ignotum 0.0.8 → 0.0.9

package/src/cli/auth-client.ts

@@ -0,0 +1,286 @@
+import { homedir } from "node:os";
+import process from "node:process";
+
+import * as Versioned from "@ignotum/contracts/versioned";
+import { createAuthClient } from "better-auth/client";
+import { deviceAuthorizationClient, organizationClient } from "better-auth/client/plugins";
+import {
+  Config,
+  Context,
+  Effect,
+  FileSystem,
+  Layer,
+  Option,
+  Path,
+  Redacted,
+  Schema,
+  Terminal,
+} from "effect";
+
+const CredentialV1 = Schema.Struct({
+  formatVersion: Schema.Literal(1),
+  authUrl: Schema.URLFromString,
+  token: Schema.String,
+});
+const CredentialThroughV1 = Versioned.initial(CredentialV1);
+const Credential = CredentialThroughV1;
+type Credential = typeof Credential.Type;
+
+const AuthUrl = Schema.URL.check(
+  Schema.makeFilter(
+    (url) =>
+      url.protocol === "https:" ||
+      (url.protocol === "http:" && ["127.0.0.1", "::1", "localhost"].includes(url.hostname)),
+    { message: "The auth URL must use HTTPS unless it targets localhost." },
+  ),
+);
+
+export class AuthCommandError extends Schema.TaggedError<AuthCommandError>()("AuthCommandError", {
+  cause: Schema.optional(Schema.Defect()),
+  message: Schema.String,
+}) {}
+
+const commandError = (message: string, cause?: unknown) =>
+  AuthCommandError.make(cause === undefined ? { message } : { cause, message });
+
+interface StoredCredential {
+  readonly authUrl: URL;
+  readonly token: Redacted.Redacted<string>;
+}
+
+interface AuthCredentialStoreService {
+  readonly load: Effect.Effect<StoredCredential | undefined, AuthCommandError>;
+  readonly remove: Effect.Effect<boolean, AuthCommandError>;
+  readonly save: (credential: StoredCredential) => Effect.Effect<void, AuthCommandError>;
+}
+
+export class AuthCredentialStore extends Context.Service<
+  AuthCredentialStore,
+  AuthCredentialStoreService
+>()("ignotum/cli/auth-client/AuthCredentialStore") {
+  static readonly layer = Layer.effect(
+    AuthCredentialStore,
+    Effect.gen(function* () {
+      const fileSystem = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const configured = yield* Config.option(Config.string("IGNOTUM_CONFIG_DIR"));
+      const xdg = yield* Config.option(Config.string("XDG_CONFIG_HOME"));
+      const appData = yield* Config.option(Config.string("APPDATA"));
+      const configurationDirectory = Option.getOrElse(configured, () =>
+        Option.getOrElse(xdg, () =>
+          process.platform === "win32" && Option.isSome(appData)
+            ? appData.value
+            : path.join(homedir(), ".config"),
+        ),
+      );
+      const directory = path.join(configurationDirectory, "ignotum");
+      const credentialPath = path.join(directory, "auth.json");
+
+      const load = Effect.fn("AuthCredentialStore.load")(function* () {
+        if (
+          !(yield* fileSystem
+            .exists(credentialPath)
+            .pipe(
+              Effect.mapError((cause) => commandError("Could not check the saved login.", cause)),
+            ))
+        ) {
+          return undefined;
+        }
+        const text = yield* fileSystem
+          .readFileString(credentialPath)
+          .pipe(Effect.mapError((cause) => commandError("Could not read the saved login.", cause)));
+        const credential = yield* Schema.decodeEffect(Schema.fromJsonString(Credential))(text).pipe(
+          Effect.mapError((cause) => commandError("The saved login is invalid.", cause)),
+        );
+        return {
+          authUrl: credential.authUrl,
+          token: Redacted.make(credential.token),
+        } satisfies StoredCredential;
+      });
+
+      const save = Effect.fn("AuthCredentialStore.save")(function* (credential: StoredCredential) {
+        const value = {
+          formatVersion: 1,
+          authUrl: credential.authUrl,
+          token: Redacted.value(credential.token),
+        } satisfies Credential;
+        const encoded = yield* Schema.encodeEffect(Schema.fromJsonString(Credential))(value).pipe(
+          Effect.mapError((cause) => commandError("Could not encode the login.", cause)),
+        );
+        yield* fileSystem
+          .makeDirectory(directory, { mode: 0o700, recursive: true })
+          .pipe(
+            Effect.mapError((cause) =>
+              commandError("Could not create the config directory.", cause),
+            ),
+          );
+        yield* Effect.scoped(
+          Effect.gen(function* () {
+            const temporaryPath = yield* fileSystem.makeTempFileScoped({
+              directory,
+              prefix: ".auth-",
+              suffix: ".json",
+            });
+            yield* fileSystem.writeFileString(temporaryPath, `${encoded}\n`, { mode: 0o600 });
+            yield* fileSystem.rename(temporaryPath, credentialPath);
+          }),
+        ).pipe(Effect.mapError((cause) => commandError("Could not save the login.", cause)));
+      });
+
+      const remove = Effect.fn("AuthCredentialStore.remove")(function* () {
+        if (
+          !(yield* fileSystem
+            .exists(credentialPath)
+            .pipe(
+              Effect.mapError((cause) => commandError("Could not check the saved login.", cause)),
+            ))
+        ) {
+          return false;
+        }
+        yield* fileSystem
+          .remove(credentialPath)
+          .pipe(
+            Effect.mapError((cause) => commandError("Could not remove the saved login.", cause)),
+          );
+        return true;
+      });
+
+      return AuthCredentialStore.of({ load: load(), remove: remove(), save });
+    }),
+  );
+}
+
+const makeClient = (authUrl: URL) =>
+  createAuthClient({
+    basePath: "/v1",
+    baseURL: authUrl.href,
+    plugins: [deviceAuthorizationClient(), organizationClient()],
+  });
+
+const authorization = (token: Redacted.Redacted<string>) => ({
+  Authorization: `Bearer ${Redacted.value(token)}`,
+});
+
+const responseError = (error: { readonly error_description?: string; readonly message?: string }) =>
+  error.error_description ?? error.message ?? "Authentication failed.";
+
+export const login = Effect.fn("Auth.login")(function* () {
+  const store = yield* AuthCredentialStore;
+  const terminal = yield* Terminal.Terminal;
+  const authUrl = yield* Config.schema(AuthUrl, "IGNOTUM_AUTH_URL").pipe(
+    Config.withDefault(new URL("https://auth.ignotum.cloud")),
+    Effect.mapError((cause) => commandError("The auth URL is invalid.", cause)),
+  );
+  const client = makeClient(authUrl);
+  const existing = yield* store.load;
+  if (existing !== undefined && existing.authUrl.href === authUrl.href) {
+    const result = yield* Effect.tryPromise({
+      try: () => client.getSession({ fetchOptions: { headers: authorization(existing.token) } }),
+      catch: (cause) => commandError("Could not check the saved login.", cause),
+    });
+    if (result.data?.user !== undefined) {
+      return {
+        email: result.data.user.email,
+        verificationUrl: undefined,
+      };
+    }
+  }
+
+  const started = yield* Effect.tryPromise({
+    try: () => client.device.code({ client_id: "ignotum-cli", scope: "openid profile email" }),
+    catch: (cause) => commandError("Could not start login.", cause),
+  });
+  if (started.data === null) {
+    return yield* commandError(responseError(started.error));
+  }
+  const url = started.data.verification_uri_complete ?? started.data.verification_uri;
+  yield* terminal.display(
+    `Open ${started.data.verification_uri}\nCode: ${started.data.user_code}\n\nWaiting for approval...\n`,
+  );
+  yield* Effect.tryPromise({
+    // @effect-diagnostics-next-line asyncFunction:off Dynamic import keeps browser-only code out of other CLI commands.
+    try: async () => (await import("open")).default(url),
+    catch: (cause) => commandError("Could not open the browser.", cause),
+  }).pipe(Effect.ignore);
+
+  let interval = started.data.interval ?? 5;
+  while (true) {
+    yield* Effect.sleep(`${interval} seconds`);
+    const polled = yield* Effect.tryPromise({
+      try: () =>
+        client.device.token({
+          client_id: "ignotum-cli",
+          device_code: started.data.device_code,
+          grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+        }),
+      catch: (cause) => commandError("Login polling failed.", cause),
+    });
+    if (polled.data?.access_token !== undefined) {
+      const token = Redacted.make(polled.data.access_token);
+      const session = yield* Effect.tryPromise({
+        try: () => client.getSession({ fetchOptions: { headers: authorization(token) } }),
+        catch: (cause) => commandError("Could not read the new session.", cause),
+      });
+      if (session.data?.user === undefined) {
+        return yield* commandError("The auth service returned an invalid session.");
+      }
+      yield* store.save({ authUrl, token });
+      return { email: session.data.user.email, verificationUrl: url };
+    }
+    switch (polled.error?.error) {
+      case "authorization_pending":
+        break;
+      case "slow_down":
+        interval += 5;
+        break;
+      case "access_denied":
+        return yield* commandError("Login was denied.");
+      case "expired_token":
+        return yield* commandError("The login code expired. Run login again.");
+      default:
+        return yield* commandError(
+          polled.error === null ? "Login failed." : responseError(polled.error),
+        );
+    }
+  }
+});
+
+export const logout = Effect.fn("Auth.logout")(function* () {
+  const store = yield* AuthCredentialStore;
+  const credential = yield* store.load;
+  if (credential === undefined) return false;
+  const client = makeClient(credential.authUrl);
+  const result = yield* Effect.tryPromise({
+    try: () => client.signOut({ fetchOptions: { headers: authorization(credential.token) } }),
+    catch: (cause) => commandError("Could not revoke the session.", cause),
+  });
+  if (result.error !== null) {
+    return yield* commandError(responseError(result.error));
+  }
+  yield* store.remove;
+  return true;
+});
+
+export const status = Effect.fn("Auth.status")(function* () {
+  const store = yield* AuthCredentialStore;
+  const credential = yield* store.load;
+  if (credential === undefined) return undefined;
+  const client = makeClient(credential.authUrl);
+  const session = yield* Effect.tryPromise({
+    try: () => client.getSession({ fetchOptions: { headers: authorization(credential.token) } }),
+    catch: (cause) => commandError("Could not check login status.", cause),
+  });
+  if (session.data?.user === undefined) return undefined;
+  const teams = yield* Effect.tryPromise({
+    try: () =>
+      client.organization.list({
+        fetchOptions: { headers: authorization(credential.token) },
+      }),
+    catch: (cause) => commandError("Could not load the team.", cause),
+  });
+  return {
+    email: session.data.user.email,
+    name: session.data.user.name,
+    teamName: teams.data?.[0]?.name,
+  };
+});

package/src/cli/command.ts

@@ -6,6 +6,12 @@ import { IdGenerator } from "@ignotum/shared/id";
 
 import packageJson from "../../package.json" with { type: "json" };
 import { generate } from "./codegen.js";
+import {
+  AuthCredentialStore,
+  login as runLogin,
+  logout as runLogout,
+  status as readAuthStatus,
+} from "./auth-client.js";
 import { ControlClient } from "./control-client.js";
 import { deploy as runDeploy } from "./deploy.js";
 import { resetDevDatabase } from "../dev-runtime/dev-database.js";
@@ -15,6 +21,58 @@ import { installDependencies } from "./package-manager.js";
 
 const DevPort = Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: 65_535 }));
 
+const authLogin = Command.make(
+  "login",
+  {},
+  Effect.fn("auth login")(function* () {
+    const terminal = yield* Terminal.Terminal;
+    const result = yield* runLogin().pipe(
+      Effect.mapError((error) =>
+        CliError.UserError.make({ cause: error, userMessage: error.message }),
+      ),
+    );
+    yield* terminal.display(`Signed in as ${result.email}.\n`);
+  }),
+).pipe(Command.withDescription("Sign in to Ignotum with GitHub."));
+
+const authLogout = Command.make(
+  "logout",
+  {},
+  Effect.fn("auth logout")(function* () {
+    const terminal = yield* Terminal.Terminal;
+    const removed = yield* runLogout().pipe(
+      Effect.mapError((error) =>
+        CliError.UserError.make({ cause: error, userMessage: error.message }),
+      ),
+    );
+    yield* terminal.display(removed ? "Signed out.\n" : "Not signed in.\n");
+  }),
+).pipe(Command.withDescription("Revoke and remove the saved login."));
+
+const authStatus = Command.make(
+  "status",
+  {},
+  Effect.fn("auth status")(function* () {
+    const terminal = yield* Terminal.Terminal;
+    const current = yield* readAuthStatus().pipe(
+      Effect.mapError((error) =>
+        CliError.UserError.make({ cause: error, userMessage: error.message }),
+      ),
+    );
+    if (current === undefined) {
+      yield* terminal.display("Not signed in.\n");
+      return;
+    }
+    const team = current.teamName === undefined ? "" : `\nTeam: ${current.teamName}`;
+    yield* terminal.display(`Signed in as ${current.name} (${current.email}).${team}\n`);
+  }),
+).pipe(Command.withDescription("Show the current Ignotum login."));
+
+const auth = Command.make("auth").pipe(
+  Command.withDescription("Manage your Ignotum login."),
+  Command.withSubcommands([authLogin, authLogout, authStatus]),
+);
+
 const codegen = Command.make(
   "codegen",
   {},
@@ -172,7 +230,7 @@ const newApp = Command.make(
 );
 
 const ignotum = Command.make("ignotum").pipe(
-  Command.withSubcommands([newApp, install, codegen, dev, deploy]),
+  Command.withSubcommands([newApp, install, codegen, dev, deploy, auth]),
 );
 
 export const main = (): void => {
@@ -180,7 +238,12 @@ export const main = (): void => {
     Command.run({ version: packageJson.version }),
     // @effect-diagnostics-next-line strictEffectProvide:off
     Effect.provide(
-      Layer.mergeAll(NodeServices.layer, NodeHttpClient.layerUndici, IdGenerator.layer),
+      Layer.mergeAll(
+        NodeServices.layer,
+        NodeHttpClient.layerUndici,
+        IdGenerator.layer,
+        AuthCredentialStore.layer.pipe(Layer.provide(NodeServices.layer)),
+      ),
     ),
     NodeRuntime.runMain,
   );

package/src/cli/control-client.ts

@@ -41,6 +41,7 @@ import {
 } from "effect";
 import { HttpClient, HttpClientRequest, HttpClientResponse } from "effect/unstable/http";
 import type { HttpClientRequest as HttpRequest } from "effect/unstable/http/HttpClientRequest";
+import { AuthCommandError, AuthCredentialStore } from "./auth-client.js";
 
 export interface HostedControlConfig {
   readonly apiUrl: URL;
@@ -69,11 +70,19 @@ export class HostedControlConfiguration extends Context.Service<
 >()("ignotum/cli/control-client/HostedControlConfiguration") {
   static readonly layer = Layer.effect(
     HostedControlConfiguration,
-    Config.all({
-      apiUrl: Config.schema(HostedApiUrl, "IGNOTUM_API_URL").pipe(
-        Config.withDefault(new URL("https://api.ignotum.cloud")),
-      ),
-      token: Config.redacted("IGNOTUM_API_TOKEN"),
+    Effect.gen(function* () {
+      const credential = yield* (yield* AuthCredentialStore).load;
+      if (credential === undefined) {
+        return yield* AuthCommandError.make({
+          message: "Run 'npx ignotum auth login' first.",
+        });
+      }
+      return {
+        apiUrl: yield* Config.schema(HostedApiUrl, "IGNOTUM_API_URL").pipe(
+          Config.withDefault(new URL("https://api.ignotum.cloud")),
+        ),
+        token: credential.token,
+      };
     }),
   );
 }
@@ -133,7 +142,11 @@ export class ControlClient extends Context.Service<ControlClient, ControlClientS
   "ignotum/cli/control-client/ControlClient",
 ) {
   static get layer() {
-    return controlClientLayer.pipe(Layer.provideMerge(HostedControlConfiguration.layer));
+    return controlClientLayer.pipe(
+      Layer.provideMerge(
+        HostedControlConfiguration.layer.pipe(Layer.provide(AuthCredentialStore.layer)),
+      ),
+    );
   }
 }
 

package/src/cli/new-app.ts

@@ -209,9 +209,10 @@ and updates them when the schema or server functions change.
 
 ## Deploy
 
-Set \`IGNOTUM_API_TOKEN\`, then choose a unique slug on the first deployment:
+Sign in, then choose a unique slug on the first deployment:
 
 \`\`\`sh
+npx ignotum auth login
 npx ignotum deploy --app my-app
 \`\`\`
 

package/src/client/errors.ts

@@ -1,7 +1,7 @@
 /** @effect-diagnostics globalConsole:skip-file */
 import { Cause, Effect, ErrorReporter, Schema } from "effect";
 
-import { FunctionAddress, Operation, ProtocolErrorCode } from "@ignotum/contracts/runtime/sync";
+import { ErrorCode, FunctionAddress, Operation } from "@ignotum/contracts/runtime/sync";
 
 export class ConnectionUnavailable extends Schema.TaggedError<ConnectionUnavailable>()(
   "ConnectionUnavailable",
@@ -36,21 +36,18 @@ export class InvalidServerMessage extends Schema.TaggedError<InvalidServerMessag
   },
 ) {}
 
-export class ServerProtocolError extends Schema.TaggedError<ServerProtocolError>()(
-  "ServerProtocolError",
-  {
-    code: ProtocolErrorCode,
-    message: Schema.String,
-    operation: Schema.optional(Operation),
-  },
-) {}
+export class ServerError extends Schema.TaggedError<ServerError>()("ServerError", {
+  code: ErrorCode,
+  message: Schema.String,
+  operation: Schema.optional(Operation),
+}) {}
 
 export const ClientInfrastructureError = Schema.Union([
   ConnectionUnavailable,
   InvalidClientMessage,
   InvalidMutationArguments,
   InvalidServerMessage,
-  ServerProtocolError,
+  ServerError,
 ]);
 export type ClientInfrastructureError = typeof ClientInfrastructureError.Type;
 

package/src/client/files.ts

@@ -10,7 +10,6 @@ import {
   makeFileValue,
   type FileFormat,
   type FileValue,
-  type RuntimeFileOccurrence,
 } from "@ignotum/contracts/schema/file";
 import { IdGenerator } from "@ignotum/shared/id";
 import { Effect, Predicate } from "effect";
@@ -28,30 +27,22 @@ export const Files = {
 const formatByMime: Partial<Record<string, FileFormat>> = {};
 for (const format of fileFormats) formatByMime[fileMimeTypes[format]] = format;
 
-interface NativeOccurrence {
-  readonly path: ReadonlyArray<string | number>;
-  readonly value: File;
-}
-
 const collectNativeFiles = (
   // oxlint-disable-next-line anti-slop/no-unknown-parameters -- This is the recursive parser for generated mutation arguments and native File values.
   value: unknown,
-  path: ReadonlyArray<string | number>,
-  occurrences: Array<NativeOccurrence>,
+  files: Array<File>,
 ): void => {
   if (value instanceof File) {
-    occurrences.push({ path, value });
+    files.push(value);
     return;
   }
   if (isFileValue(value) || Predicate.isDate(value)) return;
   if (globalThis.Array.isArray(value)) {
-    for (const [index, child] of value.entries())
-      collectNativeFiles(child, [...path, index], occurrences);
+    for (const child of value) collectNativeFiles(child, files);
     return;
   }
   if (!Predicate.isObject(value)) return;
-  for (const [key, child] of Object.entries(value))
-    collectNativeFiles(child, [...path, key], occurrences);
+  for (const child of Object.values(value)) collectNativeFiles(child, files);
 };
 
 const replaceNativeFiles = (
@@ -73,7 +64,7 @@ const replaceNativeFiles = (
 export interface PreparedMutationArguments {
   readonly value: unknown;
   readonly nativeFiles: ReadonlyMap<FileId, File>;
-  readonly occurrences: ReadonlyArray<RuntimeFileOccurrence>;
+  readonly fileIds: ReadonlyArray<FileId>;
 }
 
 export const prepareMutationArguments = Effect.fn("SyncClient.prepareMutationArguments")(function* (
@@ -81,9 +72,9 @@ export const prepareMutationArguments = Effect.fn("SyncClient.prepareMutationArg
   input: unknown,
 ) {
   const ids = yield* IdGenerator;
-  const native: NativeOccurrence[] = [];
-  collectNativeFiles(input, [], native);
-  const unique = new Set(native.map(({ value }) => value));
+  const native: File[] = [];
+  collectNativeFiles(input, native);
+  const unique = new Set(native);
   if (unique.size > fileLimits.filesPerMutation) {
     throw new Error(`A mutation may upload at most ${fileLimits.filesPerMutation} files.`);
   }
@@ -111,58 +102,52 @@ export const prepareMutationArguments = Effect.fn("SyncClient.prepareMutationArg
     nativeFiles.set(id, file);
   }
   const value = replaceNativeFiles(input, replacements);
-  const occurrences = native.map(({ path, value: file }) => {
-    const replacement = replacements.get(file);
-    if (replacement === undefined) throw new Error("A native file replacement is missing.");
-    return {
-      path,
-      file: {
-        id: fileIdOf(replacement),
-        format: replacement.format,
-        name: replacement.name,
-        size: replacement.size,
-      },
-    } satisfies RuntimeFileOccurrence;
-  });
-  return { value, nativeFiles, occurrences } satisfies PreparedMutationArguments;
+  return {
+    value,
+    nativeFiles,
+    fileIds: Array.from(nativeFiles.keys()),
+  } satisfies PreparedMutationArguments;
 });
 
-interface FileGrantOccurrence extends RuntimeFileOccurrence {
+interface FileGrant {
+  readonly id: FileId;
   readonly url: string;
 }
 
-const pathKey = (path: ReadonlyArray<string | number>): string => JSON.stringify(path);
-
 // @effect-diagnostics-next-line missingPipeableSignature:off File grant attachment naturally takes the decoded value first.
 export const applyFileGrants = (
-  // oxlint-disable-next-line anti-slop/no-unknown-parameters -- Query result types are erased at the wire decoding boundary and checked against grant paths below.
+  // oxlint-disable-next-line anti-slop/no-unknown-parameters -- Query result types are erased at the wire decoding boundary and checked against grant identities below.
   value: unknown,
-  grants: ReadonlyArray<FileGrantOccurrence>,
+  grants: ReadonlyArray<FileGrant>,
   // oxlint-disable-next-line anti-slop/no-unknown-returns -- The traversal preserves the decoded query result shape while attaching private symbols.
 ): unknown => {
-  const byPath = new Map(grants.map((grant) => [pathKey(grant.path), grant] as const));
+  const byId = new Map<FileId, string>();
+  for (const grant of grants) {
+    if (byId.has(grant.id)) throw new Error("A query file grant ID is duplicated.");
+    byId.set(grant.id, grant.url);
+  }
+  const matched = new Set<FileId>();
   const visit = (
-    // oxlint-disable-next-line anti-slop/no-unknown-parameters -- This recursive visitor validates a grant and file ID before replacement.
+    // oxlint-disable-next-line anti-slop/no-unknown-parameters -- This recursive visitor identifies file values before attaching grants.
     current: unknown,
-    path: ReadonlyArray<string | number>,
     // oxlint-disable-next-line anti-slop/no-unknown-returns -- Recursive branches preserve their input shape.
   ): unknown => {
-    const grant = byPath.get(pathKey(path));
-    if (grant !== undefined) {
-      if (!isFileValue(current) || fileIdOf(current) !== grant.file.id) {
-        throw new Error("A query file grant does not match its result value.");
-      }
-      return grantFileValue(current, grant.url);
+    if (isFileValue(current)) {
+      const id = fileIdOf(current);
+      const url = byId.get(id);
+      if (url === undefined) return current;
+      matched.add(id);
+      return grantFileValue(current, url);
     }
     if (globalThis.Array.isArray(current)) {
-      return current.map((child, index) => visit(child, [...path, index]));
+      return current.map(visit);
     }
-    if (!Predicate.isObject(current) || Predicate.isDate(current) || isFileValue(current)) {
+    if (!Predicate.isObject(current) || Predicate.isDate(current)) {
       return current;
     }
-    return Object.fromEntries(
-      Object.entries(current).map(([key, child]) => [key, visit(child, [...path, key])]),
-    );
+    return Object.fromEntries(Object.entries(current).map(([key, child]) => [key, visit(child)]));
   };
-  return visit(value, []);
+  const granted = visit(value);
+  if (matched.size !== byId.size) throw new Error("A query file grant has no result value.");
+  return granted;
 };