alchemy 2.0.0-beta.75 → 2.0.0-beta.77

package/src/Auth/BrowserOAuth.ts

@@ -0,0 +1,68 @@
+/**
+ * Shared browser-OAuth ceremony for auth providers: open the authorization
+ * URL, then race the provider's local callback listener against the branded
+ * "waiting for browser" prompt (spinner + compact URL; Enter switches to
+ * manual code entry, `o` opens the browser again, and `c` copies the URL).
+ *
+ * Built-in providers (Cloudflare, Planetscale) and custom stack-provided
+ * auth providers should all route their browser flows through this so the
+ * login UX stays uniform.
+ */
+import * as Effect from "effect/Effect";
+import type { ChildProcessSpawner } from "effect/unstable/process/ChildProcessSpawner";
+import * as Interaction from "../Interaction.ts";
+import { CallbackServerStartError } from "./OAuthFlow.ts";
+
+export interface BrowserOAuthOptions<A, E1, R1, E2, R2> {
+  /** Display name, e.g. "Cloudflare" — used in the prompt title. */
+  provider: string;
+  /** The authorization URL the browser was pointed at. */
+  url: string;
+  /** Resolves when the local callback listener receives the redirect. */
+  callback: Effect.Effect<A, E1, R1>;
+  /** Exchanges a manually pasted code / callback URL for credentials. */
+  exchange: (input: string) => Effect.Effect<A, E2, R2>;
+  /** Spinner label. @default "waiting for browser authorization (up to 5 minutes)…" */
+  waitingLabel?: string;
+}
+
+export const browserOAuth = Effect.fn(function* <A, E1, R1, E2, R2>(
+  options: BrowserOAuthOptions<A, E1, R1, E2, R2>,
+) {
+  const services = yield* Effect.context<ChildProcessSpawner>();
+  // This runner is invoked later by React's keyboard event boundary, not
+  // while the surrounding Effect is executing.
+  const openUrl = Effect.runPromiseWith(services);
+  const openFailed = yield* Interaction.openUrl(options.url).pipe(
+    Effect.as(false),
+    Effect.catch(() => Effect.succeed(true)),
+  );
+  return yield* Effect.raceFirst(
+    // A callback server that cannot start (e.g. the port is taken) must not
+    // fail the race — warn and hang so manual code entry stays available.
+    // Genuine OAuth failures delivered via the callback still fail fast.
+    options.callback.pipe(
+      Effect.catch((e) =>
+        e instanceof CallbackServerStartError
+          ? Interaction.accessors.output
+              .warning(`${e.message} — paste the authorization code instead.`)
+              .pipe(Effect.andThen(Effect.never))
+          : Effect.fail(e),
+      ),
+    ),
+    (yield* Interaction.Interaction).prompt
+      .awaitExternal({
+        message: `${options.provider} authorization`,
+        waitingLabel:
+          options.waitingLabel ??
+          "waiting for browser authorization (up to 5 minutes)…",
+        url: options.url,
+        openFailed,
+        onOpen: () => openUrl(Interaction.openUrl(options.url)),
+        inputLabel: "Paste the authorization code or callback URL",
+        validate: (value) =>
+          value.trim().length > 0 ? undefined : "Paste a code or URL",
+      })
+      .pipe(Effect.flatMap(options.exchange)),
+  );
+});

package/src/Auth/Credentials.ts

@@ -2,15 +2,14 @@ import * as Context from "effect/Context";
 import * as Effect from "effect/Effect";
 import * as FileSystem from "effect/FileSystem";
 import * as Layer from "effect/Layer";
-import type { PlatformError } from "effect/PlatformError";
 import * as Redacted from "effect/Redacted";
+import * as Schema from "effect/Schema";
 import path from "pathe";
-import { rootDir } from "./Profile.ts";
-
-const credentialsDirPath = path.join(rootDir, "credentials");
-
-export const profileCredentialsDirPath = (profile: string) =>
-  path.join(credentialsDirPath, profile);
+import { writeFileAtomic } from "../Util/AtomicFile.ts";
+import { profileCommandHint } from "../Util/interactive.ts";
+import { AuthError } from "./AuthProvider.ts";
+import { profileCredentialsDirPath } from "./Paths.ts";
+import { validateProfileName } from "./Profile.ts";
 
 export const credentialsFilePath = (profile: string, provider: string) =>
   path.join(profileCredentialsDirPath(profile), `${provider}.json`);
@@ -19,23 +18,33 @@ export const credentialsFilePath = (profile: string, provider: string) =>
  * Service exposing per-profile credential file helpers. All methods have
  * `R = never` — the {@link FileSystem.FileSystem} requirement is captured
  * by {@link CredentialsStoreLive} when the layer is built.
+ *
+ * Reads and writes go through the provider's declared credential schema, so
+ * a hand-edited or corrupted secrets file surfaces as a typed `AuthError`
+ * (with a reconfigure hint) instead of propagating malformed data into API
+ * calls.
  */
 export interface CredentialsStoreService {
-  readonly read: <T>(
+  readonly read: <A, E>(
+    profile: string,
+    provider: string,
+    schema: Schema.Codec<A, E>,
+  ) => Effect.Effect<A | undefined, AuthError>;
+  readonly write: <A, E>(
     profile: string,
     provider: string,
-  ) => Effect.Effect<T | undefined>;
-  readonly write: <T>(
+    schema: Schema.Codec<A, E>,
+    credentials: A,
+  ) => Effect.Effect<void, AuthError>;
+  readonly delete: (
     profile: string,
     provider: string,
-    credentials: T,
-  ) => Effect.Effect<void, PlatformError>;
-  readonly delete: (profile: string, provider: string) => Effect.Effect<void>;
+  ) => Effect.Effect<void, AuthError>;
   /**
    * Recursively remove the `~/.alchemy/credentials/{profile}` directory
    * containing all per-provider secrets for `profile`. No-op if it doesn't exist.
    */
-  readonly deleteProfile: (profile: string) => Effect.Effect<void>;
+  readonly deleteProfile: (profile: string) => Effect.Effect<void, AuthError>;
 }
 
 export class CredentialsStore extends Context.Service<
@@ -48,47 +57,130 @@ export const CredentialsStoreLive = Layer.effect(
   Effect.gen(function* () {
     const fs = yield* FileSystem.FileSystem;
 
-    const read = <T>(
+    const read = <A, E>(
       profile: string,
       provider: string,
-    ): Effect.Effect<T | undefined> =>
-      fs.readFileString(credentialsFilePath(profile, provider)).pipe(
-        Effect.catch(() => Effect.succeed(undefined as string | undefined)),
-        Effect.map((data) => {
-          if (data === undefined) return undefined as T | undefined;
-          try {
-            return JSON.parse(data) as T;
-          } catch {
-            return undefined as T | undefined;
-          }
-        }),
-      );
+      schema: Schema.Codec<A, E>,
+    ) =>
+      Effect.gen(function* () {
+        const filePath = yield* validateCredentialPath(profile, provider);
+        const data = yield* fs.readFileString(filePath).pipe(
+          Effect.catchReason("PlatformError", "NotFound", () =>
+            Effect.succeed(undefined),
+          ),
+          Effect.mapError(
+            (cause) =>
+              new AuthError({
+                message: `Could not read credentials at '${filePath}'.`,
+                cause,
+              }),
+          ),
+        );
+        if (data === undefined) return undefined;
+        const json = yield* Schema.decodeUnknownEffect(
+          Schema.fromJsonString(Schema.Unknown),
+        )(data).pipe(
+          Effect.mapError(
+            (cause) =>
+              new AuthError({
+                message: `Stored credentials at '${filePath}' contain invalid JSON.`,
+                cause,
+              }),
+          ),
+        );
+        const command = yield* profileCommandHint(
+          `alchemy profile edit --profile ${profile} --reconfigure ${provider}`,
+        );
+        return yield* Schema.decodeUnknownEffect(schema)(json).pipe(
+          Effect.mapError(
+            (cause) =>
+              new AuthError({
+                message:
+                  `Stored credentials at '${filePath}' do not match the expected shape. ` +
+                  `Run \`${command}\` to replace them.`,
+                cause,
+              }),
+          ),
+        );
+      });
 
-    const write = <T>(
+    const write = <A, E>(
       profile: string,
       provider: string,
-      credentials: T,
-    ): Effect.Effect<void, PlatformError> => {
-      const filePath = credentialsFilePath(profile, provider);
-      return fs.makeDirectory(path.dirname(filePath), { recursive: true }).pipe(
-        Effect.flatMap(() => {
-          return fs.writeFileString(
+      schema: Schema.Codec<A, E>,
+      credentials: A,
+    ) =>
+      Effect.gen(function* () {
+        const filePath = yield* validateCredentialPath(profile, provider);
+        const encoded = yield* Schema.encodeEffect(schema)(credentials).pipe(
+          Effect.mapError(
+            (cause) =>
+              new AuthError({
+                message: `Credentials for '${provider}' do not match the declared schema.`,
+                cause,
+              }),
+          ),
+        );
+        yield* Effect.gen(function* () {
+          const directory = path.dirname(filePath);
+          yield* fs.makeDirectory(directory, { recursive: true });
+          yield* fs.chmod(directory, 0o700);
+          yield* writeFileAtomic(
+            fs,
             filePath,
-            JSON.stringify(credentials, null, 2),
+            JSON.stringify(encoded, null, 2),
+            0o600,
           );
-        }),
-      );
-    };
+        }).pipe(
+          Effect.mapError(
+            (cause) =>
+              new AuthError({
+                message: `Could not write credentials at '${filePath}'.`,
+                cause,
+              }),
+          ),
+        );
+      });
 
-    const remove_ = (profile: string, provider: string): Effect.Effect<void> =>
-      fs
-        .remove(credentialsFilePath(profile, provider))
-        .pipe(Effect.catch(() => Effect.void));
+    const remove_ = (
+      profile: string,
+      provider: string,
+    ): Effect.Effect<void, AuthError> =>
+      validateCredentialPath(profile, provider).pipe(
+        Effect.flatMap((filePath) =>
+          fs.remove(filePath).pipe(
+            Effect.catchReason("PlatformError", "NotFound", () => Effect.void),
+            Effect.mapError(
+              (cause) =>
+                new AuthError({
+                  message: `Could not delete credentials at '${filePath}'.`,
+                  cause,
+                }),
+            ),
+          ),
+        ),
+      );
 
-    const deleteProfile = (profile: string): Effect.Effect<void> =>
-      fs
-        .remove(profileCredentialsDirPath(profile), { recursive: true })
-        .pipe(Effect.catch(() => Effect.void));
+    const deleteProfile = (profile: string) =>
+      Effect.gen(function* () {
+        yield* validateProfileName(profile).pipe(
+          Effect.mapError(
+            (cause) => new AuthError({ message: cause.message, cause }),
+          ),
+        );
+        yield* fs
+          .remove(profileCredentialsDirPath(profile), { recursive: true })
+          .pipe(
+            Effect.catchReason("PlatformError", "NotFound", () => Effect.void),
+            Effect.mapError(
+              (cause) =>
+                new AuthError({
+                  message: `Could not delete credentials for profile '${profile}'.`,
+                  cause,
+                }),
+            ),
+          );
+      });
 
     return {
       read,
@@ -99,6 +191,23 @@ export const CredentialsStoreLive = Layer.effect(
   }),
 );
 
+const CREDENTIAL_KEY_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+
+const validateCredentialPath = (profile: string, provider: string) =>
+  Effect.gen(function* () {
+    yield* validateProfileName(profile).pipe(
+      Effect.mapError(
+        (cause) => new AuthError({ message: cause.message, cause }),
+      ),
+    );
+    if (!CREDENTIAL_KEY_PATTERN.test(provider)) {
+      return yield* new AuthError({
+        message: `Invalid credential key '${provider}'.`,
+      });
+    }
+    return credentialsFilePath(profile, provider);
+  });
+
 export function displayRedacted(
   r: Redacted.Redacted<string>,
   visibleChars = 4,

package/src/Auth/CredentialsCache.ts

@@ -0,0 +1,57 @@
+import * as Cache from "effect/Cache";
+import * as Clock from "effect/Clock";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as Exit from "effect/Exit";
+
+/**
+ * Refresh expiring credentials this long before they actually expire so that
+ * in-flight requests never race the expiry deadline.
+ */
+export const CREDENTIAL_REFRESH_WINDOW = Duration.minutes(5);
+
+/** Compute how long credentials may remain cached. */
+export const credentialTimeToLive = (
+  expiresAt: number | undefined,
+  resolvedAt: number,
+): Duration.Duration => {
+  if (expiresAt === undefined) return Duration.infinity;
+  return Duration.millis(
+    Math.max(
+      0,
+      expiresAt - resolvedAt - Duration.toMillis(CREDENTIAL_REFRESH_WINDOW),
+    ),
+  );
+};
+
+/**
+ * Build a single-entry Effect cache whose TTL is derived from each resolved
+ * credential's expiry. Concurrent cache misses share one resolution.
+ */
+export const cacheUntilExpiry = <A, E>(
+  resolve: Effect.Effect<A, E>,
+  expiresAt: (credentials: A) => number | undefined,
+) =>
+  Effect.gen(function* () {
+    const cache = yield* Cache.makeWith(
+      (_: void) =>
+        Effect.gen(function* () {
+          const resolvedAt = yield* Clock.currentTimeMillis;
+          const credentials = yield* resolve;
+          return { credentials, resolvedAt };
+        }),
+      {
+        capacity: 1,
+        timeToLive: (exit) =>
+          Exit.isSuccess(exit)
+            ? credentialTimeToLive(
+                expiresAt(exit.value.credentials),
+                exit.value.resolvedAt,
+              )
+            : Duration.zero,
+      },
+    );
+    return Cache.get(cache, undefined).pipe(
+      Effect.map(({ credentials }) => credentials),
+    );
+  });