@codyswann/lisa 4.29.2 → 4.29.4

package/plugins/src/base/skills/lisa-secrets-access/scripts/aws-bootstrap.mjs

@@ -28,6 +28,8 @@
  * @module aws-bootstrap
  */
 
+import { assertOwner } from "./owner.mjs";
+
 /** The names every AWS SDK and the CLI actually read. */
 const ACCESS_KEY = "AWS_ACCESS_KEY_ID";
 const SECRET_KEY = "AWS_SECRET_ACCESS_KEY";
@@ -40,13 +42,93 @@ const PROFILE = "AWS_PROFILE";
 export const BOOTSTRAP_KEY = "LISA_AWS_BOOTSTRAP_JSON";
 
 /**
- * The profile that holds the bootstrap key pair and is assumed FROM.
+ * EMIT vs RESOLVE — read this before touching either name below.
+ *
+ * These are two different guarantees, they expire on two different conditions,
+ * and conflating them is how a temporary shim becomes permanent by accident.
+ *
+ * **EMIT** is what this writer produces as its canonical output. Exactly one
+ * shape is ever emitted as canonical: `<owner>-<stage>`, assuming from
+ * `<owner>-lisa-bootstrap`. That is the fix for the cross-project collision and
+ * it has no expiry.
+ *
+ * **RESOLVE** is the wider set of names that must keep working for READERS
+ * during a migration. It currently includes the bare `<stage>` family, which
+ * this writer emits only as a deprecated alias beside the canonical output —
+ * never as canonical output itself.
+ *
+ * A reader who mistakes the second for the first will conclude that Lisa still
+ * emits bare names and that the rename never happened. It did: every canonical
+ * name is owned, and `emitSourceProfileFor` is the only thing that names a
+ * source profile in canonical output.
+ */
+
+/**
+ * The tail of the EMITTED profile that holds the key pair and is assumed FROM.
  *
  * Named rather than `default` so it can never be picked up by accident: this
  * identity can assume roles and do nothing else, so a call that silently ran as
  * it would fail with a permissions error far from its cause.
+ *
+ * A SUFFIX rather than the whole name, because one fixed name is one shared
+ * slot. Two tenants on a workstation both wrote `[lisa-bootstrap]`, so the
+ * second run's key pair replaced the first's and the first tenant's profiles
+ * then assumed their roles from the second tenant's identity — which either
+ * fails confusingly or, where a trust policy is permissive, succeeds.
  */
-export const SOURCE_PROFILE = "lisa-bootstrap";
+export const EMITTED_SOURCE_PROFILE_SUFFIX = "lisa-bootstrap";
+
+/**
+ * A name kept RESOLVING for unmigrated readers. Never emitted as canonical.
+ * **DEPRECATED — this constant exists only to be deleted.**
+ *
+ * Generators outside this repository emit the bare `<stage>` profile family and
+ * this bare source profile independently, and scripts and documentation in
+ * caller repositories name them directly. Nothing co-ordinates a rename across
+ * those repositories, so switching this writer to the owned names alone would
+ * leave writer and reader disagreeing: a bare `[profile <stage>]` whose
+ * `source_profile = lisa-bootstrap` would point at a section that no longer
+ * exists, and every call through it would fail to resolve.
+ *
+ * So the owned names are EMITTED as canonical and these bare names are kept
+ * RESOLVING beside them, both generated from one bundle in one pass. This
+ * constant is never used to decide what canonical output looks like, and it is
+ * not used to attribute a block either — ownership is read from the `owner=`
+ * marker tag, and a pre-ownership block is attributed by the accounts in its
+ * role ARNs. Its only job is the resolve path.
+ *
+ * **The window is not a fix, and this comment must not read like one.** The
+ * bare family is a single shared slot on a machine that may serve several
+ * projects — which is precisely the collision the owned names remove. During
+ * the window that collision is unfixed ON THE RESOLVE PATH ONLY: these names
+ * are claimed when unclaimed or already ours, and refused by name when another
+ * project holds them, so the failure is loud rather than silent, but two
+ * projects still cannot both have them. The emitted names are always correct;
+ * these are correct for at most one project per machine.
+ *
+ * **Removal condition — stated against the RESOLVE path, because that is the
+ * only thing that expires.** Delete this constant and every use of it once no
+ * caller repository *resolves* the bare family: that is, once nothing outside
+ * this repository names `<stage>` or `lisa-bootstrap` when selecting a profile.
+ * A caller proves it no longer resolves them by selecting only
+ * `<namespace>-<stage>`; `LISA_SECRETS_NO_LEGACY_PROFILES=1` lets one opt out
+ * ahead of the removal and take the isolation immediately. Nothing about the
+ * emit path changes when this is deleted, because the emit path never used it.
+ */
+export const RESOLVE_ONLY_LEGACY_SOURCE_PROFILE = EMITTED_SOURCE_PROFILE_SUFFIX;
+
+/**
+ * The source profile this writer EMITS for one owner, as canonical output.
+ *
+ * The only function that names a source profile in canonical output. If a
+ * canonical section ever assumes from something this did not return, the emit
+ * path has regressed.
+ * @param {string} owner Validated owner.
+ * @returns {string} The owner's emitted source-profile name.
+ */
+export function emitSourceProfileFor(owner) {
+  return `${owner}-${EMITTED_SOURCE_PROFILE_SUFFIX}`;
+}
 
 /**
  * Read the bundle's `profiles`, which may be an object OR a JSON string.
@@ -86,11 +168,27 @@ export function readProfiles(bundle) {
  * environment credentials OUTRANK `AWS_PROFILE`, so a session that exports them
  * ignores whichever profile it selects — the profiles would exist and never be
  * used.
+ *
+ * Every name is prefixed with the OWNER. The bundle's keys name a stage and
+ * nothing else, and the kit deliberately keeps role names identical across
+ * accounts so profiles differ only by account id — correct within one tenant,
+ * and the removal of the only distinguishing feature across two. Prefixing
+ * makes the wrong resolution impossible rather than merely detectable, which is
+ * the same fix #3440 applied to the sibling remote-agent writer; a workstation
+ * carrying both now sees one convention instead of two.
+ *
+ * The `resolveOnly` half is rendered SEPARATELY, and returned rather than merged,
+ * so
+ * the installer can drop it as a unit after looking at the filesystem — which
+ * this function deliberately cannot see. See `RESOLVE_ONLY_LEGACY_SOURCE_PROFILE` for why
+ * that half exists at all and when it goes away.
  * @param {object} bundle Parsed bootstrap bundle.
- * @returns {{credentials: string, config: string, profiles: string[]}|null}
- *   Rendered file contents and the profile names, or null when unusable.
+ * @param {string} owner Tenant these profiles belong to.
+ * @returns {{credentials: string, config: string, profiles: string[], resolveOnly: {credentials: string, config: string, profiles: string[], sourceProfile: string}}|null}
+ *   Rendered file contents, the profile names, and the deprecated
+ *   bare-named half; or null when the bundle is unusable.
  */
-export function renderAwsProfiles(bundle) {
+export function renderAwsProfiles(bundle, owner) {
   if (!bundle) return null;
 
   const accessKeyId = bundle.accessKeyId ?? bundle.aws_access_key_id;
@@ -98,10 +196,15 @@ export function renderAwsProfiles(bundle) {
     bundle.secretAccessKey ?? bundle.aws_secret_access_key;
   if (!accessKeyId || !secretAccessKey) return null;
 
+  // Checked AFTER the bundle is known usable, so a surface with no bundle at
+  // all still returns null rather than failing over a missing owner it was
+  // never going to use.
+  const scope = assertOwner(owner, "~/.aws");
+  const sourceProfile = emitSourceProfileFor(scope);
   const profiles = readProfiles(bundle);
 
   const credentials = [
-    `[${SOURCE_PROFILE}]`,
+    `[${sourceProfile}]`,
     `aws_access_key_id = ${accessKeyId}`,
     `aws_secret_access_key = ${secretAccessKey}`,
     "",
@@ -109,28 +212,105 @@ export function renderAwsProfiles(bundle) {
 
   const sections = [];
   const names = [];
-  for (const [name, entry] of Object.entries(profiles)) {
+  const resolveOnlySections = [];
+  const resolveOnlyNames = [];
+  for (const [stage, entry] of Object.entries(profiles)) {
     const roleArn = entry?.roleArn ?? entry?.role_arn;
     if (!roleArn) continue;
 
+    assertDeclaredAccount(stage, entry, roleArn);
+
+    const name = `${scope}-${stage}`;
     // A name is only usable if it can be written as an ini section header and
     // read back as the same string. Anything with a bracket or newline would
     // either truncate or inject extra lines into ~/.aws/config, and a config
-    // file this corrupts is worse than one it never wrote.
+    // file this corrupts is worse than one it never wrote. Checked on the FULL
+    // name, since that is the string that becomes the header.
     if (!/^[\w.@-]+$/.test(name)) continue;
 
-    const lines = [`[profile ${name}]`, `role_arn = ${roleArn}`];
-    lines.push(`source_profile = ${SOURCE_PROFILE}`);
-    if (bundle.externalId) lines.push(`external_id = ${bundle.externalId}`);
-    if (entry.region) lines.push(`region = ${entry.region}`);
-    sections.push(`${lines.join("\n")}\n`);
+    sections.push(
+      `${profileSection(name, roleArn, sourceProfile, bundle, entry)}\n`
+    );
     // Collected here, where the name is already in scope. Recovering it by
     // re-parsing the rendered text made the header format load-bearing: a
     // change to it would silently corrupt every returned name.
     names.push(name);
+
+    // The deprecated twin, generated from the SAME bundle in the same pass.
+    // Regenerating both from one source is what makes them incapable of
+    // drifting apart; a hand-maintained second copy would be a new defect.
+    if (!/^[\w.@-]+$/.test(stage)) continue;
+    resolveOnlySections.push(
+      `${profileSection(stage, roleArn, RESOLVE_ONLY_LEGACY_SOURCE_PROFILE, bundle, entry)}\n`
+    );
+    resolveOnlyNames.push(stage);
   }
 
-  return { credentials, config: sections.join("\n"), profiles: names };
+  return {
+    credentials,
+    config: sections.join("\n"),
+    profiles: names,
+    resolveOnly: {
+      credentials: [
+        `[${RESOLVE_ONLY_LEGACY_SOURCE_PROFILE}]`,
+        `aws_access_key_id = ${accessKeyId}`,
+        `aws_secret_access_key = ${secretAccessKey}`,
+        "",
+      ].join("\n"),
+      config: resolveOnlySections.join("\n"),
+      profiles: resolveOnlyNames,
+      sourceProfile: RESOLVE_ONLY_LEGACY_SOURCE_PROFILE,
+    },
+  };
+}
+
+/**
+ * One `[profile …]` section.
+ *
+ * Shared by the canonical and the deprecated renderer so the two cannot differ
+ * in anything but their names — the resolve-only profile must reach the same
+ * role, with the same external id and region, or it is not a shim but a
+ * second, subtly different credential.
+ * @param {string} name Section name.
+ * @param {string} roleArn The role to assume.
+ * @param {string} sourceProfile The profile holding the key pair.
+ * @param {object} bundle The bundle, for `externalId`.
+ * @param {object} entry The stage entry, for `region`.
+ * @returns {string} The rendered section.
+ */
+function profileSection(name, roleArn, sourceProfile, bundle, entry) {
+  const lines = [`[profile ${name}]`, `role_arn = ${roleArn}`];
+  lines.push(`source_profile = ${sourceProfile}`);
+  if (bundle.externalId) lines.push(`external_id = ${bundle.externalId}`);
+  if (entry.region) lines.push(`region = ${entry.region}`);
+  return lines.join("\n");
+}
+
+/**
+ * Refuse a stage whose declared account contradicts its own role ARN.
+ *
+ * This writer never contacts AWS — it runs during container setup, before a
+ * task exists and often before network policy would allow the call — so the
+ * live `sts:GetCallerIdentity` comparison #3440 added is not available here.
+ * What IS available is the bundle's own statement about itself: a stage may
+ * declare `expectedAccountId`, and a declaration that disagrees with the
+ * account embedded in the role ARN is a bundle that cannot be right either way.
+ * Catching it before the write costs nothing and is the only identity assertion
+ * this surface can make offline.
+ * @param {string} stage The bundle key.
+ * @param {object} entry The stage's entry.
+ * @param {string} roleArn The role ARN about to be written.
+ */
+function assertDeclaredAccount(stage, entry, roleArn) {
+  const declared = entry?.expectedAccountId;
+  if (!declared) return;
+  const inArn = String(roleArn).split(":")[4];
+  if (String(declared) === inArn) return;
+  throw new Error(
+    `bootstrap stage "${stage}" declares expectedAccountId ${declared}, but ` +
+      `its roleArn names account ${inArn}. Refusing to write a profile whose ` +
+      `own bundle contradicts itself; nothing was changed.`
+  );
 }
 
 /**
@@ -157,10 +337,16 @@ export function parseBootstrap(raw) {
  *
  * Returns only additions; the caller merges. Nothing here mutates its input,
  * so a caller can decide what to do with the result — including reporting it.
+ * Takes the owner for one reason: `AWS_PROFILE` must name a profile that was
+ * actually written. Prefixing the written names without prefixing the derived
+ * selection would set `AWS_PROFILE=agent-dev` against a config that now defines
+ * `acme-agent-dev`, reintroducing the "profile not found" failure this module
+ * exists to remove.
  * @param {Map<string, {value: string}>} selected Secrets by exact name.
+ * @param {string} owner Tenant these secrets belong to.
  * @returns {Map<string, {value: string, note: string}>} Derived variables.
  */
-export function deriveAwsEnvironment(selected) {
+export function deriveAwsEnvironment(selected, owner) {
   const derived = new Map();
   const bundle = parseBootstrap(selected.get(BOOTSTRAP_KEY)?.value);
   if (!bundle) return derived;
@@ -195,7 +381,7 @@ export function deriveAwsEnvironment(selected) {
   // that ~/.aws/config never contains — an entry with no roleArn, or a name too
   // exotic to be an ini header — fails with "profile not found", which is the
   // exact failure this whole change removes.
-  const names = renderAwsProfiles(bundle)?.profiles ?? [];
+  const names = renderAwsProfiles(bundle, owner)?.profiles ?? [];
 
   // No usable profiles is not a reason to hand back a session with NOTHING.
   //