convex 1.48.0 → 1.49.0-alpha.0

package/src/cli/login.ts

@@ -1,5 +1,4 @@
 import { Command, Option } from "@commander-js/extra-typings";
-import * as dotenv from "dotenv";
 import { BigBrainAuth, Context, oneoffContext } from "../bundler/context.js";
 import { logFinishedStep, logMessage, logWarning } from "../bundler/log.js";
 import {
@@ -21,12 +20,7 @@ import {
   teamDashboardUrl,
 } from "./lib/dashboard.js";
 import { promptSearch, promptYesNo } from "./lib/utils/prompts.js";
-import {
-  CONVEX_DEPLOY_KEY_ENV_VAR_NAME,
-  CONVEX_DEPLOYMENT_TOKEN_ENV_VAR_NAME,
-  ENV_VAR_FILE_PATH,
-  validateOrSelectTeam,
-} from "./lib/utils/utils.js";
+import { validateOrSelectTeam } from "./lib/utils/utils.js";
 import {
   selectProject,
   updateEnvAndConfigForDeploymentSelection,
@@ -40,31 +34,24 @@ import {
   removeAnonymousPrefix,
 } from "./lib/deployment.js";
 import {
-  readGlobalConfig,
   globalConfigPath,
+  readGlobalConfig,
 } from "./lib/utils/globalConfig.js";
 import { getTeamsForUser } from "./lib/api.js";
-
-/**
- * The env file a deploy key came from, or null if it came from the shell.
- * `dotenv` doesn't overwrite variables that are already set, so a value from
- * the shell outranks these files -- match on the value to tell them apart.
- */
-function deployKeyEnvFile(
-  ctx: Context,
-  envVarName: string,
-  value: string,
-): string | null {
-  for (const file of [ENV_VAR_FILE_PATH, ".env"]) {
-    if (!ctx.fs.exists(file)) {
-      continue;
-    }
-    if (dotenv.parse(ctx.fs.readUtf8File(file))[envVarName] === value) {
-      return file;
-    }
-  }
-  return null;
-}
+import {
+  getAccountSelection,
+  initializeDefaultAccount,
+  legacyAuthForFirstAccount,
+  accountConfigPath,
+  readAccountAuth,
+  writeAccountCredentials,
+} from "./lib/accounts.js";
+import {
+  getDeployKeySource,
+  loadProjectEnvironmentVariables,
+} from "./lib/envvars.js";
+import { bindAccountToDirectory } from "./lib/accountManagement.js";
+import { warnIfDeployKeyOverridesLogin } from "./lib/deployKeyWarning.js";
 
 /**
  * A project or deployment key in the environment outranks the account token for
@@ -84,11 +71,7 @@ async function reportDeployKeyInWorkingDirectory(
     return;
   }
   const key = auth.kind === "projectKey" ? auth.projectKey : auth.deploymentKey;
-  const envVarName = process.env[CONVEX_DEPLOY_KEY_ENV_VAR_NAME]
-    ? CONVEX_DEPLOY_KEY_ENV_VAR_NAME
-    : CONVEX_DEPLOYMENT_TOKEN_ENV_VAR_NAME;
-  const envFile = deployKeyEnvFile(ctx, envVarName, key);
-  const source = envFile ?? "shell environment";
+  const { envVarName, source } = getDeployKeySource(key);
   // Big Brain only strips a `project:`/`team:` prefix itself, so a deployment
   // key authorizes only without its `dev:`/`prod:` prefix. Split on the first
   // `|` like the server does, so a secret containing one survives.
@@ -100,149 +83,291 @@ async function reportDeployKeyInWorkingDirectory(
   logWarning(`Working Directory: Invalid ${envVarName} in ${source}`);
 }
 
-const loginStatus = new Command("status")
-  .description("Check login status and list accessible teams")
-  .allowExcessArguments(false)
-  .action(async () => {
-    const ctx = await oneoffContext({
-      url: undefined,
-      adminKey: undefined,
-      envFile: undefined,
-    });
-
-    // `_updateBigBrainAuth` below replaces any deploy key in `ctx` with the
-    // account token, so read the deploy key first.
-    const auth = ctx.bigBrainAuth();
-
-    const globalConfig = readGlobalConfig(ctx);
-    if (globalConfig === null) {
-      logMessage(`No Convex account token found in: ${globalConfigPath()}`);
-      logMessage("Status: Not logged in");
-      await reportDeployKeyInWorkingDirectory(ctx, auth);
-      return;
-    }
-    logMessage(`Convex account token found in: ${globalConfigPath()}`);
-
-    const accessToken = globalConfig.accessToken;
-    if (!(await isAuthorizedHeader(ctx, `Bearer ${accessToken}`))) {
-      logMessage("Status: Not logged in");
-      await reportDeployKeyInWorkingDirectory(ctx, auth);
-      return;
-    }
-
-    logMessage("Status: Logged in");
-    // Describe the account, even if a deploy key outranks it for other commands.
-    ctx._updateBigBrainAuth({
-      kind: "accessToken",
-      header: `Bearer ${accessToken}`,
-      accessToken,
-    });
-    const teams = await getTeamsForUser(ctx);
-    logMessage(
-      `Teams: ${teams.length} team${teams.length === 1 ? "" : "s"} accessible`,
-    );
-    for (const team of teams) {
-      logMessage(`  - ${team.name} (${team.slug})`);
-    }
-    await reportDeployKeyInWorkingDirectory(ctx, auth);
-  });
-
-export const login = new Command("login")
-  .description("Login to Convex")
-  .allowExcessArguments(false)
-  .option(
-    "--device-name <name>",
-    "Provide a name for the device being authorized",
-  )
-  .option(
-    "-f, --force",
-    "Proceed with login even if a valid access token already exists for this device",
-  )
-  .option(
-    "--no-open",
-    "Don't automatically open the login link in the default browser",
-  )
-  .addOption(
-    new Option(
-      "--login-flow <mode>",
-      `How to log in; defaults to guessing based on the environment.`,
+function createLoginStatusCommand() {
+  return new Command("status")
+    .description(
+      "Check login status and list accessible teams. Exits with code 1 when not logged in.",
     )
-      .choices(["paste", "auto", "poll"] as const)
-      .default("auto" as const),
-  )
-  .addOption(new Option("--link-deployments").hideHelp())
-  // These options are hidden from the help/usage message, but allow overriding settings for testing.
-  // Change the auth credentials with the auth provider
-  .addOption(new Option("--override-auth-url <url>").hideHelp())
-  .addOption(new Option("--override-auth-client <id>").hideHelp())
-  .addOption(new Option("--override-auth-username <username>").hideHelp())
-  .addOption(new Option("--override-auth-password <password>").hideHelp())
-  // Skip the auth provider login and directly use this access token
-  .addOption(new Option("--override-access-token <token>").hideHelp())
-  // Automatically accept opt ins without prompting
-  .addOption(new Option("--accept-opt-ins").hideHelp())
-  // Dump the access token from the auth provider and skip authorization with Convex
-  .addOption(new Option("--dump-access-token").hideHelp())
-  // Hidden option for tests to check if the user is logged in.
-  .addOption(new Option("--check-login").hideHelp())
-  // Redirect to Vercel SSO integration URL
-  .addOption(
-    new Option(
-      "--vercel",
-      "Redirect to Vercel SSO integration for login",
-    ).hideHelp(),
-  )
-  // Override the Vercel URL slug (defaults to 'convex')
-  .addOption(new Option("--vercel-override <slug>").hideHelp())
-  .addCommand(loginStatus)
-  .addHelpCommand(false)
-  .action(async (options, cmd: Command) => {
-    const ctx = await oneoffContext({
-      url: undefined,
-      adminKey: undefined,
-      envFile: undefined,
-    });
-    if (
-      !options.force &&
-      (await checkAuthorization(ctx, !!options.acceptOptIns))
-    ) {
-      logFinishedStep(
-        "This device has previously been authorized and is ready for use with Convex.",
-      );
-      await handleLinkingDeployments(ctx, {
-        interactive: !!options.linkDeployments,
+    .allowExcessArguments(false)
+    .action(async () => {
+      const ctx = await oneoffContext({
+        url: undefined,
+        adminKey: undefined,
+        envFile: undefined,
       });
-      return;
-    }
-    if (!options.force && options.checkLogin) {
-      const isLoggedIn = await checkAuthorization(ctx, !!options.acceptOptIns);
-      if (!isLoggedIn) {
-        return ctx.crash({
+
+      // Keep the directory's deploy key for separate reporting after selecting
+      // the account whose teams will be listed.
+      const auth = ctx.bigBrainAuth();
+      let accountAuth = auth?.kind === "accessToken" ? auth : null;
+      if (accountAuth === null) {
+        const account = await getAccountSelection(ctx);
+        if (account !== null) {
+          accountAuth = await readAccountAuth(ctx, account);
+        } else {
+          const globalConfig = readGlobalConfig(ctx);
+          if (globalConfig !== null) {
+            accountAuth = {
+              kind: "accessToken",
+              accessToken: globalConfig.accessToken,
+              header: `Bearer ${globalConfig.accessToken}`,
+              account: null,
+            };
+          }
+        }
+      }
+      if (accountAuth === null) {
+        logMessage(`No Convex account token found in: ${globalConfigPath()}`);
+        logMessage("Status: Not logged in");
+        await reportDeployKeyInWorkingDirectory(ctx, auth);
+        return await ctx.crash({
           exitCode: 1,
           errorType: "fatal",
-          errForSentry: "You are not logged in.",
-          printedMessage: "You are not logged in.",
+          printedMessage: null,
         });
       }
-    }
-    if (!!options.overrideAuthUsername !== !!options.overrideAuthPassword) {
-      cmd.error(
-        "If overriding credentials, both username and password must be provided",
-      );
-    }
+      warnIfDeployKeyOverridesLogin(ctx, true);
+      if (accountAuth.account) {
+        logMessage(`Account: ${accountAuth.account.name}`);
+        logMessage(`Selected by: ${accountAuth.account.source}`);
+        logMessage(
+          `Convex account token found in: ${accountConfigPath(accountAuth.account.name)}`,
+        );
+      } else if (process.env.CONVEX_OVERRIDE_ACCESS_TOKEN) {
+        logMessage("Using CONVEX_OVERRIDE_ACCESS_TOKEN from the environment");
+      } else {
+        logMessage(`Convex account token found in: ${globalConfigPath()}`);
+      }
 
-    const uuid = loadUuidForAnonymousUser(ctx);
-    await performLogin(ctx, {
-      ...options,
-      anonymousId: uuid,
-      vercel: options.vercel,
-      vercelOverride: options.vercelOverride,
-    });
+      if (!(await isAuthorizedHeader(ctx, accountAuth.header))) {
+        logMessage("Status: Not logged in");
+        await reportDeployKeyInWorkingDirectory(ctx, auth);
+        return await ctx.crash({
+          exitCode: 1,
+          errorType: "fatal",
+          printedMessage: null,
+        });
+      }
 
-    await handleLinkingDeployments(ctx, {
-      interactive: !!options.linkDeployments,
+      logMessage("Status: Logged in");
+      ctx._updateBigBrainAuth(accountAuth);
+      const teams = await getTeamsForUser(ctx);
+      logMessage(
+        `Teams: ${teams.length} team${teams.length === 1 ? "" : "s"} accessible`,
+      );
+      for (const team of teams) {
+        logMessage(`  - ${team.name} (${team.slug})`);
+      }
+      await reportDeployKeyInWorkingDirectory(ctx, auth);
     });
-  });
+}
+
+export function createLoginCommand() {
+  return (
+    new Command("login")
+      .description("Login to Convex")
+      .allowExcessArguments(false)
+      .option("--account <name>", "Log in to a named account")
+      .option(
+        "--select",
+        "Select this account for this directory and its subdirectories",
+      )
+      .option(
+        "--device-name <name>",
+        "Provide a name for the device being authorized",
+      )
+      .option(
+        "-f, --force",
+        "Proceed with login even if a valid access token already exists for this device",
+      )
+      .option(
+        "--no-open",
+        "Don't automatically open the login link in the default browser",
+      )
+      .addOption(
+        new Option(
+          "--login-flow <mode>",
+          `How to log in; defaults to guessing based on the environment.`,
+        )
+          .choices(["paste", "auto", "poll"] as const)
+          .default("auto" as const),
+      )
+      .addOption(new Option("--link-deployments").hideHelp())
+      // These options are hidden from the help/usage message, but allow overriding settings for testing.
+      // Change the auth credentials with the auth provider
+      .addOption(new Option("--override-auth-url <url>").hideHelp())
+      .addOption(new Option("--override-auth-client <id>").hideHelp())
+      .addOption(new Option("--override-auth-username <username>").hideHelp())
+      .addOption(new Option("--override-auth-password <password>").hideHelp())
+      // Skip the auth provider login and directly use this access token
+      .addOption(new Option("--override-access-token <token>").hideHelp())
+      // Automatically accept opt ins without prompting
+      .addOption(new Option("--accept-opt-ins").hideHelp())
+      // Dump the access token from the auth provider and skip authorization with Convex
+      .addOption(new Option("--dump-access-token").hideHelp())
+      // Hidden option for tests to check if the user is logged in.
+      .addOption(new Option("--check-login").hideHelp())
+      // Redirect to Vercel SSO integration URL
+      .addOption(
+        new Option(
+          "--vercel",
+          "Redirect to Vercel SSO integration for login",
+        ).hideHelp(),
+      )
+      // Override the Vercel URL slug (defaults to 'convex')
+      .addOption(new Option("--vercel-override <slug>").hideHelp())
+      .addCommand(createLoginStatusCommand())
+      .addHelpCommand(false)
+      .action(async (options, cmd: Command) => {
+        const ctx = await oneoffContext({
+          url: undefined,
+          adminKey: undefined,
+          envFile: undefined,
+          skipAuth: true,
+        });
+        const account = await getAccountSelection(ctx, {
+          name: options.account,
+        });
+        if (options.select && account === null) {
+          cmd.error("Pass --account <name> with --select to name this login.");
+        }
+        loadProjectEnvironmentVariables();
+        let namingLegacyAccount = false;
+        if (account !== null) {
+          let auth = options.force
+            ? null
+            : await readAccountAuth(ctx, account, true);
+          if (
+            auth === null &&
+            !options.force &&
+            !options.overrideAccessToken &&
+            !options.overrideAuthUsername &&
+            !process.env.CONVEX_OVERRIDE_ACCESS_TOKEN
+          ) {
+            auth = await legacyAuthForFirstAccount(ctx, account);
+            namingLegacyAccount = auth !== null;
+          }
+          ctx._updateBigBrainAuth(auth);
+        } else {
+          const accessToken =
+            process.env.CONVEX_OVERRIDE_ACCESS_TOKEN ||
+            readGlobalConfig(ctx)?.accessToken;
+          ctx._updateBigBrainAuth(
+            accessToken
+              ? {
+                  kind: "accessToken",
+                  accessToken,
+                  header: `Bearer ${accessToken}`,
+                  account: null,
+                }
+              : null,
+          );
+        }
+        warnIfDeployKeyOverridesLogin(ctx, ctx.bigBrainAuth() !== null);
+        if (
+          !options.force &&
+          (await checkAuthorization(ctx, !!options.acceptOptIns))
+        ) {
+          const auth = ctx.bigBrainAuth();
+          if (
+            namingLegacyAccount &&
+            account !== null &&
+            auth?.kind === "accessToken"
+          ) {
+            await writeAccountCredentials(
+              ctx,
+              account.name,
+              auth.accessToken,
+              {},
+              null,
+            );
+          }
+          logFinishedStep(
+            account !== null
+              ? namingLegacyAccount
+                ? `Saved account "${account.name}" using your existing login.`
+                : `Account "${account.name}" is already logged in.`
+              : "This device has previously been authorized and is ready for use with Convex.",
+          );
+          if (account !== null && auth?.kind === "accessToken") {
+            await initializeDefaultAccount(
+              ctx,
+              account,
+              namingLegacyAccount,
+              !!options.select,
+            );
+          }
+          if (options.select && account !== null) {
+            if (!(await bindAccountToDirectory(ctx, account.name))) {
+              return await ctx.crash({
+                exitCode: 1,
+                errorType: "fatal",
+                printedMessage: `Logged in as "${account.name}", but the directory selection could not be changed.`,
+              });
+            }
+          }
+          await handleLinkingDeployments(ctx, {
+            interactive: !!options.linkDeployments,
+          });
+          return;
+        }
+        if (!options.force && options.checkLogin) {
+          const isLoggedIn = await checkAuthorization(
+            ctx,
+            !!options.acceptOptIns,
+          );
+          if (!isLoggedIn) {
+            return ctx.crash({
+              exitCode: 1,
+              errorType: "fatal",
+              errForSentry: "You are not logged in.",
+              printedMessage: "You are not logged in.",
+            });
+          }
+        }
+        if (!!options.overrideAuthUsername !== !!options.overrideAuthPassword) {
+          cmd.error(
+            "If overriding credentials, both username and password must be provided",
+          );
+        }
+
+        const uuid = loadUuidForAnonymousUser(ctx);
+        await performLogin(ctx, {
+          ...options,
+          account,
+          anonymousId: uuid,
+          vercel: options.vercel,
+          vercelOverride: options.vercelOverride,
+        });
+
+        const auth = ctx.bigBrainAuth();
+        if (account !== null && auth?.kind === "accessToken") {
+          await initializeDefaultAccount(
+            ctx,
+            account,
+            namingLegacyAccount,
+            !!options.select,
+          );
+        }
+        if (options.select && account !== null) {
+          if (!(await bindAccountToDirectory(ctx, account.name))) {
+            return await ctx.crash({
+              exitCode: 1,
+              errorType: "fatal",
+              printedMessage: `Logged in as "${account.name}", but the directory selection could not be changed.`,
+            });
+          }
+        }
+        warnIfDeployKeyOverridesLogin(ctx, true);
+
+        await handleLinkingDeployments(ctx, {
+          interactive: !!options.linkDeployments,
+        });
+      })
+  );
+}
+
+export const login = createLoginCommand();
 
 async function handleLinkingDeployments(
   ctx: Context,

package/src/cli/logout.ts

@@ -1,24 +1,149 @@
 import { Command } from "@commander-js/extra-typings";
 import { oneoffContext } from "../bundler/context.js";
-import { logFinishedStep } from "../bundler/log.js";
+import { logFinishedStep, logMessage, logWarning } from "../bundler/log.js";
 import { recursivelyDelete } from "./lib/fsUtils.js";
 import { globalConfigPath } from "./lib/utils/globalConfig.js";
+import {
+  getAccountSelection,
+  accountConfigPath,
+  readAccountToken,
+  readAccountSettings,
+  updateAccountSettings,
+  savedAccountNames,
+} from "./lib/accounts.js";
+import path from "path";
+import { rootDirectory } from "./lib/utils/utils.js";
+import { promptOptions } from "./lib/utils/prompts.js";
 
-export const logout = new Command("logout")
-  .description("Log out of Convex on this machine")
-  .allowExcessArguments(false)
-  .action(async () => {
-    const ctx = await oneoffContext({
-      url: undefined,
-      adminKey: undefined,
-      envFile: undefined,
-    });
+export function createLogoutCommand() {
+  return new Command("logout")
+    .description(
+      "Log out of the selected account. Directory selections are preserved.",
+    )
+    .option("--account <name>", "Remove only this account's saved credentials")
+    .option(
+      "--all",
+      "Remove all saved account credentials, preserving account selections",
+    )
+    .allowExcessArguments(false)
+    .action(async (options, cmd) => {
+      if (options.all && options.account !== undefined)
+        cmd.error("Pass either --account or --all, not both.");
+      const ctx = await oneoffContext({
+        url: undefined,
+        adminKey: undefined,
+        envFile: undefined,
+        skipAuth: true,
+      });
+
+      let all = !!options.all;
+      let account = all
+        ? null
+        : await getAccountSelection(ctx, { name: options.account });
+      if (
+        !all &&
+        options.account === undefined &&
+        process.stdin.isTTY &&
+        account !== null
+      ) {
+        const token = readAccountToken(ctx, account.name);
+        const settings = await readAccountSettings(ctx);
+        const selectedName = account.name;
+        // A matching compatibility token is another copy of this account's login.
+        const hasOtherLogins =
+          savedAccountNames(ctx).some((name) => name !== selectedName) ||
+          (typeof settings.accessToken === "string" &&
+            settings.accessToken.length > 0 &&
+            settings.accessToken !== token);
+        if (hasOtherLogins) {
+          const scope = await promptOptions(ctx, {
+            message: "Which saved logins would you like to log out of?",
+            choices: [
+              { name: `Only account "${account.name}"`, value: "account" },
+              { name: "All saved logins on this device", value: "all" },
+            ],
+            default: "account",
+          });
+          if (scope === "all") {
+            account = null;
+            all = true;
+          }
+        }
+      }
 
-    if (ctx.fs.exists(globalConfigPath())) {
-      recursivelyDelete(ctx, globalConfigPath());
-    }
+      let warnAboutLegacyCredentials = false;
+      if (account !== null) {
+        const selectedName = account.name;
+        await updateAccountSettings(
+          ctx,
+          (settings) => {
+            const token = readAccountToken(ctx, selectedName);
+            // A migrated account can share its token with old CLI versions.
+            if (token !== null && settings.accessToken === token) {
+              delete settings.accessToken;
+            } else if (
+              settings.defaultAccount === selectedName &&
+              typeof settings.accessToken === "string" &&
+              settings.accessToken.length > 0
+            ) {
+              // Editing the default or logging in with an older CLI can leave this
+              // token belonging to a different account.
+              warnAboutLegacyCredentials = true;
+            }
+          },
+          () => {
+            const configPath = accountConfigPath(selectedName);
+            recursivelyDelete(ctx, configPath, {
+              force: true,
+              followSymlinks: false,
+            });
+          },
+        );
+      } else {
+        await updateAccountSettings(
+          ctx,
+          async (settings) => {
+            if (
+              !all &&
+              savedAccountNames(ctx).length > 0 &&
+              settings.accessToken === undefined
+            ) {
+              return await ctx.crash({
+                exitCode: 1,
+                errorType: "fatal",
+                printedMessage:
+                  "No account is selected. Use `npx convex logout --account <name>` or `npx convex logout --all`.",
+              });
+            }
+            delete settings.accessToken;
+          },
+          () => {
+            const accountsDir = path.join(rootDirectory(), "accounts");
+            if (all)
+              recursivelyDelete(ctx, accountsDir, {
+                force: true,
+                followSymlinks: false,
+              });
+          },
+        );
+      }
+
+      logFinishedStep(
+        account !== null
+          ? `Removed credentials for account "${account.name}".\n  Run \`npx convex login --account ${account.name}\` to log in.`
+          : `${all ? "Removed all saved Convex account credentials." : "Removed your saved Convex login credentials."}\n  Run \`npx convex login\` to log in.`,
+      );
+      if (warnAboutLegacyCredentials) {
+        logWarning(
+          `Saved credentials remain in ${globalConfigPath()} for older CLI versions. To remove all saved account credentials, run \`npx convex logout --all\`.`,
+        );
+      }
+      if (process.env.CONVEX_OVERRIDE_ACCESS_TOKEN) {
+        logMessage(
+          "CONVEX_OVERRIDE_ACCESS_TOKEN still supplies credentials. Unset it to stop using that token.",
+        );
+      }
+    });
+}
 
-    logFinishedStep(
-      "You have been logged out of Convex.\n  Run `npx convex dev` to log in.",
-    );
-  });
+export const logout = createLogoutCommand();