@factiii/stack 0.1.30 → 0.1.32
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/bin/stack +3 -3
- package/dist/plugins/pipelines/aws/scanfix/aws-cli.d.ts.map +1 -1
- package/dist/plugins/pipelines/aws/scanfix/aws-cli.js +67 -10
- package/dist/plugins/pipelines/aws/scanfix/aws-cli.js.map +1 -1
- package/dist/plugins/pipelines/aws/scanfix/credentials.d.ts +8 -1
- package/dist/plugins/pipelines/aws/scanfix/credentials.d.ts.map +1 -1
- package/dist/plugins/pipelines/aws/scanfix/credentials.js +173 -43
- package/dist/plugins/pipelines/aws/scanfix/credentials.js.map +1 -1
- package/package.json +1 -1
package/bin/stack
CHANGED
|
@@ -36,11 +36,11 @@ program
|
|
|
36
36
|
await init(options);
|
|
37
37
|
});
|
|
38
38
|
|
|
39
|
-
// Default action:
|
|
39
|
+
// Default action: run scan when no subcommand provided (self-bootstrapping)
|
|
40
40
|
program
|
|
41
|
-
.action((options, command) => {
|
|
41
|
+
.action(async (options, command) => {
|
|
42
42
|
if (command.args.length === 0) {
|
|
43
|
-
|
|
43
|
+
await scan({});
|
|
44
44
|
}
|
|
45
45
|
});
|
|
46
46
|
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"aws-cli.d.ts","sourceRoot":"","sources":["../../../../../src/plugins/pipelines/aws/scanfix/aws-cli.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,KAAK,EAAiB,GAAG,EAAE,MAAM,4BAA4B,CAAC;
|
|
1
|
+
{"version":3,"file":"aws-cli.d.ts","sourceRoot":"","sources":["../../../../../src/plugins/pipelines/aws/scanfix/aws-cli.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,KAAK,EAAiB,GAAG,EAAE,MAAM,4BAA4B,CAAC;AAmErE,eAAO,MAAM,WAAW,EAAE,GAAG,EAqB5B,CAAC"}
|
|
@@ -6,6 +6,62 @@
|
|
|
6
6
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
7
7
|
exports.awsCliFixes = void 0;
|
|
8
8
|
const child_process_1 = require("child_process");
|
|
9
|
+
const aws_helpers_js_1 = require("../utils/aws-helpers.js");
|
|
10
|
+
/**
|
|
11
|
+
* Check if any environment uses AWS pipeline
|
|
12
|
+
*/
|
|
13
|
+
function hasAwsPipeline(config) {
|
|
14
|
+
if (config.aws)
|
|
15
|
+
return true;
|
|
16
|
+
// eslint-disable-next-line @typescript-eslint/no-require-imports
|
|
17
|
+
const { extractEnvironments } = require('../../../../utils/config-helpers.js');
|
|
18
|
+
const environments = extractEnvironments(config);
|
|
19
|
+
return Object.values(environments).some((e) => e.pipeline === 'aws' ||
|
|
20
|
+
e.access_key_id);
|
|
21
|
+
}
|
|
22
|
+
/**
|
|
23
|
+
* Auto-install AWS CLI based on platform
|
|
24
|
+
*/
|
|
25
|
+
function installAwsCli() {
|
|
26
|
+
const platform = process.platform;
|
|
27
|
+
try {
|
|
28
|
+
if (platform === 'darwin') {
|
|
29
|
+
console.log(' Installing AWS CLI via Homebrew...');
|
|
30
|
+
(0, child_process_1.execSync)('brew install awscli', { stdio: 'inherit' });
|
|
31
|
+
return true;
|
|
32
|
+
}
|
|
33
|
+
if (platform === 'linux') {
|
|
34
|
+
// Try apt first (Ubuntu/Debian)
|
|
35
|
+
try {
|
|
36
|
+
(0, child_process_1.execSync)('which apt-get', { stdio: 'pipe' });
|
|
37
|
+
console.log(' Installing AWS CLI via apt...');
|
|
38
|
+
(0, child_process_1.execSync)('sudo apt-get update && sudo apt-get install -y awscli', { stdio: 'inherit' });
|
|
39
|
+
return true;
|
|
40
|
+
}
|
|
41
|
+
catch {
|
|
42
|
+
// Not apt-based, use AWS installer
|
|
43
|
+
}
|
|
44
|
+
// Fallback: AWS official installer
|
|
45
|
+
console.log(' Installing AWS CLI via official installer...');
|
|
46
|
+
(0, child_process_1.execSync)('curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "/tmp/awscliv2.zip"' +
|
|
47
|
+
' && unzip -o /tmp/awscliv2.zip -d /tmp/aws-install' +
|
|
48
|
+
' && sudo /tmp/aws-install/aws/install' +
|
|
49
|
+
' && rm -rf /tmp/awscliv2.zip /tmp/aws-install', { stdio: 'inherit' });
|
|
50
|
+
return true;
|
|
51
|
+
}
|
|
52
|
+
if (platform === 'win32') {
|
|
53
|
+
console.log(' Installing AWS CLI via winget...');
|
|
54
|
+
(0, child_process_1.execSync)('winget install Amazon.AWSCLI', { stdio: 'inherit' });
|
|
55
|
+
return true;
|
|
56
|
+
}
|
|
57
|
+
console.log(' Unsupported platform: ' + platform);
|
|
58
|
+
return false;
|
|
59
|
+
}
|
|
60
|
+
catch (e) {
|
|
61
|
+
console.log(' Failed to install AWS CLI: ' + (e instanceof Error ? e.message : String(e)));
|
|
62
|
+
return false;
|
|
63
|
+
}
|
|
64
|
+
}
|
|
9
65
|
exports.awsCliFixes = [
|
|
10
66
|
{
|
|
11
67
|
id: 'aws-cli-not-installed-dev',
|
|
@@ -14,18 +70,19 @@ exports.awsCliFixes = [
|
|
|
14
70
|
description: 'AWS CLI not installed (needed for ECR)',
|
|
15
71
|
scan: async (config, _rootDir) => {
|
|
16
72
|
// Only check if AWS is configured
|
|
17
|
-
if (!config
|
|
18
|
-
return false;
|
|
19
|
-
try {
|
|
20
|
-
(0, child_process_1.execSync)('which aws', { stdio: 'pipe' });
|
|
73
|
+
if (!hasAwsPipeline(config))
|
|
21
74
|
return false;
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
75
|
+
return !(0, aws_helpers_js_1.isAwsCliInstalled)();
|
|
76
|
+
},
|
|
77
|
+
fix: async (_config, _rootDir) => {
|
|
78
|
+
return installAwsCli();
|
|
26
79
|
},
|
|
27
|
-
|
|
28
|
-
|
|
80
|
+
manualFix: [
|
|
81
|
+
'Install AWS CLI:',
|
|
82
|
+
' macOS: brew install awscli',
|
|
83
|
+
' Linux: sudo apt-get install awscli (or curl installer from AWS)',
|
|
84
|
+
' Windows: winget install Amazon.AWSCLI',
|
|
85
|
+
].join('\n'),
|
|
29
86
|
},
|
|
30
87
|
];
|
|
31
88
|
//# sourceMappingURL=aws-cli.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"aws-cli.js","sourceRoot":"","sources":["../../../../../src/plugins/pipelines/aws/scanfix/aws-cli.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;AAEH,iDAAyC;
|
|
1
|
+
{"version":3,"file":"aws-cli.js","sourceRoot":"","sources":["../../../../../src/plugins/pipelines/aws/scanfix/aws-cli.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;AAEH,iDAAyC;AAEzC,4DAA4D;AAE5D;;GAEG;AACH,SAAS,cAAc,CAAC,MAAqB;IAC3C,IAAI,MAAM,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAC5B,iEAAiE;IACjE,MAAM,EAAE,mBAAmB,EAAE,GAAG,OAAO,CAAC,qCAAqC,CAAC,CAAC;IAC/E,MAAM,YAAY,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IACjD,OAAO,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CACrC,CAAC,CAAU,EAAE,EAAE,CAAE,CAAmD,CAAC,QAAQ,KAAK,KAAK;QACpF,CAAgC,CAAC,aAAa,CAClD,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,aAAa;IACpB,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAElC,IAAI,CAAC;QACH,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,OAAO,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;YACrD,IAAA,wBAAQ,EAAC,qBAAqB,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;YACtD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACzB,gCAAgC;YAChC,IAAI,CAAC;gBACH,IAAA,wBAAQ,EAAC,eAAe,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;gBAC7C,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;gBAChD,IAAA,wBAAQ,EAAC,uDAAuD,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;gBACxF,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,MAAM,CAAC;gBACP,mCAAmC;YACrC,CAAC;YAED,mCAAmC;YACnC,OAAO,CAAC,GAAG,CAAC,iDAAiD,CAAC,CAAC;YAC/D,IAAA,wBAAQ,EACN,wFAAwF;gBACxF,oDAAoD;gBACpD,uCAAuC;gBACvC,+CAA+C,EAC/C,EAAE,KAAK,EAAE,SAAS,EAAE,CACrB,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACzB,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;YACnD,IAAA,wBAAQ,EAAC,8BAA8B,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;YAC/D,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,2BAA2B,GAAG,QAAQ,CAAC,CAAC;QACpD,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,GAAG,CAAC,gCAAgC,GAAG,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7F,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAEY,QAAA,WAAW,GAAU;IAChC;QACE,EAAE,EAAE,2BAA2B;QAC/B,KAAK,EAAE,KAAK;QACZ,QAAQ,EAAE,SAAS;QACnB,WAAW,EAAE,wCAAwC;QACrD,IAAI,EAAE,KAAK,EAAE,MAAqB,EAAE,QAAgB,EAAoB,EAAE;YACxE,kCAAkC;YAClC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC1C,OAAO,CAAC,IAAA,kCAAiB,GAAE,CAAC;QAC9B,CAAC;QACD,GAAG,EAAE,KAAK,EAAE,OAAsB,EAAE,QAAgB,EAAoB,EAAE;YACxE,OAAO,aAAa,EAAE,CAAC;QACzB,CAAC;QACD,SAAS,EAAE;YACT,kBAAkB;YAClB,gCAAgC;YAChC,sEAAsE;YACtE,yCAAyC;SAC1C,CAAC,IAAI,CAAC,IAAI,CAAC;KACb;CACF,CAAC"}
|
|
@@ -1,8 +1,15 @@
|
|
|
1
1
|
/**
|
|
2
2
|
* AWS Credential Fixes
|
|
3
3
|
*
|
|
4
|
-
* Handles AWS account setup
|
|
4
|
+
* Handles AWS account setup, credential validation,
|
|
5
5
|
* and region configuration checks.
|
|
6
|
+
*
|
|
7
|
+
* The aws-account-not-setup fix auto-bootstraps:
|
|
8
|
+
* 1. Checks if AWS CLI has valid credentials
|
|
9
|
+
* 2. If not, prompts user to login via `aws configure` (root or admin)
|
|
10
|
+
* 3. Confirms with user before creating IAM admin user
|
|
11
|
+
* 4. Creates IAM user, attaches bootstrap policy, creates access key
|
|
12
|
+
* 5. Auto-configures AWS CLI with new IAM credentials
|
|
6
13
|
*/
|
|
7
14
|
import type { Fix } from '../../../../types/index.js';
|
|
8
15
|
export declare const credentialsFixes: Fix[];
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../../../../src/plugins/pipelines/aws/scanfix/credentials.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../../../../src/plugins/pipelines/aws/scanfix/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAKH,OAAO,KAAK,EAAiB,GAAG,EAAE,MAAM,4BAA4B,CAAC;AA+KrE,eAAO,MAAM,gBAAgB,EAAE,GAAG,EAoKjC,CAAC"}
|
|
@@ -2,8 +2,15 @@
|
|
|
2
2
|
/**
|
|
3
3
|
* AWS Credential Fixes
|
|
4
4
|
*
|
|
5
|
-
* Handles AWS account setup
|
|
5
|
+
* Handles AWS account setup, credential validation,
|
|
6
6
|
* and region configuration checks.
|
|
7
|
+
*
|
|
8
|
+
* The aws-account-not-setup fix auto-bootstraps:
|
|
9
|
+
* 1. Checks if AWS CLI has valid credentials
|
|
10
|
+
* 2. If not, prompts user to login via `aws configure` (root or admin)
|
|
11
|
+
* 3. Confirms with user before creating IAM admin user
|
|
12
|
+
* 4. Creates IAM user, attaches bootstrap policy, creates access key
|
|
13
|
+
* 5. Auto-configures AWS CLI with new IAM credentials
|
|
7
14
|
*/
|
|
8
15
|
var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
|
|
9
16
|
if (k2 === undefined) k2 = k;
|
|
@@ -40,7 +47,151 @@ var __importStar = (this && this.__importStar) || (function () {
|
|
|
40
47
|
})();
|
|
41
48
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
42
49
|
exports.credentialsFixes = void 0;
|
|
50
|
+
const child_process_1 = require("child_process");
|
|
51
|
+
const fs = __importStar(require("fs"));
|
|
52
|
+
const path = __importStar(require("path"));
|
|
43
53
|
const aws_helpers_js_1 = require("../utils/aws-helpers.js");
|
|
54
|
+
/**
|
|
55
|
+
* Check if IAM user exists
|
|
56
|
+
*/
|
|
57
|
+
function findIamUser(userName, region) {
|
|
58
|
+
const result = (0, aws_helpers_js_1.awsExecSafe)('aws iam get-user --user-name ' + userName, region);
|
|
59
|
+
return !!result && !result.includes('NoSuchEntity');
|
|
60
|
+
}
|
|
61
|
+
/**
|
|
62
|
+
* Read the bootstrap policy JSON from the policies directory
|
|
63
|
+
*/
|
|
64
|
+
function getBootstrapPolicy() {
|
|
65
|
+
// Try dist path first (published package), then src path (development)
|
|
66
|
+
const distPath = path.resolve(__dirname, '..', 'policies', 'bootstrap-policy.json');
|
|
67
|
+
const srcPath = path.resolve(__dirname, '..', '..', '..', '..', '..', 'src', 'plugins', 'pipelines', 'aws', 'policies', 'bootstrap-policy.json');
|
|
68
|
+
if (fs.existsSync(distPath)) {
|
|
69
|
+
return fs.readFileSync(distPath, 'utf8').trim();
|
|
70
|
+
}
|
|
71
|
+
if (fs.existsSync(srcPath)) {
|
|
72
|
+
return fs.readFileSync(srcPath, 'utf8').trim();
|
|
73
|
+
}
|
|
74
|
+
throw new Error('bootstrap-policy.json not found');
|
|
75
|
+
}
|
|
76
|
+
/**
|
|
77
|
+
* Auto-bootstrap AWS account:
|
|
78
|
+
* Phase A: Check existing credentials
|
|
79
|
+
* Phase B: Interactive root/admin login
|
|
80
|
+
* Phase C: Confirm and create IAM admin user
|
|
81
|
+
* Phase D: Auto-configure with new IAM credentials
|
|
82
|
+
*/
|
|
83
|
+
async function bootstrapAwsAccount(config) {
|
|
84
|
+
const awsConfig = (0, aws_helpers_js_1.getAwsConfig)(config);
|
|
85
|
+
const region = awsConfig.region || 'us-east-1';
|
|
86
|
+
// ============================================================
|
|
87
|
+
// Phase A: Check if AWS CLI already has valid credentials
|
|
88
|
+
// ============================================================
|
|
89
|
+
let accountId = (0, aws_helpers_js_1.getAwsAccountId)(region);
|
|
90
|
+
if (accountId) {
|
|
91
|
+
console.log(' AWS credentials already configured (account: ' + accountId + ')');
|
|
92
|
+
return true;
|
|
93
|
+
}
|
|
94
|
+
// ============================================================
|
|
95
|
+
// Phase B: Prompt root/admin user to login via aws configure
|
|
96
|
+
// ============================================================
|
|
97
|
+
console.log('');
|
|
98
|
+
console.log(' ============================================================');
|
|
99
|
+
console.log(' AWS CLI has no valid credentials configured.');
|
|
100
|
+
console.log(' Login with your AWS root account or an IAM admin user.');
|
|
101
|
+
console.log(' ============================================================');
|
|
102
|
+
console.log('');
|
|
103
|
+
console.log(' Running: aws configure');
|
|
104
|
+
console.log(' (Enter your Access Key ID, Secret Access Key, and region)');
|
|
105
|
+
console.log('');
|
|
106
|
+
try {
|
|
107
|
+
(0, child_process_1.execSync)('aws configure', { stdio: 'inherit' });
|
|
108
|
+
}
|
|
109
|
+
catch (e) {
|
|
110
|
+
console.log(' aws configure failed: ' + (e instanceof Error ? e.message : String(e)));
|
|
111
|
+
return false;
|
|
112
|
+
}
|
|
113
|
+
// Verify credentials work after aws configure
|
|
114
|
+
accountId = (0, aws_helpers_js_1.getAwsAccountId)(region);
|
|
115
|
+
if (!accountId) {
|
|
116
|
+
console.log(' AWS credentials still invalid after configuration.');
|
|
117
|
+
console.log(' Please verify your Access Key ID and Secret Access Key.');
|
|
118
|
+
return false;
|
|
119
|
+
}
|
|
120
|
+
console.log(' [OK] AWS login successful (account: ' + accountId + ')');
|
|
121
|
+
// ============================================================
|
|
122
|
+
// Phase C: Confirm and create IAM admin user
|
|
123
|
+
// ============================================================
|
|
124
|
+
const userName = 'factiii-admin';
|
|
125
|
+
// Check if user already exists
|
|
126
|
+
if (findIamUser(userName, region)) {
|
|
127
|
+
console.log(' [OK] IAM user ' + userName + ' already exists');
|
|
128
|
+
return true;
|
|
129
|
+
}
|
|
130
|
+
console.log('');
|
|
131
|
+
console.log(' ============================================================');
|
|
132
|
+
console.log(' CREATE IAM ADMIN USER');
|
|
133
|
+
console.log(' ============================================================');
|
|
134
|
+
console.log(' Will create IAM user "' + userName + '" with bootstrap policy');
|
|
135
|
+
console.log(' (EC2, RDS, S3, ECR, SES, IAM, STS permissions)');
|
|
136
|
+
console.log('');
|
|
137
|
+
console.log(' This replaces root credentials with a scoped IAM user.');
|
|
138
|
+
console.log(' ============================================================');
|
|
139
|
+
console.log('');
|
|
140
|
+
// Import confirm from secret-prompts
|
|
141
|
+
const { confirm } = await Promise.resolve().then(() => __importStar(require('../../../../utils/secret-prompts.js')));
|
|
142
|
+
const proceed = await confirm(' Create IAM user "' + userName + '"?', true);
|
|
143
|
+
if (!proceed) {
|
|
144
|
+
console.log(' [--] Skipped IAM user creation');
|
|
145
|
+
console.log(' You can create it manually later or re-run: npx stack fix');
|
|
146
|
+
return true; // Credentials are valid, just no IAM user
|
|
147
|
+
}
|
|
148
|
+
try {
|
|
149
|
+
// Create IAM user
|
|
150
|
+
(0, aws_helpers_js_1.awsExec)('aws iam create-user --user-name ' + userName, region);
|
|
151
|
+
console.log(' [OK] Created IAM user: ' + userName);
|
|
152
|
+
// Read and attach bootstrap policy
|
|
153
|
+
const policy = getBootstrapPolicy();
|
|
154
|
+
(0, aws_helpers_js_1.awsExec)('aws iam put-user-policy --user-name ' + userName +
|
|
155
|
+
' --policy-name factiii-bootstrap' +
|
|
156
|
+
" --policy-document '" + policy + "'", region);
|
|
157
|
+
console.log(' [OK] Attached bootstrap policy (EC2, RDS, S3, ECR, SES, IAM, STS)');
|
|
158
|
+
// Create access key
|
|
159
|
+
const keyResult = (0, aws_helpers_js_1.awsExec)('aws iam create-access-key --user-name ' + userName, region);
|
|
160
|
+
const parsed = JSON.parse(keyResult);
|
|
161
|
+
const newAccessKeyId = parsed.AccessKey?.AccessKeyId;
|
|
162
|
+
const newSecretKey = parsed.AccessKey?.SecretAccessKey;
|
|
163
|
+
if (!newAccessKeyId || !newSecretKey) {
|
|
164
|
+
console.log(' [!] Failed to parse access key from AWS response');
|
|
165
|
+
return false;
|
|
166
|
+
}
|
|
167
|
+
console.log(' [OK] Created access key for ' + userName);
|
|
168
|
+
// ============================================================
|
|
169
|
+
// Phase D: Auto-configure AWS CLI with new IAM credentials
|
|
170
|
+
// ============================================================
|
|
171
|
+
(0, child_process_1.execSync)('aws configure set aws_access_key_id ' + newAccessKeyId, { stdio: 'pipe' });
|
|
172
|
+
(0, child_process_1.execSync)('aws configure set aws_secret_access_key ' + newSecretKey, { stdio: 'pipe' });
|
|
173
|
+
(0, child_process_1.execSync)('aws configure set region ' + region, { stdio: 'pipe' });
|
|
174
|
+
// Verify new credentials work
|
|
175
|
+
const verifyId = (0, aws_helpers_js_1.getAwsAccountId)(region);
|
|
176
|
+
if (!verifyId) {
|
|
177
|
+
console.log(' [!] New IAM credentials failed verification');
|
|
178
|
+
return false;
|
|
179
|
+
}
|
|
180
|
+
console.log(' [OK] AWS CLI configured with IAM user ' + userName + ' (root credentials replaced)');
|
|
181
|
+
console.log('');
|
|
182
|
+
console.log(' Access Key ID: ' + newAccessKeyId);
|
|
183
|
+
console.log(' Account: ' + verifyId);
|
|
184
|
+
console.log(' Region: ' + region);
|
|
185
|
+
console.log('');
|
|
186
|
+
console.log(' TIP: Store the secret key in Ansible Vault: npx stack secrets set AWS_SECRET_ACCESS_KEY');
|
|
187
|
+
return true;
|
|
188
|
+
}
|
|
189
|
+
catch (e) {
|
|
190
|
+
console.log(' [!] Failed to create IAM user: ' + (e instanceof Error ? e.message : String(e)));
|
|
191
|
+
console.log(' You may need to create the IAM user manually in the AWS Console.');
|
|
192
|
+
return false;
|
|
193
|
+
}
|
|
194
|
+
}
|
|
44
195
|
exports.credentialsFixes = [
|
|
45
196
|
// ============================================================
|
|
46
197
|
// DEV STAGE - AWS CLI and account setup
|
|
@@ -53,8 +204,14 @@ exports.credentialsFixes = [
|
|
|
53
204
|
scan: async (config, _rootDir) => {
|
|
54
205
|
// Only check if AWS pipeline is configured
|
|
55
206
|
const awsConfig = (0, aws_helpers_js_1.getAwsConfig)(config);
|
|
56
|
-
if (!awsConfig.accessKeyId && !config.aws)
|
|
57
|
-
|
|
207
|
+
if (!awsConfig.accessKeyId && !config.aws) {
|
|
208
|
+
// Also check per-environment pipeline: aws
|
|
209
|
+
const { extractEnvironments } = await Promise.resolve().then(() => __importStar(require('../../../../utils/config-helpers.js')));
|
|
210
|
+
const environments = extractEnvironments(config);
|
|
211
|
+
const hasAwsEnv = Object.values(environments).some((e) => e.pipeline === 'aws');
|
|
212
|
+
if (!hasAwsEnv)
|
|
213
|
+
return false;
|
|
214
|
+
}
|
|
58
215
|
// Check if AWS CLI is installed
|
|
59
216
|
if (!(0, aws_helpers_js_1.isAwsCliInstalled)())
|
|
60
217
|
return true;
|
|
@@ -62,50 +219,24 @@ exports.credentialsFixes = [
|
|
|
62
219
|
const accountId = (0, aws_helpers_js_1.getAwsAccountId)(awsConfig.region);
|
|
63
220
|
return !accountId;
|
|
64
221
|
},
|
|
65
|
-
fix:
|
|
222
|
+
fix: async (config, _rootDir) => {
|
|
223
|
+
return bootstrapAwsAccount(config);
|
|
224
|
+
},
|
|
66
225
|
manualFix: [
|
|
67
226
|
'============================================================',
|
|
68
|
-
'AWS SETUP
|
|
227
|
+
'AWS SETUP',
|
|
69
228
|
'============================================================',
|
|
70
229
|
'',
|
|
71
230
|
' 1. Install AWS CLI: brew install awscli (or winget install Amazon.AWSCLI)',
|
|
72
|
-
' 2.
|
|
73
|
-
' 3.
|
|
74
|
-
' 4. Create access key: User → Security credentials → Create access key → CLI',
|
|
75
|
-
' 5. Configure CLI: aws configure (paste access key ID + secret)',
|
|
76
|
-
'',
|
|
77
|
-
' Then run: npx factiii fix',
|
|
78
|
-
'',
|
|
79
|
-
' IAM Policy (attach to factiii-admin user):',
|
|
80
|
-
' Full JSON: src/plugins/pipelines/aws/policies/bootstrap-policy.json',
|
|
231
|
+
' 2. Configure CLI: aws configure (paste access key ID + secret)',
|
|
232
|
+
' 3. Run: npx stack fix (auto-creates IAM admin user)',
|
|
81
233
|
'',
|
|
82
|
-
'
|
|
83
|
-
'
|
|
84
|
-
'
|
|
85
|
-
'
|
|
86
|
-
'
|
|
87
|
-
' "Action": ["ec2:*"], "Resource": "*" },',
|
|
88
|
-
' { "Sid": "FactiiiRDSFull", "Effect": "Allow",',
|
|
89
|
-
' "Action": ["rds:*"], "Resource": "*" },',
|
|
90
|
-
' { "Sid": "FactiiiS3Full", "Effect": "Allow",',
|
|
91
|
-
' "Action": ["s3:*"], "Resource": "*" },',
|
|
92
|
-
' { "Sid": "FactiiiECRFull", "Effect": "Allow",',
|
|
93
|
-
' "Action": ["ecr:*"], "Resource": "*" },',
|
|
94
|
-
' { "Sid": "FactiiiSES", "Effect": "Allow",',
|
|
95
|
-
' "Action": ["ses:VerifyDomainIdentity","ses:VerifyDomainDkim",',
|
|
96
|
-
' "ses:GetAccountSendingEnabled","ses:GetIdentityVerificationAttributes",',
|
|
97
|
-
' "ses:GetIdentityDkimAttributes"], "Resource": "*" },',
|
|
98
|
-
' { "Sid": "FactiiiIAMLimited", "Effect": "Allow",',
|
|
99
|
-
' "Action": ["iam:CreateUser","iam:DeleteUser","iam:GetUser",',
|
|
100
|
-
' "iam:PutUserPolicy","iam:DeleteUserPolicy",',
|
|
101
|
-
' "iam:CreateAccessKey","iam:ListAccessKeys","iam:ListUsers"],',
|
|
102
|
-
' "Resource": "*" },',
|
|
103
|
-
' { "Sid": "FactiiiSTS", "Effect": "Allow",',
|
|
104
|
-
' "Action": ["sts:GetCallerIdentity"], "Resource": "*" }',
|
|
105
|
-
' ]',
|
|
106
|
-
' }',
|
|
234
|
+
' Or manually:',
|
|
235
|
+
' 2. Create IAM user: AWS Console > IAM > Users > Create "factiii-admin"',
|
|
236
|
+
' 3. Attach policy: policies/bootstrap-policy.json',
|
|
237
|
+
' 4. Create access key: User > Security credentials > Create access key > CLI',
|
|
238
|
+
' 5. Configure CLI: aws configure',
|
|
107
239
|
'',
|
|
108
|
-
' 📖 Full step-by-step guide: docs/aws-setup-guide.md',
|
|
109
240
|
'============================================================',
|
|
110
241
|
].join('\n'),
|
|
111
242
|
},
|
|
@@ -202,8 +333,7 @@ exports.credentialsFixes = [
|
|
|
202
333
|
if (!accountId) {
|
|
203
334
|
// Check if aws configure has credentials
|
|
204
335
|
try {
|
|
205
|
-
const
|
|
206
|
-
const result = execSync('aws configure get aws_access_key_id 2>/dev/null || echo ""', {
|
|
336
|
+
const result = (0, child_process_1.execSync)('aws configure get aws_access_key_id 2>nul || echo ""', {
|
|
207
337
|
encoding: 'utf8',
|
|
208
338
|
stdio: ['pipe', 'pipe', 'pipe'],
|
|
209
339
|
}).trim();
|
|
@@ -217,7 +347,7 @@ exports.credentialsFixes = [
|
|
|
217
347
|
return false;
|
|
218
348
|
},
|
|
219
349
|
fix: null,
|
|
220
|
-
manualFix: 'Check AWS credentials: aws sts get-caller-identity\nIf expired, regenerate in AWS Console: IAM
|
|
350
|
+
manualFix: 'Check AWS credentials: aws sts get-caller-identity\nIf expired, regenerate in AWS Console: IAM > Users > Security credentials',
|
|
221
351
|
},
|
|
222
352
|
];
|
|
223
353
|
//# sourceMappingURL=credentials.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../../../../src/plugins/pipelines/aws/scanfix/credentials.ts"],"names":[],"mappings":";AAAA
|
|
1
|
+
{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../../../../src/plugins/pipelines/aws/scanfix/credentials.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,iDAAyC;AACzC,uCAAyB;AACzB,2CAA6B;AAE7B,4DAAiH;AAEjH;;GAEG;AACH,SAAS,WAAW,CAAC,QAAgB,EAAE,MAAc;IACnD,MAAM,MAAM,GAAG,IAAA,4BAAW,EACxB,+BAA+B,GAAG,QAAQ,EAC1C,MAAM,CACP,CAAC;IACF,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;AACtD,CAAC;AAED;;GAEG;AACH,SAAS,kBAAkB;IACzB,uEAAuE;IACvE,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,uBAAuB,CAAC,CAAC;IACpF,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,uBAAuB,CAAC,CAAC;IAEjJ,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAClD,CAAC;IACD,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IACjD,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,mBAAmB,CAAC,MAAqB;IACtD,MAAM,SAAS,GAAG,IAAA,6BAAY,EAAC,MAAM,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,IAAI,WAAW,CAAC;IAE/C,+DAA+D;IAC/D,0DAA0D;IAC1D,+DAA+D;IAC/D,IAAI,SAAS,GAAG,IAAA,gCAAe,EAAC,MAAM,CAAC,CAAC;IACxC,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,kDAAkD,GAAG,SAAS,GAAG,GAAG,CAAC,CAAC;QAClF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,+DAA+D;IAC/D,6DAA6D;IAC7D,+DAA+D;IAC/D,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,iEAAiE,CAAC,CAAC;IAC/E,OAAO,CAAC,GAAG,CAAC,iDAAiD,CAAC,CAAC;IAC/D,OAAO,CAAC,GAAG,CAAC,2DAA2D,CAAC,CAAC;IACzE,OAAO,CAAC,GAAG,CAAC,iEAAiE,CAAC,CAAC;IAC/E,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;IACzC,OAAO,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAC;IAC5E,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,IAAI,CAAC;QACH,IAAA,wBAAQ,EAAC,eAAe,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,GAAG,CAAC,2BAA2B,GAAG,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACxF,OAAO,KAAK,CAAC;IACf,CAAC;IAED,8CAA8C;IAC9C,SAAS,GAAG,IAAA,gCAAe,EAAC,MAAM,CAAC,CAAC;IACpC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,CAAC,GAAG,CAAC,uDAAuD,CAAC,CAAC;QACrE,OAAO,CAAC,GAAG,CAAC,4DAA4D,CAAC,CAAC;QAC1E,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,yCAAyC,GAAG,SAAS,GAAG,GAAG,CAAC,CAAC;IAEzE,+DAA+D;IAC/D,6CAA6C;IAC7C,+DAA+D;IAC/D,MAAM,QAAQ,GAAG,eAAe,CAAC;IAEjC,+BAA+B;IAC/B,IAAI,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;QAClC,OAAO,CAAC,GAAG,CAAC,mBAAmB,GAAG,QAAQ,GAAG,iBAAiB,CAAC,CAAC;QAChE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,iEAAiE,CAAC,CAAC;IAC/E,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;IACxC,OAAO,CAAC,GAAG,CAAC,iEAAiE,CAAC,CAAC;IAC/E,OAAO,CAAC,GAAG,CAAC,2BAA2B,GAAG,QAAQ,GAAG,yBAAyB,CAAC,CAAC;IAChF,OAAO,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC;IACjE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,2DAA2D,CAAC,CAAC;IACzE,OAAO,CAAC,GAAG,CAAC,iEAAiE,CAAC,CAAC;IAC/E,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,qCAAqC;IACrC,MAAM,EAAE,OAAO,EAAE,GAAG,wDAAa,qCAAqC,GAAC,CAAC;IACxE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,sBAAsB,GAAG,QAAQ,GAAG,IAAI,EAAE,IAAI,CAAC,CAAC;IAE9E,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC;QACjD,OAAO,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAC;QAC5E,OAAO,IAAI,CAAC,CAAC,0CAA0C;IACzD,CAAC;IAED,IAAI,CAAC;QACH,kBAAkB;QAClB,IAAA,wBAAO,EAAC,kCAAkC,GAAG,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC/D,OAAO,CAAC,GAAG,CAAC,4BAA4B,GAAG,QAAQ,CAAC,CAAC;QAErD,mCAAmC;QACnC,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;QACpC,IAAA,wBAAO,EACL,sCAAsC,GAAG,QAAQ;YACjD,kCAAkC;YAClC,sBAAsB,GAAG,MAAM,GAAG,GAAG,EACrC,MAAM,CACP,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,sEAAsE,CAAC,CAAC;QAEpF,oBAAoB;QACpB,MAAM,SAAS,GAAG,IAAA,wBAAO,EACvB,wCAAwC,GAAG,QAAQ,EACnD,MAAM,CACP,CAAC;QACF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACrC,MAAM,cAAc,GAAG,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC;QACrD,MAAM,YAAY,GAAG,MAAM,CAAC,SAAS,EAAE,eAAe,CAAC;QAEvD,IAAI,CAAC,cAAc,IAAI,CAAC,YAAY,EAAE,CAAC;YACrC,OAAO,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC;YACnE,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,iCAAiC,GAAG,QAAQ,CAAC,CAAC;QAE1D,+DAA+D;QAC/D,2DAA2D;QAC3D,+DAA+D;QAC/D,IAAA,wBAAQ,EAAC,sCAAsC,GAAG,cAAc,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QACrF,IAAA,wBAAQ,EAAC,0CAA0C,GAAG,YAAY,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QACvF,IAAA,wBAAQ,EAAC,2BAA2B,GAAG,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAElE,8BAA8B;QAC9B,MAAM,QAAQ,GAAG,IAAA,gCAAe,EAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,gDAAgD,CAAC,CAAC;YAC9D,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,2CAA2C,GAAG,QAAQ,GAAG,8BAA8B,CAAC,CAAC;QACrG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,wBAAwB,GAAG,cAAc,CAAC,CAAC;QACvD,OAAO,CAAC,GAAG,CAAC,wBAAwB,GAAG,QAAQ,CAAC,CAAC;QACjD,OAAO,CAAC,GAAG,CAAC,wBAAwB,GAAG,MAAM,CAAC,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,4FAA4F,CAAC,CAAC;QAE1G,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,GAAG,CAAC,oCAAoC,GAAG,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACjG,OAAO,CAAC,GAAG,CAAC,qEAAqE,CAAC,CAAC;QACnF,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAEY,QAAA,gBAAgB,GAAU;IACrC,+DAA+D;IAC/D,wCAAwC;IACxC,+DAA+D;IAC/D;QACE,EAAE,EAAE,uBAAuB;QAC3B,KAAK,EAAE,KAAK;QACZ,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,yCAAyC;QACtD,IAAI,EAAE,KAAK,EAAE,MAAqB,EAAE,QAAgB,EAAoB,EAAE;YACxE,2CAA2C;YAC3C,MAAM,SAAS,GAAG,IAAA,6BAAY,EAAC,MAAM,CAAC,CAAC;YACvC,IAAI,CAAC,SAAS,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;gBAC1C,2CAA2C;gBAC3C,MAAM,EAAE,mBAAmB,EAAE,GAAG,wDAAa,qCAAqC,GAAC,CAAC;gBACpF,MAAM,YAAY,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;gBACjD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAChD,CAAC,CAAwB,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CACnD,CAAC;gBACF,IAAI,CAAC,SAAS;oBAAE,OAAO,KAAK,CAAC;YAC/B,CAAC;YAED,gCAAgC;YAChC,IAAI,CAAC,IAAA,kCAAiB,GAAE;gBAAE,OAAO,IAAI,CAAC;YAEtC,qDAAqD;YACrD,MAAM,SAAS,GAAG,IAAA,gCAAe,EAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YACpD,OAAO,CAAC,SAAS,CAAC;QACpB,CAAC;QACD,GAAG,EAAE,KAAK,EAAE,MAAqB,EAAE,QAAgB,EAAoB,EAAE;YACvE,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAC;QACrC,CAAC;QACD,SAAS,EAAE;YACT,8DAA8D;YAC9D,WAAW;YACX,8DAA8D;YAC9D,EAAE;YACF,iFAAiF;YACjF,wEAAwE;YACxE,uEAAuE;YACvE,EAAE;YACF,gBAAgB;YAChB,6EAA6E;YAC7E,yDAAyD;YACzD,gFAAgF;YAChF,wCAAwC;YACxC,EAAE;YACF,8DAA8D;SAC/D,CAAC,IAAI,CAAC,IAAI,CAAC;KACb;IACD;QACE,EAAE,EAAE,uBAAuB;QAC3B,KAAK,EAAE,KAAK;QACZ,QAAQ,EAAE,SAAS;QACnB,WAAW,EAAE,0CAA0C;QACvD,IAAI,EAAE,KAAK,EAAE,MAAqB,EAAE,QAAgB,EAAoB,EAAE;YACxE,2CAA2C;YAC3C,MAAM,EAAE,mBAAmB,EAAE,GAAG,wDAAa,qCAAqC,GAAC,CAAC;YACpF,MAAM,YAAY,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;YACjD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAChD,CAAC,CAAwB,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CACnD,CAAC;YACF,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,GAAG;gBAAE,OAAO,KAAK,CAAC;YAE5C,MAAM,SAAS,GAAG,IAAA,6BAAY,EAAC,MAAM,CAAC,CAAC;YACvC,uDAAuD;YACvD,OAAO,CAAC,SAAS,CAAC,MAAM,IAAI,SAAS,CAAC,MAAM,KAAK,WAAW,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC;QACtF,CAAC;QACD,GAAG,EAAE,IAAI;QACT,SAAS,EAAE,iFAAiF;KAC7F;IAED,+DAA+D;IAC/D,wCAAwC;IACxC,+DAA+D;IAC/D;QACE,EAAE,EAAE,yBAAyB;QAC7B,KAAK,EAAE,SAAS;QAChB,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,2DAA2D;QACxE,IAAI,EAAE,KAAK,EAAE,MAAqB,EAAE,QAAgB,EAAoB,EAAE;YACxE,2CAA2C;YAC3C,MAAM,EAAE,mBAAmB,EAAE,GAAG,wDAAa,qCAAqC,GAAC,CAAC;YACpF,MAAM,YAAY,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;YACjD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAChD,CAAC,CAAwB,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CACnD,CAAC;YACF,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,GAAG;gBAAE,OAAO,KAAK,CAAC;YAE5C,iBAAiB;YACjB,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,CAAC;gBACvE,OAAO,KAAK,CAAC;YACf,CAAC;YAED,6CAA6C;YAC7C,IAAI,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,CAAC;gBAC/B,IAAI,CAAC;oBACH,MAAM,EAAE,mBAAmB,EAAE,GAAG,wDAAa,4CAA4C,GAAC,CAAC;oBAC3F,MAAM,KAAK,GAAG,IAAI,mBAAmB,CAAC;wBACpC,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU;wBACrC,mBAAmB,EAAE,MAAM,CAAC,OAAO,CAAC,mBAAmB;qBACxD,CAAC,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,CAAC,mBAAmB,EAAE,uBAAuB,CAAC,CAAC,CAAC;oBACxF,IAAI,MAAM,CAAC,MAAM,EAAE,iBAAiB,IAAI,MAAM,CAAC,MAAM,EAAE,qBAAqB,EAAE,CAAC;wBAC7E,OAAO,KAAK,CAAC;oBACf,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,uBAAuB;gBACzB,CAAC;YACH,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;QACD,GAAG,EAAE,IAAI;QACT,SAAS,EAAE;YACT,uCAAuC;YACvC,EAAE;YACF,mCAAmC;YACnC,sCAAsC;YACtC,sCAAsC;YACtC,EAAE;YACF,mCAAmC;YACnC,mBAAmB;YACnB,EAAE;YACF,yCAAyC;YACzC,wEAAwE;YACxE,4BAA4B;SAC7B,CAAC,IAAI,CAAC,IAAI,CAAC;KACb;IACD;QACE,EAAE,EAAE,yBAAyB;QAC7B,KAAK,EAAE,SAAS;QAChB,QAAQ,EAAE,SAAS;QACnB,WAAW,EAAE,wCAAwC;QACrD,IAAI,EAAE,KAAK,EAAE,MAAqB,EAAE,QAAgB,EAAoB,EAAE;YACxE,2DAA2D;YAC3D,IAAI,CAAC,IAAA,kCAAiB,GAAE;gBAAE,OAAO,KAAK,CAAC;YACvC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,CAAC;gBACzE,sDAAsD;gBACtD,yBAAyB;YAC3B,CAAC;YAED,MAAM,SAAS,GAAG,IAAA,6BAAY,EAAC,MAAM,CAAC,CAAC;YACvC,MAAM,SAAS,GAAG,IAAA,gCAAe,EAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YACpD,sDAAsD;YACtD,2DAA2D;YAC3D,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,yCAAyC;gBACzC,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,IAAA,wBAAQ,EAAC,sDAAsD,EAAE;wBAC9E,QAAQ,EAAE,MAAM;wBAChB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;qBAChC,CAAC,CAAC,IAAI,EAAE,CAAC;oBACV,2DAA2D;oBAC3D,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;gBAC3B,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,GAAG,EAAE,IAAI;QACT,SAAS,EAAE,+HAA+H;KAC3I;CACF,CAAC"}
|