@faable/faable 1.36.0 → 1.37.0

package/dist/commands/auth/users/get.js

@@ -1,11 +1,18 @@
 import { withAuthHints, requireAuthAdmin } from '../../../api/auth_admin.js';
 import { log } from '../../../log.js';
 import { json_option, tenant_options } from '../options.js';
+import { fetch_items } from '../paging.js';
 import { print_json, yes_no, when } from '../render.js';
 
+// Identity rows carry the RAW provider access/refresh tokens — strip them
+// before anything (json output included) can print one.
+const sanitize_identity = (i) => {
+    const { access_token: _a, access_token_secret: _s, refresh_token: _r, ...safe } = i;
+    return safe;
+};
 const users_get = {
     command: 'get <user_id>',
-    describe: 'Show a user',
+    describe: 'Show a user, including their federated identities',
     builder: yargs => json_option(tenant_options(yargs))
         .positional('user_id', {
         type: 'string',
@@ -16,8 +23,22 @@ const users_get = {
     handler: withAuthHints(async (args) => {
         const api = await requireAuthAdmin(args);
         const user = await api.userGet(args.user_id);
+        // Federated identities (GitHub, Google…): who this user IS at the
+        // provider — the piece the abuse playbook keeps needing (a Faable email
+        // rarely matches the GitHub handle that owns the deployed repos).
+        // Best-effort: a tenant where the session can't read /identity still
+        // renders the user card.
+        const identities = await fetch_items(api.identityList({ query: `user:${args.user_id}` }), true)
+            .then(r => r.items.map(i => sanitize_identity(i)))
+            .catch(() => []);
+        // Resolve connection ids to names ("github") once per distinct id.
+        const connection_names = new Map();
+        for (const id of new Set(identities.map(i => String(i.connection ?? '')).filter(Boolean))) {
+            const conn = (await api.connectionGet(id).catch(() => null));
+            connection_names.set(id, conn?.connection_name ?? conn?.connection_type ?? id);
+        }
         if (args.json)
-            return print_json(user);
+            return print_json({ ...user, identities });
         log.info(`👤 ${user.id}`);
         log.info(`  Email:      ${user.email ?? '-'} (verified: ${yes_no(user.email_verified)})`);
         log.info(`  Name:       ${user.name ?? '-'}`);
@@ -36,6 +57,24 @@ const users_get = {
         else {
             log.info('  Suspended:  no');
         }
+        if (identities.length > 0) {
+            log.info(`  Identities:`);
+            for (const identity of identities) {
+                const conn = connection_names.get(String(identity.connection ?? '')) ?? '-';
+                const pd = (identity.profile_data ?? {});
+                const bits = [
+                    pd.login ?? String(identity.identity_id ?? '-'),
+                    pd.html_url,
+                    // Provider-account age is triage gold: a repo pushed from a
+                    // years-old GitHub account reads differently than one created
+                    // this morning.
+                    pd.created_at ? `account since ${String(pd.created_at).slice(0, 10)}` : undefined,
+                    pd.email && pd.email !== user.email ? `email ${pd.email}` : undefined,
+                    pd.location ? `location ${pd.location}` : undefined
+                ].filter(Boolean);
+                log.info(`    ${conn}: ${bits.join(' · ')}`);
+            }
+        }
     })
 };
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@faable/faable",
-  "version": "1.36.0",
+  "version": "1.37.0",
   "main": "dist/index.js",
   "license": "MIT",
   "author": "Marc Pomar <marc@faable.com>",