@occam-scaly/scaly-cli 0.2.5 → 0.2.7

package/bin/scaly.js

@@ -2992,9 +2992,9 @@ async function runDiagnoseApp(rest) {
   }
   if (/User pool .* does not exist/i.test(text)) {
     findings.push({
-      code: 'COGNITO_POOL_MISSING',
+      code: 'USER_GROUPS_POOL_MISSING',
       severity: 'medium',
-      hint: 'Identity add-on misconfigured; verify user pool id/region.'
+      hint: "User Groups is misconfigured for this account; contact support to repair the account's identity resources."
     });
   }
   if (/ResourceAlreadyExistsException/i.test(text)) {

package/lib/scaly-api.js

@@ -254,6 +254,27 @@ const QUERIES = {
       }
     }
   `,
+  listAddOnsByType: `
+    query ListAddOnsByType($accountId: String!, $type: AddOnTypeEnum!, $take: Int) {
+      listAddOns(
+        where: {
+          AND: [
+            { accountId: { equals: $accountId } }
+            { type: { equals: $type } }
+            { isDeleted: { equals: false } }
+          ]
+        }
+        take: $take
+      ) {
+        id
+        name
+        type
+        accountId
+        status
+        addOnCognito { userPoolName }
+      }
+    }
+  `,
   listStacks: `
     query ListStacks($take: Int) {
       listStacks(
@@ -351,6 +372,15 @@ async function findAddOnByName({ name, accountId }) {
   return data?.listAddOns || [];
 }
 
+async function listAddOnsByType({ accountId, type, take = 10 }) {
+  const data = await graphqlRequest(QUERIES.listAddOnsByType, {
+    accountId,
+    type,
+    take
+  });
+  return data?.listAddOns || [];
+}
+
 async function createStack({ accountId, name, size, minIdle }) {
   const data = await graphqlRequest(MUTATIONS.createStack, {
     data: {
@@ -419,6 +449,7 @@ module.exports = {
   findStackByName,
   findAppByName,
   findAddOnByName,
+  listAddOnsByType,
   listStacks,
   listApps,
   createStack,

package/lib/scaly-artifacts.js

@@ -34,6 +34,27 @@ const SENSITIVE_PATH_PATTERNS = [
   // ssh / aws creds
   /(^|\/)\.ssh(\/|$)/i,
   /(^|\/)\.aws(\/|$)/i,
+  // common package registry credentials
+  /(^|\/)\.npmrc$/i,
+  /(^|\/)\.pypirc$/i,
+  // docker registry auth
+  /(^|\/)\.docker\/config\.json$/i,
+  // kubernetes creds
+  /(^|\/)\.kube(\/|$)/i,
+  /(^|\/)(kubeconfig|.*\.kubeconfig)$/i,
+  // terraform state (often contains secrets)
+  /(^|\/).*\.tfstate(\.backup)?$/i,
+  /(^|\/)terraform\.tfstate(\.backup)?$/i,
+  // GCP service account keys / generic credentials files
+  /(^|\/)credentials\.json$/i,
+  /(^|\/)service-account.*\.json$/i,
+  // keystores / pkcs
+  /\.p12$/i,
+  /\.pfx$/i,
+  /\.keystore$/i,
+  /\.jks$/i,
+  // generic "secrets" files (defense-in-depth; can be overridden)
+  /(^|\/).*secrets?.*\.(ya?ml|json)$/i,
   // private keys
   /\.pem$/i,
   /\.key$/i,

package/lib/scaly-plan.js

@@ -122,6 +122,17 @@ async function buildPlan({ config, env, appName }) {
     accountId = await resolveAccountId({ config });
   }
 
+  const requestedAuthPools = new Set();
+  for (const a of filteredApps) {
+    const pool = a && a.auth && a.auth.userPool;
+    if (typeof pool === 'string' && pool.trim()) requestedAuthPools.add(pool);
+  }
+  if (requestedAuthPools.size) {
+    warnings.push(
+      "app.auth.userPool is deprecated and ignored. Scaly uses the account's User Groups automatically; configure only app.auth.groups."
+    );
+  }
+
   let stackOpId = null;
   if (!currentStack) {
     stackOpId = 'op_stack_create';
@@ -258,6 +269,7 @@ async function buildPlan({ config, env, appName }) {
 
   if (Array.isArray(config.addons) && config.addons.length) {
     let addOnReadable = true;
+    let existingUserPools = null;
     for (const addOn of config.addons) {
       if (!addOn || typeof addOn !== 'object') continue;
       const apiType = mapAddOnType(addOn.type);
@@ -274,6 +286,30 @@ async function buildPlan({ config, env, appName }) {
 
       let currentAddOn = null;
       try {
+        if (apiType === 'COGNITO') {
+          try {
+            existingUserPools =
+              existingUserPools ||
+              (await api.listAddOnsByType({
+                accountId,
+                type: 'COGNITO',
+                take: 10
+              }));
+          } catch {
+            existingUserPools = null;
+          }
+          if (
+            Array.isArray(existingUserPools) &&
+            existingUserPools.length > 1
+          ) {
+            const e = new Error(
+              `Multiple User Groups pools exist in this account (${existingUserPools.length}). Scaly supports exactly one user pool per account; contact support to repair this account before continuing.`
+            );
+            e.code = 'USER_GROUPS_POOL_DUPLICATE';
+            throw e;
+          }
+        }
+
         const list = await api.findAddOnByName({ name: addOn.name, accountId });
         currentAddOn = list?.[0] || null;
         if (list.length > 1) {
@@ -291,6 +327,40 @@ async function buildPlan({ config, env, appName }) {
       }
 
       if (!currentAddOn) {
+        if (apiType === 'COGNITO') {
+          const existing =
+            Array.isArray(existingUserPools) && existingUserPools.length
+              ? existingUserPools.find((p) => p && p.name === 'users') ||
+                existingUserPools[0]
+              : null;
+
+          if (existing) {
+            warnings.push(
+              `User Groups is provisioned automatically per account. Ignoring configured user_groups add-on '${addOn.name}' and using existing '${existing.name}'.`
+            );
+            ops.push({
+              id: `op_addon_noop_${existing.name}`,
+              kind: 'addon',
+              action: 'noop',
+              resource: {
+                type: 'addon',
+                name: existing.name,
+                id: existing.id
+              },
+              current: pick(existing, ['id', 'name', 'type', 'accountId']),
+              desired: { name: existing.name, type: apiType, accountId },
+              diff: []
+            });
+            continue;
+          }
+
+          const e = new Error(
+            'User Groups pool is missing for this account. Scaly provisions it automatically at account creation; contact support to repair this account.'
+          );
+          e.code = 'USER_GROUPS_POOL_MISSING';
+          throw e;
+        }
+
         const desired = { name: addOn.name, type: apiType, accountId };
         if (apiType === 'DATABASE') {
           const dbType = mapDbEngine(addOn.engine);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@occam-scaly/scaly-cli",
-  "version": "0.2.5",
+  "version": "0.2.7",
   "description": "Scaly CLI (auth + project config helpers)",
   "bin": {
     "scaly": "./bin/scaly.js"