niranzwp 0.8.1 → 0.8.3

package/README.md

@@ -31,9 +31,9 @@ client sites, you usually do not have that.
 `niranzwp probe` reports which tiers a site offers before you connect.
 
 ```
-$ niranzwp probe uaestories.com
-UAE Stories -- UAE's first people centric magazine
-  https://uaestories.com
+$ niranzwp probe mysite.com
+My Site -- a WordPress magazine
+  https://mysite.com
   Tier 1 (app passwords): yes
   Tier 2 (abilities):     yes
   MCP endpoint:           yes

package/bin/niranzwp.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { loginWithAppPassword } from '../lib/auth.js';
+import { loginWithAppPassword, loginManual } from '../lib/auth.js';
 import { saveProfile, saveOAuthProfile, getProfile, listProfiles, deleteProfile, storageKind, configDir } from '../lib/store.js';
 import { discover, registerClient, startDeviceFlow, pollForToken } from '../lib/oauth.js';
 import { CliError } from '../lib/errors.js';
@@ -61,7 +61,7 @@ const same = (a, b) => JSON.stringify(decodeEntities(a)) === JSON.stringify(deco
 const USAGE = `NiranzWP CLI v${VERSION} -- a CLI for WordPress
 Built by Niranjan -- https://niranz.dev
 
-  niranzwp auth login <url> [--name <profile>] [--no-open] [--app-password]
+  niranzwp auth login <url> [--name <profile>] [--no-open] [--app-password] [--manual]
   niranzwp auth status [--site <profile>]
   niranzwp auth logout <profile> [--local]   revoke on the site too, unless --local
 
@@ -205,9 +205,27 @@ async function main() {
 			return;
 		}
 
-		const creds = await loginWithAppPassword(site, { open: flags.open !== false });
+		// --manual skips the loopback listener entirely: WordPress shows the
+		// password on its own success page and the user carries it here. The
+		// only route that works when the browser cannot reach this machine --
+		// SSH, a VPS, a phone browser against a CLI running elsewhere.
+		const creds = flags.manual === true
+			? await loginManual(site, { open: flags.open !== false })
+			: await loginWithAppPassword(site, { open: flags.open !== false });
+
+		// A pasted credential can be mistyped, so prove it works before
+		// storing it. The loopback flow's credential came from WordPress
+		// directly and needs no such check, but it costs one request.
 		const name = flags.name || new URL(creds.siteUrl).hostname.replace(/^www\./, '');
 		saveProfile(name, creds);
+		try {
+			await whoami(getProfile(name));
+		} catch (e) {
+			deleteProfile(name);
+			throw new CliError('auth_denied', `The site rejected that credential: ${e.message}`, {
+				hint: 'Check the username, and paste the application password exactly as WordPress showed it (spaces are fine).',
+			});
+		}
 		console.log(`Connected "${name}" -> ${creds.siteUrl} as ${creds.user}`);
 		console.log(`Credential stored in ${storageKind()}.`);
 		console.log(creds.info.tier2

package/lib/auth.js

@@ -1,6 +1,7 @@
 import { createServer } from 'node:http';
 import { execFile } from 'node:child_process';
 import { platform } from 'node:os';
+import { createInterface } from 'node:readline';
 import { probe } from './wp.js';
 
 // WordPress core ships an Application Password authorization screen at
@@ -67,7 +68,10 @@ export async function loginWithAppPassword(siteUrl, { appName = 'NiranzWP CLI',
 
 		const timer = setTimeout(() => {
 			cleanup();
-			reject(new Error('Timed out waiting for authorization.'));
+			reject(new Error(
+				'Timed out waiting for authorization. If the browser is not on this machine ' +
+				'(SSH, a VPS, a container), it cannot reach this listener -- run again with --manual.'
+			));
 		}, timeoutMs);
 
 		function cleanup() {
@@ -92,3 +96,86 @@ export async function loginWithAppPassword(siteUrl, { appName = 'NiranzWP CLI',
 		});
 	});
 }
+
+/**
+ * The loopback flow's blind spot: the browser has to be able to reach this
+ * machine's 127.0.0.1, and over SSH, on a VPS or in a container it cannot.
+ *
+ * WordPress already handles this case itself. Sent to the authorization
+ * screen WITHOUT a success_url, it approves and then displays the generated
+ * password on its own success page -- server-side, in wp-admin, exactly the
+ * "connected" confirmation a person expects. The one manual step left is
+ * carrying that password back here, typed into a prompt that never echoes.
+ */
+export async function loginManual(siteUrl, { appName = 'NiranzWP CLI', open = true } = {}) {
+	const info = await probe(siteUrl);
+
+	if (!info.tier1 || !info.authorizeUrl) {
+		throw new Error(
+			'This site does not advertise Application Passwords. It needs WordPress 5.6+ over HTTPS, ' +
+			'or WP_ENVIRONMENT_TYPE set to "local". A security plugin may also be disabling them.'
+		);
+	}
+
+	const authorize = new URL(info.authorizeUrl);
+	authorize.searchParams.set('app_name', appName);
+
+	console.error('Open this in any browser -- it does not have to be on this machine:');
+	console.error(`  ${authorize}`);
+	console.error('');
+	console.error('Approve the connection. WordPress will show a password on screen;');
+	console.error('copy it and paste it below. It is shown exactly once.');
+	console.error('');
+	if (open) openBrowser(authorize.toString());
+
+	const { user, password } = await promptForCredentials();
+
+	if (!user.trim() || !password.trim()) {
+		throw new Error('A username and a password are both required.');
+	}
+
+	return { siteUrl: siteUrl.replace(/\/+$/, ''), user: user.trim(), password: password.trim(), info };
+}
+
+/**
+ * Both prompts on ONE readline interface.
+ *
+ * Two interfaces in sequence lose data on piped stdin: the first swallows the
+ * whole pipe buffer into its own state and closes, the second sees only EOF,
+ * its callback never fires, and the process exits 0 having done nothing --
+ * which is exactly how this failed in testing. EOF is also an answer a pipe
+ * can give, so it rejects loudly instead of hanging.
+ */
+function promptForCredentials() {
+	return new Promise((resolve, reject) => {
+		const isTTY = process.stdin.isTTY === true;
+		const rl = createInterface({ input: process.stdin, output: process.stderr, terminal: isTTY });
+
+		let done = false;
+		const finish = (fn, value) => {
+			if (done) return;
+			done = true;
+			rl.close();
+			fn(value);
+		};
+
+		rl.on('close', () => finish(reject, new Error('Input ended before both answers were given.')));
+		rl.on('error', (e) => finish(reject, e));
+
+		rl.question('WordPress username: ', (user) => {
+			// Mute the echo for the password -- but only on a real terminal.
+			// On piped input there is no echo to hide, and the muting hook
+			// interferes with readline's buffering.
+			if (isTTY) {
+				process.stderr.write('Application password: ');
+				const write = rl._writeToOutput?.bind(rl);
+				rl._writeToOutput = (str) => {
+					if (str.includes('\n') || str.includes('\r')) write?.('\n');
+				};
+			}
+			rl.question(isTTY ? '' : 'Application password: ', (password) => {
+				finish(resolve, { user, password });
+			});
+		});
+	});
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "niranzwp",
-  "version": "0.8.1",
+  "version": "0.8.3",
   "description": "A CLI for WordPress. Works on any site via Application Passwords, and unlocks Abilities where a site provides them.",
   "type": "module",
   "bin": {