@nuvlore/extension-bds 0.1.1 → 0.1.2

package/vendor/extension-workday-infra-access/tools/workday_public_cloud_kubernetes_read.mjs

@@ -1,297 +0,0 @@
-export const description = "Run one read-only kubectl operation through the local Workday public-cloud SPC kubeconfig/session. This tool never mutates Kubernetes resources.";
-
-import { execFile } from "node:child_process";
-import { join } from "node:path";
-import { promisify } from "node:util";
-import { z } from "zod";
-import { defineReadOnlyTool, fail, ok } from "@nuvlore/extension-read-only-toolkit/devops-diagnostics";
-import { shellQuote } from "../src/workday-access-profiles.mjs";
-
-const execFileAsync = promisify(execFile);
-
-const DEFAULT_KUBECTL_BINARY = "/usr/local/bin/kubectl";
-const DEFAULT_KUBECONFIG_PATH = "$HOME/.kube/spc-config";
-const DEFAULT_NAMESPACE = "bds";
-const DEFAULT_TIMEOUT_MS = 30_000;
-const VALID_OPERATIONS = ["get", "describe", "auth-whoami", "auth-can-i"];
-const VALID_OUTPUTS = ["json", "yaml", "wide", "name"];
-const READONLY_RESOURCE_PATTERN = /^[A-Za-z0-9][A-Za-z0-9./-]{0,252}$/;
-const NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9_.-]{0,252}$/;
-const SELECTOR_PATTERN = /^[A-Za-z0-9_.:/-]+(=[A-Za-z0-9_.:/-]+)?(,[A-Za-z0-9_.:/-]+(=[A-Za-z0-9_.:/-]+)?)*$/;
-const READONLY_RESOURCES = new Set([
-  "app",
-  "apps",
-  "application",
-  "applications",
-  "componentrelease",
-  "componentreleases",
-  "componentrelease.component.workday.com",
-  "componentreleases.component.workday.com",
-  "configmap",
-  "configmaps",
-  "crd",
-  "crds",
-  "customresourcedefinition",
-  "customresourcedefinitions",
-  "deploy",
-  "deployment",
-  "deployments",
-  "endpoint",
-  "endpoints",
-  "event",
-  "events",
-  "helmrelease",
-  "helmreleases",
-  "helmrelease.helm.toolkit.fluxcd.io",
-  "helmreleases.helm.toolkit.fluxcd.io",
-  "hpa",
-  "ingress",
-  "ingresses",
-  "pod",
-  "pods",
-  "scaledobject",
-  "scaledobjects",
-  "service",
-  "services",
-  "svc",
-  "statefulset",
-  "statefulsets",
-  "sts",
-  "vpa"
-]);
-
-function normalizeText(value) {
-  return typeof value === "string" ? value.trim() : "";
-}
-
-function expandHome(value) {
-  const text = normalizeText(value);
-  if (text === "$HOME") return process.env.HOME || text;
-  if (text.startsWith("$HOME/")) return join(process.env.HOME || "$HOME", text.slice("$HOME/".length));
-  if (text === "~") return process.env.HOME || text;
-  if (text.startsWith("~/")) return join(process.env.HOME || "~", text.slice(2));
-  return text;
-}
-
-function validateReadonlyToken(value, pattern, label) {
-  const text = normalizeText(value);
-  if (!text) return "";
-  if (!pattern.test(text)) {
-    throw new Error(`${label} contains unsupported characters for a read-only kubectl execFile argument.`);
-  }
-  return text;
-}
-
-function validateResource(resource) {
-  const normalized = validateReadonlyToken(resource, READONLY_RESOURCE_PATTERN, "resource").toLowerCase();
-  if (!normalized) throw new Error("resource is required for kubectl get/describe/auth-can-i.");
-  if (!READONLY_RESOURCES.has(normalized)) {
-    throw new Error(`resource ${normalized} is not in the read-only Kubernetes resource allowlist.`);
-  }
-  return normalized;
-}
-
-function normalizeInput(input = {}) {
-  const operation = normalizeText(input.operation) || "get";
-  if (!VALID_OPERATIONS.includes(operation)) {
-    throw new Error(`operation must be one of ${VALID_OPERATIONS.join(", ")}.`);
-  }
-  const output = normalizeText(input.output) || "json";
-  if (!VALID_OUTPUTS.includes(output)) {
-    throw new Error(`output must be one of ${VALID_OUTPUTS.join(", ")}.`);
-  }
-  return {
-    operation,
-    cluster: validateReadonlyToken(input.cluster, NAME_PATTERN, "cluster"),
-    context: validateReadonlyToken(input.context, NAME_PATTERN, "context"),
-    namespace: validateReadonlyToken(input.namespace, NAME_PATTERN, "namespace") || DEFAULT_NAMESPACE,
-    resource: input.resource ? validateResource(input.resource) : "",
-    name: validateReadonlyToken(input.name, NAME_PATTERN, "name"),
-    output,
-    labelSelector: validateReadonlyToken(input.labelSelector, SELECTOR_PATTERN, "labelSelector"),
-    fieldSelector: validateReadonlyToken(input.fieldSelector, SELECTOR_PATTERN, "fieldSelector"),
-    allNamespaces: input.allNamespaces === true,
-    kubeconfigPath: normalizeText(input.kubeconfigPath) || DEFAULT_KUBECONFIG_PATH,
-    kubectlBinary: normalizeText(input.kubectlBinary) || DEFAULT_KUBECTL_BINARY,
-    timeoutMs: Number.isInteger(input.timeoutMs) ? Math.max(1000, input.timeoutMs) : DEFAULT_TIMEOUT_MS
-  };
-}
-
-function kubectlEnv() {
-  return {
-    ...process.env,
-    PATH: [
-      "/Users/boqiang.liang/bin",
-      "/usr/local/bin",
-      "/opt/homebrew/bin",
-      process.env.PATH || ""
-    ].filter(Boolean).join(":")
-  };
-}
-
-function baseKubectlArgs(input) {
-  const args = ["--kubeconfig", expandHome(input.kubeconfigPath)];
-  const context = input.context || input.cluster;
-  if (context) args.push("--context", context);
-  return args;
-}
-
-function kubectlArgs(input) {
-  const args = baseKubectlArgs(input);
-  if (input.operation === "auth-whoami") return [...args, "auth", "whoami"];
-  if (input.operation === "auth-can-i") {
-    return [
-      ...args,
-      "auth",
-      "can-i",
-      "get",
-      input.resource,
-      "-n",
-      input.namespace
-    ];
-  }
-
-  if (!input.resource) throw new Error("resource is required for kubectl get/describe.");
-  args.push(input.operation, input.resource);
-  if (input.name) args.push(input.name);
-  if (input.allNamespaces) {
-    args.push("-A");
-  } else {
-    args.push("-n", input.namespace);
-  }
-  if (input.operation === "get") {
-    args.push("-o", input.output);
-    if (input.labelSelector) args.push("-l", input.labelSelector);
-    if (input.fieldSelector) args.push("--field-selector", input.fieldSelector);
-  }
-  return args;
-}
-
-function commandString(command, args) {
-  return [command, ...args].map(shellQuote).join(" ");
-}
-
-function parseJsonIfRequested(input, stdout) {
-  if (input.operation !== "get" || input.output !== "json" || !normalizeText(stdout)) return undefined;
-  try {
-    return JSON.parse(stdout);
-  } catch (_error) {
-    return undefined;
-  }
-}
-
-async function publicCloudKubernetesRead(input, options = {}) {
-  const normalized = normalizeInput(input);
-  const args = kubectlArgs(normalized);
-  const execFileImpl = options.execFileImpl || execFileAsync;
-  const command = commandString(normalized.kubectlBinary, args);
-  try {
-    const result = await execFileImpl(normalized.kubectlBinary, args, {
-      env: kubectlEnv(),
-      maxBuffer: 20 * 1024 * 1024,
-      timeout: normalized.timeoutMs
-    });
-    const stdout = normalizeText(result.stdout);
-    return JSON.stringify({
-      mode: "public-cloud-kubernetes-read",
-      ok: true,
-      target: {
-        cluster: normalized.cluster,
-        context: normalized.context || normalized.cluster || "",
-        namespace: normalized.allNamespaces ? "" : normalized.namespace,
-        allNamespaces: normalized.allNamespaces,
-        operation: normalized.operation,
-        resource: normalized.resource,
-        name: normalized.name,
-        output: normalized.operation === "get" ? normalized.output : ""
-      },
-      command,
-      stdout,
-      stderr: normalizeText(result.stderr),
-      json: parseJsonIfRequested(normalized, stdout),
-      remoteWrite: "not_executed"
-    }, null, 2);
-  } catch (error) {
-    return JSON.stringify({
-      mode: "public-cloud-kubernetes-read",
-      ok: false,
-      target: {
-        cluster: normalized.cluster,
-        context: normalized.context || normalized.cluster || "",
-        namespace: normalized.allNamespaces ? "" : normalized.namespace,
-        allNamespaces: normalized.allNamespaces,
-        operation: normalized.operation,
-        resource: normalized.resource,
-        name: normalized.name,
-        output: normalized.operation === "get" ? normalized.output : ""
-      },
-      command,
-      stdout: normalizeText(error?.stdout),
-      stderr: normalizeText(error?.stderr || error?.message),
-      remoteWrite: "not_executed"
-    }, null, 2);
-  }
-}
-
-export class WorkdayPublicCloudKubernetesReadService {
-  constructor(options = {}) {
-    this.options = options;
-  }
-
-  async invoke(input) {
-    return publicCloudKubernetesRead(input, this.options);
-  }
-}
-
-const defaultService = new WorkdayPublicCloudKubernetesReadService();
-
-export const __test = {
-  WorkdayPublicCloudKubernetesReadService,
-  baseKubectlArgs,
-  commandString,
-  expandHome,
-  kubectlArgs,
-  normalizeInput,
-  publicCloudKubernetesRead,
-  validateResource
-};
-
-const sharedTool = defineReadOnlyTool({
-  name: "workday_public_cloud_kubernetes_read",
-  description: "Run one read-only kubectl operation through the local Workday public-cloud SPC kubeconfig/session. This tool never mutates Kubernetes resources.",
-  meta: {
-    permissions: { rule: "ask" }
-  },
-  inputSchema: {
-    operation: z.enum(VALID_OPERATIONS).default("get"),
-    cluster: z.string().trim().min(1).max(253).optional(),
-    context: z.string().trim().min(1).max(253).optional(),
-    namespace: z.string().trim().min(1).max(253).default(DEFAULT_NAMESPACE),
-    resource: z.string().trim().min(1).max(253).optional(),
-    name: z.string().trim().min(1).max(253).optional(),
-    output: z.enum(VALID_OUTPUTS).default("json"),
-    labelSelector: z.string().trim().min(1).max(1024).optional(),
-    fieldSelector: z.string().trim().min(1).max(1024).optional(),
-    allNamespaces: z.boolean().default(false),
-    kubeconfigPath: z.string().trim().min(1).max(2048).default(DEFAULT_KUBECONFIG_PATH),
-    kubectlBinary: z.string().trim().min(1).max(2048).default(DEFAULT_KUBECTL_BINARY),
-    timeoutMs: z.number().int().positive().max(120_000).default(DEFAULT_TIMEOUT_MS)
-  },
-  async handler(input) {
-    try {
-      return ok(await defaultService.invoke(input));
-    } catch (error) {
-      return fail(error);
-    }
-  }
-});
-
-export default {
-  name: sharedTool.name,
-  description,
-  inputSchema: sharedTool.inputSchema,
-  meta: sharedTool.meta,
-  annotations: sharedTool.annotations,
-  invoke: sharedTool.invoke,
-  handler: sharedTool.handler
-};