@formigio/fazemos-cli 0.10.78 → 0.10.80
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/auth.d.ts +31 -3
- package/dist/auth.js +109 -19
- package/dist/auth.js.map +1 -1
- package/dist/authConfig.d.ts +43 -0
- package/dist/authConfig.js +54 -0
- package/dist/authConfig.js.map +1 -0
- package/dist/commands/preflight.js +14 -13
- package/dist/commands/preflight.js.map +1 -1
- package/dist/config.d.ts +53 -13
- package/dist/config.js +22 -1
- package/dist/config.js.map +1 -1
- package/dist/index.js +71 -36
- package/dist/index.js.map +1 -1
- package/dist/oidc.d.ts +111 -0
- package/dist/oidc.js +283 -0
- package/dist/oidc.js.map +1 -0
- package/dist/preflight/roster.d.ts +3 -0
- package/dist/preflight/roster.js +1 -0
- package/dist/preflight/roster.js.map +1 -1
- package/dist/preflight/row2_roleRegistration.d.ts +7 -0
- package/dist/preflight/row2_roleRegistration.js +73 -1
- package/dist/preflight/row2_roleRegistration.js.map +1 -1
- package/dist/preflight/schema.d.ts +9 -4
- package/dist/preflight/schema.js +5 -0
- package/dist/preflight/schema.js.map +1 -1
- package/package.json +1 -1
package/dist/config.d.ts
CHANGED
|
@@ -42,13 +42,30 @@ export interface AuthMeResponse {
|
|
|
42
42
|
activeOrgId: string;
|
|
43
43
|
activeProjectId: string | null;
|
|
44
44
|
}
|
|
45
|
+
/**
|
|
46
|
+
* A configured environment. `cognitoCliClientId` and `hostedUiDomain` were
|
|
47
|
+
* added with OIDC redirect login and are OPTIONAL on purpose: environments
|
|
48
|
+
* written by an older `fazemos init` have neither, and must keep working
|
|
49
|
+
* rather than failing to load. `auth login` refetches /auth/config on every
|
|
50
|
+
* run and backfills them, so an old entry heals on first use.
|
|
51
|
+
*/
|
|
52
|
+
export interface EnvironmentConfig {
|
|
53
|
+
apiUrl: string;
|
|
54
|
+
cognitoPoolId: string;
|
|
55
|
+
/** The WEB console app client. Retained for display and for older entries. */
|
|
56
|
+
cognitoClientId: string;
|
|
57
|
+
cognitoRegion: string;
|
|
58
|
+
/**
|
|
59
|
+
* The CLI's own app client — the one `auth login` authorizes against and
|
|
60
|
+
* the one refresh must use, because a refresh token is bound to the client
|
|
61
|
+
* that minted it. Absent on environments configured before OIDC login.
|
|
62
|
+
*/
|
|
63
|
+
cognitoCliClientId?: string;
|
|
64
|
+
/** Cognito hosted-UI origin, no trailing slash. Absent on older entries. */
|
|
65
|
+
hostedUiDomain?: string;
|
|
66
|
+
}
|
|
45
67
|
interface FazemosConfig {
|
|
46
|
-
environments: Record<string,
|
|
47
|
-
apiUrl: string;
|
|
48
|
-
cognitoPoolId: string;
|
|
49
|
-
cognitoClientId: string;
|
|
50
|
-
cognitoRegion: string;
|
|
51
|
-
}>;
|
|
68
|
+
environments: Record<string, EnvironmentConfig>;
|
|
52
69
|
activeEnv: string;
|
|
53
70
|
activeOrgId: string;
|
|
54
71
|
/**
|
|
@@ -63,6 +80,14 @@ interface FazemosConfig {
|
|
|
63
80
|
idToken: string;
|
|
64
81
|
refreshToken: string;
|
|
65
82
|
expiresAt: number;
|
|
83
|
+
/**
|
|
84
|
+
* The Cognito app client that minted this session. A refresh token is
|
|
85
|
+
* bound to its client, so refreshing with a different one fails — and
|
|
86
|
+
* since OIDC login introduced a CLI-specific client, "which client" is no
|
|
87
|
+
* longer answerable from the environment alone. Optional: sessions stored
|
|
88
|
+
* before this field existed fall back to the environment's client id.
|
|
89
|
+
*/
|
|
90
|
+
clientId?: string;
|
|
66
91
|
}>;
|
|
67
92
|
/**
|
|
68
93
|
* F15 — Cached /auth/me response. 5-minute TTL. Invalidated explicitly
|
|
@@ -77,12 +102,7 @@ interface FazemosConfig {
|
|
|
77
102
|
}
|
|
78
103
|
export declare const AUTH_ME_CACHE_TTL_MS: number;
|
|
79
104
|
export declare const config: Conf<FazemosConfig>;
|
|
80
|
-
export declare function addEnvironment(name: string, env:
|
|
81
|
-
apiUrl: string;
|
|
82
|
-
cognitoPoolId: string;
|
|
83
|
-
cognitoClientId: string;
|
|
84
|
-
cognitoRegion: string;
|
|
85
|
-
}): void;
|
|
105
|
+
export declare function addEnvironment(name: string, env: EnvironmentConfig): void;
|
|
86
106
|
export declare function hasEnvironments(): boolean;
|
|
87
107
|
/** Set the in-memory environment override from the global `--env` flag (or null to clear). */
|
|
88
108
|
export declare function setEnvOverride(name: string | null): void;
|
|
@@ -98,10 +118,30 @@ export declare function getActiveEnvName(): string;
|
|
|
98
118
|
export declare function getEnv(): {
|
|
99
119
|
apiUrl: string;
|
|
100
120
|
cognitoPoolId: string;
|
|
121
|
+
/** The WEB console app client. Retained for display and for older entries. */
|
|
101
122
|
cognitoClientId: string;
|
|
102
123
|
cognitoRegion: string;
|
|
124
|
+
/**
|
|
125
|
+
* The CLI's own app client — the one `auth login` authorizes against and
|
|
126
|
+
* the one refresh must use, because a refresh token is bound to the client
|
|
127
|
+
* that minted it. Absent on environments configured before OIDC login.
|
|
128
|
+
*/
|
|
129
|
+
cognitoCliClientId?: string;
|
|
130
|
+
/** Cognito hosted-UI origin, no trailing slash. Absent on older entries. */
|
|
131
|
+
hostedUiDomain?: string;
|
|
103
132
|
name: string;
|
|
104
133
|
};
|
|
134
|
+
/**
|
|
135
|
+
* Merge freshly-discovered fields into a stored environment.
|
|
136
|
+
*
|
|
137
|
+
* Used by `auth login`, which refetches /auth/config every run so an
|
|
138
|
+
* environment configured before OIDC login (no CLI client id, no hosted-UI
|
|
139
|
+
* domain) repairs itself instead of erroring. Only the supplied keys are
|
|
140
|
+
* written — apiUrl in particular stays whatever the user configured, since
|
|
141
|
+
* they may be reaching the API through a tunnel or an alias that the API's
|
|
142
|
+
* own view of its base URL would clobber.
|
|
143
|
+
*/
|
|
144
|
+
export declare function updateEnvironment(name: string, patch: Partial<EnvironmentConfig>): void;
|
|
105
145
|
export declare function getToken(): string | null;
|
|
106
146
|
export declare function getActiveOrgId(): string | null;
|
|
107
147
|
export declare function setActiveOrgId(orgId: string): void;
|
|
@@ -121,7 +161,7 @@ export declare function getDirContextSource(): {
|
|
|
121
161
|
org?: string;
|
|
122
162
|
project?: string;
|
|
123
163
|
} | null;
|
|
124
|
-
export declare function setAuth(env: string, email: string, idToken: string, refreshToken: string, expiresInSeconds: number): void;
|
|
164
|
+
export declare function setAuth(env: string, email: string, idToken: string, refreshToken: string, expiresInSeconds: number, clientId?: string): void;
|
|
125
165
|
/**
|
|
126
166
|
* Returns the active project id for the currently-active org, or null if
|
|
127
167
|
* none is set. Follows KD9 — no auto-pick, no interactive prompt. The
|
package/dist/config.js
CHANGED
|
@@ -72,6 +72,24 @@ export function getEnv() {
|
|
|
72
72
|
}
|
|
73
73
|
return { name, ...env };
|
|
74
74
|
}
|
|
75
|
+
/**
|
|
76
|
+
* Merge freshly-discovered fields into a stored environment.
|
|
77
|
+
*
|
|
78
|
+
* Used by `auth login`, which refetches /auth/config every run so an
|
|
79
|
+
* environment configured before OIDC login (no CLI client id, no hosted-UI
|
|
80
|
+
* domain) repairs itself instead of erroring. Only the supplied keys are
|
|
81
|
+
* written — apiUrl in particular stays whatever the user configured, since
|
|
82
|
+
* they may be reaching the API through a tunnel or an alias that the API's
|
|
83
|
+
* own view of its base URL would clobber.
|
|
84
|
+
*/
|
|
85
|
+
export function updateEnvironment(name, patch) {
|
|
86
|
+
const envs = config.get('environments');
|
|
87
|
+
const existing = envs[name];
|
|
88
|
+
if (!existing)
|
|
89
|
+
throw new Error(`Environment "${name}" is not configured.`);
|
|
90
|
+
envs[name] = { ...existing, ...patch };
|
|
91
|
+
config.set('environments', envs);
|
|
92
|
+
}
|
|
75
93
|
export function getToken() {
|
|
76
94
|
const env = getActiveEnvName();
|
|
77
95
|
const auth = config.get('auth')[env];
|
|
@@ -117,13 +135,16 @@ export function setDirContextSource(source) {
|
|
|
117
135
|
export function getDirContextSource() {
|
|
118
136
|
return dirContextSource;
|
|
119
137
|
}
|
|
120
|
-
export function setAuth(env, email, idToken, refreshToken, expiresInSeconds) {
|
|
138
|
+
export function setAuth(env, email, idToken, refreshToken, expiresInSeconds, clientId) {
|
|
121
139
|
const auth = config.get('auth');
|
|
122
140
|
auth[env] = {
|
|
123
141
|
email,
|
|
124
142
|
idToken,
|
|
125
143
|
refreshToken,
|
|
126
144
|
expiresAt: Date.now() + expiresInSeconds * 1000,
|
|
145
|
+
// Preserved across a refresh by the caller passing it back in; see
|
|
146
|
+
// refreshSession() in auth.ts.
|
|
147
|
+
...(clientId ? { clientId } : {}),
|
|
127
148
|
};
|
|
128
149
|
config.set('auth', auth);
|
|
129
150
|
}
|
package/dist/config.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAC;
|
|
1
|
+
{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAC;AAyGxB,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAElD,MAAM,CAAC,MAAM,MAAM,GAAG,IAAI,IAAI,CAAgB;IAC5C,WAAW,EAAE,aAAa;IAC1B,QAAQ,EAAE;QACR,YAAY,EAAE,EAAE;QAChB,SAAS,EAAE,EAAE;QACb,WAAW,EAAE,EAAE;QACf,kBAAkB,EAAE,EAAE;QACtB,IAAI,EAAE,EAAE;KACT;CACF,CAAC,CAAC;AAEH,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,GAAsB;IACjE,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC;IACjB,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;IACjC,iCAAiC;IACjC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IAChC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AAC5D,CAAC;AAED,+DAA+D;AAC/D,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,2EAA2E;AAC3E,4EAA4E;AAC5E,2DAA2D;AAC3D,EAAE;AACF,sEAAsE;AACtE,EAAE;AACF,4EAA4E;AAC5E,+EAA+E;AAC/E,6EAA6E;AAC7E,qEAAqE;AAErE,IAAI,WAAW,GAAkB,IAAI,CAAC;AAEtC,8FAA8F;AAC9F,MAAM,UAAU,cAAc,CAAC,IAAmB;IAChD,WAAW,GAAG,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;AACrC,CAAC;AAID,iFAAiF;AACjF,MAAM,UAAU,kBAAkB;IAChC,IAAI,WAAW;QAAE,OAAO,MAAM,CAAC;IAC/B,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,EAAE;QAAE,OAAO,SAAS,CAAC;IACtD,IAAI,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC;QAAE,OAAO,WAAW,CAAC;IAChD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB;IAC9B,OAAO,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;AACnF,CAAC;AAED,MAAM,UAAU,MAAM;IACpB,MAAM,IAAI,GAAG,gBAAgB,EAAE,CAAC;IAChC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,GAAG,GAAG,kBAAkB,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,GAAG,KAAK,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9F,MAAM,IAAI,KAAK,CAAC,gBAAgB,IAAI,IAAI,GAAG,uDAAuD,IAAI,kBAAkB,CAAC,CAAC;IAC5H,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,GAAG,GAAG,EAAE,CAAC;AAC1B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,KAAiC;IAC/E,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,IAAI,sBAAsB,CAAC,CAAC;IAC3E,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,GAAG,KAAK,EAAE,CAAC;IACvC,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,QAAQ;IACtB,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;IAC/B,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC7C,OAAO,IAAI,CAAC,OAAO,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IACpC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACxC,OAAO,KAAK,IAAI,IAAI,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;AACnC,CAAC;AAED,+DAA+D;AAC/D,EAAE;AACF,6EAA6E;AAC7E,8EAA8E;AAC9E,wEAAwE;AACxE,8EAA8E;AAC9E,6EAA6E;AAC7E,4DAA4D;AAE5D,IAAI,WAAW,GAAkB,IAAI,CAAC;AACtC,IAAI,eAAe,GAAkB,IAAI,CAAC;AAC1C,IAAI,gBAAgB,GAA4D,IAAI,CAAC;AAErF,iFAAiF;AACjF,MAAM,UAAU,cAAc,CAAC,KAAoB;IACjD,WAAW,GAAG,KAAK,CAAC;AACtB,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,kBAAkB,CAAC,SAAwB;IACzD,eAAe,GAAG,SAAS,CAAC;AAC9B,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,mBAAmB,CAAC,MAA+D;IACjG,gBAAgB,GAAG,MAAM,CAAC;AAC5B,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,mBAAmB;IACjC,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,OAAO,CACrB,GAAW,EACX,KAAa,EACb,OAAe,EACf,YAAoB,EACpB,gBAAwB,EACxB,QAAiB;IAEjB,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAChC,IAAI,CAAC,GAAG,CAAC,GAAG;QACV,KAAK;QACL,OAAO;QACP,YAAY;QACZ,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,GAAG,IAAI;QAC/C,mEAAmE;QACnE,+BAA+B;QAC/B,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClC,CAAC;IACF,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,+DAA+D;AAE/D;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB;IAChC,IAAI,eAAe;QAAE,OAAO,eAAe,CAAC;IAC5C,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAC/B,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,EAAE,CAAC;IACnD,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC;AAC5B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa,EAAE,SAAiB;IACjE,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,EAAE,CAAC;IACnD,GAAG,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC;IACvB,MAAM,CAAC,GAAG,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC;AACxC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,EAAE,CAAC;IACnD,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC;IAClB,MAAM,CAAC,GAAG,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC;AACxC,CAAC;AAED,+DAA+D;AAE/D,MAAM,UAAU,cAAc;IAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACxC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,SAAS,GAAG,gBAAgB,EAAE,CAAC;IACrC,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC/C,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,GAAG,oBAAoB;QAAE,OAAO,IAAI,CAAC;IACrE,OAAO,KAAK,CAAC,IAAI,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAoB;IACjD,MAAM,SAAS,GAAG,gBAAgB,EAAE,CAAC;IACrC,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE;QACxB,SAAS;QACT,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;QACrB,IAAI;KACL,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,yEAAyE;IACzE,yEAAyE;IACzE,wBAAwB;IACxB,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAa,EAAE,IAAY;IAC3D,MAAM,EAAE,GAAG,cAAc,EAAE,CAAC;IAC5B,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACrB,MAAM,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC;IAC9C,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,OAAO,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAa,EAAE,SAAiB;IAC9D,MAAM,EAAE,GAAG,cAAc,EAAE,CAAC;IAC5B,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACrB,MAAM,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC;IAC9C,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,OAAO,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,IAAI,IAAI,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,MAAM,EAAE,GAAG,cAAc,EAAE,CAAC;IAC5B,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACrB,OAAO,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC;AACnD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,EAAE,GAAG,cAAc,EAAE,CAAC;IAC5B,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACrB,OAAO,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC;AACpD,CAAC"}
|
package/dist/index.js
CHANGED
|
@@ -7,7 +7,8 @@ getActiveProjectId, setActiveProjectId, clearActiveProjectId, findProjectBySlug,
|
|
|
7
7
|
// Directory-scoped context override (.fazemos.json)
|
|
8
8
|
setOrgOverride, setProjectOverride, setDirContextSource, getDirContextSource, } from './config.js';
|
|
9
9
|
import { findDirContextFile, readDirContextFile, writeDirContextFile, removeDirContextFile, DIR_CONFIG_FILENAME, } from './dircontext.js';
|
|
10
|
-
import {
|
|
10
|
+
import { loginWithBrowser, hostedLogoutUrl, signup, confirmSignup, adminLogin } from './auth.js';
|
|
11
|
+
import { fetchAuthConfig } from './authConfig.js';
|
|
11
12
|
import { api, ApiError, refreshAuthMeCache, invalidateAuthMeCache, resolveOrgIdMaybeSlug, resolveProjectIdBySlug, patchProjectDocsRepo, patchOrgWorkspace } from './api.js';
|
|
12
13
|
import { isProjectConnectionUnavailable, renderProjectConnectionUnavailableCopy, } from './connectionErrorCopy.js';
|
|
13
14
|
import { loadYaml, summarize } from './yaml/load.js';
|
|
@@ -328,55 +329,70 @@ program.hook('preAction', async (_thisCommand, actionCommand) => {
|
|
|
328
329
|
// ── Init ────────────────────────────────────────────────────
|
|
329
330
|
program
|
|
330
331
|
.command('init')
|
|
331
|
-
.description('Configure an environment (
|
|
332
|
+
.description('Configure an environment (discovers Cognito settings from the API)')
|
|
332
333
|
.argument('<name>', 'Environment name (e.g., dev, prod, local)')
|
|
333
334
|
.requiredOption('--api-url <url>', 'API base URL')
|
|
334
|
-
.option('--cognito-pool <id>', 'Cognito User Pool ID (
|
|
335
|
-
.option('--cognito-client <id>', 'Cognito
|
|
336
|
-
.option('--cognito-
|
|
335
|
+
.option('--cognito-pool <id>', 'Cognito User Pool ID (discovered if omitted)')
|
|
336
|
+
.option('--cognito-client <id>', 'Cognito app client ID for the web console (discovered if omitted)')
|
|
337
|
+
.option('--cognito-cli-client <id>', 'Cognito app client ID for the CLI (discovered if omitted)')
|
|
338
|
+
.option('--hosted-ui <domain>', 'Cognito hosted-UI origin, e.g. https://jj-auth-dev.auth.us-west-2.amazoncognito.com (discovered if omitted)')
|
|
339
|
+
.option('--cognito-region <region>', 'Cognito region (discovered if omitted)')
|
|
337
340
|
.action(async (name, opts) => {
|
|
341
|
+
const apiUrl = opts.apiUrl.replace(/\/$/, '');
|
|
338
342
|
let poolId = opts.cognitoPool;
|
|
339
343
|
let clientId = opts.cognitoClient;
|
|
344
|
+
let cliClientId = opts.cognitoCliClient;
|
|
345
|
+
let hostedUiDomain = opts.hostedUi;
|
|
340
346
|
let region = opts.cognitoRegion;
|
|
341
|
-
//
|
|
342
|
-
|
|
347
|
+
// Discovery is the normal path; the flags exist for an API that predates
|
|
348
|
+
// GET /auth/config, or for pointing at a stack whose config endpoint is
|
|
349
|
+
// temporarily degraded. Anything supplied by flag wins — the operator has
|
|
350
|
+
// more context than the endpoint does about why they typed it.
|
|
351
|
+
const needsDiscovery = !poolId || !cliClientId || !hostedUiDomain || !region;
|
|
352
|
+
if (needsDiscovery) {
|
|
343
353
|
try {
|
|
344
|
-
console.log(chalk.cyan(
|
|
345
|
-
const
|
|
346
|
-
|
|
347
|
-
|
|
348
|
-
|
|
349
|
-
|
|
350
|
-
|
|
351
|
-
|
|
352
|
-
}
|
|
353
|
-
else {
|
|
354
|
-
console.log(chalk.yellow('Auto-discovery not available — provide --cognito-pool and --cognito-client'));
|
|
355
|
-
process.exit(1);
|
|
356
|
-
}
|
|
354
|
+
console.log(chalk.cyan(`Discovering auth config from ${apiUrl}/auth/config ...`));
|
|
355
|
+
const cfg = await fetchAuthConfig(apiUrl);
|
|
356
|
+
poolId = poolId || cfg.cognito.userPoolId;
|
|
357
|
+
clientId = clientId || cfg.cognito.clients.web.clientId;
|
|
358
|
+
cliClientId = cliClientId || cfg.cognito.clients.cli.clientId;
|
|
359
|
+
hostedUiDomain = hostedUiDomain || cfg.cognito.hostedUiDomain;
|
|
360
|
+
region = region || cfg.cognito.region;
|
|
361
|
+
console.log(chalk.green('Discovered Cognito settings'));
|
|
357
362
|
}
|
|
358
|
-
catch {
|
|
359
|
-
console.error(chalk.red(
|
|
363
|
+
catch (err) {
|
|
364
|
+
console.error(chalk.red(err.message));
|
|
360
365
|
process.exit(1);
|
|
361
366
|
}
|
|
362
367
|
}
|
|
363
|
-
if (!poolId
|
|
364
|
-
console.error(chalk.red('Missing Cognito Pool ID
|
|
368
|
+
if (!poolId) {
|
|
369
|
+
console.error(chalk.red('Missing Cognito Pool ID — pass --cognito-pool.'));
|
|
365
370
|
process.exit(1);
|
|
366
371
|
}
|
|
367
372
|
addEnvironment(name, {
|
|
368
|
-
apiUrl
|
|
373
|
+
apiUrl,
|
|
369
374
|
cognitoPoolId: poolId,
|
|
370
|
-
cognitoClientId: clientId,
|
|
375
|
+
cognitoClientId: clientId || '',
|
|
371
376
|
cognitoRegion: region || 'us-west-2',
|
|
377
|
+
cognitoCliClientId: cliClientId || undefined,
|
|
378
|
+
hostedUiDomain: hostedUiDomain || undefined,
|
|
372
379
|
});
|
|
373
380
|
console.log(chalk.green(`Environment "${name}" configured`));
|
|
374
|
-
console.log(` API:
|
|
375
|
-
console.log(` Pool:
|
|
376
|
-
console.log(`
|
|
377
|
-
console.log(`
|
|
381
|
+
console.log(` API: ${apiUrl}`);
|
|
382
|
+
console.log(` Pool: ${poolId}`);
|
|
383
|
+
console.log(` Region: ${region || 'us-west-2'}`);
|
|
384
|
+
console.log(` Web client: ${clientId || chalk.yellow('(none)')}`);
|
|
385
|
+
console.log(` CLI client: ${cliClientId || chalk.yellow('(none)')}`);
|
|
386
|
+
console.log(` Hosted UI: ${hostedUiDomain || chalk.yellow('(none)')}`);
|
|
387
|
+
// `auth login` needs both of these and refetches /auth/config anyway, so
|
|
388
|
+
// this is a warning rather than a failure — the environment is still
|
|
389
|
+
// usable for anything that runs on an existing token.
|
|
390
|
+
if (!cliClientId || !hostedUiDomain) {
|
|
391
|
+
console.log(chalk.yellow(`\nNo CLI app client or hosted-UI domain: \`fazemos auth login\` will not work ` +
|
|
392
|
+
`against this environment until the API's /auth/config advertises them.`));
|
|
393
|
+
}
|
|
378
394
|
if (config.get('activeEnv') === name) {
|
|
379
|
-
console.log(chalk.cyan(` Active:
|
|
395
|
+
console.log(chalk.cyan(` Active: yes`));
|
|
380
396
|
}
|
|
381
397
|
});
|
|
382
398
|
// ── Environment ─────────────────────────────────────────────
|
|
@@ -418,6 +434,10 @@ program
|
|
|
418
434
|
console.log(` Environment: ${chalk.cyan(env.name)}${srcLabel}`);
|
|
419
435
|
console.log(` API: ${env.apiUrl}`);
|
|
420
436
|
console.log(` Cognito: ${env.cognitoPoolId}`);
|
|
437
|
+
// `auth login` needs both of these; showing them here is how you tell a
|
|
438
|
+
// stale environment (configured before OIDC login) from a broken one.
|
|
439
|
+
console.log(` CLI client: ${env.cognitoCliClientId || chalk.yellow('(not discovered — run: fazemos auth login)')}`);
|
|
440
|
+
console.log(` Hosted UI: ${env.hostedUiDomain || chalk.yellow('(not discovered — run: fazemos auth login)')}`);
|
|
421
441
|
const token = getToken();
|
|
422
442
|
console.log(` Auth: ${token ? chalk.green('authenticated') : chalk.yellow('not logged in')}`);
|
|
423
443
|
});
|
|
@@ -425,12 +445,12 @@ program
|
|
|
425
445
|
const auth = program.command('auth').description('Authentication commands');
|
|
426
446
|
auth
|
|
427
447
|
.command('login')
|
|
428
|
-
.description('
|
|
429
|
-
.
|
|
430
|
-
.requiredOption('-p, --password <password>', 'Password')
|
|
448
|
+
.description('Sign in through your browser (Cognito hosted UI, auth-code + PKCE)')
|
|
449
|
+
.option('--no-browser', 'Print the sign-in URL instead of launching a browser')
|
|
431
450
|
.action(async (opts) => {
|
|
432
451
|
try {
|
|
433
|
-
|
|
452
|
+
// Commander turns `--no-browser` into `opts.browser === false`.
|
|
453
|
+
const result = await loginWithBrowser({ noBrowser: opts.browser === false });
|
|
434
454
|
console.log(chalk.green(`Logged in as ${result.email}`));
|
|
435
455
|
}
|
|
436
456
|
catch (err) {
|
|
@@ -496,13 +516,28 @@ auth
|
|
|
496
516
|
});
|
|
497
517
|
auth
|
|
498
518
|
.command('logout')
|
|
499
|
-
.description('Clear stored credentials')
|
|
519
|
+
.description('Clear stored credentials (prints the URL to end the browser session too)')
|
|
500
520
|
.action(() => {
|
|
501
521
|
const env = getActiveEnvName();
|
|
502
522
|
const auths = config.get('auth');
|
|
503
523
|
delete auths[env];
|
|
504
524
|
config.set('auth', auths);
|
|
505
525
|
console.log(chalk.green(`Logged out of ${env}`));
|
|
526
|
+
// Clearing local tokens does NOT end the Cognito hosted-UI session — the
|
|
527
|
+
// browser still holds it, so the next `auth login` signs straight back in
|
|
528
|
+
// with no prompt. That is usually what you want; when it is not (shared
|
|
529
|
+
// machine, switching accounts) this URL is how you actually sign out.
|
|
530
|
+
let url = null;
|
|
531
|
+
try {
|
|
532
|
+
url = hostedLogoutUrl();
|
|
533
|
+
}
|
|
534
|
+
catch {
|
|
535
|
+
// No environment configured — nothing further to offer.
|
|
536
|
+
}
|
|
537
|
+
if (url) {
|
|
538
|
+
console.log(chalk.gray(`\nStill signed in to the browser session. To end it too, open:`));
|
|
539
|
+
console.log(chalk.gray(` ${url}`));
|
|
540
|
+
}
|
|
506
541
|
});
|
|
507
542
|
// ── Whoami ──────────────────────────────────────────────────
|
|
508
543
|
program
|