orizu 0.1.5 → 0.2.0

package/README.md

@@ -50,6 +50,7 @@ orizu login
 ```
 
 This will open a browser tab for you to login with. You must either have an account on the [Orizu platform](https://orizu.ai) or it will help you create one.
+Approving the login creates a personal access token for the CLI and stores it in your local Orizu credentials file. You can revoke CLI tokens from the Personal Tokens page in Orizu.
 
 **Check the signed-in user**
 
@@ -120,6 +121,10 @@ orizu logout
     <td>Append dataset rows</td>
     <td><code>orizu datasets append --dataset &lt;datasetId&gt; --file ./datasets/support-extra.jsonl</code></td>
   </tr>
+  <tr>
+    <td>Delete a dataset</td>
+    <td><code>orizu datasets delete --dataset &lt;datasetId&gt;</code> (interactive confirmation required)</td>
+  </tr>
   <tr>
     <td>Lock a dataset</td>
     <td><code>orizu datasets lock --dataset &lt;datasetId&gt; --reason "Finalize for labeling"</code></td>

package/dist/credentials.js

@@ -1,6 +1,7 @@
-import { mkdirSync, readFileSync, rmSync, writeFileSync, chmodSync, existsSync } from 'fs';
+import { chmodSync, closeSync, existsSync, fsyncSync, mkdirSync, openSync, readFileSync, renameSync, rmSync, writeFileSync, } from 'fs';
 import { join } from 'path';
 import { homedir } from 'os';
+import { randomBytes } from 'crypto';
 function getConfigDir() {
     if (process.env.ORIZU_CONFIG_DIR) {
         return process.env.ORIZU_CONFIG_DIR;
@@ -17,6 +18,13 @@ function isStoredCredentialsV2(value) {
     const typed = value;
     return typed.version === 2 && !!typed.servers && typeof typed.servers === 'object';
 }
+function isStoredCredentialsV3(value) {
+    if (!value || typeof value !== 'object') {
+        return false;
+    }
+    const typed = value;
+    return typed.version === 3 && !!typed.servers && typeof typed.servers === 'object';
+}
 function isStoredCredentialsV1(value) {
     if (!value || typeof value !== 'object') {
         return false;
@@ -42,14 +50,38 @@ function migrateToV2(stored) {
 }
 function writeCredentials(config) {
     const dir = getConfigDir();
-    mkdirSync(dir, { recursive: true });
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    chmodSync(dir, 0o700);
     const path = getCredentialsPath();
-    writeFileSync(path, JSON.stringify(config, null, 2), 'utf-8');
+    const tempPath = join(dir, `.credentials.json.${process.pid}.${randomBytes(8).toString('hex')}.tmp`);
+    const payload = JSON.stringify(config, null, 2) + '\n';
+    const fd = openSync(tempPath, 'wx', 0o600);
+    try {
+        writeFileSync(fd, payload, 'utf-8');
+        fsyncSync(fd);
+    }
+    finally {
+        closeSync(fd);
+    }
+    chmodSync(tempPath, 0o600);
+    try {
+        renameSync(tempPath, path);
+    }
+    catch (error) {
+        if (process.platform === 'win32' && error?.code === 'EEXIST') {
+            rmSync(path, { force: true });
+            renameSync(tempPath, path);
+        }
+        else {
+            rmSync(tempPath, { force: true });
+            throw error;
+        }
+    }
     chmodSync(path, 0o600);
 }
 function createEmptyCredentialsConfig() {
     return {
-        version: 2,
+        version: 3,
         activeBaseUrl: null,
         servers: {},
     };
@@ -76,6 +108,9 @@ export function loadCredentialsConfig() {
         console.warn('Warning: credentials file contains invalid JSON — please re-login with `orizu login`');
         return null;
     }
+    if (isStoredCredentialsV3(parsed)) {
+        return parsed;
+    }
     if (isStoredCredentialsV2(parsed)) {
         return parsed;
     }
@@ -96,13 +131,27 @@ export function getServerCredentials(baseUrl) {
     return config.servers[baseUrl] || null;
 }
 export function saveServerCredentials(baseUrl, credentials) {
-    const config = loadCredentialsConfigForWrite();
+    const loaded = loadCredentialsConfigForWrite();
+    const config = loaded.version === 3
+        ? loaded
+        : {
+            version: 3,
+            activeBaseUrl: loaded.activeBaseUrl,
+            servers: loaded.servers,
+        };
     config.servers[baseUrl] = credentials;
     config.activeBaseUrl = baseUrl;
     writeCredentials(config);
 }
 export function updateServerCredentials(baseUrl, credentials) {
-    const config = loadCredentialsConfigForWrite();
+    const loaded = loadCredentialsConfigForWrite();
+    const config = loaded.version === 3
+        ? loaded
+        : {
+            version: 3,
+            activeBaseUrl: loaded.activeBaseUrl,
+            servers: loaded.servers,
+        };
     config.servers[baseUrl] = credentials;
     writeCredentials(config);
 }

package/dist/http.js

@@ -33,11 +33,43 @@ export function resolveLoginBaseUrl(flags = runtimeFlags) {
 export function getBaseUrl() {
     return resolveBaseUrl();
 }
+function isLoopbackHostname(hostname) {
+    const normalized = hostname.toLowerCase();
+    return (normalized === 'localhost' ||
+        normalized === '[::1]' ||
+        /^127(?:\.\d{1,3}){3}$/.test(normalized));
+}
+export function assertSecureTokenTransport(baseUrl) {
+    let parsed;
+    try {
+        parsed = new URL(baseUrl);
+    }
+    catch {
+        throw new Error(`Invalid server URL: '${baseUrl}'`);
+    }
+    if (parsed.protocol === 'https:') {
+        return;
+    }
+    if (parsed.protocol === 'http:' && isLoopbackHostname(parsed.hostname)) {
+        return;
+    }
+    throw new Error(`Refusing to send CLI tokens to ${baseUrl}. Use HTTPS, or --local for loopback development.`);
+}
+function isSessionCredentials(credentials) {
+    return 'accessToken' in credentials;
+}
+function getAuthorizationToken(credentials) {
+    return isSessionCredentials(credentials) ? credentials.accessToken : credentials.apiKey;
+}
 function isExpired(expiresAt) {
     const nowUnix = Math.floor(Date.now() / 1000);
     return expiresAt <= nowUnix + 30;
 }
 async function refreshCredentials(baseUrl, credentials) {
+    if (!isSessionCredentials(credentials)) {
+        throw new Error('API key credentials do not refresh. Run `orizu login` again if access fails.');
+    }
+    assertSecureTokenTransport(baseUrl);
     const response = await fetch(`${baseUrl}/api/cli/auth/refresh`, {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
@@ -47,7 +79,11 @@ async function refreshCredentials(baseUrl, credentials) {
         throw new Error('Session expired. Run `orizu login` again.');
     }
     const data = await response.json();
+    if (!data.accessToken || !data.refreshToken || !data.expiresAt) {
+        throw new Error('Server returned invalid refresh credentials. Run `orizu login` again.');
+    }
     const refreshed = {
+        credentialType: 'session',
         accessToken: data.accessToken,
         refreshToken: data.refreshToken,
         expiresAt: data.expiresAt,
@@ -57,28 +93,29 @@ async function refreshCredentials(baseUrl, credentials) {
 }
 export async function authedFetch(path, init = {}) {
     const baseUrl = resolveBaseUrl();
+    assertSecureTokenTransport(baseUrl);
     const credentials = getServerCredentials(baseUrl);
     if (!credentials) {
         throw new Error(`Not logged in for ${baseUrl}. Run \`orizu login --server ${baseUrl}\` (or \`--local\`) first.`);
     }
     let activeCredentials = credentials;
-    if (isExpired(activeCredentials.expiresAt)) {
+    if (isSessionCredentials(activeCredentials) && isExpired(activeCredentials.expiresAt)) {
         activeCredentials = await refreshCredentials(baseUrl, activeCredentials);
     }
     let response = await fetch(`${baseUrl}${path}`, {
         ...init,
         headers: {
             ...(init.headers || {}),
-            Authorization: `Bearer ${activeCredentials.accessToken}`,
+            Authorization: `Bearer ${getAuthorizationToken(activeCredentials)}`,
         },
     });
-    if (response.status === 401) {
+    if (response.status === 401 && isSessionCredentials(activeCredentials)) {
         activeCredentials = await refreshCredentials(baseUrl, activeCredentials);
         response = await fetch(`${baseUrl}${path}`, {
             ...init,
             headers: {
                 ...(init.headers || {}),
-                Authorization: `Bearer ${activeCredentials.accessToken}`,
+                Authorization: `Bearer ${getAuthorizationToken(activeCredentials)}`,
             },
         });
     }