Release/0.2.0

README.md

@@ -129,6 +129,34 @@ step to your workflow with the appropriate inputs.
 - `message`: Your message to testers, ensuring they receive important updates
   and information regarding the application.
 
+### Sub-Organizations
+
+If your Personal API Token belongs to the root organization but the target
+distribution profile lives in a sub-organization, set the optional
+`subOrganizationName` input. The action re-authenticates the same token against
+that sub-organization and runs every subsequent call there, so the profile is
+found (and created, when `createProfileIfNotExists` is `true`) inside the
+sub-organization instead of the root organization.
+
+```yaml
+- name: Publish App to Appcircle
+  uses: appcircleio/appcircle-testing-distribution-githubaction
+  with:
+    personalAPIToken: ${{ secrets.AC_PROFILE_API_TOKEN }}
+    subOrganizationName: YOUR_SUB_ORGANIZATION_NAME
+    profileName: ${{ secrets.AC_PROFILE_NAME }}
+    createProfileIfNotExists: ${{ secrets.CREATE_PROFILE_IF_NOT_EXISTS }}
+    appPath: ${{ secrets.APP_PATH }}
+    message: ${{ secrets.MESSAGE }}
+```
+
+- `subOrganizationName`: Name of the sub-organization to distribute into.
+  Optional; defaults to the root organization. The name must match exactly and
+  the token must have access to that sub-organization, otherwise the action
+  fails instead of falling back to the root organization.
+  It works the same way against a self-hosted installation; combine it with the
+  `authEndpoint` and `apiEndpoint` inputs described below.
+
 ### Self-Hosted Appcircle
 
 If you run a self-hosted Appcircle installation, point the action to your own

action.yml

@@ -26,6 +26,15 @@ inputs:
       Defaults to the Appcircle cloud.'
     required: false
     default: 'https://api.appcircle.io'
+  subOrganizationName:
+    description:
+      'Optional: Sub-organization name to distribute into. Leave empty to use
+      the root organization. Use this when your Personal API Token belongs to
+      the root organization but the target distribution profile lives in a
+      sub-organization. Profiles are created under the root organization when
+      this is empty.'
+    required: false
+    default: ''
   profileName:
     description:
       'Enter the profile name of the Appcircle distribution profile. This name

src/api/authApi.ts

@@ -2,14 +2,20 @@ import axios from 'axios'
 
 export async function getToken(
   pat: string,
-  authEndpoint = 'https://auth.appcircle.io'
+  authEndpoint = 'https://auth.appcircle.io',
+  subOrganizationId?: string
 ): Promise<any> {
   const params = new URLSearchParams()
   params.append('pat', pat)
 
+  const tokenPath = subOrganizationId ? '/auth/v2/token' : '/auth/v1/token'
+  if (subOrganizationId) {
+    params.append('subOrganizationId', subOrganizationId)
+  }
+
   const authHostname = authEndpoint.replace(/\/+$/, '')
   const response = await axios.post(
-    `${authHostname}/auth/v1/token`,
+    `${authHostname}${tokenPath}`,
     params.toString(),
     {
       headers: {

src/api/uploadApi.ts

@@ -56,6 +56,22 @@ export class UploadServiceHeaders {
   }
 }
 
+export async function getOrganizationId(name: string): Promise<string> {
+  const response = await appcircleApi.get('identity/v1/organizations', {
+    params: { page: 1, perPage: 1000 },
+    headers: UploadServiceHeaders.getHeaders()
+  })
+  const organizations: { id: string; name: string }[] =
+    response.data?.data ?? []
+  const organization = organizations.find(org => org.name === name)
+  if (!organization?.id) {
+    throw new Error(
+      `Sub-organization '${name}' could not be found or is not accessible with this token.`
+    )
+  }
+  return organization.id
+}
+
 export async function uploadArtifact(options: {
   message: string
   app: string

src/main.ts

@@ -3,6 +3,7 @@ import * as core from '@actions/core'
 import { getToken } from './api/authApi'
 import {
   checkTaskStatus,
+  getOrganizationId,
   getProfileId,
   setApiEndpoint,
   uploadArtifact,
@@ -26,6 +27,7 @@ export async function run(): Promise<void> {
     )
     const appPath = core.getInput('appPath')
     const message = core.getInput('message')
+    const subOrganizationName = core.getInput('subOrganizationName')
 
     setApiEndpoint(apiEndpoint)
 
@@ -41,9 +43,36 @@ export async function run(): Promise<void> {
     }
 
     const loginResponse = await getToken(personalAPIToken, authEndpoint)
-    UploadServiceHeaders.token = loginResponse.access_token
+    let accessToken = loginResponse.access_token
+    UploadServiceHeaders.token = accessToken
     console.log('Logged into Appcircle successfully.')
 
+    if (subOrganizationName) {
+      const subOrganizationId = await getOrganizationId(subOrganizationName)
+      let subLoginResponse
+      try {
+        subLoginResponse = await getToken(
+          personalAPIToken,
+          authEndpoint,
+          subOrganizationId
+        )
+      } catch (error: any) {
+        const status = error?.response?.status
+        throw new Error(
+          `Could not authenticate against sub-organization '${subOrganizationName}'` +
+            `${status ? ` (HTTP ${status})` : ''}: ${error?.message}`
+        )
+      }
+      if (!subLoginResponse?.access_token) {
+        throw new Error(
+          `Could not obtain an access token for sub-organization '${subOrganizationName}'.`
+        )
+      }
+      accessToken = subLoginResponse.access_token
+      UploadServiceHeaders.token = accessToken
+      console.log(`Switched to sub-organization: ${subOrganizationName}`)
+    }
+
     const profileIdFromName = await getProfileId(
       profileName,
       createProfileIfNotExists
@@ -57,7 +86,7 @@ export async function run(): Promise<void> {
     if (!uploadResponse.taskId) {
       core.setFailed('Task ID is not found in the upload response')
     } else {
-      await checkTaskStatus(loginResponse.access_token, uploadResponse.taskId)
+      await checkTaskStatus(accessToken, uploadResponse.taskId)
       console.log(`${appPath} uploaded to Appcircle successfully`)
     }
   } catch (error) {