ymmv-cli 0.9.0 → 0.10.0

package/README.md

@@ -68,7 +68,9 @@ Every profile is open JSON too: `GET https://ymmv.fyi/api/v1/u/<handle>`. Full c
 ## Environment variables
 
 - `NO_COLOR` disables color output (and `FORCE_COLOR=0`/`false` force-disables it).
-- `YMMV_API` points the CLI at a different Worker (development/staging). Bare origin only.
+- `YMMV_API` points the CLI at a different Worker (development/staging). Bare origin only. That
+  Worker must be deployed with or after this CLI release: `ymmv login` requires the account id the
+  login response carries and refuses (revoking what it minted) otherwise.
 - `YMMV_TOKEN` authenticates without a browser (CI and scripts, below). Takes precedence over
   the stored login and is read-only: the CLI never writes, revokes, or deletes it, and
   `ymmv login` / `ymmv logout` keep acting on the stored login. Viewing (`ymmv <handle>`) also

package/dist/cli.js

@@ -259,6 +259,9 @@ function diff(mine, theirs) {
 
 // ../shared/dist/github.js
 var GITHUB_CLIENT_ID = "Ov23liMoD29eizQcN1KZ";
+function isGithubId(x) {
+  return typeof x === "number" && Number.isSafeInteger(x) && x > 0;
+}
 
 // ../shared/dist/types.js
 var SCHEMA_VERSION = 1;
@@ -390,10 +393,7 @@ var CTRL_RE = new RegExp(
   `[${String.fromCharCode(0)}-${String.fromCharCode(31)}${String.fromCharCode(127)}-${String.fromCharCode(159)}]`,
   "g"
 );
-var BIDI_RE = new RegExp(
-  `[${String.fromCharCode(8234)}-${String.fromCharCode(8238)}${String.fromCharCode(8294)}-${String.fromCharCode(8297)}${String.fromCharCode(8206)}${String.fromCharCode(8207)}]`,
-  "g"
-);
+var BIDI_RE = new RegExp("\\p{Bidi_Control}", "gu");
 function sanitizeValue(value) {
   return value.replace(ANSI_RE, "").replace(CTRL_RE, "").replace(BIDI_RE, "");
 }
@@ -545,6 +545,7 @@ function notFound(handle, color, base) {
 
 // src/http.ts
 var REQUEST_TIMEOUT_MS = 3e4;
+var REVOKE_CAP_MS = 5e3;
 var TIMEOUT_TEXT = "request timed out";
 function isTimeoutError(err) {
   return err instanceof Error && (err.name === "TimeoutError" || err.cause instanceof Error && err.cause.name === "TimeoutError");
@@ -683,6 +684,12 @@ async function bodyJson(res) {
     return null;
   }
 }
+var MintRejected = class extends Error {
+  constructor(msg) {
+    super(msg);
+    this.name = "MintRejected";
+  }
+};
 async function mintYmmvToken(accessToken) {
   const res = await safeFetch(
     `${BASE}/api/v1/auth/token`,
@@ -724,19 +731,30 @@ async function mintYmmvToken(accessToken) {
     throw new Error(`login failed: ${res.status} ${wireText(slug)}`.trim());
   }
   const data = await bodyJson(res);
-  if (!data || typeof data.token !== "string" || data.token.length === 0 || data.handle !== null && typeof data.handle !== "string") {
-    throw new Error(
-      `Unexpected response from ${BASE}. Nothing was saved; run \`ymmv login\` again.`
+  const unexpected = `Unexpected response from ${BASE}. Nothing was saved; run \`ymmv login\` again.`;
+  if (!data) throw new Error(unexpected);
+  const token = typeof data.token === "string" && data.token.length > 0 ? data.token : null;
+  const handle = data.handle === null ? null : typeof data.handle === "string" ? sanitizeValue(data.handle) : void 0;
+  if (token === null || handle === void 0 || handle !== null && !isValidHandle(handle) || !isGithubId(data.github_id)) {
+    let revokeFailed = false;
+    if (token !== null) {
+      await revokeYmmvToken(token, AbortSignal.timeout(REVOKE_CAP_MS)).catch(() => {
+        revokeFailed = true;
+      });
+    }
+    throw new MintRejected(
+      revokeFailed ? `${unexpected} The login the server minted could not be revoked.` : unexpected
     );
   }
-  return { token: data.token, handle: data.handle === null ? null : sanitizeValue(data.handle) };
+  return { token, handle, github_id: data.github_id };
 }
-async function revokeYmmvToken(token) {
+async function revokeYmmvToken(token, signal) {
   const res = await safeFetch(
     `${BASE}/api/v1/auth/logout`,
     {
       method: "POST",
       headers: { authorization: `Bearer ${token}` },
+      signal,
       // Never follow a redirect: a 30x→200 must not read as a successful revoke (which would delete
       // the local file while the server token stays live). Same guard as mint + publish/delete.
       redirect: "manual"
@@ -769,7 +787,12 @@ async function saveToken(data) {
   if (process.platform !== "win32") await chmod(dir, 448).catch(() => {
   });
   const tmp = `${path}.${randomUUID()}.tmp`;
-  const stored = { base: BASE, token: data.token, handle: data.handle };
+  const stored = {
+    base: BASE,
+    token: data.token,
+    handle: data.handle,
+    github_id: data.github_id
+  };
   try {
     await writeFile(tmp, JSON.stringify(stored), { mode: 384 });
     if (process.platform !== "win32") await chmod(tmp, 384);
@@ -790,10 +813,17 @@ async function readTokenFile() {
 }
 async function loadToken() {
   const parsed = await readTokenFile();
-  if (!parsed || parsed.base !== BASE || typeof parsed.token !== "string" || parsed.token === "" || parsed.handle !== null && typeof parsed.handle !== "string") {
+  const rawId = parsed?.github_id;
+  const idOk = rawId === void 0 || rawId === null || isGithubId(rawId);
+  if (!parsed || parsed.base !== BASE || typeof parsed.token !== "string" || parsed.token === "" || parsed.handle !== null && typeof parsed.handle !== "string" || !idOk) {
     return null;
   }
-  return parsed;
+  return {
+    base: parsed.base,
+    token: parsed.token,
+    handle: parsed.handle === "" ? null : parsed.handle,
+    github_id: isGithubId(rawId) ? rawId : null
+  };
 }
 async function peekCredential() {
   const parsed = await readTokenFile();
@@ -802,7 +832,13 @@ async function peekCredential() {
 async function loadCredential() {
   const envToken = process.env.YMMV_TOKEN || "";
   if (envToken !== "") {
-    return { base: BASE, token: envToken, handle: process.env.YMMV_HANDLE || null, source: "env" };
+    return {
+      base: BASE,
+      token: envToken,
+      handle: process.env.YMMV_HANDLE || null,
+      github_id: null,
+      source: "env"
+    };
   }
   const stored = await loadToken();
   return stored ? { ...stored, source: "file" } : null;
@@ -950,16 +986,16 @@ ${c.faint}waiting for GitHub approval\u2026 (Ctrl+C to cancel)${c.reset}`
     )
   );
   const accessToken = await pollForToken(dc, deps);
-  const { token, handle } = await mintYmmvToken(accessToken);
+  const minted = await mintYmmvToken(accessToken);
   const replaced = await peekCredential();
   try {
-    await saveToken({ token, handle });
+    await saveToken(minted);
   } catch (e) {
-    await revokeYmmvToken(token).catch(() => {
+    await revokeYmmvToken(minted.token).catch(() => {
     });
     throw e;
   }
-  if (replaced && replaced.base === BASE && replaced.token !== token) {
+  if (replaced && replaced.base === BASE && replaced.token !== minted.token) {
     try {
       await revokeYmmvToken(replaced.token);
     } catch {
@@ -968,7 +1004,7 @@ ${c.faint}waiting for GitHub approval\u2026 (Ctrl+C to cancel)${c.reset}`
   }
   console.log(
     message(
-      handle ? `Logged in as ${handle}.` : "Logged in. No handle bound (your GitHub username is a reserved word)."
+      minted.handle ? `Logged in as ${minted.handle}.` : "Logged in. No handle bound (your GitHub username is a reserved word)."
     )
   );
 }
@@ -981,18 +1017,30 @@ var PublishRefusal = class extends Error {
   }
 };
 var ENV_TOKEN_REJECTED = "The server rejected the token in YMMV_TOKEN (revoked or expired).";
+var NOT_PERSISTED = "Login did not persist a token. Run `ymmv login`.";
 async function rateLimitMessage(res) {
   return withRetryHint(await serverMessage(res) ?? "rate limited, too many requests", res);
 }
+async function loginOrRefuse() {
+  try {
+    await login();
+  } catch (e) {
+    if (e instanceof MintRejected) throw new PublishRefusal(e.message);
+    throw e;
+  }
+  const fresh = await loadCredential();
+  if (!fresh) throw new PublishRefusal(NOT_PERSISTED);
+  return fresh;
+}
 async function ensureLogin() {
   const existing = await loadCredential();
   if (existing) return existing;
   await login();
   const fresh = await loadCredential();
-  if (!fresh) throw new Error("Login did not persist a token. Run `ymmv login`.");
+  if (!fresh) throw new Error(NOT_PERSISTED);
   return fresh;
 }
-async function publishProfile(profile) {
+async function publishProfile(profile, expected) {
   const send = (c) => safeFetch(
     `${BASE}/api/v1/profile`,
     {
@@ -1006,8 +1054,13 @@ async function publishProfile(profile) {
     },
     BASE
   );
-  let cred = await ensureLogin();
-  if ((cred.handle ?? "").toLowerCase() !== profile.handle.toLowerCase()) {
+  let cred = await loadCredential();
+  if (!cred) {
+    console.log(message("Not logged in. Logging in to publish."));
+    cred = await loginOrRefuse();
+  }
+  const idDrifted = expected.source === "file" && (expected.github_id === null ? cred.github_id !== null : cred.github_id !== expected.github_id);
+  if ((cred.handle ?? "").toLowerCase() !== profile.handle.toLowerCase() || idDrifted) {
     throw new PublishRefusal(
       "The stored login changed while this command was running. Re-run it under the current account."
     );
@@ -1020,19 +1073,35 @@ async function publishProfile(profile) {
       );
     }
     const was401 = res.status === 401;
+    const before = cred;
     console.log(
       message(
         was401 ? "Session expired. Logging in again to retry the publish." : "The server no longer recognizes your handle. Logging in again to retry the publish."
       )
     );
     if (was401) await deleteToken();
-    await login();
-    cred = await ensureLogin();
-    if ((cred.handle ?? "").toLowerCase() !== profile.handle.toLowerCase()) {
-      const bound = sanitizeValue(cred.handle ?? "");
-      throw new PublishRefusal(
-        was401 ? `The re-login bound a different account ("${bound}", not "${sanitizeValue(profile.handle)}"). Nothing was published. Re-run under the account you meant.` : `Your login now binds "${bound}". Nothing was published. Re-run the command to publish under it.`
-      );
+    cred = await loginOrRefuse();
+    const known = before.github_id !== null;
+    const idChanged = known && cred.github_id !== before.github_id;
+    const sameHandle = (cred.handle ?? "").toLowerCase() === profile.handle.toLowerCase();
+    if (!sameHandle || idChanged) {
+      const mine = sanitizeValue(profile.handle);
+      const bound = cred.handle === null ? null : sanitizeValue(cred.handle);
+      const reRun = "Nothing was published. Re-run under the account you meant.";
+      const otherAccount = `The re-login bound a different account ("${bound}", not "${mine}"). ${reRun}`;
+      if (idChanged) {
+        throw new PublishRefusal(
+          sameHandle ? `The handle "${mine}" now belongs to a different GitHub account. ${reRun}` : bound === null ? `The re-login bound a different GitHub account. ${reRun}` : otherAccount
+        );
+      }
+      if (bound === null) {
+        throw new PublishRefusal(
+          "Your login no longer binds a handle (your GitHub username is a reserved word). Nothing was published."
+        );
+      }
+      const rebound = `Your login now binds "${bound}". Nothing was published. Re-run the command to publish under it.`;
+      if (known) throw new PublishRefusal(rebound);
+      throw new PublishRefusal(was401 ? otherAccount : rebound);
     }
     res = await send(cred);
     if (res.status === 401) throw new PublishRefusal("Authentication failed. Run `ymmv login`.");
@@ -1576,7 +1645,7 @@ async function publish(io) {
     }
     const entries = assemble();
     showCard(entries);
-    printPublished(await publishProfile(newProfile(handle, entries, extras)), color);
+    printPublished(await publishProfile(newProfile(handle, entries, extras), cred), color);
     return;
   }
   try {
@@ -1592,7 +1661,7 @@ async function publish(io) {
       );
       if (ans === "y") {
         try {
-          printPublished(await publishProfile(newProfile(handle, entries, extras)), color);
+          printPublished(await publishProfile(newProfile(handle, entries, extras), cred), color);
           return;
         } catch (e) {
           if (e instanceof PromptAborted || e instanceof PublishRefusal) throw e;
@@ -1671,7 +1740,7 @@ async function runSet(target) {
     process.exitCode = 1;
     return;
   }
-  const res = await publishProfile(newProfile(handle, entries, extras));
+  const res = await publishProfile(newProfile(handle, entries, extras), cred);
   const line = target.kind === "curated" ? `Set ${KEY_LABELS[target.key]} = ${target.value}.` : `Set extra ${target.label} = ${target.value}.`;
   console.log(message(`${line}${pagePointer(res.handle)}`));
 }
@@ -1694,7 +1763,7 @@ async function runUnset(target) {
     );
     return;
   }
-  const res = await publishProfile(newProfile(handle, entries, extras));
+  const res = await publishProfile(newProfile(handle, entries, extras), cred);
   const line = target.kind === "curated" ? `Removed ${KEY_LABELS[target.key]} (was "${sanitizeValue(removed.value)}").` : `Removed extra "${sanitizeValue(removed.label)}" (was "${sanitizeValue(removed.value)}").`;
   console.log(message(`${line}${pagePointer(res.handle)}`));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ymmv-cli",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "Publish and diff terminal-native developer tool-stack profiles at ymmv.fyi.",
   "type": "module",
   "bin": {