feat(bp): support Linux with shared file-based credentials

Author: BlankParticle

packages/bp/src/credentials.ts

@@ -0,0 +1,59 @@
+import { createHash } from "node:crypto";
+import { homedir } from "node:os";
+
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Path from "effect/Path";
+import * as Schema from "effect/Schema";
+
+import { UserError } from "./runtime.ts";
+
+export const Credentials = Schema.Struct({ idToken: Schema.String, expiresAt: Schema.Number });
+export type Credentials = typeof Credentials.Type;
+const oauthError = (message: string) => new UserError({ message });
+
+const credentialsDirectory = (path: Path.Path) => {
+  const config = process.env.XDG_CONFIG_HOME;
+  return path.join(config && path.isAbsolute(config) ? config : path.join(homedir(), ".config"), "bp", "credentials");
+};
+const credentialsFilename = (baseUrl: string) => `${createHash("sha256").update(baseUrl).digest("hex")}.json`;
+
+/** Private file storage shared by macOS and Linux, including headless sessions. */
+export const loadCredentials = (baseUrl: string) =>
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    const raw = yield* fs
+      .readFileString(path.join(credentialsDirectory(path), credentialsFilename(baseUrl)))
+      .pipe(
+        Effect.catch((error) =>
+          error.reason._tag === "NotFound"
+            ? Effect.succeed(null)
+            : Effect.fail(
+                oauthError("could not read OAuth credentials; check permissions on the bp credentials directory"),
+              ),
+        ),
+      );
+    if (raw === null) return null;
+    return yield* Schema.decodeUnknownEffect(Schema.fromJsonString(Credentials))(raw).pipe(
+      Effect.mapError(() => oauthError("stored OAuth credentials are invalid; run `bp login` again")),
+    );
+  });
+
+export const saveCredentials = (baseUrl: string, credentials: Credentials) =>
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    const directory = credentialsDirectory(path);
+    yield* fs.makeDirectory(directory, { recursive: true, mode: 0o700 });
+    yield* fs.chmod(directory, 0o700);
+    const temporary = yield* fs.makeTempDirectoryScoped({ directory, prefix: ".login-" });
+    const file = path.join(temporary, "credentials.json");
+    yield* fs.writeFileString(file, JSON.stringify(credentials), { mode: 0o600, flag: "wx" });
+    yield* fs.rename(file, path.join(directory, credentialsFilename(baseUrl)));
+  }).pipe(
+    Effect.scoped,
+    Effect.mapError(() =>
+      oauthError("could not save OAuth credentials; check permissions on the bp credentials directory"),
+    ),
+  );

packages/bp/src/desktop.ts

@@ -0,0 +1,22 @@
+import * as Effect from "effect/Effect";
+
+import { capture } from "./runtime.ts";
+
+export const useDeviceLogin = (
+  requested: boolean,
+  platform: NodeJS.Platform = process.platform,
+  env: NodeJS.ProcessEnv = process.env,
+) =>
+  requested ||
+  Boolean(env.SSH_CONNECTION || env.SSH_TTY) ||
+  (platform !== "darwin" && (platform !== "linux" || !(env.DISPLAY || env.WAYLAND_DISPLAY)));
+
+/** Best effort: the sign-in URL is always printed if no browser can be launched. */
+export const openBrowser = (url: string) =>
+  Effect.gen(function* () {
+    if (process.platform === "darwin") {
+      if ((yield* capture("open", ["-a", "Helium", url])) === null) yield* capture("open", [url]);
+    } else if (process.platform === "linux") {
+      if ((yield* capture("xdg-open", [url])) === null) yield* capture("gio", ["open", url]);
+    }
+  });

packages/bp/src/oauth.ts

@@ -10,20 +10,19 @@ import * as HttpClientRequest from "effect/http/HttpClientRequest";
 import * as HttpClientResponse from "effect/http/HttpClientResponse";
 import * as Schema from "effect/Schema";
 
-import { capture, exec, UserError } from "./runtime.ts";
+import { type Credentials, loadCredentials, saveCredentials } from "./credentials.ts";
+import { openBrowser, useDeviceLogin } from "./desktop.ts";
+import { UserError } from "./runtime.ts";
 
-const KEYCHAIN_SERVICE = "com.blankparticle.bp.oauth";
 const CALLBACK_TIMEOUT_MS = 2 * 60 * 1000;
 
 const Discovery = Schema.Struct({
   authorization_endpoint: Schema.String,
   token_endpoint: Schema.String,
   device_authorization_endpoint: Schema.optional(Schema.String),
 });
-const TokenResponse = Schema.Struct({ id_token: Schema.String, expires_in: Schema.Number });
 /** The signed id_token is the bearer credential; there is no refresh, `bp login` again once it expires */
-const Credentials = Schema.Struct({ idToken: Schema.String, expiresAt: Schema.Number });
-type Credentials = typeof Credentials.Type;
+const TokenResponse = Schema.Struct({ id_token: Schema.String, expires_in: Schema.Number });
 
 const oauthError = (message: string) => new UserError({ message });
 
@@ -41,31 +40,6 @@ const requestJson = <S extends Schema.ConstraintDecoder<unknown>>(
     Effect.mapError((cause) => (cause instanceof UserError ? cause : oauthError(`OAuth request failed: ${cause}`))),
   );
 
-const keychainCredentials = (baseUrl: string) =>
-  Effect.flatMap(capture("security", ["find-generic-password", "-a", baseUrl, "-s", KEYCHAIN_SERVICE, "-w"]), (raw) => {
-    if (raw === null) return Effect.succeed<Credentials | null>(null);
-    return Effect.try({
-      try: () => Schema.decodeUnknownSync(Credentials)(JSON.parse(raw)),
-      catch: () => oauthError("stored OAuth credentials are invalid; run `bp login` again"),
-    });
-  });
-
-const saveCredentials = (baseUrl: string, credentials: Credentials) =>
-  Effect.flatMap(
-    capture("security", [
-      "add-generic-password",
-      "-U",
-      "-a",
-      baseUrl,
-      "-s",
-      KEYCHAIN_SERVICE,
-      "-w",
-      JSON.stringify(credentials),
-    ]),
-    (result) =>
-      result === null ? Effect.fail(oauthError("could not save OAuth credentials to macOS Keychain")) : Effect.void,
-  );
-
 const randomBase64Url = (bytes: number) =>
   Buffer.from(crypto.getRandomValues(new Uint8Array(bytes))).toString("base64url");
 
@@ -183,10 +157,6 @@ const identity = (resource: string) => ({
   resource,
 });
 
-/** Best effort; on machines without Helium the printed URL is the fallback */
-const openBrowser = (url: string) =>
-  process.platform === "darwin" ? Effect.ignore(exec("open", ["-a", "Helium", url])) : Effect.void;
-
 const store = (resource: string, tokens: { id_token: string; expires_in: number }) =>
   Effect.gen(function* () {
     const credentials: Credentials = { idToken: tokens.id_token, expiresAt: Date.now() + tokens.expires_in * 1000 };
@@ -284,15 +254,14 @@ export const login = (baseUrl: string, options: { device: boolean }) =>
       Discovery,
       HttpClientRequest.get(`${authOrigin()}/.well-known/openid-configuration`),
     );
-    // Off macOS there is no known browser to open, so the code flow is the default there
-    return yield* options.device || process.platform !== "darwin"
+    return yield* useDeviceLogin(options.device)
       ? loginWithDevice(resource, metadata)
       : loginWithBrowser(resource, metadata);
   });
 
 export const accessToken = (baseUrl: string) =>
   Effect.gen(function* () {
-    const credentials = yield* keychainCredentials(new URL(baseUrl).origin);
+    const credentials = yield* loadCredentials(new URL(baseUrl).origin);
     if (credentials === null) return yield* oauthError("not signed in; run `bp login`");
     if (credentials.expiresAt <= Date.now() + 30_000) return yield* oauthError("sign-in expired; run `bp login` again");
     return credentials.idToken;