@p0security/cli 0.11.4 → 0.13.0

package/dist/drivers/auth.js

@@ -32,7 +32,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.authenticate = exports.loadCredentials = exports.cached = exports.IDENTITY_CACHE_PATH = exports.IDENTITY_FILE_PATH = void 0;
+exports.authenticate = exports.cached = exports.IDENTITY_CACHE_PATH = exports.IDENTITY_FILE_PATH = void 0;
 /** Copyright © 2024-present P0 Security
 
 This file is part of @p0security/cli
@@ -45,7 +45,6 @@ You should have received a copy of the GNU General Public License along with @p0
 **/
 const login_1 = require("../commands/login");
 const util_1 = require("../util");
-const config_1 = require("./config");
 const firestore_1 = require("./firestore");
 const stdio_1 = require("./stdio");
 const fs = __importStar(require("fs/promises"));
@@ -88,7 +87,7 @@ const cached = (name, loader, options, hasExpired) => __awaiter(void 0, void 0,
     }
 });
 exports.cached = cached;
-const loadCredentials = (options) => __awaiter(void 0, void 0, void 0, function* () {
+const loadCredentialsWithAutoLogin = (options) => __awaiter(void 0, void 0, void 0, function* () {
     try {
         const buffer = yield fs.readFile(exports.IDENTITY_FILE_PATH);
         const identity = JSON.parse(buffer.toString());
@@ -96,7 +95,7 @@ const loadCredentials = (options) => __awaiter(void 0, void 0, void 0, function*
             identity.credential.expires_at < Date.now() * 1e-3) {
             yield (0, login_1.login)({ org: identity.org.slug }, { skipAuthenticate: true });
             (0, stdio_1.print2)("\u200B"); // Force a new line
-            return (0, exports.loadCredentials)({ noRefresh: true });
+            return loadCredentialsWithAutoLogin({ noRefresh: true });
         }
         return identity;
     }
@@ -107,11 +106,8 @@ const loadCredentials = (options) => __awaiter(void 0, void 0, void 0, function*
         throw error;
     }
 });
-exports.loadCredentials = loadCredentials;
 const authenticate = (options) => __awaiter(void 0, void 0, void 0, function* () {
-    yield (0, config_1.loadConfig)();
-    (0, firestore_1.initializeFirebase)();
-    const identity = yield (0, exports.loadCredentials)(options);
+    const identity = yield loadCredentialsWithAutoLogin(options);
     const userCredential = yield (0, firestore_1.authenticateToFirebase)(identity);
     return { userCredential, identity };
 });

package/dist/drivers/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/drivers/auth.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;;;;;;;;;GASG;AACH,6CAA0C;AAE1C,kCAAkC;AAClC,qCAAsC;AACtC,2CAAyE;AACzE,mCAAiC;AACjC,gDAAkC;AAClC,2CAA6B;AAEhB,QAAA,kBAAkB,GAAG,IAAI,CAAC,IAAI,CAAC,cAAO,EAAE,eAAe,CAAC,CAAC;AACzD,QAAA,mBAAmB,GAAG,IAAI,CAAC,IAAI,CAC1C,IAAI,CAAC,OAAO,CAAC,0BAAkB,CAAC,EAChC,OAAO,CACR,CAAC;AAEK,MAAM,MAAM,GAAG,CACpB,IAAY,EACZ,MAAwB,EACxB,OAA6B,EAC7B,UAAiC,EACrB,EAAE;;IACd,iCAAiC;IACjC,mHAAmH;IACnH,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,2BAAmB,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC,CAAC;IACzE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,2BAAmB,CAAC,EAAE;QACxC,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;KAC3C;IAED,MAAM,SAAS,GAAG,GAAS,EAAE;QAC3B,MAAM,IAAI,GAAG,MAAM,MAAM,EAAE,CAAC;QAC5B,IAAI,CAAC,IAAI;YAAE,MAAM,mCAAmC,IAAI,GAAG,CAAC;QAC5D,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACpE,MAAM,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/D,OAAO,IAAI,CAAC;IACd,CAAC,CAAA,CAAC;IAEF,IAAI;QACF,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,QAAQ,EAAE;YACxD,MAAM,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;YACjB,OAAO,MAAM,SAAS,EAAE,CAAC;SAC1B;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAM,CAAC;QACzE,IAAI,UAAU,aAAV,UAAU,uBAAV,UAAU,CAAG,IAAI,CAAC,EAAE;YACtB,MAAM,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;YACjB,OAAO,MAAM,SAAS,EAAE,CAAC;SAC1B;QACD,OAAO,IAAI,CAAC;KACb;IAAC,OAAO,KAAU,EAAE;QACnB,IAAI,CAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,IAAI,MAAK,QAAQ;YAC1B,IAAA,cAAM,EACJ,+BAA+B,IAAI,iBAAiB,MAAA,KAAK,CAAC,OAAO,mCAAI,KAAK,EAAE,CAC7E,CAAC;QACJ,OAAO,MAAM,SAAS,EAAE,CAAC;KAC1B;AACH,CAAC,CAAA,CAAC;AAzCW,QAAA,MAAM,UAyCjB;AAEK,MAAM,eAAe,GAAG,CAAO,OAErC,EAAqB,EAAE;IACtB,IAAI;QACF,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,0BAAkB,CAAC,CAAC;QACrD,MAAM,QAAQ,GAAa,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;QACzD,IACE,CAAC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,SAAS,CAAA;YACnB,QAAQ,CAAC,UAAU,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,EAClD;YACA,MAAM,IAAA,aAAK,EAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC;YACpE,IAAA,cAAM,EAAC,QAAQ,CAAC,CAAC,CAAC,mBAAmB;YACrC,OAAO,IAAA,uBAAe,EAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;SAC7C;QACD,OAAO,QAAQ,CAAC;KACjB;IAAC,OAAO,KAAU,EAAE;QACnB,IAAI,CAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,IAAI,MAAK,QAAQ,EAAE;YAC5B,MAAM,yDAAyD,CAAC;SACjE;QACD,MAAM,KAAK,CAAC;KACb;AACH,CAAC,CAAA,CAAC;AArBW,QAAA,eAAe,mBAqB1B;AAEK,MAAM,YAAY,GAAG,CAAO,OAElC,EAAkB,EAAE;IACnB,MAAM,IAAA,mBAAU,GAAE,CAAC;IACnB,IAAA,8BAAkB,GAAE,CAAC;IAErB,MAAM,QAAQ,GAAG,MAAM,IAAA,uBAAe,EAAC,OAAO,CAAC,CAAC;IAChD,MAAM,cAAc,GAAG,MAAM,IAAA,kCAAsB,EAAC,QAAQ,CAAC,CAAC;IAE9D,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC;AACtC,CAAC,CAAA,CAAC;AAVW,QAAA,YAAY,gBAUvB"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/drivers/auth.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;;;;;;;;;GASG;AACH,6CAA0C;AAE1C,kCAAkC;AAClC,2CAAqD;AACrD,mCAAiC;AACjC,gDAAkC;AAClC,2CAA6B;AAEhB,QAAA,kBAAkB,GAAG,IAAI,CAAC,IAAI,CAAC,cAAO,EAAE,eAAe,CAAC,CAAC;AACzD,QAAA,mBAAmB,GAAG,IAAI,CAAC,IAAI,CAC1C,IAAI,CAAC,OAAO,CAAC,0BAAkB,CAAC,EAChC,OAAO,CACR,CAAC;AAEK,MAAM,MAAM,GAAG,CACpB,IAAY,EACZ,MAAwB,EACxB,OAA6B,EAC7B,UAAiC,EACrB,EAAE;;IACd,iCAAiC;IACjC,mHAAmH;IACnH,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,2BAAmB,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC,CAAC;IACzE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,2BAAmB,CAAC,EAAE;QACxC,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;KAC3C;IAED,MAAM,SAAS,GAAG,GAAS,EAAE;QAC3B,MAAM,IAAI,GAAG,MAAM,MAAM,EAAE,CAAC;QAC5B,IAAI,CAAC,IAAI;YAAE,MAAM,mCAAmC,IAAI,GAAG,CAAC;QAC5D,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACpE,MAAM,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/D,OAAO,IAAI,CAAC;IACd,CAAC,CAAA,CAAC;IAEF,IAAI;QACF,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,QAAQ,EAAE;YACxD,MAAM,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;YACjB,OAAO,MAAM,SAAS,EAAE,CAAC;SAC1B;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAM,CAAC;QACzE,IAAI,UAAU,aAAV,UAAU,uBAAV,UAAU,CAAG,IAAI,CAAC,EAAE;YACtB,MAAM,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;YACjB,OAAO,MAAM,SAAS,EAAE,CAAC;SAC1B;QACD,OAAO,IAAI,CAAC;KACb;IAAC,OAAO,KAAU,EAAE;QACnB,IAAI,CAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,IAAI,MAAK,QAAQ;YAC1B,IAAA,cAAM,EACJ,+BAA+B,IAAI,iBAAiB,MAAA,KAAK,CAAC,OAAO,mCAAI,KAAK,EAAE,CAC7E,CAAC;QACJ,OAAO,MAAM,SAAS,EAAE,CAAC;KAC1B;AACH,CAAC,CAAA,CAAC;AAzCW,QAAA,MAAM,UAyCjB;AAEF,MAAM,4BAA4B,GAAG,CAAO,OAE3C,EAAqB,EAAE;IACtB,IAAI;QACF,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,0BAAkB,CAAC,CAAC;QACrD,MAAM,QAAQ,GAAa,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;QACzD,IACE,CAAC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,SAAS,CAAA;YACnB,QAAQ,CAAC,UAAU,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,EAClD;YACA,MAAM,IAAA,aAAK,EAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC;YACpE,IAAA,cAAM,EAAC,QAAQ,CAAC,CAAC,CAAC,mBAAmB;YACrC,OAAO,4BAA4B,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;SAC1D;QACD,OAAO,QAAQ,CAAC;KACjB;IAAC,OAAO,KAAU,EAAE;QACnB,IAAI,CAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,IAAI,MAAK,QAAQ,EAAE;YAC5B,MAAM,yDAAyD,CAAC;SACjE;QACD,MAAM,KAAK,CAAC;KACb;AACH,CAAC,CAAA,CAAC;AAEK,MAAM,YAAY,GAAG,CAAO,OAElC,EAAkB,EAAE;IACnB,MAAM,QAAQ,GAAG,MAAM,4BAA4B,CAAC,OAAO,CAAC,CAAC;IAC7D,MAAM,cAAc,GAAG,MAAM,IAAA,kCAAsB,EAAC,QAAQ,CAAC,CAAC;IAE9D,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC;AACtC,CAAC,CAAA,CAAC;AAPW,QAAA,YAAY,gBAOvB"}

package/dist/drivers/config.d.ts

@@ -11,5 +11,5 @@ You should have received a copy of the GNU General Public License along with @p0
 import { Config } from "../types/org";
 export declare const CONFIG_FILE_PATH: string;
 export declare function getTenantConfig(): Config;
-export declare function saveConfig(config: Config): Promise<void>;
-export declare function loadConfig(): Promise<void>;
+export declare function saveConfig(orgId: string): Promise<void>;
+export declare function loadConfig(): Promise<Config>;

package/dist/drivers/config.js

@@ -14,7 +14,10 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.loadConfig = exports.saveConfig = exports.getTenantConfig = exports.CONFIG_FILE_PATH = void 0;
 const util_1 = require("../util");
+const env_1 = require("./env");
+const firestore_1 = require("./firestore");
 const stdio_1 = require("./stdio");
+const firestore_2 = require("firebase/firestore");
 const promises_1 = __importDefault(require("fs/promises"));
 const path_1 = __importDefault(require("path"));
 exports.CONFIG_FILE_PATH = path_1.default.join(util_1.P0_PATH, "config.json");
@@ -23,8 +26,14 @@ function getTenantConfig() {
     return tenantConfig;
 }
 exports.getTenantConfig = getTenantConfig;
-function saveConfig(config) {
+function saveConfig(orgId) {
+    var _a;
     return __awaiter(this, void 0, void 0, function* () {
+        const orgDoc = yield (0, firestore_2.getDoc)((0, firestore_1.bootstrapDoc)(`orgs/${orgId}`));
+        const orgData = orgDoc.data();
+        if (!orgData)
+            throw "Could not find organization";
+        const config = (_a = orgData.config) !== null && _a !== void 0 ? _a : env_1.bootstrapConfig;
         (0, stdio_1.print2)(`Saving config to ${exports.CONFIG_FILE_PATH}.`);
         const dir = path_1.default.dirname(exports.CONFIG_FILE_PATH);
         yield promises_1.default.mkdir(dir, { recursive: true });
@@ -37,6 +46,7 @@ function loadConfig() {
     return __awaiter(this, void 0, void 0, function* () {
         const buffer = yield promises_1.default.readFile(exports.CONFIG_FILE_PATH);
         tenantConfig = JSON.parse(buffer.toString());
+        return tenantConfig;
     });
 }
 exports.loadConfig = loadConfig;

package/dist/drivers/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/drivers/config.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAWA,kCAAkC;AAClC,mCAAiC;AACjC,2DAA6B;AAC7B,gDAAwB;AAEX,QAAA,gBAAgB,GAAG,cAAI,CAAC,IAAI,CAAC,cAAO,EAAE,aAAa,CAAC,CAAC;AAElE,IAAI,YAAoB,CAAC;AAEzB,SAAgB,eAAe;IAC7B,OAAO,YAAY,CAAC;AACtB,CAAC;AAFD,0CAEC;AAED,SAAsB,UAAU,CAAC,MAAc;;QAC7C,IAAA,cAAM,EAAC,oBAAoB,wBAAgB,GAAG,CAAC,CAAC;QAChD,MAAM,GAAG,GAAG,cAAI,CAAC,OAAO,CAAC,wBAAgB,CAAC,CAAC;QAC3C,MAAM,kBAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,MAAM,kBAAE,CAAC,SAAS,CAAC,wBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9E,YAAY,GAAG,MAAM,CAAC;IACxB,CAAC;CAAA;AAND,gCAMC;AAED,SAAsB,UAAU;;QAC9B,MAAM,MAAM,GAAG,MAAM,kBAAE,CAAC,QAAQ,CAAC,wBAAgB,CAAC,CAAC;QACnD,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC/C,CAAC;CAAA;AAHD,gCAGC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/drivers/config.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAWA,kCAAkC;AAClC,+BAAwC;AACxC,2CAA2C;AAC3C,mCAAiC;AACjC,kDAA4C;AAC5C,2DAA6B;AAC7B,gDAAwB;AAEX,QAAA,gBAAgB,GAAG,cAAI,CAAC,IAAI,CAAC,cAAO,EAAE,aAAa,CAAC,CAAC;AAElE,IAAI,YAAoB,CAAC;AAEzB,SAAgB,eAAe;IAC7B,OAAO,YAAY,CAAC;AACtB,CAAC;AAFD,0CAEC;AAED,SAAsB,UAAU,CAAC,KAAa;;;QAC5C,MAAM,MAAM,GAAG,MAAM,IAAA,kBAAM,EACzB,IAAA,wBAAY,EAAC,QAAQ,KAAK,EAAE,CAAC,CAC9B,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAE9B,IAAI,CAAC,OAAO;YAAE,MAAM,6BAA6B,CAAC;QAElD,MAAM,MAAM,GAAG,MAAA,OAAO,CAAC,MAAM,mCAAI,qBAAe,CAAC;QAEjD,IAAA,cAAM,EAAC,oBAAoB,wBAAgB,GAAG,CAAC,CAAC;QAEhD,MAAM,GAAG,GAAG,cAAI,CAAC,OAAO,CAAC,wBAAgB,CAAC,CAAC;QAC3C,MAAM,kBAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,MAAM,kBAAE,CAAC,SAAS,CAAC,wBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAE9E,YAAY,GAAG,MAAM,CAAC;;CACvB;AAjBD,gCAiBC;AAED,SAAsB,UAAU;;QAC9B,MAAM,MAAM,GAAG,MAAM,kBAAE,CAAC,QAAQ,CAAC,wBAAgB,CAAC,CAAC;QACnD,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC7C,OAAO,YAAY,CAAC;IACtB,CAAC;CAAA;AAJD,gCAIC"}

package/dist/drivers/firestore.d.ts

@@ -9,12 +9,13 @@ This file is part of @p0security/cli
 You should have received a copy of the GNU General Public License along with @p0security/cli. If not, see <https://www.gnu.org/licenses/>.
 **/
 import { Identity } from "../types/identity";
+import { UserCredential } from "firebase/auth";
 import { CollectionReference, DocumentReference } from "firebase/firestore";
-export declare function initializeFirebase(): void;
-export declare function authenticateToFirebase(identity: Identity): Promise<import("@firebase/auth").UserCredential>;
+export declare function initializeFirebase(): Promise<void>;
+export declare function authenticateToFirebase(identity: Identity): Promise<UserCredential>;
 export declare const collection: <T>(path: string, ...pathSegments: string[]) => CollectionReference<T, import("@firebase/firestore").DocumentData>;
 export declare const doc: <T>(path: string) => DocumentReference<T, import("@firebase/firestore").DocumentData>;
-export declare const publicDoc: <T>(path: string) => DocumentReference<T, import("@firebase/firestore").DocumentData>;
+export declare const bootstrapDoc: <T>(path: string) => DocumentReference<T, import("@firebase/firestore").DocumentData>;
 /** Ensures that Firestore is shutdown at command termination
  *
  * This prevents Firestore from holding the command on execution completion or failure.

package/dist/drivers/firestore.js

@@ -9,7 +9,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.fsShutdownGuard = exports.publicDoc = exports.doc = exports.collection = exports.authenticateToFirebase = exports.initializeFirebase = void 0;
+exports.fsShutdownGuard = exports.bootstrapDoc = exports.doc = exports.collection = exports.authenticateToFirebase = exports.initializeFirebase = void 0;
 const config_1 = require("./config");
 const env_1 = require("./env");
 const app_1 = require("firebase/app");
@@ -20,9 +20,13 @@ const bootstrapFirestore = (0, firestore_1.getFirestore)(bootstrapApp);
 let app;
 let firestore;
 function initializeFirebase() {
-    const tenantConfig = (0, config_1.getTenantConfig)();
-    app = (0, app_1.initializeApp)(tenantConfig.fs, "authFirebase");
-    firestore = (0, firestore_1.getFirestore)(app);
+    return __awaiter(this, void 0, void 0, function* () {
+        if (!firestore) {
+            const tenantConfig = yield (0, config_1.loadConfig)();
+            app = (0, app_1.initializeApp)(tenantConfig.fs, "authFirebase");
+            firestore = (0, firestore_1.getFirestore)(app);
+        }
+    });
 }
 exports.initializeFirebase = initializeFirebase;
 function authenticateToFirebase(identity) {
@@ -30,6 +34,7 @@ function authenticateToFirebase(identity) {
     return __awaiter(this, void 0, void 0, function* () {
         const { credential } = identity;
         const tenantId = identity.org.tenantId;
+        yield initializeFirebase();
         // TODO: Move to map lookup
         const provider = new auth_1.OAuthProvider(identity.org.ssoProvider === "google"
             ? auth_1.SignInMethod.GOOGLE
@@ -56,10 +61,10 @@ const doc = (path) => {
     return (0, firestore_1.doc)(firestore, path);
 };
 exports.doc = doc;
-const publicDoc = (path) => {
+const bootstrapDoc = (path) => {
     return (0, firestore_1.doc)(bootstrapFirestore, path);
 };
-exports.publicDoc = publicDoc;
+exports.bootstrapDoc = bootstrapDoc;
 /** Ensures that Firestore is shutdown at command termination
  *
  * This prevents Firestore from holding the command on execution completion or failure.

package/dist/drivers/firestore.js.map

@@ -1 +1 @@
-{"version":3,"file":"firestore.js","sourceRoot":"","sources":["../../src/drivers/firestore.ts"],"names":[],"mappings":";;;;;;;;;;;;AAWA,qCAA2C;AAC3C,+BAAwC;AACxC,sCAA0D;AAC1D,wCAKuB;AACvB,kDAQ4B;AAE5B,MAAM,YAAY,GAAG,IAAA,mBAAa,EAAC,qBAAe,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC;AACvE,MAAM,kBAAkB,GAAG,IAAA,wBAAY,EAAC,YAAY,CAAC,CAAC;AAEtD,IAAI,GAAgB,CAAC;AACrB,IAAI,SAAoB,CAAC;AAEzB,SAAgB,kBAAkB;IAChC,MAAM,YAAY,GAAG,IAAA,wBAAe,GAAE,CAAC;IACvC,GAAG,GAAG,IAAA,mBAAa,EAAC,YAAY,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC;IACrD,SAAS,GAAG,IAAA,wBAAY,EAAC,GAAG,CAAC,CAAC;AAChC,CAAC;AAJD,gDAIC;AAED,SAAsB,sBAAsB,CAAC,QAAkB;;;QAC7D,MAAM,EAAE,UAAU,EAAE,GAAG,QAAQ,CAAC;QAChC,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC;QAEvC,2BAA2B;QAC3B,MAAM,QAAQ,GAAG,IAAI,oBAAa,CAChC,QAAQ,CAAC,GAAG,CAAC,WAAW,KAAK,QAAQ;YACnC,CAAC,CAAC,mBAAY,CAAC,MAAM;YACrB,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAC5B,CAAC;QAEF,MAAM,kBAAkB,GAAG,QAAQ,CAAC,UAAU,CAAC;YAC7C,WAAW,EAAE,UAAU,CAAC,YAAY;YACpC,OAAO,EAAE,UAAU,CAAC,QAAQ;SAC7B,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,IAAA,cAAO,EAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAEzB,MAAM,cAAc,GAAG,MAAM,IAAA,2BAAoB,EAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;QAE5E,IAAI,CAAC,CAAA,MAAA,cAAc,aAAd,cAAc,uBAAd,cAAc,CAAE,IAAI,0CAAE,KAAK,CAAA,EAAE;YAChC,MAAM,6IAA6I,CAAC;SACrJ;QAED,OAAO,cAAc,CAAC;;CACvB;AA1BD,wDA0BC;AAEM,MAAM,UAAU,GAAG,CAAI,IAAY,EAAE,GAAG,YAAsB,EAAE,EAAE;IACvE,OAAO,IAAA,sBAAY,EACjB,SAAS,EACT,IAAI,EACJ,GAAG,YAAY,CACU,CAAC;AAC9B,CAAC,CAAC;AANW,QAAA,UAAU,cAMrB;AAEK,MAAM,GAAG,GAAG,CAAI,IAAY,EAAE,EAAE;IACrC,OAAO,IAAA,eAAK,EAAC,SAAS,EAAE,IAAI,CAAyB,CAAC;AACxD,CAAC,CAAC;AAFW,QAAA,GAAG,OAEd;AAEK,MAAM,SAAS,GAAG,CAAI,IAAY,EAAE,EAAE;IAC3C,OAAO,IAAA,eAAK,EAAC,kBAAkB,EAAE,IAAI,CAAyB,CAAC;AACjE,CAAC,CAAC;AAFW,QAAA,SAAS,aAEpB;AAEF;;;GAGG;AACI,MAAM,eAAe,GAC1B,CAAO,EAA2B,EAAE,EAAE,CACtC,CAAO,IAAO,EAAE,EAAE;IAChB,IAAI;QACF,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;KAChB;YAAS;QACR,IAAI,kBAAkB;YAAE,KAAK,IAAA,qBAAS,EAAC,kBAAkB,CAAC,CAAC;QAC3D,IAAI,SAAS;YAAE,KAAK,IAAA,qBAAS,EAAC,SAAS,CAAC,CAAC;KAC1C;AACH,CAAC,CAAA,CAAC;AATS,QAAA,eAAe,mBASxB"}
+{"version":3,"file":"firestore.js","sourceRoot":"","sources":["../../src/drivers/firestore.ts"],"names":[],"mappings":";;;;;;;;;;;;AAWA,qCAAsC;AACtC,+BAAwC;AACxC,sCAA0D;AAC1D,wCAMuB;AACvB,kDAQ4B;AAE5B,MAAM,YAAY,GAAG,IAAA,mBAAa,EAAC,qBAAe,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC;AACvE,MAAM,kBAAkB,GAAG,IAAA,wBAAY,EAAC,YAAY,CAAC,CAAC;AAEtD,IAAI,GAAgB,CAAC;AACrB,IAAI,SAAoB,CAAC;AAEzB,SAAsB,kBAAkB;;QACtC,IAAI,CAAC,SAAS,EAAE;YACd,MAAM,YAAY,GAAG,MAAM,IAAA,mBAAU,GAAE,CAAC;YACxC,GAAG,GAAG,IAAA,mBAAa,EAAC,YAAY,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC;YACrD,SAAS,GAAG,IAAA,wBAAY,EAAC,GAAG,CAAC,CAAC;SAC/B;IACH,CAAC;CAAA;AAND,gDAMC;AAED,SAAsB,sBAAsB,CAC1C,QAAkB;;;QAElB,MAAM,EAAE,UAAU,EAAE,GAAG,QAAQ,CAAC;QAChC,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC;QAEvC,MAAM,kBAAkB,EAAE,CAAC;QAE3B,2BAA2B;QAC3B,MAAM,QAAQ,GAAG,IAAI,oBAAa,CAChC,QAAQ,CAAC,GAAG,CAAC,WAAW,KAAK,QAAQ;YACnC,CAAC,CAAC,mBAAY,CAAC,MAAM;YACrB,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAC5B,CAAC;QAEF,MAAM,kBAAkB,GAAG,QAAQ,CAAC,UAAU,CAAC;YAC7C,WAAW,EAAE,UAAU,CAAC,YAAY;YACpC,OAAO,EAAE,UAAU,CAAC,QAAQ;SAC7B,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,IAAA,cAAO,EAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAEzB,MAAM,cAAc,GAAG,MAAM,IAAA,2BAAoB,EAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;QAE5E,IAAI,CAAC,CAAA,MAAA,cAAc,aAAd,cAAc,uBAAd,cAAc,CAAE,IAAI,0CAAE,KAAK,CAAA,EAAE;YAChC,MAAM,6IAA6I,CAAC;SACrJ;QAED,OAAO,cAAc,CAAC;;CACvB;AA9BD,wDA8BC;AAEM,MAAM,UAAU,GAAG,CAAI,IAAY,EAAE,GAAG,YAAsB,EAAE,EAAE;IACvE,OAAO,IAAA,sBAAY,EACjB,SAAS,EACT,IAAI,EACJ,GAAG,YAAY,CACU,CAAC;AAC9B,CAAC,CAAC;AANW,QAAA,UAAU,cAMrB;AAEK,MAAM,GAAG,GAAG,CAAI,IAAY,EAAE,EAAE;IACrC,OAAO,IAAA,eAAK,EAAC,SAAS,EAAE,IAAI,CAAyB,CAAC;AACxD,CAAC,CAAC;AAFW,QAAA,GAAG,OAEd;AAEK,MAAM,YAAY,GAAG,CAAI,IAAY,EAAE,EAAE;IAC9C,OAAO,IAAA,eAAK,EAAC,kBAAkB,EAAE,IAAI,CAAyB,CAAC;AACjE,CAAC,CAAC;AAFW,QAAA,YAAY,gBAEvB;AAEF;;;GAGG;AACI,MAAM,eAAe,GAC1B,CAAO,EAA2B,EAAE,EAAE,CACtC,CAAO,IAAO,EAAE,EAAE;IAChB,IAAI;QACF,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;KAChB;YAAS;QACR,IAAI,kBAAkB;YAAE,KAAK,IAAA,qBAAS,EAAC,kBAAkB,CAAC,CAAC;QAC3D,IAAI,SAAS;YAAE,KAAK,IAAA,qBAAS,EAAC,SAAS,CAAC,CAAC;KAC1C;AACH,CAAC,CAAA,CAAC;AATS,QAAA,eAAe,mBASxB"}

package/dist/plugins/aws/ssh.js

@@ -55,6 +55,7 @@ exports.awsSshProvider = {
                 ? yield (0, aws_1.assumeRoleWithOktaSaml)(authn, request)
                 : (0, util_1.throwAssertNever)(config.login);
     }),
+    validateSshKey: (request, publicKey) => request.permission.publicKey === publicKey,
     ensureInstall: () => __awaiter(void 0, void 0, void 0, function* () {
         if (!(yield (0, install_1.ensureSsmInstall)())) {
             throw "Please try again after installing the required AWS utilities";
@@ -89,10 +90,10 @@ exports.awsSshProvider = {
     },
     requestToSsh: (request) => {
         const { permission, generated } = request;
-        const { awsResourcePermission, instanceId, accountId, region } = permission.spec;
-        const { idcId, idcRegion } = awsResourcePermission.permission;
-        const { ssh, name } = generated;
-        const { linuxUserName } = ssh;
+        const { resource, region } = permission;
+        const { idcId, idcRegion, instanceId, accountId } = resource;
+        const { linuxUserName, resource: generatedResource } = generated;
+        const { name } = generatedResource;
         const common = { linuxUserName, accountId, region, id: instanceId };
         return !idcId || !idcRegion
             ? Object.assign(Object.assign({}, common), { role: name, type: "aws", access: "role" }) : Object.assign(Object.assign({}, common), { idc: { id: idcId, region: idcRegion }, permissionSet: name, type: "aws", access: "idc" });

package/dist/plugins/aws/ssh.js.map

@@ -1 +1 @@
-{"version":3,"file":"ssh.js","sourceRoot":"","sources":["../../../src/plugins/aws/ssh.ts"],"names":[],"mappings":";;;;;;;;;;;;AAWA,qCAA8C;AAC9C,qCAAqD;AACrD,qCAAwC;AACxC,+BAA0C;AAC1C,2CAAiD;AASjD,MAAM,4BAA4B,GAAG,EAAE,GAAG,IAAI,CAAC;AAE/C,iGAAiG;AACjG,MAAM,+BAA+B,GAAG,qBAAqB,CAAC;AAE9D;;;;;;GAMG;AACH,MAAM,2BAA2B,GAAG;IAClC,kFAAkF;IAClF,sFAAsF;IACtF;QACE,OAAO,EACL,0RAA0R;KAC7R;IACD;;;;;;OAMG;IACH;QACE,OAAO,EAAE,kEAAkE;KAC5E;CACO,CAAC;AAEE,QAAA,cAAc,GAKvB;IACF,kBAAkB,EAAE,CAAO,KAAK,EAAE,OAAO,EAAE,EAAE;;QAC3C,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAA,qBAAY,EAAC,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAChE,IAAI,CAAC,CAAA,MAAA,MAAM,CAAC,KAAK,0CAAE,IAAI,CAAA,IAAI,CAAA,MAAA,MAAM,CAAC,KAAK,0CAAE,IAAI,MAAK,KAAK,EAAE;YACvD,MAAM,8DAA8D,CAAC;SACtE;QAED,OAAO,CAAA,MAAA,MAAM,CAAC,KAAK,0CAAE,IAAI,MAAK,KAAK;YACjC,CAAC,CAAC,MAAM,IAAA,uBAAiB,EAAC,OAA2B,CAAC;YACtD,CAAC,CAAC,CAAA,MAAA,MAAM,CAAC,KAAK,0CAAE,IAAI,MAAK,WAAW;gBAClC,CAAC,CAAC,MAAM,IAAA,4BAAsB,EAAC,KAAK,EAAE,OAA4B,CAAC;gBACnE,CAAC,CAAC,IAAA,uBAAgB,EAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvC,CAAC,CAAA;IAED,aAAa,EAAE,GAAS,EAAE;QACxB,IAAI,CAAC,CAAC,MAAM,IAAA,0BAAgB,GAAE,CAAC,EAAE;YAC/B,MAAM,8DAA8D,CAAC;SACtE;IACH,CAAC,CAAA;IAED,YAAY,EAAE,KAAK;IAEnB,oBAAoB,EAAE,4BAA4B;IAElD,4BAA4B,EAAE,GAAG,EAAE,CAAC,SAAS;IAE7C,YAAY,EAAE,CAAC,OAAO,EAAE,EAAE;QACxB,OAAO;YACL,KAAK;YACL,KAAK;YACL,eAAe;YACf,UAAU;YACV,OAAO,CAAC,MAAM;YACd,UAAU;YACV,IAAI;YACJ,iBAAiB;YACjB,+BAA+B;YAC/B,cAAc;YACd,iBAAiB;SAClB,CAAC;IACJ,CAAC;IAED,aAAa,EAAE,CAAC,OAAO,EAAE,EAAE;QACzB,0CAA0C;QAC1C,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE;YAC5B,OAAO;gBACL,6BAA6B,OAAO,CAAC,IAAI,cAAc,OAAO,CAAC,SAAS,GAAG;aAC5E,CAAC;SACH;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,YAAY,EAAE,CAAC,OAAO,EAAE,EAAE;QACxB,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;QAC1C,MAAM,EAAE,qBAAqB,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,GAC5D,UAAU,CAAC,IAAI,CAAC;QAClB,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,qBAAqB,CAAC,UAAU,CAAC;QAC9D,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,SAAS,CAAC;QAChC,MAAM,EAAE,aAAa,EAAE,GAAG,GAAG,CAAC;QAC9B,MAAM,MAAM,GAAG,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC;QACpE,OAAO,CAAC,KAAK,IAAI,CAAC,SAAS;YACzB,CAAC,iCAAM,MAAM,KAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,IACtD,CAAC,iCACM,MAAM,KACT,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,EACrC,aAAa,EAAE,IAAI,EACnB,IAAI,EAAE,KAAK,EACX,MAAM,EAAE,KAAK,GACd,CAAC;IACR,CAAC;IAED,YAAY,EAAE,CAAO,OAAO,EAAE,EAAE,kDAAC,OAAA,iCAAM,OAAO,KAAE,YAAY,EAAE,SAAS,IAAG,CAAA,GAAA;IAE1E,2BAA2B;CAC5B,CAAC"}
+{"version":3,"file":"ssh.js","sourceRoot":"","sources":["../../../src/plugins/aws/ssh.ts"],"names":[],"mappings":";;;;;;;;;;;;AAWA,qCAA8C;AAC9C,qCAAqD;AACrD,qCAAwC;AACxC,+BAA0C;AAC1C,2CAAiD;AASjD,MAAM,4BAA4B,GAAG,EAAE,GAAG,IAAI,CAAC;AAE/C,iGAAiG;AACjG,MAAM,+BAA+B,GAAG,qBAAqB,CAAC;AAE9D;;;;;;GAMG;AACH,MAAM,2BAA2B,GAAG;IAClC,kFAAkF;IAClF,sFAAsF;IACtF;QACE,OAAO,EACL,0RAA0R;KAC7R;IACD;;;;;;OAMG;IACH;QACE,OAAO,EAAE,kEAAkE;KAC5E;CACO,CAAC;AAEE,QAAA,cAAc,GAKvB;IACF,kBAAkB,EAAE,CAAO,KAAK,EAAE,OAAO,EAAE,EAAE;;QAC3C,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAA,qBAAY,EAAC,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAChE,IAAI,CAAC,CAAA,MAAA,MAAM,CAAC,KAAK,0CAAE,IAAI,CAAA,IAAI,CAAA,MAAA,MAAM,CAAC,KAAK,0CAAE,IAAI,MAAK,KAAK,EAAE;YACvD,MAAM,8DAA8D,CAAC;SACtE;QAED,OAAO,CAAA,MAAA,MAAM,CAAC,KAAK,0CAAE,IAAI,MAAK,KAAK;YACjC,CAAC,CAAC,MAAM,IAAA,uBAAiB,EAAC,OAA2B,CAAC;YACtD,CAAC,CAAC,CAAA,MAAA,MAAM,CAAC,KAAK,0CAAE,IAAI,MAAK,WAAW;gBAClC,CAAC,CAAC,MAAM,IAAA,4BAAsB,EAAC,KAAK,EAAE,OAA4B,CAAC;gBACnE,CAAC,CAAC,IAAA,uBAAgB,EAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvC,CAAC,CAAA;IAED,cAAc,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,CACrC,OAAO,CAAC,UAAU,CAAC,SAAS,KAAK,SAAS;IAE5C,aAAa,EAAE,GAAS,EAAE;QACxB,IAAI,CAAC,CAAC,MAAM,IAAA,0BAAgB,GAAE,CAAC,EAAE;YAC/B,MAAM,8DAA8D,CAAC;SACtE;IACH,CAAC,CAAA;IAED,YAAY,EAAE,KAAK;IAEnB,oBAAoB,EAAE,4BAA4B;IAElD,4BAA4B,EAAE,GAAG,EAAE,CAAC,SAAS;IAE7C,YAAY,EAAE,CAAC,OAAO,EAAE,EAAE;QACxB,OAAO;YACL,KAAK;YACL,KAAK;YACL,eAAe;YACf,UAAU;YACV,OAAO,CAAC,MAAM;YACd,UAAU;YACV,IAAI;YACJ,iBAAiB;YACjB,+BAA+B;YAC/B,cAAc;YACd,iBAAiB;SAClB,CAAC;IACJ,CAAC;IAED,aAAa,EAAE,CAAC,OAAO,EAAE,EAAE;QACzB,0CAA0C;QAC1C,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE;YAC5B,OAAO;gBACL,6BAA6B,OAAO,CAAC,IAAI,cAAc,OAAO,CAAC,SAAS,GAAG;aAC5E,CAAC;SACH;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,YAAY,EAAE,CAAC,OAAO,EAAE,EAAE;QACxB,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;QAC1C,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC;QACxC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,QAAQ,CAAC;QAC7D,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,iBAAiB,EAAE,GAAG,SAAS,CAAC;QACjE,MAAM,EAAE,IAAI,EAAE,GAAG,iBAAiB,CAAC;QACnC,MAAM,MAAM,GAAG,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC;QACpE,OAAO,CAAC,KAAK,IAAI,CAAC,SAAS;YACzB,CAAC,iCAAM,MAAM,KAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,IACtD,CAAC,iCACM,MAAM,KACT,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,EACrC,aAAa,EAAE,IAAI,EACnB,IAAI,EAAE,KAAK,EACX,MAAM,EAAE,KAAK,GACd,CAAC;IACR,CAAC;IAED,YAAY,EAAE,CAAO,OAAO,EAAE,EAAE,kDAAC,OAAA,iCAAM,OAAO,KAAE,YAAY,EAAE,SAAS,IAAG,CAAA,GAAA;IAE1E,2BAA2B;CAC5B,CAAC"}

package/dist/plugins/aws/types.d.ts

@@ -53,26 +53,26 @@ export type AwsItem = {
 export type AwsConfig = {
     "iam-write": Record<string, AwsItemConfig>;
 };
-export type AwsSshPermission = {
-    spec: CommonSshPermissionSpec & {
-        instanceId: string;
+export type AwsSshPermission = CommonSshPermissionSpec & {
+    provider: "aws";
+    region: string;
+    alias: string;
+    resource: {
+        account: string;
         accountId: string;
-        region: string;
-        type: "aws";
-        awsResourcePermission: {
-            permission: {
-                idcId?: string;
-                idcRegion?: string;
-            };
-        };
+        arn: string;
+        idcId: string;
+        idcRegion: string;
+        instanceId: string;
+        name: string;
+        userName: string;
     };
-    type: "session";
 };
 export type AwsSshGenerated = {
-    name: string;
-    ssh: {
-        linuxUserName: string;
+    resource: {
+        name: string;
     };
+    linuxUserName: string;
 };
 export type AwsSshPermissionSpec = PermissionSpec<"ssh", AwsSshPermission, AwsSshGenerated>;
 export type AwsSsh = CliPermissionSpec<AwsSshPermissionSpec, undefined>;

package/dist/plugins/azure/auth.d.ts

@@ -0,0 +1,11 @@
+export declare const azLoginCommand: () => {
+    command: string;
+    args: string[];
+};
+export declare const azAccountSetCommand: (subscriptionId: string) => {
+    command: string;
+    args: string[];
+};
+export declare const azLogin: (subscriptionId: string, options?: {
+    debug?: boolean;
+}) => Promise<void>;

package/dist/plugins/azure/auth.js

@@ -0,0 +1,56 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.azLogin = exports.azAccountSetCommand = exports.azLoginCommand = void 0;
+/** Copyright © 2024-present P0 Security
+
+This file is part of @p0security/cli
+
+@p0security/cli is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, version 3 of the License.
+
+@p0security/cli is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License along with @p0security/cli. If not, see <https://www.gnu.org/licenses/>.
+**/
+const stdio_1 = require("../../drivers/stdio");
+const util_1 = require("../../util");
+const azLoginCommand = () => ({
+    command: "az",
+    args: ["login"],
+});
+exports.azLoginCommand = azLoginCommand;
+const azAccountSetCommand = (subscriptionId) => ({
+    command: "az",
+    args: ["account", "set", "--subscription", subscriptionId],
+});
+exports.azAccountSetCommand = azAccountSetCommand;
+const azLogin = (subscriptionId, options = {}) => __awaiter(void 0, void 0, void 0, function* () {
+    const { debug } = options;
+    if (debug)
+        (0, stdio_1.print2)("Logging in to Azure...");
+    const { command: azLoginExe, args: azLoginArgs } = (0, exports.azLoginCommand)();
+    const loginResult = yield (0, util_1.exec)(azLoginExe, azLoginArgs, { check: true });
+    if (debug) {
+        (0, stdio_1.print2)(loginResult.stdout);
+        (0, stdio_1.print2)(loginResult.stderr);
+        (0, stdio_1.print2)(`Setting active Azure subscription to ${subscriptionId}...`);
+    }
+    const { command: azAccountSetExe, args: azAccountSetArgs } = (0, exports.azAccountSetCommand)(subscriptionId);
+    const accountSetResult = yield (0, util_1.exec)(azAccountSetExe, azAccountSetArgs, {
+        check: true,
+    });
+    if (debug) {
+        (0, stdio_1.print2)(accountSetResult.stdout);
+        (0, stdio_1.print2)(accountSetResult.stderr);
+    }
+});
+exports.azLogin = azLogin;
+//# sourceMappingURL=auth.js.map

package/dist/plugins/azure/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/plugins/azure/auth.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA;;;;;;;;;GASG;AACH,+CAA6C;AAC7C,qCAAkC;AAE3B,MAAM,cAAc,GAAG,GAAG,EAAE,CAAC,CAAC;IACnC,OAAO,EAAE,IAAI;IACb,IAAI,EAAE,CAAC,OAAO,CAAC;CAChB,CAAC,CAAC;AAHU,QAAA,cAAc,kBAGxB;AAEI,MAAM,mBAAmB,GAAG,CAAC,cAAsB,EAAE,EAAE,CAAC,CAAC;IAC9D,OAAO,EAAE,IAAI;IACb,IAAI,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,gBAAgB,EAAE,cAAc,CAAC;CAC3D,CAAC,CAAC;AAHU,QAAA,mBAAmB,uBAG7B;AAEI,MAAM,OAAO,GAAG,CACrB,cAAsB,EACtB,UAA+B,EAAE,EACjC,EAAE;IACF,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;IAE1B,IAAI,KAAK;QAAE,IAAA,cAAM,EAAC,wBAAwB,CAAC,CAAC;IAE5C,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,IAAA,sBAAc,GAAE,CAAC;IACpE,MAAM,WAAW,GAAG,MAAM,IAAA,WAAI,EAAC,UAAU,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAEzE,IAAI,KAAK,EAAE;QACT,IAAA,cAAM,EAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAC3B,IAAA,cAAM,EAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAC3B,IAAA,cAAM,EAAC,wCAAwC,cAAc,KAAK,CAAC,CAAC;KACrE;IAED,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,gBAAgB,EAAE,GACxD,IAAA,2BAAmB,EAAC,cAAc,CAAC,CAAC;IACtC,MAAM,gBAAgB,GAAG,MAAM,IAAA,WAAI,EAAC,eAAe,EAAE,gBAAgB,EAAE;QACrE,KAAK,EAAE,IAAI;KACZ,CAAC,CAAC;IAEH,IAAI,KAAK,EAAE;QACT,IAAA,cAAM,EAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAChC,IAAA,cAAM,EAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;KACjC;AACH,CAAC,CAAA,CAAC;AA3BW,QAAA,OAAO,WA2BlB"}

package/dist/plugins/azure/install.d.ts

@@ -0,0 +1 @@
+export declare const ensureAzInstall: () => Promise<boolean>;

package/dist/plugins/azure/install.js

@@ -0,0 +1,33 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ensureAzInstall = void 0;
+/** Copyright © 2024-present P0 Security
+
+This file is part of @p0security/cli
+
+@p0security/cli is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, version 3 of the License.
+
+@p0security/cli is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License along with @p0security/cli. If not, see <https://www.gnu.org/licenses/>.
+**/
+const install_1 = require("../../common/install");
+const AzItems = [...install_1.HomebrewItems, "az"];
+const AzInstall = Object.assign(Object.assign({}, install_1.HomebrewInstall), { az: {
+        label: "Azure command-line interface",
+        commands: {
+            darwin: ["brew update", "brew install azure-cli"],
+        },
+    } });
+const ensureAzInstall = () => __awaiter(void 0, void 0, void 0, function* () { return yield (0, install_1.ensureInstall)(AzItems, AzInstall); });
+exports.ensureAzInstall = ensureAzInstall;
+//# sourceMappingURL=install.js.map

package/dist/plugins/azure/install.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"install.js","sourceRoot":"","sources":["../../../src/plugins/azure/install.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA;;;;;;;;;GASG;AACH,kDAK8B;AAE9B,MAAM,OAAO,GAAG,CAAC,GAAG,uBAAa,EAAE,IAAI,CAAU,CAAC;AAGlD,MAAM,SAAS,mCACV,yBAAe,KAClB,EAAE,EAAE;QACF,KAAK,EAAE,8BAA8B;QACrC,QAAQ,EAAE;YACR,MAAM,EAAE,CAAC,aAAa,EAAE,wBAAwB,CAAC;SAClD;KACF,GACF,CAAC;AAEK,MAAM,eAAe,GAAG,GAAS,EAAE,kDACxC,OAAA,MAAM,IAAA,uBAAa,EAAC,OAAO,EAAE,SAAS,CAAC,CAAA,GAAA,CAAC;AAD7B,QAAA,eAAe,mBACc"}

package/dist/plugins/azure/keygen.d.ts

@@ -0,0 +1,13 @@
+export declare const AD_CERT_FILENAME = "p0cli-azure-ad-ssh-cert.pub";
+export declare const AD_SSH_KEY_PRIVATE = "id_rsa";
+export declare const azSshCertCommand: (keyPath: string) => {
+    command: string;
+    args: string[];
+};
+export declare const createTempDirectoryForKeys: () => Promise<{
+    path: string;
+    cleanup: () => Promise<void>;
+}>;
+export declare const generateSshKeyAndAzureAdCert: (keyPath: string, options?: {
+    debug?: boolean;
+}) => Promise<void>;

package/dist/plugins/azure/keygen.js

@@ -0,0 +1,69 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.generateSshKeyAndAzureAdCert = exports.createTempDirectoryForKeys = exports.azSshCertCommand = exports.AD_SSH_KEY_PRIVATE = exports.AD_CERT_FILENAME = void 0;
+/** Copyright © 2024-present P0 Security
+
+This file is part of @p0security/cli
+
+@p0security/cli is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, version 3 of the License.
+
+@p0security/cli is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License along with @p0security/cli. If not, see <https://www.gnu.org/licenses/>.
+**/
+const stdio_1 = require("../../drivers/stdio");
+const util_1 = require("../../util");
+const node_path_1 = __importDefault(require("node:path"));
+const tmp_promise_1 = __importDefault(require("tmp-promise"));
+// We pass in the name of the certificate file to generate
+exports.AD_CERT_FILENAME = "p0cli-azure-ad-ssh-cert.pub";
+// The `az ssh cert` command manages key generation, and generates SSH RSA keys with the standard names
+exports.AD_SSH_KEY_PRIVATE = "id_rsa";
+const azSshCertCommand = (keyPath) => ({
+    command: "az",
+    args: ["ssh", "cert", "--file", node_path_1.default.join(keyPath, exports.AD_CERT_FILENAME)],
+});
+exports.azSshCertCommand = azSshCertCommand;
+const createTempDirectoryForKeys = () => __awaiter(void 0, void 0, void 0, function* () {
+    // unsafeCleanup lets us delete the directory even if there are still files in it, which is fine since the
+    // files are no longer needed once we've authenticated to the remote system.
+    const { path, cleanup } = yield tmp_promise_1.default.dir({
+        mode: 0o700,
+        prefix: "p0cli-",
+        unsafeCleanup: true,
+    });
+    return { path, cleanup };
+});
+exports.createTempDirectoryForKeys = createTempDirectoryForKeys;
+const generateSshKeyAndAzureAdCert = (keyPath, options = {}) => __awaiter(void 0, void 0, void 0, function* () {
+    const { debug } = options;
+    if (debug)
+        (0, stdio_1.print2)("Generating Azure AD SSH certificate...");
+    try {
+        const { command, args } = (0, exports.azSshCertCommand)(keyPath);
+        const { stdout, stderr } = yield (0, util_1.exec)(command, args, { check: true });
+        if (debug) {
+            (0, stdio_1.print2)(stdout);
+            (0, stdio_1.print2)(stderr);
+        }
+    }
+    catch (error) {
+        (0, stdio_1.print2)(error.stdout);
+        (0, stdio_1.print2)(error.stderr);
+        throw `Failed to generate Azure AD SSH certificate: ${error}`;
+    }
+});
+exports.generateSshKeyAndAzureAdCert = generateSshKeyAndAzureAdCert;
+//# sourceMappingURL=keygen.js.map

package/dist/plugins/azure/keygen.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keygen.js","sourceRoot":"","sources":["../../../src/plugins/azure/keygen.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA;;;;;;;;;GASG;AACH,+CAA6C;AAC7C,qCAAkC;AAClC,0DAA6B;AAC7B,8DAA8B;AAE9B,0DAA0D;AAC7C,QAAA,gBAAgB,GAAG,6BAA6B,CAAC;AAE9D,uGAAuG;AAC1F,QAAA,kBAAkB,GAAG,QAAQ,CAAC;AAEpC,MAAM,gBAAgB,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,CAAC;IACpD,OAAO,EAAE,IAAI;IACb,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,mBAAI,CAAC,IAAI,CAAC,OAAO,EAAE,wBAAgB,CAAC,CAAC;CACtE,CAAC,CAAC;AAHU,QAAA,gBAAgB,oBAG1B;AAEI,MAAM,0BAA0B,GAAG,GAGvC,EAAE;IACH,0GAA0G;IAC1G,4EAA4E;IAC5E,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,qBAAG,CAAC,GAAG,CAAC;QACtC,IAAI,EAAE,KAAK;QACX,MAAM,EAAE,QAAQ;QAChB,aAAa,EAAE,IAAI;KACpB,CAAC,CAAC;IAEH,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC3B,CAAC,CAAA,CAAC;AAbW,QAAA,0BAA0B,8BAarC;AAEK,MAAM,4BAA4B,GAAG,CAC1C,OAAe,EACf,UAA+B,EAAE,EACjC,EAAE;IACF,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;IAE1B,IAAI,KAAK;QAAE,IAAA,cAAM,EAAC,wCAAwC,CAAC,CAAC;IAE5D,IAAI;QACF,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,IAAA,wBAAgB,EAAC,OAAO,CAAC,CAAC;QACpD,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAA,WAAI,EAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAEtE,IAAI,KAAK,EAAE;YACT,IAAA,cAAM,EAAC,MAAM,CAAC,CAAC;YACf,IAAA,cAAM,EAAC,MAAM,CAAC,CAAC;SAChB;KACF;IAAC,OAAO,KAAU,EAAE;QACnB,IAAA,cAAM,EAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACrB,IAAA,cAAM,EAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACrB,MAAM,gDAAgD,KAAK,EAAE,CAAC;KAC/D;AACH,CAAC,CAAA,CAAC;AArBW,QAAA,4BAA4B,gCAqBvC"}

package/dist/plugins/azure/ssh.d.ts

@@ -0,0 +1,13 @@
+/** Copyright © 2024-present P0 Security
+
+This file is part of @p0security/cli
+
+@p0security/cli is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, version 3 of the License.
+
+@p0security/cli is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License along with @p0security/cli. If not, see <https://www.gnu.org/licenses/>.
+**/
+import { SshProvider } from "../../types/ssh";
+import { AzureLocalData, AzureSshPermissionSpec, AzureSshRequest } from "./types";
+export declare const azureSshProvider: SshProvider<AzureSshPermissionSpec, AzureLocalData, AzureSshRequest>;

package/dist/plugins/azure/ssh.js

@@ -0,0 +1,124 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.azureSshProvider = void 0;
+const auth_1 = require("./auth");
+const install_1 = require("./install");
+const keygen_1 = require("./keygen");
+const tunnel_1 = require("./tunnel");
+const node_path_1 = __importDefault(require("node:path"));
+// TODO: Determine what this value should be for Azure
+const PROPAGATION_TIMEOUT_LIMIT_MS = 2 * 60 * 1000;
+exports.azureSshProvider = {
+    // TODO: Natively support Azure login in P0 CLI
+    cloudProviderLogin: () => __awaiter(void 0, void 0, void 0, function* () {
+        // Login is handled as part of setup() below
+        return undefined;
+    }),
+    ensureInstall: () => __awaiter(void 0, void 0, void 0, function* () {
+        if (!(yield (0, install_1.ensureAzInstall)())) {
+            throw "Please try again after installing the Azure CLI tool.";
+        }
+    }),
+    friendlyName: "Microsoft Azure",
+    loginRequiredMessage: "Please log in to Azure with 'az login' to continue.",
+    // TODO: Determine value
+    loginRequiredPattern: undefined,
+    propagationTimeoutMs: PROPAGATION_TIMEOUT_LIMIT_MS,
+    // TODO(ENG-3149): Implement sudo access checks here
+    preTestAccessPropagationArgs: () => undefined,
+    // Azure doesn't support ProxyCommand, as nice as that would be. Yet.
+    proxyCommand: () => [],
+    reproCommands: (request, additionalData) => {
+        var _a;
+        const { command: azLoginExe, args: azLoginArgs } = (0, auth_1.azLoginCommand)();
+        const { command: azAccountSetExe, args: azAccountSetArgs } = (0, auth_1.azAccountSetCommand)(request.subscriptionId);
+        const getKeyPath = () => {
+            // Use the same key path as the one generated in setup() so it matches the ssh command that is generated
+            // elsewhere. It'll be an annoying long temporary directory name, but it strictly will work for reproduction. If
+            // additionalData isn't present (which it always should be for the azureSshProvider), we'll use the user's home
+            // directory.
+            if (additionalData) {
+                return node_path_1.default.dirname(additionalData.identityFile);
+            }
+            else {
+                const basePath = process.env.HOME || process.env.USERPROFILE || "";
+                return node_path_1.default.join(basePath, "p0cli-azure-ssh-keys");
+            }
+        };
+        const keyPath = getKeyPath();
+        const { command: azCertGenExe, args: azCertGenArgs } = (0, keygen_1.azSshCertCommand)(keyPath);
+        // If additionalData is undefined (which, again, should be never), use the default port for Azure Network Bastion
+        // tunnels instead of generating a random one
+        const { command: azTunnelExe, args: azTunnelArgs } = (0, tunnel_1.azBastionTunnelCommand)(request, (_a = additionalData === null || additionalData === void 0 ? void 0 : additionalData.port) !== null && _a !== void 0 ? _a : "50022", { debug: true } // reproCommands() is only invoked in debug mode, so this is a safe assumption
+        );
+        return [
+            `${azLoginExe} ${azLoginArgs.join(" ")}`,
+            `${azAccountSetExe} ${azAccountSetArgs.join(" ")}`,
+            `mkdir ${keyPath}`,
+            `${azCertGenExe} ${azCertGenArgs.join(" ")}`,
+            `${azTunnelExe} ${azTunnelArgs.join(" ")}`,
+        ];
+    },
+    setup: (request, options = {}) => __awaiter(void 0, void 0, void 0, function* () {
+        const { debug } = options;
+        // The subscription ID here is used to ensure that the user is logged in to the correct tenant/directory.
+        // As long as a subscription ID in the correct tenant is provided, this will work; it need not be the same
+        // subscription as which contains the Bastion host or the target VM.
+        yield (0, auth_1.azLogin)(request.subscriptionId, { debug }); // Always re-login to Azure CLI
+        const { path: keyPath, cleanup: sshKeyPathCleanup } = yield (0, keygen_1.createTempDirectoryForKeys)();
+        const wrappedCreateCertAndTunnel = () => __awaiter(void 0, void 0, void 0, function* () {
+            try {
+                yield (0, keygen_1.generateSshKeyAndAzureAdCert)(keyPath, { debug });
+                return yield (0, tunnel_1.trySpawnBastionTunnel)(request, { debug });
+            }
+            catch (error) {
+                yield sshKeyPathCleanup();
+                throw error;
+            }
+        });
+        const { killTunnel, tunnelLocalPort } = yield wrappedCreateCertAndTunnel();
+        const sshPrivateKeyPath = node_path_1.default.join(keyPath, keygen_1.AD_SSH_KEY_PRIVATE);
+        const sshCertificateKeyPath = node_path_1.default.join(keyPath, keygen_1.AD_CERT_FILENAME);
+        const teardown = () => __awaiter(void 0, void 0, void 0, function* () {
+            yield killTunnel();
+            yield sshKeyPathCleanup();
+        });
+        return {
+            sshOptions: [
+                `CertificateFile=${sshCertificateKeyPath}`,
+                // Because we connect to the Azure Network Bastion tunnel via a local port instead of a ProxyCommand, every
+                // instance connected to will appear to `ssh` to be the same host but presenting a different host key (i.e.,
+                // `ssh` always connects to localhost but each VM will present its own host key), which will trigger MITM attack
+                // warnings. We disable host key checking to avoid this. This is ordinarily very dangerous, but in this case,
+                // security of the connection is ensured by the Azure Bastion Network tunnel, which utilizes HTTPS and thus has
+                // its own MITM protection.
+                "StrictHostKeyChecking=no",
+                "UserKnownHostsFile=/dev/null",
+            ],
+            identityFile: sshPrivateKeyPath,
+            port: tunnelLocalPort,
+            teardown,
+        };
+    }),
+    requestToSsh: (request) => (Object.assign(Object.assign({ type: "azure", id: "localhost" }, request.cliLocalData), { instanceId: request.permission.resource.instanceId, subscriptionId: request.permission.resource.subscriptionId, instanceResourceGroup: request.permission.resource.resourceGroupId, bastionId: request.permission.bastionHostId })),
+    // TODO: Implement
+    unprovisionedAccessPatterns: [],
+    toCliRequest: (request) => __awaiter(void 0, void 0, void 0, function* () {
+        return Object.assign(Object.assign({}, request), { cliLocalData: {
+                linuxUserName: request.principal,
+            } });
+    }),
+};
+//# sourceMappingURL=ssh.js.map