@logto/cli 1.39.0 → 1.40.0

package/lib/commands/database/seed/index.d.ts

@@ -1,11 +1,18 @@
 import type { DatabasePool } from '@silverhand/slonik';
 import type { CommandModule } from 'yargs';
-export declare const seedByPool: (pool: DatabasePool, cloud?: boolean, test?: boolean, encryptBaseRole?: boolean) => Promise<void>;
+type SeedByPoolOptions = {
+    cloud?: boolean;
+    test?: boolean;
+    encryptBaseRole?: boolean;
+    disablePwnedPasswordCheck?: boolean;
+};
+export declare const seedByPool: (pool: DatabasePool, { cloud, test, encryptBaseRole, disablePwnedPasswordCheck, }?: SeedByPoolOptions) => Promise<void>;
 declare const seed: CommandModule<Record<string, unknown>, {
     swe?: boolean;
     cloud?: boolean;
     test?: boolean;
     'legacy-test-data'?: boolean;
     'encrypt-base-role'?: boolean;
+    dapc?: boolean;
 }>;
 export default seed;

package/lib/commands/database/seed/index.js

@@ -3,8 +3,9 @@ import { doesConfigsTableExist } from '../../../queries/logto-config.js';
 import { consoleLog, oraPromise } from '../../../utils.js';
 import { getLatestAlterationTimestamp } from '../alteration/index.js';
 import { getAlterationDirectory } from '../alteration/utils.js';
+import { disableAdminPwnedPasswordCheckDescription } from './options.js';
 import { createTables, seedCloud, seedTables, seedTest } from './tables.js';
-export const seedByPool = async (pool, cloud = false, test = false, encryptBaseRole = false) => {
+export const seedByPool = async (pool, { cloud = false, test = false, encryptBaseRole = false, disablePwnedPasswordCheck = false, } = {}) => {
     await pool.transaction(async (connection) => {
         // Check alteration scripts available in order to insert correct timestamp
         const latestTimestamp = await getLatestAlterationTimestamp();
@@ -18,7 +19,7 @@ export const seedByPool = async (pool, cloud = false, test = false, encryptBaseR
         if (tableInfo.password.length > 0) {
             consoleLog.info('base role password:', tableInfo.password);
         }
-        await seedTables(connection, latestTimestamp, cloud);
+        await seedTables(connection, latestTimestamp, cloud, { disablePwnedPasswordCheck });
         if (cloud) {
             await seedCloud(connection);
         }
@@ -56,8 +57,13 @@ const seed = {
         .option('encrypt-base-role', {
         describe: 'Seed base role with password',
         type: 'boolean',
+    })
+        .option('dapc', {
+        describe: disableAdminPwnedPasswordCheckDescription,
+        alias: 'disable-admin-pwned-password-check',
+        type: 'boolean',
     }),
-    handler: async ({ swe, cloud, test, legacyTestData, encryptBaseRole }) => {
+    handler: async ({ swe, cloud, test, legacyTestData, encryptBaseRole, dapc }) => {
         const pool = await createPoolAndDatabaseIfNeeded();
         if (legacyTestData) {
             // eslint-disable-next-line @typescript-eslint/prefer-nullish-coalescing
@@ -74,7 +80,12 @@ const seed = {
             return;
         }
         try {
-            await seedByPool(pool, cloud, test, encryptBaseRole);
+            await seedByPool(pool, {
+                cloud,
+                test,
+                encryptBaseRole,
+                disablePwnedPasswordCheck: dapc,
+            });
         }
         catch (error) {
             consoleLog.error(error);

package/lib/commands/database/seed/options.d.ts

@@ -0,0 +1 @@
+export declare const disableAdminPwnedPasswordCheckDescription: string;

package/lib/commands/database/seed/options.js

@@ -0,0 +1,6 @@
+export const disableAdminPwnedPasswordCheckDescription = "Seed the admin tenant's sign-in experience with the Have I Been Pwned (HIBP) " +
+    'password breach check disabled. Use this for air-gapped or offline OSS deployments ' +
+    'where api.pwnedpasswords.com is unreachable, otherwise creating the first admin ' +
+    'user from the Welcome page will hang on the breach check. Scope: admin tenant only ' +
+    "— the default tenant's password policy is unaffected and stays admin-controlled " +
+    'via the Admin Console.';

package/lib/commands/database/seed/tables.d.ts

@@ -1,8 +1,9 @@
+import { type AdminSignInExperienceSeedOptions } from '@logto/schemas';
 import type { DatabaseTransactionConnection } from '@silverhand/slonik';
 export declare const createTables: (connection: DatabaseTransactionConnection, encryptBaseRole: boolean) => Promise<{
     password: string;
 }>;
-export declare const seedTables: (connection: DatabaseTransactionConnection, latestTimestamp: number, isCloud: boolean) => Promise<void>;
+export declare const seedTables: (connection: DatabaseTransactionConnection, latestTimestamp: number, isCloud: boolean, options?: AdminSignInExperienceSeedOptions) => Promise<void>;
 export declare const seedCloud: (connection: DatabaseTransactionConnection) => Promise<void>;
 /**
  * Seed additional test data for integration or alteration tests.

package/lib/commands/database/seed/tables.js

@@ -79,7 +79,7 @@ export const createTables = async (connection, encryptBaseRole) => {
     await runLifecycleQuery('after_all', { database });
     return { password };
 };
-export const seedTables = async (connection, latestTimestamp, isCloud) => {
+export const seedTables = async (connection, latestTimestamp, isCloud, options = {}) => {
     await createTenant(connection, defaultTenantId);
     await seedOidcConfigs(connection, defaultTenantId);
     await seedAdminData(connection, defaultManagementApi);
@@ -115,7 +115,7 @@ export const seedTables = async (connection, latestTimestamp, isCloud) => {
         connection.query(insertInto(createDefaultIdTokenConfig(defaultTenantId), LogtoConfigs.table)),
         connection.query(insertInto(createDefaultIdTokenConfig(adminTenantId), LogtoConfigs.table)),
         connection.query(insertInto(createDefaultSignInExperience(defaultTenantId, isCloud), SignInExperiences.table)),
-        connection.query(insertInto(createAdminTenantSignInExperience(), SignInExperiences.table)),
+        connection.query(insertInto(createAdminTenantSignInExperience(options), SignInExperiences.table)),
         connection.query(insertInto(createDefaultAdminConsoleApplication(), Applications.table)),
         connection.query(insertInto(createDefaultAccountCenter(defaultTenantId), AccountCenters.table)),
         connection.query(insertInto(createAdminTenantAccountCenter(), AccountCenters.table)),

package/lib/commands/install/index.d.ts

@@ -4,11 +4,13 @@ export type InstallArgs = {
     skipSeed: boolean;
     cloud: boolean;
     downloadUrl?: string;
+    disableAdminPwnedPasswordCheck?: boolean;
 };
 declare const install: CommandModule<unknown, {
     p?: string;
     ss: boolean;
     cloud: boolean;
     du?: string;
+    dapc?: boolean;
 }>;
 export default install;

package/lib/commands/install/index.js

@@ -1,8 +1,9 @@
 import chalk from 'chalk';
 import { getDatabaseUrlFromConfig } from '../../database.js';
 import { consoleLog } from '../../utils.js';
+import { disableAdminPwnedPasswordCheckDescription } from '../database/seed/options.js';
 import { validateNodeVersion, inquireInstallPath, validateDatabase, downloadRelease, seedDatabase, createEnv, logFinale, decompress, isUrl, } from './utils.js';
-const installLogto = async ({ path, skipSeed, downloadUrl, cloud }) => {
+const installLogto = async ({ path, skipSeed, downloadUrl, cloud, disableAdminPwnedPasswordCheck, }) => {
     validateNodeVersion();
     // Get install location path
     const installPath = await inquireInstallPath(path);
@@ -16,7 +17,10 @@ const installLogto = async ({ path, skipSeed, downloadUrl, cloud }) => {
         consoleLog.info(`Skipped database seeding.\n\n' + '  You can use the ${chalk.green('db seed')} command to seed database when ready.\n`);
     }
     else {
-        await seedDatabase(installPath, cloud);
+        await seedDatabase(installPath, {
+            cloud,
+            disablePwnedPasswordCheck: disableAdminPwnedPasswordCheck,
+        });
     }
     // Save to dot env
     await createEnv(installPath, await getDatabaseUrlFromConfig());
@@ -50,9 +54,21 @@ const install = {
             type: 'string',
             hidden: true,
         },
+        dapc: {
+            describe: disableAdminPwnedPasswordCheckDescription,
+            alias: 'disable-admin-pwned-password-check',
+            type: 'boolean',
+            default: false,
+        },
     }),
-    handler: async ({ p, ss, cloud, du }) => {
-        await installLogto({ path: p, skipSeed: ss, cloud, downloadUrl: du });
+    handler: async ({ p, ss, cloud, du, dapc }) => {
+        await installLogto({
+            path: p,
+            skipSeed: ss,
+            cloud,
+            downloadUrl: du,
+            disableAdminPwnedPasswordCheck: dapc,
+        });
     },
 };
 export default install;

package/lib/commands/install/utils.d.ts

@@ -3,7 +3,12 @@ export declare const inquireInstallPath: (initialPath?: string) => Promise<strin
 export declare const validateDatabase: () => Promise<void>;
 export declare const downloadRelease: (url?: string) => Promise<string>;
 export declare const decompress: (toPath: string, tarPath: string) => Promise<void>;
-export declare const seedDatabase: (instancePath: string, cloud: boolean) => Promise<void>;
+type SeedDatabaseOptions = {
+    cloud: boolean;
+    disablePwnedPasswordCheck?: boolean;
+};
+export declare const seedDatabase: (instancePath: string, { cloud, disablePwnedPasswordCheck }: SeedDatabaseOptions) => Promise<void>;
 export declare const createEnv: (installPath: string, databaseUrl: string) => Promise<void>;
 export declare const logFinale: (installPath: string) => void;
 export declare const isUrl: (string: string) => boolean;
+export {};

package/lib/commands/install/utils.js

@@ -114,10 +114,10 @@ export const decompress = async (toPath, tarPath) => {
         text: `Decompress to ${toPath}`,
     }, true);
 };
-export const seedDatabase = async (instancePath, cloud) => {
+export const seedDatabase = async (instancePath, { cloud, disablePwnedPasswordCheck }) => {
     try {
         const pool = await createPoolAndDatabaseIfNeeded();
-        await seedByPool(pool, cloud);
+        await seedByPool(pool, { cloud, disablePwnedPasswordCheck });
         await pool.end();
     }
     catch (error) {

package/lib/package-json.js

@@ -1,6 +1,6 @@
 export const packageJson = {
     "name": "@logto/cli",
-    "version": "1.39.0",
+    "version": "1.40.0",
     "description": "Logto CLI.",
     "author": "Silverhand Inc. <contact@silverhand.io>",
     "homepage": "https://github.com/logto-io/logto#readme",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@logto/cli",
-  "version": "1.39.0",
+  "version": "1.40.0",
   "description": "Logto CLI.",
   "author": "Silverhand Inc. <contact@silverhand.io>",
   "homepage": "https://github.com/logto-io/logto#readme",
@@ -45,9 +45,9 @@
     "tar": "^7.5.7",
     "yargs": "^17.6.0",
     "zod": "3.24.3",
-    "@logto/connector-kit": "^5.0.0",
     "@logto/core-kit": "^2.9.0",
-    "@logto/schemas": "1.39.0",
+    "@logto/schemas": "1.40.0",
+    "@logto/connector-kit": "^5.0.1",
     "@logto/shared": "^3.4.0"
   },
   "devDependencies": {