@credibledata/cred-cli 0.0.100 → 0.0.103

package/src/commands/update.ts

@@ -1,7 +1,9 @@
+/* eslint-disable @typescript-eslint/no-explicit-any */
 import { Command } from "commander";
 import { controlPlanesByEnv, Environment } from "../constants";
 import { updatePackage } from "./package/updatepackage";
-import { updateProject } from "./project/updateproject";
+import { updateEnvironment } from "./environment/updateenvironment";
+import { warnProjectDeprecated } from "./legacy";
 
 export const registerUpdateCommands = (
    cli: Command,
@@ -12,28 +14,69 @@ export const registerUpdateCommands = (
       .description("Update a resource")
       .argument("<resource>", "The resource to update");
 
-   update
-      .command("project")
-      .description("Update a project.")
-      .argument("<projectName>", "The name of the project to update.")
-      .option(
-         "--replication <replicationCount>",
-         "The new replication count (must be at least 1).",
-         parseInt,
-      )
-      .option("--debug")
-      .option("-y, --yes", "Skip confirmation.")
-      .action((projectName, options) => {
-         updateProject(
-            controlPlanesByEnv[environment],
-            projectName,
-            {
-               replicationCount: options.replication,
-            },
-            options.debug,
-            options.yes,
-         );
-      });
+   const updateEnvironmentAction = (environmentName: string, options: any) => {
+      updateEnvironment(
+         controlPlanesByEnv[environment],
+         environmentName,
+         {
+            replicationCount: options.replication,
+            gitModeling: options.gitModeling,
+            gitRepositoryOwner: options.gitRepositoryOwner,
+            gitRepositoryName: options.gitRepositoryName,
+            gitBaseBranch: options.gitBaseBranch,
+         },
+         options.debug,
+         options.yes,
+      );
+   };
+
+   // Declared once and applied to both the environment command and its deprecated
+   // project alias, so the alias cannot drift into accepting a different set.
+   const environmentOptions = (command: Command) =>
+      command
+         .option(
+            "--replication <replicationCount>",
+            "The new replication count (must be at least 1).",
+            parseInt,
+         )
+         .option(
+            "--git-modeling <true|false>",
+            "Enroll (or un-enroll) this environment for git-backed modeling drafts.",
+         )
+         .option(
+            "--git-repository-owner <owner>",
+            "GitHub owner of the repository holding this environment's draft branches.",
+         )
+         .option(
+            "--git-repository-name <name>",
+            "GitHub repository name, paired with --git-repository-owner.",
+         )
+         .option(
+            "--git-base-branch <branch>",
+            'Branch draft branches fork from. Pass "" to all three git-repository options to unset the repository.',
+         )
+         .option("--debug")
+         .option("-y, --yes", "Skip confirmation.");
+
+   environmentOptions(
+      update
+         .command("environment")
+         .description("Update an environment.")
+         .argument(
+            "<environmentName>",
+            "The name of the environment to update.",
+         ),
+   ).action(updateEnvironmentAction);
+
+   environmentOptions(
+      update
+         .command("project")
+         .description("[deprecated] Alias for 'update environment'.")
+         .argument("<projectName>", "The name of the environment to update."),
+   ).action((projectName, options) => {
+      warnProjectDeprecated("update environment");
+      updateEnvironmentAction(projectName, options);
+   });
 
    update
       .command("package")

package/src/commands/version/archive-unarchive-version.spec.ts

@@ -50,7 +50,7 @@ describe("archive-unarchive-version", () => {
 
          expect(axiosStub.calledOnce).to.be.true;
          expect(axiosStub.firstCall.args[0]).to.equal(
-            "http://test-server/organizations/test-org/projects/test-project/packages/test-package/versions/1.0.0",
+            "http://test-server/organizations/test-org/environments/test-project/packages/test-package/versions/1.0.0",
          );
          expect(axiosStub.firstCall.args[1]).to.deep.equal({
             archiveStatus: "archive",
@@ -96,7 +96,7 @@ describe("archive-unarchive-version", () => {
 
          expect(axiosStub.calledOnce).to.be.true;
          expect(axiosStub.firstCall.args[0]).to.equal(
-            "http://test-server/organizations/test-org/projects/test-project/packages/test-package/versions/1.0.0",
+            "http://test-server/organizations/test-org/environments/test-project/packages/test-package/versions/1.0.0",
          );
          expect(axiosStub.firstCall.args[1]).to.deep.equal({
             archiveStatus: "unarchive",
@@ -215,7 +215,7 @@ describe("archive-unarchive-version", () => {
             expect(axiosStub.called).to.be.false;
             expect(
                loggerStub.error.calledWith(
-                  sinon.match("Please, make sure to set a project"),
+                  sinon.match("Please, make sure to set an environment"),
                ),
             ).to.be.true;
          });
@@ -425,7 +425,7 @@ describe("archive-unarchive-version", () => {
             );
 
             expect(axiosStub.firstCall.args[0]).to.equal(
-               "https://api.example.com/organizations/test-org/projects/test-project/packages/my-package/versions/2.0.0",
+               "https://api.example.com/organizations/test-org/environments/test-project/packages/my-package/versions/2.0.0",
             );
          });
 

package/src/commands/version/archive-unarchive-version.ts

@@ -47,15 +47,15 @@ async function updateVersionArchiveStatus(
 ) {
    const clientConfig = new ClientConfiguration();
    const organizationName = clientConfig.getOrganization();
-   const projectName = clientConfig.getProject();
+   const environmentName = clientConfig.getProject();
 
    if (!clientConfig.doesConfigExists()) {
       logger.error("Please, make sure that you are logged in");
       return;
    }
 
-   if (!projectName) {
-      logger.error("Please, make sure to set a project");
+   if (!environmentName) {
+      logger.error("Please, make sure to set an environment");
       return;
    }
 
@@ -81,12 +81,9 @@ async function updateVersionArchiveStatus(
    logger.info(
       `${action === "archive" ? "Archiving" : "Unarchiving"} version ${packageName}/${versionId}`,
    );
-   console.log(
-      `${packageServer}/organizations/${organizationName}/projects/${projectName}/packages/${packageName}/versions/${versionId}`,
-   );
    try {
       const response = await axios.patch(
-         `${packageServer}/organizations/${organizationName}/projects/${projectName}/packages/${packageName}/versions/${versionId}`,
+         `${packageServer}/organizations/${organizationName}/environments/${environmentName}/packages/${packageName}/versions/${versionId}`,
          {
             archiveStatus: action,
          },

package/src/commands/version/listversions.spec.ts

@@ -119,7 +119,7 @@ describe("list-versions", () => {
       expect(listVersionsStub.called).to.be.false;
       expect(
          loggerStub.error.calledWith(
-            sinon.match("Please, make sure to set a project"),
+            sinon.match("Please, make sure to set an environment"),
          ),
       ).to.be.true;
    });

package/src/commands/version/listversions.ts

@@ -13,15 +13,15 @@ export async function listVersions(
 ) {
    const clientConfig = new ClientConfiguration();
    const organizationName = clientConfig.getOrganization();
-   const projectName = clientConfig.getProject();
+   const environmentName = clientConfig.getProject();
 
    if (!clientConfig.doesConfigExists()) {
       logger.error("Please, make sure that you are logged in");
       return;
    }
 
-   if (!projectName) {
-      logger.error("Please, make sure to set a project");
+   if (!environmentName) {
+      logger.error("Please, make sure to set an environment");
       return;
    }
 
@@ -29,7 +29,7 @@ export async function listVersions(
       const packageName = packagePath.replace("/", "");
       const response = await versionsApi.listVersions(
          organizationName,
-         projectName,
+         environmentName,
          packageName,
          {
             baseURL: controlPlane,

package/src/common/UserGroupId.spec.ts

@@ -107,11 +107,9 @@ describe("UserGroupId", () => {
          expect(id.isPublicAccess()).to.be.false;
       });
 
-      it("should return false for user:* (checks originalValue not resourceName)", () => {
-         // isPublicAccess checks this.originalValue === "*" which is never true
-         // since originalValue is the full string "user:*"
+      it("should return true for user:* (the public-access wildcard)", () => {
          const id = UserGroupId.forPublicAccess();
-         expect(id.isPublicAccess()).to.be.false;
+         expect(id.isPublicAccess()).to.be.true;
       });
    });
 });

package/src/common/UserGroupId.ts

@@ -131,7 +131,7 @@ export class UserGroupId {
 
    public isPublicAccess(): boolean {
       return (
-         this.resourceType === ResourceType.USER && this.originalValue === "*"
+         this.resourceType === ResourceType.USER && this.resourceName === "*"
       );
    }
 }

package/src/constants.spec.ts

@@ -0,0 +1,111 @@
+import { expect } from "chai";
+import {
+   CLUSTER_BY_ENVIRONMENT,
+   DEFAULT_ENVIRONMENT_BY_CLUSTER,
+   getAuth0OrganizationIdForCliLogin,
+   getCliOrgConfig,
+} from "./constants";
+
+describe("constants", () => {
+   describe("DEFAULT_ENVIRONMENT_BY_CLUSTER", () => {
+      it("defaults gcp to production", () => {
+         expect(DEFAULT_ENVIRONMENT_BY_CLUSTER.gcp).to.equal("production");
+      });
+
+      it("defaults aws to videoamp", () => {
+         expect(DEFAULT_ENVIRONMENT_BY_CLUSTER.aws).to.equal("videoamp");
+      });
+   });
+
+   describe("CLUSTER_BY_ENVIRONMENT", () => {
+      it("places videoamp on aws", () => {
+         expect(CLUSTER_BY_ENVIRONMENT.videoamp).to.equal("aws");
+      });
+
+      it("places every other env on gcp", () => {
+         expect(CLUSTER_BY_ENVIRONMENT.production).to.equal("gcp");
+         expect(CLUSTER_BY_ENVIRONMENT.staging).to.equal("gcp");
+         expect(CLUSTER_BY_ENVIRONMENT.dev).to.equal("gcp");
+         expect(CLUSTER_BY_ENVIRONMENT.localhost).to.equal("gcp");
+         expect(CLUSTER_BY_ENVIRONMENT["e2e-test"]).to.equal("gcp");
+      });
+
+      it("agrees with DEFAULT_ENVIRONMENT_BY_CLUSTER round-trip", () => {
+         for (const cluster of ["gcp", "aws"] as const) {
+            const defaultEnv = DEFAULT_ENVIRONMENT_BY_CLUSTER[cluster];
+            expect(CLUSTER_BY_ENVIRONMENT[defaultEnv]).to.equal(cluster);
+         }
+      });
+   });
+
+   describe("getCliOrgConfig", () => {
+      it("returns the videoamp registry entry", () => {
+         const cfg = getCliOrgConfig("videoamp");
+         expect(cfg).to.not.be.undefined;
+         expect(cfg!.cliOrgName).to.equal("videoamp");
+      });
+
+      it("lists videoamp's supported clusters and default", () => {
+         const cfg = getCliOrgConfig("videoamp")!;
+         expect(cfg.supportedClusters).to.have.members(["gcp", "aws"]);
+         expect(cfg.defaultCluster).to.be.oneOf(cfg.supportedClusters);
+      });
+
+      it("exposes the aws Auth0 org id for videoamp", () => {
+         const cfg = getCliOrgConfig("videoamp")!;
+         expect(cfg.auth0OrganizationIds?.aws).to.equal("org_nMRKafeSuxOiuJeG");
+      });
+
+      it("is case-insensitive on the org name", () => {
+         expect(getCliOrgConfig("VideoAmp")?.cliOrgName).to.equal("videoamp");
+         expect(getCliOrgConfig("VIDEOAMP")?.cliOrgName).to.equal("videoamp");
+      });
+
+      it("returns undefined for unregistered orgs (default gcp/device-flow path)", () => {
+         expect(getCliOrgConfig("acme")).to.be.undefined;
+         expect(getCliOrgConfig("some-new-customer")).to.be.undefined;
+      });
+
+      it("guarantees defaultCluster is in supportedClusters for every entry", () => {
+         for (const name of ["videoamp"]) {
+            const cfg = getCliOrgConfig(name)!;
+            expect(cfg.supportedClusters).to.include(cfg.defaultCluster);
+         }
+      });
+   });
+
+   describe("getAuth0OrganizationIdForCliLogin", () => {
+      it("returns the aws Auth0 org id when -c aws is the active cluster", () => {
+         expect(getAuth0OrganizationIdForCliLogin("videoamp", "aws")).to.equal(
+            "org_nMRKafeSuxOiuJeG",
+         );
+      });
+
+      it("returns undefined for videoamp on gcp (no aws-only Auth0 id maps to gcp)", () => {
+         expect(getAuth0OrganizationIdForCliLogin("videoamp", "gcp")).to.be
+            .undefined;
+      });
+
+      it("falls back to the org's defaultCluster when no cluster is passed", () => {
+         const cfg = getCliOrgConfig("videoamp")!;
+         const expected = cfg.auth0OrganizationIds?.[cfg.defaultCluster];
+         expect(getAuth0OrganizationIdForCliLogin("videoamp")).to.equal(
+            expected,
+         );
+      });
+
+      it("is case-insensitive on the org name", () => {
+         expect(getAuth0OrganizationIdForCliLogin("VideoAmp", "aws")).to.equal(
+            "org_nMRKafeSuxOiuJeG",
+         );
+      });
+
+      it("returns undefined for unregistered orgs (forces device-code flow)", () => {
+         expect(getAuth0OrganizationIdForCliLogin("acme")).to.be.undefined;
+         expect(getAuth0OrganizationIdForCliLogin("acme", "aws")).to.be
+            .undefined;
+         expect(getAuth0OrganizationIdForCliLogin("acme", "gcp")).to.be
+            .undefined;
+      });
+   });
+});

package/src/constants.ts

@@ -4,7 +4,8 @@ export type Environment =
    | "dev"
    | "localhost"
    | "e2e-test"
-   | "videoamp";
+   | "videoamp"
+   | "aws-dev";
 
 export const controlPlanesByEnv: Record<Environment, string> = {
    production: "https://admin.credibledata.com/api/v0",
@@ -13,6 +14,9 @@ export const controlPlanesByEnv: Record<Environment, string> = {
    localhost: "http://admin.ms2.localhost/api/v0",
    "e2e-test": "http://admin.ms2.localhost/api/v0",
    videoamp: "https://admin.videoamp-aws-us-east-1.credibledata.com/api/v0",
+   // The AWS development cell (credible/dev on EKS). Its public hostnames compose onto the shared
+   // apex as aws-dev-<service>.credibledata.com, unlike videoamp's, which live under its own zone.
+   "aws-dev": "https://aws-dev-admin.credibledata.com/api/v0",
 };
 
 /** Environments that must have an object in `~/.cred` `configPerEnvironment` (avoids undefined on write). */
@@ -61,27 +65,125 @@ export const auth0ConfigsByEnv: Record<
       clientId: "ge8JL5TJNwqy7bygAaJkD92KdluqEZgO",
       audience: "https://ms2data.us.auth0.com/api/v2/",
    },
+   // The DEV Auth0 tenant, not production: this cell takes its per-tier secrets from gcp/credible/dev,
+   // so it authenticates against the same tenant that dev, staging and localhost do. videoamp is the
+   // exception here, being a production cell.
+   "aws-dev": {
+      domain: "https://dev-auth.credibledata.com",
+      clientId: "rr6mzJNj9b104MjCc9xWKPPehq1MJx0L",
+      audience: "https://dev-ohaafogw5p8uyx1m.us.auth0.com/api/v2/",
+   },
+};
+
+/** Clusters a CLI org can target via `cred login <org> -c <cluster>`. */
+export type Cluster = "gcp" | "aws";
+
+/** Which cluster each {@link Environment} lives on. */
+export const CLUSTER_BY_ENVIRONMENT: Record<Environment, Cluster> = {
+   production: "gcp",
+   staging: "gcp",
+   dev: "gcp",
+   localhost: "gcp",
+   "e2e-test": "gcp",
+   videoamp: "aws",
+   "aws-dev": "aws",
 };
 
 /**
- * `cred login <organizationName>` → Auth0 Organization ID for org-branded Universal Login.
+ * Default {@link Environment} to switch to when logging into a cluster and the
+ * current active env is on a different cluster. Picked per cluster so that
+ * `cred login <org> -c aws` flips to videoamp and `-c gcp` flips to production.
+ */
+export const DEFAULT_ENVIRONMENT_BY_CLUSTER: Record<Cluster, Environment> = {
+   gcp: "production",
+   aws: "videoamp",
+};
+
+/**
+ * Per-org CLI login config. One row per org that needs non-default behavior
+ * (multi-cluster support, Auth0 Organizations PKCE, etc.). Orgs not listed here
+ * fall back to: gcp cluster only, Device Authorization Flow, no Auth0 org id.
  *
- * Auth0 documents the `organization` parameter on `/authorize` for Organizations
- * (https://auth0.com/docs/manage-users/organizations/configure-organizations/use-org-name-authentication-api).
- * The Device Authorization Flow documents only `client_id`, `scope`, and `audience` on
- * `POST /oauth/device/code` — not `organization`
+ * Auth0 docs: `organization` is supported on `/authorize` for Organizations
+ * (https://auth0.com/docs/manage-users/organizations/configure-organizations/use-org-name-authentication-api)
+ * but NOT on `POST /oauth/device/code`
  * (https://auth0.com/docs/get-started/authentication-and-authorization-flow/device-authorization-flow/call-your-api-using-the-device-authorization-flow#device-code-parameters),
- * so mapped orgs use Authorization Code + PKCE with `organization` on `/authorize` and
- * {@link AUTH_CLI_LOOPBACK_REDIRECT_URI}.
- *
- * Align with app `ORGANIZATION_HOST_ORG_ID_MAP` / `getAuth0OrganizationAuthorizationParams`.
- *
- * Entries are added when PKCE + Auth0 org id is ready for that CLI name; until then the map may
- * stay empty and `login.spec` stubs {@link getAuth0OrganizationIdForCliLogin} for PKCE coverage.
+ * so orgs with an `auth0OrganizationIds` entry for the active cluster use Auth Code + PKCE via
+ * {@link AUTH_CLI_LOOPBACK_REDIRECT_URI}. Keep aligned with the app's
+ * `ORGANIZATION_HOST_ORG_ID_MAP` / `getAuth0OrganizationAuthorizationParams`.
  */
-export const AUTH0_ORGANIZATION_IDS_BY_CLI_ORG_NAME: Record<string, string> = {
-   // videoamp: "org_nMRKafeSuxOiuJeG",
-};
+export interface CliOrgConfig {
+   /** Lowercase CLI org name (what the user types after `cred login`). */
+   cliOrgName: string;
+   /** Clusters this org can be logged into. */
+   supportedClusters: Cluster[];
+   /** Cluster used when `-c/--cluster` is omitted. Must be in `supportedClusters`. */
+   defaultCluster: Cluster;
+   /**
+    * Auth0 Organization ID per cluster. Presence triggers the PKCE + `organization=<id>`
+    * `/authorize` flow on that cluster; absence falls back to Device Authorization Flow.
+    */
+   auth0OrganizationIds?: Partial<Record<Cluster, string>>;
+}
+
+const CLI_ORG_CONFIGS: CliOrgConfig[] = [
+   {
+      cliOrgName: "videoamp",
+      supportedClusters: ["gcp", "aws"],
+      defaultCluster: "gcp",
+      auth0OrganizationIds: {
+         aws: "org_nMRKafeSuxOiuJeG",
+      },
+   },
+   {
+      // Exists on both clouds -- gcp dev and the aws development cell both have a `demo` org -- so
+      // both are listed. Registered at all only because an UNREGISTERED org is assumed gcp-only
+      // (`supportedClusters ?? ["gcp"]`), which is why `cred login demo` on an aws cell reports the
+      // org as unavailable rather than anything about the cell.
+      //
+      // defaultCluster stays gcp so a bare `cred login demo` behaves exactly as it did before this
+      // entry existed; reach the aws cell with `-c aws`.
+      //
+      // No auth0OrganizationIds: their presence selects the PKCE + loopback flow, whose redirect
+      // (127.0.0.1:18240/callback) is registered on the production Auth0 tenant only. Omitting them
+      // selects the Device Authorization Flow, which needs no callback URL and therefore works on a
+      // cell authenticating against the dev tenant.
+      cliOrgName: "demo",
+      supportedClusters: ["gcp", "aws"],
+      defaultCluster: "gcp",
+   },
+   {
+      // The tenant the PROBES measure, on every cell in both clouds -- probe_organization in
+      // stacks/{aws,gcp}/services. Distinct from `demo` above, which is a cell's own first
+      // organization; a cell has both, and they were seeded by different bootstrap steps.
+      //
+      // Needed for the same reason the `demo` entry is, and missed for a reason worth naming: the
+      // gcp-only fallback (`supportedClusters ?? ["gcp"]`) makes an unregistered org work perfectly
+      // on gcp, so nothing surfaced until an operator tried to reach the fixture on an AWS cell and
+      // got "Organization 'k6-experiments' is not available on the aws cluster" -- a message about
+      // the org, for a fact about this list. Asserted against the recipe by
+      // test_probe_organization_is_reachable_on_its_cells_clusters.
+      //
+      // defaultCluster gcp and no auth0OrganizationIds, both for the reasons given on `demo`: a bare
+      // `cred login k6-experiments` keeps behaving exactly as it did before this entry existed, and
+      // the Device Authorization Flow is the one that works against a cell on the dev Auth0 tenant.
+      cliOrgName: "k6-experiments",
+      supportedClusters: ["gcp", "aws"],
+      defaultCluster: "gcp",
+   },
+];
+
+const CLI_ORG_CONFIGS_BY_NAME: Record<string, CliOrgConfig> =
+   Object.fromEntries(
+      CLI_ORG_CONFIGS.map((c) => [c.cliOrgName.toLowerCase(), c]),
+   );
+
+/** Returns the registry entry for an org, or `undefined` if it uses defaults (gcp + device flow). */
+export function getCliOrgConfig(
+   organizationName: string,
+): CliOrgConfig | undefined {
+   return CLI_ORG_CONFIGS_BY_NAME[organizationName.toLowerCase()];
+}
 
 /**
  * Allowlisted on the Auth0 Native application (CLI) as an Allowed Callback URL for PKCE logins
@@ -89,12 +191,22 @@ export const AUTH0_ORGANIZATION_IDS_BY_CLI_ORG_NAME: Record<string, string> = {
  */
 export const AUTH_CLI_LOOPBACK_REDIRECT_URI = "http://127.0.0.1:18240/callback";
 
+/**
+ * Auth0 Organization ID for the given CLI org on the cluster it is logging into.
+ * Returning a value selects the Auth Code + PKCE branch in `login()`; `undefined`
+ * falls back to Device Authorization Flow.
+ *
+ * `cluster` defaults to the org's `defaultCluster` (or `gcp` for unregistered orgs)
+ * so callers that don't yet know the active cluster keep working.
+ */
 export function getAuth0OrganizationIdForCliLogin(
    organizationName: string,
+   cluster?: Cluster,
 ): string | undefined {
-   return AUTH0_ORGANIZATION_IDS_BY_CLI_ORG_NAME[
-      organizationName.toLowerCase()
-   ];
+   const cfg = getCliOrgConfig(organizationName);
+   if (!cfg) return undefined;
+   const targetCluster = cluster ?? cfg.defaultCluster;
+   return cfg.auth0OrganizationIds?.[targetCluster];
 }
 
 // Time constants in ms