seedyn 0.1.0 → 0.2.0

package/README.md

@@ -5,13 +5,17 @@ no runtime dependencies and requires Node.js 22.12 or newer.
 
 ## Setup
 
-Create an API key in Seedyn with the scopes needed for the files you plan to
-upload, then save it using a hidden terminal prompt:
+Open Seedyn in your browser, approve the requested upload scopes, and let the
+CLI save the new key:
 
 ```sh
-npx seedyn auth set
+npx seedyn auth login
 ```
 
+The browser encrypts the new credential to the waiting CLI process. The server
+cannot recover it from the login request. To store an existing key instead, run
+`npx seedyn auth set` and paste it into the hidden prompt.
+
 Credentials are written to `$XDG_CONFIG_HOME/seedyn/config.json`, or
 `~/.config/seedyn/config.json` when `XDG_CONFIG_HOME` is unset. The directory is
 mode `0700` and the file is mode `0600`. `SEEDYN_CONFIG_PATH` can select a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "seedyn",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Upload any file to Seedyn and receive its durable URL.",
   "type": "module",
   "license": "MIT",

package/src/browser-auth.mjs

@@ -0,0 +1,105 @@
+import { generateKeyPairSync, privateDecrypt } from "node:crypto";
+
+import { CliError } from "./errors.mjs";
+
+function delay(milliseconds) {
+  return new Promise((resolve) => setTimeout(resolve, milliseconds));
+}
+
+async function json(response) {
+  try {
+    return await response.json();
+  } catch {
+    return null;
+  }
+}
+
+function responseError(response, body) {
+  const message = body?.error?.message;
+  return new CliError(
+    typeof message === "string"
+      ? message
+      : `Seedyn authentication failed with HTTP ${response.status}.`,
+  );
+}
+
+export async function browserLogin({ apiUrl, version, openBrowser }) {
+  const { publicKey, privateKey } = generateKeyPairSync("rsa", {
+    modulusLength: 2_048,
+  });
+  const publicKeyPem = publicKey
+    .export({ type: "spki", format: "pem" })
+    .toString();
+
+  let startResponse;
+  try {
+    startResponse = await fetch(`${apiUrl}/api/cli-auth/start`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        "User-Agent": `seedyn/${version}`,
+      },
+      body: JSON.stringify({ publicKey: publicKeyPem }),
+    });
+  } catch (error) {
+    throw new CliError(`Could not reach ${apiUrl}.`, { cause: error });
+  }
+  const started = await json(startResponse);
+  if (!startResponse.ok) throw responseError(startResponse, started);
+  if (
+    typeof started?.requestId !== "string" ||
+    typeof started?.pollSecret !== "string" ||
+    typeof started?.verificationUrl !== "string" ||
+    typeof started?.expiresAt !== "string"
+  ) {
+    throw new CliError("Seedyn returned an invalid authentication response.");
+  }
+
+  console.log(`Open this page to connect the CLI:\n${started.verificationUrl}`);
+  if (openBrowser(started.verificationUrl)) {
+    console.log("Opened the page in your browser.");
+  }
+  console.log("Waiting for approval...");
+
+  const expiresAt = Date.parse(started.expiresAt);
+  const intervalMs = Math.max(
+    1_000,
+    Math.min(10_000, Number(started.intervalSeconds || 2) * 1_000),
+  );
+  while (Date.now() < expiresAt) {
+    await delay(intervalMs);
+    let response;
+    try {
+      response = await fetch(
+        `${apiUrl}/api/cli-auth/poll/${encodeURIComponent(started.requestId)}`,
+        {
+          headers: {
+            Authorization: `Bearer ${started.pollSecret}`,
+            "User-Agent": `seedyn/${version}`,
+          },
+        },
+      );
+    } catch {
+      continue;
+    }
+    const body = await json(response);
+    if (response.status === 202) continue;
+    if (!response.ok) throw responseError(response, body);
+    if (typeof body?.encryptedApiKey !== "string") {
+      throw new CliError("Seedyn returned an invalid encrypted credential.");
+    }
+    try {
+      return privateDecrypt(
+        { key: privateKey, oaepHash: "sha256" },
+        Buffer.from(body.encryptedApiKey, "base64"),
+      ).toString("utf8");
+    } catch (error) {
+      throw new CliError("The CLI could not decrypt the new credential.", {
+        cause: error,
+      });
+    }
+  }
+  throw new CliError(
+    "The login request expired. Run `seedyn auth login` again.",
+  );
+}

package/src/cli.mjs

@@ -12,6 +12,7 @@ import {
   validateApiUrl,
 } from "./config.mjs";
 import { CliError } from "./errors.mjs";
+import { browserLogin } from "./browser-auth.mjs";
 import { copyUrl, openUrl, uploadFile } from "./upload.mjs";
 
 const { version: VERSION } = createRequire(import.meta.url)("../package.json");
@@ -73,6 +74,42 @@ async function authCommand(args) {
     return;
   }
 
+  if (action === "login") {
+    const { values, positionals } = parseArgs({
+      args: args.slice(1),
+      allowPositionals: true,
+      strict: true,
+      options: {
+        "api-url": { type: "string" },
+        "no-open": { type: "boolean" },
+        help: { type: "boolean", short: "h" },
+      },
+    });
+    if (values.help) {
+      console.log(AUTH_LOGIN_HELP);
+      return;
+    }
+    if (positionals.length > 0) {
+      throw new CliError("auth login takes no arguments.");
+    }
+    const apiUrl = validateApiUrl(
+      values["api-url"] ||
+        process.env.SEEDYN_API_URL ||
+        "https://seedyn.dave.tips",
+    );
+    const key = validateApiKey(
+      await browserLogin({
+        apiUrl,
+        version: VERSION,
+        openBrowser: values["no-open"] ? () => false : openUrl,
+      }),
+    );
+    const result = await saveAuthentication({ apiKey: key, apiUrl });
+    console.log(`Seedyn credentials saved to ${result.file}`);
+    console.log(`API key: ${displayApiKey(key)}`);
+    return;
+  }
+
   if (action === "remove") {
     if (args.length > 1) throw new CliError("auth remove takes no arguments.");
     console.log(
@@ -249,7 +286,7 @@ Upload any file and receive its durable URL.
 Usage:
   seedyn <file> [options]
   seedyn upload <file> [options]
-  seedyn auth <set|status|remove>
+  seedyn auth <login|set|status|remove>
 
 Examples:
   seedyn ./image.png --copy
@@ -279,11 +316,19 @@ Options:
 const AUTH_HELP = `Usage: seedyn auth <command>
 
 Commands:
+  login                      Create a key through the Seedyn website
   set [api-key]              Store a key with owner-only permissions
   status                     Show config and redacted credential status
   remove                     Remove the stored API key
 
-Prefer bare "seedyn auth set" for a hidden prompt.`;
+Run "seedyn auth login" for the guided browser flow.`;
+
+const AUTH_LOGIN_HELP = `Usage: seedyn auth login [options]
+
+Options:
+  --api-url <origin>         Use and save a custom Seedyn application origin
+  --no-open                  Print the approval URL without opening a browser
+  -h, --help                 Show this help`;
 
 const AUTH_SET_HELP = `Usage: seedyn auth set [api-key] [options]
 

package/src/config.mjs

@@ -112,7 +112,7 @@ export async function resolveAuthentication(
     options.apiKey || environment.SEEDYN_API_KEY || config.apiKey;
   if (!candidate) {
     throw new CliError(
-      "Missing Seedyn API key. Run `seedyn auth set` or set SEEDYN_API_KEY.",
+      "Missing Seedyn API key. Run `seedyn auth login`, `seedyn auth set`, or set SEEDYN_API_KEY.",
     );
   }
   return { apiKey: validateApiKey(candidate), apiUrl };