nimblybase 0.1.5 → 0.1.6

package/README.md

@@ -30,7 +30,14 @@ keychain on macOS, and otherwise in
 `~/.config/nimblybase/credentials.json` with permissions `0600`. `nimbly
 login` always says which one it used.
 
-For a machine without a browser, create an access token in the dashboard
+For a machine without a local browser, run `nimbly login --device`. Open the
+displayed verification page on another device and enter the short code. The
+dashboard shows the requesting client and approved workspace/scopes. The CLI
+waits at the server's polling interval, backs off on slow-down, and stops on
+denial or expiry. A failed attempt keeps your previous login. Device sign-in
+still requires a person; it is not unattended CI authentication.
+
+For an explicit pasted-token fallback, create an access token in the dashboard
 under **Access tokens** and run `nimbly login --token <token>`. Omitting the
 value prompts without echoing it.
 

package/dist/index.js

@@ -68,6 +68,7 @@ function parse(argv) {
         spa: { type: "boolean" },
         build: { type: "boolean" },
         "token-only": { type: "boolean" },
+        device: { type: "boolean" },
         off: { type: "boolean" },
         using: { type: "string" },
         check: { type: "string" },
@@ -140,6 +141,7 @@ function parse(argv) {
       spa: v.spa === true ? true : void 0,
       build: v.build === true ? true : void 0,
       tokenOnly: v["token-only"] === true ? true : void 0,
+      device: v.device === true ? true : void 0,
       off: v.off === true ? true : void 0,
       using: v.using,
       check: v.check,
@@ -182,7 +184,8 @@ USAGE
   nimbly <command> [options]
 
 GETTING STARTED
-  login                    Sign in with an access token from the dashboard
+  login                    Sign in through your browser; --device for another machine
+                           --token-only is the explicit pasted-PAT fallback
   init [name]              Create or explicitly choose a project for this repo
   describe                 Show what the linked project's backend can do
   architect [requirements] Inspect this repo and propose a reviewable architecture
@@ -370,7 +373,7 @@ function when(iso) {
 
 // src/api.ts
 var DEFAULT_API_URL = "https://api-uat.nimblybase.com";
-var VERSION = "0.1.5";
+var VERSION = "0.1.6";
 function dashboardUrl(api) {
   const match = /^https:\/\/api(-[a-z0-9]+)?\.(.+)$/.exec(api);
   return match ? `https://app${match[1] ?? ""}.${match[2]}` : null;
@@ -660,7 +663,7 @@ async function discover(issuer, fetchImpl = fetch) {
   if (!doc.authorization_endpoint || !doc.token_endpoint) {
     throw new Error("the authorization server metadata is missing an endpoint this flow needs");
   }
-  for (const endpoint of [doc.token_endpoint, doc.registration_endpoint].filter(Boolean)) {
+  for (const endpoint of [doc.token_endpoint, doc.registration_endpoint, doc.device_authorization_endpoint].filter(Boolean)) {
     const target = new URL(endpoint);
     if (target.origin !== origin || target.username || target.password || target.hash) {
       throw new Error("the authorization server advertises a credential endpoint outside its API origin");
@@ -782,6 +785,57 @@ function grantResponse(body, clientId) {
     scopes: String(body.scope ?? "").split(" ").filter(Boolean)
   };
 }
+async function deviceLogin(input, fetchImpl = fetch) {
+  const doc = await discover(input.issuer, fetchImpl);
+  if (!doc.device_authorization_endpoint || !doc.registration_endpoint) {
+    throw new Error("this server does not offer device sign-in and client registration");
+  }
+  const clientId = await registerClient(doc.registration_endpoint, fetchImpl);
+  const start = await fetchImpl(doc.device_authorization_endpoint, {
+    method: "POST",
+    redirect: "error",
+    signal: AbortSignal.timeout(3e4),
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({ client_id: clientId }).toString()
+  });
+  if (!start.ok) throw new Error("device sign-in could not be started");
+  const device = await start.json();
+  if (typeof device.device_code !== "string" || !/^nb_oat_[A-Za-z0-9_-]+$/.test(device.device_code) || typeof device.user_code !== "string" || !/^[A-Z0-9]{4}-[A-Z0-9]{4}$/.test(device.user_code) || typeof device.verification_uri !== "string" || typeof device.expires_in !== "number" || !Number.isInteger(device.expires_in) || device.expires_in < 1 || device.expires_in > 900 || device.interval !== void 0 && (!Number.isInteger(device.interval) || device.interval < 1 || device.interval > 60)) {
+    throw new Error("the server returned an invalid device authorization response");
+  }
+  const verification = new URL(device.verification_uri);
+  if (verification.origin !== new URL(doc.authorization_endpoint).origin || verification.username || verification.password || verification.search || verification.hash) {
+    throw new Error("the device verification page is outside the authorization origin");
+  }
+  const now = input.now ?? (() => performance.now());
+  const sleep = input.sleep ?? ((ms) => new Promise((resolve8) => setTimeout(resolve8, ms)));
+  const deadline = now() + device.expires_in * 1e3;
+  let interval = Math.max(5, device.interval ?? 5) * 1e3;
+  input.announce({ verificationUri: verification.toString(), userCode: device.user_code, expiresInSeconds: device.expires_in });
+  while (now() < deadline) {
+    await sleep(Math.min(interval, Math.max(0, deadline - now())));
+    const remaining = deadline - now();
+    if (remaining <= 0) break;
+    const poll = await fetchImpl(doc.token_endpoint, {
+      method: "POST",
+      redirect: "error",
+      signal: AbortSignal.timeout(Math.min(3e4, remaining)),
+      headers: { "content-type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({ grant_type: "urn:ietf:params:oauth:grant-type:device_code", client_id: clientId, device_code: device.device_code }).toString()
+    });
+    const body = await poll.json();
+    if (poll.ok) return grantResponse(body, clientId);
+    if (body.error === "authorization_pending") continue;
+    if (body.error === "slow_down") {
+      interval += 5e3;
+      continue;
+    }
+    if (body.error === "access_denied") throw new Error("you declined device sign-in; your previous login was kept");
+    if (body.error === "expired_token") break;
+    throw new Error("device sign-in failed; your previous login was kept");
+  }
+  throw new Error("device sign-in expired; your previous login was kept");
+}
 async function refreshGrant(input, fetchImpl = fetch) {
   const res = await fetchImpl(input.tokenEndpoint, {
     method: "POST",
@@ -1269,8 +1323,17 @@ var WHERE_SAID = {
 async function login(flags) {
   const base = apiUrl(flags.api);
   const given = flags.token ?? await readPipedInput();
+  if (flags.device && (given || flags.tokenOnly)) throw new CliError("Choose device sign-in or a pasted token, not both.", EXIT.usage);
   if (!given && !flags.tokenOnly) {
-    const grant = await browserLogin({
+    const grant = flags.device ? await deviceLogin({
+      issuer: base,
+      announce: ({ verificationUri, userCode, expiresInSeconds }) => {
+        note(`On another device, open:
+  ${verificationUri}
+Enter code: ${userCode}
+It expires in ${expiresInSeconds} seconds. Approve only the CLI request you started.`);
+      }
+    }) : await browserLogin({
       issuer: base,
       announce: (url) => {
         out("Opening your browser to sign in.");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nimblybase",
-  "version": "0.1.5",
+  "version": "0.1.6",
   "description": "The NimblyBase command line - projects, keys and backends from a terminal.",
   "license": "UNLICENSED",
   "repository": {