expandai 0.0.2 → 0.0.3

package/src/DeviceAuth.ts

@@ -1,193 +0,0 @@
-import { HttpClient, HttpClientRequest, HttpClientResponse } from '@effect/platform'
-import { NodeHttpClient } from '@effect/platform-node'
-import { DateTime, Duration, Effect, Inspectable, Match, Option, Redacted, Ref, Schema, String } from 'effect'
-import { ConfigManager, OAuthConfig } from './Config.js'
-
-const FormattedUserCode = Schema.transform(Schema.String, Schema.String, {
-	strict: true,
-	decode: (raw) => {
-		const upper = String.toUpperCase(raw)
-		return upper.length > 4 ? `${String.takeLeft(upper, 4)}-${String.takeRight(upper, upper.length - 4)}` : upper
-	},
-	encode: (formatted) => formatted.replace('-', ''),
-})
-
-const DurationFromSeconds = Schema.transform(Schema.Number, Schema.DurationFromSelf, {
-	strict: true,
-	decode: Duration.seconds,
-	encode: Duration.toSeconds,
-})
-
-export class DeviceCodeResponse extends Schema.Class<DeviceCodeResponse>('DeviceCodeResponse')({
-	device_code: Schema.String,
-	user_code: FormattedUserCode,
-	verification_uri: Schema.String,
-	verification_uri_complete: Schema.String,
-	expires_in: DurationFromSeconds,
-	interval: DurationFromSeconds,
-}) {}
-
-export class TokenResponse extends Schema.Class<TokenResponse>('TokenResponse')({
-	access_token: Schema.String,
-	expires_in: DurationFromSeconds,
-	token_type: Schema.String,
-	scope: Schema.optional(Schema.String),
-}) {}
-
-export class DeviceAuthRequestFailed extends Schema.TaggedError<DeviceAuthRequestFailed>()('DeviceAuthRequestFailed', {
-	endpoint: Schema.String,
-	error: Schema.Defect,
-	status: Schema.optional(Schema.Number),
-}) {
-	get message() {
-		return `Device auth request to ${this.endpoint} failed${this.status ? ` (${this.status})` : ''}: ${Inspectable.format(this.error)}`
-	}
-}
-
-export class DeviceAuthorizationDenied extends Schema.TaggedError<DeviceAuthorizationDenied>()(
-	'DeviceAuthorizationDenied',
-	{},
-) {
-	get message() {
-		return 'Authorization was denied by the user'
-	}
-}
-
-export class DeviceAuthorizationExpired extends Schema.TaggedError<DeviceAuthorizationExpired>()(
-	'DeviceAuthorizationExpired',
-	{},
-) {
-	get message() {
-		return 'Device authorization code expired'
-	}
-}
-
-const CLIENT_ID = 'expandai-cli'
-
-export class DeviceAuthService extends Effect.Service<DeviceAuthService>()('@expandai/cli/DeviceAuthService', {
-	dependencies: [NodeHttpClient.layer, ConfigManager.Default],
-	effect: Effect.gen(function* () {
-		const httpClient = yield* HttpClient.HttpClient
-		const configManager = yield* ConfigManager
-		const apiUrl = yield* configManager.getApiUrl()
-
-		const requestDeviceCode = Effect.fn('DeviceAuthService.requestDeviceCode')(function* () {
-			const DEVICE_AUTH_CODE_ENDPOINT = '/api/auth/device/code'
-
-			const request = yield* HttpClientRequest.post(new URL(DEVICE_AUTH_CODE_ENDPOINT, apiUrl)).pipe(
-				HttpClientRequest.bodyJson({ client_id: CLIENT_ID }),
-			)
-
-			return yield* httpClient.execute(request).pipe(
-				Effect.flatMap(HttpClientResponse.schemaBodyJson(DeviceCodeResponse)),
-				Effect.mapError(
-					(error) =>
-						new DeviceAuthRequestFailed({
-							endpoint: DEVICE_AUTH_CODE_ENDPOINT,
-							error,
-						}),
-				),
-			)
-		})
-
-		const pollForToken = Effect.fn('DeviceAuthService.pollForToken')(function* (
-			deviceCode: string,
-			interval: Duration.Duration,
-			expiresIn: Duration.Duration,
-		) {
-			const DEVICE_AUTH_TOKEN_ENDPOINT = '/api/auth/device/token'
-			// RFC 8628 §3.5: on `slow_down`, the polling interval MUST be increased by 5
-			// seconds for this and all subsequent requests.
-			const SLOW_DOWN_BUMP = Duration.seconds(5)
-			const intervalRef = yield* Ref.make(interval)
-
-			const PollErrorBody = Schema.Struct({
-				error: Schema.String,
-				error_description: Schema.optional(Schema.String),
-			})
-
-			// better-auth's `deviceAuthorization` plugin accepts JSON; RFC 8628 §3.4
-			// would normally require `application/x-www-form-urlencoded`. If we ever
-			// target a non-better-auth server, switch to `HttpClientRequest.bodyUrlParams`.
-			const singlePoll = HttpClientRequest.post(new URL(DEVICE_AUTH_TOKEN_ENDPOINT, apiUrl)).pipe(
-				HttpClientRequest.bodyJson({
-					grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
-					device_code: deviceCode,
-					client_id: CLIENT_ID,
-				}),
-				Effect.flatMap(httpClient.execute),
-				Effect.flatMap(
-					HttpClientResponse.matchStatus({
-						'200': (response) =>
-							HttpClientResponse.schemaBodyJson(TokenResponse)(response).pipe(Effect.map(Option.some)),
-						orElse: (response) =>
-							HttpClientResponse.schemaBodyJson(PollErrorBody)(response).pipe(
-								Effect.flatMap(({ error, error_description }) =>
-									Match.value(error).pipe(
-										Match.when('authorization_pending', () =>
-											Ref.get(intervalRef).pipe(Effect.flatMap(Effect.sleep), Effect.as(Option.none<TokenResponse>())),
-										),
-										Match.when('slow_down', () =>
-											Ref.updateAndGet(intervalRef, (current) => Duration.sum(current, SLOW_DOWN_BUMP)).pipe(
-												Effect.flatMap(Effect.sleep),
-												Effect.as(Option.none<TokenResponse>()),
-											),
-										),
-										Match.when('access_denied', () => Effect.fail(new DeviceAuthorizationDenied())),
-										Match.when('expired_token', () => Effect.fail(new DeviceAuthorizationExpired())),
-										Match.orElse(() =>
-											Effect.fail(
-												new DeviceAuthRequestFailed({
-													endpoint: DEVICE_AUTH_TOKEN_ENDPOINT,
-													status: response.status,
-													error: error_description ?? error,
-												}),
-											),
-										),
-									),
-								),
-							),
-					}),
-				),
-				Effect.catchTags({
-					RequestError: (error) => new DeviceAuthRequestFailed({ endpoint: DEVICE_AUTH_TOKEN_ENDPOINT, error }),
-					ResponseError: (error) => new DeviceAuthRequestFailed({ endpoint: DEVICE_AUTH_TOKEN_ENDPOINT, error }),
-					HttpBodyError: (error) => new DeviceAuthRequestFailed({ endpoint: DEVICE_AUTH_TOKEN_ENDPOINT, error }),
-					ParseError: (error) => new DeviceAuthRequestFailed({ endpoint: DEVICE_AUTH_TOKEN_ENDPOINT, error }),
-				}),
-			)
-
-			const result = yield* Effect.repeat(singlePoll, { until: Option.isSome }).pipe(
-				Effect.timeoutFail({
-					duration: expiresIn,
-					onTimeout: () => new DeviceAuthorizationExpired(),
-				}),
-			)
-
-			return yield* Option.match(result, {
-				onNone: () => new DeviceAuthorizationExpired(),
-				onSome: Effect.succeed,
-			})
-		})
-
-		// INFO: better-auth's `deviceAuthorization` plugin issues access tokens
-		// with no refresh flow — `/api/auth/device/token` only accepts
-		// `grant_type=urn:ietf:params:oauth:grant-type:device_code`. Refresh is
-		// not part of the auth surface we're using, so we don't persist the
-		// refresh_token at all; ApiClient pre-empts the post-expiry 401 with
-		// `OAuthTokenExpired` and asks the user to re-login.
-		const saveToken = Effect.fn('DeviceAuthService.saveToken')(function* (tokenResponse: TokenResponse) {
-			const now = yield* DateTime.now
-			const expiresAt = DateTime.addDuration(now, tokenResponse.expires_in)
-
-			yield* configManager.updateConfig({
-				authMethod: OAuthConfig.make({
-					accessToken: Redacted.make(tokenResponse.access_token),
-					expiresAt,
-				}),
-			})
-		})
-
-		return { requestDeviceCode, pollForToken, saveToken } as const
-	}),
-}) {}