@wilm-ai/wilma-cli 1.2.0 → 1.3.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Wilm.ai
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/index.js

@@ -1,10 +1,11 @@
 #!/usr/bin/env node
 import { emitKeypressEvents } from "node:readline";
 import { select, input, password } from "@inquirer/prompts";
+import { createHmac } from "node:crypto";
 import { readFile, writeFile, mkdir } from "node:fs/promises";
 import { spawn } from "node:child_process";
 import { dirname, resolve } from "node:path";
-import { WilmaClient, listTenants, } from "@wilm-ai/wilma-client";
+import { WilmaClient, MfaRequiredError, listTenants, } from "@wilm-ai/wilma-client";
 import { clearConfig, getConfigPath, loadConfig, obfuscateSecret, revealSecret, saveConfig, } from "./config.js";
 // Enable keypress events for escape key detection
 if (process.stdin.isTTY) {
@@ -142,7 +143,8 @@ async function runInteractive(config) {
         if (!profile) {
             return;
         }
-        const client = await WilmaClient.login(profile);
+        const interactiveMfa = createInteractiveMfaCallback();
+        const client = await WilmaClient.login(profile, interactiveMfa);
         let nextAction = await selectOrCancel({
             message: "What do you want to view?",
             pageSize: 15,
@@ -377,7 +379,8 @@ async function handleCommand(args, config) {
     const profile = await getProfileForCommandNonInteractive(config, flags);
     if (!profile)
         return;
-    const client = await WilmaClient.login(profile);
+    const mfaCallback = createNonInteractiveMfaCallback(flags.totpSecret);
+    const client = await WilmaClient.login(profile, mfaCallback);
     if (command === "kids") {
         const students = await getStudentsForCommand(profile, config);
         if (flags.json) {
@@ -409,12 +412,12 @@ async function handleCommand(args, config) {
             const perStudentClient = await WilmaClient.login({
                 ...profile,
                 studentNumber: studentInfo?.studentNumber ?? profile.studentNumber,
-            });
+            }, mfaCallback);
             await outputNewsItem(perStudentClient, newsId, flags.json);
             return;
         }
         if (flags.allStudents) {
-            await outputAllNews(profile, config, flags.limit ?? 20, flags.json);
+            await outputAllNews(profile, config, flags.limit ?? 20, flags.json, mfaCallback);
             return;
         }
         const studentInfo = await resolveStudentForFlags(profile, config, flags.student);
@@ -425,7 +428,7 @@ async function handleCommand(args, config) {
         const perStudentClient = await WilmaClient.login({
             ...profile,
             studentNumber: studentInfo?.studentNumber ?? profile.studentNumber,
-        });
+        }, mfaCallback);
         await outputNews(perStudentClient, {
             limit: flags.limit ?? 20,
             json: flags.json,
@@ -452,7 +455,7 @@ async function handleCommand(args, config) {
             const perStudentClient = await WilmaClient.login({
                 ...profile,
                 studentNumber: studentInfo?.studentNumber ?? profile.studentNumber,
-            });
+            }, mfaCallback);
             await outputMessageItem(perStudentClient, messageId, flags.json);
             return;
         }
@@ -461,7 +464,7 @@ async function handleCommand(args, config) {
                 folder: flags.folder ?? "inbox",
                 limit: flags.limit ?? 20,
                 json: flags.json,
-            });
+            }, mfaCallback);
             return;
         }
         const studentInfo = await resolveStudentForFlags(profile, config, flags.student);
@@ -472,7 +475,7 @@ async function handleCommand(args, config) {
         const perStudentClient = await WilmaClient.login({
             ...profile,
             studentNumber: studentInfo?.studentNumber ?? profile.studentNumber,
-        });
+        }, mfaCallback);
         await outputMessages(perStudentClient, {
             folder: flags.folder ?? "inbox",
             limit: flags.limit ?? 20,
@@ -483,7 +486,7 @@ async function handleCommand(args, config) {
     }
     if (command === "exams") {
         if (flags.allStudents) {
-            await outputAllExams(profile, config, flags.limit ?? 20, flags.json);
+            await outputAllExams(profile, config, flags.limit ?? 20, flags.json, mfaCallback);
             return;
         }
         const studentInfo = await resolveStudentForFlags(profile, config, flags.student);
@@ -494,7 +497,7 @@ async function handleCommand(args, config) {
         const perStudentClient = await WilmaClient.login({
             ...profile,
             studentNumber: studentInfo?.studentNumber ?? profile.studentNumber,
-        });
+        }, mfaCallback);
         await outputUpcomingExams(perStudentClient, {
             limit: flags.limit ?? 20,
             json: flags.json,
@@ -504,7 +507,7 @@ async function handleCommand(args, config) {
     }
     if (command === "schedule") {
         if (flags.allStudents) {
-            await outputAllOverviewCommand(profile, config, "schedule", flags);
+            await outputAllOverviewCommand(profile, config, "schedule", flags, mfaCallback);
             return;
         }
         const studentInfo = await resolveStudentForFlags(profile, config, flags.student);
@@ -515,7 +518,7 @@ async function handleCommand(args, config) {
         const perStudentClient = await WilmaClient.login({
             ...profile,
             studentNumber: studentInfo?.studentNumber ?? profile.studentNumber,
-        });
+        }, mfaCallback);
         await outputSchedule(perStudentClient, {
             when: flags.when ?? "week",
             date: flags.date,
@@ -527,7 +530,7 @@ async function handleCommand(args, config) {
     }
     if (command === "homework") {
         if (flags.allStudents) {
-            await outputAllOverviewCommand(profile, config, "homework", flags);
+            await outputAllOverviewCommand(profile, config, "homework", flags, mfaCallback);
             return;
         }
         const studentInfo = await resolveStudentForFlags(profile, config, flags.student);
@@ -538,7 +541,7 @@ async function handleCommand(args, config) {
         const perStudentClient = await WilmaClient.login({
             ...profile,
             studentNumber: studentInfo?.studentNumber ?? profile.studentNumber,
-        });
+        }, mfaCallback);
         await outputHomework(perStudentClient, {
             limit: flags.limit ?? 10,
             json: flags.json,
@@ -548,7 +551,7 @@ async function handleCommand(args, config) {
     }
     if (command === "grades") {
         if (flags.allStudents) {
-            await outputAllOverviewCommand(profile, config, "grades", flags);
+            await outputAllOverviewCommand(profile, config, "grades", flags, mfaCallback);
             return;
         }
         const studentInfo = await resolveStudentForFlags(profile, config, flags.student);
@@ -559,7 +562,7 @@ async function handleCommand(args, config) {
         const perStudentClient = await WilmaClient.login({
             ...profile,
             studentNumber: studentInfo?.studentNumber ?? profile.studentNumber,
-        });
+        }, mfaCallback);
         await outputGrades(perStudentClient, {
             limit: flags.limit ?? 20,
             json: flags.json,
@@ -569,7 +572,7 @@ async function handleCommand(args, config) {
     }
     if (command === "summary") {
         if (flags.allStudents) {
-            await outputAllOverviewCommand(profile, config, "summary", flags);
+            await outputAllOverviewCommand(profile, config, "summary", flags, mfaCallback);
             return;
         }
         const studentInfo = await resolveStudentForFlags(profile, config, flags.student);
@@ -580,7 +583,7 @@ async function handleCommand(args, config) {
         const perStudentClient = await WilmaClient.login({
             ...profile,
             studentNumber: studentInfo?.studentNumber ?? profile.studentNumber,
-        });
+        }, mfaCallback);
         await outputSummary(perStudentClient, {
             days: flags.days ?? 7,
             json: flags.json,
@@ -606,6 +609,8 @@ function printUsage() {
     console.log("  wilma config clear");
     console.log("  wilma --help | -h");
     console.log("  wilma --version | -v");
+    console.log("");
+    console.log("MFA: --totp-secret <base32-key|otpauth://...>");
 }
 async function getProfileForCommandNonInteractive(config, flags) {
     if (!config.lastProfileId) {
@@ -695,6 +700,11 @@ function parseArgs(args) {
             i += 2;
             continue;
         }
+        if (arg === "--totp-secret") {
+            flags.totpSecret = rest[i + 1];
+            i += 2;
+            continue;
+        }
         if (!flags.id && !arg.startsWith("--")) {
             flags.id = arg;
             i += 1;
@@ -1269,6 +1279,68 @@ async function selectOrCancel(opts, clearScreen = true) {
         process.stdin.removeListener("keypress", onKeypress);
     }
 }
+function createInteractiveMfaCallback() {
+    return async (_formkey) => {
+        const code = await input({ message: "Enter MFA code from authenticator app" });
+        if (!code) {
+            throw new Error("MFA cancelled");
+        }
+        return code.trim();
+    };
+}
+function createNonInteractiveMfaCallback(totpSecret) {
+    if (!totpSecret)
+        return undefined;
+    const secret = parseTotpSecret(totpSecret);
+    return async (_formkey) => {
+        const code = generateTOTP(secret);
+        return code;
+    };
+}
+function parseTotpSecret(raw) {
+    // Accept either a bare base32 key or an otpauth:// URI
+    if (raw.startsWith("otpauth://")) {
+        const url = new URL(raw);
+        const secret = url.searchParams.get("secret");
+        if (!secret) {
+            console.error("No 'secret' parameter found in otpauth:// URI.");
+            process.exit(1);
+        }
+        return secret;
+    }
+    return raw.replace(/[\s-]/g, "");
+}
+function generateTOTP(secret) {
+    // TOTP: RFC 6238 — HMAC-SHA1 based, 6-digit, 30-second period
+    const base32Chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+    // Decode base32 secret
+    const cleanSecret = secret.replace(/[\s=-]+/g, "").toUpperCase();
+    let bits = "";
+    for (const c of cleanSecret) {
+        const val = base32Chars.indexOf(c);
+        if (val === -1)
+            throw new Error(`Invalid base32 character: ${c}`);
+        bits += val.toString(2).padStart(5, "0");
+    }
+    const bytes = new Uint8Array(Math.floor(bits.length / 8));
+    for (let i = 0; i < bytes.length; i++) {
+        bytes[i] = parseInt(bits.slice(i * 8, i * 8 + 8), 2);
+    }
+    const epoch = Math.floor(Date.now() / 1000);
+    const counter = Math.floor(epoch / 30);
+    const counterBuf = Buffer.alloc(8);
+    counterBuf.writeUInt32BE(Math.floor(counter / 0x100000000), 0);
+    counterBuf.writeUInt32BE(counter >>> 0, 4);
+    const hmac = createHmac("sha1", Buffer.from(bytes));
+    hmac.update(counterBuf);
+    const hash = hmac.digest();
+    const offset = hash[hash.length - 1] & 0x0f;
+    const code = ((hash[offset] & 0x7f) << 24) |
+        ((hash[offset + 1] & 0xff) << 16) |
+        ((hash[offset + 2] & 0xff) << 8) |
+        (hash[offset + 3] & 0xff);
+    return (code % 1000000).toString().padStart(6, "0");
+}
 async function inputOrCancel(opts) {
     console.clear();
     const prompt = input(opts, { clearPromptOnDone: true });
@@ -1384,11 +1456,11 @@ async function resolveStudentForFlags(profile, config, student) {
     const students = await getStudentsForCommand(profile, config);
     return students[0] ?? null;
 }
-async function outputAllNews(profile, config, limit, json) {
+async function outputAllNews(profile, config, limit, json, onMfa) {
     const students = await getStudentsForCommand(profile, config);
     const results = [];
     for (const student of students) {
-        const client = await WilmaClient.login({ ...profile, studentNumber: student.studentNumber });
+        const client = await WilmaClient.login({ ...profile, studentNumber: student.studentNumber }, onMfa);
         const news = await client.news.list();
         results.push({ student, items: news.slice(0, limit) });
     }
@@ -1404,11 +1476,11 @@ async function outputAllNews(profile, config, limit, json) {
         });
     });
 }
-async function outputAllMessages(profile, config, opts) {
+async function outputAllMessages(profile, config, opts, onMfa) {
     const students = await getStudentsForCommand(profile, config);
     const results = [];
     for (const student of students) {
-        const client = await WilmaClient.login({ ...profile, studentNumber: student.studentNumber });
+        const client = await WilmaClient.login({ ...profile, studentNumber: student.studentNumber }, onMfa);
         const messages = await client.messages.list(opts.folder);
         results.push({ student, items: messages.slice(0, opts.limit) });
     }
@@ -1424,11 +1496,11 @@ async function outputAllMessages(profile, config, opts) {
         });
     });
 }
-async function outputAllExams(profile, config, limit, json) {
+async function outputAllExams(profile, config, limit, json, onMfa) {
     const students = await getStudentsForCommand(profile, config);
     const results = [];
     for (const student of students) {
-        const client = await WilmaClient.login({ ...profile, studentNumber: student.studentNumber });
+        const client = await WilmaClient.login({ ...profile, studentNumber: student.studentNumber }, onMfa);
         const overview = await client.overview.get();
         results.push({ student, items: overview.upcomingExams.slice(0, limit) });
     }
@@ -1444,13 +1516,13 @@ async function outputAllExams(profile, config, limit, json) {
         });
     });
 }
-async function outputAllOverviewCommand(profile, config, command, flags) {
+async function outputAllOverviewCommand(profile, config, command, flags, onMfa) {
     const students = await getStudentsForCommand(profile, config);
     if (command === "summary") {
         if (flags.json) {
             const summaries = [];
             for (const student of students) {
-                const client = await WilmaClient.login({ ...profile, studentNumber: student.studentNumber });
+                const client = await WilmaClient.login({ ...profile, studentNumber: student.studentNumber }, onMfa);
                 const [overview, news, messages] = await Promise.all([
                     client.overview.get(),
                     client.news.list(),
@@ -1469,7 +1541,7 @@ async function outputAllOverviewCommand(profile, config, command, flags) {
         }
         // Human-readable summary output per student
         for (const student of students) {
-            const client = await WilmaClient.login({ ...profile, studentNumber: student.studentNumber });
+            const client = await WilmaClient.login({ ...profile, studentNumber: student.studentNumber }, onMfa);
             await outputSummary(client, {
                 days: flags.days ?? 7,
                 json: false,
@@ -1480,7 +1552,7 @@ async function outputAllOverviewCommand(profile, config, command, flags) {
     }
     const results = [];
     for (const student of students) {
-        const client = await WilmaClient.login({ ...profile, studentNumber: student.studentNumber });
+        const client = await WilmaClient.login({ ...profile, studentNumber: student.studentNumber }, onMfa);
         const overview = await client.overview.get();
         if (command === "schedule") {
             const when = flags.when || "week";
@@ -1545,6 +1617,15 @@ main().catch((err) => {
     if (isPromptCancel(err)) {
         process.exit(0);
     }
+    if (err instanceof MfaRequiredError) {
+        console.error("MFA is enabled on this Wilma account.");
+        console.error("For non-interactive use, provide your TOTP secret:");
+        console.error("  --totp-secret <base32-key>");
+        console.error("  --totp-secret 'otpauth://totp/...'");
+        console.error("Tip: export the key from your authenticator app (base32 string or otpauth:// URI).");
+        console.error("For interactive use, run 'wilma' without arguments.");
+        process.exit(1);
+    }
     console.error("CLI error:", err instanceof Error ? err.message : err);
     process.exit(1);
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wilm-ai/wilma-cli",
-  "version": "1.2.0",
+  "version": "1.3.1",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -8,17 +8,9 @@
     "wilmai": "dist/index.js",
     "wilma": "dist/index.js"
   },
-  "scripts": {
-    "build": "tsc -p tsconfig.json",
-    "lint": "echo 'add lint'",
-    "test": "echo 'add tests'",
-    "start": "node dist/index.js",
-    "prepack": "pnpm --filter @wilm-ai/wilma-client build && pnpm --filter @wilm-ai/wilma-cli build",
-    "test:live": "tsc -p tsconfig.json && node test/live.spec.mjs"
-  },
   "dependencies": {
     "@inquirer/prompts": "^5.3.8",
-    "@wilm-ai/wilma-client": "workspace:^"
+    "@wilm-ai/wilma-client": "^1.2.1"
   },
   "devDependencies": {
     "typescript": "^5.6.3"
@@ -29,5 +21,12 @@
   ],
   "publishConfig": {
     "access": "public"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "lint": "echo 'add lint'",
+    "test": "echo 'add tests'",
+    "start": "node dist/index.js",
+    "test:live": "tsc -p tsconfig.json && node test/live.spec.mjs"
   }
-}
+}