sitevision-cli 1.0.0-beta.12 → 1.0.0-beta.13

package/dist/components/AuthLoginScreen.js

@@ -28,13 +28,13 @@ export function AuthLoginScreen({ method, devProperties, onComplete, onError, on
                 setAuthUrl(session.authUrl);
                 openBrowser(session.authUrl);
                 setPhase('awaiting');
-                const token = await session.complete();
+                const { token, error } = await session.complete();
                 cancelOAuthRef.current = null;
                 if (token) {
                     onComplete({ accessToken: token });
                 }
                 else {
-                    onError('OAuth2 login failed, timed out, or was rejected.');
+                    onError(error ?? 'OAuth2 login failed.');
                 }
             }
             else {

package/dist/utils/oauth2-auth.d.ts

@@ -19,6 +19,26 @@ export interface DiscoveredOAuth2 {
  */
 export declare function discoverOAuth2Config(domain: string, useHTTP?: boolean): Promise<DiscoveredOAuth2 | null>;
 export declare function openBrowser(url: string): void;
+/**
+ * Serve the loopback redirect once. Returns the awaited code and a `close()`
+ * that shuts the server down (freeing the port) if the login is cancelled — so
+ * a retry doesn't hit an EADDRINUSE on the fixed redirect port.
+ */
+interface LoopbackResult {
+    code?: string;
+    error?: string;
+}
+/**
+ * Turn a redirect's query params into a result, prioritizing the provider's own
+ * error (the most useful reason) over a generic "no code". Exported for testing.
+ */
+export declare function classifyRedirect(params: {
+    expectedState: string;
+    state: string | null;
+    error: string | null;
+    errorDescription: string | null;
+    code: string | null;
+}): LoopbackResult;
 /**
  * Start an interactive OAuth2 login. Returns the authorize URL to open and a
  * `complete()` that awaits the loopback redirect, exchanges the code, stores the
@@ -27,7 +47,10 @@ export declare function openBrowser(url: string): void;
  */
 export declare function beginOAuth2Login(dev: DevProperties): {
     authUrl: string;
-    complete: () => Promise<string | null>;
+    complete: () => Promise<{
+        token?: string;
+        error?: string;
+    }>;
     cancel: () => void;
 } | null;
 /**
@@ -37,3 +60,4 @@ export declare function beginOAuth2Login(dev: DevProperties): {
  * driven by the Ink login screen — the access token is never persisted.
  */
 export declare function resolveOAuth2AccessToken(dev: DevProperties): Promise<string | null>;
+export {};

package/dist/utils/oauth2-auth.js

@@ -1,7 +1,7 @@
 import http from 'http';
 import crypto from 'crypto';
 import { spawn } from 'child_process';
-import { makeRequest } from './sitevision-api.js';
+import { makeRequest, summarizeErrorBody } from './sitevision-api.js';
 import { getOAuth2RefreshToken, setOAuth2RefreshToken, deleteOAuth2RefreshToken, getOAuth2ClientSecret, } from './keychain.js';
 /** Default loopback port. Fixed so a single redirect URI can be whitelisted. */
 export const DEFAULT_REDIRECT_PORT = 8137;
@@ -36,12 +36,17 @@ async function postToken(config, params, secret) {
             // client_secret_basic when confidential; public+PKCE clients omit it.
             auth: secret ? { username: config.clientId, password: secret } : undefined,
         });
-        if (response.statusCode !== 200)
-            return null;
-        return JSON.parse(response.body.toString());
+        if (response.statusCode !== 200) {
+            return {
+                error: `Token endpoint returned ${response.statusCode}: ${summarizeErrorBody(response.body, response.headers)}`,
+            };
+        }
+        return { tokens: JSON.parse(response.body.toString()) };
     }
-    catch {
-        return null;
+    catch (error) {
+        return {
+            error: `Token request failed: ${error instanceof Error ? error.message : String(error)}`,
+        };
     }
 }
 /** OpenID configuration path (published at the issuer root once the provider is saved). */
@@ -87,14 +92,37 @@ export function openBrowser(url) {
     }
 }
 /**
- * Serve the loopback redirect once. Returns the awaited code and a `close()`
- * that shuts the server down (freeing the port) if the login is cancelled — so
- * a retry doesn't hit an EADDRINUSE on the fixed redirect port.
+ * Turn a redirect's query params into a result, prioritizing the provider's own
+ * error (the most useful reason) over a generic "no code". Exported for testing.
  */
+export function classifyRedirect(params) {
+    if (params.error) {
+        return {
+            error: `The OAuth2 provider rejected the login: ${params.errorDescription
+                ? `${params.error} — ${params.errorDescription}`
+                : params.error}`,
+        };
+    }
+    if (params.state !== params.expectedState) {
+        return {
+            error: 'State mismatch — the login response did not match this request (a stale browser tab, or the wrong window).',
+        };
+    }
+    if (params.code) {
+        return { code: params.code };
+    }
+    return { error: 'No authorization code was returned by the provider.' };
+}
+function escapeHtml(text) {
+    return text
+        .replaceAll('&', '&')
+        .replaceAll('<', '&lt;')
+        .replaceAll('>', '&gt;');
+}
 function startLoopback(port, state) {
     let finish;
     let settled = false;
-    const code = new Promise(resolve => {
+    const result = new Promise(resolve => {
         finish = (value) => {
             if (settled)
                 return;
@@ -110,19 +138,29 @@ function startLoopback(port, state) {
             res.writeHead(404).end();
             return;
         }
-        const ok = url.searchParams.get('state') === state;
-        const authCode = url.searchParams.get('code');
-        const message = ok && authCode
+        const outcome = classifyRedirect({
+            expectedState: state,
+            state: url.searchParams.get('state'),
+            error: url.searchParams.get('error'),
+            errorDescription: url.searchParams.get('error_description'),
+            code: url.searchParams.get('code'),
+        });
+        const message = outcome.code
             ? 'Login complete. You can close this window and return to the terminal.'
-            : 'Login failed. Check the terminal.';
+            : `Login failed: ${outcome.error}`;
         res.writeHead(200, { 'Content-Type': 'text/html' });
-        res.end(`<!doctype html><meta charset="utf-8"><p>${message}</p>`);
-        finish(ok ? authCode : null);
+        res.end(`<!doctype html><meta charset="utf-8"><p>${escapeHtml(message)}</p>`);
+        finish(outcome);
     });
-    const timer = setTimeout(() => finish(null), LOGIN_TIMEOUT_MS);
-    server.on('error', () => finish(null));
+    const timer = setTimeout(() => finish({ error: 'Timed out waiting for the login to complete.' }), LOGIN_TIMEOUT_MS);
+    server.on('error', error => finish({
+        error: `Local login server error: ${error instanceof Error ? error.message : String(error)}`,
+    }));
     server.listen(port, '127.0.0.1');
-    return { code, close: () => finish(null) };
+    return {
+        result,
+        close: (reason) => finish({ error: reason ?? 'Login cancelled.' }),
+    };
 }
 /**
  * Start an interactive OAuth2 login. Returns the authorize URL to open and a
@@ -152,24 +190,28 @@ export function beginOAuth2Login(dev) {
     }
     const loopback = startLoopback(port, state);
     const complete = async () => {
-        const code = await loopback.code;
-        if (!code)
-            return null;
-        const tokens = await postToken(config, {
+        const redirect = await loopback.result;
+        if (redirect.error || !redirect.code) {
+            return { error: redirect.error ?? 'Login failed.' };
+        }
+        const { tokens, error } = await postToken(config, {
             grant_type: 'authorization_code',
-            code,
+            code: redirect.code,
             redirect_uri: redirectUri,
             client_id: config.clientId,
             code_verifier: verifier,
         }, secret);
-        if (!tokens?.access_token)
-            return null;
+        if (error)
+            return { error };
+        if (!tokens?.access_token) {
+            return { error: 'The token endpoint did not return an access token.' };
+        }
         if (tokens.refresh_token) {
             setOAuth2RefreshToken(domain, config.clientId, tokens.refresh_token);
         }
-        return tokens.access_token;
+        return { token: tokens.access_token };
     };
-    return { authUrl: url.href, complete, cancel: loopback.close };
+    return { authUrl: url.href, complete, cancel: () => loopback.close() };
 }
 /**
  * Silently resolve an access token by refreshing the keychain refresh token.
@@ -186,7 +228,7 @@ export async function resolveOAuth2AccessToken(dev) {
     const storedRefresh = getOAuth2RefreshToken(domain, config.clientId);
     if (!storedRefresh)
         return null;
-    const tokens = await postToken(config, {
+    const { tokens } = await postToken(config, {
         grant_type: 'refresh_token',
         refresh_token: storedRefresh,
         client_id: config.clientId,

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "sitevision-cli",
-	"version": "1.0.0-beta.12",
+	"version": "1.0.0-beta.13",
 	"license": "MIT",
 	"bin": {
 		"svc": "dist/cli.js"