@motherbase/cli 0.2.4 → 0.2.6

package/src/commands/rls.js

@@ -1,176 +1,176 @@
-'use strict';
-
-const api = require('../api');
-const { output, requireArg } = require('./_util');
-const { CliError } = require('../context');
-
-const policy = {
-  summary: 'Manage RLS policies',
-  usage: 'motherbase rls policy create --table <t> --name <n> --command <SELECT|INSERT|UPDATE|DELETE|ALL> [--using <expr>] [--check <expr>] [--roles a,b] | motherbase rls policy delete <table> <name>',
-  subcommands: {
-    create: {
-      summary: 'Create an RLS policy',
-      usage: 'motherbase rls policy create --table <t> --name <n> --command <cmd> [--using <expr>] [--check <expr>] [--roles a,b]',
-      async run(ctx, args, flags) {
-        const body = {
-          table: flags.table,
-          name: flags.name,
-          command: (flags.command || 'ALL').toUpperCase(),
-        };
-        if (!body.table || !body.name) throw new CliError('--table and --name are required');
-        if (flags.using) body.using = flags.using;
-        if (flags.check) body.check = flags.check;
-        if (flags.roles) body.roles = String(flags.roles).split(',').map(s => s.trim()).filter(Boolean);
-        const data = await api.adminRequest(ctx, 'POST', '/rls/policies', { body });
-        output(ctx, data, (d, ui) => ui.success(`Created policy ${body.name} on ${body.table}`));
-      },
-    },
-    delete: {
-      summary: 'Delete an RLS policy',
-      usage: 'motherbase rls policy delete <table> <name>',
-      async run(ctx, args) {
-        const table = requireArg(args[0], 'table');
-        const name = requireArg(args[1], 'name');
-        const data = await api.adminRequest(ctx, 'DELETE', '/rls/policies', { body: { table, name } });
-        output(ctx, data, (d, ui) => ui.success(`Dropped policy ${name} on ${table}`));
-      },
-    },
-  },
-};
-
-const subcommands = {
-  list: {
-    summary: 'List tables with RLS status and policies',
-    usage: 'motherbase rls list',
-    async run(ctx) {
-      const data = await api.adminRequest(ctx, 'GET', '/rls/tables');
-      output(ctx, data, (rows, ui) =>
-        ui.table((Array.isArray(rows) ? rows : []).map(r => ({
-          table: r.table,
-          rls: r.rlsEnabled ? 'on' : 'off',
-          policies: Array.isArray(r.policies) ? r.policies.length : 0,
-        })), [
-          { key: 'table', label: 'TABLE' },
-          { key: 'rls', label: 'RLS' },
-          { key: 'policies', label: 'POLICIES' },
-        ]),
-      );
-    },
-  },
-  enable: {
-    summary: 'Enable RLS on a table',
-    usage: 'motherbase rls enable <table>',
-    async run(ctx, args) {
-      const table = requireArg(args[0], 'table');
-      const data = await api.adminRequest(ctx, 'POST', `/rls/tables/${table}/rls`, { body: { enabled: true } });
-      output(ctx, data, (d, ui) => ui.success(`RLS enabled on ${table}`));
-    },
-  },
-  disable: {
-    summary: 'Disable RLS on a table',
-    usage: 'motherbase rls disable <table>',
-    async run(ctx, args) {
-      const table = requireArg(args[0], 'table');
-      const data = await api.adminRequest(ctx, 'POST', `/rls/tables/${table}/rls`, { body: { enabled: false } });
-      output(ctx, data, (d, ui) => ui.success(`RLS disabled on ${table}`));
-    },
-  },
-  policy,
-  preset: {
-    summary: 'Apply a policy preset to a table',
-    usage:
-      'motherbase rls preset <table> <starter|public_crud|authenticated_crud|admin_only|blocked|owner_only|org_scoped|public_read_owner_write|soft_delete> [--owner-column c] [--org-column c] [--org-claim c] [--deleted-column c] [--replace]',
-    async run(ctx, args, flags) {
-      const table = requireArg(args[0], 'table');
-      const preset = requireArg(args[1], 'preset');
-      const body = { preset };
-      if (flags['owner-column']) body.ownerColumn = flags['owner-column'];
-      if (flags['org-column']) body.orgColumn = flags['org-column'];
-      if (flags['org-claim']) body.orgClaim = flags['org-claim'];
-      if (flags['deleted-column']) body.deletedColumn = flags['deleted-column'];
-      if (flags.replace) body.replace = true;
-      const data = await api.adminRequest(ctx, 'POST', `/rls/tables/${table}/preset`, { body });
-      output(ctx, data, (d, ui) =>
-        ui.success(`Applied ${preset} to ${table}: ${(d && d.policies ? d.policies : []).join(', ')}`)
-      );
-    },
-  },
-  simulate: {
-    summary: 'Run a query as a given caller and show what RLS lets through',
-    usage:
-      'motherbase rls simulate --sql "select * from t" [--as anon|authenticated|<userId>] [--claims \'{"org_id":"x"}\'] [--limit n]',
-    async run(ctx, args, flags) {
-      const sql = flags.sql || args.join(' ');
-      if (!sql) throw new CliError('--sql is required');
-
-      // `--as` takes a role or a user id. A value that is not one of the two
-      // roles is treated as a user id, which is what makes "as this person"
-      // spellable without looking their claims up by hand.
-      const as = flags.as || 'anon';
-      const body = { sql };
-      if (as === 'anon' || as === 'authenticated') body.role = as;
-      else body.userId = as;
-      if (flags.claims) {
-        try {
-          body.claims = JSON.parse(flags.claims);
-        } catch {
-          throw new CliError('--claims must be a JSON object');
-        }
-      }
-      if (flags.limit) body.limit = Number(flags.limit);
-
-      const data = await api.adminRequest(ctx, 'POST', '/rls/simulate', { body });
-      output(ctx, data, (d, ui) => {
-        if (d.denied) {
-          ui.warn(`Refused by Postgres: ${d.denied.message}`);
-        }
-        if (d.rows && d.rows.length) {
-          ui.table(d.rows, (d.columns || []).map(key => ({ key, label: key.toUpperCase() })));
-        } else {
-          ui.info('0 rows');
-        }
-        if (d.truncated) ui.info(`Truncated at ${d.rowCount} rows.`);
-        for (const t of d.tables || []) {
-          const reason =
-            t.deniedBy === 'grant'
-              ? 'no privilege for this role'
-              : t.deniedBy === 'policy'
-                ? 'RLS on, no policy grants this role read access'
-                : null;
-          ui.info(`${t.schema}.${t.table}: RLS ${t.rlsEnabled ? 'on' : 'off'}${reason ? ` (${reason})` : ''}`);
-          for (const p of t.policies || []) {
-            ui.info(`  ${p.applies ? '*' : ' '} ${p.name} ${p.command} to ${p.roles.join(',')}: ${p.using || 'true'}`);
-          }
-        }
-      });
-    },
-  },
-  lint: {
-    summary: 'Run the security and performance advisor',
-    usage: 'motherbase rls lint [--level critical|warning|info]',
-    async run(ctx, args, flags) {
-      const data = await api.adminRequest(ctx, 'GET', '/advisor');
-      const findings = (data && data.findings ? data.findings : []).filter(
-        f => !flags.level || f.level === flags.level
-      );
-      output(ctx, { ...data, findings }, (d, ui) => {
-        if (!findings.length) return ui.success('No findings.');
-        ui.table(
-          findings.map(f => ({ level: f.level, id: f.id, target: f.target, title: f.title })),
-          [
-            { key: 'level', label: 'LEVEL' },
-            { key: 'id', label: 'RULE' },
-            { key: 'target', label: 'TARGET' },
-            { key: 'title', label: 'FINDING' },
-          ]
-        );
-      });
-    },
-  },
-};
-
-module.exports = {
-  summary: 'Row-level security (tables, policies, presets, simulator, lint)',
-  usage: 'motherbase rls <list|enable|disable|policy|preset|simulate|lint> ...',
-  subcommands,
-};
+'use strict';
+
+const api = require('../api');
+const { output, requireArg } = require('./_util');
+const { CliError } = require('../context');
+
+const policy = {
+  summary: 'Manage RLS policies',
+  usage: 'motherbase rls policy create --table <t> --name <n> --command <SELECT|INSERT|UPDATE|DELETE|ALL> [--using <expr>] [--check <expr>] [--roles a,b] | motherbase rls policy delete <table> <name>',
+  subcommands: {
+    create: {
+      summary: 'Create an RLS policy',
+      usage: 'motherbase rls policy create --table <t> --name <n> --command <cmd> [--using <expr>] [--check <expr>] [--roles a,b]',
+      async run(ctx, args, flags) {
+        const body = {
+          table: flags.table,
+          name: flags.name,
+          command: (flags.command || 'ALL').toUpperCase(),
+        };
+        if (!body.table || !body.name) throw new CliError('--table and --name are required');
+        if (flags.using) body.using = flags.using;
+        if (flags.check) body.check = flags.check;
+        if (flags.roles) body.roles = String(flags.roles).split(',').map(s => s.trim()).filter(Boolean);
+        const data = await api.adminRequest(ctx, 'POST', '/rls/policies', { body });
+        output(ctx, data, (d, ui) => ui.success(`Created policy ${body.name} on ${body.table}`));
+      },
+    },
+    delete: {
+      summary: 'Delete an RLS policy',
+      usage: 'motherbase rls policy delete <table> <name>',
+      async run(ctx, args) {
+        const table = requireArg(args[0], 'table');
+        const name = requireArg(args[1], 'name');
+        const data = await api.adminRequest(ctx, 'DELETE', '/rls/policies', { body: { table, name } });
+        output(ctx, data, (d, ui) => ui.success(`Dropped policy ${name} on ${table}`));
+      },
+    },
+  },
+};
+
+const subcommands = {
+  list: {
+    summary: 'List tables with RLS status and policies',
+    usage: 'motherbase rls list',
+    async run(ctx) {
+      const data = await api.adminRequest(ctx, 'GET', '/rls/tables');
+      output(ctx, data, (rows, ui) =>
+        ui.table((Array.isArray(rows) ? rows : []).map(r => ({
+          table: r.table,
+          rls: r.rlsEnabled ? 'on' : 'off',
+          policies: Array.isArray(r.policies) ? r.policies.length : 0,
+        })), [
+          { key: 'table', label: 'TABLE' },
+          { key: 'rls', label: 'RLS' },
+          { key: 'policies', label: 'POLICIES' },
+        ]),
+      );
+    },
+  },
+  enable: {
+    summary: 'Enable RLS on a table',
+    usage: 'motherbase rls enable <table>',
+    async run(ctx, args) {
+      const table = requireArg(args[0], 'table');
+      const data = await api.adminRequest(ctx, 'POST', `/rls/tables/${table}/rls`, { body: { enabled: true } });
+      output(ctx, data, (d, ui) => ui.success(`RLS enabled on ${table}`));
+    },
+  },
+  disable: {
+    summary: 'Disable RLS on a table',
+    usage: 'motherbase rls disable <table>',
+    async run(ctx, args) {
+      const table = requireArg(args[0], 'table');
+      const data = await api.adminRequest(ctx, 'POST', `/rls/tables/${table}/rls`, { body: { enabled: false } });
+      output(ctx, data, (d, ui) => ui.success(`RLS disabled on ${table}`));
+    },
+  },
+  policy,
+  preset: {
+    summary: 'Apply a policy preset to a table',
+    usage:
+      'motherbase rls preset <table> <starter|public_crud|authenticated_crud|admin_only|blocked|owner_only|org_scoped|public_read_owner_write|soft_delete> [--owner-column c] [--org-column c] [--org-claim c] [--deleted-column c] [--replace]',
+    async run(ctx, args, flags) {
+      const table = requireArg(args[0], 'table');
+      const preset = requireArg(args[1], 'preset');
+      const body = { preset };
+      if (flags['owner-column']) body.ownerColumn = flags['owner-column'];
+      if (flags['org-column']) body.orgColumn = flags['org-column'];
+      if (flags['org-claim']) body.orgClaim = flags['org-claim'];
+      if (flags['deleted-column']) body.deletedColumn = flags['deleted-column'];
+      if (flags.replace) body.replace = true;
+      const data = await api.adminRequest(ctx, 'POST', `/rls/tables/${table}/preset`, { body });
+      output(ctx, data, (d, ui) =>
+        ui.success(`Applied ${preset} to ${table}: ${(d && d.policies ? d.policies : []).join(', ')}`)
+      );
+    },
+  },
+  simulate: {
+    summary: 'Run a query as a given caller and show what RLS lets through',
+    usage:
+      'motherbase rls simulate --sql "select * from t" [--as anon|authenticated|<userId>] [--claims \'{"org_id":"x"}\'] [--limit n]',
+    async run(ctx, args, flags) {
+      const sql = flags.sql || args.join(' ');
+      if (!sql) throw new CliError('--sql is required');
+
+      // `--as` takes a role or a user id. A value that is not one of the two
+      // roles is treated as a user id, which is what makes "as this person"
+      // spellable without looking their claims up by hand.
+      const as = flags.as || 'anon';
+      const body = { sql };
+      if (as === 'anon' || as === 'authenticated') body.role = as;
+      else body.userId = as;
+      if (flags.claims) {
+        try {
+          body.claims = JSON.parse(flags.claims);
+        } catch {
+          throw new CliError('--claims must be a JSON object');
+        }
+      }
+      if (flags.limit) body.limit = Number(flags.limit);
+
+      const data = await api.adminRequest(ctx, 'POST', '/rls/simulate', { body });
+      output(ctx, data, (d, ui) => {
+        if (d.denied) {
+          ui.warn(`Refused by Postgres: ${d.denied.message}`);
+        }
+        if (d.rows && d.rows.length) {
+          ui.table(d.rows, (d.columns || []).map(key => ({ key, label: key.toUpperCase() })));
+        } else {
+          ui.info('0 rows');
+        }
+        if (d.truncated) ui.info(`Truncated at ${d.rowCount} rows.`);
+        for (const t of d.tables || []) {
+          const reason =
+            t.deniedBy === 'grant'
+              ? 'no privilege for this role'
+              : t.deniedBy === 'policy'
+                ? 'RLS on, no policy grants this role read access'
+                : null;
+          ui.info(`${t.schema}.${t.table}: RLS ${t.rlsEnabled ? 'on' : 'off'}${reason ? ` (${reason})` : ''}`);
+          for (const p of t.policies || []) {
+            ui.info(`  ${p.applies ? '*' : ' '} ${p.name} ${p.command} to ${p.roles.join(',')}: ${p.using || 'true'}`);
+          }
+        }
+      });
+    },
+  },
+  lint: {
+    summary: 'Run the security and performance advisor',
+    usage: 'motherbase rls lint [--level critical|warning|info]',
+    async run(ctx, args, flags) {
+      const data = await api.adminRequest(ctx, 'GET', '/advisor');
+      const findings = (data && data.findings ? data.findings : []).filter(
+        f => !flags.level || f.level === flags.level
+      );
+      output(ctx, { ...data, findings }, (d, ui) => {
+        if (!findings.length) return ui.success('No findings.');
+        ui.table(
+          findings.map(f => ({ level: f.level, id: f.id, target: f.target, title: f.title })),
+          [
+            { key: 'level', label: 'LEVEL' },
+            { key: 'id', label: 'RULE' },
+            { key: 'target', label: 'TARGET' },
+            { key: 'title', label: 'FINDING' },
+          ]
+        );
+      });
+    },
+  },
+};
+
+module.exports = {
+  summary: 'Row-level security (tables, policies, presets, simulator, lint)',
+  usage: 'motherbase rls <list|enable|disable|policy|preset|simulate|lint> ...',
+  subcommands,
+};

package/src/commands/secrets.js

@@ -1,45 +1,66 @@
-'use strict';
-
-const api = require('../api');
-const { output, requireArg } = require('./_util');
-
-const subcommands = {
-  list: {
-    summary: 'List edge secrets (names only)',
-    usage: 'motherbase secrets list',
-    async run(ctx) {
-      const data = await api.adminRequest(ctx, 'GET', '/edge-secrets');
-      const secrets = (data && data.secrets) || data || [];
-      output(ctx, data, (_d, ui) =>
-        ui.table((Array.isArray(secrets) ? secrets : []).map(s => (typeof s === 'string' ? { name: s } : s)), [
-          { key: 'name', label: 'NAME' },
-        ]),
-      );
-    },
-  },
-  set: {
-    summary: 'Set a secret',
-    usage: 'motherbase secrets set <NAME> <value>',
-    async run(ctx, args) {
-      const name = requireArg(args[0], 'NAME');
-      const value = requireArg(args[1], 'value');
-      const data = await api.adminRequest(ctx, 'PUT', '/edge-secrets', { body: { name, value } });
-      output(ctx, data, (d, ui) => ui.success(`Set secret ${name}`));
-    },
-  },
-  unset: {
-    summary: 'Remove a secret',
-    usage: 'motherbase secrets unset <NAME>',
-    async run(ctx, args) {
-      const name = requireArg(args[0], 'NAME');
-      const data = await api.adminRequest(ctx, 'DELETE', `/edge-secrets/${encodeURIComponent(name)}`);
-      output(ctx, data, (d, ui) => ui.success(`Removed secret ${name}`));
-    },
-  },
-};
-
-module.exports = {
-  summary: 'Edge function secrets',
-  usage: 'motherbase secrets <list|set|unset> ...',
-  subcommands,
-};
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const api = require('../api');
+const { output, requireArg, parseKeyValues, parseDotenv } = require('./_util');
+const { CliError } = require('../context');
+
+// `NAME=VALUE ...` plus `--env-file`, as the Supabase CLI takes them. The older
+// `set NAME value` form keeps working. Positional pairs win over the file.
+// Node itself pre-scans argv for `--env-file` and exits (code 9) when the path
+// does not exist relative to the shell's cwd, before this code runs; with
+// `--workdir`, pass an absolute path.
+function collectSecrets(cwd, args, flags) {
+  const fromFile = flags['env-file']
+    ? parseDotenv(fs.readFileSync(path.resolve(cwd, String(flags['env-file'])), 'utf8'))
+    : {};
+  const legacy = args.length === 2 && !args[0].includes('=');
+  const fromArgs = legacy ? { [args[0]]: args[1] } : parseKeyValues(args, { coerce: false });
+  return { ...fromFile, ...fromArgs };
+}
+
+const subcommands = {
+  list: {
+    summary: 'List edge secrets (names only)',
+    usage: 'motherbase secrets list',
+    async run(ctx) {
+      const data = await api.adminRequest(ctx, 'GET', '/edge-secrets');
+      const secrets = (data && data.secrets) || data || [];
+      output(ctx, data, (_d, ui) =>
+        ui.table((Array.isArray(secrets) ? secrets : []).map(s => (typeof s === 'string' ? { name: s } : s)), [
+          { key: 'name', label: 'NAME' },
+        ]),
+      );
+    },
+  },
+  set: {
+    summary: 'Set one or more secrets',
+    usage: 'motherbase secrets set NAME=VALUE [NAME=VALUE ...] [--env-file .env]',
+    async run(ctx, args, flags) {
+      const secrets = collectSecrets(ctx.cwd, args, flags);
+      const names = Object.keys(secrets);
+      if (!names.length) throw new CliError('Nothing to set. Pass NAME=VALUE pairs or --env-file <path>.');
+      // The server sets one secret per request.
+      for (const name of names) {
+        await api.adminRequest(ctx, 'PUT', '/edge-secrets', { body: { name, value: secrets[name] } });
+      }
+      output(ctx, { set: names }, (d, ui) => ui.success(`Set ${names.length === 1 ? 'secret' : 'secrets'} ${names.join(', ')}`));
+    },
+  },
+  unset: {
+    summary: 'Remove a secret',
+    usage: 'motherbase secrets unset <NAME>',
+    async run(ctx, args) {
+      const name = requireArg(args[0], 'NAME');
+      const data = await api.adminRequest(ctx, 'DELETE', `/edge-secrets/${encodeURIComponent(name)}`);
+      output(ctx, data, (d, ui) => ui.success(`Removed secret ${name}`));
+    },
+  },
+};
+
+module.exports = {
+  summary: 'Edge function secrets',
+  usage: 'motherbase secrets <list|set|unset> ...',
+  subcommands,
+};

package/src/commands/signing.js

@@ -0,0 +1,130 @@
+'use strict';
+
+// Local key material, the halves of `gen` that need no server: signing keys
+// (`gen signing-key`), tokens signed with them (`gen bearer-jwt`) and a fresh
+// set of stack secrets (`gen keys`). Node's crypto does all of it; the CLI has
+// no dependencies and this does not add one.
+
+const crypto = require('crypto');
+const fs = require('fs');
+const path = require('path');
+const api = require('../api');
+const { output } = require('./_util');
+const { CliError } = require('../context');
+
+const DEFAULT_KEY_FILE = path.join('motherbase', 'signing_keys.json');
+const ALGORITHMS = {
+  ES256: () => crypto.generateKeyPairSync('ec', { namedCurve: 'P-256' }),
+  RS256: () => crypto.generateKeyPairSync('rsa', { modulusLength: 2048 }),
+  EdDSA: () => crypto.generateKeyPairSync('ed25519'),
+};
+
+/** A private JWK with the kid and alg the server keeps when it is imported. */
+function generateSigningKey(algorithm = 'ES256') {
+  const generate = ALGORITHMS[algorithm];
+  if (!generate) throw new CliError(`--algorithm must be one of: ${Object.keys(ALGORITHMS).join(', ')}`);
+  const { privateKey } = generate();
+  return { ...privateKey.export({ format: 'jwk' }), kid: crypto.randomUUID(), alg: algorithm, use: 'sig' };
+}
+
+function algorithmOf(jwk) {
+  if (jwk.kty === 'EC' && jwk.crv === 'P-256') return 'ES256';
+  if (jwk.kty === 'RSA') return 'RS256';
+  if (jwk.kty === 'OKP' && jwk.crv === 'Ed25519') return 'EdDSA';
+  throw new CliError('The signing key must be an ES256, RS256 or EdDSA private JWK.');
+}
+
+const b64url = value => Buffer.from(typeof value === 'string' ? value : JSON.stringify(value)).toString('base64url');
+
+/** A compact JWS over `claims`, signed with a private JWK. */
+function signJwt(jwk, claims) {
+  const alg = algorithmOf(jwk);
+  const input = `${b64url({ alg, kid: jwk.kid, typ: 'JWT' })}.${b64url(claims)}`;
+  const key = crypto.createPrivateKey({ key: jwk, format: 'jwk' });
+  const signature = alg === 'EdDSA'
+    ? crypto.sign(null, Buffer.from(input), key)
+    : crypto.sign('sha256', Buffer.from(input), alg === 'ES256' ? { key, dsaEncoding: 'ieee-p1363' } : key);
+  return `${input}.${signature.toString('base64url')}`;
+}
+
+/** `30s`, `15m`, `2h`, `7d`, or plain seconds. */
+function parseDuration(value) {
+  const match = /^(\d+)([smhd]?)$/.exec(String(value).trim());
+  if (!match) throw new CliError(`invalid duration "${value}" (use e.g. 30m, 2h, 7d)`);
+  return Number(match[1]) * { '': 1, s: 1, m: 60, h: 3600, d: 86400 }[match[2]];
+}
+
+function readKeys(file) {
+  if (!fs.existsSync(file)) {
+    throw new CliError(`${file} does not exist. Run \`motherbase gen signing-key --append\` first.`);
+  }
+  const keys = JSON.parse(fs.readFileSync(file, 'utf8'));
+  if (!Array.isArray(keys) || !keys.length) throw new CliError(`${file} holds no keys.`);
+  return keys;
+}
+
+const signingKey = {
+  summary: 'Generate a JWT signing key (a private JWK) to import into a project',
+  usage: 'motherbase gen signing-key [--algorithm ES256|RS256|EdDSA] [--append] [--key-file motherbase/signing_keys.json]',
+  async run(ctx, _args, flags) {
+    const key = generateSigningKey(flags.algorithm || 'ES256');
+    if (!flags.append) {
+      output(ctx, key, (d, ui) => ui.print(JSON.stringify(d, null, 2)));
+      return;
+    }
+    const file = path.resolve(ctx.cwd, flags['key-file'] || DEFAULT_KEY_FILE);
+    const keys = fs.existsSync(file) ? JSON.parse(fs.readFileSync(file, 'utf8')) : [];
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    // Private keys: readable by the owner only.
+    fs.writeFileSync(file, JSON.stringify([...keys, key], null, 2) + '\n', { mode: 0o600 });
+    output(ctx, { kid: key.kid, alg: key.alg, file }, (d, ui) => {
+      ui.success(`Appended ${d.alg} key ${d.kid} to ${d.file}`);
+      ui.info('Import it in Studio (Project Settings > JWT Keys) to have the project accept its tokens.');
+    });
+  },
+};
+
+const bearerJwt = {
+  summary: 'Sign an access token with a local signing key, for calling the API as a user',
+  usage: 'motherbase gen bearer-jwt --sub <user id> [--role authenticated] [--valid-for 1h | --exp <unix>] [--payload <json>] [--issuer <url>] [--key-file <file>]',
+  async run(ctx, _args, flags) {
+    const [jwk] = readKeys(path.resolve(ctx.cwd, flags['key-file'] || DEFAULT_KEY_FILE));
+    if (!flags.sub) throw new CliError('--sub is required: the project resolves the token to that user.');
+    // The project verifies iss and aud against its own URL; ask it rather than guess.
+    const issuer = flags.issuer || (await api.adminRequest(ctx, 'GET', '/auth/signing-keys')).issuer;
+    const now = Math.floor(Date.now() / 1000);
+    const extra = flags.payload ? JSON.parse(String(flags.payload)) : {};
+    const claims = {
+      ...extra,
+      sub: String(flags.sub),
+      role: flags.role || extra.role || 'authenticated',
+      iss: issuer,
+      aud: flags.audience || issuer,
+      iat: now,
+      exp: flags.exp ? Number(flags.exp) : now + parseDuration(flags['valid-for'] || '1h'),
+    };
+    const token = signJwt(jwk, claims);
+    output(ctx, { token, kid: jwk.kid, claims }, d => process.stdout.write(`${d.token}\n`));
+  },
+};
+
+const hex = n => crypto.randomBytes(n).toString('hex');
+
+const keys = {
+  summary: 'Generate a fresh set of secrets for a local stack (use -o env)',
+  usage: 'motherbase gen keys [-o env]',
+  async run(ctx) {
+    const data = {
+      JWT_SECRET: hex(32),
+      CONFIG_ENCRYPTION_KEY: crypto.randomBytes(32).toString('base64'),
+      PLATFORM_SERVICE_TOKEN: hex(32),
+      EDGE_RUNTIME_TOKEN: hex(32),
+      POSTGRES_PASSWORD: hex(16),
+      S3_ACCESS_KEY_ID: hex(8),
+      S3_SECRET_ACCESS_KEY: hex(20),
+    };
+    output(ctx, data, (d, ui) => ui.keyValue(d));
+  },
+};
+
+module.exports = { signingKey, bearerJwt, keys, generateSigningKey, signJwt, parseDuration };

package/src/commands/snippets.js

@@ -0,0 +1,44 @@
+'use strict';
+
+const api = require('../api');
+const { output, requireArg } = require('./_util');
+
+// SQL Editor snippets, kept by the project (see the Studio's SQL Editor). Like
+// `supabase snippets`: list what you can see, download one as plain SQL.
+const subcommands = {
+  list: {
+    summary: 'List SQL snippets (yours and the ones shared with the project)',
+    usage: 'motherbase snippets list',
+    async run(ctx) {
+      const data = await api.adminRequest(ctx, 'GET', '/content', { query: { type: 'sql' } });
+      const items = (data && data.items) || [];
+      output(ctx, data, (_d, ui) =>
+        ui.table(items.map(item => ({ ...item, visibility: item.visibility === 'project' ? 'shared' : 'private' })), [
+          { key: 'id', label: 'ID' },
+          { key: 'name', label: 'NAME' },
+          { key: 'visibility', label: 'VISIBILITY' },
+          { key: 'ownerId', label: 'OWNER' },
+          { key: 'updatedAt', label: 'UPDATED' },
+        ]),
+      );
+    },
+  },
+  download: {
+    summary: 'Print a snippet as plain SQL (redirect it to a file to save it)',
+    usage: 'motherbase snippets download <id>',
+    async run(ctx, args) {
+      const id = requireArg(args[0], 'id');
+      const data = await api.adminRequest(ctx, 'GET', `/content/${encodeURIComponent(id)}`);
+      const item = data && data.item;
+      // Structured output keeps the whole record; the default is the bare SQL,
+      // with no decoration, so `> query.sql` writes a runnable file.
+      output(ctx, item, () => process.stdout.write(`${item.content.sql}\n`));
+    },
+  },
+};
+
+module.exports = {
+  summary: 'SQL Editor snippets',
+  usage: 'motherbase snippets <list|download> ...',
+  subcommands,
+};