@credibledata/cred-cli 0.0.100 → 0.0.103

package/src/commands/materialization/getrun.ts

@@ -0,0 +1,55 @@
+import { RunsApi } from "../../client/api";
+import { Configuration } from "../../client/configuration";
+import { ClientConfiguration } from "../../clientconfiguration";
+import { logger } from "../../logger";
+import { prettifyJson, printOutError } from "../../utils";
+
+const runsApi = new RunsApi(new Configuration());
+
+/**
+ * Get a single build/refresh run by id, including its stateful build plan. The
+ * `buildPlan.nodes` carry each produced unit's live state — per source node the
+ * physical `tableName` and `rowCount`, per index node the dimension and its
+ * status — and `buildPlan.edges` wire sources to the indexes that depend on
+ * them. This is the detailed view (`listRuns` omits the graph); use it to see
+ * exactly which physical tables a run produced and how the units relate.
+ */
+export async function getRun(
+   controlPlane: string,
+   packagePath: string,
+   runId: string,
+   debug: boolean,
+) {
+   const clientConfig = new ClientConfiguration();
+   const organizationName = clientConfig.getOrganization();
+   const environmentName = clientConfig.getProject();
+
+   if (!clientConfig.doesConfigExists()) {
+      logger.error("Please, make sure that you are logged in");
+      return;
+   }
+
+   if (!environmentName) {
+      logger.error("Please, make sure to set an environment");
+      return;
+   }
+
+   try {
+      const packageName = packagePath.replace("/", "");
+      const response = await runsApi.getRun(
+         organizationName,
+         environmentName,
+         packageName,
+         runId,
+         {
+            baseURL: controlPlane,
+            headers: clientConfig.getHeaders(),
+         },
+      );
+
+      console.log(prettifyJson(response.data));
+   } catch (e) {
+      logger.error("Failed to get run");
+      printOutError(e, debug);
+   }
+}

package/src/commands/materialization/listindexes.ts

@@ -0,0 +1,69 @@
+import { IndexesApi } from "../../client/api";
+import { Configuration } from "../../client/configuration";
+import { ClientConfiguration } from "../../clientconfiguration";
+import { logger } from "../../logger";
+import {
+   prettifyJson,
+   printOutError,
+   parsePaginationParams,
+   extractTotalCount,
+} from "../../utils";
+
+const indexesApi = new IndexesApi(new Configuration());
+
+/**
+ * List the dimensional search indexes bound to a package version (the per-`#(index)`
+ * serving anchors). Each entry prints its `status` and, when FAILED, the `error`;
+ * plus the serving `rowCount`, `lastIndexedAt`, freshness policy, and the
+ * `stale`/`staleReasons` triple — so a failing or stale index is diagnosable
+ * from the CLI. The total available count is logged to stderr.
+ */
+export async function listIndexes(
+   controlPlane: string,
+   packagePath: string,
+   versionId: string,
+   debug: boolean,
+   page?: string | number,
+   pageSize?: string | number,
+) {
+   const clientConfig = new ClientConfiguration();
+   const organizationName = clientConfig.getOrganization();
+   const environmentName = clientConfig.getProject();
+
+   if (!clientConfig.doesConfigExists()) {
+      logger.error("Please, make sure that you are logged in");
+      return;
+   }
+
+   if (!environmentName) {
+      logger.error("Please, make sure to set an environment");
+      return;
+   }
+
+   try {
+      const packageName = packagePath.replace("/", "");
+      const { limit, offset } = parsePaginationParams(page, pageSize);
+      const response = await indexesApi.listIndexes(
+         organizationName,
+         environmentName,
+         packageName,
+         versionId,
+         limit,
+         offset,
+         {
+            baseURL: controlPlane,
+            headers: clientConfig.getHeaders(),
+         },
+      );
+
+      const totalCount = extractTotalCount(response.headers);
+      if (totalCount !== undefined) {
+         logger.info(`Total indexes available: ${totalCount}`);
+      }
+
+      console.log(prettifyJson(response.data));
+   } catch (e) {
+      logger.error("Failed to list indexes");
+      printOutError(e, debug);
+   }
+}

package/src/commands/materialization/listmaterializations.ts

@@ -0,0 +1,53 @@
+import { MaterializationsApi } from "../../client/api";
+import { Configuration } from "../../client/configuration";
+import { ClientConfiguration } from "../../clientconfiguration";
+import { logger } from "../../logger";
+import { prettifyJson, printOutError } from "../../utils";
+
+const materializationsApi = new MaterializationsApi(new Configuration());
+
+/**
+ * List the Malloy Persistence materializations bound to a package version.
+ * Each materialization prints its `status` and, when FAILED, the `error`
+ * explaining why the build failed (e.g. a warehouse permission denial) — so a
+ * failing materialization is diagnosable from the CLI without opening the app.
+ */
+export async function listMaterializations(
+   controlPlane: string,
+   packagePath: string,
+   versionId: string,
+   debug: boolean,
+) {
+   const clientConfig = new ClientConfiguration();
+   const organizationName = clientConfig.getOrganization();
+   const environmentName = clientConfig.getProject();
+
+   if (!clientConfig.doesConfigExists()) {
+      logger.error("Please, make sure that you are logged in");
+      return;
+   }
+
+   if (!environmentName) {
+      logger.error("Please, make sure to set an environment");
+      return;
+   }
+
+   try {
+      const packageName = packagePath.replace("/", "");
+      const response = await materializationsApi.listMaterializations(
+         organizationName,
+         environmentName,
+         packageName,
+         versionId,
+         {
+            baseURL: controlPlane,
+            headers: clientConfig.getHeaders(),
+         },
+      );
+
+      console.log(prettifyJson(response.data));
+   } catch (e) {
+      logger.error("Failed to list materializations");
+      printOutError(e, debug);
+   }
+}

package/src/commands/materialization/listpreaggregates.ts

@@ -0,0 +1,74 @@
+import { PreaggregatesApi } from "../../client/api";
+import { Configuration } from "../../client/configuration";
+import { ClientConfiguration } from "../../clientconfiguration";
+import { logger } from "../../logger";
+import {
+   prettifyJson,
+   printOutError,
+   parsePaginationParams,
+   extractTotalCount,
+} from "../../utils";
+
+const preaggregatesApi = new PreaggregatesApi(new Configuration());
+
+/**
+ * List the pre-aggregated measures of a package version (one entry per `#@ preaggregate`
+ * measure). Each entry prints its `status` and, when FAILED, the `error`; plus the
+ * `grainDimensions` it is rolled up to, the serving `rowCount`, `lastBuiltAt`, freshness
+ * policy, and the `stale`/`staleReasons` triple. `--source` narrows to the measures of one
+ * authored source. The total available count is logged to stderr.
+ *
+ * <p>One rollup table can serve several measures, so entries here outnumber the tables
+ * behind them: the measure is what a modeler wrote, and it is the unit this lists.
+ */
+export async function listPreaggregates(
+   controlPlane: string,
+   packagePath: string,
+   versionId: string,
+   sourceName: string | undefined,
+   debug: boolean,
+   page?: string | number,
+   pageSize?: string | number,
+) {
+   const clientConfig = new ClientConfiguration();
+   const organizationName = clientConfig.getOrganization();
+   const environmentName = clientConfig.getProject();
+
+   if (!clientConfig.doesConfigExists()) {
+      logger.error("Please, make sure that you are logged in");
+      return;
+   }
+
+   if (!environmentName) {
+      logger.error("Please, make sure to set an environment");
+      return;
+   }
+
+   try {
+      const packageName = packagePath.replace("/", "");
+      const { limit, offset } = parsePaginationParams(page, pageSize);
+      const response = await preaggregatesApi.listPreaggregates(
+         organizationName,
+         environmentName,
+         packageName,
+         versionId,
+         sourceName,
+         limit,
+         offset,
+         {
+            baseURL: controlPlane,
+            headers: clientConfig.getHeaders(),
+         },
+      );
+
+      const totalCount = extractTotalCount(response.headers);
+      if (totalCount !== undefined) {
+         logger.info(`Total pre-aggregations available: ${totalCount}`);
+      }
+
+      console.log(prettifyJson(response.data));
+   } catch (e) {
+      logger.error("Failed to list pre-aggregations");
+      printOutError(e, debug);
+   }
+}

package/src/commands/materialization/listruns.ts

@@ -0,0 +1,77 @@
+import { RunsApi } from "../../client/api";
+import { Configuration } from "../../client/configuration";
+import { ClientConfiguration } from "../../clientconfiguration";
+import { logger } from "../../logger";
+import {
+   prettifyJson,
+   printOutError,
+   parsePaginationParams,
+   extractTotalCount,
+} from "../../utils";
+
+const runsApi = new RunsApi(new Configuration());
+
+/**
+ * List the build/refresh runs for a package (most recent first). Runs are one
+ * package-scoped resource spanning both families — materialized sources and
+ * dimensional indexes. Optional filters narrow the list: `versionId` limits to
+ * the runs that impacted a version; `sourceName`/`dimension`/`measure` limit to runs
+ * targeting a specific unit (Phase C per-unit dispatch). Each run prints its
+ * `status`, `trigger`, `buildNumber`, target scope, and, when failed, its
+ * `error`. The per-unit build-plan graph is available via `cred get run`.
+ */
+export async function listRuns(
+   controlPlane: string,
+   packagePath: string,
+   versionId: string | undefined,
+   debug: boolean,
+   sourceName?: string,
+   dimension?: string,
+   measure?: string,
+   page?: string | number,
+   pageSize?: string | number,
+) {
+   const clientConfig = new ClientConfiguration();
+   const organizationName = clientConfig.getOrganization();
+   const environmentName = clientConfig.getProject();
+
+   if (!clientConfig.doesConfigExists()) {
+      logger.error("Please, make sure that you are logged in");
+      return;
+   }
+
+   if (!environmentName) {
+      logger.error("Please, make sure to set an environment");
+      return;
+   }
+
+   try {
+      const packageName = packagePath.replace("/", "");
+      const { limit, offset } = parsePaginationParams(page, pageSize);
+      const response = await runsApi.listRuns(
+         organizationName,
+         environmentName,
+         packageName,
+         versionId,
+         sourceName,
+         measure,
+         dimension,
+         limit,
+         offset,
+         {
+            baseURL: controlPlane,
+            headers: clientConfig.getHeaders(),
+         },
+      );
+
+      const totalCount = extractTotalCount(response.headers);
+      if (totalCount !== undefined) {
+         logger.info(`Total runs available: ${totalCount}`);
+      }
+
+      console.log(prettifyJson(response.data));
+   } catch (e) {
+      logger.error("Failed to list runs");
+      printOutError(e, debug);
+   }
+}

package/src/commands/materialization/rerun.ts

@@ -0,0 +1,123 @@
+import { RunsApi, CreateRunRequest } from "../../client/api";
+import { Configuration } from "../../client/configuration";
+import { ClientConfiguration } from "../../clientconfiguration";
+import { logger } from "../../logger";
+import { getConfirmation, prettifyJson, printOutError } from "../../utils";
+
+const runsApi = new RunsApi(new Configuration());
+
+export interface RerunScope {
+   source?: string;
+   dimension?: string;
+   measure?: string;
+   modelFile?: string;
+   includeUpstream?: boolean;
+}
+
+/**
+ * Trigger an on-demand run (rebuild/refresh) for a package version. With no
+ * scope selectors this is a full run: re-materialize every persist source and
+ * rebuild every indexed dimension. The optional `--source` / `--dimension` /
+ * `--measure` / `--model-file` selectors narrow it to a single unit (Phase C
+ * per-unit dispatch); `--measure` rebuilds the rollup serving that
+ * pre-aggregated measure, and fails when the measure is declared at more than
+ * one grain (pass `--source` to disambiguate); `--include-upstream` additionally force-rebuilds the target's
+ * upstream persisted closure. Prints the started run (poll it with
+ * `cred get run <package> <runId>`).
+ */
+export async function rerun(
+   controlPlane: string,
+   packagePath: string,
+   versionId: string,
+   scope: RerunScope,
+   debug: boolean,
+   autoConfirm: boolean,
+) {
+   const clientConfig = new ClientConfiguration();
+   const organizationName = clientConfig.getOrganization();
+   const environmentName = clientConfig.getProject();
+
+   if (!clientConfig.doesConfigExists()) {
+      logger.error("Please, make sure that you are logged in");
+      return;
+   }
+
+   if (!environmentName) {
+      logger.error("Please, make sure to set an environment");
+      return;
+   }
+
+   if (!versionId) {
+      logger.error("Please provide a version ID");
+      return;
+   }
+
+   // Caught here rather than at the server so the message can name the flags. A
+   // source may carry a dimension and a measure of the same name, so which one
+   // you pass decides what gets rebuilt — there is no safe default.
+   if (scope.dimension && scope.measure) {
+      logger.error(
+         "--dimension and --measure both narrow a run to one field; pass only one",
+      );
+      return;
+   }
+
+   const packageName = packagePath.replace("/", "");
+
+   const request: CreateRunRequest = { versionId };
+   if (scope.source) request.sourceName = scope.source;
+   if (scope.dimension) request.dimension = scope.dimension;
+   if (scope.measure) request.measure = scope.measure;
+   if (scope.modelFile) request.modelFilePath = scope.modelFile;
+   if (scope.includeUpstream) request.includeUpstream = true;
+
+   const targetLabel = describeScope(scope);
+
+   if (!autoConfirm) {
+      const confirmation = await getConfirmation(
+         `Trigger a run for ${packageName}/${versionId} (${targetLabel})?`,
+      );
+      if (!confirmation) {
+         return;
+      }
+   }
+
+   logger.info(`Starting run for ${packageName}/${versionId} (${targetLabel})`);
+   try {
+      const response = await runsApi.createRun(
+         organizationName,
+         environmentName,
+         packageName,
+         request,
+         {
+            baseURL: controlPlane,
+            headers: clientConfig.getHeaders(),
+         },
+      );
+
+      console.log(prettifyJson(response.data));
+   } catch (e) {
+      logger.error("Failed to start run");
+      printOutError(e, debug);
+   }
+}
+
+function describeScope(scope: RerunScope): string {
+   const parts: string[] = [];
+   if (scope.source) parts.push(`source=${scope.source}`);
+   if (scope.dimension) parts.push(`dimension=${scope.dimension}`);
+   if (scope.measure) parts.push(`measure=${scope.measure}`);
+   if (scope.modelFile) parts.push(`modelFile=${scope.modelFile}`);
+   if (parts.length === 0) {
+      return "full run — all sources, indexes and pre-aggregations";
+   }
+   if (scope.includeUpstream) parts.push("includeUpstream");
+   const scoped = `scoped: ${parts.join(", ")}`;
+   // A measure names a COLUMN in a rollup table, and the whole table is what
+   // gets rebuilt — so `measure=revenue` alone understates what the caller is
+   // agreeing to. This string is the confirmation prompt, so the sibling
+   // measures have to be named as consequences before the y/n, not after.
+   return scope.measure
+      ? `${scoped} — rebuilds the measure's whole rollup table, and so every measure declared at the same grain`
+      : scoped;
+}

package/src/commands/misc/login.spec.ts

@@ -1,12 +1,13 @@
+import { spawn } from "child_process";
 import axios from "axios";
 import { expect } from "chai";
 import fs from "fs";
 import os from "os";
-import { join } from "path";
+import { join, resolve } from "path";
 import sinon from "sinon";
 import * as credConstants from "../../constants";
 import { ClientConfiguration } from "../../clientconfiguration";
-import { login } from "./login";
+import { isLoginInvocation, login } from "./login";
 import { OrganizationsApi } from "../../client/api";
 import * as loopbackOAuth from "./loopbackOAuth";
 
@@ -19,6 +20,7 @@ function createFakeIdToken(payload: Record<string, unknown>): string {
 }
 
 describe("login", () => {
+   let tmpConfigDir: string;
    let tmpConfigFilePath: string;
    let axiosStub: sinon.SinonStub;
    let orgPermissionsStub: sinon.SinonStub;
@@ -51,8 +53,26 @@ describe("login", () => {
    };
 
    beforeEach(() => {
-      tmpConfigFilePath = join(os.tmpdir(), "cred.json");
-      fs.writeFileSync(tmpConfigFilePath, "{}");
+      // mkdtempSync atomically creates a private (mode 0700) directory
+      // with an unguessable suffix, sidestepping the symlink / clobber
+      // class that CodeQL flags as js/insecure-temporary-file when a
+      // fixed name is reused inside the shared OS tmpdir.
+      tmpConfigDir = fs.mkdtempSync(join(os.tmpdir(), "cred-login-spec-"));
+      tmpConfigFilePath = join(tmpConfigDir, "cred.json");
+      // Seed with a valid ConfigFile. loadConfig now throws on malformed
+      // input rather than silently resetting, so an empty `{}` is no longer
+      // an acceptable starting state.
+      fs.writeFileSync(
+         tmpConfigFilePath,
+         JSON.stringify({
+            configPerEnvironment: {
+               production: {},
+               staging: {},
+               localhost: {},
+            },
+            activeEnvironment: "production",
+         }),
+      );
       axiosStub = sinon.stub(axios, "request");
       orgPermissionsStub = sinon
          .stub(OrganizationsApi.prototype, "getOrganization")
@@ -60,7 +80,7 @@ describe("login", () => {
    });
 
    afterEach(() => {
-      fs.rmSync(tmpConfigFilePath);
+      fs.rmSync(tmpConfigDir, { recursive: true, force: true });
       sinon.restore();
    });
 
@@ -159,7 +179,7 @@ describe("login", () => {
          "https://admin.videoamp-aws-us-east-1.credibledata.com/api/v0",
          tmpConfigFilePath,
       );
-      expect(orgIdStub.calledOnceWithExactly("videoamp")).to.be.true;
+      expect(orgIdStub.calledOnceWithExactly("videoamp", undefined)).to.be.true;
       expect(loopbackStub.calledOnce).to.be.true;
       const call = loopbackStub.getCall(0);
       expect(call.args[0].authorizeUrl).to.contain(
@@ -190,12 +210,35 @@ describe("login", () => {
          "https://admin.videoamp-aws-us-east-1.credibledata.com/api/v0",
          tmpConfigFilePath,
       );
-      expect(orgIdStub.calledOnceWithExactly("VideoAmp")).to.be.true;
+      expect(orgIdStub.calledOnceWithExactly("VideoAmp", undefined)).to.be.true;
       expect(loopbackStub.getCall(0).args[0].authorizeUrl).to.contain(
          "organization=org_nMRKafeSuxOiuJeG",
       );
    });
 
+   it("forwards the cluster arg to getAuth0OrganizationIdForCliLogin (so -c aws triggers PKCE)", async function () {
+      this.timeout(2000);
+      const orgIdStub = sinon
+         .stub(credConstants, "getAuth0OrganizationIdForCliLogin")
+         .returns("org_nMRKafeSuxOiuJeG");
+      sinon
+         .stub(loopbackOAuth, "authorizationCodeViaLoopback")
+         .callsFake(async (opts) => {
+            opts.onListening?.();
+            return { code: "test-pkce-auth-code" };
+         });
+      axiosStub.onFirstCall().resolves(mockedAccessTokenResponse);
+      const config = new ClientConfiguration(tmpConfigFilePath);
+      config.setEnvironment("videoamp");
+      await login(
+         "videoamp",
+         "https://admin.videoamp-aws-us-east-1.credibledata.com/api/v0",
+         tmpConfigFilePath,
+         "aws",
+      );
+      expect(orgIdStub.calledOnceWithExactly("videoamp", "aws")).to.be.true;
+   });
+
    it("should not pass Auth0 organization for unmapped org names", async function () {
       this.timeout(2000);
       axiosStub
@@ -211,3 +254,118 @@ describe("login", () => {
       );
    });
 });
+
+describe("isLoginInvocation", () => {
+   it("is true for a `cred login <org>` invocation", () => {
+      expect(isLoginInvocation(["node", "/x/index.js", "login", "myorg"])).to.be
+         .true;
+   });
+
+   it("is false for other commands (they stay fail-loud on a corrupt config)", () => {
+      expect(isLoginInvocation(["node", "/x/index.js", "status"])).to.be.false;
+      expect(isLoginInvocation(["node", "/x/index.js", "publish"])).to.be.false;
+      expect(isLoginInvocation(["node", "/x/index.js"])).to.be.false;
+   });
+});
+
+// Drives the real binary entrypoint (src/index.ts), not recoverIfCorrupt() in
+// isolation. index.ts reads the active environment at module load (axios
+// baseURL + command registration), so a corrupt ~/.cred used to throw before
+// the login action ran — dead-ending the documented recovery path. This guards
+// that ordering: with HOME pointed at a fixture dir holding a corrupt config,
+// `index.ts login <org>` must reset the file rather than crash with the
+// structure error.
+describe("entrypoint recovery for a corrupt ~/.cred (real index.ts)", () => {
+   let tmpHome: string;
+   const indexPath = resolve(__dirname, "../../index.ts");
+   const cliRoot = resolve(__dirname, "../../..");
+
+   beforeEach(() => {
+      tmpHome = fs.mkdtempSync(join(os.tmpdir(), "cred-entrypoint-"));
+   });
+
+   afterEach(() => {
+      fs.rmSync(tmpHome, { recursive: true, force: true });
+   });
+
+   const findBackup = (): string | undefined =>
+      fs.readdirSync(tmpHome).find((f) => f.startsWith(".cred.corrupt-"));
+
+   it("backs up the corrupt file and resets instead of crashing", async function () {
+      this.timeout(60000);
+
+      // A structurally-invalid config: parses as JSON but has neither
+      // activeEnvironment nor configPerEnvironment — exactly what triggered the
+      // customer's "re-run cred login" loop.
+      const credPath = join(tmpHome, ".cred");
+      fs.writeFileSync(credPath, JSON.stringify({ garbage: true }));
+
+      const child = spawn(
+         process.execPath,
+         ["-r", "ts-node/register", indexPath, "login", "testorg"],
+         {
+            cwd: cliRoot,
+            env: {
+               ...process.env,
+               HOME: tmpHome,
+               USERPROFILE: tmpHome,
+               // Runtime behavior is what we're testing; skip type-checking the
+               // whole import graph so an unrelated type error can't derail it.
+               TS_NODE_TRANSPILE_ONLY: "1",
+            },
+         },
+      );
+
+      let output = "";
+      child.stdout.on("data", (d) => (output += d.toString()));
+      child.stderr.on("data", (d) => (output += d.toString()));
+
+      // Recovery runs synchronously at module load, before login() touches the
+      // network. It renames the corrupt file aside (.cred.corrupt-*) and THEN
+      // rewrites .cred to a valid default. Gate on the rewrite, not the backup:
+      // the backup appears first, so killing the instant it shows can catch the
+      // child in the gap before .cred is rewritten — a flaky ENOENT on the read
+      // below. resetComplete() only goes true once .cred is the valid default
+      // (which implies the backup already happened). Then stop the process
+      // (login otherwise blocks on the device-code flow).
+      const resetComplete = (): boolean => {
+         try {
+            return (
+               JSON.parse(fs.readFileSync(credPath, "utf8"))
+                  .activeEnvironment === "production"
+            );
+         } catch {
+            return false; // .cred absent or mid-rewrite
+         }
+      };
+      await new Promise<void>((resolveWait) => {
+         const deadline = Date.now() + 55000;
+         const timer = setInterval(() => {
+            if (resetComplete() || Date.now() > deadline) {
+               clearInterval(timer);
+               resolveWait();
+            }
+         }, 200);
+         child.on("exit", () => {
+            clearInterval(timer);
+            resolveWait();
+         });
+      });
+      child.kill("SIGKILL");
+
+      const backup = findBackup();
+      expect(backup, "corrupt config should be backed up aside").to.be.a(
+         "string",
+      );
+      // The bad contents are preserved in the backup, not destroyed.
+      expect(
+         JSON.parse(fs.readFileSync(join(tmpHome, backup!), "utf8")),
+      ).to.deep.equal({ garbage: true });
+      // ~/.cred is rewritten to a valid default the next read can load.
+      const reset = JSON.parse(fs.readFileSync(credPath, "utf8"));
+      expect(reset.activeEnvironment).to.equal("production");
+      expect(reset.configPerEnvironment).to.be.an("object");
+      // The startup read no longer dead-ends on the structure error.
+      expect(output).to.not.match(/Invalid config structure/);
+   });
+});