indraq_cli 2.1.0 → 2.2.0

package/dist/shared/jenkins/role-strategy-groovy.js

@@ -12,89 +12,89 @@ exports.jenkinsRoleStrategyCompatGroovy = void 0;
  * an older (but still usable) Role Strategy release does not fail during
  * Groovy compilation before we can print a useful diagnostic.
  */
-exports.jenkinsRoleStrategyCompatGroovy = `
-def indraqLoadPluginClass = { String name ->
-  try { return Jenkins.get().pluginManager.uberClassLoader.loadClass(name) } catch (Throwable ignored) { return null }
-}
-
-def indraqRoleStrategyClass = indraqLoadPluginClass('com.michelin.cio.hudson.plugins.rolestrategy.RoleBasedAuthorizationStrategy')
-def indraqRoleClass = indraqLoadPluginClass('com.michelin.cio.hudson.plugins.rolestrategy.Role')
-def indraqRoleTypeClass = indraqLoadPluginClass('com.synopsys.arc.jenkins.plugins.rolestrategy.RoleType')
-def indraqPermissionEntryClass = indraqLoadPluginClass('com.michelin.cio.hudson.plugins.rolestrategy.PermissionEntry')
-def indraqAuthorizationTypeClass = indraqLoadPluginClass('com.michelin.cio.hudson.plugins.rolestrategy.AuthorizationType')
-
-def indraqRequireRoleStrategy = { strategy ->
-  if (indraqRoleStrategyClass == null || indraqRoleClass == null) {
-    throw new IllegalStateException('Role Strategy plugin is not installed or its core API is unavailable')
-  }
-  if (!indraqRoleStrategyClass.isInstance(strategy)) {
-    throw new IllegalStateException('Role Strategy plugin must be the active Jenkins authorization strategy; active strategy is ' + strategy.getClass().getName())
-  }
-}
-
-def indraqRoleType = { String logicalName ->
-  // Newer Role Strategy releases use RoleType.
-  if (indraqRoleTypeClass != null) {
-    try { return indraqRoleTypeClass.getField(logicalName).get(null) } catch (Throwable ignored) {}
-    try { return java.lang.Enum.valueOf(indraqRoleTypeClass, logicalName) } catch (Throwable ignored) {}
-  }
-
-  // Older releases use RoleBasedAuthorizationStrategy.GLOBAL/PROJECT/SLAVE
-  // String keys such as globalRoles/projectRoles.
-  if (indraqRoleStrategyClass != null) {
-    def legacyField = logicalName == 'Global' ? 'GLOBAL' : logicalName == 'Project' ? 'PROJECT' : 'SLAVE'
-    try { return indraqRoleStrategyClass.getField(legacyField).get(null) } catch (Throwable ignored) {}
-  }
-
-  // Last-resort values used by the plugin's REST/API contract for many years.
-  if (logicalName == 'Global') return 'globalRoles'
-  if (logicalName == 'Project') return 'projectRoles'
-  return 'slaveRoles'
-}
-
-def indraqRoles = { roleMap ->
-  try { return roleMap.getRoles().toList() } catch (Throwable ignored) {}
-  try { return roleMap.getGrantedRoles().keySet().toList() } catch (Throwable ignored) {}
-  return []
-}
-
-def indraqPrincipal = { String sid ->
-  // Newer releases support typed USER principals.
-  if (indraqPermissionEntryClass != null && indraqAuthorizationTypeClass != null) {
-    try {
-      def userType = indraqAuthorizationTypeClass.getField('USER').get(null)
-      return indraqPermissionEntryClass.getConstructor(indraqAuthorizationTypeClass, String.class).newInstance(userType, sid)
-    } catch (Throwable ignored) {}
-  }
-  // Older releases accept the String SID directly.
-  return sid
-}
-
-def indraqAssignRole = { roleMap, role, String sid ->
-  def principal = indraqPrincipal(sid)
-  try { roleMap.assignRole(role, principal); return } catch (groovy.lang.MissingMethodException ignored) {}
-  roleMap.assignRole(role, sid)
-}
-
-def indraqUnassignRole = { roleMap, role, String sid ->
-  // Remove both newer typed USER assignments and older String/EITHER entries.
-  // This also cleans identities created by an earlier IndraQ release.
-  def principal = indraqPrincipal(sid)
-  try { roleMap.unAssignRole(role, principal) } catch (Throwable ignored) {}
-  try { roleMap.unAssignRole(role, sid) } catch (Throwable ignored) {}
-  try { roleMap.deleteRoleSid(principal, role.getName()) } catch (Throwable ignored) {}
-  try { roleMap.deleteRoleSid(sid, role.getName()) } catch (Throwable ignored) {}
-}
-
-def indraqNewRole = { String name, String pattern, Set permissions ->
-  if (indraqRoleClass == null) throw new IllegalStateException('Role Strategy Role API is unavailable')
-  try { return indraqRoleClass.newInstance(name, pattern, permissions) } catch (Throwable first) {
-    // Global roles in very old versions may expose only Role(String, Set).
-    if (pattern == '.*') {
-      try { return indraqRoleClass.newInstance(name, permissions) } catch (Throwable ignored) {}
-    }
-    throw first
-  }
-}
+exports.jenkinsRoleStrategyCompatGroovy = `
+def indraqLoadPluginClass = { String name ->
+  try { return Jenkins.get().pluginManager.uberClassLoader.loadClass(name) } catch (Throwable ignored) { return null }
+}
+
+def indraqRoleStrategyClass = indraqLoadPluginClass('com.michelin.cio.hudson.plugins.rolestrategy.RoleBasedAuthorizationStrategy')
+def indraqRoleClass = indraqLoadPluginClass('com.michelin.cio.hudson.plugins.rolestrategy.Role')
+def indraqRoleTypeClass = indraqLoadPluginClass('com.synopsys.arc.jenkins.plugins.rolestrategy.RoleType')
+def indraqPermissionEntryClass = indraqLoadPluginClass('com.michelin.cio.hudson.plugins.rolestrategy.PermissionEntry')
+def indraqAuthorizationTypeClass = indraqLoadPluginClass('com.michelin.cio.hudson.plugins.rolestrategy.AuthorizationType')
+
+def indraqRequireRoleStrategy = { strategy ->
+  if (indraqRoleStrategyClass == null || indraqRoleClass == null) {
+    throw new IllegalStateException('Role Strategy plugin is not installed or its core API is unavailable')
+  }
+  if (!indraqRoleStrategyClass.isInstance(strategy)) {
+    throw new IllegalStateException('Role Strategy plugin must be the active Jenkins authorization strategy; active strategy is ' + strategy.getClass().getName())
+  }
+}
+
+def indraqRoleType = { String logicalName ->
+  // Newer Role Strategy releases use RoleType.
+  if (indraqRoleTypeClass != null) {
+    try { return indraqRoleTypeClass.getField(logicalName).get(null) } catch (Throwable ignored) {}
+    try { return java.lang.Enum.valueOf(indraqRoleTypeClass, logicalName) } catch (Throwable ignored) {}
+  }
+
+  // Older releases use RoleBasedAuthorizationStrategy.GLOBAL/PROJECT/SLAVE
+  // String keys such as globalRoles/projectRoles.
+  if (indraqRoleStrategyClass != null) {
+    def legacyField = logicalName == 'Global' ? 'GLOBAL' : logicalName == 'Project' ? 'PROJECT' : 'SLAVE'
+    try { return indraqRoleStrategyClass.getField(legacyField).get(null) } catch (Throwable ignored) {}
+  }
+
+  // Last-resort values used by the plugin's REST/API contract for many years.
+  if (logicalName == 'Global') return 'globalRoles'
+  if (logicalName == 'Project') return 'projectRoles'
+  return 'slaveRoles'
+}
+
+def indraqRoles = { roleMap ->
+  try { return roleMap.getRoles().toList() } catch (Throwable ignored) {}
+  try { return roleMap.getGrantedRoles().keySet().toList() } catch (Throwable ignored) {}
+  return []
+}
+
+def indraqPrincipal = { String sid ->
+  // Newer releases support typed USER principals.
+  if (indraqPermissionEntryClass != null && indraqAuthorizationTypeClass != null) {
+    try {
+      def userType = indraqAuthorizationTypeClass.getField('USER').get(null)
+      return indraqPermissionEntryClass.getConstructor(indraqAuthorizationTypeClass, String.class).newInstance(userType, sid)
+    } catch (Throwable ignored) {}
+  }
+  // Older releases accept the String SID directly.
+  return sid
+}
+
+def indraqAssignRole = { roleMap, role, String sid ->
+  def principal = indraqPrincipal(sid)
+  try { roleMap.assignRole(role, principal); return } catch (groovy.lang.MissingMethodException ignored) {}
+  roleMap.assignRole(role, sid)
+}
+
+def indraqUnassignRole = { roleMap, role, String sid ->
+  // Remove both newer typed USER assignments and older String/EITHER entries.
+  // This also cleans identities created by an earlier IndraQ release.
+  def principal = indraqPrincipal(sid)
+  try { roleMap.unAssignRole(role, principal) } catch (Throwable ignored) {}
+  try { roleMap.unAssignRole(role, sid) } catch (Throwable ignored) {}
+  try { roleMap.deleteRoleSid(principal, role.getName()) } catch (Throwable ignored) {}
+  try { roleMap.deleteRoleSid(sid, role.getName()) } catch (Throwable ignored) {}
+}
+
+def indraqNewRole = { String name, String pattern, Set permissions ->
+  if (indraqRoleClass == null) throw new IllegalStateException('Role Strategy Role API is unavailable')
+  try { return indraqRoleClass.newInstance(name, pattern, permissions) } catch (Throwable first) {
+    // Global roles in very old versions may expose only Role(String, Set).
+    if (pattern == '.*') {
+      try { return indraqRoleClass.newInstance(name, permissions) } catch (Throwable ignored) {}
+    }
+    throw first
+  }
+}
 `;
 //# sourceMappingURL=role-strategy-groovy.js.map

package/docs/ARCHITECTURE.md

@@ -1,29 +1,29 @@
-# IndraQ Architecture
-
-## Control plane
-
-IndraQ CLI communicates with IndraQ Cloud API. PostgreSQL stores identities, roles, projects, shared environments, encrypted user provider credentials, infrastructure associations, managed AWS IAM credentials, and audit logs.
-
-## Credential ownership
-
-AWS, NPM, Jenkins, and GHCR credentials belong to an individual IndraQ user and are reusable across that user's projects.
-
-They are not organization-wide global secrets and are not copied into each project folder.
-
-## Shared environments
-
-Admins can create any number of shared environments with arbitrary names. An environment is a reusable named target containing an IP and optional region. Health-check protocol, endpoint, port, path, interval, threshold, latency measurement, and SNI are Route53-resource settings selected when DNS is configured.
-
-PRIMARY/SECONDARY is not an environment property. A FAILOVER DNS resource chooses which environment is PRIMARY and which is SECONDARY for that particular Route53 record.
-
-## Project resources
-
-Projects keep intent and external-resource associations, including GHCR image repositories, Jenkins jobs, Route53 routing/health checks, and NPM proxy hosts. Project membership controls who can discover/re-link a project. Resource grants record access to individual AWS, NPM, and Jenkins resources and are audited.
-
-## Prebuild
-
-Prebuild reconciles rather than blindly creates. It validates user provider configuration, checks existing project associations, asks for the Route53 routing policy first (SIMPLE, FAILOVER, WEIGHTED, or LATENCY), validates Jenkins host ports, configures/repairs Route53 according to that policy, verifies DNS before NPM, and creates/repairs NPM proxy hosts. SIMPLE records never receive a health check; FAILOVER uses PRIMARY/SECONDARY health checks; WEIGHTED/LATENCY may use health checks when requested.
-
-## Local state
-
-The project folder stores the Cloud project ID in `.indraq/project.json`. Reusable provider secrets are resolved from the authenticated user's Cloud account only when required.
+# IndraQ Architecture
+
+## Control plane
+
+IndraQ CLI communicates with IndraQ Cloud API. PostgreSQL stores identities, roles, projects, shared environments, encrypted user provider credentials, infrastructure associations, managed AWS IAM credentials, and audit logs.
+
+## Credential ownership
+
+AWS, NPM, Jenkins, and GHCR credentials belong to an individual IndraQ user and are reusable across that user's projects.
+
+They are not organization-wide global secrets and are not copied into each project folder.
+
+## Shared environments
+
+Admins can create any number of shared environments with arbitrary names. An environment is a reusable named target containing an IP and optional region. Health-check protocol, endpoint, port, path, interval, threshold, latency measurement, and SNI are Route53-resource settings selected when DNS is configured.
+
+PRIMARY/SECONDARY is not an environment property. A FAILOVER DNS resource chooses which environment is PRIMARY and which is SECONDARY for that particular Route53 record.
+
+## Project resources
+
+Projects keep intent and external-resource associations, including GHCR image repositories, Jenkins jobs, Route53 routing/health checks, and NPM proxy hosts. Project membership controls who can discover/re-link a project. Resource grants record access to individual AWS, NPM, and Jenkins resources and are audited.
+
+## Prebuild
+
+Prebuild reconciles rather than blindly creates. It validates user provider configuration, checks existing project associations, asks for the Route53 routing policy first (SIMPLE, FAILOVER, WEIGHTED, or LATENCY), validates Jenkins host ports, configures/repairs Route53 according to that policy, verifies DNS before NPM, and creates/repairs NPM proxy hosts. SIMPLE records never receive a health check; FAILOVER uses PRIMARY/SECONDARY health checks; WEIGHTED/LATENCY may use health checks when requested.
+
+## Local state
+
+The project folder stores the Cloud project ID in `.indraq/project.json`. Reusable provider secrets are resolved from the authenticated user's Cloud account only when required.