332 lines
11 KiB
TypeScript
332 lines
11 KiB
TypeScript
import type { Command } from 'commander';
|
|
import { getGatewayUrl } from './gateway/login.js';
|
|
import { requireSession } from './gateway/token-ops.js';
|
|
|
|
// ─── Types ───────────────────────────────────────────────────────────────────
|
|
|
|
interface UserDto {
|
|
id: string;
|
|
name: string;
|
|
email: string;
|
|
role: string;
|
|
banned: boolean;
|
|
banReason: string | null;
|
|
createdAt: string;
|
|
updatedAt: string;
|
|
}
|
|
|
|
interface UserListDto {
|
|
users: UserDto[];
|
|
total: number;
|
|
}
|
|
|
|
// ─── HTTP helpers ────────────────────────────────────────────────────────────
|
|
|
|
async function adminGet<T>(gatewayUrl: string, cookie: string, path: string): Promise<T> {
|
|
let res: Response;
|
|
try {
|
|
res = await fetch(`${gatewayUrl}${path}`, {
|
|
headers: { Cookie: cookie, Origin: gatewayUrl },
|
|
});
|
|
} catch (err) {
|
|
console.error(
|
|
`Could not reach gateway at ${gatewayUrl}: ${err instanceof Error ? err.message : String(err)}`,
|
|
);
|
|
process.exit(1);
|
|
}
|
|
|
|
if (res.status === 401 || res.status === 403) {
|
|
console.error(`Session rejected by the gateway (${res.status.toString()}).`);
|
|
console.error('Run: mosaic gateway login');
|
|
process.exit(2);
|
|
}
|
|
|
|
if (!res.ok) {
|
|
const body = await res.text().catch(() => '');
|
|
console.error(`Gateway returned error (${res.status.toString()}): ${body.slice(0, 200)}`);
|
|
process.exit(3);
|
|
}
|
|
|
|
return res.json() as Promise<T>;
|
|
}
|
|
|
|
async function adminPost<T>(
|
|
gatewayUrl: string,
|
|
cookie: string,
|
|
path: string,
|
|
body: unknown,
|
|
): Promise<T> {
|
|
let res: Response;
|
|
try {
|
|
res = await fetch(`${gatewayUrl}${path}`, {
|
|
method: 'POST',
|
|
headers: {
|
|
'Content-Type': 'application/json',
|
|
Cookie: cookie,
|
|
Origin: gatewayUrl,
|
|
},
|
|
body: JSON.stringify(body),
|
|
});
|
|
} catch (err) {
|
|
console.error(
|
|
`Could not reach gateway at ${gatewayUrl}: ${err instanceof Error ? err.message : String(err)}`,
|
|
);
|
|
process.exit(1);
|
|
}
|
|
|
|
if (res.status === 401 || res.status === 403) {
|
|
console.error(`Session rejected by the gateway (${res.status.toString()}).`);
|
|
console.error('Run: mosaic gateway login');
|
|
process.exit(2);
|
|
}
|
|
|
|
if (!res.ok) {
|
|
const body = await res.text().catch(() => '');
|
|
console.error(`Gateway returned error (${res.status.toString()}): ${body.slice(0, 200)}`);
|
|
process.exit(3);
|
|
}
|
|
|
|
return res.json() as Promise<T>;
|
|
}
|
|
|
|
async function adminDelete(gatewayUrl: string, cookie: string, path: string): Promise<void> {
|
|
let res: Response;
|
|
try {
|
|
res = await fetch(`${gatewayUrl}${path}`, {
|
|
method: 'DELETE',
|
|
headers: { Cookie: cookie, Origin: gatewayUrl },
|
|
});
|
|
} catch (err) {
|
|
console.error(
|
|
`Could not reach gateway at ${gatewayUrl}: ${err instanceof Error ? err.message : String(err)}`,
|
|
);
|
|
process.exit(1);
|
|
}
|
|
|
|
if (res.status === 401 || res.status === 403) {
|
|
console.error(`Session rejected by the gateway (${res.status.toString()}).`);
|
|
console.error('Run: mosaic gateway login');
|
|
process.exit(2);
|
|
}
|
|
|
|
if (!res.ok && res.status !== 204) {
|
|
const body = await res.text().catch(() => '');
|
|
console.error(`Gateway returned error (${res.status.toString()}): ${body.slice(0, 200)}`);
|
|
process.exit(3);
|
|
}
|
|
}
|
|
|
|
// ─── Formatters ──────────────────────────────────────────────────────────────
|
|
|
|
function printUser(u: UserDto): void {
|
|
console.log(` ID: ${u.id}`);
|
|
console.log(` Name: ${u.name}`);
|
|
console.log(` Email: ${u.email}`);
|
|
console.log(` Role: ${u.role}`);
|
|
console.log(` Banned: ${u.banned ? `yes (${u.banReason ?? 'no reason'})` : 'no'}`);
|
|
console.log(` Created: ${new Date(u.createdAt).toLocaleString()}`);
|
|
console.log('');
|
|
}
|
|
|
|
// ─── Register function ───────────────────────────────────────────────────────
|
|
|
|
/**
|
|
* Register `mosaic auth` subcommands on an existing Commander program.
|
|
*
|
|
* Location rationale: placed in packages/mosaic rather than packages/auth because
|
|
* the CLI needs session helpers (loadSession, validateSession, requireSession)
|
|
* and gateway URL resolution (getGatewayUrl) that live in packages/mosaic.
|
|
* Keeping packages/auth as a pure server-side library avoids adding commander
|
|
* and CLI tooling as dependencies there.
|
|
*/
|
|
export function registerAuthCommand(parent: Command): void {
|
|
const auth = parent
|
|
.command('auth')
|
|
.description('Manage gateway authentication, users, SSO providers, and sessions')
|
|
.configureHelp({ sortSubcommands: true })
|
|
.action(() => {
|
|
auth.outputHelp();
|
|
});
|
|
|
|
// ─── users ──────────────────────────────────────────────────────────────
|
|
|
|
const users = auth
|
|
.command('users')
|
|
.description('Manage gateway users')
|
|
.configureHelp({ sortSubcommands: true })
|
|
.action(() => {
|
|
users.outputHelp();
|
|
});
|
|
|
|
users
|
|
.command('list')
|
|
.description('List all users on the gateway')
|
|
.option('-g, --gateway <url>', 'Gateway URL')
|
|
.option('-l, --limit <n>', 'Maximum number of users to display', '100')
|
|
.action(async (opts: { gateway?: string; limit: string }) => {
|
|
const url = getGatewayUrl(opts.gateway);
|
|
const cookie = await requireSession(url);
|
|
const limit = parseInt(opts.limit, 10);
|
|
|
|
const result = await adminGet<UserListDto>(url, cookie, '/api/admin/users');
|
|
|
|
const subset = result.users.slice(0, limit);
|
|
if (subset.length === 0) {
|
|
console.log('No users found.');
|
|
return;
|
|
}
|
|
|
|
console.log(`Users (${subset.length.toString()} of ${result.total.toString()}):\n`);
|
|
for (const u of subset) {
|
|
printUser(u);
|
|
}
|
|
});
|
|
|
|
users
|
|
.command('create')
|
|
.description('Create a new gateway user (interactive prompts)')
|
|
.option('-g, --gateway <url>', 'Gateway URL')
|
|
.action(async (opts: { gateway?: string }) => {
|
|
const url = getGatewayUrl(opts.gateway);
|
|
const cookie = await requireSession(url);
|
|
|
|
const {
|
|
text,
|
|
password: clackPassword,
|
|
select,
|
|
intro,
|
|
outro,
|
|
isCancel,
|
|
} = await import('@clack/prompts');
|
|
|
|
intro('Create a new Mosaic gateway user');
|
|
|
|
const name = await text({ message: 'Full name:', placeholder: 'Jane Doe' });
|
|
if (isCancel(name)) {
|
|
outro('Cancelled.');
|
|
process.exit(0);
|
|
}
|
|
|
|
const email = await text({ message: 'Email:', placeholder: 'jane@example.com' });
|
|
if (isCancel(email)) {
|
|
outro('Cancelled.');
|
|
process.exit(0);
|
|
}
|
|
|
|
const pw = await clackPassword({ message: 'Password:' });
|
|
if (isCancel(pw)) {
|
|
outro('Cancelled.');
|
|
process.exit(0);
|
|
}
|
|
|
|
const role = await select({
|
|
message: 'Role:',
|
|
options: [
|
|
{ value: 'member', label: 'member' },
|
|
{ value: 'admin', label: 'admin' },
|
|
],
|
|
});
|
|
if (isCancel(role)) {
|
|
outro('Cancelled.');
|
|
process.exit(0);
|
|
}
|
|
|
|
const created = await adminPost<UserDto>(url, cookie, '/api/admin/users', {
|
|
name: name as string,
|
|
email: email as string,
|
|
password: pw as string,
|
|
role: role as string,
|
|
});
|
|
|
|
outro(`User created: ${created.email} (${created.id})`);
|
|
});
|
|
|
|
users
|
|
.command('delete <id>')
|
|
.description('Delete a gateway user by ID')
|
|
.option('-g, --gateway <url>', 'Gateway URL')
|
|
.option('-y, --yes', 'Skip confirmation prompt')
|
|
.action(async (id: string, opts: { gateway?: string; yes?: boolean }) => {
|
|
const url = getGatewayUrl(opts.gateway);
|
|
const cookie = await requireSession(url);
|
|
|
|
if (!opts.yes) {
|
|
const { confirm, isCancel } = await import('@clack/prompts');
|
|
const confirmed = await confirm({
|
|
message: `Delete user ${id}? This cannot be undone.`,
|
|
});
|
|
if (isCancel(confirmed) || !confirmed) {
|
|
console.log('Aborted.');
|
|
process.exit(0);
|
|
}
|
|
}
|
|
|
|
await adminDelete(url, cookie, `/api/admin/users/${id}`);
|
|
console.log(`User ${id} deleted.`);
|
|
});
|
|
|
|
// ─── sso ────────────────────────────────────────────────────────────────
|
|
|
|
const sso = auth
|
|
.command('sso')
|
|
.description('Manage SSO provider configuration')
|
|
.configureHelp({ sortSubcommands: true })
|
|
.action(() => {
|
|
sso.outputHelp();
|
|
});
|
|
|
|
sso
|
|
.command('list')
|
|
.description('List configured SSO providers (reads gateway discovery endpoint if available)')
|
|
.option('-g, --gateway <url>', 'Gateway URL')
|
|
.action(async (opts: { gateway?: string }) => {
|
|
// The admin SSO discovery endpoint is not yet wired server-side.
|
|
// The buildSsoDiscovery helper in @mosaicstack/auth reads env-vars on the
|
|
// server; there is no GET /api/admin/sso endpoint in apps/gateway/src/admin/.
|
|
// Stub until a gateway admin route is wired.
|
|
console.log(
|
|
'not yet wired — admin endpoint missing (GET /api/admin/sso not implemented server-side)',
|
|
);
|
|
console.log(
|
|
'Hint: SSO providers are configured via environment variables (AUTHENTIK_*, WORKOS_*, KEYCLOAK_*).',
|
|
);
|
|
// Suppress unused variable warning
|
|
void opts;
|
|
});
|
|
|
|
sso
|
|
.command('test <provider>')
|
|
.description('Smoke-test a configured SSO provider')
|
|
.option('-g, --gateway <url>', 'Gateway URL')
|
|
.action(async (provider: string, opts: { gateway?: string }) => {
|
|
// No server-side SSO smoke-test endpoint exists yet.
|
|
console.log(
|
|
`not yet wired — admin endpoint missing (POST /api/admin/sso/${provider}/test not implemented server-side)`,
|
|
);
|
|
void opts;
|
|
});
|
|
|
|
// ─── sessions ────────────────────────────────────────────────────────────
|
|
|
|
const authSessions = auth
|
|
.command('sessions')
|
|
.description('Manage BetterAuth user sessions stored on the gateway')
|
|
.configureHelp({ sortSubcommands: true })
|
|
.action(() => {
|
|
authSessions.outputHelp();
|
|
});
|
|
|
|
authSessions
|
|
.command('list')
|
|
.description('List active user sessions')
|
|
.option('-g, --gateway <url>', 'Gateway URL')
|
|
.action(async (opts: { gateway?: string }) => {
|
|
// No GET /api/admin/auth-sessions endpoint exists in apps/gateway/src/admin/.
|
|
// Stub until a gateway admin route is wired.
|
|
console.log(
|
|
'not yet wired — admin endpoint missing (GET /api/admin/auth-sessions not implemented server-side)',
|
|
);
|
|
void opts;
|
|
});
|
|
}
|