securegate-cli-tool 2.0.4 → 2.1.0

package/src/commands/login.js

@@ -1,60 +1,191 @@
-/**
- * securegate login — Authenticate with SecureGate
- */
-
-const chalk = require('chalk');
-const inquirer = require('inquirer');
-const ora = require('ora');
-const api = require('../api');
-const { getAuth } = require('../config');
-
-async function loginCommand() {
-    console.log();
-    console.log(chalk.cyan.bold('🔐 SecureGate Login'));
-    console.log(chalk.dim('━'.repeat(50)));
-    console.log();
-
-    // Check if already logged in
-    const existing = getAuth();
-    if (existing?.user?.email) {
-        const { confirm } = await inquirer.prompt([{
-            type: 'confirm',
-            name: 'confirm',
-            message: `Already logged in as ${chalk.cyan(existing.user.email)}. Re-authenticate?`,
-            default: false,
-        }]);
-        if (!confirm) return;
-    }
-
-    const answers = await inquirer.prompt([
-        {
-            type: 'input',
-            name: 'email',
-            message: 'Email:',
-            validate: (v) => v.includes('@') ? true : 'Enter a valid email',
-        },
-        {
-            type: 'password',
-            name: 'password',
-            message: 'Password:',
-            mask: '•',
-            validate: (v) => v.length >= 6 ? true : 'Password must be at least 6 characters',
-        },
-    ]);
-
-    const spinner = ora('Authenticating...').start();
-
-    try {
-        const data = await api.login(answers.email, answers.password);
-        spinner.succeed(chalk.green('Logged in successfully!'));
-        console.log();
-        console.log(chalk.dim(`  User: ${data.user?.email}`));
-        console.log(chalk.dim(`  ID:   ${data.user?.id?.substring(0, 8)}...`));
-        console.log();
-    } catch (err) {
-        spinner.fail(chalk.red(`Login failed: ${err.message}`));
-        process.exitCode = 1;
-    }
-}
-
-module.exports = loginCommand;
+/**
+ * securegate login — Authenticate with SecureGate
+ */
+
+const chalk = require('chalk');
+const inquirer = require('inquirer');
+const ora = require('ora');
+const http = require('http');
+const open = require('open');
+const api = require('../api');
+const { getAuth, SUPABASE_URL, SUPABASE_ANON_KEY } = require('../config');
+
+// Use production SecureGate domain by default, fallback to localhost for dev
+const SECUREGATE_WEB_URL = process.env.SECUREGATE_WEB_URL || 'https://usesecuregate.com';
+
+async function loginCommand() {
+    console.log();
+    console.log(chalk.cyan.bold('🔐 SecureGate Login'));
+    console.log(chalk.dim('━'.repeat(50)));
+    console.log();
+
+    // Check if already logged in
+    const existing = getAuth();
+    if (existing?.user?.email) {
+        const { confirm } = await inquirer.prompt([{
+            type: 'confirm',
+            name: 'confirm',
+            message: `Already logged in as ${chalk.cyan(existing.user.email)}. Re-authenticate?`,
+            default: false,
+        }]);
+        if (!confirm) return;
+    }
+
+    const spinner = ora('Starting local authentication server...').start();
+
+    return new Promise((resolve, reject) => {
+        // Spin up a local HTTP server
+        const server = http.createServer();
+
+        server.on('request', async (req, res) => {
+            // Add CORS headers so the SecureGate web app can POST to localhost
+            res.setHeader('Access-Control-Allow-Origin', '*');
+            res.setHeader('Access-Control-Allow-Methods', 'OPTIONS, GET, POST');
+            res.setHeader('Access-Control-Allow-Headers', 'Content-Type');
+
+            if (req.method === 'OPTIONS') {
+                res.writeHead(200);
+                res.end();
+                return;
+            }
+
+            if (req.url === '/auth' && req.method === 'GET') {
+                // Return a simple HTML page that grabs the URL hash fragment (from Supabase OAuth/Magic Link)
+                // and POSTs it back to our local proxy /callback
+                res.writeHead(200, { 'Content-Type': 'text/html' });
+                res.end(`
+                    <html>
+                        <head><title>SecureGate CLI Authentication</title></head>
+                        <body>
+                            <script>
+                                const hash = window.location.hash.substring(1);
+                                if (!hash) {
+                                  // No hash present, might be a direct visit instead of redirect
+                                  document.body.innerHTML = '<h2>No session found. Please try logging in again.</h2>';
+                                } else {
+                                  const params = new URLSearchParams(hash);
+                                  const payload = {
+                                      access_token: params.get('access_token'),
+                                      refresh_token: params.get('refresh_token')
+                                  };
+                                  
+                                  fetch('http://127.0.0.1:' + window.location.port + '/callback', {
+                                      method: 'POST',
+                                      headers: { 'Content-Type': 'application/json' },
+                                      body: JSON.stringify(payload)
+                                  }).then(() => {
+                                      document.body.innerHTML = '<h2 style="font-family: sans-serif; color: #10b981; text-align: center; margin-top: 50px;">Authentication successful! You can close this tab and return to your terminal.</h2>';
+                                      setTimeout(() => window.close(), 2000); // Attempt to close, some browsers block this
+                                  }).catch(err => {
+                                      console.error(err);
+                                      document.body.innerHTML = '<h2 style="font-family: sans-serif; color: #ef4444; text-align: center; margin-top: 50px;">Failed to send session to CLI. Check your terminal.</h2>';
+                                  });
+                                }
+                            </script>
+                        </body>
+                    </html>
+                `);
+            } else if (req.url === '/callback' && req.method === 'POST') {
+                // Receive the JSON payload sent from the /auth HTML page above
+                let body = '';
+                req.on('data', chunk => {
+                    body += chunk.toString();
+                });
+                req.on('end', async () => {
+                    try {
+                        const payload = JSON.parse(body);
+
+                        // We must fetch the user profile securely given the access token
+                        spinner.text = 'Verifying session...';
+
+                        // Set the initial auth context in the API client to make requests
+                        // We manually overwrite the globally configured client to bypass normal auth requirement
+                        const { createClient } = require('@supabase/supabase-js');
+                        api.supabase = createClient(SUPABASE_URL, SUPABASE_ANON_KEY, {
+                            auth: { persistSession: false },
+                            global: { headers: { Authorization: `Bearer ${payload.access_token}` } }
+                        });
+
+                        // Request user data using the new token to confirm it's valid and get email
+                        const { data: { user }, error } = await api.supabase.auth.getUser();
+
+                        if (error || !user) {
+                            console.error("\n[DEBUG] getUser failed:", { error, user, access_token: payload.access_token.substring(0, 15) + '...' });
+                            throw new Error('Failed to verify user token');
+                        }
+
+                        // Save the full session permanently
+                        api.setAuth({
+                            user: {
+                                id: user.id,
+                                email: user.email,
+                            },
+                            access_token: payload.access_token,
+                            refresh_token: payload.refresh_token
+                        });
+
+                        spinner.succeed(chalk.green('Logged in successfully!'));
+                        console.log();
+                        console.log(chalk.dim(`  User: ${user.email}`));
+                        console.log(chalk.dim(`  ID:   ${user.id.substring(0, 8)}...`));
+                        console.log();
+
+                        res.writeHead(200, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ success: true }));
+
+                        // Close server and resolve the command promise
+                        server.close();
+                        resolve();
+                    } catch (err) {
+                        res.writeHead(400, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({ success: false, error: err.message }));
+
+                        spinner.fail(chalk.red(`Login parsing failed: ${err.message}`));
+                        server.close();
+                        process.exitCode = 1;
+                        reject(err);
+                    }
+                });
+            } else {
+                res.writeHead(404);
+                res.end('Not Found');
+            }
+        });
+
+        // Listen on a random available port on localhost
+        server.listen(0, '127.0.0.1', async () => {
+            const port = server.address().port;
+            const authUrl = `${SECUREGATE_WEB_URL}/cli/auth?port=${port}`;
+
+            spinner.text = 'Opening browser to authenticate...';
+            console.log(chalk.dim(`\nIf your browser does not open automatically, visit:\n${chalk.cyan(authUrl)}\n`));
+
+            try {
+                // Automatically open the user's default web browser to the SecureGate app
+                await open(authUrl);
+                spinner.text = 'Waiting for browser authentication...';
+            } catch (err) {
+                // Fallback if 'open' fails (e.g., inside an SSH session or container)
+                spinner.text = 'Waiting for authentication...';
+            }
+        });
+
+        server.on('error', (err) => {
+            spinner.fail(chalk.red(`Failed to start local server: ${err.message}`));
+            process.exitCode = 1;
+            reject(err);
+        });
+
+        // Timeout after 5 minutes
+        setTimeout(() => {
+            if (server.listening) {
+                server.close();
+                spinner.fail(chalk.red('Authentication timed out.'));
+                process.exitCode = 1;
+                reject(new Error('Timeout'));
+            }
+        }, 5 * 60 * 1000);
+    });
+}
+
+module.exports = loginCommand;

package/src/commands/providers.js

@@ -1,51 +1,51 @@
-/**
- * securegate providers — List available providers
- */
-
-const chalk = require('chalk');
-
-const PROVIDERS = {
-    'Major Providers': [
-        { id: 'openai', name: 'OpenAI', desc: 'GPT-4o, GPT-4.1, o3, DALL·E, Whisper' },
-        { id: 'anthropic', name: 'Anthropic', desc: 'Claude 4, Claude 3.5 Sonnet, Haiku' },
-        { id: 'google', name: 'Google AI', desc: 'Gemini 2.5 Pro, Gemini Flash, PaLM' },
-        { id: 'azure', name: 'Azure OpenAI', desc: 'GPT-4o & OpenAI models via Azure' },
-    ],
-    'Cloud & Inference': [
-        { id: 'groq', name: 'Groq', desc: 'Ultra-fast LPU inference for Llama, Mixtral' },
-        { id: 'together', name: 'Together AI', desc: 'Open-source models: Llama, Qwen, DeepSeek' },
-        { id: 'fireworks', name: 'Fireworks AI', desc: 'Fast serverless inference for open models' },
-        { id: 'perplexity', name: 'Perplexity', desc: 'Sonar models with built-in web search' },
-        { id: 'mistral', name: 'Mistral AI', desc: 'Mistral Large, Medium, Codestral' },
-        { id: 'deepseek', name: 'DeepSeek', desc: 'DeepSeek-V3, DeepSeek-R1 reasoning' },
-    ],
-    'Specialized & Enterprise': [
-        { id: 'cohere', name: 'Cohere', desc: 'Command R+, Embed, Rerank for enterprise' },
-        { id: 'replicate', name: 'Replicate', desc: 'Run open-source models via API' },
-        { id: 'bedrock', name: 'AWS Bedrock', desc: 'Managed AI models on AWS infrastructure' },
-        { id: 'huggingface', name: 'Hugging Face', desc: 'Inference API for 200k+ models' },
-    ],
-    'Custom': [
-        { id: 'custom', name: 'Custom / OpenAI-Compatible', desc: 'vLLM, LM Studio, Ollama, LocalAI, etc.' },
-    ],
-};
-
-function providersCommand() {
-    console.log();
-    console.log(chalk.cyan.bold('📦 Available Providers'));
-    console.log(chalk.dim('━'.repeat(50)));
-    console.log();
-
-    for (const [category, providers] of Object.entries(PROVIDERS)) {
-        console.log(chalk.white.bold(`  ${category}`));
-        for (const p of providers) {
-            console.log(`    ${chalk.cyan(p.id.padEnd(16))} ${chalk.dim(p.desc)}`);
-        }
-        console.log();
-    }
-
-    console.log(chalk.dim(`  Run ${chalk.cyan('securegate connect')} to add a provider.`));
-    console.log();
-}
-
-module.exports = providersCommand;
+/**
+ * securegate providers — List available providers
+ */
+
+const chalk = require('chalk');
+
+const PROVIDERS = {
+    'Major Providers': [
+        { id: 'openai', name: 'OpenAI', desc: 'GPT-4o, GPT-4.1, o3, DALL·E, Whisper' },
+        { id: 'anthropic', name: 'Anthropic', desc: 'Claude 4, Claude 3.5 Sonnet, Haiku' },
+        { id: 'google', name: 'Google AI', desc: 'Gemini 2.5 Pro, Gemini Flash, PaLM' },
+        { id: 'azure', name: 'Azure OpenAI', desc: 'GPT-4o & OpenAI models via Azure' },
+    ],
+    'Cloud & Inference': [
+        { id: 'groq', name: 'Groq', desc: 'Ultra-fast LPU inference for Llama, Mixtral' },
+        { id: 'together', name: 'Together AI', desc: 'Open-source models: Llama, Qwen, DeepSeek' },
+        { id: 'fireworks', name: 'Fireworks AI', desc: 'Fast serverless inference for open models' },
+        { id: 'perplexity', name: 'Perplexity', desc: 'Sonar models with built-in web search' },
+        { id: 'mistral', name: 'Mistral AI', desc: 'Mistral Large, Medium, Codestral' },
+        { id: 'deepseek', name: 'DeepSeek', desc: 'DeepSeek-V3, DeepSeek-R1 reasoning' },
+    ],
+    'Specialized & Enterprise': [
+        { id: 'cohere', name: 'Cohere', desc: 'Command R+, Embed, Rerank for enterprise' },
+        { id: 'replicate', name: 'Replicate', desc: 'Run open-source models via API' },
+        { id: 'bedrock', name: 'AWS Bedrock', desc: 'Managed AI models on AWS infrastructure' },
+        { id: 'huggingface', name: 'Hugging Face', desc: 'Inference API for 200k+ models' },
+    ],
+    'Custom': [
+        { id: 'custom', name: 'Custom / OpenAI-Compatible', desc: 'vLLM, LM Studio, Ollama, LocalAI, etc.' },
+    ],
+};
+
+function providersCommand() {
+    console.log();
+    console.log(chalk.cyan.bold('📦 Available Providers'));
+    console.log(chalk.dim('━'.repeat(50)));
+    console.log();
+
+    for (const [category, providers] of Object.entries(PROVIDERS)) {
+        console.log(chalk.white.bold(`  ${category}`));
+        for (const p of providers) {
+            console.log(`    ${chalk.cyan(p.id.padEnd(16))} ${chalk.dim(p.desc)}`);
+        }
+        console.log();
+    }
+
+    console.log(chalk.dim(`  Run ${chalk.cyan('securegate connect')} to add a provider.`));
+    console.log();
+}
+
+module.exports = providersCommand;

package/src/commands/status.js

@@ -1,78 +1,78 @@
-/**
- * securegate status — Show current authentication & connection state
- */
-
-const chalk = require('chalk');
-const ora = require('ora');
-const { getAuth, getConnections, CONFIG_FILE } = require('../config');
-const api = require('../api');
-
-async function statusCommand() {
-    console.log();
-    console.log(chalk.cyan.bold('📊 SecureGate Status'));
-    console.log(chalk.dim('━'.repeat(50)));
-    console.log();
-
-    // Auth status
-    const auth = getAuth();
-    if (!auth) {
-        console.log(chalk.dim('  Auth:   ') + chalk.red('Not logged in'));
-        console.log(chalk.dim(`  Run: ${chalk.cyan('securegate login')}`));
-        console.log();
-        return;
-    }
-
-    console.log(chalk.dim('  Auth:   ') + chalk.green('● Logged in'));
-    console.log(chalk.dim('  Email:  ') + chalk.white(auth.user?.email || 'unknown'));
-    console.log(chalk.dim('  ID:     ') + chalk.dim(auth.user?.id?.substring(0, 8) + '...'));
-
-    if (auth.expires_at) {
-        const remaining = auth.expires_at - Date.now();
-        if (remaining > 0) {
-            const mins = Math.round(remaining / 60000);
-            console.log(chalk.dim('  Token:  ') + chalk.green(`Valid (${mins}m remaining)`));
-        } else {
-            console.log(chalk.dim('  Token:  ') + chalk.yellow('Expired (will auto-refresh)'));
-        }
-    }
-    console.log();
-
-    // Local connections
-    const localConns = getConnections();
-    const localCount = Object.keys(localConns).length;
-    console.log(chalk.dim(`  Local keys: ${localCount} saved in ${CONFIG_FILE}`));
-
-    // Remote connections
-    const spinner = ora({ text: 'Fetching remote status...', indent: 2 }).start();
-    try {
-        const res = await api.listConnections();
-        if (res.status === 200) {
-            const conns = res.data?.connections || res.data || [];
-            spinner.succeed(`${conns.length} connection(s) on server`);
-
-            for (const c of conns) {
-                const keyCount = c.security_keys?.length || 0;
-                console.log(chalk.dim(`    ${chalk.cyan(c.connection_id)} — ${c.provider} — ${keyCount} key(s)`));
-            }
-        } else {
-            spinner.warn('Could not fetch remote status');
-        }
-    } catch (err) {
-        spinner.warn(`Could not reach server: ${err.message}`);
-    }
-
-    console.log();
-    // Plan info
-    try {
-        const profile = await api.getProfile();
-        if (profile.status === 200) {
-            const plan = profile.data?.plan || 'free';
-            const planColor = plan === 'free' ? chalk.dim : chalk.green;
-            console.log(chalk.dim('  Plan:   ') + planColor(plan.charAt(0).toUpperCase() + plan.slice(1)));
-        }
-    } catch { }
-
-    console.log();
-}
-
-module.exports = statusCommand;
+/**
+ * securegate status — Show current authentication & connection state
+ */
+
+const chalk = require('chalk');
+const ora = require('ora');
+const { getAuth, getConnections, CONFIG_FILE } = require('../config');
+const api = require('../api');
+
+async function statusCommand() {
+    console.log();
+    console.log(chalk.cyan.bold('📊 SecureGate Status'));
+    console.log(chalk.dim('━'.repeat(50)));
+    console.log();
+
+    // Auth status
+    const auth = getAuth();
+    if (!auth) {
+        console.log(chalk.dim('  Auth:   ') + chalk.red('Not logged in'));
+        console.log(chalk.dim(`  Run: ${chalk.cyan('securegate login')}`));
+        console.log();
+        return;
+    }
+
+    console.log(chalk.dim('  Auth:   ') + chalk.green('● Logged in'));
+    console.log(chalk.dim('  Email:  ') + chalk.white(auth.user?.email || 'unknown'));
+    console.log(chalk.dim('  ID:     ') + chalk.dim(auth.user?.id?.substring(0, 8) + '...'));
+
+    if (auth.expires_at) {
+        const remaining = auth.expires_at - Date.now();
+        if (remaining > 0) {
+            const mins = Math.round(remaining / 60000);
+            console.log(chalk.dim('  Token:  ') + chalk.green(`Valid (${mins}m remaining)`));
+        } else {
+            console.log(chalk.dim('  Token:  ') + chalk.yellow('Expired (will auto-refresh)'));
+        }
+    }
+    console.log();
+
+    // Local connections
+    const localConns = getConnections();
+    const localCount = Object.keys(localConns).length;
+    console.log(chalk.dim(`  Local keys: ${localCount} saved in ${CONFIG_FILE}`));
+
+    // Remote connections
+    const spinner = ora({ text: 'Fetching remote status...', indent: 2 }).start();
+    try {
+        const res = await api.listConnections();
+        if (res.status === 200) {
+            const conns = res.data?.connections || res.data || [];
+            spinner.succeed(`${conns.length} connection(s) on server`);
+
+            for (const c of conns) {
+                const keyCount = c.security_keys?.length || 0;
+                console.log(chalk.dim(`    ${chalk.cyan(c.connection_id)} — ${c.provider} — ${keyCount} key(s)`));
+            }
+        } else {
+            spinner.warn('Could not fetch remote status');
+        }
+    } catch (err) {
+        spinner.warn(`Could not reach server: ${err.message}`);
+    }
+
+    console.log();
+    // Plan info
+    try {
+        const profile = await api.getProfile();
+        if (profile.status === 200) {
+            const plan = profile.data?.plan || 'free';
+            const planColor = plan === 'free' ? chalk.dim : chalk.green;
+            console.log(chalk.dim('  Plan:   ') + planColor(plan.charAt(0).toUpperCase() + plan.slice(1)));
+        }
+    } catch { }
+
+    console.log();
+}
+
+module.exports = statusCommand;