Merge pull request #337 from appwrite/dev

feat: SDK update for version 22.6.0

Author: ChiragAgg5k

CHANGELOG.md

@@ -1,5 +1,11 @@
 # Change Log
 
+## 22.6.0
+
+* Added: `push functions` and `pull` now work with API key authentication, enabling CI usage without a console session
+* Updated: Console-only steps during push, like default domain rules, are skipped with a warning when using an API key
+* Updated: Clearer authentication errors that distinguish API key and console session requirements
+
 ## 22.5.0
 
 * Updated: `tablesdb create` now takes `--specification` instead of `--dedicated-database-id`

README.md

@@ -29,7 +29,7 @@ Once the installation is complete, you can verify the install using
 
 ```sh
 $ appwrite -v
-22.5.0
+22.6.0
 ```
 
 ### Install using prebuilt binaries
@@ -83,7 +83,7 @@ $ scoop install https://raw.githubusercontent.com/appwrite/sdk-for-cli/master/sc
 Once the installation completes, you can verify your install using
 ```
 $ appwrite -v
-22.5.0
+22.6.0
 ```
 
 ## Getting Started 

bun.lock

@@ -13,8 +13,8 @@
 # You can use "View source" of this page to see the full script.
 
 # REPO
-$GITHUB_x64_URL = "https://github.com/appwrite/sdk-for-cli/releases/download/22.5.0/appwrite-cli-win-x64.exe"
-$GITHUB_arm64_URL = "https://github.com/appwrite/sdk-for-cli/releases/download/22.5.0/appwrite-cli-win-arm64.exe"
+$GITHUB_x64_URL = "https://github.com/appwrite/sdk-for-cli/releases/download/22.6.0/appwrite-cli-win-x64.exe"
+$GITHUB_arm64_URL = "https://github.com/appwrite/sdk-for-cli/releases/download/22.6.0/appwrite-cli-win-arm64.exe"
 
 $APPWRITE_BINARY_NAME = "appwrite.exe"
 

install.ps1

@@ -120,7 +120,7 @@ verifyMacOSCodeSignature() {
 downloadBinary() {
     echo "[2/5] Downloading executable for $OS ($ARCH) ..."
 
-    GITHUB_LATEST_VERSION="22.5.0"
+    GITHUB_LATEST_VERSION="22.6.0"
     GITHUB_FILE="appwrite-cli-${OS}-${ARCH}"
     GITHUB_URL="https://github.com/$GITHUB_REPOSITORY_NAME/releases/download/$GITHUB_LATEST_VERSION/$GITHUB_FILE"
 

install.sh

@@ -0,0 +1,76 @@
+import { EXECUTABLE_NAME } from "../constants.js";
+import { globalConfig } from "../config.js";
+import { AppwriteException } from "@appwrite.io/console";
+import { hasAuthSession } from "./session.js";
+
+export type AuthMode = "session" | "apiKey" | "none";
+
+export const hasApiKey = (): boolean => globalConfig.getKey() !== "";
+
+export const getAuthMode = (): AuthMode => {
+  if (hasAuthSession()) {
+    return "session";
+  }
+
+  if (hasApiKey()) {
+    return "apiKey";
+  }
+
+  return "none";
+};
+
+export const canUseConsole = (): boolean => hasAuthSession();
+
+export const requireProjectAuth = (): void => {
+  if (getAuthMode() !== "none") {
+    return;
+  }
+
+  throw new Error(
+    `Authentication not found. Run \`${EXECUTABLE_NAME} login\` or \`${EXECUTABLE_NAME} client --key <API_KEY>\`.`,
+  );
+};
+
+export const requireConsoleAuth = (action: string): void => {
+  if (canUseConsole()) {
+    return;
+  }
+
+  if (hasApiKey()) {
+    throw new Error(
+      `${action} requires a console session. API keys work for project commands (e.g. \`${EXECUTABLE_NAME} push functions\`), not console-only commands. Run \`${EXECUTABLE_NAME} login\`.`,
+    );
+  }
+
+  throw new Error(
+    `${action} requires a console session. Run \`${EXECUTABLE_NAME} login\`.`,
+  );
+};
+
+/**
+ * True only for missing-scope / missing-session failures that optional
+ * console side-effects (e.g. default domain rules) should soft-fail on.
+ * Intentionally narrow: do not treat generic "unauthorized" text or all
+ * HTTP 403s as scope errors, so real authorization failures still surface.
+ */
+export const isAuthScopeError = (error: unknown): boolean => {
+  if (!(error instanceof Error)) {
+    return false;
+  }
+
+  const message = error.message.toLowerCase();
+  const isScopeMessage =
+    message.includes("missing scope") ||
+    message.includes("missing scopes") ||
+    message.includes("session not found") ||
+    message.includes("console session required");
+
+  if (error instanceof AppwriteException) {
+    return (
+      isScopeMessage ||
+      String(error.type ?? "").toLowerCase() === "general_unauthorized_scope"
+    );
+  }
+
+  return isScopeMessage;
+};

lib/auth/capabilities.ts

@@ -22,6 +22,11 @@ import { getFunctionsService, getSitesService } from "../services.js";
 import { sdkForProject, sdkForConsole } from "../sdks.js";
 import { localConfig } from "../config.js";
 import { applyConfigFilters } from "../config-filters.js";
+import {
+  canUseConsole,
+  requireConsoleAuth,
+  requireProjectAuth,
+} from "../auth/capabilities.js";
 import { paginate } from "../paginate.js";
 import {
   questionsPullFunctions,
@@ -100,14 +105,16 @@ export interface PullSettingsResult {
 async function createPullInstance(
   options: {
     silent?: boolean;
-    requiresConsoleAuth?: boolean;
     resource?: "functions" | "sites";
   } = {},
 ): Promise<Pull> {
-  const { silent = false, requiresConsoleAuth = false, resource } = options;
+  const { silent = false, resource } = options;
+  requireProjectAuth();
   const projectClient = await sdkForProject();
+  // Console credentials are attached when present. Console-required ops
+  // call requireConsoleAuth() themselves instead of gating the whole pull.
   const consoleClient = await sdkForConsole({
-    requiresAuth: requiresConsoleAuth,
+    requiresAuth: canUseConsole(),
   });
 
   const pullInstance = new Pull(projectClient, consoleClient, silent);
@@ -851,9 +858,8 @@ export const pullResources = async ({
 };
 
 const pullSettings = async (): Promise<void> => {
-  const pullInstance = await createPullInstance({
-    requiresConsoleAuth: true,
-  });
+  requireConsoleAuth("Pulling project settings");
+  const pullInstance = await createPullInstance();
   const project = localConfig.getProject();
   const projectId = project.projectId;
   const settings = await pullInstance.pullSettings(