chore(sync): merge dev into mobile-main

Author: DIYgod

apps/cli/package.json

@@ -1,7 +1,7 @@
 {
   "name": "folocli",
   "type": "module",
-  "version": "0.0.1",
+  "version": "0.0.4",
   "description": "Folo CLI for terminal workflows and automation",
   "author": "Folo Team",
   "license": "AGPL-3.0-only",

apps/cli/src/auth-command.test.ts

@@ -0,0 +1,42 @@
+import { describe, expect, it, vi } from "vitest"
+
+vi.mock("./browser-login", () => ({
+  loginWithBrowser: vi.fn(),
+  resolveBrowserLoginToken: vi.fn(),
+}))
+
+const { loginWithBrowser, resolveBrowserLoginToken } = await import("./browser-login")
+const { resolveLoginToken } = await import("./commands/auth")
+
+describe("resolveLoginToken", () => {
+  it("exchanges a provided one-time token into a session token", async () => {
+    vi.mocked(resolveBrowserLoginToken).mockResolvedValueOnce("session-token")
+
+    await expect(
+      resolveLoginToken({
+        inputToken: "one-time-token",
+        apiUrl: "https://api.folo.is",
+        timeoutMs: 180_000,
+        onStatus: vi.fn(),
+      }),
+    ).resolves.toBe("session-token")
+
+    expect(resolveBrowserLoginToken).toHaveBeenCalledWith("https://api.folo.is", "one-time-token")
+  })
+
+  it("falls back to browser login when no token is provided", async () => {
+    vi.mocked(loginWithBrowser).mockResolvedValueOnce({
+      token: "browser-session-token",
+      callbackUrl: "http://127.0.0.1/callback",
+      loginUrl: "https://app.folo.is/login",
+    })
+
+    await expect(
+      resolveLoginToken({
+        apiUrl: "https://api.folo.is",
+        timeoutMs: 180_000,
+        onStatus: vi.fn(),
+      }),
+    ).resolves.toBe("browser-session-token")
+  })
+})

apps/cli/src/browser-login.test.ts

@@ -56,12 +56,15 @@ describe("browser login helpers", () => {
     const fetchMock = vi.fn().mockResolvedValueOnce(
       new Response(
         JSON.stringify({
-          session: { token: "session-token" },
           user: { id: "user-1" },
         }),
         {
           status: 200,
-          headers: { "content-type": "application/json" },
+          headers: {
+            "content-type": "application/json",
+            "set-cookie":
+              "__Secure-better-auth.session_token=session-token; Path=/; HttpOnly; Secure; SameSite=None",
+          },
         },
       ),
     )
@@ -72,6 +75,49 @@ describe("browser login helpers", () => {
     expect(token).toBe("session-token")
     expect(fetchMock).toHaveBeenCalledTimes(1)
     expect(fetchMock).toHaveBeenCalledWith(
+      "https://api.folo.is/better-auth/one-time-token/apply",
+      expect.objectContaining({
+        method: "POST",
+        body: JSON.stringify({ token: "one-time-token" }),
+      }),
+    )
+  })
+
+  it("falls back to verify when apply endpoint is unavailable", async () => {
+    const fetchMock = vi
+      .fn()
+      .mockResolvedValueOnce(
+        new Response(null, {
+          status: 404,
+        }),
+      )
+      .mockResolvedValueOnce(
+        new Response(
+          JSON.stringify({
+            session: { token: "session-token" },
+            user: { id: "user-1" },
+          }),
+          {
+            status: 200,
+            headers: { "content-type": "application/json" },
+          },
+        ),
+      )
+    vi.stubGlobal("fetch", fetchMock)
+
+    const token = await resolveBrowserLoginToken(DEFAULT_VALUES.PROD.API_URL, "one-time-token")
+
+    expect(token).toBe("session-token")
+    expect(fetchMock).toHaveBeenNthCalledWith(
+      1,
+      "https://api.folo.is/better-auth/one-time-token/apply",
+      expect.objectContaining({
+        method: "POST",
+        body: JSON.stringify({ token: "one-time-token" }),
+      }),
+    )
+    expect(fetchMock).toHaveBeenNthCalledWith(
+      2,
       "https://api.folo.is/better-auth/one-time-token/verify",
       expect.objectContaining({
         method: "POST",

apps/cli/src/browser-login.ts

@@ -8,6 +8,7 @@ import { CLIError } from "./output"
 const LOCAL_CALLBACK_HOST = "127.0.0.1"
 const LOCAL_CALLBACK_PATH = "/callback"
 const DEFAULT_TIMEOUT_MS = 3 * 60 * 1000
+const ONE_TIME_TOKEN_APPLY_PATH = "/better-auth/one-time-token/apply"
 const ONE_TIME_TOKEN_VERIFY_PATH = "/better-auth/one-time-token/verify"
 const SESSION_CHECK_PATH = "/better-auth/get-session"
 
@@ -114,6 +115,38 @@ const isRecord = (value: unknown): value is Record<string, unknown> => {
   return typeof value === "object" && value !== null && !Array.isArray(value)
 }
 
+const readSetCookieValues = (response: Response): string[] => {
+  if (typeof response.headers.getSetCookie === "function") {
+    return response.headers.getSetCookie()
+  }
+
+  const setCookie = response.headers.get("set-cookie")
+  return setCookie ? [setCookie] : []
+}
+
+const extractSessionTokenFromSetCookie = (setCookieValues: string[]): string | undefined => {
+  for (const setCookie of setCookieValues) {
+    const match = setCookie.match(/(?:__Secure-)?better-auth\.session_token=([^;]+)/)
+    if (match?.[1]) {
+      return match[1]
+    }
+  }
+
+  return undefined
+}
+
+const extractSessionTokenFromBody = (data: unknown): string | undefined => {
+  if (!isRecord(data)) {
+    return undefined
+  }
+
+  if (isRecord(data.session) && typeof data.session.token === "string") {
+    return data.session.token
+  }
+
+  return undefined
+}
+
 const extractErrorMessage = async (response: Response): Promise<string | undefined> => {
   const contentType = response.headers.get("content-type") ?? ""
 
@@ -147,42 +180,80 @@ const hasValidSessionToken = async (apiUrl: string, token: string): Promise<bool
 }
 
 export const resolveBrowserLoginToken = async (apiUrl: string, token: string): Promise<string> => {
+  const applyUrl = resolveAuthEndpointUrl(apiUrl, ONE_TIME_TOKEN_APPLY_PATH)
   const verifyUrl = resolveAuthEndpointUrl(apiUrl, ONE_TIME_TOKEN_VERIFY_PATH)
 
-  let response: Response
+  const requestBody = JSON.stringify({ token })
+
+  let response: Response | undefined
+  let errorMessage: string | undefined
   try {
-    response = await fetch(verifyUrl, {
+    response = await fetch(applyUrl, {
       method: "POST",
       headers: {
         "content-type": "application/json",
       },
-      body: JSON.stringify({ token }),
+      body: requestBody,
     })
   } catch (error) {
     throw new CLIError(
       "NETWORK_ERROR",
-      `Failed to verify browser login token: ${(error as Error).message}`,
+      `Failed to apply browser login token: ${(error as Error).message}`,
     )
   }
 
   if (response.ok) {
     const data = (await response.json().catch(() => null)) as unknown
     const sessionToken =
-      isRecord(data) && isRecord(data.session) && typeof data.session.token === "string"
-        ? data.session.token
-        : undefined
+      extractSessionTokenFromSetCookie(readSetCookieValues(response)) ??
+      extractSessionTokenFromBody(data)
 
     if (!sessionToken) {
       throw new CLIError(
         "UNAUTHORIZED",
-        "Browser login verification succeeded without returning a session token.",
+        "Browser login token apply succeeded without returning a session token.",
       )
     }
 
     return sessionToken
   }
 
-  const errorMessage = await extractErrorMessage(response)
+  errorMessage = await extractErrorMessage(response)
+
+  if (response.status === 404) {
+    try {
+      response = await fetch(verifyUrl, {
+        method: "POST",
+        headers: {
+          "content-type": "application/json",
+        },
+        body: requestBody,
+      })
+    } catch (error) {
+      throw new CLIError(
+        "NETWORK_ERROR",
+        `Failed to verify browser login token: ${(error as Error).message}`,
+      )
+    }
+
+    if (response.ok) {
+      const data = (await response.json().catch(() => null)) as unknown
+      const sessionToken =
+        extractSessionTokenFromSetCookie(readSetCookieValues(response)) ??
+        extractSessionTokenFromBody(data)
+
+      if (!sessionToken) {
+        throw new CLIError(
+          "UNAUTHORIZED",
+          "Browser login verification succeeded without returning a session token.",
+        )
+      }
+
+      return sessionToken
+    }
+
+    errorMessage = await extractErrorMessage(response)
+  }
 
   try {
     if (await hasValidSessionToken(apiUrl, token)) {

apps/cli/src/client.ts

@@ -12,7 +12,7 @@ const readString = (value: unknown): string | undefined => {
   return typeof value === "string" && value.length > 0 ? value : undefined
 }
 
-const normalizeToken = (token: string | undefined) => {
+export const normalizeToken = (token: string | undefined) => {
   if (!token || !token.includes("%")) {
     return token
   }
@@ -42,6 +42,61 @@ export interface CommandContext {
   token?: string
 }
 
+export interface CLIAuthSession {
+  user?: Record<string, unknown>
+  session?: Record<string, unknown>
+  role?: unknown
+  roleEndAt?: unknown
+  feedSubscriptionLimit?: unknown
+  rsshubSubscriptionLimit?: unknown
+}
+
+const readSessionErrorMessage = async (response: Response): Promise<string | undefined> => {
+  const contentType = response.headers.get("content-type") ?? ""
+
+  if (contentType.includes("application/json")) {
+    const data = (await response.json().catch(() => null)) as Record<string, unknown> | null
+    return typeof data?.message === "string" ? data.message : undefined
+  }
+
+  const text = await response.text().catch(() => "")
+  return text || undefined
+}
+
+export const fetchAuthSession = async ({
+  apiUrl,
+  token,
+  verbose = false,
+}: {
+  apiUrl: string
+  token: string
+  verbose?: boolean
+}): Promise<CLIAuthSession> => {
+  const requestUrl = `${apiUrl}/better-auth/get-session`
+  if (verbose) {
+    console.error(`[request] GET ${requestUrl}`)
+  }
+
+  const response = await fetch(requestUrl, {
+    method: "GET",
+    headers: {
+      Authorization: `Bearer ${token}`,
+      Cookie: `__Secure-better-auth.session_token=${token}; better-auth.session_token=${token}`,
+    },
+  })
+
+  if (verbose) {
+    console.error(`[response] GET ${requestUrl} -> ${response.status}`)
+  }
+
+  if (!response.ok) {
+    const message = await readSessionErrorMessage(response)
+    throw new CLIError("UNAUTHORIZED", message || "Token is invalid or expired.")
+  }
+
+  return (await response.json()) as CLIAuthSession
+}
+
 export const getGlobalOptions = (command: Command): GlobalOptions => {
   const options = command.optsWithGlobals() as Record<string, unknown>