@mesh-tech/mesh-cli 0.35.1 → 0.35.2

package/dist/bin/mesh.js

@@ -5710,14 +5710,69 @@ function toEnv(credentials) {
     AWS_SESSION_TOKEN: SessionToken
   };
 }
-function isMaxSessionDurationError(err) {
-  if (!(err instanceof Error)) return false;
-  const message = err.message ?? "";
-  return message.includes("MaxSessionDuration") || message.includes("DurationSeconds");
+function isRoleChainedCaller(callerArn) {
+  return !!callerArn && /^arn:aws[a-z-]*:sts::\d+:assumed-role\//.test(callerArn);
 }
-async function assumeRole(roleArn, sessionName = "mesh-cli", durationSeconds = 43200) {
-  const sts = newStsClient();
-  for (const duration of [durationSeconds, 3600]) {
+function stsErrorDetail(err) {
+  if (!err || typeof err !== "object") return { text: String(err) };
+  const e = err;
+  const str = (v) => typeof v === "string" && v ? v : void 0;
+  const name = str(e.name);
+  const typeCode = str(str(e.__type)?.split("#").pop());
+  const code = str(e.Code) ?? typeCode ?? str(e.Error?.Code) ?? (name && name !== "Error" ? name : void 0);
+  const text = str(e.Error?.Message) ?? str(e.Message) ?? str(e.message) ?? code ?? String(err);
+  return { code, text };
+}
+function isSessionDurationError(err) {
+  if (!err || typeof err !== "object") return false;
+  const { code, text } = stsErrorDetail(err);
+  if (code !== void 0 && code !== "ValidationError") return false;
+  return /DurationSeconds|MaxSessionDuration|role chaining/i.test(text);
+}
+function formatDuration(seconds) {
+  return seconds % 3600 === 0 ? `${seconds / 3600}h` : `${seconds}s`;
+}
+function describeAssumeRoleFailure(opts) {
+  const reason = opts.code && opts.code !== opts.text ? `${opts.code}: ${opts.text}` : opts.text;
+  const lines = [
+    `AssumeRole failed for ${opts.roleArn} \u2014 requested a ${formatDuration(opts.durationSeconds)} session (DurationSeconds=${opts.durationSeconds}): ${reason}`
+  ];
+  if (opts.callerArn) lines.push(`  Caller: ${opts.callerArn}`);
+  const zitadel = `mesh login ${opts.loginContext ?? "<platform>.<env>"}`;
+  if (isExpiredAwsTokenMessage(`${opts.code ?? ""} ${opts.text}`)) {
+    lines.push(`  Your AWS SSO session looks expired or missing \u2014 refresh with: ${SSO_LOGIN_FIX}`);
+    lines.push(`  Or assume the role via Zitadel instead: ${zitadel}`);
+  } else if (opts.code === "AccessDenied" || /not authorized/i.test(opts.text)) {
+    lines.push("  The role does not trust this AWS identity. Assume it via Zitadel instead:");
+    lines.push(`    ${zitadel}`);
+    lines.push("  or switch to an AWS profile the role's trust policy allows.");
+  } else if (isSessionDurationError({ Code: opts.code, message: opts.text })) {
+    lines.push(
+      `  The role refused even a ${formatDuration(ROLE_CHAINING_MAX_SESSION_SECONDS)} session. Check its MaxSessionDuration, or assume it via Zitadel instead:`
+    );
+    lines.push(`    ${zitadel}`);
+  } else {
+    lines.push(`  Try assuming the role via Zitadel: ${zitadel}`);
+    lines.push(`  or refresh the AWS session: ${SSO_LOGIN_FIX}`);
+  }
+  return lines.join("\n");
+}
+async function assumeRole(roleArn, sessionName = "mesh-cli", durationSeconds = DEFAULT_ASSUME_ROLE_SECONDS, options = {}) {
+  const sts = options.sts ?? newStsClient();
+  let callerArn;
+  try {
+    callerArn = (await sts.send(new GetCallerIdentityCommand({}))).Arn;
+  } catch {
+  }
+  let requested = durationSeconds;
+  if (isRoleChainedCaller(callerArn) && requested > ROLE_CHAINING_MAX_SESSION_SECONDS) {
+    requested = ROLE_CHAINING_MAX_SESSION_SECONDS;
+    logInfo(
+      `Current AWS identity is an assumed-role session \u2014 requesting a ${formatDuration(requested)} session (role chaining caps AssumeRole at one hour)`
+    );
+  }
+  const attempts = requested > ROLE_CHAINING_MAX_SESSION_SECONDS ? [requested, ROLE_CHAINING_MAX_SESSION_SECONDS] : [requested];
+  for (const [i, duration] of attempts.entries()) {
     try {
       const resp = await sts.send(
         new AssumeRoleCommand({
@@ -5729,14 +5784,25 @@ async function assumeRole(roleArn, sessionName = "mesh-cli", durationSeconds = 4
       if (!resp.Credentials) return null;
       return toEnv(resp.Credentials);
     } catch (err) {
-      if (!isMaxSessionDurationError(err) || duration === 3600) {
-        const message = err instanceof Error ? err.message : String(err);
-        logWarn(`AssumeRole failed: ${message}`);
-        if (isExpiredAwsTokenMessage(message)) {
-          logWarn(`  Your AWS SSO session looks expired or missing \u2014 refresh with: ${SSO_LOGIN_FIX}`);
-        }
-        return null;
+      const isLast = i === attempts.length - 1;
+      if (!isLast && isSessionDurationError(err)) {
+        logInfo(
+          `STS refused a ${formatDuration(duration)} session for ${roleArn} \u2014 retrying with ${formatDuration(ROLE_CHAINING_MAX_SESSION_SECONDS)}`
+        );
+        continue;
       }
+      const { code, text } = stsErrorDetail(err);
+      logWarn(
+        describeAssumeRoleFailure({
+          roleArn,
+          durationSeconds: duration,
+          code,
+          text,
+          callerArn,
+          loginContext: options.loginContext
+        })
+      );
+      return null;
     }
   }
   return null;
@@ -5766,9 +5832,10 @@ async function assumeRoleCredentials(roleArn, idToken, sessionName, durationSeco
         Expiration: resp.Credentials.Expiration.toISOString()
       };
     } catch (err) {
-      if (!isMaxSessionDurationError(err) || duration === 3600) {
+      if (!isSessionDurationError(err) || duration === ROLE_CHAINING_MAX_SESSION_SECONDS) {
+        const { code, text } = stsErrorDetail(err);
         logWarn(
-          `AssumeRoleWithWebIdentity failed: ${err instanceof Error ? err.message : String(err)}`
+          `AssumeRoleWithWebIdentity failed: ${code && code !== text ? `${code}: ${text}` : text}`
         );
         return null;
       }
@@ -5884,7 +5951,9 @@ async function resolveAwsCredentials(roleArn, appRoot, stack) {
     }
   }
   logInfo(`Assuming ${roleName} via AWS SSO`);
-  const creds = await assumeRole(roleArn, "mesh-cli");
+  const creds = await assumeRole(roleArn, "mesh-cli", DEFAULT_ASSUME_ROLE_SECONDS, {
+    loginContext: platformContext ?? void 0
+  });
   if (creds) {
     logSuccess(`Assumed ${roleName}`);
     return { env: creds, method: "sso" };
@@ -5903,7 +5972,7 @@ async function resolveAwsCredentials(roleArn, appRoot, stack) {
   }
   return null;
 }
-var DEFAULT_REGION, MANAGED_START_PREFIX, MANAGED_START, MANAGED_END;
+var DEFAULT_REGION, MANAGED_START_PREFIX, MANAGED_START, MANAGED_END, ROLE_CHAINING_MAX_SESSION_SECONDS, DEFAULT_ASSUME_ROLE_SECONDS;
 var init_aws_auth = __esm({
   "packages/mesh-cli/src/utils/aws-auth.ts"() {
     "use strict";
@@ -5916,6 +5985,8 @@ var init_aws_auth = __esm({
     MANAGED_START_PREFIX = `# >>> mesh-cli managed profile `;
     MANAGED_START = (context) => `${MANAGED_START_PREFIX}${context} >>>`;
     MANAGED_END = `# <<< mesh-cli managed <<<`;
+    ROLE_CHAINING_MAX_SESSION_SECONDS = 3600;
+    DEFAULT_ASSUME_ROLE_SECONDS = 43200;
   }
 });
 
@@ -7037,6 +7108,7 @@ var init_src = __esm({
       name: z.string().min(1),
       kind: apiSurfaceKindSchema.optional(),
       provider: z.string().optional(),
+      externalService: z.string().min(1).optional(),
       version: z.string().optional(),
       title: z.string().optional(),
       description: z.string().optional(),