@faable/faable 3.4.0 → 3.4.1

package/dist/api/FaableApi.js

@@ -102,6 +102,14 @@ class FaableApi {
     static create(config = {}) {
         return new FaableApi(config);
     }
+    // A short-lived Management API token for ONE Faable Auth tenant, issued by
+    // the deploy api after checking the caller belongs to the project that owns
+    // it (phase 2 of arch/auth/management-api-tenant-isolation.md). `faable auth`
+    // manages tenants with it instead of the `faable login` token, which stops
+    // being platform-superadmin in phase 3.
+    async issueAuthAccountToken(account_id) {
+        return data(this.client.post(`/auth-accounts/${account_id}/token`));
+    }
     async list() {
         return allPages(next => data(this.client.get(`/app`, {
             params: { pageSize: 200, ...(next ? { next } : {}) }

package/dist/api/auth_admin.js

@@ -1,7 +1,9 @@
 import { CredentialsStore } from '../lib/CredentialsStore.js';
 import { log } from '../log.js';
-import { createBearerAuthApi } from './auth.js';
+import { FaableApi } from './FaableApi.js';
+import { createBearerAuthApi, createAnonymousAuthApi } from './auth.js';
 import { loadLiveCredentials } from './session.js';
+import { bearer_strategy } from './strategies/bearer.strategy.js';
 
 // Default tenant host. `faable auth` is customer-facing: a customer targets
 // their own tenant with --auth-url https://<account>.auth.faable.link (or
@@ -31,10 +33,50 @@ const requireAuthAdmin = async (opts = {}) => {
     }
     const domain = opts.authUrl || process.env.FAABLE_AUTH_URL || DEFAULT_AUTH_URL;
     const account = opts.account || process.env.FAABLE_AUTH_ACCOUNT;
-    // The session's bearer as a strategy — with the CLI's own identity on the
-    // wire instead of `auth-sdk` — scoped to the target tenant when one was
-    // named. The server decides whether this token may manage that tenant.
-    return createBearerAuthApi(token, { domain, account });
+    const tenant = account ?? (await resolveAccountByHost(domain));
+    const tenantToken = tenant ? await issueTenantToken(token, tenant) : undefined;
+    // Prefer the per-tenant management token; the session's bearer is the
+    // fallback (the platform tenant, or an api that can't issue one), exactly
+    // what `faable auth` sent before phase 2. Either way, scoped to the tenant.
+    return createBearerAuthApi(tenantToken ?? token, {
+        domain,
+        account: tenant ?? account
+    });
+};
+// The tenant behind an Auth host (`<slug>.auth.faable.link` or a custom
+// domain), through the anonymous public lookup. `undefined` when it can't be
+// resolved: the server then picks the tenant from the host, as before.
+const resolveAccountByHost = async (domain, auth = createAnonymousAuthApi({ domain })) => {
+    try {
+        const host = new URL(domain).host;
+        const account = await auth.fetcher.get(`/account/host/${host}`);
+        return account?.id;
+    }
+    catch {
+        return undefined;
+    }
+};
+// Statuses that mean "no per-tenant token for this one right now" — the
+// platform tenant (404 tenant_token_not_issued), an api without the endpoint,
+// or auth unable to mint. Anything else (403: not a member) is a real refusal.
+const FALLBACK_STATUSES = new Set([404, 501, 503]);
+const issueTenantToken = async (session_token, account_id, api = FaableApi.create({
+    authStrategy: bearer_strategy,
+    auth: { token: session_token }
+})) => {
+    try {
+        const { access_token } = await api.issueAuthAccountToken(account_id);
+        return access_token;
+    }
+    catch (e) {
+        const status = e?.response?.status;
+        if (status === 403) {
+            throw new Error(`Forbidden (403): you are not a member of the project that owns ${account_id}, so you can't manage it.`, { cause: e });
+        }
+        if (status === undefined || FALLBACK_STATUSES.has(status))
+            return undefined;
+        throw e;
+    }
 };
 // Translate raw management-API failures into actionable CLI errors. Everything
 // else is rethrown untouched (FaableApiError messages already carry
@@ -61,4 +103,4 @@ const withAuthHints = (handler) => {
     };
 };
 
-export { hintAuthError, requireAuthAdmin, withAuthHints };
+export { hintAuthError, issueTenantToken, requireAuthAdmin, resolveAccountByHost, withAuthHints };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@faable/faable",
-  "version": "3.4.0",
+  "version": "3.4.1",
   "main": "dist/index.js",
   "license": "MIT",
   "author": "Marc Pomar <marc@faable.com>",