eraspace 0.4.1 → 0.5.0

package/README.md

@@ -15,7 +15,7 @@ npx eraspace deploy                # prints the app URL
 ```
 
 A deploy without an account creates an unclaimed app. It works straight away and expires after about a week unless you
-sign in and claim it (`eraspace auth login`, then `eraspace claim`).
+sign in and claim it (`eraspace login`, then `eraspace claim`).
 
 ## Commands
 
@@ -34,7 +34,7 @@ sign in and claim it (`eraspace auth login`, then `eraspace claim`).
 | `changes` | Print recent committed row changes as NDJSON (`--since <commit>`, `--limit <rows>`) |
 | `undo <commit> --yes` | Put every row changed after a commit back as it was; the undo is a commit too, so it can be undone |
 | `inspect` | Show the schema, functions and deploys |
-| `auth login` / `logout` / `whoami` | Sign in with your browser, sign out, or show who you are |
+| `login` / `logout` / `whoami` (also under `auth`) | Sign in with your browser through Clerk, sign out, or show who you are. Sign-in listens once on `127.0.0.1`, so open the URL on the same machine; in CI use `ERASPACE_TOKEN` |
 | `claim` | Take ownership of this checkout's unclaimed app |
 | `apps` | List your apps |
 | `names` / `names add` / `names rm` | List, add or remove the app's names |

package/bin.js

@@ -31559,7 +31559,7 @@ var TypeId53 = "~effect/Crypto";
 var Crypto = /* @__PURE__ */ Service("effect/Crypto");
 var make46 = (impl) => {
   const randomBytesUnsafe = impl.randomBytes;
-  const randomBytes4 = (size7) => map8(validateSize("randomBytes", size7), randomBytesUnsafe);
+  const randomBytes5 = (size7) => map8(validateSize("randomBytes", size7), randomBytesUnsafe);
   const readUint53 = (bytes2) => (bytes2[0] & 31) * 2 ** 48 + bytes2[1] * 2 ** 40 + bytes2[2] * 2 ** 32 + bytes2[3] * 2 ** 24 + bytes2[4] * 2 ** 16 + bytes2[5] * 2 ** 8 + bytes2[6];
   const nextDoubleUnsafe = () => readUint53(randomBytesUnsafe(7)) / 2 ** 53;
   const nextIntUnsafe = () => {
@@ -31576,7 +31576,7 @@ var make46 = (impl) => {
   };
   return Crypto.of({
     [TypeId53]: TypeId53,
-    randomBytes: randomBytes4,
+    randomBytes: randomBytes5,
     nextDoubleUnsafe,
     nextIntUnsafe,
     digest: impl.digest,
@@ -39365,7 +39365,7 @@ init_define_ERASPACE_MOVED_ORIGINS();
 // cli/package.json
 var package_default = {
   name: "eraspace-cli",
-  version: "0.4.1",
+  version: "0.5.0",
   private: true,
   license: "MIT",
   type: "module",
@@ -39395,6 +39395,8 @@ var package_default = {
 
 // cli/src/auth.ts
 init_define_ERASPACE_MOVED_ORIGINS();
+import { createHash as createHash2, randomBytes as randomBytes4 } from "node:crypto";
+import { createServer } from "node:http";
 
 // node_modules/.pnpm/effect@4.0.5/node_modules/effect/dist/process/index.js
 init_define_ERASPACE_MOVED_ORIGINS();
@@ -39831,14 +39833,13 @@ var Token2 = Schema_exports.Struct({
 });
 var TokenList = Schema_exports.Struct({ tokens: Schema_exports.Array(Token2) });
 var CreatedToken = Schema_exports.Struct({ token: Schema_exports.String, id: Schema_exports.String });
-var DeviceStart = Schema_exports.Struct({
-  deviceCode: Schema_exports.String,
-  userCode: Schema_exports.String,
-  verificationUri: Schema_exports.String,
-  interval: Schema_exports.optional(Schema_exports.Number),
-  expiresIn: Schema_exports.optional(Schema_exports.Number)
-});
-var DeviceToken = Schema_exports.Struct({
+var SignInConfig = Schema_exports.Struct({
+  provider: Schema_exports.Literal("clerk"),
+  issuer: Schema_exports.String,
+  clientId: Schema_exports.String,
+  scopes: Schema_exports.optional(Schema_exports.String)
+});
+var SignedIn = Schema_exports.Struct({
   token: Schema_exports.String,
   user: Schema_exports.Struct({ id: Schema_exports.String, login: Schema_exports.String, provider: Schema_exports.optional(Schema_exports.String) })
 });
@@ -39948,35 +39949,70 @@ var openBrowser = (url) => Effect_exports.gen(function* () {
   const handle = yield* spawner.spawn(ChildProcess_exports.make(command2, args2, { stdin: "ignore", stdout: "ignore", stderr: "ignore" }));
   yield* handle.unref;
 }).pipe(Effect_exports.scoped, Effect_exports.ignore);
-var okDevice = ok(DeviceStart);
-var login = Effect_exports.fnUntraced(function* (config2, browser) {
-  const start = yield* okDevice(config2, "POST", "/_api/auth/device", { auth: false });
-  yield* Console_exports.log(`Open ${c.bold(start.verificationUri)} and enter the code ${c.bold(start.userCode)}`);
-  if (browser) yield* openBrowser(start.verificationUri);
-  let interval = Math.max(1, start.interval ?? 5);
-  const deadline = (yield* Clock_exports.currentTimeMillis) + Math.max(1, start.expiresIn ?? 900) * 1e3;
-  let unreachable2 = 0;
-  while ((yield* Clock_exports.currentTimeMillis) < deadline) {
-    yield* Effect_exports.sleep(Duration_exports.seconds(interval));
-    const polled = yield* api(config2, "POST", "/_api/auth/device/token", { body: { deviceCode: start.deviceCode }, auth: false }).pipe(Effect_exports.result);
-    if (polled._tag === "Failure") {
-      if (++unreachable2 >= 5) return yield* Effect_exports.fail(polled.failure);
-      interval = Math.min(interval * 2, 30);
-      continue;
-    }
-    unreachable2 = 0;
-    const { status, json: json2 } = polled.success;
-    if (status === 202) {
-      if (json2.slowDown) interval += 5;
-      continue;
+var okConfig = ok(SignInConfig);
+var okSignedIn = ok(SignedIn);
+var SIGN_IN_TIMEOUT = Duration_exports.minutes(5);
+var page = (title, body) => `<!doctype html><html><head><meta charset="utf-8"><title>${title}</title></head><body style="font:15px system-ui;max-width:30rem;margin:3rem auto"><h1>${title}</h1><p>${body}</p></body></html>`;
+var loopback = Effect_exports.acquireRelease(
+  Effect_exports.callback((resume) => {
+    const server = createServer();
+    server.once("error", (error2) => resume(fail12(`Could not start the local sign-in listener: ${describe(error2)}`)));
+    server.listen(0, "127.0.0.1", () => resume(Effect_exports.succeed(server)));
+  }),
+  (server) => Effect_exports.sync(() => {
+    server.close();
+    server.closeAllConnections();
+  })
+);
+var authorizationCode = (server, state) => Effect_exports.callback((resume) => {
+  const onRequest = (request4, response) => {
+    const url = new URL(request4.url ?? "/", "http://127.0.0.1");
+    const answer = (status, title, body, done4) => response.writeHead(status, { "content-type": "text/html; charset=utf-8", "cache-control": "no-store" }).end(page(title, body), () => done4 && resume(done4));
+    if (request4.method !== "GET" || url.pathname !== "/callback") return answer(404, "Not found", "This listener only waits for the eraspace sign-in.");
+    if (url.searchParams.get("state") !== state) return answer(400, "Sign-in failed", "This link is not from the sign-in your terminal started.");
+    const error2 = url.searchParams.get("error");
+    if (error2) {
+      const why = url.searchParams.get("error_description") || error2;
+      return answer(400, "Sign-in failed", "Return to your terminal.", fail12(`Sign-in failed: ${why}. Run eraspace login again.`));
     }
-    if (status >= 400 || json2.ok === false) return yield* Effect_exports.fail(yield* failure(polled.success));
-    const result4 = yield* decode5(DeviceToken, json2, "sign-in");
-    yield* saveSession(config2.origin, { token: result4.token, user: result4.user, createdAt: yield* Clock_exports.currentTimeMillis });
-    yield* Console_exports.log(`Signed in to ${config2.origin} as ${c.bold(result4.user.login)}.`);
-    return;
-  }
-  return yield* fail12("The sign-in code expired. Run eraspace auth login again.");
+    const code = url.searchParams.get("code");
+    if (!code) return answer(400, "Sign-in failed", "Return to your terminal.", fail12("Sign-in failed: the provider sent no authorization code. Run eraspace login again."));
+    answer(200, "Almost done", "You can close this tab and return to your terminal.", Effect_exports.succeed(code));
+  };
+  server.on("request", onRequest);
+  return Effect_exports.sync(() => server.off("request", onRequest));
+});
+var base64url = (bytes2) => bytes2.toString("base64url");
+var login = Effect_exports.fnUntraced(function* (config2, browser) {
+  const clerk = yield* okConfig(config2, "GET", "/_api/auth/config", { auth: false });
+  const verifier = base64url(randomBytes4(32));
+  const state = base64url(randomBytes4(32));
+  const signedIn = yield* Effect_exports.scoped(
+    Effect_exports.gen(function* () {
+      const server = yield* loopback;
+      const redirectUri = `http://127.0.0.1:${server.address().port}/callback`;
+      const authorize = URL.parse(`${clerk.issuer.replace(/\/+$/, "")}/oauth/authorize`);
+      if (authorize?.protocol !== "https:" && authorize?.protocol !== "http:") return yield* fail12(`The platform named an invalid sign-in provider: ${clerk.issuer}`);
+      for (const [key, value4] of Object.entries({
+        response_type: "code",
+        client_id: clerk.clientId,
+        redirect_uri: redirectUri,
+        scope: clerk.scopes ?? "profile email",
+        state,
+        code_challenge: base64url(createHash2("sha256").update(verifier).digest()),
+        code_challenge_method: "S256"
+      })) authorize.searchParams.set(key, value4);
+      yield* Console_exports.log(`Open this URL to sign in:
+${c.bold(authorize.href)}`);
+      if (browser) yield* openBrowser(authorize.href);
+      const code = yield* authorizationCode(server, state).pipe(
+        Effect_exports.timeoutOrElse({ duration: SIGN_IN_TIMEOUT, orElse: () => fail12("Sign-in timed out. Run eraspace login again.") })
+      );
+      return yield* okSignedIn(config2, "POST", "/_api/auth/clerk/token", { body: { code, codeVerifier: verifier, redirectUri }, auth: false });
+    })
+  );
+  yield* saveSession(config2.origin, { token: signedIn.token, user: signedIn.user, createdAt: yield* Clock_exports.currentTimeMillis });
+  yield* Console_exports.log(`Signed in to ${config2.origin} as ${c.bold(signedIn.user.login)}.`);
 });
 var LogoutResult = Schema_exports.Struct({ ok: Schema_exports.Literal(true) });
 var logout = Effect_exports.fnUntraced(function* (config2) {
@@ -41138,7 +41174,10 @@ var shadowFlags = {
   )
 };
 var browserFlag = {
-  browser: Flag_exports.Boolean("browser").pipe(Flag_exports.withDefault(true), Flag_exports.withDescription("Open the sign-in page in a browser; --no-browser only prints the URL"))
+  browser: Flag_exports.Boolean("browser").pipe(
+    Flag_exports.withDefault(true),
+    Flag_exports.withDescription("Open the sign-in page in a browser; --no-browser only prints the URL, to open in a browser on this machine")
+  )
 };
 var loginHandler = ({ browser }) => Effect_exports.flatMap(config, (c2) => login(c2, browser));
 var logoutHandler = () => Effect_exports.flatMap(config, logout);
@@ -41251,7 +41290,7 @@ var inspectCommand = Command_exports.make(
   ({ app }) => Effect_exports.flatMap(config, (c2) => inspect2(c2, value3(app)))
 ).pipe(Command_exports.withDescription("Show schema, functions and deployment details"));
 var authCommand = Command_exports.make("auth").pipe(
-  Command_exports.withDescription("Sign in with your browser (device flow), sign out, or show who you are"),
+  Command_exports.withDescription("Sign in with your browser through Clerk, sign out, or show who you are"),
   Command_exports.withSubcommands([
     Command_exports.make("login", browserFlag, loginHandler).pipe(Command_exports.withDescription("Sign in to the platform")),
     Command_exports.make("logout", {}, logoutHandler).pipe(Command_exports.withDescription("Revoke and forget this platform's session")),
@@ -41334,8 +41373,8 @@ var tokenCommand = Command_exports.make("token").pipe(
     ).pipe(Command_exports.withDescription("Revoke a token"))
   ])
 );
-var hidden = [
-  Command_exports.make("login", browserFlag, loginHandler).pipe(Command_exports.unlisted),
+var shortForms = [
+  Command_exports.make("login", browserFlag, loginHandler).pipe(Command_exports.withDescription("Sign in with your browser through Clerk")),
   Command_exports.make("logout", {}, logoutHandler).pipe(Command_exports.unlisted),
   Command_exports.make("whoami", {}, whoamiHandler).pipe(Command_exports.unlisted)
 ];
@@ -41364,7 +41403,7 @@ var command = eraspace.pipe(
     changesCommand,
     undoCommand,
     tokenCommand,
-    ...hidden
+    ...shortForms
   ])
 );
 var run6 = Command_exports.runWith(command, { version: VERSION });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eraspace",
-  "version": "0.4.1",
+  "version": "0.5.0",
   "description": "eraspace: build, deploy and manage eraspace capsules",
   "type": "module",
   "keywords": [