create-safest-tools 0.2.0

package/template/public/widget.css

@@ -0,0 +1,80 @@
+:host {
+  display: block;
+  width: 100%;
+  max-width: 680px;
+  --se-frame-max-height: 820px;
+  height: var(--se-frame-height, auto);
+  color: #17211c;
+  font-family: Manrope, Inter, ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
+}
+
+*, *::before, *::after { box-sizing: border-box; }
+[hidden] { display: none !important; }
+
+.frame-shell {
+  position: relative;
+  width: 100%;
+  min-height: min(420px, var(--se-frame-max-height));
+  max-height: var(--se-frame-max-height);
+  height: var(--se-frame-height, auto);
+  overflow: hidden;
+  border: 1px solid color-mix(in srgb, var(--se-primary, #173f35) 16%, #dce4df);
+  border-radius: var(--se-radius, 22px);
+  background: var(--se-surface, #fff);
+  box-shadow: 0 24px 70px rgba(20, 48, 39, .14), 0 2px 10px rgba(20, 48, 39, .06);
+}
+
+iframe {
+  display: block;
+  width: 100%;
+  min-height: min(420px, var(--se-frame-max-height));
+  max-height: var(--se-frame-max-height);
+  height: var(--se-frame-height, auto);
+  border: 0;
+  background: transparent;
+  transition: height 180ms ease;
+}
+
+.loading, .error {
+  position: absolute;
+  inset: 0;
+  z-index: 2;
+  display: grid;
+  place-content: center;
+  justify-items: center;
+  gap: 14px;
+  padding: 32px;
+  background:
+    radial-gradient(circle at 50% 25%, color-mix(in srgb, var(--se-primary, #173f35) 9%, transparent), transparent 38%),
+    var(--se-surface, #fff);
+  color: var(--se-muted, #65726b);
+  text-align: center;
+  font-size: 14px;
+}
+
+.loading-mark {
+  width: 34px;
+  aspect-ratio: 1;
+  border: 3px solid color-mix(in srgb, var(--se-primary, #173f35) 18%, transparent);
+  border-top-color: var(--se-primary, #173f35);
+  border-radius: 50%;
+  animation: spin 800ms linear infinite;
+}
+
+.error strong { color: var(--se-text, #17211c); font-size: 17px; }
+.error span { max-width: 36ch; line-height: 1.55; }
+.error button {
+  appearance: none;
+  border: 0;
+  border-radius: 999px;
+  padding: 11px 18px;
+  background: var(--se-primary, #173f35);
+  color: var(--se-primary-contrast, #fff);
+  font: inherit;
+  font-weight: 750;
+  cursor: pointer;
+}
+.error button:focus-visible { outline: 3px solid color-mix(in srgb, var(--se-primary, #173f35) 32%, transparent); outline-offset: 3px; }
+
+@keyframes spin { to { transform: rotate(1turn); } }
+@media (prefers-reduced-motion: reduce) { .loading-mark { animation-duration: 1600ms; } iframe { transition: none; } }

package/template/public/widget.js

@@ -0,0 +1,220 @@
+const MESSAGE_VERSION = 1;
+const MIN_HEIGHT = 420;
+const MAX_HEIGHT = 820;
+
+const template = document.createElement("template");
+template.innerHTML = `
+  <section class="frame-shell" aria-busy="true">
+    <div class="loading" role="status" aria-live="polite">
+      <span class="loading-mark" aria-hidden="true"></span>
+      <span>Preparing a secure report…</span>
+    </div>
+    <iframe title="Report a safety concern" referrerpolicy="no-referrer" allow=""></iframe>
+    <div class="error" role="alert" hidden>
+      <strong>The report form could not open</strong>
+      <span></span>
+      <button type="button">Try again</button>
+    </div>
+  </section>`;
+
+function normalizedOrigin(value) {
+  try {
+    const url = new URL(value, location.href);
+    const supplied = value.replace(/\/$/u, "");
+    return value.startsWith("/") || url.origin === supplied ? url.origin : "";
+  } catch { return ""; }
+}
+
+function positiveHeight(value) {
+  const height = Number(value);
+  return Number.isFinite(height) ? Math.max(MIN_HEIGHT, Math.min(MAX_HEIGHT, Math.ceil(height))) : MIN_HEIGHT;
+}
+
+class SafestReport extends HTMLElement {
+  static observedAttributes = ["api-base", "integration-id", "form-version", "context-endpoint", "target-type", "target-reference", "preview"];
+
+  #contextToken = "";
+  #previewBrand = null;
+  #previewConfig = null;
+  #iframe = null;
+  #rootNode = null;
+  #loaded = false;
+  #loadingContext = false;
+  #messageHandler = null;
+  #resizeHandler = null;
+
+  connectedCallback() {
+    if (!this.#rootNode) {
+      const root = this.attachShadow({ mode: "closed" });
+      this.#rootNode = root;
+      const stylesheet = document.createElement("link");
+      stylesheet.rel = "stylesheet";
+      stylesheet.href = `${this.apiBase}/widget.css`;
+      stylesheet.referrerPolicy = "no-referrer";
+      root.append(stylesheet, template.content.cloneNode(true));
+      this.#iframe = root.querySelector("iframe");
+      root.querySelector(".error button").addEventListener("click", () => this.#mount());
+      this.#messageHandler = (event) => this.#onMessage(event);
+      this.#resizeHandler = () => this.#send({ type: "safest-resolve:viewport", width: this.getBoundingClientRect().width });
+    }
+    globalThis.addEventListener("message", this.#messageHandler);
+    globalThis.addEventListener("resize", this.#resizeHandler, { passive: true });
+    this.#mount();
+  }
+
+  disconnectedCallback() {
+    if (this.#messageHandler) globalThis.removeEventListener("message", this.#messageHandler);
+    if (this.#resizeHandler) globalThis.removeEventListener("resize", this.#resizeHandler);
+  }
+
+  attributeChangedCallback() {
+    if (this.isConnected && this.#loaded) this.#mount();
+  }
+
+  get apiBase() { return (this.getAttribute("api-base") || location.origin).replace(/\/$/u, ""); }
+  get integrationId() { return this.getAttribute("integration-id") || ""; }
+  get formVersion() { return this.getAttribute("form-version") || "general-v1"; }
+  get contextEndpoint() { return this.getAttribute("context-endpoint") || ""; }
+  get targetType() { return this.getAttribute("target-type") || ""; }
+  get targetReference() { return this.getAttribute("target-reference") || ""; }
+  get preview() { return this.hasAttribute("preview"); }
+  set preview(value) {
+    const enabled = value !== false && value !== null && value !== undefined && value !== "false";
+    if (enabled !== this.hasAttribute("preview")) this.toggleAttribute("preview", enabled);
+  }
+  get previewBrand() { return this.#previewBrand; }
+  set previewBrand(value) {
+    this.#previewBrand = value && typeof value === "object" ? value : null;
+    this.#sendPreview();
+  }
+  get previewConfig() { return this.#previewConfig; }
+  set previewConfig(value) {
+    this.#previewConfig = value && typeof value === "object" ? value : null;
+    this.#sendPreview();
+  }
+  get contextToken() { return this.#contextToken; }
+  set contextToken(value) {
+    this.#contextToken = typeof value === "string" ? value : "";
+    if (this.hasAttribute("context-token")) this.removeAttribute("context-token");
+    if (this.#loaded && this.#contextToken) this.#sendContext(this.#contextToken);
+  }
+
+  #root() { return this.#rootNode; }
+
+  #showError(message) {
+    const root = this.#root();
+    if (!root) return;
+    root.querySelector(".frame-shell").setAttribute("aria-busy", "false");
+    root.querySelector(".loading").hidden = true;
+    root.querySelector("iframe").hidden = true;
+    const error = root.querySelector(".error");
+    error.hidden = false;
+    error.querySelector("span").textContent = message;
+  }
+
+  #mount() {
+    const root = this.#root();
+    if (!root || !this.#iframe) return;
+    this.#loaded = false;
+    this.#loadingContext = false;
+    const apiOrigin = normalizedOrigin(this.apiBase);
+    if (!apiOrigin || !this.integrationId) {
+      this.#showError("The reporting channel is not configured correctly.");
+      return;
+    }
+    root.querySelector(".frame-shell").setAttribute("aria-busy", "true");
+    root.querySelector(".loading").hidden = false;
+    root.querySelector(".error").hidden = true;
+    this.#iframe.hidden = false;
+    this.#iframe.style.height = `${MIN_HEIGHT}px`;
+    const url = new URL("/embed/", apiOrigin);
+    url.searchParams.set("integration_id", this.integrationId);
+    url.searchParams.set("form_version", this.formVersion);
+    url.searchParams.set("parent_origin", location.origin);
+    if (this.preview) url.searchParams.set("preview", "1");
+    this.#iframe.src = url.href;
+  }
+
+  #send(message) {
+    const apiOrigin = normalizedOrigin(this.apiBase);
+    if (!apiOrigin || !this.#iframe?.contentWindow) return;
+    this.#iframe.contentWindow.postMessage({ version: MESSAGE_VERSION, ...message }, apiOrigin);
+  }
+
+  #targetPayload() { return { type: this.targetType, reference: this.targetReference }; }
+
+  #sendContext(token) {
+    this.#send({ type: "safest-resolve:context", contextToken: token, target: this.#targetPayload() });
+  }
+
+  #sendPreview() {
+    if (!this.preview || !this.#loaded || !this.#previewConfig) return;
+    this.#send({ type: "safest-resolve:preview", config: this.#previewConfig, brand: this.#previewBrand });
+  }
+
+  async #prepareContext() {
+    if (this.#loadingContext) return;
+    if (this.#contextToken) { this.#sendContext(this.#contextToken); return; }
+    if (!this.contextEndpoint) {
+      this.#send({ type: "safest-resolve:context-error", message: "This application has not connected its secure reporting endpoint." });
+      return;
+    }
+    this.#loadingContext = true;
+    try {
+      const response = await fetch(this.contextEndpoint, {
+        method: "POST",
+        headers: { "content-type": "application/json", accept: "application/json" },
+        credentials: "same-origin",
+        referrerPolicy: "same-origin",
+        body: JSON.stringify({ target: this.#targetPayload(), form_version: this.formVersion }),
+      });
+      const result = await response.json().catch(() => ({}));
+      if (!response.ok) throw new Error(result?.error?.message || result?.message || "Secure reporting context was unavailable.");
+      const token = result.context_token || result.contextToken;
+      if (typeof token !== "string" || !token) throw new Error("The application returned an invalid reporting context.");
+      this.#contextToken = token;
+      this.#sendContext(token);
+    } catch (error) {
+      this.#send({ type: "safest-resolve:context-error", message: error instanceof Error ? error.message : "Secure reporting context was unavailable." });
+    } finally {
+      this.#loadingContext = false;
+    }
+  }
+
+  #onMessage(event) {
+    const apiOrigin = normalizedOrigin(this.apiBase);
+    if (!apiOrigin || event.origin !== apiOrigin || event.source !== this.#iframe?.contentWindow) return;
+    const message = event.data;
+    if (!message || typeof message !== "object" || message.version !== MESSAGE_VERSION || typeof message.type !== "string") return;
+    if (message.type === "safest-resolve:ready") {
+      this.#loaded = true;
+      const root = this.#root();
+      if (root) {
+        root.querySelector(".frame-shell").setAttribute("aria-busy", "false");
+        root.querySelector(".loading").hidden = true;
+      }
+      this.#send({ type: "safest-resolve:viewport", width: this.getBoundingClientRect().width });
+      if (this.preview) this.#sendPreview();
+      else if (message.mode === "contextual") void this.#prepareContext();
+      else this.#send({ type: "safest-resolve:target", target: this.#targetPayload() });
+      return;
+    }
+    if (message.type === "safest-resolve:resize") {
+      this.#iframe.style.height = `${positiveHeight(message.height)}px`;
+      return;
+    }
+    if (message.type === "safest-resolve:submitted") {
+      this.#contextToken = "";
+      this.dispatchEvent(new CustomEvent("safest-report-submitted", {
+        bubbles: true,
+        detail: { reference: typeof message.reference === "string" ? message.reference : "", mode: message.mode },
+      }));
+      return;
+    }
+    if (message.type === "safest-resolve:cancel") {
+      this.dispatchEvent(new CustomEvent("safest-report-cancelled", { bubbles: true }));
+    }
+  }
+}
+
+if (!customElements.get("safest-report")) customElements.define("safest-report", SafestReport);

package/template/reports.config.example.json

@@ -0,0 +1,38 @@
+{
+  "$schema": "./reports.schema.json",
+  "schemaVersion": 1,
+  "installationId": "acme-resolve",
+  "resources": {
+    "workerName": "acme-resolve-worker",
+    "databaseName": "acme-resolve-db",
+    "profileMediaBucketName": "acme-resolve-profile-media",
+    "workflowArtifactsBucketName": "acme-resolve-workflow-artifacts",
+    "evidenceBucketName": "acme-resolve-evidence",
+    "exportsBucketName": "acme-resolve-exports",
+    "workflowName": "acme-resolve-workflows",
+    "reportQueueName": "acme-resolve-report-jobs",
+    "deliveryQueueName": "acme-resolve-delivery-jobs",
+    "operationsDlqName": "acme-resolve-operations-dlq"
+  },
+  "publicBaseUrl": "https://reports.example.com",
+  "allowedOrigins": [
+    "https://app.example.com"
+  ],
+  "access": {
+    "audience": "replace-with-the-cloudflare-access-application-aud",
+    "ownerEmails": ["infrastructure@example.com"]
+  },
+  "email": {
+    "enabled": true,
+    "fromAddress": "reports@example.com"
+  },
+  "auth": {
+    "password": true,
+    "providers": []
+  },
+  "retention": {
+    "reportsDays": 365,
+    "messagesDays": 180,
+    "appealWindowDays": 30
+  }
+}

package/template/reports.schema.json

@@ -0,0 +1,89 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://safest.tools/schemas/reports-installation-v1.json",
+  "title": "Safest Resolve installation",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schemaVersion", "installationId", "resources", "publicBaseUrl", "allowedOrigins", "access", "email", "auth", "retention"],
+  "properties": {
+    "$schema": { "type": "string" },
+    "schemaVersion": { "const": 1 },
+    "installationId": { "type": "string", "pattern": "^[a-z][a-z0-9-]{0,62}$" },
+    "resources": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["workerName", "databaseName", "profileMediaBucketName", "workflowArtifactsBucketName", "evidenceBucketName", "exportsBucketName", "workflowName", "reportQueueName", "deliveryQueueName", "operationsDlqName"],
+      "properties": {
+        "workerName": { "$ref": "#/$defs/resourceName" },
+        "databaseName": { "$ref": "#/$defs/resourceName" },
+        "profileMediaBucketName": { "$ref": "#/$defs/resourceName" },
+        "workflowArtifactsBucketName": { "$ref": "#/$defs/resourceName" },
+        "evidenceBucketName": { "$ref": "#/$defs/resourceName" },
+        "exportsBucketName": { "$ref": "#/$defs/resourceName" },
+        "workflowName": { "$ref": "#/$defs/resourceName" },
+        "reportQueueName": { "$ref": "#/$defs/resourceName" },
+        "deliveryQueueName": { "$ref": "#/$defs/resourceName" },
+        "operationsDlqName": { "$ref": "#/$defs/resourceName" }
+      }
+    },
+    "publicBaseUrl": { "type": "string", "format": "uri", "pattern": "^https://" },
+    "allowedOrigins": {
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 20,
+      "uniqueItems": true,
+      "items": { "type": "string", "format": "uri", "pattern": "^https://" }
+    },
+    "access": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["audience", "ownerEmails"],
+      "properties": {
+        "audience": { "type": "string", "minLength": 1, "maxLength": 200 },
+        "ownerEmails": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 20,
+          "uniqueItems": true,
+          "items": { "type": "string", "format": "email" }
+        }
+      }
+    },
+    "email": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["enabled", "fromAddress"],
+      "properties": {
+        "enabled": { "type": "boolean" },
+        "fromAddress": { "type": "string", "maxLength": 254 }
+      }
+    },
+    "auth": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["password", "providers"],
+      "properties": {
+        "password": { "const": true },
+        "providers": {
+          "type": "array",
+          "maxItems": 3,
+          "uniqueItems": true,
+          "items": { "enum": ["google", "github", "cloudflare"] }
+        }
+      }
+    },
+    "retention": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["reportsDays", "messagesDays", "appealWindowDays"],
+      "properties": {
+        "reportsDays": { "type": "integer", "minimum": 30, "maximum": 3650 },
+        "messagesDays": { "type": "integer", "minimum": 30, "maximum": 3650 },
+        "appealWindowDays": { "type": "integer", "minimum": 1, "maximum": 365 }
+      }
+    }
+  },
+  "$defs": {
+    "resourceName": { "type": "string", "pattern": "^[a-z][a-z0-9-]{0,62}$" }
+  }
+}

package/template/scripts/reports-auth-onboarding.mjs

@@ -0,0 +1,180 @@
+import * as clack from "@clack/prompts";
+import { writeFile } from "node:fs/promises";
+import { resolve } from "node:path";
+import { readSecrets, updateSecrets } from "./reports-secrets.mjs";
+
+const OAUTH_PROVIDERS = Object.freeze([
+  {
+    id: "google",
+    name: "Google",
+    clientIdSecret: "AUTH_GOOGLE_CLIENT_ID",
+    clientSecretSecret: "AUTH_GOOGLE_CLIENT_SECRET",
+    dashboardUrl: "https://console.cloud.google.com/auth/clients",
+  },
+  {
+    id: "github",
+    name: "GitHub",
+    clientIdSecret: "AUTH_GITHUB_CLIENT_ID",
+    clientSecretSecret: "AUTH_GITHUB_CLIENT_SECRET",
+    dashboardUrl: "https://github.com/settings/developers",
+  },
+  {
+    id: "cloudflare",
+    name: "Cloudflare",
+    clientIdSecret: "AUTH_CLOUDFLARE_CLIENT_ID",
+    clientSecretSecret: "AUTH_CLOUDFLARE_CLIENT_SECRET",
+    dashboardUrl: "https://dash.cloudflare.com/?to=/:account/oauth-clients",
+  },
+]);
+
+export function oauthCallbackUrl(publicBaseUrl, providerId) {
+  return `${new URL(publicBaseUrl).origin}/api/auth/callback/${providerId}`;
+}
+
+export function requiredOAuthSecrets(config) {
+  const selected = new Set(config.auth?.providers ?? []);
+  return OAUTH_PROVIDERS.filter((provider) => selected.has(provider.id))
+    .flatMap((provider) => [provider.clientIdSecret, provider.clientSecretSecret]);
+}
+
+function setupInstructions(provider, publicBaseUrl) {
+  const callback = oauthCallbackUrl(publicBaseUrl, provider.id);
+  const shared = `Open: ${provider.dashboardUrl}\nCallback URL (copy exactly): ${callback}`;
+  if (provider.id === "google") {
+    return `${shared}\n\n1. Select or create a Google Cloud project.\n2. Configure the OAuth consent screen.\n3. Create a client with application type Web application.\n4. Add ${publicBaseUrl} as an Authorized JavaScript origin.\n5. Add the exact callback URL above as an Authorized redirect URI.\n6. Copy the Client ID and Client secret. Do not download or commit the JSON file.`;
+  }
+  if (provider.id === "github") {
+    return `${shared}\n\n1. Choose OAuth Apps, then New OAuth App.\n2. Set Homepage URL to ${publicBaseUrl}.\n3. Set Authorization callback URL to the exact callback above.\n4. Leave wildcard callback matching disabled.\n5. Register the app, generate a client secret, and copy both values.`;
+  }
+  return `${shared}\n\n1. Select the Cloudflare account, then Create client.\n2. Choose Authorization Code, response type code, and client_secret_basic.\n3. Add the exact callback URL above.\n4. Select only the User Details Read scope (user-details.read).\n5. Keep it private for members of this Cloudflare account, or complete domain verification before making it public for invited users from other accounts.\n6. Create the client and copy the secret now; Cloudflare will not show it again.`;
+}
+
+function cancelled(value) {
+  return clack.isCancel(value);
+}
+
+function providerConfigured(provider, selected, secrets) {
+  return selected.has(provider.id) && Boolean(secrets[provider.clientIdSecret] && secrets[provider.clientSecretSecret]);
+}
+
+export async function confirmEmailSending(config, ui = clack) {
+  const sender = config.email?.fromAddress ?? "";
+  const domain = sender.includes("@") ? sender.slice(sender.lastIndexOf("@") + 1) : sender;
+  ui.note(
+    `Sender: ${sender}\nDomain: ${domain}\n\n` +
+      `1. In Cloudflare, open Compute → Email Service → Email Sending.\n` +
+      `2. Onboard ${domain} and wait for its sending DNS records to show configured.\n` +
+      `3. Return here. Domain onboarding is required to email arbitrary invited users.`,
+    "Email delivery",
+  );
+  const action = await ui.select({
+    message: "Is this domain enabled for Cloudflare Email Sending?",
+    options: [
+      { value: "ready", label: "Yes, continue" },
+      { value: "back", label: "Back", hint: "stop without saving auth or provisioning resources" },
+    ],
+  });
+  return !cancelled(action) && action === "ready";
+}
+
+export async function authenticationWizard(config, existingSecrets, ui = clack) {
+  const secrets = { ...existingSecrets };
+  const selected = new Set(config.auth?.providers ?? []);
+  ui.intro("Safest Resolve authentication");
+  ui.note(
+    "Password login and email-based password recovery are always enabled. Add any OAuth providers you want normal invited users to see.",
+    "Sign-in methods",
+  );
+  while (true) {
+    const choice = await ui.select({
+      message: "Choose an OAuth provider to configure",
+      options: [
+        ...OAUTH_PROVIDERS.map((provider) => ({
+          value: provider.id,
+          label: provider.name,
+          hint: providerConfigured(provider, selected, secrets) ? "configured" : "not configured",
+        })),
+        { value: "done", label: "Continue", hint: "save these choices" },
+        { value: "back", label: "Back", hint: "discard OAuth changes and stop setup" },
+      ],
+    });
+    if (cancelled(choice) || choice === "back") {
+      ui.cancel("No OAuth changes were saved.");
+      return { cancelled: true, config, secrets: existingSecrets };
+    }
+    if (choice === "done") {
+      const incomplete = OAUTH_PROVIDERS.find((provider) => selected.has(provider.id) &&
+        (!secrets[provider.clientIdSecret] || !secrets[provider.clientSecretSecret]));
+      if (incomplete) {
+        ui.note(`Finish or remove ${incomplete.name} before continuing.`, "Credentials missing");
+        continue;
+      }
+      const nextConfig = {
+        ...config,
+        auth: { password: true, providers: OAUTH_PROVIDERS.map(({ id }) => id).filter((id) => selected.has(id)) },
+      };
+      ui.outro(selected.size ? `OAuth ready: ${[...selected].join(", ")}` : "Password-only sign-in selected.");
+      return { cancelled: false, config: nextConfig, secrets };
+    }
+
+    const provider = OAUTH_PROVIDERS.find(({ id }) => id === choice);
+    if (!provider) continue;
+    ui.note(setupInstructions(provider, config.publicBaseUrl), `${provider.name} OAuth setup`);
+    const action = await ui.select({
+      message: `${provider.name} setup`,
+      options: [
+        { value: "configure", label: providerConfigured(provider, selected, secrets) ? "Replace credentials" : "Enter credentials" },
+        ...(selected.has(provider.id) ? [{ value: "remove", label: `Remove ${provider.name}` }] : []),
+        { value: "back", label: "Back", hint: "return without changing this provider" },
+      ],
+    });
+    if (cancelled(action) || action === "back") continue;
+    if (action === "remove") {
+      selected.delete(provider.id);
+      delete secrets[provider.clientIdSecret];
+      delete secrets[provider.clientSecretSecret];
+      continue;
+    }
+    const clientId = await ui.text({
+      message: `${provider.name} Client ID`,
+      validate: (value) => value.trim() ? undefined : "Client ID is required",
+    });
+    if (cancelled(clientId)) continue;
+    const clientSecret = await ui.password({
+      message: `${provider.name} Client secret (input is masked)`,
+      validate: (value) => value.trim() ? undefined : "Client secret is required",
+    });
+    if (cancelled(clientSecret)) continue;
+    const save = await ui.select({
+      message: `Save ${provider.name} credentials to the owner-only local secrets file?`,
+      options: [
+        { value: "save", label: "Save provider" },
+        { value: "back", label: "Back", hint: "discard the values just entered" },
+      ],
+    });
+    if (cancelled(save) || save === "back") continue;
+    secrets[provider.clientIdSecret] = clientId.trim();
+    secrets[provider.clientSecretSecret] = clientSecret.trim();
+    selected.add(provider.id);
+  }
+}
+
+async function persistAuthenticationConfiguration({ configPath, secretsPath, config, secrets }) {
+  const absoluteConfig = resolve(configPath);
+  await writeFile(absoluteConfig, `${JSON.stringify(config, null, 2)}\n`, "utf8");
+  await updateSecrets(secretsPath, secrets);
+}
+
+export async function configureAuthentication({ configPath, secretsPath, config, interactive, ui = clack }) {
+  const secrets = await readSecrets(secretsPath);
+  if (!interactive) return { cancelled: false, config, secrets };
+  if (!await confirmEmailSending(config, ui)) {
+    ui.cancel("Setup stopped before provisioning. No OAuth changes were saved.");
+    return { cancelled: true, config, secrets };
+  }
+  const result = await authenticationWizard(config, secrets, ui);
+  if (!result.cancelled) {
+    await persistAuthenticationConfiguration({ configPath, secretsPath, config: result.config, secrets: result.secrets });
+  }
+  return result;
+}