snapshot of https://github.com/cortezaproject/corteza.git (2024.9.x, 2026-09-18; blobs > 131072B omitted)

server/system/commands/commands.go

@@ -0,0 +1,27 @@
+package commands
+
+import (
+	"context"
+
+	"github.com/cortezaproject/corteza/server/pkg/cli"
+	"github.com/spf13/cobra"
+)
+
+type (
+	serviceInitializer interface {
+		InitServices(ctx context.Context) error
+		Activate(ctx context.Context) error
+	}
+)
+
+func commandPreRunInitService(app serviceInitializer) func(*cobra.Command, []string) error {
+	return func(_ *cobra.Command, _ []string) error {
+		return app.InitServices(cli.Context())
+	}
+}
+
+func commandPreRunInitActivate(app serviceInitializer) func(*cobra.Command, []string) error {
+	return func(_ *cobra.Command, _ []string) error {
+		return app.Activate(cli.Context())
+	}
+}

server/system/commands/exporter.go

@@ -0,0 +1,237 @@
+package commands
+
+import (
+	"context"
+
+	"github.com/cortezaproject/corteza/server/compose/types"
+	"github.com/cortezaproject/corteza/server/pkg/auth"
+	"github.com/cortezaproject/corteza/server/pkg/dal"
+	"github.com/cortezaproject/corteza/server/pkg/envoyx"
+	"github.com/cortezaproject/corteza/server/pkg/rbac"
+	systemTypes "github.com/cortezaproject/corteza/server/system/types"
+	"github.com/spf13/cobra"
+
+	"github.com/cortezaproject/corteza/server/pkg/cli"
+	"github.com/cortezaproject/corteza/server/store"
+)
+
+type (
+	storeInitFnc func(ctx context.Context) (store.Storer, error)
+	dalInitFnc   func(ctx context.Context) (dal.FullService, error)
+	envoyInitFnc func(ctx context.Context) (*envoyx.Service, error)
+)
+
+var (
+	omitModules bool
+	omitPages   bool
+	omitCharts  bool
+
+	inclLocale bool
+	inclRbac   bool
+)
+
+func Export(ctx context.Context, storeInit storeInitFnc, dalInit dalInitFnc, envoyInit envoyInitFnc) *cobra.Command {
+
+	cmd := &cobra.Command{
+		Use:   "export",
+		Short: "Export",
+		Long:  `Export data`,
+	}
+
+	exportNsCommand := &cobra.Command{
+		Use:   "compose-namespace",
+		Short: "Export compose namespace",
+		Args:  cobra.MinimumNArgs(1),
+
+		Run: func(cmd *cobra.Command, args []string) {
+			ctx = auth.SetIdentityToContext(ctx, auth.ServiceUser())
+
+			// Init all of the sub services
+			s, err := storeInit(ctx)
+			cli.HandleError(err)
+
+			dalSvc, err := dalInit(ctx)
+			cli.HandleError(err)
+
+			envoySvc, err := envoyInit(ctx)
+			cli.HandleError(err)
+
+			scp := envoyx.Scope{
+				ResourceType: types.NamespaceResourceType,
+				Identifiers:  envoyx.MakeIdentifiers(args[0]),
+			}
+
+			f := map[string]envoyx.ResourceFilter{
+				types.NamespaceResourceType: {
+					Identifiers: envoyx.MakeIdentifiers(args[0]),
+					Scope:       scp,
+				},
+			}
+
+			if !omitModules {
+				f[types.ModuleResourceType] = envoyx.ResourceFilter{
+					Scope: scp,
+					Refs: map[string]envoyx.Ref{
+						"NamespaceID": {
+							ResourceType: types.NamespaceResourceType,
+							Identifiers:  envoyx.MakeIdentifiers(args[0]),
+							Scope:        scp,
+						},
+					},
+				}
+			}
+
+			if !omitPages {
+				f[types.PageResourceType] = envoyx.ResourceFilter{
+					Scope: scp,
+					Refs: map[string]envoyx.Ref{
+						"NamespaceID": {
+							ResourceType: types.NamespaceResourceType,
+							Identifiers:  envoyx.MakeIdentifiers(args[0]),
+							Scope:        scp,
+						},
+					},
+				}
+			}
+
+			if !omitCharts {
+				f[types.ChartResourceType] = envoyx.ResourceFilter{
+					Scope: scp,
+					Refs: map[string]envoyx.Ref{
+						"NamespaceID": {
+							ResourceType: types.NamespaceResourceType,
+							Identifiers:  envoyx.MakeIdentifiers(args[0]),
+							Scope:        scp,
+						},
+					},
+				}
+			}
+
+			nodes, _, err := envoySvc.Decode(ctx, envoyx.DecodeParams{
+				Type: envoyx.DecodeTypeStore,
+				Params: map[string]any{
+					"storer": s,
+					"dal":    dalSvc,
+				},
+				Filter: f,
+			})
+			cli.HandleError(err)
+
+			if inclRbac {
+				var aux envoyx.NodeSet
+				aux, err = encodeRbacRules(ctx, s, nodes)
+				cli.HandleError(err)
+
+				nodes = append(nodes, aux...)
+			}
+
+			if inclLocale {
+				var aux envoyx.NodeSet
+				aux, err = encodeLocale(ctx, s, nodes)
+				cli.HandleError(err)
+				nodes = append(nodes, aux...)
+			}
+
+			rf := map[string]envoyx.ResourceFilter{
+				systemTypes.RoleResourceType: {},
+			}
+			refNodes, _, err := envoySvc.Decode(ctx, envoyx.DecodeParams{
+				Type: envoyx.DecodeTypeStore,
+				Params: map[string]any{
+					"storer": s,
+					"dal":    dalSvc,
+				},
+				Filter: rf,
+			})
+			cli.HandleError(err)
+			for _, n := range refNodes {
+				n.Placeholder = true
+			}
+
+			nodes = append(nodes, refNodes...)
+
+			gg, err := envoySvc.Bake(ctx, envoyx.EncodeParams{
+				Type: envoyx.EncodeTypeStore,
+				Params: map[string]any{
+					"storer": s,
+					"dal":    dalSvc,
+				},
+			}, nil, nodes...)
+			cli.HandleError(err)
+
+			err = envoySvc.Encode(ctx, envoyx.EncodeParams{
+				Type: envoyx.EncodeTypeIo,
+				Params: map[string]any{
+					"writer": cmd.OutOrStdout(),
+				},
+			}, gg)
+			cli.HandleError(err)
+		},
+	}
+
+	exportNsCommand.Flags().BoolVar(
+		&omitModules,
+		"omit-modules",
+		false,
+		"Omit modules from output",
+	)
+	exportNsCommand.Flags().BoolVar(
+		&omitPages,
+		"omit-pages",
+		false,
+		"Omit pages from output",
+	)
+	exportNsCommand.Flags().BoolVar(
+		&omitCharts,
+		"omit-charts",
+		false,
+		"Omit charts from output",
+	)
+
+	exportNsCommand.Flags().BoolVar(
+		&inclLocale,
+		"include-locale",
+		false,
+		"Include resource translations",
+	)
+	exportNsCommand.Flags().BoolVar(
+		&inclRbac,
+		"include-rbac",
+		false,
+		"Include RBAC rules",
+	)
+
+	cmd.AddCommand(
+		exportNsCommand,
+	)
+
+	return cmd
+}
+
+func encodeRbacRules(ctx context.Context, s store.Storer, nn envoyx.NodeSet) (rules envoyx.NodeSet, err error) {
+	rr, _, err := store.SearchRbacRules(ctx, s, rbac.RuleFilter{})
+	if err != nil {
+		return
+	}
+
+	rules, err = envoyx.RBACRulesForNodes(rr, nn...)
+	if err != nil {
+		return
+	}
+
+	return
+}
+
+func encodeLocale(ctx context.Context, s store.Storer, nn envoyx.NodeSet) (translations envoyx.NodeSet, err error) {
+	tt, _, err := store.SearchResourceTranslations(ctx, s, systemTypes.ResourceTranslationFilter{})
+	if err != nil {
+		return
+	}
+
+	translations, err = envoyx.ResourceTranslationsForNodes(tt, nn...)
+	if err != nil {
+		return
+	}
+
+	return
+}

server/system/commands/importer.go

@@ -0,0 +1,133 @@
+package commands
+
+import (
+	"context"
+	"errors"
+	"os"
+
+	"github.com/spf13/cobra"
+
+	"github.com/cortezaproject/corteza/server/pkg/cli"
+	"github.com/cortezaproject/corteza/server/pkg/envoyx"
+)
+
+func Import(ctx context.Context, storeInit storeInitFnc, dalInit dalInitFnc, envoyInit envoyInitFnc) *cobra.Command {
+	var (
+		replaceOnConflict bool
+		skipOnConflict    bool
+		panicOnConflict   bool
+	)
+
+	cmd := &cobra.Command{
+		Use:   "import",
+		Short: "Import data from yaml sources.",
+
+		Run: func(cmd *cobra.Command, args []string) {
+			// Init all of the sub services
+			s, err := storeInit(ctx)
+			cli.HandleError(err)
+
+			dalSvc, err := dalInit(ctx)
+			cli.HandleError(err)
+
+			envoySvc, err := envoyInit(ctx)
+			cli.HandleError(err)
+
+			var (
+				nodes     envoyx.NodeSet
+				providers []envoyx.Provider
+
+				auxNodes     envoyx.NodeSet
+				auxProviders []envoyx.Provider
+			)
+
+			if len(args) > 0 {
+				for _, a := range args {
+					auxNodes, auxProviders, err = envoySvc.Decode(ctx, envoyx.DecodeParams{
+						Type: envoyx.DecodeTypeURI,
+						Params: map[string]any{
+							"uri": "file://" + a,
+						},
+					})
+					cli.HandleError(err)
+
+					nodes = append(nodes, auxNodes...)
+					providers = append(providers, auxProviders...)
+				}
+			} else {
+				auxNodes, auxProviders, err = envoySvc.Decode(ctx, envoyx.DecodeParams{
+					Type: envoyx.DecodeTypeIO,
+					Params: map[string]any{
+						"reader": os.Stdin,
+						"mime":   "text/yaml",
+					},
+				})
+				cli.HandleError(err)
+
+				// @todo consider changing this up
+				if len(auxProviders) > 0 {
+					cli.HandleError(errors.New("cannot define providers when importing from stdin"))
+				}
+
+				nodes = append(nodes, auxNodes...)
+				// providers = append(providers, auxProviders...)
+			}
+
+			ep := envoyx.EncodeParams{
+				Type: envoyx.EncodeTypeStore,
+				Params: map[string]any{
+					"storer": s,
+					"dal":    dalSvc,
+				},
+			}
+
+			if replaceOnConflict {
+				ep.Envoy.MergeAlg = envoyx.OnConflictReplace
+			}
+			if skipOnConflict {
+				ep.Envoy.MergeAlg = envoyx.OnConflictSkip
+			}
+			if panicOnConflict {
+				ep.Envoy.MergeAlg = envoyx.OnConflictPanic
+			}
+
+			gg, err := envoySvc.Bake(ctx, ep,
+				providers,
+				nodes...,
+			)
+			cli.HandleError(err)
+
+			err = envoySvc.Encode(ctx, envoyx.EncodeParams{
+				Type: envoyx.EncodeTypeStore,
+				Params: map[string]any{
+					"storer": s,
+					"dal":    dalSvc,
+				},
+			}, gg)
+			cli.HandleError(err)
+		},
+	}
+
+	cmd.Flags().BoolVar(
+		&replaceOnConflict,
+		"replace-existing",
+		false,
+		"replace on conflict existing resources. Default skips",
+	)
+
+	cmd.Flags().BoolVar(
+		&skipOnConflict,
+		"skip-existing",
+		false,
+		"skip on conflict existing resources. Default skips",
+	)
+
+	cmd.Flags().BoolVar(
+		&panicOnConflict,
+		"panic-existing",
+		false,
+		"panic on conflict existing resources. Default skips",
+	)
+
+	return cmd
+}

server/system/commands/rbac.go

@@ -0,0 +1,246 @@
+package commands
+
+import (
+	"context"
+	"sort"
+	"strconv"
+	"strings"
+
+	"github.com/cortezaproject/corteza/server/pkg/cli"
+	"github.com/cortezaproject/corteza/server/pkg/rbac"
+	"github.com/cortezaproject/corteza/server/pkg/slice"
+	"github.com/cortezaproject/corteza/server/store"
+	"github.com/cortezaproject/corteza/server/system/types"
+	"github.com/spf13/cobra"
+)
+
+func RBAC(ctx context.Context, storeInit func(ctx context.Context) (store.Storer, error)) *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "rbac",
+		Short: "RBAC tools",
+		Long:  "Check and manipulates permissions",
+	}
+
+	cmd.AddCommand(rbacList(ctx, storeInit))
+
+	// @todo command that can grant/revoke/reset-all permissions
+	//       in a similar format(s) as we do listing so that users can
+	//       copy-paste the whole output, modify it and import it back
+
+	return cmd
+}
+
+func rbacList(ctx context.Context, storeInit func(ctx context.Context) (store.Storer, error)) (cmd *cobra.Command) {
+	var (
+		resources   []string
+		roles       []string
+		operations  []string
+		groupBy     string
+		allow, deny bool
+
+		matchResources = func(r *rbac.Rule) bool {
+			if len(resources) == 0 {
+				return true
+			}
+
+			for _, res := range resources {
+				if strings.HasPrefix(r.Resource, res) {
+					return true
+				}
+			}
+
+			return false
+		}
+
+		// makes a simple utiliy function for matching rules according to the used flags
+		ruleMatcher = func(s store.Storer) (map[uint64]*types.Role, func(r *rbac.Rule) bool) {
+			var (
+				opsMap    = slice.ToStringBoolMap(operations)
+				rr        []*types.Role
+				rolAuxMap = slice.ToStringBoolMap(roles)
+				rolMap    = make(map[uint64]*types.Role)
+				rolMatch  = make(map[uint64]bool)
+				err       error
+			)
+
+			rr, _, err = store.SearchRoles(ctx, s, types.RoleFilter{})
+			for _, r := range rr {
+				rolMap[r.ID] = r
+				if rolAuxMap[r.Name] || rolAuxMap[r.Handle] || rolAuxMap[strconv.FormatUint(r.ID, 10)] {
+					rolMatch[r.ID] = true
+				}
+			}
+
+			cli.HandleError(err)
+
+			return rolMap, func(r *rbac.Rule) bool {
+				if !matchResources(r) {
+					return false
+				}
+				if len(opsMap) > 0 && !opsMap[r.Operation] {
+					return false
+				}
+
+				// this use of rolAuxMap to check if there are roles specified in the flags
+				// and rolMap for checking if for actual role map is intentional!
+				if len(rolAuxMap) > 0 && !rolMatch[r.RoleID] {
+					return false
+				}
+
+				if allow && r.Access != rbac.Allow {
+					return false
+				}
+
+				if deny && r.Access != rbac.Deny {
+					return false
+				}
+
+				return true
+			}
+		}
+
+		ruleSorter = func(rr []*rbac.Rule) {
+			sort.SliceStable(rr, func(i, j int) bool {
+				switch groupBy {
+				case "role", "rMap":
+					return rr[i].RoleID < rr[j].RoleID
+				case "res", "resource", "resources":
+					return strings.Compare(rr[i].Resource, rr[i].Resource) < 0
+				case "op", "ops", "operation", "operations":
+					return strings.Compare(rr[i].Operation, rr[j].Operation) < 0
+				}
+
+				return rr[i].Access < rr[j].Access
+			})
+		}
+
+		roleDisplayName = func(rMap map[uint64]*types.Role, r *rbac.Rule) (role string) {
+			if rMap[r.RoleID] != nil {
+				role = rMap[r.RoleID].Name
+				if role == "" {
+					role = rMap[r.RoleID].Handle
+				}
+			}
+
+			if role == "" {
+				return strconv.FormatUint(r.RoleID, 10)
+			}
+
+			return
+		}
+
+		lengths = func(rr []*rbac.Rule, rMap map[uint64]*types.Role) (op, res, role int) {
+			for _, r := range rr {
+				if len(r.Operation) > op {
+					op = len(r.Operation)
+				}
+				if len(r.Resource) > res {
+					res = len(r.Resource)
+				}
+			}
+			for _, r := range rMap {
+				if len(r.Name) > role {
+					role = len(r.Name)
+				}
+				if len(r.Handle) > role {
+					role = len(r.Handle)
+				}
+			}
+
+			return
+		}
+	)
+
+	cmd = &cobra.Command{
+		Use:   "list",
+		Short: "Check applied permissions against given file (only supports compose permissions for now)",
+		Run: func(cmd *cobra.Command, args []string) {
+			var (
+				rr      []*rbac.Rule
+				s, err  = storeInit(ctx)
+				role    string
+				gBucket string
+			)
+
+			cli.HandleError(err)
+
+			rr, _, err = store.SearchRbacRules(cli.Context(), s, rbac.RuleFilter{})
+			cli.HandleError(err)
+
+			ruleSorter(rr)
+			rMap, matchRule := ruleMatcher(s)
+
+			longestOp, longestRes, longestRole := lengths(rr, rMap)
+
+			hr := strings.Repeat("-", longestOp+longestRes+longestRole+20)
+
+			for i, r := range rr {
+				if !matchRule(r) {
+					continue
+				}
+
+				r.Operation = r.Operation + strings.Repeat(" ", longestOp-len(r.Operation))
+				r.Resource = r.Resource + strings.Repeat(" ", longestRes-len(r.Resource))
+
+				role = roleDisplayName(rMap, r)
+				role = role + strings.Repeat(" ", longestRole-len(role))
+
+				bOp := strings.Repeat(" ", longestOp)
+				bRes := strings.Repeat(" ", longestRes)
+				bRole := strings.Repeat(" ", longestRole)
+
+				switch groupBy {
+				case "role", "roles":
+					if gBucket != role {
+						if i != 0 {
+							cmd.Println(hr)
+						}
+						cmd.Printf("%s %7s %s on %s\n", role, r.Access, r.Operation, r.Resource)
+					} else {
+						cmd.Printf("%s %7s %s on %s\n", bRole, r.Access, r.Operation, r.Resource)
+					}
+
+					gBucket = role
+
+				case "res", "resource", "resources":
+					if gBucket != r.Resource {
+						if i != 0 {
+							cmd.Println(hr)
+						}
+
+						cmd.Printf("on %s %7s %s to %s\n", r.Resource, r.Access, role, r.Operation)
+					} else {
+						cmd.Printf("   %s %7s %s to %s\n", bRes, r.Access, role, r.Operation)
+					}
+
+					gBucket = r.Resource
+
+				case "op", "ops", "operation", "operations":
+					if gBucket != r.Operation {
+						if i != 0 {
+							cmd.Println(hr)
+						}
+
+						cmd.Printf("%s %7s %s to %s\n", r.Operation, r.Access, role, r.Resource)
+					} else {
+						cmd.Printf("%s %7s %s to %s\n", bOp, r.Access, role, r.Resource)
+					}
+
+					gBucket = r.Operation
+				default:
+					cmd.Printf("%7s %s to %s on %s\n", r.Access, role, r.Operation, r.Resource)
+				}
+			}
+
+		},
+	}
+
+	cmd.Flags().StringArrayVarP(&resources, "resource", "r", nil, "Filter by resource (by prefix)")
+	cmd.Flags().StringArrayVarP(&roles, "role", "", nil, "Filter by role (handle or ID)")
+	cmd.Flags().StringArrayVarP(&operations, "operation", "o", nil, "Filter by operation")
+	cmd.Flags().BoolVarP(&deny, "deny", "d", false, "Show only deny")
+	cmd.Flags().BoolVarP(&allow, "allow", "a", false, "Show only allows")
+	cmd.Flags().StringVarP(&groupBy, "group", "g", "", "Group rules on output")
+
+	return
+}

server/system/commands/roles.go

@@ -0,0 +1,84 @@
+package commands
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/cortezaproject/corteza/server/pkg/auth"
+	"github.com/cortezaproject/corteza/server/pkg/cli"
+	"github.com/cortezaproject/corteza/server/store"
+	"github.com/cortezaproject/corteza/server/system/service"
+	"github.com/cortezaproject/corteza/server/system/types"
+	"github.com/spf13/cobra"
+)
+
+func Roles(ctx context.Context, app serviceInitializer) *cobra.Command {
+	cmd := &cobra.Command{
+		Use:     "roles",
+		Aliases: []string{"role"},
+		Short:   "Role management",
+	}
+
+	cmd.AddCommand(rolesAddUser(ctx, app))
+	cmd.AddCommand(rolesList(ctx, app))
+
+	return cmd
+}
+
+func rolesAddUser(ctx context.Context, app serviceInitializer) *cobra.Command {
+	return &cobra.Command{
+		Use:     "useradd [role-ID-or-name-or-handle] [user-ID-or-email]",
+		Aliases: []string{"assign", "add-user", "adduser", "user-add", "user"},
+		Short:   "Add user to role",
+		Args:    cobra.ExactArgs(2),
+		PreRunE: commandPreRunInitService(app),
+		Run: func(cmd *cobra.Command, args []string) {
+			ctx = auth.SetIdentityToContext(ctx, auth.ServiceUser())
+
+			var (
+				roleStr, userStr = args[0], args[1]
+
+				role *types.Role
+				user *types.User
+
+				err error
+			)
+
+			role, err = service.DefaultRole.FindByAny(ctx, roleStr)
+			cli.HandleError(err)
+
+			user, err = service.DefaultUser.FindByAny(ctx, userStr)
+			cli.HandleError(err)
+
+			cli.HandleError(store.CreateRoleMember(ctx, service.DefaultStore, &types.RoleMember{
+				RoleID:   role.ID,
+				Resource: fmt.Sprintf("corteza::system:user/%d", user.ID),
+			}))
+
+			cmd.Printf("Added user [%d] %q to [%d] %q role\n", user.ID, user.Email, role.ID, role.Name)
+		},
+	}
+}
+
+func rolesList(ctx context.Context, app serviceInitializer) *cobra.Command {
+	return &cobra.Command{
+		Use:     "list",
+		Short:   "List all roles",
+		PreRunE: commandPreRunInitService(app),
+		Run: func(cmd *cobra.Command, args []string) {
+			ctx = auth.SetIdentityToContext(ctx, auth.ServiceUser())
+
+			f := types.RoleFilter{Query: ""}
+			if len(args) > 0 {
+				f.Query = args[0]
+			}
+
+			rr, _, err := store.SearchRoles(ctx, service.DefaultStore, f)
+			cli.HandleError(err)
+
+			for _, r := range rr {
+				cmd.Printf("%-20d %-30s %s\n", r.ID, r.Handle, r.Name)
+			}
+		},
+	}
+}

server/system/commands/settings.go

@@ -0,0 +1,228 @@
+package commands
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"os"
+	"strings"
+
+	"github.com/cortezaproject/corteza/server/pkg/auth"
+	"github.com/cortezaproject/corteza/server/system/types"
+
+	"github.com/spf13/cobra"
+
+	"github.com/cortezaproject/corteza/server/pkg/cli"
+	"github.com/cortezaproject/corteza/server/system/service"
+)
+
+func Settings(ctx context.Context, app serviceInitializer) *cobra.Command {
+	var (
+		cmd = &cobra.Command{
+			Use:   "settings",
+			Short: "Settings management",
+		}
+
+		restartWarning = func(cmd *cobra.Command, args []string) {
+			fmt.Print("\nYour server needs to be restarted in order to apply changes\n")
+		}
+	)
+
+	list := &cobra.Command{
+		Use:     "list",
+		Short:   "List all",
+		PreRunE: commandPreRunInitService(app),
+		Run: func(cmd *cobra.Command, args []string) {
+			ctx = auth.SetIdentityToContext(ctx, auth.ServiceUser())
+
+			prefix := cmd.Flags().Lookup("prefix").Value.String()
+			if kv, err := service.DefaultSettings.FindByPrefix(ctx, prefix); err != nil {
+				cli.HandleError(err)
+			} else {
+				var maxlen int
+				for _, v := range kv {
+					if l := len(v.Name); l > maxlen {
+						maxlen = l
+					}
+				}
+
+				for _, v := range kv {
+					cmd.Printf("%s%s\t%v\n", v.Name, strings.Repeat(" ", maxlen-len(v.Name)), v.Value)
+				}
+			}
+		},
+	}
+
+	list.Flags().String("prefix", "", "SettingsFilter settings by prefix")
+
+	get := &cobra.Command{
+		Use: "get [key to get, ...]",
+
+		Short:   "Get value (raw JSON) for a specific key",
+		Args:    cobra.ExactArgs(1),
+		PreRunE: commandPreRunInitService(app),
+		Run: func(cmd *cobra.Command, args []string) {
+			ctx = auth.SetIdentityToContext(ctx, auth.ServiceUser())
+
+			if v, err := service.DefaultSettings.Get(ctx, args[0], 0); err != nil {
+				cli.HandleError(err)
+			} else if v != nil {
+				cmd.Printf("%v\n", v.Value)
+			}
+		},
+	}
+
+	set := &cobra.Command{
+		Use:     "set [key to set] [value]",
+		Short:   "Set value (raw JSON or string) for a specific key",
+		Args:    cobra.ExactArgs(2),
+		PreRunE: commandPreRunInitService(app),
+		Run: func(cmd *cobra.Command, args []string) {
+			ctx = auth.SetIdentityToContext(ctx, auth.ServiceUser())
+
+			value := args[1]
+
+			v := &types.SettingValue{
+				Name: args[0],
+			}
+
+			if cmd.Flags().Lookup("as-string").Changed {
+				cli.HandleError(v.SetSetting(value))
+			} else {
+				err := v.SetRawSetting(value)
+				if _, is := err.(*json.SyntaxError); is {
+					// Quote the raw value and re-parse
+					err = v.SetRawSetting(`"` + value + `"`)
+				}
+
+				cli.HandleError(err)
+			}
+
+			cli.HandleError(service.DefaultSettings.Set(ctx, v))
+		},
+		PostRun: restartWarning,
+	}
+
+	set.Flags().BoolP("as-string", "s", false, "Treat input value as string (to avoid wrapping in quotes)")
+
+	imp := &cobra.Command{
+		Use:     "import [file]",
+		Short:   "Import settings as JSON from stdin or file",
+		Args:    cobra.MaximumNArgs(1),
+		PreRunE: commandPreRunInitService(app),
+		Run: func(cmd *cobra.Command, args []string) {
+			ctx = auth.SetIdentityToContext(ctx, auth.ServiceUser())
+
+			var (
+				fh  *os.File
+				err error
+			)
+
+			if len(args) > 0 {
+				fh, err = os.Open(args[0])
+				cli.HandleError(err)
+			} else {
+				fh = os.Stdin
+			}
+
+			var (
+				decoder = json.NewDecoder(fh)
+				input   = map[string]interface{}{}
+				vv      types.SettingValueSet
+			)
+
+			cli.HandleError(decoder.Decode(&input))
+
+			for k, v := range input {
+				val := &types.SettingValue{Name: k}
+
+				cli.HandleError(val.SetSetting(v))
+				vv = append(vv, val)
+			}
+
+			if len(vv) > 0 {
+				cli.HandleError(service.DefaultSettings.BulkSet(ctx, vv))
+			}
+		},
+		PostRun: restartWarning,
+	}
+
+	exp := &cobra.Command{
+		Use:     "export [file]",
+		Short:   "Export settings as JSON to stdout or file",
+		Args:    cobra.MaximumNArgs(1),
+		PreRunE: commandPreRunInitService(app),
+		Run: func(cmd *cobra.Command, args []string) {
+			ctx = auth.SetIdentityToContext(ctx, auth.ServiceUser())
+
+			var (
+				fh  *os.File
+				err error
+			)
+
+			if len(args) > 0 {
+				fh, err = os.Create(args[0])
+				cli.HandleError(err)
+			} else {
+				fh = os.Stdin
+			}
+
+			var (
+				encoder = json.NewEncoder(fh)
+			)
+
+			encoder.SetIndent("", "  ")
+
+			if vv, err := service.DefaultSettings.FindByPrefix(ctx); err != nil {
+				cli.HandleError(err)
+			} else {
+				cli.HandleError(encoder.Encode(vv.KV()))
+			}
+		},
+	}
+
+	del := &cobra.Command{
+		Use:     "delete [keys, ...]",
+		Short:   "Set value (raw JSON) for a specific key (or by prefix)",
+		Args:    cobra.MinimumNArgs(0),
+		PreRunE: commandPreRunInitService(app),
+		Run: func(cmd *cobra.Command, args []string) {
+			ctx = auth.SetIdentityToContext(ctx, auth.ServiceUser())
+
+			var (
+				names = []string{}
+			)
+
+			if prefix := cmd.Flags().Lookup("prefix").Value.String(); len(prefix) > 0 {
+				if vv, err := service.DefaultSettings.FindByPrefix(ctx); err != nil {
+					cli.HandleError(err)
+				} else {
+					_ = vv.Walk(func(v *types.SettingValue) error {
+						names = append(names, v.Name)
+						return nil
+					})
+				}
+			} else if len(args) > 0 {
+				names = args
+			}
+
+			for a := 0; a < len(names); a++ {
+				cli.HandleError(service.DefaultSettings.Delete(ctx, names[a], 0))
+			}
+		},
+		PostRun: restartWarning,
+	}
+
+	del.Flags().String("prefix", "", "SettingsFilter settings by prefix")
+
+	cmd.AddCommand(
+		list,
+		get,
+		set,
+		del,
+		imp,
+		exp,
+	)
+
+	return cmd
+}

server/system/commands/sink.go

@@ -0,0 +1,125 @@
+package commands
+
+import (
+	"context"
+	"time"
+
+	"github.com/cortezaproject/corteza/server/system/service"
+	"github.com/spf13/cobra"
+)
+
+// Will perform OpenID connect auto-configuration
+func Sink(ctx context.Context, app serviceInitializer) *cobra.Command {
+	var (
+		expires string
+		srup    = service.SinkRequestUrlParams{}
+	)
+
+	cmd := &cobra.Command{
+		Use:   "sink",
+		Short: "Sink",
+	}
+
+	signatureCmd := &cobra.Command{
+		Use:     "signature",
+		Short:   "Creates signature for sink HTTP endpoint",
+		PreRunE: commandPreRunInitService(app),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			if expires != "" {
+				// validate expiration date if set
+				if exp, err := time.Parse("2006-01-02", expires); err != nil {
+					return err
+				} else {
+					srup.Expires = &exp
+				}
+			}
+
+			if su, srup, err := service.DefaultSink.SignURL(srup); err != nil {
+				return err
+			} else {
+				cmd.Println(su)
+
+				cmd.Println("Sink request constraints:")
+				if srup.SignatureInPath {
+					cmd.Println(" - signature should be part of path")
+				} else {
+					cmd.Println(" - signature should be part of query-string")
+				}
+
+				if srup.Method != "" {
+					cmd.Printf(" - expecting request method %q\n", srup.Method)
+
+				}
+				if srup.Expires != nil {
+					cmd.Printf(" - signature expires at: %s\n", srup.Expires)
+
+				}
+				if srup.MaxBodySize > 0 {
+					cmd.Printf(" - max request body size is %d Kb\n", srup.MaxBodySize/1024)
+
+				} else {
+					cmd.Println(" - body size is not limited")
+
+				}
+				if srup.ContentType != "" {
+					cmd.Printf(" - expecting content type to be %q\n", srup.ContentType)
+
+				}
+				if srup.Path != "" {
+					cmd.Printf(" - valid path under /sink: %q\n", srup.Path)
+
+				}
+			}
+
+			return nil
+		},
+	}
+
+	signatureCmd.Flags().StringVar(
+		&srup.Origin,
+		"origin",
+		"",
+		"Origin of the request (arbitrary string, optional)")
+
+	signatureCmd.Flags().StringVar(
+		&srup.ContentType,
+		"content-type",
+		"",
+		"Content type (optional)")
+
+	signatureCmd.Flags().StringVar(
+		&srup.Path,
+		"path",
+		"",
+		"Full sink request path (do not include /sink prefix, add / for just root)")
+
+	signatureCmd.Flags().StringVar(
+		&expires,
+		"expires",
+		"",
+		"Date of expiration (YYYY-MM-DD, optional)")
+
+	signatureCmd.Flags().StringVar(
+		&srup.Method,
+		"method",
+		"",
+		"HTTP method that will be used (optional)")
+
+	signatureCmd.Flags().Int64Var(
+		&srup.MaxBodySize,
+		"max-body-size",
+		0,
+		"Max allowed body size")
+
+	signatureCmd.Flags().BoolVar(
+		&srup.SignatureInPath,
+		"signature-in-path",
+		false,
+		"Include signature in a path instead of query string")
+
+	cmd.AddCommand(
+		signatureCmd,
+	)
+
+	return cmd
+}

server/system/commands/users.go

@@ -0,0 +1,311 @@
+package commands
+
+import (
+	"context"
+	"fmt"
+	"strconv"
+	"syscall"
+	"time"
+
+	"github.com/brianvoe/gofakeit/v6"
+
+	"github.com/cortezaproject/corteza/server/pkg/auth"
+	"github.com/cortezaproject/corteza/server/pkg/cli"
+	"github.com/cortezaproject/corteza/server/pkg/filter"
+	"github.com/cortezaproject/corteza/server/store"
+	"github.com/cortezaproject/corteza/server/system/service"
+	"github.com/cortezaproject/corteza/server/system/types"
+	"github.com/spf13/cobra"
+	"golang.org/x/crypto/ssh/terminal"
+)
+
+func Users(ctx context.Context, app serviceInitializer) *cobra.Command {
+	var (
+		flagNoPassword       bool
+		flagPassword         string
+		flagMakePasswordLink bool
+		flagRoles            []string
+		flagSendEmail        bool
+	)
+
+	// User management commands.
+	cmd := &cobra.Command{
+		Use:     "users",
+		Aliases: []string{"user"},
+		Short:   "User management",
+	}
+
+	// List users.
+	listCmd := &cobra.Command{
+		Use:   "list",
+		Short: "List users",
+
+		PreRunE: commandPreRunInitService(app),
+		Run: func(cmd *cobra.Command, args []string) {
+			ctx = auth.SetIdentityToContext(ctx, auth.ServiceUser())
+
+			var (
+				queryFlag = cmd.Flags().Lookup("query").Value.String()
+				limitFlag = cmd.Flags().Lookup("limit").Value.String()
+
+				limit int
+				err   error
+			)
+
+			limit, err = strconv.Atoi(limitFlag)
+			cli.HandleError(err)
+
+			uf := types.UserFilter{Query: queryFlag}
+			uf.Sort = filter.SortExprSet{&filter.SortExpr{Column: "updated_at"}}
+			uf.Limit = uint(limit)
+
+			users, _, err := service.DefaultStore.SearchUsers(ctx, uf)
+			cli.HandleError(err)
+
+			fmt.Fprintf(
+				cmd.OutOrStdout(),
+				"                     Created    Updated    EmailAddress\n",
+			)
+
+			for _, u := range users {
+				upd := "---- -- --"
+
+				if u.UpdatedAt != nil {
+					upd = u.UpdatedAt.Format("2006-01-02")
+				}
+
+				fmt.Fprintf(
+					cmd.OutOrStdout(),
+					"%20d %s %s %-100s %s\n",
+					u.ID,
+					u.CreatedAt.Format("2006-01-02"),
+					upd,
+					u.Email,
+					u.Name,
+				)
+			}
+		},
+	}
+
+	listCmd.Flags().IntP("limit", "l", 20, "How many entry to display")
+	listCmd.Flags().StringP("query", "q", "", "Query and filter by handle, email, name")
+
+	addCmd := &cobra.Command{
+		Use:   "add [email]",
+		Short: "Add new user",
+		Args:  cobra.MinimumNArgs(1),
+
+		PreRunE: commandPreRunInitActivate(app),
+		Run: func(cmd *cobra.Command, args []string) {
+			ctx = auth.SetIdentityToContext(ctx, auth.ServiceUser())
+
+			var (
+				authSvc = service.Auth(service.AuthOptions{})
+
+				// @todo email validation
+				user = &types.User{Email: args[0]}
+
+				err error
+
+				// url for to create password(make-password-link)
+				url string
+
+				// Use provided password...
+				password = []byte(flagPassword)
+
+				role *types.Role
+				mm   types.RoleMemberSet
+			)
+
+			if !flagNoPassword && !flagMakePasswordLink && len(password) == 0 {
+				cmd.Print("Set password: ")
+				if password, err = terminal.ReadPassword(int(syscall.Stdin)); err != nil {
+					cli.HandleError(err)
+				}
+			}
+
+			if len(password) > 0 && !authSvc.CheckPasswordStrength(string(password)) {
+				cli.HandleError(service.AuthErrPasswordNotSecure())
+			}
+
+			for _, ri := range flagRoles {
+				role, err = service.DefaultRole.FindByAny(ctx, ri)
+				cli.HandleError(err)
+
+				mm = append(mm, &types.RoleMember{RoleID: role.ID})
+			}
+
+			// Update current settings to be sure we do not have outdated values
+			cli.HandleError(service.DefaultSettings.UpdateCurrent(ctx))
+
+			if user, err = service.DefaultUser.Create(ctx, user); err != nil {
+				cli.HandleError(err)
+			}
+
+			// generate the create password link of user
+			if flagNoPassword && len(password) == 0 && flagMakePasswordLink {
+				url, err = authSvc.GeneratePasswordCreateToken(ctx, user.Email)
+				if err != nil {
+					cli.HandleError(err)
+				}
+			}
+
+			if flagSendEmail {
+				if err = authSvc.SendInviteEmail(ctx, user.Email); err != nil {
+					cli.HandleError(err)
+				}
+			}
+
+			fmt.Fprintf(cmd.OutOrStdout(), "User created [%d].\n", user.ID)
+
+			if flagMakePasswordLink && len(url) > 0 {
+				fmt.Fprintf(cmd.OutOrStdout(), "Set password by clicking here:\n%s\n", url)
+			}
+
+			if len(mm) > 0 {
+				_ = mm.Walk(func(m *types.RoleMember) error {
+					m.Resource = fmt.Sprintf("corteza::system:user/%d", user.ID)
+					return nil
+				})
+
+				cli.HandleError(store.CreateRoleMember(ctx, service.DefaultStore, mm...))
+			}
+
+			if len(password) > 0 {
+				if err = authSvc.SetPassword(ctx, user.ID, string(password)); err != nil {
+					cli.HandleError(err)
+				}
+			}
+		},
+	}
+
+	addCmd.Flags().BoolVar(
+		&flagNoPassword,
+		"no-password",
+		false,
+		"Do not ask for password")
+
+	addCmd.Flags().StringVar(
+		&flagPassword,
+		"password",
+		"",
+		"Provide password (as alternative to interactive way)")
+
+	addCmd.Flags().BoolVar(
+		&flagMakePasswordLink,
+		"make-password-link",
+		false,
+		"Provide link to create password")
+
+	addCmd.Flags().StringSliceVar(
+		&flagRoles,
+		"role",
+		nil,
+		"Add user to roles (use ID or handle, repeat for multiple roles)")
+
+	addCmd.Flags().BoolVar(
+		&flagSendEmail,
+		"send-invite",
+		false,
+		"Send invite email to user with accept invite link")
+
+	pwdCmd := &cobra.Command{
+		Use:     "password [email]",
+		Short:   "Change password for user",
+		Args:    cobra.MinimumNArgs(1),
+		PreRunE: commandPreRunInitService(app),
+		Run: func(cmd *cobra.Command, args []string) {
+			ctx = auth.SetIdentityToContext(ctx, auth.ServiceUser())
+
+			var (
+				user     *types.User
+				err      error
+				password []byte
+			)
+
+			// Update current settings to be sure that we do not have outdated values
+			cli.HandleError(service.DefaultSettings.UpdateCurrent(ctx))
+
+			if user, err = service.DefaultUser.FindByEmail(ctx, args[0]); err != nil {
+				cli.HandleError(err)
+			}
+
+			cmd.Print("Set password: ")
+			if password, err = terminal.ReadPassword(int(syscall.Stdin)); err != nil {
+				cli.HandleError(err)
+			}
+
+			if len(password) == 0 {
+				// Password not set, that's ok too.
+				return
+			}
+
+			if err = service.DefaultAuth.SetPassword(ctx, user.ID, string(password)); err != nil {
+				cli.HandleError(err)
+			}
+		},
+	}
+
+	cmd.AddCommand(
+		listCmd,
+		addCmd,
+		pwdCmd,
+		UsersSynthetic(ctx, app),
+	)
+
+	return cmd
+}
+
+func UsersSynthetic(ctx context.Context, app serviceInitializer) *cobra.Command {
+	var (
+		total uint
+		faker = gofakeit.NewCrypto()
+
+		synth = &cobra.Command{
+			Use:     "synthetic",
+			Aliases: []string{"synth"},
+			Short:   "Generate or remove synthetic users",
+			PersistentPreRunE: func(cmd *cobra.Command, args []string) (err error) {
+				return app.InitServices(ctx)
+			},
+		}
+
+		gen = &cobra.Command{
+			Use:     "generate",
+			Aliases: []string{"gen"},
+			Short:   "Generate synthetic users",
+			Run: func(cmd *cobra.Command, args []string) {
+				cmd.Printf("Generating %d users ...", total)
+				bm := time.Now()
+
+				ctx = auth.SetIdentityToContext(ctx, auth.ServiceUser())
+				cli.HandleError(service.DefaultUser.CreateSynthetic(ctx, faker, total))
+
+				cmd.Printf("done in %s", time.Since(bm).Round(time.Millisecond))
+				cmd.Println()
+			},
+		}
+
+		rem = &cobra.Command{
+			Use:     "remove",
+			Aliases: []string{"rm", "d", "delete", "del"},
+			Short:   "Remove synthetic users",
+			Run: func(cmd *cobra.Command, args []string) {
+				cmd.Printf("Removing all synthetic users ...")
+				bm := time.Now()
+
+				ctx = auth.SetIdentityToContext(ctx, auth.ServiceUser())
+				cli.HandleError(service.DefaultUser.RemoveSynthetic(ctx))
+
+				cmd.Printf("done in %s", time.Since(bm).Round(time.Millisecond))
+				cmd.Println()
+			},
+		}
+	)
+
+	gen.Flags().UintVarP(&total, "total", "t", 1, "Number of synthetic users generated")
+
+	synth.AddCommand(gen, rem)
+
+	return synth
+}