@tillstack/cli 0.3.0 → 0.3.2

package/dist/index.js

@@ -338,7 +338,13 @@ ${c.bold('TILLFORGE')} ${c.dim('(sovereign code hosting)')}  ${c.gray('tilldev f
 ${c.bold('TILLAUTH')} ${c.dim('(auth)')}            ${c.gray('tilldev auth …')}
   auth apps                 List auth apps
   auth apps create <name> [--slug <s>]   Create an auth app
-  auth app <appId>          Show an auth app
+  auth app <appRef>         Show an auth app (by slug or id)
+  auth invite <appRef> <email> [--role <r>]   Invite a user to an app
+  auth clients <appRef>     List OIDC clients registered on an app
+  auth clients <appRef> create <name> --redirect <uri>[,<uri>] [--scopes …] [--public] [--no-consent]
+  auth clients <appRef> rm <clientId>    Remove an OIDC client
+  auth scim <appRef> [rotate]   Mint/rotate the SCIM provisioning token (shown once)
+  auth scim <appRef> disable    Turn SCIM provisioning off
 
 ${c.bold('WORKSPACE')}
   team                      List org members
@@ -757,11 +763,96 @@ async function cmdAuth(flags) {
             return;
         }
         case 'app': {
-            const appId = need(flags.positional[2], 'tilldev auth app <appId>');
+            const appId = need(flags.positional[2], 'tilldev auth app <appRef>');
             const r = await api.getAuthApp(opts, appId);
             printJson(r);
             return;
         }
+        case 'invite': {
+            const appRef = need(flags.positional[2], 'tilldev auth invite <appRef> <email> [--role <r>]');
+            const email = need(flags.positional[3], 'tilldev auth invite <appRef> <email> [--role <r>]');
+            const role = flags.named['role']?.trim();
+            const r = await api.inviteAuthUser(opts, appRef, email, role);
+            render(flags, r, () => {
+                ok(`Invited ${c.bold(r.invite.email)} as ${c.dim(r.invite.role)}`);
+                if (r.delivered)
+                    console.log(c.dim('An invitation email is on its way.'));
+                else if (r.accept_link)
+                    console.log(`Share this link:\n  ${c.bold(r.accept_link)}`);
+            });
+            return;
+        }
+        case 'clients': {
+            const appRef = need(flags.positional[2], 'tilldev auth clients <appRef> [create|rm]');
+            const action = flags.positional[3];
+            if (action === 'create') {
+                const name = need(flags.positional[4], 'tilldev auth clients <appRef> create <name> --redirect <uri>[,<uri>…] [--scopes openid,email,profile] [--public] [--no-consent]');
+                // Comma-separate multiple redirect URIs in a single --redirect flag.
+                const redirect_uris = (flags.named['redirect'] ?? '').split(',').map((s) => s.trim()).filter(Boolean);
+                if (redirect_uris.length === 0)
+                    throw new Error('At least one --redirect <uri> is required');
+                const scopes = flags.named['scopes']?.split(',').map((s) => s.trim()).filter(Boolean);
+                const body = {
+                    name,
+                    redirect_uris,
+                    ...(scopes ? { scopes } : {}),
+                    ...(flags.bool.has('public') ? { public: true } : {}),
+                    ...(flags.bool.has('no-consent') ? { require_consent: false } : {}),
+                };
+                const r = await api.createOidcClient(opts, appRef, body);
+                render(flags, r, () => {
+                    ok(`Registered OIDC client ${c.bold(r.client_id)} (${c.dim(r.client_type)})`);
+                    console.log(kv([
+                        ['client_id', r.client_id],
+                        ['redirect_uris', r.redirect_uris.join(', ')],
+                        ['scopes', r.scopes.join(' ')],
+                    ]));
+                    if (r.client_secret) {
+                        console.log(`\n${c.yellow('client_secret (shown once — store it now):')}\n  ${c.bold(r.client_secret)}`);
+                    }
+                    else {
+                        console.log(c.dim('\nPublic client — no secret; authenticate with PKCE (S256).'));
+                    }
+                });
+                return;
+            }
+            if (action === 'rm' || action === 'delete') {
+                const clientId = need(flags.positional[4], 'tilldev auth clients <appRef> rm <clientId>');
+                const r = await api.deleteOidcClient(opts, appRef, clientId);
+                render(flags, r, () => ok(`Removed client ${c.dim(clientId)}`));
+                return;
+            }
+            const r = await api.listOidcClients(opts, appRef);
+            render(flags, r, () => {
+                const cols = [
+                    { header: 'CLIENT ID', get: (x) => c.bold(x.client_id) },
+                    { header: 'NAME', get: (x) => x.name },
+                    { header: 'TYPE', get: (x) => c.dim(x.client_type) },
+                    { header: 'SCOPES', get: (x) => (x.scopes ?? []).join(' ') },
+                    { header: 'ENABLED', get: (x) => (x.enabled ? c.green('yes') : c.red('no')) },
+                ];
+                console.log(table(r.clients, cols));
+            });
+            return;
+        }
+        case 'scim': {
+            const appRef = need(flags.positional[2], 'tilldev auth scim <appRef> [rotate|disable]');
+            const action = flags.positional[3] ?? 'rotate';
+            if (action === 'disable') {
+                const r = await api.scimDisable(opts, appRef);
+                render(flags, r, () => ok('SCIM provisioning disabled for this app.'));
+                return;
+            }
+            // rotate (also the enable path — mints a fresh token, shown once)
+            const r = await api.scimRotate(opts, appRef);
+            render(flags, r, () => {
+                ok('SCIM provisioning token minted.');
+                console.log(kv([['scim_base_url', r.scim_base_url]]));
+                console.log(`\n${c.yellow('bearer token (shown once — store it now):')}\n  ${c.bold(r.token)}`);
+                console.log(c.dim('\nConfigure your IdP (Okta, Entra ID, …) with the base URL + this token.'));
+            });
+            return;
+        }
         default:
             throw new Error(`unknown: tilldev auth ${sub}`);
     }