@mesh-tech/mesh-cli 0.28.0 → 0.30.0

package/dist/src/commands/login.js

@@ -13,7 +13,21 @@ const CONFIG_FILE = path.join(CONFIG_DIR, "config.json");
 const CREDENTIALS_FILE = path.join(CONFIG_DIR, "credentials.json");
 const REDIRECT_PORT = 9876;
 const REDIRECT_URI = `http://localhost:${REDIRECT_PORT}/callback`;
-const SCOPES = "openid email profile offline_access urn:zitadel:iam:org:project:id:zitadel:aud";
+const BASE_SCOPES = "openid email profile offline_access urn:zitadel:iam:org:project:id:zitadel:aud";
+export function loginScopes(config) {
+    return config.hubProjectId
+        ? `${BASE_SCOPES} urn:zitadel:iam:org:project:id:${config.hubProjectId}:aud`
+        : BASE_SCOPES;
+}
+export function withDiscoveredFields(config, data) {
+    const out = { ...config };
+    for (const key of ["vpn", "vpnJoinBroker", "registryBroker", "hubProjectId"]) {
+        const value = data[key];
+        if (typeof value === "string" && value)
+            out[key] = value;
+    }
+    return out;
+}
 function readConfig() {
     if (!fs.existsSync(CONFIG_FILE))
         return {};
@@ -48,13 +62,14 @@ function parseTenantEnv(context) {
         return null;
     return { tenant: parts[0], env: parts[1] };
 }
-async function discoverConfigFromSsm(context) {
+async function discoverConfigFromSsm(context, opts = {}) {
     const parsed = parseTenantEnv(context);
     if (!parsed)
         return null;
     const { tenant, env } = parsed;
     const ssmPath = `/mesh-platform/${tenant}/${env}/platform/zitadel`;
-    logInfo(`Attempting SSM discovery from ${ssmPath}...`);
+    if (!opts.quiet)
+        logInfo(`Attempting SSM discovery from ${ssmPath}...`);
     try {
         const { SSMClient, GetParameterCommand } = await import("@aws-sdk/client-ssm");
         const region = process.env.AWS_REGION ?? process.env.AWS_DEFAULT_REGION ?? "us-east-2";
@@ -62,34 +77,36 @@ async function discoverConfigFromSsm(context) {
         const resp = await ssm.send(new GetParameterCommand({ Name: ssmPath }));
         const raw = resp.Parameter?.Value;
         if (!raw) {
-            logWarn(`SSM parameter ${ssmPath} has no value`);
+            if (!opts.silent)
+                logWarn(`SSM parameter ${ssmPath} has no value`);
             return null;
         }
         const data = JSON.parse(raw);
         const issuer = data.endpoint;
         const clientId = data.cliClientId;
         if (typeof issuer !== "string" || !issuer) {
-            logWarn("SSM zitadel entry missing 'endpoint' field");
+            if (!opts.silent)
+                logWarn("SSM zitadel entry missing 'endpoint' field");
             return null;
         }
         if (typeof clientId !== "string" || !clientId) {
-            logWarn("SSM zitadel entry missing 'cliClientId' field.\n" +
-                "  The platform needs to be deployed with an updated ZitadelPlatformIdentity\n" +
-                "  that exports cliClientId. Until then, contact your platform admin.");
+            if (!opts.silent) {
+                logWarn("SSM zitadel entry missing 'cliClientId' field.\n" +
+                    "  The platform needs to be deployed with an updated ZitadelPlatformIdentity\n" +
+                    "  that exports cliClientId. Until then, contact your platform admin.");
+            }
             return null;
         }
-        const config = { issuer, clientId };
-        if (typeof data.vpn === "string")
-            config.vpn = data.vpn;
-        if (typeof data.vpnJoinBroker === "string")
-            config.vpnJoinBroker = data.vpnJoinBroker;
-        if (typeof data.registryBroker === "string")
-            config.registryBroker = data.registryBroker;
+        const config = withDiscoveredFields({ issuer, clientId }, data);
+        if (opts.quiet)
+            return config;
         writeContextConfig(context, config);
         logSuccess(`Discovered platform configuration for ${context} via SSM`);
         return config;
     }
     catch (err) {
+        if (opts.silent)
+            return null;
         const message = err instanceof Error ? err.message : String(err);
         if (message.includes("ExpiredToken") || message.includes("credentials")) {
             logWarn(`SSM discovery failed: AWS credentials expired or unavailable.`);
@@ -121,23 +138,19 @@ async function discoverConfig(domain, contextKey = domain, opts = {}) {
         const resp = await fetch(url, { signal: controller.signal });
         clearTimeout(timeout);
         if (!resp.ok) {
-            logWarn(`Discovery endpoint returned ${resp.status}`);
+            if (!opts.silent)
+                logWarn(`Discovery endpoint returned ${resp.status}`);
             return null;
         }
         const data = (await resp.json());
         const issuer = data.issuer;
         const clientId = data.clientId;
         if (typeof issuer !== "string" || !issuer || typeof clientId !== "string" || !clientId) {
-            logWarn("Discovery endpoint returned invalid config (missing issuer or clientId)");
+            if (!opts.silent)
+                logWarn("Discovery endpoint returned invalid config (missing issuer or clientId)");
             return null;
         }
-        const config = { issuer, clientId };
-        if (typeof data.vpn === "string")
-            config.vpn = data.vpn;
-        if (typeof data.vpnJoinBroker === "string")
-            config.vpnJoinBroker = data.vpnJoinBroker;
-        if (typeof data.registryBroker === "string")
-            config.registryBroker = data.registryBroker;
+        const config = withDiscoveredFields({ issuer, clientId }, data);
         if (!opts.quiet) {
             writeContextConfig(contextKey, config);
             logSuccess(`Discovered platform configuration for ${contextKey}`);
@@ -145,6 +158,8 @@ async function discoverConfig(domain, contextKey = domain, opts = {}) {
         return config;
     }
     catch (err) {
+        if (opts.silent)
+            return null;
         const message = err instanceof Error ? err.message : String(err);
         if (message.includes("abort")) {
             logWarn("Discovery timed out");
@@ -260,7 +275,7 @@ function login(context, config) {
         authUrl.searchParams.set("client_id", config.clientId);
         authUrl.searchParams.set("redirect_uri", REDIRECT_URI);
         authUrl.searchParams.set("response_type", "code");
-        authUrl.searchParams.set("scope", SCOPES);
+        authUrl.searchParams.set("scope", loginScopes(config));
         authUrl.searchParams.set("code_challenge", codeChallenge);
         authUrl.searchParams.set("code_challenge_method", "S256");
         authUrl.searchParams.set("state", state);
@@ -385,7 +400,7 @@ async function attemptDeviceCode(context, config) {
         headers: { "Content-Type": "application/x-www-form-urlencoded" },
         body: new URLSearchParams({
             client_id: config.clientId,
-            scope: SCOPES,
+            scope: loginScopes(config),
         }).toString(),
     });
     if (!resp.ok) {
@@ -606,9 +621,11 @@ async function showStatus(context, config) {
         return;
     }
     let tenants = [];
+    let audience = [];
     try {
         const accessPayload = decodeJwtPayload(creds.accessToken);
         tenants = accessPayload["urn:mesh:tenants"] ?? [];
+        audience = tokenAudience(accessPayload);
     }
     catch {
     }
@@ -618,6 +635,26 @@ async function showStatus(context, config) {
     if (tenants.length > 0) {
         logInfo(`Deployable tenants: ${tenants.join(", ")}`);
     }
+    if (audience.length > 0) {
+        logInfo(`Audience: ${audience.join(", ")}`);
+        if (config.hubProjectId && !audience.includes(config.hubProjectId)) {
+            logWarn(`This session does not carry the Hub project audience (${config.hubProjectId}); ` +
+                `a Hub that enforces its audience will refuse it. Re-run: mesh login ${context}`);
+        }
+    }
+    if (!config.hubProjectId) {
+        logInfo(`Hub project: not in this context's discovery record, so this session was requested without ` +
+            `a Hub audience — a Hub that enforces its audience would refuse it. ` +
+            `\`mesh login ${context}\` re-checks what the platform publishes.`);
+    }
+}
+export function tokenAudience(payload) {
+    const aud = payload.aud;
+    if (typeof aud === "string")
+        return [aud];
+    if (Array.isArray(aud))
+        return aud.filter((a) => typeof a === "string");
+    return [];
 }
 export function registerLoginCommand(program) {
     program
@@ -657,6 +694,7 @@ export function registerLoginCommand(program) {
         if (opts.registry === false) {
             logWarn(NO_REGISTRY_DEPRECATED);
         }
+        config = await adoptPublishedHubProject(context, config);
         try {
             await runLoginFlow(context, config, opts);
         }
@@ -872,8 +910,9 @@ async function ensureValidToken(context, config, opts) {
     if (token)
         return token;
     logInfo(`No valid Zitadel session for ${context} — running login flow`);
+    const adopted = await adoptPublishedHubProject(context, config);
     try {
-        await runLoginFlow(context, config, opts);
+        await runLoginFlow(context, adopted, opts);
     }
     catch (err) {
         logError(`Login failed: ${err.message}`);
@@ -897,23 +936,36 @@ export async function ensureLogin(context, opts = {}) {
         return null;
     return readCredentials(context);
 }
-async function discoverConfigGuarded(context) {
+async function discoverConfigGuarded(context, opts = {}) {
     let config = null;
     if (parseTenantEnv(context)) {
-        config = await discoverConfigFromSsm(context);
+        config = await discoverConfigFromSsm(context, opts);
     }
     if (!config) {
         const pinned = firstPartyDomainFor(context);
         if (pinned) {
-            logInfo(`"${context}" is a known Mesh platform — resolving via ${pinned} (no AWS needed)`);
-            config = await discoverConfig(pinned, context);
+            if (!opts.quiet) {
+                logInfo(`"${context}" is a known Mesh platform — resolving via ${pinned} (no AWS needed)`);
+            }
+            config = await discoverConfig(pinned, context, opts);
         }
     }
     if (!config && context.split(".").length - 1 >= 2) {
-        config = await discoverConfig(context);
+        config = await discoverConfig(context, context, opts);
     }
     return config;
 }
+export async function adoptPublishedHubProject(context, config, discover = discoverConfigGuarded, write = writeContextConfig) {
+    if (config.hubProjectId)
+        return config;
+    const fresh = await discover(context, { quiet: true, silent: true });
+    if (!fresh?.hubProjectId)
+        return config;
+    const merged = { ...config, hubProjectId: fresh.hubProjectId };
+    write(context, merged);
+    logInfo(`${context} publishes its Hub project (${fresh.hubProjectId}) — requesting the Hub audience for this login`);
+    return merged;
+}
 async function exportAwsCredentials(context, config, opts) {
     const token = await ensureValidToken(context, config, opts);
     if (!token) {

package/dist/src/commands/temporal.js

@@ -816,6 +816,17 @@ import * as crypto from "crypto";
 import * as fs2 from "fs";
 import * as path2 from "path";
 import { execFileSync as execFileSync4 } from "child_process";
+function loginScopes(config) {
+  return config.hubProjectId ? `${BASE_SCOPES} urn:zitadel:iam:org:project:id:${config.hubProjectId}:aud` : BASE_SCOPES;
+}
+function withDiscoveredFields(config, data) {
+  const out = { ...config };
+  for (const key of ["vpn", "vpnJoinBroker", "registryBroker", "hubProjectId"]) {
+    const value = data[key];
+    if (typeof value === "string" && value) out[key] = value;
+  }
+  return out;
+}
 function readConfig() {
   if (!fs2.existsSync(CONFIG_FILE)) return {};
   try {
@@ -839,12 +850,12 @@ function parseTenantEnv(context) {
   if (parts.length !== 2 || !parts[0] || !parts[1]) return null;
   return { tenant: parts[0], env: parts[1] };
 }
-async function discoverConfigFromSsm(context) {
+async function discoverConfigFromSsm(context, opts = {}) {
   const parsed = parseTenantEnv(context);
   if (!parsed) return null;
   const { tenant, env } = parsed;
   const ssmPath = `/mesh-platform/${tenant}/${env}/platform/zitadel`;
-  logInfo(`Attempting SSM discovery from ${ssmPath}...`);
+  if (!opts.quiet) logInfo(`Attempting SSM discovery from ${ssmPath}...`);
   try {
     const { SSMClient: SSMClient2, GetParameterCommand: GetParameterCommand2 } = await import("@aws-sdk/client-ssm");
     const region = process.env.AWS_REGION ?? process.env.AWS_DEFAULT_REGION ?? "us-east-2";
@@ -852,30 +863,31 @@ async function discoverConfigFromSsm(context) {
     const resp = await ssm.send(new GetParameterCommand2({ Name: ssmPath }));
     const raw = resp.Parameter?.Value;
     if (!raw) {
-      logWarn(`SSM parameter ${ssmPath} has no value`);
+      if (!opts.silent) logWarn(`SSM parameter ${ssmPath} has no value`);
       return null;
     }
     const data = JSON.parse(raw);
     const issuer = data.endpoint;
     const clientId = data.cliClientId;
     if (typeof issuer !== "string" || !issuer) {
-      logWarn("SSM zitadel entry missing 'endpoint' field");
+      if (!opts.silent) logWarn("SSM zitadel entry missing 'endpoint' field");
       return null;
     }
     if (typeof clientId !== "string" || !clientId) {
-      logWarn(
-        "SSM zitadel entry missing 'cliClientId' field.\n  The platform needs to be deployed with an updated ZitadelPlatformIdentity\n  that exports cliClientId. Until then, contact your platform admin."
-      );
+      if (!opts.silent) {
+        logWarn(
+          "SSM zitadel entry missing 'cliClientId' field.\n  The platform needs to be deployed with an updated ZitadelPlatformIdentity\n  that exports cliClientId. Until then, contact your platform admin."
+        );
+      }
       return null;
     }
-    const config = { issuer, clientId };
-    if (typeof data.vpn === "string") config.vpn = data.vpn;
-    if (typeof data.vpnJoinBroker === "string") config.vpnJoinBroker = data.vpnJoinBroker;
-    if (typeof data.registryBroker === "string") config.registryBroker = data.registryBroker;
+    const config = withDiscoveredFields({ issuer, clientId }, data);
+    if (opts.quiet) return config;
     writeContextConfig(context, config);
     logSuccess(`Discovered platform configuration for ${context} via SSM`);
     return config;
   } catch (err) {
+    if (opts.silent) return null;
     const message = err instanceof Error ? err.message : String(err);
     if (message.includes("ExpiredToken") || message.includes("credentials")) {
       logWarn(`SSM discovery failed: AWS credentials expired or unavailable.`);
@@ -903,26 +915,24 @@ async function discoverConfig(domain, contextKey = domain, opts = {}) {
     const resp = await fetch(url, { signal: controller.signal });
     clearTimeout(timeout);
     if (!resp.ok) {
-      logWarn(`Discovery endpoint returned ${resp.status}`);
+      if (!opts.silent) logWarn(`Discovery endpoint returned ${resp.status}`);
       return null;
     }
     const data = await resp.json();
     const issuer = data.issuer;
     const clientId = data.clientId;
     if (typeof issuer !== "string" || !issuer || typeof clientId !== "string" || !clientId) {
-      logWarn("Discovery endpoint returned invalid config (missing issuer or clientId)");
+      if (!opts.silent) logWarn("Discovery endpoint returned invalid config (missing issuer or clientId)");
       return null;
     }
-    const config = { issuer, clientId };
-    if (typeof data.vpn === "string") config.vpn = data.vpn;
-    if (typeof data.vpnJoinBroker === "string") config.vpnJoinBroker = data.vpnJoinBroker;
-    if (typeof data.registryBroker === "string") config.registryBroker = data.registryBroker;
+    const config = withDiscoveredFields({ issuer, clientId }, data);
     if (!opts.quiet) {
       writeContextConfig(contextKey, config);
       logSuccess(`Discovered platform configuration for ${contextKey}`);
     }
     return config;
   } catch (err) {
+    if (opts.silent) return null;
     const message = err instanceof Error ? err.message : String(err);
     if (message.includes("abort")) {
       logWarn("Discovery timed out");
@@ -1020,7 +1030,7 @@ function login(context, config) {
     authUrl.searchParams.set("client_id", config.clientId);
     authUrl.searchParams.set("redirect_uri", REDIRECT_URI);
     authUrl.searchParams.set("response_type", "code");
-    authUrl.searchParams.set("scope", SCOPES);
+    authUrl.searchParams.set("scope", loginScopes(config));
     authUrl.searchParams.set("code_challenge", codeChallenge);
     authUrl.searchParams.set("code_challenge_method", "S256");
     authUrl.searchParams.set("state", state);
@@ -1148,7 +1158,7 @@ async function attemptDeviceCode(context, config) {
     headers: { "Content-Type": "application/x-www-form-urlencoded" },
     body: new URLSearchParams({
       client_id: config.clientId,
-      scope: SCOPES
+      scope: loginScopes(config)
     }).toString()
   });
   if (!resp.ok) {
@@ -1309,8 +1319,9 @@ async function ensureValidToken(context, config, opts) {
   let token = await getValidToken(context);
   if (token) return token;
   logInfo(`No valid Zitadel session for ${context} \u2014 running login flow`);
+  const adopted = await adoptPublishedHubProject(context, config);
   try {
-    await runLoginFlow(context, config, opts);
+    await runLoginFlow(context, adopted, opts);
   } catch (err) {
     logError(`Login failed: ${err.message}`);
     return null;
@@ -1330,24 +1341,35 @@ async function ensureLogin(context, opts = {}) {
   if (!token) return null;
   return readCredentials(context);
 }
-async function discoverConfigGuarded(context) {
+async function discoverConfigGuarded(context, opts = {}) {
   let config = null;
   if (parseTenantEnv(context)) {
-    config = await discoverConfigFromSsm(context);
+    config = await discoverConfigFromSsm(context, opts);
   }
   if (!config) {
     const pinned = firstPartyDomainFor(context);
     if (pinned) {
-      logInfo(`"${context}" is a known Mesh platform \u2014 resolving via ${pinned} (no AWS needed)`);
-      config = await discoverConfig(pinned, context);
+      if (!opts.quiet) {
+        logInfo(`"${context}" is a known Mesh platform \u2014 resolving via ${pinned} (no AWS needed)`);
+      }
+      config = await discoverConfig(pinned, context, opts);
     }
   }
   if (!config && context.split(".").length - 1 >= 2) {
-    config = await discoverConfig(context);
+    config = await discoverConfig(context, context, opts);
   }
   return config;
 }
-var CONFIG_DIR, CONFIG_FILE, CREDENTIALS_FILE, REDIRECT_PORT, REDIRECT_URI, SCOPES, atomicWriteCounter, MAX_DEVICE_CODES, RESERVED_REGISTRY_CONTEXT;
+async function adoptPublishedHubProject(context, config, discover = discoverConfigGuarded, write = writeContextConfig) {
+  if (config.hubProjectId) return config;
+  const fresh = await discover(context, { quiet: true, silent: true });
+  if (!fresh?.hubProjectId) return config;
+  const merged = { ...config, hubProjectId: fresh.hubProjectId };
+  write(context, merged);
+  logInfo(`${context} publishes its Hub project (${fresh.hubProjectId}) \u2014 requesting the Hub audience for this login`);
+  return merged;
+}
+var CONFIG_DIR, CONFIG_FILE, CREDENTIALS_FILE, REDIRECT_PORT, REDIRECT_URI, BASE_SCOPES, atomicWriteCounter, MAX_DEVICE_CODES, RESERVED_REGISTRY_CONTEXT;
 var init_login = __esm({
   "libs/mesh-cli/src/commands/login.ts"() {
     "use strict";
@@ -1364,7 +1386,7 @@ var init_login = __esm({
     CREDENTIALS_FILE = path2.join(CONFIG_DIR, "credentials.json");
     REDIRECT_PORT = 9876;
     REDIRECT_URI = `http://localhost:${REDIRECT_PORT}/callback`;
-    SCOPES = "openid email profile offline_access urn:zitadel:iam:org:project:id:zitadel:aud";
+    BASE_SCOPES = "openid email profile offline_access urn:zitadel:iam:org:project:id:zitadel:aud";
     atomicWriteCounter = 0;
     MAX_DEVICE_CODES = 3;
     RESERVED_REGISTRY_CONTEXT = "registry";