@rockcarver/frodo-lib 1.0.0 → 2.0.0-2

package/cjs/ops/AdminOps.js

@@ -6,6 +6,7 @@ Object.defineProperty(exports, "__esModule", {
 exports.addAutoIdStaticUserMapping = addAutoIdStaticUserMapping;
 exports.createLongLivedToken = createLongLivedToken;
 exports.createOAuth2ClientWithAdminPrivileges = createOAuth2ClientWithAdminPrivileges;
+exports.default = void 0;
 exports.grantOAuth2ClientAdminPrivileges = grantOAuth2ClientAdminPrivileges;
 exports.hideGenericExtensionAttributes = hideGenericExtensionAttributes;
 exports.listNonOAuth2AdminStaticUserMappings = listNonOAuth2AdminStaticUserMappings;
@@ -30,6 +31,239 @@ var _url = require("url");
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
 function asyncGeneratorStep(gen, resolve, reject, _next, _throw, key, arg) { try { var info = gen[key](arg); var value = info.value; } catch (error) { reject(error); return; } if (info.done) { resolve(value); } else { Promise.resolve(value).then(_next, _throw); } }
 function _asyncToGenerator(fn) { return function () { var self = this, args = arguments; return new Promise(function (resolve, reject) { var gen = fn.apply(self, args); function _next(value) { asyncGeneratorStep(gen, resolve, reject, _next, _throw, "next", value); } function _throw(err) { asyncGeneratorStep(gen, resolve, reject, _next, _throw, "throw", err); } _next(undefined); }); }; }
+class AdminOps {
+  constructor(state) {
+    this.state = state;
+  }
+
+  /*
+   * List all oauth2 clients, which have a corresponding staticUserMapping
+   * in the IDM authentication.json:
+    {
+      "_id": "authentication",
+      "rsFilter": {
+        ...
+        "staticUserMapping": [
+          {
+            "subject": "someOauth2ClientID",
+            "localUser": "internal/user/openidm-admin",
+            "userRoles": "authzRoles/*",
+            "roles": [
+              "internal/role/openidm-authorized",
+              "internal/role/openidm-admin"
+            ]
+          },
+          {
+            "subject": "RCSClient",
+            "localUser": "internal/user/idm-provisioning"
+          }
+        ]
+      }
+    }
+   */
+  listOAuth2CustomClients() {
+    var _this = this;
+    return _asyncToGenerator(function* () {
+      return listOAuth2CustomClients({
+        state: _this.state
+      });
+    })();
+  }
+
+  /*
+   * List all oauth2 clients, which have the fr:idm:* scope and a 
+   * corresponding staticUserMapping in the IDM authentication.json
+   * and are assigned admin privileges:
+    {
+      "_id": "authentication",
+      "rsFilter": {
+        ...
+        "staticUserMapping": [
+          {
+            "subject": "someOauth2ClientID",
+            "localUser": "internal/user/openidm-admin",
+            "userRoles": "authzRoles/*",
+            "roles": [
+              "internal/role/openidm-authorized",
+              "internal/role/openidm-admin"
+            ]
+          }
+        ]
+      }
+    }
+   */
+  listOAuth2AdminClients() {
+    var _this2 = this;
+    return _asyncToGenerator(function* () {
+      return listOAuth2AdminClients({
+        state: _this2.state
+      });
+    })();
+  }
+
+  /*
+   * List all static user mappings that are not oauth2 clients in authentication.json
+   * and are assigned admin privileges:
+    {
+      "_id": "authentication",
+      "rsFilter": {
+        ...
+          "staticUserMapping": [
+              {
+                  "subject": "amadmin",
+                  "localUser": "internal/user/openidm-admin",
+                  "userRoles": "authzRoles/*",
+                  "roles": [
+                      "internal/role/openidm-authorized",
+                      "internal/role/openidm-admin"
+                  ]
+              },
+              {
+                  "subject": "idm-provisioning",
+                  "localUser": "internal/user/idm-provisioning",
+                  "roles": [
+                      "internal/role/platform-provisioning"
+                  ]
+              },
+              {
+                  "subject": "RCSClient",
+                  "localUser": "internal/user/idm-provisioning"
+              },
+              {
+                  "subject": "autoid-resource-server",
+                  "localUser": "internal/user/idm-provisioning",
+                  "roles": [
+                      "internal/role/platform-provisioning",
+                      "internal/role/openidm-authorized",
+                      "internal/role/openidm-admin"
+                  ]
+              }
+          ]
+      }
+    }
+   */
+  listNonOAuth2AdminStaticUserMappings(showProtected) {
+    var _this3 = this;
+    return _asyncToGenerator(function* () {
+      return listNonOAuth2AdminStaticUserMappings({
+        showProtected,
+        state: _this3.state
+      });
+    })();
+  }
+
+  /*
+   * Add AutoId static user mapping to authentication.json to enable dashboards and other AutoId-based functionality.
+    {
+      "_id": "authentication",
+      "rsFilter": {
+        ...
+          "staticUserMapping": [
+              ...
+              {
+                  "subject": "autoid-resource-server",
+                  "localUser": "internal/user/idm-provisioning",
+                  "roles": [
+                      "internal/role/platform-provisioning",
+                      "internal/role/openidm-authorized",
+                      "internal/role/openidm-admin"
+                  ]
+              }
+          ]
+      }
+    }
+   */
+  addAutoIdStaticUserMapping() {
+    var _this4 = this;
+    return _asyncToGenerator(function* () {
+      return addAutoIdStaticUserMapping({
+        state: _this4.state
+      });
+    })();
+  }
+  grantOAuth2ClientAdminPrivileges(clientId) {
+    var _this5 = this;
+    return _asyncToGenerator(function* () {
+      return grantOAuth2ClientAdminPrivileges({
+        clientId,
+        state: _this5.state
+      });
+    })();
+  }
+  revokeOAuth2ClientAdminPrivileges(clientId) {
+    var _this6 = this;
+    return _asyncToGenerator(function* () {
+      return revokeOAuth2ClientAdminPrivileges({
+        clientId,
+        state: _this6.state
+      });
+    })();
+  }
+  createOAuth2ClientWithAdminPrivileges(clientId, clientSecret) {
+    var _this7 = this;
+    return _asyncToGenerator(function* () {
+      return createOAuth2ClientWithAdminPrivileges({
+        clientId,
+        clientSecret,
+        state: _this7.state
+      });
+    })();
+  }
+  createLongLivedToken(clientId, clientSecret, scope, secret, lifetime) {
+    var _this8 = this;
+    return _asyncToGenerator(function* () {
+      return createLongLivedToken({
+        clientId,
+        clientSecret,
+        scope,
+        secret,
+        lifetime,
+        state: _this8.state
+      });
+    })();
+  }
+  removeStaticUserMapping(subject) {
+    var _this9 = this;
+    return _asyncToGenerator(function* () {
+      return removeStaticUserMapping({
+        subject,
+        state: _this9.state
+      });
+    })();
+  }
+  hideGenericExtensionAttributes(includeCustomized, dryRun) {
+    var _this10 = this;
+    return _asyncToGenerator(function* () {
+      return hideGenericExtensionAttributes({
+        includeCustomized,
+        dryRun,
+        state: _this10.state
+      });
+    })();
+  }
+  showGenericExtensionAttributes(includeCustomized, dryRun) {
+    var _this11 = this;
+    return _asyncToGenerator(function* () {
+      return showGenericExtensionAttributes({
+        includeCustomized,
+        dryRun,
+        state: _this11.state
+      });
+    })();
+  }
+  repairOrgModel(excludeCustomized, extendPermissions, dryRun) {
+    var _this12 = this;
+    return _asyncToGenerator(function* () {
+      return repairOrgModel({
+        excludeCustomized,
+        extendPermissions,
+        dryRun,
+        state: _this12.state
+      });
+    })();
+  }
+}
+exports.default = AdminOps;
 var _dirname = _path.default.dirname((0, _url.fileURLToPath)(require('url').pathToFileURL(__filename).toString()));
 var OAUTH2_CLIENT = JSON.parse(_fs.default.readFileSync(_path.default.resolve(_dirname, './templates/OAuth2ClientTemplate.json'), 'utf8'));
 var GENERIC_EXTENSION_ATTRIBUTES = JSON.parse(_fs.default.readFileSync(_path.default.resolve(_dirname, './templates/cloud/GenericExtensionAttributesTemplate.json'), 'utf8'));
@@ -68,7 +302,7 @@ var autoIdRoles = ['internal/role/platform-provisioning', 'internal/role/openidm
     }
   }
  */
-function listOAuth2CustomClients() {
+function listOAuth2CustomClients(_x) {
   return _listOAuth2CustomClients.apply(this, arguments);
 }
 /*
@@ -94,17 +328,25 @@ function listOAuth2CustomClients() {
   }
  */
 function _listOAuth2CustomClients() {
-  _listOAuth2CustomClients = _asyncToGenerator(function* () {
-    var clients = yield (0, _OAuth2ClientOps.getOAuth2Clients)();
+  _listOAuth2CustomClients = _asyncToGenerator(function* (_ref) {
+    var {
+      state
+    } = _ref;
+    var clients = yield (0, _OAuth2ClientOps.getOAuth2Clients)({
+      state
+    });
     clients = clients.map(client => client._id).filter(client => !protectedClients.includes(client));
-    var authentication = yield (0, _IdmConfigApi.getConfigEntity)('authentication');
+    var authentication = yield (0, _IdmConfigApi.getConfigEntity)({
+      entityId: 'authentication',
+      state
+    });
     var subjects = authentication.rsFilter.staticUserMapping.map(mapping => mapping.subject).filter(subject => !protectedSubjects.includes(subject));
     var adminClients = subjects.filter(subject => clients.includes(subject));
     return adminClients;
   });
   return _listOAuth2CustomClients.apply(this, arguments);
 }
-function listOAuth2AdminClients() {
+function listOAuth2AdminClients(_x2) {
   return _listOAuth2AdminClients.apply(this, arguments);
 }
 /*
@@ -149,8 +391,13 @@ function listOAuth2AdminClients() {
   }
  */
 function _listOAuth2AdminClients() {
-  _listOAuth2AdminClients = _asyncToGenerator(function* () {
-    var clients = yield (0, _OAuth2ClientOps.getOAuth2Clients)();
+  _listOAuth2AdminClients = _asyncToGenerator(function* (_ref2) {
+    var {
+      state
+    } = _ref2;
+    var clients = yield (0, _OAuth2ClientOps.getOAuth2Clients)({
+      state
+    });
     clients = clients.filter(client => {
       var isPrivileged = false;
       if (client.coreOAuth2ClientConfig.scopes) {
@@ -162,7 +409,10 @@ function _listOAuth2AdminClients() {
       }
       return isPrivileged;
     }).map(client => client._id).filter(client => !protectedClients.includes(client));
-    var authentication = yield (0, _IdmConfigApi.getConfigEntity)('authentication');
+    var authentication = yield (0, _IdmConfigApi.getConfigEntity)({
+      entityId: 'authentication',
+      state
+    });
     var subjects = authentication.rsFilter.staticUserMapping.filter(mapping => {
       var isPrivileged = false;
       if (mapping.roles) {
@@ -179,14 +429,23 @@ function _listOAuth2AdminClients() {
   });
   return _listOAuth2AdminClients.apply(this, arguments);
 }
-function listNonOAuth2AdminStaticUserMappings(_x) {
+function listNonOAuth2AdminStaticUserMappings(_x3) {
   return _listNonOAuth2AdminStaticUserMappings.apply(this, arguments);
 }
 function _listNonOAuth2AdminStaticUserMappings() {
-  _listNonOAuth2AdminStaticUserMappings = _asyncToGenerator(function* (showProtected) {
-    var clients = yield (0, _OAuth2ClientOps.getOAuth2Clients)();
+  _listNonOAuth2AdminStaticUserMappings = _asyncToGenerator(function* (_ref3) {
+    var {
+      showProtected,
+      state
+    } = _ref3;
+    var clients = yield (0, _OAuth2ClientOps.getOAuth2Clients)({
+      state
+    });
     clients = clients.map(client => client._id).filter(client => !protectedClients.includes(client));
-    var authentication = yield (0, _IdmConfigApi.getConfigEntity)('authentication');
+    var authentication = yield (0, _IdmConfigApi.getConfigEntity)({
+      entityId: 'authentication',
+      state
+    });
     var subjects = authentication.rsFilter.staticUserMapping.filter(mapping => {
       var isPrivileged = false;
       if (mapping.roles) {
@@ -206,23 +465,35 @@ function _listNonOAuth2AdminStaticUserMappings() {
   });
   return _listNonOAuth2AdminStaticUserMappings.apply(this, arguments);
 }
-function getDynamicClientRegistrationScope() {
+function getDynamicClientRegistrationScope(_x4) {
   return _getDynamicClientRegistrationScope.apply(this, arguments);
 }
 function _getDynamicClientRegistrationScope() {
-  _getDynamicClientRegistrationScope = _asyncToGenerator(function* () {
-    var provider = yield (0, _OAuth2ProviderOps.getOAuth2Provider)();
+  _getDynamicClientRegistrationScope = _asyncToGenerator(function* (_ref4) {
+    var {
+      state
+    } = _ref4;
+    var provider = yield (0, _OAuth2ProviderOps.getOAuth2Provider)({
+      state
+    });
     return provider.clientDynamicRegistrationConfig.dynamicClientRegistrationScope;
   });
   return _getDynamicClientRegistrationScope.apply(this, arguments);
 }
-function addAdminScopes(_x2, _x3) {
+function addAdminScopes(_x5) {
   return _addAdminScopes.apply(this, arguments);
 }
 function _addAdminScopes() {
-  _addAdminScopes = _asyncToGenerator(function* (clientId, client) {
+  _addAdminScopes = _asyncToGenerator(function* (_ref5) {
+    var {
+      clientId,
+      client,
+      state
+    } = _ref5;
     var modClient = client;
-    var allAdminScopes = adminScopes.concat([yield getDynamicClientRegistrationScope()]);
+    var allAdminScopes = adminScopes.concat([yield getDynamicClientRegistrationScope({
+      state
+    })]);
     var addScopes = [];
     if (modClient.coreOAuth2ClientConfig.scopes && modClient.coreOAuth2ClientConfig.scopes.value) {
       addScopes = allAdminScopes.filter(scope => {
@@ -254,7 +525,11 @@ function _addAdminScopes() {
   });
   return _addAdminScopes.apply(this, arguments);
 }
-function addClientCredentialsGrantType(clientId, client) {
+function addClientCredentialsGrantType(_ref6) {
+  var {
+    clientId,
+    client
+  } = _ref6;
   var modClient = client;
   var modified = false;
   if (modClient.advancedOAuth2ClientConfig.grantTypes && modClient.advancedOAuth2ClientConfig.grantTypes.value) {
@@ -273,7 +548,7 @@ function addClientCredentialsGrantType(clientId, client) {
   }
   return modClient;
 }
-function addAdminStaticUserMapping(_x4) {
+function addAdminStaticUserMapping(_x6) {
   return _addAdminStaticUserMapping.apply(this, arguments);
 }
 /*
@@ -298,10 +573,17 @@ function addAdminStaticUserMapping(_x4) {
   }
  */
 function _addAdminStaticUserMapping() {
-  _addAdminStaticUserMapping = _asyncToGenerator(function* (name) {
+  _addAdminStaticUserMapping = _asyncToGenerator(function* (_ref7) {
+    var {
+      name,
+      state
+    } = _ref7;
     var authentication = {};
     try {
-      authentication = yield (0, _IdmConfigApi.getConfigEntity)('authentication');
+      authentication = yield (0, _IdmConfigApi.getConfigEntity)({
+        entityId: 'authentication',
+        state
+      });
     } catch (error) {
       (0, _Console.printMessage)("Error reading IDM authentication configuration: ".concat(error.message), 'error');
     }
@@ -337,7 +619,11 @@ function _addAdminStaticUserMapping() {
     if (addRoles.length > 0 || needsAdminMapping) {
       (0, _Console.printMessage)("Adding admin roles to static user mapping for client \"".concat(name, "\"..."));
       try {
-        yield (0, _IdmConfigApi.putConfigEntity)('authentication', authentication);
+        yield (0, _IdmConfigApi.putConfigEntity)({
+          entityId: 'authentication',
+          entityData: authentication,
+          state
+        });
       } catch (putConfigEntityError) {
         (0, _Console.printMessage)(putConfigEntityError, 'error');
         (0, _Console.printMessage)("Error: ".concat(putConfigEntityError), 'error');
@@ -348,13 +634,19 @@ function _addAdminStaticUserMapping() {
   });
   return _addAdminStaticUserMapping.apply(this, arguments);
 }
-function addAutoIdStaticUserMapping() {
+function addAutoIdStaticUserMapping(_x7) {
   return _addAutoIdStaticUserMapping.apply(this, arguments);
 }
 function _addAutoIdStaticUserMapping() {
-  _addAutoIdStaticUserMapping = _asyncToGenerator(function* () {
+  _addAutoIdStaticUserMapping = _asyncToGenerator(function* (_ref8) {
+    var {
+      state
+    } = _ref8;
     var name = 'autoid-resource-server';
-    var authentication = yield (0, _IdmConfigApi.getConfigEntity)('authentication');
+    var authentication = yield (0, _IdmConfigApi.getConfigEntity)({
+      entityId: 'authentication',
+      state
+    });
     var needsAdminMapping = true;
     var addRoles = [];
     var mappings = authentication.rsFilter.staticUserMapping.map(mapping => {
@@ -387,7 +679,11 @@ function _addAutoIdStaticUserMapping() {
     if (addRoles.length > 0 || needsAdminMapping) {
       (0, _Console.printMessage)("Adding required roles to static user mapping for AutoId client \"".concat(name, "\"..."));
       try {
-        yield (0, _IdmConfigApi.putConfigEntity)('authentication', authentication);
+        yield (0, _IdmConfigApi.putConfigEntity)({
+          entityId: 'authentication',
+          entityData: authentication,
+          state
+        });
       } catch (putConfigEntityError) {
         (0, _Console.printMessage)(putConfigEntityError, 'error');
         (0, _Console.printMessage)("Error: ".concat(putConfigEntityError), 'error');
@@ -398,32 +694,60 @@ function _addAutoIdStaticUserMapping() {
   });
   return _addAutoIdStaticUserMapping.apply(this, arguments);
 }
-function grantOAuth2ClientAdminPrivileges(_x5) {
+function grantOAuth2ClientAdminPrivileges(_x8) {
   return _grantOAuth2ClientAdminPrivileges.apply(this, arguments);
 }
 function _grantOAuth2ClientAdminPrivileges() {
-  _grantOAuth2ClientAdminPrivileges = _asyncToGenerator(function* (clientId) {
-    var client = yield (0, _OAuth2ClientOps.getOAuth2Client)(clientId);
+  _grantOAuth2ClientAdminPrivileges = _asyncToGenerator(function* (_ref9) {
+    var {
+      clientId,
+      state
+    } = _ref9;
+    var client = yield (0, _OAuth2ClientOps.getOAuth2Client)({
+      clientId,
+      state
+    });
     if (client.coreOAuth2ClientConfig.clientName.value.length === 0) {
       client.coreOAuth2ClientConfig.clientName.value = [clientId];
     }
     if (client.advancedOAuth2ClientConfig.descriptions.value.length === 0 || client.advancedOAuth2ClientConfig.descriptions.value[0].startsWith('Modified by Frodo') || client.advancedOAuth2ClientConfig.descriptions.value[0].startsWith('Created by Frodo')) {
       client.advancedOAuth2ClientConfig.descriptions.value = ["Modified by Frodo on ".concat(new Date().toLocaleString())];
     }
-    client = yield addAdminScopes(clientId, client);
-    client = addClientCredentialsGrantType(clientId, client);
-    yield (0, _OAuth2ClientOps.putOAuth2Client)(clientId, client);
-    yield addAdminStaticUserMapping(clientId);
+    client = yield addAdminScopes({
+      clientId,
+      client,
+      state
+    });
+    client = addClientCredentialsGrantType({
+      clientId,
+      client
+    });
+    yield (0, _OAuth2ClientOps.putOAuth2Client)({
+      clientId,
+      clientData: client,
+      state
+    });
+    yield addAdminStaticUserMapping({
+      name: clientId,
+      state
+    });
   });
   return _grantOAuth2ClientAdminPrivileges.apply(this, arguments);
 }
-function removeAdminScopes(_x6, _x7) {
+function removeAdminScopes(_x9) {
   return _removeAdminScopes.apply(this, arguments);
 }
 function _removeAdminScopes() {
-  _removeAdminScopes = _asyncToGenerator(function* (name, client) {
+  _removeAdminScopes = _asyncToGenerator(function* (_ref10) {
+    var {
+      name,
+      client,
+      state
+    } = _ref10;
     var modClient = client;
-    var allAdminScopes = adminScopes.concat([yield getDynamicClientRegistrationScope()]);
+    var allAdminScopes = adminScopes.concat([yield getDynamicClientRegistrationScope({
+      state
+    })]);
     var finalScopes = [];
     if (modClient.coreOAuth2ClientConfig.scopes && modClient.coreOAuth2ClientConfig.scopes.value) {
       finalScopes = modClient.coreOAuth2ClientConfig.scopes.value.filter(scope => !allAdminScopes.includes(scope));
@@ -448,7 +772,11 @@ function _removeAdminScopes() {
   });
   return _removeAdminScopes.apply(this, arguments);
 }
-function removeClientCredentialsGrantType(clientId, client) {
+function removeClientCredentialsGrantType(_ref11) {
+  var {
+    clientId,
+    client
+  } = _ref11;
   var modClient = client;
   var modified = false;
   var finalGrantTypes = [];
@@ -464,12 +792,19 @@ function removeClientCredentialsGrantType(clientId, client) {
   }
   return modClient;
 }
-function removeAdminStaticUserMapping(_x8) {
+function removeAdminStaticUserMapping(_x10) {
   return _removeAdminStaticUserMapping.apply(this, arguments);
 }
 function _removeAdminStaticUserMapping() {
-  _removeAdminStaticUserMapping = _asyncToGenerator(function* (name) {
-    var authentication = yield (0, _IdmConfigApi.getConfigEntity)('authentication');
+  _removeAdminStaticUserMapping = _asyncToGenerator(function* (_ref12) {
+    var {
+      name,
+      state
+    } = _ref12;
+    var authentication = yield (0, _IdmConfigApi.getConfigEntity)({
+      entityId: 'authentication',
+      state
+    });
     var finalRoles = [];
     var removeMapping = false;
     var modified = false;
@@ -493,7 +828,11 @@ function _removeAdminStaticUserMapping() {
         (0, _Console.printMessage)("Removing admin roles from static user mapping for client \"".concat(name, "\"..."));
       }
       try {
-        yield (0, _IdmConfigApi.putConfigEntity)('authentication', authentication);
+        yield (0, _IdmConfigApi.putConfigEntity)({
+          entityId: 'authentication',
+          entityData: authentication,
+          state
+        });
       } catch (putConfigEntityError) {
         (0, _Console.printMessage)(putConfigEntityError, 'error');
         (0, _Console.printMessage)("Error: ".concat(putConfigEntityError), 'error');
@@ -504,74 +843,146 @@ function _removeAdminStaticUserMapping() {
   });
   return _removeAdminStaticUserMapping.apply(this, arguments);
 }
-function revokeOAuth2ClientAdminPrivileges(_x9) {
+function revokeOAuth2ClientAdminPrivileges(_x11) {
   return _revokeOAuth2ClientAdminPrivileges.apply(this, arguments);
 }
 function _revokeOAuth2ClientAdminPrivileges() {
-  _revokeOAuth2ClientAdminPrivileges = _asyncToGenerator(function* (clientId) {
-    var client = yield (0, _OAuth2ClientOps.getOAuth2Client)(clientId);
+  _revokeOAuth2ClientAdminPrivileges = _asyncToGenerator(function* (_ref13) {
+    var {
+      clientId,
+      state
+    } = _ref13;
+    var client = yield (0, _OAuth2ClientOps.getOAuth2Client)({
+      clientId,
+      state
+    });
     if (client.coreOAuth2ClientConfig.clientName.value.length === 0) {
       client.coreOAuth2ClientConfig.clientName.value = [clientId];
     }
     if (client.advancedOAuth2ClientConfig.descriptions.value.length === 0 || client.advancedOAuth2ClientConfig.descriptions.value[0].startsWith('Modified by Frodo') || client.advancedOAuth2ClientConfig.descriptions.value[0].startsWith('Created by Frodo')) {
       client.advancedOAuth2ClientConfig.descriptions.value = ["Modified by Frodo on ".concat(new Date().toLocaleString())];
     }
-    client = yield removeAdminScopes(clientId, client);
-    client = removeClientCredentialsGrantType(clientId, client);
-    yield (0, _OAuth2ClientOps.putOAuth2Client)(clientId, client);
-    yield removeAdminStaticUserMapping(clientId);
+    client = yield removeAdminScopes({
+      name: clientId,
+      client,
+      state
+    });
+    client = removeClientCredentialsGrantType({
+      clientId,
+      client
+    });
+    yield (0, _OAuth2ClientOps.putOAuth2Client)({
+      clientId,
+      clientData: client,
+      state
+    });
+    yield removeAdminStaticUserMapping({
+      name: clientId,
+      state
+    });
   });
   return _revokeOAuth2ClientAdminPrivileges.apply(this, arguments);
 }
-function createOAuth2ClientWithAdminPrivileges(_x10, _x11) {
+function createOAuth2ClientWithAdminPrivileges(_x12) {
   return _createOAuth2ClientWithAdminPrivileges.apply(this, arguments);
 }
 function _createOAuth2ClientWithAdminPrivileges() {
-  _createOAuth2ClientWithAdminPrivileges = _asyncToGenerator(function* (clientId, clientSecret) {
+  _createOAuth2ClientWithAdminPrivileges = _asyncToGenerator(function* (_ref14) {
+    var {
+      clientId,
+      clientSecret,
+      state
+    } = _ref14;
     var client = OAUTH2_CLIENT;
     client.coreOAuth2ClientConfig.userpassword = clientSecret;
     client.coreOAuth2ClientConfig.clientName.value = [clientId];
     client.advancedOAuth2ClientConfig.descriptions.value = ["Created by Frodo on ".concat(new Date().toLocaleString())];
     try {
-      client = yield addAdminScopes(clientId, client);
-      yield (0, _OAuth2ClientOps.putOAuth2Client)(clientId, client);
-      yield addAdminStaticUserMapping(clientId);
+      client = yield addAdminScopes({
+        clientId,
+        client,
+        state
+      });
+      yield (0, _OAuth2ClientOps.putOAuth2Client)({
+        clientId,
+        clientData: client,
+        state
+      });
+      yield addAdminStaticUserMapping({
+        name: clientId,
+        state
+      });
     } catch (error) {
       (0, _Console.printMessage)("Error creating oauth2 client: ".concat(error.message), 'error');
     }
   });
   return _createOAuth2ClientWithAdminPrivileges.apply(this, arguments);
 }
-function createLongLivedToken(_x12, _x13, _x14, _x15, _x16) {
+function createLongLivedToken(_x13) {
   return _createLongLivedToken.apply(this, arguments);
 }
 function _createLongLivedToken() {
-  _createLongLivedToken = _asyncToGenerator(function* (clientId, clientSecret, scope, secret, lifetime) {
+  _createLongLivedToken = _asyncToGenerator(function* (_ref15) {
+    var {
+      clientId,
+      clientSecret,
+      scope,
+      secret,
+      lifetime,
+      state
+    } = _ref15;
     // get oauth2 client
-    var client = yield (0, _OAuth2ClientOps.getOAuth2Client)(clientId);
+    var client = yield (0, _OAuth2ClientOps.getOAuth2Client)({
+      clientId,
+      state
+    });
     client.userpassword = clientSecret;
     // remember current lifetime
     var rememberedLifetime = client.coreOAuth2ClientConfig.accessTokenLifetime.value || 3600;
     // set long token lifetime
     client.coreOAuth2ClientConfig.accessTokenLifetime.value = lifetime;
-    yield (0, _OAuth2ClientOps.putOAuth2Client)(clientId, client);
-    var response = yield (0, _OAuth2OIDCApi.clientCredentialsGrant)(clientId, clientSecret, scope);
+    yield (0, _OAuth2ClientOps.putOAuth2Client)({
+      clientId,
+      clientData: client,
+      state
+    });
+    var response = yield (0, _OAuth2OIDCApi.clientCredentialsGrant)({
+      amBaseUrl: state.getHost(),
+      clientId,
+      clientSecret,
+      scope,
+      state
+    });
     var expires = new Date().getTime() + 1000 * response.expires_in;
     response.expires_on = new Date(expires).toLocaleString();
     // reset token lifetime
     client.coreOAuth2ClientConfig.accessTokenLifetime.value = rememberedLifetime;
-    yield (0, _OAuth2ClientOps.putOAuth2Client)(clientId, client);
+    yield (0, _OAuth2ClientOps.putOAuth2Client)({
+      clientId,
+      clientData: client,
+      state
+    });
     // create secret with token as value
     if (secret) {
       var description = 'Long-lived admin token';
       try {
-        yield (0, _SecretsApi.putSecret)(secret, response.access_token, description);
+        yield (0, _SecretsApi.putSecret)({
+          secretId: secret,
+          value: response.access_token,
+          description,
+          state
+        });
         response.secret = secret;
       } catch (error) {
         if (_lodash.default.get(error, 'response.data.code') === 400 && _lodash.default.get(error, 'response.data.message') === 'Failed to create secret, the secret already exists') {
           var newSecret = "".concat(secret, "-").concat(expires);
           (0, _Console.printMessage)("esv '".concat(secret, "' already exists, using ").concat(newSecret), 'warn');
-          yield (0, _SecretsApi.putSecret)(newSecret, response.access_token, description);
+          yield (0, _SecretsApi.putSecret)({
+            secretId: newSecret,
+            value: response.access_token,
+            description,
+            state
+          });
           response.secret = newSecret;
         }
       }
@@ -581,12 +992,19 @@ function _createLongLivedToken() {
   });
   return _createLongLivedToken.apply(this, arguments);
 }
-function removeStaticUserMapping(_x17) {
+function removeStaticUserMapping(_x14) {
   return _removeStaticUserMapping.apply(this, arguments);
 }
 function _removeStaticUserMapping() {
-  _removeStaticUserMapping = _asyncToGenerator(function* (subject) {
-    var authentication = yield (0, _IdmConfigApi.getConfigEntity)('authentication');
+  _removeStaticUserMapping = _asyncToGenerator(function* (_ref16) {
+    var {
+      subject,
+      state
+    } = _ref16;
+    var authentication = yield (0, _IdmConfigApi.getConfigEntity)({
+      entityId: 'authentication',
+      state
+    });
     var removeMapping = false;
     var mappings = authentication.rsFilter.staticUserMapping.filter(mapping => {
       // find the subject and flag it
@@ -600,7 +1018,11 @@ function _removeStaticUserMapping() {
     if (removeMapping) {
       (0, _Console.printMessage)("Removing static user mapping for subject \"".concat(subject, "\"..."));
       try {
-        yield (0, _IdmConfigApi.putConfigEntity)('authentication', authentication);
+        yield (0, _IdmConfigApi.putConfigEntity)({
+          entityId: 'authentication',
+          entityData: authentication,
+          state
+        });
       } catch (putConfigEntityError) {
         (0, _Console.printMessage)(putConfigEntityError, 'error');
         (0, _Console.printMessage)("Error: ".concat(putConfigEntityError), 'error');
@@ -611,16 +1033,26 @@ function _removeStaticUserMapping() {
   });
   return _removeStaticUserMapping.apply(this, arguments);
 }
-function hideGenericExtensionAttributes(_x18, _x19) {
+function hideGenericExtensionAttributes(_x15) {
   return _hideGenericExtensionAttributes.apply(this, arguments);
 }
 function _hideGenericExtensionAttributes() {
-  _hideGenericExtensionAttributes = _asyncToGenerator(function* (includeCustomized, dryRun) {
-    var managed = yield (0, _IdmConfigApi.getConfigEntity)('managed');
+  _hideGenericExtensionAttributes = _asyncToGenerator(function* (_ref17) {
+    var {
+      includeCustomized,
+      dryRun,
+      state
+    } = _ref17;
+    var managed = yield (0, _IdmConfigApi.getConfigEntity)({
+      entityId: 'managed',
+      state
+    });
     var propertyNames = Object.keys(GENERIC_EXTENSION_ATTRIBUTES);
     var updatedObjects = managed.objects.map(object => {
       // ignore all other objects
-      if (object.name !== (0, _OpsUtils.getRealmManagedUser)()) {
+      if (object.name !== (0, _OpsUtils.getRealmManagedUser)({
+        state
+      })) {
         return object;
       }
       propertyNames.forEach(name => {
@@ -643,7 +1075,11 @@ function _hideGenericExtensionAttributes() {
       (0, _Console.printMessage)('Dry-run only. Changes are not saved.');
     } else {
       try {
-        yield (0, _IdmConfigApi.putConfigEntity)('managed', managed);
+        yield (0, _IdmConfigApi.putConfigEntity)({
+          entityId: 'managed',
+          entityData: managed,
+          state
+        });
       } catch (putConfigEntityError) {
         (0, _Console.printMessage)(putConfigEntityError, 'error');
         (0, _Console.printMessage)("Error: ".concat(putConfigEntityError), 'error');
@@ -652,16 +1088,26 @@ function _hideGenericExtensionAttributes() {
   });
   return _hideGenericExtensionAttributes.apply(this, arguments);
 }
-function showGenericExtensionAttributes(_x20, _x21) {
+function showGenericExtensionAttributes(_x16) {
   return _showGenericExtensionAttributes.apply(this, arguments);
 }
 function _showGenericExtensionAttributes() {
-  _showGenericExtensionAttributes = _asyncToGenerator(function* (includeCustomized, dryRun) {
-    var managed = yield (0, _IdmConfigApi.getConfigEntity)('managed');
+  _showGenericExtensionAttributes = _asyncToGenerator(function* (_ref18) {
+    var {
+      includeCustomized,
+      dryRun,
+      state
+    } = _ref18;
+    var managed = yield (0, _IdmConfigApi.getConfigEntity)({
+      entityId: 'managed',
+      state
+    });
     var propertyNames = Object.keys(GENERIC_EXTENSION_ATTRIBUTES);
     var updatedObjects = managed.objects.map(object => {
       // ignore all other objects
-      if (object.name !== (0, _OpsUtils.getRealmManagedUser)()) {
+      if (object.name !== (0, _OpsUtils.getRealmManagedUser)({
+        state
+      })) {
         return object;
       }
       propertyNames.forEach(name => {
@@ -684,7 +1130,11 @@ function _showGenericExtensionAttributes() {
       (0, _Console.printMessage)('Dry-run only. Changes are not saved.');
     } else {
       try {
-        yield (0, _IdmConfigApi.putConfigEntity)('managed', managed);
+        yield (0, _IdmConfigApi.putConfigEntity)({
+          entityId: 'managed',
+          entityData: managed,
+          state
+        });
       } catch (putConfigEntityError) {
         (0, _Console.printMessage)(putConfigEntityError, 'error');
         (0, _Console.printMessage)("Error: ".concat(putConfigEntityError), 'error');
@@ -693,17 +1143,26 @@ function _showGenericExtensionAttributes() {
   });
   return _showGenericExtensionAttributes.apply(this, arguments);
 }
-function repairOrgModelUser(_x22) {
+function repairOrgModelUser(_x17) {
   return _repairOrgModelUser.apply(this, arguments);
 }
 function _repairOrgModelUser() {
-  _repairOrgModelUser = _asyncToGenerator(function* (dryRun) {
-    var managed = yield (0, _IdmConfigApi.getConfigEntity)('managed');
+  _repairOrgModelUser = _asyncToGenerator(function* (_ref19) {
+    var {
+      dryRun,
+      state
+    } = _ref19;
+    var managed = yield (0, _IdmConfigApi.getConfigEntity)({
+      entityId: 'managed',
+      state
+    });
     var RDVPs = ['memberOfOrgIDs'];
     var repairData = false;
     var updatedObjects = managed.objects.map(object => {
       // ignore all other objects
-      if (object.name !== (0, _OpsUtils.getRealmManagedUser)()) {
+      if (object.name !== (0, _OpsUtils.getRealmManagedUser)({
+        state
+      })) {
         return object;
       }
       (0, _Console.printMessage)("".concat(object.name, ": checking..."));
@@ -722,7 +1181,11 @@ function _repairOrgModelUser() {
     managed.objects = updatedObjects;
     if (!dryRun) {
       try {
-        yield (0, _IdmConfigApi.putConfigEntity)('managed', managed);
+        yield (0, _IdmConfigApi.putConfigEntity)({
+          entityId: 'managed',
+          entityData: managed,
+          state
+        });
       } catch (putConfigEntityError) {
         (0, _Console.printMessage)(putConfigEntityError, 'error');
         (0, _Console.printMessage)("Error: ".concat(putConfigEntityError), 'error');
@@ -732,17 +1195,26 @@ function _repairOrgModelUser() {
   });
   return _repairOrgModelUser.apply(this, arguments);
 }
-function repairOrgModelOrg(_x23) {
+function repairOrgModelOrg(_x18) {
   return _repairOrgModelOrg.apply(this, arguments);
 }
 function _repairOrgModelOrg() {
-  _repairOrgModelOrg = _asyncToGenerator(function* (dryRun) {
-    var managed = yield (0, _IdmConfigApi.getConfigEntity)('managed');
+  _repairOrgModelOrg = _asyncToGenerator(function* (_ref20) {
+    var {
+      dryRun,
+      state
+    } = _ref20;
+    var managed = yield (0, _IdmConfigApi.getConfigEntity)({
+      entityId: 'managed',
+      state
+    });
     var RDVPs = ['adminIDs', 'ownerIDs', 'parentAdminIDs', 'parentOwnerIDs', 'parentIDs'];
     var repairData = false;
     var updatedObjects = managed.objects.map(object => {
       // ignore all other objects
-      if (object.name !== (0, _OrganizationOps.getRealmManagedOrganization)()) {
+      if (object.name !== (0, _OrganizationOps.getRealmManagedOrganization)({
+        state
+      })) {
         return object;
       }
       (0, _Console.printMessage)("".concat(object.name, ": checking..."));
@@ -761,7 +1233,11 @@ function _repairOrgModelOrg() {
     managed.objects = updatedObjects;
     if (!dryRun) {
       try {
-        yield (0, _IdmConfigApi.putConfigEntity)('managed', managed);
+        yield (0, _IdmConfigApi.putConfigEntity)({
+          entityId: 'managed',
+          entityData: managed,
+          state
+        });
       } catch (putConfigEntityError) {
         (0, _Console.printMessage)(putConfigEntityError, 'error');
         (0, _Console.printMessage)("Error: ".concat(putConfigEntityError), 'error');
@@ -795,7 +1271,7 @@ function _extendOrgModelPermissins() {
   });
   return _extendOrgModelPermissins.apply(this, arguments);
 }
-function repairOrgModel(_x24, _x25, _x26) {
+function repairOrgModel(_x19) {
   return _repairOrgModel.apply(this, arguments);
 } // suggested by John K.
 // export async function removeRealmNameFromManagedObjectLabels() {}
@@ -803,10 +1279,22 @@ function repairOrgModel(_x24, _x25, _x26) {
 // export async function cleanUpPostmanArtifacts() {}
 // export async function createSampleThemes() {}
 function _repairOrgModel() {
-  _repairOrgModel = _asyncToGenerator(function* (excludeCustomized, extendPermissions, dryRun) {
+  _repairOrgModel = _asyncToGenerator(function* (_ref21) {
+    var {
+      excludeCustomized,
+      extendPermissions,
+      dryRun,
+      state
+    } = _ref21;
     var repairData = false;
-    repairData = repairData || (yield repairOrgModelUser(dryRun));
-    repairData = repairData || (yield repairOrgModelOrg(dryRun));
+    repairData = repairData || (yield repairOrgModelUser({
+      dryRun,
+      state
+    }));
+    repairData = repairData || (yield repairOrgModelOrg({
+      dryRun,
+      state
+    }));
     if (excludeCustomized) {
       //
     }