fix: unbreak raisely start and raisely create for CLI logins

[xolott-ark]

Fixes SIR-1934.

Summary

Three commands were broken for anyone who authenticated with raisely login. Two root causes, both confirmed with runtime instrumentation against the live API rather than by reading code.

CLI tokens have no user record. They are OAuth app authorizations, so /users/me resolves me to the authorization uuid and returns 404. /authenticate also returns identity flat at the top level, with its data key holding authorization metadata (type, scopes, appUuid, authorizationUuid) rather than an organisation record. Three call sites assumed otherwise:

• informLocalDev read authData.data.organisation.private and threw a TypeError, crashing raisely start before the local server came up. It now reads organisationUuid from .raisely.json (falling back to /authenticate) and fetches the org record separately. No OAuth app scope grants reading an organisation, so that request 403s for every CLI login and only succeeds for admin tokens via RAISELY_TOKEN; since the localDevelopment flag is advisory, it fails open rather than blocking the command.
• createComponent called /users/me for the organisation uuid and 404'd before creating anything. It now resolves the uuid the same way, and throws an actionable message naming raisely logout / login / init when neither source has it.
• checkCorrectOrganisation called /users/${authData.userUuid}/move, which became /users/null/move. It now explains that the session identifies no user and points at the admin instead.

raisely start watched only stylesheets. handleCampaignChange returned early unless the changed path was <campaign>/stylesheets/..., so saving a page JSON was dropped with no upload and no message; the preview looked broken with nothing to explain why. Page JSON now routes through uploadPage, reusing the same guards as deploy: skip invalid JSON, skip pages with no uuid, and skip pages whose campaignUuid is not configured, reporting each on the spinner.

Test plan

• 103 tests pass across 12 files, including new suites for helpers, components, and auth, plus added start cases for the page upload path
• raisely start reaches a running local server instead of crashing
• raisely create debug-test-component creates the component and syncs both files down; verified the record and the generated .js / .json on disk
• Reviewer: confirm the fail-open behaviour on the organisation 403 is acceptable, since the localDevelopment warning is now skipped for standard CLI logins

Notes

Targets develop, matching the convention for feature work here. Verifying create left a debug-test-component record in the Raisely org used for testing; the CLI has no delete command, so it needs removing through the admin panel.

---

Note

Medium Risk
Touches authentication, org switching, and live upload paths used during local dev; behavior changes are intentional but could affect edge cases around org mismatch and advisory local-dev warnings.

Overview
Fixes CLI login breakage by treating /authenticate identity as top-level fields (not data), and by stopping reliance on /users/me for app-token sessions.

raisely start no longer crashes in informLocalDev when org details aren’t on the auth payload; it loads organisationUuid from config or auth and optionally fetches /organisations/:uuid (403 on CLI tokens is ignored so start isn’t blocked). Org mismatch handling in auth now refuses /users/undefined/move when there’s no userUuid, and exits on failed moves instead of continuing.

createComponent resolves organisationUuid from .raisely.json or /authenticate, with a clear recovery message when resolution fails.

Watch mode uploads campaign page JSON changes via uploadPage, with the same skip rules as deploy (valid JSON, uuid, configured campaign).

Adds a GitHub Actions test workflow (Node 18/20/22) and Vitest coverage for auth, components, helpers, and start page uploads.

^{Reviewed by Cursor Bugbot for commit 98408b4. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Risk: high.

Risk Assessment (Framework v2.0)

Framework (v2.0)

Dimension	Tier	Score	Rationale
Security	1	Low	No findings
Sensitive domains	1	High	Modifies CLI auth/session identity handling: /authenticate shape, org-switch via /users/.../move, and organisation private-flag fetch used by start/create
Data integrity	1	Low	No database/query/scoping changes
Deployment	1	Low	None
Scope	2	Medium	~140 LOC of mutative changes across 4 existing source files; tests mostly additive
Architecture	2	Low	Changes stay within the CLI package boundaries
Feature flags	2	Low	Developer CLI tooling; feature flag not required
Dependencies	2	Low	No changes

Mitigating Factors

• New Vitest coverage for auth, components, helpers, and start page-upload path
• Page upload reuses existing deploy guards (uuid/campaign checks)

Findings

#	Finding	Status	Resolution
1	When org-switch is confirmed but userUuid is missing, checkCorrectOrganisation returns and getToken still returns the token, so the CLI can continue against the wrong organisation after a failed switch	Open	--
2	auth.test.js case titled for undefined userUuid still supplies userUuid: 'user-1', so the CLI-login no-user guard is not actually asserted	Open	--

Outstanding findings: 2
Overall risk: HIGH
Decision: ESCALATE
Rationale: Tier 1 Sensitive domains is High because the PR changes authentication/session identity resolution and organisation-switch behavior for CLI OAuth logins; escalate for human review.

  

_{Sent by Cursor Approval Agent: Nemo - Pull Request Router and Approver}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 9b4ec03. Configure here.}