@burdenoff/bigconsole-cli 2026.802.1

package/LICENSE

@@ -0,0 +1,9 @@
+Copyright (c) 2025 Burdenoff Consultancy Services Private Limited, Algoshred Technologies Private Limited and all sister companies.
+
+All rights reserved.
+
+This software is proprietary and confidential. Unauthorized copying, modification, distribution, or use of this software, via any medium, is strictly prohibited without the express written permission of the copyright holders.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+For licensing inquiries, please contact: legal@algoshred.com

package/README.md

@@ -0,0 +1,235 @@
+# Bigconsole Cli
+
+A powerful command-line interface for managing bigconsole operations with GraphQL backend integration.
+
+## Features
+
+- 🔐 **Authentication Management** - Login, logout, and status checking
+- 👥 **User Management** - CRUD operations for user accounts
+- ⚙️ **Configuration Management** - Easy setup and configuration
+- 📊 **Multiple Output Formats** - JSON, table, and YAML output
+- 🛡️ **Type Safety** - Built with TypeScript for reliability
+- 🎨 **Rich CLI Experience** - Colorful output and interactive prompts
+
+## Installation
+
+### Global Installation (Production)
+
+```bash
+npm install -g @burdenoff/bigconsole-cli
+```
+
+### Global Installation (Alpha/Pre-release)
+
+```bash
+npm install -g @burdenoff/alpha-bigconsole-cli
+```
+
+### Local Installation
+
+```bash
+npm install @burdenoff/bigconsole-cli
+```
+
+## Configuration
+
+Configure the API endpoint:
+
+```bash
+bigconsole config set apiEndpoint http://localhost:8000/graphql
+```
+
+## Authentication
+
+### Login with credentials
+```bash
+bigconsole auth login
+```
+
+### Login with token
+```bash
+bigconsole auth login --token <your-access-token>
+```
+
+### Check authentication status
+```bash
+bigconsole auth status
+```
+
+### Logout
+```bash
+bigconsole auth logout
+```
+
+### Change password
+```bash
+bigconsole auth change-password
+```
+
+## User Management
+
+### List users
+```bash
+bigconsole users list
+bigconsole users list --page 2 --limit 20
+```
+
+### Get user details
+```bash
+bigconsole users get <user-id>
+```
+
+### Create a user
+```bash
+bigconsole users create
+bigconsole users create --email user@example.com --password password123 --fullName "John Doe"
+```
+
+### Update a user
+```bash
+bigconsole users update <user-id> --email newemail@example.com
+bigconsole users update <user-id> --active
+bigconsole users update <user-id> --superuser
+```
+
+### Delete a user
+```bash
+bigconsole users delete <user-id>
+bigconsole users delete <user-id> --force
+```
+
+## Configuration Management
+
+### View all configuration
+```bash
+bigconsole config get
+```
+
+### Get specific configuration
+```bash
+bigconsole config get apiEndpoint
+```
+
+### Set configuration
+```bash
+bigconsole config set apiEndpoint http://localhost:8000/graphql
+bigconsole config set outputFormat table
+```
+
+### Delete configuration
+```bash
+bigconsole config delete accessToken
+```
+
+### Clear all configuration
+```bash
+bigconsole config clear
+```
+
+### Show config file path
+```bash
+bigconsole config path
+```
+
+## Output Formats
+
+All commands support different output formats:
+
+```bash
+bigconsole users list --format json
+bigconsole users list --format table
+bigconsole users list --format yaml
+```
+
+## Global Options
+
+- `--endpoint <endpoint>`: Override the API endpoint for a single command
+- `--token <token>`: Override the access token for a single command
+- `--format <format>`: Set output format (json, table, yaml)
+- `--verbose`: Enable verbose logging
+
+## Examples
+
+```bash
+# Set up the CLI
+bigconsole config set apiEndpoint http://localhost:8000/graphql
+
+# Login
+bigconsole auth login
+
+# List all users in table format
+bigconsole users list --format table
+
+# Create a new user
+bigconsole users create --email admin@example.com --password admin123 --superuser
+
+# Check authentication status
+bigconsole auth status
+
+# Get help for any command
+bigconsole auth --help
+bigconsole users --help
+```
+
+## Development
+
+```bash
+# Install dependencies
+npm install
+
+# Build the project
+npm run build
+
+# Run in development mode
+npm run dev
+
+# Run tests
+npm test
+
+# Lint code
+npm run lint
+```
+
+## Configuration File
+
+The CLI stores configuration in `~/.config/bigconsole-cli/config.json`. This includes:
+
+- `apiEndpoint`: The GraphQL API endpoint
+- `outputFormat`: Default output format (json, table, yaml)
+- `accessToken`: Authentication token
+- `refreshToken`: Refresh token for authentication
+
+## CI/CD
+
+The project includes automated CI/CD pipelines:
+
+- **Alpha builds** - Published to `@burdenoff/alpha-bigconsole-cli` from `alpha` branch
+- **Production builds** - Published to `@burdenoff/bigconsole-cli` from `main` branch
+
+## Testing
+
+See [TESTING.md](./TESTING.md) for comprehensive testing instructions before publishing.
+
+## Security
+
+- Tokens are stored securely in user configuration directory
+- No sensitive information is logged in verbose mode
+- All API communication uses HTTPS
+- Input validation prevents injection attacks
+
+## Contributing
+
+1. Fork the repository
+2. Create a feature branch
+3. Make your changes
+4. Add tests for new functionality
+5. Ensure all tests pass
+6. Submit a pull request
+
+## License
+
+UNLICENSED - Private package for internal use
+
+---
+
+Built with ❤️ by [Vignesh T.V](https://github.com/tvvignesh)

package/dist/auth/device-code.d.ts

@@ -0,0 +1,66 @@
+/**
+ * OAuth2 Device Code flow implementation.
+ * Used for CLI authentication (similar to `gh auth login`).
+ */
+import type { CLIConfig } from '../config/index.js';
+export interface DeviceCodeResponse {
+    deviceCode: string;
+    userCode: string;
+    verificationUri: string;
+    verificationUriComplete: string | null;
+    expiresIn: number;
+    interval: number;
+}
+export interface DeviceCodeTokenResult {
+    accessToken: string;
+    refreshToken: string;
+    expiresIn: number;
+}
+/**
+ * Start the device code flow by requesting a device code from the OIDC issuer.
+ */
+export declare function startDeviceCodeFlow(config: CLIConfig & {
+    oidcIssuer: string;
+    clientId: string;
+}): Promise<DeviceCodeResponse>;
+/**
+ * Poll the token endpoint until the user approves or the code expires.
+ */
+export declare function pollForToken(deviceCode: string, interval: number, config: CLIConfig & {
+    oidcIssuer: string;
+    clientId: string;
+}): Promise<DeviceCodeTokenResult>;
+export interface ClientCredentialsResult {
+    accessToken: string;
+    expiresIn: number;
+    scopes: string[];
+}
+/**
+ * Authenticate using client credentials (app authentication).
+ * Calls the AuthenticateApp mutation on the global gateway.
+ */
+export declare function clientCredentialsFlow(globalEndpoint: string, clientId: string, clientSecret: string, scopes?: string[]): Promise<ClientCredentialsResult>;
+/**
+ * Issue a workspace token by calling the workspace gateway with an auth token.
+ * Only sends Authorization header (no X-Workspace-Authorization).
+ */
+export declare function issueWorkspaceToken(workspaceEndpoint: string, authToken: string, workspaceId: string, organizationId: string): Promise<{
+    token: string;
+    expiresAt: string;
+    scopes: string[];
+}>;
+/**
+ * Fetch user's workspaces from the global gateway.
+ */
+export declare function fetchWorkspaces(globalEndpoint: string, authToken: string): Promise<Array<{
+    id: string;
+    name: string;
+    slug: string;
+    tenantId: string;
+    organizationId: string;
+}>>;
+/**
+ * Attempt to open a URL in the user's default browser.
+ * Uses execFile instead of exec to avoid shell interpretation and command injection.
+ */
+export declare function openBrowser(url: string): Promise<boolean>;

package/dist/auth/device-code.js

@@ -0,0 +1,239 @@
+/**
+ * OAuth2 Device Code flow implementation.
+ * Used for CLI authentication (similar to `gh auth login`).
+ */
+import fetch from 'cross-fetch';
+/**
+ * Start the device code flow by requesting a device code from the OIDC issuer.
+ */
+export async function startDeviceCodeFlow(config) {
+    const url = `${config.oidcIssuer}/oidc/device/code`;
+    const body = new URLSearchParams({
+        client_id: config.clientId,
+        scope: 'openid profile email offline_access',
+    });
+    const response = await fetch(url, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: body.toString(),
+    });
+    if (!response.ok) {
+        const text = await response.text().catch(() => 'Unknown error');
+        throw new Error(`Device code request failed (${response.status}): ${text}`);
+    }
+    const data = (await response.json());
+    return {
+        deviceCode: data['device_code'],
+        userCode: data['user_code'],
+        verificationUri: data['verification_uri'],
+        verificationUriComplete: data['verification_uri_complete'] ?? null,
+        expiresIn: data['expires_in'],
+        interval: data['interval'] ?? 5,
+    };
+}
+/**
+ * Poll the token endpoint until the user approves or the code expires.
+ */
+export async function pollForToken(deviceCode, interval, config) {
+    const url = `${config.oidcIssuer}/oauth/device/token`;
+    let pollInterval = interval;
+    while (true) {
+        await new Promise((resolve) => setTimeout(resolve, pollInterval * 1000));
+        const response = await fetch(url, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: new URLSearchParams({
+                grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
+                device_code: deviceCode,
+                client_id: config.clientId,
+            }).toString(),
+        });
+        // Guard against non-JSON responses (e.g. a 502 HTML error page from a
+        // gateway during a restart). Parsing those as JSON throws SyntaxError,
+        // aborts the whole poll loop, and forces the user to re-run
+        // `bigconsole auth login` from scratch even though the transient error
+        // would have cleared on the next tick.
+        const raw = await response.text();
+        let data;
+        try {
+            data = JSON.parse(raw);
+        }
+        catch {
+            if (response.status >= 500) {
+                // Treat it like authorization_pending — keep polling.
+                continue;
+            }
+            throw new Error(`Token endpoint returned non-JSON response (status ${response.status}): ${raw.slice(0, 200)}`);
+        }
+        if (response.ok && data['access_token']) {
+            return {
+                accessToken: data['access_token'],
+                refreshToken: data['refresh_token'] ?? '',
+                expiresIn: data['expires_in'] ?? 3600,
+            };
+        }
+        const errorCode = data['error'];
+        switch (errorCode) {
+            case 'authorization_pending':
+                continue;
+            case 'slow_down':
+                pollInterval += 5;
+                continue;
+            case 'expired_token':
+                throw new Error('Device code has expired. Please try again.');
+            case 'access_denied':
+                throw new Error('Authorization was denied by the user.');
+            default:
+                throw new Error(`Device code polling failed: ${data['error_description'] ?? errorCode ?? 'Unknown error'}`);
+        }
+    }
+}
+/**
+ * Authenticate using client credentials (app authentication).
+ * Calls the AuthenticateApp mutation on the global gateway.
+ */
+export async function clientCredentialsFlow(globalEndpoint, clientId, clientSecret, scopes) {
+    const query = `
+    mutation AuthenticateApp($input: AuthenticateAppInput!) {
+      authenticateApp(input: $input) {
+        accessToken tokenType expiresIn scopes
+      }
+    }
+  `;
+    const response = await fetch(globalEndpoint, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+            query,
+            variables: { input: { clientId, clientSecret, scopes } },
+        }),
+    });
+    if (!response.ok) {
+        const text = await response.text().catch(() => 'Unknown error');
+        throw new Error(`App authentication failed (${response.status}): ${text}`);
+    }
+    const data = (await response.json());
+    if (data.errors?.length) {
+        throw new Error(`App authentication failed: ${data.errors[0].message}`);
+    }
+    if (!data.data?.authenticateApp?.accessToken) {
+        throw new Error('App authentication failed: no access token returned');
+    }
+    return data.data.authenticateApp;
+}
+/**
+ * Issue a workspace token by calling the workspace gateway with an auth token.
+ * Only sends Authorization header (no X-Workspace-Authorization).
+ */
+export async function issueWorkspaceToken(workspaceEndpoint, authToken, workspaceId, organizationId) {
+    const query = `
+    mutation IssueWorkspaceToken($input: IssueWorkspaceTokenInput!) {
+      issueWorkspaceToken(input: $input) {
+        success token expiresAt scopes
+        error { code message }
+      }
+    }
+  `;
+    const response = await fetch(workspaceEndpoint, {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/json',
+            Authorization: `Bearer ${authToken}`,
+        },
+        body: JSON.stringify({
+            query,
+            variables: { input: { workspaceId, organizationId } },
+        }),
+    });
+    if (!response.ok) {
+        const text = await response.text().catch(() => 'Unknown error');
+        throw new Error(`Workspace token request failed (${response.status}): ${text}`);
+    }
+    const data = (await response.json());
+    if (data.errors?.length) {
+        throw new Error(`Workspace token failed: ${data.errors[0].message}`);
+    }
+    const result = data.data?.issueWorkspaceToken;
+    if (!result?.success || !result.token) {
+        const errMsg = result?.error?.message ?? 'Unknown error';
+        throw new Error(`Workspace token failed: ${errMsg}`);
+    }
+    return { token: result.token, expiresAt: result.expiresAt, scopes: result.scopes ?? [] };
+}
+/**
+ * Fetch user's workspaces from the global gateway.
+ */
+export async function fetchWorkspaces(globalEndpoint, authToken) {
+    const query = `
+    query MyWorkspaces($limit: Int) {
+      myWorkspaces(limit: $limit) {
+        items { id name slug tenantId organizationId }
+      }
+    }
+  `;
+    const response = await fetch(globalEndpoint, {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/json',
+            Authorization: `Bearer ${authToken}`,
+        },
+        body: JSON.stringify({ query, variables: { limit: 50 } }),
+    });
+    if (!response.ok) {
+        const text = await response.text().catch(() => 'Unknown error');
+        throw new Error(`Failed to fetch workspaces (${response.status}): ${text}`);
+    }
+    const data = (await response.json());
+    if (data.errors?.length) {
+        throw new Error(`Failed to fetch workspaces: ${data.errors[0].message}`);
+    }
+    return data.data?.myWorkspaces?.items ?? [];
+}
+/**
+ * Validate that a string is a well-formed HTTP(S) URL.
+ * Prevents command injection by rejecting anything that isn't a valid URL.
+ */
+function isValidHttpUrl(urlString) {
+    try {
+        const parsed = new URL(urlString);
+        return parsed.protocol === 'http:' || parsed.protocol === 'https:';
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Attempt to open a URL in the user's default browser.
+ * Uses execFile instead of exec to avoid shell interpretation and command injection.
+ */
+export async function openBrowser(url) {
+    try {
+        if (!isValidHttpUrl(url)) {
+            return false;
+        }
+        const { execFile } = await import('child_process');
+        const platform = process.platform;
+        let command;
+        let args;
+        if (platform === 'darwin') {
+            command = 'open';
+            args = [url];
+        }
+        else if (platform === 'win32') {
+            command = 'cmd';
+            args = ['/c', 'start', '', url];
+        }
+        else {
+            command = 'xdg-open';
+            args = [url];
+        }
+        return new Promise((resolve) => {
+            execFile(command, args, (error) => {
+                resolve(!error);
+            });
+        });
+    }
+    catch {
+        return false;
+    }
+}

package/dist/auth/store.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Auth token persistence.
+ * Stores tokens in ~/.config/bigconsole-cli/auth.json with restrictive permissions.
+ */
+export interface StoredAuth {
+    accessToken: string;
+    refreshToken: string;
+    expiresAt?: number;
+    workspaceToken?: string;
+    workspaceTokenExpiresAt?: number;
+    workspaceId?: string;
+    organizationId?: string;
+    authMethod?: 'device_code' | 'client_credentials';
+    clientId?: string;
+    clientSecret?: string;
+}
+/**
+ * Read stored authentication data.
+ * Returns null if no auth data exists.
+ */
+export declare function readAuth(): StoredAuth | null;
+/**
+ * Write authentication data to the store.
+ * File permissions are set to 0o600 (owner read/write only).
+ */
+export declare function writeAuth(auth: StoredAuth): void;
+/**
+ * Clear stored authentication data.
+ */
+export declare function clearAuth(): void;
+/**
+ * Check if the stored token has expired.
+ */
+export declare function isTokenExpired(auth: StoredAuth): boolean;
+/**
+ * Check if the stored token is expiring within the next 5 minutes.
+ */
+export declare function isTokenExpiringSoon(auth: StoredAuth): boolean;
+/**
+ * Check if the workspace token has expired.
+ */
+export declare function isWorkspaceTokenExpired(auth: StoredAuth): boolean;
+/**
+ * Check if the workspace token is expiring within the next 5 minutes.
+ */
+export declare function isWorkspaceTokenExpiringSoon(auth: StoredAuth): boolean;

package/dist/auth/store.js

@@ -0,0 +1,90 @@
+/**
+ * Auth token persistence.
+ * Stores tokens in ~/.config/bigconsole-cli/auth.json with restrictive permissions.
+ */
+import { readFileSync, writeFileSync, mkdirSync, existsSync, chmodSync, unlinkSync } from 'fs';
+import { join } from 'path';
+import { homedir } from 'os';
+const CONFIG_DIR = join(homedir(), '.config', 'bigconsole-cli');
+const AUTH_FILE = join(CONFIG_DIR, 'auth.json');
+function ensureConfigDir() {
+    if (!existsSync(CONFIG_DIR)) {
+        mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 });
+    }
+}
+/**
+ * Read stored authentication data.
+ * Returns null if no auth data exists.
+ */
+export function readAuth() {
+    try {
+        if (!existsSync(AUTH_FILE))
+            return null;
+        const raw = readFileSync(AUTH_FILE, 'utf8');
+        return JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Write authentication data to the store.
+ * File permissions are set to 0o600 (owner read/write only).
+ */
+export function writeAuth(auth) {
+    ensureConfigDir();
+    writeFileSync(AUTH_FILE, JSON.stringify(auth, null, 2), { encoding: 'utf8', mode: 0o600 });
+    try {
+        chmodSync(AUTH_FILE, 0o600);
+    }
+    catch {
+        // chmod may fail on some platforms (Windows), that's acceptable
+    }
+}
+/**
+ * Clear stored authentication data.
+ */
+export function clearAuth() {
+    try {
+        if (existsSync(AUTH_FILE)) {
+            unlinkSync(AUTH_FILE);
+        }
+    }
+    catch {
+        // Ignore errors on cleanup
+    }
+}
+/**
+ * Check if the stored token has expired.
+ */
+export function isTokenExpired(auth) {
+    if (!auth.expiresAt)
+        return false;
+    return Date.now() >= auth.expiresAt;
+}
+/**
+ * Check if the stored token is expiring within the next 5 minutes.
+ */
+export function isTokenExpiringSoon(auth) {
+    if (!auth.expiresAt)
+        return false;
+    const BUFFER_MS = 5 * 60 * 1000;
+    return Date.now() + BUFFER_MS >= auth.expiresAt;
+}
+/**
+ * Check if the workspace token has expired.
+ */
+export function isWorkspaceTokenExpired(auth) {
+    if (!auth.workspaceTokenExpiresAt)
+        return false;
+    return Date.now() >= auth.workspaceTokenExpiresAt;
+}
+/**
+ * Check if the workspace token is expiring within the next 5 minutes.
+ */
+export function isWorkspaceTokenExpiringSoon(auth) {
+    if (!auth.workspaceTokenExpiresAt)
+        return false;
+    const BUFFER_MS = 5 * 60 * 1000;
+    return Date.now() + BUFFER_MS >= auth.workspaceTokenExpiresAt;
+}

package/dist/cli.d.ts

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+/**
+ * BigConsole CLI — dashboard, widget, parser, and workflow management from the terminal.
+ */
+export {};