miravo 0.4.0 → 0.6.0

package/src/lib/admin-client.ts

@@ -10,6 +10,7 @@ import {
   EngineStateSnapshotSchema,
   MiravoError,
 } from "@miravo/shared";
+import { loadCredential } from "./auth-store.ts";
 
 const DEFAULT_ADMIN_HOST = "127.0.0.1";
 const DEFAULT_ADMIN_PORT = 8080;
@@ -87,19 +88,67 @@ function parseAdminUrl(input: string): string {
   return url.toString().replace(/\/$/, "");
 }
 
-function buildRequestHeaders(body?: string): Record<string, string> | undefined {
+// ---------------------------------------------------------------------------
+// Session-based auth for CLI client
+// ---------------------------------------------------------------------------
+
+let sessionCookie: string | null = null;
+
+async function loginToAdmin(adminUrl: string): Promise<void> {
+  // Resolve password: env > file > default
+  const envPassword = Bun.env["MIRAVO_ADMIN_PASSWORD"];
+  let password = "admin";
+  if (envPassword && envPassword.trim().length > 0) {
+    password = envPassword;
+  } else {
+    const credential = await loadCredential();
+    // If credential file exists, we can't reverse the hash — use "admin" as default.
+    // The server will verify against the stored hash. If the user changed their password,
+    // they need to set MIRAVO_ADMIN_PASSWORD env var for CLI access.
+    if (!credential) {
+      password = "admin";
+    }
+  }
+
+  const response = await fetch(`${adminUrl}/auth/login`, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ username: "admin", password }),
+    signal: AbortSignal.timeout(10_000),
+  });
+
+  if (!response.ok) {
+    throw new MiravoError(
+      "CLI authentication failed.",
+      "Set MIRAVO_ADMIN_PASSWORD or log in with default credentials (admin/admin).",
+    );
+  }
+
+  const setCookie = response.headers.get("set-cookie");
+  if (setCookie) {
+    // Extract just the cookie value (before first ;)
+    sessionCookie = setCookie.split(";")[0] ?? null;
+  }
+}
+
+async function ensureAuthenticated(adminUrl: string): Promise<void> {
+  if (sessionCookie) return;
+  await loginToAdmin(adminUrl);
+}
+
+function buildRequestHeaders(body?: string): Record<string, string> {
   const headers: Record<string, string> = {};
   if (body) {
     headers["content-type"] = "application/json";
   }
-  const adminToken = Bun.env["MIRAVO_ADMIN_TOKEN"];
-  if (adminToken && adminToken.trim().length > 0) {
-    headers["authorization"] = `Bearer ${adminToken}`;
+  if (sessionCookie) {
+    headers["cookie"] = sessionCookie;
   }
-  return Object.keys(headers).length > 0 ? headers : undefined;
+  return headers;
 }
 
 async function requestJson<T>(options: RequestJsonOptions<T>): Promise<T> {
+  await ensureAuthenticated(options.baseUrl);
   const requestUrl = new URL(options.path, `${options.baseUrl}/`).toString();
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), options.timeoutMs);
@@ -128,6 +177,18 @@ async function requestJson<T>(options: RequestJsonOptions<T>): Promise<T> {
       );
     }
 
+    // Re-authenticate on session expiry and retry once
+    if (response.status === 401) {
+      sessionCookie = null;
+      await loginToAdmin(options.baseUrl);
+      response = await fetch(requestUrl, {
+        method: options.method ?? "GET",
+        headers: buildRequestHeaders(options.body),
+        body: options.body,
+        signal: controller.signal,
+      });
+    }
+
     const text = await response.text();
     let parsedJson: unknown;
     if (text.length > 0) {
@@ -223,4 +284,43 @@ async function executeAdminCommand(
   });
 }
 
-export { executeAdminCommand, getAdminMetrics, getAdminSnapshot, getAdminState, resolveAdminUrl };
+/** Schema that accepts any JSON object — used for adapter introspection (protocol-specific shape). */
+const AnyObjectSchema = {
+  safeParse(value: unknown): SafeParseResult<Record<string, unknown>> {
+    if (typeof value === "object" && value !== null && !Array.isArray(value)) {
+      return { success: true, data: value as Record<string, unknown> };
+    }
+    return { success: false };
+  },
+};
+
+async function getManifest(adminUrl: string, timeoutMs: number): Promise<Record<string, unknown>> {
+  return requestJson({
+    baseUrl: adminUrl,
+    path: "/manifest",
+    timeoutMs,
+    schema: AnyObjectSchema,
+  });
+}
+
+async function getLeDtJson(
+  adminUrl: string,
+  modelName: string,
+  timeoutMs: number,
+): Promise<Record<string, unknown>> {
+  return requestJson({
+    baseUrl: adminUrl,
+    path: `/catalog/models/${encodeURIComponent(modelName)}/le-dt.json`,
+    timeoutMs,
+    schema: AnyObjectSchema,
+  });
+}
+
+export {
+  executeAdminCommand,
+  getAdminSnapshot,
+  getAdminState,
+  getLeDtJson,
+  getManifest,
+  resolveAdminUrl,
+};