@hcmai/cli 0.3.2 → 0.3.3

package/dist/index.js

@@ -2034,6 +2034,11 @@ async function readStdin() {
   for await (const chunk of process.stdin) chunks.push(chunk);
   return Buffer.concat(chunks).toString("utf-8").trim();
 }
+async function readSecretFromStdin() {
+  const chunks = [];
+  for await (const chunk of process.stdin) chunks.push(chunk);
+  return Buffer.concat(chunks).toString("utf-8").replace(/\r?\n$/, "");
+}
 async function promptConfirm(question) {
   const ans = await promptText(question);
   return /^y(es)?$/i.test(ans.trim());
@@ -2281,9 +2286,9 @@ async function loginCommand(args) {
   } catch (e) {
     const err = e;
     if (err.isAxiosError) {
-      const { fromAxiosError: fromAxiosError17 } = await import("@hcmai/sdk");
+      const { fromAxiosError: fromAxiosError18 } = await import("@hcmai/sdk");
       exitWithError(
-        fromAxiosError17(
+        fromAxiosError18(
           e,
           envName
         )
@@ -7581,7 +7586,8 @@ var GUARDED_EXECUTOR_REASON_CODES = /* @__PURE__ */ new Set([
   "record-create",
   "record-update",
   "cache-mutation",
-  "setting-write"
+  "setting-write",
+  "credential-reset"
 ]);
 function assessDeliveryCommand(inputArgv) {
   const argv = inputArgv[0] === "--" ? inputArgv.slice(1) : [...inputArgv];
@@ -7590,7 +7596,9 @@ function assessDeliveryCommand(inputArgv) {
   const subcommand = argv[1] && !argv[1].startsWith("-") ? argv[1] : void 0;
   const envAlias = flagValue(argv, "--env");
   const identityAlias = flagValue(argv, "--as");
-  const sensitiveFlags = [...new Set(PAYLOAD_FLAGS.filter((flag) => hasFlag(argv, flag)))];
+  const sensitiveFlags = [
+    ...new Set([...PAYLOAD_FLAGS, ...CREDENTIAL_FLAGS].filter((flag) => hasFlag(argv, flag)))
+  ];
   const target = summarizeTarget(argv);
   let classification = classify(argv);
   const invalidPayload = payloadError(argv);
@@ -7644,6 +7652,19 @@ function classify(argv) {
   if (argv.some((arg) => APPROVAL_BYPASS_FLAGS.has(flagName(arg)))) {
     return forbidden("approval-bypass", "\u547D\u4EE4\u5305\u542B\u8DF3\u8FC7\u786E\u8BA4\u7684\u65D7\u6807\uFF0C\u987E\u95EE\u4EA4\u4ED8\u9762\u4E0D\u6267\u884C\u3002");
   }
+  if (name === "user" && subcommand === "reset-password") {
+    const nonStdinCredential = argv.some((arg) => {
+      const flag = flagName(arg);
+      return CREDENTIAL_FLAGS.has(flag) && flag !== "--password-stdin";
+    });
+    if (nonStdinCredential || !argv.includes("--password-stdin")) {
+      return forbidden(
+        "credential-governance",
+        "\u7528\u6237\u5BC6\u7801\u91CD\u7F6E\u53EA\u80FD\u901A\u8FC7 --password-stdin \u8FDB\u5165\u53D7\u63A7\u51ED\u636E\u6D41\u7A0B\u3002"
+      );
+    }
+    return guarded("credential-write", "credential-reset");
+  }
   if (argv.some((arg) => CREDENTIAL_FLAGS.has(flagName(arg)))) {
     return forbidden("credential-governance", "\u547D\u4EE4\u643A\u5E26\u8EAB\u4EFD\u51ED\u636E\u53C2\u6570\uFF0C\u5FC5\u987B\u8F6C\u4EA4\u8EAB\u4EFD\u6CBB\u7406\u6D41\u7A0B\u3002");
   }
@@ -7765,7 +7786,14 @@ function summarizeTarget(argv) {
     if (settingKeys.length > 0) target.settingKeys = settingKeys;
   }
   const id = flagValue(argv, "--id");
-  if (id) target.recordIdSha256 = sha2565(id);
+  if (name === "user" && subcommand === "reset-password") {
+    if (id) target.userIdSha256 = sha2565(id);
+    const username = flagValue(argv, "--username");
+    if (username) target.usernameSha256 = sha2565(username);
+    target.forceChangeOnNextLogin = !hasFlag(argv, "--no-force-change");
+  } else if (id) {
+    target.recordIdSha256 = sha2565(id);
+  }
   for (const flag of PAYLOAD_FLAGS) {
     const raw = flagValue(argv, flag);
     if (!raw) continue;
@@ -8116,6 +8144,32 @@ function assertGuardedAssessment(assessment, argv) {
   validateSupportedCommandShape(assessment.reasonCode, argv);
 }
 function validateSupportedCommandShape(reasonCode, argv) {
+  if (reasonCode === "credential-reset") {
+    if (argv[0] !== "user" || argv[1] !== "reset-password") {
+      throw invalid4("credential-reset \u53EA\u652F\u6301 user reset-password");
+    }
+    const userId = optionalFlagValue(argv, "--id");
+    const username = optionalFlagValue(argv, "--username");
+    if (Boolean(userId) === Boolean(username)) {
+      throw invalid4("user reset-password \u5FC5\u987B\u4E14\u53EA\u80FD\u5305\u542B --id \u6216 --username");
+    }
+    if (!argv.includes("--password-stdin")) {
+      throw invalid4("user reset-password \u5FC5\u987B\u5305\u542B\u72EC\u7ACB\u7684 --password-stdin");
+    }
+    if (argv.some(
+      (value) => [
+        "--password",
+        "--new-password",
+        "--client-secret",
+        "--pat",
+        "--new-password-stdin",
+        "--pat-stdin"
+      ].includes(value.split("=", 1)[0] ?? "")
+    ) || argv.some((value) => value.startsWith("--password-stdin="))) {
+      throw invalid4("user reset-password \u4E0D\u5141\u8BB8\u5728 argv \u4E2D\u643A\u5E26\u660E\u6587\u51ED\u636E");
+    }
+    return;
+  }
   if (reasonCode === "record-create") {
     requireFlagValue(argv, "--data", "create \u5FC5\u987B\u5305\u542B --data <JSON>");
     return;
@@ -8140,6 +8194,19 @@ function validateSupportedCommandShape(reasonCode, argv) {
     }
   }
 }
+function optionalFlagValue(argv, flag) {
+  for (let index = 0; index < argv.length; index += 1) {
+    const value = argv[index];
+    if (value === flag) {
+      const next = argv[index + 1];
+      return next && !next.startsWith("-") ? next : void 0;
+    }
+    if (value?.startsWith(`${flag}=`) && value.length > flag.length + 1) {
+      return value.slice(flag.length + 1);
+    }
+  }
+  return void 0;
+}
 function requireFlagValue(argv, flag, message) {
   for (let index = 0; index < argv.length; index += 1) {
     const value = argv[index];
@@ -8318,6 +8385,65 @@ function invalid4(message, cause) {
   return new CliError20({ code: CliErrorCode19.INVALID_ARGUMENT, message, cause });
 }
 
+// src/commands/user.ts
+init_auth_guard();
+init_exit();
+import {
+  HcmClient as HcmClient17,
+  adminResetPassword,
+  formatObject as formatObject19,
+  fromAxiosError as fromAxiosError17,
+  CliError as CliError21,
+  CliErrorCode as CliErrorCode20
+} from "@hcmai/sdk";
+function buildAdminResetPasswordRequest(args, password) {
+  const hasId = Boolean(args.id);
+  const hasUsername = Boolean(args.username);
+  if (hasId === hasUsername) {
+    throw new CliError21({
+      code: CliErrorCode20.INVALID_ARGUMENT,
+      message: "--id <uuid> \u4E0E --username <user> \u5FC5\u987B\u4E14\u53EA\u80FD\u63D0\u4F9B\u4E00\u4E2A"
+    });
+  }
+  if (!password) {
+    throw new CliError21({
+      code: CliErrorCode20.INVALID_ARGUMENT,
+      message: "\u65B0\u5BC6\u7801\u4E0D\u80FD\u4E3A\u7A7A"
+    });
+  }
+  return {
+    ...args.id ? { userId: args.id } : {},
+    ...args.username ? { username: args.username } : {},
+    newPassword: password,
+    confirmPassword: password,
+    forceChangeOnNextLogin: args.forceChange !== false
+  };
+}
+async function userResetPasswordCommand(args) {
+  try {
+    const password = args.passwordStdin ? await readSecretFromStdin() : await promptPasswordTwice();
+    const request = buildAdminResetPasswordRequest(args, password);
+    const client3 = HcmClient17.fromAuthContext(await getActiveAuthContextFromCli(args));
+    const result2 = await adminResetPassword(client3.raw(), request);
+    process.stdout.write(formatObject19(result2, { format: args.output ?? "json" }) + "\n");
+  } catch (cause) {
+    const err = cause;
+    if (err?.isAxiosError) exitWithError(fromAxiosError17(err, args.env));
+    exitWithError(cause);
+  }
+}
+async function promptPasswordTwice() {
+  const password = await promptSecret("\u65B0\u5BC6\u7801: ");
+  const confirmation = await promptSecret("\u518D\u6B21\u8F93\u5165\u65B0\u5BC6\u7801: ");
+  if (password !== confirmation) {
+    throw new CliError21({
+      code: CliErrorCode20.INVALID_ARGUMENT,
+      message: "\u4E24\u6B21\u8F93\u5165\u7684\u65B0\u5BC6\u7801\u4E0D\u4E00\u81F4"
+    });
+  }
+  return password;
+}
+
 // src/startup.ts
 function needsLegacyProfileMigration(argv) {
   const args = argv.slice(2);
@@ -8355,6 +8481,8 @@ var identity = program.command("identity").description("\u7BA1\u7406 HCM \u8EAB\
 identity.command("list").description("\u5217\u51FA identity\uFF08\u9ED8\u8BA4\u5217\u5F53\u524D env\uFF0C--env all \u5217\u5168\u90E8\uFF09").option("--env <name>", '\u8FC7\u6EE4 env\uFF1B\u4F20 "all" \u5217\u5168\u90E8', void 0).action((opts) => identityList(opts));
 identity.command("use <name>").description("\u628A identity \u8BBE\u4E3A\u5176 env \u7684 default identity").action((name) => identityUse(name));
 identity.command("remove <name>").description("\u5220\u9664 identity\uFF08\u6E05 token + \u82E5\u662F env default \u5219\u6E05\u7A7A\uFF09").action((name) => identityRemove(name));
+var user = program.command("user").description("\u7BA1\u7406\u79DF\u6237\u7528\u6237\u7684\u4E13\u7528\u51ED\u636E\u6D41\u7A0B");
+user.command("reset-password").description("\u7531 admin.system \u5B89\u5168\u91CD\u7F6E\u7528\u6237\u5BC6\u7801\uFF0C\u5E76\u4F7F\u65E2\u6709\u4F1A\u8BDD\u5931\u6548").option("--id <uuid>", "\u76EE\u6807\u7528\u6237 ID\uFF08\u4E0E --username \u4E8C\u9009\u4E00\uFF09").option("--username <user>", "\u76EE\u6807\u7528\u6237\u540D\uFF08\u4E0E --id \u4E8C\u9009\u4E00\uFF09").option("--password-stdin", "\u4ECE\u6807\u51C6\u8F93\u5165\u8BFB\u53D6\u65B0\u5BC6\u7801\uFF08Agent/\u53D7\u63A7\u4EA4\u4ED8\u5FC5\u987B\u4F7F\u7528\uFF09").option("--no-force-change", "\u4E0B\u6B21\u767B\u5F55\u4E0D\u5F3A\u5236\u6539\u5BC6\uFF08\u4EC5\u9650\u5DF2\u6279\u51C6\u7684\u9694\u79BB\u6D4B\u8BD5\u73AF\u5883\uFF09").option("--env <name>", "\u4E34\u65F6\u5207\u73AF\u5883\uFF08\u8986\u76D6 activeEnv\uFF0C\u672C\u6B21\u547D\u4EE4\uFF09").option("--as <identity>", "\u4E34\u65F6\u6362\u8EAB\u4EFD\uFF08\u5FC5\u987B\u5177\u5907 admin.system\uFF09").option("--output <fmt>", "\u8F93\u51FA\u683C\u5F0F\uFF1Atable | json | yaml", "json").action((opts) => userResetPasswordCommand(opts));
 var delivery = program.command("delivery").description("\u987E\u95EE\u4EA4\u4ED8\u547D\u4EE4\u7684\u98CE\u9669\u8BC4\u4F30\u4E0E\u4E00\u6B21\u6027\u53D7\u63A7\u6267\u884C\u5408\u540C");
 delivery.command("assess").description("\u7EAF\u672C\u5730\u8BC4\u4F30\u4E00\u6B21 HCM CLI argv\uFF1B\u7528 -- \u5206\u9694\u88AB\u8BC4\u4F30\u547D\u4EE4").option("--output <fmt>", "\u8F93\u51FA\u683C\u5F0F\uFF1Atable | json | yaml", "json").allowUnknownOption(true).argument("<command...>", "\u88AB\u8BC4\u4F30\u7684 HCM \u5B50\u547D\u4EE4\u4E0E\u53C2\u6570\uFF0C\u4E0D\u5305\u542B hcm \u672C\u8EAB").action((command, opts) => deliveryAssessCommand(command, opts));
 delivery.command("prepare").description("\u628A\u53D7\u652F\u6301\u7684 R2 argv \u4E0E\u9501\u3001\u8FD0\u884C\u65F6\u548C\u53D8\u66F4/\u56DE\u6EDA\u8BF4\u660E\u7ED1\u5B9A\u4E3A\u77ED\u65F6\u6267\u884C\u8BA1\u5212").requiredOption("--change-ref <file>", "\u9879\u76EE work/ \u6216 decisions/ \u4E0B\u7684\u53D8\u66F4\u8BF4\u660E").requiredOption("--rollback-ref <file>", "\u9879\u76EE work/ \u6216 decisions/ \u4E0B\u7684\u56DE\u6EDA\u8BF4\u660E").requiredOption("--evidence-dir <dir>", "\u9879\u76EE evidence/ \u4E0B\u7684\u6536\u636E\u76EE\u5F55").option("--project <dir>", "HCM \u987E\u95EE\u9879\u76EE\u6839\u76EE\u5F55", ".").option("--ttl-seconds <n>", "\u6709\u6548\u671F\u79D2\u6570\uFF0860-3600\uFF09", "900").option("--output <fmt>", "\u8F93\u51FA\u683C\u5F0F\uFF1Atable | json | yaml", "json").allowUnknownOption(true).argument("<command...>", "\u88AB\u7ED1\u5B9A\u7684 R2 HCM \u5B50\u547D\u4EE4\u4E0E\u53C2\u6570\uFF0C\u4E0D\u5305\u542B hcm \u672C\u8EAB").action((command, opts) => deliveryPrepareCommand(command, opts));