moontraze 1.0.6 → 1.0.8

package/lib/auth.js

@@ -1,7 +1,5 @@
 const prompts = require('prompts');
 const chalk = require('chalk');
-const http = require('http');
-const { URL } = require('url');
 const { getConfig, setConfig } = require('./config');
 
 async function login(tokenArg, options = {}) {
@@ -10,10 +8,8 @@ async function login(tokenArg, options = {}) {
     process.env.MOON_API ||
     getConfig().apiUrl ||
     'https://api.moontraze.com';
-
   const label = process.env.MOON_LABEL || process.env.MOON_PLATFORM || 'Moontraze';
 
-  // --token (hidden power user)
   if (tokenArg && String(tokenArg).trim()) {
     return saveAndValidateToken(String(tokenArg).trim(), { apiUrl, label });
   }
@@ -72,31 +68,47 @@ async function loginWithEmail({ apiUrl, label }) {
   });
 
   const data = await res.json().catch(() => ({}));
-
   if (!res.ok) throw new Error(data.error || 'Invalid email or password');
   if (!data.token) throw new Error('Login succeeded but no token returned');
 
   setConfig({ token: data.token, apiUrl });
-
   console.log('');
   console.log(chalk.green('✓ Logged in'));
-  if (data.user?.email) console.log(chalk.gray(`  ${data.user.email}`));
-  console.log(chalk.gray(`  Config: ~/.moontraze/config.json`));
+  if (data.user?.email) console.log(chalk.gray(` ${data.user.email}`));
+  console.log(chalk.gray(` Config: ~/.moontraze/config.json`));
   console.log('');
 }
 
 async function loginWithMoonID({ apiUrl, label }) {
-  const state = Math.random().toString(36).substring(2, 12);
-  const port = 17321 + Math.floor(Math.random() * 100);
-  const redirectUri = `http://127.0.0.1:${port}/callback`;
-  const appId = 'com.moonstorage.app';
+  const fetch = require('node-fetch');
+  const nonce = Math.random().toString(36).substring(2, 12);
+  const state = `${nonce}.login`;
 
+  // ★ Same flow as website (working)
+  const startRes = await fetch(`${apiUrl}/api/platform/moonid/web-start`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ state, action: 'login' }),
+  });
+  const startData = await startRes.json().catch(() => ({}));
+  if (!startRes.ok) {
+    throw new Error(startData.error || 'Could not start MoonID session');
+  }
+
+  const notifyUrl = `${apiUrl}/api/platform/moonid/web-complete`;
+  const redirectUri = `${apiUrl}/api/platform/moonid/done?state=${encodeURIComponent(
+    state
+  )}`;
+
+  const appId = 'com.moonstorage.app';
   const deepLink =
     `moonid://auth` +
     `?app_id=${encodeURIComponent(appId)}` +
     `&action=login` +
     `&redirect_uri=${encodeURIComponent(redirectUri)}` +
-    `&state=${encodeURIComponent(state)}`;
+    `&notify_url=${encodeURIComponent(notifyUrl)}` +
+    `&state=${encodeURIComponent(state)}` +
+    `&source=cli`;
 
   const qrImageUrl = `https://api.qrserver.com/v1/create-qr-code/?size=220x220&data=${encodeURIComponent(
     deepLink
@@ -105,7 +117,7 @@ async function loginWithMoonID({ apiUrl, label }) {
   console.log('');
   console.log(chalk.cyan(`${label} — MoonID Login`));
   console.log(chalk.gray('1. Open MoonID app on your phone'));
-  console.log(chalk.gray('2. Scan the QR code (open link below in browser)'));
+  console.log(chalk.gray('2. Scan the QR code (open the link below in a browser if needed)'));
   console.log(chalk.gray('3. Approve login'));
   console.log('');
   console.log(chalk.yellow('QR code image:'));
@@ -114,75 +126,45 @@ async function loginWithMoonID({ apiUrl, label }) {
   console.log(chalk.gray('Waiting for approval... (Ctrl+C to cancel)'));
   console.log('');
 
-  const token = await waitForMoonIDCallback({ port, state, timeoutMs: 120000 });
+  const token = await pollWebStatus({ apiUrl, state, timeoutMs: 180000 });
   if (!token) throw new Error('MoonID login timed out or denied');
 
   await saveAndValidateToken(token, { apiUrl, label });
 }
 
-function waitForMoonIDCallback({ port, state, timeoutMs }) {
-  return new Promise((resolve) => {
-    const server = http.createServer((req, res) => {
-      try {
-        const u = new URL(req.url, `http://127.0.0.1:${port}`);
-        if (u.pathname !== '/callback') {
-          res.writeHead(404);
-          res.end('Not found');
-          return;
-        }
-
-        const returnedState = u.searchParams.get('state');
-        const token =
-          u.searchParams.get('token') ||
-          u.searchParams.get('access_token') ||
-          u.searchParams.get('jwt');
-        const error = u.searchParams.get('error');
-
-        if (error) {
-          res.writeHead(200, { 'Content-Type': 'text/html' });
-          res.end(
-            '<html><body style="font-family:sans-serif;text-align:center;padding:40px"><h2>Login denied</h2><p>You can close this tab.</p></body></html>'
-          );
-          server.close();
-          resolve(null);
-          return;
-        }
-
-        if (returnedState && returnedState !== state) {
-          res.writeHead(400, { 'Content-Type': 'text/plain' });
-          res.end('Invalid state');
-          return;
-        }
-
-        if (!token) {
-          res.writeHead(400, { 'Content-Type': 'text/html' });
-          res.end(
-            '<html><body style="font-family:sans-serif;text-align:center;padding:40px"><h2>No token received</h2></body></html>'
-          );
-          return;
-        }
-
-        res.writeHead(200, { 'Content-Type': 'text/html' });
-        res.end(
-          '<html><body style="font-family:sans-serif;text-align:center;padding:40px"><h2>✓ Login successful</h2><p>You can close this tab.</p></body></html>'
-        );
-        server.close();
-        resolve(token);
-      } catch {
-        res.writeHead(500);
-        res.end('Error');
+async function pollWebStatus({ apiUrl, state, timeoutMs }) {
+  const fetch = require('node-fetch');
+  const start = Date.now();
+  const interval = 2000;
+
+  while (Date.now() - start < timeoutMs) {
+    await new Promise((r) => setTimeout(r, interval));
+    try {
+      const res = await fetch(
+        `${apiUrl}/api/platform/moonid/status?state=${encodeURIComponent(state)}`
+      );
+      const data = await res.json().catch(() => ({}));
+
+      // web endpoint returns status: "success"
+      if (
+        (data.status === 'success' || data.status === 'done') &&
+        data.token
+      ) {
+        return data.token;
       }
-    });
-
-    server.listen(port, '127.0.0.1');
-    const timer = setTimeout(() => {
-      try {
-        server.close();
-      } catch (_) {}
-      resolve(null);
-    }, timeoutMs);
-    server.on('close', () => clearTimeout(timer));
-  });
+      if (data.status === 'error' || data.status === 'denied') {
+        throw new Error(data.error || 'MoonID login denied');
+      }
+    } catch (e) {
+      if (
+        e.message &&
+        /denied|failed|not found|mismatch|expired|signup/i.test(e.message)
+      ) {
+        throw e;
+      }
+    }
+  }
+  return null;
 }
 
 async function saveAndValidateToken(token, { apiUrl, label }) {
@@ -190,16 +172,13 @@ async function saveAndValidateToken(token, { apiUrl, label }) {
   const res = await fetch(`${apiUrl}/api/hosting/quota`, {
     headers: { Authorization: `Bearer ${token}` },
   });
-
   if (res.status === 401) {
     throw new Error('Invalid or expired token');
   }
-
   setConfig({ token, apiUrl });
-
   console.log('');
   console.log(chalk.green('✓ Logged in'));
-  console.log(chalk.gray(`  Config: ~/.moontraze/config.json`));
+  console.log(chalk.gray(` Config: ~/.moontraze/config.json`));
   console.log('');
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "moontraze",
-  "version": "1.0.6",
+  "version": "1.0.8",
   "description": "Deploy to Moontraze hosting — like vercel CLI",
   "bin": {
     "moon": "./bin/moon.js",