ardent-cli-beta 0.0.5 → 0.0.6

package/README.md

@@ -4,13 +4,15 @@
 
 The Ardent CLI is the customer command-line client for the control-plane API.
 
-The Oclif foundation and token authentication are implemented. `ardent login
---token <token>` validates and stores an API token; `ARDENT_TOKEN` supplies the
-same flag non-interactively. `ardent status` and `ardent logout` inspect and
-remove that local session. The CLI always talks to Ardent's production control
-plane. Oclif provides help, version, autocomplete, and native JSON command
-behavior. Connector credential delivery is the first resource command; general
-resource commands and resource context remain owed.
+The Oclif foundation and authentication are implemented. `ardent login` opens
+the Ardent frontend and returns the approved API key through a loopback callback
+bound with PKCE. `ardent login --token <token>` validates and stores an existing
+API token for CI and automation; `ARDENT_TOKEN` supplies the same flag
+non-interactively. `ardent status` and `ardent logout` inspect and remove that
+local session. The CLI always talks to Ardent's production control plane. Oclif
+provides help, version, autocomplete, and native JSON command behavior.
+Connector credential delivery is the first resource command; general resource
+commands and resource context remain owed.
 
 `ardent connectors credentials set` delivers a source database password and a
 verified CA directly to the selected environment's authoritative AWS account and
@@ -29,6 +31,7 @@ it, the CLI uses `https://production.tryardent.com`.
 npm ci
 npm run build
 ./bin/run.js --help
+./bin/run.js login
 ./bin/run.js login --token <token>
 ARDENT_API_URL=http://localhost:8080 ./bin/run.js login --token <token>
 ```

package/dist/api/client.d.ts

@@ -5,3 +5,4 @@ export declare class APIError extends Error {
     constructor(message: string, status: number, code?: string | undefined);
 }
 export declare function request<T>(token: string, path: string, init?: RequestInit): Promise<T>;
+export declare function requestWithoutAuthentication<T>(path: string, init?: RequestInit): Promise<T>;

package/dist/api/client.js

@@ -10,13 +10,24 @@ export class APIError extends Error {
     }
 }
 export async function request(token, path, init = {}) {
+    return requestJSON(path, {
+        ...init,
+        headers: {
+            Authorization: `Bearer ${token}`,
+            ...init.headers,
+        },
+    });
+}
+export async function requestWithoutAuthentication(path, init = {}) {
+    return requestJSON(path, init);
+}
+async function requestJSON(path, init) {
     let response;
     try {
         response = await fetch(new URL(path, `${API_URL}/`), {
             ...init,
             headers: {
                 Accept: 'application/json',
-                Authorization: `Bearer ${token}`,
                 ...(init.body === undefined ? {} : { 'Content-Type': 'application/json' }),
                 ...init.headers,
             },

package/dist/auth/browser.d.ts

@@ -0,0 +1,8 @@
+import { type Organization } from './token.js';
+interface BrowserLoginOptions {
+    onAuthorizationURL?: (url: string, opened: boolean) => void;
+    open?: (url: string) => Promise<void>;
+    timeoutMs?: number;
+}
+export declare function loginWithBrowser(directory: string, options?: BrowserLoginOptions): Promise<Organization[]>;
+export {};

package/dist/auth/browser.js

@@ -0,0 +1,149 @@
+import { spawn } from 'node:child_process';
+import { createHash, randomBytes } from 'node:crypto';
+import { createServer } from 'node:http';
+import { setTimeout as wait } from 'node:timers/promises';
+import { APIError, API_URL, requestWithoutAuthentication } from '../api/client.js';
+import { loginWithToken } from './token.js';
+const LOGIN_TIMEOUT_MS = 30 * 60 * 1000;
+export async function loginWithBrowser(directory, options = {}) {
+    const state = randomValue();
+    const verifier = randomValue();
+    const challenge = createHash('sha256').update(verifier).digest('base64url');
+    const deadline = new AbortController();
+    let callbackURI = '';
+    let exchanging = false;
+    let resolveLogin;
+    let rejectLogin;
+    const completion = new Promise((resolve, reject) => {
+        resolveLogin = resolve;
+        rejectLogin = reject;
+    });
+    const server = createServer(async (request, response) => {
+        const callback = new URL(request.url ?? '/', 'http://127.0.0.1');
+        if (request.method !== 'GET' || callback.pathname !== '/callback') {
+            response.writeHead(404).end();
+            return;
+        }
+        if (callback.searchParams.get('state') !== state) {
+            browserResponse(response, 400, 'Ardent CLI login was rejected because the request did not match.');
+            return;
+        }
+        const authorizationError = callback.searchParams.get('error');
+        if (authorizationError) {
+            const error = new Error(`Ardent CLI login was not authorized: ${authorizationError}`);
+            browserResponse(response, 400, error.message, () => rejectLogin(error));
+            return;
+        }
+        const code = callback.searchParams.get('code');
+        if (!code || exchanging) {
+            browserResponse(response, 400, 'Ardent CLI login could not be completed.');
+            return;
+        }
+        exchanging = true;
+        try {
+            const token = await exchange(code, verifier, deadline.signal);
+            const organizations = await loginWithToken(directory, token, deadline.signal);
+            browserResponse(response, 200, 'Return to your terminal to continue. You can close this tab.', () => resolveLogin(organizations));
+        }
+        catch (error) {
+            const loginError = error instanceof Error ? error : new Error(String(error));
+            browserResponse(response, 500, 'Ardent CLI login failed. Return to your terminal for details.', () => rejectLogin(loginError));
+        }
+    });
+    await new Promise((resolve, reject) => {
+        server.once('error', reject);
+        server.listen(0, '127.0.0.1', resolve);
+    });
+    const address = server.address();
+    callbackURI = `http://127.0.0.1:${address.port}/callback`;
+    const authorizationURL = new URL('/auth/cli', `${API_URL}/`);
+    authorizationURL.search = new URLSearchParams({
+        callback_uri: callbackURI,
+        state,
+        code_challenge: challenge,
+        code_challenge_method: 'S256',
+    }).toString();
+    let opened = true;
+    try {
+        await (options.open ?? openBrowser)(authorizationURL.toString());
+    }
+    catch {
+        opened = false;
+    }
+    options.onAuthorizationURL?.(authorizationURL.toString(), opened);
+    const timeout = setTimeout(() => {
+        deadline.abort();
+        rejectLogin(new Error('Ardent CLI login timed out. Run ardent login to try again.'));
+    }, options.timeoutMs ?? LOGIN_TIMEOUT_MS);
+    try {
+        return await completion;
+    }
+    finally {
+        clearTimeout(timeout);
+        await new Promise((resolve) => {
+            server.close(() => resolve());
+            server.closeAllConnections();
+        });
+    }
+}
+async function exchange(code, verifier, signal) {
+    for (;;) {
+        try {
+            const result = await requestWithoutAuthentication('/auth/cli/exchange', {
+                body: JSON.stringify({ code, code_verifier: verifier }),
+                method: 'POST',
+                signal: AbortSignal.any([signal, AbortSignal.timeout(90_000)]),
+            });
+            if (typeof result.key !== 'string' || result.key.length === 0)
+                throw new Error('Ardent API returned an invalid CLI credential.');
+            return result.key;
+        }
+        catch (error) {
+            if (!(error instanceof APIError) || error.status !== 503 || error.code !== 'workflow_result_timeout')
+                throw error;
+            await wait(5000, undefined, { signal });
+        }
+    }
+}
+function randomValue() {
+    return randomBytes(32).toString('base64url');
+}
+function browserResponse(response, status, message, complete) {
+    response.writeHead(status, { 'Content-Type': 'text/html; charset=utf-8', 'Cache-Control': 'no-store' });
+    const escapedMessage = message.replaceAll('&', '&amp;').replaceAll('<', '&lt;').replaceAll('>', '&gt;');
+    const succeeded = status < 400;
+    response.end(`<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>Ardent CLI</title>
+  <style>
+    * { box-sizing: border-box; }
+    html { color-scheme: dark; }
+    body { margin: 0; background: #0a0a0a; color: #f4f4f5; font-family: "Helvetica Neue", Helvetica, sans-serif; }
+    header { display: flex; height: 48px; align-items: center; border-bottom: 1px solid #242424; padding: 0 20px; color: #d4d4d8; font-family: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, monospace; font-size: 12px; font-weight: 600; letter-spacing: .16em; }
+    main { min-height: calc(100vh - 48px); display: grid; place-items: center; padding: 24px; }
+    section { width: 100%; max-width: 400px; border: 1px solid #2a2a2a; background: #111; }
+    .content { padding: 24px; }
+    .status { display: flex; align-items: center; gap: 8px; margin-bottom: 16px; color: ${succeeded ? '#22c55e' : '#f87171'}; font-family: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, monospace; font-size: 12px; font-weight: 600; text-transform: uppercase; letter-spacing: .08em; }
+    .indicator { width: 7px; height: 7px; background: currentColor; }
+    h1 { margin: 0 0 8px; font-size: 24px; line-height: 1.2; letter-spacing: -.02em; }
+    p { margin: 0; color: #a1a1aa; font-size: 15px; line-height: 1.6; }
+  </style>
+</head>
+<body><header>ARDENT</header><main><section><div class="content"><div class="status"><span class="indicator"></span>${succeeded ? 'Connected' : 'Not connected'}</div><h1>${succeeded ? 'You\'re signed in' : 'Login failed'}</h1><p>${escapedMessage}</p></div></section></main></body>
+</html>`, complete);
+}
+async function openBrowser(url) {
+    const command = process.platform === 'darwin' ? 'open' : process.platform === 'win32' ? 'rundll32' : 'xdg-open';
+    const arguments_ = process.platform === 'win32' ? ['url.dll,FileProtocolHandler', url] : [url];
+    await new Promise((resolve, reject) => {
+        const child = spawn(command, arguments_, { detached: true, stdio: 'ignore' });
+        child.once('error', reject);
+        child.once('spawn', () => {
+            child.unref();
+            resolve();
+        });
+    });
+}

package/dist/auth/token.d.ts

@@ -2,4 +2,4 @@ export interface Organization {
     id: string;
     name: string;
 }
-export declare function loginWithToken(directory: string, value: string): Promise<Organization[]>;
+export declare function loginWithToken(directory: string, value: string, signal?: AbortSignal): Promise<Organization[]>;

package/dist/auth/token.js

@@ -1,10 +1,10 @@
 import { request } from '../api/client.js';
 import { saveSession } from './credentials.js';
-export async function loginWithToken(directory, value) {
+export async function loginWithToken(directory, value, signal) {
     const token = value.trim();
     if (!token)
         throw new Error('Ardent API token cannot be empty.');
-    const organizations = await request(token, '/organizations');
+    const organizations = await request(token, '/organizations', { signal });
     if (!Array.isArray(organizations) ||
         organizations.some((organization) => typeof organization !== 'object' ||
             organization === null ||
@@ -12,6 +12,7 @@ export async function loginWithToken(directory, value) {
             typeof organization.name !== 'string')) {
         throw new Error('Ardent API returned an invalid organization response.');
     }
+    signal?.throwIfAborted();
     await saveSession(directory, { token });
     return organizations;
 }

package/dist/commands/login.js

@@ -1,4 +1,5 @@
 import { Flags } from '@oclif/core';
+import { loginWithBrowser } from '../auth/browser.js';
 import { loginWithToken } from '../auth/token.js';
 import { ArdentCommand } from '../command.js';
 export default class Login extends ArdentCommand {
@@ -9,16 +10,19 @@ export default class Login extends ArdentCommand {
     };
     async run() {
         const { flags } = await this.parse(Login);
-        if (!flags.token)
-            this.error('Interactive login is not implemented yet.');
-        const organizations = await loginWithToken(this.config.configDir, flags.token);
-        if (!this.jsonEnabled()) {
-            this.log('✓ Logged in to Ardent');
-            if (organizations.length === 1)
-                this.log(`  Organization: ${organizations[0].name} (${organizations[0].id})`);
-            else
-                this.log(`  Organizations: ${organizations.length}`);
-        }
+        const organizations = flags.token
+            ? await loginWithToken(this.config.configDir, flags.token)
+            : await loginWithBrowser(this.config.configDir, {
+                onAuthorizationURL: (url, opened) => {
+                    this.log(opened ? 'Opening Ardent in your browser…' : `Open this URL to log in:\n\n${url}`);
+                    this.log('Complete login in your browser. Keep this terminal open.');
+                },
+            });
+        this.log('✓ Logged in to Ardent');
+        if (organizations.length === 1)
+            this.log(`  Organization: ${organizations[0].name} (${organizations[0].id})`);
+        else
+            this.log(`  Organizations: ${organizations.length}`);
         return { authenticated: true, organizations };
     }
 }

package/oclif.manifest.json

@@ -182,5 +182,5 @@
       ]
     }
   },
-  "version": "0.0.5"
+  "version": "0.0.6"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ardent-cli-beta",
-  "version": "0.0.5",
+  "version": "0.0.6",
   "description": "The Ardent command-line interface",
   "license": "Apache-2.0",
   "type": "module",