@codyswann/lisa 4.21.6 → 4.22.2

package/plugins/src/base/skills/lisa-secrets-access/scripts/publish-aws-bootstrap.mjs

@@ -11,11 +11,13 @@
  *
  * This command makes that handoff one fail-closed operation:
  *
- * 1. prove the existing provider record is writable with a no-op write;
- * 2. validate the candidate and assume every declared role with it;
- * 3. replace the provider value;
- * 4. read the value back exactly and assume every role again; and
- * 5. restore the previous provider value if a post-write check fails.
+ * 1. acquire a provider-backed lock for the exact bundle record;
+ * 2. re-read and prove the record is writable with a no-op write;
+ * 3. validate the candidate and assume every declared role with it;
+ * 4. replace the provider value;
+ * 5. read the value back exactly and assume every role again;
+ * 6. restore the previous value if a post-write check fails; and
+ * 7. release the lock only after publication or rollback is complete.
  *
  * The candidate arrives on stdin so it never appears in a shell command or a
  * temporary file. No credential value is written to stdout or stderr.
@@ -28,6 +30,7 @@
  * @module publish-aws-bootstrap
  */
 
+import { randomUUID } from "node:crypto";
 import { readFileSync, realpathSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 
@@ -36,7 +39,14 @@ import {
   parseBootstrap,
   readProfiles,
 } from "./aws-bootstrap.mjs";
-import { fetchAll, writeSecret } from "./providers.mjs";
+import {
+  COORDINATION_KEY_PREFIX,
+  createCoordinationRecord,
+  fetchAll,
+  fetchRaw as providerFetchRaw,
+  removeCoordinationRecord,
+  writeSecret,
+} from "./providers.mjs";
 import { readConfig } from "./surfaces.mjs";
 
 import { boundedChildOutput } from "../../lisa-setup-workstation/scripts/bounded-child.mjs";
@@ -44,6 +54,8 @@ import { boundedChildOutput } from "../../lisa-setup-workstation/scripts/bounded
 const PROFILE_NAME = /^[\w.@-]+$/;
 const ROLE_ARN =
   /^arn:(?:aws|aws-us-gov|aws-cn):iam::\d{12}:role\/[\w+=,.@/-]+$/;
+const PUBLICATION_COORDINATION_SCOPE = "AWS_BOOTSTRAP_";
+const PUBLICATION_LOCK_TTL_MS = 30 * 60 * 1000;
 
 /**
  * Validate and normalize one complete bundle without changing its serialized
@@ -188,7 +200,7 @@ export function verifyAwsBootstrap(candidate, run = boundedChildOutput) {
  * Locate the provider record that owns the bundle.
  * @param {object} cfg Resolved lisa-secrets-access configuration.
  * @param {(cfg: object) => Map<string, object>} fetch Provider reader.
- * @returns {{id: string, value: string}} Writable provider entry.
+ * @returns {{id: string, value: string, projectId: string|null}} Writable provider entry.
  */
 function currentEntry(cfg, fetch) {
   const entry = fetch(cfg).get(BOOTSTRAP_KEY);
@@ -202,32 +214,272 @@ function currentEntry(cfg, fetch) {
       `${BOOTSTRAP_KEY} has no provider identifier, so it cannot be published`
     );
   }
-  return { id: entry.id, value: entry.value };
+  return {
+    id: entry.id,
+    value: entry.value,
+    projectId: entry.projectId ?? null,
+  };
+}
+
+function firstLine(error) {
+  return (error instanceof Error ? error.message : String(error)).split(
+    "\n"
+  )[0];
+}
+
+function lockPrefix(targetId) {
+  return `${COORDINATION_KEY_PREFIX}${PUBLICATION_COORDINATION_SCOPE}${targetId}_`;
+}
+
+function deleteCoordination(cfg, row, fetchRaw, remove) {
+  remove(cfg, row.id);
+  if (fetchRaw(cfg).some(candidate => candidate.id === row.id)) {
+    throw new Error(
+      `publication lock ${row.id} is still present after deletion`
+    );
+  }
+}
+
+function writeProviderValue(cfg, id, value, write) {
+  try {
+    write(cfg, id, value);
+  } catch (error) {
+    const status =
+      typeof error === "object" &&
+      error !== null &&
+      Number.isInteger(error.status)
+        ? ` (exit ${error.status})`
+        : "";
+    // `bws secret edit` has no stdin form, so the value is present in argv and
+    // therefore in Node's child-process error message. Never propagate that
+    // message: doing so would print the credential this command protects.
+    throw new Error(`provider write command failed${status}`);
+  }
 }
 
 /**
- * Exercise the exact provider write permission without changing its value.
+ * Enter the provider election for one AWS bootstrap record.
+ *
+ * Every publisher creates a unique contender. The provider's creation time,
+ * with its immutable id as a tie-breaker, elects exactly one oldest active
+ * contender. Unlike a read-then-create mutex, no participant can overwrite or
+ * mistake another participant's record for its own.
  * @param {object} cfg Resolved configuration.
+ * @param {{id: string, projectId: string|null}} target Target provider entry.
  * @param {object} [operations] Injectable provider operations for tests.
- * @returns {{id: string, value: string}} Current provider entry.
+ * @returns {object} The winning coordination row.
  */
-export function preflightAwsBootstrap(cfg, operations = {}) {
+export function acquirePublicationLock(cfg, target, operations = {}) {
+  if (!target.projectId) {
+    throw new Error(
+      `${BOOTSTRAP_KEY} has no provider project identifier, so publication cannot be serialized`
+    );
+  }
+
+  const create = operations.createCoordination ?? createCoordinationRecord;
+  const fetchRaw = operations.fetchRaw ?? providerFetchRaw;
+  const remove = operations.removeCoordination ?? removeCoordinationRecord;
+  const holderId = (operations.holderId ?? randomUUID)();
+  const prefix = lockPrefix(target.id);
+  const key = `${prefix}${holderId}`;
+  let contender;
+
+  try {
+    contender = create(
+      cfg,
+      key,
+      target.projectId,
+      "Lisa AWS bootstrap publication contender; expires after 30 minutes"
+    );
+  } catch (error) {
+    throw new Error(`publication lock creation failed: ${firstLine(error)}`);
+  }
+
+  if (!contender?.id || contender.key !== key) {
+    if (contender?.id) {
+      try {
+        deleteCoordination(cfg, contender, fetchRaw, remove);
+      } catch {
+        // The validation failure below remains the actionable root cause.
+      }
+    }
+    throw new Error("provider returned an invalid publication lock contender");
+  }
+
+  let rows;
+  try {
+    rows = fetchRaw(cfg).filter(
+      row =>
+        row.projectId === target.projectId &&
+        typeof row.key === "string" &&
+        row.key.startsWith(prefix)
+    );
+  } catch (error) {
+    try {
+      deleteCoordination(cfg, contender, fetchRaw, remove);
+    } catch (cleanupError) {
+      throw new Error(
+        `publication lock read failed: ${firstLine(error)}; contender cleanup failed: ${firstLine(cleanupError)}`
+      );
+    }
+    throw new Error(`publication lock read failed: ${firstLine(error)}`);
+  }
+
+  const visible = rows.find(row => row.id === contender.id);
+  if (!visible) {
+    try {
+      deleteCoordination(cfg, contender, fetchRaw, remove);
+    } catch (cleanupError) {
+      throw new Error(
+        `the publication lock contender could not be observed after creation; contender cleanup failed: ${firstLine(cleanupError)}`
+      );
+    }
+    throw new Error(
+      "the publication lock contender could not be observed after creation"
+    );
+  }
+
+  const providerNow = Date.parse(visible.creationDate ?? "");
+  if (!Number.isFinite(providerNow)) {
+    try {
+      deleteCoordination(cfg, contender, fetchRaw, remove);
+    } catch (cleanupError) {
+      throw new Error(
+        `the publication lock contender has no valid provider creation time; contender cleanup failed: ${firstLine(cleanupError)}`
+      );
+    }
+    throw new Error(
+      "the publication lock contender has no valid provider creation time"
+    );
+  }
+
+  const active = [];
+  for (const row of rows) {
+    const createdAt = Date.parse(row.creationDate ?? "");
+    if (!Number.isFinite(createdAt)) {
+      try {
+        deleteCoordination(cfg, contender, fetchRaw, remove);
+      } catch (cleanupError) {
+        throw new Error(
+          `publication lock ${row.id ?? "without an id"} has no valid provider creation time; contender cleanup failed: ${firstLine(cleanupError)}`
+        );
+      }
+      throw new Error(
+        `publication lock ${row.id ?? "without an id"} has no valid provider creation time`
+      );
+    }
+    // Compare provider time with provider time. A remote host whose wall clock
+    // is skewed must not be able to expire another host's active publication.
+    if (createdAt <= providerNow - PUBLICATION_LOCK_TTL_MS) {
+      try {
+        deleteCoordination(cfg, row, fetchRaw, remove);
+      } catch (error) {
+        throw new Error(
+          `expired publication lock cleanup failed: ${firstLine(error)}`
+        );
+      }
+      continue;
+    }
+    active.push({ row, createdAt });
+  }
+
+  active.sort(
+    (left, right) =>
+      left.createdAt - right.createdAt ||
+      String(left.row.id).localeCompare(String(right.row.id))
+  );
+  if (active[0]?.row.id !== contender.id) {
+    try {
+      deleteCoordination(cfg, contender, fetchRaw, remove);
+    } catch (error) {
+      throw new Error(
+        `another publisher holds the provider lock; contender cleanup failed: ${firstLine(error)}`
+      );
+    }
+    throw new Error("another publisher holds the provider lock");
+  }
+
+  return { ...visible, targetId: target.id };
+}
+
+/**
+ * Delete a publication contender and prove the provider no longer lists it.
+ * @param {object} cfg Resolved configuration.
+ * @param {{id: string}} lock Acquired coordination row.
+ * @param {object} [operations] Injectable provider operations for tests.
+ */
+export function releasePublicationLock(cfg, lock, operations = {}) {
+  const fetchRaw = operations.fetchRaw ?? providerFetchRaw;
+  const remove = operations.removeCoordination ?? removeCoordinationRecord;
+  deleteCoordination(cfg, lock, fetchRaw, remove);
+}
+
+/**
+ * Hold the provider lock around an entire publication or preflight operation.
+ * The target is deliberately refreshed after acquisition so a pre-lock
+ * snapshot can never overwrite a publication that finished while this process
+ * was entering the election.
+ */
+function withPublicationLock(cfg, operations, task) {
   const fetch = operations.fetch ?? fetchAll;
-  const write = operations.write ?? writeSecret;
-  const entry = currentEntry(cfg, fetch);
+  const acquire = operations.acquireLock ?? acquirePublicationLock;
+  const release = operations.releaseLock ?? releasePublicationLock;
+  const target = currentEntry(cfg, fetch);
+  const lock = acquire(cfg, target, operations);
+  let result;
+  let taskError;
+
   try {
-    write(cfg, entry.id, entry.value);
+    const current = currentEntry(cfg, fetch);
+    if (current.id !== target.id || current.projectId !== target.projectId) {
+      throw new Error(
+        `${BOOTSTRAP_KEY} moved after publication lock acquisition; retry from the new provider record`
+      );
+    }
+    result = task(current);
+  } catch (error) {
+    taskError = error;
+  }
+
+  try {
+    release(cfg, lock, operations);
+  } catch (releaseError) {
+    const releaseReason = `publication lock release failed: ${firstLine(releaseError)}`;
+    if (taskError) {
+      throw new Error(`${firstLine(taskError)}; ${releaseReason}`);
+    }
+    throw new Error(releaseReason);
+  }
+
+  if (taskError) throw taskError;
+  return result;
+}
+
+function preflightUnderLock(cfg, entry, write) {
+  try {
+    writeProviderValue(cfg, entry.id, entry.value, write);
   } catch (error) {
-    const reason =
-      error instanceof Error ? error.message.split("\n")[0] : String(error);
     throw new Error(
-      `no write access to ${BOOTSTRAP_KEY}: ${reason}\n` +
+      `no write access to ${BOOTSTRAP_KEY}: ${firstLine(error)}\n` +
         `Refusing to continue because a rotated key that cannot be published would strand every remote session.`
     );
   }
   return entry;
 }
 
+/**
+ * Exercise the exact provider write permission without changing its value.
+ * @param {object} cfg Resolved configuration.
+ * @param {object} [operations] Injectable provider operations for tests.
+ * @returns {{id: string, value: string}} Current provider entry.
+ */
+export function preflightAwsBootstrap(cfg, operations = {}) {
+  const write = operations.write ?? writeSecret;
+  return withPublicationLock(cfg, operations, entry =>
+    preflightUnderLock(cfg, entry, write)
+  );
+}
+
 /**
  * Restore the previous provider value and prove the restoration.
  * @param {object} cfg Resolved configuration.
@@ -243,7 +495,7 @@ function rollback(cfg, previous, candidateRaw, fetch, write) {
     if (current.value !== candidateRaw) {
       return "rollback skipped because the provider changed after this publication";
     }
-    write(cfg, previous.id, previous.value);
+    writeProviderValue(cfg, previous.id, previous.value, write);
     const restored = currentEntry(cfg, fetch);
     if (restored.value !== previous.value) {
       return "the previous provider value could not be verified after rollback";
@@ -268,46 +520,48 @@ export function publishAwsBootstrap(raw, cfg, operations = {}) {
   const fetch = operations.fetch ?? fetchAll;
   const write = operations.write ?? writeSecret;
   const verify = operations.verify ?? verifyAwsBootstrap;
-  const previous = preflightAwsBootstrap(cfg, { fetch, write });
   const candidate = validateAwsBootstrap(raw);
+  return withPublicationLock(cfg, operations, previous => {
+    preflightUnderLock(cfg, previous, write);
 
-  // Verify before the write. A candidate that cannot assume one of its roles
-  // never becomes the value every new remote session receives.
-  verify(candidate);
+    // Verify before the write. A candidate that cannot assume one of its roles
+    // never becomes the value every new remote session receives.
+    verify(candidate);
 
-  if (candidate.raw === previous.value) {
-    return {
-      changed: false,
-      profiles: candidate.profiles.map(profile => profile.name),
-    };
-  }
+    if (candidate.raw === previous.value) {
+      return {
+        changed: false,
+        profiles: candidate.profiles.map(profile => profile.name),
+      };
+    }
 
-  try {
-    write(cfg, previous.id, candidate.raw);
-    const stored = currentEntry(cfg, fetch);
-    if (stored.value !== candidate.raw) {
-      throw new Error("provider read-back did not match the candidate exactly");
+    try {
+      writeProviderValue(cfg, previous.id, candidate.raw, write);
+      const stored = currentEntry(cfg, fetch);
+      if (stored.value !== candidate.raw) {
+        throw new Error(
+          "provider read-back did not match the candidate exactly"
+        );
+      }
+      const storedCandidate = validateAwsBootstrap(stored.value);
+      verify(storedCandidate);
+      return {
+        changed: true,
+        profiles: storedCandidate.profiles.map(profile => profile.name),
+      };
+    } catch (error) {
+      const rollbackOutcome = rollback(
+        cfg,
+        previous,
+        candidate.raw,
+        fetch,
+        write
+      );
+      throw new Error(
+        `${BOOTSTRAP_KEY} publication failed: ${firstLine(error)}; ${rollbackOutcome}`
+      );
     }
-    const storedCandidate = validateAwsBootstrap(stored.value);
-    verify(storedCandidate);
-    return {
-      changed: true,
-      profiles: storedCandidate.profiles.map(profile => profile.name),
-    };
-  } catch (error) {
-    const reason =
-      error instanceof Error ? error.message.split("\n")[0] : String(error);
-    const rollbackOutcome = rollback(
-      cfg,
-      previous,
-      candidate.raw,
-      fetch,
-      write
-    );
-    throw new Error(
-      `${BOOTSTRAP_KEY} publication failed: ${reason}; ${rollbackOutcome}`
-    );
-  }
+  });
 }
 
 /** Read a candidate from stdin without ever placing it in argv. */

package/plugins/src/base/skills/lisa-setup-remote-aws/SKILL.md

@@ -56,9 +56,12 @@ which is current. Treat the infrastructure secret as a short-lived deployment
 emission and the configured provider as the consumer-facing source of truth.
 
 Publish the emission as part of the same rotation automation. The publisher
-reads the candidate on stdin, proves every role before writing, reads the
-provider value back exactly, proves every stored role again, and restores the
-previous provider value if a post-write check fails:
+reads the candidate on stdin, acquires a provider-backed lock for the exact
+bundle record, re-reads the current value after winning, proves every role
+before writing, reads the provider value back exactly, proves every stored role
+again, and restores the previous provider value if a post-write check fails.
+The lock remains held through rollback and its deletion is verified before the
+command reports success:
 
 ```bash
 aws --profile shared secretsmanager get-secret-value \
@@ -73,10 +76,24 @@ Resolve the script from the installed runtime or `node_modules` when the
 argument or temporary file. A CDK deployment followed later by a human copy is
 not a completed rotation.
 
+The current publisher supports Bitwarden writes. It creates a temporary,
+non-secret contender in the bundle's Bitwarden project, elects the oldest
+active contender using provider-issued creation metadata, and removes the
+contender when the transaction finishes. A contender expires after 30 minutes
+so a killed publisher cannot block future rotations forever. The service
+account therefore needs create and delete access as well as read and edit
+access; `preflight` proves that complete lifecycle without changing the bundle.
+
+Normal remote-session setup is read-only. It refreshes the already-published
+bundle but does not enter the publisher election or mutate Bitwarden, so two
+containers starting together cannot cause this publication race.
+
 **One provider cannot serve this particular secret.** If `secrets.provider` is
 `aws`, reading the bundle requires AWS credentials — and the bundle *is* the AWS
 credential. Anything else works: Bitwarden, 1Password, Doppler, Vault, or a
 platform secret store. Pick the one that is not the thing being bootstrapped.
+Automated publication additionally requires a provider with an implemented
+write and coordination path; that is currently Bitwarden.
 
 On a surface that materializes (see `lisa-secrets-access`), the bundle arrives
 in `secrets.env` with everything else, so the project hook can run this setup