aptible-cli 0.24.10 → 0.26.1

data/lib/aptible/cli/helpers/database.rb

@@ -8,6 +8,23 @@ module Aptible
         include Helpers::Environment
         include Helpers::Ssh
 
+        # RdsDatabase is a translation struct so the same renderer can be
+        # used for external_aws_resource as those for databases
+        RdsDatabase = Struct.new(:handle, :id, :created_at, :raw)
+        # MockRdsDatabaseAccountShell - there is no direct 1:1 mapping
+        # between accounts and external_aws_resources. Since this is
+        # coerced via app_external_aws_rds_connections, we use this
+        # struct to stub out those that are not found to be attached to
+        # any apps.
+        MockRdsDatabaseAccountShell = Struct.new(
+          :handle,
+          :id,
+          :created_at
+        )
+        # using an ID that cannot be hit for visual segregation of
+        # unattached databases
+        UNATTACHED_RDS_ACCOUNT_ID = -9999
+
         def ensure_database(options = {})
           db_handle = options[:db]
           environment_handle = options[:environment]
@@ -46,6 +63,83 @@ module Aptible
           )
         end
 
+        def aws_rds_db?(handle)
+          handle.start_with? 'aws:rds::'
+        end
+
+        def external_rds_databases_map
+          external_rds_databases_all.map { |rds| [rds[:id], rds] }.to_h
+        end
+
+        def fetch_rds_databases_with_accounts
+          rds_map = external_rds_databases_map
+          accts_rds_map = accounts_external_rds_databases_map(rds_map)
+          [rds_map, accts_rds_map]
+        end
+
+        def accounts_external_rds_databases_map(rds_map)
+          return {} if rds_map.empty?
+
+          map_of_accounts_to_rds(rds_map)
+        end
+
+        def map_of_accounts_to_rds(rds_map)
+          # one rds db can be on multiple accounts
+          accts_rds_map = {}
+          rds_map.each_value do |db|
+            account = derive_account_from_conns(db)
+            next if account.nil?
+
+            accts_rds_map[account.id] = [] if accts_rds_map[account.id].nil?
+            accts_rds_map[account.id] << db
+          end
+          accts_rds_map
+        end
+
+        def rds_shell_account
+          MockRdsDatabaseAccountShell.new(
+            'unattached rds databases',
+            UNATTACHED_RDS_ACCOUNT_ID
+          )
+        end
+
+        def external_rds_databases_all
+          Aptible::Api::ExternalAwsResource
+            .all(
+              token: fetch_token
+            )
+            .select { |db| db.resource_type == 'aws_rds_db_instance' }
+            .map do |db|
+              RdsDatabase.new(
+                "aws:rds::#{db.resource_name}",
+                db.id,
+                db.created_at,
+                db
+              )
+            end
+        end
+
+        def derive_account_from_conns(db, preferred_acct = nil)
+          conns = db.raw.app_external_aws_rds_connections
+          return nil if conns.empty?
+
+          if preferred_acct.present?
+            valid_conns = conns.find do |conn|
+              conn.present? && conn.app.account.id == preferred_acct.id
+            end
+            return nil if valid_conns.nil?
+            return valid_conns.app.account
+          end
+
+          first_present_conn = conns.find(&:present?)
+          return nil if first_present_conn.nil?
+          first_present_conn.app.account
+        end
+
+        def external_rds_database_from_handle(handle)
+          external_rds_databases_all.find { |a| a.handle == handle }
+        end
+
         def databases_from_handle(handle, environment)
           databases = if environment
                         environment.databases
@@ -90,8 +184,19 @@ module Aptible
 
         # Creates a local tunnel and yields the helper
 
-        def with_local_tunnel(credential, port = 0)
-          op = credential.create_operation!(type: 'tunnel', status: 'succeeded')
+        def with_local_tunnel(credential, port = 0, target_account = nil)
+          op = if target_account.nil?
+                 credential.create_operation!(
+                   type: 'tunnel',
+                   status: 'succeeded'
+                 )
+               else
+                 credential.create_operation!(
+                   type: 'tunnel',
+                   status: 'succeeded',
+                   destination_account: target_account.id
+                 )
+               end
 
           with_ssh_cmd(op) do |base_ssh_cmd, ssh_credential|
             ssh_cmd = base_ssh_cmd + ['-o', 'SendEnv=ACCESS_TOKEN']
@@ -106,6 +211,72 @@ module Aptible
           end
         end
 
+        def with_rds_tunnel(handle, port = 0)
+          external_rds = external_rds_database_from_handle(handle)
+          if external_rds.nil?
+            raise Thor::Error, "No rds db found with handle #{handle}"
+          end
+
+          credential = external_rds.raw.external_aws_database_credentials.first
+          if credential.nil?
+            raise Thor::Error, 'No rds credential found with handle ' \
+                               "#{handle}. Check to see if you have run " \
+                               'db:attach or a scan has properly completed.'
+          end
+
+          target_account = derive_account_from_conns(external_rds)
+          if target_account.nil?
+            raise Thor::Error,
+                  "No env for rds found with handle #{handle}. Check to see " \
+                  'if you have run db:attach or a scan has properly completed.'
+          end
+
+          with_local_tunnel(credential, port, target_account) do |tunnel_helper|
+            url = local_rds_url(credential, tunnel_helper.port, target_account)
+            yield url, tunnel_helper
+          end
+        end
+
+        def use_rds_tunnel(handle, port)
+          with_rds_tunnel(handle, port) do |url, tunnel_helper|
+            CLI.logger.info "Connect at #{url}"
+
+            uri = URI(url)
+            db = uri.path.gsub(%r{^/}, '')
+            CLI.logger.info 'Or, use the following arguments:'
+            CLI.logger.info "* Host: #{uri.host}"
+            CLI.logger.info "* Port: #{uri.port}"
+            CLI.logger.info "* Username: #{uri.user}" unless uri.user.empty?
+            CLI.logger.info "* Password: #{uri.password}"
+            CLI.logger.info "* Database: #{db}" unless db.empty?
+
+            CLI.logger.info 'Connected. Ctrl-C to close connection.'
+
+            begin
+              tunnel_helper.wait
+            rescue Interrupt
+              CLI.logger.warn 'Closing tunnel'
+            end
+          end
+        end
+
+        def use_rds_dump(handle, filename, dump_options)
+          with_rds_tunnel(handle) do |url|
+            CLI.logger.info "Dumping to #{filename}"
+            `pg_dump #{url} #{dump_options.shelljoin} > #{filename}`
+            exit $CHILD_STATUS.exitstatus unless $CHILD_STATUS.success?
+          end
+        end
+
+        def use_rds_execute(handle, sql_path, options)
+          with_rds_tunnel(handle) do |url|
+            CLI.logger.info "Executing #{sql_path} against #{handle}"
+            args = options[:on_error_stop] ? '-v ON_ERROR_STOP=true ' : ''
+            `psql #{args}#{url} < #{sql_path}`
+            exit $CHILD_STATUS.exitstatus unless $CHILD_STATUS.success?
+          end
+        end
+
         # Creates a local PG tunnel and yields the url to it
 
         def with_postgres_tunnel(database)
@@ -120,6 +291,15 @@ module Aptible
           end
         end
 
+        def local_rds_url(credential, local_port, forced_account)
+          remote_url = credential.connection_url
+
+          uri = URI.parse(remote_url)
+          domain = forced_account.stack.internal_domain
+          "#{uri.scheme}://#{uri.user}:#{uri.password}@" \
+          "localhost.#{domain}:#{local_port}#{uri.path}"
+        end
+
         def local_url(credential, local_port)
           remote_url = credential.connection_url
 

data/lib/aptible/cli/helpers/token.rb

@@ -52,6 +52,20 @@ module Aptible
           tok = fetch_token
           JWT.decode(tok, nil, false)
         end
+
+        # Instance of Aptible::Auth::Token from current token
+        def current_token
+          Aptible::Auth::Token.current_token(token: fetch_token)
+        rescue HyperResource::ClientError => e
+          raise Thor::Error, e.message
+        end
+
+        # Instance of Aptible::Auth::User associated with current token
+        def whoami
+          current_token.user
+        rescue HyperResource::ClientError => e
+          raise Thor::Error, e.message
+        end
       end
     end
   end

data/lib/aptible/cli/helpers/vhost/option_set_builder.rb

@@ -12,7 +12,6 @@ module Aptible
             ports
             port
             alb
-            shared
           ).freeze
 
           def initialize(&block)
@@ -63,6 +62,13 @@ module Aptible
                           'least_outstanding_requests, and ' \
                           'weighted_random'
                   )
+
+                  option(
+                    :shared,
+                    type: :boolean,
+                    desc: "Share this Endpoint's load balancer with other " \
+                          'Endpoints'
+                  )
                 end
               end
 
@@ -123,15 +129,6 @@ module Aptible
                         'on this Endpoint'
                 )
               end
-
-              if builder.shared?
-                option(
-                  :shared,
-                  type: :boolean,
-                  desc: "Share this Endpoint's load balancer with other " \
-                        'Endpoints'
-                )
-              end
             end
           end
 
@@ -203,11 +200,7 @@ module Aptible
                 params[:load_balancing_algorithm_type] = lba_type
               end
 
-              if shared?
-                params[:shared] = options.delete(:shared) do
-                  create? ? false : nil
-                end
-              end
+              params[:shared] = options.delete(:shared)
             end
 
             options.delete(:environment)

data/lib/aptible/cli/renderer/text.rb

@@ -32,8 +32,14 @@ module Aptible
             # children are KeyedObject instances so they can render properly,
             # but we need to warn in tests that this is required.
             node.children.each_pair do |k, c|
-              io.print "#{format_key(k)}: "
-              visit(c, io)
+              io.print "#{format_key(k)}:"
+              if c.is_a?(Formatter::List)
+                io.puts
+                visit_indented(c, io, '  ')
+              else
+                io.print ' '
+                visit(c, io)
+              end
             end
           when Formatter::GroupedKeyedList
             enum = spacer_enumerator
@@ -65,6 +71,31 @@ module Aptible
 
         private
 
+        def visit_indented(node, io, indent)
+          return unless node.is_a?(Formatter::List)
+
+          node.children.each do |child|
+            case child
+            when Formatter::Object
+              child.children.each_pair do |k, c|
+                io.print "#{indent}#{format_key(k)}:"
+                if c.is_a?(Formatter::List)
+                  io.puts
+                  visit_indented(c, io, indent + '  ')
+                else
+                  io.print ' '
+                  visit(c, io)
+                end
+              end
+              io.puts unless child == node.children.last
+            when Formatter::Value
+              io.puts "#{indent}#{child.value}"
+            else
+              visit(child, io)
+            end
+          end
+        end
+
         def output_list(nodes, io)
           if nodes.all? { |v| v.is_a?(Formatter::Value) }
             # All nodes are single values, so we render one per line.

data/lib/aptible/cli/subcommands/aws_accounts.rb

@@ -0,0 +1,252 @@
+# frozen_string_literal: true
+
+module Aptible
+  module CLI
+    module Subcommands
+      module AwsAccounts
+        def self.included(thor)
+          thor.class_eval do
+            include Helpers::Token
+            include Helpers::AwsAccount
+            include Helpers::Telemetry
+
+            desc 'aws_accounts', 'List external AWS accounts', hide: true
+            option :organization_id, aliases: '--org-id',
+                                     type: :string,
+                                     default: nil,
+                                     desc: 'Organization ID'
+            def aws_accounts
+              telemetry(__method__, options)
+
+              accounts = aws_accounts_all
+
+              Formatter.render(Renderer.current) do |root|
+                root.list do |list|
+                  accounts.each do |ext|
+                    list.object do |node|
+                      node.value('id', ext.id) if ext.respond_to?(:id)
+                      attrs = ext.respond_to?(:attributes) ? ext.attributes : {}
+                      %w(
+                        aws_account_id
+                        account_name
+                        aws_region_primary
+                        status
+                        discovery_enabled
+                        discovery_role_arn
+                        discovery_frequency
+                        account_id
+                        created_at
+                        updated_at
+                      ).each do |k|
+                        v = attrs[k]
+                        node.value(k, v) unless v.nil?
+                      end
+                    end
+                  end
+                end
+              end
+            end
+
+            desc 'aws_accounts:add ' \
+                 '[--account-name ACCOUNT_NAME] ' \
+                 '[--aws-account-id AWS_ACCOUNT_ID] ' \
+                 '[--org-id ORGANIZATION_ID] '\
+                 '[--aws-region-primary AWS_REGION] ' \
+                 '[--discovery-enabled|--no-discovery-enabled] ' \
+                 '[--discovery-role-arn DISCOVERY_ROLE_ARN] ' \
+                 '[--discovery-frequency FREQ]', \
+                 'Add a new external AWS account', hide: true
+            option :account_name, type: :string, desc: 'Display name'
+            option :aws_account_id, type: :string, desc: 'AWS Account ID'
+            option :organization_id, aliases: '--org-id',
+                                     type: :string,
+                                     default: nil,
+                                     desc: 'Organization ID'
+            option :aws_region_primary, type: :string,
+                                        desc: 'Primary AWS region'
+            option :discovery_enabled, type: :boolean,
+                                       desc: 'Enable resource discovery'
+            option :discovery_role_arn, type: :string,
+                                        desc: 'IAM Role ARN that Aptible ' \
+                                              'will assume to discover ' \
+                                              'resources in your AWS account'
+            option :discovery_frequency,
+                   type: :string,
+                   desc: 'Discovery frequency (e.g., daily)'
+            define_method 'aws_accounts:add' do
+              telemetry(__method__, options)
+
+              resource = create_external_aws_account!(options)
+
+              Formatter.render(Renderer.current) do |root|
+                root.object do |node|
+                  node.value('id', resource.id) if resource.respond_to?(:id)
+                  rattrs =
+                    if resource.respond_to?(:attributes)
+                      resource.attributes
+                    else
+                      {}
+                    end
+                  %w(
+                    aws_account_id
+                    account_name
+                    aws_region_primary
+                    discovery_enabled
+                    discovery_role_arn
+                    discovery_frequency
+                    account_id
+                    created_at
+                    updated_at
+                  ).each do |k|
+                    v = rattrs[k]
+                    node.value(k, v) unless v.nil?
+                  end
+                end
+              end
+            end
+
+            desc 'aws_accounts:show ID',
+                 'Show an external AWS account', \
+                 hide: true
+            define_method 'aws_accounts:show' do |id|
+              telemetry(__method__, options.merge(id: id))
+              ext = ensure_external_aws_account(id)
+              Formatter.render(Renderer.current) do |root|
+                root.object do |node|
+                  node.value('id', ext.id)
+                  rattrs =
+                    if ext.respond_to?(:attributes)
+                      ext.attributes
+                    else
+                      {}
+                    end
+                  %w(
+                    aws_account_id
+                    account_name
+                    aws_region_primary
+                    discovery_enabled
+                    discovery_role_arn
+                    discovery_frequency
+                    account_id
+                    created_at
+                    updated_at
+                  ).each do |k|
+                    v = rattrs[k]
+                    node.value(k, v) unless v.nil?
+                  end
+                end
+              end
+            end
+
+            desc 'aws_accounts:delete ID',
+                 'Delete an external AWS account', \
+                 hide: true
+            define_method 'aws_accounts:delete' do |id|
+              telemetry(__method__, options.merge(id: id))
+
+              delete_external_aws_account!(id)
+
+              Formatter.render(Renderer.current) do |root|
+                root.object do |node|
+                  node.value('id', id)
+                  node.value('deleted', true)
+                end
+              end
+            end
+
+            desc 'aws_accounts:update ID ' \
+                 '[--account-name ACCOUNT_NAME] ' \
+                 '[--aws-account-id AWS_ACCOUNT_ID] ' \
+                 '[--aws-region-primary AWS_REGION] ' \
+                 '[--discovery-enabled|--no-discovery-enabled] ' \
+                 '[--discovery-role-arn DISCOVERY_ROLE_ARN] ' \
+                 '[--remove-discovery-role-arn] ' \
+                 '[--discovery-frequency FREQ]', \
+                 'Update an external AWS account', hide: true
+            option :account_name, type: :string, desc: 'New display name'
+            option :aws_account_id, type: :string, desc: 'AWS Account ID'
+            option :aws_region_primary, type: :string,
+                                        desc: 'Primary AWS region'
+            option :discovery_enabled, type: :boolean,
+                                       desc: 'Enable resource discovery'
+            option :discovery_role_arn, type: :string,
+                                        desc: 'IAM Role ARN that Aptible ' \
+                                              'will assume to discover ' \
+                                              'resources in your AWS account'
+            option :remove_discovery_role_arn, type: :boolean,
+                                               desc: 'Remove the discovery ' \
+                                                     'role ARN from this ' \
+                                                     'account'
+            option :discovery_frequency,
+                   type: :string,
+                   desc: 'Discovery frequency (e.g., daily)'
+            define_method 'aws_accounts:update' do |id|
+              telemetry(__method__, options.merge(id: id))
+
+              ext = update_external_aws_account!(id, options)
+
+              Formatter.render(Renderer.current) do |root|
+                root.object do |node|
+                  node.value('id', ext.id)
+                  rattrs =
+                    if ext.respond_to?(:attributes)
+                      ext.attributes
+                    else
+                      {}
+                    end
+                  %w(
+                    aws_account_id
+                    account_name
+                    aws_region_primary
+                    discovery_enabled
+                    discovery_role_arn
+                    discovery_frequency
+                    account_id
+                    created_at
+                    updated_at
+                  ).each do |k|
+                    v = rattrs[k]
+                    node.value(k, v) unless v.nil?
+                  end
+                end
+              end
+            end
+
+            desc 'aws_accounts:check ID',
+                 'Check the connection for an external AWS account', \
+                 hide: true
+            define_method 'aws_accounts:check' do |id|
+              telemetry(__method__, options.merge(id: id))
+
+              response = check_external_aws_account!(id)
+
+              fmt_state = lambda do |state|
+                Renderer.format == 'json' ? state : format_check_state(state)
+              end
+
+              Formatter.render(Renderer.current) do |root|
+                root.object do |node|
+                  node.value('state', fmt_state.call(response.state))
+                  node.list('checks') do |check_list|
+                    response.checks.each do |check|
+                      check_list.object do |check_node|
+                        check_node.value('name', check.check_name)
+                        check_node.value('state', fmt_state.call(check.state))
+                        check_node.value('details', check.details) \
+                          unless check.details.nil?
+                      end
+                    end
+                  end
+                end
+              end
+
+              unless response.state == 'success'
+                raise Thor::Error, 'AWS account check failed'
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end