@knowttl/mg-axi 0.1.2 → 0.1.4

package/dist/cli.js

@@ -11,15 +11,15 @@ import { updateUserAccount } from "./entra-user-update.js";
 import { revokeUserSessions } from "./entra-user-revoke-sessions.js";
 import { createMutationCoordinator, mutationFetchTransport } from "./mutations.js";
 import { TRANSITIVE_OPERATION, listGroupMemberOf, listGroupMembers, listGroups, showGroup } from "./entra-groups.js";
-import { listDirectoryRoles, showDirectoryRole, listRoleAssignments, listPimEligible, listPimActive } from "./entra-roles.js";
+import { listDirectoryRoles, showDirectoryRole, listDirectoryRoleTemplates, showDirectoryRoleTemplate, listRoleMembers, listScopedMembers, showScopedMember, listScopedRoleMemberships, showScopedRoleMembership, listRoleAssignments, listPimEligible, listPimActive } from "./entra-roles.js";
 import { listGroupAssignmentSchedules, showGroupAssignmentSchedule, listGroupAssignmentInstances, showGroupAssignmentInstance, listGroupEligibilitySchedules, showGroupEligibilitySchedule, listGroupEligibilityInstances, showGroupEligibilityInstance, listGroupEligibilityRequests, showGroupEligibilityRequest } from "./entra-group-pim.js";
 import { listAdministrativeUnitMembers, listAdministrativeUnits, listDevices, showAdministrativeUnit, showDevice } from "./entra-directory.js";
-import { listSignIns, showSignIn, listDirectoryAudits, showDirectoryAudit } from "./entra-audit-logs.js";
-import { listApplicationOwners, listApplications, listServicePrincipalOwners, listServicePrincipals, showApplication, showServicePrincipal } from "./entra-apps.js";
+import { listSignIns, showSignIn, listDirectoryAudits, showDirectoryAudit, listProvisioning, showProvisioning } from "./entra-audit-logs.js";
+import { listApplicationFederatedCredentials, listApplicationOwners, listApplications, listServicePrincipalAssignedTo, listServicePrincipalFederatedCredentials, listServicePrincipalOwners, listServicePrincipals, showApplication, showApplicationFederatedCredential, showServicePrincipal, showServicePrincipalAppRoleAssignment, showServicePrincipalAssignedTo, showServicePrincipalFederatedCredential } from "./entra-apps.js";
 import { listAppRoleAssignments, listOAuth2Grants } from "./entra-grants.js";
 import { listRiskyUsers, showRiskyUser, listRiskDetections, showRiskDetection, listRiskyServicePrincipals, showRiskyServicePrincipal, listRiskyServicePrincipalHistory, showRiskyServicePrincipalHistory, listServicePrincipalRiskDetections, showServicePrincipalRiskDetection } from "./entra-risk.js";
 import { dismissRiskyUser } from "./entra-risk-dismiss.js";
-import { listPolicies, showPolicy, listNamedLocations, showNamedLocation } from "./entra-conditional-access.js";
+import { listPolicies, showPolicy, listNamedLocations, showNamedLocation, listAuthStrengthPolicies, showAuthStrengthPolicy, listCombinationConfigurations, showCombinationConfiguration, listAuthMethodModes, showAuthMethodMode, listTemplates, showTemplate, listAuthContexts, showAuthContext, listDeletedPolicies, showDeletedPolicy, listDeletedNamedLocations, showDeletedNamedLocation } from "./entra-conditional-access.js";
 import { listBrandingLocalizations, listOrganizations, showBranding, showBrandingLocalization, showOrganization } from "./entra-organization.js";
 import { updateCaPolicy } from "./entra-ca-policy-update.js";
 import { listDomains, showDomain, listVerificationDnsRecords, showVerificationDnsRecord, listServiceConfigurationRecords, showServiceConfigurationRecord, listDomainDnsRecords, showDomainDnsRecord } from "./entra-domains.js";
@@ -118,10 +118,12 @@ export async function executeArgv(argv, overrides = {}) {
         return localHome(flags.profile);
     const profiles = new Profiles();
     if (leaf.path === "profile create") {
-        if (String(flags.mode ?? "delegated") !== "application" && (flags["certificate-thumbprint"] !== undefined || flags.federated))
-            throw new AxiError("Certificate and federated credentials belong to application profiles; pass --mode application", "VALIDATION_ERROR", [leafHelp(leaf)]);
+        const credentialFlags = ["certificate-thumbprint", "client-secret-env", "client-secret-file", "certificate-key-file", "certificate-key-env", "federated-token-file-env"];
+        if (String(flags.mode ?? "delegated") !== "application" && (flags.federated || credentialFlags.some(name => flags[name] !== undefined)))
+            throw new AxiError("Certificate, client-secret and federated credentials belong to application profiles; pass --mode application", "VALIDATION_ERROR", [leafHelp(leaf)]);
+        const optional = (name) => flags[name] === undefined ? undefined : String(flags[name]);
         return profiles.create(String(flags.name), String(flags.tenant), String(flags.client), String(flags.cloud), !!flags["allow-device-code"], String(flags.mode ?? "delegated") === "application"
-            ? { certificateThumbprint: flags["certificate-thumbprint"] === undefined ? undefined : String(flags["certificate-thumbprint"]), federated: !!flags.federated }
+            ? { certificateThumbprint: optional("certificate-thumbprint"), federated: !!flags.federated, clientSecretEnv: optional("client-secret-env"), clientSecretFile: optional("client-secret-file"), certificateKeyFile: optional("certificate-key-file"), certificateKeyEnv: optional("certificate-key-env"), federatedTokenFileEnv: optional("federated-token-file-env") }
             : undefined);
     }
     if (leaf.path === "profile list") {
@@ -164,7 +166,7 @@ export async function executeArgv(argv, overrides = {}) {
         const { MsalProvider } = await import("./msal-provider.js");
         return { profile: selected.name, ...await new DelegatedAuth(new MsalProvider()).login(selected.profile, String(flags.method ?? "browser"), String(flags.scopes).split(",")) };
     }
-    if (leaf.path === "entra conditional-access policy list" || leaf.path === "entra conditional-access policy show" || leaf.path === "entra conditional-access named-location list" || leaf.path === "entra conditional-access named-location show") {
+    if (leaf.path === "entra conditional-access policy list" || leaf.path === "entra conditional-access policy show" || leaf.path === "entra conditional-access named-location list" || leaf.path === "entra conditional-access named-location show" || leaf.path === "entra conditional-access auth-strength-policy list" || leaf.path === "entra conditional-access auth-strength-policy show" || leaf.path === "entra conditional-access combination-configuration list" || leaf.path === "entra conditional-access combination-configuration show" || leaf.path === "entra conditional-access auth-method-mode list" || leaf.path === "entra conditional-access auth-method-mode show" || leaf.path === "entra conditional-access template list" || leaf.path === "entra conditional-access template show" || leaf.path === "entra conditional-access auth-context list" || leaf.path === "entra conditional-access auth-context show" || leaf.path === "entra conditional-access deleted-policy list" || leaf.path === "entra conditional-access deleted-policy show" || leaf.path === "entra conditional-access deleted-named-location list" || leaf.path === "entra conditional-access deleted-named-location show") {
         const selected = profiles.resolve(flags.profile);
         const operation = operationFor(leaf, String(flags["api-version"] ?? "v1.0"));
         if (!operation || operation.method !== "GET") {
@@ -190,7 +192,21 @@ export async function executeArgv(argv, overrides = {}) {
             case "entra conditional-access policy list": return listPolicies(session, flags, selected.profile, operation, help, selected.name);
             case "entra conditional-access policy show": return showPolicy(session, flags, selected.profile, operation, help, selected.name);
             case "entra conditional-access named-location list": return listNamedLocations(session, flags, selected.profile, operation, help, selected.name);
-            default: return showNamedLocation(session, flags, selected.profile, operation, help, selected.name);
+            case "entra conditional-access named-location show": return showNamedLocation(session, flags, selected.profile, operation, help, selected.name);
+            case "entra conditional-access auth-strength-policy list": return listAuthStrengthPolicies(session, flags, selected.profile, operation, help, selected.name);
+            case "entra conditional-access auth-strength-policy show": return showAuthStrengthPolicy(session, flags, selected.profile, operation, help, selected.name);
+            case "entra conditional-access combination-configuration list": return listCombinationConfigurations(session, flags, selected.profile, operation, help, selected.name);
+            case "entra conditional-access combination-configuration show": return showCombinationConfiguration(session, flags, selected.profile, operation, help, selected.name);
+            case "entra conditional-access auth-method-mode list": return listAuthMethodModes(session, flags, selected.profile, operation, help, selected.name);
+            case "entra conditional-access auth-method-mode show": return showAuthMethodMode(session, flags, selected.profile, operation, help, selected.name);
+            case "entra conditional-access template list": return listTemplates(session, flags, selected.profile, operation, help, selected.name);
+            case "entra conditional-access auth-context list": return listAuthContexts(session, flags, selected.profile, operation, help, selected.name);
+            case "entra conditional-access auth-context show": return showAuthContext(session, flags, selected.profile, operation, help, selected.name);
+            case "entra conditional-access deleted-policy list": return listDeletedPolicies(session, flags, selected.profile, operation, help, selected.name);
+            case "entra conditional-access deleted-policy show": return showDeletedPolicy(session, flags, selected.profile, operation, help, selected.name);
+            case "entra conditional-access deleted-named-location list": return listDeletedNamedLocations(session, flags, selected.profile, operation, help, selected.name);
+            case "entra conditional-access deleted-named-location show": return showDeletedNamedLocation(session, flags, selected.profile, operation, help, selected.name);
+            default: return showTemplate(session, flags, selected.profile, operation, help, selected.name);
         }
     }
     if (leaf.path === "entra access-review definition list" || leaf.path === "entra access-review definition show" || leaf.path === "entra access-review instance list" || leaf.path === "entra access-review instance show" || leaf.path === "entra access-review decision list" || leaf.path === "entra access-review decision show" || leaf.path === "entra access-review contacted-reviewer list" || leaf.path === "entra access-review contacted-reviewer show" || leaf.path === "entra access-review stage list" || leaf.path === "entra access-review stage show") {
@@ -585,7 +601,7 @@ export async function executeArgv(argv, overrides = {}) {
             help: leafHelp(leaf),
         });
     }
-    if (leaf.path === "entra directory-role list" || leaf.path === "entra directory-role show" || leaf.path === "entra role-assignment list" || leaf.path === "entra pim eligible list" || leaf.path === "entra pim active list"
+    if (leaf.path === "entra directory-role list" || leaf.path === "entra directory-role show" || leaf.path === "entra directory-role-template list" || leaf.path === "entra directory-role-template show" || leaf.path === "entra directory-role member list" || leaf.path === "entra directory-role scoped-member list" || leaf.path === "entra directory-role scoped-member show" || leaf.path === "entra scoped-role-membership list" || leaf.path === "entra scoped-role-membership show" || leaf.path === "entra role-assignment list" || leaf.path === "entra pim eligible list" || leaf.path === "entra pim active list"
         || leaf.path === "entra pim group-assignment-schedule list" || leaf.path === "entra pim group-assignment-schedule show"
         || leaf.path === "entra pim group-assignment-instance list" || leaf.path === "entra pim group-assignment-instance show"
         || leaf.path === "entra pim group-eligibility-schedule list" || leaf.path === "entra pim group-eligibility-schedule show"
@@ -616,6 +632,13 @@ export async function executeArgv(argv, overrides = {}) {
         switch (leaf.path) {
             case "entra directory-role list": return listDirectoryRoles(session, flags, selected.profile, operation, help, selected.name);
             case "entra directory-role show": return showDirectoryRole(session, flags, selected.profile, operation, help, selected.name);
+            case "entra directory-role-template list": return listDirectoryRoleTemplates(session, flags, selected.profile, operation, help, selected.name);
+            case "entra directory-role-template show": return showDirectoryRoleTemplate(session, flags, selected.profile, operation, help, selected.name);
+            case "entra directory-role member list": return listRoleMembers(session, flags, selected.profile, operation, help, selected.name);
+            case "entra directory-role scoped-member list": return listScopedMembers(session, flags, selected.profile, operation, help, selected.name);
+            case "entra directory-role scoped-member show": return showScopedMember(session, flags, selected.profile, operation, help, selected.name);
+            case "entra scoped-role-membership list": return listScopedRoleMemberships(session, flags, selected.profile, operation, help, selected.name);
+            case "entra scoped-role-membership show": return showScopedRoleMembership(session, flags, selected.profile, operation, help, selected.name);
             case "entra role-assignment list": return listRoleAssignments(session, flags, selected.profile, operation, help, selected.name);
             case "entra pim eligible list": return listPimEligible(session, flags, selected.profile, operation, help, selected.name);
             case "entra pim active list": return listPimActive(session, flags, selected.profile, operation, help, selected.name);
@@ -666,13 +689,13 @@ export async function executeArgv(argv, overrides = {}) {
             default: return showBrandingLocalization(session, flags, selected.profile, operation, help, selected.name);
         }
     }
-    if (leaf.path === "entra sign-in list" || leaf.path === "entra sign-in show" || leaf.path === "entra directory-audit list" || leaf.path === "entra directory-audit show" || leaf.path === "entra application list" || leaf.path === "entra application show" || leaf.path === "entra service-principal list" || leaf.path === "entra service-principal show" || leaf.path === "entra application owner list" || leaf.path === "entra service-principal owner list") {
+    if (leaf.path === "entra sign-in list" || leaf.path === "entra sign-in show" || leaf.path === "entra directory-audit list" || leaf.path === "entra directory-audit show" || leaf.path === "entra provisioning list" || leaf.path === "entra provisioning show" || leaf.path === "entra application list" || leaf.path === "entra application show" || leaf.path === "entra service-principal list" || leaf.path === "entra service-principal show" || leaf.path === "entra application owner list" || leaf.path === "entra service-principal owner list" || leaf.path === "entra application federated-credential list" || leaf.path === "entra application federated-credential show" || leaf.path === "entra service-principal federated-credential list" || leaf.path === "entra service-principal federated-credential show" || leaf.path === "entra service-principal app-role-assigned-to list" || leaf.path === "entra service-principal app-role-assigned-to show" || leaf.path === "entra service-principal app-role-assignment show") {
         const selected = profiles.resolve(flags.profile);
         const operation = operationFor(leaf, String(flags["api-version"] ?? "v1.0"));
         if (!operation || operation.method !== "GET") {
             throw new AxiError(`Unknown catalogued Graph operation for ${leaf.path}`, "VALIDATION_ERROR", [leafHelp(leaf)]);
         }
-        if ((leaf.path.startsWith("entra sign-in ") || leaf.path.startsWith("entra directory-audit ")) && flags.cursor !== undefined)
+        if ((leaf.path.startsWith("entra sign-in ") || leaf.path.startsWith("entra directory-audit ") || leaf.path.startsWith("entra provisioning ")) && flags.cursor !== undefined)
             flags.cursor = (await readCursor(String(flags.cursor)));
         let delegated = overrides.delegated;
         let application = overrides.application;
@@ -693,11 +716,20 @@ export async function executeArgv(argv, overrides = {}) {
             case "entra sign-in show": return showSignIn(session, flags, selected.profile, operation, help, selected.name);
             case "entra directory-audit list": return listDirectoryAudits(session, flags, selected.profile, operation, help, selected.name);
             case "entra directory-audit show": return showDirectoryAudit(session, flags, selected.profile, operation, help, selected.name);
+            case "entra provisioning list": return listProvisioning(session, flags, selected.profile, operation, help, selected.name);
+            case "entra provisioning show": return showProvisioning(session, flags, selected.profile, operation, help, selected.name);
             case "entra application list": return listApplications(session, flags, selected.profile, operation, help, selected.name);
             case "entra application show": return showApplication(session, flags, selected.profile, operation, help, selected.name);
             case "entra service-principal list": return listServicePrincipals(session, flags, selected.profile, operation, help, selected.name);
             case "entra service-principal show": return showServicePrincipal(session, flags, selected.profile, operation, help, selected.name);
             case "entra application owner list": return listApplicationOwners(session, flags, selected.profile, operation, help, selected.name);
+            case "entra application federated-credential list": return listApplicationFederatedCredentials(session, flags, selected.profile, operation, help, selected.name);
+            case "entra application federated-credential show": return showApplicationFederatedCredential(session, flags, selected.profile, operation, help, selected.name);
+            case "entra service-principal federated-credential list": return listServicePrincipalFederatedCredentials(session, flags, selected.profile, operation, help, selected.name);
+            case "entra service-principal federated-credential show": return showServicePrincipalFederatedCredential(session, flags, selected.profile, operation, help, selected.name);
+            case "entra service-principal app-role-assigned-to list": return listServicePrincipalAssignedTo(session, flags, selected.profile, operation, help, selected.name);
+            case "entra service-principal app-role-assigned-to show": return showServicePrincipalAssignedTo(session, flags, selected.profile, operation, help, selected.name);
+            case "entra service-principal app-role-assignment show": return showServicePrincipalAppRoleAssignment(session, flags, selected.profile, operation, help, selected.name);
             default: return listServicePrincipalOwners(session, flags, selected.profile, operation, help, selected.name);
         }
     }