@m8t-stack/cli 0.2.24 → 0.2.26

package/dist/cli.js

@@ -604,6 +604,22 @@ async function authedJsonResult(args) {
 async function authedJson(args) {
   return (await authedJsonResult(args)).data;
 }
+async function authedJsonPagedValues(args) {
+  const maxPages = args.maxPages ?? 100;
+  const items = [];
+  let url = args.url;
+  for (let page = 0; url && page < maxPages; page++) {
+    const body = await authedJson({
+      credential: args.credential,
+      scope: args.scope,
+      method: "GET",
+      url
+    });
+    items.push(...body?.value ?? []);
+    url = body?.nextLink;
+  }
+  return items;
+}
 var init_http = __esm({
   "src/lib/http.ts"() {
     "use strict";
@@ -1231,7 +1247,7 @@ var init_enable_hosted_brain = __esm({
 import { Builtins, Cli } from "clipanion";
 
 // src/lib/package-version.ts
-var CLI_VERSION = "0.2.24";
+var CLI_VERSION = "0.2.26";
 
 // src/lib/render-error.ts
 init_errors();
@@ -13663,23 +13679,22 @@ var ACCOUNTS_API = "2024-10-01";
 var PROJECTS_API = "2025-04-01-preview";
 async function listProjectsForAccount(credential2, accountId) {
   const url = `${ARM}${accountId}/projects?api-version=${PROJECTS_API}`;
-  return await authedJson({ credential: credential2, scope: ARM_SCOPE2, method: "GET", url }) ?? {};
+  return await authedJsonPagedValues({ credential: credential2, scope: ARM_SCOPE2, url });
 }
 function formatProjectCandidate(c) {
   return `${c.projectName} (account=${c.accountName}, ${c.region})`;
 }
 async function resolveFoundryProject(opts) {
   const candidates = [];
-  const accounts = await authedJson({
+  const accounts = await authedJsonPagedValues({
     credential: opts.credential,
     scope: ARM_SCOPE2,
-    method: "GET",
     url: `${ARM}/subscriptions/${opts.subscriptionId}/providers/Microsoft.CognitiveServices/accounts?api-version=${ACCOUNTS_API}`
-  }) ?? {};
-  for (const acc of accounts.value ?? []) {
+  });
+  for (const acc of accounts) {
     if (acc.kind !== "AIServices" || !acc.name || !acc.id) continue;
     const projects = await listProjectsForAccount(opts.credential, acc.id);
-    for (const proj of projects.value ?? []) {
+    for (const proj of projects) {
       if (!proj.name) continue;
       const projectName = proj.name.includes("/") ? proj.name.slice(proj.name.lastIndexOf("/") + 1) : proj.name;
       candidates.push({
@@ -20645,6 +20660,19 @@ async function ensureAppReg(opts) {
   await ensureExposeAnApi(created.appId, created.id);
   return { tenantId: opts.tenantId, clientId: created.appId, appObjectId: created.id };
 }
+async function ensureGatewayRedirectUri(gatewayClientId, fqdn) {
+  const appObjectId = await azJson(
+    ["ad", "app", "show", "--id", gatewayClientId, "--query", "id", "--output", "json"]
+  );
+  if (!appObjectId) {
+    throw new LocalCliError({
+      code: "APP_REG_OBJECT_ID_MISSING",
+      message: `Could not resolve the object ID for app registration ${gatewayClientId}.`,
+      hint: "You need directory read access to the app registration the gateway signs in against."
+    });
+  }
+  await patchRedirectUris(appObjectId, fqdn);
+}
 async function patchRedirectUris(appObjectId, fqdn) {
   const targetUri = `https://${fqdn}`;
   const existing = await azJson(
@@ -24418,13 +24446,12 @@ var STORAGE_API2 = "2023-05-01";
 var LA_API = "2023-09-01";
 async function discoverLedgerResources(opts) {
   const { credential: credential2, subscriptionId, resourceGroup } = opts;
-  const storage = await authedJson({
+  const storage = await authedJsonPagedValues({
     credential: credential2,
     scope: ARM_SCOPE8,
-    method: "GET",
     url: `${ARM4}/subscriptions/${subscriptionId}/resourceGroups/${resourceGroup}/providers/Microsoft.Storage/storageAccounts?api-version=${STORAGE_API2}`
-  }) ?? {};
-  const accounts = (storage.value ?? []).filter((a) => a.properties?.primaryEndpoints?.table);
+  });
+  const accounts = storage.filter((a) => a.properties?.primaryEndpoints?.table);
   const ledgerAcct = accounts.find((a) => (a.tags?.["m8t-stack:role"] ?? a.properties?.tags?.["m8t-stack:role"]) === "ledger") ?? (accounts.length === 1 ? accounts[0] : void 0);
   const ledgerTableEndpoint = ledgerAcct?.properties?.primaryEndpoints?.table?.replace(/\/$/, "");
   if (!ledgerTableEndpoint) {
@@ -24434,13 +24461,11 @@ async function discoverLedgerResources(opts) {
       hint: `Found: ${accounts.map((a) => a.name).join(", ") || "(none)"}. Tag the ledger account 'm8t-stack:role=ledger'.`
     });
   }
-  const laList = await authedJson({
+  const ws = await authedJsonPagedValues({
     credential: credential2,
     scope: ARM_SCOPE8,
-    method: "GET",
     url: `${ARM4}/subscriptions/${subscriptionId}/resourceGroups/${resourceGroup}/providers/Microsoft.OperationalInsights/workspaces?api-version=${LA_API}`
-  }) ?? {};
-  const ws = laList.value ?? [];
+  });
   const workspaceId = (ws.length === 1 ? ws[0] : ws.find((w) => w.properties?.customerId))?.properties?.customerId;
   if (!workspaceId) {
     throw new LocalCliError({
@@ -25653,7 +25678,7 @@ async function writeBootstrapState(state, home = os13.homedir()) {
 // src/commands/bootstrap/launch.ts
 var DEFAULT_RG = "rg-m8t-stack";
 var DEFAULT_INSTALLER = "ghcr.io/m8t-labs/m8t-installer";
-var DEFAULT_INSTALLER_TAG = "v0.1.31";
+var DEFAULT_INSTALLER_TAG = "v0.1.32";
 var ACI_NAME = "m8t-installer";
 var MI_NAME = "m8t-installer-mi";
 var BootstrapLaunchCommand = class extends M8tCommand {
@@ -25664,8 +25689,8 @@ var BootstrapLaunchCommand = class extends M8tCommand {
     examples: [
       ["Launch in eastus2", "$0 bootstrap launch --location eastus2"],
       ["BYO app registration", "$0 bootstrap launch --location eastus2 --client-id <appId>"],
-      ["Pin a specific installer tag", "$0 bootstrap launch --location eastus2 --installer-tag v0.1.31"],
-      ["Override the full installer image ref", "$0 bootstrap launch --location eastus2 --installer-image ghcr.io/m8t-labs/m8t-installer:v0.1.31"]
+      ["Pin a specific installer tag", "$0 bootstrap launch --location eastus2 --installer-tag v0.1.32"],
+      ["Override the full installer image ref", "$0 bootstrap launch --location eastus2 --installer-image ghcr.io/m8t-labs/m8t-installer:v0.1.32"]
     ]
   });
   location = Option46.String("--location");
@@ -26461,6 +26486,20 @@ var BootstrapFinishCommand = class extends M8tCommand {
 
 `
       );
+      try {
+        await ensureGatewayRedirectUri(d.gatewayClientId, new URL(d.gatewayUrl).host);
+      } catch (e) {
+        const err = e;
+        this.context.stderr.write(
+          `  ${colors.error("\u26A0 could not authorize sign-in for your webapp:")} ${err.message}
+  ${colors.hint(`Until this is fixed, opening ${d.gatewayUrl} will fail with AADSTS50011 (redirect URI mismatch).`)}
+  ${colors.hint("Ask a directory admin to run:")}
+  ${colors.hint(`    m8t bootstrap finish --repo-root ${repoRoot}   # (as an admin), or by hand:`)}
+  ${colors.hint(`    az ad app update --id ${d.gatewayClientId} --set spa.redirectUris="['${d.gatewayUrl}']"  # (merge, do not overwrite)`)}
+
+`
+        );
+      }
     } catch (e) {
       const err = e;
       this.context.stdout.write(`${colors.success("\u2705 The platform is live.")}