@mtndev/cli 1.1.0 → 2.0.1

package/cjs/commands/aws/ec2/allow-ip/utils.cjs

@@ -0,0 +1,379 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_commands_aws_utils_exec_aws = require("../../utils/exec-aws.cjs");
+const require_commands_aws_ec2_allow_ip_schema = require("./schema.cjs");
+//#region src/commands/aws/ec2/allow-ip/utils.js
+/**
+* @typedef {Object} Ec2Instance
+* @property {string} instanceId
+* @property {string} name
+* @property {string} state
+* @property {string} instanceType
+* @property {string | null} publicIp
+* @property {string[]} securityGroupIds
+*/
+/**
+* @typedef {Object} SecurityGroup
+* @property {string} groupId
+* @property {string} groupName
+* @property {string} description
+*/
+/**
+* @typedef {Object} SshIngressRule
+* @property {string} cidrIp
+* @property {string} description
+* @property {number} fromPort
+* @property {number} toPort
+* @property {string} ipProtocol
+*/
+/**
+* Determine the caller's current public IPv4 address.
+* @returns {Promise<string>}
+*/
+async function getCurrentPublicIp() {
+	for (const url of ["https://checkip.amazonaws.com", "https://api.ipify.org"]) try {
+		const controller = new AbortController();
+		const timeout = setTimeout(() => controller.abort(), 8e3);
+		const response = await fetch(url, { signal: controller.signal });
+		clearTimeout(timeout);
+		if (!response.ok) continue;
+		const ip = (await response.text()).trim();
+		if (ip && ip.includes(".")) return ip;
+	} catch {
+		continue;
+	}
+	throw new Error("Could not determine your current public IP address");
+}
+/**
+* List regions that are opted-in / enabled for the profile.
+* @param {{ profile?: string; region: string; verbose?: boolean }} params
+* @returns {string[]}
+*/
+function listEnabledRegions(params) {
+	const { profile, region, verbose } = params;
+	const data = require_commands_aws_utils_exec_aws.runAws({
+		profile,
+		region,
+		args: [
+			"ec2",
+			"describe-regions",
+			"--query",
+			"Regions[?OptInStatus!=`not-opted-in`].RegionName"
+		],
+		verbose
+	});
+	return (Array.isArray(data) ? data : []).map((value) => String(value)).sort();
+}
+/**
+* List non-terminated EC2 instances in a region.
+* @param {{ profile?: string; region: string; verbose?: boolean }} params
+* @returns {Ec2Instance[]}
+*/
+function listInstances(params) {
+	const { profile, region, verbose } = params;
+	const data = require_commands_aws_utils_exec_aws.runAws({
+		profile,
+		region,
+		args: ["ec2", "describe-instances"],
+		verbose
+	});
+	/** @type {Ec2Instance[]} */
+	const instances = [];
+	for (const reservation of data.Reservations ?? []) for (const raw of reservation.Instances ?? []) {
+		const state = raw.State?.Name ?? "unknown";
+		if (state === "terminated" || state === "shutting-down") continue;
+		let name = "";
+		for (const tag of raw.Tags ?? []) if (tag.Key === "Name") {
+			name = tag.Value ?? "";
+			break;
+		}
+		const securityGroupIds = (raw.SecurityGroups ?? []).map((group) => group.GroupId).filter((id) => Boolean(id));
+		instances.push({
+			instanceId: raw.InstanceId,
+			name,
+			state,
+			instanceType: raw.InstanceType ?? "unknown",
+			publicIp: raw.PublicIpAddress ?? null,
+			securityGroupIds
+		});
+	}
+	instances.sort((a, b) => a.name.toLowerCase().localeCompare(b.name.toLowerCase()) || a.instanceId.localeCompare(b.instanceId));
+	return instances;
+}
+/**
+* Describe security groups by id.
+* @param {{ profile?: string; region: string; groupIds: string[]; verbose?: boolean }} params
+* @returns {SecurityGroup[]}
+*/
+function describeSecurityGroups(params) {
+	const { profile, region, groupIds, verbose } = params;
+	if (groupIds.length === 0) return [];
+	/** @type {SecurityGroup[]} */
+	const groups = (require_commands_aws_utils_exec_aws.runAws({
+		profile,
+		region,
+		args: [
+			"ec2",
+			"describe-security-groups",
+			"--group-ids",
+			...groupIds
+		],
+		verbose
+	}).SecurityGroups ?? []).map((raw) => ({
+		groupId: raw.GroupId,
+		groupName: raw.GroupName ?? "",
+		description: raw.Description ?? ""
+	}));
+	groups.sort((a, b) => a.groupName.localeCompare(b.groupName));
+	return groups;
+}
+/**
+* Load full details for a single security group.
+* @param {{ profile?: string; region: string; groupId: string; verbose?: boolean }} params
+* @returns {any | null}
+*/
+function getSecurityGroupDetails(params) {
+	const { profile, region, groupId, verbose } = params;
+	const securityGroups = require_commands_aws_utils_exec_aws.runAws({
+		profile,
+		region,
+		args: [
+			"ec2",
+			"describe-security-groups",
+			"--group-ids",
+			groupId
+		],
+		verbose
+	}).SecurityGroups ?? [];
+	if (securityGroups.length === 0) return null;
+	return securityGroups[0];
+}
+/**
+* @param {string} cidrIp
+* @returns {boolean}
+*/
+function isSingleHostCidr(cidrIp) {
+	return cidrIp.endsWith("/32") && cidrIp !== "0.0.0.0/0";
+}
+/**
+* @param {any} permission
+* @returns {boolean}
+*/
+function portAllowsSsh(permission) {
+	const protocol = permission.IpProtocol;
+	if (protocol !== "tcp" && protocol !== "6") return false;
+	const fromPort = permission.FromPort;
+	const toPort = permission.ToPort;
+	if (fromPort === void 0 && toPort === void 0) return true;
+	if (fromPort === void 0 || toPort === void 0) return false;
+	return fromPort <= 22 && 22 <= toPort;
+}
+/**
+* Extract single-host SSH ingress rules (port 22, /32) from a security group.
+* @param {any} securityGroup
+* @returns {SshIngressRule[]}
+*/
+function listSshIngressRules(securityGroup) {
+	/** @type {SshIngressRule[]} */
+	const rules = [];
+	for (const permission of securityGroup.IpPermissions ?? []) {
+		if (!portAllowsSsh(permission)) continue;
+		const fromPort = permission.FromPort ?? 22;
+		const toPort = permission.ToPort ?? 22;
+		const ipProtocol = permission.IpProtocol ?? "tcp";
+		for (const ipRange of permission.IpRanges ?? []) {
+			const cidrIp = ipRange.CidrIp;
+			if (!cidrIp || !isSingleHostCidr(cidrIp)) continue;
+			rules.push({
+				cidrIp,
+				description: ipRange.Description ?? "",
+				fromPort,
+				toPort,
+				ipProtocol
+			});
+		}
+	}
+	return rules;
+}
+/**
+* Derive a first name from the IAM ARN or profile (md-{name}-...).
+* @param {{ profile?: string; identity: { Arn?: string } }} params
+* @returns {string}
+*/
+function extractRoamingFirstName(params) {
+	const { profile, identity } = params;
+	const arn = identity.Arn ?? "";
+	const username = arn.includes("/") ? arn.split("/").pop() ?? "" : "";
+	for (const candidate of [username, profile ?? ""]) {
+		if (!candidate) continue;
+		const match = /^md-([^-]+)-/.exec(candidate);
+		if (match && match[1]) return match[1].charAt(0).toUpperCase() + match[1].slice(1).toLowerCase();
+	}
+	return require_commands_aws_ec2_allow_ip_schema.DEFAULT_ROAMING_NAME;
+}
+/**
+* @param {string} firstName
+* @returns {string}
+*/
+function roamingRuleDescription(firstName) {
+	return `${firstName} Roaming`;
+}
+/**
+* Find an existing rule whose description matches the roaming rule name.
+* @param {SshIngressRule[]} sshRules
+* @param {string} ruleDescription
+* @returns {SshIngressRule | null}
+*/
+function resolveRoamingRule(sshRules, ruleDescription) {
+	const target = ruleDescription.toLowerCase();
+	for (const rule of sshRules) if (rule.description.trim().toLowerCase() === target) return rule;
+	return null;
+}
+/**
+* Find an existing rule that already allows the given CIDR.
+* @param {SshIngressRule[]} sshRules
+* @param {string} newCidr
+* @returns {SshIngressRule | null}
+*/
+function ruleAlreadyAllowsIp(sshRules, newCidr) {
+	for (const rule of sshRules) if (rule.cidrIp === newCidr) return rule;
+	return null;
+}
+/**
+* @param {{
+*   cidrIp: string;
+*   description: string;
+*   fromPort?: number;
+*   toPort?: number;
+*   ipProtocol?: string;
+* }} params
+* @returns {string} JSON string for the --ip-permissions argument
+*/
+function buildIpPermissions(params) {
+	const { cidrIp, description, fromPort = 22, toPort = 22, ipProtocol = "tcp" } = params;
+	return JSON.stringify([{
+		IpProtocol: ipProtocol,
+		FromPort: fromPort,
+		ToPort: toPort,
+		IpRanges: [{
+			CidrIp: cidrIp,
+			Description: description
+		}]
+	}]);
+}
+/**
+* Authorize a new SSH ingress rule.
+* @param {{
+*   profile?: string;
+*   region: string;
+*   groupId: string;
+*   cidrIp: string;
+*   description: string;
+*   fromPort?: number;
+*   toPort?: number;
+*   ipProtocol?: string;
+*   verbose?: boolean;
+* }} params
+*/
+function authorizeRule(params) {
+	const { profile, region, groupId, verbose, ...rule } = params;
+	require_commands_aws_utils_exec_aws.runAws({
+		profile,
+		region,
+		args: [
+			"ec2",
+			"authorize-security-group-ingress",
+			"--group-id",
+			groupId,
+			"--ip-permissions",
+			buildIpPermissions(rule)
+		],
+		expectJson: false,
+		verbose
+	});
+}
+/**
+* Revoke an existing SSH ingress rule.
+* @param {{
+*   profile?: string;
+*   region: string;
+*   groupId: string;
+*   rule: SshIngressRule;
+*   verbose?: boolean;
+* }} params
+*/
+function revokeRule(params) {
+	const { profile, region, groupId, rule, verbose } = params;
+	require_commands_aws_utils_exec_aws.runAws({
+		profile,
+		region,
+		args: [
+			"ec2",
+			"revoke-security-group-ingress",
+			"--group-id",
+			groupId,
+			"--ip-permissions",
+			buildIpPermissions({
+				cidrIp: rule.cidrIp,
+				description: rule.description,
+				fromPort: rule.fromPort,
+				toPort: rule.toPort,
+				ipProtocol: rule.ipProtocol
+			})
+		],
+		expectJson: false,
+		verbose
+	});
+}
+/**
+* @param {Ec2Instance} instance
+* @returns {string}
+*/
+function instanceLabel(instance) {
+	const publicIp = instance.publicIp || "no public IP";
+	const name = instance.name || "(no name)";
+	return `${instance.instanceId}  ${name}  ${instance.state}  ${instance.instanceType}  ${publicIp}`;
+}
+/**
+* @param {SecurityGroup} group
+* @returns {string}
+*/
+function securityGroupLabel(group) {
+	return `${group.groupId}  ${group.groupName}  ${group.description}`;
+}
+/**
+* @param {SshIngressRule} rule
+* @returns {string}
+*/
+function sshRuleLabel(rule) {
+	const description = rule.description || "(no description)";
+	return `${rule.cidrIp}  ${description}`;
+}
+/**
+* Print single-host SSH rules using the given logger.
+* @param {SshIngressRule[]} sshRules
+* @param {(message: string) => void} [log]
+*/
+function printSshRules(sshRules, log = console.log) {
+	if (sshRules.length === 0) {
+		log("  (no single-host SSH rules on port 22)");
+		return;
+	}
+	for (const rule of sshRules) log(`  - ${sshRuleLabel(rule)}`);
+}
+//#endregion
+exports.authorizeRule = authorizeRule;
+exports.describeSecurityGroups = describeSecurityGroups;
+exports.extractRoamingFirstName = extractRoamingFirstName;
+exports.getCurrentPublicIp = getCurrentPublicIp;
+exports.getSecurityGroupDetails = getSecurityGroupDetails;
+exports.instanceLabel = instanceLabel;
+exports.listEnabledRegions = listEnabledRegions;
+exports.listInstances = listInstances;
+exports.listSshIngressRules = listSshIngressRules;
+exports.printSshRules = printSshRules;
+exports.resolveRoamingRule = resolveRoamingRule;
+exports.revokeRule = revokeRule;
+exports.roamingRuleDescription = roamingRuleDescription;
+exports.ruleAlreadyAllowsIp = ruleAlreadyAllowsIp;
+exports.securityGroupLabel = securityGroupLabel;
+exports.sshRuleLabel = sshRuleLabel;

package/cjs/commands/aws/ec2/allow-ip/utils.d.ts

@@ -0,0 +1,189 @@
+/**
+ * @typedef {Object} Ec2Instance
+ * @property {string} instanceId
+ * @property {string} name
+ * @property {string} state
+ * @property {string} instanceType
+ * @property {string | null} publicIp
+ * @property {string[]} securityGroupIds
+ */
+/**
+ * @typedef {Object} SecurityGroup
+ * @property {string} groupId
+ * @property {string} groupName
+ * @property {string} description
+ */
+/**
+ * @typedef {Object} SshIngressRule
+ * @property {string} cidrIp
+ * @property {string} description
+ * @property {number} fromPort
+ * @property {number} toPort
+ * @property {string} ipProtocol
+ */
+/**
+ * Determine the caller's current public IPv4 address.
+ * @returns {Promise<string>}
+ */
+export function getCurrentPublicIp(): Promise<string>;
+/**
+ * List regions that are opted-in / enabled for the profile.
+ * @param {{ profile?: string; region: string; verbose?: boolean }} params
+ * @returns {string[]}
+ */
+export function listEnabledRegions(params: {
+    profile?: string;
+    region: string;
+    verbose?: boolean;
+}): string[];
+/**
+ * List non-terminated EC2 instances in a region.
+ * @param {{ profile?: string; region: string; verbose?: boolean }} params
+ * @returns {Ec2Instance[]}
+ */
+export function listInstances(params: {
+    profile?: string;
+    region: string;
+    verbose?: boolean;
+}): Ec2Instance[];
+/**
+ * Describe security groups by id.
+ * @param {{ profile?: string; region: string; groupIds: string[]; verbose?: boolean }} params
+ * @returns {SecurityGroup[]}
+ */
+export function describeSecurityGroups(params: {
+    profile?: string;
+    region: string;
+    groupIds: string[];
+    verbose?: boolean;
+}): SecurityGroup[];
+/**
+ * Load full details for a single security group.
+ * @param {{ profile?: string; region: string; groupId: string; verbose?: boolean }} params
+ * @returns {any | null}
+ */
+export function getSecurityGroupDetails(params: {
+    profile?: string;
+    region: string;
+    groupId: string;
+    verbose?: boolean;
+}): any | null;
+/**
+ * Extract single-host SSH ingress rules (port 22, /32) from a security group.
+ * @param {any} securityGroup
+ * @returns {SshIngressRule[]}
+ */
+export function listSshIngressRules(securityGroup: any): SshIngressRule[];
+/**
+ * Derive a first name from the IAM ARN or profile (md-{name}-...).
+ * @param {{ profile?: string; identity: { Arn?: string } }} params
+ * @returns {string}
+ */
+export function extractRoamingFirstName(params: {
+    profile?: string;
+    identity: {
+        Arn?: string;
+    };
+}): string;
+/**
+ * @param {string} firstName
+ * @returns {string}
+ */
+export function roamingRuleDescription(firstName: string): string;
+/**
+ * Find an existing rule whose description matches the roaming rule name.
+ * @param {SshIngressRule[]} sshRules
+ * @param {string} ruleDescription
+ * @returns {SshIngressRule | null}
+ */
+export function resolveRoamingRule(sshRules: SshIngressRule[], ruleDescription: string): SshIngressRule | null;
+/**
+ * Find an existing rule that already allows the given CIDR.
+ * @param {SshIngressRule[]} sshRules
+ * @param {string} newCidr
+ * @returns {SshIngressRule | null}
+ */
+export function ruleAlreadyAllowsIp(sshRules: SshIngressRule[], newCidr: string): SshIngressRule | null;
+/**
+ * Authorize a new SSH ingress rule.
+ * @param {{
+ *   profile?: string;
+ *   region: string;
+ *   groupId: string;
+ *   cidrIp: string;
+ *   description: string;
+ *   fromPort?: number;
+ *   toPort?: number;
+ *   ipProtocol?: string;
+ *   verbose?: boolean;
+ * }} params
+ */
+export function authorizeRule(params: {
+    profile?: string;
+    region: string;
+    groupId: string;
+    cidrIp: string;
+    description: string;
+    fromPort?: number;
+    toPort?: number;
+    ipProtocol?: string;
+    verbose?: boolean;
+}): void;
+/**
+ * Revoke an existing SSH ingress rule.
+ * @param {{
+ *   profile?: string;
+ *   region: string;
+ *   groupId: string;
+ *   rule: SshIngressRule;
+ *   verbose?: boolean;
+ * }} params
+ */
+export function revokeRule(params: {
+    profile?: string;
+    region: string;
+    groupId: string;
+    rule: SshIngressRule;
+    verbose?: boolean;
+}): void;
+/**
+ * @param {Ec2Instance} instance
+ * @returns {string}
+ */
+export function instanceLabel(instance: Ec2Instance): string;
+/**
+ * @param {SecurityGroup} group
+ * @returns {string}
+ */
+export function securityGroupLabel(group: SecurityGroup): string;
+/**
+ * @param {SshIngressRule} rule
+ * @returns {string}
+ */
+export function sshRuleLabel(rule: SshIngressRule): string;
+/**
+ * Print single-host SSH rules using the given logger.
+ * @param {SshIngressRule[]} sshRules
+ * @param {(message: string) => void} [log]
+ */
+export function printSshRules(sshRules: SshIngressRule[], log?: (message: string) => void): void;
+export type Ec2Instance = {
+    instanceId: string;
+    name: string;
+    state: string;
+    instanceType: string;
+    publicIp: string | null;
+    securityGroupIds: string[];
+};
+export type SecurityGroup = {
+    groupId: string;
+    groupName: string;
+    description: string;
+};
+export type SshIngressRule = {
+    cidrIp: string;
+    description: string;
+    fromPort: number;
+    toPort: number;
+    ipProtocol: string;
+};

package/cjs/commands/aws/iam/admin-group.cjs

@@ -0,0 +1,111 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_rolldown_runtime = require("../../../__chunks/VH7oDXx4.cjs");
+const require_commands_aws_utils_exec_aws = require("../utils/exec-aws.cjs");
+let chalk = require("chalk");
+chalk = require_rolldown_runtime.__toESM(chalk, 1);
+let child_process = require("child_process");
+//#region src/commands/aws/iam/admin-group.js
+/**
+* The IAM group that grants break-glass admin access and should normally be empty.
+*/
+const ADMIN_GROUP_NAME = "acl-admin-do-not-use";
+const VAULT_DURATION = process.env.AWS_VAULT_DURATION ?? "15m";
+/**
+* A function bound to a profile's working credential mode (direct or aws-vault).
+* @typedef {(args: string[], options?: { expectJson?: boolean }) => any} ProfileRunner
+*/
+/**
+* List aws-vault profiles that have stored credentials.
+* @returns {string[]}
+*/
+function listVaultProfiles() {
+	const result = (0, child_process.spawnSync)("aws-vault", ["list", "--credentials"], { encoding: "utf-8" });
+	if (result.status !== 0) return [];
+	return (result.stdout ?? "").split("\n").map((line) => line.trim()).filter((line) => line.length > 0);
+}
+/**
+* Resolve which profiles to scan for admin-group commands.
+* Uses `--profile`, then `AWS_PROFILE`, for a single profile unless `--all` is set.
+* @param {{ profile?: string; all?: boolean }} params
+* @returns {string[]}
+*/
+function resolveAdminScanProfiles({ profile, all = false }) {
+	const targetProfile = profile ?? process.env.AWS_PROFILE;
+	if (!all && targetProfile) return [targetProfile];
+	const profiles = listVaultProfiles();
+	if (profiles.length === 0) throw new Error("No aws-vault profiles with credentials found.");
+	return profiles;
+}
+/**
+* @param {{ Users?: Array<{ UserName: string }> }} group
+* @returns {string[]}
+*/
+function groupUserNames(group) {
+	return (group.Users ?? []).map((user) => user.UserName);
+}
+/**
+* Resolve a working credential runner for a profile and read the admin group.
+* Tries stored credentials first, then falls back to `aws-vault exec`.
+* The returned `run` reuses whichever mode worked, so callers can perform
+* follow-up mutations (e.g. remove-user-from-group) with the same credentials.
+* @param {{ profile: string; verbose?: boolean }} params
+* @returns {{ accountId: string; arn: string; users: string[]; run: ProfileRunner } | null} Null when the profile is skipped
+*/
+function resolveProfileScan(params) {
+	const { profile, verbose = false } = params;
+	const idArgs = ["sts", "get-caller-identity"];
+	const groupArgs = [
+		"iam",
+		"get-group",
+		"--group-name",
+		ADMIN_GROUP_NAME
+	];
+	/** @type {ProfileRunner} */
+	const directRun = (args, options = {}) => require_commands_aws_utils_exec_aws.runAws({
+		profile,
+		args,
+		expectJson: options.expectJson ?? true,
+		verbose
+	});
+	/** @type {ProfileRunner} */
+	const vaultRun = (args, options = {}) => require_commands_aws_utils_exec_aws.runAwsVault({
+		profile,
+		args,
+		duration: VAULT_DURATION,
+		expectJson: options.expectJson ?? true,
+		verbose
+	});
+	try {
+		const identity = directRun(idArgs);
+		const group = directRun(groupArgs);
+		return {
+			accountId: identity.Account,
+			arn: identity.Arn,
+			users: groupUserNames(group),
+			run: directRun
+		};
+	} catch (directError) {
+		try {
+			const identity = vaultRun(idArgs);
+			const group = vaultRun(groupArgs);
+			return {
+				accountId: identity.Account,
+				arn: identity.Arn,
+				users: groupUserNames(group),
+				run: vaultRun
+			};
+		} catch {
+			if (verbose) {
+				const reason = directError instanceof Error ? directError.message.split("\n")[0] ?? "" : String(directError);
+				console.log(chalk.default.dim(`skip   ${profile} — ${reason}`));
+			}
+			return null;
+		}
+	}
+}
+//#endregion
+exports.ADMIN_GROUP_NAME = ADMIN_GROUP_NAME;
+exports.groupUserNames = groupUserNames;
+exports.listVaultProfiles = listVaultProfiles;
+exports.resolveAdminScanProfiles = resolveAdminScanProfiles;
+exports.resolveProfileScan = resolveProfileScan;