dh-cli 0.8.6__tar.gz → 0.8.8__tar.gz

{dh_cli-0.8.6 → dh_cli-0.8.8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dh-cli
-Version: 0.8.6
+Version: 0.8.8
 Summary: Dayhoff Labs developer CLI
 Author-email: Dayhoff Labs <dev@dayhofflabs.com>
 License: # PolyForm Noncommercial License 1.0.0

{dh_cli-0.8.6 → dh_cli-0.8.8}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "dh-cli"
-version = "0.8.6"
+version = "0.8.8"
 description = "Dayhoff Labs developer CLI"
 requires-python = ">=3.11"
 readme = "README.md"

{dh_cli-0.8.6 → dh_cli-0.8.8}/src/dh_cli/bedrock/commands.py

@@ -17,13 +17,30 @@ from __future__ import annotations
 
 import datetime as dt
 import json
+import re
 import sys
-from typing import Optional
+from typing import Optional, TypedDict
+from uuid import uuid4
 
 import click
 
+from dh_cli._identity import HandleResolutionError, resolve_handle_from_session
+from dh_cli.github_commands import _scrub_token
+
 from . import cost_report as cr
 
+
+class BedrockKeyPayload(TypedDict):
+    """The JSON shape stored in `cursor-bedrock/<handle>`."""
+
+    access_key_id: str
+    secret_access_key: str
+    region: str
+
+
+# Matches the admin SSO role within an assumed-role ARN.
+_ADMIN_ROLE_RE = re.compile(r"AWSReservedSSO_DevAdminAccess_")
+
 # Hard-coded for the dev account. Kept here (not as user-facing flags)
 # because they never change in practice and making every dev remember
 # them is the whole reason this command exists.
@@ -58,37 +75,21 @@ def bedrock():
 # --------------------------------------------------------------------------
 
 
-def _resolve_handle_from_sts() -> str:
-    """Pull the developer handle from the current SSO session.
-
-    A DeveloperAccess SSO caller identity looks like::
-
-        arn:aws:sts::074735440724:assumed-role/AWSReservedSSO_DeveloperAccess_<id>/<handle>
+def _resolve_handle() -> str:
+    """Resolve the developer handle from the current SSO session.
 
-    We return `<handle>`. Raises ClickException if STS fails or the ARN
-    shape isn't recognisable.
+    Thin wrapper around `_identity.resolve_handle_from_session` that
+    builds a boto3 Session and turns `HandleResolutionError` into a
+    `ClickException` so Click prints it cleanly. Shared with `dh gh`
+    via `_identity.py` so both commands behave identically when the
+    caller's session can't be classified.
     """
     import boto3
 
     try:
-        sts = boto3.client("sts")
-        arn = sts.get_caller_identity()["Arn"]
-    except Exception as exc:
-        raise click.ClickException(
-            f"Could not call sts:GetCallerIdentity to resolve your handle: {exc}\n"
-            "Run `awslogin dev-devaccess` (or pass --handle explicitly)."
-        )
-
-    principal = cr.classify_arn(arn)
-    # Accept any AWSReservedSSO_* session: DeveloperAccess,
-    # DevAdminAccess, SecurityAdministrator, etc. all carry the
-    # IdC username as the role-session-name, which is what we want
-    # as the developer handle.
-    if principal.principal_type in ("claude-code", "claude-code-other", "cursor"):
-        return principal.principal_name
-    raise click.ClickException(
-        f"Couldn't infer a developer handle from your identity ({arn}). Pass --handle explicitly."
-    )
+        return resolve_handle_from_session(boto3.Session())
+    except HandleResolutionError as exc:
+        raise click.ClickException(str(exc))
 
 
 # --------------------------------------------------------------------------
@@ -135,12 +136,21 @@ def bedrock_key(handle: Optional[str], region: str, mode: str):
     """
     import boto3
 
-    resolved = handle or _resolve_handle_from_sts()
+    resolved = handle or _resolve_handle()
     secret_id = f"{_SECRET_PREFIX}{resolved}"
 
+    sm = boto3.client("secretsmanager", region_name=region)
+    not_found = getattr(sm.exceptions, "ResourceNotFoundException", None)
+    if not (isinstance(not_found, type) and issubclass(not_found, BaseException)):
+        not_found = ()
     try:
-        sm = boto3.client("secretsmanager", region_name=region)
         resp = sm.get_secret_value(SecretId=secret_id)
+    except not_found:
+        raise click.ClickException(
+            f"No key yet for `{resolved}` (secret `{secret_id}` has no current "
+            f"version). Ask an admin to run `dh bedrock rotate --handle {resolved}` "
+            "to mint your first key."
+        )
     except Exception as exc:
         raise click.ClickException(
             f"Could not read secret `{secret_id}`: {exc}\n"
@@ -165,6 +175,107 @@ def bedrock_key(handle: Optional[str], region: str, mode: str):
         click.echo(json.dumps(payload, indent=2))
 
 
+# --------------------------------------------------------------------------
+# `dh bedrock rotate`
+# --------------------------------------------------------------------------
+
+
+@bedrock.command("rotate")
+@click.option(
+    "--handle",
+    "-u",
+    required=True,
+    help="Developer handle (e.g. 'dma'). Mints a key for `dev-cursor-<handle>`.",
+)
+@click.option(
+    "--region",
+    default=_DEFAULT_REGION,
+    show_default=True,
+    help="AWS region for the Secrets Manager secret.",
+)
+def bedrock_rotate(handle: str, region: str):
+    """Admin: mint a fresh Cursor Bedrock key for a developer.
+
+    Runs as `dev-admin`. Creates a new IAM access key for
+    `dev-cursor-<handle>`, writes it to `cursor-bedrock/<handle>`, then
+    deletes the prior key (delete-now).
+
+    \b
+    Examples:
+      dh bedrock rotate --handle dma
+    """
+    import boto3
+
+    user_name = f"dev-cursor-{handle}"
+    secret_id = f"{_SECRET_PREFIX}{handle}"
+
+    # Admin pre-check (defense-in-depth) — before any AWS mutation.
+    sts = boto3.Session().client("sts")
+    caller_arn = sts.get_caller_identity()["Arn"]
+    if not _ADMIN_ROLE_RE.search(caller_arn):
+        raise click.ClickException(
+            f"This command must be run as dev-admin (`awslogin dev-admin`). "
+            f"Current caller is not a DevAdminAccess role: {caller_arn}"
+        )
+
+    iam = boto3.client("iam")
+    sm = boto3.client("secretsmanager", region_name=region)
+
+    # Preflight — before create_access_key.
+    try:
+        resp = iam.list_access_keys(UserName=user_name)
+    except Exception as exc:
+        raise click.ClickException(
+            f"Could not list access keys for `{user_name}`: {exc}\n"
+            f"The IAM user may not exist yet — run `tfa` to provision it first."
+        )
+
+    prior_active_ids = [
+        meta["AccessKeyId"]
+        for meta in resp.get("AccessKeyMetadata", [])
+        if meta.get("Status") == "Active"
+    ]
+    if len(prior_active_ids) >= 2:
+        raise click.ClickException(
+            f"`{user_name}` already has 2 active keys (the IAM per-user limit). "
+            f"Delete one before rotating."
+        )
+
+    # Transaction: create → put → delete prior.
+    create_resp = iam.create_access_key(UserName=user_name)
+    new_akid = create_resp["AccessKey"]["AccessKeyId"]
+    new_secret = create_resp["AccessKey"]["SecretAccessKey"]
+
+    payload: BedrockKeyPayload = {
+        "access_key_id": new_akid,
+        "secret_access_key": new_secret,
+        "region": region,
+    }
+    try:
+        sm.put_secret_value(
+            SecretId=secret_id,
+            SecretString=json.dumps(payload),
+            ClientRequestToken=uuid4().hex,
+        )
+    except Exception as exc:
+        # Roll back the just-created key. Scrub the secret BEFORE building
+        # the message so the ClickException output can never leak it.
+        iam.delete_access_key(UserName=user_name, AccessKeyId=new_akid)
+        scrubbed = _scrub_token(str(exc), new_secret)
+        raise click.ClickException(
+            f"PutSecretValue failed for `{secret_id}`; rolled back new key "
+            f"{new_akid}. No prior key was deleted. Error: {scrubbed}"
+        )
+
+    # Only after put succeeds: delete prior active keys (not the new one).
+    for old_id in prior_active_ids:
+        if old_id == new_akid:
+            continue
+        iam.delete_access_key(UserName=user_name, AccessKeyId=old_id)
+
+    click.echo(f"Rotated `{secret_id}`. New access_key_id: {new_akid}")
+
+
 # --------------------------------------------------------------------------
 # `dh bedrock cost`
 # --------------------------------------------------------------------------
@@ -316,7 +427,7 @@ def bedrock_cost(
 
     my_handle: Optional[str] = None
     if me:
-        my_handle = _resolve_handle_from_sts()
+        my_handle = _resolve_handle()
 
     try:
         records = cr.walk_logs(

{dh_cli-0.8.6 → dh_cli-0.8.8}/tests/bedrock/test_cost_command.py

@@ -23,15 +23,32 @@ def _sts_stub(arn: str = _DEV_ARN):
     return sts
 
 
+def _session_stub(sts: MagicMock) -> MagicMock:
+    """boto3.Session() stub whose .client('sts') returns `sts`.
+
+    `_resolve_handle` (used by `bedrock_cost --me`) goes through
+    `_identity.resolve_handle_from_session(boto3.Session())`, which
+    calls `session.client('sts')`. The S3 client used by walk_logs
+    still goes through `boto3.client('s3', ...)` directly, which is
+    patched separately.
+    """
+    session = MagicMock()
+    session.client.return_value = sts
+    return session
+
+
 def _patch_boto3(sts=None):
+    sts_stub = sts or _sts_stub()
+
     def _client(name, **_kwargs):
         if name == "s3":
             return MagicMock()
-        if name == "sts":
-            return sts or _sts_stub()
-        raise AssertionError(f"unexpected boto3 client: {name}")
+        raise AssertionError(f"unexpected boto3.client call: {name}")
 
-    return patch("boto3.client", side_effect=_client)
+    return (
+        patch("boto3.Session", return_value=_session_stub(sts_stub)),
+        patch("boto3.client", side_effect=_client),
+    )
 
 
 def _invoke(args):
@@ -55,8 +72,10 @@ def test_cost_default_window_is_last_seven_days_ending_today_utc(load_fixture):
         captured_kwargs.update(kwargs)
         return iter([load_fixture("A_cache_write.json")])
 
+    p_sess, p_cli = _patch_boto3()
     with (
-        _patch_boto3(),
+        p_sess,
+        p_cli,
         patch("dh_cli.bedrock.cost_report.walk_logs", side_effect=_walk_stub),
         patch(
             "dh_cli.bedrock.cost_report.fetch_cost_explorer_total",
@@ -80,8 +99,10 @@ def test_cost_default_window_is_last_seven_days_ending_today_utc(load_fixture):
 
 def test_cost_explicit_past_end_runs_ce_reconcile(load_fixture):
     """When --end is in the past, CE reconcile runs as before."""
+    p_sess, p_cli = _patch_boto3()
     with (
-        _patch_boto3(),
+        p_sess,
+        p_cli,
         patch("dh_cli.bedrock.cost_report.walk_logs") as walk,
         patch(
             "dh_cli.bedrock.cost_report.fetch_cost_explorer_total",
@@ -118,8 +139,10 @@ def test_cost_me_filters_by_caller_handle_for_principal_type_grouping(load_fixtu
             ]
         )
 
+    p_sess, p_cli = _patch_boto3(sts=_sts_stub(_DEV_ARN))
     with (
-        _patch_boto3(sts=_sts_stub(_DEV_ARN)),
+        p_sess,
+        p_cli,
         patch("dh_cli.bedrock.cost_report.walk_logs", side_effect=_walk_stub),
         patch(
             "dh_cli.bedrock.cost_report.fetch_cost_explorer_total",

dh_cli-0.8.8/tests/bedrock/test_cursor_bedrock_isolation.py

@@ -0,0 +1,271 @@
+"""Invariant test: the per-user Cursor Bedrock secret policy isolates
+devs on BOTH the read and write planes.
+
+Runs nightly against dev via `iam:SimulatePrincipalPolicy`. A future
+Terraform change that drops the `DenyNonOwnerDataAccess` write actions,
+the `ArnNotLike` admin carve-out, or the `AllowAdminRotate` statement
+will fail this within 24 hours.
+
+This is the behavioral counterpart to `verify_cursor_keys.sh`, which
+only checks the policy *shape* (and runs as admin, whose identity policy
+bypasses the resource policy, so it cannot prove the deny actually
+fires). Mirrors `tests/github/test_engine_role_cannot_read_github_pat.py`,
+with one important difference:
+
+- The github engine-role test simulates an *identity* policy only and
+  asserts `implicitDeny` (the role simply has no grant). THIS test
+  exercises the secret's *resource-based* policy and asserts
+  `explicitDeny` for the cross-user data actions (the resource-policy
+  deny actively fires) and `allowed` for owner-read / admin-write.
+
+SimulatePrincipalPolicy + resource-policy nuance (confirmed against the
+boto3 docs while implementing):
+
+- The simulator does NOT auto-fetch a resource's policy; it must be
+  passed as the `ResourcePolicy` string. We fetch the live policy via
+  `secretsmanager:GetResourcePolicy` so the test tracks whatever
+  Terraform actually applied (not a hard-coded copy).
+- Resource-policy evaluation in the simulator is only wired up cleanly
+  for IAM *users*, not roles. Our principals are SSO permission-set
+  *roles*, so we drive the decision purely from the resource policy +
+  `ContextEntries` (`aws:userid`, `aws:PrincipalArn`,
+  `aws:MultiFactorAuthPresent`) and pass a real principal ARN as
+  `CallerArn`. The identity-policy side (DeveloperAccess's broad
+  `cursor-bedrock/*` grant) is what the resource-policy deny is the
+  belt-and-suspenders for; here we assert the resource policy in
+  isolation, which is the statement under test.
+- `ResourceOwner` is the dev account, since the simulated secret ARN
+  carries the account already but the resource policy is supplied
+  out-of-band.
+
+Fallback if the simulator ever stops honoring `ResourcePolicy` for
+`secretsmanager:*` (as it does for `sts:Assume*`): the operator's live
+owner/non-owner `aws secretsmanager get-secret-value` /
+`put-secret-value` probes (run under the respective SSO sessions) are
+the ground-truth backstop; see `blueprints/scripts/bedrock/README.md`.
+
+Marked `integration` so it doesn't run in the default `pytest` unit
+suite (no AWS creds in CI runners).
+"""
+
+from __future__ import annotations
+
+import os
+
+import pytest
+
+ACCOUNT_ID = "074735440724"
+REGION = "us-east-1"
+
+# A non-owner DeveloperAccess role ARN (the principal whose cross-user
+# access must be denied) and a DevAdminAccess role ARN (the rotate
+# principal whose write must be allowed). Plus the owner handle for the
+# allowed-read case. Set these to run the guard; unset => skip.
+#
+# IMPORTANT: `simulate_principal_policy` honors a `ResourcePolicy` /
+# accepts a `CallerArn` only for IAM *user* sources, not assumed-role
+# ARNs. The deny/allow conditions key on `aws:userid` / `aws:PrincipalArn`
+# which we supply via ContextEntries regardless, so point these at IAM
+# user ARNs that the simulator will accept (the decision is driven by the
+# resource policy + context, not by the source identity's own policies).
+# If only SSO role ARNs are available and the simulator rejects them,
+# fall back to the live owner/non-owner probes documented in the runbook.
+NONOWNER_DEV_ROLE_ARN_ENV = "DH_BEDROCK_NONOWNER_DEV_ROLE_ARN"
+ADMIN_ROLE_ARN_ENV = "DH_BEDROCK_ADMIN_ROLE_ARN"
+OWNER_HANDLE_ENV = "DH_BEDROCK_OWNER_HANDLE"
+
+# The handle whose secret the non-owner principal tries to touch. Any
+# handle that is NOT the non-owner's own session name works; default to a
+# real per-user handle from cursor_bedrock_users.
+OTHER_HANDLE = os.environ.get("DH_BEDROCK_OTHER_HANDLE", "toni")
+
+
+def _secret_arn(handle: str) -> str:
+    return f"arn:aws:secretsmanager:{REGION}:{ACCOUNT_ID}:secret:cursor-bedrock/{handle}"
+
+
+def _role_unique_id(role_arn: str) -> str:
+    """`aws:userid` for an assumed SSO role is `<role-unique-id>:<session>`.
+
+    We don't have the role's unique id from the ARN alone, so we resolve
+    it from IAM. Tests that only need `aws:PrincipalArn` (the
+    cross-user/admin cases keyed on the role ARN) don't call this.
+    """
+    import boto3
+
+    role_name = role_arn.split("/")[-1]
+    iam = boto3.client("iam")
+    return iam.get_role(RoleName=role_name)["Role"]["RoleId"]
+
+
+def _fetch_resource_policy(handle: str) -> str:
+    import boto3
+
+    sm = boto3.client("secretsmanager", region_name=REGION)
+    resp = sm.get_resource_policy(SecretId=f"cursor-bedrock/{handle}")
+    policy = resp.get("ResourcePolicy")
+    if not policy:
+        pytest.skip(f"cursor-bedrock/{handle} has no resource policy attached")
+    return policy
+
+
+def _simulate(
+    *,
+    caller_arn: str,
+    action: str,
+    resource_arn: str,
+    resource_policy: str,
+    context_entries: list[dict],
+) -> str:
+    import boto3
+
+    iam = boto3.client("iam")
+    result = iam.simulate_principal_policy(
+        PolicySourceArn=caller_arn,
+        ActionNames=[action],
+        ResourceArns=[resource_arn],
+        ResourcePolicy=resource_policy,
+        ResourceOwner=ACCOUNT_ID,
+        CallerArn=caller_arn,
+        ContextEntries=context_entries,
+    )
+    return result["EvaluationResults"][0]["EvalDecision"]
+
+
+def _ctx(principal_arn: str, userid: str) -> list[dict]:
+    return [
+        {
+            "ContextKeyName": "aws:PrincipalArn",
+            "ContextKeyValues": [principal_arn],
+            "ContextKeyType": "string",
+        },
+        {
+            "ContextKeyName": "aws:userid",
+            "ContextKeyValues": [userid],
+            "ContextKeyType": "string",
+        },
+        {
+            "ContextKeyName": "aws:MultiFactorAuthPresent",
+            "ContextKeyValues": ["true"],
+            "ContextKeyType": "boolean",
+        },
+    ]
+
+
+def _require(env_var: str) -> str:
+    value = os.environ.get(env_var)
+    if not value:
+        pytest.skip(
+            f"Set {env_var} (and the other DH_BEDROCK_* role ARNs / owner "
+            f"handle) to run the Cursor Bedrock isolation guard."
+        )
+    return value
+
+
+@pytest.mark.integration
+def test_non_owner_developer_denied_get():
+    """A DeveloperAccess non-owner is explicitly denied GetSecretValue on
+    another user's cursor-bedrock secret (DenyNonOwnerDataAccess fires)."""
+    dev_arn = _require(NONOWNER_DEV_ROLE_ARN_ENV)
+    policy = _fetch_resource_policy(OTHER_HANDLE)
+    # Session name deliberately != OTHER_HANDLE so the userid doesn't match.
+    decision = _simulate(
+        caller_arn=dev_arn,
+        action="secretsmanager:GetSecretValue",
+        resource_arn=_secret_arn(OTHER_HANDLE),
+        resource_policy=policy,
+        context_entries=_ctx(dev_arn, "AROANONOWNERDEV:intruder"),
+    )
+    assert decision == "explicitDeny", (
+        f"A non-owner DeveloperAccess principal must be explicitly denied "
+        f"GetSecretValue on cursor-bedrock/{OTHER_HANDLE}; got {decision}. "
+        f"DenyNonOwnerDataAccess (read plane) regressed."
+    )
+
+
+@pytest.mark.integration
+def test_non_owner_developer_denied_put():
+    """Write-plane isolation: a non-owner non-admin is explicitly denied
+    PutSecretValue (cannot overwrite another dev's key)."""
+    dev_arn = _require(NONOWNER_DEV_ROLE_ARN_ENV)
+    policy = _fetch_resource_policy(OTHER_HANDLE)
+    decision = _simulate(
+        caller_arn=dev_arn,
+        action="secretsmanager:PutSecretValue",
+        resource_arn=_secret_arn(OTHER_HANDLE),
+        resource_policy=policy,
+        context_entries=_ctx(dev_arn, "AROANONOWNERDEV:intruder"),
+    )
+    assert decision == "explicitDeny", (
+        f"A non-owner DeveloperAccess principal must be explicitly denied "
+        f"PutSecretValue on cursor-bedrock/{OTHER_HANDLE}; got {decision}. "
+        f"The write-hole (Council C1) reopened."
+    )
+
+
+@pytest.mark.integration
+def test_non_owner_developer_denied_update_stage():
+    """Write-plane isolation: a non-owner non-admin is explicitly denied
+    UpdateSecretVersionStage."""
+    dev_arn = _require(NONOWNER_DEV_ROLE_ARN_ENV)
+    policy = _fetch_resource_policy(OTHER_HANDLE)
+    decision = _simulate(
+        caller_arn=dev_arn,
+        action="secretsmanager:UpdateSecretVersionStage",
+        resource_arn=_secret_arn(OTHER_HANDLE),
+        resource_policy=policy,
+        context_entries=_ctx(dev_arn, "AROANONOWNERDEV:intruder"),
+    )
+    assert decision == "explicitDeny", (
+        f"A non-owner DeveloperAccess principal must be explicitly denied "
+        f"UpdateSecretVersionStage on cursor-bedrock/{OTHER_HANDLE}; got "
+        f"{decision}. DenyNonOwnerDataAccess (write plane) regressed."
+    )
+
+
+@pytest.mark.integration
+def test_owner_developer_allowed_get():
+    """The owner reading their OWN secret is allowed. The match is on
+    aws:userid StringLike "*:<owner>", so the simulated session name must
+    equal the owner handle and the resolved role unique-id is its prefix."""
+    dev_arn = _require(NONOWNER_DEV_ROLE_ARN_ENV)
+    owner = _require(OWNER_HANDLE_ENV)
+    policy = _fetch_resource_policy(owner)
+    role_id = _role_unique_id(dev_arn)
+    decision = _simulate(
+        caller_arn=dev_arn,
+        action="secretsmanager:GetSecretValue",
+        resource_arn=_secret_arn(owner),
+        resource_policy=policy,
+        # userid ends in ":<owner>" (matches AllowOwnerSSORead StringLike).
+        context_entries=_ctx(dev_arn, f"{role_id}:{owner}"),
+    )
+    assert decision == "allowed", (
+        f"The owner reading cursor-bedrock/{owner} under their own SSO "
+        f"session must be allowed; got {decision}. AllowOwnerSSORead "
+        f"regressed (or the deny over-fires on the owner)."
+    )
+
+
+@pytest.mark.integration
+def test_admin_allowed_put():
+    """The DevAdminAccess rotate role writing another user's secret is
+    allowed: AllowAdminRotate fires and the deny's ArnNotLike carve-out
+    lets it through."""
+    admin_arn = _require(ADMIN_ROLE_ARN_ENV)
+    policy = _fetch_resource_policy(OTHER_HANDLE)
+    decision = _simulate(
+        caller_arn=admin_arn,
+        action="secretsmanager:PutSecretValue",
+        resource_arn=_secret_arn(OTHER_HANDLE),
+        resource_policy=policy,
+        # Admin session name != OTHER_HANDLE; the allow is keyed on the
+        # admin's aws:PrincipalArn, not userid.
+        context_entries=_ctx(admin_arn, "AROADMIN:dma"),
+    )
+    assert decision == "allowed", (
+        f"The DevAdminAccess rotate role must be allowed PutSecretValue on "
+        f"cursor-bedrock/{OTHER_HANDLE}; got {decision}. Either "
+        f"AllowAdminRotate or the DenyNonOwnerDataAccess ArnNotLike "
+        f"carve-out regressed — `dh bedrock rotate` would break."
+    )