@carthooks/arcubase-cli 0.1.8 → 0.1.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@carthooks/arcubase-cli",
-  "version": "0.1.8",
+  "version": "0.1.9",
   "description": "Arcubase runtime CLI for admin and user command execution",
   "type": "module",
   "main": "./dist/index.js",

package/src/runtime/execute.ts

@@ -93,6 +93,23 @@ export function renderCommandHelp(scope: CommandScope, moduleName: string, comma
           '  - row query: arcubase row query --app-id <app_id> --table-id <table_id> --body-file query.json',
         ]
       : []),
+    ...(scope === 'admin' && command.commandPath[0] === 'access-rule' && command.commandPath[1] === 'update'
+      ? [
+          'body-json examples:',
+          '  - enable: {"update":["enabled"],"enabled":true}',
+          '  - rename: {"update":["name"],"name":"Sales read only"}',
+          '  - update options: {"update":["options"],"options":{"user_scope":[{"type":"user","id":123}]}}',
+        ]
+      : []),
+    ...(scope === 'admin' && command.commandPath[0] === 'access-rule' && command.commandPath[1] === 'assign-users'
+      ? [
+          'body-json example:',
+          '  - {"update":["user_scope"],"options":{"user_scope":[{"type":"user","id":123}]}}',
+          'success requires:',
+          '  - result.enabled must be true',
+          '  - result.options.user_scope must contain the assigned user ids',
+        ]
+      : []),
     ...(docHints.length > 0
       ? ['docs:', ...docHints.map((item) => `  - ${item.title}: ${item.file}`)]
       : []),
@@ -333,6 +350,51 @@ function throwBodyValidationFailure(message: string, requestType: string, path:
   })
 }
 
+function stringArray(value: unknown): string[] {
+  return Array.isArray(value) ? value.filter((item): item is string => typeof item === 'string') : []
+}
+
+function requireUpdateContains(
+  scope: CommandScope,
+  command: NonNullable<ReturnType<typeof findCommand>>,
+  body: Record<string, unknown>,
+  field: string,
+) {
+  if (!(field in body)) return
+  const update = stringArray(body.update)
+  if (!update.includes(field)) {
+    throwBodyValidationFailure(
+      `body.update must include "${field}" when body.${field} is present. Example: {"update":["${field}"],"${field}":${field === 'enabled' ? 'true' : '"value"'}}`,
+      command.requestType ?? 'AppIngressUpdateReqVO',
+      'body.update',
+      scope,
+      command,
+    )
+  }
+}
+
+function validateActionSpecificRawBody(
+  scope: CommandScope,
+  command: NonNullable<ReturnType<typeof findCommand>>,
+  body: unknown,
+) {
+  if (!isRecord(body) || !command.requestType) {
+    return
+  }
+
+  if (scope === 'admin' && command.commandPath[0] === 'access-rule' && command.commandPath[1] === 'assign-users') {
+    if ('users' in body || 'allowedUsers' in body) {
+      throwBodyValidationFailure(
+        'access-rule assign-users does not accept users or allowedUsers; use body.options.user_scope with {"update":["user_scope"],"options":{"user_scope":[{"type":"user","id":123}]}}',
+        command.requestType,
+        'body.options.user_scope',
+        scope,
+        command,
+      )
+    }
+  }
+}
+
 function validateActionSpecificBody(
   scope: CommandScope,
   command: NonNullable<ReturnType<typeof findCommand>>,
@@ -343,6 +405,45 @@ function validateActionSpecificBody(
     return
   }
 
+  if (scope === 'admin' && command.commandPath[0] === 'access-rule' && command.commandPath[1] === 'update') {
+    requireUpdateContains(scope, command, body, 'enabled')
+    requireUpdateContains(scope, command, body, 'name')
+    requireUpdateContains(scope, command, body, 'options')
+  }
+
+  if (scope === 'admin' && command.commandPath[0] === 'access-rule' && command.commandPath[1] === 'assign-users') {
+    const update = stringArray(body.update)
+    const options = isRecord(body.options) ? body.options : undefined
+    const userScope = options && Array.isArray(options.user_scope) ? options.user_scope : undefined
+    if ('users' in body || 'allowedUsers' in body) {
+      throwBodyValidationFailure(
+        'access-rule assign-users does not accept users or allowedUsers; use body.options.user_scope with {"update":["user_scope"],"options":{"user_scope":[{"type":"user","id":123}]}}',
+        command.requestType,
+        'body.options.user_scope',
+        scope,
+        command,
+      )
+    }
+    if (!update.includes('user_scope')) {
+      throwBodyValidationFailure(
+        'access-rule assign-users requires body.update to include "user_scope"',
+        command.requestType,
+        'body.update',
+        scope,
+        command,
+      )
+    }
+    if (!userScope || userScope.length === 0) {
+      throwBodyValidationFailure(
+        'access-rule assign-users requires non-empty body.options.user_scope',
+        command.requestType,
+        'body.options.user_scope',
+        scope,
+        command,
+      )
+    }
+  }
+
   if (command.commandPath[0] === 'row' && command.commandPath[1] === 'selection-action') {
     const action = flagValue(flags, 'action')
     const selection = body.selection
@@ -469,6 +570,7 @@ export async function executeCLI(scope: CommandScope, argv: string[], env?: Runt
     if (body === undefined) {
       throw new CLIError('MISSING_BODY_FILE', `command requires --body-file or --body-json for ${command.requestType}`, 2)
     }
+    validateActionSpecificRawBody(scope, command, body)
     const schema = getBodySchema(command.requestType)
     if (schema) {
       const parsedBody = schema.safeParse(body)

package/src/tests/execute_validation.test.ts

@@ -463,3 +463,77 @@ test('entry passes include_app_tables query flag', async () => {
   assert.equal(out.kind, 'result')
   assert.equal(out.data.url, 'https://arcubase.example.com/api/entry?include_app_tables=true')
 })
+
+test('access-rule update rejects enabled without update whitelist', async () => {
+  await assert.rejects(async () => {
+    await executeCLI(
+      'admin',
+      ['access-rule', 'update', '--app-id', 'app_1', '--table-id', 'table_1', '--rule-id', 'rule_1', '--body-json', '{"enabled":true}'],
+      env as any,
+      async () => new Response('{}', { status: 200 }),
+    )
+  }, (error: unknown) => {
+    assert.ok(error instanceof CLIError)
+    assert.equal(error.code, 'BODY_VALIDATION_FAILED')
+    assert.match(error.message, /update.*enabled/)
+    assert.equal(error.details?.requestType, 'AppIngressUpdateReqVO')
+    assert.ok((error.details?.tsHints ?? []).some((item) => item.file === '/opt/arcubase-sdk/types/ingress.ts'))
+    return true
+  })
+})
+
+test('access-rule update accepts enabled with update whitelist', async () => {
+  const out = await executeCLI(
+    'admin',
+    ['access-rule', 'update', '--app-id', 'app_1', '--table-id', 'table_1', '--rule-id', 'rule_1', '--body-json', '{"update":["enabled"],"enabled":true}'],
+    env as any,
+    async (_url, init) => new Response(String(init?.body ?? '{}'), { status: 200 }),
+  )
+  assert.equal(out.kind, 'result')
+  assert.deepEqual(out.data, { update: ['enabled'], enabled: true })
+})
+
+test('access-rule assign-users rejects users shortcut', async () => {
+  await assert.rejects(async () => {
+    await executeCLI(
+      'admin',
+      ['access-rule', 'assign-users', '--app-id', 'app_1', '--table-id', 'table_1', '--rule-id', 'rule_1', '--body-json', '{"users":["tu_1"]}'],
+      env as any,
+      async () => new Response('{}', { status: 200 }),
+    )
+  }, (error: unknown) => {
+    assert.ok(error instanceof CLIError)
+    assert.equal(error.code, 'BODY_VALIDATION_FAILED')
+    assert.match(error.message, /options.user_scope/)
+    assert.equal(error.details?.requestType, 'AppIngressUpdateReqVO')
+    return true
+  })
+})
+
+test('access-rule assign-users requires update user_scope and non-empty user_scope', async () => {
+  await assert.rejects(async () => {
+    await executeCLI(
+      'admin',
+      ['access-rule', 'assign-users', '--app-id', 'app_1', '--table-id', 'table_1', '--rule-id', 'rule_1', '--body-json', '{"update":["user_scope"],"options":{"user_scope":[]}}'],
+      env as any,
+      async () => new Response('{}', { status: 200 }),
+    )
+  }, (error: unknown) => {
+    assert.ok(error instanceof CLIError)
+    assert.equal(error.code, 'BODY_VALIDATION_FAILED')
+    assert.match(error.message, /non-empty/)
+    return true
+  })
+})
+
+test('access-rule assign-users accepts canonical user_scope body', async () => {
+  const out = await executeCLI(
+    'admin',
+    ['access-rule', 'assign-users', '--app-id', 'app_1', '--table-id', 'table_1', '--rule-id', 'rule_1', '--body-json', '{"update":["user_scope"],"options":{"user_scope":[{"type":"user","id":123}]}}'],
+    env as any,
+    async (_url, init) => new Response(String(init?.body ?? '{}'), { status: 200 }),
+  )
+  assert.equal(out.kind, 'result')
+  assert.deepEqual(out.data.update, ['user_scope'])
+  assert.deepEqual(out.data.options.user_scope, [{ type: 'user', id: 123 }])
+})

package/src/tests/help.test.ts

@@ -64,3 +64,17 @@ test('admin table update-schema help uses table nouns and body-json', async () =
   assert.doesNotMatch(out.text, /--entity-id/)
   assert.doesNotMatch(out.text, /admin-save-entity/)
 })
+
+test('admin access-rule help gives update whitelist and assign-users body-json examples', async () => {
+  const update = await executeCLI('admin', ['access-rule', 'update', '--help'], undefined, async () => new Response('{}'))
+  assert.equal(update.kind, 'help')
+  assert.match(update.text, /--app-id/)
+  assert.match(update.text, /--table-id/)
+  assert.match(update.text, /--rule-id/)
+  assert.match(update.text, /"update":\["enabled"\]/)
+
+  const assign = await executeCLI('admin', ['access-rule', 'assign-users', '--help'], undefined, async () => new Response('{}'))
+  assert.equal(assign.kind, 'help')
+  assert.match(assign.text, /"update":\["user_scope"\]/)
+  assert.match(assign.text, /"options":\{"user_scope":\[/)
+})