@mtndev/cli 0.0.0-dev-20260626045346 → 0.0.0-pr-20-20261020022402

package/esm/__chunks/U7HAE2RF.js

@@ -0,0 +1,288 @@
+import {
+  DEFAULT_ROAMING_NAME,
+  SSH_PORT
+} from "./J34UVKLA.js";
+import {
+  runAws
+} from "./FNXUONAV.js";
+
+// src/commands/aws/ec2/allow-ip/utils.js
+async function getCurrentPublicIp() {
+  const urls = ["https://checkip.amazonaws.com", "https://api.ipify.org"];
+  for (const url of urls) {
+    try {
+      const controller = new AbortController();
+      const timeout = setTimeout(() => controller.abort(), 8e3);
+      const response = await fetch(url, { signal: controller.signal });
+      clearTimeout(timeout);
+      if (!response.ok) continue;
+      const ip = (await response.text()).trim();
+      if (ip && ip.includes(".")) {
+        return ip;
+      }
+    } catch {
+      continue;
+    }
+  }
+  throw new Error("Could not determine your current public IP address");
+}
+function listEnabledRegions(params) {
+  const { profile, region, verbose } = params;
+  const data = runAws({
+    profile,
+    region,
+    args: [
+      "ec2",
+      "describe-regions",
+      "--query",
+      "Regions[?OptInStatus!=`not-opted-in`].RegionName"
+    ],
+    verbose
+  });
+  const regions = Array.isArray(data) ? data : [];
+  return regions.map((value) => String(value)).sort();
+}
+function listInstances(params) {
+  const { profile, region, verbose } = params;
+  const data = runAws({
+    profile,
+    region,
+    args: ["ec2", "describe-instances"],
+    verbose
+  });
+  const instances = [];
+  for (const reservation of data.Reservations ?? []) {
+    for (const raw of reservation.Instances ?? []) {
+      const state = raw.State?.Name ?? "unknown";
+      if (state === "terminated" || state === "shutting-down") {
+        continue;
+      }
+      let name = "";
+      for (const tag of raw.Tags ?? []) {
+        if (tag.Key === "Name") {
+          name = tag.Value ?? "";
+          break;
+        }
+      }
+      const securityGroupIds = (raw.SecurityGroups ?? []).map((group) => group.GroupId).filter((id) => Boolean(id));
+      instances.push({
+        instanceId: raw.InstanceId,
+        name,
+        state,
+        instanceType: raw.InstanceType ?? "unknown",
+        publicIp: raw.PublicIpAddress ?? null,
+        securityGroupIds
+      });
+    }
+  }
+  instances.sort(
+    (a, b) => a.name.toLowerCase().localeCompare(b.name.toLowerCase()) || a.instanceId.localeCompare(b.instanceId)
+  );
+  return instances;
+}
+function describeSecurityGroups(params) {
+  const { profile, region, groupIds, verbose } = params;
+  if (groupIds.length === 0) {
+    return [];
+  }
+  const data = runAws({
+    profile,
+    region,
+    args: ["ec2", "describe-security-groups", "--group-ids", ...groupIds],
+    verbose
+  });
+  const groups = (data.SecurityGroups ?? []).map((raw) => ({
+    groupId: raw.GroupId,
+    groupName: raw.GroupName ?? "",
+    description: raw.Description ?? ""
+  }));
+  groups.sort((a, b) => a.groupName.localeCompare(b.groupName));
+  return groups;
+}
+function getSecurityGroupDetails(params) {
+  const { profile, region, groupId, verbose } = params;
+  const data = runAws({
+    profile,
+    region,
+    args: ["ec2", "describe-security-groups", "--group-ids", groupId],
+    verbose
+  });
+  const securityGroups = data.SecurityGroups ?? [];
+  if (securityGroups.length === 0) {
+    return null;
+  }
+  return securityGroups[0];
+}
+function isSingleHostCidr(cidrIp) {
+  return cidrIp.endsWith("/32") && cidrIp !== "0.0.0.0/0";
+}
+function portAllowsSsh(permission) {
+  const protocol = permission.IpProtocol;
+  if (protocol !== "tcp" && protocol !== "6") {
+    return false;
+  }
+  const fromPort = permission.FromPort;
+  const toPort = permission.ToPort;
+  if (fromPort === void 0 && toPort === void 0) {
+    return true;
+  }
+  if (fromPort === void 0 || toPort === void 0) {
+    return false;
+  }
+  return fromPort <= SSH_PORT && SSH_PORT <= toPort;
+}
+function listSshIngressRules(securityGroup) {
+  const rules = [];
+  for (const permission of securityGroup.IpPermissions ?? []) {
+    if (!portAllowsSsh(permission)) {
+      continue;
+    }
+    const fromPort = permission.FromPort ?? SSH_PORT;
+    const toPort = permission.ToPort ?? SSH_PORT;
+    const ipProtocol = permission.IpProtocol ?? "tcp";
+    for (const ipRange of permission.IpRanges ?? []) {
+      const cidrIp = ipRange.CidrIp;
+      if (!cidrIp || !isSingleHostCidr(cidrIp)) {
+        continue;
+      }
+      rules.push({
+        cidrIp,
+        description: ipRange.Description ?? "",
+        fromPort,
+        toPort,
+        ipProtocol
+      });
+    }
+  }
+  return rules;
+}
+function extractRoamingFirstName(params) {
+  const { profile, identity } = params;
+  const arn = identity.Arn ?? "";
+  const username = arn.includes("/") ? arn.split("/").pop() ?? "" : "";
+  for (const candidate of [username, profile ?? ""]) {
+    if (!candidate) continue;
+    const match = /^md-([^-]+)-/.exec(candidate);
+    if (match && match[1]) {
+      return match[1].charAt(0).toUpperCase() + match[1].slice(1).toLowerCase();
+    }
+  }
+  return DEFAULT_ROAMING_NAME;
+}
+function roamingRuleDescription(firstName) {
+  return `${firstName} Roaming`;
+}
+function resolveRoamingRule(sshRules, ruleDescription) {
+  const target = ruleDescription.toLowerCase();
+  for (const rule of sshRules) {
+    if (rule.description.trim().toLowerCase() === target) {
+      return rule;
+    }
+  }
+  return null;
+}
+function ruleAlreadyAllowsIp(sshRules, newCidr) {
+  for (const rule of sshRules) {
+    if (rule.cidrIp === newCidr) {
+      return rule;
+    }
+  }
+  return null;
+}
+function buildIpPermissions(params) {
+  const {
+    cidrIp,
+    description,
+    fromPort = SSH_PORT,
+    toPort = SSH_PORT,
+    ipProtocol = "tcp"
+  } = params;
+  return JSON.stringify([
+    {
+      IpProtocol: ipProtocol,
+      FromPort: fromPort,
+      ToPort: toPort,
+      IpRanges: [{ CidrIp: cidrIp, Description: description }]
+    }
+  ]);
+}
+function authorizeRule(params) {
+  const { profile, region, groupId, verbose, ...rule } = params;
+  runAws({
+    profile,
+    region,
+    args: [
+      "ec2",
+      "authorize-security-group-ingress",
+      "--group-id",
+      groupId,
+      "--ip-permissions",
+      buildIpPermissions(rule)
+    ],
+    expectJson: false,
+    verbose
+  });
+}
+function revokeRule(params) {
+  const { profile, region, groupId, rule, verbose } = params;
+  runAws({
+    profile,
+    region,
+    args: [
+      "ec2",
+      "revoke-security-group-ingress",
+      "--group-id",
+      groupId,
+      "--ip-permissions",
+      buildIpPermissions({
+        cidrIp: rule.cidrIp,
+        description: rule.description,
+        fromPort: rule.fromPort,
+        toPort: rule.toPort,
+        ipProtocol: rule.ipProtocol
+      })
+    ],
+    expectJson: false,
+    verbose
+  });
+}
+function instanceLabel(instance) {
+  const publicIp = instance.publicIp || "no public IP";
+  const name = instance.name || "(no name)";
+  return `${instance.instanceId}  ${name}  ${instance.state}  ${instance.instanceType}  ${publicIp}`;
+}
+function securityGroupLabel(group) {
+  return `${group.groupId}  ${group.groupName}  ${group.description}`;
+}
+function sshRuleLabel(rule) {
+  const description = rule.description || "(no description)";
+  return `${rule.cidrIp}  ${description}`;
+}
+function printSshRules(sshRules, log = console.log) {
+  if (sshRules.length === 0) {
+    log("  (no single-host SSH rules on port 22)");
+    return;
+  }
+  for (const rule of sshRules) {
+    log(`  - ${sshRuleLabel(rule)}`);
+  }
+}
+
+export {
+  getCurrentPublicIp,
+  listEnabledRegions,
+  listInstances,
+  describeSecurityGroups,
+  getSecurityGroupDetails,
+  listSshIngressRules,
+  extractRoamingFirstName,
+  roamingRuleDescription,
+  resolveRoamingRule,
+  ruleAlreadyAllowsIp,
+  authorizeRule,
+  revokeRule,
+  instanceLabel,
+  securityGroupLabel,
+  sshRuleLabel,
+  printSshRules
+};

package/esm/__chunks/UXWY7BYE.js

@@ -0,0 +1,63 @@
+import {
+  calculateSmtpPassword,
+  smtpEndpoint
+} from "./B2DVQ2UL.js";
+
+// src/commands/aws/ses/send-email/utils.js
+import { randomBytes } from "crypto";
+function defaultBody() {
+  const token = randomBytes(16).toString("hex");
+  const sentAt = (/* @__PURE__ */ new Date()).toISOString();
+  return `MTN CLI test email \u2014 random token: ${token} \u2014 sent at ${sentAt}`;
+}
+async function sendViaApi(params) {
+  const { to, from, subject, body, region, profile } = params;
+  const { SESClient, SendEmailCommand } = await import("@aws-sdk/client-ses");
+  const { fromNodeProviderChain } = await import("@aws-sdk/credential-providers");
+  const client = new SESClient({
+    region,
+    credentials: fromNodeProviderChain(profile ? { profile } : {})
+  });
+  const command = new SendEmailCommand({
+    Source: from,
+    Destination: { ToAddresses: [to] },
+    Message: {
+      Subject: { Data: subject },
+      Body: { Text: { Data: body } }
+    }
+  });
+  const result = await client.send(command);
+  return result.MessageId;
+}
+async function sendViaSmtp(params) {
+  const { to, from, subject, body, region, accessKeyId } = params;
+  const user = process.env.SES_SMTP_USER ?? accessKeyId;
+  let pass = process.env.SES_SMTP_PASSWORD;
+  if (!pass) {
+    const secret = process.env.AWS_SECRET_ACCESS_KEY;
+    if (secret) {
+      pass = calculateSmtpPassword({ secretAccessKey: secret, region });
+    }
+  }
+  if (!user || !pass) {
+    throw new Error(
+      "SMTP transport requires SES_SMTP_USER and SES_SMTP_PASSWORD, or AWS_SECRET_ACCESS_KEY (plus --access-key-id) to derive the SMTP password."
+    );
+  }
+  const nodemailerModule = await import("nodemailer");
+  const nodemailer = nodemailerModule.default ?? nodemailerModule;
+  const transporter = nodemailer.createTransport({
+    host: smtpEndpoint(region),
+    port: 587,
+    secure: false,
+    auth: { user, pass }
+  });
+  const info = await transporter.sendMail({ from, to, subject, text: body });
+  return info.messageId;
+}
+
+export {
+  defaultBody,
+  sendViaApi,
+  sendViaSmtp
+};

package/esm/__chunks/VKAKISRG.js

@@ -0,0 +1,192 @@
+import {
+  breakGlassOptionsSchema
+} from "./EMSH4P76.js";
+import {
+  ADMIN_GROUP_NAME,
+  resolveProfileScan
+} from "./NF3M2L6C.js";
+import {
+  requireCommands
+} from "./FNXUONAV.js";
+import {
+  resolveProfile
+} from "./5GIUAFXL.js";
+import {
+  promptYesNo
+} from "./ZHKVJO2U.js";
+
+// src/commands/aws/iam/break-glass/handler.js
+import chalk from "chalk";
+import { ZodError } from "zod";
+function userNameFromArn(arn) {
+  const marker = ":user/";
+  const index = arn.indexOf(marker);
+  if (index === -1) {
+    return null;
+  }
+  const name = arn.slice(index + marker.length).split("/").pop();
+  return name && name.length > 0 ? name : null;
+}
+async function breakGlassCommand(options) {
+  try {
+    const { profile, user, yes, dryRun, verbose } = breakGlassOptionsSchema.parse(options);
+    requireCommands(["aws"]);
+    const targetProfile = await resolveProfile({ profile });
+    if (!targetProfile) {
+      console.error(
+        chalk.red(
+          "No profile specified. Pass --profile <name> or set AWS_PROFILE."
+        )
+      );
+      process.exit(1);
+    }
+    const scan = resolveProfileScan({ profile: targetProfile, verbose });
+    if (!scan) {
+      console.error(
+        chalk.red(
+          `
+\u274C Could not read ${ADMIN_GROUP_NAME} for profile "${targetProfile}".`
+        )
+      );
+      console.error(
+        chalk.yellow(
+          "   Check your credentials, and run `mtn aws iam setup-acl` first if the group does not exist yet.\n"
+        )
+      );
+      process.exit(1);
+    }
+    let targets = user;
+    if (targets.length === 0) {
+      const derived = userNameFromArn(scan.arn);
+      if (!derived) {
+        console.error(
+          chalk.red(
+            `
+\u274C Could not determine your IAM user from the caller identity:
+   ${scan.arn}`
+          )
+        );
+        console.error(
+          chalk.yellow("   Pass --user <name> to choose who to grant.\n")
+        );
+        process.exit(1);
+      }
+      targets = [derived];
+    }
+    const alreadyMembers = new Set(scan.users);
+    const toGrant = targets.filter((name) => !alreadyMembers.has(name));
+    const existing = targets.filter((name) => alreadyMembers.has(name));
+    console.log(
+      chalk.blue(
+        `
+==> Break-glass admin (${ADMIN_GROUP_NAME}) \u2014 profile ${targetProfile} (${scan.accountId})
+`
+      )
+    );
+    for (const name of existing) {
+      console.log(chalk.dim(`--     ${name} already has break-glass access`));
+    }
+    if (toGrant.length === 0) {
+      console.log(
+        chalk.green(
+          "\nNothing to do \u2014 all target user(s) already have break-glass access.\n"
+        )
+      );
+      return;
+    }
+    console.log(
+      chalk.red.bold(
+        `\u26A0  This grants AdministratorAccess to ${toGrant.length} user(s): ${toGrant.join(", ")}`
+      )
+    );
+    if (dryRun) {
+      for (const name of toGrant) {
+        console.log(
+          chalk.yellow(`  [dry-run] would add ${name} to ${ADMIN_GROUP_NAME}`)
+        );
+      }
+      console.log(
+        chalk.yellow("\n[dry-run] Re-run without --dry-run to apply.\n")
+      );
+      return;
+    }
+    let confirmed = yes;
+    if (!confirmed) {
+      confirmed = await promptYesNo({
+        message: `  Grant break-glass admin to ${toGrant.length} user(s) in ${targetProfile}?`,
+        defaultYes: false
+      });
+    }
+    if (!confirmed) {
+      console.log(chalk.dim("  aborted (not confirmed)\n"));
+      return;
+    }
+    let granted = 0;
+    for (const name of toGrant) {
+      try {
+        scan.run(
+          [
+            "iam",
+            "add-user-to-group",
+            "--group-name",
+            ADMIN_GROUP_NAME,
+            "--user-name",
+            name
+          ],
+          { expectJson: false }
+        );
+        console.log(chalk.green(`  granted ${name}`));
+        granted += 1;
+      } catch (grantError) {
+        const reason = grantError instanceof Error ? grantError.message.split("\n")[0] ?? "" : String(grantError);
+        console.log(chalk.red(`  failed to grant ${name}: ${reason}`));
+      }
+    }
+    console.log(chalk.blue("\n==> Summary"));
+    console.log(`  Profile:          ${targetProfile} (${scan.accountId})`);
+    console.log(`  Users granted:    ${granted}`);
+    console.log(`  Already had it:   ${existing.length}`);
+    console.log(
+      chalk.yellow(
+        "\n\u{1F4A1} Revoke with `mtn aws iam remove-admin` when you are done."
+      )
+    );
+    console.log(
+      chalk.dim(
+        "   You may need a fresh session (e.g. clear the aws-vault cache) before the new permissions apply.\n"
+      )
+    );
+  } catch (error) {
+    if (error instanceof ZodError) {
+      console.error(chalk.red("\n\u274C Invalid command options:"));
+      error.errors.forEach((err) => {
+        console.error(chalk.red(`   ${err.path.join(".")}: ${err.message}`));
+      });
+      process.exit(1);
+    }
+    const verbose = (
+      /** @type {any} */
+      options?.verbose || false
+    );
+    console.error(chalk.red("\n\u274C break-glass failed:"));
+    if (error instanceof Error) {
+      console.error(chalk.red(`   ${error.message}`));
+      if (verbose && error.stack) {
+        console.error(chalk.gray("\nStack trace:"));
+        console.error(chalk.gray(error.stack));
+      }
+    } else {
+      console.error(chalk.red(`   ${String(error)}`));
+    }
+    console.error(
+      chalk.yellow(
+        "\n\u{1F4A1} Requires the AWS CLI and iam:AddUserToGroup on the target profile.\n"
+      )
+    );
+    process.exit(1);
+  }
+}
+
+export {
+  breakGlassCommand
+};