orizu 0.1.5 → 0.2.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "orizu",
-  "version": "0.1.5",
+  "version": "0.2.0",
   "private": false,
   "type": "module",
   "bin": {

package/src/credentials.ts

@@ -1,7 +1,24 @@
-import { mkdirSync, readFileSync, rmSync, writeFileSync, chmodSync, existsSync } from 'fs'
+import {
+  chmodSync,
+  closeSync,
+  existsSync,
+  fsyncSync,
+  mkdirSync,
+  openSync,
+  readFileSync,
+  renameSync,
+  rmSync,
+  writeFileSync,
+} from 'fs'
 import { join } from 'path'
 import { homedir } from 'os'
-import { ServerCredentials, StoredCredentialsV1, StoredCredentialsV2 } from './types.js'
+import { randomBytes } from 'crypto'
+import {
+  ServerCredentials,
+  StoredCredentialsV1,
+  StoredCredentialsV2,
+  StoredCredentialsV3,
+} from './types.js'
 
 function getConfigDir(): string {
   if (process.env.ORIZU_CONFIG_DIR) {
@@ -23,6 +40,15 @@ function isStoredCredentialsV2(value: unknown): value is StoredCredentialsV2 {
   return typed.version === 2 && !!typed.servers && typeof typed.servers === 'object'
 }
 
+function isStoredCredentialsV3(value: unknown): value is StoredCredentialsV3 {
+  if (!value || typeof value !== 'object') {
+    return false
+  }
+
+  const typed = value as Partial<StoredCredentialsV3>
+  return typed.version === 3 && !!typed.servers && typeof typed.servers === 'object'
+}
+
 function isStoredCredentialsV1(value: unknown): value is StoredCredentialsV1 {
   if (!value || typeof value !== 'object') {
     return false
@@ -51,23 +77,50 @@ function migrateToV2(stored: StoredCredentialsV1): StoredCredentialsV2 {
   }
 }
 
-function writeCredentials(config: StoredCredentialsV2) {
+function writeCredentials(config: StoredCredentialsV2 | StoredCredentialsV3) {
   const dir = getConfigDir()
-  mkdirSync(dir, { recursive: true })
+  mkdirSync(dir, { recursive: true, mode: 0o700 })
+  chmodSync(dir, 0o700)
+
   const path = getCredentialsPath()
-  writeFileSync(path, JSON.stringify(config, null, 2), 'utf-8')
+  const tempPath = join(
+    dir,
+    `.credentials.json.${process.pid}.${randomBytes(8).toString('hex')}.tmp`
+  )
+  const payload = JSON.stringify(config, null, 2) + '\n'
+  const fd = openSync(tempPath, 'wx', 0o600)
+
+  try {
+    writeFileSync(fd, payload, 'utf-8')
+    fsyncSync(fd)
+  } finally {
+    closeSync(fd)
+  }
+
+  chmodSync(tempPath, 0o600)
+  try {
+    renameSync(tempPath, path)
+  } catch (error: any) {
+    if (process.platform === 'win32' && error?.code === 'EEXIST') {
+      rmSync(path, { force: true })
+      renameSync(tempPath, path)
+    } else {
+      rmSync(tempPath, { force: true })
+      throw error
+    }
+  }
   chmodSync(path, 0o600)
 }
 
-function createEmptyCredentialsConfig(): StoredCredentialsV2 {
+function createEmptyCredentialsConfig(): StoredCredentialsV3 {
   return {
-    version: 2 as const,
+    version: 3 as const,
     activeBaseUrl: null,
     servers: {},
   }
 }
 
-function loadCredentialsConfigForWrite(): StoredCredentialsV2 {
+function loadCredentialsConfigForWrite(): StoredCredentialsV2 | StoredCredentialsV3 {
   try {
     return loadCredentialsConfig() || createEmptyCredentialsConfig()
   } catch {
@@ -75,7 +128,7 @@ function loadCredentialsConfigForWrite(): StoredCredentialsV2 {
   }
 }
 
-export function loadCredentialsConfig(): StoredCredentialsV2 | null {
+export function loadCredentialsConfig(): StoredCredentialsV2 | StoredCredentialsV3 | null {
   const path = getCredentialsPath()
   if (!existsSync(path)) {
     return null
@@ -91,6 +144,10 @@ export function loadCredentialsConfig(): StoredCredentialsV2 | null {
     return null
   }
 
+  if (isStoredCredentialsV3(parsed)) {
+    return parsed
+  }
+
   if (isStoredCredentialsV2(parsed)) {
     return parsed
   }
@@ -117,7 +174,14 @@ export function getServerCredentials(baseUrl: string): ServerCredentials | null
 }
 
 export function saveServerCredentials(baseUrl: string, credentials: ServerCredentials) {
-  const config = loadCredentialsConfigForWrite()
+  const loaded = loadCredentialsConfigForWrite()
+  const config: StoredCredentialsV3 = loaded.version === 3
+    ? loaded
+    : {
+      version: 3,
+      activeBaseUrl: loaded.activeBaseUrl,
+      servers: loaded.servers,
+    }
 
   config.servers[baseUrl] = credentials
   config.activeBaseUrl = baseUrl
@@ -125,7 +189,14 @@ export function saveServerCredentials(baseUrl: string, credentials: ServerCreden
 }
 
 export function updateServerCredentials(baseUrl: string, credentials: ServerCredentials) {
-  const config = loadCredentialsConfigForWrite()
+  const loaded = loadCredentialsConfigForWrite()
+  const config: StoredCredentialsV3 = loaded.version === 3
+    ? loaded
+    : {
+      version: 3,
+      activeBaseUrl: loaded.activeBaseUrl,
+      servers: loaded.servers,
+    }
   config.servers[baseUrl] = credentials
   writeCredentials(config)
 }

package/src/http.ts

@@ -1,6 +1,6 @@
 import { getActiveBaseUrl, getServerCredentials, updateServerCredentials } from './credentials.js'
 import { getFlagBaseUrl, GlobalFlags, normalizeBaseUrl } from './global-flags.js'
-import { LoginResponse, ServerCredentials } from './types.js'
+import { LoginResponse, ServerCredentials, SessionServerCredentials } from './types.js'
 
 let runtimeFlags: GlobalFlags = { local: false, server: null }
 
@@ -45,12 +45,55 @@ export function getBaseUrl(): string {
   return resolveBaseUrl()
 }
 
+function isLoopbackHostname(hostname: string): boolean {
+  const normalized = hostname.toLowerCase()
+  return (
+    normalized === 'localhost' ||
+    normalized === '[::1]' ||
+    /^127(?:\.\d{1,3}){3}$/.test(normalized)
+  )
+}
+
+export function assertSecureTokenTransport(baseUrl: string) {
+  let parsed: URL
+  try {
+    parsed = new URL(baseUrl)
+  } catch {
+    throw new Error(`Invalid server URL: '${baseUrl}'`)
+  }
+
+  if (parsed.protocol === 'https:') {
+    return
+  }
+
+  if (parsed.protocol === 'http:' && isLoopbackHostname(parsed.hostname)) {
+    return
+  }
+
+  throw new Error(
+    `Refusing to send CLI tokens to ${baseUrl}. Use HTTPS, or --local for loopback development.`
+  )
+}
+
+function isSessionCredentials(credentials: ServerCredentials): credentials is SessionServerCredentials {
+  return 'accessToken' in credentials
+}
+
+function getAuthorizationToken(credentials: ServerCredentials): string {
+  return isSessionCredentials(credentials) ? credentials.accessToken : credentials.apiKey
+}
+
 function isExpired(expiresAt: number): boolean {
   const nowUnix = Math.floor(Date.now() / 1000)
   return expiresAt <= nowUnix + 30
 }
 
 async function refreshCredentials(baseUrl: string, credentials: ServerCredentials): Promise<ServerCredentials> {
+  if (!isSessionCredentials(credentials)) {
+    throw new Error('API key credentials do not refresh. Run `orizu login` again if access fails.')
+  }
+
+  assertSecureTokenTransport(baseUrl)
   const response = await fetch(`${baseUrl}/api/cli/auth/refresh`, {
     method: 'POST',
     headers: { 'Content-Type': 'application/json' },
@@ -62,7 +105,12 @@ async function refreshCredentials(baseUrl: string, credentials: ServerCredential
   }
 
   const data = await response.json() as LoginResponse
+  if (!data.accessToken || !data.refreshToken || !data.expiresAt) {
+    throw new Error('Server returned invalid refresh credentials. Run `orizu login` again.')
+  }
+
   const refreshed = {
+    credentialType: 'session' as const,
     accessToken: data.accessToken,
     refreshToken: data.refreshToken,
     expiresAt: data.expiresAt,
@@ -73,13 +121,14 @@ async function refreshCredentials(baseUrl: string, credentials: ServerCredential
 
 export async function authedFetch(path: string, init: RequestInit = {}) {
   const baseUrl = resolveBaseUrl()
+  assertSecureTokenTransport(baseUrl)
   const credentials = getServerCredentials(baseUrl)
   if (!credentials) {
     throw new Error(`Not logged in for ${baseUrl}. Run \`orizu login --server ${baseUrl}\` (or \`--local\`) first.`)
   }
 
   let activeCredentials = credentials
-  if (isExpired(activeCredentials.expiresAt)) {
+  if (isSessionCredentials(activeCredentials) && isExpired(activeCredentials.expiresAt)) {
     activeCredentials = await refreshCredentials(baseUrl, activeCredentials)
   }
 
@@ -87,17 +136,17 @@ export async function authedFetch(path: string, init: RequestInit = {}) {
     ...init,
     headers: {
       ...(init.headers || {}),
-      Authorization: `Bearer ${activeCredentials.accessToken}`,
+      Authorization: `Bearer ${getAuthorizationToken(activeCredentials)}`,
     },
   })
 
-  if (response.status === 401) {
+  if (response.status === 401 && isSessionCredentials(activeCredentials)) {
     activeCredentials = await refreshCredentials(baseUrl, activeCredentials)
     response = await fetch(`${baseUrl}${path}`, {
       ...init,
       headers: {
         ...(init.headers || {}),
-        Authorization: `Bearer ${activeCredentials.accessToken}`,
+        Authorization: `Bearer ${getAuthorizationToken(activeCredentials)}`,
       },
     })
   }