@wardby/cli 0.2.0 → 0.3.0

package/dist/mcp/auth/ownership.d.ts

@@ -1,16 +1,16 @@
 /**
- * Single seam for ownership decisions across Agent/BudgetGroup/Tool/Secret/
- * Webhook/Task (and anything else that gains a nullable owner column
- * later). A null owner means "public": readable AND mutable by anyone —
- * there is no gatekeeper, so no principal is turned away. `isOwner` stays
+ * Ownership decisions for the resource types that don't have grants yet:
+ * BudgetGroup/Tool/Secret/Datastore/Webhook/Task. A null owner still means
+ * "public" here: readable AND mutable by anyone. Tool and budget-group
+ * grants replace that in the resource-sharing grants Phases 2 and 3.
+ *
+ * Agents are NOT decided here any more: they use explicit grants (owner, or
+ * read < execute < write), and an owner-less agent is reachable only
+ * through its grants -- see ./access.ts and core/grants.ts. `isOwner` stays
  * available (strict, no null-passthrough) for checks that must stay
- * owner-only regardless of publicness — e.g. a future claim-on-edit
- * feature would use it to tell "already owned" apart from "public" before
- * deciding whether to stamp a new owner. Every tool file routes through
- * this module instead of re-deriving the null-handling itself, so changing
- * the policy again later is a change here, not an N-file sweep.
+ * owner-only regardless of publicness.
  */
-import type { PrismaClient, Tool } from "@prisma/client";
+import type { PrismaClient, Tool } from "#prisma";
 export declare function canRead(ownerId: string | null, principalId: string): boolean;
 export declare function isOwner(ownerId: string | null, principalId: string): boolean;
 /** Same rule as canRead: a null owner is a mutation target for anyone, same as it's a read target for anyone. */
@@ -24,90 +24,64 @@ export declare function visibleToPrincipal(principalId: string): {
         ownerId: null;
     })[];
 };
-export declare function requireOwnedAgent(db: PrismaClient, id: string, principalId: string): Promise<{
+export declare function requireOwnedBudgetGroup(db: PrismaClient, id: string, principalId: string): Promise<{
     name: string;
-    model: string;
-    budgetUsd: import("@prisma/client/runtime/library").Decimal;
     id: string;
-    systemPrompt: string;
-    createdAt: Date;
-    updatedAt: Date;
-    kind: import("@prisma/client").$Enums.AgentKind;
-    schedule: string | null;
-    timezone: string;
-    scheduleEnabled: boolean;
-    lastScheduledAt: Date | null;
-    maxTurns: number;
     ownerId: string | null;
-    budgetGroupId: string | null;
-    memoryEnabled: boolean;
-}>;
-export declare function requireReadableAgent(db: PrismaClient, id: string, principalId: string): Promise<{
-    name: string;
-    model: string;
-    budgetUsd: import("@prisma/client/runtime/library").Decimal;
-    id: string;
-    systemPrompt: string;
+    dailyBudgetUsd: import("@prisma/client-runtime-utils").Decimal | null;
+    weeklyBudgetUsd: import("@prisma/client-runtime-utils").Decimal | null;
+    monthlyBudgetUsd: import("@prisma/client-runtime-utils").Decimal | null;
+    warnThresholdRatio: import("@prisma/client-runtime-utils").Decimal;
     createdAt: Date;
     updatedAt: Date;
-    kind: import("@prisma/client").$Enums.AgentKind;
-    schedule: string | null;
-    timezone: string;
-    scheduleEnabled: boolean;
-    lastScheduledAt: Date | null;
-    maxTurns: number;
-    ownerId: string | null;
-    budgetGroupId: string | null;
-    memoryEnabled: boolean;
 }>;
-export declare function requireOwnedBudgetGroup(db: PrismaClient, id: string, principalId: string): Promise<{
+export declare function requireReadableBudgetGroup(db: Pick<PrismaClient, "budgetGroup">, id: string, principalId: string): Promise<{
     name: string;
     id: string;
-    createdAt: Date;
-    updatedAt: Date;
     ownerId: string | null;
-    dailyBudgetUsd: import("@prisma/client/runtime/library").Decimal | null;
-    weeklyBudgetUsd: import("@prisma/client/runtime/library").Decimal | null;
-    monthlyBudgetUsd: import("@prisma/client/runtime/library").Decimal | null;
-    warnThresholdRatio: import("@prisma/client/runtime/library").Decimal;
-}>;
-export declare function requireReadableBudgetGroup(db: PrismaClient, id: string, principalId: string): Promise<{
-    name: string;
-    id: string;
+    dailyBudgetUsd: import("@prisma/client-runtime-utils").Decimal | null;
+    weeklyBudgetUsd: import("@prisma/client-runtime-utils").Decimal | null;
+    monthlyBudgetUsd: import("@prisma/client-runtime-utils").Decimal | null;
+    warnThresholdRatio: import("@prisma/client-runtime-utils").Decimal;
     createdAt: Date;
     updatedAt: Date;
-    ownerId: string | null;
-    dailyBudgetUsd: import("@prisma/client/runtime/library").Decimal | null;
-    weeklyBudgetUsd: import("@prisma/client/runtime/library").Decimal | null;
-    monthlyBudgetUsd: import("@prisma/client/runtime/library").Decimal | null;
-    warnThresholdRatio: import("@prisma/client/runtime/library").Decimal;
 }>;
 export declare function requireOwnedSecret(db: PrismaClient, id: string, principalId: string): Promise<void>;
 export declare function requireOwnedWebhook(db: PrismaClient, id: string, principalId: string): Promise<void>;
 export declare function requireOwnedDatastore(db: PrismaClient, id: string, principalId: string): Promise<{
     name: string;
     id: string;
+    ownerId: string | null;
     createdAt: Date;
     updatedAt: Date;
-    ownerId: string | null;
 }>;
 export declare function requireOwnedTool(db: Pick<PrismaClient, "tool">, id: string, principalId: string): Promise<Tool>;
+/**
+ * Owner-only, with no null-is-public passthrough: for changing or removing
+ * a tool's code (update_tool/delete_tool), where requireOwnedTool's rule
+ * would let anyone rewrite a public tool. A public tool is readable but
+ * immutable over MCP (403) -- only an operator can change one, via the CLI.
+ * A tool the caller can't read is 404, the same as a missing one.
+ */
+export declare function requireStrictlyOwnedTool(db: Pick<PrismaClient, "tool">, id: string, principalId: string): Promise<Tool>;
+/** requireStrictlyOwnedTool's rule for a row already read (e.g. inside core/tool-admin.ts's transaction). */
+export declare function assertStrictlyOwnedTool(tool: Tool | null, id: string, principalId: string): Tool;
 /**
  * A Task's principalId is the caller who triggered it, not the underlying
  * agent's owner — a public agent's runs are still private to whoever
  * triggered them. No canRead/null=public path exists here on purpose.
  */
 export declare function requireOwnedTask(db: PrismaClient, taskId: string, principalId: string): Promise<{
-    status: import("@prisma/client").$Enums.TaskStatus;
+    status: import("#prisma").TaskStatus;
     runId: string | null;
-    error: import("@prisma/client/runtime/library").JsonValue | null;
-    result: import("@prisma/client/runtime/library").JsonValue | null;
+    kind: import("#prisma").TaskKind;
+    error: import("@prisma/client/runtime/client").JsonValue | null;
+    result: import("@prisma/client/runtime/client").JsonValue | null;
     id: string;
     createdAt: Date;
     updatedAt: Date;
-    kind: import("@prisma/client").$Enums.TaskKind;
     principalId: string | null;
-    inputRequests: import("@prisma/client/runtime/library").JsonValue | null;
-    inputResponses: import("@prisma/client/runtime/library").JsonValue | null;
+    inputRequests: import("@prisma/client/runtime/client").JsonValue | null;
+    inputResponses: import("@prisma/client/runtime/client").JsonValue | null;
     ttlAt: Date;
 }>;

package/dist/mcp/auth/ownership.js

@@ -17,20 +17,6 @@ export function assertCanMutate(ownerId, principalId, notFoundMessage) {
 export function visibleToPrincipal(principalId) {
     return { OR: [{ ownerId: principalId }, { ownerId: null }] };
 }
-export async function requireOwnedAgent(db, id, principalId) {
-    const agent = await db.agent.findUnique({ where: { id } });
-    if (!agent)
-        throw new McpError(404, `Agent "${id}" not found.`);
-    assertCanMutate(agent.ownerId, principalId, `Agent "${id}" is not owned by the caller.`);
-    return agent;
-}
-export async function requireReadableAgent(db, id, principalId) {
-    const agent = await db.agent.findUnique({ where: { id } });
-    if (!agent || !canRead(agent.ownerId, principalId)) {
-        throw new McpError(404, `Agent "${id}" not found.`);
-    }
-    return agent;
-}
 export async function requireOwnedBudgetGroup(db, id, principalId) {
     const group = await db.budgetGroup.findUnique({ where: { id } });
     if (!group)
@@ -71,6 +57,25 @@ export async function requireOwnedTool(db, id, principalId) {
     assertCanMutate(tool.ownerId, principalId, `Tool "${id}" is not owned by the caller.`);
     return tool;
 }
+/**
+ * Owner-only, with no null-is-public passthrough: for changing or removing
+ * a tool's code (update_tool/delete_tool), where requireOwnedTool's rule
+ * would let anyone rewrite a public tool. A public tool is readable but
+ * immutable over MCP (403) -- only an operator can change one, via the CLI.
+ * A tool the caller can't read is 404, the same as a missing one.
+ */
+export async function requireStrictlyOwnedTool(db, id, principalId) {
+    return assertStrictlyOwnedTool(await db.tool.findUnique({ where: { id } }), id, principalId);
+}
+/** requireStrictlyOwnedTool's rule for a row already read (e.g. inside core/tool-admin.ts's transaction). */
+export function assertStrictlyOwnedTool(tool, id, principalId) {
+    if (!tool || !canRead(tool.ownerId, principalId))
+        throw new McpError(404, `Tool "${id}" not found.`);
+    if (!isOwner(tool.ownerId, principalId)) {
+        throw new McpError(403, `Tool "${id}" is public; public tools can't be changed or deleted over MCP.`);
+    }
+    return tool;
+}
 /**
  * A Task's principalId is the caller who triggered it, not the underlying
  * agent's owner — a public agent's runs are still private to whoever

package/dist/mcp/auth/principal.d.ts

@@ -5,5 +5,5 @@
  * always carries an owner, so a deployment that later moves from stdio to
  * HTTP+OAuth doesn't orphan locally-authored agents.
  */
-import type { PrismaClient, Principal } from "@prisma/client";
+import type { PrismaClient, Principal } from "#prisma";
 export declare function resolvePrincipal(subject: string, db: PrismaClient): Promise<Principal>;

package/dist/mcp/auth/repo-authorization.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Set-time repository authorization for the MCP tools that give an agent
+ * authority over a repository (link_repository; create_agent/update_agent's
+ * codingProfile.repository). Returns the stamp to store on the granting row,
+ * or throws an actionable McpError. See core/repo-access.ts for the use-time
+ * side and the rules; the host call happens here, before any transaction.
+ */
+import { type AuthorizedVia, type RepoAccessKind } from "../../core/repo-access.js";
+import type { McpRequestContext } from "../context.js";
+export interface RepositoryAuthorization {
+    authorizedVia: AuthorizedVia;
+    authorizedById: string;
+    authorizedAt: Date;
+}
+export declare function authorizeRepositoryForSet(ctx: McpRequestContext, input: {
+    /** The agent's owner. The caller is always the owner here (or creating the agent). */
+    ownerId: string | null;
+    provider: string;
+    repository: string;
+    kind: RepoAccessKind;
+    adminOverride?: boolean;
+}): Promise<RepositoryAuthorization>;

package/dist/mcp/auth/repo-authorization.js

@@ -0,0 +1,51 @@
+/**
+ * Set-time repository authorization for the MCP tools that give an agent
+ * authority over a repository (link_repository; create_agent/update_agent's
+ * codingProfile.repository). Returns the stamp to store on the granting row,
+ * or throws an actionable McpError. See core/repo-access.ts for the use-time
+ * side and the rules; the host call happens here, before any transaction.
+ */
+import { requiredLevel } from "../../core/repo-access.js";
+import { McpError } from "../errors.js";
+import { requireScope } from "./resource-server.js";
+export async function authorizeRepositoryForSet(ctx, input) {
+    if (!input.ownerId) {
+        throw new McpError(400, "owner_required: agents without an owner can't be given a repository, because an owner-less agent has no owner " +
+            "whose GitHub access can be checked. An admin can assign an owner with make_owner first.");
+    }
+    const stamp = (authorizedVia) => ({
+        authorizedVia,
+        authorizedById: ctx.principal.id,
+        authorizedAt: new Date(),
+    });
+    if (input.adminOverride) {
+        // Role-gated: the scope alone never suffices (resource-server.ts).
+        requireScope(ctx, ctx.canonicalUri, "agents:admin");
+        return stamp("admin");
+    }
+    const gate = ctx.providers.repoAccess;
+    if (!gate) {
+        throw new McpError(503, "Repository access can't be checked on this deployment (no GitHub App is configured). " +
+            "An admin can approve it explicitly with adminOverride.");
+    }
+    const required = requiredLevel(input.kind);
+    const decision = await gate.authorizePrincipal({
+        principalId: input.ownerId,
+        provider: input.provider,
+        repository: input.repository,
+        required,
+        fresh: true,
+    });
+    if (decision.ok)
+        return stamp("host_permission");
+    switch (decision.reason) {
+        case "identity_not_linked":
+            throw new McpError(403, "Link your GitHub account first (link_host_account): wardby checks that your own GitHub account can " +
+                `access ${input.repository} before an agent you own may use it.`);
+        case "insufficient_permission":
+            throw new McpError(403, `Your linked GitHub account has ${decision.level ?? "no"} access to ${input.repository}; ` +
+                `this needs ${required}. Ask a repository admin for access, or a wardby admin to approve it (adminOverride).`);
+        default:
+            throw new McpError(503, `Could not verify your GitHub access to ${input.repository} right now (is the GitHub App installed on it?). Try again.`);
+    }
+}

package/dist/mcp/auth/resource-server.d.ts

@@ -4,12 +4,35 @@
  * AuthProvider (delegating | self-hosted) is active — both implement
  * verifyBearer, so this file never branches on auth mode.
  */
-import type { PrismaClient } from "@prisma/client";
+import type { PrismaClient } from "#prisma";
 import type { AuthProvider } from "../../providers/auth/types.js";
-import { McpError } from "../errors.js";
+import { McpError, insufficientScope } from "../errors.js";
 import type { McpRequestContext, McpProviders } from "../context.js";
 /** The initial capability tiers (§Scopes → capability tiers in the design doc). */
 export declare const SCOPES_SUPPORTED: string[];
+/**
+ * Scopes whose operations reach beyond the caller's own (or public)
+ * resources — they double as the permission names roles grant:
+ * agents:admin reassigns ANY agent's owner (make_owner) and sets a BYO
+ * workerImageRef; packages:approve widens coding agents' package allowlists;
+ * services:manage changes the coding-run service catalog, which decides what
+ * runs next to every coding run that names an entry.
+ * A token scope only DELEGATES — it never authorizes on its own:
+ * requireScope/requireAnyScope honour one only when one of the caller's
+ * roles (McpRequestContext.roles, resolved live per request) grants it.
+ */
+export declare const PRIVILEGED_SCOPES: readonly string[];
+/**
+ * The built-in roles and the permissions (privileged scope names) each
+ * grants. No roles = member: every non-privileged scope, nothing privileged.
+ */
+export declare const ROLE_PERMISSIONS: Readonly<Record<string, readonly string[]>>;
+export declare const ROLE_NAMES: readonly string[];
+export declare function isRoleName(name: string): boolean;
+/** The permissions granted by `roles`; unknown role names grant nothing. */
+export declare function permissionsOf(roles: readonly string[] | null | undefined): Set<string>;
+/** Intersects a space-delimited scope string with `allowed`, deduplicated, keeping request order. */
+export declare function limitScope(scope: string, allowed: readonly string[]): string;
 export interface ProtectedResourceMetadata {
     resource: string;
     authorization_servers: string[];
@@ -44,4 +67,10 @@ export declare function authenticate(headers: AuthenticateHeaders, deps: Authent
  * per missing scope.
  */
 export declare function requireScope(ctx: McpRequestContext, canonicalUri: string, ...scopes: string[]): void;
-export { McpError };
+/**
+ * Like requireScope, but any ONE of `alternatives` suffices (e.g. package
+ * approval: packages:approve or agents:admin). The first alternative is the
+ * one named in the insufficient_scope challenge.
+ */
+export declare function requireAnyScope(ctx: McpRequestContext, canonicalUri: string, ...alternatives: string[]): void;
+export { McpError, insufficientScope };

package/dist/mcp/auth/resource-server.js

@@ -10,11 +10,51 @@ export const SCOPES_SUPPORTED = [
     "secrets:write",
     "webhooks:write",
     "budget_groups:write",
+    // Approve coding agents' package allowlists (see docs/coding-packages.md).
+    "packages:approve",
+    // Create, update and delete coding-run service catalog entries (see docs/coding-services.md).
+    // Reading the catalog is agents:read.
+    "services:manage",
     // Reassigns an agent's owner regardless of who currently owns it (or
     // whether it's public) — a step above agents:write, which only ever lets
     // a caller act on agents they already own or that are unowned.
     "agents:admin",
+    // set_agent_memory / delete_agent_memory (reading memory is agents:read).
+    "memory:write",
 ];
+/**
+ * Scopes whose operations reach beyond the caller's own (or public)
+ * resources — they double as the permission names roles grant:
+ * agents:admin reassigns ANY agent's owner (make_owner) and sets a BYO
+ * workerImageRef; packages:approve widens coding agents' package allowlists;
+ * services:manage changes the coding-run service catalog, which decides what
+ * runs next to every coding run that names an entry.
+ * A token scope only DELEGATES — it never authorizes on its own:
+ * requireScope/requireAnyScope honour one only when one of the caller's
+ * roles (McpRequestContext.roles, resolved live per request) grants it.
+ */
+export const PRIVILEGED_SCOPES = ["agents:admin", "packages:approve", "services:manage"];
+/**
+ * The built-in roles and the permissions (privileged scope names) each
+ * grants. No roles = member: every non-privileged scope, nothing privileged.
+ */
+export const ROLE_PERMISSIONS = {
+    admin: ["agents:admin", "packages:approve", "services:manage"],
+    "package-approver": ["packages:approve"],
+    "service-manager": ["services:manage"],
+};
+export const ROLE_NAMES = Object.keys(ROLE_PERMISSIONS);
+export function isRoleName(name) {
+    return Object.prototype.hasOwnProperty.call(ROLE_PERMISSIONS, name);
+}
+/** The permissions granted by `roles`; unknown role names grant nothing. */
+export function permissionsOf(roles) {
+    return new Set((roles ?? []).filter(isRoleName).flatMap((r) => ROLE_PERMISSIONS[r]));
+}
+/** Intersects a space-delimited scope string with `allowed`, deduplicated, keeping request order. */
+export function limitScope(scope, allowed) {
+    return [...new Set(scope.split(/\s+/).filter((s) => allowed.includes(s)))].join(" ");
+}
 /** RFC 9728 §3.1: insert `/.well-known/oauth-protected-resource` before the resource's path. */
 export function protectedResourceMetadataUrl(canonicalUri) {
     const url = new URL(canonicalUri);
@@ -55,6 +95,9 @@ export async function authenticate(headers, deps) {
     return {
         principal,
         scopes: new Set(verified.scopes),
+        // Decided by the provider on THIS request (self-hosted: AuthUser.roles
+        // read from the database; delegating: the configured signed role claim).
+        roles: (verified.wardbyRoles ?? []).filter(isRoleName),
         canonicalUri: deps.canonicalUri,
         providers: deps.providers,
         db: deps.db,
@@ -75,8 +118,46 @@ export async function authenticate(headers, deps) {
  */
 export function requireScope(ctx, canonicalUri, ...scopes) {
     const held = scopes.every((s) => ctx.scopes.has(s));
-    if (held)
+    if (!held)
+        throw insufficientScope(scopes, protectedResourceMetadataUrl(canonicalUri));
+    requirePermission(ctx, scopes);
+}
+/**
+ * Like requireScope, but any ONE of `alternatives` suffices (e.g. package
+ * approval: packages:approve or agents:admin). The first alternative is the
+ * one named in the insufficient_scope challenge.
+ */
+export function requireAnyScope(ctx, canonicalUri, ...alternatives) {
+    const held = alternatives.filter((s) => ctx.scopes.has(s));
+    if (held.length === 0)
+        throw insufficientScope(alternatives.slice(0, 1), protectedResourceMetadataUrl(canonicalUri));
+    // One held alternative that is non-privileged, or that a role permits, suffices.
+    const permitted = permissionsOf(ctx.roles);
+    if (held.some((s) => !PRIVILEGED_SCOPES.includes(s) || permitted.has(s)))
         return;
-    throw insufficientScope(scopes, protectedResourceMetadataUrl(canonicalUri));
+    // A role DOES grant one of the unheld alternatives: re-authorizing for that
+    // scope is the fix, so say so with a scope challenge, not a role 403.
+    const reachable = alternatives.find((s) => !ctx.scopes.has(s) && permitted.has(s));
+    if (reachable)
+        throw insufficientScope([reachable], protectedResourceMetadataUrl(canonicalUri));
+    throw forbidden(held);
+}
+/**
+ * The one role check: a privileged scope is honoured only when one of the
+ * caller's roles grants it as a permission. This is authorization, not
+ * delegation, so the 403 carries no scope challenge — a client re-authorizing
+ * for more scopes can't fix it; an operator must grant a role.
+ */
+function requirePermission(ctx, scopes) {
+    const permitted = permissionsOf(ctx.roles);
+    const missing = scopes.filter((s) => PRIVILEGED_SCOPES.includes(s) && !permitted.has(s));
+    if (missing.length > 0)
+        throw forbidden(missing);
+}
+function forbidden(permissions) {
+    const grantedBy = ROLE_NAMES.filter((r) => permissions.some((p) => ROLE_PERMISSIONS[r].includes(p)));
+    return new McpError(403, `Forbidden: ${permissions.join(" ")} requires a role that grants it (${grantedBy.join(" or ")}); ` +
+        "the token's scope alone is not enough. An operator grants roles (self-hosted: " +
+        "`wardby auth user grant --subject <subject> --role <role>`; delegating: AUTH_ROLE_CLAIM/AUTH_ROLE_MAP).");
 }
-export { McpError };
+export { McpError, insufficientScope };

package/dist/mcp/auth/self-hosted/browser.js

@@ -1,6 +1,7 @@
 import { randomUUID, randomBytes } from "node:crypto";
 import { PostgresRateLimiter, RateLimitError } from "./rate-limit.js";
 import { logger } from "../../../core/logger.js";
+import { PAGE_STYLE } from "../../shared/page-style.js";
 const authLog = logger.child({ module: "self-hosted-oauth" });
 const paths = new Set([
     "/login",
@@ -29,12 +30,21 @@ const FORM_SCRIPT = `document.addEventListener('submit', async (event) => {
 });`;
 function html(res, content) {
     const nonce = randomBytes(18).toString("base64");
-    res.setHeader("content-security-policy", `default-src 'none'; script-src 'nonce-${nonce}'; connect-src 'self'; form-action 'self'; frame-ancestors 'none'; base-uri 'none'`);
+    res.setHeader("content-security-policy", 
+    // style-src reuses the same per-request nonce as script-src rather than
+    // 'unsafe-inline', so the one inline <style> stays as tightly scoped as
+    // the inline <script>.
+    `default-src 'none'; script-src 'nonce-${nonce}'; style-src 'nonce-${nonce}'; connect-src 'self'; form-action 'self'; frame-ancestors 'none'; base-uri 'none'`);
     res
         .writeHead(200, { "content-type": "text/html; charset=utf-8" })
-        .end('<!doctype html><html lang="en"><meta charset="utf-8"><title>wardby authorization</title><body>' +
+        .end('<!doctype html><html lang="en"><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">' +
+        '<title>wardby authorization</title><style nonce="' +
+        nonce +
+        '">' +
+        PAGE_STYLE +
+        '</style><body><div class="card"><div class="kicker">wardby</div>' +
         content +
-        '<p id="auth-error" role="alert"></p><noscript>JavaScript is required for secure form submission.</noscript><script nonce="' +
+        '<p id="auth-error" role="alert"></p></div><noscript>JavaScript is required for secure form submission.</noscript><script nonce="' +
         nonce +
         '">' +
         FORM_SCRIPT +
@@ -155,7 +165,7 @@ export function browserHandler(provider) {
                 html(res, '<h1>Sign in to wardby</h1><form method="post" action="/login">' +
                     hidden("interaction", interaction) +
                     hidden("csrf", challenge) +
-                    '<label>Login key <input type="password" name="login_key" required autocomplete="off"></label><button>Sign in</button></form>');
+                    '<label>Login key<input type="password" name="login_key" required autocomplete="off"></label><button>Sign in</button></form>');
                 return true;
             }
             if (req.method === "POST" &&
@@ -187,18 +197,19 @@ export function browserHandler(provider) {
             }
             if (req.method === "GET" && url.pathname === "/consent") {
                 const id = url.searchParams.get("interaction") ?? "";
-                const { interaction, challenge } = await provider.consentPage(cookies.get(sessionName) ?? "", id);
+                const { interaction, challenge, scopes } = await provider.consentPage(cookies.get(sessionName) ?? "", id);
                 const name = interaction.client.metadata.client_name;
                 html(res, "<h1>Authorize " +
                     escape(name) +
                     "</h1><p>Resource: " +
                     escape(interaction.resource) +
                     "</p><p>Scopes: " +
-                    escape(interaction.requestedScope) +
+                    escape(scopes.length ? scopes.join(" ") : "(none)") +
                     '</p><form action="/consent" method="post">' +
                     hidden("interaction", id) +
                     hidden("csrf", challenge) +
-                    '<button name="decision" value="approve">Approve</button><button name="decision" value="deny">Deny</button></form>');
+                    '<div class="actions"><button name="decision" value="approve">Approve</button>' +
+                    '<button name="decision" value="deny">Deny</button></div></form>');
                 return true;
             }
             if (req.method === "POST" && url.pathname === "/consent") {
@@ -210,7 +221,10 @@ export function browserHandler(provider) {
             if (req.method === "GET" && url.pathname === "/logout") {
                 const session = await provider.sessions.get(cookies.get(sessionName) ?? "");
                 const challenge = await provider.sessions.challenge("logout", session.sessionId, "logout");
-                html(res, '<form action="/logout" method="post">' + hidden("csrf", challenge) + "<button>Sign out</button></form>");
+                html(res, "<h1>Sign out</h1>" +
+                    '<form action="/logout" method="post">' +
+                    hidden("csrf", challenge) +
+                    "<button>Sign out</button></form>");
                 return true;
             }
             if (req.method === "POST" && url.pathname === "/logout") {

package/dist/mcp/auth/self-hosted/cli.d.ts

@@ -1,2 +1,2 @@
-import type { PrismaClient } from "@prisma/client";
+import type { PrismaClient } from "#prisma";
 export declare function authCommand(args: string[], db: PrismaClient, hashKey: string, output?: (value: string) => void): Promise<void>;

package/dist/mcp/auth/self-hosted/cli.js

@@ -1,39 +1,73 @@
 import { parseArgs } from "node:util";
 import { IdentityService } from "./credentials.js";
+const USAGE = "Use auth user create --subject <s> [--role <role>]... | user list | " +
+    "user grant --subject <s> [--role <role>]... [--revoke-role <role>]... | user disable --subject <s> | " +
+    "key create|list --subject <s> | key revoke <key-id>.";
+/** The flags each command accepts. Anything else is rejected, never silently ignored. */
+const COMMANDS = {
+    "user create": ["subject", "role"],
+    "user list": [],
+    "user grant": ["subject", "role", "revoke-role"],
+    "user disable": ["subject"],
+    "key create": ["subject"],
+    "key list": ["subject"],
+};
+const FLAG_OPTIONS = {
+    subject: { type: "string" },
+    role: { type: "string", multiple: true },
+    "revoke-role": { type: "string", multiple: true },
+};
 export async function authCommand(args, db, hashKey, output = console.log) {
     const [kind, action, ...rest] = args;
     const service = new IdentityService(db, hashKey);
     if (hashKey.toLowerCase() === process.env.SECRET_APP_KEY?.toLowerCase() ||
         hashKey.toLowerCase() === process.env.AUTH_SIGNING_KEY?.toLowerCase())
         throw new Error("Authentication keys must be independent.");
-    if (kind === "key" && action === "revoke" && rest.length === 1) {
+    const command = `${kind} ${action}`;
+    if (command === "key revoke") {
+        if (rest.length !== 1 || rest[0].startsWith("-"))
+            throw new Error("Use auth key revoke <key-id> (no flags).");
         await service.revokeKey(rest[0]);
         output("Key, sessions, and grants revoked.");
         return;
     }
-    const { values } = parseArgs({ args: rest, options: { subject: { type: "string" } } });
-    if (kind === "user" && action === "list") {
+    const allowed = COMMANDS[command];
+    if (!allowed)
+        throw new Error(USAGE);
+    // strict parsing throws on any flag not declared for THIS command, so a
+    // flag another command takes (e.g. `key create --role admin`) is an error.
+    const { values } = parseArgs({
+        args: rest,
+        strict: true,
+        allowPositionals: false,
+        options: Object.fromEntries(allowed.map((flag) => [flag, FLAG_OPTIONS[flag]])),
+    });
+    if (command === "user list") {
         output(JSON.stringify(await service.listUsers(), null, 2));
         return;
     }
     if (!values.subject)
-        throw new Error("auth requires --subject (except user list and key revoke <key-id>).");
-    if (kind === "user" && action === "create") {
-        output(JSON.stringify(await service.createUser(values.subject)));
+        throw new Error(`auth ${command} requires --subject.`);
+    if (command === "user create") {
+        output(JSON.stringify(await service.createUser(values.subject, values.role ?? [])));
         return;
     }
-    if (kind === "user" && action === "disable") {
+    if (command === "user grant") {
+        const add = values.role ?? [];
+        const remove = values["revoke-role"] ?? [];
+        if (add.length + remove.length === 0)
+            throw new Error("auth user grant requires --role <role> and/or --revoke-role <role> (each repeatable).");
+        output(JSON.stringify(await service.changeRoles(values.subject, add, remove)));
+        return;
+    }
+    if (command === "user disable") {
         await service.disableUser(values.subject);
         output("User disabled; credentials, sessions, and grants revoked.");
         return;
     }
-    if (kind === "key" && action === "create") {
+    if (command === "key create") {
         output(await service.createKey(values.subject));
         return;
     }
-    if (kind === "key" && action === "list") {
-        output(JSON.stringify(await service.listKeys(values.subject), null, 2));
-        return;
-    }
-    throw new Error("Use auth user create|list|disable or auth key create|list|revoke.");
+    output(JSON.stringify(await service.listKeys(values.subject), null, 2));
 }