apiblaze 0.19.19 → 0.19.20

package/dist/index.js

@@ -932,7 +932,7 @@ var import_commander = require("commander");
 var import_chalk44 = __toESM(require("chalk"));
 
 // package.json
-var version = "0.19.19";
+var version = "0.19.20";
 
 // src/index.ts
 init_types();
@@ -6054,6 +6054,68 @@ async function captureTargetSecret(auth, opts) {
   if (!secret) fail4("No credential entered.");
   return secret;
 }
+async function dataPlaneAuth(p) {
+  if (!p.consumerAuth) {
+    if (!p.dpKey) throw new Error("No API key for this proxy.");
+    return { "X-API-Key": p.dpKey };
+  }
+  const stored = loadConsumer();
+  if (!stored) {
+    throw new Error("Consumer login required \u2014 run `apiblaze apichat` again to sign in.");
+  }
+  const fresh = await validConsumerToken(stored) ?? stored;
+  if (fresh.accessToken !== stored.accessToken) saveConsumer(fresh);
+  return { Authorization: `Bearer ${fresh.accessToken}` };
+}
+async function ensureConsumerLogin(teamId, tenant2) {
+  const existing = loadConsumer();
+  if (existing && existing.tenant === tenant2) {
+    const fresh = await validConsumerToken(existing);
+    if (fresh) {
+      if (fresh.accessToken !== existing.accessToken) saveConsumer(fresh);
+      console.log(import_chalk39.default.dim(`  Using your consumer session on ${import_chalk39.default.bold(tenant2)}${fresh.email ? ` (${fresh.email})` : ""}.`));
+      return fresh;
+    }
+  }
+  const spinner = (0, import_ora21.default)(`Finding the login app for ${tenant2}...`).start();
+  const clients = await admin({
+    method: "GET",
+    path: `/teams/${encodeURIComponent(teamId)}/tenants/${encodeURIComponent(tenant2)}/app-clients`,
+    summary: `List app clients for ${tenant2}`
+  }).catch(() => []);
+  spinner.stop();
+  const usable = (Array.isArray(clients) ? clients : []).filter((c) => c && (c.client_id || c.clientId));
+  const pick2 = usable.find((c) => c.is_default || c.default) ?? usable.find((c) => c.verified !== false) ?? usable[0];
+  if (!pick2) {
+    throw new Error(
+      `Tenant "${tenant2}" has no login app configured, so there is no way to sign in as a consumer. Add one in the dashboard (Tenants \u2192 app clients).`
+    );
+  }
+  const clientId = pick2.client_id ?? pick2.clientId;
+  console.log(`${import_chalk39.default.cyan("\u2192")} This proxy signs consumers in with OAuth \u2014 logging you in to ${import_chalk39.default.bold(tenant2)}...`);
+  const result = await deviceLogin(clientId, "openid email profile offline_access", ({ verificationUri, userCode }) => {
+    console.log(`
+  Open: ${import_chalk39.default.underline(verificationUri)}`);
+    console.log(`  Code: ${import_chalk39.default.bold(userCode)}
+`);
+    console.log(import_chalk39.default.dim("  (opening your browser\u2026 waiting for you to finish)"));
+  }, `https://${tenant2}.portal.apiblaze.com/1.0.0`);
+  const claims = result.idToken && decodeJwt2(result.idToken) || (decodeJwt2(result.accessToken) ?? {});
+  const creds = {
+    tenant: tenant2,
+    clientId,
+    accessToken: result.accessToken,
+    refreshToken: result.refreshToken,
+    idToken: result.idToken,
+    expiresAt: Date.now() + (result.expiresIn ?? 3600) * 1e3,
+    scope: result.scope,
+    email: typeof claims.email === "string" ? claims.email : void 0,
+    obtainedAt: Date.now()
+  };
+  saveConsumer(creds);
+  console.log(`  ${import_chalk39.default.green("\u2714")} Signed in as${creds.email ? ` ${import_chalk39.default.bold(creds.email)}` : " a consumer"} on ${tenant2}.`);
+  return creds;
+}
 async function cpPost(anon, path8, body, summary) {
   if (anon) {
     const cred = loadAnonCred();
@@ -6235,7 +6297,7 @@ async function publishMcp(p, spec2) {
     const url = `https://${p.mcpHost}/${p.version}/${p.environment}/mcp/generate`;
     const res = await fetch(url, {
       method: "POST",
-      headers: { "Content-Type": "application/json", "X-API-Key": p.dpKey },
+      headers: { "Content-Type": "application/json", ...await dataPlaneAuth(p) },
       body: JSON.stringify({ openapi: spec2, environment: p.environment })
     });
     const out = await res.json().catch(() => null);
@@ -6263,15 +6325,16 @@ function maskKey(k) {
   return k.length <= 8 ? "****" : `${k.slice(0, 4)}\u2026${k.slice(-4)}`;
 }
 var revealAuth = false;
-function renderToolEvents(events, dpKey) {
+function renderToolEvents(events, cred) {
   for (const e of events ?? []) {
     const ok = typeof e.status === "number" ? e.status < 400 : String(e.status).toLowerCase() === "ok";
     const mark = ok ? import_chalk39.default.green("\u2713") : import_chalk39.default.red("\u2717");
     console.log(`  ${mark} ${import_chalk39.default.cyan(e.name)} ${import_chalk39.default.dim(`(${e.status}, ${e.ms}ms)`)}`);
     if (isVerbose() && e.method && e.url) {
-      console.log(import_chalk39.default.dim(`      curl -sS -X ${e.method} '${e.url}'${dpKey ? " \\" : ""}`));
-      if (dpKey) {
-        const keyLine = `        -H 'X-API-Key: ${revealAuth ? dpKey : maskKey(dpKey)}'`;
+      console.log(import_chalk39.default.dim(`      curl -sS -X ${e.method} '${e.url}'${cred ? " \\" : ""}`));
+      if (cred) {
+        const shown = revealAuth ? cred.value : maskKey(cred.value);
+        const keyLine = `        -H '${cred.header}: ${shown}'`;
         const hint = revealAuth ? "" : import_chalk39.default.yellow("  \u2190 /showauth will reveal this");
         console.log(import_chalk39.default.dim(keyLine) + hint);
       }
@@ -6327,7 +6390,7 @@ async function replTurn(p, messages, userText) {
     try {
       res = await fetch(chatUrl(p), {
         method: "POST",
-        headers: { "Content-Type": "application/json", "X-API-Key": p.dpKey },
+        headers: { "Content-Type": "application/json", ...await dataPlaneAuth(p) },
         body: JSON.stringify(body)
       });
     } catch (err) {
@@ -6359,7 +6422,13 @@ async function replTurn(p, messages, userText) {
       return;
     }
     if (Array.isArray(data.delta)) {
-      renderToolEvents(data.tool_events, p.dpKey);
+      renderToolEvents(
+        data.tool_events,
+        p.consumerAuth ? (() => {
+          const t = loadConsumer()?.accessToken;
+          return t ? { header: "Authorization", value: `Bearer ${t}` } : void 0;
+        })() : p.dpKey ? { header: "X-API-Key", value: p.dpKey } : void 0
+      );
       for (const m of data.delta) messages.push(m);
       printAssistant(data.delta);
     }
@@ -6447,24 +6516,50 @@ async function mintDurableProxyKey(teamId, tenant2) {
   if (!out?.key) throw new Error("key mint returned no key");
   return out.key;
 }
+async function fetchAcceptedMethods(project) {
+  try {
+    const listing = await admin({
+      method: "GET",
+      path: `/projects?team_id=${encodeURIComponent(project.teamId)}`,
+      summary: `Read the access policy for ${project.projectName}`
+    });
+    const rows = listing?.projects ?? [];
+    const row = rows.find((r) => r.project_id === project.projectId && r.api_version === project.apiVersion) ?? rows.find((r) => r.project_id === project.projectId);
+    const policy = row?.config?.requests_policy;
+    if (!policy || policy.mode !== "authenticate") return null;
+    return Array.isArray(policy.methods) && policy.methods.length ? policy.methods : null;
+  } catch {
+    return null;
+  }
+}
 async function openServerProxy(project) {
   const version2 = project.apiVersion || "1.0.0";
   const environment = "prod";
   const mcpHost = `${project.projectId}.mcp.abz.run`;
   const tenant2 = project.tenant || project.projectId;
   const me = loadCredentials()?.apiblazeUserId;
-  const prior = loadApichats().find((a) => a.projectId === project.projectId && a.dpKey);
+  const prior = loadApichats().find((a) => a.projectId === project.projectId);
+  const acceptedMethods = await fetchAcceptedMethods(project);
+  const acceptsApiKey = acceptedMethods === null || acceptedMethods.includes("api_key");
   let dpKey = prior?.dpKey;
-  if (!dpKey) {
-    console.log(import_chalk39.default.dim(`  Minting an API key for tenant ${import_chalk39.default.bold(tenant2)} to query project ${import_chalk39.default.bold(project.projectName)}\u2026`));
-    dpKey = await mintDurableProxyKey(project.teamId, tenant2);
-    console.log(`  ${import_chalk39.default.green("\u2714")} API key: ${import_chalk39.default.dim(maskKey(dpKey))}`);
+  let consumerAuth = false;
+  if (acceptsApiKey) {
+    if (!dpKey) {
+      console.log(import_chalk39.default.dim(`  Minting an API key for tenant ${import_chalk39.default.bold(tenant2)} to query project ${import_chalk39.default.bold(project.projectName)}\u2026`));
+      dpKey = await mintDurableProxyKey(project.teamId, tenant2);
+      console.log(`  ${import_chalk39.default.green("\u2714")} API key: ${import_chalk39.default.dim(maskKey(dpKey))}`);
+    }
+  } else {
+    consumerAuth = true;
+    dpKey = void 0;
+    await ensureConsumerLogin(project.teamId, tenant2);
   }
   const p = {
     projectId: project.projectId,
     version: version2,
     environment,
     dpKey,
+    consumerAuth,
     mcpHost,
     proxyUrl: `https://${project.projectId}.abz.run/${version2}/${environment}`,
     anon: false,
@@ -6497,6 +6592,7 @@ async function openServerProxy(project) {
     environment,
     mcpHost,
     dpKey,
+    consumerAuth,
     anon: false,
     ownerUserId: me,
     createdAt: prior?.createdAt ?? (/* @__PURE__ */ new Date()).toISOString(),
@@ -6579,6 +6675,9 @@ async function noArgsMenu(opts) {
       version: a.version,
       environment: a.environment,
       dpKey: a.dpKey,
+      // Carry the door forward — resuming an OAuth-only chat must not fall back to
+      // looking for a key that was never minted.
+      consumerAuth: a.consumerAuth,
       mcpHost: a.mcpHost,
       proxyUrl: void 0,
       anon: a.anon,
@@ -6721,6 +6820,7 @@ async function runApichat(opts) {
     environment: p.environment,
     mcpHost: p.mcpHost,
     dpKey: p.dpKey,
+    consumerAuth: p.consumerAuth,
     anon: p.anon,
     ownerUserId: loadCredentials()?.apiblazeUserId,
     // undefined while anon

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "apiblaze",
-  "version": "0.19.19",
+  "version": "0.19.20",
   "description": "APIblaze CLI — Chat with your APIs, Manage your API keys, users and groups with the APIblaze serverless proxy",
   "keywords": [
     "apiblaze",