assistant-ui 0.0.119 → 0.0.121

package/src/lib/cloud-auth.ts

@@ -0,0 +1,273 @@
+import { spawn } from "node:child_process";
+import { randomUUID } from "node:crypto";
+import { renameSync, statSync, unlinkSync } from "node:fs";
+import {
+  chmod,
+  link,
+  mkdir,
+  readFile,
+  rename,
+  rm,
+  writeFile,
+} from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import {
+  createDeviceLogin,
+  isAccessDenied,
+  type DeviceCredentials,
+} from "aui-auth/device";
+import { abortable } from "./cloud-abort";
+import { validateCloudUrl } from "./cloud-url";
+
+export { validateCloudUrl } from "./cloud-url";
+
+export type CloudAuthConfig = {
+  issuer: string;
+  clientId: string;
+  credentialsFile: string;
+};
+
+type SavedCredentials = DeviceCredentials & {
+  issuer: string;
+  clientId: string;
+};
+
+export const cloudAuthConfig = (): CloudAuthConfig => ({
+  issuer: validateCloudUrl(
+    process.env.ASSISTANT_UI_ACCOUNTS_URL ??
+      "https://accounts.assistant-ui.com",
+  ),
+  clientId: process.env.ASSISTANT_UI_OIDC_CLIENT_ID ?? "assistant-ui-cli",
+  credentialsFile: path.join(
+    process.env.ASSISTANT_UI_CONFIG_DIR ??
+      path.join(os.homedir(), ".assistant-ui"),
+    "credentials.json",
+  ),
+});
+
+export const readCloudCredentials = async (
+  config: CloudAuthConfig,
+  options: { matchConfig?: boolean } = {},
+): Promise<SavedCredentials | null> => {
+  let contents: string;
+  try {
+    contents = await readFile(config.credentialsFile, "utf8");
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === "ENOENT") return null;
+    throw error;
+  }
+  let saved: SavedCredentials;
+  try {
+    saved = JSON.parse(contents) as SavedCredentials;
+  } catch {
+    throw new Error("Invalid saved login. Run assistant-ui cloud login again.");
+  }
+  if (!saved || typeof saved !== "object")
+    throw new Error("Invalid saved login. Run assistant-ui cloud login again.");
+  if (
+    options.matchConfig !== false &&
+    (saved.issuer !== config.issuer || saved.clientId !== config.clientId)
+  ) {
+    return null;
+  }
+  if (
+    !saved.tokens?.accessToken ||
+    !saved.user?.id ||
+    typeof saved.tokens.accessTokenExpiresAt !== "number"
+  ) {
+    throw new Error("Invalid saved login. Run assistant-ui cloud login again.");
+  }
+  return saved;
+};
+
+export const saveCloudCredentials = async (
+  config: CloudAuthConfig,
+  credentials: DeviceCredentials,
+  signal?: AbortSignal,
+): Promise<void> => {
+  await mkdir(path.dirname(config.credentialsFile), {
+    recursive: true,
+    mode: 0o700,
+  });
+  const temporary = `${config.credentialsFile}.${randomUUID()}.tmp`;
+  const backup = `${temporary}.previous`;
+  let previous = false;
+  let replacement: ReturnType<typeof statSync> | undefined;
+  let renamed = false;
+  try {
+    try {
+      await link(config.credentialsFile, backup);
+      previous = true;
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
+    }
+    await writeFile(
+      temporary,
+      `${JSON.stringify({ ...credentials, issuer: config.issuer, clientId: config.clientId }, null, 2)}\n`,
+      { mode: 0o600, flag: "wx" },
+    );
+    await chmod(temporary, 0o600);
+    replacement = statSync(temporary);
+    signal?.throwIfAborted();
+    await rename(temporary, config.credentialsFile);
+    renamed = true;
+    signal?.throwIfAborted();
+  } catch (error) {
+    if (renamed && replacement) {
+      let current: ReturnType<typeof statSync> | undefined;
+      try {
+        current = statSync(config.credentialsFile);
+      } catch (failure) {
+        if ((failure as NodeJS.ErrnoException).code !== "ENOENT") throw failure;
+      }
+      if (current?.dev === replacement.dev && current.ino === replacement.ino) {
+        if (previous) renameSync(backup, config.credentialsFile);
+        else unlinkSync(config.credentialsFile);
+      }
+    }
+    throw error;
+  } finally {
+    await rm(temporary, { force: true });
+    await rm(backup, { force: true });
+  }
+};
+
+const openBrowser = (url: string): void => {
+  const command =
+    process.platform === "darwin"
+      ? "open"
+      : process.platform === "win32"
+        ? "rundll32"
+        : "xdg-open";
+  const args =
+    process.platform === "win32" ? ["url.dll,FileProtocolHandler", url] : [url];
+  const child = spawn(command, args, { detached: true, stdio: "ignore" });
+  child.on("error", () => {});
+  child.unref();
+};
+
+export const loginToCloud = async (
+  config: CloudAuthConfig,
+  options: {
+    noOpen?: boolean;
+    setupUrl?: string;
+    print?: (text: string) => void;
+  } = {},
+): Promise<DeviceCredentials> => {
+  if (
+    options.setupUrl &&
+    !["assistant-ui-cli", "assistant-ui-cli-dev"].includes(config.clientId)
+  ) {
+    throw new Error(
+      "Wizard sign-in requires the assistant-ui CLI OAuth client.",
+    );
+  }
+  const print = options.print ?? console.log;
+  const setup = options.setupUrl
+    ? await (
+        await import("./cloud-setup-login")
+      ).connectCloudLoginSetup(options.setupUrl)
+    : undefined;
+  const signal = AbortSignal.any([
+    AbortSignal.timeout(10 * 60 * 1000),
+    ...(setup ? [setup.signal] : []),
+  ]);
+  const login = createDeviceLogin({
+    issuer: config.issuer,
+    clientId: config.clientId,
+    fetch: (input, init) => {
+      const url = new URL(input instanceof Request ? input.url : String(input));
+      return fetch(
+        input,
+        url.pathname === "/api/auth/device/code"
+          ? {
+              ...init,
+              signal: AbortSignal.any([
+                signal,
+                ...(init?.signal ? [init.signal] : []),
+              ]),
+            }
+          : init,
+      );
+    },
+  });
+  let credentials: DeviceCredentials | undefined;
+  let committed = false;
+  try {
+    signal.throwIfAborted();
+    const authorization = await abortable(login.start(), signal);
+    signal.throwIfAborted();
+    const approvalUrl =
+      (await setup?.publish(authorization, config.issuer)) ??
+      authorization.verificationUriComplete;
+    print(`Confirm code ${authorization.userCode} at ${approvalUrl}`);
+    if (!options.noOpen && !setup)
+      openBrowser(authorization.verificationUriComplete);
+    credentials = await login.wait(authorization, { signal });
+    signal.throwIfAborted();
+    await saveCloudCredentials(config, credentials, signal);
+    committed = true;
+    await setup?.complete("signed-in").catch(() => {
+      print("Signed in locally. The setup connection could not be updated.");
+    });
+    print(`Signed in as ${credentials.user.email || credentials.user.id}.`);
+    return credentials;
+  } catch (error) {
+    if (credentials && !committed) {
+      await login.revoke(credentials).catch(() => {
+        print(
+          "The cancelled login could not be revoked. End it from your Accounts Sessions page.",
+        );
+      });
+    }
+    await setup
+      ?.complete(signal.aborted ? "cancelled" : "failed")
+      .catch(() => {});
+    throw error;
+  } finally {
+    await setup?.dispose();
+  }
+};
+
+export const cloudAccessToken = async (
+  config: CloudAuthConfig,
+  options: {
+    noOpen?: boolean;
+    setupUrl?: string;
+    print?: (text: string) => void;
+  } = {},
+): Promise<string> => {
+  const saved = await readCloudCredentials(config);
+  if (!saved) return (await loginToCloud(config, options)).tokens.accessToken;
+  const login = createDeviceLogin({
+    issuer: config.issuer,
+    clientId: config.clientId,
+  });
+  try {
+    const credentials = await login.ensureFresh(saved);
+    if (credentials !== saved) await saveCloudCredentials(config, credentials);
+    return credentials.tokens.accessToken;
+  } catch (error) {
+    if (isAccessDenied(error)) {
+      await rm(config.credentialsFile, { force: true });
+      throw new Error(
+        "Your login expired. Run assistant-ui cloud login again.",
+      );
+    }
+    throw error;
+  }
+};
+
+export const logoutFromCloud = async (
+  config: CloudAuthConfig,
+): Promise<void> => {
+  const saved = await readCloudCredentials(config, { matchConfig: false });
+  if (saved) {
+    await createDeviceLogin({
+      issuer: validateCloudUrl(saved.issuer),
+      clientId: saved.clientId,
+    }).revoke(saved);
+  }
+  await rm(config.credentialsFile, { force: true });
+};

package/src/lib/cloud-config.test.ts

@@ -0,0 +1,82 @@
+import { mkdtemp, readFile, rm, stat, writeFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { describe, expect, it } from "vitest";
+import {
+  mergeCloudEnvironment,
+  readCloudProjectConfig,
+  writeCloudProjectConfig,
+} from "./cloud-config";
+
+describe("cloud environment", () => {
+  it("preserves custom settings and repeated configuration", () => {
+    const original = "# My settings\nOPENAI_API_KEY=my-existing-key\n";
+    const merged = mergeCloudEnvironment(original, {
+      ASSISTANT_API_KEY: "secret",
+    });
+    expect(merged).toContain(original);
+    expect(mergeCloudEnvironment(merged, { ASSISTANT_API_KEY: "secret" })).toBe(
+      merged,
+    );
+  });
+
+  it("refuses to overwrite an existing configuration", () => {
+    expect(() =>
+      mergeCloudEnvironment("ASSISTANT_API_KEY=existing\n", {
+        ASSISTANT_API_KEY: "replacement",
+      }),
+    ).toThrow("already configured");
+  });
+
+  it("encodes multiline values and quotes", () => {
+    expect(mergeCloudEnvironment("", { KEY: 'hello\nworld"' })).toBe(
+      'KEY="hello\\nworld\\\""\n',
+    );
+  });
+
+  it("keeps API keys in an ignored private server environment file", async () => {
+    const directory = await mkdtemp(
+      path.join(os.tmpdir(), "assistant-ui-cloud-"),
+    );
+    try {
+      await writeFile(
+        path.join(directory, ".env.local"),
+        "OPENAI_API_KEY=existing-provider-key\n",
+      );
+      const config = {
+        organizationId: "org",
+        organizationSlug: "team",
+        projectId: "project",
+        projectSlug: "chat",
+        harnessId: "harness",
+        harnessOrigin: "https://harness.example.com",
+        apiOrigin: "https://project.example.com",
+        workspaceId: "hackathon",
+        backendUrl: "http://localhost:3000/api/chat",
+      };
+      await writeCloudProjectConfig(directory, config, "private-cloud-key");
+      expect(await readCloudProjectConfig(directory)).toEqual(config);
+      expect(
+        await readFile(
+          path.join(directory, ".assistant-ui", "cloud.json"),
+          "utf8",
+        ),
+      ).not.toContain("private-cloud-key");
+      expect(
+        await readFile(path.join(directory, ".env.local"), "utf8"),
+      ).toContain("OPENAI_API_KEY=existing-provider-key");
+      expect(
+        await readFile(path.join(directory, ".env.local"), "utf8"),
+      ).toContain('ASSISTANT_API_KEY="private-cloud-key"');
+      expect(
+        await readFile(path.join(directory, ".gitignore"), "utf8"),
+      ).toContain(".env.local");
+      if (process.platform !== "win32")
+        expect(
+          (await stat(path.join(directory, ".env.local"))).mode & 0o777,
+        ).toBe(0o600);
+    } finally {
+      await rm(directory, { recursive: true, force: true });
+    }
+  });
+});

package/src/lib/cloud-config.ts

@@ -0,0 +1,138 @@
+import {
+  mkdir,
+  readFile,
+  writeFile,
+  link,
+  rename,
+  rm,
+  stat,
+} from "node:fs/promises";
+import { randomUUID } from "node:crypto";
+import path from "node:path";
+
+export type CloudProjectConfig = {
+  organizationId: string;
+  organizationSlug: string;
+  projectId: string;
+  projectSlug: string;
+  harnessId: string;
+  harnessOrigin: string;
+  apiOrigin: string;
+  workspaceId: string;
+  backendUrl: string;
+};
+
+export const writeCloudFile = async (
+  file: string,
+  contents: string,
+  options: { exclusive?: boolean; mode?: number } = {},
+): Promise<void> => {
+  await mkdir(path.dirname(file), { recursive: true });
+  const temporary = `${file}.${randomUUID()}.tmp`;
+  try {
+    await writeFile(temporary, contents, {
+      flag: "wx",
+      mode: options.mode ?? 0o600,
+    });
+    if (options.exclusive) await link(temporary, file);
+    else await rename(temporary, file);
+  } finally {
+    await rm(temporary, { force: true });
+  }
+};
+
+export const cloudProjectConfigPath = (directory: string): string =>
+  path.join(directory, ".assistant-ui", "cloud.json");
+
+export const readCloudProjectConfig = async (
+  directory: string,
+): Promise<CloudProjectConfig | null> => {
+  try {
+    return JSON.parse(
+      await readFile(cloudProjectConfigPath(directory), "utf8"),
+    ) as CloudProjectConfig;
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === "ENOENT") return null;
+    throw error;
+  }
+};
+
+export const readOptionalFile = async (file: string): Promise<string> => {
+  try {
+    return await readFile(file, "utf8");
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === "ENOENT") return "";
+    throw error;
+  }
+};
+
+export const mergeCloudEnvironment = (
+  contents: string,
+  values: Record<string, string>,
+): string => {
+  const lines = contents.split(/\r?\n/);
+  const pending = new Map(Object.entries(values));
+  for (const line of lines) {
+    const match = line.match(
+      /^\s*(?:export\s+)?([A-Z_][A-Z0-9_]*)\s*=\s*(.*)$/,
+    );
+    if (!match) continue;
+    const key = match[1]!;
+    const expected = values[key];
+    if (expected === undefined) continue;
+    const existing = match[2]!.trim();
+    const quoted = JSON.stringify(expected);
+    if (
+      existing !== expected &&
+      existing !== quoted &&
+      existing !== `'${expected}'`
+    ) {
+      throw new Error(
+        `${key} is already configured in .env.local. Keep your existing configuration or use a new directory.`,
+      );
+    }
+    pending.delete(key);
+  }
+  if (pending.size === 0) return contents;
+  const additions = [...pending].map(
+    ([key, value]) => `${key}=${JSON.stringify(value)}`,
+  );
+  return `${contents}${contents && !contents.endsWith("\n") ? "\n" : ""}${additions.join("\n")}\n`;
+};
+
+export const writeCloudProjectConfig = async (
+  directory: string,
+  config: CloudProjectConfig,
+  apiKey: string,
+): Promise<void> => {
+  const envFile = path.join(directory, ".env.local");
+  const contents = await readOptionalFile(envFile);
+  const environment = mergeCloudEnvironment(contents, {
+    ASSISTANT_API_KEY: apiKey,
+    NEXT_PUBLIC_ASSISTANT_BASE_URL: config.apiOrigin,
+    NEXT_PUBLIC_ASSISTANT_HARNESS_URL: config.harnessOrigin,
+    NEXT_PUBLIC_ASSISTANT_WORKSPACE_ID: config.workspaceId,
+  });
+  const gitignoreFile = path.join(directory, ".gitignore");
+  const gitignore = await readOptionalFile(gitignoreFile);
+  const ignored = gitignore.split(/\r?\n/).map((line) => line.trim());
+  if (!ignored.includes(".env.local") && !ignored.includes(".env*.local")) {
+    await writeCloudFile(
+      gitignoreFile,
+      `${gitignore}${gitignore && !gitignore.endsWith("\n") ? "\n" : ""}.env.local\n`,
+      {
+        mode: await stat(gitignoreFile)
+          .then((info) => info.mode & 0o777)
+          .catch((error: NodeJS.ErrnoException) => {
+            if (error.code === "ENOENT") return 0o644;
+            throw error;
+          }),
+      },
+    );
+  }
+  await writeCloudFile(envFile, environment);
+  await writeCloudFile(
+    cloudProjectConfigPath(directory),
+    `${JSON.stringify(config, null, 2)}\n`,
+  );
+};

package/src/lib/cloud-provision.test.ts

@@ -0,0 +1,132 @@
+import { mkdtemp, readFile, rm } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { afterEach, describe, expect, it, vi } from "vitest";
+import {
+  provisionCloudHarness,
+  resolveProvisionRequest,
+} from "./cloud-provision";
+
+const directories: string[] = [];
+afterEach(async () => {
+  vi.unstubAllGlobals();
+  await Promise.all(
+    directories
+      .splice(0)
+      .map((directory) => rm(directory, { recursive: true, force: true })),
+  );
+});
+
+const directory = async () => {
+  const dir = await mkdtemp(path.join(os.tmpdir(), "assistant-ui-provision-"));
+  directories.push(dir);
+  return dir;
+};
+
+const input = {
+  org_id: "org-1",
+  project_id: "project-1",
+  harness_name: "Team chat",
+  backend_urls: ["http://localhost:3000/api/chat"],
+  allow_localhost: true,
+};
+
+describe("cloud provisioning", () => {
+  it("replays the same identity after a failed request without persisting an access code", async () => {
+    const dir = await directory();
+    const first = await resolveProvisionRequest(
+      dir,
+      input,
+      "private-access-code",
+    );
+    const second = await resolveProvisionRequest(dir, input);
+    expect(second.idempotency_key).toBe(first.idempotency_key);
+    expect(
+      await readFile(path.join(dir, ".assistant-ui", "provision.json"), "utf8"),
+    ).not.toContain("private-access-code");
+  });
+
+  it("refuses to reuse a pending setup identity for another project", async () => {
+    const dir = await directory();
+    await resolveProvisionRequest(dir, input);
+    await expect(
+      resolveProvisionRequest(dir, { ...input, project_id: "different" }),
+    ).rejects.toThrow("pending setup");
+  });
+
+  it("sends the OAuth token only in the authorization header", async () => {
+    const request = { ...input, idempotency_key: "request-id" };
+    const result = {
+      project_id: input.project_id,
+      workspace_id: "workspace",
+      harness_id: "harness",
+      harness_origin: "https://harness.example.com",
+      api_origin: "https://project.example.com",
+      api_key: "server-key",
+    };
+    const fetch = vi.fn().mockResolvedValue(Response.json(result));
+    vi.stubGlobal("fetch", fetch);
+    expect(
+      await provisionCloudHarness(
+        "https://cloud.example.com/",
+        "private-token",
+        request,
+      ),
+    ).toEqual(result);
+    expect(fetch).toHaveBeenCalledWith(
+      "https://cloud.example.com/api/cli/provision",
+      expect.objectContaining({
+        headers: expect.objectContaining({
+          Authorization: "Bearer private-token",
+        }),
+        body: JSON.stringify(request),
+      }),
+    );
+    expect(fetch.mock.calls[0]![0]).not.toContain("private-token");
+    expect(fetch.mock.calls[0]![1].body).not.toContain("private-token");
+  });
+
+  it("rejects provisioning data that belongs to a different project", async () => {
+    vi.stubGlobal(
+      "fetch",
+      vi.fn().mockResolvedValue(
+        Response.json({
+          project_id: "other",
+          workspace_id: "workspace",
+          harness_id: "harness",
+          harness_origin: "https://harness.example.com",
+          api_origin: "https://project.example.com",
+          api_key: "server-key",
+        }),
+      ),
+    );
+    await expect(
+      provisionCloudHarness("https://cloud.example.com", "token", {
+        ...input,
+        idempotency_key: "id",
+      }),
+    ).rejects.toThrow("incomplete setup response");
+  });
+
+  it("rejects malformed credentials instead of writing invalid app settings", async () => {
+    vi.stubGlobal(
+      "fetch",
+      vi.fn().mockResolvedValue(
+        Response.json({
+          project_id: input.project_id,
+          workspace_id: "workspace",
+          harness_id: "harness",
+          harness_origin: "https://harness.example.com",
+          api_origin: "https://project.example.com",
+          api_key: 123,
+        }),
+      ),
+    );
+    await expect(
+      provisionCloudHarness("https://cloud.example.com", "token", {
+        ...input,
+        idempotency_key: "id",
+      }),
+    ).rejects.toThrow("incomplete setup response");
+  });
+});