@bussolabs/closeyourit-cli 0.2.0 → 0.2.1

package/dist/base.js

@@ -101,6 +101,13 @@ class BaseCommand extends core_1.Command {
             }
             return this.exit(1);
         }
+        // Oclif's default JSON formatter serializes the complete CommandError. That object references
+        // the command instance and therefore cfg/api.config, including the bearer token. Never pass an
+        // unknown error to that formatter in JSON mode: emit a deliberately small allow-listed envelope.
+        if (this.jsonEnabled()) {
+            this.logJson({ error: { code: error_codes_1.ErrorCodes.System.unexpected, message: 'Command failed' } });
+            return this.exit(1);
+        }
         return super.catch(error);
     }
 }

package/dist/commands/whoami.js

@@ -2,11 +2,30 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 const base_1 = require("../base");
 class Whoami extends base_1.BaseCommand {
-    static description = 'Show the authenticated account, organization, token and permissions';
+    static description = 'Show the authenticated account, organization, token prefix and permissions';
     static examples = ['<%= config.bin %> whoami', '<%= config.bin %> whoami --json'];
     async run() {
         const res = await this.api.get('/cli/v1/whoami');
-        const who = res.data;
+        // Rebuild from an allow-list. If a future backend accidentally includes a token secret or other
+        // authentication internals, `--json` must not proxy them to stdout.
+        const who = {
+            account: res.data.account && {
+                id: res.data.account.id,
+                name: res.data.account.name,
+                email: res.data.account.email,
+            },
+            organization: res.data.organization && {
+                id: res.data.organization.id,
+                name: res.data.organization.name,
+                slug: res.data.organization.slug,
+            },
+            token: res.data.token && {
+                id: res.data.token.id,
+                name: res.data.token.name,
+                prefix: res.data.token.prefix,
+            },
+            permissions: res.data.permissions,
+        };
         if (!this.jsonEnabled()) {
             this.log(`Account:     ${who.account?.name ?? '-'} <${who.account?.email ?? '-'}>`);
             this.log(`Organization: ${who.organization?.name ?? '-'} (${who.organization?.slug ?? '-'})`);