@flowcore/cli-plugin-iam 1.0.0 → 1.1.0

package/dist/resource-types/policy.resource.js

@@ -0,0 +1,158 @@
+import { baseResourceDto } from "@flowcore/cli-plugin-core";
+import { diff } from "@opentf/obj-diff";
+import enquirer from "enquirer";
+import { diffString } from "json-diff";
+import { omit } from "radash";
+import { z } from "zod";
+export var PolicyDocumentAction;
+(function (PolicyDocumentAction) {
+    PolicyDocumentAction["ALL"] = "*";
+    PolicyDocumentAction["FETCH"] = "FETCH";
+    PolicyDocumentAction["INGEST"] = "INGEST";
+    PolicyDocumentAction["READ"] = "READ";
+    PolicyDocumentAction["WRITE"] = "WRITE";
+})(PolicyDocumentAction || (PolicyDocumentAction = {}));
+export const policyDto = baseResourceDto.extend({
+    spec: z.object({
+        description: z.string().optional(),
+        flowcoreManaged: z.boolean().optional(),
+        policyDocuments: z.array(z.object({
+            action: z
+                .array(z.nativeEnum(PolicyDocumentAction))
+                .or(z.nativeEnum(PolicyDocumentAction)),
+            resource: z.string(),
+            statementId: z.string().optional(),
+        })),
+        principal: z.string().optional(),
+        version: z.string(),
+    }),
+});
+export class PolicyService {
+    iamClient;
+    logger;
+    getToken;
+    constructor(iamClient, logger, getToken) {
+        this.iamClient = iamClient;
+        this.logger = logger;
+        this.getToken = getToken;
+    }
+    async createNewPolicy(organizationId, policy, skipConfirmation) {
+        const parsedPolicy = policyDto.parse(policy);
+        try {
+            const policies = await this.iamClient.getApiV1PolicyAssociationsOrganizationByOrganizationId(organizationId, {
+                headers: {
+                    Authorization: `Bearer ${await this.getToken()}`,
+                },
+            });
+            const existingPolicy = policies.data.find((p) => p.name === parsedPolicy.metadata.name);
+            if (!existingPolicy) {
+                const result = await this.iamClient.postApiV1Policies({
+                    description: parsedPolicy.spec.description ?? undefined,
+                    name: parsedPolicy.metadata.name,
+                    organizationId,
+                    policyDocuments: parsedPolicy.spec.policyDocuments,
+                    principal: parsedPolicy.spec.principal ?? undefined,
+                    version: parsedPolicy.spec.version,
+                }, {
+                    headers: {
+                        Authorization: `Bearer ${await this.getToken()}`,
+                    },
+                });
+                if (result.status !== 200) {
+                    this.logger.fatal(`Failed to create policy: ${result.statusText}`);
+                }
+                return true;
+            }
+            let useStatementIds = false;
+            const newPolicy = {
+                description: parsedPolicy.spec.description ?? "",
+                name: parsedPolicy.metadata.name,
+                organizationId,
+                policyDocuments: parsedPolicy.spec.policyDocuments.map((doc) => {
+                    if (doc.statementId) {
+                        useStatementIds = true;
+                    }
+                    return {
+                        ...doc,
+                    };
+                }),
+                version: parsedPolicy.spec.version,
+                ...(parsedPolicy.spec.principal && {
+                    principal: parsedPolicy.spec.principal,
+                }),
+                flowcoreManaged: parsedPolicy.spec.flowcoreManaged ?? false,
+            };
+            if (diff({
+                ...omit(existingPolicy, ["id"]),
+                policyDocuments: existingPolicy.policyDocuments.map((doc) => useStatementIds ? doc : omit(doc, ["statementId"])),
+            }, newPolicy).length === 0) {
+                return false;
+            }
+            if (!skipConfirmation) {
+                this.logger.info("Policy has changed, do you want to apply these changes?");
+                this.logger.info(diffString({
+                    ...omit(existingPolicy, ["id"]),
+                    policyDocuments: existingPolicy.policyDocuments.map((doc) => useStatementIds ? doc : omit(doc, ["statementId"])),
+                }, newPolicy, { color: true, full: true }));
+                const { confirm } = await enquirer.prompt({
+                    message: "Are you sure you want to update the policy?",
+                    name: "confirm",
+                    type: "confirm",
+                });
+                if (!confirm) {
+                    return false;
+                }
+            }
+            const result = await this.iamClient.patchApiV1PoliciesById(existingPolicy.id, newPolicy, {
+                headers: {
+                    Authorization: `Bearer ${await this.getToken()}`,
+                },
+            });
+            if (result.status !== 200) {
+                this.logger.fatal(`Failed to update policy: ${result.statusText}`);
+            }
+            return true;
+        }
+        catch (error) {
+            if (typeof error === "object" && error !== null && "error" in error) {
+                const err = error;
+                this.logger.fatal(`Failed to create policy with error(${err.error.status} - ${err.error.code}): ${err.error.message}`);
+            }
+            else {
+                this.logger.fatal(`Failed to create policy with unknown error: ${error}`);
+            }
+        }
+    }
+    async deletePolicy(organizationId, policy) {
+        const parsedPolicy = policyDto.parse(policy);
+        try {
+            const policies = await this.iamClient.getApiV1PolicyAssociationsOrganizationByOrganizationId(organizationId, {
+                headers: {
+                    Authorization: `Bearer ${await this.getToken()}`,
+                },
+            });
+            const existingPolicy = policies.data.find((p) => p.name === parsedPolicy.metadata.name);
+            if (!existingPolicy) {
+                return false;
+            }
+            const result = await this.iamClient.deleteApiV1PoliciesById(existingPolicy.id, {
+                headers: {
+                    Authorization: `Bearer ${await this.getToken()}`,
+                },
+            });
+            if (result.status !== 200) {
+                this.logger.fatal(`Failed to delete policy: ${result.statusText}`);
+            }
+            return true;
+        }
+        catch (error) {
+            if (typeof error === "object" && error !== null && "error" in error) {
+                const err = error;
+                this.logger.fatal(`Failed to delete policy with error(${err.error.status} - ${err.error.code}): ${err.error.message}`);
+            }
+            else {
+                this.logger.fatal(`Failed to delete policy with unknown error: ${error}`);
+            }
+        }
+    }
+}

package/dist/resource-types/role-binding.resource.d.ts

@@ -0,0 +1,82 @@
+import type { Logger } from "@flowcore/cli-plugin-config";
+import { z } from "zod";
+import type { Api as IamApi } from "../utils/clients/iam/Api.js";
+export declare const roleBindingDto: z.ZodObject<z.objectUtil.extendShape<{
+    apiVersion: z.ZodString;
+    kind: z.ZodString;
+    metadata: z.ZodObject<{
+        name: z.ZodString;
+        tenant: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        name: string;
+        tenant: string;
+    }, {
+        name: string;
+        tenant: string;
+    }>;
+}, {
+    spec: z.ZodObject<{
+        role: z.ZodString;
+        subjects: z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            type: z.ZodEnum<["user", "key"]>;
+        }, "strip", z.ZodTypeAny, {
+            id: string;
+            type: "key" | "user";
+        }, {
+            id: string;
+            type: "key" | "user";
+        }>, "many">;
+    }, "strip", z.ZodTypeAny, {
+        subjects: {
+            id: string;
+            type: "key" | "user";
+        }[];
+        role: string;
+    }, {
+        subjects: {
+            id: string;
+            type: "key" | "user";
+        }[];
+        role: string;
+    }>;
+}>, "strip", z.ZodTypeAny, {
+    kind: string;
+    apiVersion: string;
+    metadata: {
+        name: string;
+        tenant: string;
+    };
+    spec: {
+        subjects: {
+            id: string;
+            type: "key" | "user";
+        }[];
+        role: string;
+    };
+}, {
+    kind: string;
+    apiVersion: string;
+    metadata: {
+        name: string;
+        tenant: string;
+    };
+    spec: {
+        subjects: {
+            id: string;
+            type: "key" | "user";
+        }[];
+        role: string;
+    };
+}>;
+export type RoleBinding = z.infer<typeof roleBindingDto>;
+export type ApiRoleResource = Awaited<ReturnType<IamApi["getApiV1RoleAssociationsOrganizationByOrganizationId"]>>["data"][0];
+export type ApiRoleAssociationResource = Awaited<ReturnType<IamApi["getApiV1RoleAssociationsByRoleId"]>>["data"];
+export declare class RoleBindingService {
+    private readonly iamClient;
+    private readonly logger;
+    private readonly getToken;
+    constructor(iamClient: IamApi, logger: Logger, getToken: () => Promise<string>);
+    createNewRoleBinding(organizationId: string, roleBinding: unknown, skipConfirmation: boolean): Promise<boolean>;
+    deleteRoleBinding(organizationId: string, roleBinding: unknown): Promise<boolean>;
+}

package/dist/resource-types/role-binding.resource.js

@@ -0,0 +1,203 @@
+import { baseResourceDto } from "@flowcore/cli-plugin-core";
+import enquirer from "enquirer";
+import { diffString } from "json-diff";
+import { z } from "zod";
+export const roleBindingDto = baseResourceDto.extend({
+    spec: z.object({
+        role: z.string(),
+        subjects: z.array(z.object({
+            id: z.string(),
+            type: z.enum(["user", "key"]),
+        })),
+    }),
+});
+export class RoleBindingService {
+    iamClient;
+    logger;
+    getToken;
+    constructor(iamClient, logger, getToken) {
+        this.iamClient = iamClient;
+        this.logger = logger;
+        this.getToken = getToken;
+    }
+    async createNewRoleBinding(organizationId, roleBinding, skipConfirmation) {
+        const parsedRoleBinding = roleBindingDto.parse(roleBinding);
+        try {
+            const roles = await this.iamClient.getApiV1RoleAssociationsOrganizationByOrganizationId(organizationId, {
+                headers: {
+                    Authorization: `Bearer ${await this.getToken()}`,
+                },
+            });
+            const existingRole = roles.data.find((r) => r.name === parsedRoleBinding.spec.role);
+            if (!existingRole) {
+                this.logger.error(`Role ${parsedRoleBinding.spec.role} not found`);
+                return false;
+            }
+            const associations = await this.iamClient.getApiV1RoleAssociationsByRoleId(existingRole.id, {
+                headers: {
+                    Authorization: `Bearer ${await this.getToken()}`,
+                },
+            });
+            const usersToDelete = [];
+            for (const userAssociation of associations.data.users.filter((u) => u.roleId !== existingRole.id)) {
+                if (!parsedRoleBinding.spec.subjects.find((s) => s.type === "user" && s.id === userAssociation.userId)) {
+                    usersToDelete.push(userAssociation.userId);
+                }
+            }
+            const keysToDelete = [];
+            for (const keyAssociation of associations.data.keys.filter((k) => k.roleId !== existingRole.id)) {
+                if (!parsedRoleBinding.spec.subjects.find((s) => s.type === "key" && s.id === keyAssociation.keyId)) {
+                    keysToDelete.push(keyAssociation.keyId);
+                }
+            }
+            if (!skipConfirmation) {
+                const diffObject = {
+                    keys: associations.data.keys.filter((k) => !keysToDelete.includes(k.keyId)),
+                    users: associations.data.users.filter((u) => !usersToDelete.includes(u.userId)),
+                };
+                this.logger.info("Modifying the following:");
+                this.logger.info(`${diffString(associations.data.users.map((u) => u.userId), diffObject.users, { color: true, full: true })}`);
+                this.logger.info(`${diffString(associations.data.keys.map((k) => k.keyId), diffObject.keys, { color: true, full: true })}`);
+                const { confirm } = await enquirer.prompt([
+                    {
+                        message: `Are you sure you want to remove ${usersToDelete.length} users and ${keysToDelete.length} keys from role ${existingRole.name}?`,
+                        name: "confirm",
+                        type: "confirm",
+                    },
+                ]);
+                if (!confirm) {
+                    return false;
+                }
+            }
+            let changed = keysToDelete.length > 0 || usersToDelete.length > 0;
+            for (const userId of usersToDelete) {
+                const result = await this.iamClient.deleteApiV1RoleAssociationsUserByUserId(userId, { roleId: existingRole.id }, {
+                    headers: {
+                        Authorization: `Bearer ${await this.getToken()}`,
+                    },
+                });
+                if (result.status !== 200) {
+                    this.logger.error(`Failed to delete user ${userId} from role ${existingRole.id}: ${result.statusText}`);
+                }
+            }
+            for (const keyId of keysToDelete) {
+                const result = await this.iamClient.deleteApiV1RoleAssociationsKeyByKeyId(keyId, { roleId: existingRole.id }, {
+                    headers: {
+                        Authorization: `Bearer ${await this.getToken()}`,
+                    },
+                });
+                if (result.status !== 200) {
+                    this.logger.error(`Failed to delete key ${keyId} from role ${existingRole.id}: ${result.statusText}`);
+                }
+            }
+            for (const subject of parsedRoleBinding.spec.subjects) {
+                switch (subject.type) {
+                    case "user": {
+                        const existingAssociation = associations.data.users.find((a) => a.userId === subject.id);
+                        if (existingAssociation) {
+                            this.logger.debug(`User ${subject.id} already bound to role ${existingRole.id}`);
+                            continue;
+                        }
+                        const result = await this.iamClient.postApiV1RoleAssociationsUserByUserId(subject.id, { roleId: existingRole.id }, {
+                            headers: {
+                                Authorization: `Bearer ${await this.getToken()}`,
+                            },
+                        });
+                        if (result.status !== 200) {
+                            this.logger.error(`Failed to bind user ${subject.id} to role ${existingRole.id}: ${result.statusText}`);
+                        }
+                        changed = true;
+                        break;
+                    }
+                    case "key": {
+                        const existingAssociation = associations.data.keys.find((a) => a.keyId === subject.id);
+                        if (existingAssociation) {
+                            this.logger.debug(`Key ${subject.id} already bound to role ${existingRole.id}`);
+                            continue;
+                        }
+                        const result = await this.iamClient.postApiV1RoleAssociationsKeyByKeyId(subject.id, { roleId: existingRole.id }, {
+                            headers: {
+                                Authorization: `Bearer ${await this.getToken()}`,
+                            },
+                        });
+                        if (result.status !== 200) {
+                            this.logger.error(`Failed to bind key ${subject.id} to role ${existingRole.id}: ${result.statusText}`);
+                        }
+                        changed = true;
+                        break;
+                    }
+                }
+            }
+            return changed;
+        }
+        catch (error) {
+            if (typeof error === "object" && error !== null && "error" in error) {
+                const err = error;
+                this.logger.fatal(`Failed to create role binding with error(${err.error.status} - ${err.error.code}): ${err.error.message}`);
+            }
+            else {
+                this.logger.fatal(`Failed to create role binding with unknown error: ${error}`);
+            }
+        }
+    }
+    async deleteRoleBinding(organizationId, roleBinding) {
+        const parsedRoleBinding = roleBindingDto.parse(roleBinding);
+        try {
+            const roles = await this.iamClient.getApiV1RoleAssociationsOrganizationByOrganizationId(organizationId, {
+                headers: {
+                    Authorization: `Bearer ${await this.getToken()}`,
+                },
+            });
+            const targetRole = roles.data.find((r) => r.name === parsedRoleBinding.spec.role);
+            if (!targetRole) {
+                this.logger.fatal(`Role ${parsedRoleBinding.spec.role} not found`);
+            }
+            const associations = await this.iamClient.getApiV1RoleAssociationsByRoleId(targetRole.id, {
+                headers: {
+                    Authorization: `Bearer ${await this.getToken()}`,
+                },
+            });
+            for (const subject of parsedRoleBinding.spec.subjects) {
+                switch (subject.type) {
+                    case "user": {
+                        const existingAssociation = associations.data.users.find((a) => a.userId === subject.id);
+                        if (!existingAssociation) {
+                            this.logger.error(`User ${subject.id} not bound to role ${targetRole.id}`);
+                            continue;
+                        }
+                        const result = await this.iamClient.deleteApiV1RoleAssociationsUserByUserId(subject.id, { roleId: targetRole.id }, {
+                            headers: {
+                                Authorization: `Bearer ${await this.getToken()}`,
+                            },
+                        });
+                        if (result.status !== 200) {
+                            this.logger.error(`Failed to delete role binding for user ${subject.id}: ${result.statusText}`);
+                        }
+                        break;
+                    }
+                    case "key": {
+                        const result = await this.iamClient.deleteApiV1RoleAssociationsKeyByKeyId(subject.id, { roleId: targetRole.id }, {
+                            headers: {
+                                Authorization: `Bearer ${await this.getToken()}`,
+                            },
+                        });
+                        if (result.status !== 200) {
+                            this.logger.error(`Failed to delete role binding for key ${subject.id}: ${result.statusText}`);
+                        }
+                        break;
+                    }
+                }
+            }
+            return true;
+        }
+        catch (error) {
+            if (typeof error === "object" && error !== null && "error" in error) {
+                const err = error;
+                this.logger.fatal(`Failed to delete role with error(${err.error.status} - ${err.error.code}): ${err.error.message}`);
+            }
+            else {
+                this.logger.fatal(`Failed to delete role with unknown error: ${error}`);
+            }
+        }
+    }
+}

package/dist/resource-types/role.resource.d.ts

@@ -0,0 +1,65 @@
+import type { Logger } from "@flowcore/cli-plugin-config";
+import { z } from "zod";
+import type { Api as IamApi } from "../utils/clients/iam/Api.js";
+export declare const roleDto: z.ZodObject<z.objectUtil.extendShape<{
+    apiVersion: z.ZodString;
+    kind: z.ZodString;
+    metadata: z.ZodObject<{
+        name: z.ZodString;
+        tenant: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        name: string;
+        tenant: string;
+    }, {
+        name: string;
+        tenant: string;
+    }>;
+}, {
+    spec: z.ZodObject<{
+        description: z.ZodOptional<z.ZodString>;
+        flowcoreManaged: z.ZodOptional<z.ZodBoolean>;
+        policies: z.ZodArray<z.ZodString, "many">;
+    }, "strip", z.ZodTypeAny, {
+        policies: string[];
+        description?: string | undefined;
+        flowcoreManaged?: boolean | undefined;
+    }, {
+        policies: string[];
+        description?: string | undefined;
+        flowcoreManaged?: boolean | undefined;
+    }>;
+}>, "strip", z.ZodTypeAny, {
+    kind: string;
+    apiVersion: string;
+    metadata: {
+        name: string;
+        tenant: string;
+    };
+    spec: {
+        policies: string[];
+        description?: string | undefined;
+        flowcoreManaged?: boolean | undefined;
+    };
+}, {
+    kind: string;
+    apiVersion: string;
+    metadata: {
+        name: string;
+        tenant: string;
+    };
+    spec: {
+        policies: string[];
+        description?: string | undefined;
+        flowcoreManaged?: boolean | undefined;
+    };
+}>;
+export type Role = z.infer<typeof roleDto>;
+export type ApiRoleResource = Awaited<ReturnType<IamApi["getApiV1RoleAssociationsOrganizationByOrganizationId"]>>["data"][0];
+export declare class RoleService {
+    private readonly iamClient;
+    private readonly logger;
+    private readonly getToken;
+    constructor(iamClient: IamApi, logger: Logger, getToken: () => Promise<string>);
+    createNewRole(organizationId: string, role: unknown, skipConfirmation: boolean): Promise<boolean>;
+    deleteRole(organizationId: string, role: unknown): Promise<boolean>;
+}