@logto/cli 1.7.0 → 1.8.0

package/lib/commands/database/alteration/index.js

@@ -3,7 +3,7 @@ import chalk from 'chalk';
 import { createPoolFromConfig } from '../../../database.js';
 import { getCurrentDatabaseAlterationTimestamp, updateDatabaseTimestamp, } from '../../../queries/system.js';
 import { consoleLog } from '../../../utils.js';
-import { getAlterationFiles, getTimestampFromFilename } from './utils.js';
+import { getAlterationFiles, getTimestampFromFilename, chooseRevertAlterationsByTimestamp, } from './utils.js';
 import { chooseAlterationsByVersion, chooseRevertAlterationsByVersion } from './version.js';
 const importAlterationScript = async (filePath) => {
     // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
@@ -52,6 +52,15 @@ const deployAlteration = async (pool, { path: filePath, filename }, action = 'up
     }
     consoleLog.info(`Run alteration ${filename} \`${action}()\` function succeeded`);
 };
+const revertAlterations = async (alterations, pool) => {
+    consoleLog.info(`Found ${alterations.length} alteration${conditionalString(alterations.length > 1 && 's')} to revert`);
+    // The await inside the loop is intended, alterations should run in order
+    // eslint-disable-next-line @silverhand/fp/no-mutating-methods
+    for (const alteration of alterations.slice().reverse()) {
+        // eslint-disable-next-line no-await-in-loop
+        await deployAlteration(pool, alteration, 'down');
+    }
+};
 const alteration = {
     command: ['alteration <action> [target]', 'alt', 'alter'],
     describe: 'Perform database alteration',
@@ -66,37 +75,44 @@ const alteration = {
         type: 'string',
     }),
     handler: async ({ action, target }) => {
-        if (action === 'list') {
-            const files = await getAlterationFiles();
-            for (const file of files) {
-                consoleLog.plain(file.filename);
+        switch (action) {
+            case 'list': {
+                const files = await getAlterationFiles();
+                for (const file of files) {
+                    consoleLog.plain(file.filename);
+                }
+                break;
             }
-        }
-        else if (action === 'deploy') {
-            const pool = await createPoolFromConfig();
-            const alterations = await chooseAlterationsByVersion(await getAvailableAlterations(pool), target);
-            consoleLog.info(`Found ${alterations.length} alteration${conditionalString(alterations.length > 1 && 's')} to deploy`);
-            // The await inside the loop is intended, alterations should run in order
-            for (const alteration of alterations) {
-                // eslint-disable-next-line no-await-in-loop
-                await deployAlteration(pool, alteration);
+            case 'deploy': {
+                const pool = await createPoolFromConfig();
+                const alterations = await chooseAlterationsByVersion(await getAvailableAlterations(pool), target);
+                consoleLog.info(`Found ${alterations.length} alteration${conditionalString(alterations.length > 1 && 's')} to deploy`);
+                // The await inside the loop is intended, alterations should run in order
+                for (const alteration of alterations) {
+                    // eslint-disable-next-line no-await-in-loop
+                    await deployAlteration(pool, alteration);
+                }
+                await pool.end();
+                break;
             }
-            await pool.end();
-        }
-        else if (['rollback', 'r'].includes(action)) {
-            const pool = await createPoolFromConfig();
-            const alterations = await chooseRevertAlterationsByVersion(await getAvailableAlterations(pool, 'lte'), target ?? '');
-            consoleLog.info(`Found ${alterations.length} alteration${conditionalString(alterations.length > 1 && 's')} to revert`);
-            // The await inside the loop is intended, alterations should run in order
-            // eslint-disable-next-line @silverhand/fp/no-mutating-methods
-            for (const alteration of alterations.slice().reverse()) {
-                // eslint-disable-next-line no-await-in-loop
-                await deployAlteration(pool, alteration, 'down');
+            case 'rollback':
+            case 'r': {
+                const pool = await createPoolFromConfig();
+                const alterations = await chooseRevertAlterationsByVersion(await getAvailableAlterations(pool, 'lte'), target ?? '');
+                await revertAlterations(alterations, pool);
+                await pool.end();
+                break;
+            }
+            case 'rollback-to-timestamp': {
+                const pool = await createPoolFromConfig();
+                const alterations = await chooseRevertAlterationsByTimestamp(target ?? '');
+                await revertAlterations(alterations, pool);
+                await pool.end();
+                break;
+            }
+            default: {
+                consoleLog.fatal('Unsupported action');
             }
-            await pool.end();
-        }
-        else {
-            consoleLog.fatal('Unsupported action');
         }
     },
 };

package/lib/commands/database/alteration/utils.d.ts

@@ -2,3 +2,4 @@ import type { AlterationFile } from './type.js';
 export declare const getTimestampFromFilename: (filename: string) => number;
 export declare const getAlterationDirectory: () => string;
 export declare const getAlterationFiles: () => Promise<AlterationFile[]>;
+export declare const chooseRevertAlterationsByTimestamp: (target: string) => Promise<AlterationFile[]>;

package/lib/commands/database/alteration/utils.js

@@ -36,3 +36,11 @@ export const getAlterationFiles = async () => {
         .sort((file1, file2) => getTimestampFromFilename(file1) - getTimestampFromFilename(file2))
         .map((filename) => ({ path: path.join(localAlterationDirectory, filename), filename }));
 };
+export const chooseRevertAlterationsByTimestamp = async (target) => {
+    const files = await getAlterationFiles();
+    const targetTimestamp = Number(target);
+    if (Number.isNaN(targetTimestamp)) {
+        return [];
+    }
+    return files.filter(({ filename }) => getTimestampFromFilename(filename) > targetTimestamp);
+};

package/lib/commands/database/config.js

@@ -4,7 +4,7 @@ import chalk from 'chalk';
 import { createPoolFromConfig } from '../../database.js';
 import { getRowsByKeys, updateValueByKey } from '../../queries/logto-config.js';
 import { consoleLog } from '../../utils.js';
-import { generateOidcCookieKey, generateOidcPrivateKey } from './utils.js';
+import { PrivateKeyType, generateOidcCookieKey, generateOidcPrivateKey } from './utils.js';
 const validKeysDisplay = chalk.green(logtoConfigKeys.join(', '));
 const validateKeys = (keys) => {
     const invalidKey = (Array.isArray(keys) ? keys : [keys]).find(
@@ -19,6 +19,7 @@ const validRotateKeys = Object.freeze([
     LogtoOidcConfigKey.PrivateKeys,
     LogtoOidcConfigKey.CookieKeys,
 ]);
+const validPrivateKeyTypes = Object.freeze([PrivateKeyType.RSA, PrivateKeyType.EC]);
 const validateRotateKey = (key) => {
     // Using `.includes()` will result a type error
     // eslint-disable-next-line unicorn/prefer-includes
@@ -26,6 +27,13 @@ const validateRotateKey = (key) => {
         consoleLog.fatal(`Invalid config key ${chalk.red(key)} found, expected one of ${validKeysDisplay}`);
     }
 };
+const validatePrivateKeyType = (key) => {
+    // Using `.includes()` will result a type error
+    // eslint-disable-next-line unicorn/prefer-includes
+    if (!validPrivateKeyTypes.some((element) => element === key)) {
+        consoleLog.fatal(`Invalid private key type ${chalk.red(key)} found, expected one of ${validPrivateKeyTypes.join(', ')}`);
+    }
+};
 const getConfig = {
     command: 'get <key> [keys...]',
     describe: 'Get config value(s) of the given key(s) in Logto database',
@@ -103,9 +111,15 @@ const rotateConfig = {
         describe: 'The tenant to operate',
         type: 'string',
         default: defaultTenantId,
+    })
+        .option('type', {
+        describe: `The key type for ${LogtoOidcConfigKey.PrivateKeys}, one of ${validPrivateKeyTypes.join(', ')}`,
+        type: 'string',
+        default: 'ec',
     }),
-    handler: async ({ key, tenantId }) => {
+    handler: async ({ key, tenantId, type }) => {
         validateRotateKey(key);
+        validatePrivateKeyType(type);
         const pool = await createPoolFromConfig();
         const { rows } = await getRowsByKeys(pool, tenantId, [key]);
         if (!rows[0]) {
@@ -117,7 +131,7 @@ const rotateConfig = {
             // No need for default. It's already exhaustive
             switch (key) {
                 case LogtoOidcConfigKey.PrivateKeys: {
-                    return [await generateOidcPrivateKey(), ...original];
+                    return [await generateOidcPrivateKey(type), ...original];
                 }
                 case LogtoOidcConfigKey.CookieKeys: {
                     return [generateOidcCookieKey(), ...original];

package/lib/commands/database/seed/cloud.d.ts

@@ -8,3 +8,11 @@ import type { CommonQueryMethods } from 'slonik';
  * For why it is necessary, see the redirect lifecycle of cloud Admin Console.
  */
 export declare const appendAdminConsoleRedirectUris: (pool: CommonQueryMethods) => Promise<void>;
+/**
+ * Create Cloud Service M2M application for the tenant.
+ *
+ * This is a built-in M2M application for the tenant to communicate with the cloud service.
+ * - default
+ * - admin
+ */
+export declare const seedTenantCloudServiceApplication: (pool: CommonQueryMethods, tenantId: string) => Promise<void>;

package/lib/commands/database/seed/cloud.js

@@ -1,7 +1,8 @@
-import { adminConsoleApplicationId, adminTenantId, defaultTenantId } from '@logto/schemas';
+import { adminConsoleApplicationId, adminTenantId, defaultTenantId, createTenantMachineToMachineApplication, createAdminTenantApplicationRole, createCloudConnectionConfig, AdminTenantRole, } from '@logto/schemas';
 import { GlobalValues } from '@logto/shared';
 import { appendPath } from '@silverhand/essentials';
 import { sql } from 'slonik';
+import { insertInto } from '../../../database.js';
 import { consoleLog } from '../../../utils.js';
 /**
  * Append Redirect URIs for the default tenant callback in cloud Admin Console.
@@ -32,3 +33,25 @@ export const appendAdminConsoleRedirectUris = async (pool) => {
   `);
     consoleLog.succeed('Appended initial Redirect URIs to Admin Console:', redirectUris.map(String));
 };
+/**
+ * Create Cloud Service M2M application for the tenant.
+ *
+ * This is a built-in M2M application for the tenant to communicate with the cloud service.
+ * - default
+ * - admin
+ */
+export const seedTenantCloudServiceApplication = async (pool, tenantId) => {
+    // Create Cloud Service M2M application
+    const cloudServiceApplication = createTenantMachineToMachineApplication(tenantId);
+    await pool.query(insertInto(cloudServiceApplication, 'applications'));
+    // Assign tenantApplicationRole to Cloud Service M2M application
+    const { id: tenantApplicationRoleId } = await pool.one(sql `
+    select id from roles
+    where name = ${AdminTenantRole.TenantApplication}
+    and tenant_id = ${adminTenantId}
+  `);
+    await pool.query(insertInto(createAdminTenantApplicationRole(cloudServiceApplication.id, tenantApplicationRoleId), 'applications_roles'));
+    // Create Cloud Service M2M application logto_config
+    await pool.query(insertInto(createCloudConnectionConfig(tenantId, cloudServiceApplication.id, cloudServiceApplication.secret), 'logto_configs'));
+    consoleLog.succeed('Cloud Service Application successfully created for:', tenantId);
+};

package/lib/commands/database/seed/tables.js

@@ -1,6 +1,6 @@
 import { readdir, readFile } from 'node:fs/promises';
 import path from 'node:path';
-import { createDefaultAdminConsoleConfig, createCloudConnectionConfig, defaultTenantId, adminTenantId, defaultManagementApi, createAdminDataInAdminTenant, createMeApiInAdminTenant, createDefaultSignInExperience, createAdminTenantSignInExperience, createDefaultAdminConsoleApplication, createCloudApi, createTenantApplicationRole, createTenantMachineToMachineApplication, createAdminTenantApplicationRole, CloudScope, } from '@logto/schemas';
+import { createDefaultAdminConsoleConfig, defaultTenantId, adminTenantId, defaultManagementApi, createAdminDataInAdminTenant, createMeApiInAdminTenant, createDefaultSignInExperience, createAdminTenantSignInExperience, createDefaultAdminConsoleApplication, createCloudApi, createTenantApplicationRole, CloudScope, } from '@logto/schemas';
 import { Tenants } from '@logto/schemas/models';
 import { sql } from 'slonik';
 import { raw } from 'slonik-sql-tag-raw';
@@ -8,7 +8,7 @@ import { insertInto } from '../../../database.js';
 import { getDatabaseName } from '../../../queries/database.js';
 import { updateDatabaseTimestamp } from '../../../queries/system.js';
 import { consoleLog, getPathInModule } from '../../../utils.js';
-import { appendAdminConsoleRedirectUris } from './cloud.js';
+import { appendAdminConsoleRedirectUris, seedTenantCloudServiceApplication } from './cloud.js';
 import { seedOidcConfigs } from './oidc-config.js';
 import { assignScopesToRole, createTenant, seedAdminData } from './tenant.js';
 const getExplicitOrder = (query) => {
@@ -82,23 +82,21 @@ export const seedTables = async (connection, latestTimestamp, isCloud) => {
     await seedAdminData(connection, adminAdminData);
     await seedAdminData(connection, createMeApiInAdminTenant());
     const [cloudData, ...cloudAdditionalScopes] = createCloudApi();
-    const applicationRole = createTenantApplicationRole();
     await seedAdminData(connection, cloudData, ...cloudAdditionalScopes);
+    // Create tenant application role
+    const applicationRole = createTenantApplicationRole();
     await connection.query(insertInto(applicationRole, 'roles'));
     await assignScopesToRole(connection, adminTenantId, applicationRole.id, ...cloudAdditionalScopes
         .filter(({ name }) => name === CloudScope.SendSms || name === CloudScope.SendEmail)
         .map(({ id }) => id));
-    // Add M2M app for default tenant
-    const defaultTenantApplication = createTenantMachineToMachineApplication(defaultTenantId);
-    await connection.query(insertInto(defaultTenantApplication, 'applications'));
-    await connection.query(insertInto(createAdminTenantApplicationRole(defaultTenantApplication.id, applicationRole.id), 'applications_roles'));
     // Assign all cloud API scopes to role `admin:admin`
     await assignScopesToRole(connection, adminTenantId, adminAdminData.role.id, ...cloudAdditionalScopes.map(({ id }) => id));
+    // FIXME: @wangsijie should not create tenant Cloud Service application in the OSS DB.
+    await seedTenantCloudServiceApplication(connection, defaultTenantId);
     await Promise.all([
         connection.query(insertInto(createDefaultAdminConsoleConfig(defaultTenantId), 'logto_configs')),
-        connection.query(insertInto(createCloudConnectionConfig(defaultTenantId, defaultTenantApplication.id, defaultTenantApplication.secret), 'logto_configs')),
-        connection.query(insertInto(createDefaultSignInExperience(defaultTenantId, isCloud), 'sign_in_experiences')),
         connection.query(insertInto(createDefaultAdminConsoleConfig(adminTenantId), 'logto_configs')),
+        connection.query(insertInto(createDefaultSignInExperience(defaultTenantId, isCloud), 'sign_in_experiences')),
         connection.query(insertInto(createAdminTenantSignInExperience(), 'sign_in_experiences')),
         connection.query(insertInto(createDefaultAdminConsoleApplication(), 'applications')),
         updateDatabaseTimestamp(connection, latestTimestamp),
@@ -106,5 +104,8 @@ export const seedTables = async (connection, latestTimestamp, isCloud) => {
     consoleLog.succeed('Seed data');
 };
 export const seedCloud = async (connection) => {
-    await appendAdminConsoleRedirectUris(connection);
+    await Promise.all([
+        appendAdminConsoleRedirectUris(connection),
+        seedTenantCloudServiceApplication(connection, adminTenantId),
+    ]);
 };

package/lib/commands/database/utils.d.ts

@@ -1,2 +1,6 @@
-export declare const generateOidcPrivateKey: (type?: 'rsa' | 'ec') => Promise<string>;
+export declare enum PrivateKeyType {
+    RSA = "rsa",
+    EC = "ec"
+}
+export declare const generateOidcPrivateKey: (type?: PrivateKeyType) => Promise<string>;
 export declare const generateOidcCookieKey: () => string;

package/lib/commands/database/utils.js

@@ -1,8 +1,13 @@
 import { generateKeyPair } from 'node:crypto';
 import { promisify } from 'node:util';
 import { generateStandardId } from '@logto/shared';
-export const generateOidcPrivateKey = async (type = 'ec') => {
-    if (type === 'rsa') {
+export var PrivateKeyType;
+(function (PrivateKeyType) {
+    PrivateKeyType["RSA"] = "rsa";
+    PrivateKeyType["EC"] = "ec";
+})(PrivateKeyType || (PrivateKeyType = {}));
+export const generateOidcPrivateKey = async (type = PrivateKeyType.EC) => {
+    if (type === PrivateKeyType.RSA) {
         const { privateKey } = await promisify(generateKeyPair)('rsa', {
             modulusLength: 4096,
             publicKeyEncoding: {
@@ -17,7 +22,7 @@ export const generateOidcPrivateKey = async (type = 'ec') => {
         return privateKey;
     }
     // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition
-    if (type === 'ec') {
+    if (type === PrivateKeyType.EC) {
         const { privateKey } = await promisify(generateKeyPair)('ec', {
             // https://security.stackexchange.com/questions/78621/which-elliptic-curve-should-i-use
             namedCurve: 'secp384r1',

package/lib/connector/utils.d.ts

@@ -1,10 +1,10 @@
-import type { AllConnector, BaseConnector, ConnectorMetadata, GetConnectorConfig } from '@logto/connector-kit';
+import type { AllConnector, BaseConnector, ConnectorMetadata, GetConnectorConfig, GetCloudServiceClient } from '@logto/connector-kit';
 import { ConnectorType } from '@logto/connector-kit';
 import type { ConnectorFactory } from './types.js';
 export declare function validateConnectorModule(connector: Partial<BaseConnector<ConnectorType>>): asserts connector is BaseConnector<ConnectorType>;
-export declare const readUrl: (url: string, baseUrl: string, type: 'text' | 'svg') => Promise<string>;
+export declare const readUrl: (url: string, baseUrl: string, type: 'text' | 'image') => Promise<string>;
 export declare const parseMetadata: (metadata: AllConnector['metadata'], packagePath: string) => Promise<AllConnector['metadata']>;
-export declare const buildRawConnector: <T extends AllConnector = AllConnector>(connectorFactory: ConnectorFactory<T>, getConnectorConfig?: GetConnectorConfig) => Promise<{
+export declare const buildRawConnector: <T extends AllConnector = AllConnector>(connectorFactory: ConnectorFactory<T>, getConnectorConfig?: GetConnectorConfig, getCloudServiceClient?: GetCloudServiceClient) => Promise<{
     rawConnector: T;
     rawMetadata: ConnectorMetadata;
 }>;

package/lib/connector/utils.js

@@ -2,6 +2,7 @@ import { existsSync } from 'node:fs';
 import { readFile } from 'node:fs/promises';
 import path from 'node:path';
 import { ConnectorError, ConnectorErrorCodes, ConnectorType } from '@logto/connector-kit';
+import { consoleLog } from '../utils.js';
 import { notImplemented } from './consts.js';
 export function validateConnectorModule(connector) {
     if (!connector.metadata) {
@@ -14,6 +15,11 @@ export function validateConnectorModule(connector) {
         throw new ConnectorError(ConnectorErrorCodes.UnexpectedType);
     }
 }
+const supportedImageTypes = Object.freeze({
+    '.svg': 'image/svg+xml',
+    '.png': 'image/png',
+});
+const isSupportedImageType = (extension) => Object.keys(supportedImageTypes).includes(extension);
 export const readUrl = async (url, baseUrl, type) => {
     if (!url) {
         return url;
@@ -24,25 +30,32 @@ export const readUrl = async (url, baseUrl, type) => {
     if (!existsSync(path.join(baseUrl, url))) {
         return url;
     }
-    if (type === 'svg') {
-        const data = await readFile(path.join(baseUrl, url));
-        return `data:image/svg+xml;base64,${data.toString('base64')}`;
+    if (type === 'image') {
+        const filePath = path.join(baseUrl, url);
+        const extension = path.extname(filePath);
+        if (!isSupportedImageType(extension)) {
+            consoleLog.warn(`[readUrl] unexpected image type: ${filePath}, only support ".svg" and ".png". Falling back to empty string.`);
+            return '';
+        }
+        const data = await readFile(filePath);
+        return `data:${supportedImageTypes[extension]};base64,${data.toString('base64')}`;
     }
     return readFile(path.join(baseUrl, url), 'utf8');
 };
 export const parseMetadata = async (metadata, packagePath) => {
     return {
         ...metadata,
-        logo: await readUrl(metadata.logo, packagePath, 'svg'),
-        logoDark: metadata.logoDark && (await readUrl(metadata.logoDark, packagePath, 'svg')),
+        logo: await readUrl(metadata.logo, packagePath, 'image'),
+        logoDark: metadata.logoDark && (await readUrl(metadata.logoDark, packagePath, 'image')),
         readme: await readUrl(metadata.readme, packagePath, 'text'),
         configTemplate: metadata.configTemplate && (await readUrl(metadata.configTemplate, packagePath, 'text')),
     };
 };
-export const buildRawConnector = async (connectorFactory, getConnectorConfig) => {
+export const buildRawConnector = async (connectorFactory, getConnectorConfig, getCloudServiceClient) => {
     const { createConnector, path: packagePath } = connectorFactory;
     const rawConnector = await createConnector({
         getConfig: getConnectorConfig ?? notImplemented,
+        getCloudServiceClient,
     });
     validateConnectorModule(rawConnector);
     const rawMetadata = await parseMetadata(rawConnector.metadata, packagePath);

package/lib/package-json.js

@@ -1,6 +1,6 @@
 export const packageJson = {
     "name": "@logto/cli",
-    "version": "1.7.0",
+    "version": "1.8.0",
     "description": "Logto CLI.",
     "author": "Silverhand Inc. <contact@silverhand.io>",
     "homepage": "https://github.com/logto-io/logto#readme",
@@ -48,7 +48,7 @@ export const packageJson = {
         "@logto/language-kit": "workspace:^1.0.0",
         "@logto/phrases": "workspace:^1.4.1",
         "@logto/phrases-ui": "workspace:^1.2.0",
-        "@logto/schemas": "workspace:1.7.0",
+        "@logto/schemas": "workspace:1.8.0",
         "@logto/shared": "workspace:^2.0.0",
         "@silverhand/essentials": "^2.5.0",
         "chalk": "^5.0.0",
@@ -61,7 +61,7 @@ export const packageJson = {
         "ora": "^6.1.2",
         "p-limit": "^4.0.0",
         "p-queue": "^7.3.4",
-        "p-retry": "^5.1.2",
+        "p-retry": "^6.0.0",
         "pg-protocol": "^1.6.0",
         "roarr": "^7.11.0",
         "semver": "^7.3.8",
@@ -85,7 +85,7 @@ export const packageJson = {
         "@types/yargs": "^17.0.13",
         "eslint": "^8.44.0",
         "jest": "^29.5.0",
-        "lint-staged": "^13.0.0",
+        "lint-staged": "^14.0.0",
         "prettier": "^3.0.0",
         "sinon": "^15.0.0"
     },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@logto/cli",
-  "version": "1.7.0",
+  "version": "1.8.0",
   "description": "Logto CLI.",
   "author": "Silverhand Inc. <contact@silverhand.io>",
   "homepage": "https://github.com/logto-io/logto#readme",
@@ -33,7 +33,7 @@
     "@logto/language-kit": "^1.0.0",
     "@logto/phrases": "^1.4.1",
     "@logto/phrases-ui": "^1.2.0",
-    "@logto/schemas": "1.7.0",
+    "@logto/schemas": "1.8.0",
     "@logto/shared": "^2.0.0",
     "@silverhand/essentials": "^2.5.0",
     "chalk": "^5.0.0",
@@ -46,7 +46,7 @@
     "ora": "^6.1.2",
     "p-limit": "^4.0.0",
     "p-queue": "^7.3.4",
-    "p-retry": "^5.1.2",
+    "p-retry": "^6.0.0",
     "pg-protocol": "^1.6.0",
     "roarr": "^7.11.0",
     "semver": "^7.3.8",
@@ -70,7 +70,7 @@
     "@types/yargs": "^17.0.13",
     "eslint": "^8.44.0",
     "jest": "^29.5.0",
-    "lint-staged": "^13.0.0",
+    "lint-staged": "^14.0.0",
     "prettier": "^3.0.0",
     "sinon": "^15.0.0"
   },