@microsoft/managed-apps-cli 0.19.0 → 0.21.0

package/dist/Verbs/MaafAppPermissions.js

@@ -1,651 +0,0 @@
-/*!
- * Copyright (C) Microsoft Corporation. All rights reserved.
- */
-import { GrsRepositoryContributorRoleName, infoAsync, MaafAppContributorRoleName, MaafAppReaderRoleName, modifyGrsRoleAssignmentsAsync, modifyMaafRoleAssignmentsAsync, resolvePrincipalByEmailAsync, unshareGrsRepoByPrincipalsAsync, unshareMaafAppByPrincipalsAsync, } from '@microsoft/managed-apps-actions';
-import { AppConfigFileName } from '@microsoft/managed-apps-common/config';
-import { HttpClientError } from '@microsoft/managed-apps-common/services';
-import { getCliLogger, getSettings } from '../CliSettings.js';
-import { isGuid, resolveAppNameAsync, resolveEnvironmentId } from '../CliUtils.js';
-import { CLI_BINARY_NAME } from '../Constants/CliConstants.js';
-import { HelpStrings } from '../Constants/HelpStrings.js';
-import { UsageError } from '../Errors/CliError.js';
-import { printInfo, printJsonSuccess, printSuccess, printWarning } from '../Utils/ConsoleOutput.js';
-import { toRepoDetails } from '../Utils/RepoDetails.js';
-import { externalRepositoryWarning, noRepositoryLinkedMessage, parseAccessLevel, resolveAppForEditAsync, resolveRepoType, } from '../Utils/ShareAccessRouting.js';
-import { ShareMaafAppArguments, UnshareMaafAppArguments } from './VerbConstants.js';
-/**
- * Implements `ms app share` and `ms app unshare` — adds or removes role
- * assignments for AAD principals (users or groups) at either the MAAF app
- * scope (play access) or the GRS repository scope (edit access), driven by
- * the `--access` flag.
- *
- * Pipeline:
- * 1. Register option schema for the chosen mode and run the verb (so `--help`
- *    works outside an init'd project).
- * 2. Require a loaded `ms.config.json`.
- * 3. Resolve `environmentId` (`--environment-id` flag wins; otherwise from config),
- *    tenantId, and the requested access level (`--access play|edit`, default `play`).
- * 4. Read the comma- or whitespace-separated principals positionals and resolve each entry:
- *    - GUID-shaped inputs pass through unchanged.
- *    - For app-scope share (`play`, or `edit` on a non-native repo), email-shaped
- *      inputs are passed straight through on `principal.email`.
- *    - For the GRS share path and every unshare path, email-shaped inputs are
- *      resolved to AAD object ids via Graph.
- * 5. Dispatch to the matching share/unshare path:
- *    - `play` → MAAF `modifyRoleAssignments` (`MicrosoftAppReader` at app scope).
- *    - `edit` + `repoType === 'native'` → fetch the app's `repositoryId` then
- *      GRS `modifyRoleAssignments` (`RepositoryContributor` at repo scope).
- *    - `edit` + `repoType === 'none' | 'github'` → MAAF `modifyRoleAssignments`
- *      (`MicrosoftAppContributor` at app scope); GRS is skipped because the
- *      platform does not manage the repository.
- *    For unshare, paginate the matching list endpoint and pass through the
- *    full `RoleAssignment[]` records on `delete` (the strict wire contract
- *    requires `roleAssignmentId`, which only the list endpoint provides).
- * 6. Emit JSON or a human summary.
- */
-export async function executeMaafAppPermissionsAsync(argumentProvider, mode) {
-    configureOptionSchema(argumentProvider, mode);
-    await argumentProvider.runVerb();
-    const cliSettings = getSettings();
-    if (!cliSettings.appConfig) {
-        throw new UsageError(`No ${AppConfigFileName} found in the current directory. Run "${CLI_BINARY_NAME} app init" first.`);
-    }
-    // `resolveEnvironmentId` enforces flag-wins precedence and pushes the resolved
-    // id into player services so the URL builder targets the override.
-    const environmentId = await resolveEnvironmentId(argumentProvider);
-    const tenantId = await argumentProvider.getTenantIdAsync();
-    if (!tenantId) {
-        throw new UsageError('Unable to determine tenant ID. Ensure you are logged in.');
-    }
-    const appName = await resolveAppNameAsync(argumentProvider);
-    const access = parseAccessLevel(await argumentProvider.getOption('access'));
-    // `repoType` only affects edit routing. For play we should never fail on the
-    // strict migration check for legacy config shape.
-    const repoType = access === 'edit'
-        ? resolveRepoType(cliSettings.appConfig)
-        : (cliSettings.appConfig.repoType ?? 'none');
-    const inputs = parseInputs(argumentProvider.getPositionalArgs(0));
-    if (inputs.length === 0) {
-        throw new UsageError('Provide at least one user or group (AAD object ID or email address). Separate multiple entries with commas, spaces, or both.');
-    }
-    const emailPassthrough = mode === 'share' && (access === 'play' || repoType !== 'native');
-    // Top-level scenario that ties together every server call the verb makes:
-    // Graph principal resolution (`ResolvePrincipalByEmail` per email, skipped on
-    // the email-passthrough share path), optional app-info fetch (`GetMaafApp`)
-    // when the edit path needs the `repositoryId`, and the final modify call (one
-    // of `ModifyMaafRoleAssignments`, `ModifyGrsRepositoryRoleAssignments`,
-    // `UnshareMaafAppByPrincipals`, or `UnshareGrsRepoByPrincipals`). Each of those
-    // actions already emits its own wire-scoped scenario; this scenario captures
-    // the verb-level outcome plus the routing decision (scope/role) so we can
-    // correlate. All properties are PII-safe — counts and routing flags only, no
-    // emails / GUIDs / app names.
-    const logger = getCliLogger();
-    const scenario = logger.trackScenario('MaafApp.SharePermissions', {
-        mode,
-        access,
-        repoType,
-        inputCount: inputs.length,
-    });
-    try {
-        // Failures (bad shape, no Graph match, transport error) are collected here so
-        // we can warn the user but still proceed with the entries that resolved.
-        const failures = [];
-        const refs = await resolveAllAsync(inputs, failures, emailPassthrough);
-        // Verb-level summary of the principal resolution fan-out. On the Graph paths
-        // each underlying lookup also emits a `ResolvePrincipalByEmail` scenario; on
-        // the email-passthrough share path no Graph call is made and entries resolve
-        // locally. This event makes the aggregate result queryable per invocation.
-        logger.trackActivityEvent('MaafApp.SharePermissions.PrincipalResolution', {
-            mode,
-            inputCount: inputs.length,
-            resolvedCount: refs.length,
-            failedCount: failures.length,
-            emailPassthrough,
-        });
-        // If nothing resolved, the operation has no inputs to apply — abort with a
-        // single error listing every failure rather than calling the RP with an empty
-        // array.
-        if (refs.length === 0) {
-            throw new UsageError(formatFailures(failures));
-        }
-        // Otherwise warn about the unresolved entries up front (so they're visible
-        // before the success line), then proceed with the resolved subset.
-        if (failures.length > 0) {
-            printWarning(formatFailures(failures));
-        }
-        const dispatch = mode === 'share' ? shareDispatchAsync : unshareDispatchAsync;
-        const outcome = await dispatch({
-            tenantId,
-            environmentId,
-            appName,
-            access,
-            refs,
-            repoType,
-            jsonMode: argumentProvider.isJsonMode(),
-        });
-        scenario.complete({
-            resolvedCount: refs.length,
-            failedResolutionCount: failures.length,
-            scope: outcome.scope,
-            role: outcome.role,
-            // App-scope contributor fallback for `edit` is the noteworthy routing
-            // case introduced for non-native `repoType`. Tagged here so it's a
-            // simple boolean filter on the success event.
-            appScopeContributorFallback: access === 'edit' && outcome.scope === 'app',
-            ...(mode === 'unshare' && {
-                revokedCount: outcome.revokedCount ?? 0,
-                revokedPrincipalCount: outcome.revokedPrincipalCount ?? 0,
-                notFoundCount: outcome.notFound?.length ?? 0,
-                skippedCount: outcome.skipped?.length ?? 0,
-            }),
-        });
-        // After a successful edit (write) share, surface the backing repository's
-        // classification and clone URL so the newly-granted contributor knows where
-        // the source lives and how to clone it. Best-effort: the share already
-        // succeeded, so a failure to read the app info must not fail the command.
-        const repoDetails = mode === 'share' && access === 'edit'
-            ? await resolveRepoDetailsAsync({
-                appInfo: outcome.appInfo,
-                tenantId,
-                environmentId,
-                appName,
-                jsonMode: argumentProvider.isJsonMode(),
-            })
-            : undefined;
-        if (argumentProvider.isJsonMode()) {
-            // Envelope semantics for this verb: `success: true` means the modify call
-            // reached the RP and returned. When some inputs failed to resolve before
-            // the modify, `partialFailure` is `true` and `warnings` lists the
-            // unresolved entries. Consumers requiring full success must check both
-            // `success === true && partialFailure === false`. `warnings` is always
-            // present (empty array on full success) so consumers can treat its
-            // length uniformly. The server response is spread flat into the envelope
-            // (matching every other verb that emits JSON) instead of nested under a
-            // `result` key. For unshare we also include the action-layer bookkeeping
-            // (`revokedCount`, `revokedPrincipalCount`, `notFound`, `skipped`) that
-            // would otherwise only appear in the human summary — so automation gets
-            // the same fidelity as text mode.
-            printJsonSuccess({
-                access,
-                partialFailure: failures.length > 0,
-                ...outcome.result,
-                ...(mode === 'unshare' && {
-                    revokedCount: outcome.revokedCount ?? 0,
-                    revokedPrincipalCount: outcome.revokedPrincipalCount ?? 0,
-                    notFound: (outcome.notFound ?? []).map(toJsonRef),
-                    skipped: (outcome.skipped ?? []).map(toJsonRef),
-                }),
-                ...(repoDetails && {
-                    repoType: repoDetails.repoType,
-                    cloneUrl: repoDetails.cloneUrl,
-                }),
-                warnings: failures,
-            });
-        }
-        else {
-            printSummary({ appName, mode, access, inputCount: refs.length, outcome });
-            printRepoDetails(repoDetails);
-        }
-    }
-    catch (error) {
-        scenario.failure(error);
-        throw error;
-    }
-}
-async function shareDispatchAsync(inputs) {
-    const { tenantId, environmentId, appName, access, refs, repoType, jsonMode } = inputs;
-    if (access === 'play') {
-        const entries = refs.map((r) => toMaafPermissionEntry(r, MaafAppReaderRoleName));
-        const result = await modifyMaafRoleAssignmentsAsync({
-            tenantId,
-            environmentId,
-            logger: getCliLogger(),
-            actionsParams: { appName, put: entries, delete: [] },
-        });
-        return { result, scope: 'app', role: MaafAppReaderRoleName };
-    }
-    // access === 'edit': route by repoType.
-    if (repoType === 'none') {
-        throw new UsageError(noRepositoryLinkedMessage);
-    }
-    if (repoType !== 'native') {
-        // The app has no platform-managed repository, so grant contributor access
-        // at the app scope instead of going through GRS.
-        if (!jsonMode) {
-            printWarning(externalRepositoryWarning);
-        }
-        const entries = refs.map((r) => toMaafPermissionEntry(r, MaafAppContributorRoleName));
-        const result = await modifyMaafRoleAssignmentsAsync({
-            tenantId,
-            environmentId,
-            logger: getCliLogger(),
-            actionsParams: { appName, put: entries, delete: [] },
-        });
-        return { result, scope: 'app', role: MaafAppContributorRoleName };
-    }
-    const app = await resolveAppForEditAsync({ tenantId, environmentId, appName });
-    const entries = refs.map(toGrsPermissionEntry);
-    const result = await modifyGrsRoleAssignmentsAsync({
-        tenantId,
-        environmentId,
-        logger: getCliLogger(),
-        actionsParams: { repoId: app.repositoryId, put: entries, delete: [] },
-    });
-    return { result, scope: 'repo', role: GrsRepositoryContributorRoleName, appInfo: app };
-}
-async function unshareDispatchAsync(inputs) {
-    const { tenantId, environmentId, appName, access, refs, repoType, jsonMode } = inputs;
-    // Unshare never uses email passthrough, so every ref carries a resolved id.
-    const principalIds = refs.map(requirePrincipalIdForUnshare);
-    const refsByPrincipalId = new Map(refs.map((r) => [requirePrincipalIdForUnshare(r), r]));
-    if (access === 'edit' && repoType === 'none') {
-        throw new UsageError(noRepositoryLinkedMessage);
-    }
-    const useAppScope = access === 'play' || repoType !== 'native';
-    const role = useAppScope
-        ? access === 'play'
-            ? MaafAppReaderRoleName
-            : MaafAppContributorRoleName
-        : GrsRepositoryContributorRoleName;
-    let actionResult;
-    if (useAppScope) {
-        if (access === 'edit' && repoType !== 'native') {
-            if (!jsonMode) {
-                printWarning(externalRepositoryWarning);
-            }
-        }
-        actionResult = await unshareMaafAppByPrincipalsAsync({
-            tenantId,
-            environmentId,
-            logger: getCliLogger(),
-            actionsParams: {
-                appName,
-                principalIds,
-                roleDefinitionName: role,
-            },
-        });
-    }
-    else {
-        const app = await resolveAppForEditAsync({ tenantId, environmentId, appName });
-        actionResult = await unshareGrsRepoByPrincipalsAsync({
-            tenantId,
-            environmentId,
-            logger: getCliLogger(),
-            actionsParams: { repoId: app.repositoryId, principalIds },
-        });
-    }
-    return {
-        result: actionResult.result,
-        scope: useAppScope ? 'app' : 'repo',
-        role,
-        revokedCount: actionResult.revokedCount,
-        revokedPrincipalCount: actionResult.revokedPrincipalCount,
-        notFound: actionResult.notFoundPrincipalIds.map((id) => refsByPrincipalId.get(id) ?? { id, input: id }),
-        skipped: actionResult.skippedNullRoleAssignments.map((s) => refsByPrincipalId.get(s.principalObjectId) ??
-            { id: s.principalObjectId, input: s.principalObjectId }),
-    };
-}
-function requirePrincipalIdForUnshare(ref) {
-    if (!ref.id) {
-        throw new UsageError(`Could not resolve '${ref.input}' to an AAD object ID. Unshare requires object IDs.`);
-    }
-    return ref.id;
-}
-/**
- * Best-effort resolution of the app's repository details
- */
-async function resolveRepoDetailsAsync(args) {
-    let app = args.appInfo;
-    if (!app) {
-        try {
-            app = await infoAsync({
-                tenantId: args.tenantId,
-                environmentId: args.environmentId,
-                logger: getCliLogger(),
-                actionsParams: { appName: args.appName },
-            });
-        }
-        catch (error) {
-            if (!args.jsonMode) {
-                printWarning(`Share succeeded, but repository details for '${args.appName}' could not be read.`);
-            }
-            return undefined;
-        }
-    }
-    return toRepoDetails(app);
-}
-/**
- * Prints the repository details after a successful edit
- * share (text mode only). No-op when there are no details to surface.
- */
-function printRepoDetails(details) {
-    if (!details) {
-        return;
-    }
-    if (details.repoType) {
-        printInfo(`Repo type: ${details.repoType}`);
-    }
-    if (details.cloneUrl) {
-        printInfo(`Clone URL: ${details.cloneUrl}`);
-    }
-}
-/**
- * Splits variadic positional values on commas into a deduplicated, trimmed list
- * of inputs. The shell handles whitespace separation, while this function handles
- * compact comma-separated values and commas followed by spaces. Empty segments
- * (trailing commas, whitespace-only entries) are dropped.
- */
-function parseInputs(rawValues) {
-    const seen = new Set();
-    for (const rawValue of rawValues) {
-        for (const segment of rawValue.split(',')) {
-            const trimmed = segment.trim();
-            if (trimmed)
-                seen.add(trimmed);
-        }
-    }
-    return [...seen];
-}
-/**
- * Resolves a list of principal inputs to {@link ResolvedRef}s. GUIDs pass
- * through unchanged. Email-shaped inputs are handled one of two ways:
- *
- *   - `emailPassthrough === true` (app-scope share): the email is carried
- *     verbatim on the ref (`{ input, email }`, no `id`).
- *   - `emailPassthrough === false` (GRS share, any unshare): the email is
- *     resolved to an AAD object id via Microsoft Graph.
- *
- * Per-entry failures (malformed input, no Graph match, transport error like a
- * 403 on the group lookup) are pushed to the shared `failures` array rather than
- * throwing, so one bad entry doesn't kill an otherwise-valid batch.
- *
- * Graph resolution runs in parallel (`Promise.all`), with an in-flight map
- * coalescing concurrent requests for the same email. The cache deduplicates
- * within a single invocation (e.g. the same email listed twice round-trips Graph
- * once).
- */
-async function resolveAllAsync(inputs, failures, emailPassthrough) {
-    const cache = new Map();
-    const inFlight = new Map();
-    const settled = await Promise.all(inputs.map(async (input) => {
-        const cacheKey = input.toLowerCase();
-        const hit = cache.get(cacheKey);
-        if (hit)
-            return hit;
-        if (isGuid(input)) {
-            const ref = { id: input, input };
-            cache.set(cacheKey, ref);
-            return ref;
-        }
-        if (!looksLikeEmail(input)) {
-            failures.push({
-                input,
-                reason: 'not an AAD object ID (GUID) or a valid email address',
-            });
-            return null;
-        }
-        if (emailPassthrough) {
-            const ref = { input, email: input };
-            cache.set(cacheKey, ref);
-            return ref;
-        }
-        try {
-            let resolution = inFlight.get(cacheKey);
-            if (!resolution) {
-                resolution = resolvePrincipalByEmailAsync(input, getCliLogger());
-                inFlight.set(cacheKey, resolution);
-            }
-            const resolved = await resolution;
-            if (!resolved) {
-                failures.push({
-                    input,
-                    reason: 'no user or group found in this tenant (invite as a guest in Entra ID first if external)',
-                });
-                return null;
-            }
-            const ref = {
-                id: resolved.id,
-                input,
-                type: resolved.type,
-                email: input,
-                displayName: resolved.displayName,
-            };
-            cache.set(cacheKey, ref);
-            return ref;
-        }
-        catch (error) {
-            failures.push({
-                input,
-                reason: extractGraphErrorMessage(error),
-            });
-            return null;
-        }
-    }));
-    const resolved = settled.filter((r) => r !== null);
-    // Collapse duplicate refs that survived the concurrent fan-out.
-    const deduped = [];
-    const seenKeys = new Set();
-    for (const ref of resolved) {
-        const key = (ref.id ?? ref.email ?? ref.input).toLowerCase();
-        if (seenKeys.has(key))
-            continue;
-        seenKeys.add(key);
-        deduped.push(ref);
-    }
-    return deduped;
-}
-/**
- * Renders the failure list as a single multi-line message. The intro line
- * leads with the count so users skimming a long warning see the impact first.
- */
-function formatFailures(failures) {
-    const noun = failures.length === 1 ? 'entry' : 'entries';
-    const lines = failures.map((f) => `  - ${f.input}: ${f.reason}`);
-    return [`Could not resolve ${failures.length} ${noun}:`, ...lines].join('\n');
-}
-/**
- * Extracts the meaningful piece of a Graph HTTP error and formats it as
- * `Graph <status>: <message>`.
- *
- * Prefers the structured fields on {@link HttpClientError} (`status` + JSON-parsed `body`),
- * which removes the dependency on `err.message`'s exact format and decouples this code from
- * which `IHttpClient` implementation produced the error. For anything else (plain `Error`,
- * non-Graph response shape, body parse failure), falls back to the raw message so we never
- * lose information.
- */
-function extractGraphErrorMessage(error) {
-    if (error instanceof HttpClientError) {
-        // A 403 from Graph is a consent/permission problem with the caller's
-        // sign-in, not a bad principal. Echoing Graph's opaque "Insufficient
-        // privileges to complete the operation" under the "Could not resolve
-        // <email>" heading misleads users into thinking the email is wrong, so we
-        // replace it with an actionable message naming the real cause and the
-        // ways forward. See {@link formatGraphPermissionError}.
-        if (error.status === 403) {
-            return formatGraphPermissionError(error.status);
-        }
-        const message = extractGraphMessageFromBody(error.body);
-        if (message !== undefined) {
-            return `Graph ${error.status}: ${message}`;
-        }
-        return error.message;
-    }
-    return error instanceof Error ? error.message : String(error);
-}
-/**
- * Builds the actionable reason for a Graph 403 hit during principal resolution.
- * The email→object-id lookup needs the `User.ReadBasic.All` and
- * `Group.Read.All` delegated Graph permissions; a 403 means the active
- * account's token doesn't carry them in this tenant (consent was never
- * granted). Rather than surface Graph's opaque "Insufficient privileges", we
- * name the cause and the two ways forward: get those permissions consented, or
- * skip the lookup entirely by passing the AAD object ID (GUID) instead of an
- * email.
- */
-function formatGraphPermissionError(status) {
-    return (`Graph ${status}: your sign-in lacks permission to look up accounts by email. ` +
-        `Pass the AAD object ID (GUID) instead, or have an admin grant the ` +
-        `User.ReadBasic.All and Group.Read.All Graph permissions.`);
-}
-/**
- * Parses a Graph error body string and returns the inner `error.message`. Returns
- * `undefined` if the body is missing, not valid JSON, or doesn't carry the
- * `{ error: { message } }` shape. Pulled out as a top-level function so the
- * unit tests can exercise it without constructing an `HttpClientError`.
- */
-function extractGraphMessageFromBody(body) {
-    if (!body)
-        return undefined;
-    try {
-        const parsed = JSON.parse(body);
-        const message = parsed?.error?.message;
-        return typeof message === 'string' ? message : undefined;
-    }
-    catch {
-        return undefined;
-    }
-}
-/**
- * Cheap pre-flight check that an input looks like an email address. We do not
- * try to be RFC-5321 compliant — the goal is to surface obvious typos
- * (`foo@`, `@bar`, `a@b@c`, `a@b`) as a `UsageError` naming the bad input,
- * rather than letting Graph reject them with an opaque 400.
- */
-function looksLikeEmail(input) {
-    return /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(input);
-}
-/**
- * Builds a `MaafAppPermission` from a resolved reference. The `name` field is a
- * display label echoed back unchanged on the response — we prefer the friendly
- * displayName from Graph, fall back to the original input (which for the
- * email-passthrough path is the email itself).
-
- */
-function toMaafPermissionEntry(ref, role) {
-    return {
-        name: ref.displayName ?? ref.input,
-        properties: {
-            roleName: role,
-            principal: buildMaafPrincipal(ref),
-        },
-    };
-}
-/**
- * Maps a {@link ResolvedRef} to a {@link MaafPrincipal}. Prefers the AAD object
- * id when present; otherwise emits an email-only principal for the server to
- * resolve. `resolveAllAsync` guarantees at least one of `id`/`email` is set, so
- * the final `email` is always defined when `id` is absent.
- */
-function buildMaafPrincipal(ref) {
-    if (ref.id) {
-        return ref.email ? { id: ref.id, email: ref.email } : { id: ref.id };
-    }
-    return { email: ref.email ?? ref.input };
-}
-/**
- * Builds a `GrsRepoPermission` from a resolved reference for the `edit` access
- * path. Mirrors {@link toMaafPermissionEntry} — same `name` semantics, same
- * principal id passthrough — but targets the `RepositoryContributor` role
- * at the GRS repository scope. The GRS `GrsPrincipal` shape has no `email`
- * field (PPAuthZ only consumes the object id), so the email is dropped here
- * even when the user originally provided one.
- */
-function toGrsPermissionEntry(ref) {
-    // The GRS share path only runs for native-repo edit, which never uses email
-    // passthrough, so `ref.id` is always resolved here.
-    const id = ref.id ?? ref.input;
-    return {
-        name: ref.displayName ?? ref.input,
-        properties: {
-            roleName: GrsRepositoryContributorRoleName,
-            principal: ref.type ? { id, type: ref.type } : { id },
-        },
-    };
-}
-/**
- * Shapes a `ResolvedRef` for the JSON envelope's `notFound` / `skipped` arrays.
- * Strips the internal `input` field (which echoes the user's literal entry —
- * useful for stderr warnings, but redundant in structured JSON where consumers
- * already have the original list) and exposes only `id` plus a friendly
- * `label` (Graph displayName when available, else the input).
- *
- * Only the unshare path populates these arrays, and unshare always resolves
- * ids, so `ref.id` is present here.
- */
-function toJsonRef(ref) {
-    return { id: ref.id ?? ref.input, label: ref.displayName ?? ref.input };
-}
-/**
- * For share, the granted count comes from the server echo (the spec lets the
- * server dedupe or treat 409 "already exists" as success and echo the entry).
- * For unshare, the count comes from the request because neither endpoint
- * populates `delete` on the response.
- *
- * The wording varies by access mode:
- * - `play` → "play the app" / "play permissions"
- * - `edit` → "edit the app" / "edit permissions"
- *
- * When unshare matched no existing assignments for some principals, an info
- * line follows the success summary naming them — these are silent no-ops
- * (the principal had no assignment to revoke), not failures.
- */
-function printSummary(args) {
-    const { appName, mode, access, inputCount, outcome } = args;
-    const accessVerb = access === 'play' ? 'play' : 'edit';
-    if (mode === 'share') {
-        const result = outcome.result;
-        const grantedCount = result.put?.length ?? 0;
-        if (grantedCount === 0) {
-            printInfo('No changes were applied.');
-            return;
-        }
-        printSuccess(`Shared app '${appName}' with ${grantedCount} ${pluralize('principal', grantedCount)}. They can now ${accessVerb} the app.`);
-        return;
-    }
-    const revokedCount = outcome.revokedCount ?? 0;
-    const revokedPrincipalCount = outcome.revokedPrincipalCount ?? revokedCount;
-    if (revokedPrincipalCount === 0) {
-        // Every requested principal was already without an assignment — emit info
-        // rather than "Revoked ... for 0 principals" which reads like an error.
-        printInfo(`No ${accessVerb} assignments to revoke on '${appName}' — none of the ${inputCount} ${pluralize('principal', inputCount)} had existing access.`);
-        return;
-    }
-    printSuccess(`Revoked ${accessVerb} permissions for ${revokedPrincipalCount} ${pluralize('principal', revokedPrincipalCount)} on '${appName}'.`);
-    if (outcome.notFound && outcome.notFound.length > 0) {
-        const labels = outcome.notFound.map((r) => r.displayName ?? r.input).join(', ');
-        printInfo(`${outcome.notFound.length} ${pluralize('principal', outcome.notFound.length)} had no existing ${accessVerb} access (no-op): ${labels}`);
-    }
-    if (outcome.skipped && outcome.skipped.length > 0) {
-        // Matched-by-principal but the role assignment carried a null
-        // `roleDefinitionName`, so the action couldn't safely classify it.
-        // Surface it instead of letting the unshare silently no-op.
-        const labels = outcome.skipped.map((r) => r.displayName ?? r.input).join(', ');
-        printInfo(`${outcome.skipped.length} ${pluralize('principal', outcome.skipped.length)} had a role assignment with an unknown role definition; ${accessVerb} access was not modified for: ${labels}. Investigate via the role-assignments API.`);
-    }
-}
-function pluralize(noun, count) {
-    return count === 1 ? noun : `${noun}s`;
-}
-function configureOptionSchema(argumentProvider, mode) {
-    const help = mode === 'share' ? HelpStrings.app.share : HelpStrings.app.unshare;
-    const args = mode === 'share' ? ShareMaafAppArguments : UnshareMaafAppArguments;
-    argumentProvider.setDescription(help.description);
-    argumentProvider.addExamples(help.examples);
-    argumentProvider.consumePositionalArgs('userOrGroup');
-    argumentProvider.addOptions([
-        {
-            flags: { key: args.AppName.name },
-            env: args.AppName.envVar,
-            description: help.options.app,
-            optionalInNonInteractive: true,
-        },
-        {
-            flags: { key: args.Access.name },
-            env: args.Access.envVar,
-            default: args.Access.defaultValue,
-            description: help.options.access,
-            optionalInNonInteractive: true,
-        },
-    ]);
-}
-//# sourceMappingURL=MaafAppPermissions.js.map