@occam-scaly/scaly-cli 0.2.5 → 0.2.6

package/lib/scaly-api.js

@@ -254,6 +254,27 @@ const QUERIES = {
       }
     }
   `,
+  listAddOnsByType: `
+    query ListAddOnsByType($accountId: String!, $type: AddOnTypeEnum!, $take: Int) {
+      listAddOns(
+        where: {
+          AND: [
+            { accountId: { equals: $accountId } }
+            { type: { equals: $type } }
+            { isDeleted: { equals: false } }
+          ]
+        }
+        take: $take
+      ) {
+        id
+        name
+        type
+        accountId
+        status
+        addOnCognito { userPoolName }
+      }
+    }
+  `,
   listStacks: `
     query ListStacks($take: Int) {
       listStacks(
@@ -351,6 +372,15 @@ async function findAddOnByName({ name, accountId }) {
   return data?.listAddOns || [];
 }
 
+async function listAddOnsByType({ accountId, type, take = 10 }) {
+  const data = await graphqlRequest(QUERIES.listAddOnsByType, {
+    accountId,
+    type,
+    take
+  });
+  return data?.listAddOns || [];
+}
+
 async function createStack({ accountId, name, size, minIdle }) {
   const data = await graphqlRequest(MUTATIONS.createStack, {
     data: {
@@ -419,6 +449,7 @@ module.exports = {
   findStackByName,
   findAppByName,
   findAddOnByName,
+  listAddOnsByType,
   listStacks,
   listApps,
   createStack,

package/lib/scaly-artifacts.js

@@ -34,6 +34,27 @@ const SENSITIVE_PATH_PATTERNS = [
   // ssh / aws creds
   /(^|\/)\.ssh(\/|$)/i,
   /(^|\/)\.aws(\/|$)/i,
+  // common package registry credentials
+  /(^|\/)\.npmrc$/i,
+  /(^|\/)\.pypirc$/i,
+  // docker registry auth
+  /(^|\/)\.docker\/config\.json$/i,
+  // kubernetes creds
+  /(^|\/)\.kube(\/|$)/i,
+  /(^|\/)(kubeconfig|.*\.kubeconfig)$/i,
+  // terraform state (often contains secrets)
+  /(^|\/).*\.tfstate(\.backup)?$/i,
+  /(^|\/)terraform\.tfstate(\.backup)?$/i,
+  // GCP service account keys / generic credentials files
+  /(^|\/)credentials\.json$/i,
+  /(^|\/)service-account.*\.json$/i,
+  // keystores / pkcs
+  /\.p12$/i,
+  /\.pfx$/i,
+  /\.keystore$/i,
+  /\.jks$/i,
+  // generic "secrets" files (defense-in-depth; can be overridden)
+  /(^|\/).*secrets?.*\.(ya?ml|json)$/i,
   // private keys
   /\.pem$/i,
   /\.key$/i,

package/lib/scaly-plan.js

@@ -122,6 +122,12 @@ async function buildPlan({ config, env, appName }) {
     accountId = await resolveAccountId({ config });
   }
 
+  const requestedAuthPools = new Set();
+  for (const a of filteredApps) {
+    const pool = a && a.auth && a.auth.userPool;
+    if (typeof pool === 'string' && pool.trim()) requestedAuthPools.add(pool);
+  }
+
   let stackOpId = null;
   if (!currentStack) {
     stackOpId = 'op_stack_create';
@@ -258,6 +264,7 @@ async function buildPlan({ config, env, appName }) {
 
   if (Array.isArray(config.addons) && config.addons.length) {
     let addOnReadable = true;
+    let existingUserPools = null;
     for (const addOn of config.addons) {
       if (!addOn || typeof addOn !== 'object') continue;
       const apiType = mapAddOnType(addOn.type);
@@ -274,6 +281,28 @@ async function buildPlan({ config, env, appName }) {
 
       let currentAddOn = null;
       try {
+        if (apiType === 'COGNITO') {
+          try {
+            existingUserPools =
+              existingUserPools ||
+              (await api.listAddOnsByType({
+                accountId,
+                type: 'COGNITO',
+                take: 10
+              }));
+          } catch {
+            existingUserPools = null;
+          }
+          if (
+            Array.isArray(existingUserPools) &&
+            existingUserPools.length > 1
+          ) {
+            warnings.push(
+              `Multiple user groups add-ons exist in this account (${existingUserPools.length}). Scaly typically expects one user pool per account.`
+            );
+          }
+        }
+
         const list = await api.findAddOnByName({ name: addOn.name, accountId });
         currentAddOn = list?.[0] || null;
         if (list.length > 1) {
@@ -291,6 +320,44 @@ async function buildPlan({ config, env, appName }) {
       }
 
       if (!currentAddOn) {
+        if (apiType === 'COGNITO') {
+          const allowMultiple =
+            addOn.allow_multiple_user_pools === true ||
+            addOn.allowMultipleUserPools === true ||
+            config?.account?.allow_multiple_user_pools === true ||
+            config?.account?.allowMultipleUserPools === true;
+
+          const existing =
+            Array.isArray(existingUserPools) && existingUserPools.length
+              ? existingUserPools[0]
+              : null;
+
+          if (existing && !allowMultiple) {
+            warnings.push(
+              `User groups add-on '${addOn.name}' would create a new user pool, but this account already has '${existing.name}'. Reusing the existing pool is recommended to avoid "missing users" surprises. To create multiple pools, set addons[].allow_multiple_user_pools: true.`
+            );
+            if (requestedAuthPools.has(addOn.name)) {
+              warnings.push(
+                `app.auth.userPool is set to '${addOn.name}'. Consider changing it to '${existing.name}' to keep existing users.`
+              );
+            }
+            ops.push({
+              id: `op_addon_noop_${existing.name}`,
+              kind: 'addon',
+              action: 'noop',
+              resource: {
+                type: 'addon',
+                name: existing.name,
+                id: existing.id
+              },
+              current: pick(existing, ['id', 'name', 'type', 'accountId']),
+              desired: { name: existing.name, type: apiType, accountId },
+              diff: []
+            });
+            continue;
+          }
+        }
+
         const desired = { name: addOn.name, type: apiType, accountId };
         if (apiType === 'DATABASE') {
           const dbType = mapDbEngine(addOn.engine);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@occam-scaly/scaly-cli",
-  "version": "0.2.5",
+  "version": "0.2.6",
   "description": "Scaly CLI (auth + project config helpers)",
   "bin": {
     "scaly": "./bin/scaly.js"