qatools-cli 1.1.3 → 1.1.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "qatools-cli",
-  "version": "1.1.3",
+  "version": "1.1.4",
   "description": "CLI for QA Tools — requirements, epics, sprints, sessions, App Context sync, project agenda. The companion to qa-tools.com.",
   "bin": {
     "qatools": "./qatools.js"

package/qatools.js

@@ -903,6 +903,14 @@ program
         next: `qatools requirement-update -i <id> --status approved  (or refine AC first)`,
       });
     }
+    if (data.agenda.accessModelMissing) {
+      sections.push({
+        icon: "⚪",
+        title: "No access model defined for this project",
+        items: ["  • Who can sign in? Which roles exist? What's protected? How is data isolated?"],
+        next: `qatools access show  (shows a minimal example)  →  qatools access set -f model.json`,
+      });
+    }
 
     if (sections.length === 0) {
       console.log("  ✓ Nothing on the agenda. The project is in a clean state.\n");
@@ -1370,6 +1378,116 @@ program
     process.exit(0);
   });
 
+// access subcommands grouped under 'access'
+const accessCmd = program
+  .command("access")
+  .description("Manage the project's Access Model (who-can-do-what, structured)");
+
+accessCmd
+  .command("show")
+  .description("Show the access model for the project")
+  .option("--project <id>", "Target project ID (overrides default)")
+  .option("-o, --output <path>", "Save to JSON file")
+  .option("--json", "Output JSON to stdout")
+  .option("-e, --email <email>", "Login email")
+  .option("-p, --password <password>", "Login password")
+  .action(async (options) => {
+    await authenticate(options);
+    const creds = getCredentials();
+    const projectId = options.project || creds?.projectId;
+    if (!projectId) { console.error("No project configured. Run: qatools setup, or pass --project <id>"); process.exit(1); }
+    const getModel = httpsCallable(functions, "getAccessModel");
+    let result;
+    try { result = await getModel({ projectId }); }
+    catch (e) { console.error("Failed:", e.message); process.exit(1); }
+    const model = result.data.accessModel;
+    if (!model) {
+      console.log(`No access model defined for this project.`);
+      console.log(`Define one by writing a JSON file and running: qatools access set -f model.json`);
+      console.log(``);
+      console.log(`Minimal shape:`);
+      console.log(JSON.stringify({
+        authMethods: [{ key: "google", description: "Google OAuth", primary: true }],
+        roles: [{ key: "owner", description: "Project owner with full control" }],
+        resources: [{ key: "project", description: "Project metadata", ownedBy: "project", permissions: [{ role: "owner", actions: ["read","create","update","delete"] }] }],
+        isolationRules: [{ scope: "project", description: "Data scoped by projectId field", enforcedBy: ["firestore.rules", "checkProjectAccess()"] }],
+      }, null, 2));
+      process.exit(0);
+    }
+    if (options.output) {
+      fs.writeFileSync(path.resolve(options.output), JSON.stringify(model, null, 2));
+      console.log(`Saved to ${options.output}`);
+      process.exit(0);
+    }
+    if (options.json) {
+      console.log(JSON.stringify(model, null, 2));
+      process.exit(0);
+    }
+    // Pretty text output
+    console.log(``);
+    console.log(`Access Model — project ${projectId}`);
+    console.log(``);
+    if (model.authMethods?.length) {
+      console.log(`AUTH METHODS`);
+      for (const a of model.authMethods) console.log(`  ${a.primary ? "*" : " "} ${a.key.padEnd(15)} ${a.description}`);
+      console.log(``);
+    }
+    if (model.roles?.length) {
+      console.log(`ROLES`);
+      for (const r of model.roles) {
+        const inh = r.inherits?.length ? ` (inherits: ${r.inherits.join(", ")})` : "";
+        console.log(`  ${r.key.padEnd(15)} ${r.description}${inh}`);
+      }
+      console.log(``);
+    }
+    if (model.resources?.length) {
+      console.log(`RESOURCES`);
+      for (const r of model.resources) {
+        const coll = r.collection ? ` [${r.collection}]` : "";
+        console.log(`  ${r.key}${coll} — owned by ${r.ownedBy}`);
+        console.log(`    ${r.description}`);
+        for (const p of (r.permissions || [])) {
+          const cond = p.condition ? ` (${p.condition})` : "";
+          console.log(`      ${p.role.padEnd(15)} ${p.actions.join(",")}${cond}`);
+        }
+      }
+      console.log(``);
+    }
+    if (model.isolationRules?.length) {
+      console.log(`ISOLATION RULES`);
+      for (const i of model.isolationRules) {
+        console.log(`  [${i.scope}] ${i.description}`);
+        if (i.enforcedBy?.length) console.log(`    enforced by: ${i.enforcedBy.join(", ")}`);
+      }
+      console.log(``);
+    }
+    process.exit(0);
+  });
+
+accessCmd
+  .command("set")
+  .description("Upload (replace) the entire access model from a JSON file")
+  .requiredOption("-f, --file <path>", "Path to access model JSON")
+  .option("--project <id>", "Target project ID (overrides default)")
+  .option("-e, --email <email>", "Login email")
+  .option("-p, --password <password>", "Login password")
+  .action(async (options) => {
+    await authenticate(options);
+    const creds = getCredentials();
+    const projectId = options.project || creds?.projectId;
+    if (!projectId) { console.error("No project configured. Run: qatools setup, or pass --project <id>"); process.exit(1); }
+    const model = JSON.parse(fs.readFileSync(path.resolve(options.file), "utf8"));
+    const saveModel = httpsCallable(functions, "saveAccessModel");
+    try {
+      const result = await saveModel({ projectId, model });
+      console.log(`Access model saved (${result.data.id}) — project ${projectId}`);
+    } catch (e) {
+      console.error("Failed:", e.message);
+      process.exit(1);
+    }
+    process.exit(0);
+  });
+
 program
   .command("epics")
   .description("List epics for the project")