@prism-d1/cli 1.0.80 → 1.0.81

package/dist/src/utils/validate.js

@@ -0,0 +1,143 @@
+/**
+ * Validation for provider identity values collected at the prompt.
+ *
+ * These are NOT what prevents shell injection -- run() in ./exec.ts does that by
+ * never invoking a shell. Validation is here for two other reasons:
+ *
+ *  1. IAM role names are built from these values and accept only [\w+=,.@-].
+ *     A value containing a slash or a space otherwise reaches AWS and comes back
+ *     as a ValidationException that says nothing about which input was wrong.
+ *  2. Several of these values land inside an IAM trust policy condition. A
+ *     malformed one does not fail loudly -- it produces a policy whose sub claim
+ *     never matches (nothing can assume the role) or, worse, matches more
+ *     broadly than intended.
+ *
+ * Each helper exits the process with a message naming the offending value rather
+ * than throwing, matching how the bootstrapper commands report other input
+ * errors.
+ */
+function fail(lines) {
+    for (const line of lines)
+        console.error(line);
+    process.exit(1);
+}
+// ---- GitHub ----
+/**
+ * GitHub owner (user or org): alphanumerics and hyphens, no leading or trailing
+ * hyphen, 39 characters max.
+ *
+ * Deliberately looser than GitHub's current signup rule, which forbids
+ * consecutive hyphens. That rule postdates a lot of accounts, so grandfathered
+ * owners containing `--` still exist and IAM accepts them fine. Rejecting one
+ * would block a legitimate user for no security gain.
+ */
+const GITHUB_OWNER = /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,37}[A-Za-z0-9])?$/;
+/** GitHub repository: alphanumerics plus `.`, `_`, `-`, 100 characters max. */
+const GITHUB_REPO = /^[A-Za-z0-9._-]{1,100}$/;
+export function validateGithubOwner(value, label = 'GitHub username/org') {
+    if (!GITHUB_OWNER.test(value)) {
+        fail([
+            `Error: ${label} "${value}" is not a valid GitHub owner name.`,
+            '  Expected letters, digits, and hyphens (max 39 characters), not starting or ending with a hyphen.',
+        ]);
+    }
+    return value;
+}
+export function validateGithubRepo(value, label = 'Repository name') {
+    if (!GITHUB_REPO.test(value) || value === '.' || value === '..') {
+        fail([
+            `Error: ${label} "${value}" is not a valid GitHub repository name.`,
+            '  Expected letters, digits, dots, underscores, and hyphens (max 100 characters).',
+        ]);
+    }
+    return value;
+}
+// ---- GitLab ----
+/**
+ * One segment of a GitLab namespace or project path.
+ *
+ * GitLab permits letters, digits, `_`, `.`, `-`, requires the first character to
+ * be alphanumeric, and reserves the `.git` and `.atom` suffixes.
+ */
+const GITLAB_SEGMENT = /^[A-Za-z0-9][A-Za-z0-9._-]{0,254}$/;
+function validGitlabSegment(seg) {
+    return GITLAB_SEGMENT.test(seg) && !/\.(git|atom)$/i.test(seg);
+}
+/** A single GitLab group or username -- one segment, no slash. */
+export function validateGitlabNamespace(value, label = 'GitLab group/username') {
+    if (!validGitlabSegment(value)) {
+        fail([
+            `Error: ${label} "${value}" is not a valid GitLab namespace.`,
+            '  Expected a single path segment of letters, digits, dots, underscores, and hyphens.',
+            '  Use --global with just the group name, not a full project path.',
+        ]);
+    }
+    return value;
+}
+/**
+ * A full GitLab project path, which may be nested: `group/subgroup/project`.
+ *
+ * Slashes are legal here, unlike a GitHub repo name, so this cannot reuse the
+ * GitHub validator. Every segment is checked individually; empty segments (from
+ * a leading, trailing, or doubled slash) are rejected because they silently
+ * change the project_path sub claim.
+ */
+export function validateGitlabProjectPath(value, label = 'GitLab project path') {
+    const segments = value.split('/');
+    if (segments.length < 2 || !segments.every(validGitlabSegment)) {
+        fail([
+            `Error: ${label} "${value}" is not a valid GitLab project path.`,
+            '  Expected group/project, optionally nested as group/subgroup/project.',
+            '  Each segment may contain letters, digits, dots, underscores, and hyphens.',
+        ]);
+    }
+    return value;
+}
+/**
+ * Normalizes a GitLab instance URL and returns the URL and its bare hostname.
+ *
+ * The hostname is used two ways that both break silently on a malformed value:
+ * as the last element of the OIDC provider ARN, and as the prefix of the
+ * `<host>:aud` / `<host>:sub` trust policy condition keys. Deriving it with a
+ * bare `.replace(/^https?:\/\//, '')` leaves any trailing slash or path in
+ * place, so `https://gitlab.com/` yields the condition key `gitlab.com/:sub`,
+ * which no token will ever match -- the role simply becomes unassumable, with
+ * no error at creation time.
+ */
+export function normalizeGitlabUrl(value, label = 'GitLab instance URL') {
+    let parsed;
+    try {
+        parsed = new URL(value);
+    }
+    catch {
+        return fail([
+            `Error: ${label} "${value}" is not a valid URL.`,
+            '  Expected something like https://gitlab.com or https://gitlab.example.com.',
+        ]);
+    }
+    if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') {
+        fail([`Error: ${label} must use http or https, got "${parsed.protocol}".`]);
+    }
+    if (parsed.pathname !== '/' && parsed.pathname !== '') {
+        fail([
+            `Error: ${label} "${value}" must not include a path.`,
+            `  Use the instance root, e.g. ${parsed.protocol}//${parsed.host}`,
+        ]);
+    }
+    // GitLab's aud claim is the instance URL with no trailing slash.
+    return { url: `${parsed.protocol}//${parsed.host}`, host: parsed.host };
+}
+// ---- Shared ----
+/**
+ * A provider-assigned numeric id (GitHub owner/repo id, GitLab project id).
+ *
+ * These reach an IAM trust policy sub claim. A non-numeric value cannot be a
+ * real id, and permitting one risks widening the claim rather than failing.
+ */
+export function validateNumericId(value, label = 'ID') {
+    if (!/^\d+$/.test(value)) {
+        fail([`Error: ${label} "${value}" is not numeric.`]);
+    }
+    return value;
+}
+//# sourceMappingURL=validate.js.map

package/dist/src/utils/validate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../../src/utils/validate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,SAAS,IAAI,CAAC,KAAe;IAC3B,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC9C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,mBAAmB;AAEnB;;;;;;;;GAQG;AACH,MAAM,YAAY,GAAG,iDAAiD,CAAC;AAEvE,+EAA+E;AAC/E,MAAM,WAAW,GAAG,yBAAyB,CAAC;AAE9C,MAAM,UAAU,mBAAmB,CAAC,KAAa,EAAE,KAAK,GAAG,qBAAqB;IAC9E,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,UAAU,KAAK,KAAK,KAAK,qCAAqC;YAC9D,oGAAoG;SACrG,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAa,EAAE,KAAK,GAAG,iBAAiB;IACzE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChE,IAAI,CAAC;YACH,UAAU,KAAK,KAAK,KAAK,0CAA0C;YACnE,kFAAkF;SACnF,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,mBAAmB;AAEnB;;;;;GAKG;AACH,MAAM,cAAc,GAAG,oCAAoC,CAAC;AAE5D,SAAS,kBAAkB,CAAC,GAAW;IACrC,OAAO,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACjE,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,uBAAuB,CAAC,KAAa,EAAE,KAAK,GAAG,uBAAuB;IACpF,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,UAAU,KAAK,KAAK,KAAK,oCAAoC;YAC7D,sFAAsF;YACtF,mEAAmE;SACpE,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAAa,EAAE,KAAK,GAAG,qBAAqB;IACpF,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAC/D,IAAI,CAAC;YACH,UAAU,KAAK,KAAK,KAAK,uCAAuC;YAChE,wEAAwE;YACxE,6EAA6E;SAC9E,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa,EAAE,KAAK,GAAG,qBAAqB;IAC7E,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;YACV,UAAU,KAAK,KAAK,KAAK,uBAAuB;YAChD,6EAA6E;SAC9E,CAAC,CAAC;IACL,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAChE,IAAI,CAAC,CAAC,UAAU,KAAK,iCAAiC,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,GAAG,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QACtD,IAAI,CAAC;YACH,UAAU,KAAK,KAAK,KAAK,4BAA4B;YACrD,iCAAiC,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,IAAI,EAAE;SACnE,CAAC,CAAC;IACL,CAAC;IACD,iEAAiE;IACjE,OAAO,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AAC1E,CAAC;AAED,mBAAmB;AAEnB;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAa,EAAE,KAAK,GAAG,IAAI;IAC3D,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,UAAU,KAAK,KAAK,KAAK,mBAAmB,CAAC,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@prism-d1/cli",
-  "version": "1.0.80",
+  "version": "1.0.81",
   "description": "PRISM D1 Velocity CLI — AI development lifecycle assessment tool",
   "author": "andklee",
   "engines": {