avocavo 1.0.0

package/lib/auth-supabase.js

@@ -0,0 +1,718 @@
+const { createClient } = require('@supabase/supabase-js');
+const axios = require('axios');
+const chalk = require('chalk');
+const ora = require('ora');
+const open = require('open');
+const Conf = require('conf');
+const http = require('http');
+const url = require('url');
+const readline = require('readline');
+
+// Try to load keytar, fall back gracefully if unavailable
+let keytar;
+let keytarAvailable = false;
+try {
+  keytar = require('keytar');
+  keytarAvailable = true;
+} catch (error) {
+  console.warn(chalk.yellow('⚠️  Secure storage unavailable, using config file storage'));
+  keytarAvailable = false;
+}
+
+class SupabaseAuthManager {
+  constructor(baseUrl = 'https://app.avocavo.app') {
+    this.baseUrl = baseUrl.replace(/\/$/, '');
+    this.serviceName = 'avocavo-nutrition';
+    this.keytarAvailable = keytarAvailable;
+    
+    // Keep config for non-sensitive metadata
+    this.config = new Conf({
+      projectName: 'avocavo-nutrition',
+      configName: 'auth'
+    });
+
+    // Initialize Supabase client - get config from backend
+    this.supabaseConfig = null;
+    this.supabase = null;
+  }
+
+  async initializeSupabase() {
+    if (this.supabase) return true;
+    
+    try {
+      const spinner = ora('Getting Supabase configuration...').start();
+      const response = await axios.get(`${this.baseUrl}/api/auth/supabase-config`, { timeout: 10000 });
+      
+      if (!response.data.success) {
+        spinner.fail('Failed to get Supabase configuration');
+        console.error(chalk.red(`❌ ${response.data.error}`));
+        return false;
+      }
+      
+      this.supabaseConfig = response.data.config;
+      this.supabase = createClient(this.supabaseConfig.url, this.supabaseConfig.anon_key);
+      
+      spinner.succeed('Supabase configuration loaded');
+      return true;
+    } catch (error) {
+      console.error(chalk.red(`❌ Failed to initialize Supabase: ${error.message}`));
+      return false;
+    }
+  }
+
+  async login(provider = 'google') {
+    console.log(chalk.cyan(`🔐 Starting ${provider} OAuth login with Supabase...`));
+    
+    // Initialize Supabase client first
+    const initialized = await this.initializeSupabase();
+    if (!initialized) {
+      return false;
+    }
+    
+    try {
+      // Create a temporary local server to handle the OAuth callback
+      const server = await this.createCallbackServer();
+      const callbackUrl = `http://localhost:${server.port}/callback`;
+      
+      console.log(chalk.cyan('🌐 Opening browser for authentication...'));
+      
+      // Start OAuth flow with Supabase
+      // console.log(chalk.blue(`🔍 OAuth callback URL: ${callbackUrl}`)); // Debug only
+      const { data, error } = await this.supabase.auth.signInWithOAuth({
+        provider,
+        options: {
+          redirectTo: callbackUrl,
+          queryParams: {
+            access_type: 'offline',
+            prompt: 'consent',
+          }
+        }
+      });
+      
+      // console.log(chalk.blue(`🔍 OAuth URL: ${data?.url || 'No URL returned'}`)); // Debug only
+
+      if (error) {
+        console.error(chalk.red(`❌ OAuth initiation failed: ${error.message}`));
+        server.close();
+        return false;
+      }
+
+      if (data.url) {
+        try {
+          await open(data.url);
+        } catch (openError) {
+          console.log(chalk.yellow('⚠️  Could not open browser automatically'));
+          console.log(chalk.cyan(`Please manually open: ${data.url}`));
+        }
+      }
+
+      // Wait for the callback with shorter timeout 
+      const authResult = await Promise.race([
+        server.waitForCallback(),
+        new Promise((resolve) => {
+          setTimeout(() => {
+            resolve({ success: false, error: 'timeout', needsManualToken: true });
+          }, 10000); // 10 second timeout
+        })
+      ]);
+      
+      // Server should already be closed by successful callback, but ensure it's closed
+      try {
+        server.close();
+      } catch (e) {
+        // Server already closed
+      }
+
+      if (authResult.success) {
+        console.log(chalk.green(`✅ Login successful! Welcome ${authResult.user.email}`));
+        
+        // Store session data
+        await this.storeSession(authResult.session);
+        return true;
+      } else if (authResult.needsManualToken) {
+        console.log(chalk.yellow('\n⏰ Timeout waiting for callback. Trying manual token input...'));
+        return await this.handleManualTokenInput();
+      } else {
+        console.error(chalk.red(`❌ Login failed: ${authResult.error}`));
+        return false;
+      }
+
+    } catch (error) {
+      console.error(chalk.red(`❌ Login error: ${error.message}`));
+      return false;
+    }
+  }
+
+  async createCallbackServer() {
+    return new Promise((resolve, reject) => {
+      const server = http.createServer();
+      let callbackPromise;
+      let callbackResolve;
+      let callbackReject;
+
+      // Create a promise that will be resolved when we get the callback
+      const waitForCallback = () => {
+        if (!callbackPromise) {
+          callbackPromise = new Promise((resolve, reject) => {
+            callbackResolve = resolve;
+            callbackReject = reject;
+          });
+        }
+        return callbackPromise;
+      };
+
+      server.on('request', async (req, res) => {
+        const parsedUrl = url.parse(req.url, true);
+        // console.log(chalk.blue(`🔍 Callback received: ${req.url}`)); // Debug only
+        
+        if (parsedUrl.pathname === '/callback') {
+          const { code, error, error_description, access_token } = parsedUrl.query;
+          // console.log(chalk.blue(`🔍 OAuth callback - code: ${code ? 'present' : 'missing'}, token: ${access_token ? 'present' : 'missing'}, error: ${error || 'none'}`)); // Debug only
+          
+          // Send response to browser
+          res.writeHead(200, { 'Content-Type': 'text/html' });
+          
+          // If no query params, send HTML that can extract fragment tokens
+          if (!code && !access_token && !error) {
+            res.end(`
+              <html>
+                <head><title>OAuth Callback</title></head>
+                <body style="font-family: Arial, sans-serif; text-align: center; padding: 50px;">
+                  <h2>🔐 Processing Authentication...</h2>
+                  <p>Please wait while we complete your login.</p>
+                  <script>
+                    // Extract token from URL fragment and send to server
+                    const fragment = window.location.hash.substring(1);
+                    const params = new URLSearchParams(fragment);
+                    const access_token = params.get('access_token');
+                    const error = params.get('error');
+                    
+                    if (access_token) {
+                      // Send token to server as query parameter
+                      fetch('/callback?access_token=' + encodeURIComponent(access_token))
+                        .then(() => {
+                          document.body.innerHTML = '<h2 style="color: green;">✅ Authentication Successful!</h2><p>You can close this window and return to the terminal.</p>';
+                        })
+                        .catch(err => {
+                          document.body.innerHTML = '<h2 style="color: red;">❌ Authentication Failed</h2><p>Could not process token.</p>';
+                        });
+                    } else if (error) {
+                      fetch('/callback?error=' + encodeURIComponent(error))
+                        .then(() => {
+                          document.body.innerHTML = '<h2 style="color: red;">❌ Authentication Failed</h2><p>' + error + '</p>';
+                        });
+                    } else {
+                      document.body.innerHTML = '<h2 style="color: orange;">⚠️ No Authentication Data</h2><p>No token or error found in URL.</p>';
+                    }
+                  </script>
+                </body>
+              </html>
+            `);
+            return;
+          }
+          
+          if (error) {
+            res.end(`
+              <html>
+                <body style="font-family: Arial, sans-serif; text-align: center; padding: 50px;">
+                  <h2 style="color: red;">❌ Authentication Failed</h2>
+                  <p>${error_description || error}</p>
+                  <p>You can close this window.</p>
+                </body>
+              </html>
+            `);
+            callbackResolve({ success: false, error: error_description || error });
+          } else if (access_token) {
+            res.end(`
+              <html>
+                <body style="font-family: Arial, sans-serif; text-align: center; padding: 50px;">
+                  <h2 style="color: green;">✅ Authentication Successful!</h2>
+                  <p>Token received. You can close this window and return to the terminal.</p>
+                </body>
+              </html>
+            `);
+
+            try {
+              // Use the access token directly to get user info
+              // console.log(chalk.blue('🔍 Using access token from URL fragment...')); // Debug only
+              const tempSupabase = createClient(this.supabaseConfig.url, this.supabaseConfig.anon_key);
+              const { data: user, error } = await tempSupabase.auth.getUser(access_token);
+              
+              if (error || !user) {
+                // console.log(chalk.red(`🔍 Token verification failed: ${error?.message || 'Could not verify user'}`)); // Debug only
+                callbackResolve({ success: false, error: error?.message || 'Could not verify user' });
+              } else {
+                console.log(chalk.green('🔍 Token verification successful!'));
+                
+                // Create a session-like object
+                const mockSession = {
+                  access_token: access_token,
+                  user: user.user,
+                  expires_at: Math.floor(Date.now() / 1000) + 3600 // 1 hour from now
+                };
+                
+                // Close server immediately on success
+                setTimeout(() => server.close(), 100);
+                callbackResolve({ success: true, session: mockSession, user: user.user });
+              }
+            } catch (tokenError) {
+              console.log(chalk.red(`🔍 Token processing error: ${tokenError.message}`));
+              callbackResolve({ success: false, error: tokenError.message });
+            }
+          } else if (code) {
+            res.end(`
+              <html>
+                <body style="font-family: Arial, sans-serif; text-align: center; padding: 50px;">
+                  <h2 style="color: green;">✅ Authentication Successful!</h2>
+                  <p>You can close this window and return to the terminal.</p>
+                </body>
+              </html>
+            `);
+
+            try {
+              // Exchange code for session using Supabase
+              console.log(chalk.blue('🔍 Exchanging code for session...'));
+              const { data, error } = await this.supabase.auth.exchangeCodeForSession(code);
+              
+              if (error) {
+                console.log(chalk.red(`🔍 Token exchange failed: ${error.message}`));
+                callbackResolve({ success: false, error: error.message });
+              } else {
+                console.log(chalk.green('🔍 Token exchange successful!'));
+                // Close server immediately on success
+                setTimeout(() => server.close(), 100);
+                callbackResolve({ success: true, session: data.session, user: data.user });
+              }
+            } catch (exchangeError) {
+              console.log(chalk.red(`🔍 Token exchange error: ${exchangeError.message}`));
+              callbackResolve({ success: false, error: exchangeError.message });
+            }
+          } else {
+            res.end(`
+              <html>
+                <body style="font-family: Arial, sans-serif; text-align: center; padding: 50px;">
+                  <h2 style="color: orange;">⚠️ Incomplete Authentication</h2>
+                  <p>No authorization code received.</p>
+                </body>
+              </html>
+            `);
+            callbackResolve({ success: false, error: 'No authorization code received' });
+          }
+        } else {
+          res.writeHead(404);
+          res.end('Not found');
+        }
+      });
+
+      server.listen(0, 'localhost', () => {
+        const port = server.address().port;
+        // console.log(chalk.blue(`🔍 Callback server started on http://localhost:${port}/callback`)); // Debug only
+        resolve({
+          server,
+          port,
+          close: () => server.close(),
+          waitForCallback
+        });
+      });
+
+      server.on('error', reject);
+    });
+  }
+
+  async storeSession(session) {
+    const sessionData = {
+      userInfo: { 
+        email: session.user.email,
+        id: session.user.id
+      },
+      loginTime: Date.now(),
+      provider: 'supabase-oauth',
+      hasSupabaseSession: true,
+      usesSecureStorage: this.keytarAvailable
+    };
+
+    // Store session data in config
+    this.config.set('sessionData', sessionData);
+    this.config.set('isLoggedIn', true);
+
+    // Store JWT token securely
+    if (session.access_token) {
+      await this.storeJwtSecurely(session.user.email, session.access_token);
+    }
+
+    // Store refresh token securely
+    if (session.refresh_token) {
+      await this.storeRefreshTokenSecurely(session.user.email, session.refresh_token);
+    }
+  }
+
+  async storeJwtSecurely(email, jwtToken) {
+    if (this.keytarAvailable) {
+      try {
+        await keytar.setPassword(this.serviceName, `jwt_${email}`, jwtToken);
+        return true;
+      } catch (error) {
+        console.warn(chalk.yellow(`⚠️  Could not store JWT securely: ${error.message}`));
+        this.config.set('jwtToken', jwtToken);
+        return false;
+      }
+    } else {
+      this.config.set('jwtToken', jwtToken);
+      return false;
+    }
+  }
+
+  async storeRefreshTokenSecurely(email, refreshToken) {
+    if (this.keytarAvailable) {
+      try {
+        await keytar.setPassword(this.serviceName, `refresh_${email}`, refreshToken);
+        return true;
+      } catch (error) {
+        console.warn(chalk.yellow(`⚠️  Could not store refresh token securely: ${error.message}`));
+        this.config.set('refreshToken', refreshToken);
+        return false;
+      }
+    } else {
+      this.config.set('refreshToken', refreshToken);
+      return false;
+    }
+  }
+
+  async getJwtSecurely(email) {
+    if (this.keytarAvailable) {
+      try {
+        return await keytar.getPassword(this.serviceName, `jwt_${email}`);
+      } catch (error) {
+        return this.config.get('jwtToken');
+      }
+    } else {
+      return this.config.get('jwtToken');
+    }
+  }
+
+  async getRefreshTokenSecurely(email) {
+    if (this.keytarAvailable) {
+      try {
+        return await keytar.getPassword(this.serviceName, `refresh_${email}`);
+      } catch (error) {
+        return this.config.get('refreshToken');
+      }
+    } else {
+      return this.config.get('refreshToken');
+    }
+  }
+
+  isLoggedIn() {
+    return this.config.get('isLoggedIn', false);
+  }
+
+  getUserInfo() {
+    const sessionData = this.config.get('sessionData');
+    return sessionData?.userInfo || {};
+  }
+
+  async getApiKey() {
+    // For Supabase auth, we use JWT tokens instead of API keys
+    const sessionData = this.config.get('sessionData');
+    if (sessionData?.userInfo?.email) {
+      return await this.getJwtSecurely(sessionData.userInfo.email);
+    }
+    return null;
+  }
+
+  async getJwtToken() {
+    const sessionData = this.config.get('sessionData');
+    if (sessionData?.userInfo?.email) {
+      return await this.getJwtSecurely(sessionData.userInfo.email);
+    }
+    return null;
+  }
+
+  async getSelectedApiKey() {
+    // Get the selected/current API key (not JWT token)
+    const sessionData = this.config.get('sessionData');
+    if (sessionData?.userInfo?.email) {
+      if (this.keytarAvailable) {
+        try {
+          const key = await keytar.getPassword(this.serviceName, `api_${sessionData.userInfo.email}`);
+          if (key) {
+            if (process.env.AVOCAVO_DEBUG) {
+              console.log(chalk.green('[DEBUG] ✅ API key retrieved from OS keystore'));
+            }
+            return key;
+          } else {
+            if (process.env.AVOCAVO_DEBUG) {
+              console.log(chalk.yellow('[DEBUG] ⚠️ No key in keystore, checking config'));
+            }
+            // Fallback to encrypted config if keytar returns null
+            const encrypted = this.config.get('currentApiKey_encrypted');
+            if (encrypted) {
+              if (process.env.AVOCAVO_DEBUG) {
+                console.log(chalk.yellow('[DEBUG] 📁 Using config file storage'));
+              }
+              // Decrypt the API key
+              return Buffer.from(encrypted, 'base64').toString('utf8');
+            }
+          }
+        } catch (error) {
+          if (process.env.AVOCAVO_DEBUG) {
+            console.log(chalk.red(`[DEBUG] ❌ Keytar error: ${error.message}`));
+          }
+          // Fallback to encrypted config
+          const encrypted = this.config.get('currentApiKey_encrypted');
+          if (encrypted) {
+            return Buffer.from(encrypted, 'base64').toString('utf8');
+          }
+        }
+      } else {
+        if (process.env.AVOCAVO_DEBUG) {
+          console.log(chalk.red('[DEBUG] ❌ Keytar not available'));
+        }
+        // No keytar, use encrypted config
+        const encrypted = this.config.get('currentApiKey_encrypted');
+        if (encrypted) {
+          return Buffer.from(encrypted, 'base64').toString('utf8');
+        }
+      }
+    }
+    return null;
+  }
+
+  async logout() {
+    // Sign out from Supabase (if client is initialized)
+    try {
+      if (this.supabase) {
+        await this.supabase.auth.signOut();
+      }
+    } catch (error) {
+      console.warn(chalk.yellow(`⚠️ Could not sign out from Supabase: ${error.message}`));
+    }
+
+    // Remove stored credentials
+    const sessionData = this.config.get('sessionData');
+    if (sessionData?.userInfo?.email) {
+      const email = sessionData.userInfo.email;
+      
+      if (this.keytarAvailable) {
+        try {
+          await keytar.deletePassword(this.serviceName, `jwt_${email}`);
+          await keytar.deletePassword(this.serviceName, `refresh_${email}`);
+          await keytar.deletePassword(this.serviceName, `api_${email}`); // Delete API key too
+        } catch (error) {
+          // Continue cleanup
+        }
+      }
+    }
+
+    this.config.clear();
+    console.log(chalk.green('✅ Successfully logged out'));
+    
+    // DEBUG: Log stack trace to find duplicate logout
+    if (process.env.AVOCAVO_DEBUG) {
+      console.log('Logout called from:', new Error().stack);
+    }
+  }
+
+  // API key management methods - these will call the backend with JWT auth
+  async getJwtAuthHeaders() {
+    const jwtToken = await this.getJwtToken();
+    if (!jwtToken) {
+      throw new Error('Not logged in. Please login first.');
+    }
+
+    return {
+      'Authorization': `Bearer ${jwtToken}`,
+      'Content-Type': 'application/json'
+    };
+  }
+
+  async listApiKeys() {
+    try {
+      const headers = await this.getJwtAuthHeaders();
+      const response = await axios.get(`${this.baseUrl}/api/keys`, { headers, timeout: 30000 });
+      return response.data;
+    } catch (error) {
+      if (error.response?.status === 401) {
+        throw new Error('Session expired. Please login again.');
+      }
+      throw new Error(`Failed to list API keys: ${error.message}`);
+    }
+  }
+
+  async createApiKey(name = "CLI Key", description = null, environment = "development") {
+    try {
+      const headers = await this.getJwtAuthHeaders();
+      const data = {
+        key_name: name,
+        description: description || "Created via Supabase CLI",
+        environment: environment
+      };
+      
+      const response = await axios.post(`${this.baseUrl}/api/keys`, data, { headers, timeout: 30000 });
+      
+      // Auto-select the newly created key
+      if (response.data.success && response.data.key) {
+        const newKey = response.data.key;
+        console.log(chalk.cyan(`🔄 Auto-selecting your new API key: ${newKey.key_name}`));
+        await this.storeApiKeySecurely(this.config.get('sessionData')?.userInfo?.email, newKey.api_key);
+      }
+      
+      return response.data;
+    } catch (error) {
+      if (error.response?.status === 401) {
+        throw new Error('Session expired. Please login again.');
+      }
+      throw new Error(`Failed to create API key: ${error.message}`);
+    }
+  }
+
+  async switchApiKey(keyId) {
+    try {
+      const headers = await this.getJwtAuthHeaders();
+      const response = await axios.post(`${this.baseUrl}/api/keys/${keyId}/reveal`, {}, { headers, timeout: 30000 });
+      
+      if (response.data.success) {
+        const fullApiKey = response.data.api_key;
+        const keyName = response.data.key_name;
+        
+        // Store the selected API key
+        const sessionData = this.config.get('sessionData');
+        if (sessionData?.userInfo?.email) {
+          await this.storeApiKeySecurely(sessionData.userInfo.email, fullApiKey);
+        }
+        
+        console.log(chalk.green(`✅ Switched to API key: ${keyName}`));
+        return fullApiKey;
+      } else {
+        throw new Error(response.data.error || 'Failed to reveal API key');
+      }
+    } catch (error) {
+      throw new Error(`Failed to switch API key: ${error.message}`);
+    }
+  }
+
+  async autoSelectSingleKey() {
+    try {
+      const keysList = await this.listApiKeys();
+      if (keysList.keys && keysList.keys.length === 1) {
+        const singleKey = keysList.keys[0];
+        console.log(chalk.cyan(`🔄 Auto-selecting your only API key: ${singleKey.key_name}`));
+        return await this.switchApiKey(singleKey.id);
+      }
+      return null;
+    } catch (error) {
+      return null;
+    }
+  }
+
+  async refreshApiKeyLimits(keyId) {
+    try {
+      const headers = await this.getJwtAuthHeaders();
+      const response = await axios.post(`${this.baseUrl}/api/keys/${keyId}/refresh-limits`, {}, { headers, timeout: 30000 });
+      
+      if (response.data.success) {
+        console.log(chalk.green(`✅ Updated limits: ${response.data.old_limit} → ${response.data.new_limit}`));
+        return response.data;
+      } else {
+        throw new Error(response.data.error || 'Failed to refresh limits');
+      }
+    } catch (error) {
+      throw new Error(`Failed to refresh API key limits: ${error.message}`);
+    }
+  }
+
+  async storeApiKeySecurely(email, apiKey) {
+    if (this.keytarAvailable) {
+      try {
+        await keytar.setPassword(this.serviceName, `api_${email}`, apiKey);
+        // Clear any plain text version
+        this.config.delete('currentApiKey');
+        this.config.delete('currentApiKey_encrypted');
+        this.config.delete('insecureStorage');
+        
+        // Debug logging
+        if (process.env.AVOCAVO_DEBUG) {
+          console.log(chalk.green('[DEBUG] ✅ API key stored in OS keystore'));
+        }
+        return true;
+      } catch (error) {
+        if (process.env.AVOCAVO_DEBUG) {
+          console.log(chalk.red(`[DEBUG] ❌ Keytar failed: ${error.message}`));
+        }
+        // Encrypt API key before storing (basic obfuscation)
+        const encrypted = Buffer.from(apiKey).toString('base64');
+        this.config.set('currentApiKey_encrypted', encrypted);
+        this.config.set('insecureStorage', true);
+        return false;
+      }
+    } else {
+      if (process.env.AVOCAVO_DEBUG) {
+        console.log(chalk.red('[DEBUG] ❌ Keytar not available'));
+      }
+      // Encrypt API key before storing (basic obfuscation)
+      const encrypted = Buffer.from(apiKey).toString('base64');
+      this.config.set('currentApiKey_encrypted', encrypted);
+      this.config.set('insecureStorage', true);
+      return false;
+    }
+  }
+
+  async handleManualTokenInput() {
+    console.log(chalk.cyan('\n🔧 Manual Token Input'));
+    console.log(chalk.yellow('If you were redirected to nutrition.avocavo.app after logging in:'));
+    console.log(chalk.yellow('1. Look at the URL in your browser'));
+    console.log(chalk.yellow('2. Find the part that says #access_token='));
+    console.log(chalk.yellow('3. Copy ONLY the token part (after #access_token= and before &)'));
+    console.log(chalk.yellow('4. Paste it below:'));
+    
+    const rl = readline.createInterface({
+      input: process.stdin,
+      output: process.stdout
+    });
+    
+    return new Promise((resolve) => {
+      rl.question(chalk.blue('\nPaste your access token here: '), async (token) => {
+        rl.close();
+        
+        if (!token || token.trim().length === 0) {
+          console.log(chalk.red('❌ No token provided'));
+          resolve(false);
+          return;
+        }
+        
+        token = token.trim();
+        
+        try {
+          // Verify token by getting user info from Supabase
+          const tempSupabase = createClient(this.supabaseConfig.url, this.supabaseConfig.anon_key);
+          const { data: user, error } = await tempSupabase.auth.getUser(token);
+          
+          if (error || !user) {
+            console.log(chalk.red(`❌ Invalid token: ${error?.message || 'Could not verify user'}`));
+            resolve(false);
+            return;
+          }
+          
+          // Create a session-like object
+          const mockSession = {
+            access_token: token,
+            user: user.user,
+            expires_at: Math.floor(Date.now() / 1000) + 3600 // 1 hour from now
+          };
+          
+          console.log(chalk.green(`✅ Token verified! Welcome ${user.user.email}`));
+          
+          // Store session data
+          await this.storeSession(mockSession);
+          resolve(true);
+          
+        } catch (error) {
+          console.log(chalk.red(`❌ Token verification failed: ${error.message}`));
+          resolve(false);
+        }
+      });
+    });
+  }
+}
+
+module.exports = { SupabaseAuthManager };