@contrail/cli 3.5.5-alpha.5c010ac → 3.5.5-alpha.960e382

package/README.md

@@ -17,7 +17,7 @@ $ npm install -g @contrail/cli
 $ contrail COMMAND
 running command...
 $ contrail (--version)
-@contrail/cli/3.5.5-alpha.5c010ac linux-x64 node-v24.20.0
+@contrail/cli/3.5.5-alpha.960e382 linux-x64 node-v24.21.0
 $ contrail --help [COMMAND]
 USAGE
   $ contrail COMMAND

package/dist/commands/feature-flags/import.d.ts

@@ -16,6 +16,16 @@ export default class ImportFeatureFlags extends BaseCommand {
  * the command before it half-applies the file.
  */
 export declare function assertCanManageFeatureFlags(): Promise<void>;
+/**
+ * The `instance import` variant: feature flags are one step of a much larger config copy that
+ * org admins without a platform role are expected to run, so a missing role (or roles we could
+ * not read) logs and skips instead of failing the whole import. Errors from the flag upload
+ * itself still propagate — only the permission check is soft here.
+ *
+ * `contrail feature-flags import` deliberately does the opposite and fails, because there the
+ * flags are the entire point of the command.
+ */
+export declare function uploadFeatureFlagsIfPermitted(dir: string): Promise<void>;
 /**
  * Makes the target org's enabled feature flags match $dir/feature-flags.yml: enables every
  * flag in the file and disables any flag the target has that the file does not, the same

package/dist/commands/feature-flags/import.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.uploadFeatureFlags = exports.assertCanManageFeatureFlags = exports.REQUIRED_PLATFORM_ROLES = void 0;
+exports.uploadFeatureFlags = exports.uploadFeatureFlagsIfPermitted = exports.assertCanManageFeatureFlags = exports.REQUIRED_PLATFORM_ROLES = void 0;
 const tslib_1 = require("tslib");
 const path = tslib_1.__importStar(require("path"));
 const chalk_1 = tslib_1.__importDefault(require("chalk"));
@@ -48,26 +48,57 @@ class ImportFeatureFlags extends basecommand_1.BaseCommand {
     }
 }
 exports.default = ImportFeatureFlags;
+async function getPlatformRoles() {
+    try {
+        const currentUser = await (0, users_1.getCurrentUserWithPlatformRoles)();
+        return normalizePlatformRoles(currentUser?.platformRoles);
+    }
+    catch (e) {
+        throw new Error(`Could not read your platform roles. ${(0, error_helpers_1.describeError)(e)}`);
+    }
+}
 /**
  * The feature flags API only lets a platform admin/manager create or delete flags, and a
  * missing role surfaces as a generic 403 partway through the run. Checking up front stops
  * the command before it half-applies the file.
  */
 async function assertCanManageFeatureFlags() {
+    const platformRoles = await getPlatformRoles();
+    if (!platformRoles.some((role) => exports.REQUIRED_PLATFORM_ROLES.includes(role))) {
+        throw new Error(`Importing feature flags requires the ${exports.REQUIRED_PLATFORM_ROLES.join(' or ')} platform role. ` +
+            `Your roles: ${platformRoles.length ? platformRoles.join(', ') : 'none'}.`);
+    }
+}
+exports.assertCanManageFeatureFlags = assertCanManageFeatureFlags;
+/**
+ * The `instance import` variant: feature flags are one step of a much larger config copy that
+ * org admins without a platform role are expected to run, so a missing role (or roles we could
+ * not read) logs and skips instead of failing the whole import. Errors from the flag upload
+ * itself still propagate — only the permission check is soft here.
+ *
+ * `contrail feature-flags import` deliberately does the opposite and fails, because there the
+ * flags are the entire point of the command.
+ */
+async function uploadFeatureFlagsIfPermitted(dir) {
     let platformRoles;
     try {
-        const currentUser = await (0, users_1.getCurrentUserWithPlatformRoles)();
-        platformRoles = normalizePlatformRoles(currentUser?.platformRoles);
+        platformRoles = await getPlatformRoles();
     }
     catch (e) {
-        throw new Error(`Could not read your platform roles. ${(0, error_helpers_1.describeError)(e)}`);
+        logger_1.default.info(`${chalk_1.default.yellow.bold('FEATURE FLAGS')} Skipping feature flags: ${(0, error_helpers_1.describeError)(e)} ` +
+            `Ask a platform admin to run 'contrail feature-flags import -d ${dir}'.`);
+        return;
     }
     if (!platformRoles.some((role) => exports.REQUIRED_PLATFORM_ROLES.includes(role))) {
-        throw new Error(`Importing feature flags requires the ${exports.REQUIRED_PLATFORM_ROLES.join(' or ')} platform role. ` +
-            `Your roles: ${platformRoles.length ? platformRoles.join(', ') : 'none'}.`);
+        logger_1.default.info(`${chalk_1.default.yellow.bold('FEATURE FLAGS')} Skipping feature flags: this requires the ` +
+            `${exports.REQUIRED_PLATFORM_ROLES.join(' or ')} platform role and you have ` +
+            `${platformRoles.length ? platformRoles.join(', ') : 'none'}. ` +
+            `Ask a platform admin to run 'contrail feature-flags import -d ${dir}'.`);
+        return;
     }
+    await uploadFeatureFlags(dir);
 }
-exports.assertCanManageFeatureFlags = assertCanManageFeatureFlags;
+exports.uploadFeatureFlagsIfPermitted = uploadFeatureFlagsIfPermitted;
 /**
  * Makes the target org's enabled feature flags match $dir/feature-flags.yml: enables every
  * flag in the file and disables any flag the target has that the file does not, the same

package/dist/commands/feature-flags/import.spec.js

@@ -123,3 +123,52 @@ describe('uploadFeatureFlags', () => {
         expect(mocked(feature_flags_1.createFeatureFlag)).toHaveBeenCalledWith('PROMOTE');
     });
 });
+describe('uploadFeatureFlagsIfPermitted', () => {
+    let existsSyncSpy;
+    let infoSpy;
+    beforeEach(() => {
+        jest.clearAllMocks();
+        existsSyncSpy = jest.spyOn(fs_1.default, 'existsSync').mockReturnValue(true);
+        infoSpy = jest.spyOn(logger_1.default, 'info').mockImplementation(() => undefined);
+        mocked(file_helpers_1.loadData).mockReturnValue([{ featureName: 'SHOWROOM' }]);
+        mocked(feature_flags_1.createFeatureFlag).mockResolvedValue({});
+        mocked(feature_flags_1.deleteFeatureFlag).mockResolvedValue({});
+        mocked(feature_flags_1.getFeatureFlags).mockResolvedValue([]);
+    });
+    afterEach(() => {
+        existsSyncSpy.mockRestore();
+        infoSpy.mockRestore();
+    });
+    const messages = () => infoSpy.mock.calls.map(([message]) => String(message)).join('\n');
+    it('applies the flags when the user has a platform role', async () => {
+        mocked(users_1.getCurrentUserWithPlatformRoles).mockResolvedValue({
+            platformRoles: ['PLATFORM_MANAGER'],
+        });
+        await (0, import_1.uploadFeatureFlagsIfPermitted)('export-dir');
+        expect(mocked(feature_flags_1.createFeatureFlag)).toHaveBeenCalledWith('SHOWROOM');
+    });
+    it('skips with a log instead of failing when the user has no platform role', async () => {
+        mocked(users_1.getCurrentUserWithPlatformRoles).mockResolvedValue({ platformRoles: [] });
+        await expect((0, import_1.uploadFeatureFlagsIfPermitted)('export-dir')).resolves.toBeUndefined();
+        expect(mocked(feature_flags_1.getFeatureFlags)).not.toHaveBeenCalled();
+        expect(mocked(feature_flags_1.createFeatureFlag)).not.toHaveBeenCalled();
+        expect(mocked(feature_flags_1.deleteFeatureFlag)).not.toHaveBeenCalled();
+        expect(messages()).toContain('Skipping feature flags');
+        expect(messages()).toContain('PLATFORM_ADMIN or PLATFORM_MANAGER');
+        expect(messages()).toContain('contrail feature-flags import -d export-dir');
+    });
+    it('skips with a log when the platform roles cannot be read', async () => {
+        mocked(users_1.getCurrentUserWithPlatformRoles).mockRejectedValue(new Error('Forbidden resource'));
+        await expect((0, import_1.uploadFeatureFlagsIfPermitted)('export-dir')).resolves.toBeUndefined();
+        expect(mocked(feature_flags_1.createFeatureFlag)).not.toHaveBeenCalled();
+        expect(messages()).toContain('Skipping feature flags');
+        expect(messages()).toContain('Forbidden resource');
+    });
+    it('still propagates a failure from the upload itself', async () => {
+        mocked(users_1.getCurrentUserWithPlatformRoles).mockResolvedValue({
+            platformRoles: ['PLATFORM_ADMIN'],
+        });
+        mocked(feature_flags_1.createFeatureFlag).mockRejectedValue(new Error('boom'));
+        await expect((0, import_1.uploadFeatureFlagsIfPermitted)('export-dir')).rejects.toThrow('could not enable SHOWROOM: boom');
+    });
+});

package/dist/commands/instance/export.d.ts

@@ -10,3 +10,12 @@ export default class ExportInstance extends BaseCommand {
     };
     run(): Promise<void>;
 }
+/**
+ * Exports everything `contrail instance import` loads back: types, users, groups and the
+ * org's enabled feature flags. Org config (branding, sorting, admin-console settings) is
+ * written by getAllTypes, so it is not repeated here.
+ *
+ * Exporting feature flags is a plain read, so it works for any user — only the import side
+ * needs a platform role.
+ */
+export declare function exportInstance(outDir: string, overwrite: boolean): Promise<void>;

package/dist/commands/instance/export.js

@@ -1,11 +1,13 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.exportInstance = void 0;
 const tslib_1 = require("tslib");
 const path = tslib_1.__importStar(require("path"));
 const core_1 = require("@oclif/core");
 const getAll_1 = require("../types/getAll");
 const export_1 = require("../users/export");
 const export_2 = require("../groups/export");
+const export_3 = require("../feature-flags/export");
 const basecommand_1 = require("../../basecommand");
 class ExportInstance extends basecommand_1.BaseCommand {
     static description = 'Exports an data of an instance including types and users';
@@ -29,9 +31,22 @@ class ExportInstance extends basecommand_1.BaseCommand {
         }),
     };
     async run() {
-        await (0, getAll_1.getAll)(this.flags.outDir, this.flags.overwrite);
-        await (0, export_1.exportUsers)(path.join(this.flags.outDir, 'users.yml'), this.flags.overwrite);
-        await (0, export_2.exportGroups)(path.join(this.flags.outDir, 'groups.yml'), this.flags.overwrite);
+        await exportInstance(this.flags.outDir, this.flags.overwrite);
     }
 }
 exports.default = ExportInstance;
+/**
+ * Exports everything `contrail instance import` loads back: types, users, groups and the
+ * org's enabled feature flags. Org config (branding, sorting, admin-console settings) is
+ * written by getAllTypes, so it is not repeated here.
+ *
+ * Exporting feature flags is a plain read, so it works for any user — only the import side
+ * needs a platform role.
+ */
+async function exportInstance(outDir, overwrite) {
+    await (0, getAll_1.getAll)(outDir, overwrite);
+    await (0, export_1.exportUsers)(path.join(outDir, 'users.yml'), overwrite);
+    await (0, export_2.exportGroups)(path.join(outDir, 'groups.yml'), overwrite);
+    await (0, export_3.exportFeatureFlags)(outDir, overwrite);
+}
+exports.exportInstance = exportInstance;

package/dist/commands/instance/export.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/commands/instance/export.spec.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const export_1 = require("./export");
+const getAll_1 = require("../types/getAll");
+const export_2 = require("../users/export");
+const export_3 = require("../groups/export");
+const export_4 = require("../feature-flags/export");
+jest.mock('../types/getAll');
+jest.mock('../users/export');
+jest.mock('../groups/export');
+jest.mock('../feature-flags/export');
+const mocked = (fn) => fn;
+const STEPS = [getAll_1.getAll, export_2.exportUsers, export_3.exportGroups, export_4.exportFeatureFlags];
+describe('exportInstance', () => {
+    beforeEach(() => {
+        jest.clearAllMocks();
+        for (const fn of STEPS) {
+            mocked(fn).mockResolvedValue(undefined);
+        }
+    });
+    it('exports everything the import loads back, including feature flags', async () => {
+        await (0, export_1.exportInstance)('out-dir', true);
+        expect(mocked(getAll_1.getAll)).toHaveBeenCalledWith('out-dir', true);
+        expect(mocked(export_2.exportUsers)).toHaveBeenCalledWith('out-dir/users.yml', true);
+        expect(mocked(export_3.exportGroups)).toHaveBeenCalledWith('out-dir/groups.yml', true);
+        expect(mocked(export_4.exportFeatureFlags)).toHaveBeenCalledWith('out-dir', true);
+    });
+    it('passes the overwrite flag through to the feature flags export', async () => {
+        await (0, export_1.exportInstance)('out-dir', false);
+        expect(mocked(export_4.exportFeatureFlags)).toHaveBeenCalledWith('out-dir', false);
+    });
+});

package/dist/commands/instance/import.d.ts

@@ -17,6 +17,9 @@ export default class ImportInstance extends BaseCommand {
  *   4. type overrides — after policies, because they reference policies, rule sets and option
  *      set hierarchies by slug and the API rejects the whole upload if any of them is missing
  *   5. org config
+ *   6. feature flags — skipped with a log message when the user has no platform role,
+ *      since applying them needs PLATFORM_ADMIN/PLATFORM_MANAGER but the rest of the
+ *      import does not, and org admins are expected to run this command
  *
  * Fails (rejects) if the type overrides could not be applied, so the import does not
  * report success while the org is missing customizations carried by overrides

package/dist/commands/instance/import.js

@@ -11,6 +11,7 @@ const uploadTypePropertyPolicies_1 = require("../types/uploadTypePropertyPolicie
 const uploadTypePolicies_1 = require("../types/uploadTypePolicies");
 const uploadTypeOverrides_1 = require("../types/uploadTypeOverrides");
 const import_3 = require("../org-config/import");
+const import_4 = require("../feature-flags/import");
 const basecommand_1 = require("../../basecommand");
 class ImportInstance extends basecommand_1.BaseCommand {
     static description = 'Import the data to an instance, including types and users';
@@ -40,6 +41,9 @@ exports.default = ImportInstance;
  *   4. type overrides — after policies, because they reference policies, rule sets and option
  *      set hierarchies by slug and the API rejects the whole upload if any of them is missing
  *   5. org config
+ *   6. feature flags — skipped with a log message when the user has no platform role,
+ *      since applying them needs PLATFORM_ADMIN/PLATFORM_MANAGER but the rest of the
+ *      import does not, and org admins are expected to run this command
  *
  * Fails (rejects) if the type overrides could not be applied, so the import does not
  * report success while the org is missing customizations carried by overrides
@@ -53,5 +57,6 @@ async function importInstance(dir) {
     await (0, uploadTypePolicies_1.uploadTypePolicies)(dir);
     await (0, uploadTypeOverrides_1.uploadTypeOverrides)(dir);
     await (0, import_3.uploadOrgConfig)(dir);
+    await (0, import_4.uploadFeatureFlagsIfPermitted)(dir);
 }
 exports.importInstance = importInstance;

package/dist/commands/instance/import.spec.js

@@ -8,6 +8,7 @@ const uploadTypePropertyPolicies_1 = require("../types/uploadTypePropertyPolicie
 const uploadTypePolicies_1 = require("../types/uploadTypePolicies");
 const uploadTypeOverrides_1 = require("../types/uploadTypeOverrides");
 const import_4 = require("../org-config/import");
+const import_5 = require("../feature-flags/import");
 jest.mock('../types/loadAll');
 jest.mock('../users/import');
 jest.mock('../groups/import');
@@ -15,6 +16,7 @@ jest.mock('../types/uploadTypePropertyPolicies');
 jest.mock('../types/uploadTypePolicies');
 jest.mock('../types/uploadTypeOverrides');
 jest.mock('../org-config/import');
+jest.mock('../feature-flags/import');
 const mocked = (fn) => fn;
 const STEPS = [
     loadAll_1.loadAll,
@@ -24,6 +26,7 @@ const STEPS = [
     uploadTypePolicies_1.uploadTypePolicies,
     uploadTypeOverrides_1.uploadTypeOverrides,
     import_4.uploadOrgConfig,
+    import_5.uploadFeatureFlagsIfPermitted,
 ];
 describe('importInstance', () => {
     beforeEach(() => {
@@ -37,6 +40,7 @@ describe('importInstance', () => {
         expect(mocked(loadAll_1.loadAll)).toHaveBeenCalledWith('export-dir', true, false);
         expect(mocked(uploadTypeOverrides_1.uploadTypeOverrides)).toHaveBeenCalledWith('export-dir');
         expect(mocked(import_4.uploadOrgConfig)).toHaveBeenCalledWith('export-dir');
+        expect(mocked(import_5.uploadFeatureFlagsIfPermitted)).toHaveBeenCalledWith('export-dir');
         const order = STEPS.map((fn) => mocked(fn).mock.invocationCallOrder[0]);
         // strictly increasing => called in exactly this order
         for (let i = 1; i < order.length; i++) {

package/oclif.manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "3.5.5-alpha.5c010ac",
+  "version": "3.5.5-alpha.960e382",
   "commands": {
     "app:create": {
       "id": "app:create",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrail/cli",
-  "version": "3.5.5-alpha.5c010ac",
+  "version": "3.5.5-alpha.960e382",
   "description": "VibeIQ's Contrail Platform CLI.",
   "bin": {
     "contrail-cli": "./bin/run",