| | | 1 | | import { spawn } from 'node:child_process'; |
| | | 2 | | import { createInterface } from 'node:readline'; |
| | | 3 | | import { SsoSessionExpiredError } from '../../../core/domain/errors/DomainErrors.js'; |
| | | 4 | | import { presentError } from '../errors/CliErrorPresenter.js'; |
| | | 5 | | import { SilentExitError } from '../errors/SilentExitError.js'; |
| | | 6 | | |
| | 6 | 7 | | const AWS_CLI_NOT_FOUND = -1; |
| | 6 | 8 | | const LOGIN_FAILED = 1; |
| | | 9 | | |
| | | 10 | | export type RecoveryDeps = { |
| | | 11 | | isInteractive(): boolean; |
| | | 12 | | confirm(question: string): Promise<boolean>; |
| | | 13 | | runLogin(profileName?: string): Promise<number>; |
| | | 14 | | write(message: string): void; |
| | | 15 | | }; |
| | | 16 | | |
| | | 17 | | export function buildLoginArgs(profileName?: string): string[] { |
| | 6 | 18 | | if (profileName) { |
| | 5 | 19 | | return ['sso', 'login', '--profile', profileName]; |
| | | 20 | | } |
| | 1 | 21 | | return ['sso', 'login']; |
| | | 22 | | } |
| | | 23 | | |
| | | 24 | | function defaultIsInteractive(): boolean { |
| | 3 | 25 | | return [process.stdout.isTTY, process.stdin.isTTY].every(Boolean); |
| | | 26 | | } |
| | | 27 | | |
| | | 28 | | /** |
| | | 29 | | * Builds a yes/no prompt that writes its question to `output`. Exec mode |
| | | 30 | | * prompts on stderr so stdout stays reserved for the child process. |
| | | 31 | | */ |
| | | 32 | | export function createConfirm( |
| | | 33 | | output: NodeJS.WritableStream, |
| | | 34 | | ): (question: string) => Promise<boolean> { |
| | 39 | 35 | | return (question) => { |
| | 4 | 36 | | const prompt = createInterface({ input: process.stdin, output }); |
| | 4 | 37 | | return new Promise((resolve) => { |
| | 4 | 38 | | prompt.question(`${question} `, (answer) => { |
| | 4 | 39 | | prompt.close(); |
| | 4 | 40 | | resolve(answer.trim().toLowerCase() === 'y'); |
| | | 41 | | }); |
| | | 42 | | }); |
| | | 43 | | }; |
| | | 44 | | } |
| | | 45 | | |
| | | 46 | | function defaultConfirm(question: string): Promise<boolean> { |
| | 1 | 47 | | return createConfirm(process.stdout)(question); |
| | | 48 | | } |
| | | 49 | | |
| | 6 | 50 | | const STDERR_FD = 2; |
| | | 51 | | |
| | | 52 | | /** |
| | | 53 | | * Builds the `aws sso login` runner. With `stdout: 'stderr'` the login's |
| | | 54 | | * output goes to stderr, so stdout stays reserved for an exec child; the |
| | | 55 | | * default inherits every stream. |
| | | 56 | | */ |
| | | 57 | | export function createRunLogin( |
| | | 58 | | options: { stdout?: 'inherit' | 'stderr' } = {}, |
| | | 59 | | ): (profileName?: string) => Promise<number> { |
| | | 60 | | const stdio = |
| | 44 | 61 | | options.stdout === 'stderr' |
| | | 62 | | ? (['inherit', STDERR_FD, 'inherit'] as const) |
| | | 63 | | : ('inherit' as const); |
| | 44 | 64 | | return (profileName) => |
| | 3 | 65 | | new Promise((resolve) => { |
| | 3 | 66 | | const child = spawn('aws', buildLoginArgs(profileName), { |
| | | 67 | | stdio: stdio === 'inherit' ? stdio : [...stdio], |
| | | 68 | | }); |
| | 3 | 69 | | child.on('error', (error: NodeJS.ErrnoException) => { |
| | 0 | 70 | | resolve(error.code === 'ENOENT' ? AWS_CLI_NOT_FOUND : LOGIN_FAILED); |
| | | 71 | | }); |
| | 3 | 72 | | child.on('close', (code) => { |
| | 3 | 73 | | resolve(code ?? LOGIN_FAILED); |
| | | 74 | | }); |
| | | 75 | | }); |
| | | 76 | | } |
| | | 77 | | |
| | 6 | 78 | | const defaultRunLogin = createRunLogin(); |
| | | 79 | | |
| | | 80 | | function defaultWrite(message: string): void { |
| | 14 | 81 | | console.error(message); |
| | | 82 | | } |
| | | 83 | | |
| | 6 | 84 | | const defaultDeps: RecoveryDeps = { |
| | | 85 | | isInteractive: defaultIsInteractive, |
| | | 86 | | confirm: defaultConfirm, |
| | | 87 | | runLogin: defaultRunLogin, |
| | | 88 | | write: defaultWrite, |
| | | 89 | | }; |
| | | 90 | | |
| | | 91 | | export async function executeWithSsoRecovery( |
| | | 92 | | run: () => Promise<void>, |
| | | 93 | | deps: Partial<RecoveryDeps> = {}, |
| | | 94 | | ): Promise<void> { |
| | 43 | 95 | | const resolved: RecoveryDeps = { ...defaultDeps, ...deps }; |
| | 43 | 96 | | try { |
| | 43 | 97 | | return await run(); |
| | | 98 | | } catch (error) { |
| | 16 | 99 | | if (!(error instanceof SsoSessionExpiredError)) { |
| | 3 | 100 | | throw error; |
| | | 101 | | } |
| | 13 | 102 | | if (!resolved.isInteractive()) { |
| | 4 | 103 | | throw error; |
| | | 104 | | } |
| | 9 | 105 | | await recoverInteractively(run, error, resolved); |
| | | 106 | | } |
| | | 107 | | } |
| | | 108 | | |
| | | 109 | | async function recoverInteractively( |
| | | 110 | | run: () => Promise<void>, |
| | | 111 | | error: SsoSessionExpiredError, |
| | | 112 | | deps: RecoveryDeps, |
| | | 113 | | ): Promise<void> { |
| | 9 | 114 | | deps.write(presentError(error)); |
| | | 115 | | |
| | 9 | 116 | | const command = error.profileName |
| | | 117 | | ? `aws sso login --profile ${error.profileName}` |
| | | 118 | | : 'aws sso login'; |
| | 9 | 119 | | const accepted = await deps.confirm(`Run '${command}' now? [y/N]`); |
| | 9 | 120 | | if (!accepted) { |
| | 2 | 121 | | deps.write( |
| | | 122 | | 'Skipped. Run the command above when ready, then re-run envilder.', |
| | | 123 | | ); |
| | 2 | 124 | | throw new SilentExitError(LOGIN_FAILED); |
| | | 125 | | } |
| | | 126 | | |
| | 7 | 127 | | const exitCode = await deps.runLogin(error.profileName); |
| | 7 | 128 | | ensureLoginSucceeded(exitCode, deps); |
| | 7 | 129 | | await retryOnce(run, deps); |
| | | 130 | | } |
| | | 131 | | |
| | | 132 | | function ensureLoginSucceeded(exitCode: number, deps: RecoveryDeps): void { |
| | 7 | 133 | | if (exitCode === AWS_CLI_NOT_FOUND) { |
| | 1 | 134 | | deps.write( |
| | | 135 | | 'The AWS CLI was not found on your PATH. Install it, then run the command above.', |
| | | 136 | | ); |
| | 1 | 137 | | throw new SilentExitError(LOGIN_FAILED); |
| | | 138 | | } |
| | 6 | 139 | | if (exitCode !== 0) { |
| | 1 | 140 | | deps.write('Login did not complete. Try again, then re-run envilder.'); |
| | 1 | 141 | | throw new SilentExitError(LOGIN_FAILED); |
| | | 142 | | } |
| | | 143 | | } |
| | | 144 | | |
| | | 145 | | async function retryOnce( |
| | | 146 | | run: () => Promise<void>, |
| | | 147 | | deps: RecoveryDeps, |
| | | 148 | | ): Promise<void> { |
| | 5 | 149 | | deps.write('\uD83C\uDF44 1-UP! SSO session restored.'); |
| | 5 | 150 | | deps.write('\u21bb Warping back for your secrets\u2026'); |
| | 5 | 151 | | try { |
| | 5 | 152 | | await run(); |
| | 4 | 153 | | deps.write('\u2b50 Level cleared.'); |
| | | 154 | | } catch (retryError) { |
| | 1 | 155 | | if (retryError instanceof SsoSessionExpiredError) { |
| | 1 | 156 | | deps.write(presentError(retryError)); |
| | 1 | 157 | | throw new SilentExitError(LOGIN_FAILED); |
| | | 158 | | } |
| | 0 | 159 | | throw retryError; |
| | | 160 | | } |
| | | 161 | | } |