@credibledata/cred-cli 0.0.103 → 0.0.105

package/src/commands/permission/createpermission.spec.ts

@@ -1,507 +0,0 @@
-import { expect } from "chai";
-import sinon from "sinon";
-import {
-   EnvironmentPermissionsApi,
-   OrganizationPermissionsApi,
-   PackagePermissionsApi,
-} from "../../client/api";
-import { ClientConfiguration } from "../../clientconfiguration";
-import { logger } from "../../logger";
-import * as utils from "../../utils";
-import { createPermission } from "./createpermission";
-
-describe("add-permission", () => {
-   let sandbox: sinon.SinonSandbox;
-   let createOrgStub: sinon.SinonStub;
-   let createEnvStub: sinon.SinonStub;
-   let createPkgStub: sinon.SinonStub;
-   let loggerStub: sinon.SinonStubbedInstance<typeof logger>;
-   let consoleLogStub: sinon.SinonStub;
-   let processExitStub: sinon.SinonStub;
-   let confirmStub: sinon.SinonStub;
-
-   beforeEach(() => {
-      sandbox = sinon.createSandbox();
-      createOrgStub = sandbox.stub().resolves({ data: {} });
-      createEnvStub = sandbox.stub().resolves({ data: {} });
-      createPkgStub = sandbox.stub().resolves({ data: {} });
-      loggerStub = sandbox.stub(logger);
-      consoleLogStub = sandbox.stub(console, "log");
-      processExitStub = sandbox.stub(process, "exit");
-      confirmStub = sandbox.stub(utils, "getConfirmation").resolves(true);
-
-      sandbox
-         .stub(ClientConfiguration.prototype, "getOrganization")
-         .returns("test-org");
-      sandbox
-         .stub(ClientConfiguration.prototype, "getProject")
-         .returns("configured-env");
-      sandbox
-         .stub(ClientConfiguration.prototype, "doesConfigExists")
-         .returns(true);
-      sandbox
-         .stub(ClientConfiguration.prototype, "getAuthenticationHeader")
-         .returns("Bearer test-token");
-
-      sandbox
-         .stub(
-            OrganizationPermissionsApi.prototype,
-            "createOrganizationPermission",
-         )
-         .callsFake(createOrgStub);
-      sandbox
-         .stub(
-            EnvironmentPermissionsApi.prototype,
-            "createEnvironmentPermission",
-         )
-         .callsFake(createEnvStub);
-      sandbox
-         .stub(PackagePermissionsApi.prototype, "createPackagePermission")
-         .callsFake(createPkgStub);
-   });
-
-   afterEach(() => {
-      sandbox.restore();
-   });
-
-   it("grants a group an organization role", async () => {
-      await createPermission(
-         "http://test-server",
-         "group:ci-bot",
-         "admin",
-         false,
-         {
-            yes: true,
-         },
-      );
-
-      expect(createOrgStub.calledOnce).to.be.true;
-      expect(createOrgStub.firstCall.args[0]).to.equal("test-org");
-      // The subject must reach the API as the typed string. A group sent as a
-      // UserGroupId object or as a bare name addresses no tuple, so the grant
-      // would report success while leaving the group without the role.
-      expect(createOrgStub.firstCall.args[2]).to.deep.equal({
-         userGroupId: "group:ci-bot",
-         permission: "admin",
-      });
-      expect(createOrgStub.firstCall.args[3]).to.deep.include({
-         baseURL: "http://test-server",
-         headers: { Authorization: "Bearer test-token" },
-      });
-      expect(createEnvStub.called).to.be.false;
-      expect(createPkgStub.called).to.be.false;
-   });
-
-   it("grants a user an organization role", async () => {
-      await createPermission(
-         "http://test-server",
-         "user:someone@example.com",
-         "member",
-         false,
-         { yes: true },
-      );
-
-      expect(createOrgStub.firstCall.args[2]).to.deep.equal({
-         userGroupId: "user:someone@example.com",
-         permission: "member",
-      });
-   });
-
-   it("grants on an environment when one is named", async () => {
-      await createPermission(
-         "http://test-server",
-         "group:ci-bot",
-         "viewer",
-         false,
-         {
-            environment: "sales",
-         },
-      );
-
-      expect(createEnvStub.calledOnce).to.be.true;
-      expect(createEnvStub.firstCall.args[0]).to.equal("test-org");
-      expect(createEnvStub.firstCall.args[1]).to.equal("sales");
-      expect(createEnvStub.firstCall.args[4]).to.deep.equal({
-         userGroupId: "group:ci-bot",
-         permission: "viewer",
-      });
-      expect(createOrgStub.called).to.be.false;
-   });
-
-   it("grants on a package, taking the environment from the config", async () => {
-      await createPermission(
-         "http://test-server",
-         "group:ci-bot",
-         "viewer",
-         false,
-         {
-            package: "orders",
-         },
-      );
-
-      expect(createPkgStub.calledOnce).to.be.true;
-      expect(createPkgStub.firstCall.args[1]).to.equal("configured-env");
-      expect(createPkgStub.firstCall.args[2]).to.equal("orders");
-      expect(createPkgStub.firstCall.args[5]).to.deep.equal({
-         userGroupId: "group:ci-bot",
-         permission: "viewer",
-      });
-   });
-
-   it("prefers an explicit environment over the configured one for a package", async () => {
-      await createPermission(
-         "http://test-server",
-         "group:ci-bot",
-         "viewer",
-         false,
-         {
-            environment: "explicit-env",
-            package: "orders",
-         },
-      );
-
-      expect(createPkgStub.firstCall.args[1]).to.equal("explicit-env");
-   });
-
-   it("rejects a role the organization does not define", async () => {
-      // viewer belongs to environments and packages; the organization ends in member.
-      await createPermission(
-         "http://test-server",
-         "group:ci-bot",
-         "viewer",
-         false,
-         {
-            yes: true,
-         },
-      );
-
-      expect(createOrgStub.called).to.be.false;
-      expect(processExitStub.calledWith(1)).to.be.true;
-      expect(loggerStub.error.calledWith(sinon.match("Invalid role 'viewer'")))
-         .to.be.true;
-   });
-
-   it("rejects a role an environment does not define", async () => {
-      await createPermission(
-         "http://test-server",
-         "group:ci-bot",
-         "member",
-         false,
-         {
-            environment: "sales",
-         },
-      );
-
-      expect(createEnvStub.called).to.be.false;
-      expect(processExitStub.calledWith(1)).to.be.true;
-   });
-
-   it("rejects public access as an environment admin", async () => {
-      await createPermission("http://test-server", "user:*", "admin", false, {
-         environment: "sales",
-      });
-
-      expect(createEnvStub.called).to.be.false;
-      expect(processExitStub.calledWith(1)).to.be.true;
-   });
-
-   it("allows public access as an environment viewer", async () => {
-      await createPermission("http://test-server", "user:*", "viewer", false, {
-         environment: "sales",
-      });
-
-      expect(createEnvStub.calledOnce).to.be.true;
-      expect(createEnvStub.firstCall.args[4]).to.deep.equal({
-         userGroupId: "user:*",
-         permission: "viewer",
-      });
-   });
-
-   it("allows public access as an organization modeler", async () => {
-      // The one organization role the model admits for the wildcard.
-      await createPermission("http://test-server", "user:*", "modeler", false, {
-         yes: true,
-      });
-
-      expect(createOrgStub.calledOnce).to.be.true;
-      expect(createOrgStub.firstCall.args[2]).to.deep.equal({
-         userGroupId: "user:*",
-         permission: "modeler",
-      });
-   });
-
-   it("rejects every public-access role the model does not admit", async () => {
-      // Each of these reaches OpenFGA and fails there as a model validation
-      // error, so the refusal belongs before the request.
-      const cases: [string, Record<string, unknown>][] = [
-         ["admin", { yes: true }],
-         ["member", { yes: true }],
-         ["modeler", { environment: "sales" }],
-         ["admin", { environment: "sales" }],
-         ["modeler", { environment: "sales", package: "orders" }],
-      ];
-
-      for (const [role, options] of cases) {
-         createOrgStub.resetHistory();
-         createEnvStub.resetHistory();
-         createPkgStub.resetHistory();
-         processExitStub.resetHistory();
-
-         await createPermission(
-            "http://test-server",
-            "user:*",
-            role,
-            false,
-            options,
-         );
-
-         const sent =
-            createOrgStub.called ||
-            createEnvStub.called ||
-            createPkgStub.called;
-         expect(sent, `public access with ${role} must not be sent`).to.be
-            .false;
-         expect(processExitStub.calledWith(1)).to.be.true;
-      }
-   });
-
-   it("rejects an empty --environment instead of widening to the organization", async () => {
-      // `--environment "$UNSET"` must not be read as "no environment given":
-      // that would grant on the organization, which is wider than asked for.
-      await createPermission(
-         "http://test-server",
-         "group:ci-bot",
-         "admin",
-         false,
-         {
-            environment: "",
-            yes: true,
-         },
-      );
-
-      expect(createOrgStub.called).to.be.false;
-      expect(createEnvStub.called).to.be.false;
-      expect(processExitStub.calledWith(1)).to.be.true;
-      expect(loggerStub.error.calledWith(sinon.match("--environment"))).to.be
-         .true;
-   });
-
-   it("rejects an empty --package instead of widening to the environment", async () => {
-      await createPermission(
-         "http://test-server",
-         "group:ci-bot",
-         "viewer",
-         false,
-         {
-            environment: "sales",
-            package: "",
-         },
-      );
-
-      expect(createPkgStub.called).to.be.false;
-      expect(createEnvStub.called).to.be.false;
-      expect(processExitStub.calledWith(1)).to.be.true;
-   });
-
-   it("rejects a package role the server cannot write", async () => {
-      // A package reports admin and modeler because they are inherited from the
-      // environment, but only viewer is directly assignable there.
-      for (const role of ["admin", "modeler"]) {
-         createPkgStub.resetHistory();
-         processExitStub.resetHistory();
-
-         await createPermission(
-            "http://test-server",
-            "group:ci-bot",
-            role,
-            false,
-            {
-               environment: "sales",
-               package: "orders",
-            },
-         );
-
-         expect(createPkgStub.called, `role ${role} must not be sent`).to.be
-            .false;
-         expect(processExitStub.calledWith(1)).to.be.true;
-      }
-   });
-
-   it("rejects a subject with no type", async () => {
-      await createPermission("http://test-server", "ci-bot", "admin", false, {
-         yes: true,
-      });
-
-      expect(createOrgStub.called).to.be.false;
-      expect(processExitStub.calledWith(1)).to.be.true;
-   });
-
-   it("confirms before granting organization admin", async () => {
-      confirmStub.resolves(false);
-
-      await createPermission(
-         "http://test-server",
-         "group:ci-bot",
-         "admin",
-         false,
-         {},
-      );
-
-      expect(confirmStub.calledOnce).to.be.true;
-      expect(createOrgStub.called).to.be.false;
-      expect(loggerStub.info.calledWith(sinon.match("Operation cancelled"))).to
-         .be.true;
-   });
-
-   it("does not confirm for a narrower organization role", async () => {
-      await createPermission(
-         "http://test-server",
-         "group:ci-bot",
-         "modeler",
-         false,
-         {},
-      );
-
-      expect(confirmStub.called).to.be.false;
-      expect(createOrgStub.calledOnce).to.be.true;
-   });
-
-   it("refuses --notifyPeople at the organization scope", async () => {
-      // The organization endpoint has no notify parameter and always sends, so
-      // accepting the flag there would promise control that does not exist.
-      await createPermission(
-         "http://test-server",
-         "group:ci-bot",
-         "admin",
-         false,
-         {
-            notifyPeople: true,
-            yes: true,
-         },
-      );
-
-      expect(createOrgStub.called).to.be.false;
-      expect(processExitStub.calledWith(1)).to.be.true;
-      expect(loggerStub.error.calledWith(sinon.match("--notifyPeople"))).to.be
-         .true;
-   });
-
-   it("accepts --notifyPeople on an environment", async () => {
-      await createPermission(
-         "http://test-server",
-         "group:ci-bot",
-         "viewer",
-         false,
-         {
-            environment: "sales",
-            notifyPeople: true,
-         },
-      );
-
-      expect(createEnvStub.calledOnce).to.be.true;
-      expect(createEnvStub.firstCall.args[3]).to.equal(true);
-   });
-
-   it("defaults notifyPeople to false", async () => {
-      await createPermission(
-         "http://test-server",
-         "group:ci-bot",
-         "viewer",
-         false,
-         {
-            environment: "sales",
-         },
-      );
-
-      expect(createEnvStub.firstCall.args[3]).to.equal(false);
-   });
-
-   it("handles missing config", async () => {
-      sandbox.restore();
-      sandbox = sinon.createSandbox();
-      createOrgStub = sandbox.stub();
-      loggerStub = sandbox.stub(logger);
-      sandbox.stub(console, "log");
-      processExitStub = sandbox.stub(process, "exit");
-      sandbox
-         .stub(ClientConfiguration.prototype, "doesConfigExists")
-         .returns(false);
-      sandbox
-         .stub(
-            OrganizationPermissionsApi.prototype,
-            "createOrganizationPermission",
-         )
-         .callsFake(createOrgStub);
-
-      await createPermission(
-         "http://test-server",
-         "group:ci-bot",
-         "admin",
-         false,
-         {
-            yes: true,
-         },
-      );
-
-      expect(createOrgStub.called).to.be.false;
-      expect(
-         loggerStub.error.calledWith(
-            sinon.match("Please, make sure that you are logged in"),
-         ),
-      ).to.be.true;
-   });
-
-   it("handles a missing organization", async () => {
-      sandbox.restore();
-      sandbox = sinon.createSandbox();
-      createOrgStub = sandbox.stub();
-      loggerStub = sandbox.stub(logger);
-      sandbox.stub(console, "log");
-      processExitStub = sandbox.stub(process, "exit");
-      sandbox
-         .stub(ClientConfiguration.prototype, "doesConfigExists")
-         .returns(true);
-      sandbox
-         .stub(ClientConfiguration.prototype, "getOrganization")
-         .returns(undefined);
-      sandbox
-         .stub(
-            OrganizationPermissionsApi.prototype,
-            "createOrganizationPermission",
-         )
-         .callsFake(createOrgStub);
-
-      await createPermission(
-         "http://test-server",
-         "group:ci-bot",
-         "admin",
-         false,
-         {
-            yes: true,
-         },
-      );
-
-      expect(createOrgStub.called).to.be.false;
-      expect(loggerStub.error.calledWith(sinon.match("No organization set"))).to
-         .be.true;
-   });
-
-   it("exits non-zero when the API fails", async () => {
-      createOrgStub.rejects(new Error("API Error"));
-
-      await createPermission(
-         "http://test-server",
-         "group:ci-bot",
-         "admin",
-         false,
-         {
-            yes: true,
-         },
-      );
-
-      expect(processExitStub.calledWith(1)).to.be.true;
-      expect(
-         loggerStub.error.calledWith(sinon.match("Failed to grant permission")),
-      ).to.be.true;
-   });
-});

package/src/commands/permission/createpermission.ts

@@ -1,181 +0,0 @@
-import {
-   EnvironmentPermissionPermissionEnum,
-   EnvironmentPermissionsApi,
-   OrganizationPermissionPermissionEnum,
-   OrganizationPermissionsApi,
-   PackagePermissionPermissionEnum,
-   PackagePermissionsApi,
-} from "../../client/api";
-import { Configuration } from "../../client/configuration";
-import { ClientConfiguration } from "../../clientconfiguration";
-import { logger } from "../../logger";
-import { getConfirmation, printOutError } from "../../utils";
-import {
-   describeScope,
-   parseSubject,
-   PermissionScope,
-   resolveScope,
-   ScopeOptions,
-   validateRole,
-} from "./scope";
-
-const organizationPermissionsApi = new OrganizationPermissionsApi(
-   new Configuration(),
-);
-const environmentPermissionsApi = new EnvironmentPermissionsApi(
-   new Configuration(),
-);
-const packagePermissionsApi = new PackagePermissionsApi(new Configuration());
-
-export type CreatePermissionOptions = ScopeOptions & {
-   notifyPeople?: boolean;
-   yes?: boolean;
-};
-
-export async function createPermission(
-   controlPlane: string,
-   userGroupIdValue: string,
-   role: string,
-   debug: boolean,
-   options: CreatePermissionOptions,
-) {
-   const clientConfig = new ClientConfiguration();
-
-   if (!clientConfig.doesConfigExists()) {
-      logger.error("Please, make sure that you are logged in");
-      return;
-   }
-
-   const organizationName = clientConfig.getOrganization();
-   if (!organizationName) {
-      logger.error("No organization set. Please login or set an organization.");
-      return;
-   }
-
-   const resolved = resolveScope(options, clientConfig.getProject());
-   if ("error" in resolved) {
-      logger.error(resolved.error);
-      process.exit(1);
-      return;
-   }
-
-   const roleError = validateRole(resolved.scope, role);
-   if (roleError) {
-      logger.error(roleError);
-      process.exit(1);
-      return;
-   }
-
-   // The organization create endpoint takes no notify parameter and the service
-   // always sends, so honoring this flag there is not possible and ignoring it
-   // would be a false promise in both directions -- the default would email and
-   // passing it would not stop that.
-   if (
-      options.notifyPeople === true &&
-      resolved.scope === PermissionScope.ORGANIZATION
-   ) {
-      logger.error(
-         "--notifyPeople applies to an environment or a package. An organization grant always notifies a user subject.",
-      );
-      process.exit(1);
-      return;
-   }
-
-   const subject = parseSubject(resolved.scope, role, userGroupIdValue);
-   if ("error" in subject) {
-      logger.error(subject.error);
-      process.exit(1);
-      return;
-   }
-   const userGroupId = subject.userGroupId.getValue();
-
-   const target = describeScope(organizationName, resolved);
-
-   // Organization admin is the organization's broadest role: it reaches every
-   // environment and package, can read member details, and can mint further
-   // group access tokens. Granting it to a group grants it to every token that
-   // group holds, so it is confirmed rather than applied silently.
-   if (
-      resolved.scope === PermissionScope.ORGANIZATION &&
-      role === "admin" &&
-      !options.yes
-   ) {
-      const confirmation = await getConfirmation(
-         `Grant ${userGroupId} the admin role on ${target}? This reaches every environment and package in the organization, and allows creating further group access tokens.`,
-      );
-      if (!confirmation) {
-         logger.info("Operation cancelled.");
-         return;
-      }
-   }
-
-   logger.info(`Granting ${role} permission to ${userGroupId} on ${target}`);
-
-   const requestOptions = {
-      baseURL: controlPlane,
-      headers: {
-         Authorization: clientConfig.getAuthenticationHeader(),
-      },
-   };
-   const notifyPeople = options.notifyPeople === true;
-
-   try {
-      let data: unknown;
-      switch (resolved.scope) {
-         case PermissionScope.PACKAGE: {
-            const response =
-               await packagePermissionsApi.createPackagePermission(
-                  organizationName,
-                  resolved.environmentName as string,
-                  resolved.packageName as string,
-                  false,
-                  notifyPeople,
-                  {
-                     userGroupId,
-                     permission: role as PackagePermissionPermissionEnum,
-                  },
-                  requestOptions,
-               );
-            data = response.data;
-            break;
-         }
-         case PermissionScope.ENVIRONMENT: {
-            const response =
-               await environmentPermissionsApi.createEnvironmentPermission(
-                  organizationName,
-                  resolved.environmentName as string,
-                  false,
-                  notifyPeople,
-                  {
-                     userGroupId,
-                     permission: role as EnvironmentPermissionPermissionEnum,
-                  },
-                  requestOptions,
-               );
-            data = response.data;
-            break;
-         }
-         default: {
-            const response =
-               await organizationPermissionsApi.createOrganizationPermission(
-                  organizationName,
-                  false,
-                  {
-                     userGroupId,
-                     permission: role as OrganizationPermissionPermissionEnum,
-                  },
-                  requestOptions,
-               );
-            data = response.data;
-            break;
-         }
-      }
-
-      console.log(JSON.stringify(data, null, 2));
-      logger.info("Permission granted successfully");
-   } catch (error) {
-      logger.error("Failed to grant permission");
-      printOutError(error, debug);
-      process.exit(1);
-   }
-}