qatools-cli 1.1.2 → 1.1.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "qatools-cli",
-  "version": "1.1.2",
+  "version": "1.1.4",
   "description": "CLI for QA Tools — requirements, epics, sprints, sessions, App Context sync, project agenda. The companion to qa-tools.com.",
   "bin": {
     "qatools": "./qatools.js"

package/qatools.js

@@ -903,6 +903,14 @@ program
         next: `qatools requirement-update -i <id> --status approved  (or refine AC first)`,
       });
     }
+    if (data.agenda.accessModelMissing) {
+      sections.push({
+        icon: "⚪",
+        title: "No access model defined for this project",
+        items: ["  • Who can sign in? Which roles exist? What's protected? How is data isolated?"],
+        next: `qatools access show  (shows a minimal example)  →  qatools access set -f model.json`,
+      });
+    }
 
     if (sections.length === 0) {
       console.log("  ✓ Nothing on the agenda. The project is in a clean state.\n");
@@ -1370,6 +1378,116 @@ program
     process.exit(0);
   });
 
+// access subcommands grouped under 'access'
+const accessCmd = program
+  .command("access")
+  .description("Manage the project's Access Model (who-can-do-what, structured)");
+
+accessCmd
+  .command("show")
+  .description("Show the access model for the project")
+  .option("--project <id>", "Target project ID (overrides default)")
+  .option("-o, --output <path>", "Save to JSON file")
+  .option("--json", "Output JSON to stdout")
+  .option("-e, --email <email>", "Login email")
+  .option("-p, --password <password>", "Login password")
+  .action(async (options) => {
+    await authenticate(options);
+    const creds = getCredentials();
+    const projectId = options.project || creds?.projectId;
+    if (!projectId) { console.error("No project configured. Run: qatools setup, or pass --project <id>"); process.exit(1); }
+    const getModel = httpsCallable(functions, "getAccessModel");
+    let result;
+    try { result = await getModel({ projectId }); }
+    catch (e) { console.error("Failed:", e.message); process.exit(1); }
+    const model = result.data.accessModel;
+    if (!model) {
+      console.log(`No access model defined for this project.`);
+      console.log(`Define one by writing a JSON file and running: qatools access set -f model.json`);
+      console.log(``);
+      console.log(`Minimal shape:`);
+      console.log(JSON.stringify({
+        authMethods: [{ key: "google", description: "Google OAuth", primary: true }],
+        roles: [{ key: "owner", description: "Project owner with full control" }],
+        resources: [{ key: "project", description: "Project metadata", ownedBy: "project", permissions: [{ role: "owner", actions: ["read","create","update","delete"] }] }],
+        isolationRules: [{ scope: "project", description: "Data scoped by projectId field", enforcedBy: ["firestore.rules", "checkProjectAccess()"] }],
+      }, null, 2));
+      process.exit(0);
+    }
+    if (options.output) {
+      fs.writeFileSync(path.resolve(options.output), JSON.stringify(model, null, 2));
+      console.log(`Saved to ${options.output}`);
+      process.exit(0);
+    }
+    if (options.json) {
+      console.log(JSON.stringify(model, null, 2));
+      process.exit(0);
+    }
+    // Pretty text output
+    console.log(``);
+    console.log(`Access Model — project ${projectId}`);
+    console.log(``);
+    if (model.authMethods?.length) {
+      console.log(`AUTH METHODS`);
+      for (const a of model.authMethods) console.log(`  ${a.primary ? "*" : " "} ${a.key.padEnd(15)} ${a.description}`);
+      console.log(``);
+    }
+    if (model.roles?.length) {
+      console.log(`ROLES`);
+      for (const r of model.roles) {
+        const inh = r.inherits?.length ? ` (inherits: ${r.inherits.join(", ")})` : "";
+        console.log(`  ${r.key.padEnd(15)} ${r.description}${inh}`);
+      }
+      console.log(``);
+    }
+    if (model.resources?.length) {
+      console.log(`RESOURCES`);
+      for (const r of model.resources) {
+        const coll = r.collection ? ` [${r.collection}]` : "";
+        console.log(`  ${r.key}${coll} — owned by ${r.ownedBy}`);
+        console.log(`    ${r.description}`);
+        for (const p of (r.permissions || [])) {
+          const cond = p.condition ? ` (${p.condition})` : "";
+          console.log(`      ${p.role.padEnd(15)} ${p.actions.join(",")}${cond}`);
+        }
+      }
+      console.log(``);
+    }
+    if (model.isolationRules?.length) {
+      console.log(`ISOLATION RULES`);
+      for (const i of model.isolationRules) {
+        console.log(`  [${i.scope}] ${i.description}`);
+        if (i.enforcedBy?.length) console.log(`    enforced by: ${i.enforcedBy.join(", ")}`);
+      }
+      console.log(``);
+    }
+    process.exit(0);
+  });
+
+accessCmd
+  .command("set")
+  .description("Upload (replace) the entire access model from a JSON file")
+  .requiredOption("-f, --file <path>", "Path to access model JSON")
+  .option("--project <id>", "Target project ID (overrides default)")
+  .option("-e, --email <email>", "Login email")
+  .option("-p, --password <password>", "Login password")
+  .action(async (options) => {
+    await authenticate(options);
+    const creds = getCredentials();
+    const projectId = options.project || creds?.projectId;
+    if (!projectId) { console.error("No project configured. Run: qatools setup, or pass --project <id>"); process.exit(1); }
+    const model = JSON.parse(fs.readFileSync(path.resolve(options.file), "utf8"));
+    const saveModel = httpsCallable(functions, "saveAccessModel");
+    try {
+      const result = await saveModel({ projectId, model });
+      console.log(`Access model saved (${result.data.id}) — project ${projectId}`);
+    } catch (e) {
+      console.error("Failed:", e.message);
+      process.exit(1);
+    }
+    process.exit(0);
+  });
+
 program
   .command("epics")
   .description("List epics for the project")
@@ -1863,6 +1981,12 @@ Every claim, verdict, analysis, and recommendation MUST cite specific evidence:
 
 ## If you're unsure
 Say "I'm unsure" — that's better than guessing. Suggest what evidence would resolve the uncertainty.
+
+## Specialized skills
+
+There is a specific skill for **algorithmic and numerical** bugs: \`qa-numerical-verification.md\`. Read it when you're fixing a formula or any code where the bug is "wrong number" rather than "wrong structure".
+
+If you encounter a different recurring bug class that needs its own verification pattern (UI regressions, race conditions, data integrity, etc.), create a NEW specific skill (\`qa-<class>-verification.md\`) rather than expanding this file or building a monolithic "fix-checklist". The pattern is: principle here, specific category in its own skill, CLI enforces evidence regardless of category. Don't build a generic checklist for hypothetical categories — let real biting cases drive the need.
 `,
       "qa-numerical-verification.md": `---
 description: How to verify algorithmic and numerical bug fixes. Read this when fixing a formula, calculation, or any code where the bug is "wrong number" rather than "wrong structure".
@@ -1874,6 +1998,18 @@ Most evidence-first examples deal with structural bugs (NullReferenceException,
 
 This skill is for those bugs. The verification pattern is non-negotiable.
 
+## Before you start — entry-point checklist
+
+Stop here and answer these BEFORE writing any verification code:
+
+- [ ] Which input or test case actually triggers the bug? (Not "the system" — name a specific input.)
+- [ ] Does that input have non-zero, non-default values for the field the bug touches? (If everything is 0 or NULL, multiplying by anything gives the same result — the input cannot discriminate buggy from fixed code.)
+- [ ] If your input is non-discriminating: change it, or pick a different input. Never proceed with "the data doesn't show it".
+- [ ] Where will you write the expected and actual values? Answer: in the --evidence flag when you set status. If the values are large, also save them to a file you reference in evidence ("see /tmp/verify-2026-04-08.txt").
+- [ ] Can you compute the expected value by hand from the formula in under 60 seconds? If not, the formula is too complex for this verification — break it into pieces and verify each.
+
+If any answer is "I don't know", stop and ask. Don't guess.
+
 ## The pattern
 
 1. **Trivialize the input.** Pick values that make the formula readable. Set multipliers to 1, set inputs to round numbers (10, 100), set toggles to known states.