@moondeck/station 0.0.1 → 1.0.0

package/lib/credential-store-scope.ts

@@ -0,0 +1,112 @@
+/**
+ * Which credential store paths this runner may list.
+ *
+ * An owned or shared host reads whole trees (`/uai/orgs`, `/uai/users`,
+ * `/uai/projects`, its own `/uai/hosts/<id>`). A sidecar (ADR-133) holds a
+ * task lease whose IAM policy is scoped by session tag — it may list exactly
+ * `/uai/orgs/<org>` and `/uai/users/<user>` and nothing above them, so the
+ * tree listings answer AccessDenied on every path (2026-09-10, smoke 6: zero
+ * engine accounts and no GitHub token on the first live task machine). The
+ * lease carries the two ids; a lease without them (an older cloud) means the
+ * store is not read at all rather than listed where it cannot be.
+ *
+ * Project env stays unread on a task machine: the policy grants project
+ * parameters by an `org` tag the mirror never writes (put-parameter's
+ * Overwrite excludes tags), so no listing shape can reach them until the
+ * store layout or the mirror changes (hostless-implementation.md).
+ */
+import { isParameterPathSegment } from "./credential-store";
+import { leaseScope } from "./lease";
+import { sidecarMode } from "./sidecar";
+
+export type StoreListScope =
+  | { kind: "host" }
+  | { kind: "lease"; orgId: string | null; userId: string }
+  | { kind: "none"; reason: string };
+
+export function storeListScope(): StoreListScope {
+  if (!sidecarMode()) return { kind: "host" };
+  const scope = leaseScope();
+  if (!scope) return { kind: "none", reason: "the lease carries no org/user scope" };
+  return { kind: "lease", orgId: scope.orgId, userId: scope.userId };
+}
+
+const warned = new Set<string>();
+function warnOnce(tag: string, line: string): void {
+  if (warned.has(tag)) return;
+  warned.add(tag);
+  console.warn(`[${tag}] credential store: ${line}`);
+}
+/** Test seam. */
+export function resetStoreScopeWarningsForTesting(): void {
+  warned.clear();
+}
+
+/** The paths an engine-account listing walks, or null when this runner
+ * must not list at all (a sidecar without a scoped lease). */
+export function engineAccountListPaths(prefix: string, hostId: string | null): string[] | null {
+  const scope = storeListScope();
+  if (scope.kind === "host") {
+    const paths = [`${prefix}/orgs`];
+    if (hostId && isParameterPathSegment(hostId)) paths.push(`${prefix}/hosts/${hostId}`);
+    return paths;
+  }
+  if (scope.kind === "none") {
+    warnOnce("engine-accounts", `${scope.reason} — not listed on this task machine`);
+    return null;
+  }
+  // No host path: a task machine's host row owns no accounts, and the policy
+  // denies the path anyway.
+  if (scope.orgId === null || !isParameterPathSegment(scope.orgId)) return [];
+  return [`${prefix}/orgs/${scope.orgId}`];
+}
+
+/** The path a user-credential listing walks, or null to skip. */
+export function userCredentialListPath(prefix: string): string | null {
+  const scope = storeListScope();
+  if (scope.kind === "host") return `${prefix}/users`;
+  if (scope.kind === "none") {
+    warnOnce("user-credentials", `${scope.reason} — not listed on this task machine`);
+    return null;
+  }
+  if (!isParameterPathSegment(scope.userId)) return null;
+  return `${prefix}/users/${scope.userId}`;
+}
+
+/**
+ * The paths a project-env listing walks, or null to skip. An owned or shared
+ * host walks the whole tree. A task machine's lease reads
+ * `/uai/projects/<id>/…` only for parameters tagged with its org (the policy
+ * conditions on `ssm:ResourceTag/org`), and only the task's own projects are
+ * worth asking for — their ids arrive with task-up, not with the first grant,
+ * so a listing without ids on a task machine is simply "nothing yet".
+ */
+export function projectEnvListPaths(
+  prefix: string,
+  projectIds?: readonly string[],
+): string[] | null {
+  const scope = storeListScope();
+  if (scope.kind === "host") return [`${prefix}/projects`];
+  if (scope.kind === "none") {
+    warnOnce("project-env", `not read: ${scope.reason}`);
+    return null;
+  }
+  if (!scope.orgId) {
+    warnOnce("project-env", "not read on a task machine whose lease carries no org");
+    return null;
+  }
+  if (!projectIds) return null;
+  return projectIds
+    .filter((id) => isParameterPathSegment(id))
+    .map((id) => `${prefix}/projects/${id}`);
+}
+
+/**
+ * Whether project env is read by name (describe + get-parameter) instead of
+ * by path: true under a lease, whose policy conditions on each parameter's
+ * `org` tag and therefore denies the path listing itself (see
+ * `CredentialStore.listByName`).
+ */
+export function projectEnvListsByName(): boolean {
+  return storeListScope().kind === "lease";
+}