@fluid-app/fluid-cli-mist 0.1.62 → 0.1.64

package/README.md

@@ -33,9 +33,9 @@ fluid mist droplet egress-proxy on            # ask for egress for the attached
 fluid mist droplet egress-proxy off           # withdraw the request (and any grant)
 ```
 
-Fluid's egress proxy lets a Droplet's installations reach external systems such as Exigo from Fluid's fixed outbound IPs. Because those IPs reach every Exigo tenant, the grant is Fluid's decision: these commands set the Droplet's `egress_proxy_requested`, and a Fluid admin approves it, which sets `egress_proxy_enabled`. The output says whether the request is waiting or already granted. Withdrawing the request also withdraws the grant.
+Fluid's egress proxy lets a Droplet's installations reach external systems such as Exigo from Fluid's fixed outbound IPs. These commands set the Droplet's `egress_proxy_requested`. Fluid accepts it only on a company it has enabled for egress, and the proxy then admits the Droplet with no further approval, wherever the proxy honours Fluid's answer. Withdrawing the request also clears any grant a Fluid admin recorded (`egress_proxy_enabled`).
 
-`--egress-proxy` works on `create --droplet`, `create --kind droplet`, `create --hostable`, `attach --kind droplet` and `attach-droplet`. On a Droplet that already exists it updates the request rather than ignoring the flag. Fluid accepts an egress request only from a company admin. For anyone else it refuses the request: `--egress-proxy` then sets the droplet up without it and warns, and `droplet egress-proxy` fails without writing, because Fluid does not show the egress fields to them either. A Fluid that predates the fields ignores them, and the commands warn or fail the same way. `droplet egress-proxy off` also clears a grant a Fluid admin gave without a request. Mist Desktop's Safe Mode treats `droplet egress-proxy` as a write.
+`--egress-proxy` works on `create --droplet`, `create --kind droplet`, `create --hostable`, `attach --kind droplet` and `attach-droplet`. On a Droplet that already exists it updates the request rather than ignoring the flag. Fluid accepts an egress request only from a company admin, and only on a company Fluid has enabled for egress. Otherwise it refuses the request: `--egress-proxy` then sets the droplet up without it and warns, and `droplet egress-proxy` fails with Fluid's reason without writing. A Fluid that predates the fields ignores them, and the commands warn or fail the same way. `droplet egress-proxy off` also clears a grant a Fluid admin gave without a request. Mist Desktop's Safe Mode treats `droplet egress-proxy` as a write.
 
 ## Repairing the attached Droplet
 

package/dist/index.mjs

@@ -2557,23 +2557,39 @@ function planReceiptMessage(code) {
 /**
 * Ask Fluid for, or withdraw, egress through its egress proxy for the Mist's
 * attached Droplet (`fluid mist droplet egress-proxy`). The owner's ask is the
-* droplet's `egress_proxy_requested`; the grant the proxy honours,
-* `egress_proxy_enabled`, is set by a Fluid root admin, who approves it.
-* Withdrawing the request also withdraws the grant.
+* droplet's `egress_proxy_requested`, and the proxy admits the droplet on it
+* alone. A Fluid root admin's grant (`egress_proxy_enabled`) is now only a
+* record; withdrawing the request also clears it.
 */
 /** Why a droplet response can lack the egress fields. Fluid returns them only
 *  to company admins (and root admins), and older Fluids not at all. */
 const EGRESS_NOT_RETURNED = "Fluid did not return the droplet's egress fields: only a company admin can see or ask for egress, or this Fluid predates it.";
-/** Fluid refused the egress request outright (401): it accepts one only
-*  from a company admin. Distinct from an older Fluid, which ignores the
-*  field and omits it from the response. */
-const EGRESS_REFUSED = "Fluid refused the egress request: only a company admin can ask for egress. The droplet was set up without it.";
-/** Whether an API error is Fluid refusing the egress request: a 401 whose
-*  `errors` names `egress_proxy_requested`. Matched exactly, so a real
+/** Fluid refused the egress request outright: it accepts one only from a
+*  company admin (401), and only on a company Fluid enabled for egress (403).
+*  Distinct from an older Fluid, which ignores the field and omits it from
+*  the response. */
+const EGRESS_REFUSED = "Fluid refused the egress request: only a company admin can ask for egress, and only once Fluid enables egress for the company. The droplet was set up without it.";
+/** Whether an API error is Fluid refusing the egress request: a 401 or 403
+*  whose `errors` names `egress_proxy_requested`. Matched exactly, so a real
 *  authentication failure is reported as one rather than as a refusal. */
 function isEgressRefusal(error) {
-	return error instanceof MistApiError && error.status === 401 && error.fieldErrors?.egress_proxy_requested !== void 0;
-}
+	return error instanceof MistApiError && (error.status === 401 || error.status === 403) && error.fieldErrors?.egress_proxy_requested !== void 0;
+}
+/** Fluid's own words for an egress refusal, falling back to EGRESS_REFUSED. */
+function egressRefusalMessage(error) {
+	const reasons = error.fieldErrors?.egress_proxy_requested;
+	const reason = Array.isArray(reasons) ? reasons[0] : reasons;
+	return typeof reason === "string" ? `Fluid refused the egress request: ${reason}.` : EGRESS_REFUSED;
+}
+/** Fluid refused to turn egress on for the droplet. Still an API error, so
+*  it keeps the response's status and the 4xx exit code; only the message
+*  is Fluid's reason instead of a bare status. */
+var EgressRequestRefusedError = class extends MistApiError {
+	constructor(message, refused) {
+		super(message, refused.status, refused.details, refused.fieldErrors);
+		this.name = "EgressRequestRefusedError";
+	}
+};
 /** The API answered without the egress fields. */
 var EgressProxyUnsupportedError = class extends Error {
 	constructor() {
@@ -2602,7 +2618,10 @@ async function setDropletEgressProxy(client, input) {
 		granted: current.egress_proxy_enabled === true,
 		changed: false
 	};
-	const updated = (await updateDroplet(client, dropletUuid, { egress_proxy_requested: input.requested })).droplet;
+	const updated = (await updateDroplet(client, dropletUuid, { egress_proxy_requested: input.requested }).catch((error) => {
+		if (error instanceof MistApiError && isEgressRefusal(error)) throw new EgressRequestRefusedError(egressRefusalMessage(error), error);
+		throw error;
+	})).droplet;
 	if (updated.egress_proxy_requested === void 0) throw new EgressProxyUnsupportedError();
 	return {
 		mistSlug,
@@ -2883,8 +2902,7 @@ async function ensureEgressProxy(client, args) {
 	}
 	const requested = record?.egress_proxy_requested === true;
 	const granted = record?.egress_proxy_enabled === true;
-	if (granted) reporter.succeed("Egress granted — the droplet can reach Exigo through Fluid");
-	else if (requested) reporter.succeed("Egress requested — a Fluid admin must approve it before the proxy admits the droplet");
+	if (requested) reporter.succeed("Egress requested — Fluid's proxy admits requested droplets where egress is enabled");
 	else reporter.warn(`${EGRESS_NOT_RETURNED} Re-run \`fluid mist droplet egress-proxy on\` as a company admin.`);
 	return {
 		requested,
@@ -3044,7 +3062,7 @@ async function verifyManagedEnv(client, args) {
 }
 //#endregion
 //#region src/lib/surface-flags.ts
-const EGRESS_PROXY_FLAG_DESCRIPTION = "Ask Fluid to let the droplet reach external systems such as Exigo through its egress proxy (a Fluid admin approves it)";
+const EGRESS_PROXY_FLAG_DESCRIPTION = "Ask Fluid to let the droplet reach external systems such as Exigo through its egress proxy";
 /**
 * `--egress-proxy` only means something for a droplet: only a droplet's
 * installation token authenticates to the proxy. Refuse it on other kinds
@@ -3123,7 +3141,7 @@ function printSurfaceSummary(result) {
 	}
 	if (result.kind === "droplet" && result.managedEnv) if (result.managedEnv.ready) console.log(chalk.dim("  env: managed keys provisioned ✓"));
 	else console.log(chalk.yellow("  env: redeploy in progress — run `fluid mist env list` shortly to confirm managed keys"));
-	if (result.kind === "droplet" && result.egressProxy) console.log(result.egressProxy.granted ? chalk.dim("  egress proxy: granted ✓") : result.egressProxy.requested ? chalk.yellow("  egress proxy: requested — waiting for a Fluid admin to approve it") : chalk.yellow("  egress proxy: not requested — only a company admin can ask for it, or this Fluid predates it"));
+	if (result.kind === "droplet" && result.egressProxy) console.log(result.egressProxy.requested ? chalk.dim("  egress proxy: requested ✓") : chalk.yellow("  egress proxy: not requested — only a company admin can ask for it, or this Fluid predates it"));
 }
 //#endregion
 //#region src/commands/create.ts
@@ -4061,8 +4079,8 @@ const envCommand = new Command("env").description("Manage a mist's environment v
 * `fluid mist droplet egress-proxy <on|off> [slug] [--json]`
 *
 * Ask Fluid (on) to let the Mist's attached Droplet reach external systems
-* such as Exigo through its egress proxy, or withdraw the request (off). A
-* Fluid admin approves the request; withdrawing it also removes the grant.
+* such as Exigo through its egress proxy, or withdraw the request (off). The
+* proxy admits the droplet on the request alone; no Fluid admin approves it.
 * Leaves an already-correct droplet untouched. Safe Mode treats this as a
 * write (apps/mist-desktop fluid-cli-policy).
 */
@@ -4072,7 +4090,7 @@ function parseEgressProxyState(value) {
 	if (normalized === "off") return false;
 	throw new InvalidArgumentError("Use \"on\" or \"off\".");
 }
-const dropletEgressProxyCommand = new Command("egress-proxy").description("Ask Fluid (on) or stop asking (off) to let the attached Droplet reach external systems such as Exigo through its egress proxy; a Fluid admin approves it").argument("<state>", "on | off", parseEgressProxyState).argument("[slug]", "Mist slug (defaults to the .mist file in CWD)").option("--json", "Emit JSON").action((requested, slug, opts) => runAction(async () => {
+const dropletEgressProxyCommand = new Command("egress-proxy").description("Ask Fluid (on) or stop asking (off) to let the attached Droplet reach external systems such as Exigo through its egress proxy").argument("<state>", "on | off", parseEgressProxyState).argument("[slug]", "Mist slug (defaults to the .mist file in CWD)").option("--json", "Emit JSON").action((requested, slug, opts) => runAction(async () => {
 	const result = await setDropletEgressProxy(createMistClient(), {
 		slug,
 		cwd: process.cwd(),
@@ -4081,8 +4099,7 @@ const dropletEgressProxyCommand = new Command("egress-proxy").description("Ask F
 	if (opts.json) return printJson(result);
 	const target = `droplet ${result.dropletUuid} (${result.mistSlug})`;
 	if (!result.requested) console.log(result.changed ? `${chalk.green("✓")} Egress request withdrawn for ${target}` : chalk.dim(`No egress request for ${target}`));
-	else if (result.granted) console.log(`${chalk.green("✓")} Egress granted for ${target}`);
-	else console.log(`${chalk.green("✓")} Egress requested for ${target}. A Fluid admin must approve it before the proxy admits the droplet.`);
+	else console.log(result.changed ? `${chalk.green("✓")} Egress requested for ${target}. Fluid's proxy admits requested droplets where egress is enabled.` : chalk.dim(`Egress already requested for ${target}`));
 }));
 //#endregion
 //#region src/commands/droplet/reinstall.ts