pepr 2.0.2 → 2.0.4

package/dist/cli/build/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/cli/build/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAwFpC,MAAM,CAAC,OAAO,WAAW,OAAO,EAAE,OAAO,GAAG,IAAI,CAoF/C"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/cli/build/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAyFpC,MAAM,CAAC,OAAO,WAAW,OAAO,EAAE,OAAO,GAAG,IAAI,CAqF/C"}

package/dist/cli/deploy/buildAndDeploy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"buildAndDeploy.d.ts","sourceRoot":"","sources":["../../../src/cli/deploy/buildAndDeploy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAKjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAGnD,wBAAsB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CA8BvF;AACD,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAQtF"}
+{"version":3,"file":"buildAndDeploy.d.ts","sourceRoot":"","sources":["../../../src/cli/deploy/buildAndDeploy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAKjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAInD,wBAAsB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CA+BvF;AACD,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAQtF"}

package/dist/cli/dev.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dev.d.ts","sourceRoot":"","sources":["../../src/cli/dev.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AASpC,MAAM,CAAC,OAAO,WAAW,OAAO,EAAE,OAAO,GAAG,IAAI,CA+G/C"}
+{"version":3,"file":"dev.d.ts","sourceRoot":"","sources":["../../src/cli/dev.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAUpC,MAAM,CAAC,OAAO,WAAW,OAAO,EAAE,OAAO,GAAG,IAAI,CAoH/C"}

package/dist/cli/init/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/cli/init/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAcpC,MAAM,CAAC,OAAO,cAAc,OAAO,CAoElC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/cli/init/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAepC,MAAM,CAAC,OAAO,cAAc,OAAO,CA+DlC"}

package/dist/cli/rbacModeWarning.d.ts

@@ -0,0 +1,3 @@
+export declare const ADMIN_RBAC_WARNING: string;
+export declare function warnIfAdminRbac(rbacMode?: string): void;
+//# sourceMappingURL=rbacModeWarning.d.ts.map

package/dist/cli/rbacModeWarning.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rbacModeWarning.d.ts","sourceRoot":"","sources":["../../src/cli/rbacModeWarning.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,kBAAkB,QAGiC,CAAC;AAEjE,wBAAgB,eAAe,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAIvD"}

package/dist/cli.js

@@ -9676,7 +9676,7 @@ var packageJSON = {
     "!src/fixtures/**",
     "!dist/**/*.test.d.ts*"
   ],
-  version: "2.0.2",
+  version: "2.0.4",
   main: "dist/lib.js",
   types: "dist/lib.d.ts",
   scripts: {
@@ -9728,8 +9728,8 @@ var packageJSON = {
     ramda: "0.32.0"
   },
   devDependencies: {
-    "@commitlint/cli": "21.2.2",
-    "@commitlint/config-conventional": "21.2.2",
+    "@commitlint/cli": "21.2.3",
+    "@commitlint/config-conventional": "21.2.3",
     "@eslint/eslintrc": "^3.3.6",
     "@eslint/js": "^10.0.1",
     "@types/command-line-args": "^5.2.3",
@@ -9752,12 +9752,12 @@ var packageJSON = {
     selfsigned: "^5.5.0",
     shellcheck: "^4.1.0",
     tsx: "^4.20.3",
-    undici: "8.10.2",
+    undici: "8.12.0",
     vitest: "^4.0.4"
   },
   overrides: {
-    "brace-expansion": "^5.0.9",
-    "ip-address": "^10.5.0",
+    "brace-expansion": "^5.0.12",
+    "ip-address": "^10.7.4",
     tar: "^7.5.16",
     "fast-uri": "^3.1.7"
   },
@@ -10083,6 +10083,16 @@ function handleModuleBuildError(e) {
 
 // src/cli/build/index.ts
 var import_path5 = require("path");
+
+// src/cli/rbacModeWarning.ts
+var ADMIN_RBAC_WARNING = "Admin RBAC mode grants broad cluster-wide permissions. It is intended for demo/POC purposes only and should NOT be used in production. Use scoped RBAC mode for production workloads. See https://docs.pepr.dev/user-guide/rbac/ for more details.";
+function warnIfAdminRbac(rbacMode) {
+  if (rbacMode !== "scoped") {
+    logger_default.warn(ADMIN_RBAC_WARNING);
+  }
+}
+
+// src/cli/build/index.ts
 async function generateDeploymentAssets(buildResult, opts, outputDir) {
   const { cfg, path: path4 } = buildResult;
   const image = assignImage({
@@ -10186,6 +10196,7 @@ function build_default(program2) {
       logger_default.info(`Module built successfully at ${path4}`);
       return;
     }
+    warnIfAdminRbac(determineRbacMode(opts, buildModuleResult.cfg));
     await generateDeploymentAssets(buildModuleResult, opts, outputDir);
   });
 }
@@ -10477,6 +10488,7 @@ async function buildAndDeployModule(image, force) {
     validateNamespaces(capability, webhook);
   }
   try {
+    warnIfAdminRbac(builtModule.cfg.pepr.rbacMode);
     await webhook.deploy(deployWebhook, force, builtModule.cfg.pepr.webhookTimeout ?? 10);
     validateCapabilityNames(webhook.capabilities);
     await namespaceDeploymentsReady();
@@ -10547,11 +10559,16 @@ function dev_default(program2) {
     await import_fs10.promises.writeFile("insecure-tls.key", webhook.tls.pem.key);
     try {
       let program3;
+      let hasWarnedAboutAdminRbac = false;
       const name2 = `pepr-${cfg.pepr.uuid}`;
       const scheduleStore = `pepr-${cfg.pepr.uuid}-schedule`;
       const store = `pepr-${cfg.pepr.uuid}-store`;
       const runFork = async () => {
         logger_default.info(`Running module ${path4}`);
+        if (!hasWarnedAboutAdminRbac) {
+          warnIfAdminRbac(cfg.pepr.rbacMode);
+          hasWarnedAboutAdminRbac = true;
+        }
         await webhook.deploy(deployWebhook, false, 30);
         try {
           validateCapabilityNames(webhook.capabilities);
@@ -10939,9 +10956,7 @@ function init_default() {
           doPostInitActions(dirName);
         }
         logger_default.info(`New Pepr module created at ${dirName}`);
-        logger_default.warn(
-          `The default RBAC mode (admin) generates a ClusterRole with cluster-admin level permissions for the hello-pepr capability. This is intended for demo/POC purposes only and should NOT be used in production.See https://docs.pepr.dev/user-guide/rbac/ for more details.`
-        );
+        warnIfAdminRbac(packageJSON2.data.pepr.rbacMode);
         logger_default.info(`Open VSCode or your editor of choice in ${dirName} to get started!`);
       } catch (error) {
         throw new Error(`Error creating Pepr module:`, { cause: error });

package/dist/controller.js

@@ -78,7 +78,7 @@ var packageJSON = {
     "!src/fixtures/**",
     "!dist/**/*.test.d.ts*"
   ],
-  version: "2.0.2",
+  version: "2.0.4",
   main: "dist/lib.js",
   types: "dist/lib.d.ts",
   scripts: {
@@ -130,8 +130,8 @@ var packageJSON = {
     ramda: "0.32.0"
   },
   devDependencies: {
-    "@commitlint/cli": "21.2.2",
-    "@commitlint/config-conventional": "21.2.2",
+    "@commitlint/cli": "21.2.3",
+    "@commitlint/config-conventional": "21.2.3",
     "@eslint/eslintrc": "^3.3.6",
     "@eslint/js": "^10.0.1",
     "@types/command-line-args": "^5.2.3",
@@ -154,12 +154,12 @@ var packageJSON = {
     selfsigned: "^5.5.0",
     shellcheck: "^4.1.0",
     tsx: "^4.20.3",
-    undici: "8.10.2",
+    undici: "8.12.0",
     vitest: "^4.0.4"
   },
   overrides: {
-    "brace-expansion": "^5.0.9",
-    "ip-address": "^10.5.0",
+    "brace-expansion": "^5.0.12",
+    "ip-address": "^10.7.4",
     tar: "^7.5.16",
     "fast-uri": "^3.1.7"
   },

package/package.json

@@ -16,7 +16,7 @@
     "!src/fixtures/**",
     "!dist/**/*.test.d.ts*"
   ],
-  "version": "2.0.2",
+  "version": "2.0.4",
   "main": "dist/lib.js",
   "types": "dist/lib.d.ts",
   "scripts": {
@@ -68,8 +68,8 @@
     "ramda": "0.32.0"
   },
   "devDependencies": {
-    "@commitlint/cli": "21.2.2",
-    "@commitlint/config-conventional": "21.2.2",
+    "@commitlint/cli": "21.2.3",
+    "@commitlint/config-conventional": "21.2.3",
     "@eslint/eslintrc": "^3.3.6",
     "@eslint/js": "^10.0.1",
     "@types/command-line-args": "^5.2.3",
@@ -92,12 +92,12 @@
     "selfsigned": "^5.5.0",
     "shellcheck": "^4.1.0",
     "tsx": "^4.20.3",
-    "undici": "8.10.2",
+    "undici": "8.12.0",
     "vitest": "^4.0.4"
   },
   "overrides": {
-    "brace-expansion": "^5.0.9",
-    "ip-address": "^10.5.0",
+    "brace-expansion": "^5.0.12",
+    "ip-address": "^10.7.4",
     "tar": "^7.5.16",
     "fast-uri": "^3.1.7"
   },

package/src/cli/build/index.ts

@@ -19,6 +19,7 @@ import {
 import { buildModule, BuildModuleReturn } from "./buildModule";
 import Log from "../../lib/telemetry/logger";
 import { resolve } from "path";
+import { warnIfAdminRbac } from "../rbacModeWarning";
 
 interface BuildOpts {
   customName?: string;
@@ -172,6 +173,7 @@ export default function (program: Command): void {
         return;
       }
 
+      warnIfAdminRbac(determineRbacMode(opts, buildModuleResult.cfg));
       await generateDeploymentAssets(buildModuleResult, opts, outputDir);
     });
 }

package/src/cli/deploy/buildAndDeploy.ts

@@ -5,6 +5,7 @@ import { namespaceDeploymentsReady } from "../../lib/deploymentChecks";
 import { namespaceComplianceValidator, validateCapabilityNames } from "../../lib/helpers";
 import { CapabilityExport } from "../../lib/types";
 import { buildModule } from "../build/buildModule";
+import { warnIfAdminRbac } from "../rbacModeWarning";
 
 export async function buildAndDeployModule(image: string, force: boolean): Promise<void> {
   const builtModule = await buildModule("dist", {});
@@ -24,6 +25,7 @@ export async function buildAndDeployModule(image: string, force: boolean): Promi
     validateNamespaces(capability, webhook);
   }
   try {
+    warnIfAdminRbac(builtModule.cfg.pepr.rbacMode);
     await webhook.deploy(deployWebhook, force, builtModule.cfg.pepr.webhookTimeout ?? 10);
 
     // wait for capabilities to be loaded and test names

package/src/cli/dev.ts

@@ -13,6 +13,7 @@ import { deployWebhook } from "../lib/assets/deploy";
 import { promises as fs } from "fs";
 import { validateCapabilityNames } from "../lib/helpers";
 import Log from "../lib/telemetry/logger";
+import { warnIfAdminRbac } from "./rbacModeWarning";
 
 export default function (program: Command): void {
   program
@@ -56,6 +57,7 @@ export default function (program: Command): void {
 
       try {
         let program: ChildProcess;
+        let hasWarnedAboutAdminRbac = false;
         const name = `pepr-${cfg.pepr.uuid}`;
         const scheduleStore = `pepr-${cfg.pepr.uuid}-schedule`;
         const store = `pepr-${cfg.pepr.uuid}-store`;
@@ -65,6 +67,10 @@ export default function (program: Command): void {
           Log.info(`Running module ${path}`);
 
           // Deploy the webhook with a 30 second timeout for debugging, don't force
+          if (!hasWarnedAboutAdminRbac) {
+            warnIfAdminRbac(cfg.pepr.rbacMode);
+            hasWarnedAboutAdminRbac = true;
+          }
           await webhook.deploy(deployWebhook, false, 30);
 
           try {

package/src/cli/init/index.ts

@@ -14,6 +14,7 @@ import { createProjectFiles } from "./createProjectFiles";
 import { v4 as uuidv4 } from "uuid";
 import Log from "../../lib/telemetry/logger";
 import { sanitizeResourceName } from "../../sdk/sdk";
+import { warnIfAdminRbac } from "../rbacModeWarning";
 
 export default function (): Command {
   let response = {} as PromptOptions;
@@ -71,12 +72,7 @@ export default function (): Command {
           }
 
           Log.info(`New Pepr module created at ${dirName}`);
-          Log.warn(
-            `The default RBAC mode (admin) generates a ClusterRole with cluster-admin level ` +
-              `permissions for the hello-pepr capability. This is intended for demo/POC purposes only ` +
-              `and should NOT be used in production.` +
-              `See https://docs.pepr.dev/user-guide/rbac/ for more details.`,
-          );
+          warnIfAdminRbac(packageJSON.data.pepr.rbacMode);
           Log.info(`Open VSCode or your editor of choice in ${dirName} to get started!`);
         } catch (error) {
           throw new Error(`Error creating Pepr module:`, { cause: error });

package/src/cli/rbacModeWarning.ts

@@ -0,0 +1,15 @@
+// SPDX-License-Identifier: Apache-2.0
+// SPDX-FileCopyrightText: 2023-Present The Pepr Authors
+
+import Log from "../lib/telemetry/logger";
+
+export const ADMIN_RBAC_WARNING =
+  "Admin RBAC mode grants broad cluster-wide permissions. It is intended for demo/POC purposes " +
+  "only and should NOT be used in production. Use scoped RBAC mode for production workloads. " +
+  "See https://docs.pepr.dev/user-guide/rbac/ for more details.";
+
+export function warnIfAdminRbac(rbacMode?: string): void {
+  if (rbacMode !== "scoped") {
+    Log.warn(ADMIN_RBAC_WARNING);
+  }
+}