feat: integreate OKTA authentication (#216)

Author: rovilay

cli-typescript/package-lock.json

@@ -26,6 +26,7 @@
   "devDependencies": {
     "@esbuild-kit/esm-loader": "^2.6.5",
     "@types/eslint-plugin-prettier": "^3.1.3",
+    "@types/express": "^5.0.2",
     "@types/node": "^22.13.16",
     "eslint": "^9.24.0",
     "eslint-config-prettier": "^10.1.1",
@@ -41,6 +42,8 @@
     "commander": "^13.1.0",
     "dotenv": "^16.4.7",
     "ethers": "^6.13.5",
+    "express": "^5.1.0",
+    "mkdirp": "^3.0.1",
     "ox": "^0.7.0",
     "viem": "^2.26.3"
   }

cli-typescript/package.json

@@ -41,6 +41,7 @@ import {
 import listProjectsAction from '../utils/cmdActions/listProjectsAction';
 import { getProjectStore } from '../utils/fileUtils';
 import fillProjectConfigAction from '../utils/cmdActions/fillProjectConfigAction';
+import { authenticate } from '../utils/auth';
 
 export const getNewProjectCmdDescription = (defaultInfo?: string) => {
   defaultInfo =
@@ -55,10 +56,16 @@ export const getNewProjectCmdDescription = (defaultInfo?: string) => {
   `;
 };
 
-const presets = async () => {
+const presets = async (cliCmd: string) => {
   try {
     console.log('Starting prestart tasks...');
 
+    console.log('Authenticating...');
+    await authenticate();
+
+    // set cmd name globally
+    process.env.MAGICDROP_CLI_CMD = cliCmd;
+
     setBaseDir();
   } catch (error: any) {
     showError({ text: `An error occurred: ${error.message}` });
@@ -80,14 +87,32 @@ export const createEvmCommand = ({
     .description(`${platform.name} launchpad commands`)
     .aliases(commandAliases);
 
-  newCmd.hook('preAction', async () => {
+  newCmd.hook('preAction', async (_, actionCommand) => {
     try {
-      await presets();
+      await presets(actionCommand.name());
     } catch (error: any) {
       showError({ text: `setup failed - ${error.message}` });
     }
   });
 
+  // subcommand hook; verify if the collection is supported on the platform
+  newCmd.hook('preAction', (_, actionCommand) => {
+    const symbol = actionCommand.args[0];
+
+    if (!SUBCOMMAND_EXCLUDE_LIST.includes(actionCommand.name()) && !!symbol) {
+      const store = getProjectStore(symbol);
+      store.read();
+
+      if (!platform.isChainIdSupported(store.data?.chainId ?? 0)) {
+        showError({
+          text: `collection '${symbol}' not supported on the ${platform.name} platform.`,
+        });
+
+        process.exit(1);
+      }
+    }
+  });
+
   newCmd
     .command('new <symbol>')
     .aliases(['n', 'init'])
@@ -160,23 +185,6 @@ export const createEvmCommand = ({
       ) => await deployAction(platform, symbol, params),
     );
 
-  // subcommand hook; verify if the collection is supported on the platform
-  newCmd.hook('preAction', (_, actionCommand) => {
-    const symbol = actionCommand.args[0];
-    if (!SUBCOMMAND_EXCLUDE_LIST.includes(actionCommand.name()) && !!symbol) {
-      const store = getProjectStore(symbol);
-      store.read();
-
-      if (!platform.isChainIdSupported(store.data?.chainId ?? 0)) {
-        showError({
-          text: `collection '${symbol}' not supported on the ${platform.name} platform.`,
-        });
-
-        process.exit(1);
-      }
-    }
-  });
-
   newCmd
     .command('configure-project <symbol>')
     .description(

cli-typescript/src/cmds/createCommand.ts

@@ -41,16 +41,6 @@ export const createNewWalletCmd = () =>
   new Command('create-wallet')
     .command('create-wallet <symbol>')
     .description('create a new wallet for a collection')
-    .addOption(
-      getForceOption(
-        `
-    overwrite the existing wallet.json for the collection.
-    Note: this will NOT delete the existing wallet in turnkey if a wallet with the same collection name already exists.
-    Please reconcile manually in turnkey if you want to delete the existing wallet.
-  `,
-        false,
-      ),
-    )
     .action(newWalletAction);
 
 export const initContractCmd = () =>

cli-typescript/src/cmds/general.ts

@@ -40,7 +40,6 @@ export class ContractManager {
   public client: PublicClient;
   public rpcUrl: string;
   public chain: Chain;
-  private meTurnkeyServiceClient: ReturnType<typeof getMETurnkeyServiceClient>;
 
   constructor(
     public chainId: SUPPORTED_CHAINS,
@@ -50,7 +49,6 @@ export class ContractManager {
     this.symbol = this.symbol.toLowerCase();
     this.rpcUrl = rpcUrls[this.chainId];
     this.chain = getViemChainByChainId(this.chainId);
-    this.meTurnkeyServiceClient = getMETurnkeyServiceClient();
 
     // Initialize viem client
     this.client = createPublicClient({
@@ -115,7 +113,8 @@ export class ContractManager {
     value?: bigint;
     gasLimit?: bigint;
   }): Promise<Hex> {
-    return this.meTurnkeyServiceClient.sendTransaction(this.symbol, {
+    const meTurnkeyServiceClient = await getMETurnkeyServiceClient();
+    return await meTurnkeyServiceClient.sendTransaction(this.symbol, {
       to,
       data,
       value,
@@ -361,7 +360,7 @@ export class ContractManager {
     const data = encodeFunctionData({
       abi: [ERC1155M_ABIS.setTransferable],
       functionName: ERC1155M_ABIS.setTransferable.name,
-      args: [false],
+      args: [!freeze],
     });
 
     const txHash = await this.sendTransaction({

cli-typescript/src/utils/ContractManager.ts

@@ -0,0 +1,84 @@
+import fs from 'fs';
+import * as okta from './okta';
+import { mkdirp } from 'mkdirp';
+
+export const authenticate = async () => {
+  const configDir = `${process.env.HOME}/.config/magicdrop2`;
+  const configPath = `${configDir}/config.json`;
+
+  // make dir if it does not exist
+  mkdirp.sync(configDir);
+
+  // Load credentials
+  const config: IConfig = fs.existsSync(configPath)
+    ? JSON.parse(fs.readFileSync(configPath, 'utf-8'))
+    : {
+        accessToken: '',
+        refreshToken: '',
+        idToken: '',
+        expires: '2025-05-31T00:00:00.000Z',
+        meApiAdminKey: '',
+      };
+
+  const setToken = (token: okta.IAuth['token']) => {
+    config.accessToken = token.access_token;
+    config.refreshToken = token.refresh_token;
+    fs.writeFileSync(configPath, JSON.stringify(config, null, 2));
+  };
+
+  if (!config.accessToken || !config.refreshToken) {
+    const { token } = await okta.authenticate();
+    setToken(token);
+    return;
+  }
+
+  // Decode the access token and find expiry
+  const decoded = decodeJWT(config.accessToken);
+  const expiry = new Date(decoded.exp * 1000).getTime();
+  const now = new Date().getTime();
+
+  if (now >= expiry) {
+    // Authenticate if expired, and we do not have a valid refresh token
+    if (!(await okta.validToken(config.refreshToken, 'refresh_token'))) {
+      const { token } = await okta.authenticate();
+      setToken(token);
+    } else {
+      // Refresh if expired, and we have a valid refresh token
+      const token = await okta.refresh(config.refreshToken);
+      if (token) setToken(token);
+    }
+  }
+
+  return {
+    Authorization: `Bearer ${config.accessToken}`,
+  };
+};
+
+export const decodeJWT = (token: string) => {
+  return JSON.parse(
+    Buffer.from(token.split('.')[1], 'base64').toString(),
+  ) as DecodedJWT;
+};
+
+export type DecodedJWT = {
+  ver: number;
+  jti: string;
+  iss: string;
+  aud: string;
+  sub: string;
+  iat: number;
+  exp: number;
+  cid: string;
+  uid: string;
+  scp: string[];
+  auth_time: number;
+};
+
+export type IConfig = {
+  accessToken: string;
+  refreshToken: string;
+  idToken: string;
+  expires: string;
+  meApiAdminKey: string;
+  xBypassBotKey: string;
+};