@reventlessdev/reventless-spec 3.0.0-alpha.134 → 3.0.0-alpha.135

package/src/types/PrepareAccounts.res

@@ -0,0 +1,119 @@
+/***
+Make a platform's accounts manifest ready to use.
+
+```
+pnpm exec prepare-accounts
+```
+
+Finds `.reventless/users.yaml` — copying the package's committed
+`users.example.yaml` into place when there is none — validates it, and generates a
+password into every field left empty.
+
+🚨 **On the local platform this is the whole of provisioning.** The manifest *is*
+the user store there: the in-memory auth adapter hydrates from it at startup, so
+once every account has a password there is nothing left to create. On AWS the
+accounts still have to be made in a pool, which is `provision-accounts` in
+`reventless-aws`.
+
+Here, rather than as a flag on that command, because it belongs to neither
+platform. A local developer reaching it through an AWS package's binary would be
+the only thing about this half that mentioned AWS at all — and the local platform
+does not depend on `reventless-aws`, so for a project that never deploys it would
+not resolve.
+
+It creates nothing, contacts nothing, and needs no credentials. Re-running is safe:
+a password already in the file is never replaced.
+*/
+
+type args = {
+  file: option<string>,
+  help: bool,
+}
+
+let parseArgs = (argv: array<string>): result<args, string> => {
+  let acc = ref(Ok({file: None, help: false}))
+  let i = ref(0)
+  let count = argv->Array.length
+  while i.contents < count {
+    let flag = argv->Array.getUnsafe(i.contents)
+    let value = argv->Array.get(i.contents + 1)
+    switch (acc.contents, flag, value) {
+    | (Error(_), _, _) => i := count
+    | (Ok(a), "--file", Some(v)) =>
+      acc := Ok({...a, file: Some(v)})
+      i := i.contents + 2
+    | (Ok(a), "--help", _) | (Ok(a), "-h", _) =>
+      acc := Ok({...a, help: true})
+      i := i.contents + 1
+    | (Ok(_), "--file", None) => acc := Error(`${flag} needs a value`)
+    | (Ok(_), unknown, _) => acc := Error(`unknown argument "${unknown}"`)
+    }
+  }
+  acc.contents
+}
+
+let usage = `
+Make a platform's accounts manifest ready to use.
+
+  --file <path>   The manifest. Defaults to .reventless/users.yaml relative to the
+                  working directory, which is where every platform keeps it. A
+                  named path is read, never created.
+
+Copies ${AccountsManifest.templateName} into place when there is no manifest yet,
+then generates a password into every empty field. Creates no accounts and needs no
+credentials — on the local platform that is all provisioning is. A password already
+in the file is never replaced.
+`
+
+/** The cast, as the file now declares it. Printed on a fresh copy because that is
+  the moment somebody should read it: on AWS the next command turns each of these
+  into a real account in a real pool. */
+let castNote = (entries: array<AccountsManifest.entry>): string =>
+  entries
+  ->Array.map(entry =>
+    `  ${entry.username}${entry.groups->Array.length == 0
+        ? ""
+        : `  [${entry.groups->Array.join(", ")}]`}`
+  )
+  ->Array.join("\n")
+
+let run = (): result<unit, string> =>
+  // argv[0] is node, argv[1] this script.
+  switch parseArgs(NodeProcess.argv->Array.slice(~start=2, ~end=NodeProcess.argv->Array.length)) {
+  | Error(_) as e => e
+  | Ok(args) if args.help =>
+    Console.log(usage)
+    Ok()
+  | Ok(args) =>
+    switch AccountsManifest.locate(~given=?args.file, ()) {
+    | Error(_) as e => e
+    | Ok(located) =>
+      let file = located->AccountsManifest.pathOf
+      switch located {
+      | SeededFrom(_, template) => Console.log(`manifest ${file} (new, copied from ${template})`)
+      | Declared(_) => Console.log(`manifest ${file}`)
+      }
+      switch AccountsManifest.prepare(~path=file) {
+      | Error(message) => Error(`${file}: ${message}`)
+      | Ok([]) => Error(`${file} declares no accounts`)
+      | Ok(prepared) =>
+        let generated = prepared->Array.filter(p => p.passwordGenerated)->Array.length
+        Console.log(
+          `accounts ${prepared
+            ->Array.length
+            ->Int.toString} declared, ${generated->Int.toString} password(s) generated\n\n${castNote(
+              prepared->Array.map(p => p.entry),
+            )}`,
+        )
+        Ok()
+      }
+    }
+  }
+
+let main = async () =>
+  switch run() {
+  | Ok() => ()
+  | Error(message) =>
+    Console.error(`prepare-accounts: ${message}`)
+    NodeProcess.exit(1)
+  }

package/src/types/PrepareAccounts.res.mjs

@@ -0,0 +1,148 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as AccountsManifest$Reventless from "./AccountsManifest.res.mjs";
+
+function parseArgs(argv) {
+  let acc = {
+    TAG: "Ok",
+    _0: {
+      file: undefined,
+      help: false
+    }
+  };
+  let i = 0;
+  let count = argv.length;
+  while (i < count) {
+    let flag = argv[i];
+    let value = argv[i + 1 | 0];
+    let match = acc;
+    if (match.TAG === "Ok") {
+      let a = match._0;
+      let exit = 0;
+      switch (flag) {
+        case "--file" :
+          if (value !== undefined) {
+            acc = {
+              TAG: "Ok",
+              _0: {
+                file: value,
+                help: a.help
+              }
+            };
+            i = i + 2 | 0;
+          } else {
+            acc = {
+              TAG: "Error",
+              _0: flag + ` needs a value`
+            };
+          }
+          break;
+        case "--help" :
+        case "-h" :
+          exit = 1;
+          break;
+        default:
+          acc = {
+            TAG: "Error",
+            _0: `unknown argument "` + flag + `"`
+          };
+      }
+      if (exit === 1) {
+        acc = {
+          TAG: "Ok",
+          _0: {
+            file: a.file,
+            help: true
+          }
+        };
+        i = i + 1 | 0;
+      }
+    } else {
+      i = count;
+    }
+  };
+  return acc;
+}
+
+let usage = `
+Make a platform's accounts manifest ready to use.
+
+  --file <path>   The manifest. Defaults to .reventless/users.yaml relative to the
+                  working directory, which is where every platform keeps it. A
+                  named path is read, never created.
+
+Copies ` + AccountsManifest$Reventless.templateName + ` into place when there is no manifest yet,
+then generates a password into every empty field. Creates no accounts and needs no
+credentials — on the local platform that is all provisioning is. A password already
+in the file is never replaced.
+`;
+
+function castNote(entries) {
+  return entries.map(entry => `  ` + entry.username + (
+    entry.groups.length === 0 ? "" : `  [` + entry.groups.join(", ") + `]`
+  )).join("\n");
+}
+
+function run() {
+  let e = parseArgs(process.argv.slice(2, process.argv.length));
+  if (e.TAG !== "Ok") {
+    return e;
+  }
+  let args = e._0;
+  if (args.help) {
+    console.log(usage);
+    return {
+      TAG: "Ok",
+      _0: undefined
+    };
+  }
+  let e$1 = AccountsManifest$Reventless.locate(args.file, undefined);
+  if (e$1.TAG !== "Ok") {
+    return e$1;
+  }
+  let located = e$1._0;
+  let file = AccountsManifest$Reventless.pathOf(located);
+  if (located.TAG === "Declared") {
+    console.log(`manifest ` + file);
+  } else {
+    console.log(`manifest ` + file + ` (new, copied from ` + located._1 + `)`);
+  }
+  let message = AccountsManifest$Reventless.prepare(file);
+  if (message.TAG !== "Ok") {
+    return {
+      TAG: "Error",
+      _0: file + `: ` + message._0
+    };
+  }
+  let prepared = message._0;
+  if (prepared.length === 0) {
+    return {
+      TAG: "Error",
+      _0: file + ` declares no accounts`
+    };
+  }
+  let generated = prepared.filter(p => p.passwordGenerated).length;
+  console.log(`accounts ` + prepared.length.toString() + ` declared, ` + generated.toString() + ` password(s) generated\n\n` + castNote(prepared.map(p => p.entry)));
+  return {
+    TAG: "Ok",
+    _0: undefined
+  };
+}
+
+async function main() {
+  let message = run();
+  if (message.TAG === "Ok") {
+    return;
+  }
+  console.error(`prepare-accounts: ` + message._0);
+  process.exit(1);
+}
+
+export {
+  parseArgs,
+  usage,
+  castNote,
+  run,
+  main,
+}
+/* AccountsManifest-Reventless Not a pure module */

package/src/util/Util_Password.res

@@ -0,0 +1,60 @@
+/***
+A password a Reventless pool will accept, minted rather than chosen.
+
+Here rather than beside the AWS provisioning script because two callers need it
+and only one of them is AWS: `provision-admin` mints the first administrator's
+credential, and [AccountsManifest.prepare] fills a manifest's empty password
+fields on any platform, with no cloud account involved. A generator living in
+`reventless/aws` would make the platform-neutral half reach into the AWS package
+for arithmetic that has nothing to do with AWS.
+*/
+
+/** Excludes the glyphs a person confuses when retyping a printed credential —
+  `l`/`I`/`1` and `O`/`0`. These passwords are read off a terminal or out of a
+  file once, and a bootstrap that fails on a misread character sends the operator
+  back to the console this exists to avoid. */
+let lower = "abcdefghijkmnopqrstuvwxyz"
+let upper = "ABCDEFGHJKLMNPQRSTUVWXYZ"
+let digits = "23456789"
+let alphabet = lower ++ upper ++ digits
+
+/** Comfortably over the 12 every Reventless pool is created with, since nobody
+  has to remember it. */
+let length = 24
+
+/** `count` uniform bytes as ints.
+
+  Via the hex encoding because that is what [NodeCrypto] exposes of a Buffer, and
+  a binding returning raw byte values would be a new one added for this alone.
+  Two hex digits always parse, so the fallback below is unreachable — it is there
+  because the parse is *typed* as partial, not because it can fail. */
+let randomInts = (count: int): array<int> => {
+  let hex = NodeCrypto.randomBytes(count)->NodeCrypto.bufferToString("hex")
+  Array.fromInitializer(~length=count, i =>
+    hex->String.substring(~start=i * 2, ~end=i * 2 + 2)->Int.fromString(~radix=16)->Option.getOr(0)
+  )
+}
+
+let charAt = (source: string, n: int): string =>
+  source->String.charAt(mod(n, source->String.length))
+
+/**
+A password that satisfies the pool policy every Reventless pool is created with
+(12+ characters, with a lowercase, an uppercase and a digit).
+
+Satisfies it *by construction*: the three required classes are written into three
+non-overlapping thirds of the string, so one of each is always present. The
+obvious alternative — generate, test, regenerate — would leave a branch that
+almost never runs and, when it did, would hand Cognito a password it refuses.
+Almost-never is exactly the branch nobody has tested.
+*/
+let generate = (): string => {
+  let ints = randomInts(length + 6)
+  let chars = ints->Array.slice(~start=0, ~end=length)->Array.map(n => alphabet->charAt(n))
+  let third = length / 3
+  [lower, upper, digits]->Array.forEachWithIndex((classAlphabet, block) => {
+    let position = block * third + mod(ints->Array.getUnsafe(length + block), third)
+    chars->Array.set(position, classAlphabet->charAt(ints->Array.getUnsafe(length + 3 + block)))
+  })
+  chars->Array.join("")
+}

package/src/util/Util_Password.res.mjs

@@ -0,0 +1,53 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_Int from "@rescript/runtime/lib/es6/Stdlib_Int.js";
+import * as Nodecrypto from "node:crypto";
+import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
+import * as Primitive_int from "@rescript/runtime/lib/es6/Primitive_int.js";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+
+let lower = "abcdefghijkmnopqrstuvwxyz";
+
+let upper = "ABCDEFGHJKLMNPQRSTUVWXYZ";
+
+let digits = "23456789";
+
+let alphabet = lower + upper + digits;
+
+function randomInts(count) {
+  let hex = Nodecrypto.randomBytes(count).toString("hex");
+  return Stdlib_Array.fromInitializer(count, i => Stdlib_Option.getOr(Stdlib_Int.fromString(hex.substring((i << 1), (i << 1) + 2 | 0), 16), 0));
+}
+
+function charAt(source, n) {
+  return source.charAt(Primitive_int.mod_(n, source.length));
+}
+
+function generate() {
+  let ints = randomInts(30);
+  let chars = ints.slice(0, 24).map(n => charAt(alphabet, n));
+  let third = 8;
+  [
+    lower,
+    upper,
+    digits
+  ].forEach((classAlphabet, block) => {
+    let position = (block * third | 0) + Primitive_int.mod_(ints[24 + block | 0], third) | 0;
+    chars[position] = charAt(classAlphabet, ints[27 + block | 0]);
+  });
+  return chars.join("");
+}
+
+let length = 24;
+
+export {
+  lower,
+  upper,
+  digits,
+  alphabet,
+  length,
+  randomInts,
+  charAt,
+  generate,
+}
+/* node:crypto Not a pure module */