queena
464db21745
- docs/commands.md 新增 §3.8 jwks、§3.9 accounts、§3.10 audit-logs 規格 - Api 新增 jwks/accounts/audit-logs 端點（共用 api_request） - 新增 Jwks/Accounts/AuditLogs/Admin 模組；CLI 接線三個指令群 - 403 → 退出碼 8 提示需 admin；一次性密碼只在成功當下輸出 - 測試 100 例全綠（fake API 注入，比照 cli_test.exs）
707 lines
21 KiB
Elixir
707 lines
21 KiB
Elixir
defmodule BearCli.CLI do
|
||
@moduledoc """
|
||
`bear` 指令的命令列入口與指令分派。
|
||
|
||
指令：`login`（PAT 模式）、`whoami`、`token`、`logout`、`status`。
|
||
|
||
`BEAR_TOKEN` 環境變數（一次性／CI 用的 PAT）提供時，`whoami`／`token`／`status`
|
||
優先使用該值，不讀寫本機憑證檔。
|
||
"""
|
||
|
||
alias BearCli.{Accounts, Admin, Api, Apps, AuditLogs, Config, Credentials, Jwks}
|
||
|
||
@global_switches [
|
||
issuer: :string,
|
||
config: :string,
|
||
json: :boolean,
|
||
verbose: :boolean,
|
||
help: :boolean,
|
||
version: :boolean
|
||
]
|
||
@global_aliases [v: :verbose, h: :help]
|
||
|
||
@login_switches [token: :string, scope: :string, "client-id": :string]
|
||
@token_switches [refresh: :boolean]
|
||
|
||
# -- apps 指令群（docs/commands.md §3.6）--
|
||
# 注意：OptionParser 會把選項名的連字號正規化為底線
|
||
# （--client-id → :client_id），switch 定義需用底線 atom。
|
||
@apps_verbs ~w(list show create update rotate-secret toggle)
|
||
|
||
@apps_list_switches [
|
||
visibility: :string,
|
||
status: :string,
|
||
page: :integer,
|
||
per_page: :integer
|
||
]
|
||
|
||
@apps_create_switches [
|
||
client_id: :string,
|
||
url: :string,
|
||
title: :string,
|
||
method: :string,
|
||
visibility: :string,
|
||
redirect_url: :keep,
|
||
post_logout_redirect_uri: :keep,
|
||
scope: :keep,
|
||
sub: :string,
|
||
jwk_id: :string,
|
||
secret: :string
|
||
]
|
||
|
||
@apps_update_switches [
|
||
url: :string,
|
||
title: :string,
|
||
method: :string,
|
||
visibility: :string,
|
||
redirect_url: :keep,
|
||
post_logout_redirect_uri: :keep,
|
||
scope: :keep,
|
||
sub: :string,
|
||
jwk_id: :string
|
||
]
|
||
|
||
@visibilities ~w(public internal)
|
||
@statuses ~w(active inactive)
|
||
@methods ~w(client_secret PKCE)
|
||
|
||
# -- escript 入口 --
|
||
|
||
@doc "escript 主函式。執行後以 `System.halt/1` 設定退出碼。"
|
||
def main(argv) do
|
||
start_apps()
|
||
code = argv |> parse() |> dispatch()
|
||
System.halt(code)
|
||
end
|
||
|
||
# Req 預設用 Finch 作為 HTTP adapter，escript 需自行啟動一個 pool。
|
||
defp start_apps do
|
||
_ = Application.ensure_all_started(:req)
|
||
_ = Application.ensure_all_started(:finch)
|
||
|
||
case Finch.start_link(name: BearCli.Finch) do
|
||
{:ok, _} -> :ok
|
||
{:error, _} -> :ok
|
||
end
|
||
|
||
:ok
|
||
end
|
||
|
||
# -- 解析 --
|
||
|
||
@doc """
|
||
解析 argv，回傳：
|
||
|
||
- `{:version, opts}`
|
||
- `{:help, opts}`
|
||
- `{:ok, command, opts}`（opts 為 atom key 的 map）
|
||
- `{:error, message, exit_code}`
|
||
"""
|
||
def parse(argv) do
|
||
argv = Enum.map(argv, &to_string/1)
|
||
|
||
case OptionParser.parse_head(argv, strict: @global_switches, aliases: @global_aliases) do
|
||
{global, rest, []} ->
|
||
do_parse(global, rest)
|
||
|
||
{_global, _rest, [{opt, _} | _]} ->
|
||
{:error, "未知選項：#{opt}", 2}
|
||
end
|
||
end
|
||
|
||
defp do_parse(global, rest) do
|
||
cond do
|
||
global[:version] ->
|
||
{:version, %{}}
|
||
|
||
global[:help] == true and rest == [] ->
|
||
{:help, %{}}
|
||
|
||
rest == [] ->
|
||
{:help, %{}}
|
||
|
||
true ->
|
||
[command | args] = rest
|
||
parse_command(command, args, global)
|
||
end
|
||
end
|
||
|
||
defp parse_command("login", args, global) do
|
||
with {:ok, opts} <- parse_opts(args, @global_switches ++ @login_switches) do
|
||
{:ok, :login, merge_opts(global, opts)}
|
||
end
|
||
end
|
||
|
||
defp parse_command("whoami", args, global) do
|
||
with {:ok, opts} <- parse_opts(args, @global_switches) do
|
||
{:ok, :whoami, merge_opts(global, opts)}
|
||
end
|
||
end
|
||
|
||
defp parse_command("token", args, global) do
|
||
with {:ok, opts} <- parse_opts(args, @global_switches ++ @token_switches) do
|
||
{:ok, :token, merge_opts(global, opts)}
|
||
end
|
||
end
|
||
|
||
defp parse_command("logout", args, global) do
|
||
with {:ok, opts} <- parse_opts(args, @global_switches) do
|
||
{:ok, :logout, merge_opts(global, opts)}
|
||
end
|
||
end
|
||
|
||
defp parse_command("status", args, global) do
|
||
with {:ok, opts} <- parse_opts(args, @global_switches) do
|
||
{:ok, :status, merge_opts(global, opts)}
|
||
end
|
||
end
|
||
|
||
defp parse_command("apps", args, global) do
|
||
case args do
|
||
[verb | rest] when verb in @apps_verbs ->
|
||
switches = apps_switches(verb)
|
||
|
||
case OptionParser.parse(rest, strict: @global_switches ++ switches) do
|
||
{opts, positionals, []} ->
|
||
validate_apps(verb, positionals, merge_opts(global, opts_to_map(opts)))
|
||
|
||
{_opts, _extra, [{opt, _} | _]} ->
|
||
{:error, "無法解析選項：#{opt}", 2}
|
||
end
|
||
|
||
[] ->
|
||
{:error, "apps 缺少子指令（可用：#{Enum.join(@apps_verbs, " ")}）", 2}
|
||
|
||
[unknown | _] ->
|
||
{:error, "未知的 apps 子指令：#{unknown}（可用：#{Enum.join(@apps_verbs, " ")}）", 2}
|
||
end
|
||
end
|
||
|
||
# 管理端指令群（jwks/accounts/audit-logs；解析委由 BearCli.Admin）
|
||
defp parse_command(group, args, global) when group in ~w(jwks accounts audit-logs) do
|
||
case Admin.parse([group | args], global) do
|
||
:error -> {:error, "未知指令：#{group}（可用 bear --help 查看說明）", 2}
|
||
parsed -> parsed
|
||
end
|
||
end
|
||
|
||
defp parse_command(unknown, _args, _global) do
|
||
{:error, "未知指令：#{unknown}（可用 bear --help 查看說明）", 2}
|
||
end
|
||
|
||
defp parse_opts(args, switches) do
|
||
case OptionParser.parse(args, strict: switches) do
|
||
{opts, [], []} ->
|
||
{:ok, opts}
|
||
|
||
{_opts, extra, []} ->
|
||
{:error, "不接受的參數：#{Enum.join(extra, " ")}", 2}
|
||
|
||
{_opts, _extra, [{opt, _} | _]} ->
|
||
{:error, "無法解析選項：#{opt}", 2}
|
||
end
|
||
end
|
||
|
||
# -- apps 解析輔助 --
|
||
|
||
defp apps_switches("list"), do: @apps_list_switches
|
||
defp apps_switches("show"), do: []
|
||
defp apps_switches("create"), do: @apps_create_switches
|
||
defp apps_switches("update"), do: @apps_update_switches
|
||
defp apps_switches("rotate-secret"), do: []
|
||
defp apps_switches("toggle"), do: []
|
||
|
||
# apps 子指令的本地用法驗證（§3.6：用法錯誤 → 退出碼 2）。
|
||
defp validate_apps("list", [], opts) do
|
||
cond do
|
||
invalid_enum?(opts[:visibility], @visibilities, "--visibility") ->
|
||
usage_error(opts[:visibility], "--visibility", @visibilities)
|
||
|
||
invalid_enum?(opts[:status], @statuses, "--status") ->
|
||
usage_error(opts[:status], "--status", @statuses)
|
||
|
||
true ->
|
||
{:ok, {Apps, :list}, opts}
|
||
end
|
||
end
|
||
|
||
defp validate_apps("list", extra, _opts),
|
||
do: {:error, "apps list 不接受位置參數：#{Enum.join(extra, " ")}", 2}
|
||
|
||
defp validate_apps("show", [client_id], opts),
|
||
do: {:ok, {Apps, :show}, Map.put(opts, :client_id_arg, client_id)}
|
||
|
||
defp validate_apps("show", [], _opts), do: {:error, "apps show 缺少 <client-id>", 2}
|
||
|
||
defp validate_apps("show", extra, _opts),
|
||
do: {:error, "apps show 只接受一個 <client-id>（多餘：#{Enum.join(Enum.drop(extra, 1), " ")}）", 2}
|
||
|
||
defp validate_apps("create", [], opts) do
|
||
missing =
|
||
[{"client-id", opts[:client_id]}, {"url", opts[:url]}, {"title", opts[:title]}]
|
||
|> Enum.filter(fn {_name, v} -> blank?(v) end)
|
||
|> Enum.map(&elem(&1, 0))
|
||
|
||
cond do
|
||
missing != [] ->
|
||
{:error, "apps create 缺少必選參數：#{Enum.join(missing, "、")}", 2}
|
||
|
||
invalid_enum?(opts[:method], @methods, "--method") ->
|
||
usage_error(opts[:method], "--method", @methods)
|
||
|
||
invalid_enum?(opts[:visibility], @visibilities, "--visibility") ->
|
||
usage_error(opts[:visibility], "--visibility", @visibilities)
|
||
|
||
opts[:method] == "PKCE" and blank?(opts[:jwk_id]) ->
|
||
{:error, "method=PKCE 必須給 --jwk-id", 2}
|
||
|
||
true ->
|
||
{:ok, {Apps, :create}, opts}
|
||
end
|
||
end
|
||
|
||
defp validate_apps("create", extra, _opts),
|
||
do: {:error, "apps create 不接受位置參數：#{Enum.join(extra, " ")}", 2}
|
||
|
||
defp validate_apps("update", [client_id], opts) do
|
||
cond do
|
||
invalid_enum?(opts[:method], @methods, "--method") ->
|
||
usage_error(opts[:method], "--method", @methods)
|
||
|
||
invalid_enum?(opts[:visibility], @visibilities, "--visibility") ->
|
||
usage_error(opts[:visibility], "--visibility", @visibilities)
|
||
|
||
opts[:method] == "PKCE" and blank?(opts[:jwk_id]) ->
|
||
{:error, "method=PKCE 必須給 --jwk-id", 2}
|
||
|
||
true ->
|
||
{:ok, {Apps, :update}, Map.put(opts, :client_id_arg, client_id)}
|
||
end
|
||
end
|
||
|
||
defp validate_apps("update", [], _opts), do: {:error, "apps update 缺少 <client-id>", 2}
|
||
|
||
defp validate_apps("update", extra, _opts),
|
||
do: {:error, "apps update 只接受一個 <client-id>（多餘：#{Enum.join(Enum.drop(extra, 1), " ")}）", 2}
|
||
|
||
defp validate_apps("rotate-secret", [client_id], opts),
|
||
do: {:ok, {Apps, :"rotate-secret"}, Map.put(opts, :client_id_arg, client_id)}
|
||
|
||
defp validate_apps("rotate-secret", [], _opts),
|
||
do: {:error, "apps rotate-secret 缺少 <client-id>", 2}
|
||
|
||
defp validate_apps("rotate-secret", extra, _opts),
|
||
do:
|
||
{:error, "apps rotate-secret 只接受一個 <client-id>（多餘：#{Enum.join(Enum.drop(extra, 1), " ")}）",
|
||
2}
|
||
|
||
defp validate_apps("toggle", [client_id], opts),
|
||
do: {:ok, {Apps, :toggle}, Map.put(opts, :client_id_arg, client_id)}
|
||
|
||
defp validate_apps("toggle", [], _opts), do: {:error, "apps toggle 缺少 <client-id>", 2}
|
||
|
||
defp validate_apps("toggle", extra, _opts),
|
||
do: {:error, "apps toggle 只接受一個 <client-id>（多餘：#{Enum.join(Enum.drop(extra, 1), " ")}）", 2}
|
||
|
||
defp invalid_enum?(nil, _allowed, _flag), do: false
|
||
defp invalid_enum?(value, allowed, _flag), do: value not in allowed
|
||
|
||
defp usage_error(value, flag, allowed) do
|
||
{:error, "#{flag} 不接受的值：#{value}（可用：#{Enum.join(allowed, "、")}）", 2}
|
||
end
|
||
|
||
defp merge_opts(global, opts) do
|
||
Map.merge(Map.new(global), Map.new(opts))
|
||
end
|
||
|
||
# keyword 轉 map：`:keep` 選項（@keep_keys）重複出現時收集為清單，其餘取最後值。
|
||
@keep_keys ~w(redirect_url post_logout_redirect_uri scope)a
|
||
|
||
defp opts_to_map(opts) do
|
||
Enum.reduce(opts, %{}, fn
|
||
{k, v}, acc when k in @keep_keys ->
|
||
Map.update(acc, k, [v], fn existing -> existing ++ [v] end)
|
||
|
||
{k, v}, acc ->
|
||
Map.put(acc, k, v)
|
||
end)
|
||
end
|
||
|
||
# -- 分派 --
|
||
|
||
@doc """
|
||
執行已解析的指令，回傳退出碼。`opts[:api]` 可注入假的 userinfo 函式供測試。
|
||
"""
|
||
def dispatch(parsed, opts \\ []) do
|
||
api = opts[:api] || (&Api.userinfo/2)
|
||
|
||
case parsed do
|
||
{:version, _} ->
|
||
IO.puts(BearCli.version())
|
||
0
|
||
|
||
{:help, _} ->
|
||
print_help()
|
||
0
|
||
|
||
{:error, message, code} ->
|
||
IO.puts(:stderr, "錯誤：#{message}")
|
||
code
|
||
|
||
# apps 指令群（{:ok, {module, verb}, opts} 形狀；注入的 api 模組同時作為 apps_api）
|
||
{:ok, {Apps, verb}, cmd_opts} when is_atom(verb) ->
|
||
apps_api = cmd_opts[:apps_api] || opts[:apps_api] || Api
|
||
Apps.run(verb, Map.put(cmd_opts, :apps_api, apps_api))
|
||
|
||
# 管理端指令群（jwks/accounts/audit-logs；各自注入對應的 api 模組）
|
||
{:ok, {Jwks, verb}, cmd_opts} when is_atom(verb) ->
|
||
jwks_api = cmd_opts[:jwks_api] || opts[:jwks_api] || Api
|
||
Jwks.run(verb, Map.put(cmd_opts, :jwks_api, jwks_api))
|
||
|
||
{:ok, {Accounts, verb}, cmd_opts} when is_atom(verb) ->
|
||
accounts_api = cmd_opts[:accounts_api] || opts[:accounts_api] || Api
|
||
Accounts.run(verb, Map.put(cmd_opts, :accounts_api, accounts_api))
|
||
|
||
{:ok, {AuditLogs, verb}, cmd_opts} when is_atom(verb) ->
|
||
audit_logs_api = cmd_opts[:audit_logs_api] || opts[:audit_logs_api] || Api
|
||
AuditLogs.run(verb, Map.put(cmd_opts, :audit_logs_api, audit_logs_api))
|
||
|
||
{:ok, command, cmd_opts} ->
|
||
cond do
|
||
cmd_opts[:version] ->
|
||
IO.puts(BearCli.version())
|
||
0
|
||
|
||
cmd_opts[:help] ->
|
||
print_help()
|
||
0
|
||
|
||
true ->
|
||
run(command, cmd_opts, api)
|
||
end
|
||
end
|
||
end
|
||
|
||
# -- 指令實作 --
|
||
|
||
defp run(:login, opts, api) do
|
||
case opts[:token] do
|
||
nil ->
|
||
IO.puts(:stderr, "Device Flow 登入尚未開放（伺服器端 P1 未實作）。")
|
||
IO.puts(:stderr, "請改用個人存取權杖登入：bear login --token <PAT>")
|
||
2
|
||
|
||
"" ->
|
||
fail(opts, "token 不可為空", 2)
|
||
|
||
token ->
|
||
token = if token == "-", do: read_token_from_stdin(), else: token
|
||
do_login(opts, token, api)
|
||
end
|
||
end
|
||
|
||
defp run(:whoami, opts, api) do
|
||
case Config.env_token() do
|
||
# BEAR_TOKEN 優先於憑證檔（不讀檔、不寫檔）。
|
||
nil ->
|
||
whoami_from_credentials(opts, api)
|
||
|
||
token ->
|
||
call_userinfo(resolve_issuer(opts), token, opts, api)
|
||
end
|
||
end
|
||
|
||
defp run(:token, opts, _api) do
|
||
cond do
|
||
# BEAR_TOKEN 優先於憑證檔（一次性／CI 用，不寫入）。
|
||
token = Config.env_token() ->
|
||
IO.puts(token)
|
||
0
|
||
|
||
true ->
|
||
token_from_credentials(opts)
|
||
end
|
||
end
|
||
|
||
defp run(:logout, opts, _api) do
|
||
case Credentials.delete() do
|
||
:ok ->
|
||
if opts[:json] do
|
||
IO.puts(Jason.encode!(%{ok: true}))
|
||
else
|
||
IO.puts("已登出（本機憑證已清除）。")
|
||
IO.puts("注意：PAT 本身仍在伺服器端有效，如需撤銷請至 Bear 網頁「個人存取權杖」頁面。")
|
||
end
|
||
|
||
0
|
||
|
||
{:error, reason} ->
|
||
fail(opts, "清除憑證失敗：#{inspect(reason)}", 1)
|
||
end
|
||
end
|
||
|
||
defp run(:status, opts, _api) do
|
||
env_token = Config.env_token()
|
||
|
||
cond do
|
||
env_token ->
|
||
issuer = resolve_issuer(opts)
|
||
|
||
if opts[:json] do
|
||
IO.puts(
|
||
Jason.encode!(%{
|
||
ok: true,
|
||
logged_in: true,
|
||
mode: "env_token",
|
||
issuer: issuer
|
||
})
|
||
)
|
||
else
|
||
IO.puts("已登入（BEAR_TOKEN 環境變數）")
|
||
IO.puts("模式：個人存取權杖（環境變數，不寫入憑證檔）")
|
||
IO.puts("issuer：#{issuer}")
|
||
end
|
||
|
||
0
|
||
|
||
true ->
|
||
status_from_credentials(opts)
|
||
end
|
||
end
|
||
|
||
# -- 指令實作輔助 --
|
||
|
||
defp whoami_from_credentials(opts, api) do
|
||
case Credentials.load() do
|
||
{:ok, creds} ->
|
||
token = creds["access_token"]
|
||
|
||
if blank?(token) do
|
||
fail(opts, "憑證檔缺少 access_token，請重新 bear login", 7)
|
||
else
|
||
call_userinfo(resolve_issuer(opts, creds["issuer"]), token, opts, api)
|
||
end
|
||
|
||
:error ->
|
||
fail(opts, "未登入（請先執行 bear login）", 3)
|
||
end
|
||
end
|
||
|
||
defp call_userinfo(issuer, token, opts, api) do
|
||
if opts[:verbose], do: IO.puts(:stderr, "issuer: #{issuer}")
|
||
|
||
case api.(issuer, token) do
|
||
{:ok, claims} ->
|
||
if opts[:json] do
|
||
IO.puts(Jason.encode!(%{ok: true, claims: claims}))
|
||
else
|
||
print_claims(claims)
|
||
end
|
||
|
||
0
|
||
|
||
{:error, :unauthorized, desc} ->
|
||
fail(opts, "token 無效或已過期（#{desc}），請重新 bear login", 3)
|
||
|
||
{:error, :network, reason} ->
|
||
fail(opts, "無法連線到 #{issuer}：#{reason}", 6)
|
||
|
||
{:error, :server_error, status} ->
|
||
fail(opts, "伺服器回應 #{status}", 6)
|
||
end
|
||
end
|
||
|
||
defp token_from_credentials(opts) do
|
||
case Credentials.load() do
|
||
{:ok, creds} ->
|
||
if opts[:refresh] do
|
||
# 規格 §3.3：PAT 模式下 --refresh 為無效選項，報用法錯誤。
|
||
fail_token("PAT 模式無 refresh token，--refresh 為無效選項", 2)
|
||
else
|
||
case creds["access_token"] do
|
||
token when is_binary(token) and token != "" ->
|
||
# token 指令只輸出 token 本體（單行、無前綴），供 pipe 使用。
|
||
IO.puts(token)
|
||
0
|
||
|
||
_ ->
|
||
fail_token("憑證檔缺少 access_token，請重新 bear login", 7)
|
||
end
|
||
end
|
||
|
||
:error ->
|
||
fail_token("未登入（請先執行 bear login）", 3)
|
||
end
|
||
end
|
||
|
||
defp status_from_credentials(opts) do
|
||
case Credentials.load() do
|
||
{:ok, creds} ->
|
||
if opts[:json] do
|
||
IO.puts(
|
||
Jason.encode!(%{
|
||
ok: true,
|
||
logged_in: true,
|
||
email: creds["email"],
|
||
issuer: creds["issuer"],
|
||
mode: "pat"
|
||
})
|
||
)
|
||
else
|
||
IO.puts("已登入：#{creds["email"] || "(未知)"}")
|
||
IO.puts("模式：個人存取權杖（PAT）")
|
||
IO.puts("issuer：#{creds["issuer"]}")
|
||
end
|
||
|
||
0
|
||
|
||
:error ->
|
||
if opts[:json] do
|
||
IO.puts(Jason.encode!(%{ok: false, logged_in: false, error: "未登入", code: 3}))
|
||
else
|
||
IO.puts("未登入")
|
||
end
|
||
|
||
3
|
||
end
|
||
end
|
||
|
||
# -- 指令實作輔助 --
|
||
|
||
defp do_login(opts, token, api) do
|
||
issuer = resolve_issuer(opts)
|
||
|
||
if opts[:verbose], do: IO.puts(:stderr, "issuer: #{issuer}")
|
||
|
||
case api.(issuer, token) do
|
||
{:ok, claims} ->
|
||
email = claims["email"]
|
||
creds = %{"issuer" => issuer, "access_token" => token, "email" => email}
|
||
|
||
case Credentials.save(creds) do
|
||
:ok ->
|
||
if opts[:json] do
|
||
IO.puts(Jason.encode!(%{ok: true, email: email}))
|
||
else
|
||
IO.puts("已登入：#{email || "(無 email claim)"}")
|
||
end
|
||
|
||
0
|
||
|
||
{:error, reason} ->
|
||
fail(opts, "憑證檔寫入失敗：#{inspect(reason)}", 1)
|
||
end
|
||
|
||
{:error, :unauthorized, desc} ->
|
||
# 規格 §3.1：PAT 無效或已撤銷 → 退出碼 3。
|
||
fail(opts, "PAT 無效或已撤銷（#{desc}），不寫入任何資料", 3)
|
||
|
||
{:error, :network, reason} ->
|
||
fail(opts, "無法連線到 #{issuer}：#{reason}", 6)
|
||
|
||
{:error, :server_error, status} ->
|
||
fail(opts, "伺服器回應 #{status}", 6)
|
||
end
|
||
end
|
||
|
||
# -- 輔助 --
|
||
|
||
# 優先取 --issuer flag；否則取憑證內記錄的 issuer；最後才回落 config/env/預設。
|
||
defp resolve_issuer(opts, stored_issuer \\ nil) do
|
||
opts[:issuer] || stored_issuer || Config.resolve_issuer(nil, opts[:config])
|
||
end
|
||
|
||
defp read_token_from_stdin do
|
||
IO.read(:stdio, :line) |> to_string() |> String.trim()
|
||
end
|
||
|
||
defp fail(opts, message, code) do
|
||
if opts[:json] do
|
||
IO.puts(Jason.encode!(%{ok: false, error: message, code: code}))
|
||
else
|
||
IO.puts(:stderr, "錯誤：#{message}")
|
||
end
|
||
|
||
code
|
||
end
|
||
|
||
# token 指令的錯誤一律走 stderr，避免污染 stdout（pipe 的對象）。
|
||
defp fail_token(message, code) do
|
||
IO.puts(:stderr, "錯誤：#{message}")
|
||
code
|
||
end
|
||
|
||
@preferred_claims ~w(sub email name preferred_username nickname picture)
|
||
|
||
defp print_claims(claims) do
|
||
preferred =
|
||
Enum.filter(@preferred_claims, &Map.has_key?(claims, &1))
|
||
|
||
rest =
|
||
claims
|
||
|> Map.drop(@preferred_claims)
|
||
|> Enum.sort_by(fn {k, _} -> to_string(k) end)
|
||
|
||
Enum.each(preferred, fn k ->
|
||
IO.puts("#{String.pad_trailing(k, 20)}: #{format_value(claims[k])}")
|
||
end)
|
||
|
||
Enum.each(rest, fn {k, v} ->
|
||
IO.puts("#{String.pad_trailing(to_string(k), 20)}: #{format_value(v)}")
|
||
end)
|
||
end
|
||
|
||
defp format_value(v) when is_binary(v), do: v
|
||
defp format_value(v) when is_number(v), do: to_string(v)
|
||
defp format_value(v) when is_boolean(v), do: to_string(v)
|
||
defp format_value(v) when is_nil(v), do: ""
|
||
defp format_value(v), do: Jason.encode!(v)
|
||
|
||
defp blank?(nil), do: true
|
||
defp blank?(""), do: true
|
||
defp blank?(_), do: false
|
||
|
||
defp print_help do
|
||
IO.puts("""
|
||
Bear CLI — Bear SSO 終端機客戶端
|
||
|
||
用法：bear <指令> [選項]
|
||
|
||
指令：
|
||
login --token <PAT> 以個人存取權杖登入（PAT 模式；Device Flow 尚未開放）
|
||
whoami 顯示目前登入身分
|
||
token [--refresh] 印出 access token（PAT 模式下 --refresh 為用法錯誤）
|
||
logout 登出（清除本機憑證）
|
||
status 顯示登入狀態
|
||
apps <動詞> App 管理（admin；bear apps --help 查看）
|
||
jwks <動詞> 簽章金鑰管理（admin）
|
||
accounts <動詞> 帳號管理（admin）
|
||
audit-logs list 稽核日誌（admin）
|
||
|
||
apps 指令群（需 admin 權限的 PAT）：
|
||
apps list [--visibility public|internal] [--status active|inactive]
|
||
[--page N] [--per-page N]
|
||
apps show <client-id>
|
||
apps create --client-id ID --url URL --title TITLE
|
||
[--method client_secret|PKCE] [--visibility public|internal]
|
||
[--redirect-url URL]... [--post-logout-redirect-uri URI]...
|
||
[--scope SCOPE]... [--sub FIELD] [--jwk-id ID] [--secret SECRET]
|
||
apps update <client-id> [同 create 的選項；只更新有給的欄位]
|
||
apps rotate-secret <client-id>
|
||
apps toggle <client-id>
|
||
|
||
全域選項：
|
||
--issuer URL Bear（OIDC Provider）位址（預設 https://alterminal.com）
|
||
--config PATH 設定檔路徑（預設 ~/.config/bear/config.json）
|
||
--json 機器可讀輸出（JSON）
|
||
-v, --verbose 顯示詳細日誌
|
||
-h, --help 顯示說明
|
||
--version 顯示版本
|
||
|
||
環境變數：
|
||
BEAR_TOKEN 一次性／CI 用的 PAT；提供後 whoami/token/status 優先
|
||
使用，不寫入憑證檔
|
||
""")
|
||
end
|
||
end
|