systemlink-cli 1.6.1__tar.gz → 1.6.3__tar.gz

{systemlink_cli-1.6.1 → systemlink_cli-1.6.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: systemlink-cli
-Version: 1.6.1
+Version: 1.6.3
 Summary: SystemLink Integrator CLI - cross-platform CLI for SystemLink workflows and templates.
 License-File: LICENSE
 Author: Fred Visser

{systemlink_cli-1.6.1 → systemlink_cli-1.6.3}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "systemlink-cli"
-version = "1.6.1"
+version = "1.6.3"
 description = "SystemLink Integrator CLI - cross-platform CLI for SystemLink workflows and templates."
 authors = ["Fred Visser <fred.visser@emerson.com>"]
 packages = [{ include = "slcli" }]

{systemlink_cli-1.6.1 → systemlink_cli-1.6.3}/slcli/_version.py

@@ -1,4 +1,4 @@
 """Version information for slcli."""
 
 # This file is auto-generated. Do not edit manually.
-__version__ = "1.6.1"
+__version__ = "1.6.3"

{systemlink_cli-1.6.1 → systemlink_cli-1.6.3}/slcli/skills/slcli/SKILL.md

@@ -666,7 +666,7 @@ Scaffold, package, and publish custom web applications to SystemLink.
 
 ```bash
 slcli webapp init <DIRECTORY>                      # Scaffold the Angular starter
-slcli webapp manifest init <DIRECTORY> [OPTIONS]  # Create manifest.json + nipkg.config.json
+slcli webapp manifest init <DIRECTORY> [OPTIONS]  # Create nipkg.config.json for packaging
 slcli webapp pack [FOLDER] [--config FILE] [-o OUTPUT_FILE]  # Package a webapp into a .nipkg
 slcli webapp list [-w WORKSPACE] [-t INT] [-f json]
 slcli webapp get <WEBAPP_ID> [-f json]
@@ -680,11 +680,12 @@ project-scoped skills into `.agents/skills/` and creates `PROMPTS.md` plus `STAR
 AI assistant can bootstrap the Angular workspace in place with the same Nimble/SystemLink
 conventions described by the `systemlink-webapp` skill.
 
-`webapp manifest init` writes `manifest.json` and `nipkg.config.json` using the Plugin Manager
-field names (`section`, `maintainer`, `homepage`, `xbPlugin`, `slPluginManagerTags`,
+`webapp manifest init` writes `nipkg.config.json` using the Plugin Manager field names
+(`section`, `maintainer`, `homepage`, `xbPlugin`, `slPluginManagerTags`,
 `slPluginManagerMinServerVersion`, `iconFile`). `webapp pack --config ...` consumes that
-metadata, carries the icon into the package, and writes the matching control-file fields into the
-generated `.nipkg`.
+metadata, carries the icon into the package, writes the matching control-file fields into the
+generated `.nipkg`, and emits a thin `manifest.json` with `schemaVersion`, `nipkgFile`,
+`sha256`, and any configured provenance fields.
 
 ### skill — AI skill installation
 

{systemlink_cli-1.6.1 → systemlink_cli-1.6.3}/slcli/skills/systemlink-webapp/SKILL.md

@@ -24,8 +24,9 @@ That command lays down the SystemLink starter layer (`.agents/skills/`, `PROMPTS
 `START_HERE.md`) while Angular CLI remains responsible for generating the Angular workspace.
 
 When the user wants to package the app for Plugin Manager submission, prefer
-`slcli webapp manifest init <app-dir> ...` to generate `manifest.json` and `nipkg.config.json`
-with the current Plugin Manager field names, then use `slcli webapp pack --config ...`.
+`slcli webapp manifest init <app-dir> ...` to generate `nipkg.config.json`
+with the current Plugin Manager field names, then use `slcli webapp pack --config ...`
+to build the `.nipkg` and generate the thin `manifest.json` with the artifact SHA-256.
 
 ---
 

{systemlink_cli-1.6.1 → systemlink_cli-1.6.3}/slcli/user_click.py

@@ -29,6 +29,103 @@ from .workspace_utils import get_workspace_display_name, resolve_workspace_id
 
 USER_QUERY_PAGE_SIZE = 100
 USER_JSON_DEFAULT_TAKE = 1000
+AUTH_WILDCARD_VALUES = {"*", "*/*", "*:*"}
+AUTH_MUTATING_VERBS = {"*", "create", "write", "update", "manage", "admin", "delete"}
+AUTH_ADMIN_RESOURCE_KEYWORDS = {"policy", "policies", "role", "roles"}
+
+
+def _has_global_auth_scope(value: Any) -> bool:
+    """Return whether an auth scope value grants wildcard access."""
+    if isinstance(value, str):
+        return value.strip().lower() in AUTH_WILDCARD_VALUES
+    if isinstance(value, list):
+        return any(
+            isinstance(item, str) and item.strip().lower() in AUTH_WILDCARD_VALUES for item in value
+        )
+    return False
+
+
+def _action_grants_auth_management(action: str) -> bool:
+    """Return whether an action implies auth policy or role management access."""
+    normalized = action.strip().lower()
+    if normalized in AUTH_WILDCARD_VALUES:
+        return True
+
+    action_parts = [part.strip().lower() for part in normalized.split(":") if part.strip()]
+    if len(action_parts) < 2 or action_parts[0] not in {"niauth", "auth"}:
+        return False
+
+    remainder = action_parts[1:]
+    if remainder == ["*"]:
+        return True
+
+    if remainder[-1] not in AUTH_MUTATING_VERBS and "*" not in remainder:
+        return False
+
+    if len(remainder) == 1:
+        return True
+
+    return any(part in AUTH_ADMIN_RESOURCE_KEYWORDS for part in remainder[:-1])
+
+
+def _has_user_admin_access(auth_context: Dict[str, Any]) -> bool:
+    """Return whether the current caller appears to have server-admin style access."""
+    for policy in auth_context.get("policies", []):
+        statements = policy.get("statements", [])
+        if not isinstance(statements, list):
+            continue
+
+        for statement in statements:
+            if not isinstance(statement, dict):
+                continue
+
+            if not _has_global_auth_scope(statement.get("workspace")):
+                continue
+            if not _has_global_auth_scope(statement.get("resource")):
+                continue
+
+            actions = statement.get("actions", [])
+            if not isinstance(actions, list):
+                continue
+
+            for action in actions:
+                if isinstance(action, str) and _action_grants_auth_management(action):
+                    return True
+
+    return False
+
+
+def _try_get_current_auth_context() -> Optional[Dict[str, Any]]:
+    """Fetch effective auth data for the current caller when available."""
+    url = f"{get_base_url()}/niauth/v1/auth"
+
+    try:
+        auth_response = make_api_request("GET", url, payload=None, handle_errors=False)
+        auth_context = auth_response.json()
+        return auth_context if isinstance(auth_context, dict) else None
+    except Exception as exc:
+        error_response = getattr(exc, "response", None)
+        if error_response is not None and error_response.status_code in {401, 403}:
+            handle_api_error(exc)
+        return None
+
+
+def _ensure_user_admin_access(operation: str) -> None:
+    """Fail fast when the caller clearly lacks admin access for user mutations."""
+    auth_context = _try_get_current_auth_context()
+    if auth_context is None:
+        return
+
+    if _has_user_admin_access(auth_context):
+        return
+
+    click.echo(
+        f"✗ User and service account {operation} requires server admin permissions. "
+        "The active API key does not appear to have wildcard auth role or policy access "
+        "across all workspaces.",
+        err=True,
+    )
+    sys.exit(ExitCodes.PERMISSION_DENIED)
 
 
 def _get_policy_details(policy_id: str) -> Optional[dict]:
@@ -851,6 +948,7 @@ def register_user_commands(cli: click.Group) -> None:
         from .utils import check_readonly_mode
 
         check_readonly_mode("create a user")
+        _ensure_user_admin_access("creation")
 
         # If user_type wasn't specified via CLI, prompt for it first
         if user_type is None:
@@ -1060,6 +1158,7 @@ def register_user_commands(cli: click.Group) -> None:
         from .utils import check_readonly_mode
 
         check_readonly_mode("update a user")
+        _ensure_user_admin_access("updates")
 
         # First, fetch the user to check if it's a service account
         get_url = f"{get_base_url()}/niuser/v1/users/{user_id}"

{systemlink_cli-1.6.1 → systemlink_cli-1.6.3}/slcli/utils.py

@@ -75,7 +75,7 @@ def handle_api_error(exc: Exception) -> None:
     if "not found" in error_msg:
         click.echo(f"✗ Resource not found: {exc}", err=True)
         sys.exit(ExitCodes.NOT_FOUND)
-    elif "permission" in error_msg or "unauthorized" in error_msg:
+    elif "permission" in error_msg or "unauthorized" in error_msg or "forbidden" in error_msg:
         click.echo(f"✗ Permission denied: {exc}", err=True)
         sys.exit(ExitCodes.PERMISSION_DENIED)
     elif "network" in error_msg or "connection" in error_msg:

{systemlink_cli-1.6.1 → systemlink_cli-1.6.3}/slcli/webapp_click.py

@@ -4,6 +4,7 @@ Provides local scaffolding (init), packing helpers (pack), and remote
 management (list, get, delete, publish, open).
 """
 
+import hashlib
 import io
 import re
 import shutil
@@ -45,6 +46,10 @@ _ALLOWED_ICON_EXTENSIONS = frozenset({".svg", ".png", ".jpg", ".jpeg", ".webp",
 _MAX_PACKAGE_LENGTH = 100
 _MAX_DISPLAY_NAME_LENGTH = 200
 _MAX_DESCRIPTION_LENGTH = 5000
+_MAX_RELEASE_TAG_LENGTH = 200
+_MAX_SCREENSHOT_COUNT = 3
+_SOURCE_REPO_PATTERN = re.compile(r"^[A-Za-z0-9._-]+/[A-Za-z0-9._-]+$")
+_SOURCE_COMMIT_PATTERN = re.compile(r"^[0-9a-f]{40}$")
 _ALLOWED_PLUGIN_MANAGER_KEYS = {
     "buildCommand",
     "buildDir",
@@ -56,7 +61,11 @@ _ALLOWED_PLUGIN_MANAGER_KEYS = {
     "maintainer",
     "nipkgFile",
     "package",
+    "releaseTag",
     "section",
+    "screenshots",
+    "sourceCommit",
+    "sourceRepo",
     "slPluginManagerMinServerVersion",
     "slPluginManagerTags",
     "version",
@@ -237,6 +246,15 @@ def _copy_icon_file_to_directory(source_icon: Path, directory: Path) -> bool:
     return True
 
 
+def _compute_sha256(file_path: Path) -> str:
+    """Return the SHA-256 checksum for a file."""
+    sha256_hash = hashlib.sha256()
+    with open(file_path, "rb") as input_file:
+        for chunk in iter(lambda: input_file.read(1024 * 1024), b""):
+            sha256_hash.update(chunk)
+    return sha256_hash.hexdigest()
+
+
 def _normalize_plugin_manager_metadata(raw_metadata: Dict[str, Any]) -> Dict[str, Any]:
     """Normalize legacy App Store keys to Plugin Manager keys."""
     metadata = dict(raw_metadata)
@@ -252,8 +270,8 @@ def _validate_plugin_manager_metadata(
     raw_metadata: Dict[str, Any],
     require_build_dir: bool = False,
     base_dir: Optional[Path] = None,
-) -> Dict[str, str]:
-    """Validate and normalize Plugin Manager manifest metadata."""
+) -> Dict[str, Any]:
+    """Validate and normalize Plugin Manager packaging metadata."""
     from urllib.parse import urlparse
 
     metadata = _normalize_plugin_manager_metadata(raw_metadata)
@@ -274,8 +292,13 @@ def _validate_plugin_manager_metadata(
     build_dir = str(metadata.get("buildDir", "")).strip()
     build_command = str(metadata.get("buildCommand", "")).strip()
     icon_file = str(metadata.get("iconFile", "")).strip()
+    source_repo = str(metadata.get("sourceRepo", "")).strip()
+    release_tag = str(metadata.get("releaseTag", "")).strip()
+    source_commit = str(metadata.get("sourceCommit", "")).strip()
+    screenshots_raw = metadata.get("screenshots")
 
     errors: List[str] = []
+    screenshots: List[str] = []
 
     if unexpected_keys:
         errors.append("unexpected field(s): " + ", ".join(unexpected_keys))
@@ -308,6 +331,25 @@ def _validate_plugin_manager_metadata(
         errors.append(f"xbPlugin must be one of: {', '.join(_XB_PLUGIN_VALUES)}")
     if nipkg_file and not nipkg_file.endswith(".nipkg"):
         errors.append("nipkgFile must end with .nipkg")
+    if source_repo and not _SOURCE_REPO_PATTERN.match(source_repo):
+        errors.append("sourceRepo must be in owner/name format")
+    if release_tag and len(release_tag) > _MAX_RELEASE_TAG_LENGTH:
+        errors.append(f"releaseTag must be at most {_MAX_RELEASE_TAG_LENGTH} characters")
+    if source_commit and not _SOURCE_COMMIT_PATTERN.match(source_commit):
+        errors.append("sourceCommit must be a 40-character lowercase git SHA")
+    if bool(source_repo) != bool(release_tag):
+        errors.append("sourceRepo and releaseTag must be provided together")
+    if screenshots_raw not in (None, ""):
+        if not isinstance(screenshots_raw, list):
+            errors.append("screenshots must be an array of filenames")
+        else:
+            screenshots = [str(item).strip() for item in screenshots_raw]
+            if any(not item for item in screenshots):
+                errors.append("screenshots entries must be non-empty strings")
+            if len(screenshots) > _MAX_SCREENSHOT_COUNT:
+                errors.append(f"screenshots must contain at most {_MAX_SCREENSHOT_COUNT} items")
+            if len(set(screenshots)) != len(screenshots):
+                errors.append("screenshots entries must be unique")
     if require_build_dir and not build_dir:
         errors.append("buildDir is required when packing from config without a folder argument")
     icon_error = _validate_icon_file_value(icon_file, base_dir)
@@ -320,7 +362,7 @@ def _validate_plugin_manager_metadata(
             click.echo(f"  - {error}", err=True)
         sys.exit(ExitCodes.INVALID_INPUT)
 
-    validated: Dict[str, str] = {
+    validated: Dict[str, Any] = {
         "package": package_name,
         "version": version,
         "displayName": display_name,
@@ -342,6 +384,14 @@ def _validate_plugin_manager_metadata(
     if build_command:
         validated["buildCommand"] = build_command
     validated["iconFile"] = icon_file
+    if source_repo:
+        validated["sourceRepo"] = source_repo
+    if release_tag:
+        validated["releaseTag"] = release_tag
+    if source_commit:
+        validated["sourceCommit"] = source_commit
+    if screenshots:
+        validated["screenshots"] = screenshots
 
     return validated
 
@@ -349,7 +399,7 @@ def _validate_plugin_manager_metadata(
 def _pack_folder_to_nipkg(
     folder: Path,
     output: Optional[Path] = None,
-    metadata: Optional[Dict[str, str]] = None,
+    metadata: Optional[Dict[str, Any]] = None,
     icon_source: Optional[Path] = None,
 ) -> Path:
     """Pack a folder into a .nipkg (ar) file and return the output path.
@@ -530,7 +580,27 @@ def _build_angular_bootstrap_command(directory: Path) -> str:
     )
 
 
-def _build_webapp_manifest_and_config(
+def _build_submission_manifest(
+    nipkg_path: Path, metadata: Optional[Dict[str, Any]] = None
+) -> Dict[str, Any]:
+    """Build the thin submission manifest from a packaged artifact."""
+    manifest: Dict[str, Any] = {
+        "schemaVersion": 2,
+        "nipkgFile": nipkg_path.name,
+        "sha256": _compute_sha256(nipkg_path),
+    }
+    if metadata is not None:
+        for key in ("sourceRepo", "releaseTag", "sourceCommit"):
+            value = metadata.get(key)
+            if value:
+                manifest[key] = value
+        screenshots = metadata.get("screenshots")
+        if screenshots:
+            manifest["screenshots"] = screenshots
+    return manifest
+
+
+def _build_webapp_pack_config(
     package_name: str,
     version: str,
     display_name: str,
@@ -546,9 +616,12 @@ def _build_webapp_manifest_and_config(
     build_command: str,
     icon_file: str,
     icon_validation_base_dir: Path,
-) -> tuple[Dict[str, str], Dict[str, str]]:
-    """Build validated submission manifest and nipkg config payloads."""
-    manifest = _validate_plugin_manager_metadata(
+    source_repo: str,
+    release_tag: str,
+    source_commit: str,
+) -> Dict[str, Any]:
+    """Build validated nipkg.config.json payloads."""
+    pack_config = _validate_plugin_manager_metadata(
         {
             "package": package_name,
             "version": version,
@@ -561,18 +634,19 @@ def _build_webapp_manifest_and_config(
             "xbPlugin": xb_plugin,
             "slPluginManagerTags": tags,
             "slPluginManagerMinServerVersion": min_server_version,
-            "nipkgFile": _default_nipkg_filename(package_name, version),
             "iconFile": icon_file,
+            "sourceRepo": source_repo,
+            "releaseTag": release_tag,
+            "sourceCommit": source_commit,
         },
         base_dir=icon_validation_base_dir,
     )
 
-    pack_config = dict(manifest)
     pack_config.pop("nipkgFile", None)
     pack_config["buildDir"] = build_dir
     pack_config["buildCommand"] = build_command
 
-    return manifest, pack_config
+    return pack_config
 
 
 def _render_angular_prompts_md(directory: Path) -> str:
@@ -658,7 +732,7 @@ This directory was initialized with `slcli webapp init`.
 - bundled AI skills in `.agents/skills/`
 - ready-made prompts in [PROMPTS.md](PROMPTS.md)
 - deployment guidance for `slcli webapp publish`
-- Plugin Manager manifest scaffolding via `slcli webapp manifest init`
+- Plugin Manager packaging config scaffolding via `slcli webapp manifest init`
 
 Angular CLI remains the source of truth for the Angular workspace itself. That
 keeps the generated project aligned with current Angular defaults while the
@@ -774,7 +848,7 @@ def register_webapp_commands(cli: Any) -> None:
 
     @webapp.group(name="manifest")
     def webapp_manifest() -> None:
-        """Create Plugin Manager submission manifests and packaging config files."""
+        """Create Plugin Manager packaging config and submission manifest inputs."""
 
     @webapp_manifest.command(name="init")
     @click.argument(
@@ -810,12 +884,27 @@ def register_webapp_commands(cli: Any) -> None:
         show_default=True,
         help="Build command written to nipkg.config.json",
     )
+    @click.option(
+        "--source-repo",
+        default="",
+        help="Optional provenance repository in owner/name format for the generated manifest",
+    )
+    @click.option(
+        "--release-tag",
+        default="",
+        help="Optional provenance release tag for the generated manifest",
+    )
+    @click.option(
+        "--source-commit",
+        default="",
+        help="Optional source commit SHA for the generated manifest",
+    )
     @click.option(
         "--icon-file",
         required=True,
         help="Path to the icon asset; copied into the manifest directory as iconFile",
     )
-    @click.option("--force", is_flag=True, help="Overwrite existing manifest files")
+    @click.option("--force", is_flag=True, help="Overwrite existing packaging files")
     def init_manifest(
         directory: Path,
         package_name: str,
@@ -831,10 +920,13 @@ def register_webapp_commands(cli: Any) -> None:
         min_server_version: str,
         build_dir: str,
         build_command: str,
+        source_repo: str,
+        release_tag: str,
+        source_commit: str,
         icon_file: str,
         force: bool,
     ) -> None:
-        """Write manifest.json and nipkg.config.json using the Plugin Manager contract."""
+        """Write nipkg.config.json for Plugin Manager packaging."""
         try:
             directory.mkdir(parents=True, exist_ok=True)
 
@@ -842,11 +934,8 @@ def register_webapp_commands(cli: Any) -> None:
             display_name = display_name or _default_display_name(package_name)
             build_dir = build_dir or _default_angular_build_dir(directory)
 
-            manifest_path = directory / "manifest.json"
             config_path = directory / "nipkg.config.json"
             existing = []
-            if manifest_path.exists() and not force:
-                existing.append("manifest.json")
             if config_path.exists() and not force:
                 existing.append("nipkg.config.json")
             if existing:
@@ -860,7 +949,7 @@ def register_webapp_commands(cli: Any) -> None:
                 icon_file, directory, force
             )
 
-            manifest, pack_config = _build_webapp_manifest_and_config(
+            pack_config = _build_webapp_pack_config(
                 package_name=package_name,
                 version=version,
                 display_name=display_name,
@@ -876,11 +965,13 @@ def register_webapp_commands(cli: Any) -> None:
                 build_command=build_command,
                 icon_file=manifest_icon_file,
                 icon_validation_base_dir=source_icon.parent,
+                source_repo=source_repo,
+                release_tag=release_tag,
+                source_commit=source_commit,
             )
 
             copied_icon = _copy_icon_file_to_directory(source_icon, directory)
             try:
-                save_json_file(manifest, str(manifest_path))
                 save_json_file(pack_config, str(config_path))
             except Exception:
                 if copied_icon:
@@ -888,11 +979,10 @@ def register_webapp_commands(cli: Any) -> None:
                 raise
 
             format_success(
-                "Created Plugin Manager manifest files",
+                "Created Plugin Manager pack config",
                 {
-                    "Manifest": str(manifest_path),
                     "Pack config": str(config_path),
-                    "nipkgFile": manifest["nipkgFile"],
+                    "Next step": "Run slcli webapp pack --config nipkg.config.json to generate the .nipkg and manifest.json",
                 },
             )
         except SystemExit:
@@ -928,7 +1018,7 @@ def register_webapp_commands(cli: Any) -> None:
     ) -> None:
         """Pack a folder into a .nipkg."""
         try:
-            metadata: Optional[Dict[str, str]] = None
+            metadata: Optional[Dict[str, Any]] = None
             resolved_folder = folder
 
             if config_path is not None:
@@ -969,7 +1059,14 @@ def register_webapp_commands(cli: Any) -> None:
                 icon_source = _resolve_local_path(metadata["iconFile"], config_path.parent)
 
             result = _pack_folder_to_nipkg(resolved_folder, out, metadata, icon_source)
-            format_success("Packed folder", {"Path": str(result)})
+            success_data: Dict[str, str] = {"Path": str(result)}
+            if metadata is not None and config_path is not None:
+                manifest_path = config_path.parent / "manifest.json"
+                submission_manifest = _build_submission_manifest(result, metadata)
+                save_json_file(submission_manifest, str(manifest_path))
+                success_data["Manifest"] = str(manifest_path)
+
+            format_success("Packed folder", success_data)
         except SystemExit:
             raise
         except Exception as exc: