@credibledata/cred-cli 0.0.102 → 0.0.103

package/src/commands/permission/createpermission.spec.ts

@@ -0,0 +1,507 @@
+import { expect } from "chai";
+import sinon from "sinon";
+import {
+   EnvironmentPermissionsApi,
+   OrganizationPermissionsApi,
+   PackagePermissionsApi,
+} from "../../client/api";
+import { ClientConfiguration } from "../../clientconfiguration";
+import { logger } from "../../logger";
+import * as utils from "../../utils";
+import { createPermission } from "./createpermission";
+
+describe("add-permission", () => {
+   let sandbox: sinon.SinonSandbox;
+   let createOrgStub: sinon.SinonStub;
+   let createEnvStub: sinon.SinonStub;
+   let createPkgStub: sinon.SinonStub;
+   let loggerStub: sinon.SinonStubbedInstance<typeof logger>;
+   let consoleLogStub: sinon.SinonStub;
+   let processExitStub: sinon.SinonStub;
+   let confirmStub: sinon.SinonStub;
+
+   beforeEach(() => {
+      sandbox = sinon.createSandbox();
+      createOrgStub = sandbox.stub().resolves({ data: {} });
+      createEnvStub = sandbox.stub().resolves({ data: {} });
+      createPkgStub = sandbox.stub().resolves({ data: {} });
+      loggerStub = sandbox.stub(logger);
+      consoleLogStub = sandbox.stub(console, "log");
+      processExitStub = sandbox.stub(process, "exit");
+      confirmStub = sandbox.stub(utils, "getConfirmation").resolves(true);
+
+      sandbox
+         .stub(ClientConfiguration.prototype, "getOrganization")
+         .returns("test-org");
+      sandbox
+         .stub(ClientConfiguration.prototype, "getProject")
+         .returns("configured-env");
+      sandbox
+         .stub(ClientConfiguration.prototype, "doesConfigExists")
+         .returns(true);
+      sandbox
+         .stub(ClientConfiguration.prototype, "getAuthenticationHeader")
+         .returns("Bearer test-token");
+
+      sandbox
+         .stub(
+            OrganizationPermissionsApi.prototype,
+            "createOrganizationPermission",
+         )
+         .callsFake(createOrgStub);
+      sandbox
+         .stub(
+            EnvironmentPermissionsApi.prototype,
+            "createEnvironmentPermission",
+         )
+         .callsFake(createEnvStub);
+      sandbox
+         .stub(PackagePermissionsApi.prototype, "createPackagePermission")
+         .callsFake(createPkgStub);
+   });
+
+   afterEach(() => {
+      sandbox.restore();
+   });
+
+   it("grants a group an organization role", async () => {
+      await createPermission(
+         "http://test-server",
+         "group:ci-bot",
+         "admin",
+         false,
+         {
+            yes: true,
+         },
+      );
+
+      expect(createOrgStub.calledOnce).to.be.true;
+      expect(createOrgStub.firstCall.args[0]).to.equal("test-org");
+      // The subject must reach the API as the typed string. A group sent as a
+      // UserGroupId object or as a bare name addresses no tuple, so the grant
+      // would report success while leaving the group without the role.
+      expect(createOrgStub.firstCall.args[2]).to.deep.equal({
+         userGroupId: "group:ci-bot",
+         permission: "admin",
+      });
+      expect(createOrgStub.firstCall.args[3]).to.deep.include({
+         baseURL: "http://test-server",
+         headers: { Authorization: "Bearer test-token" },
+      });
+      expect(createEnvStub.called).to.be.false;
+      expect(createPkgStub.called).to.be.false;
+   });
+
+   it("grants a user an organization role", async () => {
+      await createPermission(
+         "http://test-server",
+         "user:someone@example.com",
+         "member",
+         false,
+         { yes: true },
+      );
+
+      expect(createOrgStub.firstCall.args[2]).to.deep.equal({
+         userGroupId: "user:someone@example.com",
+         permission: "member",
+      });
+   });
+
+   it("grants on an environment when one is named", async () => {
+      await createPermission(
+         "http://test-server",
+         "group:ci-bot",
+         "viewer",
+         false,
+         {
+            environment: "sales",
+         },
+      );
+
+      expect(createEnvStub.calledOnce).to.be.true;
+      expect(createEnvStub.firstCall.args[0]).to.equal("test-org");
+      expect(createEnvStub.firstCall.args[1]).to.equal("sales");
+      expect(createEnvStub.firstCall.args[4]).to.deep.equal({
+         userGroupId: "group:ci-bot",
+         permission: "viewer",
+      });
+      expect(createOrgStub.called).to.be.false;
+   });
+
+   it("grants on a package, taking the environment from the config", async () => {
+      await createPermission(
+         "http://test-server",
+         "group:ci-bot",
+         "viewer",
+         false,
+         {
+            package: "orders",
+         },
+      );
+
+      expect(createPkgStub.calledOnce).to.be.true;
+      expect(createPkgStub.firstCall.args[1]).to.equal("configured-env");
+      expect(createPkgStub.firstCall.args[2]).to.equal("orders");
+      expect(createPkgStub.firstCall.args[5]).to.deep.equal({
+         userGroupId: "group:ci-bot",
+         permission: "viewer",
+      });
+   });
+
+   it("prefers an explicit environment over the configured one for a package", async () => {
+      await createPermission(
+         "http://test-server",
+         "group:ci-bot",
+         "viewer",
+         false,
+         {
+            environment: "explicit-env",
+            package: "orders",
+         },
+      );
+
+      expect(createPkgStub.firstCall.args[1]).to.equal("explicit-env");
+   });
+
+   it("rejects a role the organization does not define", async () => {
+      // viewer belongs to environments and packages; the organization ends in member.
+      await createPermission(
+         "http://test-server",
+         "group:ci-bot",
+         "viewer",
+         false,
+         {
+            yes: true,
+         },
+      );
+
+      expect(createOrgStub.called).to.be.false;
+      expect(processExitStub.calledWith(1)).to.be.true;
+      expect(loggerStub.error.calledWith(sinon.match("Invalid role 'viewer'")))
+         .to.be.true;
+   });
+
+   it("rejects a role an environment does not define", async () => {
+      await createPermission(
+         "http://test-server",
+         "group:ci-bot",
+         "member",
+         false,
+         {
+            environment: "sales",
+         },
+      );
+
+      expect(createEnvStub.called).to.be.false;
+      expect(processExitStub.calledWith(1)).to.be.true;
+   });
+
+   it("rejects public access as an environment admin", async () => {
+      await createPermission("http://test-server", "user:*", "admin", false, {
+         environment: "sales",
+      });
+
+      expect(createEnvStub.called).to.be.false;
+      expect(processExitStub.calledWith(1)).to.be.true;
+   });
+
+   it("allows public access as an environment viewer", async () => {
+      await createPermission("http://test-server", "user:*", "viewer", false, {
+         environment: "sales",
+      });
+
+      expect(createEnvStub.calledOnce).to.be.true;
+      expect(createEnvStub.firstCall.args[4]).to.deep.equal({
+         userGroupId: "user:*",
+         permission: "viewer",
+      });
+   });
+
+   it("allows public access as an organization modeler", async () => {
+      // The one organization role the model admits for the wildcard.
+      await createPermission("http://test-server", "user:*", "modeler", false, {
+         yes: true,
+      });
+
+      expect(createOrgStub.calledOnce).to.be.true;
+      expect(createOrgStub.firstCall.args[2]).to.deep.equal({
+         userGroupId: "user:*",
+         permission: "modeler",
+      });
+   });
+
+   it("rejects every public-access role the model does not admit", async () => {
+      // Each of these reaches OpenFGA and fails there as a model validation
+      // error, so the refusal belongs before the request.
+      const cases: [string, Record<string, unknown>][] = [
+         ["admin", { yes: true }],
+         ["member", { yes: true }],
+         ["modeler", { environment: "sales" }],
+         ["admin", { environment: "sales" }],
+         ["modeler", { environment: "sales", package: "orders" }],
+      ];
+
+      for (const [role, options] of cases) {
+         createOrgStub.resetHistory();
+         createEnvStub.resetHistory();
+         createPkgStub.resetHistory();
+         processExitStub.resetHistory();
+
+         await createPermission(
+            "http://test-server",
+            "user:*",
+            role,
+            false,
+            options,
+         );
+
+         const sent =
+            createOrgStub.called ||
+            createEnvStub.called ||
+            createPkgStub.called;
+         expect(sent, `public access with ${role} must not be sent`).to.be
+            .false;
+         expect(processExitStub.calledWith(1)).to.be.true;
+      }
+   });
+
+   it("rejects an empty --environment instead of widening to the organization", async () => {
+      // `--environment "$UNSET"` must not be read as "no environment given":
+      // that would grant on the organization, which is wider than asked for.
+      await createPermission(
+         "http://test-server",
+         "group:ci-bot",
+         "admin",
+         false,
+         {
+            environment: "",
+            yes: true,
+         },
+      );
+
+      expect(createOrgStub.called).to.be.false;
+      expect(createEnvStub.called).to.be.false;
+      expect(processExitStub.calledWith(1)).to.be.true;
+      expect(loggerStub.error.calledWith(sinon.match("--environment"))).to.be
+         .true;
+   });
+
+   it("rejects an empty --package instead of widening to the environment", async () => {
+      await createPermission(
+         "http://test-server",
+         "group:ci-bot",
+         "viewer",
+         false,
+         {
+            environment: "sales",
+            package: "",
+         },
+      );
+
+      expect(createPkgStub.called).to.be.false;
+      expect(createEnvStub.called).to.be.false;
+      expect(processExitStub.calledWith(1)).to.be.true;
+   });
+
+   it("rejects a package role the server cannot write", async () => {
+      // A package reports admin and modeler because they are inherited from the
+      // environment, but only viewer is directly assignable there.
+      for (const role of ["admin", "modeler"]) {
+         createPkgStub.resetHistory();
+         processExitStub.resetHistory();
+
+         await createPermission(
+            "http://test-server",
+            "group:ci-bot",
+            role,
+            false,
+            {
+               environment: "sales",
+               package: "orders",
+            },
+         );
+
+         expect(createPkgStub.called, `role ${role} must not be sent`).to.be
+            .false;
+         expect(processExitStub.calledWith(1)).to.be.true;
+      }
+   });
+
+   it("rejects a subject with no type", async () => {
+      await createPermission("http://test-server", "ci-bot", "admin", false, {
+         yes: true,
+      });
+
+      expect(createOrgStub.called).to.be.false;
+      expect(processExitStub.calledWith(1)).to.be.true;
+   });
+
+   it("confirms before granting organization admin", async () => {
+      confirmStub.resolves(false);
+
+      await createPermission(
+         "http://test-server",
+         "group:ci-bot",
+         "admin",
+         false,
+         {},
+      );
+
+      expect(confirmStub.calledOnce).to.be.true;
+      expect(createOrgStub.called).to.be.false;
+      expect(loggerStub.info.calledWith(sinon.match("Operation cancelled"))).to
+         .be.true;
+   });
+
+   it("does not confirm for a narrower organization role", async () => {
+      await createPermission(
+         "http://test-server",
+         "group:ci-bot",
+         "modeler",
+         false,
+         {},
+      );
+
+      expect(confirmStub.called).to.be.false;
+      expect(createOrgStub.calledOnce).to.be.true;
+   });
+
+   it("refuses --notifyPeople at the organization scope", async () => {
+      // The organization endpoint has no notify parameter and always sends, so
+      // accepting the flag there would promise control that does not exist.
+      await createPermission(
+         "http://test-server",
+         "group:ci-bot",
+         "admin",
+         false,
+         {
+            notifyPeople: true,
+            yes: true,
+         },
+      );
+
+      expect(createOrgStub.called).to.be.false;
+      expect(processExitStub.calledWith(1)).to.be.true;
+      expect(loggerStub.error.calledWith(sinon.match("--notifyPeople"))).to.be
+         .true;
+   });
+
+   it("accepts --notifyPeople on an environment", async () => {
+      await createPermission(
+         "http://test-server",
+         "group:ci-bot",
+         "viewer",
+         false,
+         {
+            environment: "sales",
+            notifyPeople: true,
+         },
+      );
+
+      expect(createEnvStub.calledOnce).to.be.true;
+      expect(createEnvStub.firstCall.args[3]).to.equal(true);
+   });
+
+   it("defaults notifyPeople to false", async () => {
+      await createPermission(
+         "http://test-server",
+         "group:ci-bot",
+         "viewer",
+         false,
+         {
+            environment: "sales",
+         },
+      );
+
+      expect(createEnvStub.firstCall.args[3]).to.equal(false);
+   });
+
+   it("handles missing config", async () => {
+      sandbox.restore();
+      sandbox = sinon.createSandbox();
+      createOrgStub = sandbox.stub();
+      loggerStub = sandbox.stub(logger);
+      sandbox.stub(console, "log");
+      processExitStub = sandbox.stub(process, "exit");
+      sandbox
+         .stub(ClientConfiguration.prototype, "doesConfigExists")
+         .returns(false);
+      sandbox
+         .stub(
+            OrganizationPermissionsApi.prototype,
+            "createOrganizationPermission",
+         )
+         .callsFake(createOrgStub);
+
+      await createPermission(
+         "http://test-server",
+         "group:ci-bot",
+         "admin",
+         false,
+         {
+            yes: true,
+         },
+      );
+
+      expect(createOrgStub.called).to.be.false;
+      expect(
+         loggerStub.error.calledWith(
+            sinon.match("Please, make sure that you are logged in"),
+         ),
+      ).to.be.true;
+   });
+
+   it("handles a missing organization", async () => {
+      sandbox.restore();
+      sandbox = sinon.createSandbox();
+      createOrgStub = sandbox.stub();
+      loggerStub = sandbox.stub(logger);
+      sandbox.stub(console, "log");
+      processExitStub = sandbox.stub(process, "exit");
+      sandbox
+         .stub(ClientConfiguration.prototype, "doesConfigExists")
+         .returns(true);
+      sandbox
+         .stub(ClientConfiguration.prototype, "getOrganization")
+         .returns(undefined);
+      sandbox
+         .stub(
+            OrganizationPermissionsApi.prototype,
+            "createOrganizationPermission",
+         )
+         .callsFake(createOrgStub);
+
+      await createPermission(
+         "http://test-server",
+         "group:ci-bot",
+         "admin",
+         false,
+         {
+            yes: true,
+         },
+      );
+
+      expect(createOrgStub.called).to.be.false;
+      expect(loggerStub.error.calledWith(sinon.match("No organization set"))).to
+         .be.true;
+   });
+
+   it("exits non-zero when the API fails", async () => {
+      createOrgStub.rejects(new Error("API Error"));
+
+      await createPermission(
+         "http://test-server",
+         "group:ci-bot",
+         "admin",
+         false,
+         {
+            yes: true,
+         },
+      );
+
+      expect(processExitStub.calledWith(1)).to.be.true;
+      expect(
+         loggerStub.error.calledWith(sinon.match("Failed to grant permission")),
+      ).to.be.true;
+   });
+});

package/src/commands/permission/createpermission.ts

@@ -0,0 +1,181 @@
+import {
+   EnvironmentPermissionPermissionEnum,
+   EnvironmentPermissionsApi,
+   OrganizationPermissionPermissionEnum,
+   OrganizationPermissionsApi,
+   PackagePermissionPermissionEnum,
+   PackagePermissionsApi,
+} from "../../client/api";
+import { Configuration } from "../../client/configuration";
+import { ClientConfiguration } from "../../clientconfiguration";
+import { logger } from "../../logger";
+import { getConfirmation, printOutError } from "../../utils";
+import {
+   describeScope,
+   parseSubject,
+   PermissionScope,
+   resolveScope,
+   ScopeOptions,
+   validateRole,
+} from "./scope";
+
+const organizationPermissionsApi = new OrganizationPermissionsApi(
+   new Configuration(),
+);
+const environmentPermissionsApi = new EnvironmentPermissionsApi(
+   new Configuration(),
+);
+const packagePermissionsApi = new PackagePermissionsApi(new Configuration());
+
+export type CreatePermissionOptions = ScopeOptions & {
+   notifyPeople?: boolean;
+   yes?: boolean;
+};
+
+export async function createPermission(
+   controlPlane: string,
+   userGroupIdValue: string,
+   role: string,
+   debug: boolean,
+   options: CreatePermissionOptions,
+) {
+   const clientConfig = new ClientConfiguration();
+
+   if (!clientConfig.doesConfigExists()) {
+      logger.error("Please, make sure that you are logged in");
+      return;
+   }
+
+   const organizationName = clientConfig.getOrganization();
+   if (!organizationName) {
+      logger.error("No organization set. Please login or set an organization.");
+      return;
+   }
+
+   const resolved = resolveScope(options, clientConfig.getProject());
+   if ("error" in resolved) {
+      logger.error(resolved.error);
+      process.exit(1);
+      return;
+   }
+
+   const roleError = validateRole(resolved.scope, role);
+   if (roleError) {
+      logger.error(roleError);
+      process.exit(1);
+      return;
+   }
+
+   // The organization create endpoint takes no notify parameter and the service
+   // always sends, so honoring this flag there is not possible and ignoring it
+   // would be a false promise in both directions -- the default would email and
+   // passing it would not stop that.
+   if (
+      options.notifyPeople === true &&
+      resolved.scope === PermissionScope.ORGANIZATION
+   ) {
+      logger.error(
+         "--notifyPeople applies to an environment or a package. An organization grant always notifies a user subject.",
+      );
+      process.exit(1);
+      return;
+   }
+
+   const subject = parseSubject(resolved.scope, role, userGroupIdValue);
+   if ("error" in subject) {
+      logger.error(subject.error);
+      process.exit(1);
+      return;
+   }
+   const userGroupId = subject.userGroupId.getValue();
+
+   const target = describeScope(organizationName, resolved);
+
+   // Organization admin is the organization's broadest role: it reaches every
+   // environment and package, can read member details, and can mint further
+   // group access tokens. Granting it to a group grants it to every token that
+   // group holds, so it is confirmed rather than applied silently.
+   if (
+      resolved.scope === PermissionScope.ORGANIZATION &&
+      role === "admin" &&
+      !options.yes
+   ) {
+      const confirmation = await getConfirmation(
+         `Grant ${userGroupId} the admin role on ${target}? This reaches every environment and package in the organization, and allows creating further group access tokens.`,
+      );
+      if (!confirmation) {
+         logger.info("Operation cancelled.");
+         return;
+      }
+   }
+
+   logger.info(`Granting ${role} permission to ${userGroupId} on ${target}`);
+
+   const requestOptions = {
+      baseURL: controlPlane,
+      headers: {
+         Authorization: clientConfig.getAuthenticationHeader(),
+      },
+   };
+   const notifyPeople = options.notifyPeople === true;
+
+   try {
+      let data: unknown;
+      switch (resolved.scope) {
+         case PermissionScope.PACKAGE: {
+            const response =
+               await packagePermissionsApi.createPackagePermission(
+                  organizationName,
+                  resolved.environmentName as string,
+                  resolved.packageName as string,
+                  false,
+                  notifyPeople,
+                  {
+                     userGroupId,
+                     permission: role as PackagePermissionPermissionEnum,
+                  },
+                  requestOptions,
+               );
+            data = response.data;
+            break;
+         }
+         case PermissionScope.ENVIRONMENT: {
+            const response =
+               await environmentPermissionsApi.createEnvironmentPermission(
+                  organizationName,
+                  resolved.environmentName as string,
+                  false,
+                  notifyPeople,
+                  {
+                     userGroupId,
+                     permission: role as EnvironmentPermissionPermissionEnum,
+                  },
+                  requestOptions,
+               );
+            data = response.data;
+            break;
+         }
+         default: {
+            const response =
+               await organizationPermissionsApi.createOrganizationPermission(
+                  organizationName,
+                  false,
+                  {
+                     userGroupId,
+                     permission: role as OrganizationPermissionPermissionEnum,
+                  },
+                  requestOptions,
+               );
+            data = response.data;
+            break;
+         }
+      }
+
+      console.log(JSON.stringify(data, null, 2));
+      logger.info("Permission granted successfully");
+   } catch (error) {
+      logger.error("Failed to grant permission");
+      printOutError(error, debug);
+      process.exit(1);
+   }
+}