@codiac.io/codiac-cli 1.2.157 → 1.2.165

package/lib/cli-common/tenant-contextualizer.js

@@ -1,436 +1,436 @@
-"use strict";
-// COMMENTED OUT BC:  Moved to cli
-// import path = require('path');
-// import chalk = require('chalk');
-// import * as Case from 'case';
-// import { TenantUser, AuthTenant } from '@codiac.io/codiac-common/security/auth-entities';
-// import { isFuture } from "@codiac.io/codiac-common/utilities";
-// import { CodiacClient, CodiacClient as AuthClient } from '@codiac.io/codiac-api-client';
-// import { ProjectConfig, UserContext } from '@codiac.io/codiac-relay-contracts';
-// import { IBetterLogger } from '@codiac.io/codiac-common/IBetterLogger';
-// import { IUserInputProvider, IOutputStyler } from '@codiac.io/codiac-ops-common';
-// import { ProjectContextRepo, LocalOps, DxConstants } from '../ops';
-// import { UserContextLoader, UserContextManager } from '@codiac.io/codiac-ops-enterprise';
-// /** Interfaces with CLI user to establish a tenant context.  */
-// export class TenantContextualizer {
-//   static readonly CODE_FOR_NEW_TENANT="** create new **";
-//   /**
-//    * @param projCfg The In-memory representation of the project's thaulconfig file.
-//    */
-//   constructor(private projCfg: ProjectConfig, private authClient: AuthClient, apiClient: CodiacClient, 
-//     private _projCfgRepo: ProjectContextRepo, 
-//     private ui: IUserInputProvider, private styler: IOutputStyler, private logger: IBetterLogger
-//   ) {
-//     this.userContextLoader = new UserContextLoader(logger);
-//     this.userContextRepo = new UserContextManager(apiClient, logger);
-//   }
-//   private userContextLoader: UserContextLoader; 
-//   private userContextRepo: UserContextManager;  
-//   /** An authenticated user, freshly retrieved during this process. */
-//   private _user: TenantUser|undefined;
-//   /** Ensures that a valid tenant is assigned 
-//    * and the user has a valid tenant contributor token.  */
-//   public async establishTenantContext(currentContext?: UserContext): Promise<UserContext> {
-//     return new Promise<UserContext>(async (resolve,reject) => {
-//       try {
-//         // STEP a:  Load any locally cached user and tenant profiles
-//         /** Defaults to anonymous */
-//         let cachedUserContext = currentContext ?? this.userContextLoader.loadUserContext(this.projCfg.tenantCode);
-//         this.logger.trace(`After loadUserContext(${this.projCfg.tenantCode})`);
-//         // STEP b: Gather up whatever we have stored for user and tenant tokens
-//         let projTenantCode = (this.projCfg.tenantCode && this.projCfg.tenantCode != DxConstants.UNREGISTERED_TENANT_CODE) ? this.projCfg.tenantCode : undefined;
-//         let ultimateUserContext:UserContext|undefined;
-//         this.logger.trace(`Project tenantCode: ${projTenantCode}`);
-//         if (cachedUserContext && projTenantCode) {
-//           ultimateUserContext = ultimateUserContext || this.tryUseCurrentToken(cachedUserContext, projTenantCode);
-//           this.logger.trace(`Ultimate UserContext after tryUseCurrentToken: `, ultimateUserContext);
-//           ultimateUserContext = ultimateUserContext || await this.trySwitchTenant(cachedUserContext, projTenantCode);
-//         }
-//         this.logger.trace(`Cached UserContext before user interaction: `, cachedUserContext);
-//         this.logger.trace(`Ultimate UserContext before user interaction: `, ultimateUserContext);
-//         // Methods below call out for user input.
-//         if (projTenantCode) {
-//           ultimateUserContext = ultimateUserContext || await this.tryAuthenticateUnderTenant(projTenantCode, cachedUserContext?.userName);
-//         } else {  // this is an "else" because we are not going to allow this command to change the project tenant assignment (only add one if it hasnt been assigned).
-//           ultimateUserContext = ultimateUserContext || await this.trySelectFromMyTenants(cachedUserContext);
-//           ultimateUserContext = ultimateUserContext || await this.tryRegisterNewTenant(cachedUserContext);
-//         }
-//         resolve(ultimateUserContext!);
-//       } catch (err) {
-//         reject(err);
-//       }
-//     });
-//   }
-//   // ==========================================================================
-//   //                   PRIVATE SUPPORTING METHODS
-//   // ==========================================================================
-//   /** Returns a valid tenant context if the given tenant is already current on the given context and the token isnt expired. */
-//   public tryUseCurrentToken(currentContext: UserContext, tenantCode: string): UserContext|undefined {
-//     if (currentContext.userName != UserContext.ANONYMOUS_USERNAME
-//       && currentContext.currentTenantCode == tenantCode
-//       && currentContext.currentToken
-//       && currentContext.tokenExpiration
-//       && isFuture(currentContext.tokenExpiration)) {
-//           return currentContext;
-//     } else {
-//       return undefined;
-//     }
-//   }
-//   /** Attempts to switch the userContext to a locally cached profile for the given tenant, 
-//    * and if not found, requests a switch from the auth service.
-//    * The current userContext will only be modified if the switch is successfully made. 
-//    * throws is the userContext does not already contain at least one token that will identify the user (regardless of tenant). 
-//    * SIDE-EFFECT:  This may refresh the currentToken on the current user context and cache it to the user context file. */
-//   private async trySwitchTenant(currentContext: UserContext, newTenantCode: string): Promise<UserContext|undefined> {
-//     return new Promise<UserContext|undefined>(async (resolve,reject) => {
-//       try {
-//         let ultimate: UserContext|undefined;
-//         if (currentContext.userName != UserContext.ANONYMOUS_USERNAME) {          
-//           if (currentContext.tokens && currentContext.tokens[newTenantCode] && !this.authClient.isExpired(currentContext.tokens[newTenantCode])) {  // Use the locally cached token 
-//             // We already have an unexpired profile cached for this tenant.  Just make it the current one on the userContext object.
-//             ultimate = currentContext;
-//             ultimate.currentTenantCode = newTenantCode;
-//             ultimate.currentToken = currentContext.tokens[newTenantCode];
-//             ultimate.tokenExpiration = this.authClient.extractTokenExpiration(ultimate.currentToken);
-//             this.userContextRepo.writeUserContext(ultimate); 
-//             this.logger.trace(`Found an unexpired token for [${currentContext.userName}] under tenant: [${newTenantCode}].`);
-//           } else {   // See if the remote service will let us switch
-//             // Get ANY unexpired token to authenticate with 
-//             // (cuz we're gonna talk to the server and have IT switch our tenant)
-//             let token = (!currentContext.tokenExpiration || isFuture(currentContext.tokenExpiration)) ? currentContext.currentToken : undefined;
-//             if (!token && currentContext.tokens) {
-//               // Use one from another profile...  (any unexpired tenant token will do - we just need to identify the user)
-//               for (let tc in currentContext.tokens) {
-//                 if (!this.authClient.isExpired(currentContext.tokens[tc])) {
-//                   token = currentContext.tokens[tc];
-//                   this.logger.trace(`Found an unexpired token for [${currentContext.userName}] under tenant: [${tc}].  Using this to authenticate with the api to attempt a tenant switch.`);
-//                   break;
-//                 }
-//               }
-//             }
-//             if (token) { 
-//               // Ask the server...
-//               this.logger.trace(`Asking api to switch tenant.`);
-//               let switchResult = await this.authClient.switchTenant(token, newTenantCode);
-//               if (switchResult.success && switchResult.output) {
-//                 this._user = switchResult.output.user;  
-//                 ultimate = currentContext;
-//                 ultimate.currentTenantCode = switchResult.output.user.tenantCode;
-//                 ultimate.currentToken = switchResult.output.token;
-//                 ultimate.tokenExpiration = switchResult.output.expiration;
-//                 if (ultimate.currentTenantCode) {
-//                   ultimate.tokens[ultimate.currentTenantCode] = ultimate.currentToken;
-//                 }
-//                 this.userContextRepo.writeUserContext(ultimate); 
-//                 this.logger.trace(`Successfully Switched user context to tenant [${ultimate.currentTenantCode}] via api.`);
-//               } else if (switchResult.output) {
-//                 // We got back a failure but refreshed the token we were using.
-//                 if (token == currentContext.currentToken) /* ie: if we used the token from the original context */ {
-//                   this._user = switchResult.output.user;
-//                   currentContext.currentToken = switchResult.output.token;  // is currentContext passed in byRef?  Will this assignment be honored outside this method?
-//                   currentContext.tokenExpiration = switchResult.output.expiration;
-//                 } else if (this._user) {
-//                   this._user.profiles = switchResult.output.user.profiles;  // The token was from a random tenant, so dont switch the current users tenant, just update its list of tenant profiles.
-//                 } 
-//                 currentContext.tokens[switchResult.output.user.tenantCode] = switchResult.output.token;
-//                 this.userContextRepo.writeUserContext(currentContext); 
-//                 // We arent registered for the project tenant (http 403 ?) <--- We need to prompt for new login creds (they may want to try another user account) OR fail loudly here.
-//                 this.renderNotAMember(currentContext.userName, newTenantCode);
-//               } else {
-//                 // Our current token was invalid or expired,  (http 422 ?) <-- we need to prompt for just password. (NOTE:  That'll be server hit #2 in this sequence)
-//               }
-//             } else {
-//               // We didnt have an unexpired token to use for this.
-//             }
-//           }
-//         }
-//         resolve(ultimate);
-//       } catch (err) {
-//         reject(err);
-//       }
-//     });
-//   }
-//   /** Only diff betw this an authenticate is that 
-//    * this method only returns a valid tenant context 
-//    * (whereas authenticate returns a user or tenant context). */
-//   private async tryAuthenticateUnderTenant(tenantCode: string, defaultUserName?: string): Promise<UserContext|undefined> {
-//     return new Promise<UserContext|undefined>(async (resolve,reject) => {
-//       try {
-//         let ultimate: UserContext|undefined;
-//         let newContext = await this.authenticate(tenantCode, defaultUserName);
-//         if (newContext) {
-//           if (newContext.currentTenantCode == tenantCode) {
-//             ultimate = newContext;
-//           } else {
-//             this.renderNotAMember(newContext.userName, tenantCode);
-//           }
-//         }        
-//         resolve(ultimate);
-//       } catch (err) {
-//         reject(err);
-//       }
-//     });
-//   }
-//   private async trySelectFromMyTenants(currentContext: UserContext|undefined): Promise<UserContext|undefined> {
-//     return new Promise<UserContext|undefined>(async (resolve,reject) => {
-//       try {
-//         let ultimate: UserContext|undefined;
-//         // Step 1:  GET THE USER'S LIST OF TENANTS (se we can access an updated list of profiles.
-//         //          They gotta be up to date cuz access to that tenant may have been granted just seconds ago).
-//         // We may need to authenticate here.  Or perhaps refresh token.  Where can we store the user from a previous server trip?  do we need to?
-//         if (currentContext)
-//           this.logger.trace("currentContext token BEFORE getUserTenants...", currentContext.currentToken)
-//         else 
-//           this.logger.trace("No currentContext BEFORE getUserTenants")
-//         currentContext = await this.establishPrincipalContext(currentContext);  // shouldnt we do this before we do anything else in this class?
-//         let myTenants: AuthTenant[] = [];
-//         if (currentContext?.currentToken) {
-//           myTenants = await this.getUserTenants(this._user);
-//         }
-//         if (currentContext)
-//           this.logger.trace("currentContext token AFTER getUserTenants...", currentContext.currentToken)
-//         else 
-//           this.logger.trace("No currentContext AFTER getUserTenants")
-//         if (myTenants && myTenants.length > 0) {
-//           let tenantCode = await this.promptToSelectTenant(myTenants);
-//           if (tenantCode) {
-//             if (tenantCode == TenantContextualizer.CODE_FOR_NEW_TENANT) {
-//               tenantCode = undefined;  // this will lead us to createNewTenant while still allowing us to recognize a cancel.
-//             } else {
-//               if (!currentContext) currentContext = await this.authenticate();  // this should never happen - we already did so to get the list of tenant profiles.
-//               if (currentContext) {
-//                 ultimate = await this.trySwitchTenant(currentContext, tenantCode);  // Call server if we dont already have a token for the selected tenant.
-//                 if (ultimate) {
-//                   // Commented out bc:  TenantContextulizer should NOT be creating a proj cfg where there wasnt one. The init command has the sole responsibility there.
-//                   // if (!this.projCfg) this.projCfg = this.createDefaultProjectConfig();  // This is avoiding a corrupted project folder.
-//                   // Update the project config if available
-//                   if (this.projCfg) {
-//                     this.projCfg.tenantCode = tenantCode;
-//                     await this._projCfgRepo.updateProjectConfigFile(this.projCfg);
-//                   }
-//                 }
-//               }
-//             }
-//           } else {
-//             this.cancel();  // user gave up: stop the bus.
-//           }
-//         }
-//         resolve(ultimate);
-//       } catch (err) {
-//         reject(err);
-//       }
-//     });
-//   }  
-//   /** Side effect: Overwrites this._user if it s able to refresh it from the auth api */
-//   private async establishPrincipalContext(context: UserContext|undefined): Promise<UserContext|undefined> {
-//     return new Promise<UserContext|undefined>(async (resolve,reject) => {
-//       try {
-//         if (!this._user) {
-//           if (context && context.userName != UserContext.ANONYMOUS_USERNAME && (!context.tokenExpiration || isFuture(context.tokenExpiration))) {
-//             let refreshResult: {context?: UserContext, user?: TenantUser }|undefined;
-//             try {
-//               refreshResult = await this.userContextRepo.refreshUserContext(context);
-//             } catch (err) {
-//               this.logger.warn(`Failed to refresh your user context, leaving your api token potentially stale, preventing further communications: ${err.message||""}`, err);
-//             }
-//             // ----------------------------------------------------------------------------------
-//             // TODO:  Review this logic for refresh/expiration fails 
-//             //        that should run an authenticate but arent...
-//             // ----------------------------------------------------------------------------------
-//             if (refreshResult) {
-//               if (refreshResult.user) {
-//                 this.logger.debug("Setting this.User from refresh output...")
-//                 this._user = refreshResult.user;
-//                 this.logger.debug(`this._user profile count: ${this._user.profiles.length}`)
-//               }
-//               if (refreshResult.context) {
-//                 this.logger.debug("Setting context from refresh output...");
-//                 context = refreshResult.context;
-//               }
-//             // } else {
-//             //   if (context.currentToken && context.currentTenantCode && context.userName) {
-//             //     // Allow for use while disconnected.
-//             //     // TODO:  retrieve a locally cached user object.
-//             //     this._user = new User(context.currentTenantCode, "", "", "", context.userName);
-//             //     this._user.profiles = [];
-//             //     for (let tenantCode in context.tokens) {
-//             //       this._user.profiles.push(new AccessProfile(tenantCode));
-//             //     }
-//             //     this.logger.warn(`Using an instance of the current user sparsely populated from cache.`);
-//             //   }
-//             }
-//           }
-//           if (!this._user) {
-//             let defaultUserName = (context && context.userName != UserContext.ANONYMOUS_USERNAME) ? context.userName : undefined;
-//             let currentTenantCode = (context && context.currentTenantCode) || undefined;
-//             context = await this.authenticate(currentTenantCode, defaultUserName); 
-//           }
-//         }
-//         resolve(context);
-//       } catch (err) {
-//         reject(err);
-//       }
-//     });
-//   }
-//   private async getUserTenants(user: TenantUser|undefined): Promise<AuthTenant[]> {
-//     return new Promise<AuthTenant[]>(async (resolve,reject) => {
-//       try {
-//         let myTenants: AuthTenant[] = [];
-//         this.logger.write(`Retrieving tenants of user [${user?.login || "anonymous"}]`);
-//         let myAcctResult = await this.authClient.whoAmI();
-//         if (myAcctResult.error) throw myAcctResult.error;
-//         if (myAcctResult.output?.profiles && myAcctResult.output?.profiles.length > 0) {
-//           let myProfiles = myAcctResult.output.profiles;
-//           // We're gonna put the tenantCode in place of the name for now cuz that's all that we get with whoami.
-//           // TODO:  Consider storing AuthTenant.name with the AccessProfile entity so we can make it readable without an extra db hit. 
-//           myTenants = myProfiles.map(ap => new AuthTenant(ap.tenantCode, ap.tenantCode));
-//           // If we want the tenant names...
-//           //   let codesCsv = myProfiles.map(p => p.tenantCode).join(",");
-//           //   let criteria: TenantCriteria = { mine: true };  // <----- TODO !!!  (works off current user)  
-//           //   let result = await this.apiClient.tryReadMany(AuthTenant, TenantCriteria, criteria);
-//           //  OR
-//           //   let result = await this.authClient.getMyTenants();
-//           //   this.logger.trace("Result of attempt to get user tenants",result)
-//         }
-//         resolve(myTenants);
-//       } catch (err) {
-//         reject(err);
-//       }
-//     });
-//   }
-//   /** Prompts the user to select a tenant from the given list of tenantCodes.  
-//    * Returns undefined if cancelled, and TenantContextualizer.CODE_FOR_NEW_TENANT if "register new" is selected.
-//    * @param tenants List of tenants from which to select.
-//    * @param allowAddNew Inserts an option to add a new tenant.  (NOTE: this method DOES NOT perform the add new action itself!)
-//   */
-//   async promptToSelectTenant(tenants: AuthTenant[], allowAddNew: boolean = true): Promise<string|undefined> {
-//     return new Promise<string|undefined>(async (resolve,reject) => {
-//       try {
-//         let choices = tenants.map(t => { 
-//           return { name: t.name, value: t.code }; 
-//         });
-//         if (allowAddNew) {
-//           choices.push({ name: "(Register new tenant)", value: TenantContextualizer.CODE_FOR_NEW_TENANT});
-//         }
-//         this.logger.notice(`Your project is not assigned to a tenant.`);
-//         this.logger.notice(`Please assign it to one of your organizations or register a new organization...`);
-//         let selected = await this.ui.promptSelect('tenantCode', 'Select a Tenant:', choices);
-//         // let result = await inquirer.prompt({ type: 'list', name: 'tenantCode', message: 'Select a Tenant:', choices: choices});
-//         // let selected: string|undefined = result.tenantCode;
-//         resolve(selected);
-//       } catch (err) {
-//         reject(err);
-//       }
-//     });
-//   }
-//   /** Returns a tenant context, a user context, or undefined if operation cancelled.  
-//    * Caches the new user context.
-//    * Throws any exceptions. 
-//    * 
-//    * `unregistered` tenant code gets ignored.
-//    * 
-//    * @param login 
-//    * @param silent (optional: defaults to false) When set to true, suppresses the prompts to confirm the given defaults.  Requires defaultLogin and defaultPassword to be set.  Also requires tenantCode if the current user has more than one tenant profile and it cannot be derived decisively from the current context.  
-//    */
-//   public async authenticate(tenantCode?: string, login?: string, password?: string, silent: boolean = false): Promise<UserContext|undefined> {
-//     return new Promise<UserContext>(async (resolve,reject) => {
-//       try {
-//         let defaults = { u: login, p: password, t: tenantCode };
-//         let newContext: UserContext|undefined;
-//         while (!newContext) {
-//           newContext = undefined;
-//           defaults.t = (defaults.t !== undefined && defaults.t !== DxConstants.UNREGISTERED_TENANT_CODE) ? defaults.t : undefined;
-//           if (!silent) {
-//             this.ui.userMessage(`Please authenticate with Codiac ${(defaults.t !== undefined) ? " under tenant " + this.styler.hilite(defaults.t) : ""} (CTRL-C to cancel)`);
-//             defaults.u = await this.ui.prompt("userName", `Username: `, true, defaults.u);
-//           }
-//           if (defaults.u) {
-//             if (!silent) {
-//               defaults.p = defaults.p ?? await this.ui.promptPassword("password", "Password ");
-//             }
-//             if (defaults.p) {
-//               this.logger.debug(`Authenticating against ${this.authClient!.apiRootUrl}`);
-//               let authResult = await this.authClient!.authenticate(defaults.u, defaults.p, defaults.t);
-//               this.logger.debug("", JSON.stringify(authResult, undefined, '  '));
-//               if (authResult.output) {
-//                 let token = authResult.output.token;
-//                 let userName = authResult.output.user.login;
-//                 let tenantCode = authResult.output.user.tenantCode;
-//                 let exp = authResult.output.expiration;
-//                 // this.passwordLastEntered = password;  // we're gonna need this later if we need to register a new tenant (cuz the tenantRegn endpoint doent support a user token yet.)
-//                 newContext = await this.userContextRepo.saveToUserContext(newContext, userName, token, tenantCode, exp);
-//                 this._user = authResult.output.user;
-//               }
-//               if (authResult.error) {
-//                 throw authResult.error;  
-//               }
-//             }
-//           }
-//           // Dump em if they didnt get fully hydrated by this point.
-//           if (silent && (defaults.u === undefined || defaults.p === undefined)) {
-//             throw new Error(`Cannot authenticate using "silent": both login and password must be provided.`);
-//           }
-//         }
-//         resolve(newContext);
-//       } catch (err) {
-//         reject(err);
-//       }
-//     });
-//   }
-//   private isNullOrEmpty(value: string|undefined): boolean {
-//     return (value == undefined || value == "");
-//   }
-//   async tryRegisterNewTenant(currentContext: UserContext|undefined): Promise<UserContext|undefined> {
-//     return new Promise<UserContext|undefined>(async (resolve,reject) => {
-//       try {
-//         let ultimate:UserContext|undefined;
-//         let tenantName = await this.ui.prompt<string>("tenantName", "Enter the full name of the organization: ", true);
-//         // HACK: We happen to know that the authenticate will have necessarily been run before this was called, 
-//         // and we're keeping the pwd from that run in memory just so we can fire this request.
-//         if (!this._user) {
-//           // Wanna authenticate here?
-//           throw new Error("RegisterTenant failed: No user was provided.");
-//         } else if (!tenantName) {
-//           // this is a null gate - it can never happen bc the prompt is required;
-//           throw new Error("RegisterTenant failed: No tenant name was provided.");
-//         } else {
-//           let createNewUser = this.isNullOrEmpty(currentContext?.currentToken);  // we will have already established the user context
-//           let tenantResult = await this.authClient.registerTenant(tenantName, createNewUser, this._user.login, this._user.password!, undefined, currentContext!.currentToken || this.authClient.authToken);  
-//           if (tenantResult.error) {
-//             throw tenantResult.error;
-//           } else if (tenantResult.success && tenantResult.output) {
-//             let token = this.authClient.authToken!;  // thats a valid force - we will def have one if the register call succeeded 
-//             ultimate = await this.userContextRepo.saveToUserContext(currentContext, this._user.login, token, tenantResult.output.code);
-//             this.projCfg.tenantCode = tenantResult.output.code;
-//             await this._projCfgRepo.updateProjectConfigFile(this.projCfg);
-//           } else {
-//             // ??  Fail?  Is this a valid scenario?
-//             throw new Error("RegisterTenant failed: " + tenantResult.message + tenantResult.error);
-//           }
-//         }
-//         resolve(ultimate);
-//       } catch (err) {
-//         this.logger.debug(`Error attempting to register new tenant: ${err.message||""}${err.response?.data?.message||""}`, (err.toJSON) ? err.toJSON() : err);
-//         reject(err);
-//       }
-//     });
-//   }
-//   cancel() {
-//     throw new Error("Action cancelled. No work was done.");
-//     // this.logger.notice("Action cancelled. No work was done.");
-//     // this.exit();
-//   }
-//   /** logs a user message stating that the current user 
-//    * is not a member of the given tenant,
-//    * with instructions for what to do next.  */
-//   private renderNotAMember(username: string, tenantCode: string): void {
-//     this.logger.notice(`You are currently logged in as '${this.styler.hilite(username)}',`);
-//     this.logger.notice(`but you are not a member of the tenant '${this.styler.hilite(tenantCode)}'.`);
-//     this.logger.notice(`You will need to:`);
-//     this.logger.notice(`  EITHER) Log in as a different user, using...`);
-//     this.logger.notice(`    ${this.styler.hilite("cod login [yourUsername] -p [yourPassword]")},`);
-//     this.logger.notice(`  OR) Cancel and send a request to be added, using...`);
-//     this.logger.notice(`    ${this.styler.hilite(`cod request-access ${tenantCode} --role publisher`)}`);
-//   }
-// }
+"use strict";
+// COMMENTED OUT BC:  Moved to cli
+// import path = require('path');
+// import chalk = require('chalk');
+// import * as Case from 'case';
+// import { TenantUser, AuthTenant } from '@codiac.io/codiac-common/security/auth-entities';
+// import { isFuture } from "@codiac.io/codiac-common/utilities";
+// import { CodiacClient, CodiacClient as AuthClient } from '@codiac.io/codiac-api-client';
+// import { ProjectConfig, UserContext } from '@codiac.io/codiac-relay-contracts';
+// import { IBetterLogger } from '@codiac.io/codiac-common/IBetterLogger';
+// import { IUserInputProvider, IOutputStyler } from '@codiac.io/codiac-ops-common';
+// import { ProjectContextRepo, LocalOps, DxConstants } from '../ops';
+// import { UserContextLoader, UserContextManager } from '@codiac.io/codiac-ops-enterprise';
+// /** Interfaces with CLI user to establish a tenant context.  */
+// export class TenantContextualizer {
+//   static readonly CODE_FOR_NEW_TENANT="** create new **";
+//   /**
+//    * @param projCfg The In-memory representation of the project's thaulconfig file.
+//    */
+//   constructor(private projCfg: ProjectConfig, private authClient: AuthClient, apiClient: CodiacClient, 
+//     private _projCfgRepo: ProjectContextRepo, 
+//     private ui: IUserInputProvider, private styler: IOutputStyler, private logger: IBetterLogger
+//   ) {
+//     this.userContextLoader = new UserContextLoader(logger);
+//     this.userContextRepo = new UserContextManager(apiClient, logger);
+//   }
+//   private userContextLoader: UserContextLoader; 
+//   private userContextRepo: UserContextManager;  
+//   /** An authenticated user, freshly retrieved during this process. */
+//   private _user: TenantUser|undefined;
+//   /** Ensures that a valid tenant is assigned 
+//    * and the user has a valid tenant contributor token.  */
+//   public async establishTenantContext(currentContext?: UserContext): Promise<UserContext> {
+//     return new Promise<UserContext>(async (resolve,reject) => {
+//       try {
+//         // STEP a:  Load any locally cached user and tenant profiles
+//         /** Defaults to anonymous */
+//         let cachedUserContext = currentContext ?? this.userContextLoader.loadUserContext(this.projCfg.tenantCode);
+//         this.logger.trace(`After loadUserContext(${this.projCfg.tenantCode})`);
+//         // STEP b: Gather up whatever we have stored for user and tenant tokens
+//         let projTenantCode = (this.projCfg.tenantCode && this.projCfg.tenantCode != DxConstants.UNREGISTERED_TENANT_CODE) ? this.projCfg.tenantCode : undefined;
+//         let ultimateUserContext:UserContext|undefined;
+//         this.logger.trace(`Project tenantCode: ${projTenantCode}`);
+//         if (cachedUserContext && projTenantCode) {
+//           ultimateUserContext = ultimateUserContext || this.tryUseCurrentToken(cachedUserContext, projTenantCode);
+//           this.logger.trace(`Ultimate UserContext after tryUseCurrentToken: `, ultimateUserContext);
+//           ultimateUserContext = ultimateUserContext || await this.trySwitchTenant(cachedUserContext, projTenantCode);
+//         }
+//         this.logger.trace(`Cached UserContext before user interaction: `, cachedUserContext);
+//         this.logger.trace(`Ultimate UserContext before user interaction: `, ultimateUserContext);
+//         // Methods below call out for user input.
+//         if (projTenantCode) {
+//           ultimateUserContext = ultimateUserContext || await this.tryAuthenticateUnderTenant(projTenantCode, cachedUserContext?.userName);
+//         } else {  // this is an "else" because we are not going to allow this command to change the project tenant assignment (only add one if it hasnt been assigned).
+//           ultimateUserContext = ultimateUserContext || await this.trySelectFromMyTenants(cachedUserContext);
+//           ultimateUserContext = ultimateUserContext || await this.tryRegisterNewTenant(cachedUserContext);
+//         }
+//         resolve(ultimateUserContext!);
+//       } catch (err) {
+//         reject(err);
+//       }
+//     });
+//   }
+//   // ==========================================================================
+//   //                   PRIVATE SUPPORTING METHODS
+//   // ==========================================================================
+//   /** Returns a valid tenant context if the given tenant is already current on the given context and the token isnt expired. */
+//   public tryUseCurrentToken(currentContext: UserContext, tenantCode: string): UserContext|undefined {
+//     if (currentContext.userName != UserContext.ANONYMOUS_USERNAME
+//       && currentContext.currentTenantCode == tenantCode
+//       && currentContext.currentToken
+//       && currentContext.tokenExpiration
+//       && isFuture(currentContext.tokenExpiration)) {
+//           return currentContext;
+//     } else {
+//       return undefined;
+//     }
+//   }
+//   /** Attempts to switch the userContext to a locally cached profile for the given tenant, 
+//    * and if not found, requests a switch from the auth service.
+//    * The current userContext will only be modified if the switch is successfully made. 
+//    * throws is the userContext does not already contain at least one token that will identify the user (regardless of tenant). 
+//    * SIDE-EFFECT:  This may refresh the currentToken on the current user context and cache it to the user context file. */
+//   private async trySwitchTenant(currentContext: UserContext, newTenantCode: string): Promise<UserContext|undefined> {
+//     return new Promise<UserContext|undefined>(async (resolve,reject) => {
+//       try {
+//         let ultimate: UserContext|undefined;
+//         if (currentContext.userName != UserContext.ANONYMOUS_USERNAME) {          
+//           if (currentContext.tokens && currentContext.tokens[newTenantCode] && !this.authClient.isExpired(currentContext.tokens[newTenantCode])) {  // Use the locally cached token 
+//             // We already have an unexpired profile cached for this tenant.  Just make it the current one on the userContext object.
+//             ultimate = currentContext;
+//             ultimate.currentTenantCode = newTenantCode;
+//             ultimate.currentToken = currentContext.tokens[newTenantCode];
+//             ultimate.tokenExpiration = this.authClient.extractTokenExpiration(ultimate.currentToken);
+//             this.userContextRepo.writeUserContext(ultimate); 
+//             this.logger.trace(`Found an unexpired token for [${currentContext.userName}] under tenant: [${newTenantCode}].`);
+//           } else {   // See if the remote service will let us switch
+//             // Get ANY unexpired token to authenticate with 
+//             // (cuz we're gonna talk to the server and have IT switch our tenant)
+//             let token = (!currentContext.tokenExpiration || isFuture(currentContext.tokenExpiration)) ? currentContext.currentToken : undefined;
+//             if (!token && currentContext.tokens) {
+//               // Use one from another profile...  (any unexpired tenant token will do - we just need to identify the user)
+//               for (let tc in currentContext.tokens) {
+//                 if (!this.authClient.isExpired(currentContext.tokens[tc])) {
+//                   token = currentContext.tokens[tc];
+//                   this.logger.trace(`Found an unexpired token for [${currentContext.userName}] under tenant: [${tc}].  Using this to authenticate with the api to attempt a tenant switch.`);
+//                   break;
+//                 }
+//               }
+//             }
+//             if (token) { 
+//               // Ask the server...
+//               this.logger.trace(`Asking api to switch tenant.`);
+//               let switchResult = await this.authClient.switchTenant(token, newTenantCode);
+//               if (switchResult.success && switchResult.output) {
+//                 this._user = switchResult.output.user;  
+//                 ultimate = currentContext;
+//                 ultimate.currentTenantCode = switchResult.output.user.tenantCode;
+//                 ultimate.currentToken = switchResult.output.token;
+//                 ultimate.tokenExpiration = switchResult.output.expiration;
+//                 if (ultimate.currentTenantCode) {
+//                   ultimate.tokens[ultimate.currentTenantCode] = ultimate.currentToken;
+//                 }
+//                 this.userContextRepo.writeUserContext(ultimate); 
+//                 this.logger.trace(`Successfully Switched user context to tenant [${ultimate.currentTenantCode}] via api.`);
+//               } else if (switchResult.output) {
+//                 // We got back a failure but refreshed the token we were using.
+//                 if (token == currentContext.currentToken) /* ie: if we used the token from the original context */ {
+//                   this._user = switchResult.output.user;
+//                   currentContext.currentToken = switchResult.output.token;  // is currentContext passed in byRef?  Will this assignment be honored outside this method?
+//                   currentContext.tokenExpiration = switchResult.output.expiration;
+//                 } else if (this._user) {
+//                   this._user.profiles = switchResult.output.user.profiles;  // The token was from a random tenant, so dont switch the current users tenant, just update its list of tenant profiles.
+//                 } 
+//                 currentContext.tokens[switchResult.output.user.tenantCode] = switchResult.output.token;
+//                 this.userContextRepo.writeUserContext(currentContext); 
+//                 // We arent registered for the project tenant (http 403 ?) <--- We need to prompt for new login creds (they may want to try another user account) OR fail loudly here.
+//                 this.renderNotAMember(currentContext.userName, newTenantCode);
+//               } else {
+//                 // Our current token was invalid or expired,  (http 422 ?) <-- we need to prompt for just password. (NOTE:  That'll be server hit #2 in this sequence)
+//               }
+//             } else {
+//               // We didnt have an unexpired token to use for this.
+//             }
+//           }
+//         }
+//         resolve(ultimate);
+//       } catch (err) {
+//         reject(err);
+//       }
+//     });
+//   }
+//   /** Only diff betw this an authenticate is that 
+//    * this method only returns a valid tenant context 
+//    * (whereas authenticate returns a user or tenant context). */
+//   private async tryAuthenticateUnderTenant(tenantCode: string, defaultUserName?: string): Promise<UserContext|undefined> {
+//     return new Promise<UserContext|undefined>(async (resolve,reject) => {
+//       try {
+//         let ultimate: UserContext|undefined;
+//         let newContext = await this.authenticate(tenantCode, defaultUserName);
+//         if (newContext) {
+//           if (newContext.currentTenantCode == tenantCode) {
+//             ultimate = newContext;
+//           } else {
+//             this.renderNotAMember(newContext.userName, tenantCode);
+//           }
+//         }        
+//         resolve(ultimate);
+//       } catch (err) {
+//         reject(err);
+//       }
+//     });
+//   }
+//   private async trySelectFromMyTenants(currentContext: UserContext|undefined): Promise<UserContext|undefined> {
+//     return new Promise<UserContext|undefined>(async (resolve,reject) => {
+//       try {
+//         let ultimate: UserContext|undefined;
+//         // Step 1:  GET THE USER'S LIST OF TENANTS (se we can access an updated list of profiles.
+//         //          They gotta be up to date cuz access to that tenant may have been granted just seconds ago).
+//         // We may need to authenticate here.  Or perhaps refresh token.  Where can we store the user from a previous server trip?  do we need to?
+//         if (currentContext)
+//           this.logger.trace("currentContext token BEFORE getUserTenants...", currentContext.currentToken)
+//         else 
+//           this.logger.trace("No currentContext BEFORE getUserTenants")
+//         currentContext = await this.establishPrincipalContext(currentContext);  // shouldnt we do this before we do anything else in this class?
+//         let myTenants: AuthTenant[] = [];
+//         if (currentContext?.currentToken) {
+//           myTenants = await this.getUserTenants(this._user);
+//         }
+//         if (currentContext)
+//           this.logger.trace("currentContext token AFTER getUserTenants...", currentContext.currentToken)
+//         else 
+//           this.logger.trace("No currentContext AFTER getUserTenants")
+//         if (myTenants && myTenants.length > 0) {
+//           let tenantCode = await this.promptToSelectTenant(myTenants);
+//           if (tenantCode) {
+//             if (tenantCode == TenantContextualizer.CODE_FOR_NEW_TENANT) {
+//               tenantCode = undefined;  // this will lead us to createNewTenant while still allowing us to recognize a cancel.
+//             } else {
+//               if (!currentContext) currentContext = await this.authenticate();  // this should never happen - we already did so to get the list of tenant profiles.
+//               if (currentContext) {
+//                 ultimate = await this.trySwitchTenant(currentContext, tenantCode);  // Call server if we dont already have a token for the selected tenant.
+//                 if (ultimate) {
+//                   // Commented out bc:  TenantContextulizer should NOT be creating a proj cfg where there wasnt one. The init command has the sole responsibility there.
+//                   // if (!this.projCfg) this.projCfg = this.createDefaultProjectConfig();  // This is avoiding a corrupted project folder.
+//                   // Update the project config if available
+//                   if (this.projCfg) {
+//                     this.projCfg.tenantCode = tenantCode;
+//                     await this._projCfgRepo.updateProjectConfigFile(this.projCfg);
+//                   }
+//                 }
+//               }
+//             }
+//           } else {
+//             this.cancel();  // user gave up: stop the bus.
+//           }
+//         }
+//         resolve(ultimate);
+//       } catch (err) {
+//         reject(err);
+//       }
+//     });
+//   }  
+//   /** Side effect: Overwrites this._user if it s able to refresh it from the auth api */
+//   private async establishPrincipalContext(context: UserContext|undefined): Promise<UserContext|undefined> {
+//     return new Promise<UserContext|undefined>(async (resolve,reject) => {
+//       try {
+//         if (!this._user) {
+//           if (context && context.userName != UserContext.ANONYMOUS_USERNAME && (!context.tokenExpiration || isFuture(context.tokenExpiration))) {
+//             let refreshResult: {context?: UserContext, user?: TenantUser }|undefined;
+//             try {
+//               refreshResult = await this.userContextRepo.refreshUserContext(context);
+//             } catch (err) {
+//               this.logger.warn(`Failed to refresh your user context, leaving your api token potentially stale, preventing further communications: ${err.message||""}`, err);
+//             }
+//             // ----------------------------------------------------------------------------------
+//             // TODO:  Review this logic for refresh/expiration fails 
+//             //        that should run an authenticate but arent...
+//             // ----------------------------------------------------------------------------------
+//             if (refreshResult) {
+//               if (refreshResult.user) {
+//                 this.logger.debug("Setting this.User from refresh output...")
+//                 this._user = refreshResult.user;
+//                 this.logger.debug(`this._user profile count: ${this._user.profiles.length}`)
+//               }
+//               if (refreshResult.context) {
+//                 this.logger.debug("Setting context from refresh output...");
+//                 context = refreshResult.context;
+//               }
+//             // } else {
+//             //   if (context.currentToken && context.currentTenantCode && context.userName) {
+//             //     // Allow for use while disconnected.
+//             //     // TODO:  retrieve a locally cached user object.
+//             //     this._user = new User(context.currentTenantCode, "", "", "", context.userName);
+//             //     this._user.profiles = [];
+//             //     for (let tenantCode in context.tokens) {
+//             //       this._user.profiles.push(new AccessProfile(tenantCode));
+//             //     }
+//             //     this.logger.warn(`Using an instance of the current user sparsely populated from cache.`);
+//             //   }
+//             }
+//           }
+//           if (!this._user) {
+//             let defaultUserName = (context && context.userName != UserContext.ANONYMOUS_USERNAME) ? context.userName : undefined;
+//             let currentTenantCode = (context && context.currentTenantCode) || undefined;
+//             context = await this.authenticate(currentTenantCode, defaultUserName); 
+//           }
+//         }
+//         resolve(context);
+//       } catch (err) {
+//         reject(err);
+//       }
+//     });
+//   }
+//   private async getUserTenants(user: TenantUser|undefined): Promise<AuthTenant[]> {
+//     return new Promise<AuthTenant[]>(async (resolve,reject) => {
+//       try {
+//         let myTenants: AuthTenant[] = [];
+//         this.logger.write(`Retrieving tenants of user [${user?.login || "anonymous"}]`);
+//         let myAcctResult = await this.authClient.whoAmI();
+//         if (myAcctResult.error) throw myAcctResult.error;
+//         if (myAcctResult.output?.profiles && myAcctResult.output?.profiles.length > 0) {
+//           let myProfiles = myAcctResult.output.profiles;
+//           // We're gonna put the tenantCode in place of the name for now cuz that's all that we get with whoami.
+//           // TODO:  Consider storing AuthTenant.name with the AccessProfile entity so we can make it readable without an extra db hit. 
+//           myTenants = myProfiles.map(ap => new AuthTenant(ap.tenantCode, ap.tenantCode));
+//           // If we want the tenant names...
+//           //   let codesCsv = myProfiles.map(p => p.tenantCode).join(",");
+//           //   let criteria: TenantCriteria = { mine: true };  // <----- TODO !!!  (works off current user)  
+//           //   let result = await this.apiClient.tryReadMany(AuthTenant, TenantCriteria, criteria);
+//           //  OR
+//           //   let result = await this.authClient.getMyTenants();
+//           //   this.logger.trace("Result of attempt to get user tenants",result)
+//         }
+//         resolve(myTenants);
+//       } catch (err) {
+//         reject(err);
+//       }
+//     });
+//   }
+//   /** Prompts the user to select a tenant from the given list of tenantCodes.  
+//    * Returns undefined if cancelled, and TenantContextualizer.CODE_FOR_NEW_TENANT if "register new" is selected.
+//    * @param tenants List of tenants from which to select.
+//    * @param allowAddNew Inserts an option to add a new tenant.  (NOTE: this method DOES NOT perform the add new action itself!)
+//   */
+//   async promptToSelectTenant(tenants: AuthTenant[], allowAddNew: boolean = true): Promise<string|undefined> {
+//     return new Promise<string|undefined>(async (resolve,reject) => {
+//       try {
+//         let choices = tenants.map(t => { 
+//           return { name: t.name, value: t.code }; 
+//         });
+//         if (allowAddNew) {
+//           choices.push({ name: "(Register new tenant)", value: TenantContextualizer.CODE_FOR_NEW_TENANT});
+//         }
+//         this.logger.notice(`Your project is not assigned to a tenant.`);
+//         this.logger.notice(`Please assign it to one of your organizations or register a new organization...`);
+//         let selected = await this.ui.promptSelect('tenantCode', 'Select a Tenant:', choices);
+//         // let result = await inquirer.prompt({ type: 'list', name: 'tenantCode', message: 'Select a Tenant:', choices: choices});
+//         // let selected: string|undefined = result.tenantCode;
+//         resolve(selected);
+//       } catch (err) {
+//         reject(err);
+//       }
+//     });
+//   }
+//   /** Returns a tenant context, a user context, or undefined if operation cancelled.  
+//    * Caches the new user context.
+//    * Throws any exceptions. 
+//    * 
+//    * `unregistered` tenant code gets ignored.
+//    * 
+//    * @param login 
+//    * @param silent (optional: defaults to false) When set to true, suppresses the prompts to confirm the given defaults.  Requires defaultLogin and defaultPassword to be set.  Also requires tenantCode if the current user has more than one tenant profile and it cannot be derived decisively from the current context.  
+//    */
+//   public async authenticate(tenantCode?: string, login?: string, password?: string, silent: boolean = false): Promise<UserContext|undefined> {
+//     return new Promise<UserContext>(async (resolve,reject) => {
+//       try {
+//         let defaults = { u: login, p: password, t: tenantCode };
+//         let newContext: UserContext|undefined;
+//         while (!newContext) {
+//           newContext = undefined;
+//           defaults.t = (defaults.t !== undefined && defaults.t !== DxConstants.UNREGISTERED_TENANT_CODE) ? defaults.t : undefined;
+//           if (!silent) {
+//             this.ui.userMessage(`Please authenticate with Codiac ${(defaults.t !== undefined) ? " under tenant " + this.styler.hilite(defaults.t) : ""} (CTRL-C to cancel)`);
+//             defaults.u = await this.ui.prompt("userName", `Username: `, true, defaults.u);
+//           }
+//           if (defaults.u) {
+//             if (!silent) {
+//               defaults.p = defaults.p ?? await this.ui.promptPassword("password", "Password ");
+//             }
+//             if (defaults.p) {
+//               this.logger.debug(`Authenticating against ${this.authClient!.apiRootUrl}`);
+//               let authResult = await this.authClient!.authenticate(defaults.u, defaults.p, defaults.t);
+//               this.logger.debug("", JSON.stringify(authResult, undefined, '  '));
+//               if (authResult.output) {
+//                 let token = authResult.output.token;
+//                 let userName = authResult.output.user.login;
+//                 let tenantCode = authResult.output.user.tenantCode;
+//                 let exp = authResult.output.expiration;
+//                 // this.passwordLastEntered = password;  // we're gonna need this later if we need to register a new tenant (cuz the tenantRegn endpoint doent support a user token yet.)
+//                 newContext = await this.userContextRepo.saveToUserContext(newContext, userName, token, tenantCode, exp);
+//                 this._user = authResult.output.user;
+//               }
+//               if (authResult.error) {
+//                 throw authResult.error;  
+//               }
+//             }
+//           }
+//           // Dump em if they didnt get fully hydrated by this point.
+//           if (silent && (defaults.u === undefined || defaults.p === undefined)) {
+//             throw new Error(`Cannot authenticate using "silent": both login and password must be provided.`);
+//           }
+//         }
+//         resolve(newContext);
+//       } catch (err) {
+//         reject(err);
+//       }
+//     });
+//   }
+//   private isNullOrEmpty(value: string|undefined): boolean {
+//     return (value == undefined || value == "");
+//   }
+//   async tryRegisterNewTenant(currentContext: UserContext|undefined): Promise<UserContext|undefined> {
+//     return new Promise<UserContext|undefined>(async (resolve,reject) => {
+//       try {
+//         let ultimate:UserContext|undefined;
+//         let tenantName = await this.ui.prompt<string>("tenantName", "Enter the full name of the organization: ", true);
+//         // HACK: We happen to know that the authenticate will have necessarily been run before this was called, 
+//         // and we're keeping the pwd from that run in memory just so we can fire this request.
+//         if (!this._user) {
+//           // Wanna authenticate here?
+//           throw new Error("RegisterTenant failed: No user was provided.");
+//         } else if (!tenantName) {
+//           // this is a null gate - it can never happen bc the prompt is required;
+//           throw new Error("RegisterTenant failed: No tenant name was provided.");
+//         } else {
+//           let createNewUser = this.isNullOrEmpty(currentContext?.currentToken);  // we will have already established the user context
+//           let tenantResult = await this.authClient.registerTenant(tenantName, createNewUser, this._user.login, this._user.password!, undefined, currentContext!.currentToken || this.authClient.authToken);  
+//           if (tenantResult.error) {
+//             throw tenantResult.error;
+//           } else if (tenantResult.success && tenantResult.output) {
+//             let token = this.authClient.authToken!;  // thats a valid force - we will def have one if the register call succeeded 
+//             ultimate = await this.userContextRepo.saveToUserContext(currentContext, this._user.login, token, tenantResult.output.code);
+//             this.projCfg.tenantCode = tenantResult.output.code;
+//             await this._projCfgRepo.updateProjectConfigFile(this.projCfg);
+//           } else {
+//             // ??  Fail?  Is this a valid scenario?
+//             throw new Error("RegisterTenant failed: " + tenantResult.message + tenantResult.error);
+//           }
+//         }
+//         resolve(ultimate);
+//       } catch (err) {
+//         this.logger.debug(`Error attempting to register new tenant: ${err.message||""}${err.response?.data?.message||""}`, (err.toJSON) ? err.toJSON() : err);
+//         reject(err);
+//       }
+//     });
+//   }
+//   cancel() {
+//     throw new Error("Action cancelled. No work was done.");
+//     // this.logger.notice("Action cancelled. No work was done.");
+//     // this.exit();
+//   }
+//   /** logs a user message stating that the current user 
+//    * is not a member of the given tenant,
+//    * with instructions for what to do next.  */
+//   private renderNotAMember(username: string, tenantCode: string): void {
+//     this.logger.notice(`You are currently logged in as '${this.styler.hilite(username)}',`);
+//     this.logger.notice(`but you are not a member of the tenant '${this.styler.hilite(tenantCode)}'.`);
+//     this.logger.notice(`You will need to:`);
+//     this.logger.notice(`  EITHER) Log in as a different user, using...`);
+//     this.logger.notice(`    ${this.styler.hilite("cod login [yourUsername] -p [yourPassword]")},`);
+//     this.logger.notice(`  OR) Cancel and send a request to be added, using...`);
+//     this.logger.notice(`    ${this.styler.hilite(`cod request-access ${tenantCode} --role publisher`)}`);
+//   }
+// }
 //# sourceMappingURL=tenant-contextualizer.js.map