feat(auth): rewrite auth and session commands as native Go

commands/auth/api_token_login.go

@@ -0,0 +1,96 @@
+package auth
+
+import (
+	"bufio"
+	"errors"
+	"fmt"
+	"os"
+	"strings"
+
+	"github.com/spf13/cobra"
+
+	cobrahelp "github.com/upsun/cli/commands/cobrahelp"
+	"github.com/upsun/cli/internal/config"
+	"github.com/upsun/cli/internal/session"
+)
+
+func NewAPITokenLoginCommand(cfg *config.Config) *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "auth:api-token-login",
+		Short: "Log in using an API token",
+		Args:  cobra.MaximumNArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			// Block if TOKEN env var is already set via config.
+			if os.Getenv(cfg.Application.EnvPrefix+"TOKEN") != "" {
+				fmt.Fprintln(cmd.ErrOrStderr(), "An API token is already set via config")
+				return fmt.Errorf("an API token is already set via config")
+			}
+			// Non-interactive guard only when no arg (stdin would be needed).
+			if len(args) == 0 && os.Getenv(cfg.Application.EnvPrefix+"NO_INTERACTION") != "" {
+				fmt.Fprintln(cmd.ErrOrStderr(), "Non-interactive use of this command is not supported.")
+				return fmt.Errorf("non-interactive use of this command is not supported")
+			}
+
+			var (
+				apiToken string
+				s        *session.Session
+			)
+			if len(args) > 0 {
+				apiToken = strings.TrimSpace(args[0])
+				var err error
+				s, err = exchangeAPIToken(cmd.Context(), cfg, apiToken)
+				if err != nil {
+					return fmt.Errorf("login failed: %w", err)
+				}
+			} else {
+				const maxAttempts = 5
+				scanner := bufio.NewScanner(cmd.InOrStdin())
+				for attempt := 1; attempt <= maxAttempts; attempt++ {
+					fmt.Fprint(cmd.ErrOrStderr(), "Enter your API token: ")
+					if !scanner.Scan() {
+						return fmt.Errorf("read API token: %w", scanner.Err())
+					}
+					apiToken = strings.TrimSpace(scanner.Text())
+					if apiToken == "" {
+						fmt.Fprintln(cmd.ErrOrStderr(), "The token cannot be empty")
+						continue
+					}
+					var err error
+					s, err = exchangeAPIToken(cmd.Context(), cfg, apiToken)
+					if err == nil {
+						break
+					}
+					if errors.Is(err, ErrInvalidAPIToken) {
+						fmt.Fprintln(cmd.ErrOrStderr(), ErrInvalidAPIToken.Error())
+						if attempt == maxAttempts {
+							return fmt.Errorf("login failed after %d attempts", maxAttempts)
+						}
+						continue
+					}
+					return fmt.Errorf("login failed: %w", err)
+				}
+			}
+			fmt.Fprintln(cmd.ErrOrStderr(), "The API token is valid.")
+
+			mgr, err := session.New(cfg)
+			if err != nil {
+				return err
+			}
+			if err := mgr.SetAPIToken(apiToken); err != nil {
+				return err
+			}
+			if err := mgr.Save(s); err != nil {
+				return err
+			}
+
+			fmt.Fprintln(cmd.ErrOrStderr(), "You are logged in.")
+			if err := printUserInfo(cmd.Context(), mgr, cfg, cmd.ErrOrStderr()); err != nil {
+				return err
+			}
+			delegateSSHFinalization(cmd.Context(), cfg, cmd)
+			return nil
+		},
+	}
+	cobrahelp.SetPhpStyle(cmd)
+	return cmd
+}

commands/auth/browser_login.go

@@ -0,0 +1,122 @@
+// commands/auth/browser_login.go
+package auth
+
+import (
+	"bufio"
+	"fmt"
+	"os"
+	"strings"
+	"time"
+
+	"github.com/spf13/cobra"
+
+	cobrahelp "github.com/upsun/cli/commands/cobrahelp"
+	internalauth "github.com/upsun/cli/internal/auth"
+	"github.com/upsun/cli/internal/config"
+	"github.com/upsun/cli/internal/session"
+)
+
+func NewBrowserLoginCommand(cfg *config.Config) *cobra.Command {
+	var (
+		force   bool
+		methods []string
+		maxAge  int
+	)
+	cmd := &cobra.Command{
+		Use:     "auth:browser-login",
+		Aliases: []string{"login"},
+		Short:   "Log in via a browser",
+		RunE: func(cmd *cobra.Command, _ []string) error {
+			// If an API token is configured, browser login is not applicable.
+			if apiToken := os.Getenv(cfg.Application.EnvPrefix + "TOKEN"); apiToken != "" {
+				return fmt.Errorf("cannot log in via the browser while an API token is set (%sTOKEN)", cfg.Application.EnvPrefix)
+			}
+
+			mgr, err := session.New(cfg)
+			if err != nil {
+				return err
+			}
+
+			// Also check for an API token in the session.
+			if storedToken, err := mgr.GetAPIToken(); err == nil && storedToken != "" {
+				return fmt.Errorf("cannot log in via the browser while an API token is configured")
+			}
+
+			// Non-interactive guard.
+			if os.Getenv(cfg.Application.EnvPrefix+"NO_INTERACTION") != "" {
+				fmt.Fprintln(cmd.ErrOrStderr(), "Non-interactive use of this command is not supported.")
+				return fmt.Errorf("non-interactive use of this command is not supported")
+			}
+
+			printSessionID(cmd.ErrOrStderr(), cfg, mgr)
+
+			hasMaxAge := cmd.Flags().Changed("max-age")
+
+			// Check if already logged in (unless --force).
+			if !force && len(methods) == 0 && !hasMaxAge {
+				s, err := mgr.Load()
+				if err == nil && s != nil && s.AccessToken != "" && time.Now().Unix() < s.Expires {
+					fmt.Fprintf(cmd.ErrOrStderr(), "You are already logged in as a user.\n")
+					fmt.Fprint(cmd.ErrOrStderr(), "Log in anyway? [y/N] ")
+					scanner := bufio.NewScanner(cmd.InOrStdin())
+					scanner.Scan()
+					answer := strings.TrimSpace(strings.ToLower(scanner.Text()))
+					if answer != "y" && answer != "yes" {
+						return fmt.Errorf("login canceled")
+					}
+					force = true
+				}
+			}
+
+			flow := internalauth.NewBrowserFlow(cfg)
+			opts := internalauth.BrowserFlowOptions{
+				Force:   force,
+				Methods: methods,
+				Stderr:  cmd.ErrOrStderr(),
+				OnCodeReceived: func() {
+					fmt.Fprintln(cmd.ErrOrStderr(), "Login information received. Verifying...")
+				},
+			}
+			if hasMaxAge {
+				opts.MaxAge = &maxAge
+			}
+
+			fmt.Fprintf(cmd.ErrOrStderr(),
+				"\nHelp:\n  Leave this command running during login.\n  If you need to quit, use Ctrl+C.\n\n")
+
+			s, err := flow.Run(cmd.Context(), opts)
+			if err != nil {
+				return err
+			}
+
+			if err := mgr.Save(s); err != nil {
+				return err
+			}
+
+			if s.RefreshToken == "" {
+				clientID := cfg.API.OAuth2ClientID
+				fmt.Fprintln(cmd.ErrOrStderr(), "")
+				fmt.Fprintln(cmd.ErrOrStderr(), "Warning:")
+				fmt.Fprintln(cmd.ErrOrStderr(), "No refresh token is available. This will cause frequent login errors.")
+				fmt.Fprintln(cmd.ErrOrStderr(), "Please contact support.")
+				fmt.Fprintf(cmd.ErrOrStderr(),
+					"For internal use: the OAuth 2 client is probably misconfigured (client ID: %s).\n",
+					clientID)
+			}
+
+			fmt.Fprintln(cmd.ErrOrStderr(), "You are logged in.")
+
+			if err := printUserInfo(cmd.Context(), mgr, cfg, cmd.ErrOrStderr()); err != nil {
+				fmt.Fprintf(cmd.ErrOrStderr(), "Warning: could not retrieve user info: %v\n", err)
+			}
+
+			delegateSSHFinalization(cmd.Context(), cfg, cmd)
+			return nil
+		},
+	}
+	cmd.Flags().BoolVarP(&force, "force", "f", false, "Log in again, even if already logged in")
+	cmd.Flags().StringArrayVar(&methods, "method", nil, "Require specific authentication method(s)")
+	cmd.Flags().IntVar(&maxAge, "max-age", 0, "Maximum age (seconds) of the web authentication session")
+	cobrahelp.SetPhpStyle(cmd)
+	return cmd
+}

commands/auth/helpers.go

@@ -0,0 +1,156 @@
+package auth
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"net/http"
+	"os"
+	"strings"
+
+	"golang.org/x/oauth2"
+
+	"github.com/upsun/cli/internal/api"
+	internalauth "github.com/upsun/cli/internal/auth"
+	"github.com/upsun/cli/internal/config"
+	"github.com/upsun/cli/internal/legacy"
+	"github.com/upsun/cli/internal/session"
+)
+
+// InjectSessionCredentials injects stored credentials into a legacy PHP CLI wrapper so PHP
+// can authenticate without relying on the OS credential helper (e.g. macOS Keychain).
+// Respects an already-set TOKEN env var and is a no-op if session loading fails.
+func InjectSessionCredentials(cfg *config.Config, wrapper *legacy.CLIWrapper) {
+	envPrefix := cfg.Application.EnvPrefix
+	if os.Getenv(envPrefix+"TOKEN") != "" {
+		return
+	}
+	mgr, err := session.New(cfg)
+	if err != nil {
+		return
+	}
+	if apiToken, err := mgr.GetAPIToken(); err == nil && apiToken != "" {
+		wrapper.ExtraEnv = append(wrapper.ExtraEnv, envPrefix+"TOKEN="+apiToken)
+		return
+	}
+	if s, err := mgr.Load(); err == nil && s != nil && s.AccessToken != "" {
+		wrapper.ExtraEnv = append(wrapper.ExtraEnv, envPrefix+"API_TOKEN="+s.AccessToken)
+	}
+}
+
+// httpClient is used for all outbound HTTP requests in this package.
+// Can be replaced in tests to inject a custom transport.
+var httpClient *http.Client = http.DefaultClient
+
+// resolveBaseURL returns the API base URL, preferring the env var override.
+func resolveBaseURL(cfg *config.Config) string {
+	if v := os.Getenv(cfg.Application.EnvPrefix + "API_URL"); v != "" {
+		return v
+	}
+	return cfg.API.BaseURL
+}
+
+// newAPIClient creates an authenticated API client for commands.
+//
+// Auth priority:
+//  1. API token from env var ({EnvPrefix}TOKEN) or session storage — exchanged for OAuth access token.
+//  2. Session OAuth token — used directly.
+func newAPIClient(ctx context.Context, mgr *session.Manager, cfg *config.Config) (*api.Client, error) {
+	// Check for API token in env or session storage.
+	apiToken := os.Getenv(cfg.Application.EnvPrefix + "TOKEN")
+	if apiToken == "" {
+		var err error
+		apiToken, err = mgr.GetAPIToken()
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	if apiToken != "" {
+		// Exchange the API token for an OAuth2 access token.
+		s, err := exchangeAPIToken(ctx, cfg, apiToken)
+		if err != nil {
+			return nil, err
+		}
+		ts := oauth2.StaticTokenSource(&oauth2.Token{AccessToken: s.AccessToken})
+		return api.NewClient(resolveBaseURL(cfg), oauth2.NewClient(ctx, ts))
+	}
+
+	// Fall back to session-based OAuth token source.
+	authClient, err := internalauth.NewClient(ctx, mgr, cfg)
+	if err != nil {
+		return nil, err
+	}
+	return api.NewClient(resolveBaseURL(cfg), authClient.HTTPClient)
+}
+
+// printSessionID prints the current session ID hint when the session is non-default or
+// multiple sessions exist, followed by a blank line. No-ops otherwise.
+func printSessionID(w io.Writer, cfg *config.Config, mgr *session.Manager) {
+	sessionID := mgr.SessionID()
+	ids, _ := mgr.List()
+	if sessionID == "default" && len(ids) <= 1 {
+		return
+	}
+	fmt.Fprintf(w, "The current session ID is: %s\n", sessionID)
+	if os.Getenv(cfg.Application.EnvPrefix+"SESSION_ID") == "" {
+		fmt.Fprintf(w, "Change this using: %s session:switch\n", cfg.Application.Executable)
+	}
+	fmt.Fprintln(w)
+}
+
+// printUserInfo fetches and prints the current user's info to w (used post-login).
+func printUserInfo(ctx context.Context, mgr *session.Manager, cfg *config.Config, w io.Writer) error {
+	apiClient, err := newAPIClient(ctx, mgr, cfg)
+	if err != nil {
+		return err
+	}
+	info, err := apiClient.GetMyUser(ctx, false)
+	if err != nil {
+		return err
+	}
+	username, _ := info["username"].(string)
+	email, _ := info["email"].(string)
+	fmt.Fprintf(w, "Logged in as: %s (%s)\n", username, email)
+	return nil
+}
+
+// printTable writes a two-column property/value table to w.
+func printTable(w io.Writer, properties []string, data map[string]interface{}) {
+	col1 := len("Property")
+	col2 := len("Value")
+	for _, p := range properties {
+		if len(p) > col1 {
+			col1 = len(p)
+		}
+		v := formatValue(data[p])
+		if len(v) > col2 {
+			col2 = len(v)
+		}
+	}
+	sep := "+" + strings.Repeat("-", col1+2) + "+" + strings.Repeat("-", col2+2) + "+"
+	fmt.Fprintln(w, sep)
+	fmt.Fprintf(w, "| %-*s | %-*s |\n", col1, "Property", col2, "Value")
+	fmt.Fprintln(w, sep)
+	for _, p := range properties {
+		v := formatValue(data[p])
+		fmt.Fprintf(w, "| %-*s | %-*s |\n", col1, p, col2, v)
+	}
+	fmt.Fprintln(w, sep)
+}
+
+// formatValue converts an interface{} to a display string.
+func formatValue(v interface{}) string {
+	if v == nil {
+		return ""
+	}
+	switch val := v.(type) {
+	case bool:
+		if val {
+			return "true"
+		}
+		return "false"
+	default:
+		return strings.TrimSpace(fmt.Sprintf("%v", val))
+	}
+}