swarmiq 0.2.0

package/src/oauth.mjs

@@ -0,0 +1,159 @@
+/**
+ * oauth.mjs — Device-flow OAuth for SwarmIQ CLI.
+ *
+ * Implements RFC 8628 (OAuth 2.0 Device Authorization Grant):
+ *   1. POST /v1/auth/device/code  → {device_code, user_code, verification_uri,
+ *                                    verification_uri_complete, expires_in, interval}
+ *   2. Open verification_uri_complete in browser (best-effort); also print URL.
+ *   3. Poll POST /v1/auth/device/token every `interval` seconds:
+ *      - 200 → {access_token, token_type, tenant_id, tier}  → done
+ *      - 400 {error:"authorization_pending"} → keep waiting
+ *      - 400 {error:"slow_down"} → increase interval by 5 s
+ *      - 400 {error:"expired_token"} → abort
+ *      - 400 {error:"access_denied"} → abort
+ *
+ * All network calls are injected (defaultFetch) so tests never hit the network.
+ */
+
+/** OAuth base URL — overridable via SWARMIQ_OAUTH_URL env var. */
+export const OAUTH_BASE_URL =
+  process.env.SWARMIQ_OAUTH_URL ?? 'https://api.swarmiq.dev';
+
+/**
+ * Start the device-flow: POST /v1/auth/device/code.
+ *
+ * @param {object}   opts
+ * @param {string}  [opts.oauthBaseUrl]   - defaults to OAUTH_BASE_URL
+ * @param {Function}[opts.fetch]          - injectable fetch
+ * @returns {Promise<{device_code:string, user_code:string,
+ *   verification_uri:string, verification_uri_complete:string,
+ *   expires_in:number, interval:number}>}
+ */
+export async function requestDeviceCode({
+  oauthBaseUrl = OAUTH_BASE_URL,
+  fetch: fetchFn = globalThis.fetch,
+} = {}) {
+  const url = `${oauthBaseUrl}/v1/auth/device/code`;
+  const res = await fetchFn(url, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({}),
+  });
+
+  if (!res.ok) {
+    const body = await res.text().catch(() => '');
+    throw new Error(`POST /v1/auth/device/code failed: HTTP ${res.status} — ${body}`);
+  }
+
+  const data = await res.json();
+
+  if (!data.device_code || !data.user_code || !data.verification_uri) {
+    throw new Error(
+      'Unexpected response from /v1/auth/device/code: missing required fields'
+    );
+  }
+
+  return {
+    device_code: data.device_code,
+    user_code: data.user_code,
+    verification_uri: data.verification_uri,
+    verification_uri_complete: data.verification_uri_complete ?? data.verification_uri,
+    expires_in: data.expires_in ?? 300,
+    interval: data.interval ?? 5,
+  };
+}
+
+/**
+ * Poll /v1/auth/device/token until the user completes authorisation.
+ *
+ * @param {object}   opts
+ * @param {string}   opts.device_code
+ * @param {number}   opts.interval         - initial poll interval in seconds
+ * @param {number}  [opts.expires_in]      - total expiry window in seconds
+ * @param {string}  [opts.oauthBaseUrl]
+ * @param {Function}[opts.fetch]
+ * @param {Function}[opts.sleep]           - injectable: (ms:number)=>Promise<void>
+ * @returns {Promise<{access_token:string, token_type:string,
+ *   tenant_id:string, tier:string}>}
+ */
+export async function pollDeviceToken({
+  device_code,
+  interval,
+  expires_in = 300,
+  oauthBaseUrl = OAUTH_BASE_URL,
+  fetch: fetchFn = globalThis.fetch,
+  sleep = defaultSleep,
+}) {
+  const url = `${oauthBaseUrl}/v1/auth/device/token`;
+  const deadline = Date.now() + expires_in * 1000;
+  let currentInterval = interval;
+
+  while (Date.now() < deadline) {
+    await sleep(currentInterval * 1000);
+
+    const res = await fetchFn(url, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        device_code,
+        grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
+      }),
+    });
+
+    if (res.ok) {
+      const data = await res.json();
+      if (!data.access_token || !data.tenant_id) {
+        throw new Error(
+          'Unexpected response from /v1/auth/device/token: missing access_token or tenant_id'
+        );
+      }
+      return {
+        access_token: data.access_token,
+        token_type: data.token_type ?? 'bearer',
+        tenant_id: data.tenant_id,
+        tier: data.tier ?? 'free',
+      };
+    }
+
+    // 4xx → inspect error code
+    let detail;
+    try {
+      const body = await res.json();
+      detail = body?.detail?.error ?? body?.error ?? 'unknown_error';
+    } catch {
+      detail = 'unknown_error';
+    }
+
+    switch (detail) {
+      case 'authorization_pending':
+        // Still waiting — continue polling
+        break;
+      case 'slow_down':
+        // Server asked us to back off
+        currentInterval += 5;
+        break;
+      case 'expired_token':
+        throw new Error(
+          'Device authorisation expired. Please run `swarmiq` again to restart.'
+        );
+      case 'access_denied':
+        throw new Error(
+          'Authorisation was denied. Please run `swarmiq` again and approve access.'
+        );
+      default:
+        throw new Error(
+          `Unexpected error from /v1/auth/device/token: ${detail}`
+        );
+    }
+  }
+
+  throw new Error(
+    'Device authorisation timed out. Please run `swarmiq` again to restart.'
+  );
+}
+
+// ─── internal helpers ─────────────────────────────────────────────────────────
+
+function defaultSleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}