@jacebenson/jsn 2.0.3 → 2.1.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jacebenson/jsn",
-  "version": "2.0.3",
+  "version": "2.1.0",
   "description": "A command-line interface for ServiceNow that follows the Unix philosophy: simple, composable, and scriptable.",
   "type": "module",
   "bin": {

package/src/auth.js

@@ -544,3 +544,5 @@ export class AuthManager {
     deleteCredentials(instance);
   }
 }
+
+export { saveCredentials, loadCredentials, askHidden };

package/src/cli.js

@@ -6,6 +6,7 @@ import process from 'node:process';
 import { loadConfig, getEffectiveInstance } from './config.js';
 import { App } from './app.js';
 import { renderHelp } from './help.js';
+import { isMutationCommand } from './mutations.js';
 
 // Command modules
 import { setupCmd } from './commands/setup.js';
@@ -122,6 +123,24 @@ export const cli = yargs(hideBin(process.argv))
       }
     }
 
+    // Read-only profile check — block mutation commands on read-only profiles
+    const activeProfileName = cfg.activeProfile || cfg.defaultProfile;
+    if (activeProfileName && cfg.profiles[activeProfileName] && cfg.profiles[activeProfileName].read_only) {
+      const skipReadOnlyCheck = ['help', 'version', 'setup', 'auth', 'profiles', 'profile', 'skill', undefined].includes(cmd);
+      if (!skipReadOnlyCheck && isMutationCommand(argv)) {
+        process.stderr.write(`\n🔒 Profile "${activeProfileName}" is read-only.\n`);
+        process.stderr.write(`  Mutation commands are disabled on this profile.\n`);
+        const nonReadOnlyProfiles = Object.entries(cfg.profiles || {})
+          .filter(([n, p]) => n !== activeProfileName && !p.read_only)
+          .map(([n]) => n);
+        if (nonReadOnlyProfiles.length > 0) {
+          process.stderr.write(`  Switch to a writable profile:  jsn profiles use ${nonReadOnlyProfiles[0]}\n`);
+        }
+        process.stderr.write('\n');
+        process.exit(1);
+      }
+    }
+
     // Auto-check skill on every command (fire-and-forget, non-blocking)
     const skipSkillCheck = ['help', 'version', 'completion', 'skill'].includes(cmd)
       || process.env.JSN_NO_SKILL_CHECK === '1'

package/src/commands/auth.js

@@ -126,7 +126,7 @@ Find your instance URL in your browser's address bar when logged into ServiceNow
 
             app.config.profiles[profileName] = {
               instance_url: instanceURL,
-              auth_method: 'oauth',
+              auth_method: argv.password ? 'basic' : 'oauth',
               username: username || undefined,
             };
 

package/src/commands/profiles.js

@@ -29,6 +29,11 @@ export function profilesCmd(wrap) {
               alias: 'p',
               describe: 'Password for basic auth',
               type: 'string',
+            })
+            .option('read-only', {
+              describe: 'Mark profile as read-only (blocks mutation commands)',
+              type: 'boolean',
+              default: false,
             }),
           handler: wrap(async (argv, app) => {
             const name = argv.name;
@@ -56,6 +61,11 @@ export function profilesCmd(wrap) {
               profile.username = argv.username;
             }
 
+            // If read-only flag is set, mark the profile
+            if (argv['read-only']) {
+              profile.read_only = true;
+            }
+
             await setProfile(app.config, name, profile);
 
             app.ok({
@@ -80,9 +90,26 @@ export function profilesCmd(wrap) {
                 username: profile.username || '',
                 authenticated: isAuth,
                 default: isDefault,
+                read_only: profile.read_only || false,
               });
             }
-            app.ok({ profiles }, { summary: `${profiles.length} profile(s)` });
+
+            // Build context-aware breadcrumb: suggest switching to a non-active profile
+            const breadcrumbs = [];
+            if (profiles.length > 0) {
+              const activeName = app.config.activeProfile || app.config.defaultProfile;
+              const nonActiveProfiles = profiles.filter(p => p.name !== activeName);
+              if (nonActiveProfiles.length > 0) {
+                const suggestName = nonActiveProfiles[0].name;
+                breadcrumbs.push({
+                  action: 'switch',
+                  cmd: `jsn profiles use ${suggestName}`,
+                  description: 'Switch to a different profile',
+                });
+              }
+            }
+
+            app.ok({ profiles }, { summary: `${profiles.length} profile(s)`, breadcrumbs });
           }),
         })
         .command({
@@ -108,7 +135,8 @@ export function profilesCmd(wrap) {
               throw new Error('No profiles configured');
             }
             const profile = app.config.profiles[name];
-            app.ok({ name, ...profile }, { summary: `Profile: ${name}` });
+            const readOnlyNote = profile.read_only ? ' [READ-ONLY]' : '';
+            app.ok({ name, ...profile }, { summary: `Profile: ${name}${readOnlyNote}` });
           }),
         })
         .command({

package/src/commands/setup.js

@@ -1,10 +1,19 @@
 import readline from 'node:readline';
 import { getEffectiveInstance, normalizeInstanceURL, saveConfig, setProfile } from '../config.js';
+import { saveCredentials, loadCredentials, askHidden } from '../auth.js';
 
 export function setupCmd(wrap) {
   return {
     command: 'setup',
     describe: 'Interactive first-time setup',
+    builder: (yargs) => {
+      return yargs
+        .option('read-only', {
+          describe: 'Mark profile as read-only (blocks mutation commands)',
+          type: 'boolean',
+          default: false,
+        });
+    },
     handler: wrap(async (_argv, app) => {
       const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
       const ask = (q) => new Promise((resolve) => rl.question(q, resolve));
@@ -20,16 +29,43 @@ export function setupCmd(wrap) {
       console.log(`Instance: ${instance}`);
 
       const profileName = await ask('Profile name (default): ') || 'default';
-      await setProfile(app.config, profileName, { instance_url: instance });
+      const profile = { instance_url: instance };
+      if (_argv['read-only']) {
+        profile.read_only = true;
+      }
+
+      const authMethod = await ask('Authentication method (OAuth/Basic) [OAuth]: ');
+      const useBasic = authMethod.toLowerCase().startsWith('b');
+
+      if (useBasic) {
+        const existing = loadCredentials(instance);
+        if (existing && existing.auth_method === 'basic') {
+          console.log(`Using existing credentials for ${instance}`);
+        } else {
+          const username = await ask('Username: ');
+          rl.close(); // Close outer readline before askHidden creates its own
+          const password = await askHidden('Password: ');
+          saveCredentials(instance, { auth_method: 'basic', username, password });
+          profile.username = username;
+          console.log('Basic auth credentials saved');
+        }
+        profile.auth_method = 'basic';
+      } else {
+        profile.auth_method = 'oauth';
+      }
+
+      await setProfile(app.config, profileName, profile);
       // Set as active profile so subsequent commands know which instance to use
       app.config.activeProfile = profileName;
       app.config.defaultProfile = profileName;
       saveConfig(app.config);
 
-      const loginNow = await ask('Login now? [Y/n]: ');
-      if (!loginNow || loginNow.toLowerCase() !== 'n') {
-        await app.auth.login(instance);
-        console.log('Login successful!');
+      if (!useBasic) {
+        const loginNow = await ask('Login now? [Y/n]: ');
+        if (!loginNow || loginNow.toLowerCase() !== 'n') {
+          await app.auth.login(instance);
+          console.log('Login successful!');
+        }
       }
 
       rl.close();

package/src/mutations.js

@@ -0,0 +1,52 @@
+// Centralized mutation command registry
+// Used by the read-only profile middleware to block mutation commands.
+// Each entry is a command path array matching argv._ tokens.
+
+export const MUTATION_COMMANDS = [
+  // Incidents
+  ['incidents', 'create'],
+  ['incidents', 'update'],
+  ['incidents', 'delete'],
+  // Changes
+  ['changes', 'create'],
+  ['changes', 'update'],
+  ['changes', 'delete'],
+  // Records
+  ['records', 'create'],
+  ['records', 'update'],
+  ['records', 'delete'],
+  // Requests
+  ['requests', 'create'],
+  ['requests', 'update'],
+  ['requests', 'delete'],
+  // Tasks
+  ['tasks', 'create'],
+  ['tasks', 'update'],
+  ['tasks', 'delete'],
+  // Dev
+  ['dev', 'eval'],
+  ['dev', 'updatesets', 'set'],
+  ['dev', 'updatesets', 'create'],
+  ['dev', 'scopes', 'set'],
+];
+
+/**
+ * Check if the parsed argv matches any mutation command pattern.
+ * @param {object} argv — yargs parsed argv with `_` array
+ * @returns {boolean}
+ */
+export function isMutationCommand(argv) {
+  const cmd = argv._ || [];
+  for (const pattern of MUTATION_COMMANDS) {
+    if (pattern.length !== cmd.length) continue;
+    let match = true;
+    for (let i = 0; i < pattern.length; i++) {
+      if (pattern[i] !== cmd[i]) {
+        match = false;
+        break;
+      }
+    }
+    if (match) return true;
+  }
+  return false;
+}

package/src/output.js

@@ -192,12 +192,15 @@ export class OutputWriter {
             staleStr = ` (${p.days_since_last_seen}d ago — may have been released)`;
           }
 
+          // Show lock icon for read-only profiles
+          const lockIcon = p.read_only ? ' 🔒' : '';
+
           if (p.name) {
-            this.writer.write(`${prefix}${authIcon} ${p.name} — ${p.instance}${verifiedStr}${staleStr}\n`);
+            this.writer.write(`${prefix}${authIcon} ${p.name} — ${p.instance}${lockIcon}${verifiedStr}${staleStr}\n`);
           } else if (p.username) {
-            this.writer.write(`${prefix}${authIcon} ${p.instance} (as ${p.username})${verifiedStr}${staleStr}\n`);
+            this.writer.write(`${prefix}${authIcon} ${p.instance} (as ${p.username})${lockIcon}${verifiedStr}${staleStr}\n`);
           } else {
-            this.writer.write(`${prefix}${authIcon} ${p.instance}${verifiedStr}${staleStr}\n`);
+            this.writer.write(`${prefix}${authIcon} ${p.instance}${lockIcon}${verifiedStr}${staleStr}\n`);
           }
         }
       }