@atomist/sdm-core
Version:
Atomist Software Delivery Machine - Implementation
246 lines • 11.6 kB
JavaScript
"use strict";
/*
* Copyright © 2019 Atomist, Inc.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
return new (P || (P = Promise))(function (resolve, reject) {
function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
step((generator = generator.apply(thisArg, _arguments || [])).next());
});
};
Object.defineProperty(exports, "__esModule", { value: true });
const automation_client_1 = require("@atomist/automation-client");
const ProjectOperationCredentials_1 = require("@atomist/automation-client/lib/operations/common/ProjectOperationCredentials");
const crypto = require("crypto");
const types_1 = require("../../typings/types");
function prepareSecrets(container, ctx) {
var _a, _b, _c, _d;
return __awaiter(this, void 0, void 0, function* () {
const secrets = {
env: [],
files: [],
};
if ((_b = (_a = container) === null || _a === void 0 ? void 0 : _a.secrets) === null || _b === void 0 ? void 0 : _b.env) {
for (const secret of container.secrets.env) {
if (!!secret.value.provider) {
const value = yield prepareProviderSecret(secret.value, ctx, secrets, secret.name);
if (!!value) {
secrets.env.push({ name: secret.name, value });
}
}
else if (!!secret.value.encrypted) {
const value = decryptSecret(secret.value.encrypted, ctx);
if (!!value) {
secrets.env.push({ name: secret.name, value });
}
}
}
}
if ((_d = (_c = container) === null || _c === void 0 ? void 0 : _c.secrets) === null || _d === void 0 ? void 0 : _d.fileMounts) {
for (const secret of container.secrets.fileMounts) {
if (!!secret.value.provider) {
const value = yield prepareProviderSecret(secret.value, ctx, secrets);
if (!!value) {
secrets.files.push({
value,
mountPath: secret.mountPath,
});
}
}
else if (!!secret.value.encrypted) {
const value = decryptSecret(secret.value.encrypted, ctx);
if (!!value) {
secrets.files.push({
value,
mountPath: secret.mountPath,
});
}
}
}
}
return secrets;
});
}
exports.prepareSecrets = prepareSecrets;
function prepareProviderSecret(secret, ctx, secrets, envName) {
var _a;
return __awaiter(this, void 0, void 0, function* () {
if ((_a = secret) === null || _a === void 0 ? void 0 : _a.provider) {
switch (secret.provider.type) {
case "docker":
return prepareDockerProviderSecret(secret.provider.names || [], ctx, secrets, envName);
case "scm":
const creds = ctx.credentials;
if (!creds) {
return undefined;
}
else if (ProjectOperationCredentials_1.isTokenCredentials(creds)) {
return creds.token;
}
else {
return JSON.stringify(creds);
}
case "npm":
return prepareNpmProviderSecret(secret.provider.names || [], ctx, secrets, envName);
case "maven2":
return prepareMavenProviderSecret(secret.provider.names || [], ctx, secrets, envName);
case "atomist":
return ctx.configuration.apiKey;
default:
return undefined;
}
}
return undefined;
});
}
exports.prepareProviderSecret = prepareProviderSecret;
function prepareDockerProviderSecret(names, ctx, secrets, envName) {
var _a;
return __awaiter(this, void 0, void 0, function* () {
const { context } = ctx;
const dockerRegistries = yield context.graphClient.query({
name: "DockerRegistryProvider",
options: automation_client_1.QueryNoCacheOptions,
});
const dockerConfig = {
auths: {},
};
if ((_a = dockerRegistries) === null || _a === void 0 ? void 0 : _a.DockerRegistryProvider) {
const requestedDockerRegistries = dockerRegistries.DockerRegistryProvider
.filter(d => names.length === 0 || names.includes(d.name));
if (!!envName && requestedDockerRegistries.length > 1) {
throw new Error("More then one matching Docker registry provider found for requested env variable");
}
for (const dockerRegistry of requestedDockerRegistries) {
const credential = yield context.graphClient.query({
name: "Password",
variables: {
id: dockerRegistry.credential.id,
},
});
if (!envName) {
if (dockerRegistry.url === "https://index.docker.io/v1/") {
dockerConfig.auths[dockerRegistry.url] = {
auth: Buffer.from(credential.Password[0].owner.login + ":" + credential.Password[0].secret).toString("base64"),
};
}
else if (!!dockerRegistry.url) {
const url = /^(?:https?:\/\/)?(.*?)\/?$/.exec(dockerRegistry.url);
dockerConfig.auths[url[1]] = {
auth: Buffer.from(credential.Password[0].owner.login + ":" + credential.Password[0].secret).toString("base64"),
};
}
}
else {
secrets.env.push({ name: `${envName}_USER`, value: credential.Password[0].owner.login });
return credential.Password[0].secret;
}
}
}
return JSON.stringify(dockerConfig);
});
}
exports.prepareDockerProviderSecret = prepareDockerProviderSecret;
function prepareMavenProviderSecret(names, ctx, secrets, envName) {
var _a;
return __awaiter(this, void 0, void 0, function* () {
if (!envName) {
throw new Error("fileMounts are not supported for Maven2 repository provider secrets");
}
const { context } = ctx;
const binaryRepositoryProviders = yield context.graphClient.query({
name: "BinaryRepositoryProvider",
variables: {
type: types_1.BinaryRepositoryType.maven2,
},
options: automation_client_1.QueryNoCacheOptions,
});
if ((_a = binaryRepositoryProviders) === null || _a === void 0 ? void 0 : _a.BinaryRepositoryProvider) {
const requestedBinaryRepositoryProviders = binaryRepositoryProviders.BinaryRepositoryProvider
.filter(d => names.length === 0 || names.includes(d.name));
if (!!envName && requestedBinaryRepositoryProviders.length > 1) {
throw new Error("More then one matching Maven2 repository provider found for requested env variable");
}
for (const binaryRepositoryProvider of requestedBinaryRepositoryProviders) {
const credential = yield context.graphClient.query({
name: "Password",
variables: {
id: binaryRepositoryProvider.credential.id,
},
});
secrets.env.push({ name: `${envName}_USER`, value: credential.Password[0].owner.login });
secrets.env.push({ name: `${envName}_PWD`, value: credential.Password[0].secret });
return credential.Password[0].secret;
}
}
return undefined;
});
}
exports.prepareMavenProviderSecret = prepareMavenProviderSecret;
function prepareNpmProviderSecret(names, ctx, secrets, envName) {
var _a;
return __awaiter(this, void 0, void 0, function* () {
const { context } = ctx;
const binaryRepositoryProviders = yield context.graphClient.query({
name: "BinaryRepositoryProvider",
variables: {
type: types_1.BinaryRepositoryType.npm,
},
options: automation_client_1.QueryNoCacheOptions,
});
const npmrc = [];
if ((_a = binaryRepositoryProviders) === null || _a === void 0 ? void 0 : _a.BinaryRepositoryProvider) {
const requestedBinaryRepositoryProviders = binaryRepositoryProviders.BinaryRepositoryProvider
.filter(d => names.length === 0 || names.includes(d.name));
if (!!envName && requestedBinaryRepositoryProviders.length > 1) {
throw new Error("More then one matching Maven2 repository provider found for requested env variable");
}
for (const binaryRepositoryProvider of requestedBinaryRepositoryProviders) {
const credential = yield context.graphClient.query({
name: "Password",
variables: {
id: binaryRepositoryProvider.credential.id,
},
});
if (!envName) {
const url = binaryRepositoryProvider.url.replace(/https?:\/\//, "");
npmrc.push({ url, auth: credential.Password[0].secret });
}
else {
secrets.env.push({ name: `${envName}_USER`, value: credential.Password[0].owner.login });
return credential.Password[0].secret;
}
}
}
return npmrc.map(r => `//${r.url}/:_authToken=${r.auth}`).join("\n") + "\n";
});
}
exports.prepareNpmProviderSecret = prepareNpmProviderSecret;
function decryptSecret(secret, ctx) {
const { configuration } = ctx;
const encryptionCfp = configuration.sdm.encryption;
if (!encryptionCfp) {
throw new Error("Encryption configuration missing to decrypt secret");
}
const decrypted = crypto.privateDecrypt({
key: encryptionCfp.privateKey,
passphrase: encryptionCfp.passphrase,
}, Buffer.from(secret, "base64"));
return decrypted.toString("utf8");
}
//# sourceMappingURL=provider.js.map