@celonis/content-cli 1.5.0 → 1.6.0

package/commands/configuration-management/api/batch-import-export-api.js

@@ -57,6 +57,16 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
                 });
             });
         }
+        findPackagesByKeysAndVersion(packageKeysWithVersion, withDependencies = false) {
+            return __awaiter(this, void 0, void 0, function* () {
+                const queryParams = new URLSearchParams();
+                packageKeysWithVersion.forEach(keyWithVersion => queryParams.append("packageKeysWithVersion", keyWithVersion));
+                queryParams.set("withDependencies", withDependencies.toString());
+                return this.httpClient().get(`/package-manager/api/core/packages/versions/export/list?${queryParams.toString()}`).catch(e => {
+                    throw new logger_1.FatalError(`Problem getting packages by keys and versions: ${e}`);
+                });
+            });
+        }
         exportPackages(packageKeys, withDependencies) {
             return __awaiter(this, void 0, void 0, function* () {
                 const queryParams = new URLSearchParams();

package/commands/configuration-management/batch-import-export.service.js

@@ -47,10 +47,13 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
                 });
             });
         }
-        findAndExportListOfActivePackages(flavors, packageKeys, withDependencies) {
+        findAndExportListOfPackages(flavors, packageKeys, keysByVersion, withDependencies) {
             return __awaiter(this, void 0, void 0, function* () {
                 let packagesToExport;
-                if (packageKeys.length) {
+                if (keysByVersion.length) {
+                    packagesToExport = yield this.batchImportExportApi.findPackagesByKeysAndVersion(keysByVersion, withDependencies);
+                }
+                else if (packageKeys.length) {
                     packagesToExport = yield this.batchImportExportApi.findActivePackagesByKeys(packageKeys, withDependencies);
                 }
                 else {
@@ -60,6 +63,14 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
                 this.exportListOfPackages(packagesToExport);
             });
         }
+        listPackagesByKeysWithVersion(keysByVersion, withDependencies) {
+            return __awaiter(this, void 0, void 0, function* () {
+                const exportedPackages = yield this.batchImportExportApi.findPackagesByKeysAndVersion(keysByVersion, withDependencies);
+                exportedPackages.forEach(pkg => {
+                    logger_1.logger.info(`${pkg.name} - Key: "${pkg.key}"`);
+                });
+            });
+        }
         batchExportPackages(packageKeys, packageKeysByVersion, withDependencies, gitBranch, unzip) {
             return __awaiter(this, void 0, void 0, function* () {
                 let exportedPackagesData;

package/commands/configuration-management/config-command.service.js

@@ -29,14 +29,17 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
             this.variableService = new variable_service_1.VariableService(context);
             this.diffService = new diff_service_1.DiffService(context);
         }
-        listActivePackages(jsonResponse, flavors, withDependencies, packageKeys, variableValue, variableType) {
+        listPackages(jsonResponse, flavors, withDependencies, packageKeys, keysByVersion, variableValue, variableType) {
             return __awaiter(this, void 0, void 0, function* () {
                 if (variableValue) {
                     yield this.listPackagesByVariableValue(jsonResponse, flavors, variableValue, variableType);
                     return;
                 }
                 if (jsonResponse) {
-                    yield this.batchImportExportService.findAndExportListOfActivePackages(flavors !== null && flavors !== void 0 ? flavors : [], packageKeys !== null && packageKeys !== void 0 ? packageKeys : [], withDependencies);
+                    yield this.batchImportExportService.findAndExportListOfPackages(flavors !== null && flavors !== void 0 ? flavors : [], packageKeys !== null && packageKeys !== void 0 ? packageKeys : [], keysByVersion !== null && keysByVersion !== void 0 ? keysByVersion : [], withDependencies);
+                }
+                else if (keysByVersion) {
+                    yield this.batchImportExportService.listPackagesByKeysWithVersion(keysByVersion, withDependencies);
                 }
                 else {
                     yield this.batchImportExportService.listActivePackages(flavors !== null && flavors !== void 0 ? flavors : []);

package/commands/configuration-management/module.js

@@ -31,14 +31,15 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
         register(context, configurator) {
             const configCommand = configurator.command("config");
             configCommand.command("list")
-                .description("Command to list active packages that can be exported")
+                .description("Command to list packages")
                 .option("--json", "Return response as json type", "")
                 .option("--flavors <flavors...>", "Lists only active packages of the given flavors")
                 .option("--withDependencies", "Include dependencies", "")
-                .option("--packageKeys <packageKeys...>", "Lists only given package keys")
+                .option("--packageKeys <packageKeys...>", "Lists only active versions of given package keys")
+                .option("--keysByVersion <keysByVersion...>", "Lists packages by given key and version [packageKey.version]")
                 .option("--variableValue <variableValue>", "Variable value for filtering packages by.")
                 .option("--variableType <variableType>", "Variable type for filtering packages by.")
-                .action(this.listActivePackages);
+                .action(this.listPackages);
             configCommand.command("export")
                 .description("Command to export package configs")
                 .option("--packageKeys <packageKeys...>", "Keys of packages to export. Exports the latest deployed version only")
@@ -130,9 +131,12 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
                 .option("--params <params>", "Variable query params")
                 .action(this.listAssignments);
         }
-        listActivePackages(context, command, options) {
+        listPackages(context, command, options) {
             return __awaiter(this, void 0, void 0, function* () {
-                yield new config_command_service_1.ConfigCommandService(context).listActivePackages(options.json, options.flavors, options.withDependencies, options.packageKeys, options.variableValue, options.variableType);
+                if (options.packageKeys && options.keysByVersion) {
+                    throw new Error("Please provide either --packageKeys or --keysByVersion, but not both.");
+                }
+                yield new config_command_service_1.ConfigCommandService(context).listPackages(options.json, options.flavors, options.withDependencies, options.packageKeys, options.keysByVersion, options.variableValue, options.variableType);
             });
         }
         batchExportPackages(context, command, options) {

package/core/profile/profile.service.js

@@ -30,8 +30,10 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     const homedir = os.homedir();
     // use 5 seconds buffer to avoid rare cases when accessToken is just about to expire before the command is sent
     const expiryBuffer = 5000;
-    const deviceCodeScopes = ["studio", "package-manager", "integration.data-pools", "action-engine.projects"];
-    const clientCredentialsScopes = ["studio", "integration.data-pools", "action-engine.projects", "package-manager"];
+    /** All OAuth scopes; used for both device code and client credentials. */
+    const OAUTH_SCOPES = ["studio", "package-manager", "integration.data-pools", "action-engine.projects"];
+    /** Device code fallback: try without action-engine.projects if all 4 scopes fail. */
+    const DEVICE_CODE_SCOPES_WITHOUT_ACTION_ENGINE = ["studio", "package-manager", "integration.data-pools"];
     class ProfileService {
         constructor() {
             this.profileContainerPath = path.resolve(homedir, ".celonis-content-cli-profiles");
@@ -165,65 +167,56 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
                         }
                         break;
                     case profile_interface_1.ProfileType.DEVICE_CODE:
-                        try {
-                            const deviceCodeIssuer = yield openid_client_1.Issuer.discover(profile.team);
-                            const deviceCodeOAuthClient = new deviceCodeIssuer.Client({
-                                client_id: "content-cli",
-                                token_endpoint_auth_method: "none",
-                            });
-                            const deviceCodeHandle = yield deviceCodeOAuthClient.deviceAuthorization({
-                                scope: deviceCodeScopes.join(" ")
-                            });
-                            logger_1.logger.info(`Continue authorization here: ${deviceCodeHandle.verification_uri_complete}`);
-                            const deviceCodeTokenSet = yield deviceCodeHandle.poll();
-                            profile.apiToken = deviceCodeTokenSet.access_token;
-                            profile.refreshToken = deviceCodeTokenSet.refresh_token;
-                            profile.expiresAt = deviceCodeTokenSet.expires_at;
+                        const deviceCodeIssuer = yield openid_client_1.Issuer.discover(profile.team);
+                        const deviceCodeOAuthClient = new deviceCodeIssuer.Client({
+                            client_id: "content-cli",
+                            token_endpoint_auth_method: "none",
+                        });
+                        const deviceCodeScopeAttempts = [OAUTH_SCOPES, DEVICE_CODE_SCOPES_WITHOUT_ACTION_ENGINE];
+                        let deviceCodeSuccess = false;
+                        for (const scopeList of deviceCodeScopeAttempts) {
+                            try {
+                                const deviceCodeHandle = yield deviceCodeOAuthClient.deviceAuthorization({
+                                    scope: scopeList.join(" "),
+                                });
+                                logger_1.logger.info(`Continue authorization here: ${deviceCodeHandle.verification_uri_complete}`);
+                                const deviceCodeTokenSet = yield deviceCodeHandle.poll();
+                                profile.apiToken = deviceCodeTokenSet.access_token;
+                                profile.refreshToken = deviceCodeTokenSet.refresh_token;
+                                profile.expiresAt = deviceCodeTokenSet.expires_at;
+                                deviceCodeSuccess = true;
+                                break;
+                            }
+                            catch (err) {
+                                // This scope set failed; try next or fail below
+                            }
                         }
-                        catch (err) {
-                            logger_1.logger.error(new logger_1.FatalError("The provided team is wrong."));
-                            logger_1.logger.error(err);
+                        if (!deviceCodeSuccess) {
+                            throw new logger_1.FatalError("Device code authorization failed. The provided team or requested scopes may be invalid.");
                         }
                         break;
                     case profile_interface_1.ProfileType.CLIENT_CREDENTIALS:
                         const clientCredentialsIssuer = yield openid_client_1.Issuer.discover(profile.team);
-                        try {
-                            // try with client secret basic
-                            const clientCredentialsOAuthClient = new clientCredentialsIssuer.Client({
-                                client_id: profile.clientId,
-                                client_secret: profile.clientSecret,
-                                token_endpoint_auth_method: profile_interface_1.ClientAuthenticationMethod.CLIENT_SECRET_BASIC,
-                            });
-                            const clientCredentialsTokenSet = yield clientCredentialsOAuthClient.grant({
-                                grant_type: "client_credentials",
-                                scope: clientCredentialsScopes.join(" ")
-                            });
+                        const basicResult = yield this.tryClientCredentialsGrant(clientCredentialsIssuer, profile, profile_interface_1.ClientAuthenticationMethod.CLIENT_SECRET_BASIC);
+                        if (basicResult) {
                             profile.clientAuthenticationMethod = profile_interface_1.ClientAuthenticationMethod.CLIENT_SECRET_BASIC;
-                            profile.apiToken = clientCredentialsTokenSet.access_token;
-                            profile.expiresAt = clientCredentialsTokenSet.expires_at;
+                            profile.apiToken = basicResult.tokenSet.access_token;
+                            profile.expiresAt = basicResult.tokenSet.expires_at;
+                            profile.scopes = basicResult.scopes;
                         }
-                        catch (e) {
-                            try {
-                                // try with client secret post
-                                const clientCredentialsOAuthClient = new clientCredentialsIssuer.Client({
-                                    client_id: profile.clientId,
-                                    client_secret: profile.clientSecret,
-                                    token_endpoint_auth_method: profile_interface_1.ClientAuthenticationMethod.CLIENT_SECRET_POST,
-                                });
-                                const clientCredentialsTokenSet = yield clientCredentialsOAuthClient.grant({
-                                    grant_type: "client_credentials",
-                                    scope: clientCredentialsScopes.join(" ")
-                                });
+                        else {
+                            const postResult = yield this.tryClientCredentialsGrant(clientCredentialsIssuer, profile, profile_interface_1.ClientAuthenticationMethod.CLIENT_SECRET_POST);
+                            if (postResult) {
                                 profile.clientAuthenticationMethod = profile_interface_1.ClientAuthenticationMethod.CLIENT_SECRET_POST;
-                                profile.apiToken = clientCredentialsTokenSet.access_token;
-                                profile.expiresAt = clientCredentialsTokenSet.expires_at;
+                                profile.apiToken = postResult.tokenSet.access_token;
+                                profile.expiresAt = postResult.tokenSet.expires_at;
+                                profile.scopes = postResult.scopes;
                             }
-                            catch (err) {
-                                logger_1.logger.error(new logger_1.FatalError("The OAuth client configuration is incorrect. " +
-                                    "Check the id, secret and scopes for correctness."));
+                            else {
+                                throw new logger_1.FatalError("The OAuth client configuration is incorrect. " +
+                                    "Check the id, secret and allowed scopes for this client.");
                             }
                         }
-                        profile.scopes = [...clientCredentialsScopes];
                         break;
                     default:
                         logger_1.logger.error(new logger_1.FatalError("Unsupported profile type"));
@@ -330,6 +323,75 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
                 delete process.env.API_TOKEN;
             }
         }
+        /**
+         * Returns all non-empty combinations of scopes, ordered by size descending (4, then 3, 2, 1).
+         * Order within a combination does not matter; each set is tried once.
+         */
+        getScopeCombinationsOrderedBySize(scopes) {
+            function combinations(arr, k) {
+                if (k === 0)
+                    return [[]];
+                if (k > arr.length)
+                    return [];
+                const result = [];
+                for (let i = 0; i <= arr.length - k; i++) {
+                    const rest = combinations(arr.slice(i + 1), k - 1);
+                    rest.forEach(r => result.push([arr[i], ...r]));
+                }
+                return result;
+            }
+            return [
+                ...combinations(scopes, 4),
+                ...combinations(scopes, 3),
+                ...combinations(scopes, 2),
+                ...combinations(scopes, 1),
+            ];
+        }
+        /**
+         * Tries to obtain a client_credentials token. First tries with all scopes (including
+         * action-engine.projects); if no token is returned, tries again without action-engine.projects.
+         * Returns { tokenSet, scopes } or null if no grant succeeded.
+         */
+        tryClientCredentialsGrant(issuer, profile, tokenEndpointAuthMethod) {
+            return __awaiter(this, void 0, void 0, function* () {
+                const Client = issuer.Client;
+                const client = new Client({
+                    client_id: profile.clientId,
+                    client_secret: profile.clientSecret,
+                    token_endpoint_auth_method: tokenEndpointAuthMethod,
+                });
+                const scopeAttempts = this.getScopeCombinationsOrderedBySize(OAUTH_SCOPES);
+                for (const scopeList of scopeAttempts) {
+                    try {
+                        const tokenSet = yield client.grant({
+                            grant_type: "client_credentials",
+                            scope: scopeList.join(" "),
+                        });
+                        if (tokenSet && tokenSet.access_token) {
+                            const scopes = this.extractScopesFromTokenSet(tokenSet, scopeList);
+                            return { tokenSet, scopes };
+                        }
+                    }
+                    catch (_e) {
+                        // This scope set failed (e.g. invalid_scope); try next
+                    }
+                }
+                return null;
+            });
+        }
+        /**
+         * Extracts granted scopes from the token response (OAuth 2.0 scope parameter).
+         * Used at profile creation so we store the scopes the server actually granted for this client.
+         */
+        extractScopesFromTokenSet(tokenSet, fallbackScopes) {
+            if (tokenSet.scope && typeof tokenSet.scope === "string") {
+                const scopes = tokenSet.scope.trim().split(/\s+/).filter(Boolean);
+                if (scopes.length > 0) {
+                    return scopes;
+                }
+            }
+            return [...fallbackScopes];
+        }
     }
     exports.ProfileService = ProfileService;
     exports.profileService = new ProfileService();

package/lib/commands/configuration-management/api/batch-import-export-api.d.ts

@@ -8,6 +8,7 @@ export declare class BatchImportExportApi {
     findAllActivePackages(flavors: string[], withDependencies?: boolean): Promise<PackageExportTransport[]>;
     findActivePackagesByVariableValue(flavors: string[], variableValue: string, variableType: string): Promise<PackageExportTransport[]>;
     findActivePackagesByKeys(packageKeys: string[], withDependencies?: boolean): Promise<PackageExportTransport[]>;
+    findPackagesByKeysAndVersion(packageKeysWithVersion: string[], withDependencies?: boolean): Promise<PackageExportTransport[]>;
     exportPackages(packageKeys: string[], withDependencies: boolean): Promise<Buffer>;
     exportPackagesByVersions(packageKeysWithVersion: string[], withDependencies: boolean): Promise<Buffer>;
     batchExportPackagesMetadata(packageKeys: string[]): Promise<PackageMetadataExportTransport[]>;

package/lib/commands/configuration-management/batch-import-export.service.d.ts

@@ -6,7 +6,8 @@ export declare class BatchImportExportService {
     private gitService;
     constructor(context: Context);
     listActivePackages(flavors: string[]): Promise<void>;
-    findAndExportListOfActivePackages(flavors: string[], packageKeys: string[], withDependencies: boolean): Promise<void>;
+    findAndExportListOfPackages(flavors: string[], packageKeys: string[], keysByVersion: string[], withDependencies: boolean): Promise<void>;
+    listPackagesByKeysWithVersion(keysByVersion: string[], withDependencies: boolean): Promise<void>;
     batchExportPackages(packageKeys: string[], packageKeysByVersion: string[], withDependencies: boolean, gitBranch: string, unzip: boolean): Promise<void>;
     batchExportPackagesMetadata(packageKeys: string[], jsonResponse: boolean): Promise<void>;
     batchImportPackages(sourcePath: string, overwrite: boolean, gitBranch: string): Promise<void>;

package/lib/commands/configuration-management/config-command.service.d.ts

@@ -4,7 +4,7 @@ export declare class ConfigCommandService {
     private variableService;
     private diffService;
     constructor(context: Context);
-    listActivePackages(jsonResponse: boolean, flavors: string[], withDependencies: boolean, packageKeys: string[], variableValue: string, variableType: string): Promise<void>;
+    listPackages(jsonResponse: boolean, flavors: string[], withDependencies: boolean, packageKeys: string[], keysByVersion: string[], variableValue: string, variableType: string): Promise<void>;
     listVariables(jsonResponse: boolean, keysByVersion: string[], keysByVersionFile: string): Promise<void>;
     batchExportPackages(packageKeys: string[], packageKeysByVersion: string[], withDependencies: boolean, gitBranch: string, unzip: boolean): Promise<void>;
     batchExportPackagesMetadata(packageKeys: string[], jsonResponse: boolean): Promise<void>;

package/lib/commands/configuration-management/module.d.ts

@@ -5,7 +5,7 @@ import { Configurator, IModule } from "../../core/command/module-handler";
 import { Context } from "../../core/command/cli-context";
 declare class Module extends IModule {
     register(context: Context, configurator: Configurator): void;
-    private listActivePackages;
+    private listPackages;
     private batchExportPackages;
     private batchExportPackagesMetadata;
     private getPackageVersion;

package/lib/core/profile/profile.service.d.ts

@@ -23,5 +23,21 @@ export declare class ProfileService {
     private tryKeyAuthentication;
     private checkIfMissingProfile;
     private mapCelonisEnvProfile;
+    /**
+     * Returns all non-empty combinations of scopes, ordered by size descending (4, then 3, 2, 1).
+     * Order within a combination does not matter; each set is tried once.
+     */
+    private getScopeCombinationsOrderedBySize;
+    /**
+     * Tries to obtain a client_credentials token. First tries with all scopes (including
+     * action-engine.projects); if no token is returned, tries again without action-engine.projects.
+     * Returns { tokenSet, scopes } or null if no grant succeeded.
+     */
+    private tryClientCredentialsGrant;
+    /**
+     * Extracts granted scopes from the token response (OAuth 2.0 scope parameter).
+     * Used at profile creation so we store the scopes the server actually granted for this client.
+     */
+    private extractScopesFromTokenSet;
 }
 export declare const profileService: ProfileService;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@celonis/content-cli",
-  "version": "1.5.0",
+  "version": "1.6.0",
   "description": "CLI Tool to help manage content in Celonis Platform",
   "main": "content-cli.js",
   "bin": {
@@ -18,9 +18,9 @@
     "node": ">=18.20.5"
   },
   "dependencies": {
-    "@datadog/datadog-ci": "2.48.0",
     "adm-zip": "0.5.14",
-    "axios": "1.8.4",
+    "uuid": "9.0.1",
+    "axios": "1.13.5",
     "commander": "13.1.0",
     "form-data": "4.0.4",
     "openid-client": "5.6.1",