Return the selected account ID and email from auth login

Author: isaacroldan

.changeset/auth-login-json.md

@@ -2,4 +2,4 @@
 '@shopify/cli': minor
 ---
 
-Add typed JSON output to `auth login`.
+Add typed JSON output with selected account details to `auth login`.

.changeset/session-account-details.md

@@ -0,0 +1,5 @@
+---
+'@shopify/cli-kit': minor
+---
+
+Add account details to session selection while preserving the alias-only API.

packages/cli-kit/src/private/node/session.test.ts

@@ -172,6 +172,7 @@ describe('ensureAuthenticated when previous session is invalid', () => {
     // Verify the session was stored with email as alias
     const storedSession = vi.mocked(storeSessions).mock.calls[0]![0]
     expect(storedSession[fqdn]![userId]!.identity.alias).toBe('user@example.com')
+    expect(storedSession[fqdn]![userId]!.identity.email).toBe('user@example.com')
 
     // The userID is cached in memory and the secureStore is not accessed again
     await expect(getLastSeenUserIdAfterAuth()).resolves.toBe('1234-5678')
@@ -211,6 +212,7 @@ The CLI is currently unable to prompt for reauthentication.`,
           identity: {
             ...validIdentityToken,
             alias: 'user@example.com',
+            email: 'user@example.com',
           },
           applications: appTokens,
         },
@@ -687,6 +689,8 @@ describe('ensureAuthenticated email fetch functionality', () => {
     // Then
     const storedSession = vi.mocked(storeSessions).mock.calls[0]![0]
     expect(storedSession[fqdn]![userId]!.identity.alias).toBe('work@example.com')
+    expect(storedSession[fqdn]![userId]!.identity.email).toBe('work@example.com')
+    expect(businessPlatformRequest).toHaveBeenCalledTimes(1)
     expect(got).toEqual(validTokens)
   })
 
@@ -788,6 +792,48 @@ describe('ensureAuthenticated email fetch functionality', () => {
     // Then
     const storedSession = vi.mocked(storeSessions).mock.calls[0]![0]
     expect(storedSession[fqdn]![userId]!.identity.alias).toBe(userId)
+    expect(storedSession[fqdn]![userId]!.identity.email).toBeUndefined()
     expect(got).toEqual(validTokens)
   })
 })
+
+describe('stored authentication email', () => {
+  test('preserves a separately stored email through refresh without another request', async () => {
+    const sessions: Sessions = {
+      [fqdn]: {
+        [userId]: {
+          identity: {...validIdentityToken, alias: 'Work Account', email: 'work@example.com'},
+          applications: appTokens,
+        },
+      },
+    }
+    vi.mocked(fetchSessions).mockResolvedValue(sessions)
+    vi.mocked(validateSession).mockResolvedValueOnce('needs_refresh')
+
+    await ensureAuthenticated(defaultApplications)
+
+    const stored = vi.mocked(storeSessions).mock.calls[0]![0]
+    expect(stored[fqdn]![userId]!.identity).toMatchObject({alias: 'Work Account', email: 'work@example.com'})
+    expect(businessPlatformRequest).not.toHaveBeenCalled()
+  })
+
+  test('does not copy a cached email when reauthentication selects a different user', async () => {
+    vi.mocked(fetchSessions).mockResolvedValue({
+      [fqdn]: {
+        [userId]: {
+          identity: {...validIdentityToken, alias: 'Work Account', email: 'previous@example.com'},
+          applications: appTokens,
+        },
+      },
+    })
+    vi.mocked(validateSession).mockResolvedValueOnce('needs_full_auth')
+    vi.mocked(pollForDeviceAuthorization).mockResolvedValue({...validIdentityToken, userId: 'different-user'})
+
+    await ensureAuthenticated(defaultApplications)
+
+    const stored = vi.mocked(storeSessions).mock.calls[0]![0]
+    expect(stored[fqdn]!['different-user']!.identity.alias).toBe('Work Account')
+    expect(stored[fqdn]!['different-user']!.identity.email).toBeUndefined()
+    expect(businessPlatformRequest).not.toHaveBeenCalled()
+  })
+})

packages/cli-kit/src/private/node/session.ts

@@ -237,15 +237,15 @@ ${outputToken.json(applications)}
   if (validationResult === 'needs_full_auth') {
     await throwOnNoPrompt(noPrompt)
     outputDebug(outputContent`Initiating the full authentication flow...`)
-    newSession = await executeCompleteFlow(applications, currentSession?.identity.alias)
+    newSession = await executeCompleteFlow(applications, currentSession?.identity)
   } else if (validationResult === 'needs_refresh' || forceRefresh) {
     outputDebug(outputContent`The current session is valid but needs refresh. Refreshing...`)
     try {
       newSession = await refreshTokens(currentSession!, applications)
     } catch (error) {
       if (error instanceof InvalidGrantError) {
         await throwOnNoPrompt(noPrompt)
-        newSession = await executeCompleteFlow(applications, currentSession?.identity.alias)
+        newSession = await executeCompleteFlow(applications, currentSession?.identity)
       } else if (error instanceof InvalidRequestError) {
         await sessionStore.remove()
         throw new AbortError('\nError validating auth session', "We've cleared the current session, please try again")
@@ -295,9 +295,12 @@ The CLI is currently unable to prompt for reauthentication.`,
  * Execute the full authentication flow.
  *
  * @param applications - An object containing the applications we need to be authenticated with.
- * @param existingAlias - Optional alias from a previous session to preserve if the email fetch fails.
+ * @param existingIdentity - Optional identity from the previous session.
  */
-async function executeCompleteFlow(applications: OAuthApplications, existingAlias?: string): Promise<Session> {
+async function executeCompleteFlow(
+  applications: OAuthApplications,
+  existingIdentity?: IdentityToken,
+): Promise<Session> {
   const scopes = getFlattenScopes(applications)
   const exchangeScopes = getExchangeScopes(applications)
   const store = applications.adminApi?.storeFqdn
@@ -320,14 +323,19 @@ async function executeCompleteFlow(applications: OAuthApplications, existingAlia
   outputDebug(outputContent`CLI token received. Exchanging it for application tokens...`)
   const result = await exchangeAccessForApplicationTokens(identityToken, exchangeScopes, store)
 
-  // Preserve existing alias if available, otherwise try fetching email
+  // Preserve existing alias if available, otherwise try fetching email.
   const businessPlatformToken = result[applicationId('business-platform')]?.accessToken
-  const alias = existingAlias ?? (await fetchEmail(businessPlatformToken)) ?? identityToken.userId
+  const existingAlias = existingIdentity?.alias
+  // A cached email belongs to its user ID, even when reauthentication selects another account.
+  const existingEmail = existingIdentity?.userId === identityToken.userId ? existingIdentity.email : undefined
+  const email = existingAlias === undefined ? await fetchEmail(businessPlatformToken) : existingEmail
+  const alias = existingAlias ?? email ?? identityToken.userId
 
   const session: Session = {
     identity: {
       ...identityToken,
       alias,
+      email,
     },
     applications: result,
   }
@@ -354,7 +362,11 @@ async function refreshTokens(session: Session, applications: OAuthApplications):
   )
 
   return {
-    identity: {...identityToken, alias: session.identity.alias},
+    identity: {
+      ...identityToken,
+      alias: session.identity.alias,
+      email: identityToken.userId === session.identity.userId ? session.identity.email : undefined,
+    },
     applications: applicationTokens,
   }
 }

packages/cli-kit/src/private/node/session/account-storage.test.ts

@@ -0,0 +1,58 @@
+import {fetch, store, getSessionAccount, findSessionAccountByAlias, setSessionAlias} from './store.js'
+import * as confStore from '../conf-store.js'
+import * as fqdn from '../../../public/node/context/fqdn.js'
+import {LocalStorage} from '../../../public/node/local-storage.js'
+import {inTemporaryDirectory} from '../../../public/node/fs.js'
+import {expect, test, vi} from 'vitest'
+import type {Sessions} from './schema.js'
+
+const {getSessions, setSessions} = confStore
+
+test.each([undefined, 'verified@example.com'])(
+  'preserves stored account email %s through file reload and alias changes',
+  async (email) => {
+    await inTemporaryDirectory(async (directory) => {
+      const storage = new LocalStorage<confStore.ConfSchema>({cwd: directory})
+      vi.spyOn(confStore, 'getSessions').mockImplementation(() => getSessions(storage))
+      vi.spyOn(confStore, 'setSessions').mockImplementation((sessions) => setSessions(sessions, storage))
+      vi.spyOn(fqdn, 'identityFqdn').mockResolvedValue('accounts.example.com')
+      const sessions: Sessions = {
+        'accounts.example.com': {
+          'user-123': {
+            identity: {
+              userId: 'user-123',
+              alias: 'nickname@example.com',
+              email,
+              accessToken: 'access-token',
+              refreshToken: 'refresh-token',
+              expiresAt: new Date('2030-01-01T00:00:00Z'),
+              scopes: [],
+            },
+            applications: {},
+          },
+        },
+      }
+
+      await store(sessions)
+
+      const reloadedStorage = new LocalStorage<confStore.ConfSchema>({cwd: directory})
+      const reloaded = JSON.parse(getSessions(reloadedStorage)!)
+      expect(reloaded['accounts.example.com']['user-123'].identity.email).toBe(email)
+      expect((await fetch())!['accounts.example.com']!['user-123']!.identity.email).toBe(email)
+      await expect(getSessionAccount('user-123')).resolves.toEqual({
+        userId: 'user-123',
+        alias: 'nickname@example.com',
+        email,
+      })
+
+      await setSessionAlias('user-123', 'New label')
+
+      await expect(findSessionAccountByAlias('New label')).resolves.toEqual({
+        userId: 'user-123',
+        alias: 'New label',
+        email,
+      })
+      expect(JSON.parse(getSessions(reloadedStorage)!)['accounts.example.com']['user-123'].identity.email).toBe(email)
+    })
+  },
+)

packages/cli-kit/src/private/node/session/schema.ts

@@ -15,6 +15,7 @@ const IdentityTokenSchema = zod.object({
   scopes: zod.array(zod.string()),
   userId: zod.string(),
   alias: zod.string().optional(),
+  email: zod.string().optional(),
 })
 
 /**

packages/cli-kit/src/private/node/session/store.test.ts

@@ -1,5 +1,5 @@
 import {Sessions} from './schema.js'
-import {store, fetch, remove, getSessionAlias, setSessionAlias, findSessionByAlias} from './store.js'
+import {store, fetch, remove, getSessionAccount, setSessionAlias, findSessionByAlias} from './store.js'
 import {getSessions, removeSessions, setSessions, removeCurrentSessionId} from '../conf-store.js'
 import {identityFqdn} from '../../../public/node/context/fqdn.js'
 
@@ -129,24 +129,24 @@ describe('session store', () => {
     })
   })
 
-  describe('getSessionAlias', () => {
+  describe('getSessionAccount', () => {
     test('returns alias for existing user', async () => {
       // Given
       vi.mocked(getSessions).mockReturnValue(JSON.stringify(mockSessions))
 
       // When
-      const result = await getSessionAlias('user1')
+      const result = await getSessionAccount('user1')
 
       // Then
-      expect(result).toBe('Work Account')
+      expect(result).toEqual({userId: 'user1', alias: 'Work Account', email: undefined})
     })
 
     test('returns undefined for non-existent user', async () => {
       // Given
       vi.mocked(getSessions).mockReturnValue(JSON.stringify(mockSessions))
 
       // When
-      const result = await getSessionAlias('nonexistent')
+      const result = await getSessionAccount('nonexistent')
 
       // Then
       expect(result).toBeUndefined()
@@ -157,7 +157,7 @@ describe('session store', () => {
       vi.mocked(getSessions).mockReturnValue(undefined)
 
       // When
-      const result = await getSessionAlias('user1')
+      const result = await getSessionAccount('user1')
 
       // Then
       expect(result).toBeUndefined()
@@ -169,7 +169,7 @@ describe('session store', () => {
       vi.mocked(identityFqdn).mockResolvedValue('different.fqdn.com')
 
       // When
-      const result = await getSessionAlias('user1')
+      const result = await getSessionAccount('user1')
 
       // Then
       expect(result).toBeUndefined()

packages/cli-kit/src/private/node/session/store.ts

@@ -1,7 +1,9 @@
 import {SessionsSchema} from './schema.js'
 import {getSessions, removeCurrentSessionId, removeSessions, setSessions} from '../conf-store.js'
 import {identityFqdn} from '../../../public/node/context/fqdn.js'
-import type {Session, Sessions} from './schema.js'
+import type {IdentityToken, Session, Sessions} from './schema.js'
+
+type SessionAccount = Pick<IdentityToken, 'userId' | 'alias' | 'email'>
 
 /**
  * Serializes the session as a JSON and stores it in the system.
@@ -51,18 +53,19 @@ export async function remove() {
 }
 
 /**
- * Gets the session alias for a given user ID.
+ * Gets public account details for a stored user ID.
  *
- * @param userId - The user ID of the session to get the alias for.
- * @returns The alias for the session if it exists, otherwise undefined.
+ * @param userId - The stored user ID whose account details are requested.
+ * @returns The account details if the session exists, otherwise undefined.
  */
-export async function getSessionAlias(userId: string): Promise<string | undefined> {
+export async function getSessionAccount(userId: string): Promise<SessionAccount | undefined> {
   const sessions = await fetch()
   if (!sessions) return undefined
 
   const fqdn = await identityFqdn()
-  if (!sessions[fqdn] || !sessions[fqdn][userId]) return undefined
-  return sessions[fqdn][userId].identity.alias
+  const session = sessions[fqdn]?.[userId]
+  if (!session) return undefined
+  return {userId, alias: session.identity.alias, email: session.identity.email}
 }
 
 /**
@@ -90,6 +93,10 @@ export async function setSessionAlias(userId: string, alias: string): Promise<vo
  * @returns The user ID if found, otherwise undefined
  */
 export async function findSessionByAlias(alias: string): Promise<string | undefined> {
+  return (await findSessionAccountByAlias(alias))?.userId
+}
+
+export async function findSessionAccountByAlias(alias: string): Promise<SessionAccount | undefined> {
   const sessions = await fetch()
   if (!sessions) return undefined
 
@@ -99,7 +106,7 @@ export async function findSessionByAlias(alias: string): Promise<string | undefi
 
   for (const [userId, session] of Object.entries(fqdnSessions)) {
     if (session.identity.alias === alias || userId === alias) {
-      return userId
+      return {userId, alias: session.identity.alias, email: session.identity.email}
     }
   }