@faable/faable 1.30.0 → 1.32.0

package/dist/api/FaableApi.js

@@ -12,6 +12,20 @@ const firstPage = async (res) => {
     const items = (await res).results;
     return items;
 };
+// Walk the cursor to exhaustion. `list()` needs this instead of `firstPage`:
+// a user who sees many apps (admins see all of them) gets a multi-page
+// listing, and matching by repository against a truncated first page made
+// every repo-resolved command answer "No app linked to this repository".
+const allPages = async (fetch_page) => {
+    const items = [];
+    let next;
+    do {
+        const page = await fetch_page(next);
+        items.push(...page.results);
+        next = page.next ?? undefined;
+    } while (next);
+    return items;
+};
 const data = async (res) => {
     const items = (await res).data;
     return items;
@@ -84,7 +98,9 @@ class FaableApi {
         return new FaableApi(config);
     }
     async list() {
-        return firstPage(data(this.client.get(`/app`)));
+        return allPages((next) => data(this.client.get(`/app`, {
+            params: { pageSize: 200, ...(next ? { next } : {}) },
+        })));
     }
     async getBySlug(slug) {
         return data(this.client.get(`/app/slug/${slug}`));

package/dist/api/auth_admin.js

@@ -0,0 +1,67 @@
+import { FaableAuthApi } from '@faable/auth-sdk';
+import { CredentialsStore } from '../lib/CredentialsStore.js';
+import { log } from '../log.js';
+import { loadLiveCredentials } from './session.js';
+
+// Default tenant host. `faable auth` is customer-facing: a customer targets
+// their own tenant with --auth-url https://<account>.auth.faable.link (or
+// FAABLE_AUTH_URL); the default points at the Faable tenant.
+const DEFAULT_AUTH_URL = 'https://faable.auth.faable.link';
+// Build a management-API client for the Auth server reusing the CLI session
+// (FAABLE_TOKEN → `faable login` credentials, auto-refreshed). The bearer is
+// sent as-is and the SERVER decides whether it may manage the target tenant
+// (today MGMT_AUTH_ENFORCE is authz dry-run; when enforced, tokens without the
+// management audience/scopes for the tenant will get 403 — see
+// auth/docs/management-api-m2m-token.md for the M2M path).
+const requireAuthAdmin = async (opts = {}) => {
+    let token = process.env.FAABLE_TOKEN;
+    if (!token) {
+        const store = new CredentialsStore();
+        const config = await loadLiveCredentials(store);
+        if (config?.apikey && !config.token) {
+            // Deploy API keys are not Auth management credentials.
+            log.error("❌ You are logged in with an API key, but `faable auth` needs a browser session. Run 'faable login' (without --apikey) first.");
+            process.exit(1);
+        }
+        token = config?.token;
+    }
+    if (!token) {
+        log.error("❌ Not logged in. Run 'faable login' first.");
+        process.exit(1);
+    }
+    const domain = opts.authUrl || process.env.FAABLE_AUTH_URL || DEFAULT_AUTH_URL;
+    const account = opts.account || process.env.FAABLE_AUTH_ACCOUNT;
+    return new FaableAuthApi({
+        domain,
+        ...(account ? { headers: { account_id: account } } : {}),
+        // Static bearer: passing no `auth` keeps sdk-base from attaching any token
+        // strategy, so this header is used verbatim on every request.
+        fetcher: { headers: { Authorization: `Bearer ${token}` } }
+    });
+};
+// Translate raw management-API failures into actionable CLI errors. Everything
+// else is rethrown untouched (FaableApiError messages already carry
+// status+url) and lands in the global yargs .fail() handler.
+const hintAuthError = (e) => {
+    const status = e?.response?.status;
+    if (status === 401) {
+        throw new Error("Unauthorized (401) by the Auth management API. Your session may have expired — run 'faable login' and retry.");
+    }
+    if (status === 403) {
+        throw new Error('Forbidden (403): your session is not allowed to manage this tenant. Check --auth-url/--account, or use credentials with management access for it.');
+    }
+    throw e;
+};
+// Wrap a yargs handler so management-API errors surface with the hints above.
+const withAuthHints = (handler) => {
+    return async (args) => {
+        try {
+            await handler(args);
+        }
+        catch (e) {
+            hintAuthError(e);
+        }
+    };
+};
+
+export { hintAuthError, requireAuthAdmin, withAuthHints };

package/dist/commands/auth/actions/create.js

@@ -0,0 +1,62 @@
+import fs from 'fs-extra';
+import { withAuthHints, requireAuthAdmin } from '../../../api/auth_admin.js';
+import { log } from '../../../log.js';
+import { json_option, tenant_options } from '../options.js';
+import { print_json } from '../render.js';
+
+const actions_create = {
+    command: 'create',
+    describe: 'Create an action',
+    builder: yargs => json_option(tenant_options(yargs))
+        .option('name', {
+        alias: 'n',
+        type: 'string',
+        demandOption: true,
+        description: 'Action name (max 200 chars)'
+    })
+        .option('trigger', {
+        alias: 't',
+        type: 'string',
+        choices: ['post-login', 'continue'],
+        demandOption: true,
+        description: 'Trigger point'
+    })
+        .option('code-file', {
+        alias: 'f',
+        type: 'string',
+        description: 'Path to a JS file with the action code'
+    })
+        .option('disabled', {
+        type: 'boolean',
+        default: false,
+        description: 'Create the action disabled'
+    })
+        .option('order', {
+        type: 'number',
+        description: 'Execution order (lower runs first, default 0)'
+    })
+        .example('$0 auth actions create -n add-claims -t post-login -f ./claims.js', 'Create a post-login action from a file')
+        .showHelpOnFail(false),
+    handler: withAuthHints(async (args) => {
+        let code;
+        if (args.codeFile) {
+            if (!(await fs.pathExists(args.codeFile))) {
+                throw new Error(`Code file not found: ${args.codeFile}`);
+            }
+            code = await fs.readFile(args.codeFile, 'utf8');
+        }
+        const api = await requireAuthAdmin(args);
+        const action = await api.actionCreate({
+            name: args.name,
+            trigger: args.trigger,
+            ...(code !== undefined ? { code } : {}),
+            ...(args.disabled ? { enabled: false } : {}),
+            ...(args.order !== undefined ? { order: args.order } : {})
+        });
+        if (args.json)
+            return print_json(action);
+        log.info(`✅ Created action ${action.id} (${action.name}, trigger ${action.trigger})`);
+    })
+};
+
+export { actions_create };

package/dist/commands/auth/actions/get.js

@@ -0,0 +1,40 @@
+import { withAuthHints, requireAuthAdmin } from '../../../api/auth_admin.js';
+import { log } from '../../../log.js';
+import { json_option, tenant_options } from '../options.js';
+import { print_json, yes_no } from '../render.js';
+
+const actions_get = {
+    command: 'get <action_id>',
+    describe: 'Show an action (use --code to print its source)',
+    builder: yargs => json_option(tenant_options(yargs))
+        .positional('action_id', {
+        type: 'string',
+        demandOption: true,
+        description: 'Action identifier'
+    })
+        .option('code', {
+        type: 'boolean',
+        default: false,
+        description: 'Print the action source code'
+    })
+        .showHelpOnFail(false),
+    handler: withAuthHints(async (args) => {
+        const api = await requireAuthAdmin(args);
+        const action = await api.actionGet(args.action_id);
+        if (args.json)
+            return print_json(action);
+        log.info(`⚙️ ${action.id}`);
+        log.info(`  Name:    ${action.name ?? '-'}`);
+        log.info(`  Trigger: ${action.trigger ?? '-'}`);
+        log.info(`  Enabled: ${yes_no(action.enabled)}`);
+        log.info(`  Order:   ${action.order ?? 0}`);
+        log.info(`  Created: ${action.createdAt ?? '-'}`);
+        if (args.code) {
+            log.info('  Code:');
+            // Raw to stdout so it can be piped to a file untouched.
+            process.stdout.write((action.code ?? '') + '\n');
+        }
+    })
+};
+
+export { actions_get };

package/dist/commands/auth/actions/index.js

@@ -0,0 +1,19 @@
+import { actions_create } from './create.js';
+import { actions_get } from './get.js';
+import { actions_list } from './list.js';
+import { actions_rm } from './rm.js';
+
+const actions = {
+    command: 'actions',
+    describe: 'Manage auth actions (login-flow hooks)',
+    builder: yargs => yargs
+        .command(actions_list)
+        .command(actions_get)
+        .command(actions_create)
+        .command(actions_rm)
+        .demandCommand(1)
+        .showHelpOnFail(false),
+    handler: () => { }
+};
+
+export { actions };

package/dist/commands/auth/actions/list.js

@@ -0,0 +1,43 @@
+import { withAuthHints, requireAuthAdmin } from '../../../api/auth_admin.js';
+import { log } from '../../../log.js';
+import { json_option, list_options, tenant_options } from '../options.js';
+import { fetch_items } from '../paging.js';
+import { print_json, yes_no, when, table_lines } from '../render.js';
+
+const actions_list = {
+    command: 'list',
+    describe: 'List actions',
+    builder: yargs => json_option(list_options(tenant_options(yargs)))
+        .option('query', {
+        type: 'string',
+        description: 'FaableQL filter, e.g. "trigger:post-login"'
+    })
+        .showHelpOnFail(false),
+    handler: withAuthHints(async (args) => {
+        const api = await requireAuthAdmin(args);
+        const { items, more } = await fetch_items(api.actionList({ query: args.query, pageSize: args.limit }), args.all);
+        if (args.json)
+            return print_json(items);
+        if (items.length === 0) {
+            log.info('📭 No actions.');
+            return;
+        }
+        log.info(`⚙️ ${items.length} action(s):`);
+        const rows = items.map(a => [
+            a.id ?? '-',
+            a.name ?? '-',
+            a.trigger ?? '-',
+            yes_no(a.enabled),
+            String(a.order ?? 0),
+            when(a.createdAt)
+        ]);
+        for (const line of table_lines(['ID', 'NAME', 'TRIGGER', 'ENABLED', 'ORDER', 'CREATED'], rows)) {
+            log.info(`  ${line}`);
+        }
+        if (more) {
+            log.info('… more results available: raise --limit or use --all.');
+        }
+    })
+};
+
+export { actions_list };

package/dist/commands/auth/actions/rm.js

@@ -0,0 +1,45 @@
+import prompts from 'prompts';
+import { withAuthHints, requireAuthAdmin } from '../../../api/auth_admin.js';
+import { log } from '../../../log.js';
+import { tenant_options } from '../options.js';
+
+const actions_rm = {
+    command: 'rm <action_id>',
+    describe: 'Delete an action',
+    builder: yargs => tenant_options(yargs)
+        .positional('action_id', {
+        type: 'string',
+        demandOption: true,
+        description: 'Action identifier'
+    })
+        .option('yes', {
+        alias: 'y',
+        type: 'boolean',
+        default: false,
+        description: 'Skip the confirmation prompt'
+    })
+        .showHelpOnFail(false),
+    handler: withAuthHints(async (args) => {
+        const api = await requireAuthAdmin(args);
+        // Fetch first: shows WHAT will be deleted and 404s before the prompt.
+        const action = await api.actionGet(args.action_id);
+        if (!args.yes) {
+            const { confirm } = await prompts({
+                type: 'toggle',
+                name: 'confirm',
+                message: `Delete action "${action.name}" (${action.id}, trigger ${action.trigger})?`,
+                initial: false,
+                active: 'yes',
+                inactive: 'no'
+            });
+            if (!confirm) {
+                log.info('Cancelled.');
+                return;
+            }
+        }
+        await api.actionDelete(args.action_id);
+        log.info(`🗑️ Deleted action ${args.action_id}.`);
+    })
+};
+
+export { actions_rm };

package/dist/commands/auth/clients/create.js

@@ -0,0 +1,56 @@
+import { withAuthHints, requireAuthAdmin } from '../../../api/auth_admin.js';
+import { log } from '../../../log.js';
+import { json_option, tenant_options } from '../options.js';
+import { print_json } from '../render.js';
+
+const clients_create = {
+    command: 'create',
+    describe: 'Create an OAuth client',
+    builder: yargs => json_option(tenant_options(yargs))
+        .option('name', {
+        alias: 'n',
+        type: 'string',
+        demandOption: true,
+        description: 'Client name'
+    })
+        .option('description', {
+        alias: 'd',
+        type: 'string',
+        description: 'Client description'
+    })
+        .option('callback', {
+        type: 'string',
+        array: true,
+        description: 'Allowed callback (redirect) URL — repeatable'
+    })
+        .option('logout-url', {
+        type: 'string',
+        array: true,
+        description: 'Allowed post-logout URL — repeatable'
+    })
+        .option('web-origin', {
+        type: 'string',
+        array: true,
+        description: 'Allowed web origin (CORS) — repeatable'
+    })
+        .example('$0 auth clients create -n my-app --callback https://app.example.com/callback', 'Create a client with one redirect URL')
+        .showHelpOnFail(false),
+    handler: withAuthHints(async (args) => {
+        const api = await requireAuthAdmin(args);
+        const client = await api.clientCreate({
+            name: args.name,
+            ...(args.description ? { description: args.description } : {}),
+            ...(args.callback?.length ? { callbacks: args.callback } : {}),
+            ...(args.logoutUrl?.length ? { logout_urls: args.logoutUrl } : {}),
+            ...(args.webOrigin?.length ? { web_origins: args.webOrigin } : {})
+        });
+        if (args.json)
+            return print_json(client);
+        log.info(`✅ Created client "${client.name}" (${client.id})`);
+        log.info(`  Client ID:     ${client.client_id}`);
+        log.info(`  Client secret: ${client.client_secret}`);
+        log.info('  ⚠️ Store the secret now — treat it like a password.');
+    })
+};
+
+export { clients_create };

package/dist/commands/auth/clients/get.js

@@ -0,0 +1,46 @@
+import { withAuthHints, requireAuthAdmin } from '../../../api/auth_admin.js';
+import { log } from '../../../log.js';
+import { json_option, tenant_options } from '../options.js';
+import { print_json } from '../render.js';
+import { resolve_client } from './resolve.js';
+
+const clients_get = {
+    command: 'get <client_id>',
+    describe: 'Show an OAuth client',
+    builder: yargs => json_option(tenant_options(yargs))
+        .positional('client_id', {
+        type: 'string',
+        demandOption: true,
+        description: 'Client resource id or OAuth client_id'
+    })
+        .option('secret', {
+        type: 'boolean',
+        default: false,
+        description: 'Also print the client secret'
+    })
+        .showHelpOnFail(false),
+    handler: withAuthHints(async (args) => {
+        const api = await requireAuthAdmin(args);
+        const client = await resolve_client(api, args.client_id);
+        if (args.json)
+            return print_json(client);
+        log.info(`🔑 ${client.name ?? client.id}`);
+        log.info(`  ID:          ${client.id}`);
+        log.info(`  Client ID:   ${client.client_id ?? '-'}`);
+        if (args.secret) {
+            log.info(`  Secret:      ${client.client_secret ?? '-'}`);
+        }
+        if (client.description)
+            log.info(`  Description: ${client.description}`);
+        log.info(`  Callbacks:   ${client.callbacks?.length ? client.callbacks.join(', ') : '-'}`);
+        if (client.logout_urls?.length) {
+            log.info(`  Logout URLs: ${client.logout_urls.join(', ')}`);
+        }
+        if (client.web_origins?.length) {
+            log.info(`  Web origins: ${client.web_origins.join(', ')}`);
+        }
+        log.info(`  Created:     ${client.createdAt ?? '-'}`);
+    })
+};
+
+export { clients_get };

package/dist/commands/auth/clients/index.js

@@ -0,0 +1,19 @@
+import { clients_create } from './create.js';
+import { clients_get } from './get.js';
+import { clients_list } from './list.js';
+import { clients_rm } from './rm.js';
+
+const clients = {
+    command: 'clients',
+    describe: 'Manage OAuth clients',
+    builder: yargs => yargs
+        .command(clients_list)
+        .command(clients_get)
+        .command(clients_create)
+        .command(clients_rm)
+        .demandCommand(1)
+        .showHelpOnFail(false),
+    handler: () => { }
+};
+
+export { clients };

package/dist/commands/auth/clients/list.js

@@ -0,0 +1,41 @@
+import { withAuthHints, requireAuthAdmin } from '../../../api/auth_admin.js';
+import { log } from '../../../log.js';
+import { json_option, list_options, tenant_options } from '../options.js';
+import { fetch_items } from '../paging.js';
+import { print_json, truncate, when, table_lines } from '../render.js';
+
+const clients_list = {
+    command: 'list',
+    describe: 'List OAuth clients',
+    builder: yargs => json_option(list_options(tenant_options(yargs)))
+        .option('q', {
+        type: 'string',
+        description: 'Full-text search over name/description/client_id'
+    })
+        .showHelpOnFail(false),
+    handler: withAuthHints(async (args) => {
+        const api = await requireAuthAdmin(args);
+        const { items, more } = await fetch_items(api.clientList({ q: args.q, pageSize: args.limit }), args.all);
+        if (args.json)
+            return print_json(items);
+        if (items.length === 0) {
+            log.info('📭 No clients.');
+            return;
+        }
+        log.info(`🔑 ${items.length} client(s):`);
+        const rows = items.map(c => [
+            c.client_id ?? '-',
+            truncate(c.name, 28),
+            String(c.callbacks?.length ?? 0),
+            when(c.createdAt)
+        ]);
+        for (const line of table_lines(['CLIENT_ID', 'NAME', 'CALLBACKS', 'CREATED'], rows)) {
+            log.info(`  ${line}`);
+        }
+        if (more) {
+            log.info('… more results available: raise --limit or use --all.');
+        }
+    })
+};
+
+export { clients_list };

package/dist/commands/auth/clients/resolve.js

@@ -0,0 +1,21 @@
+// Accept either the resource id (the /client/:id param) or the OAuth
+// `client_id`. The direct lookup rejects a non-resource id with 400 (schema
+// format) or 404 — on either, fall back to a search (the management list is
+// searchable by client_id) and use a single exact match.
+const resolve_client = async (api, id) => {
+    try {
+        return await api.clientGet(id);
+    }
+    catch (e) {
+        const status = e?.response?.status;
+        if (status !== 404 && status !== 400)
+            throw e;
+        const candidates = await api.clientList({ q: id, pageSize: 10 }).pass();
+        const exact = candidates.results.filter(c => c.client_id === id);
+        if (exact.length === 1)
+            return exact[0];
+        throw new Error(`Client not found: ${id}`, { cause: e });
+    }
+};
+
+export { resolve_client };

package/dist/commands/auth/clients/rm.js

@@ -0,0 +1,45 @@
+import prompts from 'prompts';
+import { withAuthHints, requireAuthAdmin } from '../../../api/auth_admin.js';
+import { log } from '../../../log.js';
+import { tenant_options } from '../options.js';
+import { resolve_client } from './resolve.js';
+
+const clients_rm = {
+    command: 'rm <client_id>',
+    describe: 'Delete an OAuth client',
+    builder: yargs => tenant_options(yargs)
+        .positional('client_id', {
+        type: 'string',
+        demandOption: true,
+        description: 'Client resource id or OAuth client_id'
+    })
+        .option('yes', {
+        alias: 'y',
+        type: 'boolean',
+        default: false,
+        description: 'Skip the confirmation prompt'
+    })
+        .showHelpOnFail(false),
+    handler: withAuthHints(async (args) => {
+        const api = await requireAuthAdmin(args);
+        const client = await resolve_client(api, args.client_id);
+        if (!args.yes) {
+            const { confirm } = await prompts({
+                type: 'toggle',
+                name: 'confirm',
+                message: `Delete client "${client.name}" (${client.client_id})? Apps using it will stop authenticating.`,
+                initial: false,
+                active: 'yes',
+                inactive: 'no'
+            });
+            if (!confirm) {
+                log.info('Cancelled.');
+                return;
+            }
+        }
+        await api.clientDelete(client.id);
+        log.info(`🗑️ Deleted client ${client.client_id} (${client.id}).`);
+    })
+};
+
+export { clients_rm };

package/dist/commands/auth/index.js

@@ -0,0 +1,23 @@
+import { actions } from './actions/index.js';
+import { clients } from './clients/index.js';
+import { logs } from './logs/index.js';
+import { users } from './users/index.js';
+
+// `faable auth` — management commands for a Faable Auth tenant. Auth: reuses
+// the `faable login` session (or FAABLE_TOKEN); tenant: --auth-url /
+// FAABLE_AUTH_URL (defaults to the Faable tenant host). See
+// src/api/auth_admin.ts.
+const auth = {
+    command: 'auth',
+    describe: 'Manage Faable Auth (users, actions, clients, audit logs)',
+    builder: yargs => yargs
+        .command(users)
+        .command(actions)
+        .command(clients)
+        .command(logs)
+        .demandCommand(1)
+        .showHelpOnFail(false),
+    handler: () => { }
+};
+
+export { auth };

package/dist/commands/auth/logs/get.js

@@ -0,0 +1,48 @@
+import { withAuthHints, requireAuthAdmin } from '../../../api/auth_admin.js';
+import { log } from '../../../log.js';
+import { json_option, tenant_options } from '../options.js';
+import { print_json, log_status_badge } from '../render.js';
+
+const logs_get = {
+    command: 'get <log_id>',
+    describe: 'Show an audit log entry',
+    builder: yargs => json_option(tenant_options(yargs))
+        .positional('log_id', {
+        type: 'string',
+        demandOption: true,
+        description: 'Log entry identifier'
+    })
+        .showHelpOnFail(false),
+    handler: withAuthHints(async (args) => {
+        const api = await requireAuthAdmin(args);
+        const entry = await api.logGet(args.log_id);
+        if (args.json)
+            return print_json(entry);
+        log.info(`📜 ${entry.id}`);
+        log.info(`  Date:    ${entry.createdAt ?? '-'}`);
+        log.info(`  Type:    ${entry.type ?? '-'}`);
+        log.info(`  Status:  ${log_status_badge(entry.status)}`);
+        if (entry.message)
+            log.info(`  Message: ${entry.message}`);
+        const refs = [
+            ['User', entry.user],
+            ['Client', entry.client],
+            ['Connection', entry.connection],
+            ['Team', entry.team],
+            ['Identity', entry.identity]
+        ];
+        for (const [label, ref] of refs) {
+            if (!ref)
+                continue;
+            const id = typeof ref === 'string' ? ref : ref.id;
+            if (id)
+                log.info(`  ${label}:${' '.repeat(Math.max(1, 8 - label.length))}${id}`);
+        }
+        if (entry.data !== undefined && entry.data !== null) {
+            log.info('  Data:');
+            process.stdout.write(JSON.stringify(entry.data, null, 2) + '\n');
+        }
+    })
+};
+
+export { logs_get };

package/dist/commands/auth/logs/index.js

@@ -0,0 +1,15 @@
+import { logs_get } from './get.js';
+import { logs_list } from './list.js';
+
+const logs = {
+    command: 'logs',
+    describe: 'Browse the audit log (read-only)',
+    builder: yargs => yargs
+        .command(logs_list)
+        .command(logs_get)
+        .demandCommand(1)
+        .showHelpOnFail(false),
+    handler: () => { }
+};
+
+export { logs };