@mtndev/cli 0.0.0-dev-20260626045221 → 0.0.0-dev-20260914234436

package/esm/__chunks/M35URMT4.js

@@ -0,0 +1,313 @@
+import {
+  applyMysqlReadonly,
+  listMysqlDatabases
+} from "./3HE4BEJX.js";
+import {
+  applyPostgresReadonly,
+  listPostgresDatabases
+} from "./SD3E3EPH.js";
+import {
+  DEFAULT_MYSQL_HOST_PATTERN,
+  DEFAULT_READONLY_USERNAME,
+  ENGINES,
+  createReadonlyUserOptionsSchema
+} from "./T3TTUHTW.js";
+import {
+  buildReadonlyUrl,
+  detectEngineFromUrl,
+  generatePassword,
+  parseConnectionUrl,
+  resolveAdminUrl
+} from "./DLEJ25GZ.js";
+import {
+  prompt,
+  promptChoice,
+  promptYesNo
+} from "./ZHKVJO2U.js";
+
+// src/commands/db/create-readonly-user/handler.js
+import chalk from "chalk";
+import { ZodError } from "zod";
+async function resolveEngine(engineOption, url) {
+  if (engineOption) {
+    return engineOption;
+  }
+  if (url) {
+    const detected = detectEngineFromUrl(url);
+    if (detected) {
+      return detected;
+    }
+  }
+  const index = await promptChoice({
+    message: "Choose a database engine:",
+    options: ["postgres", "mysql"]
+  });
+  const chosen = ENGINES[index];
+  if (!chosen) {
+    throw new Error("No engine selected");
+  }
+  return chosen;
+}
+async function resolveUrl(params) {
+  const { urlOption, engine } = params;
+  const fromEnv = resolveAdminUrl({ url: urlOption, engine });
+  if (fromEnv) {
+    return fromEnv;
+  }
+  const example = engine === "postgres" ? "postgresql://admin:pass@host:5432/postgres" : "mysql://admin:pass@host:3306/";
+  const raw = await prompt(`  Admin connection URL (e.g. ${example}): `);
+  if (!raw) {
+    throw new Error(
+      "Admin connection URL is required (pass --url or set DATABASE_URL)"
+    );
+  }
+  return raw;
+}
+async function resolveScope(params) {
+  const { databaseOption, databases } = params;
+  if (databaseOption) {
+    const normalized = databaseOption.trim().toLowerCase();
+    if (normalized === "all" || normalized === "*") {
+      return { mode: "all", databases };
+    }
+    if (!databases.includes(databaseOption)) {
+      throw new Error(
+        `Database "${databaseOption}" not found. Available: ${databases.join(", ") || "(none)"}`
+      );
+    }
+    return { mode: "one", databases: [databaseOption] };
+  }
+  if (databases.length === 0) {
+    throw new Error("No user databases found to grant access on.");
+  }
+  const options = [
+    ...databases.map((name) => name),
+    `all (${databases.length} databases)`
+  ];
+  const index = await promptChoice({
+    message: "Grant read-only on which database?",
+    options
+  });
+  if (index === options.length - 1) {
+    return { mode: "all", databases };
+  }
+  const chosen = databases[index];
+  if (!chosen) {
+    throw new Error("No database selected");
+  }
+  return { mode: "one", databases: [chosen] };
+}
+async function resolveUsername(usernameOption) {
+  if (usernameOption) {
+    return usernameOption;
+  }
+  const raw = await prompt(
+    `  Read-only username [default: ${DEFAULT_READONLY_USERNAME}]: `
+  );
+  const username = raw || DEFAULT_READONLY_USERNAME;
+  if (!/^[A-Za-z0-9_]+$/.test(username)) {
+    throw new Error(
+      "Username must contain only letters, numbers, and underscores"
+    );
+  }
+  return username;
+}
+async function resolvePassword(passwordOption) {
+  if (passwordOption) {
+    return { password: passwordOption, generated: false };
+  }
+  const generate = await promptYesNo({
+    message: "  Generate a random password?",
+    defaultYes: true
+  });
+  if (generate) {
+    return { password: generatePassword(), generated: true };
+  }
+  const password = await prompt("  Password: ");
+  if (!password) {
+    throw new Error("Password is required");
+  }
+  return { password, generated: false };
+}
+function redactUrl(url) {
+  try {
+    const parsed = new URL(url);
+    if (parsed.password) {
+      parsed.password = "***";
+    }
+    return parsed.toString();
+  } catch {
+    return url;
+  }
+}
+async function createReadonlyUserCommand(options) {
+  try {
+    const {
+      engine: engineOption,
+      url: urlOption,
+      database: databaseOption,
+      username: usernameOption,
+      password: passwordOption,
+      hostPattern: hostPatternOption,
+      ssl: sslOption,
+      yes,
+      dryRun,
+      verbose
+    } = createReadonlyUserOptionsSchema.parse(options);
+    console.log(chalk.blue("\nCreate read-only database user"));
+    console.log("");
+    const urlForDetect = resolveAdminUrl({
+      url: urlOption,
+      engine: engineOption
+    });
+    const engine = await resolveEngine(engineOption, urlForDetect);
+    console.log(`Engine: ${engine}`);
+    const url = await resolveUrl({ urlOption, engine });
+    const config = parseConnectionUrl({
+      url,
+      engine,
+      sslOption
+    });
+    console.log(
+      `Admin:  ${config.user}@${config.host}:${config.port}` + (config.database ? `/${config.database}` : "")
+    );
+    console.log("");
+    const listed = engine === "postgres" ? await listPostgresDatabases(config) : await listMysqlDatabases(config);
+    if (verbose) {
+      console.log(`Found databases: ${listed.join(", ") || "(none)"}`);
+      console.log("");
+    }
+    const scope = await resolveScope({
+      databaseOption,
+      databases: listed
+    });
+    console.log(
+      scope.mode === "all" ? `Scope:  all (${scope.databases.length} databases)` : `Scope:  ${scope.databases[0]}`
+    );
+    console.log("");
+    const username = await resolveUsername(usernameOption);
+    const { password, generated } = await resolvePassword(passwordOption);
+    const hostPattern = hostPatternOption ?? DEFAULT_MYSQL_HOST_PATTERN;
+    console.log("");
+    console.log("Plan:");
+    console.log(`  User:     ${username}`);
+    console.log(
+      `  Password: ${generated ? "(generated)" : "(provided)"}${dryRun ? " [dry-run]" : ""}`
+    );
+    if (engine === "mysql") {
+      console.log(`  Host:     ${hostPattern}`);
+    }
+    console.log(
+      scope.mode === "all" ? `  Grants:   SELECT on ALL databases (${scope.databases.length})` : `  Grants:   SELECT on ${scope.databases[0]}`
+    );
+    if (scope.mode === "all" && engine === "postgres") {
+      console.log(
+        chalk.yellow(
+          "  Note:     Databases created later will NOT get these grants automatically \u2014 re-run this command."
+        )
+      );
+    }
+    console.log("");
+    if (!yes && !dryRun) {
+      const confirmed = await promptYesNo({
+        message: "Apply these changes?",
+        defaultYes: false
+      });
+      if (!confirmed) {
+        console.log("Aborted.");
+        return;
+      }
+      console.log("");
+    }
+    const result = engine === "postgres" ? await applyPostgresReadonly({
+      config,
+      username,
+      password,
+      databases: scope.databases,
+      dryRun,
+      verbose
+    }) : await applyMysqlReadonly({
+      config,
+      username,
+      password,
+      databases: scope.mode === "all" ? "all" : scope.databases,
+      hostPattern,
+      dryRun,
+      verbose
+    });
+    if (dryRun) {
+      console.log(chalk.cyan("Dry run \u2014 SQL that would run:"));
+      for (const statement of result.statements) {
+        console.log(`  ${statement}`);
+      }
+      console.log("");
+      console.log(chalk.cyan("No changes made."));
+      return;
+    }
+    console.log(
+      chalk.green(
+        result.created ? `Created user "${username}" and granted read-only access.` : `Updated user "${username}" password and refreshed read-only grants.`
+      )
+    );
+    console.log("");
+    const sampleDb = scope.mode === "one" ? scope.databases[0] ?? "" : scope.databases[0] ?? "";
+    const readonlyUrl = buildReadonlyUrl({
+      engine,
+      host: config.host,
+      port: config.port,
+      username,
+      password,
+      database: sampleDb
+    });
+    console.log("Connection (secret shown once \u2014 copy now):");
+    console.log(
+      "\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"
+    );
+    console.log(readonlyUrl);
+    if (scope.mode === "all") {
+      console.log("");
+      console.log(
+        chalk.gray(
+          `  (URL uses database "${sampleDb}" as an example; user can connect to any granted database.)`
+        )
+      );
+    }
+    console.log(
+      "\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"
+    );
+    console.log("");
+    console.log(chalk.gray(`Admin URL used: ${redactUrl(url)}`));
+  } catch (error) {
+    if (error instanceof ZodError) {
+      console.error(chalk.red("\n\u274C Invalid command options:"));
+      error.errors.forEach((err) => {
+        console.error(chalk.red(`   ${err.path.join(".")}: ${err.message}`));
+      });
+      process.exit(1);
+    }
+    const verbose = (
+      /** @type {any} */
+      options?.verbose || false
+    );
+    console.error(chalk.red("\n\u274C create-readonly-user failed:"));
+    if (error instanceof Error) {
+      console.error(chalk.red(`   ${error.message}`));
+      if (verbose && error.stack) {
+        console.error(chalk.gray("\nStack trace:"));
+        console.error(chalk.gray(error.stack));
+      }
+    } else {
+      console.error(chalk.red(`   ${String(error)}`));
+    }
+    console.error(
+      chalk.yellow(
+        "\n\u{1F4A1} Pass --url or set DATABASE_URL. Use --verbose for details.\n"
+      )
+    );
+    process.exit(1);
+  }
+}
+
+export {
+  createReadonlyUserCommand
+};

package/esm/__chunks/NF3M2L6C.js

@@ -0,0 +1,81 @@
+import {
+  runAws,
+  runAwsVault
+} from "./FNXUONAV.js";
+
+// src/commands/aws/iam/admin-group.js
+import { spawnSync } from "child_process";
+import chalk from "chalk";
+var ADMIN_GROUP_NAME = "acl-admin-do-not-use";
+var VAULT_DURATION = process.env.AWS_VAULT_DURATION ?? "15m";
+function listVaultProfiles() {
+  const result = spawnSync("aws-vault", ["list", "--credentials"], {
+    encoding: "utf-8"
+  });
+  if (result.status !== 0) {
+    return [];
+  }
+  return (result.stdout ?? "").split("\n").map((line) => line.trim()).filter((line) => line.length > 0);
+}
+function resolveAdminScanProfiles({ profile, all = false }) {
+  const targetProfile = profile ?? process.env.AWS_PROFILE;
+  if (!all && targetProfile) {
+    return [targetProfile];
+  }
+  const profiles = listVaultProfiles();
+  if (profiles.length === 0) {
+    throw new Error("No aws-vault profiles with credentials found.");
+  }
+  return profiles;
+}
+function groupUserNames(group) {
+  return (group.Users ?? []).map((user) => user.UserName);
+}
+function resolveProfileScan(params) {
+  const { profile, verbose = false } = params;
+  const idArgs = ["sts", "get-caller-identity"];
+  const groupArgs = ["iam", "get-group", "--group-name", ADMIN_GROUP_NAME];
+  const directRun = (args, options = {}) => runAws({ profile, args, expectJson: options.expectJson ?? true, verbose });
+  const vaultRun = (args, options = {}) => runAwsVault({
+    profile,
+    args,
+    duration: VAULT_DURATION,
+    expectJson: options.expectJson ?? true,
+    verbose
+  });
+  try {
+    const identity = directRun(idArgs);
+    const group = directRun(groupArgs);
+    return {
+      accountId: identity.Account,
+      arn: identity.Arn,
+      users: groupUserNames(group),
+      run: directRun
+    };
+  } catch (directError) {
+    try {
+      const identity = vaultRun(idArgs);
+      const group = vaultRun(groupArgs);
+      return {
+        accountId: identity.Account,
+        arn: identity.Arn,
+        users: groupUserNames(group),
+        run: vaultRun
+      };
+    } catch {
+      if (verbose) {
+        const reason = directError instanceof Error ? directError.message.split("\n")[0] ?? "" : String(directError);
+        console.log(chalk.dim(`skip   ${profile} \u2014 ${reason}`));
+      }
+      return null;
+    }
+  }
+}
+
+export {
+  ADMIN_GROUP_NAME,
+  listVaultProfiles,
+  resolveAdminScanProfiles,
+  groupUserNames,
+  resolveProfileScan
+};

package/esm/__chunks/PNPPDYKC.js

@@ -0,0 +1,299 @@
+import {
+  authorizeRule,
+  describeSecurityGroups,
+  extractRoamingFirstName,
+  getCurrentPublicIp,
+  getSecurityGroupDetails,
+  instanceLabel,
+  listEnabledRegions,
+  listInstances,
+  listSshIngressRules,
+  printSshRules,
+  resolveRoamingRule,
+  revokeRule,
+  roamingRuleDescription,
+  ruleAlreadyAllowsIp,
+  securityGroupLabel
+} from "./U7HAE2RF.js";
+import {
+  DEFAULT_REGION,
+  allowIpOptionsSchema
+} from "./J34UVKLA.js";
+import {
+  AwsCliError,
+  getCallerIdentity,
+  requireCommands
+} from "./FNXUONAV.js";
+import {
+  resolveProfile
+} from "./5GIUAFXL.js";
+import {
+  promptChoice
+} from "./ZHKVJO2U.js";
+
+// src/commands/aws/ec2/allow-ip/handler.js
+import chalk from "chalk";
+import { ZodError } from "zod";
+async function resolveRegion(params) {
+  const { profile, region, verbose } = params;
+  if (region) {
+    return region;
+  }
+  const instances = listInstances({ profile, region: DEFAULT_REGION, verbose });
+  if (instances.length > 0) {
+    return DEFAULT_REGION;
+  }
+  const regions = listEnabledRegions({
+    profile,
+    region: DEFAULT_REGION,
+    verbose
+  });
+  if (regions.length === 0) {
+    throw new Error("No enabled AWS regions found for this profile");
+  }
+  console.log(`No EC2 instances found in ${DEFAULT_REGION}.`);
+  const index = await promptChoice({
+    message: "Choose a region:",
+    options: regions
+  });
+  const chosen = regions[index];
+  if (!chosen) {
+    throw new Error("No region selected");
+  }
+  return chosen;
+}
+function handleRuleChangeError(error, ctx) {
+  const { securityGroup, sshRules, newCidr, ruleDescription, action } = ctx;
+  if (error.code === "InvalidPermission.Duplicate") {
+    const matching = ruleAlreadyAllowsIp(sshRules, newCidr);
+    const label = matching ? matching.description : ruleDescription;
+    console.log(
+      `Security group ${securityGroup.groupId} already allows SSH from ${newCidr} (${label}). Nothing to do.`
+    );
+    return;
+  }
+  if (error.code === "UnauthorizedOperation") {
+    console.error(
+      `Could not ${action} the SSH rule: your AWS profile does not have ec2:AuthorizeSecurityGroupIngress or ec2:RevokeSecurityGroupIngress on ${securityGroup.groupName} (${securityGroup.groupId}).`
+    );
+    console.error("");
+    console.error("Current single-host SSH rules on port 22:");
+    printSshRules(sshRules, (message) => console.error(message));
+    if (action === "create" && sshRules.length > 0) {
+      console.error("");
+      console.error(
+        "A rule may already exist. Re-run to update your named roaming rule, or ask an admin to grant security group ingress permissions."
+      );
+    }
+    process.exit(1);
+  }
+  throw error;
+}
+async function allowIpCommand(options) {
+  try {
+    const {
+      profile: profileOption,
+      region: regionOption,
+      ruleName,
+      verbose
+    } = allowIpOptionsSchema.parse(options);
+    const profile = await resolveProfile({ profile: profileOption });
+    if (!profile) {
+      console.error(chalk.red("Error: pass --profile or set AWS_PROFILE."));
+      process.exit(1);
+    }
+    requireCommands(["aws"]);
+    const identity = getCallerIdentity({
+      profile,
+      region: DEFAULT_REGION,
+      verbose
+    });
+    const firstName = extractRoamingFirstName({ profile, identity });
+    const ruleDescription = ruleName ?? roamingRuleDescription(firstName);
+    console.log("Caller:");
+    console.log(`  Account: ${identity.Account}`);
+    console.log(`  Arn:     ${identity.Arn}`);
+    console.log(`  Roaming rule: ${ruleDescription}`);
+    console.log("");
+    const region = await resolveRegion({
+      profile,
+      region: regionOption,
+      verbose
+    });
+    console.log(`Region: ${region}`);
+    console.log("");
+    const instances = listInstances({ profile, region, verbose });
+    if (instances.length === 0) {
+      console.log(`No EC2 instances found in ${region}.`);
+      process.exit(1);
+    }
+    const instanceIndex = await promptChoice({
+      message: "Choose an EC2 instance:",
+      options: instances.map((instance2) => instanceLabel(instance2))
+    });
+    const instance = instances[instanceIndex];
+    if (!instance) {
+      throw new Error("No instance selected");
+    }
+    console.log("");
+    const securityGroups = describeSecurityGroups({
+      profile,
+      region,
+      groupIds: instance.securityGroupIds,
+      verbose
+    });
+    if (securityGroups.length === 0) {
+      console.log("No security groups found on the selected instance.");
+      process.exit(1);
+    }
+    let securityGroup;
+    if (securityGroups.length === 1) {
+      const onlyGroup = securityGroups[0];
+      if (!onlyGroup) {
+        throw new Error("No security group found on the selected instance");
+      }
+      securityGroup = onlyGroup;
+      console.log(`Security group: ${securityGroupLabel(securityGroup)}`);
+    } else {
+      const groupIndex = await promptChoice({
+        message: "Choose a security group:",
+        options: securityGroups.map((group) => securityGroupLabel(group))
+      });
+      securityGroup = securityGroups[groupIndex];
+    }
+    if (!securityGroup) {
+      throw new Error("No security group selected");
+    }
+    console.log("");
+    const currentIp = await getCurrentPublicIp();
+    const newCidr = `${currentIp}/32`;
+    console.log(`Current public IP: ${currentIp}`);
+    console.log("");
+    const sgDetails = getSecurityGroupDetails({
+      profile,
+      region,
+      groupId: securityGroup.groupId,
+      verbose
+    });
+    if (!sgDetails) {
+      console.log("Could not load security group details.");
+      process.exit(1);
+    }
+    const sshRules = listSshIngressRules(sgDetails);
+    const roamingRule = resolveRoamingRule(sshRules, ruleDescription);
+    if (roamingRule && roamingRule.cidrIp === newCidr) {
+      console.log(
+        `Security group ${securityGroup.groupId} already allows SSH from ${newCidr} (${ruleDescription}). Nothing to do.`
+      );
+      return;
+    }
+    const otherRuleAtIp = ruleAlreadyAllowsIp(sshRules, newCidr);
+    if (otherRuleAtIp && (!roamingRule || otherRuleAtIp.cidrIp !== roamingRule.cidrIp)) {
+      const label = otherRuleAtIp.description || "(no description)";
+      console.log(
+        `Security group ${securityGroup.groupId} already allows SSH from ${newCidr} (${label}). Nothing to do.`
+      );
+      return;
+    }
+    if (roamingRule) {
+      console.log(
+        `Updating SSH rule (${ruleDescription}): ${roamingRule.cidrIp} -> ${newCidr}`
+      );
+      try {
+        revokeRule({
+          profile,
+          region,
+          groupId: securityGroup.groupId,
+          rule: roamingRule,
+          verbose
+        });
+        authorizeRule({
+          profile,
+          region,
+          groupId: securityGroup.groupId,
+          cidrIp: newCidr,
+          description: ruleDescription,
+          fromPort: roamingRule.fromPort,
+          toPort: roamingRule.toPort,
+          ipProtocol: roamingRule.ipProtocol,
+          verbose
+        });
+      } catch (error) {
+        if (error instanceof AwsCliError) {
+          handleRuleChangeError(error, {
+            securityGroup,
+            sshRules,
+            newCidr,
+            ruleDescription,
+            action: "update"
+          });
+          return;
+        }
+        throw error;
+      }
+    } else {
+      if (sshRules.length > 0) {
+        console.log("Existing single-host SSH rules (unchanged):");
+        printSshRules(sshRules);
+        console.log("");
+      }
+      console.log(`Creating new "${ruleDescription}" SSH rule for ${newCidr}`);
+      try {
+        authorizeRule({
+          profile,
+          region,
+          groupId: securityGroup.groupId,
+          cidrIp: newCidr,
+          description: ruleDescription,
+          verbose
+        });
+      } catch (error) {
+        if (error instanceof AwsCliError) {
+          handleRuleChangeError(error, {
+            securityGroup,
+            sshRules,
+            newCidr,
+            ruleDescription,
+            action: "create"
+          });
+          return;
+        }
+        throw error;
+      }
+    }
+    console.log("");
+    console.log(
+      `Done. ${securityGroup.groupName} (${securityGroup.groupId}) now allows SSH from ${newCidr} (${ruleDescription}).`
+    );
+  } catch (error) {
+    if (error instanceof ZodError) {
+      console.error(chalk.red("\n\u274C Invalid command options:"));
+      error.errors.forEach((err) => {
+        console.error(chalk.red(`   ${err.path.join(".")}: ${err.message}`));
+      });
+      process.exit(1);
+    }
+    const verbose = (
+      /** @type {any} */
+      options?.verbose || false
+    );
+    console.error(chalk.red("\n\u274C allow-ip failed:"));
+    if (error instanceof Error) {
+      console.error(chalk.red(`   ${error.message}`));
+      if (verbose && error.stack) {
+        console.error(chalk.gray("\nStack trace:"));
+        console.error(chalk.gray(error.stack));
+      }
+    } else {
+      console.error(chalk.red(`   ${String(error)}`));
+    }
+    console.error(
+      chalk.yellow("\n\u{1F4A1} Use --verbose for detailed error information\n")
+    );
+    process.exit(1);
+  }
+}
+
+export {
+  allowIpCommand
+};