sitevision-cli 1.0.0-beta.0 → 1.0.0-beta.10

package/dist/utils/project-detection.js

@@ -1,6 +1,26 @@
 import fs from 'fs';
 import path from 'path';
-import { getDeployPassword, setDeployPassword } from './keychain.js';
+import { getDeployPassword, setDeployPassword, getSessionCookie, } from './keychain.js';
+import { parseJsonc } from './jsonc.js';
+// =============================================================================
+// LOCALIZED TEXT
+// =============================================================================
+/**
+ * Resolve a manifest text field that may be a plain string or a localized
+ * object (e.g. `{sv: 'Namn', en: 'Name'}`) to a single display string.
+ *
+ * Preference order: Swedish, then English, then any available language. Returns
+ * an empty string for missing/empty values. This guards the UI from rendering a
+ * raw object as a React child, which Sitevision's localized manifests would
+ * otherwise trigger.
+ */
+export function localizedText(value, preferred = 'sv') {
+    if (!value)
+        return '';
+    if (typeof value === 'string')
+        return value;
+    return value[preferred] ?? value['en'] ?? Object.values(value)[0] ?? '';
+}
 // =============================================================================
 // PATH UTILITIES
 // =============================================================================
@@ -135,29 +155,56 @@ export function buildImportEndpointUrl(domain, siteName, addonName, appType, use
 // =============================================================================
 // PROJECT DETECTION
 // =============================================================================
+/**
+ * Thrown when a manifest.json is present but cannot be parsed. Kept distinct from
+ * a plain "no project here" (null) so the CLI can tell the user their manifest is
+ * malformed instead of the misleading "Not a Sitevision project".
+ */
+export class ManifestParseError extends Error {
+    constructor(manifestPath, cause) {
+        const reason = cause instanceof Error ? cause.message : String(cause);
+        super(`${manifestPath} is not valid JSON: ${reason}`);
+        this.name = 'ManifestParseError';
+    }
+}
+/**
+ * Read manifest.json from its supported locations (root, static/, src/).
+ * Throws ManifestParseError on malformed JSON.
+ */
+export function readManifest(cwd) {
+    const manifestPaths = [
+        path.join(cwd, 'manifest.json'),
+        path.join(cwd, 'static', 'manifest.json'),
+        path.join(cwd, 'src', 'manifest.json'),
+    ];
+    for (const manifestPath of manifestPaths) {
+        if (!fs.existsSync(manifestPath)) {
+            continue;
+        }
+        // Manifests may contain comments (Sitevision's own docs show them), so
+        // parse as JSONC.
+        try {
+            return {
+                manifestPath,
+                manifest: parseJsonc(fs.readFileSync(manifestPath, 'utf-8')),
+            };
+        }
+        catch (error) {
+            throw new ManifestParseError(manifestPath, error);
+        }
+    }
+    return null;
+}
 /**
  * Detect if the current directory is a Sitevision project
  */
 export function detectProject(cwd = process.cwd()) {
     try {
-        // Look for manifest.json in multiple locations (current, static/, src/)
-        const manifestPaths = [
-            path.join(cwd, 'manifest.json'),
-            path.join(cwd, 'static', 'manifest.json'),
-            path.join(cwd, 'src', 'manifest.json'),
-        ];
-        let manifestPath = null;
-        let manifest = null;
-        for (const p of manifestPaths) {
-            if (fs.existsSync(p)) {
-                manifestPath = p;
-                manifest = JSON.parse(fs.readFileSync(p, 'utf-8'));
-                break;
-            }
-        }
-        if (!manifest || !manifestPath) {
+        const found = readManifest(cwd);
+        if (!found) {
             return null;
         }
+        const { manifestPath, manifest } = found;
         // Check for package.json
         const packageJsonPath = path.join(cwd, 'package.json');
         if (!fs.existsSync(packageJsonPath)) {
@@ -197,6 +244,25 @@ export function detectProject(cwd = process.cwd()) {
                         }
                     }
                 }
+                // Resolve an OAuth2 access token: env var > keychain refresh.
+                // The env var is the manual/CI path; the interactive login stores a
+                // refresh token in the keychain and mints access tokens from it.
+                if (devProperties.authMethod === 'oauth2') {
+                    const envToken = process.env['SITEVISION_ACCESS_TOKEN'];
+                    if (envToken) {
+                        devProperties.accessToken = envToken;
+                    }
+                }
+                // Resolve a session cookie: env var > keychain (captured at login).
+                if (devProperties.authMethod === 'cookie' &&
+                    devProperties.domain &&
+                    devProperties.username) {
+                    const envCookie = process.env['SITEVISION_SESSION_COOKIE'];
+                    devProperties.sessionCookie =
+                        envCookie ??
+                            getSessionCookie(devProperties.domain, devProperties.username) ??
+                            undefined;
+                }
             }
             catch {
                 // Invalid dev properties file
@@ -219,7 +285,12 @@ export function detectProject(cwd = process.cwd()) {
             paths,
         };
     }
-    catch {
+    catch (error) {
+        // A malformed manifest is a real error the user should see; everything else
+        // (missing files, unreadable optional config) just means "no project here".
+        if (error instanceof ManifestParseError) {
+            throw error;
+        }
         return null;
     }
 }
@@ -271,15 +342,102 @@ export function readDevProperties(projectRoot) {
     }
 }
 /**
- * Write dev properties to file. The `password` field is never persisted —
- * it is held in the OS keychain instead.
+ * Write dev properties to file. Secrets are never persisted — `password`,
+ * `accessToken` and `sessionCookie` are held in the OS keychain / resolved at
+ * runtime instead.
  */
 export function writeDevProperties(projectRoot, properties) {
     const devPropertiesPath = findDevPropertiesPath(projectRoot) ||
         getDefaultDevPropertiesPath(projectRoot);
-    const { password: _password, ...persisted } = properties;
+    const { password: _password, accessToken: _accessToken, sessionCookie: _sessionCookie, ...persisted } = properties;
     fs.writeFileSync(devPropertiesPath, JSON.stringify(persisted, null, 2));
 }
+export function readSvcConfig(projectRoot) {
+    try {
+        return parseJsonc(fs.readFileSync(path.join(projectRoot, '.svcconfig'), 'utf-8'));
+    }
+    catch {
+        return {};
+    }
+}
+export function writeSvcConfig(projectRoot, updates) {
+    const merged = { ...readSvcConfig(projectRoot), ...updates };
+    fs.writeFileSync(path.join(projectRoot, '.svcconfig'), JSON.stringify(merged, null, 2) + '\n');
+}
+// =============================================================================
+// PACKAGE.JSON SYNC
+// =============================================================================
+/**
+ * Fields duplicated between .dev_properties.json and package.json, where
+ * sitevision-scripts reads them under different names.
+ */
+const PACKAGE_JSON_SYNC_KEYS = [
+    { packageKey: 'developmentDomain', devKey: 'domain' },
+    { packageKey: 'siteName', devKey: 'siteName' },
+    { packageKey: 'addonName', devKey: 'addonName' },
+];
+function readPackageJson(projectRoot) {
+    try {
+        return JSON.parse(fs.readFileSync(path.join(projectRoot, 'package.json'), 'utf-8'));
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Which of the shared fields package.json is missing or disagrees on, relative
+ * to the given dev properties. Reads package.json from disk — an earlier
+ * `npm install` in the same session may have rewritten it.
+ */
+export function getPackageJsonSyncChanges(projectRoot, properties) {
+    const packageJson = readPackageJson(projectRoot);
+    if (!packageJson)
+        return [];
+    const changes = [];
+    for (const { packageKey, devKey } of PACKAGE_JSON_SYNC_KEYS) {
+        const to = properties[devKey];
+        if (typeof to !== 'string' || to === '')
+            continue;
+        const from = packageJson[packageKey];
+        if (from !== to) {
+            changes.push(from === undefined
+                ? { key: packageKey, to }
+                : { key: packageKey, from, to });
+        }
+    }
+    return changes;
+}
+/**
+ * Copy the shared fields from dev properties into package.json, preserving the
+ * file's existing indentation and trailing newline.
+ */
+export function syncDevPropertiesToPackageJson(projectRoot, properties) {
+    const packageJsonPath = path.join(projectRoot, 'package.json');
+    let raw;
+    try {
+        raw = fs.readFileSync(packageJsonPath, 'utf-8');
+    }
+    catch {
+        return false;
+    }
+    let packageJson;
+    try {
+        packageJson = JSON.parse(raw);
+    }
+    catch {
+        return false;
+    }
+    for (const { packageKey, devKey } of PACKAGE_JSON_SYNC_KEYS) {
+        const value = properties[devKey];
+        if (typeof value === 'string' && value !== '') {
+            packageJson[packageKey] = value;
+        }
+    }
+    const indent = /^(?<indent>[\t ]+)/m.exec(raw)?.groups?.['indent'] ?? '\t';
+    const newline = raw.endsWith('\n') ? '\n' : '';
+    fs.writeFileSync(packageJsonPath, JSON.stringify(packageJson, null, indent) + newline);
+    return true;
+}
 /**
  * Move a plaintext password from .dev_properties.json into the OS keychain and
  * strip it from the file. Returns true if the password was migrated.

package/dist/utils/session-cookie-auth.d.ts

@@ -0,0 +1,34 @@
+import type { DevProperties } from '../types/index.js';
+interface RawCookie {
+    name: string;
+    value: string;
+    domain: string;
+}
+export interface CaptureResult {
+    cookie?: string;
+    note?: string;
+    error?: string;
+}
+export interface CookieLoginSession {
+    capture: () => Promise<CaptureResult>;
+    close: () => Promise<void>;
+}
+/**
+ * Pick the session from a cookie jar: find JSESSIONID (preferring the deploy
+ * host), then return every cookie on that host as a `Cookie:` header. On miss,
+ * return diagnostics naming the domains actually seen. Pure — no keychain, no
+ * browser — so it's unit-testable.
+ */
+export declare function selectSessionCookie(all: RawCookie[], siteDomain: string): CaptureResult;
+/**
+ * Launch a real browser at the login URL for an interactive SAML/SSO login and
+ * return handles to capture the session and close the browser. UI-agnostic: the
+ * Ink login screen decides when to `capture()` (on the user's keypress) and
+ * `close()`. Returns null if the browser can't be launched.
+ *
+ * `capture()` reads the whole cookie jar via CDP (httponly and secure included),
+ * stores the session in the keychain on success, and otherwise returns
+ * diagnostics naming the cookie domains it actually saw.
+ */
+export declare function beginCookieLogin(dev: DevProperties): Promise<CookieLoginSession | null>;
+export {};

package/dist/utils/session-cookie-auth.js

@@ -0,0 +1,99 @@
+import { setSessionCookie } from './keychain.js';
+function bareDomain(domain) {
+    return domain.replace(/^\./, '');
+}
+/** Related if either host is the other or a subdomain of it (both directions). */
+function domainRelated(a, b) {
+    const x = bareDomain(a);
+    const y = bareDomain(b);
+    return x === y || x.endsWith(`.${y}`) || y.endsWith(`.${x}`);
+}
+/**
+ * Pick the session from a cookie jar: find JSESSIONID (preferring the deploy
+ * host), then return every cookie on that host as a `Cookie:` header. On miss,
+ * return diagnostics naming the domains actually seen. Pure — no keychain, no
+ * browser — so it's unit-testable.
+ */
+export function selectSessionCookie(all, siteDomain) {
+    const sessions = all.filter(c => c.name === 'JSESSIONID');
+    if (sessions.length === 0) {
+        const domains = [...new Set(all.map(c => bareDomain(c.domain)))];
+        return {
+            error: `No JSESSIONID among ${all.length} cookies. Domains seen: ${domains.join(', ') || 'none'}. If these are only your IdP, open a Sitevision page in the browser, then press Enter again.`,
+        };
+    }
+    const chosen = sessions.find(c => domainRelated(c.domain, siteDomain)) ?? sessions[0];
+    const cookies = all.filter(c => domainRelated(c.domain, chosen.domain));
+    return {
+        cookie: cookies.map(c => `${c.name}=${c.value}`).join('; '),
+        note: `Captured session on ${bareDomain(chosen.domain)} (${cookies.length} cookies).`,
+    };
+}
+/** Read every cookie in the browser jar (httponly and secure included). */
+async function readAllCookies(browser, page) {
+    // puppeteer >= 22 exposes the whole jar directly.
+    if (typeof browser.cookies === 'function') {
+        try {
+            return (await browser.cookies());
+        }
+        catch {
+            // Fall through to CDP.
+        }
+    }
+    const client = await page.createCDPSession();
+    const { cookies } = await client.send('Network.getAllCookies');
+    return cookies;
+}
+/**
+ * Launch a real browser at the login URL for an interactive SAML/SSO login and
+ * return handles to capture the session and close the browser. UI-agnostic: the
+ * Ink login screen decides when to `capture()` (on the user's keypress) and
+ * `close()`. Returns null if the browser can't be launched.
+ *
+ * `capture()` reads the whole cookie jar via CDP (httponly and secure included),
+ * stores the session in the keychain on success, and otherwise returns
+ * diagnostics naming the cookie domains it actually saw.
+ */
+export async function beginCookieLogin(dev) {
+    const { domain, username } = dev;
+    if (!domain || !username)
+        return null;
+    let puppeteer;
+    try {
+        ({ default: puppeteer } = await import('puppeteer-core'));
+    }
+    catch {
+        return null;
+    }
+    let browser;
+    try {
+        browser = await puppeteer.launch({ headless: false, channel: 'chrome' });
+        const page = await browser.newPage();
+        const loginUrl = dev.sessionLoginUrl || `https://${domain}/`;
+        await page.goto(loginUrl, { waitUntil: 'domcontentloaded' }).catch(() => {
+            // A SAML redirect may abort the initial navigation — that's fine.
+        });
+        const capture = async () => {
+            const all = await readAllCookies(browser, page);
+            const result = selectSessionCookie(all, domain);
+            if (result.cookie) {
+                setSessionCookie(domain, username, result.cookie);
+            }
+            return result;
+        };
+        const close = async () => {
+            await browser.close().catch(() => {
+                // Best-effort close.
+            });
+        };
+        return { capture, close };
+    }
+    catch {
+        if (browser) {
+            await browser.close().catch(() => {
+                // Best-effort close.
+            });
+        }
+        return null;
+    }
+}

package/dist/utils/sitevision-api.d.ts

@@ -13,6 +13,27 @@ import type { SigningCredentials, DeployConfig, ProductionDeployConfig, SigningR
  * Create Basic Auth header value
  */
 declare function createBasicAuth(username: string, password: string): string;
+type RequestAuth = {
+    username: string;
+    password: string;
+} | {
+    token: string;
+} | {
+    cookie: string;
+};
+type AuthKind = 'basic' | 'bearer' | 'cookie';
+/** Single source of the 401 message, worded for the auth kind actually used. */
+declare function unauthorizedMessage(kind: AuthKind): string;
+/** Pick cookie > bearer > basic based on what the deploy config carries. */
+declare function configAuth(config: {
+    username: string;
+    password?: string;
+    accessToken?: string;
+    sessionCookie?: string;
+}): {
+    auth: RequestAuth;
+    kind: AuthKind;
+};
 /**
  * Make an HTTP/HTTPS request
  */
@@ -20,10 +41,7 @@ export declare function makeRequest(url: string, options: {
     method: string;
     headers?: Record<string, string>;
     body?: Buffer;
-    auth?: {
-        username: string;
-        password: string;
-    };
+    auth?: RequestAuth;
     timeoutMs?: number;
 }): Promise<{
     statusCode: number;
@@ -45,6 +63,12 @@ export declare function summarizeErrorBody(body: Buffer, headers: Record<string,
  * the signing endpoint returns an error page with HTTP 200.
  */
 export declare function looksLikeZip(body: Buffer): boolean;
+/**
+ * A stale Sitevision session usually answers with a redirect to the login page
+ * or a 200 carrying an HTML login form — not a clean 401. Detect both so cookie
+ * auth can drop the dead session and re-login instead of showing a generic error.
+ */
+export declare function looksLikeAuthExpired(statusCode: number, body: Buffer, headers: Record<string, string>): boolean;
 /**
  * Sign an app via developer.sitevision.se
  *
@@ -85,4 +109,4 @@ export declare function createAddon(config: DeployConfig, appType: SimpleAppType
  * @param appType - The app type (web, widget, rest)
  */
 export declare function activateApp(executableId: string, config: DeployConfig, _appType: SimpleAppType): Promise<ActivationResponse>;
-export { createBasicAuth };
+export { createBasicAuth, configAuth, unauthorizedMessage };