@catladder/cli 0.0.0-main-0d7b031b → 0.0.0-main-018e2dee

package/package.json

@@ -53,7 +53,7 @@
     }
   ],
   "license": "MIT",
-  "version": "0.0.0-main-0d7b031b",
+  "version": "0.0.0-main-018e2dee",
   "scripts": {
     "lint": "eslint \"src/**/*.ts\"",
     "lint:fix": "eslint \"src/**/*.ts\" --fix",

package/src/apps/cli/commands/project/doctor/{checkLocalAccess.test.ts → __tests__/checkLocalAccess.test.ts}

@@ -2,15 +2,15 @@ import type { ComponentContext, Config } from "@catladder/pipeline";
 import { beforeEach, describe, expect, it, vi } from "vitest";
 
 const state = { exists: true, keys: ["k1"] as string[] };
-vi.mock("../../../../../gcloud/serviceAccounts", () => ({
+vi.mock("../../../../../../gcloud/serviceAccounts", () => ({
   accountExists: async () => state.exists,
 }));
-vi.mock("../../../../../gcloud/localAccess", async (orig) => ({
+vi.mock("../../../../../../gcloud/localAccess", async (orig) => ({
   ...(await orig<object>()),
   listUserManagedKeyIds: async () => state.keys,
 }));
 
-import { checkLocalAccess } from "./checkLocalAccess";
+import { checkLocalAccess } from "../checkLocalAccess";
 
 const cloudRun = { type: "google-cloudrun", projectId: "p", region: "r" };
 
@@ -27,6 +27,7 @@ const config = (extra: Partial<Config> = {}) =>
     customerName: "acme",
     components: { web: { dir: ".", build: false, deploy: cloudRun } },
     localAccess: { gcp: { presets: ["logs"] } },
+    secrets: { vault: { type: "bitwarden" } },
     ...extra,
   }) as Config;
 
@@ -99,7 +100,7 @@ describe("checkLocalAccess", () => {
   });
 
   it("refuses the gitlab vault", async () => {
-    const out = await run(config({ vault: { type: "gitlab" } } as any));
+    const out = await run(config({ secrets: { vault: "gitlab" } } as any));
     expect(out.join("\n")).toMatch(/fail:.*not a CI variable store/);
   });
 
@@ -109,4 +110,18 @@ describe("checkLocalAccess", () => {
     );
     expect(out.join("\n")).toMatch(/fail:.*not allowed/);
   });
+
+  it("reports a credentialsEnvVar exported by several envs", async () => {
+    const out = await run(
+      config({
+        localAccess: {
+          gcp: {
+            presets: ["logs"],
+            credentialsEnvVar: "GOOGLE_APPLICATION_CREDENTIALS",
+          },
+        },
+      }),
+    );
+    expect(out.join("\n")).toMatch(/fail:.*declared by both/);
+  });
 });

package/src/apps/cli/commands/project/doctor/checkLocalAccess.ts

@@ -1,6 +1,7 @@
 import type { ComponentContext, Config } from "@catladder/pipeline";
 import {
   diffRoleBindings,
+  getLocalAccessGcpCredentialsEnvVars,
   getLocalAccessGcpRoles,
   getVaultConfig,
   isOfDeployType,
@@ -33,6 +34,7 @@ export const checkLocalAccess = async (
     let declared: string[];
     try {
       declared = getLocalAccessGcpRoles(config, context.env);
+      getLocalAccessGcpCredentialsEnvVars(config, context.name);
     } catch (e) {
       return { label, invalid: e.message as string };
     }

package/src/apps/cli/commands/project/setup/setupLocalAccess.ts

@@ -1,5 +1,6 @@
 import type { ComponentContext } from "@catladder/pipeline";
 import {
+  getLocalAccessGcpCredentialsEnvVars,
   getLocalAccessGcpRoles,
   getVaultConfig,
   isOfDeployType,
@@ -9,7 +10,7 @@ import type { IO } from "../../../../../core/types";
 import { syncLocalAccessServiceAccount } from "../../../../../gcloud/localAccess";
 
 /**
- * provisions the read-only local access (`localAccess` in catladder.ts)
+ * provisions the local access (`localAccess` in catladder.ts)
  * of a google cloud run component/env: a dedicated service account with
  * exactly the declared bindings and its key in the secret store. Also
  * removes what is no longer declared.
@@ -22,6 +23,8 @@ export const setupLocalAccess = async (
   if (!isOfDeployType(config, "google-cloudrun")) return;
   const projectConfig = await getProjectConfig();
   const roles = getLocalAccessGcpRoles(projectConfig, context.env);
+  // validates `credentialsEnvVar` (catenv silently skips invalid ones)
+  getLocalAccessGcpCredentialsEnvVars(projectConfig, context.name);
 
   if (roles.length > 0 && getVaultConfig(projectConfig).type === "gitlab") {
     // the gitlab vault stores secrets as CI variables available to every

package/src/localAccess/__tests__/keyFiles.test.ts

@@ -14,6 +14,7 @@ vi.mock("../../git/gitProjectInformation", () => ({
 import {
   getLocalAccessKeyFileName,
   getLocalAccessKeyFileVarName,
+  getLocalAccessKeyFileVars,
   writeLocalAccessKeyFiles,
 } from "../keyFiles";
 
@@ -105,3 +106,61 @@ describe("writeLocalAccessKeyFiles", () => {
     expect(logs.join("\n")).toMatch(/no local access key for dev:web/);
   });
 });
+
+describe("getLocalAccessKeyFileVars", () => {
+  const folder = () => join(root, ".catladder", "local-access");
+  const keyFile = () => join(folder(), "gcp-dev-web.json");
+  const withKey = async () => {
+    await mkdir(folder(), { recursive: true });
+    await writeFile(keyFile(), "{}");
+  };
+  const vertexDev = config({
+    environments: {
+      dev: {
+        localAccess: {
+          gcp: {
+            presets: ["vertex"],
+            credentialsEnvVar: "GOOGLE_APPLICATION_CREDENTIALS",
+          },
+        },
+      },
+    },
+  });
+
+  it("exports existing key files under the catladder var", async () => {
+    await withKey();
+    const c = config({
+      environments: { dev: { localAccess: { gcp: { presets: ["logs"] } } } },
+    });
+    expect(await getLocalAccessKeyFileVars(c, "web")).toEqual({
+      CATLADDER_LOCAL_ACCESS_GCP_DEV_KEY_FILE: keyFile(),
+    });
+  });
+
+  it("also exports the declared credentialsEnvVar", async () => {
+    await withKey();
+    expect(await getLocalAccessKeyFileVars(vertexDev, "web")).toEqual({
+      CATLADDER_LOCAL_ACCESS_GCP_DEV_KEY_FILE: keyFile(),
+      GOOGLE_APPLICATION_CREDENTIALS: keyFile(),
+    });
+  });
+
+  it("exports nothing while the key file is missing", async () => {
+    expect(await getLocalAccessKeyFileVars(vertexDev, "web")).toEqual({});
+  });
+
+  it("skips a conflicting credentialsEnvVar instead of throwing", async () => {
+    await withKey();
+    const c = config({
+      localAccess: {
+        gcp: {
+          presets: ["vertex"],
+          credentialsEnvVar: "GOOGLE_APPLICATION_CREDENTIALS",
+        },
+      },
+    });
+    const vars = await getLocalAccessKeyFileVars(c, "web");
+    expect(vars).not.toHaveProperty("GOOGLE_APPLICATION_CREDENTIALS");
+    expect(vars).toHaveProperty("CATLADDER_LOCAL_ACCESS_GCP_DEV_KEY_FILE");
+  });
+});

package/src/localAccess/declared.ts

@@ -1,5 +1,8 @@
 import type { Config } from "@catladder/pipeline";
-import { getLocalAccessGcpEnvs } from "@catladder/pipeline";
+import {
+  getLocalAccessGcpCredentialsEnvVars,
+  getLocalAccessGcpEnvs,
+} from "@catladder/pipeline";
 
 /**
  * the envs of a component declaring gcp local access. An invalid
@@ -17,3 +20,19 @@ export const getDeclaredLocalAccessEnvs = (
     return [];
   }
 };
+
+/**
+ * the declared `credentialsEnvVar` names of a component, mapped to their
+ * env. Empty instead of throwing on an invalid declaration, see
+ * {@link getDeclaredLocalAccessEnvs}.
+ */
+export const getDeclaredLocalAccessCredentialsEnvVars = (
+  config: Config,
+  componentName: string,
+): Record<string, string> => {
+  try {
+    return getLocalAccessGcpCredentialsEnvVars(config, componentName);
+  } catch {
+    return {};
+  }
+};

package/src/localAccess/keyFiles.ts

@@ -8,7 +8,10 @@ import { existsSync } from "fs";
 import { join } from "path";
 import type { IO } from "../core/types";
 import { writePrivateFile } from "../utils/writePrivateFile";
-import { getDeclaredLocalAccessEnvs } from "./declared";
+import {
+  getDeclaredLocalAccessCredentialsEnvVars,
+  getDeclaredLocalAccessEnvs,
+} from "./declared";
 import { getProjectRootPath } from "../git/gitProjectInformation";
 
 const sanitize = (s: string) => s.replace(/[^A-Za-z0-9]+/g, "_");
@@ -20,7 +23,8 @@ export const getLocalAccessKeyFileName = (env: string, componentName: string) =>
 /**
  * env var exposing the key file path. Deliberately NOT
  * GOOGLE_APPLICATION_CREDENTIALS: the key must only be used where a
- * command opts in (isolated gcloud config), never by ADC.
+ * command opts in (isolated gcloud config, or a declared
+ * `credentialsEnvVar`), never by ADC implicitly.
  */
 export const getLocalAccessKeyFileVarName = (env: string) =>
   `CATLADDER_LOCAL_ACCESS_GCP_${sanitize(env).toUpperCase()}_KEY_FILE`;
@@ -31,20 +35,28 @@ const getFolder = async () =>
 
 /**
  * env vars pointing at the key files that exist for the component
- * (only paths, no secrets)
+ * (only paths, no secrets): one per env, plus the declared
+ * `credentialsEnvVar` names
  */
 export const getLocalAccessKeyFileVars = async (
   config: Config,
   componentName: string,
 ): Promise<Record<string, string>> => {
   const folder = await getFolder();
+  const getPath = (env: string) =>
+    join(folder, getLocalAccessKeyFileName(env, componentName));
   return Object.fromEntries(
-    getDeclaredLocalAccessEnvs(config, componentName)
-      .map((env): [string, string] => [
-        getLocalAccessKeyFileVarName(env),
-        join(folder, getLocalAccessKeyFileName(env, componentName)),
-      ])
-      .filter(([, path]) => existsSync(path)),
+    [
+      ...getDeclaredLocalAccessEnvs(config, componentName).map(
+        (env): [string, string] => [
+          getLocalAccessKeyFileVarName(env),
+          getPath(env),
+        ],
+      ),
+      ...Object.entries(
+        getDeclaredLocalAccessCredentialsEnvVars(config, componentName),
+      ).map(([name, env]): [string, string] => [name, getPath(env)]),
+    ].filter(([, path]) => existsSync(path)),
   );
 };