vaulter-cli 2.3.4 → 2.3.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/package.json +1 -1
  2. package/src/commands/sign-in.js +87 -93
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "vaulter-cli",
3
- "version": "2.3.4",
3
+ "version": "2.3.5",
4
4
  "description": "CLI tool for Vaulter - Secure API Key Manager",
5
5
  "author": "faris-sait",
6
6
  "repository": {
package/src/commands/sign-in.js CHANGED
@@ -1,107 +1,101 @@
1
- import http from 'http';
2
1
  import crypto from 'crypto';
3
2
  import open from 'open';
4
3
  import ora from 'ora';
5
- import { saveToken, getToken } from '../lib/auth.js';
4
+ import { saveToken } from '../lib/auth.js';
6
5
  import { getApiUrl } from '../lib/config.js';
7
6
  import { printLogo } from '../assets/logo.js';
8
7
  import { success, error, info } from '../lib/ui.js';
9
8
 
9
+ const POLL_INTERVAL_MS = 2000;
10
+ const TIMEOUT_MS = 120000;
11
+
12
+ function isSSH() {
13
+ return !!(process.env.SSH_CLIENT || process.env.SSH_TTY || process.env.SSH_CONNECTION);
14
+ }
15
+
10
16
  export async function signIn() {
17
+ const requestId = crypto.randomBytes(16).toString('hex');
11
18
  const state = crypto.randomBytes(16).toString('hex');
19
+ const apiUrl = getApiUrl();
20
+
21
+ // Register pending auth request on backend
22
+ const registerRes = await fetch(`${apiUrl}/api/cli/auth-request`, {
23
+ method: 'POST',
24
+ headers: { 'Content-Type': 'application/json' },
25
+ body: JSON.stringify({ request_id: requestId, state }),
26
+ });
27
+
28
+ if (!registerRes.ok) {
29
+ const data = await registerRes.json().catch(() => ({}));
30
+ error(`Failed to start authentication: ${data.error || registerRes.status}`);
31
+ return;
32
+ }
33
+
34
+ const authUrl = `${apiUrl}/cli-auth?request_id=${requestId}&state=${state}`;
35
+
36
+ console.log('');
37
+ if (isSSH()) {
38
+ info('Open this URL in your browser to authenticate:');
39
+ console.log(` ${authUrl}`);
40
+ } else {
41
+ info('Opening browser for authentication...');
42
+ info(`If the browser doesn't open, visit:`);
43
+ console.log(` ${authUrl}`);
44
+ open(authUrl);
45
+ }
46
+ console.log('');
47
+
48
+ const spinner = ora({
49
+ text: 'Waiting for browser authorization...',
50
+ color: 'magenta',
51
+ }).start();
12
52
 
13
- return new Promise((resolve) => {
14
- const server = http.createServer(async (req, res) => {
15
- const url = new URL(req.url, `http://localhost`);
16
-
17
- if (url.pathname === '/callback') {
18
- const token = url.searchParams.get('token');
19
- const returnedState = url.searchParams.get('state');
20
- const denied = url.searchParams.get('error');
21
-
22
- if (denied === 'denied') {
23
- res.writeHead(200, { 'Content-Type': 'text/html' });
24
- res.end('<html><body style="background:#0f172a;color:#c4b5fd;font-family:sans-serif;display:flex;align-items:center;justify-content:center;height:100vh;margin:0"><h2>Authorization denied. You can close this tab.</h2></body></html>');
25
- spinner.fail('Authorization denied.');
26
- server.close();
27
- resolve();
28
- return;
29
- }
30
-
31
- if (returnedState !== state) {
32
- res.writeHead(400, { 'Content-Type': 'text/html' });
33
- res.end('<html><body style="background:#0f172a;color:#ef4444;font-family:sans-serif;display:flex;align-items:center;justify-content:center;height:100vh;margin:0"><h2>State mismatch. Please try again.</h2></body></html>');
34
- spinner.fail('State mismatch - possible CSRF attack. Try again.');
35
- server.close();
36
- resolve();
37
- return;
38
- }
39
-
40
- if (token) {
41
- saveToken(token);
42
-
43
- // Verify the token works
44
- try {
45
- const verifyRes = await fetch(`${getApiUrl()}/api/keys`, {
46
- headers: { 'Authorization': `Bearer ${token}` },
47
- });
48
- if (!verifyRes.ok) throw new Error('Verification failed');
49
- } catch {
50
- res.writeHead(200, { 'Content-Type': 'text/html' });
51
- res.end('<html><body style="background:#0f172a;color:#ef4444;font-family:sans-serif;display:flex;align-items:center;justify-content:center;height:100vh;margin:0"><h2>Token verification failed. Please try again.</h2></body></html>');
52
- spinner.fail('Token verification failed.');
53
- server.close();
54
- resolve();
55
- return;
56
- }
57
-
58
- res.writeHead(200, { 'Content-Type': 'text/html' });
59
- res.end('<html><body style="background:#0f172a;color:#a78bfa;font-family:sans-serif;display:flex;align-items:center;justify-content:center;height:100vh;margin:0"><div style="text-align:center"><h2 style="color:#22c55e">Authenticated!</h2><p>You can close this tab and return to your terminal.</p></div></body></html>');
60
- spinner.succeed('Authenticated successfully!');
61
- await printLogo();
62
- success('You are now signed in to Vaulter.');
63
- info('Run `vaulter ls` to list your keys.');
64
- server.close();
65
- resolve();
66
- return;
67
- }
68
-
69
- res.writeHead(400, { 'Content-Type': 'text/html' });
70
- res.end('<html><body style="background:#0f172a;color:#ef4444;font-family:sans-serif;display:flex;align-items:center;justify-content:center;height:100vh;margin:0"><h2>Missing token. Please try again.</h2></body></html>');
71
- spinner.fail('No token received.');
72
- server.close();
73
- resolve();
53
+ const deadline = Date.now() + TIMEOUT_MS;
54
+
55
+ while (Date.now() < deadline) {
56
+ await new Promise((r) => setTimeout(r, POLL_INTERVAL_MS));
57
+
58
+ let pollData;
59
+ try {
60
+ const pollRes = await fetch(`${apiUrl}/api/cli/auth-request/${requestId}`);
61
+ pollData = await pollRes.json();
62
+ } catch {
63
+ // Network hiccup — keep polling
64
+ continue;
65
+ }
66
+
67
+ if (pollData.status === 'completed') {
68
+ const token = pollData.token;
69
+
70
+ // Verify the token works
71
+ try {
72
+ const verifyRes = await fetch(`${apiUrl}/api/keys`, {
73
+ headers: { Authorization: `Bearer ${token}` },
74
+ });
75
+ if (!verifyRes.ok) throw new Error('Verification failed');
76
+ } catch {
77
+ spinner.fail('Token verification failed. Please try again.');
74
78
  return;
75
79
  }
76
80
 
77
- res.writeHead(404);
78
- res.end('Not found');
79
- });
80
-
81
- server.listen(0, () => {
82
- const port = server.address().port;
83
- const authUrl = `${getApiUrl()}/cli-auth?port=${port}&state=${state}`;
84
-
85
- console.log('');
86
- info('Opening browser for authentication...');
87
- console.log('');
88
- info(`If the browser doesn't open, visit:`);
89
- console.log(` ${authUrl}`);
90
- console.log('');
91
-
92
- open(authUrl);
93
- });
94
-
95
- const spinner = ora({
96
- text: 'Waiting for browser authorization...',
97
- color: 'magenta',
98
- }).start();
99
-
100
- // 120 second timeout
101
- setTimeout(() => {
102
- spinner.fail('Authorization timed out (120s). Please try again.');
103
- server.close();
104
- resolve();
105
- }, 120000);
106
- });
81
+ saveToken(token);
82
+ spinner.succeed('Authenticated successfully!');
83
+ await printLogo();
84
+ success('You are now signed in to Vaulter.');
85
+ info('Run `vaulter ls` to list your keys.');
86
+ return;
87
+ }
88
+
89
+ if (pollData.status === 'denied') {
90
+ spinner.fail('Authorization denied.');
91
+ return;
92
+ }
93
+
94
+ if (pollData.status === 'expired') {
95
+ spinner.fail('Authorization request expired. Please try again.');
96
+ return;
97
+ }
98
+ }
99
+
100
+ spinner.fail('Authorization timed out (120s). Please try again.');
107
101
  }