@auth-gate/rbac 0.8.0

package/dist/cli.d.cts

@@ -0,0 +1 @@
+#!/usr/bin/env node

package/dist/cli.d.ts

@@ -0,0 +1 @@
+#!/usr/bin/env node

package/dist/cli.mjs

@@ -0,0 +1,217 @@
+#!/usr/bin/env node
+import {
+  RbacSyncClient,
+  __spreadValues,
+  computeRbacDiff,
+  formatRbacDiff,
+  loadRbacConfig
+} from "./chunk-HE57TIQI.mjs";
+
+// src/cli.ts
+import chalk from "chalk";
+import { writeFileSync, existsSync } from "fs";
+import { resolve } from "path";
+var HELP = `
+Usage: @auth-gate/rbac <command> [options]
+
+Commands:
+  sync          Preview or apply RBAC config changes
+  init          Create a starter authgate.rbac.ts config file
+  check         Validate config locally (no server round-trip)
+
+Options (sync):
+  --apply       Apply changes (default: dry-run only)
+  --force       Allow archiving roles with assigned members
+  --strict      Treat warnings as errors (recommended for CI/CD)
+  --json        Output diff as JSON
+
+Environment:
+  AUTHGATE_API_KEY    Your project API key (required for sync)
+  AUTHGATE_BASE_URL   AuthGate instance URL (required for sync)
+`;
+async function main() {
+  const args = process.argv.slice(2);
+  const command = args[0];
+  if (!command || command === "--help" || command === "-h") {
+    console.log(HELP);
+    process.exit(0);
+  }
+  if (command === "init") {
+    await runInit();
+    return;
+  }
+  if (command === "check") {
+    await runCheck();
+    return;
+  }
+  if (command === "sync") {
+    const apply = args.includes("--apply");
+    const force = args.includes("--force");
+    const strict = args.includes("--strict");
+    const json = args.includes("--json");
+    await runSync({ apply, force, strict, json });
+    return;
+  }
+  console.error(chalk.red(`Unknown command: ${command}`));
+  console.log(HELP);
+  process.exit(1);
+}
+async function runInit() {
+  const configPath = resolve(process.cwd(), "authgate.rbac.ts");
+  if (existsSync(configPath)) {
+    console.error(chalk.yellow(`Config file already exists: ${configPath}`));
+    process.exit(1);
+  }
+  const template = `import { defineRbac } from "@auth-gate/rbac";
+
+/**
+ * RBAC config \u2014 resource/role/permission keys provide full IDE autocomplete.
+ *
+ * Sync: npx @auth-gate/rbac sync --apply
+ */
+export const rbac = defineRbac({
+  resources: {
+    documents: { actions: ["read", "write", "delete", "share"] },
+    billing:   { actions: ["read", "manage"] },
+    members:   { actions: ["invite", "remove", "update_role"] },
+  },
+  roles: {
+    admin: {
+      name: "Administrator",
+      grants: {
+        documents: { read: true, write: true, delete: true, share: true },
+        billing:   { read: true, manage: true },
+        members:   { invite: true, remove: true, update_role: true },
+      },
+    },
+    editor: {
+      name: "Editor",
+      grants: {
+        documents: { read: true, write: true },
+        billing:   { read: true },
+      },
+    },
+    viewer: {
+      name: "Viewer",
+      grants: {
+        documents: { read: true },
+      },
+    },
+  },
+});
+
+// Default export for CLI compatibility
+export default rbac;
+`;
+  writeFileSync(configPath, template, "utf-8");
+  console.log(chalk.green(`Created ${configPath}`));
+  console.log(chalk.dim("Edit your resources and roles, then run: npx @auth-gate/rbac sync"));
+}
+async function runCheck() {
+  let config;
+  try {
+    config = await loadRbacConfig(process.cwd());
+  } catch (err) {
+    console.error(chalk.red(`Config error: ${err.message}`));
+    process.exit(1);
+  }
+  const resourceCount = Object.keys(config.resources).length;
+  const roleCount = Object.keys(config.roles).length;
+  let permCount = 0;
+  for (const resource of Object.values(config.resources)) {
+    permCount += resource.actions.length;
+  }
+  console.log(chalk.green("Config valid!"));
+  console.log(chalk.dim(`${resourceCount} resource${resourceCount > 1 ? "s" : ""}, ${roleCount} role${roleCount > 1 ? "s" : ""}, ${permCount} permission${permCount > 1 ? "s" : ""}`));
+}
+async function runSync(opts) {
+  const apiKey = process.env.AUTHGATE_API_KEY;
+  const baseUrl = process.env.AUTHGATE_BASE_URL;
+  if (!apiKey) {
+    console.error(chalk.red("Missing AUTHGATE_API_KEY environment variable."));
+    process.exit(1);
+  }
+  if (!baseUrl) {
+    console.error(chalk.red("Missing AUTHGATE_BASE_URL environment variable."));
+    process.exit(1);
+  }
+  let config;
+  try {
+    config = await loadRbacConfig(process.cwd());
+  } catch (err) {
+    console.error(chalk.red(`Config error: ${err.message}`));
+    process.exit(1);
+  }
+  const resourceCount = Object.keys(config.resources).length;
+  const roleCount = Object.keys(config.roles).length;
+  console.log(chalk.dim(`Loaded config: ${resourceCount} resource${resourceCount > 1 ? "s" : ""}, ${roleCount} role${roleCount > 1 ? "s" : ""}`));
+  const client = new RbacSyncClient({ baseUrl, apiKey });
+  let serverState;
+  let memberCounts;
+  try {
+    [serverState, memberCounts] = await Promise.all([
+      client.getState(),
+      client.getMemberCounts()
+    ]);
+  } catch (err) {
+    console.error(chalk.red(`Failed to fetch server state: ${err.message}`));
+    process.exit(1);
+  }
+  const diff = computeRbacDiff(config, serverState, memberCounts);
+  if (opts.json) {
+    console.log(JSON.stringify({
+      dryRun: !opts.apply,
+      resourceOps: diff.resourceOps.map((op) => ({ type: op.type, key: op.key })),
+      roleOps: diff.roleOps.map((op) => __spreadValues(__spreadValues({
+        type: op.type,
+        key: op.key
+      }, op.type === "rename" ? { oldKey: op.oldKey } : {}), op.type === "archive" ? { assignedMembers: op.assignedMembers } : {})),
+      conditionOps: diff.conditionOps.map((op) => ({ type: op.type, key: op.key })),
+      hasDestructive: diff.hasDestructive
+    }, null, 2));
+    process.exit(diff.hasDestructive && opts.strict ? 1 : 0);
+  }
+  console.log("");
+  console.log(formatRbacDiff(diff, !opts.apply));
+  if (!opts.apply) {
+    if (opts.strict && diff.hasDestructive) {
+      console.error(chalk.red.bold("\n  --strict: destructive changes detected. Failing."));
+      process.exit(1);
+    }
+    process.exit(0);
+  }
+  if (diff.hasDestructive && !opts.force) {
+    console.error(chalk.red("\nDestructive changes require --force flag."));
+    process.exit(1);
+  }
+  const totalOps = diff.resourceOps.length + diff.roleOps.length + diff.conditionOps.length;
+  if (totalOps === 0) {
+    process.exit(0);
+  }
+  try {
+    console.log("");
+    const result = await client.apply(config, opts.force);
+    console.log(chalk.green.bold("Sync complete!"));
+    if (result.created.length) console.log(chalk.green(`  Created: ${result.created.join(", ")}`));
+    if (result.updated.length) console.log(chalk.yellow(`  Updated: ${result.updated.join(", ")}`));
+    if (result.renamed.length) console.log(chalk.cyan(`  Renamed: ${result.renamed.join(", ")}`));
+    if (result.archived.length) console.log(chalk.red(`  Archived: ${result.archived.join(", ")}`));
+    if (result.warnings.length) {
+      for (const w of result.warnings) {
+        console.log(chalk.yellow(`  Warning: ${w}`));
+      }
+      if (opts.strict) {
+        console.error(chalk.red.bold(`
+  --strict: ${result.warnings.length} warning${result.warnings.length > 1 ? "s" : ""} treated as errors.`));
+        process.exit(1);
+      }
+    }
+  } catch (err) {
+    console.error(chalk.red(`Sync failed: ${err.message}`));
+    process.exit(1);
+  }
+}
+main().catch((err) => {
+  console.error(chalk.red(err.message));
+  process.exit(1);
+});