sitevision-cli 1.0.0-beta.2 → 1.0.0-beta.21

package/dist/utils/oauth2-auth.js

@@ -0,0 +1,242 @@
+import http from 'http';
+import crypto from 'crypto';
+import open from 'open';
+import { makeRequest, summarizeErrorBody } from './sitevision-api.js';
+import { getOAuth2RefreshToken, setOAuth2RefreshToken, deleteOAuth2RefreshToken, getOAuth2ClientSecret, } from './keychain.js';
+/** Default loopback port. Fixed so a single redirect URI can be whitelisted. */
+export const DEFAULT_REDIRECT_PORT = 8137;
+// Sitevision's provider grants everything under ALL; offline_access adds the
+// refresh token so later runs log in silently.
+export const DEFAULT_SCOPES = ['ALL', 'offline_access'];
+/** Seconds to wait for the user to finish logging in before giving up. */
+const LOGIN_TIMEOUT_MS = 300_000;
+function base64url(buffer) {
+    return buffer
+        .toString('base64')
+        .replaceAll('+', '-')
+        .replaceAll('/', '_')
+        .replaceAll('=', '');
+}
+/** RFC 7636 S256 pair. Exported for testing the challenge derivation. */
+export function createPkcePair() {
+    const verifier = base64url(crypto.randomBytes(32));
+    const challenge = base64url(crypto.createHash('sha256').update(verifier).digest());
+    return { verifier, challenge };
+}
+function hasOAuth2Config(config) {
+    return Boolean(config?.authorizationEndpoint && config.tokenEndpoint && config.clientId);
+}
+async function postToken(config, params, secret) {
+    const body = Buffer.from(new URLSearchParams(params).toString());
+    try {
+        const response = await makeRequest(config.tokenEndpoint, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/x-www-form-urlencoded',
+                'Content-Length': String(body.length),
+            },
+            body,
+            // client_secret_basic when confidential; public+PKCE clients omit it.
+            auth: secret ? { username: config.clientId, password: secret } : undefined,
+        });
+        if (response.statusCode !== 200) {
+            return {
+                error: `Token endpoint returned ${response.statusCode}: ${summarizeErrorBody(response.body, response.headers)}`,
+            };
+        }
+        return { tokens: JSON.parse(response.body.toString()) };
+    }
+    catch (error) {
+        return {
+            error: `Token request failed: ${error instanceof Error ? error.message : String(error)}`,
+        };
+    }
+}
+/** OpenID configuration path (published at the issuer root once the provider is saved). */
+const DISCOVERY_PATH = '/.well-known/openid-configuration';
+/**
+ * Fetch the site's OpenID configuration (unauthenticated) to auto-fill the
+ * authorization/token endpoints. Returns null if it isn't published (provider
+ * not enabled) or the response isn't a valid config, so callers fall back to
+ * manual entry.
+ */
+export async function discoverOAuth2Config(domain, useHTTP = false) {
+    if (!domain)
+        return null;
+    const protocol = useHTTP ? 'http' : 'https';
+    try {
+        const response = await makeRequest(`${protocol}://${domain}${DISCOVERY_PATH}`, { method: 'GET' });
+        if (response.statusCode !== 200)
+            return null;
+        const doc = JSON.parse(response.body.toString());
+        if (!doc.authorization_endpoint || !doc.token_endpoint)
+            return null;
+        return {
+            authorizationEndpoint: doc.authorization_endpoint,
+            tokenEndpoint: doc.token_endpoint,
+            scopesSupported: Array.isArray(doc.scopes_supported)
+                ? doc.scopes_supported
+                : undefined,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+export function openBrowser(url) {
+    // Preserve the full OAuth URL, including & and percent-encoded parameters,
+    // through Windows shell parsing. `open` handles platform-specific escaping.
+    void open(url).catch(() => {
+        // Fall back to the printed URL.
+    });
+}
+/**
+ * Turn a redirect's query params into a result, prioritizing the provider's own
+ * error (the most useful reason) over a generic "no code". Exported for testing.
+ */
+export function classifyRedirect(params) {
+    if (params.error) {
+        return {
+            error: `The OAuth2 provider rejected the login: ${params.errorDescription
+                ? `${params.error} — ${params.errorDescription}`
+                : params.error}`,
+        };
+    }
+    if (params.state !== params.expectedState) {
+        return {
+            error: 'State mismatch — the login response did not match this request (a stale browser tab, or the wrong window).',
+        };
+    }
+    if (params.code) {
+        return { code: params.code };
+    }
+    return { error: 'No authorization code was returned by the provider.' };
+}
+function escapeHtml(text) {
+    return text
+        .replaceAll('&', '&')
+        .replaceAll('<', '&lt;')
+        .replaceAll('>', '&gt;');
+}
+function startLoopback(port, state) {
+    let finish;
+    let settled = false;
+    const result = new Promise(resolve => {
+        finish = (value) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            server.close();
+            resolve(value);
+        };
+    });
+    const server = http.createServer((req, res) => {
+        const url = new URL(req.url ?? '/', `http://127.0.0.1:${port}`);
+        if (url.pathname !== '/callback') {
+            res.writeHead(404).end();
+            return;
+        }
+        const outcome = classifyRedirect({
+            expectedState: state,
+            state: url.searchParams.get('state'),
+            error: url.searchParams.get('error'),
+            errorDescription: url.searchParams.get('error_description'),
+            code: url.searchParams.get('code'),
+        });
+        const message = outcome.code
+            ? 'Login complete. You can close this window and return to the terminal.'
+            : `Login failed: ${outcome.error}`;
+        res.writeHead(200, { 'Content-Type': 'text/html' });
+        res.end(`<!doctype html><meta charset="utf-8"><p>${escapeHtml(message)}</p>`);
+        finish(outcome);
+    });
+    const timer = setTimeout(() => finish({ error: 'Timed out waiting for the login to complete.' }), LOGIN_TIMEOUT_MS);
+    server.on('error', error => finish({
+        error: `Local login server error: ${error instanceof Error ? error.message : String(error)}`,
+    }));
+    server.listen(port, '127.0.0.1');
+    return {
+        result,
+        close: (reason) => finish({ error: reason ?? 'Login cancelled.' }),
+    };
+}
+/**
+ * Start an interactive OAuth2 login. Returns the authorize URL to open and a
+ * `complete()` that awaits the loopback redirect, exchanges the code, stores the
+ * refresh token, and resolves the access token. UI-agnostic, so an Ink screen
+ * can drive it without owning the terminal.
+ */
+export function beginOAuth2Login(dev) {
+    const config = dev.oauth2;
+    if (!hasOAuth2Config(config))
+        return null;
+    const { domain } = dev;
+    const secret = getOAuth2ClientSecret(domain, config.clientId) ?? undefined;
+    const port = config.redirectPort ?? DEFAULT_REDIRECT_PORT;
+    const redirectUri = `http://127.0.0.1:${port}/callback`;
+    const { verifier, challenge } = createPkcePair();
+    const state = base64url(crypto.randomBytes(16));
+    const url = new URL(config.authorizationEndpoint);
+    url.searchParams.set('response_type', 'code');
+    url.searchParams.set('client_id', config.clientId);
+    url.searchParams.set('redirect_uri', redirectUri);
+    url.searchParams.set('state', state);
+    url.searchParams.set('code_challenge', challenge);
+    url.searchParams.set('code_challenge_method', 'S256');
+    url.searchParams.set('scope', (config.scopes ?? DEFAULT_SCOPES).join(' '));
+    const loopback = startLoopback(port, state);
+    const complete = async () => {
+        const redirect = await loopback.result;
+        if (redirect.error || !redirect.code) {
+            return { error: redirect.error ?? 'Login failed.' };
+        }
+        const { tokens, error } = await postToken(config, {
+            grant_type: 'authorization_code',
+            code: redirect.code,
+            redirect_uri: redirectUri,
+            client_id: config.clientId,
+            code_verifier: verifier,
+        }, secret);
+        if (error)
+            return { error };
+        if (!tokens?.access_token) {
+            return { error: 'The token endpoint did not return an access token.' };
+        }
+        if (tokens.refresh_token) {
+            setOAuth2RefreshToken(domain, config.clientId, tokens.refresh_token);
+        }
+        return { token: tokens.access_token };
+    };
+    return { authUrl: url.href, complete, cancel: () => loopback.close() };
+}
+/**
+ * Silently resolve an access token by refreshing the keychain refresh token.
+ * Returns null when there's no refresh token or it's expired/revoked (in which
+ * case the stale token is dropped). Interactive login lives in `beginOAuth2Login`,
+ * driven by the Ink login screen — the access token is never persisted.
+ */
+export async function resolveOAuth2AccessToken(dev) {
+    const config = dev.oauth2;
+    if (!hasOAuth2Config(config))
+        return null;
+    const { domain } = dev;
+    const secret = getOAuth2ClientSecret(domain, config.clientId) ?? undefined;
+    const storedRefresh = getOAuth2RefreshToken(domain, config.clientId);
+    if (!storedRefresh)
+        return null;
+    const { tokens } = await postToken(config, {
+        grant_type: 'refresh_token',
+        refresh_token: storedRefresh,
+        client_id: config.clientId,
+    }, secret);
+    if (tokens?.access_token) {
+        if (tokens.refresh_token) {
+            setOAuth2RefreshToken(domain, config.clientId, tokens.refresh_token);
+        }
+        return tokens.access_token;
+    }
+    // Stale/expired refresh token — drop it so the next run logs in fresh.
+    deleteOAuth2RefreshToken(domain, config.clientId);
+    return null;
+}

package/dist/utils/password-prompt.d.ts

@@ -3,6 +3,11 @@
  * Pressing Enter (empty answer) returns `defaultYes` (default: false).
  */
 export declare function promptYesNo(prompt: string, defaultYes?: boolean): Promise<boolean>;
+/**
+ * Wait for the user to press Enter (or Ctrl+C). Used to hand control to an
+ * external browser and resume once the user says they're done.
+ */
+export declare function promptEnter(prompt: string): Promise<void>;
 /**
  * Prompt for password input with masked display
  */

package/dist/utils/password-prompt.js

@@ -29,6 +29,34 @@ export function promptYesNo(prompt, defaultYes = false) {
         stdin.on('data', onData);
     });
 }
+/**
+ * Wait for the user to press Enter (or Ctrl+C). Used to hand control to an
+ * external browser and resume once the user says they're done.
+ */
+export function promptEnter(prompt) {
+    return new Promise(resolve => {
+        process.stdout.write(prompt);
+        const stdin = process.stdin;
+        stdin.setRawMode(true);
+        stdin.resume();
+        stdin.setEncoding('utf8');
+        const onData = (data) => {
+            const char = data[0] || '';
+            const charCode = char.charCodeAt(0);
+            if (charCode === 3) {
+                process.exit();
+            }
+            if (char === '' || charCode === 13 || charCode === 10) {
+                stdin.setRawMode(false);
+                stdin.removeListener('data', onData);
+                stdin.pause();
+                process.stdout.write('\n');
+                resolve();
+            }
+        };
+        stdin.on('data', onData);
+    });
+}
 /**
  * Prompt for password input with masked display
  */

package/dist/utils/project-detection.d.ts

@@ -1,5 +1,15 @@
-import type { SitevisionManifest, DevProperties, ProjectInfo, ProjectPaths, SimpleAppType, ApiEndpoints } from '../types/index.js';
+import type { SitevisionManifest, DevProperties, ProjectInfo, ProjectPaths, SimpleAppType, ApiEndpoints, LocalizedString } from '../types/index.js';
 export type { SitevisionManifest, DevProperties, ProjectInfo, } from '../types/index.js';
+/**
+ * Resolve a manifest text field that may be a plain string or a localized
+ * object (e.g. `{sv: 'Namn', en: 'Name'}`) to a single display string.
+ *
+ * Preference order: Swedish, then English, then any available language. Returns
+ * an empty string for missing/empty values. This guards the UI from rendering a
+ * raw object as a React child, which Sitevision's localized manifests would
+ * otherwise trigger.
+ */
+export declare function localizedText(value: LocalizedString | undefined, preferred?: string): string;
 /**
  * Get standard project paths for a given root directory
  */
@@ -12,6 +22,23 @@ export declare function findDevPropertiesPath(root: string): string | null;
  * Get the default dev properties path (for creating new files)
  */
 export declare function getDefaultDevPropertiesPath(root: string): string;
+/** A bare host: no scheme, no path, no stray spaces. */
+export declare function normalizeDomain(value: string): string;
+/**
+ * The dev properties a workspace root defines (its own file merged over any
+ * ancestors'), with the deploy password resolved from the keychain like an
+ * app's would be. Used to edit shared config from the shell.
+ */
+export declare function readWorkspaceDevProperties(root: string): Partial<DevProperties>;
+/** Ancestor directories' .dev_properties.json merged, nearest wins (no own file). */
+export declare function readAncestorDevProperties(root: string): Partial<DevProperties>;
+/** Shared defaults from package.json: the workspace root's first, the app's on top. */
+export declare function readPackageDefaultsChain(root: string): Partial<DevProperties>;
+/**
+ * Everything an app's own .dev_properties.json sits on top of: package.json
+ * defaults (root, then app), then ancestor .dev_properties.json files.
+ */
+export declare function readInheritedDevProperties(root: string): Partial<DevProperties>;
 /**
  * Get the full app ID including any prefix/suffix from environment
  *
@@ -51,16 +78,45 @@ export declare function buildAddonEndpointUrl(domain: string, siteName: string,
  * Build the import endpoint URL
  */
 export declare function buildImportEndpointUrl(domain: string, siteName: string, addonName: string, appType: SimpleAppType, useHTTP?: boolean): string;
+/**
+ * Thrown when a manifest.json is present but cannot be parsed. Kept distinct from
+ * a plain "no project here" (null) so the CLI can tell the user their manifest is
+ * malformed instead of the misleading "Not a Sitevision project".
+ */
+export declare class ManifestParseError extends Error {
+    constructor(manifestPath: string, cause: unknown);
+}
+/**
+ * Read manifest.json from its supported locations (root, static/, src/).
+ * Throws ManifestParseError on malformed JSON.
+ */
+export declare function readManifest(cwd: string): {
+    manifestPath: string;
+    manifest: SitevisionManifest;
+} | null;
 /**
  * Detect if the current directory is a Sitevision project
  */
 export declare function detectProject(cwd?: string): ProjectInfo | null;
+/**
+ * Fill the runtime-only credential fields for the given domain/username:
+ * deploy password (env var > keychain), OAuth2 access token (env var), and
+ * session cookie (env var > keychain). Mutates and returns `dev`.
+ */
+export declare function resolveRuntimeSecrets(dev: DevProperties): DevProperties;
 /**
  * Validate that we're in a Sitevision project directory
  */
 export declare function requireProject(cwd?: string): ProjectInfo;
 /**
- * Get the app type (web, widget, rest)
+ * The app type (web, widget, rest, mcp), or undefined for a manifest type
+ * this CLI does not know. Display code uses this so one odd app never takes
+ * the whole shell down.
+ */
+export declare function appTypeOf(manifest: SitevisionManifest): SimpleAppType | undefined;
+/**
+ * Get the app type (web, widget, rest, mcp). Throws for unknown types, since
+ * build and deploy cannot proceed without knowing the endpoints.
  */
 export declare function getAppType(manifest: SitevisionManifest): SimpleAppType;
 /**
@@ -72,10 +128,53 @@ export declare function isBundledApp(manifest: SitevisionManifest): boolean;
  */
 export declare function readDevProperties(projectRoot: string): DevProperties | null;
 /**
- * Write dev properties to file. The `password` field is never persisted —
- * it is held in the OS keychain instead.
- */
-export declare function writeDevProperties(projectRoot: string, properties: DevProperties): void;
+ * Write dev properties to file. Secrets are never persisted — `password`,
+ * `accessToken` and `sessionCookie` are held in the OS keychain / resolved at
+ * runtime instead.
+ */
+export declare function writeDevProperties(projectRoot: string, properties: DevProperties, { complete }?: {
+    complete?: boolean;
+}): void;
+/**
+ * CLI preferences stored in .svcconfig at the project root. Unknown keys are
+ * preserved on write so hand-edited entries survive.
+ */
+export interface SvcConfig {
+    syncPackageJson?: boolean;
+    environment?: string;
+    [key: string]: unknown;
+}
+export declare function readSvcConfig(projectRoot: string): SvcConfig;
+export declare function writeSvcConfig(projectRoot: string, updates: SvcConfig): void;
+/**
+ * Values tied to the person running svc. They stay in .dev_properties.json and
+ * never go into package.json.
+ */
+export declare const USER_KEYS: string[];
+export interface PackageJsonSyncChange {
+    key: string;
+    from?: string;
+    to: string;
+}
+/** The shared defaults one directory's package.json provides. */
+export declare function readPackageDefaults(dir: string): Partial<DevProperties>;
+/** What an unset field means, so spelling out the default is not a change. */
+export declare const IMPLICIT_VALUES: Record<string, unknown>;
+/** What syncing this directory would change in its package.json. */
+export declare function getPackageJsonSyncChanges(dir: string): PackageJsonSyncChange[];
+export declare function hasPackageJson(dir: string): boolean;
+/**
+ * Copy the pending shared values from .dev_properties.json into package.json,
+ * creating package.json when the directory has none. Throws if it cannot be
+ * read or written.
+ */
+export declare function syncDevPropertiesToPackageJson(dir: string): boolean;
+/**
+ * Edit package.json in place, keeping its indentation and trailing newline. A
+ * missing file is created; an unreadable or invalid one throws, so the caller
+ * can warn instead of dropping the change silently.
+ */
+export declare function updatePackageJson(dir: string, mutate: (packageJson: Record<string, unknown>) => void): void;
 /**
  * Move a plaintext password from .dev_properties.json into the OS keychain and
  * strip it from the file. Returns true if the password was migrated.