zeuslock-dlp-cli 0.2.0

package/src/commands/tokens.js

@@ -0,0 +1,293 @@
+import { Command } from "commander";
+
+import { requestAuthenticatedJson } from "../lib/api-client.js";
+import { maskCliToken } from "../lib/cli-token.js";
+import { promptText } from "../lib/prompt.js";
+import { dash, formatTable } from "../lib/table.js";
+
+const TOKEN_STATUSES = ["all", "active", "revoked", "expired"];
+
+export function createTokensCommand({
+  stdin = process.stdin,
+  stdout = process.stdout,
+  env = process.env
+} = {}) {
+  const command = new Command("tokens")
+    .description("Manage personal CLI access tokens");
+
+  command.addCommand(createTokensCreateCommand({ stdout, env }));
+  command.addCommand(createTokensListCommand({ stdout, env }));
+  command.addCommand(createTokensRevokeCommand({ stdin, stdout, env }));
+  command.addCommand(createTokensPurgeCommand({ stdin, stdout, env }));
+
+  return command;
+}
+
+function createTokensCreateCommand({ stdout, env }) {
+  return new Command("create")
+    .description("Create a personal CLI access token")
+    .requiredOption("--name <name>", "CLI token name")
+    .option("--expires-in-days <days>", "token lifetime in days, 1 to 365")
+    .option("--json", "print machine-readable output")
+    .action(async (options) => {
+      const name = parseTokenName(options.name);
+      const expiresInDays = parseExpiresInDays(options.expiresInDays);
+      const body = { name };
+      if (expiresInDays !== null) {
+        body.expires_in_days = expiresInDays;
+      }
+
+      const created = normalizeCliToken(await requestAuthenticatedJson("/api/v1/cli-tokens", {
+        env,
+        method: "POST",
+        body
+      }));
+      const output = {
+        created: true,
+        token: serializeToken(created, { showSecret: true })
+      };
+
+      if (options.json) {
+        stdout.write(`${JSON.stringify(output)}\n`);
+        return;
+      }
+
+      stdout.write(`Created CLI token: ${created.name || name}\n`);
+      stdout.write(`Token ID: ${created.id || "unknown"}\n`);
+      stdout.write(`Token: ${created.token || "not returned"}\n`);
+      if (created.expires_at) {
+        stdout.write(`Expires: ${created.expires_at}\n`);
+      }
+    });
+}
+
+function createTokensListCommand({ stdout, env }) {
+  return new Command("list")
+    .description("List personal CLI access tokens")
+    .option("--status <status>", "status filter: all, active, revoked, or expired", "all")
+    .option("--show-secret", "include returned full token values when available")
+    .option("--json", "print machine-readable output")
+    .action(async (options) => {
+      const status = parseChoice(options.status, TOKEN_STATUSES, "--status");
+      const tokens = normalizeCliTokens(await requestAuthenticatedJson("/api/v1/cli-tokens", { env }));
+      const filtered = applyTokenFilters(tokens, { status });
+      const output = {
+        total: tokens.length,
+        matched: filtered.length,
+        filters: {
+          status
+        },
+        tokens: filtered.map((token) => serializeToken(token, { showSecret: Boolean(options.showSecret) }))
+      };
+
+      if (options.json) {
+        stdout.write(`${JSON.stringify(output)}\n`);
+        return;
+      }
+
+      stdout.write(`CLI tokens: ${output.total} total, ${output.matched} matched\n`);
+      if (!filtered.length) {
+        stdout.write("No CLI tokens found.\n");
+        return;
+      }
+
+      stdout.write("\n");
+      stdout.write(`${formatTokensTable(filtered, { showSecret: Boolean(options.showSecret) })}\n`);
+    });
+}
+
+function createTokensRevokeCommand({ stdin, stdout, env }) {
+  return new Command("revoke")
+    .description("Revoke one CLI access token")
+    .argument("<token_id>", "CLI token id from tokens list")
+    .option("-y, --yes", "skip confirmation prompt")
+    .option("--json", "print machine-readable output")
+    .action(async (tokenId, options) => {
+      const target = await resolveTokenById(tokenId, env);
+      if (target.revoked) {
+        throw new Error("CLI token is already revoked.");
+      }
+
+      if (!options.yes) {
+        const answer = await promptText({
+          message: `Revoke CLI token ${target.name || tokenId}? Type "yes" to confirm: `,
+          stdin,
+          stdout,
+          optionName: "--yes"
+        });
+        if (answer.toLowerCase() !== "yes") {
+          stdout.write("CLI token revocation cancelled.\n");
+          return;
+        }
+      }
+
+      await requestAuthenticatedJson(`/api/v1/cli-tokens/${encodeURIComponent(tokenId)}`, {
+        env,
+        method: "DELETE"
+      });
+      const output = {
+        revoked: true,
+        token_id: tokenId,
+        name: target.name || null
+      };
+
+      if (options.json) {
+        stdout.write(`${JSON.stringify(output)}\n`);
+        return;
+      }
+
+      stdout.write(`CLI token revoked: ${target.name || tokenId}\n`);
+    });
+}
+
+function createTokensPurgeCommand({ stdin, stdout, env }) {
+  return new Command("purge")
+    .description("Permanently delete one already-revoked CLI access token")
+    .argument("<token_id>", "CLI token id from tokens list")
+    .option("-y, --yes", "skip confirmation prompt")
+    .option("--json", "print machine-readable output")
+    .action(async (tokenId, options) => {
+      const target = await resolveTokenById(tokenId, env);
+      if (!target.revoked) {
+        throw new Error("CLI token is still active. Revoke it before purging.");
+      }
+
+      if (!options.yes) {
+        const answer = await promptText({
+          message: `Permanently delete CLI token ${target.name || tokenId}? Type "yes" to confirm: `,
+          stdin,
+          stdout,
+          optionName: "--yes"
+        });
+        if (answer.toLowerCase() !== "yes") {
+          stdout.write("CLI token purge cancelled.\n");
+          return;
+        }
+      }
+
+      await requestAuthenticatedJson(`/api/v1/cli-tokens/${encodeURIComponent(tokenId)}?purge=true`, {
+        env,
+        method: "DELETE"
+      });
+      const output = {
+        purged: true,
+        token_id: tokenId,
+        name: target.name || null
+      };
+
+      if (options.json) {
+        stdout.write(`${JSON.stringify(output)}\n`);
+        return;
+      }
+
+      stdout.write(`CLI token purged: ${target.name || tokenId}\n`);
+    });
+}
+
+async function resolveTokenById(tokenId, env) {
+  const tokens = normalizeCliTokens(await requestAuthenticatedJson("/api/v1/cli-tokens", { env }));
+  const target = tokens.find((token) => token.id === tokenId);
+  if (!target) {
+    throw new Error(`CLI token not found: ${tokenId}`);
+  }
+  return target;
+}
+
+function parseTokenName(value) {
+  const name = String(value || "").trim();
+  if (!name) {
+    throw new Error("--name is required.");
+  }
+  if (name.length > 255) {
+    throw new Error("--name must be 255 characters or fewer.");
+  }
+  return name;
+}
+
+function parseExpiresInDays(value) {
+  if (value === undefined) {
+    return null;
+  }
+
+  const days = Number(value);
+  if (!Number.isInteger(days) || days < 1 || days > 365) {
+    throw new Error("Invalid --expires-in-days. Allowed values are integers from 1 to 365.");
+  }
+  return days;
+}
+
+function parseChoice(value, allowed, optionName) {
+  const normalized = String(value || "").trim().toLowerCase();
+  if (!allowed.includes(normalized)) {
+    throw new Error(`Invalid ${optionName}. Allowed values: ${allowed.join(", ")}.`);
+  }
+  return normalized;
+}
+
+function normalizeCliTokens(data) {
+  const tokens = Array.isArray(data) ? data : (data?.tokens || []);
+  return tokens.map(normalizeCliToken);
+}
+
+function normalizeCliToken(token = {}) {
+  const revoked = token.revoked === true;
+  const expiresAt = token.expires_at || "";
+  const expired = Boolean(expiresAt && Date.parse(expiresAt) <= Date.now());
+  const status = revoked ? "revoked" : expired ? "expired" : "active";
+  const fullToken = token.token || "";
+  return {
+    id: token.id || "",
+    name: token.name || "",
+    token: fullToken,
+    prefix: token.prefix || "",
+    prefix_masked: token.prefix_masked || (fullToken ? maskCliToken(fullToken) : formatMaskedPrefix(token.prefix)),
+    revoked,
+    expired,
+    active: status === "active",
+    status,
+    expires_at: expiresAt,
+    last_used_at: token.last_used_at || "",
+    created_at: token.created_at || ""
+  };
+}
+
+function applyTokenFilters(tokens, { status }) {
+  if (status === "all") {
+    return tokens;
+  }
+  return tokens.filter((token) => token.status === status);
+}
+
+function serializeToken(token, { showSecret = false } = {}) {
+  const serialized = {
+    id: token.id,
+    name: token.name,
+    prefix_masked: token.prefix_masked,
+    status: token.status,
+    revoked: token.revoked,
+    expires_at: token.expires_at || null,
+    last_used_at: token.last_used_at || null,
+    created_at: token.created_at || null
+  };
+
+  if (showSecret && token.token) {
+    serialized.token = token.token;
+  }
+
+  return serialized;
+}
+
+function formatTokensTable(tokens, { showSecret = false } = {}) {
+  return formatTable(tokens, [
+    { header: "TOKEN ID", value: (token) => dash(token.id) },
+    { header: "NAME", value: (token) => dash(token.name) },
+    { header: "TOKEN", value: (token) => showSecret && token.token ? token.token : dash(token.prefix_masked) },
+    { header: "STATUS", value: (token) => token.status },
+    { header: "EXPIRES", value: (token) => dash(token.expires_at) },
+    { header: "LAST USED", value: (token) => dash(token.last_used_at) }
+  ]);
+}
+
+function formatMaskedPrefix(prefix) {
+  return prefix ? `${prefix}***...****` : "";
+}

package/src/commands/users.js

@@ -0,0 +1,255 @@
+import { Command } from "commander";
+
+import { requestAuthenticatedJson } from "../lib/api-client.js";
+import { promptText } from "../lib/prompt.js";
+import { dash, formatTable } from "../lib/table.js";
+
+export function createUsersCommand({
+  stdin = process.stdin,
+  stdout = process.stdout,
+  env = process.env
+} = {}) {
+  const command = new Command("users")
+    .description("Review and manage organization users");
+
+  command.addCommand(createUsersListCommand({ stdout, env }));
+  command.addCommand(createUsersRemoveCommand({ stdin, stdout, env }));
+
+  return command;
+}
+
+function createUsersListCommand({ stdout, env }) {
+  return new Command("list")
+    .description("List organization users")
+    .option("--search <text>", "search user email, role, status, or display name")
+    .option("--role <role>", "role filter; validated against dashboard roles")
+    .option("--json", "print machine-readable output")
+    .action(async (options) => {
+      const [usersData, rolesData] = await Promise.all([
+        requestAuthenticatedJson("/api/users", { env }),
+        requestAuthenticatedJson("/api/users/roles", { env })
+      ]);
+
+      const roles = normalizeRoles(rolesData);
+      const role = parseOptionalRole(options.role, roles);
+      const users = normalizeUsers(usersData);
+      const filtered = applyUserFilters(users, {
+        search: options.search,
+        role
+      });
+      const output = buildUsersListOutput({
+        users,
+        filtered,
+        roles,
+        filters: {
+          search: options.search || null,
+          role
+        }
+      });
+
+      if (options.json) {
+        stdout.write(`${JSON.stringify(output)}\n`);
+        return;
+      }
+
+      stdout.write(`Users: ${output.total} total, ${output.matched} matched\n`);
+      if (!filtered.length) {
+        stdout.write("No users found.\n");
+        return;
+      }
+
+      stdout.write("\n");
+      stdout.write(`${formatUsersTable(filtered)}\n`);
+    });
+}
+
+function createUsersRemoveCommand({
+  stdin = process.stdin,
+  stdout = process.stdout,
+  env = process.env
+}) {
+  return new Command("remove")
+    .description("Remove one organization user")
+    .argument("<user>", "user id, user_id, or email from users list")
+    .option("-y, --yes", "skip confirmation prompt")
+    .option("--json", "print machine-readable output")
+    .action(async (userRef, options) => {
+      const [usersData, currentUser] = await Promise.all([
+        requestAuthenticatedJson("/api/users", { env }),
+        requestAuthenticatedJson("/api/user/me", { env })
+      ]);
+      const users = normalizeUsers(usersData);
+      const target = resolveUserReference(userRef, users);
+
+      validateUserRemoval(target, users, currentUser);
+
+      if (!options.yes) {
+        const answer = await promptText({
+          message: `Remove user ${target.email || target.user_id}? Type "yes" to confirm: `,
+          stdin,
+          stdout,
+          optionName: "--yes"
+        });
+        if (answer.toLowerCase() !== "yes") {
+          stdout.write("User removal cancelled.\n");
+          return;
+        }
+      }
+
+      const data = await requestAuthenticatedJson(`/api/users/${encodeURIComponent(target.user_id)}`, {
+        env,
+        method: "DELETE"
+      });
+      const output = {
+        removed: true,
+        user_id: target.user_id,
+        email: target.email || null,
+        role: target.role || null,
+        message: data?.message || "User deleted successfully"
+      };
+
+      if (options.json) {
+        stdout.write(`${JSON.stringify(output)}\n`);
+        return;
+      }
+
+      stdout.write(`${output.message}: ${target.email || target.user_id}\n`);
+    });
+}
+
+function buildUsersListOutput({ users, filtered, roles, filters }) {
+  return {
+    total: users.length,
+    matched: filtered.length,
+    filters,
+    roles: roles.map((role) => role.value),
+    users: filtered
+  };
+}
+
+function normalizeUsers(data) {
+  const users = Array.isArray(data) ? data : (data?.users || []);
+  return users.map((user) => {
+    const id = user.id || user.user_id || "";
+    return {
+      id,
+      user_id: user.user_id || id,
+      email: normalizeEmail(user.email),
+      role: user.role || "user",
+      status: user.status || "",
+      active: user.active !== false,
+      display_name: user.display_name || "",
+      created_at: user.created_at || ""
+    };
+  });
+}
+
+function normalizeRoles(data) {
+  const roles = Array.isArray(data) ? data : (data?.roles || []);
+  return roles
+    .map((role) => ({
+      value: String(role?.value || "").trim(),
+      label: role?.label || "",
+      description: role?.description || ""
+    }))
+    .filter((role) => role.value);
+}
+
+function parseOptionalRole(value, roles) {
+  if (value === undefined || value === null || value === "") {
+    return null;
+  }
+
+  const role = String(value).trim().toLowerCase();
+  const allowed = roles.map((item) => item.value);
+  if (!allowed.includes(role)) {
+    throw new Error(`Invalid --role. Allowed values: ${allowed.join(", ")}.`);
+  }
+  return role;
+}
+
+function applyUserFilters(users, { search = "", role = null } = {}) {
+  let filtered = users;
+
+  if (role) {
+    filtered = filtered.filter((user) => String(user.role || "").toLowerCase() === role);
+  }
+
+  const query = String(search || "").trim().toLowerCase();
+  if (query) {
+    filtered = filtered.filter((user) =>
+      user.email.includes(query) ||
+      String(user.role || "").toLowerCase().includes(query) ||
+      String(user.status || "").toLowerCase().includes(query) ||
+      String(user.display_name || "").toLowerCase().includes(query)
+    );
+  }
+
+  return filtered;
+}
+
+function resolveUserReference(userRef, users) {
+  const ref = String(userRef || "").trim().toLowerCase();
+  const matches = users.filter((user) =>
+    String(user.user_id || "").toLowerCase() === ref ||
+    String(user.id || "").toLowerCase() === ref ||
+    user.email === ref
+  );
+
+  if (matches.length === 0) {
+    throw new Error(`User not found: ${userRef}`);
+  }
+  if (matches.length > 1) {
+    throw new Error(`User reference is ambiguous: ${userRef}`);
+  }
+  return matches[0];
+}
+
+function validateUserRemoval(target, users, currentUser) {
+  const targetEmail = normalizeEmail(target.email);
+  const currentEmail = normalizeEmail(currentUser?.email);
+  const currentIds = new Set([
+    currentUser?.user_id,
+    currentUser?.id,
+    currentUser?.subject
+  ].filter(Boolean).map((value) => String(value).toLowerCase()));
+  const targetIds = [
+    target.user_id,
+    target.id
+  ].filter(Boolean).map((value) => String(value).toLowerCase());
+
+  if ((targetEmail && currentEmail && targetEmail === currentEmail) ||
+      targetIds.some((id) => currentIds.has(id))) {
+    throw new Error("Refusing to remove the currently authenticated user.");
+  }
+
+  if (String(target.role || "").toLowerCase() === "admin") {
+    const activeAdmins = users.filter((user) =>
+      String(user.role || "").toLowerCase() === "admin" &&
+      isActiveUser(user)
+    );
+    if (activeAdmins.length <= 1) {
+      throw new Error("Refusing to remove the last active admin.");
+    }
+  }
+}
+
+function isActiveUser(user) {
+  const status = String(user.status || "active").toLowerCase();
+  return user.active !== false && status !== "revoked" && status !== "deleted";
+}
+
+function normalizeEmail(email) {
+  return String(email || "").trim().toLowerCase();
+}
+
+function formatUsersTable(users) {
+  return formatTable(users, [
+    { header: "USER ID", value: (user) => dash(user.user_id) },
+    { header: "EMAIL", value: (user) => dash(user.email) },
+    { header: "ROLE", value: (user) => dash(user.role) },
+    { header: "STATUS", value: (user) => dash(user.status) },
+    { header: "ACTIVE", value: (user) => user.active ? "yes" : "no" },
+    { header: "CREATED", value: (user) => dash(user.created_at) }
+  ]);
+}

package/src/commands/whoami.js

@@ -0,0 +1,43 @@
+import { Command } from "commander";
+
+import { requestAuthenticatedJsonWithMeta } from "../lib/api-client.js";
+import { normalizeApiUrl } from "../lib/config.js";
+
+export function createWhoamiCommand({
+  stdout = process.stdout,
+  stderr = process.stderr,
+  env = process.env
+} = {}) {
+  return new Command("whoami")
+    .description("Print the currently authenticated ZeusLock user")
+    .option("--json", "print machine-readable output")
+    .action(async (options) => {
+      const user = await loadCurrentUser({ env });
+
+      if (options.json) {
+        stdout.write(`${JSON.stringify(user)}\n`);
+        return;
+      }
+
+      stdout.write(`Email: ${user.email || "unknown"}\n`);
+      stdout.write(`User ID: ${user.user_id || user.id || user.subject || "unknown"}\n`);
+      stdout.write(`Role: ${user.role || "unknown"}\n`);
+      stdout.write(`Org ID: ${user.org_id || "unknown"}\n`);
+      if (user.status) {
+        stdout.write(`Status: ${user.status}\n`);
+      }
+      stdout.write(`API URL: ${user.apiUrl}\n`);
+    });
+}
+
+async function loadCurrentUser({ env }) {
+  const { data, apiUrl } = await requestAuthenticatedJsonWithMeta("/api/user/me", { env });
+  return withApiUrl(data, apiUrl);
+}
+
+function withApiUrl(user, apiUrl) {
+  return {
+    ...user,
+    apiUrl: normalizeApiUrl(apiUrl) || apiUrl
+  };
+}