@faable/faable 4.20.0 → 4.21.1

package/dist/api/FaableApi.js

@@ -272,13 +272,21 @@ class FaableApi {
         })));
     }
     // Replace the app's whole secret set (the endpoint deletes and recreates).
-    // This is the only mutation path that triggers an immediate restart of the
-    // app; the per-secret upsert/delete endpoints are not used by the CLI.
+    // The per-secret upsert/delete endpoints are not used by the CLI.
     // The endpoint stamps the created secrets with the team from the request
     // context, which a CLI user token does not carry — pass the app's team
     // (from getApp) so it travels as the `x-faable-project` header.
+    //
+    // `with_redeploy=true` (api §403): a running app restarts to apply the new
+    // values, but an app with nothing running whose last deployment failed at
+    // runtime has nothing to restart — the api relaunches that deployment and
+    // says so in `redeploy`. An api that predates it ignores the parameter and
+    // answers the bare array: read that as "no redeploy to report".
     async createSecretsBatch(context_id, team, secrets) {
-        return data(this.client.post(`/secret/createbatch`, { context_id, secrets }, { headers: projectHeader(team) }));
+        const body = await data(this.client.post(`/secret/createbatch`, { context_id, secrets }, { headers: projectHeader(team), params: { with_redeploy: true } }));
+        if (Array.isArray(body))
+            return { secrets: body, redeploy: null };
+        return { secrets: body?.secrets ?? [], redeploy: body?.redeploy ?? null };
     }
     async updateApp(app_id, params) {
         return data(this.client.post(`/app/${app_id}`, params));

package/dist/commands/auth/clients/login_methods.js

@@ -0,0 +1,83 @@
+// A client's own `login_methods` overrides the tenant's FIELD BY FIELD
+// (auth: resolveLoginMethodsConfig): a field the client does not set is
+// inherited. The update route stores the object whole, so every change here is
+// a read-modify-write of what the client has now, and a field this command was
+// not asked about keeps whatever it was — its own value or the inheritance.
+const has_login_method_changes = (c) => !!(c.inherit ||
+    c.passkey ||
+    c.only?.length ||
+    c.disable?.length ||
+    c.enable?.length);
+/**
+ * A connection by id or by name (case-insensitive). A name two connections
+ * share is refused rather than guessed: removing the wrong login method is
+ * not something to find out on the login screen.
+ */
+const resolve_connection = (connections, ref) => {
+    const by_id = connections.find(c => c.id === ref);
+    if (by_id)
+        return by_id;
+    const by_name = connections.filter(c => c.connection_name?.toLowerCase() === ref.toLowerCase());
+    if (by_name.length === 1)
+        return by_name[0];
+    const known = connections
+        .map(c => `${c.connection_name ?? '?'} (${c.id})`)
+        .join(', ');
+    if (by_name.length > 1) {
+        throw new Error(`"${ref}" names ${by_name.length} connections — use the id: ${by_name.map(c => c.id).join(', ')}`);
+    }
+    throw new Error(`Unknown connection "${ref}". This tenant has: ${known}`);
+};
+/**
+ * The client's next `login_methods`, or `null` to inherit everything from the
+ * tenant. `undefined` when nothing was asked for.
+ */
+const apply_login_method_changes = (own, tenant, connections, changes) => {
+    if (!has_login_method_changes(changes))
+        return undefined;
+    if (changes.inherit)
+        return null;
+    const next = { ...(own ?? {}) };
+    if (changes.only?.length || changes.disable?.length || changes.enable?.length) {
+        // Starts from what the client shows TODAY: its own list, or the tenant's
+        // it inherits — otherwise the first own list would silently re-offer
+        // everything the tenant had removed.
+        const disabled = new Set(own?.disabled_connections ?? tenant?.disabled_connections ?? []);
+        if (changes.only?.length) {
+            const keep = new Set(changes.only.map(ref => resolve_connection(connections, ref).id));
+            disabled.clear();
+            for (const c of connections)
+                if (!keep.has(c.id))
+                    disabled.add(c.id);
+        }
+        for (const ref of changes.disable ?? []) {
+            disabled.add(resolve_connection(connections, ref).id);
+        }
+        for (const ref of changes.enable ?? []) {
+            disabled.delete(resolve_connection(connections, ref).id);
+        }
+        next.disabled_connections = [...disabled];
+    }
+    if (changes.passkey === 'on')
+        next.passkey_login_enabled = true;
+    else if (changes.passkey === 'off')
+        next.passkey_login_enabled = false;
+    else if (changes.passkey === 'inherit')
+        delete next.passkey_login_enabled;
+    return Object.keys(next).length ? next : null;
+};
+/** What the login screen of this client offers, for the summary line. */
+const effective_login_methods = (own, tenant, connections) => {
+    const disabled = new Set(own?.disabled_connections ?? tenant?.disabled_connections ?? []);
+    const order = new Set(own?.order ?? tenant?.order ?? []);
+    const passkey = own?.passkey_login_enabled ?? tenant?.passkey_login_enabled ?? false;
+    return {
+        passkey,
+        // OIDC providers stay off the screen unless `order` names them.
+        connections: connections.filter(c => c.enabled !== false &&
+            !disabled.has(c.id) &&
+            (c.connection_type !== 'oidc' || order.has(c.id)))
+    };
+};
+
+export { apply_login_method_changes, effective_login_methods, has_login_method_changes, resolve_connection };

package/dist/commands/auth/clients/update.js

@@ -3,6 +3,7 @@ import { log } from '../../../log.js';
 import { tenant_options } from '../options.js';
 import { json_option, print_json } from '../../../lib/listing.js';
 import { parse_field_spec, parse_fields_json, apply_field_changes, format_field } from './profile_fields.js';
+import { has_login_method_changes, apply_login_method_changes, effective_login_methods } from './login_methods.js';
 import { resolve_client } from './resolve.js';
 
 // The update route replaces each list whole, so every list change here is a
@@ -19,7 +20,7 @@ const edit_list = (current, add = [], remove = []) => {
 };
 const clients_update = {
     command: 'update <client_id>',
-    describe: 'Update an OAuth client (name, URLs, profile fields)',
+    describe: 'Update an OAuth client (name, URLs, profile fields, login methods)',
     builder: yargs => json_option(tenant_options(yargs))
         .positional('client_id', {
         type: 'string',
@@ -83,9 +84,40 @@ const clients_update = {
         .option('inherit-fields', {
         type: 'boolean',
         description: "Drop this client's own profile field list and use the tenant's again"
+    })
+        .option('only-connections', {
+        type: 'string',
+        array: true,
+        description: 'Offer exactly these connections (id or name) on this client\'s login screen; every other one is removed'
+    })
+        .option('disable-connection', {
+        type: 'string',
+        array: true,
+        description: 'Stop offering a connection (id or name) on this client, also at /authorize — repeatable'
+    })
+        .option('enable-connection', {
+        type: 'string',
+        array: true,
+        description: 'Offer a removed connection again — repeatable'
+    })
+        .option('passkey-login', {
+        choices: ['on', 'off', 'inherit'],
+        description: "Passkey sign-in button on this client's login screen; inherit follows the tenant (Pro plan)"
+    })
+        .option('inherit-login-methods', {
+        type: 'boolean',
+        description: "Drop this client's own login methods and follow the tenant's again"
     })
         .conflicts('fields-json', ['add-field', 'remove-field', 'inherit-fields'])
         .conflicts('inherit-fields', ['add-field', 'remove-field'])
+        .conflicts('inherit-login-methods', [
+        'only-connections',
+        'disable-connection',
+        'enable-connection',
+        'passkey-login'
+    ])
+        .conflicts('only-connections', 'disable-connection')
+        .example('$0 auth clients update my-admin --only-connections OTP --passkey-login on', 'Sign in to my-admin only with a passkey or an email code')
         .example('$0 auth clients update my-app --add-field profile:enum:student,teacher', 'Let users of my-app pick their profile with auth-js updateProfile')
         .example('$0 auth clients update my-app --remove-field school', 'Stop accepting a field')
         .example('$0 auth clients update my-app --add-callback https://app.example.com/cb', 'Allow one more redirect URL, keeping the others')
@@ -110,6 +142,28 @@ const clients_update = {
         const callbacks = edit_list(client.callbacks, args.addCallback, args.removeCallback);
         const logout_urls = edit_list(client.logout_urls, args.addLogoutUrl, args.removeLogoutUrl);
         const web_origins = edit_list(client.web_origins, args.addWebOrigin, args.removeWebOrigin);
+        const login_changes = {
+            only: args.onlyConnections,
+            disable: args.disableConnection,
+            enable: args.enableConnection,
+            passkey: args.passkeyLogin,
+            inherit: args.inheritLoginMethods
+        };
+        const own_login = client
+            .login_methods;
+        let tenant_login;
+        let connections = [];
+        let login_methods;
+        if (has_login_method_changes(login_changes)) {
+            const [account, all] = await Promise.all([
+                api.currentAccount(),
+                api.connectionList().all()
+            ]);
+            tenant_login = account
+                .login_methods;
+            connections = all;
+            login_methods = apply_login_method_changes(own_login, tenant_login, connections, login_changes);
+        }
         const patch = {
             ...(args.name !== undefined ? { name: args.name } : {}),
             ...(args.description !== undefined
@@ -118,15 +172,27 @@ const clients_update = {
             ...(callbacks ? { callbacks } : {}),
             ...(logout_urls ? { logout_urls } : {}),
             ...(web_origins ? { web_origins } : {}),
-            ...(profile_fields !== undefined ? { profile_fields } : {})
+            ...(profile_fields !== undefined ? { profile_fields } : {}),
+            ...(login_methods !== undefined ? { login_methods } : {})
         };
         if (Object.keys(patch).length === 0) {
-            throw new Error('Nothing to update — pass a --name, --description, an --add-*/--remove-* option, --fields-json or --inherit-fields');
+            throw new Error('Nothing to update — pass a --name, --description, an --add-*/--remove-* option, --fields-json, --inherit-fields or a login-method option');
         }
         const updated = await api.clientUpdate(client.id, patch);
         if (args.json)
             return print_json(updated);
         log.info(`✅ Updated client "${updated.name}" (${updated.client_id})`);
+        if (login_methods !== undefined) {
+            const now = effective_login_methods(updated
+                .login_methods, tenant_login, connections);
+            const names = now.connections.map(c => `${c.connection_name} (${c.connection_type})`);
+            if (now.passkey)
+                names.unshift('passkey');
+            log.info(`  Login screen: ${names.length ? names.join(', ') : 'nothing'}`);
+            if (login_methods === null) {
+                log.info("  Login methods: inherited from the tenant");
+            }
+        }
         if (profile_fields !== undefined) {
             const now = updated.profile_fields;
             if (!now) {

package/dist/commands/deploy/secrets/after_save.js

@@ -0,0 +1,67 @@
+// What happens to the app after a secrets save, in the words the user reads.
+//
+// A running app restarts to apply the new values. An app with NOTHING running
+// whose last deployment failed at runtime (a crashloop over a missing
+// variable, the usual reason to come and set one) has nothing to restart: the
+// api relaunches that deployment itself and reports it (api §403). Promising
+// a restart there was wrong — nothing was coming, or a whole new deployment
+// was.
+//
+// Every command carries `-a <app id>`: these lines get copied, and outside
+// the app's checkout a bare command resolves no app.
+const after_save_lines = (args) => {
+    const { app, redeploy, changed } = args;
+    const what = args.what ?? 'the new variables';
+    const a = `-a ${app.id}`;
+    if (!redeploy) {
+        return [
+            {
+                level: 'info',
+                text: changed
+                    ? `ℹ️ The app is restarting to apply the changes.`
+                    : `ℹ️ Already up to date — the app was not restarted.`
+            }
+        ];
+    }
+    const failed = redeploy.failed_deployment_id;
+    if (redeploy.status === 'started') {
+        const id = redeploy.deployment_id;
+        return [
+            {
+                level: 'info',
+                text: `🔁 Redeploying ${app.name} with ${what} (deployment ${id}): its last deployment ${failed} had failed and nothing was running.`
+            },
+            {
+                level: 'info',
+                text: `Follow it with: faable deploy logs --build -d ${id} ${a} --follow  ·  status: faable deploy status ${a}`
+            }
+        ];
+    }
+    if (redeploy.status === 'needs_rebuild') {
+        return [
+            {
+                level: 'warn',
+                text: `⚠️ Nothing is running: the last deployment ${failed} failed to build, so ${what} are saved but not deployed.`
+            },
+            {
+                level: 'warn',
+                text: `Rebuild it with: faable deploy redeploy ${failed} ${a}  ·  why it failed: faable deploy logs --build -d ${failed} ${a}`
+            }
+        ];
+    }
+    return [
+        {
+            level: 'warn',
+            text: `⚠️ Nothing is running and Faable could not relaunch the failed deployment ${failed}, so ${what} are saved but not deployed.`
+        },
+        {
+            level: 'warn',
+            text: `Relaunch it by hand (it tells you why if it is refused): faable deploy redeploy ${failed} ${a}`
+        }
+    ];
+};
+// The `restarting` of the --json output: only a running app restarts. When
+// the api reports a redeploy (started or not), nothing restarts.
+const is_restarting = (redeploy, changed) => changed && !redeploy;
+
+export { after_save_lines, is_restarting };

package/dist/commands/deploy/secrets/rm.js

@@ -2,6 +2,7 @@ import { requireApi } from '../../../api/context.js';
 import { print_json, json_option } from '../../../lib/listing.js';
 import { log } from '../../../log.js';
 import { resolve_app_id } from '../resolve_app_id.js';
+import { is_restarting, after_save_lines } from './after_save.js';
 import { remove_app_secret } from './merge.js';
 import { confirm } from '../../../lib/interactive.js';
 
@@ -44,12 +45,24 @@ const secrets_rm = {
             log.info('Cancelled.');
             return;
         }
-        await ctx.api.createSecretsBatch(app.id, app.team, remaining);
+        const { redeploy } = await ctx.api.createSecretsBatch(app.id, app.team, remaining);
         if (args.json) {
-            return print_json({ deleted: true, name: args.name, restarting: true });
+            return print_json({
+                deleted: true,
+                name: args.name,
+                restarting: is_restarting(redeploy, true),
+                redeploy
+            });
         }
         log.info(`🗑️ Removed secret ${args.name} from ${app_id}.`);
-        log.info(`ℹ️ The app is restarting to apply the changes.`);
+        const lines = after_save_lines({
+            app,
+            redeploy,
+            changed: true,
+            what: 'the updated variables'
+        });
+        for (const { level, text } of lines)
+            log[level](text);
     }
 };
 

package/dist/commands/deploy/secrets/set.js

@@ -5,6 +5,7 @@ import { print_json, json_option } from '../../../lib/listing.js';
 import { read_stdin } from '../../../lib/stdin.js';
 import { log } from '../../../log.js';
 import { resolve_app_id } from '../resolve_app_id.js';
+import { is_restarting, after_save_lines } from './after_save.js';
 import { managed_warning } from './managed_names.js';
 import { merge_app_secrets } from './merge.js';
 import { parse_env } from './parse_env.js';
@@ -113,12 +114,12 @@ const secrets_set = {
         const app = await ctx.api.getApp(app_id);
         const existing = await ctx.api.getAppSecrets(app_id, app.team);
         const merged = merge_app_secrets(existing, parsed);
-        await ctx.api.createSecretsBatch(app.id, app.team, merged);
+        const { redeploy } = await ctx.api.createSecretsBatch(app.id, app.team, merged);
         const current = new Map(existing
             .filter(s => s.related_model === 'app')
             .map(s => [s.name, s.value]));
         const updated = parsed.filter(({ name }) => current.has(name)).length;
-        // Only claim the restart when something actually changed. Setting a name
+        // Only claim a restart when something actually changed. Setting a name
         // to the value it already has is a no-op end to end — the API compares
         // before writing and never emits the event, so the pod keeps running —
         // and this line used to promise a restart that was not coming.
@@ -134,7 +135,10 @@ const secrets_set = {
                 unchanged: parsed
                     .filter(p => current.get(p.name) === p.value)
                     .map(p => p.name),
-                restarting: changed
+                restarting: is_restarting(redeploy, changed),
+                // api §403: what the api did for an app with nothing running whose
+                // last deployment failed — null when there was nothing to relaunch.
+                redeploy
             });
         }
         if (parsed.length <= MAX_DETAILED) {
@@ -148,9 +152,13 @@ const secrets_set = {
             log.info(`🔑 ${parsed.length - updated} added, ${updated} updated`);
         }
         log.info(`✅ ${parsed.length} secret(s) saved to ${app_id}.`);
-        log.info(changed
-            ? `ℹ️ The app is restarting to apply the changes.`
-            : `ℹ️ Already up to date — the app was not restarted.`);
+        for (const { level, text } of after_save_lines({
+            app,
+            redeploy,
+            changed
+        })) {
+            log[level](text);
+        }
     }
 };
 

package/dist/mcp/tools.js

@@ -760,7 +760,7 @@ const TOOLS = [
     {
         name: 'set_secrets',
         title: 'Set environment variables',
-        description: 'Add or update environment variables of an app. The app restarts to apply them when a value changed. Returns the names added, updated and unchanged — never the values.',
+        description: 'Add or update environment variables of an app. When the app is running, it restarts to apply them (only if a value changed); if its last deployment failed at runtime and nothing is running, Faable redeploys it with the new variables. Returns the names added, updated and unchanged — never the values — and `redeploy`: null when there was nothing to relaunch; otherwise `status` is `started` (follow `deployment_id` with get_deployment), `needs_rebuild` (the last deployment failed to build: retry `failed_deployment_id` with redeploy) or `not_started` (the platform refused the relaunch: retry it with redeploy to see why).',
         input: {
             app,
             project,
@@ -998,6 +998,64 @@ const TOOLS = [
             remove: ['school']
         }
     },
+    {
+        name: 'update_auth_client_login',
+        title: "Change how users sign in to an app",
+        description: "Choose which login methods one Auth application offers: which connections (by id or name, as list_auth_connections shows them) and whether the passkey button appears. `only` keeps exactly those connections and removes the rest; `disable`/`enable` change one at a time. A removed connection is refused at /authorize too, not just hidden. `passkey` needs the Pro plan. `inherit: true` drops the app's own settings and follows the tenant's again. Settings not mentioned keep their current value.",
+        input: {
+            client: z
+                .string()
+                .describe('The application: client resource id (client_…) or OAuth client_id'),
+            only: z
+                .array(z.string())
+                .max(50)
+                .optional()
+                .describe('Offer exactly these connections (id or name)'),
+            disable: z
+                .array(z.string())
+                .max(50)
+                .optional()
+                .describe('Connections (id or name) to stop offering'),
+            enable: z
+                .array(z.string())
+                .max(50)
+                .optional()
+                .describe('Removed connections (id or name) to offer again'),
+            passkey: z
+                .enum(['on', 'off', 'inherit'])
+                .optional()
+                .describe('Passkey sign-in button; inherit follows the tenant'),
+            inherit: z
+                .boolean()
+                .optional()
+                .describe("Drop the app's own login methods and use the tenant's"),
+            tenant,
+            project
+        },
+        command: ['auth', 'clients', 'update'],
+        flags: a => [
+            a.client,
+            ...(a.only ?? []).flatMap((c) => ['--only-connections', c]),
+            ...(a.disable ?? []).flatMap((c) => ['--disable-connection', c]),
+            ...(a.enable ?? []).flatMap((c) => ['--enable-connection', c]),
+            ...opt('--passkey-login', a.passkey),
+            ...(a.inherit ? ['--inherit-login-methods'] : []),
+            ...auth_scope(a)
+        ],
+        shape: (c) => ({
+            id: c.id,
+            client_id: c.client_id,
+            name: c.name,
+            login_methods: c.login_methods ?? null
+        }),
+        write: true,
+        annotations: AUTH_WRITE,
+        example: {
+            client: 'client_1',
+            only: ['OTP'],
+            passkey: 'on'
+        }
+    },
     {
         name: 'send_password_setup',
         title: 'Send a password setup email',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@faable/faable",
-  "version": "4.20.0",
+  "version": "4.21.1",
   "main": "dist/index.js",
   "license": "MIT",
   "author": "Marc Pomar <marc@faable.com>",