@contember/cli 2.2.0-alpha.1 → 2.2.0-alpha.10

package/dist/development/src/commands/tenant/person/TenantPersonSignOutCommand.js

@@ -0,0 +1,38 @@
+import { Command } from "@contember/cli-common";
+import { requireConfirmation } from "../../../lib/tenant/confirmation.js";
+import { humanText } from "../tenantOutput.js";
+class TenantPersonSignOutCommand extends Command {
+  constructor(tenantClientProvider) {
+    super();
+    this.tenantClientProvider = tenantClientProvider;
+  }
+  configure(configuration) {
+    configuration.description(
+      "Force sign-out: revoke every active session and disable all attached API keys, including permanent keys. An account-recovery operation, recorded in the auth log."
+    );
+    configuration.argument("id").description("Person id.");
+    configuration.option("reason").valueRequired().description("Reason stored with the auth log entry, e.g. an incident id.");
+    configuration.option("yes").valueNone().description("Do not ask for confirmation.");
+  }
+  async execute(input, output) {
+    const personId = input.getArgument("id");
+    const reason = input.getOption("reason");
+    await requireConfirmation({
+      yes: input.getOption("yes") === true,
+      output,
+      warning: `This will revoke every active session and disable all attached API keys of person ${personId}, including permanent keys.`
+    });
+    await this.tenantClientProvider.person().forceSignOutPerson(personId, reason);
+    output.info(
+      `Every session of person ${personId} was revoked and all attached API keys, including permanent keys, were disabled${reason !== void 0 ? ` (reason: ${reason})` : ""}.`
+    );
+    output.data(
+      { personId, signedOut: true, reason: reason ?? null },
+      { human: (it) => humanText(it.personId), quiet: (it) => it.personId }
+    );
+  }
+}
+export {
+  TenantPersonSignOutCommand
+};
+//# sourceMappingURL=TenantPersonSignOutCommand.js.map

package/dist/development/src/commands/tenant/person/TenantPersonSignOutCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantPersonSignOutCommand.js","sources":["../../../../../../../packages/cli/src/commands/tenant/person/TenantPersonSignOutCommand.ts"],"sourcesContent":["import { Command, CommandConfiguration, Input, Output } from '@contember/cli-common'\nimport { TenantClientProvider } from '../../../lib/TenantClientProvider.js'\nimport { requireConfirmation } from '../../../lib/tenant/confirmation.js'\nimport { humanText } from '../tenantOutput.js'\n\ntype Args = {\n\tid: string\n}\n\ntype Options = {\n\treason?: string\n\tyes?: boolean\n}\n\ninterface SignOutResult {\n\tpersonId: string\n\tsignedOut: true\n\t/** Recorded in the tenant auth log next to the sign-out event. */\n\treason: string | null\n}\n\nexport class TenantPersonSignOutCommand extends Command<Args, Options> {\n\tconstructor(\n\t\tprivate readonly tenantClientProvider: TenantClientProvider,\n\t) {\n\t\tsuper()\n\t}\n\n\tprotected configure(configuration: CommandConfiguration<Args, Options>): void {\n\t\tconfiguration.description(\n\t\t\t'Force sign-out: revoke every active session and disable all attached API keys, including permanent keys. An account-recovery operation, recorded in the auth log.',\n\t\t)\n\t\tconfiguration.argument('id').description('Person id.')\n\t\tconfiguration.option('reason').valueRequired().description('Reason stored with the auth log entry, e.g. an incident id.')\n\t\tconfiguration.option('yes').valueNone().description('Do not ask for confirmation.')\n\t}\n\n\tprotected async execute(input: Input<Args, Options>, output: Output): Promise<void> {\n\t\tconst personId = input.getArgument('id')\n\t\tconst reason = input.getOption('reason')\n\n\t\tawait requireConfirmation({\n\t\t\tyes: input.getOption('yes') === true,\n\t\t\toutput,\n\t\t\twarning: `This will revoke every active session and disable all attached API keys of person ${personId}, including permanent keys.`,\n\t\t})\n\n\t\tawait this.tenantClientProvider.person().forceSignOutPerson(personId, reason)\n\n\t\toutput.info(\n\t\t\t`Every session of person ${personId} was revoked and all attached API keys, including permanent keys, were disabled${\n\t\t\t\treason !== undefined ? ` (reason: ${reason})` : ''\n\t\t\t}.`,\n\t\t)\n\t\toutput.data<SignOutResult>(\n\t\t\t{ personId, signedOut: true, reason: reason ?? null },\n\t\t\t{ human: it => humanText(it.personId), quiet: it => it.personId },\n\t\t)\n\t}\n}\n"],"names":[],"mappings":";;;AAqBO,MAAM,mCAAmC,QAAuB;AAAA,EACtE,YACkB,sBAChB;AACD,UAAA;AAFiB,SAAA,uBAAA;AAAA,EAGlB;AAAA,EAEU,UAAU,eAA0D;AAC7E,kBAAc;AAAA,MACb;AAAA,IAAA;AAED,kBAAc,SAAS,IAAI,EAAE,YAAY,YAAY;AACrD,kBAAc,OAAO,QAAQ,EAAE,cAAA,EAAgB,YAAY,6DAA6D;AACxH,kBAAc,OAAO,KAAK,EAAE,UAAA,EAAY,YAAY,8BAA8B;AAAA,EACnF;AAAA,EAEA,MAAgB,QAAQ,OAA6B,QAA+B;AACnF,UAAM,WAAW,MAAM,YAAY,IAAI;AACvC,UAAM,SAAS,MAAM,UAAU,QAAQ;AAEvC,UAAM,oBAAoB;AAAA,MACzB,KAAK,MAAM,UAAU,KAAK,MAAM;AAAA,MAChC;AAAA,MACA,SAAS,qFAAqF,QAAQ;AAAA,IAAA,CACtG;AAED,UAAM,KAAK,qBAAqB,OAAA,EAAS,mBAAmB,UAAU,MAAM;AAE5E,WAAO;AAAA,MACN,2BAA2B,QAAQ,kFAClC,WAAW,SAAY,aAAa,MAAM,MAAM,EACjD;AAAA,IAAA;AAED,WAAO;AAAA,MACN,EAAE,UAAU,WAAW,MAAM,QAAQ,UAAU,KAAA;AAAA,MAC/C,EAAE,OAAO,CAAA,OAAM,UAAU,GAAG,QAAQ,GAAG,OAAO,CAAA,OAAM,GAAG,SAAA;AAAA,IAAS;AAAA,EAElE;AACD;"}

package/dist/development/src/commands/tenant/person/TenantPersonUpdateCommand.cjs

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const cliCommon = require("@contember/cli-common");
+const tenantOutput = require("../tenantOutput.cjs");
+class TenantPersonUpdateCommand extends cliCommon.Command {
+  constructor(tenantClientProvider) {
+    super();
+    this.tenantClientProvider = tenantClientProvider;
+  }
+  configure(configuration) {
+    configuration.description("Change the profile of a person. Only the fields you pass are changed; neither can be cleared.");
+    configuration.argument("id").description("Person id.");
+    configuration.option("email").valueRequired().description("New e-mail address.");
+    configuration.option("name").valueRequired().description("New display name.");
+  }
+  async execute(input, output) {
+    const personId = input.getArgument("id");
+    const email = input.getOption("email");
+    const name = tenantOutput.requireNonEmptyTenantName(input.getOption("name"), "Person");
+    if (email === void 0 && name === void 0) {
+      throw new cliCommon.CliError("Nothing to update. Pass --email, --name, or both.", {
+        code: "NOTHING_TO_UPDATE",
+        exitCode: cliCommon.ExitCode.InputError
+      });
+    }
+    await this.tenantClientProvider.person().changeProfile(personId, { email, name });
+    const changed = [email !== void 0 ? "e-mail" : null, name !== void 0 ? "name" : null].filter((it) => it !== null);
+    output.info(`Updated ${changed.join(" and ")} of person ${personId}.`);
+    output.data(
+      { personId, email: email ?? null, name: name ?? null },
+      { human: (it) => tenantOutput.humanText(it.personId), quiet: (it) => it.personId }
+    );
+  }
+}
+exports.TenantPersonUpdateCommand = TenantPersonUpdateCommand;
+//# sourceMappingURL=TenantPersonUpdateCommand.cjs.map

package/dist/development/src/commands/tenant/person/TenantPersonUpdateCommand.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantPersonUpdateCommand.cjs","sources":["../../../../../../../packages/cli/src/commands/tenant/person/TenantPersonUpdateCommand.ts"],"sourcesContent":["import { CliError, Command, CommandConfiguration, ExitCode, Input, Output } from '@contember/cli-common'\nimport { TenantClientProvider } from '../../../lib/TenantClientProvider.js'\nimport { humanText, requireNonEmptyTenantName } from '../tenantOutput.js'\n\ntype Args = {\n\tid: string\n}\n\ntype Options = {\n\temail?: string\n\tname?: string\n}\n\ninterface UpdateResult {\n\tpersonId: string\n\t/** Null means the field was left alone — the API cannot clear an e-mail or a name. */\n\temail: string | null\n\tname: string | null\n}\n\nexport class TenantPersonUpdateCommand extends Command<Args, Options> {\n\tconstructor(\n\t\tprivate readonly tenantClientProvider: TenantClientProvider,\n\t) {\n\t\tsuper()\n\t}\n\n\tprotected configure(configuration: CommandConfiguration<Args, Options>): void {\n\t\tconfiguration.description('Change the profile of a person. Only the fields you pass are changed; neither can be cleared.')\n\t\tconfiguration.argument('id').description('Person id.')\n\t\tconfiguration.option('email').valueRequired().description('New e-mail address.')\n\t\tconfiguration.option('name').valueRequired().description('New display name.')\n\t}\n\n\tprotected async execute(input: Input<Args, Options>, output: Output): Promise<void> {\n\t\tconst personId = input.getArgument('id')\n\t\tconst email = input.getOption('email')\n\t\tconst name = requireNonEmptyTenantName(input.getOption('name'), 'Person')\n\t\tif (email === undefined && name === undefined) {\n\t\t\tthrow new CliError('Nothing to update. Pass --email, --name, or both.', {\n\t\t\t\tcode: 'NOTHING_TO_UPDATE',\n\t\t\t\texitCode: ExitCode.InputError,\n\t\t\t})\n\t\t}\n\n\t\tawait this.tenantClientProvider.person().changeProfile(personId, { email, name })\n\n\t\tconst changed = [email !== undefined ? 'e-mail' : null, name !== undefined ? 'name' : null].filter(it => it !== null)\n\t\toutput.info(`Updated ${changed.join(' and ')} of person ${personId}.`)\n\t\toutput.data<UpdateResult>(\n\t\t\t{ personId, email: email ?? null, name: name ?? null },\n\t\t\t{ human: it => humanText(it.personId), quiet: it => it.personId },\n\t\t)\n\t}\n}\n"],"names":["Command","requireNonEmptyTenantName","CliError","ExitCode","humanText"],"mappings":";;;;AAoBO,MAAM,kCAAkCA,UAAAA,QAAuB;AAAA,EACrE,YACkB,sBAChB;AACD,UAAA;AAFiB,SAAA,uBAAA;AAAA,EAGlB;AAAA,EAEU,UAAU,eAA0D;AAC7E,kBAAc,YAAY,+FAA+F;AACzH,kBAAc,SAAS,IAAI,EAAE,YAAY,YAAY;AACrD,kBAAc,OAAO,OAAO,EAAE,cAAA,EAAgB,YAAY,qBAAqB;AAC/E,kBAAc,OAAO,MAAM,EAAE,cAAA,EAAgB,YAAY,mBAAmB;AAAA,EAC7E;AAAA,EAEA,MAAgB,QAAQ,OAA6B,QAA+B;AACnF,UAAM,WAAW,MAAM,YAAY,IAAI;AACvC,UAAM,QAAQ,MAAM,UAAU,OAAO;AACrC,UAAM,OAAOC,aAAAA,0BAA0B,MAAM,UAAU,MAAM,GAAG,QAAQ;AACxE,QAAI,UAAU,UAAa,SAAS,QAAW;AAC9C,YAAM,IAAIC,UAAAA,SAAS,qDAAqD;AAAA,QACvE,MAAM;AAAA,QACN,UAAUC,UAAAA,SAAS;AAAA,MAAA,CACnB;AAAA,IACF;AAEA,UAAM,KAAK,qBAAqB,OAAA,EAAS,cAAc,UAAU,EAAE,OAAO,MAAM;AAEhF,UAAM,UAAU,CAAC,UAAU,SAAY,WAAW,MAAM,SAAS,SAAY,SAAS,IAAI,EAAE,OAAO,CAAA,OAAM,OAAO,IAAI;AACpH,WAAO,KAAK,WAAW,QAAQ,KAAK,OAAO,CAAC,cAAc,QAAQ,GAAG;AACrE,WAAO;AAAA,MACN,EAAE,UAAU,OAAO,SAAS,MAAM,MAAM,QAAQ,KAAA;AAAA,MAChD,EAAE,OAAO,CAAA,OAAMC,aAAAA,UAAU,GAAG,QAAQ,GAAG,OAAO,CAAA,OAAM,GAAG,SAAA;AAAA,IAAS;AAAA,EAElE;AACD;;"}

package/dist/development/src/commands/tenant/person/TenantPersonUpdateCommand.js

@@ -0,0 +1,36 @@
+import { Command, CliError, ExitCode } from "@contember/cli-common";
+import { requireNonEmptyTenantName, humanText } from "../tenantOutput.js";
+class TenantPersonUpdateCommand extends Command {
+  constructor(tenantClientProvider) {
+    super();
+    this.tenantClientProvider = tenantClientProvider;
+  }
+  configure(configuration) {
+    configuration.description("Change the profile of a person. Only the fields you pass are changed; neither can be cleared.");
+    configuration.argument("id").description("Person id.");
+    configuration.option("email").valueRequired().description("New e-mail address.");
+    configuration.option("name").valueRequired().description("New display name.");
+  }
+  async execute(input, output) {
+    const personId = input.getArgument("id");
+    const email = input.getOption("email");
+    const name = requireNonEmptyTenantName(input.getOption("name"), "Person");
+    if (email === void 0 && name === void 0) {
+      throw new CliError("Nothing to update. Pass --email, --name, or both.", {
+        code: "NOTHING_TO_UPDATE",
+        exitCode: ExitCode.InputError
+      });
+    }
+    await this.tenantClientProvider.person().changeProfile(personId, { email, name });
+    const changed = [email !== void 0 ? "e-mail" : null, name !== void 0 ? "name" : null].filter((it) => it !== null);
+    output.info(`Updated ${changed.join(" and ")} of person ${personId}.`);
+    output.data(
+      { personId, email: email ?? null, name: name ?? null },
+      { human: (it) => humanText(it.personId), quiet: (it) => it.personId }
+    );
+  }
+}
+export {
+  TenantPersonUpdateCommand
+};
+//# sourceMappingURL=TenantPersonUpdateCommand.js.map

package/dist/development/src/commands/tenant/person/TenantPersonUpdateCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantPersonUpdateCommand.js","sources":["../../../../../../../packages/cli/src/commands/tenant/person/TenantPersonUpdateCommand.ts"],"sourcesContent":["import { CliError, Command, CommandConfiguration, ExitCode, Input, Output } from '@contember/cli-common'\nimport { TenantClientProvider } from '../../../lib/TenantClientProvider.js'\nimport { humanText, requireNonEmptyTenantName } from '../tenantOutput.js'\n\ntype Args = {\n\tid: string\n}\n\ntype Options = {\n\temail?: string\n\tname?: string\n}\n\ninterface UpdateResult {\n\tpersonId: string\n\t/** Null means the field was left alone — the API cannot clear an e-mail or a name. */\n\temail: string | null\n\tname: string | null\n}\n\nexport class TenantPersonUpdateCommand extends Command<Args, Options> {\n\tconstructor(\n\t\tprivate readonly tenantClientProvider: TenantClientProvider,\n\t) {\n\t\tsuper()\n\t}\n\n\tprotected configure(configuration: CommandConfiguration<Args, Options>): void {\n\t\tconfiguration.description('Change the profile of a person. Only the fields you pass are changed; neither can be cleared.')\n\t\tconfiguration.argument('id').description('Person id.')\n\t\tconfiguration.option('email').valueRequired().description('New e-mail address.')\n\t\tconfiguration.option('name').valueRequired().description('New display name.')\n\t}\n\n\tprotected async execute(input: Input<Args, Options>, output: Output): Promise<void> {\n\t\tconst personId = input.getArgument('id')\n\t\tconst email = input.getOption('email')\n\t\tconst name = requireNonEmptyTenantName(input.getOption('name'), 'Person')\n\t\tif (email === undefined && name === undefined) {\n\t\t\tthrow new CliError('Nothing to update. Pass --email, --name, or both.', {\n\t\t\t\tcode: 'NOTHING_TO_UPDATE',\n\t\t\t\texitCode: ExitCode.InputError,\n\t\t\t})\n\t\t}\n\n\t\tawait this.tenantClientProvider.person().changeProfile(personId, { email, name })\n\n\t\tconst changed = [email !== undefined ? 'e-mail' : null, name !== undefined ? 'name' : null].filter(it => it !== null)\n\t\toutput.info(`Updated ${changed.join(' and ')} of person ${personId}.`)\n\t\toutput.data<UpdateResult>(\n\t\t\t{ personId, email: email ?? null, name: name ?? null },\n\t\t\t{ human: it => humanText(it.personId), quiet: it => it.personId },\n\t\t)\n\t}\n}\n"],"names":[],"mappings":";;AAoBO,MAAM,kCAAkC,QAAuB;AAAA,EACrE,YACkB,sBAChB;AACD,UAAA;AAFiB,SAAA,uBAAA;AAAA,EAGlB;AAAA,EAEU,UAAU,eAA0D;AAC7E,kBAAc,YAAY,+FAA+F;AACzH,kBAAc,SAAS,IAAI,EAAE,YAAY,YAAY;AACrD,kBAAc,OAAO,OAAO,EAAE,cAAA,EAAgB,YAAY,qBAAqB;AAC/E,kBAAc,OAAO,MAAM,EAAE,cAAA,EAAgB,YAAY,mBAAmB;AAAA,EAC7E;AAAA,EAEA,MAAgB,QAAQ,OAA6B,QAA+B;AACnF,UAAM,WAAW,MAAM,YAAY,IAAI;AACvC,UAAM,QAAQ,MAAM,UAAU,OAAO;AACrC,UAAM,OAAO,0BAA0B,MAAM,UAAU,MAAM,GAAG,QAAQ;AACxE,QAAI,UAAU,UAAa,SAAS,QAAW;AAC9C,YAAM,IAAI,SAAS,qDAAqD;AAAA,QACvE,MAAM;AAAA,QACN,UAAU,SAAS;AAAA,MAAA,CACnB;AAAA,IACF;AAEA,UAAM,KAAK,qBAAqB,OAAA,EAAS,cAAc,UAAU,EAAE,OAAO,MAAM;AAEhF,UAAM,UAAU,CAAC,UAAU,SAAY,WAAW,MAAM,SAAS,SAAY,SAAS,IAAI,EAAE,OAAO,CAAA,OAAM,OAAO,IAAI;AACpH,WAAO,KAAK,WAAW,QAAQ,KAAK,OAAO,CAAC,cAAc,QAAQ,GAAG;AACrE,WAAO;AAAA,MACN,EAAE,UAAU,OAAO,SAAS,MAAM,MAAM,QAAQ,KAAA;AAAA,MAChD,EAAE,OAAO,CAAA,OAAM,UAAU,GAAG,QAAQ,GAAG,OAAO,CAAA,OAAM,GAAG,SAAA;AAAA,IAAS;AAAA,EAElE;AACD;"}

package/dist/development/src/commands/tenant/person/TenantSessionCreateCommand.cjs

@@ -0,0 +1,65 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const cliCommon = require("@contember/cli-common");
+const tenantOutput = require("../tenantOutput.cjs");
+class TenantSessionCreateCommand extends cliCommon.Command {
+  constructor(tenantClientProvider) {
+    super();
+    this.tenantClientProvider = tenantClientProvider;
+  }
+  configure(configuration) {
+    configuration.description("Create a one-time session token for exactly one person. Requires person.createSessionToken permission.");
+    configuration.option("email").valueRequired().description("Identify the person by e-mail. Not combinable with --person-id.");
+    configuration.option("person-id").valueRequired().description("Identify the person by id. Not combinable with --email.");
+    configuration.option("expiration").valueRequired().description("Session lifetime in minutes as a positive integer.");
+    configuration.option("trust-forwarded-client-info").valueNone().description(
+      "Trust forwarded client IP and user-agent headers for this session only when the tenant endpoint is behind a trusted proxy."
+    );
+  }
+  async execute(input, output) {
+    const email = input.getOption("email");
+    const personId = input.getOption("person-id");
+    if (email === void 0 === (personId === void 0)) {
+      throw new cliCommon.CliError("Pass exactly one of --email or --person-id.", {
+        code: "INVALID_PERSON_IDENTIFIER",
+        exitCode: cliCommon.ExitCode.InputError
+      });
+    }
+    if (email?.trim() === "" || personId?.trim() === "") {
+      throw new cliCommon.CliError("The value passed to --email or --person-id must not be empty.", {
+        code: "INVALID_PERSON_IDENTIFIER",
+        exitCode: cliCommon.ExitCode.InputError
+      });
+    }
+    const expiration = parsePositiveInteger(input.getOption("expiration"), "expiration");
+    const trustForwardedClientInfo = input.getOption("trust-forwarded-client-info") === true;
+    const result = await this.tenantClientProvider.person().createSessionToken({
+      email,
+      personId,
+      expiration,
+      options: trustForwardedClientInfo ? { trustForwardedClientInfo: true } : void 0
+    });
+    const token = tenantOutput.assertGeneratedTenantToken(result.token, "session");
+    output.info(`Created a session token for person ${result.personId}. The token is shown once; store it securely.`);
+    output.data(result, {
+      human: (it) => `Session token for person ${tenantOutput.humanText(it.personId)}:
+${token}`,
+      quiet: () => token
+    });
+  }
+}
+const parsePositiveInteger = (value, option) => {
+  if (value === void 0) {
+    return void 0;
+  }
+  const parsed = Number(value);
+  if (!Number.isInteger(parsed) || parsed <= 0 || parsed > 2147483647) {
+    throw new cliCommon.CliError(`--${option} must be a positive GraphQL Int (maximum 2147483647).`, {
+      code: "INVALID_OPTION_VALUE",
+      exitCode: cliCommon.ExitCode.InputError
+    });
+  }
+  return parsed;
+};
+exports.TenantSessionCreateCommand = TenantSessionCreateCommand;
+//# sourceMappingURL=TenantSessionCreateCommand.cjs.map

package/dist/development/src/commands/tenant/person/TenantSessionCreateCommand.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantSessionCreateCommand.cjs","sources":["../../../../../../../packages/cli/src/commands/tenant/person/TenantSessionCreateCommand.ts"],"sourcesContent":["import { CliError, Command, CommandConfiguration, ExitCode, Input, Output } from '@contember/cli-common'\nimport { TenantClientProvider } from '../../../lib/TenantClientProvider.js'\nimport type { TenantCreatedSessionToken } from '../../../lib/tenant/clients/TenantPersonClient.js'\nimport { assertGeneratedTenantToken, humanText } from '../tenantOutput.js'\n\ntype Args = {}\n\ntype Options = {\n\temail?: string\n\t['person-id']?: string\n\texpiration?: string\n\t['trust-forwarded-client-info']?: boolean\n}\n\n/** `tenant session create` */\nexport class TenantSessionCreateCommand extends Command<Args, Options> {\n\tconstructor(\n\t\tprivate readonly tenantClientProvider: TenantClientProvider,\n\t) {\n\t\tsuper()\n\t}\n\n\tprotected configure(configuration: CommandConfiguration<Args, Options>): void {\n\t\tconfiguration.description('Create a one-time session token for exactly one person. Requires person.createSessionToken permission.')\n\t\tconfiguration.option('email').valueRequired().description('Identify the person by e-mail. Not combinable with --person-id.')\n\t\tconfiguration.option('person-id').valueRequired().description('Identify the person by id. Not combinable with --email.')\n\t\tconfiguration.option('expiration').valueRequired().description('Session lifetime in minutes as a positive integer.')\n\t\tconfiguration.option('trust-forwarded-client-info').valueNone().description(\n\t\t\t'Trust forwarded client IP and user-agent headers for this session only when the tenant endpoint is behind a trusted proxy.',\n\t\t)\n\t}\n\n\tprotected async execute(input: Input<Args, Options>, output: Output): Promise<void> {\n\t\tconst email = input.getOption('email')\n\t\tconst personId = input.getOption('person-id')\n\t\tif ((email === undefined) === (personId === undefined)) {\n\t\t\tthrow new CliError('Pass exactly one of --email or --person-id.', {\n\t\t\t\tcode: 'INVALID_PERSON_IDENTIFIER',\n\t\t\t\texitCode: ExitCode.InputError,\n\t\t\t})\n\t\t}\n\t\tif (email?.trim() === '' || personId?.trim() === '') {\n\t\t\tthrow new CliError('The value passed to --email or --person-id must not be empty.', {\n\t\t\t\tcode: 'INVALID_PERSON_IDENTIFIER',\n\t\t\t\texitCode: ExitCode.InputError,\n\t\t\t})\n\t\t}\n\t\tconst expiration = parsePositiveInteger(input.getOption('expiration'), 'expiration')\n\t\tconst trustForwardedClientInfo = input.getOption('trust-forwarded-client-info') === true\n\n\t\tconst result = await this.tenantClientProvider.person().createSessionToken({\n\t\t\temail,\n\t\t\tpersonId,\n\t\t\texpiration,\n\t\t\toptions: trustForwardedClientInfo ? { trustForwardedClientInfo: true } : undefined,\n\t\t})\n\t\tconst token = assertGeneratedTenantToken(result.token, 'session')\n\n\t\toutput.info(`Created a session token for person ${result.personId}. The token is shown once; store it securely.`)\n\t\toutput.data<TenantCreatedSessionToken>(result, {\n\t\t\thuman: it => `Session token for person ${humanText(it.personId)}:\\n${token}`,\n\t\t\tquiet: () => token,\n\t\t})\n\t}\n}\n\nconst parsePositiveInteger = (value: string | undefined, option: string): number | undefined => {\n\tif (value === undefined) {\n\t\treturn undefined\n\t}\n\tconst parsed = Number(value)\n\tif (!Number.isInteger(parsed) || parsed <= 0 || parsed > 2_147_483_647) {\n\t\tthrow new CliError(`--${option} must be a positive GraphQL Int (maximum 2147483647).`, {\n\t\t\tcode: 'INVALID_OPTION_VALUE',\n\t\t\texitCode: ExitCode.InputError,\n\t\t})\n\t}\n\treturn parsed\n}\n"],"names":["Command","CliError","ExitCode","assertGeneratedTenantToken","humanText"],"mappings":";;;;AAeO,MAAM,mCAAmCA,UAAAA,QAAuB;AAAA,EACtE,YACkB,sBAChB;AACD,UAAA;AAFiB,SAAA,uBAAA;AAAA,EAGlB;AAAA,EAEU,UAAU,eAA0D;AAC7E,kBAAc,YAAY,wGAAwG;AAClI,kBAAc,OAAO,OAAO,EAAE,cAAA,EAAgB,YAAY,iEAAiE;AAC3H,kBAAc,OAAO,WAAW,EAAE,cAAA,EAAgB,YAAY,yDAAyD;AACvH,kBAAc,OAAO,YAAY,EAAE,cAAA,EAAgB,YAAY,oDAAoD;AACnH,kBAAc,OAAO,6BAA6B,EAAE,UAAA,EAAY;AAAA,MAC/D;AAAA,IAAA;AAAA,EAEF;AAAA,EAEA,MAAgB,QAAQ,OAA6B,QAA+B;AACnF,UAAM,QAAQ,MAAM,UAAU,OAAO;AACrC,UAAM,WAAW,MAAM,UAAU,WAAW;AAC5C,QAAK,UAAU,YAAgB,aAAa,SAAY;AACvD,YAAM,IAAIC,UAAAA,SAAS,+CAA+C;AAAA,QACjE,MAAM;AAAA,QACN,UAAUC,UAAAA,SAAS;AAAA,MAAA,CACnB;AAAA,IACF;AACA,QAAI,OAAO,WAAW,MAAM,UAAU,KAAA,MAAW,IAAI;AACpD,YAAM,IAAID,UAAAA,SAAS,iEAAiE;AAAA,QACnF,MAAM;AAAA,QACN,UAAUC,UAAAA,SAAS;AAAA,MAAA,CACnB;AAAA,IACF;AACA,UAAM,aAAa,qBAAqB,MAAM,UAAU,YAAY,GAAG,YAAY;AACnF,UAAM,2BAA2B,MAAM,UAAU,6BAA6B,MAAM;AAEpF,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAA,EAAS,mBAAmB;AAAA,MAC1E;AAAA,MACA;AAAA,MACA;AAAA,MACA,SAAS,2BAA2B,EAAE,0BAA0B,SAAS;AAAA,IAAA,CACzE;AACD,UAAM,QAAQC,aAAAA,2BAA2B,OAAO,OAAO,SAAS;AAEhE,WAAO,KAAK,sCAAsC,OAAO,QAAQ,+CAA+C;AAChH,WAAO,KAAgC,QAAQ;AAAA,MAC9C,OAAO,CAAA,OAAM,4BAA4BC,aAAAA,UAAU,GAAG,QAAQ,CAAC;AAAA,EAAM,KAAK;AAAA,MAC1E,OAAO,MAAM;AAAA,IAAA,CACb;AAAA,EACF;AACD;AAEA,MAAM,uBAAuB,CAAC,OAA2B,WAAuC;AAC/F,MAAI,UAAU,QAAW;AACxB,WAAO;AAAA,EACR;AACA,QAAM,SAAS,OAAO,KAAK;AAC3B,MAAI,CAAC,OAAO,UAAU,MAAM,KAAK,UAAU,KAAK,SAAS,YAAe;AACvE,UAAM,IAAIH,UAAAA,SAAS,KAAK,MAAM,yDAAyD;AAAA,MACtF,MAAM;AAAA,MACN,UAAUC,UAAAA,SAAS;AAAA,IAAA,CACnB;AAAA,EACF;AACA,SAAO;AACR;;"}

package/dist/development/src/commands/tenant/person/TenantSessionCreateCommand.js

@@ -0,0 +1,65 @@
+import { Command, CliError, ExitCode } from "@contember/cli-common";
+import { assertGeneratedTenantToken, humanText } from "../tenantOutput.js";
+class TenantSessionCreateCommand extends Command {
+  constructor(tenantClientProvider) {
+    super();
+    this.tenantClientProvider = tenantClientProvider;
+  }
+  configure(configuration) {
+    configuration.description("Create a one-time session token for exactly one person. Requires person.createSessionToken permission.");
+    configuration.option("email").valueRequired().description("Identify the person by e-mail. Not combinable with --person-id.");
+    configuration.option("person-id").valueRequired().description("Identify the person by id. Not combinable with --email.");
+    configuration.option("expiration").valueRequired().description("Session lifetime in minutes as a positive integer.");
+    configuration.option("trust-forwarded-client-info").valueNone().description(
+      "Trust forwarded client IP and user-agent headers for this session only when the tenant endpoint is behind a trusted proxy."
+    );
+  }
+  async execute(input, output) {
+    const email = input.getOption("email");
+    const personId = input.getOption("person-id");
+    if (email === void 0 === (personId === void 0)) {
+      throw new CliError("Pass exactly one of --email or --person-id.", {
+        code: "INVALID_PERSON_IDENTIFIER",
+        exitCode: ExitCode.InputError
+      });
+    }
+    if (email?.trim() === "" || personId?.trim() === "") {
+      throw new CliError("The value passed to --email or --person-id must not be empty.", {
+        code: "INVALID_PERSON_IDENTIFIER",
+        exitCode: ExitCode.InputError
+      });
+    }
+    const expiration = parsePositiveInteger(input.getOption("expiration"), "expiration");
+    const trustForwardedClientInfo = input.getOption("trust-forwarded-client-info") === true;
+    const result = await this.tenantClientProvider.person().createSessionToken({
+      email,
+      personId,
+      expiration,
+      options: trustForwardedClientInfo ? { trustForwardedClientInfo: true } : void 0
+    });
+    const token = assertGeneratedTenantToken(result.token, "session");
+    output.info(`Created a session token for person ${result.personId}. The token is shown once; store it securely.`);
+    output.data(result, {
+      human: (it) => `Session token for person ${humanText(it.personId)}:
+${token}`,
+      quiet: () => token
+    });
+  }
+}
+const parsePositiveInteger = (value, option) => {
+  if (value === void 0) {
+    return void 0;
+  }
+  const parsed = Number(value);
+  if (!Number.isInteger(parsed) || parsed <= 0 || parsed > 2147483647) {
+    throw new CliError(`--${option} must be a positive GraphQL Int (maximum 2147483647).`, {
+      code: "INVALID_OPTION_VALUE",
+      exitCode: ExitCode.InputError
+    });
+  }
+  return parsed;
+};
+export {
+  TenantSessionCreateCommand
+};
+//# sourceMappingURL=TenantSessionCreateCommand.js.map

package/dist/development/src/commands/tenant/person/TenantSessionCreateCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantSessionCreateCommand.js","sources":["../../../../../../../packages/cli/src/commands/tenant/person/TenantSessionCreateCommand.ts"],"sourcesContent":["import { CliError, Command, CommandConfiguration, ExitCode, Input, Output } from '@contember/cli-common'\nimport { TenantClientProvider } from '../../../lib/TenantClientProvider.js'\nimport type { TenantCreatedSessionToken } from '../../../lib/tenant/clients/TenantPersonClient.js'\nimport { assertGeneratedTenantToken, humanText } from '../tenantOutput.js'\n\ntype Args = {}\n\ntype Options = {\n\temail?: string\n\t['person-id']?: string\n\texpiration?: string\n\t['trust-forwarded-client-info']?: boolean\n}\n\n/** `tenant session create` */\nexport class TenantSessionCreateCommand extends Command<Args, Options> {\n\tconstructor(\n\t\tprivate readonly tenantClientProvider: TenantClientProvider,\n\t) {\n\t\tsuper()\n\t}\n\n\tprotected configure(configuration: CommandConfiguration<Args, Options>): void {\n\t\tconfiguration.description('Create a one-time session token for exactly one person. Requires person.createSessionToken permission.')\n\t\tconfiguration.option('email').valueRequired().description('Identify the person by e-mail. Not combinable with --person-id.')\n\t\tconfiguration.option('person-id').valueRequired().description('Identify the person by id. Not combinable with --email.')\n\t\tconfiguration.option('expiration').valueRequired().description('Session lifetime in minutes as a positive integer.')\n\t\tconfiguration.option('trust-forwarded-client-info').valueNone().description(\n\t\t\t'Trust forwarded client IP and user-agent headers for this session only when the tenant endpoint is behind a trusted proxy.',\n\t\t)\n\t}\n\n\tprotected async execute(input: Input<Args, Options>, output: Output): Promise<void> {\n\t\tconst email = input.getOption('email')\n\t\tconst personId = input.getOption('person-id')\n\t\tif ((email === undefined) === (personId === undefined)) {\n\t\t\tthrow new CliError('Pass exactly one of --email or --person-id.', {\n\t\t\t\tcode: 'INVALID_PERSON_IDENTIFIER',\n\t\t\t\texitCode: ExitCode.InputError,\n\t\t\t})\n\t\t}\n\t\tif (email?.trim() === '' || personId?.trim() === '') {\n\t\t\tthrow new CliError('The value passed to --email or --person-id must not be empty.', {\n\t\t\t\tcode: 'INVALID_PERSON_IDENTIFIER',\n\t\t\t\texitCode: ExitCode.InputError,\n\t\t\t})\n\t\t}\n\t\tconst expiration = parsePositiveInteger(input.getOption('expiration'), 'expiration')\n\t\tconst trustForwardedClientInfo = input.getOption('trust-forwarded-client-info') === true\n\n\t\tconst result = await this.tenantClientProvider.person().createSessionToken({\n\t\t\temail,\n\t\t\tpersonId,\n\t\t\texpiration,\n\t\t\toptions: trustForwardedClientInfo ? { trustForwardedClientInfo: true } : undefined,\n\t\t})\n\t\tconst token = assertGeneratedTenantToken(result.token, 'session')\n\n\t\toutput.info(`Created a session token for person ${result.personId}. The token is shown once; store it securely.`)\n\t\toutput.data<TenantCreatedSessionToken>(result, {\n\t\t\thuman: it => `Session token for person ${humanText(it.personId)}:\\n${token}`,\n\t\t\tquiet: () => token,\n\t\t})\n\t}\n}\n\nconst parsePositiveInteger = (value: string | undefined, option: string): number | undefined => {\n\tif (value === undefined) {\n\t\treturn undefined\n\t}\n\tconst parsed = Number(value)\n\tif (!Number.isInteger(parsed) || parsed <= 0 || parsed > 2_147_483_647) {\n\t\tthrow new CliError(`--${option} must be a positive GraphQL Int (maximum 2147483647).`, {\n\t\t\tcode: 'INVALID_OPTION_VALUE',\n\t\t\texitCode: ExitCode.InputError,\n\t\t})\n\t}\n\treturn parsed\n}\n"],"names":[],"mappings":";;AAeO,MAAM,mCAAmC,QAAuB;AAAA,EACtE,YACkB,sBAChB;AACD,UAAA;AAFiB,SAAA,uBAAA;AAAA,EAGlB;AAAA,EAEU,UAAU,eAA0D;AAC7E,kBAAc,YAAY,wGAAwG;AAClI,kBAAc,OAAO,OAAO,EAAE,cAAA,EAAgB,YAAY,iEAAiE;AAC3H,kBAAc,OAAO,WAAW,EAAE,cAAA,EAAgB,YAAY,yDAAyD;AACvH,kBAAc,OAAO,YAAY,EAAE,cAAA,EAAgB,YAAY,oDAAoD;AACnH,kBAAc,OAAO,6BAA6B,EAAE,UAAA,EAAY;AAAA,MAC/D;AAAA,IAAA;AAAA,EAEF;AAAA,EAEA,MAAgB,QAAQ,OAA6B,QAA+B;AACnF,UAAM,QAAQ,MAAM,UAAU,OAAO;AACrC,UAAM,WAAW,MAAM,UAAU,WAAW;AAC5C,QAAK,UAAU,YAAgB,aAAa,SAAY;AACvD,YAAM,IAAI,SAAS,+CAA+C;AAAA,QACjE,MAAM;AAAA,QACN,UAAU,SAAS;AAAA,MAAA,CACnB;AAAA,IACF;AACA,QAAI,OAAO,WAAW,MAAM,UAAU,KAAA,MAAW,IAAI;AACpD,YAAM,IAAI,SAAS,iEAAiE;AAAA,QACnF,MAAM;AAAA,QACN,UAAU,SAAS;AAAA,MAAA,CACnB;AAAA,IACF;AACA,UAAM,aAAa,qBAAqB,MAAM,UAAU,YAAY,GAAG,YAAY;AACnF,UAAM,2BAA2B,MAAM,UAAU,6BAA6B,MAAM;AAEpF,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAA,EAAS,mBAAmB;AAAA,MAC1E;AAAA,MACA;AAAA,MACA;AAAA,MACA,SAAS,2BAA2B,EAAE,0BAA0B,SAAS;AAAA,IAAA,CACzE;AACD,UAAM,QAAQ,2BAA2B,OAAO,OAAO,SAAS;AAEhE,WAAO,KAAK,sCAAsC,OAAO,QAAQ,+CAA+C;AAChH,WAAO,KAAgC,QAAQ;AAAA,MAC9C,OAAO,CAAA,OAAM,4BAA4B,UAAU,GAAG,QAAQ,CAAC;AAAA,EAAM,KAAK;AAAA,MAC1E,OAAO,MAAM;AAAA,IAAA,CACb;AAAA,EACF;AACD;AAEA,MAAM,uBAAuB,CAAC,OAA2B,WAAuC;AAC/F,MAAI,UAAU,QAAW;AACxB,WAAO;AAAA,EACR;AACA,QAAM,SAAS,OAAO,KAAK;AAC3B,MAAI,CAAC,OAAO,UAAU,MAAM,KAAK,UAAU,KAAK,SAAS,YAAe;AACvE,UAAM,IAAI,SAAS,KAAK,MAAM,yDAAyD;AAAA,MACtF,MAAM;AAAA,MACN,UAAU,SAAS;AAAA,IAAA,CACnB;AAAA,EACF;AACA,SAAO;AACR;"}

package/dist/development/src/commands/tenant/person/personInput.cjs

@@ -0,0 +1,77 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const cliCommon = require("@contember/cli-common");
+const value = require("../../../lib/tenant/input/value.cjs");
+const resolveSecret = async (sources, readStdin) => {
+  const given = sources.flatMap((source) => [
+    ...source.stdin ? [{ source, flag: `--${source.name}-stdin` }] : [],
+    ...source.env !== void 0 ? [{ source, flag: `--${source.name}-env` }] : []
+  ]);
+  if (given.length > 1) {
+    throw new cliCommon.CliError(`Pass only one of ${given.map((it) => it.flag).join(", ")}.`, {
+      code: "AMBIGUOUS_SECRET_SOURCE",
+      exitCode: cliCommon.ExitCode.InputError
+    });
+  }
+  const chosen = given[0];
+  if (chosen === void 0) {
+    return void 0;
+  }
+  const value2 = chosen.source.env !== void 0 ? readSecretEnv(chosen.source.env) : (await readStdin()).replace(/\r?\n$/, "");
+  if (value2 === "") {
+    throw new cliCommon.CliError(`${chosen.flag} resolved to an empty value.`, { code: "EMPTY_SECRET", exitCode: cliCommon.ExitCode.InputError });
+  }
+  return { name: chosen.source.name, value: value2 };
+};
+const readSecretEnv = (name) => {
+  const value2 = process.env[name];
+  if (value2 === void 0) {
+    throw new cliCommon.CliError(`Environment variable ${name} is not set.`, { code: "SECRET_ENV_NOT_SET", exitCode: cliCommon.ExitCode.InputError });
+  }
+  return value2;
+};
+const assertBcryptHash = (hash) => {
+  if (!hash.startsWith("$2b$")) {
+    throw new cliCommon.CliError("Invalid password hash: the tenant API accepts bcrypt $2b$ hashes only.", {
+      code: "INVALID_PASSWORD_HASH",
+      exitCode: cliCommon.ExitCode.InputError
+    });
+  }
+};
+const configureCaptchaTokenOptions = (configuration) => {
+  configuration.option("captcha-token").valueRequired().description(
+    "Captcha token. Visible in the shell history and process list; prefer --captcha-token-env or --captcha-token-stdin."
+  );
+  configuration.option("captcha-token-env").valueRequired().description("Read the captcha token from the named environment variable.");
+  configuration.option("captcha-token-stdin").valueNone().description("Read the captcha token from stdin.");
+};
+const resolveCaptchaToken = async (options, readStdin, readEnvironment = (name) => process.env[name]) => {
+  const sources = [];
+  if (options["captcha-token"] !== void 0) {
+    sources.push(value.literalInput("captcha-token", "--captcha-token", options["captcha-token"]));
+  }
+  if (options["captcha-token-env"] !== void 0) {
+    sources.push(value.environmentInput("captcha-token", "--captcha-token-env", options["captcha-token-env"]));
+  }
+  if (options["captcha-token-stdin"] === true) {
+    sources.push(value.stdinInput("captcha-token", "--captcha-token-stdin"));
+  }
+  const resolved = await value.resolveOptionalTenantInput(sources, { label: "captcha token" }, { readStdin, readEnvironment });
+  if (resolved === void 0) {
+    return void 0;
+  }
+  const value$1 = resolved.kind === "stdin" ? removeOneTrailingLineEnding(resolved.value) : resolved.value;
+  if (value$1 === "") {
+    throw new cliCommon.CliError("The selected captcha token source resolved to an empty value.", {
+      code: "EMPTY_INPUT_VALUE",
+      exitCode: cliCommon.ExitCode.InputError
+    });
+  }
+  return value$1;
+};
+const removeOneTrailingLineEnding = (value2) => value2.replace(/(?:\r\n|\n)$/, "");
+exports.assertBcryptHash = assertBcryptHash;
+exports.configureCaptchaTokenOptions = configureCaptchaTokenOptions;
+exports.resolveCaptchaToken = resolveCaptchaToken;
+exports.resolveSecret = resolveSecret;
+//# sourceMappingURL=personInput.cjs.map

package/dist/development/src/commands/tenant/person/personInput.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"personInput.cjs","sources":["../../../../../../../packages/cli/src/commands/tenant/person/personInput.ts"],"sourcesContent":["import { CliError, ExitCode } from '@contember/cli-common'\nimport type { StdinReader } from '../../../lib/tenant/stdin.js'\nimport { environmentInput, literalInput, resolveOptionalTenantInput, stdinInput, type TenantInputSource } from '../../../lib/tenant/input/index.js'\n\n/**\n * One way of passing a secret. `name` is the option prefix, so `password` covers `--password-stdin`\n * and `--password-env`. A secret is never a plain option value — argv lands in the shell history and\n * in `ps` output of every user on the machine.\n */\nexport interface SecretSource {\n\treadonly name: string\n\treadonly stdin: boolean\n\treadonly env: string | undefined\n}\n\nexport interface ResolvedSecret {\n\t/** The `name` of the {@link SecretSource} the value came from. */\n\treadonly name: string\n\treadonly value: string\n}\n\n/** Resolves at most one of the offered secret sources. Returns undefined when the caller passed none. */\nexport const resolveSecret = async (sources: readonly SecretSource[], readStdin: StdinReader): Promise<ResolvedSecret | undefined> => {\n\tconst given = sources.flatMap(source => [\n\t\t...(source.stdin ? [{ source, flag: `--${source.name}-stdin` }] : []),\n\t\t...(source.env !== undefined ? [{ source, flag: `--${source.name}-env` }] : []),\n\t])\n\tif (given.length > 1) {\n\t\tthrow new CliError(`Pass only one of ${given.map(it => it.flag).join(', ')}.`, {\n\t\t\tcode: 'AMBIGUOUS_SECRET_SOURCE',\n\t\t\texitCode: ExitCode.InputError,\n\t\t})\n\t}\n\tconst chosen = given[0]\n\tif (chosen === undefined) {\n\t\treturn undefined\n\t}\n\t// the trailing newline `echo` adds is never part of the secret\n\tconst value = chosen.source.env !== undefined ? readSecretEnv(chosen.source.env) : (await readStdin()).replace(/\\r?\\n$/, '')\n\tif (value === '') {\n\t\tthrow new CliError(`${chosen.flag} resolved to an empty value.`, { code: 'EMPTY_SECRET', exitCode: ExitCode.InputError })\n\t}\n\treturn { name: chosen.source.name, value }\n}\n\nconst readSecretEnv = (name: string): string => {\n\tconst value = process.env[name]\n\tif (value === undefined) {\n\t\tthrow new CliError(`Environment variable ${name} is not set.`, { code: 'SECRET_ENV_NOT_SET', exitCode: ExitCode.InputError })\n\t}\n\treturn value\n}\n\n/** The tenant API accepts `$2b$` bcrypt hashes only — rejecting here avoids spending a rate-limit slot on a doomed call. */\nexport const assertBcryptHash = (hash: string): void => {\n\tif (!hash.startsWith('$2b$')) {\n\t\tthrow new CliError('Invalid password hash: the tenant API accepts bcrypt $2b$ hashes only.', {\n\t\t\tcode: 'INVALID_PASSWORD_HASH',\n\t\t\texitCode: ExitCode.InputError,\n\t\t})\n\t}\n}\n\nexport type CaptchaTokenOptions = {\n\treadonly ['captcha-token']?: string\n\treadonly ['captcha-token-env']?: string\n\treadonly ['captcha-token-stdin']?: boolean\n}\n\nexport const configureCaptchaTokenOptions = (configuration: {\n\toption(name: keyof CaptchaTokenOptions): {\n\t\tvalueNone(): { description(description: string): unknown }\n\t\tvalueRequired(): { description(description: string): unknown }\n\t}\n}): void => {\n\tconfiguration.option('captcha-token').valueRequired().description(\n\t\t'Captcha token. Visible in the shell history and process list; prefer --captcha-token-env or --captcha-token-stdin.',\n\t)\n\tconfiguration.option('captcha-token-env').valueRequired().description('Read the captcha token from the named environment variable.')\n\tconfiguration.option('captcha-token-stdin').valueNone().description('Read the captcha token from stdin.')\n}\n\nexport const resolveCaptchaToken = async (\n\toptions: CaptchaTokenOptions,\n\treadStdin: StdinReader,\n\treadEnvironment: (name: string) => string | undefined = name => process.env[name],\n): Promise<string | undefined> => {\n\tconst sources: TenantInputSource<'captcha-token'>[] = []\n\tif (options['captcha-token'] !== undefined) {\n\t\tsources.push(literalInput('captcha-token', '--captcha-token', options['captcha-token']))\n\t}\n\tif (options['captcha-token-env'] !== undefined) {\n\t\tsources.push(environmentInput('captcha-token', '--captcha-token-env', options['captcha-token-env']))\n\t}\n\tif (options['captcha-token-stdin'] === true) {\n\t\tsources.push(stdinInput('captcha-token', '--captcha-token-stdin'))\n\t}\n\tconst resolved = await resolveOptionalTenantInput(sources, { label: 'captcha token' }, { readStdin, readEnvironment })\n\tif (resolved === undefined) {\n\t\treturn undefined\n\t}\n\tconst value = resolved.kind === 'stdin' ? removeOneTrailingLineEnding(resolved.value) : resolved.value\n\tif (value === '') {\n\t\tthrow new CliError('The selected captcha token source resolved to an empty value.', {\n\t\t\tcode: 'EMPTY_INPUT_VALUE',\n\t\t\texitCode: ExitCode.InputError,\n\t\t})\n\t}\n\treturn value\n}\n\nconst removeOneTrailingLineEnding = (value: string): string => value.replace(/(?:\\r\\n|\\n)$/, '')\n"],"names":["CliError","ExitCode","value","literalInput","environmentInput","stdinInput","resolveOptionalTenantInput"],"mappings":";;;;AAsBO,MAAM,gBAAgB,OAAO,SAAkC,cAAgE;AACrI,QAAM,QAAQ,QAAQ,QAAQ,CAAA,WAAU;AAAA,IACvC,GAAI,OAAO,QAAQ,CAAC,EAAE,QAAQ,MAAM,KAAK,OAAO,IAAI,SAAA,CAAU,IAAI,CAAA;AAAA,IAClE,GAAI,OAAO,QAAQ,SAAY,CAAC,EAAE,QAAQ,MAAM,KAAK,OAAO,IAAI,OAAA,CAAQ,IAAI,CAAA;AAAA,EAAC,CAC7E;AACD,MAAI,MAAM,SAAS,GAAG;AACrB,UAAM,IAAIA,UAAAA,SAAS,oBAAoB,MAAM,IAAI,CAAA,OAAM,GAAG,IAAI,EAAE,KAAK,IAAI,CAAC,KAAK;AAAA,MAC9E,MAAM;AAAA,MACN,UAAUC,UAAAA,SAAS;AAAA,IAAA,CACnB;AAAA,EACF;AACA,QAAM,SAAS,MAAM,CAAC;AACtB,MAAI,WAAW,QAAW;AACzB,WAAO;AAAA,EACR;AAEA,QAAMC,SAAQ,OAAO,OAAO,QAAQ,SAAY,cAAc,OAAO,OAAO,GAAG,KAAK,MAAM,UAAA,GAAa,QAAQ,UAAU,EAAE;AAC3H,MAAIA,WAAU,IAAI;AACjB,UAAM,IAAIF,UAAAA,SAAS,GAAG,OAAO,IAAI,gCAAgC,EAAE,MAAM,gBAAgB,UAAUC,UAAAA,SAAS,WAAA,CAAY;AAAA,EACzH;AACA,SAAO,EAAE,MAAM,OAAO,OAAO,MAAM,OAAAC,OAAA;AACpC;AAEA,MAAM,gBAAgB,CAAC,SAAyB;AAC/C,QAAMA,SAAQ,QAAQ,IAAI,IAAI;AAC9B,MAAIA,WAAU,QAAW;AACxB,UAAM,IAAIF,UAAAA,SAAS,wBAAwB,IAAI,gBAAgB,EAAE,MAAM,sBAAsB,UAAUC,UAAAA,SAAS,WAAA,CAAY;AAAA,EAC7H;AACA,SAAOC;AACR;AAGO,MAAM,mBAAmB,CAAC,SAAuB;AACvD,MAAI,CAAC,KAAK,WAAW,MAAM,GAAG;AAC7B,UAAM,IAAIF,UAAAA,SAAS,0EAA0E;AAAA,MAC5F,MAAM;AAAA,MACN,UAAUC,UAAAA,SAAS;AAAA,IAAA,CACnB;AAAA,EACF;AACD;AAQO,MAAM,+BAA+B,CAAC,kBAKjC;AACX,gBAAc,OAAO,eAAe,EAAE,cAAA,EAAgB;AAAA,IACrD;AAAA,EAAA;AAED,gBAAc,OAAO,mBAAmB,EAAE,cAAA,EAAgB,YAAY,6DAA6D;AACnI,gBAAc,OAAO,qBAAqB,EAAE,UAAA,EAAY,YAAY,oCAAoC;AACzG;AAEO,MAAM,sBAAsB,OAClC,SACA,WACA,kBAAwD,CAAA,SAAQ,QAAQ,IAAI,IAAI,MAC/C;AACjC,QAAM,UAAgD,CAAA;AACtD,MAAI,QAAQ,eAAe,MAAM,QAAW;AAC3C,YAAQ,KAAKE,mBAAa,iBAAiB,mBAAmB,QAAQ,eAAe,CAAC,CAAC;AAAA,EACxF;AACA,MAAI,QAAQ,mBAAmB,MAAM,QAAW;AAC/C,YAAQ,KAAKC,uBAAiB,iBAAiB,uBAAuB,QAAQ,mBAAmB,CAAC,CAAC;AAAA,EACpG;AACA,MAAI,QAAQ,qBAAqB,MAAM,MAAM;AAC5C,YAAQ,KAAKC,MAAAA,WAAW,iBAAiB,uBAAuB,CAAC;AAAA,EAClE;AACA,QAAM,WAAW,MAAMC,MAAAA,2BAA2B,SAAS,EAAE,OAAO,mBAAmB,EAAE,WAAW,iBAAiB;AACrH,MAAI,aAAa,QAAW;AAC3B,WAAO;AAAA,EACR;AACA,QAAMJ,UAAQ,SAAS,SAAS,UAAU,4BAA4B,SAAS,KAAK,IAAI,SAAS;AACjG,MAAIA,YAAU,IAAI;AACjB,UAAM,IAAIF,UAAAA,SAAS,iEAAiE;AAAA,MACnF,MAAM;AAAA,MACN,UAAUC,UAAAA,SAAS;AAAA,IAAA,CACnB;AAAA,EACF;AACA,SAAOC;AACR;AAEA,MAAM,8BAA8B,CAACA,WAA0BA,OAAM,QAAQ,gBAAgB,EAAE;;;;;"}

package/dist/development/src/commands/tenant/person/personInput.js

@@ -0,0 +1,77 @@
+import { CliError, ExitCode } from "@contember/cli-common";
+import { literalInput, environmentInput, stdinInput, resolveOptionalTenantInput } from "../../../lib/tenant/input/value.js";
+const resolveSecret = async (sources, readStdin) => {
+  const given = sources.flatMap((source) => [
+    ...source.stdin ? [{ source, flag: `--${source.name}-stdin` }] : [],
+    ...source.env !== void 0 ? [{ source, flag: `--${source.name}-env` }] : []
+  ]);
+  if (given.length > 1) {
+    throw new CliError(`Pass only one of ${given.map((it) => it.flag).join(", ")}.`, {
+      code: "AMBIGUOUS_SECRET_SOURCE",
+      exitCode: ExitCode.InputError
+    });
+  }
+  const chosen = given[0];
+  if (chosen === void 0) {
+    return void 0;
+  }
+  const value = chosen.source.env !== void 0 ? readSecretEnv(chosen.source.env) : (await readStdin()).replace(/\r?\n$/, "");
+  if (value === "") {
+    throw new CliError(`${chosen.flag} resolved to an empty value.`, { code: "EMPTY_SECRET", exitCode: ExitCode.InputError });
+  }
+  return { name: chosen.source.name, value };
+};
+const readSecretEnv = (name) => {
+  const value = process.env[name];
+  if (value === void 0) {
+    throw new CliError(`Environment variable ${name} is not set.`, { code: "SECRET_ENV_NOT_SET", exitCode: ExitCode.InputError });
+  }
+  return value;
+};
+const assertBcryptHash = (hash) => {
+  if (!hash.startsWith("$2b$")) {
+    throw new CliError("Invalid password hash: the tenant API accepts bcrypt $2b$ hashes only.", {
+      code: "INVALID_PASSWORD_HASH",
+      exitCode: ExitCode.InputError
+    });
+  }
+};
+const configureCaptchaTokenOptions = (configuration) => {
+  configuration.option("captcha-token").valueRequired().description(
+    "Captcha token. Visible in the shell history and process list; prefer --captcha-token-env or --captcha-token-stdin."
+  );
+  configuration.option("captcha-token-env").valueRequired().description("Read the captcha token from the named environment variable.");
+  configuration.option("captcha-token-stdin").valueNone().description("Read the captcha token from stdin.");
+};
+const resolveCaptchaToken = async (options, readStdin, readEnvironment = (name) => process.env[name]) => {
+  const sources = [];
+  if (options["captcha-token"] !== void 0) {
+    sources.push(literalInput("captcha-token", "--captcha-token", options["captcha-token"]));
+  }
+  if (options["captcha-token-env"] !== void 0) {
+    sources.push(environmentInput("captcha-token", "--captcha-token-env", options["captcha-token-env"]));
+  }
+  if (options["captcha-token-stdin"] === true) {
+    sources.push(stdinInput("captcha-token", "--captcha-token-stdin"));
+  }
+  const resolved = await resolveOptionalTenantInput(sources, { label: "captcha token" }, { readStdin, readEnvironment });
+  if (resolved === void 0) {
+    return void 0;
+  }
+  const value = resolved.kind === "stdin" ? removeOneTrailingLineEnding(resolved.value) : resolved.value;
+  if (value === "") {
+    throw new CliError("The selected captcha token source resolved to an empty value.", {
+      code: "EMPTY_INPUT_VALUE",
+      exitCode: ExitCode.InputError
+    });
+  }
+  return value;
+};
+const removeOneTrailingLineEnding = (value) => value.replace(/(?:\r\n|\n)$/, "");
+export {
+  assertBcryptHash,
+  configureCaptchaTokenOptions,
+  resolveCaptchaToken,
+  resolveSecret
+};
+//# sourceMappingURL=personInput.js.map

package/dist/development/src/commands/tenant/person/personInput.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"personInput.js","sources":["../../../../../../../packages/cli/src/commands/tenant/person/personInput.ts"],"sourcesContent":["import { CliError, ExitCode } from '@contember/cli-common'\nimport type { StdinReader } from '../../../lib/tenant/stdin.js'\nimport { environmentInput, literalInput, resolveOptionalTenantInput, stdinInput, type TenantInputSource } from '../../../lib/tenant/input/index.js'\n\n/**\n * One way of passing a secret. `name` is the option prefix, so `password` covers `--password-stdin`\n * and `--password-env`. A secret is never a plain option value — argv lands in the shell history and\n * in `ps` output of every user on the machine.\n */\nexport interface SecretSource {\n\treadonly name: string\n\treadonly stdin: boolean\n\treadonly env: string | undefined\n}\n\nexport interface ResolvedSecret {\n\t/** The `name` of the {@link SecretSource} the value came from. */\n\treadonly name: string\n\treadonly value: string\n}\n\n/** Resolves at most one of the offered secret sources. Returns undefined when the caller passed none. */\nexport const resolveSecret = async (sources: readonly SecretSource[], readStdin: StdinReader): Promise<ResolvedSecret | undefined> => {\n\tconst given = sources.flatMap(source => [\n\t\t...(source.stdin ? [{ source, flag: `--${source.name}-stdin` }] : []),\n\t\t...(source.env !== undefined ? [{ source, flag: `--${source.name}-env` }] : []),\n\t])\n\tif (given.length > 1) {\n\t\tthrow new CliError(`Pass only one of ${given.map(it => it.flag).join(', ')}.`, {\n\t\t\tcode: 'AMBIGUOUS_SECRET_SOURCE',\n\t\t\texitCode: ExitCode.InputError,\n\t\t})\n\t}\n\tconst chosen = given[0]\n\tif (chosen === undefined) {\n\t\treturn undefined\n\t}\n\t// the trailing newline `echo` adds is never part of the secret\n\tconst value = chosen.source.env !== undefined ? readSecretEnv(chosen.source.env) : (await readStdin()).replace(/\\r?\\n$/, '')\n\tif (value === '') {\n\t\tthrow new CliError(`${chosen.flag} resolved to an empty value.`, { code: 'EMPTY_SECRET', exitCode: ExitCode.InputError })\n\t}\n\treturn { name: chosen.source.name, value }\n}\n\nconst readSecretEnv = (name: string): string => {\n\tconst value = process.env[name]\n\tif (value === undefined) {\n\t\tthrow new CliError(`Environment variable ${name} is not set.`, { code: 'SECRET_ENV_NOT_SET', exitCode: ExitCode.InputError })\n\t}\n\treturn value\n}\n\n/** The tenant API accepts `$2b$` bcrypt hashes only — rejecting here avoids spending a rate-limit slot on a doomed call. */\nexport const assertBcryptHash = (hash: string): void => {\n\tif (!hash.startsWith('$2b$')) {\n\t\tthrow new CliError('Invalid password hash: the tenant API accepts bcrypt $2b$ hashes only.', {\n\t\t\tcode: 'INVALID_PASSWORD_HASH',\n\t\t\texitCode: ExitCode.InputError,\n\t\t})\n\t}\n}\n\nexport type CaptchaTokenOptions = {\n\treadonly ['captcha-token']?: string\n\treadonly ['captcha-token-env']?: string\n\treadonly ['captcha-token-stdin']?: boolean\n}\n\nexport const configureCaptchaTokenOptions = (configuration: {\n\toption(name: keyof CaptchaTokenOptions): {\n\t\tvalueNone(): { description(description: string): unknown }\n\t\tvalueRequired(): { description(description: string): unknown }\n\t}\n}): void => {\n\tconfiguration.option('captcha-token').valueRequired().description(\n\t\t'Captcha token. Visible in the shell history and process list; prefer --captcha-token-env or --captcha-token-stdin.',\n\t)\n\tconfiguration.option('captcha-token-env').valueRequired().description('Read the captcha token from the named environment variable.')\n\tconfiguration.option('captcha-token-stdin').valueNone().description('Read the captcha token from stdin.')\n}\n\nexport const resolveCaptchaToken = async (\n\toptions: CaptchaTokenOptions,\n\treadStdin: StdinReader,\n\treadEnvironment: (name: string) => string | undefined = name => process.env[name],\n): Promise<string | undefined> => {\n\tconst sources: TenantInputSource<'captcha-token'>[] = []\n\tif (options['captcha-token'] !== undefined) {\n\t\tsources.push(literalInput('captcha-token', '--captcha-token', options['captcha-token']))\n\t}\n\tif (options['captcha-token-env'] !== undefined) {\n\t\tsources.push(environmentInput('captcha-token', '--captcha-token-env', options['captcha-token-env']))\n\t}\n\tif (options['captcha-token-stdin'] === true) {\n\t\tsources.push(stdinInput('captcha-token', '--captcha-token-stdin'))\n\t}\n\tconst resolved = await resolveOptionalTenantInput(sources, { label: 'captcha token' }, { readStdin, readEnvironment })\n\tif (resolved === undefined) {\n\t\treturn undefined\n\t}\n\tconst value = resolved.kind === 'stdin' ? removeOneTrailingLineEnding(resolved.value) : resolved.value\n\tif (value === '') {\n\t\tthrow new CliError('The selected captcha token source resolved to an empty value.', {\n\t\t\tcode: 'EMPTY_INPUT_VALUE',\n\t\t\texitCode: ExitCode.InputError,\n\t\t})\n\t}\n\treturn value\n}\n\nconst removeOneTrailingLineEnding = (value: string): string => value.replace(/(?:\\r\\n|\\n)$/, '')\n"],"names":[],"mappings":";;AAsBO,MAAM,gBAAgB,OAAO,SAAkC,cAAgE;AACrI,QAAM,QAAQ,QAAQ,QAAQ,CAAA,WAAU;AAAA,IACvC,GAAI,OAAO,QAAQ,CAAC,EAAE,QAAQ,MAAM,KAAK,OAAO,IAAI,SAAA,CAAU,IAAI,CAAA;AAAA,IAClE,GAAI,OAAO,QAAQ,SAAY,CAAC,EAAE,QAAQ,MAAM,KAAK,OAAO,IAAI,OAAA,CAAQ,IAAI,CAAA;AAAA,EAAC,CAC7E;AACD,MAAI,MAAM,SAAS,GAAG;AACrB,UAAM,IAAI,SAAS,oBAAoB,MAAM,IAAI,CAAA,OAAM,GAAG,IAAI,EAAE,KAAK,IAAI,CAAC,KAAK;AAAA,MAC9E,MAAM;AAAA,MACN,UAAU,SAAS;AAAA,IAAA,CACnB;AAAA,EACF;AACA,QAAM,SAAS,MAAM,CAAC;AACtB,MAAI,WAAW,QAAW;AACzB,WAAO;AAAA,EACR;AAEA,QAAM,QAAQ,OAAO,OAAO,QAAQ,SAAY,cAAc,OAAO,OAAO,GAAG,KAAK,MAAM,UAAA,GAAa,QAAQ,UAAU,EAAE;AAC3H,MAAI,UAAU,IAAI;AACjB,UAAM,IAAI,SAAS,GAAG,OAAO,IAAI,gCAAgC,EAAE,MAAM,gBAAgB,UAAU,SAAS,WAAA,CAAY;AAAA,EACzH;AACA,SAAO,EAAE,MAAM,OAAO,OAAO,MAAM,MAAA;AACpC;AAEA,MAAM,gBAAgB,CAAC,SAAyB;AAC/C,QAAM,QAAQ,QAAQ,IAAI,IAAI;AAC9B,MAAI,UAAU,QAAW;AACxB,UAAM,IAAI,SAAS,wBAAwB,IAAI,gBAAgB,EAAE,MAAM,sBAAsB,UAAU,SAAS,WAAA,CAAY;AAAA,EAC7H;AACA,SAAO;AACR;AAGO,MAAM,mBAAmB,CAAC,SAAuB;AACvD,MAAI,CAAC,KAAK,WAAW,MAAM,GAAG;AAC7B,UAAM,IAAI,SAAS,0EAA0E;AAAA,MAC5F,MAAM;AAAA,MACN,UAAU,SAAS;AAAA,IAAA,CACnB;AAAA,EACF;AACD;AAQO,MAAM,+BAA+B,CAAC,kBAKjC;AACX,gBAAc,OAAO,eAAe,EAAE,cAAA,EAAgB;AAAA,IACrD;AAAA,EAAA;AAED,gBAAc,OAAO,mBAAmB,EAAE,cAAA,EAAgB,YAAY,6DAA6D;AACnI,gBAAc,OAAO,qBAAqB,EAAE,UAAA,EAAY,YAAY,oCAAoC;AACzG;AAEO,MAAM,sBAAsB,OAClC,SACA,WACA,kBAAwD,CAAA,SAAQ,QAAQ,IAAI,IAAI,MAC/C;AACjC,QAAM,UAAgD,CAAA;AACtD,MAAI,QAAQ,eAAe,MAAM,QAAW;AAC3C,YAAQ,KAAK,aAAa,iBAAiB,mBAAmB,QAAQ,eAAe,CAAC,CAAC;AAAA,EACxF;AACA,MAAI,QAAQ,mBAAmB,MAAM,QAAW;AAC/C,YAAQ,KAAK,iBAAiB,iBAAiB,uBAAuB,QAAQ,mBAAmB,CAAC,CAAC;AAAA,EACpG;AACA,MAAI,QAAQ,qBAAqB,MAAM,MAAM;AAC5C,YAAQ,KAAK,WAAW,iBAAiB,uBAAuB,CAAC;AAAA,EAClE;AACA,QAAM,WAAW,MAAM,2BAA2B,SAAS,EAAE,OAAO,mBAAmB,EAAE,WAAW,iBAAiB;AACrH,MAAI,aAAa,QAAW;AAC3B,WAAO;AAAA,EACR;AACA,QAAM,QAAQ,SAAS,SAAS,UAAU,4BAA4B,SAAS,KAAK,IAAI,SAAS;AACjG,MAAI,UAAU,IAAI;AACjB,UAAM,IAAI,SAAS,iEAAiE;AAAA,MACnF,MAAM;AAAA,MACN,UAAU,SAAS;AAAA,IAAA,CACnB;AAAA,EACF;AACA,SAAO;AACR;AAEA,MAAM,8BAA8B,CAAC,UAA0B,MAAM,QAAQ,gBAAgB,EAAE;"}

package/dist/development/src/commands/tenant/policy/TenantAuthLogCommand.cjs

@@ -0,0 +1,96 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const cliCommon = require("@contember/cli-common");
+const chalkTable = require("chalk-table");
+const pagination = require("../../../lib/tenant/input/pagination.cjs");
+const policyInput = require("./policyInput.cjs");
+const tenantOutput = require("../tenantOutput.cjs");
+class TenantAuthLogCommand extends cliCommon.Command {
+  constructor(tenantClientProvider) {
+    super();
+    this.tenantClientProvider = tenantClientProvider;
+  }
+  configure(configuration) {
+    configuration.description("Read the tenant auth log (audit trail). Requires the system:viewAuthLog permission.");
+    configuration.option("type").valueArray().description("Filter by auth_log_type, e.g. sign_in. Repeat the option to match any of several types.");
+    configuration.option("success").valueNone().description("Only successful entries.");
+    configuration.option("failed").valueNone().description("Only failed entries.");
+    configuration.option("invoked-by").valueRequired().description("Filter by the acting identity id.");
+    configuration.option("person").valueRequired().description("Filter by the acting person id.");
+    configuration.option("target-person").valueRequired().description("Filter by the person the action was performed on.");
+    configuration.option("person-input").valueRequired().description("Filter by the submitted identifier, typically the e-mail of a failed sign-in.");
+    configuration.option("created-after").valueRequired().description("Inclusive lower bound on createdAt, as an ISO 8601 timestamp.");
+    configuration.option("created-before").valueRequired().description("Exclusive upper bound on createdAt, as an ISO 8601 timestamp.");
+    configuration.option("limit").valueRequired().description("Page size. Server default is 100, capped at 500.");
+    configuration.option("offset").valueRequired().description("Number of entries to skip. Use the nextOffset of the previous page.");
+  }
+  async execute(input, output) {
+    const limit = pagination.parsePaginationLimit(input.getOption("limit"));
+    const offset = pagination.parsePaginationOffset(input.getOption("offset")) ?? 0;
+    const filter = this.readFilter(input);
+    const page = await this.tenantClientProvider.policy().readAuthLog({
+      filter: Object.values(filter).some((it) => it !== void 0) ? filter : void 0,
+      limit,
+      offset
+    });
+    const advancedOffset = offset + page.entries.length;
+    const canContinue = page.hasMore && page.entries.length > 0 && advancedOffset <= pagination.GRAPHQL_INT_MAX;
+    const result = {
+      entries: page.entries,
+      hasMore: canContinue,
+      offset,
+      nextOffset: canContinue ? advancedOffset : null
+    };
+    output.info(`authLog: ${page.entries.length} entries from offset ${offset}${result.hasMore ? ", more available" : ""}`);
+    output.data(result, { human: renderHuman, quiet: (value) => value.entries.map((entry) => entry.id) });
+  }
+  readFilter(input) {
+    const successOnly = input.getOption("success") === true;
+    const failedOnly = input.getOption("failed") === true;
+    if (successOnly && failedOnly) {
+      throw policyInput.inputError("Pass either --success or --failed, not both.", "AMBIGUOUS_INPUT");
+    }
+    return {
+      types: input.getOption("type"),
+      success: successOnly ? true : failedOnly ? false : void 0,
+      invokedByIdentityId: input.getOption("invoked-by"),
+      personId: input.getOption("person"),
+      targetPersonId: input.getOption("target-person"),
+      personInputIdentifier: input.getOption("person-input"),
+      createdAfter: input.getOption("created-after"),
+      createdBefore: input.getOption("created-before")
+    };
+  }
+}
+const humanColumns = [
+  { field: "createdAt", name: "Time (UTC)" },
+  { field: "type", name: "Type" },
+  { field: "success", name: "OK" },
+  { field: "person", name: "Person" },
+  { field: "identity", name: "Identity" },
+  { field: "ip", name: "IP" },
+  { field: "error", name: "Error" }
+];
+const renderHuman = (page) => {
+  if (page.entries.length === 0) {
+    return "No auth log entries match the filter.";
+  }
+  const table = chalkTable({ columns: humanColumns }, page.entries.map(toHumanRow));
+  return page.hasMore ? `${table}
+More entries available — rerun with --offset ${page.nextOffset}.` : table;
+};
+const toHumanRow = (entry) => ({
+  createdAt: formatTimestamp(entry.createdAt),
+  type: tenantOutput.humanText(entry.type),
+  success: entry.success ? "yes" : "no",
+  person: tenantOutput.humanText(entry.personId ?? entry.personInputIdentifier ?? ""),
+  identity: tenantOutput.humanText(entry.invokedByIdentityId ?? ""),
+  ip: tenantOutput.humanText(entry.ipAddress ?? ""),
+  error: tenantOutput.humanText(entry.errorCode ?? "")
+});
+const formatTimestamp = (value) => {
+  const parsed = new Date(value);
+  return Number.isNaN(parsed.getTime()) ? tenantOutput.humanText(value) : parsed.toISOString().replace("T", " ").slice(0, 19);
+};
+exports.TenantAuthLogCommand = TenantAuthLogCommand;
+//# sourceMappingURL=TenantAuthLogCommand.cjs.map

package/dist/development/src/commands/tenant/policy/TenantAuthLogCommand.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantAuthLogCommand.cjs","sources":["../../../../../../../packages/cli/src/commands/tenant/policy/TenantAuthLogCommand.ts"],"sourcesContent":["/// <reference path=\"../../../../types/chalk-table/index.d.ts\" />\n\nimport { Command, CommandConfiguration, Input, Output } from '@contember/cli-common'\nimport type { AuthLogFilter } from '@contember/graphql-client-tenant'\nimport chalkTable from 'chalk-table'\nimport { TenantClientProvider } from '../../../lib/TenantClientProvider.js'\nimport { TenantAuthLogEntry } from '../../../lib/tenant/clients/index.js'\nimport { GRAPHQL_INT_MAX, parsePaginationLimit, parsePaginationOffset } from '../../../lib/tenant/input/index.js'\nimport { inputError } from './policyInput.js'\nimport { humanText } from '../tenantOutput.js'\n\ntype Args = {}\n\ntype Options = {\n\ttype?: string[]\n\tsuccess?: boolean\n\tfailed?: boolean\n\t['invoked-by']?: string\n\tperson?: string\n\t['target-person']?: string\n\t['person-input']?: string\n\t['created-after']?: string\n\t['created-before']?: string\n\tlimit?: string\n\toffset?: string\n}\n\n/** The command's answer: the page plus everything a script needs to fetch the next one. */\nexport interface AuthLogPageResult {\n\tentries: TenantAuthLogEntry[]\n\t/** True when rows exist past this page. */\n\thasMore: boolean\n\toffset: number\n\t/** Offset to pass to the next call, `null` when this is the last page. */\n\tnextOffset: number | null\n}\n\nexport class TenantAuthLogCommand extends Command<Args, Options> {\n\tconstructor(\n\t\tprivate readonly tenantClientProvider: TenantClientProvider,\n\t) {\n\t\tsuper()\n\t}\n\n\tprotected configure(configuration: CommandConfiguration<Args, Options>): void {\n\t\tconfiguration.description('Read the tenant auth log (audit trail). Requires the system:viewAuthLog permission.')\n\t\tconfiguration.option('type').valueArray().description('Filter by auth_log_type, e.g. sign_in. Repeat the option to match any of several types.')\n\t\tconfiguration.option('success').valueNone().description('Only successful entries.')\n\t\tconfiguration.option('failed').valueNone().description('Only failed entries.')\n\t\tconfiguration.option('invoked-by').valueRequired().description('Filter by the acting identity id.')\n\t\tconfiguration.option('person').valueRequired().description('Filter by the acting person id.')\n\t\tconfiguration.option('target-person').valueRequired().description('Filter by the person the action was performed on.')\n\t\tconfiguration.option('person-input').valueRequired().description('Filter by the submitted identifier, typically the e-mail of a failed sign-in.')\n\t\tconfiguration.option('created-after').valueRequired().description('Inclusive lower bound on createdAt, as an ISO 8601 timestamp.')\n\t\tconfiguration.option('created-before').valueRequired().description('Exclusive upper bound on createdAt, as an ISO 8601 timestamp.')\n\t\tconfiguration.option('limit').valueRequired().description('Page size. Server default is 100, capped at 500.')\n\t\tconfiguration.option('offset').valueRequired().description('Number of entries to skip. Use the nextOffset of the previous page.')\n\t}\n\n\tprotected async execute(input: Input<Args, Options>, output: Output): Promise<void> {\n\t\tconst limit = parsePaginationLimit(input.getOption('limit'))\n\t\tconst offset = parsePaginationOffset(input.getOption('offset')) ?? 0\n\t\tconst filter = this.readFilter(input)\n\n\t\tconst page = await this.tenantClientProvider.policy().readAuthLog({\n\t\t\tfilter: Object.values(filter).some(it => it !== undefined) ? filter : undefined,\n\t\t\tlimit,\n\t\t\toffset,\n\t\t})\n\n\t\tconst advancedOffset = offset + page.entries.length\n\t\tconst canContinue = page.hasMore && page.entries.length > 0 && advancedOffset <= GRAPHQL_INT_MAX\n\t\tconst result: AuthLogPageResult = {\n\t\t\tentries: page.entries,\n\t\t\thasMore: canContinue,\n\t\t\toffset,\n\t\t\tnextOffset: canContinue ? advancedOffset : null,\n\t\t}\n\t\toutput.info(`authLog: ${page.entries.length} entries from offset ${offset}${result.hasMore ? ', more available' : ''}`)\n\t\toutput.data(result, { human: renderHuman, quiet: value => value.entries.map(entry => entry.id) })\n\t}\n\n\tprivate readFilter(input: Input<Args, Options>): AuthLogFilter {\n\t\tconst successOnly = input.getOption('success') === true\n\t\tconst failedOnly = input.getOption('failed') === true\n\t\tif (successOnly && failedOnly) {\n\t\t\tthrow inputError('Pass either --success or --failed, not both.', 'AMBIGUOUS_INPUT')\n\t\t}\n\t\treturn {\n\t\t\ttypes: input.getOption('type'),\n\t\t\tsuccess: successOnly ? true : failedOnly ? false : undefined,\n\t\t\tinvokedByIdentityId: input.getOption('invoked-by'),\n\t\t\tpersonId: input.getOption('person'),\n\t\t\ttargetPersonId: input.getOption('target-person'),\n\t\t\tpersonInputIdentifier: input.getOption('person-input'),\n\t\t\tcreatedAfter: input.getOption('created-after'),\n\t\t\tcreatedBefore: input.getOption('created-before'),\n\t\t}\n\t}\n}\n\ntype AuthLogCell = 'createdAt' | 'type' | 'success' | 'person' | 'identity' | 'ip' | 'error'\n\n// A curated, narrow projection: the full entry (metadata, eventData, user agent) stays in --json.\nconst humanColumns: { field: AuthLogCell; name: string }[] = [\n\t{ field: 'createdAt', name: 'Time (UTC)' },\n\t{ field: 'type', name: 'Type' },\n\t{ field: 'success', name: 'OK' },\n\t{ field: 'person', name: 'Person' },\n\t{ field: 'identity', name: 'Identity' },\n\t{ field: 'ip', name: 'IP' },\n\t{ field: 'error', name: 'Error' },\n]\n\n/**\n * `Output.data` renders the human view, because `Output.table` can only emit a bare array and the\n * paging fields have to stay in the `--json` payload. Formatting therefore lives here, human-only.\n */\nconst renderHuman = (page: AuthLogPageResult): string => {\n\tif (page.entries.length === 0) {\n\t\treturn 'No auth log entries match the filter.'\n\t}\n\tconst table = chalkTable({ columns: humanColumns }, page.entries.map(toHumanRow))\n\treturn page.hasMore ? `${table}\\nMore entries available — rerun with --offset ${page.nextOffset}.` : table\n}\n\nconst toHumanRow = (entry: TenantAuthLogEntry): Record<AuthLogCell, string> => ({\n\tcreatedAt: formatTimestamp(entry.createdAt),\n\ttype: humanText(entry.type),\n\tsuccess: entry.success ? 'yes' : 'no',\n\tperson: humanText(entry.personId ?? entry.personInputIdentifier ?? ''),\n\tidentity: humanText(entry.invokedByIdentityId ?? ''),\n\tip: humanText(entry.ipAddress ?? ''),\n\terror: humanText(entry.errorCode ?? ''),\n})\n\n/** Raw ISO timestamps read badly in a terminal; UTC keeps the rendering reproducible. */\nconst formatTimestamp = (value: string): string => {\n\tconst parsed = new Date(value)\n\treturn Number.isNaN(parsed.getTime()) ? humanText(value) : parsed.toISOString().replace('T', ' ').slice(0, 19)\n}\n"],"names":["Command","parsePaginationLimit","parsePaginationOffset","GRAPHQL_INT_MAX","inputError","humanText"],"mappings":";;;;;;;AAqCO,MAAM,6BAA6BA,UAAAA,QAAuB;AAAA,EAChE,YACkB,sBAChB;AACD,UAAA;AAFiB,SAAA,uBAAA;AAAA,EAGlB;AAAA,EAEU,UAAU,eAA0D;AAC7E,kBAAc,YAAY,qFAAqF;AAC/G,kBAAc,OAAO,MAAM,EAAE,WAAA,EAAa,YAAY,yFAAyF;AAC/I,kBAAc,OAAO,SAAS,EAAE,UAAA,EAAY,YAAY,0BAA0B;AAClF,kBAAc,OAAO,QAAQ,EAAE,UAAA,EAAY,YAAY,sBAAsB;AAC7E,kBAAc,OAAO,YAAY,EAAE,cAAA,EAAgB,YAAY,mCAAmC;AAClG,kBAAc,OAAO,QAAQ,EAAE,cAAA,EAAgB,YAAY,iCAAiC;AAC5F,kBAAc,OAAO,eAAe,EAAE,cAAA,EAAgB,YAAY,mDAAmD;AACrH,kBAAc,OAAO,cAAc,EAAE,cAAA,EAAgB,YAAY,+EAA+E;AAChJ,kBAAc,OAAO,eAAe,EAAE,cAAA,EAAgB,YAAY,+DAA+D;AACjI,kBAAc,OAAO,gBAAgB,EAAE,cAAA,EAAgB,YAAY,+DAA+D;AAClI,kBAAc,OAAO,OAAO,EAAE,cAAA,EAAgB,YAAY,kDAAkD;AAC5G,kBAAc,OAAO,QAAQ,EAAE,cAAA,EAAgB,YAAY,qEAAqE;AAAA,EACjI;AAAA,EAEA,MAAgB,QAAQ,OAA6B,QAA+B;AACnF,UAAM,QAAQC,WAAAA,qBAAqB,MAAM,UAAU,OAAO,CAAC;AAC3D,UAAM,SAASC,WAAAA,sBAAsB,MAAM,UAAU,QAAQ,CAAC,KAAK;AACnE,UAAM,SAAS,KAAK,WAAW,KAAK;AAEpC,UAAM,OAAO,MAAM,KAAK,qBAAqB,OAAA,EAAS,YAAY;AAAA,MACjE,QAAQ,OAAO,OAAO,MAAM,EAAE,KAAK,CAAA,OAAM,OAAO,MAAS,IAAI,SAAS;AAAA,MACtE;AAAA,MACA;AAAA,IAAA,CACA;AAED,UAAM,iBAAiB,SAAS,KAAK,QAAQ;AAC7C,UAAM,cAAc,KAAK,WAAW,KAAK,QAAQ,SAAS,KAAK,kBAAkBC,WAAAA;AACjF,UAAM,SAA4B;AAAA,MACjC,SAAS,KAAK;AAAA,MACd,SAAS;AAAA,MACT;AAAA,MACA,YAAY,cAAc,iBAAiB;AAAA,IAAA;AAE5C,WAAO,KAAK,YAAY,KAAK,QAAQ,MAAM,wBAAwB,MAAM,GAAG,OAAO,UAAU,qBAAqB,EAAE,EAAE;AACtH,WAAO,KAAK,QAAQ,EAAE,OAAO,aAAa,OAAO,CAAA,UAAS,MAAM,QAAQ,IAAI,CAAA,UAAS,MAAM,EAAE,GAAG;AAAA,EACjG;AAAA,EAEQ,WAAW,OAA4C;AAC9D,UAAM,cAAc,MAAM,UAAU,SAAS,MAAM;AACnD,UAAM,aAAa,MAAM,UAAU,QAAQ,MAAM;AACjD,QAAI,eAAe,YAAY;AAC9B,YAAMC,YAAAA,WAAW,gDAAgD,iBAAiB;AAAA,IACnF;AACA,WAAO;AAAA,MACN,OAAO,MAAM,UAAU,MAAM;AAAA,MAC7B,SAAS,cAAc,OAAO,aAAa,QAAQ;AAAA,MACnD,qBAAqB,MAAM,UAAU,YAAY;AAAA,MACjD,UAAU,MAAM,UAAU,QAAQ;AAAA,MAClC,gBAAgB,MAAM,UAAU,eAAe;AAAA,MAC/C,uBAAuB,MAAM,UAAU,cAAc;AAAA,MACrD,cAAc,MAAM,UAAU,eAAe;AAAA,MAC7C,eAAe,MAAM,UAAU,gBAAgB;AAAA,IAAA;AAAA,EAEjD;AACD;AAKA,MAAM,eAAuD;AAAA,EAC5D,EAAE,OAAO,aAAa,MAAM,aAAA;AAAA,EAC5B,EAAE,OAAO,QAAQ,MAAM,OAAA;AAAA,EACvB,EAAE,OAAO,WAAW,MAAM,KAAA;AAAA,EAC1B,EAAE,OAAO,UAAU,MAAM,SAAA;AAAA,EACzB,EAAE,OAAO,YAAY,MAAM,WAAA;AAAA,EAC3B,EAAE,OAAO,MAAM,MAAM,KAAA;AAAA,EACrB,EAAE,OAAO,SAAS,MAAM,QAAA;AACzB;AAMA,MAAM,cAAc,CAAC,SAAoC;AACxD,MAAI,KAAK,QAAQ,WAAW,GAAG;AAC9B,WAAO;AAAA,EACR;AACA,QAAM,QAAQ,WAAW,EAAE,SAAS,gBAAgB,KAAK,QAAQ,IAAI,UAAU,CAAC;AAChF,SAAO,KAAK,UAAU,GAAG,KAAK;AAAA,+CAAkD,KAAK,UAAU,MAAM;AACtG;AAEA,MAAM,aAAa,CAAC,WAA4D;AAAA,EAC/E,WAAW,gBAAgB,MAAM,SAAS;AAAA,EAC1C,MAAMC,aAAAA,UAAU,MAAM,IAAI;AAAA,EAC1B,SAAS,MAAM,UAAU,QAAQ;AAAA,EACjC,QAAQA,aAAAA,UAAU,MAAM,YAAY,MAAM,yBAAyB,EAAE;AAAA,EACrE,UAAUA,aAAAA,UAAU,MAAM,uBAAuB,EAAE;AAAA,EACnD,IAAIA,aAAAA,UAAU,MAAM,aAAa,EAAE;AAAA,EACnC,OAAOA,aAAAA,UAAU,MAAM,aAAa,EAAE;AACvC;AAGA,MAAM,kBAAkB,CAAC,UAA0B;AAClD,QAAM,SAAS,IAAI,KAAK,KAAK;AAC7B,SAAO,OAAO,MAAM,OAAO,SAAS,IAAIA,aAAAA,UAAU,KAAK,IAAI,OAAO,YAAA,EAAc,QAAQ,KAAK,GAAG,EAAE,MAAM,GAAG,EAAE;AAC9G;;"}