apiblaze 0.18.2 → 0.18.3

package/dist/index.js

@@ -703,7 +703,7 @@ var import_commander = require("commander");
 var import_chalk39 = __toESM(require("chalk"));
 
 // package.json
-var version = "0.18.2";
+var version = "0.18.3";
 
 // src/index.ts
 init_types();

package/dist/react/index.js

@@ -96,6 +96,9 @@ var UsersGroupsWidget = React.forwardRef(function UsersGroupsWidget2({ endpoint
   const [addSel, setAddSel] = React.useState("");
   const [addRole, setAddRole] = React.useState("member");
   const [nestSel, setNestSel] = React.useState("");
+  const [admins, setAdmins] = React.useState([]);
+  const [showAdmins, setShowAdmins] = React.useState(false);
+  const [newAdmin, setNewAdmin] = React.useState("");
   const call = React.useCallback(async (body) => {
     const res = await fetch(endpoint, body ? { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(body) } : { cache: "no-store" });
     const data = await res.json().catch(() => ({}));
@@ -111,6 +114,10 @@ var UsersGroupsWidget = React.forwardRef(function UsersGroupsWidget2({ endpoint
       setGroups((d.groups ?? []).slice().sort((a, b) => a.name.localeCompare(b.name)));
       setUsers(d.users ?? []);
       setObserved(d.observed ?? []);
+      if (d.access !== "pending") {
+        const a = await call({ action: "list-admins" });
+        setAdmins(a.admin_emails ?? []);
+      }
     } catch (e) {
       setLoadError(e instanceof Error ? e.message : "Could not load groups.");
       setGroups(null);
@@ -172,6 +179,11 @@ var UsersGroupsWidget = React.forwardRef(function UsersGroupsWidget2({ endpoint
       setCreating(false);
     }
   }
+  async function addAdmin() {
+    const email = newAdmin.trim().toLowerCase();
+    if (!email) return;
+    await act("add-admin", { action: "add-admin", email }, () => setNewAdmin(""));
+  }
   const vars = {
     // @ts-expect-error CSS custom properties
     "--abz-accent": t.accent,
@@ -439,6 +451,60 @@ var UsersGroupsWidget = React.forwardRef(function UsersGroupsWidget2({ endpoint
           ] })
         ] }, g.id);
       }) }),
+      access === "ok" && groups !== null && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { style: { borderTop: `1px solid ${t.border}` }, children: [
+        /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(
+          "button",
+          {
+            onClick: () => setShowAdmins((v) => !v),
+            "aria-expanded": showAdmins,
+            style: { display: "flex", width: "100%", gap: 10, alignItems: "center", padding: "12px 16px", background: "transparent", border: "none", cursor: "pointer", color: t.text, fontFamily: "inherit", fontSize: 13, textAlign: "left" },
+            children: [
+              /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { "aria-hidden": "true", style: { color: t.muted, fontSize: 11 }, children: showAdmins ? "\u25BE" : "\u25B8" }),
+              /* @__PURE__ */ (0, import_jsx_runtime.jsx)("strong", { style: { flex: 1 }, children: "Admins" }),
+              /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { style: chip, children: admins.length })
+            ]
+          }
+        ),
+        showAdmins && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { style: { padding: "0 16px 14px 34px" }, children: [
+          /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("ul", { style: { listStyle: "none", margin: 0, padding: 0 }, children: [
+            admins.map((a) => {
+              const removable = !a.pinned && admins.length > 1;
+              return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("li", { style: { display: "flex", gap: 8, alignItems: "center", padding: "6px 0", flexWrap: "wrap" }, children: [
+                /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { style: { flex: 1, minWidth: 160 }, children: a.email }),
+                a.pinned && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { style: chip, title: "Set by the API provider \u2014 you can\u2019t remove this one", children: "provider" }),
+                /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { style: { ...chip, ...a.active ? { color: t.success, borderColor: t.success } : {} }, children: a.active ? "active" : "pending sign-in" }),
+                /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
+                  "button",
+                  {
+                    style: { ...btn("danger", true), ...removable ? {} : { opacity: 0.4, cursor: "not-allowed" } },
+                    disabled: busy || !removable,
+                    title: a.pinned ? "Provider-set admins can only be removed by the API provider" : admins.length <= 1 ? "A tenant must keep at least one admin" : `Remove ${a.email} as an admin`,
+                    onClick: () => act(`rm-admin:${a.email}`, { action: "remove-admin", email: a.email }),
+                    children: "Remove"
+                  }
+                )
+              ] }, a.email);
+            }),
+            admins.length === 0 && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("li", { style: { color: t.muted, fontSize: 13, padding: "6px 0" }, children: "No admins yet." })
+          ] }),
+          /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { style: { display: "flex", gap: 8, marginTop: 10 }, children: [
+            /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
+              "input",
+              {
+                style: { ...inputStyle, flex: 1 },
+                type: "email",
+                placeholder: "Add an admin by email",
+                value: newAdmin,
+                onChange: (e) => setNewAdmin(e.target.value),
+                onKeyDown: (e) => e.key === "Enter" && addAdmin(),
+                "aria-label": "New admin email"
+              }
+            ),
+            /* @__PURE__ */ (0, import_jsx_runtime.jsx)("button", { style: btn("primary", true), disabled: busy || !newAdmin.trim(), onClick: addAdmin, children: "Add admin" })
+          ] }),
+          /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { style: { fontSize: 12, color: t.muted, marginTop: 8 }, children: "A new admin gets access the first time they sign in. Admins are granted by email \u2014 never by adding someone to a group." })
+        ] })
+      ] }),
       access === "ok" && groups !== null && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { style: { borderTop: `1px solid ${t.border}` }, children: [
         /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(
           "button",

package/dist/react/index.mjs

@@ -61,6 +61,9 @@ var UsersGroupsWidget = React.forwardRef(function UsersGroupsWidget2({ endpoint
   const [addSel, setAddSel] = React.useState("");
   const [addRole, setAddRole] = React.useState("member");
   const [nestSel, setNestSel] = React.useState("");
+  const [admins, setAdmins] = React.useState([]);
+  const [showAdmins, setShowAdmins] = React.useState(false);
+  const [newAdmin, setNewAdmin] = React.useState("");
   const call = React.useCallback(async (body) => {
     const res = await fetch(endpoint, body ? { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(body) } : { cache: "no-store" });
     const data = await res.json().catch(() => ({}));
@@ -76,6 +79,10 @@ var UsersGroupsWidget = React.forwardRef(function UsersGroupsWidget2({ endpoint
       setGroups((d.groups ?? []).slice().sort((a, b) => a.name.localeCompare(b.name)));
       setUsers(d.users ?? []);
       setObserved(d.observed ?? []);
+      if (d.access !== "pending") {
+        const a = await call({ action: "list-admins" });
+        setAdmins(a.admin_emails ?? []);
+      }
     } catch (e) {
       setLoadError(e instanceof Error ? e.message : "Could not load groups.");
       setGroups(null);
@@ -137,6 +144,11 @@ var UsersGroupsWidget = React.forwardRef(function UsersGroupsWidget2({ endpoint
       setCreating(false);
     }
   }
+  async function addAdmin() {
+    const email = newAdmin.trim().toLowerCase();
+    if (!email) return;
+    await act("add-admin", { action: "add-admin", email }, () => setNewAdmin(""));
+  }
   const vars = {
     // @ts-expect-error CSS custom properties
     "--abz-accent": t.accent,
@@ -404,6 +416,60 @@ var UsersGroupsWidget = React.forwardRef(function UsersGroupsWidget2({ endpoint
           ] })
         ] }, g.id);
       }) }),
+      access === "ok" && groups !== null && /* @__PURE__ */ jsxs("div", { style: { borderTop: `1px solid ${t.border}` }, children: [
+        /* @__PURE__ */ jsxs(
+          "button",
+          {
+            onClick: () => setShowAdmins((v) => !v),
+            "aria-expanded": showAdmins,
+            style: { display: "flex", width: "100%", gap: 10, alignItems: "center", padding: "12px 16px", background: "transparent", border: "none", cursor: "pointer", color: t.text, fontFamily: "inherit", fontSize: 13, textAlign: "left" },
+            children: [
+              /* @__PURE__ */ jsx("span", { "aria-hidden": "true", style: { color: t.muted, fontSize: 11 }, children: showAdmins ? "\u25BE" : "\u25B8" }),
+              /* @__PURE__ */ jsx("strong", { style: { flex: 1 }, children: "Admins" }),
+              /* @__PURE__ */ jsx("span", { style: chip, children: admins.length })
+            ]
+          }
+        ),
+        showAdmins && /* @__PURE__ */ jsxs("div", { style: { padding: "0 16px 14px 34px" }, children: [
+          /* @__PURE__ */ jsxs("ul", { style: { listStyle: "none", margin: 0, padding: 0 }, children: [
+            admins.map((a) => {
+              const removable = !a.pinned && admins.length > 1;
+              return /* @__PURE__ */ jsxs("li", { style: { display: "flex", gap: 8, alignItems: "center", padding: "6px 0", flexWrap: "wrap" }, children: [
+                /* @__PURE__ */ jsx("span", { style: { flex: 1, minWidth: 160 }, children: a.email }),
+                a.pinned && /* @__PURE__ */ jsx("span", { style: chip, title: "Set by the API provider \u2014 you can\u2019t remove this one", children: "provider" }),
+                /* @__PURE__ */ jsx("span", { style: { ...chip, ...a.active ? { color: t.success, borderColor: t.success } : {} }, children: a.active ? "active" : "pending sign-in" }),
+                /* @__PURE__ */ jsx(
+                  "button",
+                  {
+                    style: { ...btn("danger", true), ...removable ? {} : { opacity: 0.4, cursor: "not-allowed" } },
+                    disabled: busy || !removable,
+                    title: a.pinned ? "Provider-set admins can only be removed by the API provider" : admins.length <= 1 ? "A tenant must keep at least one admin" : `Remove ${a.email} as an admin`,
+                    onClick: () => act(`rm-admin:${a.email}`, { action: "remove-admin", email: a.email }),
+                    children: "Remove"
+                  }
+                )
+              ] }, a.email);
+            }),
+            admins.length === 0 && /* @__PURE__ */ jsx("li", { style: { color: t.muted, fontSize: 13, padding: "6px 0" }, children: "No admins yet." })
+          ] }),
+          /* @__PURE__ */ jsxs("div", { style: { display: "flex", gap: 8, marginTop: 10 }, children: [
+            /* @__PURE__ */ jsx(
+              "input",
+              {
+                style: { ...inputStyle, flex: 1 },
+                type: "email",
+                placeholder: "Add an admin by email",
+                value: newAdmin,
+                onChange: (e) => setNewAdmin(e.target.value),
+                onKeyDown: (e) => e.key === "Enter" && addAdmin(),
+                "aria-label": "New admin email"
+              }
+            ),
+            /* @__PURE__ */ jsx("button", { style: btn("primary", true), disabled: busy || !newAdmin.trim(), onClick: addAdmin, children: "Add admin" })
+          ] }),
+          /* @__PURE__ */ jsx("div", { style: { fontSize: 12, color: t.muted, marginTop: 8 }, children: "A new admin gets access the first time they sign in. Admins are granted by email \u2014 never by adding someone to a group." })
+        ] })
+      ] }),
       access === "ok" && groups !== null && /* @__PURE__ */ jsxs("div", { style: { borderTop: `1px solid ${t.border}` }, children: [
         /* @__PURE__ */ jsxs(
           "button",

package/dist/server/index.d.mts

@@ -116,6 +116,14 @@ type GroupsAction = {
     email?: string;
     displayName?: string;
     groups?: string[];
+} | {
+    action: 'list-admins';
+} | {
+    action: 'add-admin';
+    email: string;
+} | {
+    action: 'remove-admin';
+    email: string;
 };
 declare function createApiblazeGroups(cfg: ApiblazeGroupsConfig): {
     handler: (req: Request) => Promise<Response>;

package/dist/server/index.d.ts

@@ -116,6 +116,14 @@ type GroupsAction = {
     email?: string;
     displayName?: string;
     groups?: string[];
+} | {
+    action: 'list-admins';
+} | {
+    action: 'add-admin';
+    email: string;
+} | {
+    action: 'remove-admin';
+    email: string;
 };
 declare function createApiblazeGroups(cfg: ApiblazeGroupsConfig): {
     handler: (req: Request) => Promise<Response>;

package/dist/server/index.js

@@ -172,6 +172,15 @@ function createApiblazeGroups(cfg) {
           display_name: op.displayName,
           groups: op.groups ?? []
         }));
+      // Tenant-admin allowlist — appoint/remove CO-admins by email. This is the
+      // ONLY way admin membership changes (apiblaze_admins is sealed); the plane
+      // enforces the guardrails (producer-pinned + last-admin).
+      case "list-admins":
+        return pass(await iam("GET", "/admin-emails", user, tenant));
+      case "add-admin":
+        return pass(await iam("POST", "/admin-emails", user, tenant, { email: op.email }));
+      case "remove-admin":
+        return pass(await iam("DELETE", `/admin-emails/${encodeURIComponent(op.email)}`, user, tenant));
     }
   }
   async function handler(req) {

package/dist/server/index.mjs

@@ -144,6 +144,15 @@ function createApiblazeGroups(cfg) {
           display_name: op.displayName,
           groups: op.groups ?? []
         }));
+      // Tenant-admin allowlist — appoint/remove CO-admins by email. This is the
+      // ONLY way admin membership changes (apiblaze_admins is sealed); the plane
+      // enforces the guardrails (producer-pinned + last-admin).
+      case "list-admins":
+        return pass(await iam("GET", "/admin-emails", user, tenant));
+      case "add-admin":
+        return pass(await iam("POST", "/admin-emails", user, tenant, { email: op.email }));
+      case "remove-admin":
+        return pass(await iam("DELETE", `/admin-emails/${encodeURIComponent(op.email)}`, user, tenant));
     }
   }
   async function handler(req) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "apiblaze",
-  "version": "0.18.2",
+  "version": "0.18.3",
   "description": "APIblaze CLI — Chat with your APIs, Manage your API keys, users and groups with the APIblaze serverless proxy",
   "keywords": [
     "apiblaze",