@indigoai-us/hq-cli 5.53.1 → 5.54.0

package/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 ## [Unreleased]
 
+## [5.54.0]
+
+### Added
+
+- **`hq secrets share/unshare … @all` — share a secret with the entire company.**
+  `--with @all` (share) and `--from @all` (unshare) now grant or revoke a
+  company-wide secret ACL — every active member of the company receives the
+  permission — instead of being refused. Output reads `@all (entire company)`.
+  Backed by vault-service company-wide ACL support; secrets with no explicit ACL
+  remain open to all members as before, so `@all` matters for re-opening a
+  restricted secret to the whole company.
+
 ## [5.53.1]
 
 ### Changed

package/dist/commands/secrets.js

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="96461f1a-6d5b-5dc0-b00a-0a9fa30a0dad")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="1dfcad18-3626-5c68-8b4c-0c147e896113")}catch(e){}}();
 import chalk from "chalk";
 import * as readline from "node:readline";
 import { spawn } from "node:child_process";
@@ -7,7 +7,7 @@ import * as nodePath from "node:path";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
 import { DEFAULT_SECRETS_CACHE_TTL_MS, readCache, writeCache, removeCacheEntry, clearAllCache, } from "../utils/secrets-cache.js";
 import { computeSha256 } from "../utils/integrity.js";
-import { SECRET_NAME_PATTERN, GROUP_ID_PATTERN } from "./_patterns.js";
+import { SECRET_NAME_PATTERN, GROUP_ID_PATTERN, EMAIL_PATTERN } from "./_patterns.js";
 import { describeSecretsScope, formatSecretSaved, formatSecretsListEmpty, formatSecretsListHeader, } from "./secrets-scope.js";
 import { vaultApiFetch, getCompanyUid, getEntityUid, } from "../utils/vault-api.js";
 export { vaultApiFetch, getCompanyUid, getEntityUid };
@@ -131,6 +131,27 @@ function promptSecretInteractively() {
 // large --only list is chunked client-side rather than 400'd whole by the
 // server (the legacy per-key GET path had no such cap).
 const MAX_BATCH_NAMES = 100;
+function parseSecretAclPrincipal(principal) {
+    const p = principal.trim();
+    if (p === "@all") {
+        // Company-wide grant: every active member of the company. The server
+        // carries no specific grantee id for this axis, so granteeId is empty.
+        return { granteeType: "company-wide", granteeId: "" };
+    }
+    if (EMAIL_PATTERN.test(p)) {
+        return { granteeType: "email", granteeId: p.toLowerCase() };
+    }
+    if (GROUP_ID_PATTERN.test(p)) {
+        return { granteeType: "group", granteeId: p };
+    }
+    console.error(chalk.red(`Invalid principal '${principal}': must be '@all', an email address, or a group id matching grp_<alphanumeric, underscore, hyphen>`));
+    return null;
+}
+function describeSecretAclPrincipal(principal) {
+    return principal.granteeType === "company-wide"
+        ? "@all (entire company)"
+        : principal.granteeId;
+}
 function normalizeSecretTier(tier) {
     return tier === "sensitive" || tier === "nuclear" ? tier : "standard";
 }
@@ -960,8 +981,8 @@ export function registerSecretsCommand(program) {
     });
     secrets
         .command("share <path>")
-        .description("Share a secret with a person or group")
-        .requiredOption("--with <principal>", "Email address or group id to share with")
+        .description("Share a secret with an email address, group, or the entire company (@all)")
+        .requiredOption("--with <principal>", "Email address, group id, or @all (entire company) to share with")
         .requiredOption("--permission <level>", "Permission level: read | write | admin")
         .action(async (path, opts) => {
         try {
@@ -974,20 +995,22 @@ export function registerSecretsCommand(program) {
                 console.error(chalk.red(`Invalid permission '${opts.permission}': must be one of read, write, admin`));
                 process.exit(1);
             }
-            const isEmail = /^[^\s]+@[^\s]+$/.test(opts.with);
-            if (!isEmail && !GROUP_ID_PATTERN.test(opts.with)) {
-                console.error(chalk.red(`Invalid principal '${opts.with}': must be an email address or a group id matching grp_<alphanumeric>`));
+            const principal = parseSecretAclPrincipal(opts.with);
+            if (!principal) {
                 process.exit(1);
             }
-            const granteeType = isEmail ? "email" : "group";
-            const granteeId = opts.with;
             const token = await ensureCognitoToken();
             const companyUid = await getEntityUid(token, scopeOpts(secrets.opts()));
             const res = await vaultApiFetch({
                 token,
                 path: `/secrets/${encodeURIComponent(companyUid)}/acl/grant`,
                 method: "POST",
-                body: { path, granteeType, granteeId, permission: opts.permission },
+                body: {
+                    path,
+                    granteeType: principal.granteeType,
+                    granteeId: principal.granteeId,
+                    permission: opts.permission,
+                },
             });
             if (!res.ok) {
                 const body = await res.json().catch(() => ({}));
@@ -1011,7 +1034,7 @@ export function registerSecretsCommand(program) {
                 }
                 process.exit(1);
             }
-            console.log(chalk.green(`Shared '${path}' with ${opts.with} (${opts.permission})`));
+            console.log(chalk.green(`Shared '${path}' with ${describeSecretAclPrincipal(principal)} (${opts.permission})`));
         }
         catch (err) {
             console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
@@ -1021,7 +1044,7 @@ export function registerSecretsCommand(program) {
     secrets
         .command("unshare <path>")
         .description("Remove a grant from a secret")
-        .requiredOption("--from <principal>", "Email address or group id to remove")
+        .requiredOption("--from <principal>", "Email address, group id, or @all (entire company) to remove")
         .action(async (path, opts) => {
         try {
             rejectIfPersonal(secrets.opts(), "unshare");
@@ -1029,20 +1052,21 @@ export function registerSecretsCommand(program) {
                 console.error(chalk.red(`Invalid secret path '${path}': must match ^[A-Z][A-Z0-9_]*(/[A-Z][A-Z0-9_]+)*$ (e.g. MY_KEY or PROD/DB_PASSWORD)`));
                 process.exit(1);
             }
-            const isEmailFrom = /^[^\s]+@[^\s]+$/.test(opts.from);
-            if (!isEmailFrom && !GROUP_ID_PATTERN.test(opts.from)) {
-                console.error(chalk.red(`Invalid principal '${opts.from}': must be an email address or a group id matching grp_<alphanumeric>`));
+            const principal = parseSecretAclPrincipal(opts.from);
+            if (!principal) {
                 process.exit(1);
             }
-            const granteeType = isEmailFrom ? "email" : "group";
-            const granteeId = opts.from;
             const token = await ensureCognitoToken();
             const companyUid = await getEntityUid(token, scopeOpts(secrets.opts()));
             const res = await vaultApiFetch({
                 token,
                 path: `/secrets/${encodeURIComponent(companyUid)}/acl/revoke`,
                 method: "POST",
-                body: { path, granteeType, granteeId },
+                body: {
+                    path,
+                    granteeType: principal.granteeType,
+                    granteeId: principal.granteeId,
+                },
             });
             if (!res.ok) {
                 const body = await res.json().catch(() => ({}));
@@ -1053,7 +1077,7 @@ export function registerSecretsCommand(program) {
                     console.error(chalk.red("Not authorized to modify this secret's ACL"));
                 }
                 else if (res.status === 404) {
-                    console.log(chalk.green(`Grant already absent for '${path}' / ${opts.from}`));
+                    console.log(chalk.green(`Grant already absent for '${path}' / ${describeSecretAclPrincipal(principal)}`));
                     return;
                 }
                 else if (res.status >= 500) {
@@ -1064,7 +1088,7 @@ export function registerSecretsCommand(program) {
                 }
                 process.exit(1);
             }
-            console.log(chalk.green(`Removed grant for ${opts.from} on '${path}'`));
+            console.log(chalk.green(`Removed grant for ${describeSecretAclPrincipal(principal)} on '${path}'`));
         }
         catch (err) {
             console.error(chalk.red("Error:"), err instanceof Error ? err.message : String(err));
@@ -1163,4 +1187,4 @@ export function registerSecretsCommand(program) {
     });
 }
 //# sourceMappingURL=secrets.js.map
-//# debugId=96461f1a-6d5b-5dc0-b00a-0a9fa30a0dad
+//# debugId=1dfcad18-3626-5c68-8b4c-0c147e896113

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.53.1",
+  "version": "5.54.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {

package/src/commands/secrets.test.ts

@@ -273,6 +273,92 @@ describe("secrets generate-link", () => {
   });
 });
 
+describe("secrets share ACL principals", () => {
+  it("grants a secret to a group principal", async () => {
+    vi.mocked(vaultApiFetch).mockResolvedValueOnce(jsonRes({ ok: true }));
+
+    const program = buildProgram();
+    await program.parseAsync([
+      "node",
+      "hq",
+      "secrets",
+      "share",
+      "MY_KEY",
+      "--with",
+      "grp_ops",
+      "--permission",
+      "read",
+    ]);
+
+    expect(vaultApiFetch).toHaveBeenCalledWith({
+      token: "test-token",
+      path: "/secrets/prs_alice/acl/grant",
+      method: "POST",
+      body: {
+        path: "MY_KEY",
+        granteeType: "group",
+        granteeId: "grp_ops",
+        permission: "read",
+      },
+    });
+  });
+
+  it("grants a secret company-wide with @all", async () => {
+    vi.mocked(vaultApiFetch).mockResolvedValueOnce(jsonRes({ ok: true }));
+
+    const program = buildProgram();
+    await program.parseAsync([
+      "node",
+      "hq",
+      "secrets",
+      "share",
+      "MY_KEY",
+      "--with",
+      "@all",
+      "--permission",
+      "read",
+    ]);
+
+    expect(vaultApiFetch).toHaveBeenCalledWith({
+      token: "test-token",
+      path: "/secrets/prs_alice/acl/grant",
+      method: "POST",
+      body: {
+        path: "MY_KEY",
+        granteeType: "company-wide",
+        granteeId: "",
+        permission: "read",
+      },
+    });
+  });
+
+  it("revokes a company-wide grant with @all", async () => {
+    vi.mocked(vaultApiFetch).mockResolvedValueOnce(jsonRes({ ok: true }));
+
+    const program = buildProgram();
+    await program.parseAsync([
+      "node",
+      "hq",
+      "secrets",
+      "unshare",
+      "MY_KEY",
+      "--from",
+      "@all",
+    ]);
+
+    expect(vaultApiFetch).toHaveBeenCalledWith({
+      token: "test-token",
+      path: "/secrets/prs_alice/acl/revoke",
+      method: "POST",
+      body: {
+        path: "MY_KEY",
+        granteeType: "company-wide",
+        granteeId: "",
+      },
+    });
+  });
+});
+
 // HQ-4H — `hq secrets exec`/`env` load secrets through the BATCH-LOAD endpoint
 // (`POST /secrets/{uid}/load`), which returns 200 + per-name `errors[]` and
 // never fires the server's "Secret not found" Sentry warning. The old per-key

package/src/commands/secrets.ts

@@ -12,7 +12,7 @@ import {
   clearAllCache,
 } from "../utils/secrets-cache.js";
 import { computeSha256 } from "../utils/integrity.js";
-import { SECRET_NAME_PATTERN, GROUP_ID_PATTERN } from "./_patterns.js";
+import { SECRET_NAME_PATTERN, GROUP_ID_PATTERN, EMAIL_PATTERN } from "./_patterns.js";
 import {
   describeSecretsScope,
   formatSecretSaved,
@@ -240,6 +240,40 @@ interface SecretPolicyResponse {
   scripts?: SecretPolicyScript[];
 }
 
+interface SecretAclPrincipal {
+  granteeType: "email" | "group" | "company-wide";
+  granteeId: string;
+}
+
+function parseSecretAclPrincipal(
+  principal: string,
+): SecretAclPrincipal | null {
+  const p = principal.trim();
+  if (p === "@all") {
+    // Company-wide grant: every active member of the company. The server
+    // carries no specific grantee id for this axis, so granteeId is empty.
+    return { granteeType: "company-wide", granteeId: "" };
+  }
+  if (EMAIL_PATTERN.test(p)) {
+    return { granteeType: "email", granteeId: p.toLowerCase() };
+  }
+  if (GROUP_ID_PATTERN.test(p)) {
+    return { granteeType: "group", granteeId: p };
+  }
+  console.error(
+    chalk.red(
+      `Invalid principal '${principal}': must be '@all', an email address, or a group id matching grp_<alphanumeric, underscore, hyphen>`,
+    ),
+  );
+  return null;
+}
+
+function describeSecretAclPrincipal(principal: SecretAclPrincipal): string {
+  return principal.granteeType === "company-wide"
+    ? "@all (entire company)"
+    : principal.granteeId;
+}
+
 function normalizeSecretTier(tier?: string): SecretTier {
   return tier === "sensitive" || tier === "nuclear" ? tier : "standard";
 }
@@ -1365,8 +1399,8 @@ export function registerSecretsCommand(program: Command): void {
 
   secrets
     .command("share <path>")
-    .description("Share a secret with a person or group")
-    .requiredOption("--with <principal>", "Email address or group id to share with")
+    .description("Share a secret with an email address, group, or the entire company (@all)")
+    .requiredOption("--with <principal>", "Email address, group id, or @all (entire company) to share with")
     .requiredOption("--permission <level>", "Permission level: read | write | admin")
     .action(async (path: string, opts: { with: string; permission: string }) => {
       try {
@@ -1382,13 +1416,10 @@ export function registerSecretsCommand(program: Command): void {
           process.exit(1);
         }
 
-        const isEmail = /^[^\s]+@[^\s]+$/.test(opts.with);
-        if (!isEmail && !GROUP_ID_PATTERN.test(opts.with)) {
-          console.error(chalk.red(`Invalid principal '${opts.with}': must be an email address or a group id matching grp_<alphanumeric>`));
+        const principal = parseSecretAclPrincipal(opts.with);
+        if (!principal) {
           process.exit(1);
         }
-        const granteeType = isEmail ? "email" : "group";
-        const granteeId = opts.with;
 
         const token = await ensureCognitoToken();
         const companyUid = await getEntityUid(
@@ -1400,7 +1431,12 @@ export function registerSecretsCommand(program: Command): void {
           token,
           path: `/secrets/${encodeURIComponent(companyUid)}/acl/grant`,
           method: "POST",
-          body: { path, granteeType, granteeId, permission: opts.permission },
+          body: {
+            path,
+            granteeType: principal.granteeType,
+            granteeId: principal.granteeId,
+            permission: opts.permission,
+          },
         });
 
         if (!res.ok) {
@@ -1421,7 +1457,7 @@ export function registerSecretsCommand(program: Command): void {
           process.exit(1);
         }
 
-        console.log(chalk.green(`Shared '${path}' with ${opts.with} (${opts.permission})`));
+        console.log(chalk.green(`Shared '${path}' with ${describeSecretAclPrincipal(principal)} (${opts.permission})`));
       } catch (err) {
         console.error(
           chalk.red("Error:"),
@@ -1434,7 +1470,7 @@ export function registerSecretsCommand(program: Command): void {
   secrets
     .command("unshare <path>")
     .description("Remove a grant from a secret")
-    .requiredOption("--from <principal>", "Email address or group id to remove")
+    .requiredOption("--from <principal>", "Email address, group id, or @all (entire company) to remove")
     .action(async (path: string, opts: { from: string }) => {
       try {
         rejectIfPersonal(secrets.opts(), "unshare");
@@ -1444,13 +1480,10 @@ export function registerSecretsCommand(program: Command): void {
           process.exit(1);
         }
 
-        const isEmailFrom = /^[^\s]+@[^\s]+$/.test(opts.from);
-        if (!isEmailFrom && !GROUP_ID_PATTERN.test(opts.from)) {
-          console.error(chalk.red(`Invalid principal '${opts.from}': must be an email address or a group id matching grp_<alphanumeric>`));
+        const principal = parseSecretAclPrincipal(opts.from);
+        if (!principal) {
           process.exit(1);
         }
-        const granteeType = isEmailFrom ? "email" : "group";
-        const granteeId = opts.from;
 
         const token = await ensureCognitoToken();
         const companyUid = await getEntityUid(
@@ -1462,7 +1495,11 @@ export function registerSecretsCommand(program: Command): void {
           token,
           path: `/secrets/${encodeURIComponent(companyUid)}/acl/revoke`,
           method: "POST",
-          body: { path, granteeType, granteeId },
+          body: {
+            path,
+            granteeType: principal.granteeType,
+            granteeId: principal.granteeId,
+          },
         });
 
         if (!res.ok) {
@@ -1472,7 +1509,7 @@ export function registerSecretsCommand(program: Command): void {
           } else if (res.status === 403) {
             console.error(chalk.red("Not authorized to modify this secret's ACL"));
           } else if (res.status === 404) {
-            console.log(chalk.green(`Grant already absent for '${path}' / ${opts.from}`));
+            console.log(chalk.green(`Grant already absent for '${path}' / ${describeSecretAclPrincipal(principal)}`));
             return;
           } else if (res.status >= 500) {
             console.error(chalk.red(`Server error: ${body.error ?? res.statusText}`));
@@ -1482,7 +1519,7 @@ export function registerSecretsCommand(program: Command): void {
           process.exit(1);
         }
 
-        console.log(chalk.green(`Removed grant for ${opts.from} on '${path}'`));
+        console.log(chalk.green(`Removed grant for ${describeSecretAclPrincipal(principal)} on '${path}'`));
       } catch (err) {
         console.error(
           chalk.red("Error:"),