atsign-foundation · srieteja · Nov 6, 2025 · Nov 6, 2025 · Nov 6, 2025 · Nov 13, 2025
diff --git a/apps/admin/admin_api/pubspec.lock b/apps/admin/admin_api/pubspec.lock
@@ -118,10 +118,10 @@ packages:
     dependency: transitive
     description:
       name: at_onboarding_cli
-      sha256: "264be4a871a4d6cc417ae74886eebac36defc72297f4a9dd4dda37b720bdfbc0"
+      sha256: "9e8317662dffb447e5dd41e82d5825eea0d44460e01c106570902224a97abd44"
       url: "https://pub.dev"
     source: hosted
-    version: "1.12.0"
+    version: "1.14.2"
   at_persistence_secondary_server:
     dependency: transitive
     description:

diff --git a/packages/dart/noports_core/lib/commands.dart b/packages/dart/noports_core/lib/commands.dart
@@ -0,0 +1,10 @@
+library noports_core_activate;
+
+// Implementations
+export 'package:noports_core/src/commands/activate/activate_impl.dart';
+export 'package:noports_core/src/commands/issue_keys/issue_keys_impl.dart';
+
+// Utilities
+export 'package:noports_core/src/commands/utils/console.dart';
+export 'package:noports_core/src/commands/utils/usage_messages.dart';
+export 'package:noports_core/src/common/help_requested_exception.dart';
diff --git a/packages/dart/noports_core/lib/src/commands/activate/activate_impl.dart b/packages/dart/noports_core/lib/src/commands/activate/activate_impl.dart
@@ -0,0 +1,145 @@
+import 'dart:io';
+
+import 'package:at_auth/at_auth.dart';
+import 'package:at_client/at_client.dart';
+import 'package:at_onboarding_cli/at_onboarding_cli.dart';
+import 'package:at_utils/at_logger.dart';
+import 'package:noports_core/commands.dart';
+import 'package:noports_core/src/commands/activate/activate_params.dart';
+import 'package:noports_core/utils.dart';
+
+class Activate {
+  final ActivateParams _params;
+
+  final AtOnboardingService _onboardingService;
+
+  final logger = AtSignLogger('Activate', loggingHandler: CLILoggingHandler())
+    ..level = 'info';
+
+  Activate(this._onboardingService, this._params);
+
+  factory Activate.fromArgs(List<String> args) {
+    if (args.isEmpty) {
+      throw ArgumentError('At least one argument is required.');
+    }
+
+    ActivateParams params = ActivateParams.fromArgs(args);
+
+    final preference = AtOnboardingPreference()
+      ..cramSecret = params.cramSecret
+      ..atKeysFilePath = params.atKeysFilePath;
+    AtOnboardingService service = AtOnboardingServiceImpl(
+      params.atsign,
+      preference,
+    );
+
+    return Activate(service, params);
+  }
+
+  /// Entry point for the activate command
+  Future<int> wrappedMain() async {
+    switch (_params.type) {
+      case ActivateType.cram:
+        return await cramAuthenticate();
+      case ActivateType.enroll:
+        return await enroll();
+    }
+  }
+
+  /// Authenticates an existing atSign using CRAM credentials
+  ///
+  /// Requires [_params.cramSecret] to be set
+  ///
+  /// Returns: 0 if authentication succeeds, 1 in case of failure
+  /// Throws: [ArgumentError] if cram credentials are missing
+  Future<int> cramAuthenticate() async {
+    if (_params.cramSecret == null) {
+      throw ArgumentError('Cannot perform CRAM auth without secret');
+    }
+    logger.info('Activating atsign: ${_params.atsign}');
+
+    final success = await _onboardingService.onboard();
+
+    if (!success) {
+      logger.shout('Activation Failed');
+      return 1;
+    }
+    logger.info('Activated');
+    return 0;
+  }
+
+  /// Enrolls a new device using APKAM enrollment
+  ///
+  /// Requires [_params.otp] and [_params.device] to be set.
+  /// Optionally uses [_params.atKeysFilePath] if provided.
+  ///
+  /// Returns: [AtEnrollmentResponse] containing enrollment status and details
+  /// Throws: [ArgumentError] if otp is missing
+  Future<int> enroll() async {
+    if (_params.otp == null) {
+      throw ArgumentError('Cannot create enrollment without otp');
+    }
+    logger.info(
+      'Creating new enrollment with deviceName: ${_params.deviceName}',
+    );
+
+    await _validateAndPrepareKeysFile();
+
+    final response = await _onboardingService.enroll(
+      _params.appName,
+      _params.deviceName!,
+      _params.otp!,
+      _params.namespaces,
+      atKeysFile: _getKeysFile(),
+    );
+
+    return response.enrollStatus == EnrollmentStatus.approved ? 0 : 1;
+  }
+
+  /// Validates and prepares the atKeys file location before enrollment.
+  ///
+  /// This method checks if a keys file already exists at the target location
+  /// (either specified by the user or at the default path) and prompts the user
+  /// to provide an alternate location if a file is found. This prevents
+  /// accidentally overwriting existing authentication keys during enrollment.
+  ///
+  /// The validation flow:
+  /// 1. If [_params.atKeysFilePath] is null, checks the default keys file path
+  ///    from the [AtOnboardingPreference]
+  /// 2. If [_params.atKeysFilePath] is provided, checks that custom path
+  /// 3. If a file exists at either location, prompts the user for an alternate
+  ///    path and updates [_params.atKeysFilePath]
+  /// 4. If no file exists, returns without modification (safe to proceed)
+  ///
+  ///
+  /// TODO: Replace [AtOnboardingServiceImpl] after ensuring that
+  /// [AtOnboardingService] throws a specific exception when keyFile exists at defaultPath
+  Future<void> _validateAndPrepareKeysFile() async {
+    final String? keysFilePath;
+
+    if (_params.atKeysFilePath == null) {
+      // Use the default path from onboarding service preferences
+      keysFilePath = (_onboardingService as AtOnboardingServiceImpl)
+          .atOnboardingPreference
+          .atKeysFilePath;
+    } else {
+      // Use the user-provided path
+      keysFilePath = _params.atKeysFilePath;
+    }
+
+    if (keysFilePath != null && !File(keysFilePath).existsSync()) {
+      return;
+    }
+
+    logger.shout('KeysFile exists at $keysFilePath');
+    _params.atKeysFilePath = promptUser(
+      'Please provide alternate location to store keyfile',
+    );
+    logger.info('Sending updated enrollment request');
+  }
+
+  File? _getKeysFile() {
+    final path = _params.atKeysFilePath;
+    return path != null ? File(path) : null;
+  }
+}
diff --git a/packages/dart/noports_core/lib/src/commands/activate/activate_params.dart b/packages/dart/noports_core/lib/src/commands/activate/activate_params.dart
@@ -0,0 +1,131 @@
+import 'package:args/args.dart';
+import 'package:at_commons/atsign.dart';
+import 'package:noports_core/commands.dart';
+import 'package:noports_core/src/commands/utils/constants.dart';
+import 'package:noports_core/src/commands/utils/regex.dart';
+
+enum ActivateType {
+  cram,
+  enroll;
+
+  static ActivateType parse(String input) {
+    try {
+      return values.firstWhere((type) => input.contains(type.name));
+    } on Exception {
+      throw ArgumentError(
+        'Invalid activation type in: $input (expected "cram" or "enroll")',
+      );
+    }
+  }
+}
+
+class ActivateParams {
+  final String atsign;
+  final ActivateType type;
+  final String? cramSecret;
+  final String? otp;
+  final String? deviceName;
+  final appName = defaultAppName;
+  final namespaces = defaultEnrollmentNamespaces;
+
+  String? atKeysFilePath;
+
+  // Static parser for consistent usage and help generation
+  static final ArgParser argParser = _createArgParser();
+
+  ActivateParams({
+    required this.atsign,
+    required this.type,
+    this.cramSecret,
+    this.otp,
+    this.deviceName,
+    this.atKeysFilePath,
+  });
+
+  factory ActivateParams.fromArgs(List<String> args) {
+    final results = argParser.parse(args);
+
+    if (results.wasParsed('help')) {
+      throw HelpRequestedException();
+    }
+
+    if (results.rest.isEmpty) {
+      throw ArgumentError(
+        'Activation string is required (e.g. @alice:cram:secret or'
+        ' @alice:enroll:otp:123456)',
+      );
+    }
+
+    final activationString = results.rest.single;
+    final type = ActivateType.parse(activationString);
+
+    final atsign = _parseAtsign(activationString, type);
+    if (atsign == null || atsign.isEmpty) {
+      throw ArgumentError('atsign is required in activation string');
+    }
+
+    // parse from arg parser results
+    final keyfile = results['target-keyfile'] as String?;
+
+    return ActivateParams(
+      atsign: atsign,
+      type: type,
+      cramSecret: _parseCramSecret(activationString),
+      otp: _parseOtp(activationString),
+      deviceName: _parseDeviceName(activationString),
+      atKeysFilePath: keyfile,
+    );
+  }
+
+  static ArgParser _createArgParser() {
+    return ArgParser()
+      ..addOption(
+        'target-keyfile',
+        abbr: 't',
+        mandatory: false,
+        help: 'Destination path for atKeys file',
+      )
+      ..addFlag(
+        'help',
+        abbr: 'h',
+        negatable: false,
+        help: 'Show this usage info',
+      );
+  }
+
+  static String? _parseAtsign(String input, ActivateType type) {
+    final regex = type == ActivateType.cram
+        ? ActivateRegex.cram
+        : ActivateRegex.enroll;
+
+    final match = regex.firstMatch(input);
+    final atsign = match?.namedGroup(ActivateRegexGroups.atsign);
+
+    return atsign != null && atsign.isNotEmpty ? atsign.toAtsign() : null;
+  }
+
+  static String? _parseCramSecret(String input) {
+    final match = ActivateRegex.cram.firstMatch(input);
+    return match?.namedGroup(ActivateRegexGroups.cram);
+  }
+
+  static String? _parseOtp(String input) {
+    final match = ActivateRegex.enroll.firstMatch(input);
+    return match?.namedGroup(ActivateRegexGroups.otp);
+  }
+
+  static String? _parseDeviceName(String input) {
+    final match = ActivateRegex.enroll.firstMatch(input);
+    return match?.namedGroup(ActivateRegexGroups.deviceName);
+  }
+
+  Map<String, String?> toJson() {
+    return {
+      'atsign': atsign,
+      'cramSecret': cramSecret,
+      'otp': otp,
+      'deviceName': deviceName,
+      'atKeysFilePath': atKeysFilePath,
+    };
+  }
+}