@bussolabs/closeyourit-cli 0.3.0 → 0.4.0

package/README.md

@@ -81,6 +81,9 @@ CLOSEYOURIT_TOKEN=cyi_u_… CLOSEYOURIT_API_URL=https://www.closeyour.it \
 | `errors resolve\|reopen\|mute\|unmute <id> --project <id\|key>` | Triage an error group. |
 | `tokens list --project <id\|key>` | List ingest tokens. |
 | `tokens create --project <id\|key> --name <name> --environment-id <id>` | Create a token (secret shown once). |
+| `tokens provision --project <id\|key> --name <name> --environment-id <code\|id> --to-project <id\|key> --to-environment-id <code\|id> --secret-name <NAME>` | Generate and deliver a token without revealing its value. GitHub sync is enabled by default; use `--no-sync-github` for vault-only delivery. |
+| `tokens provisions show <id> --project <id\|key>` | Show secret-free provisioning status. |
+| `tokens provisions retry <id> --project <id\|key>` | Retry GitHub sync without regenerating or revealing the token. |
 | `tokens rotate <id> --project <id\|key>` | Rotate a token (new secret shown once). |
 | `tokens revoke <id> --project <id\|key>` | Revoke a token. |
 | `secrets assets list --project <id\|key>` | List encrypted secret-file metadata (never contents). |

package/dist/commands/tokens/provision.d.ts

@@ -0,0 +1,18 @@
+import { BaseCommand } from '../../base';
+export default class TokensProvision extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        name: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'environment-id': import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        scope: import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'to-project': import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'to-environment-id': import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'secret-name': import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'idempotency-key': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'sync-github': import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        'confirm-production': import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        project: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<unknown>;
+}

package/dist/commands/tokens/provision.js

@@ -0,0 +1,55 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const node_crypto_1 = require("node:crypto");
+const base_1 = require("../../base");
+const token_provision_1 = require("../../lib/token-provision");
+class TokensProvision extends base_1.BaseCommand {
+    static description = 'Generate an ingest token and deliver it without revealing the secret';
+    static examples = [
+        '<%= config.bin %> tokens provision -p CYRA --name "Self monitoring" --environment-id staging --to-project CYRA --to-environment-id staging --secret-name CLOSEYOURIT_TOKEN',
+    ];
+    static flags = {
+        ...base_1.projectFlag,
+        name: core_1.Flags.string({ description: 'Human-readable token name', required: true }),
+        'environment-id': core_1.Flags.string({ description: 'Source environment code or id', required: true }),
+        scope: core_1.Flags.string({ description: 'Token scope (repeatable)', multiple: true, options: ['ingest', 'read'] }),
+        'to-project': core_1.Flags.string({ description: 'Destination project id or key', required: true }),
+        'to-environment-id': core_1.Flags.string({ description: 'Destination environment code or id', required: true }),
+        'secret-name': core_1.Flags.string({ description: 'Destination vault variable name', required: true }),
+        'idempotency-key': core_1.Flags.string({ description: 'Stable key for safe request retries' }),
+        'sync-github': core_1.Flags.boolean({ description: 'Synchronize the destination vault to GitHub', default: true, allowNo: true }),
+        'confirm-production': core_1.Flags.boolean({ description: 'Required when source or destination is production' }),
+    };
+    async run() {
+        const { flags } = await this.parse(TokensProvision);
+        const [projectId, destinationProjectId] = await Promise.all([
+            this.resolveProjectId(flags.project),
+            this.resolveProjectId(flags['to-project']),
+        ]);
+        const response = await this.api.post(`/cli/v1/projects/${projectId}/tokens/provisions`, {
+            name: flags.name,
+            environment_id: flags['environment-id'],
+            scopes: flags.scope?.length ? flags.scope : ['ingest'],
+            idempotency_key: flags['idempotency-key'] ?? (0, node_crypto_1.randomUUID)(),
+            sync_github: flags['sync-github'],
+            confirm_production: flags['confirm-production'] ?? false,
+            destination: {
+                project_id: destinationProjectId,
+                environment_id: flags['to-environment-id'],
+                secret_name: flags['secret-name'],
+            },
+        });
+        const safe = (0, token_provision_1.safeTokenProvisionEnvelope)(response);
+        if (!this.jsonEnabled()) {
+            const data = safe.data;
+            this.log('Token generated and delivered without revealing its value.');
+            this.log(`  provision: ${data.provision?.id ?? '-'}`);
+            this.log(`  token:     ${data.token?.id ?? '-'}`);
+            this.log(`  prefix:    ${data.token?.token_prefix ?? '-'}`);
+            this.log(`  status:    ${data.provision?.status ?? '-'}`);
+        }
+        return safe;
+    }
+}
+exports.default = TokensProvision;

package/dist/commands/tokens/provisions/retry.d.ts

@@ -0,0 +1,11 @@
+import { BaseCommand } from '../../../base';
+export default class TokensProvisionsRetry extends BaseCommand {
+    static description: string;
+    static args: {
+        id: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        project: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<unknown>;
+}

package/dist/commands/tokens/provisions/retry.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_1 = require("../../../base");
+const token_provision_1 = require("../../../lib/token-provision");
+class TokensProvisionsRetry extends base_1.BaseCommand {
+    static description = 'Retry GitHub synchronization without regenerating or revealing the token';
+    static args = {
+        id: core_1.Args.string({ description: 'Provision id', required: true }),
+    };
+    static flags = { ...base_1.projectFlag };
+    async run() {
+        const { args, flags } = await this.parse(TokensProvisionsRetry);
+        const projectId = await this.resolveProjectId(flags.project);
+        const response = await this.api.post(`/cli/v1/projects/${projectId}/tokens/provisions/${args.id}/retry`);
+        const safe = (0, token_provision_1.safeTokenProvisionEnvelope)(response);
+        if (!this.jsonEnabled()) {
+            const provision = safe.data;
+            this.log(`Provision ${provision.id ?? args.id} queued again.`);
+            this.log(`  status: ${provision.status ?? '-'}`);
+        }
+        return safe;
+    }
+}
+exports.default = TokensProvisionsRetry;

package/dist/commands/tokens/provisions/show.d.ts

@@ -0,0 +1,11 @@
+import { BaseCommand } from '../../../base';
+export default class TokensProvisionsShow extends BaseCommand {
+    static description: string;
+    static args: {
+        id: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        project: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<unknown>;
+}

package/dist/commands/tokens/provisions/show.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_1 = require("../../../base");
+const token_provision_1 = require("../../../lib/token-provision");
+class TokensProvisionsShow extends base_1.BaseCommand {
+    static description = 'Show secret-free token provision status';
+    static args = {
+        id: core_1.Args.string({ description: 'Provision id', required: true }),
+    };
+    static flags = { ...base_1.projectFlag };
+    async run() {
+        const { args, flags } = await this.parse(TokensProvisionsShow);
+        const projectId = await this.resolveProjectId(flags.project);
+        const response = await this.api.get(`/cli/v1/projects/${projectId}/tokens/provisions/${args.id}`);
+        const safe = (0, token_provision_1.safeTokenProvisionEnvelope)(response);
+        if (!this.jsonEnabled()) {
+            const data = safe.data;
+            this.log(`Provision ${data.provision?.id ?? args.id}`);
+            this.log(`  status:      ${data.provision?.status ?? '-'}`);
+            this.log(`  destination: ${data.provision?.destination_project_id ?? '-'} / ${data.provision?.destination_environment_id ?? '-'}`);
+            this.log(`  secret name: ${data.provision?.secret_name ?? '-'}`);
+            if (data.provision?.error_code)
+                this.log(`  error:       ${data.provision.error_code}`);
+        }
+        return safe;
+    }
+}
+exports.default = TokensProvisionsShow;

package/dist/lib/token-provision.d.ts

@@ -0,0 +1,8 @@
+import type { Envelope } from './api';
+type UnknownRecord = Record<string, unknown>;
+/**
+ * Rebuild the backend response from an allow-list. Even if a future backend regression adds a
+ * plaintext field, blind commands cannot return it through oclif's JSON formatter.
+ */
+export declare function safeTokenProvisionEnvelope(response: Envelope<unknown>): Envelope<UnknownRecord>;
+export {};

package/dist/lib/token-provision.js

@@ -0,0 +1,54 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.safeTokenProvisionEnvelope = safeTokenProvisionEnvelope;
+const tokenKeys = [
+    'id',
+    'name',
+    'environment_id',
+    'token_prefix',
+    'public_key',
+    'scopes',
+    'last_used_at',
+    'revoked_at',
+    'created_at',
+];
+const provisionKeys = [
+    'id',
+    'status',
+    'secret_name',
+    'sync_github',
+    'error_code',
+    'error_message',
+    'synced_at',
+    'created_at',
+    'updated_at',
+    'source_project_id',
+    'source_environment_id',
+    'destination_project_id',
+    'destination_environment_id',
+];
+function record(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value) ? value : {};
+}
+function pick(source, keys) {
+    const safe = {};
+    for (const key of keys) {
+        if (source[key] !== undefined)
+            safe[key] = source[key];
+    }
+    return safe;
+}
+/**
+ * Rebuild the backend response from an allow-list. Even if a future backend regression adds a
+ * plaintext field, blind commands cannot return it through oclif's JSON formatter.
+ */
+function safeTokenProvisionEnvelope(response) {
+    const data = record(response.data);
+    const safeData = data.provision === undefined
+        ? pick(data, provisionKeys)
+        : {
+            token: pick(record(data.token), tokenKeys),
+            provision: pick(record(data.provision), provisionKeys),
+        };
+    return response.meta ? { data: safeData, meta: response.meta } : { data: safeData };
+}