@contember/cli 2.2.0-alpha.3 → 2.2.0-alpha.4

package/dist/development/src/commands/tenant/policy/TenantPolicyDeleteCommand.js

@@ -0,0 +1,31 @@
+import { Command } from "@contember/cli-common";
+import { requireConfirmation } from "../../../lib/tenant/confirmation.js";
+import { humanText } from "../tenantOutput.js";
+class TenantPolicyDeleteCommand extends Command {
+  constructor(tenantClientProvider) {
+    super();
+    this.tenantClientProvider = tenantClientProvider;
+  }
+  configure(configuration) {
+    configuration.description("Delete an auth policy.");
+    configuration.argument("id").description('Id of the auth policy, as printed by "tenant policy list".');
+    configuration.option("yes").valueNone().description("Do not ask for confirmation.");
+  }
+  async execute(input, output) {
+    const id = input.getArgument("id");
+    await requireConfirmation({
+      yes: input.getOption("yes") === true,
+      output,
+      warning: `Auth policy ${id} will be deleted. The roles it covers fall back to the tenant defaults.`
+    });
+    await this.tenantClientProvider.policy().deleteAuthPolicy(id);
+    output.data({ id }, {
+      human: (result) => `Deleted auth policy ${humanText(result.id)}.`,
+      quiet: (result) => result.id
+    });
+  }
+}
+export {
+  TenantPolicyDeleteCommand
+};
+//# sourceMappingURL=TenantPolicyDeleteCommand.js.map

package/dist/development/src/commands/tenant/policy/TenantPolicyDeleteCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantPolicyDeleteCommand.js","sources":["../../../../../../../packages/cli/src/commands/tenant/policy/TenantPolicyDeleteCommand.ts"],"sourcesContent":["import { Command, CommandConfiguration, Input, Output } from '@contember/cli-common'\nimport { TenantClientProvider } from '../../../lib/TenantClientProvider.js'\nimport { requireConfirmation } from '../../../lib/tenant/confirmation.js'\nimport { humanText } from '../tenantOutput.js'\n\ntype Args = {\n\tid: string\n}\n\ntype Options = {\n\tyes?: boolean\n}\n\nexport class TenantPolicyDeleteCommand extends Command<Args, Options> {\n\tconstructor(\n\t\tprivate readonly tenantClientProvider: TenantClientProvider,\n\t) {\n\t\tsuper()\n\t}\n\n\tprotected configure(configuration: CommandConfiguration<Args, Options>): void {\n\t\tconfiguration.description('Delete an auth policy.')\n\t\tconfiguration.argument('id').description('Id of the auth policy, as printed by \"tenant policy list\".')\n\t\tconfiguration.option('yes').valueNone().description('Do not ask for confirmation.')\n\t}\n\n\tprotected async execute(input: Input<Args, Options>, output: Output): Promise<void> {\n\t\tconst id = input.getArgument('id')\n\t\tawait requireConfirmation({\n\t\t\tyes: input.getOption('yes') === true,\n\t\t\toutput,\n\t\t\twarning: `Auth policy ${id} will be deleted. The roles it covers fall back to the tenant defaults.`,\n\t\t})\n\n\t\tawait this.tenantClientProvider.policy().deleteAuthPolicy(id)\n\n\t\toutput.data({ id }, {\n\t\t\thuman: result => `Deleted auth policy ${humanText(result.id)}.`,\n\t\t\tquiet: result => result.id,\n\t\t})\n\t}\n}\n"],"names":[],"mappings":";;;AAaO,MAAM,kCAAkC,QAAuB;AAAA,EACrE,YACkB,sBAChB;AACD,UAAA;AAFiB,SAAA,uBAAA;AAAA,EAGlB;AAAA,EAEU,UAAU,eAA0D;AAC7E,kBAAc,YAAY,wBAAwB;AAClD,kBAAc,SAAS,IAAI,EAAE,YAAY,4DAA4D;AACrG,kBAAc,OAAO,KAAK,EAAE,UAAA,EAAY,YAAY,8BAA8B;AAAA,EACnF;AAAA,EAEA,MAAgB,QAAQ,OAA6B,QAA+B;AACnF,UAAM,KAAK,MAAM,YAAY,IAAI;AACjC,UAAM,oBAAoB;AAAA,MACzB,KAAK,MAAM,UAAU,KAAK,MAAM;AAAA,MAChC;AAAA,MACA,SAAS,eAAe,EAAE;AAAA,IAAA,CAC1B;AAED,UAAM,KAAK,qBAAqB,OAAA,EAAS,iBAAiB,EAAE;AAE5D,WAAO,KAAK,EAAE,MAAM;AAAA,MACnB,OAAO,CAAA,WAAU,uBAAuB,UAAU,OAAO,EAAE,CAAC;AAAA,MAC5D,OAAO,YAAU,OAAO;AAAA,IAAA,CACxB;AAAA,EACF;AACD;"}

package/dist/development/src/commands/tenant/policy/TenantPolicyListCommand.cjs

@@ -0,0 +1,33 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const cliCommon = require("@contember/cli-common");
+const tenantOutput = require("../tenantOutput.cjs");
+const columns = [
+  { field: "id", name: "ID" },
+  { field: "scope", name: "Scope" },
+  { field: "project", name: "Project" },
+  { field: "roles", name: "Roles", format: (value) => value.map(tenantOutput.humanText).join(", ") },
+  { field: "mfaRequired", name: "MFA required" },
+  { field: "tokenExpiration", name: "Token expiration" },
+  { field: "idleTimeout", name: "Idle timeout" },
+  { field: "mfaGraceDuration", name: "MFA grace" },
+  { field: "rememberMeAllowed", name: "Remember me" }
+];
+class TenantPolicyListCommand extends cliCommon.Command {
+  constructor(tenantClientProvider) {
+    super();
+    this.tenantClientProvider = tenantClientProvider;
+  }
+  configure(configuration) {
+    configuration.description("List the configured auth policies (per-role MFA and session policy).");
+  }
+  async execute(input, output) {
+    const policies = await this.tenantClientProvider.policy().listAuthPolicies();
+    output.table(columns, policies, "id");
+    if (policies.length === 0) {
+      output.info("No auth policies are configured. MFA enforcement is inert.");
+    }
+  }
+}
+exports.TenantPolicyListCommand = TenantPolicyListCommand;
+//# sourceMappingURL=TenantPolicyListCommand.cjs.map

package/dist/development/src/commands/tenant/policy/TenantPolicyListCommand.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantPolicyListCommand.cjs","sources":["../../../../../../../packages/cli/src/commands/tenant/policy/TenantPolicyListCommand.ts"],"sourcesContent":["import { Command, CommandConfiguration, Input, Output, OutputTableColumn } from '@contember/cli-common'\nimport { TenantClientProvider } from '../../../lib/TenantClientProvider.js'\nimport { RemoteAuthPolicy } from '../../../lib/tenant/clients/index.js'\nimport { humanText } from '../tenantOutput.js'\n\ntype Args = {}\ntype Options = {}\n\nconst columns: OutputTableColumn<RemoteAuthPolicy>[] = [\n\t{ field: 'id', name: 'ID' },\n\t{ field: 'scope', name: 'Scope' },\n\t{ field: 'project', name: 'Project' },\n\t{ field: 'roles', name: 'Roles', format: value => value.map(humanText).join(', ') },\n\t{ field: 'mfaRequired', name: 'MFA required' },\n\t{ field: 'tokenExpiration', name: 'Token expiration' },\n\t{ field: 'idleTimeout', name: 'Idle timeout' },\n\t{ field: 'mfaGraceDuration', name: 'MFA grace' },\n\t{ field: 'rememberMeAllowed', name: 'Remember me' },\n]\n\nexport class TenantPolicyListCommand extends Command<Args, Options> {\n\tconstructor(\n\t\tprivate readonly tenantClientProvider: TenantClientProvider,\n\t) {\n\t\tsuper()\n\t}\n\n\tprotected configure(configuration: CommandConfiguration<Args, Options>): void {\n\t\tconfiguration.description('List the configured auth policies (per-role MFA and session policy).')\n\t}\n\n\tprotected async execute(input: Input<Args, Options>, output: Output): Promise<void> {\n\t\tconst policies = await this.tenantClientProvider.policy().listAuthPolicies()\n\t\toutput.table(columns, policies, 'id')\n\t\tif (policies.length === 0) {\n\t\t\toutput.info('No auth policies are configured. MFA enforcement is inert.')\n\t\t}\n\t}\n}\n"],"names":["humanText","Command"],"mappings":";;;;AAQA,MAAM,UAAiD;AAAA,EACtD,EAAE,OAAO,MAAM,MAAM,KAAA;AAAA,EACrB,EAAE,OAAO,SAAS,MAAM,QAAA;AAAA,EACxB,EAAE,OAAO,WAAW,MAAM,UAAA;AAAA,EAC1B,EAAE,OAAO,SAAS,MAAM,SAAS,QAAQ,CAAA,UAAS,MAAM,IAAIA,aAAAA,SAAS,EAAE,KAAK,IAAI,EAAA;AAAA,EAChF,EAAE,OAAO,eAAe,MAAM,eAAA;AAAA,EAC9B,EAAE,OAAO,mBAAmB,MAAM,mBAAA;AAAA,EAClC,EAAE,OAAO,eAAe,MAAM,eAAA;AAAA,EAC9B,EAAE,OAAO,oBAAoB,MAAM,YAAA;AAAA,EACnC,EAAE,OAAO,qBAAqB,MAAM,cAAA;AACrC;AAEO,MAAM,gCAAgCC,UAAAA,QAAuB;AAAA,EACnE,YACkB,sBAChB;AACD,UAAA;AAFiB,SAAA,uBAAA;AAAA,EAGlB;AAAA,EAEU,UAAU,eAA0D;AAC7E,kBAAc,YAAY,sEAAsE;AAAA,EACjG;AAAA,EAEA,MAAgB,QAAQ,OAA6B,QAA+B;AACnF,UAAM,WAAW,MAAM,KAAK,qBAAqB,OAAA,EAAS,iBAAA;AAC1D,WAAO,MAAM,SAAS,UAAU,IAAI;AACpC,QAAI,SAAS,WAAW,GAAG;AAC1B,aAAO,KAAK,4DAA4D;AAAA,IACzE;AAAA,EACD;AACD;;"}

package/dist/development/src/commands/tenant/policy/TenantPolicyListCommand.js

@@ -0,0 +1,33 @@
+import { Command } from "@contember/cli-common";
+import { humanText } from "../tenantOutput.js";
+const columns = [
+  { field: "id", name: "ID" },
+  { field: "scope", name: "Scope" },
+  { field: "project", name: "Project" },
+  { field: "roles", name: "Roles", format: (value) => value.map(humanText).join(", ") },
+  { field: "mfaRequired", name: "MFA required" },
+  { field: "tokenExpiration", name: "Token expiration" },
+  { field: "idleTimeout", name: "Idle timeout" },
+  { field: "mfaGraceDuration", name: "MFA grace" },
+  { field: "rememberMeAllowed", name: "Remember me" }
+];
+class TenantPolicyListCommand extends Command {
+  constructor(tenantClientProvider) {
+    super();
+    this.tenantClientProvider = tenantClientProvider;
+  }
+  configure(configuration) {
+    configuration.description("List the configured auth policies (per-role MFA and session policy).");
+  }
+  async execute(input, output) {
+    const policies = await this.tenantClientProvider.policy().listAuthPolicies();
+    output.table(columns, policies, "id");
+    if (policies.length === 0) {
+      output.info("No auth policies are configured. MFA enforcement is inert.");
+    }
+  }
+}
+export {
+  TenantPolicyListCommand
+};
+//# sourceMappingURL=TenantPolicyListCommand.js.map

package/dist/development/src/commands/tenant/policy/TenantPolicyListCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantPolicyListCommand.js","sources":["../../../../../../../packages/cli/src/commands/tenant/policy/TenantPolicyListCommand.ts"],"sourcesContent":["import { Command, CommandConfiguration, Input, Output, OutputTableColumn } from '@contember/cli-common'\nimport { TenantClientProvider } from '../../../lib/TenantClientProvider.js'\nimport { RemoteAuthPolicy } from '../../../lib/tenant/clients/index.js'\nimport { humanText } from '../tenantOutput.js'\n\ntype Args = {}\ntype Options = {}\n\nconst columns: OutputTableColumn<RemoteAuthPolicy>[] = [\n\t{ field: 'id', name: 'ID' },\n\t{ field: 'scope', name: 'Scope' },\n\t{ field: 'project', name: 'Project' },\n\t{ field: 'roles', name: 'Roles', format: value => value.map(humanText).join(', ') },\n\t{ field: 'mfaRequired', name: 'MFA required' },\n\t{ field: 'tokenExpiration', name: 'Token expiration' },\n\t{ field: 'idleTimeout', name: 'Idle timeout' },\n\t{ field: 'mfaGraceDuration', name: 'MFA grace' },\n\t{ field: 'rememberMeAllowed', name: 'Remember me' },\n]\n\nexport class TenantPolicyListCommand extends Command<Args, Options> {\n\tconstructor(\n\t\tprivate readonly tenantClientProvider: TenantClientProvider,\n\t) {\n\t\tsuper()\n\t}\n\n\tprotected configure(configuration: CommandConfiguration<Args, Options>): void {\n\t\tconfiguration.description('List the configured auth policies (per-role MFA and session policy).')\n\t}\n\n\tprotected async execute(input: Input<Args, Options>, output: Output): Promise<void> {\n\t\tconst policies = await this.tenantClientProvider.policy().listAuthPolicies()\n\t\toutput.table(columns, policies, 'id')\n\t\tif (policies.length === 0) {\n\t\t\toutput.info('No auth policies are configured. MFA enforcement is inert.')\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;AAQA,MAAM,UAAiD;AAAA,EACtD,EAAE,OAAO,MAAM,MAAM,KAAA;AAAA,EACrB,EAAE,OAAO,SAAS,MAAM,QAAA;AAAA,EACxB,EAAE,OAAO,WAAW,MAAM,UAAA;AAAA,EAC1B,EAAE,OAAO,SAAS,MAAM,SAAS,QAAQ,CAAA,UAAS,MAAM,IAAI,SAAS,EAAE,KAAK,IAAI,EAAA;AAAA,EAChF,EAAE,OAAO,eAAe,MAAM,eAAA;AAAA,EAC9B,EAAE,OAAO,mBAAmB,MAAM,mBAAA;AAAA,EAClC,EAAE,OAAO,eAAe,MAAM,eAAA;AAAA,EAC9B,EAAE,OAAO,oBAAoB,MAAM,YAAA;AAAA,EACnC,EAAE,OAAO,qBAAqB,MAAM,cAAA;AACrC;AAEO,MAAM,gCAAgC,QAAuB;AAAA,EACnE,YACkB,sBAChB;AACD,UAAA;AAFiB,SAAA,uBAAA;AAAA,EAGlB;AAAA,EAEU,UAAU,eAA0D;AAC7E,kBAAc,YAAY,sEAAsE;AAAA,EACjG;AAAA,EAEA,MAAgB,QAAQ,OAA6B,QAA+B;AACnF,UAAM,WAAW,MAAM,KAAK,qBAAqB,OAAA,EAAS,iBAAA;AAC1D,WAAO,MAAM,SAAS,UAAU,IAAI;AACpC,QAAI,SAAS,WAAW,GAAG;AAC1B,aAAO,KAAK,4DAA4D;AAAA,IACzE;AAAA,EACD;AACD;"}

package/dist/development/src/commands/tenant/policy/TenantPolicyUpdateCommand.cjs

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const cliCommon = require("@contember/cli-common");
+const policyInput = require("./policyInput.cjs");
+const stdin = require("../../../lib/tenant/stdin.cjs");
+const tenantOutput = require("../tenantOutput.cjs");
+class TenantPolicyUpdateCommand extends cliCommon.Command {
+  constructor(tenantClientProvider, readStdin = stdin.readStdinText) {
+    super();
+    this.tenantClientProvider = tenantClientProvider;
+    this.readStdin = readStdin;
+  }
+  configure(configuration) {
+    configuration.description("Replace an auth policy with the given AuthPolicyInput JSON document.");
+    configuration.argument("id").description('Id of the auth policy, as printed by "tenant policy list".');
+    configuration.option("policy").valueRequired().description(`The policy as JSON, e.g. '${policyInput.AUTH_POLICY_JSON_EXAMPLE}'.`);
+    configuration.option("policy-stdin").valueNone().description("Read the policy JSON from stdin instead of --policy.");
+  }
+  async execute(input, output) {
+    const id = input.getArgument("id");
+    const policy = policyInput.parseAuthPolicyInput(
+      await policyInput.readTextInput({
+        label: "policy",
+        inline: input.getOption("policy"),
+        inlineFlag: "--policy",
+        fromStdin: input.getOption("policy-stdin") === true,
+        stdinFlag: "--policy-stdin"
+      }, this.readStdin)
+    );
+    await this.tenantClientProvider.policy().updateAuthPolicy(id, policy);
+    output.data({ id, scope: policy.scope, project: policy.project ?? null }, {
+      human: (result) => `Updated auth policy ${tenantOutput.humanText(result.id)}.`,
+      quiet: (result) => result.id
+    });
+  }
+}
+exports.TenantPolicyUpdateCommand = TenantPolicyUpdateCommand;
+//# sourceMappingURL=TenantPolicyUpdateCommand.cjs.map

package/dist/development/src/commands/tenant/policy/TenantPolicyUpdateCommand.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantPolicyUpdateCommand.cjs","sources":["../../../../../../../packages/cli/src/commands/tenant/policy/TenantPolicyUpdateCommand.ts"],"sourcesContent":["import { Command, CommandConfiguration, Input, Output } from '@contember/cli-common'\nimport { TenantClientProvider } from '../../../lib/TenantClientProvider.js'\nimport { AUTH_POLICY_JSON_EXAMPLE, parseAuthPolicyInput, readTextInput } from './policyInput.js'\nimport { readStdinText, StdinReader } from '../../../lib/tenant/stdin.js'\nimport { humanText } from '../tenantOutput.js'\n\ntype Args = {\n\tid: string\n}\n\ntype Options = {\n\tpolicy?: string\n\t['policy-stdin']?: boolean\n}\n\nexport class TenantPolicyUpdateCommand extends Command<Args, Options> {\n\tconstructor(\n\t\tprivate readonly tenantClientProvider: TenantClientProvider,\n\t\tprivate readonly readStdin: StdinReader = readStdinText,\n\t) {\n\t\tsuper()\n\t}\n\n\tprotected configure(configuration: CommandConfiguration<Args, Options>): void {\n\t\tconfiguration.description('Replace an auth policy with the given AuthPolicyInput JSON document.')\n\t\tconfiguration.argument('id').description('Id of the auth policy, as printed by \"tenant policy list\".')\n\t\tconfiguration.option('policy').valueRequired().description(`The policy as JSON, e.g. '${AUTH_POLICY_JSON_EXAMPLE}'.`)\n\t\tconfiguration.option('policy-stdin').valueNone().description('Read the policy JSON from stdin instead of --policy.')\n\t}\n\n\tprotected async execute(input: Input<Args, Options>, output: Output): Promise<void> {\n\t\tconst id = input.getArgument('id')\n\t\t// the mutation replaces the whole row, so the JSON must carry every field the policy should keep\n\t\tconst policy = parseAuthPolicyInput(\n\t\t\tawait readTextInput({\n\t\t\t\tlabel: 'policy',\n\t\t\t\tinline: input.getOption('policy'),\n\t\t\t\tinlineFlag: '--policy',\n\t\t\t\tfromStdin: input.getOption('policy-stdin') === true,\n\t\t\t\tstdinFlag: '--policy-stdin',\n\t\t\t}, this.readStdin),\n\t\t)\n\n\t\tawait this.tenantClientProvider.policy().updateAuthPolicy(id, policy)\n\n\t\toutput.data({ id, scope: policy.scope, project: policy.project ?? null }, {\n\t\t\thuman: result => `Updated auth policy ${humanText(result.id)}.`,\n\t\t\tquiet: result => result.id,\n\t\t})\n\t}\n}\n"],"names":["Command","readStdinText","AUTH_POLICY_JSON_EXAMPLE","parseAuthPolicyInput","readTextInput","humanText"],"mappings":";;;;;;AAeO,MAAM,kCAAkCA,UAAAA,QAAuB;AAAA,EACrE,YACkB,sBACA,YAAyBC,qBACzC;AACD,UAAA;AAHiB,SAAA,uBAAA;AACA,SAAA,YAAA;AAAA,EAGlB;AAAA,EAEU,UAAU,eAA0D;AAC7E,kBAAc,YAAY,sEAAsE;AAChG,kBAAc,SAAS,IAAI,EAAE,YAAY,4DAA4D;AACrG,kBAAc,OAAO,QAAQ,EAAE,cAAA,EAAgB,YAAY,6BAA6BC,oCAAwB,IAAI;AACpH,kBAAc,OAAO,cAAc,EAAE,UAAA,EAAY,YAAY,sDAAsD;AAAA,EACpH;AAAA,EAEA,MAAgB,QAAQ,OAA6B,QAA+B;AACnF,UAAM,KAAK,MAAM,YAAY,IAAI;AAEjC,UAAM,SAASC,YAAAA;AAAAA,MACd,MAAMC,0BAAc;AAAA,QACnB,OAAO;AAAA,QACP,QAAQ,MAAM,UAAU,QAAQ;AAAA,QAChC,YAAY;AAAA,QACZ,WAAW,MAAM,UAAU,cAAc,MAAM;AAAA,QAC/C,WAAW;AAAA,MAAA,GACT,KAAK,SAAS;AAAA,IAAA;AAGlB,UAAM,KAAK,qBAAqB,OAAA,EAAS,iBAAiB,IAAI,MAAM;AAEpE,WAAO,KAAK,EAAE,IAAI,OAAO,OAAO,OAAO,SAAS,OAAO,WAAW,KAAA,GAAQ;AAAA,MACzE,OAAO,CAAA,WAAU,uBAAuBC,aAAAA,UAAU,OAAO,EAAE,CAAC;AAAA,MAC5D,OAAO,YAAU,OAAO;AAAA,IAAA,CACxB;AAAA,EACF;AACD;;"}

package/dist/development/src/commands/tenant/policy/TenantPolicyUpdateCommand.js

@@ -0,0 +1,38 @@
+import { Command } from "@contember/cli-common";
+import { AUTH_POLICY_JSON_EXAMPLE, parseAuthPolicyInput, readTextInput } from "./policyInput.js";
+import { readStdinText } from "../../../lib/tenant/stdin.js";
+import { humanText } from "../tenantOutput.js";
+class TenantPolicyUpdateCommand extends Command {
+  constructor(tenantClientProvider, readStdin = readStdinText) {
+    super();
+    this.tenantClientProvider = tenantClientProvider;
+    this.readStdin = readStdin;
+  }
+  configure(configuration) {
+    configuration.description("Replace an auth policy with the given AuthPolicyInput JSON document.");
+    configuration.argument("id").description('Id of the auth policy, as printed by "tenant policy list".');
+    configuration.option("policy").valueRequired().description(`The policy as JSON, e.g. '${AUTH_POLICY_JSON_EXAMPLE}'.`);
+    configuration.option("policy-stdin").valueNone().description("Read the policy JSON from stdin instead of --policy.");
+  }
+  async execute(input, output) {
+    const id = input.getArgument("id");
+    const policy = parseAuthPolicyInput(
+      await readTextInput({
+        label: "policy",
+        inline: input.getOption("policy"),
+        inlineFlag: "--policy",
+        fromStdin: input.getOption("policy-stdin") === true,
+        stdinFlag: "--policy-stdin"
+      }, this.readStdin)
+    );
+    await this.tenantClientProvider.policy().updateAuthPolicy(id, policy);
+    output.data({ id, scope: policy.scope, project: policy.project ?? null }, {
+      human: (result) => `Updated auth policy ${humanText(result.id)}.`,
+      quiet: (result) => result.id
+    });
+  }
+}
+export {
+  TenantPolicyUpdateCommand
+};
+//# sourceMappingURL=TenantPolicyUpdateCommand.js.map

package/dist/development/src/commands/tenant/policy/TenantPolicyUpdateCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantPolicyUpdateCommand.js","sources":["../../../../../../../packages/cli/src/commands/tenant/policy/TenantPolicyUpdateCommand.ts"],"sourcesContent":["import { Command, CommandConfiguration, Input, Output } from '@contember/cli-common'\nimport { TenantClientProvider } from '../../../lib/TenantClientProvider.js'\nimport { AUTH_POLICY_JSON_EXAMPLE, parseAuthPolicyInput, readTextInput } from './policyInput.js'\nimport { readStdinText, StdinReader } from '../../../lib/tenant/stdin.js'\nimport { humanText } from '../tenantOutput.js'\n\ntype Args = {\n\tid: string\n}\n\ntype Options = {\n\tpolicy?: string\n\t['policy-stdin']?: boolean\n}\n\nexport class TenantPolicyUpdateCommand extends Command<Args, Options> {\n\tconstructor(\n\t\tprivate readonly tenantClientProvider: TenantClientProvider,\n\t\tprivate readonly readStdin: StdinReader = readStdinText,\n\t) {\n\t\tsuper()\n\t}\n\n\tprotected configure(configuration: CommandConfiguration<Args, Options>): void {\n\t\tconfiguration.description('Replace an auth policy with the given AuthPolicyInput JSON document.')\n\t\tconfiguration.argument('id').description('Id of the auth policy, as printed by \"tenant policy list\".')\n\t\tconfiguration.option('policy').valueRequired().description(`The policy as JSON, e.g. '${AUTH_POLICY_JSON_EXAMPLE}'.`)\n\t\tconfiguration.option('policy-stdin').valueNone().description('Read the policy JSON from stdin instead of --policy.')\n\t}\n\n\tprotected async execute(input: Input<Args, Options>, output: Output): Promise<void> {\n\t\tconst id = input.getArgument('id')\n\t\t// the mutation replaces the whole row, so the JSON must carry every field the policy should keep\n\t\tconst policy = parseAuthPolicyInput(\n\t\t\tawait readTextInput({\n\t\t\t\tlabel: 'policy',\n\t\t\t\tinline: input.getOption('policy'),\n\t\t\t\tinlineFlag: '--policy',\n\t\t\t\tfromStdin: input.getOption('policy-stdin') === true,\n\t\t\t\tstdinFlag: '--policy-stdin',\n\t\t\t}, this.readStdin),\n\t\t)\n\n\t\tawait this.tenantClientProvider.policy().updateAuthPolicy(id, policy)\n\n\t\toutput.data({ id, scope: policy.scope, project: policy.project ?? null }, {\n\t\t\thuman: result => `Updated auth policy ${humanText(result.id)}.`,\n\t\t\tquiet: result => result.id,\n\t\t})\n\t}\n}\n"],"names":[],"mappings":";;;;AAeO,MAAM,kCAAkC,QAAuB;AAAA,EACrE,YACkB,sBACA,YAAyB,eACzC;AACD,UAAA;AAHiB,SAAA,uBAAA;AACA,SAAA,YAAA;AAAA,EAGlB;AAAA,EAEU,UAAU,eAA0D;AAC7E,kBAAc,YAAY,sEAAsE;AAChG,kBAAc,SAAS,IAAI,EAAE,YAAY,4DAA4D;AACrG,kBAAc,OAAO,QAAQ,EAAE,cAAA,EAAgB,YAAY,6BAA6B,wBAAwB,IAAI;AACpH,kBAAc,OAAO,cAAc,EAAE,UAAA,EAAY,YAAY,sDAAsD;AAAA,EACpH;AAAA,EAEA,MAAgB,QAAQ,OAA6B,QAA+B;AACnF,UAAM,KAAK,MAAM,YAAY,IAAI;AAEjC,UAAM,SAAS;AAAA,MACd,MAAM,cAAc;AAAA,QACnB,OAAO;AAAA,QACP,QAAQ,MAAM,UAAU,QAAQ;AAAA,QAChC,YAAY;AAAA,QACZ,WAAW,MAAM,UAAU,cAAc,MAAM;AAAA,QAC/C,WAAW;AAAA,MAAA,GACT,KAAK,SAAS;AAAA,IAAA;AAGlB,UAAM,KAAK,qBAAqB,OAAA,EAAS,iBAAiB,IAAI,MAAM;AAEpE,WAAO,KAAK,EAAE,IAAI,OAAO,OAAO,OAAO,SAAS,OAAO,WAAW,KAAA,GAAQ;AAAA,MACzE,OAAO,CAAA,WAAU,uBAAuB,UAAU,OAAO,EAAE,CAAC;AAAA,MAC5D,OAAO,YAAU,OAAO;AAAA,IAAA,CACxB;AAAA,EACF;AACD;"}

package/dist/development/src/commands/tenant/policy/policyInput.cjs

@@ -0,0 +1,167 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const cliCommon = require("@contember/cli-common");
+const stdin = require("../../../lib/tenant/stdin.cjs");
+const value = require("../../../lib/tenant/input/value.cjs");
+const tenantOutput = require("../tenantOutput.cjs");
+const readTextInput = async (sources, readStdin = stdin.readStdinText) => {
+  const selected = [];
+  if (sources.inline !== void 0) {
+    selected.push(value.literalInput("value", sources.inlineFlag, sources.inline));
+  }
+  if (sources.fromStdin) {
+    selected.push(value.stdinInput("value", sources.stdinFlag));
+  }
+  const resolved = await value.resolveRequiredTenantInput(selected, {
+    label: sources.label,
+    allowEmpty: sources.allowEmpty,
+    trailingLineEnding: "preserve"
+  }, { readStdin });
+  return resolved.value;
+};
+const AUTH_POLICY_JSON_EXAMPLE = '{"scope":"project","project":"blog","roles":["admin"],"mfaRequired":true,"idleTimeout":"PT30M"}';
+const authPolicyScopes = {
+  global: "global",
+  project: "project"
+};
+const mailTypes = {
+  EXISTING_USER_INVITED: "EXISTING_USER_INVITED",
+  NEW_USER_INVITED: "NEW_USER_INVITED",
+  RESET_PASSWORD_REQUEST: "RESET_PASSWORD_REQUEST",
+  PASSWORDLESS_SIGN_IN: "PASSWORDLESS_SIGN_IN",
+  FORCED_SIGN_OUT: "FORCED_SIGN_OUT",
+  EMAIL_OTP: "EMAIL_OTP",
+  BACKUP_CODES_EXHAUSTED: "BACKUP_CODES_EXHAUSTED",
+  EMAIL_VERIFICATION: "EMAIL_VERIFICATION",
+  EMAIL_CHANGE_VERIFY: "EMAIL_CHANGE_VERIFY",
+  EMAIL_CHANGE_NOTIFY: "EMAIL_CHANGE_NOTIFY",
+  UNUSUAL_LOGIN: "UNUSUAL_LOGIN"
+};
+const mailTypeValues = Object.values(mailTypes);
+const describeMailTemplate = (ref) => [
+  ref.projectSlug === null ? "global" : `project ${tenantOutput.humanText(ref.projectSlug)}`,
+  tenantOutput.humanText(ref.type),
+  ref.variant === null ? null : `variant ${tenantOutput.humanText(ref.variant)}`
+].filter((it) => it !== null).join(", ");
+const formatMailTemplateRef = (ref) => `${ref.projectSlug ?? "global"}:${ref.type}:${ref.variant ?? "default"}`;
+const parseOptionalMailTemplateSelector = (value2, flag) => {
+  if (value2 === "") {
+    throw inputError(`${flag} must not be empty. Omit it to select the default.`, "EMPTY_MAIL_TEMPLATE_SELECTOR");
+  }
+  return value2;
+};
+const parseMailType = (value2) => {
+  const normalized = value2.toUpperCase();
+  const found = mailTypeValues.find((it) => it === normalized);
+  if (found === void 0) {
+    throw inputError(`Unknown mail type "${value2}". Expected one of: ${mailTypeValues.join(", ")}.`, "UNKNOWN_MAIL_TYPE");
+  }
+  return found;
+};
+const authPolicyFields = [
+  "scope",
+  "project",
+  "roles",
+  "mfaRequired",
+  "tokenExpiration",
+  "idleTimeout",
+  "mfaGraceDuration",
+  "rememberMeAllowed"
+];
+const parseAuthPolicyInput = (raw) => {
+  const record = asRecord(parseJson(raw));
+  if (record === null) {
+    throw inputError("The policy must be a JSON object.", "INVALID_POLICY");
+  }
+  const unknownFields = Object.keys(record).filter((it) => !authPolicyFields.includes(it));
+  if (unknownFields.length > 0) {
+    throw inputError(`Unknown policy field(s): ${unknownFields.join(", ")}. Expected: ${authPolicyFields.join(", ")}.`, "INVALID_POLICY");
+  }
+  const scope = readEnum(record.scope, Object.values(authPolicyScopes), "scope");
+  const project = readOptionalString(record.project, "project");
+  if (scope === "project" && project === void 0) {
+    throw inputError('A project-scoped policy needs "project" (the project slug).', "INVALID_POLICY");
+  }
+  if (scope === "global" && project !== void 0) {
+    throw inputError('A global policy must not carry "project".', "INVALID_POLICY");
+  }
+  return {
+    scope,
+    project,
+    roles: readStringArray(record.roles, "roles"),
+    mfaRequired: readOptionalBoolean(record.mfaRequired, "mfaRequired"),
+    tokenExpiration: readOptionalString(record.tokenExpiration, "tokenExpiration"),
+    idleTimeout: readOptionalString(record.idleTimeout, "idleTimeout"),
+    mfaGraceDuration: readOptionalString(record.mfaGraceDuration, "mfaGraceDuration"),
+    rememberMeAllowed: readOptionalBoolean(record.rememberMeAllowed, "rememberMeAllowed")
+  };
+};
+const inputError = (message, code) => new cliCommon.CliError(message, { code, exitCode: cliCommon.ExitCode.InputError });
+const parseJson = (raw) => {
+  try {
+    return JSON.parse(raw);
+  } catch {
+    throw new cliCommon.CliError("Cannot parse the policy as JSON.", {
+      code: "INVALID_JSON",
+      exitCode: cliCommon.ExitCode.InputError
+    });
+  }
+};
+const asRecord = (value2) => {
+  if (typeof value2 !== "object" || value2 === null || Array.isArray(value2)) {
+    return null;
+  }
+  const result = {};
+  for (const [key, item] of Object.entries(value2)) {
+    result[key] = item;
+  }
+  return result;
+};
+const readEnum = (value2, allowed, field) => {
+  const found = allowed.find((it) => it === value2);
+  if (found === void 0) {
+    throw inputError(`"${field}" must be one of: ${allowed.join(", ")}.`, "INVALID_POLICY");
+  }
+  return found;
+};
+const readOptionalString = (value2, field) => {
+  if (value2 === void 0 || value2 === null) {
+    return void 0;
+  }
+  if (typeof value2 !== "string") {
+    throw inputError(`"${field}" must be a string.`, "INVALID_POLICY");
+  }
+  return value2;
+};
+const readOptionalBoolean = (value2, field) => {
+  if (value2 === void 0 || value2 === null) {
+    return void 0;
+  }
+  if (typeof value2 !== "boolean") {
+    throw inputError(`"${field}" must be a boolean.`, "INVALID_POLICY");
+  }
+  return value2;
+};
+const readStringArray = (value2, field) => {
+  if (!Array.isArray(value2)) {
+    throw inputError(`"${field}" must be an array of strings.`, "INVALID_POLICY");
+  }
+  const result = [];
+  for (const item of value2) {
+    if (typeof item !== "string") {
+      throw inputError(`"${field}" must be an array of strings.`, "INVALID_POLICY");
+    }
+    result.push(item);
+  }
+  return result;
+};
+exports.AUTH_POLICY_JSON_EXAMPLE = AUTH_POLICY_JSON_EXAMPLE;
+exports.describeMailTemplate = describeMailTemplate;
+exports.formatMailTemplateRef = formatMailTemplateRef;
+exports.inputError = inputError;
+exports.mailTypeValues = mailTypeValues;
+exports.parseAuthPolicyInput = parseAuthPolicyInput;
+exports.parseMailType = parseMailType;
+exports.parseOptionalMailTemplateSelector = parseOptionalMailTemplateSelector;
+exports.readTextInput = readTextInput;
+//# sourceMappingURL=policyInput.cjs.map

package/dist/development/src/commands/tenant/policy/policyInput.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"policyInput.cjs","sources":["../../../../../../../packages/cli/src/commands/tenant/policy/policyInput.ts"],"sourcesContent":["import { CliError, ExitCode } from '@contember/cli-common'\nimport type { AuthPolicyInput, AuthPolicyScope, MailType } from '@contember/graphql-client-tenant'\nimport { readStdinText, type StdinReader } from '../../../lib/tenant/stdin.js'\nimport { literalInput, resolveRequiredTenantInput, stdinInput, type TenantInputSource } from '../../../lib/tenant/input/index.js'\nimport { humanText } from '../tenantOutput.js'\n\n/**\n * Structured input (an `AuthPolicyInput`, a mail template body) is taken verbatim as text, either inline\n * or from stdin, instead of being reassembled from a flag-per-field mini-syntax. Stdin needs its own\n * boolean flag: a bare `-` sentinel is impossible, `InputParser.tryParseValue` treats any value starting\n * with a dash as the next flag. Same shape as `member/membershipInput.ts`.\n */\nexport interface TextInputSources {\n\t/** What is being read, used in the error messages, e.g. `policy`. */\n\tlabel: string\n\t/** The value passed inline, e.g. `--policy '{\"scope\":\"global\",\"roles\":[]}'`. */\n\tinline: string | undefined\n\tinlineFlag: string\n\tfromStdin: boolean\n\tstdinFlag: string\n\t/** Whether an explicitly selected empty value is meaningful. */\n\tallowEmpty?: boolean\n}\n\n/** Resolves the value from exactly one of: the inline flag or stdin. */\nexport const readTextInput = async (sources: TextInputSources, readStdin: StdinReader = readStdinText): Promise<string> => {\n\tconst selected: TenantInputSource<'value'>[] = []\n\tif (sources.inline !== undefined) {\n\t\tselected.push(literalInput('value', sources.inlineFlag, sources.inline))\n\t}\n\tif (sources.fromStdin) {\n\t\tselected.push(stdinInput('value', sources.stdinFlag))\n\t}\n\tconst resolved = await resolveRequiredTenantInput(selected, {\n\t\tlabel: sources.label,\n\t\tallowEmpty: sources.allowEmpty,\n\t\ttrailingLineEnding: 'preserve',\n\t}, { readStdin })\n\treturn resolved.value\n}\n\nexport const AUTH_POLICY_JSON_EXAMPLE = '{\"scope\":\"project\",\"project\":\"blog\",\"roles\":[\"admin\"],\"mfaRequired\":true,\"idleTimeout\":\"PT30M\"}'\n\nconst authPolicyScopes = {\n\tglobal: 'global',\n\tproject: 'project',\n} satisfies Record<AuthPolicyScope, AuthPolicyScope>\n\n// `satisfies` keeps this exhaustive: a MailType added to the schema breaks the build here instead of\n// silently going unsupported.\nconst mailTypes = {\n\tEXISTING_USER_INVITED: 'EXISTING_USER_INVITED',\n\tNEW_USER_INVITED: 'NEW_USER_INVITED',\n\tRESET_PASSWORD_REQUEST: 'RESET_PASSWORD_REQUEST',\n\tPASSWORDLESS_SIGN_IN: 'PASSWORDLESS_SIGN_IN',\n\tFORCED_SIGN_OUT: 'FORCED_SIGN_OUT',\n\tEMAIL_OTP: 'EMAIL_OTP',\n\tBACKUP_CODES_EXHAUSTED: 'BACKUP_CODES_EXHAUSTED',\n\tEMAIL_VERIFICATION: 'EMAIL_VERIFICATION',\n\tEMAIL_CHANGE_VERIFY: 'EMAIL_CHANGE_VERIFY',\n\tEMAIL_CHANGE_NOTIFY: 'EMAIL_CHANGE_NOTIFY',\n\tUNUSUAL_LOGIN: 'UNUSUAL_LOGIN',\n} satisfies Record<MailType, MailType>\n\nexport const mailTypeValues: MailType[] = Object.values(mailTypes)\n\n/** What identifies a mail template — it has no id, only this triple. Emitted as the result of add/remove. */\nexport interface MailTemplateRef {\n\tprojectSlug: string | null\n\ttype: MailType\n\tvariant: string | null\n}\n\nexport const describeMailTemplate = (ref: MailTemplateRef): string =>\n\t[\n\t\tref.projectSlug === null ? 'global' : `project ${humanText(ref.projectSlug)}`,\n\t\thumanText(ref.type),\n\t\tref.variant === null ? null : `variant ${humanText(ref.variant)}`,\n\t]\n\t\t.filter(it => it !== null)\n\t\t.join(', ')\n\n/** Stable scalar form for quiet output. */\nexport const formatMailTemplateRef = (ref: MailTemplateRef): string => `${ref.projectSlug ?? 'global'}:${ref.type}:${ref.variant ?? 'default'}`\n\n/** Omitted selects the default scope/variant; an explicitly empty selector is almost certainly a shell mistake. */\nexport const parseOptionalMailTemplateSelector = (value: string | undefined, flag: '--project' | '--variant'): string | undefined => {\n\tif (value === '') {\n\t\tthrow inputError(`${flag} must not be empty. Omit it to select the default.`, 'EMPTY_MAIL_TEMPLATE_SELECTOR')\n\t}\n\treturn value\n}\n\n/** Case-insensitive, so `reset_password_request` works as well as the schema's `RESET_PASSWORD_REQUEST`. */\nexport const parseMailType = (value: string): MailType => {\n\tconst normalized = value.toUpperCase()\n\tconst found = mailTypeValues.find(it => it === normalized)\n\tif (found === undefined) {\n\t\tthrow inputError(`Unknown mail type \"${value}\". Expected one of: ${mailTypeValues.join(', ')}.`, 'UNKNOWN_MAIL_TYPE')\n\t}\n\treturn found\n}\n\nconst authPolicyFields = [\n\t'scope',\n\t'project',\n\t'roles',\n\t'mfaRequired',\n\t'tokenExpiration',\n\t'idleTimeout',\n\t'mfaGraceDuration',\n\t'rememberMeAllowed',\n]\n\n/** Parses the `AuthPolicyInput` JSON document. Unknown keys are rejected so a typo is not silently dropped. */\nexport const parseAuthPolicyInput = (raw: string): AuthPolicyInput => {\n\tconst record = asRecord(parseJson(raw))\n\tif (record === null) {\n\t\tthrow inputError('The policy must be a JSON object.', 'INVALID_POLICY')\n\t}\n\tconst unknownFields = Object.keys(record).filter(it => !authPolicyFields.includes(it))\n\tif (unknownFields.length > 0) {\n\t\tthrow inputError(`Unknown policy field(s): ${unknownFields.join(', ')}. Expected: ${authPolicyFields.join(', ')}.`, 'INVALID_POLICY')\n\t}\n\tconst scope = readEnum(record.scope, Object.values(authPolicyScopes), 'scope')\n\tconst project = readOptionalString(record.project, 'project')\n\tif (scope === 'project' && project === undefined) {\n\t\tthrow inputError('A project-scoped policy needs \"project\" (the project slug).', 'INVALID_POLICY')\n\t}\n\tif (scope === 'global' && project !== undefined) {\n\t\tthrow inputError('A global policy must not carry \"project\".', 'INVALID_POLICY')\n\t}\n\treturn {\n\t\tscope,\n\t\tproject,\n\t\troles: readStringArray(record.roles, 'roles'),\n\t\tmfaRequired: readOptionalBoolean(record.mfaRequired, 'mfaRequired'),\n\t\ttokenExpiration: readOptionalString(record.tokenExpiration, 'tokenExpiration'),\n\t\tidleTimeout: readOptionalString(record.idleTimeout, 'idleTimeout'),\n\t\tmfaGraceDuration: readOptionalString(record.mfaGraceDuration, 'mfaGraceDuration'),\n\t\trememberMeAllowed: readOptionalBoolean(record.rememberMeAllowed, 'rememberMeAllowed'),\n\t}\n}\n\nexport const inputError = (message: string, code: string): CliError => new CliError(message, { code, exitCode: ExitCode.InputError })\n\nconst parseJson = (raw: string): unknown => {\n\ttry {\n\t\treturn JSON.parse(raw)\n\t} catch {\n\t\tthrow new CliError('Cannot parse the policy as JSON.', {\n\t\t\tcode: 'INVALID_JSON',\n\t\t\texitCode: ExitCode.InputError,\n\t\t})\n\t}\n}\n\n/** Copies a plain JSON object into an indexable record — no cast, so every value stays `unknown`. */\nconst asRecord = (value: unknown): Record<string, unknown> | null => {\n\tif (typeof value !== 'object' || value === null || Array.isArray(value)) {\n\t\treturn null\n\t}\n\tconst result: Record<string, unknown> = {}\n\tfor (const [key, item] of Object.entries(value)) {\n\t\tresult[key] = item\n\t}\n\treturn result\n}\n\nconst readEnum = <T extends string>(value: unknown, allowed: T[], field: string): T => {\n\tconst found = allowed.find(it => it === value)\n\tif (found === undefined) {\n\t\tthrow inputError(`\"${field}\" must be one of: ${allowed.join(', ')}.`, 'INVALID_POLICY')\n\t}\n\treturn found\n}\n\nconst readOptionalString = (value: unknown, field: string): string | undefined => {\n\tif (value === undefined || value === null) {\n\t\treturn undefined\n\t}\n\tif (typeof value !== 'string') {\n\t\tthrow inputError(`\"${field}\" must be a string.`, 'INVALID_POLICY')\n\t}\n\treturn value\n}\n\nconst readOptionalBoolean = (value: unknown, field: string): boolean | undefined => {\n\tif (value === undefined || value === null) {\n\t\treturn undefined\n\t}\n\tif (typeof value !== 'boolean') {\n\t\tthrow inputError(`\"${field}\" must be a boolean.`, 'INVALID_POLICY')\n\t}\n\treturn value\n}\n\nconst readStringArray = (value: unknown, field: string): string[] => {\n\tif (!Array.isArray(value)) {\n\t\tthrow inputError(`\"${field}\" must be an array of strings.`, 'INVALID_POLICY')\n\t}\n\tconst result: string[] = []\n\tfor (const item of value) {\n\t\tif (typeof item !== 'string') {\n\t\t\tthrow inputError(`\"${field}\" must be an array of strings.`, 'INVALID_POLICY')\n\t\t}\n\t\tresult.push(item)\n\t}\n\treturn result\n}\n"],"names":["readStdinText","literalInput","stdinInput","resolveRequiredTenantInput","humanText","value","CliError","ExitCode"],"mappings":";;;;;;AAyBO,MAAM,gBAAgB,OAAO,SAA2B,YAAyBA,wBAAmC;AAC1H,QAAM,WAAyC,CAAA;AAC/C,MAAI,QAAQ,WAAW,QAAW;AACjC,aAAS,KAAKC,MAAAA,aAAa,SAAS,QAAQ,YAAY,QAAQ,MAAM,CAAC;AAAA,EACxE;AACA,MAAI,QAAQ,WAAW;AACtB,aAAS,KAAKC,MAAAA,WAAW,SAAS,QAAQ,SAAS,CAAC;AAAA,EACrD;AACA,QAAM,WAAW,MAAMC,MAAAA,2BAA2B,UAAU;AAAA,IAC3D,OAAO,QAAQ;AAAA,IACf,YAAY,QAAQ;AAAA,IACpB,oBAAoB;AAAA,EAAA,GAClB,EAAE,UAAA,CAAW;AAChB,SAAO,SAAS;AACjB;AAEO,MAAM,2BAA2B;AAExC,MAAM,mBAAmB;AAAA,EACxB,QAAQ;AAAA,EACR,SAAS;AACV;AAIA,MAAM,YAAY;AAAA,EACjB,uBAAuB;AAAA,EACvB,kBAAkB;AAAA,EAClB,wBAAwB;AAAA,EACxB,sBAAsB;AAAA,EACtB,iBAAiB;AAAA,EACjB,WAAW;AAAA,EACX,wBAAwB;AAAA,EACxB,oBAAoB;AAAA,EACpB,qBAAqB;AAAA,EACrB,qBAAqB;AAAA,EACrB,eAAe;AAChB;AAEO,MAAM,iBAA6B,OAAO,OAAO,SAAS;AAS1D,MAAM,uBAAuB,CAAC,QACpC;AAAA,EACC,IAAI,gBAAgB,OAAO,WAAW,WAAWC,uBAAU,IAAI,WAAW,CAAC;AAAA,EAC3EA,aAAAA,UAAU,IAAI,IAAI;AAAA,EAClB,IAAI,YAAY,OAAO,OAAO,WAAWA,aAAAA,UAAU,IAAI,OAAO,CAAC;AAChE,EACE,OAAO,CAAA,OAAM,OAAO,IAAI,EACxB,KAAK,IAAI;AAGL,MAAM,wBAAwB,CAAC,QAAiC,GAAG,IAAI,eAAe,QAAQ,IAAI,IAAI,IAAI,IAAI,IAAI,WAAW,SAAS;AAGtI,MAAM,oCAAoC,CAACC,QAA2B,SAAwD;AACpI,MAAIA,WAAU,IAAI;AACjB,UAAM,WAAW,GAAG,IAAI,sDAAsD,8BAA8B;AAAA,EAC7G;AACA,SAAOA;AACR;AAGO,MAAM,gBAAgB,CAACA,WAA4B;AACzD,QAAM,aAAaA,OAAM,YAAA;AACzB,QAAM,QAAQ,eAAe,KAAK,CAAA,OAAM,OAAO,UAAU;AACzD,MAAI,UAAU,QAAW;AACxB,UAAM,WAAW,sBAAsBA,MAAK,uBAAuB,eAAe,KAAK,IAAI,CAAC,KAAK,mBAAmB;AAAA,EACrH;AACA,SAAO;AACR;AAEA,MAAM,mBAAmB;AAAA,EACxB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACD;AAGO,MAAM,uBAAuB,CAAC,QAAiC;AACrE,QAAM,SAAS,SAAS,UAAU,GAAG,CAAC;AACtC,MAAI,WAAW,MAAM;AACpB,UAAM,WAAW,qCAAqC,gBAAgB;AAAA,EACvE;AACA,QAAM,gBAAgB,OAAO,KAAK,MAAM,EAAE,OAAO,CAAA,OAAM,CAAC,iBAAiB,SAAS,EAAE,CAAC;AACrF,MAAI,cAAc,SAAS,GAAG;AAC7B,UAAM,WAAW,4BAA4B,cAAc,KAAK,IAAI,CAAC,eAAe,iBAAiB,KAAK,IAAI,CAAC,KAAK,gBAAgB;AAAA,EACrI;AACA,QAAM,QAAQ,SAAS,OAAO,OAAO,OAAO,OAAO,gBAAgB,GAAG,OAAO;AAC7E,QAAM,UAAU,mBAAmB,OAAO,SAAS,SAAS;AAC5D,MAAI,UAAU,aAAa,YAAY,QAAW;AACjD,UAAM,WAAW,+DAA+D,gBAAgB;AAAA,EACjG;AACA,MAAI,UAAU,YAAY,YAAY,QAAW;AAChD,UAAM,WAAW,6CAA6C,gBAAgB;AAAA,EAC/E;AACA,SAAO;AAAA,IACN;AAAA,IACA;AAAA,IACA,OAAO,gBAAgB,OAAO,OAAO,OAAO;AAAA,IAC5C,aAAa,oBAAoB,OAAO,aAAa,aAAa;AAAA,IAClE,iBAAiB,mBAAmB,OAAO,iBAAiB,iBAAiB;AAAA,IAC7E,aAAa,mBAAmB,OAAO,aAAa,aAAa;AAAA,IACjE,kBAAkB,mBAAmB,OAAO,kBAAkB,kBAAkB;AAAA,IAChF,mBAAmB,oBAAoB,OAAO,mBAAmB,mBAAmB;AAAA,EAAA;AAEtF;AAEO,MAAM,aAAa,CAAC,SAAiB,SAA2B,IAAIC,UAAAA,SAAS,SAAS,EAAE,MAAM,UAAUC,UAAAA,SAAS,WAAA,CAAY;AAEpI,MAAM,YAAY,CAAC,QAAyB;AAC3C,MAAI;AACH,WAAO,KAAK,MAAM,GAAG;AAAA,EACtB,QAAQ;AACP,UAAM,IAAID,UAAAA,SAAS,oCAAoC;AAAA,MACtD,MAAM;AAAA,MACN,UAAUC,UAAAA,SAAS;AAAA,IAAA,CACnB;AAAA,EACF;AACD;AAGA,MAAM,WAAW,CAACF,WAAmD;AACpE,MAAI,OAAOA,WAAU,YAAYA,WAAU,QAAQ,MAAM,QAAQA,MAAK,GAAG;AACxE,WAAO;AAAA,EACR;AACA,QAAM,SAAkC,CAAA;AACxC,aAAW,CAAC,KAAK,IAAI,KAAK,OAAO,QAAQA,MAAK,GAAG;AAChD,WAAO,GAAG,IAAI;AAAA,EACf;AACA,SAAO;AACR;AAEA,MAAM,WAAW,CAAmBA,QAAgB,SAAc,UAAqB;AACtF,QAAM,QAAQ,QAAQ,KAAK,CAAA,OAAM,OAAOA,MAAK;AAC7C,MAAI,UAAU,QAAW;AACxB,UAAM,WAAW,IAAI,KAAK,qBAAqB,QAAQ,KAAK,IAAI,CAAC,KAAK,gBAAgB;AAAA,EACvF;AACA,SAAO;AACR;AAEA,MAAM,qBAAqB,CAACA,QAAgB,UAAsC;AACjF,MAAIA,WAAU,UAAaA,WAAU,MAAM;AAC1C,WAAO;AAAA,EACR;AACA,MAAI,OAAOA,WAAU,UAAU;AAC9B,UAAM,WAAW,IAAI,KAAK,uBAAuB,gBAAgB;AAAA,EAClE;AACA,SAAOA;AACR;AAEA,MAAM,sBAAsB,CAACA,QAAgB,UAAuC;AACnF,MAAIA,WAAU,UAAaA,WAAU,MAAM;AAC1C,WAAO;AAAA,EACR;AACA,MAAI,OAAOA,WAAU,WAAW;AAC/B,UAAM,WAAW,IAAI,KAAK,wBAAwB,gBAAgB;AAAA,EACnE;AACA,SAAOA;AACR;AAEA,MAAM,kBAAkB,CAACA,QAAgB,UAA4B;AACpE,MAAI,CAAC,MAAM,QAAQA,MAAK,GAAG;AAC1B,UAAM,WAAW,IAAI,KAAK,kCAAkC,gBAAgB;AAAA,EAC7E;AACA,QAAM,SAAmB,CAAA;AACzB,aAAW,QAAQA,QAAO;AACzB,QAAI,OAAO,SAAS,UAAU;AAC7B,YAAM,WAAW,IAAI,KAAK,kCAAkC,gBAAgB;AAAA,IAC7E;AACA,WAAO,KAAK,IAAI;AAAA,EACjB;AACA,SAAO;AACR;;;;;;;;;;"}

package/dist/development/src/commands/tenant/policy/policyInput.js

@@ -0,0 +1,167 @@
+import { CliError, ExitCode } from "@contember/cli-common";
+import { readStdinText } from "../../../lib/tenant/stdin.js";
+import { literalInput, stdinInput, resolveRequiredTenantInput } from "../../../lib/tenant/input/value.js";
+import { humanText } from "../tenantOutput.js";
+const readTextInput = async (sources, readStdin = readStdinText) => {
+  const selected = [];
+  if (sources.inline !== void 0) {
+    selected.push(literalInput("value", sources.inlineFlag, sources.inline));
+  }
+  if (sources.fromStdin) {
+    selected.push(stdinInput("value", sources.stdinFlag));
+  }
+  const resolved = await resolveRequiredTenantInput(selected, {
+    label: sources.label,
+    allowEmpty: sources.allowEmpty,
+    trailingLineEnding: "preserve"
+  }, { readStdin });
+  return resolved.value;
+};
+const AUTH_POLICY_JSON_EXAMPLE = '{"scope":"project","project":"blog","roles":["admin"],"mfaRequired":true,"idleTimeout":"PT30M"}';
+const authPolicyScopes = {
+  global: "global",
+  project: "project"
+};
+const mailTypes = {
+  EXISTING_USER_INVITED: "EXISTING_USER_INVITED",
+  NEW_USER_INVITED: "NEW_USER_INVITED",
+  RESET_PASSWORD_REQUEST: "RESET_PASSWORD_REQUEST",
+  PASSWORDLESS_SIGN_IN: "PASSWORDLESS_SIGN_IN",
+  FORCED_SIGN_OUT: "FORCED_SIGN_OUT",
+  EMAIL_OTP: "EMAIL_OTP",
+  BACKUP_CODES_EXHAUSTED: "BACKUP_CODES_EXHAUSTED",
+  EMAIL_VERIFICATION: "EMAIL_VERIFICATION",
+  EMAIL_CHANGE_VERIFY: "EMAIL_CHANGE_VERIFY",
+  EMAIL_CHANGE_NOTIFY: "EMAIL_CHANGE_NOTIFY",
+  UNUSUAL_LOGIN: "UNUSUAL_LOGIN"
+};
+const mailTypeValues = Object.values(mailTypes);
+const describeMailTemplate = (ref) => [
+  ref.projectSlug === null ? "global" : `project ${humanText(ref.projectSlug)}`,
+  humanText(ref.type),
+  ref.variant === null ? null : `variant ${humanText(ref.variant)}`
+].filter((it) => it !== null).join(", ");
+const formatMailTemplateRef = (ref) => `${ref.projectSlug ?? "global"}:${ref.type}:${ref.variant ?? "default"}`;
+const parseOptionalMailTemplateSelector = (value, flag) => {
+  if (value === "") {
+    throw inputError(`${flag} must not be empty. Omit it to select the default.`, "EMPTY_MAIL_TEMPLATE_SELECTOR");
+  }
+  return value;
+};
+const parseMailType = (value) => {
+  const normalized = value.toUpperCase();
+  const found = mailTypeValues.find((it) => it === normalized);
+  if (found === void 0) {
+    throw inputError(`Unknown mail type "${value}". Expected one of: ${mailTypeValues.join(", ")}.`, "UNKNOWN_MAIL_TYPE");
+  }
+  return found;
+};
+const authPolicyFields = [
+  "scope",
+  "project",
+  "roles",
+  "mfaRequired",
+  "tokenExpiration",
+  "idleTimeout",
+  "mfaGraceDuration",
+  "rememberMeAllowed"
+];
+const parseAuthPolicyInput = (raw) => {
+  const record = asRecord(parseJson(raw));
+  if (record === null) {
+    throw inputError("The policy must be a JSON object.", "INVALID_POLICY");
+  }
+  const unknownFields = Object.keys(record).filter((it) => !authPolicyFields.includes(it));
+  if (unknownFields.length > 0) {
+    throw inputError(`Unknown policy field(s): ${unknownFields.join(", ")}. Expected: ${authPolicyFields.join(", ")}.`, "INVALID_POLICY");
+  }
+  const scope = readEnum(record.scope, Object.values(authPolicyScopes), "scope");
+  const project = readOptionalString(record.project, "project");
+  if (scope === "project" && project === void 0) {
+    throw inputError('A project-scoped policy needs "project" (the project slug).', "INVALID_POLICY");
+  }
+  if (scope === "global" && project !== void 0) {
+    throw inputError('A global policy must not carry "project".', "INVALID_POLICY");
+  }
+  return {
+    scope,
+    project,
+    roles: readStringArray(record.roles, "roles"),
+    mfaRequired: readOptionalBoolean(record.mfaRequired, "mfaRequired"),
+    tokenExpiration: readOptionalString(record.tokenExpiration, "tokenExpiration"),
+    idleTimeout: readOptionalString(record.idleTimeout, "idleTimeout"),
+    mfaGraceDuration: readOptionalString(record.mfaGraceDuration, "mfaGraceDuration"),
+    rememberMeAllowed: readOptionalBoolean(record.rememberMeAllowed, "rememberMeAllowed")
+  };
+};
+const inputError = (message, code) => new CliError(message, { code, exitCode: ExitCode.InputError });
+const parseJson = (raw) => {
+  try {
+    return JSON.parse(raw);
+  } catch {
+    throw new CliError("Cannot parse the policy as JSON.", {
+      code: "INVALID_JSON",
+      exitCode: ExitCode.InputError
+    });
+  }
+};
+const asRecord = (value) => {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    return null;
+  }
+  const result = {};
+  for (const [key, item] of Object.entries(value)) {
+    result[key] = item;
+  }
+  return result;
+};
+const readEnum = (value, allowed, field) => {
+  const found = allowed.find((it) => it === value);
+  if (found === void 0) {
+    throw inputError(`"${field}" must be one of: ${allowed.join(", ")}.`, "INVALID_POLICY");
+  }
+  return found;
+};
+const readOptionalString = (value, field) => {
+  if (value === void 0 || value === null) {
+    return void 0;
+  }
+  if (typeof value !== "string") {
+    throw inputError(`"${field}" must be a string.`, "INVALID_POLICY");
+  }
+  return value;
+};
+const readOptionalBoolean = (value, field) => {
+  if (value === void 0 || value === null) {
+    return void 0;
+  }
+  if (typeof value !== "boolean") {
+    throw inputError(`"${field}" must be a boolean.`, "INVALID_POLICY");
+  }
+  return value;
+};
+const readStringArray = (value, field) => {
+  if (!Array.isArray(value)) {
+    throw inputError(`"${field}" must be an array of strings.`, "INVALID_POLICY");
+  }
+  const result = [];
+  for (const item of value) {
+    if (typeof item !== "string") {
+      throw inputError(`"${field}" must be an array of strings.`, "INVALID_POLICY");
+    }
+    result.push(item);
+  }
+  return result;
+};
+export {
+  AUTH_POLICY_JSON_EXAMPLE,
+  describeMailTemplate,
+  formatMailTemplateRef,
+  inputError,
+  mailTypeValues,
+  parseAuthPolicyInput,
+  parseMailType,
+  parseOptionalMailTemplateSelector,
+  readTextInput
+};
+//# sourceMappingURL=policyInput.js.map

package/dist/development/src/commands/tenant/policy/policyInput.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policyInput.js","sources":["../../../../../../../packages/cli/src/commands/tenant/policy/policyInput.ts"],"sourcesContent":["import { CliError, ExitCode } from '@contember/cli-common'\nimport type { AuthPolicyInput, AuthPolicyScope, MailType } from '@contember/graphql-client-tenant'\nimport { readStdinText, type StdinReader } from '../../../lib/tenant/stdin.js'\nimport { literalInput, resolveRequiredTenantInput, stdinInput, type TenantInputSource } from '../../../lib/tenant/input/index.js'\nimport { humanText } from '../tenantOutput.js'\n\n/**\n * Structured input (an `AuthPolicyInput`, a mail template body) is taken verbatim as text, either inline\n * or from stdin, instead of being reassembled from a flag-per-field mini-syntax. Stdin needs its own\n * boolean flag: a bare `-` sentinel is impossible, `InputParser.tryParseValue` treats any value starting\n * with a dash as the next flag. Same shape as `member/membershipInput.ts`.\n */\nexport interface TextInputSources {\n\t/** What is being read, used in the error messages, e.g. `policy`. */\n\tlabel: string\n\t/** The value passed inline, e.g. `--policy '{\"scope\":\"global\",\"roles\":[]}'`. */\n\tinline: string | undefined\n\tinlineFlag: string\n\tfromStdin: boolean\n\tstdinFlag: string\n\t/** Whether an explicitly selected empty value is meaningful. */\n\tallowEmpty?: boolean\n}\n\n/** Resolves the value from exactly one of: the inline flag or stdin. */\nexport const readTextInput = async (sources: TextInputSources, readStdin: StdinReader = readStdinText): Promise<string> => {\n\tconst selected: TenantInputSource<'value'>[] = []\n\tif (sources.inline !== undefined) {\n\t\tselected.push(literalInput('value', sources.inlineFlag, sources.inline))\n\t}\n\tif (sources.fromStdin) {\n\t\tselected.push(stdinInput('value', sources.stdinFlag))\n\t}\n\tconst resolved = await resolveRequiredTenantInput(selected, {\n\t\tlabel: sources.label,\n\t\tallowEmpty: sources.allowEmpty,\n\t\ttrailingLineEnding: 'preserve',\n\t}, { readStdin })\n\treturn resolved.value\n}\n\nexport const AUTH_POLICY_JSON_EXAMPLE = '{\"scope\":\"project\",\"project\":\"blog\",\"roles\":[\"admin\"],\"mfaRequired\":true,\"idleTimeout\":\"PT30M\"}'\n\nconst authPolicyScopes = {\n\tglobal: 'global',\n\tproject: 'project',\n} satisfies Record<AuthPolicyScope, AuthPolicyScope>\n\n// `satisfies` keeps this exhaustive: a MailType added to the schema breaks the build here instead of\n// silently going unsupported.\nconst mailTypes = {\n\tEXISTING_USER_INVITED: 'EXISTING_USER_INVITED',\n\tNEW_USER_INVITED: 'NEW_USER_INVITED',\n\tRESET_PASSWORD_REQUEST: 'RESET_PASSWORD_REQUEST',\n\tPASSWORDLESS_SIGN_IN: 'PASSWORDLESS_SIGN_IN',\n\tFORCED_SIGN_OUT: 'FORCED_SIGN_OUT',\n\tEMAIL_OTP: 'EMAIL_OTP',\n\tBACKUP_CODES_EXHAUSTED: 'BACKUP_CODES_EXHAUSTED',\n\tEMAIL_VERIFICATION: 'EMAIL_VERIFICATION',\n\tEMAIL_CHANGE_VERIFY: 'EMAIL_CHANGE_VERIFY',\n\tEMAIL_CHANGE_NOTIFY: 'EMAIL_CHANGE_NOTIFY',\n\tUNUSUAL_LOGIN: 'UNUSUAL_LOGIN',\n} satisfies Record<MailType, MailType>\n\nexport const mailTypeValues: MailType[] = Object.values(mailTypes)\n\n/** What identifies a mail template — it has no id, only this triple. Emitted as the result of add/remove. */\nexport interface MailTemplateRef {\n\tprojectSlug: string | null\n\ttype: MailType\n\tvariant: string | null\n}\n\nexport const describeMailTemplate = (ref: MailTemplateRef): string =>\n\t[\n\t\tref.projectSlug === null ? 'global' : `project ${humanText(ref.projectSlug)}`,\n\t\thumanText(ref.type),\n\t\tref.variant === null ? null : `variant ${humanText(ref.variant)}`,\n\t]\n\t\t.filter(it => it !== null)\n\t\t.join(', ')\n\n/** Stable scalar form for quiet output. */\nexport const formatMailTemplateRef = (ref: MailTemplateRef): string => `${ref.projectSlug ?? 'global'}:${ref.type}:${ref.variant ?? 'default'}`\n\n/** Omitted selects the default scope/variant; an explicitly empty selector is almost certainly a shell mistake. */\nexport const parseOptionalMailTemplateSelector = (value: string | undefined, flag: '--project' | '--variant'): string | undefined => {\n\tif (value === '') {\n\t\tthrow inputError(`${flag} must not be empty. Omit it to select the default.`, 'EMPTY_MAIL_TEMPLATE_SELECTOR')\n\t}\n\treturn value\n}\n\n/** Case-insensitive, so `reset_password_request` works as well as the schema's `RESET_PASSWORD_REQUEST`. */\nexport const parseMailType = (value: string): MailType => {\n\tconst normalized = value.toUpperCase()\n\tconst found = mailTypeValues.find(it => it === normalized)\n\tif (found === undefined) {\n\t\tthrow inputError(`Unknown mail type \"${value}\". Expected one of: ${mailTypeValues.join(', ')}.`, 'UNKNOWN_MAIL_TYPE')\n\t}\n\treturn found\n}\n\nconst authPolicyFields = [\n\t'scope',\n\t'project',\n\t'roles',\n\t'mfaRequired',\n\t'tokenExpiration',\n\t'idleTimeout',\n\t'mfaGraceDuration',\n\t'rememberMeAllowed',\n]\n\n/** Parses the `AuthPolicyInput` JSON document. Unknown keys are rejected so a typo is not silently dropped. */\nexport const parseAuthPolicyInput = (raw: string): AuthPolicyInput => {\n\tconst record = asRecord(parseJson(raw))\n\tif (record === null) {\n\t\tthrow inputError('The policy must be a JSON object.', 'INVALID_POLICY')\n\t}\n\tconst unknownFields = Object.keys(record).filter(it => !authPolicyFields.includes(it))\n\tif (unknownFields.length > 0) {\n\t\tthrow inputError(`Unknown policy field(s): ${unknownFields.join(', ')}. Expected: ${authPolicyFields.join(', ')}.`, 'INVALID_POLICY')\n\t}\n\tconst scope = readEnum(record.scope, Object.values(authPolicyScopes), 'scope')\n\tconst project = readOptionalString(record.project, 'project')\n\tif (scope === 'project' && project === undefined) {\n\t\tthrow inputError('A project-scoped policy needs \"project\" (the project slug).', 'INVALID_POLICY')\n\t}\n\tif (scope === 'global' && project !== undefined) {\n\t\tthrow inputError('A global policy must not carry \"project\".', 'INVALID_POLICY')\n\t}\n\treturn {\n\t\tscope,\n\t\tproject,\n\t\troles: readStringArray(record.roles, 'roles'),\n\t\tmfaRequired: readOptionalBoolean(record.mfaRequired, 'mfaRequired'),\n\t\ttokenExpiration: readOptionalString(record.tokenExpiration, 'tokenExpiration'),\n\t\tidleTimeout: readOptionalString(record.idleTimeout, 'idleTimeout'),\n\t\tmfaGraceDuration: readOptionalString(record.mfaGraceDuration, 'mfaGraceDuration'),\n\t\trememberMeAllowed: readOptionalBoolean(record.rememberMeAllowed, 'rememberMeAllowed'),\n\t}\n}\n\nexport const inputError = (message: string, code: string): CliError => new CliError(message, { code, exitCode: ExitCode.InputError })\n\nconst parseJson = (raw: string): unknown => {\n\ttry {\n\t\treturn JSON.parse(raw)\n\t} catch {\n\t\tthrow new CliError('Cannot parse the policy as JSON.', {\n\t\t\tcode: 'INVALID_JSON',\n\t\t\texitCode: ExitCode.InputError,\n\t\t})\n\t}\n}\n\n/** Copies a plain JSON object into an indexable record — no cast, so every value stays `unknown`. */\nconst asRecord = (value: unknown): Record<string, unknown> | null => {\n\tif (typeof value !== 'object' || value === null || Array.isArray(value)) {\n\t\treturn null\n\t}\n\tconst result: Record<string, unknown> = {}\n\tfor (const [key, item] of Object.entries(value)) {\n\t\tresult[key] = item\n\t}\n\treturn result\n}\n\nconst readEnum = <T extends string>(value: unknown, allowed: T[], field: string): T => {\n\tconst found = allowed.find(it => it === value)\n\tif (found === undefined) {\n\t\tthrow inputError(`\"${field}\" must be one of: ${allowed.join(', ')}.`, 'INVALID_POLICY')\n\t}\n\treturn found\n}\n\nconst readOptionalString = (value: unknown, field: string): string | undefined => {\n\tif (value === undefined || value === null) {\n\t\treturn undefined\n\t}\n\tif (typeof value !== 'string') {\n\t\tthrow inputError(`\"${field}\" must be a string.`, 'INVALID_POLICY')\n\t}\n\treturn value\n}\n\nconst readOptionalBoolean = (value: unknown, field: string): boolean | undefined => {\n\tif (value === undefined || value === null) {\n\t\treturn undefined\n\t}\n\tif (typeof value !== 'boolean') {\n\t\tthrow inputError(`\"${field}\" must be a boolean.`, 'INVALID_POLICY')\n\t}\n\treturn value\n}\n\nconst readStringArray = (value: unknown, field: string): string[] => {\n\tif (!Array.isArray(value)) {\n\t\tthrow inputError(`\"${field}\" must be an array of strings.`, 'INVALID_POLICY')\n\t}\n\tconst result: string[] = []\n\tfor (const item of value) {\n\t\tif (typeof item !== 'string') {\n\t\t\tthrow inputError(`\"${field}\" must be an array of strings.`, 'INVALID_POLICY')\n\t\t}\n\t\tresult.push(item)\n\t}\n\treturn result\n}\n"],"names":[],"mappings":";;;;AAyBO,MAAM,gBAAgB,OAAO,SAA2B,YAAyB,kBAAmC;AAC1H,QAAM,WAAyC,CAAA;AAC/C,MAAI,QAAQ,WAAW,QAAW;AACjC,aAAS,KAAK,aAAa,SAAS,QAAQ,YAAY,QAAQ,MAAM,CAAC;AAAA,EACxE;AACA,MAAI,QAAQ,WAAW;AACtB,aAAS,KAAK,WAAW,SAAS,QAAQ,SAAS,CAAC;AAAA,EACrD;AACA,QAAM,WAAW,MAAM,2BAA2B,UAAU;AAAA,IAC3D,OAAO,QAAQ;AAAA,IACf,YAAY,QAAQ;AAAA,IACpB,oBAAoB;AAAA,EAAA,GAClB,EAAE,UAAA,CAAW;AAChB,SAAO,SAAS;AACjB;AAEO,MAAM,2BAA2B;AAExC,MAAM,mBAAmB;AAAA,EACxB,QAAQ;AAAA,EACR,SAAS;AACV;AAIA,MAAM,YAAY;AAAA,EACjB,uBAAuB;AAAA,EACvB,kBAAkB;AAAA,EAClB,wBAAwB;AAAA,EACxB,sBAAsB;AAAA,EACtB,iBAAiB;AAAA,EACjB,WAAW;AAAA,EACX,wBAAwB;AAAA,EACxB,oBAAoB;AAAA,EACpB,qBAAqB;AAAA,EACrB,qBAAqB;AAAA,EACrB,eAAe;AAChB;AAEO,MAAM,iBAA6B,OAAO,OAAO,SAAS;AAS1D,MAAM,uBAAuB,CAAC,QACpC;AAAA,EACC,IAAI,gBAAgB,OAAO,WAAW,WAAW,UAAU,IAAI,WAAW,CAAC;AAAA,EAC3E,UAAU,IAAI,IAAI;AAAA,EAClB,IAAI,YAAY,OAAO,OAAO,WAAW,UAAU,IAAI,OAAO,CAAC;AAChE,EACE,OAAO,CAAA,OAAM,OAAO,IAAI,EACxB,KAAK,IAAI;AAGL,MAAM,wBAAwB,CAAC,QAAiC,GAAG,IAAI,eAAe,QAAQ,IAAI,IAAI,IAAI,IAAI,IAAI,WAAW,SAAS;AAGtI,MAAM,oCAAoC,CAAC,OAA2B,SAAwD;AACpI,MAAI,UAAU,IAAI;AACjB,UAAM,WAAW,GAAG,IAAI,sDAAsD,8BAA8B;AAAA,EAC7G;AACA,SAAO;AACR;AAGO,MAAM,gBAAgB,CAAC,UAA4B;AACzD,QAAM,aAAa,MAAM,YAAA;AACzB,QAAM,QAAQ,eAAe,KAAK,CAAA,OAAM,OAAO,UAAU;AACzD,MAAI,UAAU,QAAW;AACxB,UAAM,WAAW,sBAAsB,KAAK,uBAAuB,eAAe,KAAK,IAAI,CAAC,KAAK,mBAAmB;AAAA,EACrH;AACA,SAAO;AACR;AAEA,MAAM,mBAAmB;AAAA,EACxB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACD;AAGO,MAAM,uBAAuB,CAAC,QAAiC;AACrE,QAAM,SAAS,SAAS,UAAU,GAAG,CAAC;AACtC,MAAI,WAAW,MAAM;AACpB,UAAM,WAAW,qCAAqC,gBAAgB;AAAA,EACvE;AACA,QAAM,gBAAgB,OAAO,KAAK,MAAM,EAAE,OAAO,CAAA,OAAM,CAAC,iBAAiB,SAAS,EAAE,CAAC;AACrF,MAAI,cAAc,SAAS,GAAG;AAC7B,UAAM,WAAW,4BAA4B,cAAc,KAAK,IAAI,CAAC,eAAe,iBAAiB,KAAK,IAAI,CAAC,KAAK,gBAAgB;AAAA,EACrI;AACA,QAAM,QAAQ,SAAS,OAAO,OAAO,OAAO,OAAO,gBAAgB,GAAG,OAAO;AAC7E,QAAM,UAAU,mBAAmB,OAAO,SAAS,SAAS;AAC5D,MAAI,UAAU,aAAa,YAAY,QAAW;AACjD,UAAM,WAAW,+DAA+D,gBAAgB;AAAA,EACjG;AACA,MAAI,UAAU,YAAY,YAAY,QAAW;AAChD,UAAM,WAAW,6CAA6C,gBAAgB;AAAA,EAC/E;AACA,SAAO;AAAA,IACN;AAAA,IACA;AAAA,IACA,OAAO,gBAAgB,OAAO,OAAO,OAAO;AAAA,IAC5C,aAAa,oBAAoB,OAAO,aAAa,aAAa;AAAA,IAClE,iBAAiB,mBAAmB,OAAO,iBAAiB,iBAAiB;AAAA,IAC7E,aAAa,mBAAmB,OAAO,aAAa,aAAa;AAAA,IACjE,kBAAkB,mBAAmB,OAAO,kBAAkB,kBAAkB;AAAA,IAChF,mBAAmB,oBAAoB,OAAO,mBAAmB,mBAAmB;AAAA,EAAA;AAEtF;AAEO,MAAM,aAAa,CAAC,SAAiB,SAA2B,IAAI,SAAS,SAAS,EAAE,MAAM,UAAU,SAAS,WAAA,CAAY;AAEpI,MAAM,YAAY,CAAC,QAAyB;AAC3C,MAAI;AACH,WAAO,KAAK,MAAM,GAAG;AAAA,EACtB,QAAQ;AACP,UAAM,IAAI,SAAS,oCAAoC;AAAA,MACtD,MAAM;AAAA,MACN,UAAU,SAAS;AAAA,IAAA,CACnB;AAAA,EACF;AACD;AAGA,MAAM,WAAW,CAAC,UAAmD;AACpE,MAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,GAAG;AACxE,WAAO;AAAA,EACR;AACA,QAAM,SAAkC,CAAA;AACxC,aAAW,CAAC,KAAK,IAAI,KAAK,OAAO,QAAQ,KAAK,GAAG;AAChD,WAAO,GAAG,IAAI;AAAA,EACf;AACA,SAAO;AACR;AAEA,MAAM,WAAW,CAAmB,OAAgB,SAAc,UAAqB;AACtF,QAAM,QAAQ,QAAQ,KAAK,CAAA,OAAM,OAAO,KAAK;AAC7C,MAAI,UAAU,QAAW;AACxB,UAAM,WAAW,IAAI,KAAK,qBAAqB,QAAQ,KAAK,IAAI,CAAC,KAAK,gBAAgB;AAAA,EACvF;AACA,SAAO;AACR;AAEA,MAAM,qBAAqB,CAAC,OAAgB,UAAsC;AACjF,MAAI,UAAU,UAAa,UAAU,MAAM;AAC1C,WAAO;AAAA,EACR;AACA,MAAI,OAAO,UAAU,UAAU;AAC9B,UAAM,WAAW,IAAI,KAAK,uBAAuB,gBAAgB;AAAA,EAClE;AACA,SAAO;AACR;AAEA,MAAM,sBAAsB,CAAC,OAAgB,UAAuC;AACnF,MAAI,UAAU,UAAa,UAAU,MAAM;AAC1C,WAAO;AAAA,EACR;AACA,MAAI,OAAO,UAAU,WAAW;AAC/B,UAAM,WAAW,IAAI,KAAK,wBAAwB,gBAAgB;AAAA,EACnE;AACA,SAAO;AACR;AAEA,MAAM,kBAAkB,CAAC,OAAgB,UAA4B;AACpE,MAAI,CAAC,MAAM,QAAQ,KAAK,GAAG;AAC1B,UAAM,WAAW,IAAI,KAAK,kCAAkC,gBAAgB;AAAA,EAC7E;AACA,QAAM,SAAmB,CAAA;AACzB,aAAW,QAAQ,OAAO;AACzB,QAAI,OAAO,SAAS,UAAU;AAC7B,YAAM,WAAW,IAAI,KAAK,kCAAkC,gBAAgB;AAAA,IAC7E;AACA,WAAO,KAAK,IAAI;AAAA,EACjB;AACA,SAAO;AACR;"}

package/dist/development/src/commands/tenant/project/TenantConfigShowCommand.cjs

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const cliCommon = require("@contember/cli-common");
+class TenantConfigShowCommand extends cliCommon.Command {
+  constructor(tenantClientProvider) {
+    super();
+    this.tenantClientProvider = tenantClientProvider;
+  }
+  configure(configuration) {
+    configuration.description("Show the tenant-wide configuration (signup, password policy, login, captcha, rate limits)");
+  }
+  async execute(input, output) {
+    if (output.isQuiet) {
+      throw new cliCommon.CliError("Quiet output is not supported for tenant configuration.", {
+        code: "QUIET_OUTPUT_UNSUPPORTED",
+        exitCode: cliCommon.ExitCode.InputError
+      });
+    }
+    const config = await this.tenantClientProvider.project().configuration();
+    output.data(config);
+  }
+}
+exports.TenantConfigShowCommand = TenantConfigShowCommand;
+//# sourceMappingURL=TenantConfigShowCommand.cjs.map