feat(mau): make token issuance and revocation identity-safe

[ttypic]

• auth issue-ably-token / issue-jwt-token resolve the token's client
  ID through one helper: --client-id, else the client ID the CLI acts
  as. "*" is refused, and "none" still issues an anonymous token but
  warns that apps requiring identified clients reject it.
• Token output always states the identity: Client ID: anonymous in
  human output and clientId: null in JSON, rather than omitting it.
• auth issue-jwt-token --client-type server adds the signed
  x-ably-clientType=server claim, which is the only way a
  token-authenticated client can be classified as a server.
• auth revoke-token goes through the SDK's auth.revokeTokens instead
  of a hand-rolled HTTPS call to a hardcoded rest.ably.io, so it honours
  the configured endpoint and reports per-target failures.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
cli-web-cli	Ready	Preview	Oct 5, 2026 6:57pm UTC

[claude-code-ably-assistant]

Walkthrough

This PR hardens the three ably auth token commands around client identity. Token issuance (issue-ably-token, issue-jwt-token) now routes all client-ID resolution through a single shared helper on the base command — refusing wildcards, warning on anonymous tokens, and always emitting the identity in output. revoke-token replaces a hand-rolled HTTPS call to a hardcoded rest.ably.io with the SDK's auth.revokeTokens(), so it honours the configured endpoint and surfaces per-target failures. A new --client-type server flag on issue-jwt-token adds the signed x-ably-clientType claim needed to exempt token-authenticated clients from MAU counting.

Changes

Area	Files	Summary
Commands	src/commands/auth/issue-ably-token.ts	Use resolveTokenClientId(); always show Client ID: anonymous (not omitted) in output; emit clientId: null in JSON
Commands	src/commands/auth/issue-jwt-token.ts	Same client-ID consolidation; add --client-type server flag that embeds x-ably-clientType: server JWT claim
Commands	src/commands/auth/revoke-token.ts	Replace ~70-line hand-rolled HTTPS implementation with rest.auth.revokeTokens(); handle per-target failure results; remove node:https import
Services	src/services/client-identity.ts	Minor copy tweak on the wildcard rejection error message
Base	src/base-command.ts	Add resolveTokenClientId() — validates via resolveClientIdentity(), refuses *, warns on none, falls back to CLI's own identity
Tests	test/unit/commands/auth/revoke-token.test.ts	Replace nock HTTP interception with getMockAblyRest() SDK mocks; update server-error test to cover per-target failure path
Tests	test/unit/commands/auth/issue-ably-token.test.ts	Add wildcard rejection test; add default-client-ID test; update --client-id none expectation to anonymous
Tests	test/unit/commands/auth/issue-jwt-token.test.ts	Add --client-type server claim tests; add wildcard rejection + default-identity tests; update anonymous display expectation
Test Helpers	test/helpers/mock-ably-rest.ts	Add revokeTokens mock to MockRestAuth interface

Review Notes

• Output breaking change: --client-id none previously omitted the Client ID line entirely; it now always appears as Client ID: anonymous and emits a stderr warning. JSON output changes from omitting clientId to clientId: null. Callers parsing the human output or JSON should be aware.
• Wildcard now rejected: --client-id * was silently accepted before; it now fails immediately with an error. Any existing scripts passing * will break.
• revoke-token endpoint change: The old implementation hardcoded rest.ably.io. The new SDK call uses whatever endpoint is configured (e.g., sandbox, custom). This is strictly better but is a behavioural change worth noting for any environments that relied on the hardcoded host.
• New JWT claim (--client-type server): The signed x-ably-clientType: server claim is the only way a token-authenticated client bypasses MAU counting. The flag currently only accepts "server" — the option list is a one-element enum, leaving room to add other types later without a breaking flag change.
• nock no longer used in revoke-token tests: Tests now use the project-standard getMockAblyRest() mock rather than HTTP interception, which is more consistent. Verify nock isn't pulled in transitively only for these tests — if the package is unused elsewhere it could be dropped from dev dependencies.

[Copilot]

Copilot review overview

🟡 Changes recommended

Revocation authentication and error handling need correction, and JSON token-only output must include client identity.

Review effort: Lite
Findings: 1 · 2

Open (3)

• Force API-key authentication when revoking tokens · New
• Add anonymous JSON test asserting clientId is null · New
• Add anonymous JSON test asserting clientId is null · New

What changed in this PR

Updates token issuance and revocation to preserve client identity and use the SDK consistently.

Changes:

• Adds shared client-ID resolution and server JWT classification.
• Includes identity in token output.
• Migrates token revocation to SDK calls with per-target handling.
• Updates related tests and REST mocks.

File	Description
test/​unit/​commands/​auth/​revoke-token.test.ts	Tests SDK revocation behavior.
test/​unit/​commands/​auth/​issue-jwt-token.test.ts	Tests identity and server claims.
test/​unit/​commands/​auth/​issue-ably-token.test.ts	Tests identity resolution and warnings.
test/​helpers/​mock-ably-rest.ts	Adds revocation mock support.
src/​services/​client-identity.ts	Updates wildcard validation messaging.
src/​commands/​auth/​revoke-token.ts	Uses SDK token revocation.
src/​commands/​auth/​issue-jwt-token.ts	Adds server claims and identity output.
src/​commands/​auth/​issue-ably-token.ts	Uses shared identity resolution.
src/​base-command.ts	Resolves token client identity.

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[umair-ably]

approving with the caveat you fix this