zeuslock-dlp-cli 0.2.0

package/src/lib/api-client.js

@@ -0,0 +1,308 @@
+import {
+  createAuthRecord,
+  deleteAuthStore,
+  readAuthStore,
+  writeAuthStore
+} from "./auth-store.js";
+import { readApiKeyStore } from "./api-key-store.js";
+import { assertCliAccessToken } from "./cli-token.js";
+import { getCommandToken } from "./command-token.js";
+import { DEFAULT_API_URL, resolveApiUrl } from "./config.js";
+
+const CLI_TOKEN_401_MESSAGE = "CLI access token expired, revoked, or invalid. Generate a new token on the dashboard CLI page and run `zeuslock auth login --token <token>`.";
+
+export class ApiError extends Error {
+  constructor(message, { status = null, data = null, responseText = "" } = {}) {
+    super(message);
+    this.name = "ApiError";
+    this.status = status;
+    this.data = data;
+    this.responseText = responseText;
+  }
+}
+
+export async function login({ apiUrl, email, password, recaptchaToken = null }) {
+  const body = { email, password };
+  if (recaptchaToken) {
+    body.recaptcha_token = recaptchaToken;
+  }
+
+  return requestJson(apiUrl, "/api/auth/login", {
+    method: "POST",
+    body
+  });
+}
+
+export async function verifyMfa({ apiUrl, session, code }) {
+  return requestJson(apiUrl, "/api/auth/verify-mfa", {
+    method: "POST",
+    body: { session, code }
+  });
+}
+
+export async function refreshAuth({ apiUrl, refreshToken }) {
+  return requestJson(apiUrl, "/api/auth/refresh", {
+    method: "POST",
+    body: { refresh_token: refreshToken }
+  });
+}
+
+export async function getCurrentUser({ apiUrl, accessToken }) {
+  return requestJson(apiUrl, "/api/user/me", {
+    headers: {
+      Authorization: `Bearer ${accessToken}`
+    }
+  });
+}
+
+export async function getCliTokenIdentity({ apiUrl, accessToken }) {
+  return requestJson(apiUrl, "/api/auth/me", {
+    headers: {
+      Authorization: `Bearer ${accessToken}`
+    }
+  });
+}
+
+export async function resolveApiUrlForRequest(env = process.env) {
+  const auth = await readAuthStore(env);
+  const apiKey = await readApiKeyStore(env);
+  return resolveApiUrl({ env, auth: auth || apiKey }) || DEFAULT_API_URL;
+}
+
+export async function requestApiKeyJson(endpoint, {
+  method = "GET",
+  body,
+  headers = {},
+  apiKey,
+  apiUrl,
+  signal,
+  env = process.env
+} = {}) {
+  const stored = await readApiKeyStore(env);
+  const resolvedApiKey = String(apiKey || env.ZEUSLOCK_API_KEY || stored?.apiKey || "").trim();
+  if (!resolvedApiKey) {
+    throw new Error("API key is required. Provide --api-key, set ZEUSLOCK_API_KEY, or run `zeuslock auth api-key set`.");
+  }
+
+  const resolvedApiUrl = apiUrl || stored?.apiUrl || await resolveApiUrlForRequest(env);
+  return requestJson(resolvedApiUrl, endpoint, {
+    method,
+    body,
+    signal,
+    headers: {
+      ...headers,
+      "X-API-Key": resolvedApiKey
+    }
+  });
+}
+
+export async function requestApiKeyFormData(endpoint, formData, {
+  headers = {},
+  apiKey,
+  apiUrl,
+  signal,
+  env = process.env
+} = {}) {
+  const stored = await readApiKeyStore(env);
+  const resolvedApiKey = String(apiKey || env.ZEUSLOCK_API_KEY || stored?.apiKey || "").trim();
+  if (!resolvedApiKey) {
+    throw new Error("API key is required. Provide --api-key, set ZEUSLOCK_API_KEY, or run `zeuslock auth api-key set`.");
+  }
+
+  const resolvedApiUrl = apiUrl || stored?.apiUrl || await resolveApiUrlForRequest(env);
+  return requestFormData(resolvedApiUrl, endpoint, formData, {
+    signal,
+    headers: {
+      ...headers,
+      "X-API-Key": resolvedApiKey
+    }
+  });
+}
+
+export async function requestAuthenticatedJson(endpoint, {
+  method = "GET",
+  body,
+  headers = {},
+  env = process.env
+} = {}) {
+  const result = await requestAuthenticatedJsonWithMeta(endpoint, {
+    method,
+    body,
+    headers,
+    env
+  });
+  return result.data;
+}
+
+export async function requestAuthenticatedJsonWithMeta(endpoint, {
+  method = "GET",
+  body,
+  headers = {},
+  env = process.env
+} = {}) {
+  const context = await resolveAuthenticatedContext(env);
+  const requestWithToken = (token) => requestJson(context.apiUrl, endpoint, {
+    method,
+    body,
+    headers: {
+      ...headers,
+      Authorization: `Bearer ${token}`
+    }
+  });
+
+  try {
+    return {
+      data: await requestWithToken(context.accessToken),
+      apiUrl: context.apiUrl,
+      authMode: context.mode,
+      authSource: context.source
+    };
+  } catch (error) {
+    if (context.mode === "token" && error instanceof ApiError && error.status === 401) {
+      throw new Error(CLI_TOKEN_401_MESSAGE);
+    }
+
+    if (context.mode === "token" || !(error instanceof ApiError) || error.status !== 401) {
+      throw error;
+    }
+  }
+
+  if (!context.auth?.refreshToken) {
+    await deleteAuthStore(env);
+    throw new Error("Session expired. Run `zeuslock auth login` again.");
+  }
+
+  try {
+    const tokenResponse = await refreshAuth({ apiUrl: context.apiUrl, refreshToken: context.auth.refreshToken });
+    const refreshedAuth = createAuthRecord({
+      apiUrl: context.apiUrl,
+      email: context.auth.email,
+      tokenResponse,
+      previous: context.auth
+    });
+    await writeAuthStore(refreshedAuth, env);
+    return {
+      data: await requestWithToken(refreshedAuth.accessToken),
+      apiUrl: context.apiUrl,
+      authMode: refreshedAuth.mode,
+      authSource: context.source
+    };
+  } catch (error) {
+    if (error instanceof ApiError && error.status === 401) {
+      await deleteAuthStore(env);
+      throw new Error("Session expired. Run `zeuslock auth login` again.");
+    }
+    throw error;
+  }
+}
+
+async function resolveAuthenticatedContext(env) {
+  const auth = await readAuthStore(env);
+  const commandToken = getCommandToken(env);
+  const envToken = String(env.ZEUSLOCK_API_TOKEN || "").trim();
+  const apiUrl = resolveApiUrl({ env, auth }) || DEFAULT_API_URL;
+
+  if (commandToken) {
+    assertCliAccessToken(commandToken, "--token");
+    return {
+      auth,
+      apiUrl,
+      accessToken: commandToken,
+      mode: "token",
+      source: "flag"
+    };
+  }
+
+  if (envToken) {
+    return {
+      auth,
+      apiUrl,
+      accessToken: envToken,
+      mode: "token",
+      source: "env"
+    };
+  }
+
+  if (auth?.accessToken) {
+    return {
+      auth,
+      apiUrl,
+      accessToken: auth.accessToken,
+      mode: auth.mode === "token" ? "token" : "session",
+      source: "store"
+    };
+  }
+
+  throw new Error("Not logged in. Run `zeuslock auth login` first.");
+}
+
+export async function requestJson(apiUrl, endpoint, { method = "GET", body, headers = {}, signal } = {}) {
+  const url = new URL(endpoint, ensureTrailingSlash(apiUrl));
+  const requestHeaders = {
+    Accept: "application/json",
+    ...headers
+  };
+
+  const request = {
+    method,
+    headers: requestHeaders,
+    signal
+  };
+
+  if (body !== undefined) {
+    requestHeaders["Content-Type"] = "application/json";
+    request.body = JSON.stringify(body);
+  }
+
+  return fetchJson(url, request);
+}
+
+export async function requestFormData(apiUrl, endpoint, formData, { headers = {}, signal } = {}) {
+  const url = new URL(endpoint, ensureTrailingSlash(apiUrl));
+  const request = {
+    method: "POST",
+    headers: {
+      Accept: "application/json",
+      ...headers
+    },
+    body: formData,
+    signal
+  };
+
+  return fetchJson(url, request);
+}
+
+async function fetchJson(url, request) {
+  let response;
+  try {
+    response = await fetch(url, request);
+  } catch (error) {
+    throw new ApiError(error?.message || "Network request failed");
+  }
+
+  const contentType = response.headers.get("content-type") || "";
+  let data = null;
+  let responseText = "";
+
+  if (contentType.includes("application/json")) {
+    data = await response.json().catch(() => null);
+  } else {
+    responseText = await response.text().catch(() => "");
+  }
+
+  if (!response.ok) {
+    const message =
+      data?.error ||
+      data?.detail ||
+      data?.message ||
+      responseText ||
+      `Request failed with status ${response.status}`;
+    throw new ApiError(message, { status: response.status, data, responseText });
+  }
+
+  return data ?? {};
+}
+
+function ensureTrailingSlash(apiUrl) {
+  return apiUrl.endsWith("/") ? apiUrl : `${apiUrl}/`;
+}

package/src/lib/api-key-store.js

@@ -0,0 +1,84 @@
+import { chmod, mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import path from "node:path";
+
+import { getConfigDir } from "./auth-store.js";
+import { normalizeApiUrl } from "./config.js";
+
+const API_KEY_FILE_NAME = "api-key.json";
+
+export function getApiKeyFilePath(env = process.env) {
+  return path.join(getConfigDir(env), API_KEY_FILE_NAME);
+}
+
+export async function readApiKeyStore(env = process.env) {
+  try {
+    const raw = await readFile(getApiKeyFilePath(env), "utf8");
+    return normalizeApiKeyRecord(JSON.parse(raw));
+  } catch (error) {
+    if (error?.code === "ENOENT") {
+      return null;
+    }
+    throw error;
+  }
+}
+
+export async function writeApiKeyStore(record, env = process.env) {
+  const apiKeyRecord = normalizeApiKeyRecord(record);
+  if (!apiKeyRecord?.apiKey) {
+    throw new Error("Cannot save API key state without an API key");
+  }
+
+  const dir = getConfigDir(env);
+  const filePath = getApiKeyFilePath(env);
+  const tempPath = `${filePath}.${process.pid}.${Date.now()}.tmp`;
+
+  await mkdir(dir, { recursive: true, mode: 0o700 });
+  await chmod(dir, 0o700).catch(() => {});
+  await writeFile(tempPath, `${JSON.stringify(apiKeyRecord, null, 2)}\n`, {
+    mode: 0o600
+  });
+  await chmod(tempPath, 0o600).catch(() => {});
+  await rename(tempPath, filePath);
+  await chmod(filePath, 0o600).catch(() => {});
+
+  return apiKeyRecord;
+}
+
+export async function deleteApiKeyStore(env = process.env) {
+  await rm(getApiKeyFilePath(env), { force: true });
+}
+
+export function createApiKeyRecord({ apiUrl, apiKey, verified = null }) {
+  return normalizeApiKeyRecord({
+    apiUrl,
+    apiKey,
+    apiKeyMasked: maskApiKey(apiKey),
+    verified,
+    savedAt: new Date().toISOString()
+  });
+}
+
+export function maskApiKey(apiKey) {
+  const value = String(apiKey || "").trim();
+  if (!value) {
+    return "";
+  }
+  if (value.length <= 12) {
+    return `${value.slice(0, 4)}***`;
+  }
+  return `${value.slice(0, 8)}***${value.slice(-4)}`;
+}
+
+function normalizeApiKeyRecord(record) {
+  if (!record || typeof record !== "object") {
+    return null;
+  }
+
+  return {
+    apiUrl: normalizeApiUrl(record.apiUrl),
+    apiKey: typeof record.apiKey === "string" ? record.apiKey : null,
+    apiKeyMasked: typeof record.apiKeyMasked === "string" ? record.apiKeyMasked : maskApiKey(record.apiKey),
+    verified: record.verified && typeof record.verified === "object" ? record.verified : null,
+    savedAt: typeof record.savedAt === "string" ? record.savedAt : null
+  };
+}

package/src/lib/auth-store.js

@@ -0,0 +1,123 @@
+import { mkdir, readFile, rename, rm, chmod, writeFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+
+const AUTH_FILE_NAME = "auth.json";
+
+export function getConfigDir(env = process.env, platform = process.platform) {
+  if (env.ZEUSLOCK_CONFIG_DIR?.trim()) {
+    return path.resolve(env.ZEUSLOCK_CONFIG_DIR.trim());
+  }
+
+  if (platform === "darwin") {
+    return path.join(os.homedir(), "Library", "Application Support", "zeuslock");
+  }
+
+  if (platform === "win32") {
+    const appData = env.APPDATA?.trim() || path.join(os.homedir(), "AppData", "Roaming");
+    return path.join(appData, "ZeusLock");
+  }
+
+  const xdgConfigHome = env.XDG_CONFIG_HOME?.trim() || path.join(os.homedir(), ".config");
+  return path.join(xdgConfigHome, "zeuslock");
+}
+
+export function getAuthFilePath(env = process.env) {
+  return path.join(getConfigDir(env), AUTH_FILE_NAME);
+}
+
+export async function readAuthStore(env = process.env) {
+  const filePath = getAuthFilePath(env);
+
+  try {
+    const raw = await readFile(filePath, "utf8");
+    const parsed = JSON.parse(raw);
+    return normalizeAuthRecord(parsed);
+  } catch (error) {
+    if (error?.code === "ENOENT") {
+      return null;
+    }
+    throw error;
+  }
+}
+
+export async function writeAuthStore(record, env = process.env) {
+  const authRecord = normalizeAuthRecord(record);
+  if (!authRecord?.accessToken) {
+    throw new Error("Cannot save auth state without an access token");
+  }
+
+  const dir = getConfigDir(env);
+  const filePath = getAuthFilePath(env);
+  const tempPath = `${filePath}.${process.pid}.${Date.now()}.tmp`;
+
+  await mkdir(dir, { recursive: true, mode: 0o700 });
+  await chmod(dir, 0o700).catch(() => {});
+  await writeFile(tempPath, `${JSON.stringify(authRecord, null, 2)}\n`, {
+    mode: 0o600
+  });
+  await chmod(tempPath, 0o600).catch(() => {});
+  await rename(tempPath, filePath);
+  await chmod(filePath, 0o600).catch(() => {});
+
+  return authRecord;
+}
+
+export async function deleteAuthStore(env = process.env) {
+  await rm(getAuthFilePath(env), { force: true });
+}
+
+export function createAuthRecord({ apiUrl, email, tokenResponse, previous = null }) {
+  const now = new Date();
+  const expiresIn = Number(tokenResponse.expires_in);
+  const expiresAt = Number.isFinite(expiresIn)
+    ? new Date(now.getTime() + expiresIn * 1000).toISOString()
+    : (previous?.expiresAt ?? null);
+
+  return normalizeAuthRecord({
+    ...previous,
+    mode: "session",
+    apiUrl,
+    email: email ?? previous?.email ?? null,
+    tokenType: tokenResponse.token_type || previous?.tokenType || "Bearer",
+    accessToken: tokenResponse.access_token || previous?.accessToken,
+    refreshToken: tokenResponse.refresh_token || previous?.refreshToken || null,
+    idToken: tokenResponse.id_token || previous?.idToken || null,
+    expiresAt,
+    savedAt: now.toISOString()
+  });
+}
+
+export function createCliTokenAuthRecord({ apiUrl, accessToken, email = null }) {
+  return normalizeAuthRecord({
+    mode: "token",
+    apiUrl,
+    email,
+    tokenType: "Bearer",
+    accessToken,
+    refreshToken: null,
+    idToken: null,
+    expiresAt: null,
+    savedAt: new Date().toISOString()
+  });
+}
+
+function normalizeAuthRecord(record) {
+  if (!record || typeof record !== "object") {
+    return null;
+  }
+
+  const mode = record.mode === "token" ? "token" : "session";
+
+  return {
+    mode,
+    apiUrl: typeof record.apiUrl === "string" ? record.apiUrl : null,
+    email: typeof record.email === "string" ? record.email : null,
+    tokenType: typeof record.tokenType === "string" ? record.tokenType : "Bearer",
+    accessToken: typeof record.accessToken === "string" ? record.accessToken : null,
+    refreshToken: mode === "token" ? null : typeof record.refreshToken === "string" ? record.refreshToken : null,
+    idToken: mode === "token" ? null : typeof record.idToken === "string" ? record.idToken : null,
+    expiresAt: mode === "token" ? null : typeof record.expiresAt === "string" ? record.expiresAt : null,
+    savedAt: typeof record.savedAt === "string" ? record.savedAt : null
+  };
+}

package/src/lib/cli-token.js

@@ -0,0 +1,22 @@
+const CLI_TOKEN_PATTERN = /^zlu_[A-Za-z0-9_-]{43}$/;
+
+export function isCliAccessToken(value) {
+  return CLI_TOKEN_PATTERN.test(String(value || "").trim());
+}
+
+export function assertCliAccessToken(value, optionName = "--token") {
+  if (!isCliAccessToken(value)) {
+    throw new Error(`Invalid ${optionName}. Expected zlu_ followed by 43 URL-safe characters.`);
+  }
+}
+
+export function maskCliToken(token) {
+  const value = String(token || "").trim();
+  if (!value) {
+    return "";
+  }
+  if (value.length <= 12) {
+    return `${value.slice(0, 4)}***`;
+  }
+  return `${value.slice(0, 8)}***...${value.slice(-4)}`;
+}

package/src/lib/command-token.js

@@ -0,0 +1,15 @@
+const commandTokens = new WeakMap();
+
+export function setCommandToken(env, token) {
+  if (!env || typeof env !== "object") {
+    return;
+  }
+  commandTokens.set(env, String(token || "").trim());
+}
+
+export function getCommandToken(env) {
+  if (!env || typeof env !== "object") {
+    return "";
+  }
+  return commandTokens.get(env) || "";
+}

package/src/lib/config.js

@@ -0,0 +1,27 @@
+import { getCommandToken } from "./command-token.js";
+
+export const DEFAULT_API_URL = "https://api.zeuslock.ai";
+
+export function readEnvConfig(env = process.env) {
+  const apiUrl = normalizeApiUrl(env.ZEUSLOCK_API_URL);
+  const hasApiToken = Boolean(getCommandToken(env) || env.ZEUSLOCK_API_TOKEN?.trim());
+  const hasApiKey = Boolean(env.ZEUSLOCK_API_KEY?.trim());
+
+  return {
+    apiUrl,
+    hasApiToken,
+    hasApiKey
+  };
+}
+
+export function resolveApiUrl({ env = process.env, auth = null } = {}) {
+  return normalizeApiUrl(env.ZEUSLOCK_API_URL) || normalizeApiUrl(auth?.apiUrl) || DEFAULT_API_URL;
+}
+
+export function normalizeApiUrl(value) {
+  const candidate = typeof value === "string" ? value.trim() : "";
+  if (!candidate) {
+    return null;
+  }
+  return candidate.replace(/\/+$/, "");
+}