@gambi97/keel-cli 0.3.6 → 0.3.7

package/README.md

@@ -263,6 +263,12 @@ creating anything**.
    `ContainersFullAccess`, `ServerlessSQLDatabaseFullAccess`,
    `ContainerRegistryFullAccess`, plus `IAMManager` so Terraform can create
    the app's dedicated least-privilege database credential).
+5. **Organization security settings — API-key expiration must be unlimited**
+   (Console → Organization → Security → API keys). The app's database and
+   Object Storage credentials are non-expiring service credentials by design
+   (the container reads them at runtime); if your organization forces API
+   keys to expire, the first CI apply fails creating them. keel checks this
+   setting during validation and warns before anything is created.
 
 </details>
 
@@ -273,7 +279,9 @@ creating anything**.
 1. Create an account at [app.infisical.com](https://app.infisical.com) (or
    use a self-hosted instance).
 2. Create a **Machine Identity** with **Universal Auth**: you need its
-   **client ID** and **client secret**.
+   **client ID** and **client secret**. Create the client secret with
+   **unlimited uses** (Max Number of Uses = 0): CI logs in with it on every
+   plan/apply, so any finite usage limit eventually runs out mid-pipeline.
 3. Give the identity permission to create and manage projects.
 
 </details>

package/dist/bootstrap/infisical.js

@@ -30,8 +30,15 @@ export async function login(infisical) {
     const { host, clientId, clientSecret } = infisical;
     const { status, data } = await api(host, '/api/v1/auth/universal-auth/login', { method: 'POST', body: { clientId, clientSecret } });
     if (status !== 200 || !data.accessToken) {
-        throw new InfisicalError(`Infisical Universal Auth login failed (HTTP ${status}${data.message ? `: ${data.message}` : ''}). ` +
-            'Check the machine identity client ID/secret and that Universal Auth is enabled.');
+        // A usage-limited client secret is a trap for this setup: besides the
+        // bootstrap, CI logs in with it on every plan/apply, so any finite limit
+        // eventually runs out. Name the fix instead of a generic "check secret".
+        const remediation = /usage limit/i.test(data.message ?? '')
+            ? 'This client secret was created with a usage limit and it is spent. Create a new one ' +
+                'with unlimited uses (Max Number of Uses = 0): CI logs in with it on every plan/apply, ' +
+                'so a limited secret will always run out.'
+            : 'Check the machine identity client ID/secret and that Universal Auth is enabled.';
+        throw new InfisicalError(`Infisical Universal Auth login failed (HTTP ${status}${data.message ? `: ${data.message}` : ''}). ${remediation}`);
     }
     return data.accessToken;
 }

package/dist/bootstrap/scaleway.js

@@ -7,10 +7,38 @@ export class ScalewayError extends Error {
     }
 }
 const API_BASE = 'https://api.scaleway.com';
+/**
+ * The generated stack creates non-expiring service credentials (the app's
+ * database and Object Storage API keys are read by the container at runtime).
+ * An organization security setting that forces API-key expiration makes the
+ * very first CI apply fail — hours after the bootstrap looked green. Read the
+ * setting here (read-only) so the run can warn upfront, while it is still a
+ * 30-second console fix. Returns undefined when the key cannot read it.
+ */
+async function apiKeyExpirationPolicyWarning(secretKey, organizationId) {
+    try {
+        const response = await fetch(`${API_BASE}/iam/v1alpha1/organizations/${organizationId}/security-settings`, { headers: { 'X-Auth-Token': secretKey } });
+        if (!response.ok)
+            return undefined;
+        const settings = (await response.json());
+        const seconds = Number.parseInt(settings.max_api_key_expiration_duration ?? '0', 10);
+        if (!Number.isFinite(seconds) || seconds <= 0)
+            return undefined; // "0s" = unlimited
+        return ('Your Scaleway organization requires API keys to expire ' +
+            `(max ${Math.round(seconds / 86400)} days). The database/storage credentials the ` +
+            'generated stack creates are non-expiring service credentials, so the first CI apply ' +
+            'WILL fail on them. Disable the requirement first (Console → Organization → Security → ' +
+            'API keys), then merge or re-run the apply.');
+    }
+    catch {
+        return undefined;
+    }
+}
 /**
  * Validate credentials with a harmless read call before creating anything.
  * Also confirms the project belongs to the given organization. Read-only: it
- * proves the key can see the project, not that it can create resources.
+ * proves the key can see the project, not that it can create resources. The
+ * returned warning flags an org policy that would break the first CI apply.
  */
 export async function validateScalewayCredentials(scaleway) {
     const { secretKey, projectId, organizationId } = scaleway;
@@ -32,6 +60,8 @@ export async function validateScalewayCredentials(scaleway) {
         throw new ScalewayError(`Scaleway project ${projectId} belongs to organization ${project.organization_id}, ` +
             `not ${organizationId}. Check --scw-organization-id.`, 'organization');
     }
+    const warning = await apiKeyExpirationPolicyWarning(secretKey, organizationId);
+    return warning ? { warning } : {};
 }
 const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 /**

package/dist/index.js

@@ -298,8 +298,9 @@ async function runBootstrap(answers, state, options) {
     else {
         // All three credentials are checked before anything is created anywhere,
         // so a bad token cannot leave a half-bootstrapped account behind.
+        let scalewayWarning;
         await withSpinner('Validating Scaleway, Infisical and GitHub credentials', async () => {
-            await validateScalewayCredentials(answers.scaleway);
+            scalewayWarning = (await validateScalewayCredentials(answers.scaleway)).warning;
             await validateInfisical(answers.infisical);
             ctx = await createContext(answers.github);
             // A repo with commits would make the push fail after the bucket and the
@@ -310,6 +311,8 @@ async function runBootstrap(answers, state, options) {
                 assertRepoUsable(ctx, repoState);
             }
         });
+        if (scalewayWarning)
+            log.warn(scalewayWarning);
     }
     for (const step of BOOTSTRAP_STEPS) {
         if (isDone(state, step.name)) {

package/dist/prompts.js

@@ -358,11 +358,16 @@ async function askScaleway(out) {
             out.scaleway.organizationId = await text('Scaleway organization ID');
         }
         try {
-            await validateScalewayCredentials({
+            const { warning } = await validateScalewayCredentials({
                 secretKey: out.scaleway.secretKey,
                 projectId: out.scaleway.projectId,
                 organizationId: out.scaleway.organizationId,
             });
+            // e.g. an org policy that would make the first CI apply fail: better a
+            // loud heads-up now, while it is a 30-second console fix, than a red
+            // pipeline hours after everything here looked green.
+            if (warning)
+                log.warn(warning);
             p.outro('Scaleway connected — credentials valid and project reachable.');
             return;
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gambi97/keel-cli",
-  "version": "0.3.6",
+  "version": "0.3.7",
   "description": "One command from zero to a production-shaped serverless infrastructure on Scaleway (Terraform + GitHub Actions + Infisical). Only Node required.",
   "keywords": [
     "keel",

package/templates/README.md

@@ -209,6 +209,10 @@ Avoid local applies: they race against CI on the same state.
   match a Scaleway key with Object Storage access.
 - **Plan fails reading Infisical secrets**: check `INFISICAL_PROJECT_ID` and
   that the machine identity has access to the project and every environment.
+  If the error mentions a **usage limit**, the machine identity's client
+  secret was created with a maximum number of uses and it is spent: create a
+  new client secret with unlimited uses (the pipeline logs in on every
+  plan/apply) and update the `INFISICAL_CLIENT_SECRET` Actions secret.
 - **Apply green but no container**: expected until `container_image` is set.
 - **App can't reach the database**: `DATABASE_URL` is only synced after an
   apply; check the value in Infisical for that environment. It must contain