zeuslock-dlp-cli 0.2.0

package/src/commands/auth.js

@@ -0,0 +1,337 @@
+import { Command } from "commander";
+
+import { getCliTokenIdentity, login, requestApiKeyJson, resolveApiUrlForRequest, verifyMfa } from "../lib/api-client.js";
+import {
+  createApiKeyRecord,
+  deleteApiKeyStore,
+  maskApiKey,
+  readApiKeyStore,
+  writeApiKeyStore
+} from "../lib/api-key-store.js";
+import { createAuthRecord, createCliTokenAuthRecord, deleteAuthStore, readAuthStore, writeAuthStore } from "../lib/auth-store.js";
+import { assertCliAccessToken } from "../lib/cli-token.js";
+import { getCommandToken } from "../lib/command-token.js";
+import { DEFAULT_API_URL, normalizeApiUrl } from "../lib/config.js";
+import { promptPassword, promptText } from "../lib/prompt.js";
+import { createWhoamiCommand } from "./whoami.js";
+
+export function createAuthCommand({
+  stdin = process.stdin,
+  stdout = process.stdout,
+  stderr = process.stderr,
+  env = process.env
+} = {}) {
+  const command = new Command("auth")
+    .description("Authenticate with ZeusLock");
+
+  command.addCommand(createLoginCommand({ stdin, stdout, env }));
+  command.addCommand(createLogoutCommand({ stdout, env }));
+  command.addCommand(createApiKeyCommand({ stdin, stdout, env }));
+  command.addCommand(createWhoamiCommand({ stdout, stderr, env }));
+
+  return command;
+}
+
+function createApiKeyCommand({
+  stdin = process.stdin,
+  stdout = process.stdout,
+  env = process.env
+} = {}) {
+  const command = new Command("api-key")
+    .description("Configure the organization API key used by scan, anonymize, and hooks");
+
+  command.addCommand(createApiKeySetCommand({ stdin, stdout, env }));
+  command.addCommand(createApiKeyClearCommand({ stdout, env }));
+  command.addCommand(createApiKeyStatusCommand({ stdout, env }));
+
+  return command;
+}
+
+function createApiKeySetCommand({ stdin, stdout, env }) {
+  return new Command("set")
+    .description("Validate and save an organization API key locally")
+    .argument("[api_key]", "organization API key from the ZeusLock dashboard")
+    .option("--api-url <url>", "ZeusLock API base URL")
+    .option("--json", "print machine-readable output")
+    .action(async (apiKeyArg, options) => {
+      const apiKey = await resolveApiKeyValue(apiKeyArg, { stdin, stdout, env });
+      const apiUrl = normalizeApiUrl(options.apiUrl || env.ZEUSLOCK_API_URL) || await resolveApiUrlForRequest(env);
+      const verification = await requestApiKeyJson("/api/rules/sync", {
+        apiUrl,
+        apiKey,
+        env
+      });
+      const record = await writeApiKeyStore(createApiKeyRecord({
+        apiUrl,
+        apiKey,
+        verified: {
+          version: verification?.version ?? null,
+          license_status: verification?.license_status || null,
+          subscription_status: verification?.subscription_status || null,
+          policy_id: verification?.policy_id || null,
+          policy_version: verification?.policy_version || null,
+          saved_from: "rules_sync"
+        }
+      }), env);
+      const output = {
+        configured: true,
+        apiUrl,
+        apiKeyMasked: record.apiKeyMasked,
+        rulesVersion: verification?.version ?? null,
+        licenseStatus: verification?.license_status || null,
+        subscriptionStatus: verification?.subscription_status || null
+      };
+
+      if (options.json) {
+        stdout.write(`${JSON.stringify(output)}\n`);
+        return;
+      }
+
+      stdout.write(`Saved organization API key ${output.apiKeyMasked}\n`);
+      stdout.write(`API URL: ${apiUrl}\n`);
+      if (output.rulesVersion !== null) {
+        stdout.write(`Rules version: ${output.rulesVersion}\n`);
+      }
+    });
+}
+
+function createApiKeyClearCommand({ stdout, env }) {
+  return new Command("clear")
+    .description("Remove the locally saved organization API key")
+    .option("--json", "print machine-readable output")
+    .action(async (options) => {
+      await deleteApiKeyStore(env);
+      if (options.json) {
+        stdout.write(`${JSON.stringify({ configured: false, cleared: true })}\n`);
+        return;
+      }
+      stdout.write("Removed saved organization API key\n");
+    });
+}
+
+function createApiKeyStatusCommand({ stdout, env }) {
+  return new Command("status")
+    .description("Show whether an organization API key is configured")
+    .option("--json", "print machine-readable output")
+    .action(async (options) => {
+      const stored = await readApiKeyStore(env);
+      const envKey = String(env.ZEUSLOCK_API_KEY || "").trim();
+      const output = {
+        configured: Boolean(envKey || stored?.apiKey),
+        source: envKey ? "env" : stored?.apiKey ? "store" : null,
+        apiUrl: normalizeApiUrl(env.ZEUSLOCK_API_URL) || stored?.apiUrl || null,
+        apiKeyMasked: envKey ? maskApiKey(envKey) : stored?.apiKeyMasked || null,
+        savedAt: stored?.savedAt || null
+      };
+
+      if (options.json) {
+        stdout.write(`${JSON.stringify(output)}\n`);
+        return;
+      }
+
+      stdout.write(`Org API key: ${output.configured ? "configured" : "not configured"}\n`);
+      if (output.apiUrl) {
+        stdout.write(`API URL: ${output.apiUrl}\n`);
+      }
+      if (output.apiKeyMasked) {
+        stdout.write(`Key: ${output.apiKeyMasked}\n`);
+      }
+    });
+}
+
+function createLoginCommand({
+  stdin = process.stdin,
+  stdout = process.stdout,
+  env = process.env
+} = {}) {
+  return new Command("login")
+    .description("Authenticate with the ZeusLock backend and save user auth")
+    .option("--email <email>", "ZeusLock account email")
+    .option("-u, --username <email>", "ZeusLock account email")
+    .option("--password <password>", "ZeusLock account password")
+    .option("--mfa-code <code>", "MFA verification code, when required")
+    .option("--recaptcha-token <token>", "reCAPTCHA token, when the backend requires it")
+    .option("--token <zlu_token>", "dashboard-generated CLI access token")
+    .option("--api-url <url>", "ZeusLock API base URL")
+    .option("--json", "print machine-readable output")
+    .action(async (options) => {
+      const apiUrl = resolveLoginApiUrl(options, env);
+      const cliToken = options.token || getCommandToken(env);
+      if (cliToken) {
+        await loginWithCliAccessToken({ apiUrl, token: cliToken, options, stdout, env });
+        return;
+      }
+
+      const email = await resolveEmail(options, { stdin, stdout, env });
+      const password = await resolvePassword(options, { stdin, stdout, env });
+
+      let tokenResponse = await login({
+        apiUrl,
+        email,
+        password,
+        recaptchaToken: options.recaptchaToken || env.ZEUSLOCK_RECAPTCHA_TOKEN || null
+      });
+
+      if (tokenResponse.mfa_required) {
+        const code = await resolveMfaCode(options, { stdin, stdout, env });
+        tokenResponse = await verifyMfa({
+          apiUrl,
+          session: tokenResponse.session,
+          code
+        });
+      }
+
+      if (!tokenResponse.access_token) {
+        throw new Error(tokenResponse.error || "Login response did not include an access token");
+      }
+
+      const authRecord = createAuthRecord({
+        apiUrl,
+        email,
+        tokenResponse
+      });
+      await writeAuthStore(authRecord, env);
+
+      if (options.json) {
+        stdout.write(`${JSON.stringify({
+          authenticated: true,
+          apiUrl,
+          email,
+          expiresAt: authRecord.expiresAt
+        })}\n`);
+        return;
+      }
+
+      stdout.write(`Logged in as ${email}\n`);
+    });
+}
+
+function createLogoutCommand({ stdout, env }) {
+  return new Command("logout")
+    .description("Remove saved user authentication")
+    .option("--json", "print machine-readable output")
+    .action(async (options) => {
+      const hadAuth = Boolean(await readAuthStore(env));
+      await deleteAuthStore(env);
+
+      if (options.json) {
+        stdout.write(`${JSON.stringify({ authenticated: false, cleared: true, hadAuth })}\n`);
+        return;
+      }
+
+      stdout.write(hadAuth ? "Removed saved user authentication\n" : "No saved user authentication found\n");
+    });
+}
+
+async function loginWithCliAccessToken({ apiUrl, token, options, stdout, env }) {
+  if (options.email || options.username || options.password || options.mfaCode || options.recaptchaToken) {
+    throw new Error("--token cannot be combined with email/password, MFA, or reCAPTCHA options.");
+  }
+
+  const normalizedToken = String(token || "").trim();
+  assertCliAccessToken(normalizedToken, "--token");
+  const identity = await getCliTokenIdentity({ apiUrl, accessToken: normalizedToken });
+  const email = extractIdentityEmail(identity);
+  const authRecord = createCliTokenAuthRecord({
+    apiUrl,
+    accessToken: normalizedToken,
+    email
+  });
+  await writeAuthStore(authRecord, env);
+
+  if (options.json) {
+    stdout.write(`${JSON.stringify({
+      authenticated: true,
+      mode: "token",
+      apiUrl,
+      email
+    })}\n`);
+    return;
+  }
+
+  stdout.write(email ? `Logged in with CLI token as ${email}\n` : "Logged in with CLI token\n");
+}
+
+function extractIdentityEmail(identity) {
+  return identity?.email ||
+    identity?.user?.email ||
+    identity?.user_email ||
+    identity?.account?.email ||
+    null;
+}
+
+function resolveLoginApiUrl(options, env) {
+  return normalizeApiUrl(options.apiUrl || env.ZEUSLOCK_API_URL) || DEFAULT_API_URL;
+}
+
+async function resolveEmail(options, context) {
+  const email =
+    options.email ||
+    options.username ||
+    context.env.ZEUSLOCK_EMAIL ||
+    context.env.ZEUSLOCK_USERNAME ||
+    await promptText({
+      message: "Email: ",
+      stdin: context.stdin,
+      stdout: context.stdout,
+      optionName: "--email"
+    });
+
+  const normalized = String(email).trim().toLowerCase();
+  if (!normalized) {
+    throw new Error("Email is required");
+  }
+  return normalized;
+}
+
+async function resolvePassword(options, context) {
+  const password =
+    options.password ??
+    context.env.ZEUSLOCK_PASSWORD ??
+    await promptPassword({
+      stdin: context.stdin,
+      stdout: context.stdout,
+      optionName: "--password"
+    });
+
+  if (!String(password)) {
+    throw new Error("Password is required");
+  }
+  return String(password);
+}
+
+async function resolveApiKeyValue(apiKeyArg, context) {
+  const apiKey =
+    apiKeyArg ||
+    context.env.ZEUSLOCK_API_KEY ||
+    await promptPassword({
+      message: "API key: ",
+      stdin: context.stdin,
+      stdout: context.stdout,
+      optionName: "api_key"
+    });
+
+  const normalized = String(apiKey).trim();
+  if (!normalized) {
+    throw new Error("API key is required");
+  }
+  return normalized;
+}
+
+async function resolveMfaCode(options, context) {
+  const code =
+    options.mfaCode ||
+    context.env.ZEUSLOCK_MFA_CODE ||
+    await promptText({
+      message: "MFA code: ",
+      stdin: context.stdin,
+      stdout: context.stdout,
+      optionName: "--mfa-code"
+    });
+
+  const normalized = String(code).trim();
+  if (!normalized) {
+    throw new Error("MFA code is required");
+  }
+  return normalized;
+}