ymmv-cli 0.10.0 → 0.11.0

package/README.md

@@ -70,15 +70,18 @@ Every profile is open JSON too: `GET https://ymmv.fyi/api/v1/u/<handle>`. Full c
 - `NO_COLOR` disables color output (and `FORCE_COLOR=0`/`false` force-disables it).
 - `YMMV_API` points the CLI at a different Worker (development/staging). Bare origin only. That
   Worker must be deployed with or after this CLI release: `ymmv login` requires the account id the
-  login response carries and refuses (revoking what it minted) otherwise.
+  login response carries and refuses (revoking what it minted) otherwise, and `YMMV_TOKEN` needs
+  the server's account lookup.
 - `YMMV_TOKEN` authenticates without a browser (CI and scripts, below). Takes precedence over
   the stored login and is read-only: the CLI never writes, revokes, or deletes it, and
-  `ymmv login` / `ymmv logout` keep acting on the stored login. Viewing (`ymmv <handle>`) also
-  keeps using the stored login for the you-side of a diff. The token is sent to the server
-  `YMMV_API` selects, so set the two together.
-- `YMMV_HANDLE` names the GitHub username `YMMV_TOKEN` belongs to. Required for `ymmv -y` and
-  `ymmv set`/`unset` under an env token (there is no server lookup for it); ignored without
-  `YMMV_TOKEN`.
+  `ymmv login` / `ymmv logout` keep acting on the stored login. The CLI asks the server which
+  account the token belongs to, so every command, including the you-side of a `ymmv <handle>`
+  diff, runs as that account. The token is sent to the server `YMMV_API` selects, so set the
+  two together.
+- `YMMV_HANDLE` is optional. When set, it must name the GitHub username `YMMV_TOKEN` belongs
+  to: if the server reports a different account, `ymmv -y`, `ymmv set`/`unset`, and
+  `ymmv delete` refuse before sending anything, and `ymmv <handle>` shows the profile without
+  a diff. Ignored without `YMMV_TOKEN`.
 - `YMMV_NO_UPDATE_CHECK` disables the startup check for newer releases (the ecosystem-standard
   `NO_UPDATE_NOTIFIER` works too). The check is also off automatically under `CI`, in pipes,
   and in dev builds; it never blocks or fails a command.
@@ -91,7 +94,8 @@ Every profile is open JSON too: `GET https://ymmv.fyi/api/v1/u/<handle>`. Full c
 2. Copy the `token` value from the token file:
    `~/.config/ymmv/token.json` (Linux), `~/Library/Preferences/ymmv/token.json` (macOS),
    `%APPDATA%\ymmv\Config\token.json` (Windows).
-3. Set it as a CI secret named `YMMV_TOKEN`, and set `YMMV_HANDLE` to your GitHub username.
+3. Set it as a CI secret named `YMMV_TOKEN`. Setting `YMMV_HANDLE` to your GitHub username is
+   optional, and makes the job fail if the secret ever holds another account's token.
 4. Run `npx ymmv-cli@latest -y` in the job.
 
 Two things to know:
@@ -100,9 +104,12 @@ Two things to know:
   runs on. Values you already published always win, but curated keys you have never set get the
   CI runner's detected values (its OS, shell, and so on). For targeted updates from CI, prefer
   `ymmv set <key> <value>`.
-- A rejected or revoked `YMMV_TOKEN` fails with an error naming the variable; nothing falls back
-  to an interactive login, and the stored login file on the runner (if any) is left untouched.
-  `ymmv delete` acts on the account the token is bound to, regardless of `YMMV_HANDLE`.
+- A rejected or revoked `YMMV_TOKEN` fails `ymmv -y`, `ymmv set`/`unset`, and `ymmv delete` with
+  an error naming the variable; nothing falls back to an interactive login, and the stored login
+  file on the runner (if any) is left untouched. `ymmv <handle>` still shows the profile, with the
+  reason there is no diff on stderr, and exits 0.
+  `ymmv delete` acts on the account the token is bound to and names that account's page when
+  it asks for confirmation.
 
 ## License
 

package/dist/cli.js

@@ -684,6 +684,17 @@ async function bodyJson(res) {
     return null;
   }
 }
+var ENV_TOKEN_REJECTED = "The server rejected the token in YMMV_TOKEN (invalid or revoked).";
+var ENV_TOKEN_REJECTED_MINT_AGAIN = `${ENV_TOKEN_REJECTED} Mint a new one with \`ymmv login\` on an interactive machine and update YMMV_TOKEN.`;
+function parseIdentity(data) {
+  if (typeof data !== "object" || data === null) return null;
+  const { handle: rawHandle, github_id: id } = data;
+  const handle = rawHandle === null ? null : typeof rawHandle === "string" ? sanitizeValue(rawHandle) : void 0;
+  if (handle === void 0 || handle !== null && !isValidHandle(handle) || !isGithubId(id)) {
+    return null;
+  }
+  return { github_id: id, handle };
+}
 var MintRejected = class extends Error {
   constructor(msg) {
     super(msg);
@@ -734,8 +745,8 @@ async function mintYmmvToken(accessToken) {
   const unexpected = `Unexpected response from ${BASE}. Nothing was saved; run \`ymmv login\` again.`;
   if (!data) throw new Error(unexpected);
   const token = typeof data.token === "string" && data.token.length > 0 ? data.token : null;
-  const handle = data.handle === null ? null : typeof data.handle === "string" ? sanitizeValue(data.handle) : void 0;
-  if (token === null || handle === void 0 || handle !== null && !isValidHandle(handle) || !isGithubId(data.github_id)) {
+  const identity = parseIdentity(data);
+  if (token === null || identity === null) {
     let revokeFailed = false;
     if (token !== null) {
       await revokeYmmvToken(token, AbortSignal.timeout(REVOKE_CAP_MS)).catch(() => {
@@ -746,7 +757,38 @@ async function mintYmmvToken(accessToken) {
       revokeFailed ? `${unexpected} The login the server minted could not be revoked.` : unexpected
     );
   }
-  return { token, handle, github_id: data.github_id };
+  return { token, ...identity };
+}
+async function fetchWhoami(token) {
+  const res = await safeFetch(
+    `${BASE}/api/v1/auth/whoami`,
+    {
+      headers: { authorization: `Bearer ${token}` },
+      // Never follow a redirect: the bearer must not travel to a redirect target, and a 30x→200
+      // must not read as a verified identity. Same guard as mint, logout, publish, and delete.
+      redirect: "manual"
+    },
+    BASE
+  );
+  if (!res.ok) {
+    if (res.status === 401) throw new Error(ENV_TOKEN_REJECTED_MINT_AGAIN);
+    if (res.status === 404) {
+      throw new Error(
+        `${BASE} has no identity lookup for YMMV_TOKEN. ${process.env.YMMV_API ? "Point YMMV_API at an up-to-date server." : "The server is behind this CLI release; try again later."}`
+      );
+    }
+    throw new Error(
+      withRetryHint(
+        await serverMessage(res) ?? (res.status === 429 ? "rate limited, too many requests" : `The server couldn't look up your token (${res.status}). Try again shortly.`),
+        res
+      )
+    );
+  }
+  const identity = parseIdentity(await bodyJson(res));
+  if (!identity) {
+    throw new Error(`Unexpected response from ${BASE}. Check YMMV_API, or try again shortly.`);
+  }
+  return identity;
 }
 async function revokeYmmvToken(token, signal) {
   const res = await safeFetch(
@@ -1016,8 +1058,14 @@ var PublishRefusal = class extends Error {
     this.name = "PublishRefusal";
   }
 };
-var ENV_TOKEN_REJECTED = "The server rejected the token in YMMV_TOKEN (revoked or expired).";
 var NOT_PERSISTED = "Login did not persist a token. Run `ymmv login`.";
+function assertVerified(cred) {
+  if (cred.source === "env" && cred.github_id === null) {
+    throw new PublishRefusal(
+      "Internal error: the YMMV_TOKEN credential was not verified. This is a ymmv-cli bug; please report it at https://github.com/ymmv-fyi/ymmv/issues."
+    );
+  }
+}
 async function rateLimitMessage(res) {
   return withRetryHint(await serverMessage(res) ?? "rate limited, too many requests", res);
 }
@@ -1032,9 +1080,20 @@ async function loginOrRefuse() {
   if (!fresh) throw new PublishRefusal(NOT_PERSISTED);
   return fresh;
 }
+async function verifyEnvCredential(cred) {
+  const identity = await fetchWhoami(cred.token);
+  const claimed = cred.handle;
+  if (claimed !== null && claimed.toLowerCase() !== identity.handle?.toLowerCase()) {
+    const shown = `YMMV_HANDLE is "${sanitizeValue(claimed)}"`;
+    throw new Error(
+      identity.handle === null ? `${shown} but the YMMV_TOKEN account has no handle bound.` : `${shown} but YMMV_TOKEN belongs to "${identity.handle}". Fix or unset YMMV_HANDLE.`
+    );
+  }
+  return { ...cred, handle: identity.handle, github_id: identity.github_id };
+}
 async function ensureLogin() {
   const existing = await loadCredential();
-  if (existing) return existing;
+  if (existing) return existing.source === "env" ? verifyEnvCredential(existing) : existing;
   await login();
   const fresh = await loadCredential();
   if (!fresh) throw new Error(NOT_PERSISTED);
@@ -1054,11 +1113,13 @@ async function publishProfile(profile, expected) {
     },
     BASE
   );
-  let cred = await loadCredential();
+  assertVerified(expected);
+  let cred = expected.source === "env" ? expected : await loadCredential();
   if (!cred) {
     console.log(message("Not logged in. Logging in to publish."));
     cred = await loginOrRefuse();
   }
+  assertVerified(cred);
   const idDrifted = expected.source === "file" && (expected.github_id === null ? cred.github_id !== null : cred.github_id !== expected.github_id);
   if ((cred.handle ?? "").toLowerCase() !== profile.handle.toLowerCase() || idDrifted) {
     throw new PublishRefusal(
@@ -1069,7 +1130,11 @@ async function publishProfile(profile, expected) {
   if (res.status === 401 || res.status === 409) {
     if (cred.source === "env") {
       throw new PublishRefusal(
-        res.status === 401 ? `${ENV_TOKEN_REJECTED} Mint a new one with \`ymmv login\` on an interactive machine and update YMMV_TOKEN.` : "The server no longer accepts this handle for the YMMV_TOKEN account. Update YMMV_HANDLE, or mint a fresh token with `ymmv login`."
+        res.status === 401 ? ENV_TOKEN_REJECTED_MINT_AGAIN : (
+          // The handle came from whoami moments ago, so a 409 means the bind changed in between
+          // (a re-login on another machine after a GitHub rename). A fresh run looks it up again.
+          "The server no longer accepts this handle for the YMMV_TOKEN account. Re-run the command."
+        )
       );
     }
     const was401 = res.status === 401;
@@ -1143,6 +1208,7 @@ async function fetchProfileJson(handle) {
   return parseProfile(await res.json());
 }
 async function deleteProfile(cred) {
+  assertVerified(cred);
   const res = await safeFetch(
     `${BASE}/api/v1/profile`,
     {
@@ -1529,16 +1595,16 @@ function requireHandle(cred) {
   if (cred.handle) return cred.handle;
   console.error(
     message(
-      cred.source === "env" ? "YMMV_TOKEN is set but YMMV_HANDLE is not. Set YMMV_HANDLE to the GitHub username the token belongs to." : "Your GitHub username is a reserved word, so no handle is bound. Rename on GitHub, then run `ymmv login` again."
+      cred.source === "env" ? "The account behind YMMV_TOKEN has no handle bound. Run `ymmv login` on an interactive machine, as the same GitHub account, to rebind it. If that GitHub username is a reserved word, rename on GitHub first." : "Your GitHub username is a reserved word, so no handle is bound. Rename on GitHub, then run `ymmv login` again."
     )
   );
   process.exitCode = 1;
   return null;
 }
-function assertHandleUnchanged(existing, handle) {
+function assertHandleUnchanged(existing, cred, handle) {
   if (existing && existing.handle.toLowerCase() !== handle.toLowerCase()) {
     throw new Error(
-      `This login is bound to "${handle}" but your profile now lives at "${sanitizeValue(existing.handle)}". Run \`ymmv login\` to refresh, then retry.`
+      `This login is bound to "${handle}" but your profile now lives at "${sanitizeValue(existing.handle)}". ${cred.source === "env" ? "Re-run the command." : "Run `ymmv login` to refresh, then retry."}`
     );
   }
 }
@@ -1601,7 +1667,7 @@ async function publish(io) {
     }
   });
   const existing = await fetchProfileJson(handle);
-  assertHandleUnchanged(existing, handle);
+  assertHandleUnchanged(existing, cred, handle);
   const defaults = buildDefaults(existing, detected);
   const carried = unknownEntries(existing);
   const extras = existing?.extras ?? [];
@@ -1698,7 +1764,26 @@ async function view(handle) {
     console.log(notFound(handle, c, BASE));
     return;
   }
-  const cred = await loadToken();
+  const plainCard = (note, wrap = true) => {
+    console.log(renderProfile(theirs, { color: c, site: displayUrl(BASE) }));
+    if (note) {
+      const codes = palette(c);
+      console.error(message(`${codes.faint}${wrap ? `(${note})` : note}${codes.reset}`));
+    }
+  };
+  let cred = await loadCredential();
+  if (cred?.source === "env") {
+    try {
+      cred = await verifyEnvCredential(cred);
+    } catch (e) {
+      plainCard(`No diff: ${displayError(e)}`, false);
+      return;
+    }
+    if (cred.handle === null) {
+      plainCard("no diff: the account behind YMMV_TOKEN has no handle bound");
+      return;
+    }
+  }
   if (cred?.handle) {
     let mineFailed = false;
     const mine = await fetchProfileJson(cred.handle).catch(() => {
@@ -1712,24 +1797,23 @@ async function view(handle) {
       return;
     }
     if (!mine) {
-      console.log(renderProfile(theirs, { color: c, site: displayUrl(BASE) }));
       if (mineFailed) {
-        const codes = palette(c);
-        console.error(message(`${codes.faint}(couldn't load your profile to diff)${codes.reset}`));
+        plainCard("couldn't load your profile to diff");
       } else {
+        plainCard();
         console.log(nudge(c));
       }
       return;
     }
   }
-  console.log(renderProfile(theirs, { color: c, site: displayUrl(BASE) }));
+  plainCard();
 }
 async function runSet(target) {
   const cred = await ensureLogin();
   const handle = requireHandle(cred);
   if (!handle) return;
   const existing = await fetchProfileJson(handle);
-  assertHandleUnchanged(existing, handle);
+  assertHandleUnchanged(existing, cred, handle);
   const { entries, extras } = applySet(existing, target);
   if (target.kind === "extra" && extras.length > MAX_EXTRAS) {
     console.error(
@@ -1749,7 +1833,7 @@ async function runUnset(target) {
   const handle = requireHandle(cred);
   if (!handle) return;
   const existing = await fetchProfileJson(handle);
-  assertHandleUnchanged(existing, handle);
+  assertHandleUnchanged(existing, cred, handle);
   if (!existing) {
     console.log(message("No profile yet. Run `ymmv` to publish one."));
     return;
@@ -1769,7 +1853,7 @@ async function runUnset(target) {
 }
 async function runDelete(io) {
   const cred = await ensureLogin();
-  const target = cred.source === "env" ? "the profile bound to YMMV_TOKEN" : cred.handle ? `${displayUrl(BASE)}/${sanitizeValue(cred.handle)}` : "your profile";
+  const target = cred.handle ? `${displayUrl(BASE)}/${sanitizeValue(cred.handle)}` : cred.source === "env" ? "the profile bound to YMMV_TOKEN" : "your profile";
   if (!io.yes) {
     if (!io.interactive || !io.prompter) {
       console.error(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ymmv-cli",
-  "version": "0.10.0",
+  "version": "0.11.0",
   "description": "Publish and diff terminal-native developer tool-stack profiles at ymmv.fyi.",
   "type": "module",
   "bin": {