@contember/cli 2.2.0-alpha.2 → 2.2.0-alpha.4

package/dist/development/src/commands/tenant/person/TenantPersonListCommand.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantPersonListCommand.cjs","sources":["../../../../../../../packages/cli/src/commands/tenant/person/TenantPersonListCommand.ts"],"sourcesContent":["import { Command, CommandConfiguration, Input, Output } from '@contember/cli-common'\nimport { PersonsFilter } from '@contember/graphql-client-tenant'\nimport { TenantClientProvider } from '../../../lib/TenantClientProvider.js'\nimport { TenantPerson } from '../../../lib/tenant/clients/TenantPersonClient.js'\nimport { parsePaginationLimit, parsePaginationOffset } from '../../../lib/tenant/input/pagination.js'\n\ntype Args = {}\n\ntype Options = {\n\temail?: string\n\t['person-id']?: string\n\t['identity-id']?: string\n\tlimit?: string\n\toffset?: string\n}\n\nexport class TenantPersonListCommand extends Command<Args, Options> {\n\tconstructor(\n\t\tprivate readonly tenantClientProvider: TenantClientProvider,\n\t) {\n\t\tsuper()\n\t}\n\n\tprotected configure(configuration: CommandConfiguration<Args, Options>): void {\n\t\tconfiguration.description(\n\t\t\t'List persons. A SUPER_ADMIN sees everyone, anyone else only the members of projects they may view members of.',\n\t\t)\n\t\tconfiguration.option('email').valueRequired().description('Filter by e-mail address (case-insensitive substring match).')\n\t\tconfiguration.option('person-id').valueRequired().description('Filter by person id.')\n\t\tconfiguration.option('identity-id').valueRequired().description('Filter by identity id.')\n\t\tconfiguration.option('limit').valueRequired().description(\n\t\t\t'Page size. The server caps it (default 100, max 1000) — this command never paginates behind your back.',\n\t\t)\n\t\tconfiguration.option('offset').valueRequired().description('Number of persons to skip. Combine with --limit to page through the list.')\n\t}\n\n\tprotected async execute(input: Input<Args, Options>, output: Output): Promise<void> {\n\t\tconst filter: PersonsFilter = {\n\t\t\temail: input.getOption('email'),\n\t\t\tpersonId: input.getOption('person-id'),\n\t\t\tidentityId: input.getOption('identity-id'),\n\t\t}\n\t\tconst hasFilter = filter.email !== undefined || filter.personId !== undefined || filter.identityId !== undefined\n\n\t\tconst persons = await this.tenantClientProvider.person().listPersons({\n\t\t\tfilter: hasFilter ? filter : undefined,\n\t\t\tlimit: parsePaginationLimit(input.getOption('limit')),\n\t\t\toffset: parsePaginationOffset(input.getOption('offset')),\n\t\t})\n\n\t\tif (persons.length === 0) {\n\t\t\toutput.info('No persons matched.')\n\t\t}\n\t\toutput.table<TenantPerson>(\n\t\t\t[\n\t\t\t\t{ field: 'id', name: 'ID' },\n\t\t\t\t{ field: 'email', name: 'E-mail' },\n\t\t\t\t{ field: 'name', name: 'Name' },\n\t\t\t\t{ field: 'identityId', name: 'Identity' },\n\t\t\t\t{ field: 'otpEnabled', name: 'TOTP' },\n\t\t\t\t{ field: 'emailOtpEnabled', name: 'E-mail OTP' },\n\t\t\t\t{ field: 'emailVerified', name: 'Verified' },\n\t\t\t],\n\t\t\tpersons,\n\t\t\t'id',\n\t\t)\n\t}\n}\n"],"names":["Command","parsePaginationLimit","parsePaginationOffset"],"mappings":";;;;AAgBO,MAAM,gCAAgCA,UAAAA,QAAuB;AAAA,EACnE,YACkB,sBAChB;AACD,UAAA;AAFiB,SAAA,uBAAA;AAAA,EAGlB;AAAA,EAEU,UAAU,eAA0D;AAC7E,kBAAc;AAAA,MACb;AAAA,IAAA;AAED,kBAAc,OAAO,OAAO,EAAE,cAAA,EAAgB,YAAY,8DAA8D;AACxH,kBAAc,OAAO,WAAW,EAAE,cAAA,EAAgB,YAAY,sBAAsB;AACpF,kBAAc,OAAO,aAAa,EAAE,cAAA,EAAgB,YAAY,wBAAwB;AACxF,kBAAc,OAAO,OAAO,EAAE,cAAA,EAAgB;AAAA,MAC7C;AAAA,IAAA;AAED,kBAAc,OAAO,QAAQ,EAAE,cAAA,EAAgB,YAAY,2EAA2E;AAAA,EACvI;AAAA,EAEA,MAAgB,QAAQ,OAA6B,QAA+B;AACnF,UAAM,SAAwB;AAAA,MAC7B,OAAO,MAAM,UAAU,OAAO;AAAA,MAC9B,UAAU,MAAM,UAAU,WAAW;AAAA,MACrC,YAAY,MAAM,UAAU,aAAa;AAAA,IAAA;AAE1C,UAAM,YAAY,OAAO,UAAU,UAAa,OAAO,aAAa,UAAa,OAAO,eAAe;AAEvG,UAAM,UAAU,MAAM,KAAK,qBAAqB,OAAA,EAAS,YAAY;AAAA,MACpE,QAAQ,YAAY,SAAS;AAAA,MAC7B,OAAOC,WAAAA,qBAAqB,MAAM,UAAU,OAAO,CAAC;AAAA,MACpD,QAAQC,WAAAA,sBAAsB,MAAM,UAAU,QAAQ,CAAC;AAAA,IAAA,CACvD;AAED,QAAI,QAAQ,WAAW,GAAG;AACzB,aAAO,KAAK,qBAAqB;AAAA,IAClC;AACA,WAAO;AAAA,MACN;AAAA,QACC,EAAE,OAAO,MAAM,MAAM,KAAA;AAAA,QACrB,EAAE,OAAO,SAAS,MAAM,SAAA;AAAA,QACxB,EAAE,OAAO,QAAQ,MAAM,OAAA;AAAA,QACvB,EAAE,OAAO,cAAc,MAAM,WAAA;AAAA,QAC7B,EAAE,OAAO,cAAc,MAAM,OAAA;AAAA,QAC7B,EAAE,OAAO,mBAAmB,MAAM,aAAA;AAAA,QAClC,EAAE,OAAO,iBAAiB,MAAM,WAAA;AAAA,MAAW;AAAA,MAE5C;AAAA,MACA;AAAA,IAAA;AAAA,EAEF;AACD;;"}

package/dist/development/src/commands/tenant/person/TenantPersonListCommand.js

@@ -0,0 +1,53 @@
+import { Command } from "@contember/cli-common";
+import { parsePaginationOffset, parsePaginationLimit } from "../../../lib/tenant/input/pagination.js";
+class TenantPersonListCommand extends Command {
+  constructor(tenantClientProvider) {
+    super();
+    this.tenantClientProvider = tenantClientProvider;
+  }
+  configure(configuration) {
+    configuration.description(
+      "List persons. A SUPER_ADMIN sees everyone, anyone else only the members of projects they may view members of."
+    );
+    configuration.option("email").valueRequired().description("Filter by e-mail address (case-insensitive substring match).");
+    configuration.option("person-id").valueRequired().description("Filter by person id.");
+    configuration.option("identity-id").valueRequired().description("Filter by identity id.");
+    configuration.option("limit").valueRequired().description(
+      "Page size. The server caps it (default 100, max 1000) — this command never paginates behind your back."
+    );
+    configuration.option("offset").valueRequired().description("Number of persons to skip. Combine with --limit to page through the list.");
+  }
+  async execute(input, output) {
+    const filter = {
+      email: input.getOption("email"),
+      personId: input.getOption("person-id"),
+      identityId: input.getOption("identity-id")
+    };
+    const hasFilter = filter.email !== void 0 || filter.personId !== void 0 || filter.identityId !== void 0;
+    const persons = await this.tenantClientProvider.person().listPersons({
+      filter: hasFilter ? filter : void 0,
+      limit: parsePaginationLimit(input.getOption("limit")),
+      offset: parsePaginationOffset(input.getOption("offset"))
+    });
+    if (persons.length === 0) {
+      output.info("No persons matched.");
+    }
+    output.table(
+      [
+        { field: "id", name: "ID" },
+        { field: "email", name: "E-mail" },
+        { field: "name", name: "Name" },
+        { field: "identityId", name: "Identity" },
+        { field: "otpEnabled", name: "TOTP" },
+        { field: "emailOtpEnabled", name: "E-mail OTP" },
+        { field: "emailVerified", name: "Verified" }
+      ],
+      persons,
+      "id"
+    );
+  }
+}
+export {
+  TenantPersonListCommand
+};
+//# sourceMappingURL=TenantPersonListCommand.js.map

package/dist/development/src/commands/tenant/person/TenantPersonListCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantPersonListCommand.js","sources":["../../../../../../../packages/cli/src/commands/tenant/person/TenantPersonListCommand.ts"],"sourcesContent":["import { Command, CommandConfiguration, Input, Output } from '@contember/cli-common'\nimport { PersonsFilter } from '@contember/graphql-client-tenant'\nimport { TenantClientProvider } from '../../../lib/TenantClientProvider.js'\nimport { TenantPerson } from '../../../lib/tenant/clients/TenantPersonClient.js'\nimport { parsePaginationLimit, parsePaginationOffset } from '../../../lib/tenant/input/pagination.js'\n\ntype Args = {}\n\ntype Options = {\n\temail?: string\n\t['person-id']?: string\n\t['identity-id']?: string\n\tlimit?: string\n\toffset?: string\n}\n\nexport class TenantPersonListCommand extends Command<Args, Options> {\n\tconstructor(\n\t\tprivate readonly tenantClientProvider: TenantClientProvider,\n\t) {\n\t\tsuper()\n\t}\n\n\tprotected configure(configuration: CommandConfiguration<Args, Options>): void {\n\t\tconfiguration.description(\n\t\t\t'List persons. A SUPER_ADMIN sees everyone, anyone else only the members of projects they may view members of.',\n\t\t)\n\t\tconfiguration.option('email').valueRequired().description('Filter by e-mail address (case-insensitive substring match).')\n\t\tconfiguration.option('person-id').valueRequired().description('Filter by person id.')\n\t\tconfiguration.option('identity-id').valueRequired().description('Filter by identity id.')\n\t\tconfiguration.option('limit').valueRequired().description(\n\t\t\t'Page size. The server caps it (default 100, max 1000) — this command never paginates behind your back.',\n\t\t)\n\t\tconfiguration.option('offset').valueRequired().description('Number of persons to skip. Combine with --limit to page through the list.')\n\t}\n\n\tprotected async execute(input: Input<Args, Options>, output: Output): Promise<void> {\n\t\tconst filter: PersonsFilter = {\n\t\t\temail: input.getOption('email'),\n\t\t\tpersonId: input.getOption('person-id'),\n\t\t\tidentityId: input.getOption('identity-id'),\n\t\t}\n\t\tconst hasFilter = filter.email !== undefined || filter.personId !== undefined || filter.identityId !== undefined\n\n\t\tconst persons = await this.tenantClientProvider.person().listPersons({\n\t\t\tfilter: hasFilter ? filter : undefined,\n\t\t\tlimit: parsePaginationLimit(input.getOption('limit')),\n\t\t\toffset: parsePaginationOffset(input.getOption('offset')),\n\t\t})\n\n\t\tif (persons.length === 0) {\n\t\t\toutput.info('No persons matched.')\n\t\t}\n\t\toutput.table<TenantPerson>(\n\t\t\t[\n\t\t\t\t{ field: 'id', name: 'ID' },\n\t\t\t\t{ field: 'email', name: 'E-mail' },\n\t\t\t\t{ field: 'name', name: 'Name' },\n\t\t\t\t{ field: 'identityId', name: 'Identity' },\n\t\t\t\t{ field: 'otpEnabled', name: 'TOTP' },\n\t\t\t\t{ field: 'emailOtpEnabled', name: 'E-mail OTP' },\n\t\t\t\t{ field: 'emailVerified', name: 'Verified' },\n\t\t\t],\n\t\t\tpersons,\n\t\t\t'id',\n\t\t)\n\t}\n}\n"],"names":[],"mappings":";;AAgBO,MAAM,gCAAgC,QAAuB;AAAA,EACnE,YACkB,sBAChB;AACD,UAAA;AAFiB,SAAA,uBAAA;AAAA,EAGlB;AAAA,EAEU,UAAU,eAA0D;AAC7E,kBAAc;AAAA,MACb;AAAA,IAAA;AAED,kBAAc,OAAO,OAAO,EAAE,cAAA,EAAgB,YAAY,8DAA8D;AACxH,kBAAc,OAAO,WAAW,EAAE,cAAA,EAAgB,YAAY,sBAAsB;AACpF,kBAAc,OAAO,aAAa,EAAE,cAAA,EAAgB,YAAY,wBAAwB;AACxF,kBAAc,OAAO,OAAO,EAAE,cAAA,EAAgB;AAAA,MAC7C;AAAA,IAAA;AAED,kBAAc,OAAO,QAAQ,EAAE,cAAA,EAAgB,YAAY,2EAA2E;AAAA,EACvI;AAAA,EAEA,MAAgB,QAAQ,OAA6B,QAA+B;AACnF,UAAM,SAAwB;AAAA,MAC7B,OAAO,MAAM,UAAU,OAAO;AAAA,MAC9B,UAAU,MAAM,UAAU,WAAW;AAAA,MACrC,YAAY,MAAM,UAAU,aAAa;AAAA,IAAA;AAE1C,UAAM,YAAY,OAAO,UAAU,UAAa,OAAO,aAAa,UAAa,OAAO,eAAe;AAEvG,UAAM,UAAU,MAAM,KAAK,qBAAqB,OAAA,EAAS,YAAY;AAAA,MACpE,QAAQ,YAAY,SAAS;AAAA,MAC7B,OAAO,qBAAqB,MAAM,UAAU,OAAO,CAAC;AAAA,MACpD,QAAQ,sBAAsB,MAAM,UAAU,QAAQ,CAAC;AAAA,IAAA,CACvD;AAED,QAAI,QAAQ,WAAW,GAAG;AACzB,aAAO,KAAK,qBAAqB;AAAA,IAClC;AACA,WAAO;AAAA,MACN;AAAA,QACC,EAAE,OAAO,MAAM,MAAM,KAAA;AAAA,QACrB,EAAE,OAAO,SAAS,MAAM,SAAA;AAAA,QACxB,EAAE,OAAO,QAAQ,MAAM,OAAA;AAAA,QACvB,EAAE,OAAO,cAAc,MAAM,WAAA;AAAA,QAC7B,EAAE,OAAO,cAAc,MAAM,OAAA;AAAA,QAC7B,EAAE,OAAO,mBAAmB,MAAM,aAAA;AAAA,QAClC,EAAE,OAAO,iBAAiB,MAAM,WAAA;AAAA,MAAW;AAAA,MAE5C;AAAA,MACA;AAAA,IAAA;AAAA,EAEF;AACD;"}

package/dist/development/src/commands/tenant/person/TenantPersonResetMfaCommand.cjs

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const cliCommon = require("@contember/cli-common");
+const confirmation = require("../../../lib/tenant/confirmation.cjs");
+const tenantOutput = require("../tenantOutput.cjs");
+class TenantPersonResetMfaCommand extends cliCommon.Command {
+  constructor(tenantClientProvider) {
+    super();
+    this.tenantClientProvider = tenantClientProvider;
+  }
+  configure(configuration) {
+    configuration.description(
+      "Reset every MFA factor of a locked-out person: active and pending TOTP, e-mail OTP, and their backup codes. The person can enroll again afterwards. An account-recovery operation, recorded in the auth log."
+    );
+    configuration.argument("id").description("Person id.");
+    configuration.option("yes").valueNone().description("Do not ask for confirmation.");
+  }
+  async execute(input, output) {
+    const personId = input.getArgument("id");
+    await confirmation.requireConfirmation({
+      yes: input.getOption("yes") === true,
+      output,
+      warning: `This will remove TOTP, e-mail OTP and the backup codes of person ${personId}, leaving the account without a second factor.`
+    });
+    await this.tenantClientProvider.person().resetPersonMfa(personId);
+    output.info(`MFA of person ${personId} was reset: TOTP and e-mail OTP disabled, backup codes deleted.`);
+    output.data({
+      personId,
+      mfaReset: true,
+      totpDisabled: true,
+      emailOtpDisabled: true,
+      backupCodesDeleted: true
+    }, { human: (it) => tenantOutput.humanText(it.personId), quiet: (it) => it.personId });
+  }
+}
+exports.TenantPersonResetMfaCommand = TenantPersonResetMfaCommand;
+//# sourceMappingURL=TenantPersonResetMfaCommand.cjs.map

package/dist/development/src/commands/tenant/person/TenantPersonResetMfaCommand.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantPersonResetMfaCommand.cjs","sources":["../../../../../../../packages/cli/src/commands/tenant/person/TenantPersonResetMfaCommand.ts"],"sourcesContent":["import { Command, CommandConfiguration, Input, Output } from '@contember/cli-common'\nimport { TenantClientProvider } from '../../../lib/TenantClientProvider.js'\nimport { requireConfirmation } from '../../../lib/tenant/confirmation.js'\nimport { humanText } from '../tenantOutput.js'\n\ntype Args = {\n\tid: string\n}\n\ntype Options = {\n\tyes?: boolean\n}\n\n/** Spells out every factor the server clears, so an incident report can be written straight off this payload. */\ninterface ResetMfaResult {\n\tpersonId: string\n\tmfaReset: true\n\ttotpDisabled: true\n\temailOtpDisabled: true\n\tbackupCodesDeleted: true\n}\n\nexport class TenantPersonResetMfaCommand extends Command<Args, Options> {\n\tconstructor(\n\t\tprivate readonly tenantClientProvider: TenantClientProvider,\n\t) {\n\t\tsuper()\n\t}\n\n\tprotected configure(configuration: CommandConfiguration<Args, Options>): void {\n\t\tconfiguration.description(\n\t\t\t'Reset every MFA factor of a locked-out person: active and pending TOTP, e-mail OTP, and their backup codes. '\n\t\t\t\t+ 'The person can enroll again afterwards. An account-recovery operation, recorded in the auth log.',\n\t\t)\n\t\tconfiguration.argument('id').description('Person id.')\n\t\tconfiguration.option('yes').valueNone().description('Do not ask for confirmation.')\n\t}\n\n\tprotected async execute(input: Input<Args, Options>, output: Output): Promise<void> {\n\t\tconst personId = input.getArgument('id')\n\n\t\tawait requireConfirmation({\n\t\t\tyes: input.getOption('yes') === true,\n\t\t\toutput,\n\t\t\twarning: `This will remove TOTP, e-mail OTP and the backup codes of person ${personId}, leaving the account without a second factor.`,\n\t\t})\n\n\t\tawait this.tenantClientProvider.person().resetPersonMfa(personId)\n\n\t\toutput.info(`MFA of person ${personId} was reset: TOTP and e-mail OTP disabled, backup codes deleted.`)\n\t\toutput.data<ResetMfaResult>({\n\t\t\tpersonId,\n\t\t\tmfaReset: true,\n\t\t\ttotpDisabled: true,\n\t\t\temailOtpDisabled: true,\n\t\t\tbackupCodesDeleted: true,\n\t\t}, { human: it => humanText(it.personId), quiet: it => it.personId })\n\t}\n}\n"],"names":["Command","requireConfirmation","humanText"],"mappings":";;;;;AAsBO,MAAM,oCAAoCA,UAAAA,QAAuB;AAAA,EACvE,YACkB,sBAChB;AACD,UAAA;AAFiB,SAAA,uBAAA;AAAA,EAGlB;AAAA,EAEU,UAAU,eAA0D;AAC7E,kBAAc;AAAA,MACb;AAAA,IAAA;AAGD,kBAAc,SAAS,IAAI,EAAE,YAAY,YAAY;AACrD,kBAAc,OAAO,KAAK,EAAE,UAAA,EAAY,YAAY,8BAA8B;AAAA,EACnF;AAAA,EAEA,MAAgB,QAAQ,OAA6B,QAA+B;AACnF,UAAM,WAAW,MAAM,YAAY,IAAI;AAEvC,UAAMC,iCAAoB;AAAA,MACzB,KAAK,MAAM,UAAU,KAAK,MAAM;AAAA,MAChC;AAAA,MACA,SAAS,oEAAoE,QAAQ;AAAA,IAAA,CACrF;AAED,UAAM,KAAK,qBAAqB,OAAA,EAAS,eAAe,QAAQ;AAEhE,WAAO,KAAK,iBAAiB,QAAQ,iEAAiE;AACtG,WAAO,KAAqB;AAAA,MAC3B;AAAA,MACA,UAAU;AAAA,MACV,cAAc;AAAA,MACd,kBAAkB;AAAA,MAClB,oBAAoB;AAAA,IAAA,GAClB,EAAE,OAAO,CAAA,OAAMC,aAAAA,UAAU,GAAG,QAAQ,GAAG,OAAO,CAAA,OAAM,GAAG,SAAA,CAAU;AAAA,EACrE;AACD;;"}

package/dist/development/src/commands/tenant/person/TenantPersonResetMfaCommand.js

@@ -0,0 +1,37 @@
+import { Command } from "@contember/cli-common";
+import { requireConfirmation } from "../../../lib/tenant/confirmation.js";
+import { humanText } from "../tenantOutput.js";
+class TenantPersonResetMfaCommand extends Command {
+  constructor(tenantClientProvider) {
+    super();
+    this.tenantClientProvider = tenantClientProvider;
+  }
+  configure(configuration) {
+    configuration.description(
+      "Reset every MFA factor of a locked-out person: active and pending TOTP, e-mail OTP, and their backup codes. The person can enroll again afterwards. An account-recovery operation, recorded in the auth log."
+    );
+    configuration.argument("id").description("Person id.");
+    configuration.option("yes").valueNone().description("Do not ask for confirmation.");
+  }
+  async execute(input, output) {
+    const personId = input.getArgument("id");
+    await requireConfirmation({
+      yes: input.getOption("yes") === true,
+      output,
+      warning: `This will remove TOTP, e-mail OTP and the backup codes of person ${personId}, leaving the account without a second factor.`
+    });
+    await this.tenantClientProvider.person().resetPersonMfa(personId);
+    output.info(`MFA of person ${personId} was reset: TOTP and e-mail OTP disabled, backup codes deleted.`);
+    output.data({
+      personId,
+      mfaReset: true,
+      totpDisabled: true,
+      emailOtpDisabled: true,
+      backupCodesDeleted: true
+    }, { human: (it) => humanText(it.personId), quiet: (it) => it.personId });
+  }
+}
+export {
+  TenantPersonResetMfaCommand
+};
+//# sourceMappingURL=TenantPersonResetMfaCommand.js.map

package/dist/development/src/commands/tenant/person/TenantPersonResetMfaCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantPersonResetMfaCommand.js","sources":["../../../../../../../packages/cli/src/commands/tenant/person/TenantPersonResetMfaCommand.ts"],"sourcesContent":["import { Command, CommandConfiguration, Input, Output } from '@contember/cli-common'\nimport { TenantClientProvider } from '../../../lib/TenantClientProvider.js'\nimport { requireConfirmation } from '../../../lib/tenant/confirmation.js'\nimport { humanText } from '../tenantOutput.js'\n\ntype Args = {\n\tid: string\n}\n\ntype Options = {\n\tyes?: boolean\n}\n\n/** Spells out every factor the server clears, so an incident report can be written straight off this payload. */\ninterface ResetMfaResult {\n\tpersonId: string\n\tmfaReset: true\n\ttotpDisabled: true\n\temailOtpDisabled: true\n\tbackupCodesDeleted: true\n}\n\nexport class TenantPersonResetMfaCommand extends Command<Args, Options> {\n\tconstructor(\n\t\tprivate readonly tenantClientProvider: TenantClientProvider,\n\t) {\n\t\tsuper()\n\t}\n\n\tprotected configure(configuration: CommandConfiguration<Args, Options>): void {\n\t\tconfiguration.description(\n\t\t\t'Reset every MFA factor of a locked-out person: active and pending TOTP, e-mail OTP, and their backup codes. '\n\t\t\t\t+ 'The person can enroll again afterwards. An account-recovery operation, recorded in the auth log.',\n\t\t)\n\t\tconfiguration.argument('id').description('Person id.')\n\t\tconfiguration.option('yes').valueNone().description('Do not ask for confirmation.')\n\t}\n\n\tprotected async execute(input: Input<Args, Options>, output: Output): Promise<void> {\n\t\tconst personId = input.getArgument('id')\n\n\t\tawait requireConfirmation({\n\t\t\tyes: input.getOption('yes') === true,\n\t\t\toutput,\n\t\t\twarning: `This will remove TOTP, e-mail OTP and the backup codes of person ${personId}, leaving the account without a second factor.`,\n\t\t})\n\n\t\tawait this.tenantClientProvider.person().resetPersonMfa(personId)\n\n\t\toutput.info(`MFA of person ${personId} was reset: TOTP and e-mail OTP disabled, backup codes deleted.`)\n\t\toutput.data<ResetMfaResult>({\n\t\t\tpersonId,\n\t\t\tmfaReset: true,\n\t\t\ttotpDisabled: true,\n\t\t\temailOtpDisabled: true,\n\t\t\tbackupCodesDeleted: true,\n\t\t}, { human: it => humanText(it.personId), quiet: it => it.personId })\n\t}\n}\n"],"names":[],"mappings":";;;AAsBO,MAAM,oCAAoC,QAAuB;AAAA,EACvE,YACkB,sBAChB;AACD,UAAA;AAFiB,SAAA,uBAAA;AAAA,EAGlB;AAAA,EAEU,UAAU,eAA0D;AAC7E,kBAAc;AAAA,MACb;AAAA,IAAA;AAGD,kBAAc,SAAS,IAAI,EAAE,YAAY,YAAY;AACrD,kBAAc,OAAO,KAAK,EAAE,UAAA,EAAY,YAAY,8BAA8B;AAAA,EACnF;AAAA,EAEA,MAAgB,QAAQ,OAA6B,QAA+B;AACnF,UAAM,WAAW,MAAM,YAAY,IAAI;AAEvC,UAAM,oBAAoB;AAAA,MACzB,KAAK,MAAM,UAAU,KAAK,MAAM;AAAA,MAChC;AAAA,MACA,SAAS,oEAAoE,QAAQ;AAAA,IAAA,CACrF;AAED,UAAM,KAAK,qBAAqB,OAAA,EAAS,eAAe,QAAQ;AAEhE,WAAO,KAAK,iBAAiB,QAAQ,iEAAiE;AACtG,WAAO,KAAqB;AAAA,MAC3B;AAAA,MACA,UAAU;AAAA,MACV,cAAc;AAAA,MACd,kBAAkB;AAAA,MAClB,oBAAoB;AAAA,IAAA,GAClB,EAAE,OAAO,CAAA,OAAM,UAAU,GAAG,QAAQ,GAAG,OAAO,CAAA,OAAM,GAAG,SAAA,CAAU;AAAA,EACrE;AACD;"}

package/dist/development/src/commands/tenant/person/TenantPersonResetPasswordRequestCommand.cjs

@@ -0,0 +1,47 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const cliCommon = require("@contember/cli-common");
+const stdin = require("../../../lib/tenant/stdin.cjs");
+const personInput = require("./personInput.cjs");
+const tenantOutput = require("../tenantOutput.cjs");
+class TenantPersonResetPasswordRequestCommand extends cliCommon.Command {
+  constructor(tenantClientProvider, readStdin = stdin.readStdinText, readEnvironment = (name) => process.env[name]) {
+    super();
+    this.tenantClientProvider = tenantClientProvider;
+    this.readStdin = readStdin;
+    this.readEnvironment = readEnvironment;
+  }
+  configure(configuration) {
+    configuration.description(
+      "Send a password-reset e-mail to an address. Consumes the per-IP password-reset rate limit (config rateLimits.passwordResetPerIp, disabled by default) and reports success even for an unknown address, unless the tenant enables login.revealUserExists."
+    );
+    configuration.argument("email").description("E-mail address of the person to send the reset link to.");
+    configuration.option("mail-project").valueRequired().description("Project slug whose mail template variant is used.");
+    configuration.option("mail-variant").valueRequired().description("Mail template variant, usually a locale.");
+    personInput.configureCaptchaTokenOptions(configuration);
+  }
+  async execute(input, output) {
+    const email = input.getArgument("email");
+    const mailProject = input.getOption("mail-project");
+    const mailVariant = input.getOption("mail-variant");
+    const captchaToken = await personInput.resolveCaptchaToken(
+      {
+        "captcha-token": input.getOption("captcha-token"),
+        "captcha-token-env": input.getOption("captcha-token-env"),
+        "captcha-token-stdin": input.getOption("captcha-token-stdin")
+      },
+      this.readStdin,
+      this.readEnvironment
+    );
+    await this.tenantClientProvider.person().createResetPasswordRequest(email, { mailProject, mailVariant }, captchaToken);
+    output.info(`Password reset requested for ${email}. An unknown address is reported as success too, so this is not proof the person exists.`);
+    output.data({
+      email,
+      requested: true,
+      mailProject: mailProject ?? null,
+      mailVariant: mailVariant ?? null
+    }, { human: (it) => tenantOutput.humanText(it.email), quiet: (it) => it.email });
+  }
+}
+exports.TenantPersonResetPasswordRequestCommand = TenantPersonResetPasswordRequestCommand;
+//# sourceMappingURL=TenantPersonResetPasswordRequestCommand.cjs.map

package/dist/development/src/commands/tenant/person/TenantPersonResetPasswordRequestCommand.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantPersonResetPasswordRequestCommand.cjs","sources":["../../../../../../../packages/cli/src/commands/tenant/person/TenantPersonResetPasswordRequestCommand.ts"],"sourcesContent":["import { Command, CommandConfiguration, Input, Output } from '@contember/cli-common'\nimport { TenantClientProvider } from '../../../lib/TenantClientProvider.js'\nimport { readStdinText, type StdinReader } from '../../../lib/tenant/stdin.js'\nimport { type CaptchaTokenOptions, configureCaptchaTokenOptions, resolveCaptchaToken } from './personInput.js'\nimport { humanText } from '../tenantOutput.js'\n\ntype Args = {\n\temail: string\n}\n\ntype Options = CaptchaTokenOptions & {\n\t['mail-project']?: string\n\t['mail-variant']?: string\n}\n\ninterface ResetPasswordRequestResult {\n\temail: string\n\trequested: true\n\tmailProject: string | null\n\tmailVariant: string | null\n}\n\nexport class TenantPersonResetPasswordRequestCommand extends Command<Args, Options> {\n\tconstructor(\n\t\tprivate readonly tenantClientProvider: TenantClientProvider,\n\t\tprivate readonly readStdin: StdinReader = readStdinText,\n\t\tprivate readonly readEnvironment: (name: string) => string | undefined = name => process.env[name],\n\t) {\n\t\tsuper()\n\t}\n\n\tprotected configure(configuration: CommandConfiguration<Args, Options>): void {\n\t\tconfiguration.description(\n\t\t\t'Send a password-reset e-mail to an address. Consumes the per-IP password-reset rate limit (config rateLimits.passwordResetPerIp, '\n\t\t\t\t+ 'disabled by default) and reports success even for an unknown address, unless the tenant enables login.revealUserExists.',\n\t\t)\n\t\tconfiguration.argument('email').description('E-mail address of the person to send the reset link to.')\n\t\tconfiguration.option('mail-project').valueRequired().description('Project slug whose mail template variant is used.')\n\t\tconfiguration.option('mail-variant').valueRequired().description('Mail template variant, usually a locale.')\n\t\tconfigureCaptchaTokenOptions(configuration)\n\t}\n\n\tprotected async execute(input: Input<Args, Options>, output: Output): Promise<void> {\n\t\tconst email = input.getArgument('email')\n\t\tconst mailProject = input.getOption('mail-project')\n\t\tconst mailVariant = input.getOption('mail-variant')\n\t\tconst captchaToken = await resolveCaptchaToken(\n\t\t\t{\n\t\t\t\t'captcha-token': input.getOption('captcha-token'),\n\t\t\t\t'captcha-token-env': input.getOption('captcha-token-env'),\n\t\t\t\t'captcha-token-stdin': input.getOption('captcha-token-stdin'),\n\t\t\t},\n\t\t\tthis.readStdin,\n\t\t\tthis.readEnvironment,\n\t\t)\n\n\t\tawait this.tenantClientProvider.person().createResetPasswordRequest(email, { mailProject, mailVariant }, captchaToken)\n\n\t\toutput.info(`Password reset requested for ${email}. An unknown address is reported as success too, so this is not proof the person exists.`)\n\t\toutput.data<ResetPasswordRequestResult>({\n\t\t\temail,\n\t\t\trequested: true,\n\t\t\tmailProject: mailProject ?? null,\n\t\t\tmailVariant: mailVariant ?? null,\n\t\t}, { human: it => humanText(it.email), quiet: it => it.email })\n\t}\n}\n"],"names":["Command","readStdinText","configureCaptchaTokenOptions","resolveCaptchaToken","humanText"],"mappings":";;;;;;AAsBO,MAAM,gDAAgDA,UAAAA,QAAuB;AAAA,EACnF,YACkB,sBACA,YAAyBC,qBACzB,kBAAwD,CAAA,SAAQ,QAAQ,IAAI,IAAI,GAChG;AACD,UAAA;AAJiB,SAAA,uBAAA;AACA,SAAA,YAAA;AACA,SAAA,kBAAA;AAAA,EAGlB;AAAA,EAEU,UAAU,eAA0D;AAC7E,kBAAc;AAAA,MACb;AAAA,IAAA;AAGD,kBAAc,SAAS,OAAO,EAAE,YAAY,yDAAyD;AACrG,kBAAc,OAAO,cAAc,EAAE,cAAA,EAAgB,YAAY,mDAAmD;AACpH,kBAAc,OAAO,cAAc,EAAE,cAAA,EAAgB,YAAY,0CAA0C;AAC3GC,gBAAAA,6BAA6B,aAAa;AAAA,EAC3C;AAAA,EAEA,MAAgB,QAAQ,OAA6B,QAA+B;AACnF,UAAM,QAAQ,MAAM,YAAY,OAAO;AACvC,UAAM,cAAc,MAAM,UAAU,cAAc;AAClD,UAAM,cAAc,MAAM,UAAU,cAAc;AAClD,UAAM,eAAe,MAAMC,YAAAA;AAAAA,MAC1B;AAAA,QACC,iBAAiB,MAAM,UAAU,eAAe;AAAA,QAChD,qBAAqB,MAAM,UAAU,mBAAmB;AAAA,QACxD,uBAAuB,MAAM,UAAU,qBAAqB;AAAA,MAAA;AAAA,MAE7D,KAAK;AAAA,MACL,KAAK;AAAA,IAAA;AAGN,UAAM,KAAK,qBAAqB,SAAS,2BAA2B,OAAO,EAAE,aAAa,YAAA,GAAe,YAAY;AAErH,WAAO,KAAK,gCAAgC,KAAK,0FAA0F;AAC3I,WAAO,KAAiC;AAAA,MACvC;AAAA,MACA,WAAW;AAAA,MACX,aAAa,eAAe;AAAA,MAC5B,aAAa,eAAe;AAAA,IAAA,GAC1B,EAAE,OAAO,CAAA,OAAMC,aAAAA,UAAU,GAAG,KAAK,GAAG,OAAO,CAAA,OAAM,GAAG,MAAA,CAAO;AAAA,EAC/D;AACD;;"}

package/dist/development/src/commands/tenant/person/TenantPersonResetPasswordRequestCommand.js

@@ -0,0 +1,47 @@
+import { Command } from "@contember/cli-common";
+import { readStdinText } from "../../../lib/tenant/stdin.js";
+import { configureCaptchaTokenOptions, resolveCaptchaToken } from "./personInput.js";
+import { humanText } from "../tenantOutput.js";
+class TenantPersonResetPasswordRequestCommand extends Command {
+  constructor(tenantClientProvider, readStdin = readStdinText, readEnvironment = (name) => process.env[name]) {
+    super();
+    this.tenantClientProvider = tenantClientProvider;
+    this.readStdin = readStdin;
+    this.readEnvironment = readEnvironment;
+  }
+  configure(configuration) {
+    configuration.description(
+      "Send a password-reset e-mail to an address. Consumes the per-IP password-reset rate limit (config rateLimits.passwordResetPerIp, disabled by default) and reports success even for an unknown address, unless the tenant enables login.revealUserExists."
+    );
+    configuration.argument("email").description("E-mail address of the person to send the reset link to.");
+    configuration.option("mail-project").valueRequired().description("Project slug whose mail template variant is used.");
+    configuration.option("mail-variant").valueRequired().description("Mail template variant, usually a locale.");
+    configureCaptchaTokenOptions(configuration);
+  }
+  async execute(input, output) {
+    const email = input.getArgument("email");
+    const mailProject = input.getOption("mail-project");
+    const mailVariant = input.getOption("mail-variant");
+    const captchaToken = await resolveCaptchaToken(
+      {
+        "captcha-token": input.getOption("captcha-token"),
+        "captcha-token-env": input.getOption("captcha-token-env"),
+        "captcha-token-stdin": input.getOption("captcha-token-stdin")
+      },
+      this.readStdin,
+      this.readEnvironment
+    );
+    await this.tenantClientProvider.person().createResetPasswordRequest(email, { mailProject, mailVariant }, captchaToken);
+    output.info(`Password reset requested for ${email}. An unknown address is reported as success too, so this is not proof the person exists.`);
+    output.data({
+      email,
+      requested: true,
+      mailProject: mailProject ?? null,
+      mailVariant: mailVariant ?? null
+    }, { human: (it) => humanText(it.email), quiet: (it) => it.email });
+  }
+}
+export {
+  TenantPersonResetPasswordRequestCommand
+};
+//# sourceMappingURL=TenantPersonResetPasswordRequestCommand.js.map

package/dist/development/src/commands/tenant/person/TenantPersonResetPasswordRequestCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantPersonResetPasswordRequestCommand.js","sources":["../../../../../../../packages/cli/src/commands/tenant/person/TenantPersonResetPasswordRequestCommand.ts"],"sourcesContent":["import { Command, CommandConfiguration, Input, Output } from '@contember/cli-common'\nimport { TenantClientProvider } from '../../../lib/TenantClientProvider.js'\nimport { readStdinText, type StdinReader } from '../../../lib/tenant/stdin.js'\nimport { type CaptchaTokenOptions, configureCaptchaTokenOptions, resolveCaptchaToken } from './personInput.js'\nimport { humanText } from '../tenantOutput.js'\n\ntype Args = {\n\temail: string\n}\n\ntype Options = CaptchaTokenOptions & {\n\t['mail-project']?: string\n\t['mail-variant']?: string\n}\n\ninterface ResetPasswordRequestResult {\n\temail: string\n\trequested: true\n\tmailProject: string | null\n\tmailVariant: string | null\n}\n\nexport class TenantPersonResetPasswordRequestCommand extends Command<Args, Options> {\n\tconstructor(\n\t\tprivate readonly tenantClientProvider: TenantClientProvider,\n\t\tprivate readonly readStdin: StdinReader = readStdinText,\n\t\tprivate readonly readEnvironment: (name: string) => string | undefined = name => process.env[name],\n\t) {\n\t\tsuper()\n\t}\n\n\tprotected configure(configuration: CommandConfiguration<Args, Options>): void {\n\t\tconfiguration.description(\n\t\t\t'Send a password-reset e-mail to an address. Consumes the per-IP password-reset rate limit (config rateLimits.passwordResetPerIp, '\n\t\t\t\t+ 'disabled by default) and reports success even for an unknown address, unless the tenant enables login.revealUserExists.',\n\t\t)\n\t\tconfiguration.argument('email').description('E-mail address of the person to send the reset link to.')\n\t\tconfiguration.option('mail-project').valueRequired().description('Project slug whose mail template variant is used.')\n\t\tconfiguration.option('mail-variant').valueRequired().description('Mail template variant, usually a locale.')\n\t\tconfigureCaptchaTokenOptions(configuration)\n\t}\n\n\tprotected async execute(input: Input<Args, Options>, output: Output): Promise<void> {\n\t\tconst email = input.getArgument('email')\n\t\tconst mailProject = input.getOption('mail-project')\n\t\tconst mailVariant = input.getOption('mail-variant')\n\t\tconst captchaToken = await resolveCaptchaToken(\n\t\t\t{\n\t\t\t\t'captcha-token': input.getOption('captcha-token'),\n\t\t\t\t'captcha-token-env': input.getOption('captcha-token-env'),\n\t\t\t\t'captcha-token-stdin': input.getOption('captcha-token-stdin'),\n\t\t\t},\n\t\t\tthis.readStdin,\n\t\t\tthis.readEnvironment,\n\t\t)\n\n\t\tawait this.tenantClientProvider.person().createResetPasswordRequest(email, { mailProject, mailVariant }, captchaToken)\n\n\t\toutput.info(`Password reset requested for ${email}. An unknown address is reported as success too, so this is not proof the person exists.`)\n\t\toutput.data<ResetPasswordRequestResult>({\n\t\t\temail,\n\t\t\trequested: true,\n\t\t\tmailProject: mailProject ?? null,\n\t\t\tmailVariant: mailVariant ?? null,\n\t\t}, { human: it => humanText(it.email), quiet: it => it.email })\n\t}\n}\n"],"names":[],"mappings":";;;;AAsBO,MAAM,gDAAgD,QAAuB;AAAA,EACnF,YACkB,sBACA,YAAyB,eACzB,kBAAwD,CAAA,SAAQ,QAAQ,IAAI,IAAI,GAChG;AACD,UAAA;AAJiB,SAAA,uBAAA;AACA,SAAA,YAAA;AACA,SAAA,kBAAA;AAAA,EAGlB;AAAA,EAEU,UAAU,eAA0D;AAC7E,kBAAc;AAAA,MACb;AAAA,IAAA;AAGD,kBAAc,SAAS,OAAO,EAAE,YAAY,yDAAyD;AACrG,kBAAc,OAAO,cAAc,EAAE,cAAA,EAAgB,YAAY,mDAAmD;AACpH,kBAAc,OAAO,cAAc,EAAE,cAAA,EAAgB,YAAY,0CAA0C;AAC3G,iCAA6B,aAAa;AAAA,EAC3C;AAAA,EAEA,MAAgB,QAAQ,OAA6B,QAA+B;AACnF,UAAM,QAAQ,MAAM,YAAY,OAAO;AACvC,UAAM,cAAc,MAAM,UAAU,cAAc;AAClD,UAAM,cAAc,MAAM,UAAU,cAAc;AAClD,UAAM,eAAe,MAAM;AAAA,MAC1B;AAAA,QACC,iBAAiB,MAAM,UAAU,eAAe;AAAA,QAChD,qBAAqB,MAAM,UAAU,mBAAmB;AAAA,QACxD,uBAAuB,MAAM,UAAU,qBAAqB;AAAA,MAAA;AAAA,MAE7D,KAAK;AAAA,MACL,KAAK;AAAA,IAAA;AAGN,UAAM,KAAK,qBAAqB,SAAS,2BAA2B,OAAO,EAAE,aAAa,YAAA,GAAe,YAAY;AAErH,WAAO,KAAK,gCAAgC,KAAK,0FAA0F;AAC3I,WAAO,KAAiC;AAAA,MACvC;AAAA,MACA,WAAW;AAAA,MACX,aAAa,eAAe;AAAA,MAC5B,aAAa,eAAe;AAAA,IAAA,GAC1B,EAAE,OAAO,CAAA,OAAM,UAAU,GAAG,KAAK,GAAG,OAAO,CAAA,OAAM,GAAG,MAAA,CAAO;AAAA,EAC/D;AACD;"}

package/dist/development/src/commands/tenant/person/TenantPersonSetPasswordCommand.cjs

@@ -0,0 +1,46 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const cliCommon = require("@contember/cli-common");
+const personInput = require("./personInput.cjs");
+const confirmation = require("../../../lib/tenant/confirmation.cjs");
+const tenantOutput = require("../tenantOutput.cjs");
+const stdin = require("../../../lib/tenant/stdin.cjs");
+class TenantPersonSetPasswordCommand extends cliCommon.Command {
+  constructor(tenantClientProvider, readStdin = stdin.readStdinText) {
+    super();
+    this.tenantClientProvider = tenantClientProvider;
+    this.readStdin = readStdin;
+  }
+  configure(configuration) {
+    configuration.description(
+      "Set the password of a person. The new password is read from stdin or from an environment variable, never from the command line, which would leak it into the shell history and into `ps`. The tenant password policy still applies."
+    );
+    configuration.argument("id").description("Person id.");
+    configuration.option("password-stdin").valueNone().description("Read the new plaintext password from stdin.");
+    configuration.option("password-env").valueRequired().description("Read the new plaintext password from the named environment variable.");
+    configuration.option("yes").valueNone().description("Do not ask for confirmation.");
+  }
+  async execute(input, output) {
+    const personId = input.getArgument("id");
+    const secret = await personInput.resolveSecret(
+      [{ name: "password", stdin: input.getOption("password-stdin") === true, env: input.getOption("password-env") }],
+      this.readStdin
+    );
+    if (secret === void 0) {
+      throw new cliCommon.CliError("No password given. Pass --password-stdin or --password-env <VARIABLE>.", {
+        code: "PASSWORD_REQUIRED",
+        exitCode: cliCommon.ExitCode.InputError
+      });
+    }
+    await confirmation.requireConfirmation({
+      yes: input.getOption("yes") === true,
+      output,
+      warning: `This will replace the password of person ${personId}.`
+    });
+    await this.tenantClientProvider.person().changePassword(personId, secret.value);
+    output.info(`Password of person ${personId} was changed.`);
+    output.data({ personId, passwordChanged: true }, { human: (it) => tenantOutput.humanText(it.personId), quiet: (it) => it.personId });
+  }
+}
+exports.TenantPersonSetPasswordCommand = TenantPersonSetPasswordCommand;
+//# sourceMappingURL=TenantPersonSetPasswordCommand.cjs.map

package/dist/development/src/commands/tenant/person/TenantPersonSetPasswordCommand.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantPersonSetPasswordCommand.cjs","sources":["../../../../../../../packages/cli/src/commands/tenant/person/TenantPersonSetPasswordCommand.ts"],"sourcesContent":["import { CliError, Command, CommandConfiguration, ExitCode, Input, Output } from '@contember/cli-common'\nimport { TenantClientProvider } from '../../../lib/TenantClientProvider.js'\nimport { resolveSecret } from './personInput.js'\nimport { requireConfirmation } from '../../../lib/tenant/confirmation.js'\nimport { humanText } from '../tenantOutput.js'\nimport { readStdinText, StdinReader } from '../../../lib/tenant/stdin.js'\n\ntype Args = {\n\tid: string\n}\n\ntype Options = {\n\t['password-stdin']?: boolean\n\t['password-env']?: string\n\tyes?: boolean\n}\n\ninterface SetPasswordResult {\n\tpersonId: string\n\tpasswordChanged: true\n}\n\nexport class TenantPersonSetPasswordCommand extends Command<Args, Options> {\n\tconstructor(\n\t\tprivate readonly tenantClientProvider: TenantClientProvider,\n\t\tprivate readonly readStdin: StdinReader = readStdinText,\n\t) {\n\t\tsuper()\n\t}\n\n\tprotected configure(configuration: CommandConfiguration<Args, Options>): void {\n\t\tconfiguration.description(\n\t\t\t'Set the password of a person. The new password is read from stdin or from an environment variable, never from the command line, '\n\t\t\t\t+ 'which would leak it into the shell history and into `ps`. The tenant password policy still applies.',\n\t\t)\n\t\tconfiguration.argument('id').description('Person id.')\n\t\tconfiguration.option('password-stdin').valueNone().description('Read the new plaintext password from stdin.')\n\t\tconfiguration.option('password-env').valueRequired().description('Read the new plaintext password from the named environment variable.')\n\t\tconfiguration.option('yes').valueNone().description('Do not ask for confirmation.')\n\t}\n\n\tprotected async execute(input: Input<Args, Options>, output: Output): Promise<void> {\n\t\tconst personId = input.getArgument('id')\n\t\tconst secret = await resolveSecret(\n\t\t\t[{ name: 'password', stdin: input.getOption('password-stdin') === true, env: input.getOption('password-env') }],\n\t\t\tthis.readStdin,\n\t\t)\n\t\tif (secret === undefined) {\n\t\t\tthrow new CliError('No password given. Pass --password-stdin or --password-env <VARIABLE>.', {\n\t\t\t\tcode: 'PASSWORD_REQUIRED',\n\t\t\t\texitCode: ExitCode.InputError,\n\t\t\t})\n\t\t}\n\n\t\tawait requireConfirmation({\n\t\t\tyes: input.getOption('yes') === true,\n\t\t\toutput,\n\t\t\twarning: `This will replace the password of person ${personId}.`,\n\t\t})\n\n\t\tawait this.tenantClientProvider.person().changePassword(personId, secret.value)\n\n\t\toutput.info(`Password of person ${personId} was changed.`)\n\t\toutput.data<SetPasswordResult>({ personId, passwordChanged: true }, { human: it => humanText(it.personId), quiet: it => it.personId })\n\t}\n}\n"],"names":["Command","readStdinText","resolveSecret","CliError","ExitCode","requireConfirmation","humanText"],"mappings":";;;;;;;AAsBO,MAAM,uCAAuCA,UAAAA,QAAuB;AAAA,EAC1E,YACkB,sBACA,YAAyBC,qBACzC;AACD,UAAA;AAHiB,SAAA,uBAAA;AACA,SAAA,YAAA;AAAA,EAGlB;AAAA,EAEU,UAAU,eAA0D;AAC7E,kBAAc;AAAA,MACb;AAAA,IAAA;AAGD,kBAAc,SAAS,IAAI,EAAE,YAAY,YAAY;AACrD,kBAAc,OAAO,gBAAgB,EAAE,UAAA,EAAY,YAAY,6CAA6C;AAC5G,kBAAc,OAAO,cAAc,EAAE,cAAA,EAAgB,YAAY,sEAAsE;AACvI,kBAAc,OAAO,KAAK,EAAE,UAAA,EAAY,YAAY,8BAA8B;AAAA,EACnF;AAAA,EAEA,MAAgB,QAAQ,OAA6B,QAA+B;AACnF,UAAM,WAAW,MAAM,YAAY,IAAI;AACvC,UAAM,SAAS,MAAMC,YAAAA;AAAAA,MACpB,CAAC,EAAE,MAAM,YAAY,OAAO,MAAM,UAAU,gBAAgB,MAAM,MAAM,KAAK,MAAM,UAAU,cAAc,GAAG;AAAA,MAC9G,KAAK;AAAA,IAAA;AAEN,QAAI,WAAW,QAAW;AACzB,YAAM,IAAIC,UAAAA,SAAS,0EAA0E;AAAA,QAC5F,MAAM;AAAA,QACN,UAAUC,UAAAA,SAAS;AAAA,MAAA,CACnB;AAAA,IACF;AAEA,UAAMC,iCAAoB;AAAA,MACzB,KAAK,MAAM,UAAU,KAAK,MAAM;AAAA,MAChC;AAAA,MACA,SAAS,4CAA4C,QAAQ;AAAA,IAAA,CAC7D;AAED,UAAM,KAAK,qBAAqB,OAAA,EAAS,eAAe,UAAU,OAAO,KAAK;AAE9E,WAAO,KAAK,sBAAsB,QAAQ,eAAe;AACzD,WAAO,KAAwB,EAAE,UAAU,iBAAiB,KAAA,GAAQ,EAAE,OAAO,CAAA,OAAMC,aAAAA,UAAU,GAAG,QAAQ,GAAG,OAAO,CAAA,OAAM,GAAG,UAAU;AAAA,EACtI;AACD;;"}

package/dist/development/src/commands/tenant/person/TenantPersonSetPasswordCommand.js

@@ -0,0 +1,46 @@
+import { Command, CliError, ExitCode } from "@contember/cli-common";
+import { resolveSecret } from "./personInput.js";
+import { requireConfirmation } from "../../../lib/tenant/confirmation.js";
+import { humanText } from "../tenantOutput.js";
+import { readStdinText } from "../../../lib/tenant/stdin.js";
+class TenantPersonSetPasswordCommand extends Command {
+  constructor(tenantClientProvider, readStdin = readStdinText) {
+    super();
+    this.tenantClientProvider = tenantClientProvider;
+    this.readStdin = readStdin;
+  }
+  configure(configuration) {
+    configuration.description(
+      "Set the password of a person. The new password is read from stdin or from an environment variable, never from the command line, which would leak it into the shell history and into `ps`. The tenant password policy still applies."
+    );
+    configuration.argument("id").description("Person id.");
+    configuration.option("password-stdin").valueNone().description("Read the new plaintext password from stdin.");
+    configuration.option("password-env").valueRequired().description("Read the new plaintext password from the named environment variable.");
+    configuration.option("yes").valueNone().description("Do not ask for confirmation.");
+  }
+  async execute(input, output) {
+    const personId = input.getArgument("id");
+    const secret = await resolveSecret(
+      [{ name: "password", stdin: input.getOption("password-stdin") === true, env: input.getOption("password-env") }],
+      this.readStdin
+    );
+    if (secret === void 0) {
+      throw new CliError("No password given. Pass --password-stdin or --password-env <VARIABLE>.", {
+        code: "PASSWORD_REQUIRED",
+        exitCode: ExitCode.InputError
+      });
+    }
+    await requireConfirmation({
+      yes: input.getOption("yes") === true,
+      output,
+      warning: `This will replace the password of person ${personId}.`
+    });
+    await this.tenantClientProvider.person().changePassword(personId, secret.value);
+    output.info(`Password of person ${personId} was changed.`);
+    output.data({ personId, passwordChanged: true }, { human: (it) => humanText(it.personId), quiet: (it) => it.personId });
+  }
+}
+export {
+  TenantPersonSetPasswordCommand
+};
+//# sourceMappingURL=TenantPersonSetPasswordCommand.js.map

package/dist/development/src/commands/tenant/person/TenantPersonSetPasswordCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantPersonSetPasswordCommand.js","sources":["../../../../../../../packages/cli/src/commands/tenant/person/TenantPersonSetPasswordCommand.ts"],"sourcesContent":["import { CliError, Command, CommandConfiguration, ExitCode, Input, Output } from '@contember/cli-common'\nimport { TenantClientProvider } from '../../../lib/TenantClientProvider.js'\nimport { resolveSecret } from './personInput.js'\nimport { requireConfirmation } from '../../../lib/tenant/confirmation.js'\nimport { humanText } from '../tenantOutput.js'\nimport { readStdinText, StdinReader } from '../../../lib/tenant/stdin.js'\n\ntype Args = {\n\tid: string\n}\n\ntype Options = {\n\t['password-stdin']?: boolean\n\t['password-env']?: string\n\tyes?: boolean\n}\n\ninterface SetPasswordResult {\n\tpersonId: string\n\tpasswordChanged: true\n}\n\nexport class TenantPersonSetPasswordCommand extends Command<Args, Options> {\n\tconstructor(\n\t\tprivate readonly tenantClientProvider: TenantClientProvider,\n\t\tprivate readonly readStdin: StdinReader = readStdinText,\n\t) {\n\t\tsuper()\n\t}\n\n\tprotected configure(configuration: CommandConfiguration<Args, Options>): void {\n\t\tconfiguration.description(\n\t\t\t'Set the password of a person. The new password is read from stdin or from an environment variable, never from the command line, '\n\t\t\t\t+ 'which would leak it into the shell history and into `ps`. The tenant password policy still applies.',\n\t\t)\n\t\tconfiguration.argument('id').description('Person id.')\n\t\tconfiguration.option('password-stdin').valueNone().description('Read the new plaintext password from stdin.')\n\t\tconfiguration.option('password-env').valueRequired().description('Read the new plaintext password from the named environment variable.')\n\t\tconfiguration.option('yes').valueNone().description('Do not ask for confirmation.')\n\t}\n\n\tprotected async execute(input: Input<Args, Options>, output: Output): Promise<void> {\n\t\tconst personId = input.getArgument('id')\n\t\tconst secret = await resolveSecret(\n\t\t\t[{ name: 'password', stdin: input.getOption('password-stdin') === true, env: input.getOption('password-env') }],\n\t\t\tthis.readStdin,\n\t\t)\n\t\tif (secret === undefined) {\n\t\t\tthrow new CliError('No password given. Pass --password-stdin or --password-env <VARIABLE>.', {\n\t\t\t\tcode: 'PASSWORD_REQUIRED',\n\t\t\t\texitCode: ExitCode.InputError,\n\t\t\t})\n\t\t}\n\n\t\tawait requireConfirmation({\n\t\t\tyes: input.getOption('yes') === true,\n\t\t\toutput,\n\t\t\twarning: `This will replace the password of person ${personId}.`,\n\t\t})\n\n\t\tawait this.tenantClientProvider.person().changePassword(personId, secret.value)\n\n\t\toutput.info(`Password of person ${personId} was changed.`)\n\t\toutput.data<SetPasswordResult>({ personId, passwordChanged: true }, { human: it => humanText(it.personId), quiet: it => it.personId })\n\t}\n}\n"],"names":[],"mappings":";;;;;AAsBO,MAAM,uCAAuC,QAAuB;AAAA,EAC1E,YACkB,sBACA,YAAyB,eACzC;AACD,UAAA;AAHiB,SAAA,uBAAA;AACA,SAAA,YAAA;AAAA,EAGlB;AAAA,EAEU,UAAU,eAA0D;AAC7E,kBAAc;AAAA,MACb;AAAA,IAAA;AAGD,kBAAc,SAAS,IAAI,EAAE,YAAY,YAAY;AACrD,kBAAc,OAAO,gBAAgB,EAAE,UAAA,EAAY,YAAY,6CAA6C;AAC5G,kBAAc,OAAO,cAAc,EAAE,cAAA,EAAgB,YAAY,sEAAsE;AACvI,kBAAc,OAAO,KAAK,EAAE,UAAA,EAAY,YAAY,8BAA8B;AAAA,EACnF;AAAA,EAEA,MAAgB,QAAQ,OAA6B,QAA+B;AACnF,UAAM,WAAW,MAAM,YAAY,IAAI;AACvC,UAAM,SAAS,MAAM;AAAA,MACpB,CAAC,EAAE,MAAM,YAAY,OAAO,MAAM,UAAU,gBAAgB,MAAM,MAAM,KAAK,MAAM,UAAU,cAAc,GAAG;AAAA,MAC9G,KAAK;AAAA,IAAA;AAEN,QAAI,WAAW,QAAW;AACzB,YAAM,IAAI,SAAS,0EAA0E;AAAA,QAC5F,MAAM;AAAA,QACN,UAAU,SAAS;AAAA,MAAA,CACnB;AAAA,IACF;AAEA,UAAM,oBAAoB;AAAA,MACzB,KAAK,MAAM,UAAU,KAAK,MAAM;AAAA,MAChC;AAAA,MACA,SAAS,4CAA4C,QAAQ;AAAA,IAAA,CAC7D;AAED,UAAM,KAAK,qBAAqB,OAAA,EAAS,eAAe,UAAU,OAAO,KAAK;AAE9E,WAAO,KAAK,sBAAsB,QAAQ,eAAe;AACzD,WAAO,KAAwB,EAAE,UAAU,iBAAiB,KAAA,GAAQ,EAAE,OAAO,CAAA,OAAM,UAAU,GAAG,QAAQ,GAAG,OAAO,CAAA,OAAM,GAAG,UAAU;AAAA,EACtI;AACD;"}

package/dist/development/src/commands/tenant/person/TenantPersonShowCommand.cjs

@@ -0,0 +1,55 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const cliCommon = require("@contember/cli-common");
+const tenantOutput = require("../tenantOutput.cjs");
+const formatPersonDetail = (person) => {
+  const lines = [
+    `Person:       ${tenantOutput.humanText(person.id)}`,
+    `Identity:     ${tenantOutput.humanText(person.identityId)}`,
+    `E-mail:       ${person.email === null ? "-" : tenantOutput.humanText(person.email)} (${person.emailVerified ? "verified" : "unverified"})`,
+    `Name:         ${person.name === null ? "-" : tenantOutput.humanText(person.name)}`,
+    `Roles:        ${person.roles === null ? "(not visible)" : person.roles.map(tenantOutput.humanText).join(", ") || "-"}`,
+    `TOTP:         ${person.otpEnabled ? "enabled" : "disabled"}`,
+    `E-mail OTP:   ${person.emailOtpEnabled ? "enabled" : "disabled"}`,
+    `Passwordless: ${person.passwordlessEnabled === null ? "(unset)" : person.passwordlessEnabled ? "enabled" : "disabled"}`,
+    `Sessions:     ${person.sessions.length === 0 ? "none" : ""}`
+  ];
+  for (const session of person.sessions) {
+    lines.push(
+      `  ${tenantOutput.humanText(session.id)}  created ${tenantOutput.humanText(session.createdAt)}  last used ${session.lastUsedAt === null ? "-" : tenantOutput.humanText(session.lastUsedAt)}  from ${session.lastIp === null ? "-" : tenantOutput.humanText(session.lastIp)}  trust forwarded client info ${session.trustForwardedClientInfo ? "yes" : "no"}`
+    );
+  }
+  lines.push(`Identity providers: ${person.identityProviders.length === 0 ? "none" : ""}`);
+  for (const idp of person.identityProviders) {
+    lines.push(
+      `  ${tenantOutput.humanText(idp.slug)} (${tenantOutput.humanText(idp.type)})  external id ${tenantOutput.humanText(idp.externalIdentifier)}  connected ${tenantOutput.humanText(idp.createdAt)}`
+    );
+  }
+  return lines.join("\n");
+};
+class TenantPersonShowCommand extends cliCommon.Command {
+  constructor(tenantClientProvider) {
+    super();
+    this.tenantClientProvider = tenantClientProvider;
+  }
+  configure(configuration) {
+    configuration.description("Show a single person with their roles, active sessions and identity provider connections.");
+    configuration.argument("id").description("Person id.");
+  }
+  async execute(input, output) {
+    const id = input.getArgument("id");
+    const person = await this.tenantClientProvider.person().getPerson(id);
+    if (person === null) {
+      throw new cliCommon.CliError(`Person ${id} was not found, or you are not allowed to view them.`, {
+        code: "PERSON_NOT_FOUND",
+        exitCode: cliCommon.ExitCode.NotFound
+      });
+    }
+    if (person.roles === null) {
+      output.info("Roles are hidden: your token may not read the roles of this identity.");
+    }
+    output.data(person, { human: formatPersonDetail, quiet: (it) => it.id });
+  }
+}
+exports.TenantPersonShowCommand = TenantPersonShowCommand;
+//# sourceMappingURL=TenantPersonShowCommand.cjs.map

package/dist/development/src/commands/tenant/person/TenantPersonShowCommand.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantPersonShowCommand.cjs","sources":["../../../../../../../packages/cli/src/commands/tenant/person/TenantPersonShowCommand.ts"],"sourcesContent":["import { CliError, Command, CommandConfiguration, ExitCode, Input, Output } from '@contember/cli-common'\nimport { TenantClientProvider } from '../../../lib/TenantClientProvider.js'\nimport { TenantPersonDetail } from '../../../lib/tenant/clients/TenantPersonClient.js'\nimport { humanText } from '../tenantOutput.js'\n\ntype Args = {\n\tid: string\n}\n\ntype Options = {}\n\n/** Renders the whole record as an indented block. */\nconst formatPersonDetail = (person: TenantPersonDetail): string => {\n\tconst lines = [\n\t\t`Person:       ${humanText(person.id)}`,\n\t\t`Identity:     ${humanText(person.identityId)}`,\n\t\t`E-mail:       ${person.email === null ? '-' : humanText(person.email)} (${person.emailVerified ? 'verified' : 'unverified'})`,\n\t\t`Name:         ${person.name === null ? '-' : humanText(person.name)}`,\n\t\t`Roles:        ${person.roles === null ? '(not visible)' : person.roles.map(humanText).join(', ') || '-'}`,\n\t\t`TOTP:         ${person.otpEnabled ? 'enabled' : 'disabled'}`,\n\t\t`E-mail OTP:   ${person.emailOtpEnabled ? 'enabled' : 'disabled'}`,\n\t\t`Passwordless: ${person.passwordlessEnabled === null ? '(unset)' : person.passwordlessEnabled ? 'enabled' : 'disabled'}`,\n\t\t`Sessions:     ${person.sessions.length === 0 ? 'none' : ''}`,\n\t]\n\tfor (const session of person.sessions) {\n\t\tlines.push(\n\t\t\t`  ${humanText(session.id)}  created ${humanText(session.createdAt)}  last used ${\n\t\t\t\tsession.lastUsedAt === null ? '-' : humanText(session.lastUsedAt)\n\t\t\t}  from ${session.lastIp === null ? '-' : humanText(session.lastIp)}  trust forwarded client info ${\n\t\t\t\tsession.trustForwardedClientInfo ? 'yes' : 'no'\n\t\t\t}`,\n\t\t)\n\t}\n\tlines.push(`Identity providers: ${person.identityProviders.length === 0 ? 'none' : ''}`)\n\tfor (const idp of person.identityProviders) {\n\t\tlines.push(\n\t\t\t`  ${humanText(idp.slug)} (${humanText(idp.type)})  external id ${humanText(idp.externalIdentifier)}  connected ${humanText(idp.createdAt)}`,\n\t\t)\n\t}\n\treturn lines.join('\\n')\n}\n\nexport class TenantPersonShowCommand extends Command<Args, Options> {\n\tconstructor(\n\t\tprivate readonly tenantClientProvider: TenantClientProvider,\n\t) {\n\t\tsuper()\n\t}\n\n\tprotected configure(configuration: CommandConfiguration<Args, Options>): void {\n\t\tconfiguration.description('Show a single person with their roles, active sessions and identity provider connections.')\n\t\tconfiguration.argument('id').description('Person id.')\n\t}\n\n\tprotected async execute(input: Input<Args, Options>, output: Output): Promise<void> {\n\t\tconst id = input.getArgument('id')\n\t\tconst person = await this.tenantClientProvider.person().getPerson(id)\n\t\tif (person === null) {\n\t\t\t// the API returns null for both cases and does not tell them apart, so neither can we\n\t\t\tthrow new CliError(`Person ${id} was not found, or you are not allowed to view them.`, {\n\t\t\t\tcode: 'PERSON_NOT_FOUND',\n\t\t\t\texitCode: ExitCode.NotFound,\n\t\t\t})\n\t\t}\n\t\tif (person.roles === null) {\n\t\t\toutput.info('Roles are hidden: your token may not read the roles of this identity.')\n\t\t}\n\t\toutput.data(person, { human: formatPersonDetail, quiet: it => it.id })\n\t}\n}\n"],"names":["humanText","Command","CliError","ExitCode"],"mappings":";;;;AAYA,MAAM,qBAAqB,CAAC,WAAuC;AAClE,QAAM,QAAQ;AAAA,IACb,iBAAiBA,aAAAA,UAAU,OAAO,EAAE,CAAC;AAAA,IACrC,iBAAiBA,aAAAA,UAAU,OAAO,UAAU,CAAC;AAAA,IAC7C,iBAAiB,OAAO,UAAU,OAAO,MAAMA,aAAAA,UAAU,OAAO,KAAK,CAAC,KAAK,OAAO,gBAAgB,aAAa,YAAY;AAAA,IAC3H,iBAAiB,OAAO,SAAS,OAAO,MAAMA,uBAAU,OAAO,IAAI,CAAC;AAAA,IACpE,iBAAiB,OAAO,UAAU,OAAO,kBAAkB,OAAO,MAAM,IAAIA,aAAAA,SAAS,EAAE,KAAK,IAAI,KAAK,GAAG;AAAA,IACxG,iBAAiB,OAAO,aAAa,YAAY,UAAU;AAAA,IAC3D,iBAAiB,OAAO,kBAAkB,YAAY,UAAU;AAAA,IAChE,iBAAiB,OAAO,wBAAwB,OAAO,YAAY,OAAO,sBAAsB,YAAY,UAAU;AAAA,IACtH,iBAAiB,OAAO,SAAS,WAAW,IAAI,SAAS,EAAE;AAAA,EAAA;AAE5D,aAAW,WAAW,OAAO,UAAU;AACtC,UAAM;AAAA,MACL,KAAKA,aAAAA,UAAU,QAAQ,EAAE,CAAC,aAAaA,aAAAA,UAAU,QAAQ,SAAS,CAAC,eAClE,QAAQ,eAAe,OAAO,MAAMA,aAAAA,UAAU,QAAQ,UAAU,CACjE,UAAU,QAAQ,WAAW,OAAO,MAAMA,aAAAA,UAAU,QAAQ,MAAM,CAAC,iCAClE,QAAQ,2BAA2B,QAAQ,IAC5C;AAAA,IAAA;AAAA,EAEF;AACA,QAAM,KAAK,uBAAuB,OAAO,kBAAkB,WAAW,IAAI,SAAS,EAAE,EAAE;AACvF,aAAW,OAAO,OAAO,mBAAmB;AAC3C,UAAM;AAAA,MACL,KAAKA,aAAAA,UAAU,IAAI,IAAI,CAAC,KAAKA,aAAAA,UAAU,IAAI,IAAI,CAAC,kBAAkBA,aAAAA,UAAU,IAAI,kBAAkB,CAAC,eAAeA,uBAAU,IAAI,SAAS,CAAC;AAAA,IAAA;AAAA,EAE5I;AACA,SAAO,MAAM,KAAK,IAAI;AACvB;AAEO,MAAM,gCAAgCC,UAAAA,QAAuB;AAAA,EACnE,YACkB,sBAChB;AACD,UAAA;AAFiB,SAAA,uBAAA;AAAA,EAGlB;AAAA,EAEU,UAAU,eAA0D;AAC7E,kBAAc,YAAY,2FAA2F;AACrH,kBAAc,SAAS,IAAI,EAAE,YAAY,YAAY;AAAA,EACtD;AAAA,EAEA,MAAgB,QAAQ,OAA6B,QAA+B;AACnF,UAAM,KAAK,MAAM,YAAY,IAAI;AACjC,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAA,EAAS,UAAU,EAAE;AACpE,QAAI,WAAW,MAAM;AAEpB,YAAM,IAAIC,UAAAA,SAAS,UAAU,EAAE,wDAAwD;AAAA,QACtF,MAAM;AAAA,QACN,UAAUC,UAAAA,SAAS;AAAA,MAAA,CACnB;AAAA,IACF;AACA,QAAI,OAAO,UAAU,MAAM;AAC1B,aAAO,KAAK,uEAAuE;AAAA,IACpF;AACA,WAAO,KAAK,QAAQ,EAAE,OAAO,oBAAoB,OAAO,CAAA,OAAM,GAAG,IAAI;AAAA,EACtE;AACD;;"}

package/dist/development/src/commands/tenant/person/TenantPersonShowCommand.js

@@ -0,0 +1,55 @@
+import { Command, CliError, ExitCode } from "@contember/cli-common";
+import { humanText } from "../tenantOutput.js";
+const formatPersonDetail = (person) => {
+  const lines = [
+    `Person:       ${humanText(person.id)}`,
+    `Identity:     ${humanText(person.identityId)}`,
+    `E-mail:       ${person.email === null ? "-" : humanText(person.email)} (${person.emailVerified ? "verified" : "unverified"})`,
+    `Name:         ${person.name === null ? "-" : humanText(person.name)}`,
+    `Roles:        ${person.roles === null ? "(not visible)" : person.roles.map(humanText).join(", ") || "-"}`,
+    `TOTP:         ${person.otpEnabled ? "enabled" : "disabled"}`,
+    `E-mail OTP:   ${person.emailOtpEnabled ? "enabled" : "disabled"}`,
+    `Passwordless: ${person.passwordlessEnabled === null ? "(unset)" : person.passwordlessEnabled ? "enabled" : "disabled"}`,
+    `Sessions:     ${person.sessions.length === 0 ? "none" : ""}`
+  ];
+  for (const session of person.sessions) {
+    lines.push(
+      `  ${humanText(session.id)}  created ${humanText(session.createdAt)}  last used ${session.lastUsedAt === null ? "-" : humanText(session.lastUsedAt)}  from ${session.lastIp === null ? "-" : humanText(session.lastIp)}  trust forwarded client info ${session.trustForwardedClientInfo ? "yes" : "no"}`
+    );
+  }
+  lines.push(`Identity providers: ${person.identityProviders.length === 0 ? "none" : ""}`);
+  for (const idp of person.identityProviders) {
+    lines.push(
+      `  ${humanText(idp.slug)} (${humanText(idp.type)})  external id ${humanText(idp.externalIdentifier)}  connected ${humanText(idp.createdAt)}`
+    );
+  }
+  return lines.join("\n");
+};
+class TenantPersonShowCommand extends Command {
+  constructor(tenantClientProvider) {
+    super();
+    this.tenantClientProvider = tenantClientProvider;
+  }
+  configure(configuration) {
+    configuration.description("Show a single person with their roles, active sessions and identity provider connections.");
+    configuration.argument("id").description("Person id.");
+  }
+  async execute(input, output) {
+    const id = input.getArgument("id");
+    const person = await this.tenantClientProvider.person().getPerson(id);
+    if (person === null) {
+      throw new CliError(`Person ${id} was not found, or you are not allowed to view them.`, {
+        code: "PERSON_NOT_FOUND",
+        exitCode: ExitCode.NotFound
+      });
+    }
+    if (person.roles === null) {
+      output.info("Roles are hidden: your token may not read the roles of this identity.");
+    }
+    output.data(person, { human: formatPersonDetail, quiet: (it) => it.id });
+  }
+}
+export {
+  TenantPersonShowCommand
+};
+//# sourceMappingURL=TenantPersonShowCommand.js.map

package/dist/development/src/commands/tenant/person/TenantPersonShowCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantPersonShowCommand.js","sources":["../../../../../../../packages/cli/src/commands/tenant/person/TenantPersonShowCommand.ts"],"sourcesContent":["import { CliError, Command, CommandConfiguration, ExitCode, Input, Output } from '@contember/cli-common'\nimport { TenantClientProvider } from '../../../lib/TenantClientProvider.js'\nimport { TenantPersonDetail } from '../../../lib/tenant/clients/TenantPersonClient.js'\nimport { humanText } from '../tenantOutput.js'\n\ntype Args = {\n\tid: string\n}\n\ntype Options = {}\n\n/** Renders the whole record as an indented block. */\nconst formatPersonDetail = (person: TenantPersonDetail): string => {\n\tconst lines = [\n\t\t`Person:       ${humanText(person.id)}`,\n\t\t`Identity:     ${humanText(person.identityId)}`,\n\t\t`E-mail:       ${person.email === null ? '-' : humanText(person.email)} (${person.emailVerified ? 'verified' : 'unverified'})`,\n\t\t`Name:         ${person.name === null ? '-' : humanText(person.name)}`,\n\t\t`Roles:        ${person.roles === null ? '(not visible)' : person.roles.map(humanText).join(', ') || '-'}`,\n\t\t`TOTP:         ${person.otpEnabled ? 'enabled' : 'disabled'}`,\n\t\t`E-mail OTP:   ${person.emailOtpEnabled ? 'enabled' : 'disabled'}`,\n\t\t`Passwordless: ${person.passwordlessEnabled === null ? '(unset)' : person.passwordlessEnabled ? 'enabled' : 'disabled'}`,\n\t\t`Sessions:     ${person.sessions.length === 0 ? 'none' : ''}`,\n\t]\n\tfor (const session of person.sessions) {\n\t\tlines.push(\n\t\t\t`  ${humanText(session.id)}  created ${humanText(session.createdAt)}  last used ${\n\t\t\t\tsession.lastUsedAt === null ? '-' : humanText(session.lastUsedAt)\n\t\t\t}  from ${session.lastIp === null ? '-' : humanText(session.lastIp)}  trust forwarded client info ${\n\t\t\t\tsession.trustForwardedClientInfo ? 'yes' : 'no'\n\t\t\t}`,\n\t\t)\n\t}\n\tlines.push(`Identity providers: ${person.identityProviders.length === 0 ? 'none' : ''}`)\n\tfor (const idp of person.identityProviders) {\n\t\tlines.push(\n\t\t\t`  ${humanText(idp.slug)} (${humanText(idp.type)})  external id ${humanText(idp.externalIdentifier)}  connected ${humanText(idp.createdAt)}`,\n\t\t)\n\t}\n\treturn lines.join('\\n')\n}\n\nexport class TenantPersonShowCommand extends Command<Args, Options> {\n\tconstructor(\n\t\tprivate readonly tenantClientProvider: TenantClientProvider,\n\t) {\n\t\tsuper()\n\t}\n\n\tprotected configure(configuration: CommandConfiguration<Args, Options>): void {\n\t\tconfiguration.description('Show a single person with their roles, active sessions and identity provider connections.')\n\t\tconfiguration.argument('id').description('Person id.')\n\t}\n\n\tprotected async execute(input: Input<Args, Options>, output: Output): Promise<void> {\n\t\tconst id = input.getArgument('id')\n\t\tconst person = await this.tenantClientProvider.person().getPerson(id)\n\t\tif (person === null) {\n\t\t\t// the API returns null for both cases and does not tell them apart, so neither can we\n\t\t\tthrow new CliError(`Person ${id} was not found, or you are not allowed to view them.`, {\n\t\t\t\tcode: 'PERSON_NOT_FOUND',\n\t\t\t\texitCode: ExitCode.NotFound,\n\t\t\t})\n\t\t}\n\t\tif (person.roles === null) {\n\t\t\toutput.info('Roles are hidden: your token may not read the roles of this identity.')\n\t\t}\n\t\toutput.data(person, { human: formatPersonDetail, quiet: it => it.id })\n\t}\n}\n"],"names":[],"mappings":";;AAYA,MAAM,qBAAqB,CAAC,WAAuC;AAClE,QAAM,QAAQ;AAAA,IACb,iBAAiB,UAAU,OAAO,EAAE,CAAC;AAAA,IACrC,iBAAiB,UAAU,OAAO,UAAU,CAAC;AAAA,IAC7C,iBAAiB,OAAO,UAAU,OAAO,MAAM,UAAU,OAAO,KAAK,CAAC,KAAK,OAAO,gBAAgB,aAAa,YAAY;AAAA,IAC3H,iBAAiB,OAAO,SAAS,OAAO,MAAM,UAAU,OAAO,IAAI,CAAC;AAAA,IACpE,iBAAiB,OAAO,UAAU,OAAO,kBAAkB,OAAO,MAAM,IAAI,SAAS,EAAE,KAAK,IAAI,KAAK,GAAG;AAAA,IACxG,iBAAiB,OAAO,aAAa,YAAY,UAAU;AAAA,IAC3D,iBAAiB,OAAO,kBAAkB,YAAY,UAAU;AAAA,IAChE,iBAAiB,OAAO,wBAAwB,OAAO,YAAY,OAAO,sBAAsB,YAAY,UAAU;AAAA,IACtH,iBAAiB,OAAO,SAAS,WAAW,IAAI,SAAS,EAAE;AAAA,EAAA;AAE5D,aAAW,WAAW,OAAO,UAAU;AACtC,UAAM;AAAA,MACL,KAAK,UAAU,QAAQ,EAAE,CAAC,aAAa,UAAU,QAAQ,SAAS,CAAC,eAClE,QAAQ,eAAe,OAAO,MAAM,UAAU,QAAQ,UAAU,CACjE,UAAU,QAAQ,WAAW,OAAO,MAAM,UAAU,QAAQ,MAAM,CAAC,iCAClE,QAAQ,2BAA2B,QAAQ,IAC5C;AAAA,IAAA;AAAA,EAEF;AACA,QAAM,KAAK,uBAAuB,OAAO,kBAAkB,WAAW,IAAI,SAAS,EAAE,EAAE;AACvF,aAAW,OAAO,OAAO,mBAAmB;AAC3C,UAAM;AAAA,MACL,KAAK,UAAU,IAAI,IAAI,CAAC,KAAK,UAAU,IAAI,IAAI,CAAC,kBAAkB,UAAU,IAAI,kBAAkB,CAAC,eAAe,UAAU,IAAI,SAAS,CAAC;AAAA,IAAA;AAAA,EAE5I;AACA,SAAO,MAAM,KAAK,IAAI;AACvB;AAEO,MAAM,gCAAgC,QAAuB;AAAA,EACnE,YACkB,sBAChB;AACD,UAAA;AAFiB,SAAA,uBAAA;AAAA,EAGlB;AAAA,EAEU,UAAU,eAA0D;AAC7E,kBAAc,YAAY,2FAA2F;AACrH,kBAAc,SAAS,IAAI,EAAE,YAAY,YAAY;AAAA,EACtD;AAAA,EAEA,MAAgB,QAAQ,OAA6B,QAA+B;AACnF,UAAM,KAAK,MAAM,YAAY,IAAI;AACjC,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAA,EAAS,UAAU,EAAE;AACpE,QAAI,WAAW,MAAM;AAEpB,YAAM,IAAI,SAAS,UAAU,EAAE,wDAAwD;AAAA,QACtF,MAAM;AAAA,QACN,UAAU,SAAS;AAAA,MAAA,CACnB;AAAA,IACF;AACA,QAAI,OAAO,UAAU,MAAM;AAC1B,aAAO,KAAK,uEAAuE;AAAA,IACpF;AACA,WAAO,KAAK,QAAQ,EAAE,OAAO,oBAAoB,OAAO,CAAA,OAAM,GAAG,IAAI;AAAA,EACtE;AACD;"}

package/dist/development/src/commands/tenant/person/TenantPersonSignOutCommand.cjs

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const cliCommon = require("@contember/cli-common");
+const confirmation = require("../../../lib/tenant/confirmation.cjs");
+const tenantOutput = require("../tenantOutput.cjs");
+class TenantPersonSignOutCommand extends cliCommon.Command {
+  constructor(tenantClientProvider) {
+    super();
+    this.tenantClientProvider = tenantClientProvider;
+  }
+  configure(configuration) {
+    configuration.description(
+      "Force sign-out: revoke every active session and disable all attached API keys, including permanent keys. An account-recovery operation, recorded in the auth log."
+    );
+    configuration.argument("id").description("Person id.");
+    configuration.option("reason").valueRequired().description("Reason stored with the auth log entry, e.g. an incident id.");
+    configuration.option("yes").valueNone().description("Do not ask for confirmation.");
+  }
+  async execute(input, output) {
+    const personId = input.getArgument("id");
+    const reason = input.getOption("reason");
+    await confirmation.requireConfirmation({
+      yes: input.getOption("yes") === true,
+      output,
+      warning: `This will revoke every active session and disable all attached API keys of person ${personId}, including permanent keys.`
+    });
+    await this.tenantClientProvider.person().forceSignOutPerson(personId, reason);
+    output.info(
+      `Every session of person ${personId} was revoked and all attached API keys, including permanent keys, were disabled${reason !== void 0 ? ` (reason: ${reason})` : ""}.`
+    );
+    output.data(
+      { personId, signedOut: true, reason: reason ?? null },
+      { human: (it) => tenantOutput.humanText(it.personId), quiet: (it) => it.personId }
+    );
+  }
+}
+exports.TenantPersonSignOutCommand = TenantPersonSignOutCommand;
+//# sourceMappingURL=TenantPersonSignOutCommand.cjs.map

package/dist/development/src/commands/tenant/person/TenantPersonSignOutCommand.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantPersonSignOutCommand.cjs","sources":["../../../../../../../packages/cli/src/commands/tenant/person/TenantPersonSignOutCommand.ts"],"sourcesContent":["import { Command, CommandConfiguration, Input, Output } from '@contember/cli-common'\nimport { TenantClientProvider } from '../../../lib/TenantClientProvider.js'\nimport { requireConfirmation } from '../../../lib/tenant/confirmation.js'\nimport { humanText } from '../tenantOutput.js'\n\ntype Args = {\n\tid: string\n}\n\ntype Options = {\n\treason?: string\n\tyes?: boolean\n}\n\ninterface SignOutResult {\n\tpersonId: string\n\tsignedOut: true\n\t/** Recorded in the tenant auth log next to the sign-out event. */\n\treason: string | null\n}\n\nexport class TenantPersonSignOutCommand extends Command<Args, Options> {\n\tconstructor(\n\t\tprivate readonly tenantClientProvider: TenantClientProvider,\n\t) {\n\t\tsuper()\n\t}\n\n\tprotected configure(configuration: CommandConfiguration<Args, Options>): void {\n\t\tconfiguration.description(\n\t\t\t'Force sign-out: revoke every active session and disable all attached API keys, including permanent keys. An account-recovery operation, recorded in the auth log.',\n\t\t)\n\t\tconfiguration.argument('id').description('Person id.')\n\t\tconfiguration.option('reason').valueRequired().description('Reason stored with the auth log entry, e.g. an incident id.')\n\t\tconfiguration.option('yes').valueNone().description('Do not ask for confirmation.')\n\t}\n\n\tprotected async execute(input: Input<Args, Options>, output: Output): Promise<void> {\n\t\tconst personId = input.getArgument('id')\n\t\tconst reason = input.getOption('reason')\n\n\t\tawait requireConfirmation({\n\t\t\tyes: input.getOption('yes') === true,\n\t\t\toutput,\n\t\t\twarning: `This will revoke every active session and disable all attached API keys of person ${personId}, including permanent keys.`,\n\t\t})\n\n\t\tawait this.tenantClientProvider.person().forceSignOutPerson(personId, reason)\n\n\t\toutput.info(\n\t\t\t`Every session of person ${personId} was revoked and all attached API keys, including permanent keys, were disabled${\n\t\t\t\treason !== undefined ? ` (reason: ${reason})` : ''\n\t\t\t}.`,\n\t\t)\n\t\toutput.data<SignOutResult>(\n\t\t\t{ personId, signedOut: true, reason: reason ?? null },\n\t\t\t{ human: it => humanText(it.personId), quiet: it => it.personId },\n\t\t)\n\t}\n}\n"],"names":["Command","requireConfirmation","humanText"],"mappings":";;;;;AAqBO,MAAM,mCAAmCA,UAAAA,QAAuB;AAAA,EACtE,YACkB,sBAChB;AACD,UAAA;AAFiB,SAAA,uBAAA;AAAA,EAGlB;AAAA,EAEU,UAAU,eAA0D;AAC7E,kBAAc;AAAA,MACb;AAAA,IAAA;AAED,kBAAc,SAAS,IAAI,EAAE,YAAY,YAAY;AACrD,kBAAc,OAAO,QAAQ,EAAE,cAAA,EAAgB,YAAY,6DAA6D;AACxH,kBAAc,OAAO,KAAK,EAAE,UAAA,EAAY,YAAY,8BAA8B;AAAA,EACnF;AAAA,EAEA,MAAgB,QAAQ,OAA6B,QAA+B;AACnF,UAAM,WAAW,MAAM,YAAY,IAAI;AACvC,UAAM,SAAS,MAAM,UAAU,QAAQ;AAEvC,UAAMC,iCAAoB;AAAA,MACzB,KAAK,MAAM,UAAU,KAAK,MAAM;AAAA,MAChC;AAAA,MACA,SAAS,qFAAqF,QAAQ;AAAA,IAAA,CACtG;AAED,UAAM,KAAK,qBAAqB,OAAA,EAAS,mBAAmB,UAAU,MAAM;AAE5E,WAAO;AAAA,MACN,2BAA2B,QAAQ,kFAClC,WAAW,SAAY,aAAa,MAAM,MAAM,EACjD;AAAA,IAAA;AAED,WAAO;AAAA,MACN,EAAE,UAAU,WAAW,MAAM,QAAQ,UAAU,KAAA;AAAA,MAC/C,EAAE,OAAO,CAAA,OAAMC,aAAAA,UAAU,GAAG,QAAQ,GAAG,OAAO,CAAA,OAAM,GAAG,SAAA;AAAA,IAAS;AAAA,EAElE;AACD;;"}