@nuvlore/extension-workday-infra-access 0.1.1

package/tools/workday_private_cloud_sudo_readonly_command.mjs

@@ -0,0 +1,386 @@
+export const description = "Run a single read-only sudo command on an explicit Workday private-cloud/DC host by running bauth init with the dedicated LDAP PROD password, then using ordinary ssh. The secret is never returned.";
+
+import { execFile, spawn } from "node:child_process";
+import { promisify } from "node:util";
+import { z } from "zod";
+import { defineReadOnlyTool, fail, ok } from "@nuvlore/extension-read-only-toolkit/devops-diagnostics";
+import { isReadOnlyShellCommand } from "@nuvlore/extension-read-only-toolkit/read-only-shell-policy";
+import {
+  DEFAULT_DC_BOUNDARY_ADDR,
+  DEFAULT_WORKDAY_LDAP_KEYCHAIN_SERVICE,
+  DEFAULT_WORKDAY_LDAP_PROD_KEYCHAIN_ACCOUNT,
+  extractTokenFromKeychainSecret,
+  workdayProdCredentialCandidates
+} from "../src/workday-access-profiles.mjs";
+
+const execFileAsync = promisify(execFile);
+
+const DEFAULT_BAUTH_COMMAND = "/Users/boqiang.liang/bin/bauth";
+const DEFAULT_BAUTH_ARGS = ["init"];
+const DEFAULT_EXPECT_BINARY = "/usr/bin/expect";
+const DEFAULT_CONNECT_TIMEOUT_SECONDS = 20;
+const DEFAULT_TIMEOUT_MS = 120_000;
+
+function normalizeText(value) {
+  return typeof value === "string" ? value.trim() : "";
+}
+
+function sshHostFor(host) {
+  return normalizeText(host);
+}
+
+function boundaryProxyJumpFor(host) {
+  const value = sshHostFor(host);
+  const match = value.match(/\.cust\.(ash|atl|ams|dub|pdx)\.wd$/u) || value.match(/\.(ash|atl|ams|dub|pdx)\.wd$/u);
+  return match ? `boundary-proxy.${match[1]}.bnd` : "";
+}
+
+function assertStructuredHitlApproval(input, context) {
+  const approval = input.hitlApproval;
+  if (!approval || typeof approval !== "object") {
+    throw new Error(`${context} requires structured HITL approval with approved, approvedBy, action, target, reason, expectedImpact, and risk.`);
+  }
+
+  const missing = ["approvedBy", "action", "target", "reason", "expectedImpact", "risk"]
+    .filter((key) => !normalizeText(approval[key]));
+  if (approval.approved !== true || missing.length > 0) {
+    throw new Error(`${context} requires approved=true and complete HITL details: ${missing.join(", ") || "approved"}.`);
+  }
+}
+
+function normalizeInput(input = {}) {
+  return {
+    action: normalizeText(input.action) || "plan",
+    host: normalizeText(input.host),
+    command: normalizeText(input.command),
+    bauthCommand: DEFAULT_BAUTH_COMMAND,
+    bauthArgs: DEFAULT_BAUTH_ARGS,
+    expectBinary: DEFAULT_EXPECT_BINARY,
+    roleIndex: 0,
+    proxyJumpHost: normalizeText(input.proxyJumpHost),
+    boundaryAddr: normalizeText(input.boundaryAddr) || DEFAULT_DC_BOUNDARY_ADDR,
+    connectTimeoutSeconds: Number.isInteger(input.connectTimeoutSeconds)
+      ? Math.max(1, input.connectTimeoutSeconds)
+      : DEFAULT_CONNECT_TIMEOUT_SECONDS,
+    timeoutMs: Number.isInteger(input.timeoutMs) ? Math.max(1000, input.timeoutMs) : DEFAULT_TIMEOUT_MS,
+    humanApprovedSudoRead: input.humanApprovedSudoRead === true,
+    hitlApproval: input.hitlApproval
+  };
+}
+
+function assertTarget(input) {
+  if (!input.host) throw new Error("host is required for private-cloud sudo reads.");
+  if (!input.command) throw new Error("command is required for private-cloud sudo reads.");
+}
+
+function validateReadOnlyCommand(command) {
+  const result = isReadOnlyShellCommand(command);
+  if (!result.allowed) {
+    throw new Error(`Refusing sudo command: ${result.reason}`);
+  }
+  return result;
+}
+
+function buildRemoteSudoScript(command) {
+  return `IFS= read -r SUDOPASS || exit 11; printf '%s\\n' "$SUDOPASS" | sudo -S -p '' bash -lc ${JSON.stringify(command)}`;
+}
+
+function buildSshArgs(input) {
+  const args = [
+    "-o",
+    "BatchMode=yes",
+    "-o",
+    `ConnectTimeout=${input.connectTimeoutSeconds}`,
+  ];
+  const proxyJumpHost = input.proxyJumpHost || boundaryProxyJumpFor(input.host);
+  if (proxyJumpHost) {
+    args.push("-o", `ProxyJump=${proxyJumpHost}`);
+  }
+  args.push(
+    "--",
+    sshHostFor(input.host),
+    buildRemoteSudoScript(input.command)
+  );
+  return args;
+}
+
+function privateCloudSshEnv(input) {
+  return {
+    ...process.env,
+    BOUNDARY_ADDR: input?.boundaryAddr || DEFAULT_DC_BOUNDARY_ADDR,
+    BOUNDARY_SKIP_CACHE_DAEMON: "true",
+    PATH: [
+      "/opt/homebrew/bin",
+      "/Users/boqiang.liang/bin",
+      "/usr/local/bin",
+      process.env.PATH || ""
+    ].filter(Boolean).join(":")
+  };
+}
+
+function bauthEnv(input, password) {
+  return {
+    ...privateCloudSshEnv(input),
+    DEVOPS_LDAP_PASSWORD: password,
+    DEVOPS_LOGIN_TIMEOUT_SECONDS: String(Math.max(1, Math.ceil(input.timeoutMs / 1000))),
+    DEVOPS_ROLE_INDEX: String(input.roleIndex)
+  };
+}
+
+function buildPlan(input) {
+  const normalized = normalizeInput(input);
+  assertTarget(normalized);
+  const policy = validateReadOnlyCommand(normalized.command);
+  return {
+    mode: "private-cloud-sudo-readonly",
+    action: normalized.action,
+    target: {
+      accessPlane: "private-cloud",
+      loginMethod: "bauth-init-then-plain-ssh",
+      host: sshHostFor(normalized.host),
+      proxyJumpHost: normalized.proxyJumpHost || boundaryProxyJumpFor(normalized.host),
+      boundaryAddr: normalized.boundaryAddr
+    },
+    command: normalized.command,
+    policy,
+    credentialSource: {
+      keychainService: DEFAULT_WORKDAY_LDAP_KEYCHAIN_SERVICE,
+      keychainAccount: DEFAULT_WORKDAY_LDAP_PROD_KEYCHAIN_ACCOUNT,
+      fallbackKeychainEntry: "wallee/wallee.workday_prod_ldap",
+      secretHandling: "read LDAP PROD token from macOS Keychain and pass it only to remote sudo stdin; never return it"
+    },
+    prerequisites: [
+      "Workday Security Network login/session is active",
+      "Tool will run bauth init with the dedicated LDAP PROD password before plain ssh"
+    ],
+    localStateChanges: [],
+    remoteWrite: "not_executed"
+  };
+}
+
+async function readProdPasswordFromKeychain(execFileImpl) {
+  for (const candidate of workdayProdCredentialCandidates()) {
+    try {
+      const result = await execFileImpl("/usr/bin/security", [
+        "find-generic-password",
+        "-s",
+        candidate.service,
+        "-a",
+        candidate.account,
+        "-w"
+      ], {
+        maxBuffer: 1024 * 1024,
+        timeout: 10_000
+      });
+      const password = extractTokenFromKeychainSecret(result?.stdout);
+      if (password) return { password, keychainService: candidate.service, keychainAccount: candidate.account };
+    } catch (_error) {
+      // Try the legacy Workday PROD credential source next.
+    }
+  }
+  return { password: "", keychainService: DEFAULT_WORKDAY_LDAP_KEYCHAIN_SERVICE, keychainAccount: DEFAULT_WORKDAY_LDAP_PROD_KEYCHAIN_ACCOUNT };
+}
+
+function redactSecret(text, password) {
+  const raw = String(text || "");
+  if (!password) return raw;
+  return raw.split(password).join("[redacted]");
+}
+
+function tclListValue(value) {
+  return `{${String(value).replaceAll("\\", "\\\\").replaceAll("{", "\\{").replaceAll("}", "\\}")}}`;
+}
+
+function buildBauthExpectScript(input) {
+  const commandList = [input.bauthCommand, ...input.bauthArgs].map(tclListValue).join(" ");
+  return [
+    "set timeout $env(DEVOPS_LOGIN_TIMEOUT_SECONDS)",
+    "set password $env(DEVOPS_LDAP_PASSWORD)",
+    `set command [list ${commandList}]`,
+    "set role_index $env(DEVOPS_ROLE_INDEX)",
+    "spawn -noecho {*}$command",
+    "expect {",
+    "  -re {Please enter your Okta/AD password:|Please enter your CORP LDAP password:|Password:} { send -- \"$password\\r\"; exp_continue }",
+    "  -re {Please Select a Role:|Select a Role:|Select role:} { send -- \"$role_index\\r\"; exp_continue }",
+    "  eof { catch wait result; exit [lindex $result 3] }",
+    "  timeout { puts \"Workday bauth init timed out.\"; exit 124 }",
+    "}"
+  ].join("\n");
+}
+
+async function runBauthInit(execFileImpl, input, password) {
+  const result = await execFileImpl(input.expectBinary, [
+    "-c",
+    buildBauthExpectScript(input)
+  ], {
+    env: bauthEnv(input, password),
+    maxBuffer: 1024 * 1024,
+    timeout: input.timeoutMs + 5_000
+  });
+  return {
+    stdout: redactSecret(result.stdout, password),
+    stderr: redactSecret(result.stderr, password),
+    exitCode: 0
+  };
+}
+
+async function runSshSudoRead(spawnImpl, input, password) {
+  return await new Promise((resolve, reject) => {
+    const child = spawnImpl("ssh", buildSshArgs(input), {
+      stdio: ["pipe", "pipe", "pipe"],
+      env: privateCloudSshEnv(input)
+    });
+    let stdout = "";
+    let stderr = "";
+    const timer = setTimeout(() => {
+      child.kill("SIGTERM");
+      reject(new Error("private cloud sudo read timed out."));
+    }, input.timeoutMs);
+    child.stdout?.setEncoding?.("utf8");
+    child.stderr?.setEncoding?.("utf8");
+    child.stdout?.on?.("data", (chunk) => {
+      stdout += chunk;
+    });
+    child.stderr?.on?.("data", (chunk) => {
+      stderr += chunk;
+    });
+    child.on("error", (error) => {
+      clearTimeout(timer);
+      reject(error);
+    });
+    child.on("exit", (code) => {
+      clearTimeout(timer);
+      const result = {
+        exitCode: code ?? -1,
+        stdout: redactSecret(stdout, password),
+        stderr: redactSecret(stderr, password)
+      };
+      if (code === 0) {
+        resolve(result);
+      } else {
+        reject(new Error(`private cloud sudo read exited with ${code ?? "unknown"}: ${result.stderr || result.stdout}`));
+      }
+    });
+    child.stdin?.end(`${password}\n`);
+  });
+}
+
+async function privateCloudSudoReadonlyCommand(input, options = {}) {
+  const normalized = normalizeInput(input);
+  assertTarget(normalized);
+  validateReadOnlyCommand(normalized.command);
+  const execFileImpl = options.execFileImpl || execFileAsync;
+  const spawnImpl = options.spawnImpl || spawn;
+
+  if (normalized.action === "plan") {
+    return JSON.stringify(buildPlan(normalized), null, 2);
+  }
+  if (normalized.action !== "run") {
+    throw new Error(`Unsupported workday_private_cloud_sudo_readonly_command action: ${normalized.action}`);
+  }
+  if (!normalized.humanApprovedSudoRead) {
+    throw new Error("workday_private_cloud_sudo_readonly_command action=run requires humanApprovedSudoRead=true.");
+  }
+  assertStructuredHitlApproval(normalized, "workday_private_cloud_sudo_readonly_command action=run");
+
+  const keychain = await readProdPasswordFromKeychain(execFileImpl);
+  if (!keychain.password) {
+    throw new Error(`Missing LDAP PROD password in macOS keychain service ${keychain.keychainService}, account ${keychain.keychainAccount}. Store it in eldwin/eldwin.workday_prod_ldap first; wallee/wallee.workday_prod_ldap is supported only as a fallback source.`);
+  }
+
+  const bauth = await runBauthInit(execFileImpl, normalized, keychain.password);
+  const result = await runSshSudoRead(spawnImpl, normalized, keychain.password);
+  return JSON.stringify({
+    action: "run",
+    target: buildPlan(normalized).target,
+    command: normalized.command,
+    keychainService: keychain.keychainService,
+    keychainAccount: keychain.keychainAccount,
+    bauth: {
+      command: normalized.bauthCommand,
+      args: normalized.bauthArgs,
+      roleIndex: normalized.roleIndex,
+      exitCode: bauth.exitCode,
+      transcript: [bauth.stdout, bauth.stderr].filter(Boolean).join("\n").slice(-1000)
+    },
+    result,
+    remoteWrite: "not_executed"
+  }, null, 2);
+}
+
+export class WorkdayPrivateCloudSudoReadonlyCommandService {
+  constructor(options = {}) {
+    this.options = options;
+  }
+
+  async invoke(input) {
+    return privateCloudSudoReadonlyCommand(input, this.options);
+  }
+}
+
+const defaultService = new WorkdayPrivateCloudSudoReadonlyCommandService();
+
+export const __test = {
+  WorkdayPrivateCloudSudoReadonlyCommandService,
+  boundaryHostFor: sshHostFor,
+  sshHostFor,
+  boundaryProxyJumpFor,
+  bauthEnv,
+  buildPlan,
+  buildBauthExpectScript,
+  buildRemoteSudoScript,
+  buildSshArgs,
+  privateCloudSshEnv,
+  normalizeInput,
+  privateCloudSudoReadonlyCommand,
+  readProdPasswordFromKeychain,
+  runBauthInit,
+  redactSecret,
+  runSshSudoRead,
+  validateReadOnlyCommand
+};
+
+const sharedTool = defineReadOnlyTool({
+  name: "workday_private_cloud_sudo_readonly_command",
+  description: "Run a single read-only sudo command on an explicit Workday private-cloud/DC host by running bauth init with the dedicated LDAP PROD password, then using ordinary ssh. The secret is never returned.",
+  meta: {
+    permissions: { rule: "ask" },
+    secret_provider: "keychain"
+  },
+  inputSchema: {
+    action: z.enum(["plan", "run"]).default("plan"),
+    host: z.string().trim().min(1).max(253),
+    command: z.string().trim().min(1).max(4096),
+    proxyJumpHost: z.string().trim().max(253).optional().describe("Optional explicit Boundary proxy jump host. Defaults to boundary-proxy.<dc>.bnd inferred from the private-cloud host."),
+    boundaryAddr: z.string().trim().url().max(2048).default(DEFAULT_DC_BOUNDARY_ADDR),
+    connectTimeoutSeconds: z.number().int().positive().max(120).default(DEFAULT_CONNECT_TIMEOUT_SECONDS),
+    humanApprovedSudoRead: z.boolean().default(false).describe("Required for action=run because this uses saved LDAP PROD password for remote sudo."),
+    hitlApproval: z.object({
+      approved: z.literal(true),
+      approvedBy: z.string().trim().min(1).max(256),
+      action: z.string().trim().min(1).max(256),
+      target: z.string().trim().min(1).max(4096),
+      reason: z.string().trim().min(1).max(2000),
+      expectedImpact: z.string().trim().min(1).max(2000),
+      risk: z.string().trim().min(1).max(2000)
+    }).optional().describe("Required for action=run because sudo read access is privileged."),
+    timeoutMs: z.number().int().positive().max(600_000).default(DEFAULT_TIMEOUT_MS)
+  },
+  async handler(input) {
+    try {
+      return ok(await defaultService.invoke(input));
+    } catch (error) {
+      return fail(error);
+    }
+  }
+});
+
+export default {
+  name: sharedTool.name,
+  description,
+  inputSchema: sharedTool.inputSchema,
+  meta: sharedTool.meta,
+  annotations: sharedTool.annotations,
+  invoke: sharedTool.invoke,
+  handler: sharedTool.handler
+};

package/tools/workday_public_cloud_environment_map.mjs

@@ -0,0 +1,189 @@
+export const description = "Map logical Workday public-cloud environments such as CP2 to concrete SPC clusters, platform-specific login flows, and bounded read-only follow-up commands.";
+
+import { z } from "zod";
+import { defineReadOnlyTool, fail, ok } from "@nuvlore/extension-read-only-toolkit/devops-diagnostics";
+
+export const PUBLIC_CLOUD_ENVIRONMENT_MAP = {
+  cp2: {
+    environment: "CP2",
+    tier: "cust",
+    namespace: "bds",
+    entries: {
+      aws: {
+        platform: "AWS",
+        cluster: "s0054",
+        purpose: "CP2 AWS-backed public-cloud BDS access.",
+        loginFlow: [
+          "okta2aws login",
+          "sso-cli aws --force --profile sso-cust",
+          "AWS_PROFILE=sso-cust spc connect cust s0054"
+        ],
+        readOnlyChecks: [
+          "kcsb get pod",
+          "kubectl --kubeconfig=$HOME/.kube/spc-config -n bds get pods"
+        ]
+      },
+      gcs: {
+        platform: "GCS",
+        cluster: "s0029",
+        purpose: "CP2 GCS-backed public-cloud BDS access.",
+        loginFlow: [
+          "okta2aws login",
+          "sso-cli aws --force --profile sso-cust",
+          "AWS_PROFILE=sso-cust spc connect cust s0029"
+        ],
+        readOnlyChecks: [
+          "kcsb get pod",
+          "kcsb exec -it bdm-0 -- bash",
+          "gsutil ls gs://scylla-218441665564-bds-tenant-s0020/data/tenants/"
+        ]
+      }
+    }
+  }
+};
+
+const ENVIRONMENT_ALIASES = new Map([
+  ["cp2", "cp2"],
+  ["cp_2", "cp2"],
+  ["customer_preview_2", "cp2"],
+  ["customerpreview2", "cp2"]
+]);
+
+const PLATFORM_ALIASES = new Map([
+  ["aws", "aws"],
+  ["amazon", "aws"],
+  ["gcs", "gcs"],
+  ["gcp", "gcs"],
+  ["google", "gcs"],
+  ["google_cloud_storage", "gcs"]
+]);
+
+function normalizeText(value) {
+  return typeof value === "string" ? value.trim() : "";
+}
+
+function normalizeKey(value) {
+  return normalizeText(value).toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
+}
+
+function normalizeEnvironment(value) {
+  const key = normalizeKey(value);
+  return ENVIRONMENT_ALIASES.get(key) ?? key;
+}
+
+function normalizePlatform(value) {
+  const key = normalizeKey(value);
+  return PLATFORM_ALIASES.get(key) ?? key;
+}
+
+function buildKubectlCommands(envMapping, entry) {
+  return {
+    publicCloudLoginTool: {
+      tool: "workday_public_cloud_spc_login",
+      input: {
+        action: "login",
+        tier: envMapping.tier,
+        cluster: entry.cluster,
+        namespace: envMapping.namespace,
+        humanApprovedLocalWrite: true
+      }
+    },
+    verify: [
+      `AWS_PROFILE=sso-cust kubectl --kubeconfig=$HOME/.kube/spc-config config current-context`,
+      `AWS_PROFILE=sso-cust kubectl --kubeconfig=$HOME/.kube/spc-config auth whoami`,
+      `AWS_PROFILE=sso-cust kubectl --kubeconfig=$HOME/.kube/spc-config auth can-i get pods -n ${envMapping.namespace}`,
+      `AWS_PROFILE=sso-cust kubectl --kubeconfig=$HOME/.kube/spc-config auth can-i get pods/log -n ${envMapping.namespace}`
+    ],
+    readOnly: entry.readOnlyChecks
+  };
+}
+
+function mapEntry(envMapping, platformKey, entry) {
+  return {
+    environment: envMapping.environment,
+    platformKey,
+    platform: entry.platform,
+    tier: envMapping.tier,
+    namespace: envMapping.namespace,
+    cluster: entry.cluster,
+    purpose: entry.purpose,
+    loginFlow: entry.loginFlow,
+    commands: buildKubectlCommands(envMapping, entry),
+    notes: [
+      "Do not specify AWS region by default.",
+      "Use kcsb or explicit kubectl so evidence is bounded and auditable.",
+      "SPC cluster names are concrete values such as s0054 or s0029; the logical environment CP2 is not itself an SPC cluster name."
+    ]
+  };
+}
+
+export class WorkdayPublicCloudEnvironmentMapService {
+  constructor({ mappings = PUBLIC_CLOUD_ENVIRONMENT_MAP } = {}) {
+    this.mappings = mappings;
+  }
+
+  invoke(input = {}) {
+    const environmentKey = normalizeEnvironment(input.environment || "cp2");
+    const platformKey = normalizePlatform(input.platform);
+    const envMapping = this.mappings[environmentKey];
+    if (!envMapping) {
+      throw new Error(`Unsupported public cloud environment mapping: ${input.environment}. Supported: ${Object.keys(this.mappings).join(", ")}.`);
+    }
+
+    const entries = {};
+    for (const [key, entry] of Object.entries(envMapping.entries)) {
+      if (platformKey && key !== platformKey) continue;
+      entries[key] = mapEntry(envMapping, key, entry);
+    }
+    if (platformKey && Object.keys(entries).length === 0) {
+      throw new Error(`Unsupported platform for ${envMapping.environment}: ${input.platform}. Supported: ${Object.keys(envMapping.entries).join(", ")}.`);
+    }
+
+    return JSON.stringify({
+      environment: envMapping.environment,
+      requestedPlatform: normalizeText(input.platform),
+      entries,
+      remoteWrite: "not_executed"
+    }, null, 2);
+  }
+}
+
+const defaultService = new WorkdayPublicCloudEnvironmentMapService();
+
+export function workdayPublicCloudEnvironmentMap(input) {
+  return defaultService.invoke(input);
+}
+
+export const __test = {
+  PUBLIC_CLOUD_ENVIRONMENT_MAP,
+  WorkdayPublicCloudEnvironmentMapService,
+  normalizeEnvironment,
+  normalizePlatform,
+  workdayPublicCloudEnvironmentMap
+};
+
+const sharedTool = defineReadOnlyTool({
+  name: "workday_public_cloud_environment_map",
+  description: "Map logical Workday public-cloud environments such as CP2 to concrete SPC clusters, platform-specific login flows, and bounded read-only follow-up commands.",
+  inputSchema: {
+    environment: z.string().trim().min(1).max(128).default("CP2"),
+    platform: z.string().trim().max(64).default("").describe("Optional platform filter, for example AWS or GCS.")
+  },
+  async handler(input) {
+    try {
+      return ok(workdayPublicCloudEnvironmentMap(input));
+    } catch (error) {
+      return fail(error);
+    }
+  }
+});
+
+export default {
+  name: sharedTool.name,
+  description,
+  inputSchema: sharedTool.inputSchema,
+  meta: sharedTool.meta,
+  annotations: sharedTool.annotations,
+  invoke: sharedTool.invoke,
+  handler: sharedTool.handler
+};