@contember/cli 2.2.0-alpha.3 → 2.2.0-alpha.5

package/src/lib/tenant/clients/TenantApiKeyClient.ts

@@ -0,0 +1,182 @@
+import {
+	apiKey$$,
+	apiKeyWithToken$$,
+	createApiKeyError$$,
+	type CreateApiKeyOptions,
+	createApiKeyResponse$$,
+	createApiKeyResult$,
+	disableApiKeyError$$,
+	disableApiKeyResponse$$,
+	identity$,
+	identityProjectRelation$,
+	membership$,
+	type MembershipInput,
+	mutation$,
+	project$,
+	query$,
+	variableEntry$$,
+} from '@contember/graphql-client-tenant'
+import { CliError, ExitCode } from '@contember/cli-common'
+import { TenantApiTransport } from '../TenantApiTransport.js'
+
+export interface TenantApiKey {
+	id: string
+	identityId: string
+	description: string | null
+	type: string | null
+	enabled: boolean | null
+	createdAt: string | null
+	lastUsedAt: string | null
+	expiresAt: string | null
+}
+
+export interface TenantGlobalApiKey extends TenantApiKey {
+	globalRoles: string[] | null
+}
+
+export interface TenantApiKeyMembership {
+	role: string
+	variables: { name: string; values: string[] }[]
+}
+
+export interface TenantProjectApiKey extends TenantApiKey {
+	memberships: TenantApiKeyMembership[]
+}
+
+export interface TenantApiKeyWithToken {
+	id: string
+	/** Null when the key was provisioned from a caller-supplied `tokenHash` — the server never had a plaintext to return. */
+	token: string | null
+}
+
+export interface CreateApiKeyArgs {
+	projectSlug: string
+	memberships: MembershipInput[]
+	description: string
+	tokenHash?: string
+	options?: CreateApiKeyOptions
+}
+
+export interface CreateGlobalApiKeyArgs {
+	description: string
+	roles?: string[]
+	tokenHash?: string
+	options?: CreateApiKeyOptions
+}
+
+// Fetchers are immutable and reusable, so they are built once at module load.
+const globalApiKeysFetcher = query$.globalApiKeys(apiKey$$.identity(identity$.id.roles))
+const projectApiKeysFetcher = query$.projectBySlug(
+	project$.apiKeys(
+		apiKey$$.identity(
+			identity$.id.projects(
+				identityProjectRelation$.project(project$.slug).memberships(membership$.role.variables(variableEntry$$)),
+			),
+		),
+	),
+)
+const createApiKeyFetcher = mutation$.createApiKey(
+	createApiKeyResponse$$.error(createApiKeyError$$).result(createApiKeyResult$.apiKey(apiKeyWithToken$$)),
+)
+const createGlobalApiKeyFetcher = mutation$.createGlobalApiKey(
+	createApiKeyResponse$$.error(createApiKeyError$$).result(createApiKeyResult$.apiKey(apiKeyWithToken$$)),
+)
+const disableApiKeyFetcher = mutation$.disableApiKey(disableApiKeyResponse$$.error(disableApiKeyError$$))
+
+/** API keys — global permanent keys and per-project ones. */
+export class TenantApiKeyClient {
+	constructor(
+		private readonly transport: TenantApiTransport,
+	) {
+	}
+
+	public async listGlobalApiKeys(): Promise<TenantGlobalApiKey[]> {
+		const result = await this.transport.exec(globalApiKeysFetcher, {})
+		return result.globalApiKeys.map(it => ({
+			...toApiKey(it),
+			globalRoles: it.identity.roles ? [...it.identity.roles] : null,
+		}))
+	}
+
+	public async listProjectApiKeys(projectSlug: string): Promise<TenantProjectApiKey[]> {
+		const result = await this.transport.exec(projectApiKeysFetcher, { slug: projectSlug })
+		const project = result.projectBySlug
+		if (!project) {
+			throw new CliError(`Project ${projectSlug} was not found or is not visible to this token.`, {
+				code: 'PROJECT_NOT_FOUND',
+				exitCode: ExitCode.NotFound,
+				details: { projectSlug },
+			})
+		}
+		return project.apiKeys.map(it => ({
+			...toApiKey(it),
+			memberships: it.identity.projects.find(relation => relation.project.slug === projectSlug)?.memberships.map(membership => ({
+				role: membership.role,
+				variables: membership.variables.map(variable => ({ name: variable.name, values: [...variable.values] })),
+			})) ?? [],
+		}))
+	}
+
+	/** Project-scoped key. The token in the result is shown exactly once — the server does not store or re-expose it. */
+	public async createApiKey(args: CreateApiKeyArgs): Promise<TenantApiKeyWithToken> {
+		const operation = `createApiKey(${args.projectSlug})`
+		const result = await this.transport.exec(createApiKeyFetcher, {
+			projectSlug: args.projectSlug,
+			memberships: args.memberships,
+			description: args.description,
+			tokenHash: args.tokenHash,
+			options: args.options,
+		})
+		this.transport.assertOk(result.createApiKey, operation)
+		return toApiKeyWithToken(result.createApiKey?.result?.apiKey, operation)
+	}
+
+	/** Global key, tied to no project. The token in the result is shown exactly once. */
+	public async createGlobalApiKey(args: CreateGlobalApiKeyArgs): Promise<TenantApiKeyWithToken> {
+		const operation = `createGlobalApiKey(${args.description})`
+		const result = await this.transport.exec(createGlobalApiKeyFetcher, {
+			description: args.description,
+			roles: args.roles,
+			tokenHash: args.tokenHash,
+			options: args.options,
+		})
+		this.transport.assertOk(result.createGlobalApiKey, operation)
+		return toApiKeyWithToken(result.createGlobalApiKey?.result?.apiKey, operation)
+	}
+
+	public async disableApiKey(id: string): Promise<void> {
+		const result = await this.transport.exec(disableApiKeyFetcher, { id })
+		this.transport.assertOk(result.disableApiKey, `disableApiKey(${id})`)
+	}
+}
+
+const toApiKey = (it: {
+	readonly id: string
+	readonly identity: { readonly id: string }
+	readonly description?: string
+	readonly type?: string
+	readonly enabled?: boolean
+	readonly createdAt?: string
+	readonly lastUsedAt?: string
+	readonly expiresAt?: string
+}): TenantApiKey => ({
+	id: it.id,
+	identityId: it.identity.id,
+	description: it.description ?? null,
+	type: it.type ?? null,
+	enabled: it.enabled ?? null,
+	createdAt: it.createdAt ?? null,
+	lastUsedAt: it.lastUsedAt ?? null,
+	expiresAt: it.expiresAt ?? null,
+})
+
+/** `assertOk` only proves `ok`/`error` are consistent — `result` is still typed optional, so this guards the actual payload. */
+const toApiKeyWithToken = (apiKey: { id: string; token?: string } | undefined, operation: string): TenantApiKeyWithToken => {
+	if (!apiKey) {
+		throw new CliError(`${operation} reported success but returned no api key`, {
+			code: 'TENANT_API_INVALID_RESPONSE',
+			exitCode: ExitCode.InternalError,
+		})
+	}
+	return { id: apiKey.id, token: apiKey.token ?? null }
+}

package/src/lib/tenant/clients/TenantMemberClient.ts

@@ -0,0 +1,199 @@
+import { CliError, ExitCode } from '@contember/cli-common'
+import {
+	addProjectMemberError$$,
+	addProjectMemberResponse$$,
+	identity$,
+	inviteError$$,
+	type InviteOptions,
+	inviteResponse$$,
+	inviteResult$,
+	membership$,
+	type MembershipInput,
+	mutation$,
+	person$,
+	project$,
+	projectIdentityRelation$,
+	type ProjectMembersFilter,
+	query$,
+	removeProjectMemberError$$,
+	removeProjectMemberResponse$$,
+	type UnmanagedInviteOptions,
+	updateProjectMemberError$$,
+	updateProjectMemberResponse$$,
+	variableEntry$$,
+} from '@contember/graphql-client-tenant'
+import { TenantApiTransport } from '../TenantApiTransport.js'
+
+export interface TenantMembershipVariable {
+	name: string
+	values: string[]
+}
+
+export interface TenantMembership {
+	role: string
+	variables: TenantMembershipVariable[]
+}
+
+/** One member of a project — the identity, the person behind it when there is one, and its memberships. */
+export interface TenantProjectMember {
+	identityId: string
+	/** Null for an API key member — those have no person. */
+	personId: string | null
+	email: string | null
+	name: string | null
+	/** Identity label, the only human-readable name an API key member has. */
+	description: string | null
+	memberships: TenantMembership[]
+}
+
+export interface ListProjectMembersArgs {
+	filter?: ProjectMembersFilter
+	limit?: number
+	offset?: number
+}
+
+export interface InviteArgs {
+	projectSlug: string
+	email: string
+	name?: string
+	memberships: readonly MembershipInput[]
+	options?: InviteOptions
+}
+
+export interface UnmanagedInviteArgs {
+	projectSlug: string
+	email: string
+	memberships: readonly MembershipInput[]
+	options?: UnmanagedInviteOptions
+}
+
+export interface TenantInviteResult {
+	personId: string
+	identityId: string
+	email: string | null
+	name: string | null
+	/** False when the person already existed and was only added to the project. */
+	isNew: boolean
+}
+
+/** The part of an `InviteResponse` selection this client reads — shared by `invite` and `unmanagedInvite`. */
+interface InviteResponsePayload {
+	readonly ok: boolean
+	readonly error?: { readonly code: string; readonly developerMessage: string } | null
+	readonly result?: {
+		readonly isNew: boolean
+		readonly person: {
+			readonly id: string
+			readonly email?: string
+			readonly name?: string
+			readonly identity: { readonly id: string }
+		}
+	} | null
+}
+
+// Fetchers are immutable and reusable, so they are built once at module load.
+const membershipFetcher = membership$.role.variables(variableEntry$$)
+const projectMembershipsFetcher = query$.projectMemberships(membershipFetcher)
+const projectMembersFetcher = query$.projectBySlug(
+	project$.members(
+		projectIdentityRelation$
+			.identity(identity$.id.description.person(person$.id.email.name))
+			.memberships(membershipFetcher),
+	),
+)
+const inviteResultFetcher = inviteResult$.isNew.person(person$.id.email.name.identity(identity$.id))
+const inviteFetcher = mutation$.invite(inviteResponse$$.error(inviteError$$).result(inviteResultFetcher))
+const unmanagedInviteFetcher = mutation$.unmanagedInvite(inviteResponse$$.error(inviteError$$).result(inviteResultFetcher))
+const addProjectMemberFetcher = mutation$.addProjectMember(addProjectMemberResponse$$.error(addProjectMemberError$$))
+const updateProjectMemberFetcher = mutation$.updateProjectMember(updateProjectMemberResponse$$.error(updateProjectMemberError$$))
+const removeProjectMemberFetcher = mutation$.removeProjectMember(removeProjectMemberResponse$$.error(removeProjectMemberError$$))
+
+/** Project memberships and invites. */
+export class TenantMemberClient {
+	constructor(
+		private readonly transport: TenantApiTransport,
+	) {
+	}
+
+	public async listProjectMemberships(projectSlug: string, identityId: string): Promise<TenantMembership[]> {
+		const result = await this.transport.exec(projectMembershipsFetcher, { projectSlug, identityId })
+		return result.projectMemberships.map(toMembership)
+	}
+
+	/**
+	 * Lists every member of a project. The tenant API answers with an empty list — not an error — when the
+	 * caller lacks the `project.view members` permission, so an empty result is not proof the project is empty.
+	 */
+	public async listProjectMembers(projectSlug: string, { filter, limit, offset }: ListProjectMembersArgs = {}): Promise<TenantProjectMember[]> {
+		const result = await this.transport.exec(projectMembersFetcher, { slug: projectSlug, input: { filter, limit, offset } })
+		const project = result.projectBySlug
+		if (!project) {
+			throw new CliError(`Project ${projectSlug} was not found or is not visible to this token.`, {
+				code: 'PROJECT_NOT_FOUND',
+				exitCode: ExitCode.NotFound,
+				details: { projectSlug },
+			})
+		}
+		return project.members.map(member => ({
+			identityId: member.identity.id,
+			personId: member.identity.person?.id ?? null,
+			email: member.identity.person?.email ?? null,
+			name: member.identity.person?.name ?? null,
+			description: member.identity.description ?? null,
+			memberships: member.memberships.map(toMembership),
+		}))
+	}
+
+	/** Invites a person, letting the tenant deliver the credentials by mail. */
+	public async invite({ projectSlug, email, name, memberships, options }: InviteArgs): Promise<TenantInviteResult> {
+		const result = await this.transport.exec(inviteFetcher, { projectSlug, email, name, memberships, options })
+		return this.toInviteResult(result.invite, `invite(${email})`)
+	}
+
+	/** Invites a person without any mail — the caller supplies the password or the reset token hash. */
+	public async unmanagedInvite({ projectSlug, email, memberships, options }: UnmanagedInviteArgs): Promise<TenantInviteResult> {
+		const result = await this.transport.exec(unmanagedInviteFetcher, { projectSlug, email, memberships, options })
+		return this.toInviteResult(result.unmanagedInvite, `unmanagedInvite(${email})`)
+	}
+
+	public async addProjectMember(projectSlug: string, identityId: string, memberships: readonly MembershipInput[]): Promise<void> {
+		const result = await this.transport.exec(addProjectMemberFetcher, { projectSlug, identityId, memberships })
+		this.transport.assertOk(result.addProjectMember, `addProjectMember(${identityId})`)
+	}
+
+	/** Replaces all memberships of an existing member — anything not passed is removed. */
+	public async updateProjectMember(projectSlug: string, identityId: string, memberships: readonly MembershipInput[]): Promise<void> {
+		const result = await this.transport.exec(updateProjectMemberFetcher, { projectSlug, identityId, memberships })
+		this.transport.assertOk(result.updateProjectMember, `updateProjectMember(${identityId})`)
+	}
+
+	public async removeProjectMember(projectSlug: string, identityId: string): Promise<void> {
+		const result = await this.transport.exec(removeProjectMemberFetcher, { projectSlug, identityId })
+		this.transport.assertOk(result.removeProjectMember, `removeProjectMember(${identityId})`)
+	}
+
+	private toInviteResult(response: InviteResponsePayload | undefined, operation: string): TenantInviteResult {
+		this.transport.assertOk(response, operation)
+		const result = response?.result
+		if (!result) {
+			// assertOk throws on every failure, so an ok payload without a result is a broken response, not a user error
+			throw new CliError(`${operation} reported success but returned no result.`, {
+				code: 'TENANT_API_INVALID_RESPONSE',
+				exitCode: ExitCode.InternalError,
+				details: { operation },
+			})
+		}
+		return {
+			personId: result.person.id,
+			identityId: result.person.identity.id,
+			email: result.person.email ?? null,
+			name: result.person.name ?? null,
+			isNew: result.isNew,
+		}
+	}
+}
+
+const toMembership = (membership: { role: string; variables: readonly { name: string; values: readonly string[] }[] }): TenantMembership => ({
+	role: membership.role,
+	variables: membership.variables.map(variable => ({ name: variable.name, values: [...variable.values] })),
+})

package/src/lib/tenant/clients/TenantPersonClient.ts

@@ -0,0 +1,306 @@
+import { CliError, ExitCode } from '@contember/cli-common'
+import {
+	addGlobalIdentityRolesError$$,
+	addGlobalIdentityRolesResponse$$,
+	addGlobalIdentityRolesResult$,
+	changePasswordError$$,
+	changePasswordResponse$$,
+	changeProfileError$$,
+	changeProfileResponse$$,
+	createPasswordResetRequestError$$,
+	createPasswordResetRequestResponse$$,
+	type CreateResetPasswordRequestOptions,
+	createSessionTokenError$$,
+	createSessionTokenResponse$$,
+	createSessionTokenResult$,
+	disablePersonError$$,
+	disablePersonResponse$$,
+	forceSignOutPersonError$$,
+	forceSignOutPersonResponse$$,
+	identity$,
+	identityProviderListItem$$,
+	mutation$,
+	person$$,
+	personIdentityProvider$,
+	type PersonsFilter,
+	query$,
+	removeGlobalIdentityRolesError$$,
+	removeGlobalIdentityRolesResponse$$,
+	removeGlobalIdentityRolesResult$,
+	resetPersonMfaError$$,
+	resetPersonMfaResponse$$,
+	sessionInfo$$,
+	type SignInOptions,
+	signUpError$$,
+	signUpResponse$$,
+	signUpResult$,
+} from '@contember/graphql-client-tenant'
+import { TenantApiTransport } from '../TenantApiTransport.js'
+
+export interface TenantPerson {
+	id: string
+	identityId: string
+	email: string | null
+	name: string | null
+	otpEnabled: boolean
+	emailOtpEnabled: boolean
+	emailVerified: boolean
+}
+
+export interface TenantPersonSession {
+	id: string
+	createdAt: string
+	expiresAt: string | null
+	lastUsedAt: string | null
+	lastIp: string | null
+	lastUserAgent: string | null
+	createdIp: string | null
+	createdUserAgent: string | null
+	isCurrent: boolean
+	trustForwardedClientInfo: boolean
+}
+
+export interface TenantPersonIdentityProvider {
+	id: string
+	slug: string
+	type: string
+	externalIdentifier: string
+	createdAt: string
+}
+
+/**
+ * Everything `personById` exposes about a single person. `roles` is null when the caller may not read
+ * them, and `sessions` / `identityProviders` come back empty (never an error) for the same reason.
+ */
+export interface TenantPersonDetail extends TenantPerson {
+	passwordlessEnabled: boolean | null
+	roles: string[] | null
+	sessions: TenantPersonSession[]
+	identityProviders: TenantPersonIdentityProvider[]
+}
+
+export interface ListPersonsArgs {
+	filter?: PersonsFilter
+	limit?: number
+	offset?: number
+}
+
+export interface SignUpPersonArgs {
+	email: string
+	/** Plaintext password. Mutually exclusive with {@link passwordHash}; omit both to create a person without one. */
+	password?: string
+	/** Pre-computed bcrypt hash — the tenant API accepts `$2b$` only. */
+	passwordHash?: string
+	name?: string
+	roles?: readonly string[]
+	captchaToken?: string
+}
+
+export interface CreateSessionTokenArgs {
+	email?: string
+	personId?: string
+	expiration?: number
+	options?: SignInOptions
+}
+
+export interface TenantCreatedSessionToken {
+	token: string
+	personId: string
+	identityId: string
+	email: string | null
+	name: string | null
+}
+
+export interface ChangeProfileArgs {
+	email?: string
+	name?: string
+}
+
+/** The subset of a `person$$` selection the CLI maps — an actual row carries more, which is fine. */
+interface PersonRow {
+	readonly id: string
+	readonly email?: string
+	readonly name?: string
+	readonly otpEnabled: boolean
+	readonly emailOtpEnabled: boolean
+	readonly emailVerified: boolean
+	readonly identity: { readonly id: string }
+}
+
+// Fetchers are immutable and reusable, so they are built once at module load.
+const personsFetcher = query$.persons(person$$.identity(identity$.id))
+const personByIdFetcher = query$.personById(
+	person$$
+		.identity(identity$.id.roles.sessions(sessionInfo$$))
+		.identityProviders(personIdentityProvider$.id.createdAt.externalIdentifier.identityProvider(identityProviderListItem$$)),
+)
+const signUpFetcher = mutation$.signUp(
+	signUpResponse$$.error(signUpError$$.weakPasswordReasons.recommendedAction).result(signUpResult$.person(person$$.identity(identity$.id))),
+)
+const changeProfileFetcher = mutation$.changeProfile(changeProfileResponse$$.error(changeProfileError$$))
+const changePasswordFetcher = mutation$.changePassword(changePasswordResponse$$.error(changePasswordError$$.weakPasswordReasons))
+const disablePersonFetcher = mutation$.disablePerson(disablePersonResponse$$.error(disablePersonError$$))
+const forceSignOutPersonFetcher = mutation$.forceSignOutPerson(forceSignOutPersonResponse$$.error(forceSignOutPersonError$$))
+const resetPersonMfaFetcher = mutation$.resetPersonMfa(resetPersonMfaResponse$$.error(resetPersonMfaError$$))
+const createResetPasswordRequestFetcher = mutation$.createResetPasswordRequest(
+	createPasswordResetRequestResponse$$.error(createPasswordResetRequestError$$),
+)
+const createSessionTokenFetcher = mutation$.createSessionToken(
+	createSessionTokenResponse$$
+		.error(createSessionTokenError$$)
+		.result(createSessionTokenResult$.token.person(person$$.id.email.name.identity(identity$.id))),
+)
+const addGlobalIdentityRolesFetcher = mutation$.addGlobalIdentityRoles(
+	addGlobalIdentityRolesResponse$$.error(addGlobalIdentityRolesError$$).result(addGlobalIdentityRolesResult$.identity(identity$.id.roles)),
+)
+const removeGlobalIdentityRolesFetcher = mutation$.removeGlobalIdentityRoles(
+	removeGlobalIdentityRolesResponse$$.error(removeGlobalIdentityRolesError$$).result(
+		removeGlobalIdentityRolesResult$.identity(identity$.id.roles),
+	),
+)
+
+const toTenantPerson = (person: PersonRow): TenantPerson => ({
+	id: person.id,
+	identityId: person.identity.id,
+	email: person.email ?? null,
+	name: person.name ?? null,
+	otpEnabled: person.otpEnabled,
+	emailOtpEnabled: person.emailOtpEnabled,
+	emailVerified: person.emailVerified,
+})
+
+/** Persons, their global identity roles and their sessions. */
+export class TenantPersonClient {
+	constructor(
+		private readonly transport: TenantApiTransport,
+	) {
+	}
+
+	public async listPersons({ filter, limit, offset }: ListPersonsArgs = {}): Promise<TenantPerson[]> {
+		const result = await this.transport.exec(personsFetcher, { filter, limit, offset })
+		return result.persons.map(it => ({
+			id: it.id,
+			identityId: it.identity.id,
+			email: it.email ?? null,
+			name: it.name ?? null,
+			otpEnabled: it.otpEnabled,
+			emailOtpEnabled: it.emailOtpEnabled,
+			emailVerified: it.emailVerified,
+		}))
+	}
+
+	/** Null both when the person does not exist and when the caller may not see them — the API does not distinguish. */
+	public async getPerson(id: string): Promise<TenantPersonDetail | null> {
+		const result = await this.transport.exec(personByIdFetcher, { id })
+		const person = result.personById
+		if (!person) {
+			return null
+		}
+		return {
+			...toTenantPerson(person),
+			passwordlessEnabled: person.passwordlessEnabled ?? null,
+			roles: person.identity.roles ? [...person.identity.roles] : null,
+			sessions: person.identity.sessions.map(it => ({
+				id: it.id,
+				createdAt: it.createdAt,
+				expiresAt: it.expiresAt ?? null,
+				lastUsedAt: it.lastUsedAt ?? null,
+				lastIp: it.lastIp ?? null,
+				lastUserAgent: it.lastUserAgent ?? null,
+				createdIp: it.createdIp ?? null,
+				createdUserAgent: it.createdUserAgent ?? null,
+				isCurrent: it.isCurrent,
+				trustForwardedClientInfo: it.trustForwardedClientInfo,
+			})),
+			identityProviders: person.identityProviders.map(it => ({
+				id: it.id,
+				slug: it.identityProvider.slug,
+				type: it.identityProvider.type,
+				externalIdentifier: it.externalIdentifier,
+				createdAt: it.createdAt,
+			})),
+		}
+	}
+
+	/**
+	 * Creates a person through `signUp`. Needs the `PERSON_SIGN_UP` permission, consumes the tenant's
+	 * per-IP sign-up rate limit and triggers the verification mail when the tenant requires it.
+	 */
+	public async signUp({ email, password, passwordHash, name, roles, captchaToken }: SignUpPersonArgs): Promise<TenantPerson> {
+		const result = await this.transport.exec(signUpFetcher, { email, password, passwordHash, name, roles, captchaToken })
+		this.transport.assertOk(result.signUp, `signUp(${email})`)
+		const person = result.signUp?.result?.person
+		if (!person) {
+			throw new CliError(`signUp(${email}) reported success but returned no person`, {
+				code: 'TENANT_API_INVALID_RESPONSE',
+				exitCode: ExitCode.InternalError,
+			})
+		}
+		return toTenantPerson(person)
+	}
+
+	public async changeProfile(personId: string, { email, name }: ChangeProfileArgs): Promise<void> {
+		const result = await this.transport.exec(changeProfileFetcher, { personId, email, name })
+		this.transport.assertOk(result.changeProfile, `changeProfile(${personId})`)
+	}
+
+	public async changePassword(personId: string, password: string): Promise<void> {
+		const result = await this.transport.exec(changePasswordFetcher, { personId, password })
+		this.transport.assertOk(result.changePassword, `changePassword(${personId})`)
+	}
+
+	public async disablePerson(personId: string): Promise<void> {
+		const result = await this.transport.exec(disablePersonFetcher, { personId })
+		this.transport.assertOk(result.disablePerson, `disablePerson(${personId})`)
+	}
+
+	public async forceSignOutPerson(personId: string, reason?: string): Promise<void> {
+		const result = await this.transport.exec(forceSignOutPersonFetcher, { personId, reason })
+		this.transport.assertOk(result.forceSignOutPerson, `forceSignOutPerson(${personId})`)
+	}
+
+	public async resetPersonMfa(personId: string): Promise<void> {
+		const result = await this.transport.exec(resetPersonMfaFetcher, { personId })
+		this.transport.assertOk(result.resetPersonMfa, `resetPersonMfa(${personId})`)
+	}
+
+	public async createResetPasswordRequest(email: string, options?: CreateResetPasswordRequestOptions, captchaToken?: string): Promise<void> {
+		const result = await this.transport.exec(createResetPasswordRequestFetcher, { email, options, captchaToken })
+		this.transport.assertOk(result.createResetPasswordRequest, `createResetPasswordRequest(${email})`)
+	}
+
+	public async createSessionToken({ email, personId, expiration, options }: CreateSessionTokenArgs): Promise<TenantCreatedSessionToken> {
+		const result = await this.transport.exec(createSessionTokenFetcher, { email, personId, expiration, options })
+		this.transport.assertOk(result.createSessionToken, 'createSessionToken')
+		const tokenResult = result.createSessionToken?.result
+		if (!tokenResult) {
+			throw new CliError('createSessionToken reported success but returned no token.', {
+				code: 'TENANT_API_INVALID_RESPONSE',
+				exitCode: ExitCode.InternalError,
+			})
+		}
+		return {
+			token: tokenResult.token,
+			personId: tokenResult.person.id,
+			identityId: tokenResult.person.identity.id,
+			email: tokenResult.person.email ?? null,
+			name: tokenResult.person.name ?? null,
+		}
+	}
+
+	/** Returns the identity's roles after the change, or null when the caller may not read them. */
+	public async addGlobalIdentityRoles(identityId: string, roles: readonly string[]): Promise<string[] | null> {
+		const result = await this.transport.exec(addGlobalIdentityRolesFetcher, { identityId, roles })
+		this.transport.assertOk(result.addGlobalIdentityRoles, `addGlobalIdentityRoles(${identityId})`)
+		const resultRoles = result.addGlobalIdentityRoles?.result?.identity.roles
+		return resultRoles ? [...resultRoles] : null
+	}
+
+	/** Returns the identity's roles after the change, or null when the caller may not read them. */
+	public async removeGlobalIdentityRoles(identityId: string, roles: readonly string[]): Promise<string[] | null> {
+		const result = await this.transport.exec(removeGlobalIdentityRolesFetcher, { identityId, roles })
+		this.transport.assertOk(result.removeGlobalIdentityRoles, `removeGlobalIdentityRoles(${identityId})`)
+		const resultRoles = result.removeGlobalIdentityRoles?.result?.identity.roles
+		return resultRoles ? [...resultRoles] : null
+	}
+}