@credibledata/cred-cli 0.0.102 → 0.0.103

package/src/commands/permission/deletepermission.ts

@@ -0,0 +1,117 @@
+import {
+   EnvironmentPermissionsApi,
+   OrganizationPermissionsApi,
+   PackagePermissionsApi,
+} from "../../client/api";
+import { Configuration } from "../../client/configuration";
+import { ClientConfiguration } from "../../clientconfiguration";
+import { UserGroupId } from "../../common/UserGroupId";
+import { logger } from "../../logger";
+import { getConfirmation, printOutError } from "../../utils";
+import {
+   describeScope,
+   PermissionScope,
+   resolveScope,
+   ScopeOptions,
+} from "./scope";
+
+const organizationPermissionsApi = new OrganizationPermissionsApi(
+   new Configuration(),
+);
+const environmentPermissionsApi = new EnvironmentPermissionsApi(
+   new Configuration(),
+);
+const packagePermissionsApi = new PackagePermissionsApi(new Configuration());
+
+export async function deletePermission(
+   controlPlane: string,
+   userGroupIdValue: string,
+   debug: boolean,
+   autoConfirm: boolean,
+   options: ScopeOptions,
+) {
+   const clientConfig = new ClientConfiguration();
+
+   if (!clientConfig.doesConfigExists()) {
+      logger.error("Please, make sure that you are logged in");
+      return;
+   }
+
+   const organizationName = clientConfig.getOrganization();
+   if (!organizationName) {
+      logger.error("No organization set. Please login or set an organization.");
+      return;
+   }
+
+   const resolved = resolveScope(options, clientConfig.getProject());
+   if ("error" in resolved) {
+      logger.error(resolved.error);
+      process.exit(1);
+      return;
+   }
+
+   let userGroupId: string;
+   try {
+      userGroupId = new UserGroupId(userGroupIdValue).getValue();
+   } catch (e) {
+      logger.error((e as Error).message);
+      process.exit(1);
+      return;
+   }
+
+   const target = describeScope(organizationName, resolved);
+
+   if (!autoConfirm) {
+      const confirmation = await getConfirmation(
+         `Are you sure that you want to revoke ${userGroupId}'s permission on ${target}?`,
+      );
+      if (!confirmation) {
+         logger.info("Operation cancelled.");
+         return;
+      }
+   }
+
+   logger.info(`Revoking permission for ${userGroupId} on ${target}`);
+
+   const requestOptions = {
+      baseURL: controlPlane,
+      headers: {
+         Authorization: clientConfig.getAuthenticationHeader(),
+      },
+   };
+
+   try {
+      switch (resolved.scope) {
+         case PermissionScope.PACKAGE:
+            await packagePermissionsApi.deletePackagePermission(
+               organizationName,
+               resolved.environmentName as string,
+               resolved.packageName as string,
+               userGroupId,
+               requestOptions,
+            );
+            break;
+         case PermissionScope.ENVIRONMENT:
+            await environmentPermissionsApi.deleteEnvironmentPermission(
+               organizationName,
+               resolved.environmentName as string,
+               userGroupId,
+               requestOptions,
+            );
+            break;
+         default:
+            await organizationPermissionsApi.deleteOrganizationPermission(
+               organizationName,
+               userGroupId,
+               requestOptions,
+            );
+            break;
+      }
+
+      logger.info("Permission revoked successfully");
+   } catch (error) {
+      logger.error("Failed to revoke permission");
+      printOutError(error, debug);
+      process.exit(1);
+   }
+}

package/src/commands/permission/getpermission.ts

@@ -0,0 +1,115 @@
+import {
+   EnvironmentPermissionsApi,
+   OrganizationPermissionsApi,
+   PackagePermissionsApi,
+} from "../../client/api";
+import { Configuration } from "../../client/configuration";
+import { ClientConfiguration } from "../../clientconfiguration";
+import { UserGroupId } from "../../common/UserGroupId";
+import { logger } from "../../logger";
+import { printOutError } from "../../utils";
+import {
+   describeScope,
+   PermissionScope,
+   resolveScope,
+   ScopeOptions,
+} from "./scope";
+
+const organizationPermissionsApi = new OrganizationPermissionsApi(
+   new Configuration(),
+);
+const environmentPermissionsApi = new EnvironmentPermissionsApi(
+   new Configuration(),
+);
+const packagePermissionsApi = new PackagePermissionsApi(new Configuration());
+
+export async function getPermission(
+   controlPlane: string,
+   userGroupIdValue: string,
+   debug: boolean,
+   options: ScopeOptions,
+) {
+   const clientConfig = new ClientConfiguration();
+
+   if (!clientConfig.doesConfigExists()) {
+      logger.error("Please, make sure that you are logged in");
+      return;
+   }
+
+   const organizationName = clientConfig.getOrganization();
+   if (!organizationName) {
+      logger.error("No organization set. Please login or set an organization.");
+      return;
+   }
+
+   const resolved = resolveScope(options, clientConfig.getProject());
+   if ("error" in resolved) {
+      logger.error(resolved.error);
+      process.exit(1);
+      return;
+   }
+
+   let userGroupId: string;
+   try {
+      userGroupId = new UserGroupId(userGroupIdValue).getValue();
+   } catch (e) {
+      logger.error((e as Error).message);
+      process.exit(1);
+      return;
+   }
+
+   logger.info(
+      `Getting permission for ${userGroupId} on ${describeScope(organizationName, resolved)}`,
+   );
+
+   const requestOptions = {
+      baseURL: controlPlane,
+      headers: {
+         Authorization: clientConfig.getAuthenticationHeader(),
+      },
+   };
+
+   try {
+      let data: unknown;
+      switch (resolved.scope) {
+         case PermissionScope.PACKAGE: {
+            const response = await packagePermissionsApi.getPackagePermission(
+               organizationName,
+               resolved.environmentName as string,
+               resolved.packageName as string,
+               userGroupId,
+               requestOptions,
+            );
+            data = response.data;
+            break;
+         }
+         case PermissionScope.ENVIRONMENT: {
+            const response =
+               await environmentPermissionsApi.getEnvironmentPermission(
+                  organizationName,
+                  resolved.environmentName as string,
+                  userGroupId,
+                  requestOptions,
+               );
+            data = response.data;
+            break;
+         }
+         default: {
+            const response =
+               await organizationPermissionsApi.getOrganizationPermission(
+                  organizationName,
+                  userGroupId,
+                  requestOptions,
+               );
+            data = response.data;
+            break;
+         }
+      }
+
+      console.log(JSON.stringify(data, null, 2));
+   } catch (error) {
+      logger.error("Failed to get permission");
+      printOutError(error, debug);
+      process.exit(1);
+   }
+}

package/src/commands/permission/listpermissions.ts

@@ -0,0 +1,101 @@
+import {
+   EnvironmentPermissionsApi,
+   OrganizationPermissionsApi,
+   PackagePermissionsApi,
+} from "../../client/api";
+import { Configuration } from "../../client/configuration";
+import { ClientConfiguration } from "../../clientconfiguration";
+import { logger } from "../../logger";
+import { printOutError } from "../../utils";
+import {
+   describeScope,
+   PermissionScope,
+   resolveScope,
+   ScopeOptions,
+} from "./scope";
+
+const organizationPermissionsApi = new OrganizationPermissionsApi(
+   new Configuration(),
+);
+const environmentPermissionsApi = new EnvironmentPermissionsApi(
+   new Configuration(),
+);
+const packagePermissionsApi = new PackagePermissionsApi(new Configuration());
+
+export async function listPermissions(
+   controlPlane: string,
+   debug: boolean,
+   options: ScopeOptions,
+) {
+   const clientConfig = new ClientConfiguration();
+
+   if (!clientConfig.doesConfigExists()) {
+      logger.error("Please, make sure that you are logged in");
+      return;
+   }
+
+   const organizationName = clientConfig.getOrganization();
+   if (!organizationName) {
+      logger.error("No organization set. Please login or set an organization.");
+      return;
+   }
+
+   const resolved = resolveScope(options, clientConfig.getProject());
+   if ("error" in resolved) {
+      logger.error(resolved.error);
+      process.exit(1);
+      return;
+   }
+
+   logger.info(
+      `Listing permissions on ${describeScope(organizationName, resolved)}`,
+   );
+
+   const requestOptions = {
+      baseURL: controlPlane,
+      headers: {
+         Authorization: clientConfig.getAuthenticationHeader(),
+      },
+   };
+
+   try {
+      let data: unknown;
+      switch (resolved.scope) {
+         case PermissionScope.PACKAGE: {
+            const response = await packagePermissionsApi.listPackagePermissions(
+               organizationName,
+               resolved.environmentName as string,
+               resolved.packageName as string,
+               requestOptions,
+            );
+            data = response.data;
+            break;
+         }
+         case PermissionScope.ENVIRONMENT: {
+            const response =
+               await environmentPermissionsApi.listEnvironmentPermissions(
+                  organizationName,
+                  resolved.environmentName as string,
+                  requestOptions,
+               );
+            data = response.data;
+            break;
+         }
+         default: {
+            const response =
+               await organizationPermissionsApi.listOrganizationPermissions(
+                  organizationName,
+                  requestOptions,
+               );
+            data = response.data;
+            break;
+         }
+      }
+
+      console.log(JSON.stringify(data, null, 2));
+   } catch (error) {
+      logger.error("Failed to list permissions");
+      printOutError(error, debug);
+      process.exit(1);
+   }
+}

package/src/commands/permission/scope.ts

@@ -0,0 +1,180 @@
+import {
+   EnvironmentPermissionPermissionEnum,
+   OrganizationPermissionPermissionEnum,
+   PackagePermissionPermissionEnum,
+} from "../../client/api";
+import { UserGroupId } from "../../common/UserGroupId";
+
+/**
+ * Which resource a permission is granted on. The organization is the default
+ * because it is the only scope that names no resource of its own.
+ */
+export enum PermissionScope {
+   ORGANIZATION = "organization",
+   ENVIRONMENT = "environment",
+   PACKAGE = "package",
+}
+
+/**
+ * The roles each scope accepts.
+ *
+ * The organization is the odd one out: it ends in `member` where the other two
+ * end in `viewer`. They are not interchangeable, so the sets are listed per
+ * scope rather than shared.
+ *
+ * A package takes `viewer` alone, which is narrower than its schema enum. The
+ * enum carries admin and modeler because a package reports them -- they are
+ * inherited from the environment -- but only viewer is directly assignable, and
+ * the server rejects the other two. Deriving this set from the enum would let
+ * the CLI accept a grant that cannot be written.
+ */
+const ROLES_BY_SCOPE: Record<PermissionScope, readonly string[]> = {
+   [PermissionScope.ORGANIZATION]: Object.values(
+      OrganizationPermissionPermissionEnum,
+   ),
+   [PermissionScope.ENVIRONMENT]: Object.values(
+      EnvironmentPermissionPermissionEnum,
+   ),
+   [PermissionScope.PACKAGE]: [PackagePermissionPermissionEnum.Viewer],
+};
+
+export type ScopeOptions = {
+   environment?: string;
+   package?: string;
+};
+
+/**
+ * The resource a command addresses: the scope plus the names needed to reach
+ * it. `environmentName` is set for both the environment and package scopes,
+ * since a package is addressed through its environment.
+ */
+export type ResolvedScope = {
+   scope: PermissionScope;
+   environmentName?: string;
+   packageName?: string;
+};
+
+export function rolesFor(scope: PermissionScope): readonly string[] {
+   return ROLES_BY_SCOPE[scope];
+}
+
+/**
+ * Works out which resource the options address, reading the environment from
+ * the config when a package is named without one.
+ *
+ * Returns an error rather than guessing when the environment cannot be
+ * resolved: silently falling back to the organization would grant a wider
+ * permission than the caller asked for.
+ */
+export function resolveScope(
+   options: ScopeOptions,
+   configuredEnvironment: string | undefined,
+): ResolvedScope | { error: string } {
+   // An option that was passed but is empty -- `--environment "$UNSET_VAR"` --
+   // is a mistake, not an omission. Treating it as absent would widen the grant
+   // to the next scope out, which is the outcome this function exists to refuse,
+   // so it is reported rather than interpreted.
+   for (const name of ["environment", "package"] as const) {
+      const value = options[name];
+      if (value !== undefined && value.trim() === "") {
+         return { error: `--${name} was given an empty value.` };
+      }
+   }
+
+   if (options.package) {
+      const environmentName = options.environment || configuredEnvironment;
+      if (!environmentName) {
+         return {
+            error: "A package permission needs an environment. Pass --environment, or set one with 'cred set environment <name>'.",
+         };
+      }
+      return {
+         scope: PermissionScope.PACKAGE,
+         environmentName,
+         packageName: options.package,
+      };
+   }
+
+   if (options.environment) {
+      return {
+         scope: PermissionScope.ENVIRONMENT,
+         environmentName: options.environment,
+      };
+   }
+
+   return { scope: PermissionScope.ORGANIZATION };
+}
+
+/** Names the resource in log lines, so a message says what was addressed. */
+export function describeScope(
+   organizationName: string,
+   resolved: ResolvedScope,
+): string {
+   switch (resolved.scope) {
+      case PermissionScope.PACKAGE:
+         return `package ${organizationName}/${resolved.environmentName}/${resolved.packageName}`;
+      case PermissionScope.ENVIRONMENT:
+         return `environment ${organizationName}/${resolved.environmentName}`;
+      default:
+         return `organization ${organizationName}`;
+   }
+}
+
+/**
+ * Checks a role against the scope it is granted on, so a role the API would
+ * reject fails before the request instead of as an opaque 400.
+ */
+export function validateRole(
+   scope: PermissionScope,
+   role: string,
+): string | null {
+   const allowed = rolesFor(scope);
+   if (!allowed.includes(role)) {
+      return `Invalid role '${role}' for a ${scope} permission. Expected one of: ${allowed.join(", ")}`;
+   }
+   return null;
+}
+
+/**
+ * The roles the authorization model accepts for public access, per scope.
+ *
+ * Narrower than the roles a named subject can hold, and not derivable from
+ * them: the model lists `user:*` on exactly three relations. Anything else
+ * reaches OpenFGA and fails there as a model validation error, so it is listed
+ * rather than special-cased.
+ */
+const PUBLIC_ACCESS_ROLES_BY_SCOPE: Record<PermissionScope, readonly string[]> =
+   {
+      [PermissionScope.ORGANIZATION]: ["modeler"],
+      [PermissionScope.ENVIRONMENT]: ["viewer"],
+      [PermissionScope.PACKAGE]: ["viewer"],
+   };
+
+/**
+ * Parses the subject and checks the roles public access may hold. Everything
+ * else about the subject -- whether a user's email is well formed, whether a
+ * group exists -- is left to the server, which is the authority on it.
+ */
+export function parseSubject(
+   scope: PermissionScope,
+   role: string,
+   value: string,
+): { userGroupId: UserGroupId } | { error: string } {
+   let userGroupId: UserGroupId;
+   try {
+      userGroupId = new UserGroupId(value);
+   } catch (e) {
+      return { error: (e as Error).message };
+   }
+
+   if (userGroupId.isPublicAccess()) {
+      const allowed = PUBLIC_ACCESS_ROLES_BY_SCOPE[scope];
+      if (!allowed.includes(role)) {
+         return {
+            error: `Public access cannot be granted '${role}' on a ${scope}. Expected one of: ${allowed.join(", ")}`,
+         };
+      }
+   }
+
+   return { userGroupId };
+}

package/src/commands/rm.ts

@@ -7,6 +7,7 @@ import { deleteGroupAccessToken } from "./groupaccesstoken/deleteToken";
 import { deletePackage } from "./package/deletepackage";
 import { deleteEnvironment } from "./environment/deleteenvironment";
 import { warnProjectDeprecated } from "./legacy";
+import { deletePermission } from "./permission/deletepermission";
 
 export const registerRmCommands = (cli: Command, environment: Environment) => {
    const rm = cli
@@ -14,6 +15,34 @@ export const registerRmCommands = (cli: Command, environment: Environment) => {
       .description("Remove a resource")
       .argument("<resource>", "The resource to remove");
 
+   rm.command("permission")
+      .description(
+         "Revoke a user or group's permission on the organization, an environment, or a package.",
+      )
+      .argument(
+         "<userGroupId>",
+         "Whose permission to revoke [user:{email}|group:{groupName}|user:*]",
+      )
+      .option(
+         "--environment <environmentName>",
+         "Revoke the permission on this environment instead of the organization.",
+      )
+      .option(
+         "--package <packageName>",
+         "Revoke the permission on this package. Uses --environment, or the current environment.",
+      )
+      .option("--debug")
+      .option("-y, --yes", "Skip confirmation.")
+      .action((userGroupId, options) => {
+         deletePermission(
+            controlPlanesByEnv[environment],
+            userGroupId,
+            options.debug || false,
+            options.yes === true,
+            { environment: options.environment, package: options.package },
+         );
+      });
+
    rm.command("package")
       .description("Delete a package.")
       .argument("<packageName>", "The name of the package to delete.")

package/src/commands/update.ts

@@ -20,40 +20,63 @@ export const registerUpdateCommands = (
          environmentName,
          {
             replicationCount: options.replication,
+            gitModeling: options.gitModeling,
+            gitRepositoryOwner: options.gitRepositoryOwner,
+            gitRepositoryName: options.gitRepositoryName,
+            gitBaseBranch: options.gitBaseBranch,
          },
          options.debug,
          options.yes,
       );
    };
 
-   update
-      .command("environment")
-      .description("Update an environment.")
-      .argument("<environmentName>", "The name of the environment to update.")
-      .option(
-         "--replication <replicationCount>",
-         "The new replication count (must be at least 1).",
-         parseInt,
-      )
-      .option("--debug")
-      .option("-y, --yes", "Skip confirmation.")
-      .action(updateEnvironmentAction);
+   // Declared once and applied to both the environment command and its deprecated
+   // project alias, so the alias cannot drift into accepting a different set.
+   const environmentOptions = (command: Command) =>
+      command
+         .option(
+            "--replication <replicationCount>",
+            "The new replication count (must be at least 1).",
+            parseInt,
+         )
+         .option(
+            "--git-modeling <true|false>",
+            "Enroll (or un-enroll) this environment for git-backed modeling drafts.",
+         )
+         .option(
+            "--git-repository-owner <owner>",
+            "GitHub owner of the repository holding this environment's draft branches.",
+         )
+         .option(
+            "--git-repository-name <name>",
+            "GitHub repository name, paired with --git-repository-owner.",
+         )
+         .option(
+            "--git-base-branch <branch>",
+            'Branch draft branches fork from. Pass "" to all three git-repository options to unset the repository.',
+         )
+         .option("--debug")
+         .option("-y, --yes", "Skip confirmation.");
 
-   update
-      .command("project")
-      .description("[deprecated] Alias for 'update environment'.")
-      .argument("<projectName>", "The name of the environment to update.")
-      .option(
-         "--replication <replicationCount>",
-         "The new replication count (must be at least 1).",
-         parseInt,
-      )
-      .option("--debug")
-      .option("-y, --yes", "Skip confirmation.")
-      .action((projectName, options) => {
-         warnProjectDeprecated("update environment");
-         updateEnvironmentAction(projectName, options);
-      });
+   environmentOptions(
+      update
+         .command("environment")
+         .description("Update an environment.")
+         .argument(
+            "<environmentName>",
+            "The name of the environment to update.",
+         ),
+   ).action(updateEnvironmentAction);
+
+   environmentOptions(
+      update
+         .command("project")
+         .description("[deprecated] Alias for 'update environment'.")
+         .argument("<projectName>", "The name of the environment to update."),
+   ).action((projectName, options) => {
+      warnProjectDeprecated("update environment");
+      updateEnvironmentAction(projectName, options);
+   });
 
    update
       .command("package")

package/src/common/UserGroupId.spec.ts

@@ -107,11 +107,9 @@ describe("UserGroupId", () => {
          expect(id.isPublicAccess()).to.be.false;
       });
 
-      it("should return false for user:* (checks originalValue not resourceName)", () => {
-         // isPublicAccess checks this.originalValue === "*" which is never true
-         // since originalValue is the full string "user:*"
+      it("should return true for user:* (the public-access wildcard)", () => {
          const id = UserGroupId.forPublicAccess();
-         expect(id.isPublicAccess()).to.be.false;
+         expect(id.isPublicAccess()).to.be.true;
       });
    });
 });

package/src/common/UserGroupId.ts

@@ -131,7 +131,7 @@ export class UserGroupId {
 
    public isPublicAccess(): boolean {
       return (
-         this.resourceType === ResourceType.USER && this.originalValue === "*"
+         this.resourceType === ResourceType.USER && this.resourceName === "*"
       );
    }
 }