Function bodies 191 total

func main() {
	// Set version for analytics
	analytics.SetVersion(version)

	// Ensure analytics are flushed on exit
	defer analytics.Shutdown()

	if err := cmd.Execute(version); err != nil {
		os.Exit(1)
	}
}

func getConfigDir() string {
	home, err := os.UserHomeDir()
	if err != nil {
		return ""
	}
	return filepath.Join(home, ".config", "keyway")
}

func getDistinctID() string {
	mu.Lock()
	defer mu.Unlock()

	if distinctID != "" {
		return distinctID
	}

	configDir := getConfigDir()
	idFile := getIDFilePath()

	// Try to read existing ID
	if data, err := os.ReadFile(idFile); err == nil {
		var cfg idConfig
		if err := json.Unmarshal(data, &cfg); err == nil && cfg.DistinctID != "" {
			distinctID = cfg.DistinctID
			return distinctID
		}
	}

	// Create new ID
	distinctID = uuid.New().String()

	// Persist it
	if err := os.MkdirAll(configDir, 0700); err == nil {
		cfg := idConfig{DistinctID: distinctID}
		if data, err := json.MarshalIndent(cfg, "", "  "); err == nil {
			_ = os.WriteFile(idFile, data, 0600)
		}
	}

	return distinctID
}

func initClient() {
	if config.IsTelemetryDisabled() {
		return
	}

	apiKey := config.GetPostHogKey()
	if apiKey == "" {
		return
	}

	var err error
	client, err = posthog.NewWithConfig(apiKey, posthog.Config{
		Endpoint: config.GetPostHogHost(),
	})
	if err != nil {
		client = nil
	}
}

func Track(event string, properties map[string]interface{}) {
	if config.IsTelemetryDisabled() {
		return
	}

	initOnce.Do(initClient)

	if client == nil {
		return
	}

	sanitized := sanitizeProperties(properties)

	// Add standard properties
	sanitized["source"] = "cli-go"
	sanitized["platform"] = runtime.GOOS
	sanitized["arch"] = runtime.GOARCH
	sanitized["goVersion"] = runtime.Version()
	sanitized["version"] = version
	sanitized["ci"] = config.IsCI()

	_ = client.Enqueue(posthog.Capture{
		DistinctId: getDistinctID(),
		Event:      event,
		Properties: sanitized,
	})
}

func Identify(userID string, properties map[string]interface{}) {
	if config.IsTelemetryDisabled() {
		return
	}

	initOnce.Do(initClient)

	if client == nil {
		return
	}

	sanitized := sanitizeProperties(properties)
	sanitized["source"] = "cli-go"

	_ = client.Enqueue(posthog.Identify{
		DistinctId: userID,
		Properties: sanitized,
	})

	// Alias the anonymous ID to this user
	anonID := getDistinctID()
	if anonID != "" && anonID != userID {
		_ = client.Enqueue(posthog.Alias{
			DistinctId: userID,
			Alias:      anonID,
		})
	}
}

func (c *Client) GetRepoIdsFromBackend(ctx context.Context, repoFullName string) (*RepoIds, error) {
	var wrapper struct {
		Data struct {
			OwnerID *int `json:"ownerId"`
			RepoID  *int `json:"repoId"`
		} `json:"data"`
	}

	path := fmt.Sprintf("/v1/github/repo-ids?repo=%s", url.QueryEscape(repoFullName))
	err := c.do(ctx, "GET", path, nil, &wrapper)
	if err != nil {
		return nil, err
	}

	if wrapper.Data.OwnerID == nil || wrapper.Data.RepoID == nil {
		return nil, nil
	}

	return &RepoIds{
		OwnerID: *wrapper.Data.OwnerID,
		RepoID:  *wrapper.Data.RepoID,
	}, nil
}

func GetRepoIdsFromGitHub(ctx context.Context, owner, repo string) (*RepoIds, error) {
	url := fmt.Sprintf("%s/repos/%s/%s", config.GetGitHubAPIURL(), owner, repo)

	req, err := http.NewRequestWithContext(ctx, "GET", url, nil)
	if err != nil {
		return nil, err
	}
	req.Header.Set("Accept", "application/vnd.github.v3+json")
	req.Header.Set("User-Agent", "keyway-cli")

	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		return nil, err
	}
	defer resp.Body.Close()

	if resp.StatusCode != http.StatusOK {
		// Repo is private or doesn't exist
		return nil, nil
	}

	var data struct {
		ID    int `json:"id"`
		Owner struct {
			ID int `json:"id"`
		} `json:"owner"`
	}

	if err := json.NewDecoder(resp.Body).Decode(&data); err != nil {
		return nil, err
	}

	return &RepoIds{
		OwnerID: data.Owner.ID,
		RepoID:  data.ID,
	}, nil
}

func (c *Client) StartDeviceLogin(ctx context.Context, repository string, repoIds *RepoIds) (*DeviceStartResponse, error) {
	body := map[string]interface{}{}
	if repository != "" {
		body["repository"] = repository
	}
	if repoIds != nil {
		body["ownerId"] = repoIds.OwnerID
		body["repoId"] = repoIds.RepoID
	}

	var resp DeviceStartResponse
	err := c.do(ctx, "POST", "/v1/auth/device/start", body, &resp)
	return &resp, err
}

func (c *Client) PollDeviceLogin(ctx context.Context, deviceCode string) (*DevicePollResponse, error) {
	body := map[string]string{"deviceCode": deviceCode}

	var resp DevicePollResponse
	err := c.do(ctx, "POST", "/v1/auth/device/poll", body, &resp)
	return &resp, err
}

func (c *Client) ValidateToken(ctx context.Context) (*ValidateTokenResponse, error) {
	var wrapper struct {
		Data ValidateTokenResponse `json:"data"`
	}
	err := c.do(ctx, "POST", "/v1/auth/token/validate", map[string]string{}, &wrapper)
	return &wrapper.Data, err
}

func (c *Client) CheckGitHubAppInstallation(ctx context.Context, repoOwner, repoName string) (*GitHubAppInstallationStatus, error) {
	body := map[string]string{
		"repoOwner": repoOwner,
		"repoName":  repoName,
	}

	var wrapper struct {
		Data GitHubAppInstallationStatus `json:"data"`
	}
	err := c.do(ctx, "POST", "/v1/github/check-installation", body, &wrapper)
	return &wrapper.Data, err
}

func (e *APIError) Error() string {
	if e.Detail != "" {
		return e.Detail
	}
	if e.Title != "" {
		return e.Title
	}
	return fmt.Sprintf("HTTP %d", e.StatusCode)
}

func NewClient(token string) *Client {
	httpClient := &http.Client{
		Timeout: defaultTimeout,
	}

	// Allow insecure TLS for local development (self-signed certs)
	if os.Getenv("KEYWAY_INSECURE") == "1" {
		httpClient.Transport = &http.Transport{
			TLSClientConfig: &tls.Config{
				InsecureSkipVerify: true,
			},
		}
	}

	return &Client{
		baseURL:    config.GetAPIURL(),
		httpClient: httpClient,
		token:      token,
		userAgent:  "keyway-cli/dev", // Will be set properly at build time
	}
}

func (c *Client) do(ctx context.Context, method, path string, body, result interface{}) error {
	var bodyReader io.Reader
	if body != nil {
		jsonBody, err := json.Marshal(body)
		if err != nil {
			return fmt.Errorf("failed to marshal request: %w", err)
		}
		bodyReader = bytes.NewReader(jsonBody)
	}

	req, err := http.NewRequestWithContext(ctx, method, c.baseURL+path, bodyReader)
	if err != nil {
		return fmt.Errorf("failed to create request: %w", err)
	}

	req.Header.Set("Content-Type", "application/json")
	req.Header.Set("User-Agent", c.userAgent)
	if c.token != "" {
		req.Header.Set("Authorization", "Bearer "+c.token)
	}

	resp, err := c.httpClient.Do(req)
	if err != nil {
		return c.handleNetworkError(err)
	}
	defer resp.Body.Close()

	respBody, err := io.ReadAll(resp.Body)
	if err != nil {
		return fmt.Errorf("failed to read response: %w", err)
	}

	if resp.StatusCode >= 400 {
		var apiErr APIError
		if err := json.Unmarshal(respBody, &apiErr); err != nil {
			return &APIError{

func (c *Client) handleNetworkError(err error) error {
	if os.IsTimeout(err) {
		return fmt.Errorf("connection timed out - check your network connection")
	}
	// Check for common network errors
	errStr := err.Error()
	if strings.Contains(errStr, "no such host") {
		return fmt.Errorf("DNS lookup failed - check your internet connection")
	}
	if strings.Contains(errStr, "connection refused") {
		return fmt.Errorf("connection refused - is the API server running?")
	}
	if strings.Contains(errStr, "certificate") {
		return fmt.Errorf("SSL certificate error - check your system time")
	}
	return fmt.Errorf("network error: %w", err)
}

func (m *MockClient) track(method string) {
	if m.Calls == nil {
		m.Calls = make(map[string]int)
	}
	m.Calls[method]++
}

func (m *MockClient) StartDeviceLogin(ctx context.Context, repository string, repoIds *RepoIds) (*DeviceStartResponse, error) {
	m.track("StartDeviceLogin")
	if m.StartDeviceLoginFn != nil {
		return m.StartDeviceLoginFn(ctx, repository, repoIds)
	}
	return &DeviceStartResponse{
		DeviceCode:              "test-device-code",
		UserCode:                "TEST-CODE",
		VerificationURIComplete: "https://github.com/login/device",
		VerificationURI:         "https://github.com/login/device",
		ExpiresIn:               900,
		Interval:                5,
	}, nil
}

func (m *MockClient) GetRepoIdsFromBackend(ctx context.Context, repoFullName string) (*RepoIds, error) {
	m.track("GetRepoIdsFromBackend")
	if m.GetRepoIdsFromBackendFn != nil {
		return m.GetRepoIdsFromBackendFn(ctx, repoFullName)
	}
	return nil, nil
}

func (m *MockClient) PollDeviceLogin(ctx context.Context, deviceCode string) (*DevicePollResponse, error) {
	m.track("PollDeviceLogin")
	if m.PollDeviceLoginFn != nil {
		return m.PollDeviceLoginFn(ctx, deviceCode)
	}
	return &DevicePollResponse{
		Status:      "approved",
		KeywayToken: "test-keyway-token",
		GitHubLogin: "testuser",
	}, nil
}

func (m *MockClient) ValidateToken(ctx context.Context) (*ValidateTokenResponse, error) {
	m.track("ValidateToken")
	if m.ValidateTokenFn != nil {
		return m.ValidateTokenFn(ctx)
	}
	return &ValidateTokenResponse{
		Login:    "testuser",
		Username: "testuser",
	}, nil
}

func (m *MockClient) CheckGitHubAppInstallation(ctx context.Context, repoOwner, repoName string) (*GitHubAppInstallationStatus, error) {
	m.track("CheckGitHubAppInstallation")
	if m.CheckGitHubAppInstallationFn != nil {
		return m.CheckGitHubAppInstallationFn(ctx, repoOwner, repoName)
	}
	return &GitHubAppInstallationStatus{
		Installed:      true,
		InstallationID: 12345,
	}, nil
}

func (m *MockClient) InitVault(ctx context.Context, repoFullName string) (*InitVaultResponse, error) {
	m.track("InitVault")
	if m.InitVaultFn != nil {
		return m.InitVaultFn(ctx, repoFullName)
	}
	return &InitVaultResponse{
		VaultID:      "vault-123",
		RepoFullName: repoFullName,
		Message:      "Vault created successfully",
	}, nil
}

func (m *MockClient) CheckVaultExists(ctx context.Context, repoFullName string) (bool, error) {
	m.track("CheckVaultExists")
	if m.CheckVaultExistsFn != nil {
		return m.CheckVaultExistsFn(ctx, repoFullName)
	}
	return true, nil
}

func (m *MockClient) GetVaultDetails(ctx context.Context, repoFullName string) (*VaultDetails, error) {
	m.track("GetVaultDetails")
	if m.GetVaultDetailsFn != nil {
		return m.GetVaultDetailsFn(ctx, repoFullName)
	}
	return &VaultDetails{
		ID:           "vault-123",
		RepoFullName: repoFullName,
		SecretCount:  5,
	}, nil
}

func (m *MockClient) GetVaultEnvironments(ctx context.Context, repoFullName string) ([]string, error) {
	m.track("GetVaultEnvironments")
	if m.GetVaultEnvironmentsFn != nil {
		return m.GetVaultEnvironmentsFn(ctx, repoFullName)
	}
	return []string{"production", "staging", "development"}, nil
}

func (m *MockClient) PushSecrets(ctx context.Context, repo, env string, secrets map[string]string) (*PushSecretsResponse, error) {
	m.track("PushSecrets")
	if m.PushSecretsFn != nil {
		return m.PushSecretsFn(ctx, repo, env, secrets)
	}
	return &PushSecretsResponse{
		Success: true,
		Message: fmt.Sprintf("Pushed %d secrets to %s/%s", len(secrets), repo, env),
		Stats: &struct {
			Created int `json:"created"`
			Updated int `json:"updated"`
			Deleted int `json:"deleted"`
		}{
			Created: len(secrets),
			Updated: 0,
			Deleted: 0,
		},
	}, nil
}

func (m *MockClient) PullSecrets(ctx context.Context, repo, env string) (*PullSecretsResponse, error) {
	m.track("PullSecrets")
	if m.PullSecretsFn != nil {
		return m.PullSecretsFn(ctx, repo, env)
	}
	return &PullSecretsResponse{
		Content: "API_KEY=test-api-key\nDB_HOST=localhost\nDB_PORT=5432\n",
	}, nil
}

func (m *MockClient) GetProviders(ctx context.Context) ([]Provider, error) {
	m.track("GetProviders")
	if m.GetProvidersFn != nil {
		return m.GetProvidersFn(ctx)
	}
	return []Provider{
		{Name: "vercel", DisplayName: "Vercel", Configured: true},
		{Name: "railway", DisplayName: "Railway", Configured: true},
	}, nil
}

func (m *MockClient) GetConnections(ctx context.Context) ([]Connection, error) {
	m.track("GetConnections")
	if m.GetConnectionsFn != nil {
		return m.GetConnectionsFn(ctx)
	}
	return []Connection{
		{ID: "conn-1", Provider: "vercel", CreatedAt: "2024-01-01T00:00:00Z"},
	}, nil
}

func (m *MockClient) DeleteConnection(ctx context.Context, connectionID string) error {
	m.track("DeleteConnection")
	if m.DeleteConnectionFn != nil {
		return m.DeleteConnectionFn(ctx, connectionID)
	}
	return nil
}

func (m *MockClient) ConnectWithToken(ctx context.Context, provider, providerToken string) (*ConnectTokenResponse, error) {
	m.track("ConnectWithToken")
	if m.ConnectWithTokenFn != nil {
		return m.ConnectWithTokenFn(ctx, provider, providerToken)
	}
	return &ConnectTokenResponse{
		Success: true,
		User: struct {
			Username string  `json:"username"`
			TeamName *string `json:"teamName,omitempty"`
		}{
			Username: "testuser",
		},
	}, nil
}

func (m *MockClient) GetAllProviderProjects(ctx context.Context, provider string) ([]ProviderProject, []Connection, error) {
	m.track("GetAllProviderProjects")
	if m.GetAllProviderProjectsFn != nil {
		return m.GetAllProviderProjectsFn(ctx, provider)
	}
	return []ProviderProject{
			{ID: "proj-1", Name: "my-project", ConnectionID: "conn-1"},
		}, []Connection{
			{ID: "conn-1", Provider: provider},
		}, nil
}

func (m *MockClient) GetSyncStatus(ctx context.Context, repo, connectionID, projectID, environment string) (*SyncStatus, error) {
	m.track("GetSyncStatus")
	if m.GetSyncStatusFn != nil {
		return m.GetSyncStatusFn(ctx, repo, connectionID, projectID, environment)
	}
	return &SyncStatus{
		IsFirstSync:         false,
		VaultIsEmpty:        false,
		ProviderHasSecrets:  true,
		ProviderSecretCount: 5,
	}, nil
}

func (m *MockClient) GetSyncDiff(ctx context.Context, repo string, opts SyncOptions) (*SyncDiff, error) {
	m.track("GetSyncDiff")
	if m.GetSyncDiffFn != nil {
		return m.GetSyncDiffFn(ctx, repo, opts)
	}
	return &SyncDiff{
		KeywayCount:    3,
		ProviderCount:  2,
		OnlyInKeyway:   []string{"SECRET_A"},
		OnlyInProvider: []string{},
		Different:      []string{"SECRET_B"},
		Same:           []string{"SECRET_C"},
	}, nil
}

func (m *MockClient) GetSyncPreview(ctx context.Context, repo string, opts SyncOptions) (*SyncPreview, error) {
	m.track("GetSyncPreview")
	if m.GetSyncPreviewFn != nil {
		return m.GetSyncPreviewFn(ctx, repo, opts)
	}
	return &SyncPreview{
		ToCreate: []string{"SECRET_A"},
		ToUpdate: []string{"SECRET_B"},
		ToDelete: []string{},
		ToSkip:   []string{"SECRET_C"},
	}, nil
}

func (m *MockClient) ExecuteSync(ctx context.Context, repo string, opts SyncOptions) (*SyncResult, error) {
	m.track("ExecuteSync")
	if m.ExecuteSyncFn != nil {
		return m.ExecuteSyncFn(ctx, repo, opts)
	}
	return &SyncResult{
		Success: true,
		Stats: struct {
			Created int `json:"created"`
			Updated int `json:"updated"`
			Deleted int `json:"deleted"`
		}{
			Created: 1,
			Updated: 1,
			Deleted: 0,
		},
	}, nil
}

func (m *MockClient) StartOrganizationTrial(ctx context.Context, orgLogin string) (*StartTrialResponse, error) {
	return &StartTrialResponse{
		Message:   "Trial started",
		TrialEnds: "2025-02-01",
	}, nil
}

func (c *Client) GetOrganization(ctx context.Context, orgLogin string) (*OrganizationInfo, error) {
	path := fmt.Sprintf("/v1/orgs/%s", orgLogin)
	var wrapper struct {
		Data OrganizationInfo `json:"data"`
	}
	err := c.do(ctx, "GET", path, nil, &wrapper)
	if err != nil {
		return nil, err
	}
	return &wrapper.Data, nil
}

func (c *Client) StartOrganizationTrial(ctx context.Context, orgLogin string) (*StartTrialResponse, error) {
	path := fmt.Sprintf("/v1/orgs/%s/trial/start", orgLogin)
	var wrapper struct {
		Data StartTrialResponse `json:"data"`
	}
	// Send empty object as body (backend expects JSON)
	err := c.do(ctx, "POST", path, struct{}{}, &wrapper)
	if err != nil {
		return nil, err
	}
	return &wrapper.Data, nil
}

func (c *Client) CanStartTrial(ctx context.Context, orgLogin string) (bool, int, error) {
	org, err := c.GetOrganization(ctx, orgLogin)
	if err != nil {
		return false, 0, err
	}

	// Can start trial if status is "none" and effective plan is "free"
	canStart := org.Trial.Status == "none" && org.EffectivePlan == "free"
	return canStart, org.Trial.TrialDurationDays, nil
}

func (c *Client) GetProviders(ctx context.Context) ([]Provider, error) {
	var wrapper struct {
		Data struct {
			Providers []Provider `json:"providers"`
		} `json:"data"`
	}

	err := c.do(ctx, http.MethodGet, "/v1/integrations", nil, &wrapper)
	if err != nil {
		return nil, err
	}

	return wrapper.Data.Providers, nil
}

func (c *Client) GetConnections(ctx context.Context) ([]Connection, error) {
	var wrapper struct {
		Data struct {
			Connections []Connection `json:"connections"`
		} `json:"data"`
	}

	err := c.do(ctx, http.MethodGet, "/v1/integrations/connections", nil, &wrapper)
	if err != nil {
		return nil, err
	}

	return wrapper.Data.Connections, nil
}

func (c *Client) ConnectWithToken(ctx context.Context, provider, providerToken string) (*ConnectTokenResponse, error) {
	body := map[string]string{
		"token": providerToken,
	}

	var wrapper struct {
		Data ConnectTokenResponse `json:"data"`
	}
	err := c.do(ctx, http.MethodPost, fmt.Sprintf("/v1/integrations/%s/connect", provider), body, &wrapper)
	if err != nil {
		return nil, err
	}

	return &wrapper.Data, nil
}

func (c *Client) GetAllProviderProjects(ctx context.Context, provider string) ([]ProviderProject, []Connection, error) {
	var wrapper struct {
		Data struct {
			Projects    []ProviderProject `json:"projects"`
			Connections []Connection      `json:"connections"`
		} `json:"data"`
	}

	err := c.do(ctx, http.MethodGet, fmt.Sprintf("/v1/integrations/providers/%s/all-projects", provider), nil, &wrapper)
	if err != nil {
		return nil, nil, err
	}

	return wrapper.Data.Projects, wrapper.Data.Connections, nil
}

func (c *Client) LinkProject(ctx context.Context, repo string, opts SyncOptions) (*ProjectLink, error) {
	var wrapper struct {
		Data struct {
			Link ProjectLink `json:"link"`
		} `json:"data"`
	}

	body := map[string]interface{}{
		"connectionId":        opts.ConnectionID,
		"projectId":           opts.ProjectID,
		"keywayEnvironment":   opts.KeywayEnvironment,
		"providerEnvironment": opts.ProviderEnvironment,
	}

	err := c.do(ctx, http.MethodPost, fmt.Sprintf("/v1/integrations/vaults/%s/sync/link", repo), body, &wrapper)
	if err != nil {
		return nil, err
	}

	return &wrapper.Data.Link, nil
}

func (c *Client) GetSyncStatus(ctx context.Context, repo, connectionID, projectID, environment string) (*SyncStatus, error) {
	var wrapper struct {
		Data SyncStatus `json:"data"`
	}

	path := fmt.Sprintf("/v1/integrations/vaults/%s/sync/status?connectionId=%s&projectId=%s&environment=%s",
		repo, connectionID, projectID, environment)

	err := c.do(ctx, http.MethodGet, path, nil, &wrapper)
	if err != nil {
		return nil, err
	}

	return &wrapper.Data, nil
}

func (c *Client) GetSyncDiff(ctx context.Context, repo string, opts SyncOptions) (*SyncDiff, error) {
	var wrapper struct {
		Data SyncDiff `json:"data"`
	}

	// Build query string for GET request
	path := fmt.Sprintf("/v1/integrations/vaults/%s/sync/diff?connectionId=%s&projectId=%s&keywayEnvironment=%s&providerEnvironment=%s",
		repo, opts.ConnectionID, opts.ProjectID, opts.KeywayEnvironment, opts.ProviderEnvironment)
	if opts.ServiceID != nil {
		path += fmt.Sprintf("&serviceId=%s", *opts.ServiceID)
	}

	err := c.do(ctx, http.MethodGet, path, nil, &wrapper)
	if err != nil {
		return nil, err
	}

	return &wrapper.Data, nil
}

func (c *Client) GetSyncPreview(ctx context.Context, repo string, opts SyncOptions) (*SyncPreview, error) {
	var wrapper struct {
		Data SyncPreview `json:"data"`
	}

	// Build query string for GET request
	path := fmt.Sprintf("/v1/integrations/vaults/%s/sync/preview?connectionId=%s&projectId=%s&keywayEnvironment=%s&providerEnvironment=%s&direction=%s&allowDelete=%t",
		repo, opts.ConnectionID, opts.ProjectID, opts.KeywayEnvironment, opts.ProviderEnvironment, opts.Direction, opts.AllowDelete)
	if opts.ServiceID != nil {
		path += fmt.Sprintf("&serviceId=%s", *opts.ServiceID)
	}

	err := c.do(ctx, http.MethodGet, path, nil, &wrapper)
	if err != nil {
		return nil, err
	}

	return &wrapper.Data, nil
}

func (c *Client) ExecuteSync(ctx context.Context, repo string, opts SyncOptions) (*SyncResult, error) {
	var wrapper struct {
		Data SyncResult `json:"data"`
	}

	body := map[string]interface{}{
		"connectionId":        opts.ConnectionID,
		"projectId":           opts.ProjectID,
		"keywayEnvironment":   opts.KeywayEnvironment,
		"providerEnvironment": opts.ProviderEnvironment,
		"direction":           opts.Direction,
		"allowDelete":         opts.AllowDelete,
	}
	if opts.ServiceID != nil {
		body["serviceId"] = *opts.ServiceID
	}

	err := c.do(ctx, http.MethodPost, fmt.Sprintf("/v1/integrations/vaults/%s/sync", repo), body, &wrapper)
	if err != nil {
		return nil, err
	}

	return &wrapper.Data, nil
}