instant-cli 1.0.21-branch-cli-codex.25186296431.1 → 1.0.21-branch-cli-codex.25187076703.1

package/.turbo/turbo-build.log

@@ -1,4 +1,4 @@
 
-> instant-cli@1.0.21-branch-cli-codex.25186296431.1 build /home/runner/work/instant/instant/client/packages/cli
+> instant-cli@1.0.21-branch-cli-codex.25187076703.1 build /home/runner/work/instant/instant/client/packages/cli
 > rm -rf dist; tsc -p tsconfig.build.json
 

package/__tests__/authClientUpdate.test.ts

@@ -4,6 +4,7 @@ import { NodeContext } from '@effect/platform-node';
 import { GlobalOpts } from '../src/context/globalOpts.ts';
 import { CurrentApp } from '../src/context/currentApp.ts';
 import { InstantHttpAuthed } from '../src/lib/http.ts';
+import { BadArgsError } from '../src/errors.ts';
 
 // Prevent src/index.ts side-effect (program.parse) from running.
 vi.mock('../src/index.ts', () => ({}));
@@ -17,7 +18,10 @@ vi.mock('../src/ui/lib.ts', async (importOriginal) => {
     ...orig,
     renderUnwrap: (prompt: any) => {
       prompts.push(prompt);
-      return Promise.resolve(mockPromptReturn);
+      const value = Array.isArray(mockPromptReturn)
+        ? mockPromptReturn.shift()
+        : mockPromptReturn;
+      return Promise.resolve(value);
     },
   };
 });
@@ -27,6 +31,7 @@ let mockClients: any[] = [];
 const providers = [
   { id: 'prov-google', provider_name: 'google' },
   { id: 'prov-github', provider_name: 'github' },
+  { id: 'prov-apple', provider_name: 'apple' },
   { id: 'prov-clerk', provider_name: 'clerk' },
   { id: 'prov-firebase', provider_name: 'firebase' },
 ];
@@ -37,6 +42,34 @@ vi.mock('../src/lib/oauth.ts', () => ({
       oauth_service_providers: providers,
       oauth_clients: mockClients,
     }),
+  findClientByIdOrName: ({ id, name }: { id?: string; name?: string }) =>
+    Effect.gen(function* () {
+      if (id && name) {
+        return yield* BadArgsError.make({
+          message: 'Cannot specify both --id and --name',
+        });
+      }
+      if (!id && !name) {
+        return yield* BadArgsError.make({
+          message: 'Must specify --id or --name',
+        });
+      }
+      const client = id
+        ? mockClients.find((entry) => entry.id === id)
+        : mockClients.find((entry) => entry.client_name === name);
+      if (!client) {
+        return yield* BadArgsError.make({
+          message: `OAuth client not found: ${id ?? name}`,
+        });
+      }
+      return {
+        client,
+        auth: {
+          oauth_service_providers: providers,
+          oauth_clients: mockClients,
+        },
+      };
+    }),
   updateOAuthClient: (params: any) => {
     updatedClients.push(params);
     const client = mockClients.find((c) => c.id === params.oauthClientId);
@@ -109,6 +142,16 @@ beforeEach(() => {
       client_name: 'github',
       client_id: 'old-gh-id',
     },
+    {
+      id: 'apple',
+      provider_id: 'prov-apple',
+      client_name: 'apple',
+      client_id: 'old.apple.service',
+      meta: {
+        teamId: 'OLDTEAM',
+        keyId: 'OLDKEY',
+      },
+    },
     {
       id: 'clerk',
       provider_id: 'prov-clerk',
@@ -165,13 +208,47 @@ describe('google', () => {
     expect(logs.join('\n')).toContain('Credentials: Instant dev credentials');
   });
 
+  test('rejects dev credentials with custom credential flags', async () => {
+    await run(
+      {
+        name: 'google-web',
+        'dev-credentials': true,
+        'client-id': 'new-google-id',
+      },
+      { yes: true },
+    );
+
+    expect(logs.join('\n')).toContain(
+      '--dev-credentials cannot be combined with --client-id',
+    );
+    expect(updatedClients).toHaveLength(0);
+  });
+
+  test('updates redirect URI only', async () => {
+    await run(
+      {
+        name: 'google-web',
+        'custom-redirect-uri': 'https://example.com/oauth/callback',
+      },
+      { yes: true },
+    );
+
+    expect(updatedClients).toHaveLength(1);
+    expect(updatedClients[0]).toMatchObject({
+      oauthClientId: 'google-web',
+      redirectTo: 'https://example.com/oauth/callback',
+    });
+    expect(updatedClients[0].clientId).toBeUndefined();
+    expect(updatedClients[0].clientSecret).toBeUndefined();
+  });
+
   test('interactive Google web update can select dev credentials', async () => {
-    mockPromptReturn = 'dev';
+    mockPromptReturn = 'dev-credentials';
     await run({ name: 'google-web' }, { yes: false });
 
     expect(prompts).toHaveLength(1);
     expect((prompts[0] as any).params.promptText).toBe(
-      'Select Google credential mode:',
+      'What do you want to update?',
     );
     expect(updatedClients[0]).toMatchObject({
       oauthClientId: 'google-web',
@@ -214,6 +291,60 @@ describe('provider credential updates', () => {
     expect(updatedClients[0].clientId).toBeUndefined();
   });
 
+  test('interactive GitHub update can select redirect URI', async () => {
+    mockPromptReturn = ['redirect', 'https://example.com/oauth/callback'];
+
+    await run({ name: 'github' }, { yes: false });
+
+    expect(prompts).toHaveLength(2);
+    expect((prompts[0] as any).params.promptText).toBe(
+      'What do you want to update?',
+    );
+    expect(updatedClients).toHaveLength(1);
+    expect(updatedClients[0]).toMatchObject({
+      oauthClientId: 'github',
+      redirectTo: 'https://example.com/oauth/callback',
+    });
+  });
+
+  test('updates Apple Services ID only', async () => {
+    await run(
+      {
+        name: 'apple',
+        'services-id': 'new.apple.service',
+      },
+      { yes: true },
+    );
+
+    expect(updatedClients).toHaveLength(1);
+    expect(updatedClients[0]).toMatchObject({
+      oauthClientId: 'apple',
+      clientId: 'new.apple.service',
+    });
+    expect(updatedClients[0].meta).toBeUndefined();
+  });
+
+  test('updates Apple team and key metadata', async () => {
+    await run(
+      {
+        name: 'apple',
+        'team-id': 'TEAM123',
+        'key-id': 'KEY456',
+      },
+      { yes: true },
+    );
+
+    expect(updatedClients).toHaveLength(1);
+    expect(updatedClients[0]).toMatchObject({
+      oauthClientId: 'apple',
+      meta: {
+        teamId: 'TEAM123',
+        keyId: 'KEY456',
+      },
+    });
+    expect(updatedClients[0].clientId).toBeUndefined();
+  });
+
   test('updates Clerk publishable key and discovery endpoint', async () => {
     await run(
       {
@@ -252,6 +383,19 @@ describe('provider credential updates', () => {
         'https://securetoken.google.com/my-app-123/.well-known/openid-configuration',
     });
   });
+
+  test('rejects invalid Firebase project ID', async () => {
+    await run(
+      {
+        name: 'firebase',
+        'project-id': 'BAD',
+      },
+      { yes: true },
+    );
+
+    expect(logs.join('\n')).toContain('Invalid Firebase project ID');
+    expect(updatedClients).toHaveLength(0);
+  });
 });
 
 describe('--yes validation', () => {
@@ -268,4 +412,31 @@ describe('--yes validation', () => {
     );
     expect(updatedClients).toHaveLength(0);
   });
+
+  test('rejects both id and name', async () => {
+    await run(
+      {
+        id: 'github',
+        name: 'github',
+        'client-secret': 'new-gh-secret',
+      },
+      { yes: true },
+    );
+
+    expect(logs.join('\n')).toContain('Cannot specify both --id and --name');
+    expect(updatedClients).toHaveLength(0);
+  });
+
+  test('rejects unknown client name', async () => {
+    await run(
+      {
+        name: 'unknown',
+        'client-secret': 'new-gh-secret',
+      },
+      { yes: true },
+    );
+
+    expect(logs.join('\n')).toContain('OAuth client not found');
+    expect(updatedClients).toHaveLength(0);
+  });
 });

package/dist/commands/auth/client/update.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../../../src/commands/auth/client/update.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAG9C,OAAO,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAupB5D,eAAO,MAAM,mBAAmB;;;;;ieA6D/B,CAAC"}
+{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../../../src/commands/auth/client/update.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAG9C,OAAO,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AA6rB5D,eAAO,MAAM,mBAAmB;;;;;ieAqE/B,CAAC"}

package/dist/commands/auth/client/update.js

@@ -3,7 +3,7 @@ import { FileSystem } from '@effect/platform';
 import { BadArgsError } from "../../../errors.js";
 import { GlobalOpts } from "../../../context/globalOpts.js";
 import { optOrPrompt, runUIEffect, validateRequired } from "../../../lib/ui.js";
-import { getAppsAuth, updateOAuthClient } from "../../../lib/oauth.js";
+import { findClientByIdOrName, getAppsAuth, updateOAuthClient, } from "../../../lib/oauth.js";
 import { UI } from "../../../ui/index.js";
 import { DEFAULT_OAUTH_CALLBACK_URL } from '@instantdb/platform';
 import chalk from 'chalk';
@@ -48,22 +48,24 @@ const clientSecretPrompt = (provider) => ({
         UI.modifiers.dimOnComplete,
     ]),
 });
-const redirectPrompt = {
+const makeRedirectPrompt = (heading) => ({
     prompt: '',
     placeholder: 'https://yoursite.com/oauth/callback',
     modifyOutput: UI.modifiers.piped([
         (output, status) => {
             if (status === 'idle') {
-                return (`\nCustom redirect URI (optional):
+                return (`\n${heading}
 ${chalk.dim('With a custom redirect URI, users will see "Redirecting to yoursite.com..." for a more branded experience.')}
 ${chalk.dim(`Your URI must forward to ${DEFAULT_OAUTH_CALLBACK_URL} with all query parameters preserved.`)}\n\n` +
                     output.replace(/^\n/, ''));
             }
-            return `\nCustom redirect URI (optional):\n${output.replace(/^\n/, '')}`;
+            return `\n${heading}\n${output.replace(/^\n/, '')}`;
         },
         UI.modifiers.dimOnComplete,
     ]),
-};
+});
+const redirectPrompt = makeRedirectPrompt('Custom redirect URI (optional):');
+const newRedirectPrompt = makeRedirectPrompt('New redirect URI:');
 const readPrivateKeyFile = Effect.fn('readPrivateKeyFile')(function* (path) {
     const fs = yield* FileSystem.FileSystem;
     const normalizedPath = process.platform === 'win32' ? path : path.replace(/\\(.)/g, '$1');
@@ -123,26 +125,11 @@ const resolveClient = Effect.fn(function* (params) {
         modifyOutput: UI.modifiers.piped([UI.modifiers.dimOnComplete]),
     })).pipe(Effect.catchTag('UIError', (e) => BadArgsError.make({ message: `UI error: ${e.message}` })));
 });
-const selectGoogleCredentialMode = Effect.fn(function* () {
+const selectUpdateAction = Effect.fn(function* (options) {
     return yield* runUIEffect(new UI.Select({
-        options: [
-            {
-                label: 'Use my own credentials' +
-                    chalk.dim(' (client ID and secret from Google Console)'),
-                value: 'custom',
-            },
-            {
-                label: 'Use dev credentials' +
-                    chalk.dim(' (works on localhost and Expo, no Google setup)'),
-                value: 'dev',
-            },
-        ],
-        promptText: 'Select Google credential mode:',
-        modifyOutput: UI.modifiers.piped([
-            UI.modifiers.topPadding,
-            UI.modifiers.dimOnComplete,
-        ]),
-        defaultValue: 'custom',
+        options,
+        promptText: 'What do you want to update?',
+        modifyOutput: UI.modifiers.piped([UI.modifiers.dimOnComplete]),
     })).pipe(Effect.catchTag('UIError', (e) => BadArgsError.make({ message: `UI error: ${e.message}` })));
 });
 const updateGoogleToDevCredentials = Effect.fn(function* (client) {
@@ -162,6 +149,7 @@ const updateGoogleToDevCredentials = Effect.fn(function* (client) {
 });
 const handleGoogleUpdate = Effect.fn(function* (opts, client) {
     const { yes } = yield* GlobalOpts;
+    const consoleUrl = link('https://console.developers.google.com/apis/credentials');
     const appType = metaString(client, 'appType');
     const isWeb = appType === 'web' || appType === undefined;
     const devCredentialsFlag = isTrueFlag(getFlag(opts, 'dev-credentials'));
@@ -202,28 +190,59 @@ const handleGoogleUpdate = Effect.fn(function* (opts, client) {
             message: 'Must specify at least one of --client-id, --client-secret, --custom-redirect-uri, or --dev-credentials.',
         });
     }
-    const selectedMode = isWeb && !hasAnyUpdateFlag && !yes
-        ? yield* selectGoogleCredentialMode()
-        : 'custom';
-    if (selectedMode === 'dev') {
-        return yield* updateGoogleToDevCredentials(client);
-    }
-    const promptAll = !hasAnyUpdateFlag && !yes;
     const switchingFromShared = Boolean(client.use_shared_credentials);
+    if (!hasAnyUpdateFlag && !yes) {
+        yield* Effect.log(`\nCurrent mode: ${switchingFromShared
+            ? chalk.bold('Instant dev credentials')
+            : 'custom credentials'}`);
+        if (!switchingFromShared) {
+            const action = yield* selectUpdateAction([
+                { label: 'Rotate credentials', value: 'rotate' },
+                {
+                    label: 'Switch to Instant dev credentials' +
+                        chalk.dim(' (localhost and Expo, no Google setup)'),
+                    value: 'dev-credentials',
+                },
+                { label: 'Update redirect URI', value: 'redirect' },
+            ]);
+            if (action === 'dev-credentials') {
+                return yield* updateGoogleToDevCredentials(client);
+            }
+            if (action === 'redirect') {
+                const redirectTo = yield* promptFlag(opts, 'custom-redirect-uri', {
+                    promptIf: true,
+                    required: true,
+                    prompt: newRedirectPrompt,
+                });
+                const response = yield* updateOAuthClient({
+                    oauthClientId: client.id,
+                    redirectTo,
+                });
+                yield* Effect.log(boxen([
+                    `Google OAuth client updated: ${response.client.client_name}`,
+                    `ID: ${response.client.id}`,
+                    `Redirect URI: ${redirectTo}`,
+                ].join('\n'), { dimBorder: true, padding: { right: 1, left: 1 } }));
+                return;
+            }
+        }
+    }
+    const promptCredentials = !hasAnyUpdateFlag && !yes;
     const clientId = yield* promptFlag(opts, 'client-id', {
-        promptIf: promptAll || (switchingFromShared && !hasFlag(opts, 'client-id')),
-        required: promptAll || switchingFromShared,
-        prompt: clientIdPrompt(link('https://console.developers.google.com/apis/credentials')),
+        promptIf: promptCredentials || (switchingFromShared && !hasFlag(opts, 'client-id')),
+        required: promptCredentials || switchingFromShared,
+        prompt: clientIdPrompt(consoleUrl),
     });
     const clientSecret = yield* promptFlag(opts, 'client-secret', {
         promptIf: isWeb &&
-            (promptAll || (switchingFromShared && !hasFlag(opts, 'client-secret'))),
-        required: isWeb && (promptAll || switchingFromShared),
-        prompt: clientSecretPrompt(link('https://console.developers.google.com/apis/credentials')),
+            (promptCredentials ||
+                (switchingFromShared && !hasFlag(opts, 'client-secret'))),
+        required: isWeb && (promptCredentials || switchingFromShared),
+        prompt: clientSecretPrompt(consoleUrl),
     });
     const customRedirectUri = isWeb
         ? yield* promptFlag(opts, 'custom-redirect-uri', {
-            promptIf: promptAll,
+            promptIf: switchingFromShared && promptCredentials,
             required: false,
             prompt: redirectPrompt,
         })
@@ -266,21 +285,30 @@ const handleClientIdSecretUpdate = Effect.fn(function* (params) {
             message: 'Must specify at least one of --client-id, --client-secret, or --custom-redirect-uri.',
         });
     }
-    const promptAll = !hasAnyUpdateFlag && !yes;
+    let promptCredentials = false;
+    let promptRedirect = false;
+    if (!hasAnyUpdateFlag && !yes) {
+        const action = yield* selectUpdateAction([
+            { label: 'Rotate credentials', value: 'rotate' },
+            { label: 'Update redirect URI', value: 'redirect' },
+        ]);
+        promptCredentials = action === 'rotate';
+        promptRedirect = action === 'redirect';
+    }
     const clientId = yield* promptFlag(params.opts, 'client-id', {
-        promptIf: promptAll,
-        required: promptAll,
+        promptIf: promptCredentials,
+        required: promptCredentials,
         prompt: clientIdPrompt(link(params.providerUrl)),
     });
     const clientSecret = yield* promptFlag(params.opts, 'client-secret', {
-        promptIf: promptAll,
-        required: promptAll,
+        promptIf: promptCredentials,
+        required: promptCredentials,
         prompt: clientSecretPrompt(link(params.providerUrl)),
     });
     const customRedirectUri = yield* promptFlag(params.opts, 'custom-redirect-uri', {
-        promptIf: promptAll,
-        required: false,
-        prompt: redirectPrompt,
+        promptIf: promptRedirect,
+        required: promptRedirect,
+        prompt: promptRedirect ? newRedirectPrompt : redirectPrompt,
     });
     const response = yield* updateOAuthClient({
         oauthClientId: params.client.id,
@@ -475,42 +503,48 @@ const handleFirebaseUpdate = Effect.fn(function* (opts, client) {
 });
 export const authClientUpdateCmd = Effect.fn(function* (opts) {
     const { yes } = yield* GlobalOpts;
-    const auth = yield* getAppsAuth();
-    const client = yield* resolveClient({
-        id: getFlag(opts, 'id'),
-        name: getFlag(opts, 'name'),
-        yes,
-        clients: (auth.oauth_clients ?? []),
-    });
-    const provider = (auth.oauth_service_providers ?? []).find((entry) => entry.id === client.provider_id);
+    const id = getFlag(opts, 'id');
+    const name = getFlag(opts, 'name');
+    const { auth, client } = id || name
+        ? yield* findClientByIdOrName({ id, name })
+        : {
+            auth: yield* getAppsAuth(),
+            client: undefined,
+        };
+    const resolvedClient = client ??
+        (yield* resolveClient({
+            yes,
+            clients: (auth.oauth_clients ?? []),
+        }));
+    const provider = (auth.oauth_service_providers ?? []).find((entry) => entry.id === resolvedClient.provider_id);
     if (!provider) {
         return yield* BadArgsError.make({
-            message: `OAuth provider not found for client: ${client.client_name}`,
+            message: `OAuth provider not found for client: ${resolvedClient.client_name}`,
         });
     }
     switch (provider.provider_name) {
         case 'google':
-            return yield* handleGoogleUpdate(opts, client);
+            return yield* handleGoogleUpdate(opts, resolvedClient);
         case 'github':
             return yield* handleClientIdSecretUpdate({
                 opts,
-                client,
+                client: resolvedClient,
                 providerLabel: 'GitHub',
                 providerUrl: 'https://github.com/settings/developers',
             });
         case 'linkedin':
             return yield* handleClientIdSecretUpdate({
                 opts,
-                client,
+                client: resolvedClient,
                 providerLabel: 'LinkedIn',
                 providerUrl: 'https://www.linkedin.com/developers/apps',
             });
         case 'apple':
-            return yield* handleAppleUpdate(opts, client);
+            return yield* handleAppleUpdate(opts, resolvedClient);
         case 'clerk':
-            return yield* handleClerkUpdate(opts, client);
+            return yield* handleClerkUpdate(opts, resolvedClient);
         case 'firebase':
-            return yield* handleFirebaseUpdate(opts, client);
+            return yield* handleFirebaseUpdate(opts, resolvedClient);
         default:
             return yield* BadArgsError.make({
                 message: `Updating ${provider.provider_name} OAuth clients is not supported.`,