feat: add --admin and --env flags to base44 exec#435
feat: add --admin and --env flags to base44 exec#435netanelgilad wants to merge 2 commits intomainfrom
Conversation
Add two new flags to the exec command: - `--admin` sends X-Bypass-RLS: true header via the SDK client, enabling admin access that bypasses Row Level Security rules - `--env <environment>` sends X-Data-Env header (accepts dev, share, or prod) to target a specific data environment The flags are passed as env vars (BASE44_ADMIN, BASE44_DATA_ENV) to the Deno subprocess, which reads them and builds custom headers for the SDK client. Includes 8 new tests covering header injection, absence without flags, combined usage, and env var propagation to the Deno subprocess. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
🚀 Package Preview Available!Install this PR's preview build with npm: npm i @base44-preview/cli@0.0.47-pr.435.27294cbPrefer not to change any import paths? Install using npm alias so your code still imports npm i "base44@npm:@base44-preview/cli@0.0.47-pr.435.27294cb"Or add it to your {
"dependencies": {
"base44": "npm:@base44-preview/cli@0.0.47-pr.435.27294cb"
}
}
Preview published to npm registry — try new features instantly! |
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
| .option( | ||
| "--env <environment>", | ||
| "Data environment to use (dev, share, or production). Defaults to production.", | ||
| ) |
There was a problem hiding this comment.
what is this? is this a documented feature? for example with is dev vs shared?
There was a problem hiding this comment.
| .option( | ||
| "--admin", | ||
| "Run with admin privileges (bypass RLS). Requires app owner/editor role.", | ||
| ) |
There was a problem hiding this comment.
maybe we should be specific and call this --skip-rls or something?
There was a problem hiding this comment.
yeah, just thinking how not to "scare" users /agetns with such a name to the flag. @claude got a good idea for a flag name?
There was a problem hiding this comment.
Claude finished @netanelgilad's task in 21s —— View job
Here are a few flag name ideas that convey elevated access without being alarming:
| Name | Pros | Cons |
|---|---|---|
--privileged |
Familiar from Docker/containers, clearly signals elevated access | Still sounds "serious" |
--full-access |
Plain English, self-explanatory | A bit verbose |
--unrestricted |
Describes exactly what it does (no RLS restrictions) | Could imply security risk |
--as-owner |
Communicates who you're acting as, not what you're bypassing | Slightly misleading (editor role also works) |
--bypass-filters |
Softer than "bypass-rls", avoids technical jargon | Vague |
My recommendation: --privileged
It's already familiar to developers from tools like Docker (docker run --privileged), signals that the user is opting into elevated permissions intentionally, and is less alarming than --admin or --skip-rls. It also doesn't expose the internal "RLS" terminology to users who may not know what that means.
Runner-up: --full-access — if you want something even more self-documenting for non-technical users or agents reading the help text.
There was a problem hiding this comment.
@kfirstri I don't have any strong opinion here, got something you liked here?
kfirstri
left a comment
kfirstri
left a comment
There was a problem hiding this comment.
Added some comments. i not clear about what is this --env flag? what are shared data environments? is this something users are aware of?
2 participants
Note
Description
This PR adds
--adminand--envflags to thebase44 execcommand. The--adminflag enables admin-level access by sending theX-Bypass-RLSheader, bypassing row-level security for users with owner/editor roles. The--envflag allows specifying a data environment (e.g.,dev,share,production) via theX-Data-Envheader.Related Issue
None
Type of Change
Changes Made
--adminflag tobase44 execthat passesBASE44_ADMIN=trueenv var to the Deno subprocess, causing it to sendX-Bypass-RLS: trueon all SDK requests--env <environment>flag tobase44 execthat passesBASE44_DATA_ENVto the Deno subprocess, which setsX-Data-Envon all SDK requestsRunScriptOptionsinterface inrun-script.tsto acceptadminanddataEnvoptionsdeno-runtime/exec.tsto read the new env vars and inject them as custom headers when creating the SDK clientTesting
npm test)Checklist
docs/(AGENTS.md) if I made architectural changesAdditional Notes
The
--adminflag requires the user to have app owner or editor role. Both flags are optional and can be combined. The env var approach cleanly passes these settings from the CLI process through to the Deno subprocess without requiring IPC.🤖 Generated by Claude | 2026-03-21 14:49 UTC