@m8t-stack/cli 0.2.73 → 0.2.74

package/dist/cli.js

@@ -81,6 +81,17 @@ var init_reasons = __esm({
   }
 });
 
+// ../../packages/api-contract/dist/esm/delegated-identity.js
+var SERVICE_APP_ROLE, END_USER_KEY_MAX_LENGTH, END_USER_KEY_PATTERN;
+var init_delegated_identity = __esm({
+  "../../packages/api-contract/dist/esm/delegated-identity.js"() {
+    "use strict";
+    SERVICE_APP_ROLE = "Agents.Invoke";
+    END_USER_KEY_MAX_LENGTH = 200;
+    END_USER_KEY_PATTERN = new RegExp(`^[A-Za-z0-9._-]{1,${String(END_USER_KEY_MAX_LENGTH)}}$`);
+  }
+});
+
 // ../../packages/api-contract/dist/esm/team.js
 var init_team = __esm({
   "../../packages/api-contract/dist/esm/team.js"() {
@@ -224,6 +235,7 @@ var init_esm = __esm({
     init_response();
     init_errors2();
     init_reasons();
+    init_delegated_identity();
     init_team();
     init_me();
     init_binding();
@@ -1370,7 +1382,7 @@ var init_enable_hosted_brain = __esm({
 import { Builtins, Cli } from "clipanion";
 
 // src/lib/package-version.ts
-var CLI_VERSION = "0.2.73";
+var CLI_VERSION = "0.2.74";
 
 // src/lib/render-error.ts
 init_errors();
@@ -23333,6 +23345,7 @@ var PlatformEnableAutoUpdateCommand = class extends M8tCommand {
 import { Command as Command42, Option as Option39 } from "clipanion";
 
 // src/lib/app-reg.ts
+init_esm();
 init_errors();
 var APP_NAME = "m8t-webapp";
 var AZURE_CLI_FIRST_PARTY_APP_ID = "04b07795-8ddb-461a-bbee-02f9e1bf7b46";
@@ -23433,6 +23446,52 @@ async function ensureExposeAnApi(appId, appObjectId) {
     ]);
   }
 }
+async function ensureServiceAppRole(appId, appObjectId) {
+  const existingRoles = await azJson([
+    "ad",
+    "app",
+    "show",
+    "--id",
+    appId,
+    "--query",
+    "appRoles",
+    "--output",
+    "json"
+  ]);
+  if (!Array.isArray(existingRoles)) {
+    throw new LocalCliError({
+      code: "APP_REG_ROLES_UNREADABLE",
+      message: `Could not read the existing app roles on app registration ${appId}.`,
+      hint: "Re-run once you can read the app registration; writing the role now would risk replacing roles we cannot see."
+    });
+  }
+  const already = existingRoles.find((r) => r.value === SERVICE_APP_ROLE);
+  if (already && already.isEnabled !== false) return;
+  const appRoles = already ? existingRoles.map((r) => r.value === SERVICE_APP_ROLE ? { ...r, isEnabled: true } : r) : [
+    ...existingRoles,
+    {
+      id: globalThis.crypto.randomUUID(),
+      displayName: "Invoke agents",
+      description: "Allows a service principal to call the gateway agent API.",
+      value: SERVICE_APP_ROLE,
+      allowedMemberTypes: ["Application"],
+      isEnabled: true
+    }
+  ];
+  await runAz([
+    "rest",
+    "--method",
+    "PATCH",
+    // The OBJECT id, not the app id: Graph's /applications/{id} addresses the
+    // object id, and an appId here is a 404.
+    "--url",
+    `https://graph.microsoft.com/v1.0/applications/${appObjectId}`,
+    "--headers",
+    "Content-Type=application/json",
+    "--body",
+    JSON.stringify({ appRoles })
+  ]);
+}
 async function ensureAppReg(opts) {
   if (opts.clientId) {
     return { tenantId: opts.tenantId, clientId: opts.clientId, appObjectId: null };
@@ -23452,6 +23511,7 @@ async function ensureAppReg(opts) {
       });
     }
     await ensureExposeAnApi(app.appId, objId);
+    await ensureServiceAppRole(app.appId, objId);
     return { tenantId: opts.tenantId, clientId: app.appId, appObjectId: objId };
   }
   const me = await azJson(
@@ -23563,6 +23623,7 @@ async function ensureAppReg(opts) {
     })
   ]);
   await ensureExposeAnApi(created.appId, created.id);
+  await ensureServiceAppRole(created.appId, created.id);
   return { tenantId: opts.tenantId, clientId: created.appId, appObjectId: created.id };
 }
 async function ensureGatewayRedirectUri(gatewayClientId, fqdn) {