@jacebenson/jsn 4.3.7 → 4.3.8-dev.47

package/src/commands/graphql.js

@@ -0,0 +1,95 @@
+import fs from 'node:fs';
+import { declareCapabilities } from '../capabilities.js';
+
+// GraphQL documents may contain mutations. Gate the whole command so normal
+// instance/auth and read-only protections apply without attempting AST parsing.
+declareCapabilities('graphql', { mutationSubcommands: [''] });
+
+function readStdin() {
+  return new Promise((resolve, reject) => {
+    let data = '';
+    process.stdin.setEncoding('utf-8');
+    process.stdin.on('data', (chunk) => { data += chunk; });
+    process.stdin.on('end', () => resolve(data));
+    process.stdin.on('error', reject);
+  });
+}
+
+export async function resolveGraphQLInput(argv) {
+  const sources = [
+    argv.document !== undefined,
+    argv.query !== undefined,
+    argv.queryFile !== undefined,
+    argv.stdin === true,
+  ].filter(Boolean).length;
+  if (sources !== 1) {
+    throw new Error('Provide exactly one GraphQL document via positional document, --query, --query-file, or --stdin');
+  }
+
+  let query;
+  if (argv.document !== undefined) query = argv.document;
+  else if (argv.query !== undefined) query = argv.query;
+  else if (argv.queryFile !== undefined) query = fs.readFileSync(argv.queryFile, 'utf-8');
+  else query = await readStdin();
+
+  query = String(query || '').trim();
+  if (!query) throw new Error('GraphQL document must not be empty');
+  return query;
+}
+
+export function parseGraphQLVariables(value) {
+  if (value === undefined) return {};
+  let variables;
+  try {
+    variables = JSON.parse(value);
+  } catch {
+    throw new Error('--variables must be valid JSON');
+  }
+  if (!variables || typeof variables !== 'object' || Array.isArray(variables)) {
+    throw new Error('--variables must be a JSON object');
+  }
+  return variables;
+}
+
+export function graphqlCmd(wrap) {
+  return {
+    command: 'graphql [document]',
+    describe: 'Execute a GraphQL document against ServiceNow Now GraphQL',
+    builder: (yargs) => yargs
+      .positional('document', {
+        describe: 'GraphQL document string',
+        type: 'string',
+      })
+      .option('query', {
+        type: 'string',
+        describe: 'GraphQL document string (alternative to positional)',
+      })
+      .option('query-file', {
+        type: 'string',
+        describe: 'Read the GraphQL document from a file',
+      })
+      .option('variables', {
+        type: 'string',
+        describe: 'GraphQL variables as a JSON object',
+      })
+      .option('stdin', {
+        type: 'boolean',
+        describe: 'Read the GraphQL document from stdin',
+      }),
+    handler: wrap(async (argv, app) => {
+      const query = await resolveGraphQLInput(argv);
+      const variables = parseGraphQLVariables(argv.variables);
+      const endpoint = `${app.getEffectiveInstance()}/api/now/graphql`;
+      const result = await app.sdk.request(endpoint, {
+        method: 'POST',
+        body: JSON.stringify({ query, variables }),
+      });
+      const errorCount = Array.isArray(result?.errors) ? result.errors.length : 0;
+      app.ok(result, {
+        summary: errorCount
+          ? `GraphQL returned ${errorCount} error(s)`
+          : 'GraphQL request succeeded',
+      });
+    }),
+  };
+}

package/src/commands/groupmembers.js

@@ -1,4 +1,9 @@
-import { formatRecordForDisplay, getStringField, resolveFieldsParam } from '../helpers.js';
+import { formatRecordForDisplay, getStringField, resolveFieldsParam, assertSafeExactMatch, confirmDelete, quoteShellArg } from '../helpers.js';
+import { declareCapabilities } from '../capabilities.js';
+
+// add/remove write sys_user_grmember; the mutation guard (instance +
+// read-only profile) and the delete confirmation both key off this.
+declareCapabilities('groupmembers', { mutationSubcommands: ['add', 'remove'] });
 
 export function groupMembersCmd(wrap) {
   return {
@@ -42,6 +47,8 @@ export function groupMembersCmd(wrap) {
           handler: wrap(async (argv, app) => {
             const groupName = argv.group;
             const userName = argv.user;
+            assertSafeExactMatch(groupName);
+            assertSafeExactMatch(userName);
 
             // Resolve group sys_id
             const isGroupSysID = groupName.length === 32 && /^[0-9a-fA-F]+$/.test(groupName);
@@ -86,7 +93,7 @@ export function groupMembersCmd(wrap) {
               summary: `Added ${userName} to ${groupName}`,
               breadcrumbs: [
                 { action: 'list', cmd: `jsn groupmembers list --query "group.name=${groupName}"`, description: 'List group members' },
-                { action: 'remove', cmd: `jsn groupmembers remove --group "${groupName}" --user "${userName}"`, description: 'Remove this member' },
+                { action: 'remove', cmd: `jsn groupmembers remove --group ${quoteShellArg(groupName)} --user ${quoteShellArg(userName)}`, description: 'Remove this member' },
               ],
             });
           }),
@@ -96,10 +103,18 @@ export function groupMembersCmd(wrap) {
           describe: 'Remove a user from a group',
           builder: (y) => y
             .option('group', { alias: 'g', type: 'string', demandOption: true, describe: 'Group name or sys_id (required)' })
-            .option('user', { alias: 'u', type: 'string', demandOption: true, describe: 'Username or sys_id (required)' }),
+            .option('user', { alias: 'u', type: 'string', demandOption: true, describe: 'Username or sys_id (required)' })
+            .option('force', { type: 'boolean', describe: 'Skip the confirmation prompt (removal)' }),
           handler: wrap(async (argv, app) => {
             const groupName = argv.group;
             const userName = argv.user;
+            assertSafeExactMatch(groupName);
+            assertSafeExactMatch(userName);
+            // Confirm before any lookup: a refused confirmation must not
+            // touch the instance at all.
+            await confirmDelete(app, argv, `Remove ${userName} from group ${groupName}`, {
+              rerun: ['groupmembers', 'remove', '--group', groupName, '--user', userName],
+            });
 
             // Resolve group sys_id
             const isGroupSysID = groupName.length === 32 && /^[0-9a-fA-F]+$/.test(groupName);
@@ -142,7 +157,7 @@ export function groupMembersCmd(wrap) {
               summary: `Removed ${userName} from ${groupName}`,
               breadcrumbs: [
                 { action: 'list', cmd: `jsn groupmembers list --query "group.name=${groupName}"`, description: 'List group members' },
-                { action: 'add', cmd: `jsn groupmembers add --group "${groupName}" --user "${userName}"`, description: 'Add user back to group' },
+                { action: 'add', cmd: `jsn groupmembers add --group ${quoteShellArg(groupName)} --user ${quoteShellArg(userName)}`, description: 'Add user back to group' },
               ],
             });
           }),

package/src/commands/grouproles.js

@@ -1,4 +1,9 @@
-import { formatRecordForDisplay, getStringField, resolveFieldsParam, assertSafeExactMatch } from '../helpers.js';
+import { formatRecordForDisplay, getStringField, resolveFieldsParam, assertSafeExactMatch, confirmDelete, quoteShellArg } from '../helpers.js';
+import { declareCapabilities } from '../capabilities.js';
+
+// add/remove write sys_group_has_role; the mutation guard (instance +
+// read-only profile) and the delete confirmation both key off this.
+declareCapabilities('grouproles', { mutationSubcommands: ['add', 'remove'] });
 
 export function groupRolesCmd(wrap) {
   return {
@@ -88,7 +93,7 @@ export function groupRolesCmd(wrap) {
               summary: `Added role ${roleName} to ${groupName}`,
               breadcrumbs: [
                 { action: 'list', cmd: `jsn grouproles list --query "group.name=${groupName}"`, description: 'List group roles' },
-                { action: 'remove', cmd: `jsn grouproles remove --group "${groupName}" --role "${roleName}"`, description: 'Remove this role' },
+                { action: 'remove', cmd: `jsn grouproles remove --group ${quoteShellArg(groupName)} --role ${quoteShellArg(roleName)}`, description: 'Remove this role' },
               ],
             });
           }),
@@ -98,12 +103,18 @@ export function groupRolesCmd(wrap) {
           describe: 'Remove a role from a group',
           builder: (y) => y
             .option('group', { alias: 'g', type: 'string', demandOption: true, describe: 'Group name or sys_id (required)' })
-            .option('role', { alias: 'r', type: 'string', demandOption: true, describe: 'Role name or sys_id (required)' }),
+            .option('role', { alias: 'r', type: 'string', demandOption: true, describe: 'Role name or sys_id (required)' })
+            .option('force', { type: 'boolean', describe: 'Skip the confirmation prompt (removal)' }),
           handler: wrap(async (argv, app) => {
             const groupName = argv.group;
             const roleName = argv.role;
             assertSafeExactMatch(groupName);
             assertSafeExactMatch(roleName);
+            // Confirm before any lookup: a refused confirmation must not
+            // touch the instance at all.
+            await confirmDelete(app, argv, `Remove role ${roleName} from group ${groupName}`, {
+              rerun: ['grouproles', 'remove', '--group', groupName, '--role', roleName],
+            });
 
             // Resolve group sys_id
             const isGroupSysID = groupName.length === 32 && /^[0-9a-fA-F]+$/.test(groupName);
@@ -146,7 +157,7 @@ export function groupRolesCmd(wrap) {
               summary: `Removed role ${roleName} from ${groupName}`,
               breadcrumbs: [
                 { action: 'list', cmd: `jsn grouproles list --query "group.name=${groupName}"`, description: 'List group roles' },
-                { action: 'add', cmd: `jsn grouproles add --group "${groupName}" --role "${roleName}"`, description: 'Add role back to group' },
+                { action: 'add', cmd: `jsn grouproles add --group ${quoteShellArg(groupName)} --role ${quoteShellArg(roleName)}`, description: 'Add role back to group' },
               ],
             });
           }),