@mesh-tech/mesh-cli 0.40.9 → 0.40.11

package/dist/bin/{mesh.auth-preflight-AUFQ2FGD.js → mesh.auth-preflight-BGI5LPLN.js}

@@ -21,7 +21,7 @@ import {
   registryPreflight,
   stripUnscopedCodeArtifactRegistry,
   upsertNpmrcLines
-} from "./mesh.chunk-6SSOVZOI.js";
+} from "./mesh.chunk-4XX62O6Z.js";
 export {
   REGISTRY_LOGIN_FIX,
   REGISTRY_LOGIN_FIX_AWS,

package/dist/bin/{mesh.chunk-7HTKSUWR.js → mesh.chunk-3WJGDNHA.js}

@@ -49,7 +49,7 @@ import {
   isExpiredAwsTokenMessage,
   probeRegistryToken,
   registryLoginFix
-} from "./mesh.chunk-6SSOVZOI.js";
+} from "./mesh.chunk-4XX62O6Z.js";
 
 // packages/mesh-cli/src/commands/login.ts
 import * as http from "http";
@@ -1478,9 +1478,9 @@ async function ensureKubeconfig(platformName, env, sessionName, deps = {}) {
 
 // packages/mesh-cli/src/utils/temporal-auth.ts
 import { execFileSync as execFileSync3 } from "node:child_process";
-async function resolveTemporalAuth(tenant, env, platformName = tenant) {
+async function resolveTemporalAuth(tenant, env, platformName = tenant, deps = {}) {
   const { SSMClient: SSMClient2, GetParameterCommand: GetParameterCommand2 } = await import("@aws-sdk/client-ssm");
-  const ssm = new SSMClient2({ region: process.env.AWS_REGION || "us-east-2" });
+  const ssm = deps.ssm ?? new SSMClient2({ region: process.env.AWS_REGION || "us-east-2" });
   const results = {};
   async function trySSM(name) {
     try {
@@ -1490,16 +1490,25 @@ async function resolveTemporalAuth(tenant, env, platformName = tenant) {
       return void 0;
     }
   }
+  async function tryFirstSSM(names) {
+    for (const name of names) {
+      const value = await trySSM(name);
+      if (value !== void 0) return value;
+    }
+    return void 0;
+  }
   try {
-    const workerPath = `/mesh-platform/${tenant}/${env}/temporal/worker-service-account-key`;
-    const exchangePath = `/mesh-platform/${tenant}/${env}/temporal/token-exchange-app`;
-    const workerJson = await trySSM(workerPath);
+    const temporalSecret = (name) => [
+      `/platform-secrets/${tenant}/${env}/temporal/${name}`,
+      `/mesh-platform/${tenant}/${env}/temporal/${name}`
+    ];
+    const workerJson = await tryFirstSSM(temporalSecret("worker-service-account-key"));
     if (workerJson) {
       const worker = JSON.parse(workerJson);
       results.TEMPORAL_AUTH_CLIENT_ID = worker.clientId;
       results.TEMPORAL_AUTH_CLIENT_SECRET = worker.clientSecret;
     }
-    const exchangeJson = await trySSM(exchangePath);
+    const exchangeJson = await tryFirstSSM(temporalSecret("token-exchange-app"));
     if (exchangeJson) {
       const exchange = JSON.parse(exchangeJson);
       results.ZITADEL_TOKEN_EXCHANGE_CLIENT_ID = exchange.clientId;
@@ -2691,16 +2700,33 @@ async function ensureZitadelProject(pat, name, opts = {}) {
     { queries: [{ nameQuery: { name, method: "TEXT_QUERY_METHOD_EQUALS" } }] },
     opts.orgId
   );
-  const existing = search?.result?.[0]?.id;
-  if (existing) {
+  const existing = search?.result?.[0];
+  if (existing?.id) {
     if (opts.logExisting) logInfo(`Zitadel project '${name}' already exists`);
-    return existing;
+    const wanted = opts.projectRoleAssertion;
+    if (wanted !== void 0 && (existing.projectRoleAssertion ?? false) !== wanted) {
+      await api(
+        pat,
+        "PUT",
+        `/management/v1/projects/${existing.id}`,
+        {
+          name: existing.name ?? name,
+          projectRoleAssertion: wanted,
+          projectRoleCheck: existing.projectRoleCheck ?? false,
+          hasProjectCheck: existing.hasProjectCheck ?? false,
+          ...existing.privateLabelingSetting ? { privateLabelingSetting: existing.privateLabelingSetting } : {}
+        },
+        opts.orgId
+      );
+      logSuccess(`Zitadel project '${name}': role assertion turned ${wanted ? "on" : "off"}`);
+    }
+    return existing.id;
   }
   const created = await api(
     pat,
     "POST",
     "/management/v1/projects",
-    { name, projectRoleAssertion: true },
+    { name, projectRoleAssertion: opts.projectRoleAssertion ?? true },
     opts.orgId
   );
   logSuccess(`Created Zitadel project '${name}'${opts.describe ? ` (${opts.describe})` : ""}`);
@@ -2762,6 +2788,21 @@ async function ensureTestUsers(pat) {
 function hubAuthPath() {
   return path10.join(meshCacheDir("mesh-local"), "hub-auth.json");
 }
+function hubSignInScope(projectId) {
+  return [
+    "openid email profile",
+    "urn:zitadel:iam:org:projects:roles",
+    `urn:zitadel:iam:org:project:id:${projectId}:aud`
+  ].join(" ");
+}
+function hubAuthComposeEnv(auth) {
+  return {
+    MESH_HUB_OAUTH2_CLIENT_ID: auth.clientId,
+    MESH_HUB_OAUTH2_CLIENT_SECRET: auth.clientSecret,
+    MESH_HUB_OAUTH2_COOKIE_SECRET: auth.cookieSecret,
+    ...auth.projectId ? { MESH_HUB_OAUTH2_SCOPE: hubSignInScope(auth.projectId) } : {}
+  };
+}
 function readHubAuth() {
   try {
     const parsed = JSON.parse(fs10.readFileSync(hubAuthPath(), "utf-8"));
@@ -2771,7 +2812,10 @@ function readHubAuth() {
     return null;
   }
 }
-var ensureHubProject = (pat) => ensureZitadelProject(pat, HUB_PROJECT_NAME, { describe: "Hub platform app" });
+var ensureHubProject = (pat) => ensureZitadelProject(pat, HUB_PROJECT_NAME, {
+  describe: "Hub platform app",
+  projectRoleAssertion: false
+});
 function hubRoleDisplayName(roleKey) {
   const tenant = hubRoleKeyTenant(roleKey);
   return tenant === null ? roleKey : `${restrictedRoleBase(roleKey) ?? roleKey} (${tenant})`;
@@ -2826,23 +2870,8 @@ async function reconcileHubRedirectUris(pat, projectId, app) {
     `Registered Hub redirect URI http://localhost:${hubPort()}/oauth2/callback (MESH_HUB_PORT)`
   );
 }
-async function ensureHubApp(pat, projectId) {
-  const existing = await searchZitadelApp(pat, projectId, HUB_APP_NAME);
-  if (existing) {
-    await reconcileHubRedirectUris(pat, projectId, existing);
-    const clientId = existing?.oidcConfig?.clientId;
-    const persisted = readHubAuth();
-    if (persisted && persisted.clientId === clientId) return { clientId };
-    const regenerated = await api(
-      pat,
-      "POST",
-      `/management/v1/projects/${projectId}/apps/${existing.id}/oidc_config/_generate_client_secret`,
-      {}
-    );
-    logSuccess(`Regenerated Hub UI client secret (local copy was missing)`);
-    return { clientId, clientSecret: regenerated.clientSecret };
-  }
-  const created = await api(pat, "POST", `/management/v1/projects/${projectId}/apps/oidc`, {
+function buildHubAppPayload() {
+  return {
     name: HUB_APP_NAME,
     redirectUris: [.../* @__PURE__ */ new Set([hubRedirectUri(), HUB_DEFAULT_REDIRECT_URI])],
     postLogoutRedirectUris: [
@@ -2864,7 +2893,30 @@ async function ensureHubApp(pat, projectId) {
     idTokenRoleAssertion: true,
     idTokenUserinfoAssertion: true,
     devMode: true
-  });
+  };
+}
+async function ensureHubApp(pat, projectId) {
+  const existing = await searchZitadelApp(pat, projectId, HUB_APP_NAME);
+  if (existing) {
+    await reconcileHubRedirectUris(pat, projectId, existing);
+    const clientId = existing?.oidcConfig?.clientId;
+    const persisted = readHubAuth();
+    if (persisted && persisted.clientId === clientId) return { clientId };
+    const regenerated = await api(
+      pat,
+      "POST",
+      `/management/v1/projects/${projectId}/apps/${existing.id}/oidc_config/_generate_client_secret`,
+      {}
+    );
+    logSuccess(`Regenerated Hub UI client secret (local copy was missing)`);
+    return { clientId, clientSecret: regenerated.clientSecret };
+  }
+  const created = await api(
+    pat,
+    "POST",
+    `/management/v1/projects/${projectId}/apps/oidc`,
+    buildHubAppPayload()
+  );
   logSuccess(`Created Zitadel application '${HUB_APP_NAME}' (Hub UI web client, code flow)`);
   return { clientId: created.clientId, clientSecret: created.clientSecret };
 }
@@ -7833,7 +7885,7 @@ function registerDevCommand(program) {
     "tmux"
   );
   dev.command("__token-server <port> <context>", { hidden: true }).action(async (port, context) => {
-    const { startTokenServer } = await import("./mesh.dev-token-server-XG26C6IQ.js");
+    const { startTokenServer } = await import("./mesh.dev-token-server-IJUVRBWI.js");
     await startTokenServer(Number(port), context);
   });
   dev.action(async (options) => {
@@ -10971,9 +11023,9 @@ function refuseReservedRegistryContext(context, verb) {
 }
 async function hintRegistryIfMissing() {
   try {
-    const { readRegistrySession } = await import("./mesh.registry-identity-3AR27UGO.js");
+    const { readRegistrySession } = await import("./mesh.registry-identity-6UPUHKO2.js");
     if (readRegistrySession()) return;
-    const { probeRegistryToken: probeRegistryToken2 } = await import("./mesh.auth-preflight-AUFQ2FGD.js");
+    const { probeRegistryToken: probeRegistryToken2 } = await import("./mesh.auth-preflight-BGI5LPLN.js");
     const probe = await probeRegistryToken2();
     if (probe.state === "missing" || probe.state === "expired") {
       logInfo(REGISTRY_SEPARATE_HINT);
@@ -11394,6 +11446,7 @@ export {
   mockIdpComposeEnv,
   LOGIN_CONTEXT,
   TEST_USERS,
+  hubAuthComposeEnv,
   readHubAuth,
   seedZitadel,
   seedMockIdps,