t3code-cli 0.11.0 → 0.12.0

package/src/config/keystore/keyring-node.ts

@@ -0,0 +1,100 @@
+import * as Cause from "effect/Cause";
+import * as Effect from "effect/Effect";
+import * as Encoding from "effect/Encoding";
+import * as Layer from "effect/Layer";
+import * as Predicate from "effect/Predicate";
+import * as Result from "effect/Result";
+
+import { KeystoreUnavailableError } from "./error.ts";
+import {
+  masterKeyByteLength,
+  T3MasterKeyKeystoreFactory,
+  type MasterKeyKeystore,
+  type MasterKeyReadResult,
+} from "./service.ts";
+
+type KeyringModule = typeof import("@napi-rs/keyring");
+
+const keyringService = "t3cli";
+const keyringAccount = "master-key";
+
+const loadKeyringModuleOnce = Effect.tryPromise(
+  () => import("@napi-rs/keyring") as Promise<KeyringModule>,
+);
+
+const loadKeyringModuleMemoized = Effect.cached(loadKeyringModuleOnce);
+
+const loadKeyringModule = Effect.flatMap(loadKeyringModuleMemoized, (load) =>
+  load.pipe(
+    Effect.mapError(
+      (error) =>
+        new KeystoreUnavailableError({
+          reason:
+            Predicate.hasProperty(error.cause, "code") &&
+            error.cause.code === "ERR_MODULE_NOT_FOUND"
+              ? "module-not-found"
+              : "backend-unavailable",
+          cause: error,
+        }),
+    ),
+  ),
+);
+
+export function parseKeyringPassword(password: string | null): MasterKeyReadResult {
+  if (password === null || password.length === 0) {
+    return { kind: "missing" };
+  }
+  return Result.match(Encoding.decodeBase64(password.trim()), {
+    onFailure: () => ({
+      kind: "corrupt" as const,
+      message: "invalid base64 key",
+    }),
+    onSuccess: (key) => {
+      if (key.byteLength !== masterKeyByteLength) {
+        return {
+          kind: "corrupt" as const,
+          message: "unexpected key length",
+        };
+      }
+      return { kind: "present" as const, key };
+    },
+  });
+}
+
+function createKeyringKeystore(keyring: KeyringModule): MasterKeyKeystore {
+  const entry = new keyring.Entry(keyringService, keyringAccount);
+  return {
+    read: () =>
+      Effect.sync(() => {
+        try {
+          return parseKeyringPassword(entry.getPassword());
+        } catch {
+          return {
+            kind: "unavailable" as const,
+            message: "failed to read credential key from OS keyring",
+          };
+        }
+      }),
+    write: (key) =>
+      Effect.try({
+        try: () => {
+          entry.setPassword(Encoding.encodeBase64(key));
+        },
+        catch: (cause) =>
+          new KeystoreUnavailableError({
+            reason: "backend-unavailable",
+            cause: new Cause.UnknownError(cause),
+          }),
+      }),
+  };
+}
+
+const make = (): T3MasterKeyKeystoreFactory["Service"] => ({
+  make: () =>
+    Effect.gen(function* () {
+      const keyring = yield* loadKeyringModule;
+      return createKeyringKeystore(keyring);
+    }),
+});
+
+export const layerNode = Layer.succeed(T3MasterKeyKeystoreFactory, make());

package/src/config/keystore/service.test-utils.ts

@@ -0,0 +1,15 @@
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+
+import { KeystoreUnavailableError } from "./error.ts";
+import { T3MasterKeyKeystoreFactory } from "./service.ts";
+
+export const unavailableKeystoreFactoryLayer = Layer.succeed(T3MasterKeyKeystoreFactory)({
+  make: () =>
+    Effect.fail(
+      new KeystoreUnavailableError({
+        reason: "module-not-found",
+        cause: new Error("keyring unavailable in test"),
+      }),
+    ),
+});

package/src/config/keystore/service.test.ts

@@ -0,0 +1,18 @@
+import "vite-plus/test/config";
+
+import { describe, it } from "@effect/vitest";
+import { expect } from "vite-plus/test";
+
+import { shouldUseFileKeystoreForRead } from "./service.ts";
+
+describe("shouldUseFileKeystoreForRead", () => {
+  it("treats unavailable keyring reads as file-keystore fallback", () => {
+    const result = { kind: "unavailable" as const, message: "failed" };
+    expect(shouldUseFileKeystoreForRead(result)).toBe(true);
+  });
+
+  it("does not fall back for corrupt keyring reads", () => {
+    const result = { kind: "corrupt" as const, message: "invalid key" };
+    expect(shouldUseFileKeystoreForRead(result)).toBe(false);
+  });
+});

package/src/config/keystore/service.ts

@@ -0,0 +1,29 @@
+import * as Context from "effect/Context";
+import type * as Effect from "effect/Effect";
+
+import type { ConfigError } from "../error.ts";
+import type { KeystoreUnavailableError } from "./error.ts";
+
+export const masterKeyByteLength = 32;
+
+export type MasterKeyReadResult =
+  | { readonly kind: "missing" }
+  | { readonly kind: "present"; readonly key: Uint8Array }
+  | { readonly kind: "corrupt"; readonly message: string }
+  | { readonly kind: "unavailable"; readonly message: string };
+
+export type MasterKeyKeystore = {
+  readonly read: () => Effect.Effect<MasterKeyReadResult, ConfigError>;
+  readonly write: (key: Uint8Array) => Effect.Effect<void, ConfigError | KeystoreUnavailableError>;
+};
+
+export class T3MasterKeyKeystoreFactory extends Context.Service<
+  T3MasterKeyKeystoreFactory,
+  {
+    readonly make: () => Effect.Effect<MasterKeyKeystore, KeystoreUnavailableError>;
+  }
+>()("t3cli/T3MasterKeyKeystoreFactory") {}
+
+export function shouldUseFileKeystoreForRead(result: MasterKeyReadResult) {
+  return result.kind === "missing" || result.kind === "unavailable";
+}

package/src/config/layer.test-utils.ts

@@ -0,0 +1,45 @@
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+
+import * as Credential from "./credential/service.ts";
+import * as Config from "./config.ts";
+import * as Selection from "./selection/service.ts";
+import { CliRuntime } from "../cli/runtime/service.ts";
+import { ConfigPlatformLayer } from "./platform.test-utils.ts";
+import { t3CliEnvConfigLayer } from "./env/env.test-utils.ts";
+import * as CredentialCipherWeb from "./credential/cipher-web.ts";
+import * as Keystore from "./keystore/service.test-utils.ts";
+
+export type T3ConfigLayerTestInput = {
+  readonly selection?: string;
+  readonly env?: Readonly<Record<string, string | undefined>>;
+  readonly useSelectionLive?: boolean;
+};
+
+export function t3ConfigDepsLayer(homeDir: string, input: T3ConfigLayerTestInput = {}) {
+  const cliRuntimeLayer = CliRuntime.layerTest({ cwd: homeDir });
+  const configLayer = t3CliEnvConfigLayer(homeDir, input.env ?? {});
+  const platformEnvLayer = Layer.mergeAll(cliRuntimeLayer, configLayer);
+  const selectionLayer =
+    input.useSelectionLive === true
+      ? Selection.layer.pipe(Layer.provide(platformEnvLayer))
+      : Layer.succeed(Selection.T3ConfigSelection)({
+          getSelectedEnvironment: () => Effect.succeed(input.selection),
+        });
+
+  return Config.layer.pipe(
+    Layer.provide(Credential.layer),
+    Layer.provide(
+      Layer.mergeAll(
+        platformEnvLayer,
+        selectionLayer,
+        CredentialCipherWeb.layerWeb,
+        Keystore.unavailableKeystoreFactoryLayer,
+      ),
+    ),
+  );
+}
+
+export function t3ConfigLayerTest(homeDir: string, input: T3ConfigLayerTestInput = {}) {
+  return Layer.mergeAll(ConfigPlatformLayer, t3ConfigDepsLayer(homeDir, input));
+}

package/src/config/layer.test.ts

@@ -0,0 +1,209 @@
+import "vite-plus/test/config";
+
+import * as Effect from "effect/Effect";
+import { assert, describe, it } from "@effect/vitest";
+
+import { T3Config } from "./config.ts";
+import { ConfigPlatformLayer } from "./platform.test-utils.ts";
+import { makeTempHomeScoped } from "./temp-home.test-utils.ts";
+import { t3ConfigDepsLayer } from "./layer.test-utils.ts";
+
+describe("T3Config", () => {
+  it.effect(
+    "keeps default unchanged when upserting an existing environment without makeDefault",
+    () =>
+      Effect.gen(function* () {
+        return yield* makeTempHomeScoped("t3cli-config-");
+      }).pipe(
+        Effect.flatMap((homeDir) =>
+          Effect.gen(function* () {
+            const config = yield* T3Config;
+            yield* config.upsertEnvironment({
+              name: "home",
+              url: "https://home.example",
+              token: "home-token",
+              local: false,
+            });
+            yield* config.upsertEnvironment({
+              name: "work",
+              url: "https://work.example",
+              token: "work-token",
+              local: false,
+            });
+            yield* config.upsertEnvironment({
+              name: "work",
+              url: "https://work.example",
+              token: "work-token-2",
+              local: false,
+            });
+            const listed = yield* config.listEnvironments();
+            assert.equal(listed.find((environment) => environment.name === "home")?.default, true);
+            assert.equal(listed.find((environment) => environment.name === "work")?.default, false);
+          }).pipe(Effect.provide(t3ConfigDepsLayer(homeDir))),
+        ),
+        Effect.provide(ConfigPlatformLayer),
+        Effect.scoped,
+      ),
+  );
+
+  it.effect("promotes default when upserting with makeDefault", () =>
+    Effect.gen(function* () {
+      return yield* makeTempHomeScoped("t3cli-config-");
+    }).pipe(
+      Effect.flatMap((homeDir) =>
+        Effect.gen(function* () {
+          const config = yield* T3Config;
+          yield* config.upsertEnvironment({
+            name: "home",
+            url: "https://home.example",
+            token: "home-token",
+            local: false,
+          });
+          yield* config.upsertEnvironment({
+            name: "work",
+            url: "https://work.example",
+            token: "work-token",
+            local: false,
+          });
+          yield* config.upsertEnvironment({
+            name: "work",
+            url: "https://work.example",
+            token: "work-token-2",
+            local: false,
+            makeDefault: true,
+          });
+          const listed = yield* config.listEnvironments();
+          assert.equal(listed.find((environment) => environment.name === "home")?.default, false);
+          assert.equal(listed.find((environment) => environment.name === "work")?.default, true);
+        }).pipe(Effect.provide(t3ConfigDepsLayer(homeDir))),
+      ),
+      Effect.provide(ConfigPlatformLayer),
+      Effect.scoped,
+    ),
+  );
+
+  it.effect("clears default when removing the default environment", () =>
+    Effect.gen(function* () {
+      return yield* makeTempHomeScoped("t3cli-config-");
+    }).pipe(
+      Effect.flatMap((homeDir) =>
+        Effect.gen(function* () {
+          const config = yield* T3Config;
+          yield* config.upsertEnvironment({
+            name: "home",
+            url: "https://home.example",
+            token: "home-token",
+            local: false,
+          });
+          yield* config.upsertEnvironment({
+            name: "work",
+            url: "https://work.example",
+            token: "work-token",
+            local: false,
+          });
+          yield* config.removeEnvironment("home");
+          const defaultName = yield* config.getDefaultEnvironmentName();
+          assert.equal(defaultName, undefined);
+          const listed = yield* config.listEnvironments();
+          assert.equal(
+            listed.every((environment) => !environment.default),
+            true,
+          );
+        }).pipe(Effect.provide(t3ConfigDepsLayer(homeDir))),
+      ),
+      Effect.provide(ConfigPlatformLayer),
+      Effect.scoped,
+    ),
+  );
+
+  it.effect("resolves selected environment from config selection service", () =>
+    Effect.gen(function* () {
+      return yield* makeTempHomeScoped("t3cli-config-");
+    }).pipe(
+      Effect.flatMap((homeDir) =>
+        Effect.gen(function* () {
+          const config = yield* T3Config;
+          yield* config.upsertEnvironment({
+            name: "home",
+            url: "https://home.example",
+            token: "home-token",
+            local: false,
+          });
+          yield* config.upsertEnvironment({
+            name: "work",
+            url: "https://work.example",
+            token: "work-token",
+            local: true,
+          });
+          const resolved = yield* config.resolve();
+          assert.equal(resolved.source, "config");
+          if (resolved.source === "config") {
+            assert.equal(resolved.environment, "work");
+            assert.equal(resolved.token, "work-token");
+          }
+        }).pipe(Effect.provide(t3ConfigDepsLayer(homeDir, { selection: "work" }))),
+      ),
+      Effect.provide(ConfigPlatformLayer),
+      Effect.scoped,
+    ),
+  );
+
+  it.effect(
+    "resolves env override with local=false even when selected stored environment is local",
+    () =>
+      Effect.gen(function* () {
+        return yield* makeTempHomeScoped("t3cli-config-");
+      }).pipe(
+        Effect.flatMap((homeDir) =>
+          Effect.gen(function* () {
+            const config = yield* T3Config;
+            yield* config.upsertEnvironment({
+              name: "work",
+              url: "http://localhost:8787",
+              token: "work-token",
+              local: true,
+            });
+            const resolved = yield* config.resolve();
+            assert.equal(resolved.source, "env");
+            assert.equal(resolved.local, false);
+            assert.equal(resolved.url, "https://remote.example");
+            assert.equal(resolved.token, "env-token");
+          }).pipe(
+            Effect.provide(
+              t3ConfigDepsLayer(homeDir, {
+                selection: "work",
+                env: {
+                  T3CODE_URL: "https://remote.example",
+                  T3CODE_TOKEN: "env-token",
+                },
+              }),
+            ),
+          ),
+        ),
+        Effect.provide(ConfigPlatformLayer),
+        Effect.scoped,
+      ),
+  );
+
+  it.effect("reads default environment name without decrypting tokens", () =>
+    Effect.gen(function* () {
+      return yield* makeTempHomeScoped("t3cli-config-");
+    }).pipe(
+      Effect.flatMap((homeDir) =>
+        Effect.gen(function* () {
+          const config = yield* T3Config;
+          yield* config.upsertEnvironment({
+            name: "home",
+            url: "https://home.example",
+            token: "home-token",
+            local: false,
+          });
+          const defaultName = yield* config.getDefaultEnvironmentName();
+          assert.equal(defaultName, "home");
+        }).pipe(Effect.provide(t3ConfigDepsLayer(homeDir))),
+      ),
+      Effect.provide(ConfigPlatformLayer),
+      Effect.scoped,
+    ),
+  );
+});

package/src/config/paths/index.ts

@@ -0,0 +1 @@
+export { resolveConfigFilePath, resolveKeyFilePath, resolveT3cliConfigDir } from "./paths.ts";

package/src/config/paths/paths.ts

@@ -0,0 +1,36 @@
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+import * as Path from "effect/Path";
+
+import { loadT3CliEnv } from "../env/env.ts";
+import { ConfigError } from "../error.ts";
+
+export const resolveT3cliConfigDir = Effect.fn("resolveT3cliConfigDir")(function* () {
+  const path = yield* Path.Path;
+  const t3CliEnv = yield* loadT3CliEnv.pipe(
+    Effect.mapError(
+      (error) => new ConfigError({ message: "failed to load CLI environment", cause: error }),
+    ),
+  );
+  const home = yield* Option.match(t3CliEnv.home, {
+    onNone: () => Effect.die("HOME is not set"),
+    onSome: Effect.succeed,
+  });
+  const root = Option.match(t3CliEnv.xdgConfigHome, {
+    onNone: () => path.join(home, ".config"),
+    onSome: (xdgConfigHome) => xdgConfigHome,
+  });
+  return path.join(root, "t3cli");
+});
+
+export const resolveConfigFilePath = Effect.fn("resolveConfigFilePath")(function* () {
+  const path = yield* Path.Path;
+  const configDir = yield* resolveT3cliConfigDir();
+  return path.join(configDir, "config.json");
+});
+
+export const resolveKeyFilePath = Effect.fn("resolveKeyFilePath")(function* () {
+  const path = yield* Path.Path;
+  const configDir = yield* resolveT3cliConfigDir();
+  return path.join(configDir, "key");
+});

package/src/config/persist/file-mode.ts

@@ -0,0 +1,21 @@
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+
+import { ConfigError } from "../error.ts";
+
+const privateFileMode = 0o600;
+
+export const hardenPrivateFileMode = Effect.fn("hardenPrivateFileMode")(function* (
+  filePath: string,
+  label: "config" | "credential key",
+) {
+  const fs = yield* FileSystem.FileSystem;
+  yield* fs
+    .chmod(filePath, privateFileMode)
+    .pipe(
+      Effect.mapError(
+        (error) =>
+          new ConfigError({ message: `failed to set ${label} file permissions`, cause: error }),
+      ),
+    );
+});

package/src/config/persist/migration.test.ts

@@ -0,0 +1,71 @@
+import "vite-plus/test/config";
+
+import * as Cause from "effect/Cause";
+import * as Effect from "effect/Effect";
+import * as Exit from "effect/Exit";
+import * as Option from "effect/Option";
+import { assert, describe, it } from "@effect/vitest";
+
+import { ConfigError } from "../error.ts";
+import { T3CredentialCrypto } from "../credential/service.ts";
+import { ConfigPlatformLayer } from "../platform.test-utils.ts";
+import { makeTempHomeScoped } from "../temp-home.test-utils.ts";
+import { t3CredentialCryptoDepsLayer } from "../credential/service.test-utils.ts";
+import { migrateV1FileToEncrypted } from "./migration.ts";
+
+describe("migrateV1FileToEncrypted", () => {
+  it.effect("migrates v1 flat config and roundtrips encrypted tokens", () =>
+    Effect.gen(function* () {
+      return yield* makeTempHomeScoped("t3cli-migration-");
+    }).pipe(
+      Effect.flatMap((homeDir) =>
+        Effect.gen(function* () {
+          const migrated = yield* migrateV1FileToEncrypted({
+            url: "https://app.example.com",
+            token: "secret-token",
+            local: false,
+          });
+          assert.equal(migrated.default, "app.example.com");
+          const crypto = yield* T3CredentialCrypto;
+          const token = yield* crypto.decrypt({
+            environmentName: "app.example.com",
+            url: "https://app.example.com",
+            local: false,
+            token: migrated.environments["app.example.com"]!.token,
+          });
+          assert.equal(token, "secret-token");
+        }).pipe(Effect.provide(t3CredentialCryptoDepsLayer(homeDir))),
+      ),
+      Effect.provide(ConfigPlatformLayer),
+      Effect.scoped,
+    ),
+  );
+
+  it.effect("maps invalid v1 urls to ConfigError when migrating directly", () =>
+    Effect.gen(function* () {
+      return yield* makeTempHomeScoped("t3cli-migrate-url-error-");
+    }).pipe(
+      Effect.flatMap((homeDir) =>
+        Effect.gen(function* () {
+          const exit = yield* migrateV1FileToEncrypted({
+            url: "not-a-url",
+            token: "secret-token",
+            local: false,
+          }).pipe(Effect.provide(t3CredentialCryptoDepsLayer(homeDir)), Effect.exit);
+          assert.isTrue(Exit.isFailure(exit));
+          if (!Exit.isFailure(exit)) {
+            return;
+          }
+          const error = Cause.findErrorOption(exit.cause);
+          assert.isTrue(Option.isSome(error));
+          if (Option.isSome(error)) {
+            assert.instanceOf(error.value, ConfigError);
+            assert.equal(error.value.message, "invalid url");
+          }
+        }),
+      ),
+      Effect.provide(ConfigPlatformLayer),
+      Effect.scoped,
+    ),
+  );
+});

package/src/config/persist/migration.ts

@@ -0,0 +1,82 @@
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+import * as Schema from "effect/Schema";
+
+import { T3CredentialCrypto } from "../credential/service.ts";
+import { migrateV1EnvironmentName, validateEnvironmentName } from "../environment-name/name.ts";
+import { ConfigError } from "../error.ts";
+import {
+  StoredConfigV1FileSchema,
+  StoredConfigV2FileSchema,
+  type StoredConfigV1File,
+} from "./schema.ts";
+import type { EncryptedConfig } from "../types.ts";
+import { normalizeHttpBaseUrl } from "../url/url.ts";
+
+export const emptyEncryptedConfig = (): EncryptedConfig => ({
+  version: 2,
+  environments: {},
+});
+
+export const readEncryptedConfigFromValue = Effect.fn("readEncryptedConfigFromValue")(function* (
+  value: unknown,
+) {
+  return yield* Effect.gen(function* () {
+    const v2 = yield* Schema.decodeUnknownEffect(StoredConfigV2FileSchema)(value).pipe(
+      Effect.option,
+    );
+    if (Option.isSome(v2)) {
+      return { config: v2.value, migratedFromV1: false as const };
+    }
+    const v1 = yield* Schema.decodeUnknownEffect(StoredConfigV1FileSchema)(value);
+    const migrated = yield* migrateV1FileToEncrypted(v1);
+    return { config: migrated, migratedFromV1: true as const };
+  }).pipe(
+    Effect.catchTags({
+      SchemaError: (error) =>
+        Effect.fail(new ConfigError({ message: "failed to read config", cause: error })),
+    }),
+  );
+});
+
+export const migrateV1FileToEncrypted = Effect.fn("migrateV1FileToEncrypted")(function* (
+  config: StoredConfigV1File,
+) {
+  if (
+    (config.url === undefined || config.url.length === 0) &&
+    (config.token === undefined || config.token.length === 0)
+  ) {
+    return emptyEncryptedConfig();
+  }
+  if (config.url === undefined || config.token === undefined) {
+    return yield* Effect.fail(
+      new ConfigError({ message: "failed to read config: incomplete v1 credentials" }),
+    );
+  }
+  const name = yield* migrateV1EnvironmentName(config).pipe(
+    Effect.flatMap((migratedName) =>
+      validateEnvironmentName(migratedName).pipe(Effect.as(migratedName)),
+    ),
+  );
+  const normalizedUrl = yield* normalizeHttpBaseUrl(config.url).pipe(
+    Effect.mapError((error) => new ConfigError({ message: error.message, cause: error.cause })),
+  );
+  const crypto = yield* T3CredentialCrypto;
+  const token = yield* crypto.encrypt({
+    environmentName: name,
+    url: normalizedUrl,
+    local: config.local ?? false,
+    token: config.token,
+  });
+  return {
+    version: 2 as const,
+    default: name,
+    environments: {
+      [name]: {
+        url: normalizedUrl,
+        local: config.local ?? false,
+        token,
+      },
+    },
+  } satisfies EncryptedConfig;
+});