gigadrive 1.1.2 → 2.0.0

package/dist/index.cjs

@@ -26,6 +26,45 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 // src/index.ts
 var import_commander = require("commander");
 
+// src/util/log.ts
+var import_consola = require("consola");
+var verbose = false;
+var consola = (0, import_consola.createConsola)({
+  level: verbose ? 4 : 3,
+  // 4 includes debug messages, 3 is the default (info and above)
+  formatOptions: {
+    colors: true
+  }
+});
+var updateConsola = () => {
+  consola.level = verbose ? 4 : 3;
+};
+var setVerbose = (value) => {
+  verbose = value;
+  updateConsola();
+};
+var log = (message) => {
+  consola.info(message);
+};
+var error = (message) => {
+  consola.error(message);
+};
+var success = (message) => {
+  consola.success(message);
+};
+var warn = (message) => {
+  consola.warn(message);
+};
+var debug = (message, ...optionalParams) => {
+  if (!verbose) {
+    return;
+  }
+  consola.debug("[DEBUG]", message, ...optionalParams);
+};
+var spinner = (message) => {
+  log(message);
+};
+
 // src/commands/build/index.ts
 var import_build_utils = require("@gigadrive/build-utils");
 var import_fs2 = __toESM(require("fs"), 1);
@@ -40,7 +79,7 @@ var import_child_process = require("child_process");
 async function exec({
   command,
   cwd = process.cwd(),
-  env,
+  env: env2,
   onOutput = (data) => console.log(data),
   onError = (data) => console.error(data)
 }) {
@@ -58,7 +97,7 @@ async function exec({
     const childProcess = (0, import_child_process.spawn)(spawnCommand, spawnArgs, {
       cwd,
       shell: true,
-      env
+      env: env2
     });
     childProcess.stdout.on("data", (data) => {
       onOutput(data.toString().trim());
@@ -124,7 +163,7 @@ var buildCommand = (pm) => {
 // src/commands/build/index.ts
 var build = (parent) => {
   parent.command("build").description("Build the current project").action(async () => {
-    const env = {
+    const env2 = {
       ...process.env,
       NODE_ENV: "production",
       NEBULA: "1",
@@ -135,34 +174,34 @@ var build = (parent) => {
     const cwd = process.cwd();
     const packageJsonPath = import_path2.default.join(cwd, "package.json");
     if (!import_fs2.default.existsSync(packageJsonPath)) {
-      console.log("No package.json found");
+      error("No package.json found");
       return;
     }
     const packageJson = JSON.parse(import_fs2.default.readFileSync(packageJsonPath, "utf-8"));
     const buildScript = packageJson.scripts?.build;
     if (!buildScript) {
-      console.log("No build script found in package.json");
+      error("No build script found in package.json");
       return;
     }
     const packageManager = await getPackageManager({ cwd });
     if (!packageManager) {
-      console.log("No package manager found");
+      error("No package manager found");
       return;
     }
     await (0, import_build_utils.exec)({
       command: installCommand(packageManager),
       cwd,
-      env,
+      env: env2,
       onOutput: (chunk) => {
-        console.log(chunk);
+        log(chunk);
       }
     });
     await (0, import_build_utils.exec)({
       command: buildCommand(packageManager),
       cwd,
-      env,
+      env: env2,
       onOutput: (chunk) => {
-        console.log(chunk);
+        log(chunk);
       }
     });
   });
@@ -171,47 +210,6 @@ var build = (parent) => {
 // src/commands/debug/config/index.ts
 var import_network_config = require("@gigadrive/network-config");
 var import_console = require("console");
-
-// src/util/log.ts
-var import_consola = require("consola");
-var verbose = false;
-var consola = (0, import_consola.createConsola)({
-  level: verbose ? 4 : 3,
-  // 4 includes debug messages, 3 is the default (info and above)
-  formatOptions: {
-    colors: true
-  }
-});
-var updateConsola = () => {
-  consola.level = verbose ? 4 : 3;
-};
-var setVerbose = (value) => {
-  verbose = value;
-  updateConsola();
-};
-var log = (message) => {
-  consola.info(message);
-};
-var error = (message) => {
-  consola.error(message);
-};
-var success = (message) => {
-  consola.success(message);
-};
-var warn = (message) => {
-  consola.warn(message);
-};
-var debug = (message, ...optionalParams) => {
-  if (!verbose) {
-    return;
-  }
-  consola.debug("[DEBUG]", message, ...optionalParams);
-};
-var spinner = (message) => {
-  log(message);
-};
-
-// src/commands/debug/config/index.ts
 var config = (parent) => {
   parent.command("config").description("Provide debug info about the project configuration in the current directory").action(async () => {
     const configPath = (0, import_network_config.findConfig)(process.cwd());
@@ -231,6 +229,427 @@ var debug2 = (program) => {
   config(debug3);
 };
 
+// src/env.ts
+var import_env_core = require("@t3-oss/env-core");
+var import_dotenv = require("dotenv");
+var import_node_fs = __toESM(require("fs"), 1);
+var import_node_path = __toESM(require("path"), 1);
+var import_zod = require("zod");
+(() => {
+  const cwd = process.cwd();
+  const nodeEnv = process.env.NODE_ENV;
+  const candidates = [
+    nodeEnv ? `.env.${nodeEnv}.local` : null,
+    `.env.local`,
+    nodeEnv ? `.env.${nodeEnv}` : null,
+    `.env`
+  ].filter(Boolean);
+  for (const filename of candidates) {
+    const fullPath = import_node_path.default.join(cwd, filename);
+    if (import_node_fs.default.existsSync(fullPath)) {
+      console.debug(`Loading environment variables from ${fullPath}`);
+      (0, import_dotenv.config)({ path: fullPath, override: false });
+    }
+  }
+})();
+var env = (0, import_env_core.createEnv)({
+  server: {
+    GIGADRIVE_NETWORK_OAUTH_ISSUER_URL: import_zod.z.url().min(1).default("https://idp.gigadrive.de"),
+    GIGADRIVE_NETWORK_OAUTH_CLIENT_ID: import_zod.z.string().min(1).default("todo_add_client_id")
+  },
+  runtimeEnv: process.env,
+  emptyStringAsUndefined: true
+});
+
+// src/config/oauth.ts
+var cachedConfig = null;
+async function getOAuthConfig() {
+  if (cachedConfig) return cachedConfig;
+  const issuerBase = env.GIGADRIVE_NETWORK_OAUTH_ISSUER_URL.replace(/\/$/, "");
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), 8e3);
+  let discovery = null;
+  try {
+    const discoveryUrl = `${issuerBase}/.well-known/openid-configuration`;
+    const res = await fetch(discoveryUrl, { signal: controller.signal });
+    if (res.ok) {
+      discovery = await res.json();
+    } else {
+      discovery = null;
+    }
+  } catch {
+    discovery = null;
+  } finally {
+    clearTimeout(timeout);
+  }
+  if (!discovery?.authorization_endpoint || !discovery?.token_endpoint || !discovery?.userinfo_endpoint) {
+    throw new Error("OIDC discovery failed or returned incomplete endpoints");
+  }
+  const DEFAULT_SCOPE = "offline_access openid profile email";
+  cachedConfig = {
+    clientId: env.GIGADRIVE_NETWORK_OAUTH_CLIENT_ID,
+    issuer: discovery.issuer ?? issuerBase,
+    authorizeUrl: discovery.authorization_endpoint,
+    tokenUrl: discovery.token_endpoint,
+    scope: DEFAULT_SCOPE,
+    userinfoUrl: discovery.userinfo_endpoint
+  };
+  return cachedConfig;
+}
+
+// src/auth/manager.ts
+var crypto = __toESM(require("crypto"), 1);
+var fs4 = __toESM(require("fs"), 1);
+var http = __toESM(require("http"), 1);
+var os = __toESM(require("os"), 1);
+var path4 = __toESM(require("path"), 1);
+var import_node_url = require("url");
+var import_open = __toESM(require("open"), 1);
+function getAuthStoragePaths() {
+  const homeDir = os.homedir();
+  const authDir = path4.join(homeDir, ".gigadrive");
+  const authFile = path4.join(authDir, "auth.json");
+  return { directory: authDir, file: authFile };
+}
+async function ensureAuthDirectory() {
+  const { directory } = getAuthStoragePaths();
+  try {
+    await fs4.promises.mkdir(directory, { recursive: true, mode: 448 });
+    await fs4.promises.chmod(directory, 448);
+  } catch (error2) {
+    const errorMessage = error2 instanceof Error ? error2.message : "Unknown error";
+    throw new Error(`Failed to create auth directory: ${errorMessage}`);
+  }
+}
+function generatePKCE() {
+  const codeVerifier = base64URLEncode(crypto.randomBytes(64));
+  const challengeBytes = crypto.createHash("sha256").update(codeVerifier, "utf8").digest();
+  const codeChallenge = base64URLEncode(challengeBytes);
+  return { codeVerifier, codeChallenge };
+}
+function base64URLEncode(buffer) {
+  return buffer.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+}
+var AuthManager = class {
+  accessToken = null;
+  tokenExpirationTime = 0;
+  // Unix timestamp in milliseconds
+  codeVerifier = null;
+  state = null;
+  constructor() {
+  }
+  /**
+   * Retrieves the stored auth data from the local file.
+   * @returns {Promise<StoredAuthData | null>} The stored auth data if found, otherwise null.
+   * @private
+   */
+  async _loadStoredAuthData() {
+    try {
+      const { file } = getAuthStoragePaths();
+      const data = await fs4.promises.readFile(file, "utf8");
+      const authData = JSON.parse(data);
+      if (authData.accessToken && authData.tokenExpirationTime && Date.now() < authData.tokenExpirationTime) {
+        this.accessToken = authData.accessToken;
+        this.tokenExpirationTime = authData.tokenExpirationTime;
+      }
+      return authData;
+    } catch {
+      return null;
+    }
+  }
+  /**
+   * Stores the auth data in the local file.
+   * @param {StoredAuthData} authData The auth data to store.
+   * @private
+   */
+  async _saveStoredAuthData(authData) {
+    try {
+      await ensureAuthDirectory();
+      const { file } = getAuthStoragePaths();
+      await fs4.promises.writeFile(file, JSON.stringify(authData, null, 2), { encoding: "utf8", mode: 384 });
+      await fs4.promises.chmod(file, 384);
+      console.debug("Auth data saved to local storage.");
+    } catch (error2) {
+      const errorMessage = error2 instanceof Error ? error2.message : "Unknown error";
+      console.error("Error saving auth data to local storage:", errorMessage);
+    }
+  }
+  /**
+   * Deletes the stored auth data from the local file.
+   */
+  async logout() {
+    this.accessToken = null;
+    this.tokenExpirationTime = 0;
+    try {
+      const { file } = getAuthStoragePaths();
+      await fs4.promises.unlink(file);
+      log("Logged out. Auth data removed from local storage.");
+    } catch {
+      log("Logged out.");
+    }
+  }
+  /**
+   * Initiates the OAuth login flow with the IDP via a web portal.
+   * Opens a browser for user authentication and listens for the redirect.
+   * @returns {Promise<boolean>} True if login was successful, false otherwise.
+   */
+  async login() {
+    await this.logout();
+    const { codeVerifier, codeChallenge } = generatePKCE();
+    this.codeVerifier = codeVerifier;
+    this.state = crypto.randomBytes(16).toString("hex");
+    const OAUTH_CONFIG = await getOAuthConfig();
+    const loginState = this.state;
+    if (!loginState) {
+      throw new Error("Internal error: login state not initialized");
+    }
+    const server = http.createServer();
+    let usedRedirectUri = "";
+    const serverPromise = new Promise((resolve, reject) => {
+      const redirectPath = "/callback";
+      server.listen(0, "127.0.0.1", () => {
+        const address = server.address();
+        if (!address || typeof address !== "object") {
+          reject(new Error("Failed to determine callback server address"));
+          return;
+        }
+        const port = address.port;
+        usedRedirectUri = `http://127.0.0.1:${port}${redirectPath}`;
+        const authUrl = new import_node_url.URL(OAUTH_CONFIG.authorizeUrl);
+        authUrl.searchParams.append("client_id", OAUTH_CONFIG.clientId);
+        authUrl.searchParams.append("redirect_uri", usedRedirectUri);
+        authUrl.searchParams.append("response_type", "code");
+        authUrl.searchParams.append("scope", OAUTH_CONFIG.scope);
+        authUrl.searchParams.append("code_challenge", codeChallenge);
+        authUrl.searchParams.append("code_challenge_method", "S256");
+        authUrl.searchParams.append("state", loginState);
+        log(`Please open this URL in your browser to log in:
+${authUrl.toString()}
+`);
+        log("Waiting for login callback...");
+        void (0, import_open.default)(authUrl.toString());
+      });
+      server.on("request", (req, res) => {
+        const base = usedRedirectUri || "http://127.0.0.1/callback";
+        const reqUrl = new import_node_url.URL(req.url || "", base);
+        if (reqUrl.pathname === "/callback") {
+          const authCode = reqUrl.searchParams.get("code");
+          const receivedState = reqUrl.searchParams.get("state");
+          const error2 = reqUrl.searchParams.get("error");
+          res.writeHead(200, { "Content-Type": "text/html", Connection: "close" });
+          if (error2) {
+            res.end("<h1>Login Failed!</h1><p>Error: " + error2 + "</p><p>You can close this tab.</p>");
+            reject(new Error(`OAuth error: ${error2}`));
+            server.close();
+            return;
+          }
+          if (receivedState !== this.state) {
+            res.end("<h1>Login Failed!</h1><p>State mismatch. Possible CSRF attack.</p><p>You can close this tab.</p>");
+            reject(new Error("State mismatch"));
+            server.close();
+            return;
+          }
+          if (authCode) {
+            res.end("<h1>Login Successful!</h1><p>You can close this tab.</p>");
+            resolve(authCode);
+            server.close();
+          } else {
+            res.end("<h1>Login Failed!</h1><p>No authorization code received.</p><p>You can close this tab.</p>");
+            reject(new Error("No authorization code received"));
+            server.close();
+          }
+        } else {
+          res.writeHead(404).end("Not Found");
+        }
+      });
+      server.on("error", (err) => {
+        console.error("Local server error:", err);
+        reject(err);
+      });
+    });
+    try {
+      const authCode = await serverPromise;
+      const tokenResponse = await fetch(OAUTH_CONFIG.tokenUrl, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/x-www-form-urlencoded"
+        },
+        body: new import_node_url.URLSearchParams({
+          grant_type: "authorization_code",
+          client_id: OAUTH_CONFIG.clientId,
+          code: authCode,
+          ...usedRedirectUri ? { redirect_uri: usedRedirectUri } : {},
+          code_verifier: this.codeVerifier || ""
+          // Use the stored codeVerifier
+        }).toString()
+      });
+      if (!tokenResponse.ok) {
+        const errorData = await tokenResponse.json().catch(() => null);
+        throw new Error(
+          `Token exchange failed: ${tokenResponse.status} ${tokenResponse.statusText} - ${errorData ? JSON.stringify(errorData) : "Unknown error"}`
+        );
+      }
+      const tokens = await tokenResponse.json();
+      this.accessToken = tokens.access_token;
+      this.tokenExpirationTime = Date.now() + (tokens.expires_in || 3600) * 1e3;
+      if (tokens.refresh_token) {
+        await this._saveStoredAuthData({
+          refreshToken: tokens.refresh_token,
+          accessToken: this.accessToken,
+          tokenExpirationTime: this.tokenExpirationTime
+        });
+        success("Login successful!");
+        return true;
+      } else {
+        console.error("Error: No refresh token received from Gigadrive IDP.");
+        return false;
+      }
+    } catch (error2) {
+      const errorMessage = error2 instanceof Error ? error2.message : "Unknown error";
+      console.error("Login process failed:", errorMessage);
+      this.accessToken = null;
+      this.tokenExpirationTime = 0;
+      return false;
+    } finally {
+      this.codeVerifier = null;
+      this.state = null;
+    }
+  }
+  /**
+   * Refreshes the access token using the stored refresh token.
+   * This method implicitly loads the refresh token from local storage.
+   * @returns {Promise<boolean>} True if refresh was successful, false otherwise.
+   */
+  async refreshAccessToken() {
+    const storedData = await this._loadStoredAuthData();
+    const OAUTH_CONFIG = await getOAuthConfig();
+    if (!storedData?.refreshToken) {
+      error("No refresh token available for refresh. Please log in.");
+      return false;
+    }
+    try {
+      const tokenResponse = await fetch(OAUTH_CONFIG.tokenUrl, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/x-www-form-urlencoded"
+        },
+        body: new import_node_url.URLSearchParams({
+          grant_type: "refresh_token",
+          client_id: OAUTH_CONFIG.clientId,
+          refresh_token: storedData.refreshToken
+        }).toString()
+      });
+      if (!tokenResponse.ok) {
+        const errorData = await tokenResponse.json().catch(() => null);
+        if (tokenResponse.status === 400 && errorData && (errorData.error === "oauth_token_not_found" || errorData.errors?.[0]?.code === "token_invalid" || errorData.errors?.[0]?.code === "token_expired" || errorData.errors?.[0]?.code === "token_revoked")) {
+          console.error("Refresh token is invalid or expired. Please log in again.");
+          await this.logout();
+          return false;
+        }
+        throw new Error(
+          `Token refresh failed: ${tokenResponse.status} ${tokenResponse.statusText} - ${errorData ? JSON.stringify(errorData) : "Unknown error"}`
+        );
+      }
+      const tokens = await tokenResponse.json();
+      this.accessToken = tokens.access_token;
+      this.tokenExpirationTime = Date.now() + (tokens.expires_in || 3600) * 1e3;
+      const newRefreshToken = tokens.refresh_token || storedData.refreshToken;
+      if (tokens.refresh_token && tokens.refresh_token !== storedData.refreshToken) {
+        console.debug("New refresh token received and updated.");
+      }
+      await this._saveStoredAuthData({
+        refreshToken: newRefreshToken,
+        accessToken: this.accessToken,
+        tokenExpirationTime: this.tokenExpirationTime
+      });
+      console.debug("Access token refreshed successfully!");
+      return true;
+    } catch (error2) {
+      const errorMessage = error2 instanceof Error ? error2.message : "Unknown error";
+      console.error("Error refreshing access token:", errorMessage);
+      this.accessToken = null;
+      this.tokenExpirationTime = 0;
+      return false;
+    }
+  }
+  /**
+   * Provides the current valid access token. If the in-memory token is expired,
+   * it attempts to refresh it using the stored refresh token.
+   * @returns {Promise<string | null>} The valid access token or null if no session.
+   */
+  async getAccessToken() {
+    if (this.accessToken && Date.now() < this.tokenExpirationTime) {
+      return this.accessToken;
+    }
+    console.debug("Access token expired or not available. Attempting to refresh...");
+    if (await this.refreshAccessToken()) {
+      return this.accessToken;
+    }
+    error("No valid access token available. Please log in first.");
+    return null;
+  }
+  /**
+   * Fetches the current user's information from the configured userinfo endpoint.
+   * Attempts a single token refresh and retry on 401/403 responses.
+   */
+  async getUserInfo() {
+    const OAUTH_CONFIG = await getOAuthConfig();
+    const currentToken = await this.getAccessToken();
+    if (!currentToken) {
+      error("Not authenticated. Please log in.");
+      return null;
+    }
+    const fetchUserInfo = async (token) => fetch(OAUTH_CONFIG.userinfoUrl, {
+      headers: {
+        Authorization: `Bearer ${token}`,
+        Accept: "application/json"
+      }
+    });
+    let response = await fetchUserInfo(currentToken);
+    if (response.status === 401 || response.status === 403) {
+      const refreshed = await this.refreshAccessToken();
+      if (!refreshed || !this.accessToken) {
+        return null;
+      }
+      response = await fetchUserInfo(this.accessToken);
+    }
+    if (!response.ok) {
+      const body = await response.text().catch(() => "");
+      throw new Error(
+        `Failed to fetch user info: ${response.status} ${response.statusText}${body ? ` - ${body}` : ""}`
+      );
+    }
+    const data = await response.json();
+    return data;
+  }
+};
+var authManager = new AuthManager();
+
+// src/commands/login/index.ts
+var login = (program) => {
+  program.command("login").description("Login to the platform").action(async () => {
+    log("Initiating login...");
+    const result = await authManager.login();
+    if (result) {
+      try {
+        const info = await authManager.getUserInfo() ?? {};
+        const isNonEmptyString = (value) => typeof value === "string" && value.trim() !== "";
+        const nameField = info.name;
+        const givenNameField = info.given_name;
+        const familyNameField = info.family_name;
+        const preferredUsernameField = info.preferred_username;
+        const emailField = info.email;
+        const inferredName = isNonEmptyString(nameField) && nameField || (isNonEmptyString(givenNameField) && isNonEmptyString(familyNameField) ? `${givenNameField} ${familyNameField}` : void 0) || isNonEmptyString(preferredUsernameField) && preferredUsernameField || isNonEmptyString(emailField) && emailField || "your account";
+        success(`You are now logged in as ${inferredName}.`);
+      } catch {
+        success("You are now logged in.");
+      }
+    } else {
+      error("Login failed. Please try again.");
+    }
+  });
+};
+
 // src/commands/platform/deploy/index.ts
 var import_commons = require("@gigadrive/commons");
 var import_network_config2 = require("@gigadrive/network-config");
@@ -494,7 +913,7 @@ var uploadArchive = async (deploymentId, logs, config2) => {
   const fileChunkSize = 10 * 1024 * 1024;
   const numChunks = Math.ceil(fileSize / fileChunkSize);
   debug(`File size: ${fileSize}, chunk size: ${fileChunkSize}, number of chunks: ${numChunks}`);
-  const promises = [];
+  const promises2 = [];
   let start, end;
   for (let index = 1; index < numChunks + 1; index++) {
     start = (index - 1) * fileChunkSize;
@@ -534,12 +953,12 @@ var uploadArchive = async (deploymentId, logs, config2) => {
         }
       })();
     });
-    promises.push(promise);
+    promises2.push(promise);
   }
   const finishedParts = [];
   try {
-    debug(`Waiting for all ${promises.length} upload promises to complete`);
-    const responses = await Promise.all(promises);
+    debug(`Waiting for all ${promises2.length} upload promises to complete`);
+    const responses = await Promise.all(promises2);
     debug("All upload promises completed");
     for (let index = 0; index < responses.length; index++) {
       const res = responses[index];
@@ -686,6 +1105,23 @@ var platform = (program) => {
   deploy(platform2);
 };
 
+// src/commands/whoami/index.ts
+var whoami = (program) => {
+  program.command("whoami").description("Show the currently authenticated user information").action(async () => {
+    try {
+      const info = await authManager.getUserInfo();
+      if (!info) {
+        console.log('You are not logged in. Run "gigadrive login" to authenticate.');
+        return;
+      }
+      console.log(JSON.stringify(info, null, 2));
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      console.error(`Failed to retrieve user info: ${msg}`);
+    }
+  });
+};
+
 // src/index.ts
 var { isTTY } = process.stdout;
 var main = async () => {
@@ -709,6 +1145,8 @@ var main = async () => {
   platform(program);
   debug2(program);
   build(program);
+  login(program);
+  whoami(program);
   try {
     await program.parseAsync(process.argv);
   } catch (err) {
@@ -743,6 +1181,6 @@ process.on("exit", () => {
   terminal?.write("\x1B[?25h");
 });
 main().then((exitCode) => {
-  process.exitCode = exitCode;
+  process.exit(exitCode);
 }).catch(handleUnexpected);
 //# sourceMappingURL=index.cjs.map