@credibledata/cred-cli 0.0.100 → 0.0.103

package/src/commands/permission/deletepermission.ts

@@ -0,0 +1,117 @@
+import {
+   EnvironmentPermissionsApi,
+   OrganizationPermissionsApi,
+   PackagePermissionsApi,
+} from "../../client/api";
+import { Configuration } from "../../client/configuration";
+import { ClientConfiguration } from "../../clientconfiguration";
+import { UserGroupId } from "../../common/UserGroupId";
+import { logger } from "../../logger";
+import { getConfirmation, printOutError } from "../../utils";
+import {
+   describeScope,
+   PermissionScope,
+   resolveScope,
+   ScopeOptions,
+} from "./scope";
+
+const organizationPermissionsApi = new OrganizationPermissionsApi(
+   new Configuration(),
+);
+const environmentPermissionsApi = new EnvironmentPermissionsApi(
+   new Configuration(),
+);
+const packagePermissionsApi = new PackagePermissionsApi(new Configuration());
+
+export async function deletePermission(
+   controlPlane: string,
+   userGroupIdValue: string,
+   debug: boolean,
+   autoConfirm: boolean,
+   options: ScopeOptions,
+) {
+   const clientConfig = new ClientConfiguration();
+
+   if (!clientConfig.doesConfigExists()) {
+      logger.error("Please, make sure that you are logged in");
+      return;
+   }
+
+   const organizationName = clientConfig.getOrganization();
+   if (!organizationName) {
+      logger.error("No organization set. Please login or set an organization.");
+      return;
+   }
+
+   const resolved = resolveScope(options, clientConfig.getProject());
+   if ("error" in resolved) {
+      logger.error(resolved.error);
+      process.exit(1);
+      return;
+   }
+
+   let userGroupId: string;
+   try {
+      userGroupId = new UserGroupId(userGroupIdValue).getValue();
+   } catch (e) {
+      logger.error((e as Error).message);
+      process.exit(1);
+      return;
+   }
+
+   const target = describeScope(organizationName, resolved);
+
+   if (!autoConfirm) {
+      const confirmation = await getConfirmation(
+         `Are you sure that you want to revoke ${userGroupId}'s permission on ${target}?`,
+      );
+      if (!confirmation) {
+         logger.info("Operation cancelled.");
+         return;
+      }
+   }
+
+   logger.info(`Revoking permission for ${userGroupId} on ${target}`);
+
+   const requestOptions = {
+      baseURL: controlPlane,
+      headers: {
+         Authorization: clientConfig.getAuthenticationHeader(),
+      },
+   };
+
+   try {
+      switch (resolved.scope) {
+         case PermissionScope.PACKAGE:
+            await packagePermissionsApi.deletePackagePermission(
+               organizationName,
+               resolved.environmentName as string,
+               resolved.packageName as string,
+               userGroupId,
+               requestOptions,
+            );
+            break;
+         case PermissionScope.ENVIRONMENT:
+            await environmentPermissionsApi.deleteEnvironmentPermission(
+               organizationName,
+               resolved.environmentName as string,
+               userGroupId,
+               requestOptions,
+            );
+            break;
+         default:
+            await organizationPermissionsApi.deleteOrganizationPermission(
+               organizationName,
+               userGroupId,
+               requestOptions,
+            );
+            break;
+      }
+
+      logger.info("Permission revoked successfully");
+   } catch (error) {
+      logger.error("Failed to revoke permission");
+      printOutError(error, debug);
+      process.exit(1);
+   }
+}

package/src/commands/permission/getpermission.ts

@@ -0,0 +1,115 @@
+import {
+   EnvironmentPermissionsApi,
+   OrganizationPermissionsApi,
+   PackagePermissionsApi,
+} from "../../client/api";
+import { Configuration } from "../../client/configuration";
+import { ClientConfiguration } from "../../clientconfiguration";
+import { UserGroupId } from "../../common/UserGroupId";
+import { logger } from "../../logger";
+import { printOutError } from "../../utils";
+import {
+   describeScope,
+   PermissionScope,
+   resolveScope,
+   ScopeOptions,
+} from "./scope";
+
+const organizationPermissionsApi = new OrganizationPermissionsApi(
+   new Configuration(),
+);
+const environmentPermissionsApi = new EnvironmentPermissionsApi(
+   new Configuration(),
+);
+const packagePermissionsApi = new PackagePermissionsApi(new Configuration());
+
+export async function getPermission(
+   controlPlane: string,
+   userGroupIdValue: string,
+   debug: boolean,
+   options: ScopeOptions,
+) {
+   const clientConfig = new ClientConfiguration();
+
+   if (!clientConfig.doesConfigExists()) {
+      logger.error("Please, make sure that you are logged in");
+      return;
+   }
+
+   const organizationName = clientConfig.getOrganization();
+   if (!organizationName) {
+      logger.error("No organization set. Please login or set an organization.");
+      return;
+   }
+
+   const resolved = resolveScope(options, clientConfig.getProject());
+   if ("error" in resolved) {
+      logger.error(resolved.error);
+      process.exit(1);
+      return;
+   }
+
+   let userGroupId: string;
+   try {
+      userGroupId = new UserGroupId(userGroupIdValue).getValue();
+   } catch (e) {
+      logger.error((e as Error).message);
+      process.exit(1);
+      return;
+   }
+
+   logger.info(
+      `Getting permission for ${userGroupId} on ${describeScope(organizationName, resolved)}`,
+   );
+
+   const requestOptions = {
+      baseURL: controlPlane,
+      headers: {
+         Authorization: clientConfig.getAuthenticationHeader(),
+      },
+   };
+
+   try {
+      let data: unknown;
+      switch (resolved.scope) {
+         case PermissionScope.PACKAGE: {
+            const response = await packagePermissionsApi.getPackagePermission(
+               organizationName,
+               resolved.environmentName as string,
+               resolved.packageName as string,
+               userGroupId,
+               requestOptions,
+            );
+            data = response.data;
+            break;
+         }
+         case PermissionScope.ENVIRONMENT: {
+            const response =
+               await environmentPermissionsApi.getEnvironmentPermission(
+                  organizationName,
+                  resolved.environmentName as string,
+                  userGroupId,
+                  requestOptions,
+               );
+            data = response.data;
+            break;
+         }
+         default: {
+            const response =
+               await organizationPermissionsApi.getOrganizationPermission(
+                  organizationName,
+                  userGroupId,
+                  requestOptions,
+               );
+            data = response.data;
+            break;
+         }
+      }
+
+      console.log(JSON.stringify(data, null, 2));
+   } catch (error) {
+      logger.error("Failed to get permission");
+      printOutError(error, debug);
+      process.exit(1);
+   }
+}

package/src/commands/permission/listpermissions.ts

@@ -0,0 +1,101 @@
+import {
+   EnvironmentPermissionsApi,
+   OrganizationPermissionsApi,
+   PackagePermissionsApi,
+} from "../../client/api";
+import { Configuration } from "../../client/configuration";
+import { ClientConfiguration } from "../../clientconfiguration";
+import { logger } from "../../logger";
+import { printOutError } from "../../utils";
+import {
+   describeScope,
+   PermissionScope,
+   resolveScope,
+   ScopeOptions,
+} from "./scope";
+
+const organizationPermissionsApi = new OrganizationPermissionsApi(
+   new Configuration(),
+);
+const environmentPermissionsApi = new EnvironmentPermissionsApi(
+   new Configuration(),
+);
+const packagePermissionsApi = new PackagePermissionsApi(new Configuration());
+
+export async function listPermissions(
+   controlPlane: string,
+   debug: boolean,
+   options: ScopeOptions,
+) {
+   const clientConfig = new ClientConfiguration();
+
+   if (!clientConfig.doesConfigExists()) {
+      logger.error("Please, make sure that you are logged in");
+      return;
+   }
+
+   const organizationName = clientConfig.getOrganization();
+   if (!organizationName) {
+      logger.error("No organization set. Please login or set an organization.");
+      return;
+   }
+
+   const resolved = resolveScope(options, clientConfig.getProject());
+   if ("error" in resolved) {
+      logger.error(resolved.error);
+      process.exit(1);
+      return;
+   }
+
+   logger.info(
+      `Listing permissions on ${describeScope(organizationName, resolved)}`,
+   );
+
+   const requestOptions = {
+      baseURL: controlPlane,
+      headers: {
+         Authorization: clientConfig.getAuthenticationHeader(),
+      },
+   };
+
+   try {
+      let data: unknown;
+      switch (resolved.scope) {
+         case PermissionScope.PACKAGE: {
+            const response = await packagePermissionsApi.listPackagePermissions(
+               organizationName,
+               resolved.environmentName as string,
+               resolved.packageName as string,
+               requestOptions,
+            );
+            data = response.data;
+            break;
+         }
+         case PermissionScope.ENVIRONMENT: {
+            const response =
+               await environmentPermissionsApi.listEnvironmentPermissions(
+                  organizationName,
+                  resolved.environmentName as string,
+                  requestOptions,
+               );
+            data = response.data;
+            break;
+         }
+         default: {
+            const response =
+               await organizationPermissionsApi.listOrganizationPermissions(
+                  organizationName,
+                  requestOptions,
+               );
+            data = response.data;
+            break;
+         }
+      }
+
+      console.log(JSON.stringify(data, null, 2));
+   } catch (error) {
+      logger.error("Failed to list permissions");
+      printOutError(error, debug);
+      process.exit(1);
+   }
+}

package/src/commands/permission/scope.ts

@@ -0,0 +1,180 @@
+import {
+   EnvironmentPermissionPermissionEnum,
+   OrganizationPermissionPermissionEnum,
+   PackagePermissionPermissionEnum,
+} from "../../client/api";
+import { UserGroupId } from "../../common/UserGroupId";
+
+/**
+ * Which resource a permission is granted on. The organization is the default
+ * because it is the only scope that names no resource of its own.
+ */
+export enum PermissionScope {
+   ORGANIZATION = "organization",
+   ENVIRONMENT = "environment",
+   PACKAGE = "package",
+}
+
+/**
+ * The roles each scope accepts.
+ *
+ * The organization is the odd one out: it ends in `member` where the other two
+ * end in `viewer`. They are not interchangeable, so the sets are listed per
+ * scope rather than shared.
+ *
+ * A package takes `viewer` alone, which is narrower than its schema enum. The
+ * enum carries admin and modeler because a package reports them -- they are
+ * inherited from the environment -- but only viewer is directly assignable, and
+ * the server rejects the other two. Deriving this set from the enum would let
+ * the CLI accept a grant that cannot be written.
+ */
+const ROLES_BY_SCOPE: Record<PermissionScope, readonly string[]> = {
+   [PermissionScope.ORGANIZATION]: Object.values(
+      OrganizationPermissionPermissionEnum,
+   ),
+   [PermissionScope.ENVIRONMENT]: Object.values(
+      EnvironmentPermissionPermissionEnum,
+   ),
+   [PermissionScope.PACKAGE]: [PackagePermissionPermissionEnum.Viewer],
+};
+
+export type ScopeOptions = {
+   environment?: string;
+   package?: string;
+};
+
+/**
+ * The resource a command addresses: the scope plus the names needed to reach
+ * it. `environmentName` is set for both the environment and package scopes,
+ * since a package is addressed through its environment.
+ */
+export type ResolvedScope = {
+   scope: PermissionScope;
+   environmentName?: string;
+   packageName?: string;
+};
+
+export function rolesFor(scope: PermissionScope): readonly string[] {
+   return ROLES_BY_SCOPE[scope];
+}
+
+/**
+ * Works out which resource the options address, reading the environment from
+ * the config when a package is named without one.
+ *
+ * Returns an error rather than guessing when the environment cannot be
+ * resolved: silently falling back to the organization would grant a wider
+ * permission than the caller asked for.
+ */
+export function resolveScope(
+   options: ScopeOptions,
+   configuredEnvironment: string | undefined,
+): ResolvedScope | { error: string } {
+   // An option that was passed but is empty -- `--environment "$UNSET_VAR"` --
+   // is a mistake, not an omission. Treating it as absent would widen the grant
+   // to the next scope out, which is the outcome this function exists to refuse,
+   // so it is reported rather than interpreted.
+   for (const name of ["environment", "package"] as const) {
+      const value = options[name];
+      if (value !== undefined && value.trim() === "") {
+         return { error: `--${name} was given an empty value.` };
+      }
+   }
+
+   if (options.package) {
+      const environmentName = options.environment || configuredEnvironment;
+      if (!environmentName) {
+         return {
+            error: "A package permission needs an environment. Pass --environment, or set one with 'cred set environment <name>'.",
+         };
+      }
+      return {
+         scope: PermissionScope.PACKAGE,
+         environmentName,
+         packageName: options.package,
+      };
+   }
+
+   if (options.environment) {
+      return {
+         scope: PermissionScope.ENVIRONMENT,
+         environmentName: options.environment,
+      };
+   }
+
+   return { scope: PermissionScope.ORGANIZATION };
+}
+
+/** Names the resource in log lines, so a message says what was addressed. */
+export function describeScope(
+   organizationName: string,
+   resolved: ResolvedScope,
+): string {
+   switch (resolved.scope) {
+      case PermissionScope.PACKAGE:
+         return `package ${organizationName}/${resolved.environmentName}/${resolved.packageName}`;
+      case PermissionScope.ENVIRONMENT:
+         return `environment ${organizationName}/${resolved.environmentName}`;
+      default:
+         return `organization ${organizationName}`;
+   }
+}
+
+/**
+ * Checks a role against the scope it is granted on, so a role the API would
+ * reject fails before the request instead of as an opaque 400.
+ */
+export function validateRole(
+   scope: PermissionScope,
+   role: string,
+): string | null {
+   const allowed = rolesFor(scope);
+   if (!allowed.includes(role)) {
+      return `Invalid role '${role}' for a ${scope} permission. Expected one of: ${allowed.join(", ")}`;
+   }
+   return null;
+}
+
+/**
+ * The roles the authorization model accepts for public access, per scope.
+ *
+ * Narrower than the roles a named subject can hold, and not derivable from
+ * them: the model lists `user:*` on exactly three relations. Anything else
+ * reaches OpenFGA and fails there as a model validation error, so it is listed
+ * rather than special-cased.
+ */
+const PUBLIC_ACCESS_ROLES_BY_SCOPE: Record<PermissionScope, readonly string[]> =
+   {
+      [PermissionScope.ORGANIZATION]: ["modeler"],
+      [PermissionScope.ENVIRONMENT]: ["viewer"],
+      [PermissionScope.PACKAGE]: ["viewer"],
+   };
+
+/**
+ * Parses the subject and checks the roles public access may hold. Everything
+ * else about the subject -- whether a user's email is well formed, whether a
+ * group exists -- is left to the server, which is the authority on it.
+ */
+export function parseSubject(
+   scope: PermissionScope,
+   role: string,
+   value: string,
+): { userGroupId: UserGroupId } | { error: string } {
+   let userGroupId: UserGroupId;
+   try {
+      userGroupId = new UserGroupId(value);
+   } catch (e) {
+      return { error: (e as Error).message };
+   }
+
+   if (userGroupId.isPublicAccess()) {
+      const allowed = PUBLIC_ACCESS_ROLES_BY_SCOPE[scope];
+      if (!allowed.includes(role)) {
+         return {
+            error: `Public access cannot be granted '${role}' on a ${scope}. Expected one of: ${allowed.join(", ")}`,
+         };
+      }
+   }
+
+   return { userGroupId };
+}

package/src/commands/rm.ts

@@ -5,7 +5,9 @@ import { deleteGroup } from "./group/deletegroup";
 import { removeMember } from "./group/removemember";
 import { deleteGroupAccessToken } from "./groupaccesstoken/deleteToken";
 import { deletePackage } from "./package/deletepackage";
-import { deleteProject } from "./project/deleteproject";
+import { deleteEnvironment } from "./environment/deleteenvironment";
+import { warnProjectDeprecated } from "./legacy";
+import { deletePermission } from "./permission/deletepermission";
 
 export const registerRmCommands = (cli: Command, environment: Environment) => {
    const rm = cli
@@ -13,6 +15,34 @@ export const registerRmCommands = (cli: Command, environment: Environment) => {
       .description("Remove a resource")
       .argument("<resource>", "The resource to remove");
 
+   rm.command("permission")
+      .description(
+         "Revoke a user or group's permission on the organization, an environment, or a package.",
+      )
+      .argument(
+         "<userGroupId>",
+         "Whose permission to revoke [user:{email}|group:{groupName}|user:*]",
+      )
+      .option(
+         "--environment <environmentName>",
+         "Revoke the permission on this environment instead of the organization.",
+      )
+      .option(
+         "--package <packageName>",
+         "Revoke the permission on this package. Uses --environment, or the current environment.",
+      )
+      .option("--debug")
+      .option("-y, --yes", "Skip confirmation.")
+      .action((userGroupId, options) => {
+         deletePermission(
+            controlPlanesByEnv[environment],
+            userGroupId,
+            options.debug || false,
+            options.yes === true,
+            { environment: options.environment, package: options.package },
+         );
+      });
+
    rm.command("package")
       .description("Delete a package.")
       .argument("<packageName>", "The name of the package to delete.")
@@ -27,18 +57,33 @@ export const registerRmCommands = (cli: Command, environment: Environment) => {
          );
       });
 
+   const rmEnvironmentAction = (
+      environmentName: string,
+      options: { debug?: boolean; yes?: boolean },
+   ) => {
+      deleteEnvironment(
+         controlPlanesByEnv[environment],
+         environmentName,
+         options.debug,
+         options.yes,
+      );
+   };
+
+   rm.command("environment")
+      .description("Delete an environment.")
+      .argument("<environmentName>", "The name of the environment to delete.")
+      .option("--debug")
+      .option("-y, --yes", "Skip confirmation.")
+      .action(rmEnvironmentAction);
+
    rm.command("project")
-      .description("Delete a project.")
-      .argument("<projectName>", "The name of the project to delete.")
+      .description("[deprecated] Alias for 'rm environment'.")
+      .argument("<projectName>", "The name of the environment to delete.")
       .option("--debug")
       .option("-y, --yes", "Skip confirmation.")
       .action((projectName, options) => {
-         deleteProject(
-            controlPlanesByEnv[environment],
-            projectName,
-            options.debug,
-            options.yes,
-         );
+         warnProjectDeprecated("rm environment");
+         rmEnvironmentAction(projectName, options);
       });
 
    rm.command("connection")

package/src/commands/set.ts

@@ -1,5 +1,6 @@
 import { Command } from "commander";
-import { setProject } from "./project/setproject";
+import { setEnvironment } from "./environment/setenvironment";
+import { warnProjectDeprecated } from "./legacy";
 
 export const registerSetCommands = (cli: Command) => {
    const set = cli
@@ -7,10 +8,18 @@ export const registerSetCommands = (cli: Command) => {
       .description("Set a resource")
       .argument("<resource>", "The resource to set");
 
+   set.command("environment")
+      .description("Set the default environment.")
+      .argument("<environmentName>", "The name of the environment to set.")
+      .action(setEnvironment);
+
    set.command("project")
-      .description("Set the default project.")
-      .argument("<projectName>", "The name of the project to set.")
-      .action(setProject);
+      .description("[deprecated] Alias for 'set environment'.")
+      .argument("<projectName>", "The name of the environment to set.")
+      .action((projectName) => {
+         warnProjectDeprecated("set environment");
+         setEnvironment(projectName);
+      });
 
    // TODO: It would be nice to `cred set org` and avoid logging again when switching orgs.
 };