@fluid-app/fluid-cli-member-site 0.1.2 → 0.1.4

package/README.md

@@ -38,11 +38,20 @@ which it is with `--as member` or `--as admin`, and a site of the other owner
 kind is refused before any request, with the login it needs. Without `--as`,
 the server decides, and a refusal names the login the site needs.
 
-A member who is also an admin of the same company is refused by the member API
-and builds company sites only.
-
-`fluid login` signs in admins and reps only. A member signs in to this command
-with the member's own token, set in `FLUID_TOKEN`.
+`fluid login` signs in admins and reps. An admin who is also a rep of the same
+company builds both kinds of site after one normal `fluid login`: `--as admin`
+builds company sites with the admin session, and `--as member` builds the
+admin's own member sites with a rep session that the identity service narrows
+the same login to, with no second sign-in. The identity service issues that
+rep session only to a person who is a rep in the company. An admin who is not
+one gets "You are not a rep at <company>, so you cannot build a member site
+there. Use --as admin for company sites." before any member API request.
+
+Only a login made through the identity service can be narrowed. A legacy login,
+and a token set in `FLUID_TOKEN`, are sent as they are for `--as member` too,
+so an admin on a legacy login is still refused by the member API and builds
+company sites only. A member signs in to this command with the member's own
+token, set in `FLUID_TOKEN`.
 
 ## Commands
 

package/dist/index.mjs

@@ -1,6 +1,6 @@
 import { Command } from "commander";
 import chalk from "chalk";
-import { declareInputs, exitOnInputsError, findProjectConfig, getAuthToken, readConfig, withInternalReadsAsync } from "@fluid-app/fluid-cli";
+import { declareInputs, exitOnInputsError, findProjectConfig, getAuthToken, getRoleAuthTokenAsync, isRoleNotGrantedError, readConfig, withInternalReadsAsync } from "@fluid-app/fluid-cli";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
 import http from "node:http";
 import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
@@ -555,6 +555,24 @@ function resolveAuthToken() {
 	return getAuthToken() ?? null;
 }
 /**
+* The stored login's token narrowed to a rep, which is what the member API
+* accepts from a person who is also an admin: the identity service issues it
+* only for a person who holds rep standing in the company. A login that
+* cannot be narrowed, a literal token (`FLUID_TOKEN`) or a legacy profile,
+* gives the token `resolveAuthToken` gives.
+*
+* Throws a MemberSiteCliError, before any member API request, when the person
+* is not a rep in the company.
+*/
+async function resolveRepToken() {
+	try {
+		return await getRoleAuthTokenAsync(["rep"]) ?? null;
+	} catch (error) {
+		if (!isRoleNotGrantedError(error)) throw error;
+		throw new MemberSiteCliError(`You are not a rep at ${error.companyName ?? "this company"}, so you cannot build a member site there. Use --as admin for company sites.`);
+	}
+}
+/**
 * A client for one login. Reads that fail with 502, 503 or 504 are retried
 * twice, as the theme CLI retries them. A write is never retried, because a
 * failed response may follow a successful change, and a 404 never is,
@@ -604,9 +622,18 @@ function loginFor(ownerKind) {
 function describeLogin(kind) {
 	return kind === "member" ? "a member login" : "an admin login";
 }
-/** The login a command acts with, or an error that says to sign in. */
-function loadLogin(kind, resolveToken = resolveAuthToken) {
-	const token = resolveToken();
+const defaultSources = {
+	token: resolveAuthToken,
+	repToken: resolveRepToken
+};
+/**
+* The login a command acts with, or an error that says to sign in. With
+* `--as member` the token is the stored login's rep session, so an admin who
+* is also a rep builds their own sites with the login they already have;
+* otherwise it is the stored login's token as it is.
+*/
+async function loadLogin(kind, sources = defaultSources) {
+	const token = kind === "member" ? await sources.repToken() : sources.token();
 	if (!token) throw new MemberSiteCliError("Not logged in. Run `fluid login` first (or set FLUID_TOKEN).");
 	return {
 		token,
@@ -749,7 +776,7 @@ async function runCreate(handle, options, deps = defaultDeps$5) {
 	assertValidHandle(handle);
 	const name = options.name?.trim() || nameFromHandle(handle);
 	const ownerKind = ownerKindOf(options);
-	const login = deps.loadLogin(parseLoginKind(options.as));
+	const login = await deps.loadLogin(parseLoginKind(options.as));
 	const site = await clientForOwner(ownerKind, login, deps.createClients(login.token)).createSite({
 		name,
 		handle
@@ -1015,7 +1042,7 @@ var PreviewProxy = class {
 		return fetch(`${this.previewUrl}${path}`, {
 			method: "GET",
 			headers: {
-				authorization: `Bearer ${this.options.getToken()}`,
+				authorization: `Bearer ${await this.options.getToken()}`,
 				accept: route.kind === "page" ? "text/html" : "*/*",
 				"accept-encoding": "identity",
 				"user-agent": "Fluid CLI"
@@ -1359,7 +1386,7 @@ async function openBoundSite(dirArg, as, deps, context) {
 	if (!stored) throw new MemberSiteCliError(`${dir} is not a pulled site: it has no readable ${BINDING_FILE}. Pull the site first: fluid member-site pull <site> [dir]`);
 	const binding = structuredClone(stored);
 	context.ownerKind = binding.owner_kind;
-	const login = deps.loadLogin(parseLoginKind(as));
+	const login = await deps.loadLogin(parseLoginKind(as));
 	const api = clientForOwner(binding.owner_kind, login, deps.createClients(login.token));
 	if (binding.api_base !== getApiBase()) throw new MemberSiteCliError(`${dir} was pulled from ${binding.api_base}, and this login is for ${getApiBase()}. Use the login it was pulled with, or pull the site again.`);
 	return {
@@ -2717,7 +2744,7 @@ async function runDev(dirArg, options, deps = defaultDeps$2, context = {}) {
 			ownerKind: binding.owner_kind
 		},
 		apiBase,
-		getToken: () => deps.loadLogin(parseLoginKind(options.as)).token
+		getToken: async () => (await deps.loadLogin(parseLoginKind(options.as))).token
 	});
 	if (await proxy.probe() === "unavailable") throw new MemberSiteCliError(DRAFT_PREVIEW_UNAVAILABLE);
 	await checkPortAvailable(DEV_HOST, port);
@@ -4972,7 +4999,7 @@ const defaultDeps$1 = {
 	log: (line) => console.log(line)
 };
 async function runList(options, deps = defaultDeps$1) {
-	const login = deps.loadLogin(parseLoginKind(options.as));
+	const login = await deps.loadLogin(parseLoginKind(options.as));
 	const listing = await listForLogin(login, deps.createClients(login.token));
 	for (const line of formatListing(listing)) deps.log(line);
 }
@@ -5050,7 +5077,7 @@ function formatPull(result) {
 * reported with the login the site needs.
 */
 async function runPull(ref, dirArg, options, deps = defaultDeps, context = {}) {
-	const login = deps.loadLogin(parseLoginKind(options.as));
+	const login = await deps.loadLogin(parseLoginKind(options.as));
 	const clients = deps.createClients(login.token);
 	const known = await readBinding(resolve(dirArg ?? ref));
 	if (known && (known.site_id === ref || known.handle === ref)) {