@contember/cli 2.2.0-alpha.3 → 2.2.0-alpha.4

package/dist/development/src/lib/tenant/TenantConfigApplier.cjs

@@ -1,55 +1,124 @@
 "use strict";
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const cliCommon = require("@contember/cli-common");
+const authPolicy = require("./authPolicy.cjs");
 class TenantConfigApplier {
-  async apply(client, config, options = {}) {
+  constructor(output = new cliCommon.Output()) {
+    this.output = output;
+  }
+  async apply(clients, config, options = {}) {
     const dryRun = options.dryRun === true;
-    const log = (message) => console.log(`${dryRun ? "[dry-run] " : ""}${message}`);
-    if (config.config) {
-      log("configure: applying global tenant config");
-      if (!dryRun) {
-        await client.configure(config.config);
+    const actions = [];
+    const warnings = [];
+    const warn = (code, target, message) => {
+      warnings.push({ code, target, message });
+      this.output.warn(message);
+    };
+    const run = async (action, target, execute) => {
+      actions.push({ action, target });
+      if (dryRun) {
+        return;
       }
+      this.output.info(target === null ? action : `${action}: ${target}`);
+      await execute();
+    };
+    assertDistinctAuthPolicies(config.authPolicies);
+    const existingAuthPolicies = config.authPolicies === void 0 ? void 0 : await clients.policy.listAuthPolicies();
+    assertDistinctExistingAuthPolicies(existingAuthPolicies);
+    if (config.config && hasEffectiveConfigValue(config.config)) {
+      const globalConfig = config.config;
+      await run("configure", null, () => clients.project.configure(globalConfig));
     }
     if (config.identityProviders && Object.keys(config.identityProviders).length > 0) {
-      const existing = await client.listIdentityProviders();
+      const existing = await clients.project.listIdentityProviders();
       const existingBySlug = new Map(existing.map((it) => [it.slug, it]));
       for (const [slug, idp] of Object.entries(config.identityProviders)) {
         const current = existingBySlug.get(slug);
         if (!current) {
-          log(`addIDP: ${slug} (${idp.type})`);
-          if (!dryRun) {
-            await client.addIdp(slug, idp.type, idp.configuration, idp.options);
-          }
+          await run("addIdp", slug, () => clients.project.addIdp(slug, idp.type, idp.configuration, idp.options));
         } else {
-          log(`updateIDP: ${slug} (${idp.type})`);
-          if (!dryRun) {
-            await client.updateIdp(slug, idp.type, idp.configuration, idp.options);
-          }
+          await run("updateIdp", slug, () => clients.project.updateIdp(slug, idp.type, idp.configuration, idp.options));
         }
         const wantDisabled = idp.disabled === true;
         const isDisabled = current ? current.disabledAt !== null : false;
         if (wantDisabled && !isDisabled) {
-          log(`disableIDP: ${slug}`);
-          if (!dryRun) {
-            await client.disableIdp(slug);
-          }
+          await run("disableIdp", slug, () => clients.project.disableIdp(slug));
         } else if (!wantDisabled && isDisabled) {
-          log(`enableIDP: ${slug}`);
-          if (!dryRun) {
-            await client.enableIdp(slug);
-          }
+          await run("enableIdp", slug, () => clients.project.enableIdp(slug));
         }
       }
     }
     if (config.mailTemplates && config.mailTemplates.length > 0) {
       for (const template of config.mailTemplates) {
-        log(`addMailTemplate: ${template.type}${template.variant ? `/${template.variant}` : ""}`);
-        if (!dryRun) {
-          await client.addMailTemplate(template);
+        const target = `${template.type}${template.variant ? `/${template.variant}` : ""}`;
+        await run("addMailTemplate", target, () => clients.policy.addMailTemplate(template));
+      }
+    }
+    if (config.authPolicies) {
+      const existing = existingAuthPolicies ?? [];
+      const existingByKey = new Map(existing.map((it) => [authPolicy.authPolicyKey(it), it]));
+      const managedKeys = new Set(config.authPolicies.map(authPolicy.authPolicyKey));
+      for (const policy of config.authPolicies) {
+        const current = existingByKey.get(authPolicy.authPolicyKey(policy));
+        const target = authPolicy.describeAuthPolicy(policy);
+        if (!current) {
+          await run("createAuthPolicy", target, async () => {
+            await clients.policy.createAuthPolicy(policy);
+          });
+        } else {
+          await run("updateAuthPolicy", target, () => clients.policy.updateAuthPolicy(current.id, policy));
+        }
+      }
+      for (const policy of existing) {
+        if (!managedKeys.has(authPolicy.authPolicyKey(policy))) {
+          const target = authPolicy.describeAuthPolicy(policy);
+          warn("UNMANAGED_AUTH_POLICY", target, `Auth policy ${target} exists but is not in the config; it stays in effect.`);
         }
       }
     }
+    return { actions, warnings };
   }
 }
+const assertDistinctExistingAuthPolicies = (policies) => {
+  const seen = /* @__PURE__ */ new Set();
+  for (const policy of policies ?? []) {
+    const key = authPolicy.authPolicyKey(policy);
+    if (seen.has(key)) {
+      throw new Error(
+        `Duplicate existing auth policy: ${authPolicy.describeAuthPolicy(policy)}. Resolve duplicate rows before applying the tenant config.`
+      );
+    }
+    seen.add(key);
+  }
+};
+const assertDistinctAuthPolicies = (policies) => {
+  const seen = /* @__PURE__ */ new Set();
+  for (const policy of policies ?? []) {
+    const key = authPolicy.authPolicyKey(policy);
+    if (seen.has(key)) {
+      throw `Duplicate auth policy in the config: ${authPolicy.describeAuthPolicy(policy)}. Policies are identified by scope, project and role set.`;
+    }
+    seen.add(key);
+  }
+};
+const nullableConfigClearPaths = /* @__PURE__ */ new Set([
+  "passwordless.url",
+  "password.pattern",
+  "login.maxTokenExpiration",
+  "captcha.provider",
+  "captcha.threshold"
+]);
+const hasEffectiveConfigValue = (value, path = []) => {
+  if (value === void 0) {
+    return false;
+  }
+  if (value === null) {
+    return nullableConfigClearPaths.has(path.join("."));
+  }
+  if (typeof value !== "object") {
+    return true;
+  }
+  return Object.entries(value).some(([key, item]) => hasEffectiveConfigValue(item, [...path, key]));
+};
 exports.TenantConfigApplier = TenantConfigApplier;
 //# sourceMappingURL=TenantConfigApplier.cjs.map

package/dist/development/src/lib/tenant/TenantConfigApplier.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"TenantConfigApplier.cjs","sources":["../../../../../../packages/cli/src/lib/tenant/TenantConfigApplier.ts"],"sourcesContent":["import { TenantClient } from './TenantClient.js'\nimport { TenantConfig } from './tenantConfig.js'\n\nexport interface TenantConfigApplyOptions {\n\tdryRun?: boolean\n}\n\n/**\n * Applies a {@link TenantConfig} to a tenant idempotently:\n * - `configure` is a partial merge, so it is always (re)sent.\n * - identity providers are added or updated based on the current state, then\n *   enabled/disabled to match `disabled`.\n * - mail templates are upserted server-side by `addMailTemplate`.\n *\n * Nothing is ever removed — entries missing from the config are left untouched.\n */\nexport class TenantConfigApplier {\n\tpublic async apply(client: TenantClient, config: TenantConfig, options: TenantConfigApplyOptions = {}): Promise<void> {\n\t\tconst dryRun = options.dryRun === true\n\t\tconst log = (message: string) => console.log(`${dryRun ? '[dry-run] ' : ''}${message}`)\n\n\t\tif (config.config) {\n\t\t\tlog('configure: applying global tenant config')\n\t\t\tif (!dryRun) {\n\t\t\t\tawait client.configure(config.config)\n\t\t\t}\n\t\t}\n\n\t\tif (config.identityProviders && Object.keys(config.identityProviders).length > 0) {\n\t\t\tconst existing = await client.listIdentityProviders()\n\t\t\tconst existingBySlug = new Map(existing.map(it => [it.slug, it]))\n\n\t\t\tfor (const [slug, idp] of Object.entries(config.identityProviders)) {\n\t\t\t\tconst current = existingBySlug.get(slug)\n\t\t\t\tif (!current) {\n\t\t\t\t\tlog(`addIDP: ${slug} (${idp.type})`)\n\t\t\t\t\tif (!dryRun) {\n\t\t\t\t\t\tawait client.addIdp(slug, idp.type, idp.configuration, idp.options)\n\t\t\t\t\t}\n\t\t\t\t} else {\n\t\t\t\t\tlog(`updateIDP: ${slug} (${idp.type})`)\n\t\t\t\t\tif (!dryRun) {\n\t\t\t\t\t\tawait client.updateIdp(slug, idp.type, idp.configuration, idp.options)\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tconst wantDisabled = idp.disabled === true\n\t\t\t\tconst isDisabled = current ? current.disabledAt !== null : false\n\t\t\t\tif (wantDisabled && !isDisabled) {\n\t\t\t\t\tlog(`disableIDP: ${slug}`)\n\t\t\t\t\tif (!dryRun) {\n\t\t\t\t\t\tawait client.disableIdp(slug)\n\t\t\t\t\t}\n\t\t\t\t} else if (!wantDisabled && isDisabled) {\n\t\t\t\t\tlog(`enableIDP: ${slug}`)\n\t\t\t\t\tif (!dryRun) {\n\t\t\t\t\t\tawait client.enableIdp(slug)\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tif (config.mailTemplates && config.mailTemplates.length > 0) {\n\t\t\tfor (const template of config.mailTemplates) {\n\t\t\t\tlog(`addMailTemplate: ${template.type}${template.variant ? `/${template.variant}` : ''}`)\n\t\t\t\tif (!dryRun) {\n\t\t\t\t\tawait client.addMailTemplate(template)\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;AAgBO,MAAM,oBAAoB;AAAA,EAChC,MAAa,MAAM,QAAsB,QAAsB,UAAoC,CAAA,GAAmB;AACrH,UAAM,SAAS,QAAQ,WAAW;AAClC,UAAM,MAAM,CAAC,YAAoB,QAAQ,IAAI,GAAG,SAAS,eAAe,EAAE,GAAG,OAAO,EAAE;AAEtF,QAAI,OAAO,QAAQ;AAClB,UAAI,0CAA0C;AAC9C,UAAI,CAAC,QAAQ;AACZ,cAAM,OAAO,UAAU,OAAO,MAAM;AAAA,MACrC;AAAA,IACD;AAEA,QAAI,OAAO,qBAAqB,OAAO,KAAK,OAAO,iBAAiB,EAAE,SAAS,GAAG;AACjF,YAAM,WAAW,MAAM,OAAO,sBAAA;AAC9B,YAAM,iBAAiB,IAAI,IAAI,SAAS,IAAI,CAAA,OAAM,CAAC,GAAG,MAAM,EAAE,CAAC,CAAC;AAEhE,iBAAW,CAAC,MAAM,GAAG,KAAK,OAAO,QAAQ,OAAO,iBAAiB,GAAG;AACnE,cAAM,UAAU,eAAe,IAAI,IAAI;AACvC,YAAI,CAAC,SAAS;AACb,cAAI,WAAW,IAAI,KAAK,IAAI,IAAI,GAAG;AACnC,cAAI,CAAC,QAAQ;AACZ,kBAAM,OAAO,OAAO,MAAM,IAAI,MAAM,IAAI,eAAe,IAAI,OAAO;AAAA,UACnE;AAAA,QACD,OAAO;AACN,cAAI,cAAc,IAAI,KAAK,IAAI,IAAI,GAAG;AACtC,cAAI,CAAC,QAAQ;AACZ,kBAAM,OAAO,UAAU,MAAM,IAAI,MAAM,IAAI,eAAe,IAAI,OAAO;AAAA,UACtE;AAAA,QACD;AAEA,cAAM,eAAe,IAAI,aAAa;AACtC,cAAM,aAAa,UAAU,QAAQ,eAAe,OAAO;AAC3D,YAAI,gBAAgB,CAAC,YAAY;AAChC,cAAI,eAAe,IAAI,EAAE;AACzB,cAAI,CAAC,QAAQ;AACZ,kBAAM,OAAO,WAAW,IAAI;AAAA,UAC7B;AAAA,QACD,WAAW,CAAC,gBAAgB,YAAY;AACvC,cAAI,cAAc,IAAI,EAAE;AACxB,cAAI,CAAC,QAAQ;AACZ,kBAAM,OAAO,UAAU,IAAI;AAAA,UAC5B;AAAA,QACD;AAAA,MACD;AAAA,IACD;AAEA,QAAI,OAAO,iBAAiB,OAAO,cAAc,SAAS,GAAG;AAC5D,iBAAW,YAAY,OAAO,eAAe;AAC5C,YAAI,oBAAoB,SAAS,IAAI,GAAG,SAAS,UAAU,IAAI,SAAS,OAAO,KAAK,EAAE,EAAE;AACxF,YAAI,CAAC,QAAQ;AACZ,gBAAM,OAAO,gBAAgB,QAAQ;AAAA,QACtC;AAAA,MACD;AAAA,IACD;AAAA,EACD;AACD;;"}
+{"version":3,"file":"TenantConfigApplier.cjs","sources":["../../../../../../packages/cli/src/lib/tenant/TenantConfigApplier.ts"],"sourcesContent":["import { Output } from '@contember/cli-common'\nimport { authPolicyKey, describeAuthPolicy } from './authPolicy.js'\nimport { type RemoteAuthPolicy, TenantPolicyClient, TenantProjectClient } from './clients/index.js'\nimport { TenantConfig } from './tenantConfig.js'\n\nexport interface TenantConfigApplyOptions {\n\tdryRun?: boolean\n}\n\n/** The slice of the domain clients the applier drives — structural, so a test can pass a fake. */\nexport interface TenantConfigApplierClients {\n\treadonly project: Pick<TenantProjectClient, 'configure' | 'listIdentityProviders' | 'addIdp' | 'updateIdp' | 'enableIdp' | 'disableIdp'>\n\treadonly policy: Pick<TenantPolicyClient, 'addMailTemplate' | 'listAuthPolicies' | 'createAuthPolicy' | 'updateAuthPolicy'>\n}\n\nexport type TenantConfigActionType =\n\t| 'configure'\n\t| 'addIdp'\n\t| 'updateIdp'\n\t| 'enableIdp'\n\t| 'disableIdp'\n\t| 'addMailTemplate'\n\t| 'createAuthPolicy'\n\t| 'updateAuthPolicy'\n\n/** One step of the apply plan. In a dry run it is what would be done, otherwise what was done. */\nexport interface TenantConfigAction {\n\taction: TenantConfigActionType\n\ttarget: string | null\n}\n\nexport type TenantConfigWarningCode = 'UNMANAGED_AUTH_POLICY'\n\n/** Server-side state the config does not cover. Nothing is pruned, so it stays in effect. */\nexport interface TenantConfigWarning {\n\tcode: TenantConfigWarningCode\n\ttarget: string\n\tmessage: string\n}\n\n/**\n * The outcome of an apply. Warnings are returned rather than only printed: `output.warn` is silent\n * outside human mode, and an unmanaged policy is exactly what an agent running `--json` needs to see.\n */\nexport interface TenantConfigPlan {\n\tactions: TenantConfigAction[]\n\twarnings: TenantConfigWarning[]\n}\n\n/**\n * Applies a {@link TenantConfig} to a tenant idempotently:\n * - `configure` is a partial merge and is sent only when the schema maps at least one value to a database change.\n * - identity providers are added or updated based on the current state, then\n *   enabled/disabled to match `disabled`.\n * - mail templates are upserted server-side by `addMailTemplate`.\n * - auth policies are matched to existing rows by what they target (scope,\n *   project, role set) and created or updated accordingly; every policy the\n *   config does not cover is warned about, including when the config lists none.\n *\n * Nothing is ever removed — entries missing from the config are left untouched.\n *\n * Returns the plan as data; the caller prints it. The applier itself only reports each action on stderr.\n */\nexport class TenantConfigApplier {\n\tconstructor(\n\t\tprivate readonly output: Output = new Output(),\n\t) {\n\t}\n\n\tpublic async apply(\n\t\tclients: TenantConfigApplierClients,\n\t\tconfig: TenantConfig,\n\t\toptions: TenantConfigApplyOptions = {},\n\t): Promise<TenantConfigPlan> {\n\t\tconst dryRun = options.dryRun === true\n\t\tconst actions: TenantConfigAction[] = []\n\t\tconst warnings: TenantConfigWarning[] = []\n\t\tconst warn = (code: TenantConfigWarningCode, target: string, message: string) => {\n\t\t\twarnings.push({ code, target, message })\n\t\t\tthis.output.warn(message)\n\t\t}\n\t\tconst run = async (action: TenantConfigActionType, target: string | null, execute: () => Promise<void>) => {\n\t\t\tactions.push({ action, target })\n\t\t\tif (dryRun) {\n\t\t\t\treturn\n\t\t\t}\n\t\t\t// info, not progress: `tenant apply` mostly runs in CI, where a non-TTY progress line would leave no record of what was touched\n\t\t\tthis.output.info(target === null ? action : `${action}: ${target}`)\n\t\t\tawait execute()\n\t\t}\n\n\t\t// Up front, before anything has been written: two entries targeting the same\n\t\t// scope/project/roles are one policy to the applier but two rows server-side.\n\t\tassertDistinctAuthPolicies(config.authPolicies)\n\t\tconst existingAuthPolicies = config.authPolicies === undefined ? undefined : await clients.policy.listAuthPolicies()\n\t\tassertDistinctExistingAuthPolicies(existingAuthPolicies)\n\n\t\tif (config.config && hasEffectiveConfigValue(config.config)) {\n\t\t\tconst globalConfig = config.config\n\t\t\tawait run('configure', null, () => clients.project.configure(globalConfig))\n\t\t}\n\n\t\tif (config.identityProviders && Object.keys(config.identityProviders).length > 0) {\n\t\t\tconst existing = await clients.project.listIdentityProviders()\n\t\t\tconst existingBySlug = new Map(existing.map(it => [it.slug, it]))\n\n\t\t\tfor (const [slug, idp] of Object.entries(config.identityProviders)) {\n\t\t\t\tconst current = existingBySlug.get(slug)\n\t\t\t\tif (!current) {\n\t\t\t\t\tawait run('addIdp', slug, () => clients.project.addIdp(slug, idp.type, idp.configuration, idp.options))\n\t\t\t\t} else {\n\t\t\t\t\tawait run('updateIdp', slug, () => clients.project.updateIdp(slug, idp.type, idp.configuration, idp.options))\n\t\t\t\t}\n\n\t\t\t\tconst wantDisabled = idp.disabled === true\n\t\t\t\tconst isDisabled = current ? current.disabledAt !== null : false\n\t\t\t\tif (wantDisabled && !isDisabled) {\n\t\t\t\t\tawait run('disableIdp', slug, () => clients.project.disableIdp(slug))\n\t\t\t\t} else if (!wantDisabled && isDisabled) {\n\t\t\t\t\tawait run('enableIdp', slug, () => clients.project.enableIdp(slug))\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tif (config.mailTemplates && config.mailTemplates.length > 0) {\n\t\t\tfor (const template of config.mailTemplates) {\n\t\t\t\tconst target = `${template.type}${template.variant ? `/${template.variant}` : ''}`\n\t\t\t\tawait run('addMailTemplate', target, () => clients.policy.addMailTemplate(template))\n\t\t\t}\n\t\t}\n\n\t\t// `[]` is meaningful here, unlike for the other sections: it says \"I manage\n\t\t// policies and there are none\", which is exactly when the warning below matters.\n\t\tif (config.authPolicies) {\n\t\t\tconst existing = existingAuthPolicies ?? []\n\t\t\tconst existingByKey = new Map(existing.map(it => [authPolicyKey(it), it]))\n\t\t\tconst managedKeys = new Set(config.authPolicies.map(authPolicyKey))\n\n\t\t\tfor (const policy of config.authPolicies) {\n\t\t\t\tconst current = existingByKey.get(authPolicyKey(policy))\n\t\t\t\tconst target = describeAuthPolicy(policy)\n\t\t\t\tif (!current) {\n\t\t\t\t\tawait run('createAuthPolicy', target, async () => {\n\t\t\t\t\t\tawait clients.policy.createAuthPolicy(policy)\n\t\t\t\t\t})\n\t\t\t\t} else {\n\t\t\t\t\tawait run('updateAuthPolicy', target, () => clients.policy.updateAuthPolicy(current.id, policy))\n\t\t\t\t}\n\t\t\t}\n\n\t\t\t// Policies are aggregated strictest-wins, so one left behind by a config\n\t\t\t// edit keeps enforcing. Nothing is pruned, but silence would hide it.\n\t\t\tfor (const policy of existing) {\n\t\t\t\tif (!managedKeys.has(authPolicyKey(policy))) {\n\t\t\t\t\tconst target = describeAuthPolicy(policy)\n\t\t\t\t\twarn('UNMANAGED_AUTH_POLICY', target, `Auth policy ${target} exists but is not in the config; it stays in effect.`)\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\treturn { actions, warnings }\n\t}\n}\n\nconst assertDistinctExistingAuthPolicies = (policies: readonly RemoteAuthPolicy[] | undefined): void => {\n\tconst seen = new Set<string>()\n\tfor (const policy of policies ?? []) {\n\t\tconst key = authPolicyKey(policy)\n\t\tif (seen.has(key)) {\n\t\t\tthrow new Error(\n\t\t\t\t`Duplicate existing auth policy: ${describeAuthPolicy(policy)}. Resolve duplicate rows before applying the tenant config.`,\n\t\t\t)\n\t\t}\n\t\tseen.add(key)\n\t}\n}\n\n/**\n * A policy's identity is its target, so two config entries with the same\n * scope/project/roles are indistinguishable to the applier but produce two rows\n * server-side — the second of which would then be silently orphaned on the next\n * run. Cheaper to reject than to reconcile.\n */\nconst assertDistinctAuthPolicies = (policies: TenantConfig['authPolicies']): void => {\n\tconst seen = new Set<string>()\n\tfor (const policy of policies ?? []) {\n\t\tconst key = authPolicyKey(policy)\n\t\tif (seen.has(key)) {\n\t\t\tthrow `Duplicate auth policy in the config: ${describeAuthPolicy(policy)}. Policies are identified by scope, project and role set.`\n\t\t}\n\t\tseen.add(key)\n\t}\n}\n\n/** Null clears only the fields that the tenant update command maps to a nullable database column. */\nconst nullableConfigClearPaths = new Set([\n\t'passwordless.url',\n\t'password.pattern',\n\t'login.maxTokenExpiration',\n\t'captcha.provider',\n\t'captcha.threshold',\n])\n\nconst hasEffectiveConfigValue = (value: unknown, path: readonly string[] = []): boolean => {\n\tif (value === undefined) {\n\t\treturn false\n\t}\n\tif (value === null) {\n\t\treturn nullableConfigClearPaths.has(path.join('.'))\n\t}\n\tif (typeof value !== 'object') {\n\t\treturn true\n\t}\n\treturn Object.entries(value).some(([key, item]) => hasEffectiveConfigValue(item, [...path, key]))\n}\n"],"names":["Output","authPolicyKey","describeAuthPolicy"],"mappings":";;;;AA+DO,MAAM,oBAAoB;AAAA,EAChC,YACkB,SAAiB,IAAIA,UAAAA,UACrC;AADgB,SAAA,SAAA;AAAA,EAElB;AAAA,EAEA,MAAa,MACZ,SACA,QACA,UAAoC,CAAA,GACR;AAC5B,UAAM,SAAS,QAAQ,WAAW;AAClC,UAAM,UAAgC,CAAA;AACtC,UAAM,WAAkC,CAAA;AACxC,UAAM,OAAO,CAAC,MAA+B,QAAgB,YAAoB;AAChF,eAAS,KAAK,EAAE,MAAM,QAAQ,SAAS;AACvC,WAAK,OAAO,KAAK,OAAO;AAAA,IACzB;AACA,UAAM,MAAM,OAAO,QAAgC,QAAuB,YAAiC;AAC1G,cAAQ,KAAK,EAAE,QAAQ,OAAA,CAAQ;AAC/B,UAAI,QAAQ;AACX;AAAA,MACD;AAEA,WAAK,OAAO,KAAK,WAAW,OAAO,SAAS,GAAG,MAAM,KAAK,MAAM,EAAE;AAClE,YAAM,QAAA;AAAA,IACP;AAIA,+BAA2B,OAAO,YAAY;AAC9C,UAAM,uBAAuB,OAAO,iBAAiB,SAAY,SAAY,MAAM,QAAQ,OAAO,iBAAA;AAClG,uCAAmC,oBAAoB;AAEvD,QAAI,OAAO,UAAU,wBAAwB,OAAO,MAAM,GAAG;AAC5D,YAAM,eAAe,OAAO;AAC5B,YAAM,IAAI,aAAa,MAAM,MAAM,QAAQ,QAAQ,UAAU,YAAY,CAAC;AAAA,IAC3E;AAEA,QAAI,OAAO,qBAAqB,OAAO,KAAK,OAAO,iBAAiB,EAAE,SAAS,GAAG;AACjF,YAAM,WAAW,MAAM,QAAQ,QAAQ,sBAAA;AACvC,YAAM,iBAAiB,IAAI,IAAI,SAAS,IAAI,CAAA,OAAM,CAAC,GAAG,MAAM,EAAE,CAAC,CAAC;AAEhE,iBAAW,CAAC,MAAM,GAAG,KAAK,OAAO,QAAQ,OAAO,iBAAiB,GAAG;AACnE,cAAM,UAAU,eAAe,IAAI,IAAI;AACvC,YAAI,CAAC,SAAS;AACb,gBAAM,IAAI,UAAU,MAAM,MAAM,QAAQ,QAAQ,OAAO,MAAM,IAAI,MAAM,IAAI,eAAe,IAAI,OAAO,CAAC;AAAA,QACvG,OAAO;AACN,gBAAM,IAAI,aAAa,MAAM,MAAM,QAAQ,QAAQ,UAAU,MAAM,IAAI,MAAM,IAAI,eAAe,IAAI,OAAO,CAAC;AAAA,QAC7G;AAEA,cAAM,eAAe,IAAI,aAAa;AACtC,cAAM,aAAa,UAAU,QAAQ,eAAe,OAAO;AAC3D,YAAI,gBAAgB,CAAC,YAAY;AAChC,gBAAM,IAAI,cAAc,MAAM,MAAM,QAAQ,QAAQ,WAAW,IAAI,CAAC;AAAA,QACrE,WAAW,CAAC,gBAAgB,YAAY;AACvC,gBAAM,IAAI,aAAa,MAAM,MAAM,QAAQ,QAAQ,UAAU,IAAI,CAAC;AAAA,QACnE;AAAA,MACD;AAAA,IACD;AAEA,QAAI,OAAO,iBAAiB,OAAO,cAAc,SAAS,GAAG;AAC5D,iBAAW,YAAY,OAAO,eAAe;AAC5C,cAAM,SAAS,GAAG,SAAS,IAAI,GAAG,SAAS,UAAU,IAAI,SAAS,OAAO,KAAK,EAAE;AAChF,cAAM,IAAI,mBAAmB,QAAQ,MAAM,QAAQ,OAAO,gBAAgB,QAAQ,CAAC;AAAA,MACpF;AAAA,IACD;AAIA,QAAI,OAAO,cAAc;AACxB,YAAM,WAAW,wBAAwB,CAAA;AACzC,YAAM,gBAAgB,IAAI,IAAI,SAAS,IAAI,CAAA,OAAM,CAACC,yBAAc,EAAE,GAAG,EAAE,CAAC,CAAC;AACzE,YAAM,cAAc,IAAI,IAAI,OAAO,aAAa,IAAIA,WAAAA,aAAa,CAAC;AAElE,iBAAW,UAAU,OAAO,cAAc;AACzC,cAAM,UAAU,cAAc,IAAIA,WAAAA,cAAc,MAAM,CAAC;AACvD,cAAM,SAASC,WAAAA,mBAAmB,MAAM;AACxC,YAAI,CAAC,SAAS;AACb,gBAAM,IAAI,oBAAoB,QAAQ,YAAY;AACjD,kBAAM,QAAQ,OAAO,iBAAiB,MAAM;AAAA,UAC7C,CAAC;AAAA,QACF,OAAO;AACN,gBAAM,IAAI,oBAAoB,QAAQ,MAAM,QAAQ,OAAO,iBAAiB,QAAQ,IAAI,MAAM,CAAC;AAAA,QAChG;AAAA,MACD;AAIA,iBAAW,UAAU,UAAU;AAC9B,YAAI,CAAC,YAAY,IAAID,WAAAA,cAAc,MAAM,CAAC,GAAG;AAC5C,gBAAM,SAASC,WAAAA,mBAAmB,MAAM;AACxC,eAAK,yBAAyB,QAAQ,eAAe,MAAM,uDAAuD;AAAA,QACnH;AAAA,MACD;AAAA,IACD;AAEA,WAAO,EAAE,SAAS,SAAA;AAAA,EACnB;AACD;AAEA,MAAM,qCAAqC,CAAC,aAA4D;AACvG,QAAM,2BAAW,IAAA;AACjB,aAAW,UAAU,YAAY,IAAI;AACpC,UAAM,MAAMD,WAAAA,cAAc,MAAM;AAChC,QAAI,KAAK,IAAI,GAAG,GAAG;AAClB,YAAM,IAAI;AAAA,QACT,mCAAmCC,WAAAA,mBAAmB,MAAM,CAAC;AAAA,MAAA;AAAA,IAE/D;AACA,SAAK,IAAI,GAAG;AAAA,EACb;AACD;AAQA,MAAM,6BAA6B,CAAC,aAAiD;AACpF,QAAM,2BAAW,IAAA;AACjB,aAAW,UAAU,YAAY,IAAI;AACpC,UAAM,MAAMD,WAAAA,cAAc,MAAM;AAChC,QAAI,KAAK,IAAI,GAAG,GAAG;AAClB,YAAM,wCAAwCC,WAAAA,mBAAmB,MAAM,CAAC;AAAA,IACzE;AACA,SAAK,IAAI,GAAG;AAAA,EACb;AACD;AAGA,MAAM,+CAA+B,IAAI;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACD,CAAC;AAED,MAAM,0BAA0B,CAAC,OAAgB,OAA0B,OAAgB;AAC1F,MAAI,UAAU,QAAW;AACxB,WAAO;AAAA,EACR;AACA,MAAI,UAAU,MAAM;AACnB,WAAO,yBAAyB,IAAI,KAAK,KAAK,GAAG,CAAC;AAAA,EACnD;AACA,MAAI,OAAO,UAAU,UAAU;AAC9B,WAAO;AAAA,EACR;AACA,SAAO,OAAO,QAAQ,KAAK,EAAE,KAAK,CAAC,CAAC,KAAK,IAAI,MAAM,wBAAwB,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC;AACjG;;"}

package/dist/development/src/lib/tenant/TenantConfigApplier.js

@@ -1,54 +1,123 @@
+import { Output } from "@contember/cli-common";
+import { authPolicyKey, describeAuthPolicy } from "./authPolicy.js";
 class TenantConfigApplier {
-  async apply(client, config, options = {}) {
+  constructor(output = new Output()) {
+    this.output = output;
+  }
+  async apply(clients, config, options = {}) {
     const dryRun = options.dryRun === true;
-    const log = (message) => console.log(`${dryRun ? "[dry-run] " : ""}${message}`);
-    if (config.config) {
-      log("configure: applying global tenant config");
-      if (!dryRun) {
-        await client.configure(config.config);
+    const actions = [];
+    const warnings = [];
+    const warn = (code, target, message) => {
+      warnings.push({ code, target, message });
+      this.output.warn(message);
+    };
+    const run = async (action, target, execute) => {
+      actions.push({ action, target });
+      if (dryRun) {
+        return;
       }
+      this.output.info(target === null ? action : `${action}: ${target}`);
+      await execute();
+    };
+    assertDistinctAuthPolicies(config.authPolicies);
+    const existingAuthPolicies = config.authPolicies === void 0 ? void 0 : await clients.policy.listAuthPolicies();
+    assertDistinctExistingAuthPolicies(existingAuthPolicies);
+    if (config.config && hasEffectiveConfigValue(config.config)) {
+      const globalConfig = config.config;
+      await run("configure", null, () => clients.project.configure(globalConfig));
     }
     if (config.identityProviders && Object.keys(config.identityProviders).length > 0) {
-      const existing = await client.listIdentityProviders();
+      const existing = await clients.project.listIdentityProviders();
       const existingBySlug = new Map(existing.map((it) => [it.slug, it]));
       for (const [slug, idp] of Object.entries(config.identityProviders)) {
         const current = existingBySlug.get(slug);
         if (!current) {
-          log(`addIDP: ${slug} (${idp.type})`);
-          if (!dryRun) {
-            await client.addIdp(slug, idp.type, idp.configuration, idp.options);
-          }
+          await run("addIdp", slug, () => clients.project.addIdp(slug, idp.type, idp.configuration, idp.options));
         } else {
-          log(`updateIDP: ${slug} (${idp.type})`);
-          if (!dryRun) {
-            await client.updateIdp(slug, idp.type, idp.configuration, idp.options);
-          }
+          await run("updateIdp", slug, () => clients.project.updateIdp(slug, idp.type, idp.configuration, idp.options));
         }
         const wantDisabled = idp.disabled === true;
         const isDisabled = current ? current.disabledAt !== null : false;
         if (wantDisabled && !isDisabled) {
-          log(`disableIDP: ${slug}`);
-          if (!dryRun) {
-            await client.disableIdp(slug);
-          }
+          await run("disableIdp", slug, () => clients.project.disableIdp(slug));
         } else if (!wantDisabled && isDisabled) {
-          log(`enableIDP: ${slug}`);
-          if (!dryRun) {
-            await client.enableIdp(slug);
-          }
+          await run("enableIdp", slug, () => clients.project.enableIdp(slug));
         }
       }
     }
     if (config.mailTemplates && config.mailTemplates.length > 0) {
       for (const template of config.mailTemplates) {
-        log(`addMailTemplate: ${template.type}${template.variant ? `/${template.variant}` : ""}`);
-        if (!dryRun) {
-          await client.addMailTemplate(template);
+        const target = `${template.type}${template.variant ? `/${template.variant}` : ""}`;
+        await run("addMailTemplate", target, () => clients.policy.addMailTemplate(template));
+      }
+    }
+    if (config.authPolicies) {
+      const existing = existingAuthPolicies ?? [];
+      const existingByKey = new Map(existing.map((it) => [authPolicyKey(it), it]));
+      const managedKeys = new Set(config.authPolicies.map(authPolicyKey));
+      for (const policy of config.authPolicies) {
+        const current = existingByKey.get(authPolicyKey(policy));
+        const target = describeAuthPolicy(policy);
+        if (!current) {
+          await run("createAuthPolicy", target, async () => {
+            await clients.policy.createAuthPolicy(policy);
+          });
+        } else {
+          await run("updateAuthPolicy", target, () => clients.policy.updateAuthPolicy(current.id, policy));
+        }
+      }
+      for (const policy of existing) {
+        if (!managedKeys.has(authPolicyKey(policy))) {
+          const target = describeAuthPolicy(policy);
+          warn("UNMANAGED_AUTH_POLICY", target, `Auth policy ${target} exists but is not in the config; it stays in effect.`);
         }
       }
     }
+    return { actions, warnings };
   }
 }
+const assertDistinctExistingAuthPolicies = (policies) => {
+  const seen = /* @__PURE__ */ new Set();
+  for (const policy of policies ?? []) {
+    const key = authPolicyKey(policy);
+    if (seen.has(key)) {
+      throw new Error(
+        `Duplicate existing auth policy: ${describeAuthPolicy(policy)}. Resolve duplicate rows before applying the tenant config.`
+      );
+    }
+    seen.add(key);
+  }
+};
+const assertDistinctAuthPolicies = (policies) => {
+  const seen = /* @__PURE__ */ new Set();
+  for (const policy of policies ?? []) {
+    const key = authPolicyKey(policy);
+    if (seen.has(key)) {
+      throw `Duplicate auth policy in the config: ${describeAuthPolicy(policy)}. Policies are identified by scope, project and role set.`;
+    }
+    seen.add(key);
+  }
+};
+const nullableConfigClearPaths = /* @__PURE__ */ new Set([
+  "passwordless.url",
+  "password.pattern",
+  "login.maxTokenExpiration",
+  "captcha.provider",
+  "captcha.threshold"
+]);
+const hasEffectiveConfigValue = (value, path = []) => {
+  if (value === void 0) {
+    return false;
+  }
+  if (value === null) {
+    return nullableConfigClearPaths.has(path.join("."));
+  }
+  if (typeof value !== "object") {
+    return true;
+  }
+  return Object.entries(value).some(([key, item]) => hasEffectiveConfigValue(item, [...path, key]));
+};
 export {
   TenantConfigApplier
 };

package/dist/development/src/lib/tenant/TenantConfigApplier.js.map

@@ -1 +1 @@
-{"version":3,"file":"TenantConfigApplier.js","sources":["../../../../../../packages/cli/src/lib/tenant/TenantConfigApplier.ts"],"sourcesContent":["import { TenantClient } from './TenantClient.js'\nimport { TenantConfig } from './tenantConfig.js'\n\nexport interface TenantConfigApplyOptions {\n\tdryRun?: boolean\n}\n\n/**\n * Applies a {@link TenantConfig} to a tenant idempotently:\n * - `configure` is a partial merge, so it is always (re)sent.\n * - identity providers are added or updated based on the current state, then\n *   enabled/disabled to match `disabled`.\n * - mail templates are upserted server-side by `addMailTemplate`.\n *\n * Nothing is ever removed — entries missing from the config are left untouched.\n */\nexport class TenantConfigApplier {\n\tpublic async apply(client: TenantClient, config: TenantConfig, options: TenantConfigApplyOptions = {}): Promise<void> {\n\t\tconst dryRun = options.dryRun === true\n\t\tconst log = (message: string) => console.log(`${dryRun ? '[dry-run] ' : ''}${message}`)\n\n\t\tif (config.config) {\n\t\t\tlog('configure: applying global tenant config')\n\t\t\tif (!dryRun) {\n\t\t\t\tawait client.configure(config.config)\n\t\t\t}\n\t\t}\n\n\t\tif (config.identityProviders && Object.keys(config.identityProviders).length > 0) {\n\t\t\tconst existing = await client.listIdentityProviders()\n\t\t\tconst existingBySlug = new Map(existing.map(it => [it.slug, it]))\n\n\t\t\tfor (const [slug, idp] of Object.entries(config.identityProviders)) {\n\t\t\t\tconst current = existingBySlug.get(slug)\n\t\t\t\tif (!current) {\n\t\t\t\t\tlog(`addIDP: ${slug} (${idp.type})`)\n\t\t\t\t\tif (!dryRun) {\n\t\t\t\t\t\tawait client.addIdp(slug, idp.type, idp.configuration, idp.options)\n\t\t\t\t\t}\n\t\t\t\t} else {\n\t\t\t\t\tlog(`updateIDP: ${slug} (${idp.type})`)\n\t\t\t\t\tif (!dryRun) {\n\t\t\t\t\t\tawait client.updateIdp(slug, idp.type, idp.configuration, idp.options)\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tconst wantDisabled = idp.disabled === true\n\t\t\t\tconst isDisabled = current ? current.disabledAt !== null : false\n\t\t\t\tif (wantDisabled && !isDisabled) {\n\t\t\t\t\tlog(`disableIDP: ${slug}`)\n\t\t\t\t\tif (!dryRun) {\n\t\t\t\t\t\tawait client.disableIdp(slug)\n\t\t\t\t\t}\n\t\t\t\t} else if (!wantDisabled && isDisabled) {\n\t\t\t\t\tlog(`enableIDP: ${slug}`)\n\t\t\t\t\tif (!dryRun) {\n\t\t\t\t\t\tawait client.enableIdp(slug)\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tif (config.mailTemplates && config.mailTemplates.length > 0) {\n\t\t\tfor (const template of config.mailTemplates) {\n\t\t\t\tlog(`addMailTemplate: ${template.type}${template.variant ? `/${template.variant}` : ''}`)\n\t\t\t\tif (!dryRun) {\n\t\t\t\t\tawait client.addMailTemplate(template)\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n}\n"],"names":[],"mappings":"AAgBO,MAAM,oBAAoB;AAAA,EAChC,MAAa,MAAM,QAAsB,QAAsB,UAAoC,CAAA,GAAmB;AACrH,UAAM,SAAS,QAAQ,WAAW;AAClC,UAAM,MAAM,CAAC,YAAoB,QAAQ,IAAI,GAAG,SAAS,eAAe,EAAE,GAAG,OAAO,EAAE;AAEtF,QAAI,OAAO,QAAQ;AAClB,UAAI,0CAA0C;AAC9C,UAAI,CAAC,QAAQ;AACZ,cAAM,OAAO,UAAU,OAAO,MAAM;AAAA,MACrC;AAAA,IACD;AAEA,QAAI,OAAO,qBAAqB,OAAO,KAAK,OAAO,iBAAiB,EAAE,SAAS,GAAG;AACjF,YAAM,WAAW,MAAM,OAAO,sBAAA;AAC9B,YAAM,iBAAiB,IAAI,IAAI,SAAS,IAAI,CAAA,OAAM,CAAC,GAAG,MAAM,EAAE,CAAC,CAAC;AAEhE,iBAAW,CAAC,MAAM,GAAG,KAAK,OAAO,QAAQ,OAAO,iBAAiB,GAAG;AACnE,cAAM,UAAU,eAAe,IAAI,IAAI;AACvC,YAAI,CAAC,SAAS;AACb,cAAI,WAAW,IAAI,KAAK,IAAI,IAAI,GAAG;AACnC,cAAI,CAAC,QAAQ;AACZ,kBAAM,OAAO,OAAO,MAAM,IAAI,MAAM,IAAI,eAAe,IAAI,OAAO;AAAA,UACnE;AAAA,QACD,OAAO;AACN,cAAI,cAAc,IAAI,KAAK,IAAI,IAAI,GAAG;AACtC,cAAI,CAAC,QAAQ;AACZ,kBAAM,OAAO,UAAU,MAAM,IAAI,MAAM,IAAI,eAAe,IAAI,OAAO;AAAA,UACtE;AAAA,QACD;AAEA,cAAM,eAAe,IAAI,aAAa;AACtC,cAAM,aAAa,UAAU,QAAQ,eAAe,OAAO;AAC3D,YAAI,gBAAgB,CAAC,YAAY;AAChC,cAAI,eAAe,IAAI,EAAE;AACzB,cAAI,CAAC,QAAQ;AACZ,kBAAM,OAAO,WAAW,IAAI;AAAA,UAC7B;AAAA,QACD,WAAW,CAAC,gBAAgB,YAAY;AACvC,cAAI,cAAc,IAAI,EAAE;AACxB,cAAI,CAAC,QAAQ;AACZ,kBAAM,OAAO,UAAU,IAAI;AAAA,UAC5B;AAAA,QACD;AAAA,MACD;AAAA,IACD;AAEA,QAAI,OAAO,iBAAiB,OAAO,cAAc,SAAS,GAAG;AAC5D,iBAAW,YAAY,OAAO,eAAe;AAC5C,YAAI,oBAAoB,SAAS,IAAI,GAAG,SAAS,UAAU,IAAI,SAAS,OAAO,KAAK,EAAE,EAAE;AACxF,YAAI,CAAC,QAAQ;AACZ,gBAAM,OAAO,gBAAgB,QAAQ;AAAA,QACtC;AAAA,MACD;AAAA,IACD;AAAA,EACD;AACD;"}
+{"version":3,"file":"TenantConfigApplier.js","sources":["../../../../../../packages/cli/src/lib/tenant/TenantConfigApplier.ts"],"sourcesContent":["import { Output } from '@contember/cli-common'\nimport { authPolicyKey, describeAuthPolicy } from './authPolicy.js'\nimport { type RemoteAuthPolicy, TenantPolicyClient, TenantProjectClient } from './clients/index.js'\nimport { TenantConfig } from './tenantConfig.js'\n\nexport interface TenantConfigApplyOptions {\n\tdryRun?: boolean\n}\n\n/** The slice of the domain clients the applier drives — structural, so a test can pass a fake. */\nexport interface TenantConfigApplierClients {\n\treadonly project: Pick<TenantProjectClient, 'configure' | 'listIdentityProviders' | 'addIdp' | 'updateIdp' | 'enableIdp' | 'disableIdp'>\n\treadonly policy: Pick<TenantPolicyClient, 'addMailTemplate' | 'listAuthPolicies' | 'createAuthPolicy' | 'updateAuthPolicy'>\n}\n\nexport type TenantConfigActionType =\n\t| 'configure'\n\t| 'addIdp'\n\t| 'updateIdp'\n\t| 'enableIdp'\n\t| 'disableIdp'\n\t| 'addMailTemplate'\n\t| 'createAuthPolicy'\n\t| 'updateAuthPolicy'\n\n/** One step of the apply plan. In a dry run it is what would be done, otherwise what was done. */\nexport interface TenantConfigAction {\n\taction: TenantConfigActionType\n\ttarget: string | null\n}\n\nexport type TenantConfigWarningCode = 'UNMANAGED_AUTH_POLICY'\n\n/** Server-side state the config does not cover. Nothing is pruned, so it stays in effect. */\nexport interface TenantConfigWarning {\n\tcode: TenantConfigWarningCode\n\ttarget: string\n\tmessage: string\n}\n\n/**\n * The outcome of an apply. Warnings are returned rather than only printed: `output.warn` is silent\n * outside human mode, and an unmanaged policy is exactly what an agent running `--json` needs to see.\n */\nexport interface TenantConfigPlan {\n\tactions: TenantConfigAction[]\n\twarnings: TenantConfigWarning[]\n}\n\n/**\n * Applies a {@link TenantConfig} to a tenant idempotently:\n * - `configure` is a partial merge and is sent only when the schema maps at least one value to a database change.\n * - identity providers are added or updated based on the current state, then\n *   enabled/disabled to match `disabled`.\n * - mail templates are upserted server-side by `addMailTemplate`.\n * - auth policies are matched to existing rows by what they target (scope,\n *   project, role set) and created or updated accordingly; every policy the\n *   config does not cover is warned about, including when the config lists none.\n *\n * Nothing is ever removed — entries missing from the config are left untouched.\n *\n * Returns the plan as data; the caller prints it. The applier itself only reports each action on stderr.\n */\nexport class TenantConfigApplier {\n\tconstructor(\n\t\tprivate readonly output: Output = new Output(),\n\t) {\n\t}\n\n\tpublic async apply(\n\t\tclients: TenantConfigApplierClients,\n\t\tconfig: TenantConfig,\n\t\toptions: TenantConfigApplyOptions = {},\n\t): Promise<TenantConfigPlan> {\n\t\tconst dryRun = options.dryRun === true\n\t\tconst actions: TenantConfigAction[] = []\n\t\tconst warnings: TenantConfigWarning[] = []\n\t\tconst warn = (code: TenantConfigWarningCode, target: string, message: string) => {\n\t\t\twarnings.push({ code, target, message })\n\t\t\tthis.output.warn(message)\n\t\t}\n\t\tconst run = async (action: TenantConfigActionType, target: string | null, execute: () => Promise<void>) => {\n\t\t\tactions.push({ action, target })\n\t\t\tif (dryRun) {\n\t\t\t\treturn\n\t\t\t}\n\t\t\t// info, not progress: `tenant apply` mostly runs in CI, where a non-TTY progress line would leave no record of what was touched\n\t\t\tthis.output.info(target === null ? action : `${action}: ${target}`)\n\t\t\tawait execute()\n\t\t}\n\n\t\t// Up front, before anything has been written: two entries targeting the same\n\t\t// scope/project/roles are one policy to the applier but two rows server-side.\n\t\tassertDistinctAuthPolicies(config.authPolicies)\n\t\tconst existingAuthPolicies = config.authPolicies === undefined ? undefined : await clients.policy.listAuthPolicies()\n\t\tassertDistinctExistingAuthPolicies(existingAuthPolicies)\n\n\t\tif (config.config && hasEffectiveConfigValue(config.config)) {\n\t\t\tconst globalConfig = config.config\n\t\t\tawait run('configure', null, () => clients.project.configure(globalConfig))\n\t\t}\n\n\t\tif (config.identityProviders && Object.keys(config.identityProviders).length > 0) {\n\t\t\tconst existing = await clients.project.listIdentityProviders()\n\t\t\tconst existingBySlug = new Map(existing.map(it => [it.slug, it]))\n\n\t\t\tfor (const [slug, idp] of Object.entries(config.identityProviders)) {\n\t\t\t\tconst current = existingBySlug.get(slug)\n\t\t\t\tif (!current) {\n\t\t\t\t\tawait run('addIdp', slug, () => clients.project.addIdp(slug, idp.type, idp.configuration, idp.options))\n\t\t\t\t} else {\n\t\t\t\t\tawait run('updateIdp', slug, () => clients.project.updateIdp(slug, idp.type, idp.configuration, idp.options))\n\t\t\t\t}\n\n\t\t\t\tconst wantDisabled = idp.disabled === true\n\t\t\t\tconst isDisabled = current ? current.disabledAt !== null : false\n\t\t\t\tif (wantDisabled && !isDisabled) {\n\t\t\t\t\tawait run('disableIdp', slug, () => clients.project.disableIdp(slug))\n\t\t\t\t} else if (!wantDisabled && isDisabled) {\n\t\t\t\t\tawait run('enableIdp', slug, () => clients.project.enableIdp(slug))\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tif (config.mailTemplates && config.mailTemplates.length > 0) {\n\t\t\tfor (const template of config.mailTemplates) {\n\t\t\t\tconst target = `${template.type}${template.variant ? `/${template.variant}` : ''}`\n\t\t\t\tawait run('addMailTemplate', target, () => clients.policy.addMailTemplate(template))\n\t\t\t}\n\t\t}\n\n\t\t// `[]` is meaningful here, unlike for the other sections: it says \"I manage\n\t\t// policies and there are none\", which is exactly when the warning below matters.\n\t\tif (config.authPolicies) {\n\t\t\tconst existing = existingAuthPolicies ?? []\n\t\t\tconst existingByKey = new Map(existing.map(it => [authPolicyKey(it), it]))\n\t\t\tconst managedKeys = new Set(config.authPolicies.map(authPolicyKey))\n\n\t\t\tfor (const policy of config.authPolicies) {\n\t\t\t\tconst current = existingByKey.get(authPolicyKey(policy))\n\t\t\t\tconst target = describeAuthPolicy(policy)\n\t\t\t\tif (!current) {\n\t\t\t\t\tawait run('createAuthPolicy', target, async () => {\n\t\t\t\t\t\tawait clients.policy.createAuthPolicy(policy)\n\t\t\t\t\t})\n\t\t\t\t} else {\n\t\t\t\t\tawait run('updateAuthPolicy', target, () => clients.policy.updateAuthPolicy(current.id, policy))\n\t\t\t\t}\n\t\t\t}\n\n\t\t\t// Policies are aggregated strictest-wins, so one left behind by a config\n\t\t\t// edit keeps enforcing. Nothing is pruned, but silence would hide it.\n\t\t\tfor (const policy of existing) {\n\t\t\t\tif (!managedKeys.has(authPolicyKey(policy))) {\n\t\t\t\t\tconst target = describeAuthPolicy(policy)\n\t\t\t\t\twarn('UNMANAGED_AUTH_POLICY', target, `Auth policy ${target} exists but is not in the config; it stays in effect.`)\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\treturn { actions, warnings }\n\t}\n}\n\nconst assertDistinctExistingAuthPolicies = (policies: readonly RemoteAuthPolicy[] | undefined): void => {\n\tconst seen = new Set<string>()\n\tfor (const policy of policies ?? []) {\n\t\tconst key = authPolicyKey(policy)\n\t\tif (seen.has(key)) {\n\t\t\tthrow new Error(\n\t\t\t\t`Duplicate existing auth policy: ${describeAuthPolicy(policy)}. Resolve duplicate rows before applying the tenant config.`,\n\t\t\t)\n\t\t}\n\t\tseen.add(key)\n\t}\n}\n\n/**\n * A policy's identity is its target, so two config entries with the same\n * scope/project/roles are indistinguishable to the applier but produce two rows\n * server-side — the second of which would then be silently orphaned on the next\n * run. Cheaper to reject than to reconcile.\n */\nconst assertDistinctAuthPolicies = (policies: TenantConfig['authPolicies']): void => {\n\tconst seen = new Set<string>()\n\tfor (const policy of policies ?? []) {\n\t\tconst key = authPolicyKey(policy)\n\t\tif (seen.has(key)) {\n\t\t\tthrow `Duplicate auth policy in the config: ${describeAuthPolicy(policy)}. Policies are identified by scope, project and role set.`\n\t\t}\n\t\tseen.add(key)\n\t}\n}\n\n/** Null clears only the fields that the tenant update command maps to a nullable database column. */\nconst nullableConfigClearPaths = new Set([\n\t'passwordless.url',\n\t'password.pattern',\n\t'login.maxTokenExpiration',\n\t'captcha.provider',\n\t'captcha.threshold',\n])\n\nconst hasEffectiveConfigValue = (value: unknown, path: readonly string[] = []): boolean => {\n\tif (value === undefined) {\n\t\treturn false\n\t}\n\tif (value === null) {\n\t\treturn nullableConfigClearPaths.has(path.join('.'))\n\t}\n\tif (typeof value !== 'object') {\n\t\treturn true\n\t}\n\treturn Object.entries(value).some(([key, item]) => hasEffectiveConfigValue(item, [...path, key]))\n}\n"],"names":[],"mappings":";;AA+DO,MAAM,oBAAoB;AAAA,EAChC,YACkB,SAAiB,IAAI,UACrC;AADgB,SAAA,SAAA;AAAA,EAElB;AAAA,EAEA,MAAa,MACZ,SACA,QACA,UAAoC,CAAA,GACR;AAC5B,UAAM,SAAS,QAAQ,WAAW;AAClC,UAAM,UAAgC,CAAA;AACtC,UAAM,WAAkC,CAAA;AACxC,UAAM,OAAO,CAAC,MAA+B,QAAgB,YAAoB;AAChF,eAAS,KAAK,EAAE,MAAM,QAAQ,SAAS;AACvC,WAAK,OAAO,KAAK,OAAO;AAAA,IACzB;AACA,UAAM,MAAM,OAAO,QAAgC,QAAuB,YAAiC;AAC1G,cAAQ,KAAK,EAAE,QAAQ,OAAA,CAAQ;AAC/B,UAAI,QAAQ;AACX;AAAA,MACD;AAEA,WAAK,OAAO,KAAK,WAAW,OAAO,SAAS,GAAG,MAAM,KAAK,MAAM,EAAE;AAClE,YAAM,QAAA;AAAA,IACP;AAIA,+BAA2B,OAAO,YAAY;AAC9C,UAAM,uBAAuB,OAAO,iBAAiB,SAAY,SAAY,MAAM,QAAQ,OAAO,iBAAA;AAClG,uCAAmC,oBAAoB;AAEvD,QAAI,OAAO,UAAU,wBAAwB,OAAO,MAAM,GAAG;AAC5D,YAAM,eAAe,OAAO;AAC5B,YAAM,IAAI,aAAa,MAAM,MAAM,QAAQ,QAAQ,UAAU,YAAY,CAAC;AAAA,IAC3E;AAEA,QAAI,OAAO,qBAAqB,OAAO,KAAK,OAAO,iBAAiB,EAAE,SAAS,GAAG;AACjF,YAAM,WAAW,MAAM,QAAQ,QAAQ,sBAAA;AACvC,YAAM,iBAAiB,IAAI,IAAI,SAAS,IAAI,CAAA,OAAM,CAAC,GAAG,MAAM,EAAE,CAAC,CAAC;AAEhE,iBAAW,CAAC,MAAM,GAAG,KAAK,OAAO,QAAQ,OAAO,iBAAiB,GAAG;AACnE,cAAM,UAAU,eAAe,IAAI,IAAI;AACvC,YAAI,CAAC,SAAS;AACb,gBAAM,IAAI,UAAU,MAAM,MAAM,QAAQ,QAAQ,OAAO,MAAM,IAAI,MAAM,IAAI,eAAe,IAAI,OAAO,CAAC;AAAA,QACvG,OAAO;AACN,gBAAM,IAAI,aAAa,MAAM,MAAM,QAAQ,QAAQ,UAAU,MAAM,IAAI,MAAM,IAAI,eAAe,IAAI,OAAO,CAAC;AAAA,QAC7G;AAEA,cAAM,eAAe,IAAI,aAAa;AACtC,cAAM,aAAa,UAAU,QAAQ,eAAe,OAAO;AAC3D,YAAI,gBAAgB,CAAC,YAAY;AAChC,gBAAM,IAAI,cAAc,MAAM,MAAM,QAAQ,QAAQ,WAAW,IAAI,CAAC;AAAA,QACrE,WAAW,CAAC,gBAAgB,YAAY;AACvC,gBAAM,IAAI,aAAa,MAAM,MAAM,QAAQ,QAAQ,UAAU,IAAI,CAAC;AAAA,QACnE;AAAA,MACD;AAAA,IACD;AAEA,QAAI,OAAO,iBAAiB,OAAO,cAAc,SAAS,GAAG;AAC5D,iBAAW,YAAY,OAAO,eAAe;AAC5C,cAAM,SAAS,GAAG,SAAS,IAAI,GAAG,SAAS,UAAU,IAAI,SAAS,OAAO,KAAK,EAAE;AAChF,cAAM,IAAI,mBAAmB,QAAQ,MAAM,QAAQ,OAAO,gBAAgB,QAAQ,CAAC;AAAA,MACpF;AAAA,IACD;AAIA,QAAI,OAAO,cAAc;AACxB,YAAM,WAAW,wBAAwB,CAAA;AACzC,YAAM,gBAAgB,IAAI,IAAI,SAAS,IAAI,CAAA,OAAM,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;AACzE,YAAM,cAAc,IAAI,IAAI,OAAO,aAAa,IAAI,aAAa,CAAC;AAElE,iBAAW,UAAU,OAAO,cAAc;AACzC,cAAM,UAAU,cAAc,IAAI,cAAc,MAAM,CAAC;AACvD,cAAM,SAAS,mBAAmB,MAAM;AACxC,YAAI,CAAC,SAAS;AACb,gBAAM,IAAI,oBAAoB,QAAQ,YAAY;AACjD,kBAAM,QAAQ,OAAO,iBAAiB,MAAM;AAAA,UAC7C,CAAC;AAAA,QACF,OAAO;AACN,gBAAM,IAAI,oBAAoB,QAAQ,MAAM,QAAQ,OAAO,iBAAiB,QAAQ,IAAI,MAAM,CAAC;AAAA,QAChG;AAAA,MACD;AAIA,iBAAW,UAAU,UAAU;AAC9B,YAAI,CAAC,YAAY,IAAI,cAAc,MAAM,CAAC,GAAG;AAC5C,gBAAM,SAAS,mBAAmB,MAAM;AACxC,eAAK,yBAAyB,QAAQ,eAAe,MAAM,uDAAuD;AAAA,QACnH;AAAA,MACD;AAAA,IACD;AAEA,WAAO,EAAE,SAAS,SAAA;AAAA,EACnB;AACD;AAEA,MAAM,qCAAqC,CAAC,aAA4D;AACvG,QAAM,2BAAW,IAAA;AACjB,aAAW,UAAU,YAAY,IAAI;AACpC,UAAM,MAAM,cAAc,MAAM;AAChC,QAAI,KAAK,IAAI,GAAG,GAAG;AAClB,YAAM,IAAI;AAAA,QACT,mCAAmC,mBAAmB,MAAM,CAAC;AAAA,MAAA;AAAA,IAE/D;AACA,SAAK,IAAI,GAAG;AAAA,EACb;AACD;AAQA,MAAM,6BAA6B,CAAC,aAAiD;AACpF,QAAM,2BAAW,IAAA;AACjB,aAAW,UAAU,YAAY,IAAI;AACpC,UAAM,MAAM,cAAc,MAAM;AAChC,QAAI,KAAK,IAAI,GAAG,GAAG;AAClB,YAAM,wCAAwC,mBAAmB,MAAM,CAAC;AAAA,IACzE;AACA,SAAK,IAAI,GAAG;AAAA,EACb;AACD;AAGA,MAAM,+CAA+B,IAAI;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACD,CAAC;AAED,MAAM,0BAA0B,CAAC,OAAgB,OAA0B,OAAgB;AAC1F,MAAI,UAAU,QAAW;AACxB,WAAO;AAAA,EACR;AACA,MAAI,UAAU,MAAM;AACnB,WAAO,yBAAyB,IAAI,KAAK,KAAK,GAAG,CAAC;AAAA,EACnD;AACA,MAAI,OAAO,UAAU,UAAU;AAC9B,WAAO;AAAA,EACR;AACA,SAAO,OAAO,QAAQ,KAAK,EAAE,KAAK,CAAC,CAAC,KAAK,IAAI,MAAM,wBAAwB,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC;AACjG;"}

package/dist/development/src/lib/tenant/TenantConnectionProvider.cjs

@@ -0,0 +1,20 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const cliCommon = require("@contember/cli-common");
+class TenantConnectionProvider {
+  constructor(resolver) {
+    this.resolver = resolver;
+  }
+  get() {
+    const connection = this.resolver.resolve();
+    if (!connection) {
+      throw new cliCommon.CliError("Tenant connection not defined. Set CONTEMBER_DSN, or CONTEMBER_API_URL and CONTEMBER_API_TOKEN.", {
+        code: "TENANT_CONNECTION_NOT_DEFINED",
+        exitCode: cliCommon.ExitCode.InputError
+      });
+    }
+    return connection;
+  }
+}
+exports.TenantConnectionProvider = TenantConnectionProvider;
+//# sourceMappingURL=TenantConnectionProvider.cjs.map

package/dist/development/src/lib/tenant/TenantConnectionProvider.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantConnectionProvider.cjs","sources":["../../../../../../packages/cli/src/lib/tenant/TenantConnectionProvider.ts"],"sourcesContent":["import { CliError, ExitCode } from '@contember/cli-common'\nimport type { TenantConnection, TenantConnectionSource } from './TenantConnection.js'\nimport { TenantConnectionResolver } from './TenantConnectionResolver.js'\n\nexport class TenantConnectionProvider implements TenantConnectionSource {\n\tconstructor(\n\t\tprivate readonly resolver: TenantConnectionResolver,\n\t) {\n\t}\n\n\tpublic get(): TenantConnection {\n\t\tconst connection = this.resolver.resolve()\n\t\tif (!connection) {\n\t\t\tthrow new CliError('Tenant connection not defined. Set CONTEMBER_DSN, or CONTEMBER_API_URL and CONTEMBER_API_TOKEN.', {\n\t\t\t\tcode: 'TENANT_CONNECTION_NOT_DEFINED',\n\t\t\t\texitCode: ExitCode.InputError,\n\t\t\t})\n\t\t}\n\t\treturn connection\n\t}\n}\n"],"names":["CliError","ExitCode"],"mappings":";;;AAIO,MAAM,yBAA2D;AAAA,EACvE,YACkB,UAChB;AADgB,SAAA,WAAA;AAAA,EAElB;AAAA,EAEO,MAAwB;AAC9B,UAAM,aAAa,KAAK,SAAS,QAAA;AACjC,QAAI,CAAC,YAAY;AAChB,YAAM,IAAIA,UAAAA,SAAS,mGAAmG;AAAA,QACrH,MAAM;AAAA,QACN,UAAUC,UAAAA,SAAS;AAAA,MAAA,CACnB;AAAA,IACF;AACA,WAAO;AAAA,EACR;AACD;;"}

package/dist/development/src/lib/tenant/TenantConnectionProvider.js

@@ -0,0 +1,20 @@
+import { CliError, ExitCode } from "@contember/cli-common";
+class TenantConnectionProvider {
+  constructor(resolver) {
+    this.resolver = resolver;
+  }
+  get() {
+    const connection = this.resolver.resolve();
+    if (!connection) {
+      throw new CliError("Tenant connection not defined. Set CONTEMBER_DSN, or CONTEMBER_API_URL and CONTEMBER_API_TOKEN.", {
+        code: "TENANT_CONNECTION_NOT_DEFINED",
+        exitCode: ExitCode.InputError
+      });
+    }
+    return connection;
+  }
+}
+export {
+  TenantConnectionProvider
+};
+//# sourceMappingURL=TenantConnectionProvider.js.map

package/dist/development/src/lib/tenant/TenantConnectionProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantConnectionProvider.js","sources":["../../../../../../packages/cli/src/lib/tenant/TenantConnectionProvider.ts"],"sourcesContent":["import { CliError, ExitCode } from '@contember/cli-common'\nimport type { TenantConnection, TenantConnectionSource } from './TenantConnection.js'\nimport { TenantConnectionResolver } from './TenantConnectionResolver.js'\n\nexport class TenantConnectionProvider implements TenantConnectionSource {\n\tconstructor(\n\t\tprivate readonly resolver: TenantConnectionResolver,\n\t) {\n\t}\n\n\tpublic get(): TenantConnection {\n\t\tconst connection = this.resolver.resolve()\n\t\tif (!connection) {\n\t\t\tthrow new CliError('Tenant connection not defined. Set CONTEMBER_DSN, or CONTEMBER_API_URL and CONTEMBER_API_TOKEN.', {\n\t\t\t\tcode: 'TENANT_CONNECTION_NOT_DEFINED',\n\t\t\t\texitCode: ExitCode.InputError,\n\t\t\t})\n\t\t}\n\t\treturn connection\n\t}\n}\n"],"names":[],"mappings":";AAIO,MAAM,yBAA2D;AAAA,EACvE,YACkB,UAChB;AADgB,SAAA,WAAA;AAAA,EAElB;AAAA,EAEO,MAAwB;AAC9B,UAAM,aAAa,KAAK,SAAS,QAAA;AACjC,QAAI,CAAC,YAAY;AAChB,YAAM,IAAI,SAAS,mGAAmG;AAAA,QACrH,MAAM;AAAA,QACN,UAAU,SAAS;AAAA,MAAA,CACnB;AAAA,IACF;AACA,WAAO;AAAA,EACR;AACD;"}

package/dist/development/src/lib/tenant/TenantConnectionResolver.cjs

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const dsn = require("../dsn.cjs");
+class TenantConnectionResolver {
+  constructor(cliEnv) {
+    this.cliEnv = cliEnv;
+  }
+  resolve() {
+    let endpoint;
+    let token;
+    if (this.cliEnv.dsn) {
+      ({ endpoint, token } = dsn.parseDsn(this.cliEnv.dsn));
+    } else {
+      endpoint = this.cliEnv.apiUrl;
+      token = this.cliEnv.apiToken;
+    }
+    if (!endpoint || !token) {
+      return void 0;
+    }
+    if (endpoint.endsWith("/")) {
+      endpoint = endpoint.slice(0, -1);
+    }
+    if (endpoint.endsWith(".contember.cloud") && !endpoint.includes("://api-")) {
+      endpoint += "/_api";
+    }
+    return { endpoint, token };
+  }
+}
+exports.TenantConnectionResolver = TenantConnectionResolver;
+//# sourceMappingURL=TenantConnectionResolver.cjs.map

package/dist/development/src/lib/tenant/TenantConnectionResolver.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantConnectionResolver.cjs","sources":["../../../../../../packages/cli/src/lib/tenant/TenantConnectionResolver.ts"],"sourcesContent":["import { parseDsn } from '../dsn.js'\nimport type { CliEnv } from '../env.js'\nimport type { TenantConnection } from './TenantConnection.js'\n\nexport class TenantConnectionResolver {\n\tconstructor(\n\t\tprivate readonly cliEnv: CliEnv,\n\t) {\n\t}\n\n\tpublic resolve(): TenantConnection | undefined {\n\t\tlet endpoint: string | undefined\n\t\tlet token: string | undefined\n\t\tif (this.cliEnv.dsn) {\n\t\t\t;({ endpoint, token } = parseDsn(this.cliEnv.dsn))\n\t\t} else {\n\t\t\tendpoint = this.cliEnv.apiUrl\n\t\t\ttoken = this.cliEnv.apiToken\n\t\t}\n\t\tif (!endpoint || !token) {\n\t\t\treturn undefined\n\t\t}\n\t\tif (endpoint.endsWith('/')) {\n\t\t\tendpoint = endpoint.slice(0, -1)\n\t\t}\n\t\tif (endpoint.endsWith('.contember.cloud') && !endpoint.includes('://api-')) {\n\t\t\tendpoint += '/_api'\n\t\t}\n\t\treturn { endpoint, token }\n\t}\n}\n"],"names":["parseDsn"],"mappings":";;;AAIO,MAAM,yBAAyB;AAAA,EACrC,YACkB,QAChB;AADgB,SAAA,SAAA;AAAA,EAElB;AAAA,EAEO,UAAwC;AAC9C,QAAI;AACJ,QAAI;AACJ,QAAI,KAAK,OAAO,KAAK;AACnB,OAAC,EAAE,UAAU,MAAA,IAAUA,IAAAA,SAAS,KAAK,OAAO,GAAG;AAAA,IACjD,OAAO;AACN,iBAAW,KAAK,OAAO;AACvB,cAAQ,KAAK,OAAO;AAAA,IACrB;AACA,QAAI,CAAC,YAAY,CAAC,OAAO;AACxB,aAAO;AAAA,IACR;AACA,QAAI,SAAS,SAAS,GAAG,GAAG;AAC3B,iBAAW,SAAS,MAAM,GAAG,EAAE;AAAA,IAChC;AACA,QAAI,SAAS,SAAS,kBAAkB,KAAK,CAAC,SAAS,SAAS,SAAS,GAAG;AAC3E,kBAAY;AAAA,IACb;AACA,WAAO,EAAE,UAAU,MAAA;AAAA,EACpB;AACD;;"}

package/dist/development/src/lib/tenant/TenantConnectionResolver.js

@@ -0,0 +1,30 @@
+import { parseDsn } from "../dsn.js";
+class TenantConnectionResolver {
+  constructor(cliEnv) {
+    this.cliEnv = cliEnv;
+  }
+  resolve() {
+    let endpoint;
+    let token;
+    if (this.cliEnv.dsn) {
+      ({ endpoint, token } = parseDsn(this.cliEnv.dsn));
+    } else {
+      endpoint = this.cliEnv.apiUrl;
+      token = this.cliEnv.apiToken;
+    }
+    if (!endpoint || !token) {
+      return void 0;
+    }
+    if (endpoint.endsWith("/")) {
+      endpoint = endpoint.slice(0, -1);
+    }
+    if (endpoint.endsWith(".contember.cloud") && !endpoint.includes("://api-")) {
+      endpoint += "/_api";
+    }
+    return { endpoint, token };
+  }
+}
+export {
+  TenantConnectionResolver
+};
+//# sourceMappingURL=TenantConnectionResolver.js.map

package/dist/development/src/lib/tenant/TenantConnectionResolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantConnectionResolver.js","sources":["../../../../../../packages/cli/src/lib/tenant/TenantConnectionResolver.ts"],"sourcesContent":["import { parseDsn } from '../dsn.js'\nimport type { CliEnv } from '../env.js'\nimport type { TenantConnection } from './TenantConnection.js'\n\nexport class TenantConnectionResolver {\n\tconstructor(\n\t\tprivate readonly cliEnv: CliEnv,\n\t) {\n\t}\n\n\tpublic resolve(): TenantConnection | undefined {\n\t\tlet endpoint: string | undefined\n\t\tlet token: string | undefined\n\t\tif (this.cliEnv.dsn) {\n\t\t\t;({ endpoint, token } = parseDsn(this.cliEnv.dsn))\n\t\t} else {\n\t\t\tendpoint = this.cliEnv.apiUrl\n\t\t\ttoken = this.cliEnv.apiToken\n\t\t}\n\t\tif (!endpoint || !token) {\n\t\t\treturn undefined\n\t\t}\n\t\tif (endpoint.endsWith('/')) {\n\t\t\tendpoint = endpoint.slice(0, -1)\n\t\t}\n\t\tif (endpoint.endsWith('.contember.cloud') && !endpoint.includes('://api-')) {\n\t\t\tendpoint += '/_api'\n\t\t}\n\t\treturn { endpoint, token }\n\t}\n}\n"],"names":[],"mappings":";AAIO,MAAM,yBAAyB;AAAA,EACrC,YACkB,QAChB;AADgB,SAAA,SAAA;AAAA,EAElB;AAAA,EAEO,UAAwC;AAC9C,QAAI;AACJ,QAAI;AACJ,QAAI,KAAK,OAAO,KAAK;AACnB,OAAC,EAAE,UAAU,MAAA,IAAU,SAAS,KAAK,OAAO,GAAG;AAAA,IACjD,OAAO;AACN,iBAAW,KAAK,OAAO;AACvB,cAAQ,KAAK,OAAO;AAAA,IACrB;AACA,QAAI,CAAC,YAAY,CAAC,OAAO;AACxB,aAAO;AAAA,IACR;AACA,QAAI,SAAS,SAAS,GAAG,GAAG;AAC3B,iBAAW,SAAS,MAAM,GAAG,EAAE;AAAA,IAChC;AACA,QAAI,SAAS,SAAS,kBAAkB,KAAK,CAAC,SAAS,SAAS,SAAS,GAAG;AAC3E,kBAAY;AAAA,IACb;AACA,WAAO,EAAE,UAAU,MAAA;AAAA,EACpB;AACD;"}

package/dist/development/src/lib/tenant/authPolicy.cjs

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const authPolicyKey = (policy) => JSON.stringify([policy.scope, policy.project ?? null, [...policy.roles].sort()]);
+const describeAuthPolicy = (policy) => {
+  const target = policy.scope === "project" ? `project:${policy.project ?? "?"}` : "global";
+  return `${target} [${[...policy.roles].sort().join(", ")}]`;
+};
+exports.authPolicyKey = authPolicyKey;
+exports.describeAuthPolicy = describeAuthPolicy;
+//# sourceMappingURL=authPolicy.cjs.map

package/dist/development/src/lib/tenant/authPolicy.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"authPolicy.cjs","sources":["../../../../../../packages/cli/src/lib/tenant/authPolicy.ts"],"sourcesContent":["interface AuthPolicyIdentity {\n\tscope: string\n\tproject?: string | null\n\troles: readonly string[]\n}\n\n/**\n * Identity of a policy for reconciliation purposes. `auth_policy` has no unique\n * constraint beyond its generated id, so the config is matched against existing\n * rows by what the policy actually *targets*: a scope, an optional project and a\n * set of roles. Roles are sorted because `AuthPolicyResolver` treats them as a\n * set (it matches with `roles.some(...)`), so ordering carries no meaning.\n */\nexport const authPolicyKey = (policy: AuthPolicyIdentity): string => JSON.stringify([policy.scope, policy.project ?? null, [...policy.roles].sort()])\n\n/** Human-readable label for logs and error messages. */\nexport const describeAuthPolicy = (policy: AuthPolicyIdentity): string => {\n\tconst target = policy.scope === 'project' ? `project:${policy.project ?? '?'}` : 'global'\n\treturn `${target} [${[...policy.roles].sort().join(', ')}]`\n}\n"],"names":[],"mappings":";;AAaO,MAAM,gBAAgB,CAAC,WAAuC,KAAK,UAAU,CAAC,OAAO,OAAO,OAAO,WAAW,MAAM,CAAC,GAAG,OAAO,KAAK,EAAE,MAAM,CAAC;AAG7I,MAAM,qBAAqB,CAAC,WAAuC;AACzE,QAAM,SAAS,OAAO,UAAU,YAAY,WAAW,OAAO,WAAW,GAAG,KAAK;AACjF,SAAO,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,KAAK,EAAE,KAAA,EAAO,KAAK,IAAI,CAAC;AACzD;;;"}

package/dist/development/src/lib/tenant/authPolicy.js

@@ -0,0 +1,10 @@
+const authPolicyKey = (policy) => JSON.stringify([policy.scope, policy.project ?? null, [...policy.roles].sort()]);
+const describeAuthPolicy = (policy) => {
+  const target = policy.scope === "project" ? `project:${policy.project ?? "?"}` : "global";
+  return `${target} [${[...policy.roles].sort().join(", ")}]`;
+};
+export {
+  authPolicyKey,
+  describeAuthPolicy
+};
+//# sourceMappingURL=authPolicy.js.map

package/dist/development/src/lib/tenant/authPolicy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authPolicy.js","sources":["../../../../../../packages/cli/src/lib/tenant/authPolicy.ts"],"sourcesContent":["interface AuthPolicyIdentity {\n\tscope: string\n\tproject?: string | null\n\troles: readonly string[]\n}\n\n/**\n * Identity of a policy for reconciliation purposes. `auth_policy` has no unique\n * constraint beyond its generated id, so the config is matched against existing\n * rows by what the policy actually *targets*: a scope, an optional project and a\n * set of roles. Roles are sorted because `AuthPolicyResolver` treats them as a\n * set (it matches with `roles.some(...)`), so ordering carries no meaning.\n */\nexport const authPolicyKey = (policy: AuthPolicyIdentity): string => JSON.stringify([policy.scope, policy.project ?? null, [...policy.roles].sort()])\n\n/** Human-readable label for logs and error messages. */\nexport const describeAuthPolicy = (policy: AuthPolicyIdentity): string => {\n\tconst target = policy.scope === 'project' ? `project:${policy.project ?? '?'}` : 'global'\n\treturn `${target} [${[...policy.roles].sort().join(', ')}]`\n}\n"],"names":[],"mappings":"AAaO,MAAM,gBAAgB,CAAC,WAAuC,KAAK,UAAU,CAAC,OAAO,OAAO,OAAO,WAAW,MAAM,CAAC,GAAG,OAAO,KAAK,EAAE,MAAM,CAAC;AAG7I,MAAM,qBAAqB,CAAC,WAAuC;AACzE,QAAM,SAAS,OAAO,UAAU,YAAY,WAAW,OAAO,WAAW,GAAG,KAAK;AACjF,SAAO,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,KAAK,EAAE,KAAA,EAAO,KAAK,IAAI,CAAC;AACzD;"}