@govuk-pay/cli 0.0.52 → 0.0.54

package/src/commands/secrets/subcommands/provision.js

@@ -4,19 +4,36 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.handler = exports.builder = exports.desc = exports.command = void 0;
-const node_child_process_1 = require("node:child_process");
-const preflight_js_1 = __importDefault(require("../utils/preflight.js"));
-exports.command = 'provision <service> <env>';
+const cli_table3_1 = __importDefault(require("cli-table3"));
+const promises_1 = __importDefault(require("node:readline/promises"));
+const config_types_1 = require("../config/config.types");
+const secrets_1 = require("../config/secrets");
+const configs_1 = require("../../../util/configs");
+const factory_1 = require("../providers/factory");
+const standardContent_js_1 = require("../../../core/standardContent.js");
+exports.command = 'provision <service> <env> [--redact] [--dry-run]';
 exports.desc = 'Provisions secrets from config for <service> in <env>';
 const builder = (yargs) => {
     return yargs
         .positional('service', {
         type: 'string',
-        description: 'The service (e.g. connector) to provision secrets for'
+        description: 'The service (e.g. connector) to provision secrets for',
+        choices: config_types_1.SERVICE_NAMES
     })
         .positional('env', {
         type: 'string',
-        description: 'The environment (e.g. test-12) to provision the secrets in'
+        description: 'The environment (e.g. test-12) to provision the secrets in',
+        choices: config_types_1.ENVIRONMENT_NAMES
+    })
+        .option('redact', {
+        type: 'boolean',
+        default: false,
+        description: 'During a dry-run redact all printed secret values except for an empty string (which makes it suitable to paste into a PR)'
+    })
+        .option('dry-run', {
+        type: 'boolean',
+        default: false,
+        description: 'Perform a dry run, will not set any secrets, but will show all changes'
     });
 };
 exports.builder = builder;
@@ -24,7 +41,82 @@ exports.handler = provisionHandler;
 async function provisionHandler(argv) {
     const service = argv.service;
     const env = argv.env;
-    const preflightInfo = (0, preflight_js_1.default)();
-    (0, node_child_process_1.spawnSync)(preflightInfo.rbenvCommand, ['exec', 'bundle', 'exec', 'bin/pay', 'secrets', 'provision', service, env], { shell: true, stdio: 'inherit', cwd: preflightInfo.pathToLegacyRubyCli });
+    const redact = argv.redact;
+    const dryRun = argv.dryRun;
+    await (0, standardContent_js_1.showHeader)();
+    if (redact && !dryRun) {
+        console.error('The --redact option is only valid with the --dry-run option also specified');
+        process.exit(1);
+    }
+    await (0, configs_1.checkAwsCredentials)((0, configs_1.payEnvironmentToAWSAccountName)(env));
+    const rl = promises_1.default.createInterface({ input: process.stdin, output: process.stdout });
+    const secretsToProvision = [];
+    for (const sourceSecret of (0, secrets_1.configuredSecretsForServiceInEnv)(env, service)) {
+        secretsToProvision.push({
+            source: sourceSecret,
+            destination: {
+                ...sourceSecret,
+                source: 'ssm' // Currently all secrets are provisioned to ssm, but that could change in the future
+            }
+        });
+    }
+    for (const secretToProvision of secretsToProvision) {
+        const sourceProvider = (0, factory_1.providerFor)(secretToProvision.source);
+        const destinationProvider = (0, factory_1.providerFor)(secretToProvision.destination);
+        const sourceValue = await sourceProvider.get(secretToProvision.source);
+        if (sourceValue === undefined) {
+            console.error(`Secret ${secretToProvision.source.name} does not exist in ${secretToProvision.source.source}`);
+            process.exit(1);
+        }
+        const destinationValue = await destinationProvider.get(secretToProvision.destination);
+        if (sourceValue === destinationValue) {
+            console.log(`✅ Provisioning ${secretToProvision.source.name} in ${secretToProvision.destination.source} in environment ${secretToProvision.source.environment} for ${secretToProvision.source.service} would apply no change`);
+            continue;
+        }
+        if (destinationValue === undefined) {
+            console.log(`❓ Secret ${secretToProvision.source.name} does not exist in ${secretToProvision.destination.source} in environment ${secretToProvision.source.environment} for ${secretToProvision.source.service}, provision?`);
+        }
+        else {
+            console.log(`❓ Update ${secretToProvision.source.name} in ${secretToProvision.destination.source} in environment ${secretToProvision.source.environment} for ${secretToProvision.source.service}?`);
+        }
+        const table = new cli_table3_1.default({
+            head: ['Old value', 'New Value']
+        });
+        table.push([
+            secretForDisplay(destinationValue, redact),
+            secretForDisplay(sourceValue, redact)
+        ]);
+        console.log(table.toString());
+        if (dryRun) {
+            console.log('Dry run only....not provisioning');
+            continue;
+        }
+        const confirmResponse = await rl.question('    Type "yes" exactly > ');
+        if (confirmResponse.trim() !== 'yes') {
+            console.log('User rejected confirmation, secret NOT provisioned');
+            continue;
+        }
+        if (await destinationProvider.set(secretToProvision.destination, sourceValue)) {
+            console.log('✅ Secret successfully provisioned');
+        }
+        else {
+            console.error('❌ Saving the secret failed for an unknown reason');
+        }
+    }
+    console.log('\nProvision finished');
+    rl.close();
 }
 exports.default = provisionHandler;
+function secretForDisplay(secretValue, redact) {
+    if (secretValue === undefined) {
+        return '👻 NOT CURRENTLY SET 👻';
+    }
+    // Purposefully not redacting if the secret is an empty string
+    if (secretValue.trim() === '') {
+        return '"" (❗EMPTY STRING❗)';
+    }
+    if (redact) {
+        return '🤫 REDACTED 🤫';
+    }
+    return secretValue;
+}

package/src/commands/secrets.js

@@ -2,7 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.builder = exports.desc = exports.command = void 0;
 exports.command = 'secrets';
-exports.desc = 'Provision secrets (uses the legacy ruby CLI)';
+exports.desc = 'Provision secrets';
 const builder = (yargs) => {
     return yargs
         .commandDir('secrets/subcommands')

package/src/core/standardContent.js

@@ -23,7 +23,7 @@ var __importStar = (this && this.__importStar) || function (mod) {
     return result;
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.showHeader = void 0;
+exports.showHeaderStdErr = exports.showHeader = void 0;
 const fsp = __importStar(require("fs/promises"));
 const path = __importStar(require("path"));
 const constants_js_1 = require("./constants.js");
@@ -31,3 +31,7 @@ async function showHeader() {
     console.log(await fsp.readFile(path.join(constants_js_1.rootDir, 'resources/header.txt'), 'utf8'));
 }
 exports.showHeader = showHeader;
+async function showHeaderStdErr() {
+    console.warn(await fsp.readFile(path.join(constants_js_1.rootDir, 'resources/header.txt'), 'utf8'));
+}
+exports.showHeaderStdErr = showHeaderStdErr;

package/src/util/configs.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.checkAwsCredentials = exports.workspaceEnvVar = exports.ensureConfigDirectory = exports.PAY_CLI_CONFIG_PATH = void 0;
+exports.payEnvironmentToAWSAccountName = exports.checkAwsCredentials = exports.workspaceEnvVar = exports.ensureConfigDirectory = exports.PAY_CLI_CONFIG_PATH = void 0;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_os_1 = require("node:os");
 const node_path_1 = __importDefault(require("node:path"));
@@ -106,3 +106,9 @@ async function checkAwsCredentialsAreForAccount(accountName) {
         process.exit(1);
     }
 }
+/* This function will turn a Pay environment name into an AWS account name
+ */
+function payEnvironmentToAWSAccountName(environmentName) {
+    return environmentName.split('-')[0];
+}
+exports.payEnvironmentToAWSAccountName = payEnvironmentToAWSAccountName;

package/src/commands/secrets/subcommands/copy.js

@@ -1,35 +0,0 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.handler = exports.builder = exports.desc = exports.command = void 0;
-const node_child_process_1 = require("node:child_process");
-const preflight_js_1 = __importDefault(require("../utils/preflight.js"));
-exports.command = 'copy <service> <src_env> <dest_env>';
-exports.desc = 'Copies secrets for <service> from <src_env> to <dest_env>';
-const builder = (yargs) => {
-    return yargs
-        .positional('service', {
-        type: 'string',
-        description: 'The service (e.g. connector) to copy the secrets for'
-    })
-        .positional('src_env', {
-        type: 'string',
-        description: 'The environment (e.g. test-12) to copy the secrets from'
-    })
-        .positional('dest_env', {
-        type: 'string',
-        description: 'The environment (e.g. test-perf-1) to copy the secrets to'
-    });
-};
-exports.builder = builder;
-exports.handler = copyHandler;
-async function copyHandler(argv) {
-    const service = argv.service;
-    const srcEnv = argv.src_env;
-    const destEnv = argv.dest_env;
-    const preflightInfo = (0, preflight_js_1.default)();
-    (0, node_child_process_1.spawnSync)(preflightInfo.rbenvCommand, ['exec', 'bundle', 'exec', 'bin/pay', 'secrets', 'copy', service, srcEnv, destEnv], { shell: true, stdio: 'inherit', cwd: preflightInfo.pathToLegacyRubyCli });
-}
-exports.default = copyHandler;