hngr 0.1.1 → 0.3.0

package/README.md

@@ -13,14 +13,19 @@ hngr --version
 ## Authenticate
 
 ```sh
-# Interactive: username and password, then an access token is written to
+# Interactive: username and password against http://10.199.100.24:26434 (the
+# built-in default), then an access token is written to
 # ~/.config/hngr/config.json (0600).
+hngr auth login
+
+# A different deployment. The built-in default is plain http on a private
+# network; any other host needs https:// (or an explicit --insecure).
 hngr auth login --server https://hangar.example.com
 
 # CI or containers: read an existing access token from stdin.
 printf '%s' "$HANGAR_TOKEN_VALUE" | hngr auth login --token --server https://hangar.example.com
 
-# Or skip the config file entirely.
+# Or skip the config file entirely. HANGAR_URL overrides the built-in default.
 export HANGAR_URL=https://hangar.example.com
 export HANGAR_TOKEN=hng_...
 hngr auth status

package/dist/{auth-Bf4n5qaq.mjs → auth-CgBUQUQn.mjs}

@@ -1,6 +1,7 @@
-import { _ as writeStoredConfig, d as deleteStoredConfig, f as normalizeServerUrl, h as resolveConnection, m as redactUrl, n as apiGet, p as readStoredConfig, t as apiFetch, u as configFilePath, x as HngrError } from "./http-DpXNrkSL.mjs";
+import { S as HngrError, d as configFilePath, f as deleteStoredConfig, g as resolveConnection, h as redactUrl, m as readStoredConfig, n as apiGet, p as normalizeServerUrl, t as apiFetch, v as writeStoredConfig } from "./http-2HWxLIOq.mjs";
 import { hostname } from "node:os";
 import { randomUUID } from "node:crypto";
+import { spawn } from "node:child_process";
 // src/commands/auth.ts
 const AUTH_REMEDIATION = "Run `hngr auth login` or set HANGAR_TOKEN.";
 /** The first 8 characters after the `hng_` prefix, for recognising a token. Not a credential. */
@@ -38,8 +39,8 @@ function canPrompt(ctx) {
 	return ctx.io.stdin.isTTY && ctx.io.stdout.isTTY && ctx.io.prompts !== void 0;
 }
 /**
-* Enforces https everywhere; http only for localhost, 127.0.0.1 and [::1],
-* or with an explicit --insecure.
+* Enforces https everywhere; http only for localhost, 127.0.0.1, [::1], the
+* built-in default, or with an explicit --insecure.
 */
 function assertServerUrlAllowed(raw, insecure) {
 	const server = normalizeServerUrl(raw);
@@ -50,7 +51,7 @@ function assertServerUrlAllowed(raw, insecure) {
 			"localhost",
 			"127.0.0.1",
 			"[::1]"
-		].includes(url.hostname) || insecure) return server;
+		].includes(url.hostname) || insecure || server === "http://10.199.100.24:26434") return server;
 		throw new HngrError({
 			type: "config",
 			title: `Refusing insecure server URL ${redactUrl(server)}`,
@@ -92,14 +93,7 @@ async function revokePreviousToken(ctx, stored) {
 async function login(ctx, argv) {
 	if (ctx.env.HANGAR_TOKEN) throw envTokenRefusal();
 	const stored = await readStoredConfig(ctx.env);
-	let rawServer = ctx.flags.server ?? ctx.env.HANGAR_URL ?? stored?.server;
-	if (!rawServer && canPrompt(ctx)) rawServer = await ctx.io.prompts?.text("Server URL");
-	if (!rawServer) throw new HngrError({
-		type: "config",
-		title: "No Hangar server configured",
-		detail: "Pass --server <url>, set HANGAR_URL, or run `hngr auth login` interactively to store one."
-	});
-	const server = assertServerUrlAllowed(rawServer, ctx.flags.insecure);
+	const server = assertServerUrlAllowed(ctx.flags.server ?? ctx.env.HANGAR_URL ?? stored?.server ?? "http://10.199.100.24:26434", ctx.flags.insecure);
 	if (stored?.token && !ctx.flags.force) try {
 		const me = asStoredPrincipal(await apiGet({
 			server,
@@ -110,37 +104,42 @@ async function login(ctx, argv) {
 	} catch (err) {
 		if (err instanceof HngrError && err.body.type === "api") throw err;
 	}
-	if (argv.token === true) {
-		const pasted = (await ctx.io.stdin.readAll()).trim();
-		if (!pasted) throw new HngrError({
-			type: "usage",
-			title: "No token on stdin",
-			detail: "Pipe an access token into `hngr auth login --token`."
-		});
-		const principal = asStoredPrincipal(await apiGet({
-			server,
-			token: pasted
-		}, "/api/v1/me"));
-		if (ctx.flags.force && stored) await revokePreviousToken(ctx, stored);
-		const prefix = tokenPrefixOf(pasted);
-		const matched = await lookupTokenMetadata(server, pasted, prefix);
-		const path = await writeStoredConfig(ctx.env, {
-			server,
-			token: pasted,
-			...matched ? {
-				token_id: matched.id,
-				token_name: matched.name
-			} : {},
-			token_prefix: prefix,
-			principal,
-			created_at: (/* @__PURE__ */ new Date()).toISOString()
-		});
-		summarizeLogin(ctx, principal.username, matched?.name, prefix, path);
-		return 0;
-	}
+	if (argv.token === true) return loginWithToken(ctx, server, stored);
+	if (argv.password === true) return loginWithPassword(ctx, server, stored);
+	return loginDevice(ctx, server, stored);
+}
+async function loginWithToken(ctx, server, stored) {
+	const pasted = (await ctx.io.stdin.readAll()).trim();
+	if (!pasted) throw new HngrError({
+		type: "usage",
+		title: "No token on stdin",
+		detail: "Pipe an access token into `hngr auth login --token`."
+	});
+	const principal = asStoredPrincipal(await apiGet({
+		server,
+		token: pasted
+	}, "/api/v1/me"));
+	if (ctx.flags.force && stored) await revokePreviousToken(ctx, stored);
+	const prefix = tokenPrefixOf(pasted);
+	const matched = await lookupTokenMetadata(server, pasted, prefix);
+	const path = await writeStoredConfig(ctx.env, {
+		server,
+		token: pasted,
+		...matched ? {
+			token_id: matched.id,
+			token_name: matched.name
+		} : {},
+		token_prefix: prefix,
+		principal,
+		created_at: (/* @__PURE__ */ new Date()).toISOString()
+	});
+	summarizeLogin(ctx, principal.username, matched?.name, prefix, path);
+	return 0;
+}
+async function loginWithPassword(ctx, server, stored) {
 	if (!canPrompt(ctx)) throw new HngrError({
 		type: "auth",
-		title: "Logging in needs a terminal",
+		title: "Logging in with a password needs a terminal",
 		detail: "Set HANGAR_TOKEN, or pass --token and pipe an access token on stdin, in non-interactive use."
 	}, 4);
 	const prompter = ctx.io.prompts;
@@ -182,6 +181,143 @@ async function login(ctx, argv) {
 	summarizeLogin(ctx, principal.username, minted.name, minted.token_prefix, path);
 	return 0;
 }
+const DEVICE_CODE_PATH = "/api/v1/auth/device/code";
+const DEVICE_TOKEN_PATH = "/api/v1/auth/device/token";
+/** Suggested when the device flow cannot finish; the password flow still works. */
+const PASSWORD_REMEDIATION = "Run `hngr auth login --password` to sign in with a username and password instead.";
+/** Validates the create response; a bad shape is an api error, not a crash. */
+function asDeviceCode(body) {
+	const value = body;
+	if (value === null || typeof value !== "object" || typeof value.device_code !== "string" || typeof value.user_code !== "string" || typeof value.verification_uri !== "string" || typeof value.verification_uri_complete !== "string" || typeof value.expires_in !== "number" || typeof value.interval !== "number" || value.interval <= 0) throw new HngrError({
+		type: "api",
+		title: "The server returned an unexpected device authorization payload",
+		detail: "Expected {device_code, user_code, verification_uri, verification_uri_complete, expires_in, interval} from POST /api/v1/auth/device/code."
+	});
+	return value;
+}
+/** Validates the poll success response; the token is stored only when complete. */
+function asDeviceToken(body) {
+	const value = body;
+	if (value === null || typeof value !== "object" || typeof value.token !== "string" || typeof value.token_id !== "string" || typeof value.token_prefix !== "string" || typeof value.name !== "string") throw new HngrError({
+		type: "api",
+		title: "The server returned an unexpected device token payload",
+		detail: "Expected {token, token_id, token_prefix, name, principal} from POST /api/v1/auth/device/token."
+	});
+	return value;
+}
+function deviceDeniedError() {
+	return new HngrError({
+		type: "auth",
+		title: "The login request was denied",
+		detail: PASSWORD_REMEDIATION
+	});
+}
+function deviceExpiredError() {
+	return new HngrError({
+		type: "auth",
+		title: "The login request expired",
+		detail: PASSWORD_REMEDIATION
+	});
+}
+function defaultSleep(ms) {
+	return new Promise((resolve) => setTimeout(resolve, ms));
+}
+/** Starts the platform opener without waiting for it; failures are silent. */
+function openInBrowser(url) {
+	const [command, args] = process.platform === "win32" ? ["rundll32", ["url.dll,FileProtocolHandler", url]] : process.platform === "darwin" ? ["open", [url]] : ["xdg-open", [url]];
+	try {
+		const child = spawn(command, args, {
+			detached: true,
+			stdio: "ignore"
+		});
+		child.on("error", () => {});
+		child.unref();
+	} catch {}
+}
+/** The device name shown to the approver. */
+function deviceName() {
+	return hostname().slice(0, 128);
+}
+/**
+* Polls until the request leaves the pending state. `slow_down` extends the
+* interval permanently by five seconds; network failures are retried until the
+* advertised lifetime runs out. Sleeps and the clock are injectable for tests.
+*/
+async function pollDeviceToken(ctx, server, deviceCode, expiresIn, interval) {
+	const now = ctx.io.now ?? Date.now;
+	const sleep = ctx.io.sleep ?? defaultSleep;
+	const deadline = now() + expiresIn * 1e3;
+	let waitSeconds = interval;
+	for (;;) {
+		if (now() >= deadline) throw deviceExpiredError();
+		try {
+			return asDeviceToken(await (await apiFetch({ server }, {
+				method: "POST",
+				path: DEVICE_TOKEN_PATH,
+				body: { device_code: deviceCode }
+			})).json());
+		} catch (err) {
+			if (!(err instanceof HngrError)) throw err;
+			const problem = String(err.body.type);
+			if (problem.endsWith("/authorization-pending")) {
+				await sleep(waitSeconds * 1e3);
+				continue;
+			}
+			if (problem.endsWith("/slow-down")) {
+				waitSeconds += 5;
+				await sleep(waitSeconds * 1e3);
+				continue;
+			}
+			if (problem.endsWith("/access-denied")) throw deviceDeniedError();
+			if (problem.endsWith("/expired-token")) throw deviceExpiredError();
+			if (err.body.type === "network") {
+				await sleep(waitSeconds * 1e3);
+				continue;
+			}
+			throw err;
+		}
+	}
+}
+/** The browser-based login: request a code, wait for approval, store the token. */
+async function loginDevice(ctx, server, stored) {
+	const device = asDeviceCode(await (await apiFetch({ server }, {
+		method: "POST",
+		path: DEVICE_CODE_PATH,
+		body: {
+			device_name: deviceName(),
+			token_name: cliTokenName()
+		}
+	})).json());
+	ctx.detail("To approve this login from a browser:");
+	ctx.io.stderr.write(`open ${device.verification_uri}\n`);
+	ctx.io.stderr.write(`enter the user code: ${device.user_code}\n`);
+	if (ctx.io.stderr.isTTY) try {
+		await (ctx.io.openBrowser ?? openInBrowser)(device.verification_uri_complete);
+	} catch {}
+	const minted = await pollDeviceToken(ctx, server, device.device_code, device.expires_in, device.interval);
+	if (ctx.flags.force && stored) await revokePreviousToken(ctx, stored);
+	const principal = asStoredPrincipal(await apiGet({
+		server,
+		token: minted.token
+	}, "/api/v1/me"));
+	let path;
+	try {
+		path = await writeStoredConfig(ctx.env, {
+			server,
+			token: minted.token,
+			token_id: minted.token_id,
+			token_name: minted.name,
+			token_prefix: minted.token_prefix,
+			principal,
+			created_at: (/* @__PURE__ */ new Date()).toISOString()
+		});
+	} catch (err) {
+		if (!await revokeToken(server, minted.token, minted.token_id)) ctx.summary(SERVER_TOKEN_LINGERING_WARNING);
+		throw err;
+	}
+	summarizeLogin(ctx, principal.username, minted.name, minted.token_prefix, path);
+	return 0;
+}
 /** Reads the session cookie off the login response; missing cookie is an api error. */
 function sessionCookieOf(response) {
 	const pair = (response.headers.getSetCookie()[0] ?? response.headers.get("set-cookie"))?.split(";")[0]?.trim();