@credibledata/cred-cli 0.0.103 → 0.0.105

package/src/constants.ts

@@ -1,228 +0,0 @@
-export type Environment =
-   | "production"
-   | "staging"
-   | "dev"
-   | "localhost"
-   | "e2e-test"
-   | "videoamp"
-   | "aws-dev";
-
-export const controlPlanesByEnv: Record<Environment, string> = {
-   production: "https://admin.credibledata.com/api/v0",
-   dev: "https://dev-admin.credibledata.com/api/v0",
-   staging: "https://staging-admin.credibledata.com/api/v0",
-   localhost: "http://admin.ms2.localhost/api/v0",
-   "e2e-test": "http://admin.ms2.localhost/api/v0",
-   videoamp: "https://admin.videoamp-aws-us-east-1.credibledata.com/api/v0",
-   // The AWS development cell (credible/dev on EKS). Its public hostnames compose onto the shared
-   // apex as aws-dev-<service>.credibledata.com, unlike videoamp's, which live under its own zone.
-   "aws-dev": "https://aws-dev-admin.credibledata.com/api/v0",
-};
-
-/** Environments that must have an object in `~/.cred` `configPerEnvironment` (avoids undefined on write). */
-export const ALL_ENVIRONMENTS = Object.keys(
-   controlPlanesByEnv,
-) as Environment[];
-
-export const auth0ConfigsByEnv: Record<
-   Environment,
-   {
-      domain: string;
-      clientId: string;
-      clientSecret?: string;
-      audience: string;
-   }
-> = {
-   production: {
-      domain: "https://auth.credibledata.com",
-      clientId: "ge8JL5TJNwqy7bygAaJkD92KdluqEZgO",
-      audience: "https://ms2data.us.auth0.com/api/v2/",
-   },
-   dev: {
-      domain: "https://dev-auth.credibledata.com",
-      clientId: "rr6mzJNj9b104MjCc9xWKPPehq1MJx0L",
-      audience: "https://dev-ohaafogw5p8uyx1m.us.auth0.com/api/v2/",
-   },
-   staging: {
-      domain: "https://dev-auth.credibledata.com",
-      clientId: "rr6mzJNj9b104MjCc9xWKPPehq1MJx0L",
-      audience: "https://dev-ohaafogw5p8uyx1m.us.auth0.com/api/v2/",
-   },
-   localhost: {
-      domain: "https://dev-auth.credibledata.com",
-      clientId: "rr6mzJNj9b104MjCc9xWKPPehq1MJx0L",
-      audience: "https://dev-ohaafogw5p8uyx1m.us.auth0.com/api/v2/",
-   },
-   "e2e-test": {
-      domain: "https://dev-auth.credibledata.com",
-      clientId: "atd8n8dEiGUiNRM7Geuvg41fi5s8ZKqY",
-      clientSecret:
-         "ZrEvs86WLqKO9EPp4y_cOvUn3NQT1qc3XC8111f6DBt9oyaclV5sWHz6Nkyo_bEF",
-      audience: "https://dev-ohaafogw5p8uyx1m.us.auth0.com/api/v2/",
-   },
-   videoamp: {
-      domain: "https://auth.credibledata.com",
-      clientId: "ge8JL5TJNwqy7bygAaJkD92KdluqEZgO",
-      audience: "https://ms2data.us.auth0.com/api/v2/",
-   },
-   // The DEV Auth0 tenant, not production: this cell takes its per-tier secrets from gcp/credible/dev,
-   // so it authenticates against the same tenant that dev, staging and localhost do. videoamp is the
-   // exception here, being a production cell.
-   "aws-dev": {
-      domain: "https://dev-auth.credibledata.com",
-      clientId: "rr6mzJNj9b104MjCc9xWKPPehq1MJx0L",
-      audience: "https://dev-ohaafogw5p8uyx1m.us.auth0.com/api/v2/",
-   },
-};
-
-/** Clusters a CLI org can target via `cred login <org> -c <cluster>`. */
-export type Cluster = "gcp" | "aws";
-
-/** Which cluster each {@link Environment} lives on. */
-export const CLUSTER_BY_ENVIRONMENT: Record<Environment, Cluster> = {
-   production: "gcp",
-   staging: "gcp",
-   dev: "gcp",
-   localhost: "gcp",
-   "e2e-test": "gcp",
-   videoamp: "aws",
-   "aws-dev": "aws",
-};
-
-/**
- * Default {@link Environment} to switch to when logging into a cluster and the
- * current active env is on a different cluster. Picked per cluster so that
- * `cred login <org> -c aws` flips to videoamp and `-c gcp` flips to production.
- */
-export const DEFAULT_ENVIRONMENT_BY_CLUSTER: Record<Cluster, Environment> = {
-   gcp: "production",
-   aws: "videoamp",
-};
-
-/**
- * Per-org CLI login config. One row per org that needs non-default behavior
- * (multi-cluster support, Auth0 Organizations PKCE, etc.). Orgs not listed here
- * fall back to: gcp cluster only, Device Authorization Flow, no Auth0 org id.
- *
- * Auth0 docs: `organization` is supported on `/authorize` for Organizations
- * (https://auth0.com/docs/manage-users/organizations/configure-organizations/use-org-name-authentication-api)
- * but NOT on `POST /oauth/device/code`
- * (https://auth0.com/docs/get-started/authentication-and-authorization-flow/device-authorization-flow/call-your-api-using-the-device-authorization-flow#device-code-parameters),
- * so orgs with an `auth0OrganizationIds` entry for the active cluster use Auth Code + PKCE via
- * {@link AUTH_CLI_LOOPBACK_REDIRECT_URI}. Keep aligned with the app's
- * `ORGANIZATION_HOST_ORG_ID_MAP` / `getAuth0OrganizationAuthorizationParams`.
- */
-export interface CliOrgConfig {
-   /** Lowercase CLI org name (what the user types after `cred login`). */
-   cliOrgName: string;
-   /** Clusters this org can be logged into. */
-   supportedClusters: Cluster[];
-   /** Cluster used when `-c/--cluster` is omitted. Must be in `supportedClusters`. */
-   defaultCluster: Cluster;
-   /**
-    * Auth0 Organization ID per cluster. Presence triggers the PKCE + `organization=<id>`
-    * `/authorize` flow on that cluster; absence falls back to Device Authorization Flow.
-    */
-   auth0OrganizationIds?: Partial<Record<Cluster, string>>;
-}
-
-const CLI_ORG_CONFIGS: CliOrgConfig[] = [
-   {
-      cliOrgName: "videoamp",
-      supportedClusters: ["gcp", "aws"],
-      defaultCluster: "gcp",
-      auth0OrganizationIds: {
-         aws: "org_nMRKafeSuxOiuJeG",
-      },
-   },
-   {
-      // Exists on both clouds -- gcp dev and the aws development cell both have a `demo` org -- so
-      // both are listed. Registered at all only because an UNREGISTERED org is assumed gcp-only
-      // (`supportedClusters ?? ["gcp"]`), which is why `cred login demo` on an aws cell reports the
-      // org as unavailable rather than anything about the cell.
-      //
-      // defaultCluster stays gcp so a bare `cred login demo` behaves exactly as it did before this
-      // entry existed; reach the aws cell with `-c aws`.
-      //
-      // No auth0OrganizationIds: their presence selects the PKCE + loopback flow, whose redirect
-      // (127.0.0.1:18240/callback) is registered on the production Auth0 tenant only. Omitting them
-      // selects the Device Authorization Flow, which needs no callback URL and therefore works on a
-      // cell authenticating against the dev tenant.
-      cliOrgName: "demo",
-      supportedClusters: ["gcp", "aws"],
-      defaultCluster: "gcp",
-   },
-   {
-      // The tenant the PROBES measure, on every cell in both clouds -- probe_organization in
-      // stacks/{aws,gcp}/services. Distinct from `demo` above, which is a cell's own first
-      // organization; a cell has both, and they were seeded by different bootstrap steps.
-      //
-      // Needed for the same reason the `demo` entry is, and missed for a reason worth naming: the
-      // gcp-only fallback (`supportedClusters ?? ["gcp"]`) makes an unregistered org work perfectly
-      // on gcp, so nothing surfaced until an operator tried to reach the fixture on an AWS cell and
-      // got "Organization 'k6-experiments' is not available on the aws cluster" -- a message about
-      // the org, for a fact about this list. Asserted against the recipe by
-      // test_probe_organization_is_reachable_on_its_cells_clusters.
-      //
-      // defaultCluster gcp and no auth0OrganizationIds, both for the reasons given on `demo`: a bare
-      // `cred login k6-experiments` keeps behaving exactly as it did before this entry existed, and
-      // the Device Authorization Flow is the one that works against a cell on the dev Auth0 tenant.
-      cliOrgName: "k6-experiments",
-      supportedClusters: ["gcp", "aws"],
-      defaultCluster: "gcp",
-   },
-];
-
-const CLI_ORG_CONFIGS_BY_NAME: Record<string, CliOrgConfig> =
-   Object.fromEntries(
-      CLI_ORG_CONFIGS.map((c) => [c.cliOrgName.toLowerCase(), c]),
-   );
-
-/** Returns the registry entry for an org, or `undefined` if it uses defaults (gcp + device flow). */
-export function getCliOrgConfig(
-   organizationName: string,
-): CliOrgConfig | undefined {
-   return CLI_ORG_CONFIGS_BY_NAME[organizationName.toLowerCase()];
-}
-
-/**
- * Allowlisted on the Auth0 Native application (CLI) as an Allowed Callback URL for PKCE logins
- * that pass `organization` on `/authorize` (see Auth0 Organizations + Authentication API docs above).
- */
-export const AUTH_CLI_LOOPBACK_REDIRECT_URI = "http://127.0.0.1:18240/callback";
-
-/**
- * Auth0 Organization ID for the given CLI org on the cluster it is logging into.
- * Returning a value selects the Auth Code + PKCE branch in `login()`; `undefined`
- * falls back to Device Authorization Flow.
- *
- * `cluster` defaults to the org's `defaultCluster` (or `gcp` for unregistered orgs)
- * so callers that don't yet know the active cluster keep working.
- */
-export function getAuth0OrganizationIdForCliLogin(
-   organizationName: string,
-   cluster?: Cluster,
-): string | undefined {
-   const cfg = getCliOrgConfig(organizationName);
-   if (!cfg) return undefined;
-   const targetCluster = cluster ?? cfg.defaultCluster;
-   return cfg.auth0OrganizationIds?.[targetCluster];
-}
-
-// Time constants in ms
-export const SECOND = 1000;
-export const MINUTE = SECOND * 60;
-export const HOUR = MINUTE * 60;
-export const DAY = HOUR * 24;
-
-// Login related
-export const LOGIN_TIMEOUT_MS = MINUTE * 5;
-
-export const ASCII_TITLE = `
-   _____              _ _ _     _         _____ _      _____
-  / ____|            | (_) |   | |       / ____| |    |_   _|
- | |     _ __ ___  __| |_| |__ | | ___  | |    | |      | |
- | |    | '__/ _ \\/ _\` | | '_ \\| |/ _ \\ | |    | |      | |
- | |____| | |  __/ (_| | | |_) | |  __/ | |____| |____ _| |_
-  \\_____|_|  \\___|\\__,_|_|_.__/|_|\\___|  \\_____|______|_____|
-`;

package/src/index.ts

@@ -1,378 +0,0 @@
-#!/usr/bin/env node
-import axios from "axios";
-import { program } from "commander";
-import kleur from "kleur";
-import omelette from "omelette";
-import cliPackage from "../package.json";
-import { ClientConfiguration } from "./clientconfiguration";
-import { registerAddCommands } from "./commands/add";
-import { registerGetCommands } from "./commands/get";
-import { registerListCommands } from "./commands/list";
-import { isLoginInvocation, login } from "./commands/misc/login";
-import { logout } from "./commands/misc/logout";
-import { setAccessToken } from "./commands/misc/set-access-token";
-import { listPackages } from "./commands/package/listpackages";
-import { publish } from "./commands/package/publish";
-import { listEnvironments } from "./commands/environment/listenvironments";
-import { registerRmCommands } from "./commands/rm";
-import { registerSetCommands } from "./commands/set";
-import { registerUpdateCommands } from "./commands/update";
-import {
-   archiveVersion,
-   unarchiveVersion,
-} from "./commands/version/archive-unarchive-version";
-import { rerun } from "./commands/materialization/rerun";
-import { cancelRun } from "./commands/materialization/cancelrun";
-import {
-   ASCII_TITLE,
-   Cluster,
-   CLUSTER_BY_ENVIRONMENT,
-   controlPlanesByEnv,
-   DEFAULT_ENVIRONMENT_BY_CLUSTER,
-   getCliOrgConfig,
-} from "./constants";
-
-const clientConfig = new ClientConfiguration();
-
-// `cred login` is the documented recovery path for a corrupt `~/.cred`, and the
-// one command whose job is to (re)establish config. The startup reads below —
-// the axios baseURL and every getActiveEnvironment() call during command
-// registration — invoke loadConfig() eagerly at module load, so a corrupt
-// config throws here, before the login action ever runs, dead-ending the very
-// command meant to fix it. Recover up front, but ONLY for login: every other
-// command stays fail-loud (the thrown error still names `cred login` as the
-// fix) so a stray read never silently resets a user's tokens.
-if (isLoginInvocation(process.argv)) {
-   clientConfig.recoverIfCorrupt();
-}
-
-const getActiveEnvironment = () => {
-   return clientConfig.getEnvironment();
-};
-axios.defaults.baseURL = controlPlanesByEnv[getActiveEnvironment()];
-
-const cli = program
-   .version(
-      cliPackage.version,
-      "-V, --cli-version",
-      "Output the CLI version number",
-   )
-   .description(kleur.green(ASCII_TITLE));
-
-// Nested CRUD commands for resource management
-registerGetCommands(cli, getActiveEnvironment());
-registerListCommands(cli, getActiveEnvironment());
-registerUpdateCommands(cli, getActiveEnvironment());
-registerRmCommands(cli, getActiveEnvironment());
-registerAddCommands(cli, getActiveEnvironment());
-registerSetCommands(cli);
-
-// Root commands
-cli.command("publish")
-   .description("Publish a new version of the package.")
-   .option("--debug")
-   .option("-y, --yes", "Skip confirmation.")
-   .option(
-      "--replication <replication_count>",
-      "The number of replicas to create.",
-      (v) => (v === undefined ? undefined : parseInt(v)),
-      undefined,
-   )
-   .option(
-      "--set-latest",
-      "Set this version as the latest version of the package.",
-      false,
-   )
-   .action((options) => {
-      publish(
-         controlPlanesByEnv[getActiveEnvironment()],
-         options.replicationCount,
-         options.debug,
-         options.yes,
-         options.setLatest,
-      );
-   });
-
-cli.command("archive")
-   .description("Archive a version of a package.")
-   .argument(
-      "<packageName>",
-      "The name of the package to archive the version of.",
-   )
-   .argument("<versionId>", "The id of the version to archive.")
-   .option("--debug")
-   .option("-y, --yes", "Skip confirmation.")
-   .action((packageName, versionId, options) => {
-      archiveVersion(
-         controlPlanesByEnv[getActiveEnvironment()],
-         packageName,
-         versionId,
-         options.debug,
-         options.yes,
-      );
-   });
-
-cli.command("unarchive")
-   .description("Unarchive a version of a package.")
-   .argument(
-      "<packageName>",
-      "The name of the package to unarchive the version of.",
-   )
-   .argument("<versionId>", "The id of the version to unarchive.")
-   .option("--debug")
-   .option("-y, --yes", "Skip confirmation.")
-   .action((packageName, versionId, options) => {
-      unarchiveVersion(
-         controlPlanesByEnv[getActiveEnvironment()],
-         packageName,
-         versionId,
-         options.debug,
-         options.yes,
-      );
-   });
-
-cli.command("rerun")
-   .description(
-      "Trigger an on-demand run (rebuild/refresh) for a package version. Defaults to a full run (all sources, indexes and pre-aggregations); use --source/--dimension/--measure/--model-file to scope it to a single unit.",
-   )
-   .argument("<packageName>", "The name of the package to run.")
-   .argument("<versionId>", "The version to (re)build (e.g. 0.1.21).")
-   .option("--debug")
-   .option("-y, --yes", "Skip confirmation.")
-   .option("--source <sourceName>", "Scope the run to a single persist source.")
-   .option(
-      "--dimension <dimension>",
-      "Scope the run to a single indexed dimension.",
-   )
-   .option(
-      "--measure <measure>",
-      "Scope the run to a single pre-aggregated measure. Rebuilds the rollup serving it; add --source when the measure is declared at more than one grain.",
-   )
-   .option(
-      "--model-file <modelFilePath>",
-      "Disambiguate a dimension/source defined in more than one model file.",
-   )
-   .option(
-      "--include-upstream",
-      "Also force-rebuild the target's upstream persisted closure (only meaningful with --source/--dimension/--measure).",
-      false,
-   )
-   .action((packageName, versionId, options) => {
-      rerun(
-         controlPlanesByEnv[getActiveEnvironment()],
-         packageName,
-         versionId,
-         {
-            source: options.source,
-            dimension: options.dimension,
-            measure: options.measure,
-            modelFile: options.modelFile,
-            includeUpstream: options.includeUpstream,
-         },
-         options.debug,
-         options.yes,
-      );
-   });
-
-cli.command("cancel-run")
-   .description("Cancel an in-flight (non-terminal) run.")
-   .argument("<packageName>", "The name of the package that owns the run.")
-   .argument("<runId>", "The id of the run to cancel.")
-   .option("--debug")
-   .option("-y, --yes", "Skip confirmation.")
-   .action((packageName, runId, options) => {
-      cancelRun(
-         controlPlanesByEnv[getActiveEnvironment()],
-         packageName,
-         runId,
-         options.debug,
-         options.yes,
-      );
-   });
-
-cli.command("login")
-   .description("Login into Credible service.")
-   .argument("<organizationName>", "The organization to login to.")
-   .option(
-      "-c, --cluster <cluster>",
-      "Target cluster: 'gcp' or 'aws'. Defaults to the org's default cluster (gcp for most orgs).",
-   )
-   .action((organizationName, options) => {
-      const orgConfig = getCliOrgConfig(organizationName);
-      const currentEnv = clientConfig.getEnvironment();
-
-      // Determine the target cluster. Precedence:
-      //   1. Explicit -c/--cluster flag.
-      //   2. The org's defaultCluster (from CliOrgConfig), if registered.
-      //   3. The cluster of the current activeEnvironment — i.e. don't touch
-      //      anything. Unregistered orgs with no flag stay wherever the user
-      //      already set themselves via ms2ad set-env.
-      let cluster: Cluster;
-      if (options.cluster !== undefined) {
-         const requested = String(options.cluster).toLowerCase();
-         if (requested !== "gcp" && requested !== "aws") {
-            console.error(
-               `Invalid --cluster value '${options.cluster}'. Must be 'gcp' or 'aws'.`,
-            );
-            process.exit(1);
-         }
-         cluster = requested;
-      } else if (orgConfig) {
-         cluster = orgConfig.defaultCluster;
-      } else {
-         cluster = CLUSTER_BY_ENVIRONMENT[currentEnv];
-      }
-
-      // Unregistered orgs implicitly support only gcp; registered orgs declare
-      // their cluster list. Reject anything else.
-      const supportedClusters: Cluster[] = orgConfig?.supportedClusters ?? [
-         "gcp",
-      ];
-      if (!supportedClusters.includes(cluster)) {
-         console.error(
-            `Organization '${organizationName}' is not available on the ${cluster} cluster.`,
-         );
-         process.exit(1);
-      }
-
-      // Respect a previously-set activeEnvironment if it's already on the chosen
-      // cluster (e.g. `ms2ad set-env staging && cred login demo` stays on staging).
-      // Only flip envs when the current one is on a different cluster.
-      const targetEnv =
-         CLUSTER_BY_ENVIRONMENT[currentEnv] === cluster
-            ? currentEnv
-            : DEFAULT_ENVIRONMENT_BY_CLUSTER[cluster];
-      if (targetEnv !== currentEnv) {
-         clientConfig.setEnvironment(targetEnv);
-      }
-      login(
-         organizationName,
-         controlPlanesByEnv[targetEnv],
-         undefined,
-         cluster,
-      );
-   });
-
-cli.command("logout")
-   .description("Resets Credible service credentials")
-   .action(logout);
-
-cli.command("set-access-token")
-   .description("Set a service account JWT token for CLI authentication")
-   .argument("<jwtToken>", "The JWT token to use for authentication")
-   .option("-o, --organization <organizationName>", "Organization name to set")
-   .action((jwtToken, options) => {
-      setAccessToken(jwtToken, options.organization);
-   });
-
-cli.command("status")
-   .description(
-      "Shows the cell this CLI targets, and the active organization and environment.",
-   )
-   .action(() => {
-      const config = new ClientConfiguration();
-      config.printStatus();
-   });
-
-const complete = omelette("credible").tree({
-   // CRUD commands
-   get: [
-      "environment",
-      "project",
-      "group",
-      "permission",
-      "materialization",
-      "index",
-      "run",
-   ],
-   ls: [
-      "environment",
-      "project",
-      "connection",
-      "package",
-      "version",
-      "materialization",
-      "index",
-      "run",
-      "group",
-      "group-access-token",
-      "permission",
-   ],
-   update: ["environment", "project", "package"],
-   rm: [
-      "environment",
-      "project",
-      "connection",
-      "package",
-      "group",
-      "member",
-      "group-access-token",
-      "permission",
-   ],
-   add: [
-      "environment",
-      "project",
-      "connection",
-      "group",
-      "member",
-      "group-access-token",
-      "permission",
-   ],
-   // Misc commands
-   set: ["environment", "project"],
-   login: [],
-   logout: [],
-   "set-access-token": [],
-   status: [],
-   publish: [],
-   archive: [],
-   unarchive: [],
-   rerun: [],
-   "cancel-run": [],
-});
-
-complete.onAsync("$3", async ({ reply, line }) => {
-   const environmentRelatedCommands = [
-      "set environment",
-      "get environment",
-      "rm environment",
-      "set project",
-      "get project",
-      "rm project",
-   ];
-   if (environmentRelatedCommands.some((cmd) => line.includes(cmd))) {
-      reply(
-         listEnvironments(
-            controlPlanesByEnv[getActiveEnvironment()],
-            false,
-         ).then((result) =>
-            result.projects.map((environment) => environment.name),
-         ),
-      );
-   }
-   const packageRelatedCommands = ["rm package", "ls version"];
-   if (packageRelatedCommands.some((cmd) => line.includes(cmd))) {
-      reply(
-         listPackages(controlPlanesByEnv[getActiveEnvironment()], false).then(
-            (result) => result.packages.map((_package) => _package.name),
-         ),
-      );
-   }
-});
-
-complete.next(() => {
-   program.parse(process.argv);
-});
-
-if (~process.argv.indexOf("--cleanup")) {
-   complete.cleanupShellInitFile();
-   process.exit(0);
-}
-
-if (~process.argv.indexOf("--install")) {
-   complete.setupShellInitFile();
-   console.log("CLI installed successfully!");
-   process.exit(0);
-}
-
-complete.init();