convex 1.48.0 → 1.49.0-alpha.0

package/src/cli/lib/accountManagement.ts

@@ -0,0 +1,262 @@
+import { ProjectSelection } from "./deploymentSelection.js";
+import { Context } from "../../bundler/context.js";
+import { logMessage, logWarning } from "../../bundler/log.js";
+import { provisionHost } from "./config.js";
+import { version } from "../version.js";
+import {
+  isAnonymousDeployment,
+  getDeploymentTypeFromConfiguredDeployment,
+  stripDeploymentTypePrefix,
+} from "./deployment.js";
+import { CONVEX_DEPLOYMENT_ENV_VAR_NAME } from "./utils/utils.js";
+import { promptYesNo } from "./utils/prompts.js";
+import { loadProjectEnvironmentVariables } from "./envvars.js";
+import {
+  AccountCredentials,
+  AccountSelection,
+  readAccountCredentials,
+  readAccountSettings,
+  readAccountToken,
+  savedAccountNames,
+  writeAccountDirectory,
+} from "./accounts.js";
+
+export async function accountApi(
+  token: string,
+  pathname: string,
+  body?: unknown,
+) {
+  return await fetch(`${provisionHost}${pathname}`, {
+    method: body === undefined ? "GET" : "POST",
+    headers: {
+      Authorization: `Bearer ${token}`,
+      "Convex-Client": `npm-cli-${version}`,
+      ...(body === undefined ? {} : { "Content-Type": "application/json" }),
+    },
+    ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+    signal: AbortSignal.timeout(10_000),
+  });
+}
+
+export async function deploymentAccess(
+  token: string,
+  deploymentName: string,
+): Promise<"yes" | "no" | "unknown"> {
+  try {
+    const response = await accountApi(
+      token,
+      `/v1/deployments/${encodeURIComponent(deploymentName)}`,
+    );
+    if (response.ok) return "yes";
+    return [401, 403, 404].includes(response.status) ? "no" : "unknown";
+  } catch {
+    return "unknown";
+  }
+}
+
+export async function projectAccess(
+  token: string,
+  target: ProjectSelection,
+): Promise<"yes" | "no" | "unknown"> {
+  if (target.kind === "deploymentName")
+    return deploymentAccess(token, target.deploymentName);
+  if (target.kind !== "teamAndProjectSlugs") return "unknown";
+  try {
+    const response = await accountApi(
+      token,
+      `/v1/teams/${encodeURIComponent(target.teamSlug)}/projects/${encodeURIComponent(target.projectSlug)}`,
+    );
+    if (response.ok) return "yes";
+    return [401, 403, 404].includes(response.status) ? "no" : "unknown";
+  } catch {
+    return "unknown";
+  }
+}
+
+function configuredCloudDeployment(): string | null {
+  const configured = process.env[CONVEX_DEPLOYMENT_ENV_VAR_NAME]?.trim();
+  if (
+    !configured ||
+    getDeploymentTypeFromConfiguredDeployment(configured) === "local"
+  )
+    return null;
+  const name = stripDeploymentTypePrefix(configured);
+  return isAnonymousDeployment(name) ? null : name;
+}
+
+export async function bindAccountToDirectory(
+  ctx: Context,
+  name: string,
+  force = false,
+  target?: ProjectSelection,
+): Promise<boolean> {
+  const credentials = await readAccountCredentials(ctx, {
+    name,
+    source: "account selection",
+  });
+  loadProjectEnvironmentVariables();
+  const deployment = configuredCloudDeployment();
+  const selectedTarget =
+    target ??
+    (deployment === null
+      ? null
+      : {
+          kind: "deploymentName" as const,
+          deploymentName: deployment,
+          deploymentType: null,
+        });
+  if (!force && selectedTarget !== null) {
+    const label =
+      selectedTarget.kind === "teamAndProjectSlugs"
+        ? `project "${selectedTarget.teamSlug}/${selectedTarget.projectSlug}"`
+        : `deployment "${selectedTarget.kind === "deploymentName" ? selectedTarget.deploymentName : "configured"}"`;
+    const access = await projectAccess(
+      credentials!.accessToken,
+      selectedTarget,
+    );
+    if (access !== "yes") {
+      logWarning(
+        access === "no"
+          ? `Account "${name}" cannot access ${label}.`
+          : `Could not verify whether account "${name}" can access ${label}.`,
+      );
+      if (
+        !process.stdin.isTTY ||
+        !(await promptYesNo(ctx, {
+          message: `Use account "${name}" here anyway?`,
+          default: false,
+        }))
+      ) {
+        logMessage(
+          `Directory selection unchanged. To select this account anyway, run \`npx convex account select ${name} --force\`.`,
+        );
+        return false;
+      }
+    }
+  }
+  await writeAccountDirectory(ctx, name);
+  return true;
+}
+
+export async function accountLoginMetadata(
+  ctx: Context,
+  account: AccountSelection,
+  loginToken: string,
+  previous: AccountCredentials | null,
+): Promise<Omit<AccountCredentials, "accessToken">> {
+  let identity: { memberId: string; email: string } | null = null;
+  try {
+    const response = await accountApi(loginToken, "/api/dashboard/profile");
+    if (response.ok) {
+      const data = await response.json();
+      if (
+        (typeof data.id === "number" || typeof data.id === "string") &&
+        typeof data.email === "string"
+      ) {
+        identity = { memberId: String(data.id), email: data.email };
+      }
+    }
+  } catch {
+    // Older authentication tokens can be valid without access to the dashboard profile API.
+  }
+  const sameAccount =
+    previous !== null && (previous.memberId === undefined || identity === null)
+      ? await tokensBelongToSameAccount(previous.accessToken, loginToken)
+      : null;
+  if (
+    previous !== null &&
+    (previous.memberId === undefined || identity === null
+      ? sameAccount !== true
+      : identity.memberId !== previous.memberId)
+  ) {
+    return await ctx.crash({
+      exitCode: 1,
+      errorType: "fatal",
+      printedMessage:
+        sameAccount === null &&
+        (previous.memberId === undefined || identity === null)
+          ? `Could not verify the identity of saved account "${account.name}". To replace this saved login, run \`npx convex logout --account ${account.name}\` followed by \`npx convex login --account ${account.name}\`. Choose the intended account when logging in.`
+          : `The login does not match saved account "${account.name}". Log in with the matching account, or choose another name with \`npx convex login --account <name>\`.`,
+    });
+  }
+  return {
+    ...(identity ??
+      (previous?.memberId === undefined
+        ? {}
+        : { memberId: previous.memberId, email: previous.email })),
+  };
+}
+
+async function tokensBelongToSameAccount(
+  older: string,
+  newer: string,
+): Promise<boolean | null> {
+  try {
+    const responses = await Promise.all(
+      [older, newer].map((token) =>
+        accountApi(token, "/v1/list_personal_access_tokens?limit=100"),
+      ),
+    );
+    if (responses.some((response) => !response.ok)) return null;
+    const lists = await Promise.all(
+      responses.map((response) => response.json()),
+    );
+    if (
+      lists.some(
+        (list) => !Array.isArray(list.items) || list.items.length === 0,
+      )
+    )
+      return null;
+    const ids = new Set(
+      lists[0].items.map((token: { id: unknown }) => String(token.id)),
+    );
+    if (
+      lists[1].items.some((token: { id: unknown }) => ids.has(String(token.id)))
+    )
+      return true;
+    // Disjoint partial pages cannot establish that the accounts differ.
+    return lists.some((list) => list.pagination?.hasMore !== false)
+      ? null
+      : false;
+  } catch {
+    return null;
+  }
+}
+
+export async function revokeReplacedAccountToken(
+  ctx: Context,
+  previous: string | undefined,
+  accessToken: string,
+) {
+  if (previous === undefined || previous === accessToken) return;
+  const settings = await readAccountSettings(ctx);
+  if (
+    settings.revokeReplacedTokens === false ||
+    settings.accessToken === previous
+  )
+    return;
+  for (const name of savedAccountNames(ctx)) {
+    const token = readAccountToken(ctx, name);
+    if (token === null) {
+      logWarning(
+        `The new login was saved, but account "${name}" could not be read. Skipping revocation of the replaced token.`,
+      );
+      return;
+    }
+    if (token === previous) return;
+  }
+  try {
+    // The API verifies token ownership using the newly authenticated account.
+    const response = await accountApi(
+      accessToken,
+      "/v1/delete_personal_access_token",
+      { id: previous },
+    );
+    if (response.ok) return;
+  } catch {
+    // The new credentials are already saved, so a failed revocation can be retried in the dashboard.
+  }
+  logWarning(
+    "The new login was saved, but the replaced token could not be revoked. You can remove it in the dashboard's account settings.",
+  );
+}

package/src/cli/lib/accounts.ts

@@ -0,0 +1,400 @@
+import path from "path";
+import { isDeepStrictEqual } from "util";
+import { randomUUID } from "crypto";
+import { TempPath } from "../../bundler/fs.js";
+import * as dotenv from "dotenv";
+import { z } from "zod";
+import { BigBrainAuth, Context } from "../../bundler/context.js";
+import { logFinishedStep, logWarning } from "../../bundler/log.js";
+import { globalConfigPath, readGlobalConfig } from "./utils/globalConfig.js";
+import { ENV_VAR_FILE_PATH, rootDirectory } from "./utils/utils.js";
+
+import { CONVEX_ACCOUNT_ENV_VAR } from "./envvars.js";
+
+export type AccountSelection = {
+  name: string;
+  source: string;
+};
+
+const settingsSchema = z
+  .object({
+    defaultAccount: z.string().optional(),
+    directories: z.record(z.string()).optional(),
+    revokeReplacedTokens: z.boolean().optional(),
+  })
+  .passthrough();
+
+const credentialsSchema = z
+  .object({
+    accessToken: z.string().min(1),
+    memberId: z.string().optional(),
+    email: z.string().optional(),
+  })
+  .passthrough();
+
+export type AccountCredentials = z.infer<typeof credentialsSchema>;
+
+export async function readAccountSettings(
+  ctx: Context,
+): Promise<z.infer<typeof settingsSchema>> {
+  if (!ctx.fs.exists(globalConfigPath())) return {};
+  try {
+    return settingsSchema.parse(
+      JSON.parse(ctx.fs.readUtf8File(globalConfigPath())),
+    );
+  } catch {
+    return await ctx.crash({
+      exitCode: 1,
+      errorType: "invalid filesystem data",
+      printedMessage: `Unable to read account settings from ${globalConfigPath()}. Check defaultAccount, directories, and revokeReplacedTokens.`,
+    });
+  }
+}
+
+function writeAccountSettings(ctx: Context, settings: Record<string, unknown>) {
+  if (Object.keys(settings).length === 0) {
+    if (ctx.fs.exists(globalConfigPath())) ctx.fs.unlink(globalConfigPath());
+    return;
+  }
+  const temporary = `${globalConfigPath()}.${randomUUID()}.tmp` as TempPath;
+  try {
+    ctx.fs.writeUtf8File(temporary, JSON.stringify(settings, null, 2), 0o600);
+    ctx.fs.swapTmpFile(temporary, globalConfigPath());
+  } finally {
+    if (ctx.fs.exists(temporary)) ctx.fs.unlink(temporary);
+  }
+}
+
+export async function updateAccountSettings<T>(
+  ctx: Context,
+  update: (settings: z.infer<typeof settingsSchema>) => T | Promise<T>,
+  afterWrite?: () => void,
+): Promise<T> {
+  const lockPath = `${globalConfigPath()}.lock`;
+  ctx.fs.mkdir(rootDirectory(), { allowExisting: true });
+  const deadline = Date.now() + 5000;
+  for (;;) {
+    try {
+      ctx.fs.mkdir(lockPath);
+      break;
+    } catch (err: any) {
+      // Only the process that creates the directory owns the update lock.
+      // eslint-disable-next-line no-restricted-syntax
+      if (err.code !== "EEXIST") throw err;
+      if (Date.now() >= deadline) {
+        return await ctx.crash({
+          exitCode: 1,
+          errorType: "fatal",
+          printedMessage: `Another command is updating Convex accounts. Retry after it finishes. If it was interrupted, remove ${lockPath}.`,
+        });
+      }
+      await new Promise((resolve) => setTimeout(resolve, 25));
+    }
+  }
+  let released = false;
+  const release = () => {
+    if (released) return;
+    ctx.fs.rmdir(lockPath);
+    released = true;
+  };
+  const cleanup = ctx.registerCleanup(async () => release());
+  try {
+    const settings = await readAccountSettings(ctx);
+    const result = await update(settings);
+    writeAccountSettings(ctx, settings);
+    // Credential deletion follows persistence while sharing the lock with renewals.
+    afterWrite?.();
+    return result;
+  } finally {
+    ctx.removeCleanup(cleanup);
+    release();
+  }
+}
+
+export function accountConfigPath(name: string): string {
+  return path.join(
+    rootDirectory(),
+    "accounts",
+    `${encodeURIComponent(name)}.json`,
+  );
+}
+
+export async function validateAccountName(
+  ctx: Context,
+  name: string,
+): Promise<void> {
+  if (!/^[a-z0-9][a-z0-9_-]*$/.test(name)) {
+    await ctx.crash({
+      exitCode: 1,
+      errorType: "invalid filesystem or env vars",
+      printedMessage:
+        "Account names must start with a lowercase letter or number and contain only lowercase letters, numbers, hyphens, and underscores.",
+    });
+  }
+}
+
+export async function getAccountSelection(
+  ctx: Context,
+  options: { name?: string | undefined; envFile?: string | undefined } = {},
+): Promise<AccountSelection | null> {
+  let name = options.name;
+  let source = "--account";
+  if (name === undefined && process.env[CONVEX_ACCOUNT_ENV_VAR] !== undefined) {
+    name = process.env[CONVEX_ACCOUNT_ENV_VAR];
+    source = `${CONVEX_ACCOUNT_ENV_VAR} environment variable`;
+  }
+  if (name === undefined) {
+    const files = options.envFile
+      ? [options.envFile]
+      : [ENV_VAR_FILE_PATH, ".env"];
+    for (const file of files) {
+      if (!ctx.fs.exists(file)) continue;
+      name = dotenv.parse(ctx.fs.readUtf8File(file))[CONVEX_ACCOUNT_ENV_VAR];
+      if (name !== undefined) {
+        source = `${CONVEX_ACCOUNT_ENV_VAR} in ${file}`;
+        break;
+      }
+    }
+  }
+  if (name === undefined) {
+    const config = await readAccountSettings(ctx);
+    const binding = findAccountDirectory(
+      config.directories ?? {},
+      process.cwd(),
+    );
+    name = binding?.name ?? config.defaultAccount;
+    source = binding
+      ? `directory selection for ${binding.directory}`
+      : `default account in ${globalConfigPath()}`;
+  }
+  if (name === undefined) return null;
+  await validateAccountName(ctx, name);
+  return { name, source };
+}
+
+export async function readAccountAuth(
+  ctx: Context,
+  account: AccountSelection,
+  allowMissing = false,
+): Promise<Extract<BigBrainAuth, { kind: "accessToken" }> | null> {
+  const credentials = await readAccountCredentials(ctx, account, allowMissing);
+  return credentials === null
+    ? null
+    : {
+        kind: "accessToken",
+        accessToken: credentials.accessToken,
+        header: `Bearer ${credentials.accessToken}`,
+        account,
+      };
+}
+
+export async function readAccountCredentials(
+  ctx: Context,
+  account: AccountSelection,
+  allowMissing = false,
+): Promise<AccountCredentials | null> {
+  await validateAccountName(ctx, account.name);
+  const configPath = accountConfigPath(account.name);
+  if (!ctx.fs.exists(configPath)) {
+    if (allowMissing) return null;
+    return await ctx.crash({
+      exitCode: 1,
+      errorType: "invalid filesystem data",
+      printedMessage: `Account "${account.name}" selected by ${account.source} is not logged in. Run \`npx convex login --account ${account.name}\`.`,
+    });
+  }
+  try {
+    return credentialsSchema.parse(JSON.parse(ctx.fs.readUtf8File(configPath)));
+  } catch {
+    return await ctx.crash({
+      exitCode: 1,
+      errorType: "invalid filesystem data",
+      printedMessage: `Unable to read credentials for account "${account.name}" from ${configPath}.`,
+    });
+  }
+}
+
+export function readAccountToken(ctx: Context, name: string): string | null {
+  try {
+    const token = JSON.parse(
+      ctx.fs.readUtf8File(accountConfigPath(name)),
+    ).accessToken;
+    return typeof token === "string" && token.length > 0 ? token : null;
+  } catch {
+    return null;
+  }
+}
+
+async function writeCredentialsFile(
+  ctx: Context,
+  name: string,
+  credentials: AccountCredentials,
+) {
+  const configPath = accountConfigPath(name);
+  const directory = path.dirname(configPath);
+  ctx.fs.mkdir(directory, { allowExisting: true });
+  for (const dir of [rootDirectory(), directory]) {
+    if (!ctx.fs.lstat(dir).isDirectory()) {
+      return await ctx.crash({
+        exitCode: 1,
+        errorType: "invalid filesystem data",
+        printedMessage: `Cannot save account credentials through a symlink or non-directory: ${dir}.`,
+      });
+    }
+  }
+  const temporary = `${configPath}.${randomUUID()}.tmp` as TempPath;
+  try {
+    ctx.fs.writeUtf8File(
+      temporary,
+      JSON.stringify(credentials, null, 2),
+      0o600,
+    );
+    ctx.fs.swapTmpFile(temporary, configPath);
+  } finally {
+    if (ctx.fs.exists(temporary)) ctx.fs.unlink(temporary);
+  }
+}
+
+export async function writeAccountCredentials(
+  ctx: Context,
+  name: string,
+  accessToken: string,
+  metadata: Omit<AccountCredentials, "accessToken"> = {},
+  expected?: AccountCredentials | null,
+  onConflict?: () => Promise<void>,
+): Promise<void> {
+  await validateAccountName(ctx, name);
+  await updateAccountSettings(ctx, async (settings) => {
+    if (expected !== undefined) {
+      const current = await readAccountCredentials(
+        ctx,
+        { name, source: "login" },
+        true,
+      );
+      if (!isDeepStrictEqual(current, expected)) {
+        await onConflict?.();
+        return await ctx.crash({
+          exitCode: 1,
+          errorType: "fatal",
+          printedMessage: `Account "${name}" changed during login. Retry the login.`,
+        });
+      }
+    }
+    await writeCredentialsFile(ctx, name, { ...metadata, accessToken });
+    if (settings.defaultAccount === name) settings.accessToken = accessToken;
+  });
+}
+
+export async function legacyAuthForFirstAccount(
+  ctx: Context,
+  account: AccountSelection,
+): Promise<Extract<BigBrainAuth, { kind: "accessToken" }> | null> {
+  const settings = await readAccountSettings(ctx);
+  const accountsDir = path.dirname(accountConfigPath(account.name));
+  if (
+    settings.defaultAccount !== undefined ||
+    (ctx.fs.exists(accountsDir) &&
+      ctx.fs.listDir(accountsDir).some((entry) => entry.name.endsWith(".json")))
+  ) {
+    return null;
+  }
+  const config = readGlobalConfig(ctx);
+  return config === null
+    ? null
+    : {
+        kind: "accessToken",
+        accessToken: config.accessToken,
+        header: `Bearer ${config.accessToken}`,
+        account,
+      };
+}
+
+export async function initializeDefaultAccount(
+  ctx: Context,
+  account: AccountSelection,
+  namingLegacyAccount: boolean,
+  select = true,
+) {
+  const defaultAccount = await updateAccountSettings(ctx, async (settings) => {
+    if (settings.defaultAccount !== undefined) return undefined;
+    const credentials = await readAccountCredentials(ctx, account);
+    const accessToken = credentials!.accessToken;
+    const legacyToken = settings.accessToken;
+    if (
+      !select &&
+      (savedAccountNames(ctx).some((name) => name !== account.name) ||
+        (!namingLegacyAccount &&
+          typeof legacyToken === "string" &&
+          legacyToken.length > 0 &&
+          legacyToken !== accessToken))
+    )
+      return undefined;
+    if (
+      !namingLegacyAccount &&
+      typeof legacyToken === "string" &&
+      legacyToken.length > 0 &&
+      legacyToken !== accessToken
+    ) {
+      // An explicitly new login keeps the previous account as the default for
+      // directories that haven't selected an account.
+      let legacyName = "default";
+      for (
+        let suffix = 2;
+        ctx.fs.exists(accountConfigPath(legacyName));
+        suffix++
+      ) {
+        legacyName = `default-${suffix}`;
+      }
+      await writeCredentialsFile(ctx, legacyName, { accessToken: legacyToken });
+      settings.defaultAccount = legacyName;
+    } else {
+      settings.defaultAccount = account.name;
+      settings.accessToken = accessToken;
+    }
+
+    return settings.defaultAccount;
+  });
+  if (defaultAccount !== undefined)
+    logFinishedStep(`Default account: ${defaultAccount}`);
+}
+
+export function findAccountDirectory(
+  directories: Record<string, string>,
+  cwd: string,
+): { directory: string; name: string } | null {
+  let directory = path.resolve(cwd);
+  for (;;) {
+    if (Object.hasOwn(directories, directory)) {
+      return { directory, name: directories[directory] };
+    }
+    const parent = path.dirname(directory);
+    if (parent === directory) return null;
+    directory = parent;
+  }
+}
+
+export function savedAccountNames(ctx: Context): string[] {
+  const directory = path.join(rootDirectory(), "accounts");
+  if (!ctx.fs.exists(directory)) return [];
+  return ctx.fs
+    .listDir(directory)
+    .filter((entry) => entry.name.endsWith(".json"))
+    .map((entry) => entry.name.slice(0, -5))
+    .sort();
+}
+
+export async function writeAccountDirectory(ctx: Context, name: string) {
+  await validateAccountName(ctx, name);
+  await updateAccountSettings(ctx, (settings) => {
+    settings.directories = { ...settings.directories, [process.cwd()]: name };
+  });
+  logFinishedStep(
+    `Saved directory selection: ${name} (applies to this directory and its subdirectories).`,
+  );
+  const selected = await getAccountSelection(ctx);
+  if (selected !== null && selected.name !== name) {
+    logWarning(
+      `Account "${selected.name}" selected by ${selected.source} overrides this directory selection. Remove that override to use account "${name}".`,
+    );
+  }
+}

package/src/cli/lib/deployKeyWarning.ts

@@ -0,0 +1,43 @@
+import { Context } from "../../bundler/context.js";
+import { logWarning } from "../../bundler/log.js";
+import {
+  deploymentNameFromAdminKey,
+  deploymentTypeFromAdminKey,
+  isDeploymentKey,
+  isPreviewDeployKey,
+  isProjectKey,
+} from "./deployment.js";
+import { getDeployKeySource } from "./envvars.js";
+import { IGNORED_DEPLOY_KEY, readDeployKeyFromEnv } from "./utils/utils.js";
+
+const warnedContexts = new WeakSet<Context>();
+
+export function warnIfDeployKeyOverridesLogin(
+  ctx: Context,
+  hasAccount: boolean,
+) {
+  if (
+    !hasAccount ||
+    warnedContexts.has(ctx) ||
+    process.env.CONVEX_OVERRIDE_ACCESS_TOKEN
+  )
+    return;
+  const key = readDeployKeyFromEnv((name) => process.env[name]);
+  if (
+    key === undefined ||
+    key === IGNORED_DEPLOY_KEY ||
+    isPreviewDeployKey(key)
+  )
+    return;
+  const { envVarName, source } = getDeployKeySource(key);
+  const type = deploymentTypeFromAdminKey(key);
+  const target = isDeploymentKey(key)
+    ? `${type === "prod" ? "production" : type} deployment "${deploymentNameFromAdminKey(key)}"`
+    : isProjectKey(key)
+      ? "the project selected by the key"
+      : "the deployment selected by the key";
+  logWarning(
+    `WARNING: ${envVarName} in ${source} overrides your Convex account for deployment commands. They target ${target}. Remove ${envVarName} to use the selected account.`,
+  );
+  warnedContexts.add(ctx);
+}