@credibledata/cred-cli 0.0.103 → 0.0.105

package/src/clientconfiguration.ts

@@ -1,364 +0,0 @@
-import crypto from "crypto";
-import fs from "fs";
-import { jwtDecode } from "jwt-decode";
-import kleur from "kleur";
-import os from "os";
-import {
-   ALL_ENVIRONMENTS,
-   ASCII_TITLE,
-   controlPlanesByEnv,
-   Environment,
-} from "./constants";
-import { logger } from "./logger";
-
-interface ConfigFile {
-   configPerEnvironment: Partial<
-      Record<
-         Environment,
-         {
-            organization?: string;
-            project?: string;
-            auth?: { username: string; password: string };
-            vsCodeUser?: {
-               username: string;
-               email: string;
-            };
-            accessToken?: string;
-            jwtAccessToken?: string;
-            refreshToken?: string;
-            isServiceAccountToken?: boolean;
-         }
-      >
-   >;
-   activeEnvironment: Environment;
-}
-
-interface JwtPayload {
-   exp: number;
-   iat?: number;
-   sub?: string;
-}
-
-/**
- * Thrown when `.cred` exists but cannot be used: either it does not parse as
- * JSON or it parses but lacks the required top-level shape. Distinct from fs
- * errors (ENOENT, EACCES) so callers that want to recover — `cred login` —
- * can target *only* a corrupt-content failure and leave permission/IO errors
- * to surface loudly.
- */
-export class InvalidConfigError extends Error {}
-
-export class ClientConfiguration {
-   private configPath = `${os.homedir()}/.cred`;
-   private config: ConfigFile;
-
-   constructor(customConfigPath?: string) {
-      if (customConfigPath) {
-         this.configPath = customConfigPath;
-      }
-   }
-
-   public loadConfig(): ConfigFile {
-      let fileContents: Buffer | undefined;
-      try {
-         fileContents = fs.readFileSync(this.configPath);
-      } catch (error) {
-         if ((error as NodeJS.ErrnoException)?.code === "ENOENT") {
-            // First-time setup: create a default config on disk.
-            this.config = this.defaultConfig();
-            this.writeConfig();
-            return this.config;
-         }
-         throw error;
-      }
-
-      try {
-         this.config = JSON.parse(fileContents.toString());
-      } catch (error) {
-         // Non-atomic writes from older binaries, or a manually corrupted file,
-         // can leave `.cred` unparseable. Fail loud rather than silently
-         // overwriting — a silent reset erases the access token for every
-         // subsequent caller on the same machine.
-         throw new InvalidConfigError(
-            `Failed to parse ${this.configPath}: ${error}. The file may be corrupt; re-run \`cred login\` to reset.`,
-         );
-      }
-
-      if (!this.config.activeEnvironment || !this.config.configPerEnvironment) {
-         throw new InvalidConfigError(
-            `Invalid config structure in ${this.configPath}; re-run \`cred login\` to reset.`,
-         );
-      }
-
-      for (const env of ALL_ENVIRONMENTS) {
-         if (!this.config.configPerEnvironment[env]) {
-            this.config.configPerEnvironment[env] = {};
-         }
-      }
-
-      return this.config;
-   }
-
-   /**
-    * Ensure `.cred` is usable, recovering from a corrupt file if needed.
-    *
-    * `loadConfig` deliberately fails loud on a corrupt/invalid file so a read
-    * path never silently erases tokens. But `cred login` exists precisely to
-    * (re)establish config, so it must be able to get past a bad file — that is
-    * what the "re-run `cred login` to reset" message promises. We make the
-    * message true here: the bad file is renamed aside (never deleted, so a
-    * support engineer can still inspect it) and a fresh default is written.
-    *
-    * Only an {@link InvalidConfigError} triggers recovery. fs errors such as
-    * EACCES are real environment problems and are rethrown — resetting would
-    * just fail to write anyway, and we must not mask a permissions issue as a
-    * successful reset.
-    *
-    * @returns the path the corrupt file was backed up to, or null if the
-    *          existing config was already valid.
-    */
-   public recoverIfCorrupt(): string | null {
-      try {
-         this.loadConfig();
-         return null;
-      } catch (error) {
-         if (!(error instanceof InvalidConfigError)) {
-            throw error;
-         }
-         const backupPath = `${this.configPath}.corrupt-${crypto
-            .randomBytes(8)
-            .toString("hex")}`;
-         fs.renameSync(this.configPath, backupPath);
-         logger.warn(
-            `Existing config at ${this.configPath} was invalid and could not be read. ` +
-               `Backed it up to ${backupPath} and reset to defaults.`,
-         );
-         this.config = this.defaultConfig();
-         this.writeConfig();
-         return backupPath;
-      }
-   }
-
-   private defaultConfig(): ConfigFile {
-      const configPerEnvironment: ConfigFile["configPerEnvironment"] = {};
-      for (const env of ALL_ENVIRONMENTS) {
-         configPerEnvironment[env] = {};
-      }
-      return { configPerEnvironment, activeEnvironment: "production" };
-   }
-
-   // Atomic: write to a sibling temp file, then rename into place.
-   // Readers either see the old file or the new file, never a truncated
-   // zero-byte snapshot (the window that `writeFileSync` exposes between
-   // open(O_TRUNC) and write).
-   //
-   // The temp suffix uses 16 bytes of crypto-random hex so the temp
-   // path is unguessable — a predictable name (pid + Date.now()) lets a
-   // co-located attacker pre-create a symlink at that path and trick
-   // us into clobbering an arbitrary file (CodeQL js/insecure-temporary-file).
-   // O_EXCL on open further refuses to follow a pre-existing entry.
-   private writeConfig(): void {
-      const tmp = `${this.configPath}.${crypto.randomBytes(16).toString("hex")}.tmp`;
-      const fd = fs.openSync(
-         tmp,
-         fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL,
-         0o600,
-      );
-      try {
-         fs.writeFileSync(fd, JSON.stringify(this.config));
-      } finally {
-         fs.closeSync(fd);
-      }
-      fs.renameSync(tmp, this.configPath);
-   }
-
-   public setOrganization(organizationName: string) {
-      this.loadConfig();
-      // TODO: Validate organization exists and user has access.
-      const environment = this.getEnvironment();
-      this.config.configPerEnvironment[environment].organization =
-         organizationName;
-      this.writeConfig();
-   }
-
-   public setProject(projectName: string) {
-      this.loadConfig();
-      // TODO: Validate project exists and user has access.
-      const environment = this.getEnvironment();
-      this.config.configPerEnvironment[environment].project = projectName;
-      this.writeConfig();
-   }
-
-   public getOrganization() {
-      this.loadConfig();
-      const environment = this.getEnvironment();
-      return this.config.configPerEnvironment[environment].organization;
-   }
-
-   public getProject() {
-      this.loadConfig();
-      const environment = this.getEnvironment();
-      return this.config.configPerEnvironment[environment].project;
-   }
-
-   public setAccessToken(userToken: boolean, accessToken: string) {
-      this.loadConfig();
-      const environment = this.getEnvironment();
-      this.config.configPerEnvironment[environment].isServiceAccountToken =
-         !userToken;
-      this.config.configPerEnvironment[environment].accessToken = accessToken;
-      this.writeConfig();
-   }
-
-   public getAuthenticationHeader() {
-      const environment = this.getEnvironment();
-      const jwt = this.config.configPerEnvironment[environment].accessToken;
-      const isServiceAccountToken =
-         this.config.configPerEnvironment[environment].isServiceAccountToken;
-      const authType = isServiceAccountToken ? "ApiKey" : "Bearer";
-      return `${authType} ${jwt}`;
-   }
-
-   getAccessToken() {
-      this.loadConfig();
-      const environment = this.getEnvironment();
-      return this.config.configPerEnvironment[environment].accessToken;
-   }
-
-   public setJwtAccessToken(jwtAccessToken: string) {
-      this.loadConfig();
-      const environment = this.getEnvironment();
-      this.config.configPerEnvironment[environment].jwtAccessToken =
-         jwtAccessToken;
-      this.writeConfig();
-   }
-
-   public getJwtAccessToken(): string | undefined {
-      this.loadConfig();
-      const environment = this.getEnvironment();
-      return this.config.configPerEnvironment[environment].jwtAccessToken;
-   }
-
-   public setVSCodeUser(username: string, email: string) {
-      this.loadConfig();
-      const environment = this.getEnvironment();
-      if (!this.config.configPerEnvironment[environment]) {
-         this.config.configPerEnvironment[environment] = {};
-      }
-      this.config.configPerEnvironment[environment].vsCodeUser = {
-         username,
-         email,
-      };
-      this.writeConfig();
-   }
-
-   public getVSCodeUser(): { username: string; email: string } | undefined {
-      this.loadConfig();
-      const environment = this.getEnvironment();
-      return this.config.configPerEnvironment[environment].vsCodeUser;
-   }
-
-   public setRefreshToken(refreshToken: string) {
-      this.loadConfig();
-      const environment = this.getEnvironment();
-      this.config.configPerEnvironment[environment].refreshToken = refreshToken;
-      this.writeConfig();
-   }
-
-   public getRefreshToken(): string | undefined {
-      this.loadConfig();
-      const environment = this.getEnvironment();
-      return this.config.configPerEnvironment[environment].refreshToken;
-   }
-
-   public doesConfigExists() {
-      this.loadConfig();
-      const environment = this.getEnvironment();
-      return Boolean(this.config.configPerEnvironment[environment]);
-   }
-
-   public getHeaders() {
-      return {
-         Authorization: this.getAuthenticationHeader(),
-      };
-   }
-
-   public destroyConfig() {
-      this.loadConfig();
-      const environment = this.getEnvironment();
-      this.config.configPerEnvironment[environment] = {};
-      this.writeConfig();
-   }
-
-   public setEnvironment(environment: Environment) {
-      this.loadConfig();
-      this.config.activeEnvironment = environment;
-      this.writeConfig();
-   }
-
-   public getEnvironment() {
-      this.loadConfig();
-      return this.config.activeEnvironment || "production";
-   }
-
-   public isTokenValid(): { valid: boolean; reason?: string } {
-      this.loadConfig();
-      const environment = this.getEnvironment();
-      const accessToken =
-         this.config.configPerEnvironment[environment]?.accessToken;
-
-      if (!accessToken) {
-         return { valid: false, reason: "No token found. Please login." };
-      }
-
-      const isServiceAccountToken =
-         this.config.configPerEnvironment[environment]?.isServiceAccountToken;
-      if (isServiceAccountToken) {
-         return { valid: true };
-      }
-
-      try {
-         const decoded = jwtDecode<JwtPayload>(accessToken);
-         const currentTime = Math.floor(Date.now() / 1000);
-
-         if (decoded.exp && decoded.exp < currentTime) {
-            return {
-               valid: false,
-               reason: "Token expired. Please login again.",
-            };
-         }
-
-         return { valid: true };
-      } catch {
-         return {
-            valid: false,
-            reason: "Invalid token format. Please login again.",
-         };
-      }
-   }
-
-   public printStatus() {
-      this.loadConfig();
-      const tokenStatus = this.isTokenValid();
-      const cell = this.getEnvironment();
-
-      // The cell prints on both branches, and before anything else: an org and an
-      // environment name alone do not identify a cell (two cells can both hold a
-      // `demo`), and a stale token is most often a token for the wrong one.
-      console.log(kleur.green(ASCII_TITLE));
-      logger.info(`Cell: ${kleur.green(cell)} (${controlPlanesByEnv[cell]})`);
-
-      if (tokenStatus.valid) {
-         const organization = this.getOrganization();
-         const project = this.getProject();
-
-         logger.info(`Organization: ${kleur.green(organization || "Not set")}`);
-         logger.info(`Environment: ${kleur.green(project || "Not set")}`);
-      } else {
-         logger.error("Failed to get status");
-         logger.error(
-            tokenStatus.reason || "Please, make sure that you are logged in",
-         );
-      }
-   }
-}

package/src/commands/add.ts

@@ -1,191 +0,0 @@
-/* eslint-disable @typescript-eslint/no-explicit-any */
-import { Command } from "commander";
-import { controlPlanesByEnv, Environment } from "../constants";
-import { createConnections } from "./connection/createconnections";
-import { addMember } from "./group/addmember";
-import { createGroup } from "./group/creategroup";
-import { createGroupAccessToken } from "./groupaccesstoken/createToken";
-import { createEnvironment } from "./environment/createenvironment";
-import { warnProjectDeprecated } from "./legacy";
-import { createPermission } from "./permission/createpermission";
-
-export const registerAddCommands = (cli: Command, environment: Environment) => {
-   const add = cli
-      .command("add")
-      .description("Add a resource")
-      .argument("<resource>", "The resource to add");
-
-   const addEnvironmentAction = (environmentName: string, options: any) => {
-      createEnvironment(
-         controlPlanesByEnv[environment],
-         environmentName,
-         options.readmeFile,
-         options.replication,
-         options.debug,
-         options.yes,
-      );
-   };
-
-   add.command("environment")
-      .description("Add an environment.")
-      .argument("<environmentName>", "The name of the environment to create.")
-      .option("--debug")
-      .option("-y, --yes", "Skip confirmation.")
-      .option(
-         "--readmeFile <readmeFile>",
-         "The path to the readme file for the environment.",
-      )
-      .option(
-         "--replication <replicationCount>",
-         "The replication count (must be at least 1).",
-         parseInt,
-      )
-      .action(addEnvironmentAction);
-
-   add.command("project")
-      .description("[deprecated] Alias for 'add environment'.")
-      .argument("<projectName>", "The name of the environment to create.")
-      .option("--debug")
-      .option("-y, --yes", "Skip confirmation.")
-      .option(
-         "--readmeFile <readmeFile>",
-         "The path to the readme file for the environment.",
-      )
-      .option(
-         "--replication <replicationCount>",
-         "The replication count (must be at least 1).",
-         parseInt,
-      )
-      .action((projectName, options) => {
-         warnProjectDeprecated("add environment");
-         addEnvironmentAction(projectName, options);
-      });
-
-   add.command("connection")
-      .argument(
-         "<connectionFileName>",
-         "The path to the file containing the connections to create.",
-      )
-      .option(
-         "--include-tables <includeTables>",
-         "The list of tables to include. Ex: {dataset/schema}.{table}",
-      )
-      .option(
-         "--exclude-tables <excludeTables>",
-         "The list of tables to exclude. Ex: {dataset/schema}.{table}",
-      )
-      .option(
-         "--skip-indexing",
-         "Disable automatic indexing for this connection.",
-         false,
-      )
-      .option("--debug")
-      .option("-y, --yes", "Skip confirmation.")
-      .action((connectionFileName, options) => {
-         createConnections(
-            controlPlanesByEnv[environment],
-            connectionFileName,
-            options.includeTables,
-            options.excludeTables,
-            options.skipIndexing,
-            options.debug,
-            options.yes,
-         );
-      });
-
-   add.command("group")
-      .description("Add a group.")
-      .argument("<groupName>", "The name of the group to create")
-      .option("-d, --description <description>", "Description for the group")
-      .option("--debug")
-      .option("-y, --yes", "Skip confirmation.")
-      .action((groupName, options) => {
-         createGroup(
-            controlPlanesByEnv[environment],
-            groupName,
-            options.debug || false,
-            options.description,
-         );
-      });
-
-   add.command("member")
-      .description("Add a member to a group.")
-      .argument("<groupName>", "The name of the group")
-      .argument("<memberType>", "The type of member (user or group)")
-      .argument("<memberName>", "The name of the member")
-      .argument("<role>", "The role for the member (admin or member)")
-      .option("--debug")
-      .action((groupName, memberType, memberName, role, options) => {
-         addMember(
-            controlPlanesByEnv[environment],
-            groupName,
-            memberType,
-            memberName,
-            role,
-            options.debug || false,
-         );
-      });
-
-   add.command("permission")
-      .description(
-         "Grant a user or group a permission on the organization, an environment, or a package.",
-      )
-      .argument(
-         "<userGroupId>",
-         "Who to grant it to [user:{email}|group:{groupName}|user:*]",
-      )
-      .argument(
-         "<role>",
-         "The role to grant (organization: admin|modeler|member; environment: admin|modeler|viewer; package: viewer)",
-      )
-      .option(
-         "--environment <environmentName>",
-         "Grant on this environment instead of the organization.",
-      )
-      .option(
-         "--package <packageName>",
-         "Grant on this package. Uses --environment, or the current environment.",
-      )
-      .option(
-         "--notifyPeople",
-         "Email the person about the new access. Applies to an environment or a package; an organization grant always notifies a user subject.",
-         false,
-      )
-      .option("--debug")
-      .option("-y, --yes", "Skip confirmation.")
-      .action((userGroupId, role, options) => {
-         createPermission(
-            controlPlanesByEnv[environment],
-            userGroupId,
-            role,
-            options.debug || false,
-            {
-               environment: options.environment,
-               package: options.package,
-               notifyPeople: options.notifyPeople === true,
-               yes: options.yes === true,
-            },
-         );
-      });
-
-   add.command("group-access-token")
-      .description("Create an access token for a group.")
-      .argument("<groupName>", "The name of the group")
-      .argument("<tokenName>", "The name of the token to create")
-      .option(
-         "-e, --expires-at <expiresAt>",
-         "Token expiration date in ISO 8601 format (e.g., 2025-12-31T23:59:59Z). If not provided, token will expire in 99 years.",
-      )
-      .option("--debug")
-      .option("-j, --json-output", "Output only JSON (for use in scripts)")
-      .action((groupName, tokenName, options) => {
-         createGroupAccessToken(
-            controlPlanesByEnv[environment],
-            groupName,
-            tokenName,
-            options.expiresAt,
-            options.jsonOutput === true,
-            options.debug || false,
-         );
-      });
-};