@catladder/cli 0.0.0-main-2355fd7c → 0.0.0-main-018e2dee

package/src/gcloud/__tests__/syncLocalAccess.test.ts

@@ -0,0 +1,196 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import type { ComponentContext } from "@catladder/pipeline";
+import { getSecretVarName } from "@catladder/pipeline";
+
+const calls: string[] = [];
+let responses: (cmd: string) => string | undefined;
+vi.mock("child-process-promise", () => ({
+  exec: async (cmd: string) => {
+    calls.push(cmd);
+    return { stdout: responses(cmd) ?? "" };
+  },
+}));
+vi.mock("../serviceAccounts", () => ({ accountExists: async () => true }));
+vi.mock("fs/promises", async (orig) => ({
+  ...(await orig<object>()),
+  readFile: async () =>
+    JSON.stringify({ private_key_id: "new", private_key: "k" }),
+}));
+
+import {
+  getLocalAccessServiceAccountNames,
+  syncLocalAccessServiceAccount,
+} from "../localAccess";
+
+const context = {
+  env: "dev",
+  name: "web",
+  fullConfig: { customerName: "acme", appName: "shop" },
+} as ComponentContext;
+
+const saMember = `serviceAccount:${getLocalAccessServiceAccountNames(context, "p").fullIdentifier}`;
+
+const setup = (opts: { stored?: string; keys: string[]; bindings: any[] }) => {
+  calls.length = 0;
+  responses = (cmd) => {
+    if (cmd.includes("get-iam-policy"))
+      return JSON.stringify({
+        bindings: opts.bindings.map((b) => ({
+          ...b,
+          members: b.members.map((m: string) => (m === "SA" ? saMember : m)),
+        })),
+      });
+    if (cmd.includes("keys list"))
+      return JSON.stringify(opts.keys.map((k) => ({ name: `a/keys/${k}` })));
+    return undefined;
+  };
+  const vault = {
+    readAllSecrets: vi.fn(async () =>
+      opts.stored
+        ? {
+            [getSecretVarName(
+              "local",
+              "web",
+              "LOCAL_ACCESS_GCP_DEV_CREDENTIALS",
+            )]: opts.stored,
+          }
+        : {},
+    ),
+    writeSecrets: vi.fn(),
+  };
+  const manager = {
+    vault,
+    writeSecrets: vi.fn(),
+    cacheSecrets: vi.fn(),
+    readSecrets: vi.fn(),
+  };
+  const io = { log: vi.fn(), getVaultManager: async () => manager } as any;
+  return { io, manager, vault };
+};
+
+beforeEach(() => {
+  calls.length = 0;
+});
+
+describe("syncLocalAccessServiceAccount", () => {
+  it("adds missing roles, never touches other members, and reads the vault uncached", async () => {
+    const { io, manager, vault } = setup({
+      keys: ["new"],
+      stored: JSON.stringify({ private_key_id: "new" }),
+      bindings: [{ role: "roles/run.admin", members: ["user:x@y.z"] }],
+    });
+    await syncLocalAccessServiceAccount(io, context, "p", [
+      "roles/logging.viewer",
+    ]);
+    expect(
+      calls.filter((c) => c.includes("add-iam-policy-binding")),
+    ).toHaveLength(1);
+    expect(calls.some((c) => c.includes("remove-iam-policy-binding"))).toBe(
+      false,
+    );
+    expect(vault.readAllSecrets).toHaveBeenCalled();
+    expect(manager.readSecrets).not.toHaveBeenCalled();
+  });
+
+  it("reuses a valid stored key (no create, no delete, no vault write)", async () => {
+    const { io, manager } = setup({
+      keys: ["k1"],
+      stored: JSON.stringify({ private_key_id: "k1" }),
+      bindings: [],
+    });
+    await syncLocalAccessServiceAccount(io, context, "p", [
+      "roles/logging.viewer",
+    ]);
+    expect(calls.some((c) => c.includes("keys create"))).toBe(false);
+    expect(calls.some((c) => c.includes("keys delete"))).toBe(false);
+    expect(manager.writeSecrets).not.toHaveBeenCalled();
+  });
+
+  it("removes the account's own undeclared bindings only", async () => {
+    const { io } = setup({
+      keys: ["new"],
+      stored: JSON.stringify({ private_key_id: "new" }),
+      bindings: [
+        { role: "roles/logging.viewer", members: ["SA"] },
+        { role: "roles/run.admin", members: ["SA", "user:x@y.z"] },
+        { role: "roles/editor", members: ["user:x@y.z"] },
+      ],
+    });
+    await syncLocalAccessServiceAccount(io, context, "p", [
+      "roles/logging.viewer",
+    ]);
+    const removes = calls.filter((c) =>
+      c.includes("remove-iam-policy-binding"),
+    );
+    expect(removes).toHaveLength(1);
+    expect(removes[0]).toContain("--role=roles/run.admin");
+    expect(removes[0]).toContain(`--member=${saMember}`);
+    expect(calls.some((c) => c.includes("add-iam-policy-binding"))).toBe(false);
+  });
+
+  it("deletes leftover keys next to a valid stored key", async () => {
+    const { io, manager } = setup({
+      keys: ["k1", "stray"],
+      stored: JSON.stringify({ private_key_id: "k1" }),
+      bindings: [{ role: "roles/logging.viewer", members: ["SA"] }],
+    });
+    await syncLocalAccessServiceAccount(io, context, "p", [
+      "roles/logging.viewer",
+    ]);
+    const deletes = calls.filter((c) => c.includes("keys delete"));
+    expect(deletes).toHaveLength(1);
+    expect(deletes[0]).toContain("keys delete stray ");
+    expect(calls.some((c) => c.includes("keys create"))).toBe(false);
+    expect(manager.writeSecrets).not.toHaveBeenCalled();
+  });
+
+  it("removes bindings and the account when nothing is declared any more", async () => {
+    const { io } = setup({
+      keys: [],
+      bindings: [{ role: "roles/logging.viewer", members: ["SA"] }],
+    });
+    await syncLocalAccessServiceAccount(io, context, "p", []);
+    const removeIdx = calls.findIndex((c) =>
+      c.includes("remove-iam-policy-binding"),
+    );
+    const deleteIdx = calls.findIndex((c) =>
+      c.includes("service-accounts delete"),
+    );
+    expect(removeIdx).toBeGreaterThan(-1);
+    expect(deleteIdx).toBeGreaterThan(removeIdx);
+  });
+
+  it("keeps the vault and old keys untouched when creating the key fails", async () => {
+    const { io, manager } = setup({
+      keys: ["old"],
+      bindings: [{ role: "roles/logging.viewer", members: ["SA"] }],
+    });
+    const inner = responses;
+    responses = (cmd) => {
+      if (cmd.includes("keys create")) throw new Error("quota exceeded");
+      return inner(cmd);
+    };
+    await expect(
+      syncLocalAccessServiceAccount(io, context, "p", ["roles/logging.viewer"]),
+    ).rejects.toThrow("quota exceeded");
+    expect(manager.writeSecrets).not.toHaveBeenCalled();
+    expect(calls.some((c) => c.includes("keys delete"))).toBe(false);
+  });
+
+  it("rotates: stores the new key, then deletes only the old ones", async () => {
+    const { io, manager } = setup({
+      keys: ["old1", "old2", "new"],
+      bindings: [],
+    });
+    await syncLocalAccessServiceAccount(io, context, "p", [
+      "roles/logging.viewer",
+    ]);
+    const create = calls.findIndex((c) => c.includes("keys create"));
+    const deletes = calls.filter((c) => c.includes("keys delete"));
+    expect(create).toBeGreaterThan(-1);
+    expect(deletes).toHaveLength(2);
+    expect(deletes.some((c) => c.includes(" new "))).toBe(false);
+    expect(manager.writeSecrets).toHaveBeenCalledTimes(1);
+    expect(manager.writeSecrets.mock.calls[0][0]).toBe("local");
+  });
+});

package/src/gcloud/localAccess.ts

@@ -0,0 +1,257 @@
+import type { ComponentContext } from "@catladder/pipeline";
+import {
+  diffRoleBindings,
+  getLocalAccessGcpSecretName,
+  getSecretVarName,
+  LOCAL_ACCESS_GCP_SA_NAME,
+} from "@catladder/pipeline";
+import { exec } from "child-process-promise";
+import { mkdtemp, readFile, rm } from "fs/promises";
+import { tmpdir } from "os";
+import { join } from "path";
+import type { IO } from "../core/types";
+import { getGcloudServiceAccountNames } from "./serviceAccountNames";
+import { accountExists } from "./serviceAccounts";
+
+/**
+ * the dedicated read-only service account of a component/env that
+ * `project setup` provisions from the `localAccess` declaration.
+ * Shared with `project doctor` and catenv.
+ */
+export const getLocalAccessServiceAccountNames = (
+  context: ComponentContext,
+  projectId: string,
+) =>
+  getGcloudServiceAccountNames(context, {
+    name: LOCAL_ACCESS_GCP_SA_NAME,
+    projectId,
+  });
+
+type IamBinding = {
+  role: string;
+  members?: string[];
+  condition?: { title?: string; expression?: string };
+};
+
+/**
+ * all unconditional roles bound to `member` in the given iam policy
+ * bindings. Conditional bindings are reported separately, see
+ * {@link getConditionalRolesOfMemberInBindings}.
+ */
+export const getRolesOfMemberInBindings = (
+  bindings: IamBinding[],
+  member: string,
+): string[] =>
+  bindings
+    .filter((binding) => !binding.condition)
+    .filter((binding) => binding.members?.includes(member))
+    .map((binding) => binding.role)
+    .sort();
+
+/**
+ * roles bound to `member` under an iam condition. These cannot be
+ * removed by role name alone, so they are never touched by `project
+ * setup` — only reported.
+ */
+export const getConditionalRolesOfMemberInBindings = (
+  bindings: IamBinding[],
+  member: string,
+): string[] =>
+  bindings
+    .filter((binding) => binding.condition)
+    .filter((binding) => binding.members?.includes(member))
+    .map((binding) => binding.role)
+    .sort();
+
+/**
+ * parses the output of `gcloud iam service-accounts keys create` and
+ * makes sure it is a usable service account key
+ */
+export const parseServiceAccountKey = (
+  raw: string,
+): { key: string; privateKeyId: string } => {
+  let parsed: { private_key_id?: unknown; private_key?: unknown };
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new Error("gcloud did not return a valid service account key");
+  }
+  if (
+    typeof parsed.private_key_id !== "string" ||
+    typeof parsed.private_key !== "string"
+  ) {
+    throw new Error("gcloud did not return a valid service account key");
+  }
+  return { key: raw, privateKeyId: parsed.private_key_id };
+};
+
+const getProjectBindings = async (projectId: string): Promise<IamBinding[]> =>
+  JSON.parse(
+    (await exec(`gcloud projects get-iam-policy ${projectId} --format=json`))
+      .stdout,
+  ).bindings ?? [];
+
+export const listUserManagedKeyIds = async (
+  fullIdentifier: string,
+): Promise<string[]> => {
+  const keys: { name: string }[] = JSON.parse(
+    (
+      await exec(
+        `gcloud iam service-accounts keys list --iam-account=${fullIdentifier} --managed-by=user --format=json`,
+      )
+    ).stdout,
+  );
+  return keys.map((key) => key.name.split("/").pop()!);
+};
+
+/**
+ * makes the account's bindings equal to `roles`: adds missing, removes
+ * everything else (the account is dedicated, every other binding is
+ * drift). Idempotent — a no-op when nothing differs.
+ */
+const syncBindings = async (
+  io: IO,
+  projectId: string,
+  fullIdentifier: string,
+  roles: string[],
+) => {
+  const member = `serviceAccount:${fullIdentifier}`;
+  const bindings = await getProjectBindings(projectId);
+  const conditional = getConditionalRolesOfMemberInBindings(bindings, member);
+  if (conditional.length > 0) {
+    io.log(
+      `⚠️ ${fullIdentifier} has conditional bindings (${conditional.join(", ")}) — setup does not touch them, remove them by hand`,
+    );
+  }
+  const { missing, extra } = diffRoleBindings(
+    roles,
+    getRolesOfMemberInBindings(bindings, member),
+  );
+  for (const role of missing) {
+    io.log(`  + ${role}`);
+    await exec(
+      `gcloud projects add-iam-policy-binding ${projectId} --member=${member} --role=${role} --condition=None`,
+    );
+  }
+  for (const role of extra) {
+    io.log(`  - ${role}`);
+    await exec(
+      `gcloud projects remove-iam-policy-binding ${projectId} --member=${member} --role=${role} --condition=None`,
+    );
+  }
+};
+
+/**
+ * brings the local access service account of a component/env in line
+ * with the declared `roles`:
+ *
+ * - roles declared: account exists, carries exactly these bindings,
+ *   and a key for it is in the secret store (under the `local` env, so
+ *   it is never mirrored to ci). The key is only created when the
+ *   stored one is missing or no longer valid — re-running is a no-op.
+ * - no roles declared: bindings are removed and the account (with its
+ *   keys) deleted if it exists.
+ */
+export const syncLocalAccessServiceAccount = async (
+  io: IO,
+  context: ComponentContext,
+  projectId: string,
+  roles: string[],
+): Promise<void> => {
+  const { fullName, fullIdentifier } = getLocalAccessServiceAccountNames(
+    context,
+    projectId,
+  );
+  const exists = await accountExists(fullIdentifier);
+
+  if (roles.length === 0) {
+    if (exists) {
+      io.log(`local access no longer declared, removing ${fullIdentifier}...`);
+      await syncBindings(io, projectId, fullIdentifier, []);
+      await exec(
+        `gcloud iam service-accounts delete ${fullIdentifier} --quiet --project="${projectId}"`,
+      );
+    }
+    return;
+  }
+
+  if (!exists) {
+    io.log(`creating local access service account ${fullIdentifier}...`);
+    await exec(
+      `gcloud iam service-accounts create ${fullName} --display-name="${context.fullConfig.customerName}-${context.fullConfig.appName} ${context.env}:${context.name} | Catladder local access (read-only)" --project="${projectId}" --description="Read-only access for local use (agents, scripts)"`,
+    );
+  }
+  await syncBindings(io, projectId, fullIdentifier, roles);
+
+  const secretName = getLocalAccessGcpSecretName(context.env);
+  const vaultManager = await io.getVaultManager();
+  const rawName = getSecretVarName("local", context.name, secretName);
+  // straight from the vault, NOT through the local cache: a stale cache
+  // (older than the first setup, or holding an older key) would make us
+  // believe the key is gone, delete the valid one and lock out every
+  // other machine.
+  const stored = (await vaultManager.vault.readAllSecrets(io))[rawName];
+
+  const validKeyIds = await listUserManagedKeyIds(fullIdentifier);
+  let storedKeyId: string | undefined;
+  try {
+    storedKeyId = JSON.parse(stored).private_key_id;
+  } catch {
+    // no (or unparsable) stored key
+  }
+  if (storedKeyId && validKeyIds.includes(storedKeyId)) {
+    // keep the cache in line with the vault
+    await vaultManager.cacheSecrets("local", context.name, {
+      [secretName]: stored,
+    });
+    // at most one key per account: also drop leftovers of a failed run
+    // or keys added by hand
+    await deleteKeys(
+      fullIdentifier,
+      validKeyIds.filter((id) => id !== storedKeyId),
+    );
+    return;
+  }
+
+  io.log("creating local access key...");
+  // create first: a failed create must not leave the vault empty
+  const { key, privateKeyId } = await createServiceAccountKey(fullIdentifier);
+  // straight into the vault, NOT through writeSecretsAndMirror: this
+  // key is for local use only and must never reach ci variables.
+  // A fresh key replaces the old one, a backup would be dead.
+  await vaultManager.writeSecrets(
+    "local",
+    context.name,
+    { [secretName]: key },
+    io,
+    { backup: false },
+  );
+  // only now drop the keys that are not the new one
+  await deleteKeys(
+    fullIdentifier,
+    validKeyIds.filter((id) => id !== privateKeyId),
+  );
+};
+
+const deleteKeys = async (fullIdentifier: string, keyIds: string[]) => {
+  for (const keyId of keyIds) {
+    await exec(
+      `gcloud iam service-accounts keys delete ${keyId} --quiet --iam-account=${fullIdentifier}`,
+    );
+  }
+};
+
+const createServiceAccountKey = async (fullIdentifier: string) => {
+  // a private temp file (0700 folder) instead of /dev/stdout | cat:
+  // the pipe hid gcloud's exit code
+  const folder = await mkdtemp(join(tmpdir(), "catladder-local-access-"));
+  try {
+    const file = join(folder, "key.json");
+    await exec(
+      `gcloud iam service-accounts keys create "${file}" --iam-account=${fullIdentifier}`,
+    );
+    return parseServiceAccountKey(await readFile(file, "utf-8"));
+  } finally {
+    await rm(folder, { recursive: true, force: true });
+  }
+};

package/src/gcloud/serviceAccounts.ts

@@ -9,8 +9,14 @@ export const accountExists = async (fullIdentifier: string) => {
   try {
     await exec(`gcloud iam service-accounts describe ${fullIdentifier}`);
     return true;
-  } catch {
-    return false;
+  } catch (e) {
+    // only a missing account means "does not exist": an auth or
+    // permission error must not look like one (setup would skip the
+    // deletion, doctor would report it missing)
+    if (`${e?.stderr ?? ""}${e?.message ?? ""}`.includes("NOT_FOUND")) {
+      return false;
+    }
+    throw e;
   }
 };
 

package/src/localAccess/__tests__/keyFiles.test.ts

@@ -0,0 +1,166 @@
+import { mkdtemp, mkdir, readFile, stat, writeFile, rm } from "fs/promises";
+import { existsSync } from "fs";
+import { tmpdir } from "os";
+import { join } from "path";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import type { Config } from "@catladder/pipeline";
+import { getSecretVarName } from "@catladder/pipeline";
+
+let root: string;
+vi.mock("../../git/gitProjectInformation", () => ({
+  getProjectRootPath: async () => root,
+}));
+
+import {
+  getLocalAccessKeyFileName,
+  getLocalAccessKeyFileVarName,
+  getLocalAccessKeyFileVars,
+  writeLocalAccessKeyFiles,
+} from "../keyFiles";
+
+const cloudRun = {
+  type: "google-cloudrun",
+  projectId: "p",
+  region: "r",
+} as any;
+
+const config = (extra: Partial<Config>): Config =>
+  ({
+    appName: "app",
+    customerName: "acme",
+    components: { web: { dir: ".", build: false, deploy: cloudRun } },
+    ...extra,
+  }) as Config;
+
+const ioWith = (secrets: Record<string, string>) => {
+  const logs: string[] = [];
+  return {
+    logs,
+    io: {
+      log: (m: string) => logs.push(m),
+      getVaultManager: async () => ({ readSecrets: async () => secrets }),
+    } as any,
+  };
+};
+
+beforeEach(async () => {
+  root = await mkdtemp(join(tmpdir(), "keyfiles-test-"));
+});
+afterEach(async () => {
+  await rm(root, { recursive: true, force: true });
+});
+
+describe("local access key file naming", () => {
+  it("derives a file name per env and component", () => {
+    expect(getLocalAccessKeyFileName("review", "web-app")).toBe(
+      "gcp-review-web_app.json",
+    );
+  });
+  it("exposes the path under a var that is not GOOGLE_APPLICATION_CREDENTIALS", () => {
+    expect(getLocalAccessKeyFileVarName("review")).toBe(
+      "CATLADDER_LOCAL_ACCESS_GCP_REVIEW_KEY_FILE",
+    );
+  });
+});
+
+describe("writeLocalAccessKeyFiles", () => {
+  const secretName = getSecretVarName(
+    "local",
+    "web",
+    "LOCAL_ACCESS_GCP_DEV_CREDENTIALS",
+  );
+  const declared = config({
+    environments: { dev: { localAccess: { gcp: { presets: ["logs"] } } } },
+  });
+
+  it("creates nothing without a declaration", async () => {
+    const { io } = ioWith({});
+    await writeLocalAccessKeyFiles(io, config({}));
+    expect(existsSync(join(root, ".catladder"))).toBe(false);
+  });
+
+  it("does not throw on an invalid declaration", async () => {
+    const { io } = ioWith({});
+    await writeLocalAccessKeyFiles(
+      io,
+      config({ localAccess: { gcp: { roles: ["roles/owner"] } } }),
+    );
+    expect(existsSync(join(root, ".catladder"))).toBe(false);
+  });
+
+  it("writes the key with mode 0600 and removes stale files", async () => {
+    const folder = join(root, ".catladder", "local-access");
+    await mkdir(folder, { recursive: true });
+    await writeFile(join(folder, "stale.json"), "x");
+    const { io } = ioWith({ [secretName]: '{"private_key_id":"a"}' });
+    await writeLocalAccessKeyFiles(io, declared);
+    const file = join(folder, "gcp-dev-web.json");
+    expect(await readFile(file, "utf-8")).toBe('{"private_key_id":"a"}');
+    expect((await stat(file)).mode & 0o777).toBe(0o600);
+    expect(existsSync(join(folder, "stale.json"))).toBe(false);
+  });
+
+  it("warns when the key is missing", async () => {
+    const { io, logs } = ioWith({});
+    await writeLocalAccessKeyFiles(io, declared);
+    expect(logs.join("\n")).toMatch(/no local access key for dev:web/);
+  });
+});
+
+describe("getLocalAccessKeyFileVars", () => {
+  const folder = () => join(root, ".catladder", "local-access");
+  const keyFile = () => join(folder(), "gcp-dev-web.json");
+  const withKey = async () => {
+    await mkdir(folder(), { recursive: true });
+    await writeFile(keyFile(), "{}");
+  };
+  const vertexDev = config({
+    environments: {
+      dev: {
+        localAccess: {
+          gcp: {
+            presets: ["vertex"],
+            credentialsEnvVar: "GOOGLE_APPLICATION_CREDENTIALS",
+          },
+        },
+      },
+    },
+  });
+
+  it("exports existing key files under the catladder var", async () => {
+    await withKey();
+    const c = config({
+      environments: { dev: { localAccess: { gcp: { presets: ["logs"] } } } },
+    });
+    expect(await getLocalAccessKeyFileVars(c, "web")).toEqual({
+      CATLADDER_LOCAL_ACCESS_GCP_DEV_KEY_FILE: keyFile(),
+    });
+  });
+
+  it("also exports the declared credentialsEnvVar", async () => {
+    await withKey();
+    expect(await getLocalAccessKeyFileVars(vertexDev, "web")).toEqual({
+      CATLADDER_LOCAL_ACCESS_GCP_DEV_KEY_FILE: keyFile(),
+      GOOGLE_APPLICATION_CREDENTIALS: keyFile(),
+    });
+  });
+
+  it("exports nothing while the key file is missing", async () => {
+    expect(await getLocalAccessKeyFileVars(vertexDev, "web")).toEqual({});
+  });
+
+  it("skips a conflicting credentialsEnvVar instead of throwing", async () => {
+    await withKey();
+    const c = config({
+      localAccess: {
+        gcp: {
+          presets: ["vertex"],
+          credentialsEnvVar: "GOOGLE_APPLICATION_CREDENTIALS",
+        },
+      },
+    });
+    const vars = await getLocalAccessKeyFileVars(c, "web");
+    expect(vars).not.toHaveProperty("GOOGLE_APPLICATION_CREDENTIALS");
+    expect(vars).toHaveProperty("CATLADDER_LOCAL_ACCESS_GCP_DEV_KEY_FILE");
+  });
+});

package/src/localAccess/declared.ts

@@ -0,0 +1,38 @@
+import type { Config } from "@catladder/pipeline";
+import {
+  getLocalAccessGcpCredentialsEnvVars,
+  getLocalAccessGcpEnvs,
+} from "@catladder/pipeline";
+
+/**
+ * the envs of a component declaring gcp local access. An invalid
+ * declaration yields none instead of throwing: catenv and the vault
+ * cache must keep working (`project doctor` and `project setup` report
+ * the invalid declaration loudly).
+ */
+export const getDeclaredLocalAccessEnvs = (
+  config: Config,
+  componentName: string,
+): string[] => {
+  try {
+    return getLocalAccessGcpEnvs(config, componentName);
+  } catch {
+    return [];
+  }
+};
+
+/**
+ * the declared `credentialsEnvVar` names of a component, mapped to their
+ * env. Empty instead of throwing on an invalid declaration, see
+ * {@link getDeclaredLocalAccessEnvs}.
+ */
+export const getDeclaredLocalAccessCredentialsEnvVars = (
+  config: Config,
+  componentName: string,
+): Record<string, string> => {
+  try {
+    return getLocalAccessGcpCredentialsEnvVars(config, componentName);
+  } catch {
+    return {};
+  }
+};