@mesh-tech/mesh-cli 0.20.0 → 0.20.1

package/README.md

@@ -64,7 +64,9 @@ trip).
 **If your account does not hold the grant yet**, the command tells you so and
 prints the access-request URL the platform returned (or names the admin to
 ask). Contact your Mesh contact to have **registry access granted to your
-user**, then run `mesh registry login` again.
+user**, then run `mesh registry login` again — it re-mints your sign-in so the
+new role is in the token the broker sees. If it still says not authorized,
+start a fresh sign-in: `mesh registry logout && mesh registry login`.
 
 Everything after this point — installing `@mesh-tech/*` packages, scaffolding
 an app, and the local docs server — depends on this step. `mesh init` (next)
@@ -241,8 +243,10 @@ everywhere else.
 
 Your account and session are fine; you don't hold the registry grant yet. The
 message names the request URL (or the admin to ask) — see
-[step 2](#2-get-registry-access). Once granted, `mesh registry login` again;
-your sign-in is kept.
+[step 2](#2-get-registry-access). Once granted, `mesh registry login` again —
+it re-mints your sign-in so the new role reaches the broker (a role only rides
+in tokens issued after it was granted). Still refused?
+`mesh registry logout && mesh registry login` starts a fresh sign-in.
 
 ### `No registry access on this machine — @mesh-tech packages cannot be installed.`
 

package/dist/bin/mesh.js

@@ -3274,6 +3274,7 @@ __export(login_exports, {
   discoverConfigForContext: () => discoverConfigForContext,
   discoverConfigFromWellKnown: () => discoverConfigFromWellKnown,
   ensureLogin: () => ensureLogin,
+  forceRefreshToken: () => forceRefreshToken,
   getContextConfig: () => getContextConfig,
   getValidToken: () => getValidToken,
   isRemoteEnvironment: () => isRemoteEnvironment,
@@ -3993,22 +3994,43 @@ async function getValidToken(context, opts = {}) {
   if (tokenStillValid(creds.expiresAt, opts.marginMs ?? 0)) {
     return creds.idToken;
   }
+  return remintToken(context, config, creds);
+}
+async function remintToken(context, config, creds) {
   if (!creds.refreshToken) return null;
+  let tokens;
+  try {
+    tokens = await refreshTokens(config.issuer, config.clientId, creds.refreshToken);
+  } catch {
+    return null;
+  }
+  let email = creds.email;
+  try {
+    email = decodeJwtPayload(tokens.id_token).email ?? creds.email;
+  } catch {
+  }
   try {
-    const tokens = await refreshTokens(config.issuer, config.clientId, creds.refreshToken);
-    const idPayload = decodeJwtPayload(tokens.id_token);
     writeCredentials(context, {
       ...creds,
       idToken: tokens.id_token,
       accessToken: tokens.access_token,
       refreshToken: tokens.refresh_token ?? creds.refreshToken,
       expiresAt: new Date(Date.now() + tokens.expires_in * 1e3).toISOString(),
-      email: idPayload.email ?? creds.email
+      email
     });
-    return tokens.id_token;
-  } catch {
-    return null;
+  } catch (err) {
+    logWarn(
+      `The refreshed ${context} session could not be cached (${err instanceof Error ? err.message : String(err)}) \u2014 this run continues on the new token, but the next one may need a fresh sign-in.`
+    );
   }
+  return tokens.id_token;
+}
+async function forceRefreshToken(context) {
+  const config = getContextConfig(context);
+  if (!config) return null;
+  const creds = readCredentials(context);
+  if (!creds) return null;
+  return remintToken(context, config, creds);
 }
 async function probeCredentials(context, roleArn) {
   const cached = readCredentials(context);
@@ -4376,7 +4398,9 @@ __export(registry_identity_exports, {
   isReservedRegistryContext: () => isReservedRegistryContext,
   logRegistryIdentity: () => logRegistryIdentity,
   readRegistrySession: () => readRegistrySession,
+  refreshRegistrySession: () => refreshRegistrySession,
   registrySessionCandidates: () => registrySessionCandidates,
+  registryTokenRoles: () => registryTokenRoles,
   resolveRegistryIdentity: () => resolveRegistryIdentity
 });
 function isReservedRegistryContext(context) {
@@ -4480,6 +4504,22 @@ async function ensureRegistrySession(opts) {
     expiresAt: creds.expiresAt
   };
 }
+function registryTokenRoles(idToken) {
+  if (!idToken) return [];
+  try {
+    return projectRoleKeys(decodeJwtPayload(idToken)).sort();
+  } catch {
+    return [];
+  }
+}
+async function refreshRegistrySession(context) {
+  const before = registryTokenRoles(readCredentials(context)?.idToken);
+  const idToken = await forceRefreshToken(context);
+  if (!idToken) return { reminted: false, rolesChanged: false };
+  const after = registryTokenRoles(idToken);
+  const same = after.length === before.length && after.every((role, i) => role === before[i]);
+  return { reminted: true, rolesChanged: !same };
+}
 function clearRegistrySession() {
   clearCredentials(REGISTRY_CREDENTIAL_KEY);
   clearContextConfig(REGISTRY_CREDENTIAL_KEY);
@@ -4508,6 +4548,7 @@ var init_registry_identity = __esm({
   "libs/mesh-cli/src/utils/registry-identity.ts"() {
     "use strict";
     init_login();
+    init_aws_auth();
     init_first_party_contexts();
     init_registry_broker();
     init_errors();
@@ -4985,16 +5026,20 @@ function selectRoleForCaller(idToken, options) {
   const adminRoles = options.adminClaimRoles ?? ["mesh.platform:admin"];
   const claims = decodeJwtPayload2(idToken);
   if (!claims) return options.defaultRole;
+  const claimedRoles = projectRoleKeys(claims);
+  return adminRoles.some((target) => claimedRoles.includes(target)) ? options.adminRole : options.defaultRole;
+}
+function projectRoleKeys(claims) {
+  const names = /* @__PURE__ */ new Set();
   for (const [key, value] of Object.entries(claims)) {
     if (!key.startsWith("urn:zitadel:iam:org:project:")) continue;
     if (!key.endsWith(":roles")) continue;
-    if (!value || typeof value !== "object") continue;
-    const claimedRoles = Object.keys(value);
-    for (const target of adminRoles) {
-      if (claimedRoles.includes(target)) return options.adminRole;
+    if (!value || typeof value !== "object" || Array.isArray(value)) continue;
+    for (const name of Object.keys(value)) {
+      if (name) names.add(name);
     }
   }
-  return options.defaultRole;
+  return [...names];
 }
 async function resolveAwsCredentials(roleArn, appRoot, stack) {
   const roleName = roleArn.split("/").pop() ?? roleArn;
@@ -10748,6 +10793,11 @@ function scanApp(root, appRel) {
     for (const f of files) hit(code, rel(root, f), why);
   };
   anti("IAC_GRANTS", RE_IAC_GRANT, "per-user role grant baked into IaC \u2014 grants belong in the Hub (Access \u2192 People), not in a config redeploy");
+  anti(
+    "POINTER_PROJECT_OVERRIDE",
+    RE_POINTER_OVERRIDE,
+    "AppAuthzPointer is given a `zitadel:` override \u2014 an app binds its project with AppEnvironment's zitadelAppProjectId so every consumer of env.zitadel agrees; the override is reserved for the Hub"
+  );
   anti(
     "PASSWORD_STORE",
     RE_PASSWORD,
@@ -10857,7 +10907,7 @@ function registerAppCommands(program2) {
     }
   });
 }
-var APP_CHECK_RULES, APP_CHECK_CODES, SRC_EXT, SKIP_DIRS, NON_SERVICE_DIRS, RE_HTML, RE_OIDC, RE_COOKIE, RE_LOGGER, RE_EXPOSURE, RE_POINTER, RE_METADATA, RE_IAC_GRANT, RE_PASSWORD, RE_ALLOWLIST, RE_USERS_TABLE;
+var APP_CHECK_RULES, APP_CHECK_CODES, SRC_EXT, SKIP_DIRS, NON_SERVICE_DIRS, RE_HTML, RE_OIDC, RE_COOKIE, RE_LOGGER, RE_EXPOSURE, RE_POINTER, RE_METADATA, RE_IAC_GRANT, RE_POINTER_OVERRIDE, RE_PASSWORD, RE_ALLOWLIST, RE_USERS_TABLE;
 var init_app_check = __esm({
   "libs/mesh-cli/src/commands/app-check.ts"() {
     "use strict";
@@ -10929,6 +10979,13 @@ var init_app_check = __esm({
         remediation: "remove the per-user grant map; grant roles from the Hub (App \u2192 Access \u2192 People)",
         scope: "app"
       },
+      POINTER_PROJECT_OVERRIDE: {
+        gate: "H",
+        title: "Pointer publishes the env's project",
+        severity: "advisory",
+        remediation: "drop `zitadel:` from AppAuthzPointer and pass `zitadelAppProjectId: identity.projectId` to AppEnvironment \u2014 the override is the Hub's",
+        scope: "app"
+      },
       PASSWORD_STORE: {
         gate: "H",
         title: "No app-side credentials",
@@ -10976,6 +11033,7 @@ var init_app_check = __esm({
     RE_POINTER = /AppAuthzPointer/;
     RE_METADATA = /compileOpsHubMetadata|ops-hub-metadata|SpiceDBSchema/;
     RE_IAC_GRANT = /userId: *"[0-9]{6,}"/;
+    RE_POINTER_OVERRIDE = /\bzitadel: *\{\s*projectId\b/;
     RE_PASSWORD = /(^|[^a-z])(bcrypt|argon2)|password_hash|passwordHash|hashPassword|temporaryPassword.*(send|mail)|(send|mail).*temporaryPassword/;
     RE_ALLOWLIST = /ADMIN_EMAILS|ALLOWED_EMAILS|allowedEmails|adminEmails/;
     RE_USERS_TABLE = /create table (if not exists )?"?(users|roles|user_roles|permissions)"?/i;
@@ -16159,6 +16217,7 @@ __export(registry_exports, {
   resolvePublisherRoleArn: () => resolvePublisherRoleArn,
   runRegistryLogin: () => runRegistryLogin,
   runRegistryStatus: () => runRegistryStatus,
+  shouldRemintAfter: () => shouldRemintAfter,
   shouldRepairUserNpmrc: () => shouldRepairUserNpmrc
 });
 import { execFileSync as execFileSync24 } from "child_process";
@@ -16422,6 +16481,9 @@ function describeBrokerFailure(failure) {
 function registrySignInAllowed(opts, hasTty = Boolean(process.stdin.isTTY && process.stdout.isTTY)) {
   return Boolean(opts.device) || hasTty;
 }
+function shouldRemintAfter(failure) {
+  return failure.kind === "not-authorized";
+}
 async function tryBrokerLogin(opts) {
   if (opts.broker === false) return { outcome: { kind: "skipped-flag", flag: "--no-broker" } };
   if (opts.ci) return { outcome: { kind: "skipped-flag", flag: "--ci" } };
@@ -16461,6 +16523,13 @@ async function tryBrokerLogin(opts) {
       result = await requestGrant(session.context, identity);
     }
   }
+  if (!result.ok && shouldRemintAfter(result.failure)) {
+    const { rolesChanged } = await refreshRegistrySession(session.context);
+    if (rolesChanged) {
+      logInfo("Your sign-in now carries a role it did not have \u2014 retrying\u2026");
+      result = await requestGrant(session.context, identity);
+    }
+  }
   if (result.ok) return { grant: result.grant };
   const { message, hint, fatal } = describeBrokerFailure(result.failure);
   if (fatal) {
@@ -16810,7 +16879,7 @@ var init_registry = __esm({
         this.name = "RegistryNotAuthorizedError";
       }
     };
-    NOT_AUTHORIZED_RERUN = "Once granted, run: mesh registry login   (your sign-in is kept; no second browser trip)";
+    NOT_AUTHORIZED_RERUN = "Once granted, run: mesh registry login   (it re-mints your sign-in; still refused? mesh registry logout && mesh registry login)";
     CONTEXT_IGNORED_NOTICE = "The registry is global \u2014 the context argument is no longer needed (ignored).";
   }
 });
@@ -17776,6 +17845,32 @@ async function ensureHubImages() {
   }
   return version;
 }
+function tarballNameForImageVersion(version) {
+  if (version.endsWith("-src")) return null;
+  return `mesh-tech-hub-${version.replace(/-r\d+$/, "")}.tgz`;
+}
+function readHubCompiledAuthz(version) {
+  const context = path40.join(cacheDir(), `context-${version}`);
+  const file = path40.join(context, HUB_COMPILED_AUTHZ_REL);
+  if (!fs33.existsSync(file)) {
+    const tarball = tarballNameForImageVersion(version);
+    if (!tarball || !fs33.existsSync(path40.join(cacheDir(), tarball))) return null;
+    fs33.mkdirSync(context, { recursive: true });
+    try {
+      execFileSync26(
+        "tar",
+        ["-xzf", path40.join(cacheDir(), tarball), "-C", context, "--strip-components", "1", `package/${HUB_COMPILED_AUTHZ_REL}`],
+        { stdio: ["ignore", "pipe", "pipe"] }
+      );
+    } catch {
+      return null;
+    }
+    if (!fs33.existsSync(file)) return null;
+  }
+  const parsed = JSON.parse(fs33.readFileSync(file, "utf-8"));
+  if (typeof parsed.zed !== "string" || !parsed.metadata || typeof parsed.metadata !== "object") return null;
+  return { zed: parsed.zed, metadata: parsed.metadata };
+}
 function readWorkspaceCatalog(repoRoot2) {
   const text = fs33.readFileSync(path40.join(repoRoot2, "pnpm-workspace.yaml"), "utf-8");
   const marker = "\ncatalog:\n";
@@ -17790,7 +17885,7 @@ function readWorkspaceCatalog(repoRoot2) {
   return catalog;
 }
 function normalizeHubManifests(contextDir, catalog) {
-  const DEP_FIELDS = ["dependencies", "devDependencies", "optionalDependencies", "peerDependencies"];
+  const DEP_FIELDS = ["dependencies", "optionalDependencies", "peerDependencies"];
   const touched = [];
   for (const entry of fs33.readdirSync(contextDir, { withFileTypes: true })) {
     if (!entry.isDirectory()) continue;
@@ -17798,6 +17893,10 @@ function normalizeHubManifests(contextDir, catalog) {
     if (!fs33.existsSync(manifest)) continue;
     const pkg = JSON.parse(fs33.readFileSync(manifest, "utf-8"));
     let changed = false;
+    if (pkg.devDependencies) {
+      delete pkg.devDependencies;
+      changed = true;
+    }
     for (const field of DEP_FIELDS) {
       const deps = pkg[field];
       if (!deps) continue;
@@ -17873,7 +17972,7 @@ async function buildHubImagesFromSource(repoRoot2) {
   }
   return version;
 }
-var execFileAsync2, HUB_PACKAGE, HUB_IMAGES, LOCAL_IMAGE_REV, HUB_AUTH_IMAGE;
+var execFileAsync2, HUB_PACKAGE, HUB_IMAGES, LOCAL_IMAGE_REV, HUB_AUTH_IMAGE, HUB_COMPILED_AUTHZ_REL;
 var init_hub_local = __esm({
   "libs/mesh-cli/src/commands/local/hub-local.ts"() {
     "use strict";
@@ -17887,6 +17986,66 @@ var init_hub_local = __esm({
     HUB_IMAGES = ["mesh-local-hub-api", "mesh-local-hub-ui"];
     LOCAL_IMAGE_REV = "r2";
     HUB_AUTH_IMAGE = "mesh-local-hub-auth:v7.7.1-r1";
+    HUB_COMPILED_AUTHZ_REL = "api/dist/authz/compiled.json";
+  }
+});
+
+// libs/mesh-cli/src/commands/local/seed-hub-catalog.ts
+function withHubCatalogRefs(pointer, metadataRef) {
+  return {
+    spicedb: { instanceRefs: [] },
+    ...pointer,
+    opsHubMetadataRef: metadataRef,
+    mode: typeof pointer.mode === "string" ? pointer.mode : "policy-engine"
+  };
+}
+async function publishHubAuthzCatalog(compiled, awsConfig) {
+  const { SSMClient: SSMClient5, GetParameterCommand: GetParameterCommand2, PutParameterCommand } = await import("@aws-sdk/client-ssm");
+  const ssm = new SSMClient5(awsConfig);
+  await ssm.send(
+    new PutParameterCommand({
+      Name: HUB_OPS_HUB_METADATA_PARAM,
+      Type: "String",
+      // The blob is ~7.5 KB — past the 4 KB standard tier, within Advanced (8 KB),
+      // the tier the platform's Export uses for the same param.
+      Tier: "Advanced",
+      Overwrite: true,
+      Value: JSON.stringify(compiled.metadata),
+      Description: "Hub role catalog \u2014 ops-hub-metadata (local analog of MeshHub's SpiceDBSchema export)"
+    })
+  );
+  let current = {};
+  try {
+    const existing = await ssm.send(new GetParameterCommand2({ Name: HUB_AUTHZ_POINTER_PARAM }));
+    current = JSON.parse(existing.Parameter?.Value ?? "{}");
+  } catch {
+  }
+  await ssm.send(
+    new PutParameterCommand({
+      Name: HUB_AUTHZ_POINTER_PARAM,
+      Type: "String",
+      Overwrite: true,
+      Value: JSON.stringify(withHubCatalogRefs(current, HUB_OPS_HUB_METADATA_PARAM)),
+      Description: "Hub authz pointer (local analog of the platform Pulumi program)"
+    })
+  );
+  return { bundles: catalogBundleNames(compiled.metadata) };
+}
+function catalogBundleNames(metadata) {
+  const bundles = metadata.bundles;
+  if (Array.isArray(bundles)) {
+    return bundles.map((b) => b && typeof b === "object" && typeof b.name === "string" ? b.name : null).filter((n) => n !== null);
+  }
+  if (bundles && typeof bundles === "object") return Object.keys(bundles);
+  return [];
+}
+var HUB_AUTHZ_POINTER_PARAM, HUB_OPS_HUB_METADATA_PARAM;
+var init_seed_hub_catalog = __esm({
+  "libs/mesh-cli/src/commands/local/seed-hub-catalog.ts"() {
+    "use strict";
+    init_seed();
+    HUB_AUTHZ_POINTER_PARAM = `/mesh-platform/${LOCAL_TENANT}/${LOCAL_ENV}/apps/hub/stacks/local/authz`;
+    HUB_OPS_HUB_METADATA_PARAM = `${HUB_AUTHZ_POINTER_PARAM}/ops-hub-metadata`;
   }
 });
 
@@ -18063,6 +18222,17 @@ Re-running start from here may recreate shared containers with this checkout's c
       logInfo("Seeding Zitadel (Platform project, Mesh CLI app, Hub auth, test users)\u2026");
       const zitadel = await seedZitadel(LOCAL_AWS_CONFIG);
       hubAuth = zitadel.hubAuth;
+      if (hubVersion) {
+        const compiled = readHubCompiledAuthz(hubVersion);
+        if (compiled) {
+          const { bundles } = await publishHubAuthzCatalog(compiled, LOCAL_AWS_CONFIG);
+          logSuccess(`Hub role catalog seeded: ${bundles.length} role(s) (${bundles.join(", ")})`);
+        } else {
+          logWarn(
+            `Hub v${hubVersion} ships no compiled role catalog (api/dist/authz/compiled.json) \u2014 Users \u2192 Roles will be empty. Hub \u2265 2.1.0 publishes one.`
+          );
+        }
+      }
       try {
         const reconciled = await reconcileRegistryFromZitadel();
         if (reconciled.tenants.length > 0) {
@@ -18230,6 +18400,7 @@ var init_local = __esm({
     init_auth_provision();
     init_seed();
     init_seed_zitadel();
+    init_seed_hub_catalog();
     WAIT_TIMEOUT_MS = 18e4;
     WAIT_POLL_MS = 3e3;
   }