@prism-d1/cli 1.5.0 → 1.7.0

package/dist/src/dashboard/actions.js

@@ -0,0 +1,242 @@
+/**
+ * The Setup page's Run buttons: a fixed allowlist of action ids, each mapped
+ * here (server side) to a fixed argv for this CLI's own binary.
+ *
+ * Safety properties, enforced in start():
+ *   - spawn(process.execPath, [cli entry, ...fixed args]) with shell:false and
+ *     stdin closed, so prompts take their no-terminal path and nothing is parsed
+ *     by a shell;
+ *   - the request names an action id and nothing else free-form: a repo is an
+ *     id resolved against the dashboard's own scan list (never a client path),
+ *     and the only text input is a collector URL for team mode, validated as
+ *     https with a hostname, no userinfo, at most 2048 characters;
+ *   - one action at a time, each with a timeout;
+ *   - output is redacted before it leaves the server, and every run is
+ *     appended to ~/.prism/logs/dashboard-actions.log (time, id, repo name,
+ *     exit code; never output or URLs);
+ *   - no action writes to AWS. aws check and team info are read-only;
+ *     AWS-writing commands are copy-only on the page.
+ */
+import { spawn as nodeSpawn } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { appendFileSync, mkdirSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+const MIN = 60_000;
+export const ACTIONS = {
+    'codewatch-repo': { label: 'Enable codewatch in this repo', args: ['enable', 'codewatch'], repo: true, timeoutMs: 2 * MIN },
+    'codewatch-global': { label: 'Enable codewatch for every repo', args: ['enable', 'codewatch', '--global'], timeoutMs: 2 * MIN },
+    'codeburn-local': { label: 'Keep usage local', args: ['enable', 'codeburn', '--local'], timeoutMs: 2 * MIN },
+    'codeburn-systemd': { label: 'Schedule with a systemd user timer', args: ['enable', 'codeburn', '--schedule', 'systemd'], systemd: true, timeoutMs: 5 * MIN },
+    // codeburn sync setup opens a browser to sign in, so this one gets longer.
+    'codeburn-team': { label: "Sync to my team's PRISM", args: ['enable', 'codeburn', '--url'], url: true, timeoutMs: 10 * MIN },
+    'codeburn-remove': { label: 'Remove the sync schedule', args: ['enable', 'codeburn', '--remove'], confirm: true, timeoutMs: 2 * MIN },
+    'codeburn-status': { label: 'codeburn status', args: ['enable', 'codeburn', '--status'], timeoutMs: MIN },
+    'aws-check': { label: 'AWS account check (read-only)', args: ['aws', 'check'], readOnlyAws: true, timeoutMs: 10 * MIN },
+    'team-info': { label: 'Team stack info (read-only)', args: ['team', 'info'], readOnlyAws: true, timeoutMs: 2 * MIN },
+};
+const isActionId = (x) => typeof x === 'string' && Object.prototype.hasOwnProperty.call(ACTIONS, x);
+export const MAX_URL_LENGTH = 2048;
+/** null when `s` is an acceptable collector URL, else why not. */
+export function collectorUrlError(s) {
+    if (typeof s !== 'string' || !s)
+        return 'a collector URL is required';
+    if (s.length > MAX_URL_LENGTH)
+        return `the URL is longer than ${MAX_URL_LENGTH} characters`;
+    if (/[\s\u0000-\u001f\u007f]/.test(s))
+        return 'the URL contains spaces or control characters';
+    let u;
+    try {
+        u = new URL(s);
+    }
+    catch {
+        return 'not a valid URL';
+    }
+    if (u.protocol !== 'https:')
+        return 'the URL must start with https://';
+    if (!u.hostname)
+        return 'the URL has no hostname';
+    if (u.username || u.password || /^https:\/\/[^/?#]*@/i.test(s))
+        return 'the URL must not contain a user name or password';
+    return null;
+}
+/** Stable id for a scanned repo: never a path the client could choose. */
+export function repoId(path) {
+    return createHash('sha256').update(path).digest('hex').slice(0, 16);
+}
+const ANSI_RE = /\u001b\[[0-9;?]*[A-Za-z]/g;
+/**
+ * Masks secrets in command output: AWS key ids, key=value secrets, bearer
+ * tokens, JWTs, URL userinfo and token-like query parameters.
+ * shortcut: pattern-based, so an unusual secret format can slip through; add its pattern when one is seen.
+ */
+export function redact(s) {
+    return s
+        .replace(ANSI_RE, '')
+        .replace(/\b(?:AKIA|ASIA|ABIA|ACCA|A3T[A-Z0-9])[A-Z0-9]{16}\b/g, '[REDACTED]')
+        .replace(/\b((?:aws_)?(?:secret_access_key|session_token|security_token|secret|password|passwd|api[_-]?key|access_token|refresh_token|id_token|client_secret)["']?\s*[:=]\s*["']?)[^\s"',;&]+/gi, '$1[REDACTED]')
+        .replace(/\b(Bearer|Basic)\s+[A-Za-z0-9._~+/=-]{8,}/g, '$1 [REDACTED]')
+        .replace(/\beyJ[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}/g, '[REDACTED]')
+        .replace(/\b([a-z][a-z0-9+.-]*:\/\/)[^\s/@]+@/gi, '$1[REDACTED]@')
+        .replace(/([?&#](?:token|access_token|id_token|code|signature|sig|key|x-amz-[a-z-]+)=)[^&\s#"']+/gi, '$1[REDACTED]');
+}
+/** This CLI's own entry script: dist/bin/prism-cli.js beside dist/src/dashboard/. */
+export function cliEntry() {
+    return fileURLToPath(new URL('../../bin/prism-cli.js', import.meta.url));
+}
+const MAX_OUTPUT = 256 * 1024;
+const ALLOWED_KEYS = new Set(['action', 'repo', 'url', 'confirm']);
+/** `prism-cli <args>` as shown on the page. Arguments are fixed words or the validated https URL. */
+export function displayCommand(args) {
+    return ['prism-cli', ...args.map((a) => (/^[A-Za-z0-9_./:=@%+,-]+$/.test(a) ? a : `'${a.replace(/'/g, `'\\''`)}'`))].join(' ');
+}
+export function actionLogPath(home) {
+    return join(home, '.prism', 'logs', 'dashboard-actions.log');
+}
+/** Repo names go into a one-line log: anything but name characters becomes _. */
+const logSafe = (s) => s.replace(/[^A-Za-z0-9._-]/g, '_').slice(0, 120);
+export class ActionRunner {
+    d;
+    cur = null;
+    busy = false;
+    seq = 0;
+    constructor(d) {
+        this.d = d;
+    }
+    /** True while an action (or Check now) holds the lock. */
+    get running() { return this.busy; }
+    /** Runs `fn` under the same one-at-a-time lock as the actions. */
+    async exclusive(fn) {
+        if (this.busy)
+            return { status: 409, json: { error: 'another action is running; wait for it to finish' } };
+        this.busy = true;
+        try {
+            return { status: 200, json: await fn() };
+        }
+        finally {
+            this.busy = false;
+        }
+    }
+    available(id) {
+        return !ACTIONS[id].systemd || (this.d.platform === 'linux' && this.d.systemdAvailable());
+    }
+    /** Validates the request, then starts the action. 202 with the command, else 4xx with the reason. */
+    async start(body) {
+        const bad = (error, status = 400) => ({ status, json: { error } });
+        if (!body || typeof body !== 'object' || Array.isArray(body))
+            return bad('expected a JSON object');
+        const b = body;
+        const extra = Object.keys(b).filter((k) => !ALLOWED_KEYS.has(k));
+        if (extra.length)
+            return bad(`unexpected field ${extra[0]}`);
+        if (!isActionId(b.action))
+            return bad('unknown action');
+        const id = b.action, def = ACTIONS[id];
+        if (!this.available(id))
+            return bad('this action is not available on this machine');
+        let repo = null;
+        if (def.repo) {
+            if (typeof b.repo !== 'string' || !/^[a-f0-9]{16}$/.test(b.repo))
+                return bad('repo must be an id from the scan list');
+            repo = (await this.d.repos()).find((r) => r.id === b.repo) ?? null;
+            if (!repo)
+                return bad('repo is not in the scan list');
+        }
+        else if (b.repo !== undefined)
+            return bad('this action does not take a repo');
+        if (def.url) {
+            const e = collectorUrlError(b.url);
+            if (e)
+                return bad(`collector URL: ${e}`);
+        }
+        else if (b.url !== undefined)
+            return bad('this action does not take a URL');
+        if (def.confirm && b.confirm !== true)
+            return bad('this action needs confirm: true');
+        if (b.confirm !== undefined && typeof b.confirm !== 'boolean')
+            return bad('confirm must be true or false');
+        if (this.busy)
+            return bad('another action is running; wait for it to finish', 409);
+        const args = [...def.args, ...(def.url ? [b.url] : [])];
+        const cwd = repo ? repo.path : this.d.cwd;
+        const now = this.d.now ?? (() => new Date());
+        this.busy = true;
+        const runId = ++this.seq;
+        const st = this.cur = {
+            state: 'running', runId, action: id, repo: repo?.name ?? null, command: displayCommand(args), cwd,
+            buf: '', exitCode: null, timedOut: false, startedAt: now().toISOString(), finishedAt: null,
+        };
+        const add = (chunk) => {
+            st.buf += chunk.toString();
+            if (st.buf.length > MAX_OUTPUT)
+                st.buf = '[earlier output trimmed]\n' + st.buf.slice(-MAX_OUTPUT);
+        };
+        let child;
+        try {
+            child = (this.d.spawn ?? nodeSpawn)(this.d.execPath, [this.d.entry, ...args], {
+                cwd, shell: false, windowsHide: true, stdio: ['ignore', 'pipe', 'pipe'],
+                env: { ...process.env, NO_COLOR: '1', FORCE_COLOR: '0' },
+            });
+        }
+        catch (e) {
+            add(`could not start: ${e.message}\n`);
+            this.finish(st, 1);
+            return { status: 202, json: this.status() };
+        }
+        child.stdout?.on('data', add);
+        child.stderr?.on('data', add);
+        let killer;
+        const timer = setTimeout(() => {
+            st.timedOut = true;
+            add(`\n[timed out after ${Math.round(def.timeoutMs / 1000)} s; stopping it]\n`);
+            child.kill('SIGTERM');
+            killer = setTimeout(() => child.kill('SIGKILL'), this.d.killGraceMs ?? 5000);
+            killer.unref();
+        }, def.timeoutMs);
+        timer.unref();
+        let settled = false;
+        const done = (code) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            if (killer)
+                clearTimeout(killer);
+            this.finish(st, st.timedOut ? 124 : code ?? 1);
+        };
+        child.on('error', (e) => { add(`could not start: ${e.message}\n`); done(1); });
+        child.on('close', (code) => done(code));
+        return { status: 202, json: this.status() };
+    }
+    finish(st, code) {
+        st.exitCode = code;
+        st.state = 'done';
+        st.finishedAt = (this.d.now ?? (() => new Date()))().toISOString();
+        this.busy = false;
+        this.log(st);
+        try {
+            this.d.onDone?.();
+        }
+        catch { /* a refresh hook must not break the runner */ }
+    }
+    log(st) {
+        const line = JSON.stringify({ time: st.finishedAt, action: st.action, repo: st.repo ? logSafe(st.repo) : null, exit: st.exitCode }) + '\n';
+        const p = actionLogPath(this.d.home);
+        try {
+            mkdirSync(dirname(p), { recursive: true, mode: 0o700 });
+            appendFileSync(p, line, { mode: 0o600 });
+        }
+        catch (e) {
+            process.stderr.write(`prism dashboard: could not write ${p}: ${e.message}\n`);
+        }
+    }
+    /** The current or last action, output redacted. */
+    status() {
+        const c = this.cur;
+        if (!c)
+            return { state: 'idle' };
+        const { buf, ...rest } = c;
+        return { ...rest, output: redact(buf) };
+    }
+}
+//# sourceMappingURL=actions.js.map

package/dist/src/dashboard/actions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"actions.js","sourceRoot":"","sources":["../../../src/dashboard/actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,KAAK,IAAI,SAAS,EAAwC,MAAM,oBAAoB,CAAC;AAC9F,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAsBzC,MAAM,GAAG,GAAG,MAAM,CAAC;AACnB,MAAM,CAAC,MAAM,OAAO,GAAgC;IAClD,gBAAgB,EAAE,EAAE,KAAK,EAAE,+BAA+B,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,GAAG,GAAG,EAAE;IAC3H,kBAAkB,EAAE,EAAE,KAAK,EAAE,iCAAiC,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC,GAAG,GAAG,EAAE;IAC/H,gBAAgB,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC,GAAG,GAAG,EAAE;IAC5G,kBAAkB,EAAE,EAAE,KAAK,EAAE,oCAAoC,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,GAAG,GAAG,EAAE;IAC7J,2EAA2E;IAC3E,eAAe,EAAE,EAAE,KAAK,EAAE,yBAAyB,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,GAAG,GAAG,EAAE;IAC5H,iBAAiB,EAAE,EAAE,KAAK,EAAE,0BAA0B,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,UAAU,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,GAAG,GAAG,EAAE;IACrI,iBAAiB,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,UAAU,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE;IACzG,WAAW,EAAE,EAAE,KAAK,EAAE,+BAA+B,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,GAAG,GAAG,EAAE;IACvH,WAAW,EAAE,EAAE,KAAK,EAAE,6BAA6B,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,GAAG,GAAG,EAAE;CACrH,CAAC;AAEF,MAAM,UAAU,GAAG,CAAC,CAAU,EAAiB,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;AAE5H,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,CAAC;AAEnC,kEAAkE;AAClE,MAAM,UAAU,iBAAiB,CAAC,CAAU;IAC1C,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC;QAAE,OAAO,6BAA6B,CAAC;IACtE,IAAI,CAAC,CAAC,MAAM,GAAG,cAAc;QAAE,OAAO,0BAA0B,cAAc,aAAa,CAAC;IAC5F,IAAI,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,+CAA+C,CAAC;IAC9F,IAAI,CAAM,CAAC;IACX,IAAI,CAAC;QAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,iBAAiB,CAAC;IAAC,CAAC;IAC3D,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,kCAAkC,CAAC;IACvE,IAAI,CAAC,CAAC,CAAC,QAAQ;QAAE,OAAO,yBAAyB,CAAC;IAClD,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,IAAI,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,kDAAkD,CAAC;IAC1H,OAAO,IAAI,CAAC;AACd,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,MAAM,CAAC,IAAY;IACjC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,OAAO,GAAG,2BAA2B,CAAC;AAE5C;;;;GAIG;AACH,MAAM,UAAU,MAAM,CAAC,CAAS;IAC9B,OAAO,CAAC;SACL,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;SACpB,OAAO,CAAC,sDAAsD,EAAE,YAAY,CAAC;SAC7E,OAAO,CAAC,uLAAuL,EAAE,cAAc,CAAC;SAChN,OAAO,CAAC,4CAA4C,EAAE,eAAe,CAAC;SACtE,OAAO,CAAC,+DAA+D,EAAE,YAAY,CAAC;SACtF,OAAO,CAAC,uCAAuC,EAAE,eAAe,CAAC;SACjE,OAAO,CAAC,0FAA0F,EAAE,cAAc,CAAC,CAAC;AACzH,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,QAAQ;IACtB,OAAO,aAAa,CAAC,IAAI,GAAG,CAAC,wBAAwB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC3E,CAAC;AAuCD,MAAM,UAAU,GAAG,GAAG,GAAG,IAAI,CAAC;AAC9B,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;AAEnE,qGAAqG;AACrG,MAAM,UAAU,cAAc,CAAC,IAAuB;IACpD,OAAO,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACjI,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,OAAO,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,uBAAuB,CAAC,CAAC;AAC/D,CAAC;AAED,iFAAiF;AACjF,MAAM,OAAO,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAEhF,MAAM,OAAO,YAAY;IAIH;IAHZ,GAAG,GAA4C,IAAI,CAAC;IACpD,IAAI,GAAG,KAAK,CAAC;IACb,GAAG,GAAG,CAAC,CAAC;IAChB,YAAoB,CAAa;QAAb,MAAC,GAAD,CAAC,CAAY;IAAG,CAAC;IAErC,0DAA0D;IAC1D,IAAI,OAAO,KAAc,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAE5C,kEAAkE;IAClE,KAAK,CAAC,SAAS,CAAI,EAAwB;QACzC,IAAI,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,kDAAkD,EAAE,EAAE,CAAC;QAC3G,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC;YAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QAAC,CAAC;gBAAS,CAAC;YAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC;QAAC,CAAC;IAClF,CAAC;IAED,SAAS,CAAC,EAAY;QACpB,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAC5F,CAAC;IAED,qGAAqG;IACrG,KAAK,CAAC,KAAK,CAAC,IAAa;QACvB,MAAM,GAAG,GAAG,CAAC,KAAa,EAAE,MAAM,GAAG,GAAG,EAAa,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACtF,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,OAAO,GAAG,CAAC,wBAAwB,CAAC,CAAC;QACnG,MAAM,CAAC,GAAG,IAA+B,CAAC;QAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACjE,IAAI,KAAK,CAAC,MAAM;YAAE,OAAO,GAAG,CAAC,oBAAoB,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC;YAAE,OAAO,GAAG,CAAC,gBAAgB,CAAC,CAAC;QACxD,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,GAAG,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAAE,OAAO,GAAG,CAAC,8CAA8C,CAAC,CAAC;QACpF,IAAI,IAAI,GAAoB,IAAI,CAAC;QACjC,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YACb,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;gBAAE,OAAO,GAAG,CAAC,uCAAuC,CAAC,CAAC;YACtH,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;YACnE,IAAI,CAAC,IAAI;gBAAE,OAAO,GAAG,CAAC,8BAA8B,CAAC,CAAC;QACxD,CAAC;aAAM,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,GAAG,CAAC,kCAAkC,CAAC,CAAC;QAChF,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC;YACZ,MAAM,CAAC,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACnC,IAAI,CAAC;gBAAE,OAAO,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;QAC3C,CAAC;aAAM,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS;YAAE,OAAO,GAAG,CAAC,iCAAiC,CAAC,CAAC;QAC9E,IAAI,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,KAAK,IAAI;YAAE,OAAO,GAAG,CAAC,iCAAiC,CAAC,CAAC;QACrF,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,SAAS;YAAE,OAAO,GAAG,CAAC,+BAA+B,CAAC,CAAC;QAC3G,IAAI,IAAI,CAAC,IAAI;YAAE,OAAO,GAAG,CAAC,kDAAkD,EAAE,GAAG,CAAC,CAAC;QAEnF,MAAM,IAAI,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAClE,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;QAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAC7C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,MAAM,KAAK,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC;QACzB,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG;YACpB,KAAK,EAAE,SAAkB,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,IAAI,EAAE,OAAO,EAAE,cAAc,CAAC,IAAI,CAAC,EAAE,GAAG;YAC1G,GAAG,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE,UAAU,EAAE,IAAI;SACzD,CAAC;QACpC,MAAM,GAAG,GAAG,CAAC,KAAsB,EAAE,EAAE;YACrC,EAAE,CAAC,GAAG,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YAC3B,IAAI,EAAE,CAAC,GAAG,CAAC,MAAM,GAAG,UAAU;gBAAE,EAAE,CAAC,GAAG,GAAG,4BAA4B,GAAG,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,CAAC;QACpG,CAAC,CAAC;QACF,IAAI,KAAmB,CAAC;QACxB,IAAI,CAAC;YACH,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,EAAE;gBAC5E,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;gBACvE,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE;aACzD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,GAAG,CAAC,oBAAqB,CAAW,CAAC,OAAO,IAAI,CAAC,CAAC;YAClD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YACnB,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QAC9C,CAAC;QACD,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC9B,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC9B,IAAI,MAAkC,CAAC;QACvC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,EAAE,CAAC,QAAQ,GAAG,IAAI,CAAC;YACnB,GAAG,CAAC,sBAAsB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC,oBAAoB,CAAC,CAAC;YAChF,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACtB,MAAM,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC;YAC7E,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,CAAC,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;QAClB,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,IAAI,GAAG,CAAC,IAAmB,EAAE,EAAE;YACnC,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,IAAI,MAAM;gBAAE,YAAY,CAAC,MAAM,CAAC,CAAC;YACjC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;QACjD,CAAC,CAAC;QACF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,GAAG,CAAC,oBAAoB,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/E,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACxC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;IAC9C,CAAC;IAEO,MAAM,CAAC,EAAkC,EAAE,IAAY;QAC7D,EAAE,CAAC,QAAQ,GAAG,IAAI,CAAC;QACnB,EAAE,CAAC,KAAK,GAAG,MAAM,CAAC;QAClB,EAAE,CAAC,UAAU,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC;QACnE,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC;QAClB,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACb,IAAI,CAAC;YAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,8CAA8C,CAAC,CAAC;IACrF,CAAC;IAEO,GAAG,CAAC,EAAgB;QAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,IAAI,CAAC;QAC3I,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC;YACH,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACxD,cAAc,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oCAAoC,CAAC,KAAM,CAAW,CAAC,OAAO,IAAI,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;IAED,mDAAmD;IACnD,MAAM;QACJ,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC;QACnB,IAAI,CAAC,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QACjC,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC;QAC3B,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;IAC1C,CAAC;CACF"}

package/dist/src/dashboard/aws-identity.d.ts

@@ -0,0 +1,115 @@
+import { aws } from '../utils/aws.js';
+import { writeConnectionFile, type SavedConnection } from '../aws/connection.js';
+/** Section name -> its key names (lower case), plus the region value: the only value kept. */
+export type IniKeys = Map<string, {
+    keys: Set<string>;
+    region?: string;
+}>;
+/**
+ * Key names per section. Values are discarded line by line; `region` is kept
+ * only when it looks like a region name. Indented lines are nested settings
+ * (e.g. s3 = ...) and are skipped.
+ */
+export declare function iniKeys(text: string, kind: 'config' | 'credentials'): IniKeys;
+export type CredentialType = 'credential_process' | 'sso' | 'static-credentials-file' | 'static-config-file' | 'assume-role' | 'web-identity' | 'env' | 'container' | 'none';
+export declare const CREDENTIAL_TYPE_LABEL: Record<CredentialType, string>;
+/**
+ * The type the AWS CLI would use for `profile`, in its provider order within a
+ * profile: role_arn, web identity, SSO, keys in the credentials file,
+ * credential_process, keys in the config file. `shadowed` lists the types that
+ * are configured but lose.
+ */
+export declare function classifyProfile(profile: string, config: IniKeys, creds: IniKeys): {
+    type: CredentialType;
+    shadowed: CredentialType[];
+};
+export interface ResolutionStep {
+    id: 'flags' | 'env' | 'repo' | 'user' | 'default';
+    label: string;
+    /** used: this step chose the credentials. skipped: set, but an earlier step won. */
+    state: 'used' | 'skipped' | 'not-set' | 'n/a';
+    detail: string;
+}
+export interface AwsIdentityView {
+    /** Profile name the AWS CLI is given, or null (env keys, container, or nothing). */
+    profile: string | null;
+    /** Why: "AWS_PROFILE", "aws connect, repo", "default chain", ... */
+    source: string;
+    credentialType: CredentialType;
+    credentialLabel: string;
+    region: {
+        value: string;
+        source: string;
+    } | null;
+    steps: ResolutionStep[];
+    /** The saved aws connect connection (the repo file, else the user file), whether or not it is in use. */
+    saved: null | {
+        scope: 'repo' | 'user';
+        path: string;
+        profile: string;
+        region: string;
+        account: string;
+        alias: string | null;
+        verifiedAt: string;
+        inUse: boolean;
+    };
+    warnings: string[];
+    files: {
+        config: string;
+        credentials: string;
+        configFound: boolean;
+        credentialsFound: boolean;
+    };
+}
+export interface IdentityDeps {
+    env: NodeJS.ProcessEnv;
+    home: string;
+    /** The repo the dashboard runs in (for .prism/aws.local.json), or null. */
+    repoRoot: string | null;
+    /** File reader; null when the file is missing or unreadable. */
+    readText?: (path: string) => string | null;
+}
+export declare const STATIC_DEFAULT_WARNING = "The default profile has static keys in ~/.aws/credentials. Static keys win over a credential_process or SSO setting for the same profile, and they often expire. If you sign in with credential_process or SSO, remove the keys from [default] in ~/.aws/credentials.";
+export declare const NO_CREDENTIALS_WARNING = "No AWS credentials found: no AWS env var, no saved aws connect profile, and no default profile in ~/.aws/config or ~/.aws/credentials. Set one up with aws configure sso (or aws configure), then run prism-cli aws connect.";
+/** What prism-cli would use, from local files and env only. No AWS call, no aws CLI call. */
+export declare function resolveAwsIdentity(d: IdentityDeps): AwsIdentityView;
+export type CheckNowResult = {
+    ok: true;
+    account: string;
+    arn: string;
+    region: string | null;
+    profile: string | null;
+    savedAccount: string | null;
+    matches: boolean | null;
+    updated: boolean;
+    note: string;
+} | {
+    ok: false;
+    expired: boolean;
+    error: string;
+    profile: string | null;
+    region: string | null;
+    fixes: string[];
+};
+export interface CheckNowDeps {
+    identity: AwsIdentityView;
+    /** The saved connection behind identity.saved (with its real path), or null. */
+    saved: SavedConnection | null;
+    /** Same shape as aws connect's deps.aws: one read-only `aws <args>` call. */
+    aws(args: string[], profile: string, region: string): ReturnType<typeof aws>;
+    now(): Date;
+    write?: typeof writeConnectionFile;
+    redact(s: string): string;
+}
+/** The fixes to suggest for a failed check, by credential type. */
+export declare function checkFixes(v: AwsIdentityView): string[];
+/** The default `aws` call for Check now: aws connect's call, with the region optional and a timeout. */
+export declare const CHECK_NOW_TIMEOUT_MS = 30000;
+export declare function checkNowAws(args: string[], profile: string, region: string): import("../utils/aws.js").AwsResult;
+/**
+ * One read-only `sts get-caller-identity`, through aws connect's callerIdentity.
+ * On a match with the saved connection (same profile and region), the saved
+ * file's verifiedAt is refreshed; nothing else is written.
+ */
+export declare function checkNow(d: CheckNowDeps): CheckNowResult;
+//# sourceMappingURL=aws-identity.d.ts.map

package/dist/src/dashboard/aws-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws-identity.d.ts","sourceRoot":"","sources":["../../../src/dashboard/aws-identity.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAC;AAEtC,OAAO,EAA+D,mBAAmB,EAAE,KAAK,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAI9I,8FAA8F;AAC9F,MAAM,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,EAAE;IAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAE1E;;;;GAIG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,GAAG,aAAa,GAAG,OAAO,CAyB7E;AAED,MAAM,MAAM,cAAc,GAAG,oBAAoB,GAAG,KAAK,GAAG,yBAAyB,GAAG,oBAAoB,GACxG,aAAa,GAAG,cAAc,GAAG,KAAK,GAAG,WAAW,GAAG,MAAM,CAAC;AAElE,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,cAAc,EAAE,MAAM,CAUhE,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,GAAG;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,EAAE,cAAc,EAAE,CAAA;CAAE,CAYtI;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,OAAO,GAAG,KAAK,GAAG,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IAClD,KAAK,EAAE,MAAM,CAAC;IACd,oFAAoF;IACpF,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,KAAK,CAAC;IAC9C,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,eAAe;IAC9B,oFAAoF;IACpF,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,cAAc,CAAC;IAC/B,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACjD,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,yGAAyG;IACzG,KAAK,EAAE,IAAI,GAAG;QACZ,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QAC7G,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,CAAC;KACpC,CAAC;IACF,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,KAAK,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,OAAO,CAAC;QAAC,gBAAgB,EAAE,OAAO,CAAA;KAAE,CAAC;CACjG;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,2EAA2E;IAC3E,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,gEAAgE;IAChE,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CAC5C;AAID,eAAO,MAAM,sBAAsB,0QAA0Q,CAAC;AAC9S,eAAO,MAAM,sBAAsB,iOAAiO,CAAC;AAErQ,6FAA6F;AAC7F,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,YAAY,GAAG,eAAe,CAwEnE;AAED,MAAM,MAAM,cAAc,GACtB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC/K;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAEnH,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,eAAe,CAAC;IAC1B,gFAAgF;IAChF,KAAK,EAAE,eAAe,GAAG,IAAI,CAAC;IAC9B,6EAA6E;IAC7E,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,UAAU,CAAC,OAAO,GAAG,CAAC,CAAC;IAC7E,GAAG,IAAI,IAAI,CAAC;IACZ,KAAK,CAAC,EAAE,OAAO,mBAAmB,CAAC;IACnC,MAAM,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;CAC3B;AAID,mEAAmE;AACnE,wBAAgB,UAAU,CAAC,CAAC,EAAE,eAAe,GAAG,MAAM,EAAE,CASvD;AAED,wGAAwG;AACxG,eAAO,MAAM,oBAAoB,QAAS,CAAC;AAC3C,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,uCAE1E;AAED;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,CAAC,EAAE,YAAY,GAAG,cAAc,CAsBxD"}

package/dist/src/dashboard/aws-identity.js

@@ -0,0 +1,240 @@
+/**
+ * The Setup page's AWS section: which credentials prism-cli would use and why,
+ * with no AWS call, and the one read-only "Check now" call.
+ *
+ * Resolution follows the order every AWS command uses (aws/connection.ts):
+ * flags (none here), env credentials, .prism/aws.local.json, ~/.prism/aws.json,
+ * then the default chain. The credential TYPE comes from the KEY NAMES in
+ * ~/.aws/config and ~/.aws/credentials. The parser drops every value as it
+ * reads a line, except `region`, so no secret is kept, returned or shown.
+ */
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { aws } from '../utils/aws.js';
+import { callerIdentity } from '../aws/connect.js';
+import { applyConnection, connectionLabel, loadConnection, REGION_RE, writeConnectionFile } from '../aws/connection.js';
+import { resolveRegion } from '../security/setup.js';
+import { tildeHome } from './payload.js';
+/**
+ * Key names per section. Values are discarded line by line; `region` is kept
+ * only when it looks like a region name. Indented lines are nested settings
+ * (e.g. s3 = ...) and are skipped.
+ */
+export function iniKeys(text, kind) {
+    const out = new Map();
+    let cur = null;
+    for (const raw of text.split(/\r?\n/)) {
+        if (/^\s/.test(raw))
+            continue;
+        const line = raw.trim();
+        if (!line || line.startsWith('#') || line.startsWith(';'))
+            continue;
+        const sec = /^\[\s*([^\]]+?)\s*\]$/.exec(line);
+        if (sec) {
+            // config: [default] and [profile name]; [sso-session x] and others are not profiles.
+            const name = kind === 'credentials' ? sec[1] : sec[1] === 'default' ? 'default' : /^profile\s+(.+)$/.exec(sec[1])?.[1]?.trim();
+            cur = name ? (out.get(name) ?? { keys: new Set() }) : null;
+            if (name && cur)
+                out.set(name, cur);
+            continue;
+        }
+        const eq = line.indexOf('=');
+        if (!cur || eq <= 0)
+            continue;
+        const key = line.slice(0, eq).trim().toLowerCase();
+        cur.keys.add(key);
+        if (key === 'region') {
+            const v = line.slice(eq + 1).trim();
+            if (REGION_RE.test(v))
+                cur.region = v;
+        }
+    }
+    return out;
+}
+export const CREDENTIAL_TYPE_LABEL = {
+    credential_process: 'credential_process',
+    sso: 'IAM Identity Center (SSO)',
+    'static-credentials-file': 'static keys in ~/.aws/credentials',
+    'static-config-file': 'static keys in ~/.aws/config',
+    'assume-role': 'assume role (role_arn)',
+    'web-identity': 'web identity token',
+    env: 'environment variables',
+    container: 'container credentials',
+    none: 'none found',
+};
+/**
+ * The type the AWS CLI would use for `profile`, in its provider order within a
+ * profile: role_arn, web identity, SSO, keys in the credentials file,
+ * credential_process, keys in the config file. `shadowed` lists the types that
+ * are configured but lose.
+ */
+export function classifyProfile(profile, config, creds) {
+    const c = config.get(profile)?.keys ?? new Set();
+    const k = creds.get(profile)?.keys ?? new Set();
+    const present = [];
+    if (c.has('role_arn') && (c.has('web_identity_token_file')))
+        present.push('web-identity');
+    else if (c.has('role_arn') || k.has('role_arn'))
+        present.push('assume-role');
+    if (c.has('sso_session') || c.has('sso_start_url') || c.has('sso_account_id'))
+        present.push('sso');
+    if (k.has('aws_access_key_id'))
+        present.push('static-credentials-file');
+    if (c.has('credential_process') || k.has('credential_process'))
+        present.push('credential_process');
+    if (c.has('aws_access_key_id'))
+        present.push('static-config-file');
+    if (!present.length)
+        return { type: 'none', shadowed: [] };
+    return { type: present[0], shadowed: present.slice(1) };
+}
+const readTextFile = (p) => { try {
+    return readFileSync(p, 'utf8');
+}
+catch {
+    return null;
+} };
+export const STATIC_DEFAULT_WARNING = 'The default profile has static keys in ~/.aws/credentials. Static keys win over a credential_process or SSO setting for the same profile, and they often expire. If you sign in with credential_process or SSO, remove the keys from [default] in ~/.aws/credentials.';
+export const NO_CREDENTIALS_WARNING = 'No AWS credentials found: no AWS env var, no saved aws connect profile, and no default profile in ~/.aws/config or ~/.aws/credentials. Set one up with aws configure sso (or aws configure), then run prism-cli aws connect.';
+/** What prism-cli would use, from local files and env only. No AWS call, no aws CLI call. */
+export function resolveAwsIdentity(d) {
+    const read = d.readText ?? readTextFile;
+    const env = d.env;
+    const configPath = env.AWS_CONFIG_FILE || join(d.home, '.aws', 'config');
+    const credsPath = env.AWS_SHARED_CREDENTIALS_FILE || join(d.home, '.aws', 'credentials');
+    const configText = read(configPath), credsText = read(credsPath);
+    const config = iniKeys(configText ?? '', 'config');
+    const creds = iniKeys(credsText ?? '', 'credentials');
+    const saved = loadConnection(d.home, d.repoRoot);
+    const applied = applyConnection({}, saved, env);
+    const warnings = [];
+    let profile = null, source, type, shadowed = [];
+    let envDetail = 'no AWS credential env var set';
+    let decided;
+    if (env.AWS_ACCESS_KEY_ID) {
+        type = 'env';
+        source = 'AWS_ACCESS_KEY_ID';
+        decided = 'env';
+        envDetail = `AWS_ACCESS_KEY_ID is set${env.AWS_PROFILE ? ' (it wins over AWS_PROFILE)' : ''}`;
+    }
+    else if (env.AWS_PROFILE) {
+        profile = env.AWS_PROFILE;
+        source = 'AWS_PROFILE';
+        decided = 'env';
+        ({ type, shadowed } = classifyProfile(profile, config, creds));
+        envDetail = `AWS_PROFILE=${profile}`;
+    }
+    else if (env.AWS_WEB_IDENTITY_TOKEN_FILE) {
+        type = 'web-identity';
+        source = 'AWS_WEB_IDENTITY_TOKEN_FILE';
+        decided = 'env';
+        envDetail = 'AWS_WEB_IDENTITY_TOKEN_FILE is set';
+    }
+    else if (env.AWS_CONTAINER_CREDENTIALS_FULL_URI || env.AWS_CONTAINER_CREDENTIALS_RELATIVE_URI) {
+        type = 'container';
+        source = 'container credentials env var';
+        decided = 'env';
+        envDetail = 'a container credentials env var is set';
+    }
+    else if (saved && applied.profileSource) {
+        profile = saved.profile;
+        source = connectionLabel(saved);
+        decided = saved.scope;
+        ({ type, shadowed } = classifyProfile(profile, config, creds));
+    }
+    else {
+        profile = 'default';
+        source = 'default chain';
+        decided = 'default';
+        ({ type, shadowed } = classifyProfile(profile, config, creds));
+    }
+    const repoFile = d.repoRoot ? join(d.repoRoot, '.prism', 'aws.local.json') : null;
+    const savedStep = (scope) => decided === scope ? 'used' : saved?.scope === scope ? 'skipped' : 'not-set';
+    const steps = [
+        { id: 'flags', label: '--profile / --region', state: 'n/a', detail: 'not used by the dashboard' },
+        { id: 'env', label: 'Environment', state: decided === 'env' ? 'used' : 'not-set', detail: envDetail },
+        { id: 'repo', label: 'Repo: .prism/aws.local.json', state: savedStep('repo'),
+            detail: !repoFile ? 'the dashboard is not running in a git repo' : saved?.scope === 'repo' ? `profile ${saved.profile}` : 'not set' },
+        { id: 'user', label: 'User: ~/.prism/aws.json', state: savedStep('user'),
+            detail: saved?.scope === 'user' ? `profile ${saved.profile}` : saved?.scope === 'repo' ? 'the repo file wins' : 'not set' },
+        { id: 'default', label: 'Default chain', state: decided === 'default' ? 'used' : 'not-set', detail: 'the [default] profile' },
+    ];
+    const configRegion = (p) => config.get(p ?? env.AWS_PROFILE ?? 'default')?.region ?? null;
+    const region = resolveRegion({ profile: profile && profile !== 'default' ? profile : undefined, connection: applied.connection }, { env, configRegion });
+    if (creds.get('default')?.keys.has('aws_access_key_id'))
+        warnings.push(STATIC_DEFAULT_WARNING);
+    if (profile && profile !== 'default' && type === 'static-credentials-file' && shadowed.length) {
+        warnings.push(`Profile ${profile} has static keys in ~/.aws/credentials, and they win over its ${shadowed.map((t) => CREDENTIAL_TYPE_LABEL[t]).join(' and ')}. Remove the keys if they are stale.`);
+    }
+    if (type === 'none') {
+        warnings.push(profile && profile !== 'default'
+            ? `Profile ${profile} (${source}) is not configured in ~/.aws/config or ~/.aws/credentials. Create it with aws configure sso --profile ${profile}, or re-run prism-cli aws connect.`
+            : NO_CREDENTIALS_WARNING);
+    }
+    if (saved && !applied.profileSource)
+        warnings.push(`The saved aws connect profile ${saved.profile} is not used: ${source} is set in the dashboard's environment and wins.`);
+    return {
+        profile, source, credentialType: type, credentialLabel: CREDENTIAL_TYPE_LABEL[type],
+        region: region ? { value: region.region, source: region.source } : null,
+        steps,
+        saved: saved ? {
+            scope: saved.scope, path: tildeHome(saved.path, d.home), profile: saved.profile, region: saved.region, account: saved.account,
+            alias: saved.alias, verifiedAt: saved.verifiedAt, inUse: !!applied.profileSource,
+        } : null,
+        warnings,
+        files: { config: tildeHome(configPath, d.home), credentials: tildeHome(credsPath, d.home), configFound: configText !== null, credentialsFound: credsText !== null },
+    };
+}
+const EXPIRED_RE = /expired|ExpiredToken|InvalidClientTokenId|UnrecognizedClient|RequestExpired|SignatureDoesNotMatch|AuthFailure|Unable to locate credentials|NoCredentialProviders|refresh|sso|credential_process|custom-process/i;
+/** The fixes to suggest for a failed check, by credential type. */
+export function checkFixes(v) {
+    const p = v.profile && v.profile !== 'default' ? ` --profile ${v.profile}` : '';
+    const out = [];
+    if (v.credentialType === 'credential_process')
+        out.push('Sign in again with the tool your credential_process runs, then Check now again');
+    if (v.credentialType === 'sso')
+        out.push(`aws sso login${p}`);
+    if (v.credentialType === 'static-credentials-file' || v.warnings.includes(STATIC_DEFAULT_WARNING))
+        out.push('Remove or rotate the stale static keys in ~/.aws/credentials');
+    if (v.credentialType === 'none')
+        out.push(`aws configure sso${p}`);
+    out.push('prism-cli aws connect');
+    return out;
+}
+/** The default `aws` call for Check now: aws connect's call, with the region optional and a timeout. */
+export const CHECK_NOW_TIMEOUT_MS = 30_000;
+export function checkNowAws(args, profile, region) {
+    return aws(region ? [...args, '--region', region] : args, { profile: profile || undefined, env: { AWS_PAGER: '' }, timeoutMs: CHECK_NOW_TIMEOUT_MS });
+}
+/**
+ * One read-only `sts get-caller-identity`, through aws connect's callerIdentity.
+ * On a match with the saved connection (same profile and region), the saved
+ * file's verifiedAt is refreshed; nothing else is written.
+ */
+export function checkNow(d) {
+    const v = d.identity;
+    // --profile only for a saved aws connect profile; env and the default chain are left to the AWS CLI, as every AWS command does.
+    const profile = d.saved && v.saved?.inUse ? d.saved.profile : '';
+    const region = v.region?.value ?? '';
+    const id = callerIdentity({ aws: d.aws }, profile, region);
+    if ('error' in id) {
+        const error = d.redact(id.error);
+        return { ok: false, expired: EXPIRED_RE.test(error), error, profile: v.profile, region: region || null, fixes: checkFixes(v) };
+    }
+    const s = d.saved;
+    const matches = s ? s.account === id.account : null;
+    let updated = false, note;
+    if (!s)
+        note = 'No saved aws connect connection; nothing was written. Save one with prism-cli aws connect.';
+    else if (!matches)
+        note = `Does not match the saved account ${s.account}. The saved file was not changed; check the profile, then re-run prism-cli aws connect${s.scope === 'repo' ? ' --repo' : ''}.`;
+    else if (s.profile !== v.profile || s.region !== region)
+        note = `Matches the saved account, but the check used ${v.profile ? `profile ${v.profile}` : v.source} in ${region || 'no region'}, not the saved pair; the saved file was not changed.`;
+    else {
+        (d.write ?? writeConnectionFile)(s.path, { profile: s.profile, region: s.region, account: s.account, alias: s.alias, verifiedAt: d.now().toISOString() });
+        updated = true;
+        note = `Matches the saved account; updated the verified time in ${v.saved?.path ?? s.path}.`;
+    }
+    return { ok: true, account: id.account, arn: id.arn, region: region || null, profile: v.profile, savedAccount: s?.account ?? null, matches, updated, note };
+}
+//# sourceMappingURL=aws-identity.js.map