vercel-vm-factory 0.1.0 → 0.1.2

package/README.md

@@ -6,6 +6,16 @@ Create a tiny Vercel Container deployment: copy `wsterm` from `ghcr.io/v1xingyue
 npx vercel-vm-factory create \
   --base ubuntu \
   --project ws-shell-ubuntu \
+  --auth-mode basic \
+  --auth-user admin \
+  --auth-password change-me
+```
+
+GitHub OAuth is optional:
+
+```bash
+npx vercel-vm-factory create \
+  --auth-mode github \
   --client-id YOUR_GITHUB_CLIENT_ID \
   --client-secret YOUR_GITHUB_CLIENT_SECRET \
   --github-userid 12345678
@@ -17,6 +27,8 @@ Run without flags for prompts:
 npx vercel-vm-factory create
 ```
 
+The prompt asks for authentication first: `basic`, `github`, `both`, or `none`, then only asks for the fields that mode needs.
+
 Check local setup:
 
 ```bash
@@ -27,7 +39,7 @@ The script checks `vercel --version` and `vercel whoami`; if you are not logged
 
 Use `--help` to show all flags.
 
-Entered GitHub values are reused from `~/.vercel-vm-factory/defaults.json`; press Enter to keep the placeholder value or skip an empty one.
+Entered auth values are reused from `~/.vercel-vm-factory/defaults.json`; press Enter to keep the placeholder value or skip an empty one.
 
 The generated project contains only `Dockerfile.vercel`.
 
@@ -56,4 +68,27 @@ Before deploying, set the GitHub OAuth callback URL to:
 https://PROJECT.vercel.app/auth/github/callback
 ```
 
+For example, if `--project x-shell`, set:
+
+```text
+https://x-shell.vercel.app/auth/github/callback
+```
+
+GitHub OAuth fields:
+
+- Auth mode -> `--auth-mode basic|github|both|none`
+- Username -> `--auth-user`
+- Password -> `--auth-password`
+- Client ID -> `--client-id`
+- Client Secret -> `--client-secret`
+- Numeric GitHub user ID -> `--github-userid`
+
+Get your numeric user ID:
+
+```text
+https://api.github.com/users/YOUR_LOGIN
+```
+
+The callback URL must match exactly. If you deploy under another project name or custom domain, update the GitHub OAuth App or pass `--redirect-url`.
+
 Use `--dry-run` to generate files without deploying.

package/deploy-vm.mjs

@@ -64,6 +64,7 @@ async function main() {
   const prod = args.prod !== "false";
   const dryRun = Boolean(args["dry-run"]);
   const skipLink = Boolean(args["skip-link"]);
+  const authMode = await chooseAuthMode(defaultAuthMode());
 
   const oauthRedirectUrl =
     args["redirect-url"] ??
@@ -83,7 +84,8 @@ async function main() {
     project,
     scope: scope || "default",
     source: wsShellImage,
-    callback: oauthRedirectUrl,
+    auth: authMode,
+    ...(usesGitHubAuth(authMode) ? { callback: oauthRedirectUrl } : {}),
     dockerfile: path.join(appDir, "Dockerfile.vercel"),
     target: prod ? "production" : "preview",
   });
@@ -94,14 +96,23 @@ async function main() {
   }
 
   await ensureVercelReady();
-
-  const githubClientId = await secret("client-id", "GitHub client id", process.env.GITHUB_CLIENT_ID ?? defaults["client-id"]);
-  const githubClientSecret = await secret(
-    "client-secret",
-    "GitHub client secret",
-    process.env.GITHUB_CLIENT_SECRET ?? defaults["client-secret"],
-  );
-  const allowedUserIds = await secret("github-userid", "Allowed GitHub numeric user id(s)", process.env.ALLOWED_USER_IDS ?? defaults["github-userid"]);
+  if (usesGitHubAuth(authMode)) printOAuthGuide(oauthRedirectUrl);
+
+  const authUsername = usesBasicAuth(authMode)
+    ? await secret("auth-user", "Basic auth username", process.env.AUTH_USERNAME ?? defaults["auth-user"])
+    : "";
+  const authPassword = usesBasicAuth(authMode)
+    ? await secret("auth-password", "Basic auth password", process.env.AUTH_PASSWORD ?? defaults["auth-password"])
+    : "";
+  const githubClientId = usesGitHubAuth(authMode)
+    ? await secret("client-id", "GitHub client id", process.env.GITHUB_CLIENT_ID ?? defaults["client-id"])
+    : "";
+  const githubClientSecret = usesGitHubAuth(authMode)
+    ? await secret("client-secret", "GitHub client secret", process.env.GITHUB_CLIENT_SECRET ?? defaults["client-secret"])
+    : "";
+  const allowedUserIds = usesGitHubAuth(authMode)
+    ? await secret("github-userid", "Allowed GitHub numeric user id(s)", process.env.ALLOWED_USER_IDS ?? defaults["github-userid"])
+    : "";
 
   await writeDefaults(defaultsPath, {
     ...defaults,
@@ -109,6 +120,9 @@ async function main() {
     scope: scope || undefined,
     project,
     from: wsShellImage,
+    "auth-mode": authMode,
+    "auth-user": authUsername,
+    "auth-password": authPassword,
     "client-id": githubClientId,
     "client-secret": githubClientSecret,
     "github-userid": allowedUserIds,
@@ -133,10 +147,11 @@ async function main() {
     appDir,
     "--yes",
     "--logs",
-    "--env",
-    `OAUTH_REDIRECT_URL=${oauthRedirectUrl}`,
   ];
 
+  if (authUsername) vercelArgs.push("--env", `AUTH_USERNAME=${authUsername}`);
+  if (authPassword) vercelArgs.push("--env", `AUTH_PASSWORD=${authPassword}`);
+  if (usesGitHubAuth(authMode)) vercelArgs.push("--env", `OAUTH_REDIRECT_URL=${oauthRedirectUrl}`);
   if (githubClientId) vercelArgs.push("--env", `GITHUB_CLIENT_ID=${githubClientId}`);
   if (githubClientSecret) vercelArgs.push("--env", `GITHUB_CLIENT_SECRET=${githubClientSecret}`);
   if (allowedUserIds) vercelArgs.push("--env", `ALLOWED_USER_IDS=${allowedUserIds}`);
@@ -192,6 +207,9 @@ async function doctor() {
   printKeyValue("project", defaults.project || "not set");
   printKeyValue("scope", defaults.scope || "not set");
   printKeyValue("source image", defaults.from || "ghcr.io/v1xingyue/ws-shell:v1.1.alpine");
+  printKeyValue("auth mode", defaults["auth-mode"] || "not set");
+  printKeyValue("auth user", defaults["auth-user"] ? mask(defaults["auth-user"]) : "not set");
+  printKeyValue("auth password", defaults["auth-password"] ? mask(defaults["auth-password"]) : "not set");
   printKeyValue("client id", defaults["client-id"] ? mask(defaults["client-id"]) : "not set");
   printKeyValue("client secret", defaults["client-secret"] ? mask(defaults["client-secret"]) : "not set");
   printKeyValue("github userid", defaults["github-userid"] ? mask(defaults["github-userid"]) : "not set");
@@ -247,6 +265,51 @@ async function optionalValue(name, question, fallback) {
   return answer;
 }
 
+function defaultAuthMode() {
+  if (args["auth-mode"]) return args["auth-mode"];
+  const hasBasic = Boolean(args["auth-user"] || args["auth-password"] || process.env.AUTH_USERNAME || process.env.AUTH_PASSWORD);
+  const hasGitHub = Boolean(args["client-id"] || args["client-secret"] || args["github-userid"] || process.env.GITHUB_CLIENT_ID || process.env.GITHUB_CLIENT_SECRET);
+  if (hasBasic && hasGitHub) return "both";
+  if (hasBasic) return "basic";
+  if (hasGitHub) return "github";
+  return defaults["auth-mode"] || (input.isTTY ? "basic" : "none");
+}
+
+async function chooseAuthMode(fallback) {
+  const modes = new Set(["basic", "github", "both", "none"]);
+  if (args["auth-mode"]) {
+    if (!modes.has(args["auth-mode"])) throw new Error("--auth-mode must be basic, github, both, or none");
+    return args["auth-mode"];
+  }
+  if (!input.isTTY) return modes.has(fallback) ? fallback : "basic";
+
+  console.log(color.bold("Choose authentication"));
+  console.log(`  ${color.cyan("1")}. basic username/password`);
+  console.log(`  ${color.cyan("2")}. GitHub OAuth`);
+  console.log(`  ${color.cyan("3")}. both`);
+  console.log(`  ${color.cyan("4")}. none`);
+
+  const rl = createInterface({ input, output });
+  const answer = (await rl.question(`Authentication [${fallback}]: `)).trim();
+  rl.close();
+
+  if (!answer) return modes.has(fallback) ? fallback : "basic";
+  if (modes.has(answer)) return answer;
+  if (answer === "1") return "basic";
+  if (answer === "2") return "github";
+  if (answer === "3") return "both";
+  if (answer === "4") return "none";
+  throw new Error("Authentication must be basic, github, both, or none");
+}
+
+function usesBasicAuth(mode) {
+  return mode === "basic" || mode === "both";
+}
+
+function usesGitHubAuth(mode) {
+  return mode === "github" || mode === "both";
+}
+
 async function chooseBase(fallback) {
   if (args.base) return args.base;
   if (!input.isTTY) return fallback;
@@ -381,6 +444,15 @@ function printSummary(items) {
   console.log("");
 }
 
+function printOAuthGuide(callbackUrl) {
+  console.log(color.bold("GitHub OAuth"));
+  console.log(`${color.yellow("!")} Set this callback URL in your GitHub OAuth App before deploying:`);
+  console.log(`  ${color.bold(callbackUrl)}`);
+  console.log(color.dim("  GitHub: Settings -> Developer settings -> OAuth Apps -> Authorization callback URL"));
+  console.log(color.dim("  User ID: open https://api.github.com/users/YOUR_LOGIN and copy the numeric id"));
+  console.log("");
+}
+
 function printKeyValue(key, value) {
   console.log(`${color.dim(`${key.padEnd(14)} `)}${value}`);
 }
@@ -414,6 +486,9 @@ Options:
   --project NAME       Vercel project name
   --scope SLUG         Optional Vercel team/user scope slug
   --from IMAGE         Source image for /app/bin/wsterm
+  --auth-mode MODE     basic, github, both, or none
+  --auth-user VALUE    Username/password auth user
+  --auth-password VAL  Username/password auth password
   --client-id VALUE    GitHub OAuth client id
   --client-secret VAL  GitHub OAuth client secret
   --github-userid VAL  Allowed GitHub numeric user id(s)
@@ -423,5 +498,9 @@ Options:
   --dry-run            Generate Dockerfile.vercel only
   --doctor             Check Vercel CLI/login and saved defaults
   --help               Show this help
+
+GitHub OAuth:
+  Callback URL must match the deployed project:
+  https://PROJECT.vercel.app/auth/github/callback
 `);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vercel-vm-factory",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Create Vercel Container deployments for ws-shell from selectable base images.",
   "license": "MIT",
   "type": "module",