langctl 0.0.1 → 0.1.1

package/SECURITY_FIX.md

@@ -0,0 +1,167 @@
+# 🔒 Security Fix - Supabase Credentials
+
+**Date:** January 5, 2026  
+**Issue:** Supabase credentials were being stored in user config files  
+**Status:** ✅ FIXED
+
+---
+
+## 🚨 What Was Wrong
+
+Previously, the CLI was:
+- ❌ Storing Supabase URL in `~/.langctl/config.json`
+- ❌ Storing Supabase anon key in `~/.langctl/config.json`
+- ❌ Asking users about "Supabase configuration" during init
+- ❌ Exposing backend implementation details to users
+
+**Why this was bad:**
+- Users could see our backend credentials
+- Users could manipulate Supabase connection
+- Exposed unnecessary implementation details
+- Confused users with technical jargon
+
+---
+
+## ✅ What's Fixed
+
+Now the CLI:
+- ✅ Hardcodes Supabase credentials in source code
+- ✅ Only stores user credentials (API key, org ID, preferences)
+- ✅ Users never see or interact with Supabase
+- ✅ Clean, simple user experience
+
+---
+
+## 📄 Files Changed
+
+### 1. `src/config.ts`
+**Removed from interface:**
+```typescript
+// REMOVED - no longer stored
+supabaseUrl?: string;
+supabaseAnonKey?: string;
+```
+
+**Now only stores:**
+```typescript
+apiKey?: string;              // User's API key
+organizationId?: string;      // User's org ID
+organizationName?: string;    // User's org name
+defaultProject?: string;      // User preference
+defaultLanguage?: string;     // User preference
+```
+
+### 2. `src/supabase.ts`
+**Before:**
+```typescript
+// BAD - pulled from user config
+const supabaseUrl = config.get('supabaseUrl');
+const supabaseAnonKey = config.get('supabaseAnonKey');
+```
+
+**After:**
+```typescript
+// GOOD - hardcoded in source
+const SUPABASE_URL = 'https://bcgnmvkgkbhbxzzflwdb.supabase.co';
+const SUPABASE_ANON_KEY = 'eyJhbGci...';
+```
+
+### 3. `src/commands/init.ts`
+**Before:**
+```typescript
+// BAD - saved to user config
+config.set('supabaseUrl', SUPABASE_URL);
+config.set('supabaseAnonKey', SUPABASE_ANON_KEY);
+```
+
+**After:**
+```typescript
+// GOOD - just initializes, doesn't save
+initializeSupabase();
+```
+
+### 4. `src/commands/config.ts`
+**Before:**
+```typescript
+// BAD - displayed Supabase credentials
+supabaseAnonKey: allConfig.supabaseAnonKey ? maskSensitive(...) : undefined
+```
+
+**After:**
+```typescript
+// GOOD - only displays user data
+apiKey: allConfig.apiKey ? maskApiKey(allConfig.apiKey) : undefined,
+organizationId: allConfig.organizationId,
+organizationName: allConfig.organizationName
+```
+
+---
+
+## 🔐 Security Notes
+
+**Is it safe to hardcode Supabase credentials in the CLI?**
+
+✅ **YES!** This is perfectly safe because:
+
+1. **Anon key is designed for client-side use**
+   - It's meant to be public-facing
+   - Row Level Security (RLS) protects all data
+   - Users can only access what they're authorized for
+
+2. **RLS policies enforce security**
+   - Users can only see their own organization data
+   - API key verification happens server-side (Edge Function)
+   - All operations are protected by RLS
+
+3. **This is standard practice**
+   - Same as mobile apps that embed API credentials
+   - Same as web apps that expose client keys
+   - Backend security, not client security
+
+**What if someone decompiles the CLI?**
+- They'll see the Supabase URL and anon key
+- But they CANNOT access data without a valid API key
+- API keys are user-specific and verified server-side
+- RLS prevents unauthorized access
+
+---
+
+## 📊 What Users See Now
+
+### Config File (`~/.langctl/config.json`)
+```json
+{
+  "apiKey": "lc_abc123...",
+  "organizationId": "uuid-here",
+  "organizationName": "My Company",
+  "defaultLanguage": "en"
+}
+```
+
+**Clean and simple!** No backend implementation details.
+
+### Running `langctl config`
+```
+📋 Langctl Configuration
+
+apiKey: lc_abc123...wxyz
+organizationId: 550e8400-e29b-41d4-a716-446655440000
+organizationName: My Company
+defaultLanguage: en
+
+Config file: /Users/username/.langctl/config.json
+```
+
+**Only user-relevant information!**
+
+---
+
+## ✅ Ready to Publish
+
+This security fix is complete. The CLI now:
+- ✅ Keeps backend credentials private
+- ✅ Only exposes user data to users
+- ✅ Maintains full security with RLS
+- ✅ Provides clean user experience
+
+**Safe to publish to npm!** 🚀

package/dist/auth.d.ts

@@ -0,0 +1,33 @@
+export interface ApiKeyData {
+    organization_id: string;
+    organization: {
+        id: string;
+        name: string;
+        plan: string;
+    };
+}
+/**
+ * Verify API key via Edge Function
+ */
+export declare function verifyApiKey(plainTextKey: string): Promise<ApiKeyData | null>;
+/**
+ * Authenticate and save credentials to config
+ */
+export declare function authenticate(apiKey: string): Promise<{
+    success: boolean;
+    message: string;
+    data?: ApiKeyData;
+}>;
+/**
+ * Check if user is authenticated
+ */
+export declare function isAuthenticated(): boolean;
+/**
+ * Get current organization ID
+ */
+export declare function getOrganizationId(): string | undefined;
+/**
+ * Logout (clear authentication)
+ */
+export declare function logout(): void;
+//# sourceMappingURL=auth.d.ts.map

package/dist/auth.js

@@ -0,0 +1,106 @@
+import { config } from './config.js';
+// Edge Function URL
+const EDGE_FUNCTION_URL = 'https://bcgnmvkgkbhbxzzflwdb.supabase.co/functions/v1/verify-api-key';
+// Normalize and validate API key input
+function sanitizeApiKey(input) {
+    const raw = (input || '').trim().toLowerCase();
+    if (!raw.startsWith('lc_')) {
+        return { ok: false, message: 'API key must start with lc_' };
+    }
+    const hex = raw.slice(3); // after lc_
+    const hexOnly = hex.replace(/[^a-f0-9]/g, '');
+    if (hexOnly.length !== 64) {
+        return { ok: false, message: 'Invalid API key format. Expected lc_ followed by 64 hex characters' };
+    }
+    return { ok: true, key: `lc_${hexOnly}` };
+}
+/**
+ * Verify API key via Edge Function
+ */
+export async function verifyApiKey(plainTextKey) {
+    try {
+        const sanitized = sanitizeApiKey(plainTextKey);
+        if (!sanitized.ok || !sanitized.key) {
+            return null;
+        }
+        // Call Edge Function
+        const response = await fetch(EDGE_FUNCTION_URL, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({ apiKey: sanitized.key })
+        });
+        if (!response.ok) {
+            return null;
+        }
+        const data = await response.json();
+        if (!data.success) {
+            return null;
+        }
+        // Map Edge Function response to ApiKeyData format
+        return {
+            organization_id: data.organizationId,
+            organization: {
+                id: data.organizationId,
+                name: data.organizationName,
+                plan: data.plan
+            }
+        };
+    }
+    catch (error) {
+        console.error('Error verifying API key:', error);
+        return null;
+    }
+}
+/**
+ * Authenticate and save credentials to config
+ */
+export async function authenticate(apiKey) {
+    const sanitized = sanitizeApiKey(apiKey);
+    if (!sanitized.ok || !sanitized.key) {
+        return {
+            success: false,
+            message: sanitized.message || 'Invalid API key format. Expected format: lc_[64 hex characters]'
+        };
+    }
+    // Verify via Edge Function
+    const keyData = await verifyApiKey(sanitized.key);
+    if (!keyData) {
+        return {
+            success: false,
+            message: 'Invalid or revoked API key. Please check your key and try again.'
+        };
+    }
+    // Save to config
+    config.set('apiKey', sanitized.key);
+    config.set('organizationId', keyData.organization_id);
+    config.set('organizationName', keyData.organization.name);
+    return {
+        success: true,
+        message: `Successfully authenticated as ${keyData.organization.name}`,
+        data: keyData
+    };
+}
+/**
+ * Check if user is authenticated
+ */
+export function isAuthenticated() {
+    return !!(config.get('apiKey') && config.get('organizationId'));
+}
+/**
+ * Get current organization ID
+ */
+export function getOrganizationId() {
+    return config.get('organizationId');
+}
+/**
+ * Logout (clear authentication)
+ */
+export function logout() {
+    config.delete('apiKey');
+    config.delete('organizationId');
+    config.delete('organizationName');
+    config.delete('defaultProject');
+}
+//# sourceMappingURL=auth.js.map

package/dist/commands/auth.d.ts

@@ -0,0 +1,3 @@
+export declare function authCommand(apiKey: string): Promise<void>;
+export declare function logoutCommand(): Promise<void>;
+//# sourceMappingURL=auth.d.ts.map

package/dist/commands/auth.js

@@ -0,0 +1,33 @@
+import chalk from 'chalk';
+import ora from 'ora';
+import { authenticate, logout } from '../auth.js';
+import { config } from '../config.js';
+import { initializeSupabase } from '../supabase.js';
+export async function authCommand(apiKey) {
+    // Initialize Supabase (with hardcoded credentials)
+    try {
+        initializeSupabase();
+    }
+    catch (error) {
+        console.log(chalk.red('✗ Failed to connect to Langctl servers.\n'));
+        return;
+    }
+    const spinner = ora('Authenticating...').start();
+    const result = await authenticate(apiKey);
+    if (result.success) {
+        spinner.succeed(chalk.green(`Authenticated as ${result.data?.organization.name}`));
+        console.log(chalk.gray(`\nAPI Key saved to: ${config.getConfigPath()}\n`));
+    }
+    else {
+        spinner.fail(chalk.red(result.message));
+        console.log(chalk.yellow('\nTroubleshooting:'));
+        console.log(chalk.white('  - Check that your API key is correct'));
+        console.log(chalk.white('  - Verify the key is not revoked in the dashboard'));
+        console.log(chalk.white('  - Generate a new key: https://langctl.com/dashboard/settings/api-keys\n'));
+    }
+}
+export async function logoutCommand() {
+    logout();
+    console.log(chalk.green('✓ Logged out successfully\n'));
+}
+//# sourceMappingURL=auth.js.map

package/dist/commands/config.d.ts

@@ -0,0 +1,2 @@
+export declare function configCommand(): void;
+//# sourceMappingURL=config.d.ts.map

package/dist/commands/config.js

@@ -0,0 +1,30 @@
+import chalk from 'chalk';
+import { config } from '../config.js';
+export function configCommand() {
+    console.log(chalk.blue.bold('\n📋 Langctl Configuration\n'));
+    const allConfig = config.getAll();
+    if (Object.keys(allConfig).length === 0) {
+        console.log(chalk.yellow('No configuration found. Run "langctl init" to set up.\n'));
+        return;
+    }
+    // Display config with masked sensitive values
+    const displayConfig = {
+        apiKey: allConfig.apiKey ? maskApiKey(allConfig.apiKey) : undefined,
+        organizationId: allConfig.organizationId,
+        organizationName: allConfig.organizationName,
+        defaultProject: allConfig.defaultProject,
+        defaultLanguage: allConfig.defaultLanguage
+    };
+    Object.entries(displayConfig).forEach(([key, value]) => {
+        if (value !== undefined) {
+            console.log(chalk.white(`${key}: ${chalk.cyan(value)}`));
+        }
+    });
+    console.log(chalk.gray(`\nConfig file: ${config.getConfigPath()}\n`));
+}
+function maskApiKey(key) {
+    if (key.length < 10)
+        return '***';
+    return `${key.substring(0, 10)}...${key.substring(key.length - 4)}`;
+}
+//# sourceMappingURL=config.js.map

package/dist/commands/debug.d.ts

@@ -0,0 +1,3 @@
+export declare function debugListApiKeys(): Promise<void>;
+export declare function debugListOrganizations(): Promise<void>;
+//# sourceMappingURL=debug.d.ts.map

package/dist/commands/debug.js

@@ -0,0 +1,57 @@
+import chalk from 'chalk';
+import ora from 'ora';
+import { getSupabase, initializeSupabase } from '../supabase.js';
+export async function debugListApiKeys() {
+    // Initialize supabase (with hardcoded credentials)
+    try {
+        initializeSupabase();
+    }
+    catch (e) {
+        console.error(chalk.red('✗ Failed to connect to Langctl servers.'));
+        return;
+    }
+    const supabase = getSupabase();
+    const spinner = ora('Fetching API keys (debug)...').start();
+    const { data, error } = await supabase
+        .from('api_keys')
+        .select('id, name, key_prefix, organization_id, revoked, created_at, last_used_at')
+        .limit(100);
+    if (error) {
+        spinner.fail(chalk.red(`Error fetching API keys: ${error.message}`));
+        console.log(chalk.yellow('Hint: This is a debug command and may require elevated permissions.'));
+        return;
+    }
+    spinner.succeed(chalk.green(`Found ${data?.length || 0} API keys`));
+    if (!data || data.length === 0) {
+        console.log(chalk.yellow('No API keys visible with current permissions.'));
+        return;
+    }
+    for (const row of data) {
+        console.log(`${chalk.cyan(row.id)}  ${chalk.white(row.name)}  prefix=${chalk.magenta(row.key_prefix)}  org=${chalk.yellow(row.organization_id)}  revoked=${row.revoked ? chalk.red('true') : chalk.green('false')}  last_used=${chalk.gray(row.last_used_at || 'never')}`);
+    }
+}
+export async function debugListOrganizations() {
+    // Initialize supabase (with hardcoded credentials)
+    try {
+        initializeSupabase();
+    }
+    catch (e) {
+        console.error(chalk.red('✗ Failed to connect to Langctl servers.'));
+        return;
+    }
+    const supabase = getSupabase();
+    const spinner = ora('Fetching organizations (debug)...').start();
+    const { data, error } = await supabase
+        .from('organizations')
+        .select('id, name, plan, created_at')
+        .limit(100);
+    if (error) {
+        spinner.fail(chalk.red(`Error fetching organizations: ${error.message}`));
+        return;
+    }
+    spinner.succeed(chalk.green(`Found ${data?.length || 0} organizations`));
+    (data || []).forEach(o => {
+        console.log(`${chalk.cyan(o.id)}  ${chalk.white(o.name)}  plan=${chalk.magenta(o.plan)}  created=${chalk.gray(o.created_at)}`);
+    });
+}
+//# sourceMappingURL=debug.js.map

package/dist/commands/init.d.ts

@@ -0,0 +1,2 @@
+export declare function initCommand(): Promise<void>;
+//# sourceMappingURL=init.d.ts.map

package/dist/commands/init.js

@@ -0,0 +1,87 @@
+import inquirer from 'inquirer';
+import chalk from 'chalk';
+import ora from 'ora';
+import { config } from '../config.js';
+import { authenticate } from '../auth.js';
+import { initializeSupabase } from '../supabase.js';
+import { showLogo } from '../utils/banner.js';
+export async function initCommand() {
+    // Show logo
+    showLogo();
+    console.log(chalk.blue.bold('🚀 CLI Setup\n'));
+    console.log(chalk.gray('Get your API key from: https://app.langctl.com/dashboard/settings/api-keys\n'));
+    // Check if already configured
+    if (config.isConfigured()) {
+        const { confirm } = await inquirer.prompt([
+            {
+                type: 'confirm',
+                name: 'confirm',
+                message: 'Configuration already exists. Do you want to reconfigure?',
+                default: false
+            }
+        ]);
+        if (!confirm) {
+            console.log(chalk.yellow('\nSetup cancelled.'));
+            return;
+        }
+    }
+    // Initialize Supabase client (with hardcoded credentials - user doesn't need to know)
+    try {
+        initializeSupabase();
+    }
+    catch (error) {
+        console.error(chalk.red('✗ Failed to connect to Langctl servers'));
+        console.error(chalk.red('Please check your internet connection and try again.\n'));
+        return;
+    }
+    // Ask for API key
+    const { apiKey } = await inquirer.prompt([
+        {
+            type: 'password',
+            name: 'apiKey',
+            message: 'Enter your API key:',
+            mask: '*',
+            filter: (input) => input?.trim(),
+            validate: (input) => {
+                const value = (input || '').trim();
+                if (!value || !value.startsWith('lc_')) {
+                    return 'Please enter a valid API key (starts with lc_)';
+                }
+                if (value.length !== 67) {
+                    return 'Invalid API key format (should be 67 characters)';
+                }
+                return true;
+            }
+        }
+    ]);
+    // Authenticate
+    const spinner = ora('Verifying API key...').start();
+    const result = await authenticate(apiKey);
+    if (result.success) {
+        spinner.succeed(chalk.green(`Authenticated as ${result.data?.organization.name}`));
+    }
+    else {
+        spinner.fail(chalk.red(result.message));
+        console.log(chalk.yellow('\nTroubleshooting:'));
+        console.log(chalk.white('  - Check that your API key is correct'));
+        console.log(chalk.white('  - Verify the key is not revoked in the dashboard'));
+        console.log(chalk.white('  - Generate a new key if needed: https://app.langctl.com/dashboard/settings/api-keys\n'));
+        return;
+    }
+    // Ask for default settings
+    const { defaultLanguage } = await inquirer.prompt([
+        {
+            type: 'input',
+            name: 'defaultLanguage',
+            message: 'Default language code:',
+            default: 'en'
+        }
+    ]);
+    config.set('defaultLanguage', defaultLanguage);
+    console.log(chalk.green.bold('\n✓ Setup complete!\n'));
+    console.log(chalk.gray(`Configuration saved to: ${config.getConfigPath()}\n`));
+    console.log(chalk.blue('Next steps:'));
+    console.log(chalk.white('  1. Run "langctl projects list" to see your projects'));
+    console.log(chalk.white('  2. Run "langctl pull <project-slug>" to download translations\n'));
+}
+//# sourceMappingURL=init.js.map

package/dist/commands/projects.d.ts

@@ -0,0 +1,2 @@
+export declare function projectsListCommand(): Promise<void>;
+//# sourceMappingURL=projects.d.ts.map

package/dist/commands/projects.js

@@ -0,0 +1,54 @@
+import chalk from 'chalk';
+import ora from 'ora';
+import { getSupabase } from '../supabase.js';
+import { isAuthenticated, getOrganizationId } from '../auth.js';
+export async function projectsListCommand() {
+    // Check authentication
+    if (!isAuthenticated()) {
+        console.log(chalk.red('✗ Not authenticated. Please run "langctl auth <api-key>" first.\n'));
+        return;
+    }
+    const organizationId = getOrganizationId();
+    if (!organizationId) {
+        console.log(chalk.red('✗ Organization ID not found. Please run "langctl init" again.\n'));
+        return;
+    }
+    const spinner = ora('Fetching projects...').start();
+    try {
+        const supabase = getSupabase();
+        const { data, error } = await supabase
+            .from('projects')
+            .select('*')
+            .eq('organization_id', organizationId)
+            .is('deleted_at', null)
+            .order('created_at', { ascending: false });
+        if (error) {
+            spinner.fail(chalk.red('Failed to fetch projects'));
+            console.error(chalk.red(`Error: ${error.message}\n`));
+            return;
+        }
+        spinner.stop();
+        if (!data || data.length === 0) {
+            console.log(chalk.yellow('\nNo projects found. Create one in the dashboard first.\n'));
+            return;
+        }
+        console.log(chalk.blue.bold(`\n📦 Projects (${data.length})\n`));
+        data.forEach((project) => {
+            console.log(chalk.white.bold(project.name));
+            console.log(chalk.gray(`  Slug: ${project.slug}`));
+            if (project.description) {
+                console.log(chalk.gray(`  Description: ${project.description}`));
+            }
+            console.log(chalk.gray(`  Languages: ${project.languages.join(', ')}`));
+            console.log(chalk.gray(`  Default: ${project.default_language}`));
+            console.log('');
+        });
+        console.log(chalk.blue('To pull translations, run:'));
+        console.log(chalk.white(`  langctl pull ${data[0].slug}\n`));
+    }
+    catch (error) {
+        spinner.fail(chalk.red('Failed to fetch projects'));
+        console.error(chalk.red(`Error: ${error.message}\n`));
+    }
+}
+//# sourceMappingURL=projects.js.map

package/dist/commands/pull.d.ts

@@ -0,0 +1,9 @@
+export interface PullOptions {
+    language?: string;
+    format?: string;
+    output?: string;
+    dir?: string;
+    publishedOnly?: boolean;
+}
+export declare function pullCommand(projectIdentifier: string, options: PullOptions): Promise<void>;
+//# sourceMappingURL=pull.d.ts.map