@flowcore/cli-plugin-iam 1.0.0 → 1.2.1

package/dist/resource-types/role-binding.resource.d.ts

@@ -0,0 +1,82 @@
+import type { Logger } from "@flowcore/cli-plugin-config";
+import { z } from "zod";
+import type { Api as IamApi } from "../utils/clients/iam/Api.js";
+export declare const roleBindingDto: z.ZodObject<z.objectUtil.extendShape<{
+    apiVersion: z.ZodString;
+    kind: z.ZodString;
+    metadata: z.ZodObject<{
+        name: z.ZodString;
+        tenant: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        name: string;
+        tenant: string;
+    }, {
+        name: string;
+        tenant: string;
+    }>;
+}, {
+    spec: z.ZodObject<{
+        role: z.ZodString;
+        subjects: z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            type: z.ZodEnum<["user", "key"]>;
+        }, "strip", z.ZodTypeAny, {
+            id: string;
+            type: "key" | "user";
+        }, {
+            id: string;
+            type: "key" | "user";
+        }>, "many">;
+    }, "strip", z.ZodTypeAny, {
+        subjects: {
+            id: string;
+            type: "key" | "user";
+        }[];
+        role: string;
+    }, {
+        subjects: {
+            id: string;
+            type: "key" | "user";
+        }[];
+        role: string;
+    }>;
+}>, "strip", z.ZodTypeAny, {
+    kind: string;
+    apiVersion: string;
+    metadata: {
+        name: string;
+        tenant: string;
+    };
+    spec: {
+        subjects: {
+            id: string;
+            type: "key" | "user";
+        }[];
+        role: string;
+    };
+}, {
+    kind: string;
+    apiVersion: string;
+    metadata: {
+        name: string;
+        tenant: string;
+    };
+    spec: {
+        subjects: {
+            id: string;
+            type: "key" | "user";
+        }[];
+        role: string;
+    };
+}>;
+export type RoleBinding = z.infer<typeof roleBindingDto>;
+export type ApiRoleResource = Awaited<ReturnType<IamApi["getApiV1RoleAssociationsOrganizationByOrganizationId"]>>["data"][0];
+export type ApiRoleAssociationResource = Awaited<ReturnType<IamApi["getApiV1RoleAssociationsByRoleId"]>>["data"];
+export declare class RoleBindingService {
+    private readonly iamClient;
+    private readonly logger;
+    private readonly getToken;
+    constructor(iamClient: IamApi, logger: Logger, getToken: () => Promise<string>);
+    createNewRoleBinding(organizationId: string, roleBinding: unknown, skipConfirmation: boolean): Promise<boolean>;
+    deleteRoleBinding(organizationId: string, roleBinding: unknown): Promise<boolean>;
+}

package/dist/resource-types/role-binding.resource.js

@@ -0,0 +1,203 @@
+import { baseResourceDto } from "@flowcore/cli-plugin-core";
+import enquirer from "enquirer";
+import { diffString } from "json-diff";
+import { z } from "zod";
+export const roleBindingDto = baseResourceDto.extend({
+    spec: z.object({
+        role: z.string(),
+        subjects: z.array(z.object({
+            id: z.string(),
+            type: z.enum(["user", "key"]),
+        })),
+    }),
+});
+export class RoleBindingService {
+    iamClient;
+    logger;
+    getToken;
+    constructor(iamClient, logger, getToken) {
+        this.iamClient = iamClient;
+        this.logger = logger;
+        this.getToken = getToken;
+    }
+    async createNewRoleBinding(organizationId, roleBinding, skipConfirmation) {
+        const parsedRoleBinding = roleBindingDto.parse(roleBinding);
+        try {
+            const roles = await this.iamClient.getApiV1RoleAssociationsOrganizationByOrganizationId(organizationId, {
+                headers: {
+                    Authorization: `Bearer ${await this.getToken()}`,
+                },
+            });
+            const existingRole = roles.data.find((r) => r.name === parsedRoleBinding.spec.role);
+            if (!existingRole) {
+                this.logger.error(`Role ${parsedRoleBinding.spec.role} not found`);
+                return false;
+            }
+            const associations = await this.iamClient.getApiV1RoleAssociationsByRoleId(existingRole.id, {
+                headers: {
+                    Authorization: `Bearer ${await this.getToken()}`,
+                },
+            });
+            const usersToDelete = [];
+            for (const userAssociation of associations.data.users.filter((u) => u.roleId !== existingRole.id)) {
+                if (!parsedRoleBinding.spec.subjects.find((s) => s.type === "user" && s.id === userAssociation.userId)) {
+                    usersToDelete.push(userAssociation.userId);
+                }
+            }
+            const keysToDelete = [];
+            for (const keyAssociation of associations.data.keys.filter((k) => k.roleId !== existingRole.id)) {
+                if (!parsedRoleBinding.spec.subjects.find((s) => s.type === "key" && s.id === keyAssociation.keyId)) {
+                    keysToDelete.push(keyAssociation.keyId);
+                }
+            }
+            if (!skipConfirmation) {
+                const diffObject = {
+                    keys: associations.data.keys.filter((k) => !keysToDelete.includes(k.keyId)),
+                    users: associations.data.users.filter((u) => !usersToDelete.includes(u.userId)),
+                };
+                this.logger.info("Modifying the following:");
+                this.logger.info(`${diffString(associations.data.users.map((u) => u.userId), diffObject.users, { color: true, full: true })}`);
+                this.logger.info(`${diffString(associations.data.keys.map((k) => k.keyId), diffObject.keys, { color: true, full: true })}`);
+                const { confirm } = await enquirer.prompt([
+                    {
+                        message: `Are you sure you want to remove ${usersToDelete.length} users and ${keysToDelete.length} keys from role ${existingRole.name}?`,
+                        name: "confirm",
+                        type: "confirm",
+                    },
+                ]);
+                if (!confirm) {
+                    return false;
+                }
+            }
+            let changed = keysToDelete.length > 0 || usersToDelete.length > 0;
+            for (const userId of usersToDelete) {
+                const result = await this.iamClient.deleteApiV1RoleAssociationsUserByUserId(userId, { roleId: existingRole.id }, {
+                    headers: {
+                        Authorization: `Bearer ${await this.getToken()}`,
+                    },
+                });
+                if (result.status !== 200) {
+                    this.logger.error(`Failed to delete user ${userId} from role ${existingRole.id}: ${result.statusText}`);
+                }
+            }
+            for (const keyId of keysToDelete) {
+                const result = await this.iamClient.deleteApiV1RoleAssociationsKeyByKeyId(keyId, { roleId: existingRole.id }, {
+                    headers: {
+                        Authorization: `Bearer ${await this.getToken()}`,
+                    },
+                });
+                if (result.status !== 200) {
+                    this.logger.error(`Failed to delete key ${keyId} from role ${existingRole.id}: ${result.statusText}`);
+                }
+            }
+            for (const subject of parsedRoleBinding.spec.subjects) {
+                switch (subject.type) {
+                    case "user": {
+                        const existingAssociation = associations.data.users.find((a) => a.userId === subject.id);
+                        if (existingAssociation) {
+                            this.logger.debug(`User ${subject.id} already bound to role ${existingRole.id}`);
+                            continue;
+                        }
+                        const result = await this.iamClient.postApiV1RoleAssociationsUserByUserId(subject.id, { roleId: existingRole.id }, {
+                            headers: {
+                                Authorization: `Bearer ${await this.getToken()}`,
+                            },
+                        });
+                        if (result.status !== 200) {
+                            this.logger.error(`Failed to bind user ${subject.id} to role ${existingRole.id}: ${result.statusText}`);
+                        }
+                        changed = true;
+                        break;
+                    }
+                    case "key": {
+                        const existingAssociation = associations.data.keys.find((a) => a.keyId === subject.id);
+                        if (existingAssociation) {
+                            this.logger.debug(`Key ${subject.id} already bound to role ${existingRole.id}`);
+                            continue;
+                        }
+                        const result = await this.iamClient.postApiV1RoleAssociationsKeyByKeyId(subject.id, { roleId: existingRole.id }, {
+                            headers: {
+                                Authorization: `Bearer ${await this.getToken()}`,
+                            },
+                        });
+                        if (result.status !== 200) {
+                            this.logger.error(`Failed to bind key ${subject.id} to role ${existingRole.id}: ${result.statusText}`);
+                        }
+                        changed = true;
+                        break;
+                    }
+                }
+            }
+            return changed;
+        }
+        catch (error) {
+            if (typeof error === "object" && error !== null && "error" in error) {
+                const err = error;
+                this.logger.fatal(`Failed to create role binding with error(${err.error.status} - ${err.error.code}): ${err.error.message}`);
+            }
+            else {
+                this.logger.fatal(`Failed to create role binding with unknown error: ${error}`);
+            }
+        }
+    }
+    async deleteRoleBinding(organizationId, roleBinding) {
+        const parsedRoleBinding = roleBindingDto.parse(roleBinding);
+        try {
+            const roles = await this.iamClient.getApiV1RoleAssociationsOrganizationByOrganizationId(organizationId, {
+                headers: {
+                    Authorization: `Bearer ${await this.getToken()}`,
+                },
+            });
+            const targetRole = roles.data.find((r) => r.name === parsedRoleBinding.spec.role);
+            if (!targetRole) {
+                this.logger.fatal(`Role ${parsedRoleBinding.spec.role} not found`);
+            }
+            const associations = await this.iamClient.getApiV1RoleAssociationsByRoleId(targetRole.id, {
+                headers: {
+                    Authorization: `Bearer ${await this.getToken()}`,
+                },
+            });
+            for (const subject of parsedRoleBinding.spec.subjects) {
+                switch (subject.type) {
+                    case "user": {
+                        const existingAssociation = associations.data.users.find((a) => a.userId === subject.id);
+                        if (!existingAssociation) {
+                            this.logger.error(`User ${subject.id} not bound to role ${targetRole.id}`);
+                            continue;
+                        }
+                        const result = await this.iamClient.deleteApiV1RoleAssociationsUserByUserId(subject.id, { roleId: targetRole.id }, {
+                            headers: {
+                                Authorization: `Bearer ${await this.getToken()}`,
+                            },
+                        });
+                        if (result.status !== 200) {
+                            this.logger.error(`Failed to delete role binding for user ${subject.id}: ${result.statusText}`);
+                        }
+                        break;
+                    }
+                    case "key": {
+                        const result = await this.iamClient.deleteApiV1RoleAssociationsKeyByKeyId(subject.id, { roleId: targetRole.id }, {
+                            headers: {
+                                Authorization: `Bearer ${await this.getToken()}`,
+                            },
+                        });
+                        if (result.status !== 200) {
+                            this.logger.error(`Failed to delete role binding for key ${subject.id}: ${result.statusText}`);
+                        }
+                        break;
+                    }
+                }
+            }
+            return true;
+        }
+        catch (error) {
+            if (typeof error === "object" && error !== null && "error" in error) {
+                const err = error;
+                this.logger.fatal(`Failed to delete role with error(${err.error.status} - ${err.error.code}): ${err.error.message}`);
+            }
+            else {
+                this.logger.fatal(`Failed to delete role with unknown error: ${error}`);
+            }
+        }
+    }
+}

package/dist/resource-types/role.resource.d.ts

@@ -0,0 +1,65 @@
+import type { Logger } from "@flowcore/cli-plugin-config";
+import { z } from "zod";
+import type { Api as IamApi } from "../utils/clients/iam/Api.js";
+export declare const roleDto: z.ZodObject<z.objectUtil.extendShape<{
+    apiVersion: z.ZodString;
+    kind: z.ZodString;
+    metadata: z.ZodObject<{
+        name: z.ZodString;
+        tenant: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        name: string;
+        tenant: string;
+    }, {
+        name: string;
+        tenant: string;
+    }>;
+}, {
+    spec: z.ZodObject<{
+        description: z.ZodOptional<z.ZodString>;
+        flowcoreManaged: z.ZodOptional<z.ZodBoolean>;
+        policies: z.ZodArray<z.ZodString, "many">;
+    }, "strip", z.ZodTypeAny, {
+        policies: string[];
+        description?: string | undefined;
+        flowcoreManaged?: boolean | undefined;
+    }, {
+        policies: string[];
+        description?: string | undefined;
+        flowcoreManaged?: boolean | undefined;
+    }>;
+}>, "strip", z.ZodTypeAny, {
+    kind: string;
+    apiVersion: string;
+    metadata: {
+        name: string;
+        tenant: string;
+    };
+    spec: {
+        policies: string[];
+        description?: string | undefined;
+        flowcoreManaged?: boolean | undefined;
+    };
+}, {
+    kind: string;
+    apiVersion: string;
+    metadata: {
+        name: string;
+        tenant: string;
+    };
+    spec: {
+        policies: string[];
+        description?: string | undefined;
+        flowcoreManaged?: boolean | undefined;
+    };
+}>;
+export type Role = z.infer<typeof roleDto>;
+export type ApiRoleResource = Awaited<ReturnType<IamApi["getApiV1RoleAssociationsOrganizationByOrganizationId"]>>["data"][0];
+export declare class RoleService {
+    private readonly iamClient;
+    private readonly logger;
+    private readonly getToken;
+    constructor(iamClient: IamApi, logger: Logger, getToken: () => Promise<string>);
+    createNewRole(organizationId: string, role: unknown, skipConfirmation: boolean): Promise<boolean>;
+    deleteRole(organizationId: string, role: unknown): Promise<boolean>;
+}

package/dist/resource-types/role.resource.js

@@ -0,0 +1,191 @@
+import { baseResourceDto } from "@flowcore/cli-plugin-core";
+import { diff } from "@opentf/obj-diff";
+import enquirer from "enquirer";
+import { diffString } from "json-diff";
+import { inspect } from "node:util";
+import { z } from "zod";
+export const roleDto = baseResourceDto.extend({
+    spec: z.object({
+        description: z.string().optional(),
+        flowcoreManaged: z.boolean().optional(),
+        policies: z.array(z.string()),
+    }),
+});
+export class RoleService {
+    iamClient;
+    logger;
+    getToken;
+    constructor(iamClient, logger, getToken) {
+        this.iamClient = iamClient;
+        this.logger = logger;
+        this.getToken = getToken;
+    }
+    async createNewRole(organizationId, role, skipConfirmation) {
+        const parsedRole = roleDto.parse(role);
+        try {
+            const roles = await this.iamClient.getApiV1RoleAssociationsOrganizationByOrganizationId(organizationId, {
+                headers: {
+                    Authorization: `Bearer ${await this.getToken()}`,
+                },
+            });
+            const existingRole = roles.data.find((r) => r.name === parsedRole.metadata.name);
+            const policies = await this.iamClient.getApiV1PolicyAssociationsOrganizationByOrganizationId(organizationId, {
+                headers: {
+                    Authorization: `Bearer ${await this.getToken()}`,
+                },
+            });
+            const linkedPolicies = policies.data.filter((p) => parsedRole.spec.policies.includes(p.name));
+            if (!existingRole) {
+                const result = await this.iamClient.postApiV1Roles({
+                    description: parsedRole.spec.description ?? undefined,
+                    name: parsedRole.metadata.name,
+                    organizationId,
+                }, {
+                    headers: {
+                        Authorization: `Bearer ${await this.getToken()}`,
+                    },
+                });
+                if (result.status !== 200) {
+                    this.logger.fatal(`Failed to create role: ${result.statusText}`);
+                }
+                const role = result.data;
+                for (const linkedPolicy of linkedPolicies) {
+                    const binding = await this.iamClient.postApiV1PolicyAssociationsRoleByRoleId(role.id, {
+                        policyId: linkedPolicy.id,
+                    }, {
+                        headers: {
+                            Authorization: `Bearer ${await this.getToken()}`,
+                        },
+                    });
+                    if (binding.status !== 200) {
+                        this.logger.fatal(`Failed to bind policy ${linkedPolicy.id} to role ${role.id}: ${binding.statusText}`);
+                    }
+                }
+                return true;
+            }
+            const alreadyLinkedPolicies = await this.iamClient.getApiV1PolicyAssociationsRoleByRoleId(existingRole.id, {
+                headers: {
+                    Authorization: `Bearer ${await this.getToken()}`,
+                },
+            });
+            this.logger.debug(`Found ${inspect(alreadyLinkedPolicies.data)} policies linked to role ${existingRole.id}`);
+            const newRole = {
+                description: parsedRole.spec.description ?? "",
+                name: parsedRole.metadata.name,
+                policies: parsedRole.spec.policies.sort(),
+            };
+            const existingRoleData = {
+                description: existingRole.description ?? "",
+                name: existingRole.name,
+                policies: alreadyLinkedPolicies.data.map((p) => p.name).sort(),
+            };
+            const diffResult = diff(existingRoleData, newRole);
+            if (diffResult.length === 0) {
+                return false;
+            }
+            if (!skipConfirmation) {
+                this.logger.info("Role has changed, do you want to apply these changes?");
+                this.logger.info(diffString(existingRoleData, newRole, {
+                    color: true,
+                    full: true,
+                }));
+                const { confirm } = await enquirer.prompt({
+                    message: "Are you sure you want to update the role?",
+                    name: "confirm",
+                    type: "confirm",
+                });
+                if (!confirm) {
+                    return false;
+                }
+            }
+            const result = await this.iamClient.patchApiV1RolesById(existingRole.id, {
+                description: newRole.description,
+                id: existingRole.id,
+                name: newRole.name,
+                organizationId,
+            }, {
+                headers: {
+                    Authorization: `Bearer ${await this.getToken()}`,
+                },
+            });
+            if (result.status !== 200) {
+                this.logger.fatal(`Failed to update role: ${result.statusText}`);
+            }
+            const toAdd = newRole.policies.filter((p) => !existingRoleData.policies.includes(p));
+            const toRemove = existingRoleData.policies.filter((p) => !newRole.policies.includes(p));
+            for (const policy of toAdd) {
+                const policyId = policies.data.find((p) => p.name === policy)?.id;
+                if (!policyId) {
+                    this.logger.fatal(`Policy ${policy} not found`);
+                }
+                const binding = await this.iamClient.postApiV1PolicyAssociationsRoleByRoleId(existingRole.id, { policyId }, {
+                    headers: {
+                        Authorization: `Bearer ${await this.getToken()}`,
+                    },
+                });
+                if (binding.status !== 200) {
+                    this.logger.error(`Failed to bind policy ${policyId} to role ${existingRole.id}: ${binding.statusText}`);
+                }
+                this.logger.debug(`Created binding for policy ${policyId} to role ${existingRole.id}`);
+            }
+            for (const policy of toRemove) {
+                console.log(policy, alreadyLinkedPolicies.data);
+                const policyId = alreadyLinkedPolicies.data.find((p) => p.name === policy)?.id;
+                if (!policyId) {
+                    this.logger.fatal(`Policy ${policy} not found`);
+                }
+                const binding = await this.iamClient.deleteApiV1PolicyAssociationsRoleByRoleId(existingRole.id, { policyId }, {
+                    headers: {
+                        Authorization: `Bearer ${await this.getToken()}`,
+                    },
+                });
+                if (binding.status !== 200) {
+                    this.logger.error(`Failed to unbind policy ${policyId} from role ${existingRole.id}: ${binding.statusText}`);
+                }
+                this.logger.debug(`Removed binding for policy ${policyId} from role ${existingRole.id}`);
+            }
+            return true;
+        }
+        catch (error) {
+            if (typeof error === "object" && error !== null && "error" in error) {
+                const err = error;
+                this.logger.fatal(`Failed to create role with error(${err.error.status} - ${err.error.code}): ${err.error.message}`);
+            }
+            else {
+                this.logger.fatal(`Failed to create role with unknown error: ${error}`);
+            }
+        }
+    }
+    async deleteRole(organizationId, role) {
+        const parsedRole = roleDto.parse(role);
+        try {
+            const roles = await this.iamClient.getApiV1RoleAssociationsOrganizationByOrganizationId(organizationId, {
+                headers: {
+                    Authorization: `Bearer ${await this.getToken()}`,
+                },
+            });
+            const existingRole = roles.data.find((r) => r.name === parsedRole.metadata.name);
+            if (!existingRole) {
+                return false;
+            }
+            const result = await this.iamClient.deleteApiV1RolesById(existingRole.id, {
+                headers: {
+                    Authorization: `Bearer ${await this.getToken()}`,
+                },
+            });
+            if (result.status !== 200) {
+                this.logger.fatal(`Failed to delete role: ${result.statusText}`);
+            }
+            return true;
+        }
+        catch (error) {
+            if (typeof error === "object" && error !== null && "error" in error) {
+                const err = error;
+                this.logger.fatal(`Failed to delete role with error(${err.error.status} - ${err.error.code}): ${err.error.message}`);
+            }
+            else {
+                this.logger.fatal(`Failed to delete role with unknown error: ${error}`);
+            }
+        }
+    }
+}