peachsim 0.1.527

package/cli/commands/login.ts

@@ -0,0 +1,357 @@
+import { exec } from 'node:child_process'
+import { randomBytes } from 'node:crypto'
+import http from 'node:http'
+import { createInterface } from 'node:readline/promises'
+import {
+  refreshSharedDesktopAuthSession,
+  sharedDesktopAuthAccounts,
+  writeSharedDesktopAuthSession,
+  type SharedDesktopAuthSession,
+} from '../../src/auth/shared-session'
+import { rnxPublicBrand } from '../../src/public-brand'
+import { rnxExit } from '../run-rnx'
+
+const REMOTE_DEFAULT_ORIGIN = process.env.RNX_AUTH_ORIGIN || 'https://contrast.dev'
+
+type LoginResult =
+  | { ok: true; token: string; userId?: string; email?: string }
+  | { ok: false; error: string }
+
+function resolveDefaultAuthOrigin(explicitOrigin?: string) {
+  if (explicitOrigin) return explicitOrigin
+  if (process.env.RNX_AUTH_ORIGIN) return process.env.RNX_AUTH_ORIGIN
+  if (process.env.RNX_UPLOAD_ORIGIN) return process.env.RNX_UPLOAD_ORIGIN
+  return REMOTE_DEFAULT_ORIGIN
+}
+
+function printHelp() {
+  console.log(`
+rnx login — sign in so uploads can attach to your account
+
+usage:
+  rnx login [--origin <url>] [--account <name-or-id>]
+
+options:
+  --origin <url>            auth host (default: ${REMOTE_DEFAULT_ORIGIN})
+                            override with RNX_AUTH_ORIGIN env var
+  --account <name-or-id>    the account remote simulators and boxes bill to.
+                            one account is chosen for you; several ask.
+  -h, --help
+`)
+}
+
+// a session token names the person, not an account. the account that pays for
+// cloud work is chosen here, once, and stored on the session; a person with one
+// account never sees the question.
+async function chooseAccount(
+  session: SharedDesktopAuthSession,
+  requested: string | undefined,
+): Promise<{ id: string; name: string } | null> {
+  const accounts = sharedDesktopAuthAccounts(session.user)
+  if (requested !== undefined) {
+    const wanted = requested.trim().toLowerCase()
+    const match = accounts.find(
+      (account) =>
+        account.id === requested.trim() || account.name.toLowerCase() === wanted,
+    )
+    if (!match) {
+      console.error(
+        `  no account named ${JSON.stringify(requested)}. your accounts:\n` +
+          accounts.map((account) => `    ${account.name} (${account.id})`).join('\n'),
+      )
+      rnxExit(1)
+    }
+    return match
+  }
+  if (accounts.length <= 1) return accounts[0] ?? null
+  if (!process.stdin.isTTY) {
+    console.error(
+      '  this sign-in belongs to several accounts; rerun with --account <name> to choose the one to bill:\n' +
+        accounts.map((account) => `    ${account.name} (${account.id})`).join('\n'),
+    )
+    rnxExit(1)
+  }
+  console.log('  which account should remote simulators and boxes bill to?')
+  accounts.forEach((account, index) => console.log(`    ${index + 1}. ${account.name}`))
+  const prompt = createInterface({ input: process.stdin, output: process.stdout })
+  try {
+    for (;;) {
+      const answer = (await prompt.question(`  account [1-${accounts.length}]: `)).trim()
+      const chosen = accounts[Number(answer) - 1]
+      if (chosen && /^\d+$/.test(answer)) return chosen
+      console.log(`  enter a number from 1 to ${accounts.length}`)
+    }
+  } finally {
+    prompt.close()
+  }
+}
+
+async function finishLogin(
+  origin: string,
+  requestedAccount: string | undefined,
+  fallbackLabel: string | undefined,
+  suffix: string,
+) {
+  const refreshed = await refreshSharedDesktopAuthSession(origin)
+  const account = refreshed ? await chooseAccount(refreshed, requestedAccount) : null
+  if (refreshed && account) {
+    writeSharedDesktopAuthSession({ ...refreshed, accountId: account.id })
+  }
+  const label = refreshed?.user?.email || fallbackLabel || refreshed?.user?.id
+  console.log(
+    `  signed in${label ? ` as ${label}` : ''}${account ? ` (${account.name})` : ''}${suffix}`,
+  )
+}
+
+function extractStringFlag(args: string[], name: string): string | undefined {
+  const idx = args.findIndex((a) => a === name)
+  if (idx < 0) return undefined
+  const value = args[idx + 1]
+  args.splice(idx, 2)
+  return value
+}
+
+function openBrowser(url: string) {
+  const command =
+    process.platform === 'darwin'
+      ? `open "${url}"`
+      : process.platform === 'win32'
+        ? `start "" "${url}"`
+        : `xdg-open "${url}"`
+
+  exec(command, (err) => {
+    if (!err) return
+    console.log('  could not open browser automatically.')
+    console.log(`  open this URL manually:\n  ${url}\n`)
+  })
+}
+
+function renderCallbackPage(body: string) {
+  return `<!doctype html>
+<html>
+  <body style="font-family:system-ui;background:#000;color:#fff;display:flex;align-items:center;justify-content:center;height:100vh;margin:0">
+    <div style="max-width:480px;text-align:center">
+      <h1 style="font-size:28px;margin:0 0 12px">${rnxPublicBrand.name}</h1>
+      <p style="color:#ccc">${body}</p>
+    </div>
+  </body>
+</html>`
+}
+
+async function runDevLogin(origin: string): Promise<LoginResult> {
+  try {
+    const res = await fetch(`${origin.replace(/\/$/, '')}/api/dev-login`, {
+      method: 'POST',
+    })
+    if (res.status === 403) {
+      return { ok: false, error: 'local dev-login unavailable' }
+    }
+    if (!res.ok) {
+      const text = await res.text().catch(() => '')
+      return { ok: false, error: `dev-login ${res.status}: ${text}` }
+    }
+    const body = (await res.json()) as {
+      ok?: boolean
+      token?: string
+      email?: string
+      user?: { id?: string }
+    }
+    if (!body.token) {
+      return { ok: false, error: 'dev-login response missing token' }
+    }
+    return {
+      ok: true,
+      token: body.token,
+      userId: body.user?.id,
+      email: body.email,
+    }
+  } catch (err) {
+    return {
+      ok: false,
+      error: err instanceof Error ? err.message : 'dev-login fetch failed',
+    }
+  }
+}
+
+function isLocalOrigin(origin: string): boolean {
+  try {
+    const hostname = new URL(origin).hostname.replace(/^\[|\]$/g, '').toLowerCase()
+    if (hostname === 'localhost') return true
+    if (/^127(?:\.\d{1,3}){3}$/.test(hostname)) return true
+    if (hostname === '::1' || hostname === '0.0.0.0') return true
+    if (hostname.endsWith('.local')) return true
+    if (hostname.endsWith('.localhost')) return true
+    // VM↔host bridge aliases — orb, docker, lima, multipass all forward the
+    // host on a well-known name (IPv4 or IPv6) so a VM-internal `rnx login`
+    // can still take the dev-login fast path against the host's Contrast dev
+    // server. without this the CLI falls through to a browser callback that
+    // is unreachable from a headless VM.
+    if (hostname === 'host.containers.internal') return true
+    if (hostname === 'host.docker.internal') return true
+    if (hostname === 'host.orb.internal') return true
+    if (hostname === 'host.lima.internal') return true
+    // orb's IPv6 form of host.orb.internal: fd07:b51a:cc66:f0::fe (always
+    // this fixed address; it's a stable orb ULA assignment, see orb docs).
+    if (hostname === 'fd07:b51a:cc66:f0::fe') return true
+    // lima's qemu (slirp) backend does NOT resolve host.lima.internal — the
+    // host is the fixed slirp gateway 192.168.5.2. a lima/qemu user therefore
+    // targets the raw gateway IP, which would otherwise miss the dev-login fast
+    // path and fall through to the headless-broken browser callback. recognize
+    // it (and multipass's default bridge .1 gateways) so dev-login still fires.
+    // safe: no-device dev-login requests are accepted only in local dev.
+    if (hostname === '192.168.5.2') return true
+    if (/^192\.168\.(?:64|139)\.1$/.test(hostname)) return true
+    return false
+  } catch {
+    return false
+  }
+}
+
+export async function runLogin(args: string[]) {
+  if (args.includes('--help') || args.includes('-h')) {
+    printHelp()
+    rnxExit(0)
+  }
+
+  const mutableArgs = [...args]
+  const origin = resolveDefaultAuthOrigin(extractStringFlag(mutableArgs, '--origin'))
+  const requestedAccount = extractStringFlag(mutableArgs, '--account')
+
+  // in dev (localhost), skip the browser and sign in as the shared dev
+  // user via POST /api/dev-login. the no-device contract is local-only, so this
+  // path is safe to take unconditionally against local hosts.
+  if (isLocalOrigin(origin)) {
+    console.log(`  detected local origin (${origin}) — signing in as dev user`)
+    const devResult = await runDevLogin(origin)
+    if (devResult.ok) {
+      writeSharedDesktopAuthSession({
+        token: devResult.token,
+        user: devResult.userId ? { id: devResult.userId, email: devResult.email } : null,
+        origin,
+        source: 'cli',
+      })
+      await finishLogin(
+        origin,
+        requestedAccount,
+        devResult.email || devResult.userId,
+        ' (dev)',
+      )
+      return
+    }
+    console.log(`  dev-login not available (${devResult.error}); falling back to browser`)
+  }
+
+  const state = randomBytes(16).toString('hex')
+
+  // the browser round-trip needs human action (github's authorize screen on
+  // first sign-in), so the wait is generous, but it must not be infinite: a
+  // closed tab, denied consent, or blocked popup used to hang the CLI forever.
+  const LOGIN_TIMEOUT_MS = 5 * 60 * 1000
+
+  const result = await new Promise<LoginResult>((resolve) => {
+    let timer: ReturnType<typeof setTimeout>
+    let settled = false
+    const finish = (r: LoginResult) => {
+      if (settled) return
+      settled = true
+      clearTimeout(timer)
+      resolve(r)
+      server.close()
+    }
+
+    const server = http.createServer((req, res) => {
+      try {
+        const url = new URL(req.url || '/', 'http://127.0.0.1')
+        const returnedState = url.searchParams.get('state')
+        const token = url.searchParams.get('token')
+        const email = url.searchParams.get('email') || undefined
+        const userId = url.searchParams.get('userId') || undefined
+        const error = url.searchParams.get('error')
+
+        // stray localhost traffic (port scanners, favicon fetches, browser
+        // prefetch) must not abort the login. only a request carrying our
+        // state is the real callback; rfc 8252 loopback servers ignore the
+        // rest. aborting here used to kill the login mid-wait.
+        if (returnedState !== state) {
+          res.statusCode = 404
+          res.end('not found')
+          return
+        }
+
+        res.setHeader('content-type', 'text/html; charset=utf-8')
+
+        if (error) {
+          res.end(renderCallbackPage(`sign-in failed: ${error}`))
+          finish({ ok: false, error })
+          return
+        }
+
+        if (!token) {
+          res.end(
+            renderCallbackPage('missing token. close this tab and retry `rnx login`.'),
+          )
+          finish({ ok: false, error: 'missing token' })
+          return
+        }
+
+        res.end(renderCallbackPage('sign-in complete. you can return to the terminal.'))
+        finish({ ok: true, token, email, userId })
+      } catch (err) {
+        res.statusCode = 500
+        res.end(renderCallbackPage('sign-in callback failed. retry `rnx login`.'))
+        finish({
+          ok: false,
+          error: err instanceof Error ? err.message : 'callback failed',
+        })
+      }
+    })
+
+    timer = setTimeout(() => {
+      finish({
+        ok: false,
+        error:
+          'timed out waiting for the browser sign-in (5 minutes). rerun `rnx login` and complete the github authorize screen if it appears.',
+      })
+    }, LOGIN_TIMEOUT_MS)
+
+    server.listen(0, '127.0.0.1', () => {
+      const address = server.address()
+      if (!address || typeof address === 'string') {
+        finish({ ok: false, error: 'failed to bind callback server' })
+        return
+      }
+
+      const url = new URL(`${origin.replace(/\/$/, '')}/auth/rnx-cli`)
+      url.searchParams.set('state', state)
+      url.searchParams.set('port', String(address.port))
+      url.searchParams.set('contrast', origin)
+
+      console.log('  opening browser for rnx login...')
+      console.log(
+        '  first time here? github will show an authorize screen. approve it to continue.',
+      )
+      console.log(`  waiting up to 5 minutes for the browser (ctrl+c to cancel)`)
+      console.log(`  if nothing opens, visit:\n  ${url.toString()}\n`)
+      openBrowser(url.toString())
+    })
+  })
+
+  if (!result.ok) {
+    console.error(`  login failed: ${result.error}`)
+    rnxExit(1)
+  }
+
+  writeSharedDesktopAuthSession({
+    token: result.token,
+    user: result.userId
+      ? {
+          id: result.userId,
+          email: result.email,
+        }
+      : null,
+    origin,
+    source: 'cli',
+  })
+
+  await finishLogin(origin, requestedAccount, result.email || result.userId, '')
+}

package/cli/commands/logout.ts

@@ -0,0 +1,24 @@
+import {
+  clearSharedDesktopAuthSession,
+  readSharedDesktopAuthSession,
+} from '../../src/auth/shared-session'
+
+export async function runLogout() {
+  const current = readSharedDesktopAuthSession()
+  if (!current?.token) {
+    console.log('  not signed in')
+    return
+  }
+
+  try {
+    await fetch(`${current.origin.replace(/\/$/, '')}/api/auth/sign-out`, {
+      method: 'POST',
+      headers: { authorization: `Bearer ${current.token}` },
+    })
+  } catch {
+    // best-effort only
+  }
+
+  clearSharedDesktopAuthSession()
+  console.log('  signed out')
+}