berget 2.2.6 → 2.2.8

package/dist/src/services/auth-service.js

@@ -1,377 +1,124 @@
 "use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || function (mod) {
-    if (mod && mod.__esModule) return mod;
-    var result = {};
-    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
-    __setModuleDefault(result, mod);
-    return result;
-};
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AuthService = void 0;
-const client_1 = require("../client");
-// We'll use dynamic import for 'open' to support ESM modules in CommonJS
 const chalk_1 = __importDefault(require("chalk"));
-const error_handler_1 = require("../utils/error-handler");
+const client_1 = require("../client");
 const command_structure_1 = require("../constants/command-structure");
-const http = __importStar(require("http"));
-const crypto = __importStar(require("crypto"));
-const url = __importStar(require("url"));
+const error_handler_1 = require("../utils/error-handler");
+const browser_auth_1 = require("./browser-auth");
 // Keycloak configuration based on environment
 const isStageMode = process.argv.includes('--stage');
 const isLocalMode = process.argv.includes('--local');
-const KEYCLOAK_URL = (isStageMode || isLocalMode)
-    ? 'https://keycloak.stage.berget.ai'
-    : 'https://keycloak.berget.ai';
+const KEYCLOAK_URL = isStageMode || isLocalMode ? 'https://keycloak.stage.berget.ai' : 'https://keycloak.berget.ai';
 const KEYCLOAK_REALM = 'berget';
 const KEYCLOAK_CLIENT_ID = 'berget-code';
 const CALLBACK_PORT = 8787;
-/**
- * Generate a random string for PKCE code_verifier
- */
-function generateCodeVerifier() {
-    return crypto.randomBytes(32).toString('base64url');
-}
-/**
- * Generate code_challenge from code_verifier using S256 method
- */
-function generateCodeChallenge(verifier) {
-    return crypto.createHash('sha256').update(verifier).digest('base64url');
-}
 /**
  * Service for authentication operations
  * Command group: auth
  */
 class AuthService {
-    constructor() {
-        this.client = (0, client_1.createAuthenticatedClient)();
-    }
+    // Command group name for this service
+    static COMMAND_GROUP = command_structure_1.COMMAND_GROUPS.AUTH;
+    // Subcommands for this service
+    static COMMANDS = command_structure_1.SUBCOMMANDS.AUTH;
+    static instance;
+    constructor() { }
     static getInstance() {
         if (!AuthService.instance) {
             AuthService.instance = new AuthService();
         }
         return AuthService.instance;
     }
-    whoami() {
-        return __awaiter(this, void 0, void 0, function* () {
+    /**
+     * Browser-based PKCE login for interactive CLI use.
+     * Prints status to stdout/stderr. Use loginInteractive() when you need
+     * a silent, UI-agnostic result (e.g. inside the setup wizard).
+     */
+    async login() {
+        try {
+            (0, client_1.clearAuthToken)();
+            console.log(chalk_1.default.blue('Initiating login process...'));
+            const auth = makeBrowserAuth(process.argv.includes('--debug'));
+            const result = await auth.start();
+            if (!result.success) {
+                console.log(chalk_1.default.red(`\nAuthentication failed: ${result.error || 'Unknown error'}`));
+                return false;
+            }
+            (0, client_1.saveAuthToken)(result.accessToken, result.refreshToken, result.expiresIn);
+            if (process.argv.includes('--debug')) {
+                console.log(chalk_1.default.yellow('DEBUG: Token data received:'));
+                console.log(chalk_1.default.yellow(JSON.stringify({
+                    expires_in: result.expiresIn,
+                }, null, 2)));
+            }
+            console.log(chalk_1.default.green('\n✓ Successfully logged in to Berget'));
             try {
-                // Create fresh client to ensure we have the latest token
-                const client = (0, client_1.createAuthenticatedClient)();
-                const { data: profile, error } = yield client.GET('/v1/users/me');
-                if (error) {
-                    return null;
+                const profile = await this.whoami();
+                if (profile?.email) {
+                    console.log(chalk_1.default.green(`Logged in as ${profile.name || profile.email}`));
                 }
-                return profile;
             }
-            catch (error) {
-                return null;
+            catch {
+                // Ignore errors fetching profile
             }
-        });
+            console.log(chalk_1.default.cyan('\nNext steps:'));
+            console.log(chalk_1.default.cyan('  • Create an API key: berget api-keys create'));
+            console.log(chalk_1.default.cyan('  • Setup OpenCode: berget code init'));
+            return true;
+        }
+        catch (error) {
+            (0, error_handler_1.handleError)('Login failed', error);
+            return false;
+        }
     }
-    login() {
-        return __awaiter(this, void 0, void 0, function* () {
-            try {
-                // Clear any existing token to ensure a fresh login
-                (0, client_1.clearAuthToken)();
-                console.log(chalk_1.default.blue('Initiating login process...'));
-                // Generate PKCE code verifier and challenge
-                const codeVerifier = generateCodeVerifier();
-                const codeChallenge = generateCodeChallenge(codeVerifier);
-                const state = crypto.randomBytes(16).toString('hex');
-                const redirectUri = `http://localhost:${CALLBACK_PORT}/callback`;
-                // Build authorization URL
-                const authUrl = new URL(`${KEYCLOAK_URL}/realms/${KEYCLOAK_REALM}/protocol/openid-connect/auth`);
-                authUrl.searchParams.set('client_id', KEYCLOAK_CLIENT_ID);
-                authUrl.searchParams.set('response_type', 'code');
-                authUrl.searchParams.set('redirect_uri', redirectUri);
-                authUrl.searchParams.set('scope', 'openid email profile');
-                authUrl.searchParams.set('state', state);
-                authUrl.searchParams.set('code_challenge', codeChallenge);
-                authUrl.searchParams.set('code_challenge_method', 'S256');
-                // Create a promise that resolves when we receive the callback
-                const authResult = yield new Promise((resolve) => {
-                    const server = http.createServer((req, res) => __awaiter(this, void 0, void 0, function* () {
-                        const parsedUrl = url.parse(req.url || '', true);
-                        if (parsedUrl.pathname === '/callback') {
-                            const receivedState = parsedUrl.query.state;
-                            const code = parsedUrl.query.code;
-                            const error = parsedUrl.query.error;
-                            const errorPage = (title, message) => `
-              <!DOCTYPE html>
-              <html lang="en">
-                <head>
-                  <meta charset="UTF-8">
-                  <meta name="viewport" content="width=device-width, initial-scale=1.0">
-                  <title>Berget - Authentication Failed</title>
-                  <style>
-                    * { margin: 0; padding: 0; box-sizing: border-box; }
-                    body {
-                      font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Oxygen, Ubuntu, sans-serif;
-                      display: flex;
-                      justify-content: center;
-                      align-items: center;
-                      min-height: 100vh;
-                      background: linear-gradient(135deg, #0f0f1a 0%, #1a1a2e 50%, #16213e 100%);
-                      color: #fff;
-                    }
-                    .container {
-                      text-align: center;
-                      padding: 3rem;
-                      max-width: 400px;
-                    }
-                    .icon {
-                      width: 80px;
-                      height: 80px;
-                      background: linear-gradient(135deg, #f87171 0%, #ef4444 100%);
-                      border-radius: 50%;
-                      display: flex;
-                      align-items: center;
-                      justify-content: center;
-                      margin: 0 auto 1.5rem;
-                      box-shadow: 0 4px 20px rgba(248, 113, 113, 0.3);
-                    }
-                    .icon svg {
-                      width: 40px;
-                      height: 40px;
-                      stroke: #fff;
-                      stroke-width: 3;
-                    }
-                    h1 {
-                      font-size: 1.5rem;
-                      font-weight: 600;
-                      margin-bottom: 0.75rem;
-                      color: #fff;
-                    }
-                    p {
-                      color: #94a3b8;
-                      font-size: 0.95rem;
-                      line-height: 1.5;
-                    }
-                    .brand {
-                      margin-top: 2rem;
-                      opacity: 0.5;
-                      font-size: 0.8rem;
-                      letter-spacing: 0.05em;
-                    }
-                  </style>
-                </head>
-                <body>
-                  <div class="container">
-                    <div class="icon">
-                      <svg viewBox="0 0 24 24" fill="none" stroke="currentColor">
-                        <line x1="18" y1="6" x2="6" y2="18"></line>
-                        <line x1="6" y1="6" x2="18" y2="18"></line>
-                      </svg>
-                    </div>
-                    <h1>${title}</h1>
-                    <p>${message}</p>
-                    <div class="brand">BERGET</div>
-                  </div>
-                </body>
-              </html>
-            `;
-                            if (error) {
-                                res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
-                                res.end(errorPage('Authentication Failed', String(parsedUrl.query.error_description || error)));
-                                server.close();
-                                resolve({ success: false, error });
-                                return;
-                            }
-                            if (receivedState !== state) {
-                                res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
-                                res.end(errorPage('Authentication Failed', 'Invalid state parameter. Please try again.'));
-                                server.close();
-                                resolve({ success: false, error: 'Invalid state parameter' });
-                                return;
-                            }
-                            res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
-                            res.end(`
-              <!DOCTYPE html>
-              <html lang="en">
-                <head>
-                  <meta charset="UTF-8">
-                  <meta name="viewport" content="width=device-width, initial-scale=1.0">
-                  <title>Berget - Authentication Successful</title>
-                  <style>
-                    * { margin: 0; padding: 0; box-sizing: border-box; }
-                    body {
-                      font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Oxygen, Ubuntu, sans-serif;
-                      display: flex;
-                      justify-content: center;
-                      align-items: center;
-                      min-height: 100vh;
-                      background: linear-gradient(135deg, #0f0f1a 0%, #1a1a2e 50%, #16213e 100%);
-                      color: #fff;
-                    }
-                    .container {
-                      text-align: center;
-                      padding: 3rem;
-                      max-width: 400px;
-                    }
-                    .icon {
-                      width: 80px;
-                      height: 80px;
-                      background: linear-gradient(135deg, #4ade80 0%, #22c55e 100%);
-                      border-radius: 50%;
-                      display: flex;
-                      align-items: center;
-                      justify-content: center;
-                      margin: 0 auto 1.5rem;
-                      box-shadow: 0 4px 20px rgba(74, 222, 128, 0.3);
-                    }
-                    .icon svg {
-                      width: 40px;
-                      height: 40px;
-                      stroke: #fff;
-                      stroke-width: 3;
-                    }
-                    h1 {
-                      font-size: 1.5rem;
-                      font-weight: 600;
-                      margin-bottom: 0.75rem;
-                      color: #fff;
-                    }
-                    p {
-                      color: #94a3b8;
-                      font-size: 0.95rem;
-                      line-height: 1.5;
-                    }
-                    .brand {
-                      margin-top: 2rem;
-                      opacity: 0.5;
-                      font-size: 0.8rem;
-                      letter-spacing: 0.05em;
-                    }
-                  </style>
-                </head>
-                <body>
-                  <div class="container">
-                    <div class="icon">
-                      <svg viewBox="0 0 24 24" fill="none" stroke="currentColor">
-                        <polyline points="20 6 9 17 4 12"></polyline>
-                      </svg>
-                    </div>
-                    <h1>Authentication Successful</h1>
-                    <p>You can close this window and return to your terminal.</p>
-                    <div class="brand">BERGET</div>
-                  </div>
-                </body>
-              </html>
-            `);
-                            server.close();
-                            resolve({ success: true, code });
-                        }
-                    }));
-                    server.listen(CALLBACK_PORT, () => {
-                        if (process.argv.includes('--debug')) {
-                            console.log(chalk_1.default.dim(`Callback server listening on port ${CALLBACK_PORT}`));
-                        }
-                    });
-                    // Set timeout for the server
-                    setTimeout(() => {
-                        server.close();
-                        resolve({ success: false, error: 'Authentication timed out' });
-                    }, 5 * 60 * 1000) // 5 minute timeout
-                    ;
-                    (() => __awaiter(this, void 0, void 0, function* () {
-                        try {
-                            const open = yield Promise.resolve().then(() => __importStar(require('open'))).then((m) => m.default);
-                            yield open(authUrl.toString());
-                            console.log(chalk_1.default.dim('Browser opened for authentication...'));
-                        }
-                        catch (_a) {
-                            console.log(chalk_1.default.cyan('\nPlease open this URL in your browser:'));
-                            console.log(chalk_1.default.bold(authUrl.toString()));
-                        }
-                    }))();
-                });
-                if (!authResult.success || !authResult.code) {
-                    console.log(chalk_1.default.red(`\nAuthentication failed: ${authResult.error || 'Unknown error'}`));
-                    return false;
-                }
-                // Exchange authorization code for tokens
-                console.log(chalk_1.default.dim('Exchanging authorization code for tokens...'));
-                const tokenUrl = `${KEYCLOAK_URL}/realms/${KEYCLOAK_REALM}/protocol/openid-connect/token`;
-                const tokenResponse = yield fetch(tokenUrl, {
-                    method: 'POST',
-                    headers: {
-                        'Content-Type': 'application/x-www-form-urlencoded',
-                    },
-                    body: new URLSearchParams({
-                        grant_type: 'authorization_code',
-                        client_id: KEYCLOAK_CLIENT_ID,
-                        code: authResult.code,
-                        redirect_uri: redirectUri,
-                        code_verifier: codeVerifier,
-                    }).toString(),
-                });
-                if (!tokenResponse.ok) {
-                    const errorText = yield tokenResponse.text();
-                    console.log(chalk_1.default.red(`\nFailed to exchange code for tokens: ${errorText}`));
-                    return false;
-                }
-                const tokenData = (yield tokenResponse.json());
-                // Save tokens
-                (0, client_1.saveAuthToken)(tokenData.access_token, tokenData.refresh_token, tokenData.expires_in);
-                if (process.argv.includes('--debug')) {
-                    console.log(chalk_1.default.yellow('DEBUG: Token data received:'));
-                    console.log(chalk_1.default.yellow(JSON.stringify({
-                        expires_in: tokenData.expires_in,
-                        refresh_expires_in: tokenData.refresh_expires_in,
-                    }, null, 2)));
-                }
-                console.log(chalk_1.default.green('\n✓ Successfully logged in to Berget'));
-                // Try to get user info
-                try {
-                    const profile = yield this.whoami();
-                    if (profile === null || profile === void 0 ? void 0 : profile.email) {
-                        console.log(chalk_1.default.green(`Logged in as ${profile.name || profile.email}`));
-                    }
-                }
-                catch (_a) {
-                    // Ignore errors fetching profile
-                }
-                console.log(chalk_1.default.cyan('\nNext steps:'));
-                console.log(chalk_1.default.cyan('  • Create an API key: berget api-keys create'));
-                console.log(chalk_1.default.cyan('  • Setup OpenCode: berget code init'));
-                return true;
+    /**
+     * Browser-based PKCE login for wizard / programmatic use.
+     * Does NOT print to stdout — returns tokens so callers can display
+     * their own UI (e.g. via clack/prompts).
+     */
+    async loginInteractive() {
+        try {
+            (0, client_1.clearAuthToken)();
+            const auth = makeBrowserAuth(process.argv.includes('--debug'));
+            const result = await auth.start();
+            if (result.success) {
+                (0, client_1.saveAuthToken)(result.accessToken, result.refreshToken, result.expiresIn);
             }
-            catch (error) {
-                (0, error_handler_1.handleError)('Login failed', error);
-                return false;
+            return result;
+        }
+        catch (error) {
+            return {
+                error: error instanceof Error ? error.message : String(error),
+                success: false,
+            };
+        }
+    }
+    async whoami() {
+        try {
+            // Create fresh client to ensure we have the latest token
+            const client = (0, client_1.createAuthenticatedClient)();
+            const { data: profile, error } = await client.GET('/v1/users/me');
+            if (error) {
+                return null;
             }
-        });
+            return profile;
+        }
+        catch {
+            return null;
+        }
     }
 }
 exports.AuthService = AuthService;
-// Command group name for this service
-AuthService.COMMAND_GROUP = command_structure_1.COMMAND_GROUPS.AUTH;
-// Subcommands for this service
-AuthService.COMMANDS = command_structure_1.SUBCOMMANDS.AUTH;
+function makeBrowserAuth(debug) {
+    return new browser_auth_1.BrowserAuth({
+        callbackPort: CALLBACK_PORT,
+        clientId: KEYCLOAK_CLIENT_ID,
+        debug,
+        keycloakUrl: KEYCLOAK_URL,
+        realm: KEYCLOAK_REALM,
+    });
+}