Release v1.13.1

Origin-SHA: 9fd7796bd08a9e488d277f604a0e2c541b9d24f1

Author: ryanio

CHANGELOG.md

@@ -1,5 +1,11 @@
 # @opensea/cli
 
+## 1.13.1
+
+### Patch Changes
+
+- e325f04: Keep the requested OAuth scopes in the auth store so `whoami` can report broader grants, and fix `auth link-wallet` to preserve wallet-adapter method binding and accept `OPENSEA_PRIVATE_KEY`.
+
 ## 1.13.0
 
 ### Minor Changes

docs/cli-reference.md

@@ -20,9 +20,10 @@ opensea whoami
 ```
 
 `whoami` reads the current local auth token and shows the wallet address,
-scopes, their source, and expiry. Use `opensea whoami --diagnostic` to inspect
-decoded JWT claims and scope differences. Those claims are unverified,
-provider-specific diagnostics only and never authorization data.
+requested and granted scopes, any broader-scope warning, the scope source, and
+expiry. Use `opensea whoami --diagnostic` to inspect decoded JWT claims and
+scope differences. Those claims are unverified, provider-specific diagnostics
+only and never authorization data.
 
 ## Collections
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opensea/cli",
-  "version": "1.13.0",
+  "version": "1.13.1",
   "type": "module",
   "description": "OpenSea CLI - Query the OpenSea API from the command line or programmatically",
   "main": "dist/index.js",

src/auth/store.ts

@@ -18,6 +18,7 @@ export interface StoredToken {
   refreshToken: string
   scopedTokenId?: string
   expiresAt: string
+  requestedScopes: string[]
   scopes: string[]
   scopeSource?:
     | "authorization_server"
@@ -42,6 +43,7 @@ const storedTokenSchema = z
     refreshToken: z.string().min(1),
     scopedTokenId: z.string().min(1).optional(),
     expiresAt: z.iso.datetime(),
+    requestedScopes: z.array(z.string().min(1)),
     scopes: z.array(z.string().min(1)),
     scopeSource: z
       .enum([

src/commands/auth.ts

@@ -260,6 +260,7 @@ export function authCommand(
         refreshToken: scopedToken.token,
         scopedTokenId: scopedToken.id,
         expiresAt: expiresAt.toISOString(),
+        requestedScopes: scopes,
         scopes: grantedScopes,
         scopeSource,
         address,
@@ -340,8 +341,14 @@ export function authCommand(
           process.exit(1)
         }
 
-        const adapter = createWalletFromEnv()
-        const signMessage = adapter.signMessage
+        const privateKey = process.env.OPENSEA_PRIVATE_KEY
+        const adapter = privateKey
+          ? new PrivateKeyAdapter({
+              privateKey,
+              rpcUrl: process.env.OPENSEA_RPC_URL ?? "https://eth.merkle.io",
+            })
+          : createWalletFromEnv()
+        const signMessage = adapter.signMessage?.bind(adapter)
         if (!signMessage) {
           console.error("Wallet adapter does not support message signing")
           process.exit(1)
@@ -448,6 +455,7 @@ export function authCommand(
           accessToken: refreshed.accessToken,
           refreshToken: refreshed.refreshToken,
           expiresAt: refreshed.expiresAt.toISOString(),
+          requestedScopes: token.requestedScopes,
           scopes: refreshed.scopes,
           scopeSource: refreshed.scopeSource,
           address: token.address,

src/commands/login.ts

@@ -110,6 +110,7 @@ export function loginCommand(
           accessToken: token.accessToken,
           refreshToken: token.refreshToken,
           expiresAt: token.expiresAt.toISOString(),
+          requestedScopes: scopes,
           scopes: token.scopes,
           ...(token.scopeSource ? { scopeSource: token.scopeSource } : {}),
           address,

src/commands/whoami.ts

@@ -74,6 +74,7 @@ export function whoamiCommand(getFormat: () => OutputFormat): Command {
       }
 
       const jwtScopes = jwt?.opensea_scopes ?? []
+      const broaderScopes = difference(token.scopes, token.requestedScopes)
       const diagnostic = options.diagnostic
         ? {
             unverified: true,
@@ -92,7 +93,17 @@ export function whoamiCommand(getFormat: () => OutputFormat): Command {
             address: token.address,
             auth_method: token.authMethod,
             scopes: token.scopes,
+            requested_scopes: token.requestedScopes,
+            granted_scopes: token.scopes,
             scope_source: token.scopeSource ?? "unknown",
+            ...(broaderScopes.length > 0
+              ? {
+                  scope_warning: {
+                    type: "broader_than_requested",
+                    scopes: broaderScopes,
+                  },
+                }
+              : {}),
             ...(diagnostic ? { diagnostic } : {}),
             expires_at: token.expiresAt,
             expired,

test/auth/store.test.ts

@@ -26,6 +26,7 @@ const baseToken = {
   accessToken: "access",
   refreshToken: "refresh",
   expiresAt: "2030-01-01T00:00:00.000Z",
+  requestedScopes: ["read:eligibility"],
   scopes: ["read:eligibility"],
   address: "0xAbC",
   authMethod: "oauth" as const,
@@ -120,7 +121,7 @@ describe("auth store", () => {
     expect(loadCurrentToken()).toEqual(siweToken)
   })
 
-  test("rejects prerelease stores missing required token fields", () => {
+  test("rejects prerelease stores missing requested scopes", () => {
     const warn = vi.spyOn(console, "warn").mockImplementation(() => {})
     mkdirSync(`${testHome}/.opensea`, { recursive: true })
     writeFileSync(
@@ -134,6 +135,7 @@ describe("auth store", () => {
             expiresAt: "2030-01-01T00:00:00.000Z",
             scopes: ["read:eligibility"],
             address: "0xabc",
+            authMethod: "oauth",
           },
         },
       }),

test/commands/auth-login.test.ts

@@ -6,7 +6,10 @@ const { getAddress, loadCurrentToken, removeToken, saveToken, signMessage } =
     loadCurrentToken: vi.fn(),
     removeToken: vi.fn(),
     saveToken: vi.fn(),
-    signMessage: vi.fn(async () => "0xsigned"),
+    signMessage: vi.fn(function (this: { getAddress?: unknown }) {
+      if (!this?.getAddress) throw new Error("wallet adapter binding lost")
+      return Promise.resolve("0xsigned")
+    }),
   }))
 
 vi.mock("../../src/auth/store.js", () => ({
@@ -33,6 +36,41 @@ describe("auth login", () => {
   afterEach(() => {
     vi.clearAllMocks()
     vi.restoreAllMocks()
+    delete process.env.OPENSEA_AUTH_TOKEN
+    delete process.env.OPENSEA_PRIVATE_KEY
+  })
+
+  it("links a wallet with OPENSEA_PRIVATE_KEY and preserves adapter binding", async () => {
+    process.env.OPENSEA_AUTH_TOKEN = "wallet-jwt"
+    process.env.OPENSEA_PRIVATE_KEY = "fixture-private-key"
+    const fetchSpy = vi
+      .spyOn(globalThis, "fetch")
+      .mockResolvedValueOnce(
+        new Response(JSON.stringify({ nonce: "abcd1234efgh5678" }), {
+          status: 200,
+        }),
+      )
+      .mockResolvedValueOnce(
+        new Response(
+          JSON.stringify({
+            linkedWalletAddress: "0xfBa662e1a8e91a350702cF3b87D0C2d2Fb4BA57F",
+          }),
+          { status: 200 },
+        ),
+      )
+
+    await authCommand(
+      () => undefined,
+      createCommandTestContext().getFormat,
+    ).parseAsync(["link-wallet", "--api-key", "api-key"], {
+      from: "user",
+    })
+
+    expect(fetchSpy).toHaveBeenCalledTimes(2)
+    expect(signMessage).toHaveBeenCalledOnce()
+    expect(console.log).toHaveBeenCalledWith(
+      expect.stringContaining('"status": "linked"'),
+    )
   })
 
   it("uses the current SIWE and scoped-token endpoints", async () => {
@@ -130,6 +168,7 @@ describe("auth login", () => {
         accessToken: "wallet-jwt",
         refreshToken: "pat-value",
         scopedTokenId: "381768924447939181",
+        requestedScopes: ["write:wallets"],
         scopes: ["write:wallets"],
         authMethod: "siwe",
       }),
@@ -198,6 +237,7 @@ describe("auth login", () => {
       refreshToken: "pat-value",
       scopedTokenId: "381768924447939181",
       expiresAt: "2030-01-01T00:00:00.000Z",
+      requestedScopes: ["write:wallets"],
       scopes: ["write:wallets"],
       address: "0xfba662e1a8e91a350702cf3b87d0c2d2fb4ba57f",
       authMethod: "siwe",

test/commands/auth-refresh.test.ts

@@ -29,6 +29,7 @@ const storedToken = {
   accessToken: "old-access",
   refreshToken: "old-refresh",
   expiresAt: "2030-01-01T00:00:00.000Z",
+  requestedScopes: ["read:eligibility"],
   scopes: ["read:eligibility"],
   address: "0xabc",
   authMethod: "oauth" as const,
@@ -73,6 +74,7 @@ describe("auth refresh", () => {
       accessToken: "new-access",
       refreshToken: "new-refresh",
       expiresAt: "2031-01-01T00:00:00.000Z",
+      requestedScopes: ["read:eligibility"],
       scopes: ["read:eligibility", "write:orders"],
       address: "0xabc",
       authMethod: "oauth",