@whooshbang/sdk 1.0.0-rc.31 → 1.0.0-rc.32
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +16 -8
- package/dist/browser-confirmation.d.ts +1 -1
- package/dist/browser-confirmation.js +20 -20
- package/dist/browser-confirmation.js.map +1 -1
- package/dist/cli/arguments.js +1 -1
- package/dist/cli/arguments.js.map +1 -1
- package/dist/cli/browser-confirmation.d.ts +2 -2
- package/dist/cli/browser-confirmation.js +2 -2
- package/dist/cli/browser-confirmation.js.map +1 -1
- package/dist/cli/commands.js +40 -36
- package/dist/cli/commands.js.map +1 -1
- package/dist/cli/config.d.ts +1 -1
- package/dist/cli/config.js +1 -1
- package/dist/cli/main.js +5 -5
- package/dist/cli/selectors.js +6 -6
- package/dist/cli/selectors.js.map +1 -1
- package/dist/cli/session.d.ts +3 -3
- package/dist/cli/session.js +3 -3
- package/dist/client.d.ts +10 -10
- package/dist/client.js +32 -32
- package/dist/client.js.map +1 -1
- package/dist/errors.d.ts +2 -2
- package/dist/errors.js +2 -2
- package/dist/index.d.ts +1 -1
- package/package.json +2 -2
package/README.md
CHANGED
|
@@ -286,12 +286,12 @@ evaluates DOM globals. These subpaths are published in
|
|
|
286
286
|
canonical red fallback while leaving every configured customer name, logo, and
|
|
287
287
|
accent authoritative.
|
|
288
288
|
|
|
289
|
-
`@whooshbang/sdk@1.0.0-rc.
|
|
289
|
+
`@whooshbang/sdk@1.0.0-rc.32` carries contracts `1.0.0-rc.23`: a project
|
|
290
290
|
credential holding the opt-in `projects:read` / `projects:write` scopes can now
|
|
291
291
|
read and write its own project's recipient configuration, an origin may be
|
|
292
292
|
written in any spelling that means the same origin, and
|
|
293
293
|
`WhooshBangProblemError.pendingInvitation` names the rollout gate an uninvited
|
|
294
|
-
|
|
294
|
+
organization is waiting on.
|
|
295
295
|
|
|
296
296
|
## Machine clients
|
|
297
297
|
|
|
@@ -368,11 +368,11 @@ code throws from that same method.
|
|
|
368
368
|
| `cancellation_too_late` | Outcome | The race is inherent: a correct caller cancels and learns it was too late. `cancelSubscriptionLink` receives it as a problem and returns it; `cancelMessage` receives the same fact as `cancellation_effective: false` on a success, as the contract documents, so the problem code arriving there is outside the documented response and throws. |
|
|
369
369
|
| `authentication_required` | Exception | No credential reached the service. The integration's configuration is wrong. |
|
|
370
370
|
| `credential_invalid` | Exception | The credential is malformed, revoked, or past its rotation overlap. Only a replacement credential fixes it. |
|
|
371
|
-
| `scope_forbidden` | Exception | The credential lacks a scope, or the
|
|
371
|
+
| `scope_forbidden` | Exception | The credential lacks a scope, or the organization is not yet invited (`pendingInvitation`). No branch at the call site grants either. |
|
|
372
372
|
| `environment_mismatch` | Exception | A credential reached across the test/live boundary. |
|
|
373
373
|
| `idempotency_key_required` | Exception | The client sends a key on every side effect, so receiving this means the request the service saw is not the one the client sent. |
|
|
374
374
|
| `idempotency_conflict` | Exception | Same key, different body — including the stale row-version, claimed-identity, revoked-client, and acknowledgement cursor or disposition refusals that reuse the code. The fix is a new request, never a retry. |
|
|
375
|
-
| `project_slug_conflict` | Exception | The slug is already taken in this
|
|
375
|
+
| `project_slug_conflict` | Exception | The slug is already taken in this organization. Refused input, handled as `request_invalid` is: choose another. |
|
|
376
376
|
| `request_invalid` | Exception | The request broke a documented bound. `fieldErrors` names each field. |
|
|
377
377
|
| `replay_unavailable` | Exception | A customer-event replay was refused by the attempt's state. The caller waits for a terminal attempt or accepts that an aged-out payload is gone; there is nothing to branch on. |
|
|
378
378
|
| `subscriber_unbound` | Outcome | On a send, the person's channel state: they revoked their channel or never finished subscribing, so the branch is to invite them again. The service uses the same code when a `connection_id` does not route to the subscriber or the connection behind them was archived, which an invitation does not fix; `problem.diagnostic_id` tells support which. `createMessage` and `createMessageInEnvironment` return it. `createMachineClient` still throws it: a machine client for an unbound subscriber is setup that is wrong. |
|
|
@@ -388,10 +388,10 @@ code throws from that same method.
|
|
|
388
388
|
| `recipient_group_archived` | Exception | Archive is terminal. The caller needs a different group. |
|
|
389
389
|
| `resource_not_found` | Exception | The identifier is wrong or outside the credential's reach; absent and out-of-scope look identical on purpose. |
|
|
390
390
|
| `resource_expired` | Exception | Published but not produced by the service today: a resource's expiry reaches the caller as its own `status` or `state`, which is already a value. The recipient-session element treats it, with `recipient_capability_invalid`, as a session that has ended. |
|
|
391
|
-
| `
|
|
391
|
+
| `credential_organization_mismatch` | Exception | An organization credential reached a project outside its organization. |
|
|
392
392
|
| `endpoint_rotation_conflict` | Exception | A prior overlap is still active. The caller waits for `retryAt`, as for rate limiting. |
|
|
393
393
|
| `rate_limited` | Exception | Wait until `retryAt`. The caller's response is to wait, not to branch. |
|
|
394
|
-
| `privacy_operation_in_progress` | Exception | Export, erasure, or
|
|
394
|
+
| `privacy_operation_in_progress` | Exception | Export, erasure, or organization closure still has in-flight work to drain or a provider cleanup to retry. Wait until `retryAt`, then repeat the same operation. |
|
|
395
395
|
| `provider_retryable` | Exception | The provider failed before acceptance. The service retries where a retry is scheduled; the caller waits. |
|
|
396
396
|
| `provider_terminal` | Exception | The provider refused permanently. Fix the binding or the content and send a new message. |
|
|
397
397
|
| `provider_outcome_unknown` | Exception | The provider may already have acted. Read the resource state before deciding anything. |
|
|
@@ -414,7 +414,7 @@ occurred is data on both, not a class of its own: an abort, a deadline, or a
|
|
|
414
414
|
network failure changes nothing about whether the side effect landed. The
|
|
415
415
|
client never resolves an unknown outcome on your behalf.
|
|
416
416
|
|
|
417
|
-
Use a verified human-session token with the same client to call `
|
|
417
|
+
Use a verified human-session token with the same client to call `getOrganization`,
|
|
418
418
|
`listProjects`, `createProject`, `getProject`, `updateProject`, `listApiCredentials`,
|
|
419
419
|
`createApiCredential`, `rotateApiCredential`, and `revokeApiCredential`.
|
|
420
420
|
Credential create and rotate calls intentionally have no response-replay key:
|
|
@@ -468,7 +468,15 @@ node packages/sdk-js/examples/send-interactive-message.mjs
|
|
|
468
468
|
|
|
469
469
|
## Compatibility
|
|
470
470
|
|
|
471
|
+
The organization rename in SDK `1.0.0-rc.32` is a clean cut. Update old
|
|
472
|
+
`getAccount` and credential lifecycle calls to their organization equivalents,
|
|
473
|
+
response fields to `organization_id`, and CLI tenant options to `--organization`.
|
|
474
|
+
An older SDK can reject a response before application code reads it, including
|
|
475
|
+
project-scoped calls whose caller ignores the tenant field. Use the matching
|
|
476
|
+
contracts and mock release and follow the
|
|
477
|
+
[upgrade guide](../../docs/onboarding/organization-upgrade.mdx).
|
|
478
|
+
|
|
471
479
|
The exact runtime dependency is
|
|
472
|
-
`@whooshbang/contracts@1.0.0-rc.
|
|
480
|
+
`@whooshbang/contracts@1.0.0-rc.23`. Successful payloads are
|
|
473
481
|
validated with its packaged validators, while additive response fields remain
|
|
474
482
|
available on the returned object.
|
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
import { validateProblem,
|
|
1
|
+
import { validateProblem, validateCreateOrganizationCredentialRequest, validateCreateApiCredentialRequest, validateRotateOrganizationCredentialRequest, validateRotateApiCredentialRequest, validateOrganizationCredentialCollection, validateApiCredentialCollection, validateOrganizationCredentialSecretReveal, validateApiCredentialSecretReveal, validateOrganizationCredentialRotation, validateApiCredentialRotation, validateOrganizationCredential, validateApiCredential, } from "@whooshbang/contracts";
|
|
2
2
|
function encoded(bytes) {
|
|
3
3
|
return btoa(Array.from(new Uint8Array(bytes), (byte) => String.fromCharCode(byte)).join(""))
|
|
4
4
|
.replaceAll("+", "-")
|
|
@@ -31,10 +31,10 @@ export function parseCredentialConfirmation(value) {
|
|
|
31
31
|
!Number.isFinite(parsed.expiresAt) ||
|
|
32
32
|
parsed.expiresAt <= Date.now() ||
|
|
33
33
|
parsed.expiresAt > Date.now() + 300_000 ||
|
|
34
|
-
typeof parsed.
|
|
35
|
-
parsed.
|
|
34
|
+
typeof parsed.organizationId !== "string" ||
|
|
35
|
+
parsed.organizationId.length > 100 ||
|
|
36
36
|
!["GET", "POST"].includes(parsed.method) ||
|
|
37
|
-
!/^\/v1\/(?:
|
|
37
|
+
!/^\/v1\/(?:organization|projects\/[A-Za-z0-9_-]+\/environments\/[A-Za-z0-9_-]+)\/credentials(?:\/[A-Za-z0-9_-]+\/(?:rotate|revoke))?$/u.test(parsed.path) ||
|
|
38
38
|
(parsed.method === "GET" &&
|
|
39
39
|
(parsed.path.endsWith("/rotate") ||
|
|
40
40
|
parsed.path.endsWith("/revoke") ||
|
|
@@ -46,20 +46,20 @@ export function parseCredentialConfirmation(value) {
|
|
|
46
46
|
parsed.publicKey.d !== undefined) {
|
|
47
47
|
throw new Error("Invalid or expired credential confirmation.");
|
|
48
48
|
}
|
|
49
|
-
const
|
|
49
|
+
const organization = parsed.path.startsWith("/v1/organization/");
|
|
50
50
|
const validBody = parsed.method === "GET" || parsed.path.endsWith("/revoke")
|
|
51
51
|
? parsed.body === undefined
|
|
52
52
|
: parsed.path.endsWith("/rotate")
|
|
53
|
-
?
|
|
54
|
-
?
|
|
53
|
+
? organization
|
|
54
|
+
? validateRotateOrganizationCredentialRequest(parsed.body)
|
|
55
55
|
: validateRotateApiCredentialRequest(parsed.body)
|
|
56
|
-
:
|
|
57
|
-
?
|
|
56
|
+
: organization
|
|
57
|
+
? validateCreateOrganizationCredentialRequest(parsed.body)
|
|
58
58
|
: validateCreateApiCredentialRequest(parsed.body);
|
|
59
59
|
if (!validBody ||
|
|
60
60
|
Object.keys(parsed).some((key) => ![
|
|
61
61
|
"apiOrigin",
|
|
62
|
-
"
|
|
62
|
+
"organizationId",
|
|
63
63
|
"method",
|
|
64
64
|
"path",
|
|
65
65
|
"body",
|
|
@@ -101,7 +101,7 @@ export async function decryptCredentialResult(privateKey, state, encrypted) {
|
|
|
101
101
|
export async function credentialConfirmationDigest(request) {
|
|
102
102
|
return encoded(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(JSON.stringify([
|
|
103
103
|
request.apiOrigin,
|
|
104
|
-
request.
|
|
104
|
+
request.organizationId,
|
|
105
105
|
request.method,
|
|
106
106
|
request.path,
|
|
107
107
|
request.body ?? null,
|
|
@@ -116,25 +116,25 @@ export function validConfirmedCredentialResult(request, value) {
|
|
|
116
116
|
return value.status === 403;
|
|
117
117
|
if (value.status >= 400)
|
|
118
118
|
return validateProblem(value.body) && value.body.status === value.status;
|
|
119
|
-
const
|
|
119
|
+
const organization = request.path.startsWith("/v1/organization/");
|
|
120
120
|
if (request.method === "GET")
|
|
121
121
|
return (value.status === 200 &&
|
|
122
|
-
(
|
|
123
|
-
?
|
|
122
|
+
(organization
|
|
123
|
+
? validateOrganizationCredentialCollection(value.body)
|
|
124
124
|
: validateApiCredentialCollection(value.body)));
|
|
125
125
|
if (request.path.endsWith("/revoke"))
|
|
126
126
|
return (value.status === 200 &&
|
|
127
|
-
(
|
|
128
|
-
?
|
|
127
|
+
(organization
|
|
128
|
+
? validateOrganizationCredential(value.body)
|
|
129
129
|
: validateApiCredential(value.body)));
|
|
130
130
|
if (request.path.endsWith("/rotate"))
|
|
131
131
|
return (value.status === 201 &&
|
|
132
|
-
(
|
|
133
|
-
?
|
|
132
|
+
(organization
|
|
133
|
+
? validateOrganizationCredentialRotation(value.body)
|
|
134
134
|
: validateApiCredentialRotation(value.body)));
|
|
135
135
|
return (value.status === 201 &&
|
|
136
|
-
(
|
|
137
|
-
?
|
|
136
|
+
(organization
|
|
137
|
+
? validateOrganizationCredentialSecretReveal(value.body)
|
|
138
138
|
: validateApiCredentialSecretReveal(value.body)));
|
|
139
139
|
}
|
|
140
140
|
//# sourceMappingURL=browser-confirmation.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"browser-confirmation.js","sourceRoot":"","sources":["../src/browser-confirmation.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,
|
|
1
|
+
{"version":3,"file":"browser-confirmation.js","sourceRoot":"","sources":["../src/browser-confirmation.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,2CAA2C,EAC3C,kCAAkC,EAClC,2CAA2C,EAC3C,kCAAkC,EAClC,wCAAwC,EACxC,+BAA+B,EAC/B,0CAA0C,EAC1C,iCAAiC,EACjC,sCAAsC,EACtC,6BAA6B,EAC7B,8BAA8B,EAC9B,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAgB/B,SAAS,OAAO,CAAC,KAAkB;IACjC,OAAO,IAAI,CACT,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CACzE,EAAE,CACH,CACF;SACE,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC;SACpB,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC;SACpB,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AACzB,CAAC;AACD,SAAS,OAAO,CAAC,KAAa;IAC5B,OAAO,UAAU,CAAC,IAAI,CACpB,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,EACrD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CACvB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,KAAa;IAEb,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAA2B,CAAC;IAC3D,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACtC,IACE,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,SAAS;QAC/B,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,QAAQ;QACZ,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ;YACxB,CAAC,CACC,GAAG,CAAC,QAAQ,KAAK,OAAO;gBACxB,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAClD,CAAC;QAEJ,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACzC,IACE,QAAQ,CAAC,QAAQ,KAAK,OAAO;QAC7B,QAAQ,CAAC,QAAQ,KAAK,WAAW;QACjC,CAAC,QAAQ,CAAC,IAAI;QACd,QAAQ,CAAC,QAAQ,KAAK,WAAW;QACjC,QAAQ,CAAC,QAAQ;QACjB,QAAQ,CAAC,QAAQ;QACjB,QAAQ,CAAC,MAAM;QACf,QAAQ,CAAC,IAAI;QACb,CAAC,0BAA0B,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;QAC9C,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC;QAClC,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE;QAC9B,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;QACvC,OAAO,MAAM,CAAC,cAAc,KAAK,QAAQ;QACzC,MAAM,CAAC,cAAc,CAAC,MAAM,GAAG,GAAG;QAClC,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;QACxC,CAAC,uIAAuI,CAAC,IAAI,CAC3I,MAAM,CAAC,IAAI,CACZ;QACD,CAAC,MAAM,CAAC,MAAM,KAAK,KAAK;YACtB,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAC9B,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAC/B,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;QAC/B,MAAM,CAAC,SAAS,CAAC,GAAG,KAAK,KAAK;QAC9B,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,MAAM;QAC7B,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,QAAQ;QACtC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,KAAK,GAAG;QACjC,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,SAAS,EAChC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC;IACjE,MAAM,SAAS,GACb,MAAM,CAAC,MAAM,KAAK,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;QACxD,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS;QAC3B,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;YAC/B,CAAC,CAAC,YAAY;gBACZ,CAAC,CAAC,2CAA2C,CAAC,MAAM,CAAC,IAAI,CAAC;gBAC1D,CAAC,CAAC,kCAAkC,CAAC,MAAM,CAAC,IAAI,CAAC;YACnD,CAAC,CAAC,YAAY;gBACZ,CAAC,CAAC,2CAA2C,CAAC,MAAM,CAAC,IAAI,CAAC;gBAC1D,CAAC,CAAC,kCAAkC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1D,IACE,CAAC,SAAS;QACV,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CACtB,CAAC,GAAG,EAAE,EAAE,CACN,CAAC;YACC,WAAW;YACX,gBAAgB;YAChB,QAAQ;YACR,MAAM;YACN,MAAM;YACN,WAAW;YACX,aAAa;YACb,OAAO;YACP,WAAW;SACZ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAClB;QAED,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,SAAqB,EACrB,KAAa,EACb,MAAe;IAEf,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,SAAS,EACT,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,EACrC,KAAK,EACL,CAAC,SAAS,CAAC,CACZ,CAAC;IACF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,WAAW,CACzC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAChC,IAAI,EACJ,CAAC,SAAS,CAAC,CACZ,CAAC;IACF,MAAM,EAAE,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IACtD,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAC5C,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,cAAc,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EACxE,GAAG,EACH,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CACjD,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CACzC,UAAU,EACV,GAAG,EACH,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,CAC1C,CAAC;IACF,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,UAAqB,EACrB,KAAa,EACb,SAAiB;IAEjB,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,CAAC,OAAO,EAAE,EAAE,EAAE,UAAU,CAAC,GAAG,KAAK,CAAC;IACxC,IACE,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,CAAC,OAAO;QACR,CAAC,EAAE;QACH,CAAC,UAAU;QACX,SAAS,CAAC,MAAM,GAAG,MAAM;QAEzB,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CACxC,UAAU,EACV,UAAU,EACV,OAAO,CAAC,OAAO,CAAC,CACjB,CAAC;IACF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE;QACzE,SAAS;KACV,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,KAAK,CACf,IAAI,WAAW,EAAE,CAAC,MAAM,CACtB,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CACzB;QACE,IAAI,EAAE,SAAS;QACf,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC;QACf,cAAc,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC;KAChD,EACD,GAAG,EACH,OAAO,CAAC,UAAU,CAAC,CACpB,CACF,CACS,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,OAA+B;IAE/B,OAAO,OAAO,CACZ,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CACxB,SAAS,EACT,IAAI,WAAW,EAAE,CAAC,MAAM,CACtB,IAAI,CAAC,SAAS,CAAC;QACb,OAAO,CAAC,SAAS;QACjB,OAAO,CAAC,cAAc;QACtB,OAAO,CAAC,MAAM;QACd,OAAO,CAAC,IAAI;QACZ,OAAO,CAAC,IAAI,IAAI,IAAI;QACpB,OAAO,CAAC,SAAS,CAAC,CAAC;QACnB,OAAO,CAAC,WAAW;QACnB,OAAO,CAAC,KAAK;QACb,OAAO,CAAC,SAAS;KAClB,CAAC,CACH,CACF,CACF,CAAC;AACJ,CAAC;AAQD,MAAM,UAAU,8BAA8B,CAC5C,OAA+B,EAC/B,KAAgC;IAEhC,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC,MAAM,KAAK,GAAG,CAAC;IACvD,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG;QACrB,OAAO,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC;IAC3E,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC;IAClE,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK;QAC1B,OAAO,CACL,KAAK,CAAC,MAAM,KAAK,GAAG;YACpB,CAAC,YAAY;gBACX,CAAC,CAAC,wCAAwC,CAAC,KAAK,CAAC,IAAI,CAAC;gBACtD,CAAC,CAAC,+BAA+B,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CACjD,CAAC;IACJ,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;QAClC,OAAO,CACL,KAAK,CAAC,MAAM,KAAK,GAAG;YACpB,CAAC,YAAY;gBACX,CAAC,CAAC,8BAA8B,CAAC,KAAK,CAAC,IAAI,CAAC;gBAC5C,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CACvC,CAAC;IACJ,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;QAClC,OAAO,CACL,KAAK,CAAC,MAAM,KAAK,GAAG;YACpB,CAAC,YAAY;gBACX,CAAC,CAAC,sCAAsC,CAAC,KAAK,CAAC,IAAI,CAAC;gBACpD,CAAC,CAAC,6BAA6B,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAC/C,CAAC;IACJ,OAAO,CACL,KAAK,CAAC,MAAM,KAAK,GAAG;QACpB,CAAC,YAAY;YACX,CAAC,CAAC,0CAA0C,CAAC,KAAK,CAAC,IAAI,CAAC;YACxD,CAAC,CAAC,iCAAiC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CACnD,CAAC;AACJ,CAAC"}
|
package/dist/cli/arguments.js
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"arguments.js","sourceRoot":"","sources":["../../src/cli/arguments.ts"],"names":[],"mappings":"AAkBA,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC;IACvB,
|
|
1
|
+
{"version":3,"file":"arguments.js","sourceRoot":"","sources":["../../src/cli/arguments.ts"],"names":[],"mappings":"AAkBA,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC;IACvB,cAAc;IACd,MAAM;IACN,MAAM;IACN,SAAS;IACT,kBAAkB;IAClB,KAAK;IACL,WAAW;IACX,eAAe;IACf,UAAU;IACV,QAAQ;IACR,WAAW;IACX,MAAM;IACN,SAAS;IACT,KAAK;CACN,CAAC,CAAC;AAEH;;;;;;;;;GASG;AACH,MAAM,OAAO,GAAgC,IAAI,GAAG,CAAC;IACnD,CAAC,GAAG,EAAE,YAAY,CAAC;IACnB,CAAC,GAAG,EAAE,aAAa,CAAC;IACpB,CAAC,KAAK,EAAE,aAAa,CAAC;IACtB,CAAC,GAAG,EAAE,KAAK,CAAC;IACZ,CAAC,GAAG,EAAE,MAAM,CAAC;IACb,CAAC,GAAG,EAAE,MAAM,CAAC;IACb,CAAC,GAAG,EAAE,SAAS,CAAC;IAChB,CAAC,GAAG,EAAE,YAAY,CAAC;IACnB,CAAC,GAAG,EAAE,MAAM,CAAC;IACb,CAAC,GAAG,EAAE,MAAM,CAAC;IACb,CAAC,GAAG,EAAE,KAAK,CAAC;CACb,CAAC,CAAC;AAEH,SAAS,SAAS,CAAC,IAAY;IAC7B,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAuB;IACpD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAoB,CAAC;IAE7C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAW,CAAC;QACpC,yEAAyE;QACzE,0EAA0E;QAC1E,mBAAmB;QACnB,MAAM,KAAK,GACT,KAAK,CAAC,MAAM,GAAG,CAAC;YAChB,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;YACrB,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;YACvB,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvB,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YACtC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAClB,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QACrE,IAAI,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;YAClB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YACrC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACzB,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;YAC3D,SAAS;QACX,CAAC;QACD,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACnB,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAC7B,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/C,oEAAoE;YACpE,yEAAyE;YACzE,aAAa;YACb,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACnB,SAAS;QACX,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACxB,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;QAC1D,KAAK,IAAI,CAAC,CAAC;IACb,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAChD,CAAC;AAED,MAAM,OAAO,UAAW,SAAQ,KAAK;IACnC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;IAC3B,CAAC;CACF;AAED,MAAM,UAAU,QAAQ,CACtB,MAAuB,EACvB,IAAY,EACZ,IAAY;IAEZ,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,UAAU,CAAC,KAAK,IAAI,iBAAiB,IAAI,GAAG,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}
|
|
@@ -4,14 +4,14 @@ import { type ConfirmedCredentialResult, type CredentialConfirmation } from "../
|
|
|
4
4
|
* the callback; the ephemeral private key protects the one-time result. Neither
|
|
5
5
|
* is persisted, and other web origins cannot read the dashboard URL fragment. */
|
|
6
6
|
export declare function confirmCredentialOperation(options: {
|
|
7
|
-
request: Pick<CredentialConfirmation, "apiOrigin" | "
|
|
7
|
+
request: Pick<CredentialConfirmation, "apiOrigin" | "organizationId" | "method" | "path" | "body">;
|
|
8
8
|
confirmationUrl: string;
|
|
9
9
|
openUrl: (url: string) => Promise<void>;
|
|
10
10
|
timeoutMs?: number;
|
|
11
11
|
}): Promise<ConfirmedCredentialResult>;
|
|
12
12
|
export declare function credentialConfirmationClient(options: {
|
|
13
13
|
origin: string;
|
|
14
|
-
|
|
14
|
+
organization: () => Promise<{
|
|
15
15
|
id: string;
|
|
16
16
|
}>;
|
|
17
17
|
openUrl: (url: string) => Promise<void>;
|
|
@@ -110,7 +110,7 @@ export function credentialConfirmationClient(options) {
|
|
|
110
110
|
credential: "unused",
|
|
111
111
|
fetch: async (input, init) => {
|
|
112
112
|
const request = new Request(input, init);
|
|
113
|
-
const
|
|
113
|
+
const organization = await options.organization();
|
|
114
114
|
const metadata = await fetch(new URL("/cli/credentials", options.origin));
|
|
115
115
|
if (!metadata.ok)
|
|
116
116
|
throw new Error("Browser credential confirmation is unavailable.");
|
|
@@ -119,7 +119,7 @@ export function credentialConfirmationClient(options) {
|
|
|
119
119
|
const result = await confirmCredentialOperation({
|
|
120
120
|
request: {
|
|
121
121
|
apiOrigin: options.origin,
|
|
122
|
-
|
|
122
|
+
organizationId: organization.id,
|
|
123
123
|
method: request.method,
|
|
124
124
|
path: new URL(request.url).pathname,
|
|
125
125
|
...(raw ? { body: JSON.parse(raw) } : {}),
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"browser-confirmation.js","sourceRoot":"","sources":["../../src/cli/browser-confirmation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,8BAA8B,GAG/B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzC;;iFAEiF;AACjF,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,OAQhD;IACC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAC7C,IACE,GAAG,CAAC,QAAQ,KAAK,QAAQ;QACzB,CAAC,CACC,GAAG,CAAC,QAAQ,KAAK,OAAO;YACxB,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAClD;QAED,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,WAAW,CAC1C;QACE,IAAI,EAAE,UAAU;QAChB,aAAa,EAAE,IAAI;QACnB,cAAc,EAAE,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QACzC,IAAI,EAAE,SAAS;KAChB,EACD,IAAI,EACJ,CAAC,SAAS,EAAE,SAAS,CAAC,CACvB,CAAC;IACF,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;IAC9B,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,oBAAqB,MAAM,CAAC,OAAO,EAAkB,CAAC,IAAI,EAAE,CAAC;IAC5E,MAAM,UAAU,GAA2B;QACzC,GAAG,OAAO,CAAC,OAAO;QAClB,SAAS,EAAE,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC;QAC/D,KAAK,EAAE,WAAW,EAAE;QACpB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC;QACtD,WAAW,EAAE,GAAG,MAAM,WAAW;KAClC,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,4BAA4B,CAAC,UAAU,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACjD,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,KAAgD,CAAC;IACrD,MAAM,SAAS,GAAG,IAAI,OAAO,CAC3B,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAClB,KAAK,GAAG,UAAU,CAChB,GAAG,EAAE,CACH,MAAM,CACJ,IAAI,KAAK,CACP,yFAAyF,CAC1F,CACF,EACH,OAAO,CAAC,SAAS,IAAI,OAAO,CAC7B,CAAC;QACF,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;YACzC,QAAQ,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;YAChD,QAAQ,CAAC,SAAS,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC;YACrD,QAAQ,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;YACxD,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,KAAK,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;gBAClD,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;gBAC9B,OAAO;YACT,CAAC;YACD,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,GAAG,KAAK,WAAW,EAAE,CAAC;gBAC5D,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAC;gBAC/D,QAAQ,CAAC,SAAS,CAChB,yBAAyB,EACzB,yCAAyC,KAAK,gEAAgE,CAC/G,CAAC;gBACF,QAAQ,CAAC,GAAG,CACV,kKAAkK,KAAK,6iBAA6iB,CACrtB,CAAC;gBACF,OAAO;YACT,CAAC;YACD,IACE,OAAO,CAAC,MAAM,KAAK,MAAM;gBACzB,OAAO,CAAC,GAAG,KAAK,WAAW;gBAC3B,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,MAAM;gBACjC,SAAS,EACT,CAAC;gBACD,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;gBAC9B,OAAO;YACT,CAAC;YACD,SAAS,GAAG,IAAI,CAAC;YACjB,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;YAClD,KAAK,CAAC,KAAK,IAAI,EAAE;gBACf,IAAI,CAAC;oBACH,MAAM,MAAM,GAAa,EAAE,CAAC;oBAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;oBACb,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;wBAClC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAmB,CAAC,CAAC;wBAC/C,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;wBACrB,IAAI,IAAI,GAAG,MAAM;4BAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;wBACzD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBACrB,CAAC;oBACD,MAAM,MAAM,GAAG,CAAC,MAAM,uBAAuB,CAC3C,IAAI,CAAC,UAAU,EACf,UAAU,CAAC,KAAK,EAChB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CACvC,CAA8B,CAAC;oBAChC,IACE,IAAI,CAAC,GAAG,EAAE,IAAI,UAAU,CAAC,SAAS;wBAClC,MAAM,CAAC,aAAa,KAAK,MAAM;wBAC/B,CAAC,8BAA8B,CAAC,UAAU,EAAE,MAAM,CAAC;wBAEnD,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;oBACxC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;oBAC9B,OAAO,CAAC,MAAM,CAAC,CAAC;gBAClB,CAAC;gBAAC,MAAM,CAAC;oBACP,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;gBAChC,CAAC;wBAAS,CAAC;oBACT,SAAS,GAAG,KAAK,CAAC;gBACpB,CAAC;YACH,CAAC,CAAC,EAAE,CAAC;QACP,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;IACF,4EAA4E;IAC5E,wCAAwC;IACxC,KAAK,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACtC,IAAI,CAAC;QACH,GAAG,CAAC,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC;QAC1D,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC;QAC/B,OAAO,MAAM,CAAC;IAChB,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,mBAAmB,EAAE,CAAC;IAC/B,CAAC;AACH,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,OAI5C;IACC,OAAO,IAAI,gBAAgB,CAAC;QAC1B,OAAO,EAAE,OAAO,CAAC,MAAM;QACvB,iEAAiE;QACjE,UAAU,EAAE,QAAQ;QACpB,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YAC3B,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YACzC,MAAM,
|
|
1
|
+
{"version":3,"file":"browser-confirmation.js","sourceRoot":"","sources":["../../src/cli/browser-confirmation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,8BAA8B,GAG/B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzC;;iFAEiF;AACjF,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,OAQhD;IACC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAC7C,IACE,GAAG,CAAC,QAAQ,KAAK,QAAQ;QACzB,CAAC,CACC,GAAG,CAAC,QAAQ,KAAK,OAAO;YACxB,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAClD;QAED,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,WAAW,CAC1C;QACE,IAAI,EAAE,UAAU;QAChB,aAAa,EAAE,IAAI;QACnB,cAAc,EAAE,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QACzC,IAAI,EAAE,SAAS;KAChB,EACD,IAAI,EACJ,CAAC,SAAS,EAAE,SAAS,CAAC,CACvB,CAAC;IACF,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;IAC9B,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,oBAAqB,MAAM,CAAC,OAAO,EAAkB,CAAC,IAAI,EAAE,CAAC;IAC5E,MAAM,UAAU,GAA2B;QACzC,GAAG,OAAO,CAAC,OAAO;QAClB,SAAS,EAAE,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC;QAC/D,KAAK,EAAE,WAAW,EAAE;QACpB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC;QACtD,WAAW,EAAE,GAAG,MAAM,WAAW;KAClC,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,4BAA4B,CAAC,UAAU,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACjD,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,KAAgD,CAAC;IACrD,MAAM,SAAS,GAAG,IAAI,OAAO,CAC3B,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAClB,KAAK,GAAG,UAAU,CAChB,GAAG,EAAE,CACH,MAAM,CACJ,IAAI,KAAK,CACP,yFAAyF,CAC1F,CACF,EACH,OAAO,CAAC,SAAS,IAAI,OAAO,CAC7B,CAAC;QACF,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;YACzC,QAAQ,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;YAChD,QAAQ,CAAC,SAAS,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC;YACrD,QAAQ,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;YACxD,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,KAAK,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;gBAClD,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;gBAC9B,OAAO;YACT,CAAC;YACD,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,GAAG,KAAK,WAAW,EAAE,CAAC;gBAC5D,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAC;gBAC/D,QAAQ,CAAC,SAAS,CAChB,yBAAyB,EACzB,yCAAyC,KAAK,gEAAgE,CAC/G,CAAC;gBACF,QAAQ,CAAC,GAAG,CACV,kKAAkK,KAAK,6iBAA6iB,CACrtB,CAAC;gBACF,OAAO;YACT,CAAC;YACD,IACE,OAAO,CAAC,MAAM,KAAK,MAAM;gBACzB,OAAO,CAAC,GAAG,KAAK,WAAW;gBAC3B,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,MAAM;gBACjC,SAAS,EACT,CAAC;gBACD,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;gBAC9B,OAAO;YACT,CAAC;YACD,SAAS,GAAG,IAAI,CAAC;YACjB,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;YAClD,KAAK,CAAC,KAAK,IAAI,EAAE;gBACf,IAAI,CAAC;oBACH,MAAM,MAAM,GAAa,EAAE,CAAC;oBAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;oBACb,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;wBAClC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAmB,CAAC,CAAC;wBAC/C,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;wBACrB,IAAI,IAAI,GAAG,MAAM;4BAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;wBACzD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBACrB,CAAC;oBACD,MAAM,MAAM,GAAG,CAAC,MAAM,uBAAuB,CAC3C,IAAI,CAAC,UAAU,EACf,UAAU,CAAC,KAAK,EAChB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CACvC,CAA8B,CAAC;oBAChC,IACE,IAAI,CAAC,GAAG,EAAE,IAAI,UAAU,CAAC,SAAS;wBAClC,MAAM,CAAC,aAAa,KAAK,MAAM;wBAC/B,CAAC,8BAA8B,CAAC,UAAU,EAAE,MAAM,CAAC;wBAEnD,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;oBACxC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;oBAC9B,OAAO,CAAC,MAAM,CAAC,CAAC;gBAClB,CAAC;gBAAC,MAAM,CAAC;oBACP,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;gBAChC,CAAC;wBAAS,CAAC;oBACT,SAAS,GAAG,KAAK,CAAC;gBACpB,CAAC;YACH,CAAC,CAAC,EAAE,CAAC;QACP,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;IACF,4EAA4E;IAC5E,wCAAwC;IACxC,KAAK,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACtC,IAAI,CAAC;QACH,GAAG,CAAC,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC;QAC1D,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC;QAC/B,OAAO,MAAM,CAAC;IAChB,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,mBAAmB,EAAE,CAAC;IAC/B,CAAC;AACH,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,OAI5C;IACC,OAAO,IAAI,gBAAgB,CAAC;QAC1B,OAAO,EAAE,OAAO,CAAC,MAAM;QACvB,iEAAiE;QACjE,UAAU,EAAE,QAAQ;QACpB,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YAC3B,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YACzC,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,YAAY,EAAE,CAAC;YAClD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,kBAAkB,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;YAC1E,IAAI,CAAC,QAAQ,CAAC,EAAE;gBACd,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;YACrE,MAAM,EAAE,gBAAgB,EAAE,eAAe,EAAE,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAEnE,CAAC;YACF,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAAC;gBAC9C,OAAO,EAAE;oBACP,SAAS,EAAE,OAAO,CAAC,MAAM;oBACzB,cAAc,EAAE,YAAY,CAAC,EAAE;oBAC/B,MAAM,EAAE,OAAO,CAAC,MAAwB;oBACxC,IAAI,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ;oBACnC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACrD;gBACD,eAAe;gBACf,OAAO,EAAE,OAAO,CAAC,OAAO;aACzB,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM;gBACxB,CAAC,CAAC;oBACE,IAAI,EAAE,wDAAwD;oBAC9D,KAAK,EAAE,iBAAiB;oBACxB,MAAM,EAAE,GAAG;oBACX,IAAI,EAAE,iBAAiB;oBACvB,MAAM,EAAE,yDAAyD;oBACjE,aAAa,EAAE,iCAAiC;oBAChD,SAAS,EAAE,KAAK;iBACjB;gBACH,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;YAChB,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;gBACxC,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,OAAO,EAAE;oBACP,cAAc,EACZ,MAAM,CAAC,MAAM,IAAI,GAAG;wBAClB,CAAC,CAAC,0BAA0B;wBAC5B,CAAC,CAAC,kBAAkB;iBACzB;aACF,CAAC,CAAC;QACL,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}
|
package/dist/cli/commands.js
CHANGED
|
@@ -284,7 +284,7 @@ export function describeInteraction(summary, where) {
|
|
|
284
284
|
*
|
|
285
285
|
* A project credential already names one project and one environment, so it
|
|
286
286
|
* authenticates the flat `/v1/messages` routes and is refused by the
|
|
287
|
-
* environment-scoped ones. An OAuth grant covers the
|
|
287
|
+
* environment-scoped ones. An OAuth grant covers the organization and must say
|
|
288
288
|
* which environment it means. Asking somebody holding a project credential to
|
|
289
289
|
* repeat what the credential already says — and then failing them for it —
|
|
290
290
|
* was the reason `wb credential create` produced something `wb` could not use.
|
|
@@ -441,7 +441,7 @@ function positional(context, names) {
|
|
|
441
441
|
const DEFAULT_ROTATION_OVERLAP_SECONDS = 3600;
|
|
442
442
|
/** The contract's own ceiling, restated so the refusal can name it. */
|
|
443
443
|
const MAX_ROTATION_OVERLAP_SECONDS = 86_400;
|
|
444
|
-
/** The ordinary login selects the
|
|
444
|
+
/** The ordinary login selects the organization; the browser separately confirms
|
|
445
445
|
* every lifecycle operation. Neither OAuth grants nor API keys administer keys. */
|
|
446
446
|
async function administeringCredentials(context) {
|
|
447
447
|
const { client: api, kind } = await authorizedAuthority({
|
|
@@ -456,7 +456,7 @@ async function administeringCredentials(context) {
|
|
|
456
456
|
api,
|
|
457
457
|
credentials: credentialConfirmationClient({
|
|
458
458
|
origin: context.origin,
|
|
459
|
-
|
|
459
|
+
organization: () => api.getOrganization(),
|
|
460
460
|
openUrl: context.openUrl,
|
|
461
461
|
}),
|
|
462
462
|
};
|
|
@@ -482,7 +482,7 @@ function rotationOverlap(context) {
|
|
|
482
482
|
function credentialArgument(context, verb) {
|
|
483
483
|
const credentialId = context.parsed.words[2];
|
|
484
484
|
if (!credentialId) {
|
|
485
|
-
throw new UsageError(`wb credential ${verb} <credential-id> [--
|
|
485
|
+
throw new UsageError(`wb credential ${verb} <credential-id> [--organization]` +
|
|
486
486
|
(verb === "rotate" ? " [--overlap <seconds>]" : ""));
|
|
487
487
|
}
|
|
488
488
|
return credentialId;
|
|
@@ -514,19 +514,19 @@ const commands = {
|
|
|
514
514
|
origin: context.origin,
|
|
515
515
|
secret: key,
|
|
516
516
|
});
|
|
517
|
-
// Only an
|
|
517
|
+
// Only an organization key can be checked against anything organization-wide, and
|
|
518
518
|
// only then does a refusal mean something. A project key names its own
|
|
519
|
-
// project, so `/v1/
|
|
519
|
+
// project, so `/v1/organization` refuses it for a reason that has nothing to
|
|
520
520
|
// do with whether the key is any good — calling it anyway and reporting
|
|
521
521
|
// the refusal as expected would make a typo look like a stored key
|
|
522
522
|
// working correctly.
|
|
523
|
-
const checkable = key.startsWith("
|
|
523
|
+
const checkable = key.startsWith("wb_oc1.");
|
|
524
524
|
const keyed = checkable ? await client(context) : null;
|
|
525
|
-
let
|
|
525
|
+
let organization = null;
|
|
526
526
|
let refusal = null;
|
|
527
527
|
if (keyed) {
|
|
528
528
|
try {
|
|
529
|
-
|
|
529
|
+
organization = await keyed.getOrganization();
|
|
530
530
|
}
|
|
531
531
|
catch (error) {
|
|
532
532
|
// A refusal is the key's answer and worth reporting. Anything else —
|
|
@@ -537,22 +537,22 @@ const commands = {
|
|
|
537
537
|
(error.status !== 401 && error.status !== 403)) {
|
|
538
538
|
throw error;
|
|
539
539
|
}
|
|
540
|
-
refusal = `It was stored, but ${context.origin} refused it. Check that it is complete and unrevoked, and that it carries
|
|
540
|
+
refusal = `It was stored, but ${context.origin} refused it. Check that it is complete and unrevoked, and that it carries organization:read and projects:read.`;
|
|
541
541
|
}
|
|
542
542
|
}
|
|
543
543
|
emit(context.writer, {
|
|
544
|
-
...(
|
|
544
|
+
...(organization ? { organization: organization.id } : {}),
|
|
545
545
|
origin: context.origin,
|
|
546
546
|
stored: "key",
|
|
547
|
-
verified:
|
|
547
|
+
verified: organization !== null,
|
|
548
548
|
}, [
|
|
549
549
|
`Stored a key for ${context.origin}.`,
|
|
550
|
-
...(
|
|
550
|
+
...(organization ? [`Organization ${organization.id}.`] : []),
|
|
551
551
|
...(refusal ? [refusal] : []),
|
|
552
552
|
...(checkable || refusal
|
|
553
553
|
? []
|
|
554
554
|
: [
|
|
555
|
-
"It names its own project, so there is nothing
|
|
555
|
+
"It names its own project, so there is nothing organization-wide to check it against. The first command you run with it is where a bad key will show.",
|
|
556
556
|
]),
|
|
557
557
|
]);
|
|
558
558
|
return;
|
|
@@ -567,10 +567,14 @@ const commands = {
|
|
|
567
567
|
...(scopes && scopes.length > 0 ? { scopes } : {}),
|
|
568
568
|
});
|
|
569
569
|
const api = await client(context);
|
|
570
|
-
const
|
|
571
|
-
emit(context.writer, {
|
|
570
|
+
const organization = await api.getOrganization();
|
|
571
|
+
emit(context.writer, {
|
|
572
|
+
organization: organization.id,
|
|
573
|
+
origin: context.origin,
|
|
574
|
+
scopes: session.scopes,
|
|
575
|
+
}, [
|
|
572
576
|
`Signed in to ${context.origin}.`,
|
|
573
|
-
`
|
|
577
|
+
`Organization ${organization.id}.`,
|
|
574
578
|
`Permissions: ${session.scopes.join(", ")}`,
|
|
575
579
|
]);
|
|
576
580
|
},
|
|
@@ -591,10 +595,10 @@ const commands = {
|
|
|
591
595
|
},
|
|
592
596
|
async whoami(context) {
|
|
593
597
|
const api = await client(context);
|
|
594
|
-
const
|
|
595
|
-
emit(context.writer,
|
|
596
|
-
`
|
|
597
|
-
...(
|
|
598
|
+
const organization = await api.getOrganization();
|
|
599
|
+
emit(context.writer, organization, [
|
|
600
|
+
`Organization ${organization.id}`,
|
|
601
|
+
...(organization.name ? [organization.name] : []),
|
|
598
602
|
]);
|
|
599
603
|
},
|
|
600
604
|
async "project list"(context) {
|
|
@@ -616,7 +620,7 @@ const commands = {
|
|
|
616
620
|
const api = await client(context);
|
|
617
621
|
const remembered = await loadContext(context.origin, context.contextFile);
|
|
618
622
|
const selector = context.parsed.options.get("project") ?? remembered?.projectId;
|
|
619
|
-
// A project id needs no
|
|
623
|
+
// A project id needs no organization-directory read, which keeps this usable
|
|
620
624
|
// with a credential restricted to this project's configuration.
|
|
621
625
|
const projectId = selector?.startsWith("project_")
|
|
622
626
|
? selector
|
|
@@ -710,14 +714,14 @@ const commands = {
|
|
|
710
714
|
*
|
|
711
715
|
* `create` shipped alone, which left the CLI able to issue the widest key
|
|
712
716
|
* WhooshBang hands out and unable to get rid of one (FXO-2220). All three
|
|
713
|
-
* take `--
|
|
717
|
+
* take `--organization` to address the organization-scoped family, exactly as
|
|
714
718
|
* `credential create` does, so there is one flag to learn rather than a
|
|
715
719
|
* separate command per kind.
|
|
716
720
|
*/
|
|
717
721
|
async "credential list"(context) {
|
|
718
722
|
const { api, credentials: credentialApi } = await administeringCredentials(context);
|
|
719
|
-
if (context.parsed.switches.has("
|
|
720
|
-
const credentials = await credentialApi.
|
|
723
|
+
if (context.parsed.switches.has("organization")) {
|
|
724
|
+
const credentials = await credentialApi.listOrganizationCredentials();
|
|
721
725
|
emit(context.writer, credentials, table(credentialRows(credentials.items)));
|
|
722
726
|
return;
|
|
723
727
|
}
|
|
@@ -729,8 +733,8 @@ const commands = {
|
|
|
729
733
|
const credentialId = credentialArgument(context, "rotate");
|
|
730
734
|
const { api, credentials: credentialApi } = await administeringCredentials(context);
|
|
731
735
|
const overlap = rotationOverlap(context);
|
|
732
|
-
const rotation = context.parsed.switches.has("
|
|
733
|
-
? await credentialApi.
|
|
736
|
+
const rotation = context.parsed.switches.has("organization")
|
|
737
|
+
? await credentialApi.rotateOrganizationCredential(credentialId, {
|
|
734
738
|
overlap_seconds: overlap,
|
|
735
739
|
})
|
|
736
740
|
: await (async () => {
|
|
@@ -761,8 +765,8 @@ const commands = {
|
|
|
761
765
|
async "credential revoke"(context) {
|
|
762
766
|
const credentialId = credentialArgument(context, "revoke");
|
|
763
767
|
const { api, credentials: credentialApi } = await administeringCredentials(context);
|
|
764
|
-
const revoked = context.parsed.switches.has("
|
|
765
|
-
? await credentialApi.
|
|
768
|
+
const revoked = context.parsed.switches.has("organization")
|
|
769
|
+
? await credentialApi.revokeOrganizationCredential(credentialId)
|
|
766
770
|
: await (async () => {
|
|
767
771
|
const { environmentId, projectId } = await resolveEnvironment(api, context.parsed, resolveOptions(context));
|
|
768
772
|
return credentialApi.revokeApiCredential(projectId, environmentId, credentialId);
|
|
@@ -777,23 +781,23 @@ const commands = {
|
|
|
777
781
|
async "credential create"(context) {
|
|
778
782
|
const { api, credentials: credentialApi } = await administeringCredentials(context);
|
|
779
783
|
const label = required(context.parsed, "label", "what this credential is for");
|
|
780
|
-
// `--
|
|
784
|
+
// `--organization` issues the key that belongs to the organization rather than
|
|
781
785
|
// to one project environment. It is the one a CI job or an agent working
|
|
782
786
|
// across projects can actually hold: it names its project per call, so it
|
|
783
787
|
// takes no --project and no --environment here.
|
|
784
|
-
if (context.parsed.switches.has("
|
|
785
|
-
// `
|
|
788
|
+
if (context.parsed.switches.has("organization")) {
|
|
789
|
+
// `organization:read` and `projects:read` together are what make
|
|
786
790
|
// `--project <slug>` resolve for something with nobody at a keyboard, so
|
|
787
791
|
// the default set carries both; the rest matches `wb credential create`.
|
|
788
792
|
const scopes = (context.parsed.repeated.get("scope") ?? [
|
|
789
|
-
"
|
|
793
|
+
"organization:read",
|
|
790
794
|
"projects:read",
|
|
791
795
|
"messages:write",
|
|
792
796
|
"messages:read",
|
|
793
797
|
"subscriptions:write",
|
|
794
798
|
"subscriptions:read",
|
|
795
799
|
]);
|
|
796
|
-
const issued = await credentialApi.
|
|
800
|
+
const issued = await credentialApi.createOrganizationCredential({
|
|
797
801
|
label,
|
|
798
802
|
scopes,
|
|
799
803
|
});
|
|
@@ -1061,7 +1065,7 @@ const commands = {
|
|
|
1061
1065
|
}
|
|
1062
1066
|
const { api, flat, projectId } = await messageScope(context);
|
|
1063
1067
|
if (flat) {
|
|
1064
|
-
throw new UsageError("Subscriber export covers both project environments. Sign in with `wb login` or use an
|
|
1068
|
+
throw new UsageError("Subscriber export covers both project environments. Sign in with `wb login` or use an organization credential with organization:read and all three data read scopes.");
|
|
1065
1069
|
}
|
|
1066
1070
|
const exported = await api.getSubscriberDataExport(projectId, subscriberId);
|
|
1067
1071
|
// The artifact itself is the result in both human and JSON modes. Keeping
|
|
@@ -1082,7 +1086,7 @@ const commands = {
|
|
|
1082
1086
|
origin: context.origin,
|
|
1083
1087
|
});
|
|
1084
1088
|
if (projectScoped) {
|
|
1085
|
-
throw new UsageError("Subscriber erasure covers both project environments. Sign in with `wb login` or use an
|
|
1089
|
+
throw new UsageError("Subscriber erasure covers both project environments. Sign in with `wb login` or use an organization credential carrying all three data write scopes.");
|
|
1086
1090
|
}
|
|
1087
1091
|
const remembered = await loadContext(context.origin, context.contextFile);
|
|
1088
1092
|
const projectSelector = context.parsed.options.get("project") ?? remembered?.projectId;
|