seedyn 0.1.0 → 0.2.1

package/README.md

@@ -5,13 +5,17 @@ no runtime dependencies and requires Node.js 22.12 or newer.
 
 ## Setup
 
-Create an API key in Seedyn with the scopes needed for the files you plan to
-upload, then save it using a hidden terminal prompt:
+Open Seedyn in your browser, approve the requested upload scopes, and let the
+CLI save the new key:
 
 ```sh
-npx seedyn auth set
+npx seedyn auth login
 ```
 
+The browser encrypts the new credential to the waiting CLI process. The server
+cannot recover it from the login request. To store an existing key instead, run
+`npx seedyn auth set` and paste it into the hidden prompt.
+
 Credentials are written to `$XDG_CONFIG_HOME/seedyn/config.json`, or
 `~/.config/seedyn/config.json` when `XDG_CONFIG_HOME` is unset. The directory is
 mode `0700` and the file is mode `0600`. `SEEDYN_CONFIG_PATH` can select a
@@ -29,6 +33,19 @@ owner-only config file. API URL precedence is `--api-url`, then
 Passing a secret on the command line can expose it to shell history and process
 inspection; prefer the environment or `seedyn auth set`.
 
+## Self-hosted Seedyn
+
+Save the application origin once, then use the normal login flow:
+
+```sh
+npx seedyn config set api-url https://seedyn.example.com
+npx seedyn config get api-url
+npx seedyn auth login
+```
+
+The origin must use HTTPS. HTTP is accepted for `localhost` during development.
+For a one-off command, pass `--api-url`. In CI, set `SEEDYN_API_URL`.
+
 ## Upload
 
 The shortest form treats the first argument as a file:

package/package.json

@@ -1,9 +1,14 @@
 {
   "name": "seedyn",
-  "version": "0.1.0",
+  "version": "0.2.1",
   "description": "Upload any file to Seedyn and receive its durable URL.",
   "type": "module",
   "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/DavidIlie/seedyn.git",
+    "directory": "packages/cli"
+  },
   "files": [
     "bin/",
     "src/",
@@ -12,7 +17,7 @@
     "THIRD_PARTY_NOTICES.md"
   ],
   "bin": {
-    "seedyn": "./bin/seedyn.mjs"
+    "seedyn": "bin/seedyn.mjs"
   },
   "engines": {
     "node": ">=22.12.0"

package/src/browser-auth.mjs

@@ -0,0 +1,105 @@
+import { generateKeyPairSync, privateDecrypt } from "node:crypto";
+
+import { CliError } from "./errors.mjs";
+
+function delay(milliseconds) {
+  return new Promise((resolve) => setTimeout(resolve, milliseconds));
+}
+
+async function json(response) {
+  try {
+    return await response.json();
+  } catch {
+    return null;
+  }
+}
+
+function responseError(response, body) {
+  const message = body?.error?.message;
+  return new CliError(
+    typeof message === "string"
+      ? message
+      : `Seedyn authentication failed with HTTP ${response.status}.`,
+  );
+}
+
+export async function browserLogin({ apiUrl, version, openBrowser }) {
+  const { publicKey, privateKey } = generateKeyPairSync("rsa", {
+    modulusLength: 2_048,
+  });
+  const publicKeyPem = publicKey
+    .export({ type: "spki", format: "pem" })
+    .toString();
+
+  let startResponse;
+  try {
+    startResponse = await fetch(`${apiUrl}/api/cli-auth/start`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        "User-Agent": `seedyn/${version}`,
+      },
+      body: JSON.stringify({ publicKey: publicKeyPem }),
+    });
+  } catch (error) {
+    throw new CliError(`Could not reach ${apiUrl}.`, { cause: error });
+  }
+  const started = await json(startResponse);
+  if (!startResponse.ok) throw responseError(startResponse, started);
+  if (
+    typeof started?.requestId !== "string" ||
+    typeof started?.pollSecret !== "string" ||
+    typeof started?.verificationUrl !== "string" ||
+    typeof started?.expiresAt !== "string"
+  ) {
+    throw new CliError("Seedyn returned an invalid authentication response.");
+  }
+
+  console.log(`Open this page to connect the CLI:\n${started.verificationUrl}`);
+  if (openBrowser(started.verificationUrl)) {
+    console.log("Opened the page in your browser.");
+  }
+  console.log("Waiting for approval...");
+
+  const expiresAt = Date.parse(started.expiresAt);
+  const intervalMs = Math.max(
+    1_000,
+    Math.min(10_000, Number(started.intervalSeconds || 2) * 1_000),
+  );
+  while (Date.now() < expiresAt) {
+    await delay(intervalMs);
+    let response;
+    try {
+      response = await fetch(
+        `${apiUrl}/api/cli-auth/poll/${encodeURIComponent(started.requestId)}`,
+        {
+          headers: {
+            Authorization: `Bearer ${started.pollSecret}`,
+            "User-Agent": `seedyn/${version}`,
+          },
+        },
+      );
+    } catch {
+      continue;
+    }
+    const body = await json(response);
+    if (response.status === 202) continue;
+    if (!response.ok) throw responseError(response, body);
+    if (typeof body?.encryptedApiKey !== "string") {
+      throw new CliError("Seedyn returned an invalid encrypted credential.");
+    }
+    try {
+      return privateDecrypt(
+        { key: privateKey, oaepHash: "sha256" },
+        Buffer.from(body.encryptedApiKey, "base64"),
+      ).toString("utf8");
+    } catch (error) {
+      throw new CliError("The CLI could not decrypt the new credential.", {
+        cause: error,
+      });
+    }
+  }
+  throw new CliError(
+    "The login request expired. Run `seedyn auth login` again.",
+  );
+}

package/src/cli.mjs

@@ -7,11 +7,13 @@ import {
   readConfig,
   removeAuthentication,
   resolveAuthentication,
+  saveApiUrl,
   saveAuthentication,
   validateApiKey,
   validateApiUrl,
 } from "./config.mjs";
 import { CliError } from "./errors.mjs";
+import { browserLogin } from "./browser-auth.mjs";
 import { copyUrl, openUrl, uploadFile } from "./upload.mjs";
 
 const { version: VERSION } = createRequire(import.meta.url)("../package.json");
@@ -31,6 +33,10 @@ export async function run(arguments_) {
     await authCommand(args.slice(1));
     return;
   }
+  if (first === "config") {
+    await configCommand(args.slice(1));
+    return;
+  }
   await uploadCommand(first === "upload" ? args.slice(1) : args);
 }
 
@@ -73,6 +79,42 @@ async function authCommand(args) {
     return;
   }
 
+  if (action === "login") {
+    const { values, positionals } = parseArgs({
+      args: args.slice(1),
+      allowPositionals: true,
+      strict: true,
+      options: {
+        "api-url": { type: "string" },
+        "no-open": { type: "boolean" },
+        help: { type: "boolean", short: "h" },
+      },
+    });
+    if (values.help) {
+      console.log(AUTH_LOGIN_HELP);
+      return;
+    }
+    if (positionals.length > 0) {
+      throw new CliError("auth login takes no arguments.");
+    }
+    const apiUrl = validateApiUrl(
+      values["api-url"] ||
+        process.env.SEEDYN_API_URL ||
+        "https://seedyn.dave.tips",
+    );
+    const key = validateApiKey(
+      await browserLogin({
+        apiUrl,
+        version: VERSION,
+        openBrowser: values["no-open"] ? () => false : openUrl,
+      }),
+    );
+    const result = await saveAuthentication({ apiKey: key, apiUrl });
+    console.log(`Seedyn credentials saved to ${result.file}`);
+    console.log(`API key: ${displayApiKey(key)}`);
+    return;
+  }
+
   if (action === "remove") {
     if (args.length > 1) throw new CliError("auth remove takes no arguments.");
     console.log(
@@ -98,6 +140,35 @@ async function authCommand(args) {
   throw new CliError(`Unknown auth command: ${action}`);
 }
 
+async function configCommand(args) {
+  const action = args[0] || "help";
+  if (action === "help" || action === "--help" || action === "-h") {
+    console.log(CONFIG_HELP);
+    return;
+  }
+
+  if (action === "set" && args[1] === "api-url") {
+    if (args.length !== 3) {
+      throw new CliError("Usage: seedyn config set api-url <origin>");
+    }
+    const result = await saveApiUrl(args[2]);
+    console.log(`API URL saved to ${result.file}`);
+    console.log(`API URL: ${result.value.apiUrl}`);
+    return;
+  }
+
+  if (action === "get" && args[1] === "api-url") {
+    if (args.length !== 2) {
+      throw new CliError("Usage: seedyn config get api-url");
+    }
+    const config = await readConfig();
+    console.log(config.apiUrl || "https://seedyn.dave.tips");
+    return;
+  }
+
+  throw new CliError(`Unknown config command: ${args.join(" ")}`);
+}
+
 async function uploadCommand(args) {
   const { values, positionals } = parseArgs({
     args,
@@ -249,7 +320,8 @@ Upload any file and receive its durable URL.
 Usage:
   seedyn <file> [options]
   seedyn upload <file> [options]
-  seedyn auth <set|status|remove>
+  seedyn auth <login|set|status|remove>
+  seedyn config <set|get> api-url
 
 Examples:
   seedyn ./image.png --copy
@@ -279,11 +351,25 @@ Options:
 const AUTH_HELP = `Usage: seedyn auth <command>
 
 Commands:
+  login                      Create a key through the Seedyn website
   set [api-key]              Store a key with owner-only permissions
   status                     Show config and redacted credential status
   remove                     Remove the stored API key
 
-Prefer bare "seedyn auth set" for a hidden prompt.`;
+Run "seedyn auth login" for the guided browser flow.`;
+
+const CONFIG_HELP = `Usage: seedyn config <command>
+
+Commands:
+  set api-url <origin>       Save a self-hosted Seedyn application origin
+  get api-url                Print the configured application origin`;
+
+const AUTH_LOGIN_HELP = `Usage: seedyn auth login [options]
+
+Options:
+  --api-url <origin>         Use and save a custom Seedyn application origin
+  --no-open                  Print the approval URL without opening a browser
+  -h, --help                 Show this help`;
 
 const AUTH_SET_HELP = `Usage: seedyn auth set [api-key] [options]
 

package/src/config.mjs

@@ -112,7 +112,7 @@ export async function resolveAuthentication(
     options.apiKey || environment.SEEDYN_API_KEY || config.apiKey;
   if (!candidate) {
     throw new CliError(
-      "Missing Seedyn API key. Run `seedyn auth set` or set SEEDYN_API_KEY.",
+      "Missing Seedyn API key. Run `seedyn auth login`, `seedyn auth set`, or set SEEDYN_API_KEY.",
     );
   }
   return { apiKey: validateApiKey(candidate), apiUrl };
@@ -133,6 +133,17 @@ export async function saveAuthentication(
   return { file: configPath(environment), value: next };
 }
 
+export async function saveApiUrl(apiUrl, environment = process.env) {
+  const existing = await readConfig(environment);
+  const next = {
+    ...existing,
+    apiUrl: validateApiUrl(apiUrl),
+    updatedAt: new Date().toISOString(),
+  };
+  await writeConfig(next, environment);
+  return { file: configPath(environment), value: next };
+}
+
 export async function removeAuthentication(environment = process.env) {
   const existing = await readConfig(environment);
   const { apiKey: _removed, ...next } = existing;