51f14fa2b1
Closes the gaps and the one security finding from the second end-to-end
CLI test (E2E_STASH_REPORT.md), plus the H1 boot-regression found while
re-reviewing those fixes.
Security
- S6: reserved-path validation (`check_reserved`) now case-folds before
comparing, so `/API/v2/x`, `/HEALTHZ`, `/Admin/x` are rejected like
their lowercase forms. Request-time matching stays case-sensitive.
- S10: "public route != public data" callout in sdk-shape.md (script_gate
skips authz when the principal is anonymous).
Observability / features
- G1: trigger executions now write `execution_logs`. Migration 0043 adds
a `source` column (CHECK mirrors ExecutionSource/OutboxSourceKind,
DEFAULT 'http' backfills history); a shared `build_execution_log` helper
in executor-core; dispatcher logging for outbox triggers + queue
consumers (skips sync-HTTP rows the orchestrator already logs). `pic
logs` gains a source column + `--source` filter.
- G5: dev-only in-memory email capture under PICLOUD_DEV_MODE with no SMTP
(email::send succeeds locally), readable at GET /api/v1/admin/dev/emails
(Owner/Admin only; route mounted only in capture mode).
- G6: generalized the Rhai in-place-mutation footgun note (trim/replace/
make_upper/make_lower/crop/truncate/pad return ()).
- G2/G3/G4 (CLI): `pic members`, `pic files`, `pic queues`, read-only
`pic kv` (+ new kv_api.rs); `pic deploy --timeout/--memory/--kind/
--sandbox`; first-class `pic triggers create-{docs,files,pubsub,queue,
email}` wrappers. All new client path segments percent-encoded via seg().
H1 regression fix (found in re-review)
- The S6 change also runs in `compile_routes`, which compiles every stored
route at boot and on each route CRUD. A single stored route the new
validation rejects (creatable while the S6 gap existed) made the whole
compile Err and aborted startup. `compile_routes` is now lenient: it
skips an un-compilable row with a warning instead of bricking boot
(route creation still validates separately). Migration 0044 sweeps
pre-existing reserved-path routes on upgrade (WHERE mirrors
check_reserved exactly). Added regression tests for both.
Verified: cargo fmt, clippy --all-targets --all-features -D warnings, the
schema_snapshot test, and the new S6/lenient-compile unit tests all pass;
boot-resilience and G1/G5 confirmed live.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
87 lines
2.6 KiB
Rust
87 lines
2.6 KiB
Rust
//! `pic members ls | add | set | rm` — manage app membership (G2).
|
|
//!
|
|
//! Wraps `/api/v1/admin/apps/{id}/members*`. All gated on
|
|
//! `AppAdmin(app)` server-side; Editors/Viewers get a 403.
|
|
|
|
use anyhow::Result;
|
|
use picloud_shared::AppRole;
|
|
|
|
use crate::client::Client;
|
|
use crate::config;
|
|
use crate::output::{KvBlock, OutputMode, Table};
|
|
|
|
pub async fn ls(app: &str, mode: OutputMode) -> Result<()> {
|
|
let creds = config::resolve()?;
|
|
let client = Client::from_creds(&creds)?;
|
|
let members = client.members_list(app).await?;
|
|
let mut table = Table::new(["user_id", "username", "role", "instance_role", "active"]);
|
|
for m in members {
|
|
table.row([
|
|
m.user_id.to_string(),
|
|
m.username,
|
|
app_role_str(m.role).to_string(),
|
|
format!("{:?}", m.instance_role).to_lowercase(),
|
|
m.is_active.to_string(),
|
|
]);
|
|
}
|
|
table.print(mode);
|
|
Ok(())
|
|
}
|
|
|
|
pub async fn add(app: &str, user_id: &str, role: &str, mode: OutputMode) -> Result<()> {
|
|
let creds = config::resolve()?;
|
|
let client = Client::from_creds(&creds)?;
|
|
let m = client
|
|
.members_grant(app, user_id, parse_role(role)?)
|
|
.await?;
|
|
print_member(&m, mode);
|
|
Ok(())
|
|
}
|
|
|
|
pub async fn set(app: &str, user_id: &str, role: &str, mode: OutputMode) -> Result<()> {
|
|
let creds = config::resolve()?;
|
|
let client = Client::from_creds(&creds)?;
|
|
let m = client
|
|
.members_set_role(app, user_id, parse_role(role)?)
|
|
.await?;
|
|
print_member(&m, mode);
|
|
Ok(())
|
|
}
|
|
|
|
pub async fn rm(app: &str, user_id: &str) -> Result<()> {
|
|
let creds = config::resolve()?;
|
|
let client = Client::from_creds(&creds)?;
|
|
client.members_remove(app, user_id).await?;
|
|
println!("Removed {user_id} from {app}");
|
|
Ok(())
|
|
}
|
|
|
|
fn print_member(m: &crate::client::AppMemberDto, mode: OutputMode) {
|
|
let mut block = KvBlock::new();
|
|
block
|
|
.field("user_id", m.user_id.to_string())
|
|
.field("username", m.username.clone())
|
|
.field("role", app_role_str(m.role))
|
|
.field("created_at", m.created_at.to_rfc3339());
|
|
block.print(mode);
|
|
}
|
|
|
|
fn parse_role(s: &str) -> Result<AppRole> {
|
|
match s.to_ascii_lowercase().as_str() {
|
|
"app_admin" | "admin" => Ok(AppRole::AppAdmin),
|
|
"editor" => Ok(AppRole::Editor),
|
|
"viewer" => Ok(AppRole::Viewer),
|
|
other => Err(anyhow::anyhow!(
|
|
"unknown role {other:?} (want app_admin | editor | viewer)"
|
|
)),
|
|
}
|
|
}
|
|
|
|
fn app_role_str(r: AppRole) -> &'static str {
|
|
match r {
|
|
AppRole::AppAdmin => "app_admin",
|
|
AppRole::Editor => "editor",
|
|
AppRole::Viewer => "viewer",
|
|
}
|
|
}
|