@ycadence/cli 0.2.1 → 0.3.0

package/README.md

@@ -30,7 +30,27 @@ npm install -g @yarlisaisolutions/ycadence-cli
 The package installs two commands that behave the same: `ycadence`, and `devpulse`,
 the name from before the rename.
 
-## Configure
+## Sign in
+
+**Behind Google IAP** (the Yarlis instances): open the web app, go to **Settings →
+Account → Command line**, click **Copy command**, and run it. It looks like this:
+
+```sh
+ycadence login --setup ycs1.…
+```
+
+It prints a code and a google.com/device link. Approve it with your work account and the
+CLI finishes by itself: the instance issues this machine a personal token, and everything
+secret goes into your OS keychain. Then:
+
+```sh
+ycadence doctor
+```
+
+The full walkthrough, troubleshooting and the admin setup are in
+[docs/cli/getting-started.md](https://github.com/YarlisAISolutions/dev-pulse/blob/main/docs/cli/getting-started.md).
+
+**Anywhere else**, sign in with a personal token from **Settings → Account → API tokens**:
 
 ```sh
 ycadence login --url https://ycadence.example.com --api-key-stdin < key.txt
@@ -41,8 +61,7 @@ ycadence doctor                              # checks configuration and connecti
 Profiles live in `~/.config/ycadence/config.json` (`$XDG_CONFIG_HOME` aware); switch with
 `--profile <name>` or `ycadence config use <name>`. The API key is kept in the OS keychain
 (macOS Keychain, or the Secret Service through `secret-tool`), else in a `credentials.json`
-with mode 0600. For an instance behind Google IAP, `ycadence login --oauth-client-id …
---iap-audience …` signs in with Google and refreshes the identity token itself.
+with mode 0600.
 
 Environment variables still win, so CI needs nothing else:
 

package/dist/bin.js

@@ -535,6 +535,7 @@ var PROFILE_KEYS = [
   "project",
   "format",
   "oauthClientId",
+  "oauthFlow",
   "iapAudience"
 ];
 var PROFILE_KEY_HELP = {
@@ -543,6 +544,7 @@ var PROFILE_KEY_HELP = {
   project: "Default project id (or identifier, once the server lists projects)",
   format: "Default output format: table, json or ndjson",
   oauthClientId: "Desktop OAuth client id used by `ycadence login` for IAP",
+  oauthFlow: "How `ycadence login` signs in to Google: device or loopback",
   iapAudience: "The IAP OAuth client id; the audience of the identity token"
 };
 function configDirectory(env) {
@@ -1859,6 +1861,40 @@ function completionScript(root, shell) {
   return fish(root);
 }
 
+// src/handlers/auth.ts
+import { hostname } from "node:os";
+
+// ../core/src/cli-setup.ts
+var SETUP_CODE_PREFIX = "ycs1.";
+function decodeSetupCode(code) {
+  const trimmed = code.trim();
+  if (!trimmed.startsWith(SETUP_CODE_PREFIX))
+    return null;
+  let parsed;
+  try {
+    parsed = JSON.parse(Buffer.from(trimmed.slice(SETUP_CODE_PREFIX.length), "base64url").toString("utf8"));
+  } catch {
+    return null;
+  }
+  if (typeof parsed !== "object" || parsed === null)
+    return null;
+  const { u, c, s, f } = parsed;
+  if (typeof u !== "string" || typeof c !== "string" || typeof s !== "string")
+    return null;
+  if (f !== "device" && f !== "loopback")
+    return null;
+  try {
+    const url = new URL(u);
+    if (url.protocol !== "https:" && url.hostname !== "localhost")
+      return null;
+  } catch {
+    return null;
+  }
+  if (c === "" || s === "")
+    return null;
+  return { url: u.replace(/\/+$/, ""), oauthClientId: c, oauthClientSecret: s, flow: f };
+}
+
 // src/handlers/auth.ts
 function str(value) {
   return typeof value === "string" ? value : undefined;
@@ -1869,11 +1905,44 @@ function keyHint(key) {
 async function storedKey(context) {
   return readEnv("API_KEY", context.env) ?? await context.secrets.get(secretAccount.apiKey(context.config.profile));
 }
+async function requestCliToken(context, url, idToken) {
+  let response;
+  try {
+    response = await context.fetch(`${url}/api/auth/iap/cli-token`, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${idToken}`,
+        "Content-Type": "application/json",
+        Accept: "application/json"
+      },
+      body: JSON.stringify({ organization: context.config.org, host: hostname() })
+    });
+  } catch (error) {
+    throw new CliError(`Could not reach ${new URL(url).host}: ${error instanceof Error ? error.message : "error"}`, "network_error", EXIT.tempfail);
+  }
+  if (response.status === 404)
+    return null;
+  const body = await response.json().catch(() => ({}));
+  if (!response.ok || body.token === undefined || body.organization === undefined) {
+    throw new CliError(`Signed in, but no token was issued: ${body.error ?? `HTTP ${response.status}`}`, body.code ?? "token_refused");
+  }
+  return { token: body.token, organization: body.organization };
+}
 var loginHandler = async (context) => {
   const profile = context.config.profile;
   assertProfileName(profile);
   const file = await context.configStore.load();
   const stored = { ...file.profiles[profile] ?? {} };
+  const setupFlag = str(context.flags.setup);
+  const setup = setupFlag === undefined ? undefined : decodeSetupCode(setupFlag);
+  if (setup === null) {
+    throw new UsageError("That setup code could not be read. Copy the command again from Settings → Account → Command line.");
+  }
+  if (setup !== undefined) {
+    stored.url = setup.url;
+    stored.oauthClientId = setup.oauthClientId;
+    stored.oauthFlow = setup.flow;
+  }
   const url = str(context.flags.url);
   if (url !== undefined) {
     try {
@@ -1907,12 +1976,12 @@ var loginHandler = async (context) => {
   } else if (clientId === undefined) {
     context.notice("No OAuth client is configured, so the IAP sign-in is skipped. That is right for an instance that is not behind IAP. For one that is, a person must first create the Desktop OAuth client (see docs/cli/work-management.md), then run `ycadence login --oauth-client-id <id> --iap-audience <IAP client id>`.");
   } else {
-    const clientSecret = context.env.YCADENCE_OAUTH_CLIENT_SECRET || await context.secrets.get(secretAccount.oauthClientSecret(profile));
+    const clientSecret = context.env.YCADENCE_OAUTH_CLIENT_SECRET || setup?.oauthClientSecret || await context.secrets.get(secretAccount.oauthClientSecret(profile));
     if (clientSecret === undefined || clientSecret === "") {
-      throw new ConfigError("The OAuth client secret is missing. Set YCADENCE_OAUTH_CLIENT_SECRET for this login; it is then kept in the credential store.");
+      throw new ConfigError("The OAuth client secret is missing. Copy the sign-in command from Settings → Account → Command line, or set YCADENCE_OAUTH_CLIENT_SECRET for this login; it is then kept in the credential store.");
     }
     const client = oauthClientFrom({ clientId, clientSecret, env: context.env });
-    const tokens = context.flags.device === true ? await deviceLogin({
+    const tokens = context.flags.device === true || stored.oauthFlow === "device" ? await deviceLogin({
       client,
       fetch: context.fetch,
       print: (message) => context.notice(message),
@@ -1943,6 +2012,19 @@ var loginHandler = async (context) => {
       await context.secrets.set(secretAccount.identityToken(profile), JSON.stringify({ token: identity.idToken, expiresAt: identity.expiresAt }));
     }
     signedIn = true;
+    if (apiKey === undefined && identity !== undefined && stored.url !== undefined) {
+      const issued = await requestCliToken(context, stored.url, identity.idToken);
+      if (issued === null) {
+        context.notice("This server cannot issue CLI tokens yet. Create a personal token under Settings → Account → API tokens, then run `ycadence login --api-key-stdin` with it on stdin.");
+      } else {
+        apiKey = issued.token;
+        if (stored.org === undefined) {
+          stored.org = issued.organization;
+          file.profiles[profile] = stored;
+          await context.configStore.save(file);
+        }
+      }
+    }
   }
   if (apiKey !== undefined)
     await context.secrets.set(secretAccount.apiKey(profile), apiKey);
@@ -2144,7 +2226,7 @@ var configPathHandler = async (context) => {
 };
 
 // src/version.ts
-var CLI_VERSION = "0.2.1";
+var CLI_VERSION = "0.3.0";
 
 // src/handlers/doctor.ts
 function legacyNote(name, env) {
@@ -2812,6 +2894,12 @@ var legacyProjectArg = {
   description: "Project id (the older positional form of --project)"
 };
 var LOGIN_FLAGS = [
+  {
+    name: "setup",
+    type: "string",
+    placeholder: "<code>",
+    description: "Setup code from Settings → Account → Command line (URL, OAuth client, flow)"
+  },
   { name: "url", type: "string", placeholder: "<url>", description: "The instance URL" },
   { name: "api-key-stdin", type: "boolean", description: "Read the API key from stdin" },
   { name: "device", type: "boolean", description: "Use the device flow (no local browser)" },
@@ -3301,10 +3389,11 @@ var TREE = {
     {
       name: "login",
       summary: "Save a profile, sign in for IAP, and store an API key",
-      description: "Signs in with Google (loopback, or --device) against the configured Desktop OAuth client for an IAP identity token, when one is configured. The API key is read from stdin and kept in the OS keychain.",
+      description: "Behind IAP, run the command from Settings → Account → Command line: `--setup` carries the URL and OAuth client, the device flow signs you in to Google, and the instance issues this machine a personal token. Elsewhere, pass --url and an API key on stdin. Credentials are kept in the OS keychain.",
       needsClient: false,
       flags: LOGIN_FLAGS,
       examples: [
+        "ycadence login --setup ycs1.…",
         "ycadence login --url https://ycadence.example.com --api-key-stdin < key.txt",
         "ycadence login --profile yarlis --oauth-client-id <desktop client id> --iap-audience <iap client id>"
       ],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ycadence/cli",
-  "version": "0.2.1",
+  "version": "0.3.0",
   "description": "YCadence from the command line: work items, states, cycles and imports.",
   "keywords": [
     "ycadence",