@habeetat/cli 0.1.0-dev.20260708084836.99a488d → 0.1.0-dev.20260710132343.dec67be

package/dist/bin.js

@@ -13183,11 +13183,11 @@ SET name = EXCLUDED.name, indicator = EXCLUDED.indicator, access_token_ttl = EXC
 
 -- Scope for API Resource
 INSERT INTO scopes (tenant_id, id, resource_id, name, description)
-VALUES ('default', 'nhp-backend-scope', 'nhp-backend-resource', 'nhp:all', 'Full access to NHP backend API')
+VALUES ('default', 'nhp-backend-scope', 'nhp-backend-resource', 'nhp:api', 'Full access to NHP backend API')
 ON CONFLICT (id) DO UPDATE
 SET resource_id = EXCLUDED.resource_id, name = EXCLUDED.name, description = EXCLUDED.description;
 
--- Default platform user role: grants the API scope (nhp:all) to EVERY user and is a Logto
+-- Default platform user role: grants the API scope (nhp:api) to EVERY user and is a Logto
 -- default role (is_default), so self-registered users are auto-assigned it on sign-up. Without
 -- this a new user has no scope on the API resource \u2192 their token is opaque \u2192 they can't call
 -- /auth/me or create their first org (org-onboarding self-registration would be locked out).
@@ -13933,6 +13933,32 @@ async function restartCommand(service) {
   }
 }
 
+// src/commands/reconcile-iam.ts
+async function reconcileIamCommand(options = {}) {
+  const projectDir = getProjectDir();
+  const spinner = ora("Reconciling IAM baseline (nhp:api scope + roles + user backfill)...").start();
+  try {
+    const args = [
+      "compose",
+      "-f",
+      COMPOSE_FILE,
+      "exec",
+      "-T",
+      "backend",
+      "node",
+      "dist/scripts/reconcile-iam.js"
+    ];
+    if (options.dropLegacy) args.push("--drop-legacy");
+    const { stdout } = await execa("docker", args, { cwd: projectDir, stdio: "pipe" });
+    spinner.succeed("IAM baseline reconciled");
+    const line = stdout.trim();
+    if (line) logger.info(line.split("\n").pop() ?? line);
+  } catch (err) {
+    spinner.fail("IAM baseline reconcile failed");
+    throw err;
+  }
+}
+
 // src/commands/update.ts
 async function composePull(opts) {
   const cmd = opts.service ? `docker compose -f ${COMPOSE_FILE} pull ${opts.service}` : `docker compose -f ${COMPOSE_FILE} pull`;
@@ -13967,6 +13993,13 @@ async function updateCommand(service) {
     logger.error(String(err));
     process.exit(1);
   }
+  try {
+    await reconcileIamCommand();
+  } catch (err) {
+    logger.warn(
+      `IAM baseline reconcile skipped/failed: ${String(err)}. Run 'habeetat reconcile-iam' manually.`
+    );
+  }
   console.log("");
   logger.info("Update complete. Run `habeetat status` to verify all services are healthy.");
 }
@@ -14377,6 +14410,9 @@ program2.command("doctor").description("Diagnose common issues").action(doctorCo
 program2.command("destroy").description("Destroy the platform \u2014 remove all containers and volumes").option("-f, --force", "Skip confirmation prompt").action((options) => {
   return destroyCommand(options);
 });
+program2.command("reconcile-iam").description("Reconcile the IAM baseline (nhp:api scope + roles + backfill users)").option("--drop-legacy", "Stop granting the legacy nhp:all alias (post-migration cleanup)").action((options) => {
+  return reconcileIamCommand(options);
+});
 program2.command("init").description("Initialize platform (seed Logto apps, create admin user, setup database)").action(() => {
   return initPlatform(getProjectDir());
 });