@contrail/cli 3.5.4-alpha.f60c4df → 3.5.5-alpha.177136f

package/dist/commands/feature-flags/import.js

@@ -0,0 +1,191 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.uploadFeatureFlags = exports.uploadFeatureFlagsIfPermitted = exports.assertCanManageFeatureFlags = exports.REQUIRED_PLATFORM_ROLES = void 0;
+const tslib_1 = require("tslib");
+const path = tslib_1.__importStar(require("path"));
+const chalk_1 = tslib_1.__importDefault(require("chalk"));
+const fs_1 = tslib_1.__importDefault(require("fs"));
+const login_1 = require("../../auth/login");
+const core_1 = require("@oclif/core");
+const file_helpers_1 = require("../../helpers/file-helpers");
+const error_helpers_1 = require("../../helpers/error-helpers");
+const feature_flags_1 = require("../../api/feature-flags");
+const users_1 = require("../../api/users");
+const export_1 = require("./export");
+const basecommand_1 = require("../../basecommand");
+const logger_1 = tslib_1.__importDefault(require("../../logger"));
+exports.REQUIRED_PLATFORM_ROLES = ['PLATFORM_ADMIN', 'PLATFORM_MANAGER'];
+class ImportFeatureFlags extends basecommand_1.BaseCommand {
+    static description = 'Upload an extracted set of feature flags';
+    static examples = [
+        `$ contrail feature-flags import
+`,
+    ];
+    static flags = {
+        ...basecommand_1.BaseCommand.baseFlags,
+        dir: core_1.Flags.string({
+            char: 'd',
+            description: `The directory from which to import the feature flags. Defaults to the current directory. The feature flags will be loaded from $dir/${export_1.FEATURE_FLAGS_FILE}`,
+            required: false,
+            default: '.',
+        }),
+    };
+    async run() {
+        try {
+            await (0, login_1.authUser)();
+            await assertCanManageFeatureFlags();
+            this.log(`${chalk_1.default.blue.bold('START')} Uploading Feature Flags.`);
+            this.log(`${chalk_1.default.yellow.bold('FEATURE FLAGS')} Uploading`);
+            await uploadFeatureFlags(this.flags.dir);
+            this.log(`${chalk_1.default.yellow.bold('FEATURE FLAGS')} Uploaded`);
+        }
+        catch (e) {
+            this.log(`${chalk_1.default.red.bold('FAIL')} Feature Flags Upload Failed. ${(0, error_helpers_1.describeError)(e)}`);
+            process.exitCode = 1;
+            return;
+        }
+        this.log(`${chalk_1.default.green.bold('COMPLETE')} Feature Flags Upload Complete.`);
+    }
+}
+exports.default = ImportFeatureFlags;
+async function getPlatformRoles() {
+    try {
+        const currentUser = await (0, users_1.getCurrentUserWithPlatformRoles)();
+        return normalizePlatformRoles(currentUser?.platformRoles);
+    }
+    catch (e) {
+        throw new Error(`Could not read your platform roles. ${(0, error_helpers_1.describeError)(e)}`);
+    }
+}
+/**
+ * The feature flags API only lets a platform admin/manager create or delete flags, and a
+ * missing role surfaces as a generic 403 partway through the run. Checking up front stops
+ * the command before it half-applies the file.
+ */
+async function assertCanManageFeatureFlags() {
+    const platformRoles = await getPlatformRoles();
+    if (!platformRoles.some((role) => exports.REQUIRED_PLATFORM_ROLES.includes(role))) {
+        throw new Error(`Importing feature flags requires the ${exports.REQUIRED_PLATFORM_ROLES.join(' or ')} platform role. ` +
+            `Your roles: ${platformRoles.length ? platformRoles.join(', ') : 'none'}.`);
+    }
+}
+exports.assertCanManageFeatureFlags = assertCanManageFeatureFlags;
+/**
+ * The `instance import` variant: feature flags are one step of a much larger config copy that
+ * org admins without a platform role are expected to run, so a missing role (or roles we could
+ * not read) logs and skips instead of failing the whole import. Errors from the flag upload
+ * itself still propagate — only the permission check is soft here.
+ *
+ * `contrail feature-flags import` deliberately does the opposite and fails, because there the
+ * flags are the entire point of the command.
+ */
+async function uploadFeatureFlagsIfPermitted(dir) {
+    let platformRoles;
+    try {
+        platformRoles = await getPlatformRoles();
+    }
+    catch (e) {
+        logger_1.default.info(`${chalk_1.default.yellow.bold('FEATURE FLAGS')} Skipping feature flags: ${(0, error_helpers_1.describeError)(e)} ` +
+            `Ask a platform admin to run 'contrail feature-flags import -d ${dir}'.`);
+        return;
+    }
+    if (!platformRoles.some((role) => exports.REQUIRED_PLATFORM_ROLES.includes(role))) {
+        logger_1.default.info(`${chalk_1.default.yellow.bold('FEATURE FLAGS')} Skipping feature flags: this requires the ` +
+            `${exports.REQUIRED_PLATFORM_ROLES.join(' or ')} platform role and you have ` +
+            `${platformRoles.length ? platformRoles.join(', ') : 'none'}. ` +
+            `Ask a platform admin to run 'contrail feature-flags import -d ${dir}'.`);
+        return;
+    }
+    await uploadFeatureFlags(dir);
+}
+exports.uploadFeatureFlagsIfPermitted = uploadFeatureFlagsIfPermitted;
+/**
+ * Makes the target org's enabled feature flags match $dir/feature-flags.yml: enables every
+ * flag in the file and disables any flag the target has that the file does not, the same
+ * way groups import reconciles groups. Feature flags are not editable in place, so there is
+ * no update step.
+ *
+ * Failures are collected and rethrown so an import never reports success while the org is
+ * missing flags.
+ *
+ * A file that lists no flags at all is skipped rather than applied: reconciling against an
+ * empty list would disable every flag in the target org, which is almost never what a copy
+ * is meant to do. Flags that should be off in the target have to be disabled by hand.
+ */
+async function uploadFeatureFlags(dir) {
+    const filePath = path.join(dir, export_1.FEATURE_FLAGS_FILE);
+    if (!fs_1.default.existsSync(filePath)) {
+        logger_1.default.info(`${chalk_1.default.yellow.bold('FEATURE FLAGS')} No feature flags found in ${dir}. Skipping.`);
+        return;
+    }
+    const data = (0, file_helpers_1.loadData)(filePath) ?? [];
+    if (!Array.isArray(data)) {
+        throw new Error(`${filePath} must contain a YAML list of feature flags`);
+    }
+    const featureNamesToEnable = new Set(data.map(toFeatureName).filter(Boolean));
+    if (featureNamesToEnable.size === 0) {
+        logger_1.default.info(`${chalk_1.default.yellow.bold('FEATURE FLAGS')} ${filePath} lists no feature flags. Skipping, so ` +
+            'the flags currently enabled in this org are left as they are.');
+        return;
+    }
+    const existingFlags = (await (0, feature_flags_1.getFeatureFlags)()) ?? [];
+    const enabledFeatureNames = new Set(existingFlags.map((flag) => flag?.featureName));
+    const toCreate = [...featureNamesToEnable].filter((name) => !enabledFeatureNames.has(name));
+    const toDelete = existingFlags.filter((flag) => !featureNamesToEnable.has(flag?.featureName));
+    const failures = [];
+    for (const featureName of toCreate) {
+        try {
+            await (0, feature_flags_1.createFeatureFlag)(featureName);
+            logger_1.default.info(`${chalk_1.default.yellow.bold('FEATURE FLAGS')} Enabled ${featureName}`);
+        }
+        catch (e) {
+            failures.push(`could not enable ${featureName}: ${(0, error_helpers_1.describeError)(e)}`);
+        }
+    }
+    const removed = [];
+    for (const flag of toDelete) {
+        try {
+            await (0, feature_flags_1.deleteFeatureFlag)(flag.id);
+            logger_1.default.info(`${chalk_1.default.yellow.bold('FEATURE FLAGS')} Disabled ${flag.featureName}`);
+            removed.push(flag.featureName);
+        }
+        catch (e) {
+            failures.push(`could not disable ${flag.featureName}: ${(0, error_helpers_1.describeError)(e)}`);
+        }
+    }
+    // call out the removals explicitly: they are the only destructive part of the import
+    if (removed.length) {
+        const removedList = removed.sort().join(', ');
+        logger_1.default.info(`${chalk_1.default.yellow.bold('FEATURE FLAGS')} The following ${removed.length} flag(s) were ` +
+            `enabled in this org but not in the source, so they were removed: ${removedList}`);
+    }
+    if (failures.length) {
+        throw new Error(`Failed to apply feature flags. ${failures.join('; ')}`);
+    }
+}
+exports.uploadFeatureFlags = uploadFeatureFlags;
+// the API returns platformRoles as an array, but some contexts carry it as a JSON string
+function normalizePlatformRoles(platformRoles) {
+    if (Array.isArray(platformRoles)) {
+        return platformRoles;
+    }
+    if (typeof platformRoles === 'string') {
+        try {
+            const parsed = JSON.parse(platformRoles);
+            return Array.isArray(parsed) ? parsed : [];
+        }
+        catch {
+            return [];
+        }
+    }
+    return [];
+}
+// entries are exported as `- featureName: X`, but a hand written `- X` is accepted too
+function toFeatureName(entry) {
+    const featureName = typeof entry === 'string' ? entry : entry?.featureName;
+    if (typeof featureName !== 'string' || !featureName.trim()) {
+        logger_1.default.info(`${chalk_1.default.yellow.bold('FEATURE FLAGS')} Skipping entry with no featureName`);
+        return undefined;
+    }
+    return featureName.trim();
+}

package/dist/commands/feature-flags/import.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/commands/feature-flags/import.spec.js

@@ -0,0 +1,194 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const tslib_1 = require("tslib");
+const fs_1 = tslib_1.__importDefault(require("fs"));
+const import_1 = require("./import");
+const file_helpers_1 = require("../../helpers/file-helpers");
+const feature_flags_1 = require("../../api/feature-flags");
+const users_1 = require("../../api/users");
+const logger_1 = tslib_1.__importDefault(require("../../logger"));
+jest.mock('../../helpers/file-helpers');
+jest.mock('../../api/feature-flags');
+jest.mock('../../api/users');
+const mocked = (fn) => fn;
+describe('assertCanManageFeatureFlags', () => {
+    beforeEach(() => {
+        jest.clearAllMocks();
+    });
+    it.each(['PLATFORM_ADMIN', 'PLATFORM_MANAGER'])('allows a %s', async (role) => {
+        mocked(users_1.getCurrentUserWithPlatformRoles).mockResolvedValue({ platformRoles: [role] });
+        await expect((0, import_1.assertCanManageFeatureFlags)()).resolves.toBeUndefined();
+    });
+    it('accepts platformRoles serialized as a JSON string', async () => {
+        mocked(users_1.getCurrentUserWithPlatformRoles).mockResolvedValue({
+            platformRoles: '["PLATFORM_MANAGER"]',
+        });
+        await expect((0, import_1.assertCanManageFeatureFlags)()).resolves.toBeUndefined();
+    });
+    it('rejects a user with no platform role', async () => {
+        mocked(users_1.getCurrentUserWithPlatformRoles).mockResolvedValue({ platformRoles: [] });
+        await expect((0, import_1.assertCanManageFeatureFlags)()).rejects.toThrow('requires the PLATFORM_ADMIN or PLATFORM_MANAGER platform role');
+    });
+    it('rejects a user holding only some other platform role', async () => {
+        mocked(users_1.getCurrentUserWithPlatformRoles).mockResolvedValue({
+            platformRoles: ['PLATFORM_USER'],
+        });
+        await expect((0, import_1.assertCanManageFeatureFlags)()).rejects.toThrow('Your roles: PLATFORM_USER.');
+    });
+    it('rejects when the roles could not be read', async () => {
+        mocked(users_1.getCurrentUserWithPlatformRoles).mockRejectedValue(new Error('Forbidden resource'));
+        await expect((0, import_1.assertCanManageFeatureFlags)()).rejects.toThrow('Could not read your platform roles. Forbidden resource');
+    });
+});
+describe('uploadFeatureFlags', () => {
+    let existsSyncSpy;
+    beforeEach(() => {
+        jest.clearAllMocks();
+        existsSyncSpy = jest.spyOn(fs_1.default, 'existsSync').mockReturnValue(true);
+        mocked(feature_flags_1.createFeatureFlag).mockResolvedValue({});
+        mocked(feature_flags_1.deleteFeatureFlag).mockResolvedValue({});
+        mocked(feature_flags_1.getFeatureFlags).mockResolvedValue([]);
+    });
+    afterEach(() => {
+        existsSyncSpy.mockRestore();
+    });
+    it('skips when the export has no feature-flags.yml', async () => {
+        existsSyncSpy.mockReturnValue(false);
+        await (0, import_1.uploadFeatureFlags)('export-dir');
+        expect(mocked(feature_flags_1.getFeatureFlags)).not.toHaveBeenCalled();
+        expect(mocked(feature_flags_1.createFeatureFlag)).not.toHaveBeenCalled();
+    });
+    it('skips an export that lists no flags instead of disabling everything in the target org', async () => {
+        mocked(file_helpers_1.loadData).mockReturnValue([]);
+        mocked(feature_flags_1.getFeatureFlags).mockResolvedValue([
+            { id: '1', featureName: 'SHOWROOM' },
+            { id: '2', featureName: 'DEV_TABS' },
+        ]);
+        const infoSpy = jest.spyOn(logger_1.default, 'info').mockImplementation(() => undefined);
+        await (0, import_1.uploadFeatureFlags)('export-dir');
+        expect(mocked(feature_flags_1.deleteFeatureFlag)).not.toHaveBeenCalled();
+        expect(mocked(feature_flags_1.createFeatureFlag)).not.toHaveBeenCalled();
+        expect(infoSpy).toHaveBeenCalledWith(expect.stringContaining('lists no feature flags'));
+        infoSpy.mockRestore();
+    });
+    it('treats a blank feature-flags.yml the same as an empty list', async () => {
+        mocked(file_helpers_1.loadData).mockReturnValue(undefined);
+        mocked(feature_flags_1.getFeatureFlags).mockResolvedValue([{ id: '1', featureName: 'SHOWROOM' }]);
+        await (0, import_1.uploadFeatureFlags)('export-dir');
+        expect(mocked(feature_flags_1.getFeatureFlags)).not.toHaveBeenCalled();
+        expect(mocked(feature_flags_1.deleteFeatureFlag)).not.toHaveBeenCalled();
+    });
+    it('enables every flag from the export that the target org is missing', async () => {
+        mocked(file_helpers_1.loadData).mockReturnValue([{ featureName: 'SHOWROOM' }, { featureName: 'PROMOTE' }]);
+        mocked(feature_flags_1.getFeatureFlags).mockResolvedValue([{ id: '1', featureName: 'SHOWROOM' }]);
+        await (0, import_1.uploadFeatureFlags)('export-dir');
+        expect(mocked(feature_flags_1.createFeatureFlag)).toHaveBeenCalledTimes(1);
+        expect(mocked(feature_flags_1.createFeatureFlag)).toHaveBeenCalledWith('PROMOTE');
+    });
+    it('disables flags the target org has that the export does not, so the orgs match', async () => {
+        mocked(file_helpers_1.loadData).mockReturnValue([{ featureName: 'SHOWROOM' }]);
+        mocked(feature_flags_1.getFeatureFlags).mockResolvedValue([
+            { id: '1', featureName: 'SHOWROOM' },
+            { id: '2', featureName: 'DEV_TABS' },
+        ]);
+        await (0, import_1.uploadFeatureFlags)('export-dir');
+        expect(mocked(feature_flags_1.createFeatureFlag)).not.toHaveBeenCalled();
+        expect(mocked(feature_flags_1.deleteFeatureFlag)).toHaveBeenCalledTimes(1);
+        expect(mocked(feature_flags_1.deleteFeatureFlag)).toHaveBeenCalledWith('2');
+    });
+    it('summarizes what it removed, and why, at the end of the run', async () => {
+        const infoSpy = jest.spyOn(logger_1.default, 'info').mockImplementation(() => undefined);
+        mocked(file_helpers_1.loadData).mockReturnValue([{ featureName: 'SHOWROOM' }]);
+        mocked(feature_flags_1.getFeatureFlags).mockResolvedValue([
+            { id: '1', featureName: 'SHOWROOM' },
+            { id: '2', featureName: 'PROMOTE' },
+            { id: '3', featureName: 'DEV_TABS' },
+        ]);
+        await (0, import_1.uploadFeatureFlags)('export-dir');
+        const summary = infoSpy.mock.calls.map(([message]) => String(message)).at(-1);
+        expect(summary).toContain('2 flag(s) were enabled in this org but not in the source');
+        expect(summary).toContain('DEV_TABS, PROMOTE');
+        infoSpy.mockRestore();
+    });
+    it('does not print a removal summary when nothing was removed', async () => {
+        const infoSpy = jest.spyOn(logger_1.default, 'info').mockImplementation(() => undefined);
+        mocked(file_helpers_1.loadData).mockReturnValue([{ featureName: 'SHOWROOM' }]);
+        mocked(feature_flags_1.getFeatureFlags).mockResolvedValue([{ id: '1', featureName: 'SHOWROOM' }]);
+        await (0, import_1.uploadFeatureFlags)('export-dir');
+        const messages = infoSpy.mock.calls.map(([message]) => String(message));
+        expect(messages.some((message) => message.includes('so they were removed'))).toBe(false);
+        infoSpy.mockRestore();
+    });
+    it('accepts plain feature names and ignores entries with no featureName', async () => {
+        mocked(file_helpers_1.loadData).mockReturnValue(['SHOWROOM', { featureName: '  PROMOTE  ' }, {}, null]);
+        await (0, import_1.uploadFeatureFlags)('export-dir');
+        expect(mocked(feature_flags_1.createFeatureFlag).mock.calls.map(([name]) => name)).toEqual([
+            'SHOWROOM',
+            'PROMOTE',
+        ]);
+    });
+    it('rejects when the file is not a list', async () => {
+        mocked(file_helpers_1.loadData).mockReturnValue({ featureName: 'SHOWROOM' });
+        await expect((0, import_1.uploadFeatureFlags)('export-dir')).rejects.toThrow('must contain a YAML list of feature flags');
+    });
+    it('applies what it can and then rejects, rather than reporting success', async () => {
+        mocked(file_helpers_1.loadData).mockReturnValue([{ featureName: 'SHOWROOM' }, { featureName: 'PROMOTE' }]);
+        mocked(feature_flags_1.createFeatureFlag).mockImplementation(async (featureName) => {
+            if (featureName === 'SHOWROOM') {
+                throw new Error('Forbidden resource');
+            }
+            return {};
+        });
+        await expect((0, import_1.uploadFeatureFlags)('export-dir')).rejects.toThrow('could not enable SHOWROOM: Forbidden resource');
+        expect(mocked(feature_flags_1.createFeatureFlag)).toHaveBeenCalledWith('PROMOTE');
+    });
+});
+describe('uploadFeatureFlagsIfPermitted', () => {
+    let existsSyncSpy;
+    let infoSpy;
+    beforeEach(() => {
+        jest.clearAllMocks();
+        existsSyncSpy = jest.spyOn(fs_1.default, 'existsSync').mockReturnValue(true);
+        infoSpy = jest.spyOn(logger_1.default, 'info').mockImplementation(() => undefined);
+        mocked(file_helpers_1.loadData).mockReturnValue([{ featureName: 'SHOWROOM' }]);
+        mocked(feature_flags_1.createFeatureFlag).mockResolvedValue({});
+        mocked(feature_flags_1.deleteFeatureFlag).mockResolvedValue({});
+        mocked(feature_flags_1.getFeatureFlags).mockResolvedValue([]);
+    });
+    afterEach(() => {
+        existsSyncSpy.mockRestore();
+        infoSpy.mockRestore();
+    });
+    const messages = () => infoSpy.mock.calls.map(([message]) => String(message)).join('\n');
+    it('applies the flags when the user has a platform role', async () => {
+        mocked(users_1.getCurrentUserWithPlatformRoles).mockResolvedValue({
+            platformRoles: ['PLATFORM_MANAGER'],
+        });
+        await (0, import_1.uploadFeatureFlagsIfPermitted)('export-dir');
+        expect(mocked(feature_flags_1.createFeatureFlag)).toHaveBeenCalledWith('SHOWROOM');
+    });
+    it('skips with a log instead of failing when the user has no platform role', async () => {
+        mocked(users_1.getCurrentUserWithPlatformRoles).mockResolvedValue({ platformRoles: [] });
+        await expect((0, import_1.uploadFeatureFlagsIfPermitted)('export-dir')).resolves.toBeUndefined();
+        expect(mocked(feature_flags_1.getFeatureFlags)).not.toHaveBeenCalled();
+        expect(mocked(feature_flags_1.createFeatureFlag)).not.toHaveBeenCalled();
+        expect(mocked(feature_flags_1.deleteFeatureFlag)).not.toHaveBeenCalled();
+        expect(messages()).toContain('Skipping feature flags');
+        expect(messages()).toContain('PLATFORM_ADMIN or PLATFORM_MANAGER');
+        expect(messages()).toContain('contrail feature-flags import -d export-dir');
+    });
+    it('skips with a log when the platform roles cannot be read', async () => {
+        mocked(users_1.getCurrentUserWithPlatformRoles).mockRejectedValue(new Error('Forbidden resource'));
+        await expect((0, import_1.uploadFeatureFlagsIfPermitted)('export-dir')).resolves.toBeUndefined();
+        expect(mocked(feature_flags_1.createFeatureFlag)).not.toHaveBeenCalled();
+        expect(messages()).toContain('Skipping feature flags');
+        expect(messages()).toContain('Forbidden resource');
+    });
+    it('still propagates a failure from the upload itself', async () => {
+        mocked(users_1.getCurrentUserWithPlatformRoles).mockResolvedValue({
+            platformRoles: ['PLATFORM_ADMIN'],
+        });
+        mocked(feature_flags_1.createFeatureFlag).mockRejectedValue(new Error('boom'));
+        await expect((0, import_1.uploadFeatureFlagsIfPermitted)('export-dir')).rejects.toThrow('could not enable SHOWROOM: boom');
+    });
+});

package/dist/commands/groups/export.js

@@ -2,11 +2,8 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.exportGroups = exports.DEFAULT_FILE_LOCATION = void 0;
 const tslib_1 = require("tslib");
-const path = tslib_1.__importStar(require("path"));
 const chalk_1 = tslib_1.__importDefault(require("chalk"));
-const fs_1 = tslib_1.__importDefault(require("fs"));
 const login_1 = require("../../auth/login");
-const js_yaml_1 = tslib_1.__importDefault(require("js-yaml"));
 const core_1 = require("@oclif/core");
 const file_helpers_1 = require("../../helpers/file-helpers");
 const users_1 = require("../../api/users");
@@ -61,18 +58,9 @@ async function exportGroups(fileLocation, overwrite) {
         });
     }
     groups = groups.sort((one, two) => (one.name < two.name ? -1 : 1));
-    await saveData(groups, fileLocation, overwrite);
+    await (0, file_helpers_1.saveData)(groups, fileLocation, overwrite);
 }
 exports.exportGroups = exportGroups;
-async function saveData(data, fileLocation, overwrite) {
-    const yamlStr = js_yaml_1.default.dump(data);
-    const CURRENT_DIR = process.cwd();
-    const pathToWrite = path.join(CURRENT_DIR, fileLocation);
-    if (fs_1.default.existsSync(pathToWrite)) {
-        await (0, file_helpers_1.safeFileOverwrite)(pathToWrite, overwrite);
-    }
-    fs_1.default.writeFileSync(pathToWrite, yamlStr, 'utf8');
-}
 function getGroupPrincipals(group, allGroups, orgUsers) {
     if (!group?.groupPrincipals) {
         return [];

package/dist/commands/groups/import.js

@@ -2,13 +2,11 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.uploadGroups = void 0;
 const tslib_1 = require("tslib");
-const path = tslib_1.__importStar(require("path"));
 const sdk_1 = require("@contrail/sdk");
 const chalk_1 = tslib_1.__importDefault(require("chalk"));
-const fs_1 = tslib_1.__importDefault(require("fs"));
 const login_1 = require("../../auth/login");
-const js_yaml_1 = tslib_1.__importDefault(require("js-yaml"));
 const core_1 = require("@oclif/core");
+const file_helpers_1 = require("../../helpers/file-helpers");
 const basecommand_1 = require("../../basecommand");
 const logger_1 = tslib_1.__importDefault(require("../../logger"));
 class ImportGroups extends basecommand_1.BaseCommand {
@@ -39,23 +37,12 @@ class ImportGroups extends basecommand_1.BaseCommand {
     }
 }
 exports.default = ImportGroups;
-function getGroupsFile(fileLocation) {
-    const CURRENT_DIR = process.cwd();
-    try {
-        const fullPath = path.join(CURRENT_DIR, fileLocation);
-        const doc = js_yaml_1.default.load(fs_1.default.readFileSync(fullPath, 'utf8'));
-        return doc;
-    }
-    catch (e) {
-        throw new Error(`ERROR PARSING YAML: ${e}`);
-    }
-}
 async function uploadGroups(fileLocation) {
     const existingGroups = await new sdk_1.Entities().get({
         entityName: 'group',
         relations: ['groupPrincipals'],
     });
-    const groupsToImport = getGroupsFile(fileLocation);
+    const groupsToImport = (0, file_helpers_1.loadData)(fileLocation);
     const orgUsers = await new sdk_1.Entities().get({
         entityName: 'user-org',
     });

package/dist/commands/instance/export.d.ts

@@ -10,3 +10,12 @@ export default class ExportInstance extends BaseCommand {
     };
     run(): Promise<void>;
 }
+/**
+ * Exports everything `contrail instance import` loads back: types, users, groups and the
+ * org's enabled feature flags. Org config (branding, sorting, admin-console settings) is
+ * written by getAllTypes, so it is not repeated here.
+ *
+ * Exporting feature flags is a plain read, so it works for any user — only the import side
+ * needs a platform role.
+ */
+export declare function exportInstance(outDir: string, overwrite: boolean): Promise<void>;

package/dist/commands/instance/export.js

@@ -1,11 +1,13 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.exportInstance = void 0;
 const tslib_1 = require("tslib");
 const path = tslib_1.__importStar(require("path"));
 const core_1 = require("@oclif/core");
 const getAll_1 = require("../types/getAll");
 const export_1 = require("../users/export");
 const export_2 = require("../groups/export");
+const export_3 = require("../feature-flags/export");
 const basecommand_1 = require("../../basecommand");
 class ExportInstance extends basecommand_1.BaseCommand {
     static description = 'Exports an data of an instance including types and users';
@@ -29,9 +31,22 @@ class ExportInstance extends basecommand_1.BaseCommand {
         }),
     };
     async run() {
-        await (0, getAll_1.getAll)(this.flags.outDir, this.flags.overwrite);
-        await (0, export_1.exportUsers)(path.join(this.flags.outDir, 'users.yml'), this.flags.overwrite);
-        await (0, export_2.exportGroups)(path.join(this.flags.outDir, 'groups.yml'), this.flags.overwrite);
+        await exportInstance(this.flags.outDir, this.flags.overwrite);
     }
 }
 exports.default = ExportInstance;
+/**
+ * Exports everything `contrail instance import` loads back: types, users, groups and the
+ * org's enabled feature flags. Org config (branding, sorting, admin-console settings) is
+ * written by getAllTypes, so it is not repeated here.
+ *
+ * Exporting feature flags is a plain read, so it works for any user — only the import side
+ * needs a platform role.
+ */
+async function exportInstance(outDir, overwrite) {
+    await (0, getAll_1.getAll)(outDir, overwrite);
+    await (0, export_1.exportUsers)(path.join(outDir, 'users.yml'), overwrite);
+    await (0, export_2.exportGroups)(path.join(outDir, 'groups.yml'), overwrite);
+    await (0, export_3.exportFeatureFlags)(outDir, overwrite);
+}
+exports.exportInstance = exportInstance;

package/dist/commands/instance/export.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/commands/instance/export.spec.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const export_1 = require("./export");
+const getAll_1 = require("../types/getAll");
+const export_2 = require("../users/export");
+const export_3 = require("../groups/export");
+const export_4 = require("../feature-flags/export");
+jest.mock('../types/getAll');
+jest.mock('../users/export');
+jest.mock('../groups/export');
+jest.mock('../feature-flags/export');
+const mocked = (fn) => fn;
+const STEPS = [getAll_1.getAll, export_2.exportUsers, export_3.exportGroups, export_4.exportFeatureFlags];
+describe('exportInstance', () => {
+    beforeEach(() => {
+        jest.clearAllMocks();
+        for (const fn of STEPS) {
+            mocked(fn).mockResolvedValue(undefined);
+        }
+    });
+    it('exports everything the import loads back, including feature flags', async () => {
+        await (0, export_1.exportInstance)('out-dir', true);
+        expect(mocked(getAll_1.getAll)).toHaveBeenCalledWith('out-dir', true);
+        expect(mocked(export_2.exportUsers)).toHaveBeenCalledWith('out-dir/users.yml', true);
+        expect(mocked(export_3.exportGroups)).toHaveBeenCalledWith('out-dir/groups.yml', true);
+        expect(mocked(export_4.exportFeatureFlags)).toHaveBeenCalledWith('out-dir', true);
+    });
+    it('passes the overwrite flag through to the feature flags export', async () => {
+        await (0, export_1.exportInstance)('out-dir', false);
+        expect(mocked(export_4.exportFeatureFlags)).toHaveBeenCalledWith('out-dir', false);
+    });
+});

package/dist/commands/instance/import.d.ts

@@ -9,3 +9,20 @@ export default class ImportInstance extends BaseCommand {
     };
     run(): Promise<void>;
 }
+/**
+ * Imports an instance export in dependency order:
+ *   1. option sets, types, option set hierarchies, rule sets
+ *   2. users and groups (policy principals)
+ *   3. type property policies and type policies
+ *   4. type overrides — after policies, because they reference policies, rule sets and option
+ *      set hierarchies by slug and the API rejects the whole upload if any of them is missing
+ *   5. org config
+ *   6. feature flags — skipped with a log message when the user has no platform role,
+ *      since applying them needs PLATFORM_ADMIN/PLATFORM_MANAGER but the rest of the
+ *      import does not, and org admins are expected to run this command
+ *
+ * Fails (rejects) if the type overrides could not be applied, so the import does not
+ * report success while the org is missing customizations carried by overrides
+ * (labels/formulas/editability of core properties, subtype-level property changes).
+ */
+export declare function importInstance(dir: string): Promise<void>;

package/dist/commands/instance/import.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.importInstance = void 0;
 const tslib_1 = require("tslib");
 const path = tslib_1.__importStar(require("path"));
 const core_1 = require("@oclif/core");
@@ -8,6 +9,9 @@ const import_1 = require("../users/import");
 const import_2 = require("../groups/import");
 const uploadTypePropertyPolicies_1 = require("../types/uploadTypePropertyPolicies");
 const uploadTypePolicies_1 = require("../types/uploadTypePolicies");
+const uploadTypeOverrides_1 = require("../types/uploadTypeOverrides");
+const import_3 = require("../org-config/import");
+const import_4 = require("../feature-flags/import");
 const basecommand_1 = require("../../basecommand");
 class ImportInstance extends basecommand_1.BaseCommand {
     static description = 'Import the data to an instance, including types and users';
@@ -25,11 +29,34 @@ class ImportInstance extends basecommand_1.BaseCommand {
         }),
     };
     async run() {
-        await (0, loadAll_1.loadAll)(this.flags.dir, true);
-        await (0, import_1.uploadUsers)(path.join(this.flags.dir, 'users.yml'));
-        await (0, import_2.uploadGroups)(path.join(this.flags.dir, 'groups.yml'));
-        await (0, uploadTypePropertyPolicies_1.uploadTypePropertyPolicies)(this.flags.dir);
-        await (0, uploadTypePolicies_1.uploadTypePolicies)(this.flags.dir);
+        await importInstance(this.flags.dir);
     }
 }
 exports.default = ImportInstance;
+/**
+ * Imports an instance export in dependency order:
+ *   1. option sets, types, option set hierarchies, rule sets
+ *   2. users and groups (policy principals)
+ *   3. type property policies and type policies
+ *   4. type overrides — after policies, because they reference policies, rule sets and option
+ *      set hierarchies by slug and the API rejects the whole upload if any of them is missing
+ *   5. org config
+ *   6. feature flags — skipped with a log message when the user has no platform role,
+ *      since applying them needs PLATFORM_ADMIN/PLATFORM_MANAGER but the rest of the
+ *      import does not, and org admins are expected to run this command
+ *
+ * Fails (rejects) if the type overrides could not be applied, so the import does not
+ * report success while the org is missing customizations carried by overrides
+ * (labels/formulas/editability of core properties, subtype-level property changes).
+ */
+async function importInstance(dir) {
+    await (0, loadAll_1.loadAll)(dir, true, false);
+    await (0, import_1.uploadUsers)(path.join(dir, 'users.yml'));
+    await (0, import_2.uploadGroups)(path.join(dir, 'groups.yml'));
+    await (0, uploadTypePropertyPolicies_1.uploadTypePropertyPolicies)(dir);
+    await (0, uploadTypePolicies_1.uploadTypePolicies)(dir);
+    await (0, uploadTypeOverrides_1.uploadTypeOverrides)(dir);
+    await (0, import_3.uploadOrgConfig)(dir);
+    await (0, import_4.uploadFeatureFlagsIfPermitted)(dir);
+}
+exports.importInstance = importInstance;

package/dist/commands/instance/import.spec.d.ts

@@ -0,0 +1 @@
+export {};