@motherbase/cli 0.2.3 → 0.2.5

package/src/commands/signing.js

@@ -0,0 +1,130 @@
+'use strict';
+
+// Local key material, the halves of `gen` that need no server: signing keys
+// (`gen signing-key`), tokens signed with them (`gen bearer-jwt`) and a fresh
+// set of stack secrets (`gen keys`). Node's crypto does all of it; the CLI has
+// no dependencies and this does not add one.
+
+const crypto = require('crypto');
+const fs = require('fs');
+const path = require('path');
+const api = require('../api');
+const { output } = require('./_util');
+const { CliError } = require('../context');
+
+const DEFAULT_KEY_FILE = path.join('motherbase', 'signing_keys.json');
+const ALGORITHMS = {
+  ES256: () => crypto.generateKeyPairSync('ec', { namedCurve: 'P-256' }),
+  RS256: () => crypto.generateKeyPairSync('rsa', { modulusLength: 2048 }),
+  EdDSA: () => crypto.generateKeyPairSync('ed25519'),
+};
+
+/** A private JWK with the kid and alg the server keeps when it is imported. */
+function generateSigningKey(algorithm = 'ES256') {
+  const generate = ALGORITHMS[algorithm];
+  if (!generate) throw new CliError(`--algorithm must be one of: ${Object.keys(ALGORITHMS).join(', ')}`);
+  const { privateKey } = generate();
+  return { ...privateKey.export({ format: 'jwk' }), kid: crypto.randomUUID(), alg: algorithm, use: 'sig' };
+}
+
+function algorithmOf(jwk) {
+  if (jwk.kty === 'EC' && jwk.crv === 'P-256') return 'ES256';
+  if (jwk.kty === 'RSA') return 'RS256';
+  if (jwk.kty === 'OKP' && jwk.crv === 'Ed25519') return 'EdDSA';
+  throw new CliError('The signing key must be an ES256, RS256 or EdDSA private JWK.');
+}
+
+const b64url = value => Buffer.from(typeof value === 'string' ? value : JSON.stringify(value)).toString('base64url');
+
+/** A compact JWS over `claims`, signed with a private JWK. */
+function signJwt(jwk, claims) {
+  const alg = algorithmOf(jwk);
+  const input = `${b64url({ alg, kid: jwk.kid, typ: 'JWT' })}.${b64url(claims)}`;
+  const key = crypto.createPrivateKey({ key: jwk, format: 'jwk' });
+  const signature = alg === 'EdDSA'
+    ? crypto.sign(null, Buffer.from(input), key)
+    : crypto.sign('sha256', Buffer.from(input), alg === 'ES256' ? { key, dsaEncoding: 'ieee-p1363' } : key);
+  return `${input}.${signature.toString('base64url')}`;
+}
+
+/** `30s`, `15m`, `2h`, `7d`, or plain seconds. */
+function parseDuration(value) {
+  const match = /^(\d+)([smhd]?)$/.exec(String(value).trim());
+  if (!match) throw new CliError(`invalid duration "${value}" (use e.g. 30m, 2h, 7d)`);
+  return Number(match[1]) * { '': 1, s: 1, m: 60, h: 3600, d: 86400 }[match[2]];
+}
+
+function readKeys(file) {
+  if (!fs.existsSync(file)) {
+    throw new CliError(`${file} does not exist. Run \`motherbase gen signing-key --append\` first.`);
+  }
+  const keys = JSON.parse(fs.readFileSync(file, 'utf8'));
+  if (!Array.isArray(keys) || !keys.length) throw new CliError(`${file} holds no keys.`);
+  return keys;
+}
+
+const signingKey = {
+  summary: 'Generate a JWT signing key (a private JWK) to import into a project',
+  usage: 'motherbase gen signing-key [--algorithm ES256|RS256|EdDSA] [--append] [--key-file motherbase/signing_keys.json]',
+  async run(ctx, _args, flags) {
+    const key = generateSigningKey(flags.algorithm || 'ES256');
+    if (!flags.append) {
+      output(ctx, key, (d, ui) => ui.print(JSON.stringify(d, null, 2)));
+      return;
+    }
+    const file = path.resolve(ctx.cwd, flags['key-file'] || DEFAULT_KEY_FILE);
+    const keys = fs.existsSync(file) ? JSON.parse(fs.readFileSync(file, 'utf8')) : [];
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    // Private keys: readable by the owner only.
+    fs.writeFileSync(file, JSON.stringify([...keys, key], null, 2) + '\n', { mode: 0o600 });
+    output(ctx, { kid: key.kid, alg: key.alg, file }, (d, ui) => {
+      ui.success(`Appended ${d.alg} key ${d.kid} to ${d.file}`);
+      ui.info('Import it in Studio (Project Settings > JWT Keys) to have the project accept its tokens.');
+    });
+  },
+};
+
+const bearerJwt = {
+  summary: 'Sign an access token with a local signing key, for calling the API as a user',
+  usage: 'motherbase gen bearer-jwt --sub <user id> [--role authenticated] [--valid-for 1h | --exp <unix>] [--payload <json>] [--issuer <url>] [--key-file <file>]',
+  async run(ctx, _args, flags) {
+    const [jwk] = readKeys(path.resolve(ctx.cwd, flags['key-file'] || DEFAULT_KEY_FILE));
+    if (!flags.sub) throw new CliError('--sub is required: the project resolves the token to that user.');
+    // The project verifies iss and aud against its own URL; ask it rather than guess.
+    const issuer = flags.issuer || (await api.adminRequest(ctx, 'GET', '/auth/signing-keys')).issuer;
+    const now = Math.floor(Date.now() / 1000);
+    const extra = flags.payload ? JSON.parse(String(flags.payload)) : {};
+    const claims = {
+      ...extra,
+      sub: String(flags.sub),
+      role: flags.role || extra.role || 'authenticated',
+      iss: issuer,
+      aud: flags.audience || issuer,
+      iat: now,
+      exp: flags.exp ? Number(flags.exp) : now + parseDuration(flags['valid-for'] || '1h'),
+    };
+    const token = signJwt(jwk, claims);
+    output(ctx, { token, kid: jwk.kid, claims }, d => process.stdout.write(`${d.token}\n`));
+  },
+};
+
+const hex = n => crypto.randomBytes(n).toString('hex');
+
+const keys = {
+  summary: 'Generate a fresh set of secrets for a local stack (use -o env)',
+  usage: 'motherbase gen keys [-o env]',
+  async run(ctx) {
+    const data = {
+      JWT_SECRET: hex(32),
+      CONFIG_ENCRYPTION_KEY: crypto.randomBytes(32).toString('base64'),
+      PLATFORM_SERVICE_TOKEN: hex(32),
+      EDGE_RUNTIME_TOKEN: hex(32),
+      POSTGRES_PASSWORD: hex(16),
+      S3_ACCESS_KEY_ID: hex(8),
+      S3_SECRET_ACCESS_KEY: hex(20),
+    };
+    output(ctx, data, (d, ui) => ui.keyValue(d));
+  },
+};
+
+module.exports = { signingKey, bearerJwt, keys, generateSigningKey, signJwt, parseDuration };

package/src/commands/snippets.js

@@ -0,0 +1,44 @@
+'use strict';
+
+const api = require('../api');
+const { output, requireArg } = require('./_util');
+
+// SQL Editor snippets, kept by the project (see the Studio's SQL Editor). Like
+// `supabase snippets`: list what you can see, download one as plain SQL.
+const subcommands = {
+  list: {
+    summary: 'List SQL snippets (yours and the ones shared with the project)',
+    usage: 'motherbase snippets list',
+    async run(ctx) {
+      const data = await api.adminRequest(ctx, 'GET', '/content', { query: { type: 'sql' } });
+      const items = (data && data.items) || [];
+      output(ctx, data, (_d, ui) =>
+        ui.table(items.map(item => ({ ...item, visibility: item.visibility === 'project' ? 'shared' : 'private' })), [
+          { key: 'id', label: 'ID' },
+          { key: 'name', label: 'NAME' },
+          { key: 'visibility', label: 'VISIBILITY' },
+          { key: 'ownerId', label: 'OWNER' },
+          { key: 'updatedAt', label: 'UPDATED' },
+        ]),
+      );
+    },
+  },
+  download: {
+    summary: 'Print a snippet as plain SQL (redirect it to a file to save it)',
+    usage: 'motherbase snippets download <id>',
+    async run(ctx, args) {
+      const id = requireArg(args[0], 'id');
+      const data = await api.adminRequest(ctx, 'GET', `/content/${encodeURIComponent(id)}`);
+      const item = data && data.item;
+      // Structured output keeps the whole record; the default is the bare SQL,
+      // with no decoration, so `> query.sql` writes a runnable file.
+      output(ctx, item, () => process.stdout.write(`${item.content.sql}\n`));
+    },
+  },
+};
+
+module.exports = {
+  summary: 'SQL Editor snippets',
+  usage: 'motherbase snippets <list|download> ...',
+  subcommands,
+};

package/src/commands/storage.js

@@ -1,9 +1,140 @@
 'use strict';
 
+// Storage in the Supabase CLI's shape: objects are addressed `ss:///bucket/key`
+// and `ls|cp|mv|rm` take `-r` for a whole prefix. The pre-Supabase forms still
+// work: `cp ./a.png bucket:` uploads, `cp <fileId> ./a.png` downloads and
+// `rm <fileId>` deletes by id.
+
 const fs = require('fs');
 const path = require('path');
 const api = require('../api');
 const { output, requireArg, splitRef } = require('./_util');
+const { CliError } = require('../context');
+const remote = require('../storage/remote');
+
+const PAGE = 1000;
+
+const objectPath = (bucket, key) => `/storage/buckets/${encodeURIComponent(bucket)}/objects/${remote.encodeKey(key)}`;
+
+/** Every key under a prefix, paged through the server's 1000-row limit. */
+async function listKeys(ctx, bucket, prefix) {
+  const keys = [];
+  for (let offset = 0; ; offset += PAGE) {
+    const data = await api.adminRequest(ctx, 'GET', `/storage/buckets/${encodeURIComponent(bucket)}/objects`, {
+      query: { prefix: prefix || undefined, limit: PAGE, offset },
+    });
+    const page = (data && data.objects) || [];
+    keys.push(...page.map(o => o.name));
+    if (page.length < PAGE) return keys;
+  }
+}
+
+/** Files under a local directory, as paths relative to it with `/` separators. */
+function walk(dir, base = dir) {
+  return fs.readdirSync(dir, { withFileTypes: true }).flatMap(entry => {
+    const full = path.join(dir, entry.name);
+    if (entry.isDirectory()) return walk(full, base);
+    return entry.isFile() ? [path.relative(base, full).split(path.sep).join('/')] : [];
+  });
+}
+
+/**
+ * Run one request per object, in order. The first failure stops the batch and
+ * says how far it got, so a partial copy or delete is never reported as done.
+ */
+async function each(items, label, fn) {
+  const done = [];
+  for (const item of items) {
+    try {
+      await fn(item);
+    } catch (err) {
+      throw new CliError(`${label} failed on ${item} after ${done.length} of ${items.length}: ${err.message}`);
+    }
+    done.push(item);
+  }
+  return done;
+}
+
+/** The keys an operation on `key` touches: the one object, or everything under it with -r. */
+async function sourceKeys(ctx, { bucket, key }, recursive) {
+  if (!recursive) {
+    if (!key) throw new CliError('Name an object, or pass -r to act on a whole prefix.');
+    return [key];
+  }
+  const keys = await listKeys(ctx, bucket, remote.asPrefix(key));
+  if (!keys.length) throw new CliError(`No objects under ss:///${bucket}/${remote.asPrefix(key)}`);
+  return keys;
+}
+
+/** Remote-to-remote copy or move: same bucket, since both routes are bucket-scoped. */
+async function transfer(ctx, action, srcArg, dstArg, recursive) {
+  const src = remote.requireBucket(remote.parseRemote(srcArg), srcArg);
+  const dst = remote.requireBucket(remote.parseRemote(dstArg), dstArg);
+  if (src.bucket !== dst.bucket) {
+    throw new CliError(`${action} works within one bucket: ${src.bucket} and ${dst.bucket} differ.`);
+  }
+  const keys = await sourceKeys(ctx, src, recursive);
+  const target = key => (recursive
+    ? remote.rebase(key, remote.asPrefix(src.key), remote.asPrefix(dst.key))
+    : remote.destinationKey(dst.key, key));
+  // cp overwrites as it does locally; mv refuses to, as Supabase's does.
+  const upsert = action === 'copy';
+  return each(keys, action, key =>
+    api.adminRequest(ctx, 'POST', `/storage/buckets/${encodeURIComponent(src.bucket)}/${action}`, {
+      body: { from: key, to: target(key), upsert },
+    }),
+  );
+}
+
+async function upload(ctx, srcArg, dstArg, recursive) {
+  const dst = remote.requireBucket(remote.parseRemote(dstArg), dstArg);
+  const local = path.resolve(ctx.cwd, srcArg);
+  const upsert = 'true';
+  if (fs.statSync(local).isDirectory()) {
+    if (!recursive) throw new CliError(`${srcArg} is a directory: pass -r to upload it.`);
+    const prefix = remote.asPrefix(dst.key);
+    return each(walk(local), 'upload', rel =>
+      api.uploadFile(ctx, '/storage/files', path.join(local, rel), { bucket: dst.bucket, path: prefix + rel, upsert }),
+    );
+  }
+  const key = remote.destinationKey(dst.key, local);
+  return each([key], 'upload', () => api.uploadFile(ctx, '/storage/files', local, { bucket: dst.bucket, path: key, upsert }));
+}
+
+async function download(ctx, srcArg, dstArg, recursive) {
+  const src = remote.requireBucket(remote.parseRemote(srcArg), srcArg);
+  const local = path.resolve(ctx.cwd, dstArg);
+  if (recursive) {
+    const prefix = remote.asPrefix(src.key);
+    const keys = await sourceKeys(ctx, src, true);
+    return each(keys, 'download', key => {
+      const target = path.join(local, ...key.slice(prefix.length).split('/'));
+      fs.mkdirSync(path.dirname(target), { recursive: true });
+      return api.downloadFile(ctx, objectPath(src.bucket, key), target);
+    });
+  }
+  const [key] = await sourceKeys(ctx, src, false);
+  const intoDir = dstArg.endsWith('/') || dstArg.endsWith(path.sep) || (fs.existsSync(local) && fs.statSync(local).isDirectory());
+  const target = intoDir ? path.join(local, path.basename(key)) : local;
+  fs.mkdirSync(path.dirname(target), { recursive: true });
+  return each([key], 'download', () => api.downloadFile(ctx, objectPath(src.bucket, key), target));
+}
+
+// The id-addressed forms that predate `ss://` paths.
+async function legacyCopy(ctx, src, dst, flags) {
+  if (fs.existsSync(path.resolve(ctx.cwd, src))) {
+    const { bucket } = splitRef(dst);
+    const fields = { bucket, visibility: flags.visibility };
+    const data = await api.uploadFile(ctx, '/storage/files', path.resolve(ctx.cwd, src), fields);
+    return output(ctx, data, (d, ui) => ui.success(`Uploaded ${src}${d && d.id ? ` → ${d.id}` : ''}`));
+  }
+  const { rest } = splitRef(src);
+  const fileId = rest || src;
+  const res = await api.downloadFile(ctx, `/storage/files/${fileId}/raw`, path.resolve(ctx.cwd, dst));
+  return output(ctx, res, (d, ui) => ui.success(`Downloaded ${fileId} → ${dst}`));
+}
+
+const reportDone = (verb, count) => (_d, ui) => ui.success(`${verb} ${count} object${count === 1 ? '' : 's'}`);
 
 const buckets = {
   summary: 'Manage storage buckets',
@@ -26,11 +157,16 @@ const buckets = {
     },
     create: {
       summary: 'Create a bucket',
-      usage: 'motherbase storage buckets create <slug> [--name n] [--visibility public|private]',
+      usage:
+        'motherbase storage buckets create <slug> [--name n] [--visibility public|private]'
+        + ' [--file-size-limit 20MB] [--allowed-mime-types image/*,application/pdf]',
       async run(ctx, args, flags) {
         const slug = requireArg(args[0], 'slug');
         const body = { slug, name: flags.name || slug };
         if (flags.visibility) body.visibility = flags.visibility;
+        // Passed through as typed: the server reads "20MB" as well as a byte count.
+        if (flags['file-size-limit']) body.fileSizeLimit = flags['file-size-limit'];
+        if (flags['allowed-mime-types']) body.allowedMimeTypes = String(flags['allowed-mime-types']).split(',');
         const data = await api.adminRequest(ctx, 'POST', '/storage/buckets', { body });
         output(ctx, data, (d, ui) => ui.success(`Created bucket ${slug}`));
       },
@@ -51,63 +187,75 @@ const buckets = {
 const subcommands = {
   buckets,
   ls: {
-    summary: 'List files (optionally within a bucket)',
-    usage: 'motherbase storage ls [bucket]',
-    async run(ctx, args) {
-      const bucket = args[0];
-      const apiPath = bucket ? `/storage/buckets/${bucket}/files` : '/storage/files';
-      const data = await api.adminRequest(ctx, 'GET', apiPath);
-      const rows = (data && (data.files || data.items)) || (Array.isArray(data) ? data : []);
-      output(ctx, data, (_d, ui) =>
-        ui.table(rows, [
-          { key: 'id', label: 'ID' },
-          { key: 'filename', label: 'FILENAME' },
-          { key: 'size', label: 'SIZE' },
-          { key: 'visibility', label: 'VISIBILITY' },
-        ]),
-      );
+    summary: 'List buckets, or the objects under a path',
+    usage: 'motherbase storage ls [ss:///bucket/prefix] [-r]',
+    async run(ctx, args, flags) {
+      const arg = args[0] || remote.SCHEME;
+      // A bare bucket name is the pre-`ss://` form of the same request.
+      const { bucket, key } = remote.parseRemote(remote.isRemote(arg) ? arg : `${remote.SCHEME}${arg}`);
+      if (!bucket) {
+        const data = await api.adminRequest(ctx, 'GET', '/storage/buckets');
+        const slugs = (Array.isArray(data) ? data : []).map(b => `${b.slug}/`);
+        return output(ctx, { entries: slugs }, (d, ui) => d.entries.forEach(e => ui.print(e)));
+      }
+      const prefix = remote.asPrefix(key);
+      const keys = await listKeys(ctx, bucket, prefix);
+      const entries = flags.recursive ? keys : remote.childrenOf(keys, prefix);
+      output(ctx, { bucket, prefix, entries }, (d, ui) => d.entries.forEach(e => ui.print(e)));
     },
   },
   cp: {
-    summary: 'Upload (local -> bucket) or download (fileId -> local)',
-    usage: 'motherbase storage cp <src> <dst>   e.g. cp ./a.png mybucket:  |  cp <fileId> ./a.png',
+    summary: 'Copy between local paths and ss:///bucket/key (upload, download or in-bucket copy)',
+    usage: 'motherbase storage cp <src> <dst> [-r]   e.g. cp ./a.png ss:///media/  |  cp -r ss:///media/img ./img',
     async run(ctx, args, flags) {
       const src = requireArg(args[0], 'src');
       const dst = requireArg(args[1], 'dst');
-      const srcLocal = fs.existsSync(path.resolve(ctx.cwd, src));
-
-      if (srcLocal) {
-        // Upload: dst is "bucket" or "bucket:path" (path is advisory; server keys by id).
-        const { bucket } = splitRef(dst);
-        const fields = {};
-        if (bucket) fields.bucket = bucket;
-        if (flags.visibility) fields.visibility = flags.visibility;
-        const data = await api.uploadFile(ctx, '/storage/files', path.resolve(ctx.cwd, src), fields);
-        output(ctx, data, (d, ui) => ui.success(`Uploaded ${src}${d && d.id ? ` → ${d.id}` : ''}`));
-      } else {
-        // Download: src is a fileId (optionally "bucket:id"), dst is a local path.
-        const { rest } = splitRef(src);
-        const fileId = rest || src;
-        const destPath = path.resolve(ctx.cwd, dst);
-        const res = await api.downloadFile(ctx, `/storage/files/${fileId}/raw`, destPath);
-        if (ctx.flags.json) require('../ui').json(res);
-        else require('../ui').success(`Downloaded ${fileId} → ${dst}`);
+      const recursive = Boolean(flags.recursive);
+      let done;
+      if (remote.isRemote(src) && remote.isRemote(dst)) done = await transfer(ctx, 'copy', src, dst, recursive);
+      else if (remote.isRemote(dst)) done = await upload(ctx, src, dst, recursive);
+      else if (remote.isRemote(src)) done = await download(ctx, src, dst, recursive);
+      else return legacyCopy(ctx, src, dst, flags);
+      output(ctx, { copied: done }, reportDone('Copied', done.length));
+    },
+  },
+  mv: {
+    summary: 'Move objects within a bucket',
+    usage: 'motherbase storage mv <ss:///bucket/src> <ss:///bucket/dst> [-r]',
+    async run(ctx, args, flags) {
+      const src = requireArg(args[0], 'src');
+      const dst = requireArg(args[1], 'dst');
+      if (!remote.isRemote(src) || !remote.isRemote(dst)) {
+        throw new CliError('mv moves objects: both paths must be ss:///bucket/key.');
       }
+      const done = await transfer(ctx, 'move', src, dst, Boolean(flags.recursive));
+      output(ctx, { moved: done }, reportDone('Moved', done.length));
     },
   },
   rm: {
-    summary: 'Delete a file by id',
-    usage: 'motherbase storage rm <id>',
-    async run(ctx, args) {
-      const id = requireArg(args[0], 'id');
-      const data = await api.adminRequest(ctx, 'DELETE', `/storage/files/${id}`);
-      output(ctx, data, (d, ui) => ui.success(`Deleted file ${id}`));
+    summary: 'Delete objects by path (or a file by id)',
+    usage: 'motherbase storage rm <ss:///bucket/key | fileId>... [-r]',
+    async run(ctx, args, flags) {
+      requireArg(args[0], 'path');
+      const removed = [];
+      for (const arg of args) {
+        if (!remote.isRemote(arg)) {
+          await api.adminRequest(ctx, 'DELETE', `/storage/files/${encodeURIComponent(arg)}`);
+          removed.push(arg);
+          continue;
+        }
+        const target = remote.requireBucket(remote.parseRemote(arg), arg);
+        const keys = await sourceKeys(ctx, target, Boolean(flags.recursive));
+        const done = await each(keys, 'rm', key => api.adminRequest(ctx, 'DELETE', objectPath(target.bucket, key)));
+        removed.push(...done.map(key => `${target.bucket}/${key}`));
+      }
+      output(ctx, { removed }, reportDone('Deleted', removed.length));
     },
   },
 };
 
 module.exports = {
-  summary: 'Storage buckets and files',
-  usage: 'motherbase storage <buckets|ls|cp|rm> ...',
+  summary: 'Storage buckets and objects (ss:///bucket/key paths)',
+  usage: 'motherbase storage <buckets|ls|cp|mv|rm> ...',
   subcommands,
 };

package/src/commands/test.js

@@ -0,0 +1,9 @@
+'use strict';
+
+// Supabase's `test db`: pgTAP files from motherbase/tests, run on the linked project.
+
+module.exports = {
+  summary: 'Run database tests (pgTAP)',
+  usage: 'motherbase test db [file.sql ...]',
+  subcommands: require('../migration/commands').testSubcommands,
+};

package/src/commands/users.js

@@ -104,10 +104,39 @@ const subcommands = {
       output(ctx, data, (d, ui) => ui.success(`Sessions revoked for ${id}`));
     },
   },
+  audit: {
+    summary: 'Read the auth audit log, newest first',
+    usage: 'motherbase users audit [--action <a>] [--actor <email|id>] [--type <log type>] [--from <iso>] [--to <iso>] [--limit <n>]',
+    async run(ctx, args, flags) {
+      const query = {
+        action: flags.action,
+        actor: flags.actor,
+        log_type: flags.type,
+        from: flags.from,
+        to: flags.to,
+        per_page: flags.limit || 50,
+      };
+      const data = await api.adminRequest(ctx, 'GET', '/auth/audit-logs', { query });
+      const entries = ((data && data.entries) || []).map(e => ({
+        at: e.created_at,
+        action: e.payload.action,
+        actor: e.payload.actor_username || e.payload.actor_id,
+        ip: e.ip_address,
+      }));
+      output(ctx, data, (_d, ui) =>
+        ui.table(entries, [
+          { key: 'at', label: 'AT' },
+          { key: 'action', label: 'ACTION' },
+          { key: 'actor', label: 'ACTOR' },
+          { key: 'ip', label: 'IP' },
+        ]),
+      );
+    },
+  },
 };
 
 module.exports = {
   summary: 'Project auth users',
-  usage: 'motherbase users <list|get|create|update|delete|reset-password|promote|demote|revoke-sessions> ...',
+  usage: 'motherbase users <list|get|create|update|delete|reset-password|promote|demote|revoke-sessions|audit> ...',
   subcommands,
 };

package/src/commands/vault.js

@@ -0,0 +1,82 @@
+'use strict';
+
+const api = require('../api');
+const { output, requireArg } = require('./_util');
+const { CliError } = require('../context');
+
+const subcommands = {
+  list: {
+    summary: 'List Vault secrets (names and metadata, never values)',
+    usage: 'motherbase vault list',
+    async run(ctx) {
+      const data = await api.adminRequest(ctx, 'GET', '/vault');
+      const secrets = (data && data.secrets) || [];
+      output(ctx, data, (_d, ui) =>
+        ui.table(secrets, [
+          { key: 'id', label: 'ID' },
+          { key: 'name', label: 'NAME' },
+          { key: 'description', label: 'DESCRIPTION' },
+          { key: 'updatedAt', label: 'UPDATED' },
+        ]),
+      );
+    },
+  },
+  enable: {
+    summary: 'Install the Vault for this project',
+    usage: 'motherbase vault enable',
+    async run(ctx) {
+      const data = await api.adminRequest(ctx, 'POST', '/vault/enable');
+      output(ctx, data, (_d, ui) => ui.success('Vault enabled'));
+    },
+  },
+  create: {
+    summary: 'Store an encrypted secret',
+    usage: 'motherbase vault create <name> --secret <value> [--description <text>]',
+    async run(ctx, args, flags) {
+      const name = requireArg(args[0], 'name');
+      if (typeof flags.secret !== 'string') throw new CliError('--secret is required');
+      const body = { name, secret: flags.secret };
+      if (typeof flags.description === 'string') body.description = flags.description;
+      const data = await api.adminRequest(ctx, 'POST', '/vault/secrets', { body });
+      output(ctx, data, (_d, ui) => ui.success(`Created secret ${name}`));
+    },
+  },
+  update: {
+    summary: 'Rename a secret, change its value or its description',
+    usage: 'motherbase vault update <id> [--name <n>] [--secret <value>] [--description <text>]',
+    async run(ctx, args, flags) {
+      const id = requireArg(args[0], 'id');
+      const body = {};
+      for (const key of ['name', 'secret', 'description']) {
+        if (typeof flags[key] === 'string') body[key] = flags[key];
+      }
+      if (!Object.keys(body).length) throw new CliError('nothing to update: pass --name, --secret or --description');
+      const data = await api.adminRequest(ctx, 'PATCH', `/vault/secrets/${encodeURIComponent(id)}`, { body });
+      output(ctx, data, (_d, ui) => ui.success(`Updated secret ${id}`));
+    },
+  },
+  reveal: {
+    summary: 'Print the decrypted value of a secret',
+    usage: 'motherbase vault reveal <id>',
+    async run(ctx, args) {
+      const id = requireArg(args[0], 'id');
+      const data = await api.adminRequest(ctx, 'GET', `/vault/secrets/${encodeURIComponent(id)}/reveal`);
+      output(ctx, data, (d, ui) => ui.print(String((d && d.secret) ?? '')));
+    },
+  },
+  delete: {
+    summary: 'Delete a secret',
+    usage: 'motherbase vault delete <id>',
+    async run(ctx, args) {
+      const id = requireArg(args[0], 'id');
+      const data = await api.adminRequest(ctx, 'DELETE', `/vault/secrets/${encodeURIComponent(id)}`);
+      output(ctx, data, (_d, ui) => ui.success(`Deleted secret ${id}`));
+    },
+  },
+};
+
+module.exports = {
+  summary: 'Encrypted secrets (Vault)',
+  usage: 'motherbase vault <list|enable|create|update|reveal|delete> ...',
+  subcommands,
+};