metergraph-cli 0.2.2 → 0.2.4

package/src/auth-binding.js

@@ -1,5 +1,5 @@
 import { randomBytes } from "node:crypto";
-import fs from "node:fs";
+import fs, { withRollback } from "./anchored-fs.js";
 import path from "node:path";
 
 import { Stop, isSlot } from "./auth-store.js";
@@ -8,8 +8,9 @@ import { parseOrigin } from "./origin.js";
 
 // The project binding, .metergraph/project.json, names which origin,
 // workspace and profile a project is signed in to and which credential slot
-// in the user's private store holds the grant. It holds no credential, user
-// name or absolute path, so it is safe to commit. Other files in .metergraph,
+// in the user's private store holds the grant. The private grant also pins the
+// canonical checkout, so copying this file never adopts or revokes that grant.
+// It holds no credential, user name or absolute path. Other files in .metergraph,
 // such as skill receipts, are never touched.
 
 export const BINDING_PATH = ".metergraph/project.json";
@@ -25,7 +26,8 @@ export function resolveProject(project) {
   try {
     const real = fs.realpathSync(path.resolve(project ?? process.cwd()));
     if (fs.statSync(real).isDirectory()) return real;
-  } catch {
+  } catch (error) {
+    if (error.code === "ENOTSUP") throw new Stop("unsupported", "secure_writes_unavailable");
     // Fall through to the fixed error.
   }
   throw new Stop("invalid_input", "invalid_project");
@@ -44,6 +46,7 @@ export function readBinding(root) {
     return { binding, content };
   } catch (error) {
     if (error instanceof Stop) throw error;
+    if (error.code === "ENOTSUP") throw new Stop("unsupported", "secure_writes_unavailable");
     throw new Stop("filesystem_error", "read_failed");
   }
 }
@@ -82,12 +85,13 @@ export function writeBinding(root, binding, previous) {
   } catch (error) {
     if (created) {
       try {
-        fs.rmdirSync(dir);
+        withRollback(() => fs.rmdirSync(dir));
       } catch {
         // Not empty. An empty directory is harmless.
       }
     }
     if (error instanceof Stop) throw error;
+    if (error.code === "ENOTSUP") throw new Stop("unsupported", "secure_writes_unavailable");
     throw new Stop("filesystem_error", "binding_write_failed");
   }
 }
@@ -102,6 +106,7 @@ export function removeBinding(root, previous) {
     });
   } catch (error) {
     if (error instanceof Stop) throw error;
+    if (error.code === "ENOTSUP") throw new Stop("unsupported", "secure_writes_unavailable");
     throw new Stop("filesystem_error", "binding_write_failed");
   }
 }
@@ -118,7 +123,7 @@ function withProjectLock(dir, work) {
     return work();
   } finally {
     try {
-      fs.unlinkSync(lock);
+      withRollback(() => fs.unlinkSync(lock));
     } catch {
       // Reported by the next run as a held lock.
     }
@@ -145,7 +150,7 @@ function replace(dir, content) {
     fs.renameSync(temp, dest);
   } catch (error) {
     try {
-      fs.unlinkSync(temp);
+      withRollback(() => fs.unlinkSync(temp));
     } catch {
       // Already renamed or never created.
     }

package/src/auth-callback.js

@@ -19,6 +19,9 @@ const ALLOWED_PARAMS = new Set(["code", "state", "error", "error_description", "
 // The setup receipt a combined sign-in approval returns next to the code.
 // Accepted only by a wait that asked for it.
 export const SETUP_CODE_PARAM = "ingest_setup_code";
+// The fixed error_description values a consent page sends when the workspace
+// the CLI named matches none, or more than one, of the person's workspaces.
+const HINT_REFUSALS = ["workspace_hint_ambiguous", "workspace_hint_unknown"];
 
 const PAGE_HEADERS = {
   "content-type": "text/html; charset=utf-8",
@@ -39,7 +42,11 @@ const PAGE_HEADERS = {
 //     { kind: "code", code[, setupCode] } setupCode, the ingest_setup_code
 //                                         value, only when wait() was given
 //                                         acceptSetupCode and it was sent
-//     { kind: "denied" }                  the user or server declined
+//     { kind: "denied", hint }            the user or server declined; hint
+//                                         is workspace_hint_ambiguous or
+//                                         workspace_hint_unknown when the
+//                                         consent page refused the workspace
+//                                         the CLI named, else null
 //     { kind: "error", reason }           authorization_error,
 //                                         callback_issuer_mismatch or
 //                                         callback_invalid
@@ -163,8 +170,9 @@ function inspect(request, { host, state, issuer, requireIss, acceptSetupCode })
     if (seen.has("code") || seen.has(SETUP_CODE_PARAM)) {
       return { status: 400, result: { kind: "error", reason: "callback_invalid" } };
     }
+    const description = params.get("error_description");
     return params.get("error") === "access_denied"
-      ? { status: 200, result: { kind: "denied" } }
+      ? { status: 200, result: { kind: "denied", hint: HINT_REFUSALS.includes(description) ? description : null } }
       : { status: 200, result: { kind: "error", reason: "authorization_error" } };
   }
   const code = params.get("code");

package/src/auth-login.js

@@ -16,6 +16,7 @@ import {
   exchangeCode,
   newPkce,
   revoke,
+  sameScopes,
   verifyContext,
 } from "./auth-oauth.js";
 import { LOCK_WAIT_MS, sessionFor } from "./auth-session.js";
@@ -25,26 +26,35 @@ import {
   deleteCredential,
   newSlot,
   openStore,
-  readCredential,
+  readProjectCredential,
+  projectIdentity,
   resolveConfigDir,
   withSlotLock,
   writeCredential,
 } from "./auth-store.js";
-import { AUTH_HTTP_TIMEOUT_MS, METADATA_SCOPE } from "./constants.js";
+import { AUTH_HTTP_TIMEOUT_MS, WORKFLOW_PERMISSIONS, loginScope } from "./constants.js";
 import { runDoctor } from "./doctor.js";
 import { agentKeyAction, classifyEnvironment } from "./environment.js";
+import { workspaceLabel, workspacePinned } from "./read-contract.js";
 import { deadline, trapSignals } from "./transport.js";
 
 // login and logout. Each returns { outcome, reason, data }; every string in
-// data is a fixed token, the validated origin, a supported profile or a
-// server-verified workspace UUID. Token values, the authorization code, the
-// PKCE verifier, absolute paths and server text never leave this module.
+// data is a fixed token, the validated origin, a supported profile, a
+// server-verified workspace UUID, or that workspace's slug and name as the
+// service reported them, checked as safe to print and dropped if they contain
+// a credential this run holds. Token values, the authorization code, the PKCE
+// verifier, absolute paths and other server text never leave this module.
 // progress(text) prints human progress lines; it is a no-op with --json.
 // options.announce(data), given only with --json --no-browser, receives the
 // login data with an open_url next action as soon as the authorization URL
 // exists, while the listener keeps waiting. The caller prints it as the one
 // JSON line, so an agent can hand the URL to a person; approval-handoff.js
 // lets the agent's command exit then while this process keeps waiting.
+// options.role is "metadata" (the default) or "debug", and options.permissions
+// the workflow permission scopes --allow-* added to Debug, which a workspace
+// owner approves on the consent page. options.workspaceText is a workspace named by
+// slug or name: sent to a consent page that can match it, and checked against
+// the workspace the service reports.
 // options.ingestSetup, given only by setup, is { familyId, supported(origin,
 // profile, signal) }. When the service supports it, the sign-in consent also
 // approves the first ingest key for that family, and an ok result carries the
@@ -61,8 +71,12 @@ export async function runLogin(options, progress) {
     status: null,
     previousGrant: null,
     environment: null,
+    role: options.role === "debug" ? "debug" : "metadata",
+    scope: loginScope(options.role, options.permissions ?? []),
+    workspaceLabel: { slug: null, name: null },
   };
   const end = (outcome, reason, next = null) => ({ outcome, reason, data: loginData(ctx, next) });
+  const workspaceText = options.workspaceText ?? null;
 
   // Handoffs come first: no listener, request or file write happens for a
   // session that cannot finish sign in. The next action tells the agent how
@@ -74,6 +88,11 @@ export async function runLogin(options, progress) {
     return end("unsupported", "runtime_not_supported", agentKeyAction({ kind: "declared_cloud" }, options.origin));
   }
   if (environment.remote) return end("unsupported", environment.reason, agentKeyAction(environment, options.origin));
+  // Refuse before reading saved grants or creating a callback/manual URL.
+  // Browser consent through a host loopback port cannot establish identity.
+  if (new URL(options.origin).protocol === "http:") {
+    return end("unsupported", "local_docker_transport_required");
+  }
   const trap = trapSignals();
   try {
     const root = resolveProject(options.project);
@@ -94,18 +113,25 @@ export async function runLogin(options, progress) {
     }
     const store = openStore(configDir, { create: true });
 
-    // A rerun with a working grant changes nothing and opens no browser.
-    if (bound !== null && !options.reconnect) {
-      const session = await sessionFor(bound, store, trap.signal);
+    // A rerun with a working grant for the same role and permissions changes
+    // nothing and opens no browser. Asking for others signs in again, for the
+    // same workspace.
+    const saved = bound === null ? null : readOrNull(store, bound.credential_slot, root);
+    if (bound !== null && !options.reconnect && saved?.scope === ctx.scope) {
+      const session = await sessionFor(bound, store, trap.signal, root);
       if (session.ok) {
+        if (workspaceText !== null && !workspacePinned(session.documents.workspace?.workspace, workspaceText)) {
+          return end("conflict", "bound_to_other_workspace", RECONNECT);
+        }
         Object.assign(ctx, {
           profile: bound.deployment_profile,
           workspaceId: bound.workspace_id,
+          workspaceLabel: labelWithout(workspaceLabel(session.documents.workspace?.workspace), session.knownCredentials),
           authenticated: true,
           configured: true,
           status: "reused",
         });
-        return end("ok", null, CONNECTED);
+        return end("ok", null, connected(ctx));
       }
       if (session.outcome !== "login_required") return end(session.outcome, session.reason);
     }
@@ -128,13 +154,14 @@ export async function runLogin(options, progress) {
     try {
       writeCredential(store, slot, {
         schema_version: 1,
+        project_id: projectIdentity(root),
         origin: ctx.origin,
         issuer: endpoints.issuer,
         resource: endpoints.resource,
         deployment_profile: ctx.profile,
         workspace_id: grant.tenant,
         client_id: clientId,
-        scope: METADATA_SCOPE,
+        scope: ctx.scope,
         access_token: grant.accessToken,
         refresh_token: grant.refreshToken,
         expires_at: grant.expiresAt,
@@ -162,9 +189,9 @@ export async function runLogin(options, progress) {
     // The old grant is no longer referenced. Ask the service to revoke it
     // and remove it locally; neither affects the new binding.
     if (bound !== null && bound.credential_slot !== slot) {
-      ctx.previousGrant = await retireSlot(store, bound);
+      ctx.previousGrant = await retireSlot(store, bound, root);
     }
-    return { ...end("ok", null, CONNECTED), ingestSetup: flow.ingestSetup };
+    return { ...end("ok", null, connected(ctx)), ingestSetup: flow.ingestSetup };
   } catch (error) {
     if (error instanceof Stop) return end(error.outcome, error.reason);
     throw error;
@@ -189,9 +216,18 @@ async function authorize(options, ctx, cancel, progress, announce) {
   if (options.signup && ctx.profile !== "managed") return fail("unsupported", "signup_unsupported");
 
   let limit = deadline(AUTH_HTTP_TIMEOUT_MS, cancel);
-  const discovered = await discover(ctx.origin, limit.signal);
+  const discovered = await discover(ctx.origin, limit.signal, ctx.scope.split(" ")[0]);
   if (!discovered.ok) return httpFailure(discovered, cancel);
   const { endpoints, requireIss, offeredClientId } = discovered;
+  const scopes = ctx.scope.split(" ");
+  // The consent page can match a slug or name only where the service says
+  // so. Without that, a slug is still checked after sign in, but a name,
+  // which may be ambiguous, is refused before the browser opens.
+  const workspaceText = options.workspaceText ?? null;
+  if (workspaceText !== null && !discovered.workspaceHint && !SLUG.test(workspaceText.toLowerCase())) {
+    return fail("unsupported", "workspace_name_unsupported", USE_SLUG);
+  }
+  const workspaceHint = discovered.workspaceHint ? workspaceText ?? options.workspace ?? null : null;
 
   // Setup asks this consent to approve the first ingest key too, but only
   // when the service says it can. Otherwise sign in is unchanged and setup
@@ -209,7 +245,7 @@ async function authorize(options, ctx, cancel, progress, announce) {
   let verifier;
   try {
     limit = deadline(AUTH_HTTP_TIMEOUT_MS, cancel);
-    const client = await clientFor(endpoints, offeredClientId, listener.redirectUri, limit.signal);
+    const client = await clientFor(endpoints, offeredClientId, listener.redirectUri, limit.signal, scopes);
     if (!client.ok) return httpFailure(client, cancel);
     clientId = client.clientId;
 
@@ -234,9 +270,12 @@ async function authorize(options, ctx, cancel, progress, announce) {
       challenge: pkce.challenge,
       signup: options.signup,
       ingestSetup: setupPkce === null ? null : { familyId: options.ingestSetup.familyId, challenge: setupPkce.challenge },
+      scopes,
+      workspaceHint,
     });
-    const purpose = setupPkce === null ? "sign in with Metadata access"
-      : "sign in with Metadata access and approve an ingest-only key for this project";
+    const access = accessText(ctx) + (ctx.scope.includes(" ") ? ", which a workspace owner approves" : "");
+    const purpose = setupPkce === null ? `sign in with ${access}`
+      : `sign in with ${access} and approve an ingest-only key for this project`;
     const seconds = Math.round(options.timeoutMs / 1000);
     // A wait armed after Ctrl+C has already settled; do not show the URL.
     if (cancel.aborted) return fail("authorization_failed", "cancelled");
@@ -272,6 +311,8 @@ async function authorize(options, ctx, cancel, progress, announce) {
   }
 
   if (callback.kind === "code" && setupPkce !== null && callback.setupCode) options.ingestSetup.onApproved?.();
+  // The consent page refused the workspace the CLI named.
+  if (callback.kind === "denied" && callback.hint) return fail("invalid_input", callback.hint, USE_SLUG);
   if (callback.kind === "denied") return fail("authorization_failed", "access_denied");
   if (callback.kind === "timeout") return fail("authorization_failed", "timeout");
   if (callback.kind === "cancelled") return fail("authorization_failed", "cancelled");
@@ -280,7 +321,7 @@ async function authorize(options, ctx, cancel, progress, announce) {
   limit = deadline(AUTH_HTTP_TIMEOUT_MS, cancel);
   const exchanged = await exchangeCode(
     endpoints,
-    { clientId, redirectUri: listener.redirectUri, code: callback.code, verifier },
+    { clientId, redirectUri: listener.redirectUri, code: callback.code, verifier, scopes },
     limit.signal,
   );
   if (!exchanged.ok) return httpFailure(exchanged, cancel);
@@ -297,14 +338,22 @@ async function authorize(options, ctx, cancel, progress, announce) {
   const verified = await verifyContext(
     ctx.origin,
     grant.accessToken,
-    { profile: ctx.profile, workspaceId: grant.tenant },
+    { profile: ctx.profile, workspaceId: grant.tenant, access: ctx.role === "debug" ? "read" : "metadata" },
     limit.signal,
   );
   if (!verified.ok) {
     if (cancel.aborted) return rejectGrant("authorization_failed", "cancelled");
     return rejectGrant(verified.outcome, verified.reason);
   }
+  if (ctx.role === "debug" && !sameScopes(ctx.scope, verified.scopes)) return rejectGrant("verification_failed", "scope_mismatch");
+  const workspace = verified.documents.workspace?.workspace;
+  if (workspaceText !== null && !workspacePinned(workspace, workspaceText)) {
+    return rejectGrant("verification_failed", "workspace_mismatch");
+  }
   ctx.workspaceId = grant.tenant;
+  ctx.workspaceLabel = labelWithout(workspaceLabel(workspace), [
+    grant.accessToken, grant.refreshToken, callback.code, verifier, callback.setupCode, setupPkce?.verifier,
+  ]);
   // The receipt is a separate credential: setup redeems it with its own
   // verifier, for the family it named, after binding this sign in. A service
   // that showed only the sign in returns no receipt, and setup falls back to
@@ -335,7 +384,8 @@ export async function runLogout(options) {
         store,
         bound.credential_slot,
         async () => {
-          const record = readOrNull(store, bound.credential_slot);
+          const record = readOrNull(store, bound.credential_slot, root);
+          if (record === null) return false;
           // A grant is only ever sent back to the origin it came from.
           if (record !== null && record.origin === bound.origin) {
             const limit = deadline(AUTH_HTTP_TIMEOUT_MS, trap.signal);
@@ -372,13 +422,14 @@ export async function runLogout(options) {
 // Revokes and removes the grant a previous binding pointed to. Returns
 // "accepted", "unconfirmed" or "not_attempted". Failures here never undo the
 // new binding.
-async function retireSlot(store, bound) {
+async function retireSlot(store, bound, root) {
   try {
     return await withSlotLock(
       store,
       bound.credential_slot,
       async () => {
-        const record = readOrNull(store, bound.credential_slot);
+        const record = readOrNull(store, bound.credential_slot, root);
+        if (record === null) return "not_attempted";
         let revocation = "not_attempted";
         if (record !== null && record.origin === bound.origin) {
           revocation = await revokeQuietly(endpointsFor(record.origin), record.client_id, record.refresh_token);
@@ -393,9 +444,9 @@ async function retireSlot(store, bound) {
   }
 }
 
-function readOrNull(store, slot) {
+function readOrNull(store, slot, root) {
   try {
-    return readCredential(store, slot);
+    return readProjectCredential(store, slot, root);
   } catch (error) {
     if (error instanceof Stop && error.outcome === "login_required") return null;
     throw error;
@@ -436,10 +487,38 @@ const RECONNECT = {
   kind: "reconnect",
   message: "Run login again with --reconnect to switch this project, or run logout first.",
 };
-const CONNECTED = {
-  kind: "connected",
-  message: 'This project is signed in with Metadata access. Run "metergraph logout" to sign out.',
+const USE_SLUG = {
+  kind: "use_workspace_slug",
+  message:
+    "Run login again with --workspace and the workspace's slug, which its Settings page and " +
+    "\"metergraph context\" show.",
 };
+const SLUG = /^[a-z0-9][a-z0-9-]{1,62}$/;
+
+// A workspace label is service text. If it holds a credential this run knows,
+// it is not printed; sign in itself is unaffected.
+function labelWithout(label, secrets) {
+  const values = [label.slug, label.name].filter((value) => value !== null);
+  const echoes = secrets.some((secret) => typeof secret === "string" && secret.length > 0 &&
+    values.some((value) => value.includes(secret)));
+  return echoes ? { slug: null, name: null } : label;
+}
+
+// The role and permissions a sign in asks for, by the Keys page's labels.
+function accessText(ctx) {
+  if (ctx.role !== "debug") return "the Metadata role";
+  const labels = WORKFLOW_PERMISSIONS.filter(({ scope }) => ctx.scope.split(" ").includes(scope)).map(({ label }) => label);
+  if (labels.length === 0) return "the Debug role";
+  const list = labels.length === 1 ? labels[0] : `${labels.slice(0, -1).join(", ")} and ${labels.at(-1)}`;
+  return `the Debug role with ${list}`;
+}
+
+function connected(ctx) {
+  return {
+    kind: "connected",
+    message: `This project is signed in with ${accessText(ctx)}. Run "metergraph logout" to sign out.`,
+  };
+}
 
 function loginData(ctx, next) {
   return {
@@ -447,8 +526,12 @@ function loginData(ctx, next) {
     runtime: ctx.runtime,
     environment: ctx.environment,
     deployment_profile: ctx.profile,
-    workspace: ctx.workspaceId === null ? null : { id: ctx.workspaceId },
-    scopes: ctx.authenticated ? [METADATA_SCOPE] : [],
+    workspace: ctx.workspaceId === null ? null : { id: ctx.workspaceId, ...ctx.workspaceLabel },
+    access: {
+      role: ctx.role,
+      permissions: Object.fromEntries(WORKFLOW_PERMISSIONS.map(({ field, scope }) => [field, ctx.scope.split(" ").includes(scope)])),
+    },
+    scopes: ctx.authenticated ? ctx.scope.split(" ").sort() : [],
     authenticated: ctx.authenticated,
     configured: ctx.configured,
     status: ctx.status,