neon 2.43.0 → 2.44.0

package/dist/commands/auth.js

@@ -1,5 +1,8 @@
 import { createHash } from "node:crypto";
-import { existsSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { existsSync, rmSync } from "node:fs";
+import { credentialInputs, displacedProfileWarning, selectCredential, } from "../_shared/auth_selection.js";
+import { API_KEY, interpretCredentials, OAUTH, readCredentials, writeCredentials, } from "../_shared/credentials.js";
+import { assertProfilesUsable, assertValidProfileName, DEFAULT_PROFILE, newProfileCredentialsPath, readProfiles, resolveProfile, selectProfileName, upsertProfile, } from "../_shared/profiles.js";
 import { getApiClient } from "../api.js";
 import { auth, refreshToken } from "../auth.js";
 import { setAuthContext } from "../auth_context.js";
@@ -7,20 +10,19 @@ import { credentialsPath as defaultCredentialsPath } from "../config.js";
 import { isConfigInit, isCurrentBranchProbe, isProfileCommand, } from "../context.js";
 import { isCi } from "../env.js";
 import { log } from "../log.js";
-import { assertValidProfileName, DEFAULT_PROFILE, newProfileCredentialsPath, readProfiles, resolveProfile, selectProfileName, upsertProfile, } from "../profiles.js";
 import { extendTokenSet } from "../utils/auth.js";
 /**
- * The credentials file this invocation reads and writes: the selected profile's, falling
- * back to plain `credentials.json` when no profile was named and none is declared. An
- * unknown profile name is a hard error rather than a silent write to the default file —
- * a typo must not authenticate the wrong account.
+ * The credentials file a named profile resolves to, falling back to plain `credentials.json`
+ * when the name is `DEFAULT` and nothing is declared. An unknown profile name is a hard error
+ * rather than a silent write to the default file — a typo must not authenticate the wrong
+ * account.
  */
-const credentialsPathFor = ({ configDir, profile, }) => {
-    const name = selectProfileName(profile);
-    if (name === DEFAULT_PROFILE && !readProfiles(configDir))
+export const credentialsPathForName = (configDir, name) => {
+    if (name === DEFAULT_PROFILE && !readProfiles(configDir, log.warning))
         return defaultCredentialsPath(configDir);
     return resolveProfile(configDir, name).credentialsPath;
 };
+const credentialsPathFor = ({ configDir, profile, }) => credentialsPathForName(configDir, selectProfileName(profile));
 export const command = "auth";
 export const aliases = ["login"];
 export const describe = "Authenticate";
@@ -35,11 +37,6 @@ export const authFlow = async ({ configDir, oauthHost, clientId, apiHost, forceA
     if (!allowInteractiveAuth && isCi()) {
         throw new Error("Cannot run interactive auth in CI");
     }
-    const tokenSet = await auth({
-        oauthHost: oauthHost,
-        clientId: clientId,
-        allowUnsafeTls,
-    });
     // A named profile that doesn't exist yet is created here rather than erroring: `neon
     // auth --profile work` is how you make one, so it must work before there is anything
     // to look up.
@@ -47,7 +44,16 @@ export const authFlow = async ({ configDir, oauthHost, clientId, apiHost, forceA
     const isNamed = profileName !== DEFAULT_PROFILE;
     if (isNamed)
         assertValidProfileName(profileName);
-    const credentialsPath = isNamed && !readProfiles(configDir)?.profiles[profileName]
+    // Both checks belong before the browser opens. Signing in and then refusing costs a real
+    // sign-in, and worse, the write in between lands on a path chosen from metadata this
+    // refuses to trust.
+    assertProfilesUsable(configDir, profileName);
+    const tokenSet = await auth({
+        oauthHost: oauthHost,
+        clientId: clientId,
+        allowUnsafeTls,
+    });
+    const credentialsPath = isNamed && !readProfiles(configDir, log.warning)?.profiles[profileName]
         ? newProfileCredentialsPath(configDir, profileName)
         : credentialsPathFor({ configDir, profile });
     let identity = {};
@@ -79,17 +85,18 @@ export const authFlow = async ({ configDir, oauthHost, clientId, apiHost, forceA
  */
 const preserveCredentials = async (path, credentials, apiClient) => {
     const { data: { id, email }, } = await apiClient.getCurrentUserInfo();
-    const contents = JSON.stringify({
-        // Cast to a plain record: we intentionally spread the credentials object.
+    // Replace rather than merge, and declare the kind. Signing in makes this an OAuth
+    // credential and nothing of a previous one is carried over: a retained API key would leave
+    // the file holding two credentials, possibly for two different accounts, with a single
+    // field deciding which one is live.
+    const stored = {
         ...credentials,
-        user_id: id,
-    });
-    // Owner-only. A credentials file needs read/write, never execute.
-    writeFileSync(path, contents, {
-        mode: 0o600,
-    });
+        type: OAUTH,
+        ...(id !== undefined ? { user_id: id } : {}),
+    };
+    writeCredentials(path, stored);
     log.debug("Saved credentials to %s", path);
-    log.debug("Credentials MD5 hash: %s", md5hash(contents));
+    log.debug("Credentials MD5 hash: %s", md5hash(JSON.stringify(stored)));
     return { ...(id ? { id } : {}), ...(email ? { email } : {}) };
 };
 const handleExistingToken = async (tokenSet, props, credentialsPath) => {
@@ -133,6 +140,34 @@ const handleExistingToken = async (tokenSet, props, credentialsPath) => {
         throw new Error("AUTH_REFRESH_FAILED");
     }
 };
+/**
+ * The credential a stored file can authenticate with right now — its API key, or an OAuth
+ * access token, refreshed first when it has expired. Never launches a browser.
+ *
+ * The `profile` subcommands need exactly this. They deliberately skip `ensureAuth`, but
+ * `rotate-key` still has to call the API as the account it is rotating, and falling through to
+ * an interactive login would be authenticating something other than what the command is about.
+ */
+export const usableCredential = async (props, at) => {
+    const credentialsPath = at.path;
+    const stored = readCredentials(at);
+    if (stored === null)
+        return null;
+    // A file that declares an unusable kind throws, rather than being reported as "no
+    // credential" — the user needs to know it is broken, not that it is absent.
+    const credential = interpretCredentials(stored, at);
+    if (credential.kind === API_KEY) {
+        return { apiKey: credential.apiKey, kind: API_KEY };
+    }
+    try {
+        const result = await handleExistingToken(stored, props, credentialsPath);
+        return result ? { apiKey: result.apiKey, kind: OAUTH } : null;
+    }
+    catch (err) {
+        log.debug("Could not use the stored OAuth session at %s: %s", credentialsPath, err instanceof Error ? err.message : "unknown error");
+        return null;
+    }
+};
 export const ensureAuth = async (props) => {
     // Skip auth for help command or no command
     if (props._.length === 0 || props.help) {
@@ -167,55 +202,89 @@ export const ensureAuth = async (props) => {
     // `init` manages its own auth flow (asks the user if they have an account,
     // then triggers OAuth at the right time). Skip the global auth middleware.
     const isInit = props._[0] === "init";
-    // Use existing API key or handle auth command
-    if (props.apiKey || props._[0] === "auth") {
-        if (props.apiKey) {
-            log.debug("Using an API key to authorize requests");
-            setAuthContext({
-                source: "api-key",
-                configDir: props.configDir,
-            });
-        }
+    // `auth` writes a credential rather than using one, and reads `--profile` as the
+    // destination to write it to. Running selection here would reject the flag pair it
+    // accepts, and could resolve a stored key that this command must not authenticate with.
+    if (props._[0] === "auth") {
         props.apiClient = getApiClient({
             apiKey: props.apiKey,
             apiHost: props.apiHost,
         });
         return;
     }
-    const credentialsPath = credentialsPathFor(props);
-    // Handle case when credentials file exists
-    if (existsSync(credentialsPath)) {
+    // Throws when `--api-key` and `--profile` are both passed.
+    const selection = selectCredential({
+        ...credentialInputs(),
+        profileFlag: props.profile,
+    });
+    const displaced = displacedProfileWarning(selection);
+    if (displaced !== null) {
+        log.warning(displaced);
+    }
+    if (selection.source !== "profile") {
+        props.apiKey = selection.apiKey;
+        log.debug("Using an API key to authorize requests");
+        setAuthContext({
+            source: "api-key",
+            configDir: props.configDir,
+        });
+        props.apiClient = getApiClient({
+            apiKey: props.apiKey,
+            apiHost: props.apiHost,
+        });
+        return;
+    }
+    // An explicit `--profile` outranks an exported `NEON_API_KEY`, which the middleware has
+    // already folded into `apiKey`. Clear it so nothing downstream — analytics, `dev`'s env
+    // runtime, a re-exec — authenticates with a key this invocation decided against.
+    props.apiKey = "";
+    const credentialsPath = credentialsPathForName(props.configDir, selection.profile);
+    const at = { path: credentialsPath, profile: selection.profile };
+    const stored = readCredentials(at);
+    if (stored !== null) {
         log.debug("Trying to read credentials from %s", credentialsPath);
+        // Throws on a file whose declared kind is unusable. That is deliberate: falling
+        // through to a browser login would replace the credential the user is fixing.
+        const credential = interpretCredentials(stored, at);
+        if (credential.kind === API_KEY) {
+            log.debug('Using profile "%s"\'s API key to authorize requests', selection.profile);
+            props.apiKey = credential.apiKey;
+            setAuthContext({
+                source: "profile-api-key",
+                configDir: props.configDir,
+                profile: selection.profile,
+                credentialsPath,
+            });
+            props.apiClient = getApiClient({
+                apiKey: credential.apiKey,
+                apiHost: props.apiHost,
+            });
+            return;
+        }
         try {
-            const contents = readFileSync(credentialsPath, "utf8");
-            log.debug("Credentials MD5 hash: %s", md5hash(contents));
-            const tokenSet = JSON.parse(contents);
-            // Try to use existing token or refresh it
-            const result = await handleExistingToken(tokenSet, props, credentialsPath);
+            const result = await handleExistingToken(stored, props, credentialsPath);
             if (result) {
                 props.apiKey = result.apiKey;
                 props.apiClient = result.apiClient;
                 setAuthContext({
                     source: "stored-credentials",
                     configDir: props.configDir,
+                    profile: selection.profile,
+                    credentialsPath,
                 });
                 return;
             }
         }
         catch (err) {
-            if (!(err instanceof Error &&
-                err.message === "AUTH_REFRESH_FAILED") &&
-                err.code !== "ENOENT" &&
-                !(err instanceof SyntaxError)) {
-                // Throw for any errors except auth refresh failure, missing file, or invalid credentials file
+            if (!(err instanceof Error && err.message === "AUTH_REFRESH_FAILED")) {
                 throw err;
             }
-            // Fall through to new auth flow for auth failures
+            // A refresh that failed is recoverable by logging in again.
             log.debug("Ensure auth failed, starting authentication", err);
         }
     }
     else {
-        log.debug("Credentials file %s does not exist, starting authentication", credentialsPath);
+        log.debug("No usable credentials at %s, starting authentication", credentialsPath);
     }
     // `dev` never launches the interactive browser flow. With no usable
     // credentials it proceeds without an API client; env injection is skipped
@@ -232,8 +301,10 @@ export const ensureAuth = async (props) => {
         log.debug("init: skipping global auth; init manages its own auth flow");
         return;
     }
-    // Start new auth flow if no valid token exists or refresh failed
-    const apiKey = await authFlow(props);
+    // Start new auth flow if no valid token exists or refresh failed. Pass the resolved
+    // profile rather than the raw flag, so a name that came from `NEON_PROFILE` is written to
+    // its own file instead of overwriting `DEFAULT`'s.
+    const apiKey = await authFlow({ ...props, profile: selection.profile });
     props.apiKey = apiKey;
     props.apiClient = getApiClient({
         apiKey,
@@ -242,20 +313,21 @@ export const ensureAuth = async (props) => {
     setAuthContext({
         source: "stored-credentials",
         configDir: props.configDir,
+        profile: selection.profile,
+        credentialsPath,
     });
 };
 /**
- * Delete the credentials backing a profile — used by the 401 handler to clear a token the
- * API has rejected, so the next command re-authenticates instead of failing again.
+ * Delete one credentials file — used by the 401 handler to clear an OAuth token set the API
+ * has rejected, so the next command logs in again instead of failing the same way.
  *
- * @param configDir Directory the credentials live in
- * @param profile Profile whose credentials to clear. Defaults to the selected one.
+ * It takes the exact path rather than a directory and an optional profile. Deriving the path
+ * here meant re-running selection from partial state, and the 401 handler has no parsed
+ * arguments: it passed only the config directory, so a rejected token on a
+ * `--profile`-selected account deleted whatever `DEFAULT` pointed at — signing the user out
+ * of an account whose credentials the failed request had never touched.
  */
-export const deleteCredentials = (configDir, profile) => {
-    const credentialsPath = credentialsPathFor({
-        configDir,
-        ...(profile ? { profile } : {}),
-    });
+export const deleteCredentialsAt = (credentialsPath) => {
     try {
         if (existsSync(credentialsPath)) {
             rmSync(credentialsPath);

package/dist/commands/bootstrap.js

@@ -3,6 +3,7 @@ import { join, relative, resolve } from "node:path";
 import chalk from "chalk";
 import { BootstrapInputError, ensureTargetUsable, FALLBACK_TEMPLATES, fetchTemplates, findTemplate, scaffoldTemplate, templateIds, } from "neon-init/bootstrap";
 import prompts from "prompts";
+import { credentialInputs } from "../_shared/auth_selection.js";
 import { isCi } from "../env.js";
 import { log } from "../log.js";
 import { detectPackageManager, installedPackageManagers, runCommand, } from "../utils/package_manager.js";
@@ -326,11 +327,23 @@ const selectPackageManager = async () => {
  */
 const runNeonLink = async (props, targetDir) => {
     const args = [process.argv[1], "link"];
-    if (props.apiKey) {
-        args.push("--api-key", props.apiKey);
+    // Forward how to authenticate, never the credential itself. A key on the child's argv is
+    // visible to anything that can list processes, and `runCommand` prints the whole argument
+    // list when the command fails — so a failed link would put the key in the log too.
+    // Forwarding the selection also keeps the child on the same account: without `--profile` it
+    // would resolve its own, and `--config-dir` was never forwarded at all.
+    if (props.configDir) {
+        args.push("--config-dir", props.configDir);
+    }
+    if (props.profile) {
+        args.push("--profile", props.profile);
     }
     args.push("--api-host", props.apiHost, "--output", props.output);
-    await runCommand(process.execPath, args, targetDir);
+    // An explicit `--api-key` has nowhere else to go — the child cannot re-resolve a flag we
+    // were given — so it travels in the environment, which neither `ps` nor our own logging
+    // exposes. A profile needs none of this; the child reads the credential itself.
+    const explicitKey = props.profile ? "" : credentialInputs().apiKeyFlag;
+    await runCommand(process.execPath, args, targetDir, explicitKey ? { NEON_API_KEY: explicitKey } : undefined);
 };
 const printScaffolded = (template, targetDir) => {
     log.info("");

package/dist/commands/init.js

@@ -1,4 +1,5 @@
 import { detectAgent, enrichResponse, interactiveInit, orchestrate, routeDataStep, } from "neon-init";
+import { credentialInputs } from "../_shared/auth_selection.js";
 import { sendError } from "../analytics.js";
 import { log } from "../log.js";
 export const command = "init";
@@ -29,6 +30,22 @@ export const builder = (yargs) => yargs
 })
     .strict(false);
 export const handler = async (argv) => {
+    // `init` delegates its whole auth flow to `neon-init`, which reads the default credentials
+    // directly and re-invokes the CLI as a subprocess. It has no way to be told which profile
+    // to use, so honouring a selection here is not possible yet — and silently running as the
+    // default account would be worse than refusing, because naming an account is the entire
+    // job of the thing being ignored.
+    //
+    // `NEON_PROFILE` counts just as much as the flag. Checking only the flag left the case that
+    // is easier to hit by accident: a profile exported once into a shell then silently
+    // disregarded by every `neon init` run in it.
+    const selectedProfile = argv.profile?.trim() || credentialInputs().profileEnv.trim();
+    if (selectedProfile) {
+        const how = argv.profile?.trim()
+            ? "--profile was passed, so"
+            : "NEON_PROFILE is set, so";
+        throw new Error(`${how} \`neon init\` would run as the default account instead of "${selectedProfile}", and it does not support profile selection yet. Run it without one, or set the project up with \`neon --profile ${selectedProfile} link\`.`);
+    }
     try {
         // Auto-detect agent from environment. When --agent is explicitly passed,
         // always detect (the user asked for agent mode). Otherwise, require