akv-manager 0.0.3 → 0.0.5

package/public/styles.css

@@ -240,10 +240,130 @@
             border-radius:999px;margin:16px auto 0;overflow:hidden}
   .progress .bar{height:100%;background:linear-gradient(90deg,var(--azure),var(--ok));border-radius:999px;transition:width .4s}
 
+  /* ---------- sidebar: pinned / recent + account switcher ---------- */
+  .navpins{display:flex;flex-direction:column;gap:1px;margin:2px 0 4px}
+  .navpin{display:flex;align-items:center;gap:8px;width:100%;text-align:left;background:transparent;border:0;
+          color:var(--muted);padding:6px 11px;border-radius:var(--r-sm);cursor:pointer;font-family:var(--mono);
+          font-size:11.5px;transition:.12s;overflow:hidden}
+  .navpin:hover{background:rgba(255,255,255,.03);color:var(--text)}
+  .navpin.active{background:var(--azuredim);color:#fff}
+  .navpin .pn{flex:1;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
+  .navpin .star{color:var(--warn);font-size:10px;flex:none}
+  .navpin .env-dot{width:6px;height:6px;border-radius:50%;flex:none}
+  .navempty{font-family:var(--mono);font-size:10.5px;color:var(--faint);padding:4px 12px}
+  .acct{margin-top:auto;border-top:1px solid var(--line2);padding-top:10px}
+  .acctbtn{display:flex;align-items:center;gap:9px;width:100%;text-align:left;background:transparent;border:0;
+           color:var(--muted);padding:8px;border-radius:var(--r-sm);cursor:pointer;font-size:12px;transition:.12s;line-height:1.5}
+  .acctbtn:hover{background:rgba(255,255,255,.03)}
+  .acctbtn b{color:var(--text);font-weight:600}
+  .acctbtn .chev{margin-left:auto;color:var(--faint);flex:none}
+
+  /* ---------- command palette (⌘K) ---------- */
+  .cmdk-ov{position:fixed;inset:0;background:rgba(5,8,14,.55);backdrop-filter:blur(3px);opacity:0;
+           pointer-events:none;transition:.14s;z-index:70;display:flex;align-items:flex-start;justify-content:center;padding-top:12vh}
+  .cmdk-ov.show{opacity:1;pointer-events:auto}
+  .cmdk{width:min(640px,92vw);background:var(--panel);border:1px solid var(--line);border-radius:14px;
+        box-shadow:0 40px 90px -30px rgba(0,0,0,.85);overflow:hidden;transform:translateY(-8px);transition:.16s}
+  .cmdk-ov.show .cmdk{transform:translateY(0)}
+  .cmdk-in{display:flex;align-items:center;gap:11px;padding:15px 18px;border-bottom:1px solid var(--line)}
+  .cmdk-in svg{width:17px;height:17px;color:var(--faint);flex:none}
+  .cmdk-in input{flex:1;background:transparent;border:0;outline:0;color:var(--text);font-family:var(--sans);font-size:15px}
+  .cmdk-in input::placeholder{color:var(--faint)}
+  .cmdk-in kbd{font-family:var(--mono);font-size:10px;color:var(--faint);border:1px solid var(--line);border-radius:5px;padding:2px 6px}
+  .cmdk-list{max-height:54vh;overflow:auto;padding:7px}
+  .cmdk-sec{font-family:var(--mono);font-size:9.5px;letter-spacing:.16em;text-transform:uppercase;color:var(--faint);padding:9px 11px 5px}
+  .cmdk-it{display:flex;align-items:center;gap:11px;padding:9px 11px;border-radius:8px;cursor:pointer}
+  .cmdk-it .ico{width:16px;height:16px;color:var(--muted);flex:none}
+  .cmdk-it .lbl{flex:1;overflow:hidden;text-overflow:ellipsis;white-space:nowrap;font-size:13.5px}
+  .cmdk-it .lbl small{color:var(--faint);font-family:var(--mono);font-size:11px;margin-left:8px}
+  .cmdk-it .hint{font-family:var(--mono);font-size:10px;color:var(--faint)}
+  .cmdk-it.cur{background:var(--azuredim)}
+  .cmdk-it.cur .ico{color:var(--azure)}
+  .cmdk-empty{padding:26px;text-align:center;color:var(--muted);font-size:13px}
+
+  /* ---------- dashboard ---------- */
+  .actcards{display:grid;grid-template-columns:repeat(auto-fill,minmax(210px,1fr));gap:13px;margin-bottom:26px}
+  .actcard{display:block;text-align:left;background:linear-gradient(180deg,var(--panel),var(--panel2));
+           border:1px solid var(--line);border-radius:var(--r);padding:16px 17px;cursor:pointer;position:relative;
+           overflow:hidden;transition:.15s;font-family:inherit}
+  .actcard::after{content:"";position:absolute;inset:0 0 auto;height:2px;background:var(--line)}
+  .actcard:hover{border-color:var(--azure);transform:translateY(-1px)}
+  .actcard .k{display:flex;align-items:center;gap:8px;font-family:var(--mono);color:var(--muted);font-size:10.5px;
+              text-transform:uppercase;letter-spacing:.12em}
+  .actcard .k svg{width:14px;height:14px}
+  .actcard .v{font-family:var(--mono);font-size:32px;font-weight:600;margin-top:11px;line-height:1;letter-spacing:-.02em}
+  .actcard .sub{font-family:var(--sans);font-size:12px;color:var(--muted);margin-top:6px}
+  .actcard.sev-alert::after{background:var(--alert)} .actcard.sev-alert .v{color:#FF8893}
+  .actcard.sev-warn::after{background:var(--warn)} .actcard.sev-warn .v{color:#FBC56B}
+  .actcard.sev-azure::after{background:var(--azure)} .actcard.sev-azure .v{color:#8FBEFF}
+  .actcard.sev-ok::after{background:var(--ok)} .actcard.sev-ok .v{color:#7FE0C8}
+  .dashgrid{display:grid;grid-template-columns:1fr 1fr;gap:22px;align-items:start}
+  @media (max-width:1100px){.dashgrid{grid-template-columns:1fr}}
+  .secthead2{display:flex;align-items:center;justify-content:space-between;margin:0 0 12px}
+  .secthead2 .eyebrow{font-size:11px}
+  .vtiles{display:flex;flex-direction:column;gap:7px}
+  .vtile{display:flex;align-items:center;gap:11px;background:var(--panel);border:1px solid var(--line);
+         border-radius:10px;padding:11px 13px;cursor:pointer;transition:.13s}
+  .vtile:hover{border-color:var(--azure);background:var(--raise)}
+  .vtile .star{color:var(--warn);font-size:12px;flex:none;background:none;border:0;cursor:pointer;padding:0}
+  .vtile .star.off{color:var(--faint)}
+  .vtile .nm{flex:1;font-family:var(--mono);font-size:12.5px;font-weight:600;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
+  .vtile .rg{font-family:var(--mono);font-size:11px;color:var(--faint);overflow:hidden;text-overflow:ellipsis;white-space:nowrap;max-width:40%}
+
+  /* ---------- facets (tag filtering) ---------- */
+  .facets{display:flex;gap:10px;flex-wrap:wrap;align-items:center;margin-bottom:14px}
+  .facet{display:flex;align-items:center;gap:6px}
+  .facet label{font-family:var(--mono);font-size:10px;letter-spacing:.1em;text-transform:uppercase;color:var(--faint)}
+  select.facetsel{font-family:var(--mono);font-size:12px;background:var(--panel2);border:1px solid var(--line);
+                  color:var(--text);border-radius:7px;padding:6px 9px;cursor:pointer;color-scheme:dark;max-width:200px}
+  select.facetsel:focus{outline:none;border-color:var(--azure)}
+  select.facetsel.on{border-color:var(--azure);color:#fff}
+  .facetclear{font-family:var(--mono);font-size:11px;color:var(--azure);background:none;border:0;cursor:pointer}
+
+  /* ---------- tag chips + editor ---------- */
+  .tagchips{display:flex;gap:5px;flex-wrap:wrap}
+  .tagchip{font-family:var(--mono);font-size:10px;color:var(--muted);background:rgba(255,255,255,.04);
+           border:1px solid var(--line);border-radius:5px;padding:1px 7px;white-space:nowrap}
+  .tagchip b{color:var(--text);font-weight:500}
+  .tagedit{display:flex;flex-direction:column;gap:9px;max-width:680px}
+  .tagrow{display:flex;align-items:center;gap:9px}
+  .tagrow input{font-family:var(--mono);font-size:12px;background:var(--ink);border:1px solid var(--line);
+                color:var(--text);border-radius:6px;padding:8px 10px;color-scheme:dark}
+  .tagrow .tk{width:230px;flex:none} .tagrow .tv{flex:1}
+  .tagrow .del{flex:none}
+  .tagrow.fixed input{opacity:.6}
+
+  /* ---------- routed vault page ---------- */
+  .vhead{margin-bottom:18px}
+  .crumb{display:flex;align-items:center;gap:9px;flex-wrap:wrap;margin-bottom:6px}
+  .crumb a{font-family:var(--mono);font-size:12px;color:var(--muted)}
+  .crumb a:hover{color:var(--text)}
+  .crumb .sep{color:var(--faint)}
+  .crumb .here{font-family:var(--mono);font-size:16px;font-weight:600;color:var(--text);word-break:break-all}
+  .star{background:none;border:0;cursor:pointer;color:var(--faint);font-size:16px;padding:0 2px;line-height:1}
+  .star.on{color:var(--warn)}
+  .vmeta{display:flex;align-items:center;gap:9px;flex-wrap:wrap;font-family:var(--mono);font-size:11.5px;color:var(--muted)}
+  .vmeta .mono{word-break:break-all}
+  .tabs{display:flex;gap:2px;border-bottom:1px solid var(--line);margin-bottom:16px}
+  .tabs button{font-family:var(--sans);font-size:13px;font-weight:500;background:transparent;border:0;
+               color:var(--muted);padding:10px 15px;cursor:pointer;position:relative;transition:.12s}
+  .tabs button:hover{color:var(--text)}
+  .tabs button.active{color:#fff}
+  .tabs button.active::after{content:"";position:absolute;left:0;right:0;bottom:-1px;height:2px;background:var(--azure)}
+  .tabs button .c{font-family:var(--mono);font-size:10.5px;color:var(--faint);margin-left:6px}
+  .vtools{display:flex;flex-direction:column;gap:10px;margin-bottom:6px}
+  .vtools-row{display:flex;align-items:center;gap:12px;flex-wrap:wrap}
+  .vtools-row .search{flex:1;min-width:0}
+  .vtools-actions{margin-left:auto;display:flex;gap:7px}
+  .stick{position:sticky;top:0;z-index:5}
+  .itemwrap{margin-top:8px}
+
   @media (max-width:900px){
     /* .app grid + main padding handled by Tailwind max-[900px]: utilities */
     aside{position:static;height:auto;flex-direction:row;flex-wrap:wrap;align-items:center}
     aside nav{display:flex;gap:4px;flex-wrap:wrap} .navlabel{display:none} .who{display:none}
+    .navpins,.acct{display:none}
     input.search{min-width:180px}
+    .dashgrid{grid-template-columns:1fr}
   }
   @media (prefers-reduced-motion:reduce){*{animation-duration:.01ms!important;transition:none!important}}

package/server.js

@@ -268,16 +268,26 @@ const VAULT_QUERY =
   "| project name, resourceGroup, subscriptionId, location, " +
   "sku=tostring(properties.sku.name), " +
   "enableRbac=tostring(properties.enableRbacAuthorization), " +
-  "uri=tostring(properties.vaultUri) | order by name asc";
+  "uri=tostring(properties.vaultUri), tags " +
+  "| order by name asc";
 
 async function listVaultsRaw(force) {
   if (!force && vaultCache.data && Date.now() - vaultCache.at < VAULT_TTL) return vaultCache.data;
   const subIds = (await listSubscriptions(force)).map((s) => s.subscriptionId);
-  const out = await armFetch('/providers/Microsoft.ResourceGraph/resources?api-version=2021-03-01', {
-    method: 'POST',
-    body: { subscriptions: subIds, query: VAULT_QUERY, options: { resultFormat: 'objectArray', $top: 1000 } },
-  });
-  const data = out.data || [];
+  // Resource Graph returns at most 1000 rows per page; follow $skipToken to get them all.
+  const data = [];
+  let skipToken;
+  for (let page = 0; page < 100; page++) {            // hard stop at 100k vaults — a safety bound
+    const options = { resultFormat: 'objectArray', $top: 1000 };
+    if (skipToken) options.$skipToken = skipToken;
+    const out = await armFetch('/providers/Microsoft.ResourceGraph/resources?api-version=2021-03-01', {
+      method: 'POST',
+      body: { subscriptions: subIds, query: VAULT_QUERY, options },
+    });
+    if (out.data) data.push(...out.data);
+    skipToken = out.$skipToken;
+    if (!skipToken) break;
+  }
   vaultCache = { at: Date.now(), data };
   return data;
 }
@@ -292,6 +302,65 @@ app.get('/api/vaults', async (req, res) => {
   }
 });
 
+// Find a vault's management-plane coordinates (sub + rg) from the cached inventory.
+async function findVaultMeta(name) {
+  const vaults = await listVaultsRaw();
+  return vaults.find((v) => (v.name || '').toLowerCase() === name.toLowerCase());
+}
+
+// "Default" / governance tags that this tool must never edit or remove — they are
+// applied by Azure Policy / automation and are read-only here. Patterns are matched
+// case-insensitively; a trailing '*' is a prefix wildcard (e.g. "automation.*").
+// Operators can override the whole list with AZBO_PROTECTED_TAGS (comma-separated);
+// set it to an empty string to disable protection entirely.
+const PROTECTED_TAGS = (() => {
+  const def = ['env', 'environment', 'cost-center', 'costcenter', 'contact-*', 'owner',
+    'solution', 'location', 'roles', 'managed-by', 'managedby',
+    'expirationdate', 'runninginterval', 'automation.*', 'hidden-*'];
+  const raw = process.env.AZBO_PROTECTED_TAGS;
+  if (raw === undefined) return def;
+  return raw.split(',').map((s) => s.trim()).filter(Boolean);
+})();
+function tagMatch(pattern, key) {
+  const p = pattern.toLowerCase(), k = String(key).toLowerCase();
+  return p.endsWith('*') ? k.startsWith(p.slice(0, -1)) : k === p;
+}
+function isProtectedTag(key) { return PROTECTED_TAGS.some((p) => tagMatch(p, key)); }
+
+// Replace a vault's tag set (management plane). The body's `tags` object is the
+// COMPLETE desired set — Key Vault's PATCH overwrites the whole tags collection.
+// Protected/default tags are force-preserved from the current state, so they can be
+// neither edited nor removed regardless of what the client sends.
+// Requires management-plane write (e.g. Contributor / Tag Contributor) on the vault.
+app.put('/api/vaults/:name/tags', (req, res) => {
+  const { name } = req.params;
+  if (!isValidName(name)) return res.status(400).json({ ok: false, error: 'Invalid vault name' });
+  const { tags } = req.body || {};
+  if (!tags || typeof tags !== 'object' || Array.isArray(tags))
+    return res.status(400).json({ ok: false, error: 'tags must be an object of name → value' });
+  const entries = Object.entries(tags);
+  if (entries.length > 50) return res.status(400).json({ ok: false, error: 'Azure allows at most 50 tags per resource' });
+  for (const [k, v] of entries) {
+    if (typeof k !== 'string' || !k.length || k.length > 512) return res.status(400).json({ ok: false, error: `Invalid tag name: ${k}` });
+    if (typeof v !== 'string' || v.length > 256) return res.status(400).json({ ok: false, error: `Invalid value for tag "${k}" (max 256 chars)` });
+  }
+  send(res, (async () => {
+    const v = await findVaultMeta(name);
+    if (!v) throw new Error('Vault not found in inventory — try Refresh first');
+    const current = v.tags || {};
+    // Start from the client's desired set, then force every protected tag that exists
+    // today back to its original value — this blocks edit AND removal of default tags.
+    const finalTags = {};
+    for (const [k, val] of entries) { if (!isProtectedTag(k)) finalTags[k] = val; }
+    for (const [k, val] of Object.entries(current)) { if (isProtectedTag(k)) finalTags[k] = val; }
+    const url = `/subscriptions/${v.subscriptionId}/resourceGroups/${v.resourceGroup}` +
+                `/providers/Microsoft.KeyVault/vaults/${name}?api-version=2023-07-01`;
+    const out = await armFetch(url, { method: 'PATCH', body: { tags: finalTags } });
+    v.tags = (out && out.tags) || finalTags;     // reflect immediately in the cached inventory
+    return { tags: v.tags };
+  })());
+});
+
 // ---- API: expiring secrets & certificates (scans every readable vault) -----
 
 /** Run async worker over items with bounded concurrency. */
@@ -475,6 +544,15 @@ app.patch('/api/vaults/:name/certificates/:cert', (req, res) => {
   send(res, kvWrite(name, 'PATCH', `/certificates/${cert}?api-version=${KV_API}`, { attributes: attrs }));
 });
 
+// Turn a write failure into a precise, actionable reason. A 403 from Key Vault is
+// either a network/firewall block (fix: VPN) or a real data-plane permission gap
+// (fix: grant Set on secrets) — never conflate the two as a bare "forbidden".
+function writeReason(e) {
+  if (e.firewall) return 'blocked by the vault firewall — your IP is not allowed (connect to the corporate VPN)';
+  if (e.forbidden) return 'no write permission — your identity can read but not Set secrets on this vault';
+  return e.message || 'failed';
+}
+
 // Create one or many secrets in a vault. items: [{name, value}], optional common expires.
 app.post('/api/vaults/:name/secrets-create', async (req, res) => {
   const { name } = req.params;
@@ -492,7 +570,7 @@ app.post('/api/vaults/:name/secrets-create', async (req, res) => {
       if (Object.keys(attrs).length) body.attributes = attrs;
       await kvWrite(name, 'PUT', `/secrets/${it.name}?api-version=${KV_API}`, body);
       return { ...r, ok: true };
-    } catch (e) { return { ...r, ok: false, error: e.forbidden ? 'forbidden' : (e.message || 'failed') }; }
+    } catch (e) { return { ...r, ok: false, error: writeReason(e), firewall: !!e.firewall, forbidden: !!e.forbidden }; }
   }, 10);
   res.json({ ok: true, results });
 });
@@ -517,7 +595,7 @@ app.post('/api/batch', async (req, res) => {
         await kvWrite(it.vault, 'PATCH', `/secrets/${it.name}?api-version=${KV_API}`, { attributes: attrs });
       }
       return { ...r, ok: true };
-    } catch (e) { return { ...r, ok: false, error: e.forbidden ? 'forbidden' : (e.message || 'failed') }; }
+    } catch (e) { return { ...r, ok: false, error: writeReason(e), firewall: !!e.firewall, forbidden: !!e.forbidden }; }
   }, 12);
   res.json({ ok: true, results });
 });
@@ -534,7 +612,8 @@ const ENV_RULES = (() => {
 })();
 const PKG_VERSION = (() => { try { return require('./package.json').version; } catch { return null; } })();
 app.get('/api/config', (req, res) =>
-  res.json({ ok: true, data: { envRules: ENV_RULES, title: process.env.AZBO_TITLE || null, version: PKG_VERSION } }));
+  res.json({ ok: true, data: { envRules: ENV_RULES, title: process.env.AZBO_TITLE || null,
+    version: PKG_VERSION, protectedTags: PROTECTED_TAGS } }));
 
 function openBrowser(url) {
   if (process.env.AZBO_NO_OPEN) return;