|
| 1 | +package cmd |
| 2 | + |
| 3 | +import ( |
| 4 | + "context" |
| 5 | + "fmt" |
| 6 | + "os" |
| 7 | + "sort" |
| 8 | + "strings" |
| 9 | + |
| 10 | + "github.com/automagik-dev/workit/internal/msauth" |
| 11 | + "github.com/automagik-dev/workit/internal/outfmt" |
| 12 | + "github.com/automagik-dev/workit/internal/secrets" |
| 13 | + "github.com/automagik-dev/workit/internal/ui" |
| 14 | +) |
| 15 | + |
| 16 | +func isM365ServicesCSV(value string) bool { |
| 17 | + parts := strings.Split(value, ",") |
| 18 | + if len(parts) == 0 { |
| 19 | + return false |
| 20 | + } |
| 21 | + for _, part := range parts { |
| 22 | + if strings.ToLower(strings.TrimSpace(part)) != "m365" { |
| 23 | + return false |
| 24 | + } |
| 25 | + } |
| 26 | + return true |
| 27 | +} |
| 28 | + |
| 29 | +func (c *AuthAddCmd) runM365(ctx context.Context, flags *RootFlags, u *ui.UI) error { |
| 30 | + if !c.Readonly { |
| 31 | + return usage("m365 auth requires explicit --readonly") |
| 32 | + } |
| 33 | + if c.Headless || c.NoPoll || c.CallbackServer != "" { |
| 34 | + return usage("m365 auth uses browser OAuth; headless callback-server mode is not supported yet") |
| 35 | + } |
| 36 | + if c.AuthCode != "" { |
| 37 | + return usage("m365 auth does not accept raw --auth-code; use browser OAuth") |
| 38 | + } |
| 39 | + if c.Step != 0 && c.Step != 1 && c.Step != 2 { |
| 40 | + return usage("step must be 1 or 2") |
| 41 | + } |
| 42 | + if c.Step != 0 && !c.Remote { |
| 43 | + return usage("--step requires --remote") |
| 44 | + } |
| 45 | + if c.Remote || c.Step == 1 { |
| 46 | + if c.Step == 2 || c.AuthURL != "" { |
| 47 | + return usage("m365 remote step 2 is not supported yet; use browser OAuth on this machine") |
| 48 | + } |
| 49 | + result, err := m365ManualAuthURL(ctx, msauth.ManualAuthURLOptions{Readonly: c.Readonly, ForceConsent: c.ForceConsent}) |
| 50 | + if err != nil { |
| 51 | + return err |
| 52 | + } |
| 53 | + if outfmt.IsJSON(ctx) { |
| 54 | + return outfmt.WriteJSON(ctx, os.Stdout, map[string]any{ |
| 55 | + "provider": "microsoft_graph", |
| 56 | + "auth_url": result.URL, |
| 57 | + "state": result.State, |
| 58 | + "expires_in": result.ExpiresIn, |
| 59 | + }) |
| 60 | + } |
| 61 | + u.Out().Printf("provider\tmicrosoft_graph") |
| 62 | + u.Out().Printf("auth_url\t%s", result.URL) |
| 63 | + u.Out().Printf("state\t%s", result.State) |
| 64 | + return nil |
| 65 | + } |
| 66 | + if dryRunErr := dryRunExit(ctx, flags, "auth.add.m365", map[string]any{ |
| 67 | + "email": strings.TrimSpace(c.Email), |
| 68 | + "provider": "microsoft_graph", |
| 69 | + "services": []string{"m365"}, |
| 70 | + "scopes": msauth.PilotAllowedScopes(), |
| 71 | + "readonly": c.Readonly, |
| 72 | + }); dryRunErr != nil { |
| 73 | + return dryRunErr |
| 74 | + } |
| 75 | + if keychainErr := ensureKeychainAccessIfNeeded(); keychainErr != nil { |
| 76 | + return fmt.Errorf("keychain access: %w", keychainErr) |
| 77 | + } |
| 78 | + result, err := authorizeM365(ctx, msauth.AuthorizeOptions{ |
| 79 | + ExpectedEmail: strings.TrimSpace(c.Email), |
| 80 | + Readonly: c.Readonly, |
| 81 | + ForceConsent: c.ForceConsent, |
| 82 | + Timeout: c.Timeout, |
| 83 | + }) |
| 84 | + if err != nil { |
| 85 | + return err |
| 86 | + } |
| 87 | + if normalizeEmail(result.Email) != normalizeEmail(c.Email) { |
| 88 | + return fmt.Errorf("authorized as %s, expected %s", result.Email, c.Email) |
| 89 | + } |
| 90 | + return storeM365Token(ctx, u, result.Email, result.RefreshToken) |
| 91 | +} |
| 92 | + |
| 93 | +func (c *AuthManageCmd) runM365(ctx context.Context) error { |
| 94 | + result, err := m365ManualAuthURL(ctx, msauth.ManualAuthURLOptions{Readonly: true, ForceConsent: c.ForceConsent}) |
| 95 | + if err != nil { |
| 96 | + return err |
| 97 | + } |
| 98 | + if outfmt.IsJSON(ctx) || c.PrintURL { |
| 99 | + return outfmt.WriteJSON(ctx, os.Stdout, map[string]any{ |
| 100 | + "provider": "microsoft_graph", |
| 101 | + "auth_url": result.URL, |
| 102 | + "state": result.State, |
| 103 | + "expires_in": result.ExpiresIn, |
| 104 | + }) |
| 105 | + } |
| 106 | + u := ui.FromContext(ctx) |
| 107 | + u.Err().Println("Opening Microsoft 365 authorization in your browser…") |
| 108 | + u.Err().Println(result.URL) |
| 109 | + return nil |
| 110 | +} |
| 111 | + |
| 112 | +func storeM365Token(ctx context.Context, u *ui.UI, email string, refreshToken string) error { |
| 113 | + store, err := openSecretsStore() |
| 114 | + if err != nil { |
| 115 | + return err |
| 116 | + } |
| 117 | + serviceNames := []string{"m365"} |
| 118 | + scopes := msauth.PilotAllowedScopes() |
| 119 | + sort.Strings(scopes) |
| 120 | + if err := store.MergeToken(msauth.ClientName, email, secrets.Token{ |
| 121 | + Client: msauth.ClientName, |
| 122 | + Email: email, |
| 123 | + Services: serviceNames, |
| 124 | + Scopes: scopes, |
| 125 | + RefreshToken: refreshToken, |
| 126 | + }); err != nil { |
| 127 | + return err |
| 128 | + } |
| 129 | + return writeResult(ctx, u, |
| 130 | + kv("stored", true), |
| 131 | + kv("provider", "microsoft_graph"), |
| 132 | + kv("email", email), |
| 133 | + kv("services", serviceNames), |
| 134 | + kv("client", msauth.ClientName), |
| 135 | + ) |
| 136 | +} |
0 commit comments