systemlink-cli 1.6.2__tar.gz → 1.6.4__tar.gz

{systemlink_cli-1.6.2 → systemlink_cli-1.6.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: systemlink-cli
-Version: 1.6.2
+Version: 1.6.4
 Summary: SystemLink Integrator CLI - cross-platform CLI for SystemLink workflows and templates.
 License-File: LICENSE
 Author: Fred Visser

{systemlink_cli-1.6.2 → systemlink_cli-1.6.4}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "systemlink-cli"
-version = "1.6.2"
+version = "1.6.4"
 description = "SystemLink Integrator CLI - cross-platform CLI for SystemLink workflows and templates."
 authors = ["Fred Visser <fred.visser@emerson.com>"]
 packages = [{ include = "slcli" }]

{systemlink_cli-1.6.2 → systemlink_cli-1.6.4}/slcli/_version.py

@@ -1,4 +1,4 @@
 """Version information for slcli."""
 
 # This file is auto-generated. Do not edit manually.
-__version__ = "1.6.2"
+__version__ = "1.6.4"

{systemlink_cli-1.6.2 → systemlink_cli-1.6.4}/slcli/skills/systemlink-webapp/SKILL.md

@@ -161,6 +161,9 @@ import { APP_BASE_HREF } from '@angular/common';
 // Most Nimble component modules are exported from the main `@ni/nimble-angular` barrel.
 // Icon modules (e.g. NimbleIconMagnifyingGlassModule) are ONLY in the main barrel —
 // sub-paths like `@ni/nimble-angular/icons/magnifying-glass` do NOT exist.
+// Do NOT add `@ni/nimble-components` or register raw custom elements just to make
+// Angular templates compile. If a Nimble element is unknown, import the missing
+// Angular module from `@ni/nimble-angular` instead.
 import {
   NimbleThemeProviderModule,
   NimbleButtonModule,
@@ -214,8 +217,25 @@ import { MyFeatureComponent } from './my-feature/my-feature.component';
 export class AppModule {}
 ```
 
+When using `@ni/nimble-angular`, prefer the Angular wrappers end-to-end:
+
+- Do **not** add `@ni/nimble-components` as a direct dependency just to register icons or other raw custom elements.
+- Do **not** use `CUSTOM_ELEMENTS_SCHEMA` as a workaround for unknown Nimble elements. In this codebase that is usually a sign that the corresponding Nimble Angular module import is missing, and `CUSTOM_ELEMENTS_SCHEMA` suppresses valuable template checking.
+- If Angular reports an unknown Nimble tag, fix the module imports first.
+
 For Nimble form controls (`nimble-text-field`, `nimble-select`, etc.), bind with Angular forms APIs (`[(ngModel)]`, `[formControl]`, or `formControlName`) and use `(ngModelChange)` for value-change reactions. Avoid native control bindings like `[value]`, `(input)`, or `(change)` on Nimble elements.
 
+For control labels, prefer Nimble's built-in label pattern by slotting text content inside the control instead of pairing the control with a separate HTML `<label>` element for the primary label:
+
+```html
+<nimble-select [(ngModel)]="selectedWorkspace">
+  Workspace
+  <nimble-list-option *ngFor="let ws of workspaces" [value]="ws.id">
+    {{ ws.name }}
+  </nimble-list-option>
+</nimble-select>
+```
+
 **Critical:** Provide `APP_BASE_HREF` via DI and **remove the `<base href="/">` tag from `index.html`**. SystemLink enforces a `base-uri 'self'` CSP directive; the `<base>` element violates it.
 
 ---
@@ -737,6 +757,8 @@ Save the returned webapp ID — you'll need it for every subsequent redeploy.
 | `InputFieldValidationError` on API call | SDK-generated request body has wrong shape | Inspect raw API; the generated type may add or omit a `request: {}` wrapper. Use direct `fetch` with manually constructed body |
 | nimble-dialog does not open | `*ngIf` destroys element before `ViewChild` can resolve | Remove `*ngIf` from the dialog element; use `@ViewChild` + `ElementRef` and call `nativeElement.show()` / `nativeElement.close()` |
 | Icon module import fails | Icon sub-path `@ni/nimble-angular/icons/...` does not exist | Import icon modules from the main `@ni/nimble-angular` barrel only |
+| Angular says a Nimble tag is unknown | Missing `@ni/nimble-angular` module import | Import the missing wrapper module instead of adding `CUSTOM_ELEMENTS_SCHEMA` or registering raw `@ni/nimble-components` elements |
+| Nimble form control label looks detached or duplicated | Used a separate HTML `<label>` for the primary control label | Slot the label text inside `nimble-text-field`, `nimble-select`, and similar controls |
 | Table rows empty despite correct response | `projection` flattens nested objects | Remove `projection` from query body |
 | `TableRecord` type error | Row type missing index signature | Add `[key: string]: FieldValue \| undefined` |
 | Button appearance invalid | Wrong value for `appearance` attr | Use `appearance="block" appearance-variant="accent"` |

{systemlink_cli-1.6.2 → systemlink_cli-1.6.4}/slcli/skills/systemlink-webapp/references/nimble-angular.md

@@ -1,5 +1,13 @@
 # Nimble Angular — Template & Usage Reference
 
+## Wrapper-first rule
+
+When building Angular apps with Nimble, use `@ni/nimble-angular` wrapper modules as the default integration path.
+
+- Import the needed Angular module for each Nimble control instead of registering raw custom elements from `@ni/nimble-components`.
+- Do not add `CUSTOM_ELEMENTS_SCHEMA` just to silence unknown Nimble elements in templates. That usually hides a missing module import and weakens Angular's template validation.
+- If a Nimble icon or control is unknown, first look for the matching module in `@ni/nimble-angular` and import it.
+
 ## nimble-theme-provider
 
 Wrap your entire app. Always place at the root component level.
@@ -176,6 +184,8 @@ import { NimbleTextFieldModule } from "@ni/nimble-angular";
 </nimble-text-field>
 ```
 
+Use the text inside the element as the control's primary label. Do not add a separate HTML `<label>` element for the basic Nimble control label unless you have a specific accessibility or layout need that cannot be expressed with Nimble's built-in labeling pattern.
+
 Import icon modules from the **main `@ni/nimble-angular` barrel** — icon-specific sub-paths do not exist:
 
 ```typescript
@@ -195,6 +205,7 @@ import { NimbleSelectModule, NimbleListOptionModule } from "@ni/nimble-angular";
 ```html
 <!-- Basic -->
 <nimble-select [(ngModel)]="selectedType" (ngModelChange)="onTypeChange()">
+  Type
   <nimble-list-option value="">All types</nimble-list-option>
   <nimble-list-option value="DOUBLE">Double</nimble-list-option>
   <nimble-list-option value="STRING">String</nimble-list-option>
@@ -203,12 +214,15 @@ import { NimbleSelectModule, NimbleListOptionModule } from "@ni/nimble-angular";
 
 <!-- With built-in filter (useful for long lists) -->
 <nimble-select filter-mode="standard" [(ngModel)]="selectedWorkspace">
+  Workspace
   <nimble-list-option *ngFor="let ws of workspaces" [value]="ws.id"
     >{{ ws.name }}</nimble-list-option
   >
 </nimble-select>
 ```
 
+Use the slotted text content as the select label instead of pairing the control with a separate HTML `<label>` for the primary label.
+
 > Use `filter-mode="standard"` to add a built-in text filter to the dropdown — no custom search logic needed for long option lists.
 
 ---

{systemlink_cli-1.6.2 → systemlink_cli-1.6.4}/slcli/user_click.py

@@ -29,6 +29,103 @@ from .workspace_utils import get_workspace_display_name, resolve_workspace_id
 
 USER_QUERY_PAGE_SIZE = 100
 USER_JSON_DEFAULT_TAKE = 1000
+AUTH_WILDCARD_VALUES = {"*", "*/*", "*:*"}
+AUTH_MUTATING_VERBS = {"*", "create", "write", "update", "manage", "admin", "delete"}
+AUTH_ADMIN_RESOURCE_KEYWORDS = {"policy", "policies", "role", "roles"}
+
+
+def _has_global_auth_scope(value: Any) -> bool:
+    """Return whether an auth scope value grants wildcard access."""
+    if isinstance(value, str):
+        return value.strip().lower() in AUTH_WILDCARD_VALUES
+    if isinstance(value, list):
+        return any(
+            isinstance(item, str) and item.strip().lower() in AUTH_WILDCARD_VALUES for item in value
+        )
+    return False
+
+
+def _action_grants_auth_management(action: str) -> bool:
+    """Return whether an action implies auth policy or role management access."""
+    normalized = action.strip().lower()
+    if normalized in AUTH_WILDCARD_VALUES:
+        return True
+
+    action_parts = [part.strip().lower() for part in normalized.split(":") if part.strip()]
+    if len(action_parts) < 2 or action_parts[0] not in {"niauth", "auth"}:
+        return False
+
+    remainder = action_parts[1:]
+    if remainder == ["*"]:
+        return True
+
+    if remainder[-1] not in AUTH_MUTATING_VERBS and "*" not in remainder:
+        return False
+
+    if len(remainder) == 1:
+        return True
+
+    return any(part in AUTH_ADMIN_RESOURCE_KEYWORDS for part in remainder[:-1])
+
+
+def _has_user_admin_access(auth_context: Dict[str, Any]) -> bool:
+    """Return whether the current caller appears to have server-admin style access."""
+    for policy in auth_context.get("policies", []):
+        statements = policy.get("statements", [])
+        if not isinstance(statements, list):
+            continue
+
+        for statement in statements:
+            if not isinstance(statement, dict):
+                continue
+
+            if not _has_global_auth_scope(statement.get("workspace")):
+                continue
+            if not _has_global_auth_scope(statement.get("resource")):
+                continue
+
+            actions = statement.get("actions", [])
+            if not isinstance(actions, list):
+                continue
+
+            for action in actions:
+                if isinstance(action, str) and _action_grants_auth_management(action):
+                    return True
+
+    return False
+
+
+def _try_get_current_auth_context() -> Optional[Dict[str, Any]]:
+    """Fetch effective auth data for the current caller when available."""
+    url = f"{get_base_url()}/niauth/v1/auth"
+
+    try:
+        auth_response = make_api_request("GET", url, payload=None, handle_errors=False)
+        auth_context = auth_response.json()
+        return auth_context if isinstance(auth_context, dict) else None
+    except Exception as exc:
+        error_response = getattr(exc, "response", None)
+        if error_response is not None and error_response.status_code in {401, 403}:
+            handle_api_error(exc)
+        return None
+
+
+def _ensure_user_admin_access(operation: str) -> None:
+    """Fail fast when the caller clearly lacks admin access for user mutations."""
+    auth_context = _try_get_current_auth_context()
+    if auth_context is None:
+        return
+
+    if _has_user_admin_access(auth_context):
+        return
+
+    click.echo(
+        f"✗ User and service account {operation} requires server admin permissions. "
+        "The active API key does not appear to have wildcard auth role or policy access "
+        "across all workspaces.",
+        err=True,
+    )
+    sys.exit(ExitCodes.PERMISSION_DENIED)
 
 
 def _get_policy_details(policy_id: str) -> Optional[dict]:
@@ -851,6 +948,7 @@ def register_user_commands(cli: click.Group) -> None:
         from .utils import check_readonly_mode
 
         check_readonly_mode("create a user")
+        _ensure_user_admin_access("creation")
 
         # If user_type wasn't specified via CLI, prompt for it first
         if user_type is None:
@@ -1060,6 +1158,7 @@ def register_user_commands(cli: click.Group) -> None:
         from .utils import check_readonly_mode
 
         check_readonly_mode("update a user")
+        _ensure_user_admin_access("updates")
 
         # First, fetch the user to check if it's a service account
         get_url = f"{get_base_url()}/niuser/v1/users/{user_id}"

{systemlink_cli-1.6.2 → systemlink_cli-1.6.4}/slcli/utils.py

@@ -75,7 +75,7 @@ def handle_api_error(exc: Exception) -> None:
     if "not found" in error_msg:
         click.echo(f"✗ Resource not found: {exc}", err=True)
         sys.exit(ExitCodes.NOT_FOUND)
-    elif "permission" in error_msg or "unauthorized" in error_msg:
+    elif "permission" in error_msg or "unauthorized" in error_msg or "forbidden" in error_msg:
         click.echo(f"✗ Permission denied: {exc}", err=True)
         sys.exit(ExitCodes.PERMISSION_DENIED)
     elif "network" in error_msg or "connection" in error_msg: