holivia 0.12.0 → 0.14.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 14dc959e163c982b0cb9ff68d098eb453c99c9802055de1c6086c8b61541894b
-  data.tar.gz: cb404446122ffd0f4dab4535b358ec50c6bcdda67781c569f9c6db699ca8ed3e
+  metadata.gz: fab1251135002a03f719e93cb2f2d1fcb52842e2f5c5fecc3fa8c47c279b8747
+  data.tar.gz: 8e2dd66d735bf875c123d42d90c25ab7d853024c5378dc8445d2f8c4eeb233aa
 SHA512:
-  metadata.gz: fd225340d2dd039e3a40f1104b0a606db28e3b5d30b3f7bd5a19a3ddc6d4e222a1519db2db64a3429fa8040ddc2131b38b5dafca3ce61701241c939e562475ae
-  data.tar.gz: c55acec78801a2a38ffa864d95997ae1e0245baa82fa57f53a508592d53a25b77e6c4809cc9d07ff44e9d2eb444a85d22a57d283ade5d32e3ae6d37ae8ec23c8
+  metadata.gz: a0c502ac53052598fff122e0b5bafc5028c7cd2dee25ebc6629879f0a77d17516314608012493d41ee8571cb79802d5a276c43e64d03236f2e86d8e7a4c68e77
+  data.tar.gz: 5454072e3f4e4d046b1a8de6e60a9a9641db2a5d16eaf85441de7340e065572f4606c83a603bc4f615ef0c86b02f4a03babf28fa267559375c9fa0602fac3c56

data/CHANGELOG.md

@@ -1,5 +1,25 @@
 ## [Unreleased]
 
+## [0.14.0] - 2026-10-23
+
+- Add `holivia enterprise show <id>` for enterprise details: settings, headquarter, CSM, countries, employees count, and the current contract summary for contract viewers and managers
+- Add `holivia enterprise employee-stats <id>` for aggregate employee counts (total, left, current, current dependents and HR managers), excluding demo employees
+- Add read-only `holivia employee index` and `holivia employee show` commands with enterprise, query, left, HR manager, dependent status, demo, and pagination filters; demo employees are excluded unless `--demo` is given
+- Add read-only `holivia contract index` and `holivia contract show` commands with enterprise, status (`active`, `expiring_soon`, `low_remaining`), and pagination filters
+- Employee responses never include Holivia account data (user id, sign-up, or care status); SKILL.md treats employee data as personal data
+- Employee commands require an employee viewer or manager role; contract commands require a contract viewer or manager role
+- Requires the matching Holivia backoffice API deployment
+
+## [0.13.0] - 2026-09-30
+
+- Replace terminal password login with browser OAuth authorization using PKCE and existing password/company SSO sign-in.
+- Require CLI upgrade and a new login; remove `--email`/`--password` and legacy `/api/v1/auth/*` endpoints.
+- Use two-hour access tokens, rotating refresh tokens without a fixed expiry, and server revocation for logout.
+- Store per-environment credentials atomically with owner-only permissions and omit credentials from debug logs.
+- Keep browser and CLI sessions independent; existing API permissions continue to apply.
+- Redirect browser authorization callbacks to the localized Holivia completion page while the CLI exchanges tokens separately.
+- Requires the matching Holivia OAuth server deployment and provisioning of the public CLI application.
+
 ## [0.12.0] - 2026-09-16
 
 - Add `holivia tag` commands for catalogue CRUD and incremental topic-link management through repeatable `--topic-tag-json` flags or stdin JSON

data/README.md

@@ -2,7 +2,7 @@
 
 Ruby client and command-line interface for the Holivia API.
 
-The `holivia` executable is primarily used to manage Holivia backoffice data from the terminal: environments, authentication, selfcare content, objectives, enterprises, communication library items, HR intervention catalog items, HR home highlights, crises, collective interventions, and appointment diagnostics.
+The `holivia` executable is primarily used to manage Holivia backoffice data from the terminal: environments, authentication, selfcare content, objectives, enterprises, employees, contracts, communication library items, HR intervention catalog items, HR home highlights, crises, collective interventions, and appointment diagnostics.
 
 Coding agents can use [`SKILL.md`](SKILL.md) as a downloadable usage guide for operating this CLI safely.
 
@@ -73,21 +73,23 @@ holivia env debug --false
 
 ## Authentication
 
-Log in interactively:
+Log in through your browser using your existing password or company SSO:
 
 ```bash
 holivia login
 ```
 
-Or pass credentials directly:
-
-```bash
-holivia login --email user@example.com --password secret
-```
+The CLI opens a browser and prints a URL you can open manually on the same computer. A temporary loopback listener receives the callback. Browserless login is not supported.
 
 Credentials are stored per environment in `~/.holivia/credentials.<env>.json`. Access tokens are sent as bearer tokens, and the CLI automatically refreshes credentials after a `401` response when a refresh token is available.
 
-Log out and remove stored credentials for the current environment:
+Access tokens expire after two hours. Refresh tokens have no fixed expiry and rotate when used. Credential files are replaced atomically with owner-only permissions. Pundit permissions still determine which API operations the user may perform.
+
+Existing users must upgrade the CLI and run `holivia login` again. The old `/api/v1/auth/login`, `/api/v1/auth/refresh`, and `/api/v1/auth/logout` endpoints and `--email`/`--password` flags have been removed.
+
+The database migration drops the legacy `auth_tokens` table. Rolling it back restores the table structure only; deleted or revoked credentials are not restored. Users must log in again.
+
+Logout revokes this CLI session and removes credentials for the current environment. Other CLI sessions and browser sessions remain signed in. If the server cannot be reached, credentials are retained so logout can be retried:
 
 ```bash
 holivia logout
@@ -184,6 +186,32 @@ Find an enterprise id:
 holivia enterprise lookup --query acme
 ```
 
+Show details for an enterprise:
+
+```bash
+holivia enterprise show 123
+```
+
+Show employee counts for an enterprise:
+
+```bash
+holivia enterprise employee-stats 123
+```
+
+List and inspect employees of an enterprise:
+
+```bash
+holivia employee index --enterprise-id 123 --query durand --left false
+holivia employee show 42
+```
+
+List and inspect contracts of an enterprise:
+
+```bash
+holivia contract index --enterprise-id 123 --status active
+holivia contract show 7
+```
+
 List crises for an enterprise:
 
 ```bash

data/SKILL.md

@@ -2,7 +2,7 @@
 
 Use this skill when you need to operate the Holivia API through the `holivia` command-line tool.
 
-The CLI manages Holivia backoffice data: environments, authentication, selfcare contents, objectives, selfcare-objective associations, enterprises, HR intervention catalog items, HR home highlights, crises, collective interventions, and appointment video diagnostics.
+The CLI manages Holivia backoffice data: environments, authentication, selfcare contents, objectives, selfcare-objective associations, enterprises, employees, contracts, HR intervention catalog items, HR home highlights, crises, collective interventions, and appointment video diagnostics.
 
 ## Preconditions
 
@@ -16,11 +16,12 @@ Use `holivia` in examples below. If working from a checkout before installation,
 
 - Never invent API URLs, credentials, IDs, enum values, or content model fields.
 - Never print, store, or commit passwords, access tokens, refresh tokens, or files under `~/.holivia/credentials.*.json`.
-- Prefer interactive `holivia login` when a human can enter credentials. Use `--password` only when the user explicitly provides it for automation.
+- Use `holivia login` and let the user authenticate in their browser. Terminal email/password flags are no longer supported.
 - Before creating or updating content, run `holivia selfcare schema` and use its returned enum values and permitted item params as the source of truth.
 - Before creating or updating intervention catalog items, run `holivia intervention schema` and use its returned enum values and locales as the source of truth.
 - Before creating or updating HR home highlights, run `holivia highlight schema` and use its returned enum values and locales as the source of truth.
 - For destructive actions such as `holivia env remove`, `holivia selfcare objective delete`, `holivia crisis delete`, or `holivia collective-intervention delete`, confirm the target environment and ID first unless the user explicitly requested that exact action.
+- Employee data is personal data. Query only the employees a task needs, do not copy employee lists into unrelated output, and never try to infer whether an employee has a Holivia account.
 - Treat all command output as JSON except informational commands such as `holivia env`, `holivia env list`, `holivia login`, `holivia logout`, `holivia version`, and `holivia --help`.
 
 ## Installation
@@ -90,19 +91,19 @@ Debug logging may expose request details. Do not enable it in shared logs unless
 
 Credentials are stored per environment at `~/.holivia/credentials.<env>.json`. The CLI sends the access token as a bearer token and refreshes credentials automatically after a `401` response when possible.
 
-Interactive login:
+Browser login using your existing password or company SSO:
 
 ```bash
 holivia login
 ```
 
-Non-interactive login:
+A browser on the same computer is required. If it does not open automatically, open the printed URL manually. Do not ask for terminal credentials; browserless login is not supported.
 
-```bash
-holivia login --email user@example.com --password secret
-```
+Access tokens expire after two hours. Refresh tokens have no fixed expiry and rotate when used. Credential files are replaced atomically with owner-only permissions. Pundit permissions still determine which API operations the user may perform.
+
+Existing users must upgrade the CLI and run `holivia login` again. The old `/api/v1/auth/login`, `/api/v1/auth/refresh`, and `/api/v1/auth/logout` endpoints and `--email`/`--password` flags have been removed.
 
-Logout for the current environment:
+Logout revokes this CLI session and removes credentials for the current environment. Other CLI sessions and browser sessions remain signed in. If the server cannot be reached, credentials are retained so logout can be retried:
 
 ```bash
 holivia logout
@@ -367,6 +368,66 @@ Filter enterprise lookup:
 holivia enterprise index --headquarter-id 10 --user-id 20 --page 1 --per-page 25
 ```
 
+Show details for one enterprise (settings, headquarter, CSM, countries, employees count; the current contract is included only for contract viewers and managers):
+
+```bash
+holivia enterprise show 123
+```
+
+Show aggregate employee counts for one enterprise (excludes demo employees; never includes account sign-up data):
+
+```bash
+holivia enterprise employee-stats 123
+```
+
+## Employees
+
+Requires an employee viewer or manager role. Responses never include Holivia account data (no user id, sign-up, or care status). `employee index` excludes demo employees unless `--demo true` (demo employees only) or `--demo all` (everyone) is given.
+
+List employees of an enterprise:
+
+```bash
+holivia employee index --enterprise-id 123 --page 1 --per-page 25
+```
+
+Search and filter employees:
+
+```bash
+holivia employee index --enterprise-id 123 --query durand --left false --hr-manager true
+holivia employee index --enterprise-id 123 --dependent-status dependent
+holivia employee index --enterprise-id 123 --demo true
+```
+
+Show one employee:
+
+```bash
+holivia employee show 42
+```
+
+## Contracts
+
+Requires a contract viewer or manager role.
+
+List contracts of an enterprise, most recent first:
+
+```bash
+holivia contract index --enterprise-id 123
+```
+
+Find active contracts, contracts expiring within three months, or contracts with low remaining sessions:
+
+```bash
+holivia contract index --status active
+holivia contract index --status expiring_soon
+holivia contract index --status low_remaining
+```
+
+Show every setting of one contract, including notes:
+
+```bash
+holivia contract show 7
+```
+
 ## Crises
 
 List crises:

data/exe/holivia

@@ -9,7 +9,10 @@ rescue Holivia::ApiError => e
   warn "Error (#{e.status}): #{e.message}"
   warn JSON.pretty_generate(e.details) if e.details.is_a?(Hash)
   exit 1
-rescue Holivia::ConfigError => e
+rescue Holivia::ConfigError, Holivia::BrowserLogin::Error, OptionParser::ParseError, Faraday::Error => e
   warn "Error: #{e.message}"
   exit 1
+rescue Interrupt
+  warn "Cancelled."
+  exit 130
 end

data/lib/holivia/auth.rb

@@ -2,15 +2,20 @@
 
 require "json"
 require "fileutils"
+require "tempfile"
 
 module Holivia
   class Auth
-    def initialize(client: Client.new(auth: nil))
-      @client = client
+    def initialize(client: nil, configuration: Holivia.configuration)
+      @client = client || Client.new(base_url: configuration.base_url, auth: nil)
+      @credentials_path = configuration.credentials_path.dup.freeze
     end
 
-    def login(email:, password:)
-      response = client.post("/api/v1/auth/login", body: { email: email, password: password })
+    def login(code:, code_verifier:, redirect_uri:)
+      response = client.post_form("/oauth/token", body: {
+                                    grant_type: "authorization_code", client_id: BrowserLogin::CLIENT_ID,
+                                    code: code, code_verifier: code_verifier, redirect_uri: redirect_uri
+                                  })
       store_tokens(response)
       response
     end
@@ -18,15 +23,25 @@ module Holivia
     def refresh
       raise ApiError.new("No refresh token. Run `holivia login`.", status: 401) unless refresh_token
 
-      response = client.post("/api/v1/auth/refresh", headers: { "Authorization" => "Bearer #{refresh_token}" })
+      response = client.post_form("/oauth/token", body: {
+                                    grant_type: "refresh_token", client_id: BrowserLogin::CLIENT_ID,
+                                    refresh_token: refresh_token
+                                  })
       store_tokens(response)
       response
+    rescue ApiError => e
+      raise unless e.details.is_a?(Hash) && e.details["error"] == "invalid_grant"
+
+      raise ApiError.new("Session expired or revoked. Run `holivia login`.", status: 401)
     end
 
     def logout
-      raise ApiError.new("Already logged out.", status: 401) unless access_token
+      raise ApiError.new("Already logged out.", status: 401) unless refresh_token
 
-      response = client.delete("/api/v1/auth/logout", headers: { "Authorization" => "Bearer #{access_token}" })
+      response = client.post_form("/oauth/revoke", body: {
+                                    client_id: BrowserLogin::CLIENT_ID, token: refresh_token,
+                                    token_type_hint: "refresh_token"
+                                  })
       FileUtils.rm_f(credentials_path)
       response
     end
@@ -41,7 +56,7 @@ module Holivia
 
     private
 
-    attr_reader :client
+    attr_reader :client, :credentials_path
 
     def credentials
       return nil unless File.exist?(credentials_path)
@@ -50,17 +65,14 @@ module Holivia
     end
 
     def store_tokens(data)
-      FileUtils.mkdir_p(File.dirname(credentials_path))
-
-      File.write(credentials_path, JSON.pretty_generate(
-                                     "access_token" => data["access_token"],
-                                     "refresh_token" => data["refresh_token"]
-                                   ))
-      File.chmod(0o600, credentials_path)
-    end
-
-    def credentials_path
-      Holivia.configuration.credentials_path
+      directory = File.dirname(credentials_path)
+      FileUtils.mkdir_p(directory, mode: 0o700)
+      Tempfile.create(["credentials", ".json"], directory) do |file|
+        file.write(JSON.pretty_generate(data.slice("access_token", "refresh_token")))
+        file.flush
+        file.fsync
+        File.rename(file.path, credentials_path)
+      end
     end
   end
 end

data/lib/holivia/browser_login.rb

@@ -0,0 +1,125 @@
+# frozen_string_literal: true
+
+require "digest"
+require "securerandom"
+require "socket"
+require "timeout"
+require "uri"
+
+module Holivia
+  class BrowserLogin
+    class Error < StandardError; end
+
+    CLIENT_ID = "holivia-cli"
+
+    def initialize(base_url: Holivia.configuration.base_url, output: $stderr, timeout: 180, browser_launcher: nil)
+      @base_url = base_url.dup.freeze
+      @output = output
+      @timeout = timeout
+      @browser_launcher = browser_launcher || method(:launch_browser)
+    end
+
+    def call
+      verifier = SecureRandom.urlsafe_base64(32)
+      state = SecureRandom.urlsafe_base64(32)
+      server = TCPServer.new("127.0.0.1", 0)
+      redirect_uri = "http://127.0.0.1:#{server.addr[1]}/callback"
+
+      Timeout.timeout(@timeout, Error, "Browser login timed out. Run holivia login to try again.") do
+        open_browser(authorization_url(verifier, state, redirect_uri))
+        code = receive_code(server, state)
+        { code: code, code_verifier: verifier, redirect_uri: redirect_uri }
+      end
+    ensure
+      server&.close
+    end
+
+    private
+
+    def authorization_url(verifier, state, redirect_uri)
+      url = URI.join(@base_url, "/oauth/authorize")
+      url.query = URI.encode_www_form(
+        client_id: CLIENT_ID, response_type: "code", redirect_uri: redirect_uri,
+        code_challenge: [Digest::SHA256.digest(verifier)].pack("m0").tr("+/", "-_").delete("="),
+        code_challenge_method: "S256", state: state
+      )
+      url.to_s
+    end
+
+    def open_browser(url)
+      @output.puts "Open this URL in a browser on this computer to log in:\n#{url}"
+      @browser_launcher.call(url)
+    end
+
+    def launch_browser(url)
+      command = RUBY_PLATFORM.include?("darwin") ? "open" : "xdg-open"
+      system(command, url, out: File::NULL, err: File::NULL)
+    end
+
+    def receive_code(server, state)
+      loop do
+        code = handle_callback(server.accept, state)
+        return code if code
+      end
+    end
+
+    def handle_callback(socket, state)
+      params = callback_params(socket.gets("\r\n\r\n", 8192))
+      unless valid_callback?(params, state)
+        respond(socket, "400 Bad Request", "Invalid login callback.")
+        return nil
+      end
+
+      complete_callback(socket, params)
+    rescue SystemCallError, IOError
+      nil # A disconnected browser must not prevent a later valid callback.
+    ensure
+      socket.close
+    end
+
+    def callback_params(request)
+      return {} unless request&.end_with?("\r\n\r\n")
+
+      match = request.lines.first.match(%r{\AGET /callback\?([^\s]+) HTTP/1\.[01]\r\n\z})
+      return {} unless match
+
+      pairs = URI.decode_www_form(match[1])
+      return {} unless pairs.map(&:first).uniq.length == pairs.length
+
+      pairs.to_h
+    rescue ArgumentError
+      {}
+    end
+
+    def valid_callback?(params, state)
+      return false unless params["state"] == state
+
+      code = params["code"]
+      error = params["error"]
+      (code && !code.empty? && error.nil?) || (error && !error.empty? && code.nil?)
+    end
+
+    def complete_callback(socket, params)
+      if params["error"]
+        respond(socket, "200 OK", "Authorization was not granted. Return to the terminal.")
+        raise Error, "Authorization was not granted. Run holivia login to try again."
+      end
+
+      redirect_to_completion(socket)
+      params.fetch("code")
+    end
+
+    def redirect_to_completion(socket)
+      url = URI.join(@base_url, "/oauth/complete")
+      socket.write "HTTP/1.1 303 See Other\r\nLocation: #{url}\r\n" \
+                   "Referrer-Policy: no-referrer\r\nCache-Control: no-store\r\n" \
+                   "Content-Length: 0\r\nConnection: close\r\n\r\n"
+    end
+
+    def respond(socket, status, message)
+      socket.write "HTTP/1.1 #{status}\r\nContent-Type: text/plain; charset=utf-8\r\n" \
+                   "Content-Length: #{message.bytesize}\r\nCache-Control: no-store\r\n" \
+                   "Connection: close\r\n\r\n#{message}"
+    end
+  end
+end

data/lib/holivia/cli/help.rb

@@ -17,7 +17,7 @@ module Holivia
           Config stored at ~/.holivia/config.yml. Defaults to staging if no config exists.
 
         Authentication:
-          holivia login [--email EMAIL --password PASSWORD]  Log in (flags or interactive prompt)
+          holivia login                                    Log in through your browser (password or company SSO)
           holivia logout                         Log out and clear stored credentials
           Tokens are stored at ~/.holivia/credentials.<env>.json and refreshed automatically on 401.
 
@@ -77,6 +77,24 @@ module Holivia
           holivia enterprise index [--query TEXT --headquarter-id ID --user-id ID --page N --per-page N]
                                                 Find enterprises and their enterprise_id values
           holivia enterprise lookup [options]   Alias for enterprise index
+          holivia enterprise show <id>          Show enterprise details: settings, headquarter, CSM,
+                                                countries, employees count, and the current contract
+                                                for contract viewers
+          holivia enterprise employee-stats <id> Show aggregate employee counts (total, left, current,
+                                                current dependents, current HR managers)
+
+        Employees:
+          holivia employee index [--enterprise-id ID --query TEXT --left true|false --hr-manager true|false
+                                  --dependent-status creator|dependent|not_dependent --demo true|false|all
+                                  --page N --per-page N]
+                                                List employees; never includes Holivia account data.
+                                                Demo employees are excluded unless --demo is given
+          holivia employee show <id>            Show one employee with its enterprise
+
+        Contracts:
+          holivia contract index [--enterprise-id ID --status active|expiring_soon|low_remaining --page N --per-page N]
+                                                List contracts, most recent first
+          holivia contract show <id>            Show every setting of one contract with its enterprise
 
         Communication Items:
           holivia communication index [--page N --per-page N --query TEXT --locale LOCALE --document-type TYPE]

data/lib/holivia/cli.rb

@@ -16,6 +16,8 @@ require_relative "commands/communication_item"
 require_relative "commands/intervention_item"
 require_relative "commands/hr_home_highlight"
 require_relative "commands/enterprise"
+require_relative "commands/employee"
+require_relative "commands/contract"
 require_relative "commands/crisis"
 require_relative "commands/collective_intervention"
 require_relative "commands/support_phone_number"
@@ -37,6 +39,8 @@ module Holivia
       when "intervention" then Commands::InterventionItem.route(args)
       when "highlight" then Commands::HrHomeHighlight.route(args)
       when "enterprise" then Commands::Enterprise.route(args)
+      when "employee" then Commands::Employee.route(args)
+      when "contract" then Commands::Contract.route(args)
       when "crisis" then Commands::Crisis.route(args)
       when "collective-intervention", "collective_intervention", "collective" then Commands::CollectiveIntervention.route(args)
       when "support-phone-numbers" then Commands::SupportPhoneNumber.route(args)

data/lib/holivia/client.rb

@@ -2,6 +2,7 @@
 
 require "faraday"
 require "faraday/multipart"
+require "uri"
 
 module Holivia
   class Client
@@ -15,6 +16,16 @@ module Holivia
       request(:post, path, body:, headers:)
     end
 
+    def post_form(path, body: {})
+      response = connection.post(path) do |req|
+        req.headers["Accept"] = "application/json"
+        req.headers["Content-Type"] = "application/x-www-form-urlencoded"
+        req.body = URI.encode_www_form(body)
+      end
+
+      handle_response(response)
+    end
+
     def get(path, params: {}, headers: {})
       request(:get, path, params:, headers:)
     end
@@ -59,7 +70,7 @@ module Holivia
       @connection ||= http.new(url: base_url) do |f|
         f.request :multipart
         f.request :json
-        f.response :logger if Holivia.configuration.debug?
+        f.response :logger, nil, headers: false, bodies: false if Holivia.configuration.debug?
         f.response :json
         f.adapter Faraday.default_adapter
       end
@@ -77,6 +88,8 @@ module Holivia
       return "Request failed" unless body.is_a?(Hash)
 
       error = body["error"]
+      return [error, body["error_description"]].compact.join(": ") if error.is_a?(String)
+
       error.is_a?(Hash) ? (error["message"] || "Request failed") : (error || "Request failed")
     end
 

data/lib/holivia/commands/auth.rb

@@ -1,23 +1,19 @@
 # frozen_string_literal: true
 
-require "io/console"
 require "optparse"
 
 module Holivia
   module Commands
     class Auth
       def login(args = [])
-        options = {}
         OptionParser.new do |opts|
-          opts.banner = "Usage: holivia login [--email EMAIL --password PASSWORD]"
-          opts.on("--email EMAIL") { |v| options[:email] = v }
-          opts.on("--password PASSWORD") { |v| options[:password] = v }
+          opts.banner = "Usage: holivia login"
         end.parse!(args)
+        raise OptionParser::InvalidArgument, args.join(" ") unless args.empty?
 
-        email = options[:email] || prompt("Email: ")
-        password = options[:password] || prompt_secret("Password: ")
-
-        Holivia::Auth.new.login(email: email, password: password)
+        auth = Holivia::Auth.new
+        exchange = BrowserLogin.new.call
+        auth.login(**exchange)
         puts "Logged in successfully."
       end
 
@@ -25,20 +21,6 @@ module Holivia
         Holivia::Auth.new.logout
         puts "Logged out successfully."
       end
-
-      private
-
-      def prompt(label)
-        print label
-        $stdin.gets.chomp
-      end
-
-      def prompt_secret(label)
-        print label
-        result = $stdin.noecho(&:gets).chomp
-        puts
-        result
-      end
     end
   end
 end

data/lib/holivia/commands/contract.rb

@@ -0,0 +1,41 @@
+# frozen_string_literal: true
+
+require_relative "base"
+
+module Holivia
+  module Commands
+    class Contract < Base
+      BASE_PATH = "/api/v1/backoffice/contracts"
+
+      def self.route(args)
+        subcommand = args.shift
+        case subcommand
+        when "index" then new.index(args)
+        when "show" then new.show(args)
+        else warn "Unknown contract command: #{subcommand}"
+             exit 1
+        end
+      end
+
+      def index(args = [])
+        params = {}
+        OptionParser.new do |opts|
+          opts.banner = "Usage: holivia contract index [options]"
+          opts.on("--enterprise-id ID", Integer) { |v| params[:enterprise_id] = v }
+          opts.on("--status STATUS") { |v| params[:status] = v }
+          opts.on("--page N", Integer) { |v| params[:page] = v }
+          opts.on("--per-page N", Integer) { |v| params[:per_page] = v }
+        end.parse!(args)
+
+        output(client.get(BASE_PATH, params: params))
+      end
+
+      def show(args = [])
+        id = args.shift
+        abort "Usage: holivia contract show <id>" unless id
+
+        output(client.get("#{BASE_PATH}/#{id}"))
+      end
+    end
+  end
+end

data/lib/holivia/commands/employee.rb

@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+
+require_relative "base"
+
+module Holivia
+  module Commands
+    class Employee < Base
+      BASE_PATH = "/api/v1/backoffice/employees"
+      BOOLEAN_VALUES = %w[true false].freeze
+      DEPENDENT_STATUSES = %w[creator dependent not_dependent].freeze
+      DEMO_VALUES = %w[true false all].freeze
+
+      def self.route(args)
+        subcommand = args.shift
+        case subcommand
+        when "index" then new.index(args)
+        when "show" then new.show(args)
+        else warn "Unknown employee command: #{subcommand}"
+             exit 1
+        end
+      end
+
+      def index(args = []) # rubocop:disable Metrics/AbcSize,Metrics/MethodLength
+        params = {}
+        OptionParser.new do |opts|
+          opts.banner = "Usage: holivia employee index [options]"
+          opts.on("--enterprise-id ID", Integer) { |v| params[:enterprise_id] = v }
+          opts.on("--query TEXT") { |v| params[:query] = v }
+          opts.on("--left BOOL", BOOLEAN_VALUES) { |v| params[:left] = v }
+          opts.on("--hr-manager BOOL", BOOLEAN_VALUES) { |v| params[:hr_manager] = v }
+          opts.on("--dependent-status STATUS", DEPENDENT_STATUSES) { |v| params[:dependent_status] = v }
+          opts.on("--demo VALUE", DEMO_VALUES) { |v| params[:demo] = v }
+          opts.on("--page N", Integer) { |v| params[:page] = v }
+          opts.on("--per-page N", Integer) { |v| params[:per_page] = v }
+        end.parse!(args)
+
+        output(client.get(BASE_PATH, params: params))
+      end
+
+      def show(args = [])
+        id = args.shift
+        abort "Usage: holivia employee show <id>" unless id
+
+        output(client.get("#{BASE_PATH}/#{id}"))
+      end
+    end
+  end
+end

data/lib/holivia/commands/enterprise.rb

@@ -11,6 +11,8 @@ module Holivia
         subcommand = args.shift
         case subcommand
         when "index", "lookup", "search" then new.index(args)
+        when "show" then new.show(args)
+        when "employee-stats" then new.employee_stats(args)
         else warn "Unknown enterprise command: #{subcommand}"
              exit 1
         end
@@ -29,6 +31,20 @@ module Holivia
 
         output(client.get(BASE_PATH, params: params))
       end
+
+      def show(args = [])
+        id = args.shift
+        abort "Usage: holivia enterprise show <id>" unless id
+
+        output(client.get("#{BASE_PATH}/#{id}"))
+      end
+
+      def employee_stats(args = [])
+        id = args.shift
+        abort "Usage: holivia enterprise employee-stats <id>" unless id
+
+        output(client.get("#{BASE_PATH}/#{id}/employee_stats"))
+      end
     end
   end
 end

data/lib/holivia/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Holivia
-  VERSION = "0.12.0"
+  VERSION = "0.14.0"
 end

data/lib/holivia.rb

@@ -7,6 +7,7 @@ require_relative "holivia/api_error"
 require_relative "holivia/config_error"
 require_relative "holivia/client"
 require_relative "holivia/auth"
+require_relative "holivia/browser_login"
 
 module Holivia
   class << self

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: holivia
 version: !ruby/object:Gem::Version
-  version: 0.12.0
+  version: 0.14.0
 platform: ruby
 authors:
 - Holivia
@@ -57,6 +57,7 @@ files:
 - lib/holivia.rb
 - lib/holivia/api_error.rb
 - lib/holivia/auth.rb
+- lib/holivia/browser_login.rb
 - lib/holivia/cli.rb
 - lib/holivia/cli/help.rb
 - lib/holivia/client.rb
@@ -65,7 +66,9 @@ files:
 - lib/holivia/commands/base.rb
 - lib/holivia/commands/collective_intervention.rb
 - lib/holivia/commands/communication_item.rb
+- lib/holivia/commands/contract.rb
 - lib/holivia/commands/crisis.rb
+- lib/holivia/commands/employee.rb
 - lib/holivia/commands/enterprise.rb
 - lib/holivia/commands/env.rb
 - lib/holivia/commands/format.rb