@seliseblocks/cli-os 0.1.5 → 0.2.0

package/README.md

@@ -10,7 +10,7 @@ CLI for SELISE Blocks Cloud.
 Install the npm package where you want to operate the CLI:
 
 ```bash
-npm install -g @seliseblocks/cli-os
+npm install -g @seliseblocks/cli-os@latest
 blocks --version
 ```
 

package/dist/commands/deselect.js

@@ -1,31 +1,21 @@
-import { normalizeAccountName, readConfig } from "../lib/config.js";
-import { readTokenStore, writeTokenStore } from "../lib/token-store.js";
-import { requestContext } from "../lib/request-context.js";
+import { stringFlag } from "../lib/args.js";
+import { stopProjectImpersonation } from "../lib/auth.js";
+import { readConfig } from "../lib/config.js";
 import { clearSelectedProject, parseCommand } from "../lib/workspace.js";
 export async function deselectProject(argv) {
     const { flags } = parseCommand(argv);
+    const accountName = stringFlag(flags, "account") || undefined;
     const config = await readConfig();
-    const { accountName } = requestContext(flags);
-    const account = normalizeAccountName(accountName ?? config.activeAccount);
-    const tenantId = await clearSelectedProject();
+    const tenantId = config.selectedProject?.tenantId;
     if (!tenantId) {
         console.log("No project is currently selected.");
         return;
     }
-    const store = await readTokenStore();
-    const projects = store.accounts[account]?.projects;
-    if (projects && tenantId in projects) {
-        const { [tenantId]: _removed, ...remainingProjects } = projects;
-        await writeTokenStore({
-            accounts: {
-                ...store.accounts,
-                [account]: {
-                    ...store.accounts[account],
-                    projects: remainingProjects
-                }
-            }
-        });
-    }
-    console.log(`Deselected project tenant ${tenantId}.`);
+    // Stop-impersonation restores a fresh account refresh token and drops the
+    // project's cached token from the store, so there's nothing left to clean
+    // up here beyond the selection itself.
+    await stopProjectImpersonation(accountName, tenantId);
+    await clearSelectedProject();
+    console.log(`Deselected project tenant ${tenantId}. Account session restored.`);
     console.log("Run 'blocks use <tenantId>' to select a project again.");
 }

package/dist/commands/iam/me.js

@@ -4,8 +4,11 @@ import { requestContext } from "../../lib/request-context.js";
 import { parseCommand } from "../../lib/workspace.js";
 export async function iamMe(argv = []) {
     const { flags } = parseCommand(argv);
+    // The server resets to the root tenant's identity for this endpoint
+    // regardless of which token calls it, so the impersonated project session
+    // works fine here too -- prefer it when a project is selected.
     const me = await blocksRequest("/iam/v4/iam/me", {
-        accountAuth: true,
+        preferImpersonatedProjectAuth: true,
         ...requestContext(flags)
     });
     writeOutput(me, { ...flags, json: true });

package/dist/commands/login.js

@@ -1,9 +1,11 @@
 import { parseFlags, stringFlag } from "../lib/args.js";
-import { pollDeviceToken, requestDeviceAuthorization } from "../lib/auth.js";
+import { getImpersonatedProjectSession, pollDeviceToken, requestDeviceAuthorization } from "../lib/auth.js";
 import { getAccountProfile, readConfig, writeConfig } from "../lib/config.js";
 import { openBrowser } from "../lib/open-browser.js";
+import { listProjectGroups } from "../lib/project-info.js";
 import { applyAccountToken } from "../lib/token.js";
 import { readTokenStore, writeTokenStore } from "../lib/token-store.js";
+import { readWorkspaceConfig } from "../lib/workspace.js";
 export async function login(argv) {
     const { flags } = parseFlags(argv);
     const accountOverride = stringFlag(flags, "account");
@@ -32,4 +34,33 @@ export async function login(argv) {
     await writeConfig(next.config);
     await writeTokenStore(next.store);
     console.log("Login done.");
+    const workspace = await readWorkspaceConfig();
+    const rememberedTenantId = workspace.project?.tenantId ?? next.config.selectedProject?.tenantId;
+    if (rememberedTenantId) {
+        try {
+            await getImpersonatedProjectSession(name, rememberedTenantId);
+            console.log(`Re-selected project tenant ${rememberedTenantId}.`);
+        }
+        catch (error) {
+            console.log(`Could not re-select project tenant ${rememberedTenantId}: ${error instanceof Error ? error.message : String(error)}`);
+            console.log("Run 'blocks use <tenantId>' to select a project.");
+        }
+        return;
+    }
+    try {
+        const groups = await listProjectGroups(flags);
+        const projects = groups.flatMap((group) => group.projects ?? []);
+        if (projects.length === 0) {
+            console.log("No projects found for this account.");
+            return;
+        }
+        console.log("Available projects:");
+        for (const project of projects) {
+            console.log(`  ${project.tenantId ?? "-"}  ${project.name ?? "-"}  ${project.environment ?? "-"}`);
+        }
+        console.log("Run 'blocks use <tenantId>' to select one.");
+    }
+    catch (error) {
+        console.log(`Could not list projects: ${error instanceof Error ? error.message : String(error)}`);
+    }
 }

package/dist/commands/secrets/save.js

@@ -45,7 +45,7 @@ function redactSecret(body) {
         return body;
     const redacted = {};
     for (const [key, value] of Object.entries(pairs)) {
-        redacted[key] = /secret|password|key$/i.test(key) ? "***" : value;
+        redacted[key] = /(secret|password|key$)/i.test(key) ? "***" : value;
     }
     return { ...body, keyValuePairs: redacted };
 }

package/dist/commands/use.js

@@ -1,9 +1,24 @@
-import { saveSelectedProject } from "../lib/workspace.js";
+import { stringFlag } from "../lib/args.js";
+import { getImpersonatedProjectSession, stopProjectImpersonation } from "../lib/auth.js";
+import { readConfig } from "../lib/config.js";
+import { parseCommand, saveSelectedProject } from "../lib/workspace.js";
 export async function useProject(argv) {
-    const tenantId = argv[0];
+    const { args, flags } = parseCommand(argv);
+    const tenantId = args[0];
     if (!tenantId)
         throw new Error("Missing project tenant id.");
+    const accountName = stringFlag(flags, "account") || undefined;
+    const config = await readConfig();
+    const previousTenantId = config.selectedProject?.tenantId;
+    if (previousTenantId && previousTenantId !== tenantId) {
+        // Switching projects needs a fresh account refresh token to start the new
+        // impersonation -- the one used to start the old impersonation was
+        // already consumed by the server, so the old session must be stopped
+        // first to get a new one back.
+        await stopProjectImpersonation(accountName, previousTenantId);
+    }
     await saveSelectedProject(tenantId);
+    const project = await getImpersonatedProjectSession(accountName, tenantId);
     console.log(`Selected project tenant ${tenantId}`);
-    console.log("Root/account session is kept for OS project APIs. Project impersonation is created lazily when a service command needs it.");
+    console.log(`Project session ready for tenant ${project.tenantId}.`);
 }

package/dist/index.js

@@ -500,7 +500,9 @@ Auth:
     Device-code login. Prints a verification URL and user code, opens the
     browser to the verification page when possible so you only need to click
     approve, then polls until the device is authorized; stores account access
-    and refresh tokens and auto-refreshes later.
+    and refresh tokens and auto-refreshes later. If a project was previously
+    selected, re-impersonates it automatically; otherwise lists projects and
+    prompts you to run 'blocks use <tenantId>'.
 
   blocks auth status [--json]
     Show only whether account/project access and refresh tokens are missing,
@@ -518,8 +520,9 @@ Auth:
 
 Projects:
   blocks projects list [--json]
-    List accessible Blocks projects via /os/v4/Project/Gets using the account
-    token. Read-only.
+    List accessible Blocks projects via /os/v4/Project/Gets. Uses the
+    impersonated project session when a project is selected, otherwise the
+    account token. Read-only.
 
   blocks projects get [tenantId] [--deployment] [--json]
     Read one project from Project/Gets. Uses selected project when tenantId is
@@ -528,20 +531,24 @@ Projects:
     to resolve its target. Read-only.
 
   blocks use <project-tenant-id>
-    Save the selected project tenant globally and in blocks.json when present.
-    Does not call cloud APIs.
+    Save the selected project tenant globally and in blocks.json when present,
+    then immediately impersonate it. If a different project was selected,
+    stops that impersonation first to reclaim a fresh account refresh token
+    before starting the new one.
 
   blocks deselect
-    Clear the selected project tenant (globally and in blocks.json) and drop
-    its cached impersonation token. Use this to recover when an impersonated
-    project token has expired or failed, then run 'blocks use <tenantId>'
-    again to reselect and re-impersonate.
+    Stop the active impersonation (restoring a fresh account refresh token),
+    then clear the selected project tenant (globally and in blocks.json) and
+    drop its cached impersonation token. Run 'blocks use <tenantId>' again to
+    reselect and re-impersonate.
 
 IAM:
   blocks iam me [--json]
-    Read the current user from IAM using the account token (bootstrapping/CLI
-    operator identity, not a project resource). Every other iam * command below
-    is project-scoped: it requires a selected project and calls IAM using an
+    Read the current user from IAM (bootstrapping/CLI operator identity, not
+    a project resource). Uses the impersonated project session when a project
+    is selected, otherwise the account token -- the server always resolves
+    this to the root identity either way. Every other iam * command below is
+    project-scoped: it requires a selected project and calls IAM using an
     impersonated project token only, never the account token.
 
   Users (/iam/v4/iam/users*):

package/dist/lib/api.d.ts

@@ -5,6 +5,7 @@ type RequestOptions = {
     body?: unknown;
     impersonatedProjectAuth?: boolean;
     method?: string;
+    preferImpersonatedProjectAuth?: boolean;
     projectTenantId?: string;
     query?: Record<string, string | number | boolean | string[] | undefined>;
 };

package/dist/lib/api.js

@@ -31,8 +31,26 @@ export async function blocksRequest(path, options = {}) {
         if (options.impersonatedProjectAuth) {
             const project = await getImpersonatedProjectSession(options.accountName, options.projectTenantId, { forceRefresh });
             headers.Authorization = `Bearer ${project.accessToken}`;
+            // The impersonated token is minted and signed by the root tenant's IdP --
+            // its JWKS only exists under the root tenant, so signature validation
+            // needs x-blocks-key pointed at root, not the target project. The actual
+            // tenant-data scoping comes from a claim already inside the validated
+            // token, not from this header.
             headers["x-blocks-key"] = project.accountTenant;
         }
+        if (options.preferImpersonatedProjectAuth) {
+            const tenantId = options.projectTenantId ?? config.selectedProject?.tenantId;
+            if (tenantId) {
+                const project = await getImpersonatedProjectSession(options.accountName, tenantId, { forceRefresh });
+                headers.Authorization = `Bearer ${project.accessToken}`;
+                headers["x-blocks-key"] = project.accountTenant;
+            }
+            else {
+                const account = await getAccountSession(options.accountName, { forceRefresh });
+                headers.Authorization = `Bearer ${account.accessToken}`;
+                headers["x-blocks-key"] = account.accountTenant;
+            }
+        }
         return fetch(url, {
             body: options.body === undefined ? undefined : isFormData ? options.body : JSON.stringify(options.body),
             headers,
@@ -41,14 +59,22 @@ export async function blocksRequest(path, options = {}) {
             throw new Error(`Blocks API request failed for ${url.origin}${url.pathname}: ${error.message}`);
         });
     };
+    const method = options.method ?? (options.body === undefined ? "GET" : "POST");
     let response = await send(false);
-    if (response.status === 401 && (options.accountAuth || options.impersonatedProjectAuth)) {
+    if (response.status === 401 && (options.accountAuth || options.impersonatedProjectAuth || options.preferImpersonatedProjectAuth)) {
         // The locally cached expiry said the token was still good, but the server
         // rejected it anyway (early revocation, clock skew, forced logout server-side).
         // Force one refresh-and-retry before giving up -- this is what actually
         // prevents a spurious 're-run blocks login' when the refresh token is still valid.
         response = await send(true);
     }
+    else if (response.status === 500 && method === "GET") {
+        // Some tenant-scoped read endpoints (mfa config, signup-settings) intermittently
+        // 500 with a JWKS/kid lookup failure right after impersonation, then succeed on
+        // an immediate identical retry once the signing-key cache catches up. Safe to
+        // retry blindly here because GET is idempotent.
+        response = await send(false);
+    }
     const text = await response.text();
     const data = parseJson(text);
     if (!response.ok) {

package/dist/lib/auth.d.ts

@@ -31,4 +31,5 @@ export declare function pollDeviceToken(profile: AccountProfile, device: DeviceA
 export declare function getAccountSession(accountOverride?: string, options?: SessionOptions): Promise<AccountSession>;
 export declare function selectProject(tenantId: string): Promise<void>;
 export declare function getImpersonatedProjectSession(accountOverride?: string, tenantOverride?: string, options?: SessionOptions): Promise<ProjectSession>;
+export declare function stopProjectImpersonation(accountOverride?: string, tenantOverride?: string): Promise<void>;
 export declare function revokeCurrentSession(accountOverride?: string): Promise<void>;

package/dist/lib/auth.js

@@ -194,6 +194,57 @@ export async function getImpersonatedProjectSession(accountOverride, tenantOverr
     await writeTokenStore(next.store);
     return projectSessionFromToken(name, tenantId, next.store.accounts[name].projects[tenantId], account.accountTenant);
 }
+// Ends the active project impersonation and restores a fresh, refreshable
+// account-level session. The IAM server revokes the account refresh token the
+// moment it's used to start an impersonation (see impersonateProject) and
+// only ever hands back a project-scoped one in exchange -- calling
+// '/impersonation/stop' is the only way to get a new account-level refresh
+// token back. No-ops if no project is selected or nothing was ever
+// impersonated for it.
+export async function stopProjectImpersonation(accountOverride, tenantOverride) {
+    const config = await readConfig();
+    const { name, profile } = getAccountProfile(config, accountOverride);
+    const tenantId = tenantOverride ?? config.selectedProject?.tenantId;
+    if (!tenantId)
+        return;
+    const store = await readTokenStore();
+    if (!store.accounts[name]?.projects?.[tenantId]?.refreshToken)
+        return;
+    // The stop endpoint requires a currently-valid bearer token to authenticate
+    // the call, so refresh the project session first if it's expiring.
+    const project = await getImpersonatedProjectSession(name, tenantId);
+    const beforeStop = await readTokenStore();
+    const projectToken = beforeStop.accounts[name]?.projects?.[tenantId];
+    if (!projectToken?.refreshToken)
+        return;
+    const refreshed = await postStopImpersonation(profile.apiUrl, project.accessToken, project.accountTenant, projectToken.refreshToken);
+    const latestConfig = await readConfig();
+    const latestStore = await readTokenStore();
+    const next = applyAccountToken(latestConfig, latestStore, name, profile.clientId, refreshed);
+    const { [tenantId]: _removed, ...remainingProjects } = next.store.accounts[name]?.projects ?? {};
+    next.store.accounts[name] = {
+        ...next.store.accounts[name],
+        projects: remainingProjects
+    };
+    await writeConfig(next.config);
+    await writeTokenStore(next.store);
+}
+async function postStopImpersonation(apiUrl, accessToken, accountTenant, refreshToken) {
+    const response = await fetch(new URL("/iam/v4/auth/impersonation/stop", apiUrl), {
+        body: JSON.stringify({ refresh_token: refreshToken }),
+        headers: {
+            Accept: "application/json",
+            Authorization: `Bearer ${accessToken}`,
+            "Content-Type": "application/json",
+            "x-blocks-key": accountTenant
+        },
+        method: "POST"
+    });
+    const data = parseJson(await response.text());
+    if (response.ok && !data.error)
+        return data;
+    throw new Error(data.error_description ?? data.error ?? `Stop impersonation failed with HTTP ${response.status}`);
+}
 export async function revokeCurrentSession(accountOverride) {
     const config = await readConfig();
     const store = await readTokenStore();

package/dist/lib/project-info.js

@@ -1,12 +1,16 @@
 import { blocksRequest } from "./api.js";
 import { requestContext } from "./request-context.js";
 import { selectedProject } from "./workspace.js";
-// Project metadata (Project/Gets, Project/GetAsset) always uses the account
-// token, never the impersonated project token -- these endpoints operate at
-// the account/tenant-group level, above any single project's own API surface.
+// Project metadata (Project/Gets, Project/GetAsset) is authorized at the
+// account/tenant-group level, above any single project's own API surface --
+// but the platform's permission check rebuilds to the root tenant while
+// impersonating, and the underlying query filters by user id rather than
+// tenant, so the impersonated project session works here too. Prefer it when
+// a project is selected (avoids an extra account-session refresh mid-project
+// work); fall back to the account token when nothing is selected yet.
 export async function listProjectGroups(flags) {
     return blocksRequest("/os/v4/Project/Gets", {
-        accountAuth: true,
+        preferImpersonatedProjectAuth: true,
         query: { page: 0, pageSize: 100, tenantGroupId: "" },
         ...requestContext(flags)
     });
@@ -32,7 +36,7 @@ export async function resolveSelectedProject(flags) {
 }
 export async function getProjectAssets(tenantGroupId, flags) {
     return blocksRequest("/os/v4/Project/GetAsset", {
-        accountAuth: true,
+        preferImpersonatedProjectAuth: true,
         query: { page: 0, pageSize: 100, tenantGroupId },
         ...requestContext(flags)
     });

package/dist/lib/scaffold-web/root-files.js

@@ -18,7 +18,7 @@ export async function writeRootFiles(root, options) {
         },
         dependencies: {
             "@radix-ui/react-dropdown-menu": "^2.1.24",
-            "@seliseblocks/client": "^0.1.1",
+            "@seliseblocks/client": "^0.1.3",
             "@tanstack/react-query": "^5.101.4",
             clsx: "^2.1.1",
             "lucide-react": "^1.28.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seliseblocks/cli-os",
-  "version": "0.1.5",
+  "version": "0.2.0",
   "description": "CLI for SELISE Blocks project setup and configuration.",
   "license": "MIT",
   "type": "module",