diff --git a/README.md b/README.md index 46483a8c..b2e69e77 100644 --- a/README.md +++ b/README.md @@ -298,8 +298,17 @@ populated, not that login succeeded. `fill` requires an already-open page and ne navigates or submits it. Optional `page_url` selects the exact page; cards require it. Do not automatically retry failed/unknown fills or fall back to aliases. +Create specs list `fields` as an ordered array. Each entry carries a stable `name` +(letters, digits, and underscores, starting with a letter) that keys values, updates, +and fills. Order is preserved: list fields in the same top-to-bottom order as the +website, because the collection form renders that order unchanged. An optional `label` +supplies non-secret display text for that field on the collection form; it never +affects value keys, updates, or fills. Use a single trimmed line of at most 128 UTF-8 +bytes, and it is returned as metadata in `get`/`list` output. + Use `credentials update --version --spec-file changes.json` -with a spec such as `{"fields":{"password":{"value":"replacement"}}}`. Keep actual +with a spec such as `{"fields":{"password":{"value":"replacement"}}}`; update specs key +`fields` by name rather than using the ordered array. Keep actual secrets in protected files or stdin, never shell arguments. Omission preserves values; null or an empty string clears supported fields, including required text/email/password fields (returning them to pending collection). The form still requires nonempty required inputs. Field definitions cannot change. Stale versions fail, without retries. `items invoke collect` reopens the full form without diff --git a/cmd/org.go b/cmd/org.go index 2bce469d..92143ade 100644 --- a/cmd/org.go +++ b/cmd/org.go @@ -135,6 +135,16 @@ func renderOrgLimits(limits *kernel.OrgLimits) { {"Default Project Max Concurrent Sessions", formatProjectLimitValue(limits.DefaultProjectMaxConcurrentSessions, limits.JSON.DefaultProjectMaxConcurrentSessions)}, } + // Concurrency usage is measured live and only returned by newer API + // versions. Unlike the limit rows, a null here means usage could not be + // read rather than "unlimited", so render it as unknown. + if orgLimitFieldPresent(limits.JSON.ConcurrentSessionsUsed) { + rows = append(rows, []string{"Concurrent Sessions Used", formatOrgUsageValue(limits.ConcurrentSessionsUsed, limits.JSON.ConcurrentSessionsUsed)}) + } + if orgLimitFieldPresent(limits.JSON.ConcurrentSessionsAvailable) { + rows = append(rows, []string{"Concurrent Sessions Available", formatOrgUsageValue(limits.ConcurrentSessionsAvailable, limits.JSON.ConcurrentSessionsAvailable)}) + } + // Managed auth limits are plan-derived and only returned by newer API // versions, so render each row only when the field is present. A null // max_auth_connections means unlimited, so presence — not validity — is the @@ -167,6 +177,15 @@ func orgLimitFieldPresent(field respjson.Field) bool { return field.Raw() != respjson.Omitted } +// formatOrgUsageValue renders a live usage counter, where a null means the API +// could not read current usage rather than "unlimited". +func formatOrgUsageValue(value int64, field respjson.Field) string { + if !field.Valid() { + return "unknown" + } + return fmt.Sprintf("%d", value) +} + func renderOrgEntitlements(entitlements *kernel.OrgEntitlements) { if entitlements == nil { pterm.Info.Println("No organization entitlements found") @@ -266,7 +285,7 @@ var orgLimitsCmd = &cobra.Command{ var orgLimitsGetCmd = &cobra.Command{ Use: "get", Short: "Get organization limits", - Long: "Show the organization's effective limits: the concurrency limit, the default per-project cap applied to projects without an explicit override, and the plan-derived managed auth and vault limits along with current auth connection and vault usage.", + Long: "Show the organization's effective limits: the concurrency limit, current organization-wide concurrent browser usage and remaining capacity, the default per-project cap applied to projects without an explicit override, and the plan-derived managed auth and vault limits along with current auth connection and vault usage.", Args: cobra.NoArgs, RunE: runOrgLimitsGet, } diff --git a/cmd/org_test.go b/cmd/org_test.go index 9118f619..33afdbbd 100644 --- a/cmd/org_test.go +++ b/cmd/org_test.go @@ -4,6 +4,7 @@ import ( "context" "encoding/json" "errors" + "strings" "testing" "time" @@ -296,6 +297,63 @@ func TestOrgLimitsGet_NullDefaultShownAsUnlimited(t *testing.T) { assert.Contains(t, buf.String(), "unlimited") } +func TestOrgLimitsGet_RendersConcurrencyUsage(t *testing.T) { + buf := capturePtermOutput(t) + fake := &FakeOrgLimitsService{ + GetFunc: func(ctx context.Context, opts ...option.RequestOption) (*kernel.OrgLimits, error) { + limits := &kernel.OrgLimits{ + MaxConcurrentSessions: 100, + ConcurrentSessionsUsed: 12, + ConcurrentSessionsAvailable: 88, + } + limits.JSON.ConcurrentSessionsUsed = respjson.NewField("12") + limits.JSON.ConcurrentSessionsAvailable = respjson.NewField("88") + return limits, nil + }, + } + c := OrgCmd{limits: fake} + assert.NoError(t, c.LimitsGet(context.Background(), OrgLimitsGetInput{})) + + out := buf.String() + assert.Contains(t, out, "Concurrent Sessions Used") + assert.Contains(t, out, "12") + assert.Contains(t, out, "Concurrent Sessions Available") + assert.Contains(t, out, "88") +} + +func TestOrgLimitsGet_NullConcurrencyUsageShownAsUnknown(t *testing.T) { + buf := capturePtermOutput(t) + fake := &FakeOrgLimitsService{ + GetFunc: func(ctx context.Context, opts ...option.RequestOption) (*kernel.OrgLimits, error) { + limits := &kernel.OrgLimits{MaxConcurrentSessions: 100} + // Null (not omitted) means usage could not be read, which is not + // the same as unlimited. + limits.JSON.ConcurrentSessionsUsed = respjson.NewField(respjson.Null) + limits.JSON.ConcurrentSessionsAvailable = respjson.NewField(respjson.Null) + return limits, nil + }, + } + c := OrgCmd{limits: fake} + assert.NoError(t, c.LimitsGet(context.Background(), OrgLimitsGetInput{})) + + out := buf.String() + // Both usage rows render as unknown rather than borrowing the "unlimited" + // meaning a null limit would have. + assert.Contains(t, out, "Concurrent Sessions Used") + assert.Contains(t, out, "Concurrent Sessions Available") + assert.Equal(t, 2, strings.Count(out, "unknown")) +} + +func TestOrgLimitsGet_OmitsConcurrencyUsageRowsWhenAbsent(t *testing.T) { + buf := capturePtermOutput(t) + c := OrgCmd{limits: &FakeOrgLimitsService{}} + assert.NoError(t, c.LimitsGet(context.Background(), OrgLimitsGetInput{})) + + out := buf.String() + assert.NotContains(t, out, "Concurrent Sessions Used") + assert.NotContains(t, out, "Concurrent Sessions Available") +} + func TestOrgLimitsGet_RendersManagedAuthLimits(t *testing.T) { buf := capturePtermOutput(t) fake := &FakeOrgLimitsService{ diff --git a/cmd/vaults_credentials.go b/cmd/vaults_credentials.go index 03b697c8..5d20dca9 100644 --- a/cmd/vaults_credentials.go +++ b/cmd/vaults_credentials.go @@ -1,6 +1,7 @@ package cmd import ( + "bytes" "context" "encoding/json" "fmt" @@ -63,7 +64,7 @@ func newVaultCredentialsCommand() *cobra.Command { }, } if update { - cmd.Long += "\nUpdate preserves omitted fields, replaces nonempty string values, and clears supported values with null or an empty string. Clearing a required text/email/password field returns pending_collection; form submissions still require a nonempty value.\nField definitions are immutable. Do not automatically retry version conflicts." + cmd.Long += "\nUpdate spec fields are an object keyed by field name, not the ordered array used on create.\nUpdate preserves omitted fields, replaces nonempty string values, and clears supported values with null or an empty string. Clearing a required text/email/password field returns pending_collection; form submissions still require a nonempty value.\nField definitions are immutable. Do not automatically retry version conflicts." cmd.Flags().Int64("version", 0, "Expected version from items get (required; never auto-refreshed)") _ = cmd.MarkFlagRequired("version") cmd.Flags().String("expected-item-id", "", "Immutable item ID from the original read; reject an update if the key now refers to a replacement item") @@ -127,8 +128,17 @@ func (c VaultsCmd) saveCredential(ctx context.Context, vault, key string, data [ } else { var spec kernel.CredentialVaultItemSpecInputParam if json.Unmarshal(data, &spec) != nil || len(spec.Fields) == 0 { + if credentialSpecUsesKeyedFields(data) { + return fmt.Errorf("credential spec fields must be an ordered array of definitions carrying a name, not an object keyed by name") + } return fmt.Errorf("credential spec requires fields") } + // Names key values, updates, and fills; reject specs the form cannot address. + for _, field := range spec.Fields { + if strings.TrimSpace(field.Name) == "" { + return fmt.Errorf("every credential spec field requires a name") + } + } item, err = c.vaults.Items.Upsert(ctx, key, kernel.VaultItemUpsertParams{IDOrName: vault, OfCredential: &kernel.CredentialVaultItemRequestParam{Type: "credential", Spec: spec}}, option.WithMaxRetries(0)) } if err != nil { @@ -136,3 +146,16 @@ func (c VaultsCmd) saveCredential(ctx context.Context, vault, key string, data [ } return c.showItem(item, output, open) } + +// The create spec moved from fields keyed by name to an ordered array; point +// callers still sending the object form at the replacement shape. +func credentialSpecUsesKeyedFields(data []byte) bool { + var object struct { + Fields json.RawMessage `json:"fields"` + } + if json.Unmarshal(data, &object) != nil { + return false + } + fields := bytes.TrimSpace(object.Fields) + return len(fields) > 0 && fields[0] == '{' +} diff --git a/cmd/vaults_fill_credentials_test.go b/cmd/vaults_fill_credentials_test.go index c351e70c..29d7b7f6 100644 --- a/cmd/vaults_fill_credentials_test.go +++ b/cmd/vaults_fill_credentials_test.go @@ -19,7 +19,7 @@ func TestVaultFillBothItemTypesAndInputs(t *testing.T) { for _, input := range []string{"params", "spec-file"} { for _, test := range []struct{ name, item, params, result string }{ {"card", readyFillCardFixture, fillParamsFixture, completedFillFixture}, - {"credential", readyFillCredentialFixture, `{"browser_id":"browser-id","fields":[{"field":"expiration","selector":"#password"},{"field":"custom field","selector":"#custom"},{"field":"otp","selector":"#code"}]}`, completedFillFixture}, + {"credential", readyFillCredentialFixture, `{"browser_id":"browser-id","fields":[{"field":"expiration","selector":"#password"},{"field":"custom_field","selector":"#custom"},{"field":"otp","selector":"#code"}]}`, completedFillFixture}, {"credential URL", readyFillCredentialFixture, `{"browser_id":"browser-id","page_url":"http://localhost/login","fields":[{"field":"expiration","selector":"#password"}]}`, `{"type":"fill","status":"completed","fields":[{"index":0,"status":"filled"}]}`}, } { t.Run(input+"/"+test.name, func(t *testing.T) { @@ -56,7 +56,7 @@ func TestVaultCredentialFillValidation(t *testing.T) { for _, params := range []string{ `{"browser_id":"id","fields":[{"field":"unknown","selector":"#field"}]}`, `{"browser_id":"id","fields":[{"field":"expiration","selector":"#field","format":"MM/YY"}]}`, - `{"browser_id":"id","fields":[{"field":"custom field","selector":"#field","format":"MM/YYYY"}]}`, + `{"browser_id":"id","fields":[{"field":"custom_field","selector":"#field","format":"MM/YYYY"}]}`, `{"browser_id":"id","fields":[{"field":"expiration","selector":"#field","value":"secret-sentinel"}]}`, `{"browser_id":"id","browser_id":"secret-sentinel","fields":[{"field":"expiration","selector":"#field"}]}`, } { @@ -106,7 +106,7 @@ func TestCredentialFillCLIOutcomes(t *testing.T) { io.WriteString(w, result) })) defer server.Close() - out, stderr, exit := runVaultFillCLI(t, server.URL, "fill", "--params", `{"browser_id":"id","fields":[{"field":"expiration","selector":"#password"},{"field":"custom field","selector":"#custom"},{"field":"otp","selector":"#code"}]}`, "-o", "json") + out, stderr, exit := runVaultFillCLI(t, server.URL, "fill", "--params", `{"browser_id":"id","fields":[{"field":"expiration","selector":"#password"},{"field":"custom_field","selector":"#custom"},{"field":"otp","selector":"#code"}]}`, "-o", "json") assert.True(t, json.Valid([]byte(out))) assert.JSONEq(t, result, out) assert.Empty(t, stderr) diff --git a/cmd/vaults_help.go b/cmd/vaults_help.go index 8e3dc275..e9b38ab7 100644 --- a/cmd/vaults_help.go +++ b/cmd/vaults_help.go @@ -69,7 +69,7 @@ type AgentCardCardSpec = { merchant: string; // approval-screen name; 1..120 characters amount: number; // integer minor units; 1..9007199254740991 currency: string; // three letters - card_id?: string; // vc_...; otherwise chosen at approval + card_id?: string; // opaque AgentCard ID, pass through unchanged; else chosen at approval }; type LinkLineItem = { diff --git a/cmd/vaults_public_values_test.go b/cmd/vaults_public_values_test.go index b88bc680..ca6b98c6 100644 --- a/cmd/vaults_public_values_test.go +++ b/cmd/vaults_public_values_test.go @@ -121,3 +121,41 @@ func TestVaultFillActionableErrors(t *testing.T) { }) } } + +// label is non-secret display metadata: it must reach the API unchanged on create +// and survive the display-safe output projection on every read. +func TestVaultCredentialLabelsRoundTrip(t *testing.T) { + t.Setenv("KERNEL_PROJECT", "") + spec := `{"description":"Hacker News","fields":[{"name":"username","label":"Username or email","type":"text","required":true,"sensitive":false},{"name":"password","label":"Password","type":"password","required":true,"sensitive":true}]}` + fixture := fmt.Sprintf(`{"id":"credential-1","key":"login","type":"credential","version":1,"spec":%s,"state":{"status":"pending_collection","fields":{"username":{"has_value":false},"password":{"has_value":false}}},"available_operations":[],"available_expansions":[]}`, spec) + sent := "" + client := vaultTestClient(t, func(w http.ResponseWriter, r *http.Request) { + var body struct { + Spec struct { + Fields json.RawMessage `json:"fields"` + } `json:"spec"` + } + require.NoError(t, json.NewDecoder(r.Body).Decode(&body)) + sent = string(body.Spec.Fields) + w.Header().Set("Content-Type", "application/json") + io.WriteString(w, fixture) + }) + out, _, err := executeVaultCommand(t, client, "vaults", "credentials", "create", "user-123", "login", "--spec-file", credentialSpecFile(t, spec), "-o", "json") + require.NoError(t, err) + assert.Contains(t, sent, `"label":"Username or email"`) + assert.Contains(t, sent, `"label":"Password"`) + assert.Contains(t, out, `"label": "Username or email"`) + assert.Contains(t, out, `"label": "Password"`) +} + +// A label is metadata only; it must never carry a value into the output. +func TestVaultCredentialLabelDoesNotExposeValues(t *testing.T) { + fixture := strings.Replace(publicCredentialFixture, + `{"name":"password","type":"password"}`, + `{"name":"password","label":"Password","type":"password"}`, 1) + require.NotEqual(t, publicCredentialFixture, fixture) + out, err := filterVaultJSON(json.RawMessage(fixture), vaultItemFields) + require.NoError(t, err) + assert.Contains(t, string(out), `"label":"Password"`) + assert.NotContains(t, string(out), "private-password") +} diff --git a/cmd/vaults_sdk_contract_test.go b/cmd/vaults_sdk_contract_test.go index 8fa3a16c..802591fb 100644 --- a/cmd/vaults_sdk_contract_test.go +++ b/cmd/vaults_sdk_contract_test.go @@ -124,3 +124,51 @@ func TestVaultPreparationEventsAreProjected(t *testing.T) { assert.Contains(t, out, `"preparation_id": "prep-1"`) assert.NotContains(t, out, "never-print") } + +func TestCredentialFieldOrderIsPreserved(t *testing.T) { + t.Setenv("KERNEL_PROJECT", "") + spec := `{"description":"Example","fields":[{"name":"email","type":"email","required":true,"sensitive":false},{"name":"password","type":"password","required":true,"sensitive":true},{"name":"otp","type":"totp","required":false,"sensitive":true}]}` + client := vaultTestClient(t, func(w http.ResponseWriter, r *http.Request) { + var body struct { + Spec struct { + Fields json.RawMessage `json:"fields"` + } `json:"spec"` + } + require.NoError(t, json.NewDecoder(r.Body).Decode(&body)) + // The website's top-to-bottom order must reach the API unchanged. + assert.Equal(t, `[{"name":"email","type":"email","required":true,"sensitive":false},{"name":"password","type":"password","required":true,"sensitive":true},{"name":"otp","type":"totp","required":false,"sensitive":true}]`, string(body.Spec.Fields)) + w.Header().Set("Content-Type", "application/json") + fmt.Fprintf(w, `{"id":"credential-1","key":"login","type":"credential","version":1,"spec":%s,"state":{"status":"pending_collection","fields":{"email":{"has_value":false},"password":{"has_value":false},"otp":{"has_value":false}}},"available_operations":[],"available_expansions":[]}`, spec) + }) + out, _, err := executeVaultCommand(t, client, "vaults", "credentials", "create", "user-123", "login", "--spec-file", credentialSpecFile(t, spec), "-o", "json") + require.NoError(t, err) + assert.Less(t, strings.Index(out, `"email"`), strings.Index(out, `"password"`)) + assert.Less(t, strings.Index(out, `"password"`), strings.Index(out, `"otp"`)) + for _, name := range []string{"email", "password", "otp"} { + assert.Contains(t, out, fmt.Sprintf(`"name": %q`, name)) + } +} + +func TestCredentialKeyedFieldsAreRejectedWithGuidance(t *testing.T) { + t.Setenv("KERNEL_PROJECT", "") + client := vaultTestClient(t, func(w http.ResponseWriter, r *http.Request) { + t.Error("a keyed create spec must not reach the API") + }) + _, _, err := executeVaultCommand(t, client, "vaults", "credentials", "create", "user-123", "login", + "--spec-file", credentialSpecFile(t, `{"fields":{"password":{"type":"password","value":"secret-echo"}}}`)) + require.Error(t, err) + assert.Contains(t, err.Error(), "ordered array") + assert.NotContains(t, err.Error(), "secret-echo") +} + +func TestCredentialFieldsRequireNames(t *testing.T) { + t.Setenv("KERNEL_PROJECT", "") + client := vaultTestClient(t, func(w http.ResponseWriter, r *http.Request) { + t.Error("an unnamed field must not reach the API") + }) + _, _, err := executeVaultCommand(t, client, "vaults", "credentials", "create", "user-123", "login", + "--spec-file", credentialSpecFile(t, `{"fields":[{"type":"password","value":"secret-echo"}]}`)) + require.Error(t, err) + assert.Contains(t, err.Error(), "name") + assert.NotContains(t, err.Error(), "secret-echo") +} diff --git a/cmd/vaults_test.go b/cmd/vaults_test.go index 14942156..5ec933b3 100644 --- a/cmd/vaults_test.go +++ b/cmd/vaults_test.go @@ -303,6 +303,32 @@ func TestVaultCardRequestMapping(t *testing.T) { } } +func TestVaultCardAgentcardCardIDIsOpaque(t *testing.T) { + t.Setenv("KERNEL_PROJECT", "project-test") + // AgentCard card IDs are opaque: the CLI must forward whatever the caller + // supplies without assuming a prefix or format. + for _, cardID := range []string{"vc_chosen", "chosen", "card-123", "AGC/9f2e::7"} { + t.Run(cardID, func(t *testing.T) { + client := vaultTestClient(t, func(w http.ResponseWriter, r *http.Request) { + var body map[string]json.RawMessage + require.NoError(t, json.NewDecoder(r.Body).Decode(&body)) + var spec struct { + CardID string `json:"card_id"` + } + require.NoError(t, json.Unmarshal(body["spec"], &spec)) + assert.Equal(t, cardID, spec.CardID) + w.Header().Set("Content-Type", "application/json") + _, _ = io.WriteString(w, requestedCardFixture) + }) + spec := fmt.Sprintf(`{"wallet":"wallet-1","amount":1234,"currency":"usd","merchant":"Example Shop","card_id":%q}`, cardID) + _, _, err := executeVaultCommand(t, client, + "vaults", "cards", "create", "checkout", "order-1", "-o", "json", + "--provider", "agentcard", "--spec", spec) + require.NoError(t, err) + }) + } +} + func TestVaultInvokeRequiresAdvertisedOperation(t *testing.T) { t.Setenv("KERNEL_PROJECT", "project-test") for _, state := range []string{"requested", "pending_authorization", "ready", "consumed", "expired", "declined"} { diff --git a/go.mod b/go.mod index dcae6b62..54673228 100644 --- a/go.mod +++ b/go.mod @@ -9,7 +9,7 @@ require ( github.com/charmbracelet/lipgloss/v2 v2.0.0-beta.1 github.com/golang-jwt/jwt/v5 v5.2.2 github.com/joho/godotenv v1.5.1 - github.com/kernel/kernel-go-sdk v0.110.0 + github.com/kernel/kernel-go-sdk v0.110.1-0.20260918232759-6e379e6df7b9 github.com/klauspost/compress v1.18.5 github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c github.com/pterm/pterm v0.12.80 diff --git a/go.sum b/go.sum index 1f47cec9..7f091b2b 100644 --- a/go.sum +++ b/go.sum @@ -64,8 +64,8 @@ github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw= github.com/joho/godotenv v1.5.1 h1:7eLL/+HRGLY0ldzfGMeQkb7vMd0as4CfYvUVzLqw0N0= github.com/joho/godotenv v1.5.1/go.mod h1:f4LDr5Voq0i2e/R5DDNOoa2zzDfwtkZa6DnEwAbqwq4= -github.com/kernel/kernel-go-sdk v0.110.0 h1:2KkE0hAlJav5xg2818Eg+mIK2p1F2nDZ0rZdA2EO1QQ= -github.com/kernel/kernel-go-sdk v0.110.0/go.mod h1:EeZzSuHZVeHKxKCPUzxou2bovNGhXaz0RXrSqKNf1AQ= +github.com/kernel/kernel-go-sdk v0.110.1-0.20260918232759-6e379e6df7b9 h1:pXDNpTFqbNjXMSmMYlbzAIpqlVVuyaNP1Xzsm36qvRI= +github.com/kernel/kernel-go-sdk v0.110.1-0.20260918232759-6e379e6df7b9/go.mod h1:EeZzSuHZVeHKxKCPUzxou2bovNGhXaz0RXrSqKNf1AQ= github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE= github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= github.com/klauspost/cpuid/v2 v2.0.9/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=