insta 0.0.25 → 0.0.26

package/dist/commands/auth.js

@@ -1,6 +1,6 @@
 import { createServer } from 'node:http';
 import { randomBytes } from 'node:crypto';
-import { ApiClient, linkedProject } from '../api.js';
+import { ApiClient, ApiError, linkedProject } from '../api.js';
 import { ENVS, ENV_NAMES, envForApiUrl, isEnvName } from '../env.js';
 import { info, die, printJson, promptPassword, openUrl } from '../util.js';
 /** --api-url and --env both set the target host; --api-url wins (more specific), matching the
@@ -17,6 +17,8 @@ function targetApiUrl(opts) {
     return ENVS[want].api;
 }
 export async function login(opts) {
+    if (opts.device)
+        return loginDevice(opts);
     if (opts.oauth)
         return loginOauth(opts.oauth, opts);
     const api = await ApiClient.load();
@@ -24,7 +26,7 @@ export async function login(opts) {
     if (target)
         api.setApiUrl(target);
     if (!opts.email)
-        die('--email is required (or use --oauth <github|google>)');
+        die('--email is required (or use --oauth <github|google>; on a headless machine, --device)');
     const password = opts.password ?? process.env.INSTA_PASSWORD ?? (await promptPassword());
     const res = await api.request('POST', '/auth/login', { email: opts.email, password }, { auth: false });
     api.setSession(res, res.user);
@@ -47,6 +49,80 @@ export async function loginOauth(provider, opts) {
     await api.persist();
     info(`logged in as ${me.user.email ?? me.user.id} @ ${api.apiUrl}`);
 }
+// RFC 8628 device authorization — login from a machine with no usable browser (VM, SSH box, CI
+// container). The loopback --oauth flow can never work there: its callback targets 127.0.0.1 on
+// THIS machine. Here the roles invert — we mint a code, print a link the human opens on ANY
+// device, and poll the platform until they approve in the console.
+export async function loginDevice(opts) {
+    const api = await ApiClient.load();
+    const target = targetApiUrl(opts);
+    if (target)
+        api.setApiUrl(target);
+    const token = await deviceGrant((path, body) => api.request('POST', path, body, { auth: false }));
+    api.setSession({ accessToken: token, refreshToken: token });
+    const me = await api.request('GET', '/me');
+    api.setSession({ accessToken: token, refreshToken: token }, me.user);
+    await api.persist();
+    info(`logged in as ${me.user.email ?? me.user.id} @ ${api.apiUrl}`);
+}
+const sleepSeconds = (s) => new Promise((r) => setTimeout(r, s * 1000));
+// Drives the device grant against the platform's Better Auth mount (/api/auth/device*) and
+// returns the approved session token. Injectable poster + wait keep this testable without a
+// network or real timers. Poll errors arrive as ApiError with the OAuth error code as message.
+export async function deviceGrant(post, wait = sleepSeconds) {
+    const start = (await post('/api/auth/device/code', { client_id: 'insta-cli' }));
+    // A missing/garbage expires_in must fail loudly here — carried into the deadline arithmetic it
+    // becomes NaN, every `Date.now() < deadline` is false, and login dies as a bogus instant expiry.
+    // Cap the lifetime too: a huge-but-finite value (Number.MAX_VALUE) overflows the ms conversion
+    // to Infinity and would otherwise pin the CLI polling forever.
+    const expiresIn = Number(start.expires_in);
+    if (!Number.isFinite(expiresIn) || expiresIn <= 0) {
+        throw new Error('malformed device authorization response (missing expires_in) — is the platform up to date?');
+    }
+    const lifetime = Math.min(expiresIn, 3600); // no device code sensibly outlives an hour
+    info('to log in, open this link in a browser on any device:');
+    info(`  ${start.verification_uri_complete ?? start.verification_uri}`);
+    info(`and check it shows this code: ${start.user_code}`);
+    info(`waiting for approval… (expires in ${Math.round(lifetime / 60)}m, ctrl-c to abort)`);
+    // Absent OR non-finite interval = the RFC 8628 §3.2 default 5s: NaN would fire the timer
+    // instantly and Infinity gets truncated to ~1ms by Node — both hot-poll the token endpoint.
+    const rawInterval = Number(start.interval);
+    let interval = Number.isFinite(rawInterval) ? Math.max(rawInterval, 1) : 5;
+    const deadline = Date.now() + lifetime * 1000;
+    while (Date.now() < deadline) {
+        await wait(interval);
+        let grant = null;
+        try {
+            grant = (await post('/api/auth/device/token', {
+                grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
+                device_code: start.device_code,
+                client_id: 'insta-cli',
+            }));
+        }
+        catch (e) {
+            if (!(e instanceof ApiError))
+                continue; // transport blip (dropped SSH/CI link) — keep polling until deadline
+            const code = e.message;
+            if (code === 'authorization_pending')
+                continue;
+            if (code === 'slow_down') {
+                interval += 5;
+                continue;
+            } // RFC 8628 §3.5: back off by 5s
+            if (code === 'expired_token')
+                break;
+            if (code === 'access_denied')
+                throw new Error('login request was denied in the console');
+            throw e; // a definite API-level error (invalid_grant, …) — not retryable
+        }
+        // Validated OUTSIDE the try: a 200 without a token is a malformed response that must fail
+        // loudly, not be mistaken for a transport blip and retried into an empty stored session.
+        if (!grant?.access_token)
+            throw new Error('malformed token response (missing access_token)');
+        return grant.access_token;
+    }
+    throw new Error('device login expired before it was approved — run `insta login --device` again');
+}
 // Start a loopback server, open the browser at the platform bridge, and await the token.
 function browserOauth(apiUrl, provider) {
     return new Promise((resolve, reject) => {

package/dist/index.js

@@ -54,10 +54,11 @@ function resolveVersion() {
 }
 program.name('insta').description('InstaCloud CLI — manage projects, branches, secrets, deploys').version(resolveVersion());
 // ---- auth ----
-program.command('login').description('Log in with email + password, or --oauth <github|google> (browser)')
+program.command('login').description('Log in with email + password, --oauth <github|google> (browser), or --device (headless)')
     .option('--email <email>', 'account email')
     .option('--password <password>', 'account password (else $INSTA_PASSWORD or prompt)')
     .option('--oauth <provider>', 'browser OAuth login: github | google')
+    .option('--device', 'device-code login: approve from a browser on any other machine (VMs, SSH, CI)')
     .option('--api-url <url>', 'control-plane API base URL')
     .option('--env <name>', `deployment environment: ${ENV_NAMES.join(' | ')}`)
     .action(guard((o) => auth.login(o)));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "insta",
-  "version": "0.0.25",
+  "version": "0.0.26",
   "type": "module",
   "description": "InstaCloud CLI — a thin client of the platform control-plane API.",
   "keywords": [