@nuvlore/extension-workday-infra-access 0.1.1

package/tools/workday_public_cloud_spc_login.mjs

@@ -0,0 +1,505 @@
+export const description = "Plan, check, or start a local Workday public-cloud SPC login session for a specific tier and cluster using a saved macOS Keychain LDAP token. Use this for public cloud environments; private cloud/DC access stays on Boundary/BOS-AINAT login.";
+
+import { execFile, spawn } from "node:child_process";
+import { openSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { promisify } from "node:util";
+import { z } from "zod";
+import { defineReadOnlyTool, fail, ok } from "@nuvlore/extension-read-only-toolkit/devops-diagnostics";
+import {
+  DEFAULT_WORKDAY_LDAP_KEYCHAIN_ACCOUNT,
+  DEFAULT_WORKDAY_LDAP_KEYCHAIN_SERVICE,
+  DEFAULT_WORKDAY_LDAP_PROD_KEYCHAIN_ACCOUNT,
+  extractTokenFromKeychainSecret,
+  workdayProdCredentialCandidates,
+  shellQuote
+} from "../src/workday-access-profiles.mjs";
+
+const execFileAsync = promisify(execFile);
+
+const DEFAULT_TIER = "cust";
+const DEFAULT_NAMESPACE = "bds";
+const DEFAULT_KUBECONFIG_PATH = "$HOME/.kube/spc-config";
+const DEFAULT_SPC_BINARY = "/usr/local/bin/spc";
+const DEFAULT_KUBECTL_BINARY = "/usr/local/bin/kubectl";
+const DEFAULT_AWS_BINARY = "/usr/local/bin/aws";
+const DEFAULT_SSO_CLI_BINARY = "/Users/boqiang.liang/bin/sso-cli";
+const DEFAULT_AWS_PROFILE = "sso-cust";
+const DEFAULT_AWS_REGION = "";
+const DEFAULT_EXPECT_BINARY = "/usr/bin/expect";
+const DEFAULT_TIMEOUT_MS = 120_000;
+const DEFAULT_READY_WAIT_MS = 20_000;
+const VALID_TIERS = ["dev", "eng", "cust", "fedstg", "fed"];
+
+function normalizeText(value) {
+  return typeof value === "string" ? value.trim() : "";
+}
+
+function expandHome(value) {
+  const text = normalizeText(value);
+  if (text === "$HOME") return process.env.HOME || text;
+  if (text.startsWith("$HOME/")) return join(process.env.HOME || "$HOME", text.slice("$HOME/".length));
+  if (text === "~") return process.env.HOME || text;
+  if (text.startsWith("~/")) return join(process.env.HOME || "~", text.slice(2));
+  return text;
+}
+
+function normalizeInput(input = {}) {
+  const tier = normalizeText(input.tier || input.environment) || DEFAULT_TIER;
+  if (!VALID_TIERS.includes(tier)) {
+    throw new Error(`tier must be one of ${VALID_TIERS.join(", ")}.`);
+  }
+  const developerAccess = typeof input.developerAccess === "boolean"
+    ? input.developerAccess
+    : ["dev", "eng"].includes(tier);
+  return {
+    action: normalizeText(input.action) || "plan",
+    cluster: normalizeText(input.cluster),
+    tier,
+    developerAccess,
+    namespace: normalizeText(input.namespace) || DEFAULT_NAMESPACE,
+    kubeconfigPath: normalizeText(input.kubeconfigPath) || DEFAULT_KUBECONFIG_PATH,
+    spcBinary: normalizeText(input.spcBinary) || DEFAULT_SPC_BINARY,
+    kubectlBinary: normalizeText(input.kubectlBinary) || DEFAULT_KUBECTL_BINARY,
+    awsBinary: normalizeText(input.awsBinary) || DEFAULT_AWS_BINARY,
+    ssoCliBinary: normalizeText(input.ssoCliBinary) || DEFAULT_SSO_CLI_BINARY,
+    awsProfile: normalizeText(input.awsProfile) || DEFAULT_AWS_PROFILE,
+    awsRegion: normalizeText(input.awsRegion) || DEFAULT_AWS_REGION,
+    expectBinary: normalizeText(input.expectBinary) || DEFAULT_EXPECT_BINARY,
+    keychainService: DEFAULT_WORKDAY_LDAP_KEYCHAIN_SERVICE,
+    keychainAccount: DEFAULT_WORKDAY_LDAP_PROD_KEYCHAIN_ACCOUNT || DEFAULT_WORKDAY_LDAP_KEYCHAIN_ACCOUNT,
+    humanApprovedLocalWrite: input.humanApprovedLocalWrite === true,
+    hitlApproval: input.hitlApproval,
+    timeoutMs: Number.isInteger(input.timeoutMs) ? Math.max(1000, input.timeoutMs) : DEFAULT_TIMEOUT_MS,
+    readyWaitMs: Number.isInteger(input.readyWaitMs) ? Math.max(0, input.readyWaitMs) : DEFAULT_READY_WAIT_MS,
+    logPath: normalizeText(input.logPath)
+  };
+}
+
+function assertCluster(input) {
+  if (!input.cluster) {
+    throw new Error("cluster is required, for example s0026.");
+  }
+}
+
+function assertStructuredHitlApproval(input, context) {
+  const approval = input.hitlApproval;
+  if (!approval || typeof approval !== "object") {
+    throw new Error(`${context} requires structured HITL approval with approved, approvedBy, action, target, reason, expectedImpact, and risk.`);
+  }
+
+  const missing = ["approvedBy", "action", "target", "reason", "expectedImpact", "risk"]
+    .filter((key) => !normalizeText(approval[key]));
+  if (approval.approved !== true || missing.length > 0) {
+    throw new Error(`${context} requires approved=true and complete HITL details: ${missing.join(", ") || "approved"}.`);
+  }
+}
+
+function spcArgs(input) {
+  return [
+    ...(input.developerAccess ? ["-d"] : []),
+    "connect",
+    input.tier,
+    input.cluster,
+    "--kubeconfig-path",
+    expandHome(input.kubeconfigPath)
+  ];
+}
+
+function kubectlArgs(input, args) {
+  return ["--kubeconfig", expandHome(input.kubeconfigPath), ...args];
+}
+
+function commandString(command, args) {
+  return [command, ...args].map(shellQuote).join(" ");
+}
+
+function awsEnv(input) {
+  const env = {
+    ...process.env,
+    AWS_PROFILE: input.awsProfile
+  };
+  if (input.awsRegion) {
+    env.AWS_REGION = input.awsRegion;
+    env.AWS_DEFAULT_REGION = input.awsRegion;
+  } else {
+    delete env.AWS_REGION;
+    delete env.AWS_DEFAULT_REGION;
+  }
+  return env;
+}
+
+function spcEnv(input) {
+  const env = {
+    ...process.env,
+    AWS_PROFILE: input.awsProfile,
+    PATH: [
+      "/Users/boqiang.liang/bin",
+      "/usr/local/bin",
+      "/opt/homebrew/bin",
+      process.env.PATH || ""
+    ].filter(Boolean).join(":")
+  };
+  delete env.AWS_REGION;
+  delete env.AWS_DEFAULT_REGION;
+  return env;
+}
+
+function defaultLogPath(input) {
+  return join(tmpdir(), `workday-public-cloud-spc-${input.tier}-${input.cluster}.log`);
+}
+
+function awsRefreshArgs(input) {
+  return [
+    "aws",
+    "--force",
+    "--profile",
+    input.awsProfile,
+    ...(input.awsRegion ? ["--region", input.awsRegion] : [])
+  ];
+}
+
+function buildPlan(input) {
+  const normalized = normalizeInput(input);
+  assertCluster(normalized);
+  const logPath = normalized.logPath || defaultLogPath(normalized);
+  return {
+    mode: "public-cloud-spc-local-auth-helper",
+    action: normalized.action,
+    target: {
+      accessPlane: "public-cloud",
+      loginMethod: "spc",
+      tier: normalized.tier,
+      cluster: normalized.cluster,
+      namespace: normalized.namespace,
+      developerAccess: normalized.developerAccess,
+      kubeconfigPath: normalized.kubeconfigPath
+    },
+    credentialSource: {
+      keychainService: normalized.keychainService,
+      keychainAccount: normalized.keychainAccount,
+      secretHandling: "read LDAP token from macOS Keychain, pass it only to expect via environment, never return it"
+      ,
+      credentialSelection: "Public cloud SPC login uses LDAP PROD for all tiers; private cloud Boundary login also uses LDAP PROD"
+    },
+    commands: {
+      awsRefresh: commandString(normalized.ssoCliBinary, awsRefreshArgs(normalized)),
+      awsStatus: `AWS_PROFILE=${shellQuote(normalized.awsProfile)} ${commandString(normalized.awsBinary, ["sts", "get-caller-identity"])}`,
+      spcConnect: commandString(normalized.spcBinary, spcArgs(normalized)),
+      status: commandString(normalized.kubectlBinary, kubectlArgs(normalized, ["config", "current-context"])),
+      whoami: commandString(normalized.kubectlBinary, kubectlArgs(normalized, ["auth", "whoami"])),
+      namespaceReadCheck: commandString(normalized.kubectlBinary, kubectlArgs(normalized, ["auth", "can-i", "get", "pods", "-n", normalized.namespace]))
+    },
+    localStateChanges: [
+      "spc connect may update the local SPC kubeconfig/context",
+      "sso-cli aws --force may refresh local AWS STS credentials for the sso-cust profile",
+      "spc connect starts a local forwarding session that must stay running for Kubernetes reads"
+    ],
+    requiredForLogin: {
+      prerequisite: "Workday Security Network login/session must already be active before starting SPC.",
+      humanApprovedLocalWrite: true,
+      structuredHitlApproval: true,
+      awsCredentialRefresh: `Run sso-cli aws --force --profile ${normalized.awsProfile} before SPC when AWS STS is expired.`,
+      keychainEntry: `${normalized.keychainService}/${normalized.keychainAccount}`,
+      fallbackKeychainEntry: "wallee/wallee.workday_prod_ldap"
+    },
+    logPath,
+    forbiddenActions: [
+      "kubectl apply",
+      "kubectl patch",
+      "kubectl scale",
+      "kubectl delete",
+      "kubectl rollout restart",
+      "Argo Sync",
+      "Argo Rollback"
+    ],
+    remoteWrite: "not_executed"
+  };
+}
+
+async function readPasswordFromKeychain(execFileImpl) {
+  for (const candidate of workdayProdCredentialCandidates()) {
+    try {
+      const result = await execFileImpl("/usr/bin/security", [
+        "find-generic-password",
+        "-s",
+        candidate.service,
+        "-a",
+        candidate.account,
+        "-w"
+      ], {
+        maxBuffer: 1024 * 1024,
+        timeout: 10_000
+      });
+      const password = extractTokenFromKeychainSecret(result?.stdout);
+      if (password) return { password, keychainService: candidate.service, keychainAccount: candidate.account };
+    } catch (_error) {
+      // Try the legacy Workday PROD credential source next.
+    }
+  }
+  return { password: "", keychainService: DEFAULT_WORKDAY_LDAP_KEYCHAIN_SERVICE, keychainAccount: DEFAULT_WORKDAY_LDAP_PROD_KEYCHAIN_ACCOUNT };
+}
+
+function tclListValue(value) {
+  return `{${String(value).replaceAll("\\", "\\\\").replaceAll("{", "\\{").replaceAll("}", "\\}")}}`;
+}
+
+function buildExpectScript(input) {
+  const commandList = [input.spcBinary, ...spcArgs(input)].map(tclListValue).join(" ");
+  return [
+    "set timeout $env(WORKDAY_SPC_LOGIN_TIMEOUT_SECONDS)",
+    "set password $env(WORKDAY_SPC_LDAP_PASSWORD)",
+    `set command [list ${commandList}]`,
+    "spawn -noecho {*}$command",
+    "expect {",
+    "  -re {(?i)(password|passcode).*:} { send -- \"$password\\r\"; exp_continue }",
+    "  -re {(?i)(connected|forwarding|listening|kubeconfig|context)} { puts \"WORKDAY_PUBLIC_CLOUD_SPC_LOGIN_PROGRESS\"; exp_continue }",
+    "  eof { catch wait result; exit [lindex $result 3] }",
+    "  timeout { puts \"WORKDAY_PUBLIC_CLOUD_SPC_LOGIN_TIMEOUT\"; exit 124 }",
+    "}"
+  ].join("\n");
+}
+
+function redactSecret(text, password) {
+  const raw = String(text || "");
+  if (!password) return raw;
+  return raw.split(password).join("[redacted]");
+}
+
+function startSpcLoginProcess(spawnImpl, input, password, logPath) {
+  const fd = openSync(logPath, "a", 0o600);
+  const child = spawnImpl(input.expectBinary, ["-c", buildExpectScript(input)], {
+    detached: true,
+    stdio: ["ignore", fd, fd],
+    env: {
+      ...spcEnv(input),
+      WORKDAY_SPC_LDAP_PASSWORD: password,
+      WORKDAY_SPC_LOGIN_TIMEOUT_SECONDS: String(Math.max(1, Math.ceil(input.timeoutMs / 1000)))
+    }
+  });
+  if (typeof child.unref === "function") child.unref();
+  return {
+    pid: child.pid,
+    logPath
+  };
+}
+
+async function runAwsStatus(execFileImpl, input) {
+  try {
+    const result = await execFileImpl(input.awsBinary, ["sts", "get-caller-identity"], {
+      env: awsEnv(input),
+      maxBuffer: 1024 * 1024,
+      timeout: 15_000
+    });
+    return {
+      ok: true,
+      profile: input.awsProfile,
+      region: input.awsRegion,
+      stdout: normalizeText(result.stdout),
+      stderr: normalizeText(result.stderr)
+    };
+  } catch (error) {
+    return {
+      ok: false,
+      profile: input.awsProfile,
+      region: input.awsRegion,
+      stdout: normalizeText(error?.stdout),
+      stderr: normalizeText(error?.stderr || error?.message)
+    };
+  }
+}
+
+async function refreshAwsCredentials(execFileImpl, input) {
+  const result = await execFileImpl(input.ssoCliBinary, awsRefreshArgs(input), {
+    env: awsEnv(input),
+    maxBuffer: 1024 * 1024,
+    timeout: input.timeoutMs
+  });
+  return {
+    ok: true,
+    profile: input.awsProfile,
+    region: input.awsRegion,
+    stdout: normalizeText(result.stdout),
+    stderr: normalizeText(result.stderr)
+  };
+}
+
+async function runKubectlStatus(execFileImpl, input) {
+  const checks = [
+    ["currentContext", ["config", "current-context"]],
+    ["whoami", ["auth", "whoami"]],
+    ["namespaceReadCheck", ["auth", "can-i", "get", "pods", "-n", input.namespace]]
+  ];
+  const results = {};
+  for (const [key, args] of checks) {
+    try {
+      const result = await execFileImpl(input.kubectlBinary, kubectlArgs(input, args), {
+        env: spcEnv(input),
+        maxBuffer: 1024 * 1024,
+        timeout: 10_000
+      });
+      results[key] = {
+        ok: true,
+        stdout: normalizeText(result.stdout),
+        stderr: normalizeText(result.stderr)
+      };
+    } catch (error) {
+      results[key] = {
+        ok: false,
+        stdout: normalizeText(error?.stdout),
+        stderr: normalizeText(error?.stderr || error?.message)
+      };
+    }
+  }
+  return {
+    ready: Boolean(results.currentContext?.ok && results.whoami?.ok),
+    ...results
+  };
+}
+
+async function waitForReady(execFileImpl, input) {
+  const deadline = Date.now() + input.readyWaitMs;
+  let latest = await runKubectlStatus(execFileImpl, input);
+  while (!latest.ready && Date.now() < deadline) {
+    await new Promise((resolve) => setTimeout(resolve, 1000));
+    latest = await runKubectlStatus(execFileImpl, input);
+  }
+  return latest;
+}
+
+async function publicCloudSpcLogin(input, options = {}) {
+  const normalized = normalizeInput(input);
+  assertCluster(normalized);
+  const execFileImpl = options.execFileImpl || execFileAsync;
+  const spawnImpl = options.spawnImpl || spawn;
+
+  if (normalized.action === "plan") {
+    return JSON.stringify(buildPlan(normalized), null, 2);
+  }
+  if (normalized.action === "status") {
+    return JSON.stringify({
+      action: "status",
+      target: buildPlan(normalized).target,
+      awsStatus: await runAwsStatus(execFileImpl, normalized),
+      status: await runKubectlStatus(execFileImpl, normalized),
+      remoteWrite: "not_executed"
+    }, null, 2);
+  }
+  if (normalized.action !== "login") {
+    throw new Error(`Unsupported workday_public_cloud_spc_login action: ${normalized.action}`);
+  }
+  if (!normalized.humanApprovedLocalWrite) {
+    throw new Error("workday_public_cloud_spc_login action=login may update local SPC kubeconfig/session state and requires humanApprovedLocalWrite=true.");
+  }
+  assertStructuredHitlApproval(normalized, "workday_public_cloud_spc_login action=login");
+
+  const awsRefresh = await refreshAwsCredentials(execFileImpl, normalized);
+  const keychain = await readPasswordFromKeychain(execFileImpl);
+  if (!keychain.password) {
+    throw new Error(`Missing LDAP PROD password in macOS keychain service ${normalized.keychainService}, account ${normalized.keychainAccount}. Store it in eldwin/eldwin.workday_prod_ldap first; wallee/wallee.workday_prod_ldap is supported only as a fallback source.`);
+  }
+
+  const logPath = normalized.logPath || defaultLogPath(normalized);
+  const processInfo = startSpcLoginProcess(spawnImpl, normalized, keychain.password, logPath);
+  const status = await waitForReady(execFileImpl, normalized);
+  return JSON.stringify({
+    action: "login",
+    target: buildPlan(normalized).target,
+    keychainService: keychain.keychainService,
+    keychainAccount: keychain.keychainAccount,
+    awsRefresh,
+    process: processInfo,
+    status,
+    transcript: "SPC login process started in the background; inspect logPath if ready=false. Secrets are not written by this tool.",
+    remoteWrite: "not_executed"
+  }, null, 2);
+}
+
+export class WorkdayPublicCloudSpcLoginService {
+  constructor(options = {}) {
+    this.options = options;
+  }
+
+  async invoke(input) {
+    return publicCloudSpcLogin(input, this.options);
+  }
+}
+
+const defaultService = new WorkdayPublicCloudSpcLoginService();
+
+export const __test = {
+  WorkdayPublicCloudSpcLoginService,
+  buildExpectScript,
+  buildPlan,
+  commandString,
+  defaultLogPath,
+  expandHome,
+  normalizeInput,
+  readPasswordFromKeychain,
+  redactSecret,
+  refreshAwsCredentials,
+  runAwsStatus,
+  runKubectlStatus,
+  awsEnv,
+  awsRefreshArgs,
+  spcEnv,
+  publicCloudSpcLogin,
+  spcArgs,
+  tclListValue
+};
+
+const sharedTool = defineReadOnlyTool({
+  name: "workday_public_cloud_spc_login",
+  description: "Plan, check, or start a local Workday public-cloud SPC login session for a specific tier and cluster using a saved macOS Keychain LDAP token. Use this for public cloud environments; private cloud/DC access stays on Boundary/BOS-AINAT login.",
+  meta: {
+    permissions: { rule: "ask" },
+    secret_provider: "keychain"
+  },
+  inputSchema: {
+    action: z.enum(["plan", "status", "login"]).default("plan"),
+    cluster: z.string().trim().min(1).max(253),
+    tier: z.enum(VALID_TIERS).default(DEFAULT_TIER),
+    environment: z.enum(VALID_TIERS).optional().describe("Alias for tier."),
+    developerAccess: z.boolean().optional(),
+    namespace: z.string().trim().min(1).max(253).default(DEFAULT_NAMESPACE),
+    kubeconfigPath: z.string().trim().min(1).max(2048).default(DEFAULT_KUBECONFIG_PATH),
+    spcBinary: z.string().trim().min(1).max(2048).default(DEFAULT_SPC_BINARY),
+    kubectlBinary: z.string().trim().min(1).max(2048).default(DEFAULT_KUBECTL_BINARY),
+    awsBinary: z.string().trim().min(1).max(2048).default(DEFAULT_AWS_BINARY),
+    ssoCliBinary: z.string().trim().min(1).max(2048).default(DEFAULT_SSO_CLI_BINARY),
+    awsProfile: z.string().trim().min(1).max(128).default(DEFAULT_AWS_PROFILE),
+    awsRegion: z.string().trim().max(64).default(DEFAULT_AWS_REGION).describe("Optional. Leave blank to use sso-cli/aws defaults; do not pass a region into SPC or kubectl."),
+    expectBinary: z.literal(DEFAULT_EXPECT_BINARY).default(DEFAULT_EXPECT_BINARY),
+    humanApprovedLocalWrite: z.boolean().default(false).describe("Required for action=login because spc connect may update local kubeconfig/session state."),
+    hitlApproval: z.object({
+      approved: z.literal(true),
+      approvedBy: z.string().trim().min(1).max(256),
+      action: z.string().trim().min(1).max(256),
+      target: z.string().trim().min(1).max(4096),
+      reason: z.string().trim().min(1).max(2000),
+      expectedImpact: z.string().trim().min(1).max(2000),
+      risk: z.string().trim().min(1).max(2000)
+    }).optional().describe("Required for action=login because local auth state may be updated."),
+    timeoutMs: z.number().int().positive().max(600_000).default(DEFAULT_TIMEOUT_MS),
+    readyWaitMs: z.number().int().min(0).max(120_000).default(DEFAULT_READY_WAIT_MS),
+    logPath: z.string().trim().min(1).max(2048).optional()
+  },
+  async handler(input) {
+    try {
+      return ok(await defaultService.invoke(input));
+    } catch (error) {
+      return fail(error);
+    }
+  }
+});
+
+export default {
+  name: sharedTool.name,
+  description,
+  inputSchema: sharedTool.inputSchema,
+  meta: sharedTool.meta,
+  annotations: sharedTool.annotations,
+  invoke: sharedTool.invoke,
+  handler: sharedTool.handler
+};