nate2-scripts 1.0.3__tar.gz → 2.0.0__tar.gz

{nate2_scripts-1.0.3 → nate2_scripts-2.0.0}/.gitignore

@@ -1,3 +1,4 @@
 __pycache__
 dist
-.vscode
+.vscode
+uv.lock

{nate2_scripts-1.0.3 → nate2_scripts-2.0.0}/PKG-INFO

@@ -1,9 +1,13 @@
 Metadata-Version: 2.5
 Name: nate2-scripts
-Version: 1.0.3
+Version: 2.0.0
 Summary: Utility scripts for AWS development on macOS
 Project-URL: Homepage, https://github.com/tennex-nwestfall/nate2-scripts
 License-File: LICENSE
 Requires-Python: >=3.11
 Requires-Dist: argcomplete
 Requires-Dist: boto3
+Provides-Extra: dev
+Requires-Dist: boto3-stubs[essential]; extra == 'dev'
+Requires-Dist: moto[all]; extra == 'dev'
+Requires-Dist: pytest; extra == 'dev'

nate2_scripts-2.0.0/README.md

@@ -0,0 +1,204 @@
+[![PyPI version](https://img.shields.io/pypi/v/nate2-scripts)](https://pypi.org/project/nate2-scripts/)
+[![License](https://img.shields.io/github/license/tennex-nwestfall/nate2-scripts)](https://github.com/tennex-nwestfall/nate2-scripts/blob/main/LICENSE)
+
+# Nate2's Scripts
+
+Utility scripts for AWS development on macOS.
+
+To install run:
+
+```bash
+pip install nate2-scripts
+```
+
+To update run:
+
+```bash
+pip install --upgrade nate2-scripts
+```
+
+## Scripts
+
+### `console`
+
+Opens the AWS Management Console in your browser for a specific service, ARN, resource id, or resource name, using federated sign-in from your current AWS credentials. Supports multi-session via searching browser history sqlite databases.
+
+**Requirements:**
+
+- `AWS_PROFILE` set (e.g. via `asp`)
+- `git config user.email` set — it is used as the `role_session_name` for every assume-role profile
+
+**Example Alias:**
+
+```bash
+# noglob is so that one can paste in logs arns that end with :*
+# otherwise zsh tries to see the log arn as a glob and fails
+alias co="noglob console"
+# needed for autocomplete
+eval "$(register-python-argcomplete console)"
+```
+
+**Usage:**
+
+```bash
+console [service | arn | id | name] [search ...] [-r REGION] [-f]
+```
+
+```bash
+# change to an account/role
+asp my-aws-role
+
+# open main page of the role/account
+console
+# open ec2 page of the role/account
+console ec2
+# open lambda page of the role/account in us-west-2
+console lambda -r us-west-2
+# open a service page filtered by search terms (multiple words are joined)
+console lambda my-function
+console logs /aws/lambda/my
+console cf my stack
+# open instance id page of the role/account in
+# whatever region that instance is in
+console i-0123456789abcdef
+# open an S3 bucket, prefix, or object
+console s3://my-bucket/some/prefix/
+# open a resource by name (log group, S3 bucket, EC2 Name tag,
+# CloudFormation stack, or Lambda function)
+console my-function
+# open the console page for the resource the ARN points to
+console arn:aws:ec2:us-east-1:012345678967:instance/i-0123456789abcdef
+# force a new federated sign-in (resets the session cache)
+console -f
+```
+
+**Options:**
+
+| Flag                    | Description                                                       |
+| ----------------------- | ----------------------------------------------------------------- |
+| `-r`, `--region <name>` | Region to open the console in; also added to the searched regions |
+| `-f`, `--force`         | Reset the session cache and force a new federated sign-in         |
+
+**Resolution order:**
+
+1. **ARN** — if the first argument parses as an ARN
+2. **Service** — if the first argument is a known service name or alias
+3. **Resource id** — if the first argument matches a known id pattern
+4. **Resource name** — looked up in parallel across all name-resolving services; the first match in priority order wins: CloudWatch log group → S3 bucket → EC2 `Name` tag → CloudFormation stack → Lambda function
+
+**Supported services** (aliases after the `/`):
+
+| Service                | Names                                     | Search terms |
+| ---------------------- | ----------------------------------------- | ------------ |
+| API Gateway            | `apigateway` / `api`                      |              |
+| Artifact               | `artifact`                                |              |
+| Athena                 | `athena`                                  |              |
+| Batch                  | `batch` / `job` / `jobs`                  |              |
+| Bedrock                | `bedrock` / `br`                          |              |
+| CloudFormation         | `cloudformation` / `cf`                   | ✓            |
+| CloudFront             | `cloudfront` / `front`                    |              |
+| CloudHSM               | `cloudhsm` / `hsm`                        |              |
+| CloudTrail             | `cloudtrail` / `ct`                       |              |
+| CloudWatch             | `cloudwatch` / `cw`                       |              |
+| CloudWatch Logs        | `logs`                                    | ✓            |
+| Cognito                | `cognito` / `cn`                          |              |
+| Config                 | `config` / `cfg`                          |              |
+| Control Tower          | `controltower`                            |              |
+| Cost Management        | `cost`                                    |              |
+| DynamoDB               | `dynamodb` / `dynamo` / `dyn`             |              |
+| EC2 instances          | `ec2`                                     | ✓            |
+| EC2 AMIs (owned by me) | `ami`                                     | ✓            |
+| ECR                    | `ecr` / `docker`                          |              |
+| ECS                    | `ecs` / `cluster` / `task` / `tasks`      |              |
+| EFS                    | `efs`                                     |              |
+| EKS                    | `eks`                                     |              |
+| Elastic Beanstalk      | `elasticbeanstalk` / `bean`               |              |
+| Elastic Load Balancing | `elb` / `alb`                             |              |
+| EventBridge            | `eventbridge` / `eb`                      |              |
+| FSx                    | `fsx`                                     |              |
+| Glue                   | `glue`                                    |              |
+| GuardDuty              | `guardduty` / `guard`                     |              |
+| IAM                    | `iam`                                     |              |
+| Inspector              | `inspector`                               |              |
+| KMS                    | `kms`                                     |              |
+| Lambda                 | `lambda`                                  | ✓            |
+| Lex                    | `lex`                                     |              |
+| Lightsail              | `lightsail` / `ls`                        |              |
+| Marketplace            | `marketplace` / `market` / `tennex`       | ✓            |
+| Polly                  | `polly`                                   |              |
+| RDS                    | `rds`                                     |              |
+| Route 53               | `route53` / `53`                          |              |
+| S3                     | `s3`                                      |              |
+| SageMaker              | `sagemaker` / `sage`                      |              |
+| Secrets Manager        | `secretsmanager` / `secretmanager` / `sm` |              |
+| Security groups        | `sg`                                      | ✓            |
+| SNS                    | `sns`                                     |              |
+| SQS                    | `sqs`                                     |              |
+| Step Functions         | `step`                                    |              |
+| Storage Gateway        | `storagegateway` / `sgw`                  |              |
+| Support                | `support`                                 |              |
+| Systems Manager        | `ssm`                                     |              |
+| SSM Parameter Store    | `parameter` / `ps`                        | ✓            |
+| VPC                    | `vpc`                                     |              |
+| VPC subnets            | `subnet`                                  |              |
+| VPC network ACLs       | `acl` / `nacl`                            |              |
+| VPC Elastic IPs        | `elasticip` / `eni`                       |              |
+| VPC route tables       | `routetable` / `routes`                   |              |
+| VPC internet gateways  | `internetgateway` / `internet` / `igw`    |              |
+| VPC NAT gateways       | `nat`                                     |              |
+| VPC endpoints          | `endpoints` / `end`                       |              |
+| VPC transit gateways   | `transitgateway` / `transit` / `tgw`      |              |
+
+`tennex` opens a Marketplace search for "tennex". Cost Management and Marketplace always open in `us-east-1`.
+
+**Supported resource ids:** `i-*` (EC2 instance), `sg-*` (security group), `ami-*`, `lt-*` (launch template), `vol-*` (EBS volume), `snap-*` (EBS snapshot), `eni-*` (network interface), `s3://bucket[/key]`
+
+**Supported ARNs:** `ec2` (instance), `lambda` (function), `logs` (log group, log stream), `s3` (bucket, prefix, object)
+
+**Cross-account ARNs:** if an ARN's account differs from the current one, `console` switches to the first profile in your AWS config whose `role_arn` is in that account.
+
+**Regions:** ids and names are searched across `us-east-1`, `us-east-2`, `us-west-1`, and `us-west-2`, plus the region passed with `-r`.
+
+**Session cache:** federated session hashes are cached per profile for 59 minutes in `$XDG_STATE_HOME/console-sessions.json` (default `~/.local/state/console-sessions.json`). Use `-f` to reset it.
+
+---
+
+### `bing-wrapper`
+
+A PTY wrapper that runs any command in a pseudo-terminal and plays a macOS system sound when a configurable output pattern is detected, and/or when the command finishes. Useful for long-running CLI tools (e.g. CDK deployments) that prompt for confirmation or take a while to complete.
+
+**Requirements:** None
+
+**Example Alias Usage:**
+
+```bash
+# wraps cdk to play Frog.aiff when done and play Glass.aiff (default) on "(y/n)" prompts
+alias cdk="bing-wrapper --end --pattern \"(y/n)\" --sound-end /System/Library/Sounds/Frog.aiff -- cdk"
+
+# wraps nextflow to play a sound when done
+alias nextflow="bing-wrapper --end -- nextflow"
+
+# needed for autocomplete of bing-wrapper and the inner command
+eval "$(bing-wrapper --autocomplete)"
+```
+
+**Options:**
+
+| Flag                     | Description                                               | Default      |
+| ------------------------ | --------------------------------------------------------- | ------------ |
+| `--end`                  | Play a sound when the command exits                       | off          |
+| `--pattern <text>`       | Play a sound when `<text>` appears in output (repeatable) | none         |
+| `--sound-end <path>`     | Sound file to play on exit                                | `Glass.aiff` |
+| `--sound-pattern <path>` | Sound file to play on pattern match                       | `Glass.aiff` |
+| `--sound-while <path>`   | Sound file to play on loop while the command runs         | none         |
+
+---
+
+## Development
+
+```bash
+pip install -e ".[dev]"
+pytest
+```
+
+Resolver tests live in `tests/console/resolvers/`, one module per service, and use `moto` to mock AWS.

nate2_scripts-2.0.0/i-want-to-refactor-fizzy-feather.md

@@ -0,0 +1,173 @@
+# Refactor console resolvers into per-service `Resolver` classes
+
+## Context
+
+The `console` command (entry point `nate2_scripts.console:main`) turns a user argument
+into an AWS console URL and opens it. Today the resolution logic lives in **three
+monolithic resolvers** plus a static service map, each of which handles *every* AWS
+service internally via large `match`/`if` ladders:
+
+- [destitationResolver.py](src/nate2_scripts/console/destitationResolver.py) — orchestrator + `_get_services()` static keyword→URL map
+- [arnResolver.py](src/nate2_scripts/console/arnResolver.py) — one class, ~15 `parse_*` methods for every ARN service
+- [nameResolver.py](src/nate2_scripts/console/nameResolver.py) — one class, parallel cross-service/region name lookup
+- [resourceIdResolver.py](src/nate2_scripts/console/resourceIdResolver.py) — one class, `match` over every id prefix
+
+The new target shape already exists in [resolvers/s3.py](src/nate2_scripts/console/resolvers/s3.py):
+a `Resolver` ABC ([resolvers/__init__.py](src/nate2_scripts/console/resolvers/__init__.py))
+with four dimensions — `try_resolve_name`, `try_resolve_arn`, `try_resolve_service`,
+`try_resolve_id` — and **one class per service** (`S3Resolver`) implementing all four,
+each returning `None` when the input isn't theirs.
+
+Goal: move all existing resolution logic into per-service `Resolver` subclasses following
+the `S3Resolver` pattern, wire a dispatcher that iterates them, and delete the three old
+monolith files. **Functionality stays the same** (same URLs, same parallel name search,
+same priority tie-breaking).
+
+## Key design points (settled)
+
+- **Granularity:** one class per service, splitting the ec2 namespace into a separate
+  `Ec2Resolver` (instances, AMIs, volumes, snapshots, launch templates, ENIs, security
+  groups) and `VpcResolver` (vpc, subnet, route table, nat gateway, acl).
+- **Static-only services** (cost, support, athena, ecr, bedrock, config, controltower,
+  cognito, cloudfront, route53, kms-link, storagegateway, fsx, ssm, parameter, cloudtrail,
+  tennex): each gets its **own** `Resolver` subclass. **No shared mixin/base** — every class
+  implements all four methods explicitly, with the three unused ones written out as
+  `return None`. `sns`, `sqs`, `ecs`, `eks` (and every other service) stay their own separate
+  classes; none are combined.
+- **Name lookup stays parallel + priority-ordered:** logs > s3 > ec2 > cloudformation >
+  lambda (existing order in [nameResolver.py:24](src/nate2_scripts/console/nameResolver.py#L24)).
+- **URL wrapping:** resolvers return a **bare host+path** (e.g. `console.aws.amazon.com/s3/...`
+  for global, `{region}.console.aws.amazon.com/...` for regional), exactly as `S3Resolver`
+  does. The **dispatcher** prepends `https://{mdn}`. `mdn` (multisession domain name) stays
+  out of `Context` — it's the dispatcher's concern.
+
+## Context object
+
+Extend `Context` in [resolvers/__init__.py](src/nate2_scripts/console/resolvers/__init__.py)
+so resolvers have what the monoliths used to pull from constructor args:
+
+```python
+class Context:
+    session: boto3.Session      # built from assumed creds in main()
+    default_region: str
+    regions: list[str]          # NEW — from RegionCache, for multi-region name/id search
+    current_account: str        # for arn.account access checks
+    profile: str
+```
+
+`session` replaces the bare `boto3.client(...)` calls in the old resolvers — every
+resolver uses `context.session.client(svc, region_name=region)`. In
+[console/__init__.py](src/nate2_scripts/console/__init__.py) `main()`, build the session
+from the `creds` already obtained via `get_credentials()` and populate `Context`.
+
+## New files (under `resolvers/`)
+
+Resource-resolving services (port the matching `parse_*` / `_resolve_*` bodies verbatim,
+swapping `boto3.client` → `context.session.client` and dropping the `https://{mdn}` prefix
+from returned strings so the dispatcher adds it):
+
+| File | Class | Dimensions ported from |
+|---|---|---|
+| `ec2.py` | `Ec2Resolver` | arn `instance`; ids `i-,sg-,ami-,lt-,vol-,snap-,eni-`; name tag:Name; service `ec2`,`sg`,`ami`,`elb`* |
+| `vpc.py` | `VpcResolver` | arn `subnet`,`natgateway`; ids `vpc-,subnet-,rtb-,nat-`; service `vpc`,`subnet`,`acl` |
+| `iam.py` | `IamResolver` | arn `role`,`user`; ids `role/`,`usr/`; service `iam` (global, us-east-1) |
+| `lambda.py` | `LambdaResolver` | arn `function`; name function; service `lambda` |
+| `logs.py` | `LogsResolver` | arn `log-group`; name log-group; service `logs`,`cw`,`cloudwatch` |
+| `cloudformation.py` | `CloudFormationResolver` | name stack; service `cf`,`cloudformation` |
+| `rds.py` | `RdsResolver` | arn `db`,`cluster`; service `rds` |
+| `secretsmanager.py` | `SecretsManagerResolver` | arn `secret`; service `sm`,`secretsmanager`,`secretmanager` |
+| `ecs.py` | `EcsResolver` | arn `cluster`,`service`,`task`,`task-definition`; service `ecs` |
+| `eks.py` | `EksResolver` | arn `cluster`; service `eks` |
+| `sns.py` | `SnsResolver` | arn topic; service `sns` |
+| `sqs.py` | `SqsResolver` | arn queue; service `sqs` |
+| `batch.py` | `BatchResolver` | arn `job-queue`,`compute-environment`,`job-definition`,`job`; service `batch` |
+| `dynamodb.py` | `DynamoDbResolver` | arn `table`; service `dynamo` |
+| `stepfunctions.py` | `StepFunctionsResolver` | arn `stateMachine`,`execution`; service `step` |
+| `elb.py` | `ElbResolver` | arn `loadbalancer`,`targetgroup`; service `elb` |
+
+*`elb`/`acl`/`ami`/`sg` service keywords are static list-view links — keep them on the
+resolver that owns that resource where natural, or in a static resolver; either is fine.
+
+Static-only resolvers (one class each): `cost.py`, `support.py`, `athena.py`, `ecr.py`,
+`bedrock.py`, `config.py`, `controltower.py`, `cognito.py`, `cloudfront.py`, `route53.py`,
+`kms.py`, `storagegateway.py`, `fsx.py`, `ssm.py`, `cloudtrail.py`, `tennex.py` — seeded
+from the remaining entries of `_get_services()` in
+[destitationResolver.py:60](src/nate2_scripts/console/destitationResolver.py#L60).
+**No shared base/mixin.** Each class implements `try_resolve_service` (matching its own
+keyword aliases) and writes out `try_resolve_name`, `try_resolve_arn`, `try_resolve_id` as
+explicit `return None`.
+
+## Dispatcher
+
+Rewrite [destitationResolver.py](src/nate2_scripts/console/destitationResolver.py)
+`parse_destination` (keep `DestinationResolver` name + `get_service_list()` so
+[console/__init__.py](src/nate2_scripts/console/__init__.py) callers are untouched) to hold
+an ordered `list[Resolver]` and dispatch:
+
+1. Empty arg → `https://{mdn}{default_region}.console.aws.amazon.com/`.
+2. `Arn.try_parse(arg)` succeeds → **ARN input is terminal.** Try each resolver's
+   `try_resolve_arn`; return the first non-None. If none resolve it, print an
+   ARN-specific error to stderr and `sys.exit(1)` — **do not** fall through to the
+   service/id/name steps below.
+3. `try_resolve_service(ctx, arg, search)` across resolvers → first non-None.
+4. Else `try_resolve_id(ctx, arg)` across resolvers → first non-None.
+5. Else **name** search: run each name-capable resolver's `try_resolve_name` concurrently
+   (`ThreadPoolExecutor`, reuse `MAX_THREADS`), collect by each resolver's priority index,
+   return the lowest-priority winner — preserving [nameResolver.py:33-48](src/nate2_scripts/console/nameResolver.py#L33-L48).
+   Each regional resolver loops `context.regions` internally.
+6. None matched → same stderr error + `sys.exit(1)`.
+
+Every returned bare path is wrapped as `https://{mdn}{path}` before returning.
+`get_service_list()` returns the union of every resolver's known service keywords (for
+argcomplete in [console/__init__.py:129](src/nate2_scripts/console/__init__.py#L129)).
+
+- **`search` is a real second positional CLI arg.** Add a `search` positional (`nargs="?"`,
+  default `""`) to `parse_args` in
+  [console/__init__.py:115](src/nate2_scripts/console/__init__.py#L115), pass it into
+  `parse_destination(service, region, search)`, and thread it through to
+  `try_resolve_service` and `try_resolve_name`. Usage becomes `console <service> <search>`
+  (e.g. `console ec2 <filter>`).
+- **Apply `search` to the URL when given and the target console supports it.** When
+  `search` is non-empty and the resolver's console view accepts a filter/search query
+  param, the resolver appends it (URL-encoded) so the console opens pre-filtered — e.g.
+  EC2 instances `...#Instances:search=<term>`, Lambda `...#/functions?fo=and&k0=...&v0=<term>`,
+  CloudWatch log-groups list, S3 object/bucket search, etc. Where a console view has no such
+  param (as noted in the `S3Resolver` comments), the resolver ignores `search` and returns
+  the plain URL. Each ported resolver decides per-view; an empty `search` always yields the
+  current (unfiltered) URL, preserving today's behavior. The exact query-param syntax per
+  service is verified against the live console during implementation.
+- `try_resolve_*` methods **return `None`** on any failure (matching `S3Resolver`), rather
+  than `sys.exit` mid-resolve as the old monoliths did. Net effect: the final "not found"
+  error is emitted once by the dispatcher. This drops a few service-specific error strings
+  (e.g. "current account X cannot access Y") in favor of the unified message — a deliberate
+  simplification consistent with the target pattern.
+
+## Cleanup
+
+Delete [arnResolver.py](src/nate2_scripts/console/arnResolver.py),
+[nameResolver.py](src/nate2_scripts/console/nameResolver.py),
+[resourceIdResolver.py](src/nate2_scripts/console/resourceIdResolver.py) once their logic
+is ported. Move the `split()` helper from arnResolver into `resolvers/__init__.py` (shared
+by several resolvers). Keep `Arn` in `resolvers/__init__.py` as the single ARN parser
+(replaces `ParsedArn` + `split`-based parsing).
+
+## Verification
+
+No test suite exists, so verify by running the CLI against a real profile:
+
+1. `asp <profile>` then reinstall/link: `pip install -e .` (or `uv pip install -e .`).
+2. Exercise each dimension and confirm the same URL opens as before the refactor:
+   - **service keyword:** `console s3`, `console ec2`, `console cost`, `console logs`, `console sm`
+   - **arn:** `console arn:aws:s3:::<bucket>`, `console arn:aws:lambda:us-east-1:<acct>:function:<fn>`,
+     `console arn:aws:iam::<acct>:role/<role>`
+   - **resource id:** `console i-<id>`, `console vpc-<id>`, `console subnet-<id>`
+   - **name:** `console <bucket-name>`, `console <stack-name>`, `console <lambda-name>`,
+     `console <ec2-Name-tag>` — confirm priority tie-break still favors logs > s3 > ec2 > cfn > lambda.
+   - **search arg:** `console ec2 <term>` — confirm the second positional is accepted and
+     threaded through (no crash; ignored by resolvers that don't use it yet).
+   - **empty:** `console` → region landing page.
+   - **unknown:** `console zzzzz` → stderr "Unknown service" + exit 1.
+3. Confirm argcomplete still lists services: `console <TAB>` (or inspect `get_service_list()`).
+4. Spot-check that the multisession domain prefix (`{mdn}`) still appears in generated URLs
+   when a multi-session hash is cached (the `-f` path vs cached path in
+   [console/__init__.py:174-185](src/nate2_scripts/console/__init__.py#L174-L185)).

nate2_scripts-2.0.0/plan.md

@@ -0,0 +1,16 @@
+# plan
+
+I want:
+
+- resolve arns
+  - tries to switch to account if -s or --switch is specified
+- resolve resource names in
+- resolve service with search parameter
+  search parameter is the second arg
+- resolve ids
+
+- p or --profile
+- takes a profile glob
+
+- f or --force
+- refreshes mdn cache

{nate2_scripts-1.0.3 → nate2_scripts-2.0.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "nate2-scripts"
-version = "1.0.3"
+version = "2.0.0"
 description = "Utility scripts for AWS development on macOS"
 requires-python = ">=3.11"
 dependencies = [
@@ -22,5 +22,18 @@ packages = ["src/nate2_scripts"]
 [tool.hatch.build.targets.wheel.force-include]
 "src/nate2_scripts/bing_wrapper/autocomplete.sh" = "nate2_scripts/bing_wrapper/autocomplete.sh"
 
+[project.optional-dependencies]
+dev = [
+    "boto3-stubs[essential]",
+    "moto[all]",
+    "pytest",
+]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+# Resolver test modules are named after the service they cover (s3.py, logs.py,
+# ...) rather than test_*.py, so widen collection to any module under tests/.
+python_files = ["*.py"]
+
 [project.urls]
 Homepage = "https://github.com/tennex-nwestfall/nate2-scripts"

{nate2_scripts-1.0.3 → nate2_scripts-2.0.0}/src/nate2_scripts/bing_wrapper/__init__.py

@@ -1,5 +1,6 @@
 """PTY wrapper for cdk that plays a sound when (y/n) prompts appear."""
 
+import argparse
 import fcntl
 import os
 import select
@@ -10,7 +11,6 @@ import sys
 import termios
 import threading
 import tty
-import argparse
 
 # _PATTERN = b"(y/n)"
 # _WINDOW = len(_PATTERN) * 2
@@ -73,7 +73,9 @@ def run(args: argparse.Namespace) -> None:
                     return
 
     if args.sound_while:
-        _sound_while_thread = threading.Thread(target=_play_sound_while_loop, daemon=True)
+        _sound_while_thread = threading.Thread(
+            target=_play_sound_while_loop, daemon=True
+        )
         _sound_while_thread.start()
 
     # Propagate terminal resizes to the child (also sends SIGWINCH to it).

nate2_scripts-2.0.0/src/nate2_scripts/console/__init__.py

@@ -0,0 +1,207 @@
+# PYTHON_ARGCOMPLETE_OK
+
+import argparse
+import json
+import os
+import subprocess
+import sys
+import time
+import urllib.parse
+import webbrowser
+from typing import Any
+
+import argcomplete
+import boto3
+from argcomplete.completers import ChoicesCompleter
+
+from nate2_scripts.console.boto3_session import update_role_names
+from nate2_scripts.console.hash_grabber import HashGrabber
+from nate2_scripts.console.resolvers import Context
+from nate2_scripts.console.session_cache import SessionCache
+from nate2_scripts.console.text_resolver import TextResolver
+
+DEFAULT_REGIONS = ["us-east-1", "us-east-2", "us-west-1", "us-west-2"]
+
+
+def get_signin_token(session: boto3.Session) -> str:
+    creds = session.get_credentials()
+    if creds is None:
+        print("Error: No credentials found for this session.", file=sys.stderr)
+        sys.exit(1)
+    frozen = creds.get_frozen_credentials()
+    session_json = json.dumps(
+        {
+            "sessionId": frozen.access_key,
+            "sessionKey": frozen.secret_key,
+            "sessionToken": frozen.token,
+        }
+    )
+    sess = urllib.parse.quote(session_json)
+    token_url = (
+        f"https://signin.aws.amazon.com/federation?Action=getSigninToken&Session={sess}"
+    )
+    result = subprocess.run(
+        ["curl", "-s", token_url], capture_output=True, text=True, check=True
+    )
+    try:
+        return json.loads(result.stdout)["SigninToken"]
+    except json.JSONDecodeError:
+        print("Error: Failed to parse JSON response. You may not have credentials.")
+        sys.exit(1)
+
+
+def ensure_profile():
+    profile_name = os.environ.get("AWS_PROFILE", "")
+    if not profile_name:
+        print(
+            "Error: AWS_PROFILE environment variable is not set. run asp.",
+            file=sys.stderr,
+        )
+        sys.exit(1)
+
+
+def parse_args() -> argparse.Namespace:
+    parser = argparse.ArgumentParser(
+        description="Open AWS console for a specific service."
+    )
+    svc_arg: Any = parser.add_argument(
+        "service",
+        type=str,
+        default="",
+        nargs="?",
+        help="The AWS service to open in the console, or an AWS ARN.",
+    )
+    svc_arg.completer = ChoicesCompleter(TextResolver.get_service_list())
+    parser.add_argument(
+        "search",
+        type=str,
+        default=[],
+        nargs="*",
+        help="Optional search/filter terms applied to service or name resolution. Multiple words are joined with spaces.",
+    )
+    regions_arg: Any = parser.add_argument(
+        "-r",
+        "--region",
+        type=str,
+        default="",
+        help="The AWS region to use.",
+    )
+    regions_arg.completer = argcomplete.completers.ChoicesCompleter(DEFAULT_REGIONS)
+
+    parser.add_argument(
+        "-f",
+        "--force",
+        action="store_true",
+        help="Force new federations. This will reset the federations cache.",
+    )
+    argcomplete.autocomplete(parser)
+    args = parser.parse_intermixed_args()
+    # collapse multi-word search into a single string for the resolvers
+    args.search = " ".join(args.search)
+
+    return args
+
+
+def get_suffix(
+    service: str,
+    search: str,
+    region: str | None,
+    session: boto3.Session,
+) -> tuple[str | None, Context]:
+
+    # add region if it is not already in the default searchable regions list
+    regions = DEFAULT_REGIONS.copy()
+    if region:
+        session._session.set_config_variable("region", region)
+        if region not in regions:
+            regions.append(region)
+
+    # set up context
+    context = Context()
+    context.session = session
+    context.regions = regions
+
+    # get account data
+    context.identity = context.session.client("sts").get_caller_identity()
+
+    resolver = TextResolver(context)
+
+    suffix = resolver.get_destination_suffix(service, search)
+    return (suffix, context)
+
+
+def build_signin_url(session: boto3.Session, suffix: str) -> str:
+    region = session.region_name
+    signin_token = get_signin_token(session)
+    dest = urllib.parse.quote(
+        f"https://{region}.console.aws.amazon.com{suffix}", safe=""
+    )
+    return f"https://signin.aws.amazon.com/federation?Action=login&Issuer=&SigninToken={signin_token}&Destination={dest}"
+
+
+def build_regular_url(session: boto3.Session, suffix: str, mdn: str) -> str:
+    region = session.region_name
+    return f"https://{mdn}.{region}.console.aws.amazon.com{suffix}"
+
+
+def open(url: str):
+    print(f"Opening console URL: {url}")
+    webbrowser.open(url)
+
+
+def open_console(suffix: str, context: Context, session_cache: SessionCache):
+    print(f"Opening console with suffix: {suffix}")
+    if not context.useprefix:
+        open(f"https://{suffix}")
+    else:
+        hash = session_cache.get_session_hash(context.session.profile_name)
+        if hash is None:
+            print(
+                f"{context.session.profile_name} has no cached session. Grabbing signin token."
+            )
+            url = build_signin_url(context.session, suffix)
+            open(url)
+            hash = HashGrabber.get_hash(context.identity["Account"], time.time())
+            if hash is None:
+                print("Failed to grab hash.")
+                sys.exit(1)
+            print(
+                f"Successfully grabbed hash for {context.session.profile_name}: {hash}"
+            )
+            session_cache.record_valid_hash(context.session.profile_name, hash)
+
+        else:
+            multisession_domain_name = f"{context.identity['Account']}-{hash}"
+            print(
+                f"{context.session.profile_name} cache has cached multi session with domain: {multisession_domain_name}"
+            )
+            url = build_regular_url(context.session, suffix, multisession_domain_name)
+            open(url)
+
+
+def main() -> None:
+    ensure_profile()
+    args = parse_args()
+
+    session = boto3.Session()
+    session_cache = SessionCache()
+    update_role_names(session)
+
+    if args.force:
+        print("Force passed. Resetting session cache.")
+        session_cache.reset()
+
+    print("Default region is: ", session.region_name)
+
+    suffix, context = get_suffix(args.service, args.search, args.region, session)
+    if suffix:
+        open_console(suffix, context, session_cache)
+    else:
+        print("Cannot open console page.")
+
+
+if __name__ == "__main__":
+    main()
+
+
+# set user to OrganizationAccountAccessRole/nwestfall@tennex.io