@atlasauth/cli 0.12.0 → 0.14.0

package/dist/migrate/export/stytch-config.d.ts

@@ -0,0 +1,22 @@
+import type { TranslationResult } from '../framework/plugin';
+import { type Obj } from './record-set';
+import { type StytchProduct } from './stytch';
+import { type VendorHttp } from './vendor-http';
+/**
+ * `atlas migrate stytch config` — what Stytch's project API exposes: the RBAC
+ * policy (roles, resources and their actions) and, for B2B, the organizations
+ * with their SSO connections. Password strength, session duration, OAuth
+ * providers, MFA and branding are dashboard-only settings: the report lists
+ * each as manual, with where to find it. The bridge and lazy-migration presets
+ * are carried to the next step.
+ */
+export interface StytchConfigSnapshot {
+    projectId: string;
+    product: StytchProduct;
+    roles: Obj[];
+    resources: Obj[];
+    organizations: number;
+    ssoConnections: number;
+}
+export declare function fetchStytchConfig(http: VendorHttp, projectId: string, product: StytchProduct): Promise<StytchConfigSnapshot>;
+export declare function translateStytchConfig(snap: StytchConfigSnapshot): TranslationResult;

package/dist/migrate/export/stytch-config.js

@@ -0,0 +1,102 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.fetchStytchConfig = fetchStytchConfig;
+exports.translateStytchConfig = translateStytchConfig;
+const record_set_1 = require("./record-set");
+const stytch_1 = require("./stytch");
+const translate_kit_1 = require("./translate-kit");
+const vendor_http_1 = require("./vendor-http");
+async function optionalGet(http, path) {
+    try {
+        const body = (await http.get(path)).body;
+        return (0, record_set_1.isObj)(body) ? body : null;
+    }
+    catch (err) {
+        if (err instanceof vendor_http_1.VendorApiError && [400, 403, 404].includes(err.status))
+            return null;
+        throw err;
+    }
+}
+async function fetchStytchConfig(http, projectId, product) {
+    // The consumer policy endpoint is UNCONFIRMED; a project without it just reports no roles.
+    const res = await optionalGet(http, product === 'b2b' ? '/v1/b2b/rbac/policy' : '/v1/rbac/policy');
+    const policy = res && (0, record_set_1.isObj)(res.policy) ? res.policy : {};
+    let organizations = 0;
+    let ssoConnections = 0;
+    if (product === 'b2b') {
+        try {
+            const { body } = await http.post('/v1/b2b/organizations/search', { limit: 1000 });
+            const orgs = (0, record_set_1.objs)((0, record_set_1.isObj)(body) ? body.organizations : undefined);
+            organizations = orgs.length;
+            for (const o of orgs) {
+                const id = (0, record_set_1.str)(o.organization_id);
+                const sso = id ? await optionalGet(http, `/v1/b2b/sso/${encodeURIComponent(id)}`) : null;
+                if (sso)
+                    ssoConnections += (0, record_set_1.objs)(sso.saml_connections).length + (0, record_set_1.objs)(sso.oidc_connections).length;
+            }
+        }
+        catch (err) {
+            if (!(err instanceof vendor_http_1.VendorApiError))
+                throw err;
+        }
+    }
+    return { projectId, product, roles: (0, record_set_1.objs)(policy.roles), resources: (0, record_set_1.objs)(policy.resources), organizations, ssoConnections };
+}
+function translateStytchConfig(snap) {
+    const b = new translate_kit_1.ConfigBuilder();
+    const permissions = new Set();
+    for (const r of snap.resources) {
+        const resource = (0, record_set_1.str)(r.resource_id);
+        if (resource)
+            for (const a of (0, record_set_1.strs)(r.actions))
+                permissions.add(`${resource}:${a}`);
+    }
+    let roles = 0;
+    for (const r of snap.roles) {
+        const id = (0, record_set_1.str)(r.role_id);
+        if (!id)
+            continue;
+        const key = (0, stytch_1.stytchRoleKey)(id);
+        const perms = (0, record_set_1.objs)(r.permissions).flatMap((p) => (0, record_set_1.strs)(p.actions).map((a) => `${(0, record_set_1.str)(p.resource_id) ?? '*'}:${a}`));
+        for (const p of perms)
+            if (!p.startsWith('*:'))
+                permissions.add(p);
+        // Built-in roles already exist in Atlas as admin and member.
+        if (key !== id)
+            continue;
+        roles++;
+        b.roles[id] = key;
+        b.push('roles', { key, name: key, description: (0, record_set_1.str)(r.description) ?? '', permissions: perms });
+    }
+    for (const key of permissions)
+        b.push('permissions', { key, name: key, description: '' });
+    if (permissions.size)
+        b.add('mapped', 'authorization', 'RBAC resources and actions', `${permissions.size} permission(s), keyed resource:action.`, 'permissions');
+    if (roles)
+        b.add('mapped', 'authorization', 'custom roles', `${roles} role(s); members keep the same role id as their Atlas role key. stytch_admin and stytch_member map to Atlas's admin and member.`, 'roles');
+    if (snap.roles.length === 0)
+        b.add('manual', 'authorization', 'RBAC policy', 'No RBAC policy was returned; default roles carry over as admin and member.');
+    if (snap.ssoConnections)
+        b.add('mapped', 'enterprise', `${snap.ssoConnections} SSO connection(s) in ${snap.organizations} organization(s)`, 'Move with the data export as Atlas SSO connections.', 'sso_connections');
+    if (snap.product === 'b2b')
+        b.add('manual', 'organizations', 'organization MFA policy, allowed auth methods, JIT provisioning', 'Per-organization settings are kept in the exported organization metadata; set the matching policy on each Atlas organization.');
+    for (const [setting, where] of [
+        ['password strength (zxcvbn / LUDS) and breach check', 'Dashboard → Authentication → Passwords; set Atlas password rules under auth_config.password'],
+        ['session duration and JWT lifetime', 'Dashboard → Sessions; set the Atlas session lifetime'],
+        ['OAuth providers (client ids and secrets)', 'Dashboard → OAuth; use the same OAuth apps in Atlas so imported accounts relink'],
+        ['redirect URLs and authorized domains', 'Dashboard → Redirect URLs, SDK configuration'],
+        ['multi-factor authentication (TOTP, SMS)', 'Dashboard → Authentication → MFA'],
+        ['email templates, SMS and branding', 'Dashboard → Email templates, Branding'],
+        ['custom claims and JWT templates', 'Dashboard → Sessions → JWT templates'],
+        ['webhooks', 'Dashboard → Webhooks (create Atlas webhook endpoints)'],
+    ]) {
+        b.add('manual', 'settings not in the API', setting, `Stytch does not expose this through the project API; copy it from ${where}.`);
+    }
+    const test = snap.projectId.startsWith('project-test-');
+    const vars = { project_id: snap.projectId, ...(test ? { api_host: 'test.stytch.com' } : {}), ...(snap.product === 'b2b' ? { jwks_path: 'b2b/sessions' } : {}) };
+    return b.result(`Stytch project ${snap.projectId}`, {
+        bridge: { preset: 'stytch', vars },
+        lazy: { preset: 'stytch', config: { project_id: snap.projectId, product: snap.product } },
+    });
+}
+//# sourceMappingURL=stytch-config.js.map

package/dist/migrate/export/stytch-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stytch-config.js","sourceRoot":"","sources":["../../../src/migrate/export/stytch-config.ts"],"names":[],"mappings":";;AAkCA,8CAqBC;AAED,sDAgDC;AAvGD,6CAAgE;AAChE,qCAA6D;AAC7D,mDAAgD;AAChD,+CAAgE;AAmBhE,KAAK,UAAU,WAAW,CAAC,IAAgB,EAAE,IAAY;IACvD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAM,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9C,OAAO,IAAA,kBAAK,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACnC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,4BAAc,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QACvF,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,iBAAiB,CAAC,IAAgB,EAAE,SAAiB,EAAE,OAAsB;IACjG,2FAA2F;IAC3F,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;IACnG,MAAM,MAAM,GAAQ,GAAG,IAAI,IAAA,kBAAK,EAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/D,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,cAAc,GAAG,CAAC,CAAC;IACvB,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAM,8BAA8B,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACvF,MAAM,IAAI,GAAG,IAAA,iBAAI,EAAC,IAAA,kBAAK,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAChE,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC;YAC5B,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;gBACrB,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,eAAe,CAAC,CAAC;gBAClC,MAAM,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,WAAW,CAAC,IAAI,EAAE,eAAe,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBACzF,IAAI,GAAG;oBAAE,cAAc,IAAI,IAAA,iBAAI,EAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,MAAM,GAAG,IAAA,iBAAI,EAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC;YACnG,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,CAAC,GAAG,YAAY,4BAAc,CAAC;gBAAE,MAAM,GAAG,CAAC;QAClD,CAAC;IACH,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,IAAA,iBAAI,EAAC,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,IAAA,iBAAI,EAAC,MAAM,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,cAAc,EAAE,CAAC;AAC7H,CAAC;AAED,SAAgB,qBAAqB,CAAC,IAA0B;IAC9D,MAAM,CAAC,GAAG,IAAI,6BAAa,EAAE,CAAC;IAE9B,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,CAAC;QACpC,IAAI,QAAQ;YAAE,KAAK,MAAM,CAAC,IAAI,IAAA,iBAAI,EAAC,CAAC,CAAC,OAAO,CAAC;gBAAE,WAAW,CAAC,GAAG,CAAC,GAAG,QAAQ,IAAI,CAAC,EAAE,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC3B,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAC1B,IAAI,CAAC,EAAE;YAAE,SAAS;QAClB,MAAM,GAAG,GAAG,IAAA,sBAAa,EAAC,EAAE,CAAC,CAAC;QAC9B,MAAM,KAAK,GAAG,IAAA,iBAAI,EAAC,CAAC,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,iBAAI,EAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAClH,KAAK,MAAM,CAAC,IAAI,KAAK;YAAE,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACnE,6DAA6D;QAC7D,IAAI,GAAG,KAAK,EAAE;YAAE,SAAS;QACzB,KAAK,EAAE,CAAC;QACR,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC;QAClB,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,KAAK,EAAU,CAAC,CAAC;IACzG,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,WAAW;QAAE,CAAC,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,EAAE,EAAU,CAAC,CAAC;IAClG,IAAI,WAAW,CAAC,IAAI;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,EAAE,4BAA4B,EAAE,GAAG,WAAW,CAAC,IAAI,wCAAwC,EAAE,aAAa,CAAC,CAAC;IACjK,IAAI,KAAK;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,EAAE,cAAc,EAAE,GAAG,KAAK,kIAAkI,EAAE,OAAO,CAAC,CAAC;IACjN,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,EAAE,aAAa,EAAE,4EAA4E,CAAC,CAAC;IAE3J,IAAI,IAAI,CAAC,cAAc;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC,cAAc,yBAAyB,IAAI,CAAC,aAAa,kBAAkB,EAAE,qDAAqD,EAAE,iBAAiB,CAAC,CAAC;IACtN,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,EAAE,iEAAiE,EAAE,+HAA+H,CAAC,CAAC;IAEjQ,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI;QAC7B,CAAC,oDAAoD,EAAE,6FAA6F,CAAC;QACrJ,CAAC,mCAAmC,EAAE,sDAAsD,CAAC;QAC7F,CAAC,0CAA0C,EAAE,iFAAiF,CAAC;QAC/H,CAAC,sCAAsC,EAAE,8CAA8C,CAAC;QACxF,CAAC,yCAAyC,EAAE,kCAAkC,CAAC;QAC/E,CAAC,mCAAmC,EAAE,uCAAuC,CAAC;QAC9E,CAAC,iCAAiC,EAAE,sCAAsC,CAAC;QAC3E,CAAC,UAAU,EAAE,uDAAuD,CAAC;KAC7D,EAAE,CAAC;QACX,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,yBAAyB,EAAE,OAAO,EAAE,qEAAqE,KAAK,GAAG,CAAC,CAAC;IACrI,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;IACxD,MAAM,IAAI,GAA2B,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACxL,OAAO,CAAC,CAAC,MAAM,CAAC,kBAAkB,IAAI,CAAC,SAAS,EAAE,EAAE;QAClD,MAAM,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;QAClC,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE;KAC1F,CAAC,CAAC;AACL,CAAC"}

package/dist/migrate/export/stytch.d.ts

@@ -0,0 +1,68 @@
+import type { PasswordHash, UserRecord } from '@atlasauth/migrate';
+import { RecordSet, type Obj } from './record-set';
+import { VendorHttp } from './vendor-http';
+/**
+ * `atlas migrate export stytch` — Stytch (consumer and B2B) onto the canonical
+ * bundle models, from the Stytch API with the project id and secret (on this
+ * machine only).
+ *
+ *   consumer   `POST /v1/users/search` (cursor paging, 1000 per page): emails
+ *              and phone numbers with their verified flags, name, OAuth
+ *              providers, metadata, roles, lock state.
+ *   B2B        `POST /v1/b2b/organizations/search`, then per organization
+ *              `POST /v1/b2b/organizations/members/search`, `GET /v1/b2b/sso/{org}`
+ *              and the RBAC policy (`GET /v1/b2b/rbac/policy`).
+ *
+ * Stytch members belong to ONE organization each (`member_id` is per
+ * organization). Atlas users are people, so members sharing an email become one
+ * user: the earliest member's id is the user id (the session JWT `sub` of that
+ * member maps to it) and the others' ids are kept in `private_metadata`.
+ *
+ * Password hashes never leave Stytch through the API: they come from the export
+ * Stytch support sends on request (support@stytch.com), given as `--stytch-hashes`
+ * (CSV, JSON or NDJSON). Until then the `stytch` lazy-migration preset checks
+ * passwords against Stytch on first sign-in. TOTP secrets, passkeys and crypto
+ * wallets are not exported.
+ */
+export type StytchProduct = 'consumer' | 'b2b';
+export interface StytchExportOptions {
+    projectId: string;
+    secret: string;
+    /** Detected from the project when omitted. */
+    product?: StytchProduct;
+    /** Override `https://api.stytch.com` (live) / `https://test.stytch.com` (test), e.g. a custom domain. */
+    baseUrl?: string;
+    /** The support-provided password export (CSV, JSON array or NDJSON text). */
+    hashesText?: string;
+    fetchImpl?: typeof fetch;
+    sleep?: (ms: number) => Promise<void>;
+    onProgress?: (message: string) => void;
+}
+/** The API host for a project id: live projects are on api.stytch.com, test projects on test.stytch.com. */
+export declare function stytchBaseUrl(projectId: string): string;
+/** HTTP Basic credentials for the project. */
+export declare function stytchAuthorization(projectId: string, secret: string): string;
+export declare function stytchHttp(o: Pick<StytchExportOptions, 'projectId' | 'secret' | 'baseUrl' | 'fetchImpl' | 'sleep'>): VendorHttp;
+/** Is this a B2B project? Its organization search answers; a consumer project refuses the endpoint. */
+export declare function detectStytchProduct(http: VendorHttp): Promise<StytchProduct>;
+/** Stytch's cursor paging: `results_metadata.next_cursor` until it is null. */
+export declare function stytchSearch(http: VendorHttp, path: string, body: Obj, key: string): Promise<Obj[]>;
+export declare function exportStytch(opts: StytchExportOptions): Promise<RecordSet>;
+/** One Stytch user object → a user record; null with nothing to sign in with. */
+export declare function mapStytchUser(u: Obj): UserRecord | null;
+export declare function stytchRoleKey(roleId: string): string;
+/**
+ * Parse the password export Stytch support sends: a JSON array (or an object
+ * holding one under `users` / `members` / `results`), NDJSON, or CSV with a
+ * header row. Keys are lower-cased; a nested `scrypt_config` etc. is flattened.
+ */
+export declare function parseStytchHashes(text: string): Obj[];
+/**
+ * One row of the support export → the bundle's password hash. Field names
+ * follow Stytch's own password-migration API (`hash`, `hash_type`, and the
+ * `scrypt_config` / `pbkdf_2_config` / salt fields), which is the format the
+ * export mirrors (UNCONFIRMED: Stytch support documents it per request).
+ */
+export declare function stytchPasswordHash(row: Obj): PasswordHash | {
+    reason: string;
+};