@govuk-pay/cli 0.0.26 → 0.0.28

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@govuk-pay/cli",
-  "version": "0.0.26",
+  "version": "0.0.28",
   "description": "GOV.UK Pay Command Line Interface",
   "bin": {
     "pay": "bin/cli.js",

package/resources/usageDetails.txt

@@ -1,10 +1,8 @@
 Commands:
   pay browse                   # Opens web browser link to useful links
-  pay deployment_status <env>  # Describe what's deployed
   pay doctor                   # Attempts to initialise or fix the Pay CLI
   pay help [COMMAND]           # Describe available commands or one specific ...
   pay local                    # Sets up local Pay development environment
   pay schema                   # Generates web based database diagrams and me...
   pay secrets                  # Manage secrets in and between environments
-  pay ssm                      # Start an SSM session to boxes in environments
   pay tunnel                   # Open tunnel to application database

package/src/commands/tunnel.js

@@ -10,6 +10,7 @@ const client_ecs_1 = require("@aws-sdk/client-ecs");
 const client_rds_1 = require("@aws-sdk/client-rds");
 const client_ssm_1 = require("@aws-sdk/client-ssm");
 const readline_1 = __importDefault(require("readline"));
+const promises_1 = __importDefault(require("node:readline/promises"));
 const child_process_1 = require("child_process");
 const constants_js_1 = require("../core/constants.js");
 let ec2;
@@ -29,6 +30,30 @@ function logTunnelCommands() {
     pay tunnel help                     # Describe tunnel command`);
 }
 exports.logTunnelCommands = logTunnelCommands;
+async function readInputForReadOrWriteDBAccess() {
+    const rl = promises_1.default.createInterface({
+        input: process.stdin,
+        output: process.stdout
+    });
+    let answer = await rl.question('Do you require read-only access, or write-access to the database? [R/w]: ');
+    rl.close();
+    if (answer === undefined || answer === '') {
+        answer = 'R';
+        console.log('No option entered. Defaulting to read-only');
+    }
+    if (answer === 'R' || answer === 'r') {
+        printGreen('Database read-only access requested');
+        return 'read-only';
+    }
+    else if (answer === 'w') {
+        printGreen('Database write access requested');
+        return 'write';
+    }
+    else {
+        printError('Invalid option entered. Exiting..');
+        process.exit(1);
+    }
+}
 async function tunnelHandler(options) {
     await (0, standardContent_js_1.showHeader)();
     const { environment, application } = parseArguments(options);
@@ -39,10 +64,11 @@ async function tunnelHandler(options) {
     let bastionTask = null;
     try {
         printWarningToUser();
+        const dbAccessType = await readInputForReadOrWriteDBAccess();
         const database = await getDatabaseDetails(environment, application);
         bastionTask = await startBastion(environment);
         openTunnel(bastionTask, database, environment);
-        printHowToTunnelText(application, environment, database.EngineVersion);
+        await printHowToTunnelText(application, environment, database.EngineVersion, dbAccessType);
         await waitForExit();
         await shutdown(environment, bastionTask);
     }
@@ -345,10 +371,10 @@ async function terminateSession(task, environment) {
         }
     }
 }
-function printHowToTunnelText(application, environment, dbEngineVersion) {
-    const dbUser = getDbUser(application);
-    const payLowPassDbSecretName = getPayLowPassDbSecretname(environment, dbUser);
-    const paySecretsPasswordName = getPaySecretsPasswordName();
+async function printHowToTunnelText(application, environment, dbEngineVersion, dbAccessType) {
+    const dbUser = await getDbUser(environment, application, dbAccessType);
+    const payLowPassDbSecretName = getPayLowPassDbSecretName(environment, dbUser, dbAccessType);
+    const paySecretsPasswordName = getPaySecretsPasswordName(dbAccessType);
     printGreen(`\nConnected tunnel to ${application} RDS database in ${environment} on port 65432\n`);
     printGreen('Copy DB credentials to clipboard (in another window) using pay-low-pass:');
     printGreen(`  pay-low-pass ${payLowPassDbSecretName} | pbcopy`);
@@ -361,15 +387,42 @@ function printHowToTunnelText(application, environment, dbEngineVersion) {
     printGreen('Or even more conveniently connect using a docker container and set the password automatically using pay-low-pass:');
     printGreen(`   docker run -e "PGPASSWORD=$(pay-low-pass ${payLowPassDbSecretName})" --rm -ti postgres:${dbEngineVersion}-alpine psql --host docker.for.mac.localhost --port 65432 --user ${dbUser} --dbname ${application}\n`);
 }
-// TODO: add a write flag. Default to readonly.
-function getDbUser(application) {
-    return `${application}_support_readonly`;
+async function getDbUser(environment, application, dbAccessType) {
+    let paramName;
+    if (dbAccessType === 'write') {
+        paramName = `${environment}_${application}.db_user`;
+    }
+    else {
+        paramName = `${environment}_${application}.db_support_user_readonly`;
+    }
+    const ssmClient = new client_ssm_1.SSMClient();
+    const input = { Names: [paramName], WithDecryption: true };
+    const command = new client_ssm_1.GetParametersCommand(input);
+    const response = await ssmClient.send(command);
+    if (response?.Parameters?.length !== undefined && response?.Parameters?.length > 0 &&
+        response?.Parameters[0]?.Value !== undefined) {
+        return response.Parameters[0].Value;
+    }
+    else {
+        printError('Unable to get database username from Parameter Store');
+        return '';
+    }
 }
-function getPayLowPassDbSecretname(environment, user) {
-    return `aws/rds/support_readonly_users/${environment.split('-')[0]}/${user}`;
+function getPayLowPassDbSecretName(environment, user, dbAccessType) {
+    if (dbAccessType === 'write') {
+        return `aws/rds/application_users/${environment.split('-')[0]}/${user}`;
+    }
+    else {
+        return `aws/rds/support_readonly_users/${environment.split('-')[0]}/${user}`;
+    }
 }
-function getPaySecretsPasswordName() {
-    return 'DB_SUPPORT_PASSWORD_READONLY';
+function getPaySecretsPasswordName(dbAccessType) {
+    if (dbAccessType === 'write') {
+        return 'DB_PASSWORD';
+    }
+    else {
+        return 'DB_SUPPORT_PASSWORD_READONLY';
+    }
 }
 function printWarningToUser() {
     console.log(FORMAT.yellow, '⚠️  WARNING: When using SSM, any and all activity you perform may be getting logged for security auditing purposes (think PCI).', FORMAT.reset);

package/src/core/commandRouter.js

@@ -21,9 +21,6 @@ handlers.set('tunnel', {
 handlers.set('legacy', {
     handler: legacy_1.default
 });
-handlers.set('deployment_status', {
-    handler: legacy_1.default
-});
 handlers.set('doctor', {
     handler: legacy_1.default
 });
@@ -39,9 +36,6 @@ handlers.set('schema', {
 handlers.set('secrets', {
     handler: legacy_1.default
 });
-handlers.set('ssm', {
-    handler: legacy_1.default
-});
 handlers.set('demo', {
     handler: demo_js_1.default
 });

package/resources/legacy-ruby-cli/lib/pay_cli/commands/ssm.rb

@@ -1,58 +0,0 @@
-require 'aws-sdk-ec2'
-require 'aws-sdk-autoscaling'
-require 'aws-sdk-elasticloadbalancing'
-
-module PayCLI::Commands::Ssm
-
-  def self.usage!
-    STDERR.puts <<~USAGE
-      pay ssm <environment> <instance_id>
-
-      example:
-        pay ssm test-12 i-1c472d8c2ffd826d7
-
-    USAGE
-    exit
-  end
-
-  def self.start!
-    args = ARGV[1..-1] || []
-    usage! if args.length != 2
-
-    PayCLI::StopYubicoAuthenticator.stop_yubico_authenticator!
-
-    env, instance_id = args
-
-    usage! unless instance_id.match(/^i-/)
-
-    PayCLI::Environment.setup! env
-
-    warn <<~WARN
-      \e[33m
-      ⚠️  WARNING: When using SSM, any and all activity you perform may be getting logged for security auditing purposes (think PCI).
-         Avoid sending or accessing \e[4manything\e[24m that could cause a security breach, such as:
-
-          • Secret API Keys or Tokens
-          • Credentials or Passwords
-          • Cardholder Data or Personally-Identifiable Information (PII)
-          • Anything else that may be protected by GDPR or PCI-DSS
-          • Anything classified as GSC 'Secret' or above
-
-         If you have a problem with this or aren't sure, use Ctrl-C \e[4mright now\e[24m and discontinue your SSM session.
-      \e[0m
-    WARN
-    sleep(5)
-    start_ssm_session(instance_id, env)
-  end
-
-  def self.start_ssm_session(instance_id, env)
-    STDERR.puts "SSM to instance #{instance_id} in #{env}"
-
-    pid = spawn(
-      "aws ssm start-session --target \"#{instance_id}\"",
-      in: STDIN, out: STDOUT, err: STDERR
-    )
-    Process.wait pid
-    exit $CHILD_STATUS.exitstatus
-  end
-end