@contember/cli 2.1.0-rc.3 → 2.2.0-alpha.10

package/dist/development/src/commands/project/ProjectValidateCommand.js

@@ -1,6 +1,5 @@
-import { Command } from "@contember/cli-common";
-import { emptySchema } from "@contember/schema-utils";
-import { validateSchemaAndPrintErrors } from "../../lib/schema/SchemaValidationHelper.js";
+import { Command, CliError, ExitCode } from "@contember/cli-common";
+import { emptySchema, SchemaValidator } from "@contember/schema-utils";
 class ProjectValidateCommand extends Command {
   constructor(schemaLoader, migrationValidator, migrationsResolver, schemaDiffer, schemaVersionBuilder) {
     super();
@@ -13,25 +12,54 @@ class ProjectValidateCommand extends Command {
   configure(configuration) {
     configuration.description("Validates project schema");
   }
-  async execute() {
-    let projectValid = true;
+  async execute(input, output) {
+    const issues = [];
     const migrations = await this.migrationsResolver.getSchemaMigrations();
-    projectValid = this.migrationValidator.validate(emptySchema, migrations) && projectValid;
+    if (!this.migrationValidator.validate(emptySchema, migrations)) {
+      issues.push({
+        source: "migrations",
+        path: "",
+        code: "MIGRATIONS_INVALID_SCHEMA",
+        message: "One or more migrations produce an invalid schema; see the diagnostics above for details"
+      });
+    }
     const schema = await this.schemaLoader.loadSchema();
-    projectValid = validateSchemaAndPrintErrors(schema, "Defined schema is invalid:") && projectValid;
+    for (const err of SchemaValidator.validate(schema)) {
+      issues.push({ source: "schema", path: err.path.join("."), code: err.code, message: err.message });
+    }
     const builtSchema = await this.schemaVersionBuilder.buildSchema();
-    projectValid = validateSchemaAndPrintErrors(builtSchema, "Schema built from migrations is invalid:") && projectValid;
-    if (projectValid) {
+    for (const err of SchemaValidator.validate(builtSchema)) {
+      issues.push({ source: "built-schema", path: err.path.join("."), code: err.code, message: err.message });
+    }
+    if (issues.length === 0) {
       const diff = await this.schemaDiffer.diffSchemas(builtSchema, schema);
       if (diff.length > 0) {
-        console.log("Migrations are not in sync with a defined schema");
-        projectValid = false;
+        issues.push({
+          source: "diff",
+          path: "",
+          code: "SCHEMA_MIGRATIONS_DIFF",
+          message: "Migrations are not in sync with the defined schema"
+        });
       }
     }
-    if (projectValid) {
-      console.log("Project schema is valid");
+    const columns = [
+      { field: "source", name: "Source" },
+      { field: "path", name: "Path" },
+      { field: "code", name: "Code" },
+      { field: "message", name: "Message" }
+    ];
+    if (issues.length > 0) {
+      if (!output.isJson && !output.isQuiet) {
+        output.table(columns, issues, "message");
+      }
+      throw new CliError(`Project schema is invalid: found ${issues.length} issue(s)`, {
+        code: "SCHEMA_INVALID",
+        exitCode: ExitCode.InputError,
+        details: issues
+      });
     }
-    return projectValid ? 0 : 1;
+    output.table(columns, issues, "message");
+    output.info("Project schema is valid");
   }
 }
 export {

package/dist/development/src/commands/project/ProjectValidateCommand.js.map

@@ -1 +1 @@
-{"version":3,"file":"ProjectValidateCommand.js","sources":["../../../../../../packages/cli/src/commands/project/ProjectValidateCommand.ts"],"sourcesContent":["import { Command, CommandConfiguration } from '@contember/cli-common'\nimport { emptySchema } from '@contember/schema-utils'\nimport { SchemaLoader } from '../../lib/schema/SchemaLoader'\nimport { validateSchemaAndPrintErrors } from '../../lib/schema/SchemaValidationHelper'\nimport { MigrationsValidator } from '../../lib/migrations/MigrationsValidator'\nimport { MigrationsResolver, SchemaVersionBuilder } from '@contember/migrations-client'\nimport { SchemaDiffer } from '@contember/schema-migrations'\n\ntype Args = {}\n\ntype Options = {}\n\nexport class ProjectValidateCommand extends Command<Args, Options> {\n\tconstructor(\n\t\tprivate readonly schemaLoader: SchemaLoader,\n\t\tprivate readonly migrationValidator: MigrationsValidator,\n\t\tprivate readonly migrationsResolver: MigrationsResolver,\n\t\tprivate readonly schemaDiffer: SchemaDiffer,\n\t\tprivate readonly schemaVersionBuilder: SchemaVersionBuilder,\n\t) {\n\t\tsuper()\n\t}\n\n\tprotected configure(configuration: CommandConfiguration<Args, Options>): void {\n\t\tconfiguration.description('Validates project schema')\n\t}\n\n\tprotected async execute(): Promise<number> {\n\t\tlet projectValid = true\n\n\t\tconst migrations = await this.migrationsResolver.getSchemaMigrations()\n\t\tprojectValid = this.migrationValidator.validate(emptySchema, migrations)\n\t\t\t&& projectValid\n\n\t\tconst schema = await this.schemaLoader.loadSchema()\n\t\tprojectValid = validateSchemaAndPrintErrors(schema, 'Defined schema is invalid:')\n\t\t\t&& projectValid\n\n\t\tconst builtSchema = await this.schemaVersionBuilder.buildSchema()\n\t\tprojectValid = validateSchemaAndPrintErrors(builtSchema, 'Schema built from migrations is invalid:')\n\t\t\t&& projectValid\n\n\t\tif (projectValid) {\n\t\t\tconst diff = await this.schemaDiffer.diffSchemas(builtSchema, schema)\n\t\t\tif (diff.length > 0) {\n\t\t\t\tconsole.log('Migrations are not in sync with a defined schema')\n\t\t\t\tprojectValid = false\n\t\t\t}\n\t\t}\n\n\t\tif (projectValid) {\n\t\t\tconsole.log('Project schema is valid')\n\t\t}\n\n\t\treturn projectValid ? 0 : 1\n\t}\n}\n"],"names":[],"mappings":";;;AAYO,MAAM,+BAA+B,QAAuB;AAAA,EAClE,YACkB,cACA,oBACA,oBACA,cACA,sBAChB;AACD,UAAA;AANiB,SAAA,eAAA;AACA,SAAA,qBAAA;AACA,SAAA,qBAAA;AACA,SAAA,eAAA;AACA,SAAA,uBAAA;AAAA,EAGlB;AAAA,EAEU,UAAU,eAA0D;AAC7E,kBAAc,YAAY,0BAA0B;AAAA,EACrD;AAAA,EAEA,MAAgB,UAA2B;AAC1C,QAAI,eAAe;AAEnB,UAAM,aAAa,MAAM,KAAK,mBAAmB,oBAAA;AACjD,mBAAe,KAAK,mBAAmB,SAAS,aAAa,UAAU,KACnE;AAEJ,UAAM,SAAS,MAAM,KAAK,aAAa,WAAA;AACvC,mBAAe,6BAA6B,QAAQ,4BAA4B,KAC5E;AAEJ,UAAM,cAAc,MAAM,KAAK,qBAAqB,YAAA;AACpD,mBAAe,6BAA6B,aAAa,0CAA0C,KAC/F;AAEJ,QAAI,cAAc;AACjB,YAAM,OAAO,MAAM,KAAK,aAAa,YAAY,aAAa,MAAM;AACpE,UAAI,KAAK,SAAS,GAAG;AACpB,gBAAQ,IAAI,kDAAkD;AAC9D,uBAAe;AAAA,MAChB;AAAA,IACD;AAEA,QAAI,cAAc;AACjB,cAAQ,IAAI,yBAAyB;AAAA,IACtC;AAEA,WAAO,eAAe,IAAI;AAAA,EAC3B;AACD;"}
+{"version":3,"file":"ProjectValidateCommand.js","sources":["../../../../../../packages/cli/src/commands/project/ProjectValidateCommand.ts"],"sourcesContent":["import { CliError, Command, CommandConfiguration, ExitCode, Input, Output } from '@contember/cli-common'\nimport { emptySchema, SchemaValidator } from '@contember/schema-utils'\nimport { MigrationsValidator } from '../../lib/migrations/MigrationsValidator.js'\nimport { MigrationsResolver, SchemaVersionBuilder } from '@contember/migrations-client'\nimport { SchemaDiffer } from '@contember/schema-migrations'\nimport { SchemaLoader } from '../../lib/schema/SchemaLoader.js'\n\ntype Args = {}\n\ntype Options = {}\n\ntype ValidationIssue = {\n\tsource: 'schema' | 'built-schema' | 'migrations' | 'diff'\n\tpath: string\n\tcode: string\n\tmessage: string\n}\n\nexport class ProjectValidateCommand extends Command<Args, Options> {\n\tconstructor(\n\t\tprivate readonly schemaLoader: SchemaLoader,\n\t\tprivate readonly migrationValidator: MigrationsValidator,\n\t\tprivate readonly migrationsResolver: MigrationsResolver,\n\t\tprivate readonly schemaDiffer: SchemaDiffer,\n\t\tprivate readonly schemaVersionBuilder: SchemaVersionBuilder,\n\t) {\n\t\tsuper()\n\t}\n\n\tprotected configure(configuration: CommandConfiguration<Args, Options>): void {\n\t\tconfiguration.description('Validates project schema')\n\t}\n\n\tprotected async execute(input: Input<Args, Options>, output: Output): Promise<void> {\n\t\tconst issues: ValidationIssue[] = []\n\n\t\t// prints its own itemized diagnostics per offending migration; here we only need the pass/fail\n\t\tconst migrations = await this.migrationsResolver.getSchemaMigrations()\n\t\tif (!this.migrationValidator.validate(emptySchema, migrations)) {\n\t\t\tissues.push({\n\t\t\t\tsource: 'migrations',\n\t\t\t\tpath: '',\n\t\t\t\tcode: 'MIGRATIONS_INVALID_SCHEMA',\n\t\t\t\tmessage: 'One or more migrations produce an invalid schema; see the diagnostics above for details',\n\t\t\t})\n\t\t}\n\n\t\tconst schema = await this.schemaLoader.loadSchema()\n\t\tfor (const err of SchemaValidator.validate(schema)) {\n\t\t\tissues.push({ source: 'schema', path: err.path.join('.'), code: err.code, message: err.message })\n\t\t}\n\n\t\tconst builtSchema = await this.schemaVersionBuilder.buildSchema()\n\t\tfor (const err of SchemaValidator.validate(builtSchema)) {\n\t\t\tissues.push({ source: 'built-schema', path: err.path.join('.'), code: err.code, message: err.message })\n\t\t}\n\n\t\t// comparing an already-invalid schema against migrations is meaningless — only diff once both sides are valid\n\t\tif (issues.length === 0) {\n\t\t\tconst diff = await this.schemaDiffer.diffSchemas(builtSchema, schema)\n\t\t\tif (diff.length > 0) {\n\t\t\t\tissues.push({\n\t\t\t\t\tsource: 'diff',\n\t\t\t\t\tpath: '',\n\t\t\t\t\tcode: 'SCHEMA_MIGRATIONS_DIFF',\n\t\t\t\t\tmessage: 'Migrations are not in sync with the defined schema',\n\t\t\t\t})\n\t\t\t}\n\t\t}\n\n\t\tconst columns: { field: keyof ValidationIssue & string; name: string }[] = [\n\t\t\t{ field: 'source', name: 'Source' },\n\t\t\t{ field: 'path', name: 'Path' },\n\t\t\t{ field: 'code', name: 'Code' },\n\t\t\t{ field: 'message', name: 'Message' },\n\t\t]\n\t\tif (issues.length > 0) {\n\t\t\tif (!output.isJson && !output.isQuiet) {\n\t\t\t\toutput.table(columns, issues, 'message')\n\t\t\t}\n\t\t\tthrow new CliError(`Project schema is invalid: found ${issues.length} issue(s)`, {\n\t\t\t\tcode: 'SCHEMA_INVALID',\n\t\t\t\texitCode: ExitCode.InputError,\n\t\t\t\tdetails: issues,\n\t\t\t})\n\t\t}\n\n\t\toutput.table(columns, issues, 'message')\n\t\toutput.info('Project schema is valid')\n\t}\n}\n"],"names":[],"mappings":";;AAkBO,MAAM,+BAA+B,QAAuB;AAAA,EAClE,YACkB,cACA,oBACA,oBACA,cACA,sBAChB;AACD,UAAA;AANiB,SAAA,eAAA;AACA,SAAA,qBAAA;AACA,SAAA,qBAAA;AACA,SAAA,eAAA;AACA,SAAA,uBAAA;AAAA,EAGlB;AAAA,EAEU,UAAU,eAA0D;AAC7E,kBAAc,YAAY,0BAA0B;AAAA,EACrD;AAAA,EAEA,MAAgB,QAAQ,OAA6B,QAA+B;AACnF,UAAM,SAA4B,CAAA;AAGlC,UAAM,aAAa,MAAM,KAAK,mBAAmB,oBAAA;AACjD,QAAI,CAAC,KAAK,mBAAmB,SAAS,aAAa,UAAU,GAAG;AAC/D,aAAO,KAAK;AAAA,QACX,QAAQ;AAAA,QACR,MAAM;AAAA,QACN,MAAM;AAAA,QACN,SAAS;AAAA,MAAA,CACT;AAAA,IACF;AAEA,UAAM,SAAS,MAAM,KAAK,aAAa,WAAA;AACvC,eAAW,OAAO,gBAAgB,SAAS,MAAM,GAAG;AACnD,aAAO,KAAK,EAAE,QAAQ,UAAU,MAAM,IAAI,KAAK,KAAK,GAAG,GAAG,MAAM,IAAI,MAAM,SAAS,IAAI,SAAS;AAAA,IACjG;AAEA,UAAM,cAAc,MAAM,KAAK,qBAAqB,YAAA;AACpD,eAAW,OAAO,gBAAgB,SAAS,WAAW,GAAG;AACxD,aAAO,KAAK,EAAE,QAAQ,gBAAgB,MAAM,IAAI,KAAK,KAAK,GAAG,GAAG,MAAM,IAAI,MAAM,SAAS,IAAI,SAAS;AAAA,IACvG;AAGA,QAAI,OAAO,WAAW,GAAG;AACxB,YAAM,OAAO,MAAM,KAAK,aAAa,YAAY,aAAa,MAAM;AACpE,UAAI,KAAK,SAAS,GAAG;AACpB,eAAO,KAAK;AAAA,UACX,QAAQ;AAAA,UACR,MAAM;AAAA,UACN,MAAM;AAAA,UACN,SAAS;AAAA,QAAA,CACT;AAAA,MACF;AAAA,IACD;AAEA,UAAM,UAAqE;AAAA,MAC1E,EAAE,OAAO,UAAU,MAAM,SAAA;AAAA,MACzB,EAAE,OAAO,QAAQ,MAAM,OAAA;AAAA,MACvB,EAAE,OAAO,QAAQ,MAAM,OAAA;AAAA,MACvB,EAAE,OAAO,WAAW,MAAM,UAAA;AAAA,IAAU;AAErC,QAAI,OAAO,SAAS,GAAG;AACtB,UAAI,CAAC,OAAO,UAAU,CAAC,OAAO,SAAS;AACtC,eAAO,MAAM,SAAS,QAAQ,SAAS;AAAA,MACxC;AACA,YAAM,IAAI,SAAS,oCAAoC,OAAO,MAAM,aAAa;AAAA,QAChF,MAAM;AAAA,QACN,UAAU,SAAS;AAAA,QACnB,SAAS;AAAA,MAAA,CACT;AAAA,IACF;AAEA,WAAO,MAAM,SAAS,QAAQ,SAAS;AACvC,WAAO,KAAK,yBAAyB;AAAA,EACtC;AACD;"}

package/dist/development/src/commands/tenant/TenantApplyCommand.cjs

@@ -0,0 +1,59 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const cliCommon = require("@contember/cli-common");
+const TenantApiTransport = require("../../lib/tenant/TenantApiTransport.cjs");
+const index = require("../../lib/tenant/clients/index.cjs");
+const tenantOutput = require("./tenantOutput.cjs");
+const DEFAULT_CONFIG_PATH = "tenant.config.ts";
+class TenantApplyCommand extends cliCommon.Command {
+  constructor(remoteProjectResolver, tenantConfigLoader, tenantConfigApplier) {
+    super();
+    this.remoteProjectResolver = remoteProjectResolver;
+    this.tenantConfigLoader = tenantConfigLoader;
+    this.tenantConfigApplier = tenantConfigApplier;
+  }
+  configure(configuration) {
+    configuration.description("Apply declarative tenant configuration (global config, identity providers, mail templates, custom roles)");
+    configuration.argument("config").optional().description(`Path to the tenant config file (default: ${DEFAULT_CONFIG_PATH})`);
+    configuration.option("dsn").valueRequired().description("Project DSN. Falls back to CONTEMBER_* environment variables.");
+    configuration.option("dry-run").valueNone().description("Print the actions that would be performed without executing them.");
+  }
+  async execute(input, output) {
+    const configPath = input.getArgument("config") ?? DEFAULT_CONFIG_PATH;
+    const dsn = input.getOption("dsn");
+    const dryRun = input.getOption("dry-run") === true;
+    const remoteProject = this.remoteProjectResolver.resolve(dsn);
+    if (!remoteProject) {
+      throw new cliCommon.CliError("Project not defined. Please provide a DSN (--dsn) or set CONTEMBER_* environment variables.", {
+        code: "PROJECT_NOT_DEFINED",
+        exitCode: cliCommon.ExitCode.InputError
+      });
+    }
+    const config = await this.tenantConfigLoader.loadConfig(configPath);
+    const clients = index.createTenantClients(TenantApiTransport.TenantApiTransport.create(remoteProject.endpoint, remoteProject.token));
+    output.info(`Applying tenant config from ${configPath}`);
+    output.info(`API URL: ${remoteProject.endpoint}`);
+    const { actions, warnings } = await this.tenantConfigApplier.apply(clients, config, { dryRun });
+    const result = { configPath, dryRun, actions, warnings };
+    output.data(result, {
+      human: renderApplyResult,
+      // deliberately actions only: quiet is a scalar stream meant for piping, and the applier
+      // already printed the warnings on stderr wherever they are not suppressed
+      quiet: (value) => value.actions.map(formatAction)
+    });
+    if (actions.length === 0) {
+      output.info("Nothing to apply, the config declares no actions.");
+    } else {
+      output.info(dryRun ? "Dry run complete. No changes were made." : "Tenant configuration applied.");
+    }
+  }
+}
+const formatAction = (action) => action.target === null ? tenantOutput.humanText(action.action) : `${tenantOutput.humanText(action.action)}:${tenantOutput.humanText(action.target)}`;
+const renderApplyResult = (result) => {
+  if (result.actions.length === 0) {
+    return "No tenant configuration actions.";
+  }
+  return result.actions.map(formatAction).join("\n");
+};
+exports.TenantApplyCommand = TenantApplyCommand;
+//# sourceMappingURL=TenantApplyCommand.cjs.map

package/dist/development/src/commands/tenant/TenantApplyCommand.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantApplyCommand.cjs","sources":["../../../../../../packages/cli/src/commands/tenant/TenantApplyCommand.ts"],"sourcesContent":["import { CliError, Command, CommandConfiguration, ExitCode, Input, Output } from '@contember/cli-common'\nimport { RemoteProjectResolver } from '../../lib/project/RemoteProjectResolver.js'\nimport { TenantApiTransport } from '../../lib/tenant/TenantApiTransport.js'\nimport { createTenantClients } from '../../lib/tenant/clients/index.js'\nimport { TenantConfigLoader } from '../../lib/tenant/TenantConfigLoader.js'\nimport { TenantConfigAction, TenantConfigApplier, TenantConfigWarning } from '../../lib/tenant/TenantConfigApplier.js'\nimport { humanText } from './tenantOutput.js'\n\ntype Args = {\n\tconfig?: string\n}\n\ntype Options = {\n\tdsn?: string\n\t['dry-run']?: boolean\n}\n\nconst DEFAULT_CONFIG_PATH = 'tenant.config.ts'\n\nexport class TenantApplyCommand extends Command<Args, Options> {\n\tconstructor(\n\t\tprivate readonly remoteProjectResolver: RemoteProjectResolver,\n\t\tprivate readonly tenantConfigLoader: TenantConfigLoader,\n\t\tprivate readonly tenantConfigApplier: TenantConfigApplier,\n\t) {\n\t\tsuper()\n\t}\n\n\tprotected configure(configuration: CommandConfiguration<Args, Options>): void {\n\t\tconfiguration.description('Apply declarative tenant configuration (global config, identity providers, mail templates, custom roles)')\n\t\tconfiguration.argument('config').optional().description(`Path to the tenant config file (default: ${DEFAULT_CONFIG_PATH})`)\n\t\tconfiguration.option('dsn').valueRequired().description('Project DSN. Falls back to CONTEMBER_* environment variables.')\n\t\tconfiguration.option('dry-run').valueNone().description('Print the actions that would be performed without executing them.')\n\t}\n\n\tprotected async execute(input: Input<Args, Options>, output: Output): Promise<void> {\n\t\tconst configPath = input.getArgument('config') ?? DEFAULT_CONFIG_PATH\n\t\tconst dsn = input.getOption('dsn')\n\t\tconst dryRun = input.getOption('dry-run') === true\n\n\t\tconst remoteProject = this.remoteProjectResolver.resolve(dsn)\n\t\tif (!remoteProject) {\n\t\t\tthrow new CliError('Project not defined. Please provide a DSN (--dsn) or set CONTEMBER_* environment variables.', {\n\t\t\t\tcode: 'PROJECT_NOT_DEFINED',\n\t\t\t\texitCode: ExitCode.InputError,\n\t\t\t})\n\t\t}\n\n\t\tconst config = await this.tenantConfigLoader.loadConfig(configPath)\n\t\tconst clients = createTenantClients(TenantApiTransport.create(remoteProject.endpoint, remoteProject.token))\n\n\t\toutput.info(`Applying tenant config from ${configPath}`)\n\t\toutput.info(`API URL: ${remoteProject.endpoint}`)\n\n\t\tconst { actions, warnings } = await this.tenantConfigApplier.apply(clients, config, { dryRun })\n\n\t\tconst result: TenantConfigApplyResult = { configPath, dryRun, actions, warnings }\n\t\toutput.data(result, {\n\t\t\thuman: renderApplyResult,\n\t\t\t// deliberately actions only: quiet is a scalar stream meant for piping, and the applier\n\t\t\t// already printed the warnings on stderr wherever they are not suppressed\n\t\t\tquiet: value => value.actions.map(formatAction),\n\t\t})\n\n\t\tif (actions.length === 0) {\n\t\t\toutput.info('Nothing to apply, the config declares no actions.')\n\t\t} else {\n\t\t\toutput.info(dryRun ? 'Dry run complete. No changes were made.' : 'Tenant configuration applied.')\n\t\t}\n\t}\n}\n\nexport interface TenantConfigApplyResult {\n\tconfigPath: string\n\tdryRun: boolean\n\tactions: TenantConfigAction[]\n\t/** Reachable in `--json` only; `output.warn` writes nothing outside human mode. */\n\twarnings: TenantConfigWarning[]\n}\n\nconst formatAction = (action: TenantConfigAction): string =>\n\taction.target === null ? humanText(action.action) : `${humanText(action.action)}:${humanText(action.target)}`\n\nconst renderApplyResult = (result: TenantConfigApplyResult): string => {\n\tif (result.actions.length === 0) {\n\t\treturn 'No tenant configuration actions.'\n\t}\n\treturn result.actions.map(formatAction).join('\\n')\n}\n"],"names":["Command","CliError","ExitCode","createTenantClients","TenantApiTransport","humanText"],"mappings":";;;;;;AAiBA,MAAM,sBAAsB;AAErB,MAAM,2BAA2BA,UAAAA,QAAuB;AAAA,EAC9D,YACkB,uBACA,oBACA,qBAChB;AACD,UAAA;AAJiB,SAAA,wBAAA;AACA,SAAA,qBAAA;AACA,SAAA,sBAAA;AAAA,EAGlB;AAAA,EAEU,UAAU,eAA0D;AAC7E,kBAAc,YAAY,0GAA0G;AACpI,kBAAc,SAAS,QAAQ,EAAE,SAAA,EAAW,YAAY,4CAA4C,mBAAmB,GAAG;AAC1H,kBAAc,OAAO,KAAK,EAAE,cAAA,EAAgB,YAAY,+DAA+D;AACvH,kBAAc,OAAO,SAAS,EAAE,UAAA,EAAY,YAAY,mEAAmE;AAAA,EAC5H;AAAA,EAEA,MAAgB,QAAQ,OAA6B,QAA+B;AACnF,UAAM,aAAa,MAAM,YAAY,QAAQ,KAAK;AAClD,UAAM,MAAM,MAAM,UAAU,KAAK;AACjC,UAAM,SAAS,MAAM,UAAU,SAAS,MAAM;AAE9C,UAAM,gBAAgB,KAAK,sBAAsB,QAAQ,GAAG;AAC5D,QAAI,CAAC,eAAe;AACnB,YAAM,IAAIC,UAAAA,SAAS,+FAA+F;AAAA,QACjH,MAAM;AAAA,QACN,UAAUC,UAAAA,SAAS;AAAA,MAAA,CACnB;AAAA,IACF;AAEA,UAAM,SAAS,MAAM,KAAK,mBAAmB,WAAW,UAAU;AAClE,UAAM,UAAUC,MAAAA,oBAAoBC,sCAAmB,OAAO,cAAc,UAAU,cAAc,KAAK,CAAC;AAE1G,WAAO,KAAK,+BAA+B,UAAU,EAAE;AACvD,WAAO,KAAK,YAAY,cAAc,QAAQ,EAAE;AAEhD,UAAM,EAAE,SAAS,SAAA,IAAa,MAAM,KAAK,oBAAoB,MAAM,SAAS,QAAQ,EAAE,OAAA,CAAQ;AAE9F,UAAM,SAAkC,EAAE,YAAY,QAAQ,SAAS,SAAA;AACvE,WAAO,KAAK,QAAQ;AAAA,MACnB,OAAO;AAAA;AAAA;AAAA,MAGP,OAAO,CAAA,UAAS,MAAM,QAAQ,IAAI,YAAY;AAAA,IAAA,CAC9C;AAED,QAAI,QAAQ,WAAW,GAAG;AACzB,aAAO,KAAK,mDAAmD;AAAA,IAChE,OAAO;AACN,aAAO,KAAK,SAAS,4CAA4C,+BAA+B;AAAA,IACjG;AAAA,EACD;AACD;AAUA,MAAM,eAAe,CAAC,WACrB,OAAO,WAAW,OAAOC,aAAAA,UAAU,OAAO,MAAM,IAAI,GAAGA,uBAAU,OAAO,MAAM,CAAC,IAAIA,aAAAA,UAAU,OAAO,MAAM,CAAC;AAE5G,MAAM,oBAAoB,CAAC,WAA4C;AACtE,MAAI,OAAO,QAAQ,WAAW,GAAG;AAChC,WAAO;AAAA,EACR;AACA,SAAO,OAAO,QAAQ,IAAI,YAAY,EAAE,KAAK,IAAI;AAClD;;"}

package/dist/development/src/commands/tenant/TenantApplyCommand.js

@@ -0,0 +1,59 @@
+import { Command, CliError, ExitCode } from "@contember/cli-common";
+import { TenantApiTransport } from "../../lib/tenant/TenantApiTransport.js";
+import { createTenantClients } from "../../lib/tenant/clients/index.js";
+import { humanText } from "./tenantOutput.js";
+const DEFAULT_CONFIG_PATH = "tenant.config.ts";
+class TenantApplyCommand extends Command {
+  constructor(remoteProjectResolver, tenantConfigLoader, tenantConfigApplier) {
+    super();
+    this.remoteProjectResolver = remoteProjectResolver;
+    this.tenantConfigLoader = tenantConfigLoader;
+    this.tenantConfigApplier = tenantConfigApplier;
+  }
+  configure(configuration) {
+    configuration.description("Apply declarative tenant configuration (global config, identity providers, mail templates, custom roles)");
+    configuration.argument("config").optional().description(`Path to the tenant config file (default: ${DEFAULT_CONFIG_PATH})`);
+    configuration.option("dsn").valueRequired().description("Project DSN. Falls back to CONTEMBER_* environment variables.");
+    configuration.option("dry-run").valueNone().description("Print the actions that would be performed without executing them.");
+  }
+  async execute(input, output) {
+    const configPath = input.getArgument("config") ?? DEFAULT_CONFIG_PATH;
+    const dsn = input.getOption("dsn");
+    const dryRun = input.getOption("dry-run") === true;
+    const remoteProject = this.remoteProjectResolver.resolve(dsn);
+    if (!remoteProject) {
+      throw new CliError("Project not defined. Please provide a DSN (--dsn) or set CONTEMBER_* environment variables.", {
+        code: "PROJECT_NOT_DEFINED",
+        exitCode: ExitCode.InputError
+      });
+    }
+    const config = await this.tenantConfigLoader.loadConfig(configPath);
+    const clients = createTenantClients(TenantApiTransport.create(remoteProject.endpoint, remoteProject.token));
+    output.info(`Applying tenant config from ${configPath}`);
+    output.info(`API URL: ${remoteProject.endpoint}`);
+    const { actions, warnings } = await this.tenantConfigApplier.apply(clients, config, { dryRun });
+    const result = { configPath, dryRun, actions, warnings };
+    output.data(result, {
+      human: renderApplyResult,
+      // deliberately actions only: quiet is a scalar stream meant for piping, and the applier
+      // already printed the warnings on stderr wherever they are not suppressed
+      quiet: (value) => value.actions.map(formatAction)
+    });
+    if (actions.length === 0) {
+      output.info("Nothing to apply, the config declares no actions.");
+    } else {
+      output.info(dryRun ? "Dry run complete. No changes were made." : "Tenant configuration applied.");
+    }
+  }
+}
+const formatAction = (action) => action.target === null ? humanText(action.action) : `${humanText(action.action)}:${humanText(action.target)}`;
+const renderApplyResult = (result) => {
+  if (result.actions.length === 0) {
+    return "No tenant configuration actions.";
+  }
+  return result.actions.map(formatAction).join("\n");
+};
+export {
+  TenantApplyCommand
+};
+//# sourceMappingURL=TenantApplyCommand.js.map

package/dist/development/src/commands/tenant/TenantApplyCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantApplyCommand.js","sources":["../../../../../../packages/cli/src/commands/tenant/TenantApplyCommand.ts"],"sourcesContent":["import { CliError, Command, CommandConfiguration, ExitCode, Input, Output } from '@contember/cli-common'\nimport { RemoteProjectResolver } from '../../lib/project/RemoteProjectResolver.js'\nimport { TenantApiTransport } from '../../lib/tenant/TenantApiTransport.js'\nimport { createTenantClients } from '../../lib/tenant/clients/index.js'\nimport { TenantConfigLoader } from '../../lib/tenant/TenantConfigLoader.js'\nimport { TenantConfigAction, TenantConfigApplier, TenantConfigWarning } from '../../lib/tenant/TenantConfigApplier.js'\nimport { humanText } from './tenantOutput.js'\n\ntype Args = {\n\tconfig?: string\n}\n\ntype Options = {\n\tdsn?: string\n\t['dry-run']?: boolean\n}\n\nconst DEFAULT_CONFIG_PATH = 'tenant.config.ts'\n\nexport class TenantApplyCommand extends Command<Args, Options> {\n\tconstructor(\n\t\tprivate readonly remoteProjectResolver: RemoteProjectResolver,\n\t\tprivate readonly tenantConfigLoader: TenantConfigLoader,\n\t\tprivate readonly tenantConfigApplier: TenantConfigApplier,\n\t) {\n\t\tsuper()\n\t}\n\n\tprotected configure(configuration: CommandConfiguration<Args, Options>): void {\n\t\tconfiguration.description('Apply declarative tenant configuration (global config, identity providers, mail templates, custom roles)')\n\t\tconfiguration.argument('config').optional().description(`Path to the tenant config file (default: ${DEFAULT_CONFIG_PATH})`)\n\t\tconfiguration.option('dsn').valueRequired().description('Project DSN. Falls back to CONTEMBER_* environment variables.')\n\t\tconfiguration.option('dry-run').valueNone().description('Print the actions that would be performed without executing them.')\n\t}\n\n\tprotected async execute(input: Input<Args, Options>, output: Output): Promise<void> {\n\t\tconst configPath = input.getArgument('config') ?? DEFAULT_CONFIG_PATH\n\t\tconst dsn = input.getOption('dsn')\n\t\tconst dryRun = input.getOption('dry-run') === true\n\n\t\tconst remoteProject = this.remoteProjectResolver.resolve(dsn)\n\t\tif (!remoteProject) {\n\t\t\tthrow new CliError('Project not defined. Please provide a DSN (--dsn) or set CONTEMBER_* environment variables.', {\n\t\t\t\tcode: 'PROJECT_NOT_DEFINED',\n\t\t\t\texitCode: ExitCode.InputError,\n\t\t\t})\n\t\t}\n\n\t\tconst config = await this.tenantConfigLoader.loadConfig(configPath)\n\t\tconst clients = createTenantClients(TenantApiTransport.create(remoteProject.endpoint, remoteProject.token))\n\n\t\toutput.info(`Applying tenant config from ${configPath}`)\n\t\toutput.info(`API URL: ${remoteProject.endpoint}`)\n\n\t\tconst { actions, warnings } = await this.tenantConfigApplier.apply(clients, config, { dryRun })\n\n\t\tconst result: TenantConfigApplyResult = { configPath, dryRun, actions, warnings }\n\t\toutput.data(result, {\n\t\t\thuman: renderApplyResult,\n\t\t\t// deliberately actions only: quiet is a scalar stream meant for piping, and the applier\n\t\t\t// already printed the warnings on stderr wherever they are not suppressed\n\t\t\tquiet: value => value.actions.map(formatAction),\n\t\t})\n\n\t\tif (actions.length === 0) {\n\t\t\toutput.info('Nothing to apply, the config declares no actions.')\n\t\t} else {\n\t\t\toutput.info(dryRun ? 'Dry run complete. No changes were made.' : 'Tenant configuration applied.')\n\t\t}\n\t}\n}\n\nexport interface TenantConfigApplyResult {\n\tconfigPath: string\n\tdryRun: boolean\n\tactions: TenantConfigAction[]\n\t/** Reachable in `--json` only; `output.warn` writes nothing outside human mode. */\n\twarnings: TenantConfigWarning[]\n}\n\nconst formatAction = (action: TenantConfigAction): string =>\n\taction.target === null ? humanText(action.action) : `${humanText(action.action)}:${humanText(action.target)}`\n\nconst renderApplyResult = (result: TenantConfigApplyResult): string => {\n\tif (result.actions.length === 0) {\n\t\treturn 'No tenant configuration actions.'\n\t}\n\treturn result.actions.map(formatAction).join('\\n')\n}\n"],"names":[],"mappings":";;;;AAiBA,MAAM,sBAAsB;AAErB,MAAM,2BAA2B,QAAuB;AAAA,EAC9D,YACkB,uBACA,oBACA,qBAChB;AACD,UAAA;AAJiB,SAAA,wBAAA;AACA,SAAA,qBAAA;AACA,SAAA,sBAAA;AAAA,EAGlB;AAAA,EAEU,UAAU,eAA0D;AAC7E,kBAAc,YAAY,0GAA0G;AACpI,kBAAc,SAAS,QAAQ,EAAE,SAAA,EAAW,YAAY,4CAA4C,mBAAmB,GAAG;AAC1H,kBAAc,OAAO,KAAK,EAAE,cAAA,EAAgB,YAAY,+DAA+D;AACvH,kBAAc,OAAO,SAAS,EAAE,UAAA,EAAY,YAAY,mEAAmE;AAAA,EAC5H;AAAA,EAEA,MAAgB,QAAQ,OAA6B,QAA+B;AACnF,UAAM,aAAa,MAAM,YAAY,QAAQ,KAAK;AAClD,UAAM,MAAM,MAAM,UAAU,KAAK;AACjC,UAAM,SAAS,MAAM,UAAU,SAAS,MAAM;AAE9C,UAAM,gBAAgB,KAAK,sBAAsB,QAAQ,GAAG;AAC5D,QAAI,CAAC,eAAe;AACnB,YAAM,IAAI,SAAS,+FAA+F;AAAA,QACjH,MAAM;AAAA,QACN,UAAU,SAAS;AAAA,MAAA,CACnB;AAAA,IACF;AAEA,UAAM,SAAS,MAAM,KAAK,mBAAmB,WAAW,UAAU;AAClE,UAAM,UAAU,oBAAoB,mBAAmB,OAAO,cAAc,UAAU,cAAc,KAAK,CAAC;AAE1G,WAAO,KAAK,+BAA+B,UAAU,EAAE;AACvD,WAAO,KAAK,YAAY,cAAc,QAAQ,EAAE;AAEhD,UAAM,EAAE,SAAS,SAAA,IAAa,MAAM,KAAK,oBAAoB,MAAM,SAAS,QAAQ,EAAE,OAAA,CAAQ;AAE9F,UAAM,SAAkC,EAAE,YAAY,QAAQ,SAAS,SAAA;AACvE,WAAO,KAAK,QAAQ;AAAA,MACnB,OAAO;AAAA;AAAA;AAAA,MAGP,OAAO,CAAA,UAAS,MAAM,QAAQ,IAAI,YAAY;AAAA,IAAA,CAC9C;AAED,QAAI,QAAQ,WAAW,GAAG;AACzB,aAAO,KAAK,mDAAmD;AAAA,IAChE,OAAO;AACN,aAAO,KAAK,SAAS,4CAA4C,+BAA+B;AAAA,IACjG;AAAA,EACD;AACD;AAUA,MAAM,eAAe,CAAC,WACrB,OAAO,WAAW,OAAO,UAAU,OAAO,MAAM,IAAI,GAAG,UAAU,OAAO,MAAM,CAAC,IAAI,UAAU,OAAO,MAAM,CAAC;AAE5G,MAAM,oBAAoB,CAAC,WAA4C;AACtE,MAAI,OAAO,QAAQ,WAAW,GAAG;AAChC,WAAO;AAAA,EACR;AACA,SAAO,OAAO,QAAQ,IAAI,YAAY,EAAE,KAAK,IAAI;AAClD;"}

package/dist/development/src/commands/tenant/apikey/TenantApiKeyCreateCommand.cjs

@@ -0,0 +1,68 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const cliCommon = require("@contember/cli-common");
+const stdin = require("../../../lib/tenant/stdin.cjs");
+const membershipInput = require("../member/membershipInput.cjs");
+const tenantOutput = require("../tenantOutput.cjs");
+class TenantApiKeyCreateCommand extends cliCommon.Command {
+  constructor(tenantClientProvider, readStdin = stdin.readStdinText) {
+    super();
+    this.tenantClientProvider = tenantClientProvider;
+    this.readStdin = readStdin;
+  }
+  configure(configuration) {
+    configuration.description("Create a permanent API key, scoped to a project or global. Prints the token — it is shown exactly once.");
+    configuration.option("project").valueRequired().description("Create a key as a member of this project (slug). Mutually exclusive with --global.");
+    configuration.option("global").valueNone().description("Create a key tied to no project, carrying global tenant roles. Mutually exclusive with --project.");
+    configuration.option("description").valueRequired().required().description("Human-readable label for the key.");
+    membershipInput.configureMembershipOptions(configuration, {
+      roleDescription: "A role to grant, repeatable. With --project a membership role without variables, with --global a tenant role."
+    });
+    configuration.option("token-hash").valueRequired().description("Provision the key from a caller-supplied hex-encoded sha256 token hash instead of generating a token.");
+    configuration.option("trust-forwarded-client-info").valueNone().description(
+      "Trust X-Contember-Client-IP and X-Contember-Client-User-Agent on requests made with this key. Enable only behind a trusted proxy that strips client-supplied values and sets the real ones; otherwise clients can spoof audit metadata."
+    );
+  }
+  async execute(input, output) {
+    const project = input.getOption("project");
+    const global = input.getOption("global") === true;
+    const description = input.getOption("description");
+    const membershipSource = membershipInput.readMembershipInputSource(input);
+    const tokenHash = input.getOption("token-hash");
+    const trustForwardedClientInfo = input.getOption("trust-forwarded-client-info") === true;
+    if (project !== void 0 && global) {
+      throw new cliCommon.CliError("Options --project and --global are mutually exclusive.", { code: "CONFLICTING_TARGET", exitCode: cliCommon.ExitCode.InputError });
+    }
+    if (project === void 0 && !global) {
+      throw new cliCommon.CliError("Specify either --project <slug> or --global.", { code: "TARGET_REQUIRED", exitCode: cliCommon.ExitCode.InputError });
+    }
+    if (global && (membershipSource.json !== void 0 || membershipSource.fromStdin)) {
+      throw new cliCommon.CliError("--memberships and --memberships-stdin only apply to --project.", {
+        code: "CONFLICTING_OPTION",
+        exitCode: cliCommon.ExitCode.InputError
+      });
+    }
+    const options = trustForwardedClientInfo ? { trustForwardedClientInfo: true } : void 0;
+    const apiKey = project !== void 0 ? await this.tenantClientProvider.apiKey().createApiKey({
+      projectSlug: project,
+      memberships: await membershipInput.resolveNonEmptyMemberships(membershipSource, this.readStdin),
+      description,
+      tokenHash,
+      options
+    }) : await this.tenantClientProvider.apiKey().createGlobalApiKey({ description, roles: membershipSource.roles, tokenHash, options });
+    tenantOutput.assertTenantCredentialContract(apiKey.token !== null === (tokenHash === void 0), "API key");
+    const generatedToken = apiKey.token === null ? null : tenantOutput.assertGeneratedTenantToken(apiKey.token, "API key");
+    if (apiKey.token !== null) {
+      output.warn("This token is shown exactly once and cannot be retrieved again — store it now.");
+    } else {
+      output.info("No token was returned: the key was provisioned from --token-hash, so the server never held the plaintext.");
+    }
+    output.data(apiKey, {
+      human: (it) => `Created API key ${tenantOutput.humanText(it.id)}` + (generatedToken !== null ? `
+Token: ${generatedToken}` : ""),
+      quiet: (it) => generatedToken ?? it.id
+    });
+  }
+}
+exports.TenantApiKeyCreateCommand = TenantApiKeyCreateCommand;
+//# sourceMappingURL=TenantApiKeyCreateCommand.cjs.map

package/dist/development/src/commands/tenant/apikey/TenantApiKeyCreateCommand.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantApiKeyCreateCommand.cjs","sources":["../../../../../../../packages/cli/src/commands/tenant/apikey/TenantApiKeyCreateCommand.ts"],"sourcesContent":["import { CliError, Command, CommandConfiguration, ExitCode, Input, Output } from '@contember/cli-common'\nimport { TenantClientProvider } from '../../../lib/TenantClientProvider.js'\nimport { TenantApiKeyWithToken } from '../../../lib/tenant/clients/TenantApiKeyClient.js'\nimport { readStdinText, StdinReader } from '../../../lib/tenant/stdin.js'\nimport { configureMembershipOptions, MembershipOptions, readMembershipInputSource, resolveNonEmptyMemberships } from '../member/membershipInput.js'\nimport { assertGeneratedTenantToken, assertTenantCredentialContract, humanText } from '../tenantOutput.js'\n\ntype Args = {}\n\ntype Options = MembershipOptions & {\n\tproject?: string\n\tglobal?: true\n\tdescription: string\n\t['token-hash']?: string\n\t['trust-forwarded-client-info']?: true\n}\n\n/** `tenant api-key create` — a project-scoped key (`--project`) or a global one (`--global`); exactly one is required. */\nexport class TenantApiKeyCreateCommand extends Command<Args, Options> {\n\tconstructor(\n\t\tprivate readonly tenantClientProvider: TenantClientProvider,\n\t\tprivate readonly readStdin: StdinReader = readStdinText,\n\t) {\n\t\tsuper()\n\t}\n\n\tprotected configure(configuration: CommandConfiguration<Args, Options>): void {\n\t\tconfiguration.description('Create a permanent API key, scoped to a project or global. Prints the token — it is shown exactly once.')\n\t\tconfiguration //\n\t\t\t.option('project')\n\t\t\t.valueRequired()\n\t\t\t.description('Create a key as a member of this project (slug). Mutually exclusive with --global.')\n\t\tconfiguration //\n\t\t\t.option('global')\n\t\t\t.valueNone()\n\t\t\t.description('Create a key tied to no project, carrying global tenant roles. Mutually exclusive with --project.')\n\t\tconfiguration //\n\t\t\t.option('description')\n\t\t\t.valueRequired()\n\t\t\t.required()\n\t\t\t.description('Human-readable label for the key.')\n\t\tconfigureMembershipOptions(configuration, {\n\t\t\troleDescription: 'A role to grant, repeatable. With --project a membership role without variables, with --global a tenant role.',\n\t\t})\n\t\tconfiguration //\n\t\t\t.option('token-hash')\n\t\t\t.valueRequired()\n\t\t\t.description('Provision the key from a caller-supplied hex-encoded sha256 token hash instead of generating a token.')\n\t\tconfiguration //\n\t\t\t.option('trust-forwarded-client-info')\n\t\t\t.valueNone()\n\t\t\t.description(\n\t\t\t\t'Trust X-Contember-Client-IP and X-Contember-Client-User-Agent on requests made with this key. Enable only behind a trusted proxy that strips client-supplied values and sets the real ones; otherwise clients can spoof audit metadata.',\n\t\t\t)\n\t}\n\n\tprotected async execute(input: Input<Args, Options>, output: Output): Promise<void> {\n\t\tconst project = input.getOption('project')\n\t\tconst global = input.getOption('global') === true\n\t\tconst description = input.getOption('description')\n\t\tconst membershipSource = readMembershipInputSource(input)\n\t\tconst tokenHash = input.getOption('token-hash')\n\t\tconst trustForwardedClientInfo = input.getOption('trust-forwarded-client-info') === true\n\n\t\tif (project !== undefined && global) {\n\t\t\tthrow new CliError('Options --project and --global are mutually exclusive.', { code: 'CONFLICTING_TARGET', exitCode: ExitCode.InputError })\n\t\t}\n\t\tif (project === undefined && !global) {\n\t\t\tthrow new CliError('Specify either --project <slug> or --global.', { code: 'TARGET_REQUIRED', exitCode: ExitCode.InputError })\n\t\t}\n\t\tif (global && (membershipSource.json !== undefined || membershipSource.fromStdin)) {\n\t\t\tthrow new CliError('--memberships and --memberships-stdin only apply to --project.', {\n\t\t\t\tcode: 'CONFLICTING_OPTION',\n\t\t\t\texitCode: ExitCode.InputError,\n\t\t\t})\n\t\t}\n\n\t\tconst options = trustForwardedClientInfo ? { trustForwardedClientInfo: true } : undefined\n\n\t\tconst apiKey = project !== undefined\n\t\t\t? await this.tenantClientProvider.apiKey().createApiKey({\n\t\t\t\tprojectSlug: project,\n\t\t\t\tmemberships: await resolveNonEmptyMemberships(membershipSource, this.readStdin),\n\t\t\t\tdescription,\n\t\t\t\ttokenHash,\n\t\t\t\toptions,\n\t\t\t})\n\t\t\t: await this.tenantClientProvider.apiKey().createGlobalApiKey({ description, roles: membershipSource.roles, tokenHash, options })\n\t\tassertTenantCredentialContract((apiKey.token !== null) === (tokenHash === undefined), 'API key')\n\t\tconst generatedToken = apiKey.token === null ? null : assertGeneratedTenantToken(apiKey.token, 'API key')\n\n\t\tif (apiKey.token !== null) {\n\t\t\toutput.warn('This token is shown exactly once and cannot be retrieved again — store it now.')\n\t\t} else {\n\t\t\toutput.info('No token was returned: the key was provisioned from --token-hash, so the server never held the plaintext.')\n\t\t}\n\t\toutput.data<TenantApiKeyWithToken>(apiKey, {\n\t\t\thuman: it => `Created API key ${humanText(it.id)}` + (generatedToken !== null ? `\\nToken: ${generatedToken}` : ''),\n\t\t\tquiet: it => generatedToken ?? it.id,\n\t\t})\n\t}\n}\n"],"names":["Command","readStdinText","configureMembershipOptions","readMembershipInputSource","CliError","ExitCode","resolveNonEmptyMemberships","assertTenantCredentialContract","assertGeneratedTenantToken","humanText"],"mappings":";;;;;;AAkBO,MAAM,kCAAkCA,UAAAA,QAAuB;AAAA,EACrE,YACkB,sBACA,YAAyBC,qBACzC;AACD,UAAA;AAHiB,SAAA,uBAAA;AACA,SAAA,YAAA;AAAA,EAGlB;AAAA,EAEU,UAAU,eAA0D;AAC7E,kBAAc,YAAY,yGAAyG;AACnI,kBACE,OAAO,SAAS,EAChB,cAAA,EACA,YAAY,oFAAoF;AAClG,kBACE,OAAO,QAAQ,EACf,UAAA,EACA,YAAY,mGAAmG;AACjH,kBACE,OAAO,aAAa,EACpB,cAAA,EACA,SAAA,EACA,YAAY,mCAAmC;AACjDC,oBAAAA,2BAA2B,eAAe;AAAA,MACzC,iBAAiB;AAAA,IAAA,CACjB;AACD,kBACE,OAAO,YAAY,EACnB,cAAA,EACA,YAAY,uGAAuG;AACrH,kBACE,OAAO,6BAA6B,EACpC,UAAA,EACA;AAAA,MACA;AAAA,IAAA;AAAA,EAEH;AAAA,EAEA,MAAgB,QAAQ,OAA6B,QAA+B;AACnF,UAAM,UAAU,MAAM,UAAU,SAAS;AACzC,UAAM,SAAS,MAAM,UAAU,QAAQ,MAAM;AAC7C,UAAM,cAAc,MAAM,UAAU,aAAa;AACjD,UAAM,mBAAmBC,gBAAAA,0BAA0B,KAAK;AACxD,UAAM,YAAY,MAAM,UAAU,YAAY;AAC9C,UAAM,2BAA2B,MAAM,UAAU,6BAA6B,MAAM;AAEpF,QAAI,YAAY,UAAa,QAAQ;AACpC,YAAM,IAAIC,UAAAA,SAAS,0DAA0D,EAAE,MAAM,sBAAsB,UAAUC,mBAAS,YAAY;AAAA,IAC3I;AACA,QAAI,YAAY,UAAa,CAAC,QAAQ;AACrC,YAAM,IAAID,UAAAA,SAAS,gDAAgD,EAAE,MAAM,mBAAmB,UAAUC,mBAAS,YAAY;AAAA,IAC9H;AACA,QAAI,WAAW,iBAAiB,SAAS,UAAa,iBAAiB,YAAY;AAClF,YAAM,IAAID,UAAAA,SAAS,kEAAkE;AAAA,QACpF,MAAM;AAAA,QACN,UAAUC,UAAAA,SAAS;AAAA,MAAA,CACnB;AAAA,IACF;AAEA,UAAM,UAAU,2BAA2B,EAAE,0BAA0B,SAAS;AAEhF,UAAM,SAAS,YAAY,SACxB,MAAM,KAAK,qBAAqB,OAAA,EAAS,aAAa;AAAA,MACvD,aAAa;AAAA,MACb,aAAa,MAAMC,gBAAAA,2BAA2B,kBAAkB,KAAK,SAAS;AAAA,MAC9E;AAAA,MACA;AAAA,MACA;AAAA,IAAA,CACA,IACC,MAAM,KAAK,qBAAqB,OAAA,EAAS,mBAAmB,EAAE,aAAa,OAAO,iBAAiB,OAAO,WAAW,SAAS;AACjIC,iBAAAA,+BAAgC,OAAO,UAAU,UAAW,cAAc,SAAY,SAAS;AAC/F,UAAM,iBAAiB,OAAO,UAAU,OAAO,OAAOC,wCAA2B,OAAO,OAAO,SAAS;AAExG,QAAI,OAAO,UAAU,MAAM;AAC1B,aAAO,KAAK,gFAAgF;AAAA,IAC7F,OAAO;AACN,aAAO,KAAK,2GAA2G;AAAA,IACxH;AACA,WAAO,KAA4B,QAAQ;AAAA,MAC1C,OAAO,QAAM,mBAAmBC,aAAAA,UAAU,GAAG,EAAE,CAAC,MAAM,mBAAmB,OAAO;AAAA,SAAY,cAAc,KAAK;AAAA,MAC/G,OAAO,CAAA,OAAM,kBAAkB,GAAG;AAAA,IAAA,CAClC;AAAA,EACF;AACD;;"}

package/dist/development/src/commands/tenant/apikey/TenantApiKeyCreateCommand.js

@@ -0,0 +1,68 @@
+import { Command, CliError, ExitCode } from "@contember/cli-common";
+import { readStdinText } from "../../../lib/tenant/stdin.js";
+import { configureMembershipOptions, readMembershipInputSource, resolveNonEmptyMemberships } from "../member/membershipInput.js";
+import { assertTenantCredentialContract, assertGeneratedTenantToken, humanText } from "../tenantOutput.js";
+class TenantApiKeyCreateCommand extends Command {
+  constructor(tenantClientProvider, readStdin = readStdinText) {
+    super();
+    this.tenantClientProvider = tenantClientProvider;
+    this.readStdin = readStdin;
+  }
+  configure(configuration) {
+    configuration.description("Create a permanent API key, scoped to a project or global. Prints the token — it is shown exactly once.");
+    configuration.option("project").valueRequired().description("Create a key as a member of this project (slug). Mutually exclusive with --global.");
+    configuration.option("global").valueNone().description("Create a key tied to no project, carrying global tenant roles. Mutually exclusive with --project.");
+    configuration.option("description").valueRequired().required().description("Human-readable label for the key.");
+    configureMembershipOptions(configuration, {
+      roleDescription: "A role to grant, repeatable. With --project a membership role without variables, with --global a tenant role."
+    });
+    configuration.option("token-hash").valueRequired().description("Provision the key from a caller-supplied hex-encoded sha256 token hash instead of generating a token.");
+    configuration.option("trust-forwarded-client-info").valueNone().description(
+      "Trust X-Contember-Client-IP and X-Contember-Client-User-Agent on requests made with this key. Enable only behind a trusted proxy that strips client-supplied values and sets the real ones; otherwise clients can spoof audit metadata."
+    );
+  }
+  async execute(input, output) {
+    const project = input.getOption("project");
+    const global = input.getOption("global") === true;
+    const description = input.getOption("description");
+    const membershipSource = readMembershipInputSource(input);
+    const tokenHash = input.getOption("token-hash");
+    const trustForwardedClientInfo = input.getOption("trust-forwarded-client-info") === true;
+    if (project !== void 0 && global) {
+      throw new CliError("Options --project and --global are mutually exclusive.", { code: "CONFLICTING_TARGET", exitCode: ExitCode.InputError });
+    }
+    if (project === void 0 && !global) {
+      throw new CliError("Specify either --project <slug> or --global.", { code: "TARGET_REQUIRED", exitCode: ExitCode.InputError });
+    }
+    if (global && (membershipSource.json !== void 0 || membershipSource.fromStdin)) {
+      throw new CliError("--memberships and --memberships-stdin only apply to --project.", {
+        code: "CONFLICTING_OPTION",
+        exitCode: ExitCode.InputError
+      });
+    }
+    const options = trustForwardedClientInfo ? { trustForwardedClientInfo: true } : void 0;
+    const apiKey = project !== void 0 ? await this.tenantClientProvider.apiKey().createApiKey({
+      projectSlug: project,
+      memberships: await resolveNonEmptyMemberships(membershipSource, this.readStdin),
+      description,
+      tokenHash,
+      options
+    }) : await this.tenantClientProvider.apiKey().createGlobalApiKey({ description, roles: membershipSource.roles, tokenHash, options });
+    assertTenantCredentialContract(apiKey.token !== null === (tokenHash === void 0), "API key");
+    const generatedToken = apiKey.token === null ? null : assertGeneratedTenantToken(apiKey.token, "API key");
+    if (apiKey.token !== null) {
+      output.warn("This token is shown exactly once and cannot be retrieved again — store it now.");
+    } else {
+      output.info("No token was returned: the key was provisioned from --token-hash, so the server never held the plaintext.");
+    }
+    output.data(apiKey, {
+      human: (it) => `Created API key ${humanText(it.id)}` + (generatedToken !== null ? `
+Token: ${generatedToken}` : ""),
+      quiet: (it) => generatedToken ?? it.id
+    });
+  }
+}
+export {
+  TenantApiKeyCreateCommand
+};
+//# sourceMappingURL=TenantApiKeyCreateCommand.js.map

package/dist/development/src/commands/tenant/apikey/TenantApiKeyCreateCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantApiKeyCreateCommand.js","sources":["../../../../../../../packages/cli/src/commands/tenant/apikey/TenantApiKeyCreateCommand.ts"],"sourcesContent":["import { CliError, Command, CommandConfiguration, ExitCode, Input, Output } from '@contember/cli-common'\nimport { TenantClientProvider } from '../../../lib/TenantClientProvider.js'\nimport { TenantApiKeyWithToken } from '../../../lib/tenant/clients/TenantApiKeyClient.js'\nimport { readStdinText, StdinReader } from '../../../lib/tenant/stdin.js'\nimport { configureMembershipOptions, MembershipOptions, readMembershipInputSource, resolveNonEmptyMemberships } from '../member/membershipInput.js'\nimport { assertGeneratedTenantToken, assertTenantCredentialContract, humanText } from '../tenantOutput.js'\n\ntype Args = {}\n\ntype Options = MembershipOptions & {\n\tproject?: string\n\tglobal?: true\n\tdescription: string\n\t['token-hash']?: string\n\t['trust-forwarded-client-info']?: true\n}\n\n/** `tenant api-key create` — a project-scoped key (`--project`) or a global one (`--global`); exactly one is required. */\nexport class TenantApiKeyCreateCommand extends Command<Args, Options> {\n\tconstructor(\n\t\tprivate readonly tenantClientProvider: TenantClientProvider,\n\t\tprivate readonly readStdin: StdinReader = readStdinText,\n\t) {\n\t\tsuper()\n\t}\n\n\tprotected configure(configuration: CommandConfiguration<Args, Options>): void {\n\t\tconfiguration.description('Create a permanent API key, scoped to a project or global. Prints the token — it is shown exactly once.')\n\t\tconfiguration //\n\t\t\t.option('project')\n\t\t\t.valueRequired()\n\t\t\t.description('Create a key as a member of this project (slug). Mutually exclusive with --global.')\n\t\tconfiguration //\n\t\t\t.option('global')\n\t\t\t.valueNone()\n\t\t\t.description('Create a key tied to no project, carrying global tenant roles. Mutually exclusive with --project.')\n\t\tconfiguration //\n\t\t\t.option('description')\n\t\t\t.valueRequired()\n\t\t\t.required()\n\t\t\t.description('Human-readable label for the key.')\n\t\tconfigureMembershipOptions(configuration, {\n\t\t\troleDescription: 'A role to grant, repeatable. With --project a membership role without variables, with --global a tenant role.',\n\t\t})\n\t\tconfiguration //\n\t\t\t.option('token-hash')\n\t\t\t.valueRequired()\n\t\t\t.description('Provision the key from a caller-supplied hex-encoded sha256 token hash instead of generating a token.')\n\t\tconfiguration //\n\t\t\t.option('trust-forwarded-client-info')\n\t\t\t.valueNone()\n\t\t\t.description(\n\t\t\t\t'Trust X-Contember-Client-IP and X-Contember-Client-User-Agent on requests made with this key. Enable only behind a trusted proxy that strips client-supplied values and sets the real ones; otherwise clients can spoof audit metadata.',\n\t\t\t)\n\t}\n\n\tprotected async execute(input: Input<Args, Options>, output: Output): Promise<void> {\n\t\tconst project = input.getOption('project')\n\t\tconst global = input.getOption('global') === true\n\t\tconst description = input.getOption('description')\n\t\tconst membershipSource = readMembershipInputSource(input)\n\t\tconst tokenHash = input.getOption('token-hash')\n\t\tconst trustForwardedClientInfo = input.getOption('trust-forwarded-client-info') === true\n\n\t\tif (project !== undefined && global) {\n\t\t\tthrow new CliError('Options --project and --global are mutually exclusive.', { code: 'CONFLICTING_TARGET', exitCode: ExitCode.InputError })\n\t\t}\n\t\tif (project === undefined && !global) {\n\t\t\tthrow new CliError('Specify either --project <slug> or --global.', { code: 'TARGET_REQUIRED', exitCode: ExitCode.InputError })\n\t\t}\n\t\tif (global && (membershipSource.json !== undefined || membershipSource.fromStdin)) {\n\t\t\tthrow new CliError('--memberships and --memberships-stdin only apply to --project.', {\n\t\t\t\tcode: 'CONFLICTING_OPTION',\n\t\t\t\texitCode: ExitCode.InputError,\n\t\t\t})\n\t\t}\n\n\t\tconst options = trustForwardedClientInfo ? { trustForwardedClientInfo: true } : undefined\n\n\t\tconst apiKey = project !== undefined\n\t\t\t? await this.tenantClientProvider.apiKey().createApiKey({\n\t\t\t\tprojectSlug: project,\n\t\t\t\tmemberships: await resolveNonEmptyMemberships(membershipSource, this.readStdin),\n\t\t\t\tdescription,\n\t\t\t\ttokenHash,\n\t\t\t\toptions,\n\t\t\t})\n\t\t\t: await this.tenantClientProvider.apiKey().createGlobalApiKey({ description, roles: membershipSource.roles, tokenHash, options })\n\t\tassertTenantCredentialContract((apiKey.token !== null) === (tokenHash === undefined), 'API key')\n\t\tconst generatedToken = apiKey.token === null ? null : assertGeneratedTenantToken(apiKey.token, 'API key')\n\n\t\tif (apiKey.token !== null) {\n\t\t\toutput.warn('This token is shown exactly once and cannot be retrieved again — store it now.')\n\t\t} else {\n\t\t\toutput.info('No token was returned: the key was provisioned from --token-hash, so the server never held the plaintext.')\n\t\t}\n\t\toutput.data<TenantApiKeyWithToken>(apiKey, {\n\t\t\thuman: it => `Created API key ${humanText(it.id)}` + (generatedToken !== null ? `\\nToken: ${generatedToken}` : ''),\n\t\t\tquiet: it => generatedToken ?? it.id,\n\t\t})\n\t}\n}\n"],"names":[],"mappings":";;;;AAkBO,MAAM,kCAAkC,QAAuB;AAAA,EACrE,YACkB,sBACA,YAAyB,eACzC;AACD,UAAA;AAHiB,SAAA,uBAAA;AACA,SAAA,YAAA;AAAA,EAGlB;AAAA,EAEU,UAAU,eAA0D;AAC7E,kBAAc,YAAY,yGAAyG;AACnI,kBACE,OAAO,SAAS,EAChB,cAAA,EACA,YAAY,oFAAoF;AAClG,kBACE,OAAO,QAAQ,EACf,UAAA,EACA,YAAY,mGAAmG;AACjH,kBACE,OAAO,aAAa,EACpB,cAAA,EACA,SAAA,EACA,YAAY,mCAAmC;AACjD,+BAA2B,eAAe;AAAA,MACzC,iBAAiB;AAAA,IAAA,CACjB;AACD,kBACE,OAAO,YAAY,EACnB,cAAA,EACA,YAAY,uGAAuG;AACrH,kBACE,OAAO,6BAA6B,EACpC,UAAA,EACA;AAAA,MACA;AAAA,IAAA;AAAA,EAEH;AAAA,EAEA,MAAgB,QAAQ,OAA6B,QAA+B;AACnF,UAAM,UAAU,MAAM,UAAU,SAAS;AACzC,UAAM,SAAS,MAAM,UAAU,QAAQ,MAAM;AAC7C,UAAM,cAAc,MAAM,UAAU,aAAa;AACjD,UAAM,mBAAmB,0BAA0B,KAAK;AACxD,UAAM,YAAY,MAAM,UAAU,YAAY;AAC9C,UAAM,2BAA2B,MAAM,UAAU,6BAA6B,MAAM;AAEpF,QAAI,YAAY,UAAa,QAAQ;AACpC,YAAM,IAAI,SAAS,0DAA0D,EAAE,MAAM,sBAAsB,UAAU,SAAS,YAAY;AAAA,IAC3I;AACA,QAAI,YAAY,UAAa,CAAC,QAAQ;AACrC,YAAM,IAAI,SAAS,gDAAgD,EAAE,MAAM,mBAAmB,UAAU,SAAS,YAAY;AAAA,IAC9H;AACA,QAAI,WAAW,iBAAiB,SAAS,UAAa,iBAAiB,YAAY;AAClF,YAAM,IAAI,SAAS,kEAAkE;AAAA,QACpF,MAAM;AAAA,QACN,UAAU,SAAS;AAAA,MAAA,CACnB;AAAA,IACF;AAEA,UAAM,UAAU,2BAA2B,EAAE,0BAA0B,SAAS;AAEhF,UAAM,SAAS,YAAY,SACxB,MAAM,KAAK,qBAAqB,OAAA,EAAS,aAAa;AAAA,MACvD,aAAa;AAAA,MACb,aAAa,MAAM,2BAA2B,kBAAkB,KAAK,SAAS;AAAA,MAC9E;AAAA,MACA;AAAA,MACA;AAAA,IAAA,CACA,IACC,MAAM,KAAK,qBAAqB,OAAA,EAAS,mBAAmB,EAAE,aAAa,OAAO,iBAAiB,OAAO,WAAW,SAAS;AACjI,mCAAgC,OAAO,UAAU,UAAW,cAAc,SAAY,SAAS;AAC/F,UAAM,iBAAiB,OAAO,UAAU,OAAO,OAAO,2BAA2B,OAAO,OAAO,SAAS;AAExG,QAAI,OAAO,UAAU,MAAM;AAC1B,aAAO,KAAK,gFAAgF;AAAA,IAC7F,OAAO;AACN,aAAO,KAAK,2GAA2G;AAAA,IACxH;AACA,WAAO,KAA4B,QAAQ;AAAA,MAC1C,OAAO,QAAM,mBAAmB,UAAU,GAAG,EAAE,CAAC,MAAM,mBAAmB,OAAO;AAAA,SAAY,cAAc,KAAK;AAAA,MAC/G,OAAO,CAAA,OAAM,kBAAkB,GAAG;AAAA,IAAA,CAClC;AAAA,EACF;AACD;"}

package/dist/development/src/commands/tenant/apikey/TenantApiKeyDisableCommand.cjs

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const cliCommon = require("@contember/cli-common");
+const confirmation = require("../../../lib/tenant/confirmation.cjs");
+const tenantOutput = require("../tenantOutput.cjs");
+class TenantApiKeyDisableCommand extends cliCommon.Command {
+  constructor(tenantClientProvider) {
+    super();
+    this.tenantClientProvider = tenantClientProvider;
+  }
+  configure(configuration) {
+    configuration.description("Disable a permanent API key, revoking its token immediately");
+    configuration.argument("id").description("The api key id (ApiKey.id — not the token).");
+    configuration.option("yes").valueNone().description("Do not ask for confirmation.");
+  }
+  async execute(input, output) {
+    const id = input.getArgument("id");
+    await confirmation.requireConfirmation({
+      yes: input.getOption("yes") === true,
+      output,
+      warning: `API key ${id} will be disabled and its token will stop working immediately.`
+    });
+    await this.tenantClientProvider.apiKey().disableApiKey(id);
+    output.data({ id }, {
+      human: (it) => `API key ${tenantOutput.humanText(it.id)} disabled`,
+      quiet: (it) => it.id
+    });
+  }
+}
+exports.TenantApiKeyDisableCommand = TenantApiKeyDisableCommand;
+//# sourceMappingURL=TenantApiKeyDisableCommand.cjs.map

package/dist/development/src/commands/tenant/apikey/TenantApiKeyDisableCommand.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantApiKeyDisableCommand.cjs","sources":["../../../../../../../packages/cli/src/commands/tenant/apikey/TenantApiKeyDisableCommand.ts"],"sourcesContent":["import { Command, CommandConfiguration, Input, Output } from '@contember/cli-common'\nimport { TenantClientProvider } from '../../../lib/TenantClientProvider.js'\nimport { requireConfirmation } from '../../../lib/tenant/confirmation.js'\nimport { humanText } from '../tenantOutput.js'\n\ntype Args = {\n\tid: string\n}\n\ntype Options = {\n\tyes?: true\n}\n\n/** `tenant api-key disable <id>` — destructive: the key's token stops working immediately. */\nexport class TenantApiKeyDisableCommand extends Command<Args, Options> {\n\tconstructor(\n\t\tprivate readonly tenantClientProvider: TenantClientProvider,\n\t) {\n\t\tsuper()\n\t}\n\n\tprotected configure(configuration: CommandConfiguration<Args, Options>): void {\n\t\tconfiguration.description('Disable a permanent API key, revoking its token immediately')\n\t\tconfiguration.argument('id').description('The api key id (ApiKey.id — not the token).')\n\t\tconfiguration //\n\t\t\t.option('yes')\n\t\t\t.valueNone()\n\t\t\t.description('Do not ask for confirmation.')\n\t}\n\n\tprotected async execute(input: Input<Args, Options>, output: Output): Promise<void> {\n\t\tconst id = input.getArgument('id')\n\n\t\tawait requireConfirmation({\n\t\t\tyes: input.getOption('yes') === true,\n\t\t\toutput,\n\t\t\twarning: `API key ${id} will be disabled and its token will stop working immediately.`,\n\t\t})\n\n\t\tawait this.tenantClientProvider.apiKey().disableApiKey(id)\n\n\t\toutput.data({ id }, {\n\t\t\thuman: it => `API key ${humanText(it.id)} disabled`,\n\t\t\tquiet: it => it.id,\n\t\t})\n\t}\n}\n"],"names":["Command","requireConfirmation","humanText"],"mappings":";;;;;AAcO,MAAM,mCAAmCA,UAAAA,QAAuB;AAAA,EACtE,YACkB,sBAChB;AACD,UAAA;AAFiB,SAAA,uBAAA;AAAA,EAGlB;AAAA,EAEU,UAAU,eAA0D;AAC7E,kBAAc,YAAY,6DAA6D;AACvF,kBAAc,SAAS,IAAI,EAAE,YAAY,6CAA6C;AACtF,kBACE,OAAO,KAAK,EACZ,UAAA,EACA,YAAY,8BAA8B;AAAA,EAC7C;AAAA,EAEA,MAAgB,QAAQ,OAA6B,QAA+B;AACnF,UAAM,KAAK,MAAM,YAAY,IAAI;AAEjC,UAAMC,iCAAoB;AAAA,MACzB,KAAK,MAAM,UAAU,KAAK,MAAM;AAAA,MAChC;AAAA,MACA,SAAS,WAAW,EAAE;AAAA,IAAA,CACtB;AAED,UAAM,KAAK,qBAAqB,OAAA,EAAS,cAAc,EAAE;AAEzD,WAAO,KAAK,EAAE,MAAM;AAAA,MACnB,OAAO,CAAA,OAAM,WAAWC,aAAAA,UAAU,GAAG,EAAE,CAAC;AAAA,MACxC,OAAO,QAAM,GAAG;AAAA,IAAA,CAChB;AAAA,EACF;AACD;;"}

package/dist/development/src/commands/tenant/apikey/TenantApiKeyDisableCommand.js

@@ -0,0 +1,31 @@
+import { Command } from "@contember/cli-common";
+import { requireConfirmation } from "../../../lib/tenant/confirmation.js";
+import { humanText } from "../tenantOutput.js";
+class TenantApiKeyDisableCommand extends Command {
+  constructor(tenantClientProvider) {
+    super();
+    this.tenantClientProvider = tenantClientProvider;
+  }
+  configure(configuration) {
+    configuration.description("Disable a permanent API key, revoking its token immediately");
+    configuration.argument("id").description("The api key id (ApiKey.id — not the token).");
+    configuration.option("yes").valueNone().description("Do not ask for confirmation.");
+  }
+  async execute(input, output) {
+    const id = input.getArgument("id");
+    await requireConfirmation({
+      yes: input.getOption("yes") === true,
+      output,
+      warning: `API key ${id} will be disabled and its token will stop working immediately.`
+    });
+    await this.tenantClientProvider.apiKey().disableApiKey(id);
+    output.data({ id }, {
+      human: (it) => `API key ${humanText(it.id)} disabled`,
+      quiet: (it) => it.id
+    });
+  }
+}
+export {
+  TenantApiKeyDisableCommand
+};
+//# sourceMappingURL=TenantApiKeyDisableCommand.js.map

package/dist/development/src/commands/tenant/apikey/TenantApiKeyDisableCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantApiKeyDisableCommand.js","sources":["../../../../../../../packages/cli/src/commands/tenant/apikey/TenantApiKeyDisableCommand.ts"],"sourcesContent":["import { Command, CommandConfiguration, Input, Output } from '@contember/cli-common'\nimport { TenantClientProvider } from '../../../lib/TenantClientProvider.js'\nimport { requireConfirmation } from '../../../lib/tenant/confirmation.js'\nimport { humanText } from '../tenantOutput.js'\n\ntype Args = {\n\tid: string\n}\n\ntype Options = {\n\tyes?: true\n}\n\n/** `tenant api-key disable <id>` — destructive: the key's token stops working immediately. */\nexport class TenantApiKeyDisableCommand extends Command<Args, Options> {\n\tconstructor(\n\t\tprivate readonly tenantClientProvider: TenantClientProvider,\n\t) {\n\t\tsuper()\n\t}\n\n\tprotected configure(configuration: CommandConfiguration<Args, Options>): void {\n\t\tconfiguration.description('Disable a permanent API key, revoking its token immediately')\n\t\tconfiguration.argument('id').description('The api key id (ApiKey.id — not the token).')\n\t\tconfiguration //\n\t\t\t.option('yes')\n\t\t\t.valueNone()\n\t\t\t.description('Do not ask for confirmation.')\n\t}\n\n\tprotected async execute(input: Input<Args, Options>, output: Output): Promise<void> {\n\t\tconst id = input.getArgument('id')\n\n\t\tawait requireConfirmation({\n\t\t\tyes: input.getOption('yes') === true,\n\t\t\toutput,\n\t\t\twarning: `API key ${id} will be disabled and its token will stop working immediately.`,\n\t\t})\n\n\t\tawait this.tenantClientProvider.apiKey().disableApiKey(id)\n\n\t\toutput.data({ id }, {\n\t\t\thuman: it => `API key ${humanText(it.id)} disabled`,\n\t\t\tquiet: it => it.id,\n\t\t})\n\t}\n}\n"],"names":[],"mappings":";;;AAcO,MAAM,mCAAmC,QAAuB;AAAA,EACtE,YACkB,sBAChB;AACD,UAAA;AAFiB,SAAA,uBAAA;AAAA,EAGlB;AAAA,EAEU,UAAU,eAA0D;AAC7E,kBAAc,YAAY,6DAA6D;AACvF,kBAAc,SAAS,IAAI,EAAE,YAAY,6CAA6C;AACtF,kBACE,OAAO,KAAK,EACZ,UAAA,EACA,YAAY,8BAA8B;AAAA,EAC7C;AAAA,EAEA,MAAgB,QAAQ,OAA6B,QAA+B;AACnF,UAAM,KAAK,MAAM,YAAY,IAAI;AAEjC,UAAM,oBAAoB;AAAA,MACzB,KAAK,MAAM,UAAU,KAAK,MAAM;AAAA,MAChC;AAAA,MACA,SAAS,WAAW,EAAE;AAAA,IAAA,CACtB;AAED,UAAM,KAAK,qBAAqB,OAAA,EAAS,cAAc,EAAE;AAEzD,WAAO,KAAK,EAAE,MAAM;AAAA,MACnB,OAAO,CAAA,OAAM,WAAW,UAAU,GAAG,EAAE,CAAC;AAAA,MACxC,OAAO,QAAM,GAAG;AAAA,IAAA,CAChB;AAAA,EACF;AACD;"}

package/dist/development/src/commands/tenant/apikey/TenantApiKeyListCommand.cjs

@@ -0,0 +1,55 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const cliCommon = require("@contember/cli-common");
+const memberOptions = require("../member/memberOptions.cjs");
+const tenantOutput = require("../tenantOutput.cjs");
+class TenantApiKeyListCommand extends cliCommon.Command {
+  constructor(tenantClientProvider) {
+    super();
+    this.tenantClientProvider = tenantClientProvider;
+  }
+  configure(configuration) {
+    configuration.description("List global permanent API keys, or project-scoped keys with --project");
+    configuration.option("project").valueRequired().description("List permanent API keys scoped to this project slug instead of global keys.");
+  }
+  async execute(input, output) {
+    const project = input.getOption("project");
+    if (project === void 0) {
+      const apiKeys2 = await this.tenantClientProvider.apiKey().listGlobalApiKeys();
+      output.table(
+        [
+          { field: "id", name: "ID" },
+          { field: "identityId", name: "Identity" },
+          { field: "description", name: "Description" },
+          { field: "globalRoles", name: "Global Roles", format: (value) => value === null ? "(not visible)" : value.map(tenantOutput.humanText).join(", ") || "-" },
+          { field: "type", name: "Type" },
+          { field: "enabled", name: "Enabled" },
+          { field: "createdAt", name: "Created At" },
+          { field: "lastUsedAt", name: "Last Used At", format: (value) => value === null ? "never used" : tenantOutput.humanText(value) },
+          { field: "expiresAt", name: "Expires At", format: (value) => value === null ? "never expires" : tenantOutput.humanText(value) }
+        ],
+        apiKeys2,
+        "id"
+      );
+      return;
+    }
+    const apiKeys = await this.tenantClientProvider.apiKey().listProjectApiKeys(project);
+    output.table(
+      [
+        { field: "id", name: "ID" },
+        { field: "identityId", name: "Identity" },
+        { field: "description", name: "Description" },
+        { field: "memberships", name: "Memberships", format: memberOptions.formatMemberships },
+        { field: "type", name: "Type" },
+        { field: "enabled", name: "Enabled" },
+        { field: "createdAt", name: "Created At" },
+        { field: "lastUsedAt", name: "Last Used At", format: (value) => value === null ? "never used" : tenantOutput.humanText(value) },
+        { field: "expiresAt", name: "Expires At", format: (value) => value === null ? "never expires" : tenantOutput.humanText(value) }
+      ],
+      apiKeys,
+      "id"
+    );
+  }
+}
+exports.TenantApiKeyListCommand = TenantApiKeyListCommand;
+//# sourceMappingURL=TenantApiKeyListCommand.cjs.map

package/dist/development/src/commands/tenant/apikey/TenantApiKeyListCommand.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantApiKeyListCommand.cjs","sources":["../../../../../../../packages/cli/src/commands/tenant/apikey/TenantApiKeyListCommand.ts"],"sourcesContent":["import { Command, CommandConfiguration, Input, Output } from '@contember/cli-common'\nimport { TenantClientProvider } from '../../../lib/TenantClientProvider.js'\nimport type { TenantGlobalApiKey, TenantProjectApiKey } from '../../../lib/tenant/clients/TenantApiKeyClient.js'\nimport { formatMemberships } from '../member/memberOptions.js'\nimport { humanText } from '../tenantOutput.js'\n\ntype Args = {}\ntype Options = {\n\tproject?: string\n}\n\n/** `tenant api-key list` — global keys by default, or project-scoped keys selected by `--project`. */\nexport class TenantApiKeyListCommand extends Command<Args, Options> {\n\tconstructor(\n\t\tprivate readonly tenantClientProvider: TenantClientProvider,\n\t) {\n\t\tsuper()\n\t}\n\n\tprotected configure(configuration: CommandConfiguration<Args, Options>): void {\n\t\tconfiguration.description('List global permanent API keys, or project-scoped keys with --project')\n\t\tconfiguration.option('project').valueRequired().description('List permanent API keys scoped to this project slug instead of global keys.')\n\t}\n\n\tprotected async execute(input: Input<Args, Options>, output: Output): Promise<void> {\n\t\tconst project = input.getOption('project')\n\t\tif (project === undefined) {\n\t\t\tconst apiKeys = await this.tenantClientProvider.apiKey().listGlobalApiKeys()\n\t\t\toutput.table<TenantGlobalApiKey>(\n\t\t\t\t[\n\t\t\t\t\t{ field: 'id', name: 'ID' },\n\t\t\t\t\t{ field: 'identityId', name: 'Identity' },\n\t\t\t\t\t{ field: 'description', name: 'Description' },\n\t\t\t\t\t{ field: 'globalRoles', name: 'Global Roles', format: value => value === null ? '(not visible)' : value.map(humanText).join(', ') || '-' },\n\t\t\t\t\t{ field: 'type', name: 'Type' },\n\t\t\t\t\t{ field: 'enabled', name: 'Enabled' },\n\t\t\t\t\t{ field: 'createdAt', name: 'Created At' },\n\t\t\t\t\t{ field: 'lastUsedAt', name: 'Last Used At', format: value => value === null ? 'never used' : humanText(value) },\n\t\t\t\t\t{ field: 'expiresAt', name: 'Expires At', format: value => value === null ? 'never expires' : humanText(value) },\n\t\t\t\t],\n\t\t\t\tapiKeys,\n\t\t\t\t'id',\n\t\t\t)\n\t\t\treturn\n\t\t}\n\n\t\tconst apiKeys = await this.tenantClientProvider.apiKey().listProjectApiKeys(project)\n\t\toutput.table<TenantProjectApiKey>(\n\t\t\t[\n\t\t\t\t{ field: 'id', name: 'ID' },\n\t\t\t\t{ field: 'identityId', name: 'Identity' },\n\t\t\t\t{ field: 'description', name: 'Description' },\n\t\t\t\t{ field: 'memberships', name: 'Memberships', format: formatMemberships },\n\t\t\t\t{ field: 'type', name: 'Type' },\n\t\t\t\t{ field: 'enabled', name: 'Enabled' },\n\t\t\t\t{ field: 'createdAt', name: 'Created At' },\n\t\t\t\t{ field: 'lastUsedAt', name: 'Last Used At', format: value => value === null ? 'never used' : humanText(value) },\n\t\t\t\t{ field: 'expiresAt', name: 'Expires At', format: value => value === null ? 'never expires' : humanText(value) },\n\t\t\t],\n\t\t\tapiKeys,\n\t\t\t'id',\n\t\t)\n\t}\n}\n"],"names":["Command","apiKeys","humanText","formatMemberships"],"mappings":";;;;;AAYO,MAAM,gCAAgCA,UAAAA,QAAuB;AAAA,EACnE,YACkB,sBAChB;AACD,UAAA;AAFiB,SAAA,uBAAA;AAAA,EAGlB;AAAA,EAEU,UAAU,eAA0D;AAC7E,kBAAc,YAAY,uEAAuE;AACjG,kBAAc,OAAO,SAAS,EAAE,cAAA,EAAgB,YAAY,6EAA6E;AAAA,EAC1I;AAAA,EAEA,MAAgB,QAAQ,OAA6B,QAA+B;AACnF,UAAM,UAAU,MAAM,UAAU,SAAS;AACzC,QAAI,YAAY,QAAW;AAC1B,YAAMC,WAAU,MAAM,KAAK,qBAAqB,OAAA,EAAS,kBAAA;AACzD,aAAO;AAAA,QACN;AAAA,UACC,EAAE,OAAO,MAAM,MAAM,KAAA;AAAA,UACrB,EAAE,OAAO,cAAc,MAAM,WAAA;AAAA,UAC7B,EAAE,OAAO,eAAe,MAAM,cAAA;AAAA,UAC9B,EAAE,OAAO,eAAe,MAAM,gBAAgB,QAAQ,CAAA,UAAS,UAAU,OAAO,kBAAkB,MAAM,IAAIC,aAAAA,SAAS,EAAE,KAAK,IAAI,KAAK,IAAA;AAAA,UACrI,EAAE,OAAO,QAAQ,MAAM,OAAA;AAAA,UACvB,EAAE,OAAO,WAAW,MAAM,UAAA;AAAA,UAC1B,EAAE,OAAO,aAAa,MAAM,aAAA;AAAA,UAC5B,EAAE,OAAO,cAAc,MAAM,gBAAgB,QAAQ,CAAA,UAAS,UAAU,OAAO,eAAeA,aAAAA,UAAU,KAAK,EAAA;AAAA,UAC7G,EAAE,OAAO,aAAa,MAAM,cAAc,QAAQ,CAAA,UAAS,UAAU,OAAO,kBAAkBA,aAAAA,UAAU,KAAK,EAAA;AAAA,QAAE;AAAA,QAEhHD;AAAAA,QACA;AAAA,MAAA;AAED;AAAA,IACD;AAEA,UAAM,UAAU,MAAM,KAAK,qBAAqB,OAAA,EAAS,mBAAmB,OAAO;AACnF,WAAO;AAAA,MACN;AAAA,QACC,EAAE,OAAO,MAAM,MAAM,KAAA;AAAA,QACrB,EAAE,OAAO,cAAc,MAAM,WAAA;AAAA,QAC7B,EAAE,OAAO,eAAe,MAAM,cAAA;AAAA,QAC9B,EAAE,OAAO,eAAe,MAAM,eAAe,QAAQE,cAAAA,kBAAA;AAAA,QACrD,EAAE,OAAO,QAAQ,MAAM,OAAA;AAAA,QACvB,EAAE,OAAO,WAAW,MAAM,UAAA;AAAA,QAC1B,EAAE,OAAO,aAAa,MAAM,aAAA;AAAA,QAC5B,EAAE,OAAO,cAAc,MAAM,gBAAgB,QAAQ,CAAA,UAAS,UAAU,OAAO,eAAeD,aAAAA,UAAU,KAAK,EAAA;AAAA,QAC7G,EAAE,OAAO,aAAa,MAAM,cAAc,QAAQ,CAAA,UAAS,UAAU,OAAO,kBAAkBA,aAAAA,UAAU,KAAK,EAAA;AAAA,MAAE;AAAA,MAEhH;AAAA,MACA;AAAA,IAAA;AAAA,EAEF;AACD;;"}