nukebase 0.0.1 → 2.0.1

package/lib/credentials.js

@@ -0,0 +1,118 @@
+// ~/.nukebase/credentials.json — every account signed in on this machine,
+// keyed by uid. A project's sys/config.json says which uid owns it; the token
+// for that uid lives here and never inside a project folder.
+//
+//   {
+//     "version": 1,
+//     "default": "<uid>",            used only outside a project
+//     "accounts": {
+//       "<uid>": { "label": "you@example.com", "api": "https://usw4.nukebase.com",
+//                  "token": "...", "method": "browser", "created": 0, "lastUsed": 0 }
+//     }
+//   }
+//
+// Several terminals may run at once (pushes to different accounts in
+// parallel), so every write re-reads the file, changes one entry, writes a
+// temporary file and renames it over the original. Reads never lock.
+
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+const DIR = process.env.NUKEBASE_HOME || path.join(os.homedir(), '.nukebase');
+const FILE = path.join(DIR, 'credentials.json');
+const LAST_USED_EVERY_MS = 60 * 60 * 1000;
+
+function empty() {
+  return { version: 1, default: null, accounts: {} };
+}
+
+function load() {
+  try {
+    const data = JSON.parse(fs.readFileSync(FILE, 'utf8'));
+    if (!data || typeof data !== 'object' || typeof data.accounts !== 'object') return empty();
+    return data;
+  } catch (e) {
+    return empty();
+  }
+}
+
+function sleepSync(ms) {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+
+// Apply `change` to a fresh read and write the result atomically.
+function edit(change) {
+  fs.mkdirSync(DIR, { recursive: true, mode: 0o700 });
+  const data = load();
+  change(data);
+  const tmp = `${FILE}.${process.pid}.${Date.now()}.tmp`;
+  fs.writeFileSync(tmp, JSON.stringify(data, null, 2) + '\n', { mode: 0o600 });
+  // Windows refuses a rename onto a file another process has open for a
+  // moment; a few short retries ride that out.
+  for (let attempt = 0; ; attempt++) {
+    try { fs.renameSync(tmp, FILE); break; } catch (e) {
+      if (attempt >= 20 || !['EPERM', 'EACCES', 'EBUSY'].includes(e.code)) {
+        try { fs.unlinkSync(tmp); } catch {}
+        throw e;
+      }
+      sleepSync(25);
+    }
+  }
+  return data;
+}
+
+function list() {
+  const data = load();
+  return Object.entries(data.accounts).map(([uid, a]) => ({ uid, ...a, isDefault: data.default === uid }));
+}
+
+function get(uid) {
+  const a = uid ? load().accounts[uid] : null;
+  return a ? { uid, ...a } : null;
+}
+
+// By uid, or by label (email or username), case-insensitive.
+function find(query) {
+  if (!query) return null;
+  const data = load();
+  if (data.accounts[query]) return { uid: query, ...data.accounts[query] };
+  const q = String(query).toLowerCase();
+  const hit = Object.entries(data.accounts).find(([, a]) => String(a.label || '').toLowerCase() === q);
+  return hit ? { uid: hit[0], ...hit[1] } : null;
+}
+
+function getDefault() {
+  const data = load();
+  if (data.default && data.accounts[data.default]) return { uid: data.default, ...data.accounts[data.default] };
+  const uids = Object.keys(data.accounts);
+  return uids.length === 1 ? { uid: uids[0], ...data.accounts[uids[0]] } : null;
+}
+
+function put(uid, entry) {
+  return edit((data) => {
+    data.accounts[uid] = { ...(data.accounts[uid] || {}), ...entry };
+    if (!data.default || !data.accounts[data.default]) data.default = uid;
+  });
+}
+
+function remove(uid) {
+  return edit((data) => {
+    delete data.accounts[uid];
+    if (data.default === uid) data.default = Object.keys(data.accounts)[0] || null;
+  });
+}
+
+function setDefault(uid) {
+  return edit((data) => { if (data.accounts[uid]) data.default = uid; });
+}
+
+// Pushes only read this file; "last used" is written at most once an hour so
+// ten parallel pushes don't queue up on it.
+function touch(uid) {
+  const a = get(uid);
+  if (!a || Date.now() - (a.lastUsed || 0) < LAST_USED_EVERY_MS) return;
+  try { edit((data) => { if (data.accounts[uid]) data.accounts[uid].lastUsed = Date.now(); }); } catch {}
+}
+
+module.exports = { FILE, list, get, find, getDefault, put, remove, setDefault, touch };

package/lib/login.js

@@ -0,0 +1,173 @@
+// The ways `nukebase login` gets a CLI token. Each returns
+// { uid, token, label } for credentials.put().
+//
+//   browser     open /cli-auth.html, approve, a one-time code comes back to a
+//               local server, swapped (with a PKCE secret) for the token
+//   device      a short code to type on the website, for SSH / no browser
+//   emailLink   the email sign-in link, delivered back to a local server
+//   password    username + password (the master account)
+//
+// The last two get an ordinary session first and swap it at /cli/exchange,
+// which also signs that session out.
+
+const http = require('http');
+const os = require('os');
+const crypto = require('crypto');
+const { openBrowser, hostOf } = require('./ui');
+
+const LOGIN_TIMEOUT_MS = 5 * 60 * 1000;
+
+const deviceName = () => os.hostname() || 'Unknown device';
+const b64url = (buf) => buf.toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+
+function page(mark, title, message, accent) {
+  return `<!doctype html><meta charset="utf-8"><title>NukeBase</title><body style="font-family:-apple-system,Segoe UI,Roboto,Helvetica,Arial,sans-serif;background:#f1f5f9;margin:0;">
+    <div style="max-width:420px;margin:80px auto;background:#fff;border:1px solid #e2e8f0;border-radius:14px;padding:36px;text-align:center;">
+      <div style="font-size:18px;font-weight:800;color:#0f172a;letter-spacing:-0.3px;">&#9670; NukeBase</div>
+      <div style="font-size:40px;margin:16px 0 8px;color:${accent};">${mark}</div>
+      <h1 style="font-size:20px;color:#0f172a;margin:0 0 8px;">${title}</h1>
+      <p style="color:#475569;margin:0;font-size:15px;">${message}</p>
+    </div></body>`;
+}
+
+// A one-shot server on 127.0.0.1 for the browser to come back to. Resolves
+// with the callback's query once one arrives carrying the right state.
+function startLoopback(state) {
+  return new Promise((resolveStart, rejectStart) => {
+    let finish;
+    const result = new Promise((res, rej) => { finish = { res, rej }; });
+    const server = http.createServer((req, res) => {
+      const url = new URL(req.url, 'http://127.0.0.1');
+      if (url.pathname !== '/callback') { res.writeHead(404); return res.end(); }
+      const q = Object.fromEntries(url.searchParams);
+      if (q.state !== state) {
+        res.writeHead(400, { 'Content-Type': 'text/html; charset=utf-8' });
+        return res.end(page('✕', 'Sign-in error', 'This sign-in could not be verified. Return to your terminal and try again.', '#dc2626'));
+      }
+      const denied = q.error === 'access_denied';
+      res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+      res.end(denied
+        ? page('✕', 'Cancelled', 'The CLI was not signed in. You can close this tab.', '#64748b')
+        : page('✓', 'CLI signed in', 'You can close this tab and return to your terminal.', '#16a34a'));
+      clearTimeout(timer);
+      server.close();
+      finish.res(q);
+    });
+    const timer = setTimeout(() => { server.close(); finish.rej(new Error('No response within 5 minutes. Run nukebase login again.')); }, LOGIN_TIMEOUT_MS);
+    server.on('error', rejectStart);
+    server.listen(0, '127.0.0.1', () => resolveStart({ port: server.address().port, result }));
+  });
+}
+
+async function postJson(url, body, cookie) {
+  const headers = { 'Content-Type': 'application/json' };
+  if (cookie) headers.Cookie = cookie;
+  let res;
+  try {
+    res = await fetch(url, { method: 'POST', headers, body: JSON.stringify(body || {}) });
+  } catch (e) {
+    throw new Error(`Could not reach ${hostOf(url)} (${e.cause?.message || e.message})`);
+  }
+  let data = {};
+  try { data = await res.json(); } catch {}
+  return { status: res.status, ok: res.ok, data };
+}
+
+// A server from before CLI sign-in answers 404 (or the static 404 page).
+function needsNewerServer(r, api) {
+  if (r.status === 404 && !r.data.error) {
+    throw new Error(`${hostOf(api)} doesn't support CLI sign-in yet. Try again after it's updated.`);
+  }
+}
+
+async function browser(api, { email } = {}) {
+  const state = b64url(crypto.randomBytes(24));
+  const verifier = b64url(crypto.randomBytes(32));
+  const challenge = b64url(crypto.createHash('sha256').update(verifier).digest());
+  const { port, result } = await startLoopback(state);
+
+  const url = new URL(`${api}/cli-auth.html`);
+  url.searchParams.set('port', String(port));
+  url.searchParams.set('state', state);
+  url.searchParams.set('challenge', challenge);
+  url.searchParams.set('device', deviceName());
+  if (email) url.searchParams.set('email', email);
+
+  console.log('\n  Opening your browser to approve this CLI. If it doesn\'t open, visit:');
+  console.log(`  ${url}\n`);
+  console.log('  Waiting for approval…  (Ctrl+C to cancel)');
+  openBrowser(url.toString());
+
+  // The usual reason for a long wait: no account yet, so no sign-in email
+  // ever arrives (the server doesn't say which addresses have accounts).
+  const hint = setTimeout(() => {
+    console.log(`\n  Still waiting. No account yet? Sign up at ${api}/start.html first, then run this again.`);
+  }, 90 * 1000);
+  hint.unref();
+  const q = await result.finally(() => clearTimeout(hint));
+  if (q.error) throw new Error('Sign-in was cancelled in the browser.');
+  if (!q.code) throw new Error('The browser did not return a sign-in code.');
+  const r = await postJson(`${api}/cli/token`, { code: q.code, verifier });
+  needsNewerServer(r, api);
+  if (!r.ok) throw new Error(r.data.error || `Sign-in failed (${r.status})`);
+  return r.data;
+}
+
+async function device(api) {
+  const start = await postJson(`${api}/cli/device-start`, { device: deviceName() });
+  needsNewerServer(start, api);
+  if (!start.ok) throw new Error(start.data.error || `Could not start sign-in (${start.status})`);
+  const { deviceCode, userCode, verifyUrl, interval = 5, expiresIn = 600 } = start.data;
+
+  console.log('\n  On any device, open:');
+  console.log(`    ${verifyUrl}`);
+  console.log('  and enter this code:\n');
+  console.log(`    ${userCode}\n`);
+  console.log(`  Waiting for approval…  (expires in ${Math.round(expiresIn / 60)} minutes)`);
+
+  let wait = Math.max(interval, 2) * 1000;
+  const deadline = Date.now() + expiresIn * 1000;
+  while (Date.now() < deadline) {
+    await new Promise(r => setTimeout(r, wait));
+    const r = await postJson(`${api}/cli/device-poll`, { deviceCode });
+    if (r.status === 410) throw new Error('The code expired. Run nukebase login --device again.');
+    if (!r.ok) throw new Error(r.data.error || `Sign-in failed (${r.status})`);
+    if (r.data.status === 'slow_down') { wait += 1000; continue; }
+    if (r.data.status === 'approved') return { uid: r.data.uid, token: r.data.token, label: r.data.label };
+  }
+  throw new Error('The code expired. Run nukebase login --device again.');
+}
+
+// Swap an ordinary session for a CLI token, then sign the session out.
+async function exchange(api, uid, token) {
+  const r = await postJson(`${api}/cli/exchange`, { device: deviceName(), revokeCurrent: true }, `uid=${uid}; token=${token}`);
+  needsNewerServer(r, api);
+  if (r.status === 401) throw new Error('That sign-in is no longer valid.');
+  if (!r.ok) throw new Error(r.data.error || `Sign-in failed (${r.status})`);
+  return r.data;
+}
+
+async function emailLink(api, email) {
+  const state = crypto.randomBytes(16).toString('hex');
+  const { port, result } = await startLoopback(state);
+  const r = await postJson(`${api}/magic-link`, { email, redirectUri: `http://127.0.0.1:${port}/callback`, state });
+  if (r.data.status !== 'Success') throw new Error(r.data.message || 'Could not send the sign-in link.');
+
+  console.log(`\n  ✉  Sign-in link sent to ${email} (if it has a NukeBase account).`);
+  console.log('     Open it in a browser on this computer.');
+  console.log('\n  Waiting for the link to be clicked…  (expires in 5 minutes)');
+  const q = await result;
+  if (!q.uid || !q.token) throw new Error('The sign-in link did not return a session.');
+  return exchange(api, q.uid, q.token);
+}
+
+async function password(api, username, pass) {
+  const r = await postJson(`${api}/login`, { username, password: pass });
+  if (r.data.status !== 'Success' || !r.data.uid || !r.data.token) {
+    throw new Error(r.data.message || 'Sign-in failed');
+  }
+  const out = await exchange(api, r.data.uid, r.data.token);
+  return { ...out, label: out.label || username };
+}
+
+module.exports = { browser, device, emailLink, password, exchange, deviceName };