Audit third-party CLI: token login, kebab-case rename, compliance report commands

[uvollmer]

Summary

Audits and rounds out the prb third-party CLI surface. Three intended changes, plus three bugs caught while verifying end-to-end against a live org.

Intended changes

• Token/API-key login — adds prb auth login --token, converging on the documented UX (--hostname … --token … --org …). Skips the browser device flow, validates the token, and persists a token-only host config. Org selection is shared with the device flow via a new selectOrganization helper.
• Kebab-case rename (clean break) — prb thirdParty → prb third-party; package pkg/cmd/thirdpartymgmt → pkg/cmd/third-party; flags --thirdParty-ids → --third-party-ids on asset/datum. No back-compat aliases. GraphQL field names and IAM action identifiers keep their canonical casing.
• Compliance report commands — new prb third-party report upload | list | delete, wrapping the existing uploadThirdPartyComplianceReport / deleteThirdPartyComplianceReport mutations and the complianceReports connection.

Bugs found & fixed while verifying against a live backend

1. Date-only flags rejected — --report-date 2026-01-01 (as documented) failed server-side because the Datetime scalar only parses RFC3339. Added cmdutil.NormalizeDatetime (date-only → midnight UTC, RFC3339 passthrough) with unit tests.
2. CLI uploads sent application/octet-stream — multipart.CreateFormFile hardcodes that Content-Type, which the server's document validator rejects; the file-validation error then surfaced as an opaque HTTP 500. DoUpload now derives the real MIME from the file extension. This is in shared pkg/cli/api/client.go, so it fixes every CLI upload — evidence upload was broken the same way.
3. evidence upload selected a non-existent field — its mutation queried evidence on UploadMeasureEvidencePayload (which only has evidenceEdge), failing GraphQL validation with an HTTP 422 before reaching the resolver. Fixed to evidenceEdge { node { … } }. Pre-existing; surfaced only because fix Bootstrap api #2 let the request reach query validation.

Also fixed a bogus --json example (real flag is -o json) in the report and third-party list commands. The same typo exists in ~21 other list commands and was left out of scope.

Testing

Verified end-to-end against a live org (all throwaway objects cleaned up):

• third-party list works; old thirdParty command is gone (clean break confirmed).
• report upload … --report-date 2026-01-01 --valid-until 2026-12-31 → succeeds; report list -o json confirms dates normalized to 2026-01-01T00:00:00Z / 2026-12-31T00:00:00Z.
• Invalid date → clean client-side error; delete without --yes refused; delete --yes removes the report.
• evidence upload ./x.pdf --measure <id> → succeeds (confirms both the content-type and mutation-selection fixes on that path).
• go build, go vet, gofmt, and cmdutil unit tests all green.

Notes / follow-ups (out of scope)

• The report commands exist only in the CLI; MCP (specification.yaml) and n8n have no compliance-report upload operation (api-surface.md sync gap).
• --json example typo persists in ~21 other list commands.

🤖 Generated with Claude Code

---

Summary by cubic

Adds token login to prb auth login, renames the third-party CLI to kebab-case, and adds report upload/list/delete commands. Fixes broken uploads by sending real MIME types, normalizes date flags, and fixes evidence upload selection.

prb (CLI) +716 -99

• Token/API-key login: prb auth login --hostname … --token … --org … validates the token and saves a host config; shared org picker for interactive mode.
• Rename: prb thirdParty → prb third-party; flags --thirdParty-ids → --third-party-ids; updated help, prompts, and outputs. Fixed GraphQL fields in list (thirdParties) and update (thirdParty).
• Reports: new prb third-party report upload|list|delete. Upload supports --report-date, optional --report-name, --valid-until; list supports sorting and -o json; delete confirms or --yes.
• Date handling: added cmdutil.NormalizeDatetime to accept YYYY-MM-DD or RFC3339; used by report flags.
• Uploads: multipart now sets a real Content-Type from the file extension (applies to all CLI uploads, including evidence).
• Evidence upload: selects evidenceEdge { node { … } } to match schema.
• Minor docs/help fixes: corrected -o json examples; updated webhook help text.

Tests +68 -0

• Unit tests for NormalizeDatetime: date-only anchoring, RFC3339 passthrough, and invalid input cases.

Other +3 -3

• README: switched examples to prb third-party and added report upload usage.

^{Written for commit f110b9e. Summary will update on new commits.}

[cubic-dev-ai]

4 issues found across 24 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="pkg/cmd/third-party/report/list/list.go">

<violation number="1" location="pkg/cmd/third-party/report/list/list.go:104">
P2: The `--order-direction` flag accepts `ASC` or `DESC` but is not validated client-side. If a user passes an invalid value like `--order-direction INVALID`, the invalid string is sent directly to the GraphQL API, which would reject it with a generic server error. Consider adding a `cmdutil.ValidateEnum` call alongside the existing `flagOrderBy` validation to provide a clear, immediate error message.

```go
if flagOrderBy != "" {
    if err := cmdutil.ValidateEnum("order-by", flagOrderBy, []string{"REPORT_DATE", "CREATED_AT"}); err != nil {
        return err
    }

    if err := cmdutil.ValidateEnum("order-direction", flagOrderDir, []string{"ASC", "DESC"}); err != nil {
        return err
    }

    variables["orderBy"] = map[string]any{
        "field":     flagOrderBy,
        "direction": flagOrderDir,
    }
}
```</violation>

<violation number="2" location="pkg/cmd/third-party/report/list/list.go:115">
P3: `--limit=0` or a negative limit reports “No compliance reports found” without contacting the API, which can be mistaken for an empty third party. Validate the limit before pagination, as intended by `cmdutil.ValidateLimit`.</violation>
</file>

<file name="pkg/cmd/third-party/report/delete/delete.go">

<violation number="1" location="pkg/cmd/third-party/report/delete/delete.go:34">
P3: This adds another near-verbatim delete-command implementation, so confirmation or client-flow fixes will continue to require edits across every resource. A shared cmdutil delete-command helper with resource-specific mutation/input/output parameters would keep behavior consistent.</violation>
</file>

<file name="pkg/cmd/auth/login/login.go">

<violation number="1" location="pkg/cmd/auth/login/login.go:265">
P1: Token login can transmit a personal API key in cleartext when `--hostname http://…` is supplied. Reject non-HTTPS hosts before validating or persisting the token.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

P1: Token login can transmit a personal API key in cleartext when --hostname http://… is supplied. Reject non-HTTPS hosts before validating or persisting the token.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At pkg/cmd/auth/login/login.go, line 265:

<comment>Token login can transmit a personal API key in cleartext when `--hostname http://…` is supplied. Reject non-HTTPS hosts before validating or persisting the token.</comment>

<file context>
@@ -253,10 +238,92 @@ func NewCmdLogin(f *cmdutil.Factory) *cobra.Command {
+
+	_, _ = fmt.Fprintf(f.IOStreams.ErrOut, "Validating token on %s...\n", host)
+
+	orgs, err := fetchOrganizations(baseURL, token)
+	if err != nil {
+		return fmt.Errorf("cannot authenticate with token: %w", err)
</file context>

Suggested change

	orgs, err := fetchOrganizations(baseURL, token)
	if strings.HasPrefix(strings.ToLower(baseURL), "http://") {
	return fmt.Errorf("token login requires an HTTPS hostname")
	}
	orgs, err := fetchOrganizations(baseURL, token)

[cubic-dev-ai]

P2: The --order-direction flag accepts ASC or DESC but is not validated client-side. If a user passes an invalid value like --order-direction INVALID, the invalid string is sent directly to the GraphQL API, which would reject it with a generic server error. Consider adding a cmdutil.ValidateEnum call alongside the existing flagOrderBy validation to provide a clear, immediate error message.

if flagOrderBy != "" {
    if err := cmdutil.ValidateEnum("order-by", flagOrderBy, []string{"REPORT_DATE", "CREATED_AT"}); err != nil {
        return err
    }

    if err := cmdutil.ValidateEnum("order-direction", flagOrderDir, []string{"ASC", "DESC"}); err != nil {
        return err
    }

    variables["orderBy"] = map[string]any{
        "field":     flagOrderBy,
        "direction": flagOrderDir,
    }
}

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At pkg/cmd/third-party/report/list/list.go, line 104:

<comment>The `--order-direction` flag accepts `ASC` or `DESC` but is not validated client-side. If a user passes an invalid value like `--order-direction INVALID`, the invalid string is sent directly to the GraphQL API, which would reject it with a generic server error. Consider adding a `cmdutil.ValidateEnum` call alongside the existing `flagOrderBy` validation to provide a clear, immediate error message.

```go
if flagOrderBy != "" {
    if err := cmdutil.ValidateEnum("order-by", flagOrderBy, []string{"REPORT_DATE", "CREATED_AT"}); err != nil {
        return err
    }

    if err := cmdutil.ValidateEnum("order-direction", flagOrderDir, []string{"ASC", "DESC"}); err != nil {
        return err
    }

    variables["orderBy"] = map[string]any{
        "field":     flagOrderBy,
        "direction": flagOrderDir,
    }
}
```</comment>

<file context>
@@ -0,0 +1,185 @@
+				"id": args[0],
+			}
+
+			if flagOrderBy != "" {
+				if err := cmdutil.ValidateEnum("order-by", flagOrderBy, []string{"REPORT_DATE", "CREATED_AT"}); err != nil {
+					return err
</file context>

[cubic-dev-ai]

P3: This adds another near-verbatim delete-command implementation, so confirmation or client-flow fixes will continue to require edits across every resource. A shared cmdutil delete-command helper with resource-specific mutation/input/output parameters would keep behavior consistent.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At pkg/cmd/third-party/report/delete/delete.go, line 34:

<comment>This adds another near-verbatim delete-command implementation, so confirmation or client-flow fixes will continue to require edits across every resource. A shared cmdutil delete-command helper with resource-specific mutation/input/output parameters would keep behavior consistent.</comment>

<file context>
@@ -0,0 +1,105 @@
+}
+`
+
+func NewCmdDelete(f *cmdutil.Factory) *cobra.Command {
+	var flagYes bool
+
</file context>

[cubic-dev-ai]

P3: --limit=0 or a negative limit reports “No compliance reports found” without contacting the API, which can be mistaken for an empty third party. Validate the limit before pagination, as intended by cmdutil.ValidateLimit.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At pkg/cmd/third-party/report/list/list.go, line 115:

<comment>`--limit=0` or a negative limit reports “No compliance reports found” without contacting the API, which can be mistaken for an empty third party. Validate the limit before pagination, as intended by `cmdutil.ValidateLimit`.</comment>

<file context>
@@ -0,0 +1,185 @@
+				}
+			}
+
+			reports, _, err := api.Paginate(
+				client,
+				listQuery,
</file context>