@indigoai-us/hq-cli 5.10.1 → 5.12.0

package/src/utils/vault-api.test.ts

@@ -0,0 +1,147 @@
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+
+vi.mock('../sentry.js', () => ({
+  Sentry: { addBreadcrumb: vi.fn() },
+}));
+
+import { Sentry } from '../sentry.js';
+import { getEntityUid, resolveCallerPersonUid, vaultApiFetch } from './vault-api.js';
+
+const fetchMock = vi.fn();
+const originalFetch = globalThis.fetch;
+
+function mockResponse(status: number, body: unknown): Response {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { 'Content-Type': 'application/json' },
+  });
+}
+
+beforeEach(() => {
+  fetchMock.mockReset();
+  globalThis.fetch = fetchMock as unknown as typeof fetch;
+});
+
+afterEach(() => {
+  globalThis.fetch = originalFetch;
+});
+
+describe('resolveCallerPersonUid', () => {
+  it('returns the canonical person uid (oldest createdAt, uid tie-break)', async () => {
+    fetchMock.mockResolvedValueOnce(
+      mockResponse(200, {
+        entities: [
+          { uid: 'prs_b', type: 'person', createdAt: '2026-01-02T00:00:00Z' },
+          { uid: 'prs_a', type: 'person', createdAt: '2026-01-01T00:00:00Z' },
+          { uid: 'prs_c', type: 'person', createdAt: '2026-01-01T00:00:00Z' },
+        ],
+      }),
+    );
+
+    const uid = await resolveCallerPersonUid('tok');
+    expect(uid).toBe('prs_a');
+  });
+
+  it('throws when the caller has no person entity', async () => {
+    fetchMock.mockResolvedValueOnce(mockResponse(200, { entities: [] }));
+    await expect(resolveCallerPersonUid('tok')).rejects.toThrow(
+      /No person entity/,
+    );
+  });
+
+  it('throws when the API returns an error status', async () => {
+    fetchMock.mockResolvedValueOnce(mockResponse(401, { error: 'unauth' }));
+    await expect(resolveCallerPersonUid('tok')).rejects.toThrow(
+      /Failed to fetch person entity/,
+    );
+  });
+
+  it('filters out non-person entries before sorting', async () => {
+    fetchMock.mockResolvedValueOnce(
+      mockResponse(200, {
+        entities: [
+          { uid: 'cmp_a', type: 'company', createdAt: '2025-01-01T00:00:00Z' },
+          { uid: 'prs_a', type: 'person', createdAt: '2026-01-01T00:00:00Z' },
+        ],
+      }),
+    );
+    const uid = await resolveCallerPersonUid('tok');
+    expect(uid).toBe('prs_a');
+  });
+});
+
+describe('getEntityUid', () => {
+  it('routes to person resolution when personal=true', async () => {
+    fetchMock.mockResolvedValueOnce(
+      mockResponse(200, {
+        entities: [
+          { uid: 'prs_a', type: 'person', createdAt: '2026-01-01T00:00:00Z' },
+        ],
+      }),
+    );
+    const uid = await getEntityUid('tok', { personal: true });
+    expect(uid).toBe('prs_a');
+    const url = fetchMock.mock.calls[0][0] as string;
+    expect(url).toMatch(/\/entity\/by-type\/person/);
+  });
+
+  it('routes to company-slug resolution when companySlug is set', async () => {
+    fetchMock.mockResolvedValueOnce(
+      mockResponse(200, { entity: { uid: 'cmp_acme' } }),
+    );
+    const uid = await getEntityUid('tok', { companySlug: 'acme' });
+    expect(uid).toBe('cmp_acme');
+    const url = fetchMock.mock.calls[0][0] as string;
+    expect(url).toMatch(/\/entity\/by-slug\/company\/acme/);
+  });
+
+  it('falls back to membership lookup when neither personal nor slug is set', async () => {
+    fetchMock.mockResolvedValueOnce(
+      mockResponse(200, {
+        memberships: [
+          {
+            companyUid: 'cmp_only',
+            role: 'member',
+            status: 'active',
+            membershipKey: 'k',
+          },
+        ],
+      }),
+    );
+    const uid = await getEntityUid('tok', {});
+    expect(uid).toBe('cmp_only');
+    const url = fetchMock.mock.calls[0][0] as string;
+    expect(url).toMatch(/\/membership\/me/);
+  });
+});
+
+describe('vaultApiFetch breadcrumb URL sanitization', () => {
+  it('redacts query string in request breadcrumb data.url', async () => {
+    fetchMock.mockResolvedValueOnce(mockResponse(200, {}));
+    const addBreadcrumbMock = vi.mocked(Sentry.addBreadcrumb);
+    addBreadcrumbMock.mockClear();
+    await vaultApiFetch({ token: 'tok', path: '/v1/foo', query: { path: 'secrets/my-secret', reveal: 'true' } });
+    const requestCrumb = addBreadcrumbMock.mock.calls[0][0];
+    expect(requestCrumb.data?.url).not.toMatch(/secrets%2F|reveal=true/);
+    expect(requestCrumb.data?.url).toContain('?<redacted>');
+  });
+
+  it('omits query delimiter when there is no query string', async () => {
+    fetchMock.mockResolvedValueOnce(mockResponse(200, {}));
+    const addBreadcrumbMock = vi.mocked(Sentry.addBreadcrumb);
+    addBreadcrumbMock.mockClear();
+    await vaultApiFetch({ token: 'tok', path: '/v1/bar' });
+    const requestCrumb = addBreadcrumbMock.mock.calls[0][0];
+    expect(requestCrumb.data?.url).not.toContain('?');
+  });
+
+  it('redacts query string in non-2xx error breadcrumb data.url', async () => {
+    fetchMock.mockResolvedValueOnce(mockResponse(401, {}));
+    const addBreadcrumbMock = vi.mocked(Sentry.addBreadcrumb);
+    addBreadcrumbMock.mockClear();
+    await vaultApiFetch({ token: 'tok', path: '/v1/baz', query: { action: 'generate-token' } });
+    const errorCrumb = addBreadcrumbMock.mock.calls[1][0];
+    expect(errorCrumb.data?.url).not.toContain('generate-token');
+    expect(errorCrumb.data?.url).toContain('?<redacted>');
+  });
+});

package/src/utils/vault-api.ts

@@ -1,4 +1,5 @@
 import { DEFAULT_VAULT_API_URL } from './cognito-session.js';
+import { Sentry } from '../sentry.js';
 
 export interface VaultApiOptions {
   token: string;
@@ -15,14 +16,31 @@ export async function vaultApiFetch(opts: VaultApiOptions): Promise<Response> {
       url.searchParams.set(k, v);
     }
   }
-  return fetch(url.toString(), {
-    method: opts.method ?? 'GET',
+  const method = opts.method ?? 'GET';
+  const safeUrl = url.search ? `${url.origin}${url.pathname}?<redacted>` : `${url.origin}${url.pathname}`;
+  Sentry.addBreadcrumb({
+    category: "http",
+    message: `${method} ${opts.path}`,
+    level: "info",
+    data: { url: safeUrl, method },
+  });
+  const response = await fetch(url.toString(), {
+    method,
     headers: {
       Authorization: `Bearer ${opts.token}`,
       'Content-Type': 'application/json',
     },
     body: opts.body ? JSON.stringify(opts.body) : undefined,
   });
+  if (!response.ok) {
+    Sentry.addBreadcrumb({
+      category: "http",
+      message: `${method} ${opts.path} → ${response.status}`,
+      level: "warning",
+      data: { url: safeUrl, status: response.status },
+    });
+  }
+  return response;
 }
 
 interface MembershipEntry {
@@ -78,3 +96,46 @@ export async function getCompanyUid(
   }
   return resolveCompanyFromMemberships(token);
 }
+
+interface PersonEntity {
+  uid: string;
+  type: string;
+  createdAt?: string;
+}
+
+// Same selection rule as the backend's `resolveCallerPersonUid`: ascending by
+// createdAt, tie-break by uid ascending. Returns the `prs_*` UID.
+export async function resolveCallerPersonUid(token: string): Promise<string> {
+  const res = await vaultApiFetch({
+    token,
+    path: '/entity/by-type/person',
+  });
+  if (!res.ok) {
+    throw new Error("Failed to fetch person entity — run `hq login` and try again");
+  }
+  const data = (await res.json()) as { entities: PersonEntity[] };
+  const persons = (data.entities ?? []).filter((e) => e.type === 'person');
+  if (persons.length === 0) {
+    throw new Error('No person entity found for the caller. Sign in to HQ once to provision one.');
+  }
+  persons.sort((a, b) => {
+    const ac = a.createdAt ?? '';
+    const bc = b.createdAt ?? '';
+    if (ac !== bc) return ac < bc ? -1 : 1;
+    return a.uid < b.uid ? -1 : 1;
+  });
+  return persons[0].uid;
+}
+
+// Resolves the scope UID (cmp_* or prs_*) for a secrets command. Precedence:
+// `--personal` → caller's canonical person entity; else `--company <slug>` →
+// resolved company UID; else fallback to single active company membership.
+export async function getEntityUid(
+  token: string,
+  opts: { personal?: boolean; companySlug?: string },
+): Promise<string> {
+  if (opts.personal) {
+    return resolveCallerPersonUid(token);
+  }
+  return getCompanyUid(token, opts.companySlug);
+}