@mtndev/cli 1.1.0 → 2.0.1

package/cjs/commands/aws/iam/users/utils.cjs

@@ -0,0 +1,454 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_rolldown_runtime = require("../../../../__chunks/VH7oDXx4.cjs");
+const require_commands_aws_utils_tty = require("../../utils/tty.cjs");
+const require_commands_aws_utils_exec_aws = require("../../utils/exec-aws.cjs");
+let chalk = require("chalk");
+chalk = require_rolldown_runtime.__toESM(chalk, 1);
+//#region src/commands/aws/iam/users/utils.js
+const KNOWN_ROLES = [
+	"read-only",
+	"iam-admin",
+	"power-user"
+];
+const REQUIRED_ACL_GROUPS = [
+	"acl-read-only",
+	"acl-iam-full-access",
+	"acl-power-users"
+];
+/**
+* Map a user role to its ACL group.
+* @param {string} role
+* @returns {string}
+*/
+function roleToGroup(role) {
+	switch (role) {
+		case "read-only": return "acl-read-only";
+		case "iam-admin": return "acl-iam-full-access";
+		case "power-user": return "acl-power-users";
+		default: throw new Error(`Unknown role: ${role}`);
+	}
+}
+/**
+* Lowercase and hyphenate a raw value into a slug.
+* @param {string} value
+* @returns {string}
+*/
+function normalizeSlug(value) {
+	return value.toLowerCase().replace(/ /g, "-");
+}
+/**
+* @param {string} value
+* @returns {boolean}
+*/
+function isValidSlug(value) {
+	return /^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/.test(value);
+}
+/**
+* Build the canonical IAM username.
+* @param {{ identifier: string; accountName: string; role: string }} params
+* @returns {string}
+*/
+function buildUsername(params) {
+	const { identifier, accountName, role } = params;
+	return `md-${identifier}-${accountName}-${role}`;
+}
+/**
+* Strip md- prefix, role suffix, and account suffix from a raw identifier.
+* @param {{ raw: string; accountName: string; role: string }} params
+* @returns {string}
+*/
+function normalizeIdentifier(params) {
+	const { raw, accountName, role } = params;
+	let identifier = normalizeSlug(raw);
+	if (identifier.startsWith("md-")) identifier = identifier.slice(3);
+	if (identifier.endsWith(`-${role}`)) identifier = identifier.slice(0, -(role.length + 1));
+	else for (const knownRole of KNOWN_ROLES) if (identifier.endsWith(`-${knownRole}`)) {
+		identifier = identifier.slice(0, -(knownRole.length + 1));
+		break;
+	}
+	if (identifier.endsWith(`-${accountName}`)) identifier = identifier.slice(0, -(accountName.length + 1));
+	return identifier;
+}
+/**
+* Parse an md-{identifier}-{account}-{role} username into parts.
+* Identifier is the first segment; account is everything between it and the role
+* (so multi-segment account slugs still work).
+* @param {string} name - Profile name or IAM user name
+* @returns {{ identifier: string; accountName: string; role: string } | null}
+*/
+function parseMdUsername(name) {
+	let value = normalizeSlug(name);
+	if (!value.startsWith("md-")) return null;
+	value = value.slice(3);
+	const rolesByLength = [...KNOWN_ROLES].sort((a, b) => b.length - a.length);
+	/** @type {string | null} */
+	let role = null;
+	for (const knownRole of rolesByLength) if (value.endsWith(`-${knownRole}`)) {
+		role = knownRole;
+		value = value.slice(0, -(knownRole.length + 1));
+		break;
+	}
+	if (!role) return null;
+	const dash = value.indexOf("-");
+	if (dash <= 0 || dash === value.length - 1) return null;
+	const identifier = value.slice(0, dash);
+	const accountName = value.slice(dash + 1);
+	if (!isValidSlug(identifier) || !isValidSlug(accountName)) return null;
+	return {
+		identifier,
+		accountName,
+		role
+	};
+}
+/**
+* Infer the AWS account slug from the caller IAM user / profile name.
+* Prefers the ARN username, then the profile string.
+* @param {{
+*   profile?: string;
+*   identity?: { Arn?: string };
+* }} params
+* @returns {string | null}
+*/
+function inferAccountName(params) {
+	const { profile, identity } = params;
+	const arn = identity?.Arn ?? "";
+	const username = arn.includes("/") ? arn.split("/").pop() ?? "" : "";
+	for (const candidate of [username, profile ?? ""]) {
+		if (!candidate) continue;
+		const parsed = parseMdUsername(candidate);
+		if (parsed) return parsed.accountName;
+	}
+	return null;
+}
+/**
+* @param {{ username: string; profile?: string; verbose?: boolean }} params
+* @returns {boolean}
+*/
+function userExists(params) {
+	const { username, profile, verbose } = params;
+	try {
+		require_commands_aws_utils_exec_aws.runAws({
+			profile,
+			args: [
+				"iam",
+				"get-user",
+				"--user-name",
+				username
+			],
+			verbose
+		});
+		return true;
+	} catch {
+		return false;
+	}
+}
+/**
+* Create the IAM user if it does not exist.
+* @param {{ username: string; profile?: string; verbose?: boolean }} params
+*/
+function ensureUser(params) {
+	const { username, profile, verbose } = params;
+	if (userExists({
+		username,
+		profile,
+		verbose
+	})) {
+		console.log(`  User exists: ${username}`);
+		return;
+	}
+	console.log(`  Create user: ${username}`);
+	require_commands_aws_utils_exec_aws.runAws({
+		profile,
+		args: [
+			"iam",
+			"create-user",
+			"--user-name",
+			username,
+			"--path",
+			"/"
+		],
+		verbose
+	});
+}
+/**
+* Add the user to the group if not already a member.
+* @param {{ username: string; group: string; profile?: string; verbose?: boolean }} params
+*/
+function ensureUserInGroup(params) {
+	const { username, group, profile, verbose } = params;
+	if (require_commands_aws_utils_exec_aws.runAws({
+		profile,
+		args: [
+			"iam",
+			"get-group",
+			"--group-name",
+			group,
+			"--query",
+			`Users[?UserName=='${username}'].UserName`,
+			"--output",
+			"text"
+		],
+		expectJson: false,
+		verbose
+	})) {
+		console.log(`  Already in group: ${group}`);
+		return;
+	}
+	console.log(`  Add to group: ${group}`);
+	require_commands_aws_utils_exec_aws.runAws({
+		profile,
+		args: [
+			"iam",
+			"add-user-to-group",
+			"--user-name",
+			username,
+			"--group-name",
+			group
+		],
+		expectJson: false,
+		verbose
+	});
+}
+/**
+* Create a CLI access key for the user and print a one-line setup command.
+* @param {{ username: string; profile?: string; verbose?: boolean }} params
+* @returns {boolean} False when the user already has the maximum number of keys
+*/
+function createCliAccessKey(params) {
+	const { username, profile, verbose } = params;
+	const keyCountRaw = require_commands_aws_utils_exec_aws.runAws({
+		profile,
+		args: [
+			"iam",
+			"list-access-keys",
+			"--user-name",
+			username,
+			"--query",
+			"length(AccessKeyMetadata)",
+			"--output",
+			"text"
+		],
+		expectJson: false,
+		verbose
+	});
+	if ((Number.parseInt(keyCountRaw, 10) || 0) >= 2) {
+		console.log(chalk.default.yellow(`  WARNING: ${username} already has 2 access keys (AWS max).`));
+		console.log(chalk.default.yellow("  Delete an existing key before creating a new one."));
+		return false;
+	}
+	const [accessKeyId, secretAccessKey] = require_commands_aws_utils_exec_aws.runAws({
+		profile,
+		args: [
+			"iam",
+			"create-access-key",
+			"--user-name",
+			username,
+			"--query",
+			"AccessKey.[AccessKeyId,SecretAccessKey]",
+			"--output",
+			"text"
+		],
+		expectJson: false,
+		verbose
+	}).split(/\s+/);
+	if (!accessKeyId || !secretAccessKey) throw new Error("Failed to parse the newly created access key");
+	const setupCmd = ` export AWS_ACCESS_KEY_ID='${accessKeyId}' AWS_SECRET_ACCESS_KEY='${secretAccessKey}' && aws-vault add ${username} --env --add-config && aws configure set aws_access_key_id "$AWS_ACCESS_KEY_ID" --profile ${username} && aws configure set aws_secret_access_key "$AWS_SECRET_ACCESS_KEY" --profile ${username} && aws configure set region us-east-1 --profile ${username}`;
+	console.log("");
+	console.log(`  CLI credentials for ${username} (secret shown once — copy now):`);
+	console.log("  ────────────────────────────────────────────────────────────────");
+	console.log("  YOU MUST run the command below with a LEADING SPACE so it is not saved");
+	console.log("  to shell history — same idea as:  TEST=\"a\" && echo $TEST");
+	console.log("");
+	console.log(setupCmd);
+	console.log("  ────────────────────────────────────────────────────────────────");
+	console.log("");
+	return true;
+}
+/**
+* Verify the required ACL groups exist before creating users.
+* @param {{ profile?: string; verbose?: boolean }} params
+* @returns {boolean}
+*/
+function ensureAclGroupsExist(params) {
+	const { profile, verbose } = params;
+	const missing = REQUIRED_ACL_GROUPS.filter((group) => {
+		try {
+			require_commands_aws_utils_exec_aws.runAws({
+				profile,
+				args: [
+					"iam",
+					"get-group",
+					"--group-name",
+					group
+				],
+				verbose
+			});
+			return false;
+		} catch {
+			return true;
+		}
+	});
+	if (missing.length > 0) {
+		missing.forEach((group) => console.log(`  Missing group: ${group}`));
+		console.log("");
+		console.log("  Run `mtn aws iam setup-acl` first to create ACL groups and policies.");
+		return false;
+	}
+	return true;
+}
+/**
+* @param {{ accountName?: string; inferredAccountName?: string | null }} params
+* @returns {Promise<string>}
+*/
+async function promptAccountName(params) {
+	const { accountName, inferredAccountName } = params;
+	if (accountName) {
+		const slug = normalizeSlug(accountName);
+		if (isValidSlug(slug)) {
+			console.log(`  Account name: ${slug}`);
+			return slug;
+		}
+		console.log("  Invalid account name option — falling back to prompt.");
+	}
+	const defaultSlug = inferredAccountName && isValidSlug(normalizeSlug(inferredAccountName)) ? normalizeSlug(inferredAccountName) : null;
+	for (;;) {
+		const hint = defaultSlug ? ` [default: ${defaultSlug}]` : " (e.g. vincent)";
+		const raw = await require_commands_aws_utils_tty.prompt(`  AWS account name${hint} — used in md-{identifier}-{account}-{role}: `);
+		if (raw === "" && defaultSlug) {
+			console.log(`  → account name: ${defaultSlug}`);
+			return defaultSlug;
+		}
+		const slug = normalizeSlug(raw);
+		if (isValidSlug(slug)) {
+			if (raw !== slug) console.log(`  → account name: ${slug}`);
+			return slug;
+		}
+		console.log("  Invalid account name — use lowercase letters, numbers, and hyphens" + (defaultSlug ? ", or press Enter to accept the default." : "."));
+	}
+}
+/**
+* @returns {Promise<string>}
+*/
+async function promptRole() {
+	for (;;) {
+		console.log("  Role (username will be md-{identifier}-{account}-{role}):");
+		console.log("    1) read-only   → acl-read-only");
+		console.log("    2) iam-admin   → acl-iam-full-access");
+		console.log("    3) power-user  → acl-power-users");
+		switch (await require_commands_aws_utils_tty.prompt("  Choice [1-3]: ")) {
+			case "1":
+			case "read-only": return "read-only";
+			case "2":
+			case "iam-admin": return "iam-admin";
+			case "3":
+			case "power-user": return "power-user";
+			default: console.log("  Invalid choice — enter 1, 2, 3, or the role name.");
+		}
+	}
+}
+/**
+* @param {{ accountName: string; role: string }} params
+* @returns {Promise<string>}
+*/
+async function promptIdentifier(params) {
+	const { accountName, role } = params;
+	const exampleUser = buildUsername({
+		identifier: "declan",
+		accountName,
+		role
+	});
+	for (;;) {
+		const raw = await require_commands_aws_utils_tty.prompt(`  Identifier (e.g. declan, or full ${exampleUser}): `);
+		const lowerRaw = normalizeSlug(raw);
+		const identifier = normalizeIdentifier({
+			raw,
+			accountName,
+			role
+		});
+		if (isValidSlug(identifier)) {
+			if (lowerRaw !== identifier) console.log(`  → parsed identifier: ${identifier}`);
+			return identifier;
+		}
+		console.log("  Invalid identifier — use lowercase letters, numbers, and hyphens.");
+		console.log("  Tip: enter just the short name (e.g. declan).");
+	}
+}
+/**
+* Interactively create IAM users, assign ACL groups, and print CLI credentials.
+* @param {{
+*   accountName?: string;
+*   profile?: string;
+*   identity?: { Arn?: string };
+*   verbose?: boolean;
+* }} params
+*/
+async function createUsersInteractive(params) {
+	const { accountName: accountNameOption, profile, identity, verbose } = params;
+	if (!ensureAclGroupsExist({
+		profile,
+		verbose
+	})) return;
+	console.log("");
+	const accountName = await promptAccountName({
+		accountName: accountNameOption,
+		inferredAccountName: inferAccountName({
+			profile,
+			identity
+		})
+	});
+	console.log("");
+	while (await require_commands_aws_utils_tty.promptYesNo({
+		message: "  Create another user?",
+		defaultYes: false
+	})) {
+		console.log("");
+		const role = await promptRole();
+		const username = buildUsername({
+			identifier: await promptIdentifier({
+				accountName,
+				role
+			}),
+			accountName,
+			role
+		});
+		const group = roleToGroup(role);
+		console.log("");
+		console.log(`  → user: ${username}`);
+		console.log(`  → group: ${group}`);
+		console.log("");
+		ensureUser({
+			username,
+			profile,
+			verbose
+		});
+		ensureUserInGroup({
+			username,
+			group,
+			profile,
+			verbose
+		});
+		try {
+			createCliAccessKey({
+				username,
+				profile,
+				verbose
+			});
+		} catch (error) {
+			console.log(chalk.default.yellow(`  Could not create access key: ${error instanceof Error ? error.message : String(error)}`));
+		}
+		console.log("");
+	}
+}
+//#endregion
+exports.buildUsername = buildUsername;
+exports.createCliAccessKey = createCliAccessKey;
+exports.createUsersInteractive = createUsersInteractive;
+exports.ensureAclGroupsExist = ensureAclGroupsExist;
+exports.ensureUser = ensureUser;
+exports.ensureUserInGroup = ensureUserInGroup;
+exports.inferAccountName = inferAccountName;
+exports.isValidSlug = isValidSlug;
+exports.normalizeIdentifier = normalizeIdentifier;
+exports.normalizeSlug = normalizeSlug;
+exports.parseMdUsername = parseMdUsername;
+exports.roleToGroup = roleToGroup;

package/cjs/commands/aws/iam/users/utils.d.ts

@@ -0,0 +1,119 @@
+/**
+ * Map a user role to its ACL group.
+ * @param {string} role
+ * @returns {string}
+ */
+export function roleToGroup(role: string): string;
+/**
+ * Lowercase and hyphenate a raw value into a slug.
+ * @param {string} value
+ * @returns {string}
+ */
+export function normalizeSlug(value: string): string;
+/**
+ * @param {string} value
+ * @returns {boolean}
+ */
+export function isValidSlug(value: string): boolean;
+/**
+ * Build the canonical IAM username.
+ * @param {{ identifier: string; accountName: string; role: string }} params
+ * @returns {string}
+ */
+export function buildUsername(params: {
+    identifier: string;
+    accountName: string;
+    role: string;
+}): string;
+/**
+ * Strip md- prefix, role suffix, and account suffix from a raw identifier.
+ * @param {{ raw: string; accountName: string; role: string }} params
+ * @returns {string}
+ */
+export function normalizeIdentifier(params: {
+    raw: string;
+    accountName: string;
+    role: string;
+}): string;
+/**
+ * Parse an md-{identifier}-{account}-{role} username into parts.
+ * Identifier is the first segment; account is everything between it and the role
+ * (so multi-segment account slugs still work).
+ * @param {string} name - Profile name or IAM user name
+ * @returns {{ identifier: string; accountName: string; role: string } | null}
+ */
+export function parseMdUsername(name: string): {
+    identifier: string;
+    accountName: string;
+    role: string;
+} | null;
+/**
+ * Infer the AWS account slug from the caller IAM user / profile name.
+ * Prefers the ARN username, then the profile string.
+ * @param {{
+ *   profile?: string;
+ *   identity?: { Arn?: string };
+ * }} params
+ * @returns {string | null}
+ */
+export function inferAccountName(params: {
+    profile?: string;
+    identity?: {
+        Arn?: string;
+    };
+}): string | null;
+/**
+ * Create the IAM user if it does not exist.
+ * @param {{ username: string; profile?: string; verbose?: boolean }} params
+ */
+export function ensureUser(params: {
+    username: string;
+    profile?: string;
+    verbose?: boolean;
+}): void;
+/**
+ * Add the user to the group if not already a member.
+ * @param {{ username: string; group: string; profile?: string; verbose?: boolean }} params
+ */
+export function ensureUserInGroup(params: {
+    username: string;
+    group: string;
+    profile?: string;
+    verbose?: boolean;
+}): void;
+/**
+ * Create a CLI access key for the user and print a one-line setup command.
+ * @param {{ username: string; profile?: string; verbose?: boolean }} params
+ * @returns {boolean} False when the user already has the maximum number of keys
+ */
+export function createCliAccessKey(params: {
+    username: string;
+    profile?: string;
+    verbose?: boolean;
+}): boolean;
+/**
+ * Verify the required ACL groups exist before creating users.
+ * @param {{ profile?: string; verbose?: boolean }} params
+ * @returns {boolean}
+ */
+export function ensureAclGroupsExist(params: {
+    profile?: string;
+    verbose?: boolean;
+}): boolean;
+/**
+ * Interactively create IAM users, assign ACL groups, and print CLI credentials.
+ * @param {{
+ *   accountName?: string;
+ *   profile?: string;
+ *   identity?: { Arn?: string };
+ *   verbose?: boolean;
+ * }} params
+ */
+export function createUsersInteractive(params: {
+    accountName?: string;
+    profile?: string;
+    identity?: {
+        Arn?: string;
+    };
+    verbose?: boolean;
+}): Promise<void>;