chore: add CI workflow (typecheck + prettier format check), tsconfig, and prettier formatting

src/auth-server.ts

@@ -0,0 +1,155 @@
+/**
+ * Local HTTP callback server for the Command Code browser auth flow.
+ *
+ * Starts a one-shot server on a random port. The Command Code Studio
+ * website POSTs the user's API key to /callback after they authenticate.
+ */
+
+import { createServer, type Server } from "node:http";
+import type { AddressInfo } from "node:net";
+
+export interface AuthCallback {
+  apiKey: string;
+  state: string;
+  userId: string;
+  userName: string;
+  keyName: string;
+}
+
+export interface AuthServer {
+  server: Server;
+  port: number;
+  waitForCallback: Promise<AuthCallback>;
+}
+
+/**
+ * Start a local HTTP server that listens for the Command Code Studio
+ * to POST the API key after the user authenticates in their browser.
+ *
+ * The server accepts exactly one valid POST to /callback and then closes.
+ */
+export function startAuthServer(): Promise<AuthServer> {
+  let resolveCallback: (value: AuthCallback) => void;
+  let rejectCallback: (error: Error) => void;
+
+  const waitForCallback = new Promise<AuthCallback>((resolve, reject) => {
+    resolveCallback = resolve;
+    rejectCallback = reject;
+  });
+
+  const server = createServer((req, res) => {
+    // CORS: allow requests from Command Code domains and localhost for dev
+    const origin = req.headers.origin || "";
+    const allowedOrigins = [
+      "http://localhost:3000",
+      "https://staging.commandcode.ai",
+      "https://commandcode.ai",
+    ];
+    const responseOrigin = allowedOrigins.includes(origin)
+      ? origin
+      : allowedOrigins[0];
+
+    res.setHeader("Access-Control-Allow-Origin", responseOrigin);
+    res.setHeader("Access-Control-Allow-Methods", "POST, OPTIONS");
+    res.setHeader("Access-Control-Allow-Headers", "Content-Type");
+    res.setHeader("Content-Type", "application/json");
+
+    // Handle CORS preflight
+    if (req.method === "OPTIONS") {
+      res.writeHead(204);
+      res.end();
+      return;
+    }
+
+    if (req.url !== "/callback") {
+      res.writeHead(404);
+      res.end(JSON.stringify({ success: false, error: "Not found" }));
+      return;
+    }
+
+    if (req.method !== "POST") {
+      res.writeHead(405);
+      res.end(
+        JSON.stringify({
+          success: false,
+          error: "Method not allowed. Use POST.",
+        }),
+      );
+      return;
+    }
+
+    let body = "";
+    req.on("data", (chunk) => {
+      body += chunk.toString();
+      if (body.length > 10_000) req.destroy();
+    });
+
+    req.on("end", () => {
+      try {
+        const parsed = JSON.parse(body) as Record<string, unknown>;
+
+        if (parsed.error) {
+          res.writeHead(200);
+          res.end(JSON.stringify({ success: true }));
+          const description =
+            typeof parsed.error_description === "string"
+              ? parsed.error_description
+              : String(parsed.error);
+          if (parsed.error === "access_denied") {
+            rejectCallback(
+              new Error(description || "Authorization was denied by the user"),
+            );
+          } else {
+            rejectCallback(new Error(description || String(parsed.error)));
+          }
+          server.close();
+          return;
+        }
+
+        const apiKey = typeof parsed.apiKey === "string" ? parsed.apiKey : "";
+        const state = typeof parsed.state === "string" ? parsed.state : "";
+        const userId = typeof parsed.userId === "string" ? parsed.userId : "";
+        const userName =
+          typeof parsed.userName === "string" ? parsed.userName : "";
+        const keyName =
+          typeof parsed.keyName === "string" ? parsed.keyName : "";
+
+        if (!apiKey || !state || !userId || !userName || !keyName) {
+          res.writeHead(400);
+          res.end(
+            JSON.stringify({
+              success: false,
+              error: "Missing required fields",
+            }),
+          );
+          return;
+        }
+
+        res.writeHead(200);
+        res.end(JSON.stringify({ success: true }));
+
+        resolveCallback({ apiKey, state, userId, userName, keyName });
+        server.close();
+      } catch {
+        res.writeHead(400);
+        res.end(JSON.stringify({ success: false, error: "Invalid JSON" }));
+      }
+    });
+
+    req.on("error", () => {
+      res.writeHead(500);
+      res.end(JSON.stringify({ success: false, error: "Request error" }));
+    });
+  });
+
+  return new Promise((resolve) => {
+    server.on("error", (err: NodeJS.ErrnoException) => {
+      rejectCallback(new Error(`Failed to start auth server: ${err.message}`));
+    });
+
+    server.listen(0, "127.0.0.1", () => {
+      const address = server.address() as AddressInfo;
+      resolve({ server, port: address.port, waitForCallback });
+    });
+  });
+}