@leverege/build-tools 2.8.11 → 2.8.12

package/src/sa-tools/roles/leverege-dev-john/20220113-121423/leveregeStorageObjectAccess.json

@@ -0,0 +1,10 @@
+{
+  "description": "Leverege read / write access to Storage Objects",
+  "includedPermissions": [
+    "storage.objects.create",
+    "storage.objects.delete",
+    "storage.objects.get"
+  ],
+  "stage": "BETA",
+  "title": "Leverege Storage Object Admin"
+}

package/src/sa-tools/roles/leverege-dev-john/20220113-121423/leveregeSvcAcctActor.json

@@ -0,0 +1,8 @@
+{
+  "description": "Leverege service account act as other user",
+  "includedPermissions": [
+    "iam.serviceAccounts.actAs"
+  ],
+  "stage": "BETA",
+  "title": "Leverege Svc Acct Impersonation"
+}

package/src/sa-tools/roles/leverege-dev-john/20220113-121423/leveregeSvcAcctTokenCreator.json

@@ -0,0 +1,8 @@
+{
+  "description": "Leverege IAM blob signing access",
+  "includedPermissions": [
+    "iam.serviceAccounts.signBlob"
+  ],
+  "stage": "BETA",
+  "title": "Leverege Svc Acct Token Creator"
+}

package/src/sa-tools/roles/prd-indoor-zoning/20220113-121935/leveregeBigQueryReader.json

@@ -0,0 +1,10 @@
+{
+  "description": "Leverege BQ data accessor",
+  "includedPermissions": [
+    "bigquery.jobs.create",
+    "bigquery.tables.create",
+    "bigquery.tables.getData"
+  ],
+  "stage": "BETA",
+  "title": "Leverege Big Query Reader"
+}

package/src/sa-tools/roles/prd-indoor-zoning/20220113-121935/leveregeBigQueryWriter.json

@@ -0,0 +1,10 @@
+{
+  "description": "Leverege Big Query Writer",
+  "includedPermissions": [
+    "bigquery.datasets.get",
+    "bigquery.tables.get",
+    "bigquery.tables.updateData"
+  ],
+  "stage": "BETA",
+  "title": "Leverege Big Query Writer"
+}

package/src/sa-tools/roles/prd-indoor-zoning/20220113-121935/leveregeCloudFunctionsAdmin.json

@@ -0,0 +1,12 @@
+{
+  "description": "Leverege limited Cloud Functions Admin",
+  "includedPermissions": [
+    "cloudfunctions.functions.create",
+    "cloudfunctions.functions.delete",
+    "cloudfunctions.functions.get",
+    "cloudfunctions.functions.sourceCodeSet",
+    "cloudfunctions.functions.update"
+  ],
+  "stage": "BETA",
+  "title": "Leverege Cloud Functions Admin"
+}

package/src/sa-tools/roles/prd-indoor-zoning/20220113-121935/leveregeFirebaseUpdates.json

@@ -0,0 +1,8 @@
+{
+  "description": "Leverege Firebase Updates Access",
+  "includedPermissions": [
+    "firebasedatabase.instances.update"
+  ],
+  "stage": "BETA",
+  "title": "Leverege Firebase Updates"
+}

package/src/sa-tools/roles/prd-indoor-zoning/20220113-121935/leveregeLogsViewer.json

@@ -0,0 +1,8 @@
+{
+  "description": "Leverege view access to logs",
+  "includedPermissions": [
+    "logging.logEntries.list"
+  ],
+  "stage": "BETA",
+  "title": "Leverege Logs Viewer"
+}

package/src/sa-tools/roles/prd-indoor-zoning/20220113-121935/leveregePubSub.json

@@ -0,0 +1,13 @@
+{
+  "description": "Leverege Pub/Sub",
+  "includedPermissions": [
+    "pubsub.subscriptions.consume",
+    "pubsub.subscriptions.create",
+    "pubsub.topics.attachSubscription",
+    "pubsub.topics.create",
+    "pubsub.topics.list",
+    "pubsub.topics.publish"
+  ],
+  "stage": "BETA",
+  "title": "Leverege Pub/Sub"
+}

package/src/sa-tools/roles/prd-indoor-zoning/20220113-121935/leveregeSecretsViewer.json

@@ -0,0 +1,8 @@
+{
+  "description": "Custom Secrets Manager Access",
+  "includedPermissions": [
+    "secretmanager.versions.access"
+  ],
+  "stage": "BETA",
+  "title": "Leverege Secret Viewer"
+}

package/src/sa-tools/roles/prd-indoor-zoning/20220113-121935/leveregeStorageObjectAccess.json

@@ -0,0 +1,10 @@
+{
+  "description": "Leverege read / write access to Storage Objects",
+  "includedPermissions": [
+    "storage.objects.create",
+    "storage.objects.delete",
+    "storage.objects.get"
+  ],
+  "stage": "BETA",
+  "title": "Leverege Storage Object Admin"
+}

package/src/sa-tools/roles/prd-indoor-zoning/20220113-121935/leveregeSvcAcctActor.json

@@ -0,0 +1,8 @@
+{
+  "description": "Leverege service account act as other user",
+  "includedPermissions": [
+    "iam.serviceAccounts.actAs"
+  ],
+  "stage": "BETA",
+  "title": "Leverege Svc Acct Impersonation"
+}

package/src/sa-tools/roles/prd-indoor-zoning/20220113-121935/leveregeSvcAcctTokenCreator.json

@@ -0,0 +1,8 @@
+{
+  "description": "Leverege IAM blob signing access",
+  "includedPermissions": [
+    "iam.serviceAccounts.signBlob"
+  ],
+  "stage": "BETA",
+  "title": "Leverege Svc Acct Token Creator"
+}

package/src/sa-tools/roles-grab

@@ -0,0 +1,30 @@
+#!/bin/bash
+#
+# To fetch Leverege custom role names:
+#   gcloud --project=<PROJ_NAME> iam roles list --filter=Leverege | grep name
+#
+LEVEREGE_ROLES=(
+  leveregeBigQueryReader
+  leveregeBigQueryWriter
+  leveregeCloudFunctionsAdmin
+  leveregeFirebaseUpdates
+  leveregeLogsViewer
+  leveregePubSub
+  leveregeSecretsViewer
+  leveregeStorageObjectAccess
+  leveregeSvcAcctActor
+  leveregeSvcAcctTokenCreator
+)
+
+PROJ=${1:-leverege-sandbox}
+DTS="`date +\"%Y%m%d-%H%M%S\"`"
+ROLESDIR="roles/${PROJ}/${DTS}"
+mkdir -p $ROLESDIR
+
+for ROLE in "${LEVEREGE_ROLES[@]}";
+do
+  JSON="${ROLESDIR}/${ROLE}.json"
+  printf "Fetching role $ROLE\n"
+  gcloud --project leverege-sandbox iam roles describe $ROLE \
+    --format=json | jq '{description,includedPermissions,stage,title}' > $JSON
+done

package/src/sa-tools/roles-push

@@ -0,0 +1,19 @@
+#!/bin/bash
+
+PROJ="${1:-leverege-sandbox}"
+
+printf "\n   Create/Update IAM Roles for => $PROJ\n\n"
+
+cd roles/baseline
+for JSON in leverege*.json;
+do
+  ROLE=`basename $JSON .json`
+  IAM_VERB="create"
+
+  gcloud --project $PROJ iam roles describe $ROLE &>/dev/null
+  [ "$?" == "0" ] && IAM_VERB="update"
+
+  printf "Attempting to $IAM_VERB role $ROLE on $PROJ\n"
+  gcloud --project $PROJ iam roles $IAM_VERB $ROLE --file $JSON
+done
+cd -

package/src/service-man/Config.js

@@ -0,0 +1,40 @@
+const chalk = require( 'chalk' )
+const fs = require( 'fs' )
+
+class Config {
+
+  constructor() {
+    this.configDir = `${__dirname}/config`
+    const jsonText = fs.readFileSync( `${this.configDir}/config.json` )
+    this.config = JSON.parse( jsonText )
+    this.verifyConfig( this.config )
+  }
+
+  verifyConfig( config ) {
+    /**
+     * Verify reference sources exist.
+     */
+    let errors
+    config.templates.forEach( ( template ) => {
+      if ( !template.enabled ) return
+      template.sources.forEach( ( source ) => {
+        if ( typeof source === 'object' ) {
+          console.log( source, 'STILL TODO' )
+        } else {
+          const fullName = `${this.configDir}/${source}`
+          if ( !fs.existsSync( fullName ) ) {
+            console.log( chalk.red(
+              `***ERROR: missing source ${fullName}`
+            ) )
+            errors = true
+          }
+        }
+      } )
+    } )
+    if ( errors ) { process.exit( 1 ) }
+  }
+}
+
+module.exports = {
+  Config,
+}

package/src/service-man/ServiceMan.js

@@ -0,0 +1,32 @@
+const chalk = require( 'chalk' )
+const cliArgs = require( 'command-line-args' )
+const cliHelp = require( 'command-line-usage' )
+const execa = require( 'execa' )
+const figlet = require( 'figlet' )
+
+const { Config } = require( './Config' )
+const { clear, condir, proceed, Shell, VersionCheck } = require( './utils' )
+
+const greet = async () => {
+  clear()
+  console.log(
+    chalk.keyword( 'orange' ).bold(
+      figlet.textSync( 'service-man', { horizontalLayout : 'full' } )
+    ), chalk.green`
+
+  This utility attempts to ease the pain of managing IAM roles and the
+  creation of service accounts for new clusters and services.
+`
+  )
+}
+
+const start = async () => {
+
+  await greet()
+
+  await proceed()
+
+  console.log( 'Weeeeee....' )
+}
+
+exports.start = start

package/src/service-man/index.js

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+
+const ServiceMan = require( './ServiceMan' )
+
+ServiceMan.start()

package/src/service-man/utils/Shell.js

@@ -0,0 +1,95 @@
+/**
+ * Shell like things can go in here. I mostly created this to make it
+ * easier to push and pop around the directory trees for repo-init. It
+ * might make sense to add other things in here to make writing node CLI
+ * commands a little less painful.
+ */
+const fs = require( 'fs' )
+const process = require( 'process' )
+
+const dirStack = []
+
+/**
+ * Simple wrapper functions for debugging.
+ */
+const cwd = () => {
+  return process.cwd()
+}
+
+const chdir = ( dir ) => {
+  return process.chdir( dir )
+}
+
+const dirs = () => {
+  console.log( dirStack )
+}
+
+const pushd = ( dir ) => {
+  if ( !dir ) {
+    throw new Error( 'pushd: no other directory' )
+  }
+
+  dirStack.push( cwd() )
+  chdir( dir )
+}
+
+const throwIfEmptyStack = () => {
+  if ( dirStack.length === 0 ) {
+    throw new Error( 'popd: directory stack empty' )
+  }
+}
+
+const popd = ( all ) => {
+  throwIfEmptyStack()
+  chdir( dirStack.pop() )
+}
+
+const popdAll = () => {
+  throwIfEmptyStack()
+  chdir( dirStack[0] )
+  dirStack.length = 0
+}
+
+/**
+ * This function will do an upwards traversal of a file tree looking for the
+ * specified file. An error will be thrown if the file is not found within
+ * maxLevels.
+ */
+const reverseFindFile = ( findFile, options ) => {
+  pushd( options.startDir || cwd() )
+  let maxLevels = options.maxLevels || 5
+  let fileRoot
+  while ( maxLevels > 0 ) {
+    if ( fs.existsSync( findFile ) ) {
+      fileRoot = cwd()
+      break
+    }
+    pushd( '..' ) // walk up the tree
+    maxLevels -= 1
+  }
+
+  popdAll()
+
+  if ( !fileRoot ) {
+    throw new Error( `reverseFindFile: ${findFile} not found` )
+  }
+
+  return fileRoot
+}
+
+const findRepoRoot = () => {
+  return reverseFindFile( 'package.json', { startDir : __dirname } )
+}
+
+module.exports = {
+  dirs,
+  pushd,
+  popd,
+  popdAll,
+
+  reverseFindFile,
+  findRepoRoot,
+
+  cwd,
+  chdir,
+}

package/src/service-man/utils/VersionCheck.js

@@ -0,0 +1,77 @@
+const chalk = require( 'chalk' )
+const coerce = require( 'semver/functions/coerce' )
+const semverLt = require( 'semver/functions/lt' )
+const satisfies = require( 'semver/functions/satisfies' )
+
+/**
+ * This function verifies the specified version falls in this range:
+ *
+ *    minimum >= current < maximum
+ *
+ * The params will be semver coerced where a version of 12 will be coerced
+ * to 12.0.0, a version of 12.18.4-beta.3 will be coerced to 12.18.4.
+ *
+ * Note that this function still has its references to node, but could be
+ * made entirely generic if need be.
+ *
+ * @param {Object} params
+ * @param {String} params.current - version to check
+ * @param {String} params.minimum - can be equal or greater to this
+ * @param {String} params.maximum - must be less than this
+ * @param {String} params.preferred - the most acceptable version
+ */
+function validate( params = {} ) {
+  const throwChalk = ( error ) => {
+    const errorStr = chalk.red.bold( '***ERROR =>' )
+    throw new Error(
+      chalk.keyword( 'orange' ).bold( `\n${errorStr} ${error}` )
+    )
+  }
+
+  if ( !params || !params.current || !params.minimum || !params.maximum ) {
+    throwChalk(
+      'current, minimum and maximum parameters are required by validate'
+    )
+  }
+
+  const coercedVersions = ( sems ) => {
+    return Object.keys( sems ).reduce( ( obj, key ) => {
+      const coerced = obj // avoid eslint warning
+      coerced[key] = coerce( sems[key] ).version
+      return coerced
+    }, {} )
+  }
+
+  const { current, minimum, maximum, preferred } = coercedVersions( params )
+
+  /**
+   * Verify that the current version falls within the accepted ranges.
+   */
+  const rangeStr = `>=${minimum} <${maximum}`
+  if ( !satisfies( current, rangeStr ) ) {
+    throwChalk(
+      `Version ${current} is outside the accepted range of ${rangeStr}`
+    )
+  }
+
+  /**
+   * Suggest upgrading to the currently recommended version.
+   */
+  if ( preferred && semverLt( current, preferred ) ) {
+    console.log(
+      chalk.keyword( 'orange' ).bold( `
+  ${chalk.yellow.bold( '        *** HEADS UP ***' )}
+  Running node version => ${chalk.yellow.bold( `v${current}` )} (which should work)
+  Preferred version is => ${chalk.green.bold( `v${preferred}` )}
+
+  Also, a reinstall of the build-tools may be necessary after any node upgrade
+          ${chalk.cyan.bold( 'npm i -g @leverege/build-tools' )}
+`
+      )
+    )
+  }
+}
+
+module.exports = {
+  validate,
+}

package/src/service-man/utils/index.js

@@ -0,0 +1,54 @@
+const inquirer = require( 'inquirer' )
+const Shell = require( './Shell' )
+const VersionCheck = require( './VersionCheck' )
+
+/**
+ * Clears the screen and optionally homes the cursor.
+ */
+const clear = ( home = true ) => {
+  // console.log( ( home ? '\x1B[0f' : '' ) + '\x1B[2J' )
+  console.log( `${home ? '\x1B[0f' : ''}\x1B[2J` )
+}
+
+/**
+ * A simple object dumping convenience.
+ */
+const condir = ( log, thing ) => {
+  console.dir( { log, thing }, { depth : 8, colors : true } ) // eslint-disable-line
+}
+
+/**
+ * General "yes" to proceed function.
+ */
+const proceed = async ( query = 'Do you wish to proceed?' ) => {
+  await inquirer.prompt( [
+    {
+      type : 'confirm',
+      name : 'proceed',
+      message : query,
+      default : true,
+    }
+  ]
+  ).then( ( answer ) => {
+    if ( !answer.proceed ) { process.exit( 0 ) }
+  } )
+}
+
+/**
+ * A simple mS sleeper.
+ */
+const sleep = ( ms = 0 ) => {
+  return new Promise( ( resolve ) => {
+    setTimeout( resolve, ms )
+  } )
+}
+
+module.exports = {
+  clear,
+  condir,
+  proceed,
+  sleep,
+  pause : sleep,
+  Shell,
+  VersionCheck,
+}

package/src/unleash.js

@@ -2,10 +2,15 @@
 
 const execa = require( 'execa' )
 const SimpleGit = require( 'simple-git' )
+
 const git = new SimpleGit()
 
 const getCurrentBranchName = async () => {
   const branchInfo = await git.branch()
+
+  // first check to see if there are no branches - new repo?
+  if ( Object.keys( branchInfo.branches ).length === 0 ) { return '' }
+
   return Object
     .entries( branchInfo.branches )
     .find( ( [ name, info ] ) => ( info.current ) )[0]
@@ -24,13 +29,14 @@ const npmRunner = async ( script ) => {
   } catch ( err ) {
     process.exit( 1 )
   }
+  return undefined
 }
 
 ( async () => {
   if ( await isProtected() ) {
     const script = [ 'test', 'lint' ]
-    for( let i = 0; i < script.length; i++ ) {
-      await npmRunner( script[ i ] )
+    for ( let i = 0; i < script.length; i++ ) {
+      await npmRunner( script[i] )
     }
   } else {
     process.exit( 0 )

package/src/sa-tools/roles/LeveregeSecretManagerAccess.json

@@ -1,8 +0,0 @@
-{
-  "title": "Leverege Secret Manager Access (ro)",
-  "description": "Read only access to the Secrets in Secrets Manager",
-  "includedPermissions": [
-    "secretmanager.versions.access"
-  ],
-  "stage": "BETA"
-}