@contember/cli 2.2.0-alpha.2 → 2.2.0-alpha.4

package/dist/development/src/commands/tenant/member/membershipInput.js

@@ -0,0 +1,109 @@
+import { CliError, ExitCode } from "@contember/cli-common";
+const MEMBERSHIPS_JSON_EXAMPLE = '[{"role":"editor","variables":[{"name":"locale","values":["cs","en"]}]}]';
+const configureMembershipOptions = (configuration, { roleDescription = "Membership role without variables. Repeat for several roles." } = {}) => {
+  configuration.option("role").valueArray().description(roleDescription);
+  configuration.option("memberships").valueRequired().description(
+    `Memberships as JSON, e.g. '${MEMBERSHIPS_JSON_EXAMPLE}'. Not combinable with --role.`
+  );
+  configuration.option("memberships-stdin").valueNone().description("Read the memberships JSON from stdin instead of --memberships.");
+};
+const readMembershipInputSource = (input) => ({
+  roles: input.getOption("role"),
+  json: input.getOption("memberships"),
+  fromStdin: input.getOption("memberships-stdin") === true
+});
+const resolveMemberships = async (source, readStdin) => {
+  const roles = source.roles ?? [];
+  const hasJson = source.json !== void 0;
+  if (hasJson && source.fromStdin) {
+    throw membershipInputError("Pass the memberships either as --memberships or as --memberships-stdin, not both.");
+  }
+  if (roles.length > 0 && (hasJson || source.fromStdin)) {
+    throw membershipInputError("Pass the memberships either as --role or as JSON (--memberships / --memberships-stdin), not both.");
+  }
+  if (roles.length > 0) {
+    return roles.map((role) => ({ role, variables: [] }));
+  }
+  if (hasJson) {
+    return parseMemberships(source.json ?? "", "--memberships");
+  }
+  if (source.fromStdin) {
+    return parseMemberships(await readStdin(), "stdin");
+  }
+  throw membershipInputError(
+    `No memberships given. Pass --role <role> for a role without variables, or the full structure as --memberships '${MEMBERSHIPS_JSON_EXAMPLE}'.`
+  );
+};
+const resolveNonEmptyMemberships = async (source, readStdin) => {
+  const memberships = await resolveMemberships(source, readStdin);
+  if (memberships.length === 0) {
+    throw membershipInputError("At least one membership is required for this operation.");
+  }
+  return memberships;
+};
+const membershipInputError = (message, details) => new CliError(message, { code: "INVALID_MEMBERSHIPS", exitCode: ExitCode.InputError, details });
+const parseMemberships = (json, origin) => {
+  if (json.trim() === "") {
+    throw membershipInputError(`Empty memberships JSON read from ${origin}.`);
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(json);
+  } catch (e) {
+    throw membershipInputError(`Memberships read from ${origin} are not valid JSON: ${e instanceof Error ? e.message : String(e)}`);
+  }
+  if (!Array.isArray(parsed)) {
+    throw membershipInputError(`Memberships read from ${origin} must be a JSON array, got ${describeJson(parsed)}.`);
+  }
+  return parsed.map((it, index) => parseMembership(it, `${origin}[${index}]`));
+};
+const parseMembership = (value, path) => {
+  const record = asRecord(value, path);
+  assertNoUnknownKeys(record, ["role", "variables"], path);
+  const role = record.role;
+  if (typeof role !== "string" || role === "") {
+    throw membershipInputError(`${path}.role must be a non-empty string.`);
+  }
+  const variables = record.variables;
+  if (variables === void 0 || variables === null) {
+    return { role, variables: [] };
+  }
+  if (!Array.isArray(variables)) {
+    throw membershipInputError(`${path}.variables must be an array, got ${describeJson(variables)}.`);
+  }
+  return { role, variables: variables.map((it, index) => parseVariable(it, `${path}.variables[${index}]`)) };
+};
+const parseVariable = (value, path) => {
+  const record = asRecord(value, path);
+  assertNoUnknownKeys(record, ["name", "values"], path);
+  const name = record.name;
+  if (typeof name !== "string" || name === "") {
+    throw membershipInputError(`${path}.name must be a non-empty string.`);
+  }
+  const values = record.values;
+  if (!Array.isArray(values) || values.some((it) => typeof it !== "string")) {
+    throw membershipInputError(`${path}.values must be an array of strings.`);
+  }
+  return { name, values: values.filter((it) => typeof it === "string") };
+};
+const asRecord = (value, path) => {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw membershipInputError(`${path} must be an object, got ${describeJson(value)}.`);
+  }
+  return { ...value };
+};
+const assertNoUnknownKeys = (record, known, path) => {
+  const unknown = Object.keys(record).filter((it) => !known.includes(it));
+  if (unknown.length > 0) {
+    throw membershipInputError(`${path} has unknown ${unknown.length === 1 ? "key" : "keys"} ${unknown.join(", ")}. Allowed: ${known.join(", ")}.`);
+  }
+};
+const describeJson = (value) => value === null ? "null" : Array.isArray(value) ? "an array" : typeof value;
+export {
+  MEMBERSHIPS_JSON_EXAMPLE,
+  configureMembershipOptions,
+  readMembershipInputSource,
+  resolveMemberships,
+  resolveNonEmptyMemberships
+};
+//# sourceMappingURL=membershipInput.js.map

package/dist/development/src/commands/tenant/member/membershipInput.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"membershipInput.js","sources":["../../../../../../../packages/cli/src/commands/tenant/member/membershipInput.ts"],"sourcesContent":["import { CliError, CommandConfiguration, ExitCode } from '@contember/cli-common'\nimport type { MembershipInput } from '@contember/graphql-client-tenant'\nimport type { StdinReader } from '../../../lib/tenant/stdin.js'\n\n/** `Arguments` is not part of the `@contember/cli-common` public surface, so the widest form is spelled out here. */\ntype AnyArguments = Record<string, string | string[] | undefined>\n\n/**\n * The options every command taking `memberships: [MembershipInput!]!` declares.\n *\n * There are deliberately exactly two ways in, and no third one:\n *\n * - `--role <role>`, repeatable — a membership with no variables, which is the whole shape a human\n *   needs for `--role editor`;\n * - `--memberships <json>` / `--memberships-stdin` — the complete `MembershipInput[]` structure, which is\n *   what a script or an agent already holds.\n *\n * A compact string syntax for variables (`editor:locale=en,cs`) is intentionally not offered: it breaks\n * the moment a value contains the separator, and the JSON form costs an agent nothing.\n */\nexport type MembershipOptions = {\n\trole?: string[]\n\tmemberships?: string\n\t['memberships-stdin']?: boolean\n}\n\nexport const MEMBERSHIPS_JSON_EXAMPLE = '[{\"role\":\"editor\",\"variables\":[{\"name\":\"locale\",\"values\":[\"cs\",\"en\"]}]}]'\n\n/** `roleDescription` exists for `tenant api-key create`, where `--role` also names a global tenant role. */\nexport const configureMembershipOptions = (\n\tconfiguration: CommandConfiguration<AnyArguments, MembershipOptions>,\n\t{ roleDescription = 'Membership role without variables. Repeat for several roles.' }: { roleDescription?: string } = {},\n): void => {\n\tconfiguration.option('role').valueArray().description(roleDescription)\n\tconfiguration.option('memberships').valueRequired().description(\n\t\t`Memberships as JSON, e.g. '${MEMBERSHIPS_JSON_EXAMPLE}'. Not combinable with --role.`,\n\t)\n\tconfiguration.option('memberships-stdin').valueNone().description('Read the memberships JSON from stdin instead of --memberships.')\n}\n\n/** The raw values of {@link MembershipOptions}, read by the command so no generic `Input` has to be passed around. */\nexport interface MembershipInputSource {\n\troles: string[] | undefined\n\tjson: string | undefined\n\tfromStdin: boolean\n}\n\nexport const readMembershipInputSource = (input: {\n\tgetOption(name: 'role'): string[] | undefined\n\tgetOption(name: 'memberships'): string | undefined\n\tgetOption(name: 'memberships-stdin'): boolean | undefined\n}): MembershipInputSource => ({\n\troles: input.getOption('role'),\n\tjson: input.getOption('memberships'),\n\tfromStdin: input.getOption('memberships-stdin') === true,\n})\n\nexport const resolveMemberships = async (source: MembershipInputSource, readStdin: StdinReader): Promise<MembershipInput[]> => {\n\tconst roles = source.roles ?? []\n\tconst hasJson = source.json !== undefined\n\tif (hasJson && source.fromStdin) {\n\t\tthrow membershipInputError('Pass the memberships either as --memberships or as --memberships-stdin, not both.')\n\t}\n\tif (roles.length > 0 && (hasJson || source.fromStdin)) {\n\t\tthrow membershipInputError('Pass the memberships either as --role or as JSON (--memberships / --memberships-stdin), not both.')\n\t}\n\tif (roles.length > 0) {\n\t\treturn roles.map(role => ({ role, variables: [] }))\n\t}\n\tif (hasJson) {\n\t\treturn parseMemberships(source.json ?? '', '--memberships')\n\t}\n\tif (source.fromStdin) {\n\t\treturn parseMemberships(await readStdin(), 'stdin')\n\t}\n\tthrow membershipInputError(\n\t\t`No memberships given. Pass --role <role> for a role without variables, or the full structure as --memberships '${MEMBERSHIPS_JSON_EXAMPLE}'.`,\n\t)\n}\n\n/** Creation operations must not create an identity with no project access. */\nexport const resolveNonEmptyMemberships = async (source: MembershipInputSource, readStdin: StdinReader): Promise<MembershipInput[]> => {\n\tconst memberships = await resolveMemberships(source, readStdin)\n\tif (memberships.length === 0) {\n\t\tthrow membershipInputError('At least one membership is required for this operation.')\n\t}\n\treturn memberships\n}\n\nconst membershipInputError = (message: string, details?: unknown): CliError =>\n\tnew CliError(message, { code: 'INVALID_MEMBERSHIPS', exitCode: ExitCode.InputError, details })\n\nconst parseMemberships = (json: string, origin: string): MembershipInput[] => {\n\tif (json.trim() === '') {\n\t\tthrow membershipInputError(`Empty memberships JSON read from ${origin}.`)\n\t}\n\tlet parsed: unknown\n\ttry {\n\t\tparsed = JSON.parse(json)\n\t} catch (e) {\n\t\tthrow membershipInputError(`Memberships read from ${origin} are not valid JSON: ${e instanceof Error ? e.message : String(e)}`)\n\t}\n\tif (!Array.isArray(parsed)) {\n\t\tthrow membershipInputError(`Memberships read from ${origin} must be a JSON array, got ${describeJson(parsed)}.`)\n\t}\n\treturn parsed.map((it, index) => parseMembership(it, `${origin}[${index}]`))\n}\n\nconst parseMembership = (value: unknown, path: string): MembershipInput => {\n\tconst record = asRecord(value, path)\n\tassertNoUnknownKeys(record, ['role', 'variables'], path)\n\tconst role = record.role\n\tif (typeof role !== 'string' || role === '') {\n\t\tthrow membershipInputError(`${path}.role must be a non-empty string.`)\n\t}\n\tconst variables = record.variables\n\tif (variables === undefined || variables === null) {\n\t\treturn { role, variables: [] }\n\t}\n\tif (!Array.isArray(variables)) {\n\t\tthrow membershipInputError(`${path}.variables must be an array, got ${describeJson(variables)}.`)\n\t}\n\treturn { role, variables: variables.map((it, index) => parseVariable(it, `${path}.variables[${index}]`)) }\n}\n\nconst parseVariable = (value: unknown, path: string): { name: string; values: string[] } => {\n\tconst record = asRecord(value, path)\n\tassertNoUnknownKeys(record, ['name', 'values'], path)\n\tconst name = record.name\n\tif (typeof name !== 'string' || name === '') {\n\t\tthrow membershipInputError(`${path}.name must be a non-empty string.`)\n\t}\n\tconst values = record.values\n\tif (!Array.isArray(values) || values.some(it => typeof it !== 'string')) {\n\t\tthrow membershipInputError(`${path}.values must be an array of strings.`)\n\t}\n\treturn { name, values: values.filter(it => typeof it === 'string') }\n}\n\nconst asRecord = (value: unknown, path: string): Record<string, unknown> => {\n\tif (typeof value !== 'object' || value === null || Array.isArray(value)) {\n\t\tthrow membershipInputError(`${path} must be an object, got ${describeJson(value)}.`)\n\t}\n\treturn { ...value }\n}\n\n// a typo'd key would otherwise be dropped without a word, which is the worst possible failure for a script\nconst assertNoUnknownKeys = (record: Record<string, unknown>, known: string[], path: string): void => {\n\tconst unknown = Object.keys(record).filter(it => !known.includes(it))\n\tif (unknown.length > 0) {\n\t\tthrow membershipInputError(`${path} has unknown ${unknown.length === 1 ? 'key' : 'keys'} ${unknown.join(', ')}. Allowed: ${known.join(', ')}.`)\n\t}\n}\n\nconst describeJson = (value: unknown): string => (value === null ? 'null' : Array.isArray(value) ? 'an array' : typeof value)\n"],"names":[],"mappings":";AA0BO,MAAM,2BAA2B;AAGjC,MAAM,6BAA6B,CACzC,eACA,EAAE,kBAAkB,+DAAA,IAAiG,CAAA,MAC3G;AACV,gBAAc,OAAO,MAAM,EAAE,WAAA,EAAa,YAAY,eAAe;AACrE,gBAAc,OAAO,aAAa,EAAE,cAAA,EAAgB;AAAA,IACnD,8BAA8B,wBAAwB;AAAA,EAAA;AAEvD,gBAAc,OAAO,mBAAmB,EAAE,UAAA,EAAY,YAAY,gEAAgE;AACnI;AASO,MAAM,4BAA4B,CAAC,WAIZ;AAAA,EAC7B,OAAO,MAAM,UAAU,MAAM;AAAA,EAC7B,MAAM,MAAM,UAAU,aAAa;AAAA,EACnC,WAAW,MAAM,UAAU,mBAAmB,MAAM;AACrD;AAEO,MAAM,qBAAqB,OAAO,QAA+B,cAAuD;AAC9H,QAAM,QAAQ,OAAO,SAAS,CAAA;AAC9B,QAAM,UAAU,OAAO,SAAS;AAChC,MAAI,WAAW,OAAO,WAAW;AAChC,UAAM,qBAAqB,mFAAmF;AAAA,EAC/G;AACA,MAAI,MAAM,SAAS,MAAM,WAAW,OAAO,YAAY;AACtD,UAAM,qBAAqB,mGAAmG;AAAA,EAC/H;AACA,MAAI,MAAM,SAAS,GAAG;AACrB,WAAO,MAAM,IAAI,CAAA,UAAS,EAAE,MAAM,WAAW,CAAA,IAAK;AAAA,EACnD;AACA,MAAI,SAAS;AACZ,WAAO,iBAAiB,OAAO,QAAQ,IAAI,eAAe;AAAA,EAC3D;AACA,MAAI,OAAO,WAAW;AACrB,WAAO,iBAAiB,MAAM,UAAA,GAAa,OAAO;AAAA,EACnD;AACA,QAAM;AAAA,IACL,kHAAkH,wBAAwB;AAAA,EAAA;AAE5I;AAGO,MAAM,6BAA6B,OAAO,QAA+B,cAAuD;AACtI,QAAM,cAAc,MAAM,mBAAmB,QAAQ,SAAS;AAC9D,MAAI,YAAY,WAAW,GAAG;AAC7B,UAAM,qBAAqB,yDAAyD;AAAA,EACrF;AACA,SAAO;AACR;AAEA,MAAM,uBAAuB,CAAC,SAAiB,YAC9C,IAAI,SAAS,SAAS,EAAE,MAAM,uBAAuB,UAAU,SAAS,YAAY,SAAS;AAE9F,MAAM,mBAAmB,CAAC,MAAc,WAAsC;AAC7E,MAAI,KAAK,KAAA,MAAW,IAAI;AACvB,UAAM,qBAAqB,oCAAoC,MAAM,GAAG;AAAA,EACzE;AACA,MAAI;AACJ,MAAI;AACH,aAAS,KAAK,MAAM,IAAI;AAAA,EACzB,SAAS,GAAG;AACX,UAAM,qBAAqB,yBAAyB,MAAM,wBAAwB,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC,CAAC,EAAE;AAAA,EAC/H;AACA,MAAI,CAAC,MAAM,QAAQ,MAAM,GAAG;AAC3B,UAAM,qBAAqB,yBAAyB,MAAM,8BAA8B,aAAa,MAAM,CAAC,GAAG;AAAA,EAChH;AACA,SAAO,OAAO,IAAI,CAAC,IAAI,UAAU,gBAAgB,IAAI,GAAG,MAAM,IAAI,KAAK,GAAG,CAAC;AAC5E;AAEA,MAAM,kBAAkB,CAAC,OAAgB,SAAkC;AAC1E,QAAM,SAAS,SAAS,OAAO,IAAI;AACnC,sBAAoB,QAAQ,CAAC,QAAQ,WAAW,GAAG,IAAI;AACvD,QAAM,OAAO,OAAO;AACpB,MAAI,OAAO,SAAS,YAAY,SAAS,IAAI;AAC5C,UAAM,qBAAqB,GAAG,IAAI,mCAAmC;AAAA,EACtE;AACA,QAAM,YAAY,OAAO;AACzB,MAAI,cAAc,UAAa,cAAc,MAAM;AAClD,WAAO,EAAE,MAAM,WAAW,GAAC;AAAA,EAC5B;AACA,MAAI,CAAC,MAAM,QAAQ,SAAS,GAAG;AAC9B,UAAM,qBAAqB,GAAG,IAAI,oCAAoC,aAAa,SAAS,CAAC,GAAG;AAAA,EACjG;AACA,SAAO,EAAE,MAAM,WAAW,UAAU,IAAI,CAAC,IAAI,UAAU,cAAc,IAAI,GAAG,IAAI,cAAc,KAAK,GAAG,CAAC,EAAA;AACxG;AAEA,MAAM,gBAAgB,CAAC,OAAgB,SAAqD;AAC3F,QAAM,SAAS,SAAS,OAAO,IAAI;AACnC,sBAAoB,QAAQ,CAAC,QAAQ,QAAQ,GAAG,IAAI;AACpD,QAAM,OAAO,OAAO;AACpB,MAAI,OAAO,SAAS,YAAY,SAAS,IAAI;AAC5C,UAAM,qBAAqB,GAAG,IAAI,mCAAmC;AAAA,EACtE;AACA,QAAM,SAAS,OAAO;AACtB,MAAI,CAAC,MAAM,QAAQ,MAAM,KAAK,OAAO,KAAK,CAAA,OAAM,OAAO,OAAO,QAAQ,GAAG;AACxE,UAAM,qBAAqB,GAAG,IAAI,sCAAsC;AAAA,EACzE;AACA,SAAO,EAAE,MAAM,QAAQ,OAAO,OAAO,CAAA,OAAM,OAAO,OAAO,QAAQ,EAAA;AAClE;AAEA,MAAM,WAAW,CAAC,OAAgB,SAA0C;AAC3E,MAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,GAAG;AACxE,UAAM,qBAAqB,GAAG,IAAI,2BAA2B,aAAa,KAAK,CAAC,GAAG;AAAA,EACpF;AACA,SAAO,EAAE,GAAG,MAAA;AACb;AAGA,MAAM,sBAAsB,CAAC,QAAiC,OAAiB,SAAuB;AACrG,QAAM,UAAU,OAAO,KAAK,MAAM,EAAE,OAAO,CAAA,OAAM,CAAC,MAAM,SAAS,EAAE,CAAC;AACpE,MAAI,QAAQ,SAAS,GAAG;AACvB,UAAM,qBAAqB,GAAG,IAAI,gBAAgB,QAAQ,WAAW,IAAI,QAAQ,MAAM,IAAI,QAAQ,KAAK,IAAI,CAAC,cAAc,MAAM,KAAK,IAAI,CAAC,GAAG;AAAA,EAC/I;AACD;AAEA,MAAM,eAAe,CAAC,UAA4B,UAAU,OAAO,SAAS,MAAM,QAAQ,KAAK,IAAI,aAAa,OAAO;"}

package/dist/development/src/commands/tenant/person/TenantIdentityRoleAddCommand.cjs

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const cliCommon = require("@contember/cli-common");
+const tenantOutput = require("../tenantOutput.cjs");
+class TenantIdentityRoleAddCommand extends cliCommon.Command {
+  constructor(tenantClientProvider) {
+    super();
+    this.tenantClientProvider = tenantClientProvider;
+  }
+  configure(configuration) {
+    configuration.description("Grant global (project-independent) roles to an identity.");
+    configuration.argument("identityId").description('Identity id, as listed by "tenant person list".');
+    configuration.argument("role").variadic().description("One or more global roles to grant.");
+  }
+  async execute(input, output) {
+    const identityId = input.getArgument("identityId");
+    const added = input.getArgument("role");
+    const roles = await this.tenantClientProvider.person().addGlobalIdentityRoles(identityId, added);
+    output.info(`Granted ${added.join(", ")} to identity ${identityId}.`);
+    output.data(
+      { identityId, added, roles },
+      { human: (it) => it.roles === null ? tenantOutput.humanText(it.identityId) : it.roles.map(tenantOutput.humanText).join(", "), quiet: (it) => it.identityId }
+    );
+  }
+}
+exports.TenantIdentityRoleAddCommand = TenantIdentityRoleAddCommand;
+//# sourceMappingURL=TenantIdentityRoleAddCommand.cjs.map

package/dist/development/src/commands/tenant/person/TenantIdentityRoleAddCommand.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantIdentityRoleAddCommand.cjs","sources":["../../../../../../../packages/cli/src/commands/tenant/person/TenantIdentityRoleAddCommand.ts"],"sourcesContent":["import { Command, CommandConfiguration, Input, Output } from '@contember/cli-common'\nimport { TenantClientProvider } from '../../../lib/TenantClientProvider.js'\nimport { humanText } from '../tenantOutput.js'\n\ntype Args = {\n\tidentityId: string\n\trole: string[]\n}\n\ntype Options = {}\n\ninterface IdentityRolesResult {\n\tidentityId: string\n\tadded: string[]\n\t/** All global roles of the identity after the change, or null when the token may not read them. */\n\troles: string[] | null\n}\n\nexport class TenantIdentityRoleAddCommand extends Command<Args, Options> {\n\tconstructor(\n\t\tprivate readonly tenantClientProvider: TenantClientProvider,\n\t) {\n\t\tsuper()\n\t}\n\n\tprotected configure(configuration: CommandConfiguration<Args, Options>): void {\n\t\tconfiguration.description('Grant global (project-independent) roles to an identity.')\n\t\tconfiguration.argument('identityId').description('Identity id, as listed by \"tenant person list\".')\n\t\tconfiguration.argument('role').variadic().description('One or more global roles to grant.')\n\t}\n\n\tprotected async execute(input: Input<Args, Options>, output: Output): Promise<void> {\n\t\tconst identityId = input.getArgument('identityId')\n\t\tconst added = input.getArgument('role')\n\n\t\tconst roles = await this.tenantClientProvider.person().addGlobalIdentityRoles(identityId, added)\n\n\t\toutput.info(`Granted ${added.join(', ')} to identity ${identityId}.`)\n\t\toutput.data<IdentityRolesResult>(\n\t\t\t{ identityId, added, roles },\n\t\t\t{ human: it => it.roles === null ? humanText(it.identityId) : it.roles.map(humanText).join(', '), quiet: it => it.identityId },\n\t\t)\n\t}\n}\n"],"names":["Command","humanText"],"mappings":";;;;AAkBO,MAAM,qCAAqCA,UAAAA,QAAuB;AAAA,EACxE,YACkB,sBAChB;AACD,UAAA;AAFiB,SAAA,uBAAA;AAAA,EAGlB;AAAA,EAEU,UAAU,eAA0D;AAC7E,kBAAc,YAAY,0DAA0D;AACpF,kBAAc,SAAS,YAAY,EAAE,YAAY,iDAAiD;AAClG,kBAAc,SAAS,MAAM,EAAE,SAAA,EAAW,YAAY,oCAAoC;AAAA,EAC3F;AAAA,EAEA,MAAgB,QAAQ,OAA6B,QAA+B;AACnF,UAAM,aAAa,MAAM,YAAY,YAAY;AACjD,UAAM,QAAQ,MAAM,YAAY,MAAM;AAEtC,UAAM,QAAQ,MAAM,KAAK,qBAAqB,SAAS,uBAAuB,YAAY,KAAK;AAE/F,WAAO,KAAK,WAAW,MAAM,KAAK,IAAI,CAAC,gBAAgB,UAAU,GAAG;AACpE,WAAO;AAAA,MACN,EAAE,YAAY,OAAO,MAAA;AAAA,MACrB,EAAE,OAAO,CAAA,OAAM,GAAG,UAAU,OAAOC,aAAAA,UAAU,GAAG,UAAU,IAAI,GAAG,MAAM,IAAIA,sBAAS,EAAE,KAAK,IAAI,GAAG,OAAO,CAAA,OAAM,GAAG,WAAA;AAAA,IAAW;AAAA,EAE/H;AACD;;"}

package/dist/development/src/commands/tenant/person/TenantIdentityRoleAddCommand.js

@@ -0,0 +1,27 @@
+import { Command } from "@contember/cli-common";
+import { humanText } from "../tenantOutput.js";
+class TenantIdentityRoleAddCommand extends Command {
+  constructor(tenantClientProvider) {
+    super();
+    this.tenantClientProvider = tenantClientProvider;
+  }
+  configure(configuration) {
+    configuration.description("Grant global (project-independent) roles to an identity.");
+    configuration.argument("identityId").description('Identity id, as listed by "tenant person list".');
+    configuration.argument("role").variadic().description("One or more global roles to grant.");
+  }
+  async execute(input, output) {
+    const identityId = input.getArgument("identityId");
+    const added = input.getArgument("role");
+    const roles = await this.tenantClientProvider.person().addGlobalIdentityRoles(identityId, added);
+    output.info(`Granted ${added.join(", ")} to identity ${identityId}.`);
+    output.data(
+      { identityId, added, roles },
+      { human: (it) => it.roles === null ? humanText(it.identityId) : it.roles.map(humanText).join(", "), quiet: (it) => it.identityId }
+    );
+  }
+}
+export {
+  TenantIdentityRoleAddCommand
+};
+//# sourceMappingURL=TenantIdentityRoleAddCommand.js.map

package/dist/development/src/commands/tenant/person/TenantIdentityRoleAddCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantIdentityRoleAddCommand.js","sources":["../../../../../../../packages/cli/src/commands/tenant/person/TenantIdentityRoleAddCommand.ts"],"sourcesContent":["import { Command, CommandConfiguration, Input, Output } from '@contember/cli-common'\nimport { TenantClientProvider } from '../../../lib/TenantClientProvider.js'\nimport { humanText } from '../tenantOutput.js'\n\ntype Args = {\n\tidentityId: string\n\trole: string[]\n}\n\ntype Options = {}\n\ninterface IdentityRolesResult {\n\tidentityId: string\n\tadded: string[]\n\t/** All global roles of the identity after the change, or null when the token may not read them. */\n\troles: string[] | null\n}\n\nexport class TenantIdentityRoleAddCommand extends Command<Args, Options> {\n\tconstructor(\n\t\tprivate readonly tenantClientProvider: TenantClientProvider,\n\t) {\n\t\tsuper()\n\t}\n\n\tprotected configure(configuration: CommandConfiguration<Args, Options>): void {\n\t\tconfiguration.description('Grant global (project-independent) roles to an identity.')\n\t\tconfiguration.argument('identityId').description('Identity id, as listed by \"tenant person list\".')\n\t\tconfiguration.argument('role').variadic().description('One or more global roles to grant.')\n\t}\n\n\tprotected async execute(input: Input<Args, Options>, output: Output): Promise<void> {\n\t\tconst identityId = input.getArgument('identityId')\n\t\tconst added = input.getArgument('role')\n\n\t\tconst roles = await this.tenantClientProvider.person().addGlobalIdentityRoles(identityId, added)\n\n\t\toutput.info(`Granted ${added.join(', ')} to identity ${identityId}.`)\n\t\toutput.data<IdentityRolesResult>(\n\t\t\t{ identityId, added, roles },\n\t\t\t{ human: it => it.roles === null ? humanText(it.identityId) : it.roles.map(humanText).join(', '), quiet: it => it.identityId },\n\t\t)\n\t}\n}\n"],"names":[],"mappings":";;AAkBO,MAAM,qCAAqC,QAAuB;AAAA,EACxE,YACkB,sBAChB;AACD,UAAA;AAFiB,SAAA,uBAAA;AAAA,EAGlB;AAAA,EAEU,UAAU,eAA0D;AAC7E,kBAAc,YAAY,0DAA0D;AACpF,kBAAc,SAAS,YAAY,EAAE,YAAY,iDAAiD;AAClG,kBAAc,SAAS,MAAM,EAAE,SAAA,EAAW,YAAY,oCAAoC;AAAA,EAC3F;AAAA,EAEA,MAAgB,QAAQ,OAA6B,QAA+B;AACnF,UAAM,aAAa,MAAM,YAAY,YAAY;AACjD,UAAM,QAAQ,MAAM,YAAY,MAAM;AAEtC,UAAM,QAAQ,MAAM,KAAK,qBAAqB,SAAS,uBAAuB,YAAY,KAAK;AAE/F,WAAO,KAAK,WAAW,MAAM,KAAK,IAAI,CAAC,gBAAgB,UAAU,GAAG;AACpE,WAAO;AAAA,MACN,EAAE,YAAY,OAAO,MAAA;AAAA,MACrB,EAAE,OAAO,CAAA,OAAM,GAAG,UAAU,OAAO,UAAU,GAAG,UAAU,IAAI,GAAG,MAAM,IAAI,SAAS,EAAE,KAAK,IAAI,GAAG,OAAO,CAAA,OAAM,GAAG,WAAA;AAAA,IAAW;AAAA,EAE/H;AACD;"}

package/dist/development/src/commands/tenant/person/TenantIdentityRoleRemoveCommand.cjs

@@ -0,0 +1,34 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const cliCommon = require("@contember/cli-common");
+const confirmation = require("../../../lib/tenant/confirmation.cjs");
+const tenantOutput = require("../tenantOutput.cjs");
+class TenantIdentityRoleRemoveCommand extends cliCommon.Command {
+  constructor(tenantClientProvider) {
+    super();
+    this.tenantClientProvider = tenantClientProvider;
+  }
+  configure(configuration) {
+    configuration.description("Revoke global (project-independent) roles from an identity.");
+    configuration.argument("identityId").description('Identity id, as listed by "tenant person list".');
+    configuration.argument("role").variadic().description("One or more global roles to revoke.");
+    configuration.option("yes").valueNone().description("Do not ask for confirmation.");
+  }
+  async execute(input, output) {
+    const identityId = input.getArgument("identityId");
+    const removed = input.getArgument("role");
+    await confirmation.requireConfirmation({
+      yes: input.getOption("yes") === true,
+      output,
+      warning: `This will revoke ${removed.join(", ")} from identity ${identityId}, which may lock it out of the API.`
+    });
+    const roles = await this.tenantClientProvider.person().removeGlobalIdentityRoles(identityId, removed);
+    output.info(`Revoked ${removed.join(", ")} from identity ${identityId}.`);
+    output.data(
+      { identityId, removed, roles },
+      { human: (it) => it.roles === null ? tenantOutput.humanText(it.identityId) : it.roles.map(tenantOutput.humanText).join(", "), quiet: (it) => it.identityId }
+    );
+  }
+}
+exports.TenantIdentityRoleRemoveCommand = TenantIdentityRoleRemoveCommand;
+//# sourceMappingURL=TenantIdentityRoleRemoveCommand.cjs.map

package/dist/development/src/commands/tenant/person/TenantIdentityRoleRemoveCommand.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantIdentityRoleRemoveCommand.cjs","sources":["../../../../../../../packages/cli/src/commands/tenant/person/TenantIdentityRoleRemoveCommand.ts"],"sourcesContent":["import { Command, CommandConfiguration, Input, Output } from '@contember/cli-common'\nimport { TenantClientProvider } from '../../../lib/TenantClientProvider.js'\nimport { requireConfirmation } from '../../../lib/tenant/confirmation.js'\nimport { humanText } from '../tenantOutput.js'\n\ntype Args = {\n\tidentityId: string\n\trole: string[]\n}\n\ntype Options = {\n\tyes?: boolean\n}\n\ninterface IdentityRolesResult {\n\tidentityId: string\n\tremoved: string[]\n\t/** All global roles of the identity after the change, or null when the token may not read them. */\n\troles: string[] | null\n}\n\nexport class TenantIdentityRoleRemoveCommand extends Command<Args, Options> {\n\tconstructor(\n\t\tprivate readonly tenantClientProvider: TenantClientProvider,\n\t) {\n\t\tsuper()\n\t}\n\n\tprotected configure(configuration: CommandConfiguration<Args, Options>): void {\n\t\tconfiguration.description('Revoke global (project-independent) roles from an identity.')\n\t\tconfiguration.argument('identityId').description('Identity id, as listed by \"tenant person list\".')\n\t\tconfiguration.argument('role').variadic().description('One or more global roles to revoke.')\n\t\tconfiguration.option('yes').valueNone().description('Do not ask for confirmation.')\n\t}\n\n\tprotected async execute(input: Input<Args, Options>, output: Output): Promise<void> {\n\t\tconst identityId = input.getArgument('identityId')\n\t\tconst removed = input.getArgument('role')\n\n\t\tawait requireConfirmation({\n\t\t\tyes: input.getOption('yes') === true,\n\t\t\toutput,\n\t\t\twarning: `This will revoke ${removed.join(', ')} from identity ${identityId}, which may lock it out of the API.`,\n\t\t})\n\n\t\tconst roles = await this.tenantClientProvider.person().removeGlobalIdentityRoles(identityId, removed)\n\n\t\toutput.info(`Revoked ${removed.join(', ')} from identity ${identityId}.`)\n\t\toutput.data<IdentityRolesResult>(\n\t\t\t{ identityId, removed, roles },\n\t\t\t{ human: it => it.roles === null ? humanText(it.identityId) : it.roles.map(humanText).join(', '), quiet: it => it.identityId },\n\t\t)\n\t}\n}\n"],"names":["Command","requireConfirmation","humanText"],"mappings":";;;;;AAqBO,MAAM,wCAAwCA,UAAAA,QAAuB;AAAA,EAC3E,YACkB,sBAChB;AACD,UAAA;AAFiB,SAAA,uBAAA;AAAA,EAGlB;AAAA,EAEU,UAAU,eAA0D;AAC7E,kBAAc,YAAY,6DAA6D;AACvF,kBAAc,SAAS,YAAY,EAAE,YAAY,iDAAiD;AAClG,kBAAc,SAAS,MAAM,EAAE,SAAA,EAAW,YAAY,qCAAqC;AAC3F,kBAAc,OAAO,KAAK,EAAE,UAAA,EAAY,YAAY,8BAA8B;AAAA,EACnF;AAAA,EAEA,MAAgB,QAAQ,OAA6B,QAA+B;AACnF,UAAM,aAAa,MAAM,YAAY,YAAY;AACjD,UAAM,UAAU,MAAM,YAAY,MAAM;AAExC,UAAMC,iCAAoB;AAAA,MACzB,KAAK,MAAM,UAAU,KAAK,MAAM;AAAA,MAChC;AAAA,MACA,SAAS,oBAAoB,QAAQ,KAAK,IAAI,CAAC,kBAAkB,UAAU;AAAA,IAAA,CAC3E;AAED,UAAM,QAAQ,MAAM,KAAK,qBAAqB,SAAS,0BAA0B,YAAY,OAAO;AAEpG,WAAO,KAAK,WAAW,QAAQ,KAAK,IAAI,CAAC,kBAAkB,UAAU,GAAG;AACxE,WAAO;AAAA,MACN,EAAE,YAAY,SAAS,MAAA;AAAA,MACvB,EAAE,OAAO,CAAA,OAAM,GAAG,UAAU,OAAOC,aAAAA,UAAU,GAAG,UAAU,IAAI,GAAG,MAAM,IAAIA,sBAAS,EAAE,KAAK,IAAI,GAAG,OAAO,CAAA,OAAM,GAAG,WAAA;AAAA,IAAW;AAAA,EAE/H;AACD;;"}

package/dist/development/src/commands/tenant/person/TenantIdentityRoleRemoveCommand.js

@@ -0,0 +1,34 @@
+import { Command } from "@contember/cli-common";
+import { requireConfirmation } from "../../../lib/tenant/confirmation.js";
+import { humanText } from "../tenantOutput.js";
+class TenantIdentityRoleRemoveCommand extends Command {
+  constructor(tenantClientProvider) {
+    super();
+    this.tenantClientProvider = tenantClientProvider;
+  }
+  configure(configuration) {
+    configuration.description("Revoke global (project-independent) roles from an identity.");
+    configuration.argument("identityId").description('Identity id, as listed by "tenant person list".');
+    configuration.argument("role").variadic().description("One or more global roles to revoke.");
+    configuration.option("yes").valueNone().description("Do not ask for confirmation.");
+  }
+  async execute(input, output) {
+    const identityId = input.getArgument("identityId");
+    const removed = input.getArgument("role");
+    await requireConfirmation({
+      yes: input.getOption("yes") === true,
+      output,
+      warning: `This will revoke ${removed.join(", ")} from identity ${identityId}, which may lock it out of the API.`
+    });
+    const roles = await this.tenantClientProvider.person().removeGlobalIdentityRoles(identityId, removed);
+    output.info(`Revoked ${removed.join(", ")} from identity ${identityId}.`);
+    output.data(
+      { identityId, removed, roles },
+      { human: (it) => it.roles === null ? humanText(it.identityId) : it.roles.map(humanText).join(", "), quiet: (it) => it.identityId }
+    );
+  }
+}
+export {
+  TenantIdentityRoleRemoveCommand
+};
+//# sourceMappingURL=TenantIdentityRoleRemoveCommand.js.map

package/dist/development/src/commands/tenant/person/TenantIdentityRoleRemoveCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantIdentityRoleRemoveCommand.js","sources":["../../../../../../../packages/cli/src/commands/tenant/person/TenantIdentityRoleRemoveCommand.ts"],"sourcesContent":["import { Command, CommandConfiguration, Input, Output } from '@contember/cli-common'\nimport { TenantClientProvider } from '../../../lib/TenantClientProvider.js'\nimport { requireConfirmation } from '../../../lib/tenant/confirmation.js'\nimport { humanText } from '../tenantOutput.js'\n\ntype Args = {\n\tidentityId: string\n\trole: string[]\n}\n\ntype Options = {\n\tyes?: boolean\n}\n\ninterface IdentityRolesResult {\n\tidentityId: string\n\tremoved: string[]\n\t/** All global roles of the identity after the change, or null when the token may not read them. */\n\troles: string[] | null\n}\n\nexport class TenantIdentityRoleRemoveCommand extends Command<Args, Options> {\n\tconstructor(\n\t\tprivate readonly tenantClientProvider: TenantClientProvider,\n\t) {\n\t\tsuper()\n\t}\n\n\tprotected configure(configuration: CommandConfiguration<Args, Options>): void {\n\t\tconfiguration.description('Revoke global (project-independent) roles from an identity.')\n\t\tconfiguration.argument('identityId').description('Identity id, as listed by \"tenant person list\".')\n\t\tconfiguration.argument('role').variadic().description('One or more global roles to revoke.')\n\t\tconfiguration.option('yes').valueNone().description('Do not ask for confirmation.')\n\t}\n\n\tprotected async execute(input: Input<Args, Options>, output: Output): Promise<void> {\n\t\tconst identityId = input.getArgument('identityId')\n\t\tconst removed = input.getArgument('role')\n\n\t\tawait requireConfirmation({\n\t\t\tyes: input.getOption('yes') === true,\n\t\t\toutput,\n\t\t\twarning: `This will revoke ${removed.join(', ')} from identity ${identityId}, which may lock it out of the API.`,\n\t\t})\n\n\t\tconst roles = await this.tenantClientProvider.person().removeGlobalIdentityRoles(identityId, removed)\n\n\t\toutput.info(`Revoked ${removed.join(', ')} from identity ${identityId}.`)\n\t\toutput.data<IdentityRolesResult>(\n\t\t\t{ identityId, removed, roles },\n\t\t\t{ human: it => it.roles === null ? humanText(it.identityId) : it.roles.map(humanText).join(', '), quiet: it => it.identityId },\n\t\t)\n\t}\n}\n"],"names":[],"mappings":";;;AAqBO,MAAM,wCAAwC,QAAuB;AAAA,EAC3E,YACkB,sBAChB;AACD,UAAA;AAFiB,SAAA,uBAAA;AAAA,EAGlB;AAAA,EAEU,UAAU,eAA0D;AAC7E,kBAAc,YAAY,6DAA6D;AACvF,kBAAc,SAAS,YAAY,EAAE,YAAY,iDAAiD;AAClG,kBAAc,SAAS,MAAM,EAAE,SAAA,EAAW,YAAY,qCAAqC;AAC3F,kBAAc,OAAO,KAAK,EAAE,UAAA,EAAY,YAAY,8BAA8B;AAAA,EACnF;AAAA,EAEA,MAAgB,QAAQ,OAA6B,QAA+B;AACnF,UAAM,aAAa,MAAM,YAAY,YAAY;AACjD,UAAM,UAAU,MAAM,YAAY,MAAM;AAExC,UAAM,oBAAoB;AAAA,MACzB,KAAK,MAAM,UAAU,KAAK,MAAM;AAAA,MAChC;AAAA,MACA,SAAS,oBAAoB,QAAQ,KAAK,IAAI,CAAC,kBAAkB,UAAU;AAAA,IAAA,CAC3E;AAED,UAAM,QAAQ,MAAM,KAAK,qBAAqB,SAAS,0BAA0B,YAAY,OAAO;AAEpG,WAAO,KAAK,WAAW,QAAQ,KAAK,IAAI,CAAC,kBAAkB,UAAU,GAAG;AACxE,WAAO;AAAA,MACN,EAAE,YAAY,SAAS,MAAA;AAAA,MACvB,EAAE,OAAO,CAAA,OAAM,GAAG,UAAU,OAAO,UAAU,GAAG,UAAU,IAAI,GAAG,MAAM,IAAI,SAAS,EAAE,KAAK,IAAI,GAAG,OAAO,CAAA,OAAM,GAAG,WAAA;AAAA,IAAW;AAAA,EAE/H;AACD;"}

package/dist/development/src/commands/tenant/person/TenantPersonCreateCommand.cjs

@@ -0,0 +1,79 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const cliCommon = require("@contember/cli-common");
+const personInput = require("./personInput.cjs");
+const tenantOutput = require("../tenantOutput.cjs");
+const stdin = require("../../../lib/tenant/stdin.cjs");
+class TenantPersonCreateCommand extends cliCommon.Command {
+  constructor(tenantClientProvider, readStdin = stdin.readStdinText, readEnvironment = (name) => process.env[name]) {
+    super();
+    this.tenantClientProvider = tenantClientProvider;
+    this.readStdin = readStdin;
+    this.readEnvironment = readEnvironment;
+  }
+  configure(configuration) {
+    configuration.description(
+      "Create a person (tenant signUp). Consumes the per-IP sign-up rate limit (config rateLimits.signUpPerIp, disabled by default, so bulk creation only throttles once a tenant configures it), verifies a captcha when one is configured, and sends a verification e-mail when signup.requireEmailVerification is on."
+    );
+    configuration.argument("email").description("E-mail address of the new person.");
+    configuration.option("name").valueRequired().description("Display name of the new person.");
+    configuration.option("role").valueArray().description("Global identity role to grant. Repeat the option to grant several.");
+    configuration.option("password-stdin").valueNone().description("Read the plaintext password from stdin.");
+    configuration.option("password-env").valueRequired().description("Read the plaintext password from the named environment variable.");
+    configuration.option("password-hash-stdin").valueNone().description("Read a bcrypt ($2b$) password hash from stdin.");
+    configuration.option("password-hash-env").valueRequired().description(
+      "Read a bcrypt ($2b$) password hash from the named environment variable. Preferred for provisioning — the plaintext never leaves your side."
+    );
+    personInput.configureCaptchaTokenOptions(configuration);
+  }
+  async execute(input, output) {
+    const email = input.getArgument("email");
+    const name = tenantOutput.requireNonEmptyTenantName(input.getOption("name"), "Person");
+    const passwordFromStdin = input.getOption("password-stdin") === true;
+    const passwordHashFromStdin = input.getOption("password-hash-stdin") === true;
+    const captchaFromStdin = input.getOption("captcha-token-stdin") === true;
+    if (captchaFromStdin && (passwordFromStdin || passwordHashFromStdin)) {
+      throw new cliCommon.CliError("Only one value can consume stdin. Combine a --*-stdin option with an environment-backed source instead.", {
+        code: "AMBIGUOUS_STDIN_INPUT",
+        exitCode: cliCommon.ExitCode.InputError
+      });
+    }
+    const secret = await personInput.resolveSecret(
+      [
+        { name: "password", stdin: passwordFromStdin, env: input.getOption("password-env") },
+        { name: "password-hash", stdin: passwordHashFromStdin, env: input.getOption("password-hash-env") }
+      ],
+      this.readStdin
+    );
+    const password = secret?.name === "password" ? secret.value : void 0;
+    const passwordHash = secret?.name === "password-hash" ? secret.value : void 0;
+    if (passwordHash !== void 0) {
+      personInput.assertBcryptHash(passwordHash);
+    }
+    if (secret === void 0) {
+      output.warn("No password given. The person is created without one and can only sign in after a password reset or through an identity provider.");
+    }
+    const captchaToken = await personInput.resolveCaptchaToken(
+      {
+        "captcha-token": input.getOption("captcha-token"),
+        "captcha-token-env": input.getOption("captcha-token-env"),
+        "captcha-token-stdin": input.getOption("captcha-token-stdin")
+      },
+      this.readStdin,
+      this.readEnvironment
+    );
+    output.info(`Creating person ${email}`);
+    const person = await this.tenantClientProvider.person().signUp({
+      email,
+      password,
+      passwordHash,
+      name,
+      roles: input.getOption("role"),
+      captchaToken
+    });
+    output.info(`Created person ${person.id} with identity ${person.identityId}.`);
+    output.data(person, { human: (it) => tenantOutput.humanText(it.id), quiet: (it) => it.id });
+  }
+}
+exports.TenantPersonCreateCommand = TenantPersonCreateCommand;
+//# sourceMappingURL=TenantPersonCreateCommand.cjs.map

package/dist/development/src/commands/tenant/person/TenantPersonCreateCommand.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantPersonCreateCommand.cjs","sources":["../../../../../../../packages/cli/src/commands/tenant/person/TenantPersonCreateCommand.ts"],"sourcesContent":["import { CliError, Command, CommandConfiguration, ExitCode, Input, Output } from '@contember/cli-common'\nimport { TenantClientProvider } from '../../../lib/TenantClientProvider.js'\nimport { TenantPerson } from '../../../lib/tenant/clients/TenantPersonClient.js'\nimport { assertBcryptHash, type CaptchaTokenOptions, configureCaptchaTokenOptions, resolveCaptchaToken, resolveSecret } from './personInput.js'\nimport { humanText, requireNonEmptyTenantName } from '../tenantOutput.js'\nimport { readStdinText, StdinReader } from '../../../lib/tenant/stdin.js'\n\ntype Args = {\n\temail: string\n}\n\ntype Options = CaptchaTokenOptions & {\n\tname?: string\n\trole?: string[]\n\t['password-stdin']?: boolean\n\t['password-env']?: string\n\t['password-hash-stdin']?: boolean\n\t['password-hash-env']?: string\n}\n\nexport class TenantPersonCreateCommand extends Command<Args, Options> {\n\tconstructor(\n\t\tprivate readonly tenantClientProvider: TenantClientProvider,\n\t\tprivate readonly readStdin: StdinReader = readStdinText,\n\t\tprivate readonly readEnvironment: (name: string) => string | undefined = name => process.env[name],\n\t) {\n\t\tsuper()\n\t}\n\n\tprotected configure(configuration: CommandConfiguration<Args, Options>): void {\n\t\tconfiguration.description(\n\t\t\t'Create a person (tenant signUp). Consumes the per-IP sign-up rate limit (config rateLimits.signUpPerIp, disabled by default, '\n\t\t\t\t+ 'so bulk creation only throttles once a tenant configures it), verifies a captcha when one is configured, and sends a '\n\t\t\t\t+ 'verification e-mail when signup.requireEmailVerification is on.',\n\t\t)\n\t\tconfiguration.argument('email').description('E-mail address of the new person.')\n\t\tconfiguration.option('name').valueRequired().description('Display name of the new person.')\n\t\tconfiguration.option('role').valueArray().description('Global identity role to grant. Repeat the option to grant several.')\n\t\tconfiguration.option('password-stdin').valueNone().description('Read the plaintext password from stdin.')\n\t\tconfiguration.option('password-env').valueRequired().description('Read the plaintext password from the named environment variable.')\n\t\tconfiguration.option('password-hash-stdin').valueNone().description('Read a bcrypt ($2b$) password hash from stdin.')\n\t\tconfiguration.option('password-hash-env').valueRequired().description(\n\t\t\t'Read a bcrypt ($2b$) password hash from the named environment variable. Preferred for provisioning — the plaintext never leaves your side.',\n\t\t)\n\t\tconfigureCaptchaTokenOptions(configuration)\n\t}\n\n\tprotected async execute(input: Input<Args, Options>, output: Output): Promise<void> {\n\t\tconst email = input.getArgument('email')\n\t\tconst name = requireNonEmptyTenantName(input.getOption('name'), 'Person')\n\t\tconst passwordFromStdin = input.getOption('password-stdin') === true\n\t\tconst passwordHashFromStdin = input.getOption('password-hash-stdin') === true\n\t\tconst captchaFromStdin = input.getOption('captcha-token-stdin') === true\n\t\tif (captchaFromStdin && (passwordFromStdin || passwordHashFromStdin)) {\n\t\t\tthrow new CliError('Only one value can consume stdin. Combine a --*-stdin option with an environment-backed source instead.', {\n\t\t\t\tcode: 'AMBIGUOUS_STDIN_INPUT',\n\t\t\t\texitCode: ExitCode.InputError,\n\t\t\t})\n\t\t}\n\t\tconst secret = await resolveSecret(\n\t\t\t[\n\t\t\t\t{ name: 'password', stdin: passwordFromStdin, env: input.getOption('password-env') },\n\t\t\t\t{ name: 'password-hash', stdin: passwordHashFromStdin, env: input.getOption('password-hash-env') },\n\t\t\t],\n\t\t\tthis.readStdin,\n\t\t)\n\t\tconst password = secret?.name === 'password' ? secret.value : undefined\n\t\tconst passwordHash = secret?.name === 'password-hash' ? secret.value : undefined\n\t\tif (passwordHash !== undefined) {\n\t\t\tassertBcryptHash(passwordHash)\n\t\t}\n\t\tif (secret === undefined) {\n\t\t\toutput.warn('No password given. The person is created without one and can only sign in after a password reset or through an identity provider.')\n\t\t}\n\t\tconst captchaToken = await resolveCaptchaToken(\n\t\t\t{\n\t\t\t\t'captcha-token': input.getOption('captcha-token'),\n\t\t\t\t'captcha-token-env': input.getOption('captcha-token-env'),\n\t\t\t\t'captcha-token-stdin': input.getOption('captcha-token-stdin'),\n\t\t\t},\n\t\t\tthis.readStdin,\n\t\t\tthis.readEnvironment,\n\t\t)\n\n\t\toutput.info(`Creating person ${email}`)\n\t\tconst person = await this.tenantClientProvider.person().signUp({\n\t\t\temail,\n\t\t\tpassword,\n\t\t\tpasswordHash,\n\t\t\tname,\n\t\t\troles: input.getOption('role'),\n\t\t\tcaptchaToken,\n\t\t})\n\n\t\toutput.info(`Created person ${person.id} with identity ${person.identityId}.`)\n\t\toutput.data<TenantPerson>(person, { human: it => humanText(it.id), quiet: it => it.id })\n\t}\n}\n"],"names":["Command","readStdinText","configureCaptchaTokenOptions","requireNonEmptyTenantName","CliError","ExitCode","resolveSecret","assertBcryptHash","resolveCaptchaToken","humanText"],"mappings":";;;;;;AAoBO,MAAM,kCAAkCA,UAAAA,QAAuB;AAAA,EACrE,YACkB,sBACA,YAAyBC,qBACzB,kBAAwD,CAAA,SAAQ,QAAQ,IAAI,IAAI,GAChG;AACD,UAAA;AAJiB,SAAA,uBAAA;AACA,SAAA,YAAA;AACA,SAAA,kBAAA;AAAA,EAGlB;AAAA,EAEU,UAAU,eAA0D;AAC7E,kBAAc;AAAA,MACb;AAAA,IAAA;AAID,kBAAc,SAAS,OAAO,EAAE,YAAY,mCAAmC;AAC/E,kBAAc,OAAO,MAAM,EAAE,cAAA,EAAgB,YAAY,iCAAiC;AAC1F,kBAAc,OAAO,MAAM,EAAE,WAAA,EAAa,YAAY,oEAAoE;AAC1H,kBAAc,OAAO,gBAAgB,EAAE,UAAA,EAAY,YAAY,yCAAyC;AACxG,kBAAc,OAAO,cAAc,EAAE,cAAA,EAAgB,YAAY,kEAAkE;AACnI,kBAAc,OAAO,qBAAqB,EAAE,UAAA,EAAY,YAAY,gDAAgD;AACpH,kBAAc,OAAO,mBAAmB,EAAE,cAAA,EAAgB;AAAA,MACzD;AAAA,IAAA;AAEDC,gBAAAA,6BAA6B,aAAa;AAAA,EAC3C;AAAA,EAEA,MAAgB,QAAQ,OAA6B,QAA+B;AACnF,UAAM,QAAQ,MAAM,YAAY,OAAO;AACvC,UAAM,OAAOC,aAAAA,0BAA0B,MAAM,UAAU,MAAM,GAAG,QAAQ;AACxE,UAAM,oBAAoB,MAAM,UAAU,gBAAgB,MAAM;AAChE,UAAM,wBAAwB,MAAM,UAAU,qBAAqB,MAAM;AACzE,UAAM,mBAAmB,MAAM,UAAU,qBAAqB,MAAM;AACpE,QAAI,qBAAqB,qBAAqB,wBAAwB;AACrE,YAAM,IAAIC,UAAAA,SAAS,2GAA2G;AAAA,QAC7H,MAAM;AAAA,QACN,UAAUC,UAAAA,SAAS;AAAA,MAAA,CACnB;AAAA,IACF;AACA,UAAM,SAAS,MAAMC,YAAAA;AAAAA,MACpB;AAAA,QACC,EAAE,MAAM,YAAY,OAAO,mBAAmB,KAAK,MAAM,UAAU,cAAc,EAAA;AAAA,QACjF,EAAE,MAAM,iBAAiB,OAAO,uBAAuB,KAAK,MAAM,UAAU,mBAAmB,EAAA;AAAA,MAAE;AAAA,MAElG,KAAK;AAAA,IAAA;AAEN,UAAM,WAAW,QAAQ,SAAS,aAAa,OAAO,QAAQ;AAC9D,UAAM,eAAe,QAAQ,SAAS,kBAAkB,OAAO,QAAQ;AACvE,QAAI,iBAAiB,QAAW;AAC/BC,kBAAAA,iBAAiB,YAAY;AAAA,IAC9B;AACA,QAAI,WAAW,QAAW;AACzB,aAAO,KAAK,mIAAmI;AAAA,IAChJ;AACA,UAAM,eAAe,MAAMC,YAAAA;AAAAA,MAC1B;AAAA,QACC,iBAAiB,MAAM,UAAU,eAAe;AAAA,QAChD,qBAAqB,MAAM,UAAU,mBAAmB;AAAA,QACxD,uBAAuB,MAAM,UAAU,qBAAqB;AAAA,MAAA;AAAA,MAE7D,KAAK;AAAA,MACL,KAAK;AAAA,IAAA;AAGN,WAAO,KAAK,mBAAmB,KAAK,EAAE;AACtC,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAA,EAAS,OAAO;AAAA,MAC9D;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,OAAO,MAAM,UAAU,MAAM;AAAA,MAC7B;AAAA,IAAA,CACA;AAED,WAAO,KAAK,kBAAkB,OAAO,EAAE,kBAAkB,OAAO,UAAU,GAAG;AAC7E,WAAO,KAAmB,QAAQ,EAAE,OAAO,CAAA,OAAMC,aAAAA,UAAU,GAAG,EAAE,GAAG,OAAO,CAAA,OAAM,GAAG,IAAI;AAAA,EACxF;AACD;;"}

package/dist/development/src/commands/tenant/person/TenantPersonCreateCommand.js

@@ -0,0 +1,79 @@
+import { Command, CliError, ExitCode } from "@contember/cli-common";
+import { configureCaptchaTokenOptions, resolveSecret, assertBcryptHash, resolveCaptchaToken } from "./personInput.js";
+import { requireNonEmptyTenantName, humanText } from "../tenantOutput.js";
+import { readStdinText } from "../../../lib/tenant/stdin.js";
+class TenantPersonCreateCommand extends Command {
+  constructor(tenantClientProvider, readStdin = readStdinText, readEnvironment = (name) => process.env[name]) {
+    super();
+    this.tenantClientProvider = tenantClientProvider;
+    this.readStdin = readStdin;
+    this.readEnvironment = readEnvironment;
+  }
+  configure(configuration) {
+    configuration.description(
+      "Create a person (tenant signUp). Consumes the per-IP sign-up rate limit (config rateLimits.signUpPerIp, disabled by default, so bulk creation only throttles once a tenant configures it), verifies a captcha when one is configured, and sends a verification e-mail when signup.requireEmailVerification is on."
+    );
+    configuration.argument("email").description("E-mail address of the new person.");
+    configuration.option("name").valueRequired().description("Display name of the new person.");
+    configuration.option("role").valueArray().description("Global identity role to grant. Repeat the option to grant several.");
+    configuration.option("password-stdin").valueNone().description("Read the plaintext password from stdin.");
+    configuration.option("password-env").valueRequired().description("Read the plaintext password from the named environment variable.");
+    configuration.option("password-hash-stdin").valueNone().description("Read a bcrypt ($2b$) password hash from stdin.");
+    configuration.option("password-hash-env").valueRequired().description(
+      "Read a bcrypt ($2b$) password hash from the named environment variable. Preferred for provisioning — the plaintext never leaves your side."
+    );
+    configureCaptchaTokenOptions(configuration);
+  }
+  async execute(input, output) {
+    const email = input.getArgument("email");
+    const name = requireNonEmptyTenantName(input.getOption("name"), "Person");
+    const passwordFromStdin = input.getOption("password-stdin") === true;
+    const passwordHashFromStdin = input.getOption("password-hash-stdin") === true;
+    const captchaFromStdin = input.getOption("captcha-token-stdin") === true;
+    if (captchaFromStdin && (passwordFromStdin || passwordHashFromStdin)) {
+      throw new CliError("Only one value can consume stdin. Combine a --*-stdin option with an environment-backed source instead.", {
+        code: "AMBIGUOUS_STDIN_INPUT",
+        exitCode: ExitCode.InputError
+      });
+    }
+    const secret = await resolveSecret(
+      [
+        { name: "password", stdin: passwordFromStdin, env: input.getOption("password-env") },
+        { name: "password-hash", stdin: passwordHashFromStdin, env: input.getOption("password-hash-env") }
+      ],
+      this.readStdin
+    );
+    const password = secret?.name === "password" ? secret.value : void 0;
+    const passwordHash = secret?.name === "password-hash" ? secret.value : void 0;
+    if (passwordHash !== void 0) {
+      assertBcryptHash(passwordHash);
+    }
+    if (secret === void 0) {
+      output.warn("No password given. The person is created without one and can only sign in after a password reset or through an identity provider.");
+    }
+    const captchaToken = await resolveCaptchaToken(
+      {
+        "captcha-token": input.getOption("captcha-token"),
+        "captcha-token-env": input.getOption("captcha-token-env"),
+        "captcha-token-stdin": input.getOption("captcha-token-stdin")
+      },
+      this.readStdin,
+      this.readEnvironment
+    );
+    output.info(`Creating person ${email}`);
+    const person = await this.tenantClientProvider.person().signUp({
+      email,
+      password,
+      passwordHash,
+      name,
+      roles: input.getOption("role"),
+      captchaToken
+    });
+    output.info(`Created person ${person.id} with identity ${person.identityId}.`);
+    output.data(person, { human: (it) => humanText(it.id), quiet: (it) => it.id });
+  }
+}
+export {
+  TenantPersonCreateCommand
+};
+//# sourceMappingURL=TenantPersonCreateCommand.js.map

package/dist/development/src/commands/tenant/person/TenantPersonCreateCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantPersonCreateCommand.js","sources":["../../../../../../../packages/cli/src/commands/tenant/person/TenantPersonCreateCommand.ts"],"sourcesContent":["import { CliError, Command, CommandConfiguration, ExitCode, Input, Output } from '@contember/cli-common'\nimport { TenantClientProvider } from '../../../lib/TenantClientProvider.js'\nimport { TenantPerson } from '../../../lib/tenant/clients/TenantPersonClient.js'\nimport { assertBcryptHash, type CaptchaTokenOptions, configureCaptchaTokenOptions, resolveCaptchaToken, resolveSecret } from './personInput.js'\nimport { humanText, requireNonEmptyTenantName } from '../tenantOutput.js'\nimport { readStdinText, StdinReader } from '../../../lib/tenant/stdin.js'\n\ntype Args = {\n\temail: string\n}\n\ntype Options = CaptchaTokenOptions & {\n\tname?: string\n\trole?: string[]\n\t['password-stdin']?: boolean\n\t['password-env']?: string\n\t['password-hash-stdin']?: boolean\n\t['password-hash-env']?: string\n}\n\nexport class TenantPersonCreateCommand extends Command<Args, Options> {\n\tconstructor(\n\t\tprivate readonly tenantClientProvider: TenantClientProvider,\n\t\tprivate readonly readStdin: StdinReader = readStdinText,\n\t\tprivate readonly readEnvironment: (name: string) => string | undefined = name => process.env[name],\n\t) {\n\t\tsuper()\n\t}\n\n\tprotected configure(configuration: CommandConfiguration<Args, Options>): void {\n\t\tconfiguration.description(\n\t\t\t'Create a person (tenant signUp). Consumes the per-IP sign-up rate limit (config rateLimits.signUpPerIp, disabled by default, '\n\t\t\t\t+ 'so bulk creation only throttles once a tenant configures it), verifies a captcha when one is configured, and sends a '\n\t\t\t\t+ 'verification e-mail when signup.requireEmailVerification is on.',\n\t\t)\n\t\tconfiguration.argument('email').description('E-mail address of the new person.')\n\t\tconfiguration.option('name').valueRequired().description('Display name of the new person.')\n\t\tconfiguration.option('role').valueArray().description('Global identity role to grant. Repeat the option to grant several.')\n\t\tconfiguration.option('password-stdin').valueNone().description('Read the plaintext password from stdin.')\n\t\tconfiguration.option('password-env').valueRequired().description('Read the plaintext password from the named environment variable.')\n\t\tconfiguration.option('password-hash-stdin').valueNone().description('Read a bcrypt ($2b$) password hash from stdin.')\n\t\tconfiguration.option('password-hash-env').valueRequired().description(\n\t\t\t'Read a bcrypt ($2b$) password hash from the named environment variable. Preferred for provisioning — the plaintext never leaves your side.',\n\t\t)\n\t\tconfigureCaptchaTokenOptions(configuration)\n\t}\n\n\tprotected async execute(input: Input<Args, Options>, output: Output): Promise<void> {\n\t\tconst email = input.getArgument('email')\n\t\tconst name = requireNonEmptyTenantName(input.getOption('name'), 'Person')\n\t\tconst passwordFromStdin = input.getOption('password-stdin') === true\n\t\tconst passwordHashFromStdin = input.getOption('password-hash-stdin') === true\n\t\tconst captchaFromStdin = input.getOption('captcha-token-stdin') === true\n\t\tif (captchaFromStdin && (passwordFromStdin || passwordHashFromStdin)) {\n\t\t\tthrow new CliError('Only one value can consume stdin. Combine a --*-stdin option with an environment-backed source instead.', {\n\t\t\t\tcode: 'AMBIGUOUS_STDIN_INPUT',\n\t\t\t\texitCode: ExitCode.InputError,\n\t\t\t})\n\t\t}\n\t\tconst secret = await resolveSecret(\n\t\t\t[\n\t\t\t\t{ name: 'password', stdin: passwordFromStdin, env: input.getOption('password-env') },\n\t\t\t\t{ name: 'password-hash', stdin: passwordHashFromStdin, env: input.getOption('password-hash-env') },\n\t\t\t],\n\t\t\tthis.readStdin,\n\t\t)\n\t\tconst password = secret?.name === 'password' ? secret.value : undefined\n\t\tconst passwordHash = secret?.name === 'password-hash' ? secret.value : undefined\n\t\tif (passwordHash !== undefined) {\n\t\t\tassertBcryptHash(passwordHash)\n\t\t}\n\t\tif (secret === undefined) {\n\t\t\toutput.warn('No password given. The person is created without one and can only sign in after a password reset or through an identity provider.')\n\t\t}\n\t\tconst captchaToken = await resolveCaptchaToken(\n\t\t\t{\n\t\t\t\t'captcha-token': input.getOption('captcha-token'),\n\t\t\t\t'captcha-token-env': input.getOption('captcha-token-env'),\n\t\t\t\t'captcha-token-stdin': input.getOption('captcha-token-stdin'),\n\t\t\t},\n\t\t\tthis.readStdin,\n\t\t\tthis.readEnvironment,\n\t\t)\n\n\t\toutput.info(`Creating person ${email}`)\n\t\tconst person = await this.tenantClientProvider.person().signUp({\n\t\t\temail,\n\t\t\tpassword,\n\t\t\tpasswordHash,\n\t\t\tname,\n\t\t\troles: input.getOption('role'),\n\t\t\tcaptchaToken,\n\t\t})\n\n\t\toutput.info(`Created person ${person.id} with identity ${person.identityId}.`)\n\t\toutput.data<TenantPerson>(person, { human: it => humanText(it.id), quiet: it => it.id })\n\t}\n}\n"],"names":[],"mappings":";;;;AAoBO,MAAM,kCAAkC,QAAuB;AAAA,EACrE,YACkB,sBACA,YAAyB,eACzB,kBAAwD,CAAA,SAAQ,QAAQ,IAAI,IAAI,GAChG;AACD,UAAA;AAJiB,SAAA,uBAAA;AACA,SAAA,YAAA;AACA,SAAA,kBAAA;AAAA,EAGlB;AAAA,EAEU,UAAU,eAA0D;AAC7E,kBAAc;AAAA,MACb;AAAA,IAAA;AAID,kBAAc,SAAS,OAAO,EAAE,YAAY,mCAAmC;AAC/E,kBAAc,OAAO,MAAM,EAAE,cAAA,EAAgB,YAAY,iCAAiC;AAC1F,kBAAc,OAAO,MAAM,EAAE,WAAA,EAAa,YAAY,oEAAoE;AAC1H,kBAAc,OAAO,gBAAgB,EAAE,UAAA,EAAY,YAAY,yCAAyC;AACxG,kBAAc,OAAO,cAAc,EAAE,cAAA,EAAgB,YAAY,kEAAkE;AACnI,kBAAc,OAAO,qBAAqB,EAAE,UAAA,EAAY,YAAY,gDAAgD;AACpH,kBAAc,OAAO,mBAAmB,EAAE,cAAA,EAAgB;AAAA,MACzD;AAAA,IAAA;AAED,iCAA6B,aAAa;AAAA,EAC3C;AAAA,EAEA,MAAgB,QAAQ,OAA6B,QAA+B;AACnF,UAAM,QAAQ,MAAM,YAAY,OAAO;AACvC,UAAM,OAAO,0BAA0B,MAAM,UAAU,MAAM,GAAG,QAAQ;AACxE,UAAM,oBAAoB,MAAM,UAAU,gBAAgB,MAAM;AAChE,UAAM,wBAAwB,MAAM,UAAU,qBAAqB,MAAM;AACzE,UAAM,mBAAmB,MAAM,UAAU,qBAAqB,MAAM;AACpE,QAAI,qBAAqB,qBAAqB,wBAAwB;AACrE,YAAM,IAAI,SAAS,2GAA2G;AAAA,QAC7H,MAAM;AAAA,QACN,UAAU,SAAS;AAAA,MAAA,CACnB;AAAA,IACF;AACA,UAAM,SAAS,MAAM;AAAA,MACpB;AAAA,QACC,EAAE,MAAM,YAAY,OAAO,mBAAmB,KAAK,MAAM,UAAU,cAAc,EAAA;AAAA,QACjF,EAAE,MAAM,iBAAiB,OAAO,uBAAuB,KAAK,MAAM,UAAU,mBAAmB,EAAA;AAAA,MAAE;AAAA,MAElG,KAAK;AAAA,IAAA;AAEN,UAAM,WAAW,QAAQ,SAAS,aAAa,OAAO,QAAQ;AAC9D,UAAM,eAAe,QAAQ,SAAS,kBAAkB,OAAO,QAAQ;AACvE,QAAI,iBAAiB,QAAW;AAC/B,uBAAiB,YAAY;AAAA,IAC9B;AACA,QAAI,WAAW,QAAW;AACzB,aAAO,KAAK,mIAAmI;AAAA,IAChJ;AACA,UAAM,eAAe,MAAM;AAAA,MAC1B;AAAA,QACC,iBAAiB,MAAM,UAAU,eAAe;AAAA,QAChD,qBAAqB,MAAM,UAAU,mBAAmB;AAAA,QACxD,uBAAuB,MAAM,UAAU,qBAAqB;AAAA,MAAA;AAAA,MAE7D,KAAK;AAAA,MACL,KAAK;AAAA,IAAA;AAGN,WAAO,KAAK,mBAAmB,KAAK,EAAE;AACtC,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAA,EAAS,OAAO;AAAA,MAC9D;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,OAAO,MAAM,UAAU,MAAM;AAAA,MAC7B;AAAA,IAAA,CACA;AAED,WAAO,KAAK,kBAAkB,OAAO,EAAE,kBAAkB,OAAO,UAAU,GAAG;AAC7E,WAAO,KAAmB,QAAQ,EAAE,OAAO,CAAA,OAAM,UAAU,GAAG,EAAE,GAAG,OAAO,CAAA,OAAM,GAAG,IAAI;AAAA,EACxF;AACD;"}

package/dist/development/src/commands/tenant/person/TenantPersonDisableCommand.cjs

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const cliCommon = require("@contember/cli-common");
+const confirmation = require("../../../lib/tenant/confirmation.cjs");
+const tenantOutput = require("../tenantOutput.cjs");
+class TenantPersonDisableCommand extends cliCommon.Command {
+  constructor(tenantClientProvider) {
+    super();
+    this.tenantClientProvider = tenantClientProvider;
+  }
+  configure(configuration) {
+    configuration.description("Disable a person. They can no longer sign in and all of their API keys are invalidated.");
+    configuration.argument("id").description("Person id.");
+    configuration.option("yes").valueNone().description("Do not ask for confirmation.");
+  }
+  async execute(input, output) {
+    const personId = input.getArgument("id");
+    await confirmation.requireConfirmation({
+      yes: input.getOption("yes") === true,
+      output,
+      warning: `This will disable person ${personId} and invalidate all of their API keys.`
+    });
+    await this.tenantClientProvider.person().disablePerson(personId);
+    output.info(`Person ${personId} was disabled.`);
+    output.data({ personId, disabled: true }, { human: (it) => tenantOutput.humanText(it.personId), quiet: (it) => it.personId });
+  }
+}
+exports.TenantPersonDisableCommand = TenantPersonDisableCommand;
+//# sourceMappingURL=TenantPersonDisableCommand.cjs.map

package/dist/development/src/commands/tenant/person/TenantPersonDisableCommand.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantPersonDisableCommand.cjs","sources":["../../../../../../../packages/cli/src/commands/tenant/person/TenantPersonDisableCommand.ts"],"sourcesContent":["import { Command, CommandConfiguration, Input, Output } from '@contember/cli-common'\nimport { TenantClientProvider } from '../../../lib/TenantClientProvider.js'\nimport { requireConfirmation } from '../../../lib/tenant/confirmation.js'\nimport { humanText } from '../tenantOutput.js'\n\ntype Args = {\n\tid: string\n}\n\ntype Options = {\n\tyes?: boolean\n}\n\ninterface DisableResult {\n\tpersonId: string\n\tdisabled: true\n}\n\nexport class TenantPersonDisableCommand extends Command<Args, Options> {\n\tconstructor(\n\t\tprivate readonly tenantClientProvider: TenantClientProvider,\n\t) {\n\t\tsuper()\n\t}\n\n\tprotected configure(configuration: CommandConfiguration<Args, Options>): void {\n\t\tconfiguration.description('Disable a person. They can no longer sign in and all of their API keys are invalidated.')\n\t\tconfiguration.argument('id').description('Person id.')\n\t\tconfiguration.option('yes').valueNone().description('Do not ask for confirmation.')\n\t}\n\n\tprotected async execute(input: Input<Args, Options>, output: Output): Promise<void> {\n\t\tconst personId = input.getArgument('id')\n\n\t\tawait requireConfirmation({\n\t\t\tyes: input.getOption('yes') === true,\n\t\t\toutput,\n\t\t\twarning: `This will disable person ${personId} and invalidate all of their API keys.`,\n\t\t})\n\n\t\tawait this.tenantClientProvider.person().disablePerson(personId)\n\n\t\toutput.info(`Person ${personId} was disabled.`)\n\t\toutput.data<DisableResult>({ personId, disabled: true }, { human: it => humanText(it.personId), quiet: it => it.personId })\n\t}\n}\n"],"names":["Command","requireConfirmation","humanText"],"mappings":";;;;;AAkBO,MAAM,mCAAmCA,UAAAA,QAAuB;AAAA,EACtE,YACkB,sBAChB;AACD,UAAA;AAFiB,SAAA,uBAAA;AAAA,EAGlB;AAAA,EAEU,UAAU,eAA0D;AAC7E,kBAAc,YAAY,yFAAyF;AACnH,kBAAc,SAAS,IAAI,EAAE,YAAY,YAAY;AACrD,kBAAc,OAAO,KAAK,EAAE,UAAA,EAAY,YAAY,8BAA8B;AAAA,EACnF;AAAA,EAEA,MAAgB,QAAQ,OAA6B,QAA+B;AACnF,UAAM,WAAW,MAAM,YAAY,IAAI;AAEvC,UAAMC,iCAAoB;AAAA,MACzB,KAAK,MAAM,UAAU,KAAK,MAAM;AAAA,MAChC;AAAA,MACA,SAAS,4BAA4B,QAAQ;AAAA,IAAA,CAC7C;AAED,UAAM,KAAK,qBAAqB,OAAA,EAAS,cAAc,QAAQ;AAE/D,WAAO,KAAK,UAAU,QAAQ,gBAAgB;AAC9C,WAAO,KAAoB,EAAE,UAAU,UAAU,KAAA,GAAQ,EAAE,OAAO,CAAA,OAAMC,aAAAA,UAAU,GAAG,QAAQ,GAAG,OAAO,CAAA,OAAM,GAAG,UAAU;AAAA,EAC3H;AACD;;"}

package/dist/development/src/commands/tenant/person/TenantPersonDisableCommand.js

@@ -0,0 +1,29 @@
+import { Command } from "@contember/cli-common";
+import { requireConfirmation } from "../../../lib/tenant/confirmation.js";
+import { humanText } from "../tenantOutput.js";
+class TenantPersonDisableCommand extends Command {
+  constructor(tenantClientProvider) {
+    super();
+    this.tenantClientProvider = tenantClientProvider;
+  }
+  configure(configuration) {
+    configuration.description("Disable a person. They can no longer sign in and all of their API keys are invalidated.");
+    configuration.argument("id").description("Person id.");
+    configuration.option("yes").valueNone().description("Do not ask for confirmation.");
+  }
+  async execute(input, output) {
+    const personId = input.getArgument("id");
+    await requireConfirmation({
+      yes: input.getOption("yes") === true,
+      output,
+      warning: `This will disable person ${personId} and invalidate all of their API keys.`
+    });
+    await this.tenantClientProvider.person().disablePerson(personId);
+    output.info(`Person ${personId} was disabled.`);
+    output.data({ personId, disabled: true }, { human: (it) => humanText(it.personId), quiet: (it) => it.personId });
+  }
+}
+export {
+  TenantPersonDisableCommand
+};
+//# sourceMappingURL=TenantPersonDisableCommand.js.map

package/dist/development/src/commands/tenant/person/TenantPersonDisableCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantPersonDisableCommand.js","sources":["../../../../../../../packages/cli/src/commands/tenant/person/TenantPersonDisableCommand.ts"],"sourcesContent":["import { Command, CommandConfiguration, Input, Output } from '@contember/cli-common'\nimport { TenantClientProvider } from '../../../lib/TenantClientProvider.js'\nimport { requireConfirmation } from '../../../lib/tenant/confirmation.js'\nimport { humanText } from '../tenantOutput.js'\n\ntype Args = {\n\tid: string\n}\n\ntype Options = {\n\tyes?: boolean\n}\n\ninterface DisableResult {\n\tpersonId: string\n\tdisabled: true\n}\n\nexport class TenantPersonDisableCommand extends Command<Args, Options> {\n\tconstructor(\n\t\tprivate readonly tenantClientProvider: TenantClientProvider,\n\t) {\n\t\tsuper()\n\t}\n\n\tprotected configure(configuration: CommandConfiguration<Args, Options>): void {\n\t\tconfiguration.description('Disable a person. They can no longer sign in and all of their API keys are invalidated.')\n\t\tconfiguration.argument('id').description('Person id.')\n\t\tconfiguration.option('yes').valueNone().description('Do not ask for confirmation.')\n\t}\n\n\tprotected async execute(input: Input<Args, Options>, output: Output): Promise<void> {\n\t\tconst personId = input.getArgument('id')\n\n\t\tawait requireConfirmation({\n\t\t\tyes: input.getOption('yes') === true,\n\t\t\toutput,\n\t\t\twarning: `This will disable person ${personId} and invalidate all of their API keys.`,\n\t\t})\n\n\t\tawait this.tenantClientProvider.person().disablePerson(personId)\n\n\t\toutput.info(`Person ${personId} was disabled.`)\n\t\toutput.data<DisableResult>({ personId, disabled: true }, { human: it => humanText(it.personId), quiet: it => it.personId })\n\t}\n}\n"],"names":[],"mappings":";;;AAkBO,MAAM,mCAAmC,QAAuB;AAAA,EACtE,YACkB,sBAChB;AACD,UAAA;AAFiB,SAAA,uBAAA;AAAA,EAGlB;AAAA,EAEU,UAAU,eAA0D;AAC7E,kBAAc,YAAY,yFAAyF;AACnH,kBAAc,SAAS,IAAI,EAAE,YAAY,YAAY;AACrD,kBAAc,OAAO,KAAK,EAAE,UAAA,EAAY,YAAY,8BAA8B;AAAA,EACnF;AAAA,EAEA,MAAgB,QAAQ,OAA6B,QAA+B;AACnF,UAAM,WAAW,MAAM,YAAY,IAAI;AAEvC,UAAM,oBAAoB;AAAA,MACzB,KAAK,MAAM,UAAU,KAAK,MAAM;AAAA,MAChC;AAAA,MACA,SAAS,4BAA4B,QAAQ;AAAA,IAAA,CAC7C;AAED,UAAM,KAAK,qBAAqB,OAAA,EAAS,cAAc,QAAQ;AAE/D,WAAO,KAAK,UAAU,QAAQ,gBAAgB;AAC9C,WAAO,KAAoB,EAAE,UAAU,UAAU,KAAA,GAAQ,EAAE,OAAO,CAAA,OAAM,UAAU,GAAG,QAAQ,GAAG,OAAO,CAAA,OAAM,GAAG,UAAU;AAAA,EAC3H;AACD;"}

package/dist/development/src/commands/tenant/person/TenantPersonListCommand.cjs

@@ -0,0 +1,53 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const cliCommon = require("@contember/cli-common");
+const pagination = require("../../../lib/tenant/input/pagination.cjs");
+class TenantPersonListCommand extends cliCommon.Command {
+  constructor(tenantClientProvider) {
+    super();
+    this.tenantClientProvider = tenantClientProvider;
+  }
+  configure(configuration) {
+    configuration.description(
+      "List persons. A SUPER_ADMIN sees everyone, anyone else only the members of projects they may view members of."
+    );
+    configuration.option("email").valueRequired().description("Filter by e-mail address (case-insensitive substring match).");
+    configuration.option("person-id").valueRequired().description("Filter by person id.");
+    configuration.option("identity-id").valueRequired().description("Filter by identity id.");
+    configuration.option("limit").valueRequired().description(
+      "Page size. The server caps it (default 100, max 1000) — this command never paginates behind your back."
+    );
+    configuration.option("offset").valueRequired().description("Number of persons to skip. Combine with --limit to page through the list.");
+  }
+  async execute(input, output) {
+    const filter = {
+      email: input.getOption("email"),
+      personId: input.getOption("person-id"),
+      identityId: input.getOption("identity-id")
+    };
+    const hasFilter = filter.email !== void 0 || filter.personId !== void 0 || filter.identityId !== void 0;
+    const persons = await this.tenantClientProvider.person().listPersons({
+      filter: hasFilter ? filter : void 0,
+      limit: pagination.parsePaginationLimit(input.getOption("limit")),
+      offset: pagination.parsePaginationOffset(input.getOption("offset"))
+    });
+    if (persons.length === 0) {
+      output.info("No persons matched.");
+    }
+    output.table(
+      [
+        { field: "id", name: "ID" },
+        { field: "email", name: "E-mail" },
+        { field: "name", name: "Name" },
+        { field: "identityId", name: "Identity" },
+        { field: "otpEnabled", name: "TOTP" },
+        { field: "emailOtpEnabled", name: "E-mail OTP" },
+        { field: "emailVerified", name: "Verified" }
+      ],
+      persons,
+      "id"
+    );
+  }
+}
+exports.TenantPersonListCommand = TenantPersonListCommand;
+//# sourceMappingURL=TenantPersonListCommand.cjs.map