opal-security 2.0.20 → 2.1.0

package/lib/commands/login.js

@@ -9,8 +9,8 @@ const apollo_1 = require("../lib/apollo");
 const credentials_1 = require("../lib/credentials");
 const inquirer = require("inquirer");
 const handler_1 = require("../handler");
-const credentials_2 = require("../lib/credentials");
 const config_1 = require("../lib/config");
+const common_1 = require("../lib/common");
 const ISSUER_PROD = 'https://auth.opal.dev';
 const ISSUER_DEV = 'https://authdev.opal.dev';
 const GRANT_TYPE = 'urn:ietf:params:oauth:grant-type:device_code';
@@ -45,22 +45,26 @@ class Login extends command_1.Command {
         var _a, _b, _c, _d, _e;
         try {
             await apollo_1.initClient(this);
-            let email;
-            let organizationID;
-            if (await credentials_2.cred.accessToken) {
-                email = await credentials_2.cred.email;
-                organizationID = await credentials_2.cred.organizationID;
-                await credentials_2.cred.removeCredentials(-1);
-            }
+            const { flags } = this.parse(Login);
             const configDir = this.config.configDir;
             const configData = config_1.getOrCreateConfigData(configDir);
-            if (email && organizationID) {
-                console.log('Signing in as ' + email + ' - to use a different account, run `opal logout`');
+            let email = flags.email;
+            let organizationID;
+            if (await credentials_1.cred.accessToken) {
+                // Only use the previous email + organizationID if email isn't explicitly specified.
+                if (!email) {
+                    email = await credentials_1.cred.email;
+                    organizationID = await credentials_1.cred.organizationID;
+                }
+                await credentials_1.cred.removeCredentials(-1);
+            }
+            this.log('Welcome to Opal! ⚡️\n');
+            this.log('Please confirm your Opal instance URL:', configData[config_1.urlKey]);
+            this.log('If this is not correct, please first use `opal set-url --help`\n');
+            if (email) {
+                this.log('Signing in as: ' + email + ' - to use a different account, run `opal login --email [EMAIL]`');
             }
             else {
-                this.log('Welcome to Opal! ⚡️\n');
-                this.log('Please confirm your Opal instance URL:', configData[config_1.urlKey]);
-                this.log('If this is not correct, please first use `opal set-url --help`\n');
                 const { email: promptEmail } = await inquirer.prompt([{
                         name: 'email',
                         message: 'Enter your email:',
@@ -68,6 +72,8 @@ class Login extends command_1.Command {
                         validate: email => Boolean(email),
                     }]);
                 email = promptEmail;
+            }
+            if (!organizationID) {
                 const { resp: signInOrganizationsResponse, error } = await handler_1.runQuery({
                     command: this,
                     query: CLISignInMethodDocument,
@@ -77,7 +83,7 @@ class Login extends command_1.Command {
                     this.log('Could not connect to Opal. Did you set the right URL? (`opal set-url --help`)');
                 }
                 const signInOrganizations = (_b = (_a = signInOrganizationsResponse === null || signInOrganizationsResponse === void 0 ? void 0 : signInOrganizationsResponse.data) === null || _a === void 0 ? void 0 : _a.signInMethod) === null || _b === void 0 ? void 0 : _b.signInOrganizations;
-                if (signInOrganizations) {
+                if (signInOrganizations && signInOrganizations.length > 0) {
                     if (signInOrganizations.length === 1) {
                         organizationID = signInOrganizations[0].organizationId;
                     }
@@ -94,6 +100,10 @@ class Login extends command_1.Command {
                         organizationID = responses.organizationID;
                     }
                 }
+                else {
+                    // If there are no organizations for the user, require the user to login before failing,
+                    // which is parity with our web app.
+                }
             }
             let issuer;
             let clientId;
@@ -121,14 +131,9 @@ class Login extends command_1.Command {
             });
             this.log('\nYou are being redirected to your browser to authenticate.\n');
             this.log(`      User Code: ${handle.user_code}\n`);
-            // Wait 1s before opening the browser window to ensure the user has time to
+            // Wait before opening the browser window to ensure the user has time to
             // see the User Code.
-            const sleep = (ms) => {
-                return new Promise(resolve => {
-                    setTimeout(resolve, ms);
-                });
-            };
-            await sleep(1000);
+            await common_1.sleep(1000);
             await open(handle.verification_uri_complete, { wait: false });
             const tokenSet = await handle.poll();
             const userInfo = await client.userinfo(tokenSet);
@@ -141,8 +146,8 @@ class Login extends command_1.Command {
             });
             if (authCheckErr || !((_e = (_d = (_c = authCheckResp === null || authCheckResp === void 0 ? void 0 : authCheckResp.data) === null || _c === void 0 ? void 0 : _c.organizationSettings) === null || _d === void 0 ? void 0 : _d.settings) === null || _e === void 0 ? void 0 : _e.id)) {
                 this.log('Error verifying log in. Authenticated commands may fail. Please double check your URL and use `opal logout; opal login` to try again.\n');
-                this.log(authCheckErr + '\n');
-                return;
+                await credentials_1.cred.removeCredentials(-1);
+                apollo_1.handleError(this, authCheckErr);
             }
             this.log('🎉 You have successfully authenticated with Opal! You can now run authenticated commands.\n');
         }
@@ -156,5 +161,9 @@ Login.description = 'Authenticates you with the Opal server.';
 Login.examples = ['$ opal login'];
 Login.flags = {
     help: command_1.flags.help({ char: 'h' }),
+    email: command_1.flags.string({
+        multiple: false,
+        description: 'Email address to login with.',
+    }),
 };
 Login.args = [];

package/lib/commands/postgres-instances/start.js

@@ -1,60 +1,19 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 const command_1 = require("@oclif/command");
-const handler_1 = require("../../handler");
 const cmd_1 = require("../../lib/cmd");
 const apollo_1 = require("../../lib/apollo");
 const inquirer = require("inquirer");
 const resources_1 = require("../../lib/resources");
 const common_1 = require("../../lib/common");
-const ListPostgresInstancesDocument = `
-query ListPostgresInstances {
-  resources(input: {serviceType: POSTGRES, onlyMine: true, maxNumEntries: 1000}) {
-    __typename
-    ... on ResourcesResult {
-      resources {
-        name
-        id
-      }
-      cursor
-    }
-  }
-}`;
-const StartPostgresInstanceSessionDocument = `
-mutation StartPostgresInstanceSession($id: ResourceId!, $accessLevel: ResourceAccessLevelInput!, $sessionId: SessionId) {
-  createSession(input: {resourceId: $id, accessLevel: $accessLevel, sessionId: $sessionId}) {
-    __typename
-    ... on CreateSessionResult {
-      session {
-        id
-        endTime
-        metadata {
-          ... on AwsIamFederatedRdsSession {
-            dbUser
-            dbPassword
-            dbHostname
-            dbPort
-            dbName
-          }
-        }
-      }
-    }
-    ... on SessionNotFoundError {
-      message
-    }
-    ... on MfaInvalidError {
-      message
-    }
-    ... on OidcIDTokenNotFoundError {
-      message
-    }
-    ... on ResourceNotFoundError {
-      message
-    }
-    ... on EndSystemAuthorizationError {
-      message
-    }
-  }
+const sessions_1 = require("../../lib/sessions");
+const RdsSessionMetadataFragment = `
+... on AwsIamFederatedRdsSession {
+  dbUser
+  dbPassword
+  dbHostname
+  dbPort
+  dbName
 }`;
 class StartPostgresInstanceSession extends command_1.Command {
     async run() {
@@ -63,110 +22,76 @@ class StartPostgresInstanceSession extends command_1.Command {
         let instanceId = flags.id;
         let instanceName = null;
         const sessionId = flags.sessionId;
-        // TODO: RESOURCES-1: How do we grant access to a perm using ID
         if (!instanceId) {
-            const { resp: postgresInstancesResp, error } = await handler_1.runQuery({
-                command: this,
-                query: ListPostgresInstancesDocument,
-                variables: {},
-            });
-            if (error) {
-                apollo_1.printRequestOutput(this, postgresInstancesResp, error);
-                return;
-            }
-            const resourceInfos = postgresInstancesResp === null || postgresInstancesResp === void 0 ? void 0 : postgresInstancesResp.data.resources.resources.map((resource) => {
-                return {
-                    id: resource.id,
-                    name: resource.name,
-                };
-            });
-            const noResourcesFound = resources_1.resourcesAreEmpty(this, resourceInfos);
-            if (noResourcesFound) {
-                return;
-            }
-            const resourceInfoByName = {};
-            resourceInfos.forEach(resourceInfo => {
-                resourceInfoByName[resourceInfo.name] = resourceInfo;
-            });
-            inquirer.registerPrompt('autocomplete', require('inquirer-autocomplete-prompt'));
-            const selectedInstanceInfo = await inquirer.prompt([
-                {
-                    name: 'instance',
-                    message: 'Select a Postgres RDS instance to login to',
-                    type: 'autocomplete',
-                    source: (answers, input) => cmd_1.filterChoices(input, resourceInfos),
-                },
-            ]);
-            const selectedInstance = resourceInfoByName[selectedInstanceInfo.instance];
+            const selectedInstance = await resources_1.promptUserForResource(this, 'AWS_RDS_POSTGRES_INSTANCE', 'Select an RDS Postgres instance to login to');
             if (!selectedInstance) {
                 return;
             }
             instanceId = selectedInstance.id;
             instanceName = selectedInstance.name;
-            // TODO: RESOURCES-3: Select the access level for the DB
         }
-        // Fetch all access levels for resource
         const accessLevel = await resources_1.promptUserForAccessLevels(this, instanceId, 'Postgres database', flags.accessLevelRemoteId);
         if (!accessLevel) {
             return;
         }
-        const { resp, error } = await handler_1.runMutation({
-            command: this,
-            query: StartPostgresInstanceSessionDocument,
-            variables: {
-                id: instanceId,
-                accessLevel,
-                sessionId,
-            },
-        });
-        switch (resp === null || resp === void 0 ? void 0 : resp.data.createSession.__typename) {
-            case 'CreateSessionResult': {
-                const metadata = resp.data.createSession.session.metadata;
-                switch (metadata === null || metadata === void 0 ? void 0 : metadata.__typename) {
-                    case 'AwsIamFederatedRdsSession': {
-                        const dbUrl = `postgresql://${metadata.dbUser}:${encodeURIComponent(metadata.dbPassword)}@${metadata.dbHostname}:${metadata.dbPort}/${metadata.dbName}`;
-                        const externalAppLaunchName = 'Launch external database app';
-                        const psqlSessionLaunchName = 'Launch shell with psql session';
-                        const selectedLaunchInfo = await inquirer.prompt([
+        const session = await sessions_1.getOrCreateSession(this, instanceId, accessLevel, sessionId, RdsSessionMetadataFragment);
+        const metadata = session.metadata;
+        switch (metadata === null || metadata === void 0 ? void 0 : metadata.__typename) {
+            case 'AwsIamFederatedRdsSession': {
+                // Don't inform the user about RDS session expiration time, since RDS works differently.
+                // Opal RDS sessions expire after 15min because after that time they can no longer be used to connect.
+                // However, once connected, RDS sessions can be used for up to 12h.
+                // Since there's many options for how the user can use RDS credentials, it's unclear which expiration
+                // we want to show the user.
+                const externalAppLaunchName = 'Launch external database app';
+                const psqlSessionLaunchName = 'Launch shell with psql session';
+                const viewDetailsName = 'View connection configuration';
+                const selectedLaunchInfo = await inquirer.prompt([{
+                        name: 'launch',
+                        message: 'Select how to access the database',
+                        type: 'list',
+                        choices: [
                             {
-                                name: 'launch',
-                                message: 'Select how to access the database',
-                                type: 'list',
-                                choices: [
-                                    {
-                                        name: externalAppLaunchName,
-                                    },
-                                    {
-                                        name: psqlSessionLaunchName,
-                                    },
-                                ],
+                                name: externalAppLaunchName,
                             },
-                        ]);
-                        if (selectedLaunchInfo.launch === externalAppLaunchName) {
-                            const startSessionCmd = `open ${dbUrl}`;
-                            cmd_1.runCommandExec(startSessionCmd, `Opened external app for ${instanceName ? `"${instanceName}" instance` : 'instance'}`, `Failed to open external app for ${instanceName ? `"${instanceName}" instance` : 'instance'}`);
-                        }
-                        else if (selectedLaunchInfo.launch === psqlSessionLaunchName) {
-                            const startSessionCmd = `psql ${dbUrl}`;
-                            cmd_1.startInteractiveShell(startSessionCmd, `shell with psql session for ${instanceName ? `"${instanceName}" instance` : 'instance'}`);
-                        }
+                            {
+                                name: psqlSessionLaunchName,
+                            },
+                            {
+                                name: viewDetailsName,
+                            },
+                        ],
+                    }]);
+                const dbUrl = `postgresql://${metadata.dbUser}:${encodeURIComponent(metadata.dbPassword)}@${metadata.dbHostname}:${metadata.dbPort}/${metadata.dbName}`;
+                switch (selectedLaunchInfo.launch) {
+                    case externalAppLaunchName: {
+                        const startSessionCmd = `open ${dbUrl}`;
+                        cmd_1.runCommandExec(startSessionCmd, `Opened external app for ${instanceName ? `"${instanceName}" instance` : 'instance'}`, `Failed to open external app for ${instanceName ? `"${instanceName}" instance` : 'instance'}`);
+                        break;
+                    }
+                    case viewDetailsName: {
+                        const contentParts = [
+                            `[Connection URL]\n${dbUrl}`,
+                            `[Hostname]\n${metadata.dbHostname}`,
+                            `[Port]\n${metadata.dbPort}`,
+                            `[User]\n${metadata.dbUser}`,
+                            `[Password]\n${metadata.dbPassword}`,
+                            `[Database]\n${metadata.dbName}`,
+                        ];
+                        const content = contentParts.join('\n\n');
+                        common_1.displayContent(content);
+                        break;
+                    }
+                    case psqlSessionLaunchName: {
+                        const startSessionCmd = `psql ${dbUrl}`;
+                        cmd_1.startInteractiveShell(startSessionCmd, `shell with psql session for ${instanceName ? `"${instanceName}" instance` : 'instance'}`);
                         break;
                     }
-                    default:
-                        apollo_1.printRequestOutput(this, resp, error);
                 }
                 break;
             }
-            case 'MfaInvalidError': {
-                common_1.handleMfaRedirect(this, instanceId);
-                break;
-            }
-            case 'OidcIDTokenNotFoundError': {
-                common_1.handleOidcRedirect(this, instanceId);
-                break;
-            }
             default:
-                apollo_1.printRequestOutput(this, resp, error);
+                return apollo_1.handleError(this, undefined, session);
         }
     }
 }

package/lib/commands/resources/get.d.ts

@@ -1,5 +1,5 @@
 import { Command, flags } from '@oclif/command';
-export declare const GetResourceDocument = "\nquery GetResource($id: ResourceId!) {\n  resource(input: {id: $id}) {\n    __typename\n    ... on ResourceResult {\n      resource {\n        name\n        id\n        description\n        connection {\n          name\n          id\n        }\n        resourceUsers {\n          user {\n            email\n          }\n        }\n      }\n    }\n    ... on ResourceNotFoundError {\n      message\n    }\n  }\n}";
+export declare const GetResourceDocument = "\nquery GetResource($id: ResourceId!) {\n  resource(input: {id: $id}) {\n    __typename\n    ... on ResourceResult {\n      resource {\n        name\n        id\n        description\n        resourceType\n        connection {\n          name\n          id\n          connectionType\n        }\n        parentResource {\n          name\n          id\n          resourceType\n        }\n        resourceUsers {\n          user {\n            fullName\n            email\n            id\n          }\n        }\n      }\n    }\n    ... on ResourceNotFoundError {\n      message\n    }\n  }\n}";
 export default class GetResource extends Command {
     static description: string;
     static examples: string[];

package/lib/commands/resources/get.js

@@ -4,6 +4,7 @@ exports.GetResourceDocument = void 0;
 const command_1 = require("@oclif/command");
 const handler_1 = require("../../handler");
 const cmd_1 = require("../../lib/cmd");
+const apollo_1 = require("../../lib/apollo");
 exports.GetResourceDocument = `
 query GetResource($id: ResourceId!) {
   resource(input: {id: $id}) {
@@ -13,13 +14,22 @@ query GetResource($id: ResourceId!) {
         name
         id
         description
+        resourceType
         connection {
           name
           id
+          connectionType
+        }
+        parentResource {
+          name
+          id
+          resourceType
         }
         resourceUsers {
           user {
+            fullName
             email
+            id
           }
         }
       }
@@ -33,7 +43,15 @@ class GetResource extends command_1.Command {
     async run() {
         cmd_1.setMostRecentCommand(this);
         const { flags } = this.parse(GetResource);
-        await handler_1.default({ command: this, query: exports.GetResourceDocument, variables: flags });
+        const { resp, error } = await handler_1.runQuery({
+            command: this,
+            query: exports.GetResourceDocument,
+            variables: flags,
+        });
+        if (error) {
+            return apollo_1.handleError(this, error, resp);
+        }
+        apollo_1.printResponse(this, resp);
     }
 }
 exports.default = GetResource;

package/lib/commands/set-url.d.ts

@@ -4,14 +4,17 @@ export default class SetUrl extends Command {
     static examples: string[];
     static flags: {
         help: import("@oclif/parser/lib/flags").IBooleanFlag<void>;
-        custom: flags.IOptionFlag<string | undefined>;
         allowSelfSignedCerts: import("@oclif/parser/lib/flags").IBooleanFlag<boolean>;
+        custom: flags.IOptionFlag<string | undefined>;
         prod: import("@oclif/parser/lib/flags").IBooleanFlag<boolean>;
-        staging: import("@oclif/parser/lib/flags").IBooleanFlag<boolean>;
         demo: import("@oclif/parser/lib/flags").IBooleanFlag<boolean>;
         dev: import("@oclif/parser/lib/flags").IBooleanFlag<boolean>;
         devLocal: import("@oclif/parser/lib/flags").IBooleanFlag<boolean>;
     };
-    static args: never[];
+    static args: {
+        name: string;
+        description: string;
+        required: boolean;
+    }[];
     run(): Promise<void>;
 }

package/lib/commands/set-url.js

@@ -7,17 +7,17 @@ const credentials_1 = require("../lib/credentials");
 class SetUrl extends command_1.Command {
     async run() {
         try {
-            const { flags } = this.parse(SetUrl);
+            const { flags, args } = this.parse(SetUrl);
             let url = config_1.defaultUrl;
-            if (flags.custom) {
+            if (args.url) {
+                url = args.url;
+            }
+            else if (flags.custom) {
                 url = flags.custom;
             }
             else if (flags.prod) {
                 url = 'https://app.opal.dev';
             }
-            else if (flags.staging) {
-                url = 'https://staging.opal.dev';
-            }
             else if (flags.demo) {
                 url = 'https://demo.opal.dev';
             }
@@ -27,6 +27,23 @@ class SetUrl extends command_1.Command {
             else if (flags.devLocal) {
                 url = 'http://localhost:3000';
             }
+            if (!url.startsWith('http://') && !url.startsWith('https://')) {
+                // Add protocol if not specified
+                if (url.startsWith('localhost')) {
+                    url = 'http://' + url;
+                }
+                else {
+                    url = 'https://' + url;
+                }
+            }
+            if (url.match(/^https?:\/\/[^/]+\/$/)) {
+                // URL matches `https://x.y.z/`, so trim trailing slash
+                url = url.slice(0, -1);
+            }
+            else if (!url.match(/^https?:\/\/[^/]+$/)) {
+                // Error if URL doesn't match `https://x.y.z` or `http://x.y.z`
+                throw new Error('Invalid URL. Please provide only the protocol and domain (e.g. https://app.opal.dev).');
+            }
             const configData = config_1.getOrCreateConfigData(this.config.configDir);
             configData[config_1.urlKey] = url;
             configData[config_1.allowSelfSignedCertsKey] = flags.allowSelfSignedCerts !== undefined;
@@ -46,14 +63,21 @@ SetUrl.description = `Sets the url of the Opal server. Defaults to ${config_1.de
 SetUrl.examples = ['$ opal set-url'];
 SetUrl.flags = {
     help: command_1.flags.help({ char: 'h' }),
+    allowSelfSignedCerts: command_1.flags.boolean(),
+    // Legacy flags
     custom: command_1.flags.string({
         multiple: false,
+        hidden: true,
     }),
-    allowSelfSignedCerts: command_1.flags.boolean(),
-    prod: command_1.flags.boolean(),
-    staging: command_1.flags.boolean(),
-    demo: command_1.flags.boolean(),
-    dev: command_1.flags.boolean(),
-    devLocal: command_1.flags.boolean(),
+    prod: command_1.flags.boolean({ hidden: true }),
+    demo: command_1.flags.boolean({ hidden: true }),
+    dev: command_1.flags.boolean({ hidden: true }),
+    devLocal: command_1.flags.boolean({ hidden: true }),
 };
-SetUrl.args = [];
+SetUrl.args = [
+    {
+        name: 'url',
+        description: 'URL of the Opal server to use. If unspecified, defaults to https://app.opal.dev',
+        required: false,
+    },
+];

package/lib/commands/ssh/copyFrom.js

@@ -1,46 +1,12 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 const command_1 = require("@oclif/command");
-const handler_1 = require("../../handler");
 const apollo_1 = require("../../lib/apollo");
 const cmd_1 = require("../../lib/cmd");
 const ssh_1 = require("../../lib/ssh");
-const common_1 = require("../../lib/common");
-const StartSSHSessionDocument = `
-mutation StartSSHSession($id: ResourceId!, $accessLevel: ResourceAccessLevelInput!, $sessionId: SessionId) {
-  createSession(input: {resourceId: $id, accessLevel: $accessLevel, sessionId: $sessionId}) {
-    __typename
-    ... on CreateSessionResult {
-      session {
-        id
-        endTime
-        metadata {
-          ... on AwsIamFederatedSSMSession {
-            awsAccessKeyId
-            awsSecretAccessKey
-            awsSessionToken
-            awsLoginUrl
-            federatedArn
-            ec2InstanceId
-            ec2Region
-          }
-        }
-      }
-    }
-    ... on SessionNotFoundError {
-      message
-    }
-    ... on MfaInvalidError {
-      message
-    }
-    ... on ResourceNotFoundError {
-      message
-    }
-    ... on EndSystemAuthorizationError {
-      message
-    }
-  }
-}`;
+const resources_1 = require("../../lib/resources");
+const sessions_1 = require("../../lib/sessions");
+const start_1 = require("./start");
 class StartSCPSession extends command_1.Command {
     async run() {
         cmd_1.setMostRecentCommand(this);
@@ -60,38 +26,23 @@ class StartSCPSession extends command_1.Command {
             instanceId = selectedInstance.id;
             instanceName = selectedInstance.name;
         }
-        const { resp, error } = await handler_1.runMutation({
-            command: this,
-            query: StartSSHSessionDocument,
-            variables: { id: instanceId, accessLevel: cmd_1.DEFAULT_ACCESS_LEVEL, sessionId },
-        });
-        switch (resp === null || resp === void 0 ? void 0 : resp.data.createSession.__typename) {
-            case 'CreateSessionResult': {
-                const metadata = resp.data.createSession.session.metadata;
-                switch (metadata === null || metadata === void 0 ? void 0 : metadata.__typename) {
-                    case 'AwsIamFederatedSSMSession': {
-                        const envVars = {
-                            AWS_ACCESS_KEY_ID: metadata.awsAccessKeyId,
-                            AWS_SECRET_ACCESS_KEY: metadata.awsSecretAccessKey,
-                            AWS_SESSION_TOKEN: metadata.awsSessionToken,
-                        };
-                        // Run SCP script
-                        const scpCmd = `$SCRIPT_PATH/../../scripts/ssh_ssm_scp_from_server.sh ${metadata.ec2InstanceId} ${flags.user} ${flags.src} ${metadata.ec2Region} ${flags.dest}`;
-                        const outputMessage = `from "${flags.src}" on ${instanceName ? `"${instanceName}" instance` : 'instance'} to "${flags.dest}" locally.`;
-                        cmd_1.runCommandSpawn(scpCmd, `Copied ${outputMessage}`, `Failed to copy ${outputMessage}`, envVars);
-                        break;
-                    }
-                    default:
-                        apollo_1.printRequestOutput(this, resp, error);
-                }
-                break;
-            }
-            case 'MfaInvalidError': {
-                common_1.handleMfaRedirect(this, instanceId);
+        const session = await sessions_1.getOrCreateSession(this, instanceId, resources_1.DEFAULT_ACCESS_LEVEL, sessionId, start_1.Ec2SessionMetadataFragment);
+        const metadata = session.metadata;
+        switch (metadata === null || metadata === void 0 ? void 0 : metadata.__typename) {
+            case 'AwsIamFederatedSSMSession': {
+                const envVars = {
+                    AWS_ACCESS_KEY_ID: metadata.awsAccessKeyId,
+                    AWS_SECRET_ACCESS_KEY: metadata.awsSecretAccessKey,
+                    AWS_SESSION_TOKEN: metadata.awsSessionToken,
+                };
+                // Run SCP script
+                const scpCmd = `$SCRIPT_PATH/../../scripts/ssh_ssm_scp_from_server.sh ${metadata.ec2InstanceId} ${flags.user} ${flags.src} ${metadata.ec2Region} ${flags.dest}`;
+                const outputMessage = `from "${flags.src}" on ${instanceName ? `"${instanceName}" instance` : 'instance'} to "${flags.dest}" locally.`;
+                cmd_1.runCommandSpawn(scpCmd, `Copied ${outputMessage}`, `Failed to copy ${outputMessage}`, envVars);
                 break;
             }
             default:
-                apollo_1.printRequestOutput(this, resp, error);
+                return apollo_1.handleError(this, undefined, session);
         }
     }
 }
@@ -118,7 +69,7 @@ StartSCPSession.flags = {
         multiple: false,
         required: false,
         default: 'ssm-user',
-        description: "Pick which user you want to run SCP over. Keep in mind not all users will have access to each other's home directory.",
+        description: 'Pick which user you want to run SCP over. Keep in mind not all users will have access to each other\'s home directory.',
     }),
     id: command_1.flags.string({
         multiple: false,