berget 2.2.6 → 2.2.7

package/dist/src/services/auth-service.js

@@ -1,27 +1,4 @@
 "use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || function (mod) {
-    if (mod && mod.__esModule) return mod;
-    var result = {};
-    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
-    __setModuleDefault(result, mod);
-    return result;
-};
 var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
     function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
     return new (P || (P = Promise))(function (resolve, reject) {
@@ -37,42 +14,32 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AuthService = void 0;
 const client_1 = require("../client");
-// We'll use dynamic import for 'open' to support ESM modules in CommonJS
 const chalk_1 = __importDefault(require("chalk"));
 const error_handler_1 = require("../utils/error-handler");
 const command_structure_1 = require("../constants/command-structure");
-const http = __importStar(require("http"));
-const crypto = __importStar(require("crypto"));
-const url = __importStar(require("url"));
+const browser_auth_1 = require("./browser-auth");
 // Keycloak configuration based on environment
-const isStageMode = process.argv.includes('--stage');
-const isLocalMode = process.argv.includes('--local');
-const KEYCLOAK_URL = (isStageMode || isLocalMode)
-    ? 'https://keycloak.stage.berget.ai'
-    : 'https://keycloak.berget.ai';
-const KEYCLOAK_REALM = 'berget';
-const KEYCLOAK_CLIENT_ID = 'berget-code';
+const isStageMode = process.argv.includes("--stage");
+const isLocalMode = process.argv.includes("--local");
+const KEYCLOAK_URL = isStageMode || isLocalMode ? "https://keycloak.stage.berget.ai" : "https://keycloak.berget.ai";
+const KEYCLOAK_REALM = "berget";
+const KEYCLOAK_CLIENT_ID = "berget-code";
 const CALLBACK_PORT = 8787;
-/**
- * Generate a random string for PKCE code_verifier
- */
-function generateCodeVerifier() {
-    return crypto.randomBytes(32).toString('base64url');
-}
-/**
- * Generate code_challenge from code_verifier using S256 method
- */
-function generateCodeChallenge(verifier) {
-    return crypto.createHash('sha256').update(verifier).digest('base64url');
+function makeBrowserAuth(debug) {
+    return new browser_auth_1.BrowserAuth({
+        keycloakUrl: KEYCLOAK_URL,
+        realm: KEYCLOAK_REALM,
+        clientId: KEYCLOAK_CLIENT_ID,
+        callbackPort: CALLBACK_PORT,
+        debug,
+    });
 }
 /**
  * Service for authentication operations
  * Command group: auth
  */
 class AuthService {
-    constructor() {
-        this.client = (0, client_1.createAuthenticatedClient)();
-    }
+    constructor() { }
     static getInstance() {
         if (!AuthService.instance) {
             AuthService.instance = new AuthService();
@@ -84,271 +51,41 @@ class AuthService {
             try {
                 // Create fresh client to ensure we have the latest token
                 const client = (0, client_1.createAuthenticatedClient)();
-                const { data: profile, error } = yield client.GET('/v1/users/me');
+                const { data: profile, error } = yield client.GET("/v1/users/me");
                 if (error) {
                     return null;
                 }
                 return profile;
             }
-            catch (error) {
+            catch (_a) {
                 return null;
             }
         });
     }
+    /**
+     * Browser-based PKCE login for interactive CLI use.
+     * Prints status to stdout/stderr. Use loginInteractive() when you need
+     * a silent, UI-agnostic result (e.g. inside the setup wizard).
+     */
     login() {
         return __awaiter(this, void 0, void 0, function* () {
             try {
-                // Clear any existing token to ensure a fresh login
                 (0, client_1.clearAuthToken)();
-                console.log(chalk_1.default.blue('Initiating login process...'));
-                // Generate PKCE code verifier and challenge
-                const codeVerifier = generateCodeVerifier();
-                const codeChallenge = generateCodeChallenge(codeVerifier);
-                const state = crypto.randomBytes(16).toString('hex');
-                const redirectUri = `http://localhost:${CALLBACK_PORT}/callback`;
-                // Build authorization URL
-                const authUrl = new URL(`${KEYCLOAK_URL}/realms/${KEYCLOAK_REALM}/protocol/openid-connect/auth`);
-                authUrl.searchParams.set('client_id', KEYCLOAK_CLIENT_ID);
-                authUrl.searchParams.set('response_type', 'code');
-                authUrl.searchParams.set('redirect_uri', redirectUri);
-                authUrl.searchParams.set('scope', 'openid email profile');
-                authUrl.searchParams.set('state', state);
-                authUrl.searchParams.set('code_challenge', codeChallenge);
-                authUrl.searchParams.set('code_challenge_method', 'S256');
-                // Create a promise that resolves when we receive the callback
-                const authResult = yield new Promise((resolve) => {
-                    const server = http.createServer((req, res) => __awaiter(this, void 0, void 0, function* () {
-                        const parsedUrl = url.parse(req.url || '', true);
-                        if (parsedUrl.pathname === '/callback') {
-                            const receivedState = parsedUrl.query.state;
-                            const code = parsedUrl.query.code;
-                            const error = parsedUrl.query.error;
-                            const errorPage = (title, message) => `
-              <!DOCTYPE html>
-              <html lang="en">
-                <head>
-                  <meta charset="UTF-8">
-                  <meta name="viewport" content="width=device-width, initial-scale=1.0">
-                  <title>Berget - Authentication Failed</title>
-                  <style>
-                    * { margin: 0; padding: 0; box-sizing: border-box; }
-                    body {
-                      font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Oxygen, Ubuntu, sans-serif;
-                      display: flex;
-                      justify-content: center;
-                      align-items: center;
-                      min-height: 100vh;
-                      background: linear-gradient(135deg, #0f0f1a 0%, #1a1a2e 50%, #16213e 100%);
-                      color: #fff;
-                    }
-                    .container {
-                      text-align: center;
-                      padding: 3rem;
-                      max-width: 400px;
-                    }
-                    .icon {
-                      width: 80px;
-                      height: 80px;
-                      background: linear-gradient(135deg, #f87171 0%, #ef4444 100%);
-                      border-radius: 50%;
-                      display: flex;
-                      align-items: center;
-                      justify-content: center;
-                      margin: 0 auto 1.5rem;
-                      box-shadow: 0 4px 20px rgba(248, 113, 113, 0.3);
-                    }
-                    .icon svg {
-                      width: 40px;
-                      height: 40px;
-                      stroke: #fff;
-                      stroke-width: 3;
-                    }
-                    h1 {
-                      font-size: 1.5rem;
-                      font-weight: 600;
-                      margin-bottom: 0.75rem;
-                      color: #fff;
-                    }
-                    p {
-                      color: #94a3b8;
-                      font-size: 0.95rem;
-                      line-height: 1.5;
-                    }
-                    .brand {
-                      margin-top: 2rem;
-                      opacity: 0.5;
-                      font-size: 0.8rem;
-                      letter-spacing: 0.05em;
-                    }
-                  </style>
-                </head>
-                <body>
-                  <div class="container">
-                    <div class="icon">
-                      <svg viewBox="0 0 24 24" fill="none" stroke="currentColor">
-                        <line x1="18" y1="6" x2="6" y2="18"></line>
-                        <line x1="6" y1="6" x2="18" y2="18"></line>
-                      </svg>
-                    </div>
-                    <h1>${title}</h1>
-                    <p>${message}</p>
-                    <div class="brand">BERGET</div>
-                  </div>
-                </body>
-              </html>
-            `;
-                            if (error) {
-                                res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
-                                res.end(errorPage('Authentication Failed', String(parsedUrl.query.error_description || error)));
-                                server.close();
-                                resolve({ success: false, error });
-                                return;
-                            }
-                            if (receivedState !== state) {
-                                res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
-                                res.end(errorPage('Authentication Failed', 'Invalid state parameter. Please try again.'));
-                                server.close();
-                                resolve({ success: false, error: 'Invalid state parameter' });
-                                return;
-                            }
-                            res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
-                            res.end(`
-              <!DOCTYPE html>
-              <html lang="en">
-                <head>
-                  <meta charset="UTF-8">
-                  <meta name="viewport" content="width=device-width, initial-scale=1.0">
-                  <title>Berget - Authentication Successful</title>
-                  <style>
-                    * { margin: 0; padding: 0; box-sizing: border-box; }
-                    body {
-                      font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Oxygen, Ubuntu, sans-serif;
-                      display: flex;
-                      justify-content: center;
-                      align-items: center;
-                      min-height: 100vh;
-                      background: linear-gradient(135deg, #0f0f1a 0%, #1a1a2e 50%, #16213e 100%);
-                      color: #fff;
-                    }
-                    .container {
-                      text-align: center;
-                      padding: 3rem;
-                      max-width: 400px;
-                    }
-                    .icon {
-                      width: 80px;
-                      height: 80px;
-                      background: linear-gradient(135deg, #4ade80 0%, #22c55e 100%);
-                      border-radius: 50%;
-                      display: flex;
-                      align-items: center;
-                      justify-content: center;
-                      margin: 0 auto 1.5rem;
-                      box-shadow: 0 4px 20px rgba(74, 222, 128, 0.3);
-                    }
-                    .icon svg {
-                      width: 40px;
-                      height: 40px;
-                      stroke: #fff;
-                      stroke-width: 3;
-                    }
-                    h1 {
-                      font-size: 1.5rem;
-                      font-weight: 600;
-                      margin-bottom: 0.75rem;
-                      color: #fff;
-                    }
-                    p {
-                      color: #94a3b8;
-                      font-size: 0.95rem;
-                      line-height: 1.5;
-                    }
-                    .brand {
-                      margin-top: 2rem;
-                      opacity: 0.5;
-                      font-size: 0.8rem;
-                      letter-spacing: 0.05em;
-                    }
-                  </style>
-                </head>
-                <body>
-                  <div class="container">
-                    <div class="icon">
-                      <svg viewBox="0 0 24 24" fill="none" stroke="currentColor">
-                        <polyline points="20 6 9 17 4 12"></polyline>
-                      </svg>
-                    </div>
-                    <h1>Authentication Successful</h1>
-                    <p>You can close this window and return to your terminal.</p>
-                    <div class="brand">BERGET</div>
-                  </div>
-                </body>
-              </html>
-            `);
-                            server.close();
-                            resolve({ success: true, code });
-                        }
-                    }));
-                    server.listen(CALLBACK_PORT, () => {
-                        if (process.argv.includes('--debug')) {
-                            console.log(chalk_1.default.dim(`Callback server listening on port ${CALLBACK_PORT}`));
-                        }
-                    });
-                    // Set timeout for the server
-                    setTimeout(() => {
-                        server.close();
-                        resolve({ success: false, error: 'Authentication timed out' });
-                    }, 5 * 60 * 1000) // 5 minute timeout
-                    ;
-                    (() => __awaiter(this, void 0, void 0, function* () {
-                        try {
-                            const open = yield Promise.resolve().then(() => __importStar(require('open'))).then((m) => m.default);
-                            yield open(authUrl.toString());
-                            console.log(chalk_1.default.dim('Browser opened for authentication...'));
-                        }
-                        catch (_a) {
-                            console.log(chalk_1.default.cyan('\nPlease open this URL in your browser:'));
-                            console.log(chalk_1.default.bold(authUrl.toString()));
-                        }
-                    }))();
-                });
-                if (!authResult.success || !authResult.code) {
-                    console.log(chalk_1.default.red(`\nAuthentication failed: ${authResult.error || 'Unknown error'}`));
-                    return false;
-                }
-                // Exchange authorization code for tokens
-                console.log(chalk_1.default.dim('Exchanging authorization code for tokens...'));
-                const tokenUrl = `${KEYCLOAK_URL}/realms/${KEYCLOAK_REALM}/protocol/openid-connect/token`;
-                const tokenResponse = yield fetch(tokenUrl, {
-                    method: 'POST',
-                    headers: {
-                        'Content-Type': 'application/x-www-form-urlencoded',
-                    },
-                    body: new URLSearchParams({
-                        grant_type: 'authorization_code',
-                        client_id: KEYCLOAK_CLIENT_ID,
-                        code: authResult.code,
-                        redirect_uri: redirectUri,
-                        code_verifier: codeVerifier,
-                    }).toString(),
-                });
-                if (!tokenResponse.ok) {
-                    const errorText = yield tokenResponse.text();
-                    console.log(chalk_1.default.red(`\nFailed to exchange code for tokens: ${errorText}`));
+                console.log(chalk_1.default.blue("Initiating login process..."));
+                const auth = makeBrowserAuth(process.argv.includes("--debug"));
+                const result = yield auth.start();
+                if (!result.success) {
+                    console.log(chalk_1.default.red(`\nAuthentication failed: ${result.error || "Unknown error"}`));
                     return false;
                 }
-                const tokenData = (yield tokenResponse.json());
-                // Save tokens
-                (0, client_1.saveAuthToken)(tokenData.access_token, tokenData.refresh_token, tokenData.expires_in);
-                if (process.argv.includes('--debug')) {
-                    console.log(chalk_1.default.yellow('DEBUG: Token data received:'));
+                (0, client_1.saveAuthToken)(result.accessToken, result.refreshToken, result.expiresIn);
+                if (process.argv.includes("--debug")) {
+                    console.log(chalk_1.default.yellow("DEBUG: Token data received:"));
                     console.log(chalk_1.default.yellow(JSON.stringify({
-                        expires_in: tokenData.expires_in,
-                        refresh_expires_in: tokenData.refresh_expires_in,
+                        expires_in: result.expiresIn,
                     }, null, 2)));
                 }
-                console.log(chalk_1.default.green('\n✓ Successfully logged in to Berget'));
-                // Try to get user info
+                console.log(chalk_1.default.green("\n✓ Successfully logged in to Berget"));
                 try {
                     const profile = yield this.whoami();
                     if (profile === null || profile === void 0 ? void 0 : profile.email) {
@@ -358,17 +95,41 @@ class AuthService {
                 catch (_a) {
                     // Ignore errors fetching profile
                 }
-                console.log(chalk_1.default.cyan('\nNext steps:'));
-                console.log(chalk_1.default.cyan('  • Create an API key: berget api-keys create'));
-                console.log(chalk_1.default.cyan('  • Setup OpenCode: berget code init'));
+                console.log(chalk_1.default.cyan("\nNext steps:"));
+                console.log(chalk_1.default.cyan("  • Create an API key: berget api-keys create"));
+                console.log(chalk_1.default.cyan("  • Setup OpenCode: berget code init"));
                 return true;
             }
             catch (error) {
-                (0, error_handler_1.handleError)('Login failed', error);
+                (0, error_handler_1.handleError)("Login failed", error);
                 return false;
             }
         });
     }
+    /**
+     * Browser-based PKCE login for wizard / programmatic use.
+     * Does NOT print to stdout — returns tokens so callers can display
+     * their own UI (e.g. via clack/prompts).
+     */
+    loginInteractive() {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                (0, client_1.clearAuthToken)();
+                const auth = makeBrowserAuth(process.argv.includes("--debug"));
+                const result = yield auth.start();
+                if (result.success) {
+                    (0, client_1.saveAuthToken)(result.accessToken, result.refreshToken, result.expiresIn);
+                }
+                return result;
+            }
+            catch (error) {
+                return {
+                    success: false,
+                    error: error instanceof Error ? error.message : String(error),
+                };
+            }
+        });
+    }
 }
 exports.AuthService = AuthService;
 // Command group name for this service