@mtndev/cli 0.0.0-dev-20260626045221 → 0.0.0-dev-20260914234436

package/esm/__chunks/DMYFNF54.js

@@ -0,0 +1,192 @@
+import {
+  ACL_GROUPS,
+  CUSTOM_POLICIES,
+  attach,
+  detach,
+  ensureGroup,
+  printFinalState,
+  publishPolicy
+} from "./XOUWDB3T.js";
+import {
+  createUsersInteractive
+} from "./3QLI5BDL.js";
+import {
+  setupAclOptionsSchema
+} from "./XQN2TA4S.js";
+import {
+  getCallerIdentity,
+  requireCommands
+} from "./FNXUONAV.js";
+import {
+  resolveProfile
+} from "./5GIUAFXL.js";
+import {
+  promptYesNo
+} from "./ZHKVJO2U.js";
+
+// src/commands/aws/iam/setup-acl/handler.js
+import chalk from "chalk";
+import { ZodError } from "zod";
+async function resolveRestrictRegions(params) {
+  const { restrictRegions } = params;
+  if (restrictRegions) {
+    console.log(`Region restriction: ${restrictRegions}`);
+    return restrictRegions === "yes";
+  }
+  console.log("Region restriction");
+  console.log(
+    "  The policy UserAdminsDenyRegionsList limits acl-power-users to a hard-coded"
+  );
+  console.log(
+    "  region allowlist. Most accounts should leave this OFF unless you have a strong reason."
+  );
+  const restrict = await promptYesNo({
+    message: "  Attach region restriction to acl-power-users?",
+    defaultYes: false
+  });
+  console.log(`  \u2192 ${restrict ? "yes" : "no"}`);
+  console.log("");
+  return restrict;
+}
+async function setupAclCommand(options) {
+  try {
+    const {
+      restrictRegions,
+      createUsers,
+      profile: profileOption,
+      region,
+      verbose
+    } = setupAclOptionsSchema.parse(options);
+    requireCommands(["aws"]);
+    const profile = await resolveProfile({ profile: profileOption });
+    const identity = getCallerIdentity({ profile, region, verbose });
+    const accountId = identity.Account;
+    console.log("Caller:");
+    console.log(`  Account: ${accountId}`);
+    console.log(`  Arn:     ${identity.Arn}`);
+    console.log("");
+    const restrict = await resolveRestrictRegions({ restrictRegions });
+    console.log("1. Ensure groups exist...");
+    for (const group of ACL_GROUPS) {
+      ensureGroup({ name: group, profile, verbose });
+    }
+    console.log("");
+    console.log("2. Publish custom policies...");
+    for (const policy of CUSTOM_POLICIES) {
+      publishPolicy({
+        name: policy.name,
+        fileName: policy.fileName,
+        accountId,
+        profile,
+        verbose
+      });
+    }
+    console.log("");
+    const ADMIN = "arn:aws:iam::aws:policy/AdministratorAccess";
+    const IAM_FULL = "arn:aws:iam::aws:policy/IAMFullAccess";
+    const READ_ONLY = "arn:aws:iam::aws:policy/ReadOnlyAccess";
+    const WRITE_LIST = `arn:aws:iam::${accountId}:policy/UserAdminsWriteList`;
+    const DENY_LIST = `arn:aws:iam::${accountId}:policy/UserAdminsDenyList`;
+    const SELF_SERVICE = `arn:aws:iam::${accountId}:policy/UserAdminsSelfServiceIAM`;
+    const DENY_REGIONS = `arn:aws:iam::${accountId}:policy/UserAdminsDenyRegionsList`;
+    const STS_FEDERATION = `arn:aws:iam::${accountId}:policy/sts-federation`;
+    const S3_RESTRICTIONS = `arn:aws:iam::${accountId}:policy/S3RestrictionsDenyNonS3Services`;
+    console.log("3. Attach policies to groups...");
+    attach({ group: "acl-admin-do-not-use", arn: ADMIN, profile, verbose });
+    attach({ group: "acl-iam-full-access", arn: IAM_FULL, profile, verbose });
+    attach({ group: "acl-iam-full-access", arn: READ_ONLY, profile, verbose });
+    attach({
+      group: "acl-iam-full-access",
+      arn: SELF_SERVICE,
+      profile,
+      verbose
+    });
+    attach({
+      group: "acl-iam-full-access",
+      arn: STS_FEDERATION,
+      profile,
+      verbose
+    });
+    detach({ group: "acl-iam-full-access", arn: DENY_LIST, profile, verbose });
+    attach({ group: "acl-power-users", arn: READ_ONLY, profile, verbose });
+    attach({ group: "acl-power-users", arn: WRITE_LIST, profile, verbose });
+    attach({ group: "acl-power-users", arn: DENY_LIST, profile, verbose });
+    attach({ group: "acl-power-users", arn: SELF_SERVICE, profile, verbose });
+    attach({ group: "acl-read-only", arn: READ_ONLY, profile, verbose });
+    attach({ group: "acl-read-only", arn: STS_FEDERATION, profile, verbose });
+    attach({
+      group: "acl-s3-restrictions",
+      arn: S3_RESTRICTIONS,
+      profile,
+      verbose
+    });
+    console.log("");
+    console.log("4. Apply region restriction to acl-power-users...");
+    if (restrict) {
+      attach({ group: "acl-power-users", arn: DENY_REGIONS, profile, verbose });
+    } else {
+      detach({ group: "acl-power-users", arn: DENY_REGIONS, profile, verbose });
+    }
+    console.log("");
+    console.log("5. Detach legacy policies (if present)...");
+    const LEGACY_POWER_USER = "arn:aws:iam::aws:policy/PowerUserAccess";
+    const LEGACY_IAM_RO = "arn:aws:iam::aws:policy/IAMReadOnlyAccess";
+    const LEGACY_ALLOW = `arn:aws:iam::${accountId}:policy/UserAdminsAllowList`;
+    const LEGACY_DENY_SVCS = `arn:aws:iam::${accountId}:policy/UserAdminsDenyListServices`;
+    const LEGACY_DENY_GPU = `arn:aws:iam::${accountId}:policy/UserAdminsDenyListGpu`;
+    const legacyArns = [
+      LEGACY_POWER_USER,
+      LEGACY_IAM_RO,
+      LEGACY_ALLOW,
+      LEGACY_DENY_SVCS,
+      LEGACY_DENY_GPU
+    ];
+    for (const group of ACL_GROUPS) {
+      for (const arn of legacyArns) {
+        detach({ group, arn, profile, verbose });
+      }
+    }
+    console.log("");
+    console.log("6. Final state:");
+    printFinalState({ profile, verbose });
+    console.log("");
+    if (createUsers) {
+      console.log("7. Create IAM users (optional)");
+      console.log("");
+      await createUsersInteractive({ profile, verbose });
+    }
+    console.log(chalk.green("\n\u2705 ACL setup complete."));
+  } catch (error) {
+    if (error instanceof ZodError) {
+      console.error(chalk.red("\n\u274C Invalid command options:"));
+      error.errors.forEach((err) => {
+        console.error(chalk.red(`   ${err.path.join(".")}: ${err.message}`));
+      });
+      process.exit(1);
+    }
+    const verbose = (
+      /** @type {any} */
+      options?.verbose || false
+    );
+    console.error(chalk.red("\n\u274C iam setup-acl failed:"));
+    if (error instanceof Error) {
+      console.error(chalk.red(`   ${error.message}`));
+      if (verbose && error.stack) {
+        console.error(chalk.gray("\nStack trace:"));
+        console.error(chalk.gray(error.stack));
+      }
+    } else {
+      console.error(chalk.red(`   ${String(error)}`));
+    }
+    console.error(
+      chalk.yellow(
+        "\n\u{1F4A1} Run with a profile that has IAMFullAccess (e.g. md-*-iam-admin).\n"
+      )
+    );
+    process.exit(1);
+  }
+}
+
+export {
+  setupAclCommand
+};

package/esm/__chunks/DNFTUMGD.js

@@ -0,0 +1,23 @@
+import {
+  profileField,
+  verboseField
+} from "./73BJG53F.js";
+
+// src/commands/aws/iam/remove-admin/schema.js
+import { z } from "zod";
+var removeAdminOptionsSchema = z.object({
+  profile: profileField,
+  all: z.boolean().optional().default(false).describe(
+    "Scan every aws-vault profile (default only when --profile and AWS_PROFILE are unset)"
+  ),
+  user: z.array(z.string()).optional().default([]).describe(
+    "Only remove these user(s); repeatable. Default: every user in the group"
+  ),
+  yes: z.boolean().optional().default(false).describe("Skip the per-profile confirmation prompt"),
+  dryRun: z.boolean().optional().default(false).describe("Preview removals without changing anything"),
+  verbose: verboseField
+});
+
+export {
+  removeAdminOptionsSchema
+};

package/esm/__chunks/DVKD6YSR.js

@@ -0,0 +1,49 @@
+import {
+  createReadonlyUserCommand
+} from "./M35URMT4.js";
+
+// src/commands/db/index.js
+function registerDbCommands(program) {
+  const db = program.command("db").summary("Database operational commands").description("Database operational helpers (MySQL and Postgres)");
+  db.command("create-readonly-user").summary("Create a read-only database user").description(
+    "Create (or update) a read-only database user on MySQL or Postgres. Interactively pick a single database or all databases, then print a connection URL."
+  ).option(
+    "-e, --engine <engine>",
+    "Database engine: postgres or mysql (inferred from --url when omitted)"
+  ).option(
+    "-u, --url <url>",
+    "Admin connection URL (defaults to DATABASE_URL / MYSQL_URL / POSTGRES_URL)"
+  ).option(
+    "-d, --database <name>",
+    'Target database name, or "all" for every non-system database'
+  ).option(
+    "--username <name>",
+    "Read-only username to create (default: readonly)"
+  ).option(
+    "--password <password>",
+    "Password for the new user (generated when omitted)"
+  ).option("--host-pattern <pattern>", "MySQL user host pattern (default: %)").option("--ssl", "Force SSL on (loose verify \u2014 useful for RDS)").option("--no-ssl", "Force SSL off").option("-y, --yes", "Skip the confirmation prompt").option("--dry-run", "Print the SQL plan without applying it").option("-v, --verbose", "Enable verbose logging").action(async (options) => {
+    let ssl;
+    if (options.ssl === true) {
+      ssl = true;
+    } else if (options.noSsl === true) {
+      ssl = false;
+    }
+    await createReadonlyUserCommand({
+      engine: options.engine,
+      url: options.url,
+      database: options.database,
+      username: options.username,
+      password: options.password,
+      hostPattern: options.hostPattern,
+      ssl,
+      yes: options.yes ?? false,
+      dryRun: options.dryRun ?? false,
+      verbose: options.verbose ?? false
+    });
+  });
+}
+
+export {
+  registerDbCommands
+};

package/esm/__chunks/EMSH4P76.js

@@ -0,0 +1,20 @@
+import {
+  profileField,
+  verboseField
+} from "./73BJG53F.js";
+
+// src/commands/aws/iam/break-glass/schema.js
+import { z } from "zod";
+var breakGlassOptionsSchema = z.object({
+  profile: profileField,
+  user: z.array(z.string()).optional().default([]).describe(
+    "Grant break-glass to this user (repeatable). Default: your own IAM user"
+  ),
+  yes: z.boolean().optional().default(false).describe("Skip the confirmation prompt"),
+  dryRun: z.boolean().optional().default(false).describe("Preview the grant without changing anything"),
+  verbose: verboseField
+});
+
+export {
+  breakGlassOptionsSchema
+};

package/esm/__chunks/FFKFVMIE.js

@@ -0,0 +1,167 @@
+import {
+  removeAdminOptionsSchema
+} from "./DNFTUMGD.js";
+import {
+  ADMIN_GROUP_NAME,
+  resolveAdminScanProfiles,
+  resolveProfileScan
+} from "./NF3M2L6C.js";
+import {
+  requireCommands
+} from "./FNXUONAV.js";
+import {
+  promptYesNo
+} from "./ZHKVJO2U.js";
+
+// src/commands/aws/iam/remove-admin/handler.js
+import chalk from "chalk";
+import { ZodError } from "zod";
+async function removeAdminCommand(options) {
+  try {
+    const { profile, all, user, yes, dryRun, verbose } = removeAdminOptionsSchema.parse(options);
+    requireCommands(["aws"]);
+    const userFilter = new Set(user);
+    const needsVault = all || !(profile ?? process.env.AWS_PROFILE);
+    if (needsVault) {
+      requireCommands(["aws-vault"]);
+    }
+    let profiles;
+    try {
+      profiles = resolveAdminScanProfiles({ profile, all });
+    } catch (resolveError) {
+      if (resolveError instanceof Error && resolveError.message === "No aws-vault profiles with credentials found.") {
+        console.error(chalk.red(resolveError.message));
+        process.exit(1);
+      }
+      throw resolveError;
+    }
+    console.log(
+      chalk.blue(
+        `
+==> Removing break-glass access (${ADMIN_GROUP_NAME}) across ${profiles.length} profile(s)
+`
+      )
+    );
+    if (dryRun) {
+      console.log(chalk.yellow("[dry-run] No changes will be made.\n"));
+    }
+    let removed = 0;
+    let cleaned = 0;
+    let skipped = 0;
+    for (const candidate of profiles) {
+      const scan = resolveProfileScan({ profile: candidate, verbose });
+      if (!scan) {
+        skipped += 1;
+        continue;
+      }
+      if (scan.users.length === 0) {
+        if (verbose) {
+          console.log(
+            chalk.green(`OK     ${candidate} (${scan.accountId}) \u2014 0 users`)
+          );
+        }
+        cleaned += 1;
+        continue;
+      }
+      const targets = userFilter.size > 0 ? scan.users.filter((name) => userFilter.has(name)) : scan.users;
+      if (targets.length === 0) {
+        console.log(
+          chalk.dim(
+            `--     ${candidate} (${scan.accountId}) \u2014 has users but none match --user`
+          )
+        );
+        skipped += 1;
+        continue;
+      }
+      console.log(
+        chalk.red(
+          `FOUND  ${candidate} (${scan.accountId}) \u2014 ${targets.length} user(s): ${targets.join(", ")}`
+        )
+      );
+      if (dryRun) {
+        for (const name of targets) {
+          console.log(
+            chalk.yellow(
+              `  [dry-run] would remove ${name} from ${ADMIN_GROUP_NAME}`
+            )
+          );
+        }
+        continue;
+      }
+      let confirmed = yes;
+      if (!confirmed) {
+        confirmed = await promptYesNo({
+          message: `  Remove ${targets.length} user(s) from ${ADMIN_GROUP_NAME} in ${candidate}?`,
+          defaultYes: false
+        });
+      }
+      if (!confirmed) {
+        console.log(chalk.dim("  skipped (not confirmed)"));
+        skipped += 1;
+        continue;
+      }
+      for (const name of targets) {
+        try {
+          scan.run(
+            [
+              "iam",
+              "remove-user-from-group",
+              "--group-name",
+              ADMIN_GROUP_NAME,
+              "--user-name",
+              name
+            ],
+            { expectJson: false }
+          );
+          console.log(chalk.green(`  removed ${name}`));
+          removed += 1;
+        } catch (removeError) {
+          const reason = removeError instanceof Error ? removeError.message.split("\n")[0] ?? "" : String(removeError);
+          console.log(chalk.red(`  failed to remove ${name}: ${reason}`));
+        }
+      }
+    }
+    console.log(chalk.blue("\n==> Summary"));
+    console.log(`  Profiles scanned:  ${profiles.length}`);
+    console.log(`  Users removed:     ${removed}`);
+    console.log(`  Already clean:     ${cleaned}`);
+    console.log(`  Skipped:           ${skipped}`);
+    if (dryRun) {
+      console.log(
+        chalk.yellow("\n[dry-run] Re-run without --dry-run to apply changes.")
+      );
+    }
+  } catch (error) {
+    if (error instanceof ZodError) {
+      console.error(chalk.red("\n\u274C Invalid command options:"));
+      error.errors.forEach((err) => {
+        console.error(chalk.red(`   ${err.path.join(".")}: ${err.message}`));
+      });
+      process.exit(1);
+    }
+    const verbose = (
+      /** @type {any} */
+      options?.verbose || false
+    );
+    console.error(chalk.red("\n\u274C remove-admin failed:"));
+    if (error instanceof Error) {
+      console.error(chalk.red(`   ${error.message}`));
+      if (verbose && error.stack) {
+        console.error(chalk.gray("\nStack trace:"));
+        console.error(chalk.gray(error.stack));
+      }
+    } else {
+      console.error(chalk.red(`   ${String(error)}`));
+    }
+    console.error(
+      chalk.yellow(
+        "\n\u{1F4A1} Requires the AWS CLI (and aws-vault when scanning multiple profiles) and iam:RemoveUserFromGroup.\n"
+      )
+    );
+    process.exit(1);
+  }
+}
+
+export {
+  removeAdminCommand
+};

package/esm/__chunks/FNXUONAV.js

@@ -0,0 +1,110 @@
+// src/commands/aws/utils/exec-aws.js
+import { spawnSync } from "child_process";
+import chalk from "chalk";
+var AwsCliError = class extends Error {
+  /**
+   * @param {string} message
+   * @param {string | null} [code]
+   */
+  constructor(message, code = null) {
+    super(message);
+    this.name = "AwsCliError";
+    this.code = code;
+  }
+};
+function parseAwsErrorCode(stderr) {
+  const match = /\(([A-Za-z.]+)\)/.exec(stderr);
+  return match?.[1] ?? null;
+}
+function requireCommands(commands) {
+  const missing = commands.filter((command) => {
+    const result = spawnSync("which", [command], { stdio: "pipe" });
+    return result.status !== 0;
+  });
+  if (missing.length > 0) {
+    throw new Error(
+      `Required command(s) not found on PATH: ${missing.join(", ")}`
+    );
+  }
+}
+function runAws(params) {
+  const {
+    profile,
+    region,
+    args,
+    expectJson = true,
+    verbose = false,
+    env
+  } = params;
+  const finalArgs = [];
+  if (profile) finalArgs.push("--profile", profile);
+  if (region) finalArgs.push("--region", region);
+  finalArgs.push("--no-cli-pager", ...args);
+  if (expectJson) finalArgs.push("--output", "json");
+  return spawnAws("aws", finalArgs, { expectJson, verbose, env });
+}
+function runAwsVault(params) {
+  const {
+    profile,
+    args,
+    duration = "15m",
+    expectJson = true,
+    verbose = false
+  } = params;
+  const awsArgs = ["--no-cli-pager", ...args];
+  if (expectJson) awsArgs.push("--output", "json");
+  const finalArgs = [
+    "exec",
+    profile,
+    "--duration",
+    duration,
+    "--",
+    "aws",
+    ...awsArgs
+  ];
+  return spawnAws("aws-vault", finalArgs, { expectJson, verbose });
+}
+function spawnAws(command, args, options) {
+  const { expectJson, verbose, env } = options;
+  if (verbose) {
+    console.log(chalk.gray(`   Executing: ${command} ${args.join(" ")}`));
+  }
+  const result = spawnSync(command, args, {
+    encoding: "utf-8",
+    env: env ? { ...process.env, ...env } : process.env
+  });
+  if (result.error) {
+    throw new AwsCliError(result.error.message);
+  }
+  if (result.status !== 0) {
+    const stderr = (result.stderr || result.stdout || "").trim();
+    const message = stderr || `Command failed: ${command} ${args.join(" ")}`;
+    throw new AwsCliError(message, parseAwsErrorCode(stderr));
+  }
+  const stdout = (result.stdout ?? "").trim();
+  if (!expectJson) {
+    return stdout;
+  }
+  if (!stdout) {
+    return {};
+  }
+  return JSON.parse(stdout);
+}
+function getCallerIdentity(params) {
+  const { profile, region, verbose } = params;
+  return runAws({
+    profile,
+    region,
+    args: ["sts", "get-caller-identity"],
+    verbose
+  });
+}
+
+export {
+  AwsCliError,
+  parseAwsErrorCode,
+  requireCommands,
+  runAws,
+  runAwsVault,
+  getCallerIdentity
+};