omnibiofex 2.8.5 → 4.0.0

package/src/auth.js

@@ -1,415 +1,215 @@
-const http = require('http');
-const { URL } = require('url');
-const axios = require('axios');
 const chalk = require('chalk');
-const inquirer = require('inquirer');
-const Conf = require('conf');
-const { sendSignInLinkToEmail } = require('firebase/auth');
-const { app, auth, db } = require('./firebase');
-
-// Use the shared auth instance
-const config = new Conf({
-  projectName: 'omnibiofex',
-  schema: {
-    token: { type: 'string' },
-    refreshToken: { type: 'string' },
-    expiresAt: { type: 'number' }
-  }
-});
-
-const LOCAL_PORT = 8765;
-const CALLBACK_PATH = '/auth/callback';
-
-async function login() {
-  console.log(chalk.hex('#F24E1E')('\n🔐 OmniBioFex X Authentication\n'));
-  
-  if (isAuthenticated()) {
-    const { confirm } = await inquirer.prompt([{
-      type: 'confirm',
-      name: 'confirm',
-      message: 'You are already logged in. Login again?',
-      default: false
-    }]);
-    if (!confirm) {
-      console.log(chalk.gray('Login cancelled.'));
-      return;
-    }
-    // Clear old tokens
-    config.delete('authToken');
-    config.delete('refreshToken');
-    config.delete('tokenExpiry');
-  }
-
-  const { email } = await inquirer.prompt([{
-    type: 'input',
-    name: 'email',
-    message: 'Enter your email:',
-    validate: (input) => {
-      const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
-      return emailRegex.test(input) || 'Please enter a valid email';
-    }
-  }]);
-
-  console.log(chalk.gray('\n📧 Sending magic link...'));
-
-  let server = null;
-  let spinner = null;
-  let timeout = null;
-
-  try {
-    server = startLocalServer();
-
-    const actionCodeSettings = {
-      url: `https://x.omnibiofex.cloud/auth?cli=true`,
-      handleCodeInApp: true
-    };
-
-    await sendSignInLinkToEmail(auth, email, actionCodeSettings);
-
-    config.set('pendingEmail', email);
-    config.set('pendingLogin', true);
-
-    console.log(chalk.green(`\n✓ Magic link sent to ${email}`));
-    console.log(chalk.gray('\n📬 Check your inbox and click the link to complete login.'));
-    console.log(chalk.gray('⏳ Waiting for authentication... (press Ctrl+C to cancel)\n'));
-
-    const frames = ['⠋', '⠙', '⠹', '⠸', '⠼', '⠴', '⠦', '⠧', '⠇', '⠏'];
-    let i = 0;
-    spinner = setInterval(() => {
-      process.stdout.write(`\r${chalk.hex('#F24E1E')(frames[i])} ${chalk.gray('Waiting for magic link click...')}`);
-      i = (i + 1) % frames.length;
-    }, 80);
-
-    timeout = setTimeout(() => {
-      cleanup();
-      console.log(chalk.red('\n\n✗ Authentication timed out. Please try again.'));
-      config.delete('pendingLogin');
-      config.delete('pendingEmail');
-      process.exit(1);
-    }, 5 * 60 * 1000);
-
-    const authData = await waitForAuth();
-    
-    cleanup();
-
-    if (authData && authData.token) {
-      // 🔥 Validate token format before storing
-      if (!authData.token.startsWith('eyJ')) {
-        throw new Error('Invalid token format received');
-      }
+const http = require('http');
+const url = require('url');
+const open = require('open');
+const user = require('./user');
 
-      config.set('authToken', authData.token);
-      if (authData.refreshToken) {
-        config.set('refreshToken', authData.refreshToken);
-      }
-      config.set('userEmail', email);
-      config.set('tokenExpiry', Date.now() + (55 * 60 * 1000)); // 55 minutes
-      config.delete('pendingLogin');
-      config.delete('pendingEmail');
-      
-      console.log(chalk.green('\n\n✓ Successfully authenticated!'));
-      console.log(chalk.hex('#F24E1E')(`\n🎉 Welcome to OmniBioFex X, ${email}!`));
-      console.log(chalk.gray('You can now use all CLI commands.\n'));
-      
-      process.exit(0);
-    } else {
-      throw new Error('No authentication data received');
-    }
+const FIREBASE_CONFIG = {
+  apiKey: "AIzaSyDlgXId4pLlYqm-MDuhfz3dLH24KBRHkw8",
+  authDomain: "x.omnibiofex.cloud",
+  projectId: "omnibiofex-x"
+};
 
-  } catch (error) {
-    cleanup();
-    console.error(chalk.red(`\n✗ Authentication failed: ${error.message}`));
-    config.delete('pendingLogin');
-    config.delete('pendingEmail');
-    process.exit(1);
-  }
+const GOOGLE_CLIENT_ID = "292246591666-bc9jk6astsk1rha03cmuulda66db7c1q.apps.googleusercontent.com";
+const GOOGLE_CLIENT_SECRET = "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";
+const REDIRECT_URI = "http://localhost:8765/callback";
+const SCOPES = "openid email profile";
 
-  function cleanup() {
-    if (spinner) {
-      clearInterval(spinner);
-      spinner = null;
-      process.stdout.write('\n');
-    }
-    if (timeout) {
-      clearTimeout(timeout);
-      timeout = null;
-    }
-    if (server) {
-      server.close();
-      server = null;
-    }
-  }
+function isAuthenticated() {
+  const token = user.getToken();
+  return !!token && !user.isTokenExpired();
 }
 
-function startLocalServer() {
-  const server = http.createServer((req, res) => {
-    const url = new URL(req.url, `http://localhost:${LOCAL_PORT}`);
-    
-    if (url.pathname === '/favicon.ico') {
-      res.writeHead(204);
-      res.end();
-      return;
-    }
-    
-    console.log('Local server received request:', req.url);
-    
-    if (url.pathname === CALLBACK_PATH) {
-      let token = url.searchParams.get('token');
-      let refreshToken = url.searchParams.get('refreshToken');
-      const error = url.searchParams.get('error');
-
-      if (token && token.includes(' ')) {
-        console.log(chalk.yellow('⚠️  Token contains spaces, fixing...'));
-        token = token.replace(/ /g, '+');
-      }
-      
-      if (refreshToken && refreshToken.includes(' ')) {
-        refreshToken = refreshToken.replace(/ /g, '+');
-      }
-
-      if (token) {
-        console.log('✓ Received auth token from browser');
-        console.log('Token length:', token.length);
-        console.log('Token starts with:', token.substring(0, 20));
-        
-        if (!token.startsWith('eyJ')) {
-          console.error('✗ Invalid token format');
-          res.writeHead(400, { 'Content-Type': 'text/html' });
-          res.end('<h1>Invalid Token</h1><p>The authentication token is malformed.</p>');
-          global._authData = null;
-          return;
+async function getAuthToken() {
+  let token = user.getToken();
+  const refreshToken = user.getRefreshToken();
+  
+  if (!token) throw new Error('Not authenticated. Please run: obx login');
+  
+  if (user.isTokenExpired() && refreshToken) {
+    try {
+      console.log(chalk.gray('🔄 Refreshing authentication token...'));
+      const response = await fetch(
+        `https://securetoken.googleapis.com/v1/token?key=${FIREBASE_CONFIG.apiKey}`,
+        {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+          body: `grant_type=refresh_token&refresh_token=${refreshToken}`
         }
+      );
+      
+      if (response.ok) {
+        const data = await response.json();
+        const parts = data.id_token.split('.');
+        const payload = JSON.parse(
+          Buffer.from(parts[1].replace(/-/g, '+').replace(/_/g, '/'), 'base64').toString('utf8')
+        );
         
-        res.writeHead(200, { 'Content-Type': 'text/html' });
-        res.end(`
-          <!DOCTYPE html>
-          <html>
-          <head>
-            <title>OmniBioFex X - Authentication Successful</title>
-            <style>
-              body { font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif; 
-                     background: #F4F4F0; color: #0F0F0F; display: flex; align-items: center; 
-                     justify-content: center; min-height: 100vh; margin: 0; 
-                     background-image: radial-gradient(#E0E0DB 1px, transparent 1px); 
-                     background-size: 40px 40px; }
-              .card { background: white; border: 1px solid #E0E0DB; padding: 48px; 
-                      max-width: 500px; text-align: center; }
-              .check { width: 64px; height: 64px; border-radius: 50%; background: #10b981; 
-                       color: white; font-size: 32px; display: flex; align-items: center; 
-                       justify-content: center; margin: 0 auto 24px; }
-              h1 { margin: 0 0 12px; font-size: 24px; }
-              p { color: #737373; margin: 0 0 24px; }
-            </style>
-          </head>
-          <body>
-            <div class="card">
-              <div class="check">✓</div>
-              <h1>Authentication Successful!</h1>
-              <p>You can close this window and return to your terminal.</p>
-            </div>
-          </body>
-          </html>
-        `);
-        
-        global._authData = { token, refreshToken };
+        user.setToken(data.id_token, data.refresh_token,
+          data.expires_in ? Math.floor(Date.now()/1000) + parseInt(data.expires_in) : null,
+          { email: payload.email, uid: payload.user_id || payload.sub, name: payload.name }
+        );
+        token = data.id_token;
+        console.log(chalk.green('✓ Token refreshed successfully!'));
       } else {
-        console.error('✗ No token received, error:', error);
-        res.writeHead(200, { 'Content-Type': 'text/html' });
-        res.end(`
-          <!DOCTYPE html>
-          <html>
-          <head>
-            <title>Authentication Failed</title>
-            <style>
-              body { font-family: sans-serif; background: #F4F4F0; display: flex; 
-                     align-items: center; justify-content: center; min-height: 100vh; margin: 0; }
-              .card { background: white; padding: 48px; text-align: center; border: 1px solid #E0E0DB; }
-              h1 { color: #F24E1E; }
-            </style>
-          </head>
-          <body>
-            <div class="card">
-              <h1>Authentication Failed</h1>
-              <p>${error || 'Unknown error'}</p>
-            </div>
-          </body>
-          </html>
-        `);
-        global._authData = null;
+        throw new Error('Token refresh failed');
       }
-    } else {
-      res.writeHead(404);
-      res.end('Not found');
+    } catch (error) {
+      throw new Error('Token refresh failed. Please run: obx login');
     }
-  });
+  }
+  
+  return token;
+}
 
-  server.listen(LOCAL_PORT, () => {
-    console.log(`Local auth server listening on port ${LOCAL_PORT}`);
+function buildGoogleAuthUrl() {
+  const params = new URLSearchParams({
+    client_id: GOOGLE_CLIENT_ID,
+    redirect_uri: REDIRECT_URI,
+    response_type: 'code',
+    scope: SCOPES,
+    access_type: 'offline',
+    prompt: 'consent'
   });
-
-  return server;
+  return `https://accounts.google.com/o/oauth2/v2/auth?${params.toString()}`;
 }
 
-function waitForAuth() {
-  return new Promise((resolve) => {
-    const checkInterval = setInterval(() => {
-      if (global._authData !== undefined) {
-        clearInterval(checkInterval);
-        const authData = global._authData;
-        delete global._authData;
-        resolve(authData);
-      }
-    }, 500);
+async function exchangeGoogleCode(code) {
+  const response = await fetch('https://oauth2.googleapis.com/token', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+    body: new URLSearchParams({
+      code, client_id: GOOGLE_CLIENT_ID, client_secret: GOOGLE_CLIENT_SECRET,
+      redirect_uri: REDIRECT_URI, grant_type: 'authorization_code'
+    })
   });
+  if (!response.ok) {
+    const error = await response.json();
+    throw new Error(error.error_description || 'Failed to exchange code');
+  }
+  return await response.json();
 }
 
-async function refreshAuthToken() {
-  const refreshToken = config.get('refreshToken');
-  
-  if (!refreshToken) {
-    throw new Error('No refresh token available. Please login again.');
+async function signInWithGoogle(googleIdToken, googleAccessToken) {
+  const response = await fetch(
+    `https://identitytoolkit.googleapis.com/v1/accounts:signInWithIdp?key=${FIREBASE_CONFIG.apiKey}`,
+    {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        postBody: `id_token=${googleIdToken}&providerId=google.com&access_token=${googleAccessToken}`,
+        requestUri: REDIRECT_URI,
+        returnIdpCredential: true,
+        returnSecureToken: true
+      })
+    }
+  );
+  if (!response.ok) {
+    const error = await response.json();
+    throw new Error(error.error?.message || 'Failed to sign in with Google');
   }
+  return await response.json();
+}
 
-  try {
-    console.log(chalk.gray('🔄 Refreshing authentication token...'));
+async function login() {
+  console.log(chalk.hex('#F24E1E')('\n═══════════════════════════════════════════════════════════'));
+  console.log(chalk.white.bold('🔐 OmniBioFex X Authentication'));
+  console.log(chalk.hex('#F24E1E')('═══════════════════════════════════════════════════════════\n'));
+
+  if (isAuthenticated()) {
+    const email = user.getCurrentUserEmail();
+    const name = user.getCurrentUserName();
+    console.log(chalk.gray(`  Currently logged in as: ${chalk.white(name || email || 'Unknown')}\n`));
+    
+    const inquirer = require('inquirer');
+    const { relogin } = await inquirer.prompt([{
+      type: 'confirm', name: 'relogin',
+      message: 'Login with a different Google account?', default: false
+    }]);
     
-    const apiKey = app.options.apiKey; // Get API key from the shared Firebase app
+    if (!relogin) { console.log(chalk.yellow('Login cancelled.')); return; }
+    user.clearTokens();
+  }
 
-    const response = await axios.post(
-      `https://securetoken.googleapis.com/v1/token?key=${apiKey}`,
-      new URLSearchParams({
-        grant_type: 'refresh_token',
-        refresh_token: refreshToken
-      }).toString(),
-      {
-        headers: {
-          'Content-Type': 'application/x-www-form-urlencoded'
+  console.log(chalk.gray('🌐 Opening Google sign-in in your browser...\n'));
+  const authUrl = buildGoogleAuthUrl();
+  let timeoutId = null;
+  
+  const server = http.createServer(async (req, res) => {
+    const parsedUrl = url.parse(req.url, true);
+    
+    if (parsedUrl.pathname === '/callback') {
+      const { code, error } = parsedUrl.query;
+      
+      if (error) {
+        res.writeHead(400, { 'Content-Type': 'text/html' });
+        res.end(`<html><body style="font-family:sans-serif;text-align:center;padding:50px;"><h1 style="color:#EF4444;">✗ Auth Failed</h1><p>${error}</p></body></html>`);
+        if (timeoutId) clearTimeout(timeoutId);
+        server.close(() => { console.error(chalk.red(`✗ Error: ${error}`)); process.exit(1); });
+        return;
+      }
+      
+      if (code) {
+        try {
+          console.log(chalk.gray('🔄 Exchanging authorization code...'));
+          const googleTokens = await exchangeGoogleCode(code);
+          console.log(chalk.gray('🔄 Signing in with Firebase...'));
+          const firebaseResponse = await signInWithGoogle(googleTokens.id_token, googleTokens.access_token);
+          
+          const expiresIn = parseInt(firebaseResponse.expiresIn);
+          user.setToken(firebaseResponse.idToken, firebaseResponse.refreshToken,
+            Math.floor(Date.now()/1000) + expiresIn,
+            { email: firebaseResponse.email, uid: firebaseResponse.localId, name: firebaseResponse.displayName }
+          );
+          
+          res.writeHead(200, { 'Content-Type': 'text/html' });
+          res.end(`<html><body style="font-family:sans-serif;text-align:center;padding:50px;background:#F3EFE0;"><h1 style="color:#10B981;">✓ Success!</h1><p>Welcome, ${firebaseResponse.displayName || firebaseResponse.email}!</p><p>You can close this window.</p></body></html>`);
+          
+          console.log(chalk.green('\n✓ Successfully authenticated with Google!'));
+          console.log(chalk.hex('#F24E1E')(`\n🎉 Welcome to OmniBioFex X, ${firebaseResponse.displayName || firebaseResponse.email}!`));
+          console.log(chalk.gray('You can now use all CLI commands.\n'));
+          
+          if (timeoutId) clearTimeout(timeoutId);
+          server.close(() => process.exit(0));
+        } catch (error) {
+          res.writeHead(500, { 'Content-Type': 'text/html' });
+          res.end(`<html><body style="font-family:sans-serif;text-align:center;padding:50px;"><h1 style="color:#EF4444;">✗ Failed</h1><p>${error.message}</p></body></html>`);
+          if (timeoutId) clearTimeout(timeoutId);
+          server.close(() => { console.error(chalk.red(`\n✗ Failed: ${error.message}`)); process.exit(1); });
         }
       }
-    );
-
-    const { id_token, refresh_token, expires_in } = response.data;
-
-    if (!id_token || !id_token.startsWith('eyJ')) {
-      throw new Error('Invalid token received from refresh endpoint');
     }
+  });
 
-    config.set('authToken', id_token);
-    config.set('refreshToken', refresh_token);
-    config.set('tokenExpiry', Date.now() + ((expires_in - 300) * 1000));
-
-    console.log(chalk.green('✓ Token refreshed successfully!'));
-    return id_token;
-  } catch (error) {
-    console.error(chalk.red('✗ Failed to refresh token:', error.message));
-    throw new Error('Token refresh failed. Please login again.');
-  }
-}
-
-function logout() {
-  config.delete('authToken');
-  config.delete('refreshToken');
-  config.delete('userId');
-  config.delete('userEmail');
-  config.delete('tokenExpiry');
-  console.log(chalk.green('✓ Logged out successfully'));
-  process.exit(0);
-}
-
-function isAuthenticated() {
-  return config.get('authToken') !== null;
-}
-
-function isTokenExpired() {
-  const expiry = config.get('tokenExpiry');
-  if (!expiry) return true;
-  return Date.now() >= expiry;
-}
+  server.listen(8765, () => {
+    console.log(chalk.gray('  Local auth server listening on http://localhost:8765'));
+    open(authUrl).catch(() => {
+      console.log(chalk.gray('  If browser didn\'t open, visit:'));
+      console.log(chalk.blue(`  ${authUrl}\n`));
+    });
+  });
 
-async function getAuthToken() {
-  if (isTokenExpired()) {
-    try {
-      await refreshAuthToken();
-    } catch (error) {
-      console.error(chalk.red(error.message));
-      process.exit(1);
-    }
-  }
-  
-  const token = config.get('authToken');
-  if (!token) {
-    console.error(chalk.red('Not authenticated. Please run: obx login'));
-    process.exit(1);
-  }
-  
-  if (!token.startsWith('eyJ')) {
-    console.error(chalk.red('Stored token is corrupted. Please login again.'));
-    config.delete('authToken');
-    process.exit(1);
-  }
-  
-  return token;
+  timeoutId = setTimeout(() => {
+    server.close(() => { console.error(chalk.red('\n✗ Authentication timeout.\n')); process.exit(1); });
+  }, 300000);
 }
 
-// ==================== USER EXTRACTION FUNCTIONS ====================
-
-/**
- * Decode base64url to string (handles JWT format)
- */
-function base64UrlDecode(str) {
-  let base64 = str.replace(/-/g, '+').replace(/_/g, '/');
-  while (base64.length % 4) {
-    base64 += '=';
-  }
-  return Buffer.from(base64, 'base64').toString('utf8');
-}
+async function logout() {
+  console.log(chalk.hex('#F24E1E')('\n═══════════════════════════════════════════════════════════'));
+  console.log(chalk.white.bold('🚪 Sign Out'));
+  console.log(chalk.hex('#F24E1E')('═══════════════════════════════════════════════════════════\n'));
 
-/**
- * Decode JWT token to extract user info
- */
-function decodeToken() {
-  const token = config.get('authToken'); // fixed key name
-  if (!token) return null;
-  
-  try {
-    const parts = token.split('.');
-    if (parts.length !== 3) return null;
-    
-    const payload = parts[1];
-    const decoded = base64UrlDecode(payload);
-    const data = JSON.parse(decoded);
-    
-    return {
-      uid: data.user_id || data.sub,
-      email: data.email,
-      exp: data.exp
-    };
-  } catch (error) {
-    return null;
-  }
-}
+  if (!user.getToken()) { console.log(chalk.yellow('  You are not logged in.')); return; }
 
-/**
- * Get current user UID from stored token
- */
-function getCurrentUserUid() {
-  const decoded = decodeToken();
-  return decoded ? decoded.uid : null;
-}
+  const inquirer = require('inquirer');
+  const { confirm } = await inquirer.prompt([{
+    type: 'confirm', name: 'confirm',
+    message: 'Are you sure you want to sign out?', default: false
+  }]);
 
-/**
- * Get current user email from stored token
- */
-function getCurrentUserEmail() {
-  const decoded = decodeToken();
-  return decoded ? decoded.email : null;
+  if (!confirm) { console.log(chalk.yellow('  Logout cancelled.')); return; }
+  user.clearTokens();
+  console.log(chalk.green('  ✓ Logged out successfully\n'));
 }
 
-module.exports = {
-  login,
-  logout,
-  getAuthToken,
-  isAuthenticated,
-  getCurrentUserUid,
-  getCurrentUserEmail
-};
+module.exports = { login, logout, getAuthToken, isAuthenticated };