CLI: sign-in hint on 401 and a default login server (#1371)

* CLI: explain 401s with a login hint, default login to executor.sh A 401 from a stored profile now renders as a sign-in message naming the profile and the exact login command, instead of the transport-level `Decode error (401 GET .../api/tools)`. `executor login` with no flags and no profiles now targets https://executor.sh instead of erroring, and prints the chosen server before starting the device flow. * Keep profile plumbing out of CLI auth messages The sign-in hint now mirrors how the user addressed the server: plain `executor login` when no flags were typed, echoing --server/--base-url only when they were. Login and logout output mention profiles only when the user works with named profiles. * Add changeset for CLI login hints

Rhys Sullivan committed 4 months ago

Commit 262fc3e1 parent 56b60bf5 files · +359 −24Browse files

Showing the changes to apps/cli/src (3 of 5 files). Show all

Unified · Split

3 files

apps/cli/src/main.ts +61 −24
apps/cli/src/server-connection.test.ts +84 −0
apps/cli/src/server-connection.ts +49 −0

apps/cli/src/main.ts+61−24

 import { Argument as Args, Command, Flag as Options } from "effect/unstable/cli";
 import { BunRuntime, BunServices } from "@effect/platform-bun";
 import { HttpApiClient } from "effect/unstable/httpapi";
-import { FetchHttpClient, HttpClient, HttpClientRequest } from "effect/unstable/http";
+import {
+  FetchHttpClient,
+  HttpClient,
+  HttpClientError,
+  HttpClientRequest,
+} from "effect/unstable/http";
 import { FileSystem, Path as PlatformPath } from "effect";
 import type { PlatformError } from "effect/PlatformError";
 import * as Effect from "effect/Effect";
 import {
   canAutoStartCliServerConnection,
   chooseCliServerConnectionWithActiveLocal,
+  describeUnauthorizedCliServer,
   parseCliExecutorServerConnection,
+  profileNameFromConnectionKey,
   type CliServerConnectionSource,
   withCliServerAuthFallback,
 } from "./server-connection";
 // login. The refreshed tokens are written back to the originating profile.
 const OAUTH_REFRESH_SKEW_SECONDS = 60;
-const profileNameFromKey = (key: string): string | null =>
-  key.startsWith("profile:") ? key.slice("profile:".length) : null;
 const refreshOAuthConnection = (
   connection: ExecutorServerConnection,
 ): Effect.Effect<ExecutorServerConnection, never, FileSystem.FileSystem | PlatformPath.Path> =>
       },
     });
-    const profileName = profileNameFromKey(connection.key);
+    const profileName = profileNameFromConnectionKey(connection.key);
     if (profileName) {
       yield* upsertCliServerConnectionProfile({
         name: profileName,
 }): Effect.Effect<ExecuteCodeResult, Error, FileSystem.FileSystem | PlatformPath.Path> =>
   Effect.gen(function* () {
     const connection = yield* resolveExecutorServerConnection(input.target);
-    const client = yield* makeApiClient(connection);
+    const client = yield* makeApiClient(connection, input.target);
     const response = yield* client.executions.execute({
       payload: {
         code: input.code,
 // Typed API client
 // ---------------------------------------------------------------------------
-const makeApiClient = (connection: ExecutorServerConnection) => {
+const makeApiClient = (connection: ExecutorServerConnection, target: ServerTarget = {}) => {
   const authorization = getExecutorServerAuthorizationHeader(connection);
   return HttpApiClient.make(ExecutorApi, {
     baseUrl: connection.apiBaseUrl,
           ),
         }
       : {}),
+    // A 401 on an endpoint that doesn't model it is a sign-in problem: rewrite
+    // the transport-level error into the login hint. Without this the client
+    // fails decoding the unexpected status and prints the opaque
+    // `Decode error (401 GET .../api/tools)`. Declared 401s (typed API errors)
+    // decode before this catch and pass through untouched.
+    transformResponse: (effect) =>
+      Effect.catchIf(
+        effect,
+        (cause) => HttpClientError.isHttpClientError(cause) && cause.response?.status === 401,
+        () =>
+          Effect.fail(new Error(describeUnauthorizedCliServer({ connection, cliPrefix, target }))),
+      ),
   }).pipe(Effect.provide(FetchHttpClient.layer));
 };
   Effect.gen(function* () {
     if (args.scopeDir) process.env.EXECUTOR_SCOPE_DIR = resolve(args.scopeDir);
-    const connection = yield* resolveExecutorServerConnection({
+    const target: ServerTarget = { baseUrl: args.baseUrl, serverName: args.serverName };
-      baseUrl: args.baseUrl,
+    const connection = yield* resolveExecutorServerConnection(target);
-      serverName: args.serverName,
+    const client = yield* makeApiClient(connection, target);
-    });
-    const client = yield* makeApiClient(connection);
     const tools = yield* client.tools.list({ query: {} });
     const toolPaths = tools.map((tool) => tool.address);
       const contentObj = yield* parseOptionalJsonObject(Option.getOrUndefined(content));
-      const client = yield* makeApiClient(connection);
+      const client = yield* makeApiClient(connection, target);
       const result = yield* client.executions.resume({
         params: { executionId },
         payload: { action, content: contentObj },
   }
 };
+/** Where `executor login` lands with no flags and no stored profiles. */
+const DEFAULT_LOGIN_ORIGIN = "https://executor.sh";
 // Resolve which server a login/logout targets: an existing profile (--server
-// or the default) or a bare origin (--base-url). The profile name is decided
+// or the default), a bare origin (--base-url), or hosted Executor when
-// later, from the authenticated account.
+// nothing is configured yet. The profile name is decided later, from the
+// authenticated account.
 const resolveLoginOrigin = (input: {
   readonly baseUrl: Option.Option<string>;
   readonly server: Option.Option<string>;
     const store = yield* readCliServerConnectionStore();
     const profile = defaultCliServerConnectionProfile(store);
     if (profile) return { origin: profile.connection.origin, profile };
-    return yield* Effect.fail(
+    return { origin: DEFAULT_LOGIN_ORIGIN, profile: null };
-      new Error(
-        "No server to log in to. Pass --base-url <https://your-host> or --server <profile>.",
-      ),
-    );
   });
 const loginNameOption = Options.string("name").pipe(
     Effect.gen(function* () {
       const target = yield* resolveLoginOrigin({ baseUrl, server });
       const explicitName = Option.getOrUndefined(name);
+      // The target may have been picked implicitly (default profile, or the
+      // hosted fallback): say where the login is going before the device flow.
+      console.log(`Signing in to ${target.origin}`);
       const discovery = yield* Effect.tryPromise({
         try: () => discoverCliLogin(target.origin),
         catch: toError,
       });
       console.log("");
-      console.log(`Logged in to ${target.origin} (profile "${profileName}", now the default).`);
+      // Profile bookkeeping stays backstage unless the user works with named
+      // profiles (--name, or a store that already has several).
+      const mentionProfile =
+        explicitName !== undefined || (yield* readCliServerConnectionStore()).profiles.length > 1;
+      console.log(
+        mentionProfile
+          ? `Logged in to ${target.origin} (profile "${profileName}", now the default).`
+          : `Logged in to ${target.origin}.`,
+      );
       if (email) console.log(`Account: ${email}`);
       if (org) console.log(`Organization: ${org}`);
       else if (sub) console.log(`User: ${sub}`);
     }),
-).pipe(Command.withDescription("Sign in to a hosted Executor server in the browser (device flow)"));
+).pipe(
+  Command.withDescription(
+    "Sign in to a hosted Executor server in the browser (device flow). Defaults to https://executor.sh.",
+  ),
+);
 const logoutCommand = Command.make(
   "logout",
         console.log(`No stored login for ${target.origin}.`);
         return;
       }
+      // Profile bookkeeping stays backstage unless the user addressed one.
+      const mentionProfile = Option.isSome(server) || store.profiles.length > 1;
       if (!profile.connection.auth) {
-        console.log(`Profile "${profile.name}" has no stored credentials.`);
+        console.log(
+          mentionProfile
+            ? `Profile "${profile.name}" has no stored credentials.`
+            : `Not signed in to ${target.origin}.`,
+        );
         return;
       }
       yield* upsertCliServerConnectionProfile({
         makeDefault: store.defaultProfile === profile.name,
       });
       console.log(
-        `Logged out of ${profile.connection.origin} (cleared credentials for "${profile.name}").`,
+        mentionProfile
+          ? `Logged out of ${profile.connection.origin} (cleared credentials for "${profile.name}").`
+          : `Logged out of ${profile.connection.origin}.`,
       );
     }),
 ).pipe(Command.withDescription("Clear stored credentials for a server profile"));

apps/cli/src/server-connection.test.ts+84−0

@@ -1,8 +1,11 @@
1	import { describe, expect, it } from "@effect/vitest";	1	import { describe, expect, it } from "@effect/vitest";
2		2
		3	import { normalizeExecutorServerConnection } from "@executor-js/sdk/shared";
		4
3	import {	5	import {
4	canAutoStartCliServerConnection,	6	canAutoStartCliServerConnection,
5	chooseCliServerConnectionWithActiveLocal,	7	chooseCliServerConnectionWithActiveLocal,
		8	describeUnauthorizedCliServer,
6	parseCliExecutorServerConnection,	9	parseCliExecutorServerConnection,
7	withCliServerAuthFallback,	10	withCliServerAuthFallback,
8	} from "./server-connection";	11	} from "./server-connection";
@@ -135,3 +138,84 @@ describe("CLI server connection", () => { · 126 unmodified lines
135	).toBe("conflict");	138	).toBe("conflict");
136	});	139	});
137	});	140	});
		141
		142	describe("describeUnauthorizedCliServer", () => {
		143	it("hints plain `executor login` when the server was picked implicitly", () => {
		144	const connection = normalizeExecutorServerConnection({
		145	key: "profile:rhys-executor.sh",
		146	origin: "https://executor.sh",
		147	auth: { kind: "oauth", accessToken: "stale", expiresAt: 1 },
		148	});
		149
		150	const message = describeUnauthorizedCliServer({
		151	connection,
		152	cliPrefix: "executor",
		153	target: {},
		154	});
		155	expect(message).toContain("You're signed out of https://executor.sh");
		156	expect(message).toContain("Run `executor login` to sign in again.");
		157	// Profile names are plumbing: never surfaced when the user didn't type one.
		158	expect(message).not.toContain("--server");
		159	expect(message).not.toContain("profile");
		160	});
		161
		162	it("echoes --server back when the user targeted a named profile", () => {
		163	const connection = normalizeExecutorServerConnection({
		164	key: "profile:work",
		165	origin: "https://executor.example",
		166	auth: { kind: "oauth", accessToken: "stale", expiresAt: 1 },
		167	});
		168
		169	const message = describeUnauthorizedCliServer({
		170	connection,
		171	cliPrefix: "executor",
		172	target: { serverName: "work" },
		173	});
		174	expect(message).toContain("You're signed out of https://executor.example");
		175	expect(message).toContain("executor login --server work");
		176	});
		177
		178	it("echoes --base-url back when the user targeted an origin", () => {
		179	const connection = normalizeExecutorServerConnection({
		180	origin: "https://executor.example",
		181	});
		182
		183	const message = describeUnauthorizedCliServer({
		184	connection,
		185	cliPrefix: "executor",
		186	target: { baseUrl: "https://executor.example" },
		187	});
		188	expect(message).toContain("no credentials are stored");
		189	expect(message).toContain("executor login --base-url https://executor.example");
		190	});
		191
		192	it("mentions the env vars when a profile-less bearer key is rejected", () => {
		193	const connection = normalizeExecutorServerConnection({
		194	origin: "https://executor.example",
		195	auth: { kind: "bearer", token: "key_bad" },
		196	});
		197
		198	const message = describeUnauthorizedCliServer({
		199	connection,
		200	cliPrefix: "executor",
		201	target: {},
		202	});
		203	expect(message).toContain("rejected the stored bearer credentials");
		204	expect(message).toContain("EXECUTOR_API_KEY");
		205	});
		206
		207	it("uses the dev entrypoint prefix verbatim", () => {
		208	const connection = normalizeExecutorServerConnection({
		209	key: "profile:hosted",
		210	origin: "https://executor.example",
		211	auth: { kind: "oauth", accessToken: "stale" },
		212	});
		213
		214	const message = describeUnauthorizedCliServer({
		215	connection,
		216	cliPrefix: "bun run apps/cli/src/main.ts",
		217	target: {},
		218	});
		219	expect(message).toContain("bun run apps/cli/src/main.ts login");
		220	});
		221	});

apps/cli/src/server-connection.ts+49−0

@@ -52,6 +52,55 @@ export const canAutoStartCliServerConnection = (connection: ExecutorServerConnec · 51 unmodified lines
52	return url.protocol === "http:" && canAutoStartLocalDaemonForHost(url.hostname);	52	return url.protocol === "http:" && canAutoStartLocalDaemonForHost(url.hostname);
53	};	53	};
54		54
		55	export const profileNameFromConnectionKey = (key: string): string \| null =>
		56	key.startsWith("profile:") ? key.slice("profile:".length) : null;
		57
		58	// A 401 from the server means the stored credential is stale, revoked, or
		59	// missing: a sign-in problem, not a transport problem. Rendered instead of
		60	// the raw HTTP client error so the user learns the recovery command, not the
		61	// failing endpoint.
		62	//
		63	// The hint mirrors how the user addressed the server. The common case types
		64	// no flags (the default profile, normally executor.sh), and login re-targets
		65	// that same default, so the fix is plain `executor login`: profile names are
		66	// plumbing and stay invisible. Only an explicit --server / --base-url comes
		67	// back in the hint.
		68	export const describeUnauthorizedCliServer = (input: {
		69	readonly connection: ExecutorServerConnection;
		70	readonly cliPrefix: string;
		71	readonly target: { readonly baseUrl?: string; readonly serverName?: string };
		72	}): string => {
		73	const { connection, cliPrefix, target } = input;
		74	const loginCommand = target.serverName
		75	? `${cliPrefix} login --server ${target.serverName}`
		76	: target.baseUrl
		77	? `${cliPrefix} login --base-url ${connection.origin}`
		78	: `${cliPrefix} login`;
		79
		80	if (!connection.auth) {
		81	return [
		82	`${connection.origin} requires authentication, and no credentials are stored for it.`,
		83	`Run \`${loginCommand}\` to sign in.`,
		84	].join("\n");
		85	}
		86
		87	if (connection.auth.kind === "oauth") {
		88	return [
		89	`You're signed out of ${connection.origin}.`,
		90	`Run \`${loginCommand}\` to sign in again.`,
		91	].join("\n");
		92	}
		93
		94	const envHint =
		95	connection.auth.kind === "bearer" && !profileNameFromConnectionKey(connection.key)
		96	? " If the key came from EXECUTOR_API_KEY or EXECUTOR_AUTH_TOKEN, check that value."
		97	: "";
		98	return [
		99	`${connection.origin} rejected the stored ${connection.auth.kind} credentials (401).${envHint}`,
		100	`Run \`${loginCommand}\` to sign in again.`,
		101	].join("\n");
		102	};
		103
55	export type CliServerConnectionSource =	104	export type CliServerConnectionSource =
56	\| "explicit"	105	\| "explicit"
57	\| "default-profile"	106	\| "default-profile"

CLI: sign-in hint on 401 and a default login server (#1371)

Keyboard shortcuts

General

Issues and pull requests

Issues, pull requests and Inbox

Repository code