feat: add user set-password, remove-role and roles commands

libs/ferriskey-cli-client/src/lib.rs

@@ -231,6 +231,12 @@ pub struct CreateRedirectUriRequest {
     pub enabled: bool,
 }
 
+#[derive(Debug, Clone, Serialize)]
+pub struct SetPasswordRequest {
+    pub value: String,
+    pub temporary: bool,
+}
+
 impl FerriskeyClient {
     pub fn new(
         base_url: impl Into<String>,
@@ -613,6 +619,59 @@ impl FerriskeyClient {
         Ok(())
     }
 
+    pub fn remove_user_role(
+        &self,
+        realm: &str,
+        user_id: &str,
+        role_id: &str,
+    ) -> Result<(), FerriskeyClientError> {
+        let response = self
+            .http
+            .delete(self.endpoint(&format!(
+                "realms/{realm}/users/{user_id}/roles/{role_id}"
+            )))
+            .bearer_auth(&self.token)
+            .send()?;
+
+        if !response.status().is_success() {
+            let status = response.status();
+            let body = response.text().unwrap_or_default();
+            return Err(FerriskeyClientError::Api { status, body });
+        }
+
+        Ok(())
+    }
+
+    pub fn list_user_roles(
+        &self,
+        realm: &str,
+        user_id: &str,
+    ) -> Result<Vec<CreatedRole>, FerriskeyClientError> {
+        self.get_list(&self.endpoint(&format!("realms/{realm}/users/{user_id}/roles")))
+    }
+
+    pub fn set_user_password(
+        &self,
+        realm: &str,
+        user_id: &str,
+        request: &SetPasswordRequest,
+    ) -> Result<(), FerriskeyClientError> {
+        let response = self
+            .http
+            .put(self.endpoint(&format!("realms/{realm}/users/{user_id}/reset-password")))
+            .bearer_auth(&self.token)
+            .json(request)
+            .send()?;
+
+        if !response.status().is_success() {
+            let status = response.status();
+            let body = response.text().unwrap_or_default();
+            return Err(FerriskeyClientError::Api { status, body });
+        }
+
+        Ok(())
+    }
+
     /// RFC 8628 §3.1 — start a device authorization flow.
     pub fn device_authorization(
         &self,

libs/ferriskey-cli-commands/src/lib.rs

@@ -23,7 +23,7 @@ pub use self::source::{
 };
 pub use self::user::{
     UserAssignRoleArgs, UserCommand, UserCreateArgs, UserDeleteArgs, UserGetArgs, UserListArgs,
-    UserSubcommand,
+    UserRemoveRoleArgs, UserRolesArgs, UserSetPasswordArgs, UserSubcommand,
 };
 use clap::{Parser, Subcommand};
 

libs/ferriskey-cli-commands/src/user.rs

@@ -22,6 +22,12 @@ pub enum UserSubcommand {
     Delete(UserDeleteArgs),
     /// Assign a realm role to a user.
     AssignRole(UserAssignRoleArgs),
+    /// Remove a realm role from a user.
+    RemoveRole(UserRemoveRoleArgs),
+    /// List the realm roles assigned to a user.
+    Roles(UserRolesArgs),
+    /// Set a user's password.
+    SetPassword(UserSetPasswordArgs),
 }
 
 /// Arguments for assigning a realm role to a user.
@@ -38,6 +44,55 @@ pub struct UserAssignRoleArgs {
     pub realm: Option<String>,
 }
 
+/// Arguments for removing a realm role from a user.
+#[derive(Debug, Args)]
+pub struct UserRemoveRoleArgs {
+    /// Username.
+    pub username: String,
+
+    /// Realm role name to remove.
+    pub role: String,
+
+    /// Realm name. Defaults to the selected context realm.
+    #[arg(long)]
+    pub realm: Option<String>,
+}
+
+/// Arguments for listing a user's realm roles.
+#[derive(Debug, Args)]
+pub struct UserRolesArgs {
+    /// Username.
+    pub username: String,
+
+    /// Realm name. Defaults to the selected context realm.
+    #[arg(long)]
+    pub realm: Option<String>,
+}
+
+/// Arguments for setting a user's password.
+#[derive(Debug, Args)]
+pub struct UserSetPasswordArgs {
+    /// Username.
+    pub username: String,
+
+    /// Realm name. Defaults to the selected context realm.
+    #[arg(long)]
+    pub realm: Option<String>,
+
+    /// New password. Prefer `--stdin` — a value here lands in shell history
+    /// and the process list.
+    #[arg(long, conflicts_with = "stdin")]
+    pub password: Option<String>,
+
+    /// Read the new password from stdin (trailing newline trimmed).
+    #[arg(long, default_value_t = false)]
+    pub stdin: bool,
+
+    /// Require the user to change this password on next login.
+    #[arg(long, default_value_t = false)]
+    pub temporary: bool,
+}
+
 /// Arguments for listing users.
 #[derive(Debug, Args)]
 pub struct UserListArgs {