@contember/cli 2.1.0-rc.3 → 2.2.0-alpha.10

package/src/commands/tenant/person/TenantSessionCreateCommand.ts

@@ -0,0 +1,79 @@
+import { CliError, Command, CommandConfiguration, ExitCode, Input, Output } from '@contember/cli-common'
+import { TenantClientProvider } from '../../../lib/TenantClientProvider.js'
+import type { TenantCreatedSessionToken } from '../../../lib/tenant/clients/TenantPersonClient.js'
+import { assertGeneratedTenantToken, humanText } from '../tenantOutput.js'
+
+type Args = {}
+
+type Options = {
+	email?: string
+	['person-id']?: string
+	expiration?: string
+	['trust-forwarded-client-info']?: boolean
+}
+
+/** `tenant session create` */
+export class TenantSessionCreateCommand extends Command<Args, Options> {
+	constructor(
+		private readonly tenantClientProvider: TenantClientProvider,
+	) {
+		super()
+	}
+
+	protected configure(configuration: CommandConfiguration<Args, Options>): void {
+		configuration.description('Create a one-time session token for exactly one person. Requires person.createSessionToken permission.')
+		configuration.option('email').valueRequired().description('Identify the person by e-mail. Not combinable with --person-id.')
+		configuration.option('person-id').valueRequired().description('Identify the person by id. Not combinable with --email.')
+		configuration.option('expiration').valueRequired().description('Session lifetime in minutes as a positive integer.')
+		configuration.option('trust-forwarded-client-info').valueNone().description(
+			'Trust forwarded client IP and user-agent headers for this session only when the tenant endpoint is behind a trusted proxy.',
+		)
+	}
+
+	protected async execute(input: Input<Args, Options>, output: Output): Promise<void> {
+		const email = input.getOption('email')
+		const personId = input.getOption('person-id')
+		if ((email === undefined) === (personId === undefined)) {
+			throw new CliError('Pass exactly one of --email or --person-id.', {
+				code: 'INVALID_PERSON_IDENTIFIER',
+				exitCode: ExitCode.InputError,
+			})
+		}
+		if (email?.trim() === '' || personId?.trim() === '') {
+			throw new CliError('The value passed to --email or --person-id must not be empty.', {
+				code: 'INVALID_PERSON_IDENTIFIER',
+				exitCode: ExitCode.InputError,
+			})
+		}
+		const expiration = parsePositiveInteger(input.getOption('expiration'), 'expiration')
+		const trustForwardedClientInfo = input.getOption('trust-forwarded-client-info') === true
+
+		const result = await this.tenantClientProvider.person().createSessionToken({
+			email,
+			personId,
+			expiration,
+			options: trustForwardedClientInfo ? { trustForwardedClientInfo: true } : undefined,
+		})
+		const token = assertGeneratedTenantToken(result.token, 'session')
+
+		output.info(`Created a session token for person ${result.personId}. The token is shown once; store it securely.`)
+		output.data<TenantCreatedSessionToken>(result, {
+			human: it => `Session token for person ${humanText(it.personId)}:\n${token}`,
+			quiet: () => token,
+		})
+	}
+}
+
+const parsePositiveInteger = (value: string | undefined, option: string): number | undefined => {
+	if (value === undefined) {
+		return undefined
+	}
+	const parsed = Number(value)
+	if (!Number.isInteger(parsed) || parsed <= 0 || parsed > 2_147_483_647) {
+		throw new CliError(`--${option} must be a positive GraphQL Int (maximum 2147483647).`, {
+			code: 'INVALID_OPTION_VALUE',
+			exitCode: ExitCode.InputError,
+		})
+	}
+	return parsed
+}

package/src/commands/tenant/person/index.ts

@@ -0,0 +1,15 @@
+// Commands of `tenant person`, plus `tenant session create` and `tenant identity role …` — the directory
+// maps to the TenantPersonClient domain (persons, sessions, global identity roles), not to a command prefix.
+// `personInput.ts` stays unexported on purpose: the five tenant barrels merge into `commands/tenant/index.ts`.
+export * from './TenantIdentityRoleAddCommand.js'
+export * from './TenantIdentityRoleRemoveCommand.js'
+export * from './TenantPersonCreateCommand.js'
+export * from './TenantPersonDisableCommand.js'
+export * from './TenantPersonListCommand.js'
+export * from './TenantPersonResetMfaCommand.js'
+export * from './TenantPersonResetPasswordRequestCommand.js'
+export * from './TenantPersonSetPasswordCommand.js'
+export * from './TenantPersonShowCommand.js'
+export * from './TenantPersonSignOutCommand.js'
+export * from './TenantPersonUpdateCommand.js'
+export * from './TenantSessionCreateCommand.js'

package/src/commands/tenant/person/personInput.ts

@@ -0,0 +1,112 @@
+import { CliError, ExitCode } from '@contember/cli-common'
+import type { StdinReader } from '../../../lib/tenant/stdin.js'
+import { environmentInput, literalInput, resolveOptionalTenantInput, stdinInput, type TenantInputSource } from '../../../lib/tenant/input/index.js'
+
+/**
+ * One way of passing a secret. `name` is the option prefix, so `password` covers `--password-stdin`
+ * and `--password-env`. A secret is never a plain option value — argv lands in the shell history and
+ * in `ps` output of every user on the machine.
+ */
+export interface SecretSource {
+	readonly name: string
+	readonly stdin: boolean
+	readonly env: string | undefined
+}
+
+export interface ResolvedSecret {
+	/** The `name` of the {@link SecretSource} the value came from. */
+	readonly name: string
+	readonly value: string
+}
+
+/** Resolves at most one of the offered secret sources. Returns undefined when the caller passed none. */
+export const resolveSecret = async (sources: readonly SecretSource[], readStdin: StdinReader): Promise<ResolvedSecret | undefined> => {
+	const given = sources.flatMap(source => [
+		...(source.stdin ? [{ source, flag: `--${source.name}-stdin` }] : []),
+		...(source.env !== undefined ? [{ source, flag: `--${source.name}-env` }] : []),
+	])
+	if (given.length > 1) {
+		throw new CliError(`Pass only one of ${given.map(it => it.flag).join(', ')}.`, {
+			code: 'AMBIGUOUS_SECRET_SOURCE',
+			exitCode: ExitCode.InputError,
+		})
+	}
+	const chosen = given[0]
+	if (chosen === undefined) {
+		return undefined
+	}
+	// the trailing newline `echo` adds is never part of the secret
+	const value = chosen.source.env !== undefined ? readSecretEnv(chosen.source.env) : (await readStdin()).replace(/\r?\n$/, '')
+	if (value === '') {
+		throw new CliError(`${chosen.flag} resolved to an empty value.`, { code: 'EMPTY_SECRET', exitCode: ExitCode.InputError })
+	}
+	return { name: chosen.source.name, value }
+}
+
+const readSecretEnv = (name: string): string => {
+	const value = process.env[name]
+	if (value === undefined) {
+		throw new CliError(`Environment variable ${name} is not set.`, { code: 'SECRET_ENV_NOT_SET', exitCode: ExitCode.InputError })
+	}
+	return value
+}
+
+/** The tenant API accepts `$2b$` bcrypt hashes only — rejecting here avoids spending a rate-limit slot on a doomed call. */
+export const assertBcryptHash = (hash: string): void => {
+	if (!hash.startsWith('$2b$')) {
+		throw new CliError('Invalid password hash: the tenant API accepts bcrypt $2b$ hashes only.', {
+			code: 'INVALID_PASSWORD_HASH',
+			exitCode: ExitCode.InputError,
+		})
+	}
+}
+
+export type CaptchaTokenOptions = {
+	readonly ['captcha-token']?: string
+	readonly ['captcha-token-env']?: string
+	readonly ['captcha-token-stdin']?: boolean
+}
+
+export const configureCaptchaTokenOptions = (configuration: {
+	option(name: keyof CaptchaTokenOptions): {
+		valueNone(): { description(description: string): unknown }
+		valueRequired(): { description(description: string): unknown }
+	}
+}): void => {
+	configuration.option('captcha-token').valueRequired().description(
+		'Captcha token. Visible in the shell history and process list; prefer --captcha-token-env or --captcha-token-stdin.',
+	)
+	configuration.option('captcha-token-env').valueRequired().description('Read the captcha token from the named environment variable.')
+	configuration.option('captcha-token-stdin').valueNone().description('Read the captcha token from stdin.')
+}
+
+export const resolveCaptchaToken = async (
+	options: CaptchaTokenOptions,
+	readStdin: StdinReader,
+	readEnvironment: (name: string) => string | undefined = name => process.env[name],
+): Promise<string | undefined> => {
+	const sources: TenantInputSource<'captcha-token'>[] = []
+	if (options['captcha-token'] !== undefined) {
+		sources.push(literalInput('captcha-token', '--captcha-token', options['captcha-token']))
+	}
+	if (options['captcha-token-env'] !== undefined) {
+		sources.push(environmentInput('captcha-token', '--captcha-token-env', options['captcha-token-env']))
+	}
+	if (options['captcha-token-stdin'] === true) {
+		sources.push(stdinInput('captcha-token', '--captcha-token-stdin'))
+	}
+	const resolved = await resolveOptionalTenantInput(sources, { label: 'captcha token' }, { readStdin, readEnvironment })
+	if (resolved === undefined) {
+		return undefined
+	}
+	const value = resolved.kind === 'stdin' ? removeOneTrailingLineEnding(resolved.value) : resolved.value
+	if (value === '') {
+		throw new CliError('The selected captcha token source resolved to an empty value.', {
+			code: 'EMPTY_INPUT_VALUE',
+			exitCode: ExitCode.InputError,
+		})
+	}
+	return value
+}
+
+const removeOneTrailingLineEnding = (value: string): string => value.replace(/(?:\r\n|\n)$/, '')

package/src/commands/tenant/policy/TenantAuthLogCommand.ts

@@ -0,0 +1,141 @@
+/// <reference path="../../../../types/chalk-table/index.d.ts" />
+
+import { Command, CommandConfiguration, Input, Output } from '@contember/cli-common'
+import type { AuthLogFilter } from '@contember/graphql-client-tenant'
+import chalkTable from 'chalk-table'
+import { TenantClientProvider } from '../../../lib/TenantClientProvider.js'
+import { TenantAuthLogEntry } from '../../../lib/tenant/clients/index.js'
+import { GRAPHQL_INT_MAX, parsePaginationLimit, parsePaginationOffset } from '../../../lib/tenant/input/index.js'
+import { inputError } from './policyInput.js'
+import { humanText } from '../tenantOutput.js'
+
+type Args = {}
+
+type Options = {
+	type?: string[]
+	success?: boolean
+	failed?: boolean
+	['invoked-by']?: string
+	person?: string
+	['target-person']?: string
+	['person-input']?: string
+	['created-after']?: string
+	['created-before']?: string
+	limit?: string
+	offset?: string
+}
+
+/** The command's answer: the page plus everything a script needs to fetch the next one. */
+export interface AuthLogPageResult {
+	entries: TenantAuthLogEntry[]
+	/** True when rows exist past this page. */
+	hasMore: boolean
+	offset: number
+	/** Offset to pass to the next call, `null` when this is the last page. */
+	nextOffset: number | null
+}
+
+export class TenantAuthLogCommand extends Command<Args, Options> {
+	constructor(
+		private readonly tenantClientProvider: TenantClientProvider,
+	) {
+		super()
+	}
+
+	protected configure(configuration: CommandConfiguration<Args, Options>): void {
+		configuration.description('Read the tenant auth log (audit trail). Requires the system:viewAuthLog permission.')
+		configuration.option('type').valueArray().description('Filter by auth_log_type, e.g. sign_in. Repeat the option to match any of several types.')
+		configuration.option('success').valueNone().description('Only successful entries.')
+		configuration.option('failed').valueNone().description('Only failed entries.')
+		configuration.option('invoked-by').valueRequired().description('Filter by the acting identity id.')
+		configuration.option('person').valueRequired().description('Filter by the acting person id.')
+		configuration.option('target-person').valueRequired().description('Filter by the person the action was performed on.')
+		configuration.option('person-input').valueRequired().description('Filter by the submitted identifier, typically the e-mail of a failed sign-in.')
+		configuration.option('created-after').valueRequired().description('Inclusive lower bound on createdAt, as an ISO 8601 timestamp.')
+		configuration.option('created-before').valueRequired().description('Exclusive upper bound on createdAt, as an ISO 8601 timestamp.')
+		configuration.option('limit').valueRequired().description('Page size. Server default is 100, capped at 500.')
+		configuration.option('offset').valueRequired().description('Number of entries to skip. Use the nextOffset of the previous page.')
+	}
+
+	protected async execute(input: Input<Args, Options>, output: Output): Promise<void> {
+		const limit = parsePaginationLimit(input.getOption('limit'))
+		const offset = parsePaginationOffset(input.getOption('offset')) ?? 0
+		const filter = this.readFilter(input)
+
+		const page = await this.tenantClientProvider.policy().readAuthLog({
+			filter: Object.values(filter).some(it => it !== undefined) ? filter : undefined,
+			limit,
+			offset,
+		})
+
+		const advancedOffset = offset + page.entries.length
+		const canContinue = page.hasMore && page.entries.length > 0 && advancedOffset <= GRAPHQL_INT_MAX
+		const result: AuthLogPageResult = {
+			entries: page.entries,
+			hasMore: canContinue,
+			offset,
+			nextOffset: canContinue ? advancedOffset : null,
+		}
+		output.info(`authLog: ${page.entries.length} entries from offset ${offset}${result.hasMore ? ', more available' : ''}`)
+		output.data(result, { human: renderHuman, quiet: value => value.entries.map(entry => entry.id) })
+	}
+
+	private readFilter(input: Input<Args, Options>): AuthLogFilter {
+		const successOnly = input.getOption('success') === true
+		const failedOnly = input.getOption('failed') === true
+		if (successOnly && failedOnly) {
+			throw inputError('Pass either --success or --failed, not both.', 'AMBIGUOUS_INPUT')
+		}
+		return {
+			types: input.getOption('type'),
+			success: successOnly ? true : failedOnly ? false : undefined,
+			invokedByIdentityId: input.getOption('invoked-by'),
+			personId: input.getOption('person'),
+			targetPersonId: input.getOption('target-person'),
+			personInputIdentifier: input.getOption('person-input'),
+			createdAfter: input.getOption('created-after'),
+			createdBefore: input.getOption('created-before'),
+		}
+	}
+}
+
+type AuthLogCell = 'createdAt' | 'type' | 'success' | 'person' | 'identity' | 'ip' | 'error'
+
+// A curated, narrow projection: the full entry (metadata, eventData, user agent) stays in --json.
+const humanColumns: { field: AuthLogCell; name: string }[] = [
+	{ field: 'createdAt', name: 'Time (UTC)' },
+	{ field: 'type', name: 'Type' },
+	{ field: 'success', name: 'OK' },
+	{ field: 'person', name: 'Person' },
+	{ field: 'identity', name: 'Identity' },
+	{ field: 'ip', name: 'IP' },
+	{ field: 'error', name: 'Error' },
+]
+
+/**
+ * `Output.data` renders the human view, because `Output.table` can only emit a bare array and the
+ * paging fields have to stay in the `--json` payload. Formatting therefore lives here, human-only.
+ */
+const renderHuman = (page: AuthLogPageResult): string => {
+	if (page.entries.length === 0) {
+		return 'No auth log entries match the filter.'
+	}
+	const table = chalkTable({ columns: humanColumns }, page.entries.map(toHumanRow))
+	return page.hasMore ? `${table}\nMore entries available — rerun with --offset ${page.nextOffset}.` : table
+}
+
+const toHumanRow = (entry: TenantAuthLogEntry): Record<AuthLogCell, string> => ({
+	createdAt: formatTimestamp(entry.createdAt),
+	type: humanText(entry.type),
+	success: entry.success ? 'yes' : 'no',
+	person: humanText(entry.personId ?? entry.personInputIdentifier ?? ''),
+	identity: humanText(entry.invokedByIdentityId ?? ''),
+	ip: humanText(entry.ipAddress ?? ''),
+	error: humanText(entry.errorCode ?? ''),
+})
+
+/** Raw ISO timestamps read badly in a terminal; UTC keeps the rendering reproducible. */
+const formatTimestamp = (value: string): string => {
+	const parsed = new Date(value)
+	return Number.isNaN(parsed.getTime()) ? humanText(value) : parsed.toISOString().replace('T', ' ').slice(0, 19)
+}

package/src/commands/tenant/policy/TenantMailTemplateAddCommand.ts

@@ -0,0 +1,92 @@
+import { Command, CommandConfiguration, Input, Output } from '@contember/cli-common'
+import { TenantClientProvider } from '../../../lib/TenantClientProvider.js'
+import { TenantMailTemplate } from '../../../lib/tenant/tenantConfig.js'
+import {
+	describeMailTemplate,
+	formatMailTemplateRef,
+	MailTemplateRef,
+	mailTypeValues,
+	parseMailType,
+	parseOptionalMailTemplateSelector,
+	readTextInput,
+} from './policyInput.js'
+import { readStdinText, StdinReader } from '../../../lib/tenant/stdin.js'
+
+type Args = {
+	type: string
+}
+
+type Options = {
+	variant?: string
+	project?: string
+	/** Declared `required()` below, so the parser rejects the run before `execute` when it is missing. */
+	subject: string
+	content?: string
+	['content-stdin']?: boolean
+	['reply-to']?: string
+	['no-layout']?: boolean
+}
+
+/**
+ * The template is upserted by the (project, type, variant) triple. Scope lives in `--project`, not in a
+ * separate command: `addProjectMailTemplate` is bound to the very same resolver and is deprecated in the
+ * SDL in favour of `addMailTemplate`, whose input already carries `projectSlug`.
+ */
+export class TenantMailTemplateAddCommand extends Command<Args, Options> {
+	constructor(
+		private readonly tenantClientProvider: TenantClientProvider,
+		private readonly readStdin: StdinReader = readStdinText,
+	) {
+		super()
+	}
+
+	protected configure(configuration: CommandConfiguration<Args, Options>): void {
+		configuration.description('Add or replace a mail template. Existing templates with the same project, type and variant are overwritten.')
+		configuration.argument('type').description(`Mail type. One of: ${mailTypeValues.join(', ')}.`)
+		configuration.option('variant').valueRequired().description('Template variant, e.g. a locale. Defaults to the unnamed variant.')
+		configuration.option('project').valueRequired().description('Project slug. Omit for a tenant-wide (global) template.')
+		configuration.option('subject').valueRequired().required().description('Mail subject.')
+		configuration.option('content').valueRequired().description('The template body as an inline string.')
+		configuration.option('content-stdin').valueNone().description('Read the template body from stdin instead of --content.')
+		configuration.option('reply-to').valueRequired().description('Reply-to address of the sent mail.')
+		configuration.option('no-layout').valueNone().description('Do not wrap the body in the default layout.')
+	}
+
+	protected async execute(input: Input<Args, Options>, output: Output): Promise<void> {
+		const type = parseMailType(input.getArgument('type'))
+		const variant = parseOptionalMailTemplateSelector(input.getOption('variant'), '--variant')
+		const projectSlug = parseOptionalMailTemplateSelector(input.getOption('project'), '--project')
+		const subject = input.getOption('subject')
+		const content = await readTextInput({
+			label: 'template body',
+			inline: input.getOption('content'),
+			inlineFlag: '--content',
+			fromStdin: input.getOption('content-stdin') === true,
+			stdinFlag: '--content-stdin',
+			allowEmpty: true,
+		}, this.readStdin)
+
+		const template: TenantMailTemplate = {
+			type,
+			subject,
+			content,
+			variant,
+			projectSlug,
+			replyTo: input.getOption('reply-to'),
+			// omitted means "use the server default", which is true — only an explicit opt-out is sent
+			useLayout: input.getOption('no-layout') === true ? false : undefined,
+		}
+
+		await this.tenantClientProvider.policy().addMailTemplate(template)
+
+		const ref: MailTemplateRef = {
+			projectSlug: template.projectSlug ?? null,
+			type,
+			variant: template.variant ?? null,
+		}
+		output.data(ref, {
+			human: value => `Added mail template (${describeMailTemplate(value)}).`,
+			quiet: formatMailTemplateRef,
+		})
+	}
+}

package/src/commands/tenant/policy/TenantMailTemplateListCommand.ts

@@ -0,0 +1,50 @@
+import { Command, CommandConfiguration, Input, Output, OutputTableColumn } from '@contember/cli-common'
+import { TenantClientProvider } from '../../../lib/TenantClientProvider.js'
+import { TenantMailTemplateData } from '../../../lib/tenant/clients/index.js'
+import { humanText } from '../tenantOutput.js'
+import { formatMailTemplateRef } from './policyInput.js'
+
+type Args = {}
+type Options = {}
+
+const CONTENT_PREVIEW_LENGTH = 40
+
+/** Human mode only — a full Mustache body would make the table unreadable. `--json` keeps it whole. */
+const previewContent = (value: string): string => {
+	const singleLine = humanText(value).replace(/\s+/g, ' ').trim()
+	return singleLine.length > CONTENT_PREVIEW_LENGTH ? `${singleLine.slice(0, CONTENT_PREVIEW_LENGTH - 1)}…` : singleLine
+}
+
+const columns: OutputTableColumn<TenantMailTemplateData>[] = [
+	{ field: 'projectSlug', name: 'Project' },
+	{ field: 'type', name: 'Type' },
+	{ field: 'variant', name: 'Variant' },
+	{ field: 'subject', name: 'Subject' },
+	{ field: 'useLayout', name: 'Layout' },
+	{ field: 'replyTo', name: 'Reply to' },
+	{ field: 'content', name: 'Content', format: previewContent },
+]
+
+export class TenantMailTemplateListCommand extends Command<Args, Options> {
+	constructor(
+		private readonly tenantClientProvider: TenantClientProvider,
+	) {
+		super()
+	}
+
+	protected configure(configuration: CommandConfiguration<Args, Options>): void {
+		configuration.description('List the configured mail templates, global and project-scoped.')
+	}
+
+	protected async execute(input: Input<Args, Options>, output: Output): Promise<void> {
+		const templates = await this.tenantClientProvider.policy().listMailTemplates()
+		if (output.isQuiet) {
+			output.data(templates, { quiet: rows => rows.map(formatMailTemplateRef) })
+			return
+		}
+		output.table(columns, templates, 'type')
+		if (templates.length === 0) {
+			output.info('No mail templates are configured. The built-in ones are used.')
+		}
+	}
+}

package/src/commands/tenant/policy/TenantMailTemplateRemoveCommand.ts

@@ -0,0 +1,63 @@
+import { Command, CommandConfiguration, Input, Output } from '@contember/cli-common'
+import { TenantClientProvider } from '../../../lib/TenantClientProvider.js'
+import { requireConfirmation } from '../../../lib/tenant/confirmation.js'
+import {
+	describeMailTemplate,
+	formatMailTemplateRef,
+	MailTemplateRef,
+	mailTypeValues,
+	parseMailType,
+	parseOptionalMailTemplateSelector,
+} from './policyInput.js'
+
+type Args = {
+	type: string
+}
+
+type Options = {
+	variant?: string
+	project?: string
+	yes?: boolean
+}
+
+/** Counterpart of `mail-template add` — the same (project, type, variant) triple addresses the row. */
+export class TenantMailTemplateRemoveCommand extends Command<Args, Options> {
+	constructor(
+		private readonly tenantClientProvider: TenantClientProvider,
+	) {
+		super()
+	}
+
+	protected configure(configuration: CommandConfiguration<Args, Options>): void {
+		configuration.description('Remove a mail template, so the built-in one is used again.')
+		configuration.argument('type').description(`Mail type. One of: ${mailTypeValues.join(', ')}.`)
+		configuration.option('variant').valueRequired().description('Template variant, e.g. a locale. Defaults to the unnamed variant.')
+		configuration.option('project').valueRequired().description('Project slug. Omit to address the tenant-wide (global) template.')
+		configuration.option('yes').valueNone().description('Do not ask for confirmation.')
+	}
+
+	protected async execute(input: Input<Args, Options>, output: Output): Promise<void> {
+		const ref: MailTemplateRef = {
+			projectSlug: parseOptionalMailTemplateSelector(input.getOption('project'), '--project') ?? null,
+			type: parseMailType(input.getArgument('type')),
+			variant: parseOptionalMailTemplateSelector(input.getOption('variant'), '--variant') ?? null,
+		}
+		const description = describeMailTemplate(ref)
+		await requireConfirmation({
+			yes: input.getOption('yes') === true,
+			output,
+			warning: `Mail template (${description}) will be removed and the built-in one used instead.`,
+		})
+
+		await this.tenantClientProvider.policy().removeMailTemplate({
+			projectSlug: ref.projectSlug ?? undefined,
+			type: ref.type,
+			variant: ref.variant ?? undefined,
+		})
+
+		output.data(ref, {
+			human: value => `Removed mail template (${describeMailTemplate(value)}).`,
+			quiet: formatMailTemplateRef,
+		})
+	}
+}

package/src/commands/tenant/policy/TenantPolicyCreateCommand.ts

@@ -0,0 +1,46 @@
+import { Command, CommandConfiguration, Input, Output } from '@contember/cli-common'
+import { TenantClientProvider } from '../../../lib/TenantClientProvider.js'
+import { AUTH_POLICY_JSON_EXAMPLE, parseAuthPolicyInput, readTextInput } from './policyInput.js'
+import { readStdinText, StdinReader } from '../../../lib/tenant/stdin.js'
+import { humanText } from '../tenantOutput.js'
+
+type Args = {}
+
+type Options = {
+	policy?: string
+	['policy-stdin']?: boolean
+}
+
+export class TenantPolicyCreateCommand extends Command<Args, Options> {
+	constructor(
+		private readonly tenantClientProvider: TenantClientProvider,
+		private readonly readStdin: StdinReader = readStdinText,
+	) {
+		super()
+	}
+
+	protected configure(configuration: CommandConfiguration<Args, Options>): void {
+		configuration.description('Create an auth policy from an AuthPolicyInput JSON document.')
+		configuration.option('policy').valueRequired().description(`The policy as JSON, e.g. '${AUTH_POLICY_JSON_EXAMPLE}'.`)
+		configuration.option('policy-stdin').valueNone().description('Read the policy JSON from stdin instead of --policy.')
+	}
+
+	protected async execute(input: Input<Args, Options>, output: Output): Promise<void> {
+		const policy = parseAuthPolicyInput(
+			await readTextInput({
+				label: 'policy',
+				inline: input.getOption('policy'),
+				inlineFlag: '--policy',
+				fromStdin: input.getOption('policy-stdin') === true,
+				stdinFlag: '--policy-stdin',
+			}, this.readStdin),
+		)
+
+		const id = await this.tenantClientProvider.policy().createAuthPolicy(policy)
+
+		output.data({ id, scope: policy.scope, project: policy.project ?? null }, {
+			human: result => `Created auth policy ${humanText(result.id)}.`,
+			quiet: result => result.id,
+		})
+	}
+}

package/src/commands/tenant/policy/TenantPolicyDeleteCommand.ts

@@ -0,0 +1,42 @@
+import { Command, CommandConfiguration, Input, Output } from '@contember/cli-common'
+import { TenantClientProvider } from '../../../lib/TenantClientProvider.js'
+import { requireConfirmation } from '../../../lib/tenant/confirmation.js'
+import { humanText } from '../tenantOutput.js'
+
+type Args = {
+	id: string
+}
+
+type Options = {
+	yes?: boolean
+}
+
+export class TenantPolicyDeleteCommand extends Command<Args, Options> {
+	constructor(
+		private readonly tenantClientProvider: TenantClientProvider,
+	) {
+		super()
+	}
+
+	protected configure(configuration: CommandConfiguration<Args, Options>): void {
+		configuration.description('Delete an auth policy.')
+		configuration.argument('id').description('Id of the auth policy, as printed by "tenant policy list".')
+		configuration.option('yes').valueNone().description('Do not ask for confirmation.')
+	}
+
+	protected async execute(input: Input<Args, Options>, output: Output): Promise<void> {
+		const id = input.getArgument('id')
+		await requireConfirmation({
+			yes: input.getOption('yes') === true,
+			output,
+			warning: `Auth policy ${id} will be deleted. The roles it covers fall back to the tenant defaults.`,
+		})
+
+		await this.tenantClientProvider.policy().deleteAuthPolicy(id)
+
+		output.data({ id }, {
+			human: result => `Deleted auth policy ${humanText(result.id)}.`,
+			quiet: result => result.id,
+		})
+	}
+}