@atlasauth/cli 0.12.0 → 0.14.0

package/dist/migrate/oidc/plugin.js

@@ -0,0 +1,73 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.oidcPlugin = void 0;
+const errors_1 = require("../../errors");
+const plugin_kit_1 = require("../export/plugin-kit");
+const sso_metadata_1 = require("../export/sso-metadata");
+const translate_kit_1 = require("../export/translate-kit");
+/**
+ * `atlas migrate oidc export --set oidc-issuer=https://idp.example.com` — any
+ * OpenID Connect provider from its discovery document: an Atlas SSO connection,
+ * the JWT bridge preset (the issuer's tokens exchange for Atlas sessions, keys
+ * found by discovery) and, when the provider allows the password grant, the
+ * lazy-migration preset. Users come from `atlas migrate user-table` / `ldap`.
+ */
+const ISSUER = { flag: 'oidc-issuer', env: 'OIDC_ISSUER', label: 'the provider issuer URL (https://idp.example.com/realms/acme)', required: true };
+const CLIENT_ID = { flag: 'oidc-client-id', env: 'OIDC_CLIENT_ID', label: 'the client id Atlas signs in with (and the password grant uses)', required: false };
+const CLIENT_SECRET = { flag: 'oidc-client-secret', env: 'OIDC_CLIENT_SECRET', label: 'the client secret', required: false, secret: true };
+const DOMAINS = { flag: 'oidc-domains', env: 'OIDC_DOMAINS', label: 'email domains that sign in through this provider (comma separated)', required: false };
+async function discover(p) {
+    const issuer = p.credential({ ...ISSUER, required: true });
+    try {
+        return await (0, sso_metadata_1.fetchDiscovery)(p.fetch, issuer);
+    }
+    catch (err) {
+        throw new errors_1.CliError(`OpenID Connect discovery: ${err.message}`);
+    }
+}
+exports.oidcPlugin = {
+    vendor: 'oidc',
+    source: 'oidc',
+    label: 'Any OpenID Connect provider',
+    help: 'Move off a generic OpenID Connect provider: discovery (--set oidc-issuer=…) creates the Atlas SSO connection, the zero-logout bridge accepts the provider\'s tokens (keys found by discovery), and lazy migration uses the password grant when the provider offers it for a client you register. Bring the accounts with atlas migrate user-table (a CSV/JSON export) or atlas migrate ldap.',
+    config: {
+        reads: 'the provider\'s OpenID Connect discovery document',
+        credentials: [ISSUER, CLIENT_ID],
+        async translate(p) {
+            const d = await discover(p);
+            const b = new translate_kit_1.ConfigBuilder();
+            b.add('mapped', 'oidc', d.issuer, 'Becomes an Atlas SSO connection (atlas migrate oidc export + import). Add Atlas\'s redirect URI to the provider\'s client.', 'sso_connections');
+            b.add('mapped', 'oidc', 'jwks_uri', d.jwks_uri ? `Session tokens verify against ${d.jwks_uri} (found by discovery).` : 'The provider publishes no jwks_uri: the bridge cannot verify its tokens.', 'bridge');
+            if (d.grant_types_supported.includes('password'))
+                b.add('differs', 'oidc', 'grant_types_supported password', 'The password grant is offered: lazy migration can check passwords against the provider.', 'legacy_auth_connection');
+            else
+                b.add('manual', 'oidc', 'grant_types_supported', 'The provider does not list the password grant: passwords cannot be checked by lazy migration (users reset, or you export hashes).');
+            const clientId = p.credential(CLIENT_ID);
+            return b.result(`OIDC provider ${d.issuer}`, {
+                bridge: { preset: 'oidc', vars: { issuer: d.issuer } },
+                ...(d.token_endpoint && clientId ? { lazy: { preset: 'oidc', config: { token_endpoint: d.token_endpoint, client_id: clientId, ...(d.userinfo_endpoint ? { userinfo_endpoint: d.userinfo_endpoint } : {}) } } } : {}),
+            });
+        },
+    },
+    export: {
+        reads: 'the provider\'s OpenID Connect discovery document (--set oidc-issuer=…)',
+        credentials: [ISSUER, CLIENT_ID, CLIENT_SECRET, DOMAINS],
+        limits: ['An OpenID Connect provider exposes no user list: bring the accounts with atlas migrate user-table or atlas migrate ldap.'],
+        async run(p, writer, resume) {
+            const d = await discover(p);
+            const domains = (p.credential(DOMAINS) ?? '').split(',').map((x) => x.trim().toLowerCase()).filter(Boolean);
+            const c = (0, sso_metadata_1.oidcConnection)(d, { clientId: p.credential(CLIENT_ID), clientSecret: p.credential(CLIENT_SECRET), domains: domains.length ? domains : undefined });
+            await (0, plugin_kit_1.writeRecordSet)((0, sso_metadata_1.connectionSet)([c], `OIDC provider ${d.issuer}`), writer, resume, p.say);
+        },
+    },
+    bridge: {
+        preset: 'oidc',
+        vars: (p, t) => ({ ...t?.bridge?.vars, issuer: t?.bridge?.vars.issuer ?? p.credential({ ...ISSUER, required: true }) }),
+    },
+    lazy: {
+        preset: 'oidc',
+        config: (p, t) => ({ ...t?.lazy?.config, ...(p.credential(CLIENT_ID) ? { client_id: p.credential(CLIENT_ID) } : {}) }),
+        secret: CLIENT_SECRET,
+    },
+};
+//# sourceMappingURL=plugin.js.map

package/dist/migrate/oidc/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/migrate/oidc/plugin.ts"],"names":[],"mappings":";;;AAAA,yCAAwC;AACxC,qDAAsD;AACtD,yDAAuF;AACvF,2DAAwD;AAGxD;;;;;;GAMG;AAEH,MAAM,MAAM,GAAmB,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,+DAA+D,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AACnK,MAAM,SAAS,GAAmB,EAAE,IAAI,EAAE,gBAAgB,EAAE,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,iEAAiE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC/K,MAAM,aAAa,GAAmB,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,mBAAmB,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC3J,MAAM,OAAO,GAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,oEAAoE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAE5K,KAAK,UAAU,QAAQ,CAAC,CAAgB;IACtC,MAAM,MAAM,GAAG,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAE,CAAC;IAC5D,IAAI,CAAC;QACH,OAAO,MAAM,IAAA,6BAAc,EAAC,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,iBAAQ,CAAC,6BAA8B,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC;AAEY,QAAA,UAAU,GAAoB;IACzC,MAAM,EAAE,MAAM;IACd,MAAM,EAAE,MAAM;IACd,KAAK,EAAE,6BAA6B;IACpC,IAAI,EAAE,8XAA8X;IACpY,MAAM,EAAE;QACN,KAAK,EAAE,mDAAmD;QAC1D,WAAW,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC;QAChC,KAAK,CAAC,SAAS,CAAC,CAAC;YACf,MAAM,CAAC,GAAG,MAAM,QAAQ,CAAC,CAAC,CAAC,CAAC;YAC5B,MAAM,CAAC,GAAG,IAAI,6BAAa,EAAE,CAAC;YAC9B,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,4HAA4H,EAAE,iBAAiB,CAAC,CAAC;YACnL,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,iCAAiC,CAAC,CAAC,QAAQ,wBAAwB,CAAC,CAAC,CAAC,0EAA0E,EAAE,QAAQ,CAAC,CAAC;YAC7M,IAAI,CAAC,CAAC,qBAAqB,CAAC,QAAQ,CAAC,UAAU,CAAC;gBAAE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,gCAAgC,EAAE,yFAAyF,EAAE,wBAAwB,CAAC,CAAC;;gBAC7N,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,uBAAuB,EAAE,mIAAmI,CAAC,CAAC;YAC3L,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YACzC,OAAO,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,MAAM,EAAE,EAAE;gBAC3C,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE;gBACtD,GAAG,CAAC,CAAC,CAAC,cAAc,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,cAAc,EAAE,CAAC,CAAC,cAAc,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACrN,CAAC,CAAC;QACL,CAAC;KACF;IACD,MAAM,EAAE;QACN,KAAK,EAAE,yEAAyE;QAChF,WAAW,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,CAAC;QACxD,MAAM,EAAE,CAAC,0HAA0H,CAAC;QACpI,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM;YACzB,MAAM,CAAC,GAAG,MAAM,QAAQ,CAAC,CAAC,CAAC,CAAC;YAC5B,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC5G,MAAM,CAAC,GAAG,IAAA,6BAAc,EAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;YAC7J,MAAM,IAAA,2BAAc,EAAC,IAAA,4BAAa,EAAC,CAAC,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QAC/F,CAAC;KACF;IACD,MAAM,EAAE;QACN,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAE,EAAE,CAAC;KACzH;IACD,IAAI,EAAE;QACJ,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,SAAS,CAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QACvH,MAAM,EAAE,aAAa;KACtB;CACF,CAAC"}

package/dist/migrate/onelogin/plugin.d.ts

@@ -0,0 +1,2 @@
+import type { MigrationPlugin } from '../framework/plugin';
+export declare const oneLoginPlugin: MigrationPlugin;

package/dist/migrate/onelogin/plugin.js

@@ -0,0 +1,61 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.oneLoginPlugin = void 0;
+const onelogin_1 = require("../export/onelogin");
+const plugin_kit_1 = require("../export/plugin-kit");
+const translate_kit_1 = require("../export/translate-kit");
+/**
+ * `atlas migrate onelogin` — a OneLogin account: users and roles through API
+ * v2 with API credentials on this machine, the `onelogin` bridge preset
+ * (OIDC v2 tokens verified against the account's keys) and lazy migration
+ * through OneLogin's session-login-token API (OneLogin never exports hashes).
+ */
+const SUBDOMAIN = { flag: 'onelogin-subdomain', env: 'ONELOGIN_SUBDOMAIN', label: 'your OneLogin subdomain (acme for acme.onelogin.com)', required: true };
+const CLIENT_ID = { flag: 'onelogin-client-id', env: 'ONELOGIN_CLIENT_ID', label: 'an API credential client id', required: true };
+const CLIENT_SECRET = { flag: 'onelogin-client-secret', env: 'ONELOGIN_CLIENT_SECRET', label: 'the API credential client secret', required: true, secret: true };
+const subdomain = (p) => (0, onelogin_1.oneLoginSubdomain)((0, plugin_kit_1.need)(p, SUBDOMAIN));
+exports.oneLoginPlugin = {
+    vendor: 'onelogin',
+    source: 'onelogin',
+    label: 'OneLogin',
+    help: 'Move a OneLogin account: users with their login, email, name, phone, status (suspended and locked carry over) and custom attributes, roles as app roles, a zero-logout bridge for OneLogin OIDC tokens, and lazy migration for passwords (OneLogin never exports hashes). Your API credentials stay on this machine. Apps connected through OneLogin\'s SAML / OIDC are moved with atlas migrate saml / oidc using the app\'s metadata.',
+    config: {
+        reads: 'your OneLogin subdomain (the API exposes no policy settings to read)',
+        credentials: [SUBDOMAIN],
+        async translate(p) {
+            const sub = subdomain(p);
+            const b = new translate_kit_1.ConfigBuilder();
+            b.set('strategies.password', true);
+            b.add('differs', 'authentication', 'password', 'OneLogin never exports password hashes: the onelogin lazy-migration preset checks each password against OneLogin on first sign-in.', 'auth_config.strategies.password');
+            b.add('manual', 'security policies', 'user security policies (password, MFA, session)', 'The OneLogin API does not expose security policies: read them in the admin portal and set Atlas\'s passwordPolicy, MFA policy and session lifetimes in auth_config.');
+            b.add('manual', 'apps', 'SAML / OIDC connectors', 'Download each app\'s metadata and move it with atlas migrate saml export (or oidc export).');
+            return b.result(`OneLogin account ${sub}.onelogin.com`, {
+                bridge: { preset: 'onelogin', vars: { subdomain: sub } },
+                lazy: { preset: 'onelogin', config: { subdomain: sub, client_id: (0, plugin_kit_1.need)(p, CLIENT_ID) } },
+            });
+        },
+    },
+    export: {
+        reads: 'your OneLogin account through API v2 (users, roles)',
+        credentials: [SUBDOMAIN, CLIENT_ID, CLIENT_SECRET],
+        limits: [
+            'Password hashes are never exported by OneLogin: passwords move by lazy migration (preset onelogin).',
+            'MFA secrets cannot be exported: users enrol their second factor again.',
+            'OneLogin does not say which addresses were confirmed: they import unverified.',
+        ],
+        async run(p, writer, resume) {
+            const set = await (0, plugin_kit_1.vendorStep)('OneLogin', () => (0, onelogin_1.exportOneLogin)({ subdomain: (0, plugin_kit_1.need)(p, SUBDOMAIN), clientId: (0, plugin_kit_1.need)(p, CLIENT_ID), clientSecret: (0, plugin_kit_1.need)(p, CLIENT_SECRET), fetchImpl: p.fetch, onProgress: (m) => p.say(`  reading ${m}`) }));
+            await (0, plugin_kit_1.writeRecordSet)(set, writer, resume, p.say);
+        },
+    },
+    bridge: {
+        preset: 'onelogin',
+        vars: (p, t) => ({ subdomain: subdomain(p), ...t?.bridge?.vars }),
+    },
+    lazy: {
+        preset: 'onelogin',
+        config: (p, t) => ({ subdomain: subdomain(p), client_id: (0, plugin_kit_1.need)(p, CLIENT_ID), ...t?.lazy?.config }),
+        secret: CLIENT_SECRET,
+    },
+};
+//# sourceMappingURL=plugin.js.map

package/dist/migrate/onelogin/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/migrate/onelogin/plugin.ts"],"names":[],"mappings":";;;AAAA,iDAAuE;AACvE,qDAAwE;AACxE,2DAAwD;AAGxD;;;;;GAKG;AAEH,MAAM,SAAS,GAAmB,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,sDAAsD,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AAC3K,MAAM,SAAS,GAAmB,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,6BAA6B,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AAClJ,MAAM,aAAa,GAAmB,EAAE,IAAI,EAAE,wBAAwB,EAAE,GAAG,EAAE,wBAAwB,EAAE,KAAK,EAAE,kCAAkC,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAEjL,MAAM,SAAS,GAAG,CAAC,CAAgB,EAAE,EAAE,CAAC,IAAA,4BAAiB,EAAC,IAAA,iBAAI,EAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;AAEjE,QAAA,cAAc,GAAoB;IAC7C,MAAM,EAAE,UAAU;IAClB,MAAM,EAAE,UAAU;IAClB,KAAK,EAAE,UAAU;IACjB,IAAI,EAAE,yaAAya;IAC/a,MAAM,EAAE;QACN,KAAK,EAAE,sEAAsE;QAC7E,WAAW,EAAE,CAAC,SAAS,CAAC;QACxB,KAAK,CAAC,SAAS,CAAC,CAAC;YACf,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;YACzB,MAAM,CAAC,GAAG,IAAI,6BAAa,EAAE,CAAC;YAC9B,CAAC,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC;YACnC,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,gBAAgB,EAAE,UAAU,EAAE,oIAAoI,EAAE,iCAAiC,CAAC,CAAC;YACxN,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,mBAAmB,EAAE,iDAAiD,EAAE,qKAAqK,CAAC,CAAC;YAC/P,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,wBAAwB,EAAE,4FAA4F,CAAC,CAAC;YAChJ,OAAO,CAAC,CAAC,MAAM,CAAC,oBAAoB,GAAG,eAAe,EAAE;gBACtD,MAAM,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE;gBACxD,IAAI,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,IAAA,iBAAI,EAAC,CAAC,EAAE,SAAS,CAAC,EAAE,EAAE;aACxF,CAAC,CAAC;QACL,CAAC;KACF;IACD,MAAM,EAAE;QACN,KAAK,EAAE,qDAAqD;QAC5D,WAAW,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,aAAa,CAAC;QAClD,MAAM,EAAE;YACN,qGAAqG;YACrG,wEAAwE;YACxE,+EAA+E;SAChF;QACD,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM;YACzB,MAAM,GAAG,GAAG,MAAM,IAAA,uBAAU,EAAC,UAAU,EAAE,GAAG,EAAE,CAC5C,IAAA,yBAAc,EAAC,EAAE,SAAS,EAAE,IAAA,iBAAI,EAAC,CAAC,EAAE,SAAS,CAAC,EAAE,QAAQ,EAAE,IAAA,iBAAI,EAAC,CAAC,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAA,iBAAI,EAAC,CAAC,EAAE,aAAa,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC,EAAE,CAAC,CACtL,CAAC;YACF,MAAM,IAAA,2BAAc,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;KACF;IACD,MAAM,EAAE;QACN,MAAM,EAAE,UAAU;QAClB,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;KAClE;IACD,IAAI,EAAE;QACJ,MAAM,EAAE,UAAU;QAClB,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAA,iBAAI,EAAC,CAAC,EAAE,SAAS,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAClG,MAAM,EAAE,aAAa;KACtB;CACF,CAAC"}

package/dist/migrate/ory/plugin.d.ts

@@ -0,0 +1,2 @@
+import type { MigrationPlugin } from '../framework/plugin';
+export declare const oryPlugin: MigrationPlugin;

package/dist/migrate/ory/plugin.js

@@ -0,0 +1,186 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.oryPlugin = void 0;
+const node_path_1 = require("node:path");
+const errors_1 = require("../../errors");
+const ory_1 = require("../export/ory");
+const ory_config_1 = require("../export/ory-config");
+const tables_1 = require("../export/frameworks/tables");
+const plugin_kit_1 = require("../export/plugin-kit");
+const vendor_http_1 = require("../export/vendor-http");
+/**
+ * `atlas migrate ory` — Ory Kratos and Hydra, self-hosted or on Ory Network:
+ * the Kratos config (kratos.yml, or `ory get project` JSON), identity schemas
+ * and Hydra's config and OAuth 2.0 clients as Atlas config; identities with
+ * their verified addresses, social links, metadata and — from a database dump —
+ * password hashes in every format Kratos verifies, TOTP seeds, recovery codes,
+ * WebAuthn / passkey credentials and live session tokens; a zero-logout
+ * bridge (Kratos vouches for the session, or imported session tokens); lazy
+ * migration through Kratos' login flow; and the code. Credentials stay on this
+ * machine. Ory Network has no database access and its Admin API returns no
+ * hashes, seeds or session tokens: those users move by lazy migration and
+ * enrol their second factor again.
+ */
+const ADMIN_URL = { flag: '--ory-admin-url', env: 'ORY_ADMIN_URL', label: 'the Kratos admin URL (http://kratos:4434) or your Ory Network project URL', required: false };
+const PUBLIC_URL = { flag: '--ory-public-url', env: 'ORY_PUBLIC_URL', label: 'the Kratos public URL (https://auth.example.com, or https://<slug>.projects.oryapis.com)', required: false };
+const API_KEY = { flag: '--ory-api-key', env: 'ORY_API_KEY', label: 'an Ory Network project API key (ory_pat_…)', required: false, secret: true };
+const DUMP = { flag: '--ory-dump', env: 'ORY_DUMP_DIR', label: 'a folder of Kratos table dumps (identities.csv, identity_credentials.csv, …)', required: false };
+const RP_ID = { flag: '--ory-rp-id', env: 'ORY_RP_ID', label: 'the WebAuthn relying-party id passkeys were registered for (rp.id in kratos.yml)', required: false };
+const NID = { flag: '--ory-nid', env: 'ORY_NID', label: 'the project (nid) to export from a multi-project database', required: false };
+const CONFIG_FILE = { flag: '--ory-config', env: 'ORY_CONFIG', label: 'kratos.yml, or the JSON of `ory get project <id> --format json`', required: false };
+const HYDRA_CONFIG = { flag: '--ory-hydra-config', env: 'ORY_HYDRA_CONFIG', label: 'hydra.yml', required: false };
+const HYDRA_URL = { flag: '--ory-hydra-url', env: 'ORY_HYDRA_URL', label: 'the Hydra admin URL (http://hydra:4445), to read OAuth 2.0 clients', required: false };
+const BRIDGE_MODE = {
+    flag: '--ory-bridge',
+    env: 'ORY_BRIDGE',
+    label: 'what the bridge accepts: whoami-cookie (default when the public URL is known), whoami-token (X-Session-Token / Bearer tokens checked with Kratos) or session-token (tokens imported with a database export)',
+    required: false,
+};
+const COOKIE_NAME = { flag: '--ory-cookie-name', env: 'ORY_COOKIE_NAME', label: 'the session cookie name (ory_kratos_session; ory_session_<slug> on Ory Network)', required: false };
+const EMAIL_TRAIT = { flag: '--ory-email-trait', env: 'ORY_EMAIL_TRAIT', label: 'the identity trait holding the email address (default email), for lazy migration', required: false };
+const NETWORK = /\.projects\.oryapis\.com$|\.oryapis\.com$/i;
+const isNetwork = (url) => !!url && NETWORK.test((0, plugin_kit_1.hostOf)(url).replace(/:\d+$/, ''));
+/** `https://…` with no trailing slash; a bare host gets https. */
+function baseUrl(raw) {
+    const s = raw.trim().replace(/\/+$/, '');
+    return /^https?:\/\//.test(s) ? s : `https://${s}`;
+}
+const PRESETS = { 'whoami-cookie': 'ory_whoami', 'whoami-token': 'ory_whoami_token', 'session-token': 'ory' };
+function publicUrl(p, t) {
+    const admin = p.credential(ADMIN_URL);
+    const raw = p.credential(PUBLIC_URL) ?? (isNetwork(admin) ? admin : undefined) ?? t?.bridge?.vars.base_url ?? t?.lazy?.config.base_url;
+    return raw ? baseUrl(raw) : undefined;
+}
+function bridgeMode(p, hasPublicUrl) {
+    const raw = p.credential(BRIDGE_MODE)?.trim().toLowerCase();
+    if (!raw)
+        return hasPublicUrl ? 'whoami-cookie' : 'session-token';
+    if (raw === 'whoami-cookie' || raw === 'whoami-token' || raw === 'session-token')
+        return raw;
+    throw new errors_1.CliError(`Ory: --set ory-bridge takes whoami-cookie, whoami-token or session-token (got ${raw}).`);
+}
+/** The preset the last `bridge.vars` call chose (the framework reads `vars` first, then `preset`). */
+let chosenPreset = 'ory';
+exports.oryPlugin = {
+    vendor: 'ory',
+    source: 'ory',
+    label: 'Ory (Kratos, Hydra, Ory Network)',
+    help: 'Move Ory Kratos and Hydra (self-hosted or Ory Network): kratos.yml, identity schemas, Hydra settings and OAuth 2.0 clients as Atlas config; identities with verified addresses, social links and metadata through the Admin API, plus password hashes, TOTP seeds, recovery codes, passkeys and session tokens from a database dump; a zero-logout bridge where Kratos vouches for the session; lazy migration through the Kratos login flow; and the code. Credentials stay on this machine.',
+    config: {
+        reads: 'kratos.yml or `ory get project` JSON, hydra.yml, the identity schemas, and the Hydra Admin API (OAuth 2.0 clients)',
+        credentials: [CONFIG_FILE, HYDRA_CONFIG, PUBLIC_URL, HYDRA_URL, ADMIN_URL, API_KEY],
+        async translate(p) {
+            const warnings = [];
+            let kratos;
+            let hydra;
+            const read = (path) => {
+                try {
+                    return (0, ory_config_1.parseOryConfig)(p.ctx.readFile((0, node_path_1.resolve)(path)), path);
+                }
+                catch (err) {
+                    throw new errors_1.CliError(`Ory: could not read ${path}: ${err.message}`);
+                }
+            };
+            const configPath = p.credential(CONFIG_FILE);
+            if (configPath) {
+                const parsed = read(configPath);
+                const project = (0, ory_config_1.splitOryProject)(parsed);
+                kratos = project?.kratos ?? parsed;
+                hydra = project?.hydra;
+            }
+            const hydraPath = p.credential(HYDRA_CONFIG);
+            if (hydraPath)
+                hydra = read(hydraPath);
+            let schemas = (0, ory_config_1.resolveOrySchemas)(kratos, (path) => p.ctx.readFile(path), (m) => warnings.push(m));
+            const url = p.credential(PUBLIC_URL) ?? (isNetwork(p.credential(ADMIN_URL)) ? p.credential(ADMIN_URL) : undefined);
+            const apiKey = p.credential(API_KEY);
+            const headers = apiKey ? { authorization: `Bearer ${apiKey}` } : undefined;
+            if (url && !schemas.length) {
+                const http = new vendor_http_1.VendorHttp({ vendor: 'Ory', baseUrl: baseUrl(url), headers, fetchImpl: p.fetch });
+                schemas = await (0, plugin_kit_1.vendorStep)('Ory', () => (0, ory_config_1.fetchOrySchemas)(http));
+            }
+            let clients = [];
+            const admin = p.credential(ADMIN_URL);
+            const hydraUrl = p.credential(HYDRA_URL) ?? (isNetwork(admin) ? admin : isNetwork(url) ? url : undefined);
+            if (hydraUrl) {
+                const http = new vendor_http_1.VendorHttp({ vendor: 'Ory Hydra', baseUrl: baseUrl(hydraUrl), headers, fetchImpl: p.fetch });
+                clients = await (0, plugin_kit_1.vendorStep)('Ory Hydra', () => (0, ory_config_1.fetchOryClients)(http));
+            }
+            if (!kratos && !hydra && !schemas.length && !clients.length) {
+                throw new errors_1.CliError('Ory: nothing to read. Pass kratos.yml (--set ory-config=<file>), an Ory Network project JSON, a public URL (--set ory-public-url=…) or the Hydra admin URL (--set ory-hydra-url=…).');
+            }
+            for (const w of warnings)
+                p.say(`  ${w}`);
+            const origin = configPath ?? (url ? `Ory ${(0, plugin_kit_1.hostOf)(url)}` : hydraPath ?? `Ory Hydra ${(0, plugin_kit_1.hostOf)(hydraUrl ?? '')}`);
+            return (0, ory_config_1.translateOryConfig)({ origin, kratos, hydra, schemas, clients, publicUrl: url ? baseUrl(url) : undefined });
+        },
+    },
+    export: {
+        reads: 'a dump of the Kratos database (identities, identity_credentials, identity_verifiable_addresses, sessions) or the Kratos Admin API',
+        credentials: [DUMP, ADMIN_URL, API_KEY, RP_ID, NID],
+        limits: [
+            'Password hashes, TOTP seeds, recovery codes, WebAuthn credentials and session tokens live only in the database: dump it (see the guide). The Admin API returns none of them, so those users move by lazy migration and enrol their second factor again.',
+            'Ory Network has no database access: its identities export through the Admin API with a project API key, passwords move by lazy migration and the bridge asks Ory to vouch for the session.',
+            'Hash formats Atlas cannot verify (for example $hmac-md4$) are left out and those users move by lazy migration.',
+            'Passkeys and security keys need the relying-party id (--set ory-rp-id) and keep working only when Atlas serves sign-in on that domain.',
+            'Ory Network organizations (enterprise SSO) and Hydra consent grants are not exported: recreate SSO connections in Atlas; users consent again.',
+        ],
+        async run(p, writer, resume) {
+            const dump = p.credential(DUMP);
+            const rpId = p.credential(RP_ID);
+            const rawAdmin = p.credential(ADMIN_URL) ?? (isNetwork(p.credential(PUBLIC_URL)) ? p.credential(PUBLIC_URL) : undefined);
+            let set;
+            if (dump) {
+                set = await (0, plugin_kit_1.vendorStep)('Ory', async () => (0, ory_1.exportOryTables)((0, tables_1.readDumpDir)((0, node_path_1.resolve)(dump)), { rpId, networkId: p.credential(NID) }));
+            }
+            else if (rawAdmin) {
+                const apiKey = p.credential(API_KEY);
+                if (isNetwork(rawAdmin) && !apiKey)
+                    throw new errors_1.CliError('Ory Network: pass a project API key (--set ory-api-key=ory_pat_… or ORY_API_KEY).');
+                set = await (0, plugin_kit_1.vendorStep)('Ory', () => (0, ory_1.exportOryApi)({ adminUrl: rawAdmin, apiKey, rpId, fetchImpl: p.fetch, onProgress: (m) => p.say(`  reading ${m}`) }));
+            }
+            else {
+                throw new errors_1.CliError('Ory: pass a folder of Kratos table dumps (--set ory-dump=<folder>), or the admin URL (--set ory-admin-url=…) for an Admin API export without password hashes.');
+            }
+            await (0, plugin_kit_1.writeRecordSet)(set, writer, resume, p.say);
+        },
+    },
+    bridge: {
+        get preset() {
+            return chosenPreset;
+        },
+        vars(p, t) {
+            const vars = { ...t?.bridge?.vars };
+            const url = publicUrl(p, t);
+            const mode = bridgeMode(p, !!url);
+            chosenPreset = PRESETS[mode];
+            if (mode === 'session-token')
+                return {};
+            if (!url)
+                throw new errors_1.CliError('Ory: the whoami bridge calls Kratos: pass its public URL (--set ory-public-url=https://auth.example.com).');
+            vars.base_url = url;
+            if (mode === 'whoami-cookie') {
+                const slug = /^https:\/\/([a-z0-9-]+)\.projects\.oryapis\.com/i.exec(url)?.[1];
+                vars.cookie_name = p.credential(COOKIE_NAME)?.trim() ?? vars.cookie_name ?? (slug ? `ory_session_${slug}` : 'ory_kratos_session');
+            }
+            else
+                delete vars.cookie_name;
+            return vars;
+        },
+    },
+    lazy: {
+        preset: 'ory',
+        config(p, t) {
+            const config = { ...t?.lazy?.config };
+            const url = publicUrl(p, t);
+            if (url)
+                config.base_url = url;
+            const trait = p.credential(EMAIL_TRAIT);
+            if (trait)
+                config.email_trait = trait.trim();
+            return config;
+        },
+    },
+    codemod: 'ory',
+};
+//# sourceMappingURL=plugin.js.map

package/dist/migrate/ory/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/migrate/ory/plugin.ts"],"names":[],"mappings":";;;AAAA,yCAAoC;AACpC,yCAAwC;AACxC,uCAA8D;AAC9D,qDAA4L;AAC5L,wDAA0D;AAE1D,qDAA0E;AAC1E,uDAAmD;AAGnD;;;;;;;;;;;;GAYG;AAEH,MAAM,SAAS,GAAmB,EAAE,IAAI,EAAE,iBAAiB,EAAE,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,2EAA2E,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACzL,MAAM,UAAU,GAAmB,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,0FAA0F,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC3M,MAAM,OAAO,GAAmB,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,4CAA4C,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAClK,MAAM,IAAI,GAAmB,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,8EAA8E,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACjL,MAAM,KAAK,GAAmB,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,kFAAkF,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACpL,MAAM,GAAG,GAAmB,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,2DAA2D,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACvJ,MAAM,WAAW,GAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,YAAY,EAAE,KAAK,EAAE,iEAAiE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC3K,MAAM,YAAY,GAAmB,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAClI,MAAM,SAAS,GAAmB,EAAE,IAAI,EAAE,iBAAiB,EAAE,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,oEAAoE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAClL,MAAM,WAAW,GAAmB;IAClC,IAAI,EAAE,cAAc;IACpB,GAAG,EAAE,YAAY;IACjB,KAAK,EAAE,6MAA6M;IACpN,QAAQ,EAAE,KAAK;CAChB,CAAC;AACF,MAAM,WAAW,GAAmB,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,iBAAiB,EAAE,KAAK,EAAE,iFAAiF,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACrM,MAAM,WAAW,GAAmB,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,iBAAiB,EAAE,KAAK,EAAE,kFAAkF,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAEtM,MAAM,OAAO,GAAG,4CAA4C,CAAC;AAE7D,MAAM,SAAS,GAAG,CAAC,GAAuB,EAAW,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,IAAA,mBAAM,EAAC,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAEhH,kEAAkE;AAClE,SAAS,OAAO,CAAC,GAAW;IAC1B,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACzC,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC;AACrD,CAAC;AAGD,MAAM,OAAO,GAA+B,EAAE,eAAe,EAAE,YAAY,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;AAE1I,SAAS,SAAS,CAAC,CAAgB,EAAE,CAA4F;IAC/H,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC;IACvI,OAAO,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACxC,CAAC;AAED,SAAS,UAAU,CAAC,CAAgB,EAAE,YAAqB;IACzD,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5D,IAAI,CAAC,GAAG;QAAE,OAAO,YAAY,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,eAAe,CAAC;IAClE,IAAI,GAAG,KAAK,eAAe,IAAI,GAAG,KAAK,cAAc,IAAI,GAAG,KAAK,eAAe;QAAE,OAAO,GAAG,CAAC;IAC7F,MAAM,IAAI,iBAAQ,CAAC,iFAAiF,GAAG,IAAI,CAAC,CAAC;AAC/G,CAAC;AAED,sGAAsG;AACtG,IAAI,YAAY,GAAG,KAAK,CAAC;AAEZ,QAAA,SAAS,GAAoB;IACxC,MAAM,EAAE,KAAK;IACb,MAAM,EAAE,KAAK;IACb,KAAK,EAAE,kCAAkC;IACzC,IAAI,EAAE,+dAA+d;IACre,MAAM,EAAE;QACN,KAAK,EAAE,oHAAoH;QAC3H,WAAW,EAAE,CAAC,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC;QACnF,KAAK,CAAC,SAAS,CAAC,CAAC;YACf,MAAM,QAAQ,GAAa,EAAE,CAAC;YAC9B,IAAI,MAAiC,CAAC;YACtC,IAAI,KAAgC,CAAC;YACrC,MAAM,IAAI,GAAG,CAAC,IAAY,EAAiB,EAAE;gBAC3C,IAAI,CAAC;oBACH,OAAO,IAAA,2BAAc,EAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;gBAC7D,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,IAAI,iBAAQ,CAAC,uBAAuB,IAAI,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC/E,CAAC;YACH,CAAC,CAAC;YACF,MAAM,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;YAC7C,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;gBAChC,MAAM,OAAO,GAAG,IAAA,4BAAe,EAAC,MAAM,CAAC,CAAC;gBACxC,MAAM,GAAG,OAAO,EAAE,MAAM,IAAI,MAAM,CAAC;gBACnC,KAAK,GAAG,OAAO,EAAE,KAAK,CAAC;YACzB,CAAC;YACD,MAAM,SAAS,GAAG,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;YAC7C,IAAI,SAAS;gBAAE,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC;YAEvC,IAAI,OAAO,GAAwB,IAAA,8BAAiB,EAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YACtH,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YACnH,MAAM,MAAM,GAAG,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YACrC,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;YAC3E,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;gBAC3B,MAAM,IAAI,GAAG,IAAI,wBAAU,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;gBACnG,OAAO,GAAG,MAAM,IAAA,uBAAU,EAAC,KAAK,EAAE,GAAG,EAAE,CAAC,IAAA,4BAAe,EAAC,IAAI,CAAC,CAAC,CAAC;YACjE,CAAC;YACD,IAAI,OAAO,GAAU,EAAE,CAAC;YACxB,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YACtC,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAC1G,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,IAAI,GAAG,IAAI,wBAAU,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;gBAC9G,OAAO,GAAG,MAAM,IAAA,uBAAU,EAAC,WAAW,EAAE,GAAG,EAAE,CAAC,IAAA,4BAAe,EAAC,IAAI,CAAC,CAAC,CAAC;YACvE,CAAC;YACD,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;gBAC5D,MAAM,IAAI,iBAAQ,CAAC,qLAAqL,CAAC,CAAC;YAC5M,CAAC;YACD,KAAK,MAAM,CAAC,IAAI,QAAQ;gBAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC1C,MAAM,MAAM,GAAG,UAAU,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,IAAA,mBAAM,EAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,IAAI,aAAa,IAAA,mBAAM,EAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;YAC/G,OAAO,IAAA,+BAAkB,EAAC,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QACpH,CAAC;KACF;IACD,MAAM,EAAE;QACN,KAAK,EAAE,mIAAmI;QAC1I,WAAW,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC;QACnD,MAAM,EAAE;YACN,yPAAyP;YACzP,4LAA4L;YAC5L,gHAAgH;YAChH,wIAAwI;YACxI,+IAA+I;SAChJ;QACD,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM;YACzB,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YAChC,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YACjC,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YACzH,IAAI,GAAc,CAAC;YACnB,IAAI,IAAI,EAAE,CAAC;gBACT,GAAG,GAAG,MAAM,IAAA,uBAAU,EAAC,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,IAAA,qBAAe,EAAC,IAAA,oBAAW,EAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;YACjI,CAAC;iBAAM,IAAI,QAAQ,EAAE,CAAC;gBACpB,MAAM,MAAM,GAAG,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;gBACrC,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM;oBAAE,MAAM,IAAI,iBAAQ,CAAC,mFAAmF,CAAC,CAAC;gBAC5I,GAAG,GAAG,MAAM,IAAA,uBAAU,EAAC,KAAK,EAAE,GAAG,EAAE,CAAC,IAAA,kBAAY,EAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YAC1J,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,iBAAQ,CAAC,+JAA+J,CAAC,CAAC;YACtL,CAAC;YACD,MAAM,IAAA,2BAAc,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;KACF;IACD,MAAM,EAAE;QACN,IAAI,MAAM;YACR,OAAO,YAAY,CAAC;QACtB,CAAC;QACD,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,IAAI,GAA2B,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YAC5D,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAC5B,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;YAClC,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;YAC7B,IAAI,IAAI,KAAK,eAAe;gBAAE,OAAO,EAAE,CAAC;YACxC,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,iBAAQ,CAAC,2GAA2G,CAAC,CAAC;YAC1I,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC;YACpB,IAAI,IAAI,KAAK,eAAe,EAAE,CAAC;gBAC7B,MAAM,IAAI,GAAG,kDAAkD,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;gBAC/E,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC;YACpI,CAAC;;gBAAM,OAAO,IAAI,CAAC,WAAW,CAAC;YAC/B,OAAO,IAAI,CAAC;QACd,CAAC;KACF;IACD,IAAI,EAAE;QACJ,MAAM,EAAE,KAAK;QACb,MAAM,CAAC,CAAC,EAAE,CAAC;YACT,MAAM,MAAM,GAA2B,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YAC9D,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAC5B,IAAI,GAAG;gBAAE,MAAM,CAAC,QAAQ,GAAG,GAAG,CAAC;YAC/B,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;YACxC,IAAI,KAAK;gBAAE,MAAM,CAAC,WAAW,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;YAC7C,OAAO,MAAM,CAAC;QAChB,CAAC;KACF;IACD,OAAO,EAAE,KAAK;CACf,CAAC"}

package/dist/migrate/ping-identity/plugin.d.ts

@@ -0,0 +1,2 @@
+import type { MigrationPlugin } from '../framework/plugin';
+export declare const pingIdentityPlugin: MigrationPlugin;

package/dist/migrate/ping-identity/plugin.js

@@ -0,0 +1,100 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.pingIdentityPlugin = void 0;
+const pingone_1 = require("../export/pingone");
+const plugin_kit_1 = require("../export/plugin-kit");
+const translate_kit_1 = require("../export/translate-kit");
+const record_set_1 = require("../export/record-set");
+const pingone_2 = require("../export/pingone");
+/**
+ * `atlas migrate ping-identity` — a PingOne environment: password policy,
+ * social providers and SAML / OIDC connections as Atlas config; users, groups
+ * (roles) and enterprise connections through the management API with a worker
+ * application on this machine; the `ping_identity` bridge preset (PingOne
+ * access / ID tokens verified against the environment's keys) and lazy
+ * migration through PingOne's password check. PingFederate keeps users in your
+ * directory: export that as LDIF (`atlas migrate ldap`) and its SAML
+ * connections as metadata (`atlas migrate saml`).
+ */
+const ENVIRONMENT = { flag: 'pingone-environment-id', env: 'PINGONE_ENVIRONMENT_ID', label: 'your PingOne environment id', required: true };
+const CLIENT_ID = { flag: 'pingone-client-id', env: 'PINGONE_CLIENT_ID', label: 'a PingOne worker application client id', required: true };
+const CLIENT_SECRET = { flag: 'pingone-client-secret', env: 'PINGONE_CLIENT_SECRET', label: 'the worker application client secret', required: true, secret: true };
+const REGION = { flag: 'pingone-region', env: 'PINGONE_REGION', label: 'the PingOne region (com, eu, asia, ca, com.au)', required: false };
+const GROUPS = { flag: 'pingone-groups', env: 'PINGONE_GROUPS', label: 'read each user\'s group memberships (true by default; false for very large environments)', required: false };
+const region = (p) => (0, pingone_1.pingRegion)(p.credential(REGION));
+const creds = (p) => ({ environmentId: (0, plugin_kit_1.need)(p, ENVIRONMENT), clientId: (0, plugin_kit_1.need)(p, CLIENT_ID), clientSecret: (0, plugin_kit_1.need)(p, CLIENT_SECRET), region: region(p), fetchImpl: p.fetch });
+exports.pingIdentityPlugin = {
+    vendor: 'ping-identity',
+    source: 'ping_identity',
+    label: 'Ping Identity (PingOne, PingFederate)',
+    help: 'Move a PingOne environment: password policy and social providers as Atlas config, SAML / OIDC identity providers as SSO connections, users with their login, verified email, phones, state and population, groups as roles, a zero-logout bridge for PingOne tokens, and lazy migration for passwords (PingOne never exports hashes). Your worker application credentials stay on this machine. PingFederate: export your directory as LDIF (atlas migrate ldap) and its connection metadata (atlas migrate saml).',
+    config: {
+        reads: 'your PingOne environment (password policies, identity providers)',
+        credentials: [ENVIRONMENT, CLIENT_ID, CLIENT_SECRET, REGION],
+        async translate(p) {
+            const c = creds(p);
+            const { policies, idps } = await (0, plugin_kit_1.vendorStep)('PingOne', async () => {
+                const http = (0, pingone_1.pingOneHttp)(c, await (0, pingone_1.pingOneToken)(c));
+                const safe = async (path, key) => {
+                    try {
+                        return await (0, pingone_1.pingOneList)(http, path, key);
+                    }
+                    catch {
+                        return [];
+                    }
+                };
+                return { policies: await safe('/passwordPolicies', 'passwordPolicies'), idps: await safe('/identityProviders', 'identityProviders') };
+            });
+            const b = new translate_kit_1.ConfigBuilder();
+            b.set('strategies.password', true);
+            b.add('differs', 'authentication', 'password', 'PingOne never exports password hashes: the ping_identity lazy-migration preset checks each password against PingOne on first sign-in.', 'auth_config.strategies.password');
+            const policy = policies.find((x) => x.default === true) ?? policies[0];
+            if (policy) {
+                const min = Number((0, record_set_1.isObj)(policy.length) ? policy.length.min : 8);
+                b.set('passwordPolicy.minLength', Math.max(8, Number.isFinite(min) ? min : 8));
+                b.add(min < 8 ? 'differs' : 'mapped', `passwordPolicies ${(0, record_set_1.str)(policy.name) ?? ''}`.trim(), 'length.min', `${min}${min < 8 ? ' (Atlas requires at least 8; existing passwords still sign in)' : ''}.`, 'auth_config.passwordPolicy.minLength');
+                b.add('differs', `passwordPolicies ${(0, record_set_1.str)(policy.name) ?? ''}`.trim(), 'minCharacters / excludesCommonlyUsed', 'Atlas follows NIST 800-63B: length and breached-password checks, no character-class rules.', 'auth_config.passwordPolicy');
+            }
+            for (const idp of idps) {
+                const type = (0, record_set_1.str)(idp.type) ?? '';
+                const name = (0, record_set_1.str)(idp.name) ?? type;
+                if ((0, pingone_2.ssoConnectionOf)(idp)) {
+                    b.add('mapped', 'identityProviders', `${name} (${type})`, 'Enterprise IdP: moves with the data export as an Atlas SSO connection; update the IdP with Atlas\'s ACS URL / redirect URI, and replace PingOne routing with the connection\'s domains.', 'sso_connections');
+                }
+                else if ((0, translate_kit_1.socialKey)(type)) {
+                    b.socialProvider({ atlasKey: (0, translate_kit_1.socialKey)(type), vendorName: name, area: 'identityProviders', setting: `${name} (${type})`, clientId: (0, record_set_1.str)(idp.clientId) });
+                }
+                else
+                    b.add('manual', 'identityProviders', `${name} (${type})`, 'No Atlas counterpart for this provider type: add it as a custom OAuth provider.');
+            }
+            b.add('manual', 'authentication', 'sign-on policies / MFA policies / DaVinci flows', 'PingOne sign-on policies, MFA policies and DaVinci flows are not translated: set Atlas\'s MFA policy and sign-in methods in auth_config.');
+            return b.result(`PingOne environment ${c.environmentId}`, {
+                bridge: { preset: 'ping_identity', vars: { environment_id: c.environmentId, region: c.region } },
+                lazy: { preset: 'ping_identity', config: { environment_id: c.environmentId, region: c.region, client_id: c.clientId } },
+            });
+        },
+    },
+    export: {
+        reads: 'your PingOne environment through the management API (users, groups, identity providers)',
+        credentials: [ENVIRONMENT, CLIENT_ID, CLIENT_SECRET, REGION, GROUPS],
+        limits: [
+            'Password hashes are never exported by PingOne: passwords move by lazy migration (preset ping_identity).',
+            'TOTP secrets, FIDO2 credentials and mobile-app pairings cannot be exported: users enrol their second factor again.',
+            'PingFederate has no user store of its own: export your directory (LDIF) and the SAML connection metadata with atlas migrate ldap / saml.',
+        ],
+        async run(p, writer, resume) {
+            const set = await (0, plugin_kit_1.vendorStep)('PingOne', () => (0, pingone_1.exportPingOne)({ ...creds(p), groups: p.credential(GROUPS) !== 'false', onProgress: (m) => p.say(`  reading ${m}`) }));
+            await (0, plugin_kit_1.writeRecordSet)(set, writer, resume, p.say);
+        },
+    },
+    bridge: {
+        preset: 'ping_identity',
+        vars: (p, t) => ({ environment_id: (0, plugin_kit_1.need)(p, ENVIRONMENT), region: region(p), ...t?.bridge?.vars }),
+    },
+    lazy: {
+        preset: 'ping_identity',
+        config: (p, t) => ({ environment_id: (0, plugin_kit_1.need)(p, ENVIRONMENT), region: region(p), client_id: (0, plugin_kit_1.need)(p, CLIENT_ID), ...t?.lazy?.config }),
+        secret: CLIENT_SECRET,
+    },
+};
+//# sourceMappingURL=plugin.js.map

package/dist/migrate/ping-identity/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/migrate/ping-identity/plugin.ts"],"names":[],"mappings":";;;AAAA,+CAAsG;AACtG,qDAAwE;AACxE,2DAAmE;AACnE,qDAA4D;AAC5D,+CAAoD;AAGpD;;;;;;;;;GASG;AAEH,MAAM,WAAW,GAAmB,EAAE,IAAI,EAAE,wBAAwB,EAAE,GAAG,EAAE,wBAAwB,EAAE,KAAK,EAAE,6BAA6B,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AAC5J,MAAM,SAAS,GAAmB,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,mBAAmB,EAAE,KAAK,EAAE,wCAAwC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AAC3J,MAAM,aAAa,GAAmB,EAAE,IAAI,EAAE,uBAAuB,EAAE,GAAG,EAAE,uBAAuB,EAAE,KAAK,EAAE,sCAAsC,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACnL,MAAM,MAAM,GAAmB,EAAE,IAAI,EAAE,gBAAgB,EAAE,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,gDAAgD,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC3J,MAAM,MAAM,GAAmB,EAAE,IAAI,EAAE,gBAAgB,EAAE,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,0FAA0F,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAErM,MAAM,MAAM,GAAG,CAAC,CAAgB,EAAE,EAAE,CAAC,IAAA,oBAAU,EAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AACtE,MAAM,KAAK,GAAG,CAAC,CAAgB,EAAE,EAAE,CAAC,CAAC,EAAE,aAAa,EAAE,IAAA,iBAAI,EAAC,CAAC,EAAE,WAAW,CAAC,EAAE,QAAQ,EAAE,IAAA,iBAAI,EAAC,CAAC,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,IAAA,iBAAI,EAAC,CAAC,EAAE,aAAa,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;AAE5K,QAAA,kBAAkB,GAAoB;IACjD,MAAM,EAAE,eAAe;IACvB,MAAM,EAAE,eAAe;IACvB,KAAK,EAAE,uCAAuC;IAC9C,IAAI,EAAE,ofAAof;IAC1f,MAAM,EAAE;QACN,KAAK,EAAE,kEAAkE;QACzE,WAAW,EAAE,CAAC,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,CAAC;QAC5D,KAAK,CAAC,SAAS,CAAC,CAAC;YACf,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACnB,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,IAAA,uBAAU,EAAC,SAAS,EAAE,KAAK,IAAI,EAAE;gBAChE,MAAM,IAAI,GAAG,IAAA,qBAAW,EAAC,CAAC,EAAE,MAAM,IAAA,sBAAY,EAAC,CAAC,CAAC,CAAC,CAAC;gBACnD,MAAM,IAAI,GAAG,KAAK,EAAE,IAAY,EAAE,GAAW,EAAE,EAAE;oBAC/C,IAAI,CAAC;wBACH,OAAO,MAAM,IAAA,qBAAW,EAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;oBAC5C,CAAC;oBAAC,MAAM,CAAC;wBACP,OAAO,EAAW,CAAC;oBACrB,CAAC;gBACH,CAAC,CAAC;gBACF,OAAO,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC,mBAAmB,EAAE,kBAAkB,CAAC,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC,oBAAoB,EAAE,mBAAmB,CAAC,EAAE,CAAC;YACxI,CAAC,CAAC,CAAC;YACH,MAAM,CAAC,GAAG,IAAI,6BAAa,EAAE,CAAC;YAC9B,CAAC,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC;YACnC,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,gBAAgB,EAAE,UAAU,EAAE,uIAAuI,EAAE,iCAAiC,CAAC,CAAC;YAC3N,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC;YACvE,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,GAAG,GAAG,MAAM,CAAC,IAAA,kBAAK,EAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACjE,CAAC,CAAC,GAAG,CAAC,0BAA0B,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC/E,CAAC,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,oBAAoB,IAAA,gBAAG,EAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,YAAY,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,gEAAgE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,sCAAsC,CAAC,CAAC;gBAC9O,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,oBAAoB,IAAA,gBAAG,EAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,sCAAsC,EAAE,4FAA4F,EAAE,4BAA4B,CAAC,CAAC;YAC5O,CAAC;YACD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACjC,MAAM,IAAI,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;gBACnC,IAAI,IAAA,yBAAe,EAAC,GAAG,CAAC,EAAE,CAAC;oBACzB,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,mBAAmB,EAAE,GAAG,IAAI,KAAK,IAAI,GAAG,EAAE,yLAAyL,EAAE,iBAAiB,CAAC,CAAC;gBAC1Q,CAAC;qBAAM,IAAI,IAAA,yBAAS,EAAC,IAAI,CAAC,EAAE,CAAC;oBAC3B,CAAC,CAAC,cAAc,CAAC,EAAE,QAAQ,EAAE,IAAA,yBAAS,EAAC,IAAI,CAAE,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,GAAG,IAAI,KAAK,IAAI,GAAG,EAAE,QAAQ,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;gBAC3J,CAAC;;oBAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,mBAAmB,EAAE,GAAG,IAAI,KAAK,IAAI,GAAG,EAAE,iFAAiF,CAAC,CAAC;YACtJ,CAAC;YACD,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,EAAE,iDAAiD,EAAE,0IAA0I,CAAC,CAAC;YACjO,OAAO,CAAC,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC,aAAa,EAAE,EAAE;gBACxD,MAAM,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,EAAE,cAAc,EAAE,CAAC,CAAC,aAAa,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE;gBAChG,IAAI,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,EAAE,cAAc,EAAE,CAAC,CAAC,aAAa,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE;aACxH,CAAC,CAAC;QACL,CAAC;KACF;IACD,MAAM,EAAE;QACN,KAAK,EAAE,yFAAyF;QAChG,WAAW,EAAE,CAAC,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,CAAC;QACpE,MAAM,EAAE;YACN,yGAAyG;YACzG,oHAAoH;YACpH,0IAA0I;SAC3I;QACD,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM;YACzB,MAAM,GAAG,GAAG,MAAM,IAAA,uBAAU,EAAC,SAAS,EAAE,GAAG,EAAE,CAAC,IAAA,uBAAa,EAAC,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YACpK,MAAM,IAAA,2BAAc,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;KACF;IACD,MAAM,EAAE;QACN,MAAM,EAAE,eAAe;QACvB,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,cAAc,EAAE,IAAA,iBAAI,EAAC,CAAC,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;KAClG;IACD,IAAI,EAAE;QACJ,MAAM,EAAE,eAAe;QACvB,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,cAAc,EAAE,IAAA,iBAAI,EAAC,CAAC,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAA,iBAAI,EAAC,CAAC,EAAE,SAAS,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAClI,MAAM,EAAE,aAAa;KACtB;CACF,CAAC"}

package/dist/migrate/pocketbase/plugin.d.ts

@@ -0,0 +1,2 @@
+import type { MigrationPlugin } from '../framework/plugin';
+export declare const pocketbasePlugin: MigrationPlugin;

package/dist/migrate/pocketbase/plugin.js

@@ -0,0 +1,99 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.pocketbasePlugin = void 0;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const pocketbase_1 = require("../export/pocketbase");
+const pocketbase_config_1 = require("../export/pocketbase-config");
+const errors_1 = require("../../errors");
+const plugin_kit_1 = require("../export/plugin-kit");
+const project_files_1 = require("../export/project-files");
+/**
+ * `atlas migrate pocketbase` — a PocketBase app (v0.23+ and ≤0.22). The REST
+ * API never returns password hashes, so everything is read from the SQLite
+ * database on this machine: `pb_data/data.db` through Node's built-in SQLite
+ * (read-only), or a `sqlite3 -json` dump folder. Auth collection options
+ * become Atlas config; the `pocketbase` remote bridge asks PocketBase about a
+ * live token once (auth-refresh); lazy migration signs in against PocketBase
+ * for anyone left; and the `pocketbase` codemod rewrites the JS SDK calls.
+ */
+const DB = { flag: '--pocketbase-db', env: 'POCKETBASE_DB', label: 'pb_data/data.db (copy it with its -wal/-shm files, or stop the server)', required: false };
+const DUMP = { flag: '--pocketbase-dump', env: 'POCKETBASE_DUMP', label: 'a folder of sqlite3 -json table dumps (_collections, your auth collections, _externalAuths)', required: false };
+const SCHEMA = { flag: '--pocketbase-schema', env: 'POCKETBASE_SCHEMA', label: 'a collections export (Settings → Export collections, pb_schema.json)', required: false };
+const URL_SPEC = { flag: '--pocketbase-url', env: 'POCKETBASE_URL', label: 'the public PocketBase URL (https://pb.example.com)', required: false };
+const COLLECTIONS = { flag: '--pocketbase-collections', env: 'POCKETBASE_COLLECTIONS', label: 'auth collections to export, comma-separated (default: all but _superusers)', required: false };
+const SUPERUSERS = { flag: '--pocketbase-superusers', env: 'POCKETBASE_SUPERUSERS', label: 'true to export _superusers too', required: false };
+async function readTables(p) {
+    const dump = (0, project_files_1.projectDir)(p, DUMP);
+    if (dump)
+        return { tables: (0, pocketbase_1.readPocketBaseDump)(dump), origin: 'sqlite3 dump' };
+    const named = p.credential(DB);
+    const db = named ? (0, node_path_1.resolve)(named) : [(0, node_path_1.join)((0, node_path_1.resolve)(p.project), 'pb_data', 'data.db')].find((f) => (0, node_fs_1.existsSync)(f));
+    if (!db)
+        return undefined;
+    return { tables: await (0, pocketbase_1.readPocketBaseDb)(db), origin: 'pb_data/data.db' };
+}
+function url(p) {
+    return p.credential(URL_SPEC)?.trim().replace(/\/+$/, '');
+}
+exports.pocketbasePlugin = {
+    vendor: 'pocketbase',
+    source: 'pocketbase',
+    label: 'PocketBase',
+    help: 'Move a PocketBase app: auth collection options (password, OAuth2, OTP, MFA, token duration, rules) as Atlas config; every auth record with its bcrypt hash, verified email, username, custom fields and OAuth2 links, read from pb_data/data.db or a sqlite3 dump on this machine; a zero-logout bridge that asks PocketBase about each live token once; lazy migration for anyone left; and the code.',
+    config: {
+        reads: 'a collections export (pb_schema.json) or _collections in pb_data/data.db',
+        credentials: [SCHEMA, DB, DUMP, URL_SPEC],
+        async translate(p) {
+            const file = (0, project_files_1.projectFile)(p, SCHEMA, ['pb_schema.json']);
+            if (file)
+                return (0, plugin_kit_1.vendorStep)('PocketBase', async () => (0, pocketbase_config_1.translatePocketBaseConfig)({ collections: (0, pocketbase_config_1.parsePocketBaseSchema)(file.text), file, url: url(p) }));
+            const read = await (0, plugin_kit_1.vendorStep)('PocketBase', () => readTables(p));
+            if (!read)
+                throw new errors_1.CliError('PocketBase: pass a collections export (--set pocketbase-schema=pb_schema.json), the database (--set pocketbase-db=pb_data/data.db) or a dump folder (--set pocketbase-dump=<dir>).');
+            return (0, pocketbase_config_1.translatePocketBaseConfig)({ collections: read.tables.collections, url: url(p) });
+        },
+    },
+    export: {
+        reads: 'pb_data/data.db (read-only, built-in SQLite) or a sqlite3 -json dump folder',
+        credentials: [DB, DUMP, URL_SPEC, COLLECTIONS, SUPERUSERS],
+        limits: [
+            'The PocketBase API never returns password hashes or token keys: the export reads the SQLite database (or your dump of it) on this machine.',
+            'Auth tokens are signed per record and are not imported: the pocketbase bridge preset asks PocketBase (auth-refresh) about each live token once instead.',
+            'PocketBase MFA and OTP are one-time sign-in state, not enrolled factors: users enrol an Atlas second factor after the move.',
+            '≤0.22 admins (_admins) are not exported.',
+        ],
+        async run(p, writer, resume) {
+            const read = await (0, plugin_kit_1.vendorStep)('PocketBase', () => readTables(p));
+            if (!read)
+                throw new errors_1.CliError('PocketBase: no pb_data/data.db in this folder. Pass --set pocketbase-db=<path to data.db> or --set pocketbase-dump=<folder of sqlite3 -json dumps>.');
+            const collections = p.credential(COLLECTIONS)?.split(',').map((c) => c.trim()).filter(Boolean);
+            const set = (0, pocketbase_1.exportPocketBase)(read.tables, { collections, includeSuperusers: (0, project_files_1.truthyCredential)(p, SUPERUSERS), url: url(p), origin: read.origin });
+            await (0, plugin_kit_1.writeRecordSet)(set, writer, resume, p.say);
+        },
+    },
+    bridge: {
+        preset: 'pocketbase',
+        vars(p, t) {
+            const vars = { ...t?.bridge?.vars };
+            const u = url(p);
+            if (u)
+                vars.url = u;
+            vars.collection ??= 'users';
+            return vars;
+        },
+    },
+    lazy: {
+        preset: 'pocketbase',
+        config(p, t) {
+            const config = { ...t?.lazy?.config };
+            const u = url(p);
+            if (u)
+                config.url = u;
+            config.collection ??= 'users';
+            return config;
+        },
+    },
+    codemod: 'pocketbase',
+};
+//# sourceMappingURL=plugin.js.map

package/dist/migrate/pocketbase/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/migrate/pocketbase/plugin.ts"],"names":[],"mappings":";;;AAAA,qCAAqC;AACrC,yCAA0C;AAC1C,qDAAqH;AACrH,mEAA+F;AAC/F,yCAAwC;AAExC,qDAAkE;AAClE,2DAAoF;AAEpF;;;;;;;;GAQG;AAEH,MAAM,EAAE,GAAmB,EAAE,IAAI,EAAE,iBAAiB,EAAE,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,wEAAwE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC/K,MAAM,IAAI,GAAmB,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,iBAAiB,EAAE,KAAK,EAAE,6FAA6F,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC1M,MAAM,MAAM,GAAmB,EAAE,IAAI,EAAE,qBAAqB,EAAE,GAAG,EAAE,mBAAmB,EAAE,KAAK,EAAE,sEAAsE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACzL,MAAM,QAAQ,GAAmB,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,oDAAoD,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACnK,MAAM,WAAW,GAAmB,EAAE,IAAI,EAAE,0BAA0B,EAAE,GAAG,EAAE,wBAAwB,EAAE,KAAK,EAAE,4EAA4E,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC9M,MAAM,UAAU,GAAmB,EAAE,IAAI,EAAE,yBAAyB,EAAE,GAAG,EAAE,uBAAuB,EAAE,KAAK,EAAE,gCAAgC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAE/J,KAAK,UAAU,UAAU,CAAC,CAAgB;IACxC,MAAM,IAAI,GAAG,IAAA,0BAAU,EAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACjC,IAAI,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,IAAA,+BAAkB,EAAC,IAAI,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAC9E,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IAC/B,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,IAAA,mBAAO,EAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAA,gBAAI,EAAC,IAAA,mBAAO,EAAC,CAAC,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,oBAAU,EAAC,CAAC,CAAC,CAAC,CAAC;IAChH,IAAI,CAAC,EAAE;QAAE,OAAO,SAAS,CAAC;IAC1B,OAAO,EAAE,MAAM,EAAE,MAAM,IAAA,6BAAgB,EAAC,EAAE,CAAC,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;AAC3E,CAAC;AAED,SAAS,GAAG,CAAC,CAAgB;IAC3B,OAAO,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC5D,CAAC;AAEY,QAAA,gBAAgB,GAAoB;IAC/C,MAAM,EAAE,YAAY;IACpB,MAAM,EAAE,YAAY;IACpB,KAAK,EAAE,YAAY;IACnB,IAAI,EAAE,wYAAwY;IAC9Y,MAAM,EAAE;QACN,KAAK,EAAE,0EAA0E;QACjF,WAAW,EAAE,CAAC,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC;QACzC,KAAK,CAAC,SAAS,CAAC,CAAC;YACf,MAAM,IAAI,GAAG,IAAA,2BAAW,EAAC,CAAC,EAAE,MAAM,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC;YACxD,IAAI,IAAI;gBAAE,OAAO,IAAA,uBAAU,EAAC,YAAY,EAAE,KAAK,IAAI,EAAE,CAAC,IAAA,6CAAyB,EAAC,EAAE,WAAW,EAAE,IAAA,yCAAqB,EAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACvJ,MAAM,IAAI,GAAG,MAAM,IAAA,uBAAU,EAAC,YAAY,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;YACjE,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,iBAAQ,CAAC,oLAAoL,CAAC,CAAC;YACpN,OAAO,IAAA,6CAAyB,EAAC,EAAE,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC1F,CAAC;KACF;IACD,MAAM,EAAE;QACN,KAAK,EAAE,6EAA6E;QACpF,WAAW,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,CAAC;QAC1D,MAAM,EAAE;YACN,4IAA4I;YAC5I,yJAAyJ;YACzJ,6HAA6H;YAC7H,0CAA0C;SAC3C;QACD,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM;YACzB,MAAM,IAAI,GAAG,MAAM,IAAA,uBAAU,EAAC,YAAY,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;YACjE,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,iBAAQ,CAAC,qJAAqJ,CAAC,CAAC;YACrL,MAAM,WAAW,GAAG,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC/F,MAAM,GAAG,GAAG,IAAA,6BAAgB,EAAC,IAAI,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,iBAAiB,EAAE,IAAA,gCAAgB,EAAC,CAAC,EAAE,UAAU,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YACjJ,MAAM,IAAA,2BAAc,EAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;KACF;IACD,MAAM,EAAE;QACN,MAAM,EAAE,YAAY;QACpB,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,IAAI,GAA2B,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YAC5D,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;YACjB,IAAI,CAAC;gBAAE,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC;YACpB,IAAI,CAAC,UAAU,KAAK,OAAO,CAAC;YAC5B,OAAO,IAAI,CAAC;QACd,CAAC;KACF;IACD,IAAI,EAAE;QACJ,MAAM,EAAE,YAAY;QACpB,MAAM,CAAC,CAAC,EAAE,CAAC;YACT,MAAM,MAAM,GAA2B,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YAC9D,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;YACjB,IAAI,CAAC;gBAAE,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC;YACtB,MAAM,CAAC,UAAU,KAAK,OAAO,CAAC;YAC9B,OAAO,MAAM,CAAC;QAChB,CAAC;KACF;IACD,OAAO,EAAE,YAAY;CACtB,CAAC"}

package/dist/migrate/propelauth/plugin.d.ts

@@ -0,0 +1,2 @@
+import type { MigrationPlugin } from '../framework/plugin';
+export declare const propelauthPlugin: MigrationPlugin;