opal-security 2.0.9 → 2.0.12

package/README.md

@@ -22,7 +22,7 @@ $ npm install -g opal-security
 $ opal COMMAND
 running command...
 $ opal (-v|--version|version)
-opal-security/2.0.9 darwin-x64 node-v14.16.1
+opal-security/2.0.12 darwin-x64 node-v14.16.1
 $ opal --help [COMMAND]
 USAGE
   $ opal COMMAND
@@ -86,7 +86,7 @@ EXAMPLE
   opal aws:identity
 ```
 
-_See code: [src/commands/aws/identity.ts](https://github.com/cli/opal/blob/v2.0.9/src/commands/aws/identity.ts)_
+_See code: [src/commands/aws/identity.ts](https://github.com/opalsecurity/opal-cli/blob/v2.0.12/src/commands/aws/identity.ts)_
 
 ## `opal curl-example`
 
@@ -100,7 +100,7 @@ OPTIONS
   -h, --help  show CLI help
 ```
 
-_See code: [src/commands/curl-example.ts](https://github.com/cli/opal/blob/v2.0.9/src/commands/curl-example.ts)_
+_See code: [src/commands/curl-example.ts](https://github.com/opalsecurity/opal-cli/blob/v2.0.12/src/commands/curl-example.ts)_
 
 ## `opal help [COMMAND]`
 
@@ -136,7 +136,7 @@ EXAMPLES
   opal iam-roles:start --id 51f7176b-0464-4a6f-8369-e951e187b398
 ```
 
-_See code: [src/commands/iam-roles/start.ts](https://github.com/cli/opal/blob/v2.0.9/src/commands/iam-roles/start.ts)_
+_See code: [src/commands/iam-roles/start.ts](https://github.com/opalsecurity/opal-cli/blob/v2.0.12/src/commands/iam-roles/start.ts)_
 
 ## `opal kube-roles:start`
 
@@ -158,7 +158,7 @@ EXAMPLES
   "arn:aws:iam::712234975475:role/acme-eks-cluster-admin-role"
 ```
 
-_See code: [src/commands/kube-roles/start.ts](https://github.com/cli/opal/blob/v2.0.9/src/commands/kube-roles/start.ts)_
+_See code: [src/commands/kube-roles/start.ts](https://github.com/opalsecurity/opal-cli/blob/v2.0.12/src/commands/kube-roles/start.ts)_
 
 ## `opal login`
 
@@ -175,7 +175,7 @@ EXAMPLE
   $ opal login
 ```
 
-_See code: [src/commands/login.ts](https://github.com/cli/opal/blob/v2.0.9/src/commands/login.ts)_
+_See code: [src/commands/login.ts](https://github.com/opalsecurity/opal-cli/blob/v2.0.12/src/commands/login.ts)_
 
 ## `opal logout`
 
@@ -192,7 +192,7 @@ EXAMPLE
   $ opal logout
 ```
 
-_See code: [src/commands/logout.ts](https://github.com/cli/opal/blob/v2.0.9/src/commands/logout.ts)_
+_See code: [src/commands/logout.ts](https://github.com/opalsecurity/opal-cli/blob/v2.0.12/src/commands/logout.ts)_
 
 ## `opal postgres-instances:start`
 
@@ -213,7 +213,7 @@ EXAMPLES
   opal postgres-instances:start --id 51f7176b-0464-4a6f-8369-e951e187b398 --accessLevelRemoteId "fullaccess"
 ```
 
-_See code: [src/commands/postgres-instances/start.ts](https://github.com/cli/opal/blob/v2.0.9/src/commands/postgres-instances/start.ts)_
+_See code: [src/commands/postgres-instances/start.ts](https://github.com/opalsecurity/opal-cli/blob/v2.0.12/src/commands/postgres-instances/start.ts)_
 
 ## `opal resources:get`
 
@@ -231,7 +231,7 @@ EXAMPLE
   opal resources:get --id 54052a3e-5375-4392-aeaf-0c6c44c131d4
 ```
 
-_See code: [src/commands/resources/get.ts](https://github.com/cli/opal/blob/v2.0.9/src/commands/resources/get.ts)_
+_See code: [src/commands/resources/get.ts](https://github.com/opalsecurity/opal-cli/blob/v2.0.12/src/commands/resources/get.ts)_
 
 ## `opal set-url`
 
@@ -249,12 +249,13 @@ OPTIONS
   --dev
   --devLocal
   --prod
+  --staging
 
 EXAMPLE
   $ opal set-host
 ```
 
-_See code: [src/commands/set-url.ts](https://github.com/cli/opal/blob/v2.0.9/src/commands/set-url.ts)_
+_See code: [src/commands/set-url.ts](https://github.com/opalsecurity/opal-cli/blob/v2.0.12/src/commands/set-url.ts)_
 
 ## `opal ssh:copyFrom`
 
@@ -280,7 +281,7 @@ EXAMPLES
   opal ssh:copyFrom --src instance/dir --dest my/dir --id 51f7176b-0464-4a6f-8369-e951e187b398
 ```
 
-_See code: [src/commands/ssh/copyFrom.ts](https://github.com/cli/opal/blob/v2.0.9/src/commands/ssh/copyFrom.ts)_
+_See code: [src/commands/ssh/copyFrom.ts](https://github.com/opalsecurity/opal-cli/blob/v2.0.12/src/commands/ssh/copyFrom.ts)_
 
 ## `opal ssh:copyTo`
 
@@ -306,7 +307,7 @@ EXAMPLES
   opal ssh:copyTo --src my/dir --dest instance/dir --id 51f7176b-0464-4a6f-8369-e951e187b398
 ```
 
-_See code: [src/commands/ssh/copyTo.ts](https://github.com/cli/opal/blob/v2.0.9/src/commands/ssh/copyTo.ts)_
+_See code: [src/commands/ssh/copyTo.ts](https://github.com/opalsecurity/opal-cli/blob/v2.0.12/src/commands/ssh/copyTo.ts)_
 
 ## `opal ssh:start`
 
@@ -325,5 +326,5 @@ EXAMPLES
   opal ssh:start --id 51f7176b-0464-4a6f-8369-e951e187b398
 ```
 
-_See code: [src/commands/ssh/start.ts](https://github.com/cli/opal/blob/v2.0.9/src/commands/ssh/start.ts)_
+_See code: [src/commands/ssh/start.ts](https://github.com/opalsecurity/opal-cli/blob/v2.0.12/src/commands/ssh/start.ts)_
 <!-- commandsstop -->

package/lib/commands/curl-example.js

@@ -6,13 +6,15 @@ const credentials_1 = require("../lib/credentials");
 class CurlExample extends command_1.Command {
     async run() {
         const accessToken = await credentials_1.cred.accessToken;
+        const organizationID = await credentials_1.cred.organizationID;
         const configData = config_1.getOrCreateConfigData(this.config.configDir);
         const url = configData[config_1.urlKey];
         this.log(`
 curl -v ${url}/query \\
   --data-binary '{"query":"query ListSSHSessions {resources(input: {serviceType: SSH, onlyMine: true}) {... on ResourcesResult { resources { name } } } }"}' \\
   --header "Content-Type: application/json" \\
-  --header "Authorization: Bearer ${accessToken}"
+  --header "Authorization: Bearer ${accessToken}" \\
+  --header "X-Opal-Organization-ID: ${organizationID}"
 `);
     }
 }

package/lib/commands/login.js

@@ -6,16 +6,106 @@ const open = require("open");
 const openid_client_1 = require("openid-client");
 const apollo_1 = require("../lib/apollo");
 const credentials_1 = require("../lib/credentials");
-const ISSUER = 'https://auth.opal.dev';
+const inquirer = require("inquirer");
+const handler_1 = require("../handler");
+const credentials_2 = require("../lib/credentials");
+const config_1 = require("../lib/config");
+const ISSUER_PROD = 'https://auth.opal.dev';
+const ISSUER_DEV = 'https://authdev.opal.dev';
 const GRANT_TYPE = 'urn:ietf:params:oauth:grant-type:device_code';
-const CLIENT_ID = '42rm6E5v7o67LBpRfjdT9KhnjrQHr9UF';
+const CLIENT_ID_PROD = '42rm6E5v7o67LBpRfjdT9KhnjrQHr9UF';
+const CLIENT_ID_DEV = 'XYV8qoAvZG7dHnhRp2g5XMJ1zX9fBP6s';
+const CLISignInMethodDocument = `
+query CLISignInMethod($input: SignInMethodInput!) {
+  signInMethod(input: $input) {
+    __typename
+    ... on SignInMethodResult {
+      signInOrganizations {
+        organizationId
+        organizationName
+      }
+    }
+  }
+}`;
+const CLIAuthSessionCheckDocument = `
+query CLIAuthSessionCheck {
+  organizationSettings {
+      ... on OrganizationSettingsResult {
+        settings {
+          id
+        }
+      }
+  }
+}
+`;
 class Login extends command_1.Command {
     async run() {
+        var _a, _b, _c, _d, _e;
         try {
-            const issuer = await openid_client_1.Issuer.discover(ISSUER);
+            await apollo_1.initClient(this);
+            let email;
+            let organizationID;
+            if (await credentials_2.cred.accessToken) {
+                email = await credentials_2.cred.email;
+                organizationID = await credentials_2.cred.organizationID;
+                await credentials_2.cred.removeCredentials(-1);
+            }
+            const configDir = this.config.configDir;
+            const configData = config_1.getOrCreateConfigData(configDir);
+            if (email && organizationID) {
+                console.log('Signing in as ' + email + ' - to use a different account, run `opal logout`');
+            }
+            else {
+                this.log('Welcome to Opal! ⚡️\n');
+                this.log('Please confirm your Opal instance URL:', configData[config_1.urlKey]);
+                this.log('If this is not correct, please first use `opal set-url --help`\n');
+                const { email: promptEmail } = await inquirer.prompt([{
+                        name: 'email',
+                        message: 'Enter your email:',
+                        type: 'input',
+                        validate: email => Boolean(email),
+                    }]);
+                email = promptEmail;
+                const { resp: signInOrganizationsResponse, error } = await handler_1.runQuery({
+                    command: this,
+                    query: CLISignInMethodDocument,
+                    variables: { input: { email } },
+                });
+                if (error) {
+                    this.log('Could not connect to Opal. Did you set the right URL? (`opal set-url --help`)');
+                }
+                const signInOrganizations = (_b = (_a = signInOrganizationsResponse === null || signInOrganizationsResponse === void 0 ? void 0 : signInOrganizationsResponse.data) === null || _a === void 0 ? void 0 : _a.signInMethod) === null || _b === void 0 ? void 0 : _b.signInOrganizations;
+                if (signInOrganizations) {
+                    if (signInOrganizations.length === 1) {
+                        organizationID = signInOrganizations[0].organizationId;
+                    }
+                    else {
+                        const responses = await inquirer.prompt([{
+                                name: 'organizationID',
+                                message: 'Select an organization:',
+                                type: 'list',
+                                choices: signInOrganizations.map(signInOrganization => ({
+                                    name: signInOrganization.organizationName,
+                                    value: signInOrganization.organizationId,
+                                })),
+                            }]);
+                        organizationID = responses.organizationID;
+                    }
+                }
+            }
+            let issuer;
+            let clientId;
+            if (config_1.isProduction(this.config.configDir)) {
+                issuer = await openid_client_1.Issuer.discover(ISSUER_PROD);
+                clientId = CLIENT_ID_PROD;
+            }
+            else {
+                issuer = await openid_client_1.Issuer.discover(ISSUER_DEV);
+                clientId = CLIENT_ID_DEV;
+            }
             const client = new issuer.Client({
                 grant_types: [GRANT_TYPE],
-                client_id: CLIENT_ID,
+                client_id: clientId,
                 response_types: [],
                 redirect_uris: [],
                 token_endpoint_auth_method: 'none',
@@ -25,13 +115,29 @@ class Login extends command_1.Command {
                 audience: 'https://opal.dev',
                 scope: 'openid email profile',
             });
-            this.log('You are being redirected to your browser to authenticate.\n');
+            this.log('\nYou are being redirected to your browser to authenticate.\n');
             this.log(`      User Code: ${handle.user_code}\n`);
+            // Wait 2 seconds to show the user code clearly
+            const sleep = (ms) => {
+                return new Promise(resolve => {
+                    setTimeout(resolve, ms);
+                });
+            };
+            await sleep(2000);
             await open(handle.verification_uri_complete, { wait: false });
             const tokenSet = await handle.poll();
             const userInfo = await client.userinfo(tokenSet);
-            await keytar.setPassword(credentials_1.OPAL_CREDS_KEY, userInfo.email || 'unset-email', (tokenSet === null || tokenSet === void 0 ? void 0 : tokenSet.access_token) || '');
-            await apollo_1.initClient(this);
+            await keytar.setPassword(credentials_1.OPAL_CREDS_KEY, (userInfo.email || 'unset-email') + '|' + organizationID, (tokenSet === null || tokenSet === void 0 ? void 0 : tokenSet.access_token) || '');
+            // "Representative" authenticated call to check the log-in worked as expected.
+            const { resp: authCheckResp, error: authCheckErr } = await handler_1.runQuery({
+                command: this,
+                query: CLIAuthSessionCheckDocument,
+                variables: {},
+            });
+            if (authCheckErr || !((_e = (_d = (_c = authCheckResp === null || authCheckResp === void 0 ? void 0 : authCheckResp.data) === null || _c === void 0 ? void 0 : _c.organizationSettings) === null || _d === void 0 ? void 0 : _d.settings) === null || _e === void 0 ? void 0 : _e.id)) {
+                this.log('Error verifying log in. Authenticated commands may fail. Please double check your URL and use `opal logout; opal login` to try again.\n');
+                return;
+            }
             this.log('🎉 You have successfully authenticated with Opal! You can now run authenticated commands.\n');
         }
         catch (error) {

package/lib/commands/set-url.d.ts

@@ -7,6 +7,7 @@ export default class SetUrl extends Command {
         custom: flags.IOptionFlag<string | undefined>;
         allowSelfSignedCerts: import("@oclif/parser/lib/flags").IBooleanFlag<boolean>;
         prod: import("@oclif/parser/lib/flags").IBooleanFlag<boolean>;
+        staging: import("@oclif/parser/lib/flags").IBooleanFlag<boolean>;
         demo: import("@oclif/parser/lib/flags").IBooleanFlag<boolean>;
         dev: import("@oclif/parser/lib/flags").IBooleanFlag<boolean>;
         devLocal: import("@oclif/parser/lib/flags").IBooleanFlag<boolean>;

package/lib/commands/set-url.js

@@ -14,6 +14,9 @@ class SetUrl extends command_1.Command {
             else if (flags.prod) {
                 url = 'https://app.opal.dev';
             }
+            else if (flags.staging) {
+                url = 'https://staging.opal.dev';
+            }
             else if (flags.demo) {
                 url = 'https://demo.opal.dev';
             }
@@ -46,6 +49,7 @@ SetUrl.flags = {
     }),
     allowSelfSignedCerts: command_1.flags.boolean(),
     prod: command_1.flags.boolean(),
+    staging: command_1.flags.boolean(),
     demo: command_1.flags.boolean(),
     dev: command_1.flags.boolean(),
     devLocal: command_1.flags.boolean(),

package/lib/handler.d.ts

@@ -1,15 +1,15 @@
 import { Command } from '@oclif/command';
-interface QueryHandlerProps {
+interface QueryHandlerProps<TVar = Record<string, any>> {
     command: Command;
     query: string;
-    variables?: Record<string, any>;
+    variables?: TVar;
 }
 export declare const runMutation: ({ command, query, variables, }: QueryHandlerProps) => Promise<{
     resp: import("@apollo/client/core").FetchResult<any, Record<string, any>, Record<string, any>> | null;
     error: any;
 }>;
-export declare const runQuery: ({ command, query, variables, }: QueryHandlerProps) => Promise<{
-    resp: import("@apollo/client/core").ApolloQueryResult<any> | null;
+export declare const runQuery: <TResponse = any, TVar = Record<string, any>>({ command, query, variables, }: QueryHandlerProps<TVar>) => Promise<{
+    resp: import("@apollo/client/core").ApolloQueryResult<TResponse> | null;
     error: any;
 }>;
 declare const handler: ({ command, query, variables }: QueryHandlerProps) => void;

package/lib/lib/apollo.js

@@ -21,6 +21,7 @@ exports.initClient = async (command) => {
     const currentCLIVersion = command.config.version;
     const configData = config_1.getOrCreateConfigData(configDir);
     const accessToken = await credentials_1.cred.accessToken;
+    const organizationID = await credentials_1.cred.organizationID;
     const httpsAgent = new https.Agent({
         rejectUnauthorized: !configData[config_1.allowSelfSignedCertsKey],
     });
@@ -36,7 +37,7 @@ exports.initClient = async (command) => {
     });
     const authLink = context_1.setContext((_, { headers }) => {
         return {
-            headers: Object.assign(Object.assign({}, headers), { authorization: `Bearer ${accessToken}` }),
+            headers: Object.assign(Object.assign({}, headers), { authorization: `Bearer ${accessToken}`, 'X-Opal-Organization-ID': organizationID }),
         };
     });
     const checkCLIVersion = (operation) => {

package/lib/lib/config.d.ts

@@ -4,3 +4,4 @@ export declare const allowSelfSignedCertsKey = "allowSelfSignedCerts";
 export declare const defaultAllowSelfSignedCerts = false;
 export declare const getOrCreateConfigData: (configDir: string) => Record<string, any>;
 export declare const writeConfigData: (configDir: string, newConfigData: Record<string, any>) => void;
+export declare const isProduction: (configDir: string) => boolean;

package/lib/lib/config.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.writeConfigData = exports.getOrCreateConfigData = exports.defaultAllowSelfSignedCerts = exports.allowSelfSignedCertsKey = exports.defaultUrl = exports.urlKey = void 0;
+exports.isProduction = exports.writeConfigData = exports.getOrCreateConfigData = exports.defaultAllowSelfSignedCerts = exports.allowSelfSignedCertsKey = exports.defaultUrl = exports.urlKey = void 0;
 const fs = require("fs");
 const path = require("path");
 exports.urlKey = 'url';
@@ -50,3 +50,11 @@ exports.writeConfigData = (configDir, newConfigData) => {
         mode: 0o0600,
     });
 };
+exports.isProduction = (configDir) => {
+    const configData = exports.getOrCreateConfigData(configDir);
+    // Custom URLs are considered production since it includes on-prem
+    return configData[exports.urlKey] !== 'https://dev.opal.dev' &&
+        configData[exports.urlKey] !== 'http://localhost:3000' &&
+        configData[exports.urlKey] !== 'https://demo.opal.dev' &&
+        configData[exports.urlKey] !== 'https://staging.opal.dev';
+};

package/lib/lib/credentials.d.ts

@@ -1,6 +1,8 @@
 export declare const OPAL_CREDS_KEY = "opal";
 export declare const cred: {
     removeCredentials(after: number): Promise<void>;
-    readonly accountId: Promise<string>;
-    readonly accessToken: Promise<string>;
+    readonly accountId: Promise<string | undefined>;
+    readonly organizationID: Promise<string | undefined>;
+    readonly email: Promise<string | undefined>;
+    readonly accessToken: Promise<string | undefined>;
 };

package/lib/lib/credentials.js

@@ -20,6 +20,9 @@ exports.cred = {
         return (async () => {
             try {
                 const keyContents = await keytar.findCredentials(exports.OPAL_CREDS_KEY);
+                if (!keyContents[0]) {
+                    return undefined;
+                }
                 const { account } = keyContents[0];
                 return account;
             }
@@ -28,12 +31,50 @@ exports.cred = {
             }
         })();
     },
+    get organizationID() {
+        return (async () => {
+            try {
+                const keyContents = await keytar.findCredentials(exports.OPAL_CREDS_KEY);
+                if (!keyContents[0]) {
+                    return undefined;
+                }
+                const { account } = keyContents[0];
+                const parts = account.split('|');
+                if (!parts || parts.length <= 1) {
+                    return undefined;
+                }
+                return parts.pop();
+            }
+            catch (error) {
+                throw error;
+            }
+        })();
+    },
+    get email() {
+        return (async () => {
+            try {
+                const keyContents = await keytar.findCredentials(exports.OPAL_CREDS_KEY);
+                if (!keyContents[0]) {
+                    return undefined;
+                }
+                const { account } = keyContents[0];
+                const parts = account.split('|');
+                if (!parts || parts.length <= 1) {
+                    return undefined;
+                }
+                return parts[0];
+            }
+            catch (error) {
+                throw error;
+            }
+        })();
+    },
     get accessToken() {
         return (async () => {
             try {
                 const keyContents = await keytar.findCredentials(exports.OPAL_CREDS_KEY);
                 if (!keyContents[0]) {
-                    return 'unset-token';
+                    return undefined;
                 }
                 const { password } = keyContents[0];
                 return password;