t3code-cli 0.11.0 → 0.13.0

package/src/auth/local-token.ts

@@ -2,7 +2,7 @@ import {
   AuthAdministrativeScopes,
   AuthSessionId,
   type AuthEnvironmentScope,
-} from "#t3tools/contracts";
+} from "@t3tools/contracts";
 import * as Context from "effect/Context";
 import * as Crypto from "effect/Crypto";
 import * as DateTime from "effect/DateTime";
@@ -15,7 +15,8 @@ import * as Path from "effect/Path";
 import * as Predicate from "effect/Predicate";
 import * as SqlClient from "effect/unstable/sql/SqlClient";
 
-import { Environment } from "../environment/service.ts";
+import { loadT3CliEnv } from "../config/env/env.ts";
+import { CliRuntime } from "../cli/runtime/service.ts";
 import { SqlClientFactory } from "../sql/service.ts";
 import {
   AuthLocalDatabaseError,
@@ -38,7 +39,8 @@ export class T3LocalAuthToken extends Context.Service<
 export const makeT3LocalAuthToken = Effect.fn("makeT3LocalAuthToken")(function* () {
   const fs = yield* FileSystem.FileSystem;
   const path = yield* Path.Path;
-  const environment = yield* Environment;
+  const cliRuntime = yield* CliRuntime;
+  const t3CliEnv = yield* loadT3CliEnv;
   const crypto = yield* Crypto.Crypto;
   const sqlClientFactory = yield* SqlClientFactory;
 
@@ -100,14 +102,15 @@ export const makeT3LocalAuthToken = Effect.fn("makeT3LocalAuthToken")(function*
 
   function openAuthDatabase(dbPath: string) {
     return sqlClientFactory.sqliteClient({ filename: dbPath }).pipe(
-      Effect.catchTag("SqlError", (error) =>
-        Effect.fail(
-          new AuthLocalDatabaseError({
-            operation: "connect",
-            message: error.message,
-          }),
-        ),
-      ),
+      Effect.catchTags({
+        SqlError: (error) =>
+          Effect.fail(
+            new AuthLocalDatabaseError({
+              operation: "connect",
+              message: error.message,
+            }),
+          ),
+      }),
     );
   }
 
@@ -157,14 +160,15 @@ export const makeT3LocalAuthToken = Effect.fn("makeT3LocalAuthToken")(function*
       expiresAt: DateTime.formatIso(expiresAt),
     }).pipe(
       provideAuthDatabase(input.dbPath),
-      Effect.catchTag("SqlError", (error) =>
-        Effect.fail(
-          new AuthLocalDatabaseError({
-            operation: Predicate.isTagged(error.reason, "ConnectionError") ? "connect" : "query",
-            message: error.message,
-          }),
-        ),
-      ),
+      Effect.catchTags({
+        SqlError: (error) =>
+          Effect.fail(
+            new AuthLocalDatabaseError({
+              operation: Predicate.isTagged(error.reason, "ConnectionError") ? "connect" : "query",
+              message: error.message,
+            }),
+          ),
+      }),
     );
     return {
       token,
@@ -185,10 +189,11 @@ export const makeT3LocalAuthToken = Effect.fn("makeT3LocalAuthToken")(function*
       );
     }
 
-    const baseDir = yield* resolveLocalBaseDir({ baseDir: input.baseDir }).pipe(
-      Effect.provideService(Environment, environment),
-      Effect.provideService(Path.Path, path),
-    );
+    const baseDir = yield* resolveLocalBaseDir({
+      baseDir: input.baseDir,
+      cliRuntime,
+      t3CliEnv,
+    }).pipe(Effect.provideService(Path.Path, path));
     const session = yield* issueLocalDatabaseSession({
       dbPath: path.join(baseDir, "userdata", "state.sqlite"),
       secretsDir: path.join(baseDir, "userdata", "secrets"),

package/src/auth/remote-error.ts

@@ -0,0 +1,17 @@
+import {
+  RemoteEnvironmentAuthFetchError,
+  type RemoteEnvironmentAuthError,
+  RemoteEnvironmentAuthInvalidJsonError,
+  RemoteEnvironmentAuthTimeoutError,
+  RemoteEnvironmentAuthUndeclaredStatusError,
+} from "@t3tools/client-runtime/authorization";
+import { EnvironmentHttpCommonError } from "@t3tools/contracts";
+import * as Schema from "effect/Schema";
+
+export const RemoteEnvironmentAuthErrorSchema = Schema.Union([
+  EnvironmentHttpCommonError,
+  Schema.instanceOf(RemoteEnvironmentAuthFetchError),
+  Schema.instanceOf(RemoteEnvironmentAuthInvalidJsonError),
+  Schema.instanceOf(RemoteEnvironmentAuthTimeoutError),
+  Schema.instanceOf(RemoteEnvironmentAuthUndeclaredStatusError),
+]) satisfies Schema.Schema<RemoteEnvironmentAuthError>;

package/src/auth/service.test.ts

@@ -0,0 +1,200 @@
+import "vite-plus/test/config";
+
+import * as Effect from "effect/Effect";
+import * as Exit from "effect/Exit";
+import * as FileSystem from "effect/FileSystem";
+import * as Path from "effect/Path";
+import * as Schema from "effect/Schema";
+import { assert, describe, it } from "@effect/vitest";
+
+import { T3Auth } from "./service.ts";
+import { StoredConfigV2FileJson } from "../config/persist/schema.ts";
+import { ConfigPlatformLayer } from "../config/platform.test-utils.ts";
+import { makeTempHomeScoped } from "../config/temp-home.test-utils.ts";
+import { t3AuthDepsLayer } from "./layer.test-utils.ts";
+
+describe("T3Auth persistence", () => {
+  it.effect("fails to persist a duplicate environment without allowReplace", () =>
+    Effect.gen(function* () {
+      return yield* makeTempHomeScoped("t3cli-auth-");
+    }).pipe(
+      Effect.flatMap((homeDir) =>
+        Effect.gen(function* () {
+          const auth = yield* T3Auth;
+          yield* auth.persistEnvironment({
+            name: "work",
+            url: "https://work.example",
+            token: "work-token",
+            local: false,
+            allowReplace: true,
+          });
+          const result = yield* auth
+            .persistEnvironment({
+              name: "work",
+              url: "https://work.example",
+              token: "work-token-2",
+              local: false,
+              allowReplace: false,
+            })
+            .pipe(Effect.exit);
+          assert.equal(Exit.isFailure(result), true);
+        }).pipe(Effect.provide(t3AuthDepsLayer(homeDir))),
+      ),
+      Effect.provide(ConfigPlatformLayer),
+      Effect.scoped,
+    ),
+  );
+
+  it.effect("does not change default when replace is used for a new environment", () =>
+    Effect.gen(function* () {
+      return yield* makeTempHomeScoped("t3cli-auth-");
+    }).pipe(
+      Effect.flatMap((homeDir) =>
+        Effect.gen(function* () {
+          const auth = yield* T3Auth;
+          yield* auth.persistEnvironment({
+            name: "home",
+            url: "https://home.example",
+            token: "home-token",
+            local: false,
+            allowReplace: true,
+          });
+          yield* auth.persistEnvironment({
+            name: "work",
+            url: "https://work.example",
+            token: "work-token",
+            local: false,
+            replace: true,
+            allowReplace: true,
+          });
+          const listed = yield* auth.listEnvironments();
+          assert.equal(listed.find((environment) => environment.name === "home")?.default, true);
+          assert.equal(listed.find((environment) => environment.name === "work")?.default, false);
+        }).pipe(Effect.provide(t3AuthDepsLayer(homeDir))),
+      ),
+      Effect.provide(ConfigPlatformLayer),
+      Effect.scoped,
+    ),
+  );
+
+  it.effect("promotes default when replacing an existing environment with replace", () =>
+    Effect.gen(function* () {
+      return yield* makeTempHomeScoped("t3cli-auth-");
+    }).pipe(
+      Effect.flatMap((homeDir) =>
+        Effect.gen(function* () {
+          const auth = yield* T3Auth;
+          yield* auth.persistEnvironment({
+            name: "home",
+            url: "https://home.example",
+            token: "home-token",
+            local: false,
+            allowReplace: true,
+          });
+          yield* auth.persistEnvironment({
+            name: "work",
+            url: "https://work.example",
+            token: "work-token",
+            local: false,
+            allowReplace: true,
+          });
+          yield* auth.persistEnvironment({
+            name: "work",
+            url: "https://work.example",
+            token: "work-token-2",
+            local: false,
+            replace: true,
+            allowReplace: true,
+          });
+          const listed = yield* auth.listEnvironments();
+          assert.equal(listed.find((environment) => environment.name === "work")?.default, true);
+        }).pipe(Effect.provide(t3AuthDepsLayer(homeDir))),
+      ),
+      Effect.provide(ConfigPlatformLayer),
+      Effect.scoped,
+    ),
+  );
+
+  it.effect("lists environments without decrypting tokens", () =>
+    Effect.gen(function* () {
+      return yield* makeTempHomeScoped("t3cli-auth-");
+    }).pipe(
+      Effect.flatMap((homeDir) =>
+        Effect.gen(function* () {
+          const fs = yield* FileSystem.FileSystem;
+          const path = yield* Path.Path;
+          const configPath = path.join(homeDir, ".config", "t3cli", "config.json");
+
+          yield* Effect.gen(function* () {
+            const auth = yield* T3Auth;
+            yield* auth.persistEnvironment({
+              name: "home",
+              url: "https://home.example",
+              token: "home-token",
+              local: false,
+              allowReplace: true,
+            });
+            yield* auth.persistEnvironment({
+              name: "work",
+              url: "https://work.example",
+              token: "work-token",
+              local: false,
+              allowReplace: true,
+            });
+          }).pipe(Effect.provide(t3AuthDepsLayer(homeDir)));
+
+          const raw = yield* fs.readFileString(configPath);
+          const parsed = yield* Schema.decodeUnknownEffect(StoredConfigV2FileJson)(raw);
+          const homeEnvironment = parsed.environments.home;
+          assert.isDefined(homeEnvironment);
+          const corrupted = yield* Schema.encodeEffect(StoredConfigV2FileJson)({
+            ...parsed,
+            environments: {
+              ...parsed.environments,
+              home: {
+                ...homeEnvironment,
+                token: {
+                  ...homeEnvironment.token,
+                  tag: "AAAAAAAAAAAAAAAAAAAAAA==",
+                },
+              },
+            },
+          });
+          yield* fs.writeFileString(configPath, `${corrupted}\n`, { mode: 0o600 });
+
+          yield* Effect.gen(function* () {
+            const auth = yield* T3Auth;
+            const listed = yield* auth.listEnvironments();
+            assert.equal(listed.length, 2);
+            assert.equal(listed.find((environment) => environment.name === "home")?.active, true);
+          }).pipe(Effect.provide(t3AuthDepsLayer(homeDir)));
+        }),
+      ),
+      Effect.provide(ConfigPlatformLayer),
+      Effect.scoped,
+    ),
+  );
+
+  it.effect("resolves unpair target from encrypted default metadata", () =>
+    Effect.gen(function* () {
+      return yield* makeTempHomeScoped("t3cli-auth-");
+    }).pipe(
+      Effect.flatMap((homeDir) =>
+        Effect.gen(function* () {
+          const auth = yield* T3Auth;
+          yield* auth.persistEnvironment({
+            name: "home",
+            url: "https://home.example",
+            token: "home-token",
+            local: false,
+            allowReplace: true,
+          });
+          const target = yield* auth.resolveUnpairTarget({});
+          assert.equal(target, "home");
+        }).pipe(Effect.provide(t3AuthDepsLayer(homeDir))),
+      ),
+      Effect.provide(ConfigPlatformLayer),
+      Effect.scoped,
+    ),
+  );
+});

package/src/auth/service.ts

@@ -1,9 +1,19 @@
 import * as Context from "effect/Context";
 import type * as Effect from "effect/Effect";
 
-import type { AuthSessionState, AuthWebSocketTicketResult } from "./schema.ts";
+import type { AuthWebSocketTicketResult } from "./schema.ts";
 import type { AuthError } from "./error.ts";
-import type { AuthConfigInput, LocalAuthInput, LocalAuthResult, PairResult } from "./type.ts";
+import type {
+  AuthConfigInput,
+  AuthEnvironmentListItem,
+  AuthStatusResult,
+  AuthUnpairResult,
+  AuthUseResult,
+  LocalAuthInput,
+  LocalAuthResult,
+  PairResult,
+  PersistEnvironmentInput,
+} from "./type.ts";
 
 export class T3Auth extends Context.Service<
   T3Auth,
@@ -11,7 +21,21 @@ export class T3Auth extends Context.Service<
     readonly pair: (value: string) => Effect.Effect<PairResult, AuthError>;
     readonly local: (input: LocalAuthInput) => Effect.Effect<LocalAuthResult, AuthError>;
     readonly writeConfig: (input: AuthConfigInput) => Effect.Effect<void, AuthError>;
-    readonly status: () => Effect.Effect<AuthSessionState, AuthError>;
+    readonly persistEnvironment: (
+      input: PersistEnvironmentInput,
+    ) => Effect.Effect<string, AuthError>;
+    readonly environmentExists: (name: string) => Effect.Effect<boolean, AuthError>;
+    readonly defaultNameFromUrl: (url: string) => Effect.Effect<string, AuthError>;
+    readonly defaultNameForLocal: () => Effect.Effect<string, AuthError>;
+    readonly listEnvironments: () => Effect.Effect<readonly AuthEnvironmentListItem[], AuthError>;
+    readonly useEnvironment: (name: string) => Effect.Effect<AuthUseResult, AuthError>;
+    readonly unpairEnvironment: (input: {
+      readonly name: string;
+    }) => Effect.Effect<AuthUnpairResult, AuthError>;
+    readonly resolveUnpairTarget: (input: {
+      readonly name?: string;
+    }) => Effect.Effect<string, AuthError>;
+    readonly status: () => Effect.Effect<AuthStatusResult, AuthError>;
     readonly issueWebSocketTicket: () => Effect.Effect<AuthWebSocketTicketResult, AuthError>;
   }
 >()("t3cli/T3Auth") {}

package/src/auth/transport.ts

@@ -1,23 +1,19 @@
 import {
-  AuthAccessTokenType,
-  AuthEnvironmentBootstrapTokenType,
-  AuthTokenExchangeGrantType,
-} from "#t3tools/contracts";
+  bootstrapRemoteBearerSession,
+  fetchRemoteSessionState,
+  issueRemoteWebSocketTicket,
+} from "@t3tools/client-runtime/authorization";
 import * as Context from "effect/Context";
 import * as DateTime from "effect/DateTime";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
-import { HttpClient, HttpClientError, HttpClientRequest } from "effect/unstable/http";
+import { HttpClient } from "effect/unstable/http";
 
-import { toHttpEndpointUrl } from "../config/url.ts";
 import { AuthTransportError } from "./error.ts";
 import {
   type AuthBearerBootstrapResult,
-  decodeAuthAccessTokenResult,
   type AuthSessionState,
-  decodeAuthSessionState,
   type AuthWebSocketTicketResult,
-  decodeAuthWebSocketTicketResult,
 } from "./schema.ts";
 
 export type AuthTransportConnection = {
@@ -42,53 +38,25 @@ export class T3AuthTransport extends Context.Service<
 >()("t3cli/T3AuthTransport") {}
 
 const makeT3AuthTransport = Effect.fn("makeT3AuthTransport")(function* () {
-  const client = HttpClient.filterStatusOk(yield* HttpClient.HttpClient);
+  const httpClient = yield* HttpClient.HttpClient;
 
   const bootstrapBearer = Effect.fn("AuthTransport.bootstrapBearer")(function* (input: {
     readonly baseUrl: string;
     readonly credential: string;
   }) {
-    const url = yield* makeHttpEndpointUrl(input.baseUrl, "/oauth/token");
-    const request = HttpClientRequest.post(url).pipe(
-      HttpClientRequest.acceptJson,
-      HttpClientRequest.bodyUrlParams({
-        grant_type: AuthTokenExchangeGrantType,
-        subject_token: input.credential,
-        subject_token_type: AuthEnvironmentBootstrapTokenType,
-        requested_token_type: AuthAccessTokenType,
-      }),
-    );
-    const response = yield* client.execute(request).pipe(
-      Effect.catchTags({
-        HttpClientError: (error) =>
-          Effect.fail(
-            new AuthTransportError({
-              message: "auth request failed",
-              cause: HttpClientError.HttpClientErrorSchema.fromHttpClientError(error),
-            }),
-          ),
-      }),
-    );
-    const result = yield* response.json.pipe(
-      Effect.flatMap(decodeAuthAccessTokenResult),
-      Effect.catchTags({
-        HttpClientError: (error) =>
-          Effect.fail(
-            new AuthTransportError({
-              message: "auth request failed",
-              cause: HttpClientError.HttpClientErrorSchema.fromHttpClientError(error),
-            }),
-          ),
-        SchemaError: (error) =>
-          Effect.fail(
-            new AuthTransportError({ message: "auth response decode failed", cause: error }),
-          ),
-      }),
+    const result = yield* bootstrapRemoteBearerSession({
+      httpBaseUrl: input.baseUrl,
+      credential: input.credential,
+    }).pipe(
+      Effect.provideService(HttpClient.HttpClient, httpClient),
+      Effect.mapError(
+        (error) => new AuthTransportError({ message: "auth request failed", cause: error }),
+      ),
     );
     const now = yield* DateTime.now;
     return {
       authenticated: true,
-      role: result.scope.split(/\s+/u).includes("access:write") ? "owner" : "client",
+      role: inferRole(result.scope),
       sessionMethod: "bearer-access-token",
       expiresAt: DateTime.formatIso(DateTime.add(now, { seconds: result.expires_in })),
       sessionToken: result.access_token,
@@ -98,69 +66,41 @@ const makeT3AuthTransport = Effect.fn("makeT3AuthTransport")(function* () {
   const getSession = Effect.fn("AuthTransport.getSession")(function* (
     connection: AuthTransportConnection,
   ) {
-    const url = yield* makeHttpEndpointUrl(connection.url, "/api/auth/session");
-    const request = HttpClientRequest.get(url).pipe(authenticatedRequest(connection));
-    const response = yield* client.execute(request).pipe(
-      Effect.catchTags({
-        HttpClientError: (error) =>
-          Effect.fail(
-            new AuthTransportError({
-              message: "auth request failed",
-              cause: HttpClientError.HttpClientErrorSchema.fromHttpClientError(error),
-            }),
-          ),
-      }),
-    );
-    return yield* response.json.pipe(
-      Effect.flatMap(decodeAuthSessionState),
-      Effect.catchTags({
-        HttpClientError: (error) =>
-          Effect.fail(
-            new AuthTransportError({
-              message: "auth request failed",
-              cause: HttpClientError.HttpClientErrorSchema.fromHttpClientError(error),
-            }),
-          ),
-        SchemaError: (error) =>
-          Effect.fail(
-            new AuthTransportError({ message: "auth response decode failed", cause: error }),
-          ),
-      }),
+    const result = yield* fetchRemoteSessionState({
+      httpBaseUrl: connection.url,
+      bearerToken: connection.token,
+    }).pipe(
+      Effect.provideService(HttpClient.HttpClient, httpClient),
+      Effect.mapError(
+        (error) => new AuthTransportError({ message: "auth request failed", cause: error }),
+      ),
     );
+    return {
+      authenticated: result.authenticated,
+      ...(result.scopes !== undefined ? { role: inferRole(result.scopes.join(" ")) } : {}),
+      ...(result.sessionMethod !== undefined ? { sessionMethod: result.sessionMethod } : {}),
+      ...(result.expiresAt !== undefined
+        ? { expiresAt: DateTime.formatIso(result.expiresAt) }
+        : {}),
+    } satisfies AuthSessionState;
   });
 
   const issueWebSocketTicket = Effect.fn("AuthTransport.issueWebSocketTicket")(function* (
     connection: AuthTransportConnection,
   ) {
-    const url = yield* makeHttpEndpointUrl(connection.url, "/api/auth/websocket-ticket");
-    const request = HttpClientRequest.post(url).pipe(authenticatedRequest(connection));
-    const response = yield* client.execute(request).pipe(
-      Effect.catchTags({
-        HttpClientError: (error) =>
-          Effect.fail(
-            new AuthTransportError({
-              message: "auth request failed",
-              cause: HttpClientError.HttpClientErrorSchema.fromHttpClientError(error),
-            }),
-          ),
-      }),
-    );
-    return yield* response.json.pipe(
-      Effect.flatMap(decodeAuthWebSocketTicketResult),
-      Effect.catchTags({
-        HttpClientError: (error) =>
-          Effect.fail(
-            new AuthTransportError({
-              message: "auth request failed",
-              cause: HttpClientError.HttpClientErrorSchema.fromHttpClientError(error),
-            }),
-          ),
-        SchemaError: (error) =>
-          Effect.fail(
-            new AuthTransportError({ message: "auth response decode failed", cause: error }),
-          ),
-      }),
+    const result = yield* issueRemoteWebSocketTicket({
+      httpBaseUrl: connection.url,
+      bearerToken: connection.token,
+    }).pipe(
+      Effect.provideService(HttpClient.HttpClient, httpClient),
+      Effect.mapError(
+        (error) => new AuthTransportError({ message: "auth request failed", cause: error }),
+      ),
     );
+    return {
+      ticket: result.ticket,
+      expiresAt: DateTime.formatIso(result.expiresAt),
+    } satisfies AuthWebSocketTicketResult;
   });
 
   return {
@@ -172,15 +112,6 @@ const makeT3AuthTransport = Effect.fn("makeT3AuthTransport")(function* () {
 
 export const T3AuthTransportLive = Layer.effect(T3AuthTransport, makeT3AuthTransport());
 
-const authenticatedRequest =
-  (connection: AuthTransportConnection) => (request: HttpClientRequest.HttpClientRequest) =>
-    request.pipe(HttpClientRequest.acceptJson, HttpClientRequest.bearerToken(connection.token));
-
-function makeHttpEndpointUrl(baseUrl: string, path: string) {
-  return toHttpEndpointUrl(baseUrl, path).pipe(
-    Effect.catchTags({
-      UrlError: (error) =>
-        Effect.fail(new AuthTransportError({ message: "auth request failed", cause: error })),
-    }),
-  );
+function inferRole(scope: string): AuthBearerBootstrapResult["role"] {
+  return scope.split(/\s+/u).includes("access:write") ? "owner" : "client";
 }

package/src/auth/type.ts

@@ -1,4 +1,5 @@
 import type { AuthBearerBootstrapResult } from "./schema.ts";
+import type { AuthSessionState } from "./schema.ts";
 
 export type AuthSessionRole = AuthBearerBootstrapResult["role"];
 
@@ -8,9 +9,44 @@ export type PairingUrl = {
 };
 
 export type AuthConfigInput = {
+  readonly name: string;
   readonly url: string;
   readonly token: string;
-  readonly local?: boolean;
+  readonly local: boolean;
+  readonly makeDefault?: boolean;
+};
+
+export type PersistEnvironmentInput = {
+  readonly name: string;
+  readonly url: string;
+  readonly token: string;
+  readonly local: boolean;
+  readonly replace?: boolean;
+  readonly allowReplace: boolean;
+};
+
+export type AuthResolvedConfig = {
+  readonly url: string;
+  readonly token: string;
+  readonly source: "env" | "config";
+  readonly local: boolean;
+  readonly environment?: string;
+};
+
+export type AuthEnvironmentSummary = {
+  readonly name: string;
+  readonly url: string;
+  readonly local: boolean;
+  readonly default: boolean;
+};
+
+export type AuthStatusResult = {
+  readonly config: AuthResolvedConfig;
+  readonly session: AuthSessionState;
+};
+
+export type AuthEnvironmentListItem = AuthEnvironmentSummary & {
+  readonly active: boolean;
 };
 
 export type PairResult = {
@@ -51,3 +87,13 @@ export type LocalAuthResult = {
   readonly source: "local";
   readonly baseDir: string;
 };
+
+export type AuthUseResult = {
+  readonly name: string;
+  readonly default: true;
+};
+
+export type AuthUnpairResult = {
+  readonly name: string;
+  readonly removed: true;
+};