@indigoai-us/hq-cli 5.51.0 → 5.53.0

package/src/commands/members.test.ts

@@ -34,6 +34,7 @@ import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { getCompanyUid } from "../utils/vault-api.js";
 import {
   InviteHttpError,
+  changeMemberRole,
   detectTarget,
   formatInviteHttpError,
   getCallerPersonUid,
@@ -998,6 +999,121 @@ describe("registerMembersCommand set-role", () => {
   });
 });
 
+// ---------------------------------------------------------------------------
+// changeMemberRole + the unified `promote` command (alias `set-role`)
+// ---------------------------------------------------------------------------
+
+describe("changeMemberRole", () => {
+  it("rejects an invalid role WITHOUT making a network call", async () => {
+    await expect(
+      changeMemberRole(
+        "test-token",
+        "cmp_acme",
+        "prs_x#cmp_acme",
+        "superuser" as never,
+      ),
+    ).rejects.toThrow("must be one of owner, admin, member, guest");
+    expect(fetchSpy).not.toHaveBeenCalled();
+  });
+
+  it("accepts the full role set and POSTs to /membership/role", async () => {
+    fetchSpy.mockResolvedValueOnce(jsonResponse(200, {}));
+    await changeMemberRole("test-token", "cmp_acme", "prs_x#cmp_acme", "guest");
+    const call = fetchSpy.mock.calls[0];
+    expect(String(call[0])).toMatch(/\/membership\/role$/);
+    const body = JSON.parse((call[1]?.body as string) ?? "{}");
+    expect(body).toEqual({
+      companyUid: "cmp_acme",
+      membershipKey: "prs_x#cmp_acme",
+      newRole: "guest",
+    });
+  });
+});
+
+describe("registerMembersCommand promote", () => {
+  it("resolves an email target and promotes to a full-set role the old set-role couldn't (admin)", async () => {
+    fetchSpy.mockResolvedValueOnce(jsonResponse(200, {}));
+    const logSpy = vi.spyOn(console, "log").mockImplementation(() => undefined);
+
+    await buildMembersProgram().parseAsync(
+      ["members", "--company", "acme", "promote", "alice@example.com", "admin"],
+      { from: "user" },
+    );
+
+    const call = fetchSpy.mock.calls[0];
+    expect(String(call[0])).toMatch(/\/membership\/role$/);
+    const body = JSON.parse((call[1]?.body as string) ?? "{}");
+    expect(body).toEqual({
+      companyUid: "cmp_acme",
+      membershipKey: "email:alice@example.com#cmp_acme",
+      newRole: "admin",
+    });
+    expect(logSpy).toHaveBeenCalledWith(
+      expect.stringContaining("Updated role for 'alice@example.com' to admin"),
+    );
+  });
+
+  it("forwards a personUid target and the guest role (beyond set-role's admin|member cap)", async () => {
+    fetchSpy.mockResolvedValueOnce(jsonResponse(200, {}));
+    vi.spyOn(console, "log").mockImplementation(() => undefined);
+
+    await buildMembersProgram().parseAsync(
+      ["members", "--company", "acme", "promote", "prs_bob", "guest"],
+      { from: "user" },
+    );
+
+    const body = JSON.parse(
+      (fetchSpy.mock.calls[0]?.[1]?.body as string) ?? "{}",
+    );
+    expect(body).toEqual({
+      companyUid: "cmp_acme",
+      membershipKey: "prs_bob#cmp_acme",
+      newRole: "guest",
+    });
+  });
+
+  it("rejects an invalid role at the CLI and exits non-zero without a network call", async () => {
+    const errSpy = vi.spyOn(console, "error").mockImplementation(() => undefined);
+    vi.spyOn(process, "exit").mockImplementation(((code?: number) => {
+      throw new Error(`__EXIT__:${code ?? 0}`);
+    }) as never);
+
+    await expect(
+      buildMembersProgram().parseAsync(
+        ["members", "--company", "acme", "promote", "alice@example.com", "wizard"],
+        { from: "user" },
+      ),
+    ).rejects.toThrow("__EXIT__:1");
+
+    expect(errSpy).toHaveBeenCalledWith(
+      expect.stringContaining("must be one of owner, admin, member, guest"),
+    );
+    expect(fetchSpy).not.toHaveBeenCalled();
+  });
+
+  it("surfaces a backend 403 verbatim (server-enforced authorization)", async () => {
+    fetchSpy.mockResolvedValueOnce(
+      jsonResponse(403, { error: "Only an owner may promote a member to owner" }),
+    );
+    const errSpy = vi.spyOn(console, "error").mockImplementation(() => undefined);
+    vi.spyOn(console, "log").mockImplementation(() => undefined);
+    vi.spyOn(process, "exit").mockImplementation(((code?: number) => {
+      throw new Error(`__EXIT__:${code ?? 0}`);
+    }) as never);
+
+    await expect(
+      buildMembersProgram().parseAsync(
+        ["members", "--company", "acme", "promote", "prs_bob", "owner"],
+        { from: "user" },
+      ),
+    ).rejects.toThrow("__EXIT__:1");
+
+    expect(errSpy).toHaveBeenCalledWith(
+      expect.stringContaining("Only an owner may promote a member to owner"),
+    );
+  });
+});
+
 // ---------------------------------------------------------------------------
 // resolveRevokeTargetToMembershipKey
 // ---------------------------------------------------------------------------

package/src/commands/members.ts

@@ -6,10 +6,8 @@ import { vaultApiFetch, getCompanyUid } from "../utils/vault-api.js";
 const EMAIL_PATTERN = /^[^\s]+@[^\s]+$/;
 const PERSON_UID_PATTERN = /^prs_[A-Za-z0-9_-]+$/;
 export const VALID_ROLES = new Set(["owner", "admin", "member", "guest"]);
-const VALID_MEMBER_SET_ROLES = new Set(["admin", "member"]);
 
 export type Role = "owner" | "admin" | "member" | "guest";
-type MemberSetRole = "admin" | "member";
 
 export interface PendingInvite {
   membershipKey: string;
@@ -498,15 +496,24 @@ export async function revokeInvite(
   }
 }
 
-async function setMemberRole(
+/**
+ * Change a member's role via `POST /membership/role`, accepting the FULL role
+ * set (owner|admin|member|guest). This is a GENERAL role change — it can promote
+ * OR demote. Authorization (owner-or-admin `changeRoles`, owner-only
+ * promote-to-owner / change-an-owner) is enforced SERVER-side; this function
+ * only validates the role string locally and surfaces the server's error.
+ * Role string is validated BEFORE any network call so callers/tests can rely on
+ * a synchronous-shaped rejection for a bad role.
+ */
+export async function changeMemberRole(
   token: string,
   companyUid: string,
   membershipKey: string,
-  newRole: MemberSetRole,
+  newRole: Role,
 ): Promise<void> {
-  if (!VALID_MEMBER_SET_ROLES.has(newRole)) {
+  if (!VALID_ROLES.has(newRole)) {
     throw new Error(
-      `Invalid role '${newRole}': must be one of admin, member`,
+      `Invalid role '${newRole}': must be one of owner, admin, member, guest`,
     );
   }
 
@@ -532,23 +539,41 @@ export function registerMembersCommand(program: Command): void {
     .description("Manage company memberships and invites")
     .option("--company <slug>", "Company slug (resolves to companyUid)");
 
+  // Canonical role-change command. `promote` is the discoverable verb users
+  // reach for; `set-role` is kept as an alias for the older name. The route is a
+  // GENERAL role change, so the help text and success message are honest that it
+  // can demote as well as promote. Authorization is enforced server-side.
   members
-    .command("set-role <membershipKey> <role>")
-    .description("Change a member or agent role to admin or member")
-    .action(async (membershipKey: string, role: string) => {
+    .command("promote <target> <newRole>")
+    .alias("set-role")
+    .description(
+      "Change a member's role (owner|admin|member|guest) — promotes OR demotes. " +
+        "<target> may be an email, a prs_ personUid, or a full membership key. " +
+        "Owner-or-admin only; setting a target to owner (or changing an owner) is owner-only. Server-enforced.",
+    )
+    .action(async (target: string, newRole: string) => {
       try {
+        const role = newRole.trim().toLowerCase();
+        if (!VALID_ROLES.has(role)) {
+          console.error(
+            chalk.red(
+              `Invalid role '${newRole}': must be one of owner, admin, member, guest`,
+            ),
+          );
+          process.exit(1);
+        }
+
         const token = await ensureCognitoToken();
         const companySlug = members.opts().company as string | undefined;
         const companyUid = await getCompanyUid(token, companySlug);
-
-        await setMemberRole(
-          token,
+        const membershipKey = resolveRevokeTargetToMembershipKey(
+          target,
           companyUid,
-          membershipKey,
-          role as MemberSetRole,
         );
+
+        await changeMemberRole(token, companyUid, membershipKey, role as Role);
         console.log(
-          chalk.green(`Updated role for '${membershipKey}' to ${role}`),
+          chalk.green(`Updated role for '${target}' to ${role}`),
         );
       } catch (err) {
         if (err instanceof InviteHttpError) {

package/src/index.ts

@@ -48,6 +48,8 @@ import { registerSignalsCommand } from "./commands/signals.js";
 import { registerReindexCommand } from "./commands/reindex.js";
 import { registerRescueCommand } from "./commands/rescue.js";
 import { registerMcpCommand } from "./commands/mcp-status.js";
+import { registerCrmCommand } from "./commands/crm.js";
+import { registerCompanyCommand } from "./commands/company.js";
 import { sanitizeArgv } from "./utils/feedback-diagnostics.js";
 import { environmentalFsErrorMessage } from "./utils/environmental-error.js";
 import { isEpipe } from "./utils/epipe.js";
@@ -214,6 +216,15 @@ registerRescueCommand(program);
 // off the configs, NOT linkStatus), with secret-redacted output + `--json`.
 registerMcpCommand(program);
 
+// Native CRM entity upsert (subcommand group — `hq crm entity upsert`). Wraps
+// POST /crm/entities (the ontology write gate) so an authenticated company
+// member can create/update canonical CRM entities in the company vault.
+registerCrmCommand(program);
+
+// Company settings (subcommand group — `hq company settings set`). Owner-only
+// toggles for crmEnabled / ontologyEnabled via PUT /company-settings.
+registerCompanyCommand(program);
+
 (async () => {
   try {
     Sentry.addBreadcrumb({