feat(cli): seed auth.json from env-supplied credentials (2/3) by moranshe-max · Pull Request #537 · base44/cli

moranshe-max · 2026-06-09T11:08:24Z

Note

Description

Adds support for seeding authentication from environment-supplied credentials so non-interactive flows (CI, agents, provisioning tools like the Stripe Projects CLI) can run the CLI with no manual `base44 login`. When `BASE44_ACCESS_TOKEN` and `BASE44_REFRESH_TOKEN` are present, the `ensureAuth` middleware decodes the access-token JWT and writes a standard `~/.base44/auth/auth.json`, so all downstream code uses one file-based auth path. Credentials are also loaded from project-local `.env`/`.env.local` at startup, with normalization of the Stripe Projects CLI's `BASE44_PROJECTS_BASE44_` variables to their bare `BASE44_` names.

Related Issue

None

Type of Change

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Breaking change (fix or feature that would cause existing functionality to not work as expected)
Documentation update
Refactoring (no functional changes)
Other (please describe):

Changes Made

Added `seedAuthFromEnv()` in `core/auth/config.ts`: decodes the `BASE44_ACCESS_TOKEN` JWT (`sub` -> email, `exp` -> expiry; no signature verification, the server validates), pairs it with `BASE44_REFRESH_TOKEN`, and writes a standard auth file. No-ops unless the env vars form a complete record.
Wired `seedAuthFromEnv()` into the `ensureAuth` middleware before the login check, so env tokens satisfy auth without an interactive login.
Added `loadProjectEnvFiles()` in `core/utils/env.ts` to load `.env.local` then `.env` (ambient `process.env` always wins; `.env.local` beats `.env`), and `normalizeBase44Env()` to copy `BASE44_PROJECTS_BASE44_` vars to their bare `BASE44_` names when unset.
Added `cli/bootstrap-env.ts`, imported first in `cli/index.ts`, so env files load before the HTTP clients capture `getBase44ApiUrl()` at module load.
Documented the env-credential flow in `docs/api-patterns.md`.
Added a `givenEnv()` helper to the CLI testkit for injecting env vars into runs.

Testing

I have tested these changes locally
I have added/updated tests as needed
All tests pass (`npm test`)

Checklist

My code follows the project's style guidelines
I have performed a self-review of my own code
I have commented my code, particularly in hard-to-understand areas
I have made corresponding changes to the documentation (if applicable)
My changes generate no new warnings
I have updated `docs/` (AGENTS.md) if I made architectural changes

Additional Notes

The seeded file behaves like a normal login: a 401 triggers the usual refresh, and if refresh fails the file is deleted and self-heals on the next command (re-seeded from the still-present env vars). Adds a new dependency on `jsonwebtoken` for decoding the access token.

_{Generated by Claude | 2026-06-10 12:32 UTC | b493243}

github-actions · 2026-06-09T11:08:53Z

🚀 Package Preview Available!

Install this PR's preview build with npm:

npm i @base44-preview/cli@0.0.54-pr.537.b493243

Prefer not to change any import paths? Install using npm alias so your code still imports base44:

npm i "base44@npm:@base44-preview/cli@0.0.54-pr.537.b493243"

Or add it to your package.json dependencies:

{
  "dependencies": {
    "base44": "npm:@base44-preview/cli@0.0.54-pr.537.b493243"
  }
}

📦 Preview Package: @base44-preview/cli@0.0.54-pr.537.b493243
🔗 View this commit on GitHub

_{Preview published to npm registry — try new features instantly!}

kfirstri · 2026-06-10T10:13:37Z

+`BASE44_API_URL`): for each, if the bare name is unset and exactly one
+`<PREFIX>_<KEY>` variable exists, its value is copied to the bare name. This is
+prefix-agnostic and leaves the bare key unset when ambiguous.
+


I feel that this is too verbose, and we can minimize it. Not sure what's the value for the agent (not that i know if the AGENTS.md helps at all...)

kfirstri · 2026-06-10T10:17:11Z

+ *
+ * @returns true if an auth file was written.
+ */
+export async function seedAuthFromEnv(): Promise<boolean> {


It seems like this returned boolean is not used anywhere

kfirstri · 2026-06-10T10:17:34Z

+/**
+ * Decodes a JWT payload's claims WITHOUT verifying the signature (display/expiry
+ * use only — the server still validates the token). Returns null for non-JWTs.
+ */


I think we can remove this comment

kfirstri · 2026-06-10T10:18:13Z

+ * form a standard record (not a JWT with `exp`, or no refresh token).
+ *
+ * @returns true if an auth file was written.
+ */


Remove / minimize comment

I really should add a rule to AGENTS.md or something

kfirstri · 2026-06-10T10:53:42Z

+  }
+
+  normalizeBase44Env();
+}


All this can be replaced with a call to config() function from dotenv

kfirstri · 2026-06-10T10:54:33Z

+      process.env[bareKey] = process.env[matches[0]];
+    }
+  }
+}


I would consider removing it if we expect specific env vars for now. even make the BASE44_ENV_KEYS to hold the specific STRIPE keys if they are static

kfirstri · 2026-06-10T10:59:48Z

@@ -1,3 +1,5 @@
+// Must stay first — see bootstrap-env.js.
+import "@/cli/bootstrap-env.js";


Ok lets remove this, and add an import to import { loadProjectEnvFiles } from "@/core/utils/env.js"; and inside runCLI function lets use findProjectRoot and pass it into loadProjectEnvFiles?

notice that loadProjectEnvFiles may return empty route if .app.jsonc not found

kfirstri · 2026-06-10T11:02:13Z

+// Must run before any module reads env-derived config at import time — notably
+// the HTTP clients, which capture getBase44ApiUrl() when ky.create() runs at
+// module load. Imported first in cli/index.ts so it initializes ahead of them.
+loadProjectEnvFiles();


I commented in index.ts file, i think this file should be removed

kfirstri · 2026-06-10T11:03:46Z

+ * Decodes a JWT payload's claims WITHOUT verifying the signature (display/expiry
+ * use only — the server still validates the token). Returns null for non-JWTs.
+ */
+function decodeJwtClaims(token: string): Record<string, unknown> | null {


Artem added jsonwebtoken package for the dev server, can we use it here as well? no need to decode ourselved

kfirstri · 2026-06-10T11:04:41Z

+ * never overridden). Synchronous so it can run during bootstrap, before the HTTP
+ * clients capture `getBase44ApiUrl()`.
+ */
+export function loadProjectEnvFiles(cwd: string = process.cwd()): void {


change cwd to be "projectRoot" because we want to support the user running either from the project root, or from ~/my-project/base44 .. we don't want to force the user to be on the project root for this to work

kfirstri · 2026-06-10T11:05:38Z

+  const b64url = (obj: Record<string, unknown>) =>
+    Buffer.from(JSON.stringify(obj)).toString("base64url");
+  return `${b64url({ alg: "none", typ: "JWT" })}.${b64url(claims)}.sig`;
+}


consider of jsonwebtoken package can resolve this for you?

kfirstri

Added some comments, and i think we can tell the AI to chill with the comments :P

Enables non-interactive credential handoff (CI, agents, provisioning tools) by seeding the standard auth file from the environment, instead of special-casing env vars throughout the token flow: - The `ensureAuth` middleware calls `seedAuthFromEnv()` before the login check: when BASE44_ACCESS_TOKEN is set it decodes the JWT (sub -> email, exp -> expiresAt), reads BASE44_REFRESH_TOKEN, and writes a standard ~/.base44/auth/auth.json. readAuth / base44Client / isLoggedIn / whoami / refresh then all use one plain file-based path (no per-call-site special-casing; base44-client.ts and whoami.ts are untouched). - Overwrites an existing login when env vars are present (env = source of truth); no-ops when the creds can't form a standard record (not a JWT with exp, or no refresh token). - Loads .env/.env.local at startup via cli/bootstrap-env.ts (first import, before the HTTP clients capture getBase44ApiUrl()). - Normalizes prefix-namespaced vars (e.g. <PREFIX>_BASE44_APP_ID) to the bare BASE44_* names; prefix-agnostic and left unset when ambiguous. Adds a givenEnv testkit helper plus env-seeding and env-normalization specs. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

This was referenced Jun 9, 2026

feat(cli): add scaffold command to set up an existing app (3/3) #538

Open

feat(cli): add init command for Stripe Projects handoff #535

Closed

moranshe-max force-pushed the feature/env-token-auth branch 5 times, most recently from dd70d92 to e502594 Compare June 9, 2026 12:40

moranshe-max changed the title ~~feat(cli): env-supplied credentials — .env auto-load + access token (2/3)~~ feat(cli): seed auth.json from env-supplied credentials (2/3) Jun 9, 2026

moranshe-max force-pushed the feature/env-token-auth branch 3 times, most recently from ab0b4ea to 54f3fe5 Compare June 9, 2026 13:56

moranshe-max mentioned this pull request Jun 9, 2026

feat(cli): steer create to scaffold when an app id is in the env (4/4) #539

Closed

moranshe-max changed the title ~~feat(cli): seed auth.json from env-supplied credentials (2/3)~~ feat(cli): seed auth.json from env-supplied credentials (2/4) Jun 9, 2026

moranshe-max changed the title ~~feat(cli): seed auth.json from env-supplied credentials (2/4)~~ feat(cli): seed auth.json from env-supplied credentials (2/3) Jun 10, 2026

kfirstri reviewed Jun 10, 2026

View reviewed changes

kfirstri requested changes Jun 10, 2026

View reviewed changes

moranshe-max force-pushed the feature/scaffold-shared branch from a74b402 to 9ee4aa1 Compare June 10, 2026 12:06

moranshe-max force-pushed the feature/env-token-auth branch from 54f3fe5 to 8cc7307 Compare June 10, 2026 12:13

moranshe-max force-pushed the feature/scaffold-shared branch from 9ee4aa1 to d77abe1 Compare June 10, 2026 12:29

moranshe-max force-pushed the feature/env-token-auth branch from 8cc7307 to 9daf582 Compare June 10, 2026 12:32

		@@ -1,3 +1,5 @@
		// Must stay first — see bootstrap-env.js.
		import "@/cli/bootstrap-env.js";

Conversation

moranshe-max commented Jun 9, 2026 • edited by claude Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Related Issue

Type of Change

Changes Made

Testing

Checklist

Additional Notes

Uh oh!

github-actions Bot commented Jun 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🚀 Package Preview Available!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

kfirstri left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

moranshe-max commented Jun 9, 2026 •

edited by claude Bot

Loading

github-actions Bot commented Jun 9, 2026 •

edited

Loading