@mtndev/cli 2.0.0 → 2.0.1

package/esm/commands/aws/iam/users/utils.js

@@ -1,30 +1,440 @@
-import {
-  buildUsername,
-  createCliAccessKey,
-  createUsersInteractive,
-  ensureAclGroupsExist,
-  ensureUser,
-  ensureUserInGroup,
-  inferAccountName,
-  isValidSlug,
-  normalizeIdentifier,
-  normalizeSlug,
-  parseMdUsername,
-  roleToGroup
-} from "../../../../__chunks/3QLI5BDL.js";
-import "../../../../__chunks/FNXUONAV.js";
-import "../../../../__chunks/ZHKVJO2U.js";
-export {
-  buildUsername,
-  createCliAccessKey,
-  createUsersInteractive,
-  ensureAclGroupsExist,
-  ensureUser,
-  ensureUserInGroup,
-  inferAccountName,
-  isValidSlug,
-  normalizeIdentifier,
-  normalizeSlug,
-  parseMdUsername,
-  roleToGroup
-};
+import { prompt, promptYesNo } from "../../utils/tty.js";
+import { runAws } from "../../utils/exec-aws.js";
+import chalk from "chalk";
+//#region src/commands/aws/iam/users/utils.js
+const KNOWN_ROLES = [
+	"read-only",
+	"iam-admin",
+	"power-user"
+];
+const REQUIRED_ACL_GROUPS = [
+	"acl-read-only",
+	"acl-iam-full-access",
+	"acl-power-users"
+];
+/**
+* Map a user role to its ACL group.
+* @param {string} role
+* @returns {string}
+*/
+function roleToGroup(role) {
+	switch (role) {
+		case "read-only": return "acl-read-only";
+		case "iam-admin": return "acl-iam-full-access";
+		case "power-user": return "acl-power-users";
+		default: throw new Error(`Unknown role: ${role}`);
+	}
+}
+/**
+* Lowercase and hyphenate a raw value into a slug.
+* @param {string} value
+* @returns {string}
+*/
+function normalizeSlug(value) {
+	return value.toLowerCase().replace(/ /g, "-");
+}
+/**
+* @param {string} value
+* @returns {boolean}
+*/
+function isValidSlug(value) {
+	return /^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/.test(value);
+}
+/**
+* Build the canonical IAM username.
+* @param {{ identifier: string; accountName: string; role: string }} params
+* @returns {string}
+*/
+function buildUsername(params) {
+	const { identifier, accountName, role } = params;
+	return `md-${identifier}-${accountName}-${role}`;
+}
+/**
+* Strip md- prefix, role suffix, and account suffix from a raw identifier.
+* @param {{ raw: string; accountName: string; role: string }} params
+* @returns {string}
+*/
+function normalizeIdentifier(params) {
+	const { raw, accountName, role } = params;
+	let identifier = normalizeSlug(raw);
+	if (identifier.startsWith("md-")) identifier = identifier.slice(3);
+	if (identifier.endsWith(`-${role}`)) identifier = identifier.slice(0, -(role.length + 1));
+	else for (const knownRole of KNOWN_ROLES) if (identifier.endsWith(`-${knownRole}`)) {
+		identifier = identifier.slice(0, -(knownRole.length + 1));
+		break;
+	}
+	if (identifier.endsWith(`-${accountName}`)) identifier = identifier.slice(0, -(accountName.length + 1));
+	return identifier;
+}
+/**
+* Parse an md-{identifier}-{account}-{role} username into parts.
+* Identifier is the first segment; account is everything between it and the role
+* (so multi-segment account slugs still work).
+* @param {string} name - Profile name or IAM user name
+* @returns {{ identifier: string; accountName: string; role: string } | null}
+*/
+function parseMdUsername(name) {
+	let value = normalizeSlug(name);
+	if (!value.startsWith("md-")) return null;
+	value = value.slice(3);
+	const rolesByLength = [...KNOWN_ROLES].sort((a, b) => b.length - a.length);
+	/** @type {string | null} */
+	let role = null;
+	for (const knownRole of rolesByLength) if (value.endsWith(`-${knownRole}`)) {
+		role = knownRole;
+		value = value.slice(0, -(knownRole.length + 1));
+		break;
+	}
+	if (!role) return null;
+	const dash = value.indexOf("-");
+	if (dash <= 0 || dash === value.length - 1) return null;
+	const identifier = value.slice(0, dash);
+	const accountName = value.slice(dash + 1);
+	if (!isValidSlug(identifier) || !isValidSlug(accountName)) return null;
+	return {
+		identifier,
+		accountName,
+		role
+	};
+}
+/**
+* Infer the AWS account slug from the caller IAM user / profile name.
+* Prefers the ARN username, then the profile string.
+* @param {{
+*   profile?: string;
+*   identity?: { Arn?: string };
+* }} params
+* @returns {string | null}
+*/
+function inferAccountName(params) {
+	const { profile, identity } = params;
+	const arn = identity?.Arn ?? "";
+	const username = arn.includes("/") ? arn.split("/").pop() ?? "" : "";
+	for (const candidate of [username, profile ?? ""]) {
+		if (!candidate) continue;
+		const parsed = parseMdUsername(candidate);
+		if (parsed) return parsed.accountName;
+	}
+	return null;
+}
+/**
+* @param {{ username: string; profile?: string; verbose?: boolean }} params
+* @returns {boolean}
+*/
+function userExists(params) {
+	const { username, profile, verbose } = params;
+	try {
+		runAws({
+			profile,
+			args: [
+				"iam",
+				"get-user",
+				"--user-name",
+				username
+			],
+			verbose
+		});
+		return true;
+	} catch {
+		return false;
+	}
+}
+/**
+* Create the IAM user if it does not exist.
+* @param {{ username: string; profile?: string; verbose?: boolean }} params
+*/
+function ensureUser(params) {
+	const { username, profile, verbose } = params;
+	if (userExists({
+		username,
+		profile,
+		verbose
+	})) {
+		console.log(`  User exists: ${username}`);
+		return;
+	}
+	console.log(`  Create user: ${username}`);
+	runAws({
+		profile,
+		args: [
+			"iam",
+			"create-user",
+			"--user-name",
+			username,
+			"--path",
+			"/"
+		],
+		verbose
+	});
+}
+/**
+* Add the user to the group if not already a member.
+* @param {{ username: string; group: string; profile?: string; verbose?: boolean }} params
+*/
+function ensureUserInGroup(params) {
+	const { username, group, profile, verbose } = params;
+	if (runAws({
+		profile,
+		args: [
+			"iam",
+			"get-group",
+			"--group-name",
+			group,
+			"--query",
+			`Users[?UserName=='${username}'].UserName`,
+			"--output",
+			"text"
+		],
+		expectJson: false,
+		verbose
+	})) {
+		console.log(`  Already in group: ${group}`);
+		return;
+	}
+	console.log(`  Add to group: ${group}`);
+	runAws({
+		profile,
+		args: [
+			"iam",
+			"add-user-to-group",
+			"--user-name",
+			username,
+			"--group-name",
+			group
+		],
+		expectJson: false,
+		verbose
+	});
+}
+/**
+* Create a CLI access key for the user and print a one-line setup command.
+* @param {{ username: string; profile?: string; verbose?: boolean }} params
+* @returns {boolean} False when the user already has the maximum number of keys
+*/
+function createCliAccessKey(params) {
+	const { username, profile, verbose } = params;
+	const keyCountRaw = runAws({
+		profile,
+		args: [
+			"iam",
+			"list-access-keys",
+			"--user-name",
+			username,
+			"--query",
+			"length(AccessKeyMetadata)",
+			"--output",
+			"text"
+		],
+		expectJson: false,
+		verbose
+	});
+	if ((Number.parseInt(keyCountRaw, 10) || 0) >= 2) {
+		console.log(chalk.yellow(`  WARNING: ${username} already has 2 access keys (AWS max).`));
+		console.log(chalk.yellow("  Delete an existing key before creating a new one."));
+		return false;
+	}
+	const [accessKeyId, secretAccessKey] = runAws({
+		profile,
+		args: [
+			"iam",
+			"create-access-key",
+			"--user-name",
+			username,
+			"--query",
+			"AccessKey.[AccessKeyId,SecretAccessKey]",
+			"--output",
+			"text"
+		],
+		expectJson: false,
+		verbose
+	}).split(/\s+/);
+	if (!accessKeyId || !secretAccessKey) throw new Error("Failed to parse the newly created access key");
+	const setupCmd = ` export AWS_ACCESS_KEY_ID='${accessKeyId}' AWS_SECRET_ACCESS_KEY='${secretAccessKey}' && aws-vault add ${username} --env --add-config && aws configure set aws_access_key_id "$AWS_ACCESS_KEY_ID" --profile ${username} && aws configure set aws_secret_access_key "$AWS_SECRET_ACCESS_KEY" --profile ${username} && aws configure set region us-east-1 --profile ${username}`;
+	console.log("");
+	console.log(`  CLI credentials for ${username} (secret shown once — copy now):`);
+	console.log("  ────────────────────────────────────────────────────────────────");
+	console.log("  YOU MUST run the command below with a LEADING SPACE so it is not saved");
+	console.log("  to shell history — same idea as:  TEST=\"a\" && echo $TEST");
+	console.log("");
+	console.log(setupCmd);
+	console.log("  ────────────────────────────────────────────────────────────────");
+	console.log("");
+	return true;
+}
+/**
+* Verify the required ACL groups exist before creating users.
+* @param {{ profile?: string; verbose?: boolean }} params
+* @returns {boolean}
+*/
+function ensureAclGroupsExist(params) {
+	const { profile, verbose } = params;
+	const missing = REQUIRED_ACL_GROUPS.filter((group) => {
+		try {
+			runAws({
+				profile,
+				args: [
+					"iam",
+					"get-group",
+					"--group-name",
+					group
+				],
+				verbose
+			});
+			return false;
+		} catch {
+			return true;
+		}
+	});
+	if (missing.length > 0) {
+		missing.forEach((group) => console.log(`  Missing group: ${group}`));
+		console.log("");
+		console.log("  Run `mtn aws iam setup-acl` first to create ACL groups and policies.");
+		return false;
+	}
+	return true;
+}
+/**
+* @param {{ accountName?: string; inferredAccountName?: string | null }} params
+* @returns {Promise<string>}
+*/
+async function promptAccountName(params) {
+	const { accountName, inferredAccountName } = params;
+	if (accountName) {
+		const slug = normalizeSlug(accountName);
+		if (isValidSlug(slug)) {
+			console.log(`  Account name: ${slug}`);
+			return slug;
+		}
+		console.log("  Invalid account name option — falling back to prompt.");
+	}
+	const defaultSlug = inferredAccountName && isValidSlug(normalizeSlug(inferredAccountName)) ? normalizeSlug(inferredAccountName) : null;
+	for (;;) {
+		const hint = defaultSlug ? ` [default: ${defaultSlug}]` : " (e.g. vincent)";
+		const raw = await prompt(`  AWS account name${hint} — used in md-{identifier}-{account}-{role}: `);
+		if (raw === "" && defaultSlug) {
+			console.log(`  → account name: ${defaultSlug}`);
+			return defaultSlug;
+		}
+		const slug = normalizeSlug(raw);
+		if (isValidSlug(slug)) {
+			if (raw !== slug) console.log(`  → account name: ${slug}`);
+			return slug;
+		}
+		console.log("  Invalid account name — use lowercase letters, numbers, and hyphens" + (defaultSlug ? ", or press Enter to accept the default." : "."));
+	}
+}
+/**
+* @returns {Promise<string>}
+*/
+async function promptRole() {
+	for (;;) {
+		console.log("  Role (username will be md-{identifier}-{account}-{role}):");
+		console.log("    1) read-only   → acl-read-only");
+		console.log("    2) iam-admin   → acl-iam-full-access");
+		console.log("    3) power-user  → acl-power-users");
+		switch (await prompt("  Choice [1-3]: ")) {
+			case "1":
+			case "read-only": return "read-only";
+			case "2":
+			case "iam-admin": return "iam-admin";
+			case "3":
+			case "power-user": return "power-user";
+			default: console.log("  Invalid choice — enter 1, 2, 3, or the role name.");
+		}
+	}
+}
+/**
+* @param {{ accountName: string; role: string }} params
+* @returns {Promise<string>}
+*/
+async function promptIdentifier(params) {
+	const { accountName, role } = params;
+	const exampleUser = buildUsername({
+		identifier: "declan",
+		accountName,
+		role
+	});
+	for (;;) {
+		const raw = await prompt(`  Identifier (e.g. declan, or full ${exampleUser}): `);
+		const lowerRaw = normalizeSlug(raw);
+		const identifier = normalizeIdentifier({
+			raw,
+			accountName,
+			role
+		});
+		if (isValidSlug(identifier)) {
+			if (lowerRaw !== identifier) console.log(`  → parsed identifier: ${identifier}`);
+			return identifier;
+		}
+		console.log("  Invalid identifier — use lowercase letters, numbers, and hyphens.");
+		console.log("  Tip: enter just the short name (e.g. declan).");
+	}
+}
+/**
+* Interactively create IAM users, assign ACL groups, and print CLI credentials.
+* @param {{
+*   accountName?: string;
+*   profile?: string;
+*   identity?: { Arn?: string };
+*   verbose?: boolean;
+* }} params
+*/
+async function createUsersInteractive(params) {
+	const { accountName: accountNameOption, profile, identity, verbose } = params;
+	if (!ensureAclGroupsExist({
+		profile,
+		verbose
+	})) return;
+	console.log("");
+	const accountName = await promptAccountName({
+		accountName: accountNameOption,
+		inferredAccountName: inferAccountName({
+			profile,
+			identity
+		})
+	});
+	console.log("");
+	while (await promptYesNo({
+		message: "  Create another user?",
+		defaultYes: false
+	})) {
+		console.log("");
+		const role = await promptRole();
+		const username = buildUsername({
+			identifier: await promptIdentifier({
+				accountName,
+				role
+			}),
+			accountName,
+			role
+		});
+		const group = roleToGroup(role);
+		console.log("");
+		console.log(`  → user: ${username}`);
+		console.log(`  → group: ${group}`);
+		console.log("");
+		ensureUser({
+			username,
+			profile,
+			verbose
+		});
+		ensureUserInGroup({
+			username,
+			group,
+			profile,
+			verbose
+		});
+		try {
+			createCliAccessKey({
+				username,
+				profile,
+				verbose
+			});
+		} catch (error) {
+			console.log(chalk.yellow(`  Could not create access key: ${error instanceof Error ? error.message : String(error)}`));
+		}
+		console.log("");
+	}
+}
+//#endregion
+export { buildUsername, createCliAccessKey, createUsersInteractive, ensureAclGroupsExist, ensureUser, ensureUserInGroup, inferAccountName, isValidSlug, normalizeIdentifier, normalizeSlug, parseMdUsername, roleToGroup };