sitevision-cli 1.0.0-beta.11 → 1.0.0-beta.13

package/dist/components/AuthLoginScreen.js

@@ -28,13 +28,13 @@ export function AuthLoginScreen({ method, devProperties, onComplete, onError, on
                 setAuthUrl(session.authUrl);
                 openBrowser(session.authUrl);
                 setPhase('awaiting');
-                const token = await session.complete();
+                const { token, error } = await session.complete();
                 cancelOAuthRef.current = null;
                 if (token) {
                     onComplete({ accessToken: token });
                 }
                 else {
-                    onError('OAuth2 login failed, timed out, or was rejected.');
+                    onError(error ?? 'OAuth2 login failed.');
                 }
             }
             else {

package/dist/components/DevPropertiesForm.js

@@ -1,10 +1,10 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-import { useState } from 'react';
+import { useState, useEffect } from 'react';
 import { Box, Text, useInput } from 'ink';
 import { TextInput } from './TextInput.js';
 import { writeDevProperties } from '../utils/project-detection.js';
 import { setDeployPassword, deleteDeployPassword, setOAuth2ClientSecret, } from '../utils/keychain.js';
-import { DEFAULT_REDIRECT_PORT } from '../utils/oauth2-auth.js';
+import { DEFAULT_REDIRECT_PORT, discoverOAuth2Config, } from '../utils/oauth2-auth.js';
 const LABELS = {
     domain: 'Domain',
     siteName: 'Site Name',
@@ -50,8 +50,39 @@ export function DevPropertiesForm({ projectRoot, initialProperties, packageJson,
         scopes: initialProperties?.oauth2?.scopes?.join(' ') ?? '',
         clientSecret: '',
     }));
+    const [discoveryNote, setDiscoveryNote] = useState('');
     const method = properties.authMethod ?? 'basic';
     const isOAuth = method === 'oauth2';
+    // When OAuth2 is chosen, auto-fill the endpoints from the site's OpenID
+    // configuration (unauthenticated) so the user doesn't type them in.
+    useEffect(() => {
+        if (method !== 'oauth2' || !properties.domain)
+            return;
+        if (oauth.authorizationEndpoint && oauth.tokenEndpoint)
+            return;
+        let cancelled = false;
+        setDiscoveryNote('Looking up OAuth2 endpoints…');
+        void discoverOAuth2Config(properties.domain, properties.useHTTPForDevDeploy).then(discovered => {
+            if (cancelled)
+                return;
+            if (discovered) {
+                setOauth(previous => ({
+                    ...previous,
+                    authorizationEndpoint: previous.authorizationEndpoint || discovered.authorizationEndpoint,
+                    tokenEndpoint: previous.tokenEndpoint || discovered.tokenEndpoint,
+                    scopes: previous.scopes || (discovered.scopesSupported?.join(' ') ?? ''),
+                }));
+                setDiscoveryNote('Endpoints auto-filled from the site OpenID config.');
+            }
+            else {
+                setDiscoveryNote('Could not auto-discover endpoints — enter them below.');
+            }
+        });
+        return () => {
+            cancelled = true;
+        };
+        // eslint-disable-next-line react-hooks/exhaustive-deps
+    }, [method, properties.domain]);
     const methodSteps = method === 'oauth2'
         ? [
             'oauthClientId',
@@ -177,7 +208,7 @@ export function DevPropertiesForm({ projectRoot, initialProperties, packageJson,
                 return null;
         }
     };
-    return (_jsxs(Box, { flexDirection: "column", padding: 1, children: [_jsxs(Box, { marginBottom: 1, children: [_jsx(Text, { bold: true, color: "cyan", children: "Setup Development Properties" }), _jsxs(Text, { children: [' ', "Step ", stepIndex + 1, " of ", steps.length, ":", ' ', currentStep ? LABELS[currentStep] : ''] })] }), isOAuth && (_jsx(Box, { marginBottom: 1, children: _jsxs(Text, { dimColor: true, children: ["Whitelist this redirect URI on the OAuth2 client: http://127.0.0.1:", redirectPort, "/callback"] }) })), _jsx(Box, { marginBottom: 1, children: steps.map((s, i) => (_jsx(Box, { marginRight: 1, children: _jsx(Text, { color: i <= stepIndex ? 'green' : 'gray', children: i < stepIndex ? '✓' : i === stepIndex ? '●' : '○' }) }, s))) }), _jsx(Box, { borderStyle: "single", borderColor: "gray", padding: 1, children: renderInput() })] }));
+    return (_jsxs(Box, { flexDirection: "column", padding: 1, children: [_jsxs(Box, { marginBottom: 1, children: [_jsx(Text, { bold: true, color: "cyan", children: "Setup Development Properties" }), _jsxs(Text, { children: [' ', "Step ", stepIndex + 1, " of ", steps.length, ":", ' ', currentStep ? LABELS[currentStep] : ''] })] }), isOAuth && (_jsxs(Box, { marginBottom: 1, flexDirection: "column", children: [_jsxs(Text, { dimColor: true, children: ["Whitelist this redirect URI on the OAuth2 client: http://127.0.0.1:", redirectPort, "/callback"] }), discoveryNote && _jsx(Text, { color: "yellow", children: discoveryNote })] })), _jsx(Box, { marginBottom: 1, children: steps.map((s, i) => (_jsx(Box, { marginRight: 1, children: _jsx(Text, { color: i <= stepIndex ? 'green' : 'gray', children: i < stepIndex ? '✓' : i === stepIndex ? '●' : '○' }) }, s))) }), _jsx(Box, { borderStyle: "single", borderColor: "gray", padding: 1, children: renderInput() })] }));
 }
 function MethodSelect({ defaultValue, onSubmit, }) {
     const [index, setIndex] = useState(() => Math.max(0, AUTH_METHODS.findIndex(m => m.value === defaultValue)));

package/dist/utils/oauth2-auth.d.ts

@@ -6,7 +6,39 @@ export declare function createPkcePair(): {
     verifier: string;
     challenge: string;
 };
+export interface DiscoveredOAuth2 {
+    authorizationEndpoint: string;
+    tokenEndpoint: string;
+    scopesSupported?: string[];
+}
+/**
+ * Fetch the site's OpenID configuration (unauthenticated) to auto-fill the
+ * authorization/token endpoints. Returns null if it isn't published (provider
+ * not enabled) or the response isn't a valid config, so callers fall back to
+ * manual entry.
+ */
+export declare function discoverOAuth2Config(domain: string, useHTTP?: boolean): Promise<DiscoveredOAuth2 | null>;
 export declare function openBrowser(url: string): void;
+/**
+ * Serve the loopback redirect once. Returns the awaited code and a `close()`
+ * that shuts the server down (freeing the port) if the login is cancelled — so
+ * a retry doesn't hit an EADDRINUSE on the fixed redirect port.
+ */
+interface LoopbackResult {
+    code?: string;
+    error?: string;
+}
+/**
+ * Turn a redirect's query params into a result, prioritizing the provider's own
+ * error (the most useful reason) over a generic "no code". Exported for testing.
+ */
+export declare function classifyRedirect(params: {
+    expectedState: string;
+    state: string | null;
+    error: string | null;
+    errorDescription: string | null;
+    code: string | null;
+}): LoopbackResult;
 /**
  * Start an interactive OAuth2 login. Returns the authorize URL to open and a
  * `complete()` that awaits the loopback redirect, exchanges the code, stores the
@@ -15,7 +47,10 @@ export declare function openBrowser(url: string): void;
  */
 export declare function beginOAuth2Login(dev: DevProperties): {
     authUrl: string;
-    complete: () => Promise<string | null>;
+    complete: () => Promise<{
+        token?: string;
+        error?: string;
+    }>;
     cancel: () => void;
 } | null;
 /**
@@ -25,3 +60,4 @@ export declare function beginOAuth2Login(dev: DevProperties): {
  * driven by the Ink login screen — the access token is never persisted.
  */
 export declare function resolveOAuth2AccessToken(dev: DevProperties): Promise<string | null>;
+export {};

package/dist/utils/oauth2-auth.js

@@ -1,7 +1,7 @@
 import http from 'http';
 import crypto from 'crypto';
 import { spawn } from 'child_process';
-import { makeRequest } from './sitevision-api.js';
+import { makeRequest, summarizeErrorBody } from './sitevision-api.js';
 import { getOAuth2RefreshToken, setOAuth2RefreshToken, deleteOAuth2RefreshToken, getOAuth2ClientSecret, } from './keychain.js';
 /** Default loopback port. Fixed so a single redirect URI can be whitelisted. */
 export const DEFAULT_REDIRECT_PORT = 8137;
@@ -36,9 +36,45 @@ async function postToken(config, params, secret) {
             // client_secret_basic when confidential; public+PKCE clients omit it.
             auth: secret ? { username: config.clientId, password: secret } : undefined,
         });
+        if (response.statusCode !== 200) {
+            return {
+                error: `Token endpoint returned ${response.statusCode}: ${summarizeErrorBody(response.body, response.headers)}`,
+            };
+        }
+        return { tokens: JSON.parse(response.body.toString()) };
+    }
+    catch (error) {
+        return {
+            error: `Token request failed: ${error instanceof Error ? error.message : String(error)}`,
+        };
+    }
+}
+/** OpenID configuration path (published at the issuer root once the provider is saved). */
+const DISCOVERY_PATH = '/.well-known/openid-configuration';
+/**
+ * Fetch the site's OpenID configuration (unauthenticated) to auto-fill the
+ * authorization/token endpoints. Returns null if it isn't published (provider
+ * not enabled) or the response isn't a valid config, so callers fall back to
+ * manual entry.
+ */
+export async function discoverOAuth2Config(domain, useHTTP = false) {
+    if (!domain)
+        return null;
+    const protocol = useHTTP ? 'http' : 'https';
+    try {
+        const response = await makeRequest(`${protocol}://${domain}${DISCOVERY_PATH}`, { method: 'GET' });
         if (response.statusCode !== 200)
             return null;
-        return JSON.parse(response.body.toString());
+        const doc = JSON.parse(response.body.toString());
+        if (!doc.authorization_endpoint || !doc.token_endpoint)
+            return null;
+        return {
+            authorizationEndpoint: doc.authorization_endpoint,
+            tokenEndpoint: doc.token_endpoint,
+            scopesSupported: Array.isArray(doc.scopes_supported)
+                ? doc.scopes_supported
+                : undefined,
+        };
     }
     catch {
         return null;
@@ -56,14 +92,37 @@ export function openBrowser(url) {
     }
 }
 /**
- * Serve the loopback redirect once. Returns the awaited code and a `close()`
- * that shuts the server down (freeing the port) if the login is cancelled — so
- * a retry doesn't hit an EADDRINUSE on the fixed redirect port.
+ * Turn a redirect's query params into a result, prioritizing the provider's own
+ * error (the most useful reason) over a generic "no code". Exported for testing.
  */
+export function classifyRedirect(params) {
+    if (params.error) {
+        return {
+            error: `The OAuth2 provider rejected the login: ${params.errorDescription
+                ? `${params.error} — ${params.errorDescription}`
+                : params.error}`,
+        };
+    }
+    if (params.state !== params.expectedState) {
+        return {
+            error: 'State mismatch — the login response did not match this request (a stale browser tab, or the wrong window).',
+        };
+    }
+    if (params.code) {
+        return { code: params.code };
+    }
+    return { error: 'No authorization code was returned by the provider.' };
+}
+function escapeHtml(text) {
+    return text
+        .replaceAll('&', '&')
+        .replaceAll('<', '&lt;')
+        .replaceAll('>', '&gt;');
+}
 function startLoopback(port, state) {
     let finish;
     let settled = false;
-    const code = new Promise(resolve => {
+    const result = new Promise(resolve => {
         finish = (value) => {
             if (settled)
                 return;
@@ -79,19 +138,29 @@ function startLoopback(port, state) {
             res.writeHead(404).end();
             return;
         }
-        const ok = url.searchParams.get('state') === state;
-        const authCode = url.searchParams.get('code');
-        const message = ok && authCode
+        const outcome = classifyRedirect({
+            expectedState: state,
+            state: url.searchParams.get('state'),
+            error: url.searchParams.get('error'),
+            errorDescription: url.searchParams.get('error_description'),
+            code: url.searchParams.get('code'),
+        });
+        const message = outcome.code
             ? 'Login complete. You can close this window and return to the terminal.'
-            : 'Login failed. Check the terminal.';
+            : `Login failed: ${outcome.error}`;
         res.writeHead(200, { 'Content-Type': 'text/html' });
-        res.end(`<!doctype html><meta charset="utf-8"><p>${message}</p>`);
-        finish(ok ? authCode : null);
+        res.end(`<!doctype html><meta charset="utf-8"><p>${escapeHtml(message)}</p>`);
+        finish(outcome);
     });
-    const timer = setTimeout(() => finish(null), LOGIN_TIMEOUT_MS);
-    server.on('error', () => finish(null));
+    const timer = setTimeout(() => finish({ error: 'Timed out waiting for the login to complete.' }), LOGIN_TIMEOUT_MS);
+    server.on('error', error => finish({
+        error: `Local login server error: ${error instanceof Error ? error.message : String(error)}`,
+    }));
     server.listen(port, '127.0.0.1');
-    return { code, close: () => finish(null) };
+    return {
+        result,
+        close: (reason) => finish({ error: reason ?? 'Login cancelled.' }),
+    };
 }
 /**
  * Start an interactive OAuth2 login. Returns the authorize URL to open and a
@@ -121,24 +190,28 @@ export function beginOAuth2Login(dev) {
     }
     const loopback = startLoopback(port, state);
     const complete = async () => {
-        const code = await loopback.code;
-        if (!code)
-            return null;
-        const tokens = await postToken(config, {
+        const redirect = await loopback.result;
+        if (redirect.error || !redirect.code) {
+            return { error: redirect.error ?? 'Login failed.' };
+        }
+        const { tokens, error } = await postToken(config, {
             grant_type: 'authorization_code',
-            code,
+            code: redirect.code,
             redirect_uri: redirectUri,
             client_id: config.clientId,
             code_verifier: verifier,
         }, secret);
-        if (!tokens?.access_token)
-            return null;
+        if (error)
+            return { error };
+        if (!tokens?.access_token) {
+            return { error: 'The token endpoint did not return an access token.' };
+        }
         if (tokens.refresh_token) {
             setOAuth2RefreshToken(domain, config.clientId, tokens.refresh_token);
         }
-        return tokens.access_token;
+        return { token: tokens.access_token };
     };
-    return { authUrl: url.href, complete, cancel: loopback.close };
+    return { authUrl: url.href, complete, cancel: () => loopback.close() };
 }
 /**
  * Silently resolve an access token by refreshing the keychain refresh token.
@@ -155,7 +228,7 @@ export async function resolveOAuth2AccessToken(dev) {
     const storedRefresh = getOAuth2RefreshToken(domain, config.clientId);
     if (!storedRefresh)
         return null;
-    const tokens = await postToken(config, {
+    const { tokens } = await postToken(config, {
         grant_type: 'refresh_token',
         refresh_token: storedRefresh,
         client_id: config.clientId,

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "sitevision-cli",
-	"version": "1.0.0-beta.11",
+	"version": "1.0.0-beta.13",
 	"license": "MIT",
 	"bin": {
 		"svc": "dist/cli.js"