@p0security/cli 0.13.2 → 0.13.4

package/README.md

@@ -16,7 +16,7 @@ Supports creating access requests for cloud resources, assuming AWS roles, and c
 - [Quickstart](#quickstart)
   - [Installation](#installation)
   - [Configuration](#configuration)
-- [Command Reference](#command-reference)
+- [Command Reference](#cli-reference)
 - [Example Usage](#example-usage)
 - [Support](#support)
 - [Contributing](#contributing)

package/dist/drivers/config.d.ts

@@ -10,6 +10,8 @@ You should have received a copy of the GNU General Public License along with @p0
 **/
 import { Config } from "../types/org";
 export declare const CONFIG_FILE_PATH: string;
-export declare function getTenantConfig(): Config;
-export declare function saveConfig(orgId: string): Promise<void>;
-export declare function loadConfig(): Promise<Config>;
+export declare const getTenantConfig: () => Config;
+/** Use only if the organization is configured with Google login to P0 */
+export declare const getGoogleTenantConfig: () => import("../types/org").GoogleApplicationConfig;
+export declare const saveConfig: (orgId: string) => Promise<void>;
+export declare const loadConfig: () => Promise<Config>;

package/dist/drivers/config.js

@@ -12,7 +12,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.loadConfig = exports.saveConfig = exports.getTenantConfig = exports.CONFIG_FILE_PATH = void 0;
+exports.loadConfig = exports.saveConfig = exports.getGoogleTenantConfig = exports.getTenantConfig = exports.CONFIG_FILE_PATH = void 0;
 const util_1 = require("../util");
 const env_1 = require("./env");
 const firestore_1 = require("./firestore");
@@ -22,32 +22,34 @@ const promises_1 = __importDefault(require("fs/promises"));
 const path_1 = __importDefault(require("path"));
 exports.CONFIG_FILE_PATH = path_1.default.join(util_1.P0_PATH, "config.json");
 let tenantConfig;
-function getTenantConfig() {
-    return tenantConfig;
-}
+const getTenantConfig = () => tenantConfig;
 exports.getTenantConfig = getTenantConfig;
-function saveConfig(orgId) {
+/** Use only if the organization is configured with Google login to P0 */
+const getGoogleTenantConfig = () => {
+    if ("google" in tenantConfig) {
+        return tenantConfig;
+    }
+    throw "Login failed!\nThis organization is configured to use Google login but the required OAuth client parameters are missing.\nPlease contact support@p0.dev to properly configure your organization login.";
+};
+exports.getGoogleTenantConfig = getGoogleTenantConfig;
+const saveConfig = (orgId) => __awaiter(void 0, void 0, void 0, function* () {
     var _a;
-    return __awaiter(this, void 0, void 0, function* () {
-        const orgDoc = yield (0, firestore_2.getDoc)((0, firestore_1.bootstrapDoc)(`orgs/${orgId}`));
-        const orgData = orgDoc.data();
-        if (!orgData)
-            throw "Could not find organization";
-        const config = (_a = orgData.config) !== null && _a !== void 0 ? _a : env_1.bootstrapConfig;
-        (0, stdio_1.print2)(`Saving config to ${exports.CONFIG_FILE_PATH}.`);
-        const dir = path_1.default.dirname(exports.CONFIG_FILE_PATH);
-        yield promises_1.default.mkdir(dir, { recursive: true });
-        yield promises_1.default.writeFile(exports.CONFIG_FILE_PATH, JSON.stringify(config), { mode: "600" });
-        tenantConfig = config;
-    });
-}
+    const orgDoc = yield (0, firestore_2.getDoc)((0, firestore_1.bootstrapDoc)(`orgs/${orgId}`));
+    const orgData = orgDoc.data();
+    if (!orgData)
+        throw "Could not find organization";
+    const config = (_a = orgData.config) !== null && _a !== void 0 ? _a : env_1.bootstrapConfig;
+    (0, stdio_1.print2)(`Saving config to ${exports.CONFIG_FILE_PATH}.`);
+    const dir = path_1.default.dirname(exports.CONFIG_FILE_PATH);
+    yield promises_1.default.mkdir(dir, { recursive: true });
+    yield promises_1.default.writeFile(exports.CONFIG_FILE_PATH, JSON.stringify(config), { mode: "600" });
+    tenantConfig = config;
+});
 exports.saveConfig = saveConfig;
-function loadConfig() {
-    return __awaiter(this, void 0, void 0, function* () {
-        const buffer = yield promises_1.default.readFile(exports.CONFIG_FILE_PATH);
-        tenantConfig = JSON.parse(buffer.toString());
-        return tenantConfig;
-    });
-}
+const loadConfig = () => __awaiter(void 0, void 0, void 0, function* () {
+    const buffer = yield promises_1.default.readFile(exports.CONFIG_FILE_PATH);
+    tenantConfig = JSON.parse(buffer.toString());
+    return tenantConfig;
+});
 exports.loadConfig = loadConfig;
 //# sourceMappingURL=config.js.map

package/dist/drivers/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/drivers/config.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAWA,kCAAkC;AAClC,+BAAwC;AACxC,2CAA2C;AAC3C,mCAAiC;AACjC,kDAA4C;AAC5C,2DAA6B;AAC7B,gDAAwB;AAEX,QAAA,gBAAgB,GAAG,cAAI,CAAC,IAAI,CAAC,cAAO,EAAE,aAAa,CAAC,CAAC;AAElE,IAAI,YAAoB,CAAC;AAEzB,SAAgB,eAAe;IAC7B,OAAO,YAAY,CAAC;AACtB,CAAC;AAFD,0CAEC;AAED,SAAsB,UAAU,CAAC,KAAa;;;QAC5C,MAAM,MAAM,GAAG,MAAM,IAAA,kBAAM,EACzB,IAAA,wBAAY,EAAC,QAAQ,KAAK,EAAE,CAAC,CAC9B,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAE9B,IAAI,CAAC,OAAO;YAAE,MAAM,6BAA6B,CAAC;QAElD,MAAM,MAAM,GAAG,MAAA,OAAO,CAAC,MAAM,mCAAI,qBAAe,CAAC;QAEjD,IAAA,cAAM,EAAC,oBAAoB,wBAAgB,GAAG,CAAC,CAAC;QAEhD,MAAM,GAAG,GAAG,cAAI,CAAC,OAAO,CAAC,wBAAgB,CAAC,CAAC;QAC3C,MAAM,kBAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,MAAM,kBAAE,CAAC,SAAS,CAAC,wBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAE9E,YAAY,GAAG,MAAM,CAAC;;CACvB;AAjBD,gCAiBC;AAED,SAAsB,UAAU;;QAC9B,MAAM,MAAM,GAAG,MAAM,kBAAE,CAAC,QAAQ,CAAC,wBAAgB,CAAC,CAAC;QACnD,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC7C,OAAO,YAAY,CAAC;IACtB,CAAC;CAAA;AAJD,gCAIC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/drivers/config.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAWA,kCAAkC;AAClC,+BAAwC;AACxC,2CAA2C;AAC3C,mCAAiC;AACjC,kDAA4C;AAC5C,2DAA6B;AAC7B,gDAAwB;AAEX,QAAA,gBAAgB,GAAG,cAAI,CAAC,IAAI,CAAC,cAAO,EAAE,aAAa,CAAC,CAAC;AAElE,IAAI,YAAoB,CAAC;AAElB,MAAM,eAAe,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC;AAArC,QAAA,eAAe,mBAAsB;AAElD,yEAAyE;AAClE,MAAM,qBAAqB,GAAG,GAAG,EAAE;IACxC,IAAI,QAAQ,IAAI,YAAY,EAAE;QAC5B,OAAO,YAAY,CAAC;KACrB;IACD,MAAM,wMAAwM,CAAC;AACjN,CAAC,CAAC;AALW,QAAA,qBAAqB,yBAKhC;AAEK,MAAM,UAAU,GAAG,CAAO,KAAa,EAAE,EAAE;;IAChD,MAAM,MAAM,GAAG,MAAM,IAAA,kBAAM,EACzB,IAAA,wBAAY,EAAC,QAAQ,KAAK,EAAE,CAAC,CAC9B,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAE9B,IAAI,CAAC,OAAO;QAAE,MAAM,6BAA6B,CAAC;IAElD,MAAM,MAAM,GAAG,MAAA,OAAO,CAAC,MAAM,mCAAI,qBAAe,CAAC;IAEjD,IAAA,cAAM,EAAC,oBAAoB,wBAAgB,GAAG,CAAC,CAAC;IAEhD,MAAM,GAAG,GAAG,cAAI,CAAC,OAAO,CAAC,wBAAgB,CAAC,CAAC;IAC3C,MAAM,kBAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,MAAM,kBAAE,CAAC,SAAS,CAAC,wBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAE9E,YAAY,GAAG,MAAM,CAAC;AACxB,CAAC,CAAA,CAAC;AAjBW,QAAA,UAAU,cAiBrB;AAEK,MAAM,UAAU,GAAG,GAAS,EAAE;IACnC,MAAM,MAAM,GAAG,MAAM,kBAAE,CAAC,QAAQ,CAAC,wBAAgB,CAAC,CAAC;IACnD,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC7C,OAAO,YAAY,CAAC;AACtB,CAAC,CAAA,CAAC;AAJW,QAAA,UAAU,cAIrB"}

package/dist/drivers/env.d.ts

@@ -9,7 +9,7 @@ export declare const bootstrapConfig: {
     };
     google: {
         clientId: string;
-        clientSecret: string;
+        publicClientSecretForPkce: string;
     };
     appUrl: string;
     environment: string;

package/dist/drivers/env.js

@@ -32,7 +32,13 @@ exports.bootstrapConfig = {
         clientId: (_g = env.P0_GOOGLE_OIDC_CLIENT_ID) !== null && _g !== void 0 ? _g : "228132571547-kilcq1er15hlbl6mitghttnacp7u58l8.apps.googleusercontent.com",
         // Despite the name, this is not actually "secret" in any sense of the word.
         // Instead, the client is protected by requiring PKCE and defining the redirect URIs.
-        clientSecret: (_h = env.P0_GOOGLE_OIDC_CLIENT_SECRET) !== null && _h !== void 0 ? _h : "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",
+        // PKCE achieves similar security guarantees for public clients with an on-the-fly
+        // generated secret (the code verifier) as the static secret does for confidential clients.
+        // See also: https://auth0.com/docs/get-started/authentication-and-authorization-flow/authorization-code-flow-with-pkce
+        // In the PKCE flow the client secret is an optional parameter, however, Google's
+        // implementation requires it. That's why the "secret" is present here.
+        // This "secret" is only used if the organization uses Google Workspace to log in to P0.
+        publicClientSecretForPkce: (_h = env.P0_GOOGLE_OIDC_CLIENT_SECRET) !== null && _h !== void 0 ? _h : "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",
     },
     appUrl: (_j = env.P0_APP_URL) !== null && _j !== void 0 ? _j : "https://api.p0.app",
     environment: (_k = env.P0_ENV) !== null && _k !== void 0 ? _k : "production",

package/dist/drivers/env.js.map

@@ -1 +1 @@
-{"version":3,"file":"env.js","sourceRoot":"","sources":["../../src/drivers/env.ts"],"names":[],"mappings":";;;;;;;AAAA;;;;;;;;;GASG;AACH,oDAA4B;AAE5B,gBAAM,CAAC,MAAM,EAAE,CAAC;AAEhB,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;AAEX,QAAA,eAAe,GAAG;IAC7B,EAAE,EAAE;QACF,wDAAwD;QACxD,MAAM,EAAE,MAAA,GAAG,CAAC,aAAa,mCAAI,yCAAyC;QACtE,UAAU,EAAE,MAAA,GAAG,CAAC,iBAAiB,mCAAI,yBAAyB;QAC9D,SAAS,EAAE,MAAA,GAAG,CAAC,gBAAgB,mCAAI,SAAS;QAC5C,aAAa,EAAE,MAAA,GAAG,CAAC,oBAAoB,mCAAI,qBAAqB;QAChE,iBAAiB,EAAE,MAAA,GAAG,CAAC,yBAAyB,mCAAI,cAAc;QAClE,KAAK,EAAE,MAAA,GAAG,CAAC,YAAY,mCAAI,2CAA2C;KACvE;IACD,MAAM,EAAE;QACN,QAAQ,EACN,MAAA,GAAG,CAAC,wBAAwB,mCAC5B,0EAA0E;QAC5E,4EAA4E;QAC5E,qFAAqF;QACrF,YAAY,EACV,MAAA,GAAG,CAAC,4BAA4B,mCAAI,qCAAqC;KAC5E;IACD,MAAM,EAAE,MAAA,GAAG,CAAC,UAAU,mCAAI,oBAAoB;IAC9C,WAAW,EAAE,MAAA,GAAG,CAAC,MAAM,mCAAI,YAAY;CACxC,CAAC"}
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../../src/drivers/env.ts"],"names":[],"mappings":";;;;;;;AAAA;;;;;;;;;GASG;AACH,oDAA4B;AAE5B,gBAAM,CAAC,MAAM,EAAE,CAAC;AAEhB,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;AAEX,QAAA,eAAe,GAAG;IAC7B,EAAE,EAAE;QACF,wDAAwD;QACxD,MAAM,EAAE,MAAA,GAAG,CAAC,aAAa,mCAAI,yCAAyC;QACtE,UAAU,EAAE,MAAA,GAAG,CAAC,iBAAiB,mCAAI,yBAAyB;QAC9D,SAAS,EAAE,MAAA,GAAG,CAAC,gBAAgB,mCAAI,SAAS;QAC5C,aAAa,EAAE,MAAA,GAAG,CAAC,oBAAoB,mCAAI,qBAAqB;QAChE,iBAAiB,EAAE,MAAA,GAAG,CAAC,yBAAyB,mCAAI,cAAc;QAClE,KAAK,EAAE,MAAA,GAAG,CAAC,YAAY,mCAAI,2CAA2C;KACvE;IACD,MAAM,EAAE;QACN,QAAQ,EACN,MAAA,GAAG,CAAC,wBAAwB,mCAC5B,0EAA0E;QAC5E,4EAA4E;QAC5E,qFAAqF;QACrF,kFAAkF;QAClF,2FAA2F;QAC3F,uHAAuH;QACvH,iFAAiF;QACjF,uEAAuE;QACvE,wFAAwF;QACxF,yBAAyB,EACvB,MAAA,GAAG,CAAC,4BAA4B,mCAAI,qCAAqC;KAC5E;IACD,MAAM,EAAE,MAAA,GAAG,CAAC,UAAU,mCAAI,oBAAoB;IAC9C,WAAW,EAAE,MAAA,GAAG,CAAC,MAAM,mCAAI,YAAY;CACxC,CAAC"}

package/dist/plugins/azure/auth.d.ts

@@ -10,6 +10,10 @@ export declare const azAccountSetCommand: (subscriptionId: string) => {
     command: string;
     args: string[];
 };
+export declare const azAccountShowUserPrincipalName: () => {
+    command: string;
+    args: string[];
+};
 export declare const azLogin: (subscriptionId: string, options?: {
     debug?: boolean;
-}) => Promise<void>;
+}) => Promise<string>;

package/dist/plugins/azure/auth.js

@@ -9,7 +9,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.azLogin = exports.azAccountSetCommand = exports.azLogoutCommand = exports.azLoginCommand = void 0;
+exports.azLogin = exports.azAccountShowUserPrincipalName = exports.azAccountSetCommand = exports.azLogoutCommand = exports.azLoginCommand = void 0;
 /** Copyright © 2024-present P0 Security
 
 This file is part of @p0security/cli
@@ -34,7 +34,10 @@ const knownAccountSetErrors = [
         message: "Failed to set the active Azure subscription. Please try again.",
     },
 ];
-const normalizeAzureCliError = (error, normalizedErrors) => {
+const normalizeAzureCliError = (error, normalizedErrors, options) => {
+    if (options.debug) {
+        (0, stdio_1.print2)(error);
+    }
     for (const { pattern, message } of normalizedErrors) {
         if (pattern.test(error.stderr)) {
             throw message;
@@ -57,6 +60,11 @@ const azAccountSetCommand = (subscriptionId) => ({
     args: ["account", "set", "--subscription", subscriptionId],
 });
 exports.azAccountSetCommand = azAccountSetCommand;
+const azAccountShowUserPrincipalName = () => ({
+    command: "az",
+    args: ["account", "show", "--query", "user.name", "-o", "tsv"],
+});
+exports.azAccountShowUserPrincipalName = azAccountShowUserPrincipalName;
 const performLogout = ({ debug }) => __awaiter(void 0, void 0, void 0, function* () {
     try {
         const { command: azLogoutExe, args: azLogoutArgs } = (0, exports.azLogoutCommand)();
@@ -84,7 +92,7 @@ const performLogin = (subscriptionId, { debug }) => __awaiter(void 0, void 0, vo
         }
     }
     catch (error) {
-        throw normalizeAzureCliError(error, knownLoginErrors);
+        throw normalizeAzureCliError(error, knownLoginErrors, { debug });
     }
 });
 const performSetAccount = (subscriptionId, { debug }) => __awaiter(void 0, void 0, void 0, function* () {
@@ -99,7 +107,22 @@ const performSetAccount = (subscriptionId, { debug }) => __awaiter(void 0, void
         }
     }
     catch (error) {
-        throw normalizeAzureCliError(error, knownAccountSetErrors);
+        throw normalizeAzureCliError(error, knownAccountSetErrors, { debug });
+    }
+});
+const getUserPrincipalName = ({ debug }) => __awaiter(void 0, void 0, void 0, function* () {
+    try {
+        const { command, args } = (0, exports.azAccountShowUserPrincipalName)();
+        const accountShowResult = yield (0, util_1.exec)(command, args, { check: true });
+        if (debug) {
+            (0, stdio_1.print2)(`Found account information...`);
+            (0, stdio_1.print2)(accountShowResult.stdout);
+            (0, stdio_1.print2)(accountShowResult.stderr);
+        }
+        return accountShowResult.stdout.trim();
+    }
+    catch (error) {
+        throw `Failed to get the current user name: ${error}.`;
     }
 });
 const azLogin = (subscriptionId, options = {}) => __awaiter(void 0, void 0, void 0, function* () {
@@ -111,6 +134,7 @@ const azLogin = (subscriptionId, options = {}) => __awaiter(void 0, void 0, void
     yield performLogout(options);
     yield performLogin(subscriptionId, options);
     yield performSetAccount(subscriptionId, options);
+    return yield getUserPrincipalName(options);
 });
 exports.azLogin = azLogin;
 //# sourceMappingURL=auth.js.map

package/dist/plugins/azure/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/plugins/azure/auth.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA;;;;;;;;;GASG;AACH,+CAA6C;AAC7C,qCAAkC;AAGlC,MAAM,gBAAgB,GAAiB;IACrC;QACE,OAAO,EACL,6FAA6F;QAC/F,OAAO,EAAE,gDAAgD;KAC1D;CACF,CAAC;AAEF,MAAM,qBAAqB,GAAiB;IAC1C;QACE,OAAO,EAAE,+DAA+D;QACxE,OAAO,EAAE,gEAAgE;KAC1E;CACF,CAAC;AAEF,MAAM,sBAAsB,GAAG,CAAC,KAAU,EAAE,gBAA8B,EAAE,EAAE;IAC5E,KAAK,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,gBAAgB,EAAE;QACnD,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE;YAC9B,MAAM,OAAO,CAAC;SACf;KACF;IACD,MAAM,KAAK,CAAC;AACd,CAAC,CAAC;AAEK,MAAM,cAAc,GAAG,GAAG,EAAE,CAAC,CAAC;IACnC,OAAO,EAAE,IAAI;IACb,IAAI,EAAE,CAAC,OAAO,CAAC;CAChB,CAAC,CAAC;AAHU,QAAA,cAAc,kBAGxB;AAEI,MAAM,eAAe,GAAG,GAAG,EAAE,CAAC,CAAC;IACpC,OAAO,EAAE,IAAI;IACb,IAAI,EAAE,CAAC,QAAQ,CAAC;CACjB,CAAC,CAAC;AAHU,QAAA,eAAe,mBAGzB;AAEI,MAAM,mBAAmB,GAAG,CAAC,cAAsB,EAAE,EAAE,CAAC,CAAC;IAC9D,OAAO,EAAE,IAAI;IACb,IAAI,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,gBAAgB,EAAE,cAAc,CAAC;CAC3D,CAAC,CAAC;AAHU,QAAA,mBAAmB,uBAG7B;AAEH,MAAM,aAAa,GAAG,CAAO,EAAE,KAAK,EAAuB,EAAE,EAAE;IAC7D,IAAI;QACF,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,IAAA,uBAAe,GAAE,CAAC;QACvE,MAAM,YAAY,GAAG,MAAM,IAAA,WAAI,EAAC,WAAW,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAE5E,IAAI,KAAK,EAAE;YACT,IAAA,cAAM,EAAC,YAAY,CAAC,MAAM,CAAC,CAAC;YAC5B,IAAA,cAAM,EAAC,YAAY,CAAC,MAAM,CAAC,CAAC;SAC7B;KACF;IAAC,OAAO,KAAU,EAAE;QACnB,IAAI,KAAK,EAAE;YACT,iDAAiD;YACjD,IAAA,cAAM,EAAC,oBAAoB,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;SAC5C;KACF;AACH,CAAC,CAAA,CAAC;AAEF,MAAM,YAAY,GAAG,CACnB,cAAsB,EACtB,EAAE,KAAK,EAAuB,EAC9B,EAAE;IACF,IAAI;QACF,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,IAAA,sBAAc,GAAE,CAAC;QACpE,MAAM,WAAW,GAAG,MAAM,IAAA,WAAI,EAAC,UAAU,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAEzE,IAAI,KAAK,EAAE;YACT,IAAA,cAAM,EAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YAC3B,IAAA,cAAM,EAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YAC3B,IAAA,cAAM,EAAC,wCAAwC,cAAc,KAAK,CAAC,CAAC;SACrE;KACF;IAAC,OAAO,KAAU,EAAE;QACnB,MAAM,sBAAsB,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;KACvD;AACH,CAAC,CAAA,CAAC;AAEF,MAAM,iBAAiB,GAAG,CACxB,cAAsB,EACtB,EAAE,KAAK,EAAuB,EAC9B,EAAE;IACF,IAAI;QACF,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,gBAAgB,EAAE,GACxD,IAAA,2BAAmB,EAAC,cAAc,CAAC,CAAC;QACtC,MAAM,gBAAgB,GAAG,MAAM,IAAA,WAAI,EAAC,eAAe,EAAE,gBAAgB,EAAE;YACrE,KAAK,EAAE,IAAI;SACZ,CAAC,CAAC;QAEH,IAAI,KAAK,EAAE;YACT,IAAA,cAAM,EAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;YAChC,IAAA,cAAM,EAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;SACjC;KACF;IAAC,OAAO,KAAK,EAAE;QACd,MAAM,sBAAsB,CAAC,KAAK,EAAE,qBAAqB,CAAC,CAAC;KAC5D;AACH,CAAC,CAAA,CAAC;AAEK,MAAM,OAAO,GAAG,CACrB,cAAsB,EACtB,UAA+B,EAAE,EACjC,EAAE;IACF,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;IAC1B,IAAI,KAAK;QAAE,IAAA,cAAM,EAAC,wBAAwB,CAAC,CAAC;IAE5C,qEAAqE;IACrE,kDAAkD;IAClD,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;IAE7B,MAAM,YAAY,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IAE5C,MAAM,iBAAiB,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;AACnD,CAAC,CAAA,CAAC;AAdW,QAAA,OAAO,WAclB"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/plugins/azure/auth.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA;;;;;;;;;GASG;AACH,+CAA6C;AAC7C,qCAAkC;AAGlC,MAAM,gBAAgB,GAAiB;IACrC;QACE,OAAO,EACL,6FAA6F;QAC/F,OAAO,EAAE,gDAAgD;KAC1D;CACF,CAAC;AAEF,MAAM,qBAAqB,GAAiB;IAC1C;QACE,OAAO,EAAE,+DAA+D;QACxE,OAAO,EAAE,gEAAgE;KAC1E;CACF,CAAC;AAEF,MAAM,sBAAsB,GAAG,CAC7B,KAAU,EACV,gBAA8B,EAC9B,OAA4B,EAC5B,EAAE;IACF,IAAI,OAAO,CAAC,KAAK,EAAE;QACjB,IAAA,cAAM,EAAC,KAAK,CAAC,CAAC;KACf;IACD,KAAK,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,gBAAgB,EAAE;QACnD,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE;YAC9B,MAAM,OAAO,CAAC;SACf;KACF;IACD,MAAM,KAAK,CAAC;AACd,CAAC,CAAC;AAEK,MAAM,cAAc,GAAG,GAAG,EAAE,CAAC,CAAC;IACnC,OAAO,EAAE,IAAI;IACb,IAAI,EAAE,CAAC,OAAO,CAAC;CAChB,CAAC,CAAC;AAHU,QAAA,cAAc,kBAGxB;AAEI,MAAM,eAAe,GAAG,GAAG,EAAE,CAAC,CAAC;IACpC,OAAO,EAAE,IAAI;IACb,IAAI,EAAE,CAAC,QAAQ,CAAC;CACjB,CAAC,CAAC;AAHU,QAAA,eAAe,mBAGzB;AAEI,MAAM,mBAAmB,GAAG,CAAC,cAAsB,EAAE,EAAE,CAAC,CAAC;IAC9D,OAAO,EAAE,IAAI;IACb,IAAI,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,gBAAgB,EAAE,cAAc,CAAC;CAC3D,CAAC,CAAC;AAHU,QAAA,mBAAmB,uBAG7B;AAEI,MAAM,8BAA8B,GAAG,GAAG,EAAE,CAAC,CAAC;IACnD,OAAO,EAAE,IAAI;IACb,IAAI,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,CAAC;CAC/D,CAAC,CAAC;AAHU,QAAA,8BAA8B,kCAGxC;AAEH,MAAM,aAAa,GAAG,CAAO,EAAE,KAAK,EAAuB,EAAE,EAAE;IAC7D,IAAI;QACF,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,IAAA,uBAAe,GAAE,CAAC;QACvE,MAAM,YAAY,GAAG,MAAM,IAAA,WAAI,EAAC,WAAW,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAE5E,IAAI,KAAK,EAAE;YACT,IAAA,cAAM,EAAC,YAAY,CAAC,MAAM,CAAC,CAAC;YAC5B,IAAA,cAAM,EAAC,YAAY,CAAC,MAAM,CAAC,CAAC;SAC7B;KACF;IAAC,OAAO,KAAU,EAAE;QACnB,IAAI,KAAK,EAAE;YACT,iDAAiD;YACjD,IAAA,cAAM,EAAC,oBAAoB,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;SAC5C;KACF;AACH,CAAC,CAAA,CAAC;AAEF,MAAM,YAAY,GAAG,CACnB,cAAsB,EACtB,EAAE,KAAK,EAAuB,EAC9B,EAAE;IACF,IAAI;QACF,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,IAAA,sBAAc,GAAE,CAAC;QACpE,MAAM,WAAW,GAAG,MAAM,IAAA,WAAI,EAAC,UAAU,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAEzE,IAAI,KAAK,EAAE;YACT,IAAA,cAAM,EAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YAC3B,IAAA,cAAM,EAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YAC3B,IAAA,cAAM,EAAC,wCAAwC,cAAc,KAAK,CAAC,CAAC;SACrE;KACF;IAAC,OAAO,KAAU,EAAE;QACnB,MAAM,sBAAsB,CAAC,KAAK,EAAE,gBAAgB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;KAClE;AACH,CAAC,CAAA,CAAC;AAEF,MAAM,iBAAiB,GAAG,CACxB,cAAsB,EACtB,EAAE,KAAK,EAAuB,EAC9B,EAAE;IACF,IAAI;QACF,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,gBAAgB,EAAE,GACxD,IAAA,2BAAmB,EAAC,cAAc,CAAC,CAAC;QACtC,MAAM,gBAAgB,GAAG,MAAM,IAAA,WAAI,EAAC,eAAe,EAAE,gBAAgB,EAAE;YACrE,KAAK,EAAE,IAAI;SACZ,CAAC,CAAC;QAEH,IAAI,KAAK,EAAE;YACT,IAAA,cAAM,EAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;YAChC,IAAA,cAAM,EAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;SACjC;KACF;IAAC,OAAO,KAAK,EAAE;QACd,MAAM,sBAAsB,CAAC,KAAK,EAAE,qBAAqB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;KACvE;AACH,CAAC,CAAA,CAAC;AAEF,MAAM,oBAAoB,GAAG,CAAO,EAAE,KAAK,EAAuB,EAAE,EAAE;IACpE,IAAI;QACF,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,IAAA,sCAA8B,GAAE,CAAC;QAC3D,MAAM,iBAAiB,GAAG,MAAM,IAAA,WAAI,EAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACrE,IAAI,KAAK,EAAE;YACT,IAAA,cAAM,EAAC,8BAA8B,CAAC,CAAC;YACvC,IAAA,cAAM,EAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;YACjC,IAAA,cAAM,EAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;SAClC;QACD,OAAO,iBAAiB,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;KACxC;IAAC,OAAO,KAAU,EAAE;QACnB,MAAM,wCAAwC,KAAK,GAAG,CAAC;KACxD;AACH,CAAC,CAAA,CAAC;AAEK,MAAM,OAAO,GAAG,CACrB,cAAsB,EACtB,UAA+B,EAAE,EACjC,EAAE;IACF,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;IAC1B,IAAI,KAAK;QAAE,IAAA,cAAM,EAAC,wBAAwB,CAAC,CAAC;IAE5C,qEAAqE;IACrE,kDAAkD;IAClD,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;IAE7B,MAAM,YAAY,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IAE5C,MAAM,iBAAiB,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IAEjD,OAAO,MAAM,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC7C,CAAC,CAAA,CAAC;AAhBW,QAAA,OAAO,WAgBlB"}

package/dist/plugins/azure/ssh.js

@@ -111,7 +111,10 @@ exports.azureSshProvider = {
         // The subscription ID here is used to ensure that the user is logged in to the correct tenant/directory.
         // As long as a subscription ID in the correct tenant is provided, this will work; it need not be the same
         // subscription as which contains the Bastion host or the target VM.
-        yield (0, auth_1.azLogin)(request.subscriptionId, { debug }); // Always re-login to Azure CLI
+        const linuxUserName = yield (0, auth_1.azLogin)(request.subscriptionId, { debug }); // Always re-login to Azure CLI
+        if (linuxUserName !== request.linuxUserName) {
+            throw `Azure CLI login returned a different user name than expected. Expected: ${request.linuxUserName}, Actual: ${linuxUserName}`;
+        }
         const { path: keyPath, cleanup: sshKeyPathCleanup } = yield (0, keygen_1.createTempDirectoryForKeys)();
         const wrappedCreateCertAndTunnel = () => __awaiter(void 0, void 0, void 0, function* () {
             try {
@@ -151,8 +154,9 @@ exports.azureSshProvider = {
     unprovisionedAccessPatterns,
     provisionedAccessPatterns,
     toCliRequest: (request) => __awaiter(void 0, void 0, void 0, function* () {
+        var _a;
         return Object.assign(Object.assign({}, request), { cliLocalData: {
-                linuxUserName: request.principal,
+                linuxUserName: (_a = request.generated.linuxUserName) !== null && _a !== void 0 ? _a : request.principal,
             } });
     }),
 };

package/dist/plugins/azure/ssh.js.map

@@ -1 +1 @@
-{"version":3,"file":"ssh.js","sourceRoot":"","sources":["../../../src/plugins/azure/ssh.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA;;;;;;;;;GASG;AACH,mDAA0D;AAE1D,iCAKgB;AAChB,uCAA4C;AAC5C,qCAMkB;AAClB,qCAAyE;AAMzE,0DAA6B;AAE7B,MAAM,2BAA2B,GAAG;IAClC;QACE,mEAAmE;QACnE,OAAO,EAAE,uCAAuC;KACjD;CACO,CAAC;AAEX,MAAM,yBAAyB,GAAG;IAChC;QACE,OAAO,EAAE,8BAA8B;KACxC;CACO,CAAC;AAEX,qFAAqF;AACrF,kFAAkF;AAClF,iFAAiF;AACjF,kFAAkF;AAClF,yDAAyD;AACzD,MAAM,4BAA4B,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEtC,QAAA,gBAAgB,GAIzB;IACF,+CAA+C;IAC/C,kBAAkB,EAAE,GAAS,EAAE;QAC7B,4CAA4C;QAC5C,OAAO,SAAS,CAAC;IACnB,CAAC,CAAA;IAED,aAAa,EAAE,GAAS,EAAE;QACxB,IAAI,CAAC,CAAC,MAAM,IAAA,yBAAe,GAAE,CAAC,EAAE;YAC9B,MAAM,uDAAuD,CAAC;SAC/D;IACH,CAAC,CAAA;IAED,YAAY,EAAE,iBAAiB;IAE/B,oBAAoB,EAAE,qDAAqD;IAE3E,wBAAwB;IACxB,oBAAoB,EAAE,SAAS;IAE/B,oBAAoB,EAAE,4BAA4B;IAElD,4BAA4B,EAAE,CAAC,OAAO,EAAE,EAAE;QACxC,IAAI,IAAA,mBAAa,EAAC,OAAO,CAAC,EAAE;YAC1B,uCACK,OAAO;gBACV,6GAA6G;gBAC7G,mEAAmE;gBACnE,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,CAAC,KAAK,CAAC,IAClB;SACH;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,qEAAqE;IACrE,YAAY,EAAE,GAAG,EAAE,CAAC,EAAE;IAEtB,aAAa,EAAE,CAAC,OAAO,EAAE,cAAc,EAAE,EAAE;;QACzC,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,IAAA,sBAAe,GAAE,CAAC;QACvE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,IAAA,qBAAc,GAAE,CAAC;QACpE,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,gBAAgB,EAAE,GACxD,IAAA,0BAAmB,EAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QAE9C,MAAM,UAAU,GAAG,GAAG,EAAE;YACtB,wGAAwG;YACxG,gHAAgH;YAChH,+GAA+G;YAC/G,aAAa;YACb,IAAI,cAAc,EAAE;gBAClB,OAAO,mBAAI,CAAC,OAAO,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;aAClD;iBAAM;gBACL,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC;gBACnE,OAAO,mBAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,sBAAsB,CAAC,CAAC;aACpD;QACH,CAAC,CAAC;QAEF,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;QAE7B,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,GAClD,IAAA,yBAAgB,EAAC,OAAO,CAAC,CAAC;QAE5B,iHAAiH;QACjH,6CAA6C;QAC7C,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,IAAA,+BAAsB,EACzE,OAAO,EACP,MAAA,cAAc,aAAd,cAAc,uBAAd,cAAc,CAAE,IAAI,mCAAI,OAAO,EAC/B,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,8EAA8E;SAC/F,CAAC;QAEF,OAAO;YACL,GAAG,WAAW,IAAI,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;YAC1C,GAAG,UAAU,IAAI,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;YACxC,GAAG,eAAe,IAAI,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;YAClD,SAAS,OAAO,EAAE;YAClB,GAAG,YAAY,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;YAC5C,GAAG,WAAW,IAAI,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;SAC3C,CAAC;IACJ,CAAC;IAED,KAAK,EAAE,CAAO,OAAO,EAAE,OAAO,GAAG,EAAE,EAAE,EAAE;QACrC,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;QAE1B,yGAAyG;QACzG,0GAA0G;QAC1G,oEAAoE;QACpE,MAAM,IAAA,cAAO,EAAC,OAAO,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,+BAA+B;QAEjF,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,GACjD,MAAM,IAAA,mCAA0B,GAAE,CAAC;QAErC,MAAM,0BAA0B,GAAG,GAAS,EAAE;YAC5C,IAAI;gBACF,MAAM,IAAA,qCAA4B,EAAC,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;gBACvD,OAAO,MAAM,IAAA,8BAAqB,EAAC,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;aACxD;YAAC,OAAO,KAAU,EAAE;gBACnB,MAAM,iBAAiB,EAAE,CAAC;gBAC1B,MAAM,KAAK,CAAC;aACb;QACH,CAAC,CAAA,CAAC;QAEF,MAAM,EAAE,UAAU,EAAE,eAAe,EAAE,GAAG,MAAM,0BAA0B,EAAE,CAAC;QAE3E,MAAM,iBAAiB,GAAG,mBAAI,CAAC,IAAI,CAAC,OAAO,EAAE,2BAAkB,CAAC,CAAC;QACjE,MAAM,qBAAqB,GAAG,mBAAI,CAAC,IAAI,CAAC,OAAO,EAAE,yBAAgB,CAAC,CAAC;QAEnE,MAAM,QAAQ,GAAG,GAAS,EAAE;YAC1B,MAAM,UAAU,EAAE,CAAC;YACnB,MAAM,iBAAiB,EAAE,CAAC;QAC5B,CAAC,CAAA,CAAC;QAEF,OAAO;YACL,UAAU,EAAE;gBACV,mBAAmB,qBAAqB,EAAE;gBAE1C,2GAA2G;gBAC3G,4GAA4G;gBAC5G,gHAAgH;gBAChH,6GAA6G;gBAC7G,+GAA+G;gBAC/G,2BAA2B;gBAC3B,0BAA0B;gBAC1B,8BAA8B;aAC/B;YACD,YAAY,EAAE,iBAAiB;YAC/B,IAAI,EAAE,eAAe;YACrB,QAAQ;SACT,CAAC;IACJ,CAAC,CAAA;IAED,YAAY,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,+BACzB,IAAI,EAAE,OAAO,EACb,EAAE,EAAE,WAAW,IACZ,OAAO,CAAC,YAAY,KACvB,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,UAAU,EAClD,cAAc,EAAE,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,cAAc,EAC1D,qBAAqB,EAAE,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,eAAe,EAClE,SAAS,EAAE,OAAO,CAAC,UAAU,CAAC,aAAa,IAC3C;IAEF,2BAA2B;IAC3B,yBAAyB;IAEzB,YAAY,EAAE,CAAO,OAAO,EAAE,EAAE;QAC9B,uCACK,OAAO,KACV,YAAY,EAAE;gBACZ,aAAa,EAAE,OAAO,CAAC,SAAS;aACjC,IACD;IACJ,CAAC,CAAA;CACF,CAAC"}
+{"version":3,"file":"ssh.js","sourceRoot":"","sources":["../../../src/plugins/azure/ssh.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA;;;;;;;;;GASG;AACH,mDAA0D;AAE1D,iCAKgB;AAChB,uCAA4C;AAC5C,qCAMkB;AAClB,qCAAyE;AAMzE,0DAA6B;AAE7B,MAAM,2BAA2B,GAAG;IAClC;QACE,mEAAmE;QACnE,OAAO,EAAE,uCAAuC;KACjD;CACO,CAAC;AAEX,MAAM,yBAAyB,GAAG;IAChC;QACE,OAAO,EAAE,8BAA8B;KACxC;CACO,CAAC;AAEX,qFAAqF;AACrF,kFAAkF;AAClF,iFAAiF;AACjF,kFAAkF;AAClF,yDAAyD;AACzD,MAAM,4BAA4B,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEtC,QAAA,gBAAgB,GAIzB;IACF,+CAA+C;IAC/C,kBAAkB,EAAE,GAAS,EAAE;QAC7B,4CAA4C;QAC5C,OAAO,SAAS,CAAC;IACnB,CAAC,CAAA;IAED,aAAa,EAAE,GAAS,EAAE;QACxB,IAAI,CAAC,CAAC,MAAM,IAAA,yBAAe,GAAE,CAAC,EAAE;YAC9B,MAAM,uDAAuD,CAAC;SAC/D;IACH,CAAC,CAAA;IAED,YAAY,EAAE,iBAAiB;IAE/B,oBAAoB,EAAE,qDAAqD;IAE3E,wBAAwB;IACxB,oBAAoB,EAAE,SAAS;IAE/B,oBAAoB,EAAE,4BAA4B;IAElD,4BAA4B,EAAE,CAAC,OAAO,EAAE,EAAE;QACxC,IAAI,IAAA,mBAAa,EAAC,OAAO,CAAC,EAAE;YAC1B,uCACK,OAAO;gBACV,6GAA6G;gBAC7G,mEAAmE;gBACnE,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,CAAC,KAAK,CAAC,IAClB;SACH;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,qEAAqE;IACrE,YAAY,EAAE,GAAG,EAAE,CAAC,EAAE;IAEtB,aAAa,EAAE,CAAC,OAAO,EAAE,cAAc,EAAE,EAAE;;QACzC,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,IAAA,sBAAe,GAAE,CAAC;QACvE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,IAAA,qBAAc,GAAE,CAAC;QACpE,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,gBAAgB,EAAE,GACxD,IAAA,0BAAmB,EAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QAE9C,MAAM,UAAU,GAAG,GAAG,EAAE;YACtB,wGAAwG;YACxG,gHAAgH;YAChH,+GAA+G;YAC/G,aAAa;YACb,IAAI,cAAc,EAAE;gBAClB,OAAO,mBAAI,CAAC,OAAO,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;aAClD;iBAAM;gBACL,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC;gBACnE,OAAO,mBAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,sBAAsB,CAAC,CAAC;aACpD;QACH,CAAC,CAAC;QAEF,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;QAE7B,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,GAClD,IAAA,yBAAgB,EAAC,OAAO,CAAC,CAAC;QAE5B,iHAAiH;QACjH,6CAA6C;QAC7C,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,IAAA,+BAAsB,EACzE,OAAO,EACP,MAAA,cAAc,aAAd,cAAc,uBAAd,cAAc,CAAE,IAAI,mCAAI,OAAO,EAC/B,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,8EAA8E;SAC/F,CAAC;QAEF,OAAO;YACL,GAAG,WAAW,IAAI,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;YAC1C,GAAG,UAAU,IAAI,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;YACxC,GAAG,eAAe,IAAI,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;YAClD,SAAS,OAAO,EAAE;YAClB,GAAG,YAAY,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;YAC5C,GAAG,WAAW,IAAI,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;SAC3C,CAAC;IACJ,CAAC;IAED,KAAK,EAAE,CAAO,OAAO,EAAE,OAAO,GAAG,EAAE,EAAE,EAAE;QACrC,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;QAE1B,yGAAyG;QACzG,0GAA0G;QAC1G,oEAAoE;QACpE,MAAM,aAAa,GAAG,MAAM,IAAA,cAAO,EAAC,OAAO,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,+BAA+B;QAEvG,IAAI,aAAa,KAAK,OAAO,CAAC,aAAa,EAAE;YAC3C,MAAM,2EAA2E,OAAO,CAAC,aAAa,aAAa,aAAa,EAAE,CAAC;SACpI;QAED,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,GACjD,MAAM,IAAA,mCAA0B,GAAE,CAAC;QAErC,MAAM,0BAA0B,GAAG,GAAS,EAAE;YAC5C,IAAI;gBACF,MAAM,IAAA,qCAA4B,EAAC,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;gBACvD,OAAO,MAAM,IAAA,8BAAqB,EAAC,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;aACxD;YAAC,OAAO,KAAU,EAAE;gBACnB,MAAM,iBAAiB,EAAE,CAAC;gBAC1B,MAAM,KAAK,CAAC;aACb;QACH,CAAC,CAAA,CAAC;QAEF,MAAM,EAAE,UAAU,EAAE,eAAe,EAAE,GAAG,MAAM,0BAA0B,EAAE,CAAC;QAE3E,MAAM,iBAAiB,GAAG,mBAAI,CAAC,IAAI,CAAC,OAAO,EAAE,2BAAkB,CAAC,CAAC;QACjE,MAAM,qBAAqB,GAAG,mBAAI,CAAC,IAAI,CAAC,OAAO,EAAE,yBAAgB,CAAC,CAAC;QAEnE,MAAM,QAAQ,GAAG,GAAS,EAAE;YAC1B,MAAM,UAAU,EAAE,CAAC;YACnB,MAAM,iBAAiB,EAAE,CAAC;QAC5B,CAAC,CAAA,CAAC;QAEF,OAAO;YACL,UAAU,EAAE;gBACV,mBAAmB,qBAAqB,EAAE;gBAE1C,2GAA2G;gBAC3G,4GAA4G;gBAC5G,gHAAgH;gBAChH,6GAA6G;gBAC7G,+GAA+G;gBAC/G,2BAA2B;gBAC3B,0BAA0B;gBAC1B,8BAA8B;aAC/B;YACD,YAAY,EAAE,iBAAiB;YAC/B,IAAI,EAAE,eAAe;YACrB,QAAQ;SACT,CAAC;IACJ,CAAC,CAAA;IAED,YAAY,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,+BACzB,IAAI,EAAE,OAAO,EACb,EAAE,EAAE,WAAW,IACZ,OAAO,CAAC,YAAY,KACvB,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,UAAU,EAClD,cAAc,EAAE,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,cAAc,EAC1D,qBAAqB,EAAE,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,eAAe,EAClE,SAAS,EAAE,OAAO,CAAC,UAAU,CAAC,aAAa,IAC3C;IAEF,2BAA2B;IAC3B,yBAAyB;IAEzB,YAAY,EAAE,CAAO,OAAO,EAAE,EAAE;;QAC9B,uCACK,OAAO,KACV,YAAY,EAAE;gBACZ,aAAa,EAAE,MAAA,OAAO,CAAC,SAAS,CAAC,aAAa,mCAAI,OAAO,CAAC,SAAS;aACpE,IACD;IACJ,CAAC,CAAA;CACF,CAAC"}

package/dist/plugins/azure/types.d.ts

@@ -15,7 +15,10 @@ export type KnownError = {
     pattern: RegExp;
     message: string;
 };
-export type AzureSshPermissionSpec = PermissionSpec<"ssh", AzureSshPermission>;
+export type AzureSshGenerated = {
+    linuxUserName: string;
+};
+export type AzureSshPermissionSpec = PermissionSpec<"ssh", AzureSshPermission, AzureSshGenerated>;
 export type AzureSsh = CliPermissionSpec<AzureSshPermissionSpec, AzureLocalData>;
 export type AzureSshPermission = CommonSshPermissionSpec & {
     provider: "azure";

package/dist/plugins/google/login.js

@@ -35,7 +35,7 @@ const GOOGLE_OIDC_REDIRECT_PORT = 52700;
 const GOOGLE_OIDC_REDIRECT_URL = `http://127.0.0.1:${GOOGLE_OIDC_REDIRECT_PORT}`;
 const PKCE_LENGTH = 128;
 const requestAuth = () => __awaiter(void 0, void 0, void 0, function* () {
-    const tenantConfig = (0, config_1.getTenantConfig)();
+    const tenantConfig = (0, config_1.getGoogleTenantConfig)();
     const pkceChallenge = (yield import("pkce-challenge")).default;
     const pkce = yield pkceChallenge(PKCE_LENGTH);
     const authBody = {
@@ -55,10 +55,10 @@ ${url}`);
     return pkce;
 });
 const requestToken = (code, pkce) => __awaiter(void 0, void 0, void 0, function* () {
-    const tenantConfig = (0, config_1.getTenantConfig)();
+    const tenantConfig = (0, config_1.getGoogleTenantConfig)();
     const body = {
         client_id: tenantConfig.google.clientId,
-        client_secret: tenantConfig.google.clientSecret,
+        client_secret: tenantConfig.google.publicClientSecretForPkce,
         code,
         code_verifier: pkce.code_verifier,
         grant_type: "authorization_code",

package/dist/plugins/google/login.js.map

@@ -1 +1 @@
-{"version":3,"file":"login.js","sourceRoot":"","sources":["../../../src/plugins/google/login.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA;;;;;;;;;GASG;AACH,iDAAsD;AACtD,qDAA8D;AAC9D,8CAAiE;AACjE,iDAAuD;AACvD,+CAA6C;AAE7C,gDAAwB;AAOxB,MAAM,eAAe,GAAG,8CAA8C,CAAC;AACvE,MAAM,wBAAwB,GAAG,qCAAqC,CAAC;AACvE,MAAM,yBAAyB,GAAG,KAAK,CAAC;AACxC,MAAM,wBAAwB,GAAG,oBAAoB,yBAAyB,EAAE,CAAC;AACjF,MAAM,WAAW,GAAG,GAAG,CAAC;AAExB,MAAM,WAAW,GAAG,GAAS,EAAE;IAC7B,MAAM,YAAY,GAAG,IAAA,wBAAe,GAAE,CAAC;IACvC,MAAM,aAAa,GAAG,CAAC,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAc,CAAC;IACtE,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,WAAW,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAqB;QACjC,SAAS,EAAE,YAAY,CAAC,MAAM,CAAC,QAAQ;QACvC,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,qBAAqB,EAAE,MAAM;QAC7B,YAAY,EAAE,wBAAwB;QACtC,aAAa,EAAE,MAAM;QACrB,KAAK,EAAE,QAAQ;KAChB,CAAC;IACF,MAAM,GAAG,GAAG,GAAG,eAAe,IAAI,IAAA,iBAAS,EAAC,QAAQ,CAAC,EAAE,CAAC;IACxD,IAAA,cAAI,EAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;QACnB,IAAA,cAAM,EAAC;;EAET,GAAG,EAAE,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC,CAAA,CAAC;AAEF,MAAM,YAAY,GAAG,CACnB,IAAY,EACZ,IAAuD,EACvD,EAAE;IACF,MAAM,YAAY,GAAG,IAAA,wBAAe,GAAE,CAAC;IACvC,MAAM,IAAI,GAAG;QACX,SAAS,EAAE,YAAY,CAAC,MAAM,CAAC,QAAQ;QACvC,aAAa,EAAE,YAAY,CAAC,MAAM,CAAC,YAAY;QAC/C,IAAI;QACJ,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,UAAU,EAAE,oBAAoB;QAChC,YAAY,EAAE,wBAAwB;KACvC,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,wBAAwB,EAAE;QACrD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,mBAAY;QACrB,IAAI,EAAE,IAAA,iBAAS,EAAC,IAAI,CAAC;KACtB,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,MAAM,IAAA,wBAAgB,EAAC,QAAQ,CAAC,CAAC;IAC/C,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAkB,CAAC;AAC/C,CAAC,CAAA,CAAC;AAEK,MAAM,WAAW,GAAG,GAAS,EAAE;IACpC,OAAO,MAAM,IAAA,2BAAkB,EAC7B,GAAS,EAAE,kDAAC,OAAA,MAAM,WAAW,EAAE,CAAA,GAAA,EAC/B,CAAO,IAAI,EAAE,KAAK,EAAE,EAAE,kDAAC,OAAA,MAAM,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA,GAAA,EAC3D,EAAE,IAAI,EAAE,yBAAyB,EAAE,CACpC,CAAC;AACJ,CAAC,CAAA,CAAC;AANW,QAAA,WAAW,eAMtB"}
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../../../src/plugins/google/login.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA;;;;;;;;;GASG;AACH,iDAAsD;AACtD,qDAA8D;AAC9D,8CAAiE;AACjE,iDAA6D;AAC7D,+CAA6C;AAE7C,gDAAwB;AAOxB,MAAM,eAAe,GAAG,8CAA8C,CAAC;AACvE,MAAM,wBAAwB,GAAG,qCAAqC,CAAC;AACvE,MAAM,yBAAyB,GAAG,KAAK,CAAC;AACxC,MAAM,wBAAwB,GAAG,oBAAoB,yBAAyB,EAAE,CAAC;AACjF,MAAM,WAAW,GAAG,GAAG,CAAC;AAExB,MAAM,WAAW,GAAG,GAAS,EAAE;IAC7B,MAAM,YAAY,GAAG,IAAA,8BAAqB,GAAE,CAAC;IAC7C,MAAM,aAAa,GAAG,CAAC,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAc,CAAC;IACtE,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,WAAW,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAqB;QACjC,SAAS,EAAE,YAAY,CAAC,MAAM,CAAC,QAAQ;QACvC,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,qBAAqB,EAAE,MAAM;QAC7B,YAAY,EAAE,wBAAwB;QACtC,aAAa,EAAE,MAAM;QACrB,KAAK,EAAE,QAAQ;KAChB,CAAC;IACF,MAAM,GAAG,GAAG,GAAG,eAAe,IAAI,IAAA,iBAAS,EAAC,QAAQ,CAAC,EAAE,CAAC;IACxD,IAAA,cAAI,EAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;QACnB,IAAA,cAAM,EAAC;;EAET,GAAG,EAAE,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC,CAAA,CAAC;AAEF,MAAM,YAAY,GAAG,CACnB,IAAY,EACZ,IAAuD,EACvD,EAAE;IACF,MAAM,YAAY,GAAG,IAAA,8BAAqB,GAAE,CAAC;IAC7C,MAAM,IAAI,GAAG;QACX,SAAS,EAAE,YAAY,CAAC,MAAM,CAAC,QAAQ;QACvC,aAAa,EAAE,YAAY,CAAC,MAAM,CAAC,yBAAyB;QAC5D,IAAI;QACJ,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,UAAU,EAAE,oBAAoB;QAChC,YAAY,EAAE,wBAAwB;KACvC,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,wBAAwB,EAAE;QACrD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,mBAAY;QACrB,IAAI,EAAE,IAAA,iBAAS,EAAC,IAAI,CAAC;KACtB,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,MAAM,IAAA,wBAAgB,EAAC,QAAQ,CAAC,CAAC;IAC/C,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAkB,CAAC;AAC/C,CAAC,CAAA,CAAC;AAEK,MAAM,WAAW,GAAG,GAAS,EAAE;IACpC,OAAO,MAAM,IAAA,2BAAkB,EAC7B,GAAS,EAAE,kDAAC,OAAA,MAAM,WAAW,EAAE,CAAA,GAAA,EAC/B,CAAO,IAAI,EAAE,KAAK,EAAE,EAAE,kDAAC,OAAA,MAAM,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA,GAAA,EAC3D,EAAE,IAAI,EAAE,yBAAyB,EAAE,CACpC,CAAC;AACJ,CAAC,CAAA,CAAC;AANW,QAAA,WAAW,eAMtB"}

package/dist/types/org.d.ts

@@ -8,8 +8,25 @@ This file is part of @p0security/cli
 
 You should have received a copy of the GNU General Public License along with @p0security/cli. If not, see <https://www.gnu.org/licenses/>.
 **/
-import { bootstrapConfig } from "../drivers/env";
-export type Config = typeof bootstrapConfig;
+type ApplicationConfig = {
+    fs: {
+        apiKey: string;
+        authDomain: string;
+        projectId: string;
+        storageBucket: string;
+        messagingSenderId: string;
+        appId: string;
+    };
+    appUrl: string;
+    environment: string;
+};
+export type GoogleApplicationConfig = ApplicationConfig & {
+    google: {
+        clientId: string;
+        publicClientSecretForPkce: string;
+    };
+};
+export type Config = ApplicationConfig | GoogleApplicationConfig;
 type BaseOrgData = {
     clientId: string;
     providerId: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@p0security/cli",
-  "version": "0.13.2",
+  "version": "0.13.4",
   "description": "Execute infra CLI commands with P0 grants",
   "main": "index.ts",
   "repository": {