bt-cli 0.4.35__tar.gz → 0.4.37__tar.gz

{bt_cli-0.4.35/src/bt_cli/data → bt_cli-0.4.37/.claude}/skills/epml/SKILL.md

@@ -132,13 +132,17 @@ bt epml rbp tmdategrps tmdates replace <tmdategrp_id> --file tmdates.json
 
 # Roles + assignments
 bt epml rbp roles list
-bt epml rbp roles create --name "Helpdesk Role"
+bt epml rbp roles create --name "Helpdesk Role" --action A \
+  --iolog '/iologs/%date%/%uniqueid%.iolog' \
+  --message "This session is logged."
 bt epml rbp roles duplicate <role_id>
-bt epml rbp roles cmdgrps   add    <role_id> --ids 1,2
+bt epml rbp roles cmdgrps   add <role_id> --ids 1,2          # cmdgrps & tmdategrps: just IDs
+bt epml rbp roles tmdategrps add <role_id> --ids 1
+bt epml rbp roles hostgrps  add <role_id> --ids 1 --kind B   # B = both Submit and Run-as
+bt epml rbp roles usergrps  add <role_id> --ids 4 --kind S   # S = Submit (who requests)
+bt epml rbp roles usergrps  add <role_id> --ids 3 --kind R   # R = Run-as (whose identity)
 bt epml rbp roles cmdgrps   remove <role_id> <cmdgrp_id>
 bt epml rbp roles hostgrps  list   <role_id>
-bt epml rbp roles usergrps  add    <role_id> --ids 5
-bt epml rbp roles tmdategrps add   <role_id> --ids 1
 
 # Entitlement report ('who can do what')
 bt epml rbp entitlement run
@@ -200,11 +204,34 @@ bt epml quick tests-then-deploy --suite <suite_id>      # commits if pass; rollb
 - **`POST /usergrps/multiple`** (bulk create): body is `{"usergroups": [...]}` — undocumented wrapper key.
 - **POST on child collections is additive**, not replacing. Calling `commands add` twice with the same command will get you a duplicate.
 - **Children share the parent's `id`** in GET responses — the listed `id` field is the cmdgrp/hostgrp/usergrp ID, not unique per child. The actual identifier is the `cmd`/`host`/`user` text.
+- **Role assignments take a single object per request, not an array**. The CLI loops under the hood; the wire body is e.g. `{"cmds": 35}`, `{"hosts": 1, "type": "S"}`, `{"users": 4, "type": "R"}`, `{"tmdates": 1}`.
+- **Hostgrp / usergrp assignments require a `type` field** (`S` = Submit / who requests, `R` = Run-as / whose identity the command runs under). Without `type` the request 400s with "RBP role type not in: [S,R]". CLI: `--kind S|R|B` on `roles hostgrps add` and `roles usergrps add`. `B` (default) creates both an S row and an R row for the same id — appropriate when the same group plays both roles. For "Admin requests, runs as root", do `--ids 4 --kind S` and `--ids 3 --kind R` separately.
+- **Roles need `rpt: 1`** to appear in `bt epml rbp entitlement run`. The role still functions for policy evaluation either way, but only `rpt=1` roles are surfaced in the report. Not yet exposed by the CLI — file-level edit via export/import is the workaround.
 
 ## Known gaps (TODO)
 
 - **`bt epml rbp roles get <id>`** — there is no GET-single-role in the v1 API. The detailed view (role with all child relations resolved) only exists at `/api/v6/pbul/{hostid}/rbp/roledetail/{id}`, which is on the IAM-only authorizer. Not callable with a PAT today. Workaround: use `bt epml rbp roles list` for the role row, then `bt epml rbp roles {cmdgrps,hostgrps,usergrps,tmdategrps} list <id>` to fetch each child relation.
 
+## Tenant-side gotchas (not a CLI bug)
+
+- **`bt epml rbp tx begin` may return** `400 "RBP Transactions not enabled on host"`. This is a per-tenant feature flag on the PMUL host — transactions need to be enabled at the appliance / settings level before they'll work. The CLI surfaces the server's exact message; nothing client-side to fix. (Verified 2026-05-01 against the lab tenant — host id 100 does not have transactions enabled.) The `quick tests-then-deploy` workflow depends on transactions, so it'll also fail until the host is configured for it.
+
+## tmdate shape (`dotw` map)
+
+The OpenAPI spec describes `tmdate` as a `string` field with `x-go-name: "JsonDefinition"`. The actual runtime shape is a structured object:
+
+```json
+{"dotw": {
+  "mon": [{"from":"09:00","to":"17:00"}],
+  "tue": [{"from":"09:00","to":"17:00"}],
+  ...
+  "sat": [],
+  "sun": []
+}}
+```
+
+A day with an empty list is inactive. A day can have multiple windows (e.g. split shift). The CLI's `--from/--to/--days` short flags build the map for you; for anything more complex use `--file` with the full JSON.
+
 ## Path-version policy (CLI internal)
 
 Where the spec offers both legacy `/api/pbul/{hostid}/rbp/<x>` and newer

{bt_cli-0.4.35 → bt_cli-0.4.37}/CLAUDE.md

@@ -1,6 +1,6 @@
 # BT-CLI
 
-BeyondTrust Platform CLI for Password Safe, Entitle, PRA, EPM Windows, and EPM Linux. **Version: 0.4.35**
+BeyondTrust Platform CLI for Password Safe, Entitle, PRA, EPM Windows, and EPM Linux. **Version: 0.4.37**
 
 ## Setup
 

{bt_cli-0.4.35 → bt_cli-0.4.37}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: bt-cli
-Version: 0.4.35
+Version: 0.4.37
 Summary: BeyondTrust Platform CLI (unofficial) - Password Safe, Entitle, PRA, EPM
 Author-email: Dave Grendysz <dgrendysz@beyondtrust.com>
 License: MIT

{bt_cli-0.4.35 → bt_cli-0.4.37}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "bt-cli"
-version = "0.4.35"
+version = "0.4.37"
 description = "BeyondTrust Platform CLI (unofficial) - Password Safe, Entitle, PRA, EPM"
 readme = "README.md"
 requires-python = ">=3.9"

{bt_cli-0.4.35 → bt_cli-0.4.37}/src/bt_cli/__init__.py

@@ -1,3 +1,3 @@
 """BeyondTrust Unified Admin CLI."""
 
-__version__ = "0.4.35"
+__version__ = "0.4.37"

{bt_cli-0.4.35 → bt_cli-0.4.37}/src/bt_cli/data/CLAUDE.md

@@ -1,6 +1,6 @@
 # BT-CLI
 
-BeyondTrust Platform CLI for Password Safe, Entitle, PRA, EPM Windows, and EPM Linux. **Version: 0.4.35**
+BeyondTrust Platform CLI for Password Safe, Entitle, PRA, EPM Windows, and EPM Linux. **Version: 0.4.37**
 
 ## Setup
 

{bt_cli-0.4.35/.claude → bt_cli-0.4.37/src/bt_cli/data}/skills/epml/SKILL.md

@@ -132,13 +132,17 @@ bt epml rbp tmdategrps tmdates replace <tmdategrp_id> --file tmdates.json
 
 # Roles + assignments
 bt epml rbp roles list
-bt epml rbp roles create --name "Helpdesk Role"
+bt epml rbp roles create --name "Helpdesk Role" --action A \
+  --iolog '/iologs/%date%/%uniqueid%.iolog' \
+  --message "This session is logged."
 bt epml rbp roles duplicate <role_id>
-bt epml rbp roles cmdgrps   add    <role_id> --ids 1,2
+bt epml rbp roles cmdgrps   add <role_id> --ids 1,2          # cmdgrps & tmdategrps: just IDs
+bt epml rbp roles tmdategrps add <role_id> --ids 1
+bt epml rbp roles hostgrps  add <role_id> --ids 1 --kind B   # B = both Submit and Run-as
+bt epml rbp roles usergrps  add <role_id> --ids 4 --kind S   # S = Submit (who requests)
+bt epml rbp roles usergrps  add <role_id> --ids 3 --kind R   # R = Run-as (whose identity)
 bt epml rbp roles cmdgrps   remove <role_id> <cmdgrp_id>
 bt epml rbp roles hostgrps  list   <role_id>
-bt epml rbp roles usergrps  add    <role_id> --ids 5
-bt epml rbp roles tmdategrps add   <role_id> --ids 1
 
 # Entitlement report ('who can do what')
 bt epml rbp entitlement run
@@ -200,11 +204,34 @@ bt epml quick tests-then-deploy --suite <suite_id>      # commits if pass; rollb
 - **`POST /usergrps/multiple`** (bulk create): body is `{"usergroups": [...]}` — undocumented wrapper key.
 - **POST on child collections is additive**, not replacing. Calling `commands add` twice with the same command will get you a duplicate.
 - **Children share the parent's `id`** in GET responses — the listed `id` field is the cmdgrp/hostgrp/usergrp ID, not unique per child. The actual identifier is the `cmd`/`host`/`user` text.
+- **Role assignments take a single object per request, not an array**. The CLI loops under the hood; the wire body is e.g. `{"cmds": 35}`, `{"hosts": 1, "type": "S"}`, `{"users": 4, "type": "R"}`, `{"tmdates": 1}`.
+- **Hostgrp / usergrp assignments require a `type` field** (`S` = Submit / who requests, `R` = Run-as / whose identity the command runs under). Without `type` the request 400s with "RBP role type not in: [S,R]". CLI: `--kind S|R|B` on `roles hostgrps add` and `roles usergrps add`. `B` (default) creates both an S row and an R row for the same id — appropriate when the same group plays both roles. For "Admin requests, runs as root", do `--ids 4 --kind S` and `--ids 3 --kind R` separately.
+- **Roles need `rpt: 1`** to appear in `bt epml rbp entitlement run`. The role still functions for policy evaluation either way, but only `rpt=1` roles are surfaced in the report. Not yet exposed by the CLI — file-level edit via export/import is the workaround.
 
 ## Known gaps (TODO)
 
 - **`bt epml rbp roles get <id>`** — there is no GET-single-role in the v1 API. The detailed view (role with all child relations resolved) only exists at `/api/v6/pbul/{hostid}/rbp/roledetail/{id}`, which is on the IAM-only authorizer. Not callable with a PAT today. Workaround: use `bt epml rbp roles list` for the role row, then `bt epml rbp roles {cmdgrps,hostgrps,usergrps,tmdategrps} list <id>` to fetch each child relation.
 
+## Tenant-side gotchas (not a CLI bug)
+
+- **`bt epml rbp tx begin` may return** `400 "RBP Transactions not enabled on host"`. This is a per-tenant feature flag on the PMUL host — transactions need to be enabled at the appliance / settings level before they'll work. The CLI surfaces the server's exact message; nothing client-side to fix. (Verified 2026-05-01 against the lab tenant — host id 100 does not have transactions enabled.) The `quick tests-then-deploy` workflow depends on transactions, so it'll also fail until the host is configured for it.
+
+## tmdate shape (`dotw` map)
+
+The OpenAPI spec describes `tmdate` as a `string` field with `x-go-name: "JsonDefinition"`. The actual runtime shape is a structured object:
+
+```json
+{"dotw": {
+  "mon": [{"from":"09:00","to":"17:00"}],
+  "tue": [{"from":"09:00","to":"17:00"}],
+  ...
+  "sat": [],
+  "sun": []
+}}
+```
+
+A day with an empty list is inactive. A day can have multiple windows (e.g. split shift). The CLI's `--from/--to/--days` short flags build the map for you; for anything more complex use `--file` with the full JSON.
+
 ## Path-version policy (CLI internal)
 
 Where the spec offers both legacy `/api/pbul/{hostid}/rbp/<x>` and newer

{bt_cli-0.4.35 → bt_cli-0.4.37}/src/bt_cli/epml/client/base.py

@@ -489,9 +489,13 @@ class EPMLClient:
         h = self.host(host_id)
         return self.get(f"/api/pbul/{h}/rbp/roles/{role_id}/cmdgrps")
 
-    def add_role_cmdgrps(self, role_id: int, cmdgrp_ids: List[int], host_id: Optional[int] = None) -> Any:
+    def add_role_cmdgrps(self, role_id: int, cmdgrp_ids: List[int], host_id: Optional[int] = None) -> List[Any]:
+        """Add cmdgrps to a role. The API accepts ONE assignment per request
+        as a bare object (`{cmds: <id>}`) — not an array. Loop here.
+        """
         h = self.host(host_id)
-        return self.post(f"/api/pbul/{h}/rbp/roles/{role_id}/cmdgrps", json=cmdgrp_ids)
+        path = f"/api/pbul/{h}/rbp/roles/{role_id}/cmdgrps"
+        return [self.post(path, json={"cmds": cid}) for cid in cmdgrp_ids]
 
     def remove_role_cmdgrp(self, role_id: int, cmdgrp_id: int, host_id: Optional[int] = None) -> None:
         h = self.host(host_id)
@@ -501,9 +505,31 @@ class EPMLClient:
         h = self.host(host_id)
         return self.get(f"/api/pbul/{h}/rbp/roles/{role_id}/hostgrps")
 
-    def add_role_hostgrps(self, role_id: int, hostgrp_ids: List[int], host_id: Optional[int] = None) -> Any:
+    def add_role_hostgrps(
+        self,
+        role_id: int,
+        hostgrp_ids: List[int],
+        kind: str = "B",
+        host_id: Optional[int] = None,
+    ) -> List[Any]:
+        """Add hostgrps to a role. Each assignment carries a `type`:
+          S = Submit (where the request comes from)
+          R = Run-as (where the command actually runs)
+
+        For a typical "users on these hosts can run on these same hosts" rule,
+        you usually want BOTH — pass `kind="B"` (default) and the client posts
+        twice, once with type S and once with type R.
+        """
         h = self.host(host_id)
-        return self.post(f"/api/pbul/{h}/rbp/roles/{role_id}/hostgrps", json=hostgrp_ids)
+        path = f"/api/pbul/{h}/rbp/roles/{role_id}/hostgrps"
+        types = ("S", "R") if kind.upper() == "B" else (kind.upper(),)
+        if not all(t in ("S", "R") for t in types):
+            raise ValueError(f"hostgrp kind must be S, R, or B (both); got {kind!r}")
+        results = []
+        for hid in hostgrp_ids:
+            for t in types:
+                results.append(self.post(path, json={"hosts": hid, "type": t}))
+        return results
 
     def remove_role_hostgrp(self, role_id: int, hostgrp_id: int, host_id: Optional[int] = None) -> None:
         h = self.host(host_id)
@@ -513,9 +539,27 @@ class EPMLClient:
         h = self.host(host_id)
         return self.get(f"/api/pbul/{h}/rbp/roles/{role_id}/usergrps")
 
-    def add_role_usergrps(self, role_id: int, usergrp_ids: List[int], host_id: Optional[int] = None) -> Any:
+    def add_role_usergrps(
+        self,
+        role_id: int,
+        usergrp_ids: List[int],
+        kind: str = "B",
+        host_id: Optional[int] = None,
+    ) -> List[Any]:
+        """Add usergrps to a role. Same S/R/B `type` semantics as hostgrps.
+          S = Submit user (who requests)
+          R = Run-as user (whose identity the command runs under)
+        """
         h = self.host(host_id)
-        return self.post(f"/api/pbul/{h}/rbp/roles/{role_id}/usergrps", json=usergrp_ids)
+        path = f"/api/pbul/{h}/rbp/roles/{role_id}/usergrps"
+        types = ("S", "R") if kind.upper() == "B" else (kind.upper(),)
+        if not all(t in ("S", "R") for t in types):
+            raise ValueError(f"usergrp kind must be S, R, or B (both); got {kind!r}")
+        results = []
+        for uid in usergrp_ids:
+            for t in types:
+                results.append(self.post(path, json={"users": uid, "type": t}))
+        return results
 
     def remove_role_usergrp(self, role_id: int, usergrp_id: int, host_id: Optional[int] = None) -> None:
         h = self.host(host_id)
@@ -525,9 +569,11 @@ class EPMLClient:
         h = self.host(host_id)
         return self.get(f"/api/pbul/{h}/rbp/roles/{role_id}/tmdategrps")
 
-    def add_role_tmdategrps(self, role_id: int, tmdategrp_ids: List[int], host_id: Optional[int] = None) -> Any:
+    def add_role_tmdategrps(self, role_id: int, tmdategrp_ids: List[int], host_id: Optional[int] = None) -> List[Any]:
+        """Add tmdategrps to a role. Single object per request, key is `tmdates`."""
         h = self.host(host_id)
-        return self.post(f"/api/pbul/{h}/rbp/roles/{role_id}/tmdategrps", json=tmdategrp_ids)
+        path = f"/api/pbul/{h}/rbp/roles/{role_id}/tmdategrps"
+        return [self.post(path, json={"tmdates": tid}) for tid in tmdategrp_ids]
 
     def remove_role_tmdategrp(self, role_id: int, tmdategrp_id: int, host_id: Optional[int] = None) -> None:
         h = self.host(host_id)

{bt_cli-0.4.35 → bt_cli-0.4.37}/src/bt_cli/epml/commands/rbp_roles.py

@@ -46,20 +46,37 @@ def create_role(
     name: str = typer.Option(..., "--name", "-n"),
     description: str = typer.Option("", "--description", "-d"),
     action: str = typer.Option("A", "--action", "-a", help="Role verdict: A=Allow, R=Reject"),
+    iolog: Optional[str] = typer.Option(
+        None, "--iolog",
+        help="I/O log path template (e.g. /iologs/%date%/%uniqueid%.iolog). Omit to disable.",
+    ),
+    message: Optional[str] = typer.Option(None, "--message", "-m", help="Message shown to the requesting user"),
+    comment: Optional[str] = typer.Option(None, "--comment", help="Internal comment"),
+    disabled: bool = typer.Option(False, "--disabled", help="Create the role disabled"),
     host: Optional[int] = _host_opt(),
 ):
     """Create a role.
 
     The API requires `action` to be exactly `A` (Allow) or `R` (Reject) —
     not 'Allow'/'Reject'. Defaults to A.
+
+    `iolog` accepts the appliance's path template syntax — typical value is
+    `/iologs/%date%/%uniqueid%.iolog`. Omit to disable I/O logging on this role.
     """
     from bt_cli.epml.client import get_client
     if action not in ("A", "R"):
         typer.echo(f"--action must be 'A' or 'R', got {action!r}", err=True)
         raise typer.Exit(2)
+    body = {"name": name, "description": description, "action": action, "disabled": disabled}
+    if iolog is not None:
+        body["iolog"] = iolog
+    if message is not None:
+        body["message"] = message
+    if comment is not None:
+        body["comment"] = comment
     try:
         with get_client() as c:
-            result = c.create_role({"name": name, "description": description, "action": action}, host_id=host)
+            result = c.create_role(body, host_id=host)
         print_json(result)
     except httpx.HTTPStatusError as e:
         print_api_error(e, "create role"); raise typer.Exit(1)
@@ -104,15 +121,20 @@ def duplicate_role(
 
 # ---- assignments: cmdgrps / hostgrps / usergrps / tmdategrps ----
 
-def _make_assignment_app(label: str, list_fn: str, add_fn: str, remove_fn: str):
-    """Build a sub-typer for managing one role-child resource type."""
+def _make_assignment_app(label: str, list_fn: str, add_fn: str, remove_fn: str, has_kind: bool = False):
+    """Build a sub-typer for managing one role-child resource type.
+
+    has_kind: if True, expose --kind S|R|B (Submit / Run-as / Both). Used for
+    hostgrps and usergrps where each assignment carries a type. Cmdgrps and
+    tmdategrps don't take a kind.
+    """
     sub = typer.Typer(no_args_is_help=True, help=f"Manage {label} on a role")
 
     @sub.command("list")
     def _list(
         role_id: int = typer.Argument(..., help="Role ID"),
         host: Optional[int] = _host_opt(),
-        output: OutputFormat = typer.Option(OutputFormat.TABLE, "--output", "-o"),
+        output: OutputFormat = typer.Option(OutputFormat.JSON, "--output", "-o"),
     ):
         f"""List {label} assigned to a role."""
         from bt_cli.epml.client import get_client
@@ -123,29 +145,60 @@ def _make_assignment_app(label: str, list_fn: str, add_fn: str, remove_fn: str):
                 print_json(data)
             else:
                 rows = data if isinstance(data, list) else (data.get("data", []) if isinstance(data, dict) else [])
-                print_table(rows, [("ID", "id"), ("Name", "name")], title=f"{label} on role {role_id}")
+                # Best-effort table: include `type` column when present
+                if rows and isinstance(rows[0], dict) and "type" in rows[0]:
+                    cols = [(k.upper(), k) for k in rows[0].keys()]
+                else:
+                    cols = [("ID", "id"), ("Name", "name")]
+                print_table(rows, cols, title=f"{label} on role {role_id}")
         except httpx.HTTPStatusError as e:
             print_api_error(e, f"list role {label}"); raise typer.Exit(1)
         except Exception as e:
             print_api_error(e, f"list role {label}"); raise typer.Exit(1)
 
-    @sub.command("add")
-    def _add(
-        role_id: int = typer.Argument(..., help="Role ID"),
-        ids: str = typer.Option(..., "--ids", help=f"Comma-separated {label} IDs to add"),
-        host: Optional[int] = _host_opt(),
-    ):
-        f"""Add {label} to a role."""
-        from bt_cli.epml.client import get_client
-        try:
-            id_list = [int(x.strip()) for x in ids.split(",") if x.strip()]
-            with get_client() as c:
-                result = getattr(c, add_fn)(role_id, id_list, host_id=host)
-            print_json(result)
-        except httpx.HTTPStatusError as e:
-            print_api_error(e, f"add role {label}"); raise typer.Exit(1)
-        except Exception as e:
-            print_api_error(e, f"add role {label}"); raise typer.Exit(1)
+    if has_kind:
+        @sub.command("add")
+        def _add(
+            role_id: int = typer.Argument(..., help="Role ID"),
+            ids: str = typer.Option(..., "--ids", help=f"Comma-separated {label} IDs to add"),
+            kind: str = typer.Option(
+                "B", "--kind", "-k",
+                help="Assignment type: S=Submit, R=Run-as, B=Both (creates two assignments per id)",
+            ),
+            host: Optional[int] = _host_opt(),
+        ):
+            f"""Add {label} to a role."""
+            from bt_cli.epml.client import get_client
+            if kind.upper() not in ("S", "R", "B"):
+                typer.echo(f"--kind must be S, R, or B; got {kind!r}", err=True)
+                raise typer.Exit(2)
+            try:
+                id_list = [int(x.strip()) for x in ids.split(",") if x.strip()]
+                with get_client() as c:
+                    result = getattr(c, add_fn)(role_id, id_list, kind=kind.upper(), host_id=host)
+                print_json(result)
+            except httpx.HTTPStatusError as e:
+                print_api_error(e, f"add role {label}"); raise typer.Exit(1)
+            except Exception as e:
+                print_api_error(e, f"add role {label}"); raise typer.Exit(1)
+    else:
+        @sub.command("add")
+        def _add(
+            role_id: int = typer.Argument(..., help="Role ID"),
+            ids: str = typer.Option(..., "--ids", help=f"Comma-separated {label} IDs to add"),
+            host: Optional[int] = _host_opt(),
+        ):
+            f"""Add {label} to a role."""
+            from bt_cli.epml.client import get_client
+            try:
+                id_list = [int(x.strip()) for x in ids.split(",") if x.strip()]
+                with get_client() as c:
+                    result = getattr(c, add_fn)(role_id, id_list, host_id=host)
+                print_json(result)
+            except httpx.HTTPStatusError as e:
+                print_api_error(e, f"add role {label}"); raise typer.Exit(1)
+            except Exception as e:
+                print_api_error(e, f"add role {label}"); raise typer.Exit(1)
 
     @sub.command("remove")
     def _remove(
@@ -168,6 +221,6 @@ def _make_assignment_app(label: str, list_fn: str, add_fn: str, remove_fn: str):
 
 
 app.add_typer(_make_assignment_app("cmdgrps", "list_role_cmdgrps", "add_role_cmdgrps", "remove_role_cmdgrp"), name="cmdgrps")
-app.add_typer(_make_assignment_app("hostgrps", "list_role_hostgrps", "add_role_hostgrps", "remove_role_hostgrp"), name="hostgrps")
-app.add_typer(_make_assignment_app("usergrps", "list_role_usergrps", "add_role_usergrps", "remove_role_usergrp"), name="usergrps")
+app.add_typer(_make_assignment_app("hostgrps", "list_role_hostgrps", "add_role_hostgrps", "remove_role_hostgrp", has_kind=True), name="hostgrps")
+app.add_typer(_make_assignment_app("usergrps", "list_role_usergrps", "add_role_usergrps", "remove_role_usergrp", has_kind=True), name="usergrps")
 app.add_typer(_make_assignment_app("tmdategrps", "list_role_tmdategrps", "add_role_tmdategrps", "remove_role_tmdategrp"), name="tmdategrps")

{bt_cli-0.4.35 → bt_cli-0.4.37}/src/bt_cli/epml/commands/rbp_tmdategrps.py

@@ -95,7 +95,12 @@ def list_tmdates(
     host: Optional[int] = _host_opt(),
     output: OutputFormat = typer.Option(OutputFormat.JSON, "--output", "-o"),
 ):
-    """List time/date entries in a group."""
+    """List time/date entries in a group.
+
+    Each entry's schedule lives in the nested `dotw` map. Defaults to JSON
+    output because the structure is non-tabular; use `-o table` for a
+    summarized day-by-day view.
+    """
     from bt_cli.epml.client import get_client
     try:
         with get_client() as c:
@@ -104,10 +109,26 @@ def list_tmdates(
             print_json(data)
         else:
             rows = data if isinstance(data, list) else (data.get("data", []) if isinstance(data, dict) else [])
-            print_table(rows, [
-                ("ID", "id"),
+            view = []
+            for r in rows:
+                dotw = (r.get("dotw") or {})
+                active_days = [d for d in ("mon","tue","wed","thu","fri","sat","sun") if dotw.get(d)]
+                # Show window summary using the first day's first window if any
+                window = ""
+                for d in active_days:
+                    rng = (dotw.get(d) or [{}])[0]
+                    if rng.get("from") and rng.get("to"):
+                        window = f"{rng['from']}-{rng['to']}"
+                        break
+                view.append({
+                    "description": r.get("description", "") or r.get("name", "") or "-",
+                    "days": ",".join(active_days) or "-",
+                    "window": window or "-",
+                })
+            print_table(view, [
                 ("Description", "description"),
-                ("Disabled", "disabled"),
+                ("Days", "days"),
+                ("Window", "window"),
             ], title=f"tmdates in tmdategrp {tmdategrp_id}")
     except httpx.HTTPStatusError as e:
         print_api_error(e, "list tmdates"); raise typer.Exit(1)
@@ -115,18 +136,46 @@ def list_tmdates(
         print_api_error(e, "list tmdates"); raise typer.Exit(1)
 
 
+_VALID_DAYS = ("mon", "tue", "wed", "thu", "fri", "sat", "sun")
+
+
+def _build_dotw(from_: str, to: str, days: str) -> dict:
+    """Build a `dotw` map (day-of-the-week → list of from/to ranges).
+
+    The spec calls the per-tmdate field `tmdate: string` (a JSON definition)
+    but the actual API uses a structured object: `{"dotw": {"mon": [{"from":"...","to":"..."}], ...}}`.
+    Days that aren't in `--days` get an empty list (= not active).
+    """
+    selected = {d.strip().lower() for d in days.split(",") if d.strip()}
+    bad = selected - set(_VALID_DAYS)
+    if bad:
+        raise ValueError(f"unknown days: {','.join(sorted(bad))} — must be in {','.join(_VALID_DAYS)}")
+    window = {"from": from_, "to": to}
+    return {d: ([window] if d in selected else []) for d in _VALID_DAYS}
+
+
 @tmdates_app.command("add")
 def add_tmdates(
     tmdategrp_id: int = typer.Argument(..., help="Time/Date group ID"),
-    file: Optional[typer.FileText] = typer.Option(None, "--file", "-f", help="JSON file: array of tmdate objects"),
+    file: Optional[typer.FileText] = typer.Option(None, "--file", "-f", help="JSON file: array of tmdate objects (full shape, with `dotw`)"),
     description: Optional[str] = typer.Option(None, "--description", "-d", help="Description for a single tmdate (used with --from/--to)"),
     from_: Optional[str] = typer.Option(None, "--from", help="Time window start (e.g. 09:00)"),
     to: Optional[str] = typer.Option(None, "--to", help="Time window end (e.g. 17:00)"),
+    days: str = typer.Option("mon,tue,wed,thu,fri", "--days", help="Comma-separated days when --from/--to applies"),
     host: Optional[int] = _host_opt(),
 ):
-    """Add tmdate entries. Provide --file for full bodies, or --from/--to/--description for one quick entry.
+    """Add tmdate entries.
 
-    The API wraps the body as `{"tmdates": [...]}` (the spec doesn't document this).
+    Two ways to specify entries:
+
+    - **--from / --to / --days**: quick one-window helper. Builds a per-day-of-week
+      schedule (`dotw` map). Default `--days mon,tue,wed,thu,fri` (weekdays).
+    - **--file**: a JSON array of full tmdate objects. Each object should be
+      `{"dotw": {"mon": [{"from":"09:00","to":"17:00"}], ...}}` — every weekday key
+      with a list of windows. Days you omit are silently treated as inactive.
+
+    The wrapper around the array (`{"tmdates": [...]}`) is added by the client
+    automatically — it's not in the spec but is required by the server.
     """
     from bt_cli.epml.client import get_client
     if file:
@@ -136,9 +185,13 @@ def add_tmdates(
             raise typer.Exit(2)
     else:
         if not (from_ and to):
-            typer.echo("Provide --file, or both --from and --to (with optional --description)", err=True)
+            typer.echo("Provide --file, or both --from and --to (with optional --description / --days)", err=True)
+            raise typer.Exit(2)
+        try:
+            entry = {"dotw": _build_dotw(from_, to, days)}
+        except ValueError as e:
+            typer.echo(f"Bad --days: {e}", err=True)
             raise typer.Exit(2)
-        entry = {"from": from_, "to": to}
         if description:
             entry["description"] = description
         tmdates = [entry]