securewithtrace 0.14.1 → 0.16.0

package/README.md

@@ -66,12 +66,17 @@ tracecli vulnerabilities list --severity HIGH
 tracecli auth login
 tracecli auth status
 tracecli auth logout
-tracecli auth org list
-tracecli auth org current
-tracecli auth org switch <organization-id-or-slug>
 ```
 
-When your account belongs to multiple organizations, use `tracecli auth org switch` to set the active organization context used by repository, vulnerability, and pentest commands.
+### Organization context
+
+```bash
+tracecli org list
+tracecli org current
+tracecli org switch <organization-id-or-slug>
+```
+
+When your account belongs to multiple organizations, use `tracecli org switch` to set the active organization context used by repository, vulnerability, and pentest commands.
 
 ### Repositories
 

package/dist/index.js

@@ -22645,6 +22645,7 @@ var PatchCapabilitiesResponseSchema = external_exports.object({
 });
 var OrganizationResponseSchema = external_exports.object({
   organizationId: external_exports.uuid(),
+  workosOrganizationId: external_exports.string().optional(),
   name: external_exports.string(),
   slug: external_exports.string(),
   logoUrl: external_exports.string().nullable(),
@@ -22671,6 +22672,15 @@ var organizationContract = c9.router({
       500: ErrorResponseSchema
     }
   },
+  listMyOrganizations: {
+    method: "GET",
+    path: "/users/me/organizations",
+    responses: {
+      200: ListOrganizationsResponseSchema,
+      401: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
   getOrganization: {
     method: "GET",
     path: "/organizations/:organizationId",
@@ -24692,17 +24702,21 @@ async function pollForToken(clientId, deviceCode, options = {}) {
   }
   throw new Error("Authorization timed out. Please try again.");
 }
-async function refreshAccessToken(clientId, refreshToken) {
+async function refreshAccessToken(clientId, refreshToken, organizationId) {
+  const body = new URLSearchParams({
+    grant_type: "refresh_token",
+    client_id: clientId,
+    refresh_token: refreshToken
+  });
+  if (organizationId && organizationId.trim().length > 0) {
+    body.set("organization_id", organizationId);
+  }
   const response = await fetch(WORKOS_TOKEN_URL, {
     method: "POST",
     headers: {
       "Content-Type": "application/x-www-form-urlencoded"
     },
-    body: new URLSearchParams({
-      grant_type: "refresh_token",
-      client_id: clientId,
-      refresh_token: refreshToken
-    })
+    body
   });
   if (!response.ok) {
     const text = await response.text();
@@ -24890,6 +24904,24 @@ async function refreshStoredAccessToken() {
     return null;
   }
 }
+async function refreshStoredAccessTokenForOrganization(workosOrganizationId) {
+  const clientId = getWorkosClientId();
+  const refreshToken = readRefreshToken();
+  if (!clientId || !refreshToken) {
+    return false;
+  }
+  try {
+    const tokenResponse = await refreshAccessToken(clientId, refreshToken, workosOrganizationId);
+    const nextRefreshToken = tokenResponse.refresh_token ?? refreshToken;
+    writeTokens(tokenResponse.access_token, nextRefreshToken);
+    return true;
+  } catch (error48) {
+    if (error48 instanceof Error && (error48.message.includes(" 400 ") || error48.message.includes(" 401 "))) {
+      removeToken();
+    }
+    return false;
+  }
+}
 async function authenticatedRequest(request) {
   const token = readToken();
   if (!token) {
@@ -24953,8 +24985,8 @@ function determineActiveOrganization(organizations, selectedOrganizationId) {
   };
 }
 async function resolveOrganizationId(client) {
-  const result = client ? await client.organization.listOrganizations() : await authenticatedRequest(
-    (authenticatedClient) => authenticatedClient.organization.listOrganizations()
+  const result = client ? await client.organization.listMyOrganizations() : await authenticatedRequest(
+    (authenticatedClient) => authenticatedClient.organization.listMyOrganizations()
   );
   if (result.status !== 200) {
     console.error(`Failed to resolve organization (status ${result.status}).`);
@@ -24987,8 +25019,8 @@ async function resolveOrganizationId(client) {
 }
 async function resolveOrganizationIdSafe(client) {
   try {
-    const result = client ? await client.organization.listOrganizations() : await authenticatedRequestSafe(
-      (authenticatedClient) => authenticatedClient.organization.listOrganizations()
+    const result = client ? await client.organization.listMyOrganizations() : await authenticatedRequestSafe(
+      (authenticatedClient) => authenticatedClient.organization.listMyOrganizations()
     );
     if (!result) {
       return null;
@@ -25083,7 +25115,7 @@ function isSafeOrganizationId(organizationId) {
   return SAFE_ORGANIZATION_ID_PATTERN.test(organizationId);
 }
 async function fetchOrganizationContext() {
-  const result = await authenticatedRequest((client) => client.organization.listOrganizations());
+  const result = await authenticatedRequest((client) => client.organization.listMyOrganizations());
   if (result.status !== 200) {
     console.error(`Failed to list organizations (status ${result.status}).`);
     process.exit(1);
@@ -25163,9 +25195,15 @@ Use an organization ID or exact slug.`
     };
   }
   return {
-    error: `Organization '${input}' not found. Run \`tracecli auth org list\` to see available organizations.`
+    error: `Organization '${input}' not found. Run \`tracecli org list\` to see available organizations.`
   };
 }
+async function refreshAfterOrganizationSwitch(workosOrganizationId, refreshForOrganization = (organizationId) => refreshStoredAccessTokenForOrganization(organizationId)) {
+  if (!workosOrganizationId || workosOrganizationId.trim().length === 0) {
+    return false;
+  }
+  return refreshForOrganization(workosOrganizationId);
+}
 function createLoginCommand() {
   return new Command("login").description("Authenticate with Trace").action(async () => {
     const existingToken = readToken();
@@ -25342,10 +25380,18 @@ function createOrgSwitchCommand() {
       process.exit(1);
     }
     writeSelectedOrganizationId(match.organization.organizationId);
+    const refreshed = await refreshAfterOrganizationSwitch(
+      match.organization.workosOrganizationId
+    );
     console.log(
       `Active organization set to ${sanitizeForOutput(match.organization.name)} (${sanitizeForOutput(match.organization.slug)})`
     );
     console.log(`  Org ID: ${match.organization.organizationId}`);
+    if (!refreshed) {
+      console.warn(
+        "Token refresh for the selected organization was not completed. If repository commands fail, run `tracecli auth login` again."
+      );
+    }
   });
 }
 function createOrgCommand() {
@@ -25360,7 +25406,7 @@ function createAuthCommand() {
   auth.addCommand(createLoginCommand());
   auth.addCommand(createLogoutCommand());
   auth.addCommand(createStatusCommand());
-  auth.addCommand(createOrgCommand());
+  auth.addCommand(createOrgCommand(), { hidden: true });
   return auth;
 }
 
@@ -26737,6 +26783,7 @@ program2.action(() => {
   program2.outputHelp();
 });
 program2.addCommand(createAuthCommand());
+program2.addCommand(createOrgCommand());
 program2.addCommand(createRepoCommand());
 program2.addCommand(createVulnerabilitiesCommand());
 program2.addCommand(createPentestCommand());

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "securewithtrace",
-  "version": "0.14.1",
+  "version": "0.16.0",
   "description": "Official Trace CLI for vulnerability intelligence in your terminal",
   "type": "module",
   "bin": {