feat(access): manage registry package access

[jdx]

Summary

• add aube access registry operations for package lists, collaborators, visibility, MFA, and team grants/revocations
• support scoped registry auth, OTP headers, JSON output, stable diagnostics, and pnpm's access ls packages [entity] form
• generate the CLI reference and error-code data

Tests

• cargo fmt --check
• cargo clippy --all-targets -- -D warnings
• cargo test
• mise run render

This pull request was generated by Codex.

---

Note

Medium Risk
Registry write operations change package visibility and team permissions using authenticated tokens; mistakes or bugs could affect live registry state, though behavior follows established npm access APIs and includes validation.

Overview
Adds aube access, an npm-style CLI for registry visibility, collaborators, and team permissions.

The registry client gains a new access module with HTTP calls to npm access endpoints (list packages for user/org/team, collaborators, get/set visibility and publish MFA, grant/revoke team access). Requests use scoped-registry auth, optional npm-otp, capped response bodies, and distinct AccessEntityNotFound vs package 404 errors.

The command layer wires subcommands (get status, list packages / collaborators, ls with pnpm packages [ENTITY] compatibility, set for status= / mfa=, grant, revoke), argument validation, human or --json output, and shared network flags. New diagnostics ERR_AUBE_ACCESS_ENTITY_NOT_FOUND and ERR_AUBE_ACCESS_INVALID_ARGUMENT are registered alongside generated usage/docs and error-code data.

^{Reviewed by Cursor Bugbot for commit 8313bd5. Bugbot is set up for automated code reviews on this repo. Configure here.}

Summary by CodeRabbit

• New Features

  • Added aube access for managing package visibility, MFA requirements, and team permissions.
  • Supports viewing package status, listing packages and collaborators, granting or revoking access, and updating settings.
  • Added JSON output, one-time password support, registry configuration, and retry options.

• Documentation

  • Added comprehensive command reference pages and examples for all access subcommands.
  • Added guidance for the new invalid-argument error.

[coderabbitai]

📝 Walkthrough

Walkthrough

Adds the aube access command for querying and modifying package visibility, MFA requirements, collaborators, and team permissions through new registry client APIs, validation, output formatting, error codes, command metadata, and generated documentation.

Changes

Package access management

Layer / File(s)	Summary
CLI contract and dispatch aube.usage.kdl, crates/aube/src/commands/access.rs, crates/aube/src/commands/mod.rs, crates/aube/src/lib.rs	Defines the access command hierarchy, flags, arguments, aliases, and top-level dispatch wiring.
Registry access API crates/aube-registry/src/client.rs, crates/aube-registry/src/client/access.rs	Adds registry operations for package listing, collaborators, status, MFA, team grants, and revocations, including authentication, OTP headers, encoding, response parsing, and error mapping.
Validation, execution, and output crates/aube/src/commands/access.rs, crates/aube-codes/src/errors.rs, docs/error-codes.data.json	Validates identifiers and settings, executes registry calls, maps errors, emits text or JSON, and tests parsing behavior.
Generated CLI documentation docs/cli/access/*, docs/cli/commands.json, docs/cli/index.md	Documents the access command, nested subcommands, arguments, flags, aliases, and navigation links.

Estimated code review effort: 4 (Complex) | ~60 minutes

Sequence Diagram(s)

sequenceDiagram
  participant User
  participant AccessCommand
  participant RegistryClient
  participant Registry
  User->>AccessCommand: run aube access subcommand
  AccessCommand->>AccessCommand: validate package, team, and settings
  AccessCommand->>RegistryClient: invoke access operation
  RegistryClient->>Registry: send authenticated request with optional OTP
  Registry-->>RegistryClient: return JSON or HTTP status
  RegistryClient-->>AccessCommand: return result or typed error
  AccessCommand-->>User: print text, JSON, or error

Loading

Suggested labels: keep-open

Poem

A rabbit hops through access doors,
Granting teams and guarding stores.
With OTP tucked in a carrot sack,
JSON and status reports come back.
Visibility blooms, permissions align—
A tidy registry, row by row, just fine!

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely summarizes the main change: adding registry package access management via aube access.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Greptile Summary

Adds aube access, a new top-level command for npm registry package access management: listing packages/collaborators, reading and setting visibility/MFA, and granting/revoking team permissions. The implementation follows existing codebase patterns — scoped registry routing, body-cap enforcement, OTP header forwarding, and typed error codes — with a complete usage spec, CLI reference docs, and unit tests.

• crates/aube-registry/src/client/access.rs: New registry client module with six public methods covering all access operations; correct object-keyed collaborator parsing, 404 disambiguation between package and entity, and format=cli query parameter on all list endpoints.
• crates/aube/src/commands/access.rs: CLI dispatcher with full argument validation, pnpm access ls packages [ENTITY] alias, and JSON output mode; all three valid status values are now present in validation error messages.
• crates/aube-codes/src/errors.rs: Two new stable error codes wired through the aube-registry error enum and access_registry_error mapper.

Confidence Score: 5/5

Safe to merge; the new command only performs authenticated registry reads and writes that already exist in equivalent npm/pnpm CLI flows, and all input is validated before hitting the wire.

The implementation is well-structured with no .unwrap()/.expect() in library code, correct scoped registry routing for list operations, proper body-cap enforcement, and good unit test coverage across auth, OTP headers, 404 disambiguation, and scoped registries. The two observations are non-blocking style/consistency points that do not affect correctness of the common cases.

crates/aube-codes/src/errors.rs — the exit code gap between ERR_AUBE_ACCESS_ENTITY_NOT_FOUND and ERR_AUBE_PACKAGE_NOT_FOUND is worth addressing before the codes become stable public API.

Important Files Changed

Filename	Overview
crates/aube-registry/src/client/access.rs	New registry client module implementing all access API calls; solid body-cap enforcement, OTP header forwarding, scoped-registry auth routing for org/team list. Team grant/revoke routes to the package's registry rather than the team's scope registry, which may produce confusing errors for cross-scope operations.
crates/aube/src/commands/access.rs	New CLI command; argument validation, pnpm ls packages alias, correct object-keyed collaborator parsing, and all three valid status values now present in error messages. Clean and consistent with codebase patterns.
crates/aube-codes/src/errors.rs	Adds ERR_AUBE_ACCESS_ENTITY_NOT_FOUND (registry/network) and ERR_AUBE_ACCESS_INVALID_ARGUMENT (engine/CLI); the entity-not-found code omits a bespoke exit code while its sibling ERR_AUBE_PACKAGE_NOT_FOUND has exit code 40, creating an inconsistency for scripts.
crates/aube-registry/src/lib.rs	Adds AccessEntityNotFound error variant with correct diagnostic code wiring.
aube.usage.kdl	Adds full access command tree to the usage spec; flags, subcommands, and argument definitions match the Rust implementation.
crates/aube/src/lib.rs	Wires the new Access variant and dispatch into the top-level Commands enum.

_{Reviews (4): Last reviewed commit: "Merge branch 'main' into codex/access-co..." | Re-trigger Greptile}

[coderabbitai]

Actionable comments posted: 5

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@crates/aube-registry/src/client/access.rs`:
- Around line 210-214: Update access_list_packages and access_request so the
package-listing path passes a distinct entity label instead of None; use the
requested user, organization, or team name when constructing Error::NotFound,
while preserving the existing package-name behavior for package access requests.

In `@crates/aube/src/commands/access.rs`:
- Around line 267-281: Require the scope parsed by split_team to begin with
exactly the expected @ prefix; reject inputs where scope is empty or does not
start with @, while preserving the existing team and extra-colon validation and
error message.

In `@docs/cli/access/grant.md`:
- Line 4: The usage declaration for the access grant command currently uses a
generic `<ARGS>…` placeholder; update the command’s usage source to explicitly
show the required positional arguments in order: `<PERMISSIONS> <TEAM>
<PACKAGE>`, then regenerate the corresponding documentation page.

In `@docs/cli/access/ls.md`:
- Around line 4-12: Update the `AccessCommand::Ls` usage documentation to show
its bounded forms explicitly: replace the variadic `[ENTITIES]…` syntax with
examples for `aube access ls [ENTITY]` and the compatibility form `aube access
ls packages [ENTITY]`, and clarify that at most two values are accepted.

In `@docs/cli/commands.json`:
- Around line 85-129: Update the access grant command’s full_cmd/usage
documentation to explicitly show the required positional arguments: use “access
grant <PERMISSIONS> <TEAM> <PACKAGE>” instead of the generic “access grant
<ARGS>…”, while preserving the existing argument definitions.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 242abce6-d143-4853-a375-6e63a3ae7987

📥 Commits

Reviewing files that changed from the base of the PR and between 10c4081 and ecb0078.

📒 Files selected for processing (20)

• aube.usage.kdl
• crates/aube-codes/src/errors.rs
• crates/aube-registry/src/client.rs
• crates/aube-registry/src/client/access.rs
• crates/aube/src/commands/access.rs
• crates/aube/src/commands/mod.rs
• crates/aube/src/lib.rs
• docs/cli/access.md
• docs/cli/access/get.md
• docs/cli/access/get/status.md
• docs/cli/access/grant.md
• docs/cli/access/list.md
• docs/cli/access/list/collaborators.md
• docs/cli/access/list/packages.md
• docs/cli/access/ls.md
• docs/cli/access/revoke.md
• docs/cli/access/set.md
• docs/cli/commands.json
• docs/cli/index.md
• docs/error-codes.data.json

[jdx]

Addressed the access command feedback in 54e65ba: scoped organization/team lists now use scope registry/auth settings, list 404s name the requested entity, team validation is strict, and the CLI help spells out the exact grant and ls forms.

The checked-in CLI reference is generated by usage-lib, which intentionally collapses three-or-more positional arguments into <ARGS>...; its generated argument section still lists the ordered PERMISSIONS, TEAM, and PACKAGE fields. The runtime help uses the explicit forms, and the generated ls argument documentation now lists both accepted invocations.

This comment was generated by Codex.

[jdx]

The MFA mapping is intentional pnpm v11.11.0 parity: its access set mfa implementation computes publishRequiresTfa = mfaValue !== 'none' and sends that boolean as publish_requires_tfa. automation is preserved in aube's user-facing output, while the registry API itself accepts the same boolean policy value for both publish and automation.

This comment was generated by Codex.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit b4ce1b2. Configure here.}