@uic-coe-connect/cli 0.2.1 → 0.2.2

package/dist/commands/roles.js

@@ -184,6 +184,75 @@ export function registerRoleCommands() {
                 rules.forEach((rule, i) => info(`  [${i}] ${describeRule(rule)}`));
             });
         },
+    }, {
+        name: "roles token",
+        summary: "Show, issue, or rotate the app's role-resolve token",
+        usage: "roles token <app> [--issue | --rotate | --revoke]",
+        details: [
+            "The token your app puts in COE_ROLES_TOKEN so the SDK can resolve roles.",
+            "It is stored hashed and shown ONCE, at issue — there is no way to read it",
+            "back later. Lost it? Rotate and update the app's env.",
+            "",
+            "  coe roles token myapp --issue      # first time",
+            "  coe roles token myapp --rotate     # replace a live one",
+            "",
+            "Then: coe env set myapp COE_ROLES_TOKEN=<value>, and deploy.",
+        ],
+        async run({ args, client }) {
+            const c = client();
+            const app = await resolveApp(c, args.arg(0, "app"));
+            const path = `/registered-apps/${app.id}/roles/token`;
+            if (args.bool("revoke")) {
+                await c.request("DELETE", path);
+                emit({ appId: app.id, revoked: true }, () => {
+                    info(`✓ Revoked ${app.id}'s roles token`);
+                    info("  Role resolution now fails for this app until you issue a new one,");
+                    info("  and users sign in with rolesResolved: false.");
+                });
+                return;
+            }
+            const issuing = args.bool("issue") || args.bool("rotate");
+            if (!issuing) {
+                const { token } = await c.request("GET", path);
+                emit({ appId: app.id, token }, () => {
+                    if (!token) {
+                        info(`${app.id} has no roles token.`);
+                        info(`  Issue one with: coe roles token ${app.id} --issue`);
+                        return;
+                    }
+                    details([
+                        ["App", app.id],
+                        ["Token", `${token.prefix}… (stored hashed; issue a new one to see a value)`],
+                        ["Created", `${new Date(token.createdAt).toLocaleString()} by ${token.createdBy}`],
+                        [
+                            "Last used",
+                            token.lastUsedAt
+                                ? new Date(token.lastUsedAt).toLocaleString()
+                                : "never — the app hasn't resolved a role yet",
+                        ],
+                    ]);
+                });
+                return;
+            }
+            // Rotating invalidates the value the deployed app is holding, so it
+            // can't be something you do by reaching for the wrong flag.
+            const existing = await c.request("GET", path);
+            if (existing.token && !args.bool("rotate")) {
+                throw new CliError(`${app.id} already has a roles token (${existing.token.prefix}…).`, 6, "Re-run with --rotate to replace it. The deployed app will fail to resolve roles until you update COE_ROLES_TOKEN and redeploy.");
+            }
+            const result = await c.request("POST", path);
+            emit(result, () => {
+                info(`✓ ${result.rotated ? "Rotated" : "Issued"} ${app.id}'s roles token`);
+                info("");
+                info(`  ${result.token}`);
+                info("");
+                info("  This is the only time it is shown. Store it now:");
+                info(`    coe env set ${app.id} COE_ROLES_TOKEN=${result.token}`);
+                if (result.rotated) {
+                    info("  The previous token stopped working immediately — deploy to pick this one up.");
+                }
+            });
+        },
     }, {
         name: "roles remove-rule",
         summary: "Remove a rule by its index (see roles show)",

package/dist/types.d.ts

@@ -61,6 +61,15 @@ export interface AppAccess {
     devTeam: string[];
     staff: StaffAccess;
 }
+/** An app's role-resolve token, minus anything that could reconstruct it. */
+export interface RolesTokenInfo {
+    appId: string;
+    /** Leading characters only — enough to recognise which token is deployed. */
+    prefix: string;
+    createdAt: string;
+    createdBy: string;
+    lastUsedAt?: string;
+}
 export interface RegisteredApp {
     id: string;
     name: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@uic-coe-connect/cli",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "The coe CLI \u2014 manage COEConnect apps (pipelines, deploys, access, env) from a terminal, with browser-approved auth. Designed to be driven by an AI agent.",
   "type": "module",
   "bin": {