sitevision-cli 1.0.0-beta.9 → 1.0.0

package/dist/utils/oauth2-auth.js

@@ -1,10 +1,14 @@
 import http from 'http';
 import crypto from 'crypto';
-import { spawn } from 'child_process';
-import { makeRequest } from './sitevision-api.js';
+import open from 'open';
+import { makeRequest, summarizeErrorBody } from './sitevision-api.js';
 import { getOAuth2RefreshToken, setOAuth2RefreshToken, deleteOAuth2RefreshToken, getOAuth2ClientSecret, } from './keychain.js';
+import { debug } from './debug.js';
 /** Default loopback port. Fixed so a single redirect URI can be whitelisted. */
 export const DEFAULT_REDIRECT_PORT = 8137;
+// Sitevision's provider grants everything under ALL; offline_access adds the
+// refresh token so later runs log in silently.
+export const DEFAULT_SCOPES = ['ALL', 'offline_access'];
 /** Seconds to wait for the user to finish logging in before giving up. */
 const LOGIN_TIMEOUT_MS = 300_000;
 function base64url(buffer) {
@@ -20,8 +24,32 @@ export function createPkcePair() {
     const challenge = base64url(crypto.createHash('sha256').update(verifier).digest());
     return { verifier, challenge };
 }
-function hasOAuth2Config(config) {
-    return Boolean(config?.authorizationEndpoint && config.tokenEndpoint && config.clientId);
+/**
+ * Why this project's OAuth2 settings cannot be used, if they cannot. The
+ * endpoints may come from a committed package.json, and the keychain secrets
+ * are stored per site, so they only ever go to that site, over TLS.
+ */
+export function oauth2ConfigProblem(dev) {
+    const config = dev.oauth2;
+    if (!config?.authorizationEndpoint ||
+        !config.tokenEndpoint ||
+        !config.clientId) {
+        return 'OAuth2 is not fully configured (authorization/token endpoint or client ID missing).';
+    }
+    if (!dev.domain)
+        return 'OAuth2 needs the site domain to be set.';
+    const schemes = dev.useHTTPForDevDeploy ? ['https:', 'http:'] : ['https:'];
+    for (const endpoint of [config.authorizationEndpoint, config.tokenEndpoint]) {
+        const url = URL.canParse(endpoint) ? new URL(endpoint) : undefined;
+        if (!url || !schemes.includes(url.protocol)) {
+            return `OAuth2 endpoint ${endpoint} must be an https URL.`;
+        }
+    }
+    const tokenHost = new URL(config.tokenEndpoint).host.toLowerCase();
+    if (tokenHost !== dev.domain.toLowerCase()) {
+        return `OAuth2 token endpoint is on ${tokenHost}, not on ${dev.domain}. Stored secrets are only sent to the site they belong to.`;
+    }
+    return undefined;
 }
 async function postToken(config, params, secret) {
     const body = Buffer.from(new URLSearchParams(params).toString());
@@ -36,34 +64,90 @@ async function postToken(config, params, secret) {
             // client_secret_basic when confidential; public+PKCE clients omit it.
             auth: secret ? { username: config.clientId, password: secret } : undefined,
         });
+        if (response.statusCode !== 200) {
+            return {
+                status: response.statusCode,
+                error: `Token endpoint returned ${response.statusCode}: ${summarizeErrorBody(response.body, response.headers)}`,
+            };
+        }
+        return { tokens: JSON.parse(response.body.toString()) };
+    }
+    catch (error) {
+        return {
+            error: `Token request failed: ${error instanceof Error ? error.message : String(error)}`,
+        };
+    }
+}
+/** OpenID configuration path (published at the issuer root once the provider is saved). */
+const DISCOVERY_PATH = '/.well-known/openid-configuration';
+/**
+ * Fetch the site's OpenID configuration (unauthenticated) to auto-fill the
+ * authorization/token endpoints. Returns null if it isn't published (provider
+ * not enabled) or the response isn't a valid config, so callers fall back to
+ * manual entry.
+ */
+export async function discoverOAuth2Config(domain, useHTTP = false) {
+    if (!domain)
+        return null;
+    const protocol = useHTTP ? 'http' : 'https';
+    try {
+        const response = await makeRequest(`${protocol}://${domain}${DISCOVERY_PATH}`, { method: 'GET' });
         if (response.statusCode !== 200)
             return null;
-        return JSON.parse(response.body.toString());
+        const doc = JSON.parse(response.body.toString());
+        if (!doc.authorization_endpoint || !doc.token_endpoint)
+            return null;
+        return {
+            authorizationEndpoint: doc.authorization_endpoint,
+            tokenEndpoint: doc.token_endpoint,
+            scopesSupported: Array.isArray(doc.scopes_supported)
+                ? doc.scopes_supported
+                : undefined,
+        };
     }
     catch {
         return null;
     }
 }
 export function openBrowser(url) {
-    const isWin = process.platform === 'win32';
-    const cmd = process.platform === 'darwin' ? 'open' : isWin ? 'cmd' : 'xdg-open';
-    const args = isWin ? ['/c', 'start', '', url] : [url];
-    try {
-        spawn(cmd, args, { stdio: 'ignore', detached: true }).unref();
-    }
-    catch {
+    // Preserve the full OAuth URL, including & and percent-encoded parameters,
+    // through Windows shell parsing. `open` handles platform-specific escaping.
+    void open(url).catch(() => {
         // Fall back to the printed URL.
-    }
+    });
 }
 /**
- * Serve the loopback redirect once. Returns the awaited code and a `close()`
- * that shuts the server down (freeing the port) if the login is cancelled — so
- * a retry doesn't hit an EADDRINUSE on the fixed redirect port.
+ * Turn a redirect's query params into a result, prioritizing the provider's own
+ * error (the most useful reason) over a generic "no code". Exported for testing.
  */
+export function classifyRedirect(params) {
+    if (params.error) {
+        return {
+            error: `The OAuth2 provider rejected the login: ${params.errorDescription
+                ? `${params.error} — ${params.errorDescription}`
+                : params.error}`,
+        };
+    }
+    if (params.state !== params.expectedState) {
+        return {
+            error: 'State mismatch — the login response did not match this request (a stale browser tab, or the wrong window).',
+        };
+    }
+    if (params.code) {
+        return { code: params.code };
+    }
+    return { error: 'No authorization code was returned by the provider.' };
+}
+function escapeHtml(text) {
+    return text
+        .replaceAll('&', '&')
+        .replaceAll('<', '&lt;')
+        .replaceAll('>', '&gt;');
+}
 function startLoopback(port, state) {
     let finish;
     let settled = false;
-    const code = new Promise(resolve => {
+    const result = new Promise(resolve => {
         finish = (value) => {
             if (settled)
                 return;
@@ -79,19 +163,29 @@ function startLoopback(port, state) {
             res.writeHead(404).end();
             return;
         }
-        const ok = url.searchParams.get('state') === state;
-        const authCode = url.searchParams.get('code');
-        const message = ok && authCode
+        const outcome = classifyRedirect({
+            expectedState: state,
+            state: url.searchParams.get('state'),
+            error: url.searchParams.get('error'),
+            errorDescription: url.searchParams.get('error_description'),
+            code: url.searchParams.get('code'),
+        });
+        const message = outcome.code
             ? 'Login complete. You can close this window and return to the terminal.'
-            : 'Login failed. Check the terminal.';
+            : `Login failed: ${outcome.error}`;
         res.writeHead(200, { 'Content-Type': 'text/html' });
-        res.end(`<!doctype html><meta charset="utf-8"><p>${message}</p>`);
-        finish(ok ? authCode : null);
+        res.end(`<!doctype html><meta charset="utf-8"><p>${escapeHtml(message)}</p>`);
+        finish(outcome);
     });
-    const timer = setTimeout(() => finish(null), LOGIN_TIMEOUT_MS);
-    server.on('error', () => finish(null));
+    const timer = setTimeout(() => finish({ error: 'Timed out waiting for the login to complete.' }), LOGIN_TIMEOUT_MS);
+    server.on('error', error => finish({
+        error: `Local login server error: ${error instanceof Error ? error.message : String(error)}`,
+    }));
     server.listen(port, '127.0.0.1');
-    return { code, close: () => finish(null) };
+    return {
+        result,
+        close: (reason) => finish({ error: reason ?? 'Login cancelled.' }),
+    };
 }
 /**
  * Start an interactive OAuth2 login. Returns the authorize URL to open and a
@@ -101,7 +195,7 @@ function startLoopback(port, state) {
  */
 export function beginOAuth2Login(dev) {
     const config = dev.oauth2;
-    if (!hasOAuth2Config(config))
+    if (!config || oauth2ConfigProblem(dev))
         return null;
     const { domain } = dev;
     const secret = getOAuth2ClientSecret(domain, config.clientId) ?? undefined;
@@ -116,29 +210,34 @@ export function beginOAuth2Login(dev) {
     url.searchParams.set('state', state);
     url.searchParams.set('code_challenge', challenge);
     url.searchParams.set('code_challenge_method', 'S256');
-    if (config.scopes?.length) {
-        url.searchParams.set('scope', config.scopes.join(' '));
-    }
+    url.searchParams.set('scope', (config.scopes ?? DEFAULT_SCOPES).join(' '));
     const loopback = startLoopback(port, state);
+    debug('auth', `oauth2 login ${domain} client ${config.clientId} port ${port}`);
     const complete = async () => {
-        const code = await loopback.code;
-        if (!code)
-            return null;
-        const tokens = await postToken(config, {
+        const redirect = await loopback.result;
+        debug('auth', `oauth2 redirect ${redirect.error ?? (redirect.code ? 'code received' : 'no code')}`);
+        if (redirect.error || !redirect.code) {
+            return { error: redirect.error ?? 'Login failed.' };
+        }
+        const { tokens, error } = await postToken(config, {
             grant_type: 'authorization_code',
-            code,
+            code: redirect.code,
             redirect_uri: redirectUri,
             client_id: config.clientId,
             code_verifier: verifier,
         }, secret);
-        if (!tokens?.access_token)
-            return null;
+        debug('auth', `oauth2 token ${error ?? (tokens?.access_token ? 'ok' : 'missing')}${tokens?.refresh_token ? ' + refresh' : ''}`);
+        if (error)
+            return { error };
+        if (!tokens?.access_token) {
+            return { error: 'The token endpoint did not return an access token.' };
+        }
         if (tokens.refresh_token) {
             setOAuth2RefreshToken(domain, config.clientId, tokens.refresh_token);
         }
-        return tokens.access_token;
+        return { token: tokens.access_token };
     };
-    return { authUrl: url.href, complete, cancel: loopback.close };
+    return { authUrl: url.href, complete, cancel: () => loopback.close() };
 }
 /**
  * Silently resolve an access token by refreshing the keychain refresh token.
@@ -148,25 +247,29 @@ export function beginOAuth2Login(dev) {
  */
 export async function resolveOAuth2AccessToken(dev) {
     const config = dev.oauth2;
-    if (!hasOAuth2Config(config))
+    if (!config || oauth2ConfigProblem(dev))
         return null;
     const { domain } = dev;
     const secret = getOAuth2ClientSecret(domain, config.clientId) ?? undefined;
     const storedRefresh = getOAuth2RefreshToken(domain, config.clientId);
     if (!storedRefresh)
         return null;
-    const tokens = await postToken(config, {
+    const { tokens, status } = await postToken(config, {
         grant_type: 'refresh_token',
         refresh_token: storedRefresh,
         client_id: config.clientId,
     }, secret);
+    debug('auth', `oauth2 refresh ${domain}: ${tokens?.access_token ? 'ok' : `failed (${status})`}`);
     if (tokens?.access_token) {
         if (tokens.refresh_token) {
             setOAuth2RefreshToken(domain, config.clientId, tokens.refresh_token);
         }
         return tokens.access_token;
     }
-    // Stale/expired refresh token — drop it so the next run logs in fresh.
-    deleteOAuth2RefreshToken(domain, config.clientId);
+    // Only a rejection (invalid_grant) means the token is dead. Offline, a
+    // timeout or a 5xx says nothing about it, so it stays.
+    if (status === 400 || status === 401) {
+        deleteOAuth2RefreshToken(domain, config.clientId);
+    }
     return null;
 }

package/dist/utils/password-prompt.js

@@ -1,9 +1,24 @@
+import { debug } from './debug.js';
+// Without a terminal nobody can answer: prompts resolve to their "no answer"
+// value (default, nothing, empty password) and the caller reports what is missing.
+const interactive = () => Boolean(process.stdin.isTTY);
+// 130 = 128 + SIGINT, so `svc sign && svc deploy` stops at a cancelled prompt.
+const cancelled = () => {
+    debug('prompt', 'cancelled');
+    process.exit(130);
+};
 /**
  * Prompt for a yes/no answer. Returns true for y/Y.
  * Pressing Enter (empty answer) returns `defaultYes` (default: false).
  */
 export function promptYesNo(prompt, defaultYes = false) {
     return new Promise(resolve => {
+        if (!interactive()) {
+            debug('prompt', `${prompt.trim()} (no terminal, ${defaultYes ? 'yes' : 'no'})`);
+            resolve(defaultYes);
+            return;
+        }
+        debug('prompt', prompt.trim());
         process.stdout.write(prompt);
         const stdin = process.stdin;
         stdin.setRawMode(true);
@@ -17,13 +32,15 @@ export function promptYesNo(prompt, defaultYes = false) {
             process.stdout.write(`${char}\n`);
             const charCode = char.charCodeAt(0);
             if (charCode === 3) {
-                process.exit();
+                cancelled();
             }
             // Enter (CR/LF) or empty input → use the default
             if (char === '' || charCode === 13 || charCode === 10) {
+                debug('prompt', `answered default (${defaultYes ? 'yes' : 'no'})`);
                 resolve(defaultYes);
                 return;
             }
+            debug('prompt', `answered ${char === 'y' || char === 'Y' ? 'yes' : 'no'}`);
             resolve(char === 'y' || char === 'Y');
         };
         stdin.on('data', onData);
@@ -35,6 +52,12 @@ export function promptYesNo(prompt, defaultYes = false) {
  */
 export function promptEnter(prompt) {
     return new Promise(resolve => {
+        if (!interactive()) {
+            debug('prompt', `${prompt.trim()} (no terminal, continuing)`);
+            resolve();
+            return;
+        }
+        debug('prompt', prompt.trim());
         process.stdout.write(prompt);
         const stdin = process.stdin;
         stdin.setRawMode(true);
@@ -44,13 +67,14 @@ export function promptEnter(prompt) {
             const char = data[0] || '';
             const charCode = char.charCodeAt(0);
             if (charCode === 3) {
-                process.exit();
+                cancelled();
             }
             if (char === '' || charCode === 13 || charCode === 10) {
                 stdin.setRawMode(false);
                 stdin.removeListener('data', onData);
                 stdin.pause();
                 process.stdout.write('\n');
+                debug('prompt', 'continued');
                 resolve();
             }
         };
@@ -62,6 +86,12 @@ export function promptEnter(prompt) {
  */
 export function promptPassword(prompt) {
     return new Promise(resolve => {
+        if (!interactive()) {
+            debug('prompt', `${prompt.trim()} (no terminal, empty)`);
+            resolve('');
+            return;
+        }
+        debug('prompt', prompt.trim());
         process.stdout.write(prompt);
         const stdin = process.stdin;
         stdin.setRawMode(true);
@@ -69,6 +99,9 @@ export function promptPassword(prompt) {
         stdin.setEncoding('utf8');
         let password = '';
         const onData = (data) => {
+            // Arrow keys and the like arrive as escape sequences, not as text.
+            if (data.startsWith('\u001B'))
+                return;
             // Handle each character in the input (supports paste)
             for (const char of data) {
                 const charCode = char.charCodeAt(0);
@@ -78,6 +111,7 @@ export function promptPassword(prompt) {
                     stdin.removeListener('data', onData);
                     stdin.pause();
                     process.stdout.write('\n');
+                    debug('prompt', password ? 'password entered' : 'left empty');
                     resolve(password);
                     return;
                 }
@@ -90,7 +124,7 @@ export function promptPassword(prompt) {
                 }
                 else if (charCode === 3) {
                     // Ctrl+C
-                    process.exit();
+                    cancelled();
                 }
                 else if (charCode >= 32) {
                     // Printable characters

package/dist/utils/process-runner.js

@@ -1,60 +1,100 @@
-import { spawn } from 'child_process';
+import { spawn, spawnSync, } from 'child_process';
 import { EventEmitter } from 'events';
+import { debug } from './debug.js';
+const children = new Set();
+/**
+ * Spawn a child in its own process group, so stopping it also stops whatever it
+ * starts (npm, webpack workers), and track it so the CLI can kill leftovers on
+ * exit.
+ */
+export function spawnChild(command, args, options = {}) {
+    const child = spawn(command, args, {
+        ...options,
+        detached: process.platform !== 'win32',
+    });
+    children.add(child);
+    debug('spawn', `${command} ${args.join(' ')} (cwd ${String(options.cwd ?? process.cwd())})`);
+    const forget = () => children.delete(child);
+    child.on('close', (code, signal) => {
+        debug('spawn', `${command} exited ${signal ?? code}`);
+        forget();
+    });
+    child.on('error', error => {
+        debug('spawn', `${command} failed: ${error.message}`);
+        forget();
+    });
+    return child;
+}
+/** Stop a child and everything it started. */
+export function killChild(child) {
+    if (child.pid === undefined ||
+        child.exitCode !== null ||
+        child.signalCode !== null) {
+        return;
+    }
+    try {
+        if (process.platform === 'win32') {
+            // No process groups on Windows: taskkill /T takes the whole tree.
+            spawnSync('taskkill', ['/pid', String(child.pid), '/T', '/F'], {
+                stdio: 'ignore',
+                windowsHide: true,
+            });
+        }
+        else {
+            process.kill(-child.pid, 'SIGTERM');
+        }
+    }
+    catch {
+        // Already gone.
+    }
+}
+/** Kill every child still running; returns how many were signalled. */
+export function killAllChildren() {
+    const running = [...children];
+    for (const child of running)
+        killChild(child);
+    return running.length;
+}
 export class ProcessRunner extends EventEmitter {
     process = null;
     output = [];
     command;
     args;
     cwd;
-    interactive;
-    customEnv;
-    constructor(command, args = [], cwd, interactive = false, customEnv) {
+    env;
+    constructor(command, args = [], cwd, env) {
         super();
         this.command = command;
         this.args = args;
         this.cwd = cwd;
-        this.interactive = interactive;
-        this.customEnv = customEnv;
+        this.env = env;
     }
     run() {
         return new Promise((resolve, reject) => {
-            this.process = spawn(this.command, this.args, {
+            // One pre-joined string: the shell resolves npm.cmd on Windows, and Node
+            // deprecates shell + args (DEP0190). Callers pass trusted args only.
+            this.process = spawnChild([this.command, ...this.args].join(' '), [], {
                 cwd: this.cwd || process.cwd(),
-                env: { ...process.env, ...this.customEnv },
+                env: this.env,
                 shell: true,
-                stdio: this.interactive ? 'inherit' : 'pipe',
+                stdio: 'pipe',
             });
-            // Only capture output if not in interactive mode
-            if (!this.interactive) {
-                this.process.stdout?.on('data', data => {
-                    const output = {
-                        type: 'stdout',
-                        data: data.toString(),
-                    };
-                    this.output.push(output);
-                    if (this.output.length > 1000) {
-                        this.output.shift();
-                    }
-                    this.emit('output', output);
-                });
-                this.process.stderr?.on('data', data => {
-                    const output = {
-                        type: 'stderr',
-                        data: data.toString(),
-                    };
-                    this.output.push(output);
-                    if (this.output.length > 1000) {
-                        this.output.shift();
-                    }
-                    this.emit('output', output);
-                });
-            }
+            const capture = (type) => (data) => {
+                const output = { type, data: data.toString() };
+                this.output.push(output);
+                if (this.output.length > 1000) {
+                    this.output.shift();
+                }
+                this.emit('output', output);
+            };
+            this.process.stdout?.on('data', capture('stdout'));
+            this.process.stderr?.on('data', capture('stderr'));
             this.process.on('error', error => {
                 this.emit('error', error);
                 reject(error);
             });
             this.process.on('close', code => {
-                const exitCode = code ?? 0;
+                const exitCode = code ?? 1;
                 this.emit('exit', exitCode);
                 resolve({
                     exitCode,
@@ -64,9 +104,8 @@ export class ProcessRunner extends EventEmitter {
         });
     }
     kill() {
-        if (this.process) {
-            this.process.kill('SIGTERM');
-        }
+        if (this.process)
+            killChild(this.process);
     }
     getOutput() {
         return this.output;