@calimero-network/registry-cli 1.22.4 → 1.24.0

package/README.md

@@ -48,9 +48,9 @@ calimero-registry org update <orgId> [-n <name>] [-m <json>]
 calimero-registry org delete <orgId> [-y]                   # irreversible
 
 calimero-registry org members list   <orgId>
-calimero-registry org members add    <orgId> <email> [-r admin|member]
-calimero-registry org members update <orgId> <email> -r admin|member
-calimero-registry org members remove <orgId> <email>
+calimero-registry org members add    <orgId> <username> [-r admin|member]
+calimero-registry org members update <orgId> <username> -r admin|member
+calimero-registry org members remove <orgId> <username>
 
 calimero-registry org packages link   <orgId> <package>
 calimero-registry org packages unlink <orgId> <package>

package/dist/index.js

@@ -98,10 +98,24 @@ var RemoteConfig = class _RemoteConfig {
       return false;
     }
     if (parsed.protocol !== "http:") return false;
-    const host = parsed.hostname.toLowerCase();
+    const host = parsed.hostname.toLowerCase().replace(/^\[(.*)\]$/, "$1");
     const isLocal = host === "localhost" || host === "127.0.0.1" || host === "::1" || host.endsWith(".localhost");
     return !isLocal;
   }
+  /**
+   * Throws when an API key would be sent to `url` over plain http:// to a
+   * non-loopback host. Called wherever the effective registry URL (flag, env
+   * var or config file) is about to receive the Bearer key. https:// and
+   * http://localhost / 127.0.0.1 / [::1] are always allowed.
+   */
+  static assertApiKeyTransport(url, apiKey) {
+    if (!apiKey) return;
+    if (_RemoteConfig.isInsecureRemoteUrl(url)) {
+      throw new Error(
+        `Refusing to send the API key to ${url}: plain http:// is only allowed for localhost / 127.0.0.1 / [::1]. Use an https:// registry URL (check --url, CALIMERO_REGISTRY_URL and \`calimero-registry config get registry-url\`).`
+      );
+    }
+  }
   /**
    * Get API key with priority:
    * 1. Environment variable CALIMERO_API_KEY
@@ -776,6 +790,18 @@ var LocalArtifactServer = class {
     };
   }
 };
+function isAllowedOrigin(origin, allowedHosts) {
+  let parsed;
+  try {
+    parsed = new URL(origin);
+  } catch {
+    return false;
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    return false;
+  }
+  return allowedHosts.has(parsed.hostname.toLowerCase());
+}
 var LocalRegistryServer = class {
   config;
   dataStore;
@@ -821,6 +847,43 @@ var LocalRegistryServer = class {
         });
       }
     });
+    const allowedOriginHosts = /* @__PURE__ */ new Set();
+    for (const name of allowedHosts) {
+      allowedOriginHosts.add(name.replace(/:\d+$/, ""));
+    }
+    this.server.addHook("onRequest", async (request, reply) => {
+      const method = request.method.toUpperCase();
+      if (method === "GET" || method === "HEAD" || method === "OPTIONS") {
+        return;
+      }
+      const origin = request.headers.origin;
+      if (origin !== void 0 && !isAllowedOrigin(origin, allowedOriginHosts)) {
+        return reply.code(403).send({
+          statusCode: 403,
+          error: "Forbidden",
+          message: "Cross-origin request not allowed"
+        });
+      }
+      const fetchSite = request.headers["sec-fetch-site"];
+      if (fetchSite !== void 0 && fetchSite !== "same-origin" && fetchSite !== "none") {
+        return reply.code(403).send({
+          statusCode: 403,
+          error: "Forbidden",
+          message: "Cross-site request not allowed"
+        });
+      }
+      const pathname = request.url.split("?")[0];
+      if (pathname.startsWith("/local/")) {
+        const contentType = String(request.headers["content-type"] ?? "").split(";")[0].trim().toLowerCase();
+        if (contentType !== "application/json") {
+          return reply.code(415).send({
+            statusCode: 415,
+            error: "Unsupported Media Type",
+            message: "Content-Type must be application/json"
+          });
+        }
+      }
+    });
     await this.registerRoutes();
     await this.server.listen({ port: serverPort, host });
     this.isRunning = true;
@@ -1755,11 +1818,12 @@ Note:
   - Config file values are used unless overridden by flags or environment variables
   - Priority: flag > environment variable > config file > default
 `
-  ).action(async (bundleFile, options) => {
+  ).action(async (bundleFile, options, command) => {
+    const urlFlag = command.optsWithGlobals().url;
     let mpkPath;
     let tempMpk = null;
     try {
-      if (!options.remote && (options.url || options.apiKey)) {
+      if (!options.remote && (urlFlag || options.apiKey)) {
         console.warn(
           "\u26A0\uFE0F  Warning: --url and --api-key are only used with --remote flag"
         );
@@ -1889,8 +1953,9 @@ Note:
         );
       } else if (useRemote) {
         const remoteConfig = new RemoteConfig();
-        const registryUrl = options.url || process.env.CALIMERO_REGISTRY_URL || remoteConfig.getRegistryUrl();
+        const registryUrl = urlFlag || process.env.CALIMERO_REGISTRY_URL || remoteConfig.getRegistryUrl();
         const apiKey = options.apiKey || process.env.CALIMERO_API_KEY || remoteConfig.getApiKey();
+        RemoteConfig.assertApiKeyTransport(registryUrl, apiKey);
         await pushToRemote(mpkPath, manifest, registryUrl, apiKey);
       }
     } catch (error) {
@@ -1949,7 +2014,8 @@ Examples:
   # 3) With custom registry URL:
   $ calimero-registry bundle edit com.calimero.myapp 1.0.0 --remote --url https://apps.calimero.network --manifest signed-manifest.json
 `
-  ).action(async (pkg, version2, options) => {
+  ).action(async (pkg, version2, options, command) => {
+    const urlFlag = command.optsWithGlobals().url;
     try {
       if (!options.remote) {
         console.error(
@@ -1958,8 +2024,9 @@ Examples:
         process.exit(1);
       }
       const remoteConfig = new RemoteConfig();
-      const registryUrl = options.url || process.env.CALIMERO_REGISTRY_URL || remoteConfig.getRegistryUrl();
+      const registryUrl = urlFlag || process.env.CALIMERO_REGISTRY_URL || remoteConfig.getRegistryUrl();
       const apiKey = options.apiKey || process.env.CALIMERO_API_KEY || remoteConfig.getApiKey();
+      RemoteConfig.assertApiKeyTransport(registryUrl, apiKey);
       const baseUrl = registryUrl.replace(/\/$/, "");
       const bundleUrl = `${baseUrl}/api/v2/bundles/${encodeURIComponent(pkg)}/${encodeURIComponent(version2)}`;
       const headers = {
@@ -2426,7 +2493,7 @@ function getGlobalOpts(command) {
     timeout: parseInt(String(opts.timeout ?? DEFAULT_TIMEOUT), 10) || DEFAULT_TIMEOUT
   };
 }
-function getAuthHeaders() {
+function getAuthHeaders(url) {
   const remoteConfig = new RemoteConfig();
   const apiKey = remoteConfig.getApiKey();
   if (!apiKey) {
@@ -2434,6 +2501,7 @@ function getAuthHeaders() {
       "API token required for org write operations.\nGet a token from the Organizations page in the web UI, then run:\n  calimero-registry config set api-key <token>"
     );
   }
+  RemoteConfig.assertApiKeyTransport(url, apiKey);
   return { Authorization: `Bearer ${apiKey}` };
 }
 async function fetchJson(url, options = {}) {
@@ -2461,9 +2529,9 @@ var orgCommand = new Command("org").description("Manage organizations (create, l
     const spinner2 = ora4("Resolving identity...").start();
     let authHeaders;
     try {
-      authHeaders = getAuthHeaders();
+      authHeaders = getAuthHeaders(url);
     } catch (e) {
-      spinner2.fail("API token required");
+      spinner2.fail("Cannot use API token");
       console.error(chalk4.red(e instanceof Error ? e.message : String(e)));
       process.exit(1);
     }
@@ -2538,7 +2606,7 @@ var orgCommand = new Command("org").description("Manage organizations (create, l
       const { url, timeout } = getGlobalOpts(command);
       const spinner2 = ora4("Creating organization...").start();
       try {
-        const authHeaders = getAuthHeaders();
+        const authHeaders = getAuthHeaders(url);
         const pathname = "/api/v2/orgs";
         const body = {
           name: options.name.trim(),
@@ -2599,7 +2667,7 @@ var orgCommand = new Command("org").description("Manage organizations (create, l
       const { url, timeout } = getGlobalOpts(command);
       const spinner2 = ora4("Updating organization...").start();
       try {
-        const authHeaders = getAuthHeaders();
+        const authHeaders = getAuthHeaders(url);
         const pathname = `/api/v2/orgs/${encodeURIComponent(orgId)}`;
         const body = {};
         if (options.name !== void 0) body.name = options.name;
@@ -2664,7 +2732,7 @@ var orgCommand = new Command("org").description("Manage organizations (create, l
       }
       const spinner2 = ora4("Deleting organization...").start();
       try {
-        const authHeaders = getAuthHeaders();
+        const authHeaders = getAuthHeaders(url);
         const pathname = `/api/v2/orgs/${encodeURIComponent(orgId)}`;
         const base = url.replace(/\/$/, "");
         const { data, status } = await fetchJson(`${base}${pathname}`, {
@@ -2690,7 +2758,7 @@ var orgCommand = new Command("org").description("Manage organizations (create, l
     }
   )
 ).addCommand(
-  new Command("members").description("List, add, or remove organization members").addCommand(
+  new Command("members").description("List, invite, or remove organization members").addCommand(
     new Command("list").description("List members of an org").argument("<orgId>", "Organization id or slug").action(async (orgId, _options, command) => {
       const { url, timeout } = getGlobalOpts(command);
       const base = url.replace(/\/$/, "");
@@ -2715,15 +2783,17 @@ var orgCommand = new Command("org").description("Manage organizations (create, l
       }
     })
   ).addCommand(
-    new Command("add").description("Add a member by email").argument("<orgId>", "Organization id or slug").argument("<email>", "Member email address").option("-r, --role <role>", "Role: member or admin", "member").action(
-      async (orgId, email, options, command) => {
+    new Command("add").description(
+      "Invite a member by username; they join once they accept"
+    ).argument("<orgId>", "Organization id or slug").argument("<username>", "Member username").option("-r, --role <role>", "Role: member or admin", "member").action(
+      async (orgId, username, options, command) => {
         const { url, timeout } = getGlobalOpts(command);
-        const spinner2 = ora4("Adding member...").start();
+        const spinner2 = ora4("Inviting member...").start();
         try {
-          const authHeaders = getAuthHeaders();
+          const authHeaders = getAuthHeaders(url);
           const pathname = `/api/v2/orgs/${encodeURIComponent(orgId)}/members`;
           const body = {
-            email: email.trim(),
+            username: username.trim().replace(/^@+/, ""),
             role: options.role === "admin" ? "admin" : "member"
           };
           const base = url.replace(/\/$/, "");
@@ -2740,7 +2810,9 @@ var orgCommand = new Command("org").description("Manage organizations (create, l
             console.error(chalk4.red(JSON.stringify(data)));
             process.exit(1);
           }
-          spinner2.succeed("Member added");
+          spinner2.succeed(
+            status === 202 ? "Invitation sent; the user joins once they accept it" : "Member added"
+          );
         } catch (e) {
           spinner2.fail("Failed");
           console.error(
@@ -2751,13 +2823,13 @@ var orgCommand = new Command("org").description("Manage organizations (create, l
       }
     )
   ).addCommand(
-    new Command("update").description("Update a member role (admin or member)").argument("<orgId>", "Organization id or slug").argument("<email>", "Member email address").requiredOption("-r, --role <role>", "New role: admin or member").action(
+    new Command("update").description("Update a member role (admin or member)").argument("<orgId>", "Organization id or slug").argument("<member>", "Member username or email address").requiredOption("-r, --role <role>", "New role: admin or member").action(
       async (orgId, email, options, command) => {
         const { url, timeout } = getGlobalOpts(command);
         const role = options.role === "admin" ? "admin" : "member";
         const spinner2 = ora4("Updating member role...").start();
         try {
-          const authHeaders = getAuthHeaders();
+          const authHeaders = getAuthHeaders(url);
           const pathname = `/api/v2/orgs/${encodeURIComponent(orgId)}/members/${encodeURIComponent(email.trim())}`;
           const body = { role };
           const base = url.replace(/\/$/, "");
@@ -2785,12 +2857,12 @@ var orgCommand = new Command("org").description("Manage organizations (create, l
       }
     )
   ).addCommand(
-    new Command("remove").description("Remove a member by email").argument("<orgId>", "Organization id or slug").argument("<email>", "Member email address").action(
+    new Command("remove").description("Remove a member by username or email").argument("<orgId>", "Organization id or slug").argument("<member>", "Member username or email address").action(
       async (orgId, email, _options, command) => {
         const { url, timeout } = getGlobalOpts(command);
         const spinner2 = ora4("Removing member...").start();
         try {
-          const authHeaders = getAuthHeaders();
+          const authHeaders = getAuthHeaders(url);
           const pathname = `/api/v2/orgs/${encodeURIComponent(orgId)}/members/${encodeURIComponent(email.trim())}`;
           const base = url.replace(/\/$/, "");
           const { data, status } = await fetchJson(`${base}${pathname}`, {
@@ -2823,7 +2895,7 @@ var orgCommand = new Command("org").description("Manage organizations (create, l
         const { url, timeout } = getGlobalOpts(command);
         const spinner2 = ora4("Linking package...").start();
         try {
-          const authHeaders = getAuthHeaders();
+          const authHeaders = getAuthHeaders(url);
           const pathname = `/api/v2/orgs/${encodeURIComponent(orgId)}/packages`;
           const body = { package: pkg.trim() };
           const base = url.replace(/\/$/, "");
@@ -2856,7 +2928,7 @@ var orgCommand = new Command("org").description("Manage organizations (create, l
         const { url, timeout } = getGlobalOpts(command);
         const spinner2 = ora4("Unlinking package...").start();
         try {
-          const authHeaders = getAuthHeaders();
+          const authHeaders = getAuthHeaders(url);
           const pathname = `/api/v2/orgs/${encodeURIComponent(orgId)}/packages/${encodeURIComponent(pkg.trim())}`;
           const base = url.replace(/\/$/, "");
           const { data, status } = await fetchJson(`${base}${pathname}`, {