bt-cli 0.4.59__tar.gz → 0.4.60__tar.gz

{bt_cli-0.4.59 → bt_cli-0.4.60}/CLAUDE.md

@@ -1,6 +1,6 @@
 # BT-CLI
 
-BeyondTrust Platform CLI for Password Safe, Entitle, PRA, EPM Windows, EPM Linux, and the BeyondTrust Secrets API. **Version: 0.4.59**
+BeyondTrust Platform CLI for Password Safe, Entitle, PRA, EPM Windows, EPM Linux, and the BeyondTrust Secrets API. **Version: 0.4.60**
 
 ## Setup
 

{bt_cli-0.4.59 → bt_cli-0.4.60}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: bt-cli
-Version: 0.4.59
+Version: 0.4.60
 Summary: BeyondTrust Platform CLI (unofficial) - Password Safe, Entitle, PRA, EPM
 Author-email: Dave Grendysz <dgrendysz@beyondtrust.com>
 License: MIT

{bt_cli-0.4.59 → bt_cli-0.4.60}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "bt-cli"
-version = "0.4.59"
+version = "0.4.60"
 description = "BeyondTrust Platform CLI (unofficial) - Password Safe, Entitle, PRA, EPM"
 readme = "README.md"
 requires-python = ">=3.9"

{bt_cli-0.4.59 → bt_cli-0.4.60}/src/bt_cli/__init__.py

@@ -1,3 +1,3 @@
 """BeyondTrust Unified Admin CLI."""
 
-__version__ = "0.4.59"
+__version__ = "0.4.60"

{bt_cli-0.4.59 → bt_cli-0.4.60}/src/bt_cli/pws/commands/secrets.py

@@ -297,12 +297,17 @@ def grant_safe_permission(
     safe_id: str = typer.Argument(..., help="Safe ID (GUID)"),
     user_id: Optional[int] = typer.Option(None, "--user", "-u", help="User ID to grant permission"),
     group_id: Optional[int] = typer.Option(None, "--group", "-g", help="Group ID to grant permission"),
-    permissions: str = typer.Option(..., "--permissions", "-p", help="Comma-separated permission flags (e.g., Read,Write)"),
+    permissions: str = typer.Option(..., "--permissions", "-p", help='Comma-separated flags, e.g. "Read" or "Read, Create, Edit, Delete, Share, Manage"'),
     expires: Optional[str] = typer.Option(None, "--expires", "-e", help="Expiry datetime (ISO format)"),
 ) -> None:
     """Grant permissions to a user or group on a safe.
 
-    Use 'pws secrets safes permissions-options' to see available permission flags.
+    Flags come from 'pws secrets safes permissions-options' (None, Read, Create,
+    Edit, Delete, Share, Manage) but are NOT freely combinable — the server
+    validates the whole set. Valid combos include: "Read"; "Read, Edit";
+    "Read, Create, Edit, Delete, Share"; and "Read, Create, Edit, Delete, Share,
+    Manage" (full owner). "Manage" is only valid with the full lower set, so
+    e.g. "Read, Edit, Manage" is rejected as an invalid combination.
     """
     try:
         if not user_id and not group_id: