@carthooks/arcubase-cli 0.1.16 → 0.1.17

package/bundle/arcubase-admin.mjs

@@ -17517,9 +17517,9 @@ function renderCommandHelp(scope, moduleName, commandName, env = process.env) {
       '  - {"update":["user_scope"],"options":{"user_scope":[{"type":"user","id":2188889901}]}}',
       "success requires:",
       "  - result.enabled must be true",
-      "  - result.options.user_scope must contain the assigned numeric TenantUser.ID values",
-      "  - PermitUserScope.id must be numeric TenantUser.ID",
-      "  - Do not copy hash arcubaseTenantUserId into PermitUserScope.id",
+      "  - result.options.user_scope must contain the assigned numeric arcubaseUserId values",
+      "  - PermitUserScope.id must be the numeric arcubaseUserId",
+      "  - Do not copy a non-numeric arcubaseUserId into PermitUserScope.id",
       "  - If result.enabled is false, enable the rule first and retry assign-users"
     ] : [],
     ...scope === "admin" && command.commandPath[0] === "app" && command.commandPath[1] === "create-from-bundle-url" ? [
@@ -17996,8 +17996,8 @@ function buildAssignUsersValidationDetails(scope, command, requestType, path3, m
     commonMistakes: [
       "do not use user_scope at top level",
       "do not use users or allowedUsers",
-      "do not use hash tenant user id as id",
-      "id must be numeric TenantUser.ID"
+      "do not use non-numeric arcubaseUserId as id",
+      "id must be the numeric arcubaseUserId"
     ]
   };
 }
@@ -18310,7 +18310,7 @@ function validateAccessRuleUserScope(scope, command, requestType, userScope, env
     }
     if (typeof item.id !== "number" || !Number.isInteger(item.id) || item.id <= 0) {
       throwBodyValidationFailure(
-        "access-rule user_scope[].id must be numeric TenantUser.ID, department ID, or actor ID",
+        "access-rule user_scope[].id must be numeric arcubaseUserId, department ID, or actor ID",
         requestType,
         `${pathPrefix}.${index}.id`,
         scope,
@@ -18515,7 +18515,7 @@ function validateActionSpecificBody(scope, command, flags, body, env) {
       }
       if (typeof item.id !== "number" || !Number.isInteger(item.id) || item.id <= 0) {
         throwBodyValidationFailure(
-          "access-rule assign-users requires body.options.user_scope[].id to be numeric TenantUser.ID",
+          "access-rule assign-users requires body.options.user_scope[].id to be numeric arcubaseUserId",
           command.requestType,
           `body.options.user_scope.${index}.id`,
           scope,
@@ -19219,14 +19219,14 @@ async function executeCLI(scope, argv, env, fetchImpl = fetch) {
           const hasUserScopeIDIssue = parsedBody.error.issues.some((issue2) => issue2.path.join(".") === "options.user_scope.0.id" || issue2.path.join(".").startsWith("options.user_scope."));
           throw new CLIError(
             "BODY_VALIDATION_FAILED",
-            hasUserScopeIDIssue ? "access-rule assign-users requires body.options.user_scope[].id to be numeric TenantUser.ID" : message,
+            hasUserScopeIDIssue ? "access-rule assign-users requires body.options.user_scope[].id to be numeric arcubaseUserId" : message,
             2,
             buildAssignUsersValidationDetails(
               scope,
               command,
               command.requestType,
               hasUserScopeIDIssue ? "body.options.user_scope" : "body",
-              hasUserScopeIDIssue ? "access-rule assign-users requires body.options.user_scope[].id to be numeric TenantUser.ID" : message,
+              hasUserScopeIDIssue ? "access-rule assign-users requires body.options.user_scope[].id to be numeric arcubaseUserId" : message,
               runtimeEnv
             )
           );

package/bundle/arcubase.mjs

@@ -17517,9 +17517,9 @@ function renderCommandHelp(scope, moduleName, commandName, env = process.env) {
       '  - {"update":["user_scope"],"options":{"user_scope":[{"type":"user","id":2188889901}]}}',
       "success requires:",
       "  - result.enabled must be true",
-      "  - result.options.user_scope must contain the assigned numeric TenantUser.ID values",
-      "  - PermitUserScope.id must be numeric TenantUser.ID",
-      "  - Do not copy hash arcubaseTenantUserId into PermitUserScope.id",
+      "  - result.options.user_scope must contain the assigned numeric arcubaseUserId values",
+      "  - PermitUserScope.id must be the numeric arcubaseUserId",
+      "  - Do not copy a non-numeric arcubaseUserId into PermitUserScope.id",
       "  - If result.enabled is false, enable the rule first and retry assign-users"
     ] : [],
     ...scope === "admin" && command.commandPath[0] === "app" && command.commandPath[1] === "create-from-bundle-url" ? [
@@ -17996,8 +17996,8 @@ function buildAssignUsersValidationDetails(scope, command, requestType, path3, m
     commonMistakes: [
       "do not use user_scope at top level",
       "do not use users or allowedUsers",
-      "do not use hash tenant user id as id",
-      "id must be numeric TenantUser.ID"
+      "do not use non-numeric arcubaseUserId as id",
+      "id must be the numeric arcubaseUserId"
     ]
   };
 }
@@ -18310,7 +18310,7 @@ function validateAccessRuleUserScope(scope, command, requestType, userScope, env
     }
     if (typeof item.id !== "number" || !Number.isInteger(item.id) || item.id <= 0) {
       throwBodyValidationFailure(
-        "access-rule user_scope[].id must be numeric TenantUser.ID, department ID, or actor ID",
+        "access-rule user_scope[].id must be numeric arcubaseUserId, department ID, or actor ID",
         requestType,
         `${pathPrefix}.${index}.id`,
         scope,
@@ -18515,7 +18515,7 @@ function validateActionSpecificBody(scope, command, flags, body, env) {
       }
       if (typeof item.id !== "number" || !Number.isInteger(item.id) || item.id <= 0) {
         throwBodyValidationFailure(
-          "access-rule assign-users requires body.options.user_scope[].id to be numeric TenantUser.ID",
+          "access-rule assign-users requires body.options.user_scope[].id to be numeric arcubaseUserId",
           command.requestType,
           `body.options.user_scope.${index}.id`,
           scope,
@@ -19219,14 +19219,14 @@ async function executeCLI(scope, argv, env, fetchImpl = fetch) {
           const hasUserScopeIDIssue = parsedBody.error.issues.some((issue2) => issue2.path.join(".") === "options.user_scope.0.id" || issue2.path.join(".").startsWith("options.user_scope."));
           throw new CLIError(
             "BODY_VALIDATION_FAILED",
-            hasUserScopeIDIssue ? "access-rule assign-users requires body.options.user_scope[].id to be numeric TenantUser.ID" : message,
+            hasUserScopeIDIssue ? "access-rule assign-users requires body.options.user_scope[].id to be numeric arcubaseUserId" : message,
             2,
             buildAssignUsersValidationDetails(
               scope,
               command,
               command.requestType,
               hasUserScopeIDIssue ? "body.options.user_scope" : "body",
-              hasUserScopeIDIssue ? "access-rule assign-users requires body.options.user_scope[].id to be numeric TenantUser.ID" : message,
+              hasUserScopeIDIssue ? "access-rule assign-users requires body.options.user_scope[].id to be numeric arcubaseUserId" : message,
               runtimeEnv
             )
           );

package/dist/runtime/execute.js

@@ -123,9 +123,9 @@ export function renderCommandHelp(scope, moduleName, commandName, env = process.
                 '  - {"update":["user_scope"],"options":{"user_scope":[{"type":"user","id":2188889901}]}}',
                 'success requires:',
                 '  - result.enabled must be true',
-                '  - result.options.user_scope must contain the assigned numeric TenantUser.ID values',
-                '  - PermitUserScope.id must be numeric TenantUser.ID',
-                '  - Do not copy hash arcubaseTenantUserId into PermitUserScope.id',
+                '  - result.options.user_scope must contain the assigned numeric arcubaseUserId values',
+                '  - PermitUserScope.id must be the numeric arcubaseUserId',
+                '  - Do not copy a non-numeric arcubaseUserId into PermitUserScope.id',
                 '  - If result.enabled is false, enable the rule first and retry assign-users',
             ]
             : []),
@@ -634,8 +634,8 @@ function buildAssignUsersValidationDetails(scope, command, requestType, path, me
         commonMistakes: [
             'do not use user_scope at top level',
             'do not use users or allowedUsers',
-            'do not use hash tenant user id as id',
-            'id must be numeric TenantUser.ID',
+            'do not use non-numeric arcubaseUserId as id',
+            'id must be the numeric arcubaseUserId',
         ],
     };
 }
@@ -906,7 +906,7 @@ function validateAccessRuleUserScope(scope, command, requestType, userScope, env
             throwBodyValidationFailure('access-rule user_scope[].type must be "user", "department", or "actor"; do not use FieldVO type "member" here', requestType, `${pathPrefix}.${index}.type`, scope, command, env);
         }
         if (typeof item.id !== 'number' || !Number.isInteger(item.id) || item.id <= 0) {
-            throwBodyValidationFailure('access-rule user_scope[].id must be numeric TenantUser.ID, department ID, or actor ID', requestType, `${pathPrefix}.${index}.id`, scope, command, env);
+            throwBodyValidationFailure('access-rule user_scope[].id must be numeric arcubaseUserId, department ID, or actor ID', requestType, `${pathPrefix}.${index}.id`, scope, command, env);
         }
     }
 }
@@ -1001,7 +1001,7 @@ function validateActionSpecificBody(scope, command, flags, body, env) {
                 throwBodyValidationFailure('access-rule assign-users requires body.options.user_scope[].type to be "user"', command.requestType, `body.options.user_scope.${index}.type`, scope, command, env);
             }
             if (typeof item.id !== 'number' || !Number.isInteger(item.id) || item.id <= 0) {
-                throwBodyValidationFailure('access-rule assign-users requires body.options.user_scope[].id to be numeric TenantUser.ID', command.requestType, `body.options.user_scope.${index}.id`, scope, command, env);
+                throwBodyValidationFailure('access-rule assign-users requires body.options.user_scope[].id to be numeric arcubaseUserId', command.requestType, `body.options.user_scope.${index}.id`, scope, command, env);
             }
         }
     }
@@ -1714,7 +1714,7 @@ export async function executeCLI(scope, argv, env, fetchImpl = fetch) {
                 const message = parsedBody.error.issues.map((issue) => `${issue.path.join('.')}: ${issue.message}`).join('; ');
                 if (isAssignUsersCommand(scope, command)) {
                     const hasUserScopeIDIssue = parsedBody.error.issues.some((issue) => issue.path.join('.') === 'options.user_scope.0.id' || issue.path.join('.').startsWith('options.user_scope.'));
-                    throw new CLIError('BODY_VALIDATION_FAILED', hasUserScopeIDIssue ? 'access-rule assign-users requires body.options.user_scope[].id to be numeric TenantUser.ID' : message, 2, buildAssignUsersValidationDetails(scope, command, command.requestType, hasUserScopeIDIssue ? 'body.options.user_scope' : 'body', hasUserScopeIDIssue ? 'access-rule assign-users requires body.options.user_scope[].id to be numeric TenantUser.ID' : message, runtimeEnv));
+                    throw new CLIError('BODY_VALIDATION_FAILED', hasUserScopeIDIssue ? 'access-rule assign-users requires body.options.user_scope[].id to be numeric arcubaseUserId' : message, 2, buildAssignUsersValidationDetails(scope, command, command.requestType, hasUserScopeIDIssue ? 'body.options.user_scope' : 'body', hasUserScopeIDIssue ? 'access-rule assign-users requires body.options.user_scope[].id to be numeric arcubaseUserId' : message, runtimeEnv));
                 }
                 throw new CLIError('BODY_VALIDATION_FAILED', message, 2, buildBodyValidationDetails(scope, command, command.requestType, parsedBody.error.issues.map((issue) => ({
                     path: issue.path.length > 0 ? `body.${issue.path.join('.')}` : 'body',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@carthooks/arcubase-cli",
-  "version": "0.1.16",
+  "version": "0.1.17",
   "description": "Arcubase runtime CLI for admin and user command execution",
   "type": "module",
   "main": "./dist/index.js",

package/sdk-dist/docs/runtime-reference/access-rule.md

@@ -4,7 +4,7 @@ Use `arcubase-admin access-rule` for app/table access.
 
 ## One Path
 
-1. Get the numeric `TenantUser.ID`.
+1. Get the numeric `arcubaseUserId`.
 2. Create an enabled rule with `options.policy`.
 3. Assign users with `options.user_scope`.
 4. Verify with `access-rule get`.
@@ -15,9 +15,9 @@ Use `arcubase-admin access-rule` for app/table access.
 arcubase-admin get-digiemployee-users
 ```
 
-Use the numeric `tenantUserId` / `TenantUser.ID`.
+Use the numeric `arcubaseUserId`.
 
-Do not use hash ids such as `arcubaseTenantUserId`.
+Do not use non-numeric Arcubase user ids in `user_scope[].id`.
 Use `user_scope[].type:"user"` for a tenant user. Do not use FieldVO field type `member` in access rules.
 
 ## Body Input
@@ -107,8 +107,8 @@ Rules:
 - `assign-users` preserves the existing policy.
 - body must use `update:["user_scope"]`.
 - body must use `options.user_scope`.
-- `user_scope[].type` is `user` for tenant users.
-- `user_scope[].id` is numeric `TenantUser.ID`.
+- `user_scope[].type` is `user` for Arcubase organization users.
+- `user_scope[].id` is the numeric `arcubaseUserId`.
 
 ## Verify
 

package/src/runtime/execute.ts

@@ -140,9 +140,9 @@ export function renderCommandHelp(scope: CommandScope, moduleName: string, comma
           '  - {"update":["user_scope"],"options":{"user_scope":[{"type":"user","id":2188889901}]}}',
           'success requires:',
           '  - result.enabled must be true',
-          '  - result.options.user_scope must contain the assigned numeric TenantUser.ID values',
-          '  - PermitUserScope.id must be numeric TenantUser.ID',
-          '  - Do not copy hash arcubaseTenantUserId into PermitUserScope.id',
+          '  - result.options.user_scope must contain the assigned numeric arcubaseUserId values',
+          '  - PermitUserScope.id must be the numeric arcubaseUserId',
+          '  - Do not copy a non-numeric arcubaseUserId into PermitUserScope.id',
           '  - If result.enabled is false, enable the rule first and retry assign-users',
         ]
       : []),
@@ -703,8 +703,8 @@ function buildAssignUsersValidationDetails(
     commonMistakes: [
       'do not use user_scope at top level',
       'do not use users or allowedUsers',
-      'do not use hash tenant user id as id',
-      'id must be numeric TenantUser.ID',
+      'do not use non-numeric arcubaseUserId as id',
+      'id must be the numeric arcubaseUserId',
     ],
   }
 }
@@ -1036,7 +1036,7 @@ function validateAccessRuleUserScope(
     }
     if (typeof item.id !== 'number' || !Number.isInteger(item.id) || item.id <= 0) {
       throwBodyValidationFailure(
-        'access-rule user_scope[].id must be numeric TenantUser.ID, department ID, or actor ID',
+        'access-rule user_scope[].id must be numeric arcubaseUserId, department ID, or actor ID',
         requestType,
         `${pathPrefix}.${index}.id`,
         scope,
@@ -1266,7 +1266,7 @@ function validateActionSpecificBody(
       }
       if (typeof item.id !== 'number' || !Number.isInteger(item.id) || item.id <= 0) {
         throwBodyValidationFailure(
-          'access-rule assign-users requires body.options.user_scope[].id to be numeric TenantUser.ID',
+          'access-rule assign-users requires body.options.user_scope[].id to be numeric arcubaseUserId',
           command.requestType,
           `body.options.user_scope.${index}.id`,
           scope,
@@ -2110,14 +2110,14 @@ export async function executeCLI(scope: CommandScope, argv: string[], env?: Runt
           const hasUserScopeIDIssue = parsedBody.error.issues.some((issue) => issue.path.join('.') === 'options.user_scope.0.id' || issue.path.join('.').startsWith('options.user_scope.'))
           throw new CLIError(
             'BODY_VALIDATION_FAILED',
-            hasUserScopeIDIssue ? 'access-rule assign-users requires body.options.user_scope[].id to be numeric TenantUser.ID' : message,
+            hasUserScopeIDIssue ? 'access-rule assign-users requires body.options.user_scope[].id to be numeric arcubaseUserId' : message,
             2,
             buildAssignUsersValidationDetails(
               scope,
               command,
               command.requestType,
               hasUserScopeIDIssue ? 'body.options.user_scope' : 'body',
-              hasUserScopeIDIssue ? 'access-rule assign-users requires body.options.user_scope[].id to be numeric TenantUser.ID' : message,
+              hasUserScopeIDIssue ? 'access-rule assign-users requires body.options.user_scope[].id to be numeric arcubaseUserId' : message,
               runtimeEnv,
             )
           )

package/src/tests/execute_validation.test.ts

@@ -61,8 +61,8 @@ function assertAssignUsersGuidance(error: unknown, messagePattern?: RegExp): boo
   assert.deepEqual(error.details?.commonMistakes, [
     'do not use user_scope at top level',
     'do not use users or allowedUsers',
-    'do not use hash tenant user id as id',
-    'id must be numeric TenantUser.ID',
+    'do not use non-numeric arcubaseUserId as id',
+    'id must be the numeric arcubaseUserId',
   ])
   assert.ok(error.details?.tsHints?.some((item) => item.symbol === 'AppIngressUpdateReqVO' && item.file === '/runtime/arcubase-sdk/types/ingress.ts'))
   assert.ok(error.details?.tsHints?.some((item) => item.symbol === 'EntityIngressOptions' && item.file === '/runtime/arcubase-sdk/types/ingress.ts'))
@@ -1329,7 +1329,7 @@ test('access-rule assign-users rejects non-user member scope type', async () =>
   }, (error: unknown) => assertAssignUsersGuidance(error, /type.*user/))
 })
 
-test('access-rule assign-users rejects hash tenant user id', async () => {
+test('access-rule assign-users rejects non-numeric arcubaseUserId', async () => {
   await assert.rejects(async () => {
     await executeCLI(
       'admin',
@@ -1337,7 +1337,7 @@ test('access-rule assign-users rejects hash tenant user id', async () => {
       env as any,
       async () => new Response('{}', { status: 200 }),
     )
-  }, (error: unknown) => assertAssignUsersGuidance(error, /numeric TenantUser.ID/))
+  }, (error: unknown) => assertAssignUsersGuidance(error, /numeric arcubaseUserId/))
 })
 
 test('access-rule assign-users accepts canonical user_scope body', async () => {

package/src/tests/help.test.ts

@@ -121,11 +121,24 @@ test('admin access-rule help gives update whitelist and assign-users body-json e
   assert.equal(assign.kind, 'help')
   assert.match(assign.text, /"update":\["user_scope"\]/)
   assert.match(assign.text, /\{"update":\["user_scope"\],"options":\{"user_scope":\[\{"type":"user","id":2188889901\}\]\}\}/)
+  assert.match(assign.text, /arcubaseUserId/)
+  assert.doesNotMatch(assign.text, forbiddenArcubaseUserTerms())
   assert.doesNotMatch(assign.text, /"type":"member"/)
   assert.doesNotMatch(assign.text, /"users"/)
   assert.doesNotMatch(assign.text, /"allowedUsers"/)
 })
 
+test('admin assign-users help uses arcubaseUserId terminology', async () => {
+  const help = await executeCLI('admin', ['access-rule', 'assign-users', '--help'], env as any, async () => new Response('{}'))
+  assert.equal(help.kind, 'help')
+  assert.doesNotMatch(help.text, forbiddenArcubaseUserTerms())
+  assert.match(help.text, /arcubaseUserId/)
+})
+
+function forbiddenArcubaseUserTerms(): RegExp {
+  return new RegExp(['tenant' + 'UserId', 'TenantUser' + String.raw`\.ID`, 'tenant user' + ' id'].join('|'), 'i')
+}
+
 test('every body command help exposes readable TypeScript type paths', async () => {
   for (const scope of ['admin', 'user'] as const satisfies readonly CommandScope[]) {
     for (const command of listCommands(scope).filter((item) => item.requestType)) {