gigadrive 2.3.0 → 2.4.1

package/dist/index.cjs

@@ -32,7 +32,7 @@ var import_effect29 = require("effect");
 // package.json
 var package_default = {
   name: "gigadrive",
-  version: "2.3.0",
+  version: "2.4.1",
   repository: {
     type: "git",
     url: "https://github.com/Gigadrive/sdk.git",
@@ -58,7 +58,7 @@ var package_default = {
   dependencies: {
     "@effect/cli": "^0.75.0",
     "@effect/platform": "^0.96.0",
-    "@effect/platform-node": "^0.106.0",
+    "@effect/platform-node": "^0.107.0",
     "@gigadrive/build-utils": "workspace:*",
     "@gigadrive/commons": "workspace:*",
     "@gigadrive/network-config": "workspace:*",
@@ -69,8 +69,8 @@ var package_default = {
     open: "^10.2.0"
   },
   devDependencies: {
-    "@effect/language-service": "^0.84.0",
-    "@types/archiver": "^6.0.3",
+    "@effect/language-service": "^0.86.0",
+    "@types/archiver": "^6.0.4",
     esbuild: "^0.28.0",
     typescript: "catalog:"
   },
@@ -113,6 +113,25 @@ var TokenExchangeError = class extends import_effect.Schema.TaggedError()("Token
   statusCode: import_effect.Schema.optional(import_effect.Schema.Number)
 }) {
 };
+var DeviceAuthorizationError = class extends import_effect.Schema.TaggedError()(
+  "DeviceAuthorizationError",
+  {
+    message: import_effect.Schema.String,
+    cause: import_effect.Schema.optional(import_effect.Schema.String)
+  }
+) {
+};
+var AuthorizationDeniedError = class extends import_effect.Schema.TaggedError()(
+  "AuthorizationDeniedError",
+  {
+    message: import_effect.Schema.String
+  }
+) {
+};
+var DeviceCodeExpiredError = class extends import_effect.Schema.TaggedError()("DeviceCodeExpiredError", {
+  message: import_effect.Schema.String
+}) {
+};
 var TokenRefreshError = class extends import_effect.Schema.TaggedError()("TokenRefreshError", {
   message: import_effect.Schema.String,
   statusCode: import_effect.Schema.optional(import_effect.Schema.Number)
@@ -310,15 +329,9 @@ var import_effect6 = require("effect");
 
 // src/services/auth.ts
 var import_effect5 = require("effect");
-var crypto = __toESM(require("crypto"), 1);
-var http = __toESM(require("http"), 1);
+var import_node_process2 = __toESM(require("process"), 1);
 var import_open = __toESM(require("open"), 1);
 
-// src/services/auth-storage.ts
-var import_platform = require("@effect/platform");
-var import_effect3 = require("effect");
-var os = __toESM(require("os"), 1);
-
 // src/domain.ts
 var import_effect2 = require("effect");
 var DeploymentId = import_effect2.Schema.String.pipe(import_effect2.Schema.brand("@Gigadrive/DeploymentId"));
@@ -336,9 +349,18 @@ var OAuthClientConfig = import_effect2.Schema.Struct({
   issuer: import_effect2.Schema.String,
   authorizeUrl: import_effect2.Schema.String,
   tokenUrl: import_effect2.Schema.String,
+  deviceAuthorizeUrl: import_effect2.Schema.String,
   scope: import_effect2.Schema.String,
   userinfoUrl: import_effect2.Schema.String
 });
+var DeviceAuthorizationResponse = import_effect2.Schema.Struct({
+  device_code: import_effect2.Schema.String,
+  user_code: import_effect2.Schema.String,
+  verification_uri: import_effect2.Schema.String,
+  verification_uri_complete: import_effect2.Schema.optional(import_effect2.Schema.String),
+  expires_in: import_effect2.Schema.Number,
+  interval: import_effect2.Schema.optional(import_effect2.Schema.Number)
+});
 var StoredAuthData = import_effect2.Schema.Struct({
   refreshToken: import_effect2.Schema.String,
   accessToken: import_effect2.Schema.optional(import_effect2.Schema.String),
@@ -353,7 +375,47 @@ var DevKeyEntry = import_effect2.Schema.Struct({
 });
 var DevKeyStore = import_effect2.Schema.Record({ key: import_effect2.Schema.String, value: DevKeyEntry });
 
+// src/lib/clipboard.ts
+var import_node_child_process = require("child_process");
+var import_node_process = __toESM(require("process"), 1);
+var clipboardCandidates = () => {
+  switch (import_node_process.default.platform) {
+    case "darwin":
+      return [{ cmd: "pbcopy", args: [] }];
+    case "win32":
+      return [{ cmd: "clip", args: [] }];
+    default:
+      return [
+        { cmd: "wl-copy", args: [] },
+        { cmd: "xclip", args: ["-selection", "clipboard"] },
+        { cmd: "xsel", args: ["--clipboard", "--input"] }
+      ];
+  }
+};
+function writeClipboard(text) {
+  const candidates = clipboardCandidates();
+  const tryNext = (index) => {
+    if (index >= candidates.length) return;
+    const { cmd, args } = candidates[index];
+    let proc;
+    try {
+      proc = (0, import_node_child_process.spawn)(cmd, args, { stdio: ["pipe", "ignore", "ignore"] });
+    } catch {
+      tryNext(index + 1);
+      return;
+    }
+    proc.on("error", () => tryNext(index + 1));
+    proc.stdin?.on("error", () => {
+    });
+    proc.stdin?.end(text);
+  };
+  tryNext(0);
+}
+
 // src/services/auth-storage.ts
+var import_platform = require("@effect/platform");
+var import_effect3 = require("effect");
+var os = __toESM(require("os"), 1);
 var AuthStorageService = class extends import_effect3.Effect.Service()("AuthStorageService", {
   accessors: true,
   effect: import_effect3.Effect.gen(function* () {
@@ -442,7 +504,8 @@ var OpenIdDiscoveryDocument = import_effect4.Schema.Struct({
   issuer: import_effect4.Schema.optional(import_effect4.Schema.String),
   authorization_endpoint: import_effect4.Schema.optional(import_effect4.Schema.String),
   token_endpoint: import_effect4.Schema.optional(import_effect4.Schema.String),
-  userinfo_endpoint: import_effect4.Schema.optional(import_effect4.Schema.String)
+  userinfo_endpoint: import_effect4.Schema.optional(import_effect4.Schema.String),
+  device_authorization_endpoint: import_effect4.Schema.optional(import_effect4.Schema.String)
 });
 var CLI_SCOPES = [
   // Identity / OIDC
@@ -508,7 +571,7 @@ var OAuthConfigService = class extends import_effect4.Effect.Service()("OAuthCon
           })
         )
       );
-      if (!decoded.authorization_endpoint || !decoded.token_endpoint || !decoded.userinfo_endpoint) {
+      if (!decoded.authorization_endpoint || !decoded.token_endpoint || !decoded.userinfo_endpoint || !decoded.device_authorization_endpoint) {
         return yield* import_effect4.Effect.fail(
           new OAuthDiscoveryError({
             message: "OIDC discovery returned incomplete endpoints"
@@ -520,6 +583,7 @@ var OAuthConfigService = class extends import_effect4.Effect.Service()("OAuthCon
         issuer: decoded.issuer ?? issuerBase,
         authorizeUrl: decoded.authorization_endpoint,
         tokenUrl: decoded.token_endpoint,
+        deviceAuthorizeUrl: decoded.device_authorization_endpoint,
         scope: DEFAULT_SCOPE,
         userinfoUrl: decoded.userinfo_endpoint
       };
@@ -533,14 +597,9 @@ var OAuthConfigService = class extends import_effect4.Effect.Service()("OAuthCon
 };
 
 // src/services/auth.ts
-var escapeHtml = (value) => value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;").replace(/\//g, "&#x2F;");
-var base64URLEncode = (buffer) => buffer.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
-var generatePKCE = () => {
-  const codeVerifier = base64URLEncode(crypto.randomBytes(64));
-  const challengeBytes = crypto.createHash("sha256").update(codeVerifier, "utf8").digest();
-  const codeChallenge = base64URLEncode(challengeBytes);
-  return { codeVerifier, codeChallenge };
-};
+var DEVICE_CODE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
+var DEFAULT_POLL_INTERVAL_SECONDS = 5;
+var REQUEST_TIMEOUT_SECONDS = 30;
 var AuthService = class extends import_effect5.Effect.Service()("AuthService", {
   accessors: true,
   dependencies: [OAuthConfigService.Default, AuthStorageService.Default],
@@ -555,115 +614,178 @@ var AuthService = class extends import_effect5.Effect.Service()("AuthService", {
       yield* storage.remove;
       yield* import_effect5.Effect.log("Logged out");
     });
-    const exchangeCodeForTokens = (config, authCode, redirectUri, codeVerifier) => import_effect5.Effect.gen(function* () {
+    const requestDeviceAuthorization = (config) => import_effect5.Effect.gen(function* () {
       const response = yield* import_effect5.Effect.tryPromise({
-        try: () => fetch(config.tokenUrl, {
+        try: (signal) => fetch(config.deviceAuthorizeUrl, {
           method: "POST",
           headers: { "Content-Type": "application/x-www-form-urlencoded" },
-          body: new URLSearchParams({
-            grant_type: "authorization_code",
-            client_id: config.clientId,
-            code: authCode,
-            redirect_uri: redirectUri,
-            code_verifier: codeVerifier
-          }).toString()
+          body: new URLSearchParams({ client_id: config.clientId, scope: config.scope }).toString(),
+          signal
         }),
-        catch: (error) => new TokenExchangeError({
-          message: `Token exchange request failed: ${error instanceof Error ? error.message : String(error)}`
+        catch: (error) => new DeviceAuthorizationError({
+          message: `Device authorization request failed: ${error instanceof Error ? error.message : String(error)}`
         })
       });
       if (!response.ok) {
         const body = yield* import_effect5.Effect.tryPromise({
           try: () => response.text(),
-          catch: () => new TokenExchangeError({ message: "Failed to read token exchange error response" })
+          catch: () => new DeviceAuthorizationError({ message: "Failed to read device authorization error response" })
         });
         return yield* import_effect5.Effect.fail(
-          new TokenExchangeError({
-            message: `Token exchange failed: ${response.status} ${response.statusText} - ${body}`,
-            statusCode: response.status
+          new DeviceAuthorizationError({
+            message: `Device authorization failed: ${response.status} ${response.statusText} - ${body}`
           })
         );
       }
-      const tokens = yield* import_effect5.Effect.tryPromise({
+      const json = yield* import_effect5.Effect.tryPromise({
+        try: () => response.json(),
+        catch: () => new DeviceAuthorizationError({ message: "Failed to parse device authorization response" })
+      });
+      return yield* import_effect5.Schema.decodeUnknown(DeviceAuthorizationResponse)(json).pipe(
+        import_effect5.Effect.mapError(
+          () => new DeviceAuthorizationError({ message: "Invalid device authorization response schema" })
+        )
+      );
+    }).pipe(
+      import_effect5.Effect.timeoutFail({
+        duration: import_effect5.Duration.seconds(REQUEST_TIMEOUT_SECONDS),
+        onTimeout: () => new DeviceAuthorizationError({ message: "Device authorization request timed out" })
+      })
+    );
+    const pollTokenOnce = (config, deviceCode) => import_effect5.Effect.gen(function* () {
+      const response = yield* import_effect5.Effect.tryPromise({
+        try: (signal) => fetch(config.tokenUrl, {
+          method: "POST",
+          headers: { "Content-Type": "application/x-www-form-urlencoded" },
+          body: new URLSearchParams({
+            grant_type: DEVICE_CODE_GRANT_TYPE,
+            client_id: config.clientId,
+            device_code: deviceCode
+          }).toString(),
+          signal
+        }),
+        catch: (error) => new TokenExchangeError({
+          message: `Token poll request failed: ${error instanceof Error ? error.message : String(error)}`
+        })
+      });
+      if (response.ok) {
+        const tokens = yield* import_effect5.Effect.tryPromise({
+          try: () => response.json(),
+          catch: () => new TokenExchangeError({ message: "Failed to parse token response" })
+        });
+        return { kind: "tokens", tokens };
+      }
+      const errorBody = yield* import_effect5.Effect.tryPromise({
         try: () => response.json(),
-        catch: () => new TokenExchangeError({ message: "Failed to parse token exchange response" })
+        catch: () => new TokenExchangeError({ message: "Failed to parse token poll error response" })
       });
-      return tokens;
+      switch (errorBody.error) {
+        case "authorization_pending":
+          return { kind: "pending" };
+        case "slow_down":
+          return { kind: "slow_down" };
+        case "access_denied":
+          return { kind: "denied" };
+        case "expired_token":
+          return { kind: "expired" };
+        default:
+          return yield* import_effect5.Effect.fail(
+            new TokenExchangeError({
+              message: `Token poll failed: ${response.status} ${response.statusText} - ${errorBody.error ?? "unknown_error"}`,
+              statusCode: response.status
+            })
+          );
+      }
     });
-    const startCallbackServer = (config, codeChallenge, state) => import_effect5.Effect.async((resume) => {
-      const server = http.createServer();
-      const redirectPath = "/callback";
-      server.listen(0, "127.0.0.1", () => {
-        const address = server.address();
-        if (!address || typeof address !== "object") {
-          server.close(() => {
-            resume(import_effect5.Effect.fail(new LoginFlowError({ message: "Failed to determine callback server address" })));
-          });
-          return;
+    const pollForToken = (config, device) => import_effect5.Effect.gen(function* () {
+      const deadline = Date.now() + device.expires_in * 1e3;
+      let interval = device.interval ?? DEFAULT_POLL_INTERVAL_SECONDS;
+      while (true) {
+        yield* import_effect5.Effect.sleep(import_effect5.Duration.seconds(interval));
+        if (Date.now() >= deadline) {
+          return yield* import_effect5.Effect.fail(
+            new DeviceCodeExpiredError({
+              message: "The login code expired before it was approved. Please run `gigadrive login` again."
+            })
+          );
         }
-        const port = address.port;
-        const redirectUri = `http://127.0.0.1:${port}${redirectPath}`;
-        const authUrl = new URL(config.authorizeUrl);
-        authUrl.searchParams.append("client_id", config.clientId);
-        authUrl.searchParams.append("redirect_uri", redirectUri);
-        authUrl.searchParams.append("response_type", "code");
-        authUrl.searchParams.append("scope", config.scope);
-        authUrl.searchParams.append("code_challenge", codeChallenge);
-        authUrl.searchParams.append("code_challenge_method", "S256");
-        authUrl.searchParams.append("state", state);
-        import_effect5.Console.log(`Please open this URL in your browser to log in:
-${authUrl.toString()}
-`).pipe(import_effect5.Effect.runSync);
-        import_effect5.Console.log("Waiting for login callback...").pipe(import_effect5.Effect.runSync);
-        void (0, import_open.default)(authUrl.toString());
-        server.on("request", (req, res) => {
-          const reqUrl = new URL(req.url || "", redirectUri);
-          if (reqUrl.pathname !== "/callback") {
-            res.writeHead(404).end("Not Found");
-            return;
-          }
-          const authCode = reqUrl.searchParams.get("code");
-          const receivedState = reqUrl.searchParams.get("state");
-          const oauthError = reqUrl.searchParams.get("error");
-          res.writeHead(200, { "Content-Type": "text/html", Connection: "close" });
-          if (oauthError) {
-            const safeOauthError = escapeHtml(oauthError);
-            res.end(`<h1>Login Failed!</h1><p>Error: ${safeOauthError}</p><p>You can close this tab.</p>`);
-            server.close();
-            resume(import_effect5.Effect.fail(new LoginFlowError({ message: `OAuth error: ${oauthError}` })));
-            return;
-          }
-          if (receivedState !== state) {
-            res.end(
-              "<h1>Login Failed!</h1><p>State mismatch. Possible CSRF attack.</p><p>You can close this tab.</p>"
+        const result = yield* pollTokenOnce(config, device.device_code).pipe(
+          // A hung poll must not stall the loop: on timeout treat it as pending so
+          // the next iteration re-checks the expiry deadline.
+          import_effect5.Effect.timeoutTo({
+            duration: import_effect5.Duration.seconds(REQUEST_TIMEOUT_SECONDS),
+            onSuccess: (value) => value,
+            onTimeout: () => ({ kind: "pending" })
+          })
+        );
+        switch (result.kind) {
+          case "tokens":
+            return result.tokens;
+          case "pending":
+            continue;
+          case "slow_down":
+            interval += 5;
+            continue;
+          case "denied":
+            return yield* import_effect5.Effect.fail(new AuthorizationDeniedError({ message: "The login request was denied." }));
+          case "expired":
+            return yield* import_effect5.Effect.fail(
+              new DeviceCodeExpiredError({
+                message: "The login code expired before it was approved. Please run `gigadrive login` again."
+              })
             );
-            server.close();
-            resume(import_effect5.Effect.fail(new LoginFlowError({ message: "State mismatch" })));
-            return;
-          }
-          if (authCode) {
-            res.end("<h1>Login Successful!</h1><p>You can close this tab.</p>");
-            server.close();
-            resume(import_effect5.Effect.succeed({ authCode, redirectUri }));
-          } else {
-            res.end("<h1>Login Failed!</h1><p>No authorization code received.</p><p>You can close this tab.</p>");
-            server.close();
-            resume(import_effect5.Effect.fail(new LoginFlowError({ message: "No authorization code received" })));
-          }
-        });
-        server.on("error", (err) => {
-          server.close();
-          resume(import_effect5.Effect.fail(new LoginFlowError({ message: `Local server error: ${err.message}` })));
-        });
+        }
+      }
+    });
+    const watchCopyKey = (url) => import_effect5.Effect.async((resume) => {
+      const stdin = import_node_process2.default.stdin;
+      if (!stdin.isTTY) {
+        return;
+      }
+      stdin.setRawMode(true);
+      stdin.resume();
+      stdin.setEncoding("utf8");
+      const onData = (key) => {
+        if (key === "c" || key === "C") {
+          writeClipboard(url);
+          import_effect5.Console.log("Copied the login URL to your clipboard.").pipe(import_effect5.Effect.runSync);
+        } else if (key === "") {
+          resume(import_effect5.Effect.fail(new LoginFlowError({ message: "Login canceled." })));
+        }
+      };
+      stdin.on("data", onData);
+      return import_effect5.Effect.sync(() => {
+        stdin.off("data", onData);
+        if (stdin.isTTY) stdin.setRawMode(false);
+        stdin.pause();
       });
     });
     const login = import_effect5.Effect.gen(function* () {
       yield* logout;
-      const { codeVerifier, codeChallenge } = generatePKCE();
-      const state = crypto.randomBytes(16).toString("hex");
       const config = yield* oauthConfig.getConfig;
-      const { authCode, redirectUri } = yield* startCallbackServer(config, codeChallenge, state);
-      const tokens = yield* exchangeCodeForTokens(config, authCode, redirectUri, codeVerifier);
+      const device = yield* requestDeviceAuthorization(config);
+      const verificationUri = device.verification_uri;
+      const verificationUriComplete = device.verification_uri_complete ?? verificationUri;
+      const interactive = import_node_process2.default.stdin.isTTY === true;
+      yield* import_effect5.Console.log(
+        `
+To sign in, visit:
+
+    ${verificationUri}
+
+and enter the code:
+
+    ${device.user_code}
+`
+      );
+      if (interactive) {
+        yield* import_effect5.Effect.tryPromise(() => (0, import_open.default)(verificationUriComplete)).pipe(import_effect5.Effect.catchAll(() => import_effect5.Effect.void));
+        yield* import_effect5.Console.log("We tried to open your browser automatically. If it did not open, use the URL above.");
+        yield* import_effect5.Console.log('Press "c" to copy the URL to your clipboard, or Ctrl+C to cancel.');
+      }
+      yield* import_effect5.Console.log("\nWaiting for you to approve the login\u2026");
+      const poll = pollForToken(config, device);
+      const tokens = yield* interactive ? poll.pipe(import_effect5.Effect.raceFirst(watchCopyKey(verificationUriComplete))) : poll;
       if (!tokens.refresh_token) {
         return yield* import_effect5.Effect.fail(
           new TokenExchangeError({ message: "No refresh token received from identity provider" })
@@ -2160,7 +2282,10 @@ var loginCommand = import_cli9.Command.make(
     yield* import_effect21.Console.log(`You are now logged in as ${name}.`);
   }).pipe(
     import_effect21.Effect.catchTags({
-      LoginFlowError: (err) => import_effect21.Console.error(`Login failed: ${err.message}`),
+      LoginFlowError: (err) => import_effect21.Console.error(err.message),
+      DeviceAuthorizationError: (err) => import_effect21.Console.error(`Login failed: ${err.message}`),
+      AuthorizationDeniedError: (err) => import_effect21.Console.error(err.message),
+      DeviceCodeExpiredError: (err) => import_effect21.Console.error(err.message),
       TokenExchangeError: (err) => import_effect21.Console.error(`Login failed: ${err.message}`),
       OAuthDiscoveryError: (err) => import_effect21.Console.error(`Login failed: ${err.message}`),
       AuthStorageWriteError: (err) => import_effect21.Console.error(`Failed to save credentials: ${err.message}`)