dropsh 0.2.0 → 0.3.1

package/README.md

@@ -141,8 +141,76 @@ dropsh auth status
 dropsh auth logout
 ```
 
-Secrets and tokens are never written to `dropsh.config.js`. The active session is
-stored per host under `~/.config/dropsh/<host>.json` with file mode `0600`.
+Secrets and tokens are never written to `dropsh.config.js`. Sessions are stored
+per host under `~/.config/dropsh/<host>.json` with file mode `0600`.
+
+### Named profiles — many identities per host
+
+A host can hold several **named auth profiles** at once (e.g. two OAuth2 scopes)
+and you switch between them without logging in again. Each auth provider is one
+profile, identified by its `id`. For OAuth2, give each `oauth2Plugin` an explicit
+`id` (it defaults to the grant `type` when omitted) so two profiles of the same
+grant flow can coexist:
+
+```js
+plugins: [
+  oauth2Plugin({
+    id: "session",
+    default: true,                       // used when none is selected/active
+    type: "oauth2_client_credentials",
+    client_id: "my-client",
+    client_secret,                       // enables headless auto-renew (see below)
+    token_url: "https://my-drupal.example.com/oauth/token",
+    scope: "some:scope",
+  }),
+  oauth2Plugin({
+    id: "pm",
+    type: "oauth2_client_credentials",
+    client_id: "my-client",
+    client_secret,
+    token_url: "https://my-drupal.example.com/oauth/token",
+    scope: "other:scope",
+  }),
+],
+```
+
+```bash
+dropsh auth login --provider session     # log in and store the "session" profile
+dropsh auth login --provider pm          # log in and store the "pm" profile too
+dropsh auth status                       # list all profiles; * marks the active one
+dropsh auth use pm                       # switch the persistent active profile
+dropsh --auth-profile session read …     # override the profile for one command
+dropsh auth logout --profile pm          # drop one profile
+dropsh auth logout --all                 # drop every profile for this host
+```
+
+Profile selection precedence (highest first):
+
+1. `--auth-profile <id>` (global flag)
+2. `$DROPSH_AUTH_PROFILE`
+3. the stored active profile (`auth use`)
+4. the provider marked `default: true`
+5. the sole configured profile, if there is only one
+
+With more than one profile and none active/default/selected, dropsh asks you to
+run `auth use <id>` or pass `--auth-profile <id>`.
+
+The on-disk format holds every profile in one file; legacy single-session files
+are upgraded automatically on first write.
+
+### Token renewal
+
+dropsh renews expiring tokens automatically — both **proactively** (before a token
+lapses) and **reactively** (if the server rejects a token with `401`, dropsh renews
+once and retries the request). Renewal uses the credentials already available:
+
+- **`oauth2_authcode`** — the stored `refresh_token`.
+- **`oauth2_client_credentials`** — re-mints from `client_secret`, so keep the
+  secret in config (e.g. `conductor.config.local.js`) for unattended runs. Without
+  it, an interactive login cannot be renewed and you must `auth login` again.
+
+Renewal is isolated per profile: refreshing one profile never touches another's
+session or the active pointer.
 
 ## Commands
 

package/dist/src/commands/auth.js

@@ -1,5 +1,5 @@
 import { loginCapableProviders, providerById } from "../core/auth/registry.js";
-import { clearSession, readSession, writeSession } from "../core/auth/session-store.js";
+import { clearAll, clearProfile, readProfiles, setActive, writeProfile, } from "../core/auth/session-store.js";
 import { AuthError, ConfigError } from "../errors.js";
 function authContext(deps) {
     const ctx = {
@@ -40,16 +40,28 @@ async function pickProvider(deps, requestedId) {
 export async function runAuthLogin(args, deps) {
     const provider = await pickProvider(deps, args.provider);
     const session = await provider.login(authContext(deps));
-    await writeSession(deps.baseUrl, provider.id, session, deps.stateDir);
+    // Store under the provider id and make it the active profile (login = new default).
+    await writeProfile(deps.baseUrl, provider.id, provider.id, session, deps.stateDir);
+    await setActive(deps.baseUrl, provider.id, deps.stateDir);
     deps.stdout(`logged in via ${provider.displayName}\n`);
 }
-export async function runAuthLogout(_args, deps) {
-    const rec = await readSession(deps.baseUrl, deps.stateDir);
-    if (!rec) {
+export async function runAuthUse(args, deps) {
+    await setActive(deps.baseUrl, args.profile, deps.stateDir);
+    deps.stdout(`active auth profile: ${args.profile}\n`);
+}
+export async function runAuthLogout(args, deps) {
+    if (args.all) {
+        await clearAll(deps.baseUrl, deps.stateDir);
+        deps.stdout("cleared all auth profiles\n");
+        return;
+    }
+    const file = await readProfiles(deps.baseUrl, deps.stateDir);
+    const name = args.profile ?? file?.active;
+    if (!name || !file?.profiles[name]) {
         deps.stdout("not logged in\n");
         return;
     }
-    const provider = providerById(deps.providers, rec.activeProvider);
+    const provider = providerById(deps.providers, file.profiles[name].provider);
     try {
         if (provider)
             await provider.logout(authContext(deps));
@@ -59,30 +71,49 @@ export async function runAuthLogout(_args, deps) {
         deps.stderr(`warning: provider logout failed: ${String(err)}\n`);
     }
     finally {
-        await clearSession(deps.baseUrl, deps.stateDir);
+        await clearProfile(deps.baseUrl, name, deps.stateDir);
     }
-    deps.stdout("logged out\n");
+    deps.stdout(`logged out ${name}\n`);
+}
+async function statusFor(deps, name, providerId, session) {
+    const provider = providerById(deps.providers, providerId);
+    const base = provider
+        ? await provider.status(session)
+        : { loggedIn: false, provider: providerId };
+    return { ...base, profile: name, active: false };
 }
 export async function runAuthStatus(args, deps) {
-    const rec = await readSession(deps.baseUrl, deps.stateDir);
-    if (!rec) {
+    const file = await readProfiles(deps.baseUrl, deps.stateDir);
+    const host = new URL(deps.baseUrl).hostname;
+    const names = file ? Object.keys(file.profiles) : [];
+    const wanted = args.profile ? names.filter((n) => n === args.profile) : names;
+    if (wanted.length === 0) {
+        if (args.profile && names.length > 0)
+            throw new AuthError(`no auth profile '${args.profile}' for ${host}`);
         if (args.json)
-            deps.stdout(`${JSON.stringify({ loggedIn: false })}\n`);
+            deps.stdout(`${JSON.stringify({ host, profiles: {} })}\n`);
         else
             deps.stdout("not logged in\n");
         return;
     }
-    const provider = providerById(deps.providers, rec.activeProvider);
-    if (!provider)
-        throw new AuthError(`active provider '${rec.activeProvider}' is not configured`);
-    const info = await provider.status(rec.session);
-    const host = new URL(deps.baseUrl).hostname;
+    const rows = await Promise.all(wanted.map(async (n) => {
+        const rec = file?.profiles[n];
+        const info = rec ? await statusFor(deps, n, rec.provider, rec.session) : null;
+        return { name: n, active: file?.active === n, info };
+    }));
     if (args.json) {
-        deps.stdout(`${JSON.stringify({ ...info, host })}\n`);
+        const profiles = {};
+        for (const r of rows)
+            profiles[r.name] = { ...r.info, active: r.active };
+        deps.stdout(`${JSON.stringify({ host, active: file?.active, profiles })}\n`);
         return;
     }
-    deps.stdout(`provider: ${provider.displayName} [${provider.id}]\n`);
     deps.stdout(`host: ${host}\n`);
-    if (info.expiresAt !== undefined)
-        deps.stdout(`token: ${info.state} (until ${new Date(info.expiresAt).toISOString()})\n`);
+    for (const r of rows) {
+        const marker = r.active ? "*" : " ";
+        const state = r.info?.expiresAt !== undefined
+            ? `${r.info.state} (until ${new Date(r.info.expiresAt).toISOString()})`
+            : (r.info?.state ?? (r.info?.loggedIn ? "ok" : "not logged in"));
+        deps.stdout(`${marker} ${r.name}: ${state}\n`);
+    }
 }

package/dist/src/core/auth/registry.js

@@ -1,5 +1,25 @@
+import { ConfigError } from "../../errors.js";
 export function collectProviders(plugins) {
-    return plugins.map((p) => p.authProvider).filter((p) => p !== undefined);
+    const providers = plugins
+        .map((p) => p.authProvider)
+        .filter((p) => p !== undefined);
+    const seen = new Set();
+    for (const p of providers) {
+        if (seen.has(p.id))
+            throw new ConfigError(`duplicate auth profile id '${p.id}'. Give each oauth2Plugin a unique 'id'.`);
+        seen.add(p.id);
+    }
+    return providers;
+}
+/**
+ * The provider declaring `default: true`, used as the fallback profile when none
+ * is active or explicitly selected. Throws if more than one claims the default.
+ */
+export function defaultProvider(providers) {
+    const defaults = providers.filter((p) => p.default === true);
+    if (defaults.length > 1)
+        throw new ConfigError(`multiple auth profiles set default:true (${defaults.map((p) => p.id).join(", ")}). Only one may.`);
+    return defaults[0];
 }
 export function loginCapableProviders(providers) {
     return providers.filter((p) => p.capabilities.login);
@@ -7,3 +27,16 @@ export function loginCapableProviders(providers) {
 export function providerById(providers, id) {
     return providers.find((p) => p.id === id);
 }
+/**
+ * A session-less provider (e.g. static Basic) is the sole configured provider
+ * that declares no login capability: it carries credentials inline and needs no
+ * stored session. Used by both resolveAuth and authStatus.
+ */
+export function sessionlessProvider(providers) {
+    if (providers.length !== 1)
+        return undefined;
+    const only = providers[0];
+    if (!only)
+        return undefined;
+    return only.capabilities.login === false ? only : undefined;
+}

package/dist/src/core/auth/session-store.js

@@ -1,6 +1,7 @@
 import { chmod, mkdir, readFile, rm, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { join } from "node:path";
+import { ConfigError } from "../../errors.js";
 export function defaultStateDir() {
     return join(homedir(), ".config", "dropsh");
 }
@@ -10,29 +11,107 @@ function hostnameFromUrl(baseUrl) {
 function sessionPath(baseUrl, dir) {
     return join(dir, `${hostnameFromUrl(baseUrl)}.json`);
 }
-export async function readSession(baseUrl, dir) {
+function isLegacy(raw) {
+    return (typeof raw === "object" &&
+        raw !== null &&
+        "activeProvider" in raw &&
+        typeof raw.activeProvider === "string");
+}
+/**
+ * Read the whole profiles file, migrating a legacy `{ activeProvider, session }`
+ * record in memory to the v2 shape. No write-time migration is needed: the next
+ * `writeProfile` persists v2 naturally.
+ */
+export async function readProfiles(baseUrl, dir) {
     const path = sessionPath(baseUrl, dir ?? defaultStateDir());
+    let raw;
     try {
-        const raw = await readFile(path, "utf8");
-        return JSON.parse(raw);
+        raw = JSON.parse(await readFile(path, "utf8"));
     }
     catch {
         return null;
     }
+    if (isLegacy(raw)) {
+        return {
+            version: 2,
+            active: raw.activeProvider,
+            profiles: { [raw.activeProvider]: { provider: raw.activeProvider, session: raw.session } },
+        };
+    }
+    const file = raw;
+    if (typeof file !== "object" || file === null || typeof file.profiles !== "object")
+        return null;
+    return {
+        version: 2,
+        profiles: file.profiles ?? {},
+        ...(typeof file.active === "string" ? { active: file.active } : {}),
+    };
 }
-export async function writeSession(baseUrl, activeProvider, session, dir) {
-    const stateDir = dir ?? defaultStateDir();
+export async function readProfile(baseUrl, name, dir) {
+    const file = await readProfiles(baseUrl, dir);
+    return file?.profiles[name] ?? null;
+}
+async function writeFileAtomic(path, file, stateDir) {
     await mkdir(stateDir, { recursive: true });
-    const record = { activeProvider, session };
-    const path = sessionPath(baseUrl, stateDir);
-    await writeFile(path, JSON.stringify(record, null, 2), {
-        encoding: "utf8",
-        mode: 0o600,
-    });
+    await writeFile(path, JSON.stringify(file, null, 2), { encoding: "utf8", mode: 0o600 });
     // writeFile's `mode` only applies when creating a new file; overwriting an
     // existing file keeps its old (possibly looser) permissions, so tighten explicitly.
     await chmod(path, 0o600);
 }
-export async function clearSession(baseUrl, dir) {
+/**
+ * Upsert a single profile slot, merging into the existing file so other slots and
+ * the `active` pointer are preserved. Used both by `auth login` and by adapter
+ * token renewals (which must never disturb sibling profiles).
+ */
+export async function writeProfile(baseUrl, name, provider, session, dir) {
+    const stateDir = dir ?? defaultStateDir();
+    const file = (await readProfiles(baseUrl, stateDir)) ?? { version: 2, profiles: {} };
+    file.profiles[name] = { provider, session };
+    await writeFileAtomic(sessionPath(baseUrl, stateDir), file, stateDir);
+}
+/** Set the persistent active pointer. Errors if the slot has no stored session. */
+export async function setActive(baseUrl, name, dir) {
+    const stateDir = dir ?? defaultStateDir();
+    const file = await readProfiles(baseUrl, stateDir);
+    if (!file?.profiles[name])
+        throw new ConfigError(`no auth profile '${name}' for this host. Run 'dropsh auth login --provider ${name}'.`);
+    file.active = name;
+    await writeFileAtomic(sessionPath(baseUrl, stateDir), file, stateDir);
+}
+/** Remove a single profile; unset `active` if it pointed there; delete the file if empty. */
+export async function clearProfile(baseUrl, name, dir) {
+    const stateDir = dir ?? defaultStateDir();
+    const file = await readProfiles(baseUrl, stateDir);
+    if (!file?.profiles[name])
+        return;
+    delete file.profiles[name];
+    if (file.active === name)
+        delete file.active;
+    const path = sessionPath(baseUrl, stateDir);
+    if (Object.keys(file.profiles).length === 0) {
+        await rm(path, { force: true });
+        return;
+    }
+    await writeFileAtomic(path, file, stateDir);
+}
+/** Remove every profile for this host (deletes the file). */
+export async function clearAll(baseUrl, dir) {
     await rm(sessionPath(baseUrl, dir ?? defaultStateDir()), { force: true });
 }
+// --- Legacy (v1) compatibility API -----------------------------------------
+// Existing callers/tests use these single-session helpers. They now operate on
+// the active profile of the v2 store, so old and new code interoperate.
+export async function readSession(baseUrl, dir) {
+    const file = await readProfiles(baseUrl, dir);
+    if (!file?.active)
+        return null;
+    const rec = file.profiles[file.active];
+    return rec ? { activeProvider: file.active, session: rec.session } : null;
+}
+export async function writeSession(baseUrl, activeProvider, session, dir) {
+    await writeProfile(baseUrl, activeProvider, activeProvider, session, dir);
+    await setActive(baseUrl, activeProvider, dir);
+}
+export async function clearSession(baseUrl, dir) {
+    await clearAll(baseUrl, dir);
+}

package/dist/src/core/jsonapi/client.js

@@ -1,3 +1,4 @@
+import { HttpError } from "../../errors.js";
 import { createCollection } from "./collection.js";
 import { toResource } from "./resource.js";
 import { resolveType } from "./types.js";
@@ -19,8 +20,20 @@ export function createJsonApiClient(opts) {
             headers: { ...JSONAPI_HEADERS, ...extraHeaders },
         };
         const req = body !== undefined ? { ...reqBase, body } : reqBase;
-        const withAuth = await opts.auth.apply(req);
-        const res = await opts.http.send(withAuth);
+        let res;
+        try {
+            res = await opts.http.send(await opts.auth.apply(req));
+        }
+        catch (err) {
+            // The server rejected the token (401). Ask the auth adapter to renew and,
+            // if it could, retry the request exactly once with a fresh token.
+            if (!(err instanceof HttpError) || err.status !== 401 || !opts.auth.renew)
+                throw err;
+            const renewed = await opts.auth.renew();
+            if (!renewed)
+                throw err;
+            res = await opts.http.send(await opts.auth.apply(req));
+        }
         if (res.status === 204 || res.body.length === 0)
             return { ok: true };
         return JSON.parse(res.body);

package/dist/src/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { parseArgs } from "node:util";
 import { Command } from "commander";
-import { runAuthLogin, runAuthLogout, runAuthStatus } from "./commands/auth.js";
+import { runAuthLogin, runAuthLogout, runAuthStatus, runAuthUse } from "./commands/auth.js";
 import { runCreate } from "./commands/create.js";
 import { runDelete } from "./commands/delete.js";
 import { runRead } from "./commands/read.js";
@@ -9,8 +9,8 @@ import { applyOperationSchemaPlugins, operationHookPluginIds, runSchema, SCHEMA_
 import { runSearch } from "./commands/search.js";
 import { runUpdate } from "./commands/update.js";
 import { runUploadFile } from "./commands/upload-file.js";
-import { collectProviders, providerById } from "./core/auth/registry.js";
-import { readSession, writeSession } from "./core/auth/session-store.js";
+import { collectProviders, defaultProvider, providerById, sessionlessProvider, } from "./core/auth/registry.js";
+import { readProfiles, writeProfile } from "./core/auth/session-store.js";
 import { createFileStore } from "./core/cache/file-store.js";
 import { createOutput } from "./core/cli/output.js";
 import { createPrompt } from "./core/cli/prompt.js";
@@ -24,20 +24,81 @@ import { AuthError, ConfigError, exitCodeFor } from "./errors.js";
 function resolveConfigPath(override) {
     return override ?? process.env.DROPSH_CONFIG ?? "dropsh.config.js";
 }
+/**
+ * Choose the profile name to authenticate as. Precedence:
+ *   explicit → stored `active` → config `default:true` → the sole provider.
+ * Returns undefined when nothing selects a profile (caller then tries sessionless).
+ */
+function chooseProfile(providers, file, explicit) {
+    if (explicit)
+        return explicit;
+    if (file?.active)
+        return file.active;
+    const def = defaultProvider(providers);
+    if (def)
+        return def.id;
+    return providers.length === 1 ? providers[0]?.id : undefined;
+}
 export async function resolveAuth(deps) {
-    const rec = await readSession(deps.baseUrl, deps.stateDir);
-    if (!rec)
-        throw new AuthError("Not authenticated. Run 'dropsh auth login'.");
-    const provider = providerById(collectProviders(deps.plugins), rec.activeProvider);
+    const providers = collectProviders(deps.plugins);
+    const file = await readProfiles(deps.baseUrl, deps.stateDir);
+    const name = chooseProfile(providers, file, deps.profile);
+    if (name) {
+        const provider = providerById(providers, name);
+        if (!provider)
+            throw new ConfigError(`auth profile '${name}' has no configured provider`);
+        const rec = file?.profiles[name];
+        if (rec) {
+            return provider.createAdapter(rec.session, {
+                http: deps.http,
+                now: deps.now,
+                save: (session) => writeProfile(deps.baseUrl, name, provider.id, session, deps.stateDir),
+            });
+        }
+        // No stored session for the chosen profile: a login-less provider carries its
+        // credentials inline; anything else needs an explicit login.
+        if (provider.capabilities.login === false) {
+            return provider.createAdapter(undefined, {
+                http: deps.http,
+                now: deps.now,
+                save: async () => { },
+            });
+        }
+        throw new AuthError(`Not authenticated for profile '${name}'. Run 'dropsh auth login --provider ${name}'.`);
+    }
+    const sessionless = sessionlessProvider(providers);
+    if (sessionless) {
+        return sessionless.createAdapter(undefined, {
+            http: deps.http,
+            now: deps.now,
+            save: async () => { },
+        });
+    }
+    const ids = providers.map((p) => p.id).join(", ");
+    throw new AuthError(`Multiple auth profiles configured (${ids}); none active. Run 'dropsh auth use <id>' or pass --auth-profile <id>.`);
+}
+export async function authStatus(deps) {
+    const providers = collectProviders(deps.plugins);
+    const file = await readProfiles(deps.baseUrl, deps.stateDir);
+    const name = chooseProfile(providers, file, deps.profile);
+    if (!name) {
+        const sessionless = sessionlessProvider(providers);
+        return sessionless
+            ? { loggedIn: true, provider: sessionless.id, sessionless: true }
+            : { loggedIn: false };
+    }
+    const provider = providerById(providers, name);
     if (!provider)
-        throw new ConfigError(`active provider '${rec.activeProvider}' is not configured`);
-    return provider.createAdapter(rec.session, {
-        http: deps.http,
-        now: deps.now,
-        save: (session) => writeSession(deps.baseUrl, provider.id, session, deps.stateDir),
-    });
+        return { loggedIn: false };
+    const rec = file?.profiles[name];
+    if (!rec) {
+        return provider.capabilities.login === false
+            ? { loggedIn: true, provider: provider.id, sessionless: true }
+            : { loggedIn: false, provider: provider.id };
+    }
+    return provider.status(rec.session);
 }
-async function defaultContext(configPath) {
+async function defaultContext(configPath, profile) {
     const cfg = await loadConfig(configPath);
     const http = createHttpClient({ timeoutMs: cfg.defaults.timeout_ms });
     const auth = await resolveAuth({
@@ -45,6 +106,7 @@ async function defaultContext(configPath) {
         plugins: cfg.plugins,
         http,
         now: Date.now,
+        ...(profile !== undefined ? { profile } : {}),
     });
     const client = createJsonApiClient({
         baseUrl: cfg.site.base_url,
@@ -68,7 +130,8 @@ export function buildProgram(opts = {}) {
         .name("dropsh")
         .description("Entity-agnostic CLI for Drupal 11 JSON:API")
         .version("0.0.0")
-        .option("--config <path>", "path to config file (overrides DROPSH_CONFIG)");
+        .option("--config <path>", "path to config file (overrides DROPSH_CONFIG)")
+        .option("--auth-profile <id>", "auth profile to use (overrides the active profile and $DROPSH_AUTH_PROFILE)");
     const stdout = opts.stdout ?? ((s) => process.stdout.write(s));
     const stderr = opts.stderr ?? ((s) => process.stderr.write(s));
     const setExitCode = opts.setExitCode ??
@@ -76,7 +139,11 @@ export function buildProgram(opts = {}) {
             process.exitCode = c;
         });
     const contextFactory = opts.contextFactory ??
-        (() => defaultContext(resolveConfigPath(program.opts().config)));
+        (() => {
+            const o = program.opts();
+            const profile = o.authProfile ?? process.env.DROPSH_AUTH_PROFILE;
+            return defaultContext(resolveConfigPath(o.config), profile);
+        });
     const output = createOutput({ stdout, stderr });
     async function run(fn) {
         try {
@@ -269,14 +336,21 @@ export function buildProgram(opts = {}) {
         .description("Log in via an auth provider")
         .option("--provider <id>", "skip the picker and use this provider id")
         .action((o) => run2(async () => runAuthLogin(o.provider ? { provider: o.provider } : {}, await authDeps())));
+    auth
+        .command("use <id>")
+        .description("Set the active auth profile for this host")
+        .action((id) => run2(async () => runAuthUse({ profile: id }, await authDeps())));
     auth
         .command("logout")
-        .description("Clear the active session")
-        .action(() => run2(async () => runAuthLogout({}, await authDeps())));
+        .description("Clear a stored session (default: the active profile)")
+        .option("--profile <id>", "log out this profile instead of the active one")
+        .option("--all", "clear every profile for this host")
+        .action((o) => run2(async () => runAuthLogout(o, await authDeps())));
     auth
         .command("status")
-        .description("Show the active session")
+        .description("List auth profiles and their session state")
         .option("--json", "machine-readable output")
+        .option("--profile <id>", "show only this profile")
         .action((o) => run2(async () => runAuthStatus(o, await authDeps())));
     if (opts.plugins) {
         for (const plugin of opts.plugins) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dropsh",
-  "version": "0.2.0",
+  "version": "0.3.1",
   "description": "Entity-agnostic helper CLI for Drupal 11 JSON:API, used by the dropsh Claude skill for editorial publishing workflows.",
   "type": "module",
   "bin": {