wawesome 0.13.0 → 0.14.0

package/README.md

@@ -121,7 +121,9 @@ npx wawesome deploy
 | `npx wawesome domains detach <host>`    | Stop serving the app at a domain you attached                       |
 | `npx wawesome credentials`              | List deploy credentials: name, prefix, capabilities, Apps, last use |
 | `npx wawesome credentials mint <name>`  | Mint a deploy credential and print its secret, once                 |
+| `npx wawesome credentials regenerate <name>`| Replace a deploy credential's secret, keeping its name          |
 | `npx wawesome credentials revoke <name>`| Revoke a deploy credential by name or prefix                        |
+| `npx wawesome credentials delete <name>`| Delete a revoked or expired credential, freeing its name            |
 
 ---
 
@@ -292,9 +294,9 @@ keyboard to log in. It belongs to the workspace rather than to you: it keeps wor
 and revoking it does not end your own session. Once you have one, [Deploying from CI](#deploying-from-ci)
 is what to do with it.
 
-Minting, listing and revoking belong to the workspace owner. They are closed to deploy credentials
-themselves, whatever those carry, so a leaked credential cannot mint another. All three run on your
-ordinary `npx wawesome login` session.
+Minting, listing, regenerating, revoking and deleting belong to the workspace owner. They are closed
+to deploy credentials themselves, whatever those carry, so a leaked credential cannot mint another or
+renew its own expiry. All five run on your ordinary `npx wawesome login` session.
 
 ### Mint one
 
@@ -342,6 +344,27 @@ Name, displayable prefix, capabilities, Apps, last use and expiry. Never the sec
 platform no longer holds. `LAST USED` lags by a few minutes and reads `never` for a credential
 nothing has ever presented, which is a better reason to revoke one than any calendar date.
 
+### Rotate one
+
+```bash
+npx wawesome credentials regenerate ci-pipeline
+npx wawesome credentials regenerate ci --expires never --yes
+npx wawesome credentials regenerate ci-pipeline > secret.txt
+```
+
+Regenerating replaces the secret where it stands. The credential keeps its id, its name, its
+capabilities and the Apps it may reach, so the only thing to change in your CI settings is the secret
+itself. Its displayable prefix changes with it, since the prefix is what you match one against. The
+new secret is printed once, on stdout alone, exactly as at minting.
+
+It asks first, because anything holding the old secret stops working the moment this lands and has to
+be given the new one; `--yes` is the answer where nobody is at the keyboard. Without `--expires` the
+new secret lives ninety days, the same rule minting follows, including on a credential that never
+expired.
+
+An expired credential regenerates into a working one — that is the ordinary reason to reach for this.
+A revoked one is refused, because nothing un-revokes a credential.
+
 ### Revoke one
 
 ```bash
@@ -354,6 +377,22 @@ where nobody is at the keyboard, and a prefix naming more than one credential is
 guessed at. A revocation lands on the very next request presenting the secret, and nothing un-revokes
 it.
 
+### Delete one
+
+```bash
+npx wawesome credentials delete ci-pipeline
+npx wawesome credentials delete wawe_ab3k9x --yes
+```
+
+Deleting is a second act, not a shortcut through revoking, so only a credential that has already
+stopped working can be deleted. Revoke a live one first. It resolves its target the way revoking
+does, by name or by displayable prefix, and asks before it does it unless you pass `--yes`.
+
+What deleting gives up is the reason revoking left the record behind. The credential leaves the
+listing, the name comes free to mint again, and a pipeline still presenting the secret is told the
+secret is unknown rather than that somebody revoked it. Whoever is debugging that pipeline goes
+looking in their CI settings instead of your dashboard.
+
 ---
 
 ## Configuration and a custom gateway
@@ -666,8 +705,8 @@ While it is set:
 - a refusal names which of four things happened: the credential is unknown, revoked, expired, or does not carry what
   the command needs. It does not ask you to sign in again, which a pipeline cannot do;
 - `login` and `logout` refuse, because neither would change what the next command authenticates as;
-- `credentials` is refused by the platform, because minting, listing and revoking are closed to
-  credentials whatever they carry;
+- `credentials` is refused by the platform, because minting, listing, regenerating, revoking and
+  deleting are closed to credentials whatever they carry;
 - `whoami` names the credential by its prefix, so you can match it against the one in your CI settings.
 
 ---

package/dist/index.mjs

@@ -883,7 +883,7 @@ async function buildJs(entryInput, options) {
 * that has to name this version — `--version`, the dependency a scaffolded
 * project pins — reads it here, so a release bumps one file.
 */
-const CLI_VERSION = "0.13.0";
+const CLI_VERSION = "0.14.0";
 //#endregion
 //#region src/prompt.ts
 /**
@@ -4669,6 +4669,7 @@ async function workspaceCommand(action, target, options) {
 //#endregion
 //#region src/deploy-credentials.ts
 const SECRET_SHOWN_ONCE = "Copy it now. This is the only time it will be shown. If you lose it, revoke this credential and mint another.";
+const REGENERATED_SECRET_SHOWN_ONCE = "Copy it now. This is the only time it will be shown. If you lose it, regenerate this credential again.";
 function requireCredentials$1() {
 	const creds = readCredentials();
 	if (!creds) {
@@ -4750,6 +4751,18 @@ async function fetchCredentials(creds) {
 	if (!res.ok) throw await refusal(res, `Failed to read the credentials (HTTP ${res.status}).`);
 	return (await res.json()).credentials ?? [];
 }
+async function regenerateCredential(creds, credentialId, payload) {
+	const res = await authorizedFetch(`${creds.gateway_url}/v1/tenant/credentials/${encodeURIComponent(credentialId)}/regenerate`, {
+		method: "POST",
+		headers: {
+			Authorization: `Bearer ${creds.tenant_jwt}`,
+			"Content-Type": "application/json"
+		},
+		body: JSON.stringify(payload)
+	});
+	if (!res.ok) throw await refusal(res, `Failed to regenerate the credential (HTTP ${res.status}).`);
+	return await res.json();
+}
 async function revokeCredential(creds, credentialId) {
 	const res = await authorizedFetch(`${creds.gateway_url}/v1/tenant/credentials/${encodeURIComponent(credentialId)}/revoke`, {
 		method: "POST",
@@ -4758,6 +4771,13 @@ async function revokeCredential(creds, credentialId) {
 	if (!res.ok) throw await refusal(res, `Failed to revoke the credential (HTTP ${res.status}).`);
 	return await res.json();
 }
+async function deleteCredential(creds, credentialId) {
+	const res = await authorizedFetch(`${creds.gateway_url}/v1/tenant/credentials/${encodeURIComponent(credentialId)}`, {
+		method: "DELETE",
+		headers: { Authorization: `Bearer ${creds.tenant_jwt}` }
+	});
+	if (!res.ok) throw await refusal(res, `Failed to delete the credential (HTTP ${res.status}).`);
+}
 /**
 * Mint one credential.
 *
@@ -4785,12 +4805,22 @@ async function mintCredentialCommand(name, options) {
 	} catch (err) {
 		fail(errorText(err));
 	}
-	console.error(`\n[wawesome] ✔ Minted deploy credential '${credential.name}'.\n`);
+	reveal(`Minted deploy credential '${credential.name}'.`, credential, SECRET_SHOWN_ONCE);
+}
+/**
+* Hand the secret over, once.
+*
+* The secret goes to stdout on a line of its own and everything a person reads
+* goes to stderr, so `wawesome credentials mint ci > secret` writes the secret
+* and not one character besides.
+*/
+function reveal(headline, credential, shownOnce) {
+	console.error(`\n[wawesome] ✔ ${headline}\n`);
 	console.error(`  Prefix:       ${credential.prefix}`);
 	console.error(`  Capabilities: ${credential.capabilities.join(", ")}`);
 	console.error(`  Apps:         ${namedApps(credential.apps) ?? "every App in the workspace"}`);
 	console.error(`  Expires:      ${asUtc(credential.expires_at)}`);
-	console.error(`\n  ${SECRET_SHOWN_ONCE}\n`);
+	console.error(`\n  ${shownOnce}\n`);
 	console.log(credential.secret);
 	console.error("");
 }
@@ -4876,9 +4906,8 @@ function matchCredentials(credentials, target) {
 	const wanted = typed.startsWith("wawe_") ? credentialPrefix(typed) : typed;
 	return credentials.filter((credential) => credential.prefix.startsWith(wanted));
 }
-async function revokeCredentialCommand(target, options) {
-	if (!target || !target.trim()) fail("No credential given. Usage: wawesome credentials revoke <name-or-prefix>");
-	const creds = requireCredentials$1();
+/** The one credential a typed name or prefix means, or an exit saying why none. */
+async function resolveCredential(creds, target, options) {
 	if (options.verbose) console.error(`[wawesome:verbose] GET ${creds.gateway_url}/v1/tenant/credentials`);
 	let credentials;
 	try {
@@ -4889,7 +4918,57 @@ async function revokeCredentialCommand(target, options) {
 	const matched = matchCredentials(credentials, target);
 	if (matched.length === 0) fail(`No deploy credential named or prefixed '${asShown(target)}' in this workspace.`, "Run 'wawesome credentials list' to see what this workspace has.");
 	if (matched.length > 1) fail(`'${asShown(target)}' names more than one credential:`, ...matched.map((credential) => `  ${credential.name} (${credential.prefix})`), "Name one of them, or give more of its prefix.");
-	const credential = matched[0];
+	return matched[0];
+}
+/**
+* Replace a credential's secret where it stands, keeping the name a pipeline's
+* settings already refer to.
+*
+* Confirmed like a revoke, because it is one for whatever holds the old secret:
+* the pipeline stops on its very next request until somebody gives it the new
+* one.
+*/
+async function regenerateCredentialCommand(target, options) {
+	if (!target || !target.trim()) fail("No credential given. Usage: wawesome credentials regenerate <name-or-prefix>");
+	const creds = requireCredentials$1();
+	const credential = await resolveCredential(creds, target, options);
+	if (credential.revoked_at) fail(`'${credential.name}' (${credential.prefix}) was revoked at ${asUtc(credential.revoked_at)}, and nothing un-revokes one.`, `Mint a replacement, or delete this one first to free its name for it.`);
+	const payload = {};
+	const expiry = parseExpiry(options.expires);
+	if (expiry !== void 0) payload.expiry = expiry;
+	if (!options.yes) {
+		if (!isInteractive()) fail(`Regenerating asks for confirmation, and there is nobody to ask.`, `Pass --yes to regenerate '${credential.name}' (${credential.prefix}) without being asked.`);
+		let confirmed;
+		try {
+			confirmed = await confirm({
+				message: `Regenerate '${credential.name}' (${credential.prefix})? Anything holding the old secret stops working at once and has to be given the new one.`,
+				default: false
+			});
+		} catch {
+			confirmed = false;
+		}
+		if (!confirmed) {
+			console.error(`[wawesome] Cancelled. '${credential.name}' still works.`);
+			return;
+		}
+	}
+	if (options.verbose) {
+		console.error(`[wawesome:verbose] POST ${creds.gateway_url}/v1/tenant/credentials/${credential.id}/regenerate`);
+		console.error(`[wawesome:verbose] Payload: ${JSON.stringify(payload)}`);
+	}
+	let regenerated;
+	try {
+		regenerated = await regenerateCredential(creds, credential.id, payload);
+	} catch (err) {
+		if (err instanceof GatewayError && err.status === 404) fail(`'${credential.name}' (${credential.prefix}) no longer exists in this workspace.`);
+		fail(errorText(err));
+	}
+	reveal(`Regenerated '${regenerated.name}'. Anything still presenting the old secret is refused from its very next request.`, regenerated, REGENERATED_SECRET_SHOWN_ONCE);
+}
+async function revokeCredentialCommand(target, options) {
+	if (!target || !target.trim()) fail("No credential given. Usage: wawesome credentials revoke <name-or-prefix>");
+	const creds = requireCredentials$1();
+	const credential = await resolveCredential(creds, target, options);
 	if (credential.revoked_at) {
 		console.log(`[wawesome] '${credential.name}' (${credential.prefix}) was already revoked at ${asUtc(credential.revoked_at)}. Nothing to do.`);
 		return;
@@ -4921,11 +5000,49 @@ async function revokeCredentialCommand(target, options) {
 	console.log(`\n[wawesome] ✔ Revoked '${revoked.name}' (${revoked.prefix}).`);
 	console.log("[wawesome] Anything still presenting it is refused from its very next request.\n");
 }
+async function deleteCredentialCommand(target, options) {
+	if (!target || !target.trim()) fail("No credential given. Usage: wawesome credentials delete <name-or-prefix>");
+	const creds = requireCredentials$1();
+	const credential = await resolveCredential(creds, target, options);
+	const named = `'${credential.name}' (${credential.prefix})`;
+	if (statusOf(credential, Date.now()) === "active") fail(`${named} still works, and only a credential that has stopped working is deleted.`, `Revoke it first: wawesome credentials revoke ${credential.name}`);
+	if (!options.yes) {
+		if (!isInteractive()) fail("Deleting asks for confirmation, and there is nobody to ask.", `Pass --yes to delete ${named} without being asked.`);
+		console.log(`\n[wawesome] Deleting ${named} forgets it.`);
+		console.log(`[wawesome]   It leaves the listing, and the name '${credential.name}' comes free.`);
+		console.log("[wawesome]   Anything still presenting its secret is told the secret is unknown, rather");
+		console.log("[wawesome]   than that somebody here revoked it.\n");
+		let confirmed;
+		try {
+			confirmed = await confirm({
+				message: `Delete ${named}?`,
+				default: false
+			});
+		} catch {
+			confirmed = false;
+		}
+		if (!confirmed) {
+			console.log(`[wawesome] Cancelled. ${named} is still listed.`);
+			return;
+		}
+	}
+	if (options.verbose) console.error(`[wawesome:verbose] DELETE ${creds.gateway_url}/v1/tenant/credentials/${credential.id}`);
+	try {
+		await deleteCredential(creds, credential.id);
+	} catch (err) {
+		if (err instanceof GatewayError && err.status === 404) fail(`${named} no longer exists in this workspace.`);
+		fail(errorText(err));
+	}
+	console.log(`\n[wawesome] ✔ Deleted ${named}. The name '${credential.name}' is free again.`);
+	console.log("[wawesome] Anything still presenting its secret is told the secret is unknown.\n");
+}
 async function credentialsCommand(action, target, options) {
 	if (!action || action === "list" || action === "ls") return listCredentialsCommand(options);
 	if (action === "mint") return mintCredentialCommand(target, options);
+	if (action === "regenerate") return regenerateCredentialCommand(target, options);
 	if (action === "revoke") return revokeCredentialCommand(target, options);
-	fail(`Unknown credentials action '${action}'.`, "Usage: wawesome credentials [list|mint <name>|revoke <name-or-prefix>]");
+	if (action === "delete") return deleteCredentialCommand(target, options);
+	fail(`Unknown credentials action '${action}'.`, "Usage: wawesome credentials [list|mint <name>|regenerate <name-or-prefix>|revoke <name-or-prefix>|delete <name-or-prefix>]");
 }
 //#endregion
 //#region src/cron.ts
@@ -5386,7 +5503,7 @@ cli.command("logout", "Clear stored authentication credentials").action(() => lo
 cli.command("whoami", "Show current login session info").action(() => whoami());
 cli.command("workspace [action] [name]", "Show the workspace, or rename its public address").usage("workspace <action> [name]\n\nActions:\n  show                Show the workspace name, address, and whether it can still change\n  rename <name>       Change the public address, while nothing live depends on it").example("wawesome workspace").example("wawesome workspace rename northwind").option("-v, --verbose", "Enable verbose debug output").action((action, name, options) => workspaceCommand(action, name, options));
 cli.command("templates [action]", "Browse the template catalog").usage("templates [action]\n\nActions:\n  list (ls)           Show every available template (default)").example("wawesome templates").example("wawesome templates list").option("--api <url>", "API URL (default: https://api.wawesome.io)").option("-v, --verbose", "Enable verbose debug output").action((action, options) => templatesCommand(action, options));
-cli.command("credentials [action] [target]", "Mint, list and revoke deploy credentials").alias("credential").usage(`credentials <action> [options]
+cli.command("credentials [action] [target]", "Mint, list, regenerate, revoke and delete deploy credentials").alias("credential").usage(`credentials <action> [options]
 
   A deploy credential is what a CI pipeline or an agent authenticates with, where
   there is nobody at a keyboard to log in. Minting is the only time the secret is
@@ -5395,7 +5512,9 @@ cli.command("credentials [action] [target]", "Mint, list and revoke deploy crede
   Actions:
     list (ls)                       Show every credential: name, prefix, capabilities, Apps, last use, expiry (default)
     mint <name>                     Mint one, printing the secret exactly once
+    regenerate <name-or-prefix>     Replace one's secret, keeping its name, capabilities and Apps
     revoke <name-or-prefix>         Revoke one, immediately and for good
+    delete <name-or-prefix>         Forget a revoked or expired one, freeing its name
 
   Examples:
     wawesome credentials
@@ -5404,11 +5523,16 @@ cli.command("credentials [action] [target]", "Mint, list and revoke deploy crede
     wawesome credentials mint prod-deploy -c deploy -a prod --expires 30
     wawesome credentials mint ci -c deploy,domains:attach -a prod
     wawesome credentials mint ci-pipeline > /tmp/secret
+    wawesome credentials regenerate ci-pipeline
+    wawesome credentials regenerate ci --expires never --yes
     wawesome credentials revoke ci-pipeline
-    wawesome credentials revoke wawe_ab3k9x --yes`).option("-c, --capability <capability>", "Capability to grant: deploy, logs:read, domains:attach (repeatable or comma-separated, default: deploy)").option("-a, --app <app>", "Restrict the credential to this App (repeatable or comma-separated, default: every App)").option("--expires <days|never>", "Days until the credential expires, or 'never' (default: 90)").option("-y, --yes", "Skip the revoke confirmation").option("-v, --verbose", "Enable verbose debug output").action((action, target, options) => credentialsCommand(action, target, options));
+    wawesome credentials revoke wawe_ab3k9x --yes
+    wawesome credentials delete ci-pipeline`).option("-c, --capability <capability>", "Capability to grant: deploy, logs:read, domains:attach (repeatable or comma-separated, default: deploy)").option("-a, --app <app>", "Restrict the credential to this App (repeatable or comma-separated, default: every App)").option("--expires <days|never>", "Days until the credential expires, or 'never' (default: 90)").option("-y, --yes", "Skip the confirmation a regenerate, revoke or delete asks for").option("-v, --verbose", "Enable verbose debug output").action((action, target, options) => credentialsCommand(action, target, options));
 cli.command("credentials mint <name>", "Mint a deploy credential, printing its secret exactly once").option("-c, --capability <capability>", "Capability to grant: deploy, logs:read, domains:attach (repeatable or comma-separated)").option("-a, --app <app>", "Restrict the credential to this App (repeatable or comma-separated)").option("--expires <days|never>", "Days until the credential expires, or 'never' (default: 90)").option("-v, --verbose", "Enable verbose debug output").action((name, options) => mintCredentialCommand(name, options));
 cli.command("credentials list", "List deploy credentials, never their secrets").alias("credentials ls").option("-v, --verbose", "Enable verbose debug output").action((options) => listCredentialsCommand(options));
+cli.command("credentials regenerate <name-or-prefix>", "Replace a deploy credential's secret, keeping its name, capabilities and Apps").option("--expires <days|never>", "Days until the regenerated credential expires, or 'never' (default: 90)").option("-y, --yes", "Regenerate without being asked to confirm").option("-v, --verbose", "Enable verbose debug output").action((target, options) => regenerateCredentialCommand(target, options));
 cli.command("credentials revoke <name-or-prefix>", "Revoke a deploy credential, immediately and for good").option("-y, --yes", "Revoke without being asked to confirm").option("-v, --verbose", "Enable verbose debug output").action((target, options) => revokeCredentialCommand(target, options));
+cli.command("credentials delete <name-or-prefix>", "Delete a revoked or expired deploy credential, freeing its name").option("-y, --yes", "Delete without being asked to confirm").option("-v, --verbose", "Enable verbose debug output").action((target, options) => deleteCredentialCommand(target, options));
 cli.command("init", "Scaffold a new function project in the current directory").usage("init [options]\n\nWith --template, the project is fetched from the template catalog, wired up\nfrom what the template declares it needs, and deployed. Run 'wawesome templates'\nto see what is available.").example("wawesome init").example("wawesome init --template stripe-webhook").option("-t, --template <name>", "Scaffold from a catalog template and deploy it").option("--api <url>", "API URL (default: https://api.wawesome.io)").option("--dashboard <url>", "Dashboard URL (default: https://dashboard.wawesome.io)").option("--no-install", "Skip installing dependencies after scaffolding").option("--root", "Generate a root function router template").option("-v, --verbose", "Enable verbose debug output").action((options) => init(options));
 cli.command("logs [function-name-or-invocation-id]", "View invocation history, fetch log output, or follow live").usage(`logs [target] [options]
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wawesome",
-  "version": "0.13.0",
+  "version": "0.14.0",
   "description": "CLI tool for building and deploying serverless functions on wawesome.io platform",
   "type": "module",
   "bin": {