convex 1.46.0 → 1.48.0-alpha.0

package/src/cli/lib/formatValidationProgress.ts

@@ -0,0 +1,35 @@
+import { chalkStderr } from "chalk";
+import { DiscardedStagedValidator } from "./deployApi/evaluateSchema.js";
+
+export function formatValidationProgress({
+  numDocsValidated,
+  totalDocs,
+}: {
+  numDocsValidated: number;
+  totalDocs?: number | null | undefined;
+}): string {
+  const checked = numDocsValidated.toLocaleString();
+  return totalDocs === null || totalDocs === undefined
+    ? `${checked} documents checked`
+    : `${checked} of approximately ${totalDocs.toLocaleString()} documents checked`;
+}
+
+/** "validated; the push removes the staged validator" */
+export function formatDiscardedStagedValidator(
+  validator: DiscardedStagedValidator,
+): string {
+  let status;
+  switch (validator.state.state) {
+    case "pending": {
+      status = `validating in the background (${formatValidationProgress(validator.state)})`;
+      break;
+    }
+    case "valid":
+      status = chalkStderr.green("validated");
+      break;
+  }
+  const action = validator.replaced
+    ? "the push stages a different validator"
+    : "the push removes the staged validator";
+  return `${status}; ${action}`;
+}

package/src/cli/lib/fsUtils.ts

@@ -6,12 +6,15 @@ import { NodeFs } from "../../bundler/fs.js";
 export function recursivelyDelete(
   ctx: Context,
   deletePath: string,
-  opts?: { force?: boolean; dryRun?: boolean },
+  opts?: { force?: boolean; dryRun?: boolean; followSymlinks?: boolean },
 ) {
   const dryRun = !!opts?.dryRun;
   let st;
   try {
-    st = ctx.fs.stat(deletePath);
+    st =
+      opts?.followSymlinks === false
+        ? ctx.fs.lstat(deletePath)
+        : ctx.fs.stat(deletePath);
   } catch (err: any) {
     if (err.code === "ENOENT" && opts?.force) {
       return;

package/src/cli/lib/generateDocs.ts

@@ -299,7 +299,7 @@ function renderCopyableCommands(text: string): string {
     .map((line) =>
       /^- /.test(line)
         ? line.replace(
-            /`(npx convex [^`]*)`/g,
+            /`(npx convex(?:@[^\s`]+)? [^`]*)`/g,
             (_, command) =>
               `<CodeWithCopyButton text={${JSON.stringify(command)}} />`,
           )

package/src/cli/lib/indexes.ts

@@ -27,7 +27,7 @@ export type LargeIndexDeletionCheck =
   | "no verification"
   // If large indexes are being deleted, ask for confirmation (and fail in non-interactive envs)
   | "ask for confirmation"
-  // If large indexes are being deleted, confirm (the user has used --allow-deleting-large-indexes)
+  // If large indexes are being deleted, confirm (the user has used --skip-large-indexes-check)
   | "has confirmation";
 
 export function addProgressLinkIfSlow(

package/src/cli/lib/login.ts

@@ -32,6 +32,17 @@ import {
   modifyGlobalConfig,
 } from "./utils/globalConfig.js";
 import { updateBigBrainAuthAfterLogin } from "./deploymentSelection.js";
+import {
+  getProfileSelection,
+  ProfileSelection,
+  profileConfigPath,
+  writeProfileCredentials,
+  readProfileCredentials,
+} from "./profiles.js";
+import {
+  profileLoginMetadata,
+  revokeReplacedProfileToken,
+} from "./profileManagement.js";
 
 // Per https://github.com/panva/node-openid-client/tree/main/docs#customizing
 custom.setHttpOptionsDefaults({
@@ -291,6 +302,7 @@ export async function performLogin(
     anonymousId,
     vercel,
     vercelOverride,
+    profile: selectedProfile,
   }: {
     overrideAuthUrl?: string | undefined;
     overrideAuthClient?: string | undefined;
@@ -307,8 +319,16 @@ export async function performLogin(
     anonymousId?: string | undefined;
     vercel?: boolean | undefined;
     vercelOverride?: string | undefined;
+    profile?: ProfileSelection | null;
   } = {},
 ) {
+  const auth = ctx.bigBrainAuth();
+  const profile =
+    selectedProfile !== undefined
+      ? selectedProfile
+      : auth?.kind === "accessToken" && auth.profile !== undefined
+        ? auth.profile
+        : await getProfileSelection(ctx);
   loginFlow = loginFlow || "auto";
   // Get access token from big-brain
   // Default the device name to the hostname, but allow the user to change this if the terminal is interactive.
@@ -400,6 +420,12 @@ export async function performLogin(
   }
 
   // Exchange the WorkOS access token for a Convex personal access token.
+  const previous =
+    profile === null ? null : await readProfileCredentials(ctx, profile, true);
+  const metadata =
+    profile === null
+      ? {}
+      : await profileLoginMetadata(ctx, profile, accessToken, previous);
   ctx._updateBigBrainAuth({
     accessToken: accessToken,
     kind: "accessToken",
@@ -417,8 +443,19 @@ export async function performLogin(
   const newAccessToken = response.data!.accessToken;
   const globalConfig = { accessToken: newAccessToken };
   try {
-    await modifyGlobalConfig(ctx, globalConfig);
-    const path = globalConfigPath();
+    if (profile !== null) {
+      await writeProfileCredentials(
+        ctx,
+        profile.name,
+        newAccessToken,
+        metadata,
+        previous,
+      );
+    } else {
+      await modifyGlobalConfig(ctx, globalConfig);
+    }
+    const path =
+      profile !== null ? profileConfigPath(profile.name) : globalConfigPath();
     logFinishedStep(`Saved credentials to ${formatPathForPrinting(path)}`);
   } catch (err: unknown) {
     return await ctx.crash({
@@ -429,8 +466,15 @@ export async function performLogin(
     });
   }
 
+  if (profile !== null) {
+    await revokeReplacedProfileToken(
+      ctx,
+      previous?.accessToken,
+      newAccessToken,
+    );
+  }
   logVerbose(`performLogin: updating big brain auth after login`);
-  await updateBigBrainAuthAfterLogin(ctx, newAccessToken);
+  await updateBigBrainAuthAfterLogin(ctx, newAccessToken, profile ?? undefined);
 
   logVerbose(`performLogin: checking opt ins, acceptOptIns: ${acceptOptIns}`);
   // Do opt in to TOS and Privacy Policy stuff

package/src/cli/lib/mcp/requestContext.ts

@@ -149,7 +149,13 @@ export function encodeDeploymentSelector(
     projectDir,
     deployment,
   };
-  return `${deployment.kind}:${btoa(JSON.stringify(payload))}`;
+  // ASCII JSON escapes support Unicode paths with the existing Latin-1 decoder.
+  const serialized = JSON.stringify(payload).replace(
+    /[\u0080-\uffff]/g,
+    (character) =>
+      `\\u${character.charCodeAt(0).toString(16).padStart(4, "0")}`,
+  );
+  return `${deployment.kind}:${btoa(serialized)}`;
 }
 
 const payloadSchema = z.object({

package/src/cli/lib/mcp/tools/env.ts

@@ -12,13 +12,22 @@ const envListInputSchema = z.object({
     .describe(
       "Deployment selector (from the status tool) to list environment variables from.",
     ),
+  includeValues: z
+    .boolean()
+    .optional()
+    .describe(
+      "Also return each variable's value. Values are often secrets like API keys, so leave this off unless you need every value, and use envGet to read a single variable instead.",
+    ),
 });
 
 const envListOutputSchema = z.object({
   variables: z.array(
     z.object({
       name: z.string(),
-      value: z.string(),
+      value: z
+        .string()
+        .optional()
+        .describe("Only present when includeValues is true."),
     }),
   ),
 });
@@ -28,7 +37,8 @@ export const EnvListTool: ConvexTool<
   typeof envListOutputSchema
 > = {
   name: "envList",
-  description: "List all environment variables in your Convex deployment.",
+  description:
+    "List the names of all environment variables in your Convex deployment. Values are left out unless includeValues is true.",
   inputSchema: envListInputSchema,
   outputSchema: envListOutputSchema,
   handler: async (ctx, args) => {
@@ -51,7 +61,11 @@ export const EnvListTool: ConvexTool<
       componentPath: undefined,
       args: {},
     })) as EnvVar[];
-    return { variables };
+    return {
+      variables: variables.map(({ name, value }) =>
+        args.includeValues ? { name, value } : { name },
+      ),
+    };
   },
 };
 

package/src/cli/lib/profileManagement.ts

@@ -0,0 +1,262 @@
+import { ProjectSelection } from "./deploymentSelection.js";
+import { Context } from "../../bundler/context.js";
+import { logMessage, logWarning } from "../../bundler/log.js";
+import { provisionHost } from "./config.js";
+import { version } from "../version.js";
+import {
+  isAnonymousDeployment,
+  getDeploymentTypeFromConfiguredDeployment,
+  stripDeploymentTypePrefix,
+} from "./deployment.js";
+import { CONVEX_DEPLOYMENT_ENV_VAR_NAME } from "./utils/utils.js";
+import { promptYesNo } from "./utils/prompts.js";
+import { loadProjectEnvironmentVariables } from "./envvars.js";
+import {
+  ProfileCredentials,
+  ProfileSelection,
+  readProfileCredentials,
+  readProfileSettings,
+  readProfileToken,
+  savedProfileNames,
+  writeProfileDirectory,
+} from "./profiles.js";
+
+export async function profileApi(
+  token: string,
+  pathname: string,
+  body?: unknown,
+) {
+  return await fetch(`${provisionHost}${pathname}`, {
+    method: body === undefined ? "GET" : "POST",
+    headers: {
+      Authorization: `Bearer ${token}`,
+      "Convex-Client": `npm-cli-${version}`,
+      ...(body === undefined ? {} : { "Content-Type": "application/json" }),
+    },
+    ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+    signal: AbortSignal.timeout(10_000),
+  });
+}
+
+export async function deploymentAccess(
+  token: string,
+  deploymentName: string,
+): Promise<"yes" | "no" | "unknown"> {
+  try {
+    const response = await profileApi(
+      token,
+      `/v1/deployments/${encodeURIComponent(deploymentName)}`,
+    );
+    if (response.ok) return "yes";
+    return [401, 403, 404].includes(response.status) ? "no" : "unknown";
+  } catch {
+    return "unknown";
+  }
+}
+
+export async function projectAccess(
+  token: string,
+  target: ProjectSelection,
+): Promise<"yes" | "no" | "unknown"> {
+  if (target.kind === "deploymentName")
+    return deploymentAccess(token, target.deploymentName);
+  if (target.kind !== "teamAndProjectSlugs") return "unknown";
+  try {
+    const response = await profileApi(
+      token,
+      `/v1/teams/${encodeURIComponent(target.teamSlug)}/projects/${encodeURIComponent(target.projectSlug)}`,
+    );
+    if (response.ok) return "yes";
+    return [401, 403, 404].includes(response.status) ? "no" : "unknown";
+  } catch {
+    return "unknown";
+  }
+}
+
+function configuredCloudDeployment(): string | null {
+  const configured = process.env[CONVEX_DEPLOYMENT_ENV_VAR_NAME]?.trim();
+  if (
+    !configured ||
+    getDeploymentTypeFromConfiguredDeployment(configured) === "local"
+  )
+    return null;
+  const name = stripDeploymentTypePrefix(configured);
+  return isAnonymousDeployment(name) ? null : name;
+}
+
+export async function bindProfileToDirectory(
+  ctx: Context,
+  name: string,
+  force = false,
+  target?: ProjectSelection,
+): Promise<boolean> {
+  const credentials = await readProfileCredentials(ctx, {
+    name,
+    source: "account selection",
+  });
+  loadProjectEnvironmentVariables();
+  const deployment = configuredCloudDeployment();
+  const selectedTarget =
+    target ??
+    (deployment === null
+      ? null
+      : {
+          kind: "deploymentName" as const,
+          deploymentName: deployment,
+          deploymentType: null,
+        });
+  if (!force && selectedTarget !== null) {
+    const label =
+      selectedTarget.kind === "teamAndProjectSlugs"
+        ? `project "${selectedTarget.teamSlug}/${selectedTarget.projectSlug}"`
+        : `deployment "${selectedTarget.kind === "deploymentName" ? selectedTarget.deploymentName : "configured"}"`;
+    const access = await projectAccess(
+      credentials!.accessToken,
+      selectedTarget,
+    );
+    if (access !== "yes") {
+      logWarning(
+        access === "no"
+          ? `Account "${name}" cannot access ${label}.`
+          : `Could not verify whether account "${name}" can access ${label}.`,
+      );
+      if (
+        !process.stdin.isTTY ||
+        !(await promptYesNo(ctx, {
+          message: `Use account "${name}" here anyway?`,
+          default: false,
+        }))
+      ) {
+        logMessage(
+          `Directory selection unchanged. To select this account anyway, run \`npx convex account select ${name} --force\`.`,
+        );
+        return false;
+      }
+    }
+  }
+  await writeProfileDirectory(ctx, name);
+  return true;
+}
+
+export async function profileLoginMetadata(
+  ctx: Context,
+  profile: ProfileSelection,
+  loginToken: string,
+  previous: ProfileCredentials | null,
+): Promise<Omit<ProfileCredentials, "accessToken">> {
+  let identity: { memberId: string; email: string } | null = null;
+  try {
+    const response = await profileApi(loginToken, "/api/dashboard/profile");
+    if (response.ok) {
+      const data = await response.json();
+      if (
+        (typeof data.id === "number" || typeof data.id === "string") &&
+        typeof data.email === "string"
+      ) {
+        identity = { memberId: String(data.id), email: data.email };
+      }
+    }
+  } catch {
+    // Older authentication tokens can be valid without access to the dashboard profile API.
+  }
+  const sameAccount =
+    previous !== null && (previous.memberId === undefined || identity === null)
+      ? await tokensBelongToSameAccount(previous.accessToken, loginToken)
+      : null;
+  if (
+    previous !== null &&
+    (previous.memberId === undefined || identity === null
+      ? sameAccount !== true
+      : identity.memberId !== previous.memberId)
+  ) {
+    return await ctx.crash({
+      exitCode: 1,
+      errorType: "fatal",
+      printedMessage:
+        sameAccount === null &&
+        (previous.memberId === undefined || identity === null)
+          ? `Could not verify the identity of saved account "${profile.name}". To replace this saved login, run \`npx convex logout --account ${profile.name}\` followed by \`npx convex login --account ${profile.name}\`. Choose the intended account when logging in.`
+          : `The login does not match saved account "${profile.name}". Log in with the matching account, or choose another name with \`npx convex login --account <name>\`.`,
+    });
+  }
+  return {
+    ...(identity ??
+      (previous?.memberId === undefined
+        ? {}
+        : { memberId: previous.memberId, email: previous.email })),
+  };
+}
+
+async function tokensBelongToSameAccount(
+  older: string,
+  newer: string,
+): Promise<boolean | null> {
+  try {
+    const responses = await Promise.all(
+      [older, newer].map((token) =>
+        profileApi(token, "/v1/list_personal_access_tokens?limit=100"),
+      ),
+    );
+    if (responses.some((response) => !response.ok)) return null;
+    const lists = await Promise.all(
+      responses.map((response) => response.json()),
+    );
+    if (
+      lists.some(
+        (list) => !Array.isArray(list.items) || list.items.length === 0,
+      )
+    )
+      return null;
+    const ids = new Set(
+      lists[0].items.map((token: { id: unknown }) => String(token.id)),
+    );
+    if (
+      lists[1].items.some((token: { id: unknown }) => ids.has(String(token.id)))
+    )
+      return true;
+    // Disjoint partial pages cannot establish that the accounts differ.
+    return lists.some((list) => list.pagination?.hasMore !== false)
+      ? null
+      : false;
+  } catch {
+    return null;
+  }
+}
+
+export async function revokeReplacedProfileToken(
+  ctx: Context,
+  previous: string | undefined,
+  accessToken: string,
+) {
+  if (previous === undefined || previous === accessToken) return;
+  const settings = await readProfileSettings(ctx);
+  if (
+    settings.revokeReplacedTokens === false ||
+    settings.accessToken === previous
+  )
+    return;
+  for (const name of savedProfileNames(ctx)) {
+    const token = readProfileToken(ctx, name);
+    if (token === null) {
+      logWarning(
+        `The new login was saved, but account "${name}" could not be read. Skipping revocation of the replaced token.`,
+      );
+      return;
+    }
+    if (token === previous) return;
+  }
+  try {
+    // The API verifies token ownership using the newly authenticated account.
+    const response = await profileApi(
+      accessToken,
+      "/v1/delete_personal_access_token",
+      { id: previous },
+    );
+    if (response.ok) return;
+  } catch {
+    // The new credentials are already saved, so a failed revocation can be retried in the dashboard.
+  }
+  logWarning(
+    "The new login was saved, but the replaced token could not be revoked. You can remove it in the dashboard's account settings.",
+  );
+}