@govuk-pay/cli 0.0.43 → 0.0.45

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@govuk-pay/cli",
-  "version": "0.0.43",
+  "version": "0.0.45",
   "description": "GOV.UK Pay Command Line Interface",
   "bin": {
     "pay": "bin/cli.js",

package/src/commands/local/subcommands/db.js

@@ -19,6 +19,11 @@ const builder = (yargs) => {
         type: 'boolean',
         default: false,
         description: 'Launch psql inside the apps database container (no psql history)'
+    })
+        .option('superuser', {
+        type: 'boolean',
+        default: false,
+        description: 'Connect to the database as the postgres superuser'
     });
 };
 exports.builder = builder;
@@ -27,6 +32,7 @@ async function dbHandler(argv) {
     await (0, standardContent_1.showHeader)();
     const service = argv.app_name;
     const docker = argv.docker;
+    const asSuperuser = argv.superuser;
     if (!(service in servicesConfig)) {
         console.error(`The service specified (${service}) was not defined in the service_config.yaml file`);
         return;
@@ -37,14 +43,14 @@ async function dbHandler(argv) {
         return;
     }
     if (docker) {
-        launchPsqlInDocker(serviceConfig);
+        launchPsqlInDocker(serviceConfig, asSuperuser);
     }
     else if (!psqlAvailable()) {
         console.warn('PSQL installation not found locally.');
-        launchPsqlInDocker(serviceConfig);
+        launchPsqlInDocker(serviceConfig, asSuperuser);
     }
     else {
-        launchPsql(serviceConfig);
+        launchPsql(serviceConfig, asSuperuser);
     }
 }
 exports.default = dbHandler;
@@ -55,7 +61,7 @@ function psqlAvailable() {
     }
     return false;
 }
-function launchPsqlInDocker(serviceConfig) {
+function launchPsqlInDocker(serviceConfig, asSuperuser) {
     console.log('Running psql in running app db container.');
     console.log('Note: This means you wont have a psql history, and one will not survive restarts of pay local');
     (0, node_child_process_1.spawn)('docker', [
@@ -66,18 +72,18 @@ function launchPsqlInDocker(serviceConfig) {
         `${serviceConfig.name}_db`,
         'psql',
         '--host', `${serviceConfig.name}_db`,
-        '--user', serviceConfig.name,
+        '--user', asSuperuser ? 'postgres' : serviceConfig.name,
         '--dbname', serviceConfig.name
     ], { stdio: 'inherit', shell: true });
 }
-function launchPsql(serviceConfig) {
+function launchPsql(serviceConfig, asSuperuser) {
     if (serviceConfig.db_port === undefined) {
         throw new Error(`Service config for ${serviceConfig.name} is missing db_port specification`);
     }
     (0, node_child_process_1.spawn)('psql', [
         '--host', '127.0.0.1',
         '--port', `${serviceConfig.db_port}`,
-        '--user', serviceConfig.name,
+        '--user', asSuperuser ? 'postgres' : serviceConfig.name,
         '--dbname', serviceConfig.name
     ], {
         stdio: 'inherit',

package/src/commands/secrets/subcommands/audit.js

@@ -0,0 +1,30 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handler = exports.builder = exports.desc = exports.command = void 0;
+const node_child_process_1 = require("node:child_process");
+const preflight_js_1 = __importDefault(require("../utils/preflight.js"));
+exports.command = 'audit <service> <env..>';
+exports.desc = 'Audits secrets for <service> for the given <envs..>';
+const builder = (yargs) => {
+    return yargs
+        .positional('service', {
+        type: 'string',
+        description: 'The service (e.g. connector) to audit the secret for'
+    })
+        .positional('env', {
+        type: 'string',
+        description: 'The environment (e.g. test-12) to audit the secret for'
+    });
+};
+exports.builder = builder;
+exports.handler = auditHandler;
+async function auditHandler(argv) {
+    const service = argv.service;
+    const envs = argv.env;
+    const preflightInfo = (0, preflight_js_1.default)();
+    (0, node_child_process_1.spawnSync)(preflightInfo.rbenvCommand, ['exec', 'bundle', 'exec', 'bin/pay', 'secrets', 'audit', service, ...envs], { shell: true, stdio: 'inherit', cwd: preflightInfo.pathToLegacyRubyCli });
+}
+exports.default = auditHandler;

package/src/commands/secrets/subcommands/copy.js

@@ -0,0 +1,35 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handler = exports.builder = exports.desc = exports.command = void 0;
+const node_child_process_1 = require("node:child_process");
+const preflight_js_1 = __importDefault(require("../utils/preflight.js"));
+exports.command = 'copy <service> <src_env> <dest_env>';
+exports.desc = 'Copies secrets for <service> from <src_env> to <dest_env>';
+const builder = (yargs) => {
+    return yargs
+        .positional('service', {
+        type: 'string',
+        description: 'The service (e.g. connector) to copy the secrets for'
+    })
+        .positional('src_env', {
+        type: 'string',
+        description: 'The environment (e.g. test-12) to copy the secrets from'
+    })
+        .positional('dest_env', {
+        type: 'string',
+        description: 'The environment (e.g. test-perf-1) to copy the secrets to'
+    });
+};
+exports.builder = builder;
+exports.handler = copyHandler;
+async function copyHandler(argv) {
+    const service = argv.service;
+    const srcEnv = argv.src_env;
+    const destEnv = argv.dest_env;
+    const preflightInfo = (0, preflight_js_1.default)();
+    (0, node_child_process_1.spawnSync)(preflightInfo.rbenvCommand, ['exec', 'bundle', 'exec', 'bin/pay', 'secrets', 'copy', service, srcEnv, destEnv], { shell: true, stdio: 'inherit', cwd: preflightInfo.pathToLegacyRubyCli });
+}
+exports.default = copyHandler;

package/src/commands/secrets/subcommands/fetch.js

@@ -0,0 +1,47 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handler = exports.builder = exports.desc = exports.command = void 0;
+const node_child_process_1 = require("node:child_process");
+const preflight_js_1 = __importDefault(require("../utils/preflight.js"));
+exports.command = 'fetch <env> <service> <secret_name> [--use-ssm]';
+exports.desc = 'Fetches a <named secret> for <service> for <env>, if use-ssm is set then get the secret from ssm';
+const builder = (yargs) => {
+    return yargs
+        .positional('env', {
+        type: 'string',
+        description: 'The environment (e.g. test-12) to fetch the secret for'
+    })
+        .positional('service', {
+        type: 'string',
+        description: 'The service (e.g. connector) to fetch the secret for'
+    })
+        .positional('secret_name', {
+        type: 'string',
+        description: 'The name of the secret to get'
+    })
+        .option('use-ssm', {
+        type: 'boolean',
+        default: false,
+        description: 'Query SSM to get the value'
+    });
+};
+exports.builder = builder;
+exports.handler = fetchHandler;
+async function fetchHandler(argv) {
+    const service = argv.service;
+    const env = argv.env;
+    const secretName = argv.secret_name;
+    const useSSM = argv.useSsm;
+    const preflightInfo = (0, preflight_js_1.default)();
+    const rbenvArgs = ['exec', 'bundle', 'exec', 'bin/pay', 'secrets', 'fetch', env, service, secretName];
+    if (useSSM) {
+        rbenvArgs.push('--use-ssm');
+    }
+    (0, node_child_process_1.spawnSync)(preflightInfo.rbenvCommand, rbenvArgs, { shell: true, stdio: 'inherit', cwd: preflightInfo.pathToLegacyRubyCli });
+    // The fetch command doesn't output a newline which is really annoying, so add one
+    console.log();
+}
+exports.default = fetchHandler;

package/src/commands/secrets/subcommands/provision.js

@@ -0,0 +1,30 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handler = exports.builder = exports.desc = exports.command = void 0;
+const node_child_process_1 = require("node:child_process");
+const preflight_js_1 = __importDefault(require("../utils/preflight.js"));
+exports.command = 'provision <service> <env>';
+exports.desc = 'Provisions secrets from config for <service> in <env>';
+const builder = (yargs) => {
+    return yargs
+        .positional('service', {
+        type: 'string',
+        description: 'The service (e.g. connector) to provision secrets for'
+    })
+        .positional('env', {
+        type: 'string',
+        description: 'The environment (e.g. test-12) to provision the secrets in'
+    });
+};
+exports.builder = builder;
+exports.handler = provisionHandler;
+async function provisionHandler(argv) {
+    const service = argv.service;
+    const env = argv.env;
+    const preflightInfo = (0, preflight_js_1.default)();
+    (0, node_child_process_1.spawnSync)(preflightInfo.rbenvCommand, ['exec', 'bundle', 'exec', 'bin/pay', 'secrets', 'provision', service, env], { shell: true, stdio: 'inherit', cwd: preflightInfo.pathToLegacyRubyCli });
+}
+exports.default = provisionHandler;

package/src/commands/secrets/utils/preflight.js

@@ -0,0 +1,47 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_child_process_1 = require("node:child_process");
+const node_path_1 = __importDefault(require("node:path"));
+const constants_1 = require("../../../core/constants");
+function preflightCheck() {
+    const pathToLegacyRubyCli = node_path_1.default.join(constants_1.rootDir, 'resources', 'legacy-ruby-cli');
+    const rbenvCommand = process.env.PAY_CLI_RBENV_COMMAND ?? 'rbenv';
+    console.error('Checking for ruby dependencies prior to launch');
+    const whichRbenvResult = (0, node_child_process_1.spawnSync)('command', ['-v', rbenvCommand], { shell: true });
+    if (whichRbenvResult.status !== 0) {
+        console.error('You need rbenv installed before you can continue.');
+        process.exit(1);
+    }
+    console.error(`Ruby version manager ${rbenvCommand} available`);
+    console.error('Checking for bundler');
+    const whichBundlerResult = (0, node_child_process_1.spawnSync)(rbenvCommand, ['exec', 'bundle', '--version'], { shell: true, cwd: pathToLegacyRubyCli });
+    if (whichBundlerResult.status !== 0) {
+        console.error('You need bundler installed and available to rbenv before you can continue. Installing it...');
+        const installBundlerResult = (0, node_child_process_1.spawnSync)(rbenvCommand, ['exec', 'gem', 'install', 'bundler'], { shell: true, stdio: 'inherit', cwd: pathToLegacyRubyCli });
+        if (installBundlerResult.status !== 0) {
+            console.error('Could not install bundler, cannot continue');
+            process.exit(1);
+        }
+    }
+    console.error('Bundler available');
+    console.error('Checking for bundled dependencies');
+    const bundleCheckResult = (0, node_child_process_1.spawnSync)(rbenvCommand, ['exec', 'bundle', 'check'], { shell: true, cwd: pathToLegacyRubyCli });
+    if (bundleCheckResult.status !== 0) {
+        console.error('Not all bundler dependencies are installed, installing them now.');
+        const bundleInstallResult = (0, node_child_process_1.spawnSync)(rbenvCommand, ['exec', 'bundle', 'install'], { shell: true, stdio: 'inherit', cwd: pathToLegacyRubyCli });
+        if (bundleInstallResult.status !== 0) {
+            console.error('Failed to bundle install, cannot continue');
+            process.exit(1);
+        }
+    }
+    console.error('Bundled dependencies installed and available');
+    console.error('All ruby dependencies satisfied, executing legacy ruby cli');
+    return {
+        rbenvCommand,
+        pathToLegacyRubyCli
+    };
+}
+exports.default = preflightCheck;

package/src/commands/secrets.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.builder = exports.desc = exports.command = void 0;
+exports.command = 'secrets';
+exports.desc = 'Provision secrets (uses the legacy ruby CLI)';
+const builder = (yargs) => {
+    return yargs
+        .commandDir('secrets/subcommands')
+        .demandCommand();
+};
+exports.builder = builder;