@seliseblocks/cli-os 0.2.5 → 0.2.6

package/dist/commands/auth/config/save.js

@@ -7,7 +7,7 @@ import { requestContext } from "../../../lib/request-context.js";
 import { parseCommand, selectedProject } from "../../../lib/workspace.js";
 export async function authConfigSave(argv) {
     const { flags } = parseCommand(argv);
-    const body = {
+    const overrides = {
         ...(await jsonBodyFlag(flags)),
         ...compact({
             absoluteRefreshTokenValidForNumberMinutes: optionalIntegerFlag(flags, "absolute-refresh-token-minutes"),
@@ -21,12 +21,22 @@ export async function authConfigSave(argv) {
             rememberMeRefreshTokenValidForNumberMinutes: optionalIntegerFlag(flags, "remember-me-refresh-token-minutes")
         })
     };
+    const projectKey = await selectedProject(flags);
+    // POST /auth/config replaces the whole config document rather than merging
+    // (confirmed against the portal's own save call, which always resends every
+    // field it read on load) -- fetch the current config first so fields the
+    // caller didn't mention here survive the round trip instead of resetting.
+    const current = await blocksRequest("/iam/v4/auth/config", {
+        impersonatedProjectAuth: true,
+        ...requestContext(flags),
+        projectTenantId: projectKey
+    });
+    const body = { ...current, ...overrides };
     if (booleanFlag(flags, "dry-run")) {
         writeOutput({ dryRun: true, endpoint: "/iam/v4/auth/config", request: body }, flags);
         return;
     }
     await confirmMutation(flags, "Save AuthController configuration for the selected project.");
-    const projectKey = await selectedProject(flags);
     const result = await blocksRequest("/iam/v4/auth/config", {
         body,
         impersonatedProjectAuth: true,

package/dist/commands/auth/oidc-clients/save.js

@@ -8,7 +8,7 @@ import { parseCommand, selectedProject } from "../../../lib/workspace.js";
 /** Upsert: omit --item-id to register a new OIDC client, pass it to update an existing one. */
 export async function authOidcClientsSave(argv) {
     const { flags } = parseCommand(argv);
-    const body = {
+    const overrides = {
         ...(await jsonBodyFlag(flags)),
         ...compact({
             allowedMfaMethods: listFlag(flags, "allowed-mfa-methods")?.map(Number),
@@ -36,12 +36,27 @@ export async function authOidcClientsSave(argv) {
             useTokensCookie: optionalBooleanFlag(flags, "use-tokens-cookie")
         })
     };
+    const projectKey = await selectedProject(flags);
+    const itemId = typeof overrides.itemId === "string" ? overrides.itemId : undefined;
+    // Saving an existing client (itemId set) replaces the whole client document
+    // rather than merging -- the portal's own Edit dialog always resubmits every
+    // field, including ones this command wasn't asked to change. Fetch the
+    // current client first so unmentioned fields (redirectUris, scope, PKCE, ...)
+    // survive instead of being reset to defaults. A new client (no itemId) has
+    // no prior state to merge.
+    const current = itemId
+        ? await blocksRequest(`/iam/v4/oidc-clients/${encodeURIComponent(itemId)}`, {
+            impersonatedProjectAuth: true,
+            ...requestContext(flags),
+            projectTenantId: projectKey
+        })
+        : {};
+    const body = { ...current, ...overrides };
     if (booleanFlag(flags, "dry-run")) {
         writeOutput({ dryRun: true, endpoint: "/iam/v4/oidc-clients", request: redactSecret(body) }, flags);
         return;
     }
     await confirmMutation(flags, `Save OIDC client '${body.clientDisplayName ?? body.itemId ?? "(new)"}'. The response's client secret is shown once.`);
-    const projectKey = await selectedProject(flags);
     const result = await blocksRequest("/iam/v4/oidc-clients", {
         body,
         impersonatedProjectAuth: true,

package/dist/commands/new/web.js

@@ -21,6 +21,15 @@ export async function newWeb(argv) {
     const appDomain = await resolveAppDomain(project, flags);
     const apiUrl = stringFlag(flags, "blocks-api-url") || apiUrlFromAppDomain(appDomain);
     const oidcClientId = await resolveOidcClientId(tenantId, appDomain, name, flags);
+    if (oidcClientId) {
+        try {
+            await ensureOidcLoginEnabled(tenantId, flags);
+        }
+        catch (error) {
+            console.warn(`Warning: could not confirm/enable OIDC login on this project's AuthController config: ${error.message}`);
+            console.warn("Enable it manually: 'blocks auth:config:save --oidc-enabled --project " + tenantId + "', or in the Blocks portal under IAM > Auth Config.");
+        }
+    }
     await scaffoldWebProject({
         apiUrl,
         appDomain,
@@ -116,6 +125,32 @@ async function listOidcClientSummaries(tenantId, flags) {
     }
     return summaries;
 }
+// Creating/selecting an OIDC client is not enough for the hosted login flow to
+// work: AuthController separately gates the whole OIDC/IdP path behind
+// isOidcEnabled on the tenant's auth config, off by default. Without this,
+// scaffolded apps 404/error on login until someone flips it manually in the
+// portal (IAM > Auth Config), so check-and-enable it here as part of setup.
+// POST /auth/config replaces the whole config document rather than merging
+// (confirmed against the portal's own save call, which always resends every
+// field) -- sending just `{ isOidcEnabled: true }` would reset every other
+// AuthController setting for this tenant, so the fetched config is spread
+// back in full with only that one field overridden.
+async function ensureOidcLoginEnabled(tenantId, flags) {
+    const config = await blocksRequest("/iam/v4/auth/config", {
+        impersonatedProjectAuth: true,
+        projectTenantId: tenantId,
+        ...requestContext(flags)
+    });
+    if (config.isOidcEnabled)
+        return;
+    await confirmMutation(flags, "Enable OIDC login on this project's AuthController configuration.");
+    await blocksRequest("/iam/v4/auth/config", {
+        body: { ...config, isOidcEnabled: true },
+        impersonatedProjectAuth: true,
+        projectTenantId: tenantId,
+        ...requestContext(flags)
+    });
+}
 function normalizeList(raw) {
     if (Array.isArray(raw))
         return raw;
@@ -135,10 +170,15 @@ async function createOidcClientInteractively(tenantId, appDomain, appName, flags
     // clientType drives IAM's tokenEndpointAuthMethod: omitting it stores this browser
     // app as confidential ("client_secret_post") and lets it request client_credentials.
     // The scaffold only ever produces a PKCE SPA, so it is always "public".
+    // isAutoRedirect: the scaffolded login page's startLogin() already navigates
+    // straight to the provider via window.location.assign -- without this flag IAM
+    // shows an interstitial "continue" click on the hosted login page instead of
+    // redirecting immediately, which is dead weight for a flow the SPA already drives.
     const body = {
         clientDisplayName: displayName,
         clientType: "public",
         isActive: true,
+        isAutoRedirect: true,
         redirectUris: [redirectUri],
         registerAsIdentityProvider: true,
         requirePkce: true,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seliseblocks/cli-os",
-  "version": "0.2.5",
+  "version": "0.2.6",
   "description": "CLI for SELISE Blocks project setup and configuration.",
   "license": "MIT",
   "type": "module",