spaps 0.7.2 → 0.7.4

package/src/auth/api-key.js

@@ -0,0 +1,119 @@
+const fs = require('node:fs');
+const path = require('node:path');
+
+const API_KEY_ENV_VARS = [
+  'SPAPS_API_KEY',
+  'NEXT_PUBLIC_SPAPS_API_KEY',
+  'VITE_SPAPS_API_KEY',
+];
+
+const API_KEY_ENV_FILES = ['.env.local', '.env'];
+
+function stripWrappingQuotes(value) {
+  if (value.length >= 2) {
+    const first = value[0];
+    const last = value[value.length - 1];
+    if ((first === '"' && last === '"') || (first === '\'' && last === '\'')) {
+      return value.slice(1, -1);
+    }
+  }
+  return value;
+}
+
+function parseEnvAssignments(content) {
+  const values = {};
+
+  for (const rawLine of String(content || '').split(/\r?\n/)) {
+    const line = rawLine.trim();
+    if (!line || line.startsWith('#')) {
+      continue;
+    }
+
+    const separator = line.indexOf('=');
+    if (separator <= 0) {
+      continue;
+    }
+
+    const key = line.slice(0, separator).trim();
+    const value = stripWrappingQuotes(line.slice(separator + 1).trim());
+    values[key] = value;
+  }
+
+  return values;
+}
+
+function readApiKeyFromFile(filePath) {
+  if (!fs.existsSync(filePath)) {
+    return null;
+  }
+
+  try {
+    const values = parseEnvAssignments(fs.readFileSync(filePath, 'utf8'));
+    for (const envVar of API_KEY_ENV_VARS) {
+      if (typeof values[envVar] === 'string' && values[envVar].trim()) {
+        return {
+          apiKey: values[envVar].trim(),
+          envVar,
+          path: filePath,
+          source: path.basename(filePath),
+        };
+      }
+    }
+  } catch {
+    return null;
+  }
+
+  return null;
+}
+
+function findUpApiKey(startDir = process.cwd()) {
+  let current = path.resolve(startDir);
+
+  while (true) {
+    for (const envFile of API_KEY_ENV_FILES) {
+      const hit = readApiKeyFromFile(path.join(current, envFile));
+      if (hit) {
+        return hit;
+      }
+    }
+
+    const parent = path.dirname(current);
+    if (parent === current) {
+      return null;
+    }
+    current = parent;
+  }
+}
+
+function resolveAuthApiKey({ cwd = process.cwd(), env = process.env } = {}) {
+  for (const envVar of API_KEY_ENV_VARS) {
+    if (typeof env[envVar] === 'string' && env[envVar].trim()) {
+      return {
+        apiKey: env[envVar].trim(),
+        envVar,
+        path: null,
+        source: envVar,
+      };
+    }
+  }
+
+  const fileHit = findUpApiKey(cwd);
+  if (fileHit) {
+    return fileHit;
+  }
+
+  return {
+    apiKey: null,
+    envVar: null,
+    path: null,
+    source: null,
+  };
+}
+
+module.exports = {
+  API_KEY_ENV_FILES,
+  API_KEY_ENV_VARS,
+  findUpApiKey,
+  parseEnvAssignments,
+  resolveAuthApiKey,
+};

package/src/auth/client-id.js

@@ -0,0 +1,136 @@
+const fs = require('node:fs');
+const path = require('node:path');
+
+const { requestJson } = require('../local-runtime');
+
+const CONTRACT_FILES = [
+  {
+    relativePath: 'spaps.app.json',
+    label: 'spaps.app.json',
+  },
+  {
+    relativePath: path.join('.spaps', 'app.json'),
+    label: '.spaps/app.json',
+  },
+];
+
+function readJsonIfPresent(filePath) {
+  if (!fs.existsSync(filePath)) {
+    return null;
+  }
+
+  try {
+    return JSON.parse(fs.readFileSync(filePath, 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+function extractClientIdFromContract(contract) {
+  const candidates = [
+    contract?.spaps?.application?.slug,
+    contract?.server?.application_slug,
+    contract?.application_slug,
+    contract?.slug,
+  ];
+
+  for (const candidate of candidates) {
+    if (typeof candidate === 'string' && candidate.trim()) {
+      return candidate.trim();
+    }
+  }
+
+  return null;
+}
+
+function findUpContract(startDir = process.cwd()) {
+  let current = path.resolve(startDir);
+
+  while (true) {
+    for (const contractFile of CONTRACT_FILES) {
+      const filePath = path.join(current, contractFile.relativePath);
+      const payload = readJsonIfPresent(filePath);
+      const clientId = extractClientIdFromContract(payload);
+      if (clientId) {
+        return {
+          clientId,
+          source: contractFile.label,
+          path: filePath,
+        };
+      }
+    }
+
+    const parent = path.dirname(current);
+    if (parent === current) {
+      return null;
+    }
+    current = parent;
+  }
+}
+
+async function findRuntimeClientId(serverUrl) {
+  if (!serverUrl) {
+    return null;
+  }
+
+  const result = await requestJson({
+    method: 'GET',
+    url: `${String(serverUrl).replace(/\/+$/, '')}/health/local-mode`,
+  });
+
+  const clientId = result.ok && result.data && typeof result.data === 'object'
+    ? result.data.test_application?.slug || null
+    : null;
+
+  if (!clientId) {
+    return null;
+  }
+
+  return {
+    clientId,
+    source: '/health/local-mode',
+    path: null,
+  };
+}
+
+async function resolveLoginClientId({ options = {}, serverUrl, cwd = process.cwd() } = {}) {
+  if (typeof options.clientId === 'string' && options.clientId.trim()) {
+    return {
+      clientId: options.clientId.trim(),
+      source: '--client-id',
+      path: null,
+    };
+  }
+
+  if (typeof process.env.SPAPS_CLI_CLIENT_ID === 'string' && process.env.SPAPS_CLI_CLIENT_ID.trim()) {
+    return {
+      clientId: process.env.SPAPS_CLI_CLIENT_ID.trim(),
+      source: 'SPAPS_CLI_CLIENT_ID',
+      path: null,
+    };
+  }
+
+  const contractHit = findUpContract(cwd);
+  if (contractHit) {
+    return contractHit;
+  }
+
+  const runtimeHit = await findRuntimeClientId(serverUrl);
+  if (runtimeHit) {
+    return runtimeHit;
+  }
+
+  return {
+    clientId: null,
+    source: null,
+    path: null,
+  };
+}
+
+module.exports = {
+  CONTRACT_FILES,
+  extractClientIdFromContract,
+  findRuntimeClientId,
+  findUpContract,
+  resolveLoginClientId,
+};

package/src/auth/client.js

@@ -0,0 +1,169 @@
+// Authenticated HTTP client for the SPAPS CLI.
+//
+// Wraps axios with:
+//   - bearer token injection from stored credentials
+//   - SPAPS_ACCESS_TOKEN env-var bypass (CI / machine use)
+//   - automatic one-shot refresh on 401 via POST /auth/refresh, writing the
+//     rotated pair back to the credentials store
+
+const axios = require('axios');
+
+const { DEFAULT_PORT } = require('../config');
+const {
+  getCredentials,
+  setCredentials,
+} = require('./credentials');
+const { resolveAuthApiKey } = require('./api-key');
+const { buildApiUrl, extractApiError, unwrapApiData } = require('./http');
+
+function resolveServerUrl(options = {}) {
+  if (options.serverUrl) return String(options.serverUrl).replace(/\/+$/, '');
+  if (process.env.SPAPS_API_URL) return String(process.env.SPAPS_API_URL).replace(/\/+$/, '');
+  const port = options.port || DEFAULT_PORT;
+  return `http://localhost:${port}`;
+}
+
+function buildRequestHeaders(headers = {}, cwd = process.cwd()) {
+  const resolved = resolveAuthApiKey({ cwd });
+  if (
+    !resolved.apiKey ||
+    Object.prototype.hasOwnProperty.call(headers, 'X-API-Key') ||
+    Object.prototype.hasOwnProperty.call(headers, 'x-api-key')
+  ) {
+    return headers;
+  }
+
+  return {
+    ...headers,
+    'X-API-Key': resolved.apiKey,
+  };
+}
+
+async function refreshAccessToken({
+  serverUrl,
+  refreshToken,
+  axiosInstance = axios,
+  headers = {},
+  cwd = process.cwd(),
+}) {
+  const res = await axiosInstance.post(
+    buildApiUrl(serverUrl, '/auth/refresh'),
+    { refresh_token: refreshToken },
+    {
+      headers: buildRequestHeaders(
+        { 'Content-Type': 'application/json', ...headers },
+        cwd
+      ),
+      validateStatus: () => true,
+    }
+  );
+  if (res.status >= 400) {
+    const apiError = extractApiError(res.data || {}, res.status);
+    const err = new Error(apiError.message || `refresh failed (HTTP ${res.status})`);
+    err.code = apiError.code || 'REFRESH_FAILED';
+    err.status = res.status;
+    throw err;
+  }
+  return unwrapApiData(res.data);
+}
+
+async function authFetch(
+  pathOrUrl,
+  {
+    serverUrl,
+    method = 'GET',
+    body = null,
+    headers = {},
+    axiosInstance = axios,
+    allowRefresh = true,
+    cwd = process.cwd(),
+  } = {}
+) {
+  const base = serverUrl || resolveServerUrl();
+  const url = /^https?:\/\//.test(pathOrUrl) ? pathOrUrl : buildApiUrl(base, pathOrUrl);
+
+  // CI / machine bypass: an explicit env-var token skips the credentials file
+  // entirely and opts out of refresh.
+  let accessToken = process.env.SPAPS_ACCESS_TOKEN || null;
+  let storedCreds = null;
+  if (!accessToken) {
+    storedCreds = getCredentials(base);
+    if (!storedCreds || !storedCreds.access_token) {
+      const err = new Error('Not authenticated. Run `spaps login` first.');
+      err.code = 'NOT_AUTHENTICATED';
+      throw err;
+    }
+    accessToken = storedCreds.access_token;
+  }
+
+  const doRequest = (tokenToUse) =>
+    axiosInstance({
+      url,
+      method,
+      data: body,
+      headers: buildRequestHeaders({
+        ...headers,
+        Authorization: `Bearer ${tokenToUse}`,
+        ...(body ? { 'Content-Type': 'application/json' } : {}),
+      }, cwd),
+      validateStatus: () => true,
+    });
+
+  let res = await doRequest(accessToken);
+  const initialError = res.status === 401 ? extractApiError(res.data || {}, res.status) : null;
+  const shouldAttemptRefresh = !(
+    initialError &&
+    typeof initialError.code === 'string' &&
+    initialError.code.toUpperCase() === 'INVALID_APPLICATION'
+  );
+
+  if (
+    res.status === 401 &&
+    storedCreds &&
+    storedCreds.refresh_token &&
+    allowRefresh &&
+    shouldAttemptRefresh
+  ) {
+    try {
+      const refreshed = await refreshAccessToken({
+        serverUrl: base,
+        refreshToken: storedCreds.refresh_token,
+        axiosInstance,
+        cwd,
+      });
+      const nowSec = Math.floor(Date.now() / 1000);
+      const newAccess = refreshed.access_token;
+      const newRefresh = refreshed.refresh_token || storedCreds.refresh_token;
+      setCredentials(base, {
+        ...storedCreds,
+        access_token: newAccess,
+        refresh_token: newRefresh,
+        expires_in: refreshed.expires_in || storedCreds.expires_in,
+        expires_at: refreshed.expires_in ? nowSec + Number(refreshed.expires_in) : null,
+        token_type: refreshed.token_type || storedCreds.token_type || 'Bearer',
+      });
+      res = await doRequest(newAccess);
+    } catch (err) {
+      if (err.code === 'INVALID_APPLICATION') {
+        throw err;
+      }
+      const authErr = new Error('Session expired. Run `spaps login` again.');
+      authErr.code = 'SESSION_EXPIRED';
+      authErr.cause = err;
+      throw authErr;
+    }
+  }
+
+  return {
+    ...res,
+    raw: res.data,
+    data: unwrapApiData(res.data),
+  };
+}
+
+module.exports = {
+  buildRequestHeaders,
+  resolveServerUrl,
+  refreshAccessToken,
+  authFetch,
+};

package/src/auth/credentials.js

@@ -0,0 +1,110 @@
+// File-backed credential storage for the SPAPS CLI.
+//
+// Stores tokens per-server at ~/.config/spaps/credentials.json with 0600 perms.
+// Uses a separate filename from the Python client's ~/.config/spaps/tokens.json
+// to avoid schema collisions; cross-client unification can come later.
+//
+// TODO(keyring): fall back to OS keyring (Keychain / Secret Service / Credential
+// Manager) when available, then to this file store.
+
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+
+const SCHEMA_VERSION = 1;
+
+function defaultCredentialsPath() {
+  if (process.env.SPAPS_CREDENTIALS_PATH) {
+    return process.env.SPAPS_CREDENTIALS_PATH;
+  }
+  const base = process.env.XDG_CONFIG_HOME || path.join(os.homedir(), '.config');
+  return path.join(base, 'spaps', 'credentials.json');
+}
+
+function normalizeServerUrl(url) {
+  if (!url) return '';
+  return String(url).trim().replace(/\/+$/, '').toLowerCase();
+}
+
+function emptyStore() {
+  return { version: SCHEMA_VERSION, servers: {} };
+}
+
+function createStore(filePath) {
+  const target = filePath || defaultCredentialsPath();
+
+  function loadAll() {
+    try {
+      const raw = fs.readFileSync(target, 'utf8');
+      const data = JSON.parse(raw);
+      if (!data || typeof data !== 'object') return emptyStore();
+      if (!data.servers || typeof data.servers !== 'object') data.servers = {};
+      if (!data.version) data.version = SCHEMA_VERSION;
+      return data;
+    } catch (err) {
+      if (err.code === 'ENOENT') return emptyStore();
+      throw err;
+    }
+  }
+
+  function saveAll(data) {
+    const dir = path.dirname(target);
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const tmp = `${target}.${process.pid}.tmp`;
+    fs.writeFileSync(tmp, JSON.stringify(data, null, 2), { mode: 0o600 });
+    fs.renameSync(tmp, target);
+    try {
+      fs.chmodSync(target, 0o600);
+    } catch {
+      // Best effort — Windows ignores chmod, and that's OK.
+    }
+  }
+
+  function getCredentials(serverUrl) {
+    const data = loadAll();
+    return data.servers[normalizeServerUrl(serverUrl)] || null;
+  }
+
+  function setCredentials(serverUrl, creds) {
+    const data = loadAll();
+    data.servers[normalizeServerUrl(serverUrl)] = {
+      ...creds,
+      saved_at: Math.floor(Date.now() / 1000),
+    };
+    saveAll(data);
+  }
+
+  function clearCredentials(serverUrl) {
+    const data = loadAll();
+    const key = normalizeServerUrl(serverUrl);
+    if (data.servers[key]) {
+      delete data.servers[key];
+      saveAll(data);
+      return true;
+    }
+    return false;
+  }
+
+  return {
+    path: target,
+    getCredentials,
+    setCredentials,
+    clearCredentials,
+    _loadAll: loadAll,
+    _saveAll: saveAll,
+  };
+}
+
+// Default singleton used by handlers in normal CLI operation.
+const defaultStore = createStore();
+
+module.exports = {
+  SCHEMA_VERSION,
+  createStore,
+  defaultCredentialsPath,
+  normalizeServerUrl,
+  get CREDENTIALS_PATH() { return defaultStore.path; },
+  getCredentials: (url) => defaultStore.getCredentials(url),
+  setCredentials: (url, creds) => defaultStore.setCredentials(url, creds),
+  clearCredentials: (url) => defaultStore.clearCredentials(url),
+};

package/src/auth/device-flow.js

@@ -0,0 +1,159 @@
+// RFC 8628 device authorization grant client for the SPAPS CLI.
+//
+// Wraps the server endpoints under /api/cli/device/{authorize,verify,token}:
+//   - startDeviceAuthorization() -> POST /api/cli/device/authorize
+//   - pollForToken()             -> POST /api/cli/device/token (polling)
+//
+// The `verify` endpoint is JWT-gated and driven by the user's browser session,
+// not this client.
+
+const axios = require('axios');
+
+const { buildApiUrl, extractApiError, unwrapApiData } = require('./http');
+
+const GRANT_TYPE = 'urn:ietf:params:oauth:grant-type:device_code';
+const DEFAULT_CLIENT_ID = null;
+
+class DeviceFlowError extends Error {
+  constructor(code, message) {
+    super(message || code);
+    this.name = 'DeviceFlowError';
+    this.code = code;
+  }
+}
+
+async function startDeviceAuthorization({
+  serverUrl,
+  clientId = DEFAULT_CLIENT_ID,
+  axiosInstance = axios,
+}) {
+  if (!serverUrl || !clientId) {
+    throw new DeviceFlowError('config_error', 'serverUrl and clientId are required');
+  }
+  let res;
+  try {
+    res = await axiosInstance.post(
+      buildApiUrl(serverUrl, '/cli/device/authorize'),
+      { client_id: clientId },
+      {
+        headers: { 'Content-Type': 'application/json' },
+        validateStatus: () => true,
+      }
+    );
+  } catch (err) {
+    throw new DeviceFlowError(
+      'network_error',
+      `Failed to reach SPAPS at ${serverUrl}: ${err.message || err}`
+    );
+  }
+
+  if (res.status >= 400) {
+    const body = res.data || {};
+    const apiError = extractApiError(body, res.status);
+    throw new DeviceFlowError(
+      apiError.code || 'authorize_failed',
+      apiError.message || `HTTP ${res.status}`
+    );
+  }
+  return unwrapApiData(res.data);
+}
+
+function defaultSleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+async function pollForToken({
+  serverUrl,
+  deviceCode,
+  clientId = DEFAULT_CLIENT_ID,
+  interval = 5,
+  expiresIn = 900,
+  axiosInstance = axios,
+  onTick = null,
+  clock = Date.now,
+  sleepFn = defaultSleep,
+}) {
+  if (!serverUrl || !deviceCode || !clientId) {
+    throw new DeviceFlowError(
+      'config_error',
+      'serverUrl, deviceCode, and clientId are required'
+    );
+  }
+
+  const startTime = clock();
+  const expiresAtMs = startTime + Number(expiresIn) * 1000;
+  // Use Number.isFinite so an explicit 0 is respected (tests use interval=0
+  // to skip real sleeps; `0 || 5` would clobber that to 5).
+  const parsedInterval = Number(interval);
+  let currentInterval = Math.max(
+    0,
+    Number.isFinite(parsedInterval) ? parsedInterval : 5
+  );
+
+  // Loop until the server returns success, an unrecoverable error, or the
+  // device code TTL is exhausted.
+  while (clock() < expiresAtMs) {
+    let res;
+    try {
+      res = await axiosInstance.post(
+        buildApiUrl(serverUrl, '/cli/device/token'),
+        {
+          grant_type: GRANT_TYPE,
+          device_code: deviceCode,
+          client_id: clientId,
+        },
+        {
+          headers: { 'Content-Type': 'application/json' },
+          validateStatus: () => true,
+        }
+      );
+    } catch (err) {
+      throw new DeviceFlowError(
+        'network_error',
+        `Failed to reach SPAPS during poll: ${err.message || err}`
+      );
+    }
+
+    const responseData = unwrapApiData(res.data);
+
+    if (res.status >= 200 && res.status < 300 && responseData && responseData.access_token) {
+      return responseData;
+    }
+
+    const apiError = extractApiError(res.data || {}, res.status);
+    const errorCode = apiError.code || `http_${res.status}`;
+    const errorDesc = apiError.message || '';
+
+    if (errorCode === 'authorization_pending') {
+      if (onTick) onTick({ status: 'pending', interval: currentInterval });
+      await sleepFn(currentInterval * 1000);
+      continue;
+    }
+    if (errorCode === 'slow_down') {
+      currentInterval += 5;
+      if (onTick) onTick({ status: 'slow_down', interval: currentInterval });
+      await sleepFn(currentInterval * 1000);
+      continue;
+    }
+    if (errorCode === 'access_denied') {
+      throw new DeviceFlowError('access_denied', errorDesc || 'User denied the authorization request');
+    }
+    if (errorCode === 'expired_token') {
+      throw new DeviceFlowError('expired_token', errorDesc || 'Device code expired before authorization');
+    }
+    throw new DeviceFlowError(
+      errorCode,
+      errorDesc || `Device token exchange failed (HTTP ${res.status})`
+    );
+  }
+
+  throw new DeviceFlowError('expired_token', 'Timed out waiting for user authorization');
+}
+
+module.exports = {
+  DEFAULT_CLIENT_ID,
+  GRANT_TYPE,
+  DeviceFlowError,
+  startDeviceAuthorization,
+  pollForToken,
+};