@contember/cli 2.2.0-alpha.3 → 2.2.0-alpha.4

package/src/lib/tenant/clients/TenantPolicyClient.ts

@@ -0,0 +1,192 @@
+import { CliError, ExitCode } from '@contember/cli-common'
+import {
+	addMailTemplateError$$,
+	addMailTemplateResponse$$,
+	authLogEntry$$,
+	type AuthLogFilter,
+	authLogPage$,
+	authPolicy$$,
+	type AuthPolicyInput,
+	type AuthPolicyScope,
+	createAuthPolicyError$$,
+	createAuthPolicyResponse$$,
+	createAuthPolicyResult$$,
+	deleteAuthPolicyError$$,
+	deleteAuthPolicyResponse$$,
+	mailTemplateData$$,
+	type MailTemplateIdentifier,
+	type MailType,
+	mutation$,
+	query$,
+	removeMailTemplateError$$,
+	removeMailTemplateResponse$$,
+	updateAuthPolicyError$$,
+	updateAuthPolicyResponse$$,
+} from '@contember/graphql-client-tenant'
+import { describeAuthPolicy } from '../authPolicy.js'
+import { TenantApiTransport } from '../TenantApiTransport.js'
+import { TenantMailTemplate } from '../tenantConfig.js'
+
+/** A policy as it exists server-side. The config-side counterpart is `TenantAuthPolicy` in `tenantConfig.ts`. */
+export interface RemoteAuthPolicy {
+	id: string
+	scope: AuthPolicyScope
+	/** Project slug, `null` for a global policy. */
+	project: string | null
+	roles: string[]
+	mfaRequired: boolean | null
+	/** ISO 8601 duration, e.g. `PT1H`. */
+	tokenExpiration: string | null
+	idleTimeout: string | null
+	mfaGraceDuration: string | null
+	rememberMeAllowed: boolean | null
+}
+
+export interface TenantMailTemplateData {
+	projectSlug: string | null
+	type: MailType
+	variant: string | null
+	subject: string
+	content: string
+	useLayout: boolean
+	replyTo: string | null
+}
+
+export interface TenantAuthLogEntry {
+	id: string
+	createdAt: string
+	type: string
+	success: boolean
+	invokedByIdentityId: string | null
+	personId: string | null
+	targetPersonId: string | null
+	personInputIdentifier: string | null
+	errorCode: string | null
+	errorMessage: string | null
+	ipAddress: string | null
+	userAgent: string | null
+	identityProviderId: string | null
+	metadata: unknown
+	eventData: unknown
+}
+
+export interface TenantAuthLogPage {
+	entries: TenantAuthLogEntry[]
+	/** True when more rows exist past `offset + entries.length`. */
+	hasMore: boolean
+}
+
+export interface ReadAuthLogArgs {
+	filter?: AuthLogFilter
+	limit?: number
+	offset?: number
+}
+
+// Fetchers are immutable and reusable, so they are built once at module load.
+const authPoliciesFetcher = query$.authPolicies(authPolicy$$)
+const createAuthPolicyFetcher = mutation$.createAuthPolicy(
+	createAuthPolicyResponse$$.error(createAuthPolicyError$$).result(createAuthPolicyResult$$),
+)
+const updateAuthPolicyFetcher = mutation$.updateAuthPolicy(updateAuthPolicyResponse$$.error(updateAuthPolicyError$$))
+const deleteAuthPolicyFetcher = mutation$.deleteAuthPolicy(deleteAuthPolicyResponse$$.error(deleteAuthPolicyError$$))
+const mailTemplatesFetcher = query$.mailTemplates(mailTemplateData$$)
+const addMailTemplateFetcher = mutation$.addMailTemplate(addMailTemplateResponse$$.error(addMailTemplateError$$))
+const removeMailTemplateFetcher = mutation$.removeMailTemplate(removeMailTemplateResponse$$.error(removeMailTemplateError$$))
+const authLogFetcher = query$.authLog(authLogPage$.hasMore.entries(authLogEntry$$))
+
+/** Auth policies, mail templates and the auth log. */
+export class TenantPolicyClient {
+	constructor(
+		private readonly transport: TenantApiTransport,
+	) {
+	}
+
+	public async listAuthPolicies(): Promise<RemoteAuthPolicy[]> {
+		const result = await this.transport.exec(authPoliciesFetcher, {})
+		return result.authPolicies.map(it => ({
+			id: it.id,
+			scope: it.scope,
+			project: it.project ?? null,
+			roles: [...it.roles],
+			mfaRequired: it.mfaRequired ?? null,
+			tokenExpiration: it.tokenExpiration ?? null,
+			idleTimeout: it.idleTimeout ?? null,
+			mfaGraceDuration: it.mfaGraceDuration ?? null,
+			rememberMeAllowed: it.rememberMeAllowed ?? null,
+		}))
+	}
+
+	/** Returns the id of the created policy — the only thing `createAuthPolicy` hands back. */
+	public async createAuthPolicy(policy: AuthPolicyInput): Promise<string> {
+		const result = await this.transport.exec(createAuthPolicyFetcher, { policy })
+		// a policy has no slug, so the target is the only thing that identifies it in an error
+		this.transport.assertOk(result.createAuthPolicy, `createAuthPolicy(${describeAuthPolicy(policy)})`)
+		const id = result.createAuthPolicy?.result?.id
+		if (id === undefined) {
+			// ok without a result breaks the schema contract, so there is nothing sensible to report back
+			throw new CliError(`createAuthPolicy(${describeAuthPolicy(policy)}) reported success without returning an id.`, {
+				code: 'TENANT_API_INVALID_RESPONSE',
+				exitCode: ExitCode.InternalError,
+			})
+		}
+		return id
+	}
+
+	public async updateAuthPolicy(id: string, policy: AuthPolicyInput): Promise<void> {
+		const result = await this.transport.exec(updateAuthPolicyFetcher, { id, policy })
+		this.transport.assertOk(result.updateAuthPolicy, `updateAuthPolicy(${id}: ${describeAuthPolicy(policy)})`)
+	}
+
+	public async deleteAuthPolicy(id: string): Promise<void> {
+		const result = await this.transport.exec(deleteAuthPolicyFetcher, { id })
+		this.transport.assertOk(result.deleteAuthPolicy, `deleteAuthPolicy(${id})`)
+	}
+
+	public async listMailTemplates(): Promise<TenantMailTemplateData[]> {
+		const result = await this.transport.exec(mailTemplatesFetcher, {})
+		return result.mailTemplates.map(it => ({
+			projectSlug: it.projectSlug ?? null,
+			type: it.type,
+			variant: it.variant ?? null,
+			subject: it.subject,
+			content: it.content,
+			useLayout: it.useLayout,
+			replyTo: it.replyTo ?? null,
+		}))
+	}
+
+	public async addMailTemplate(template: TenantMailTemplate): Promise<void> {
+		const result = await this.transport.exec(addMailTemplateFetcher, { template })
+		this.transport.assertOk(result.addMailTemplate, `addMailTemplate(${template.type}/${template.variant ?? ''})`)
+	}
+
+	/** A template is addressed by the `projectSlug`/`type`/`variant` triple — it has no id of its own. */
+	public async removeMailTemplate(templateIdentifier: MailTemplateIdentifier): Promise<void> {
+		const result = await this.transport.exec(removeMailTemplateFetcher, { templateIdentifier })
+		this.transport.assertOk(result.removeMailTemplate, `removeMailTemplate(${templateIdentifier.type}/${templateIdentifier.variant ?? ''})`)
+	}
+
+	public async readAuthLog({ filter, limit, offset }: ReadAuthLogArgs = {}): Promise<TenantAuthLogPage> {
+		const result = await this.transport.exec(authLogFetcher, { filter, limit, offset })
+		return {
+			hasMore: result.authLog.hasMore,
+			entries: result.authLog.entries.map(it => ({
+				id: it.id,
+				createdAt: it.createdAt,
+				type: it.type,
+				success: it.success,
+				invokedByIdentityId: it.invokedByIdentityId ?? null,
+				personId: it.personId ?? null,
+				targetPersonId: it.targetPersonId ?? null,
+				personInputIdentifier: it.personInputIdentifier ?? null,
+				errorCode: it.errorCode ?? null,
+				errorMessage: it.errorMessage ?? null,
+				ipAddress: it.ipAddress ?? null,
+				userAgent: it.userAgent ?? null,
+				identityProviderId: it.identityProviderId ?? null,
+				metadata: it.metadata ?? null,
+				eventData: it.eventData ?? null,
+			})),
+		}
+	}
+}

package/src/lib/tenant/clients/TenantProjectClient.ts

@@ -0,0 +1,425 @@
+import {
+	addIDPError$$,
+	addIDPResponse$$,
+	apiKeyWithToken$$,
+	type CaptchaProvider,
+	config$,
+	configCaptcha$$,
+	configCaptchaProtect$$,
+	configEmailChange$$,
+	configLogin$$,
+	configLoginAnomalyDetection$$,
+	configPassword$$,
+	configPasswordless$$,
+	type ConfigPolicy,
+	configRateLimits$,
+	configRateLimitWindow$$,
+	configSignup$$,
+	configureError$$,
+	configureResponse$$,
+	createProjectResponse$$,
+	createProjectResponseError$$,
+	createProjectResult$,
+	disableIDPError$$,
+	disableIDPResponse$$,
+	enableIDPError$$,
+	enableIDPResponse$$,
+	identity$$,
+	identityGlobalPermissions$$,
+	identityProjectRelation$,
+	identityProvider$,
+	membership$$,
+	mutation$,
+	project$,
+	projectSecretInfo$$,
+	query$,
+	roleConditionVariableDefinition$$,
+	roleDefinition$,
+	roleEntityVariableDefinition$$,
+	rolePredefinedVariableDefinition$$,
+	roleVariableDefinition$$,
+	setProjectSecretError$$,
+	setProjectSecretResponse$$,
+	updateIDPError$$,
+	updateIDPResponse$$,
+	updateProjectError$$,
+	updateProjectResponse$$,
+} from '@contember/graphql-client-tenant'
+import { CliError, ExitCode } from '@contember/cli-common'
+import type { ModelType } from 'graphql-ts-client-api'
+import { TenantApiTransport } from '../TenantApiTransport.js'
+import { TenantGlobalConfig, TenantIdpOptions } from '../tenantConfig.js'
+
+export interface RemoteIdentityProvider {
+	slug: string
+	type: string
+	disabledAt: string | null
+}
+
+export interface TenantProjectSummary {
+	id: string
+	name: string
+	slug: string
+}
+
+export interface TenantProjectRole {
+	name: string
+	/** Variable names the role expects, retained for compatibility. */
+	variables: string[]
+	variableDefinitions: TenantProjectRoleVariableDefinition[]
+}
+
+export type TenantProjectRoleVariableDefinition =
+	| { type: 'entity'; name: string; entityName: string }
+	| { type: 'predefined'; name: string; value: string }
+	| { type: 'condition'; name: string }
+
+export interface TenantProjectSecret {
+	key: string
+	createdAt: string
+	updatedAt: string
+}
+
+export interface TenantProjectDetail {
+	id: string
+	name: string
+	slug: string
+	config: unknown
+	roles: TenantProjectRole[]
+	secrets: TenantProjectSecret[]
+}
+
+export interface TenantCreateProjectDetails {
+	name?: string
+	config?: unknown
+	/** Skip issuing a deploy API key for the project. */
+	noDeployToken?: boolean
+}
+
+export interface TenantCreateProjectResult {
+	/** Null when {@link TenantCreateProjectDetails.noDeployToken} was requested. */
+	deployerApiKey: { id: string; token: string | null } | null
+}
+
+export interface TenantUpdateProjectChanges {
+	name?: string
+	config?: unknown
+	mergeConfig?: boolean
+}
+
+export interface TenantRateLimitWindowState {
+	limit: number
+	window: string
+}
+
+/** The tenant-wide configuration returned by `Query.configuration` — the read side of {@link TenantGlobalConfig}. */
+export interface TenantConfigState {
+	signup: { requireEmailVerification: boolean }
+	emailChange: { requireVerification: boolean }
+	passwordless: { enabled: ConfigPolicy; url: string | null; expiration: string }
+	password: {
+		minLength: number
+		requireUppercase: number
+		requireLowercase: number
+		requireDigit: number
+		requireSpecial: number
+		pattern: string | null
+		checkBlacklist: boolean
+		checkHibp: boolean
+	}
+	login: {
+		baseBackoff: string
+		maxBackoff: string
+		attemptWindow: string
+		revealUserExists: boolean
+		revealLoginMethod: boolean
+		defaultTokenExpiration: string
+		maxTokenExpiration: string | null
+		mfaGraceDuration: string
+		anomalyDetection: {
+			enabled: boolean
+			historySize: number
+			emailThreshold: number
+			stepUpThreshold: number
+		}
+	}
+	captcha: {
+		provider: CaptchaProvider | null
+		threshold: number | null
+		protect: {
+			signUp: boolean
+			passwordReset: boolean
+			passwordlessInit: boolean
+			emailVerification: boolean
+		}
+	}
+	rateLimits: {
+		signUpPerIp: TenantRateLimitWindowState
+		loginPerIp: TenantRateLimitWindowState
+		passwordResetPerIp: TenantRateLimitWindowState
+		passwordlessInitPerIp: TenantRateLimitWindowState
+		emailOtpPerPerson: TenantRateLimitWindowState
+		emailVerificationPerIp: TenantRateLimitWindowState
+	}
+}
+
+export interface TenantWhoAmIProject {
+	slug: string
+	name: string
+	roles: string[]
+}
+
+/** `Query.me` — the identity behind the token the CLI is using. */
+export interface TenantWhoAmI {
+	id: string
+	description: string | null
+	/** Global (tenant-wide) roles — empty for an identity whose access is entirely project-scoped. */
+	roles: string[]
+	permissions: { canCreateProject: boolean; canDeployEntrypoint: boolean } | null
+	projects: TenantWhoAmIProject[]
+}
+
+// Fetchers are immutable and reusable, so they are built once at module load.
+const createProjectFetcher = mutation$.createProject(
+	createProjectResponse$$.error(createProjectResponseError$$).result(createProjectResult$.deployerApiKey(apiKeyWithToken$$)),
+)
+const setProjectSecretFetcher = mutation$.setProjectSecret(setProjectSecretResponse$$.error(setProjectSecretError$$))
+const updateProjectFetcher = mutation$.updateProject(updateProjectResponse$$.error(updateProjectError$$))
+const configureFetcher = mutation$.configure(configureResponse$$.error(configureError$$))
+const configurationFetcher = query$.configuration(
+	config$
+		.signup(configSignup$$)
+		.emailChange(configEmailChange$$)
+		.passwordless(configPasswordless$$)
+		.password(configPassword$$)
+		.login(configLogin$$.anomalyDetection(configLoginAnomalyDetection$$))
+		.captcha(configCaptcha$$.protect(configCaptchaProtect$$))
+		.rateLimits(
+			configRateLimits$
+				.signUpPerIp(configRateLimitWindow$$)
+				.loginPerIp(configRateLimitWindow$$)
+				.passwordResetPerIp(configRateLimitWindow$$)
+				.passwordlessInitPerIp(configRateLimitWindow$$)
+				.emailOtpPerPerson(configRateLimitWindow$$)
+				.emailVerificationPerIp(configRateLimitWindow$$),
+		),
+)
+const projectsFetcher = query$.projects(project$.id.name.slug)
+const roleVariableFetcher = roleVariableDefinition$$
+	.on(roleConditionVariableDefinition$$)
+	.on(roleEntityVariableDefinition$$)
+	.on(rolePredefinedVariableDefinition$$)
+const toRoleVariableDefinition = (variable: ModelType<typeof roleVariableFetcher>): TenantProjectRoleVariableDefinition => {
+	switch (variable.__typename) {
+		case 'RoleEntityVariableDefinition':
+			return { type: 'entity', name: variable.name, entityName: variable.entityName }
+		case 'RolePredefinedVariableDefinition':
+			return { type: 'predefined', name: variable.name, value: variable.value }
+		case 'RoleConditionVariableDefinition':
+			return { type: 'condition', name: variable.name }
+		case 'RoleVariableDefinition':
+			throw new CliError(`Tenant API returned an abstract role variable definition for "${variable.name}".`, {
+				code: 'TENANT_API_INVALID_RESPONSE',
+				exitCode: ExitCode.InternalError,
+			})
+	}
+}
+const projectBySlugFetcher = query$.projectBySlug(
+	project$
+		.id.name.slug.config
+		.roles(roleDefinition$.name.variables(roleVariableFetcher))
+		.secrets(projectSecretInfo$$),
+)
+const identityProvidersFetcher = query$.identityProviders(identityProvider$.slug.type.disabledAt)
+const addIdpFetcher = mutation$.addIDP(addIDPResponse$$.error(addIDPError$$))
+const updateIdpFetcher = mutation$.updateIDP(updateIDPResponse$$.error(updateIDPError$$))
+const enableIdpFetcher = mutation$.enableIDP(enableIDPResponse$$.error(enableIDPError$$))
+const disableIdpFetcher = mutation$.disableIDP(disableIDPResponse$$.error(disableIDPError$$))
+const meFetcher = query$.me(
+	identity$$
+		.permissions(identityGlobalPermissions$$)
+		.projects(identityProjectRelation$.project(project$.slug.name).memberships(membership$$)),
+)
+
+const toRateLimitWindow = (it: { limit: number; window: string }): TenantRateLimitWindowState => ({ limit: it.limit, window: it.window })
+
+/** Projects, project secrets, global tenant configuration, identity providers and `me`. */
+export class TenantProjectClient {
+	constructor(
+		private readonly transport: TenantApiTransport,
+	) {
+	}
+
+	public async listProjects(): Promise<TenantProjectSummary[]> {
+		const result = await this.transport.exec(projectsFetcher, {})
+		return result.projects.map(it => ({ id: it.id, name: it.name, slug: it.slug }))
+	}
+
+	/** Null both when the project does not exist and when the caller may not see it — the API does not distinguish. */
+	public async getProjectBySlug(slug: string): Promise<TenantProjectDetail | null> {
+		const result = await this.transport.exec(projectBySlugFetcher, { slug })
+		const project = result.projectBySlug
+		if (!project) {
+			return null
+		}
+		return {
+			id: project.id,
+			name: project.name,
+			slug: project.slug,
+			config: project.config,
+			roles: project.roles.map(role => ({
+				name: role.name,
+				variables: role.variables.map(it => it.name),
+				variableDefinitions: role.variables.map(toRoleVariableDefinition),
+			})),
+			secrets: project.secrets.map(it => ({ key: it.key, createdAt: it.createdAt, updatedAt: it.updatedAt })),
+		}
+	}
+
+	/** Returns `null` (nothing created) when `ignoreExisting` swallowed an `ALREADY_EXISTS`. */
+	public async createProject(slug: string, ignoreExisting = false, details?: TenantCreateProjectDetails): Promise<TenantCreateProjectResult | null> {
+		const result = await this.transport.exec(createProjectFetcher, {
+			projectSlug: slug,
+			name: details?.name,
+			config: details?.config,
+			options: details?.noDeployToken ? { noDeployToken: true } : undefined,
+		})
+		if (ignoreExisting && result.createProject?.error?.code === 'ALREADY_EXISTS') {
+			return null
+		}
+		this.transport.assertOk(result.createProject, `createProject(${slug})`)
+		const deployerApiKey = result.createProject?.result?.deployerApiKey
+		return { deployerApiKey: deployerApiKey ? { id: deployerApiKey.id, token: deployerApiKey.token ?? null } : null }
+	}
+
+	public async updateProject(slug: string, changes: TenantUpdateProjectChanges): Promise<void> {
+		const result = await this.transport.exec(updateProjectFetcher, {
+			projectSlug: slug,
+			name: changes.name,
+			config: changes.config,
+			mergeConfig: changes.mergeConfig,
+		})
+		this.transport.assertOk(result.updateProject, `updateProject(${slug})`)
+	}
+
+	public async setProjectSecret(slug: string, key: string, value: string): Promise<void> {
+		const result = await this.transport.exec(setProjectSecretFetcher, { projectSlug: slug, key, value })
+		this.transport.assertOk(result.setProjectSecret, `setProjectSecret(${slug}/${key})`)
+	}
+
+	public async configure(config: TenantGlobalConfig): Promise<void> {
+		const result = await this.transport.exec(configureFetcher, { config })
+		this.transport.assertOk(result.configure, 'configure')
+	}
+
+	public async configuration(): Promise<TenantConfigState> {
+		const result = await this.transport.exec(configurationFetcher, {})
+		const config = result.configuration
+		return {
+			signup: { requireEmailVerification: config.signup.requireEmailVerification },
+			emailChange: { requireVerification: config.emailChange.requireVerification },
+			passwordless: {
+				enabled: config.passwordless.enabled,
+				url: config.passwordless.url ?? null,
+				expiration: config.passwordless.expiration,
+			},
+			password: {
+				minLength: config.password.minLength,
+				requireUppercase: config.password.requireUppercase,
+				requireLowercase: config.password.requireLowercase,
+				requireDigit: config.password.requireDigit,
+				requireSpecial: config.password.requireSpecial,
+				pattern: config.password.pattern ?? null,
+				checkBlacklist: config.password.checkBlacklist,
+				checkHibp: config.password.checkHibp,
+			},
+			login: {
+				baseBackoff: config.login.baseBackoff,
+				maxBackoff: config.login.maxBackoff,
+				attemptWindow: config.login.attemptWindow,
+				revealUserExists: config.login.revealUserExists,
+				revealLoginMethod: config.login.revealLoginMethod,
+				defaultTokenExpiration: config.login.defaultTokenExpiration,
+				maxTokenExpiration: config.login.maxTokenExpiration ?? null,
+				mfaGraceDuration: config.login.mfaGraceDuration,
+				anomalyDetection: {
+					enabled: config.login.anomalyDetection.enabled,
+					historySize: config.login.anomalyDetection.historySize,
+					emailThreshold: config.login.anomalyDetection.emailThreshold,
+					stepUpThreshold: config.login.anomalyDetection.stepUpThreshold,
+				},
+			},
+			captcha: {
+				provider: config.captcha.provider ?? null,
+				threshold: config.captcha.threshold ?? null,
+				protect: {
+					signUp: config.captcha.protect.signUp,
+					passwordReset: config.captcha.protect.passwordReset,
+					passwordlessInit: config.captcha.protect.passwordlessInit,
+					emailVerification: config.captcha.protect.emailVerification,
+				},
+			},
+			rateLimits: {
+				signUpPerIp: toRateLimitWindow(config.rateLimits.signUpPerIp),
+				loginPerIp: toRateLimitWindow(config.rateLimits.loginPerIp),
+				passwordResetPerIp: toRateLimitWindow(config.rateLimits.passwordResetPerIp),
+				passwordlessInitPerIp: toRateLimitWindow(config.rateLimits.passwordlessInitPerIp),
+				emailOtpPerPerson: toRateLimitWindow(config.rateLimits.emailOtpPerPerson),
+				emailVerificationPerIp: toRateLimitWindow(config.rateLimits.emailVerificationPerIp),
+			},
+		}
+	}
+
+	public async listIdentityProviders(): Promise<RemoteIdentityProvider[]> {
+		const result = await this.transport.exec(identityProvidersFetcher, {})
+		return result.identityProviders.map(it => ({
+			slug: it.slug,
+			type: it.type,
+			disabledAt: it.disabledAt ?? null,
+		}))
+	}
+
+	public async addIdp(slug: string, type: string, configuration: unknown, options?: TenantIdpOptions): Promise<void> {
+		const result = await this.transport.exec(addIdpFetcher, { identityProvider: slug, type, configuration, options })
+		this.transport.assertOk(result.addIDP, `addIDP(${slug})`)
+	}
+
+	public async updateIdp(slug: string, type: string, configuration: unknown, options?: TenantIdpOptions): Promise<void> {
+		const result = await this.transport.exec(updateIdpFetcher, {
+			identityProvider: slug,
+			type,
+			configuration,
+			options,
+			mergeConfiguration: false,
+		})
+		this.transport.assertOk(result.updateIDP, `updateIDP(${slug})`)
+	}
+
+	public async enableIdp(slug: string): Promise<void> {
+		const result = await this.transport.exec(enableIdpFetcher, { identityProvider: slug })
+		this.transport.assertOk(result.enableIDP, `enableIDP(${slug})`)
+	}
+
+	public async disableIdp(slug: string): Promise<void> {
+		const result = await this.transport.exec(disableIdpFetcher, { identityProvider: slug })
+		this.transport.assertOk(result.disableIDP, `disableIDP(${slug})`)
+	}
+
+	public async whoAmI(): Promise<TenantWhoAmI> {
+		const result = await this.transport.exec(meFetcher, {})
+		const me = result.me
+		return {
+			id: me.id,
+			description: me.description ?? null,
+			roles: me.roles ? [...me.roles] : [],
+			permissions: me.permissions
+				? { canCreateProject: me.permissions.canCreateProject, canDeployEntrypoint: me.permissions.canDeployEntrypoint }
+				: null,
+			projects: me.projects.map(it => ({
+				slug: it.project.slug,
+				name: it.project.name,
+				roles: it.memberships.map(m => m.role),
+			})),
+		}
+	}
+}

package/src/lib/tenant/clients/index.ts

@@ -0,0 +1,29 @@
+import { TenantApiTransport } from '../TenantApiTransport.js'
+import { TenantApiKeyClient } from './TenantApiKeyClient.js'
+import { TenantMemberClient } from './TenantMemberClient.js'
+import { TenantPersonClient } from './TenantPersonClient.js'
+import { TenantPolicyClient } from './TenantPolicyClient.js'
+import { TenantProjectClient } from './TenantProjectClient.js'
+
+export * from './TenantApiKeyClient.js'
+export * from './TenantMemberClient.js'
+export * from './TenantPersonClient.js'
+export * from './TenantPolicyClient.js'
+export * from './TenantProjectClient.js'
+
+/** One instance of every tenant domain client, all sharing a single transport. */
+export interface TenantClients {
+	readonly project: TenantProjectClient
+	readonly person: TenantPersonClient
+	readonly member: TenantMemberClient
+	readonly apiKey: TenantApiKeyClient
+	readonly policy: TenantPolicyClient
+}
+
+export const createTenantClients = (transport: TenantApiTransport): TenantClients => ({
+	project: new TenantProjectClient(transport),
+	person: new TenantPersonClient(transport),
+	member: new TenantMemberClient(transport),
+	apiKey: new TenantApiKeyClient(transport),
+	policy: new TenantPolicyClient(transport),
+})

package/src/lib/tenant/confirmation.ts

@@ -0,0 +1,32 @@
+import { CliError, ExitCode, Output } from '@contember/cli-common'
+import { promptConfirm } from '../prompt/index.js'
+
+export interface ConfirmationArgs {
+	readonly yes: boolean
+	readonly output: Output
+	/** What is about to happen, shown above the prompt. */
+	readonly warning: string
+}
+
+/**
+ * The one destructive-action guard of the tenant commands. `--yes` skips the prompt; without a TTY there
+ * is nobody to answer it, so the run fails fast instead of hanging a CI job. Declining throws as well, so
+ * a caller never has to turn a boolean into an exit code and an agent always gets a typed error.
+ */
+export const requireConfirmation = async ({ yes, output, warning }: ConfirmationArgs): Promise<void> => {
+	if (yes) {
+		return
+	}
+	if (!output.canPrompt()) {
+		throw new CliError('TTY not available. Pass --yes to confirm execution.', {
+			code: 'TTY_UNAVAILABLE',
+			exitCode: ExitCode.InputError,
+		})
+	}
+	output.warn(warning)
+	output.info('(to skip this dialog, you can pass the --yes option)')
+	const confirmed = await promptConfirm(output, { message: 'Do you want to continue?' })
+	if (!confirmed) {
+		throw new CliError('Aborted by the user.', { code: 'ABORTED', exitCode: ExitCode.InputError })
+	}
+}

package/src/lib/tenant/input/index.ts

@@ -0,0 +1,2 @@
+export * from './pagination.js'
+export * from './value.js'