az2aws 1.6.2 → 1.8.0

package/lib/login.js

@@ -20,6 +20,8 @@ const promises_2 = __importDefault(require("fs/promises"));
 const https_1 = require("https");
 const node_http_handler_1 = require("@smithy/node-http-handler");
 const loginStates_1 = require("./loginStates");
+const sessionDuration_1 = require("./sessionDuration");
+const sensitiveOutput_1 = require("./sensitiveOutput");
 const debug = (0, debug_1.default)("az2aws");
 const WIDTH = 425;
 const HEIGHT = 550;
@@ -30,6 +32,7 @@ const AZURE_AD_SSO = "autologon.microsoftazuread-sso.com";
 const AWS_SAML_ENDPOINT = "https://signin.aws.amazon.com/saml";
 const AWS_CN_SAML_ENDPOINT = "https://signin.amazonaws.cn/saml";
 const AWS_GOV_SAML_ENDPOINT = "https://signin.amazonaws-us-gov.com/saml";
+const REDACTED = "[redacted]";
 // Keep the runtime import as native `import()` so CommonJS output can load
 // the ESM-only https-proxy-agent package.
 // eslint-disable-next-line @typescript-eslint/no-implied-eval
@@ -38,51 +41,85 @@ const getProxyUrl = () => process.env.https_proxy ||
     process.env.HTTPS_PROXY ||
     process.env.http_proxy ||
     process.env.HTTP_PROXY;
+function printCredentialsReadyMessage(profileName, credentials) {
+    console.log();
+    console.log(`Credentials expire at ${credentials.aws_expiration}.`);
+    console.log(`Use them with AWS CLI by passing --profile "${profileName}".`);
+}
+function handleBackgroundPromise(promise, description) {
+    void promise.catch((error) => {
+        const message = (0, sensitiveOutput_1.formatDebugErrorMessage)(error);
+        debug(`${description}: ${message}`);
+    });
+}
 exports.login = {
     async _createHttpsProxyAgentAsync(proxyUrl, proxyOptions) {
         const { HttpsProxyAgent } = await importHttpsProxyAgent();
         return new HttpsProxyAgent(proxyUrl, proxyOptions);
     },
-    async loginAsync(profileName, mode, disableSandbox, noPrompt, enableChromeNetworkService, awsNoVerifySsl, enableChromeSeamlessSso, noDisableExtensions, disableGpu, incognito = false) {
-        let headless, cliProxy;
-        if (mode === "cli") {
-            headless = true;
-            cliProxy = true;
-        }
-        else if (mode === "gui") {
-            headless = false;
-            cliProxy = false;
-        }
-        else if (mode === "debug") {
-            headless = false;
-            cliProxy = true;
-        }
-        else {
-            throw new CLIError_1.CLIError("Invalid mode");
-        }
-        const profile = await this._loadProfileAsync(profileName);
-        console.log(`Using AWS region ${profile.region || "(from AWS SDK defaults)"}`);
-        if (profile.region && profile.region.startsWith("us-gov")) {
-            console.warn("GovCloud region detected in profile. Note: Other AWS CLI operations " +
-                "will use your AWS CLI default region. If needed, set it to match " +
-                "this GovCloud region (us-gov-west-1 or us-gov-east-1).");
-        }
-        let assertionConsumerServiceURL = AWS_SAML_ENDPOINT;
-        if (profile.region && profile.region.startsWith("us-gov")) {
-            assertionConsumerServiceURL = AWS_GOV_SAML_ENDPOINT;
+    async loginAsync(profileName, mode, disableSandbox, noPrompt, enableChromeNetworkService, awsNoVerifySsl, enableChromeSeamlessSso, noDisableExtensions, disableGpu, incognito = false, credentialProcess = false) {
+        const originalConsoleLog = console.log;
+        const effectiveNoPrompt = credentialProcess ? true : noPrompt;
+        try {
+            if (credentialProcess) {
+                console.log = (...args) => console.error(...args);
+            }
+            let headless, cliProxy;
+            if (mode === "cli") {
+                headless = true;
+                cliProxy = true;
+            }
+            else if (mode === "gui") {
+                headless = false;
+                cliProxy = false;
+            }
+            else if (mode === "debug") {
+                headless = false;
+                cliProxy = true;
+            }
+            else {
+                throw new CLIError_1.CLIError("Invalid mode");
+            }
+            const profile = await this._loadProfileAsync(profileName);
+            console.log(`Using AWS region ${profile.region || "(from AWS SDK defaults)"}`);
+            if (profile.region && profile.region.startsWith("us-gov")) {
+                console.warn("GovCloud region detected in profile. Note: Other AWS CLI operations " +
+                    "will use your AWS CLI default region. If needed, set it to match " +
+                    "this GovCloud region (us-gov-west-1 or us-gov-east-1).");
+            }
+            let assertionConsumerServiceURL = AWS_SAML_ENDPOINT;
+            if (profile.region && profile.region.startsWith("us-gov")) {
+                assertionConsumerServiceURL = AWS_GOV_SAML_ENDPOINT;
+            }
+            if (profile.region && profile.region.startsWith("cn-")) {
+                assertionConsumerServiceURL = AWS_CN_SAML_ENDPOINT;
+            }
+            console.log("Using AWS SAML endpoint", assertionConsumerServiceURL);
+            const loginUrl = await this._createLoginUrlAsync(profile.azure_app_id_uri, profile.azure_tenant_id, assertionConsumerServiceURL);
+            const allowSensitiveOutput = (0, sensitiveOutput_1.shouldAllowSensitiveOutput)();
+            const samlResponse = await this._performLoginAsync(loginUrl, headless, disableSandbox, cliProxy, effectiveNoPrompt, enableChromeNetworkService, profile.azure_default_username, profile.azure_default_password, enableChromeSeamlessSso, profile.azure_default_remember_me, noDisableExtensions, disableGpu, incognito, allowSensitiveOutput);
+            const roles = this._parseRolesFromSamlResponse(samlResponse);
+            const { role, durationHours } = await this._askUserForRoleAndDurationAsync(roles, effectiveNoPrompt, profile.azure_default_role_arn, profile.azure_default_duration_hours, credentialProcess ? "--credential-process" : "--no-prompt");
+            const credentials = await this._assumeRoleAsync(profileName, samlResponse, role, durationHours, awsNoVerifySsl, profile.region, !credentialProcess);
+            if (credentialProcess) {
+                if (!credentials) {
+                    throw new CLIError_1.CLIError("Unable to retrieve credentials.");
+                }
+                originalConsoleLog(JSON.stringify({
+                    Version: 1,
+                    AccessKeyId: credentials.aws_access_key_id,
+                    SecretAccessKey: credentials.aws_secret_access_key,
+                    SessionToken: credentials.aws_session_token,
+                    Expiration: credentials.aws_expiration,
+                }));
+            }
         }
-        if (profile.region && profile.region.startsWith("cn-")) {
-            assertionConsumerServiceURL = AWS_CN_SAML_ENDPOINT;
+        finally {
+            console.log = originalConsoleLog;
         }
-        console.log("Using AWS SAML endpoint", assertionConsumerServiceURL);
-        const loginUrl = await this._createLoginUrlAsync(profile.azure_app_id_uri, profile.azure_tenant_id, assertionConsumerServiceURL);
-        const samlResponse = await this._performLoginAsync(loginUrl, headless, disableSandbox, cliProxy, noPrompt, enableChromeNetworkService, profile.azure_default_username, profile.azure_default_password, enableChromeSeamlessSso, profile.azure_default_remember_me, noDisableExtensions, disableGpu, incognito);
-        const roles = this._parseRolesFromSamlResponse(samlResponse);
-        const { role, durationHours } = await this._askUserForRoleAndDurationAsync(roles, noPrompt, profile.azure_default_role_arn, profile.azure_default_duration_hours);
-        await this._assumeRoleAsync(profileName, samlResponse, role, durationHours, awsNoVerifySsl, profile.region);
     },
     async loginAll(mode, disableSandbox, noPrompt, enableChromeNetworkService, awsNoVerifySsl, enableChromeSeamlessSso, forceRefresh, noDisableExtensions, disableGpu, incognito = false) {
-        const profiles = await awsConfig_1.awsConfig.getAllProfileNames();
+        const profiles = await awsConfig_1.awsConfig.getAz2awsProfileNames();
         for (const profile of profiles) {
             debug(`Check if profile ${profile} is expired or is about to expire`);
             if (!forceRefresh &&
@@ -117,12 +154,22 @@ exports.login = {
             }
         }
         debug("Environment");
-        debug({
-            ...env,
-            azure_default_password: "xxxxxxxxxx",
-        });
+        debug(this._redactProfileForDebug(env));
         return env;
     },
+    _redactProfileForDebug(env) {
+        return Object.fromEntries(Object.entries(env).map(([key, value]) => [
+            key,
+            key === "azure_default_duration_hours" ? value : REDACTED,
+        ]));
+    },
+    _redactArnForDebug(arn) {
+        const match = arn.match(/^(arn:[^:]+:iam::)[^:]+:(.+?\/).+$/);
+        if (!match) {
+            return arn;
+        }
+        return `${match[1]}${REDACTED}:${match[2]}${REDACTED}`;
+    },
     // Load the profile
     async _loadProfileAsync(profileName) {
         const profile = await awsConfig_1.awsConfig.getProfileConfigAsync(profileName);
@@ -156,7 +203,7 @@ exports.login = {
             <samlp:NameIDPolicy Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"></samlp:NameIDPolicy>
         </samlp:AuthnRequest>
         `;
-        debug("Generated SAML request", samlRequest);
+        debug("Generated SAML request");
         debug("Deflating SAML");
         return new Promise((resolve, reject) => {
             zlib_1.default.deflateRaw(samlRequest, (err, samlBuffer) => {
@@ -166,7 +213,7 @@ exports.login = {
                 debug("Encoding SAML in base64");
                 const samlBase64 = samlBuffer.toString("base64");
                 const url = `https://login.microsoftonline.com/${tenantId}/saml2?SAMLRequest=${encodeURIComponent(samlBase64)}`;
-                debug("Created login URL", url);
+                debug("Created login URL", (0, sensitiveOutput_1.redactUrlForLogs)(url));
                 return resolve(url);
             });
         });
@@ -189,7 +236,7 @@ exports.login = {
      * @returns {Promise.<string>} The SAML response.
      * @private
      */
-    async _performLoginAsync(url, headless, disableSandbox, cliProxy, noPrompt, enableChromeNetworkService, defaultUsername, defaultPassword, enableChromeSeamlessSso, rememberMe, noDisableExtensions, disableGpu, incognito = false) {
+    async _performLoginAsync(url, headless, disableSandbox, cliProxy, noPrompt, enableChromeNetworkService, defaultUsername, defaultPassword, enableChromeSeamlessSso, rememberMe, noDisableExtensions, disableGpu, incognito = false, allowSensitiveStateOutput = true) {
         debug("Loading login page in Chrome");
         let browser;
         const useRememberMe = rememberMe && !incognito;
@@ -248,9 +295,14 @@ exports.login = {
                     e.name === "TargetCloseError" &&
                     useRememberMe &&
                     !paths_1.paths.userDataDir) {
-                    debug(`Browser launch failed with TargetCloseError. Resetting profile at ${paths_1.paths.chromium}`);
+                    debug("Browser launch failed with TargetCloseError. Resetting managed browser profile.");
                     console.warn("Browser profile appears incompatible. Resetting profile data and retrying...");
-                    await promises_2.default.rm(paths_1.paths.chromium, { recursive: true, force: true });
+                    await promises_2.default.rm(paths_1.paths.chromium, {
+                        recursive: true,
+                        force: true,
+                        maxRetries: 5,
+                        retryDelay: 100,
+                    });
                     await promises_2.default.mkdir(paths_1.paths.chromium, { recursive: true });
                     browser = await puppeteer_1.default.launch(launchParams);
                 }
@@ -283,29 +335,27 @@ exports.login = {
             const samlResponsePromise = new Promise((resolve) => {
                 page.on("request", (req) => {
                     const reqURL = req.url();
-                    debug(`Request: ${reqURL}`);
+                    const redactedURL = (0, sensitiveOutput_1.redactUrlForLogs)(reqURL);
+                    debug(`Request: ${redactedURL}`);
                     if (reqURL === AWS_SAML_ENDPOINT ||
                         reqURL === AWS_GOV_SAML_ENDPOINT ||
                         reqURL === AWS_CN_SAML_ENDPOINT) {
                         resolve(undefined);
                         samlResponseData = req.postData();
-                        // eslint-disable-next-line @typescript-eslint/no-floating-promises
-                        req.respond({
+                        handleBackgroundPromise(req.respond({
                             status: 200,
                             contentType: "text/plain",
                             headers: {},
                             body: "",
-                        });
+                        }), `Failed to respond to intercepted request ${redactedURL}`);
                         if (browser) {
-                            // eslint-disable-next-line @typescript-eslint/no-floating-promises
-                            browser.close();
+                            handleBackgroundPromise(browser.close(), "Failed to close browser after receiving SAML response");
                         }
                         browser = undefined;
                         debug(`Received SAML response, browser closed`);
                     }
                     else {
-                        // eslint-disable-next-line @typescript-eslint/no-floating-promises
-                        req.continue();
+                        handleBackgroundPromise(req.continue(), `Failed to continue intercepted request ${redactedURL}`);
                     }
                 });
             });
@@ -325,13 +375,12 @@ exports.login = {
                 if (err instanceof Error) {
                     // An error will be thrown if you're still logged in cause the page.goto ot waitForNavigation
                     // will be a redirect to AWS. That's usually OK
-                    debug(`Error occurred during loading the first page: ${err.message}`);
+                    debug(`Error occurred during loading the first page: ${(0, sensitiveOutput_1.formatDebugErrorMessage)(err)}`);
                 }
             }
             if (cliProxy) {
                 let totalUnrecognizedDelay = 0;
-                // eslint-disable-next-line no-constant-condition
-                while (true) {
+                for (;;) {
                     if (samlResponseData)
                         break;
                     let foundState = false;
@@ -345,7 +394,7 @@ exports.login = {
                             if (err instanceof Error) {
                                 // An error can be thrown if the page isn't in a good state.
                                 // If one occurs, try again after another loop.
-                                debug(`Error when running state "${state.name}". ${err.toString()}. Retrying...`);
+                                debug(`Error when running state "${state.name}". ${(0, sensitiveOutput_1.formatDebugErrorMessage)(err)}. Retrying...`);
                             }
                             break;
                         }
@@ -354,7 +403,7 @@ exports.login = {
                             debug(`Found state: ${state.name}`);
                             await Promise.race([
                                 samlResponsePromise,
-                                state.handler(page, selected, noPrompt, defaultUsername, defaultPassword, useRememberMe),
+                                state.handler(page, selected, noPrompt, defaultUsername, defaultPassword, useRememberMe, allowSensitiveStateOutput),
                             ]);
                             debug(`Finished state: ${state.name}`);
                             break;
@@ -366,6 +415,9 @@ exports.login = {
                     else {
                         debug("State not recognized!");
                         if (totalUnrecognizedDelay > MAX_UNRECOGNIZED_PAGE_DELAY) {
+                            if (!allowSensitiveStateOutput) {
+                                throw new CLIError_1.CLIError("Unable to recognize page state in a shared environment. Re-run locally with --mode=debug to capture a screenshot.");
+                            }
                             const path = "az2aws-unrecognized-state.png";
                             await page.screenshot({ path });
                             throw new CLIError_1.CLIError(`Unable to recognize page state! A screenshot has been dumped to ${path}. If this problem persists, try running with --mode=gui or --mode=debug`);
@@ -383,13 +435,15 @@ exports.login = {
                 throw new Error("SAML response not found");
             }
             const samlResponse = querystring_1.default.parse(samlResponseData).SAMLResponse;
-            debug("Found SAML response", samlResponse);
             if (!samlResponse) {
                 throw new Error("SAML response not found");
             }
             else if (Array.isArray(samlResponse)) {
                 throw new Error("SAML can't be an array");
             }
+            debug("Found SAML response", {
+                base64Length: samlResponse.length,
+            });
             return samlResponse;
         }
         finally {
@@ -407,16 +461,16 @@ exports.login = {
     _parseRolesFromSamlResponse(assertion) {
         debug("Converting assertion from base64 to UTF-8");
         const samlText = Buffer.from(assertion, "base64").toString("utf8");
-        debug("Converted", samlText);
+        debug("Converted assertion from base64 to UTF-8", {
+            xmlLength: samlText.length,
+        });
         debug("Parsing SAML XML");
         const saml = (0, cheerio_1.load)(samlText, { xmlMode: true });
         debug("Looking for role SAML attribute");
-        // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
-        const roles = saml("Attribute[Name='https://aws.amazon.com/SAML/Attributes/Role']>AttributeValue")
-            .map(function () {
-            // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-            // @ts-ignore
-            const roleAndPrincipal = saml(this).text();
+        const roleSelection = saml("Attribute[Name='https://aws.amazon.com/SAML/Attributes/Role']>AttributeValue");
+        const roleNodes = roleSelection.toArray();
+        const roles = roleNodes.map((roleNode) => {
+            const roleAndPrincipal = saml(roleNode).text();
             const parts = roleAndPrincipal.split(",");
             // Role / Principal claims may be in either order
             const [roleIdx, principalIdx] = parts[0].includes(":role/")
@@ -425,9 +479,11 @@ exports.login = {
             const roleArn = parts[roleIdx].trim();
             const principalArn = parts[principalIdx].trim();
             return { roleArn, principalArn };
-        })
-            .get();
-        debug("Found roles", roles);
+        });
+        debug("Found roles", roles.map((role) => ({
+            roleArn: this._redactArnForDebug(role.roleArn),
+            principalArn: this._redactArnForDebug(role.principalArn),
+        })));
         return roles;
     },
     /**
@@ -436,21 +492,15 @@ exports.login = {
      * @param {bool} [noPrompt] - Enable skipping of user prompting
      * @param {string} [defaultRoleArn] - The default role ARN
      * @param {number} [defaultDurationHours] - The default session duration in hours
+     * @param {string} [nonInteractiveModeLabel] - CLI flag label to reference in
+     * non-interactive errors
      * @returns {Promise.<{role: string, durationHours: number}>} The selected role and duration
      * @private
      */
-    async _askUserForRoleAndDurationAsync(roles, noPrompt, defaultRoleArn, defaultDurationHours) {
+    async _askUserForRoleAndDurationAsync(roles, noPrompt, defaultRoleArn, defaultDurationHours, nonInteractiveModeLabel = "--no-prompt") {
+        var _a;
         let role;
-        let durationHours = 1;
-        if (defaultDurationHours) {
-            const parsedDuration = parseInt(defaultDurationHours, 10);
-            if (!Number.isNaN(parsedDuration) &&
-                parsedDuration > 0 &&
-                parsedDuration <= 12) {
-                durationHours = parsedDuration;
-            }
-        }
-        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        let durationHours = (_a = (0, sessionDuration_1.parseSessionDurationHours)(defaultDurationHours)) !== null && _a !== void 0 ? _a : 1;
         const questions = [];
         if (roles.length === 0) {
             throw new CLIError_1.CLIError("No roles found in SAML response.");
@@ -462,11 +512,11 @@ exports.login = {
         else {
             if (noPrompt) {
                 if (!defaultRoleArn) {
-                    throw new CLIError_1.CLIError("--no-prompt requires azure_default_role_arn when multiple roles are available.");
+                    throw new CLIError_1.CLIError(`${nonInteractiveModeLabel} requires azure_default_role_arn when multiple roles are available.`);
                 }
                 role = roles.find((r) => r.roleArn === defaultRoleArn);
                 if (!role) {
-                    throw new CLIError_1.CLIError(`Default role ARN '${defaultRoleArn}' was not found in the SAML response.`);
+                    throw new CLIError_1.CLIError("Configured default role ARN was not found in the SAML response.");
                 }
                 debug("Valid role found. No need to ask.");
             }
@@ -494,23 +544,23 @@ exports.login = {
                 name: "durationHours",
                 message: "Session Duration Hours (up to 12):",
                 type: "input",
-                default: defaultDurationHours || 1,
-                validate: (input) => {
-                    const num = Number(input);
-                    if (num > 0 && num <= 12)
-                        return true;
-                    return "Duration hours must be between 1 and 12";
-                },
+                default: String(durationHours),
+                validate: sessionDuration_1.validateSessionDurationHours,
             });
         }
         // Don't prompt for questions if not needed, an unneeded TTYWRAP prevents node from exiting when
         // user is logged in and using multiple profiles --all-profiles and --no-prompt
         if (questions.length > 0) {
             const answers = await inquirer_1.default.prompt(questions);
-            if (!role)
+            if (!role && answers.role) {
                 role = roles.find((r) => r.roleArn === answers.role);
+            }
             if (answers.durationHours) {
-                durationHours = parseInt(answers.durationHours, 10);
+                const parsedDurationHours = (0, sessionDuration_1.parseSessionDurationHours)(answers.durationHours);
+                if (parsedDurationHours === null) {
+                    throw new CLIError_1.CLIError(sessionDuration_1.sessionDurationHoursValidationMessage);
+                }
+                durationHours = parsedDurationHours;
             }
         }
         if (!role) {
@@ -522,16 +572,19 @@ exports.login = {
      * Assume the role.
      * @param {string} profileName - The profile name
      * @param {string} assertion - The SAML assertion
-     * @param {string} role - The role to assume
+     * @param {Role} role - The role to assume
      * @param {number} durationHours - The session duration in hours
-     * @param {bool} awsNoVerifySsl - Whether to have the AWS CLI verify SSL
+     * @param {boolean} awsNoVerifySsl - Whether the AWS SDK STS client should
+     * disable TLS certificate verification
      * @param {string} region - AWS region, if specified
-     * @returns {Promise} A promise
+     * @param {boolean} writeProfile - Whether to persist the credentials to the
+     * AWS shared credentials file
+     * @returns {Promise<AwsCredentials | undefined>} Retrieved credentials, or
+     * undefined when STS does not return them
      * @private
      */
-    async _assumeRoleAsync(profileName, assertion, role, durationHours, awsNoVerifySsl, region) {
-        var _a, _b, _c, _d, _e;
-        console.log(`Assuming role ${role.roleArn} in region ${region}...`);
+    async _assumeRoleAsync(profileName, assertion, role, durationHours, awsNoVerifySsl, region, writeProfile = true) {
+        console.log(`Assuming selected role in region ${region}...`);
         let stsOptions = {};
         if (awsNoVerifySsl) {
             console.warn("WARNING: SSL certificate verification is disabled. " +
@@ -573,13 +626,26 @@ exports.login = {
         });
         if (!res.Credentials) {
             debug("Unable to get security credentials from AWS");
-            return;
+            return undefined;
         }
-        await awsConfig_1.awsConfig.setProfileCredentialsAsync(profileName, {
-            aws_access_key_id: (_a = res.Credentials.AccessKeyId) !== null && _a !== void 0 ? _a : "",
-            aws_secret_access_key: (_b = res.Credentials.SecretAccessKey) !== null && _b !== void 0 ? _b : "",
-            aws_session_token: (_c = res.Credentials.SessionToken) !== null && _c !== void 0 ? _c : "",
-            aws_expiration: (_e = (_d = res.Credentials.Expiration) === null || _d === void 0 ? void 0 : _d.toISOString()) !== null && _e !== void 0 ? _e : "",
-        });
+        if (!res.Credentials.AccessKeyId ||
+            !res.Credentials.SecretAccessKey ||
+            !res.Credentials.SessionToken ||
+            !res.Credentials.Expiration) {
+            debug("Received incomplete credentials from AWS");
+            throw new CLIError_1.CLIError("AWS returned incomplete credentials. One or more required fields " +
+                "(AccessKeyId, SecretAccessKey, SessionToken, Expiration) are missing.");
+        }
+        const credentials = {
+            aws_access_key_id: res.Credentials.AccessKeyId,
+            aws_secret_access_key: res.Credentials.SecretAccessKey,
+            aws_session_token: res.Credentials.SessionToken,
+            aws_expiration: res.Credentials.Expiration.toISOString(),
+        };
+        if (writeProfile) {
+            await awsConfig_1.awsConfig.setProfileCredentialsAsync(profileName, credentials);
+            printCredentialsReadyMessage(profileName, credentials);
+        }
+        return credentials;
     },
 };