@bussolabs/closeyourit-cli 0.22.0 → 0.23.1

package/dist/lib/service-accounts.js

@@ -0,0 +1,132 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.environmentsLine = environmentsLine;
+exports.normalizeEnvironmentCodes = normalizeEnvironmentCodes;
+exports.accountSummary = accountSummary;
+exports.withoutSecret = withoutSecret;
+exports.tokenStatus = tokenStatus;
+exports.unknownEnvironmentCodes = unknownEnvironmentCodes;
+exports.assertBoundaryApplied = assertBoundaryApplied;
+const api_1 = require("./api");
+const error_codes_1 = require("../errors/error-codes");
+/**
+ * Reading and correcting a service account without recreating it (CYCL-46).
+ *
+ * One rule runs through everything here: on the secret boundary of a service account, an EMPTY list
+ * of environment codes does not mean "no access", it means "every environment". So the empty list is
+ * never a neutral value to fall into by accident — it is a decision, and it has to be printed with
+ * words that cannot be misread.
+ */
+/** The boundary in words: the codes, or the fact that there is no boundary at all. */
+function environmentsLine(codes) {
+    const list = normalizeEnvironmentCodes(Array.isArray(codes) ? codes : []);
+    return `secret environments: ${list.length > 0 ? list.join(', ') : 'all (no restriction)'}`;
+}
+/**
+ * Environment codes the way the server stores them: trimmed, lowercase, each one once, blanks
+ * dropped — the same normalisation `Connections::SetSecretAccess#sanitize` applies before saving.
+ * Sending them already in that shape is what makes "what I asked for" and "what came back"
+ * comparable at all: otherwise ` Staging ` would look dropped every single time.
+ */
+function normalizeEnvironmentCodes(values) {
+    const seen = new Set();
+    const codes = [];
+    for (const value of values) {
+        const code = String(value ?? '').trim().toLowerCase();
+        if (code === '' || seen.has(code))
+            continue;
+        seen.add(code);
+        codes.push(code);
+    }
+    return codes;
+}
+/**
+ * The fields of a service account worth printing, as an explicit allow-list — the same discipline as
+ * `changeRequestSummary`: `renderRecord` prints every scalar it is handed, so handing it the raw
+ * payload would print whatever the server adds next, up to and including a field carrying a token.
+ * `secret_environment_codes` is left out on purpose: it is an array (renderRecord would swallow it)
+ * and it deserves the sentence `environmentsLine` builds, not a bare key.
+ */
+function accountSummary(account) {
+    const summary = {
+        id: account.id,
+        name: account.name,
+        handle: account.handle,
+        created_at: account.created_at,
+        active_tokens_count: account.active_tokens_count,
+    };
+    return Object.fromEntries(Object.entries(summary).filter(([, value]) => value !== undefined && value !== null));
+}
+/**
+ * A copy of a token row without the secret, on both the human and the `--json` path.
+ *
+ * `UserApiTokenSerializer` never ships it — the secret exists only in the response of `tokens
+ * create`, reveal-once, and in the database there is just a prefix. This strips it anyway, for the
+ * same reason `withoutValue` does it on the vault queue: the CLI decides what leaves the terminal,
+ * so a payload that one day carried the secret (a serializer edit, a proxy, a hand-rolled backend)
+ * cannot turn a plain listing into a second reveal.
+ */
+function withoutSecret(row) {
+    if (row === null || typeof row !== 'object')
+        return row;
+    const { secret: _secret, ...rest } = row;
+    return rest;
+}
+/** `active` while the token works, `revoked` once it has been withdrawn — what the reader is after. */
+function tokenStatus(token) {
+    return token.revoked_at ? 'revoked' : 'active';
+}
+/**
+ * The requested codes an organization does not declare — checked BEFORE writing.
+ *
+ * `SetSecretAccess` intersects what it receives with the codes the organization really has and
+ * saves what is left, answering 200 either way. On a typo that intersection is empty, and an empty
+ * allow-list is not "no environments", it is EVERY environment: `--secret-environment stagin` would
+ * hand the account the production secrets it was being restricted away from. Catching it here means
+ * the mistake costs an error message instead of an open door.
+ *
+ * `known` empty is treated as "could not read them" by the caller, not as "nothing is valid": a
+ * lookup that came back empty (no permission, a serializer without `code`) must not block a command
+ * the caller is entitled to run.
+ */
+function unknownEnvironmentCodes(requested, known) {
+    const declared = new Set(normalizeEnvironmentCodes(known));
+    return requested.filter((code) => !declared.has(code));
+}
+/**
+ * Refuse an environment boundary the server did not actually put in place.
+ *
+ * The pre-flight check above catches the typo before it is written, but it cannot be the only
+ * guard: reading the environments needs `environments.view`, a permission managing members does not
+ * imply, and an environment can be removed between the two calls. So the request and the response
+ * are compared here too, and any difference — a code dropped OR a code appearing that nobody asked
+ * for, which would mean a wider boundary than requested — is an error, not a footnote.
+ *
+ * Whatever the server did save stays saved (the boundary is one call away from being fixed, and
+ * rolling it back blindly could lock out an agent mid-run), but the command says so and exits
+ * non-zero — the same shape as `assertNothingDropped` on a partial bulk triage.
+ */
+function assertBoundaryApplied(requested, applied) {
+    const inForce = applied.length > 0 ? applied.join(', ') : 'all environments (no restriction)';
+    // --all-environments: the removal is the whole point, so a boundary still standing means the
+    // command did nothing while looking like it worked.
+    if (requested.length === 0) {
+        if (applied.length === 0)
+            return;
+        throw new api_1.ApiRequestError(500, error_codes_1.ErrorCodes.ServiceAccount.restrictionNotApplied, `The restriction was not removed: the account can still read secrets only in ${inForce}. ` +
+            'Nothing else changed — run the command again, or check the account from the web vault.');
+    }
+    const kept = new Set(applied.map((code) => code.toLowerCase()));
+    const asked = new Set(requested);
+    const dropped = requested.filter((code) => !kept.has(code));
+    const extra = applied.filter((code) => !asked.has(code.toLowerCase()));
+    if (dropped.length === 0 && extra.length === 0)
+        return;
+    const what = dropped.length > 0
+        ? `Not applied: ${dropped.join(', ')} — the server kept a different boundary ` +
+            '(an environment removed in the meantime, or a code this organization does not have).'
+        : `Applied without being asked for: ${extra.join(', ')} — the boundary is wider than requested ` +
+            `(${requested.join(', ')}).`;
+    throw new api_1.ApiRequestError(404, error_codes_1.ErrorCodes.ServiceAccount.boundaryMismatch, `${what} In force now: ${inForce}. ` +
+        'Run "environments list" to see the real codes, then set the boundary again.');
+}

package/dist/lib/vault-requests.d.ts

@@ -0,0 +1,38 @@
+/** Org-level collection of the secret changes waiting for a second approval (CYCL-40). */
+export declare const CHANGE_REQUESTS_PATH = "/cli/v1/vault/change_requests";
+/**
+ * A copy of a change-request row without the proposed value.
+ *
+ * `SecretChangeRequestSerializer` never ships `value` — it is encrypted at rest and a change
+ * request is only ever allowed to reveal the NAME and the intent. This strips it anyway, on both
+ * the human and the `--json` path: the CLI decides what leaves the terminal, so a payload that one
+ * day carried the secret (a serializer edit, a proxy, a hand-rolled backend) cannot leak it through
+ * a command whose whole point is reviewing secrets without seeing them.
+ */
+export declare function withoutValue<T>(row: T): T;
+/** One row of `vault requests list`: never the value, only what identifies the pending change. */
+export declare function changeRequestRow(row: Record<string, unknown>): string[];
+/** Column headers of `vault requests list`, in the order `changeRequestRow` fills them. */
+export declare const CHANGE_REQUEST_HEADERS: string[];
+/**
+ * Short human wording of what a request is about — `STRIPE_KEY (set) on ACME/production`. Empty when
+ * the payload names nothing, so the caller can fall back to a bare confirmation instead of printing
+ * a line full of question marks.
+ */
+export declare function changeRequestLabel(row: Record<string, unknown>): string;
+/**
+ * The fields of a decided request worth printing, as an explicit allow-list — the same discipline as
+ * `leaseSummary` in `tickets lease claim`: `renderRecord` prints every scalar it is handed, so
+ * handing it the raw payload would print whatever the server adds next. Absent/null fields are
+ * dropped rather than shown as `-`: an approval has no rejection reason, and a row of dashes reads
+ * like missing data instead of "not applicable".
+ */
+export declare function changeRequestSummary(row: Record<string, unknown>): Record<string, unknown>;
+/**
+ * Append the way out to a refused decision, keeping the server's own message and code intact — the
+ * pattern `fetchLookupRows` already uses on a 403 in `BaseCommand`. Anything else (a 404 on a
+ * request outside the visible projects, a plain "Permesso negato" from the RBAC gate, a network
+ * failure) passes through untouched: inventing an explanation for an error we have not identified
+ * would be worse than the bare code.
+ */
+export declare function describeDecisionError(error: unknown): unknown;

package/dist/lib/vault-requests.js

@@ -0,0 +1,125 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CHANGE_REQUEST_HEADERS = exports.CHANGE_REQUESTS_PATH = void 0;
+exports.withoutValue = withoutValue;
+exports.changeRequestRow = changeRequestRow;
+exports.changeRequestLabel = changeRequestLabel;
+exports.changeRequestSummary = changeRequestSummary;
+exports.describeDecisionError = describeDecisionError;
+const api_1 = require("./api");
+/** Org-level collection of the secret changes waiting for a second approval (CYCL-40). */
+exports.CHANGE_REQUESTS_PATH = '/cli/v1/vault/change_requests';
+/**
+ * A copy of a change-request row without the proposed value.
+ *
+ * `SecretChangeRequestSerializer` never ships `value` — it is encrypted at rest and a change
+ * request is only ever allowed to reveal the NAME and the intent. This strips it anyway, on both
+ * the human and the `--json` path: the CLI decides what leaves the terminal, so a payload that one
+ * day carried the secret (a serializer edit, a proxy, a hand-rolled backend) cannot leak it through
+ * a command whose whole point is reviewing secrets without seeing them.
+ */
+function withoutValue(row) {
+    if (row === null || typeof row !== 'object')
+        return row;
+    const { value: _value, ...rest } = row;
+    return rest;
+}
+/** `key` of the project the change belongs to (its name as a fallback), or '' when the payload is silent. */
+function projectLabel(row) {
+    const project = (row.project ?? {});
+    return String(project.key ?? project.name ?? '');
+}
+/** `code` of the target environment (its label as a fallback), or '' when the payload is silent. */
+function environmentLabel(row) {
+    const environment = (row.environment ?? {});
+    return String(environment.code ?? environment.label ?? '');
+}
+/**
+ * Who asked for the change: name, email as a fallback, '' when nobody is attached. The requester FK
+ * is nullified when the account is deleted (the audit outlives the person), so this is a real case,
+ * not a defensive flourish.
+ */
+function requesterLabel(row) {
+    const requester = (row.requested_by ?? {});
+    return String(requester.name ?? requester.email ?? '');
+}
+/** One row of `vault requests list`: never the value, only what identifies the pending change. */
+function changeRequestRow(row) {
+    return [
+        String(row.id ?? ''),
+        projectLabel(row),
+        environmentLabel(row),
+        String(row.action ?? ''),
+        String(row.name ?? ''),
+        requesterLabel(row),
+        String(row.created_at ?? ''),
+    ];
+}
+/** Column headers of `vault requests list`, in the order `changeRequestRow` fills them. */
+exports.CHANGE_REQUEST_HEADERS = ['ID', 'PROJECT', 'ENVIRONMENT', 'ACTION', 'NAME', 'REQUESTED BY', 'ASKED AT'];
+/**
+ * Short human wording of what a request is about — `STRIPE_KEY (set) on ACME/production`. Empty when
+ * the payload names nothing, so the caller can fall back to a bare confirmation instead of printing
+ * a line full of question marks.
+ */
+function changeRequestLabel(row) {
+    const name = String(row.name ?? '').trim();
+    if (name === '')
+        return '';
+    const action = String(row.action ?? '').trim();
+    const where = [projectLabel(row), environmentLabel(row)].filter(Boolean).join('/');
+    return [name, action && `(${action})`, where && `on ${where}`].filter(Boolean).join(' ');
+}
+/**
+ * The fields of a decided request worth printing, as an explicit allow-list — the same discipline as
+ * `leaseSummary` in `tickets lease claim`: `renderRecord` prints every scalar it is handed, so
+ * handing it the raw payload would print whatever the server adds next. Absent/null fields are
+ * dropped rather than shown as `-`: an approval has no rejection reason, and a row of dashes reads
+ * like missing data instead of "not applicable".
+ */
+function changeRequestSummary(row) {
+    const summary = {
+        id: row.id,
+        project: projectLabel(row) || undefined,
+        environment: environmentLabel(row) || undefined,
+        name: row.name,
+        action: row.action,
+        status: row.status,
+        requested_by: requesterLabel(row) || undefined,
+        requested_at: row.created_at,
+        decided_at: row.decided_at,
+        reason: row.reason,
+    };
+    return Object.fromEntries(Object.entries(summary).filter(([, value]) => value !== undefined && value !== null));
+}
+/**
+ * The four ways a decision is refused, each with the way out. The backend codes are stable and its
+ * messages are already clear about WHAT happened; what a refusal alone does not say is what to do
+ * next — and all four look identical from the outside ("it did not work"), while they call for
+ * opposite reactions: hand the request to a colleague, log in as yourself, refresh the queue, write
+ * a real reason.
+ */
+const DECISION_HINTS = {
+    // Four-eyes separation: whoever decides is never whoever asked (Secrets::ChangeRequests::DecisionGuard).
+    'R403-CHANGEREQUEST-001': 'The four-eyes rule holds here: this one has to be decided by someone else with secrets.manage on that project.',
+    // CYRA-640: the second approval is a person's, never a machine's — a service-account token
+    // authenticates like a personal one, so the refusal has to name the difference.
+    'R403-CHANGEREQUEST-003': 'Only a person can decide a secret change request: a service account cannot, so run this with your own login.',
+    'R409-CHANGEREQUEST-001': 'It was already decided (applied, rejected or withdrawn) — run "vault requests list" to see what is still waiting.',
+    'R422-CHANGEREQUEST-001': 'Pass a --reason that says why: a rejection freezes the request, and whoever asked needs to know what to fix.',
+};
+/**
+ * Append the way out to a refused decision, keeping the server's own message and code intact — the
+ * pattern `fetchLookupRows` already uses on a 403 in `BaseCommand`. Anything else (a 404 on a
+ * request outside the visible projects, a plain "Permesso negato" from the RBAC gate, a network
+ * failure) passes through untouched: inventing an explanation for an error we have not identified
+ * would be worse than the bare code.
+ */
+function describeDecisionError(error) {
+    if (!(error instanceof api_1.ApiRequestError))
+        return error;
+    const hint = DECISION_HINTS[error.code];
+    if (!hint)
+        return error;
+    return new api_1.ApiRequestError(error.status, error.code, `${error.message}. ${hint}`, error.details);
+}

package/dist/lib/workload.d.ts

@@ -0,0 +1,37 @@
+/**
+ * La board del carico di lavoro non-dev (fiere, materiale cartaceo, incontri, chiamate): una sola
+ * raccolta d'organizzazione, con radice di tenancy il TEAM e non il progetto — per questo l'endpoint
+ * non è annidato sotto `/projects/:id` come quasi tutto il resto della CLI.
+ */
+export declare const WORKLOAD_ACTIONS_PATH = "/cli/v1/workload/actions";
+/** Gli stati dell'enum del server, nell'ordine in cui un'attività li attraversa. */
+export declare const WORKLOAD_STATUSES: string[];
+/**
+ * I campi che `workload create` e `workload update` scrivono allo stesso modo. Il titolo resta
+ * fuori: nasce obbligatorio sulla creazione e facoltativo sulla modifica. Il team pure — è
+ * immutabile lato server (spostare un'attività cambierebbe chi la vede), quindi si indica solo
+ * quando l'attività nasce.
+ */
+export declare const actionFieldFlags: {
+    description: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+    status: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+    'scheduled-at': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+    'due-at': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+    ticket: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+};
+type ActionFlags = Record<string, unknown>;
+/** Popola `body` coi campi scalari presenti nei flag (chiavi snake_case attese dall'API CLI). */
+export declare function applyActionBody(body: ActionFlags, flags: ActionFlags): void;
+/**
+ * Vero quando il ticket indicato NON è finito sull'attività: il server sostituisce in silenzio con
+ * «nessun ticket» un id che chi scrive non può vedere (anti-BOLA), e senza dirlo l'attività
+ * risulterebbe collegata a chi l'ha appena salvata — mentre non lo è. Falso quando non c'era niente
+ * da collegare (flag assente, o stringa vuota che scollega apposta) o quando il legame c'è davvero.
+ *
+ * Sulla modifica la conseguenza è più pesante che sulla creazione — quel silenzio toglie anche il
+ * ticket che c'era prima — quindi l'avviso vero e proprio lo scrive ciascun comando.
+ */
+export declare function ticketLinkMissing(reference: string | undefined, resolvedId: string | undefined, data: Record<string, unknown>): boolean;
+/** La riga dei partecipanti: `renderRecord` stampa solo i campi scalari, e i nomi sono un elenco. */
+export declare function participantsLine(data: Record<string, unknown>): string;
+export {};

package/dist/lib/workload.js

@@ -0,0 +1,64 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.actionFieldFlags = exports.WORKLOAD_STATUSES = exports.WORKLOAD_ACTIONS_PATH = void 0;
+exports.applyActionBody = applyActionBody;
+exports.ticketLinkMissing = ticketLinkMissing;
+exports.participantsLine = participantsLine;
+const core_1 = require("@oclif/core");
+const output_1 = require("./output");
+/**
+ * La board del carico di lavoro non-dev (fiere, materiale cartaceo, incontri, chiamate): una sola
+ * raccolta d'organizzazione, con radice di tenancy il TEAM e non il progetto — per questo l'endpoint
+ * non è annidato sotto `/projects/:id` come quasi tutto il resto della CLI.
+ */
+exports.WORKLOAD_ACTIONS_PATH = '/cli/v1/workload/actions';
+/** Gli stati dell'enum del server, nell'ordine in cui un'attività li attraversa. */
+exports.WORKLOAD_STATUSES = ['planned', 'in_progress', 'done', 'cancelled'];
+/**
+ * I campi che `workload create` e `workload update` scrivono allo stesso modo. Il titolo resta
+ * fuori: nasce obbligatorio sulla creazione e facoltativo sulla modifica. Il team pure — è
+ * immutabile lato server (spostare un'attività cambierebbe chi la vede), quindi si indica solo
+ * quando l'attività nasce.
+ */
+exports.actionFieldFlags = {
+    description: core_1.Flags.string({ description: 'What the activity is about (free text)' }),
+    status: core_1.Flags.string({
+        description: `Status (${exports.WORKLOAD_STATUSES.join(', ')})`,
+        options: exports.WORKLOAD_STATUSES,
+    }),
+    'scheduled-at': core_1.Flags.string({ description: 'When it takes place (ISO 8601)' }),
+    'due-at': core_1.Flags.string({ description: 'Deadline (ISO 8601)' }),
+    ticket: core_1.Flags.string({
+        description: 'Link an existing ticket by code (e.g. DRFL-3) or id — pass an empty string to unlink',
+    }),
+};
+/** Popola `body` coi campi scalari presenti nei flag (chiavi snake_case attese dall'API CLI). */
+function applyActionBody(body, flags) {
+    if (flags.description !== undefined)
+        body.description = flags.description;
+    if (flags.status !== undefined)
+        body.status = flags.status;
+    if (flags['scheduled-at'] !== undefined)
+        body.scheduled_at = flags['scheduled-at'];
+    if (flags['due-at'] !== undefined)
+        body.due_at = flags['due-at'];
+}
+/**
+ * Vero quando il ticket indicato NON è finito sull'attività: il server sostituisce in silenzio con
+ * «nessun ticket» un id che chi scrive non può vedere (anti-BOLA), e senza dirlo l'attività
+ * risulterebbe collegata a chi l'ha appena salvata — mentre non lo è. Falso quando non c'era niente
+ * da collegare (flag assente, o stringa vuota che scollega apposta) o quando il legame c'è davvero.
+ *
+ * Sulla modifica la conseguenza è più pesante che sulla creazione — quel silenzio toglie anche il
+ * ticket che c'era prima — quindi l'avviso vero e proprio lo scrive ciascun comando.
+ */
+function ticketLinkMissing(reference, resolvedId, data) {
+    if (!reference || !resolvedId)
+        return false;
+    return data.ticket_id !== resolvedId;
+}
+/** La riga dei partecipanti: `renderRecord` stampa solo i campi scalari, e i nomi sono un elenco. */
+function participantsLine(data) {
+    const names = (Array.isArray(data.participants) ? data.participants : []).map((name) => (0, output_1.sanitize)(name));
+    return `participants: ${names.length > 0 ? names.join(', ') : '-'}`;
+}