@baseworks/iam 1.2.0 → 1.3.0

package/dist/cli.js

@@ -17,21 +17,10 @@ function buildIamCommand(deps) {
       ["id", user.id]
     ]);
   });
-  const users = iam.command("users").description("user directory");
-  users.command("find <email>").description("resolve a user id by exact email (for invites)").action(async (email) => {
-    const { user } = await http.get(
-      `/users/lookup?email=${encodeURIComponent(email)}`
-    ).catch(die);
-    kv([
-      ["id", user.id],
-      ["email", user.email],
-      ["name", user.name ?? "\u2014"]
-    ]);
-  });
   const token = iam.command("token").description("api tokens (service / cli / agent credentials)");
   outputOpt(token.command("list")).description("active tokens you can see").action(async (opts) => {
     const { tokens } = await http.get(
-      "/v1/tokens"
+      "/tokens"
     ).catch(die);
     printOutput(
       tokens,
@@ -45,7 +34,7 @@ function buildIamCommand(deps) {
     );
   });
   token.command("issue <name>").description("issue a token; the secret is printed once").option("--type <type>", "user | service | cli | agent", "service").option("--org <id>", "bind to an organization (opaque context)").option("--scope <scope...>", "grant scopes").action(async (name, opts) => {
-    const res = await http.post("/v1/tokens", {
+    const res = await http.post("/tokens", {
       name,
       type: opts.type,
       org_id: opts.org ?? null,
@@ -58,7 +47,7 @@ function buildIamCommand(deps) {
     ]);
   });
   token.command("revoke <id>").description("revoke a token by id").action(async (id) => {
-    await http.del(`/v1/tokens/${encodeURIComponent(id)}`).catch(die);
+    await http.del(`/tokens/${encodeURIComponent(id)}`).catch(die);
     success(`token revoked: ${id}`);
   });
   return iam;

package/dist/events.d.ts

@@ -25,17 +25,17 @@ declare const UserEvents: _baseworks_foldbase.EventCatalog<{
         picture: z.ZodNullable<z.ZodString>;
         at: z.ZodNumber;
     }, "strip", z.ZodTypeAny, {
-        email: string;
         at: number;
         subject: string;
         issuer: string;
+        email: string;
         name: string | null;
         picture: string | null;
     }, {
-        email: string;
         at: number;
         subject: string;
         issuer: string;
+        email: string;
         name: string | null;
         picture: string | null;
     }>;
@@ -45,13 +45,13 @@ declare const UserEvents: _baseworks_foldbase.EventCatalog<{
         picture: z.ZodNullable<z.ZodString>;
         at: z.ZodNumber;
     }, "strip", z.ZodTypeAny, {
-        email: string;
         at: number;
+        email: string;
         name: string | null;
         picture: string | null;
     }, {
-        email: string;
         at: number;
+        email: string;
         name: string | null;
         picture: string | null;
     }>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@baseworks/iam",
-  "version": "1.2.0",
+  "version": "1.3.0",
   "description": "IAM capability: identity (users) + credentials (api tokens). Typed HTTP client, foldbase event catalog, projections, and CLI plugin for iam-service. Contract-first, versioned with the service. Roles/PDP live in @baseworks/org.",
   "type": "module",
   "publishConfig": {

package/src/__tests__/cli.test.ts

@@ -27,15 +27,12 @@ describe('flect iam whoami', () => {
   })
 })
 
-// ── users find ────────────────────────────────────────────────────────────────
+// ── no users find ─────────────────────────────────────────────────────────────
 
-describe('flect iam users find', () => {
-  it('resolves a user id by email', async () => {
-    mocks.mockGet('/users/lookup', { user: USER })
+describe('flect iam users', () => {
+  it('is gone: looking a person up by email is for services, not for a CLI', async () => {
     const r = await run(['iam', 'users', 'find', 'ali@acme.test'])
-    expect(r.exitCode).toBe(0)
-    expect(r.stdout).toContain(USER.id)
-    expect(r.stdout).toContain('ali@acme.test')
+    expect(r.stdout + r.stderr).toMatch(/unknown command/)
   })
 })
 
@@ -43,7 +40,7 @@ describe('flect iam users find', () => {
 
 describe('flect iam token', () => {
   it('list renders NAME / TYPE / PREFIX columns', async () => {
-    mocks.mockGet('/v1/tokens', {
+    mocks.mockGet('/tokens', {
       tokens: [{ id: 't1', name: 'ci', type: 'service', key_prefix: 'bwt_abc12345', expires_at: null }],
     })
     const r = await run(['iam', 'token', 'list'])
@@ -54,14 +51,14 @@ describe('flect iam token', () => {
   })
 
   it('issue prints the one-time secret', async () => {
-    mocks.mockPost('/v1/tokens', { token: { id: 't1', key_prefix: 'bwt_secret1234' }, secret: 'bwt_secret1234_rest' })
+    mocks.mockPost('/tokens', { token: { id: 't1', key_prefix: 'bwt_secret1234' }, secret: 'bwt_secret1234_rest' })
     const r = await run(['iam', 'token', 'issue', 'ci', '--type', 'service'])
     expect(r.exitCode).toBe(0)
     expect(r.stdout).toContain('bwt_secret1234_rest')
   })
 
   it('revoke calls DELETE and reports success', async () => {
-    mocks.mockDelete('/v1/tokens/t1')
+    mocks.mockDelete('/tokens/t1')
     const r = await run(['iam', 'token', 'revoke', 't1'])
     expect(r.exitCode).toBe(0)
     expect(r.stdout).toContain('t1')

package/src/cli.ts

@@ -41,24 +41,11 @@ export function buildIamCommand(deps: IamCliDeps): Command {
       ])
     })
 
-  // ── users ─────────────────────────────────────────────────────────────────--
-  const users = iam.command('users').description('user directory')
-
-  users
-    .command('find <email>')
-    .description('resolve a user id by exact email (for invites)')
-    .action(async (email: string) => {
-      const { user } = await http
-        .get<{ user: { id: string; email: string; name: string | null } }>(
-          `/users/lookup?email=${encodeURIComponent(email)}`,
-        )
-        .catch(die)
-      kv([
-        ['id', user.id],
-        ['email', user.email],
-        ['name', user.name ?? '—'],
-      ])
-    })
+  // There is no `users find <email>`. It asked iam "does this address have an
+  // account here?" with a person's token, which is an account-existence oracle;
+  // iam answers that to services only now. Invite by email instead
+  // (`org invite <email>`): the invitation reaches the person without anyone
+  // learning their user id first.
 
   // ── token (credentials) ───────────────────────────────────────────────────--
   const token = iam.command('token').description('api tokens (service / cli / agent credentials)')
@@ -68,7 +55,7 @@ export function buildIamCommand(deps: IamCliDeps): Command {
     .action(async (opts: { output?: string }) => {
       const { tokens } = await http
         .get<{ tokens: Array<{ id: string; name: string; type: string; key_prefix: string; expires_at: number | null }> }>(
-          '/v1/tokens',
+          '/tokens',
         )
         .catch(die)
       printOutput(tokens as unknown as Record<string, unknown>[], opts.output, () =>
@@ -89,7 +76,7 @@ export function buildIamCommand(deps: IamCliDeps): Command {
     .option('--scope <scope...>', 'grant scopes')
     .action(async (name: string, opts: { type?: string; org?: string; scope?: string[] }) => {
       const res = await http
-        .post<{ token: { id: string; key_prefix: string }; secret: string }>('/v1/tokens', {
+        .post<{ token: { id: string; key_prefix: string }; secret: string }>('/tokens', {
           name,
           type: opts.type,
           org_id: opts.org ?? null,
@@ -107,7 +94,7 @@ export function buildIamCommand(deps: IamCliDeps): Command {
     .command('revoke <id>')
     .description('revoke a token by id')
     .action(async (id: string) => {
-      await http.del(`/v1/tokens/${encodeURIComponent(id)}`).catch(die)
+      await http.del(`/tokens/${encodeURIComponent(id)}`).catch(die)
       success(`token revoked: ${id}`)
     })