systemprompt-cli 0.17.0

Unified CLI for systemprompt.io AI governance: agent orchestration, MCP governance, analytics, profiles, cloud deploy, and self-hosted operations.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129

use anyhow::{Result, anyhow, bail};
use dialoguer::Confirm;
use dialoguer::theme::ColorfulTheme;
use systemprompt_cloud::{CloudApiClient, CloudPath, TenantStore, TenantType, get_cloud_paths};
use systemprompt_identifiers::TenantId;
use systemprompt_logging::CliService;

use super::select::{get_credentials, select_tenant};
use crate::cli_settings::CliConfig;
use crate::cloud::types::RotateCredentialsOutput;
use crate::shared::CommandOutput;

pub async fn rotate_credentials(
    id: Option<String>,
    skip_confirm: bool,
    config: &CliConfig,
) -> Result<CommandOutput> {
    let cloud_paths = get_cloud_paths();
    let tenants_path = cloud_paths.resolve(CloudPath::Tenants);
    let mut store = TenantStore::load_from_path(&tenants_path).unwrap_or_else(|e| {
        if !config.is_json_output() {
            CliService::warning(&format!("Failed to load tenant store: {}", e));
        }
        TenantStore::default()
    });

    let tenant_id = resolve_rotation_target(id, &store, skip_confirm)?;

    let tenant = store
        .tenants
        .iter()
        .find(|t| t.id == tenant_id.as_str())
        .ok_or_else(|| anyhow!("Tenant not found: {}", tenant_id.as_str()))?;

    if tenant.tenant_type != TenantType::Cloud {
        bail!("Credential rotation is only available for cloud tenants");
    }

    if !skip_confirm && !confirm_rotation(&tenant.name)? {
        return Ok(cancelled_output(&tenant_id, config));
    }

    let creds = get_credentials()?;
    let client = CloudApiClient::new(&creds.api_url, &creds.api_token)?;

    let response = if config.is_json_output() {
        client.rotate_credentials(&tenant_id).await?
    } else {
        let spinner = CliService::spinner("Rotating database credentials...");
        let resp = client.rotate_credentials(&tenant_id).await?;
        spinner.finish_and_clear();
        resp
    };

    let tenant = store
        .tenants
        .iter_mut()
        .find(|t| t.id == tenant_id.as_str())
        .ok_or_else(|| anyhow!("Tenant not found after rotation"))?;

    tenant.internal_database_url = Some(response.internal_database_url.clone());
    if tenant.external_db_access {
        tenant.database_url = Some(response.external_database_url.clone());
    }

    store.save_to_path(&tenants_path)?;

    let output = RotateCredentialsOutput {
        tenant: tenant_id.as_str().to_owned(),
        status: response.status.clone(),
        internal_database_url: response.internal_database_url.clone(),
        external_database_url: response.external_database_url,
    };

    if !config.is_json_output() {
        render_rotation_result(&output);
    }

    Ok(CommandOutput::card_value("Rotate Credentials", &output))
}

fn resolve_rotation_target(
    id: Option<String>,
    store: &TenantStore,
    skip_confirm: bool,
) -> Result<TenantId> {
    if let Some(id) = id {
        return Ok(TenantId::new(id));
    }
    if store.tenants.is_empty() {
        bail!("No tenants configured.");
    }
    if skip_confirm {
        bail!("Tenant ID required in non-interactive mode");
    }
    Ok(TenantId::new(select_tenant(&store.tenants)?.id.clone()))
}

fn confirm_rotation(tenant_name: &str) -> Result<bool> {
    Ok(Confirm::with_theme(&ColorfulTheme::default())
        .with_prompt(format!(
            "Rotate database credentials for '{}'? This will generate a new password.",
            tenant_name
        ))
        .default(false)
        .interact()?)
}

fn cancelled_output(tenant_id: &TenantId, config: &CliConfig) -> CommandOutput {
    if !config.is_json_output() {
        CliService::info("Cancelled");
    }
    let output = RotateCredentialsOutput {
        tenant: tenant_id.as_str().to_owned(),
        status: "cancelled".to_owned(),
        internal_database_url: String::new(),
        external_database_url: String::new(),
    };
    CommandOutput::card_value("Rotate Credentials", &output)
}

fn render_rotation_result(output: &RotateCredentialsOutput) {
    CliService::success("Database credentials rotated");
    CliService::key_value("Status", &output.status);

    CliService::section("New Database Connection");
    CliService::key_value("Internal URL", &output.internal_database_url);
    CliService::key_value("External URL", &output.external_database_url);
}