gigadrive 2.3.0 → 2.4.0

package/dist/index.mjs

@@ -9,7 +9,7 @@ import { Effect as Effect27, Layer, LogLevel, Logger } from "effect";
 // package.json
 var package_default = {
   name: "gigadrive",
-  version: "2.3.0",
+  version: "2.4.0",
   repository: {
     type: "git",
     url: "https://github.com/Gigadrive/sdk.git",
@@ -35,7 +35,7 @@ var package_default = {
   dependencies: {
     "@effect/cli": "^0.75.0",
     "@effect/platform": "^0.96.0",
-    "@effect/platform-node": "^0.106.0",
+    "@effect/platform-node": "^0.107.0",
     "@gigadrive/build-utils": "workspace:*",
     "@gigadrive/commons": "workspace:*",
     "@gigadrive/network-config": "workspace:*",
@@ -46,8 +46,8 @@ var package_default = {
     open: "^10.2.0"
   },
   devDependencies: {
-    "@effect/language-service": "^0.84.0",
-    "@types/archiver": "^6.0.3",
+    "@effect/language-service": "^0.86.0",
+    "@types/archiver": "^6.0.4",
     esbuild: "^0.28.0",
     typescript: "catalog:"
   },
@@ -90,6 +90,25 @@ var TokenExchangeError = class extends Schema.TaggedError()("TokenExchangeError"
   statusCode: Schema.optional(Schema.Number)
 }) {
 };
+var DeviceAuthorizationError = class extends Schema.TaggedError()(
+  "DeviceAuthorizationError",
+  {
+    message: Schema.String,
+    cause: Schema.optional(Schema.String)
+  }
+) {
+};
+var AuthorizationDeniedError = class extends Schema.TaggedError()(
+  "AuthorizationDeniedError",
+  {
+    message: Schema.String
+  }
+) {
+};
+var DeviceCodeExpiredError = class extends Schema.TaggedError()("DeviceCodeExpiredError", {
+  message: Schema.String
+}) {
+};
 var TokenRefreshError = class extends Schema.TaggedError()("TokenRefreshError", {
   message: Schema.String,
   statusCode: Schema.optional(Schema.Number)
@@ -286,16 +305,10 @@ import { ApiError, GigadriveClient } from "@gigadrive/sdk";
 import { Config as Config2, Effect as Effect4 } from "effect";
 
 // src/services/auth.ts
-import { Console, Effect as Effect3, Option as Option2 } from "effect";
-import * as crypto from "crypto";
-import * as http from "http";
+import { Console, Duration, Effect as Effect3, Option as Option2, Schema as Schema5 } from "effect";
+import process3 from "process";
 import open from "open";
 
-// src/services/auth-storage.ts
-import { FileSystem, Path } from "@effect/platform";
-import { Effect, Option, Schema as Schema3 } from "effect";
-import * as os from "os";
-
 // src/domain.ts
 import { Schema as Schema2 } from "effect";
 var DeploymentId = Schema2.String.pipe(Schema2.brand("@Gigadrive/DeploymentId"));
@@ -313,9 +326,18 @@ var OAuthClientConfig = Schema2.Struct({
   issuer: Schema2.String,
   authorizeUrl: Schema2.String,
   tokenUrl: Schema2.String,
+  deviceAuthorizeUrl: Schema2.String,
   scope: Schema2.String,
   userinfoUrl: Schema2.String
 });
+var DeviceAuthorizationResponse = Schema2.Struct({
+  device_code: Schema2.String,
+  user_code: Schema2.String,
+  verification_uri: Schema2.String,
+  verification_uri_complete: Schema2.optional(Schema2.String),
+  expires_in: Schema2.Number,
+  interval: Schema2.optional(Schema2.Number)
+});
 var StoredAuthData = Schema2.Struct({
   refreshToken: Schema2.String,
   accessToken: Schema2.optional(Schema2.String),
@@ -330,7 +352,47 @@ var DevKeyEntry = Schema2.Struct({
 });
 var DevKeyStore = Schema2.Record({ key: Schema2.String, value: DevKeyEntry });
 
+// src/lib/clipboard.ts
+import { spawn } from "child_process";
+import process2 from "process";
+var clipboardCandidates = () => {
+  switch (process2.platform) {
+    case "darwin":
+      return [{ cmd: "pbcopy", args: [] }];
+    case "win32":
+      return [{ cmd: "clip", args: [] }];
+    default:
+      return [
+        { cmd: "wl-copy", args: [] },
+        { cmd: "xclip", args: ["-selection", "clipboard"] },
+        { cmd: "xsel", args: ["--clipboard", "--input"] }
+      ];
+  }
+};
+function writeClipboard(text) {
+  const candidates = clipboardCandidates();
+  const tryNext = (index) => {
+    if (index >= candidates.length) return;
+    const { cmd, args } = candidates[index];
+    let proc;
+    try {
+      proc = spawn(cmd, args, { stdio: ["pipe", "ignore", "ignore"] });
+    } catch {
+      tryNext(index + 1);
+      return;
+    }
+    proc.on("error", () => tryNext(index + 1));
+    proc.stdin?.on("error", () => {
+    });
+    proc.stdin?.end(text);
+  };
+  tryNext(0);
+}
+
 // src/services/auth-storage.ts
+import { FileSystem, Path } from "@effect/platform";
+import { Effect, Option, Schema as Schema3 } from "effect";
+import * as os from "os";
 var AuthStorageService = class extends Effect.Service()("AuthStorageService", {
   accessors: true,
   effect: Effect.gen(function* () {
@@ -419,7 +481,8 @@ var OpenIdDiscoveryDocument = Schema4.Struct({
   issuer: Schema4.optional(Schema4.String),
   authorization_endpoint: Schema4.optional(Schema4.String),
   token_endpoint: Schema4.optional(Schema4.String),
-  userinfo_endpoint: Schema4.optional(Schema4.String)
+  userinfo_endpoint: Schema4.optional(Schema4.String),
+  device_authorization_endpoint: Schema4.optional(Schema4.String)
 });
 var CLI_SCOPES = [
   // Identity / OIDC
@@ -485,7 +548,7 @@ var OAuthConfigService = class extends Effect2.Service()("OAuthConfigService", {
           })
         )
       );
-      if (!decoded.authorization_endpoint || !decoded.token_endpoint || !decoded.userinfo_endpoint) {
+      if (!decoded.authorization_endpoint || !decoded.token_endpoint || !decoded.userinfo_endpoint || !decoded.device_authorization_endpoint) {
         return yield* Effect2.fail(
           new OAuthDiscoveryError({
             message: "OIDC discovery returned incomplete endpoints"
@@ -497,6 +560,7 @@ var OAuthConfigService = class extends Effect2.Service()("OAuthConfigService", {
         issuer: decoded.issuer ?? issuerBase,
         authorizeUrl: decoded.authorization_endpoint,
         tokenUrl: decoded.token_endpoint,
+        deviceAuthorizeUrl: decoded.device_authorization_endpoint,
         scope: DEFAULT_SCOPE,
         userinfoUrl: decoded.userinfo_endpoint
       };
@@ -510,14 +574,9 @@ var OAuthConfigService = class extends Effect2.Service()("OAuthConfigService", {
 };
 
 // src/services/auth.ts
-var escapeHtml = (value) => value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;").replace(/\//g, "&#x2F;");
-var base64URLEncode = (buffer) => buffer.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
-var generatePKCE = () => {
-  const codeVerifier = base64URLEncode(crypto.randomBytes(64));
-  const challengeBytes = crypto.createHash("sha256").update(codeVerifier, "utf8").digest();
-  const codeChallenge = base64URLEncode(challengeBytes);
-  return { codeVerifier, codeChallenge };
-};
+var DEVICE_CODE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
+var DEFAULT_POLL_INTERVAL_SECONDS = 5;
+var REQUEST_TIMEOUT_SECONDS = 30;
 var AuthService = class extends Effect3.Service()("AuthService", {
   accessors: true,
   dependencies: [OAuthConfigService.Default, AuthStorageService.Default],
@@ -532,115 +591,178 @@ var AuthService = class extends Effect3.Service()("AuthService", {
       yield* storage.remove;
       yield* Effect3.log("Logged out");
     });
-    const exchangeCodeForTokens = (config, authCode, redirectUri, codeVerifier) => Effect3.gen(function* () {
+    const requestDeviceAuthorization = (config) => Effect3.gen(function* () {
       const response = yield* Effect3.tryPromise({
-        try: () => fetch(config.tokenUrl, {
+        try: (signal) => fetch(config.deviceAuthorizeUrl, {
           method: "POST",
           headers: { "Content-Type": "application/x-www-form-urlencoded" },
-          body: new URLSearchParams({
-            grant_type: "authorization_code",
-            client_id: config.clientId,
-            code: authCode,
-            redirect_uri: redirectUri,
-            code_verifier: codeVerifier
-          }).toString()
+          body: new URLSearchParams({ client_id: config.clientId, scope: config.scope }).toString(),
+          signal
         }),
-        catch: (error) => new TokenExchangeError({
-          message: `Token exchange request failed: ${error instanceof Error ? error.message : String(error)}`
+        catch: (error) => new DeviceAuthorizationError({
+          message: `Device authorization request failed: ${error instanceof Error ? error.message : String(error)}`
         })
       });
       if (!response.ok) {
         const body = yield* Effect3.tryPromise({
           try: () => response.text(),
-          catch: () => new TokenExchangeError({ message: "Failed to read token exchange error response" })
+          catch: () => new DeviceAuthorizationError({ message: "Failed to read device authorization error response" })
         });
         return yield* Effect3.fail(
-          new TokenExchangeError({
-            message: `Token exchange failed: ${response.status} ${response.statusText} - ${body}`,
-            statusCode: response.status
+          new DeviceAuthorizationError({
+            message: `Device authorization failed: ${response.status} ${response.statusText} - ${body}`
           })
         );
       }
-      const tokens = yield* Effect3.tryPromise({
+      const json = yield* Effect3.tryPromise({
+        try: () => response.json(),
+        catch: () => new DeviceAuthorizationError({ message: "Failed to parse device authorization response" })
+      });
+      return yield* Schema5.decodeUnknown(DeviceAuthorizationResponse)(json).pipe(
+        Effect3.mapError(
+          () => new DeviceAuthorizationError({ message: "Invalid device authorization response schema" })
+        )
+      );
+    }).pipe(
+      Effect3.timeoutFail({
+        duration: Duration.seconds(REQUEST_TIMEOUT_SECONDS),
+        onTimeout: () => new DeviceAuthorizationError({ message: "Device authorization request timed out" })
+      })
+    );
+    const pollTokenOnce = (config, deviceCode) => Effect3.gen(function* () {
+      const response = yield* Effect3.tryPromise({
+        try: (signal) => fetch(config.tokenUrl, {
+          method: "POST",
+          headers: { "Content-Type": "application/x-www-form-urlencoded" },
+          body: new URLSearchParams({
+            grant_type: DEVICE_CODE_GRANT_TYPE,
+            client_id: config.clientId,
+            device_code: deviceCode
+          }).toString(),
+          signal
+        }),
+        catch: (error) => new TokenExchangeError({
+          message: `Token poll request failed: ${error instanceof Error ? error.message : String(error)}`
+        })
+      });
+      if (response.ok) {
+        const tokens = yield* Effect3.tryPromise({
+          try: () => response.json(),
+          catch: () => new TokenExchangeError({ message: "Failed to parse token response" })
+        });
+        return { kind: "tokens", tokens };
+      }
+      const errorBody = yield* Effect3.tryPromise({
         try: () => response.json(),
-        catch: () => new TokenExchangeError({ message: "Failed to parse token exchange response" })
+        catch: () => new TokenExchangeError({ message: "Failed to parse token poll error response" })
       });
-      return tokens;
+      switch (errorBody.error) {
+        case "authorization_pending":
+          return { kind: "pending" };
+        case "slow_down":
+          return { kind: "slow_down" };
+        case "access_denied":
+          return { kind: "denied" };
+        case "expired_token":
+          return { kind: "expired" };
+        default:
+          return yield* Effect3.fail(
+            new TokenExchangeError({
+              message: `Token poll failed: ${response.status} ${response.statusText} - ${errorBody.error ?? "unknown_error"}`,
+              statusCode: response.status
+            })
+          );
+      }
     });
-    const startCallbackServer = (config, codeChallenge, state) => Effect3.async((resume) => {
-      const server = http.createServer();
-      const redirectPath = "/callback";
-      server.listen(0, "127.0.0.1", () => {
-        const address = server.address();
-        if (!address || typeof address !== "object") {
-          server.close(() => {
-            resume(Effect3.fail(new LoginFlowError({ message: "Failed to determine callback server address" })));
-          });
-          return;
+    const pollForToken = (config, device) => Effect3.gen(function* () {
+      const deadline = Date.now() + device.expires_in * 1e3;
+      let interval = device.interval ?? DEFAULT_POLL_INTERVAL_SECONDS;
+      while (true) {
+        yield* Effect3.sleep(Duration.seconds(interval));
+        if (Date.now() >= deadline) {
+          return yield* Effect3.fail(
+            new DeviceCodeExpiredError({
+              message: "The login code expired before it was approved. Please run `gigadrive login` again."
+            })
+          );
         }
-        const port = address.port;
-        const redirectUri = `http://127.0.0.1:${port}${redirectPath}`;
-        const authUrl = new URL(config.authorizeUrl);
-        authUrl.searchParams.append("client_id", config.clientId);
-        authUrl.searchParams.append("redirect_uri", redirectUri);
-        authUrl.searchParams.append("response_type", "code");
-        authUrl.searchParams.append("scope", config.scope);
-        authUrl.searchParams.append("code_challenge", codeChallenge);
-        authUrl.searchParams.append("code_challenge_method", "S256");
-        authUrl.searchParams.append("state", state);
-        Console.log(`Please open this URL in your browser to log in:
-${authUrl.toString()}
-`).pipe(Effect3.runSync);
-        Console.log("Waiting for login callback...").pipe(Effect3.runSync);
-        void open(authUrl.toString());
-        server.on("request", (req, res) => {
-          const reqUrl = new URL(req.url || "", redirectUri);
-          if (reqUrl.pathname !== "/callback") {
-            res.writeHead(404).end("Not Found");
-            return;
-          }
-          const authCode = reqUrl.searchParams.get("code");
-          const receivedState = reqUrl.searchParams.get("state");
-          const oauthError = reqUrl.searchParams.get("error");
-          res.writeHead(200, { "Content-Type": "text/html", Connection: "close" });
-          if (oauthError) {
-            const safeOauthError = escapeHtml(oauthError);
-            res.end(`<h1>Login Failed!</h1><p>Error: ${safeOauthError}</p><p>You can close this tab.</p>`);
-            server.close();
-            resume(Effect3.fail(new LoginFlowError({ message: `OAuth error: ${oauthError}` })));
-            return;
-          }
-          if (receivedState !== state) {
-            res.end(
-              "<h1>Login Failed!</h1><p>State mismatch. Possible CSRF attack.</p><p>You can close this tab.</p>"
+        const result = yield* pollTokenOnce(config, device.device_code).pipe(
+          // A hung poll must not stall the loop: on timeout treat it as pending so
+          // the next iteration re-checks the expiry deadline.
+          Effect3.timeoutTo({
+            duration: Duration.seconds(REQUEST_TIMEOUT_SECONDS),
+            onSuccess: (value) => value,
+            onTimeout: () => ({ kind: "pending" })
+          })
+        );
+        switch (result.kind) {
+          case "tokens":
+            return result.tokens;
+          case "pending":
+            continue;
+          case "slow_down":
+            interval += 5;
+            continue;
+          case "denied":
+            return yield* Effect3.fail(new AuthorizationDeniedError({ message: "The login request was denied." }));
+          case "expired":
+            return yield* Effect3.fail(
+              new DeviceCodeExpiredError({
+                message: "The login code expired before it was approved. Please run `gigadrive login` again."
+              })
             );
-            server.close();
-            resume(Effect3.fail(new LoginFlowError({ message: "State mismatch" })));
-            return;
-          }
-          if (authCode) {
-            res.end("<h1>Login Successful!</h1><p>You can close this tab.</p>");
-            server.close();
-            resume(Effect3.succeed({ authCode, redirectUri }));
-          } else {
-            res.end("<h1>Login Failed!</h1><p>No authorization code received.</p><p>You can close this tab.</p>");
-            server.close();
-            resume(Effect3.fail(new LoginFlowError({ message: "No authorization code received" })));
-          }
-        });
-        server.on("error", (err) => {
-          server.close();
-          resume(Effect3.fail(new LoginFlowError({ message: `Local server error: ${err.message}` })));
-        });
+        }
+      }
+    });
+    const watchCopyKey = (url) => Effect3.async((resume) => {
+      const stdin = process3.stdin;
+      if (!stdin.isTTY) {
+        return;
+      }
+      stdin.setRawMode(true);
+      stdin.resume();
+      stdin.setEncoding("utf8");
+      const onData = (key) => {
+        if (key === "c" || key === "C") {
+          writeClipboard(url);
+          Console.log("Copied the login URL to your clipboard.").pipe(Effect3.runSync);
+        } else if (key === "") {
+          resume(Effect3.fail(new LoginFlowError({ message: "Login canceled." })));
+        }
+      };
+      stdin.on("data", onData);
+      return Effect3.sync(() => {
+        stdin.off("data", onData);
+        if (stdin.isTTY) stdin.setRawMode(false);
+        stdin.pause();
       });
     });
     const login = Effect3.gen(function* () {
       yield* logout;
-      const { codeVerifier, codeChallenge } = generatePKCE();
-      const state = crypto.randomBytes(16).toString("hex");
       const config = yield* oauthConfig.getConfig;
-      const { authCode, redirectUri } = yield* startCallbackServer(config, codeChallenge, state);
-      const tokens = yield* exchangeCodeForTokens(config, authCode, redirectUri, codeVerifier);
+      const device = yield* requestDeviceAuthorization(config);
+      const verificationUri = device.verification_uri;
+      const verificationUriComplete = device.verification_uri_complete ?? verificationUri;
+      const interactive = process3.stdin.isTTY === true;
+      yield* Console.log(
+        `
+To sign in, visit:
+
+    ${verificationUri}
+
+and enter the code:
+
+    ${device.user_code}
+`
+      );
+      if (interactive) {
+        yield* Effect3.tryPromise(() => open(verificationUriComplete)).pipe(Effect3.catchAll(() => Effect3.void));
+        yield* Console.log("We tried to open your browser automatically. If it did not open, use the URL above.");
+        yield* Console.log('Press "c" to copy the URL to your clipboard, or Ctrl+C to cancel.');
+      }
+      yield* Console.log("\nWaiting for you to approve the login\u2026");
+      const poll = pollForToken(config, device);
+      const tokens = yield* interactive ? poll.pipe(Effect3.raceFirst(watchCopyKey(verificationUriComplete))) : poll;
       if (!tokens.refresh_token) {
         return yield* Effect3.fail(
           new TokenExchangeError({ message: "No refresh token received from identity provider" })
@@ -835,7 +957,7 @@ var ApiClientService = class extends Effect4.Service()("ApiClientService", {
 
 // src/services/project-link.ts
 import { FileSystem as FileSystem2, Path as Path2 } from "@effect/platform";
-import { Effect as Effect5, Option as Option3, Schema as Schema5 } from "effect";
+import { Effect as Effect5, Option as Option3, Schema as Schema6 } from "effect";
 var LINK_DIR = ".gigadrive";
 var LINK_FILE = "project.json";
 var ProjectLinkService = class extends Effect5.Service()("ProjectLinkService", {
@@ -854,7 +976,7 @@ var ProjectLinkService = class extends Effect5.Service()("ProjectLinkService", {
         try: () => JSON.parse(data),
         catch: () => new ProjectLinkReadError({ message: `${LINK_DIR}/${LINK_FILE} contains invalid JSON` })
       });
-      const link = yield* Schema5.decodeUnknown(ProjectLink)(json).pipe(
+      const link = yield* Schema6.decodeUnknown(ProjectLink)(json).pipe(
         Effect5.mapError(() => new ProjectLinkReadError({ message: `${LINK_DIR}/${LINK_FILE} has an invalid schema` }))
       );
       return Option3.some(link);
@@ -1721,7 +1843,7 @@ import * as os3 from "os";
 
 // src/services/dev-credentials-store.ts
 import { FileSystem as FileSystem7, Path as Path6 } from "@effect/platform";
-import { Effect as Effect15, Option as Option8, Schema as Schema6 } from "effect";
+import { Effect as Effect15, Option as Option8, Schema as Schema7 } from "effect";
 import * as os2 from "os";
 var DevCredentialsStore = class extends Effect15.Service()("DevCredentialsStore", {
   accessors: true,
@@ -1754,7 +1876,7 @@ var DevCredentialsStore = class extends Effect15.Service()("DevCredentialsStore"
         try: () => JSON.parse(data),
         catch: () => new DevCredentialsStoreReadError({ message: "dev-keys.json contains invalid JSON" })
       });
-      return yield* Schema6.decodeUnknown(DevKeyStore)(json).pipe(
+      return yield* Schema7.decodeUnknown(DevKeyStore)(json).pipe(
         Effect15.mapError(() => new DevCredentialsStoreReadError({ message: "dev-keys.json has an invalid schema" }))
       );
     });
@@ -2145,7 +2267,10 @@ var loginCommand = Command9.make(
     yield* Console9.log(`You are now logged in as ${name}.`);
   }).pipe(
     Effect19.catchTags({
-      LoginFlowError: (err) => Console9.error(`Login failed: ${err.message}`),
+      LoginFlowError: (err) => Console9.error(err.message),
+      DeviceAuthorizationError: (err) => Console9.error(`Login failed: ${err.message}`),
+      AuthorizationDeniedError: (err) => Console9.error(err.message),
+      DeviceCodeExpiredError: (err) => Console9.error(err.message),
       TokenExchangeError: (err) => Console9.error(`Login failed: ${err.message}`),
       OAuthDiscoveryError: (err) => Console9.error(`Login failed: ${err.message}`),
       AuthStorageWriteError: (err) => Console9.error(`Failed to save credentials: ${err.message}`)
@@ -2178,7 +2303,7 @@ import { Effect as Effect24 } from "effect";
 import { Command as Command11, Options as Options6 } from "@effect/cli";
 import { FileSystem as FileSystem9, Path as Path8 } from "@effect/platform";
 import { formatFileSize } from "@gigadrive/commons";
-import { Console as Console11, Duration, Effect as Effect23, Option as Option12, Schedule, Stream } from "effect";
+import { Console as Console11, Duration as Duration2, Effect as Effect23, Option as Option12, Schedule, Stream } from "effect";
 import * as os4 from "os";
 
 // src/services/archive.ts
@@ -2578,7 +2703,7 @@ var pollDeployment = (deploymentId) => Effect23.gen(function* () {
         );
       }
     }),
-    Schedule.addDelay(Schedule.forever, () => Duration.seconds(1))
+    Schedule.addDelay(Schedule.forever, () => Duration2.seconds(1))
   ).pipe(
     Effect23.catchAll((err) => {
       if (err === "done") return Effect23.void;