mayar 0.1.9 → 0.2.0

package/README.md

@@ -4,13 +4,28 @@ Command-line interface for the [Mayar](https://docs.mayar.id) API. Zero runtime
 
 ## Install
 
+**One-liner (no npm required):**
+
+```bash
+curl -fsSL https://raw.githubusercontent.com/mayarid/mayar-cli/main/install.sh | sh
+```
+
+Downloads the latest tarball from the npm registry, extracts to `~/.local/share/mayar`, and symlinks the binary to `~/.local/bin/mayar`. Requires only `node>=18`, `curl`, and `tar`. Override paths or pin a version:
+
+```bash
+MAYAR_VERSION=0.1.9 MAYAR_BIN_DIR=/usr/local/bin \
+  curl -fsSL https://raw.githubusercontent.com/mayarid/mayar-cli/main/install.sh | sh
+```
+
+**Via npm:**
+
 ```bash
 npm install -g mayar
 # or run without installing:
 npx mayar --help
 ```
 
-Or from source:
+**From source:**
 
 ```bash
 git clone https://github.com/mayarid/mayar-cli.git

package/node_modules/@mayaross/auth/README.md

@@ -0,0 +1,204 @@
+# @mayaross/auth
+
+SDK untuk autentikasi `mayar-cli` via mayar auth service menggunakan Google OAuth + SSE.
+
+## Instalasi
+
+```bash
+npm install @mayaross/auth
+```
+
+Tidak ada dependency eksternal — hanya menggunakan built-in Node.js (`https`, `http`, `child_process`). Membutuhkan Node.js >= 18.
+
+---
+
+## Flow
+
+```
+mayar login
+    │
+    ├─ 1. Minta appid + URL ke server  →  GET /token/cli/initiate
+    │
+    ├─ 2. Buka browser ke auth URL     →  /oauth2/google?state=appid,<uuid>
+    │
+    ├─ 3. Subscribe SSE                →  GET /token/cli/stream?appid=<uuid>
+    │         (tunggu token, max 5 menit)
+    │
+    ├─ 4. User login Google di browser
+    │
+    └─ 5. Server push token via SSE   →  CLI terima, simpan credentials
+```
+
+---
+
+## Penggunaan
+
+### Login satu langkah
+
+```js
+const { MayarAuth } = require('@mayaross/auth');
+
+const auth = new MayarAuth('https://auth.mayar.id');
+
+try {
+  const token = await auth.login({
+    onUrl: ({ url }) => {
+      console.log(`Membuka browser untuk login...`);
+      console.log(`Jika browser tidak terbuka, buka URL ini:\n${url}`);
+    }
+  });
+
+  // token = "authToken,refreshToken"
+  console.log('Login berhasil!');
+  // simpan token ke ~/.mayar/credentials atau keychain
+} catch (e) {
+  console.error('Login gagal:', e.message);
+}
+```
+
+### Manual step-by-step
+
+```js
+const { MayarAuth } = require('@mayaross/auth');
+
+const auth = new MayarAuth('https://auth.mayar.id');
+
+// 1. Dapatkan appid dan URL login
+const { appid, url } = await auth.initiate();
+console.log('Buka URL ini di browser:', url);
+
+// 2. (opsional) buka browser secara manual
+auth.openBrowser(url);
+
+// 3. Tunggu token via SSE
+const token = await auth.listenForToken(appid);
+console.log('Token diterima:', token);
+```
+
+---
+
+## API
+
+### `new MayarAuth(baseUrl, opts?)`
+
+| Parameter | Type | Default | Keterangan |
+|-----------|------|---------|------------|
+| `baseUrl` | `string` | `'https://auth.mayar.id'` | Base URL auth server |
+| `opts.timeoutMs` | `number` | `300000` (5 menit) | Timeout tunggu login |
+
+---
+
+### `auth.login(opts?)`
+
+Full login flow: initiate → buka browser → tunggu token via SSE.
+
+```ts
+login(opts?: {
+  openBrowser?: boolean,   // default: true. Set false untuk print URL saja
+  onUrl?: ({ appid, url }) => void  // callback sebelum browser dibuka
+}): Promise<string>  // "authToken,refreshToken"
+```
+
+---
+
+### `auth.initiate()`
+
+Minta `appid` dan `url` dari server.
+
+```ts
+initiate(): Promise<{ appid: string, url: string }>
+```
+
+---
+
+### `auth.listenForToken(appid)`
+
+Konek ke SSE stream dan tunggu token. Resolve saat token diterima, reject saat timeout.
+
+```ts
+listenForToken(appid: string): Promise<string>  // "authToken,refreshToken"
+```
+
+---
+
+### `auth.openBrowser(url)`
+
+Buka URL di browser default. Support macOS, Linux, Windows.
+
+```ts
+openBrowser(url: string): void
+```
+
+---
+
+## Format Token
+
+Token yang dikembalikan berupa string dengan format:
+
+```
+authToken,refreshToken
+```
+
+- **authToken** — JWT RS256, berlaku 24 jam
+- **refreshToken** — JWT RS256, berlaku 7 hari, digunakan untuk refresh otomatis via `/validate`
+
+Untuk decode payload:
+
+```js
+const [authToken] = token.split(',');
+const payload = JSON.parse(
+  Buffer.from(authToken.split('.')[1], 'base64url').toString()
+);
+// { sub: email, role, name, exp, ... }
+```
+
+---
+
+## Contoh Integrasi di mayar-cli
+
+```js
+// commands/login.js
+const { MayarAuth } = require('@mayaross/auth');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+const CREDENTIALS_PATH = path.join(os.homedir(), '.mayar', 'credentials.json');
+
+async function loginCommand() {
+  const auth = new MayarAuth(process.env.MAYAR_AUTH_URL || 'https://auth.mayar.id');
+
+  console.log('Menghubungkan ke mayar...');
+
+  const token = await auth.login({
+    onUrl: ({ url }) => {
+      console.log('\nJika browser tidak terbuka otomatis, buka URL ini:');
+      console.log(url + '\n');
+    }
+  });
+
+  const [authToken] = token.split(',');
+  const { sub: email, name, exp } = JSON.parse(
+    Buffer.from(authToken.split('.')[1], 'base64url').toString()
+  );
+
+  fs.mkdirSync(path.dirname(CREDENTIALS_PATH), { recursive: true });
+  fs.writeFileSync(CREDENTIALS_PATH, JSON.stringify({ token, email, name }, null, 2));
+
+  console.log(`\nLogin berhasil sebagai ${name} (${email})`);
+  console.log(`Token berlaku hingga ${new Date(exp * 1000).toLocaleString()}`);
+}
+
+module.exports = { loginCommand };
+```
+
+---
+
+## Server Endpoints
+
+SDK ini mengonsumsi dua endpoint dari auth server:
+
+| Endpoint | Method | Keterangan |
+|----------|--------|------------|
+| `/token/cli/initiate` | GET | Generate `appid` + auth URL |
+| `/token/cli/stream?appid=<uuid>` | GET (SSE) | Stream token setelah user login |

package/node_modules/@mayaross/auth/index.js

@@ -0,0 +1,146 @@
+/**
+ * @mayarid/auth-cli
+ * SDK for mayar-cli to authenticate via mayar auth service.
+ *
+ * Usage:
+ *   const { MayarAuth } = require('@mayarid/auth-cli');
+ *   const auth = new MayarAuth('https://auth.mayar.id');
+ *   const token = await auth.login();   // opens browser, waits for SSE token
+ */
+
+const https = require('https');
+const http = require('http');
+const { spawn } = require('child_process');
+
+class MayarAuth {
+  /**
+   * @param {string} baseUrl - Auth server base URL, e.g. 'https://auth.mayar.id'
+   * @param {object} [opts]
+   * @param {number} [opts.timeoutMs=300000] - How long to wait for login (default 5 min)
+   */
+  constructor(baseUrl = 'https://auth.mayar.id', opts = {}) {
+    this.baseUrl = baseUrl.replace(/\/$/, '');
+    this.timeoutMs = opts.timeoutMs ?? 5 * 60 * 1000;
+  }
+
+  /**
+   * Step 1: Ask the server for a fresh appid + auth URL.
+   * @returns {Promise<{ appid: string, url: string }>}
+   */
+  async initiate() {
+    return new Promise((resolve, reject) => {
+      const endpoint = new URL(`${this.baseUrl}/token/cli/initiate`);
+      const lib = endpoint.protocol === 'https:' ? https : http;
+
+      lib.get(endpoint.href, (res) => {
+        let body = '';
+        res.on('data', (chunk) => (body += chunk));
+        res.on('end', () => {
+          try {
+            resolve(JSON.parse(body));
+          } catch (e) {
+            reject(new Error(`Invalid response from server: ${body}`));
+          }
+        });
+      }).on('error', reject);
+    });
+  }
+
+  /**
+   * Step 2: Open system browser at the given URL.
+   * @param {string} url
+   */
+  openBrowser(url) {
+    const platform = process.platform;
+    const cmd = platform === 'darwin' ? 'open'
+      : platform === 'win32' ? 'start'
+      : 'xdg-open';
+
+    spawn(cmd, [url], { detached: true, stdio: 'ignore' }).unref();
+  }
+
+  /**
+   * Step 3: Subscribe to SSE stream and wait for the token event.
+   * Resolves with the token pair string "authToken,refreshToken".
+   * @param {string} appid
+   * @returns {Promise<string>}
+   */
+  listenForToken(appid) {
+    return new Promise((resolve, reject) => {
+      const endpoint = new URL(`${this.baseUrl}/token/cli/stream?appid=${encodeURIComponent(appid)}`);
+      const lib = endpoint.protocol === 'https:' ? https : http;
+
+      const timer = setTimeout(() => {
+        req.destroy();
+        reject(new Error('Login timed out. Please try again.'));
+      }, this.timeoutMs);
+
+      const req = lib.get(endpoint.href, (res) => {
+        if (res.statusCode !== 200) {
+          clearTimeout(timer);
+          reject(new Error(`SSE stream returned ${res.statusCode}`));
+          return;
+        }
+
+        let buf = '';
+        let eventName = '';
+
+        res.setEncoding('utf8');
+        res.on('data', (chunk) => {
+          buf += chunk;
+          const lines = buf.split('\n');
+          buf = lines.pop(); // keep incomplete last line
+
+          for (const line of lines) {
+            if (line.startsWith('event:')) {
+              eventName = line.replace('event:', '').trim();
+            } else if (line.startsWith('data:')) {
+              const raw = line.replace('data:', '').trim();
+              if (eventName === 'token') {
+                clearTimeout(timer);
+                req.destroy();
+                try {
+                  const { token } = JSON.parse(raw);
+                  resolve(token);
+                } catch {
+                  reject(new Error('Failed to parse token from server'));
+                }
+              } else if (eventName === 'timeout') {
+                clearTimeout(timer);
+                req.destroy();
+                reject(new Error('Login timed out on server side. Please try again.'));
+              }
+              eventName = '';
+            }
+          }
+        });
+
+        res.on('error', (e) => { clearTimeout(timer); reject(e); });
+        res.on('end', () => { clearTimeout(timer); reject(new Error('SSE stream closed unexpectedly')); });
+      });
+
+      req.on('error', (e) => { clearTimeout(timer); reject(e); });
+    });
+  }
+
+  /**
+   * Full login flow: initiate → open browser → listen for SSE token.
+   * @param {object} [opts]
+   * @param {boolean} [opts.openBrowser=true] - Set false to print URL instead of opening browser
+   * @param {function} [opts.onUrl] - Called with { appid, url } before waiting for token
+   * @returns {Promise<string>} token pair "authToken,refreshToken"
+   */
+  async login({ openBrowser = true, onUrl } = {}) {
+    const { appid, url } = await this.initiate();
+
+    if (typeof onUrl === 'function') onUrl({ appid, url });
+
+    if (openBrowser) {
+      this.openBrowser(url);
+    }
+
+    return this.listenForToken(appid);
+  }
+}
+
+module.exports = { MayarAuth };

package/node_modules/@mayaross/auth/package.json

@@ -0,0 +1,10 @@
+{
+  "name": "@mayaross/auth",
+  "version": "1.0.0",
+  "description": "SDK for mayar-cli to authenticate via mayar auth service",
+  "main": "index.js",
+  "license": "ISC",
+  "engines": {
+    "node": ">=18"
+  }
+}

package/package.json

@@ -1,17 +1,25 @@
 {
   "name": "mayar",
-  "version": "0.1.9",
+  "version": "0.2.0",
   "description": "Zero-dependency Node.js CLI for the Mayar API (production endpoint).",
   "bin": {
     "mayar": "bin/mayar.js"
   },
   "main": "src/cli.js",
   "scripts": {
-    "start": "node bin/mayar.js"
+    "start": "node bin/mayar.js",
+    "test": "node --test",
+    "test:coverage": "node --test --experimental-test-coverage"
   },
   "engines": {
     "node": ">=18"
   },
+  "dependencies": {
+    "@mayaross/auth": "^1.0.0"
+  },
+  "bundleDependencies": [
+    "@mayaross/auth"
+  ],
   "keywords": [
     "mayar",
     "mayar-api",

package/src/api.js

@@ -1,7 +1,8 @@
 const https = require('https');
 const { URL } = require('url');
+const config = require('./config');
 
-const BASE_URL = process.env.MAYAR_API_URL || 'https://api.mayar.id';
+const BASE_URL = config.apiBaseUrl();
 const VERSION = require('../package.json').version;
 
 function request(method, pathname, { apiKey, body, query } = {}) {

package/src/cli.js

@@ -10,6 +10,7 @@ ${ui.bold('Usage:')}
 
 ${ui.bold('Setup:')}
   init                                Run first-time setup (or re-configure API key)
+  login [--no-browser]                Sign in via browser (Google OAuth) and save auth token
   api-key <key>                       Save API key non-interactively
   config show                         Show config path and masked API key
   config reset                        Remove the saved API key
@@ -73,10 +74,13 @@ ${ui.bold('Global flags:')}
 
 ${ui.bold('Environment:')}
   MAYAR_API_KEY         Used when --api-key is not given and no config is saved
-  MAYAR_API_URL         Override API base URL (default: https://api.mayar.id)
+  MAYAR_API_URL         Override API base URL
+  MAYAR_AUTH_URL        Override auth server base URL (used by 'login')
+  NODE_ENV=development  Target the sandbox (api/auth .mayar.club) instead of production
 
 ${ui.dim('Resolution order: --api-key flag > MAYAR_API_KEY env > saved config.')}
-${ui.dim('Endpoint: MAYAR_API_URL env or https://api.mayar.id (default)')}
+${ui.dim('API endpoint:  MAYAR_API_URL, else NODE_ENV=development → api.mayar.club, else api.mayar.id')}
+${ui.dim('Auth endpoint: MAYAR_AUTH_URL, else NODE_ENV=development → auth.mayar.club, else auth.mayar.id')}
 ${ui.dim('Config:   ~/.config/mayar/config.json (chmod 600)')}
 `;
 
@@ -88,6 +92,7 @@ function parseFlags(argv) {
     if (a === '--') { positional.push(...argv.slice(i + 1)); break; }
     if (a === '--json') flags.json = true;
     else if (a === '--force') flags.force = true;
+    else if (a === '--no-browser') flags['no-browser'] = true;
     else if (a === '--api-key') flags.apiKey = argv[++i];
     else if (a.startsWith('--api-key=')) flags.apiKey = a.slice('--api-key='.length);
     else if (a === '--page') flags.page = argv[++i];
@@ -140,6 +145,10 @@ async function run(argv) {
       const init = require('./commands/init');
       return await init.run({ flags });
     }
+    if (cmd === 'login') {
+      const login = require('./commands/login');
+      return await login.run({ flags });
+    }
     if (cmd === 'api-key' || cmd === 'apikey') {
       const apikey = require('./commands/apikey');
       return await apikey.run({ positional: [sub, ...rest].filter((x) => x !== undefined) });
@@ -196,4 +205,4 @@ async function run(argv) {
   }
 }
 
-module.exports = { run };
+module.exports = { run, parseFlags };

package/src/commands/login.js

@@ -0,0 +1,74 @@
+const { MayarAuth } = require('@mayaross/auth');
+const config = require('../config');
+const ui = require('../ui');
+
+// Decode the payload of a JWT without verifying its signature.
+function decodeJwt(token) {
+  const parts = String(token || '').split('.');
+  if (parts.length !== 3) return null;
+  try {
+    const padded = parts[1].replace(/-/g, '+').replace(/_/g, '/');
+    const pad = padded.length % 4 === 0 ? '' : '='.repeat(4 - (padded.length % 4));
+    return JSON.parse(Buffer.from(padded + pad, 'base64').toString('utf8'));
+  } catch (_) {
+    return null;
+  }
+}
+
+async function run({ flags }) {
+  const authUrl = config.authBaseUrl();
+  const auth = new MayarAuth(authUrl);
+
+  if (!flags.json) {
+    ui.printBanner();
+    process.stdout.write(`${ui.bold('Sign in to Mayar')}\n`);
+    process.stdout.write(`${ui.dim('Auth server:')} ${authUrl}\n\n`);
+    process.stdout.write('Opening your browser to complete Google sign-in…\n');
+  }
+
+  const token = await auth.login({
+    openBrowser: !flags['no-browser'],
+    onUrl: ({ url }) => {
+      if (flags.json) return;
+      if (flags['no-browser']) {
+        process.stdout.write('\nOpen this URL in your browser to sign in:\n');
+      } else {
+        process.stdout.write('\nIf your browser did not open automatically, visit:\n');
+      }
+      process.stdout.write(ui.cyan(url) + '\n\n');
+      process.stdout.write(ui.dim('Waiting for you to finish signing in…') + '\n');
+    },
+  });
+
+  // The SDK returns "authToken,refreshToken".
+  const [authToken, refreshToken] = String(token).split(',');
+  const claims = decodeJwt(authToken) || {};
+  const email = claims.sub || claims.email || null;
+  const name = claims.name || null;
+  const expiresAt = claims.exp ? new Date(claims.exp * 1000).toISOString() : null;
+
+  const existing = config.load() || {};
+  config.save({
+    ...existing,
+    auth: {
+      authToken,
+      refreshToken: refreshToken || null,
+      email,
+      name,
+      expiresAt,
+      authUrl,
+      savedAt: new Date().toISOString(),
+    },
+  });
+
+  if (flags.json) {
+    ui.jsonOut({ ok: true, email, name, expiresAt, authUrl });
+    return;
+  }
+
+  process.stdout.write('\n' + ui.green(`✓ Signed in${name ? ` as ${name}` : ''}${email ? ` (${email})` : ''}`) + '\n');
+  if (expiresAt) process.stdout.write(`${ui.bold('Token expires:')} ${expiresAt}\n`);
+  process.stdout.write(ui.dim(`Credentials saved to ${config.file}`) + '\n');
+}
+
+module.exports = { run };

package/src/config.js

@@ -40,4 +40,21 @@ function clear() {
   try { fs.unlinkSync(file); return true; } catch (_) { return false; }
 }
 
-module.exports = { load, save, clear, file, dir };
+// Environment resolution -----------------------------------------------------
+// NODE_ENV=development targets the *.mayar.club sandbox; anything else targets
+// production *.mayar.id. Explicit env overrides always win.
+function isDev() {
+  return process.env.NODE_ENV === 'development';
+}
+
+function apiBaseUrl() {
+  if (process.env.MAYAR_API_URL) return process.env.MAYAR_API_URL;
+  return isDev() ? 'https://api.mayar.club' : 'https://api.mayar.id';
+}
+
+function authBaseUrl() {
+  if (process.env.MAYAR_AUTH_URL) return process.env.MAYAR_AUTH_URL;
+  return isDev() ? 'https://auth.mayar.club' : 'https://auth.mayar.id';
+}
+
+module.exports = { load, save, clear, file, dir, isDev, apiBaseUrl, authBaseUrl };