berget 2.1.2 → 2.2.1

package/dist/src/services/auth-service.js

@@ -41,6 +41,30 @@ const client_1 = require("../client");
 const chalk_1 = __importDefault(require("chalk"));
 const error_handler_1 = require("../utils/error-handler");
 const command_structure_1 = require("../constants/command-structure");
+const http = __importStar(require("http"));
+const crypto = __importStar(require("crypto"));
+const url = __importStar(require("url"));
+// Keycloak configuration based on environment
+const isStageMode = process.argv.includes('--stage');
+const isLocalMode = process.argv.includes('--local');
+const KEYCLOAK_URL = (isStageMode || isLocalMode)
+    ? 'https://keycloak.stage.berget.ai'
+    : 'https://keycloak.berget.ai';
+const KEYCLOAK_REALM = 'berget';
+const KEYCLOAK_CLIENT_ID = 'berget-code';
+const CALLBACK_PORT = 8787;
+/**
+ * Generate a random string for PKCE code_verifier
+ */
+function generateCodeVerifier() {
+    return crypto.randomBytes(32).toString('base64url');
+}
+/**
+ * Generate code_challenge from code_verifier using S256 method
+ */
+function generateCodeChallenge(verifier) {
+    return crypto.createHash('sha256').update(verifier).digest('base64url');
+}
 /**
  * Service for authentication operations
  * Command group: auth
@@ -58,7 +82,9 @@ class AuthService {
     whoami() {
         return __awaiter(this, void 0, void 0, function* () {
             try {
-                const { data: profile, error } = yield this.client.GET('/v1/users/me');
+                // Create fresh client to ensure we have the latest token
+                const client = (0, client_1.createAuthenticatedClient)();
+                const { data: profile, error } = yield client.GET('/v1/users/me');
                 if (error) {
                     return null;
                 }
@@ -75,126 +101,267 @@ class AuthService {
                 // Clear any existing token to ensure a fresh login
                 (0, client_1.clearAuthToken)();
                 console.log(chalk_1.default.blue('Initiating login process...'));
-                // Step 1: Initiate device authorization
-                const { data: deviceData, error: deviceError } = yield client_1.apiClient.POST('/v1/auth/device', {});
-                if (deviceError || !deviceData) {
-                    throw new Error(deviceError
-                        ? JSON.stringify(deviceError)
-                        : 'Failed to get device authorization data');
-                }
-                // Type assertion for deviceData
-                const typedDeviceData = deviceData;
-                // Display information to user
-                console.log(chalk_1.default.cyan('\nTo complete login:'));
-                console.log(chalk_1.default.cyan(`1. Open this URL: ${chalk_1.default.bold(typedDeviceData.verification_url ||
-                    'https://keycloak.berget.ai/device')}`));
-                if (!typedDeviceData.verification_url)
-                    console.log(chalk_1.default.cyan(`2. Enter this code: ${chalk_1.default.bold(typedDeviceData.user_code || '')}\n`));
-                // Try to open browser automatically
-                try {
-                    if (typedDeviceData.verification_url) {
-                        // Use dynamic import for the 'open' package
-                        const open = yield Promise.resolve().then(() => __importStar(require('open'))).then((m) => m.default);
-                        yield open(typedDeviceData.verification_url);
-                        console.log(chalk_1.default.dim("Browser opened automatically. If it didn't open, please use the URL above."));
+                // Generate PKCE code verifier and challenge
+                const codeVerifier = generateCodeVerifier();
+                const codeChallenge = generateCodeChallenge(codeVerifier);
+                const state = crypto.randomBytes(16).toString('hex');
+                const redirectUri = `http://localhost:${CALLBACK_PORT}/callback`;
+                // Build authorization URL
+                const authUrl = new URL(`${KEYCLOAK_URL}/realms/${KEYCLOAK_REALM}/protocol/openid-connect/auth`);
+                authUrl.searchParams.set('client_id', KEYCLOAK_CLIENT_ID);
+                authUrl.searchParams.set('response_type', 'code');
+                authUrl.searchParams.set('redirect_uri', redirectUri);
+                authUrl.searchParams.set('scope', 'openid email profile');
+                authUrl.searchParams.set('state', state);
+                authUrl.searchParams.set('code_challenge', codeChallenge);
+                authUrl.searchParams.set('code_challenge_method', 'S256');
+                // Create a promise that resolves when we receive the callback
+                const authResult = yield new Promise((resolve) => {
+                    const server = http.createServer((req, res) => __awaiter(this, void 0, void 0, function* () {
+                        const parsedUrl = url.parse(req.url || '', true);
+                        if (parsedUrl.pathname === '/callback') {
+                            const receivedState = parsedUrl.query.state;
+                            const code = parsedUrl.query.code;
+                            const error = parsedUrl.query.error;
+                            const errorPage = (title, message) => `
+              <!DOCTYPE html>
+              <html lang="en">
+                <head>
+                  <meta charset="UTF-8">
+                  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+                  <title>Berget - Authentication Failed</title>
+                  <style>
+                    * { margin: 0; padding: 0; box-sizing: border-box; }
+                    body {
+                      font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Oxygen, Ubuntu, sans-serif;
+                      display: flex;
+                      justify-content: center;
+                      align-items: center;
+                      min-height: 100vh;
+                      background: linear-gradient(135deg, #0f0f1a 0%, #1a1a2e 50%, #16213e 100%);
+                      color: #fff;
                     }
-                }
-                catch (error) {
-                    console.log(chalk_1.default.yellow('Could not open browser automatically. Please open the URL manually.'));
-                }
-                console.log(chalk_1.default.dim('\nWaiting for authentication to complete...'));
-                // Step 2: Poll for completion
-                const startTime = Date.now();
-                const expiresIn = typedDeviceData.expires_in !== undefined
-                    ? typedDeviceData.expires_in
-                    : 900;
-                const expiresAt = startTime + expiresIn * 1000;
-                let pollInterval = (typedDeviceData.interval || 5) * 1000;
-                const spinner = ['⠋', '⠙', '⠹', '⠸', '⠼', '⠴', '⠦', '⠧', '⠇', '⠏'];
-                let spinnerIdx = 0;
-                while (Date.now() < expiresAt) {
-                    // Wait for the polling interval
-                    yield new Promise((resolve) => setTimeout(resolve, pollInterval));
-                    // Update spinner
-                    process.stdout.write(`\r${chalk_1.default.blue(spinner[spinnerIdx])} Waiting for authentication...`);
-                    spinnerIdx = (spinnerIdx + 1) % spinner.length;
-                    // Check if authentication is complete
-                    const deviceCode = typedDeviceData.device_code || '';
-                    const { data: tokenData, error: tokenError } = yield client_1.apiClient.POST('/v1/auth/device/token', {
-                        body: {
-                            device_code: deviceCode,
-                        },
-                    });
-                    if (tokenError) {
-                        // Parse the error to get status and other details
-                        const errorObj = typeof tokenError === 'string' ? JSON.parse(tokenError) : tokenError;
-                        const status = errorObj.status || 0;
-                        const errorCode = errorObj.code || '';
-                        if (status === 401 || errorCode === 'AUTHORIZATION_PENDING') {
-                            // Still waiting for user to complete authorization
-                            continue;
-                        }
-                        else if (status === 429) {
-                            // Slow down
-                            pollInterval *= 2;
-                            continue;
-                        }
-                        else if (status === 400) {
-                            // Error or expired
-                            if (errorCode === 'EXPIRED_TOKEN') {
-                                console.log(chalk_1.default.red('\n\nAuthentication timed out. Please try again.'));
-                            }
-                            else if (errorCode !== 'AUTHORIZATION_PENDING') {
-                                // Only show error if it's not the expected "still waiting" error
-                                const errorMessage = errorObj.message || JSON.stringify(errorObj);
-                                console.log(chalk_1.default.red(`\n\nError: ${errorMessage}`));
-                                return false;
+                    .container {
+                      text-align: center;
+                      padding: 3rem;
+                      max-width: 400px;
+                    }
+                    .icon {
+                      width: 80px;
+                      height: 80px;
+                      background: linear-gradient(135deg, #f87171 0%, #ef4444 100%);
+                      border-radius: 50%;
+                      display: flex;
+                      align-items: center;
+                      justify-content: center;
+                      margin: 0 auto 1.5rem;
+                      box-shadow: 0 4px 20px rgba(248, 113, 113, 0.3);
+                    }
+                    .icon svg {
+                      width: 40px;
+                      height: 40px;
+                      stroke: #fff;
+                      stroke-width: 3;
+                    }
+                    h1 {
+                      font-size: 1.5rem;
+                      font-weight: 600;
+                      margin-bottom: 0.75rem;
+                      color: #fff;
+                    }
+                    p {
+                      color: #94a3b8;
+                      font-size: 0.95rem;
+                      line-height: 1.5;
+                    }
+                    .brand {
+                      margin-top: 2rem;
+                      opacity: 0.5;
+                      font-size: 0.8rem;
+                      letter-spacing: 0.05em;
+                    }
+                  </style>
+                </head>
+                <body>
+                  <div class="container">
+                    <div class="icon">
+                      <svg viewBox="0 0 24 24" fill="none" stroke="currentColor">
+                        <line x1="18" y1="6" x2="6" y2="18"></line>
+                        <line x1="6" y1="6" x2="18" y2="18"></line>
+                      </svg>
+                    </div>
+                    <h1>${title}</h1>
+                    <p>${message}</p>
+                    <div class="brand">BERGET</div>
+                  </div>
+                </body>
+              </html>
+            `;
+                            if (error) {
+                                res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+                                res.end(errorPage('Authentication Failed', String(parsedUrl.query.error_description || error)));
+                                server.close();
+                                resolve({ success: false, error });
+                                return;
                             }
-                            else {
-                                // If it's AUTHORIZATION_PENDING, continue polling
-                                continue;
+                            if (receivedState !== state) {
+                                res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+                                res.end(errorPage('Authentication Failed', 'Invalid state parameter. Please try again.'));
+                                server.close();
+                                resolve({ success: false, error: 'Invalid state parameter' });
+                                return;
                             }
-                            return false;
+                            res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+                            res.end(`
+              <!DOCTYPE html>
+              <html lang="en">
+                <head>
+                  <meta charset="UTF-8">
+                  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+                  <title>Berget - Authentication Successful</title>
+                  <style>
+                    * { margin: 0; padding: 0; box-sizing: border-box; }
+                    body {
+                      font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Oxygen, Ubuntu, sans-serif;
+                      display: flex;
+                      justify-content: center;
+                      align-items: center;
+                      min-height: 100vh;
+                      background: linear-gradient(135deg, #0f0f1a 0%, #1a1a2e 50%, #16213e 100%);
+                      color: #fff;
+                    }
+                    .container {
+                      text-align: center;
+                      padding: 3rem;
+                      max-width: 400px;
+                    }
+                    .icon {
+                      width: 80px;
+                      height: 80px;
+                      background: linear-gradient(135deg, #4ade80 0%, #22c55e 100%);
+                      border-radius: 50%;
+                      display: flex;
+                      align-items: center;
+                      justify-content: center;
+                      margin: 0 auto 1.5rem;
+                      box-shadow: 0 4px 20px rgba(74, 222, 128, 0.3);
+                    }
+                    .icon svg {
+                      width: 40px;
+                      height: 40px;
+                      stroke: #fff;
+                      stroke-width: 3;
+                    }
+                    h1 {
+                      font-size: 1.5rem;
+                      font-weight: 600;
+                      margin-bottom: 0.75rem;
+                      color: #fff;
+                    }
+                    p {
+                      color: #94a3b8;
+                      font-size: 0.95rem;
+                      line-height: 1.5;
+                    }
+                    .brand {
+                      margin-top: 2rem;
+                      opacity: 0.5;
+                      font-size: 0.8rem;
+                      letter-spacing: 0.05em;
+                    }
+                  </style>
+                </head>
+                <body>
+                  <div class="container">
+                    <div class="icon">
+                      <svg viewBox="0 0 24 24" fill="none" stroke="currentColor">
+                        <polyline points="20 6 9 17 4 12"></polyline>
+                      </svg>
+                    </div>
+                    <h1>Authentication Successful</h1>
+                    <p>You can close this window and return to your terminal.</p>
+                    <div class="brand">BERGET</div>
+                  </div>
+                </body>
+              </html>
+            `);
+                            server.close();
+                            resolve({ success: true, code });
                         }
-                        else {
-                            // For any other error, log it but continue polling
-                            // This makes the flow more resilient to temporary issues
-                            if (process.env.DEBUG) {
-                                console.log(chalk_1.default.yellow(`\n\nReceived error: ${JSON.stringify(errorObj)}`));
-                                console.log(chalk_1.default.yellow('Continuing to wait for authentication...'));
-                                process.stdout.write(`\r${chalk_1.default.blue(spinner[spinnerIdx])} Waiting for authentication...`);
-                            }
-                            continue;
+                    }));
+                    server.listen(CALLBACK_PORT, () => {
+                        if (process.argv.includes('--debug')) {
+                            console.log(chalk_1.default.dim(`Callback server listening on port ${CALLBACK_PORT}`));
                         }
-                    }
-                    else if (tokenData) {
-                        // Type assertion for tokenData
-                        const typedTokenData = tokenData;
-                        if (typedTokenData.token) {
-                            // Success!
-                            (0, client_1.saveAuthToken)(typedTokenData.token, typedTokenData.refresh_token || '', typedTokenData.expires_in || 3600);
-                            if (process.argv.includes('--debug')) {
-                                console.log(chalk_1.default.yellow('DEBUG: Token data received:'));
-                                console.log(chalk_1.default.yellow(JSON.stringify({
-                                    expires_in: typedTokenData.expires_in,
-                                    refresh_expires_in: typedTokenData.refresh_expires_in,
-                                }, null, 2)));
-                            }
-                            process.stdout.write('\r' + ' '.repeat(50) + '\r'); // Clear the spinner line
-                            console.log(chalk_1.default.green('✓ Successfully logged in to Berget'));
-                            if (typedTokenData.user) {
-                                const user = typedTokenData.user;
-                                console.log(chalk_1.default.green(`Logged in as ${user.name || user.email || 'User'}`));
-                            }
-                            console.log(chalk_1.default.cyan('\nNext steps:'));
-                            console.log(chalk_1.default.cyan('  • Create an API key: berget api-keys create'));
-                            console.log(chalk_1.default.cyan('  • Setup OpenCode: berget code init'));
-                            return true;
+                    });
+                    // Set timeout for the server
+                    setTimeout(() => {
+                        server.close();
+                        resolve({ success: false, error: 'Authentication timed out' });
+                    }, 5 * 60 * 1000) // 5 minute timeout
+                    ;
+                    (() => __awaiter(this, void 0, void 0, function* () {
+                        try {
+                            const open = yield Promise.resolve().then(() => __importStar(require('open'))).then((m) => m.default);
+                            yield open(authUrl.toString());
+                            console.log(chalk_1.default.dim('Browser opened for authentication...'));
+                        }
+                        catch (_a) {
+                            console.log(chalk_1.default.cyan('\nPlease open this URL in your browser:'));
+                            console.log(chalk_1.default.bold(authUrl.toString()));
                         }
+                    }))();
+                });
+                if (!authResult.success || !authResult.code) {
+                    console.log(chalk_1.default.red(`\nAuthentication failed: ${authResult.error || 'Unknown error'}`));
+                    return false;
+                }
+                // Exchange authorization code for tokens
+                console.log(chalk_1.default.dim('Exchanging authorization code for tokens...'));
+                const tokenUrl = `${KEYCLOAK_URL}/realms/${KEYCLOAK_REALM}/protocol/openid-connect/token`;
+                const tokenResponse = yield fetch(tokenUrl, {
+                    method: 'POST',
+                    headers: {
+                        'Content-Type': 'application/x-www-form-urlencoded',
+                    },
+                    body: new URLSearchParams({
+                        grant_type: 'authorization_code',
+                        client_id: KEYCLOAK_CLIENT_ID,
+                        code: authResult.code,
+                        redirect_uri: redirectUri,
+                        code_verifier: codeVerifier,
+                    }).toString(),
+                });
+                if (!tokenResponse.ok) {
+                    const errorText = yield tokenResponse.text();
+                    console.log(chalk_1.default.red(`\nFailed to exchange code for tokens: ${errorText}`));
+                    return false;
+                }
+                const tokenData = (yield tokenResponse.json());
+                // Save tokens
+                (0, client_1.saveAuthToken)(tokenData.access_token, tokenData.refresh_token, tokenData.expires_in);
+                if (process.argv.includes('--debug')) {
+                    console.log(chalk_1.default.yellow('DEBUG: Token data received:'));
+                    console.log(chalk_1.default.yellow(JSON.stringify({
+                        expires_in: tokenData.expires_in,
+                        refresh_expires_in: tokenData.refresh_expires_in,
+                    }, null, 2)));
+                }
+                console.log(chalk_1.default.green('\n✓ Successfully logged in to Berget'));
+                // Try to get user info
+                try {
+                    const profile = yield this.whoami();
+                    if (profile === null || profile === void 0 ? void 0 : profile.email) {
+                        console.log(chalk_1.default.green(`Logged in as ${profile.name || profile.email}`));
                     }
                 }
-                console.log(chalk_1.default.red('\n\nAuthentication timed out. Please try again.'));
-                return false;
+                catch (_a) {
+                    // Ignore errors fetching profile
+                }
+                console.log(chalk_1.default.cyan('\nNext steps:'));
+                console.log(chalk_1.default.cyan('  • Create an API key: berget api-keys create'));
+                console.log(chalk_1.default.cyan('  • Setup OpenCode: berget code init'));
+                return true;
             }
             catch (error) {
                 (0, error_handler_1.handleError)('Login failed', error);

package/dist/src/utils/token-manager.js

@@ -104,18 +104,23 @@ class TokenManager {
     }
     /**
      * Check if the access token is expired
-     * @returns true if expired or about to expire (within 5 minutes), false otherwise
+     * @returns true if expired or about to expire (within 10% of lifetime or 30 seconds), false otherwise
      */
     isTokenExpired() {
         if (!this.tokenData || !this.tokenData.expires_at)
             return true;
         try {
-            // Consider token expired if it's within 10 minutes of expiration
-            // Using a larger buffer to be more proactive about refreshing
-            const expirationBuffer = 10 * 60 * 1000; // 10 minutes in milliseconds
-            const isExpired = Date.now() + expirationBuffer >= this.tokenData.expires_at;
+            const now = Date.now();
+            const expiresAt = this.tokenData.expires_at;
+            const timeUntilExpiry = expiresAt - now;
+            // Use 10% of remaining lifetime or 30 seconds, whichever is smaller
+            // This ensures we don't refresh tokens that were just issued
+            const minBuffer = 30 * 1000; // 30 seconds minimum
+            const percentBuffer = timeUntilExpiry * 0.1; // 10% of lifetime
+            const expirationBuffer = Math.min(minBuffer, percentBuffer);
+            const isExpired = now + expirationBuffer >= expiresAt;
             if (isExpired) {
-                logger_1.logger.debug(`Token expired or expiring soon. Current time: ${new Date().toISOString()}, Expiry: ${new Date(this.tokenData.expires_at).toISOString()}`);
+                logger_1.logger.debug(`Token expired or expiring soon. Current time: ${new Date().toISOString()}, Expiry: ${new Date(expiresAt).toISOString()}`);
             }
             return isExpired;
         }

package/index.ts

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-import { program } from 'commander'
+import { program, Option } from 'commander'
 import { registerCommands } from './src/commands'
 import { checkBergetConfig } from './src/utils/config-checker'
 import chalk from 'chalk'
@@ -23,7 +23,8 @@ program
 Version: ${version}`
   )
   .version(version, '-v, --version')
-  .option('--local', 'Use local API endpoint (hidden)', false)
+  .addOption(new Option('--local').default(false).hideHelp())
+  .addOption(new Option('--stage').default(false).hideHelp())
   .option('--debug', 'Enable debug output', false)
 
 // Register all commands

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "berget",
-  "version": "2.1.2",
+  "version": "2.2.1",
   "main": "dist/index.js",
   "bin": {
     "berget": "dist/index.js"

package/src/client.ts

@@ -9,13 +9,20 @@ import { logger } from './utils/logger'
 
 // API Base URL
 // Use --local flag to test against local API
+// Use --stage flag to test against stage API
 const isLocalMode = process.argv.includes('--local')
+const isStageMode = process.argv.includes('--stage')
+
 export const API_BASE_URL =
   process.env.BERGET_API_URL ||
-  (isLocalMode ? 'http://localhost:3000' : 'https://api.berget.ai')
+  (isLocalMode ? 'http://localhost:3000' :
+   isStageMode ? 'https://api.stage.berget.ai' :
+   'https://api.berget.ai') // production default
 
 if (isLocalMode && !process.env.BERGET_API_URL) {
   logger.debug('Using local API endpoint: http://localhost:3000')
+} else if (isStageMode && !process.env.BERGET_API_URL) {
+  logger.debug('Using stage API endpoint: https://api.stage.berget.ai')
 }
 
 // Create a typed client for the Berget API
@@ -209,6 +216,13 @@ export const createAuthenticatedClient = () => {
   })
 }
 
+// Keycloak configuration for token refresh (must match auth-service.ts)
+const KEYCLOAK_URL = (isStageMode || isLocalMode)
+  ? 'https://keycloak.stage.berget.ai'
+  : 'https://keycloak.berget.ai'
+const KEYCLOAK_REALM = 'berget'
+const KEYCLOAK_CLIENT_ID = 'berget-code'
+
 // Helper function to refresh the access token
 async function refreshAccessToken(
   tokenManager: TokenManager,
@@ -219,16 +233,22 @@ async function refreshAccessToken(
 
     logger.debug('Attempting to refresh access token')
 
-    // Use fetch directly since this endpoint might not be in the OpenAPI spec
+    // Refresh directly against Keycloak (berget-code is a public PKCE client)
     try {
-      const response = await fetch(`${API_BASE_URL}/v1/auth/refresh`, {
-        method: 'POST',
-        headers: {
-          'Content-Type': 'application/json',
-          Accept: 'application/json',
+      const response = await fetch(
+        `${KEYCLOAK_URL}/realms/${KEYCLOAK_REALM}/protocol/openid-connect/token`,
+        {
+          method: 'POST',
+          headers: {
+            'Content-Type': 'application/x-www-form-urlencoded',
+          },
+          body: new URLSearchParams({
+            grant_type: 'refresh_token',
+            client_id: KEYCLOAK_CLIENT_ID,
+            refresh_token: refreshToken,
+          }),
         },
-        body: JSON.stringify({ refresh_token: refreshToken }),
-      })
+      )
 
       // Handle HTTP errors
       if (!response.ok) {