unoverse 0.1.151 → 0.1.152

package/operator/lib/deploy.sh

@@ -577,6 +577,50 @@ _ensure_ground_config() {
 
 }
 
+# A CREDENTIAL FAILURE IS A SIGN-IN PROBLEM, NOT A TERRAFORM PROBLEM.
+#
+# The most common way an AWS deploy fails is an expired SSO token: it happens to every
+# operator, on a schedule, forever. Terraform reports it as a provider stack trace
+# (InvalidGrantException, "failed to refresh cached credentials"), which reads as a
+# broken setup and sends the operator debugging the wrong thing. Recognise the
+# signatures and answer with the fix instead of the trace.
+_plan_hit_credentials() {
+  local cloud="$1" log="$2"
+  if [ "$cloud" = "aws" ]; then
+    grep -qE "No valid credential sources|refresh cached SSO token|InvalidGrantException|ExpiredToken|InvalidClientTokenId|security token included in the request is (expired|invalid)" "$log"
+  else
+    grep -qE "Unable to authenticate you|invalid or missing.*token|401.*Unauthorized" "$log"
+  fi
+}
+
+_credentials_help() {
+  local cloud="$1"
+  echo ""
+  if [ "$cloud" = "aws" ]; then
+    fail "AWS did not accept your credentials, so nothing was changed."
+    echo ""
+    info "This is almost always an expired sign-in, not a broken setup:"
+    echo ""
+    echo -e "    Signed in with SSO?      ${BOLD}aws sso login${NC}${AWS_PROFILE:+ ${BOLD}--profile $AWS_PROFILE${NC}}  ${DIM}(tokens expire on a schedule; this is the usual fix)${NC}"
+    echo -e "    Profile not selected?    ${BOLD}export AWS_PROFILE=<name>${NC}  ${DIM}(currently: ${AWS_PROFILE:-not set})${NC}"
+    echo -e "    Using access keys?       ${BOLD}aws configure${NC}  ${DIM}(or export AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY)${NC}"
+    echo ""
+    info "Confirm it works, then deploy again:"
+    echo -e "    ${BOLD}aws sts get-caller-identity${NC}"
+    echo ""
+    echo -e "  ${DIM}Setting up AWS credentials for the first time:${NC}"
+    echo -e "  ${DIM}https://docs.aws.amazon.com/cli/latest/userguide/getting-started-quickstart.html${NC}"
+  else
+    fail "DigitalOcean did not accept your token, so nothing was changed."
+    echo ""
+    info "The API token is expired, revoked, or not set:"
+    echo ""
+    echo -e "    Mint one (Write scope):  ${BOLD}https://cloud.digitalocean.com/account/api/tokens${NC}"
+    echo -e "    Then provide it:         ${BOLD}export DIGITALOCEAN_TOKEN=<token>${NC}  ${DIM}(or do_token in terraform.tfvars)${NC}"
+  fi
+  echo ""
+}
+
 _ground_apply() {
   local cloud="$1" tmp planfile rc
   # SEPARATE STATEMENT. On macOS bash 3.2 a single `local a="$1" b="...$a"` expands $a
@@ -595,7 +639,13 @@ _ground_apply() {
   case "$rc" in
     0) rm -rf "$tmp"; return 3 ;;
     2) : ;;
-    *) fail "Terraform could not plan the change:"; tail -20 "$tmp/plan.log" | sed 's/^/      /'; rm -rf "$tmp"; return 1 ;;
+    *)
+      if _plan_hit_credentials "$cloud" "$tmp/plan.log"; then
+        _credentials_help "$cloud"
+      else
+        fail "Terraform could not plan the change:"; tail -20 "$tmp/plan.log" | sed 's/^/      /'
+      fi
+      rm -rf "$tmp"; return 1 ;;
   esac
 
   # STOPPING IS FOR LOSING SOMETHING, NOT FOR BUILDING IT. Typing `unoverse deploy` is

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unoverse",
-  "version": "0.1.151",
+  "version": "0.1.152",
   "description": "The Unoverse front door — create a Studio project, a universe, or a client app, and launch Studio.",
   "license": "SEE LICENSE IN README.md",
   "type": "module",