feat(cli): support logging in with an API key (#2590)

Co-authored-by: Claude <noreply@anthropic.com>

Synced from monorepo@e43ad599757bae98575cf5d34cd0600bdb808712

Author: SferaDev

.sync-commit

@@ -1 +1 @@
-1e65c38d8a31e7dc7119ad1218e84055aea169eb
+e43ad599757bae98575cf5d34cd0600bdb808712

src/commands/auth/login.ts

@@ -11,6 +11,7 @@ import { DEFAULT_PROFILE } from '~/lib/profile';
 type Flags = {
   profile: string;
   force: boolean;
+  'api-key'?: string;
   issuer?: string;
   'api-url'?: string;
   'client-id'?: string;
@@ -28,14 +29,21 @@ export async function implementation(this: LocalContext, { profile = DEFAULT_PRO
     await updateConfig({ ...config, profiles: updatedProfiles });
   }
 
-  try {
-    const { baseUrl, client } = getAuthConfig({
-      clientId: customFlags['client-id'],
-      clientSecret: customFlags['client-secret'],
-      issuer: customFlags.issuer,
-      apiBaseUrl: customFlags['api-url']
-    });
+  const { baseUrl, client } = getAuthConfig({
+    clientId: customFlags['client-id'],
+    clientSecret: customFlags['client-secret'],
+    issuer: customFlags.issuer,
+    apiBaseUrl: customFlags['api-url']
+  });
 
+  // Passing --api-key is a non-interactive alternative to the device OAuth flow below.
+  const apiKey = customFlags['api-key'];
+  if (apiKey) {
+    await loginWithApiKey.call(this, { profile, apiKey, baseUrl });
+    return;
+  }
+
+  try {
     for await (const step of XataApi.deviceLogin(client)) {
       match(step)
         .with({ type: 'prompt' }, (step) => {
@@ -72,6 +80,35 @@ export async function implementation(this: LocalContext, { profile = DEFAULT_PRO
   }
 }
 
+async function loginWithApiKey(
+  this: LocalContext,
+  { profile, apiKey, baseUrl }: { profile: string; apiKey: string; baseUrl: string }
+) {
+  // Validate the API key before persisting it so we don't store an invalid one.
+  try {
+    const xata = new XataApi({ baseUrl, token: apiKey });
+    await xata.api.organizations.getOrganizationsList({});
+  } catch {
+    console.error('The provided API key is invalid or could not be verified. No changes were made.');
+    return;
+  }
+
+  await updateConfig({
+    ...config,
+    activeProfile: profile,
+    profiles: {
+      ...(config?.profiles || {}),
+      [profile]: {
+        type: 'apiKey',
+        apiKey,
+        customConfig: { apiBaseUrl: baseUrl }
+      }
+    }
+  });
+
+  console.log(`Logged in with profile "${profile}" using an API key.`);
+}
+
 export const AuthLoginCommand = buildCommand({
   docs: {
     brief: `Log in to a ${CLI_NAME} account`
@@ -89,6 +126,12 @@ export const AuthLoginCommand = buildCommand({
         brief: 'Force login even if already logged in',
         default: false
       },
+      'api-key': {
+        kind: 'parsed',
+        parse: String,
+        brief: 'Log in non-interactively with an API key instead of the browser OAuth flow',
+        optional: true
+      },
       issuer: {
         kind: 'parsed',
         parse: String,

src/commands/auth/login.unit.test.ts

@@ -0,0 +1,158 @@
+import { beforeEach, describe, expect, mock, test } from 'bun:test';
+import type { LocalContext } from '~/context';
+import type { Config } from '~/lib/schemas';
+
+// Module-level state shared with the mocked `~/lib/config` module. The object
+// identity is kept stable (we only mutate it) so the live binding in login.ts
+// always observes the latest state.
+const configState: Config = { activeProfile: 'default', profiles: {} };
+const updateConfig = mock(async (newConfig: Config) => {
+  configState.activeProfile = newConfig.activeProfile;
+  configState.profiles = newConfig.profiles;
+});
+
+mock.module('~/lib/config', () => ({
+  config: configState,
+  updateConfig
+}));
+
+const getOrganizationsList = mock(async () => ({ organizations: [] }));
+
+class FakeXataApi {
+  api = { organizations: { getOrganizationsList } };
+  static async *deviceLogin() {
+    // Not exercised by the API key flow.
+  }
+}
+
+mock.module('@xata.io/api', () => ({
+  XataApi: FakeXataApi
+}));
+
+const { implementation } = await import('./login');
+
+function buildContext() {
+  const logs: string[] = [];
+  const errors: string[] = [];
+
+  const originalLog = console.log;
+  const originalError = console.error;
+  console.log = (...args: unknown[]) => logs.push(args.join(' '));
+  console.error = (...args: unknown[]) => errors.push(args.join(' '));
+
+  const restore = () => {
+    console.log = originalLog;
+    console.error = originalError;
+  };
+
+  const context = {} as unknown as LocalContext;
+
+  return { context, logs, errors, restore };
+}
+
+describe('auth login --api-key', () => {
+  beforeEach(() => {
+    configState.activeProfile = 'default';
+    configState.profiles = {};
+    updateConfig.mockClear();
+    getOrganizationsList.mockClear();
+    getOrganizationsList.mockImplementation(async () => ({ organizations: [] }));
+  });
+
+  test('stores an apiKey profile after validating the key', async () => {
+    const { context, logs, restore } = buildContext();
+
+    try {
+      await implementation.call(context, { profile: 'default', force: false, 'api-key': 'xau_test' });
+    } finally {
+      restore();
+    }
+
+    expect(getOrganizationsList).toHaveBeenCalledTimes(1);
+    expect(updateConfig).toHaveBeenCalledTimes(1);
+    expect(configState.activeProfile).toBe('default');
+    expect(configState.profiles.default).toEqual({
+      type: 'apiKey',
+      apiKey: 'xau_test',
+      customConfig: { apiBaseUrl: 'https://api.xata.tech' }
+    });
+    expect(logs.join('')).toContain('Logged in with profile "default" using an API key.');
+  });
+
+  test('respects the --profile flag', async () => {
+    const { context, restore } = buildContext();
+
+    try {
+      await implementation.call(context, { profile: 'work', force: false, 'api-key': 'xau_work' });
+    } finally {
+      restore();
+    }
+
+    expect(configState.activeProfile).toBe('work');
+    expect(configState.profiles.work).toMatchObject({ type: 'apiKey', apiKey: 'xau_work' });
+  });
+
+  test('uses a custom api base url when provided', async () => {
+    const { context, restore } = buildContext();
+
+    try {
+      await implementation.call(context, {
+        profile: 'default',
+        force: false,
+        'api-key': 'xau_custom',
+        'api-url': 'https://api.staging.xata.tech'
+      });
+    } finally {
+      restore();
+    }
+
+    expect(configState.profiles.default).toMatchObject({
+      customConfig: { apiBaseUrl: 'https://api.staging.xata.tech' }
+    });
+  });
+
+  test('does not store the profile when the key is invalid', async () => {
+    getOrganizationsList.mockImplementationOnce(async () => {
+      throw new Error('401 Unauthorized');
+    });
+    const { context, errors, restore } = buildContext();
+
+    try {
+      await implementation.call(context, { profile: 'default', force: false, 'api-key': 'bad-key' });
+    } finally {
+      restore();
+    }
+
+    expect(updateConfig).not.toHaveBeenCalled();
+    expect(configState.profiles.default).toBeUndefined();
+    expect(errors.join('')).toContain('The provided API key is invalid');
+  });
+
+  test('does not overwrite an existing profile without --force', async () => {
+    configState.profiles = { default: { type: 'apiKey', apiKey: 'existing' } };
+    const { context, logs, restore } = buildContext();
+
+    try {
+      await implementation.call(context, { profile: 'default', force: false, 'api-key': 'xau_new' });
+    } finally {
+      restore();
+    }
+
+    expect(getOrganizationsList).not.toHaveBeenCalled();
+    expect(updateConfig).not.toHaveBeenCalled();
+    expect(logs.join('')).toContain('already logged in');
+  });
+
+  test('falls through to the device flow when no --api-key is passed', async () => {
+    const { context, restore } = buildContext();
+
+    try {
+      await implementation.call(context, { profile: 'default', force: false });
+    } finally {
+      restore();
+    }
+
+    expect(getOrganizationsList).not.toHaveBeenCalled();
+    expect(updateConfig).not.toHaveBeenCalled();
+  });
+});