dataiku-sdk 3.1.0 → 3.3.0

package/dist/src/cli/commands/sql.js

@@ -1,6 +1,7 @@
 import { readFileSync, } from "node:fs";
-import { mkdir, writeFile, } from "node:fs/promises";
+import { mkdir, } from "node:fs/promises";
 import { dirname, resolve, } from "node:path";
+import { writeResponseToFile, } from "../../utils/response-file.js";
 import { readStdinText, stripUtf8Bom, } from "../coerce.js";
 import { enqueueCliWarning, } from "../output.js";
 import { UsageError, } from "../usage.js";
@@ -121,7 +122,7 @@ export const sqlCommands = {
             }
             const outputPath = resolve(outputFile);
             await mkdir(dirname(outputPath), { recursive: true, });
-            await writeFile(outputPath, `${JSON.stringify(result, null, 2)}\n`, "utf-8");
+            await writeResponseToFile(outputPath, new Response(`${JSON.stringify(result, null, 2)}\n`), "preserve");
             return {
                 queryId: result.queryId,
                 schema: result.schema,

package/dist/src/cli/commands/statistics.js

@@ -1,4 +1,5 @@
 import { requiredJsonInput, } from "../coerce.js";
+import { executionMode, } from "../flags.js";
 import { encodedProjectEndpoint, planResult, } from "../output.js";
 import { requireArgs, } from "../usage.js";
 const STATISTICS_PLAN_EXIT_CODES = { usage: 1, error: 2, transient: 3, };
@@ -51,7 +52,7 @@ export const statisticsCommands = {
             requireArgs(a, 1, "dss statistics create-worksheet <dataset> (--data JSON|--data-file PATH|--stdin) [--dry-run] [--project-key KEY]");
             const body = requiredJsonInput(f, "--data, --data-file, or --stdin is required (worksheet definition).");
             const projectKey = f["project-key"];
-            if (f["dry-run"] === true) {
+            if (executionMode(f).dryRun) {
                 return statisticsPlan("create-worksheet", {
                     method: "POST",
                     endpoint: statisticsWorksheetsEndpoint(c, a[0], projectKey),
@@ -72,7 +73,7 @@ export const statisticsCommands = {
             requireArgs(a, 2, "dss statistics update-worksheet <dataset> <worksheetId> (--data JSON|--data-file PATH|--stdin) [--dry-run] [--project-key KEY]");
             const body = requiredJsonInput(f, "--data, --data-file, or --stdin is required (worksheet definition).");
             const projectKey = f["project-key"];
-            if (f["dry-run"] === true) {
+            if (executionMode(f).dryRun) {
                 return statisticsPlan("update-worksheet", {
                     method: "PUT",
                     endpoint: statisticsWorksheetEndpoint(c, a[0], a[1], projectKey),
@@ -90,7 +91,7 @@ export const statisticsCommands = {
         handler: async (c, a, f) => {
             requireArgs(a, 2, "dss statistics delete-worksheet <dataset> <worksheetId> [--dry-run] [--project-key KEY]");
             const projectKey = f["project-key"];
-            if (f["dry-run"] === true) {
+            if (executionMode(f).dryRun) {
                 return statisticsPlan("delete-worksheet", {
                     method: "DELETE",
                     endpoint: statisticsWorksheetEndpoint(c, a[0], a[1], projectKey),
@@ -108,7 +109,7 @@ export const statisticsCommands = {
         handler: async (c, a, f) => {
             requireArgs(a, 2, "dss statistics run-worksheet <dataset> <worksheetId> [--dry-run] [--project-key KEY]");
             const projectKey = f["project-key"];
-            if (f["dry-run"] === true) {
+            if (executionMode(f).dryRun) {
                 return statisticsPlan("run-worksheet", {
                     method: "POST",
                     endpoint: `${statisticsWorksheetEndpoint(c, a[0], a[1], projectKey)}/actions/run-card`,
@@ -127,7 +128,7 @@ export const statisticsCommands = {
             requireArgs(a, 2, "dss statistics run-card <dataset> <worksheetId> (--data JSON|--data-file PATH|--stdin) [--dry-run] [--project-key KEY]");
             const card = requiredJsonInput(f, "--data, --data-file, or --stdin is required (card settings).");
             const projectKey = f["project-key"];
-            if (f["dry-run"] === true) {
+            if (executionMode(f).dryRun) {
                 return statisticsPlan("run-card", {
                     method: "POST",
                     endpoint: `${statisticsWorksheetEndpoint(c, a[0], a[1], projectKey)}/actions/run-card`,
@@ -147,7 +148,7 @@ export const statisticsCommands = {
             requireArgs(a, 2, "dss statistics run-computation <dataset> <worksheetId> (--data JSON|--data-file PATH|--stdin) [--dry-run] [--project-key KEY]");
             const computation = requiredJsonInput(f, "--data, --data-file, or --stdin is required (computation settings).");
             const projectKey = f["project-key"];
-            if (f["dry-run"] === true) {
+            if (executionMode(f).dryRun) {
                 return statisticsPlan("run-computation", {
                     method: "POST",
                     endpoint: `${statisticsWorksheetEndpoint(c, a[0], a[1], projectKey)}/actions/run-computation`,

package/dist/src/cli/commands/user.d.ts

@@ -0,0 +1,8 @@
+import type { CommandMeta } from "../types.js";
+export declare function sanitizeUserSecrets<T>(value: T, secrets?: string[]): T;
+/**
+ * Extract every exact password value in a user body (top-level or nested) so
+ * errors echoing the payload can be scrubbed.
+ */
+export declare function userSecretsFromBody(body: unknown): string[];
+export declare const userCommands: Record<string, CommandMeta>;

package/dist/src/cli/commands/user.js

@@ -0,0 +1,296 @@
+import { normalizeSecretKey, sanitizeSecrets, } from "../../utils/secret-sanitize.js";
+import { requiredJsonInput, splitCsvFlag, } from "../coerce.js";
+import { executionMode, } from "../flags.js";
+import { readIfExists, skipResult, } from "../output.js";
+import { requireArgs, UsageError, } from "../usage.js";
+/** Credential-bearing user keys, matched after stripping -/_ and lowercasing. */
+const SENSITIVE_USER_NORMALIZED_KEYS = {
+    password: true,
+    userpassword: true,
+};
+/**
+ * Key check for the user secrets family: `secrets` entries (DSS user settings
+ * carry a secrets array of credential values) and password-like keys are
+ * redacted regardless of nesting depth.
+ */
+function isSensitiveUserKey(normalizedKey) {
+    return SENSITIVE_USER_NORMALIZED_KEYS[normalizedKey] === true || normalizedKey === "secrets";
+}
+export function sanitizeUserSecrets(value, secrets = []) {
+    return sanitizeSecrets(value, {
+        sensitiveKeys: SENSITIVE_USER_NORMALIZED_KEYS,
+        isSensitiveKey: (normalizedKey) => normalizedKey === "secrets",
+        secrets,
+    });
+}
+/**
+ * Extract every exact password value in a user body (top-level or nested) so
+ * errors echoing the payload can be scrubbed.
+ */
+export function userSecretsFromBody(body) {
+    if (body === undefined || body === null || typeof body !== "object" || Array.isArray(body)) {
+        return [];
+    }
+    const found = [];
+    const visit = (value) => {
+        if (Array.isArray(value)) {
+            value.forEach(visit);
+            return;
+        }
+        if (value !== null && typeof value === "object") {
+            for (const [key, item,] of Object.entries(value)) {
+                const normalizedKey = normalizeSecretKey(key);
+                if (isSensitiveUserKey(normalizedKey)) {
+                    // `secrets` may be an array of credential values or a single
+                    // string; passwords are single strings.
+                    if (typeof item === "string")
+                        found.push(item);
+                    else if (Array.isArray(item)) {
+                        for (const entry of item) {
+                            if (typeof entry === "string")
+                                found.push(entry);
+                            else
+                                visit(entry);
+                        }
+                    }
+                    else
+                        visit(item);
+                }
+                else {
+                    visit(item);
+                }
+            }
+        }
+    };
+    visit(body);
+    return found;
+}
+function requiredUserJson(flags, usage) {
+    const body = requiredJsonInput(flags, `--data, --data-file, or --stdin is required (user definition). Usage: ${usage}`);
+    return body;
+}
+/** Login identifiers must be non-empty before any request or dry-run preview. */
+function requireLogin(value, usage) {
+    const trimmed = value?.trim() ?? "";
+    if (trimmed.length === 0) {
+        throw new UsageError(`login must be a non-empty string.\nUsage: ${usage}`, "validation_failed");
+    }
+    return trimmed;
+}
+export const userCommands = {
+    list: {
+        handler: (c, _a, f) => c.users.list(f["connected"] === true ? { connected: true, } : undefined),
+        usage: "dss user list [--connected]",
+        description: "List DSS users (admin). --connected reports currently connected users via WebSockets, which may under-report when WebSockets are disabled.",
+        examples: ["dss user list", "dss user list --connected",],
+    },
+    get: {
+        handler: (c, a) => {
+            const usage = "dss user get <login>";
+            requireArgs(a, 1, usage);
+            return c.users.get(requireLogin(a[0], usage));
+        },
+        usage: "dss user get <login>",
+        description: "Get a DSS user (admin).",
+        examples: ["dss user get admin",],
+    },
+    create: {
+        handler: async (c, _a, f) => {
+            const usage = "dss user create (--data JSON|--data-file PATH|--stdin)";
+            const body = requiredUserJson(f, usage);
+            if (executionMode(f).dryRun) {
+                return {
+                    dryRun: true,
+                    action: "create",
+                    resource: "user",
+                    login: typeof body.login === "string" ? body.login : undefined,
+                    endpoint: "/public/api/admin/users",
+                    method: "POST",
+                    payload: sanitizeUserSecrets(body),
+                };
+            }
+            const result = await c.users.create(body);
+            return sanitizeUserSecrets(result, userSecretsFromBody(body));
+        },
+        usage: "dss user create (--data JSON|--data-file PATH|--stdin) [--dry-run]",
+        description: 'Create a DSS user (admin). The JSON body follows the DSS User schema, e.g. {"login":"UserA","sourceType":"LOCAL","displayName":"User A","groups":[],"userProfile":"DATA_ANALYST","password":"..."}. Secrets are never echoed in output.',
+        examples: [
+            `dss user create --data '{"login":"UserA","sourceType":"LOCAL","displayName":"User A","groups":[],"userProfile":"DATA_ANALYST","password":"s3cret"}'`,
+        ],
+    },
+    update: {
+        handler: async (c, a, f) => {
+            const usage = "dss user update <login> (--data JSON|--data-file PATH|--stdin) [--dry-run]";
+            requireArgs(a, 1, usage);
+            const login = requireLogin(a[0], usage);
+            const body = requiredUserJson(f, usage);
+            if (executionMode(f).dryRun) {
+                return {
+                    dryRun: true,
+                    action: "update",
+                    resource: "user",
+                    login,
+                    method: "PUT",
+                    endpoint: `/public/api/admin/users/${encodeURIComponent(login)}`,
+                    payload: sanitizeUserSecrets(body),
+                    note: "PUT replaces the whole User object; the body must come from `dss user get`. No GET was issued in dry-run.",
+                };
+            }
+            const result = await c.users.update(login, body);
+            return sanitizeUserSecrets(result, userSecretsFromBody(body));
+        },
+        usage: "dss user update <login> (--data JSON|--data-file PATH|--stdin) [--dry-run]",
+        description: "Update a DSS user (admin). The body MUST be the User object obtained from `dss user get` (PUT semantics); pass undocumented attributes through unchanged. Use --dry-run to preview the merged result without writing.",
+        examples: [
+            `dss user update UserA --data '{"login":"UserA","displayName":"User A2","groups":["administrators"],"codeAllowed":true}'`,
+        ],
+    },
+    delete: {
+        handler: async (c, a, f) => {
+            const usage = "dss user delete <login> [--if-exists] [--dry-run]";
+            requireArgs(a, 1, usage);
+            const login = requireLogin(a[0], usage);
+            if (executionMode(f).dryRun) {
+                return {
+                    dryRun: true,
+                    action: "delete",
+                    resource: "user",
+                    login,
+                    method: "DELETE",
+                    endpoint: `/public/api/admin/users/${encodeURIComponent(login)}`,
+                    ...(f["if-exists"] === true
+                        ? { note: "Existence not checked in dry-run; live --if-exists issues a GET probe first.", }
+                        : {}),
+                };
+            }
+            if (f["if-exists"] === true) {
+                const current = await readIfExists(() => c.users.get(login));
+                if (!current)
+                    return skipResult("user", login, "missing");
+            }
+            return c.users.delete(login);
+        },
+        usage: "dss user delete <login> [--if-exists] [--dry-run]",
+        description: "Delete a DSS user (admin). Destructive and irreversible.",
+        examples: ["dss user delete UserA", "dss user delete UserA --if-exists",],
+    },
+    resync: {
+        handler: async (c, a, f) => {
+            const usage = "dss user resync <login>";
+            requireArgs(a, 1, usage);
+            const login = requireLogin(a[0], usage);
+            if (executionMode(f).dryRun) {
+                return {
+                    dryRun: true,
+                    action: "resync",
+                    resource: "user",
+                    login,
+                    method: "POST",
+                    endpoint: `/public/api/admin/users/${encodeURIComponent(login)}/actions/resync`,
+                };
+            }
+            return c.users.resync(login);
+        },
+        usage: "dss user resync <login> [--dry-run]",
+        description: "Resync one DSS user (admin). Returns a DSS future; poll with `dss future wait <jobId>` when hasResult is false.",
+        examples: ["dss user resync UserA",],
+    },
+    "resync-multi": {
+        handler: async (c, _a, f) => {
+            const logins = splitCsvFlag(f["logins"]);
+            if (logins.length === 0) {
+                throw new UsageError("--logins is required. Usage: dss user resync-multi --logins user1,user2", "missing_required_flag");
+            }
+            if (executionMode(f).dryRun) {
+                return {
+                    dryRun: true,
+                    action: "resync-multi",
+                    resource: "user",
+                    count: logins.length,
+                    method: "POST",
+                    endpoint: "/public/api/admin/users/actions/resync-multi",
+                    payload: logins,
+                };
+            }
+            return c.users.resyncMulti(logins);
+        },
+        usage: "dss user resync-multi --logins CSV [--dry-run]",
+        description: "Resync multiple DSS users (admin). Returns a DSS future.",
+        examples: ["dss user resync-multi --logins user1,user2,user3",],
+    },
+    "external-users": {
+        handler: async (c, _a, f) => {
+            if (executionMode(f).dryRun) {
+                return {
+                    dryRun: true,
+                    action: "external-users",
+                    resource: "user",
+                    method: "GET",
+                    endpoint: "/public/api/admin/users/actions/external-users",
+                    note: "Mints a DSS future that enumerates the external identity supplier.",
+                };
+            }
+            return c.users.externalUsers();
+        },
+        usage: "dss user external-users [--dry-run]",
+        description: "Fetch externally sourced users and their provisioning status (admin). Returns a DSS future whose result is the external user list when hasResult is true.",
+        examples: ["dss user external-users",],
+    },
+    "external-groups": {
+        handler: async (c, _a, f) => {
+            if (executionMode(f).dryRun) {
+                return {
+                    dryRun: true,
+                    action: "external-groups",
+                    resource: "user",
+                    method: "GET",
+                    endpoint: "/public/api/admin/users/actions/external-groups",
+                    note: "Mints a DSS future that enumerates the external identity supplier's groups.",
+                };
+            }
+            return c.users.externalGroups();
+        },
+        usage: "dss user external-groups [--dry-run]",
+        description: "Fetch externally sourced groups (admin). Returns a DSS future whose result is the external group name list when hasResult is true.",
+        examples: ["dss user external-groups",],
+    },
+    provision: {
+        handler: async (c, _a, f) => {
+            const usage = "dss user provision (--data JSON|--data-file PATH|--stdin)";
+            const body = requiredJsonInput(f, `--data, --data-file, or --stdin is required (provisioning request). Usage: ${usage}`);
+            if (executionMode(f).dryRun) {
+                return {
+                    dryRun: true,
+                    action: "provision",
+                    resource: "user",
+                    userSourceType: typeof body.userSourceType === "string" ? body.userSourceType : undefined,
+                    method: "POST",
+                    endpoint: "/public/api/admin/users/actions/provision",
+                    payload: body,
+                };
+            }
+            return c.users.provision(body);
+        },
+        usage: "dss user provision (--data JSON|--data-file PATH|--stdin) [--dry-run]",
+        description: "Provision users from an external source (admin). Body is the documented {userSourceType, users[]} request; returns a DSS future with a provisioning summary.",
+        examples: [
+            `dss user provision --data '{"userSourceType":"AZURE_AD","users":[{"login":"bob","displayName":"Bob","sourceGroupNames":["externalGroupA"],"dkuGroupNames":["dssGroupA"]}]}'`,
+        ],
+    },
+    activity: {
+        handler: (c) => c.users.activityAll(),
+        usage: "dss user activity",
+        description: "Get last activity timestamps for all DSS users (admin).",
+        examples: ["dss user activity",],
+    },
+    "activity-get": {
+        handler: (c, a) => {
+            const usage = "dss user activity-get <login>";
+            requireArgs(a, 1, usage);
+            return c.users.activity(requireLogin(a[0], usage));
+        },
+        usage: "dss user activity-get <login>",
+        description: "Get last activity timestamps for one DSS user (admin).",
+        examples: ["dss user activity-get UserA",],
+    },
+};

package/dist/src/cli/commands/variable.js

@@ -1,4 +1,5 @@
 import { json, } from "../coerce.js";
+import { executionMode, } from "../flags.js";
 import { UsageError, } from "../usage.js";
 export const variableCommands = {
     get: {
@@ -15,7 +16,7 @@ export const variableCommands = {
             if (standard === undefined && local === undefined) {
                 throw new UsageError("--standard and/or --local is required.");
             }
-            if (f["dry-run"] === true) {
+            if (executionMode(f).dryRun) {
                 const current = await c.variables.get(pk);
                 const next = f["replace"] === true
                     ? { standard: standard ?? {}, local: local ?? {}, }

package/dist/src/cli/commands/webapp.js

@@ -2,6 +2,7 @@ import { ClientValidationError, } from "../../errors.js";
 import { deepMerge, } from "../../utils/deep-merge.js";
 import { stableHash, } from "../../utils/stable-hash.js";
 import { num, requiredJsonInput, } from "../coerce.js";
+import { executionMode, } from "../flags.js";
 import { requireArgs, } from "../usage.js";
 const UPDATE_SETTINGS_USAGE = "dss webapp update-settings <webappId> (--data JSON|--data-file PATH|--stdin) [--expect-hash SHA256] [--dry-run] [--project-key KEY]";
 const RESTART_USAGE = "dss webapp restart-backend <webappId> [--wait] [--timeout MS] [--poll-interval MS] [--project-key KEY]";
@@ -44,7 +45,7 @@ export const webappCommands = {
             const body = requiredJsonInput(f, "--data, --data-file, or --stdin is required (webapp settings).");
             const projectKey = f["project-key"];
             const expectHash = validateExpectHash(f["expect-hash"]);
-            if (f["dry-run"] === true) {
+            if (executionMode(f).dryRun) {
                 const current = await c.webapps.getSettings(a[0], projectKey);
                 const currentHash = stableHash(current);
                 if (expectHash !== undefined && currentHash !== expectHash.toLowerCase()) {

package/dist/src/cli/commands/wiki.js

@@ -1,5 +1,6 @@
 import { deepMerge, } from "../../utils/deep-merge.js";
 import { jsonInput, textInput, } from "../coerce.js";
+import { executionMode, } from "../flags.js";
 import { readIfExists, skipResult, } from "../output.js";
 import { requireArgs, UsageError, } from "../usage.js";
 export const wikiCommands = {
@@ -31,12 +32,12 @@ export const wikiCommands = {
                 throw new UsageError("--name is required. Usage: dss wiki create --name NAME");
             const content = textInput(f);
             const pk = f["project-key"];
-            if (f["if-not-exists"] === true || f["dry-run"] === true) {
+            if (f["if-not-exists"] === true || executionMode(f).dryRun) {
                 const existing = (await c.wiki.list(pk)).find((article) => article.article.name === name);
-                if (existing && f["if-not-exists"] === true && f["dry-run"] !== true) {
+                if (existing && f["if-not-exists"] === true && !executionMode(f).dryRun) {
                     return skipResult("wiki", existing.article.id, "exists", { current: existing, });
                 }
-                if (f["dry-run"] === true) {
+                if (executionMode(f).dryRun) {
                     return {
                         dryRun: true,
                         action: "create",
@@ -75,7 +76,7 @@ export const wikiCommands = {
             if (!data && content === undefined && name === undefined) {
                 throw new UsageError("--name, --content, --file, --data, --data-file, or --stdin is required.");
             }
-            if (f["dry-run"] === true) {
+            if (executionMode(f).dryRun) {
                 const current = await c.wiki.get(a[0], f["project-key"]);
                 const next = deepMerge(current, data ?? {});
                 if (name !== undefined) {
@@ -105,11 +106,11 @@ export const wikiCommands = {
         handler: async (c, a, f) => {
             requireArgs(a, 1, "dss wiki delete <id-or-name>");
             const pk = f["project-key"];
-            if (f["dry-run"] === true || f["if-exists"] === true) {
+            if (executionMode(f).dryRun || f["if-exists"] === true) {
                 const current = await readIfExists(() => c.wiki.get(a[0], pk));
                 if (!current)
                     return skipResult("wiki", a[0], "missing");
-                if (f["dry-run"] === true) {
+                if (executionMode(f).dryRun) {
                     return { dryRun: true, action: "delete", resource: "wiki", article: a[0], current, };
                 }
             }

package/dist/src/cli/contract.d.ts

@@ -99,13 +99,12 @@ export declare const AGENT_CONTRACT_USAGE = "dss agent contract [--fields PATHS]
 export declare const CLEANUP_USAGE = "dss cleanup --file PATH [--dry-run|--apply] [--continue-on-error]";
 export declare function isAllowedCleanupAction(resource: string, action: string): boolean;
 export declare function buildCommandSchemas(resource: string, action: string, flags: CommandFlagMetadata[], requiredFlags: string[], requiredOneOf: CommandFlagChoice[], payloadSchema: CommandPayloadSchema | undefined, outputShape: CommandOutputShape, usage: string): CommandAgentSchemas;
-export declare function inferRequiresProject(resource: string, action: string, usage: string): boolean;
 export declare function inferInputContract(usage: string): CommandInputContract;
 export declare function supportsCleanupLedger(resource: string, action: string): boolean;
 export declare function inferCleanupHint(resource: string, action: string): string | undefined;
-export declare function buildCommandRegistry(): Record<string, Record<string, CommandRegistryEntry>>;
+export declare function buildCommandRegistry(resourceFilter?: string): Record<string, Record<string, CommandRegistryEntry>>;
 export declare function agentContractJsonSchema(): Record<string, unknown>;
-export declare function commandActionSummary(registry: Record<string, Record<string, CommandRegistryEntry>>): Record<string, string[]>;
+export declare function commandActionSummary(): Record<string, string[]>;
 export declare function buildAgentContract(): Record<string, unknown>;
 export declare function commandPlanShape(resource: string, action: string, args: string[], flags: Record<string, string | boolean>, entry: CommandRegistryEntry, projectKey: string | undefined): {
     endpoint?: string;