@contember/cli 2.2.0-alpha.1 → 2.2.0-alpha.10

package/tests/tenantConfigApplier.test.ts

@@ -1,87 +1,483 @@
 import { describe, expect, test } from 'bun:test'
-import { TenantConfigApplier } from '../src/lib/tenant/TenantConfigApplier.js'
-import type { RemoteIdentityProvider, TenantClient } from '../src/lib/tenant/TenantClient.js'
+import { createTestOutput } from '../../cli-common/tests/lib/testOutput.js'
+import { TenantConfigApplier, TenantConfigApplierClients } from '../src/lib/tenant/TenantConfigApplier.js'
+import type { RemoteAuthPolicy, RemoteCustomRole, RemoteIdentityProvider } from '../src/lib/tenant/clients/index.js'
+import type { TenantCustomRoleConfig, TenantGlobalConfig } from '../src/lib/tenant/tenantConfig.js'
+import { defineTenantConfig } from '../src/lib/tenant/tenantConfig.js'
 
-const createClientMock = (existingIdps: RemoteIdentityProvider[] = []) => {
+const createPolicy = (policy: Pick<RemoteAuthPolicy, 'id' | 'scope' | 'project' | 'roles'>): RemoteAuthPolicy => ({
+	mfaRequired: null,
+	tokenExpiration: null,
+	idleTimeout: null,
+	mfaGraceDuration: null,
+	rememberMeAllowed: null,
+	...policy,
+})
+
+const createClientsMock = (
+	existingIdps: RemoteIdentityProvider[] = [],
+	existingPolicies: RemoteAuthPolicy[] = [],
+	existingCustomRoles: RemoteCustomRole[] = [],
+) => {
 	const calls: string[] = []
-	const client = {
-		configure: async () => {
-			calls.push('configure')
-		},
-		listIdentityProviders: async () => existingIdps,
-		addIdp: async (slug: string) => {
-			calls.push(`addIdp:${slug}`)
-		},
-		updateIdp: async (slug: string) => {
-			calls.push(`updateIdp:${slug}`)
-		},
-		enableIdp: async (slug: string) => {
-			calls.push(`enableIdp:${slug}`)
+	const configured: TenantGlobalConfig[] = []
+	const updatedCustomRoles: { readonly slug: string; readonly role: TenantCustomRoleConfig }[] = []
+	const clients: TenantConfigApplierClients = {
+		project: {
+			configure: async (config: TenantGlobalConfig) => {
+				calls.push('configure')
+				configured.push(config)
+			},
+			listIdentityProviders: async () => existingIdps,
+			addIdp: async (slug: string) => {
+				calls.push(`addIdp:${slug}`)
+			},
+			updateIdp: async (slug: string) => {
+				calls.push(`updateIdp:${slug}`)
+			},
+			enableIdp: async (slug: string) => {
+				calls.push(`enableIdp:${slug}`)
+			},
+			disableIdp: async (slug: string) => {
+				calls.push(`disableIdp:${slug}`)
+			},
 		},
-		disableIdp: async (slug: string) => {
-			calls.push(`disableIdp:${slug}`)
-		},
-		addMailTemplate: async (template: { type: string }) => {
-			calls.push(`addMailTemplate:${template.type}`)
+		policy: {
+			addMailTemplate: async (template: { type: string }) => {
+				calls.push(`addMailTemplate:${template.type}`)
+			},
+			listAuthPolicies: async () => existingPolicies,
+			createAuthPolicy: async (policy: { roles: readonly string[] }) => {
+				calls.push(`createAuthPolicy:${[...policy.roles].sort().join('+')}`)
+				return 'new-policy-id'
+			},
+			updateAuthPolicy: async (id: string) => {
+				calls.push(`updateAuthPolicy:${id}`)
+			},
+			listCustomRoles: async () => existingCustomRoles,
+			createCustomRole: async (slug: string, role: TenantCustomRoleConfig) => {
+				calls.push(`createCustomRole:${slug}:${role.grants.length}`)
+			},
+			updateCustomRole: async (slug: string, role: TenantCustomRoleConfig) => {
+				calls.push(`updateCustomRole:${slug}:${role.grants.length}`)
+				updatedCustomRoles.push({ slug, role })
+			},
 		},
 	}
-	return { client: client as unknown as TenantClient, calls }
+	return { clients, calls, configured, updatedCustomRoles }
+}
+
+const createApplier = () => {
+	const testOutput = createTestOutput()
+	return { applier: new TenantConfigApplier(testOutput.output), ...testOutput }
 }
 
 describe('TenantConfigApplier', () => {
 	test('sends configure when global config is present', async () => {
-		const { client, calls } = createClientMock()
-		await new TenantConfigApplier().apply(client, { config: { password: { minLength: 8 } } })
+		const { clients, calls } = createClientsMock()
+		const { applier } = createApplier()
+		const { actions } = await applier.apply(clients, { config: { password: { minLength: 8 } } })
+		expect(calls).toEqual(['configure'])
+		expect(actions).toEqual([{ action: 'configure', target: null }])
+	})
+
+	// The applier does not model config sections; new ones (here: panel) must reach `configure` verbatim.
+	test('forwards the management panel access lists verbatim', async () => {
+		const { clients, configured } = createClientsMock()
+		const { applier } = createApplier()
+		await applier.apply(clients, {
+			config: { panel: { globalRoles: ['super_admin', 'ops'], projectRoles: [] } },
+		})
+		expect(configured).toEqual([{ panel: { globalRoles: ['super_admin', 'ops'], projectRoles: [] } }])
+	})
+
+	test('skips a schema-level no-op and continues with later actions', async () => {
+		const { clients, calls } = createClientsMock([])
+		const { applier } = createApplier()
+		const { actions } = await applier.apply(clients, {
+			config: { password: { minLength: null }, captcha: { secret: null } },
+			identityProviders: { google: { type: 'oidc', configuration: {} } },
+			mailTemplates: [{ type: 'RESET_PASSWORD_REQUEST', subject: 's', content: 'c' }],
+		})
+		expect(calls).toEqual(['addIdp:google', 'addMailTemplate:RESET_PASSWORD_REQUEST'])
+		expect(actions).toEqual([
+			{ action: 'addIdp', target: 'google' },
+			{ action: 'addMailTemplate', target: 'RESET_PASSWORD_REQUEST' },
+		])
+	})
+
+	test('a dry run omits no-op configure but keeps the rest of the plan', async () => {
+		const { clients, calls } = createClientsMock([])
+		const { applier } = createApplier()
+		const { actions } = await applier.apply(clients, {
+			config: { captcha: { secret: null, protect: { signUp: null } } },
+			identityProviders: { google: { type: 'oidc', configuration: {} } },
+		}, { dryRun: true })
+		expect(calls).toEqual([])
+		expect(actions).toEqual([{ action: 'addIdp', target: 'google' }])
+	})
+
+	test('keeps explicit null clears that map to nullable database columns', async () => {
+		const { clients, calls } = createClientsMock()
+		const { applier } = createApplier()
+		const { actions } = await applier.apply(clients, { config: { password: { pattern: null } } })
 		expect(calls).toEqual(['configure'])
+		expect(actions).toEqual([{ action: 'configure', target: null }])
 	})
 
 	test('adds a new identity provider', async () => {
-		const { client, calls } = createClientMock([])
-		await new TenantConfigApplier().apply(client, {
+		const { clients, calls } = createClientsMock([])
+		const { applier } = createApplier()
+		const { actions } = await applier.apply(clients, {
 			identityProviders: { google: { type: 'oidc', configuration: {} } },
 		})
 		expect(calls).toEqual(['addIdp:google'])
+		expect(actions).toEqual([{ action: 'addIdp', target: 'google' }])
 	})
 
 	test('updates an existing identity provider', async () => {
-		const { client, calls } = createClientMock([{ slug: 'google', type: 'oidc', disabledAt: null }])
-		await new TenantConfigApplier().apply(client, {
+		const { clients, calls } = createClientsMock([{ slug: 'google', type: 'oidc', disabledAt: null }])
+		const { applier } = createApplier()
+		await applier.apply(clients, {
 			identityProviders: { google: { type: 'oidc', configuration: {} } },
 		})
 		expect(calls).toEqual(['updateIdp:google'])
 	})
 
 	test('disables an enabled provider marked disabled', async () => {
-		const { client, calls } = createClientMock([{ slug: 'google', type: 'oidc', disabledAt: null }])
-		await new TenantConfigApplier().apply(client, {
+		const { clients, calls } = createClientsMock([{ slug: 'google', type: 'oidc', disabledAt: null }])
+		const { applier } = createApplier()
+		await applier.apply(clients, {
 			identityProviders: { google: { type: 'oidc', configuration: {}, disabled: true } },
 		})
 		expect(calls).toEqual(['updateIdp:google', 'disableIdp:google'])
 	})
 
 	test('re-enables a disabled provider no longer marked disabled', async () => {
-		const { client, calls } = createClientMock([{ slug: 'google', type: 'oidc', disabledAt: '2024-01-01T00:00:00Z' }])
-		await new TenantConfigApplier().apply(client, {
+		const { clients, calls } = createClientsMock([{ slug: 'google', type: 'oidc', disabledAt: '2024-01-01T00:00:00Z' }])
+		const { applier } = createApplier()
+		await applier.apply(clients, {
 			identityProviders: { google: { type: 'oidc', configuration: {} } },
 		})
 		expect(calls).toEqual(['updateIdp:google', 'enableIdp:google'])
 	})
 
 	test('upserts mail templates', async () => {
-		const { client, calls } = createClientMock()
-		await new TenantConfigApplier().apply(client, {
-			mailTemplates: [{ type: 'RESET_PASSWORD_REQUEST', subject: 's', content: 'c' }],
+		const { clients, calls } = createClientsMock()
+		const { applier } = createApplier()
+		const { actions } = await applier.apply(clients, {
+			mailTemplates: [{ type: 'RESET_PASSWORD_REQUEST', subject: 's', content: 'c', variant: 'cs' }],
 		})
 		expect(calls).toEqual(['addMailTemplate:RESET_PASSWORD_REQUEST'])
+		expect(actions).toEqual([{ action: 'addMailTemplate', target: 'RESET_PASSWORD_REQUEST/cs' }])
 	})
 
-	test('dry run performs no mutations but still reads state', async () => {
-		const { client, calls } = createClientMock([])
-		await new TenantConfigApplier().apply(client, {
+	test('creates an auth policy that does not exist yet', async () => {
+		const { clients, calls } = createClientsMock([], [])
+		const { applier } = createApplier()
+		const { actions } = await applier.apply(clients, {
+			authPolicies: [{ scope: 'global', roles: ['admin'], mfaRequired: true }],
+		})
+		expect(calls).toEqual(['createAuthPolicy:admin'])
+		expect(actions).toEqual([{ action: 'createAuthPolicy', target: 'global [admin]' }])
+	})
+
+	test('updates the policy targeting the same scope and roles', async () => {
+		const { clients, calls } = createClientsMock([], [createPolicy({ id: 'p1', scope: 'global', project: null, roles: ['admin'] })])
+		const { applier } = createApplier()
+		const { actions } = await applier.apply(clients, {
+			authPolicies: [{ scope: 'global', roles: ['admin'], mfaRequired: true }],
+		})
+		expect(calls).toEqual(['updateAuthPolicy:p1'])
+		expect(actions).toEqual([{ action: 'updateAuthPolicy', target: 'global [admin]' }])
+	})
+
+	test('matches roles as a set, not as an ordered list', async () => {
+		const { clients, calls } = createClientsMock([], [createPolicy({ id: 'p1', scope: 'global', project: null, roles: ['editor', 'admin'] })])
+		const { applier } = createApplier()
+		await applier.apply(clients, {
+			authPolicies: [{ scope: 'global', roles: ['admin', 'editor'] }],
+		})
+		expect(calls).toEqual(['updateAuthPolicy:p1'])
+	})
+
+	test('keeps global and project policies with the same roles apart', async () => {
+		const { clients, calls } = createClientsMock([], [createPolicy({ id: 'p1', scope: 'global', project: null, roles: ['admin'] })])
+		const { applier } = createApplier()
+		await applier.apply(clients, {
+			authPolicies: [{ scope: 'project', project: 'blog', roles: ['admin'] }],
+		})
+		expect(calls).toEqual(['createAuthPolicy:admin'])
+	})
+
+	test('warns about an existing policy the config does not manage', async () => {
+		const { clients } = createClientsMock([], [createPolicy({ id: 'stale', scope: 'global', project: null, roles: ['old_role'] })])
+		const { applier, stderr } = createApplier()
+		const { warnings } = await applier.apply(clients, {
+			authPolicies: [{ scope: 'global', roles: ['admin'] }],
+		})
+		expect(warnings).toEqual([{
+			code: 'UNMANAGED_AUTH_POLICY',
+			target: 'global [old_role]',
+			message: 'Auth policy global [old_role] exists but is not in the config; it stays in effect.',
+		}])
+		expect(stderr.lines.filter(it => it.includes('stays in effect'))).toHaveLength(1)
+	})
+
+	// An empty list is the case the warning exists for: the config claims to manage
+	// policies, so a row left over from an earlier apply keeps enforcing unnoticed.
+	test('warns about existing policies when the config lists none', async () => {
+		const { clients, calls } = createClientsMock([], [createPolicy({ id: 'stale', scope: 'global', project: null, roles: ['old_role'] })])
+		const { applier, stderr } = createApplier()
+		const { warnings } = await applier.apply(clients, { authPolicies: [] })
+		expect(warnings).toHaveLength(1)
+		expect(warnings[0].code).toBe('UNMANAGED_AUTH_POLICY')
+		expect(stderr.lines).toHaveLength(1)
+		expect(stderr.lines[0]).toContain('old_role')
+		expect(calls).toEqual([])
+	})
+
+	test('stays silent about existing policies when the config does not mention them at all', async () => {
+		const { clients } = createClientsMock([], [createPolicy({ id: 'stale', scope: 'global', project: null, roles: ['old_role'] })])
+		const { applier, stderr } = createApplier()
+		const { warnings } = await applier.apply(clients, {})
+		expect(warnings).toEqual([])
+		expect(stderr.text).toBe('')
+	})
+
+	test('rejects two config entries targeting the same policy before anything is written', async () => {
+		const { clients, calls } = createClientsMock()
+		const { applier } = createApplier()
+		let thrown: unknown
+		try {
+			await applier.apply(clients, {
+				config: { password: { minLength: 8 } },
+				authPolicies: [
+					{ scope: 'global', roles: ['admin', 'editor'], mfaRequired: true },
+					{ scope: 'global', roles: ['editor', 'admin'], mfaRequired: false },
+				],
+			})
+		} catch (e) {
+			thrown = e
+		}
+		expect(thrown).toContain('Duplicate auth policy')
+		// `configure` comes first in apply(), so an empty call list proves the check ran before it.
+		expect(calls).toEqual([])
+	})
+
+	test('rejects duplicate existing policies before anything is written', async () => {
+		const duplicate = { scope: 'global' as const, project: null, roles: ['admin'] }
+		const { clients, calls } = createClientsMock([], [
+			createPolicy({ id: 'p1', ...duplicate }),
+			createPolicy({ id: 'p2', ...duplicate }),
+		])
+		const { applier } = createApplier()
+		let thrown: unknown
+		try {
+			await applier.apply(clients, {
+				config: { password: { minLength: 8 } },
+				authPolicies: [{ scope: 'global', roles: ['admin'] }],
+			})
+		} catch (e) {
+			thrown = e
+		}
+		expect(thrown).toBeInstanceOf(Error)
+		if (thrown instanceof Error) {
+			expect(thrown.message).toContain('Duplicate existing auth policy')
+		}
+		expect(calls).toEqual([])
+	})
+
+	test('creates all custom role slugs before applying configured grants', async () => {
+		const { clients, calls } = createClientsMock()
+		const { applier } = createApplier()
+		await applier.apply(clients, {
+			customRoles: {
+				support: {
+					grants: [{
+						permission: 'identity:addGlobalRoles',
+						config: {
+							roles: { allowed: ['reviewer'] },
+							target: {
+								globalRoles: { allowed: ['person'] },
+								projectMemberships: 'none',
+							},
+							allowSelf: false,
+						},
+					}],
+				},
+				reviewer: {
+					grants: [{ permission: 'person:view' }],
+				},
+			},
+		})
+		expect(calls).toEqual([
+			'createCustomRole:support:0',
+			'createCustomRole:reviewer:0',
+			'updateCustomRole:support:1',
+			'updateCustomRole:reviewer:1',
+		])
+	})
+
+	test('updates an existing custom role without recreating it', async () => {
+		const { clients, calls } = createClientsMock([], [], [{ slug: 'support' }])
+		const { applier } = createApplier()
+		await applier.apply(clients, {
+			customRoles: {
+				support: {
+					description: 'Support team',
+					grants: [{ permission: 'person:list' }],
+				},
+			},
+		})
+		expect(calls).toEqual(['updateCustomRole:support:1'])
+	})
+
+	test('clears an existing custom role description explicitly', async () => {
+		const { clients, updatedCustomRoles } = createClientsMock([], [], [{ slug: 'support' }])
+		const { applier } = createApplier()
+		await applier.apply(clients, {
+			customRoles: {
+				support: {
+					description: null,
+					grants: [{ permission: 'person:list' }],
+				},
+			},
+		})
+		expect(updatedCustomRoles).toEqual([{
+			slug: 'support',
+			role: {
+				description: null,
+				grants: [{ permission: 'person:list' }],
+			},
+		}])
+	})
+
+	test('dry run performs no mutations but still reads state and returns the plan', async () => {
+		const { clients, calls } = createClientsMock([])
+		const { applier } = createApplier()
+		const { actions } = await applier.apply(clients, {
 			config: { password: { minLength: 8 } },
 			identityProviders: { google: { type: 'oidc', configuration: {} } },
 			mailTemplates: [{ type: 'RESET_PASSWORD_REQUEST', subject: 's', content: 'c' }],
+			authPolicies: [{ scope: 'global', roles: ['admin'] }],
+			customRoles: {
+				support: { grants: [{ permission: 'person:list' }] },
+			},
 		}, { dryRun: true })
 		expect(calls).toEqual([])
+		expect(actions).toEqual([
+			{ action: 'configure', target: null },
+			{ action: 'addIdp', target: 'google' },
+			{ action: 'addMailTemplate', target: 'RESET_PASSWORD_REQUEST' },
+			{ action: 'createAuthPolicy', target: 'global [admin]' },
+			{ action: 'createCustomRole', target: 'support' },
+			{ action: 'updateCustomRole', target: 'support' },
+		])
+	})
+
+	// createTestOutput defaults to a non-TTY stderr, which is what CI looks like — `progress()` would print nothing here
+	test('reports every executed action on stderr even without a TTY, and writes nothing to stdout', async () => {
+		const { clients } = createClientsMock([{ slug: 'google', type: 'oidc', disabledAt: null }])
+		const { applier, stdout, stderr } = createApplier()
+
+		await applier.apply(clients, {
+			config: { password: { minLength: 8 } },
+			identityProviders: { google: { type: 'oidc', configuration: {}, disabled: true } },
+			mailTemplates: [{ type: 'RESET_PASSWORD_REQUEST', subject: 's', content: 'c' }],
+		})
+
+		expect(stderr.lines).toEqual([
+			'configure',
+			'updateIdp: google',
+			'disableIdp: google',
+			'addMailTemplate: RESET_PASSWORD_REQUEST',
+		])
+		expect(stdout.text).toBe('')
+	})
+
+	test('a dry run reports nothing — no action was taken', async () => {
+		const { clients } = createClientsMock([])
+		const { applier, stdout, stderr } = createApplier()
+
+		await applier.apply(clients, { config: { password: { minLength: 8 } } }, { dryRun: true })
+
+		expect(stderr.text).toBe('')
+		expect(stdout.text).toBe('')
+	})
+
+	test('accepts every typed custom-role grant configuration kind', () => {
+		const config = defineTenantConfig({
+			customRoles: {
+				support: {
+					grants: [
+						{ permission: 'person:list' },
+						{
+							permission: 'person:signUp',
+							config: { roles: { allowed: ['person'] } },
+						},
+						{
+							permission: 'person:changePassword',
+							config: {
+								target: {
+									globalRoles: { allowed: ['person'] },
+									projectMemberships: 'none',
+								},
+							},
+						},
+						{
+							permission: 'person:changeProfile',
+							config: {
+								target: {
+									globalRoles: { allowed: ['person'] },
+									projectMemberships: 'none',
+								},
+								fields: { allowed: ['name'] },
+							},
+						},
+						{
+							permission: 'person:createSessionToken',
+							config: {
+								target: {
+									globalRoles: { allowed: ['person'] },
+									projectMemberships: 'none',
+								},
+								session: {
+									maxExpirationMinutes: 30,
+									allowTrustForwardedClientInfo: false,
+								},
+							},
+						},
+						{
+							permission: 'identity:addGlobalRoles',
+							config: {
+								roles: { allowed: ['support'] },
+								target: {
+									globalRoles: { allowed: ['person'] },
+									projectMemberships: 'none',
+								},
+								allowSelf: false,
+							},
+						},
+						{
+							permission: 'apiKey:createGlobal',
+							config: {
+								roles: { allowed: ['support'] },
+								allowTrustForwardedClientInfo: false,
+							},
+						},
+						{
+							permission: 'mailTemplate:list',
+							config: {
+								global: false,
+								projects: ['example'],
+								types: ['FORCED_SIGN_OUT'],
+							},
+						},
+					],
+				},
+			},
+		})
+		expect(config.customRoles?.support.grants).toHaveLength(8)
 	})
 })

package/dist/development/src/lib/tenant/TenantClient.cjs

@@ -1,104 +0,0 @@
-"use strict";
-Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const graphqlClient = require("@contember/graphql-client");
-const TenantApi = require("@contember/graphql-client-tenant");
-const graphqlTsClientApi = require("graphql-ts-client-api");
-const createTenantApiUrl = (url) => {
-  if (url.endsWith("/")) {
-    url = url.substring(0, url.length - 1);
-  }
-  if (url.endsWith("/tenant")) {
-    return url;
-  }
-  return url + "/tenant";
-};
-const createProjectFetcher = TenantApi.mutation$.createProject(TenantApi.createProjectResponse$$.error(TenantApi.createProjectResponseError$$));
-const configureFetcher = TenantApi.mutation$.configure(TenantApi.configureResponse$$.error(TenantApi.configureError$$));
-const identityProvidersFetcher = TenantApi.query$.identityProviders(TenantApi.identityProvider$.slug.type.disabledAt);
-const addIdpFetcher = TenantApi.mutation$.addIDP(TenantApi.addIDPResponse$$.error(TenantApi.addIDPError$$));
-const updateIdpFetcher = TenantApi.mutation$.updateIDP(TenantApi.updateIDPResponse$$.error(TenantApi.updateIDPError$$));
-const enableIdpFetcher = TenantApi.mutation$.enableIDP(TenantApi.enableIDPResponse$$.error(TenantApi.enableIDPError$$));
-const disableIdpFetcher = TenantApi.mutation$.disableIDP(TenantApi.disableIDPResponse$$.error(TenantApi.disableIDPError$$));
-const addMailTemplateFetcher = TenantApi.mutation$.addMailTemplate(TenantApi.addMailTemplateResponse$$.error(TenantApi.addMailTemplateError$$));
-class TenantClient {
-  constructor(apiClient) {
-    this.apiClient = apiClient;
-  }
-  static create(url, apiToken) {
-    const graphqlClient$1 = new graphqlClient.GraphQlClient({ url: createTenantApiUrl(url), apiToken });
-    return new TenantClient(graphqlClient$1);
-  }
-  async createProject(slug, ignoreExisting = false) {
-    const result = await this.exec(createProjectFetcher, { projectSlug: slug });
-    if (!result.createProject?.ok) {
-      const code = result.createProject?.error?.code;
-      if (ignoreExisting && code === "ALREADY_EXISTS") {
-        return;
-      }
-      throw code ?? "UNKNOWN";
-    }
-  }
-  async configure(config) {
-    const result = await this.exec(configureFetcher, { config });
-    this.assertOk(result.configure, "configure");
-  }
-  async listIdentityProviders() {
-    const result = await this.exec(identityProvidersFetcher, {});
-    return result.identityProviders.map((it) => ({
-      slug: it.slug,
-      type: it.type,
-      disabledAt: it.disabledAt ?? null
-    }));
-  }
-  async addIdp(slug, type, configuration, options) {
-    const result = await this.exec(addIdpFetcher, { identityProvider: slug, type, configuration, options });
-    this.assertOk(result.addIDP, `addIDP(${slug})`);
-  }
-  async updateIdp(slug, type, configuration, options) {
-    const result = await this.exec(updateIdpFetcher, {
-      identityProvider: slug,
-      type,
-      configuration,
-      options,
-      mergeConfiguration: false
-    });
-    this.assertOk(result.updateIDP, `updateIDP(${slug})`);
-  }
-  async enableIdp(slug) {
-    const result = await this.exec(enableIdpFetcher, { identityProvider: slug });
-    this.assertOk(result.enableIDP, `enableIDP(${slug})`);
-  }
-  async disableIdp(slug) {
-    const result = await this.exec(disableIdpFetcher, { identityProvider: slug });
-    this.assertOk(result.disableIDP, `disableIDP(${slug})`);
-  }
-  async addMailTemplate(template) {
-    const result = await this.exec(addMailTemplateFetcher, { template });
-    this.assertOk(result.addMailTemplate, `addMailTemplate(${template.type}/${template.variant ?? ""})`);
-  }
-  async exec(fetcher, variables) {
-    const writer = new graphqlTsClientApi.TextWriter();
-    writer.text(fetcher.fetchableType.name.toLowerCase());
-    if (fetcher.variableTypeMap.size !== 0) {
-      writer.scope({ type: "ARGUMENTS", multiLines: fetcher.variableTypeMap.size > 2, suffix: " " }, () => {
-        graphqlTsClientApi.util.iterateMap(fetcher.variableTypeMap, ([name, type]) => {
-          writer.seperator();
-          writer.text(`$${name}: ${type}`);
-        });
-      });
-    }
-    writer.text(fetcher.toString());
-    writer.text(fetcher.toFragmentString());
-    return this.apiClient.execute(writer.toString(), { variables });
-  }
-  assertOk(result, operation) {
-    if (!result?.ok) {
-      const code = result?.error?.code ?? "UNKNOWN";
-      const message = result?.error?.developerMessage;
-      throw `${operation} failed: ${code}${message ? ` — ${message}` : ""}`;
-    }
-  }
-}
-exports.TenantClient = TenantClient;
-exports.createTenantApiUrl = createTenantApiUrl;
-//# sourceMappingURL=TenantClient.cjs.map

package/dist/development/src/lib/tenant/TenantClient.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"TenantClient.cjs","sources":["../../../../../../packages/cli/src/lib/tenant/TenantClient.ts"],"sourcesContent":["import { GraphQlClient } from '@contember/graphql-client'\nimport {\n\taddIDPError$$,\n\taddIDPResponse$$,\n\taddMailTemplateError$$,\n\taddMailTemplateResponse$$,\n\ttype ConfigInput,\n\tconfigureError$$,\n\tconfigureResponse$$,\n\tcreateProjectResponse$$,\n\tcreateProjectResponseError$$,\n\tdisableIDPError$$,\n\tdisableIDPResponse$$,\n\tenableIDPError$$,\n\tenableIDPResponse$$,\n\tidentityProvider$,\n\ttype MailTemplate,\n\tmutation$,\n\tquery$,\n\tupdateIDPError$$,\n\tupdateIDPResponse$$,\n} from '@contember/graphql-client-tenant'\nimport { Fetcher, TextWriter, util } from 'graphql-ts-client-api'\nimport { TenantGlobalConfig, TenantIdpOptions, TenantMailTemplate } from './tenantConfig.js'\n\nexport const createTenantApiUrl = (url: string) => {\n\tif (url.endsWith('/')) {\n\t\turl = url.substring(0, url.length - 1)\n\t}\n\tif (url.endsWith('/tenant')) {\n\t\treturn url\n\t}\n\treturn url + '/tenant'\n}\n\nexport interface RemoteIdentityProvider {\n\tslug: string\n\ttype: string\n\tdisabledAt: string | null\n}\n\ninterface MutationResult {\n\tok: boolean\n\terror?: { code: string; developerMessage?: string } | null\n}\n\n// Fetchers are immutable and reusable, so they are built once at module load.\nconst createProjectFetcher = mutation$.createProject(createProjectResponse$$.error(createProjectResponseError$$))\nconst configureFetcher = mutation$.configure(configureResponse$$.error(configureError$$))\nconst identityProvidersFetcher = query$.identityProviders(identityProvider$.slug.type.disabledAt)\nconst addIdpFetcher = mutation$.addIDP(addIDPResponse$$.error(addIDPError$$))\nconst updateIdpFetcher = mutation$.updateIDP(updateIDPResponse$$.error(updateIDPError$$))\nconst enableIdpFetcher = mutation$.enableIDP(enableIDPResponse$$.error(enableIDPError$$))\nconst disableIdpFetcher = mutation$.disableIDP(disableIDPResponse$$.error(disableIDPError$$))\nconst addMailTemplateFetcher = mutation$.addMailTemplate(addMailTemplateResponse$$.error(addMailTemplateError$$))\n\nexport class TenantClient {\n\tconstructor(private readonly apiClient: GraphQlClient) {}\n\n\tpublic static create(url: string, apiToken: string): TenantClient {\n\t\tconst graphqlClient = new GraphQlClient({ url: createTenantApiUrl(url), apiToken })\n\t\treturn new TenantClient(graphqlClient)\n\t}\n\n\tpublic async createProject(slug: string, ignoreExisting = false): Promise<void> {\n\t\tconst result = await this.exec(createProjectFetcher, { projectSlug: slug })\n\t\tif (!result.createProject?.ok) {\n\t\t\tconst code = result.createProject?.error?.code\n\t\t\tif (ignoreExisting && code === 'ALREADY_EXISTS') {\n\t\t\t\treturn\n\t\t\t}\n\t\t\tthrow code ?? 'UNKNOWN'\n\t\t}\n\t}\n\n\tpublic async configure(config: TenantGlobalConfig): Promise<void> {\n\t\t// `TenantGlobalConfig` widens a few fields to `| null` (the API accepts an\n\t\t// explicit null to clear/disable); the generated wire type omits that.\n\t\tconst result = await this.exec(configureFetcher, { config: config as ConfigInput })\n\t\tthis.assertOk(result.configure, 'configure')\n\t}\n\n\tpublic async listIdentityProviders(): Promise<RemoteIdentityProvider[]> {\n\t\tconst result = await this.exec(identityProvidersFetcher, {})\n\t\treturn result.identityProviders.map(it => ({\n\t\t\tslug: it.slug,\n\t\t\ttype: it.type,\n\t\t\tdisabledAt: it.disabledAt ?? null,\n\t\t}))\n\t}\n\n\tpublic async addIdp(slug: string, type: string, configuration: unknown, options?: TenantIdpOptions): Promise<void> {\n\t\tconst result = await this.exec(addIdpFetcher, { identityProvider: slug, type, configuration, options })\n\t\tthis.assertOk(result.addIDP, `addIDP(${slug})`)\n\t}\n\n\tpublic async updateIdp(slug: string, type: string, configuration: unknown, options?: TenantIdpOptions): Promise<void> {\n\t\tconst result = await this.exec(updateIdpFetcher, {\n\t\t\tidentityProvider: slug,\n\t\t\ttype,\n\t\t\tconfiguration,\n\t\t\toptions,\n\t\t\tmergeConfiguration: false,\n\t\t})\n\t\tthis.assertOk(result.updateIDP, `updateIDP(${slug})`)\n\t}\n\n\tpublic async enableIdp(slug: string): Promise<void> {\n\t\tconst result = await this.exec(enableIdpFetcher, { identityProvider: slug })\n\t\tthis.assertOk(result.enableIDP, `enableIDP(${slug})`)\n\t}\n\n\tpublic async disableIdp(slug: string): Promise<void> {\n\t\tconst result = await this.exec(disableIdpFetcher, { identityProvider: slug })\n\t\tthis.assertOk(result.disableIDP, `disableIDP(${slug})`)\n\t}\n\n\tpublic async addMailTemplate(template: TenantMailTemplate): Promise<void> {\n\t\tconst result = await this.exec(addMailTemplateFetcher, { template: template as MailTemplate })\n\t\tthis.assertOk(result.addMailTemplate, `addMailTemplate(${template.type}/${template.variant ?? ''})`)\n\t}\n\n\tprivate async exec<TData extends object, TVariables extends object>(\n\t\tfetcher: Fetcher<'Query' | 'Mutation', TData, TVariables>,\n\t\tvariables: TVariables,\n\t): Promise<TData> {\n\t\tconst writer = new TextWriter()\n\t\twriter.text(fetcher.fetchableType.name.toLowerCase())\n\t\tif (fetcher.variableTypeMap.size !== 0) {\n\t\t\twriter.scope({ type: 'ARGUMENTS', multiLines: fetcher.variableTypeMap.size > 2, suffix: ' ' }, () => {\n\t\t\t\tutil.iterateMap(fetcher.variableTypeMap, ([name, type]) => {\n\t\t\t\t\twriter.seperator()\n\t\t\t\t\twriter.text(`$${name}: ${type}`)\n\t\t\t\t})\n\t\t\t})\n\t\t}\n\t\twriter.text(fetcher.toString())\n\t\twriter.text(fetcher.toFragmentString())\n\t\treturn this.apiClient.execute<TData>(writer.toString(), { variables })\n\t}\n\n\tprivate assertOk(result: MutationResult | undefined, operation: string): void {\n\t\tif (!result?.ok) {\n\t\t\tconst code = result?.error?.code ?? 'UNKNOWN'\n\t\t\tconst message = result?.error?.developerMessage\n\t\t\tthrow `${operation} failed: ${code}${message ? ` — ${message}` : ''}`\n\t\t}\n\t}\n}\n"],"names":["mutation$","createProjectResponse$$","createProjectResponseError$$","configureResponse$$","configureError$$","query$","identityProvider$","addIDPResponse$$","addIDPError$$","updateIDPResponse$$","updateIDPError$$","enableIDPResponse$$","enableIDPError$$","disableIDPResponse$$","disableIDPError$$","addMailTemplateResponse$$","addMailTemplateError$$","graphqlClient","GraphQlClient","TextWriter","util"],"mappings":";;;;;AAyBO,MAAM,qBAAqB,CAAC,QAAgB;AAClD,MAAI,IAAI,SAAS,GAAG,GAAG;AACtB,UAAM,IAAI,UAAU,GAAG,IAAI,SAAS,CAAC;AAAA,EACtC;AACA,MAAI,IAAI,SAAS,SAAS,GAAG;AAC5B,WAAO;AAAA,EACR;AACA,SAAO,MAAM;AACd;AAcA,MAAM,uBAAuBA,UAAAA,UAAU,cAAcC,UAAAA,wBAAwB,MAAMC,UAAAA,4BAA4B,CAAC;AAChH,MAAM,mBAAmBF,UAAAA,UAAU,UAAUG,UAAAA,oBAAoB,MAAMC,UAAAA,gBAAgB,CAAC;AACxF,MAAM,2BAA2BC,UAAAA,OAAO,kBAAkBC,UAAAA,kBAAkB,KAAK,KAAK,UAAU;AAChG,MAAM,gBAAgBN,UAAAA,UAAU,OAAOO,UAAAA,iBAAiB,MAAMC,UAAAA,aAAa,CAAC;AAC5E,MAAM,mBAAmBR,UAAAA,UAAU,UAAUS,UAAAA,oBAAoB,MAAMC,UAAAA,gBAAgB,CAAC;AACxF,MAAM,mBAAmBV,UAAAA,UAAU,UAAUW,UAAAA,oBAAoB,MAAMC,UAAAA,gBAAgB,CAAC;AACxF,MAAM,oBAAoBZ,UAAAA,UAAU,WAAWa,UAAAA,qBAAqB,MAAMC,UAAAA,iBAAiB,CAAC;AAC5F,MAAM,yBAAyBd,UAAAA,UAAU,gBAAgBe,UAAAA,0BAA0B,MAAMC,UAAAA,sBAAsB,CAAC;AAEzG,MAAM,aAAa;AAAA,EACzB,YAA6B,WAA0B;AAA1B,SAAA,YAAA;AAAA,EAA2B;AAAA,EAExD,OAAc,OAAO,KAAa,UAAgC;AACjE,UAAMC,kBAAgB,IAAIC,cAAAA,cAAc,EAAE,KAAK,mBAAmB,GAAG,GAAG,UAAU;AAClF,WAAO,IAAI,aAAaD,eAAa;AAAA,EACtC;AAAA,EAEA,MAAa,cAAc,MAAc,iBAAiB,OAAsB;AAC/E,UAAM,SAAS,MAAM,KAAK,KAAK,sBAAsB,EAAE,aAAa,MAAM;AAC1E,QAAI,CAAC,OAAO,eAAe,IAAI;AAC9B,YAAM,OAAO,OAAO,eAAe,OAAO;AAC1C,UAAI,kBAAkB,SAAS,kBAAkB;AAChD;AAAA,MACD;AACA,YAAM,QAAQ;AAAA,IACf;AAAA,EACD;AAAA,EAEA,MAAa,UAAU,QAA2C;AAGjE,UAAM,SAAS,MAAM,KAAK,KAAK,kBAAkB,EAAE,QAA+B;AAClF,SAAK,SAAS,OAAO,WAAW,WAAW;AAAA,EAC5C;AAAA,EAEA,MAAa,wBAA2D;AACvE,UAAM,SAAS,MAAM,KAAK,KAAK,0BAA0B,CAAA,CAAE;AAC3D,WAAO,OAAO,kBAAkB,IAAI,CAAA,QAAO;AAAA,MAC1C,MAAM,GAAG;AAAA,MACT,MAAM,GAAG;AAAA,MACT,YAAY,GAAG,cAAc;AAAA,IAAA,EAC5B;AAAA,EACH;AAAA,EAEA,MAAa,OAAO,MAAc,MAAc,eAAwB,SAA2C;AAClH,UAAM,SAAS,MAAM,KAAK,KAAK,eAAe,EAAE,kBAAkB,MAAM,MAAM,eAAe,QAAA,CAAS;AACtG,SAAK,SAAS,OAAO,QAAQ,UAAU,IAAI,GAAG;AAAA,EAC/C;AAAA,EAEA,MAAa,UAAU,MAAc,MAAc,eAAwB,SAA2C;AACrH,UAAM,SAAS,MAAM,KAAK,KAAK,kBAAkB;AAAA,MAChD,kBAAkB;AAAA,MAClB;AAAA,MACA;AAAA,MACA;AAAA,MACA,oBAAoB;AAAA,IAAA,CACpB;AACD,SAAK,SAAS,OAAO,WAAW,aAAa,IAAI,GAAG;AAAA,EACrD;AAAA,EAEA,MAAa,UAAU,MAA6B;AACnD,UAAM,SAAS,MAAM,KAAK,KAAK,kBAAkB,EAAE,kBAAkB,MAAM;AAC3E,SAAK,SAAS,OAAO,WAAW,aAAa,IAAI,GAAG;AAAA,EACrD;AAAA,EAEA,MAAa,WAAW,MAA6B;AACpD,UAAM,SAAS,MAAM,KAAK,KAAK,mBAAmB,EAAE,kBAAkB,MAAM;AAC5E,SAAK,SAAS,OAAO,YAAY,cAAc,IAAI,GAAG;AAAA,EACvD;AAAA,EAEA,MAAa,gBAAgB,UAA6C;AACzE,UAAM,SAAS,MAAM,KAAK,KAAK,wBAAwB,EAAE,UAAoC;AAC7F,SAAK,SAAS,OAAO,iBAAiB,mBAAmB,SAAS,IAAI,IAAI,SAAS,WAAW,EAAE,GAAG;AAAA,EACpG;AAAA,EAEA,MAAc,KACb,SACA,WACiB;AACjB,UAAM,SAAS,IAAIE,8BAAA;AACnB,WAAO,KAAK,QAAQ,cAAc,KAAK,aAAa;AACpD,QAAI,QAAQ,gBAAgB,SAAS,GAAG;AACvC,aAAO,MAAM,EAAE,MAAM,aAAa,YAAY,QAAQ,gBAAgB,OAAO,GAAG,QAAQ,IAAA,GAAO,MAAM;AACpGC,2BAAAA,KAAK,WAAW,QAAQ,iBAAiB,CAAC,CAAC,MAAM,IAAI,MAAM;AAC1D,iBAAO,UAAA;AACP,iBAAO,KAAK,IAAI,IAAI,KAAK,IAAI,EAAE;AAAA,QAChC,CAAC;AAAA,MACF,CAAC;AAAA,IACF;AACA,WAAO,KAAK,QAAQ,UAAU;AAC9B,WAAO,KAAK,QAAQ,kBAAkB;AACtC,WAAO,KAAK,UAAU,QAAe,OAAO,YAAY,EAAE,WAAW;AAAA,EACtE;AAAA,EAEQ,SAAS,QAAoC,WAAyB;AAC7E,QAAI,CAAC,QAAQ,IAAI;AAChB,YAAM,OAAO,QAAQ,OAAO,QAAQ;AACpC,YAAM,UAAU,QAAQ,OAAO;AAC/B,YAAM,GAAG,SAAS,YAAY,IAAI,GAAG,UAAU,MAAM,OAAO,KAAK,EAAE;AAAA,IACpE;AAAA,EACD;AACD;;;"}