akv-manager 0.1.0 → 0.2.0

package/server.js

@@ -88,23 +88,43 @@ const ARM_RES = 'https://management.azure.com';
 // `az account get-access-token` is the ONLY remaining az call on the hot path —
 // it bridges the existing az login (MFA / conditional access) into a bearer token;
 // everything else below is plain fetch against Azure REST.
-const tokenCache = new Map(); // resource -> { token, exp, pending }
-
-async function getToken(resource) {
-  const c = tokenCache.get(resource);
+const tokenCache = new Map(); // `${tenant}|${resource}` -> { token, exp, pending }
+let selectedSub = null;    // active subscription in single-account mode; scopes tokens to its user+tenant
+let aggregateMode = false; // "All accounts": fan out across every logged-in tenant and merge results
+const subTenant = new Map(); // subscriptionId -> tenantId, populated by azAccountList (for token keying)
+
+// Cache/mint an access token for `resource`, scoped to a subscription's tenant. `sub`
+// picks the tenant (falls back to selectedSub, else the CLI default); tokens are keyed
+// by tenant so subscriptions sharing a tenant reuse one token (fewer slow `az` calls).
+async function getToken(resource, sub) {
+  const scope = sub || selectedSub;                               // subscription id, or null → CLI default
+  const tenant = scope ? (subTenant.get(scope) || scope) : 'default';
+  const key = `${tenant}|${resource}`;
+  const c = tokenCache.get(key);
   if (c && c.token && Date.now() < c.exp) return c.token;
   if (c && c.pending) return c.pending;
   const pending = (async () => {
-    const out = await az(['account', 'get-access-token', '--resource', resource]);
-    tokenCache.set(resource, { token: out.accessToken, exp: Date.now() + 45 * 60 * 1000, pending: null });
+    // Scope the token to a subscription so it carries that subscription's user + tenant.
+    // This is how switching account — and "All accounts" mode, which mints one token per
+    // tenant — works without mutating the CLI's global default (no `az account set`).
+    const args = ['account', 'get-access-token', '--resource', resource];
+    if (scope) args.push('--subscription', scope);
+    const out = await az(args);
+    tokenCache.set(key, { token: out.accessToken, exp: Date.now() + 45 * 60 * 1000, pending: null });
     return out.accessToken;
   })();
-  tokenCache.set(resource, { ...(c || {}), pending });
+  tokenCache.set(key, { ...(c || {}), pending });
   try { return await pending; }
-  catch (e) { tokenCache.delete(resource); throw e; }
+  catch (e) { tokenCache.delete(key); throw e; }
+}
+// Drop a cached token (on 401) for the tenant behind a given subscription.
+function dropToken(resource, sub) {
+  const scope = sub || selectedSub;
+  const tenant = scope ? (subTenant.get(scope) || scope) : 'default';
+  tokenCache.delete(`${tenant}|${resource}`);
 }
-const getVaultToken = () => getToken(VAULT_RES);
-const getArmToken = () => getToken(ARM_RES);
+const getVaultToken = (sub) => getToken(VAULT_RES, sub);
+const getArmToken = (sub) => getToken(ARM_RES, sub);
 
 function decodeJwt(t) {
   try {
@@ -114,8 +134,8 @@ function decodeJwt(t) {
 }
 
 // Azure Resource Manager REST call (management plane).
-async function armFetch(pathOrUrl, { method = 'GET', body, timeout = 40000 } = {}) {
-  const token = await getArmToken();
+async function armFetch(pathOrUrl, { method = 'GET', body, timeout = 40000, sub } = {}) {
+  const token = await getArmToken(sub);
   const url = pathOrUrl.startsWith('http') ? pathOrUrl : `${ARM_RES}${pathOrUrl}`;
   const ctrl = new AbortController();
   const timer = setTimeout(() => ctrl.abort(), timeout);
@@ -130,7 +150,7 @@ async function armFetch(pathOrUrl, { method = 'GET', body, timeout = 40000 } = {
   } catch (e) {
     throw Object.assign(new Error(e.name === 'AbortError' ? 'ARM request timed out' : e.message), { timedOut: e.name === 'AbortError' });
   } finally { clearTimeout(timer); }
-  if (resp.status === 401) { tokenCache.delete(ARM_RES); throw Object.assign(new Error('Token rejected — run az login'), { needLogin: true }); }
+  if (resp.status === 401) { dropToken(ARM_RES, sub); throw Object.assign(new Error('Token rejected — run az login'), { needLogin: true }); }
   if (resp.status === 403) throw Object.assign(new Error('Forbidden'), { forbidden: true });
   if (!resp.ok) throw new Error(`ARM ${resp.status}: ${(await resp.text()).slice(0, 200)}`);
   return resp.json();
@@ -145,7 +165,48 @@ async function listSubscriptions(force) {
   subsCache = { at: Date.now(), data };
   return data;
 }
-let selectedSub = null; // active subscription (server-side context, replaces `az account set`)
+
+// All identities currently logged into the Azure CLI (every `az login`), across all
+// tenants — the tenant-independent master list behind the account switcher. Unlike
+// listSubscriptions (ARM, single tenant), this reads local CLI state, so it still
+// works when the *active* account's token has expired.
+let accountsCache = { at: 0, data: null };
+const ACCOUNTS_TTL = 30 * 1000;
+async function azAccountList(force) {
+  if (!force && accountsCache.data && Date.now() - accountsCache.at < ACCOUNTS_TTL) return accountsCache.data;
+  const out = await az(['account', 'list']);
+  const data = (Array.isArray(out) ? out : []).map((a) => ({
+    id: a.id, name: a.name, state: a.state, tenantId: a.tenantId, isDefault: !!a.isDefault,
+    user: (a.user && a.user.name) || 'unknown', type: (a.user && a.user.type) || 'user',
+  }));
+  accountsCache = { at: Date.now(), data };
+  for (const a of data) subTenant.set(a.id, a.tenantId);   // keep the sub→tenant map warm for token keying
+  return data;
+}
+// The account the console is pointed at: the selected sub, else the CLI default, else the first.
+function pickActiveAccount(accounts) {
+  return accounts.find((a) => a.id === selectedSub) || accounts.find((a) => a.isDefault) || accounts[0] || null;
+}
+// Distinct tenants across the logged-in accounts, each with its subscription ids and a
+// representative sub used to mint that tenant's token. Drives "All accounts" fan-out.
+function tenantsOf(accounts) {
+  const byTenant = new Map();
+  for (const a of accounts) {
+    if (!byTenant.has(a.tenantId)) byTenant.set(a.tenantId, { tenantId: a.tenantId, repSub: a.id, subIds: [], user: a.user });
+    byTenant.get(a.tenantId).subIds.push(a.id);
+  }
+  return [...byTenant.values()];
+}
+// Everything that depends on *which* identity is active. Cleared when the account or
+// aggregate mode changes so the next calls re-auth and re-inventory as the new scope.
+function resetIdentityCaches() {
+  tokenCache.clear();
+  subsCache = { at: 0, data: null };
+  vaultCache = { at: 0, data: null };
+  aksDiscoverCache = { at: 0, data: null };
+  listCache.clear();
+  aksCredCache.clear();
+}
 
 // Tell apart a real permission denial from a Key Vault firewall / network block.
 async function forbiddenError(resp) {
@@ -155,8 +216,16 @@ async function forbiddenError(resp) {
   return Object.assign(new Error(msg), { forbidden: true, firewall });
 }
 
-async function kvFetch(name, pathQuery, { timeout = 15000 } = {}) {
-  const token = await getVaultToken();
+// Which subscription (hence tenant) a vault lives in — lets data-plane calls pick the
+// right token in "All accounts" mode. Reads the cached inventory, so it's a cheap lookup.
+async function vaultSub(name) {
+  try { const m = await findVaultMeta(name); return m ? m.subscriptionId : null; }
+  catch { return null; }
+}
+
+async function kvFetch(name, pathQuery, { timeout = 15000, sub } = {}) {
+  const scope = sub || await vaultSub(name);
+  const token = await getVaultToken(scope);
   const ctrl = new AbortController();
   const timer = setTimeout(() => ctrl.abort(), timeout);
   let resp;
@@ -166,7 +235,7 @@ async function kvFetch(name, pathQuery, { timeout = 15000 } = {}) {
   } catch (e) {
     throw Object.assign(new Error(e.name === 'AbortError' ? 'Vault request timed out' : e.message), { timedOut: e.name === 'AbortError' });
   } finally { clearTimeout(timer); }
-  if (resp.status === 401) { tokenCache.delete(VAULT_RES);
+  if (resp.status === 401) { dropToken(VAULT_RES, scope);
     throw Object.assign(new Error('Token rejected — run az login'), { needLogin: true }); }
   if (resp.status === 403) throw await forbiddenError(resp);
   if (resp.status === 404) throw Object.assign(new Error('Vault or item not found'), { notFound: true });
@@ -218,21 +287,42 @@ async function kvListCached(name, kind) {
 
 // ---- API: accounts & subscriptions ----------------------------------------
 
+// Active identity. Sourced from `az account list` (so it resolves even when the
+// token is expired), then a liveness probe tells the UI whether re-login is needed.
 app.get('/api/account', (req, res) =>
   send(res, (async () => {
-    const claims = decodeJwt(await getArmToken());
-    const subs = await listSubscriptions();
-    if (!selectedSub && subs.length) selectedSub = subs[0].subscriptionId;
-    const cur = subs.find((s) => s.subscriptionId === selectedSub) || subs[0] || {};
+    const accounts = await azAccountList();
+    if (!accounts.length) throw Object.assign(new Error('Azure CLI is signed out — run az login'), { needLogin: true });
+    if (aggregateMode) {
+      const users = new Set(accounts.map((a) => a.user)), tenants = new Set(accounts.map((a) => a.tenantId));
+      return {
+        aggregate: true, user: { name: `All accounts · ${users.size} user${users.size === 1 ? '' : 's'}` },
+        name: `${accounts.length} subscriptions · ${tenants.size} tenant${tenants.size === 1 ? '' : 's'}`,
+        id: '', tenantId: '', live: true, needLogin: false,
+      };
+    }
+    const act = pickActiveAccount(accounts);
+    if (act && !selectedSub) selectedSub = act.id;
+    let live = false, tenantId = (act && act.tenantId) || '';
+    try { const claims = decodeJwt(await getArmToken()); live = true; if (claims.tid) tenantId = claims.tid; }
+    catch { /* token expired / conditional access → surface needLogin but keep identity */ }
     return {
-      user: { name: claims.upn || claims.unique_name || claims.name || claims.email || 'signed in' },
-      name: cur.displayName || '', id: cur.subscriptionId || '',
-      tenantId: claims.tid || cur.tenantId || '',
+      aggregate: false,
+      user: { name: (act && act.user) || 'signed in' },
+      name: (act && act.name) || '', id: (act && act.id) || '',
+      tenantId, live, needLogin: !live,
     };
   })()));
 
 app.get('/api/subscriptions', (req, res) =>
   send(res, (async () => {
+    // In "All accounts" mode a single ARM token only sees one tenant, so list every
+    // logged-in subscription (all tenants) from the CLI instead.
+    if (aggregateMode) {
+      return (await azAccountList(!!req.query.refresh)).map((a) => ({
+        id: a.id, name: a.name, state: a.state, tenantId: a.tenantId, isDefault: false,
+      }));
+    }
     const subs = await listSubscriptions(!!req.query.refresh);
     if (!selectedSub && subs.length) selectedSub = subs[0].subscriptionId;
     return subs.map((s) => ({
@@ -241,24 +331,64 @@ app.get('/api/subscriptions', (req, res) =>
     }));
   })()));
 
+// Every logged-in identity, grouped by user — powers the account switcher. Needs no
+// valid token, so it stays reachable even when the active account has expired.
+app.get('/api/accounts', (req, res) =>
+  send(res, (async () => {
+    const accounts = await azAccountList(!!req.query.refresh);
+    const byUser = new Map();
+    for (const a of accounts) {
+      if (!byUser.has(a.user)) byUser.set(a.user, { user: a.user, type: a.type, subscriptions: [] });
+      byUser.get(a.user).subscriptions.push({
+        id: a.id, name: a.name, state: a.state, tenantId: a.tenantId,
+        cliDefault: a.isDefault, active: a.id === selectedSub,
+      });
+    }
+    return { activeSubscription: selectedSub, aggregate: aggregateMode, users: [...byUser.values()] };
+  })()));
+
+// Point the console at another subscription — which may belong to a different user /
+// tenant. Because tokens are scoped to `selectedSub`, this is exactly what "change
+// user" does: drop the identity-scoped caches so the next calls re-auth as the new
+// identity. Validated against `az account list` so cross-tenant subs are allowed.
 app.post('/api/subscription/set', (req, res) => {
-  const { subscription } = req.body || {};
+  const { subscription, all } = req.body || {};
+  // "All accounts": aggregate across every logged-in tenant (one token per tenant, merged).
+  if (all) {
+    return send(res, (async () => {
+      const accounts = await azAccountList();
+      if (!accounts.length) throw Object.assign(new Error('No logged-in accounts — run az login'), { needLogin: true });
+      aggregateMode = true;
+      selectedSub = null;
+      resetIdentityCaches();
+      const users = new Set(accounts.map((a) => a.user)), tenants = new Set(accounts.map((a) => a.tenantId));
+      return { aggregate: true, user: { name: `All accounts · ${users.size} user${users.size === 1 ? '' : 's'}` },
+        name: `${accounts.length} subscriptions · ${tenants.size} tenant${tenants.size === 1 ? '' : 's'}`,
+        subscriptions: accounts.length, tenants: tenants.size, live: true, needLogin: false };
+    })());
+  }
   if (!subscription || !SUB_RE.test(subscription))
     return res.status(400).json({ ok: false, error: 'Invalid subscription id/name' });
-  // With everything on REST, the "active subscription" is just server state.
   send(res, (async () => {
-    const subs = await listSubscriptions();
-    const cur = subs.find((s) => s.subscriptionId === subscription);
-    if (!cur) throw new Error('Subscription not found');
-    selectedSub = subscription;
-    const claims = decodeJwt(await getArmToken());
-    return { user: { name: claims.upn || claims.unique_name || claims.name || 'signed in' },
-      name: cur.displayName, id: cur.subscriptionId, tenantId: claims.tid || cur.tenantId };
+    const accounts = await azAccountList();
+    const act = accounts.find((a) => a.id === subscription || a.name === subscription);
+    if (!act) throw Object.assign(new Error('Subscription not found among logged-in accounts'), { status: 404 });
+    aggregateMode = false;
+    selectedSub = act.id;
+    resetIdentityCaches();                      // identity changed → drop identity-scoped caches
+    let live = false;
+    try { await getArmToken(); live = true; } catch { /* target account needs re-login */ }
+    return {
+      aggregate: false,
+      user: { name: act.user }, name: act.name, id: act.id, tenantId: act.tenantId,
+      live, needLogin: !live, loginHint: live ? null : `az login --tenant ${act.tenantId}`,
+    };
   })());
 });
 
 app.post('/api/logout', (req, res) => {
-  tokenCache.clear(); subsCache = { at: 0, data: null }; vaultCache = { at: 0, data: null };
+  selectedSub = null; aggregateMode = false;
+  resetIdentityCaches(); accountsCache = { at: 0, data: null }; subTenant.clear();
   send(res, az(['logout'], { json: false }).then(() => ({ loggedOut: true })).catch(() => ({ loggedOut: true })));
 });
 
@@ -272,10 +402,9 @@ const VAULT_QUERY =
   "uri=tostring(properties.vaultUri), tags " +
   "| order by name asc";
 
-async function listVaultsRaw(force) {
-  if (!force && vaultCache.data && Date.now() - vaultCache.at < VAULT_TTL) return vaultCache.data;
-  const subIds = (await listSubscriptions(force)).map((s) => s.subscriptionId);
-  // Resource Graph returns at most 1000 rows per page; follow $skipToken to get them all.
+// One Resource Graph sweep over a set of subscriptions, using `sub`'s tenant token.
+// Resource Graph returns at most 1000 rows per page; follow $skipToken to get them all.
+async function resourceGraphVaults(subIds, sub) {
   const data = [];
   let skipToken;
   for (let page = 0; page < 100; page++) {            // hard stop at 100k vaults — a safety bound
@@ -284,19 +413,47 @@ async function listVaultsRaw(force) {
     const out = await armFetch('/providers/Microsoft.ResourceGraph/resources?api-version=2021-03-01', {
       method: 'POST',
       body: { subscriptions: subIds, query: VAULT_QUERY, options },
+      sub,
     });
     if (out.data) data.push(...out.data);
     skipToken = out.$skipToken;
     if (!skipToken) break;
   }
-  vaultCache = { at: Date.now(), data };
+  return data;
+}
+
+async function listVaultsRaw(force) {
+  if (!force && vaultCache.data && Date.now() - vaultCache.at < VAULT_TTL) return vaultCache.data;
+  const data = [];
+  const warnings = [];   // accounts whose slice failed (e.g. expired) — surfaced as a partial-results note
+  if (aggregateMode) {
+    // "All accounts": one Resource Graph sweep per tenant (each needs its own token),
+    // tag every vault with its owning account, and keep going if one tenant fails.
+    for (const t of tenantsOf(await azAccountList(force))) {
+      try {
+        const rows = await resourceGraphVaults(t.subIds, t.repSub);
+        for (const r of rows) { r.tenantId = t.tenantId; r.account = t.user; }
+        data.push(...rows);
+      } catch (e) {
+        warnings.push({ tenantId: t.tenantId, user: t.user, needLogin: !!e.needLogin,
+          error: (e.stderr || e.message || 'failed').slice(0, 200) });
+      }
+    }
+  } else {
+    const subIds = (await listSubscriptions(force)).map((s) => s.subscriptionId);
+    const rows = await resourceGraphVaults(subIds, selectedSub);
+    const act = pickActiveAccount(await azAccountList().catch(() => [])) || {};
+    for (const r of rows) { r.tenantId = act.tenantId || ''; r.account = act.user || ''; }
+    data.push(...rows);
+  }
+  vaultCache = { at: Date.now(), data, warnings };
   return data;
 }
 
 app.get('/api/vaults', async (req, res) => {
   try {
     const data = await listVaultsRaw(!!req.query.refresh);
-    res.json({ ok: true, data });
+    res.json({ ok: true, data, aggregate: aggregateMode, warnings: (vaultCache.warnings || []) });
   } catch (err) {
     res.status(err.needLogin ? 401 : 500)
        .json({ ok: false, error: err.stderr || err.message, needLogin: !!err.needLogin });
@@ -328,6 +485,25 @@ function tagMatch(pattern, key) {
 }
 function isProtectedTag(key) { return PROTECTED_TAGS.some((p) => tagMatch(p, key)); }
 
+const IPV4_RE = /^(?:25[0-5]|2[0-4]\d|1?\d?\d)(?:\.(?:25[0-5]|2[0-4]\d|1?\d?\d)){3}(?:\/(?:3[0-2]|[12]?\d))?$/;
+function normalizeIpRule(ip) {
+  const s = String(ip || '').trim();
+  if (!IPV4_RE.test(s)) throw Object.assign(new Error('Invalid IPv4 address/range'), { status: 400 });
+  return s.includes('/') ? s : `${s}/32`;
+}
+function ipRuleMatches(ruleValue, targetRule) {
+  const rv = String(ruleValue || '').trim().toLowerCase();
+  const t = String(targetRule || '').trim().toLowerCase();
+  if (!rv || !t) return false;
+  if (rv === t) return true;
+  if (t.endsWith('/32') && rv === t.slice(0, -3)) return true;
+  return false;
+}
+function parseFirewallIp(msg) {
+  const m = /Client address:\s*([0-9]{1,3}(?:\.[0-9]{1,3}){3})/i.exec(String(msg || ''));
+  return m ? m[1] : null;
+}
+
 // Replace a vault's tag set (management plane). The body's `tags` object is the
 // COMPLETE desired set — Key Vault's PATCH overwrites the whole tags collection.
 // Protected/default tags are force-preserved from the current state, so they can be
@@ -356,12 +532,81 @@ app.put('/api/vaults/:name/tags', (req, res) => {
     for (const [k, val] of Object.entries(current)) { if (isProtectedTag(k)) finalTags[k] = val; }
     const url = `/subscriptions/${v.subscriptionId}/resourceGroups/${v.resourceGroup}` +
                 `/providers/Microsoft.KeyVault/vaults/${name}?api-version=2023-07-01`;
-    const out = await armFetch(url, { method: 'PATCH', body: { tags: finalTags } });
+    const out = await armFetch(url, { method: 'PATCH', body: { tags: finalTags }, sub: v.subscriptionId });
     v.tags = (out && out.tags) || finalTags;     // reflect immediately in the cached inventory
     return { tags: v.tags };
   })());
 });
 
+// Allow one IPv4 (or CIDR) through a vault firewall by adding it to networkAcls.ipRules.
+// Requires management-plane write on the vault (e.g. Contributor).
+app.post('/api/vaults/:name/firewall/allow-ip', (req, res) => {
+  const { name } = req.params;
+  if (!isValidName(name)) return res.status(400).json({ ok: false, error: 'Invalid vault name' });
+  send(res, (async () => {
+    const v = await findVaultMeta(name);
+    if (!v) throw Object.assign(new Error('Vault not found in inventory — try Refresh first'), { status: 404, notFound: true });
+
+    let ip = null;
+    try {
+      const bodyIp = req.body && req.body.ip;
+      ip = bodyIp ? String(bodyIp).trim() : null;
+      if (!ip) ip = parseFirewallIp(req.body && req.body.error);
+      ip = normalizeIpRule(ip || '');
+    } catch {
+      throw Object.assign(new Error('Could not determine a valid IP. Provide req.body.ip (IPv4)'), { status: 400 });
+    }
+
+    const url = `/subscriptions/${v.subscriptionId}/resourceGroups/${v.resourceGroup}` +
+                `/providers/Microsoft.KeyVault/vaults/${name}?api-version=2023-07-01`;
+    const cur = await armFetch(url, { sub: v.subscriptionId });
+    const props = cur.properties || {};
+    const acl = props.networkAcls || {};
+    const currentRules = Array.isArray(acl.ipRules) ? acl.ipRules : [];
+    const have = currentRules.some((r) => String((r && r.value) || '').toLowerCase() === ip.toLowerCase());
+    if (!have) {
+      const nextAcls = { ...acl, ipRules: [...currentRules, { value: ip }] };
+      await armFetch(url, { method: 'PATCH', body: { properties: { networkAcls: nextAcls } }, sub: v.subscriptionId });
+    }
+    return { vault: name, ip, alreadyAllowed: have };
+  })());
+});
+
+// Remove one IPv4 (or CIDR) from a vault firewall (networkAcls.ipRules).
+// Requires management-plane write on the vault (e.g. Contributor).
+app.post('/api/vaults/:name/firewall/remove-ip', (req, res) => {
+  const { name } = req.params;
+  if (!isValidName(name)) return res.status(400).json({ ok: false, error: 'Invalid vault name' });
+  send(res, (async () => {
+    const v = await findVaultMeta(name);
+    if (!v) throw Object.assign(new Error('Vault not found in inventory — try Refresh first'), { status: 404, notFound: true });
+
+    let ip;
+    try {
+      const bodyIp = req.body && req.body.ip;
+      ip = bodyIp ? String(bodyIp).trim() : null;
+      if (!ip) ip = parseFirewallIp(req.body && req.body.error);
+      ip = normalizeIpRule(ip || '');
+    } catch {
+      throw Object.assign(new Error('Could not determine a valid IP. Provide req.body.ip (IPv4)'), { status: 400 });
+    }
+
+    const url = `/subscriptions/${v.subscriptionId}/resourceGroups/${v.resourceGroup}` +
+                `/providers/Microsoft.KeyVault/vaults/${name}?api-version=2023-07-01`;
+    const cur = await armFetch(url, { sub: v.subscriptionId });
+    const props = cur.properties || {};
+    const acl = props.networkAcls || {};
+    const currentRules = Array.isArray(acl.ipRules) ? acl.ipRules : [];
+    const nextRules = currentRules.filter((r) => !ipRuleMatches((r && r.value) || '', ip));
+    const removed = nextRules.length !== currentRules.length;
+    if (removed) {
+      const nextAcls = { ...acl, ipRules: nextRules };
+      await armFetch(url, { method: 'PATCH', body: { properties: { networkAcls: nextAcls } }, sub: v.subscriptionId });
+    }
+    return { vault: name, ip, removed };
+  })());
+});
+
 // ---- API: expiring secrets & certificates (scans every readable vault) -----
 
 /** Run async worker over items with bounded concurrency. */
@@ -493,7 +738,8 @@ function buildAttrs(src = {}) {
 }
 
 async function kvWrite(vaultName, method, pathQuery, body) {
-  const token = await getVaultToken();
+  const scope = await vaultSub(vaultName);
+  const token = await getVaultToken(scope);
   const ctrl = new AbortController();
   const timer = setTimeout(() => ctrl.abort(), 20000);
   let resp;
@@ -505,7 +751,7 @@ async function kvWrite(vaultName, method, pathQuery, body) {
   } catch (e) {
     throw Object.assign(new Error(e.name === 'AbortError' ? 'Vault request timed out' : e.message), {});
   } finally { clearTimeout(timer); }
-  if (resp.status === 401) { tokenCache.delete(VAULT_RES); throw Object.assign(new Error('Token rejected — run az login'), { needLogin: true }); }
+  if (resp.status === 401) { dropToken(VAULT_RES, scope); throw Object.assign(new Error('Token rejected — run az login'), { needLogin: true }); }
   if (resp.status === 403) throw await forbiddenError(resp);
   if (resp.status === 404) throw Object.assign(new Error('Vault or item not found'), { notFound: true });
   if (!resp.ok) {
@@ -608,12 +854,23 @@ app.post('/api/batch', async (req, res) => {
 
 const https = require('https');
 const AKS_AAD_SERVER_APP = '6dae42f8-4368-4678-94ff-3960e28e3630'; // Microsoft public constant
-const getAksToken = () => getToken(AKS_AAD_SERVER_APP);
+const getAksToken = (sub) => getToken(AKS_AAD_SERVER_APP, sub);
 const K8S_NAME = /^[a-z0-9]([a-z0-9.-]{0,251}[a-z0-9])?$/; // DNS-1123-ish (namespaces, pods, cms)
 const isK8sName = (v) => typeof v === 'string' && K8S_NAME.test(v);
 
-// Operator-supplied cluster list — NEVER baked in. JSON via AZBO_AKS_CLUSTERS, or a
-// path via AZBO_AKS_CLUSTERS_FILE. Each: { name, resourceGroup, subscription, env?, label? }.
+// Cluster list — NEVER baked in. Two sources, merged: (1) the operator's file/env
+// (AZBO_AKS_CLUSTERS / AZBO_AKS_CLUSTERS_FILE), and (2) a list the user pastes in the
+// UI, persisted in their browser's localStorage and registered with this local server
+// for the session. Each entry: { name, resourceGroup, subscription, env?, label? }.
+const RG_RE = /^[\w.()-]{1,90}$/;
+function clusterValid(c) {
+  return c && isValidName(c.name) && RG_RE.test(c.resourceGroup || '') && SUB_RE.test(c.subscription || '');
+}
+function normalizeClusters(arr, source) {
+  return (Array.isArray(arr) ? arr : []).filter((c) => c && c.name && c.resourceGroup && c.subscription)
+    .map((c) => ({ name: String(c.name), resourceGroup: String(c.resourceGroup), subscription: String(c.subscription),
+      env: c.env ? String(c.env) : '', label: c.label ? String(c.label) : String(c.name), configured: true, source }));
+}
 const AKS_CLUSTERS = (() => {
   let raw = process.env.AZBO_AKS_CLUSTERS;
   if (!raw && process.env.AZBO_AKS_CLUSTERS_FILE) {
@@ -621,13 +878,10 @@ const AKS_CLUSTERS = (() => {
     catch (e) { console.warn('  AZBO_AKS_CLUSTERS_FILE could not be read:', e.message); }
   }
   if (!raw) return [];
-  try {
-    const arr = JSON.parse(raw);
-    return (Array.isArray(arr) ? arr : []).filter((c) => c && c.name && c.resourceGroup && c.subscription)
-      .map((c) => ({ name: c.name, resourceGroup: c.resourceGroup, subscription: c.subscription,
-        env: c.env || '', label: c.label || c.name, configured: true }));
-  } catch { console.warn('  AZBO_AKS_CLUSTERS is not valid JSON — ignoring.'); return []; }
+  try { return normalizeClusters(JSON.parse(raw), 'file'); }
+  catch { console.warn('  AZBO_AKS_CLUSTERS is not valid JSON — ignoring.'); return []; }
 })();
+let SESSION_CLUSTERS = [];   // set by the client via POST /api/aks/clusters (from its localStorage)
 
 async function resolveSubId(nameOrId) {
   if (/^[0-9a-fA-F-]{36}$/.test(nameOrId)) return nameOrId;
@@ -646,14 +900,16 @@ async function aksCredential(c) {
   const url = `/subscriptions/${subId}/resourceGroups/${c.resourceGroup}` +
               `/providers/Microsoft.ContainerService/managedClusters/${c.name}` +
               `/listClusterUserCredential?api-version=2024-05-01`;
-  const out = await armFetch(url, { method: 'POST' });
+  const out = await armFetch(url, { method: 'POST', sub: subId });
   const kc = out.kubeconfigs && out.kubeconfigs[0];
   if (!kc || !kc.value) throw new Error('No kubeconfig returned for this cluster');
   const yaml = Buffer.from(kc.value, 'base64').toString('utf8');
   const server = (yaml.match(/server:\s*(\S+)/) || [])[1];
   const caB64 = (yaml.match(/certificate-authority-data:\s*(\S+)/) || [])[1];
   if (!server) throw new Error('Could not parse API server URL from kubeconfig');
-  const cred = { server: server.replace(/\/+$/, ''),
+  // Carry the cluster's subscription on the cred so k8sGet mints the right tenant's
+  // AKS token — this is what makes cross-tenant clusters work in "All accounts" mode.
+  const cred = { server: server.replace(/\/+$/, ''), sub: subId,
     ca: caB64 ? Buffer.from(caB64, 'base64').toString('utf8') : undefined, at: Date.now() };
   aksCredCache.set(key, cred);
   return cred;
@@ -673,7 +929,7 @@ function imageTag(img) {
 // One GET against a cluster's Kubernetes API. raw=true returns text (for pod logs).
 function k8sGet(cred, pathQuery, { raw = false, timeout = 25000 } = {}) {
   return new Promise((resolve, reject) => {
-    getAksToken().then((token) => {
+    getAksToken(cred.sub).then((token) => {
       const u = new URL(cred.server + pathQuery);
       const req = https.request({
         hostname: u.hostname, port: u.port || 443, path: u.pathname + u.search, method: 'GET',
@@ -685,7 +941,7 @@ function k8sGet(cred, pathQuery, { raw = false, timeout = 25000 } = {}) {
         res.on('data', (c) => { data += c; });
         res.on('end', () => {
           const s = res.statusCode;
-          if (s === 401) { tokenCache.delete(AKS_AAD_SERVER_APP); return reject(Object.assign(new Error('Token rejected — run az login'), { needLogin: true })); }
+          if (s === 401) { dropToken(AKS_AAD_SERVER_APP, cred.sub); return reject(Object.assign(new Error('Token rejected — run az login'), { needLogin: true })); }
           if (s === 403) return reject(Object.assign(new Error(k8sMsg(data) || 'Forbidden'), { forbidden: true }));
           if (s === 404) return reject(Object.assign(new Error(k8sMsg(data) || 'Not found'), { notFound: true }));
           if (s >= 400) return reject(new Error(k8sMsg(data) || `Kubernetes returned ${s}`));
@@ -712,23 +968,40 @@ const AKS_QUERY =
   "| project name, resourceGroup, subscriptionId, " +
   "ver=tostring(properties.kubernetesVersion), " +
   "priv=tostring(properties.apiServerAccessProfile.enablePrivateCluster) | order by name asc";
-async function discoverClusters() {
-  try {
-    const subIds = (await listSubscriptions()).map((s) => s.subscriptionId);
+// Cached so getClusterChecked (called on every pod/log/configmap request) doesn't
+// re-run a Resource Graph query each time. Force-refreshed via ?refresh=1.
+let aksDiscoverCache = { at: 0, data: null };
+const AKS_DISCOVER_TTL = 60 * 1000;
+async function discoverClusters(force) {
+  if (!force && aksDiscoverCache.data && Date.now() - aksDiscoverCache.at < AKS_DISCOVER_TTL) return aksDiscoverCache.data;
+  const query = async (subIds, sub) => {
     const out = await armFetch('/providers/Microsoft.ResourceGraph/resources?api-version=2021-03-01', {
-      method: 'POST', body: { subscriptions: subIds, query: AKS_QUERY, options: { resultFormat: 'objectArray', $top: 1000 } },
+      method: 'POST', body: { subscriptions: subIds, query: AKS_QUERY, options: { resultFormat: 'objectArray', $top: 1000 } }, sub,
     });
     return (out.data || []).map((c) => ({ name: c.name, resourceGroup: c.resourceGroup,
       subscription: c.subscriptionId, version: c.ver, private: c.priv === 'true', configured: false }));
-  } catch { return []; }
+  };
+  try {
+    const data = [];
+    if (aggregateMode) {
+      // one sweep per tenant; skip tenants that fail (e.g. expired) so the rest still list
+      for (const t of tenantsOf(await azAccountList(force))) {
+        try { data.push(...await query(t.subIds, t.repSub)); } catch { /* skip this tenant */ }
+      }
+    } else {
+      data.push(...await query((await listSubscriptions()).map((s) => s.subscriptionId), selectedSub));
+    }
+    aksDiscoverCache = { at: Date.now(), data };
+    return data;
+  } catch { return aksDiscoverCache.data || []; }   // on error, reuse last good result
 }
 
 function clusterById(list, id) { return list.find((c) => c.name === id); }
-async function aksList() {
-  const discovered = await discoverClusters();
+async function aksList(force) {
+  const discovered = await discoverClusters(force);
   const byKey = new Map();
   for (const c of discovered) byKey.set(c.name.toLowerCase(), c);
-  for (const c of AKS_CLUSTERS) {                 // configured entries win + carry their label/env
+  for (const c of [...AKS_CLUSTERS, ...SESSION_CLUSTERS]) {   // configured (file then session) win + carry label/env
     const prev = byKey.get(c.name.toLowerCase()) || {};
     byKey.set(c.name.toLowerCase(), { ...prev, ...c });
   }
@@ -736,7 +1009,23 @@ async function aksList() {
 }
 
 app.get('/api/aks/clusters', (req, res) =>
-  send(res, aksList().then((clusters) => ({ clusters, configured: AKS_CLUSTERS.length }))));
+  send(res, aksList(!!req.query.refresh).then((clusters) => ({ clusters,
+    configured: AKS_CLUSTERS.length + SESSION_CLUSTERS.length, file: AKS_CLUSTERS.length, session: SESSION_CLUSTERS.length }))));
+
+// Register the user's pasted cluster list for this session (from their localStorage).
+// Replaces the previous session list; validated; localhost-only like the rest of the API.
+app.post('/api/aks/clusters', (req, res) => {
+  const { clusters } = req.body || {};
+  if (!Array.isArray(clusters)) return res.status(400).json({ ok: false, error: 'clusters must be a JSON array' });
+  if (clusters.length > 200) return res.status(400).json({ ok: false, error: 'Too many clusters (max 200)' });
+  for (const c of clusters) {
+    if (!c || !c.name || !c.resourceGroup || !c.subscription) return res.status(400).json({ ok: false, error: `Each entry needs name, resourceGroup, subscription (got: ${JSON.stringify(c).slice(0, 60)})` });
+    if (!clusterValid(c)) return res.status(400).json({ ok: false, error: `Invalid cluster entry "${c.name}" — check name / resourceGroup / subscription` });
+  }
+  SESSION_CLUSTERS = normalizeClusters(clusters, 'session');
+  aksCredCache.clear();                              // coordinates may have changed
+  res.json({ ok: true, data: { count: SESSION_CLUSTERS.length } });
+});
 
 // Resolve a :cluster route param to a known cluster, or throw a typed 400/404.
 async function getClusterChecked(name) {
@@ -764,7 +1053,7 @@ app.get('/api/aks/:cluster/pods', (req, res) =>
       const labels = p.metadata.labels || {};
       const build = imageTag((spec[0] || {}).image) || labels['app.kubernetes.io/version'] || labels.version || labels['tags.datadoghq.com/version'] || '';
       return { name: p.metadata.name, namespace: p.metadata.namespace, phase: p.status && p.status.phase, node: p.spec && p.spec.nodeName,
-        build,
+        build, labels,                                    // labels: used client-side to match Service selectors → Ingress
         restarts: cs.reduce((a, x) => a + (x.restartCount || 0), 0),
         ready: `${cs.filter((x) => x.ready).length}/${cs.length || spec.length}`,
         containers: spec.map((x) => x.name), created: p.metadata.creationTimestamp };
@@ -876,6 +1165,67 @@ async function fetchSpc(cred, ns, name) {
   }
   return null;
 }
+// ---- External Secrets helpers (shared by the per-pod trace and the cluster map) -----
+function parseVaultHost(url) { const m = /([a-z0-9][a-z0-9-]{1,22}[a-z0-9])\.vault\.azure\./i.exec(String(url || '')); return m ? m[1].toLowerCase() : null; }
+function akvVaultOf(store) { const a = store && store.spec && store.spec.provider && store.spec.provider.azurekv; return a ? parseVaultHost(a.vaultUrl || a.vaultUri) : null; }
+// GET the first readable API version among candidates; tolerate not-installed (404) / no-access (403).
+async function k8sFirst(cred, paths) {
+  for (const p of paths) { try { return await k8sGet(cred, p); } catch (e) { if (e.notFound || e.forbidden) continue; throw e; } }
+  return null;
+}
+const ES_GROUP = 'external-secrets.io', CSI_GROUP = 'secrets-store.csi.x-k8s.io';
+const esPaths = (suffix) => [`/apis/${ES_GROUP}/v1/${suffix}`, `/apis/${ES_GROUP}/v1beta1/${suffix}`];
+const csiPaths = (suffix) => [`/apis/${CSI_GROUP}/v1/${suffix}`, `/apis/${CSI_GROUP}/v1alpha1/${suffix}`];
+// Resolve a secretStoreRef ({kind,name}) to its azurekv vault short-name (or null).
+async function storeRefVault(cred, ns, ref) {
+  if (!ref || !ref.name) return null;
+  const store = await k8sFirst(cred, ref.kind === 'ClusterSecretStore'
+    ? esPaths(`clustersecretstores/${ref.name}`) : esPaths(`namespaces/${ns}/secretstores/${ref.name}`));
+  return akvVaultOf(store);
+}
+// When listing SecretStores is denied but get-by-name isn't (common on locked-down
+// clusters), try these conventional store names. Override/extend for your naming via
+// AZBO_SECRETSTORE_NAMES (comma-separated).
+const CONVENTIONAL_STORES = (process.env.AZBO_SECRETSTORE_NAMES || 'secretstore-app,secretstore,azure-store,azurekv,azure-kv')
+  .split(',').map((s) => s.trim()).filter(Boolean);
+// Vault short-names a namespace reads from, resolved directly from its External Secrets
+// config (SecretStores + ExternalSecrets) and CSI SecretProviderClasses. Mirrors
+// `kubectl get secretstore -n <ns>`, so it needs only namespaced read. Reports
+// `restricted` when RBAC blocks reading those CRDs (so the UI can say so, not "none").
+// With `deep`, also GETs conventional SecretStore names — works with get-only RBAC.
+async function namespaceVaults(cred, ns, { deep = false } = {}) {
+  const set = new Set();
+  let forbidden = false;
+  const listItems = async (paths) => {
+    for (const p of paths) {
+      try { return (await k8sGet(cred, p)).items || []; }
+      catch (e) { if (e.forbidden) { forbidden = true; return null; } if (e.notFound) continue; throw e; }
+    }
+    return [];
+  };
+  for (const it of (await listItems(esPaths(`namespaces/${ns}/secretstores`)) || [])) { const v = akvVaultOf(it); if (v) set.add(v); }
+  for (const it of (await listItems(esPaths(`namespaces/${ns}/externalsecrets`)) || [])) {
+    const v = await storeRefVault(cred, ns, (it.spec && it.spec.secretStoreRef) || {}); if (v) set.add(v);
+  }
+  for (const it of (await listItems(csiPaths(`namespaces/${ns}/secretproviderclasses`)) || [])) {
+    const params = (it.spec && it.spec.parameters) || {};
+    const kv = params.keyvaultName || params.keyvaultname || params.keyVaultName;
+    if (kv) set.add(String(kv).toLowerCase());
+  }
+  // get-only RBAC fallback: fetch conventional SecretStore names directly by name.
+  if (deep && !set.size) {
+    for (const nm of CONVENTIONAL_STORES) {
+      let store = null, stop = false;
+      for (const p of esPaths(`namespaces/${ns}/secretstores/${nm}`)) {
+        try { store = await k8sGet(cred, p); break; }
+        catch (e) { if (e.forbidden) { forbidden = true; stop = true; break; } if (e.notFound) continue; throw e; }
+      }
+      if (stop) break;
+      const v = akvVaultOf(store); if (v) set.add(v);
+    }
+  }
+  return { vaults: [...set], restricted: forbidden && set.size === 0 };
+}
 
 app.get('/api/aks/:cluster/:ns/pods/:pod/keyvaults', (req, res) => {
   const { ns, pod } = req.params;
@@ -980,8 +1330,100 @@ app.get('/api/aks/:cluster/:ns/pods/:pod/keyvaults', (req, res) => {
       } catch (e) { entry.reason = e.forbidden ? 'needs read on externalsecrets / secretstores' : (e.message || 'unreadable'); }
       externalSecrets.push(entry);
     }
+    // 5) Fallback that mirrors `kubectl get secretstore -n <ns>`: resolve the namespace's
+    //    own External Secrets config directly. Robust when the per-secret owner chain above
+    //    doesn't resolve (e.g. a frontend pod that never mounts the synced Secret).
+    let nsInfo = { vaults: [], restricted: false };
+    try { nsInfo = await namespaceVaults(cred, ns, { deep: true }); } catch { /* namespace CRDs not readable */ }
+    for (const v of nsInfo.vaults) { set.add(v); (srcMap[v] = srcMap[v] || new Set()).add('namespace secretstore'); }
+
     const vaults = [...set].sort().map((name) => ({ name, sources: [...(srcMap[name] || [])] }));
-    return { vaults, configmapsScanned: scanned, spcs, externalSecrets };
+    return { vaults, configmapsScanned: scanned, spcs, externalSecrets, namespaceVaults: nsInfo.vaults, restricted: nsInfo.restricted };
+  })());
+});
+
+// Namespace → Key Vault map for the pod list. Resolves each namespace directly from its
+// own External Secrets config + CSI classes (namespaced reads — so it works with
+// per-namespace RBAC, unlike a cluster-wide list). The client passes ?namespaces= (the
+// namespaces its pods are in) so we only probe what's on screen.
+app.get('/api/aks/:cluster/secret-vaults', (req, res) => {
+  send(res, (async () => {
+    const cred = await aksCredential(await getClusterChecked(req.params.cluster));
+    const nsList = [...new Set(String(req.query.namespaces || '').split(',')
+      .map((s) => s.trim()).filter((s) => isK8sName(s)))].slice(0, 200);   // bound the fan-out
+    const byNamespace = {}, restricted = {};
+    const results = await pool(nsList, async (ns) => [ns, await namespaceVaults(cred, ns)], 8);
+    for (const r of results) {
+      if (!r) continue;
+      const [ns, info] = r;
+      if (info.vaults.length) byNamespace[ns] = info.vaults.sort();
+      else if (info.restricted) restricted[ns] = true;
+    }
+    return { byNamespace, restricted };
+  })());
+});
+
+const ingBackendSvc = (b) => (b && ((b.service && b.service.name) || b.serviceName)) || null;
+const ingBackendPort = (b) => { const s = b && b.service; const p = s && s.port; return (p && (p.name || p.number)) || (b && b.servicePort) || null; };
+// Parse an Ingress into the config worth showing: routes (host/path/backend:port), TLS
+// (secret + cert-manager/ACME), class, and the common nginx annotations (HTTPS redirect,
+// CORS, body size). Keeps only a curated set so the map stays lean.
+function parseIngress(ing) {
+  const a = (ing.metadata && ing.metadata.annotations) || {};
+  const spec = ing.spec || {};
+  const rules = spec.rules || [];
+  const routes = [];
+  for (const r of rules) for (const p of ((r.http && r.http.paths) || []))
+    routes.push({ host: r.host || null, path: p.path || '/', pathType: p.pathType || null, service: ingBackendSvc(p.backend), port: ingBackendPort(p.backend) });
+  const cm = (a['cert-manager.io/common-name'] || a['kubernetes.io/tls-acme'] || a['cert-manager.io/cluster-issuer'] || a['cert-manager.io/issuer'] || a['certmanager.k8s.io/acme-challenge-type']) ? {
+    commonName: a['cert-manager.io/common-name'] || null, tlsAcme: a['kubernetes.io/tls-acme'] || null,
+    issuer: a['cert-manager.io/cluster-issuer'] || a['cert-manager.io/issuer'] || null,
+    challenge: a['certmanager.k8s.io/acme-challenge-type'] || a['cert-manager.io/acme-challenge-type'] || null,
+    dnsProvider: a['certmanager.k8s.io/acme-dns01-provider'] || a['cert-manager.io/acme-dns01-provider'] || null,
+  } : null;
+  const cors = a['nginx.ingress.kubernetes.io/enable-cors'] === 'true' ? {
+    origin: a['nginx.ingress.kubernetes.io/cors-allow-origin'] || null,
+    methods: a['nginx.ingress.kubernetes.io/cors-allow-methods'] || null,
+    headers: a['nginx.ingress.kubernetes.io/cors-allow-headers'] || null,
+  } : null;
+  return {
+    name: ing.metadata && ing.metadata.name,
+    className: spec.ingressClassName || a['kubernetes.io/ingress.class'] || null,
+    hosts: [...new Set(rules.map((r) => r.host).filter(Boolean))],
+    routes,
+    tls: (spec.tls || []).map((t) => ({ hosts: t.hosts || [], secretName: t.secretName || null })),
+    sslRedirect: a['nginx.ingress.kubernetes.io/force-ssl-redirect'] === 'true' || a['nginx.org/redirect-to-https'] === 'true',
+    allowHttp: a['kubernetes.io/ingress.allow-http'] || null,
+    proxyBodySize: a['nginx.ingress.kubernetes.io/proxy-body-size'] || a['nginx.org/client-max-body-size'] || null,
+    cors, certManager: cm,
+    backendServices: [...new Set(routes.map((r) => r.service).filter(Boolean))],
+  };
+}
+
+// Namespace → { Services (name+selector), parsed Ingresses } for the pod list. The client
+// matches each pod's labels to a Service's selector, then to the Ingress(es) routing to it
+// — surfacing host, TLS, class, CORS, redirect and body-size. Namespaced list reads
+// (Services + Ingresses), allowed here even where External Secrets are not.
+app.get('/api/aks/:cluster/ingress-map', (req, res) => {
+  send(res, (async () => {
+    const cred = await aksCredential(await getClusterChecked(req.params.cluster));
+    const nsList = [...new Set(String(req.query.namespaces || '').split(',')
+      .map((s) => s.trim()).filter((s) => isK8sName(s)))].slice(0, 200);
+    const tolerant = async (path) => { try { return ((await k8sGet(cred, path)).items) || []; } catch (e) { if (e.forbidden || e.notFound) return []; throw e; } };
+    const results = await pool(nsList, async (ns) => {
+      const [svcs, ings] = await Promise.all([
+        tolerant(`/api/v1/namespaces/${ns}/services`),
+        tolerant(`/apis/networking.k8s.io/v1/namespaces/${ns}/ingresses`),
+      ]);
+      const services = svcs
+        .filter((s) => s.spec && s.spec.selector && Object.keys(s.spec.selector).length)
+        .map((s) => ({ name: s.metadata.name, selector: s.spec.selector }));
+      const ingresses = ings.map(parseIngress).filter((i) => i.backendServices.length || i.hosts.length);
+      return [ns, { services, ingresses }];
+    }, 8);
+    const byNamespace = {};
+    for (const r of results) if (r && r[1] && (r[1].services.length || r[1].ingresses.length)) byNamespace[r[0]] = r[1];
+    return { byNamespace };
   })());
 });
 
@@ -1012,7 +1454,7 @@ async function bridgeExec(client, params) {
     const c = clusterById(await aksList(), clusterName);
     if (!c) throw new Error('Cluster is not in your configured/visible list');
     cred = await aksCredential(c);
-    token = await getAksToken();
+    token = await getAksToken(cred.sub);
   } catch (e) {
     tell('\r\n\x1b[31m' + (e.network ? 'Cannot reach the cluster — connect to the VPN.' : (e.message || 'auth failed')) + '\x1b[0m\r\n');
     client.close(); return;