab answered), it never settles. */
+async function askTerminal(teams, { input, prompt, preselected, signal }) {
+  prompt.write(`You belong to ${teams.length} teams:\n`);
+  teams.forEach((team, index) => prompt.write(`  ${index + 1}. ${team.name}${roleOf(team) ? ` (${roleOf(team)})` : ''}\n`));
+  const defaults = teams.map((team, index) => preselected(team) ? index + 1 : null).filter(Boolean);
+  const shown = defaults.length ? defaults.join(',') : '1';
+  const reader = createInterface({ input, output: prompt });
+  try {
+    for (;;) {
+      const answer = (await reader.question(`Sign in to which? (numbers like 1,2, or "all") [${shown}] `, { signal })).trim().toLowerCase();
+      const picked = answer === 'all' ? teams.map((_, index) => index + 1) : (answer || shown).split(/[\s,]+/u).filter(Boolean).map(Number);
+      if (picked.length && picked.every((number) => Number.isInteger(number) && number >= 1 && number <= teams.length)) return [...new Set(picked)].map((number) => teams[number - 1]);
+      prompt.write(`Answer with numbers from 1 to ${teams.length}.\n`);
+    }
+  } catch (error) {
+    if (signal.aborted) return new Promise(() => {});
+    throw error;
+  } finally {
+    reader.close();
+    if (signal.aborted) prompt.write('\n');
+  }
+}