@indigoai-us/hq-cli 5.10.0 → 5.11.0

package/src/utils/vault-api.test.ts

@@ -0,0 +1,111 @@
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+
+import { getEntityUid, resolveCallerPersonUid } from './vault-api.js';
+
+const fetchMock = vi.fn();
+const originalFetch = globalThis.fetch;
+
+function mockResponse(status: number, body: unknown): Response {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { 'Content-Type': 'application/json' },
+  });
+}
+
+beforeEach(() => {
+  fetchMock.mockReset();
+  globalThis.fetch = fetchMock as unknown as typeof fetch;
+});
+
+afterEach(() => {
+  globalThis.fetch = originalFetch;
+});
+
+describe('resolveCallerPersonUid', () => {
+  it('returns the canonical person uid (oldest createdAt, uid tie-break)', async () => {
+    fetchMock.mockResolvedValueOnce(
+      mockResponse(200, {
+        entities: [
+          { uid: 'prs_b', type: 'person', createdAt: '2026-01-02T00:00:00Z' },
+          { uid: 'prs_a', type: 'person', createdAt: '2026-01-01T00:00:00Z' },
+          { uid: 'prs_c', type: 'person', createdAt: '2026-01-01T00:00:00Z' },
+        ],
+      }),
+    );
+
+    const uid = await resolveCallerPersonUid('tok');
+    expect(uid).toBe('prs_a');
+  });
+
+  it('throws when the caller has no person entity', async () => {
+    fetchMock.mockResolvedValueOnce(mockResponse(200, { entities: [] }));
+    await expect(resolveCallerPersonUid('tok')).rejects.toThrow(
+      /No person entity/,
+    );
+  });
+
+  it('throws when the API returns an error status', async () => {
+    fetchMock.mockResolvedValueOnce(mockResponse(401, { error: 'unauth' }));
+    await expect(resolveCallerPersonUid('tok')).rejects.toThrow(
+      /Failed to fetch person entity/,
+    );
+  });
+
+  it('filters out non-person entries before sorting', async () => {
+    fetchMock.mockResolvedValueOnce(
+      mockResponse(200, {
+        entities: [
+          { uid: 'cmp_a', type: 'company', createdAt: '2025-01-01T00:00:00Z' },
+          { uid: 'prs_a', type: 'person', createdAt: '2026-01-01T00:00:00Z' },
+        ],
+      }),
+    );
+    const uid = await resolveCallerPersonUid('tok');
+    expect(uid).toBe('prs_a');
+  });
+});
+
+describe('getEntityUid', () => {
+  it('routes to person resolution when personal=true', async () => {
+    fetchMock.mockResolvedValueOnce(
+      mockResponse(200, {
+        entities: [
+          { uid: 'prs_a', type: 'person', createdAt: '2026-01-01T00:00:00Z' },
+        ],
+      }),
+    );
+    const uid = await getEntityUid('tok', { personal: true });
+    expect(uid).toBe('prs_a');
+    const url = fetchMock.mock.calls[0][0] as string;
+    expect(url).toMatch(/\/entity\/by-type\/person/);
+  });
+
+  it('routes to company-slug resolution when companySlug is set', async () => {
+    fetchMock.mockResolvedValueOnce(
+      mockResponse(200, { entity: { uid: 'cmp_acme' } }),
+    );
+    const uid = await getEntityUid('tok', { companySlug: 'acme' });
+    expect(uid).toBe('cmp_acme');
+    const url = fetchMock.mock.calls[0][0] as string;
+    expect(url).toMatch(/\/entity\/by-slug\/company\/acme/);
+  });
+
+  it('falls back to membership lookup when neither personal nor slug is set', async () => {
+    fetchMock.mockResolvedValueOnce(
+      mockResponse(200, {
+        memberships: [
+          {
+            companyUid: 'cmp_only',
+            role: 'member',
+            status: 'active',
+            membershipKey: 'k',
+          },
+        ],
+      }),
+    );
+    const uid = await getEntityUid('tok', {});
+    expect(uid).toBe('cmp_only');
+    const url = fetchMock.mock.calls[0][0] as string;
+    expect(url).toMatch(/\/membership\/me/);
+  });
+});

package/src/utils/vault-api.ts

@@ -78,3 +78,46 @@ export async function getCompanyUid(
   }
   return resolveCompanyFromMemberships(token);
 }
+
+interface PersonEntity {
+  uid: string;
+  type: string;
+  createdAt?: string;
+}
+
+// Same selection rule as the backend's `resolveCallerPersonUid`: ascending by
+// createdAt, tie-break by uid ascending. Returns the `prs_*` UID.
+export async function resolveCallerPersonUid(token: string): Promise<string> {
+  const res = await vaultApiFetch({
+    token,
+    path: '/entity/by-type/person',
+  });
+  if (!res.ok) {
+    throw new Error("Failed to fetch person entity — run `hq login` and try again");
+  }
+  const data = (await res.json()) as { entities: PersonEntity[] };
+  const persons = (data.entities ?? []).filter((e) => e.type === 'person');
+  if (persons.length === 0) {
+    throw new Error('No person entity found for the caller. Sign in to HQ once to provision one.');
+  }
+  persons.sort((a, b) => {
+    const ac = a.createdAt ?? '';
+    const bc = b.createdAt ?? '';
+    if (ac !== bc) return ac < bc ? -1 : 1;
+    return a.uid < b.uid ? -1 : 1;
+  });
+  return persons[0].uid;
+}
+
+// Resolves the scope UID (cmp_* or prs_*) for a secrets command. Precedence:
+// `--personal` → caller's canonical person entity; else `--company <slug>` →
+// resolved company UID; else fallback to single active company membership.
+export async function getEntityUid(
+  token: string,
+  opts: { personal?: boolean; companySlug?: string },
+): Promise<string> {
+  if (opts.personal) {
+    return resolveCallerPersonUid(token);
+  }
+  return getCompanyUid(token, opts.companySlug);
+}