// @effect-diagnostics nodeBuiltinImport:off - The CLI loopback OAuth callback is a Node HTTP boundary.import * as NodeHttp from "node:http"; import * as NodeHttpServer from "@effect/platform-node/NodeHttpServer";import * as Clock from "effect/Clock";import * as Console from "effect/Console";import * as Context from "effect/Context";import * as Crypto from "effect/Crypto";import * as Deferred from "effect/Deferred";import * as Duration from "effect/Duration";import * as Effect from "effect/Effect";import * as Encoding from "effect/Encoding";import * as Layer from "effect/Layer";import * as Option from "effect/Option";import * as Schema from "effect/Schema";import * as Semaphore from "effect/Semaphore";import * as HttpClient from "effect/unstable/http/HttpClient";import * as HttpClientRequest from "effect/unstable/http/HttpClientRequest";import * as HttpClientResponse from "effect/unstable/http/HttpClientResponse";import * as HttpRouter from "effect/unstable/http/HttpRouter";import * as HttpServerRequest from "effect/unstable/http/HttpServerRequest";import * as HttpServerResponse from "effect/unstable/http/HttpServerResponse"; import * as ServerSecretStore from "../auth/ServerSecretStore.ts";import { cloudCliOAuthConfig, type CloudCliOAuthConfig } from "./publicConfig.ts"; const CLOUD_CLI_OAUTH_TOKEN_SECRET = "cloud-cli-oauth-token";const CLOUD_CLI_OAUTH_CALLBACK_TIMEOUT = Duration.minutes(10);const CLOUD_CLI_OAUTH_REFRESH_EARLY_MS = Duration.toMillis(Duration.minutes(5));const CLOUD_CLI_OAUTH_CALLBACK_HOST = "127.0.0.1";const CLOUD_CLI_OAUTH_CALLBACK_PORT = 34338; const PersistedToken = Schema.Struct({  accessToken: Schema.String,  refreshToken: Schema.String,  expiresAtEpochMs: Schema.Number,});type PersistedToken = typeof PersistedToken.Type; const PersistedTokenJson = Schema.fromJsonString(PersistedToken);const decodePersistedToken = Schema.decodeUnknownEffect(PersistedTokenJson);const encodePersistedToken = Schema.encodeEffect(PersistedTokenJson); const OAuthTokenResponse = Schema.Struct({  access_token: Schema.String,  refresh_token: Schema.optional(Schema.String),  expires_in: Schema.Number,  token_type: Schema.String,}); type CredentialReadFailure = ServerSecretStore.SecretStoreReadError | Schema.SchemaError; type CredentialPersistFailure =  | Schema.SchemaError  | ServerSecretStore.SecretStoreTemporaryPathGenerationError  | ServerSecretStore.SecretStorePersistError; const CloudCliCredentialRefreshStage = Schema.Literals([  "read-credential",  "decode-credential",  "load-oauth-config",  "exchange-token",  "encode-credential",  "persist-credential",]); const CloudCliAuthorizationStage = Schema.Literals([  "load-oauth-config",  "prepare-pkce",  "start-callback-server",  "exchange-token",  "encode-credential",  "persist-credential",]); export class CloudCliCredentialRemovalError extends Schema.TaggedErrorClass<CloudCliCredentialRemovalError>()(  "CloudCliCredentialRemovalError",  {    secretName: Schema.Literal(CLOUD_CLI_OAUTH_TOKEN_SECRET),    cause: Schema.Defect(),  },) {  override get message(): string {    return `Could not remove the stored T3 Connect CLI credential ${this.secretName}.`;  }} export class CloudCliCredentialRefreshError extends Schema.TaggedErrorClass<CloudCliCredentialRefreshError>()(  "CloudCliCredentialRefreshError",  {    stage: CloudCliCredentialRefreshStage,    secretName: Schema.Literal(CLOUD_CLI_OAUTH_TOKEN_SECRET),    tokenEndpoint: Schema.optional(Schema.String),    cause: Schema.Defect(),  },) {  static fromCredentialRead(cause: CredentialReadFailure): CloudCliCredentialRefreshError {    return new CloudCliCredentialRefreshError({      stage: cause._tag === "SecretStoreReadError" ? "read-credential" : "decode-credential",      secretName: CLOUD_CLI_OAUTH_TOKEN_SECRET,      cause,    });  }   static fromCredentialPersist(cause: CredentialPersistFailure): CloudCliCredentialRefreshError {    return new CloudCliCredentialRefreshError({      stage: cause._tag === "SchemaError" ? "encode-credential" : "persist-credential",      secretName: CLOUD_CLI_OAUTH_TOKEN_SECRET,      cause,    });  }   override get message(): string {    const tokenEndpoint = this.tokenEndpoint ? ` using ${this.tokenEndpoint}` : "";    return `Could not refresh the T3 Connect CLI credential ${this.secretName} during ${this.stage}${tokenEndpoint}.`;  }} export class CloudCliCredentialReadError extends Schema.TaggedErrorClass<CloudCliCredentialReadError>()(  "CloudCliCredentialReadError",  {    stage: Schema.Literals(["read-credential", "decode-credential"]),    secretName: Schema.Literal(CLOUD_CLI_OAUTH_TOKEN_SECRET),    cause: Schema.Defect(),  },) {  static fromCredentialRead(cause: CredentialReadFailure): CloudCliCredentialReadError {    return new CloudCliCredentialReadError({      stage: cause._tag === "SecretStoreReadError" ? "read-credential" : "decode-credential",      secretName: CLOUD_CLI_OAUTH_TOKEN_SECRET,      cause,    });  }   override get message(): string {    return `Could not inspect the stored T3 Connect CLI credential ${this.secretName} during ${this.stage}.`;  }} export class CloudCliAuthorizationError extends Schema.TaggedErrorClass<CloudCliAuthorizationError>()(  "CloudCliAuthorizationError",  {    stage: CloudCliAuthorizationStage,    secretName: Schema.Literal(CLOUD_CLI_OAUTH_TOKEN_SECRET),    tokenEndpoint: Schema.optional(Schema.String),    redirectUri: Schema.optional(Schema.String),    callbackHost: Schema.optional(Schema.String),    callbackPort: Schema.optional(Schema.Number),    cause: Schema.Defect(),  },) {  static fromCredentialPersist(cause: CredentialPersistFailure): CloudCliAuthorizationError {    return new CloudCliAuthorizationError({      stage: cause._tag === "SchemaError" ? "encode-credential" : "persist-credential",      secretName: CLOUD_CLI_OAUTH_TOKEN_SECRET,      cause,    });  }   override get message(): string {    const tokenEndpoint = this.tokenEndpoint ? ` using ${this.tokenEndpoint}` : "";    const redirectUri = this.redirectUri ? ` with callback ${this.redirectUri}` : "";    const callbackAddress =      this.callbackHost && this.callbackPort !== undefined        ? ` on ${this.callbackHost}:${this.callbackPort}`        : "";    return `Could not authorize the T3 Connect CLI credential ${this.secretName} during ${this.stage}${tokenEndpoint}${redirectUri}${callbackAddress}.`;  }} export class CloudCliAuthorizationTimeoutError extends Schema.TaggedErrorClass<CloudCliAuthorizationTimeoutError>()(  "CloudCliAuthorizationTimeoutError",  {    redirectUri: Schema.String,    timeoutMillis: Schema.Number,    cause: Schema.Defect(),  },) {  override get message(): string {    return `Timed out after ${this.timeoutMillis}ms waiting for T3 Connect authorization at ${this.redirectUri}.`;  }} export const CloudCliTokenManagerError = Schema.Union([  CloudCliCredentialRemovalError,  CloudCliCredentialRefreshError,  CloudCliCredentialReadError,  CloudCliAuthorizationError,  CloudCliAuthorizationTimeoutError,]);export type CloudCliTokenManagerError = typeof CloudCliTokenManagerError.Type; export class CloudCliTokenManager extends Context.Service<  CloudCliTokenManager,  {    readonly get: Effect.Effect<      PersistedToken,      | CloudCliCredentialRefreshError      | CloudCliAuthorizationError      | CloudCliAuthorizationTimeoutError    >;    readonly getExisting: Effect.Effect<      Option.Option<PersistedToken>,      CloudCliCredentialRefreshError    >;    readonly hasCredential: Effect.Effect<boolean, CloudCliCredentialReadError>;    readonly clear: Effect.Effect<void, CloudCliCredentialRemovalError>;  }>()("t3/cloud/CliTokenManager/CloudCliTokenManager") {} function stringToBytes(value: string): Uint8Array {  return new TextEncoder().encode(value);} function bytesToString(value: Uint8Array): string {  return new TextDecoder().decode(value);} export const make = Effect.gen(function* () {  const crypto = yield* Crypto.Crypto;  const httpClient = (yield* HttpClient.HttpClient).pipe(HttpClient.filterStatusOk);  const secrets = yield* ServerSecretStore.ServerSecretStore;  const semaphore = yield* Semaphore.make(1);  const persist = Effect.fn("cloud.cli_token.persist")(function* (token: PersistedToken) {    const encoded = yield* encodePersistedToken(token);    yield* secrets.set(CLOUD_CLI_OAUTH_TOKEN_SECRET, stringToBytes(encoded));    return token;  });   const clear = secrets.remove(CLOUD_CLI_OAUTH_TOKEN_SECRET).pipe(    Effect.mapError(      (cause) =>        new CloudCliCredentialRemovalError({          secretName: CLOUD_CLI_OAUTH_TOKEN_SECRET,          cause,        }),    ),  );   const read = Effect.fn("cloud.cli_token.read")(function* () {    const encoded = yield* secrets.get(CLOUD_CLI_OAUTH_TOKEN_SECRET);    if (Option.isNone(encoded)) return Option.none<PersistedToken>();    return Option.some(yield* decodePersistedToken(bytesToString(encoded.value)));  });   const exchangeToken = Effect.fn("cloud.cli_token.exchange")(function* (    metadata: CloudCliOAuthConfig,    params: Record<string, string>,  ) {    const response = yield* HttpClientRequest.post(metadata.tokenEndpoint).pipe(      HttpClientRequest.bodyUrlParams(params),      httpClient.execute,      Effect.flatMap(HttpClientResponse.schemaBodyJson(OAuthTokenResponse)),    );    const now = yield* Clock.currentTimeMillis;    return {      accessToken: response.access_token,      refreshToken: response.refresh_token ?? params.refresh_token ?? "",      expiresAtEpochMs: now + response.expires_in * 1_000,    } satisfies PersistedToken;  });   const refresh = Effect.fn("cloud.cli_token.refresh")(function* (token: PersistedToken) {    const metadata = yield* cloudCliOAuthConfig.pipe(      Effect.mapError(        (cause) =>          new CloudCliCredentialRefreshError({            stage: "load-oauth-config",            secretName: CLOUD_CLI_OAUTH_TOKEN_SECRET,            cause,          }),      ),    );    return yield* exchangeToken(metadata, {      grant_type: "refresh_token",      refresh_token: token.refreshToken,      client_id: metadata.clientId,    }).pipe(      Effect.mapError(        (cause) =>          new CloudCliCredentialRefreshError({            stage: "exchange-token",            secretName: CLOUD_CLI_OAUTH_TOKEN_SECRET,            tokenEndpoint: metadata.tokenEndpoint,            cause,          }),      ),    );  });   const login = Effect.fn("cloud.cli_token.login")(function* () {    const metadata = yield* cloudCliOAuthConfig.pipe(      Effect.mapError(        (cause) =>          new CloudCliAuthorizationError({            stage: "load-oauth-config",            secretName: CLOUD_CLI_OAUTH_TOKEN_SECRET,            cause,          }),      ),    );    const { challenge, state, verifier } = yield* Effect.gen(function* () {      const verifier = Encoding.encodeBase64Url(yield* crypto.randomBytes(32));      const challenge = Encoding.encodeBase64Url(        yield* crypto.digest("SHA-256", new TextEncoder().encode(verifier)),      );      const state = yield* crypto.randomUUIDv4;      return { challenge, state, verifier };    }).pipe(      Effect.mapError(        (cause) =>          new CloudCliAuthorizationError({            stage: "prepare-pkce",            secretName: CLOUD_CLI_OAUTH_TOKEN_SECRET,            redirectUri: metadata.redirectUri,            cause,          }),      ),    );    const callback = yield* Deferred.make<string>();    const callbackRoute = HttpRouter.add(      "GET",      "/callback",      Effect.gen(function* () {        const request = yield* HttpServerRequest.HttpServerRequest;        const url = new URL(request.originalUrl, metadata.redirectUri);        const code = url.searchParams.get("code");        if (url.searchParams.get("state") !== state || !code) {          return HttpServerResponse.text("Invalid T3 Connect authorization callback.", {            status: 400,          });        }        yield* Deferred.succeed(callback, code);        return yield* HttpServerResponse.html`<html>  <body style="font-family: sans-serif; text-align: center; margin-top: 50px;">    <h1>T3 Connect authorization complete</h1>    <p>You can close this window and return to your terminal.</p>  </body></html>`;      }),    );    yield* HttpRouter.serve(callbackRoute, {      disableListenLog: true,      disableLogger: true,    }).pipe(      Layer.provide(        NodeHttpServer.layer(NodeHttp.createServer, {          host: CLOUD_CLI_OAUTH_CALLBACK_HOST,          port: CLOUD_CLI_OAUTH_CALLBACK_PORT,          disablePreemptiveShutdown: true,        }),      ),      Layer.build,      Effect.mapError(        (cause) =>          new CloudCliAuthorizationError({            stage: "start-callback-server",            secretName: CLOUD_CLI_OAUTH_TOKEN_SECRET,            redirectUri: metadata.redirectUri,            callbackHost: CLOUD_CLI_OAUTH_CALLBACK_HOST,            callbackPort: CLOUD_CLI_OAUTH_CALLBACK_PORT,            cause,          }),      ),    );    const authorizationUrl = new URL(metadata.authorizationEndpoint);    authorizationUrl.searchParams.set("client_id", metadata.clientId);    authorizationUrl.searchParams.set("redirect_uri", metadata.redirectUri);    authorizationUrl.searchParams.set("response_type", "code");    authorizationUrl.searchParams.set("scope", metadata.scopes.join(" "));    authorizationUrl.searchParams.set("state", state);    authorizationUrl.searchParams.set("code_challenge", challenge);    authorizationUrl.searchParams.set("code_challenge_method", "S256");    yield* Console.log(`Open this URL to authorize T3 Connect:\n${authorizationUrl.toString()}\n`);    const code = yield* Deferred.await(callback).pipe(      Effect.timeout(CLOUD_CLI_OAUTH_CALLBACK_TIMEOUT),      Effect.catchTags({        TimeoutError: (cause) =>          Effect.fail(            new CloudCliAuthorizationTimeoutError({              redirectUri: metadata.redirectUri,              timeoutMillis: Duration.toMillis(CLOUD_CLI_OAUTH_CALLBACK_TIMEOUT),              cause,            }),          ),      }),    );    return yield* exchangeToken(metadata, {      grant_type: "authorization_code",      code,      redirect_uri: metadata.redirectUri,      client_id: metadata.clientId,      code_verifier: verifier,    }).pipe(      Effect.mapError(        (cause) =>          new CloudCliAuthorizationError({            stage: "exchange-token",            secretName: CLOUD_CLI_OAUTH_TOKEN_SECRET,            tokenEndpoint: metadata.tokenEndpoint,            redirectUri: metadata.redirectUri,            cause,          }),      ),    );  });   const getExistingNoLock = Effect.fn("cloud.cli_token.get_existing_no_lock")(function* () {    const token = yield* read().pipe(      Effect.mapError(CloudCliCredentialRefreshError.fromCredentialRead),    );    if (Option.isNone(token)) return token;    const now = yield* Clock.currentTimeMillis;    if (token.value.expiresAtEpochMs - CLOUD_CLI_OAUTH_REFRESH_EARLY_MS > now) {      return token;    }    return Option.some(      yield* refresh(token.value).pipe(        Effect.flatMap((refreshed) =>          persist(refreshed).pipe(            Effect.mapError(CloudCliCredentialRefreshError.fromCredentialPersist),          ),        ),      ),    );  });   const getExisting = semaphore.withPermits(1)(getExistingNoLock());  const hasCredential = semaphore.withPermits(1)(    read().pipe(      Effect.map(Option.isSome),      Effect.mapError(CloudCliCredentialReadError.fromCredentialRead),    ),  );  const get = semaphore.withPermits(1)(    Effect.gen(function* () {      const token = yield* getExistingNoLock();      return Option.isSome(token)        ? token.value        : yield* Effect.scoped(login()).pipe(            Effect.flatMap((authorized) =>              persist(authorized).pipe(                Effect.mapError(CloudCliAuthorizationError.fromCredentialPersist),              ),            ),          );    }),  );   return CloudCliTokenManager.of({ get, getExisting, hasCredential, clear });}); export const layer = Layer.effect(CloudCliTokenManager, make);