neonctl 2.28.0 → 2.29.0

package/dist/commands/auth.js

@@ -1,26 +1,26 @@
-import { existsSync, readFileSync, writeFileSync, rmSync } from 'node:fs';
-import { join } from 'node:path';
-import { createHash } from 'node:crypto';
-import { getApiClient } from '../api.js';
-import { auth, refreshToken } from '../auth.js';
-import { isCurrentBranchProbe } from '../context.js';
-import { CREDENTIALS_FILE } from '../config.js';
-import { isCi } from '../env.js';
-import { log } from '../log.js';
-import { extendTokenSet } from '../utils/auth.js';
-export const command = 'auth';
-export const aliases = ['login'];
-export const describe = 'Authenticate';
-export const builder = (yargs) => yargs.option('context-file', {
+import { createHash } from "node:crypto";
+import { existsSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { getApiClient } from "../api.js";
+import { auth, refreshToken } from "../auth.js";
+import { CREDENTIALS_FILE } from "../config.js";
+import { isConfigInit, isCurrentBranchProbe } from "../context.js";
+import { isCi } from "../env.js";
+import { log } from "../log.js";
+import { extendTokenSet } from "../utils/auth.js";
+export const command = "auth";
+export const aliases = ["login"];
+export const describe = "Authenticate";
+export const builder = (yargs) => yargs.option("context-file", {
     hidden: true,
 });
 export const handler = async (args) => {
     await authFlow(args);
 };
-export const authFlow = async ({ configDir, oauthHost, clientId, apiHost, forceAuth, 'force-auth': forceAuthKebab, allowUnsafeTls, }) => {
+export const authFlow = async ({ configDir, oauthHost, clientId, apiHost, forceAuth, "force-auth": forceAuthKebab, allowUnsafeTls, }) => {
     const allowInteractiveAuth = forceAuth ?? forceAuthKebab;
     if (!allowInteractiveAuth && isCi()) {
-        throw new Error('Cannot run interactive auth in CI');
+        throw new Error("Cannot run interactive auth in CI");
     }
     const tokenSet = await auth({
         oauthHost: oauthHost,
@@ -30,16 +30,16 @@ export const authFlow = async ({ configDir, oauthHost, clientId, apiHost, forceA
     const credentialsPath = join(configDir, CREDENTIALS_FILE);
     try {
         await preserveCredentials(credentialsPath, tokenSet, getApiClient({
-            apiKey: tokenSet.access_token || '',
+            apiKey: tokenSet.access_token || "",
             apiHost,
         }));
     }
     catch {
-        log.error('Failed to save credentials');
-        return '';
+        log.error("Failed to save credentials");
+        return "";
     }
-    log.info('Auth complete');
-    return tokenSet.access_token || '';
+    log.info("Auth complete");
+    return tokenSet.access_token || "";
 };
 const preserveCredentials = async (path, credentials, apiClient) => {
     const { data: { id }, } = await apiClient.getCurrentUserInfo();
@@ -52,13 +52,13 @@ const preserveCredentials = async (path, credentials, apiClient) => {
     writeFileSync(path, contents, {
         mode: 0o700,
     });
-    log.debug('Saved credentials to %s', path);
-    log.debug('Credentials MD5 hash: %s', md5hash(contents));
+    log.debug("Saved credentials to %s", path);
+    log.debug("Credentials MD5 hash: %s", md5hash(contents));
 };
 const handleExistingToken = async (tokenSet, props, credentialsPath) => {
     // Use existing access_token, if present and valid
     if (tokenSet.access_token && tokenSet.expires_at > Date.now()) {
-        log.debug('Using existing valid access_token');
+        log.debug("Using existing valid access_token");
         const apiClient = getApiClient({
             apiKey: tokenSet.access_token,
             apiHost: props.apiHost,
@@ -67,10 +67,10 @@ const handleExistingToken = async (tokenSet, props, credentialsPath) => {
     }
     // Either access_token is missing or its expired. Refresh the token
     log.debug(tokenSet.expires_at < Date.now()
-        ? 'Token is expired, attempting refresh'
-        : 'Token is missing access_token, attempting refresh');
+        ? "Token is expired, attempting refresh"
+        : "Token is missing access_token, attempting refresh");
     if (!tokenSet.refresh_token) {
-        log.debug('TokenSet is missing refresh_token, starting authentication');
+        log.debug("TokenSet is missing refresh_token, starting authentication");
         return null;
     }
     try {
@@ -87,13 +87,13 @@ const handleExistingToken = async (tokenSet, props, credentialsPath) => {
             apiHost: props.apiHost,
         });
         await preserveCredentials(credentialsPath, extendedTokenSet, apiClient);
-        log.debug('Token refresh successful');
+        log.debug("Token refresh successful");
         return { apiKey, apiClient };
     }
     catch (err) {
-        const typedErr = err instanceof Error ? err : new Error('Unknown error');
-        log.debug('Failed to refresh token: %s', typedErr.message);
-        throw new Error('AUTH_REFRESH_FAILED');
+        const typedErr = err instanceof Error ? err : new Error("Unknown error");
+        log.debug("Failed to refresh token: %s", typedErr.message);
+        throw new Error("AUTH_REFRESH_FAILED");
     }
 };
 export const ensureAuth = async (props) => {
@@ -107,23 +107,28 @@ export const ensureAuth = async (props) => {
     if (isCurrentBranchProbe(props)) {
         return;
     }
+    // `config init` only scaffolds a neon.ts and installs npm packages locally; it
+    // never calls the Neon API, so skip auth entirely — no token refresh, no login.
+    if (isConfigInit(props)) {
+        return;
+    }
     // `dev` runs a function locally. It injects the selected branch's env vars
     // when credentials happen to be available, but must never trigger an
     // interactive login: use an API key or existing stored credentials if
     // present, otherwise run with no API client (env injection is skipped).
-    const isLocalDev = props._[0] === 'dev';
+    const isLocalDev = props._[0] === "dev";
     // `bootstrap` only copies a public template repo; it never calls the Neon
     // API, so it must work without credentials and must never pop a browser
     // login. It uses an API key / stored credentials when present (harmless),
     // otherwise it proceeds with no API client.
-    const isBootstrap = props._[0] === 'bootstrap';
+    const isBootstrap = props._[0] === "bootstrap";
     // `init` manages its own auth flow (asks the user if they have an account,
     // then triggers OAuth at the right time). Skip the global auth middleware.
-    const isInit = props._[0] === 'init';
+    const isInit = props._[0] === "init";
     // Use existing API key or handle auth command
-    if (props.apiKey || props._[0] === 'auth') {
+    if (props.apiKey || props._[0] === "auth") {
         if (props.apiKey) {
-            log.debug('Using an API key to authorize requests');
+            log.debug("Using an API key to authorize requests");
         }
         props.apiClient = getApiClient({
             apiKey: props.apiKey,
@@ -134,10 +139,10 @@ export const ensureAuth = async (props) => {
     const credentialsPath = join(props.configDir, CREDENTIALS_FILE);
     // Handle case when credentials file exists
     if (existsSync(credentialsPath)) {
-        log.debug('Trying to read credentials from %s', credentialsPath);
+        log.debug("Trying to read credentials from %s", credentialsPath);
         try {
-            const contents = readFileSync(credentialsPath, 'utf8');
-            log.debug('Credentials MD5 hash: %s', md5hash(contents));
+            const contents = readFileSync(credentialsPath, "utf8");
+            log.debug("Credentials MD5 hash: %s", md5hash(contents));
             const tokenSet = JSON.parse(contents);
             // Try to use existing token or refresh it
             const result = await handleExistingToken(tokenSet, props, credentialsPath);
@@ -148,32 +153,33 @@ export const ensureAuth = async (props) => {
             }
         }
         catch (err) {
-            if (!(err instanceof Error && err.message === 'AUTH_REFRESH_FAILED') &&
-                err.code !== 'ENOENT' &&
+            if (!(err instanceof Error &&
+                err.message === "AUTH_REFRESH_FAILED") &&
+                err.code !== "ENOENT" &&
                 !(err instanceof SyntaxError)) {
                 // Throw for any errors except auth refresh failure, missing file, or invalid credentials file
                 throw err;
             }
             // Fall through to new auth flow for auth failures
-            log.debug('Ensure auth failed, starting authentication', err);
+            log.debug("Ensure auth failed, starting authentication", err);
         }
     }
     else {
-        log.debug('Credentials file %s does not exist, starting authentication', credentialsPath);
+        log.debug("Credentials file %s does not exist, starting authentication", credentialsPath);
     }
     // `dev` never launches the interactive browser flow. With no usable
     // credentials it proceeds without an API client; env injection is skipped
     // and the function still runs locally.
     if (isLocalDev) {
-        log.debug('dev: no usable credentials; running without env injection');
+        log.debug("dev: no usable credentials; running without env injection");
         return;
     }
     if (isBootstrap) {
-        log.debug('bootstrap: no usable credentials; continuing without auth');
+        log.debug("bootstrap: no usable credentials; continuing without auth");
         return;
     }
     if (isInit) {
-        log.debug('init: skipping global auth; init manages its own auth flow');
+        log.debug("init: skipping global auth; init manages its own auth flow");
         return;
     }
     // Start new auth flow if no valid token exists or refresh failed
@@ -193,16 +199,16 @@ export const deleteCredentials = (configDir) => {
     try {
         if (existsSync(credentialsPath)) {
             rmSync(credentialsPath);
-            log.info('Deleted credentials from %s', credentialsPath);
+            log.info("Deleted credentials from %s", credentialsPath);
         }
         else {
-            log.debug('Credentials file %s does not exist', credentialsPath);
+            log.debug("Credentials file %s does not exist", credentialsPath);
         }
     }
     catch (err) {
-        const typedErr = err instanceof Error ? err : new Error('Unknown error');
-        log.error('Failed to delete credentials: %s', typedErr.message);
-        throw new Error('CREDENTIALS_DELETE_FAILED');
+        const typedErr = err instanceof Error ? err : new Error("Unknown error");
+        log.error("Failed to delete credentials: %s", typedErr.message);
+        throw new Error("CREDENTIALS_DELETE_FAILED");
     }
 };
-const md5hash = (s) => createHash('md5').update(s).digest('hex');
+const md5hash = (s) => createHash("md5").update(s).digest("hex");