@openbkn/bkn-sdk 0.1.1-alpha.2 → 0.1.1-alpha.4

package/dist/cli.js

@@ -6,6 +6,7 @@ import {
   HttpError,
   InputError,
   activePlatform,
+  attachNoAuth,
   attachToken,
   createClient,
   credentialDeviceLogin,
@@ -14,6 +15,7 @@ import {
   deletePlatform,
   deviceLogin,
   exportCreds,
+  fetchAuthStatus,
   formatError,
   getUserSafe,
   listPlatforms,
@@ -33,7 +35,7 @@ import {
   use,
   whoami,
   writePlatformConfig
-} from "./chunk-5MOIXIMJ.js";
+} from "./chunk-APJNRHLS.js";
 
 // src/cli.ts
 import { Command as Command16 } from "commander";
@@ -41,7 +43,7 @@ import { Command as Command16 } from "commander";
 // package.json
 var package_default = {
   name: "@openbkn/bkn-sdk",
-  version: "0.1.1-alpha.2",
+  version: "0.1.1-alpha.4",
   description: "Unified TypeScript SDK + CLI for the BKN (Business Knowledge Network) platform.",
   type: "module",
   license: "Apache-2.0",
@@ -81,6 +83,7 @@ var package_default = {
   },
   dependencies: {
     "@clack/prompts": "^0.9.1",
+    "@openbkn/bkn-sdk": "^0.1.1-alpha.3",
     chalk: "^5.4.1",
     commander: "^13.1.0",
     "csv-parse": "^6.2.1",
@@ -400,13 +403,16 @@ function registerAuthLeaves(cmd) {
     "device-login wait before timing out",
     (v) => Number.parseInt(v, 10),
     120
-  ).option("--no-browser", "(legacy) print the URL instead of opening a browser").option("--product <name>", "(legacy) ISF OAuth product query").option("--signin-public-key-file <path>", "(legacy) RSA public key for ISF /oauth2/signin").action(async (url, opts, cmd2) => {
+  ).option("--no-browser", "(legacy) print the URL instead of opening a browser").option("--product <name>", "(legacy) ISF OAuth product query").option("--signin-public-key-file <path>", "(legacy) RSA public key for ISF /oauth2/signin").option("--no-auth", "register the platform with no authentication (no bkn-safe)").action(async (url, opts, cmd2) => {
     const g = cmd2.optsWithGlobals();
     if (g.insecure) process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0";
     const out = outputOptions(cmd2);
     const report = (r) => {
       if (out.json || out.compact) {
         printJson({ loggedIn: true, ...r }, out);
+      } else if (r.noAuth) {
+        process.stdout.write(`Registered ${r.baseUrl ?? url} (no authentication)
+`);
       } else {
         process.stdout.write(`Logged in to ${r.baseUrl ?? url} as ${r.username ?? r.userId}
 `);
@@ -417,36 +423,58 @@ function registerAuthLeaves(cmd) {
       report(attachToken(url, token, { insecure: g.insecure }));
       return;
     }
+    if (opts.auth === false) {
+      report(attachNoAuth(url, { insecure: g.insecure }));
+      return;
+    }
+    const authStatus = await fetchAuthStatus(url);
+    if (authStatus && !authStatus.enabled) {
+      process.stderr.write(
+        `Platform auth is disabled (stack: ${authStatus.stack ?? "none"}) \u2014 registering without auth.
+`
+      );
+      report(attachNoAuth(url, { insecure: g.insecure }));
+      return;
+    }
     let tokens;
     let account;
-    if (opts.username || opts.password) {
-      const username = opts.username ?? await promptLine("Username: ");
-      account = username;
-      const password = opts.password ?? await promptLine("Password: ", true);
-      tokens = await credentialDeviceLogin(url, username, password, {
-        clientId: opts.clientId,
-        audience: opts.audience,
-        timeoutMs: opts.timeout * 1e3
-      });
-    } else {
-      const openInBrowser = !opts.device && opts.browser !== false;
-      tokens = await deviceLogin(url, {
-        clientId: opts.clientId,
-        audience: opts.audience,
-        timeoutMs: opts.timeout * 1e3,
-        onPrompt: ({ userCode, verificationUri, verificationUriComplete }) => {
-          const target = verificationUriComplete ?? verificationUri;
-          process.stderr.write(
-            `
+    try {
+      if (opts.username || opts.password) {
+        const username = opts.username ?? await promptLine("Username: ");
+        account = username;
+        const password = opts.password ?? await promptLine("Password: ", true);
+        tokens = await credentialDeviceLogin(url, username, password, {
+          clientId: opts.clientId,
+          audience: opts.audience,
+          timeoutMs: opts.timeout * 1e3
+        });
+      } else {
+        const openInBrowser = !opts.device && opts.browser !== false;
+        tokens = await deviceLogin(url, {
+          clientId: opts.clientId,
+          audience: opts.audience,
+          timeoutMs: opts.timeout * 1e3,
+          onPrompt: ({ userCode, verificationUri, verificationUriComplete }) => {
+            const target = verificationUriComplete ?? verificationUri;
+            process.stderr.write(
+              `
 Open this URL to sign in and authorize:
   ${target}
 User code: ${userCode}
 `
-          );
-          if (openInBrowser) openBrowser(target);
-          process.stderr.write("Waiting for authorization\u2026\n");
-        }
-      });
+            );
+            if (openInBrowser) openBrowser(target);
+            process.stderr.write("Waiting for authorization\u2026\n");
+          }
+        });
+      }
+    } catch (e) {
+      if (e instanceof Error && /Device auth failed \(404\)/.test(e.message)) {
+        process.stderr.write("No auth endpoint found \u2014 registering platform without auth.\n");
+        report(attachNoAuth(url, { insecure: g.insecure }));
+        return;
+      }
+      throw e;
     }
     if (!account) {
       account = await resolveAccount(
@@ -548,6 +576,7 @@ function authCommand() {
 
 // src/commands/admin.ts
 var int = (v) => Number.parseInt(v, 10);
+var DEFAULT_RESET_PASSWORD = "openbkn";
 function adminCommand() {
   const admin = new Command2("admin").description(
     "Operator CLI (kweaver-admin): org, user, role, models, audit"
@@ -680,12 +709,21 @@ function adminCommand() {
   user.command("delete <id>").description("Delete a user").action(async (id, _opts, cmd) => {
     printJson(await clientFrom(cmd).admin.userDelete(id), outputOptions(cmd));
   });
-  user.command("reset-password [id]").description("Reset a user's password (RSA-encrypted in transit)").option("--id <userId>", "explicit user UUID (alt to the positional id)").option("--user <account>", "resolve the user by account / login name").option("--password <s>", "the new password").option("--new-password <s>", "the new password (alias of --password)").option("--prompt-password", "prompt for the new password interactively").option("-y, --yes", "skip confirmation").action(async (id, opts, cmd) => {
+  user.command("reset-password [id]").description("Reset a user's password (defaults to the platform initial password)").option("--id <userId>", "explicit user UUID (alt to the positional id)").option("--user <account>", "resolve the user by account / login name").option("--password <s>", "the new password (default: platform initial 'openbkn')").option("--new-password <s>", "the new password (alias of --password)").option("-y, --yes", "skip confirmation").action(async (id, opts, cmd) => {
     const userId = id ?? opts.id ?? opts.user;
-    const pwd = opts.password ?? opts.newPassword;
     if (!userId) throw new Error("Provide a user id (positional or --id).");
-    if (!pwd) throw new Error("Provide --password / --new-password.");
-    printJson(await clientFrom(cmd).admin.userResetPassword(userId, pwd), outputOptions(cmd));
+    const pwd = opts.password ?? opts.newPassword ?? DEFAULT_RESET_PASSWORD;
+    const r = await clientFrom(cmd).admin.userResetPassword(userId, pwd);
+    const out = outputOptions(cmd);
+    if (out.json || out.compact) printJson(r, out);
+    else if (opts.password || opts.newPassword)
+      process.stdout.write(`Password reset for ${userId}.
+`);
+    else
+      process.stdout.write(
+        `Password reset for ${userId} to the initial password '${DEFAULT_RESET_PASSWORD}' (must change on next login).
+`
+      );
   });
   const role = admin.command("role").description("Role management");
   role.command("list").description("List roles").option("--keyword <s>", "filter by keyword").option("--limit <n>", "page size", int, 100).option("--offset <n>", "page offset", int, 0).option("--source <s>", "role source filter (business | user)").action(async (opts, cmd) => {