bikeshed-now 0.9.0 → 0.10.0

package/README.md

@@ -28,6 +28,10 @@ and run `bikeshed login --paste`. The token is shown once. In CI, set
 `BIKESHED_ORIGIN` and `BIKESHED_TOKEN` instead of running `login` at all; they
 outrank whatever `login` saved.
 
+`bikeshed logout` signs this computer out. It revokes a token from browser
+sign-in as well as deleting it. A pasted token is only deleted, because CI may
+be using the same one: revoke it at `/account` once nothing needs it.
+
 ## The loop
 
 ```bash

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bikeshed-now",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "license": "Apache-2.0",
   "type": "module",
   "description": "Publish and revise documents on a Bikeshed deployment from the terminal.",

package/src/client.mjs

@@ -4,7 +4,7 @@
 import { readFileSync } from "node:fs";
 import { basename } from "node:path";
 
-export const CLIENT_NAME = "bikeshed-cli/0.9.0";
+export const CLIENT_NAME = "bikeshed-cli/0.10.0";
 
 /**
  * Three surfaces, and the split is deliberate rather than untidy.
@@ -225,6 +225,40 @@ export async function exchangeCode(tokenEndpoint, { code, verifier, redirectUri,
 }
 
 /** Check that a token works, and say who it belongs to. */
+/**
+ * Revoke the token being presented, and only it (SPEC §23).
+ *
+ * A 401 from /tokens means one of two things that need different advice: the
+ * token had already stopped working, or the deployment is older than a token
+ * revoking itself and still takes only a browser session there. One call with
+ * the same token to /mcp tells them apart. Returns "revoked", "invalid" or
+ * "unsupported"; a deployment that cannot be reached throws.
+ */
+export async function revokeOwnToken(origin, token) {
+  const res = await fetch(`${origin}/tokens`, {
+    method: "POST",
+    headers: headers(token, { "Content-Type": "application/json" }),
+    body: JSON.stringify({ op: "revoke" }),
+  });
+  if (res.ok) return "revoked";
+  if (res.status !== 401) {
+    throw new CliError(await readError(res, `the server returned ${res.status}`));
+  }
+  const probe = await fetch(`${origin}/mcp`, {
+    method: "POST",
+    headers: headers(token, { "Content-Type": "application/json" }),
+    body: JSON.stringify({
+      jsonrpc: "2.0",
+      id: 1,
+      method: "tools/call",
+      params: { name: "list_documents", arguments: { limit: 1 } },
+    }),
+  });
+  if (probe.status === 401) return "invalid";
+  if (probe.ok) return "unsupported";
+  throw new CliError(`the server returned ${probe.status}`);
+}
+
 export async function whoami(origin, token) {
   // list_documents is the cheapest authenticated call, and a token that can
   // list is a token that works.

package/src/index.mjs

@@ -16,6 +16,7 @@ import {
   fetchSource,
   listSkills,
   printable,
+  revokeOwnToken,
   uploadFile,
   whoami,
 } from "./client.mjs";
@@ -33,15 +34,8 @@ import {
 } from "./login.mjs";
 
 /**
- * This is the END-USER tool, and it is deliberately not the same thing as the
- * scripts in `scripts/`. Conflating the two is how somebody runs a teardown
- * against production, so the difference is stated in `--help`, in the README,
- * and here:
- *
- *   scripts/*.mjs   whoever owns the deployment. Admin credentials. Talks to
- *                   Firestore and Storage directly. Provisions and withdraws.
- *   bikeshed        any signed-up user. A personal access token. Talks to the
- *                   deployment over HTTPS. Publishes and revises documents.
+ * A person's own client: their personal access token, over HTTPS, able to do
+ * exactly what they can do in the browser and nothing more.
  *
  * Every command takes `--json`, so it composes inside a script or an agent's
  * shell without anybody parsing human-readable output.
@@ -50,6 +44,7 @@ import {
 const USAGE = `bikeshed — publish and revise documents
 
   bikeshed login                       sign in through your browser (--paste for a token)
+  bikeshed logout                      sign out (revokes a token from browser sign-in)
   bikeshed list                        documents you can read
   bikeshed publish <file>              create a new document
   bikeshed update <id> <file>          publish a new version
@@ -116,10 +111,6 @@ Options
 
 Environment
   BIKESHED_ORIGIN, BIKESHED_TOKEN, BIKESHED_AGENT
-
-This is the end-user tool. The scripts in scripts/ are the OPERATOR tools: they
-use admin credentials, talk to the database directly, and can tear a deployment
-down. They are not the same thing.
 `;
 
 function fail(message) {
@@ -275,7 +266,9 @@ async function browserLogin(flags) {
   });
   // Checked before it is stored, the same as a pasted one.
   await whoami(where, token);
-  writeConfig({ ...readConfig(), origin: where, token });
+  // `via` is what lets `logout` revoke this token: one made by browser sign-in
+  // belongs to this computer alone, where a pasted one may be in CI as well.
+  writeConfig({ ...readConfig(), origin: where, token, via: "browser" });
 
   // The environment outranks the file (resolveAuth), so a variable left over
   // from an earlier session would quietly keep being used instead.
@@ -313,13 +306,78 @@ async function pasteLogin(flags) {
     // Verified before it is stored, so a typo fails here rather than on the
     // next command with a confusing message.
     await whoami(where, token);
-    writeConfig({ ...readConfig(), origin: where, token });
+    writeConfig({ ...readConfig(), origin: where, token, via: "paste" });
     console.log(`\nSaved to ${CONFIG_PATH} (readable only by you).`);
   } finally {
     rl.close();
   }
 }
 
+/**
+ * Sign this computer out.
+ *
+ * Only the SAVED sign-in, never BIKESHED_TOKEN or --token: those belong to a
+ * shell or a job, and revoking one would sign out something nobody meant to
+ * touch. A token from browser sign-in exists for this computer alone, so it is
+ * revoked on the deployment as well as forgotten here. A pasted one may be in
+ * CI too, so it is only forgotten, as is one saved before `login` recorded
+ * which kind it was (SPEC §23).
+ *
+ * The token is forgotten whatever the deployment says, and when it cannot be
+ * reached at all: after `logout`, this computer is signed out. `revoked` in
+ * --json means the deployment confirmed the token no longer works.
+ */
+async function logout(flags) {
+  const config = readConfig();
+  const origin = String(config.origin || resolveAuth().origin).replace(/\/+$/, "");
+  const shadowed = () => {
+    if (process.env.BIKESHED_TOKEN) {
+      console.error("BIKESHED_TOKEN is set in this shell, so commands here still use it. Unset it to sign out here too.");
+    }
+  };
+
+  if (!config.token) {
+    out(flags.json, { origin, revoked: false, forgot: false }, () => console.log("Not signed in on this computer."));
+    shadowed();
+    return;
+  }
+
+  let outcome = "kept";
+  let why = "You pasted it in, so something else may use it too.";
+  if (config.via === "browser") {
+    try {
+      outcome = await revokeOwnToken(origin, config.token);
+      why = `${origin} is too old to revoke a token from the command line.`;
+    } catch (e) {
+      outcome = "failed";
+      why =
+        e instanceof CliError
+          ? `${origin} did not revoke it (${printable(e.message, 80)}).`
+          : `Could not reach ${origin} to revoke it (${printable(e.cause?.code ?? e.message, 80)}).`;
+    }
+  }
+
+  const kept = { ...config, origin };
+  delete kept.token;
+  delete kept.via;
+  writeConfig(kept);
+
+  const revoked = outcome === "revoked" || outcome === "invalid";
+  out(flags.json, { origin, revoked, forgot: true }, () =>
+    console.log(
+      outcome === "revoked"
+        ? `Signed out. ${origin} revoked the token, and it is gone from this computer.`
+        : outcome === "invalid"
+          ? `Signed out. The token had already stopped working on ${origin}, and it is gone from this computer.`
+          : "Signed out. The token is gone from this computer.",
+    ),
+  );
+  if (!revoked) {
+    console.error(`${why} It still works until you revoke it at ${origin}/account, under Access tokens.`);
+  }
+  shadowed();
+}
+
 async function list(flags) {
   const { origin, token } = resolveAuth(flags);
   const page = (limit, cursor) => {
@@ -737,6 +795,7 @@ async function watchFile(file, run) {
 
 const COMMANDS = {
   login,
+  logout,
   list,
   publish,
   update,
@@ -755,7 +814,7 @@ const COMMANDS = {
 };
 
 /** Commands that reach a deployment without authenticating as anybody. */
-const NO_TOKEN = new Set(["login", "open", "skills"]);
+const NO_TOKEN = new Set(["login", "logout", "open", "skills"]);
 
 async function main() {
   const { values, positionals } = parseArgs({