convex 1.48.0-alpha.0 → 1.48.0

package/src/cli/login.ts

@@ -1,4 +1,5 @@
 import { Command, Option } from "@commander-js/extra-typings";
+import * as dotenv from "dotenv";
 import { BigBrainAuth, Context, oneoffContext } from "../bundler/context.js";
 import { logFinishedStep, logMessage, logWarning } from "../bundler/log.js";
 import {
@@ -20,7 +21,12 @@ import {
   teamDashboardUrl,
 } from "./lib/dashboard.js";
 import { promptSearch, promptYesNo } from "./lib/utils/prompts.js";
-import { validateOrSelectTeam } from "./lib/utils/utils.js";
+import {
+  CONVEX_DEPLOY_KEY_ENV_VAR_NAME,
+  CONVEX_DEPLOYMENT_TOKEN_ENV_VAR_NAME,
+  ENV_VAR_FILE_PATH,
+  validateOrSelectTeam,
+} from "./lib/utils/utils.js";
 import {
   selectProject,
   updateEnvAndConfigForDeploymentSelection,
@@ -34,24 +40,31 @@ import {
   removeAnonymousPrefix,
 } from "./lib/deployment.js";
 import {
-  globalConfigPath,
   readGlobalConfig,
+  globalConfigPath,
 } from "./lib/utils/globalConfig.js";
 import { getTeamsForUser } from "./lib/api.js";
-import {
-  getProfileSelection,
-  initializeDefaultProfile,
-  legacyAuthForFirstProfile,
-  profileConfigPath,
-  readProfileAuth,
-  writeProfileCredentials,
-} from "./lib/profiles.js";
-import {
-  getDeployKeySource,
-  loadProjectEnvironmentVariables,
-} from "./lib/envvars.js";
-import { bindProfileToDirectory } from "./lib/profileManagement.js";
-import { warnIfDeployKeyOverridesLogin } from "./lib/deployKeyWarning.js";
+
+/**
+ * The env file a deploy key came from, or null if it came from the shell.
+ * `dotenv` doesn't overwrite variables that are already set, so a value from
+ * the shell outranks these files -- match on the value to tell them apart.
+ */
+function deployKeyEnvFile(
+  ctx: Context,
+  envVarName: string,
+  value: string,
+): string | null {
+  for (const file of [ENV_VAR_FILE_PATH, ".env"]) {
+    if (!ctx.fs.exists(file)) {
+      continue;
+    }
+    if (dotenv.parse(ctx.fs.readUtf8File(file))[envVarName] === value) {
+      return file;
+    }
+  }
+  return null;
+}
 
 /**
  * A project or deployment key in the environment outranks the account token for
@@ -71,7 +84,11 @@ async function reportDeployKeyInWorkingDirectory(
     return;
   }
   const key = auth.kind === "projectKey" ? auth.projectKey : auth.deploymentKey;
-  const { envVarName, source } = getDeployKeySource(key);
+  const envVarName = process.env[CONVEX_DEPLOY_KEY_ENV_VAR_NAME]
+    ? CONVEX_DEPLOY_KEY_ENV_VAR_NAME
+    : CONVEX_DEPLOYMENT_TOKEN_ENV_VAR_NAME;
+  const envFile = deployKeyEnvFile(ctx, envVarName, key);
+  const source = envFile ?? "shell environment";
   // Big Brain only strips a `project:`/`team:` prefix itself, so a deployment
   // key authorizes only without its `dev:`/`prod:` prefix. Split on the first
   // `|` like the server does, so a secret containing one survives.
@@ -83,291 +100,149 @@ async function reportDeployKeyInWorkingDirectory(
   logWarning(`Working Directory: Invalid ${envVarName} in ${source}`);
 }
 
-function createLoginStatusCommand() {
-  return new Command("status")
-    .description(
-      "Check login status and list accessible teams. Exits with code 1 when not logged in.",
-    )
-    .allowExcessArguments(false)
-    .action(async () => {
-      const ctx = await oneoffContext({
-        url: undefined,
-        adminKey: undefined,
-        envFile: undefined,
-      });
+const loginStatus = new Command("status")
+  .description("Check login status and list accessible teams")
+  .allowExcessArguments(false)
+  .action(async () => {
+    const ctx = await oneoffContext({
+      url: undefined,
+      adminKey: undefined,
+      envFile: undefined,
+    });
 
-      // Keep the directory's deploy key for separate reporting after selecting
-      // the account whose teams will be listed.
-      const auth = ctx.bigBrainAuth();
-      let accountAuth = auth?.kind === "accessToken" ? auth : null;
-      if (accountAuth === null) {
-        const profile = await getProfileSelection(ctx);
-        if (profile !== null) {
-          accountAuth = await readProfileAuth(ctx, profile);
-        } else {
-          const globalConfig = readGlobalConfig(ctx);
-          if (globalConfig !== null) {
-            accountAuth = {
-              kind: "accessToken",
-              accessToken: globalConfig.accessToken,
-              header: `Bearer ${globalConfig.accessToken}`,
-              profile: null,
-            };
-          }
-        }
-      }
-      if (accountAuth === null) {
-        logMessage(`No Convex account token found in: ${globalConfigPath()}`);
-        logMessage("Status: Not logged in");
-        await reportDeployKeyInWorkingDirectory(ctx, auth);
-        return await ctx.crash({
-          exitCode: 1,
-          errorType: "fatal",
-          printedMessage: null,
-        });
-      }
-      warnIfDeployKeyOverridesLogin(ctx, true);
-      if (accountAuth.profile) {
-        logMessage(`Account: ${accountAuth.profile.name}`);
-        logMessage(`Selected by: ${accountAuth.profile.source}`);
-        logMessage(
-          `Convex account token found in: ${profileConfigPath(accountAuth.profile.name)}`,
-        );
-      } else if (process.env.CONVEX_OVERRIDE_ACCESS_TOKEN) {
-        logMessage("Using CONVEX_OVERRIDE_ACCESS_TOKEN from the environment");
-      } else {
-        logMessage(`Convex account token found in: ${globalConfigPath()}`);
-      }
+    // `_updateBigBrainAuth` below replaces any deploy key in `ctx` with the
+    // account token, so read the deploy key first.
+    const auth = ctx.bigBrainAuth();
 
-      if (!(await isAuthorizedHeader(ctx, accountAuth.header))) {
-        logMessage("Status: Not logged in");
-        await reportDeployKeyInWorkingDirectory(ctx, auth);
-        return await ctx.crash({
-          exitCode: 1,
-          errorType: "fatal",
-          printedMessage: null,
-        });
-      }
+    const globalConfig = readGlobalConfig(ctx);
+    if (globalConfig === null) {
+      logMessage(`No Convex account token found in: ${globalConfigPath()}`);
+      logMessage("Status: Not logged in");
+      await reportDeployKeyInWorkingDirectory(ctx, auth);
+      return;
+    }
+    logMessage(`Convex account token found in: ${globalConfigPath()}`);
 
-      logMessage("Status: Logged in");
-      ctx._updateBigBrainAuth(accountAuth);
-      const teams = await getTeamsForUser(ctx);
-      logMessage(
-        `Teams: ${teams.length} team${teams.length === 1 ? "" : "s"} accessible`,
-      );
-      for (const team of teams) {
-        logMessage(`  - ${team.name} (${team.slug})`);
-      }
+    const accessToken = globalConfig.accessToken;
+    if (!(await isAuthorizedHeader(ctx, `Bearer ${accessToken}`))) {
+      logMessage("Status: Not logged in");
       await reportDeployKeyInWorkingDirectory(ctx, auth);
-    });
-}
+      return;
+    }
 
-export function createLoginCommand() {
-  return (
-    new Command("login")
-      .description("Login to Convex")
-      .allowExcessArguments(false)
-      .option("--account <name>", "Log in to a named account")
-      .option(
-        "--select",
-        "Select this account for this directory and its subdirectories",
-      )
-      .option(
-        "--device-name <name>",
-        "Provide a name for the device being authorized",
-      )
-      .option(
-        "-f, --force",
-        "Proceed with login even if a valid access token already exists for this device",
-      )
-      .option(
-        "--no-open",
-        "Don't automatically open the login link in the default browser",
-      )
-      .addOption(
-        new Option(
-          "--login-flow <mode>",
-          `How to log in; defaults to guessing based on the environment.`,
-        )
-          .choices(["paste", "auto", "poll"] as const)
-          .default("auto" as const),
-      )
-      .addOption(new Option("--link-deployments").hideHelp())
-      // These options are hidden from the help/usage message, but allow overriding settings for testing.
-      // Change the auth credentials with the auth provider
-      .addOption(new Option("--override-auth-url <url>").hideHelp())
-      .addOption(new Option("--override-auth-client <id>").hideHelp())
-      .addOption(new Option("--override-auth-username <username>").hideHelp())
-      .addOption(new Option("--override-auth-password <password>").hideHelp())
-      // Skip the auth provider login and directly use this access token
-      .addOption(new Option("--override-access-token <token>").hideHelp())
-      // Automatically accept opt ins without prompting
-      .addOption(new Option("--accept-opt-ins").hideHelp())
-      // Dump the access token from the auth provider and skip authorization with Convex
-      .addOption(new Option("--dump-access-token").hideHelp())
-      // Hidden option for tests to check if the user is logged in.
-      .addOption(new Option("--check-login").hideHelp())
-      // Redirect to Vercel SSO integration URL
-      .addOption(
-        new Option(
-          "--vercel",
-          "Redirect to Vercel SSO integration for login",
-        ).hideHelp(),
-      )
-      // Override the Vercel URL slug (defaults to 'convex')
-      .addOption(new Option("--vercel-override <slug>").hideHelp())
-      .addCommand(createLoginStatusCommand())
-      .addHelpCommand(false)
-      .action(async (options, cmd: Command) => {
-        const ctx = await oneoffContext({
-          url: undefined,
-          adminKey: undefined,
-          envFile: undefined,
-          skipAuth: true,
-        });
-        const profile = await getProfileSelection(ctx, {
-          name: options.account,
-        });
-        if (options.select && profile === null) {
-          cmd.error("Pass --account <name> with --select to name this login.");
-        }
-        loadProjectEnvironmentVariables();
-        let namingLegacyAccount = false;
-        if (profile !== null) {
-          let auth = options.force
-            ? null
-            : await readProfileAuth(ctx, profile, true);
-          if (
-            auth === null &&
-            !options.force &&
-            !options.overrideAccessToken &&
-            !options.overrideAuthUsername &&
-            !process.env.CONVEX_OVERRIDE_ACCESS_TOKEN
-          ) {
-            auth = await legacyAuthForFirstProfile(ctx, profile);
-            namingLegacyAccount = auth !== null;
-          }
-          ctx._updateBigBrainAuth(auth);
-        } else {
-          const accessToken =
-            process.env.CONVEX_OVERRIDE_ACCESS_TOKEN ||
-            readGlobalConfig(ctx)?.accessToken;
-          ctx._updateBigBrainAuth(
-            accessToken
-              ? {
-                  kind: "accessToken",
-                  accessToken,
-                  header: `Bearer ${accessToken}`,
-                  profile: null,
-                }
-              : null,
-          );
-        }
-        warnIfDeployKeyOverridesLogin(ctx, ctx.bigBrainAuth() !== null);
-        if (
-          !options.force &&
-          (await checkAuthorization(ctx, !!options.acceptOptIns))
-        ) {
-          const auth = ctx.bigBrainAuth();
-          if (
-            namingLegacyAccount &&
-            profile !== null &&
-            auth?.kind === "accessToken"
-          ) {
-            await writeProfileCredentials(
-              ctx,
-              profile.name,
-              auth.accessToken,
-              {},
-              null,
-            );
-          }
-          logFinishedStep(
-            profile !== null
-              ? namingLegacyAccount
-                ? `Saved account "${profile.name}" using your existing login.`
-                : `Account "${profile.name}" is already logged in.`
-              : "This device has previously been authorized and is ready for use with Convex.",
-          );
-          if (profile !== null && auth?.kind === "accessToken") {
-            await initializeDefaultProfile(
-              ctx,
-              profile,
-              namingLegacyAccount,
-              !!options.select,
-            );
-          }
-          if (options.select && profile !== null) {
-            if (!(await bindProfileToDirectory(ctx, profile.name))) {
-              return await ctx.crash({
-                exitCode: 1,
-                errorType: "fatal",
-                printedMessage: `Logged in as "${profile.name}", but the directory selection could not be changed.`,
-              });
-            }
-          }
-          await handleLinkingDeployments(ctx, {
-            interactive: !!options.linkDeployments,
-          });
-          return;
-        }
-        if (!options.force && options.checkLogin) {
-          const isLoggedIn = await checkAuthorization(
-            ctx,
-            !!options.acceptOptIns,
-          );
-          if (!isLoggedIn) {
-            return ctx.crash({
-              exitCode: 1,
-              errorType: "fatal",
-              errForSentry: "You are not logged in.",
-              printedMessage: "You are not logged in.",
-            });
-          }
-        }
-        if (!!options.overrideAuthUsername !== !!options.overrideAuthPassword) {
-          cmd.error(
-            "If overriding credentials, both username and password must be provided",
-          );
-        }
+    logMessage("Status: Logged in");
+    // Describe the account, even if a deploy key outranks it for other commands.
+    ctx._updateBigBrainAuth({
+      kind: "accessToken",
+      header: `Bearer ${accessToken}`,
+      accessToken,
+    });
+    const teams = await getTeamsForUser(ctx);
+    logMessage(
+      `Teams: ${teams.length} team${teams.length === 1 ? "" : "s"} accessible`,
+    );
+    for (const team of teams) {
+      logMessage(`  - ${team.name} (${team.slug})`);
+    }
+    await reportDeployKeyInWorkingDirectory(ctx, auth);
+  });
 
-        const uuid = loadUuidForAnonymousUser(ctx);
-        await performLogin(ctx, {
-          ...options,
-          profile,
-          anonymousId: uuid,
-          vercel: options.vercel,
-          vercelOverride: options.vercelOverride,
+export const login = new Command("login")
+  .description("Login to Convex")
+  .allowExcessArguments(false)
+  .option(
+    "--device-name <name>",
+    "Provide a name for the device being authorized",
+  )
+  .option(
+    "-f, --force",
+    "Proceed with login even if a valid access token already exists for this device",
+  )
+  .option(
+    "--no-open",
+    "Don't automatically open the login link in the default browser",
+  )
+  .addOption(
+    new Option(
+      "--login-flow <mode>",
+      `How to log in; defaults to guessing based on the environment.`,
+    )
+      .choices(["paste", "auto", "poll"] as const)
+      .default("auto" as const),
+  )
+  .addOption(new Option("--link-deployments").hideHelp())
+  // These options are hidden from the help/usage message, but allow overriding settings for testing.
+  // Change the auth credentials with the auth provider
+  .addOption(new Option("--override-auth-url <url>").hideHelp())
+  .addOption(new Option("--override-auth-client <id>").hideHelp())
+  .addOption(new Option("--override-auth-username <username>").hideHelp())
+  .addOption(new Option("--override-auth-password <password>").hideHelp())
+  // Skip the auth provider login and directly use this access token
+  .addOption(new Option("--override-access-token <token>").hideHelp())
+  // Automatically accept opt ins without prompting
+  .addOption(new Option("--accept-opt-ins").hideHelp())
+  // Dump the access token from the auth provider and skip authorization with Convex
+  .addOption(new Option("--dump-access-token").hideHelp())
+  // Hidden option for tests to check if the user is logged in.
+  .addOption(new Option("--check-login").hideHelp())
+  // Redirect to Vercel SSO integration URL
+  .addOption(
+    new Option(
+      "--vercel",
+      "Redirect to Vercel SSO integration for login",
+    ).hideHelp(),
+  )
+  // Override the Vercel URL slug (defaults to 'convex')
+  .addOption(new Option("--vercel-override <slug>").hideHelp())
+  .addCommand(loginStatus)
+  .addHelpCommand(false)
+  .action(async (options, cmd: Command) => {
+    const ctx = await oneoffContext({
+      url: undefined,
+      adminKey: undefined,
+      envFile: undefined,
+    });
+    if (
+      !options.force &&
+      (await checkAuthorization(ctx, !!options.acceptOptIns))
+    ) {
+      logFinishedStep(
+        "This device has previously been authorized and is ready for use with Convex.",
+      );
+      await handleLinkingDeployments(ctx, {
+        interactive: !!options.linkDeployments,
+      });
+      return;
+    }
+    if (!options.force && options.checkLogin) {
+      const isLoggedIn = await checkAuthorization(ctx, !!options.acceptOptIns);
+      if (!isLoggedIn) {
+        return ctx.crash({
+          exitCode: 1,
+          errorType: "fatal",
+          errForSentry: "You are not logged in.",
+          printedMessage: "You are not logged in.",
         });
+      }
+    }
+    if (!!options.overrideAuthUsername !== !!options.overrideAuthPassword) {
+      cmd.error(
+        "If overriding credentials, both username and password must be provided",
+      );
+    }
 
-        const auth = ctx.bigBrainAuth();
-        if (profile !== null && auth?.kind === "accessToken") {
-          await initializeDefaultProfile(
-            ctx,
-            profile,
-            namingLegacyAccount,
-            !!options.select,
-          );
-        }
-        if (options.select && profile !== null) {
-          if (!(await bindProfileToDirectory(ctx, profile.name))) {
-            return await ctx.crash({
-              exitCode: 1,
-              errorType: "fatal",
-              printedMessage: `Logged in as "${profile.name}", but the directory selection could not be changed.`,
-            });
-          }
-        }
-        warnIfDeployKeyOverridesLogin(ctx, true);
-
-        await handleLinkingDeployments(ctx, {
-          interactive: !!options.linkDeployments,
-        });
-      })
-  );
-}
+    const uuid = loadUuidForAnonymousUser(ctx);
+    await performLogin(ctx, {
+      ...options,
+      anonymousId: uuid,
+      vercel: options.vercel,
+      vercelOverride: options.vercelOverride,
+    });
 
-export const login = createLoginCommand();
+    await handleLinkingDeployments(ctx, {
+      interactive: !!options.linkDeployments,
+    });
+  });
 
 async function handleLinkingDeployments(
   ctx: Context,

package/src/cli/logout.ts

@@ -1,149 +1,24 @@
 import { Command } from "@commander-js/extra-typings";
 import { oneoffContext } from "../bundler/context.js";
-import { logFinishedStep, logMessage, logWarning } from "../bundler/log.js";
+import { logFinishedStep } from "../bundler/log.js";
 import { recursivelyDelete } from "./lib/fsUtils.js";
 import { globalConfigPath } from "./lib/utils/globalConfig.js";
-import {
-  getProfileSelection,
-  profileConfigPath,
-  readProfileToken,
-  readProfileSettings,
-  updateProfileSettings,
-  savedProfileNames,
-} from "./lib/profiles.js";
-import path from "path";
-import { rootDirectory } from "./lib/utils/utils.js";
-import { promptOptions } from "./lib/utils/prompts.js";
 
-export function createLogoutCommand() {
-  return new Command("logout")
-    .description(
-      "Log out of the selected account. Directory selections are preserved.",
-    )
-    .option("--account <name>", "Remove only this account's saved credentials")
-    .option(
-      "--all",
-      "Remove all saved account credentials, preserving account selections",
-    )
-    .allowExcessArguments(false)
-    .action(async (options, cmd) => {
-      if (options.all && options.account !== undefined)
-        cmd.error("Pass either --account or --all, not both.");
-      const ctx = await oneoffContext({
-        url: undefined,
-        adminKey: undefined,
-        envFile: undefined,
-        skipAuth: true,
-      });
-
-      let all = !!options.all;
-      let profile = all
-        ? null
-        : await getProfileSelection(ctx, { name: options.account });
-      if (
-        !all &&
-        options.account === undefined &&
-        process.stdin.isTTY &&
-        profile !== null
-      ) {
-        const token = readProfileToken(ctx, profile.name);
-        const settings = await readProfileSettings(ctx);
-        const selectedName = profile.name;
-        // A matching compatibility token is another copy of this account's login.
-        const hasOtherLogins =
-          savedProfileNames(ctx).some((name) => name !== selectedName) ||
-          (typeof settings.accessToken === "string" &&
-            settings.accessToken.length > 0 &&
-            settings.accessToken !== token);
-        if (hasOtherLogins) {
-          const scope = await promptOptions(ctx, {
-            message: "Which saved logins would you like to log out of?",
-            choices: [
-              { name: `Only account "${profile.name}"`, value: "profile" },
-              { name: "All saved logins on this device", value: "all" },
-            ],
-            default: "profile",
-          });
-          if (scope === "all") {
-            profile = null;
-            all = true;
-          }
-        }
-      }
-
-      let warnAboutLegacyCredentials = false;
-      if (profile !== null) {
-        const selectedName = profile.name;
-        await updateProfileSettings(
-          ctx,
-          (settings) => {
-            const token = readProfileToken(ctx, selectedName);
-            // A migrated account can share its token with old CLI versions.
-            if (token !== null && settings.accessToken === token) {
-              delete settings.accessToken;
-            } else if (
-              settings.defaultProfile === selectedName &&
-              typeof settings.accessToken === "string" &&
-              settings.accessToken.length > 0
-            ) {
-              // Editing the default or logging in with an older CLI can leave this
-              // token belonging to a different account.
-              warnAboutLegacyCredentials = true;
-            }
-          },
-          () => {
-            const configPath = profileConfigPath(selectedName);
-            recursivelyDelete(ctx, configPath, {
-              force: true,
-              followSymlinks: false,
-            });
-          },
-        );
-      } else {
-        await updateProfileSettings(
-          ctx,
-          async (settings) => {
-            if (
-              !all &&
-              savedProfileNames(ctx).length > 0 &&
-              settings.accessToken === undefined
-            ) {
-              return await ctx.crash({
-                exitCode: 1,
-                errorType: "fatal",
-                printedMessage:
-                  "No account is selected. Use `npx convex logout --account <name>` or `npx convex logout --all`.",
-              });
-            }
-            delete settings.accessToken;
-          },
-          () => {
-            const profilesDir = path.join(rootDirectory(), "profiles");
-            if (all)
-              recursivelyDelete(ctx, profilesDir, {
-                force: true,
-                followSymlinks: false,
-              });
-          },
-        );
-      }
-
-      logFinishedStep(
-        profile !== null
-          ? `Removed credentials for account "${profile.name}".\n  Run \`npx convex login --account ${profile.name}\` to log in.`
-          : `${all ? "Removed all saved Convex account credentials." : "Removed your saved Convex login credentials."}\n  Run \`npx convex login\` to log in.`,
-      );
-      if (warnAboutLegacyCredentials) {
-        logWarning(
-          `Saved credentials remain in ${globalConfigPath()} for older CLI versions. To remove all saved account credentials, run \`npx convex logout --all\`.`,
-        );
-      }
-      if (process.env.CONVEX_OVERRIDE_ACCESS_TOKEN) {
-        logMessage(
-          "CONVEX_OVERRIDE_ACCESS_TOKEN still supplies credentials. Unset it to stop using that token.",
-        );
-      }
+export const logout = new Command("logout")
+  .description("Log out of Convex on this machine")
+  .allowExcessArguments(false)
+  .action(async () => {
+    const ctx = await oneoffContext({
+      url: undefined,
+      adminKey: undefined,
+      envFile: undefined,
     });
-}
 
-export const logout = createLogoutCommand();
+    if (ctx.fs.exists(globalConfigPath())) {
+      recursivelyDelete(ctx, globalConfigPath());
+    }
+
+    logFinishedStep(
+      "You have been logged out of Convex.\n  Run `npx convex dev` to log in.",
+    );
+  });