@mtndev/cli 1.1.0 → 2.0.1

package/esm/commands/aws/ec2/allow-ip/handler.js

@@ -0,0 +1,258 @@
+import { promptChoice } from "../../utils/tty.js";
+import { AwsCliError, getCallerIdentity, requireCommands } from "../../utils/exec-aws.js";
+import { resolveProfile } from "../../utils/resolve-profile.js";
+import { DEFAULT_REGION, allowIpOptionsSchema } from "./schema.js";
+import { authorizeRule, describeSecurityGroups, extractRoamingFirstName, getCurrentPublicIp, getSecurityGroupDetails, instanceLabel, listEnabledRegions, listInstances, listSshIngressRules, printSshRules, resolveRoamingRule, revokeRule, roamingRuleDescription, ruleAlreadyAllowsIp, securityGroupLabel } from "./utils.js";
+import chalk from "chalk";
+import { ZodError } from "zod";
+//#region src/commands/aws/ec2/allow-ip/handler.js
+/**
+* Resolve which region to operate in: explicit, else default if it has instances,
+* else prompt from the enabled regions.
+* @param {{ profile?: string; region?: string; verbose: boolean }} params
+* @returns {Promise<string>}
+*/
+async function resolveRegion(params) {
+	const { profile, region, verbose } = params;
+	if (region) return region;
+	if (listInstances({
+		profile,
+		region: "us-east-1",
+		verbose
+	}).length > 0) return DEFAULT_REGION;
+	const regions = listEnabledRegions({
+		profile,
+		region: DEFAULT_REGION,
+		verbose
+	});
+	if (regions.length === 0) throw new Error("No enabled AWS regions found for this profile");
+	console.log(`No EC2 instances found in ${DEFAULT_REGION}.`);
+	const chosen = regions[await promptChoice({
+		message: "Choose a region:",
+		options: regions
+	})];
+	if (!chosen) throw new Error("No region selected");
+	return chosen;
+}
+/**
+* Handle errors from authorize/revoke with the same UX as the original script.
+* Returns when the situation is benign (duplicate); exits the process on a
+* permissions failure; rethrows anything else.
+* @param {AwsCliError} error
+* @param {{
+*   securityGroup: import("./utils.js").SecurityGroup;
+*   sshRules: import("./utils.js").SshIngressRule[];
+*   newCidr: string;
+*   ruleDescription: string;
+*   action: "create" | "update";
+* }} ctx
+*/
+function handleRuleChangeError(error, ctx) {
+	const { securityGroup, sshRules, newCidr, ruleDescription, action } = ctx;
+	if (error.code === "InvalidPermission.Duplicate") {
+		const matching = ruleAlreadyAllowsIp(sshRules, newCidr);
+		const label = matching ? matching.description : ruleDescription;
+		console.log(`Security group ${securityGroup.groupId} already allows SSH from ${newCidr} (${label}). Nothing to do.`);
+		return;
+	}
+	if (error.code === "UnauthorizedOperation") {
+		console.error(`Could not ${action} the SSH rule: your AWS profile does not have ec2:AuthorizeSecurityGroupIngress or ec2:RevokeSecurityGroupIngress on ${securityGroup.groupName} (${securityGroup.groupId}).`);
+		console.error("");
+		console.error("Current single-host SSH rules on port 22:");
+		printSshRules(sshRules, (message) => console.error(message));
+		if (action === "create" && sshRules.length > 0) {
+			console.error("");
+			console.error("A rule may already exist. Re-run to update your named roaming rule, or ask an admin to grant security group ingress permissions.");
+		}
+		process.exit(1);
+	}
+	throw error;
+}
+/**
+* `aws ec2 allow-ip` handler: update or create a named roaming SSH rule for the
+* caller's current public IP on a chosen EC2 instance's security group.
+* @param {unknown} options
+*/
+async function allowIpCommand(options) {
+	try {
+		const { profile: profileOption, region: regionOption, ruleName, verbose } = allowIpOptionsSchema.parse(options);
+		const profile = await resolveProfile({ profile: profileOption });
+		if (!profile) {
+			console.error(chalk.red("Error: pass --profile or set AWS_PROFILE."));
+			process.exit(1);
+		}
+		requireCommands(["aws"]);
+		const identity = getCallerIdentity({
+			profile,
+			region: DEFAULT_REGION,
+			verbose
+		});
+		const firstName = extractRoamingFirstName({
+			profile,
+			identity
+		});
+		const ruleDescription = ruleName ?? roamingRuleDescription(firstName);
+		console.log("Caller:");
+		console.log(`  Account: ${identity.Account}`);
+		console.log(`  Arn:     ${identity.Arn}`);
+		console.log(`  Roaming rule: ${ruleDescription}`);
+		console.log("");
+		const region = await resolveRegion({
+			profile,
+			region: regionOption,
+			verbose
+		});
+		console.log(`Region: ${region}`);
+		console.log("");
+		const instances = listInstances({
+			profile,
+			region,
+			verbose
+		});
+		if (instances.length === 0) {
+			console.log(`No EC2 instances found in ${region}.`);
+			process.exit(1);
+		}
+		const instance = instances[await promptChoice({
+			message: "Choose an EC2 instance:",
+			options: instances.map((instance) => instanceLabel(instance))
+		})];
+		if (!instance) throw new Error("No instance selected");
+		console.log("");
+		const securityGroups = describeSecurityGroups({
+			profile,
+			region,
+			groupIds: instance.securityGroupIds,
+			verbose
+		});
+		if (securityGroups.length === 0) {
+			console.log("No security groups found on the selected instance.");
+			process.exit(1);
+		}
+		let securityGroup;
+		if (securityGroups.length === 1) {
+			const onlyGroup = securityGroups[0];
+			if (!onlyGroup) throw new Error("No security group found on the selected instance");
+			securityGroup = onlyGroup;
+			console.log(`Security group: ${securityGroupLabel(securityGroup)}`);
+		} else securityGroup = securityGroups[await promptChoice({
+			message: "Choose a security group:",
+			options: securityGroups.map((group) => securityGroupLabel(group))
+		})];
+		if (!securityGroup) throw new Error("No security group selected");
+		console.log("");
+		const currentIp = await getCurrentPublicIp();
+		const newCidr = `${currentIp}/32`;
+		console.log(`Current public IP: ${currentIp}`);
+		console.log("");
+		const sgDetails = getSecurityGroupDetails({
+			profile,
+			region,
+			groupId: securityGroup.groupId,
+			verbose
+		});
+		if (!sgDetails) {
+			console.log("Could not load security group details.");
+			process.exit(1);
+		}
+		const sshRules = listSshIngressRules(sgDetails);
+		const roamingRule = resolveRoamingRule(sshRules, ruleDescription);
+		if (roamingRule && roamingRule.cidrIp === newCidr) {
+			console.log(`Security group ${securityGroup.groupId} already allows SSH from ${newCidr} (${ruleDescription}). Nothing to do.`);
+			return;
+		}
+		const otherRuleAtIp = ruleAlreadyAllowsIp(sshRules, newCidr);
+		if (otherRuleAtIp && (!roamingRule || otherRuleAtIp.cidrIp !== roamingRule.cidrIp)) {
+			const label = otherRuleAtIp.description || "(no description)";
+			console.log(`Security group ${securityGroup.groupId} already allows SSH from ${newCidr} (${label}). Nothing to do.`);
+			return;
+		}
+		if (roamingRule) {
+			console.log(`Updating SSH rule (${ruleDescription}): ${roamingRule.cidrIp} -> ${newCidr}`);
+			try {
+				revokeRule({
+					profile,
+					region,
+					groupId: securityGroup.groupId,
+					rule: roamingRule,
+					verbose
+				});
+				authorizeRule({
+					profile,
+					region,
+					groupId: securityGroup.groupId,
+					cidrIp: newCidr,
+					description: ruleDescription,
+					fromPort: roamingRule.fromPort,
+					toPort: roamingRule.toPort,
+					ipProtocol: roamingRule.ipProtocol,
+					verbose
+				});
+			} catch (error) {
+				if (error instanceof AwsCliError) {
+					handleRuleChangeError(error, {
+						securityGroup,
+						sshRules,
+						newCidr,
+						ruleDescription,
+						action: "update"
+					});
+					return;
+				}
+				throw error;
+			}
+		} else {
+			if (sshRules.length > 0) {
+				console.log("Existing single-host SSH rules (unchanged):");
+				printSshRules(sshRules);
+				console.log("");
+			}
+			console.log(`Creating new "${ruleDescription}" SSH rule for ${newCidr}`);
+			try {
+				authorizeRule({
+					profile,
+					region,
+					groupId: securityGroup.groupId,
+					cidrIp: newCidr,
+					description: ruleDescription,
+					verbose
+				});
+			} catch (error) {
+				if (error instanceof AwsCliError) {
+					handleRuleChangeError(error, {
+						securityGroup,
+						sshRules,
+						newCidr,
+						ruleDescription,
+						action: "create"
+					});
+					return;
+				}
+				throw error;
+			}
+		}
+		console.log("");
+		console.log(`Done. ${securityGroup.groupName} (${securityGroup.groupId}) now allows SSH from ${newCidr} (${ruleDescription}).`);
+	} catch (error) {
+		if (error instanceof ZodError) {
+			console.error(chalk.red("\n❌ Invalid command options:"));
+			error.errors.forEach((err) => {
+				console.error(chalk.red(`   ${err.path.join(".")}: ${err.message}`));
+			});
+			process.exit(1);
+		}
+		const verbose = options?.verbose || false;
+		console.error(chalk.red("\n❌ allow-ip failed:"));
+		if (error instanceof Error) {
+			console.error(chalk.red(`   ${error.message}`));
+			if (verbose && error.stack) {
+				console.error(chalk.gray("\nStack trace:"));
+				console.error(chalk.gray(error.stack));
+			}
+		} else console.error(chalk.red(`   ${String(error)}`));
+		console.error(chalk.yellow("\n💡 Use --verbose for detailed error information\n"));
+		process.exit(1);
+	}
+}
+//#endregion
+export { allowIpCommand };

package/esm/commands/aws/ec2/allow-ip/index.d.ts

@@ -0,0 +1,3 @@
+export * from "./handler.js";
+export * from "./schema.js";
+export * from "./utils.js";

package/esm/commands/aws/ec2/allow-ip/index.js

@@ -0,0 +1,4 @@
+import { DEFAULT_REGION, DEFAULT_ROAMING_NAME, SSH_PORT, allowIpOptionsSchema } from "./schema.js";
+import { authorizeRule, describeSecurityGroups, extractRoamingFirstName, getCurrentPublicIp, getSecurityGroupDetails, instanceLabel, listEnabledRegions, listInstances, listSshIngressRules, printSshRules, resolveRoamingRule, revokeRule, roamingRuleDescription, ruleAlreadyAllowsIp, securityGroupLabel, sshRuleLabel } from "./utils.js";
+import { allowIpCommand } from "./handler.js";
+export { DEFAULT_REGION, DEFAULT_ROAMING_NAME, SSH_PORT, allowIpCommand, allowIpOptionsSchema, authorizeRule, describeSecurityGroups, extractRoamingFirstName, getCurrentPublicIp, getSecurityGroupDetails, instanceLabel, listEnabledRegions, listInstances, listSshIngressRules, printSshRules, resolveRoamingRule, revokeRule, roamingRuleDescription, ruleAlreadyAllowsIp, securityGroupLabel, sshRuleLabel };

package/esm/commands/aws/ec2/allow-ip/schema.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Default region checked first before prompting.
+ */
+export const DEFAULT_REGION: "us-east-1";
+/**
+ * SSH port managed by this command.
+ */
+export const SSH_PORT: 22;
+/**
+ * Fallback first name when one cannot be derived from the profile/IAM user.
+ */
+export const DEFAULT_ROAMING_NAME: "Declan";
+/**
+ * Zod schema for `aws ec2 allow-ip` options.
+ */
+export const allowIpOptionsSchema: z.ZodObject<{
+    profile: z.ZodOptional<z.ZodString>;
+    region: z.ZodOptional<z.ZodString>;
+    ruleName: z.ZodOptional<z.ZodString>;
+    verbose: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+}, "strip", z.ZodTypeAny, {
+    verbose: boolean;
+    profile?: string | undefined;
+    region?: string | undefined;
+    ruleName?: string | undefined;
+}, {
+    profile?: string | undefined;
+    region?: string | undefined;
+    verbose?: boolean | undefined;
+    ruleName?: string | undefined;
+}>;
+export type AllowIpOptions = z.infer<typeof allowIpOptionsSchema>;
+import { z } from "zod";

package/esm/commands/aws/ec2/allow-ip/schema.js

@@ -0,0 +1,29 @@
+import { profileField, regionField, verboseField } from "../../schema.js";
+import { z } from "zod";
+//#region src/commands/aws/ec2/allow-ip/schema.js
+/**
+* Default region checked first before prompting.
+*/
+const DEFAULT_REGION = "us-east-1";
+/**
+* SSH port managed by this command.
+*/
+const SSH_PORT = 22;
+/**
+* Fallback first name when one cannot be derived from the profile/IAM user.
+*/
+const DEFAULT_ROAMING_NAME = "Declan";
+/**
+* Zod schema for `aws ec2 allow-ip` options.
+*/
+const allowIpOptionsSchema = z.object({
+	profile: profileField,
+	region: regionField,
+	ruleName: z.string().optional().describe("SSH rule description to update or create (default: \"{FirstName} Roaming\" derived from the profile/IAM user)"),
+	verbose: verboseField
+});
+/**
+* @typedef {z.infer<typeof allowIpOptionsSchema>} AllowIpOptions
+*/
+//#endregion
+export { DEFAULT_REGION, DEFAULT_ROAMING_NAME, SSH_PORT, allowIpOptionsSchema };

package/esm/commands/aws/ec2/allow-ip/utils.d.ts

@@ -0,0 +1,189 @@
+/**
+ * @typedef {Object} Ec2Instance
+ * @property {string} instanceId
+ * @property {string} name
+ * @property {string} state
+ * @property {string} instanceType
+ * @property {string | null} publicIp
+ * @property {string[]} securityGroupIds
+ */
+/**
+ * @typedef {Object} SecurityGroup
+ * @property {string} groupId
+ * @property {string} groupName
+ * @property {string} description
+ */
+/**
+ * @typedef {Object} SshIngressRule
+ * @property {string} cidrIp
+ * @property {string} description
+ * @property {number} fromPort
+ * @property {number} toPort
+ * @property {string} ipProtocol
+ */
+/**
+ * Determine the caller's current public IPv4 address.
+ * @returns {Promise<string>}
+ */
+export function getCurrentPublicIp(): Promise<string>;
+/**
+ * List regions that are opted-in / enabled for the profile.
+ * @param {{ profile?: string; region: string; verbose?: boolean }} params
+ * @returns {string[]}
+ */
+export function listEnabledRegions(params: {
+    profile?: string;
+    region: string;
+    verbose?: boolean;
+}): string[];
+/**
+ * List non-terminated EC2 instances in a region.
+ * @param {{ profile?: string; region: string; verbose?: boolean }} params
+ * @returns {Ec2Instance[]}
+ */
+export function listInstances(params: {
+    profile?: string;
+    region: string;
+    verbose?: boolean;
+}): Ec2Instance[];
+/**
+ * Describe security groups by id.
+ * @param {{ profile?: string; region: string; groupIds: string[]; verbose?: boolean }} params
+ * @returns {SecurityGroup[]}
+ */
+export function describeSecurityGroups(params: {
+    profile?: string;
+    region: string;
+    groupIds: string[];
+    verbose?: boolean;
+}): SecurityGroup[];
+/**
+ * Load full details for a single security group.
+ * @param {{ profile?: string; region: string; groupId: string; verbose?: boolean }} params
+ * @returns {any | null}
+ */
+export function getSecurityGroupDetails(params: {
+    profile?: string;
+    region: string;
+    groupId: string;
+    verbose?: boolean;
+}): any | null;
+/**
+ * Extract single-host SSH ingress rules (port 22, /32) from a security group.
+ * @param {any} securityGroup
+ * @returns {SshIngressRule[]}
+ */
+export function listSshIngressRules(securityGroup: any): SshIngressRule[];
+/**
+ * Derive a first name from the IAM ARN or profile (md-{name}-...).
+ * @param {{ profile?: string; identity: { Arn?: string } }} params
+ * @returns {string}
+ */
+export function extractRoamingFirstName(params: {
+    profile?: string;
+    identity: {
+        Arn?: string;
+    };
+}): string;
+/**
+ * @param {string} firstName
+ * @returns {string}
+ */
+export function roamingRuleDescription(firstName: string): string;
+/**
+ * Find an existing rule whose description matches the roaming rule name.
+ * @param {SshIngressRule[]} sshRules
+ * @param {string} ruleDescription
+ * @returns {SshIngressRule | null}
+ */
+export function resolveRoamingRule(sshRules: SshIngressRule[], ruleDescription: string): SshIngressRule | null;
+/**
+ * Find an existing rule that already allows the given CIDR.
+ * @param {SshIngressRule[]} sshRules
+ * @param {string} newCidr
+ * @returns {SshIngressRule | null}
+ */
+export function ruleAlreadyAllowsIp(sshRules: SshIngressRule[], newCidr: string): SshIngressRule | null;
+/**
+ * Authorize a new SSH ingress rule.
+ * @param {{
+ *   profile?: string;
+ *   region: string;
+ *   groupId: string;
+ *   cidrIp: string;
+ *   description: string;
+ *   fromPort?: number;
+ *   toPort?: number;
+ *   ipProtocol?: string;
+ *   verbose?: boolean;
+ * }} params
+ */
+export function authorizeRule(params: {
+    profile?: string;
+    region: string;
+    groupId: string;
+    cidrIp: string;
+    description: string;
+    fromPort?: number;
+    toPort?: number;
+    ipProtocol?: string;
+    verbose?: boolean;
+}): void;
+/**
+ * Revoke an existing SSH ingress rule.
+ * @param {{
+ *   profile?: string;
+ *   region: string;
+ *   groupId: string;
+ *   rule: SshIngressRule;
+ *   verbose?: boolean;
+ * }} params
+ */
+export function revokeRule(params: {
+    profile?: string;
+    region: string;
+    groupId: string;
+    rule: SshIngressRule;
+    verbose?: boolean;
+}): void;
+/**
+ * @param {Ec2Instance} instance
+ * @returns {string}
+ */
+export function instanceLabel(instance: Ec2Instance): string;
+/**
+ * @param {SecurityGroup} group
+ * @returns {string}
+ */
+export function securityGroupLabel(group: SecurityGroup): string;
+/**
+ * @param {SshIngressRule} rule
+ * @returns {string}
+ */
+export function sshRuleLabel(rule: SshIngressRule): string;
+/**
+ * Print single-host SSH rules using the given logger.
+ * @param {SshIngressRule[]} sshRules
+ * @param {(message: string) => void} [log]
+ */
+export function printSshRules(sshRules: SshIngressRule[], log?: (message: string) => void): void;
+export type Ec2Instance = {
+    instanceId: string;
+    name: string;
+    state: string;
+    instanceType: string;
+    publicIp: string | null;
+    securityGroupIds: string[];
+};
+export type SecurityGroup = {
+    groupId: string;
+    groupName: string;
+    description: string;
+};
+export type SshIngressRule = {
+    cidrIp: string;
+    description: string;
+    fromPort: number;
+    toPort: number;
+    ipProtocol: string;
+};