@atlasauth/cli 0.18.1 → 0.20.0

package/dist/commands/config.js

@@ -38,12 +38,15 @@ function pick(row, keys) {
     }
     return out;
 }
-/** The write body for a create/update: strip null/undefined so the API never sees them. */
-function compact(config) {
+/**
+ * The write body: strip null/undefined. On a PATCH (`keepNull`) an explicit file
+ * `null` is kept so it clears a nullable field; an absent key stays unmanaged.
+ */
+function compact(config, keepNull = false) {
     const out = {};
     if (config && typeof config === 'object' && !Array.isArray(config)) {
         for (const [k, v] of Object.entries(config)) {
-            if (v === null || v === undefined)
+            if (v === undefined || (v === null && !keepNull))
                 continue;
             out[k] = v;
         }
@@ -64,26 +67,83 @@ function enc(segment) {
  */
 function registry() {
     const specs = [
+        // 0. Email provider — first, because email sign-in strategies need one. Secrets
+        //    (api_key, …) are write-only: the live side shows "(secret set)", never a value.
+        {
+            kind: 'singleton',
+            type: 'email_provider',
+            async fetchLive(http) {
+                let p;
+                try {
+                    p = await http.get('/v1/messaging_providers/email');
+                }
+                catch (err) {
+                    if ((0, config_http_1.isNotFound)(err))
+                        return null;
+                    throw err;
+                }
+                if (!p || p.configured === false)
+                    return null;
+                const config = { ...obj((p.config ?? null)) };
+                const set = obj((p.secrets_set ?? null));
+                const names = Array.isArray(p.secrets_set) ? p.secrets_set : Object.keys(set).filter((k) => set[k] === true);
+                for (const k of names)
+                    config[k] = SECRET_SET;
+                return pick({ ...p, config }, ['transport', 'from_address', 'config']);
+            },
+            async apply(http, config) {
+                await http.put('/v1/messaging_providers/email', compact(withoutMarkers(config)));
+            },
+            normalize: (c) => redactSecrets(c, ['config']),
+        },
         // 1. Instance config (auth_config + allowed origins) — the §9.3 singleton.
         {
             kind: 'singleton',
             type: 'instance',
             async fetchLive(http) {
                 const inst = await http.get('/v1/instance');
-                return {
-                    allowed_origins: inst.allowed_origins ?? [],
-                    auth_config: inst.auth_config ?? {},
-                };
+                const hints = obj(inst.allowed_origin_integrations ?? null);
+                const origins = originStrings(inst.allowed_origins ?? []).map((o) => (hints[o] ? { origin: o, integration: hints[o] } : o));
+                return { allowed_origins: origins, auth_config: stripOriginIntegrations(inst.auth_config ?? {}) };
             },
             async apply(http, config) {
                 const c = compact(config);
-                // A file without allowed_origins leaves the live origins alone (a partial
-                // document, e.g. one produced by `atlas migrate better-auth config`).
-                const body = { auth_config: c.auth_config ?? {} };
-                if (c.allowed_origins !== undefined)
-                    body.allowed_origins = c.allowed_origins;
+                // Integration hints live in auth_config.originIntegrations server-side and a
+                // write replaces auth_config, so carry the live hints over for any origin the
+                // file names as a plain string (the plan ignores hints the file does not set).
+                const live = await http.get('/v1/instance');
+                const liveHints = obj(live.allowed_origin_integrations ?? null);
+                const authConfig = stripOriginIntegrations(c.auth_config ?? {});
+                const body = { auth_config: authConfig };
+                if (c.allowed_origins !== undefined) {
+                    // A file without allowed_origins leaves the live origins alone (a partial
+                    // document, e.g. one produced by `atlas migrate better-auth config`).
+                    body.allowed_origins = (Array.isArray(c.allowed_origins) ? c.allowed_origins : []).map((e) => typeof e === 'string' && liveHints[e] ? { origin: e, integration: liveHints[e] } : e);
+                }
+                else {
+                    const kept = obj(live.auth_config ?? null).originIntegrations;
+                    if (kept !== undefined)
+                        authConfig.originIntegrations = kept;
+                }
                 await http.patch('/v1/instance', body);
             },
+            normalize(c) {
+                const d = obj(c);
+                const hints = {};
+                for (const e of Array.isArray(d.allowed_origins) ? d.allowed_origins : []) {
+                    const o = obj(e);
+                    if (o.integration)
+                        hints[String(o.origin)] = o.integration;
+                }
+                const out = {};
+                if (d.allowed_origins !== undefined)
+                    out.allowed_origins = originStrings(d.allowed_origins);
+                if (Object.keys(hints).length)
+                    out.allowed_origin_integrations = hints;
+                if (d.auth_config !== undefined)
+                    out.auth_config = stripOriginIntegrations(d.auth_config);
+                return out;
+            },
         },
         // 2. Org settings schema (P1-5) — a singleton JSON Schema; 404 when unset.
         {
@@ -138,12 +198,52 @@ function registry() {
                 await http.post('/v1/oauth_clients', compact(config));
             },
             async update(http, live, config) {
-                await http.patch(`/v1/oauth_clients/${enc(live.id)}`, compact(config));
+                await http.patch(`/v1/oauth_clients/${enc(live.id)}`, compact(config, true));
             },
             async remove(http, live) {
                 await http.delete(`/v1/oauth_clients/${enc(live.id)}`);
             },
         },
+        // 4b. Hooks — after the clients. before_user_create: url, timeout_ms, fail_closed,
+        //     enabled; the signing secret is write-only ("(secret set)").
+        {
+            kind: 'singleton',
+            type: 'hooks',
+            async fetchLive(http) {
+                let h;
+                try {
+                    h = await http.get('/v1/instance/hooks/before_user_create');
+                }
+                catch (err) {
+                    if ((0, config_http_1.isNotFound)(err))
+                        return null;
+                    throw err;
+                }
+                if (!h || (h.url == null && h.enabled !== true))
+                    return null;
+                const bu = pick(h, ['url', 'timeout_ms', 'fail_closed', 'enabled']);
+                if (h.signing_secret_set === true)
+                    bu.signing_secret = SECRET_SET;
+                return { before_user_create: bu };
+            },
+            async apply(http, config, opts) {
+                const bu = compact(obj(withoutMarkers(config)).before_user_create ?? {}, true);
+                if (Object.keys(bu).length === 0)
+                    return;
+                try {
+                    await http.patch(`/v1/instance/hooks/before_user_create${opts.forceHook ? '?force=true' : ''}`, bu);
+                }
+                catch (err) {
+                    const refused = err instanceof backend_1.AtlasApiError && err.status === 409 ? err.errors.find((e) => e.code === 'HOOK_TEST_FAILED') : undefined;
+                    if (refused) {
+                        throw new errors_1.CliError(`hooks.before_user_create: the change was refused because the hook test call failed (HOOK_TEST_FAILED): ${refused.message} ` +
+                            'The hook was left as it was. Deploy the route, or pass --force-hook to apply it anyway.');
+                    }
+                    throw err;
+                }
+            },
+            normalize: (c) => redactSecrets(c, ['before_user_create']),
+        },
         // 5. Social / enterprise OAuth providers — key = the catalog provider slug.
         {
             kind: 'collection',
@@ -182,7 +282,7 @@ function registry() {
                 await http.post('/v1/custom_oauth_providers', compact(config));
             },
             async update(http, live, config) {
-                const body = compact(config);
+                const body = compact(config, true);
                 delete body.provider_key; // immutable
                 await http.patch(`/v1/custom_oauth_providers/${enc(live.id)}`, body);
             },
@@ -209,7 +309,7 @@ function registry() {
                 await http.post('/v1/resource_servers', body);
             },
             async update(http, live, config) {
-                const body = compact(config);
+                const body = compact(config, true);
                 delete body.identifier; // immutable
                 delete body.signing_alg; // read-only
                 await http.patch(`/v1/resource_servers/${enc(live.id)}`, body);
@@ -314,10 +414,12 @@ function registry() {
                 await http.post('/v1/webhook_endpoints', {
                     url: c.url,
                     enabled_events: c.enabled_events ?? [],
+                    // Sent on create so a paused endpoint is never live, even briefly.
+                    ...(typeof c.active === 'boolean' ? { active: c.active } : {}),
                 });
             },
             async update(http, live, config) {
-                await http.patch(`/v1/webhook_endpoints/${enc(live.id)}`, compact(config));
+                await http.patch(`/v1/webhook_endpoints/${enc(live.id)}`, compact(config, true));
             },
             async remove(http, live) {
                 await http.delete(`/v1/webhook_endpoints/${enc(live.id)}`);
@@ -339,7 +441,7 @@ function registry() {
                 await http.post('/v1/sso_connections', compact(config));
             },
             async update(http, live, config) {
-                const body = compact(config);
+                const body = compact(config, true);
                 delete body.type; // fixed at creation; PATCH does not take it
                 await http.patch(`/v1/sso_connections/${enc(live.id)}`, body);
             },
@@ -347,6 +449,37 @@ function registry() {
                 await http.delete(`/v1/sso_connections/${enc(live.id)}`);
             },
         },
+        // 10b. SSO onboarding profiles (hosted setup links) — key = name. After the SSO
+        //      connections; a profile may name an organization that already exists.
+        {
+            kind: 'collection',
+            type: 'sso_onboarding_profiles',
+            keyOf: (c) => String(obj(c).name ?? ''),
+            async fetchLive(http) {
+                let rows;
+                try {
+                    rows = await listData(http, '/v1/sso_onboarding_profiles');
+                }
+                catch (err) {
+                    if ((0, config_http_1.isNotFound)(err))
+                        return [];
+                    throw err;
+                }
+                return rows.map((r) => {
+                    const config = pick(r, SSO_PROFILE_KEYS);
+                    return { key: String(r.name ?? ''), id: String(r.id ?? ''), config };
+                });
+            },
+            async create(http, config) {
+                await http.post('/v1/sso_onboarding_profiles', compact(config));
+            },
+            async update(http, live, config) {
+                await http.patch(`/v1/sso_onboarding_profiles/${enc(live.id)}`, compact(config, true));
+            },
+            async remove(http, live) {
+                await http.delete(`/v1/sso_onboarding_profiles/${enc(live.id)}`);
+            },
+        },
         // 11. Billing plans — key = slug.
         {
             kind: 'collection',
@@ -364,7 +497,7 @@ function registry() {
                 await http.post('/v1/billing/plans', compact(config));
             },
             async update(http, live, config) {
-                const body = compact(config);
+                const body = compact(config, true);
                 delete body.slug; // immutable
                 await http.patch(`/v1/billing/plans/${enc(live.id)}`, body);
             },
@@ -389,7 +522,7 @@ function registry() {
                 await http.post('/v1/notification_templates', compact(config));
             },
             async update(http, live, config) {
-                const body = compact(config);
+                const body = compact(config, true);
                 delete body.name; // the name is the URL key
                 await http.put(`/v1/notification_templates/${enc(live.id)}`, body);
             },
@@ -451,6 +584,55 @@ function registry() {
             // No delete: pruning a policy would silently loosen an org's security, so
             // org policies are never deleted by import (reported as skipped).
         },
+        // 12. Branding — the hosted-page appearance; a partial merge on write (PATCH).
+        {
+            kind: 'singleton',
+            type: 'branding',
+            async fetchLive(http) {
+                let b;
+                try {
+                    b = await http.get('/v1/branding');
+                }
+                catch (err) {
+                    if ((0, config_http_1.isNotFound)(err))
+                        return null;
+                    throw err;
+                }
+                const { object: _o, resolved: _r, ...fields } = b ?? {};
+                const out = compact(fields);
+                return Object.keys(out).length ? out : null;
+            },
+            async apply(http, config) {
+                await http.patch('/v1/branding', compact(config, true));
+            },
+        },
+        // 13. Cookie-consent banner — last: it only needs the instance. PUT replaces the
+        //     whole setting and needs script_url, so apply merges the file over the live one.
+        {
+            kind: 'singleton',
+            type: 'cookie_consent',
+            async fetchLive(http) {
+                let cc;
+                try {
+                    cc = await http.get('/v1/instance/cookie_consent');
+                }
+                catch (err) {
+                    if ((0, config_http_1.isNotFound)(err))
+                        return null;
+                    throw err;
+                }
+                const out = pick(cc ?? {}, COOKIE_CONSENT_KEYS);
+                return Object.keys(out).length ? out : null;
+            },
+            async apply(http, config) {
+                const live = await http.get('/v1/instance/cookie_consent');
+                const body = { ...pick(live ?? {}, COOKIE_CONSENT_KEYS), ...compact(config, true) };
+                if (body.script_url === undefined || body.script_url === null) {
+                    throw new errors_1.CliError('cookie_consent needs a script_url (the consent manager script) when none is set on the instance.');
+                }
+                await http.put('/v1/instance/cookie_consent', body);
+            },
+        },
     ];
     return specs;
 }
@@ -462,6 +644,22 @@ const OAUTH_CLIENT_KEYS = [
     'token_endpoint_auth_method',
     'logo_url',
     'first_party',
+    'post_logout_redirect_uris',
+    'claims_redirect_uris',
+    'backchannel_logout_uri',
+    'backchannel_logout_session_required',
+    'frontchannel_logout_uri',
+    'frontchannel_logout_session_required',
+    'skip_logout_confirmation',
+    'refresh_touches_session',
+    'require_verified_email',
+    'require_pkce',
+    'login_url',
+    'consent_url',
+    'subject_type',
+    'sector_identifier_uri',
+    'access_token_format',
+    'token_lifetimes',
 ];
 const OAUTH_PROVIDER_KEYS = [
     'provider',
@@ -521,6 +719,8 @@ const SSO_KEYS = [
     'claim_role_mappings',
     'default_role_id',
 ];
+const SSO_PROFILE_KEYS = ['name', 'allowed_connection_types', 'organization_id', 'company_name', 'allow_scim', 'intents', 'return_url'];
+const COOKIE_CONSENT_KEYS = ['enabled', 'script_url', 'script_id', 'site_id', 'blocking_mode', 'extra_origins', 'settings_link', 'culture', 'host_aliases'];
 const BILLING_KEYS = [
     'name',
     'slug',
@@ -557,6 +757,40 @@ function obj(config) {
         ? config
         : {};
 }
+/** What a write-only secret looks like on the live side, and in a plan. */
+const SECRET_SET = '(secret set)';
+const SECRET_KEY = /(secret|token|password|passwd|api_?key|private_?key)/i;
+/**
+ * Show each secret value under `groups` as "(secret set)" so a plan never echoes it
+ * and compares equal to the live "(secret set)". An unresolved \${VAR} stays visible
+ * (apply refuses it), as does an empty value.
+ */
+function redactSecrets(config, groups) {
+    const out = { ...obj(config) };
+    const mask = (g) => Object.fromEntries(Object.entries(g).map(([k, v]) => [k, SECRET_KEY.test(k) && typeof v === 'string' && v !== '' && !/^\$\{[A-Z0-9_]+\}$/.test(v) ? SECRET_SET : v]));
+    for (const g of groups)
+        if (out[g] && typeof out[g] === 'object' && !Array.isArray(out[g]))
+            out[g] = mask(obj(out[g]));
+    return out;
+}
+/** A document without any "(secret set)" marker: what an export writes and what apply sends. */
+function withoutMarkers(value) {
+    if (Array.isArray(value))
+        return value.map(withoutMarkers);
+    if (value && typeof value === 'object') {
+        return Object.fromEntries(Object.entries(value).filter(([, v]) => v !== SECRET_SET).map(([k, v]) => [k, withoutMarkers(v)]));
+    }
+    return value;
+}
+/** An origin list in either form (strings, or { origin, integration }) as plain strings. */
+function originStrings(list) {
+    return (Array.isArray(list) ? list : []).map((e) => (typeof e === 'string' ? e : String(obj(e).origin ?? '')));
+}
+/** auth_config without the integration hints, which belong to allowed_origins. */
+function stripOriginIntegrations(authConfig) {
+    const { originIntegrations: _hints, ...rest } = obj(authConfig);
+    return rest;
+}
 /** A stable natural key for an SSO connection, which has no name field. */
 function ssoKey(config) {
     const c = obj(config);
@@ -664,7 +898,7 @@ async function writeExport(http, dir, format) {
             const live = await spec.fetchLive(http);
             if (live === null)
                 continue; // nothing to write (e.g. no schema registered)
-            (0, node_fs_1.writeFileSync)((0, node_path_1.join)(dir, `${spec.type}.${ext}`), (0, serialize_1.serialize)(live, format));
+            (0, node_fs_1.writeFileSync)((0, node_path_1.join)(dir, `${spec.type}.${ext}`), (0, serialize_1.serialize)(withoutMarkers(live), format));
             fileCount += 1;
         }
         else {
@@ -694,6 +928,7 @@ async function exportConfig(ctx, values) {
  */
 async function planConfigImport(http, opts) {
     const { dir, format, env, prune } = opts;
+    const applyOpts = { forceHook: opts.forceHook === true };
     const ext = format === 'json' ? 'json' : 'yaml';
     if (!(0, node_fs_1.existsSync)(dir)) {
         throw new errors_1.CliError(`Config directory not found: ${dir}. Run 'atlas config export' first.`);
@@ -711,12 +946,20 @@ async function planConfigImport(http, opts) {
         const parsed = interpolate((0, serialize_1.deserialize)(text, format), env);
         if (spec.kind === 'singleton') {
             const desired = parsed;
-            const live = await spec.fetchLive(http);
-            if (live !== null && (0, serialize_1.deepEqual)(desired, live)) {
+            const liveRaw = await spec.fetchLive(http);
+            const norm = spec.normalize ?? ((c) => c);
+            const desiredN = norm(desired);
+            // A section that only clears fields (all null) against nothing live is already satisfied.
+            if (liveRaw === null && onlyNulls(desiredN)) {
+                unchanged += 1;
+                continue;
+            }
+            const live = liveRaw === null ? null : comparable(norm(liveRaw), desiredN, prune);
+            if (live !== null && (0, serialize_1.deepEqual)(desiredN, live)) {
                 unchanged += 1;
                 continue;
             }
-            changes.push({ type: spec.type, action: live === null ? 'create' : 'update', key: '', ...(live === null ? {} : { before: live }), after: desired, apply: () => spec.apply(http, desired) });
+            changes.push({ type: spec.type, action: live === null ? 'create' : 'update', key: '', ...(live === null ? {} : { before: live }), after: desiredN, apply: () => spec.apply(http, desired, applyOpts) });
             continue;
         }
         // Collection: diff desired-by-key against live-by-key.
@@ -731,12 +974,12 @@ async function planConfigImport(http, opts) {
             if (!existing) {
                 changes.push({ type: spec.type, action: 'create', key, after: cfg, apply: () => spec.create(http, cfg) });
             }
-            else if (!(0, serialize_1.deepEqual)(cfg, existing.config)) {
+            else if (!(0, serialize_1.deepEqual)(cfg, comparable(existing.config, cfg, prune))) {
                 if (!spec.update) {
                     throw new errors_1.CliError(`${spec.type} '${key}' changed but is immutable; recreate it instead.`);
                 }
                 const upd = spec.update;
-                changes.push({ type: spec.type, action: 'update', key, before: existing.config, after: cfg, apply: () => upd(http, existing, cfg) });
+                changes.push({ type: spec.type, action: 'update', key, before: comparable(existing.config, cfg, prune), after: cfg, apply: () => upd(http, existing, cfg) });
             }
             else {
                 unchanged += 1;
@@ -761,6 +1004,39 @@ async function planConfigImport(http, opts) {
     }
     return { changes, unchanged, skippedDeletes };
 }
+/** True for a non-empty object whose every leaf is `null` (a file that only clears fields). */
+function onlyNulls(x) {
+    if (x === null)
+        return true;
+    if (typeof x !== 'object' || Array.isArray(x) || x === undefined)
+        return false;
+    const vals = Object.values(x);
+    return vals.length > 0 && vals.every(onlyNulls);
+}
+/**
+ * The live document as the plan compares it. With `--prune` the whole live
+ * document (keys the file leaves unset show as drift). Without it only the keys
+ * the file sets, recursively, so a freshly applied file plans clean. A desired
+ * `null` means "unset", so it matches a live key that is absent.
+ */
+function comparable(live, desired, prune) {
+    if (prune)
+        return live;
+    const isObj = (x) => x !== null && typeof x === 'object' && !Array.isArray(x);
+    if (!isObj(live) || !isObj(desired))
+        return live;
+    const out = {};
+    for (const k of Object.keys(desired)) {
+        const l = live[k];
+        if (l === undefined || l === null) {
+            if (desired[k] === null)
+                out[k] = null;
+            continue;
+        }
+        out[k] = comparable(l, desired[k], false);
+    }
+    return out;
+}
 /** The stored credential of a named profile (one profile per environment). */
 function profileHttp(ctx, name) {
     const stored = ctx.config.load().profiles[name];
@@ -823,7 +1099,7 @@ async function importConfig(ctx, values) {
     const format = resolveFormat(values);
     const dryRun = values['dry-run'] === true;
     const prune = values.prune === true;
-    const plan = await planConfigImport(http, { dir, format, env: readSecretsEnv(ctx, values), prune });
+    const plan = await planConfigImport(http, { dir, format, env: readSecretsEnv(ctx, values), prune, forceHook: values['force-hook'] === true });
     printPlan(ctx, plan.changes, plan.unchanged, plan.skippedDeletes, { dryRun, prune });
     if (dryRun)
         return 0;
@@ -858,6 +1134,7 @@ const show = (v) => (v === undefined ? '(unset)' : typeof v === 'string' ? JSON.
 async function planConfig(ctx, values, source) {
     const http = requireHttp(ctx, values);
     const { dir, format, env } = source;
+    const where = source.label ?? dir;
     const prune = values.prune === true;
     const plan = await planConfigImport(http, { dir, format, env, prune });
     const deletes = prune ? [] : plan.skippedDeletes;
@@ -892,12 +1169,12 @@ async function planConfig(ctx, values, source) {
         }
         if (deletes.length) {
             ctx.io.out('');
-            ctx.io.out(`Live but not in ${dir} (kept; pass --prune to plan their deletion):`);
+            ctx.io.out(`Live but not in ${where} (kept; pass --prune to plan their deletion):`);
             for (const d of deletes)
                 ctx.io.out(`    ${d.type}${d.key ? ` ${d.key}` : ''}`);
         }
         if (pending === 0)
-            ctx.io.out('No drift: the instance matches the config directory.');
+            ctx.io.out(`No drift: the instance matches ${where}.`);
     }
     return wantsCheck(values) && pending > 0 ? 2 : 0;
 }
@@ -955,7 +1232,7 @@ function resolveSource(ctx, args) {
         throw new errors_1.CliError(`Config not found: ${path}. Pass a config file (atlas.yaml / atlas.json) or a directory from 'atlas config export'.`);
     }
     if (!isFile)
-        return { dir: path, format: resolveFormat(args.values), env, cleanup: () => undefined };
+        return { dir: path, label: path, format: resolveFormat(args.values), env, cleanup: () => undefined };
     const ext = (0, node_path_1.extname)(path).toLowerCase();
     const format = ext === '.yaml' || ext === '.yml' ? 'yaml' : ext === '.json' ? 'json' : resolveFormat(args.values);
     const doc = (0, serialize_1.deserialize)(ctx.readFile(path), format);
@@ -970,7 +1247,7 @@ function resolveSource(ctx, args) {
     const dir = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'atlas-apply-'));
     for (const [type, value] of Object.entries(doc))
         (0, node_fs_1.writeFileSync)((0, node_path_1.join)(dir, `${type}.json`), (0, serialize_1.serialize)(value, 'json'));
-    return { dir, format: 'json', env, cleanup: () => (0, node_fs_1.rmSync)(dir, { recursive: true, force: true }) };
+    return { dir, label: path, format: 'json', env, cleanup: () => (0, node_fs_1.rmSync)(dir, { recursive: true, force: true }) };
 }
 /**
  * `atlas plan [<file|dir>]`: the read-only diff of `atlas config plan`, taking
@@ -1000,7 +1277,7 @@ async function applyCommand(ctx, args) {
     try {
         const kept = keepingSecrets(requireHttp(ctx, values), (0, args_1.str)(values, 'out') || (0, secrets_1.productDir)(ctx.env, 'atlas'));
         const prune = values.prune === true;
-        const plan = await planConfigImport(kept.http, { dir: source.dir, format: source.format, env: source.env, prune });
+        const plan = await planConfigImport(kept.http, { dir: source.dir, format: source.format, env: source.env, prune, forceHook: values['force-hook'] === true });
         printPlan(ctx, plan.changes, plan.unchanged, plan.skippedDeletes, { dryRun: false, prune });
         if (plan.changes.length === 0) {
             ctx.io.out('No changes to apply.');