feat: テナント匿名アクセス設定 & policies create ヘルプ改善 (#78)

* feat: admin tenants update に --anonymous-access オプションを追加、policies create のヘルプに target スキーマ例を追加

- admin tenants update に --anonymous-access / --no-anonymous-access フラグを追加し、
  テナントの anonymousAccessEnabled を CLI から直接切り替え可能にした (#76)
- admin policies create のヘルプに target フィールド (subjects, resources, actions,
  environments) の構造と実用的な JSON 例を追加 (#75)
- 匿名アクセスポリシーの作成例を policies create の examples に追加
- テナント update の --anonymous-access フラグに対するテスト4件を追加

Closes #75, Closes #76

* fix: サーバー側スキーマに合わせて実装を修正

- anonymousAccessEnabled を settings.features 配下のネスト構造に修正
  (トップレベルではなく settings.features.anonymousAccessEnabled)
- policy target から environments フィールドを削除（サーバー未サポート）
- action の attributeId を "action" から "method" (HTTP method) に修正
- target の matchFunction オプション (string-equal, string-regexp, glob) を記載
- subjects/resources/actions の有効な attributeId 一覧をヘルプに追加

Author: miya0001

CHANGELOG.md

@@ -7,6 +7,10 @@
 
 ## [Unreleased]
 
+### 2026-03-19
+- **Feat**: `admin tenants update` に `--anonymous-access` / `--no-anonymous-access` オプションを追加 — テナントの匿名アクセス設定を CLI から管理可能に (#76)
+- **Docs**: `admin policies create` のヘルプに `target` フィールド（subjects, resources, actions, environments）のスキーマ例を追加 (#75)
+
 ### 2026-03-17
 - **Fix**: API キーコマンド (`me api-keys`, `admin api-keys`) のヘルプで表示されるスコープ一覧を、API キーで実際に使用可能な6スコープに修正 (#74)
 

src/commands/admin/policies.ts

@@ -57,11 +57,27 @@ export function registerPoliciesCommand(parent: Command): void {
     .command("create [json]")
     .description(
       "Create a new policy\n\n" +
-        "JSON payload example:\n" +
+        "JSON payload examples:\n\n" +
+        "  Allow all entities:\n" +
         "  {\n" +
         '    "description": "Allow all entities",\n' +
         '    "rules": [{"ruleId": "allow-all", "effect": "Permit"}]\n' +
-        "  }",
+        "  }\n\n" +
+        "  Allow GET access to a specific entity type:\n" +
+        "  {\n" +
+        '    "description": "Allow GET access to Landmark entities",\n' +
+        '    "target": {\n' +
+        '      "resources": [{"attributeId": "entityType", "matchValue": "Landmark"}],\n' +
+        '      "actions": [{"attributeId": "method", "matchValue": "GET"}]\n' +
+        "    },\n" +
+        '    "rules": [{"ruleId": "permit-get", "effect": "Permit"}]\n' +
+        "  }\n\n" +
+        "Target fields:\n" +
+        "  subjects   — attributeId: role, userId, email, tenantId\n" +
+        "  resources  — attributeId: path, entityType, entityId, entityOwner, tenantService\n" +
+        "  actions    — attributeId: method (GET, POST, PATCH, DELETE)\n\n" +
+        "Each element: {attributeId, matchValue, matchFunction?}\n" +
+        "  matchFunction: \"string-equal\" (default) | \"string-regexp\" | \"glob\"",
     )
     .action(
       withErrorHandler(async (json: unknown, _opts: unknown, cmd: Command) => {
@@ -81,6 +97,14 @@ export function registerPoliciesCommand(parent: Command): void {
       description: "Create with inline JSON",
       command: `geonic admin policies create '{"description":"Allow all entities","rules":[{"ruleId":"allow-all","effect":"Permit"}]}'`,
     },
+    {
+      description: "Create with target (entity type + method)",
+      command: `geonic admin policies create '{"description":"Allow GET Landmark","target":{"resources":[{"attributeId":"entityType","matchValue":"Landmark"}],"actions":[{"attributeId":"method","matchValue":"GET"}]},"rules":[{"ruleId":"permit-get","effect":"Permit"}]}'`,
+    },
+    {
+      description: "Create anonymous access policy",
+      command: `geonic admin policies create '{"policyId":"public-read","target":{"subjects":[{"attributeId":"role","matchValue":"anonymous"}],"resources":[{"attributeId":"entityType","matchValue":"WeatherObserved"}],"actions":[{"attributeId":"method","matchValue":"GET"}]},"rules":[{"effect":"Permit"}]}'`,
+    },
     {
       description: "Create from a JSON file",
       command: "geonic admin policies create @policy.json",

src/commands/admin/tenants.ts

@@ -107,10 +107,24 @@ export function registerTenantsCommand(parent: Command): void {
         "JSON payload: only specified fields are updated.\n" +
         '  e.g. {"name": "new-name", "description": "Updated description"}',
     )
+    .option("--anonymous-access", "Enable anonymous access for the tenant")
+    .option("--no-anonymous-access", "Disable anonymous access for the tenant")
     .action(
       withErrorHandler(
-        async (id: unknown, json: unknown, _opts: unknown, cmd: Command) => {
-          const body = await parseJsonInput(json as string | undefined);
+        async (id: unknown, json: unknown, opts: unknown, cmd: Command) => {
+          const options = opts as { anonymousAccess?: boolean };
+          let body: Record<string, unknown>;
+          if (json) {
+            body = (await parseJsonInput(json as string)) as Record<string, unknown>;
+          } else if (options.anonymousAccess !== undefined) {
+            body = {
+              settings: {
+                features: { anonymousAccessEnabled: options.anonymousAccess },
+              },
+            };
+          } else {
+            body = (await parseJsonInput(undefined)) as Record<string, unknown>;
+          }
           const client = createClient(cmd);
           const format = getFormat(cmd);
           const response = await client.rawRequest(
@@ -133,6 +147,14 @@ export function registerTenantsCommand(parent: Command): void {
       description: "Rename a tenant",
       command: `geonic admin tenants update <tenant-id> '{"name":"new-name"}'`,
     },
+    {
+      description: "Enable anonymous access",
+      command: "geonic admin tenants update <tenant-id> --anonymous-access",
+    },
+    {
+      description: "Disable anonymous access",
+      command: "geonic admin tenants update <tenant-id> --no-anonymous-access",
+    },
     {
       description: "Update from a JSON file",
       command: "geonic admin tenants update <tenant-id> @patch.json",

tests/admin-tenants.test.ts

@@ -103,6 +103,47 @@ describe("admin tenants commands", () => {
       expect(outputResponse).toHaveBeenCalled();
       expect(printSuccess).toHaveBeenCalledWith("Tenant updated.");
     });
+
+    it("enables anonymous access with --anonymous-access", async () => {
+      client.rawRequest.mockResolvedValue(mockResponse({ id: "t1" }));
+      const program = makeProgram();
+      await runCommand(program, ["admin", "tenants", "update", "t1", "--anonymous-access"]);
+      expect(client.rawRequest).toHaveBeenCalledWith("PATCH", "/admin/tenants/t1", {
+        body: { settings: { features: { anonymousAccessEnabled: true } } },
+      });
+      expect(parseJsonInput).not.toHaveBeenCalled();
+      expect(printSuccess).toHaveBeenCalledWith("Tenant updated.");
+    });
+
+    it("disables anonymous access with --no-anonymous-access", async () => {
+      client.rawRequest.mockResolvedValue(mockResponse({ id: "t1" }));
+      const program = makeProgram();
+      await runCommand(program, ["admin", "tenants", "update", "t1", "--no-anonymous-access"]);
+      expect(client.rawRequest).toHaveBeenCalledWith("PATCH", "/admin/tenants/t1", {
+        body: { settings: { features: { anonymousAccessEnabled: false } } },
+      });
+      expect(parseJsonInput).not.toHaveBeenCalled();
+      expect(printSuccess).toHaveBeenCalledWith("Tenant updated.");
+    });
+
+    it("prefers json argument over --anonymous-access flag", async () => {
+      const body = { name: "updated" };
+      vi.mocked(parseJsonInput).mockResolvedValue(body);
+      client.rawRequest.mockResolvedValue(mockResponse({ id: "t1" }));
+      const program = makeProgram();
+      await runCommand(program, ["admin", "tenants", "update", "t1", '{"name":"updated"}', "--anonymous-access"]);
+      expect(client.rawRequest).toHaveBeenCalledWith("PATCH", "/admin/tenants/t1", { body });
+    });
+
+    it("falls back to parseJsonInput when no json and no flag", async () => {
+      const body = { description: "interactive" };
+      vi.mocked(parseJsonInput).mockResolvedValue(body);
+      client.rawRequest.mockResolvedValue(mockResponse({ id: "t1" }));
+      const program = makeProgram();
+      await runCommand(program, ["admin", "tenants", "update", "t1"]);
+      expect(parseJsonInput).toHaveBeenCalledWith(undefined);
+      expect(client.rawRequest).toHaveBeenCalledWith("PATCH", "/admin/tenants/t1", { body });
+    });
   });
 
   describe("tenants delete", () => {