@contember/cli 2.2.0-alpha.1 → 2.2.0-alpha.10

package/dist/production/src/commands/tenant/person/TenantIdentityRoleRemoveCommand.cjs

@@ -0,0 +1,34 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const cliCommon = require("@contember/cli-common");
+const confirmation = require("../../../lib/tenant/confirmation.cjs");
+const tenantOutput = require("../tenantOutput.cjs");
+class TenantIdentityRoleRemoveCommand extends cliCommon.Command {
+  constructor(tenantClientProvider) {
+    super();
+    this.tenantClientProvider = tenantClientProvider;
+  }
+  configure(configuration) {
+    configuration.description("Revoke global (project-independent) roles from an identity.");
+    configuration.argument("identityId").description('Identity id, as listed by "tenant person list".');
+    configuration.argument("role").variadic().description("One or more global roles to revoke.");
+    configuration.option("yes").valueNone().description("Do not ask for confirmation.");
+  }
+  async execute(input, output) {
+    const identityId = input.getArgument("identityId");
+    const removed = input.getArgument("role");
+    await confirmation.requireConfirmation({
+      yes: input.getOption("yes") === true,
+      output,
+      warning: `This will revoke ${removed.join(", ")} from identity ${identityId}, which may lock it out of the API.`
+    });
+    const roles = await this.tenantClientProvider.person().removeGlobalIdentityRoles(identityId, removed);
+    output.info(`Revoked ${removed.join(", ")} from identity ${identityId}.`);
+    output.data(
+      { identityId, removed, roles },
+      { human: (it) => it.roles === null ? tenantOutput.humanText(it.identityId) : it.roles.map(tenantOutput.humanText).join(", "), quiet: (it) => it.identityId }
+    );
+  }
+}
+exports.TenantIdentityRoleRemoveCommand = TenantIdentityRoleRemoveCommand;
+//# sourceMappingURL=TenantIdentityRoleRemoveCommand.cjs.map

package/dist/production/src/commands/tenant/person/TenantIdentityRoleRemoveCommand.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantIdentityRoleRemoveCommand.cjs","sources":["../../../../../../../packages/cli/src/commands/tenant/person/TenantIdentityRoleRemoveCommand.ts"],"sourcesContent":["import { Command, CommandConfiguration, Input, Output } from '@contember/cli-common'\nimport { TenantClientProvider } from '../../../lib/TenantClientProvider.js'\nimport { requireConfirmation } from '../../../lib/tenant/confirmation.js'\nimport { humanText } from '../tenantOutput.js'\n\ntype Args = {\n\tidentityId: string\n\trole: string[]\n}\n\ntype Options = {\n\tyes?: boolean\n}\n\ninterface IdentityRolesResult {\n\tidentityId: string\n\tremoved: string[]\n\t/** All global roles of the identity after the change, or null when the token may not read them. */\n\troles: string[] | null\n}\n\nexport class TenantIdentityRoleRemoveCommand extends Command<Args, Options> {\n\tconstructor(\n\t\tprivate readonly tenantClientProvider: TenantClientProvider,\n\t) {\n\t\tsuper()\n\t}\n\n\tprotected configure(configuration: CommandConfiguration<Args, Options>): void {\n\t\tconfiguration.description('Revoke global (project-independent) roles from an identity.')\n\t\tconfiguration.argument('identityId').description('Identity id, as listed by \"tenant person list\".')\n\t\tconfiguration.argument('role').variadic().description('One or more global roles to revoke.')\n\t\tconfiguration.option('yes').valueNone().description('Do not ask for confirmation.')\n\t}\n\n\tprotected async execute(input: Input<Args, Options>, output: Output): Promise<void> {\n\t\tconst identityId = input.getArgument('identityId')\n\t\tconst removed = input.getArgument('role')\n\n\t\tawait requireConfirmation({\n\t\t\tyes: input.getOption('yes') === true,\n\t\t\toutput,\n\t\t\twarning: `This will revoke ${removed.join(', ')} from identity ${identityId}, which may lock it out of the API.`,\n\t\t})\n\n\t\tconst roles = await this.tenantClientProvider.person().removeGlobalIdentityRoles(identityId, removed)\n\n\t\toutput.info(`Revoked ${removed.join(', ')} from identity ${identityId}.`)\n\t\toutput.data<IdentityRolesResult>(\n\t\t\t{ identityId, removed, roles },\n\t\t\t{ human: it => it.roles === null ? humanText(it.identityId) : it.roles.map(humanText).join(', '), quiet: it => it.identityId },\n\t\t)\n\t}\n}\n"],"names":["Command","requireConfirmation","humanText"],"mappings":";;;;;AAqBO,MAAM,wCAAwCA,UAAAA,QAAuB;AAAA,EAC3E,YACkB,sBAChB;AACD,UAAA;AAFiB,SAAA,uBAAA;AAAA,EAGlB;AAAA,EAEU,UAAU,eAA0D;AAC7E,kBAAc,YAAY,6DAA6D;AACvF,kBAAc,SAAS,YAAY,EAAE,YAAY,iDAAiD;AAClG,kBAAc,SAAS,MAAM,EAAE,SAAA,EAAW,YAAY,qCAAqC;AAC3F,kBAAc,OAAO,KAAK,EAAE,UAAA,EAAY,YAAY,8BAA8B;AAAA,EACnF;AAAA,EAEA,MAAgB,QAAQ,OAA6B,QAA+B;AACnF,UAAM,aAAa,MAAM,YAAY,YAAY;AACjD,UAAM,UAAU,MAAM,YAAY,MAAM;AAExC,UAAMC,iCAAoB;AAAA,MACzB,KAAK,MAAM,UAAU,KAAK,MAAM;AAAA,MAChC;AAAA,MACA,SAAS,oBAAoB,QAAQ,KAAK,IAAI,CAAC,kBAAkB,UAAU;AAAA,IAAA,CAC3E;AAED,UAAM,QAAQ,MAAM,KAAK,qBAAqB,SAAS,0BAA0B,YAAY,OAAO;AAEpG,WAAO,KAAK,WAAW,QAAQ,KAAK,IAAI,CAAC,kBAAkB,UAAU,GAAG;AACxE,WAAO;AAAA,MACN,EAAE,YAAY,SAAS,MAAA;AAAA,MACvB,EAAE,OAAO,CAAA,OAAM,GAAG,UAAU,OAAOC,aAAAA,UAAU,GAAG,UAAU,IAAI,GAAG,MAAM,IAAIA,sBAAS,EAAE,KAAK,IAAI,GAAG,OAAO,CAAA,OAAM,GAAG,WAAA;AAAA,IAAW;AAAA,EAE/H;AACD;;"}

package/dist/production/src/commands/tenant/person/TenantIdentityRoleRemoveCommand.js

@@ -0,0 +1,34 @@
+import { Command } from "@contember/cli-common";
+import { requireConfirmation } from "../../../lib/tenant/confirmation.js";
+import { humanText } from "../tenantOutput.js";
+class TenantIdentityRoleRemoveCommand extends Command {
+  constructor(tenantClientProvider) {
+    super();
+    this.tenantClientProvider = tenantClientProvider;
+  }
+  configure(configuration) {
+    configuration.description("Revoke global (project-independent) roles from an identity.");
+    configuration.argument("identityId").description('Identity id, as listed by "tenant person list".');
+    configuration.argument("role").variadic().description("One or more global roles to revoke.");
+    configuration.option("yes").valueNone().description("Do not ask for confirmation.");
+  }
+  async execute(input, output) {
+    const identityId = input.getArgument("identityId");
+    const removed = input.getArgument("role");
+    await requireConfirmation({
+      yes: input.getOption("yes") === true,
+      output,
+      warning: `This will revoke ${removed.join(", ")} from identity ${identityId}, which may lock it out of the API.`
+    });
+    const roles = await this.tenantClientProvider.person().removeGlobalIdentityRoles(identityId, removed);
+    output.info(`Revoked ${removed.join(", ")} from identity ${identityId}.`);
+    output.data(
+      { identityId, removed, roles },
+      { human: (it) => it.roles === null ? humanText(it.identityId) : it.roles.map(humanText).join(", "), quiet: (it) => it.identityId }
+    );
+  }
+}
+export {
+  TenantIdentityRoleRemoveCommand
+};
+//# sourceMappingURL=TenantIdentityRoleRemoveCommand.js.map

package/dist/production/src/commands/tenant/person/TenantIdentityRoleRemoveCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantIdentityRoleRemoveCommand.js","sources":["../../../../../../../packages/cli/src/commands/tenant/person/TenantIdentityRoleRemoveCommand.ts"],"sourcesContent":["import { Command, CommandConfiguration, Input, Output } from '@contember/cli-common'\nimport { TenantClientProvider } from '../../../lib/TenantClientProvider.js'\nimport { requireConfirmation } from '../../../lib/tenant/confirmation.js'\nimport { humanText } from '../tenantOutput.js'\n\ntype Args = {\n\tidentityId: string\n\trole: string[]\n}\n\ntype Options = {\n\tyes?: boolean\n}\n\ninterface IdentityRolesResult {\n\tidentityId: string\n\tremoved: string[]\n\t/** All global roles of the identity after the change, or null when the token may not read them. */\n\troles: string[] | null\n}\n\nexport class TenantIdentityRoleRemoveCommand extends Command<Args, Options> {\n\tconstructor(\n\t\tprivate readonly tenantClientProvider: TenantClientProvider,\n\t) {\n\t\tsuper()\n\t}\n\n\tprotected configure(configuration: CommandConfiguration<Args, Options>): void {\n\t\tconfiguration.description('Revoke global (project-independent) roles from an identity.')\n\t\tconfiguration.argument('identityId').description('Identity id, as listed by \"tenant person list\".')\n\t\tconfiguration.argument('role').variadic().description('One or more global roles to revoke.')\n\t\tconfiguration.option('yes').valueNone().description('Do not ask for confirmation.')\n\t}\n\n\tprotected async execute(input: Input<Args, Options>, output: Output): Promise<void> {\n\t\tconst identityId = input.getArgument('identityId')\n\t\tconst removed = input.getArgument('role')\n\n\t\tawait requireConfirmation({\n\t\t\tyes: input.getOption('yes') === true,\n\t\t\toutput,\n\t\t\twarning: `This will revoke ${removed.join(', ')} from identity ${identityId}, which may lock it out of the API.`,\n\t\t})\n\n\t\tconst roles = await this.tenantClientProvider.person().removeGlobalIdentityRoles(identityId, removed)\n\n\t\toutput.info(`Revoked ${removed.join(', ')} from identity ${identityId}.`)\n\t\toutput.data<IdentityRolesResult>(\n\t\t\t{ identityId, removed, roles },\n\t\t\t{ human: it => it.roles === null ? humanText(it.identityId) : it.roles.map(humanText).join(', '), quiet: it => it.identityId },\n\t\t)\n\t}\n}\n"],"names":[],"mappings":";;;AAqBO,MAAM,wCAAwC,QAAuB;AAAA,EAC3E,YACkB,sBAChB;AACD,UAAA;AAFiB,SAAA,uBAAA;AAAA,EAGlB;AAAA,EAEU,UAAU,eAA0D;AAC7E,kBAAc,YAAY,6DAA6D;AACvF,kBAAc,SAAS,YAAY,EAAE,YAAY,iDAAiD;AAClG,kBAAc,SAAS,MAAM,EAAE,SAAA,EAAW,YAAY,qCAAqC;AAC3F,kBAAc,OAAO,KAAK,EAAE,UAAA,EAAY,YAAY,8BAA8B;AAAA,EACnF;AAAA,EAEA,MAAgB,QAAQ,OAA6B,QAA+B;AACnF,UAAM,aAAa,MAAM,YAAY,YAAY;AACjD,UAAM,UAAU,MAAM,YAAY,MAAM;AAExC,UAAM,oBAAoB;AAAA,MACzB,KAAK,MAAM,UAAU,KAAK,MAAM;AAAA,MAChC;AAAA,MACA,SAAS,oBAAoB,QAAQ,KAAK,IAAI,CAAC,kBAAkB,UAAU;AAAA,IAAA,CAC3E;AAED,UAAM,QAAQ,MAAM,KAAK,qBAAqB,SAAS,0BAA0B,YAAY,OAAO;AAEpG,WAAO,KAAK,WAAW,QAAQ,KAAK,IAAI,CAAC,kBAAkB,UAAU,GAAG;AACxE,WAAO;AAAA,MACN,EAAE,YAAY,SAAS,MAAA;AAAA,MACvB,EAAE,OAAO,CAAA,OAAM,GAAG,UAAU,OAAO,UAAU,GAAG,UAAU,IAAI,GAAG,MAAM,IAAI,SAAS,EAAE,KAAK,IAAI,GAAG,OAAO,CAAA,OAAM,GAAG,WAAA;AAAA,IAAW;AAAA,EAE/H;AACD;"}

package/dist/production/src/commands/tenant/person/TenantPersonCreateCommand.cjs

@@ -0,0 +1,79 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const cliCommon = require("@contember/cli-common");
+const personInput = require("./personInput.cjs");
+const tenantOutput = require("../tenantOutput.cjs");
+const stdin = require("../../../lib/tenant/stdin.cjs");
+class TenantPersonCreateCommand extends cliCommon.Command {
+  constructor(tenantClientProvider, readStdin = stdin.readStdinText, readEnvironment = (name) => process.env[name]) {
+    super();
+    this.tenantClientProvider = tenantClientProvider;
+    this.readStdin = readStdin;
+    this.readEnvironment = readEnvironment;
+  }
+  configure(configuration) {
+    configuration.description(
+      "Create a person (tenant signUp). Consumes the per-IP sign-up rate limit (config rateLimits.signUpPerIp, disabled by default, so bulk creation only throttles once a tenant configures it), verifies a captcha when one is configured, and sends a verification e-mail when signup.requireEmailVerification is on."
+    );
+    configuration.argument("email").description("E-mail address of the new person.");
+    configuration.option("name").valueRequired().description("Display name of the new person.");
+    configuration.option("role").valueArray().description("Global identity role to grant. Repeat the option to grant several.");
+    configuration.option("password-stdin").valueNone().description("Read the plaintext password from stdin.");
+    configuration.option("password-env").valueRequired().description("Read the plaintext password from the named environment variable.");
+    configuration.option("password-hash-stdin").valueNone().description("Read a bcrypt ($2b$) password hash from stdin.");
+    configuration.option("password-hash-env").valueRequired().description(
+      "Read a bcrypt ($2b$) password hash from the named environment variable. Preferred for provisioning — the plaintext never leaves your side."
+    );
+    personInput.configureCaptchaTokenOptions(configuration);
+  }
+  async execute(input, output) {
+    const email = input.getArgument("email");
+    const name = tenantOutput.requireNonEmptyTenantName(input.getOption("name"), "Person");
+    const passwordFromStdin = input.getOption("password-stdin") === true;
+    const passwordHashFromStdin = input.getOption("password-hash-stdin") === true;
+    const captchaFromStdin = input.getOption("captcha-token-stdin") === true;
+    if (captchaFromStdin && (passwordFromStdin || passwordHashFromStdin)) {
+      throw new cliCommon.CliError("Only one value can consume stdin. Combine a --*-stdin option with an environment-backed source instead.", {
+        code: "AMBIGUOUS_STDIN_INPUT",
+        exitCode: cliCommon.ExitCode.InputError
+      });
+    }
+    const secret = await personInput.resolveSecret(
+      [
+        { name: "password", stdin: passwordFromStdin, env: input.getOption("password-env") },
+        { name: "password-hash", stdin: passwordHashFromStdin, env: input.getOption("password-hash-env") }
+      ],
+      this.readStdin
+    );
+    const password = secret?.name === "password" ? secret.value : void 0;
+    const passwordHash = secret?.name === "password-hash" ? secret.value : void 0;
+    if (passwordHash !== void 0) {
+      personInput.assertBcryptHash(passwordHash);
+    }
+    if (secret === void 0) {
+      output.warn("No password given. The person is created without one and can only sign in after a password reset or through an identity provider.");
+    }
+    const captchaToken = await personInput.resolveCaptchaToken(
+      {
+        "captcha-token": input.getOption("captcha-token"),
+        "captcha-token-env": input.getOption("captcha-token-env"),
+        "captcha-token-stdin": input.getOption("captcha-token-stdin")
+      },
+      this.readStdin,
+      this.readEnvironment
+    );
+    output.info(`Creating person ${email}`);
+    const person = await this.tenantClientProvider.person().signUp({
+      email,
+      password,
+      passwordHash,
+      name,
+      roles: input.getOption("role"),
+      captchaToken
+    });
+    output.info(`Created person ${person.id} with identity ${person.identityId}.`);
+    output.data(person, { human: (it) => tenantOutput.humanText(it.id), quiet: (it) => it.id });
+  }
+}
+exports.TenantPersonCreateCommand = TenantPersonCreateCommand;
+//# sourceMappingURL=TenantPersonCreateCommand.cjs.map

package/dist/production/src/commands/tenant/person/TenantPersonCreateCommand.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantPersonCreateCommand.cjs","sources":["../../../../../../../packages/cli/src/commands/tenant/person/TenantPersonCreateCommand.ts"],"sourcesContent":["import { CliError, Command, CommandConfiguration, ExitCode, Input, Output } from '@contember/cli-common'\nimport { TenantClientProvider } from '../../../lib/TenantClientProvider.js'\nimport { TenantPerson } from '../../../lib/tenant/clients/TenantPersonClient.js'\nimport { assertBcryptHash, type CaptchaTokenOptions, configureCaptchaTokenOptions, resolveCaptchaToken, resolveSecret } from './personInput.js'\nimport { humanText, requireNonEmptyTenantName } from '../tenantOutput.js'\nimport { readStdinText, StdinReader } from '../../../lib/tenant/stdin.js'\n\ntype Args = {\n\temail: string\n}\n\ntype Options = CaptchaTokenOptions & {\n\tname?: string\n\trole?: string[]\n\t['password-stdin']?: boolean\n\t['password-env']?: string\n\t['password-hash-stdin']?: boolean\n\t['password-hash-env']?: string\n}\n\nexport class TenantPersonCreateCommand extends Command<Args, Options> {\n\tconstructor(\n\t\tprivate readonly tenantClientProvider: TenantClientProvider,\n\t\tprivate readonly readStdin: StdinReader = readStdinText,\n\t\tprivate readonly readEnvironment: (name: string) => string | undefined = name => process.env[name],\n\t) {\n\t\tsuper()\n\t}\n\n\tprotected configure(configuration: CommandConfiguration<Args, Options>): void {\n\t\tconfiguration.description(\n\t\t\t'Create a person (tenant signUp). Consumes the per-IP sign-up rate limit (config rateLimits.signUpPerIp, disabled by default, '\n\t\t\t\t+ 'so bulk creation only throttles once a tenant configures it), verifies a captcha when one is configured, and sends a '\n\t\t\t\t+ 'verification e-mail when signup.requireEmailVerification is on.',\n\t\t)\n\t\tconfiguration.argument('email').description('E-mail address of the new person.')\n\t\tconfiguration.option('name').valueRequired().description('Display name of the new person.')\n\t\tconfiguration.option('role').valueArray().description('Global identity role to grant. Repeat the option to grant several.')\n\t\tconfiguration.option('password-stdin').valueNone().description('Read the plaintext password from stdin.')\n\t\tconfiguration.option('password-env').valueRequired().description('Read the plaintext password from the named environment variable.')\n\t\tconfiguration.option('password-hash-stdin').valueNone().description('Read a bcrypt ($2b$) password hash from stdin.')\n\t\tconfiguration.option('password-hash-env').valueRequired().description(\n\t\t\t'Read a bcrypt ($2b$) password hash from the named environment variable. Preferred for provisioning — the plaintext never leaves your side.',\n\t\t)\n\t\tconfigureCaptchaTokenOptions(configuration)\n\t}\n\n\tprotected async execute(input: Input<Args, Options>, output: Output): Promise<void> {\n\t\tconst email = input.getArgument('email')\n\t\tconst name = requireNonEmptyTenantName(input.getOption('name'), 'Person')\n\t\tconst passwordFromStdin = input.getOption('password-stdin') === true\n\t\tconst passwordHashFromStdin = input.getOption('password-hash-stdin') === true\n\t\tconst captchaFromStdin = input.getOption('captcha-token-stdin') === true\n\t\tif (captchaFromStdin && (passwordFromStdin || passwordHashFromStdin)) {\n\t\t\tthrow new CliError('Only one value can consume stdin. Combine a --*-stdin option with an environment-backed source instead.', {\n\t\t\t\tcode: 'AMBIGUOUS_STDIN_INPUT',\n\t\t\t\texitCode: ExitCode.InputError,\n\t\t\t})\n\t\t}\n\t\tconst secret = await resolveSecret(\n\t\t\t[\n\t\t\t\t{ name: 'password', stdin: passwordFromStdin, env: input.getOption('password-env') },\n\t\t\t\t{ name: 'password-hash', stdin: passwordHashFromStdin, env: input.getOption('password-hash-env') },\n\t\t\t],\n\t\t\tthis.readStdin,\n\t\t)\n\t\tconst password = secret?.name === 'password' ? secret.value : undefined\n\t\tconst passwordHash = secret?.name === 'password-hash' ? secret.value : undefined\n\t\tif (passwordHash !== undefined) {\n\t\t\tassertBcryptHash(passwordHash)\n\t\t}\n\t\tif (secret === undefined) {\n\t\t\toutput.warn('No password given. The person is created without one and can only sign in after a password reset or through an identity provider.')\n\t\t}\n\t\tconst captchaToken = await resolveCaptchaToken(\n\t\t\t{\n\t\t\t\t'captcha-token': input.getOption('captcha-token'),\n\t\t\t\t'captcha-token-env': input.getOption('captcha-token-env'),\n\t\t\t\t'captcha-token-stdin': input.getOption('captcha-token-stdin'),\n\t\t\t},\n\t\t\tthis.readStdin,\n\t\t\tthis.readEnvironment,\n\t\t)\n\n\t\toutput.info(`Creating person ${email}`)\n\t\tconst person = await this.tenantClientProvider.person().signUp({\n\t\t\temail,\n\t\t\tpassword,\n\t\t\tpasswordHash,\n\t\t\tname,\n\t\t\troles: input.getOption('role'),\n\t\t\tcaptchaToken,\n\t\t})\n\n\t\toutput.info(`Created person ${person.id} with identity ${person.identityId}.`)\n\t\toutput.data<TenantPerson>(person, { human: it => humanText(it.id), quiet: it => it.id })\n\t}\n}\n"],"names":["Command","readStdinText","configureCaptchaTokenOptions","requireNonEmptyTenantName","CliError","ExitCode","resolveSecret","assertBcryptHash","resolveCaptchaToken","humanText"],"mappings":";;;;;;AAoBO,MAAM,kCAAkCA,UAAAA,QAAuB;AAAA,EACrE,YACkB,sBACA,YAAyBC,qBACzB,kBAAwD,CAAA,SAAQ,QAAQ,IAAI,IAAI,GAChG;AACD,UAAA;AAJiB,SAAA,uBAAA;AACA,SAAA,YAAA;AACA,SAAA,kBAAA;AAAA,EAGlB;AAAA,EAEU,UAAU,eAA0D;AAC7E,kBAAc;AAAA,MACb;AAAA,IAAA;AAID,kBAAc,SAAS,OAAO,EAAE,YAAY,mCAAmC;AAC/E,kBAAc,OAAO,MAAM,EAAE,cAAA,EAAgB,YAAY,iCAAiC;AAC1F,kBAAc,OAAO,MAAM,EAAE,WAAA,EAAa,YAAY,oEAAoE;AAC1H,kBAAc,OAAO,gBAAgB,EAAE,UAAA,EAAY,YAAY,yCAAyC;AACxG,kBAAc,OAAO,cAAc,EAAE,cAAA,EAAgB,YAAY,kEAAkE;AACnI,kBAAc,OAAO,qBAAqB,EAAE,UAAA,EAAY,YAAY,gDAAgD;AACpH,kBAAc,OAAO,mBAAmB,EAAE,cAAA,EAAgB;AAAA,MACzD;AAAA,IAAA;AAEDC,gBAAAA,6BAA6B,aAAa;AAAA,EAC3C;AAAA,EAEA,MAAgB,QAAQ,OAA6B,QAA+B;AACnF,UAAM,QAAQ,MAAM,YAAY,OAAO;AACvC,UAAM,OAAOC,aAAAA,0BAA0B,MAAM,UAAU,MAAM,GAAG,QAAQ;AACxE,UAAM,oBAAoB,MAAM,UAAU,gBAAgB,MAAM;AAChE,UAAM,wBAAwB,MAAM,UAAU,qBAAqB,MAAM;AACzE,UAAM,mBAAmB,MAAM,UAAU,qBAAqB,MAAM;AACpE,QAAI,qBAAqB,qBAAqB,wBAAwB;AACrE,YAAM,IAAIC,UAAAA,SAAS,2GAA2G;AAAA,QAC7H,MAAM;AAAA,QACN,UAAUC,UAAAA,SAAS;AAAA,MAAA,CACnB;AAAA,IACF;AACA,UAAM,SAAS,MAAMC,YAAAA;AAAAA,MACpB;AAAA,QACC,EAAE,MAAM,YAAY,OAAO,mBAAmB,KAAK,MAAM,UAAU,cAAc,EAAA;AAAA,QACjF,EAAE,MAAM,iBAAiB,OAAO,uBAAuB,KAAK,MAAM,UAAU,mBAAmB,EAAA;AAAA,MAAE;AAAA,MAElG,KAAK;AAAA,IAAA;AAEN,UAAM,WAAW,QAAQ,SAAS,aAAa,OAAO,QAAQ;AAC9D,UAAM,eAAe,QAAQ,SAAS,kBAAkB,OAAO,QAAQ;AACvE,QAAI,iBAAiB,QAAW;AAC/BC,kBAAAA,iBAAiB,YAAY;AAAA,IAC9B;AACA,QAAI,WAAW,QAAW;AACzB,aAAO,KAAK,mIAAmI;AAAA,IAChJ;AACA,UAAM,eAAe,MAAMC,YAAAA;AAAAA,MAC1B;AAAA,QACC,iBAAiB,MAAM,UAAU,eAAe;AAAA,QAChD,qBAAqB,MAAM,UAAU,mBAAmB;AAAA,QACxD,uBAAuB,MAAM,UAAU,qBAAqB;AAAA,MAAA;AAAA,MAE7D,KAAK;AAAA,MACL,KAAK;AAAA,IAAA;AAGN,WAAO,KAAK,mBAAmB,KAAK,EAAE;AACtC,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAA,EAAS,OAAO;AAAA,MAC9D;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,OAAO,MAAM,UAAU,MAAM;AAAA,MAC7B;AAAA,IAAA,CACA;AAED,WAAO,KAAK,kBAAkB,OAAO,EAAE,kBAAkB,OAAO,UAAU,GAAG;AAC7E,WAAO,KAAmB,QAAQ,EAAE,OAAO,CAAA,OAAMC,aAAAA,UAAU,GAAG,EAAE,GAAG,OAAO,CAAA,OAAM,GAAG,IAAI;AAAA,EACxF;AACD;;"}

package/dist/production/src/commands/tenant/person/TenantPersonCreateCommand.js

@@ -0,0 +1,79 @@
+import { Command, CliError, ExitCode } from "@contember/cli-common";
+import { configureCaptchaTokenOptions, resolveSecret, assertBcryptHash, resolveCaptchaToken } from "./personInput.js";
+import { requireNonEmptyTenantName, humanText } from "../tenantOutput.js";
+import { readStdinText } from "../../../lib/tenant/stdin.js";
+class TenantPersonCreateCommand extends Command {
+  constructor(tenantClientProvider, readStdin = readStdinText, readEnvironment = (name) => process.env[name]) {
+    super();
+    this.tenantClientProvider = tenantClientProvider;
+    this.readStdin = readStdin;
+    this.readEnvironment = readEnvironment;
+  }
+  configure(configuration) {
+    configuration.description(
+      "Create a person (tenant signUp). Consumes the per-IP sign-up rate limit (config rateLimits.signUpPerIp, disabled by default, so bulk creation only throttles once a tenant configures it), verifies a captcha when one is configured, and sends a verification e-mail when signup.requireEmailVerification is on."
+    );
+    configuration.argument("email").description("E-mail address of the new person.");
+    configuration.option("name").valueRequired().description("Display name of the new person.");
+    configuration.option("role").valueArray().description("Global identity role to grant. Repeat the option to grant several.");
+    configuration.option("password-stdin").valueNone().description("Read the plaintext password from stdin.");
+    configuration.option("password-env").valueRequired().description("Read the plaintext password from the named environment variable.");
+    configuration.option("password-hash-stdin").valueNone().description("Read a bcrypt ($2b$) password hash from stdin.");
+    configuration.option("password-hash-env").valueRequired().description(
+      "Read a bcrypt ($2b$) password hash from the named environment variable. Preferred for provisioning — the plaintext never leaves your side."
+    );
+    configureCaptchaTokenOptions(configuration);
+  }
+  async execute(input, output) {
+    const email = input.getArgument("email");
+    const name = requireNonEmptyTenantName(input.getOption("name"), "Person");
+    const passwordFromStdin = input.getOption("password-stdin") === true;
+    const passwordHashFromStdin = input.getOption("password-hash-stdin") === true;
+    const captchaFromStdin = input.getOption("captcha-token-stdin") === true;
+    if (captchaFromStdin && (passwordFromStdin || passwordHashFromStdin)) {
+      throw new CliError("Only one value can consume stdin. Combine a --*-stdin option with an environment-backed source instead.", {
+        code: "AMBIGUOUS_STDIN_INPUT",
+        exitCode: ExitCode.InputError
+      });
+    }
+    const secret = await resolveSecret(
+      [
+        { name: "password", stdin: passwordFromStdin, env: input.getOption("password-env") },
+        { name: "password-hash", stdin: passwordHashFromStdin, env: input.getOption("password-hash-env") }
+      ],
+      this.readStdin
+    );
+    const password = secret?.name === "password" ? secret.value : void 0;
+    const passwordHash = secret?.name === "password-hash" ? secret.value : void 0;
+    if (passwordHash !== void 0) {
+      assertBcryptHash(passwordHash);
+    }
+    if (secret === void 0) {
+      output.warn("No password given. The person is created without one and can only sign in after a password reset or through an identity provider.");
+    }
+    const captchaToken = await resolveCaptchaToken(
+      {
+        "captcha-token": input.getOption("captcha-token"),
+        "captcha-token-env": input.getOption("captcha-token-env"),
+        "captcha-token-stdin": input.getOption("captcha-token-stdin")
+      },
+      this.readStdin,
+      this.readEnvironment
+    );
+    output.info(`Creating person ${email}`);
+    const person = await this.tenantClientProvider.person().signUp({
+      email,
+      password,
+      passwordHash,
+      name,
+      roles: input.getOption("role"),
+      captchaToken
+    });
+    output.info(`Created person ${person.id} with identity ${person.identityId}.`);
+    output.data(person, { human: (it) => humanText(it.id), quiet: (it) => it.id });
+  }
+}
+export {
+  TenantPersonCreateCommand
+};
+//# sourceMappingURL=TenantPersonCreateCommand.js.map

package/dist/production/src/commands/tenant/person/TenantPersonCreateCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantPersonCreateCommand.js","sources":["../../../../../../../packages/cli/src/commands/tenant/person/TenantPersonCreateCommand.ts"],"sourcesContent":["import { CliError, Command, CommandConfiguration, ExitCode, Input, Output } from '@contember/cli-common'\nimport { TenantClientProvider } from '../../../lib/TenantClientProvider.js'\nimport { TenantPerson } from '../../../lib/tenant/clients/TenantPersonClient.js'\nimport { assertBcryptHash, type CaptchaTokenOptions, configureCaptchaTokenOptions, resolveCaptchaToken, resolveSecret } from './personInput.js'\nimport { humanText, requireNonEmptyTenantName } from '../tenantOutput.js'\nimport { readStdinText, StdinReader } from '../../../lib/tenant/stdin.js'\n\ntype Args = {\n\temail: string\n}\n\ntype Options = CaptchaTokenOptions & {\n\tname?: string\n\trole?: string[]\n\t['password-stdin']?: boolean\n\t['password-env']?: string\n\t['password-hash-stdin']?: boolean\n\t['password-hash-env']?: string\n}\n\nexport class TenantPersonCreateCommand extends Command<Args, Options> {\n\tconstructor(\n\t\tprivate readonly tenantClientProvider: TenantClientProvider,\n\t\tprivate readonly readStdin: StdinReader = readStdinText,\n\t\tprivate readonly readEnvironment: (name: string) => string | undefined = name => process.env[name],\n\t) {\n\t\tsuper()\n\t}\n\n\tprotected configure(configuration: CommandConfiguration<Args, Options>): void {\n\t\tconfiguration.description(\n\t\t\t'Create a person (tenant signUp). Consumes the per-IP sign-up rate limit (config rateLimits.signUpPerIp, disabled by default, '\n\t\t\t\t+ 'so bulk creation only throttles once a tenant configures it), verifies a captcha when one is configured, and sends a '\n\t\t\t\t+ 'verification e-mail when signup.requireEmailVerification is on.',\n\t\t)\n\t\tconfiguration.argument('email').description('E-mail address of the new person.')\n\t\tconfiguration.option('name').valueRequired().description('Display name of the new person.')\n\t\tconfiguration.option('role').valueArray().description('Global identity role to grant. Repeat the option to grant several.')\n\t\tconfiguration.option('password-stdin').valueNone().description('Read the plaintext password from stdin.')\n\t\tconfiguration.option('password-env').valueRequired().description('Read the plaintext password from the named environment variable.')\n\t\tconfiguration.option('password-hash-stdin').valueNone().description('Read a bcrypt ($2b$) password hash from stdin.')\n\t\tconfiguration.option('password-hash-env').valueRequired().description(\n\t\t\t'Read a bcrypt ($2b$) password hash from the named environment variable. Preferred for provisioning — the plaintext never leaves your side.',\n\t\t)\n\t\tconfigureCaptchaTokenOptions(configuration)\n\t}\n\n\tprotected async execute(input: Input<Args, Options>, output: Output): Promise<void> {\n\t\tconst email = input.getArgument('email')\n\t\tconst name = requireNonEmptyTenantName(input.getOption('name'), 'Person')\n\t\tconst passwordFromStdin = input.getOption('password-stdin') === true\n\t\tconst passwordHashFromStdin = input.getOption('password-hash-stdin') === true\n\t\tconst captchaFromStdin = input.getOption('captcha-token-stdin') === true\n\t\tif (captchaFromStdin && (passwordFromStdin || passwordHashFromStdin)) {\n\t\t\tthrow new CliError('Only one value can consume stdin. Combine a --*-stdin option with an environment-backed source instead.', {\n\t\t\t\tcode: 'AMBIGUOUS_STDIN_INPUT',\n\t\t\t\texitCode: ExitCode.InputError,\n\t\t\t})\n\t\t}\n\t\tconst secret = await resolveSecret(\n\t\t\t[\n\t\t\t\t{ name: 'password', stdin: passwordFromStdin, env: input.getOption('password-env') },\n\t\t\t\t{ name: 'password-hash', stdin: passwordHashFromStdin, env: input.getOption('password-hash-env') },\n\t\t\t],\n\t\t\tthis.readStdin,\n\t\t)\n\t\tconst password = secret?.name === 'password' ? secret.value : undefined\n\t\tconst passwordHash = secret?.name === 'password-hash' ? secret.value : undefined\n\t\tif (passwordHash !== undefined) {\n\t\t\tassertBcryptHash(passwordHash)\n\t\t}\n\t\tif (secret === undefined) {\n\t\t\toutput.warn('No password given. The person is created without one and can only sign in after a password reset or through an identity provider.')\n\t\t}\n\t\tconst captchaToken = await resolveCaptchaToken(\n\t\t\t{\n\t\t\t\t'captcha-token': input.getOption('captcha-token'),\n\t\t\t\t'captcha-token-env': input.getOption('captcha-token-env'),\n\t\t\t\t'captcha-token-stdin': input.getOption('captcha-token-stdin'),\n\t\t\t},\n\t\t\tthis.readStdin,\n\t\t\tthis.readEnvironment,\n\t\t)\n\n\t\toutput.info(`Creating person ${email}`)\n\t\tconst person = await this.tenantClientProvider.person().signUp({\n\t\t\temail,\n\t\t\tpassword,\n\t\t\tpasswordHash,\n\t\t\tname,\n\t\t\troles: input.getOption('role'),\n\t\t\tcaptchaToken,\n\t\t})\n\n\t\toutput.info(`Created person ${person.id} with identity ${person.identityId}.`)\n\t\toutput.data<TenantPerson>(person, { human: it => humanText(it.id), quiet: it => it.id })\n\t}\n}\n"],"names":[],"mappings":";;;;AAoBO,MAAM,kCAAkC,QAAuB;AAAA,EACrE,YACkB,sBACA,YAAyB,eACzB,kBAAwD,CAAA,SAAQ,QAAQ,IAAI,IAAI,GAChG;AACD,UAAA;AAJiB,SAAA,uBAAA;AACA,SAAA,YAAA;AACA,SAAA,kBAAA;AAAA,EAGlB;AAAA,EAEU,UAAU,eAA0D;AAC7E,kBAAc;AAAA,MACb;AAAA,IAAA;AAID,kBAAc,SAAS,OAAO,EAAE,YAAY,mCAAmC;AAC/E,kBAAc,OAAO,MAAM,EAAE,cAAA,EAAgB,YAAY,iCAAiC;AAC1F,kBAAc,OAAO,MAAM,EAAE,WAAA,EAAa,YAAY,oEAAoE;AAC1H,kBAAc,OAAO,gBAAgB,EAAE,UAAA,EAAY,YAAY,yCAAyC;AACxG,kBAAc,OAAO,cAAc,EAAE,cAAA,EAAgB,YAAY,kEAAkE;AACnI,kBAAc,OAAO,qBAAqB,EAAE,UAAA,EAAY,YAAY,gDAAgD;AACpH,kBAAc,OAAO,mBAAmB,EAAE,cAAA,EAAgB;AAAA,MACzD;AAAA,IAAA;AAED,iCAA6B,aAAa;AAAA,EAC3C;AAAA,EAEA,MAAgB,QAAQ,OAA6B,QAA+B;AACnF,UAAM,QAAQ,MAAM,YAAY,OAAO;AACvC,UAAM,OAAO,0BAA0B,MAAM,UAAU,MAAM,GAAG,QAAQ;AACxE,UAAM,oBAAoB,MAAM,UAAU,gBAAgB,MAAM;AAChE,UAAM,wBAAwB,MAAM,UAAU,qBAAqB,MAAM;AACzE,UAAM,mBAAmB,MAAM,UAAU,qBAAqB,MAAM;AACpE,QAAI,qBAAqB,qBAAqB,wBAAwB;AACrE,YAAM,IAAI,SAAS,2GAA2G;AAAA,QAC7H,MAAM;AAAA,QACN,UAAU,SAAS;AAAA,MAAA,CACnB;AAAA,IACF;AACA,UAAM,SAAS,MAAM;AAAA,MACpB;AAAA,QACC,EAAE,MAAM,YAAY,OAAO,mBAAmB,KAAK,MAAM,UAAU,cAAc,EAAA;AAAA,QACjF,EAAE,MAAM,iBAAiB,OAAO,uBAAuB,KAAK,MAAM,UAAU,mBAAmB,EAAA;AAAA,MAAE;AAAA,MAElG,KAAK;AAAA,IAAA;AAEN,UAAM,WAAW,QAAQ,SAAS,aAAa,OAAO,QAAQ;AAC9D,UAAM,eAAe,QAAQ,SAAS,kBAAkB,OAAO,QAAQ;AACvE,QAAI,iBAAiB,QAAW;AAC/B,uBAAiB,YAAY;AAAA,IAC9B;AACA,QAAI,WAAW,QAAW;AACzB,aAAO,KAAK,mIAAmI;AAAA,IAChJ;AACA,UAAM,eAAe,MAAM;AAAA,MAC1B;AAAA,QACC,iBAAiB,MAAM,UAAU,eAAe;AAAA,QAChD,qBAAqB,MAAM,UAAU,mBAAmB;AAAA,QACxD,uBAAuB,MAAM,UAAU,qBAAqB;AAAA,MAAA;AAAA,MAE7D,KAAK;AAAA,MACL,KAAK;AAAA,IAAA;AAGN,WAAO,KAAK,mBAAmB,KAAK,EAAE;AACtC,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAA,EAAS,OAAO;AAAA,MAC9D;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,OAAO,MAAM,UAAU,MAAM;AAAA,MAC7B;AAAA,IAAA,CACA;AAED,WAAO,KAAK,kBAAkB,OAAO,EAAE,kBAAkB,OAAO,UAAU,GAAG;AAC7E,WAAO,KAAmB,QAAQ,EAAE,OAAO,CAAA,OAAM,UAAU,GAAG,EAAE,GAAG,OAAO,CAAA,OAAM,GAAG,IAAI;AAAA,EACxF;AACD;"}

package/dist/production/src/commands/tenant/person/TenantPersonDisableCommand.cjs

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const cliCommon = require("@contember/cli-common");
+const confirmation = require("../../../lib/tenant/confirmation.cjs");
+const tenantOutput = require("../tenantOutput.cjs");
+class TenantPersonDisableCommand extends cliCommon.Command {
+  constructor(tenantClientProvider) {
+    super();
+    this.tenantClientProvider = tenantClientProvider;
+  }
+  configure(configuration) {
+    configuration.description("Disable a person. They can no longer sign in and all of their API keys are invalidated.");
+    configuration.argument("id").description("Person id.");
+    configuration.option("yes").valueNone().description("Do not ask for confirmation.");
+  }
+  async execute(input, output) {
+    const personId = input.getArgument("id");
+    await confirmation.requireConfirmation({
+      yes: input.getOption("yes") === true,
+      output,
+      warning: `This will disable person ${personId} and invalidate all of their API keys.`
+    });
+    await this.tenantClientProvider.person().disablePerson(personId);
+    output.info(`Person ${personId} was disabled.`);
+    output.data({ personId, disabled: true }, { human: (it) => tenantOutput.humanText(it.personId), quiet: (it) => it.personId });
+  }
+}
+exports.TenantPersonDisableCommand = TenantPersonDisableCommand;
+//# sourceMappingURL=TenantPersonDisableCommand.cjs.map

package/dist/production/src/commands/tenant/person/TenantPersonDisableCommand.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantPersonDisableCommand.cjs","sources":["../../../../../../../packages/cli/src/commands/tenant/person/TenantPersonDisableCommand.ts"],"sourcesContent":["import { Command, CommandConfiguration, Input, Output } from '@contember/cli-common'\nimport { TenantClientProvider } from '../../../lib/TenantClientProvider.js'\nimport { requireConfirmation } from '../../../lib/tenant/confirmation.js'\nimport { humanText } from '../tenantOutput.js'\n\ntype Args = {\n\tid: string\n}\n\ntype Options = {\n\tyes?: boolean\n}\n\ninterface DisableResult {\n\tpersonId: string\n\tdisabled: true\n}\n\nexport class TenantPersonDisableCommand extends Command<Args, Options> {\n\tconstructor(\n\t\tprivate readonly tenantClientProvider: TenantClientProvider,\n\t) {\n\t\tsuper()\n\t}\n\n\tprotected configure(configuration: CommandConfiguration<Args, Options>): void {\n\t\tconfiguration.description('Disable a person. They can no longer sign in and all of their API keys are invalidated.')\n\t\tconfiguration.argument('id').description('Person id.')\n\t\tconfiguration.option('yes').valueNone().description('Do not ask for confirmation.')\n\t}\n\n\tprotected async execute(input: Input<Args, Options>, output: Output): Promise<void> {\n\t\tconst personId = input.getArgument('id')\n\n\t\tawait requireConfirmation({\n\t\t\tyes: input.getOption('yes') === true,\n\t\t\toutput,\n\t\t\twarning: `This will disable person ${personId} and invalidate all of their API keys.`,\n\t\t})\n\n\t\tawait this.tenantClientProvider.person().disablePerson(personId)\n\n\t\toutput.info(`Person ${personId} was disabled.`)\n\t\toutput.data<DisableResult>({ personId, disabled: true }, { human: it => humanText(it.personId), quiet: it => it.personId })\n\t}\n}\n"],"names":["Command","requireConfirmation","humanText"],"mappings":";;;;;AAkBO,MAAM,mCAAmCA,UAAAA,QAAuB;AAAA,EACtE,YACkB,sBAChB;AACD,UAAA;AAFiB,SAAA,uBAAA;AAAA,EAGlB;AAAA,EAEU,UAAU,eAA0D;AAC7E,kBAAc,YAAY,yFAAyF;AACnH,kBAAc,SAAS,IAAI,EAAE,YAAY,YAAY;AACrD,kBAAc,OAAO,KAAK,EAAE,UAAA,EAAY,YAAY,8BAA8B;AAAA,EACnF;AAAA,EAEA,MAAgB,QAAQ,OAA6B,QAA+B;AACnF,UAAM,WAAW,MAAM,YAAY,IAAI;AAEvC,UAAMC,iCAAoB;AAAA,MACzB,KAAK,MAAM,UAAU,KAAK,MAAM;AAAA,MAChC;AAAA,MACA,SAAS,4BAA4B,QAAQ;AAAA,IAAA,CAC7C;AAED,UAAM,KAAK,qBAAqB,OAAA,EAAS,cAAc,QAAQ;AAE/D,WAAO,KAAK,UAAU,QAAQ,gBAAgB;AAC9C,WAAO,KAAoB,EAAE,UAAU,UAAU,KAAA,GAAQ,EAAE,OAAO,CAAA,OAAMC,aAAAA,UAAU,GAAG,QAAQ,GAAG,OAAO,CAAA,OAAM,GAAG,UAAU;AAAA,EAC3H;AACD;;"}

package/dist/production/src/commands/tenant/person/TenantPersonDisableCommand.js

@@ -0,0 +1,29 @@
+import { Command } from "@contember/cli-common";
+import { requireConfirmation } from "../../../lib/tenant/confirmation.js";
+import { humanText } from "../tenantOutput.js";
+class TenantPersonDisableCommand extends Command {
+  constructor(tenantClientProvider) {
+    super();
+    this.tenantClientProvider = tenantClientProvider;
+  }
+  configure(configuration) {
+    configuration.description("Disable a person. They can no longer sign in and all of their API keys are invalidated.");
+    configuration.argument("id").description("Person id.");
+    configuration.option("yes").valueNone().description("Do not ask for confirmation.");
+  }
+  async execute(input, output) {
+    const personId = input.getArgument("id");
+    await requireConfirmation({
+      yes: input.getOption("yes") === true,
+      output,
+      warning: `This will disable person ${personId} and invalidate all of their API keys.`
+    });
+    await this.tenantClientProvider.person().disablePerson(personId);
+    output.info(`Person ${personId} was disabled.`);
+    output.data({ personId, disabled: true }, { human: (it) => humanText(it.personId), quiet: (it) => it.personId });
+  }
+}
+export {
+  TenantPersonDisableCommand
+};
+//# sourceMappingURL=TenantPersonDisableCommand.js.map

package/dist/production/src/commands/tenant/person/TenantPersonDisableCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantPersonDisableCommand.js","sources":["../../../../../../../packages/cli/src/commands/tenant/person/TenantPersonDisableCommand.ts"],"sourcesContent":["import { Command, CommandConfiguration, Input, Output } from '@contember/cli-common'\nimport { TenantClientProvider } from '../../../lib/TenantClientProvider.js'\nimport { requireConfirmation } from '../../../lib/tenant/confirmation.js'\nimport { humanText } from '../tenantOutput.js'\n\ntype Args = {\n\tid: string\n}\n\ntype Options = {\n\tyes?: boolean\n}\n\ninterface DisableResult {\n\tpersonId: string\n\tdisabled: true\n}\n\nexport class TenantPersonDisableCommand extends Command<Args, Options> {\n\tconstructor(\n\t\tprivate readonly tenantClientProvider: TenantClientProvider,\n\t) {\n\t\tsuper()\n\t}\n\n\tprotected configure(configuration: CommandConfiguration<Args, Options>): void {\n\t\tconfiguration.description('Disable a person. They can no longer sign in and all of their API keys are invalidated.')\n\t\tconfiguration.argument('id').description('Person id.')\n\t\tconfiguration.option('yes').valueNone().description('Do not ask for confirmation.')\n\t}\n\n\tprotected async execute(input: Input<Args, Options>, output: Output): Promise<void> {\n\t\tconst personId = input.getArgument('id')\n\n\t\tawait requireConfirmation({\n\t\t\tyes: input.getOption('yes') === true,\n\t\t\toutput,\n\t\t\twarning: `This will disable person ${personId} and invalidate all of their API keys.`,\n\t\t})\n\n\t\tawait this.tenantClientProvider.person().disablePerson(personId)\n\n\t\toutput.info(`Person ${personId} was disabled.`)\n\t\toutput.data<DisableResult>({ personId, disabled: true }, { human: it => humanText(it.personId), quiet: it => it.personId })\n\t}\n}\n"],"names":[],"mappings":";;;AAkBO,MAAM,mCAAmC,QAAuB;AAAA,EACtE,YACkB,sBAChB;AACD,UAAA;AAFiB,SAAA,uBAAA;AAAA,EAGlB;AAAA,EAEU,UAAU,eAA0D;AAC7E,kBAAc,YAAY,yFAAyF;AACnH,kBAAc,SAAS,IAAI,EAAE,YAAY,YAAY;AACrD,kBAAc,OAAO,KAAK,EAAE,UAAA,EAAY,YAAY,8BAA8B;AAAA,EACnF;AAAA,EAEA,MAAgB,QAAQ,OAA6B,QAA+B;AACnF,UAAM,WAAW,MAAM,YAAY,IAAI;AAEvC,UAAM,oBAAoB;AAAA,MACzB,KAAK,MAAM,UAAU,KAAK,MAAM;AAAA,MAChC;AAAA,MACA,SAAS,4BAA4B,QAAQ;AAAA,IAAA,CAC7C;AAED,UAAM,KAAK,qBAAqB,OAAA,EAAS,cAAc,QAAQ;AAE/D,WAAO,KAAK,UAAU,QAAQ,gBAAgB;AAC9C,WAAO,KAAoB,EAAE,UAAU,UAAU,KAAA,GAAQ,EAAE,OAAO,CAAA,OAAM,UAAU,GAAG,QAAQ,GAAG,OAAO,CAAA,OAAM,GAAG,UAAU;AAAA,EAC3H;AACD;"}

package/dist/production/src/commands/tenant/person/TenantPersonListCommand.cjs

@@ -0,0 +1,53 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const cliCommon = require("@contember/cli-common");
+const pagination = require("../../../lib/tenant/input/pagination.cjs");
+class TenantPersonListCommand extends cliCommon.Command {
+  constructor(tenantClientProvider) {
+    super();
+    this.tenantClientProvider = tenantClientProvider;
+  }
+  configure(configuration) {
+    configuration.description(
+      "List persons. A SUPER_ADMIN sees everyone, anyone else only the members of projects they may view members of."
+    );
+    configuration.option("email").valueRequired().description("Filter by e-mail address (case-insensitive substring match).");
+    configuration.option("person-id").valueRequired().description("Filter by person id.");
+    configuration.option("identity-id").valueRequired().description("Filter by identity id.");
+    configuration.option("limit").valueRequired().description(
+      "Page size. The server caps it (default 100, max 1000) — this command never paginates behind your back."
+    );
+    configuration.option("offset").valueRequired().description("Number of persons to skip. Combine with --limit to page through the list.");
+  }
+  async execute(input, output) {
+    const filter = {
+      email: input.getOption("email"),
+      personId: input.getOption("person-id"),
+      identityId: input.getOption("identity-id")
+    };
+    const hasFilter = filter.email !== void 0 || filter.personId !== void 0 || filter.identityId !== void 0;
+    const persons = await this.tenantClientProvider.person().listPersons({
+      filter: hasFilter ? filter : void 0,
+      limit: pagination.parsePaginationLimit(input.getOption("limit")),
+      offset: pagination.parsePaginationOffset(input.getOption("offset"))
+    });
+    if (persons.length === 0) {
+      output.info("No persons matched.");
+    }
+    output.table(
+      [
+        { field: "id", name: "ID" },
+        { field: "email", name: "E-mail" },
+        { field: "name", name: "Name" },
+        { field: "identityId", name: "Identity" },
+        { field: "otpEnabled", name: "TOTP" },
+        { field: "emailOtpEnabled", name: "E-mail OTP" },
+        { field: "emailVerified", name: "Verified" }
+      ],
+      persons,
+      "id"
+    );
+  }
+}
+exports.TenantPersonListCommand = TenantPersonListCommand;
+//# sourceMappingURL=TenantPersonListCommand.cjs.map

package/dist/production/src/commands/tenant/person/TenantPersonListCommand.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantPersonListCommand.cjs","sources":["../../../../../../../packages/cli/src/commands/tenant/person/TenantPersonListCommand.ts"],"sourcesContent":["import { Command, CommandConfiguration, Input, Output } from '@contember/cli-common'\nimport { PersonsFilter } from '@contember/graphql-client-tenant'\nimport { TenantClientProvider } from '../../../lib/TenantClientProvider.js'\nimport { TenantPerson } from '../../../lib/tenant/clients/TenantPersonClient.js'\nimport { parsePaginationLimit, parsePaginationOffset } from '../../../lib/tenant/input/pagination.js'\n\ntype Args = {}\n\ntype Options = {\n\temail?: string\n\t['person-id']?: string\n\t['identity-id']?: string\n\tlimit?: string\n\toffset?: string\n}\n\nexport class TenantPersonListCommand extends Command<Args, Options> {\n\tconstructor(\n\t\tprivate readonly tenantClientProvider: TenantClientProvider,\n\t) {\n\t\tsuper()\n\t}\n\n\tprotected configure(configuration: CommandConfiguration<Args, Options>): void {\n\t\tconfiguration.description(\n\t\t\t'List persons. A SUPER_ADMIN sees everyone, anyone else only the members of projects they may view members of.',\n\t\t)\n\t\tconfiguration.option('email').valueRequired().description('Filter by e-mail address (case-insensitive substring match).')\n\t\tconfiguration.option('person-id').valueRequired().description('Filter by person id.')\n\t\tconfiguration.option('identity-id').valueRequired().description('Filter by identity id.')\n\t\tconfiguration.option('limit').valueRequired().description(\n\t\t\t'Page size. The server caps it (default 100, max 1000) — this command never paginates behind your back.',\n\t\t)\n\t\tconfiguration.option('offset').valueRequired().description('Number of persons to skip. Combine with --limit to page through the list.')\n\t}\n\n\tprotected async execute(input: Input<Args, Options>, output: Output): Promise<void> {\n\t\tconst filter: PersonsFilter = {\n\t\t\temail: input.getOption('email'),\n\t\t\tpersonId: input.getOption('person-id'),\n\t\t\tidentityId: input.getOption('identity-id'),\n\t\t}\n\t\tconst hasFilter = filter.email !== undefined || filter.personId !== undefined || filter.identityId !== undefined\n\n\t\tconst persons = await this.tenantClientProvider.person().listPersons({\n\t\t\tfilter: hasFilter ? filter : undefined,\n\t\t\tlimit: parsePaginationLimit(input.getOption('limit')),\n\t\t\toffset: parsePaginationOffset(input.getOption('offset')),\n\t\t})\n\n\t\tif (persons.length === 0) {\n\t\t\toutput.info('No persons matched.')\n\t\t}\n\t\toutput.table<TenantPerson>(\n\t\t\t[\n\t\t\t\t{ field: 'id', name: 'ID' },\n\t\t\t\t{ field: 'email', name: 'E-mail' },\n\t\t\t\t{ field: 'name', name: 'Name' },\n\t\t\t\t{ field: 'identityId', name: 'Identity' },\n\t\t\t\t{ field: 'otpEnabled', name: 'TOTP' },\n\t\t\t\t{ field: 'emailOtpEnabled', name: 'E-mail OTP' },\n\t\t\t\t{ field: 'emailVerified', name: 'Verified' },\n\t\t\t],\n\t\t\tpersons,\n\t\t\t'id',\n\t\t)\n\t}\n}\n"],"names":["Command","parsePaginationLimit","parsePaginationOffset"],"mappings":";;;;AAgBO,MAAM,gCAAgCA,UAAAA,QAAuB;AAAA,EACnE,YACkB,sBAChB;AACD,UAAA;AAFiB,SAAA,uBAAA;AAAA,EAGlB;AAAA,EAEU,UAAU,eAA0D;AAC7E,kBAAc;AAAA,MACb;AAAA,IAAA;AAED,kBAAc,OAAO,OAAO,EAAE,cAAA,EAAgB,YAAY,8DAA8D;AACxH,kBAAc,OAAO,WAAW,EAAE,cAAA,EAAgB,YAAY,sBAAsB;AACpF,kBAAc,OAAO,aAAa,EAAE,cAAA,EAAgB,YAAY,wBAAwB;AACxF,kBAAc,OAAO,OAAO,EAAE,cAAA,EAAgB;AAAA,MAC7C;AAAA,IAAA;AAED,kBAAc,OAAO,QAAQ,EAAE,cAAA,EAAgB,YAAY,2EAA2E;AAAA,EACvI;AAAA,EAEA,MAAgB,QAAQ,OAA6B,QAA+B;AACnF,UAAM,SAAwB;AAAA,MAC7B,OAAO,MAAM,UAAU,OAAO;AAAA,MAC9B,UAAU,MAAM,UAAU,WAAW;AAAA,MACrC,YAAY,MAAM,UAAU,aAAa;AAAA,IAAA;AAE1C,UAAM,YAAY,OAAO,UAAU,UAAa,OAAO,aAAa,UAAa,OAAO,eAAe;AAEvG,UAAM,UAAU,MAAM,KAAK,qBAAqB,OAAA,EAAS,YAAY;AAAA,MACpE,QAAQ,YAAY,SAAS;AAAA,MAC7B,OAAOC,WAAAA,qBAAqB,MAAM,UAAU,OAAO,CAAC;AAAA,MACpD,QAAQC,WAAAA,sBAAsB,MAAM,UAAU,QAAQ,CAAC;AAAA,IAAA,CACvD;AAED,QAAI,QAAQ,WAAW,GAAG;AACzB,aAAO,KAAK,qBAAqB;AAAA,IAClC;AACA,WAAO;AAAA,MACN;AAAA,QACC,EAAE,OAAO,MAAM,MAAM,KAAA;AAAA,QACrB,EAAE,OAAO,SAAS,MAAM,SAAA;AAAA,QACxB,EAAE,OAAO,QAAQ,MAAM,OAAA;AAAA,QACvB,EAAE,OAAO,cAAc,MAAM,WAAA;AAAA,QAC7B,EAAE,OAAO,cAAc,MAAM,OAAA;AAAA,QAC7B,EAAE,OAAO,mBAAmB,MAAM,aAAA;AAAA,QAClC,EAAE,OAAO,iBAAiB,MAAM,WAAA;AAAA,MAAW;AAAA,MAE5C;AAAA,MACA;AAAA,IAAA;AAAA,EAEF;AACD;;"}

package/dist/production/src/commands/tenant/person/TenantPersonListCommand.js

@@ -0,0 +1,53 @@
+import { Command } from "@contember/cli-common";
+import { parsePaginationOffset, parsePaginationLimit } from "../../../lib/tenant/input/pagination.js";
+class TenantPersonListCommand extends Command {
+  constructor(tenantClientProvider) {
+    super();
+    this.tenantClientProvider = tenantClientProvider;
+  }
+  configure(configuration) {
+    configuration.description(
+      "List persons. A SUPER_ADMIN sees everyone, anyone else only the members of projects they may view members of."
+    );
+    configuration.option("email").valueRequired().description("Filter by e-mail address (case-insensitive substring match).");
+    configuration.option("person-id").valueRequired().description("Filter by person id.");
+    configuration.option("identity-id").valueRequired().description("Filter by identity id.");
+    configuration.option("limit").valueRequired().description(
+      "Page size. The server caps it (default 100, max 1000) — this command never paginates behind your back."
+    );
+    configuration.option("offset").valueRequired().description("Number of persons to skip. Combine with --limit to page through the list.");
+  }
+  async execute(input, output) {
+    const filter = {
+      email: input.getOption("email"),
+      personId: input.getOption("person-id"),
+      identityId: input.getOption("identity-id")
+    };
+    const hasFilter = filter.email !== void 0 || filter.personId !== void 0 || filter.identityId !== void 0;
+    const persons = await this.tenantClientProvider.person().listPersons({
+      filter: hasFilter ? filter : void 0,
+      limit: parsePaginationLimit(input.getOption("limit")),
+      offset: parsePaginationOffset(input.getOption("offset"))
+    });
+    if (persons.length === 0) {
+      output.info("No persons matched.");
+    }
+    output.table(
+      [
+        { field: "id", name: "ID" },
+        { field: "email", name: "E-mail" },
+        { field: "name", name: "Name" },
+        { field: "identityId", name: "Identity" },
+        { field: "otpEnabled", name: "TOTP" },
+        { field: "emailOtpEnabled", name: "E-mail OTP" },
+        { field: "emailVerified", name: "Verified" }
+      ],
+      persons,
+      "id"
+    );
+  }
+}
+export {
+  TenantPersonListCommand
+};
+//# sourceMappingURL=TenantPersonListCommand.js.map

package/dist/production/src/commands/tenant/person/TenantPersonListCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantPersonListCommand.js","sources":["../../../../../../../packages/cli/src/commands/tenant/person/TenantPersonListCommand.ts"],"sourcesContent":["import { Command, CommandConfiguration, Input, Output } from '@contember/cli-common'\nimport { PersonsFilter } from '@contember/graphql-client-tenant'\nimport { TenantClientProvider } from '../../../lib/TenantClientProvider.js'\nimport { TenantPerson } from '../../../lib/tenant/clients/TenantPersonClient.js'\nimport { parsePaginationLimit, parsePaginationOffset } from '../../../lib/tenant/input/pagination.js'\n\ntype Args = {}\n\ntype Options = {\n\temail?: string\n\t['person-id']?: string\n\t['identity-id']?: string\n\tlimit?: string\n\toffset?: string\n}\n\nexport class TenantPersonListCommand extends Command<Args, Options> {\n\tconstructor(\n\t\tprivate readonly tenantClientProvider: TenantClientProvider,\n\t) {\n\t\tsuper()\n\t}\n\n\tprotected configure(configuration: CommandConfiguration<Args, Options>): void {\n\t\tconfiguration.description(\n\t\t\t'List persons. A SUPER_ADMIN sees everyone, anyone else only the members of projects they may view members of.',\n\t\t)\n\t\tconfiguration.option('email').valueRequired().description('Filter by e-mail address (case-insensitive substring match).')\n\t\tconfiguration.option('person-id').valueRequired().description('Filter by person id.')\n\t\tconfiguration.option('identity-id').valueRequired().description('Filter by identity id.')\n\t\tconfiguration.option('limit').valueRequired().description(\n\t\t\t'Page size. The server caps it (default 100, max 1000) — this command never paginates behind your back.',\n\t\t)\n\t\tconfiguration.option('offset').valueRequired().description('Number of persons to skip. Combine with --limit to page through the list.')\n\t}\n\n\tprotected async execute(input: Input<Args, Options>, output: Output): Promise<void> {\n\t\tconst filter: PersonsFilter = {\n\t\t\temail: input.getOption('email'),\n\t\t\tpersonId: input.getOption('person-id'),\n\t\t\tidentityId: input.getOption('identity-id'),\n\t\t}\n\t\tconst hasFilter = filter.email !== undefined || filter.personId !== undefined || filter.identityId !== undefined\n\n\t\tconst persons = await this.tenantClientProvider.person().listPersons({\n\t\t\tfilter: hasFilter ? filter : undefined,\n\t\t\tlimit: parsePaginationLimit(input.getOption('limit')),\n\t\t\toffset: parsePaginationOffset(input.getOption('offset')),\n\t\t})\n\n\t\tif (persons.length === 0) {\n\t\t\toutput.info('No persons matched.')\n\t\t}\n\t\toutput.table<TenantPerson>(\n\t\t\t[\n\t\t\t\t{ field: 'id', name: 'ID' },\n\t\t\t\t{ field: 'email', name: 'E-mail' },\n\t\t\t\t{ field: 'name', name: 'Name' },\n\t\t\t\t{ field: 'identityId', name: 'Identity' },\n\t\t\t\t{ field: 'otpEnabled', name: 'TOTP' },\n\t\t\t\t{ field: 'emailOtpEnabled', name: 'E-mail OTP' },\n\t\t\t\t{ field: 'emailVerified', name: 'Verified' },\n\t\t\t],\n\t\t\tpersons,\n\t\t\t'id',\n\t\t)\n\t}\n}\n"],"names":[],"mappings":";;AAgBO,MAAM,gCAAgC,QAAuB;AAAA,EACnE,YACkB,sBAChB;AACD,UAAA;AAFiB,SAAA,uBAAA;AAAA,EAGlB;AAAA,EAEU,UAAU,eAA0D;AAC7E,kBAAc;AAAA,MACb;AAAA,IAAA;AAED,kBAAc,OAAO,OAAO,EAAE,cAAA,EAAgB,YAAY,8DAA8D;AACxH,kBAAc,OAAO,WAAW,EAAE,cAAA,EAAgB,YAAY,sBAAsB;AACpF,kBAAc,OAAO,aAAa,EAAE,cAAA,EAAgB,YAAY,wBAAwB;AACxF,kBAAc,OAAO,OAAO,EAAE,cAAA,EAAgB;AAAA,MAC7C;AAAA,IAAA;AAED,kBAAc,OAAO,QAAQ,EAAE,cAAA,EAAgB,YAAY,2EAA2E;AAAA,EACvI;AAAA,EAEA,MAAgB,QAAQ,OAA6B,QAA+B;AACnF,UAAM,SAAwB;AAAA,MAC7B,OAAO,MAAM,UAAU,OAAO;AAAA,MAC9B,UAAU,MAAM,UAAU,WAAW;AAAA,MACrC,YAAY,MAAM,UAAU,aAAa;AAAA,IAAA;AAE1C,UAAM,YAAY,OAAO,UAAU,UAAa,OAAO,aAAa,UAAa,OAAO,eAAe;AAEvG,UAAM,UAAU,MAAM,KAAK,qBAAqB,OAAA,EAAS,YAAY;AAAA,MACpE,QAAQ,YAAY,SAAS;AAAA,MAC7B,OAAO,qBAAqB,MAAM,UAAU,OAAO,CAAC;AAAA,MACpD,QAAQ,sBAAsB,MAAM,UAAU,QAAQ,CAAC;AAAA,IAAA,CACvD;AAED,QAAI,QAAQ,WAAW,GAAG;AACzB,aAAO,KAAK,qBAAqB;AAAA,IAClC;AACA,WAAO;AAAA,MACN;AAAA,QACC,EAAE,OAAO,MAAM,MAAM,KAAA;AAAA,QACrB,EAAE,OAAO,SAAS,MAAM,SAAA;AAAA,QACxB,EAAE,OAAO,QAAQ,MAAM,OAAA;AAAA,QACvB,EAAE,OAAO,cAAc,MAAM,WAAA;AAAA,QAC7B,EAAE,OAAO,cAAc,MAAM,OAAA;AAAA,QAC7B,EAAE,OAAO,mBAAmB,MAAM,aAAA;AAAA,QAClC,EAAE,OAAO,iBAAiB,MAAM,WAAA;AAAA,MAAW;AAAA,MAE5C;AAAA,MACA;AAAA,IAAA;AAAA,EAEF;AACD;"}

package/dist/production/src/commands/tenant/person/TenantPersonResetMfaCommand.cjs

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const cliCommon = require("@contember/cli-common");
+const confirmation = require("../../../lib/tenant/confirmation.cjs");
+const tenantOutput = require("../tenantOutput.cjs");
+class TenantPersonResetMfaCommand extends cliCommon.Command {
+  constructor(tenantClientProvider) {
+    super();
+    this.tenantClientProvider = tenantClientProvider;
+  }
+  configure(configuration) {
+    configuration.description(
+      "Reset every MFA factor of a locked-out person: active and pending TOTP, e-mail OTP, and their backup codes. The person can enroll again afterwards. An account-recovery operation, recorded in the auth log."
+    );
+    configuration.argument("id").description("Person id.");
+    configuration.option("yes").valueNone().description("Do not ask for confirmation.");
+  }
+  async execute(input, output) {
+    const personId = input.getArgument("id");
+    await confirmation.requireConfirmation({
+      yes: input.getOption("yes") === true,
+      output,
+      warning: `This will remove TOTP, e-mail OTP and the backup codes of person ${personId}, leaving the account without a second factor.`
+    });
+    await this.tenantClientProvider.person().resetPersonMfa(personId);
+    output.info(`MFA of person ${personId} was reset: TOTP and e-mail OTP disabled, backup codes deleted.`);
+    output.data({
+      personId,
+      mfaReset: true,
+      totpDisabled: true,
+      emailOtpDisabled: true,
+      backupCodesDeleted: true
+    }, { human: (it) => tenantOutput.humanText(it.personId), quiet: (it) => it.personId });
+  }
+}
+exports.TenantPersonResetMfaCommand = TenantPersonResetMfaCommand;
+//# sourceMappingURL=TenantPersonResetMfaCommand.cjs.map

package/dist/production/src/commands/tenant/person/TenantPersonResetMfaCommand.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantPersonResetMfaCommand.cjs","sources":["../../../../../../../packages/cli/src/commands/tenant/person/TenantPersonResetMfaCommand.ts"],"sourcesContent":["import { Command, CommandConfiguration, Input, Output } from '@contember/cli-common'\nimport { TenantClientProvider } from '../../../lib/TenantClientProvider.js'\nimport { requireConfirmation } from '../../../lib/tenant/confirmation.js'\nimport { humanText } from '../tenantOutput.js'\n\ntype Args = {\n\tid: string\n}\n\ntype Options = {\n\tyes?: boolean\n}\n\n/** Spells out every factor the server clears, so an incident report can be written straight off this payload. */\ninterface ResetMfaResult {\n\tpersonId: string\n\tmfaReset: true\n\ttotpDisabled: true\n\temailOtpDisabled: true\n\tbackupCodesDeleted: true\n}\n\nexport class TenantPersonResetMfaCommand extends Command<Args, Options> {\n\tconstructor(\n\t\tprivate readonly tenantClientProvider: TenantClientProvider,\n\t) {\n\t\tsuper()\n\t}\n\n\tprotected configure(configuration: CommandConfiguration<Args, Options>): void {\n\t\tconfiguration.description(\n\t\t\t'Reset every MFA factor of a locked-out person: active and pending TOTP, e-mail OTP, and their backup codes. '\n\t\t\t\t+ 'The person can enroll again afterwards. An account-recovery operation, recorded in the auth log.',\n\t\t)\n\t\tconfiguration.argument('id').description('Person id.')\n\t\tconfiguration.option('yes').valueNone().description('Do not ask for confirmation.')\n\t}\n\n\tprotected async execute(input: Input<Args, Options>, output: Output): Promise<void> {\n\t\tconst personId = input.getArgument('id')\n\n\t\tawait requireConfirmation({\n\t\t\tyes: input.getOption('yes') === true,\n\t\t\toutput,\n\t\t\twarning: `This will remove TOTP, e-mail OTP and the backup codes of person ${personId}, leaving the account without a second factor.`,\n\t\t})\n\n\t\tawait this.tenantClientProvider.person().resetPersonMfa(personId)\n\n\t\toutput.info(`MFA of person ${personId} was reset: TOTP and e-mail OTP disabled, backup codes deleted.`)\n\t\toutput.data<ResetMfaResult>({\n\t\t\tpersonId,\n\t\t\tmfaReset: true,\n\t\t\ttotpDisabled: true,\n\t\t\temailOtpDisabled: true,\n\t\t\tbackupCodesDeleted: true,\n\t\t}, { human: it => humanText(it.personId), quiet: it => it.personId })\n\t}\n}\n"],"names":["Command","requireConfirmation","humanText"],"mappings":";;;;;AAsBO,MAAM,oCAAoCA,UAAAA,QAAuB;AAAA,EACvE,YACkB,sBAChB;AACD,UAAA;AAFiB,SAAA,uBAAA;AAAA,EAGlB;AAAA,EAEU,UAAU,eAA0D;AAC7E,kBAAc;AAAA,MACb;AAAA,IAAA;AAGD,kBAAc,SAAS,IAAI,EAAE,YAAY,YAAY;AACrD,kBAAc,OAAO,KAAK,EAAE,UAAA,EAAY,YAAY,8BAA8B;AAAA,EACnF;AAAA,EAEA,MAAgB,QAAQ,OAA6B,QAA+B;AACnF,UAAM,WAAW,MAAM,YAAY,IAAI;AAEvC,UAAMC,iCAAoB;AAAA,MACzB,KAAK,MAAM,UAAU,KAAK,MAAM;AAAA,MAChC;AAAA,MACA,SAAS,oEAAoE,QAAQ;AAAA,IAAA,CACrF;AAED,UAAM,KAAK,qBAAqB,OAAA,EAAS,eAAe,QAAQ;AAEhE,WAAO,KAAK,iBAAiB,QAAQ,iEAAiE;AACtG,WAAO,KAAqB;AAAA,MAC3B;AAAA,MACA,UAAU;AAAA,MACV,cAAc;AAAA,MACd,kBAAkB;AAAA,MAClB,oBAAoB;AAAA,IAAA,GAClB,EAAE,OAAO,CAAA,OAAMC,aAAAA,UAAU,GAAG,QAAQ,GAAG,OAAO,CAAA,OAAM,GAAG,SAAA,CAAU;AAAA,EACrE;AACD;;"}

package/dist/production/src/commands/tenant/person/TenantPersonResetMfaCommand.js

@@ -0,0 +1,37 @@
+import { Command } from "@contember/cli-common";
+import { requireConfirmation } from "../../../lib/tenant/confirmation.js";
+import { humanText } from "../tenantOutput.js";
+class TenantPersonResetMfaCommand extends Command {
+  constructor(tenantClientProvider) {
+    super();
+    this.tenantClientProvider = tenantClientProvider;
+  }
+  configure(configuration) {
+    configuration.description(
+      "Reset every MFA factor of a locked-out person: active and pending TOTP, e-mail OTP, and their backup codes. The person can enroll again afterwards. An account-recovery operation, recorded in the auth log."
+    );
+    configuration.argument("id").description("Person id.");
+    configuration.option("yes").valueNone().description("Do not ask for confirmation.");
+  }
+  async execute(input, output) {
+    const personId = input.getArgument("id");
+    await requireConfirmation({
+      yes: input.getOption("yes") === true,
+      output,
+      warning: `This will remove TOTP, e-mail OTP and the backup codes of person ${personId}, leaving the account without a second factor.`
+    });
+    await this.tenantClientProvider.person().resetPersonMfa(personId);
+    output.info(`MFA of person ${personId} was reset: TOTP and e-mail OTP disabled, backup codes deleted.`);
+    output.data({
+      personId,
+      mfaReset: true,
+      totpDisabled: true,
+      emailOtpDisabled: true,
+      backupCodesDeleted: true
+    }, { human: (it) => humanText(it.personId), quiet: (it) => it.personId });
+  }
+}
+export {
+  TenantPersonResetMfaCommand
+};
+//# sourceMappingURL=TenantPersonResetMfaCommand.js.map

package/dist/production/src/commands/tenant/person/TenantPersonResetMfaCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantPersonResetMfaCommand.js","sources":["../../../../../../../packages/cli/src/commands/tenant/person/TenantPersonResetMfaCommand.ts"],"sourcesContent":["import { Command, CommandConfiguration, Input, Output } from '@contember/cli-common'\nimport { TenantClientProvider } from '../../../lib/TenantClientProvider.js'\nimport { requireConfirmation } from '../../../lib/tenant/confirmation.js'\nimport { humanText } from '../tenantOutput.js'\n\ntype Args = {\n\tid: string\n}\n\ntype Options = {\n\tyes?: boolean\n}\n\n/** Spells out every factor the server clears, so an incident report can be written straight off this payload. */\ninterface ResetMfaResult {\n\tpersonId: string\n\tmfaReset: true\n\ttotpDisabled: true\n\temailOtpDisabled: true\n\tbackupCodesDeleted: true\n}\n\nexport class TenantPersonResetMfaCommand extends Command<Args, Options> {\n\tconstructor(\n\t\tprivate readonly tenantClientProvider: TenantClientProvider,\n\t) {\n\t\tsuper()\n\t}\n\n\tprotected configure(configuration: CommandConfiguration<Args, Options>): void {\n\t\tconfiguration.description(\n\t\t\t'Reset every MFA factor of a locked-out person: active and pending TOTP, e-mail OTP, and their backup codes. '\n\t\t\t\t+ 'The person can enroll again afterwards. An account-recovery operation, recorded in the auth log.',\n\t\t)\n\t\tconfiguration.argument('id').description('Person id.')\n\t\tconfiguration.option('yes').valueNone().description('Do not ask for confirmation.')\n\t}\n\n\tprotected async execute(input: Input<Args, Options>, output: Output): Promise<void> {\n\t\tconst personId = input.getArgument('id')\n\n\t\tawait requireConfirmation({\n\t\t\tyes: input.getOption('yes') === true,\n\t\t\toutput,\n\t\t\twarning: `This will remove TOTP, e-mail OTP and the backup codes of person ${personId}, leaving the account without a second factor.`,\n\t\t})\n\n\t\tawait this.tenantClientProvider.person().resetPersonMfa(personId)\n\n\t\toutput.info(`MFA of person ${personId} was reset: TOTP and e-mail OTP disabled, backup codes deleted.`)\n\t\toutput.data<ResetMfaResult>({\n\t\t\tpersonId,\n\t\t\tmfaReset: true,\n\t\t\ttotpDisabled: true,\n\t\t\temailOtpDisabled: true,\n\t\t\tbackupCodesDeleted: true,\n\t\t}, { human: it => humanText(it.personId), quiet: it => it.personId })\n\t}\n}\n"],"names":[],"mappings":";;;AAsBO,MAAM,oCAAoC,QAAuB;AAAA,EACvE,YACkB,sBAChB;AACD,UAAA;AAFiB,SAAA,uBAAA;AAAA,EAGlB;AAAA,EAEU,UAAU,eAA0D;AAC7E,kBAAc;AAAA,MACb;AAAA,IAAA;AAGD,kBAAc,SAAS,IAAI,EAAE,YAAY,YAAY;AACrD,kBAAc,OAAO,KAAK,EAAE,UAAA,EAAY,YAAY,8BAA8B;AAAA,EACnF;AAAA,EAEA,MAAgB,QAAQ,OAA6B,QAA+B;AACnF,UAAM,WAAW,MAAM,YAAY,IAAI;AAEvC,UAAM,oBAAoB;AAAA,MACzB,KAAK,MAAM,UAAU,KAAK,MAAM;AAAA,MAChC;AAAA,MACA,SAAS,oEAAoE,QAAQ;AAAA,IAAA,CACrF;AAED,UAAM,KAAK,qBAAqB,OAAA,EAAS,eAAe,QAAQ;AAEhE,WAAO,KAAK,iBAAiB,QAAQ,iEAAiE;AACtG,WAAO,KAAqB;AAAA,MAC3B;AAAA,MACA,UAAU;AAAA,MACV,cAAc;AAAA,MACd,kBAAkB;AAAA,MAClB,oBAAoB;AAAA,IAAA,GAClB,EAAE,OAAO,CAAA,OAAM,UAAU,GAAG,QAAQ,GAAG,OAAO,CAAA,OAAM,GAAG,SAAA,CAAU;AAAA,EACrE;AACD;"}