tinybird 0.0.1.dev94__tar.gz → 0.0.1.dev96__tar.gz

{tinybird-0.0.1.dev94 → tinybird-0.0.1.dev96}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.2
 Name: tinybird
-Version: 0.0.1.dev94
+Version: 0.0.1.dev96
 Summary: Tinybird Command Line Tool
 Home-page: https://www.tinybird.co/docs/cli/introduction.html
 Author: Tinybird

{tinybird-0.0.1.dev94 → tinybird-0.0.1.dev96}/tinybird/prompts.py

@@ -419,13 +419,15 @@ You are a Tinybird expert. You will be given a prompt to generate new or update
 {pipe_example}
 {copy_pipe_instructions}
 {materialized_pipe_instructions}
+{connection_instructions}
+{connection_example}
 
 {feedback_history}
 
 Use the following format to generate the response and do not wrap it in any other text, including the <response> tag.
 <response>
     <resource>
-        <type>[datasource or pipe]</type>
+        <type>[datasource or pipe or connection]</type>
         <name>[resource name here]</name>
         <content>[resource content here]</content>
     </resource>
@@ -440,6 +442,8 @@ Use the following format to generate the response and do not wrap it in any othe
         pipe_example=pipe_example,
         copy_pipe_instructions=copy_pipe_instructions,
         materialized_pipe_instructions=materialized_pipe_instructions,
+        connection_instructions=connection_instructions,
+        connection_example=connection_example,
         feedback_history=feedback_history,
     )
 
@@ -672,6 +676,25 @@ ENGINE_SORTING_KEY "date, dimension_1, dimension_2, ..."
 </target_datasource_content>
 """
 
+connection_instructions = """
+<connection_file_instructions>
+    - Content cannot be empty.
+    - The connection names must be unique.
+    - No indentation is allowed for property names
+    - We only support kafka connections for now
+</connection_file_instructions>
+"""
+
+connection_example = """
+<connection_content>
+TYPE kafka
+KAFKA_BOOTSTRAP_SERVERS {{ tb_secret("PRODUCTION_KAFKA_SERVERS", "localhost:9092") }}
+KAFKA_SECURITY_PROTOCOL SASL_SSL
+KAFKA_SASL_MECHANISM PLAIN
+KAFKA_KEY {{ tb_secret("PRODUCTION_KAFKA_USERNAME", "") }}
+KAFKA_SECRET {{ tb_secret("PRODUCTION_KAFKA_PASSWORD", "") }}
+</connection_content>
+"""
 
 datasource_instructions = """
 <datasource_file_instructions>
@@ -805,6 +828,7 @@ When you need to work with resources or data in cloud, add always the --cloud fl
 </command_calling>
 <development_instructions>
 - When asking to create a tinybird data project, if the needed folders are not already created, use the following structure:
+├── connections
 ├── copies
 ├── datasources
 ├── endpoints
@@ -838,6 +862,8 @@ Follow these instructions when creating or updating .pipe files:
 {pipe_example}
 {copy_pipe_instructions}
 {materialized_pipe_instructions}
+{connection_instructions}
+{connection_example}
 </pipe_file_instructions>
 <test_file_instructions>
 Follow these instructions when creating or updating .yaml files for tests:
@@ -858,6 +884,8 @@ Follow these instructions when evolving a datasource schema:
         materialized_pipe_instructions=materialized_pipe_instructions,
         test_instructions=test_instructions,
         deployment_instructions=deployment_instructions,
+        connection_instructions=connection_instructions,
+        connection_example=connection_example,
     )
 
 

{tinybird-0.0.1.dev94 → tinybird-0.0.1.dev96}/tinybird/sql_template.py

@@ -2399,3 +2399,87 @@ def extract_variables_from_sql(sql: str, params: List[Dict[str, Any]]) -> Dict[s
         return {}
 
     return defaults
+
+
+def render_template_with_secrets(name: str, content: str, secrets: Optional[Dict[str, str]] = None) -> str:
+    """Renders a template with secrets, allowing for default values.
+
+    Args:
+        name: The name of the template
+        content: The template content
+        secrets: A dictionary mapping secret names to their values
+
+    Returns:
+        The rendered template
+
+    Examples:
+        >>> render_template_with_secrets(
+        ...     "my_kafka_connection",
+        ...     "KAFKA_BOOTSTRAP_SERVERS {{ tb_secret('PRODUCTION_KAFKA_SERVERS', 'localhost:9092') }}",
+        ...     secrets = {'PRODUCTION_KAFKA_SERVERS': 'server1:9092,server2:9092'}
+        ... )
+        'KAFKA_BOOTSTRAP_SERVERS server1:9092,server2:9092'
+
+        >>> render_template_with_secrets(
+        ...     "my_kafka_connection",
+        ...     "KAFKA_BOOTSTRAP_SERVERS {{ tb_secret('MISSING_SECRET', 'localhost:9092') }}",
+        ...     secrets = {}
+        ... )
+        'KAFKA_BOOTSTRAP_SERVERS localhost:9092'
+
+        >>> render_template_with_secrets(
+        ...     "my_kafka_connection",
+        ...     "KAFKA_BOOTSTRAP_SERVERS {{ tb_secret('MISSING_SECRET') }}",
+        ...     secrets = {}
+        ... )
+        Traceback (most recent call last):
+        ...
+        tinybird.sql_template.SQLTemplateException: Template Syntax Error: Cannot access secret 'MISSING_SECRET'. Check the secret exists in the Workspace and the token has the required scope.
+    """
+    if not secrets:
+        secrets = {}
+
+    def tb_secret(secret_name: str, default: Optional[str] = None) -> str:
+        """Get a secret value with an optional default.
+
+        Args:
+            secret_name: The name of the secret to retrieve
+            default: The default value to use if the secret is not found
+
+        Returns:
+            The secret value or default
+
+        Raises:
+            SQLTemplateException: If the secret is not found and no default is provided
+        """
+        if secret_name in secrets:
+            return secrets[secret_name]
+        elif default is not None:
+            return default
+        else:
+            raise SQLTemplateException(
+                f"Cannot access secret '{secret_name}'. Check the secret exists in the Workspace and the token has the required scope."
+            )
+
+    # Create the template
+    t = Template(content, name=name)
+
+    try:
+        # Create namespace with our tb_secret function
+        namespace = {"tb_secret": tb_secret}
+
+        # Generate the template without all the extra processing
+        # This directly uses the underlying _generate method of the Template class
+        result = t.generate(**namespace)
+
+        # Convert the result to string
+        if isinstance(result, bytes):
+            return result.decode("utf-8")
+
+        return str(result)
+    except SQLTemplateCustomError as e:
+        raise e
+    except SQLTemplateException as e:
+        raise e
+    except Exception as e:
+        raise SQLTemplateException(f"Error rendering template with secrets: {str(e)}")

{tinybird-0.0.1.dev94 → tinybird-0.0.1.dev96}/tinybird/tb/__cli__.py

@@ -4,5 +4,5 @@ __description__ = 'Tinybird Command Line Tool'
 __url__ = 'https://www.tinybird.co/docs/cli/introduction.html'
 __author__ = 'Tinybird'
 __author_email__ = 'support@tinybird.co'
-__version__ = '0.0.1.dev94'
-__revision__ = '97387e2'
+__version__ = '0.0.1.dev96'
+__revision__ = 'f1cd799'

{tinybird-0.0.1.dev94 → tinybird-0.0.1.dev96}/tinybird/tb/cli.py

@@ -15,6 +15,7 @@ import tinybird.tb.modules.datasource
 import tinybird.tb.modules.deployment
 import tinybird.tb.modules.endpoint
 import tinybird.tb.modules.fmt
+import tinybird.tb.modules.infra
 import tinybird.tb.modules.job
 import tinybird.tb.modules.local
 import tinybird.tb.modules.login

{tinybird-0.0.1.dev94 → tinybird-0.0.1.dev96}/tinybird/tb/modules/build.py

@@ -97,6 +97,8 @@ def build_project(project: Project, tb_client: TinyB, file_changed: Optional[str
             build = result.get("build")
             datasources = build.get("new_datasource_names", [])
             pipes = build.get("new_pipe_names", [])
+            connections = build.get("new_data_connector_names", [])
+
             if not file_changed:
                 for ds in datasources:
                     ds_path_str: Optional[str] = next(
@@ -115,6 +117,15 @@ def build_project(project: Project, tb_client: TinyB, file_changed: Optional[str
                         pipe_path_str = pipe_path_str.replace(f"{project.folder}/", "")
                         click.echo(FeedbackManager.info(message=f"✓ {pipe_path_str} created"))
 
+                for connection in connections:
+                    connection_name = connection
+                    connection_path_str: Optional[str] = next(
+                        (p for p in project_files if p.endswith(connection_name + ".connection")), None
+                    )
+                    if connection_path_str:
+                        connection_path_str = connection_path_str.replace(f"{project.folder}/", "")
+                        click.echo(FeedbackManager.info(message=f"✓ {connection_path_str} created"))
+
             try:
                 for filename in project_files:
                     if filename.endswith(".datasource"):

{tinybird-0.0.1.dev94 → tinybird-0.0.1.dev96}/tinybird/tb/modules/cicd.py

@@ -31,6 +31,10 @@ on:
 
 concurrency: ${{! github.workflow }}-${{! github.event.pull_request.number }}
 
+env:
+  TINYBIRD_HOST: ${{ secrets.TINYBIRD_HOST }}
+  TINYBIRD_TOKEN: ${{ secrets.TINYBIRD_TOKEN }}
+
 jobs:
   ci:
     runs-on: ubuntu-latest
@@ -50,6 +54,8 @@ jobs:
         run: tb build
       - name: Test project
         run: tb test run
+      - name: Deployment check
+        run: tb --cloud --host ${{ TINYBIRD_HOST }} --token ${{ TINYBIRD_TOKEN }} deploy --check
 """
 
 
@@ -82,6 +88,7 @@ tinybird_ci_workflow:
     - cd $CI_PROJECT_DIR/{{ data_project_dir }}
     - tb build
     - tb test run
+    - tb --cloud --host ${{ TINYBIRD_HOST }} --token ${{ TINYBIRD_TOKEN }} deploy --check
   services:
     - name: tinybirdco/tinybird-local:beta
       alias: tinybird-local

{tinybird-0.0.1.dev94 → tinybird-0.0.1.dev96}/tinybird/tb/modules/cli.py

@@ -7,8 +7,11 @@ import json
 import logging
 import os
 import sys
+from os import getcwd
+from pathlib import Path
 from typing import Any, Callable, Dict, List, Optional, Tuple, Union
 
+import aiofiles
 import click
 import humanfriendly
 from click import Context
@@ -18,7 +21,6 @@ from tinybird.client import (
     AuthNoTokenException,
     TinyB,
 )
-from tinybird.config import get_config
 from tinybird.tb import __cli__
 from tinybird.tb.modules.common import (
     CatchAuthExceptions,
@@ -53,6 +55,7 @@ VERSION = f"{__cli__.__version__} (rev {__cli__.__revision__})"
     help="Prints internal representation, can be combined with any command to get more information.",
 )
 @click.option("--token", help="Use auth token, defaults to TB_TOKEN envvar, then to the .tinyb file.")
+@click.option("--user-token", help="Use user token, defaults to TB_USER_TOKEN envvar, then to the .tinyb file.")
 @click.option("--host", help="Use custom host, defaults to TB_HOST envvar, then to https://api.tinybird.co")
 @click.option("--show-tokens", is_flag=True, default=False, help="Enable the output of tokens.")
 @click.option("--cloud/--local", is_flag=True, default=False, help="Run against cloud or local.")
@@ -65,6 +68,7 @@ async def cli(
     ctx: Context,
     debug: bool,
     token: str,
+    user_token: str,
     host: str,
     show_tokens: bool,
     cloud: bool,
@@ -92,7 +96,9 @@ async def cli(
         config_temp.set_token(token)
     if host:
         config_temp.set_host(host)
-    if token or host:
+    if user_token:
+        config_temp.set_user_token(user_token)
+    if token or host or user_token:
         await try_update_config_with_remote(config_temp, auto_persist=False, raise_on_errors=False)
 
     # Overwrite token and host with env vars manually, without resorting to click.
@@ -104,8 +110,10 @@ async def cli(
         token = os.environ.get("TB_TOKEN", "")
     if not host and "TB_HOST" in os.environ:
         host = os.environ.get("TB_HOST", "")
+    if not user_token and "TB_USER_TOKEN" in os.environ:
+        user_token = os.environ.get("TB_USER_TOKEN", "")
 
-    config = await get_config(host, token, config_file=config_temp._path)
+    config = await get_config(host, token, user_token=user_token, config_file=config_temp._path)
     client = _get_tb_client(config.get("token", None), config["host"])
     folder = os.path.join(config_temp._path.replace(".tinyb", ""), config.get("cwd", os.getcwd()))
     project = Project(folder=folder)
@@ -398,7 +406,7 @@ async def create_ctx_client(ctx: Context, config: Dict[str, Any], cloud: bool, b
     if command in commands_without_ctx_client:
         return None
 
-    commands_always_cloud = ["pull", "playground"]
+    commands_always_cloud = ["pull", "playground", "infra"]
     commands_always_build = ["build", "test", "dev", "create"]
     commands_always_local: List[str] = []
     if (
@@ -422,3 +430,34 @@ def get_target_env(cloud: bool, build: bool) -> str:
     if build:
         return "build"
     return "local"
+
+
+async def get_config(
+    host: str,
+    token: Optional[str],
+    user_token: Optional[str],
+    semver: Optional[str] = None,
+    config_file: Optional[str] = None,
+) -> Dict[str, Any]:
+    if host:
+        host = host.rstrip("/")
+
+    config = {}
+    try:
+        async with aiofiles.open(config_file or Path(getcwd()) / ".tinyb") as file:
+            res = await file.read()
+            config = json.loads(res)
+    except OSError:
+        pass
+    except json.decoder.JSONDecodeError:
+        click.echo(FeedbackManager.error_load_file_config(config_file=config_file))
+        return config
+
+    config["token_passed"] = token
+    config["token"] = token or config.get("token", None)
+    config["user_token"] = user_token or config.get("user_token", None)
+    config["semver"] = semver or config.get("semver", None)
+    config["host"] = host or config.get("host", "https://api.europe-west2.gcp.tinybird.co")
+    config["workspaces"] = config.get("workspaces", [])
+    config["cwd"] = config.get("cwd", getcwd())
+    return config

{tinybird-0.0.1.dev94 → tinybird-0.0.1.dev96}/tinybird/tb/modules/common.py

@@ -81,6 +81,8 @@ SUPPORTED_FORMATS = ["csv", "ndjson", "json", "parquet"]
 OLDEST_ROLLBACK = "oldest_rollback"
 MAIN_BRANCH = "main"
 
+CONTEXT_SETTINGS = dict(help_option_names=["-h", "--help"])
+
 
 def obfuscate_token(value: Optional[str]) -> Optional[str]:
     if not value:

{tinybird-0.0.1.dev94 → tinybird-0.0.1.dev96}/tinybird/tb/modules/create.py

@@ -9,7 +9,7 @@ from tinybird.client import TinyB
 from tinybird.prompts import create_prompt, mock_prompt, rules_prompt
 from tinybird.tb.modules.cicd import init_cicd
 from tinybird.tb.modules.cli import cli
-from tinybird.tb.modules.common import _generate_datafile, check_user_token_with_client, coro, generate_datafile
+from tinybird.tb.modules.common import _generate_datafile, coro, generate_datafile
 from tinybird.tb.modules.config import CLIConfig
 from tinybird.tb.modules.datafile.fixture import persist_fixture
 from tinybird.tb.modules.exceptions import CLIException
@@ -44,6 +44,7 @@ async def create(
     local_client: TinyB = ctx.ensure_object(dict)["client"]
     project: Project = ctx.ensure_object(dict)["project"]
     config = CLIConfig.get_project_config()
+    ctx_config = ctx.ensure_object(dict)["config"]
 
     # If folder is provided, rewrite the config and project folder
     if folder:
@@ -65,15 +66,14 @@ async def create(
         folder_path.mkdir()
 
     try:
-        tb_client = config.get_client()
+        tb_client = config.get_client(token=ctx_config.get("token"), host=ctx_config.get("host"))
         user_token: Optional[str] = None
         created_something = False
         if prompt:
             try:
-                user_token = config.get_user_token()
+                user_token = ctx_config.get("user_token")
                 if not user_token:
                     raise CLIException("No user token found")
-                await check_user_token_with_client(tb_client, token=user_token)
             except Exception as e:
                 click.echo(
                     FeedbackManager.error(
@@ -144,7 +144,7 @@ async def create(
         click.echo(FeedbackManager.error(message=f"Error: {str(e)}"))
 
 
-PROJECT_PATHS = ("datasources", "endpoints", "materializations", "copies", "pipes", "fixtures", "tests")
+PROJECT_PATHS = ("datasources", "endpoints", "materializations", "copies", "pipes", "fixtures", "tests", "connections")
 
 
 def validate_project_structure(folder: str) -> bool:
@@ -248,6 +248,7 @@ TYPE ENDPOINT
         resources = parse_xml(result, "resource")
         datasources = []
         pipes = []
+        connections = []
         for resource_xml in resources:
             resource_type = extract_xml(resource_xml, "type")
             name = extract_xml(resource_xml, "name")
@@ -260,6 +261,8 @@ TYPE ENDPOINT
                 datasources.append(resource)
             elif resource_type.lower() == "pipe":
                 pipes.append(resource)
+            elif resource_type.lower() == "connection":
+                connections.append(resource)
 
         for ds in datasources:
             content = ds["content"].replace("```", "")
@@ -279,6 +282,12 @@ TYPE ENDPOINT
             generate_pipe_file(pipe["name"], content, folder)
             created_any_resource = True
 
+        for conn in connections:
+            content = conn["content"].replace("```", "")
+            filename = f"{conn['name']}.connection"
+            generate_connection_file(conn["name"], content, folder)
+            created_any_resource = True
+
     return result, created_any_resource
 
 
@@ -333,6 +342,17 @@ def generate_pipe_file(name: str, content: str, folder: str) -> Path:
     return f.relative_to(folder)
 
 
+def generate_connection_file(name: str, content: str, folder: str) -> Path:
+    base = Path(folder) / "connections"
+    if not base.exists():
+        base.mkdir()
+    f = base / (f"{name}.connection")
+    with open(f"{f}", "w") as file:
+        file.write(content)
+    click.echo(FeedbackManager.info_file_created(file=f.relative_to(folder)))
+    return f.relative_to(folder)
+
+
 def create_rules(folder: str, source: str, agent: str):
     if agent == "cursor":
         extension = ".cursorrules"

{tinybird-0.0.1.dev94 → tinybird-0.0.1.dev96}/tinybird/tb/modules/datafile/common.py

@@ -115,6 +115,7 @@ class DataFileExtensions:
     PIPE = ".pipe"
     DATASOURCE = ".datasource"
     INCL = ".incl"
+    CONNECTION = ".connection"
 
 
 class CopyModes:
@@ -241,6 +242,11 @@ class Datafile:
                     raise DatafileValidationError(f"Materialized node {repr(node['name'])} missing target datasource")
                 if node.get("type", "").lower() == PipeNodeTypes.COPY:
                     self.validate_copy_node(node)
+            for token in self.tokens:
+                if token["permission"].upper() != "READ":
+                    raise DatafileValidationError(
+                        f"Invalid permission {token['permission']} for token {token['token_name']}. Only READ is allowed for pipes"
+                    )
         elif self.kind == DatafileKind.datasource:
             # TODO(eclbg):
             #  [x] Just one node
@@ -253,6 +259,11 @@ class Datafile:
             node = self.nodes[0]
             if "schema" not in node:
                 raise DatafileValidationError("SCHEMA is mandatory")
+            for token in self.tokens:
+                if token["permission"].upper() not in {"READ", "APPEND"}:
+                    raise DatafileValidationError(
+                        f"Invalid permission {token['permission']} for token {token['token_name']}. Only READ and APPEND are allowed for datasources"
+                    )
         else:
             # We cannot validate a datafile whose kind is unknown
             pass
@@ -1274,16 +1285,28 @@ def parse(
 
     @multiline_not_supported
     def add_token(*args: str, **kwargs: Any) -> None:  # token_name, permissions):
-        # lineno = kwargs["lineno"]
+        lineno = kwargs["lineno"]
         if len(args) < 2:
             raise DatafileSyntaxError(
-                message='TOKEN takes two params: token name and permissions e.g TOKEN "read api token" READ',
+                message='TOKEN takes two params: token name and permission e.g TOKEN "read api token" READ',
                 lineno=lineno,
                 pos=1,
             )
-        # TODO(eclbg): We should validate that the permissions are a valid string. We only support READ for pipes and
-        # APPEND for datasources
-        doc.tokens.append({"token_name": _unquote(args[0]), "permissions": args[1]})
+        if len(args) > 2:
+            raise DatafileSyntaxError(
+                f"Invalid number of arguments for TOKEN command: {len(args)}. Expected 2 arguments: token name and permission",
+                lineno=lineno,
+                pos=len("token") + len(args[0]) + 3,  # Naive handling of whitespace. Assuming there's 2
+            )
+        permission = args[1]
+        if permission.upper() not in ["READ", "APPEND"]:
+            raise DatafileSyntaxError(
+                f"Invalid permission: {permission}. Only READ and APPEND are supported",
+                lineno=lineno,
+                pos=len("token") + len(args[0]) + 3,  # Naive handling of whitespace. Assuming there's 2
+            )
+        token_name = _unquote(args[0])
+        doc.tokens.append({"token_name": token_name, "permission": permission.upper()})
 
     @not_supported_yet()
     def include(*args: str, **kwargs: Any) -> None:
@@ -1678,6 +1701,7 @@ def get_project_filenames(folder: str, with_vendor=False) -> List[str]:
         f"{folder}/sinks/*.pipe",
         f"{folder}/copies/*.pipe",
         f"{folder}/playgrounds/*.pipe",
+        f"{folder}/connections/*.connection",
     ]
     if with_vendor:
         folders.append(f"{folder}/vendor/**/**/*.datasource")

{tinybird-0.0.1.dev94 → tinybird-0.0.1.dev96}/tinybird/tb/modules/datafile/parse_datasource.py

@@ -1,5 +1,5 @@
 import os
-from typing import Optional
+from typing import List, Optional
 
 import click
 
@@ -21,6 +21,7 @@ def parse_datasource(
     skip_eval: bool = False,
     hide_folders: bool = False,
     add_context_to_datafile_syntax_errors: bool = True,
+    secrets: Optional[List[str]] = None,
 ) -> Datafile:
     basepath = ""
     if not content:

{tinybird-0.0.1.dev94 → tinybird-0.0.1.dev96}/tinybird/tb/modules/datafile/parse_pipe.py

@@ -1,5 +1,5 @@
 import os
-from typing import Optional
+from typing import List, Optional
 
 import click
 
@@ -23,6 +23,7 @@ def parse_pipe(
     skip_eval: bool = False,
     hide_folders: bool = False,
     add_context_to_datafile_syntax_errors: bool = True,
+    secrets: Optional[List[str]] = None,
 ) -> Datafile:
     basepath = ""
     if not content:

{tinybird-0.0.1.dev94 → tinybird-0.0.1.dev96}/tinybird/tb/modules/deployment.py

@@ -4,7 +4,7 @@ import sys
 import time
 from datetime import datetime
 from pathlib import Path
-from typing import Any, Dict, Optional, Union
+from typing import Any, Dict, Optional, Tuple, Union
 
 import click
 import requests
@@ -451,8 +451,10 @@ def create_deployment(
 
 def print_changes(result: dict, project: Project) -> None:
     deployment = result.get("deployment", {})
-    columns = ["status", "name", "path"]
+    resources_columns = ["status", "name", "path"]
     resources: list[list[Union[str, None]]] = []
+    tokens_columns = ["Change", "Token name", "Added permissions", "Removed permissions"]
+    tokens: list[Tuple[str, str, str, str]] = []
 
     for ds in deployment.get("new_datasource_names", []):
         resources.append(["new", ds, project.get_resource_path(ds, "datasource")])
@@ -481,8 +483,26 @@ def print_changes(result: dict, project: Project) -> None:
     for dc in deployment.get("deleted_data_connector_names", []):
         resources.append(["deleted", dc, project.get_resource_path(dc, "data_connector")])
 
+    for token_change in deployment.get("token_changes", []):
+        token_name = token_change.get("token_name")
+        change_type = token_change.get("change_type")
+        added_perms = []
+        removed_perms = []
+        permission_changes = token_change.get("permission_changes", {})
+        for perm in permission_changes.get("added_permissions", []):
+            added_perms.append(f"{perm['resource_name']}.{perm['resource_type']}:{perm['permission']}")
+        for perm in permission_changes.get("removed_permissions", []):
+            removed_perms.append(f"{perm['resource_name']}.{perm['resource_type']}:{perm['permission']}")
+
+        tokens.append((change_type, token_name, "\n".join(added_perms), "\n".join(removed_perms)))
+
     if resources:
         click.echo(FeedbackManager.highlight(message="\n» Changes to be deployed...\n"))
-        echo_safe_humanfriendly_tables_format_smart_table(resources, column_names=columns)
+        echo_safe_humanfriendly_tables_format_smart_table(resources, column_names=resources_columns)
     else:
         click.echo(FeedbackManager.highlight(message="\n» No changes to be deployed\n"))
+    if tokens:
+        click.echo(FeedbackManager.highlight(message="\n» Changes in tokens to be deployed...\n"))
+        echo_safe_humanfriendly_tables_format_smart_table(tokens, column_names=tokens_columns)
+    else:
+        click.echo(FeedbackManager.highlight(message="\n» No changes in tokens to be deployed\n"))