aspera-cli 4.27.2 → 4.27.3

data/lib/aspera/cli/plugins/server.rb

@@ -81,7 +81,6 @@ module Aspera
           @connection_type = :ssh
           @ascmd_executor = nil
           @server_transfer_spec = nil
-          options.parse_options!
           @ssh_opts = options.get_option(:ssh_options).symbolize_keys
         end
 
@@ -160,7 +159,7 @@ module Aspera
         end
 
         Sync::Operations::DIRECTIONS.each do |dir|
-          define_method(:"action_sync_#{dir}") { |path:, sync_info: {}, **| run_sync_transfer(dir, path: path, sync_info: sync_info) { @server_transfer_spec } }
+          define_method(:"action_sync_#{dir}") { |path:, sync_info: {}, **| run_sync_transfer(dir, path: path, sync_info: sync_info) { server_transfer_spec } }
         end
 
         # --- DSL ---
@@ -169,22 +168,18 @@ module Aspera
         option :passphrase,  description: 'SSH private key passphrase'
         option :ssh_options, description: 'SSH options', allowed: Hash
 
-        # root_setup runs once before any command argument is consumed, populating
-        # @server_transfer_spec and @ascmd_executor so that condition methods work.
-        root_setup :setup_server
-
         command :health, description: 'Check transfer health'
-        command(:upload, description: 'Upload files to server', transfer_paths: :send, action: lambda do
-          @server_transfer_spec['direction'] = Transfer::Spec.transfer_type_to_direction(:upload)
-          Runner.result_transfer(transfer.start(@server_transfer_spec))
+        command(:upload, description: 'Upload files to server', transfer_paths: :send, action: lambda do |**|
+          server_transfer_spec['direction'] = Transfer::Spec.transfer_type_to_direction(:upload)
+          Runner.result_transfer(transfer.start(server_transfer_spec))
         end)
         command(
           :download,
           description: 'Download files from server',
           transfer_paths: :receive,
-          action: lambda do
-            @server_transfer_spec['direction'] = Transfer::Spec.transfer_type_to_direction(:download)
-            Runner.result_transfer(transfer.start(@server_transfer_spec))
+          action: lambda do |**|
+            server_transfer_spec['direction'] = Transfer::Spec.transfer_type_to_direction(:download)
+            Runner.result_transfer(transfer.start(server_transfer_spec))
           end
         )
         command :sync, description: 'Synchronize files with server'
@@ -201,43 +196,76 @@ module Aspera
         end
 
         # AsCmd operations (available only when SSH/local - not WSS)
-        ASCMD_ARGS = [{name: :command_arguments, multiple: true, mandatory: false, default: nil}].freeze
-        private_constant :ASCMD_ARGS
+        # Arguments follow AsCmd::OPS_ARGS: one path per operation, or source and destination
+        PATHS_ARGS = [{name: :paths, multiple: true}].freeze
+        private_constant :PATHS_ARGS
 
-        command :ls,     description: 'List files',            condition: :ascmd_available?, aliases: [:browse], arguments: ASCMD_ARGS
-        command :rm,     description: 'Delete files',          condition: :ascmd_available?, aliases: [:delete], arguments: ASCMD_ARGS
-        command :mv,     description: 'Rename/move files',     condition: :ascmd_available?, aliases: [:rename], arguments: ASCMD_ARGS
-        command :cp,     description: 'Copy files',            condition: :ascmd_available?,                     arguments: ASCMD_ARGS
-        command :mkdir,  description: 'Create directory',      condition: :ascmd_available?,                     arguments: ASCMD_ARGS
-        command :df,     description: 'Show disk usage',       condition: :ascmd_available?,                     arguments: ASCMD_ARGS
-        command :du,     description: 'Show file sizes',       condition: :ascmd_available?,                     arguments: ASCMD_ARGS
-        command :md5sum, description: 'Compute MD5 checksums', condition: :ascmd_available?,                     arguments: ASCMD_ARGS
-        command :info,   description: 'Show server system information',   condition: :ascmd_available?,                     arguments: ASCMD_ARGS
+        command(
+          :ls, description: 'List files', condition: :ascmd_available?, aliases: [:browse], arguments: PATHS_ARGS,
+          action: lambda do |paths:, **|
+            execute_ascmd(:ls, paths) do |result|
+              Result::ObjectList.new(result.map(&:stringify_keys), fields: %w[zmode zuid zgid size mtime name])
+            end
+          end
+        )
+        command :rm,     description: 'Delete files', condition: :ascmd_available?, aliases: [:delete], arguments: PATHS_ARGS
+        command :mv,     description: 'Rename/move files: source destination pairs, or sources with --to-folder', condition: :ascmd_available?, aliases: [:rename], arguments: PATHS_ARGS
+        command :cp,     description: 'Copy files: source destination pairs, or sources with --to-folder',        condition: :ascmd_available?,                     arguments: PATHS_ARGS
+        command :mkdir,  description: 'Create directory', condition: :ascmd_available?, arguments: PATHS_ARGS
+        command(
+          :df, description: 'Show disk usage', condition: :ascmd_available?,
+          action: lambda do |**|
+            execute_ascmd(:df, []) do |result|
+              Result::ObjectList.new(result.map(&:stringify_keys))
+            end
+          end
+        )
+        command :du,     description: 'Show file sizes',       condition: :ascmd_available?,                     arguments: PATHS_ARGS
+        command :md5sum, description: 'Compute MD5 checksums', condition: :ascmd_available?,                     arguments: PATHS_ARGS
+        command :info,   description: 'Show server system information', condition: :ascmd_available?,
+          action: ->(**) { execute_ascmd(:info, []) { |r| Result::SingleObject.new(r.stringify_keys) } }
 
         # Generate ascmd handlers - convention: action_<op>
-        %i[rm mv cp mkdir].each do |op|
-          define_action_method([op]) do |command_arguments:, **|
-            execute_ascmd(op, command_arguments) { Result::Success.new }
+        %i[rm mkdir].each do |op|
+          define_action_method([op]) do |paths:, **|
+            execute_ascmd(op, paths) { Result::Success.new }
+          end
+        end
+
+        %i[mv cp].each do |op|
+          define_action_method([op]) do |paths:, **|
+            execute_ascmd(op, source_destination_pairs(paths)) { Result::Success.new }
           end
         end
 
-        %i[du md5sum info].each do |op|
-          define_action_method([op]) do |command_arguments:, **|
-            execute_ascmd(op, command_arguments) { |r| Result::SingleObject.new(r.stringify_keys) }
+        %i[du md5sum].each do |op|
+          define_action_method([op]) do |paths:, **|
+            execute_ascmd(op, paths) { |r| Result::SingleObject.new(r.stringify_keys) }
           end
         end
 
         # --- conditions ---
 
         def ascmd_available?
-          !@ascmd_executor.nil?
+          !ascmd_executor.nil?
+        end
+
+        # --- server access ---
+
+        # @return [Hash] base transfer spec, built from CLI options on first use
+        def server_transfer_spec
+          build_server_access if @server_transfer_spec.nil?
+          @server_transfer_spec
         end
 
-        # --- setup ---
+        # @return [LocalExecutor, Ssh, nil] ascmd executor, nil with WSS (ascmd not available)
+        def ascmd_executor
+          build_server_access if @server_transfer_spec.nil?
+          @ascmd_executor
+        end
 
         # Build the transfer spec and ascmd executor from CLI options.
-        # Stores results in instance variables; returns empty context hash.
-        def setup_server(**)
+        def build_server_access
           @server_transfer_spec = options_to_base_transfer_spec
           @ascmd_executor = case @connection_type
           when :local then LocalExecutor.new
@@ -245,14 +273,13 @@ module Aspera
           when :ssh   then Ssh.new(@server_transfer_spec['remote_host'], @server_transfer_spec['remote_user'], @ssh_opts)
           else Aspera.error_unexpected_value(@connection_type) { 'connection type' }
           end
-          {}
         end
 
         # --- health ---
 
-        def action_health_transfer
+        def action_health_transfer(**)
           nagios = Nagios.new
-          probe_ts = @server_transfer_spec.merge({
+          probe_ts = server_transfer_spec.merge({
             'direction'     => 'send',
             'cookie'        => 'aspera.sync', # hide in console
             'resume_policy' => 'none',
@@ -269,24 +296,23 @@ module Aspera
 
         # --- ascmd handlers ---
 
-        def action_ls(command_arguments:, **)
-          execute_ascmd(:ls, command_arguments) do |result|
-            Result::ObjectList.new(result.map(&:stringify_keys), fields: %w[zmode zuid zgid size mtime name])
-          end
-        end
+        private
 
-        def action_df(command_arguments:, **)
-          execute_ascmd(:df, command_arguments) do |result|
-            Result::ObjectList.new(result.map(&:stringify_keys))
-          end
+        # AsCmd `cp` and `mv` take source and destination pairs.
+        # With option `to_folder`, paths are only sources, copied or moved into that folder.
+        # @param paths [Array<String>] command line arguments
+        # @return [Array<String>] flat list of source and destination pairs
+        def source_destination_pairs(paths)
+          to_folder = options.get_option(:to_folder)
+          return paths.flat_map { |source| [source, "#{to_folder.chomp('/')}/#{File.basename(source)}"] } unless to_folder.nil?
+          Aspera.assert(paths.length.even?, type: Cli::BadArgument) { 'expecting pairs: <source> <destination> ..., or sources with option to_folder' }
+          paths
         end
 
-        private
-
-        def execute_ascmd(op, command_arguments)
-          ascmd = AsCmd.new(@ascmd_executor)
+        def execute_ascmd(op, arguments)
+          ascmd = AsCmd.new(ascmd_executor)
           begin
-            result = ascmd.execute_single(op, command_arguments)
+            result = ascmd.execute_single(op, arguments)
             yield(result)
           rescue AsCmd::Error => e
             raise Cli::BadArgument, e.extended_message

data/lib/aspera/cli/plugins/shares.rb

@@ -3,7 +3,7 @@
 require 'aspera/cli/plugins/basic_auth'
 require 'aspera/cli/plugins/node'
 require 'aspera/assert'
-require 'aspera/rest_list'
+require 'aspera/rest/list'
 
 module Aspera
   module Cli
@@ -23,7 +23,7 @@ module Aspera
             result[:version] =
               begin
                 version = nil
-                login_page = Rest
+                login_page = Rest::Client
                   .new(base_url: url, redirect_max: 2)
                   .read('', headers: {'Accept'=>'text/html'})
                 Aspera.assert(login_page.include?('aspera-Shares')) { 'not Shares' }
@@ -39,16 +39,16 @@ module Aspera
               end
             result[:ping] =
               begin
-                Rest
+                Rest::Client
                   .new(base_url: "#{url}/#{NODE_API_PATH}")
-                  .read('ping', headers: {'Content-Type'=>'application/json'})
+                  .read('ping', headers: {'Content-Type' => Mime::JSON})
                 'ping ok'
               rescue => e
                 e
               end
             result[:api] =
               begin
-                data, resp = Rest
+                data, resp = Rest::Client
                   .new(base_url: "#{url}/#{NODE_API_PATH}", redirect_max: 1)
                   .read('info', exception: false, ret: :both)
                 # shall fail: shares requires auth, but we check error message
@@ -103,12 +103,19 @@ module Aspera
         SHARE_PERMISSIONS_OPS = %i[list show].freeze
         # group users: Rails only exposes index+show+update+destroy (no create)
         GROUP_USERS_OPS = (Operations::ALL - %i[create]).freeze
+        # Arguments of group users commands, by operation
+        GROUP_USERS_ARGS = {
+          show:   [{name: :user_id, type: :identifier}],
+          modify: [{name: :user_id, type: :identifier}, {name: :user, type: Hash}],
+          delete: [{name: :user_id, type: :identifier}]
+        }.freeze
 
         # --- DSL ---
 
         command :health,   description: 'Check Shares health'
-        command :info,     description: 'Show server information', action: -> { Result::SingleObject.new(basic_auth_api(NODE_API_PATH).read('info', headers: {'Content-Type'=>'application/json'})) }
-        command :files,    description: 'Browse and transfer files on Shares', aliases: [:repository], setup: :setup_shares_node
+        command :info,     description: 'Show server information', action: ->(**) { Result::SingleObject.new(basic_auth_api(NODE_API_PATH).read('info', headers: {'Content-Type' => Mime::JSON})) }
+        command :files,    description: 'Browse and transfer files on Shares', aliases: [:repository],
+          mount: {plugin: Node, instance: :shares_node_plugin, only: Node::COMMANDS_SHARES}
         command :admin,    description: 'Administer Shares', setup: :setup_admin
 
         commands_under :admin do
@@ -137,30 +144,33 @@ module Aspera
               command :ldap,  description: "LDAP #{entity_type}s"
               command :saml,  description: "SAML #{entity_type}s"
 
+              user_fields = %w[id user_id username first_name last_name email] if entity_type.eql?(:user)
               # all: list/show/delete only (no create, no modify — users/groups/:all has no update route)
               lookup_method_all = :"lookup_shares_#{entity_type}_all_id"
               commands_under :all do
-                (Operations::ALL - %i[create modify]).each do |op|
-                  id_args = Operations::GLOBAL.include?(op) ? {} : {arguments: [{name: :"#{entity_type}_id", type: :identifier, lookup: lookup_method_all}]}
-                  command op, description: "#{op.capitalize} #{entity_type}s", **id_args
-                end
+                crud_commands entity: "data/#{entity_type}s",
+                  api:            :@api_shares_admin,
+                  name:           entity_type.to_s,
+                  operations:     Operations::ALL - %i[create modify],
+                  lookup:         lookup_method_all,
+                  display_fields: user_fields && (user_fields + %w[directory_user])
                 USR_GRP_SETTINGS.each do |setting|
                   # share_permissions: Rails only exposes index+show (read-only)
                   setting_ops = setting.eql?(:share_permissions) ? SHARE_PERMISSIONS_OPS : %i[show modify]
                   command setting,
-                    description: "Manage #{setting} for a #{entity_type}",
+                    description: "Manage #{entity_noun(setting, singular: false)} for a #{entity_type}",
                     arguments: [{name: :"#{entity_type}_id", type: :identifier, lookup: lookup_method_all}]
                   commands_under setting do
                     setting_ops.each do |op|
-                      # share_permissions > show needs a permission identifier (list does not)
-                      perm_id_arg = if setting.eql?(:share_permissions) && op.eql?(:show)
-                        [{name: :permission_id, type: :identifier, lookup: :lookup_share_id}]
-                      else
-                        []
-                      end
+                      # share_permissions > show needs a permission identifier (list does not), modify needs data
+                      op_args =
+                        case op
+                        when :show then setting.eql?(:share_permissions) ? [{name: :permission_id, type: :identifier, lookup: :lookup_share_id}] : nil
+                        when :modify then [{name: setting, type: Hash}]
+                        end
                       command op,
-                        description: "#{op.capitalize} #{setting} for a #{entity_type}",
-                        arguments: perm_id_arg.empty? ? nil : perm_id_arg
+                        description: "#{op.capitalize} #{entity_noun(setting, singular: false)} for a #{entity_type}",
+                        arguments: op_args
                     end
                   end
                 end
@@ -170,7 +180,7 @@ module Aspera
                     arguments: [{name: :group_id, type: :identifier, lookup: :lookup_shares_group_all_id}]
                   commands_under :users do
                     GROUP_USERS_OPS.each do |op|
-                      command op, description: "#{op.capitalize} users of a group"
+                      command op, description: "#{op.capitalize} users of a group", arguments: GROUP_USERS_ARGS[op]
                     end
                   end
                 end
@@ -179,17 +189,19 @@ module Aspera
               # local: full CRUD only — no nested settings (Rails does not nest transfer_settings/app_authorizations/share_permissions under local_users/local_groups)
               commands_under :local do
                 lookup_method_local = :"lookup_shares_#{entity_type}_local_id"
-                Operations::ALL.each do |op|
-                  id_args = Operations::GLOBAL.include?(op) ? {} : {arguments: [{name: :"#{entity_type}_id", type: :identifier, lookup: lookup_method_local}]}
-                  command op, description: "#{op.capitalize} #{entity_type}s", **id_args
-                end
+                crud_commands entity: "data/local_#{entity_type}s",
+                  api:            :@api_shares_admin,
+                  name:           "local #{entity_type}",
+                  lookup:         lookup_method_local,
+                  display_fields: user_fields,
+                  body_component: Schema::Registry::SHARES
                 if entity_type.eql?(:group)
                   command :users,
                     description: 'Manage users of a group',
                     arguments: [{name: :group_id, type: :identifier, lookup: :lookup_shares_group_local_id}]
                   commands_under :users do
                     GROUP_USERS_OPS.each do |op|
-                      command op, description: "#{op.capitalize} users of a group"
+                      command op, description: "#{op.capitalize} users of a group", arguments: GROUP_USERS_ARGS[op]
                     end
                   end
                 end
@@ -198,13 +210,13 @@ module Aspera
               # ldap: add only
               commands_under :ldap do
                 command :add, description: "Add a LDAP #{entity_type}",
-                  arguments: [{name: :entity_name, type: String, bulk: true}]
+                  arguments: [{name: entity_type, bulk: true}]
               end
 
               # saml: import only
               commands_under :saml do
                 command :import, description: "Import a SAML #{entity_type}",
-                  arguments: [{name: :entity_parameters, type: Hash, bulk: true}]
+                  arguments: [{name: entity_type, type: Hash, bulk: true}]
               end
             end
           end
@@ -221,7 +233,7 @@ module Aspera
             lookup_method = :"lookup_shares_#{entity_type}_#{location}_id"
             define_method(lookup_method) do |field, value, **|
               path = admin_entity_path(entity_type, location)
-              RestList.lookup_entity_generic(entity: entity_type, field: field, value: value) { @api_shares_admin.read(path) }['id']
+              Rest::List.lookup_entity_generic(entity: entity_type, field: field, value: value) { @api_shares_admin.read(path) }['id']
             end
             private lookup_method
           end
@@ -245,7 +257,8 @@ module Aspera
         %i[user_permissions group_permissions].each do |perm_type|
           commands_under [:admin, :share, perm_type] do
             SHARE_PERMISSIONS_OPS.each do |op|
-              command op, description: "#{op.capitalize} #{perm_type}"
+              command op, description: "#{op.capitalize} #{entity_noun(perm_type, singular: false)}",
+                arguments: op.eql?(:show) ? [{name: :permission_id, type: :identifier}] : nil
             end
           end
         end
@@ -259,11 +272,11 @@ module Aspera
 
         # --- setup ---
 
-        # Build the Shares node API plugin and inject into ctx.
-        # @return [Hash] context hash containing :shares_node_plugin
-        def setup_shares_node(**)
-          api_shares_node = basic_auth_api(NODE_API_PATH)
-          {shares_node_plugin: Node.new(context: context, api: api_shares_node)}
+        # files - mount target: Node plugin on the Shares node API.
+        # Api::Node (not plain Rest::Client) so that Node commands using its helpers work (e.g. spec, transport).
+        # @return [Node]
+        def shares_node_plugin(**)
+          Node.new(context: context, api: Api::Node.new(**basic_auth_params(NODE_API_PATH)))
         end
 
         # Build the admin REST API and store in ivar.
@@ -275,12 +288,12 @@ module Aspera
 
         # Lookup a share id by field/value using the admin API.
         def lookup_share_id(field, value, **)
-          RestList.lookup_entity_generic(entity: 'share', field: field, value: value) { @api_shares_admin.read('data/shares') }['id']
+          Rest::List.lookup_entity_generic(entity: 'share', field: field, value: value) { @api_shares_admin.read('data/shares') }['id']
         end
 
         # --- health ---
 
-        def action_health
+        def action_health(**)
           nagios = Nagios.new
           shares_url = options.get_option(:url, mandatory: true)
           health = self.class.health_check(shares_url)
@@ -298,44 +311,6 @@ module Aspera
           Result::ObjectList.new(nagios.status_list)
         end
 
-        # --- files sub-commands (restricted to COMMANDS_SHARES, delegated to Node) ---
-
-        commands_under :files do
-          Node::COMMANDS_SHARES.each do |cmd|
-            next if cmd.eql?(:sync) # intermediate node with sub-commands, declared separately below
-            spec = Node::COMMANDS_GEN3_SPEC[cmd] || {description: "Node #{cmd} command"}
-            command cmd, **spec
-          end
-          command :sync, description: 'Synchronize folders (Gen3)'
-          commands_under :sync do
-            Sync::Operations::DIRECTIONS.each do |dir|
-              command dir, description: "#{dir.capitalize}-sync (Gen3)", transfer_paths: :send, arguments: SyncActions::PATH_AND_INFO_ARGS
-            end
-            command :admin, description: 'Manage sync database (admin operations)'
-            SyncActions.register_sync_admin_commands(self, :admin)
-          end
-        end
-
-        # One handler per COMMANDS_SHARES command (except :sync which is an intermediate node).
-        Node::COMMANDS_SHARES.reject { |cmd| cmd.eql?(:sync) }.each do |cmd|
-          define_action_method([:files, cmd]) do |shares_node_plugin:, **ctx|
-            shares_node_plugin.dispatch_v3_command(cmd, **ctx)
-          end
-        end
-
-        # Handlers for files > sync > <direction>: delegate to Node's [:sync, dir] leaf.
-        Sync::Operations::DIRECTIONS.each do |dir|
-          define_action_method([:files, :sync, dir]) do |shares_node_plugin:, **ctx|
-            shares_node_plugin.dispatch_from_registry([:sync, dir], ctx, skip_setup: true)
-          end
-        end
-        # Handlers for files > sync > admin > <op>: delegate to Node's [:sync, :admin, op] leaf.
-        SyncActions::ADMIN_COMMANDS.each do |op|
-          define_action_method([:files, :sync, :admin, op]) do |shares_node_plugin:, **ctx|
-            shares_node_plugin.dispatch_from_registry([:sync, :admin, op], ctx, skip_setup: true)
-          end
-        end
-
         private
 
         # @return [String] admin API path for the given entity_type and location
@@ -346,42 +321,25 @@ module Aspera
 
         # --- admin > user|group handlers ---
 
-        # Shared handler for list/show/delete/create/modify on user or group.
-        # @param entity_type [Symbol] :user or :group
-        # @param location    [Symbol] :all or :local
-        # @param op          [Symbol] CRUD operation
-        def action_admin_entity_crud(entity_type, location, op)
-          path = admin_entity_path(entity_type, location)
-          lookup = ->(f, v) { RestList.lookup_entity_generic(entity: entity_type, field: f, value: v) { @api_shares_admin.read(path) }['id'] }
-          display_fields = entity_type.eql?(:user) ? %w[id user_id username first_name last_name email] : nil
-          display_fields&.push('directory_user') if entity_type.eql?(:user) && location.eql?(:all)
-          # :all excludes :create; :local has a documented POST+PUT requestBody for both users and groups
-          body_component = location.eql?(:local) ? Schema::Registry::SHARES : nil
-          id = Operations::INSTANCE.include?(op) ? options.instance_identifier(&lookup) : nil
-          send(:"entity_#{op}", api: @api_shares_admin, entity: path, id: id, display_fields: display_fields, body_component: body_component)
-        end
-
         # Shared handler for USR_GRP_SETTINGS (transfer_settings, app_authorizations, share_permissions)
         # @param entity_type [Symbol] :user or :group
         # @param location    [Symbol] :all or :local
         # @param setting     [Symbol] one of USR_GRP_SETTINGS
         # @param op          [Symbol] CRUD operation
-        # entity_id: resolved via arguments:(:identifier) on each setting leaf command
-        def action_admin_entity_setting(entity_type, location, setting, op, entity_id:, permission_id: nil, **)
-          path = admin_entity_path(entity_type, location)
-          entity_path = "#{path}/#{entity_id}/#{setting}"
-          is_singleton = !setting.eql?(:share_permissions)
-          id = permission_id || (Operations::INSTANCE.include?(op) && !is_singleton ? options.instance_identifier { |f, v| lookup_share_id(f, v) } : nil)
-          send(:"entity_#{op}", api: @api_shares_admin, entity: entity_path, id: id, is_singleton: is_singleton)
+        # entity_id: resolved via arguments:(:identifier) on the setting node
+        # permission_id: (share_permissions show) and data: (modify) resolved via arguments: on the leaf
+        def action_admin_entity_setting(entity_type, location, setting, op, entity_id:, permission_id: nil, data: nil)
+          entity_path = "#{admin_entity_path(entity_type, location)}/#{entity_id}/#{setting}"
+          send(:"entity_#{op}", api: @api_shares_admin, entity: entity_path, id: permission_id, is_singleton: !setting.eql?(:share_permissions), data: data)
         end
 
         # Shared handler for :users (group only)
         # group_id: resolved by Phase A via arguments:(:identifier) on the :users node
-        def action_admin_entity_users(entity_type, location, op, group_id:, **)
+        # user_id: and data: resolved via arguments: on the leaf (GROUP_USERS_ARGS)
+        def action_admin_entity_users(entity_type, location, op, group_id:, user_id: nil, data: nil)
           path = admin_entity_path(entity_type, location)
           prefix = location.eql?(:all) ? '' : "#{location}_"
-          id = Operations::INSTANCE.include?(op) ? options.instance_identifier : nil
-          send(:"entity_#{op}", api: @api_shares_admin, entity: "#{path}/#{group_id}/#{prefix}users", id: id)
+          send(:"entity_#{op}", api: @api_shares_admin, entity: "#{path}/#{group_id}/#{prefix}users", id: user_id, data: data)
         end
 
         # Generate action_admin_<user|group>_<location>_<verb> for all combinations
@@ -389,19 +347,13 @@ module Aspera
           # all: list/show/delete only (no create, no modify — no update route on /users and /groups)
           # local: full CRUD only — no nested settings under local_users/local_groups
           ENTITY_LOCATIONS.each do |location|
-            ops = location.eql?(:all) ? (Operations::ALL - %i[create modify]) : Operations::ALL
-            ops.each do |op|
-              define_action_method([:admin, entity_type, location, op]) do
-                action_admin_entity_crud(entity_type, location, op)
-              end
-            end
             unless location.eql?(:local)
               USR_GRP_SETTINGS.each do |setting|
                 # share_permissions: Rails only exposes index+show (read-only)
                 setting_ops = setting.eql?(:share_permissions) ? SHARE_PERMISSIONS_OPS : %i[show modify]
                 setting_ops.each do |op|
                   define_action_method([:admin, entity_type, location, setting, op]) do |**kwargs|
-                    action_admin_entity_setting(entity_type, location, setting, op, entity_id: kwargs[:"#{entity_type}_id"], permission_id: kwargs[:permission_id])
+                    action_admin_entity_setting(entity_type, location, setting, op, entity_id: kwargs[:"#{entity_type}_id"], permission_id: kwargs[:permission_id], data: kwargs[setting])
                   end
                 end
               end
@@ -409,24 +361,24 @@ module Aspera
             next unless entity_type.eql?(:group)
             # group users: no create route (Rails only exposes index+show+update+destroy)
             GROUP_USERS_OPS.each do |op|
-              define_action_method([:admin, entity_type, location, :users, op]) do |group_id:, **|
-                action_admin_entity_users(entity_type, location, op, group_id: group_id)
+              define_action_method([:admin, entity_type, location, :users, op]) do |group_id:, user_id: nil, user: nil, **|
+                action_admin_entity_users(entity_type, location, op, group_id: group_id, user_id: user_id, data: user)
               end
             end
           end
 
           # ldap: add
-          define_action_method([:admin, entity_type, :ldap, :add]) do |entity_name:, **|
+          define_action_method([:admin, entity_type, :ldap, :add]) do |**kwargs|
             path = admin_entity_path(entity_type, :ldap)
-            bulk_result(entity_name, command: :add, id_result: entity_type.to_s) do |entity_name|
+            bulk_result(kwargs.fetch(entity_type), command: :add, id_result: entity_type.to_s) do |entity_name|
               @api_shares_admin.create(path, {entity_type => entity_name})
             end
           end
 
           # saml: import
-          define_action_method([:admin, entity_type, :saml, :import]) do |entity_parameters:, **|
+          define_action_method([:admin, entity_type, :saml, :import]) do |**kwargs|
             path = admin_entity_path(entity_type, :saml)
-            bulk_result(entity_parameters, command: :import) do |entity_parameters|
+            bulk_result(kwargs.fetch(entity_type), command: :import) do |entity_parameters|
               entity_parameters = entity_parameters.transform_keys { |k| k.gsub(/\s+/, '_').downcase }
               Aspera.assert_type(entity_parameters, Hash)
               SAML_IMPORT_MANDATORY.each { |p| raise "missing mandatory field: #{p}" if entity_parameters[p].nil? }
@@ -440,12 +392,12 @@ module Aspera
 
         # Handlers for admin > share > user_permissions|group_permissions > op
         # share_id: resolved by Phase A via arguments:(:identifier, lookup: :lookup_share_id) on the perm_type node
+        # permission_id: resolved via arguments: on the show leaf
         # Rails only exposes index+show for share permissions (read-only)
         %i[user_permissions group_permissions].each do |perm_type|
           SHARE_PERMISSIONS_OPS.each do |op|
-            define_action_method([:admin, :share, perm_type, op]) do |share_id:, **|
-              id = Operations::INSTANCE.include?(op) ? options.instance_identifier : nil
-              send(:"entity_#{op}", api: @api_shares_admin, entity: "data/shares/#{share_id}/#{perm_type}", id: id)
+            define_action_method([:admin, :share, perm_type, op]) do |share_id:, permission_id: nil, **|
+              send(:"entity_#{op}", api: @api_shares_admin, entity: "data/shares/#{share_id}/#{perm_type}", id: permission_id)
             end
           end
         end

data/lib/aspera/cli/preset_actions.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require 'aspera/assert'
+require 'aspera/cli/preset_manager'
 
 module Aspera
   module Cli
@@ -11,10 +12,6 @@ module Aspera
       # Display columns for preset overview
       CONF_OVERVIEW_KEYS = %w[preset parameter value].freeze
 
-      def action_preset_list(**)
-        Result::ValueList.new(presets.config_presets.keys, name: 'name')
-      end
-
       def action_preset_overview(**)
         cp = presets.config_presets
         # Display process modifies the value (hide secrets): we do not want to save removed secrets
@@ -55,18 +52,21 @@ module Aspera
 
       SECRET_KEYWORDS = %w[password secret].freeze
 
-      # If +option_name+ ends with a secret keyword and the vault is configured,
+      # If `option_name` ends with a secret keyword and the vault is configured,
       # move the clear-text value into the vault and replace it with a @vault: reference.
       # @param preset      [Hash]   the preset hash (modified in place)
       # @param preset_name [String] name used as base for the vault label
       # @param option_name [String] option key to inspect
       def secure_preset_option(preset, preset_name, option_name)
         return unless SECRET_KEYWORDS.any? { |kw| option_name.end_with?(kw) }
+        # Vault password is not saved in vault
+        return if option_name.eql?('vault_password')
         # Never auto-secure the global preset: it holds vault credentials themselves
-        return if preset_name.eql?(presets.global_default_preset)
+        # Checked before opening the vault, which may not be usable yet (e.g. vault_password not set)
+        return if presets.global_preset?(preset_name)
         return if vault.nil?
         value = preset[option_name]
-        # Already a vault reference or nil — nothing to do
+        # Already a vault reference or nil - nothing to do
         return if value.nil? || value.to_s.start_with?('@vault:')
         vault_label = preset_name
         incr = 0
@@ -93,6 +93,12 @@ module Aspera
         cp = presets.config_presets
         raise "no such preset: #{name}" unless cp.key?(name)
         cp.delete(name)
+        # Remove default declarations referring to the deleted preset
+        defaults = cp[PresetManager::Key::DEFAULTS]
+        defaults&.select { |_, preset_name| preset_name.eql?(name) }&.each_key do |plugin|
+          defaults.delete(plugin)
+          Log.log.info { "Removed: #{PresetManager::Key::DEFAULTS}: #{plugin}" }
+        end
         Result::Status.new("Deleted: #{name}")
       end
 
@@ -124,11 +130,11 @@ module Aspera
         Result::Nothing.new
       end
 
-      def action_preset_initialize(name:, config_value:, **)
+      def action_preset_initialize(name:, preset:, **)
         name = presets.global_default_preset if name.eql?(GLOBAL_DEFAULT_KEYWORD)
         cp = presets.config_presets
         Log.log.warn { "configuration already exists: #{name}, overwriting" } if cp.key?(name)
-        cp[name] = config_value
+        cp[name] = preset
         Result::Status.new("Modified: #{@option_config_file}")
       end
 
@@ -147,8 +153,9 @@ module Aspera
         name = presets.global_default_preset if name.eql?(GLOBAL_DEFAULT_KEYWORD)
         cp = presets.config_presets
         cp[name] ||= {}
+        # Option names are only known at runtime: cannot be declared as interactive arguments
         option_names.each do |option_name|
-          option_value = options.get_interactive(option_name, check_option: true)
+          option_value = options.get_interactive(option_name)
           cp[name][option_name] = option_value
           secure_preset_option(cp[name], name, option_name)
         end