= None;
+ for (k, v) in url::form_urlencoded::parse(query.as_bytes()) {
+ match k.as_ref() {
+ "token" => token = Some(v.into_owned()),
+ "state" => state = Some(v.into_owned()),
+ "error" => error = Some(v.into_owned()),
+ _ => {}
+ }
+ }
+
+ // Constant-time enough: states are short, equal length on success path.
+ if state.as_deref() != Some(expected_state) {
+ respond(
+ &mut stream,
+ 400,
+ "bad state",
+ "State mismatch
Re-run wk login to start over.
",
+ )?;
+ bail!("state mismatch — refusing token");
+ }
+
+ if let Some(err) = error {
+ respond(
+ &mut stream,
+ 200,
+ "OK",
+ &format!(
+ "Login cancelled
You can close this tab and re-run wk login.
reason: {}
",
+ html_escape(&err),
+ ),
+ )?;
+ bail!("login cancelled in browser ({err})");
+ }
+
+ let Some(tok) = token else {
+ respond(&mut stream, 400, "missing token", "missing token")?;
+ bail!("callback missing token");
+ };
+
+ respond(
+ &mut stream,
+ 200,
+ "OK",
+ "WaveKat CLI signed inYou're signed in.
You can close this tab and return to your terminal.
",
+ )?;
+ Ok(Some(tok))
+}
+
+fn respond(stream: &mut TcpStream, status: u16, reason: &str, body: &str) -> Result<()> {
+ let body_bytes = body.as_bytes();
+ let resp = format!(
+ "HTTP/1.1 {status} {reason}\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: {len}\r\nConnection: close\r\n\r\n",
+ len = body_bytes.len(),
+ );
+ stream.write_all(resp.as_bytes())?;
+ stream.write_all(body_bytes)?;
+ // Drain any unread bytes so the kernel doesn't RST the connection
+ // before the browser reads our response.
+ let _ = stream.flush();
+ let mut sink = [0u8; 64];
+ let _ = stream.set_read_timeout(Some(Duration::from_millis(50)));
+ let _ = stream.read(&mut sink);
+ Ok(())
+}
+
+fn random_state() -> String {
+ let mut bytes = [0u8; 24];
+ rand::thread_rng().fill_bytes(&mut bytes);
+ // URL-safe base64 (manual, to avoid pulling in another crate).
+ base64url(&bytes)
+}
+
+fn base64url(bytes: &[u8]) -> String {
+ const ALPHA: &[u8; 64] = b"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+ let mut out = String::with_capacity((bytes.len() * 4).div_ceil(3));
+ let mut i = 0;
+ while i + 3 <= bytes.len() {
+ let n = ((bytes[i] as u32) << 16) | ((bytes[i + 1] as u32) << 8) | (bytes[i + 2] as u32);
+ out.push(ALPHA[((n >> 18) & 0x3f) as usize] as char);
+ out.push(ALPHA[((n >> 12) & 0x3f) as usize] as char);
+ out.push(ALPHA[((n >> 6) & 0x3f) as usize] as char);
+ out.push(ALPHA[(n & 0x3f) as usize] as char);
+ i += 3;
+ }
+ let rem = bytes.len() - i;
+ if rem == 1 {
+ let n = (bytes[i] as u32) << 16;
+ out.push(ALPHA[((n >> 18) & 0x3f) as usize] as char);
+ out.push(ALPHA[((n >> 12) & 0x3f) as usize] as char);
+ } else if rem == 2 {
+ let n = ((bytes[i] as u32) << 16) | ((bytes[i + 1] as u32) << 8);
+ out.push(ALPHA[((n >> 18) & 0x3f) as usize] as char);
+ out.push(ALPHA[((n >> 12) & 0x3f) as usize] as char);
+ out.push(ALPHA[((n >> 6) & 0x3f) as usize] as char);
+ }
+ out
+}
+
+fn client_name() -> String {
+ let host = std::env::var("HOSTNAME")
+ .ok()
+ .or_else(|| hostname().ok())
+ .unwrap_or_else(|| "unknown-host".to_string());
+ format!("wavekat-cli on {host}")
+}
+
+#[cfg(unix)]
+fn hostname() -> Result {
+ let out = std::process::Command::new("hostname").output()?;
+ if !out.status.success() {
+ return Err(anyhow!("hostname exited non-zero"));
+ }
+ Ok(String::from_utf8_lossy(&out.stdout).trim().to_string())
+}
+
+#[cfg(not(unix))]
+fn hostname() -> Result {
+ std::env::var("COMPUTERNAME").map_err(|e| anyhow!(e))
+}
+
+fn html_escape(s: &str) -> String {
+ let mut out = String::with_capacity(s.len());
+ for c in s.chars() {
+ match c {
+ '<' => out.push_str("<"),
+ '>' => out.push_str(">"),
+ '&' => out.push_str("&"),
+ '"' => out.push_str("""),
+ '\'' => out.push_str("'"),
+ _ => out.push(c),
+ }
+ }
+ out
+}
+
+#[cfg(test)]
+mod tests {
+ use super::*;
+
+ // RFC 4648 test vectors, adapted to URL-safe alphabet without padding.
+ #[test]
+ fn base64url_rfc_vectors() {
+ assert_eq!(base64url(b""), "");
+ assert_eq!(base64url(b"f"), "Zg");
+ assert_eq!(base64url(b"fo"), "Zm8");
+ assert_eq!(base64url(b"foo"), "Zm9v");
+ assert_eq!(base64url(b"foob"), "Zm9vYg");
+ assert_eq!(base64url(b"fooba"), "Zm9vYmE");
+ assert_eq!(base64url(b"foobar"), "Zm9vYmFy");
+ }
+
+ #[test]
+ fn base64url_uses_url_safe_alphabet() {
+ // Bytes that would yield `+` and `/` under standard base64.
+ // 0xfb,0xff,0xff -> 6-bit indices 62, 63, 63, 63 -> "-___".
+ assert_eq!(base64url(&[0xfb, 0xff, 0xff]), "-___");
+ // Confirm none of the disallowed characters ever appear.
+ let big: Vec = (0u8..=255).collect();
+ let out = base64url(&big);
+ assert!(!out.contains('+'));
+ assert!(!out.contains('/'));
+ assert!(!out.contains('='));
+ }
+
+ #[test]
+ fn random_state_shape() {
+ let s = random_state();
+ // 24 bytes -> 32 base64url chars (no padding).
+ assert_eq!(s.len(), 32);
+ let alpha: &[u8] = b"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+ for b in s.as_bytes() {
+ assert!(alpha.contains(b), "unexpected byte {b:#x} in state");
+ }
+ }
+
+ #[test]
+ fn random_state_is_not_constant() {
+ // Astronomically unlikely to collide; protects against an accidental
+ // hard-coded or zeroed RNG.
+ assert_ne!(random_state(), random_state());
+ }
+
+ #[test]
+ fn html_escape_handles_metacharacters() {
+ assert_eq!(
+ html_escape("it's & ok"),
+ "<a href="x">it's & ok</a>",
+ );
+ assert_eq!(html_escape("plain text"), "plain text");
+ assert_eq!(html_escape(""), "");
}
- Ok(buf)
}
diff --git a/src/commands/logout.rs b/src/commands/logout.rs
index d6cb2ce..ea2515b 100644
--- a/src/commands/logout.rs
+++ b/src/commands/logout.rs
@@ -1,12 +1,23 @@
use anyhow::Result;
+use crate::client::Client;
use crate::config;
+use crate::style;
pub async fn run() -> Result<()> {
+ // Best-effort server-side revoke before we forget the credentials
+ // locally. If the platform is unreachable we still clear the file —
+ // the user clearly wants to be signed out, and they can revoke from
+ // the web UI later.
+ if let Ok(client) = Client::from_config() {
+ let _ = client
+ .post_empty("/api/auth/cli/tokens/revoke-current")
+ .await;
+ }
if config::clear()? {
- println!("Signed out.");
+ println!("{} Signed out.", style::green("✓"));
} else {
- println!("Already signed out.");
+ println!("{}", style::dim("Already signed out."));
}
Ok(())
}
diff --git a/src/commands/me.rs b/src/commands/me.rs
index 561f3bf..dee9dc9 100644
--- a/src/commands/me.rs
+++ b/src/commands/me.rs
@@ -2,6 +2,7 @@ use anyhow::Result;
use serde::Deserialize;
use crate::client::Client;
+use crate::style;
#[derive(Deserialize)]
struct Me {
@@ -15,10 +16,11 @@ struct Me {
pub async fn run() -> Result<()> {
let client = Client::from_config()?;
let me: Me = client.get_json("/api/me").await?;
- println!("login: {}", me.login);
- println!("id: {}", me.id);
- println!("name: {}", me.name.as_deref().unwrap_or("-"));
- println!("email: {}", me.email.as_deref().unwrap_or("-"));
- println!("role: {}", me.role);
+ let label = |s: &str| style::dim(&format!("{s:<6}"));
+ println!("{} {}", label("login:"), style::bold(&me.login));
+ println!("{} {}", label("id:"), me.id);
+ println!("{} {}", label("name:"), me.name.as_deref().unwrap_or("-"));
+ println!("{} {}", label("email:"), me.email.as_deref().unwrap_or("-"));
+ println!("{} {}", label("role:"), style::role(&me.role));
Ok(())
}
diff --git a/src/commands/projects.rs b/src/commands/projects.rs
index 34a9506..10e5d68 100644
--- a/src/commands/projects.rs
+++ b/src/commands/projects.rs
@@ -3,6 +3,7 @@ use clap::{Args as ClapArgs, Subcommand};
use serde::{Deserialize, Serialize};
use crate::client::Client;
+use crate::style;
#[derive(Subcommand)]
pub enum Cmd {
@@ -27,6 +28,9 @@ pub struct ListArgs {
pub struct ShowArgs {
/// Project id (uuid)
project_id: String,
+ /// Print raw JSON instead of a summary
+ #[arg(long)]
+ json: bool,
}
#[derive(Deserialize)]
@@ -77,26 +81,69 @@ async fn list(client: &Client, args: ListArgs) -> Result<()> {
println!("No projects.");
return Ok(());
}
- println!("{:<38} {:<28} CREATED", "ID", "NAME");
+ println!(
+ "{} {} {}",
+ style::bold(&format!("{:<38}", "ID")),
+ style::bold(&format!("{:<28}", "NAME")),
+ style::bold("CREATED"),
+ );
for p in &resp.projects {
+ // Pad to fixed widths in raw bytes first, then style — ANSI escape
+ // codes count as bytes (not columns) inside Rust's `{: Result<()> {
let path = format!("/api/projects/{}", args.project_id);
let v: serde_json::Value = client.get_json(&path).await?;
- println!("{}", serde_json::to_string_pretty(&v)?);
+ if args.json {
+ println!("{}", serde_json::to_string_pretty(&v)?);
+ return Ok(());
+ }
+ let s = |k: &str| v.get(k).and_then(|x| x.as_str()).unwrap_or("-").to_string();
+ let label = |s: &str| style::dim(&format!("{s:<13}"));
+ println!("{} {}", label("id:"), style::dim(&s("id")));
+ println!("{} {}", label("name:"), style::bold(&s("name")));
+ if let Some(desc) = v.get("description").and_then(|x| x.as_str()) {
+ if !desc.trim().is_empty() {
+ println!("{} {desc}", label("description:"));
+ }
+ }
+ println!("{} {}", label("created:"), s("createdAt"));
+ println!("{} {}", label("updated:"), s("updatedAt"));
+ if let Some(ls) = v.get("activeLabelSetId").and_then(|x| x.as_str()) {
+ println!("{} {ls}", label("label set:"));
+ }
+ if let Some(role) = v.get("role").and_then(|x| x.as_str()) {
+ println!("{} {}", label("your role:"), style::cyan(role));
+ }
Ok(())
}
@@ -109,3 +156,22 @@ fn truncate(s: &str, n: usize) -> String {
s.to_string()
}
}
+
+#[cfg(test)]
+mod tests {
+ use super::*;
+
+ #[test]
+ fn truncate_passes_short_strings() {
+ assert_eq!(truncate("hi", 28), "hi");
+ assert_eq!(truncate("", 5), "");
+ }
+
+ #[test]
+ fn truncate_clips_long_strings_with_ellipsis() {
+ let out = truncate("abcdefghij", 5);
+ assert_eq!(out.chars().count(), 5);
+ assert!(out.ends_with('…'));
+ assert_eq!(out, "abcd…");
+ }
+}
diff --git a/src/config.rs b/src/config.rs
index 43a5de4..9b2392c 100644
--- a/src/config.rs
+++ b/src/config.rs
@@ -3,10 +3,20 @@ use serde::{Deserialize, Serialize};
use std::fs;
use std::path::PathBuf;
+/// Persisted credentials. The CLI now authenticates with a bearer token
+/// minted via the loopback OAuth flow (see `commands::login`); the older
+/// `session_cookie` field is still read so existing installs keep working
+/// until the next `wk login`.
#[derive(Serialize, Deserialize, Clone)]
pub struct AuthConfig {
pub base_url: String,
- pub session_cookie: String,
+ /// `wkcli_…` bearer token issued by `POST /api/auth/cli/tokens`.
+ #[serde(default, skip_serializing_if = "Option::is_none")]
+ pub token: Option,
+ /// Legacy: raw value of the `wk_session` cookie. Read for back-compat,
+ /// not written by new logins.
+ #[serde(default, skip_serializing_if = "Option::is_none")]
+ pub session_cookie: Option,
}
fn config_dir() -> Result {
diff --git a/src/main.rs b/src/main.rs
index 923006d..55802cb 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -4,11 +4,25 @@ use clap::{Parser, Subcommand};
mod client;
mod commands;
mod config;
+mod style;
+
+// Both `-V` and `--version` print the same string — that matches what
+// `rustc -V` / `cargo -V` actually do, despite clap's default of
+// splitting them. clap prepends the bin name ("wk ") for us.
+const VERSION: &str = concat!(
+ env!("CARGO_PKG_VERSION"),
+ "\n",
+ env!("CARGO_PKG_NAME"),
+ " — ",
+ env!("CARGO_PKG_DESCRIPTION"),
+ "\n",
+ env!("CARGO_PKG_REPOSITORY"),
+);
#[derive(Parser)]
#[command(
name = "wk",
- version,
+ version = VERSION,
about = "Command-line client for the WaveKat platform",
long_about = "Command-line client for the WaveKat platform.\n\nRun `wk login` to authenticate. \
Credentials are stored under your platform config dir (e.g. ~/.config/wavekat/auth.json on Linux/macOS)."
diff --git a/src/style.rs b/src/style.rs
new file mode 100644
index 0000000..c374ae9
--- /dev/null
+++ b/src/style.rs
@@ -0,0 +1,110 @@
+// Tiny ANSI styling helpers. Self-contained so we don't drag in a colour
+// crate just to dim a few labels. Output is automatically plain when
+// stdout isn't a TTY (so piping into `jq` / files / other tools is
+// untouched) and when the `NO_COLOR` env var is set per
+// . `CLICOLOR_FORCE=1` forces colour on, useful in
+// CI where stdout is captured but you still want the codes.
+
+use std::io::IsTerminal;
+use std::sync::OnceLock;
+
+fn enabled() -> bool {
+ static ON: OnceLock = OnceLock::new();
+ *ON.get_or_init(|| {
+ if std::env::var_os("NO_COLOR").is_some() {
+ return false;
+ }
+ if std::env::var("CLICOLOR_FORCE").is_ok_and(|v| v != "0") {
+ return true;
+ }
+ std::io::stdout().is_terminal()
+ })
+}
+
+fn wrap(code: &str, body: &str) -> String {
+ if enabled() {
+ format!("\x1b[{code}m{body}\x1b[0m")
+ } else {
+ body.to_string()
+ }
+}
+
+pub fn bold(s: &str) -> String {
+ wrap("1", s)
+}
+pub fn dim(s: &str) -> String {
+ wrap("2", s)
+}
+pub fn red(s: &str) -> String {
+ wrap("31", s)
+}
+pub fn green(s: &str) -> String {
+ wrap("32", s)
+}
+pub fn yellow(s: &str) -> String {
+ wrap("33", s)
+}
+pub fn cyan(s: &str) -> String {
+ wrap("36", s)
+}
+pub fn magenta(s: &str) -> String {
+ wrap("35", s)
+}
+
+/// Colour a review status string. Unknown / unreviewed render dim.
+pub fn review(status: Option<&str>) -> String {
+ match status {
+ Some("approved") => green("approved"),
+ Some("rejected") => red("rejected"),
+ Some("needs_fix") => yellow("needs_fix"),
+ Some(other) => other.to_string(),
+ None => dim("—"),
+ }
+}
+
+/// Colour a user role string.
+pub fn role(s: &str) -> String {
+ match s {
+ "root" => magenta("root"),
+ "user" => green("user"),
+ "none" => yellow("none"),
+ _ => s.to_string(),
+ }
+}
+
+#[cfg(test)]
+mod tests {
+ use super::*;
+
+ // These tests assert on substrings rather than exact bytes, so they
+ // pass whether `enabled()` decides colour is on or off — the cached
+ // OnceLock means we can't reliably flip the mode mid-test-binary.
+
+ #[test]
+ fn bold_preserves_payload() {
+ assert!(bold("hello").contains("hello"));
+ }
+
+ #[test]
+ fn review_known_states_contain_label() {
+ assert!(review(Some("approved")).contains("approved"));
+ assert!(review(Some("rejected")).contains("rejected"));
+ assert!(review(Some("needs_fix")).contains("needs_fix"));
+ }
+
+ #[test]
+ fn review_unknown_passes_through() {
+ // Unknown statuses must render verbatim — no swallowing.
+ assert_eq!(review(Some("draft")), "draft");
+ }
+
+ #[test]
+ fn review_none_renders_em_dash() {
+ assert!(review(None).contains('—'));
+ }
+
+ #[test]
+ fn role_unknown_passes_through() {
+ assert_eq!(role("admin"), "admin");
+ }
+}
+
+