// Command sentryctl is Sentry's control CLI. Six subcommands now // (ping, query, dashboards, alerts) clearly justify splitting dispatch // across files -- see cli/README.md's "revisit once there's a real // command tree" note -- while keeping the same hand-rolled switch on // os.Args, no CLI framework, per that same README. package main import ( "encoding/json" "fmt" "io" "os" "strings" "text/tabwriter" ) const ( defaultAPIURL = "http://localhost:8080" defaultAlertingURL = "http://localhost:8081" ) func main() { os.Exit(run(os.Args[1:], os.Stdout, os.Stderr)) } func run(args []string, stdout, stderr io.Writer) int { if len(args) == 0 { usage(stderr) return 1 } switch args[0] { case "ping": return cmdPing(args[1:], stdout, stderr) case "query": return cmdQuery(args[1:], stdout, stderr) case "dashboards": return cmdDashboards(args[1:], stdout, stderr) case "alerts": return cmdAlerts(args[1:], stdout, stderr) case "agents": return cmdAgents(args[1:], stdout, stderr) case "users": return cmdUsers(args[1:], os.Stdin, stdout, stderr) case "-h", "--help", "help": usage(stdout) return 0 default: fmt.Fprintf(stderr, "sentryctl: unknown command %q\n", args[0]) usage(stderr) return 1 } } func usage(w io.Writer) { fmt.Fprintln(w, `sentryctl: Sentry control CLI Usage: sentryctl ping [--api ] sentryctl query "" [--api ] [--language sql|spl] [--json] sentryctl dashboards list|get |apply [--api ] sentryctl dashboards permissions list [--api ] sentryctl dashboards permissions grant viewer|editor [--api ] sentryctl dashboards permissions revoke [--api ] sentryctl alerts list|get |apply [--alerting-api ] sentryctl agents list|get [--api ] sentryctl agents config get |clear [--api ] sentryctl agents config set [--batch-max-size N] [--batch-flush-interval-ms N] [--heartbeat-enabled true|false] [--heartbeat-interval-ms N] [--journald-unit UNIT] [--api ] sentryctl agents restart [--yes] [--api ] sentryctl users login [--password ] [--api ] sentryctl users list [--api ] sentryctl users create [--password ] [--role viewer|editor|admin|owner] [--api ] sentryctl users delete [--api ] sentryctl users reset-password [--password ] [--api ] Commands: ping Checks that the api service is reachable via GET /healthz. query Runs a query (pipe syntax or SQL) against POST /query and prints the result as a table, or as JSON with --json. Quote the query in your shell -- pipe syntax uses "|", which your shell will otherwise interpret itself. dashboards list/get/apply against api's dashboard CRUD endpoints. "apply " imports a dashboard exported via the web UI's Export JSON button or GET /dashboards/{id}/export -- the same JSON shape both places, Terraform-friendly. "permissions" grants/revokes/lists per-resource dashboard access (a Phase 4, enterprise-api-only feature -- a 501 on plain api means no enterprise permission service is wired in on this deployment, not a client error). A grant only ever raises someone to viewer or editor on one dashboard; Admin/Owner already have tenant-wide access. alerts list/get/apply against alerting's rule CRUD endpoints. "apply " creates a rule from a JSON file with the same shape POST /rules accepts. agents Agent inventory, remote config, and lifecycle commands (see /docs/agent-management-design.md). "config set" reads the agent's current effective config first and PUTs back the complete merged override -- only the fields you pass change, everything else carries forward unchanged, same as the web UI's edit form. "restart" briefly interrupts log collection on that host and prompts for confirmation unless --yes is given. users Local username/password login and user management (see api/localauth -- only meaningful on a deployment with LOCAL_AUTH_ENABLED set; a 404 on any of these means it isn't). "login" is the only command that works with no $SENTRYCTL_TOKEN set yet -- it prints just the raw token to stdout: `+"`export SENTRYCTL_TOKEN=$(sentryctl users login admin)`"+`. --password (on any users subcommand) is read from stdin if omitted -- same shell-history/ps caveat as typing a credential in any flag, prefer piping it in. "create"/"list"/"delete"/"reset-password" require an owner-role token (see RegisterRoutes in api/localauth). --api defaults to $SENTRYCTL_API_URL, or `+defaultAPIURL+` if unset. --alerting-api defaults to $SENTRYCTL_ALERTING_API_URL, or `+defaultAlertingURL+` if unset. --language overrides auto-detection; omit it for the common case. $SENTRYCTL_TOKEN, if set, is sent as "Authorization: Bearer " on every request -- required once a deployment configures enterprise-auth (see /docs/phase-4-rbac-design.md). No flag equivalent, deliberately: unlike --api, a credential shouldn't be typed where shell history or `+"`ps`"+` output can capture it.`) } func resolveAPIURL(env func(string) string) string { if v := env("SENTRYCTL_API_URL"); v != "" { return v } return defaultAPIURL } func resolveAlertingURL(env func(string) string) string { if v := env("SENTRYCTL_ALERTING_API_URL"); v != "" { return v } return defaultAlertingURL } // resolveToken reads the RoleService/human bearer credential sentryctl // presents to api/alerting once enterprise-auth enforcement is turned // on (api/internal/authz.RequireRole*) -- empty by default, matching // every other Phase 0-3 client's nil-authorizer no-op behavior. func resolveToken(env func(string) string) string { return env("SENTRYCTL_TOKEN") } type errorResponseBody struct { Error string `json:"error"` } func printTable(w io.Writer, columns []string, rows [][]any) { tw := tabwriter.NewWriter(w, 0, 4, 2, ' ', 0) fmt.Fprintln(tw, strings.Join(columns, "\t")) for _, row := range rows { cells := make([]string, len(row)) for i, v := range row { cells[i] = formatCell(v) } fmt.Fprintln(tw, strings.Join(cells, "\t")) } _ = tw.Flush() fmt.Fprintf(w, "(%d row(s))\n", len(rows)) } func formatCell(v any) string { switch t := v.(type) { case nil: return "" case map[string]any, []any: b, err := json.Marshal(t) if err != nil { return fmt.Sprintf("%v", t) } return string(b) default: return fmt.Sprintf("%v", t) } }