feat(database): write endpoints — add / update / delete

CHANGELOG.md

@@ -36,6 +36,38 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
+- Database write endpoints (#122, #13 write slice):
+  `kasapi-cli databases add --password <pw> --comment <text>
+  --allowed-hosts <hosts>`,
+  `… update <database-login> [flags]` and
+  `… delete <database-login>` wire `add_database` /
+  `update_database` / `delete_database`. `update` and `delete` are
+  gated by the #109 confirmation prompt; `add` is reversible and not
+  prompted. All three honour `--dry-run` (#132) and emit a #131 audit
+  record; the password is redacted in both. `update` sends only the
+  explicitly-set flags (keyed on cobra `Changed`), so an empty value
+  is a deliberate "clear". `add_database` takes no `database_login`
+  — KAS generates it (the login equals the database name on creation,
+  e.g. `d0123460`) and echoes it in `ReturnInfo`, which the command
+  prints. The password key is split between actions: `--password`
+  maps to `database_password` on `add` and to `database_new_password`
+  on `update` (the same `_new_password` split the ftpuser/sambauser
+  slices carry). `delete_database`'s confirmation prompt uses the
+  louder verb "permanently delete" because the action drops the
+  database and every row it contains — the loudest data-loss surface
+  of the v0.2.0 write phase.
+
+### Changed
+
+- `kasapi-cli databases list`/`databases get` now decode the
+  `in_progress` flag the KAS API surfaces on every `get_databases`
+  entry. The list view exposes a new `IN_PROGRESS` column, and the
+  singular detail view appends an `in_progress` row when present.
+  Read-test fixtures were captured against an account with a newly-
+  created database `d0123460`; the existing decode/tabular tests now
+  pin against that snapshot rather than the previous `d0123450`-based
+  one.
+
 - DDNS-user write endpoints (#121, #13 write slice):
   `kasapi-cli ddnsusers add --password <pw> --zone <z> --label <l>
   --target-ip <ip> --comment <text> [--dual-stack]`,

docs/cli/kasapi-cli.md

@@ -35,7 +35,7 @@ kasapi-cli [flags]
 * [kasapi-cli completion](kasapi-cli_completion.md)	 - Generate the autocompletion script for the specified shell
 * [kasapi-cli config](kasapi-cli_config.md)	 - Inspect and bootstrap the kasapi-cli configuration
 * [kasapi-cli cronjobs](kasapi-cli_cronjobs.md)	 - Inspect and manage cronjobs (get/add/update/delete_cronjob)
-* [kasapi-cli databases](kasapi-cli_databases.md)	 - Inspect databases visible to the login (get_databases)
+* [kasapi-cli databases](kasapi-cli_databases.md)	 - Inspect and manage databases (get/add/update/delete_database)
 * [kasapi-cli ddnsusers](kasapi-cli_ddnsusers.md)	 - Inspect and manage DDNS users (get/add/update/delete_ddnsuser)
 * [kasapi-cli directoryprotection](kasapi-cli_directoryprotection.md)	 - Inspect directory (htaccess) protections (get_directoryprotection)
 * [kasapi-cli dns](kasapi-cli_dns.md)	 - Inspect DNS records for a zone

docs/cli/kasapi-cli_databases.md

@@ -1,6 +1,6 @@
 ## kasapi-cli databases
 
-Inspect databases visible to the login (get_databases)
+Inspect and manage databases (get/add/update/delete_database)
 
 ### Options
 
@@ -29,6 +29,9 @@ Inspect databases visible to the login (get_databases)
 ### SEE ALSO
 
 * [kasapi-cli](kasapi-cli.md)	 - Command-line client for the All-Inkl KAS API
+* [kasapi-cli databases add](kasapi-cli_databases_add.md)	 - Create a database (add_database; the login is generated by KAS)
+* [kasapi-cli databases delete](kasapi-cli_databases_delete.md)	 - Permanently delete a database and all data in it (delete_database)
 * [kasapi-cli databases get](kasapi-cli_databases_get.md)	 - Show details for a single database (get_databases with database_login)
 * [kasapi-cli databases list](kasapi-cli_databases_list.md)	 - List all databases (get_databases, no filter)
+* [kasapi-cli databases update](kasapi-cli_databases_update.md)	 - Replace mutable fields of a database (update_database)
 

docs/cli/kasapi-cli_databases_add.md

@@ -0,0 +1,39 @@
+## kasapi-cli databases add
+
+Create a database (add_database; the login is generated by KAS)
+
+```
+kasapi-cli databases add --password <pw> --comment <text> --allowed-hosts <hosts> [flags]
+```
+
+### Options
+
+```
+      --allowed-hosts string   comma-separated list of hosts allowed to connect (required for add; e.g. "localhost, 192.168.100.10, 192.168.100.10/32")
+      --comment string         user comment / label (required for add)
+  -h, --help                   help for add
+      --password string        database password (required for add; new password for update)
+```
+
+### Options inherited from parent commands
+
+```
+      --audit-log string                 append a JSON-Lines audit record for each write action to this file (also KAS_AUDIT_LOG); a logfmt line always goes to stderr regardless
+      --auth-data string                 KAS auth data (overrides config and KAS_AUTHDATA)
+      --auth-type string                 KAS auth strategy: 'plain' = send password on each KasApi call (no KasAuth, no 2FA support); 'session' = bootstrap via KasAuth and reuse the credential token. Overrides config and KAS_AUTHTYPE.
+      --config string                    path to the kasapi-cli config file (overrides the default location)
+      --dry-run                          preview a destructive command's KAS request (action + redacted parameters) and exit 0 without dispatching or prompting; honours --output
+      --login string                     KAS login (overrides config and KAS_LOGIN)
+      --otp string                       2FA one-time PIN — sent to KasAuth as session_2fa during the credential-token bootstrap. Requires auth_type=session; the KAS API does not document 2FA on direct kas_auth_type=plain calls.
+  -o, --output string                    output format: json|yaml|table (default table)
+      --profile string                   profile to select from the config file (overrides default_profile)
+      --session-lifetime int             session_lifetime in seconds passed to KasAuth (1..30000); 0 keeps the server default. Requires auth_type=session.
+      --session-update-lifetime string   session_update_lifetime passed to KasAuth ('Y' = sliding window, 'N' = fixed). Empty omits the parameter. Requires auth_type=session.
+  -v, --verbose                          enable verbose logging on stderr
+  -y, --yes                              skip confirmation prompts on destructive operations
+```
+
+### SEE ALSO
+
+* [kasapi-cli databases](kasapi-cli_databases.md)	 - Inspect and manage databases (get/add/update/delete_database)
+

docs/cli/kasapi-cli_databases_delete.md

@@ -0,0 +1,36 @@
+## kasapi-cli databases delete
+
+Permanently delete a database and all data in it (delete_database)
+
+```
+kasapi-cli databases delete <database-login> [flags]
+```
+
+### Options
+
+```
+  -h, --help   help for delete
+```
+
+### Options inherited from parent commands
+
+```
+      --audit-log string                 append a JSON-Lines audit record for each write action to this file (also KAS_AUDIT_LOG); a logfmt line always goes to stderr regardless
+      --auth-data string                 KAS auth data (overrides config and KAS_AUTHDATA)
+      --auth-type string                 KAS auth strategy: 'plain' = send password on each KasApi call (no KasAuth, no 2FA support); 'session' = bootstrap via KasAuth and reuse the credential token. Overrides config and KAS_AUTHTYPE.
+      --config string                    path to the kasapi-cli config file (overrides the default location)
+      --dry-run                          preview a destructive command's KAS request (action + redacted parameters) and exit 0 without dispatching or prompting; honours --output
+      --login string                     KAS login (overrides config and KAS_LOGIN)
+      --otp string                       2FA one-time PIN — sent to KasAuth as session_2fa during the credential-token bootstrap. Requires auth_type=session; the KAS API does not document 2FA on direct kas_auth_type=plain calls.
+  -o, --output string                    output format: json|yaml|table (default table)
+      --profile string                   profile to select from the config file (overrides default_profile)
+      --session-lifetime int             session_lifetime in seconds passed to KasAuth (1..30000); 0 keeps the server default. Requires auth_type=session.
+      --session-update-lifetime string   session_update_lifetime passed to KasAuth ('Y' = sliding window, 'N' = fixed). Empty omits the parameter. Requires auth_type=session.
+  -v, --verbose                          enable verbose logging on stderr
+  -y, --yes                              skip confirmation prompts on destructive operations
+```
+
+### SEE ALSO
+
+* [kasapi-cli databases](kasapi-cli_databases.md)	 - Inspect and manage databases (get/add/update/delete_database)
+

docs/cli/kasapi-cli_databases_get.md

@@ -32,5 +32,5 @@ kasapi-cli databases get <database-login> [flags]
 
 ### SEE ALSO
 
-* [kasapi-cli databases](kasapi-cli_databases.md)	 - Inspect databases visible to the login (get_databases)
+* [kasapi-cli databases](kasapi-cli_databases.md)	 - Inspect and manage databases (get/add/update/delete_database)
 

docs/cli/kasapi-cli_databases_list.md

@@ -32,5 +32,5 @@ kasapi-cli databases list [flags]
 
 ### SEE ALSO
 
-* [kasapi-cli databases](kasapi-cli_databases.md)	 - Inspect databases visible to the login (get_databases)
+* [kasapi-cli databases](kasapi-cli_databases.md)	 - Inspect and manage databases (get/add/update/delete_database)
 

docs/cli/kasapi-cli_databases_update.md

@@ -0,0 +1,39 @@
+## kasapi-cli databases update
+
+Replace mutable fields of a database (update_database)
+
+```
+kasapi-cli databases update <database-login> [password/comment/allowed-hosts flags] [flags]
+```
+
+### Options
+
+```
+      --allowed-hosts string   comma-separated list of hosts allowed to connect (required for add; e.g. "localhost, 192.168.100.10, 192.168.100.10/32")
+      --comment string         user comment / label (required for add)
+  -h, --help                   help for update
+      --password string        database password (required for add; new password for update)
+```
+
+### Options inherited from parent commands
+
+```
+      --audit-log string                 append a JSON-Lines audit record for each write action to this file (also KAS_AUDIT_LOG); a logfmt line always goes to stderr regardless
+      --auth-data string                 KAS auth data (overrides config and KAS_AUTHDATA)
+      --auth-type string                 KAS auth strategy: 'plain' = send password on each KasApi call (no KasAuth, no 2FA support); 'session' = bootstrap via KasAuth and reuse the credential token. Overrides config and KAS_AUTHTYPE.
+      --config string                    path to the kasapi-cli config file (overrides the default location)
+      --dry-run                          preview a destructive command's KAS request (action + redacted parameters) and exit 0 without dispatching or prompting; honours --output
+      --login string                     KAS login (overrides config and KAS_LOGIN)
+      --otp string                       2FA one-time PIN — sent to KasAuth as session_2fa during the credential-token bootstrap. Requires auth_type=session; the KAS API does not document 2FA on direct kas_auth_type=plain calls.
+  -o, --output string                    output format: json|yaml|table (default table)
+      --profile string                   profile to select from the config file (overrides default_profile)
+      --session-lifetime int             session_lifetime in seconds passed to KasAuth (1..30000); 0 keeps the server default. Requires auth_type=session.
+      --session-update-lifetime string   session_update_lifetime passed to KasAuth ('Y' = sliding window, 'N' = fixed). Empty omits the parameter. Requires auth_type=session.
+  -v, --verbose                          enable verbose logging on stderr
+  -y, --yes                              skip confirmation prompts on destructive operations
+```
+
+### SEE ALSO
+
+* [kasapi-cli databases](kasapi-cli_databases.md)	 - Inspect and manage databases (get/add/update/delete_database)
+

docs/usage/destructive-writes.md

@@ -58,6 +58,23 @@ prints it on success. The `--password` flag is redacted in the
 `--dry-run` preview and the audit record for both `add` and `update`
 (it maps to `samba_password` on add, `samba_new_password` on update).
 
+[`databases`](https://github.com/chmmou/kasapi-cli/issues/122) `add` /
+`update` / `delete` wire the same contract with one important
+loudness adjustment: `delete_database`'s confirmation prompt uses the
+verb `"permanently delete"` rather than the bare `"delete"` every
+other slice uses, because dropping a database also drops every row
+it contains — the loudest data-loss surface of the v0.2.0 write
+phase. `update` and `delete` are gated; `add` is reversible and not
+prompted. `update` is gated because every field it sets is replaced
+wholesale (the confirmation prompt phrases this as replacing the
+database's *settings*) and `update` sends only the explicitly-changed
+flags. `add_database` takes no login — KAS generates it (the login
+equals the database name on creation, e.g. `d0123460`) and the
+command prints it on success. The `--password` flag is redacted in
+the `--dry-run` preview and the audit record for both `add` and
+`update` (it maps to `database_password` on add,
+`database_new_password` on update).
+
 [`ddnsusers`](https://github.com/chmmou/kasapi-cli/issues/121) `add` /
 `update` / `delete` wire the same contract with the same policy:
 `update` and `delete` are gated; `add` is reversible and not prompted.