niranzwp 0.8.2 → 0.8.4

package/bin/niranzwp.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { loginWithAppPassword } from '../lib/auth.js';
+import { loginWithAppPassword, loginManual } from '../lib/auth.js';
 import { saveProfile, saveOAuthProfile, getProfile, listProfiles, deleteProfile, storageKind, configDir } from '../lib/store.js';
 import { discover, registerClient, startDeviceFlow, pollForToken } from '../lib/oauth.js';
 import { CliError } from '../lib/errors.js';
@@ -61,7 +61,7 @@ const same = (a, b) => JSON.stringify(decodeEntities(a)) === JSON.stringify(deco
 const USAGE = `NiranzWP CLI v${VERSION} -- a CLI for WordPress
 Built by Niranjan -- https://niranz.dev
 
-  niranzwp auth login <url> [--name <profile>] [--no-open] [--app-password]
+  niranzwp auth login <url> [--name <profile>] [--no-open] [--app-password] [--manual]
   niranzwp auth status [--site <profile>]
   niranzwp auth logout <profile> [--local]   revoke on the site too, unless --local
 
@@ -164,7 +164,7 @@ const out = (flags, value, pretty) => {
 
 async function main() {
 	const { _: pos, flags } = parseArgs(process.argv.slice(2));
-	const [cmd, sub, ...rest] = pos;
+	let [cmd, sub, ...rest] = pos;
 
 	if (flags.version || cmd === 'version') {
 		console.log(`NiranzWP CLI v${VERSION}`);
@@ -174,6 +174,11 @@ async function main() {
 
 	if (!cmd || flags.help || cmd === 'help') { console.log(USAGE); return; }
 
+	// The first outside user's first command was "posts list". Plurals are
+	// what people type; refusing them over one letter is a papercut with no
+	// upside, so both forms work and the docs keep showing the singular.
+	cmd = { posts: 'post', pages: 'page', users: 'user', medias: 'media', setting: 'settings', site: 'sites' }[cmd] ?? cmd;
+
 	if (cmd === 'auth' && sub === 'login') {
 		const url = rest[0];
 		if (!url) die('usage: niranzwp auth login <url>');
@@ -205,9 +210,27 @@ async function main() {
 			return;
 		}
 
-		const creds = await loginWithAppPassword(site, { open: flags.open !== false });
+		// --manual skips the loopback listener entirely: WordPress shows the
+		// password on its own success page and the user carries it here. The
+		// only route that works when the browser cannot reach this machine --
+		// SSH, a VPS, a phone browser against a CLI running elsewhere.
+		const creds = flags.manual === true
+			? await loginManual(site, { open: flags.open !== false })
+			: await loginWithAppPassword(site, { open: flags.open !== false });
+
+		// A pasted credential can be mistyped, so prove it works before
+		// storing it. The loopback flow's credential came from WordPress
+		// directly and needs no such check, but it costs one request.
 		const name = flags.name || new URL(creds.siteUrl).hostname.replace(/^www\./, '');
 		saveProfile(name, creds);
+		try {
+			await whoami(getProfile(name));
+		} catch (e) {
+			deleteProfile(name);
+			throw new CliError('auth_denied', `The site rejected that credential: ${e.message}`, {
+				hint: 'Check the username, and paste the application password exactly as WordPress showed it (spaces are fine).',
+			});
+		}
 		console.log(`Connected "${name}" -> ${creds.siteUrl} as ${creds.user}`);
 		console.log(`Credential stored in ${storageKind()}.`);
 		console.log(creds.info.tier2

package/lib/auth.js

@@ -1,6 +1,7 @@
 import { createServer } from 'node:http';
 import { execFile } from 'node:child_process';
 import { platform } from 'node:os';
+import { createInterface } from 'node:readline';
 import { probe } from './wp.js';
 
 // WordPress core ships an Application Password authorization screen at
@@ -67,7 +68,10 @@ export async function loginWithAppPassword(siteUrl, { appName = 'NiranzWP CLI',
 
 		const timer = setTimeout(() => {
 			cleanup();
-			reject(new Error('Timed out waiting for authorization.'));
+			reject(new Error(
+				'Timed out waiting for authorization. If the browser is not on this machine ' +
+				'(SSH, a VPS, a container), it cannot reach this listener -- run again with --manual.'
+			));
 		}, timeoutMs);
 
 		function cleanup() {
@@ -92,3 +96,86 @@ export async function loginWithAppPassword(siteUrl, { appName = 'NiranzWP CLI',
 		});
 	});
 }
+
+/**
+ * The loopback flow's blind spot: the browser has to be able to reach this
+ * machine's 127.0.0.1, and over SSH, on a VPS or in a container it cannot.
+ *
+ * WordPress already handles this case itself. Sent to the authorization
+ * screen WITHOUT a success_url, it approves and then displays the generated
+ * password on its own success page -- server-side, in wp-admin, exactly the
+ * "connected" confirmation a person expects. The one manual step left is
+ * carrying that password back here, typed into a prompt that never echoes.
+ */
+export async function loginManual(siteUrl, { appName = 'NiranzWP CLI', open = true } = {}) {
+	const info = await probe(siteUrl);
+
+	if (!info.tier1 || !info.authorizeUrl) {
+		throw new Error(
+			'This site does not advertise Application Passwords. It needs WordPress 5.6+ over HTTPS, ' +
+			'or WP_ENVIRONMENT_TYPE set to "local". A security plugin may also be disabling them.'
+		);
+	}
+
+	const authorize = new URL(info.authorizeUrl);
+	authorize.searchParams.set('app_name', appName);
+
+	console.error('Open this in any browser -- it does not have to be on this machine:');
+	console.error(`  ${authorize}`);
+	console.error('');
+	console.error('Approve the connection. WordPress will show a password on screen;');
+	console.error('copy it and paste it below. It is shown exactly once.');
+	console.error('');
+	if (open) openBrowser(authorize.toString());
+
+	const { user, password } = await promptForCredentials();
+
+	if (!user.trim() || !password.trim()) {
+		throw new Error('A username and a password are both required.');
+	}
+
+	return { siteUrl: siteUrl.replace(/\/+$/, ''), user: user.trim(), password: password.trim(), info };
+}
+
+/**
+ * Both prompts on ONE readline interface.
+ *
+ * Two interfaces in sequence lose data on piped stdin: the first swallows the
+ * whole pipe buffer into its own state and closes, the second sees only EOF,
+ * its callback never fires, and the process exits 0 having done nothing --
+ * which is exactly how this failed in testing. EOF is also an answer a pipe
+ * can give, so it rejects loudly instead of hanging.
+ */
+function promptForCredentials() {
+	return new Promise((resolve, reject) => {
+		const isTTY = process.stdin.isTTY === true;
+		const rl = createInterface({ input: process.stdin, output: process.stderr, terminal: isTTY });
+
+		let done = false;
+		const finish = (fn, value) => {
+			if (done) return;
+			done = true;
+			rl.close();
+			fn(value);
+		};
+
+		rl.on('close', () => finish(reject, new Error('Input ended before both answers were given.')));
+		rl.on('error', (e) => finish(reject, e));
+
+		rl.question('WordPress username: ', (user) => {
+			// Mute the echo for the password -- but only on a real terminal.
+			// On piped input there is no echo to hide, and the muting hook
+			// interferes with readline's buffering.
+			if (isTTY) {
+				process.stderr.write('Application password: ');
+				const write = rl._writeToOutput?.bind(rl);
+				rl._writeToOutput = (str) => {
+					if (str.includes('\n') || str.includes('\r')) write?.('\n');
+				};
+			}
+			rl.question(isTTY ? '' : 'Application password: ', (password) => {
+				finish(resolve, { user, password });
+			});
+		});
+	});
+}

package/lib/errors.js

@@ -68,8 +68,13 @@ export function fromRest(status, body, fallback = 'usage_error') {
 		// capability failure, so keep the two hints apart.
 		const scoped = /route|scope/i.test(String(body?.message ?? ''));
 		return new CliError('insufficient_scope', body?.message || 'Not permitted.', {
+			// The first outside session hit this and the old hint only
+			// explained the problem. A hint that names no way forward is a
+			// dead end wearing a helpful tone.
 			hint: scoped
-				? 'This token is scoped to a different endpoint. Novamira OAuth tokens work against its MCP endpoint, not the core abilities run route.'
+				? 'This profile\'s OAuth token only covers its provider\'s own routes (abilities, MCP), not core REST. ' +
+				  'For core commands (post, page, media, settings), connect the same site with an application password: ' +
+				  'niranzwp auth login <site> --app-password --name <new-profile> (add --manual if the browser is on another machine).'
 				: 'This credential belongs to a user without the required capability.',
 		});
 	}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "niranzwp",
-  "version": "0.8.2",
+  "version": "0.8.4",
   "description": "A CLI for WordPress. Works on any site via Application Passwords, and unlocks Abilities where a site provides them.",
   "type": "module",
   "bin": {