@nuvlore/extension-workday-infra-access 0.1.1

package/tools/public_cloud_access_status.mjs

@@ -0,0 +1,48 @@
+export const description = "Return local public-cloud connection readiness status; does not authenticate or call cloud APIs.";
+
+import { z } from "zod";
+import { defineReadOnlyTool, fail, ok } from "@nuvlore/extension-read-only-toolkit/devops-diagnostics";
+
+function normalizeText(value) {
+  return typeof value === "string" ? value.trim() : "";
+}
+
+export class PublicCloudConnectPlanService {
+  invoke(input) {
+    const platform = normalizeText(input.platform) || "unknown";
+    return JSON.stringify({
+      mode: "atomic-helper",
+      platform,
+      environment: normalizeText(input.environment),
+      target: normalizeText(input.target),
+      status: "connection_procedure_lives_in_skill",
+      nextAtomicTool: platform === "aws" ? "aws_cust_federated_readonly_command_pack" : platform === "gcp" ? "gcp_readonly_command_pack" : "",
+      remoteWrite: "not_executed"
+    }, null, 2);
+  }
+}
+
+const defaultService = new PublicCloudConnectPlanService();
+
+function publicCloudConnectPlan(input) {
+  return defaultService.invoke(input);
+}
+
+export default defineReadOnlyTool({
+  name: "public_cloud_access_status",
+  description: "Return local public-cloud connection readiness status; does not authenticate or call cloud APIs.",
+  inputSchema: {
+    platform: z.string().trim().max(128).default(""),
+    environment: z.string().trim().max(256).default(""),
+    target: z.string().trim().max(1024).default("")
+  },
+  async handler(input) {
+    try {
+      return ok(publicCloudConnectPlan(input));
+    } catch (error) {
+      return fail(error);
+    }
+  }
+});
+
+export const __test = { PublicCloudConnectPlanService, publicCloudConnectPlan };

package/tools/workday_boundary_login.mjs

@@ -0,0 +1,460 @@
+export const description = "Check or prepare Workday datacenter Boundary authentication using the saved macOS keychain LDAP password. The tool consumes the password in-place for bauth init and never returns the secret.";
+
+import { execFile, spawn } from "node:child_process";
+import net from "node:net";
+import { promisify } from "node:util";
+import { z } from "zod";
+import { defineReadOnlyTool, fail, ok } from "@nuvlore/extension-read-only-toolkit/devops-diagnostics";
+import {
+  DEFAULT_DC_BOUNDARY_ADDR,
+  DEFAULT_WORKDAY_LDAP_KEYCHAIN_SERVICE,
+  DEFAULT_WORKDAY_LDAP_SERVICE_KEY,
+  extractTokenFromKeychainSecret,
+  workdayProdCredentialCandidates
+} from "../src/workday-access-profiles.mjs";
+
+const execFileAsync = promisify(execFile);
+
+const DEFAULT_BAUTH_COMMAND = "/Users/boqiang.liang/bin/bauth";
+const DEFAULT_BAUTH_ARGS = ["init"];
+const DEFAULT_BOUNDARY_ADDR = DEFAULT_DC_BOUNDARY_ADDR;
+const DEFAULT_BOUNDARY_BINARY = "/opt/homebrew/bin/boundary";
+const DEFAULT_EXPECT_BINARY = "/usr/bin/expect";
+const DEFAULT_KEYCHAIN_SERVICE = DEFAULT_WORKDAY_LDAP_KEYCHAIN_SERVICE;
+const DEFAULT_TIMEOUT_MS = 120_000;
+const DEFAULT_CUST_VAULT_HOST = "sesh.vault.az1.cust.pdx.wd";
+
+function normalizeText(value) {
+  return typeof value === "string" ? value.trim() : "";
+}
+
+function normalizePinnedText(value, expected, label) {
+  const normalized = normalizeText(value) || expected;
+  if (normalized !== expected) {
+    throw new Error(`${label} must be exactly ${expected}.`);
+  }
+  return normalized;
+}
+
+function normalizePinnedArgs(value) {
+  if (value === undefined) return DEFAULT_BAUTH_ARGS;
+  if (!Array.isArray(value) || value.length !== DEFAULT_BAUTH_ARGS.length || value.some((item, index) => String(item) !== DEFAULT_BAUTH_ARGS[index])) {
+    throw new Error(`args must be exactly ${JSON.stringify(DEFAULT_BAUTH_ARGS)}.`);
+  }
+  return DEFAULT_BAUTH_ARGS;
+}
+
+function assertStructuredHitlApproval(input, context) {
+  const approval = input.hitlApproval;
+  if (!approval || typeof approval !== "object") {
+    throw new Error(`${context} requires structured HITL approval with approved, approvedBy, action, target, reason, expectedImpact, and risk.`);
+  }
+
+  const missing = ["approvedBy", "action", "target", "reason", "expectedImpact", "risk"]
+    .filter((key) => !normalizeText(approval[key]));
+  if (approval.approved !== true || missing.length > 0) {
+    throw new Error(`${context} requires approved=true and complete HITL details: ${missing.join(", ") || "approved"}.`);
+  }
+}
+
+const extractPasswordFromKeychainSecret = extractTokenFromKeychainSecret;
+
+async function readPasswordFromKeychain(execFileImpl) {
+  for (const candidate of workdayProdCredentialCandidates()) {
+    try {
+      const result = await execFileImpl("/usr/bin/security", [
+        "find-generic-password",
+        "-s",
+        candidate.service,
+        "-a",
+        candidate.account,
+        "-w"
+      ], {
+        maxBuffer: 1024 * 1024,
+        timeout: 10_000
+      });
+      const password = extractPasswordFromKeychainSecret(result?.stdout);
+      if (password) return { password, keychainService: candidate.service, keychainAccount: candidate.account };
+    } catch (_error) {
+      // Try the legacy Workday PROD credential source next.
+    }
+  }
+  return { password: "", keychainService: DEFAULT_KEYCHAIN_SERVICE, keychainAccount: "eldwin.workday_prod_ldap" };
+}
+
+function parseBoundaryAuthStatus(stdout = "", stderr = "") {
+  const raw = normalizeText(stdout);
+  if (raw) {
+    try {
+      const parsed = JSON.parse(raw);
+      if (Number(parsed?.status_code) === 200 && parsed?.item?.expiration_time) {
+        return {
+          ready: true,
+          reason: "",
+          expirationTime: String(parsed.item.expiration_time)
+        };
+      }
+    } catch (_error) {
+      // Fall through to a text reason.
+    }
+  }
+  return {
+    ready: false,
+    reason: normalizeText(stderr || raw || "Boundary auth token is unavailable."),
+    expirationTime: ""
+  };
+}
+
+async function readBoundaryAuthStatus(execFileImpl, input) {
+  try {
+    const result = await execFileImpl(input.boundaryBinary, [
+      "auth-tokens",
+      "read",
+      "-id",
+      "self",
+      "-format",
+      "json"
+    ], {
+      env: buildBoundaryEnv(input),
+      maxBuffer: 1024 * 1024,
+      timeout: 10_000
+    });
+    return parseBoundaryAuthStatus(result.stdout, result.stderr);
+  } catch (error) {
+    return parseBoundaryAuthStatus(error?.stdout, error?.stderr || error?.message);
+  }
+}
+
+async function readSshAgentStatus(execFileImpl) {
+  try {
+    const result = await execFileImpl("/usr/bin/ssh-add", ["-l"], {
+      env: buildBoundaryEnv({ boundaryAddr: DEFAULT_BOUNDARY_ADDR }),
+      maxBuffer: 1024 * 1024,
+      timeout: 10_000
+    });
+    const output = normalizeText(result.stdout || result.stderr);
+    return {
+      ready: /cert|ssh-rsa|ecdsa|ed25519/iu.test(output),
+      reason: "",
+      identities: output.split("\n").filter(Boolean).slice(0, 10)
+    };
+  } catch (error) {
+    return {
+      ready: false,
+      reason: normalizeText(error?.stderr || error?.stdout || error?.message || "ssh-agent identity status is unavailable."),
+      identities: []
+    };
+  }
+}
+
+async function findOpenPort() {
+  return await new Promise((resolve, reject) => {
+    const server = net.createServer();
+    server.listen(0, "127.0.0.1", () => {
+      const port = server.address().port;
+      server.close(() => resolve(port));
+    });
+    server.on("error", reject);
+  });
+}
+
+function buildBoundaryEnv(input, extra = {}) {
+  return {
+    ...process.env,
+    ...extra,
+    BOUNDARY_ADDR: input.boundaryAddr,
+    BOUNDARY_SKIP_CACHE_DAEMON: "true",
+    PATH: [
+      "/opt/homebrew/bin",
+      "/Users/boqiang.liang/bin",
+      "/usr/local/bin",
+      process.env.PATH || ""
+    ].filter(Boolean).join(":")
+  };
+}
+
+function redactSecret(text, password) {
+  const raw = String(text || "");
+  if (!password) return raw;
+  return raw.split(password).join("[redacted]");
+}
+
+function tclListValue(value) {
+  return `{${String(value).replaceAll("\\", "\\\\").replaceAll("{", "\\{").replaceAll("}", "\\}")}}`;
+}
+
+function buildExpectScript(command, args) {
+  const commandList = [command, ...args].map(tclListValue).join(" ");
+  return [
+    "set timeout $env(DEVOPS_LOGIN_TIMEOUT_SECONDS)",
+    "set password $env(DEVOPS_LDAP_PASSWORD)",
+    "set role_index $env(DEVOPS_ROLE_INDEX)",
+    `set command [list ${commandList}]`,
+    "spawn -noecho {*}$command",
+    "expect {",
+    "  -re {Please enter your Okta/AD password:|Please enter your CORP LDAP password:|Password:} { send -- \"$password\\r\"; exp_continue }",
+    "  -re {Please Select a Role:} { send -- \"$role_index\\r\"; exp_continue }",
+    "  eof { catch wait result; exit [lindex $result 3] }",
+    "  timeout { puts \"Workday boundary login timed out.\"; exit 124 }",
+    "}"
+  ].join("\n");
+}
+
+async function runBauthLogin(execFileImpl, input, password) {
+  const timeoutSeconds = Math.max(1, Math.ceil(input.timeoutMs / 1000));
+  let result;
+  try {
+    result = await execFileImpl(input.expectBinary, [
+      "-c",
+      buildExpectScript(input.command, input.args)
+    ], {
+      env: buildBoundaryEnv(input, {
+        DEVOPS_LDAP_PASSWORD: password,
+        DEVOPS_LOGIN_TIMEOUT_SECONDS: String(timeoutSeconds),
+        DEVOPS_ROLE_INDEX: String(input.roleIndex)
+      }),
+      maxBuffer: 1024 * 1024,
+      timeout: input.timeoutMs + 5_000
+    });
+  } catch (error) {
+    const stdout = redactSecret(error?.stdout, password);
+    const stderr = redactSecret(error?.stderr || error?.message, password);
+    throw new Error(`bauth init failed with exit ${error?.code ?? "unknown"}: ${[stdout, stderr].filter(Boolean).join("\n").slice(-2000)}`);
+  }
+  return {
+    stdout: redactSecret(result.stdout, password),
+    stderr: redactSecret(result.stderr, password),
+    exitCode: 0
+  };
+}
+
+function normalizeInput(input = {}) {
+  return {
+    action: normalizeText(input.action) || "status",
+    keychainService: DEFAULT_KEYCHAIN_SERVICE,
+    keychainAccount: "eldwin.workday_prod_ldap",
+    boundaryAddr: normalizeText(input.boundaryAddr) || process.env.BOUNDARY_ADDR || DEFAULT_BOUNDARY_ADDR,
+    boundaryBinary: normalizePinnedText(input.boundaryBinary, DEFAULT_BOUNDARY_BINARY, "boundaryBinary"),
+    expectBinary: normalizePinnedText(input.expectBinary, DEFAULT_EXPECT_BINARY, "expectBinary"),
+    command: normalizePinnedText(input.command, DEFAULT_BAUTH_COMMAND, "command"),
+    args: normalizePinnedArgs(input.args),
+    roleIndex: Number.isInteger(input.roleIndex) ? input.roleIndex : 0,
+    humanApprovedLocalWrite: input.humanApprovedLocalWrite === true,
+    hitlApproval: input.hitlApproval,
+    timeoutMs: Number.isInteger(input.timeoutMs) ? Math.max(1000, input.timeoutMs) : DEFAULT_TIMEOUT_MS
+  };
+}
+
+async function waitForVault(execFileImpl, url, timeoutMs) {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    try {
+      await execFileImpl("/usr/bin/curl", ["-sk", "--connect-timeout", "2", "-o", "/dev/null", url], {
+        maxBuffer: 1024 * 1024,
+        timeout: 5_000
+      });
+      return true;
+    } catch (_error) {
+      await new Promise((resolve) => setTimeout(resolve, 1000));
+    }
+  }
+  return false;
+}
+
+function parseVaultLoginDiagnostic(raw = "") {
+  const text = String(raw || "");
+  try {
+    const parsed = JSON.parse(text);
+    const policies = Array.isArray(parsed?.auth?.token_policies) ? parsed.auth.token_policies : [];
+    const roles = policies
+      .filter((policy) => policy && policy !== "default")
+      .map((policy) => String(policy).replace(/_basic$/u, ""))
+      .sort();
+    const errors = Array.isArray(parsed?.errors) ? parsed.errors.map(String) : [];
+    return {
+      loginOk: Boolean(parsed?.auth?.client_token),
+      policyCount: policies.length,
+      roles,
+      errors
+    };
+  } catch (_error) {
+    return {
+      loginOk: false,
+      policyCount: 0,
+      roles: [],
+      errors: [text.slice(0, 500)]
+    };
+  }
+}
+
+async function diagnoseVaultRoles(execFileImpl, spawnImpl, input, password) {
+  const port = await findOpenPort();
+  const localUrl = `https://localhost:${port}`;
+  const child = spawnImpl(input.boundaryBinary, ["connect", DEFAULT_CUST_VAULT_HOST, "-listen-port", String(port)], {
+    env: buildBoundaryEnv(input),
+    stdio: ["ignore", "ignore", "pipe"]
+  });
+  let stderr = "";
+  child.stderr?.setEncoding?.("utf8");
+  child.stderr?.on?.("data", (chunk) => {
+    stderr += chunk;
+  });
+  try {
+    const reachable = await waitForVault(execFileImpl, `${localUrl}/v1/sys/health`, Math.min(input.timeoutMs, 30_000));
+    if (!reachable) {
+      return {
+        vaultHost: DEFAULT_CUST_VAULT_HOST,
+        reachable: false,
+        loginOk: false,
+        policyCount: 0,
+        roles: [],
+        errors: [normalizeText(stderr || "Vault tunnel did not become reachable.")]
+      };
+    }
+    const result = await execFileImpl("/usr/bin/curl", [
+      "-sk",
+      `${localUrl}/v1/auth/ldap/login/${process.env.USER || ""}`,
+      "--request",
+      "POST",
+      "--data",
+      JSON.stringify({ password })
+    ], {
+      maxBuffer: 1024 * 1024,
+      timeout: 15_000
+    });
+    return {
+      vaultHost: DEFAULT_CUST_VAULT_HOST,
+      reachable: true,
+      ...parseVaultLoginDiagnostic(result.stdout)
+    };
+  } finally {
+    child.kill("SIGTERM");
+  }
+}
+
+async function workdayBoundaryLogin(input, options = {}) {
+  const execFileImpl = options.execFileImpl || execFileAsync;
+  const spawnImpl = options.spawnImpl || spawn;
+  const normalized = normalizeInput(input);
+  const before = await readBoundaryAuthStatus(execFileImpl, normalized);
+  const beforeSshAgent = await readSshAgentStatus(execFileImpl);
+  if (normalized.action === "status") {
+    return JSON.stringify({
+      action: "status",
+      boundaryAddr: normalized.boundaryAddr,
+      boundary: before,
+      sshAgent: beforeSshAgent,
+      ready: before.ready && beforeSshAgent.ready
+    }, null, 2);
+  }
+  if (normalized.action === "diagnose-vault") {
+    const keychain = await readPasswordFromKeychain(execFileImpl);
+    if (!keychain.password) {
+      throw new Error(`Missing LDAP PROD password in macOS keychain service ${normalized.keychainService}, account ${normalized.keychainAccount}. Store it in eldwin/eldwin.workday_prod_ldap first; wallee/wallee.workday_prod_ldap is supported only as a fallback source.`);
+    }
+    const diagnostic = await diagnoseVaultRoles(execFileImpl, spawnImpl, normalized, keychain.password);
+    return JSON.stringify({ action: "diagnose-vault", boundaryAddr: normalized.boundaryAddr, keychainService: keychain.keychainService, keychainAccount: keychain.keychainAccount, diagnostic }, null, 2);
+  }
+  if (normalized.action !== "login") {
+    throw new Error(`Unsupported workday_boundary_login action: ${normalized.action}`);
+  }
+  if (!normalized.humanApprovedLocalWrite) {
+    throw new Error("workday_boundary_login action=login may update local Boundary/SSH auth state and requires humanApprovedLocalWrite=true.");
+  }
+  assertStructuredHitlApproval(normalized, "workday_boundary_login action=login");
+  const keychain = await readPasswordFromKeychain(execFileImpl);
+  if (!keychain.password) {
+    throw new Error(`Missing LDAP PROD password in macOS keychain service ${normalized.keychainService}, account ${normalized.keychainAccount}. Store it in eldwin/eldwin.workday_prod_ldap first; wallee/wallee.workday_prod_ldap is supported only as a fallback source.`);
+  }
+
+  const login = await runBauthLogin(execFileImpl, normalized, keychain.password);
+  const after = await readBoundaryAuthStatus(execFileImpl, normalized);
+  const afterSshAgent = await readSshAgentStatus(execFileImpl);
+  return JSON.stringify({
+    action: "login",
+    boundaryAddr: normalized.boundaryAddr,
+    keychainService: keychain.keychainService,
+    keychainAccount: keychain.keychainAccount,
+    command: normalized.command,
+    args: normalized.args,
+    roleIndex: normalized.roleIndex,
+    loginExitCode: login.exitCode,
+    boundary: after,
+    sshAgent: afterSshAgent,
+    ready: after.ready && afterSshAgent.ready,
+    transcript: [login.stdout, login.stderr].filter(Boolean).join("\n").slice(-1000)
+  }, null, 2);
+}
+
+export class WorkdayBoundaryLoginService {
+  constructor(options = {}) {
+    this.options = options;
+  }
+
+  async invoke(input) {
+    return workdayBoundaryLogin(input, this.options);
+  }
+}
+
+const defaultService = new WorkdayBoundaryLoginService();
+
+export const __test = {
+  WorkdayBoundaryLoginService,
+  extractPasswordFromKeychainSecret,
+  parseBoundaryAuthStatus,
+  readSshAgentStatus,
+  parseVaultLoginDiagnostic,
+  diagnoseVaultRoles,
+  normalizeInput,
+  normalizePinnedText,
+  workdayBoundaryLogin,
+  runBauthLogin,
+  redactSecret,
+  tclListValue
+};
+
+const sharedTool = defineReadOnlyTool({
+  name: "workday_boundary_login",
+  description: "Check or prepare Workday datacenter Boundary authentication using the saved macOS keychain LDAP password. The tool consumes the password in-place for bauth init and never returns the secret.",
+  meta: {
+    permissions: { rule: "ask" },
+    secret_provider: "keychain"
+  },
+  inputSchema: {
+    action: z.enum(["status", "login", "diagnose-vault"]).default("status"),
+    boundaryAddr: z.string().trim().url().max(2048).default(DEFAULT_BOUNDARY_ADDR),
+    boundaryBinary: z.literal(DEFAULT_BOUNDARY_BINARY).default(DEFAULT_BOUNDARY_BINARY),
+    expectBinary: z.literal(DEFAULT_EXPECT_BINARY).default(DEFAULT_EXPECT_BINARY),
+    command: z.literal(DEFAULT_BAUTH_COMMAND).default(DEFAULT_BAUTH_COMMAND),
+    args: z.tuple([z.literal("init")]).default(DEFAULT_BAUTH_ARGS),
+    roleIndex: z.number().int().min(0).max(99).default(0),
+    humanApprovedLocalWrite: z.boolean().default(false).describe("Required for action=login because bauth may update local Boundary/SSH auth state."),
+    hitlApproval: z.object({
+      approved: z.literal(true),
+      approvedBy: z.string().trim().min(1).max(256),
+      action: z.string().trim().min(1).max(256),
+      target: z.string().trim().min(1).max(4096),
+      reason: z.string().trim().min(1).max(2000),
+      expectedImpact: z.string().trim().min(1).max(2000),
+      risk: z.string().trim().min(1).max(2000)
+    }).optional().describe("Required for action=login because local auth state may be updated."),
+    timeoutMs: z.number().int().positive().max(600_000).default(DEFAULT_TIMEOUT_MS)
+  },
+  async handler(input) {
+    try {
+      return ok(await defaultService.invoke(input));
+    } catch (error) {
+      return fail(error);
+    }
+  }
+});
+
+export default {
+  name: sharedTool.name,
+  description,
+  inputSchema: sharedTool.inputSchema,
+  meta: sharedTool.meta,
+  annotations: sharedTool.annotations,
+  invoke: sharedTool.invoke,
+  handler: sharedTool.handler
+};