wldx-cli 0.1.1 → 1.1.0

package/src/auth.mjs

@@ -1,128 +0,0 @@
-// The Wildix login of the user, shared with the wildix-auth agent skill: one file per account in
-// $WILDIX_CONFIG_DIR/tokens (default ~/.wildix/tokens), named <e-mail with @ as _at_>.prod.json, holding the Cognito
-// set {IdToken, AccessToken, RefreshToken, ExpiresIn, email, savedAt}. An expired IdToken is renewed with the
-// RefreshToken and written back in the same format, so the skill and the CLI keep using one session.
-//
-// The token is never printed and never put on a command line or into the environment of a child process.
-import crypto from 'node:crypto';
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import {AuthError} from './errors.mjs';
-import {USER_AGENT} from './version.mjs';
-
-export const CLIENT_ID = '2un9vsk5ghu0ocurajqe4a6l1e';
-export const COGNITO_URL = 'https://cognito-idp.eu-central-1.amazonaws.com/';
-const RENEW_EARLY_MS = 60_000;
-export const LOGIN_HINT = 'Log in with the wildix-auth agent skill (npx skills add gorets/wildix-skills -s wildix-auth); `wx login` is not there yet.';
-
-export const configDir = (env = process.env) => env.WILDIX_CONFIG_DIR || path.join(os.homedir(), '.wildix');
-export const tokensDir = (env = process.env) => path.join(configDir(env), 'tokens');
-
-// The e-mail becomes part of a file name: letters, digits and . _ % + - @ only, no "..".
-export function tokenFile(email, env = process.env) {
-  if (!/^[A-Za-z0-9._%+@-]+$/.test(email) || email.includes('..')) throw new AuthError(`Not a valid e-mail: ${email}`);
-  return path.join(tokensDir(env), `${email.replace(/@/g, '_at_')}.prod.json`);
-}
-
-function readJson(file) {
-  try {
-    return JSON.parse(fs.readFileSync(file, 'utf8'));
-  } catch {
-    return undefined;
-  }
-}
-
-export function jwtClaims(token) {
-  try {
-    return JSON.parse(Buffer.from(String(token).split('.')[1], 'base64url').toString('utf8'));
-  } catch {
-    return {};
-  }
-}
-
-// When the IdToken of a saved set stops being valid, in ms: its `exp` claim, else savedAt + ExpiresIn, else 0.
-export function expiresAt(set) {
-  const exp = jwtClaims(set?.IdToken).exp;
-  if (Number.isFinite(exp)) return exp * 1000;
-  const saved = Date.parse(set?.savedAt ?? '');
-  return Number.isFinite(saved) && Number.isFinite(set?.ExpiresIn) ? saved + set.ExpiresIn * 1000 : 0;
-}
-
-// The saved sessions: [{email, expiresAt}], never the tokens.
-export function sessions(env = process.env) {
-  const dir = tokensDir(env);
-  let names;
-  try {
-    names = fs.readdirSync(dir).filter((n) => n.endsWith('.prod.json')).sort();
-  } catch {
-    return [];
-  }
-  return names
-    .map((n) => readJson(path.join(dir, n)))
-    .filter((set) => typeof set?.email === 'string')
-    .map((set) => ({email: set.email, expiresAt: expiresAt(set)}));
-}
-
-// Which account: --account, else WILDIX_EMAIL, else the only saved session.
-export function pickAccount(env = process.env, account) {
-  const email = account || env.WILDIX_EMAIL;
-  if (email) return email;
-  const list = sessions(env);
-  if (!list.length) throw new AuthError(`Not logged in to Wildix. ${LOGIN_HINT}`);
-  if (list.length > 1) {
-    throw new AuthError(`Several Wildix accounts are logged in. Pick one with --account or WILDIX_EMAIL:\n${list.map((s) => `  ${s.email}`).join('\n')}`);
-  }
-  return list[0].email;
-}
-
-// The format of the skill: whole seconds, no milliseconds (its bash parses it with `date -f %Y-%m-%dT%H:%M:%SZ`).
-export const stamp = (ms) => new Date(ms).toISOString().replace(/\.\d{3}Z$/, 'Z');
-
-// Writes a token set privately (0600) and atomically; a set without IdToken, RefreshToken and ExpiresIn is refused.
-export function saveTokens(file, set) {
-  if (typeof set?.IdToken !== 'string' || typeof set?.RefreshToken !== 'string' || typeof set?.ExpiresIn !== 'number') {
-    throw new AuthError('The answer carried no complete set of tokens: nothing was saved.');
-  }
-  const dir = path.dirname(file);
-  fs.mkdirSync(dir, {recursive: true, mode: 0o700});
-  const tmp = path.join(dir, `.${path.basename(file)}.${crypto.randomBytes(6).toString('hex')}`);
-  fs.writeFileSync(tmp, `${JSON.stringify(set, null, 2)}\n`, {mode: 0o600, flag: 'wx'});
-  fs.renameSync(tmp, file);
-}
-
-async function renew(email, set, {env, fetchImpl, now}) {
-  const res = await fetchImpl(COGNITO_URL, {
-    method: 'POST',
-    headers: {
-      'user-agent': USER_AGENT,
-      'content-type': 'application/x-amz-json-1.1',
-      'cache-control': 'no-store',
-      'x-amz-target': 'AWSCognitoIdentityProviderService.InitiateAuth',
-    },
-    body: JSON.stringify({AuthFlow: 'REFRESH_TOKEN_AUTH', ClientId: CLIENT_ID, AuthParameters: {REFRESH_TOKEN: set.RefreshToken}, ClientMetadata: {}}),
-    redirect: 'error',
-    signal: AbortSignal.timeout(30_000),
-  });
-  const body = await res.json().catch(() => ({}));
-  const result = body?.AuthenticationResult;
-  if (!res.ok || body?.__type || typeof result?.IdToken !== 'string') {
-    throw new AuthError(`The session of ${email} could not be renewed (${body?.message || body?.__type || `HTTP ${res.status}`}). ${LOGIN_HINT}`);
-  }
-  // Cognito does not send a new RefreshToken on a refresh: the saved one is kept.
-  const next = {...result, email, savedAt: stamp(now), RefreshToken: set.RefreshToken, ExpiresIn: result.ExpiresIn ?? set.ExpiresIn};
-  saveTokens(tokenFile(email, env), next);
-  return next;
-}
-
-// A valid IdToken of the account: WILDIX_ID_TOKEN as given (tests, CI), else the saved session, renewed when it
-// expires within a minute.
-export async function getToken({account, env = process.env, fetchImpl = globalThis.fetch, now = Date.now()} = {}) {
-  if (env.WILDIX_ID_TOKEN) return env.WILDIX_ID_TOKEN;
-  const email = pickAccount(env, account);
-  const set = readJson(tokenFile(email, env));
-  if (typeof set?.IdToken !== 'string') throw new AuthError(`No saved session for ${email}. ${LOGIN_HINT}`);
-  if (expiresAt(set) - RENEW_EARLY_MS > now) return set.IdToken;
-  if (typeof set.RefreshToken !== 'string') throw new AuthError(`The session of ${email} has expired. ${LOGIN_HINT}`);
-  return (await renew(email, set, {env, fetchImpl, now})).IdToken;
-}

package/src/commands/auth.mjs

@@ -1,32 +0,0 @@
-// wx auth: the saved Wildix sessions (shared with the wildix-auth agent skill). Never prints a token.
-import {AuthError} from '../errors.mjs';
-import {pickAccount, sessions} from '../auth.mjs';
-
-export default {
-  summary: 'the Wildix accounts you are logged in with',
-  commands: {
-    status: {
-      summary: 'saved sessions, which one is used and until when its token is valid (no network)',
-      usage: 'wx auth status',
-      options: {},
-      args: [0, 0],
-      async run({values, env, now}) {
-        let account = null;
-        try {
-          account = pickAccount(env, values.account);
-        } catch (e) {
-          if (!(e instanceof AuthError)) throw e;
-        }
-        return {
-          account,
-          tokenFromEnvironment: Boolean(env.WILDIX_ID_TOKEN),
-          sessions: sessions(env).map((s) => ({
-            email: s.email,
-            tokenValidUntil: s.expiresAt ? new Date(s.expiresAt).toISOString() : null,
-            expired: s.expiresAt <= now,
-          })),
-        };
-      },
-    },
-  },
-};

package/src/completion.mjs

@@ -1,105 +0,0 @@
-// Shell completion. `wx completion <shell>` prints a small script; on every Tab it runs
-// `wx __complete -- <words after wx, the last one being the word under the cursor>`, which prints the candidates,
-// one per line as "value<TAB>description". The candidates come from the command definitions (and the saved
-// accounts for --account), so completion follows the commands without a regenerated script. No network.
-import {sessions} from './auth.mjs';
-import {COMMON_OPTIONS, GROUPS, commandOf, groupOf} from './commands/index.mjs';
-
-export const SHELLS = ['bash', 'zsh', 'fish'];
-
-export const TOP_LEVEL = {
-  completion: 'print the shell completion script (bash, zsh, fish)',
-};
-
-const TOP_OPTIONS = {'--help': 'help of wx', '--version': 'the version of wx'};
-
-function valuesOf(option, env) {
-  if (option.choices) return option.choices.map((v) => [v]);
-  if (option.complete === 'accounts') return sessions(env).map((s) => [s.email]);
-  return [];
-}
-
-// The candidates for the word under the cursor: ["value\tdescription", ...].
-export function complete(words, env = process.env) {
-  const cur = words.length ? words[words.length - 1] : '';
-  const done = words.slice(0, -1);
-  const offer = (pairs) => pairs.filter(([v]) => v.startsWith(cur)).map(([v, d]) => (d ? `${v}\t${d}` : v));
-
-  if (done.length === 0) {
-    return offer([
-      ...Object.entries(GROUPS).map(([name, g]) => [name, g.summary]),
-      ...Object.entries(TOP_LEVEL),
-      ...(cur.startsWith('-') ? Object.entries(TOP_OPTIONS) : []),
-    ]);
-  }
-  if (done[0] === 'completion') return done.length === 1 ? offer(SHELLS.map((s) => [s, `the script for ${s}`])) : [];
-
-  const group = groupOf(done[0]);
-  if (!group) return [];
-  if (done.length === 1) return offer(Object.entries(group.commands).map(([name, cmd]) => [name, cmd.summary]));
-
-  const cmd = commandOf(group, done[1]);
-  if (!cmd) return [];
-  const options = {...cmd.options, ...COMMON_OPTIONS};
-  const prev = done[done.length - 1];
-  if (done.length > 2 && prev.startsWith('--')) {
-    const option = Object.hasOwn(options, prev.slice(2)) ? options[prev.slice(2)] : undefined;
-    if (option?.type === 'string') return offer(valuesOf(option, env));
-  }
-  if (cur.startsWith('-')) {
-    const used = new Set(done.slice(2).filter((w) => w.startsWith('--')).map((w) => w.slice(2)));
-    return offer(Object.entries(options).filter(([name, o]) => o.multiple || !used.has(name)).map(([name, o]) => [`--${name}`, o.description]));
-  }
-  return [];
-}
-
-const SCRIPTS = {
-  bash: `# wx completion for bash. Add to ~/.bashrc:  eval "$(wx completion bash)"
-_wx_complete() {
-  # The words are taken before IFS changes: bash 3.2 (macOS) joins the elements of a quoted array slice when IFS
-  # is a newline.
-  local words=("\${COMP_WORDS[@]:1:COMP_CWORD}") out line
-  COMPREPLY=()
-  out=$(wx __complete -- "\${words[@]}" 2>/dev/null) || return 0
-  local IFS=$'\\n'
-  for line in $out; do
-    COMPREPLY+=("\${line%%$'\\t'*}")
-  done
-}
-complete -F _wx_complete wx
-`,
-  zsh: `# wx completion for zsh. Add to ~/.zshrc (after compinit):  eval "$(wx completion zsh)"
-_wx() {
-  local -a lines items
-  local line
-  lines=("\${(@f)$(wx __complete -- "\${(@)words[2,CURRENT]}" 2>/dev/null)}")
-  for line in $lines; do
-    [[ -n $line ]] || continue
-    if [[ $line == *$'\\t'* ]]; then items+=("\${\${line%%$'\\t'*}//:/\\\\:}:\${line#*$'\\t'}")
-    else items+=("\${line//:/\\\\:}"); fi
-  done
-  (( \${#items} )) && _describe -t wx-candidates 'wx' items
-}
-(( \${+functions[compdef]} )) || { autoload -Uz compinit && compinit; }
-compdef _wx wx
-`,
-  fish: `# wx completion for fish. Save as ~/.config/fish/completions/wx.fish:  wx completion fish > ~/.config/fish/completions/wx.fish
-complete -c wx -f -a '(wx __complete -- (commandline -opc)[2..-1] (commandline -ct) 2>/dev/null)'
-`,
-};
-
-export function completionScript(shell) {
-  return Object.hasOwn(SCRIPTS, shell) ? SCRIPTS[shell] : undefined;
-}
-
-export function completionUsage() {
-  return [
-    'Usage: wx completion [bash|zsh|fish]   (default: the shell of $SHELL)',
-    '',
-    'Prints the completion script. To turn completion on for good:',
-    '  bash:  echo \'eval "$(wx completion bash)"\' >> ~/.bashrc',
-    '  zsh:   echo \'eval "$(wx completion zsh)"\' >> ~/.zshrc',
-    '  fish:  wx completion fish > ~/.config/fish/completions/wx.fish',
-    'then open a new terminal. It completes an installed `wx` (npm i -g wldx-cli), not `npx wldx-cli`.',
-  ].join('\n');
-}

package/src/errors.mjs

@@ -1,30 +0,0 @@
-// Errors that map to exit codes: UsageError 64 (EX_USAGE), AuthError 2, anything else 1.
-
-export class UsageError extends Error {
-  constructor(message, usage) {
-    super(message);
-    this.name = 'UsageError';
-    this.usage = usage;
-  }
-}
-
-export class AuthError extends Error {
-  constructor(message) {
-    super(message);
-    this.name = 'AuthError';
-  }
-}
-
-const NOT_IMPLEMENTED = /is not implemented/;
-
-export class HttpError extends Error {
-  constructor(status, method, path, body, service = 'the service') {
-    const lines = [`HTTP ${status} from ${service} (${method} ${path})`];
-    if (body) lines.push(body.length > 2000 ? `${body.slice(0, 2000)}…` : body);
-    if (status === 401) lines.push('The token was rejected: log in again.');
-    if (NOT_IMPLEMENTED.test(body ?? '')) lines.push('The service does not implement this operation yet. Do not retry.');
-    super(lines.join('\n'));
-    this.name = 'HttpError';
-    this.status = status;
-  }
-}

package/src/http.mjs

@@ -1,47 +0,0 @@
-import {HttpError} from './errors.mjs';
-import {USER_AGENT} from './version.mjs';
-
-const SEGMENT = /^[A-Za-z0-9_+][A-Za-z0-9_.:+-]*$/;
-
-// A tagged template for request paths: every interpolated value is one path segment of id characters (no "/",
-// "?", "#", "..", nothing empty), so an id taken from fetched data cannot rewrite the path.
-//   apiPath`/channels/${id}/messages`
-export function apiPath(strings, ...values) {
-  return strings.reduce((out, s, i) => {
-    if (i === 0) return s;
-    const v = String(values[i - 1] ?? '');
-    if (!SEGMENT.test(v) || v.includes('..')) throw new Error(`An id is not safe in a request path: ${JSON.stringify(v)}`);
-    return out + encodeURIComponent(v) + s;
-  }, '');
-}
-
-// "?a=1&b=2" from an object; undefined, null, false and '' are left out.
-export function query(params) {
-  const q = new URLSearchParams();
-  for (const [k, v] of Object.entries(params)) if (v !== undefined && v !== null && v !== false && v !== '') q.append(k, String(v));
-  const s = q.toString();
-  return s ? `?${s}` : '';
-}
-
-// One JSON request. Redirects are refused, so the token never follows one to another host. Returns the parsed
-// answer, or {ok: true} when it is empty; throws HttpError on a status other than 2xx.
-export async function request(url, {method = 'GET', token, body, service, fetchImpl = globalThis.fetch, timeoutMs = 60_000} = {}) {
-  const headers = {'user-agent': USER_AGENT, accept: 'application/json'};
-  if (token) headers.authorization = `Bearer ${token}`;
-  if (body !== undefined) headers['content-type'] = 'application/json';
-  const res = await fetchImpl(url, {
-    method,
-    headers,
-    body: body === undefined ? undefined : JSON.stringify(body),
-    redirect: 'error',
-    signal: AbortSignal.timeout(timeoutMs),
-  });
-  const text = await res.text();
-  if (!res.ok) throw new HttpError(res.status, method, new URL(url).pathname, text, service);
-  if (!text) return {ok: true};
-  try {
-    return JSON.parse(text);
-  } catch {
-    return {text};
-  }
-}