@faable/faable 3.4.0 → 3.4.2

package/dist/api/FaableApi.js

@@ -102,6 +102,14 @@ class FaableApi {
     static create(config = {}) {
         return new FaableApi(config);
     }
+    // A short-lived Management API token for ONE Faable Auth tenant, issued by
+    // the deploy api after checking the caller belongs to the project that owns
+    // it (phase 2 of arch/auth/management-api-tenant-isolation.md). `faable auth`
+    // manages tenants with it instead of the `faable login` token, which stops
+    // being platform-superadmin in phase 3.
+    async issueAuthAccountToken(account_id) {
+        return data(this.client.post(`/auth-accounts/${account_id}/token`));
+    }
     async list() {
         return allPages(next => data(this.client.get(`/app`, {
             params: { pageSize: 200, ...(next ? { next } : {}) }

package/dist/api/auth_admin.js

@@ -1,7 +1,9 @@
 import { CredentialsStore } from '../lib/CredentialsStore.js';
 import { log } from '../log.js';
-import { createBearerAuthApi } from './auth.js';
+import { FaableApi } from './FaableApi.js';
+import { createBearerAuthApi, createAnonymousAuthApi } from './auth.js';
 import { loadLiveCredentials } from './session.js';
+import { bearer_strategy } from './strategies/bearer.strategy.js';
 
 // Default tenant host. `faable auth` is customer-facing: a customer targets
 // their own tenant with --auth-url https://<account>.auth.faable.link (or
@@ -31,10 +33,50 @@ const requireAuthAdmin = async (opts = {}) => {
     }
     const domain = opts.authUrl || process.env.FAABLE_AUTH_URL || DEFAULT_AUTH_URL;
     const account = opts.account || process.env.FAABLE_AUTH_ACCOUNT;
-    // The session's bearer as a strategy — with the CLI's own identity on the
-    // wire instead of `auth-sdk` — scoped to the target tenant when one was
-    // named. The server decides whether this token may manage that tenant.
-    return createBearerAuthApi(token, { domain, account });
+    const tenant = account ?? (await resolveAccountByHost(domain));
+    const tenantToken = tenant ? await issueTenantToken(token, tenant) : undefined;
+    // Prefer the per-tenant management token; the session's bearer is the
+    // fallback (the platform tenant, or an api that can't issue one), exactly
+    // what `faable auth` sent before phase 2. Either way, scoped to the tenant.
+    return createBearerAuthApi(tenantToken ?? token, {
+        domain,
+        account: tenant ?? account
+    });
+};
+// The tenant behind an Auth host (`<slug>.auth.faable.link` or a custom
+// domain), through the anonymous public lookup. `undefined` when it can't be
+// resolved: the server then picks the tenant from the host, as before.
+const resolveAccountByHost = async (domain, auth = createAnonymousAuthApi({ domain })) => {
+    try {
+        const host = new URL(domain).host;
+        const account = await auth.fetcher.get(`/account/host/${host}`);
+        return account?.id;
+    }
+    catch {
+        return undefined;
+    }
+};
+// Statuses that mean "no per-tenant token for this one right now" — the
+// platform tenant (404 tenant_token_not_issued), an api without the endpoint,
+// or auth unable to mint. Anything else (403: not a member) is a real refusal.
+const FALLBACK_STATUSES = new Set([404, 501, 503]);
+const issueTenantToken = async (session_token, account_id, api = FaableApi.create({
+    authStrategy: bearer_strategy,
+    auth: { token: session_token }
+})) => {
+    try {
+        const { access_token } = await api.issueAuthAccountToken(account_id);
+        return access_token;
+    }
+    catch (e) {
+        const status = e?.response?.status;
+        if (status === 403) {
+            throw new Error(`Forbidden (403): you are not a member of the project that owns ${account_id}, so you can't manage it.`, { cause: e });
+        }
+        if (status === undefined || FALLBACK_STATUSES.has(status))
+            return undefined;
+        throw e;
+    }
 };
 // Translate raw management-API failures into actionable CLI errors. Everything
 // else is rethrown untouched (FaableApiError messages already carry
@@ -61,4 +103,4 @@ const withAuthHints = (handler) => {
     };
 };
 
-export { hintAuthError, requireAuthAdmin, withAuthHints };
+export { hintAuthError, issueTenantToken, requireAuthAdmin, resolveAccountByHost, withAuthHints };

package/dist/commands/auth/users/import.js

@@ -149,6 +149,8 @@ const users_import = {
                     email: r.email,
                     status: r.status,
                     user_id: r.user_id,
+                    skipped_identities: r
+                        .skipped_identities,
                     error: r.error
                 });
             }
@@ -169,6 +171,11 @@ const users_import = {
             print_json({ dry_run, summary, results });
         }
         else {
+            const without = results.filter(r => r.skipped_identities?.length);
+            if (without.length) {
+                const names = [...new Set(without.flatMap(r => r.skipped_identities))];
+                log.warn(`⚠️  ${without.length} user(s) imported without their ${names.join(', ')} identity: this tenant has no connection by that name. Create it and re-run with --update-existing, or map it with --map-connection.`);
+            }
             for (const r of results.filter(r => r.status === 'error')) {
                 log.error(`❌ record ${r.record}${r.email ? ` (${r.email})` : ''}: ${r.error?.code} — ${r.error?.message}`);
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@faable/faable",
-  "version": "3.4.0",
+  "version": "3.4.2",
   "main": "dist/index.js",
   "license": "MIT",
   "author": "Marc Pomar <marc@faable.com>",