@p0security/cli 0.15.0 → 0.16.1

package/dist/commands/aws/__tests__/role.test.js

@@ -35,6 +35,9 @@ jest.mock("../../../drivers/stdio");
 jest.mock("typescript", () => (Object.assign(Object.assign({}, jest.requireActual("typescript")), { sys: {
         writeOutputIsTTY: () => true,
     } })));
+jest.mock("../../shared/request", () => ({
+    provisionRequest: jest.fn(),
+}));
 const mockFetch = jest.spyOn(global, "fetch");
 const mockPrint1 = stdio_1.print1;
 const mockPrint2 = stdio_1.print2;
@@ -58,10 +61,7 @@ describe("aws role", () => {
         };
         describe("without Okta SAML", () => {
             (0, firestore_1.mockGetDoc)({ "iam-write": { "1": item } });
-            describe.each([
-                ["ls", "aws role ls"],
-                ["assume", "aws role assume Role1"],
-            ])("%s", (_, command) => {
+            describe.each([["assume", "aws role assume Role1"]])("%s", (_, command) => {
                 it("should print a friendly error message", () => __awaiter(void 0, void 0, void 0, function* () {
                     const error = yield (0, yargs_1.failure)((0, __1.awsCommand)((0, yargs_2.default)()), command);
                     expect(error).toMatchInlineSnapshot(`"Account test is not configured for Okta SAML login."`);
@@ -90,13 +90,6 @@ describe("aws role", () => {
                     expect(mockPrint1.mock.calls).toMatchSnapshot("stdout");
                 }));
             });
-            describe("ls", () => {
-                it("lists roles", () => __awaiter(void 0, void 0, void 0, function* () {
-                    yield (0, __1.awsCommand)((0, yargs_2.default)()).parse("aws role ls");
-                    expect(mockPrint2.mock.calls).toMatchSnapshot("stderr");
-                    expect(mockPrint1.mock.calls).toMatchSnapshot("stdout");
-                }));
-            });
         });
     });
 });

package/dist/commands/aws/__tests__/role.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"role.test.js","sourceRoot":"","sources":["../../../../src/commands/aws/__tests__/role.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;AAAA;;;;;;;;;GASG;AACH,0BAAgC;AAChC,kDAAwD;AACxD,0DAAwD;AACxD,kDAAiD;AACjD,6DAAyD;AACzD,2DAAuD;AACvD,kDAA0B;AAE1B,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;AACzB,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;AACnC,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;AACpC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC,iCACzB,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,KACnC,GAAG,EAAE;QACH,gBAAgB,EAAE,GAAG,EAAE,CAAC,IAAI;KAC7B,IACD,CAAC,CAAC;AAEJ,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAC9C,MAAM,UAAU,GAAG,cAAmB,CAAC;AACvC,MAAM,UAAU,GAAG,cAAmB,CAAC;AAEvC,UAAU,CAAC,GAAG,EAAE;IACd,IAAI,CAAC,aAAa,EAAE,CAAC;IACrB,SAAS,CAAC,kBAAkB,CAC1B,CAAO,GAAsB,EAAE,EAAE;QAC/B,OAAA,CAAC;YACC,EAAE,EAAE,IAAI;YACR,mDAAmD;YACnD,IAAI,EAAE,GAAS,EAAE,kDAAC,OAAA,CAAC,EAAE,CAAC,CAAA,GAAA;YACtB,mEAAmE;YACnE,IAAI,EAAE,GAAS,EAAE,kDACf,OAAC,GAAc,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,4BAAY,CAAC,CAAC,CAAC,0BAAW,CAAA,GAAA;SACjE,CAAa,CAAA;MAAA,CACjB,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE;IACxB,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;QAC1C,MAAM,IAAI,GAAG;YACX,KAAK,EAAE,MAAM;YACb,KAAK,EAAE,WAAW;SACnB,CAAC;QACF,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;YACjC,IAAA,sBAAU,EAAC,EAAE,WAAW,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;YAC3C,QAAQ,CAAC,IAAI,CAAC;gBACZ,CAAC,IAAI,EAAE,aAAa,CAAC;gBACrB,CAAC,QAAQ,EAAE,uBAAuB,CAAC;aACpC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE;gBACtB,EAAE,CAAC,uCAAuC,EAAE,GAAS,EAAE;oBACrD,MAAM,KAAK,GAAG,MAAM,IAAA,eAAO,EAAC,IAAA,cAAU,EAAC,IAAA,eAAK,GAAE,CAAC,EAAE,OAAO,CAAC,CAAC;oBAC1D,MAAM,CAAC,KAAK,CAAC,CAAC,qBAAqB,CACjC,uDAAuD,CACxD,CAAC;gBACJ,CAAC,CAAA,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;YAC9B,UAAU,CAAC,GAAG,EAAE;gBACd,IAAA,sBAAU,EAAC;oBACT,WAAW,EAAE;wBACX,GAAG,kCACE,IAAI,KACP,KAAK,EAAE;gCACL,IAAI,EAAE,WAAW;gCACjB,QAAQ,EAAE;oCACR,IAAI,EAAE,MAAM;oCACZ,KAAK,EAAE,YAAY;oCACnB,gBAAgB,EAAE,MAAM;iCACzB;6BACF,GACF;qBACF;iBACF,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YACH,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE;gBACtB,EAAE,CAAC,sBAAsB,EAAE,GAAS,EAAE;oBACpC,MAAM,IAAA,cAAU,EAAC,IAAA,eAAK,GAAE,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;oBACzD,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;oBACxD,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;gBAC1D,CAAC,CAAA,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YACH,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE;gBAClB,EAAE,CAAC,aAAa,EAAE,GAAS,EAAE;oBAC3B,MAAM,IAAA,cAAU,EAAC,IAAA,eAAK,GAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;oBAC/C,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;oBACxD,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;gBAC1D,CAAC,CAAA,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"role.test.js","sourceRoot":"","sources":["../../../../src/commands/aws/__tests__/role.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;AAAA;;;;;;;;;GASG;AACH,0BAAgC;AAChC,kDAAwD;AACxD,0DAAwD;AACxD,kDAAiD;AACjD,6DAAyD;AACzD,2DAAuD;AACvD,kDAA0B;AAE1B,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;AACzB,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;AACnC,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;AACpC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC,iCACzB,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,KACnC,GAAG,EAAE;QACH,gBAAgB,EAAE,GAAG,EAAE,CAAC,IAAI;KAC7B,IACD,CAAC,CAAC;AACJ,IAAI,CAAC,IAAI,CAAC,sBAAsB,EAAE,GAAG,EAAE,CAAC,CAAC;IACvC,gBAAgB,EAAE,IAAI,CAAC,EAAE,EAAE;CAC5B,CAAC,CAAC,CAAC;AAEJ,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAC9C,MAAM,UAAU,GAAG,cAAmB,CAAC;AACvC,MAAM,UAAU,GAAG,cAAmB,CAAC;AAEvC,UAAU,CAAC,GAAG,EAAE;IACd,IAAI,CAAC,aAAa,EAAE,CAAC;IACrB,SAAS,CAAC,kBAAkB,CAC1B,CAAO,GAAsB,EAAE,EAAE;QAC/B,OAAA,CAAC;YACC,EAAE,EAAE,IAAI;YACR,mDAAmD;YACnD,IAAI,EAAE,GAAS,EAAE,kDAAC,OAAA,CAAC,EAAE,CAAC,CAAA,GAAA;YACtB,mEAAmE;YACnE,IAAI,EAAE,GAAS,EAAE,kDACf,OAAC,GAAc,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,4BAAY,CAAC,CAAC,CAAC,0BAAW,CAAA,GAAA;SACjE,CAAa,CAAA;MAAA,CACjB,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE;IACxB,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;QAC1C,MAAM,IAAI,GAAG;YACX,KAAK,EAAE,MAAM;YACb,KAAK,EAAE,WAAW;SACnB,CAAC;QACF,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;YACjC,IAAA,sBAAU,EAAC,EAAE,WAAW,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;YAC3C,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,uBAAuB,CAAC,CAAC,CAAC,CAClD,IAAI,EACJ,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE;gBACb,EAAE,CAAC,uCAAuC,EAAE,GAAS,EAAE;oBACrD,MAAM,KAAK,GAAG,MAAM,IAAA,eAAO,EAAC,IAAA,cAAU,EAAC,IAAA,eAAK,GAAE,CAAC,EAAE,OAAO,CAAC,CAAC;oBAC1D,MAAM,CAAC,KAAK,CAAC,CAAC,qBAAqB,CACjC,uDAAuD,CACxD,CAAC;gBACJ,CAAC,CAAA,CAAC,CAAC;YACL,CAAC,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;YAC9B,UAAU,CAAC,GAAG,EAAE;gBACd,IAAA,sBAAU,EAAC;oBACT,WAAW,EAAE;wBACX,GAAG,kCACE,IAAI,KACP,KAAK,EAAE;gCACL,IAAI,EAAE,WAAW;gCACjB,QAAQ,EAAE;oCACR,IAAI,EAAE,MAAM;oCACZ,KAAK,EAAE,YAAY;oCACnB,gBAAgB,EAAE,MAAM;iCACzB;6BACF,GACF;qBACF;iBACF,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YACH,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE;gBACtB,EAAE,CAAC,sBAAsB,EAAE,GAAS,EAAE;oBACpC,MAAM,IAAA,cAAU,EAAC,IAAA,eAAK,GAAE,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;oBACzD,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;oBACxD,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;gBAC1D,CAAC,CAAA,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/commands/aws/index.d.ts

@@ -1,4 +1,4 @@
 import yargs from "yargs";
-export declare const awsCommand: (yargs: yargs.Argv<{}>) => yargs.Argv<{
-    account: string | undefined;
+export declare const awsCommand: (yargs: yargs.Argv<{}>) => yargs.Argv<import("./types").AssumeCommandArgs & {
+    "permission-set": string;
 }>;

package/dist/commands/aws/index.js

@@ -1,4 +1,13 @@
 "use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.awsCommand = void 0;
 /** Copyright © 2024-present P0 Security
@@ -11,17 +20,29 @@ This file is part of @p0security/cli
 
 You should have received a copy of the GNU General Public License along with @p0security/cli. If not, see <https://www.gnu.org/licenses/>.
 **/
+const auth_1 = require("../../drivers/auth");
+const config_1 = require("../../plugins/aws/config");
+const permission_set_1 = require("./permission-set");
 const role_1 = require("./role");
-const awsCommands = [role_1.role];
-const awsArgs = (yargs) => {
+const awsArgs = (yargs) => __awaiter(void 0, void 0, void 0, function* () {
+    var _a;
     const base = yargs
         .option("account", {
         type: "string",
         describe: "AWS account ID or alias (or set P0_AWS_ACCOUNT)",
+    })
+        .option("reason", {
+        describe: "Reason access is needed",
+        type: "string",
     })
         .env("P0_AWS");
-    return awsCommands.reduce((m, c) => c(m), base).demandCommand(1);
-};
+    const authn = yield (0, auth_1.authenticate)();
+    const { config } = yield (0, config_1.getFirstAwsConfig)(authn);
+    const withCommand = ((_a = config.login) === null || _a === void 0 ? void 0 : _a.type) === "idc"
+        ? (0, permission_set_1.permissionSet)(base, authn)
+        : (0, role_1.role)(base, authn);
+    return withCommand.demandCommand(1);
+});
 const awsCommand = (yargs) => yargs.command("aws", "Execute AWS commands", awsArgs);
 exports.awsCommand = awsCommand;
 //# sourceMappingURL=index.js.map

package/dist/commands/aws/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/commands/aws/index.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;GASG;AACH,iCAA8B;AAG9B,MAAM,WAAW,GAAG,CAAC,WAAI,CAAC,CAAC;AAE3B,MAAM,OAAO,GAAG,CAAC,KAAiB,EAAE,EAAE;IACpC,MAAM,IAAI,GAAG,KAAK;SACf,MAAM,CAAC,SAAS,EAAE;QACjB,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,iDAAiD;KAC5D,CAAC;SACD,GAAG,CAAC,QAAQ,CAAC,CAAC;IACjB,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;AACnE,CAAC,CAAC;AAEK,MAAM,UAAU,GAAG,CAAC,KAAiB,EAAE,EAAE,CAC9C,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,sBAAsB,EAAE,OAAO,CAAC,CAAC;AAD3C,QAAA,UAAU,cACiC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/commands/aws/index.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA;;;;;;;;;GASG;AACH,6CAAkD;AAClD,qDAA6D;AAC7D,qDAAiD;AACjD,iCAA8B;AAG9B,MAAM,OAAO,GAAG,CAAO,KAAiB,EAAE,EAAE;;IAC1C,MAAM,IAAI,GAAG,KAAK;SACf,MAAM,CAAC,SAAS,EAAE;QACjB,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,iDAAiD;KAC5D,CAAC;SACD,MAAM,CAAC,QAAQ,EAAE;QAChB,QAAQ,EAAE,yBAAyB;QACnC,IAAI,EAAE,QAAQ;KACf,CAAC;SACD,GAAG,CAAC,QAAQ,CAAC,CAAC;IAEjB,MAAM,KAAK,GAAG,MAAM,IAAA,mBAAY,GAAE,CAAC;IAEnC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAA,0BAAiB,EAAC,KAAK,CAAC,CAAC;IAElD,MAAM,WAAW,GACf,CAAA,MAAA,MAAM,CAAC,KAAK,0CAAE,IAAI,MAAK,KAAK;QAC1B,CAAC,CAAC,IAAA,8BAAa,EAAC,IAAI,EAAE,KAAK,CAAC;QAC5B,CAAC,CAAC,IAAA,WAAI,EAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAExB,OAAO,WAAW,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;AACtC,CAAC,CAAA,CAAC;AAEK,MAAM,UAAU,GAAG,CAAC,KAAiB,EAAE,EAAE,CAC9C,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,sBAAsB,EAAE,OAAO,CAAC,CAAC;AAD3C,QAAA,UAAU,cACiC"}

package/dist/commands/aws/permission-set.d.ts

@@ -0,0 +1,6 @@
+import { Authn } from "../../types/identity";
+import { AssumeCommandArgs } from "./types";
+import yargs from "yargs";
+export declare const permissionSet: (yargs: yargs.Argv<AssumeCommandArgs>, authn: Authn) => yargs.Argv<AssumeCommandArgs & {
+    "permission-set": string;
+}>;

package/dist/commands/aws/permission-set.js

@@ -0,0 +1,85 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.permissionSet = void 0;
+/** Copyright © 2024-present P0 Security
+
+This file is part of @p0security/cli
+
+@p0security/cli is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, version 3 of the License.
+
+@p0security/cli is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License along with @p0security/cli. If not, see <https://www.gnu.org/licenses/>.
+**/
+const firestore_1 = require("../../drivers/firestore");
+const stdio_1 = require("../../drivers/stdio");
+const config_1 = require("../../plugins/aws/config");
+const idc_1 = require("../../plugins/aws/idc");
+const request_1 = require("../shared/request");
+const lodash_1 = require("lodash");
+const typescript_1 = require("typescript");
+const permissionSet = (yargs, authn) => yargs.command("permission-set", "Interact with AWS permission sets", (yargs) => yargs
+    .command("assume <permission-set>", "Assume an AWS permission set", (y) => y.positional("permission-set", {
+    type: "string",
+    demandOption: true,
+    describe: "An AWS permission set name",
+}), (0, firestore_1.fsShutdownGuard)((argv) => oktaAwsAssumePermissionSet(argv, authn)))
+    .demandCommand(1));
+exports.permissionSet = permissionSet;
+const oktaAwsAssumePermissionSet = (argv, authn) => __awaiter(void 0, void 0, void 0, function* () {
+    var _a;
+    const { account, permissionSet } = argv;
+    const { config } = yield (0, config_1.getAwsConfig)(authn, account);
+    if (((_a = config.login) === null || _a === void 0 ? void 0 : _a.type) !== "idc") {
+        throw new Error(`Unexpected login type. Expected IDC to be enabled for account ${account}`);
+    }
+    const { login } = config;
+    const requestCommand = buildPermissionSetRequestCommand(argv);
+    yield (0, request_1.provisionRequest)(requestCommand, authn);
+    const awsCredential = yield (0, idc_1.assumeRoleWithIdc)({
+        accountId: config.id,
+        permissionSet,
+        idc: { id: login.identityStoreId, region: login.idcRegion },
+    });
+    printAwsCredentials(argv, awsCredential);
+});
+const buildPermissionSetRequestCommand = (argv) => {
+    return Object.assign(Object.assign({}, (0, lodash_1.pick)(argv, "$0", "_")), { arguments: [
+            "aws",
+            "permission-set",
+            argv.permissionSet,
+            ...(argv.reason ? ["--reason", argv.reason] : []),
+            ...(argv.account ? ["--account", argv.account] : []),
+        ], wait: true });
+};
+/**
+ * Prints the AWS credentials to the console.
+ *
+ * @param awsCredential The AWS credentials to print.
+ * @param argv The command line arguments.
+ */
+const printAwsCredentials = (argv, awsCredential) => {
+    var _a;
+    const isTty = (_a = typescript_1.sys.writeOutputIsTTY) === null || _a === void 0 ? void 0 : _a.call(typescript_1.sys);
+    if (isTty)
+        (0, stdio_1.print2)("Execute the following commands:\n");
+    const indent = isTty ? "  " : "";
+    (0, stdio_1.print1)(Object.entries(awsCredential)
+        .map(([key, value]) => `${indent}export ${key}=${value}`)
+        .join("\n"));
+    if (isTty)
+        (0, stdio_1.print2)(`
+Or, populate these environment variables using BASH command substitution:
+
+  $(p0 aws${argv.account ? ` --account ${argv.account}` : ""} permission-set assume ${argv.permissionSet}) `);
+};
+//# sourceMappingURL=permission-set.js.map

package/dist/commands/aws/permission-set.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-set.js","sourceRoot":"","sources":["../../../src/commands/aws/permission-set.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA;;;;;;;;;GASG;AACH,uDAA0D;AAC1D,+CAAqD;AACrD,qDAAwD;AACxD,+CAA0D;AAG1D,+CAAqD;AAErD,mCAA8B;AAC9B,2CAAiC;AAG1B,MAAM,aAAa,GAAG,CAC3B,KAAoC,EACpC,KAAY,EACZ,EAAE,CACF,KAAK,CAAC,OAAO,CACX,gBAAgB,EAChB,mCAAmC,EACnC,CAAC,KAAK,EAAE,EAAE,CACR,KAAK;KACF,OAAO,CACN,yBAAyB,EACzB,8BAA8B,EAC9B,CAAC,CAAgC,EAAE,EAAE,CACnC,CAAC,CAAC,UAAU,CAAC,gBAAgB,EAAE;IAC7B,IAAI,EAAE,QAAQ;IACd,YAAY,EAAE,IAAI;IAClB,QAAQ,EAAE,4BAA4B;CACvC,CAAC,EACJ,IAAA,2BAAe,EAAC,CAAC,IAAI,EAAE,EAAE,CAAC,0BAA0B,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CACnE;KACA,aAAa,CAAC,CAAC,CAAC,CACtB,CAAC;AArBS,QAAA,aAAa,iBAqBtB;AAEJ,MAAM,0BAA0B,GAAG,CACjC,IAA8D,EAC9D,KAAY,EACZ,EAAE;;IACF,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC;IACxC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAA,qBAAY,EAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAEtD,IAAI,CAAA,MAAA,MAAM,CAAC,KAAK,0CAAE,IAAI,MAAK,KAAK,EAAE;QAChC,MAAM,IAAI,KAAK,CACb,iEAAiE,OAAO,EAAE,CAC3E,CAAC;KACH;IAED,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;IAEzB,MAAM,cAAc,GAAG,gCAAgC,CAAC,IAAI,CAAC,CAAC;IAE9D,MAAM,IAAA,0BAAgB,EAAC,cAAc,EAAE,KAAK,CAAC,CAAC;IAE9C,MAAM,aAAa,GAAG,MAAM,IAAA,uBAAiB,EAAC;QAC5C,SAAS,EAAE,MAAM,CAAC,EAAE;QACpB,aAAa;QACb,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,eAAe,EAAE,MAAM,EAAE,KAAK,CAAC,SAAS,EAAE;KAC5D,CAAC,CAAC;IAEH,mBAAmB,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;AAC3C,CAAC,CAAA,CAAC;AAEF,MAAM,gCAAgC,GAAG,CACvC,IAA8D,EAI7D,EAAE;IACH,uCACK,IAAA,aAAI,EAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,KACxB,SAAS,EAAE;YACT,KAAK;YACL,gBAAgB;YAChB,IAAI,CAAC,aAAa;YAClB,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SACrD,EACD,IAAI,EAAE,IAAI,IACV;AACJ,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,mBAAmB,GAAG,CAC1B,IAA8D,EAC9D,aAA6B,EAC7B,EAAE;;IACF,MAAM,KAAK,GAAG,MAAA,gBAAG,CAAC,gBAAgB,gEAAI,CAAC;IACvC,IAAI,KAAK;QAAE,IAAA,cAAM,EAAC,mCAAmC,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACjC,IAAA,cAAM,EACJ,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC;SAC1B,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,MAAM,UAAU,GAAG,IAAI,KAAK,EAAE,CAAC;SACxD,IAAI,CAAC,IAAI,CAAC,CACd,CAAC;IACF,IAAI,KAAK;QACP,IAAA,cAAM,EAAC;;;YAGC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,0BAA0B,IAAI,CAAC,aAAa,IAAI,CAAC,CAAC;AAC9G,CAAC,CAAC"}

package/dist/commands/aws/role.d.ts

@@ -1,29 +1,9 @@
-import { AwsFederatedLogin } from "../../plugins/aws/types";
 import { Authn } from "../../types/identity";
 import yargs from "yargs";
 export declare const role: (yargs: yargs.Argv<{
     account: string | undefined;
-}>) => yargs.Argv<{
+}>, authn: Authn) => yargs.Argv<{
     account: string | undefined;
 } & {
     role: string;
 }>;
-/** Retrieves the configured Okta SAML response for the specified account
- *
- * If no account is passed, and the organization only has one account configured,
- * assumes that account.
- */
-export declare const initOktaSaml: (authn: Authn, account: string | undefined) => Promise<{
-    samlResponse: string;
-    config: {
-        id: string;
-    } & import("../../plugins/aws/types").AwsItemConfig & {
-        login: AwsFederatedLogin;
-    };
-    account: string;
-}>;
-/** Extracts all roles from a SAML assertion */
-export declare const rolesFromSaml: (account: string, saml: string) => {
-    arns: string[];
-    roles: string[];
-};

package/dist/commands/aws/role.js

@@ -9,7 +9,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.rolesFromSaml = exports.initOktaSaml = exports.role = void 0;
+exports.role = void 0;
 /** Copyright © 2024-present P0 Security
 
 This file is part of @p0security/cli
@@ -20,63 +20,22 @@ This file is part of @p0security/cli
 
 You should have received a copy of the GNU General Public License along with @p0security/cli. If not, see <https://www.gnu.org/licenses/>.
 **/
-const xml_1 = require("../../common/xml");
-const auth_1 = require("../../drivers/auth");
 const firestore_1 = require("../../drivers/firestore");
 const stdio_1 = require("../../drivers/stdio");
-const config_1 = require("../../plugins/aws/config");
 const aws_1 = require("../../plugins/okta/aws");
-const login_1 = require("../../plugins/okta/login");
+const request_1 = require("../shared/request");
 const lodash_1 = require("lodash");
 const typescript_1 = require("typescript");
-const role = (yargs) => yargs.command("role", "Interact with AWS roles", (yargs) => yargs
-    .command("ls", "List available AWS roles", lodash_1.identity, 
-// TODO: select based on uidLocation
-(0, firestore_1.fsShutdownGuard)(oktaAwsListRoles))
+const role = (yargs, authn) => yargs.command("role", "Interact with AWS roles", (yargs) => yargs
     .command("assume <role>", "Assume an AWS role", (y) => y.positional("role", {
     type: "string",
     demandOption: true,
     describe: "An AWS role name",
 }), 
 // TODO: select based on uidLocation
-(0, firestore_1.fsShutdownGuard)(oktaAwsAssumeRole))
+(0, firestore_1.fsShutdownGuard)((argv) => oktaAwsAssumeRole(argv, authn)))
     .demandCommand(1));
 exports.role = role;
-const isFederatedLogin = (config) => { var _a; return ((_a = config.login) === null || _a === void 0 ? void 0 : _a.type) === "federated"; };
-/** Retrieves the configured Okta SAML response for the specified account
- *
- * If no account is passed, and the organization only has one account configured,
- * assumes that account.
- */
-const initOktaSaml = (authn, account) => __awaiter(void 0, void 0, void 0, function* () {
-    var _a;
-    const { identity, config } = yield (0, config_1.getAwsConfig)(authn, account);
-    if (!isFederatedLogin(config))
-        throw `Account ${(_a = config.label) !== null && _a !== void 0 ? _a : config.id} is not configured for Okta SAML login.`;
-    const samlResponse = yield (0, login_1.getSamlResponse)(identity, config.login);
-    return {
-        samlResponse,
-        config,
-        account: config.id,
-    };
-});
-exports.initOktaSaml = initOktaSaml;
-/** Extracts all roles from a SAML assertion */
-const rolesFromSaml = (account, saml) => {
-    var _a;
-    const samlText = Buffer.from(saml, "base64").toString("ascii");
-    const samlObject = (0, xml_1.parseXml)(samlText);
-    const samlAttributes = samlObject["saml2p:Response"]["saml2:Assertion"]["saml2:AttributeStatement"]["saml2:Attribute"];
-    const roleAttribute = samlAttributes.find((a) => a._attributes.Name === "https://aws.amazon.com/SAML/Attributes/Role");
-    // Format:
-    //   'arn:aws:iam::391052057035:saml-provider/p0dev-ext_okta_sso,arn:aws:iam::391052057035:role/path/to/role/SSOAmazonS3FullAccess'
-    const arns = (_a = (0, lodash_1.flatten)([roleAttribute === null || roleAttribute === void 0 ? void 0 : roleAttribute["saml2:AttributeValue"]])) === null || _a === void 0 ? void 0 : _a.map((r) => r.split(",")[1]);
-    const roles = arns
-        .filter((r) => r.startsWith(`arn:aws:iam::${account}:role/`))
-        .map((r) => r.split("/").slice(1).join("/"));
-    return { arns, roles };
-};
-exports.rolesFromSaml = rolesFromSaml;
 /** Assumes a role in AWS via Okta SAML federation.
  *
  * Prerequisites:
@@ -88,14 +47,33 @@ exports.rolesFromSaml = rolesFromSaml;
  *   the user's identity blob
  * - The requested role is assigned to the user in Okta
  */
-const oktaAwsAssumeRole = (args) => __awaiter(void 0, void 0, void 0, function* () {
-    var _b;
-    const authn = yield (0, auth_1.authenticate)();
+const oktaAwsAssumeRole = (argv, authn) => __awaiter(void 0, void 0, void 0, function* () {
+    const requestCommand = buildRoleRequestCommand(argv);
+    yield (0, request_1.provisionRequest)(requestCommand, authn);
     const awsCredential = yield (0, aws_1.assumeRoleWithOktaSaml)(authn, {
-        accountId: args.account,
-        role: args.role,
+        accountId: argv.account,
+        role: argv.role,
     });
-    const isTty = (_b = typescript_1.sys.writeOutputIsTTY) === null || _b === void 0 ? void 0 : _b.call(typescript_1.sys);
+    printAwsCredentials(argv, awsCredential);
+});
+const buildRoleRequestCommand = (argv) => {
+    return Object.assign(Object.assign({}, (0, lodash_1.pick)(argv, "$0", "_")), { arguments: [
+            "aws",
+            "role",
+            argv.role,
+            ...(argv.reason ? ["--reason", argv.reason] : []),
+            ...(argv.account ? ["--account", argv.account] : []),
+        ], wait: true });
+};
+/**
+ * Prints the AWS credentials to the console.
+ *
+ * @param argv The command line arguments.
+ * @param awsCredential The AWS credentials to print.
+ */
+const printAwsCredentials = (argv, awsCredential) => {
+    var _a;
+    const isTty = (_a = typescript_1.sys.writeOutputIsTTY) === null || _a === void 0 ? void 0 : _a.call(typescript_1.sys);
     if (isTty)
         (0, stdio_1.print2)("Execute the following commands:\n");
     const indent = isTty ? "  " : "";
@@ -106,23 +84,7 @@ const oktaAwsAssumeRole = (args) => __awaiter(void 0, void 0, void 0, function*
         (0, stdio_1.print2)(`
 Or, populate these environment variables using BASH command substitution:
 
-  $(p0 aws${args.account ? ` --account ${args.account}` : ""} role assume ${args.role})
+  $(p0 aws${argv.account ? ` --account ${argv.account}` : ""} role assume ${argv.role})
 `);
-});
-/** Lists assigned AWS roles for this user on this account */
-const oktaAwsListRoles = (args) => __awaiter(void 0, void 0, void 0, function* () {
-    var _c;
-    const authn = yield (0, auth_1.authenticate)();
-    const { account, samlResponse } = yield (0, exports.initOktaSaml)(authn, args.account);
-    const { arns, roles } = (0, exports.rolesFromSaml)(account, samlResponse);
-    const isTty = (_c = typescript_1.sys.writeOutputIsTTY) === null || _c === void 0 ? void 0 : _c.call(typescript_1.sys);
-    if (isTty)
-        (0, stdio_1.print2)(`Your available roles for account ${account}:`);
-    if (!(roles === null || roles === void 0 ? void 0 : roles.length)) {
-        const accounts = (0, lodash_1.uniq)(arns.map((a) => a.split(":")[4])).sort();
-        throw `No roles found. You have roles on these accounts:\n${accounts.join("\n")}`;
-    }
-    const indent = isTty ? "  " : "";
-    (0, stdio_1.print1)(roles.map((r) => `${indent}${r}`).join("\n"));
-});
+};
 //# sourceMappingURL=role.js.map

package/dist/commands/aws/role.js.map

@@ -1 +1 @@
-{"version":3,"file":"role.js","sourceRoot":"","sources":["../../../src/commands/aws/role.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA;;;;;;;;;GASG;AACH,0CAA4C;AAC5C,6CAAkD;AAClD,uDAA0D;AAC1D,+CAAqD;AACrD,qDAAwD;AAExD,gDAAgE;AAChE,oDAA2D;AAE3D,mCAAiD;AACjD,2CAAiC;AAG1B,MAAM,IAAI,GAAG,CAAC,KAAkD,EAAE,EAAE,CACzE,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,yBAAyB,EAAE,CAAC,KAAK,EAAE,EAAE,CACzD,KAAK;KACF,OAAO,CACN,IAAI,EACJ,0BAA0B,EAC1B,iBAAQ;AACR,oCAAoC;AACpC,IAAA,2BAAe,EAAC,gBAAgB,CAAC,CAClC;KACA,OAAO,CACN,eAAe,EACf,oBAAoB,EACpB,CAAC,CAA8C,EAAE,EAAE,CACjD,CAAC,CAAC,UAAU,CAAC,MAAM,EAAE;IACnB,IAAI,EAAE,QAAQ;IACd,YAAY,EAAE,IAAI;IAClB,QAAQ,EAAE,kBAAkB;CAC7B,CAAC;AACJ,oCAAoC;AACpC,IAAA,2BAAe,EAAC,iBAAiB,CAAC,CACnC;KACA,aAAa,CAAC,CAAC,CAAC,CACpB,CAAC;AAvBS,QAAA,IAAI,QAuBb;AAEJ,MAAM,gBAAgB,GAAG,CACvB,MAAe,EACmC,EAAE,WACpD,OAAA,CAAA,MAAA,MAAM,CAAC,KAAK,0CAAE,IAAI,MAAK,WAAW,CAAA,EAAA,CAAC;AAErC;;;;GAIG;AACI,MAAM,YAAY,GAAG,CAC1B,KAAY,EACZ,OAA2B,EAC3B,EAAE;;IACF,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,IAAA,qBAAY,EAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAChE,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC;QAC3B,MAAM,WAAW,MAAA,MAAM,CAAC,KAAK,mCAAI,MAAM,CAAC,EAAE,yCAAyC,CAAC;IACtF,MAAM,YAAY,GAAG,MAAM,IAAA,uBAAe,EAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IACnE,OAAO;QACL,YAAY;QACZ,MAAM;QACN,OAAO,EAAE,MAAM,CAAC,EAAE;KACnB,CAAC;AACJ,CAAC,CAAA,CAAC;AAbW,QAAA,YAAY,gBAavB;AAEF,+CAA+C;AACxC,MAAM,aAAa,GAAG,CAAC,OAAe,EAAE,IAAY,EAAE,EAAE;;IAC7D,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC/D,MAAM,UAAU,GAAG,IAAA,cAAQ,EAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,cAAc,GAClB,UAAU,CAAC,iBAAiB,CAAC,CAAC,iBAAiB,CAAC,CAC9C,0BAA0B,CAC3B,CAAC,iBAAiB,CAAC,CAAC;IACvB,MAAM,aAAa,GAAG,cAAc,CAAC,IAAI,CACvC,CAAC,CAAM,EAAE,EAAE,CACT,CAAC,CAAC,WAAW,CAAC,IAAI,KAAK,6CAA6C,CACvE,CAAC;IACF,UAAU;IACV,mIAAmI;IACnI,MAAM,IAAI,GAAG,MACX,IAAA,gBAAO,EAAC,CAAC,aAAa,aAAb,aAAa,uBAAb,aAAa,CAAG,sBAAsB,CAAC,CAAC,CAClD,0CAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;IAChC,MAAM,KAAK,GAAG,IAAI;SACf,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,gBAAgB,OAAO,QAAQ,CAAC,CAAC;SAC5D,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/C,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACzB,CAAC,CAAC;AApBW,QAAA,aAAa,iBAoBxB;AAEF;;;;;;;;;;GAUG;AACH,MAAM,iBAAiB,GAAG,CAAO,IAAwC,EAAE,EAAE;;IAC3E,MAAM,KAAK,GAAG,MAAM,IAAA,mBAAY,GAAE,CAAC;IACnC,MAAM,aAAa,GAAG,MAAM,IAAA,4BAAsB,EAAC,KAAK,EAAE;QACxD,SAAS,EAAE,IAAI,CAAC,OAAO;QACvB,IAAI,EAAE,IAAI,CAAC,IAAI;KAChB,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,MAAA,gBAAG,CAAC,gBAAgB,gEAAI,CAAC;IACvC,IAAI,KAAK;QAAE,IAAA,cAAM,EAAC,mCAAmC,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACjC,IAAA,cAAM,EACJ,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC;SAC1B,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,MAAM,UAAU,GAAG,IAAI,KAAK,EAAE,CAAC;SACxD,IAAI,CAAC,IAAI,CAAC,CACd,CAAC;IACF,IAAI,KAAK;QACP,IAAA,cAAM,EAAC;;;YAGC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,gBACxD,IAAI,CAAC,IACP;CACD,CAAC,CAAC;AACH,CAAC,CAAA,CAAC;AAEF,6DAA6D;AAC7D,MAAM,gBAAgB,GAAG,CAAO,IAA0B,EAAE,EAAE;;IAC5D,MAAM,KAAK,GAAG,MAAM,IAAA,mBAAY,GAAE,CAAC;IACnC,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,MAAM,IAAA,oBAAY,EAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1E,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,IAAA,qBAAa,EAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,MAAA,gBAAG,CAAC,gBAAgB,gEAAI,CAAC;IACvC,IAAI,KAAK;QAAE,IAAA,cAAM,EAAC,oCAAoC,OAAO,GAAG,CAAC,CAAC;IAClE,IAAI,CAAC,CAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,MAAM,CAAA,EAAE;QAClB,MAAM,QAAQ,GAAG,IAAA,aAAI,EAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/D,MAAM,sDAAsD,QAAQ,CAAC,IAAI,CACvE,IAAI,CACL,EAAE,CAAC;KACL;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACjC,IAAA,cAAM,EAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AACvD,CAAC,CAAA,CAAC"}
+{"version":3,"file":"role.js","sourceRoot":"","sources":["../../../src/commands/aws/role.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA;;;;;;;;;GASG;AACH,uDAA0D;AAC1D,+CAAqD;AAErD,gDAAgE;AAEhE,+CAAqD;AAErD,mCAA8B;AAC9B,2CAAiC;AAG1B,MAAM,IAAI,GAAG,CAClB,KAAkD,EAClD,KAAY,EACZ,EAAE,CACF,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,yBAAyB,EAAE,CAAC,KAAK,EAAE,EAAE,CACzD,KAAK;KACF,OAAO,CACN,eAAe,EACf,oBAAoB,EACpB,CAAC,CAA8C,EAAE,EAAE,CACjD,CAAC,CAAC,UAAU,CAAC,MAAM,EAAE;IACnB,IAAI,EAAE,QAAQ;IACd,YAAY,EAAE,IAAI;IAClB,QAAQ,EAAE,kBAAkB;CAC7B,CAAC;AACJ,oCAAoC;AACpC,IAAA,2BAAe,EAAC,CAAC,IAAI,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAC1D;KACA,aAAa,CAAC,CAAC,CAAC,CACpB,CAAC;AAnBS,QAAA,IAAI,QAmBb;AAEJ;;;;;;;;;;GAUG;AACH,MAAM,iBAAiB,GAAG,CACxB,IAAqD,EACrD,KAAY,EACZ,EAAE;IACF,MAAM,cAAc,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAErD,MAAM,IAAA,0BAAgB,EAAC,cAAc,EAAE,KAAK,CAAC,CAAC;IAE9C,MAAM,aAAa,GAAG,MAAM,IAAA,4BAAsB,EAAC,KAAK,EAAE;QACxD,SAAS,EAAE,IAAI,CAAC,OAAO;QACvB,IAAI,EAAE,IAAI,CAAC,IAAI;KAChB,CAAC,CAAC;IAEH,mBAAmB,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;AAC3C,CAAC,CAAA,CAAC;AAEF,MAAM,uBAAuB,GAAG,CAC9B,IAAqD,EAIpD,EAAE;IACH,uCACK,IAAA,aAAI,EAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,KACxB,SAAS,EAAE;YACT,KAAK;YACL,MAAM;YACN,IAAI,CAAC,IAAI;YACT,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SACrD,EACD,IAAI,EAAE,IAAI,IACV;AACJ,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,mBAAmB,GAAG,CAC1B,IAAqD,EACrD,aAA6B,EAC7B,EAAE;;IACF,MAAM,KAAK,GAAG,MAAA,gBAAG,CAAC,gBAAgB,gEAAI,CAAC;IACvC,IAAI,KAAK;QAAE,IAAA,cAAM,EAAC,mCAAmC,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACjC,IAAA,cAAM,EACJ,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC;SAC1B,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,MAAM,UAAU,GAAG,IAAI,KAAK,EAAE,CAAC;SACxD,IAAI,CAAC,IAAI,CAAC,CACd,CAAC;IACF,IAAI,KAAK;QACP,IAAA,cAAM,EAAC;;;YAGC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,gBAAgB,IAAI,CAAC,IAAI;CACpF,CAAC,CAAC;AACH,CAAC,CAAC"}

package/dist/commands/aws/types.d.ts

@@ -0,0 +1,20 @@
+/** Copyright © 2024-present P0 Security
+
+This file is part of @p0security/cli
+
+@p0security/cli is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, version 3 of the License.
+
+@p0security/cli is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License along with @p0security/cli. If not, see <https://www.gnu.org/licenses/>.
+**/
+export type AssumeCommandArgs = {
+    account?: string;
+    reason?: string;
+};
+export type AssumePermissionSetCommandArgs = AssumeCommandArgs & {
+    permissionSet: string;
+};
+export type AssumeRoleCommandArgs = AssumeCommandArgs & {
+    role: string;
+};

package/dist/commands/aws/types.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

package/dist/commands/aws/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/commands/aws/types.ts"],"names":[],"mappings":""}

package/dist/commands/ls.js

@@ -72,7 +72,7 @@ const ls = (args) => __awaiter(void 0, void 0, void 0, function* () {
     ]));
     if (data && "ok" in data && data.ok) {
         if (args.json) {
-            (0, stdio_1.print2)(JSON.stringify(data, null, 2));
+            (0, stdio_1.print1)(JSON.stringify(data, null, 2));
             return;
         }
         const allArguments = [...args._, ...args.arguments];

package/dist/commands/shared/request.d.ts

@@ -1,6 +1,9 @@
 import { Authn } from "../../types/identity";
 import { RequestResponse } from "../../types/request";
 import yargs from "yargs";
+export declare const PROVISIONING_ACCESS_MESSAGE = "Waiting for access to be provisioned";
+export declare const EXISTING_ACCESS_MESSAGE = "Existing access found.";
+export declare const ACCESS_EXISTS_ERROR_MESSAGE = "This principal already has this access";
 export declare const requestArgs: <T>(yargs: yargs.Argv<T>) => yargs.Argv<T & {
     wait: boolean;
 } & {
@@ -13,3 +16,7 @@ export declare const request: (command: "grant" | "request") => <T>(args: yargs.
     accessMessage?: string;
     message?: "all" | "approval-required" | "none" | "quiet";
 }) => Promise<RequestResponse<T> | undefined>;
+export declare const provisionRequest: (argv: yargs.ArgumentsCamelCase<{
+    arguments: string[];
+    wait?: boolean;
+}>, authn: Authn) => Promise<void>;

package/dist/commands/shared/request.js

@@ -9,7 +9,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.request = exports.requestArgs = void 0;
+exports.provisionRequest = exports.request = exports.requestArgs = exports.ACCESS_EXISTS_ERROR_MESSAGE = exports.EXISTING_ACCESS_MESSAGE = exports.PROVISIONING_ACCESS_MESSAGE = void 0;
 /** Copyright © 2024-present P0 Security
 
 This file is part of @p0security/cli
@@ -20,6 +20,7 @@ This file is part of @p0security/cli
 
 You should have received a copy of the GNU General Public License along with @p0security/cli. If not, see <https://www.gnu.org/licenses/>.
 **/
+const _1 = require(".");
 const api_1 = require("../../drivers/api");
 const auth_1 = require("../../drivers/auth");
 const firestore_1 = require("../../drivers/firestore");
@@ -27,6 +28,9 @@ const stdio_1 = require("../../drivers/stdio");
 const firestore_2 = require("firebase/firestore");
 const typescript_1 = require("typescript");
 const WAIT_TIMEOUT = 300e3;
+exports.PROVISIONING_ACCESS_MESSAGE = "Waiting for access to be provisioned";
+exports.EXISTING_ACCESS_MESSAGE = "Existing access found.";
+exports.ACCESS_EXISTS_ERROR_MESSAGE = "This principal already has this access";
 const APPROVED = { message: "Your request was approved", code: 0 };
 const DENIED = { message: "Your request was denied", code: 2 };
 const ERRORED = { message: "Your request encountered an error", code: 1 };
@@ -124,4 +128,27 @@ const request = (command) => (args, authn, options) => __awaiter(void 0, void 0,
     }
 });
 exports.request = request;
+const provisionRequest = (argv, authn) => __awaiter(void 0, void 0, void 0, function* () {
+    try {
+        const response = yield (0, exports.request)("request")(argv, authn, {
+            message: "approval-required",
+        });
+        if (!response) {
+            (0, stdio_1.print2)("Did not receive access ID from server");
+            return;
+        }
+        const { id, isPreexisting } = response;
+        (0, stdio_1.print2)(!isPreexisting ? exports.PROVISIONING_ACCESS_MESSAGE : exports.EXISTING_ACCESS_MESSAGE);
+        yield (0, _1.waitForProvisioning)(authn, id);
+    }
+    catch (error) {
+        if (error === exports.ACCESS_EXISTS_ERROR_MESSAGE) {
+            (0, stdio_1.print2)(exports.EXISTING_ACCESS_MESSAGE);
+        }
+        else {
+            throw error;
+        }
+    }
+});
+exports.provisionRequest = provisionRequest;
 //# sourceMappingURL=request.js.map

package/dist/commands/shared/request.js.map

@@ -1 +1 @@
-{"version":3,"file":"request.js","sourceRoot":"","sources":["../../../src/commands/shared/request.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA;;;;;;;;;GASG;AACH,2CAAiD;AACjD,6CAAkD;AAClD,uDAA8C;AAC9C,+CAAwD;AAOxD,kDAAgD;AAChD,2CAAiC;AAGjC,MAAM,YAAY,GAAG,KAAK,CAAC;AAE3B,MAAM,QAAQ,GAAG,EAAE,OAAO,EAAE,2BAA2B,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AACnE,MAAM,MAAM,GAAG,EAAE,OAAO,EAAE,yBAAyB,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AAC/D,MAAM,OAAO,GAAG,EAAE,OAAO,EAAE,mCAAmC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AAE1E,MAAM,0BAA0B,GAAG;IACjC,QAAQ;IACR,iBAAiB,EAAE,QAAQ;IAC3B,IAAI,EAAE,QAAQ;IACd,aAAa,EAAE,QAAQ;IACvB,MAAM;IACN,OAAO;CACR,CAAC;AAEF,MAAM,iBAAiB,GAAG,CACxB,MAAW,EACwC,EAAE,CACrD,MAAM,IAAI,0BAA0B,CAAC;AAEhC,MAAM,WAAW,GAAG,CAAI,KAAoB,EAAE,EAAE,CACrD,KAAK;KACF,mBAAmB,CAAC,EAAE,yBAAyB,EAAE,IAAI,EAAE,CAAC;KACxD,IAAI,CAAC,KAAK,CAAC,CAAC,4HAA4H;KACxI,MAAM,CAAC,MAAM,EAAE;IACd,KAAK,EAAE,GAAG;IACV,OAAO,EAAE,IAAI;IACb,OAAO,EAAE,KAAK;IACd,QAAQ,EAAE,sCAAsC;CACjD,CAAC;KACD,MAAM,CAAC,WAAW,EAAE;IACnB,KAAK,EAAE,IAAI;IACX,MAAM,EAAE,IAAI;IACZ,OAAO,EAAE,EAAc;CACxB,CAAC,CAAC;AAdM,QAAA,WAAW,eAcjB;AAEP,MAAM,cAAc,GAAG,CACrB,QAAgB,EAChB,SAAiB,EACjB,UAAmB,EACnB,EAAE;IACF,OAAA,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE;QACpC,IAAI,UAAU;YACZ,IAAA,cAAM,EAAC,2DAA2D,CAAC,CAAC;QACtE,IAAI,MAAM,GAA+B,SAAS,CAAC;QACnD,MAAM,WAAW,GAAG,IAAA,sBAAU,EAC5B,IAAA,eAAG,EAAC,KAAK,QAAQ,wBAAwB,SAAS,EAAE,CAAC,EACrD,CAAC,IAAI,EAAE,EAAE;YACP,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YACzB,IAAI,CAAC,IAAI;gBAAE,OAAO;YAClB,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;YACxB,IAAI,iBAAiB,CAAC,MAAM,CAAC,EAAE;gBAC7B,IAAI,MAAM;oBAAE,YAAY,CAAC,MAAM,CAAC,CAAC;gBACjC,WAAW,aAAX,WAAW,uBAAX,WAAW,EAAI,CAAC;gBAChB,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,0BAA0B,CAAC,MAAM,CAAC,CAAC;gBAC7D,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK;oBAC7B,CAAC,CAAC,GAAG,OAAO,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE;oBACrC,CAAC,CAAC,OAAO,CAAC;gBACZ,IAAI,IAAI,KAAK,CAAC,IAAI,UAAU;oBAAE,IAAA,cAAM,EAAC,YAAY,CAAC,CAAC;gBACnD,OAAO,CAAC,IAAI,CAAC,CAAC;aACf;QACH,CAAC,CACF,CAAC;QACF,MAAM,GAAG,UAAU,CAAC,GAAG,EAAE;YACvB,WAAW,aAAX,WAAW,uBAAX,WAAW,EAAI,CAAC;YAChB,IAAA,cAAM,EAAC,iDAAiD,CAAC,CAAC;YAC1D,OAAO,CAAC,CAAC,CAAC,CAAC;QACb,CAAC,EAAE,YAAY,CAAC,CAAC;IACnB,CAAC,CAAC,CAAA;EAAA,CAAC;AAEE,MAAM,OAAO,GAClB,CAAC,OAA4B,EAAE,EAAE,CACjC,CACE,IAGE,EACF,KAAa,EACb,OAGC,EACwC,EAAE;IAC3C,MAAM,aAAa,GAAG,KAAK,aAAL,KAAK,cAAL,KAAK,GAAI,CAAC,MAAM,IAAA,mBAAY,GAAE,CAAC,CAAC;IACtD,MAAM,EAAE,cAAc,EAAE,GAAG,aAAa,CAAC;IACzC,MAAM,aAAa,GAAG,CAAC,OAAgB,EAAE,EAAE;QACzC,QAAQ,OAAO,EAAE;YACf,KAAK,mBAAmB;gBACtB,OAAO,2BAA2B,CAAC;YACrC;gBACE,OAAO,mBAAmB,CAAC;SAC9B;IACH,CAAC,CAAC;IAEF,MAAM,mBAAmB,GAAG,IAAA,kBAAY,EACtC,aAAa,EACb,IAAI,EACJ,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,CAC7B,CAAC;IAEF,MAAM,IAAI,GACR,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,OAAO,KAAI,OAAO;QACzB,CAAC,CAAC,MAAM,IAAA,iBAAS,EAAC,aAAa,CAAC,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,OAAO,CAAC,EAAE,mBAAmB,CAAC;QACvE,CAAC,CAAC,MAAM,mBAAmB,CAAC;IAEhC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,SAAS,IAAI,IAAI,IAAI,IAAI,CAAC,EAAE,EAAE;QACxD,MAAM,UAAU,GACd,CAAC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,OAAO,CAAA;YACjB,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,OAAO,MAAK,KAAK;YAC1B,CAAC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,OAAO,MAAK,mBAAmB;gBACvC,CAAC,IAAI,CAAC,aAAa;gBACnB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACxB,IAAI,UAAU;YAAE,IAAA,cAAM,EAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC;QACpB,IAAI,IAAI,CAAC,IAAI,IAAI,EAAE,IAAI,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE;YACnD,MAAM,IAAI,GAAG,MAAM,cAAc,CAC/B,cAAc,CAAC,IAAI,CAAC,QAAQ,EAC5B,EAAE,EACF,UAAU,CACX,CAAC;YACF,IAAI,IAAI,EAAE;gBACR,gBAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACf,OAAO,SAAS,CAAC;aAClB;YACD,OAAO,IAAI,CAAC;SACb;;YAAM,OAAO,SAAS,CAAC;KACzB;SAAM;QACL,MAAM,IAAI,CAAC;KACZ;AACH,CAAC,CAAA,CAAC;AA3DS,QAAA,OAAO,WA2DhB"}
+{"version":3,"file":"request.js","sourceRoot":"","sources":["../../../src/commands/shared/request.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA;;;;;;;;;GASG;AACH,wBAAwC;AACxC,2CAAiD;AACjD,6CAAkD;AAClD,uDAA8C;AAC9C,+CAAwD;AAOxD,kDAAgD;AAChD,2CAAiC;AAGjC,MAAM,YAAY,GAAG,KAAK,CAAC;AAEd,QAAA,2BAA2B,GACtC,sCAAsC,CAAC;AAC5B,QAAA,uBAAuB,GAAG,wBAAwB,CAAC;AACnD,QAAA,2BAA2B,GACtC,wCAAwC,CAAC;AAE3C,MAAM,QAAQ,GAAG,EAAE,OAAO,EAAE,2BAA2B,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AACnE,MAAM,MAAM,GAAG,EAAE,OAAO,EAAE,yBAAyB,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AAC/D,MAAM,OAAO,GAAG,EAAE,OAAO,EAAE,mCAAmC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AAE1E,MAAM,0BAA0B,GAAG;IACjC,QAAQ;IACR,iBAAiB,EAAE,QAAQ;IAC3B,IAAI,EAAE,QAAQ;IACd,aAAa,EAAE,QAAQ;IACvB,MAAM;IACN,OAAO;CACR,CAAC;AAEF,MAAM,iBAAiB,GAAG,CACxB,MAAW,EACwC,EAAE,CACrD,MAAM,IAAI,0BAA0B,CAAC;AAEhC,MAAM,WAAW,GAAG,CAAI,KAAoB,EAAE,EAAE,CACrD,KAAK;KACF,mBAAmB,CAAC,EAAE,yBAAyB,EAAE,IAAI,EAAE,CAAC;KACxD,IAAI,CAAC,KAAK,CAAC,CAAC,4HAA4H;KACxI,MAAM,CAAC,MAAM,EAAE;IACd,KAAK,EAAE,GAAG;IACV,OAAO,EAAE,IAAI;IACb,OAAO,EAAE,KAAK;IACd,QAAQ,EAAE,sCAAsC;CACjD,CAAC;KACD,MAAM,CAAC,WAAW,EAAE;IACnB,KAAK,EAAE,IAAI;IACX,MAAM,EAAE,IAAI;IACZ,OAAO,EAAE,EAAc;CACxB,CAAC,CAAC;AAdM,QAAA,WAAW,eAcjB;AAEP,MAAM,cAAc,GAAG,CACrB,QAAgB,EAChB,SAAiB,EACjB,UAAmB,EACnB,EAAE;IACF,OAAA,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE;QACpC,IAAI,UAAU;YACZ,IAAA,cAAM,EAAC,2DAA2D,CAAC,CAAC;QACtE,IAAI,MAAM,GAA+B,SAAS,CAAC;QACnD,MAAM,WAAW,GAAG,IAAA,sBAAU,EAC5B,IAAA,eAAG,EAAC,KAAK,QAAQ,wBAAwB,SAAS,EAAE,CAAC,EACrD,CAAC,IAAI,EAAE,EAAE;YACP,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YACzB,IAAI,CAAC,IAAI;gBAAE,OAAO;YAClB,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;YACxB,IAAI,iBAAiB,CAAC,MAAM,CAAC,EAAE;gBAC7B,IAAI,MAAM;oBAAE,YAAY,CAAC,MAAM,CAAC,CAAC;gBACjC,WAAW,aAAX,WAAW,uBAAX,WAAW,EAAI,CAAC;gBAChB,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,0BAA0B,CAAC,MAAM,CAAC,CAAC;gBAC7D,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK;oBAC7B,CAAC,CAAC,GAAG,OAAO,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE;oBACrC,CAAC,CAAC,OAAO,CAAC;gBACZ,IAAI,IAAI,KAAK,CAAC,IAAI,UAAU;oBAAE,IAAA,cAAM,EAAC,YAAY,CAAC,CAAC;gBACnD,OAAO,CAAC,IAAI,CAAC,CAAC;aACf;QACH,CAAC,CACF,CAAC;QACF,MAAM,GAAG,UAAU,CAAC,GAAG,EAAE;YACvB,WAAW,aAAX,WAAW,uBAAX,WAAW,EAAI,CAAC;YAChB,IAAA,cAAM,EAAC,iDAAiD,CAAC,CAAC;YAC1D,OAAO,CAAC,CAAC,CAAC,CAAC;QACb,CAAC,EAAE,YAAY,CAAC,CAAC;IACnB,CAAC,CAAC,CAAA;EAAA,CAAC;AAEE,MAAM,OAAO,GAClB,CAAC,OAA4B,EAAE,EAAE,CACjC,CACE,IAGE,EACF,KAAa,EACb,OAGC,EACwC,EAAE;IAC3C,MAAM,aAAa,GAAG,KAAK,aAAL,KAAK,cAAL,KAAK,GAAI,CAAC,MAAM,IAAA,mBAAY,GAAE,CAAC,CAAC;IACtD,MAAM,EAAE,cAAc,EAAE,GAAG,aAAa,CAAC;IACzC,MAAM,aAAa,GAAG,CAAC,OAAgB,EAAE,EAAE;QACzC,QAAQ,OAAO,EAAE;YACf,KAAK,mBAAmB;gBACtB,OAAO,2BAA2B,CAAC;YACrC;gBACE,OAAO,mBAAmB,CAAC;SAC9B;IACH,CAAC,CAAC;IAEF,MAAM,mBAAmB,GAAG,IAAA,kBAAY,EACtC,aAAa,EACb,IAAI,EACJ,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,CAC7B,CAAC;IAEF,MAAM,IAAI,GACR,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,OAAO,KAAI,OAAO;QACzB,CAAC,CAAC,MAAM,IAAA,iBAAS,EAAC,aAAa,CAAC,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,OAAO,CAAC,EAAE,mBAAmB,CAAC;QACvE,CAAC,CAAC,MAAM,mBAAmB,CAAC;IAEhC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,SAAS,IAAI,IAAI,IAAI,IAAI,CAAC,EAAE,EAAE;QACxD,MAAM,UAAU,GACd,CAAC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,OAAO,CAAA;YACjB,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,OAAO,MAAK,KAAK;YAC1B,CAAC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,OAAO,MAAK,mBAAmB;gBACvC,CAAC,IAAI,CAAC,aAAa;gBACnB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACxB,IAAI,UAAU;YAAE,IAAA,cAAM,EAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC;QACpB,IAAI,IAAI,CAAC,IAAI,IAAI,EAAE,IAAI,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE;YACnD,MAAM,IAAI,GAAG,MAAM,cAAc,CAC/B,cAAc,CAAC,IAAI,CAAC,QAAQ,EAC5B,EAAE,EACF,UAAU,CACX,CAAC;YACF,IAAI,IAAI,EAAE;gBACR,gBAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACf,OAAO,SAAS,CAAC;aAClB;YACD,OAAO,IAAI,CAAC;SACb;;YAAM,OAAO,SAAS,CAAC;KACzB;SAAM;QACL,MAAM,IAAI,CAAC;KACZ;AACH,CAAC,CAAA,CAAC;AA3DS,QAAA,OAAO,WA2DhB;AAEG,MAAM,gBAAgB,GAAG,CAC9B,IAGE,EACF,KAAY,EACZ,EAAE;IACF,IAAI;QACF,MAAM,QAAQ,GAAG,MAAM,IAAA,eAAO,EAAC,SAAS,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;YACrD,OAAO,EAAE,mBAAmB;SAC7B,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,EAAE;YACb,IAAA,cAAM,EAAC,uCAAuC,CAAC,CAAC;YAChD,OAAO;SACR;QAED,MAAM,EAAE,EAAE,EAAE,aAAa,EAAE,GAAG,QAAQ,CAAC;QAEvC,IAAA,cAAM,EACJ,CAAC,aAAa,CAAC,CAAC,CAAC,mCAA2B,CAAC,CAAC,CAAC,+BAAuB,CACvE,CAAC;QACF,MAAM,IAAA,sBAAmB,EAAgB,KAAK,EAAE,EAAE,CAAC,CAAC;KACrD;IAAC,OAAO,KAAK,EAAE;QACd,IAAI,KAAK,KAAK,mCAA2B,EAAE;YACzC,IAAA,cAAM,EAAC,+BAAuB,CAAC,CAAC;SACjC;aAAM;YACL,MAAM,KAAK,CAAC;SACb;KACF;AACH,CAAC,CAAA,CAAC;AA9BW,QAAA,gBAAgB,oBA8B3B"}

package/dist/index.d.ts

@@ -1 +1 @@
-export declare const main: () => void;
+export declare const main: () => Promise<void>;

package/dist/index.js

@@ -1,4 +1,13 @@
 "use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.main = void 0;
 /** Copyright © 2024-present P0 Security
@@ -12,13 +21,15 @@ This file is part of @p0security/cli
 You should have received a copy of the GNU General Public License along with @p0security/cli. If not, see <https://www.gnu.org/licenses/>.
 **/
 const commands_1 = require("./commands");
+const firestore_1 = require("./drivers/firestore");
 const lodash_1 = require("lodash");
-const main = () => {
+const main = () => __awaiter(void 0, void 0, void 0, function* () {
+    yield (0, firestore_1.initializeFirebase)();
     // We can suppress output here, as .fail() already print2 errors
     void commands_1.cli.parse().catch(lodash_1.noop);
-};
+});
 exports.main = main;
 if (require.main === module) {
-    (0, exports.main)();
+    void (0, exports.main)();
 }
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;GASG;AACH,yCAAiC;AACjC,mCAA8B;AAEvB,MAAM,IAAI,GAAG,GAAG,EAAE;IACvB,gEAAgE;IAChE,KAAM,cAAG,CAAC,KAAK,EAAU,CAAC,KAAK,CAAC,aAAI,CAAC,CAAC;AACxC,CAAC,CAAC;AAHW,QAAA,IAAI,QAGf;AAEF,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE;IAC3B,IAAA,YAAI,GAAE,CAAC;CACR"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA;;;;;;;;;GASG;AACH,yCAAiC;AACjC,mDAAyD;AACzD,mCAA8B;AAEvB,MAAM,IAAI,GAAG,GAAS,EAAE;IAC7B,MAAM,IAAA,8BAAkB,GAAE,CAAC;IAE3B,gEAAgE;IAChE,KAAM,cAAG,CAAC,KAAK,EAAU,CAAC,KAAK,CAAC,aAAI,CAAC,CAAC;AACxC,CAAC,CAAA,CAAC;AALW,QAAA,IAAI,QAKf;AAEF,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE;IAC3B,KAAK,IAAA,YAAI,GAAE,CAAC;CACb"}

package/dist/plugins/aws/config.d.ts

@@ -1,4 +1,13 @@
 import { Authn } from "../../types/identity";
+export declare const getFirstAwsConfig: (authn: Authn) => Promise<{
+    identity: import("../../types/identity").Identity;
+    config: {
+        label?: string | undefined;
+        state: string;
+        login?: import("./types").AwsLogin | undefined;
+        id: string;
+    };
+}>;
 export declare const getAwsConfig: (authn: Authn, account: string | undefined) => Promise<{
     identity: import("../../types/identity").Identity;
     config: {

package/dist/plugins/aws/config.js

@@ -9,7 +9,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getAwsConfig = void 0;
+exports.getAwsConfig = exports.getFirstAwsConfig = void 0;
 /** Copyright © 2024-present P0 Security
 
 This file is part of @p0security/cli
@@ -23,13 +23,24 @@ You should have received a copy of the GNU General Public License along with @p0
 const firestore_1 = require("../../drivers/firestore");
 const firestore_2 = require("firebase/firestore");
 const lodash_1 = require("lodash");
-const getAwsConfig = (authn, account) => __awaiter(void 0, void 0, void 0, function* () {
+const getFirstAwsConfig = (authn) => __awaiter(void 0, void 0, void 0, function* () {
     var _a;
     const { identity } = authn;
     const snapshot = yield (0, firestore_2.getDoc)((0, firestore_1.doc)(`o/${identity.org.tenantId}/integrations/aws`));
     const config = snapshot.data();
+    const item = Object.entries((_a = config === null || config === void 0 ? void 0 : config["iam-write"]) !== null && _a !== void 0 ? _a : {}).find(([_id, { state }]) => state === "installed");
+    if (!item)
+        throw `P0 is not installed on any AWS account`;
+    return { identity, config: Object.assign({ id: item[0] }, item[1]) };
+});
+exports.getFirstAwsConfig = getFirstAwsConfig;
+const getAwsConfig = (authn, account) => __awaiter(void 0, void 0, void 0, function* () {
+    var _b;
+    const { identity } = authn;
+    const snapshot = yield (0, firestore_2.getDoc)((0, firestore_1.doc)(`o/${identity.org.tenantId}/integrations/aws`));
+    const config = snapshot.data();
     // TODO: Support alias lookup
-    const allItems = (0, lodash_1.sortBy)(Object.entries((_a = config === null || config === void 0 ? void 0 : config["iam-write"]) !== null && _a !== void 0 ? _a : {}).filter(([, { state }]) => state === "installed"), ([id]) => id);
+    const allItems = (0, lodash_1.sortBy)(Object.entries((_b = config === null || config === void 0 ? void 0 : config["iam-write"]) !== null && _b !== void 0 ? _b : {}).filter(([, { state }]) => state === "installed"), ([id]) => id);
     const item = account
         ? allItems.find(([id, { label }]) => id === account || label === account)
         : allItems.length !== 1

package/dist/plugins/aws/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../src/plugins/aws/config.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA;;;;;;;;;GASG;AACH,uDAA8C;AAG9C,kDAA4C;AAC5C,mCAAgC;AAEzB,MAAM,YAAY,GAAG,CAC1B,KAAY,EACZ,OAA2B,EAC3B,EAAE;;IACF,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAC3B,MAAM,QAAQ,GAAG,MAAM,IAAA,kBAAM,EAC3B,IAAA,eAAG,EAAC,KAAK,QAAQ,CAAC,GAAG,CAAC,QAAQ,mBAAmB,CAAC,CACnD,CAAC;IACF,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/B,6BAA6B;IAC7B,MAAM,QAAQ,GAAG,IAAA,eAAM,EACrB,MAAM,CAAC,OAAO,CAAC,MAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAG,WAAW,CAAC,mCAAI,EAAE,CAAC,CAAC,MAAM,CAChD,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,WAAW,CACzC,EACD,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,CACb,CAAC;IACF,MAAM,IAAI,GAAG,OAAO;QAClB,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,KAAK,OAAO,IAAI,KAAK,KAAK,OAAO,CAAC;QACzE,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;YACrB,CAAC,CAAC,CAAC,GAAG,EAAE;gBACJ,MAAM,2EAA2E,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,aAAL,KAAK,cAAL,KAAK,GAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/I,CAAC,CAAC,EAAE;YACN,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAClB,IAAI,CAAC,IAAI;QAAE,MAAM,sCAAsC,OAAO,EAAE,CAAC;IACjE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAI,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,IAAK,IAAI,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC;AAC3D,CAAC,CAAA,CAAC;AAzBW,QAAA,YAAY,gBAyBvB"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../src/plugins/aws/config.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA;;;;;;;;;GASG;AACH,uDAA8C;AAG9C,kDAA4C;AAC5C,mCAAgC;AAEzB,MAAM,iBAAiB,GAAG,CAAO,KAAY,EAAE,EAAE;;IACtD,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAC3B,MAAM,QAAQ,GAAG,MAAM,IAAA,kBAAM,EAC3B,IAAA,eAAG,EAAC,KAAK,QAAQ,CAAC,GAAG,CAAC,QAAQ,mBAAmB,CAAC,CACnD,CAAC;IACF,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;IAE/B,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,MAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAG,WAAW,CAAC,mCAAI,EAAE,CAAC,CAAC,IAAI,CAC3D,CAAC,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,WAAW,CAC5C,CAAC;IAEF,IAAI,CAAC,IAAI;QAAE,MAAM,wCAAwC,CAAC;IAE1D,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAI,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,IAAK,IAAI,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC;AAC3D,CAAC,CAAA,CAAC;AAdW,QAAA,iBAAiB,qBAc5B;AAEK,MAAM,YAAY,GAAG,CAC1B,KAAY,EACZ,OAA2B,EAC3B,EAAE;;IACF,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAC3B,MAAM,QAAQ,GAAG,MAAM,IAAA,kBAAM,EAC3B,IAAA,eAAG,EAAC,KAAK,QAAQ,CAAC,GAAG,CAAC,QAAQ,mBAAmB,CAAC,CACnD,CAAC;IACF,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/B,6BAA6B;IAC7B,MAAM,QAAQ,GAAG,IAAA,eAAM,EACrB,MAAM,CAAC,OAAO,CAAC,MAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAG,WAAW,CAAC,mCAAI,EAAE,CAAC,CAAC,MAAM,CAChD,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,WAAW,CACzC,EACD,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,CACb,CAAC;IACF,MAAM,IAAI,GAAG,OAAO;QAClB,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,KAAK,OAAO,IAAI,KAAK,KAAK,OAAO,CAAC;QACzE,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;YACrB,CAAC,CAAC,CAAC,GAAG,EAAE;gBACJ,MAAM,2EAA2E,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,aAAL,KAAK,cAAL,KAAK,GAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/I,CAAC,CAAC,EAAE;YACN,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAClB,IAAI,CAAC,IAAI;QAAE,MAAM,sCAAsC,OAAO,EAAE,CAAC;IACjE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAI,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,IAAK,IAAI,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC;AAC3D,CAAC,CAAA,CAAC;AAzBW,QAAA,YAAY,gBAyBvB"}

package/dist/plugins/aws/idc/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/plugins/aws/idc/index.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA;;;;;;;;;GASG;AACH,iDAAyD;AACzD,iDAAuD;AACvD,gDAA+C;AAO/C,4CAAgE;AAGhE,MAAM,KAAK,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC7B,MAAM,IAAI,GAAG,EAAE,GAAG,KAAK,CAAC;AAExB,MAAM,gBAAgB,GAAG,CAAC,GAAG,KAAK,CAAC;AACnC,MAAM,uBAAuB,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,oCAAoC;AAC/E,MAAM,cAAc,GAAG,CAAC,oBAAoB,CAAC,CAAC;AAEvC,MAAM,cAAc,GAAG,CAC5B,MAAc,EACiB,EAAE;IACjC,OAAA,MAAM,IAAA,aAAM,EACV,gBAAgB,EAChB,GAAwC,EAAE;QACxC,MAAM,IAAI,GAAG;YACX,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,UAAU,EAAE,OAAO;gBACnB,UAAU,EAAE,QAAQ;gBACpB,UAAU,EAAE,CAAC,yBAAiB,CAAC;gBAC/B,MAAM,EAAE,cAAc;aACvB,CAAC;SACH,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,gBAAgB,MAAM,gCAAgC,EACtD,IAAI,CACL,CAAC;QACF,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC,CAAA,EACD,EAAE,QAAQ,EAAE,uBAAuB,EAAE,EACrC,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,qBAAqB;QACxB,CAAC,CAAC,IAAI,CAAC,qBAAqB,GAAG,IAAI,CAAC,GAAG,EAAE;QACzC,CAAC,CAAC,IAAI,CACX,CAAA;EAAA,CAAC;AA1BS,QAAA,cAAc,kBA0BvB;AAEJ,MAAM,aAAa,GAAG,CACpB,iBAA6D,EAC7D,GAAmC,EACnC,EAAE;IACF,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,iBAAiB,CAAC;IACrD,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC;IAE3B,MAAM,yBAAyB,GAAG,GAAG,EAAE,CAAC,CAAC;QACvC,IAAI,EAAE;YACJ,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,QAAQ;gBACR,YAAY;gBACZ,QAAQ,EAAE,WAAW,EAAE,oBAAoB;aAC5C,CAAC;SACH;QACD,GAAG,EAAE,gBAAgB,MAAM,qCAAqC;KACjE,CAAC,CAAC;IACH,MAAM,oBAAoB,GAAG,CAAC,iBAAuC,EAAE,EAAE,CAAC,CAAC;QACzE,GAAG,EAAE,gBAAgB,MAAM,sBAAsB;QACjD,IAAI,EAAE;YACJ,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,QAAQ;gBACR,YAAY;gBACZ,UAAU,EAAE,iBAAiB,CAAC,UAAU;gBACxC,SAAS,EAAE,yBAAiB;aAC7B,CAAC;SACH;KACF,CAAC,CAAC;IACH;;;;;OAKG;IACH,MAAM,yBAAyB,GAAG,CAChC,YAA8B,EAC9B,OAAsD,EACtD,EAAE;QACF,gHAAgH;QAChH,gGAAgG;QAEhG,OAAO,MAAM,IAAA,sBAAc,EACzB,GAAS,EAAE;YACT,MAAM,IAAI,GAAG;gBACX,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE;oBACP,wBAAwB,EAAE,YAAY,CAAC,WAAW;iBACnD;aACF,CAAC;YACF,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC;YAC7C,IAAI,SAAS,KAAK,SAAS;gBACzB,MAAM,IAAI,KAAK,CACb,0DAA0D,CAC3D,CAAC;YAEJ,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;YACrC,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;YACvC,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;YAC1C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,sBAAsB,MAAM,yCAAyC,MAAM,CAAC,QAAQ,EAAE,EAAE,EACxF,IAAI,CACL,CAAC;YACF,IAAI,CAAC,QAAQ,CAAC,EAAE;gBACd,MAAM,IAAI,KAAK,CACb,oCAAoC,QAAQ,CAAC,UAAU,KAAK,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,CACpF,CAAC;YACJ,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC/B,CAAC,CAAA,EACD,GAAG,EAAE,CAAC,IAAI,EACV,CAAC,CACF,CAAC;IACJ,CAAC,CAAA,CAAC;IAEF,OAAO;QACL,UAAU,EAAE;YACV,YAAY,EAAE,UAAU;YACxB,gBAAgB,EAAhB,wBAAgB;YAChB,qBAAqB,EAAE,yBAAyB;YAChD,iBAAiB,EAAE,oBAAoB;YACvC,kBAAkB,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;gBAClC,UAAU,EAAE,SAAS,CAAC,SAAS;gBAC/B,QAAQ,EAAE,SAAS,CAAC,QAAQ;aAC7B,CAAC;YACF,oBAAoB,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;gBACpC,SAAS,EAAE,SAAS,CAAC,QAAQ;gBAC7B,yBAAyB,EAAE,SAAS,CAAC,uBAAuB;aAC7D,CAAC;SACqC;QACzC,yBAAyB;KAC1B,CAAC;AACJ,CAAC,CAAC;AAEF;;;;GAIG;AACI,MAAM,iBAAiB,GAAG,CAAO,IAIvC,EAA2B,EAAE;IAC5B,OAAA,MAAM,IAAA,aAAM,EACV,WAAW,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,aAAa,EAAE,EACjD,GAAS,EAAE;QACT,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QACrB,MAAM,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC;QACvB,MAAM,aAAa,GAAG,MAAM,IAAA,sBAAc,EAAC,MAAM,CAAC,CAAC;QAEnD,MAAM,EAAE,UAAU,EAAE,yBAAyB,EAAE,GAAG,aAAa,CAC7D,aAAa,EACb,GAAG,CACJ,CAAC;QAEF,MAAM,YAAY,GAAG,MAAM,IAAA,aAAM,EAC/B,8BAA8B,EAC9B,GAAS,EAAE;YACT,MAAM,IAAI,GAAG,MAAM,IAAA,iBAAS,EAC1B,UAAU,CACX,CAAC;YACF,uCAAY,IAAI,KAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,GAAG,GAAG,IAAG;QACnE,CAAC,CAAA,EACD,EAAE,QAAQ,EAAE,gBAAgB,EAAE,EAC9B,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAChE,CAAC;QAEF,MAAM,WAAW,GAAG,MAAM,yBAAyB,CAAC,YAAY,EAAE;YAChE,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,aAAa,EAAE,IAAI,CAAC,aAAa;SAClC,CAAC,CAAC;QACH,OAAO;YACL,iBAAiB,EAAE,WAAW,CAAC,eAAe,CAAC,WAAW;YAC1D,qBAAqB,EAAE,WAAW,CAAC,eAAe,CAAC,eAAe;YAClE,iBAAiB,EAAE,WAAW,CAAC,eAAe,CAAC,YAAY;YAC3D,kBAAkB,EAAE,WAAW,CAAC,eAAe,CAAC,YAAY;YAC5D,SAAS,EAAE,WAAW,CAAC,eAAe,CAAC,UAAU;SAClD,CAAC;IACJ,CAAC,CAAA,EACD,EAAE,QAAQ,EAAE,gBAAgB,EAAE,EAC9B,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAChE,CAAA;EAAA,CAAC;AA3CS,QAAA,iBAAiB,qBA2C1B"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/plugins/aws/idc/index.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA;;;;;;;;;GASG;AACH,iDAAyD;AACzD,iDAAuD;AACvD,gDAA+C;AAO/C,4CAAgE;AAGhE,MAAM,KAAK,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC7B,MAAM,IAAI,GAAG,EAAE,GAAG,KAAK,CAAC;AAExB,MAAM,gBAAgB,GAAG,CAAC,GAAG,KAAK,CAAC;AACnC,MAAM,uBAAuB,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,oCAAoC;AAC/E,MAAM,cAAc,GAAG,CAAC,oBAAoB,CAAC,CAAC;AAEvC,MAAM,cAAc,GAAG,CAC5B,MAAc,EACiB,EAAE;IACjC,OAAA,MAAM,IAAA,aAAM,EACV,gBAAgB,EAChB,GAAwC,EAAE;QACxC,MAAM,IAAI,GAAG;YACX,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,UAAU,EAAE,OAAO;gBACnB,UAAU,EAAE,QAAQ;gBACpB,UAAU,EAAE,CAAC,yBAAiB,CAAC;gBAC/B,MAAM,EAAE,cAAc;aACvB,CAAC;SACH,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,gBAAgB,MAAM,gCAAgC,EACtD,IAAI,CACL,CAAC;QACF,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC,CAAA,EACD,EAAE,QAAQ,EAAE,uBAAuB,EAAE,EACrC,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,qBAAqB;QACxB,CAAC,CAAC,IAAI,CAAC,qBAAqB,GAAG,IAAI,CAAC,GAAG,EAAE;QACzC,CAAC,CAAC,IAAI,CACX,CAAA;EAAA,CAAC;AA1BS,QAAA,cAAc,kBA0BvB;AAEJ,MAAM,aAAa,GAAG,CACpB,iBAA6D,EAC7D,GAAmC,EACnC,EAAE;IACF,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,iBAAiB,CAAC;IACrD,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC;IAE3B,MAAM,yBAAyB,GAAG,GAAG,EAAE,CAAC,CAAC;QACvC,IAAI,EAAE;YACJ,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,QAAQ;gBACR,YAAY;gBACZ,QAAQ,EAAE,WAAW,EAAE,oBAAoB;aAC5C,CAAC;SACH;QACD,GAAG,EAAE,gBAAgB,MAAM,qCAAqC;KACjE,CAAC,CAAC;IACH,MAAM,oBAAoB,GAAG,CAAC,iBAAuC,EAAE,EAAE,CAAC,CAAC;QACzE,GAAG,EAAE,gBAAgB,MAAM,sBAAsB;QACjD,IAAI,EAAE;YACJ,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,QAAQ;gBACR,YAAY;gBACZ,UAAU,EAAE,iBAAiB,CAAC,UAAU;gBACxC,SAAS,EAAE,yBAAiB;aAC7B,CAAC;SACH;KACF,CAAC,CAAC;IACH;;;;;OAKG;IACH,MAAM,yBAAyB,GAAG,CAChC,YAA8B,EAC9B,OAAsD,EACtD,EAAE;QACF,gHAAgH;QAChH,gGAAgG;QAEhG,OAAO,MAAM,IAAA,sBAAc,EACzB,GAAS,EAAE;YACT,MAAM,IAAI,GAAG;gBACX,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE;oBACP,wBAAwB,EAAE,YAAY,CAAC,WAAW;iBACnD;aACF,CAAC;YACF,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC;YAC7C,IAAI,SAAS,KAAK,SAAS;gBACzB,MAAM,IAAI,KAAK,CACb,0DAA0D,CAC3D,CAAC;YAEJ,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;YACrC,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;YACvC,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;YAC1C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,sBAAsB,MAAM,yCAAyC,MAAM,CAAC,QAAQ,EAAE,EAAE,EACxF,IAAI,CACL,CAAC;YACF,IAAI,CAAC,QAAQ,CAAC,EAAE;gBACd,MAAM,IAAI,KAAK,CACb,oCAAoC,QAAQ,CAAC,UAAU,KAAK,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,CACpF,CAAC;YACJ,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC/B,CAAC,CAAA,EACD,GAAG,EAAE,CAAC,IAAI,EACV,CAAC,CACF,CAAC;IACJ,CAAC,CAAA,CAAC;IAEF,OAAO;QACL,UAAU,EAAE;YACV,YAAY,EAAE,UAAU;YACxB,gBAAgB,EAAhB,wBAAgB;YAChB,qBAAqB,EAAE,yBAAyB;YAChD,iBAAiB,EAAE,oBAAoB;YACvC,kBAAkB,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;gBAClC,UAAU,EAAE,SAAS,CAAC,SAAS;gBAC/B,QAAQ,EAAE,SAAS,CAAC,QAAQ;aAC7B,CAAC;YACF,oBAAoB,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;gBACpC,SAAS,EAAE,SAAS,CAAC,QAAQ;gBAC7B,yBAAyB,EAAE,SAAS,CAAC,uBAAuB;aAC7D,CAAC;SACqC;QACzC,yBAAyB;KAC1B,CAAC;AACJ,CAAC,CAAC;AAEF;;;;GAIG;AACI,MAAM,iBAAiB,GAAG,CAAO,IAIvC,EAA2B,EAAE;IAC5B,OAAA,MAAM,IAAA,aAAM,EACV,WAAW,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,aAAa,EAAE,EACjD,GAAS,EAAE;QACT,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QACrB,MAAM,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC;QACvB,MAAM,aAAa,GAAG,MAAM,IAAA,sBAAc,EAAC,MAAM,CAAC,CAAC;QAEnD,MAAM,EAAE,UAAU,EAAE,yBAAyB,EAAE,GAAG,aAAa,CAC7D,aAAa,EACb,GAAG,CACJ,CAAC;QAEF,MAAM,YAAY,GAAG,MAAM,IAAA,aAAM,EAC/B,8BAA8B,EAC9B,GAAS,EAAE;YACT,MAAM,IAAI,GAAG,MAAM,IAAA,iBAAS,EAC1B,UAAU,CACX,CAAC;YACF,uCAAY,IAAI,KAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,GAAG,GAAG,IAAG;QACnE,CAAC,CAAA,EACD,EAAE,QAAQ,EAAE,gBAAgB,EAAE,EAC9B,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAChE,CAAC;QAEF,MAAM,WAAW,GAAG,MAAM,yBAAyB,CAAC,YAAY,EAAE;YAChE,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,aAAa,EAAE,IAAI,CAAC,aAAa;SAClC,CAAC,CAAC;QAEH,OAAO;YACL,iBAAiB,EAAE,WAAW,CAAC,eAAe,CAAC,WAAW;YAC1D,qBAAqB,EAAE,WAAW,CAAC,eAAe,CAAC,eAAe;YAClE,iBAAiB,EAAE,WAAW,CAAC,eAAe,CAAC,YAAY;YAC3D,kBAAkB,EAAE,WAAW,CAAC,eAAe,CAAC,YAAY;YAC5D,SAAS,EAAE,WAAW,CAAC,eAAe,CAAC,UAAU;SAClD,CAAC;IACJ,CAAC,CAAA,EACD,EAAE,QAAQ,EAAE,gBAAgB,EAAE,EAC9B,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAChE,CAAA;EAAA,CAAC;AA5CS,QAAA,iBAAiB,qBA4C1B"}

package/dist/plugins/aws/types.d.ts

@@ -29,6 +29,9 @@ export type AwsIamLogin = {
 export type AwsIdcLogin = {
     type: "idc";
     parent: string;
+    idcArn: string;
+    idcRegion: string;
+    identityStoreId: string;
 };
 export type AwsFederatedLogin = {
     type: "federated";

package/dist/plugins/okta/aws.js

@@ -20,13 +20,49 @@ This file is part of @p0security/cli
 
 You should have received a copy of the GNU General Public License along with @p0security/cli. If not, see <https://www.gnu.org/licenses/>.
 **/
-const role_1 = require("../../commands/aws/role");
+const xml_1 = require("../../common/xml");
 const auth_1 = require("../../drivers/auth");
 const assumeRole_1 = require("../aws/assumeRole");
+const config_1 = require("../aws/config");
+const login_1 = require("./login");
+const lodash_1 = require("lodash");
+/** Extracts all roles from a SAML assertion */
+const rolesFromSaml = (account, saml) => {
+    var _a;
+    const samlText = Buffer.from(saml, "base64").toString("ascii");
+    const samlObject = (0, xml_1.parseXml)(samlText);
+    const samlAttributes = samlObject["saml2p:Response"]["saml2:Assertion"]["saml2:AttributeStatement"]["saml2:Attribute"];
+    const roleAttribute = samlAttributes.find((a) => a._attributes.Name === "https://aws.amazon.com/SAML/Attributes/Role");
+    // Format:
+    //   'arn:aws:iam::391052057035:saml-provider/p0dev-ext_okta_sso,arn:aws:iam::391052057035:role/path/to/role/SSOAmazonS3FullAccess'
+    const arns = (_a = (0, lodash_1.flatten)([roleAttribute === null || roleAttribute === void 0 ? void 0 : roleAttribute["saml2:AttributeValue"]])) === null || _a === void 0 ? void 0 : _a.map((r) => r.split(",")[1]);
+    const roles = arns
+        .filter((r) => r.startsWith(`arn:aws:iam::${account}:role/`))
+        .map((r) => r.split("/").slice(1).join("/"));
+    return { arns, roles };
+};
+const isFederatedLogin = (config) => { var _a; return ((_a = config.login) === null || _a === void 0 ? void 0 : _a.type) === "federated"; };
+/** Retrieves the configured Okta SAML response for the specified account
+ *
+ * If no account is passed, and the organization only has one account configured,
+ * assumes that account.
+ */
+const initOktaSaml = (authn, account) => __awaiter(void 0, void 0, void 0, function* () {
+    var _a;
+    const { identity, config } = yield (0, config_1.getAwsConfig)(authn, account);
+    if (!isFederatedLogin(config))
+        throw `Account ${(_a = config.label) !== null && _a !== void 0 ? _a : config.id} is not configured for Okta SAML login.`;
+    const samlResponse = yield (0, login_1.getSamlResponse)(identity, config.login);
+    return {
+        samlResponse,
+        config,
+        account: config.id,
+    };
+});
 const assumeRoleWithOktaSaml = (authn, args) => __awaiter(void 0, void 0, void 0, function* () {
     return yield (0, auth_1.cached)(`aws-okta-${args.accountId}-${args.role}`, () => __awaiter(void 0, void 0, void 0, function* () {
-        const { account, config, samlResponse } = yield (0, role_1.initOktaSaml)(authn, args.accountId);
-        const { roles } = (0, role_1.rolesFromSaml)(account, samlResponse);
+        const { account, config, samlResponse } = yield initOktaSaml(authn, args.accountId);
+        const { roles } = rolesFromSaml(account, samlResponse);
         if (!roles.includes(args.role))
             throw `Role ${args.role} not available. Available roles:\n${roles.map((r) => `  ${r}`).join("\n")}`;
         return yield (0, assumeRole_1.assumeRoleWithSaml)({

package/dist/plugins/okta/aws.js.map

@@ -1 +1 @@
-{"version":3,"file":"aws.js","sourceRoot":"","sources":["../../../src/plugins/okta/aws.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA;;;;;;;;;GASG;AACH,kDAAsE;AACtE,6CAA4C;AAE5C,kDAAuD;AAEhD,MAAM,sBAAsB,GAAG,CACpC,KAAY,EACZ,IAA0C,EAC1C,EAAE;IACF,OAAA,MAAM,IAAA,aAAM,EACV,YAAY,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,IAAI,EAAE,EACzC,GAAS,EAAE;QACT,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,IAAA,mBAAY,EAC1D,KAAK,EACL,IAAI,CAAC,SAAS,CACf,CAAC;QACF,MAAM,EAAE,KAAK,EAAE,GAAG,IAAA,oBAAa,EAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QACvD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;YAC5B,MAAM,QAAQ,IAAI,CAAC,IAAI,qCAAqC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACtG,OAAO,MAAM,IAAA,+BAAkB,EAAC;YAC9B,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE;gBACJ,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,gBAAgB;gBACpD,QAAQ,EAAE,YAAY;aACvB;SACF,CAAC,CAAC;IACL,CAAC,CAAA,EACD,EAAE,QAAQ,EAAE,MAAM,EAAE,CACrB,CAAA;EAAA,CAAC;AAxBS,QAAA,sBAAsB,0BAwB/B"}
+{"version":3,"file":"aws.js","sourceRoot":"","sources":["../../../src/plugins/okta/aws.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA;;;;;;;;;GASG;AACH,0CAA4C;AAC5C,6CAA4C;AAE5C,kDAAuD;AACvD,0CAA6C;AAE7C,mCAA0C;AAC1C,mCAAiC;AAEjC,+CAA+C;AAC/C,MAAM,aAAa,GAAG,CAAC,OAAe,EAAE,IAAY,EAAE,EAAE;;IACtD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC/D,MAAM,UAAU,GAAG,IAAA,cAAQ,EAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,cAAc,GAClB,UAAU,CAAC,iBAAiB,CAAC,CAAC,iBAAiB,CAAC,CAC9C,0BAA0B,CAC3B,CAAC,iBAAiB,CAAC,CAAC;IACvB,MAAM,aAAa,GAAG,cAAc,CAAC,IAAI,CACvC,CAAC,CAAM,EAAE,EAAE,CACT,CAAC,CAAC,WAAW,CAAC,IAAI,KAAK,6CAA6C,CACvE,CAAC;IACF,UAAU;IACV,mIAAmI;IACnI,MAAM,IAAI,GAAG,MACX,IAAA,gBAAO,EAAC,CAAC,aAAa,aAAb,aAAa,uBAAb,aAAa,CAAG,sBAAsB,CAAC,CAAC,CAClD,0CAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;IAChC,MAAM,KAAK,GAAG,IAAI;SACf,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,gBAAgB,OAAO,QAAQ,CAAC,CAAC;SAC5D,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/C,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACzB,CAAC,CAAC;AAEF,MAAM,gBAAgB,GAAG,CACvB,MAAe,EACmC,EAAE,WACpD,OAAA,CAAA,MAAA,MAAM,CAAC,KAAK,0CAAE,IAAI,MAAK,WAAW,CAAA,EAAA,CAAC;AAErC;;;;GAIG;AACH,MAAM,YAAY,GAAG,CAAO,KAAY,EAAE,OAA2B,EAAE,EAAE;;IACvE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,IAAA,qBAAY,EAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAChE,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC;QAC3B,MAAM,WAAW,MAAA,MAAM,CAAC,KAAK,mCAAI,MAAM,CAAC,EAAE,yCAAyC,CAAC;IACtF,MAAM,YAAY,GAAG,MAAM,IAAA,uBAAe,EAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IACnE,OAAO;QACL,YAAY;QACZ,MAAM;QACN,OAAO,EAAE,MAAM,CAAC,EAAE;KACnB,CAAC;AACJ,CAAC,CAAA,CAAC;AAEK,MAAM,sBAAsB,GAAG,CACpC,KAAY,EACZ,IAA0C,EAC1C,EAAE;IACF,OAAA,MAAM,IAAA,aAAM,EACV,YAAY,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,IAAI,EAAE,EACzC,GAAS,EAAE;QACT,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,YAAY,CAC1D,KAAK,EACL,IAAI,CAAC,SAAS,CACf,CAAC;QACF,MAAM,EAAE,KAAK,EAAE,GAAG,aAAa,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QACvD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;YAC5B,MAAM,QAAQ,IAAI,CAAC,IAAI,qCAAqC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACtG,OAAO,MAAM,IAAA,+BAAkB,EAAC;YAC9B,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE;gBACJ,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,gBAAgB;gBACpD,QAAQ,EAAE,YAAY;aACvB;SACF,CAAC,CAAC;IACL,CAAC,CAAA,EACD,EAAE,QAAQ,EAAE,MAAM,EAAE,CACrB,CAAA;EAAA,CAAC;AAxBS,QAAA,sBAAsB,0BAwB/B"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@p0security/cli",
-  "version": "0.15.0",
+  "version": "0.16.1",
   "description": "Execute infra CLI commands with P0 grants",
   "main": "index.ts",
   "repository": {