@p0security/cli 0.5.0 → 0.5.2

package/dist/commands/__tests__/ssh.test.js

@@ -40,14 +40,10 @@ const mockSsm = ssm_1.ssm;
 const mockPrint1 = stdio_1.print1;
 const mockPrint2 = stdio_1.print2;
 (0, firestore_1.mockGetDoc)({
-    workflows: {
-        items: [
-            {
-                state: "installed",
-                type: "aws",
-                identifier: "test-account",
-            },
-        ],
+    "iam-write": {
+        ["aws:test-account"]: {
+            state: "installed",
+        },
     },
 });
 mockSsm.mockResolvedValue({});

package/dist/commands/index.js

@@ -21,7 +21,6 @@ const login_1 = require("./login");
 const ls_1 = require("./ls");
 const request_1 = require("./request");
 const ssh_1 = require("./ssh");
-const lodash_1 = require("lodash");
 const typescript_1 = require("typescript");
 const yargs_1 = __importDefault(require("yargs"));
 const helpers_1 = require("yargs/helpers");
@@ -36,7 +35,6 @@ exports.cli = commands
     .reduce((m, c) => c(m), (0, yargs_1.default)((0, helpers_1.hideBin)(process.argv)))
     .middleware(version_1.checkVersion)
     .strict()
-    .version(lodash_1.VERSION)
     .demandCommand(1)
     .fail((message, error, yargs) => {
     if (error)

package/dist/commands/ls.js

@@ -60,16 +60,18 @@ const ls = (args) => __awaiter(void 0, void 0, void 0, function* () {
                 ? ` (use \`p0
          ${allArguments.join(" ")} <like>\` to narrow results)`
                 : "";
-        (0, stdio_1.print2)(`Showing${truncationPart} ${label}${postfixPart}:`);
-        const isSameValue = data.items.every((i) => !i.group && i.key === i.value);
-        const maxLength = (0, lodash_1.max)(data.items.map((i) => i.key.length)) || 0;
-        for (const item of data.items) {
+        (0, stdio_1.print2)(`Showing${truncationPart} ${label}${postfixPart}. Resources labeled with * are already accessible to you:`);
+        const sortedItems = (0, lodash_1.orderBy)(data.items, "isPreexisting", "desc");
+        const isSameValue = sortedItems.every((i) => !i.group && i.key === i.value);
+        const maxLength = (0, lodash_1.max)(sortedItems.map((i) => i.key.length)) || 0;
+        for (const item of sortedItems) {
             const tagPart = `${item.group ? `${item.group} / ` : ""}${item.value}`;
-            (0, stdio_1.print1)(isSameValue
+            const prefix = item.isPreexisting ? "* " : "  ";
+            (0, stdio_1.print1)(`${prefix}${isSameValue
                 ? item.key
                 : maxLength > 30
                     ? `${item.key}\n  ${stdio_1.Ansi.Dim}${tagPart}${stdio_1.Ansi.Reset}`
-                    : `${item.key.padEnd(maxLength)}${stdio_1.Ansi.Dim} - ${tagPart}${stdio_1.Ansi.Reset}`);
+                    : `${item.key.padEnd(maxLength)}${stdio_1.Ansi.Dim} - ${tagPart}${stdio_1.Ansi.Reset}`}`);
         }
     }
     else {

package/dist/commands/ssh.d.ts

@@ -7,5 +7,6 @@ export declare type SshCommandArgs = {
     arguments: string[];
     sudo?: boolean;
     reason?: string;
+    account?: string;
 };
 export declare const sshCommand: (yargs: yargs.Argv<{}>) => yargs.Argv<SshCommandArgs>;

package/dist/commands/ssh.js

@@ -73,14 +73,18 @@ const sshCommand = (yargs) => yargs.command("ssh <destination> [command [argumen
     .option("reason", {
     describe: "Reason access is needed",
     type: "string",
+})
+    .option("account", {
+    type: "string",
+    describe: "The account on which the instance is located",
 }), (0, firestore_1.guard)(ssh));
 exports.sshCommand = sshCommand;
 const validateSshInstall = (authn) => __awaiter(void 0, void 0, void 0, function* () {
-    var _a, _b;
+    var _a;
     const configDoc = yield (0, firestore_2.getDoc)((0, firestore_1.doc)(`o/${authn.identity.org.tenantId}/integrations/ssh`));
-    const items = (_b = (_a = configDoc
-        .data()) === null || _a === void 0 ? void 0 : _a.workflows) === null || _b === void 0 ? void 0 : _b.items.filter((i) => i.state === "installed" && i.type === "aws");
-    if (!(items === null || items === void 0 ? void 0 : items.length)) {
+    const configItems = (_a = configDoc.data()) === null || _a === void 0 ? void 0 : _a["iam-write"];
+    const items = Object.entries(configItems !== null && configItems !== void 0 ? configItems : {}).filter(([key, value]) => value.state == "installed" && key.startsWith("aws"));
+    if (items.length === 0) {
         throw "This organization is not configured for SSH access via the P0 CLI";
     }
 });
@@ -141,6 +145,7 @@ const ssh = (args) => __awaiter(void 0, void 0, void 0, function* () {
             "aws",
             ...(args.sudo || args.command === "sudo" ? ["--sudo"] : []),
             ...(args.reason ? ["--reason", args.reason] : []),
+            ...(args.account ? ["--account", args.account] : []),
         ], wait: true }), authn, { message: "approval-required" });
     if (!response) {
         (0, stdio_1.print2)("Did not receive access ID from server");

package/dist/plugins/aws/__mocks__/assumeRole.js

@@ -15,6 +15,7 @@ const assumeRoleWithSaml = () => __awaiter(void 0, void 0, void 0, function* ()
         AWS_ACCESS_KEY_ID: "test-access-key-id",
         AWS_SECRET_ACCESS_KEY: "test-secret-access-key",
         AWS_SESSION_TOKEN: "test-session-token",
+        AWS_SECURITY_TOKEN: "test-session-token",
     });
 });
 exports.assumeRoleWithSaml = assumeRoleWithSaml;

package/dist/plugins/aws/assumeRole.js

@@ -38,6 +38,7 @@ const stsAssume = (params) => __awaiter(void 0, void 0, void 0, function* () {
         AWS_ACCESS_KEY_ID: stsCredentials.AccessKeyId,
         AWS_SECRET_ACCESS_KEY: stsCredentials.SecretAccessKey,
         AWS_SESSION_TOKEN: stsCredentials.SessionToken,
+        AWS_SECURITY_TOKEN: stsCredentials.SessionToken,
     };
 });
 /** Assumes an AWS role via SAML login */

package/dist/plugins/aws/types.d.ts

@@ -12,6 +12,7 @@ export declare type AwsCredentials = {
     AWS_ACCESS_KEY_ID: string;
     AWS_SECRET_ACCESS_KEY: string;
     AWS_SESSION_TOKEN: string;
+    AWS_SECURITY_TOKEN: string;
 };
 export declare type AwsIamLogin = {
     type: "iam";

package/dist/plugins/ssh/types.d.ts

@@ -9,14 +9,10 @@ This file is part of @p0security/cli
 You should have received a copy of the GNU General Public License along with @p0security/cli. If not, see <https://www.gnu.org/licenses/>.
 **/
 declare type SshItemConfig = {
-    alias?: string;
-    identifier: string;
+    label?: string;
     state: string;
-    type: "aws" | "gcloud";
 };
 export declare type SshConfig = {
-    workflows?: {
-        items: SshItemConfig[];
-    };
+    "iam-write": Record<string, SshItemConfig>;
 };
 export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@p0security/cli",
-  "version": "0.5.0",
+  "version": "0.5.2",
   "description": "Execute infra CLI commands with P0 grants",
   "main": "index.ts",
   "repository": {