Release v1.19.6

cmd/explore.go

@@ -618,7 +618,7 @@ func Explore(cmd *cobra.Command, args []string) error {
 	defer func() {
 		_, _ = multi.Stop()
 	}()
-	ctx, oi, token, err := login(ctx, cmd, []string{"request:receive", "api:read"}, multi.NewWriter())
+	ctx, oi, token, err := login(ctx, cmd, localDiscoveryScopes(), multi.NewWriter())
 	_, _ = multi.Stop()
 	if err != nil {
 		return err

cmd/member_command_test.go

@@ -0,0 +1,99 @@
+//go:build !race
+
+package cmd
+
+// Command smoke tests exercise pterm's animated UI, which has pre-existing data
+// races in SpinnerPrinter. Run these without -race; the workflow scope tests and
+// backend authorization tests also run separately with race detection.
+
+import (
+	"context"
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io/fs"
+	"net/http"
+	"net/http/httptest"
+	"path/filepath"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"connectrpc.com/connect"
+	"github.com/overmindtech/cli/go/sdp-go"
+	"github.com/overmindtech/cli/go/sdp-go/sdpconnect"
+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
+)
+
+// Exercise command authentication against a local API rather than only checking
+// the shared scope lists. No Auth0, cloud credentials or NATS server is involved.
+func TestMemberCommandAuthentication(t *testing.T) {
+	const memberScopes = "account:read changes:read changes:write config:read explore:read request:receive request:send reverselink:request source:read sources:read"
+	for _, command := range []string{"terraform", "explore"} {
+		for _, allowed := range []bool{true, false} {
+			t.Run(fmt.Sprintf("%s/allowed=%v", command, allowed), func(t *testing.T) {
+				viper.Reset()
+				t.Cleanup(viper.Reset)
+				scopes := memberScopes
+				if !allowed {
+					scopes = "account:read"
+				}
+				claims, err := json.Marshal(map[string]any{"scope": scopes, "sub": "member", "exp": time.Now().Add(time.Hour).Unix(), "https://api.overmind.tech/account-name": "test"})
+				if err != nil {
+					t.Fatal(err)
+				}
+				// ensureToken parses this JWT but signature verification belongs to the server.
+				token := base64.RawURLEncoding.EncodeToString([]byte(`{"alg":"RS256"}`)) + "." + base64.RawURLEncoding.EncodeToString(claims) + ".AA"
+				mux := http.NewServeMux()
+				var exchanged atomic.Bool
+				mux.Handle(sdpconnect.ApiKeyServiceExchangeKeyForTokenProcedure, connect.NewUnaryHandler(sdpconnect.ApiKeyServiceExchangeKeyForTokenProcedure, func(_ context.Context, _ *connect.Request[sdp.ExchangeKeyForTokenRequest]) (*connect.Response[sdp.ExchangeKeyForTokenResponse], error) {
+					exchanged.Store(true)
+					return connect.NewResponse(&sdp.ExchangeKeyForTokenResponse{AccessToken: token}), nil
+				}))
+				server := httptest.NewServer(mux)
+				defer server.Close()
+				mux.HandleFunc("/api/public/instance-data", func(w http.ResponseWriter, _ *http.Request) {
+					w.Header().Set("Content-Type", "application/json")
+					if err := json.NewEncoder(w).Encode(map[string]string{"api_url": server.URL, "nats_url": "nats://127.0.0.1:4222"}); err != nil {
+						t.Error(err)
+					}
+				})
+				viper.Set("app", server.URL)
+				viper.Set("api-key", "ovm_api_test")
+				viper.Set("timeout", "5s")
+				viper.Set("only-use-managed-sources", true)
+				cmd := &cobra.Command{Use: command}
+				cmd.SetContext(t.Context())
+				if command == "terraform" {
+					_, _, got, cleanup, err := StartSources(t.Context(), cmd, nil)
+					if cleanup != nil {
+						cleanup()
+					}
+					if allowed && (err != nil || got == nil) {
+						t.Fatalf("expected Member authentication success, got token=%v, error=%v", got != nil, err)
+					}
+					if !allowed && err == nil {
+						t.Error("expected authentication to reject missing workflow scopes")
+					}
+				} else {
+					// A missing snapshot stops after authentication, before starting a source
+					// or opening the browser. The wrapped filesystem error proves that the
+					// Member passed the real Explore command's login requirements.
+					t.Setenv("SNAPSHOT_SOURCE", filepath.Join(t.TempDir(), "missing.json"))
+					err := Explore(cmd, nil)
+					if allowed && !errors.Is(err, fs.ErrNotExist) {
+						t.Fatalf("expected snapshot file error after Member login, got %v", err)
+					}
+					if !allowed && (err == nil || errors.Is(err, fs.ErrNotExist)) {
+						t.Errorf("expected login rejection before source startup, got %v", err)
+					}
+				}
+				if !exchanged.Load() {
+					t.Error("expected command to exchange credentials with local API")
+				}
+			})
+		}
+	}
+}

cmd/member_scopes_test.go

@@ -0,0 +1,41 @@
+package cmd
+
+import (
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"strings"
+	"testing"
+
+	"github.com/overmindtech/cli/go/auth"
+	"github.com/overmindtech/cli/go/cliauth"
+	"golang.org/x/oauth2"
+)
+
+func TestMemberWorkflowScopes(t *testing.T) {
+	const memberScopes = "account:read changes:read changes:write config:read explore:read request:receive request:send reverselink:request source:read sources:read"
+	for name, required := range map[string][]string{"explore": localDiscoveryScopes(), "terraform": terraformWorkflowScopes()} {
+		t.Run(name, func(t *testing.T) {
+			for _, scopes := range append([]string{memberScopes}, required...) {
+				granted := memberScopes
+				want := true
+				if scopes != memberScopes {
+					granted = strings.ReplaceAll(memberScopes, scopes, "")
+					want = false
+				}
+				payload, err := json.Marshal(auth.CustomClaims{Scope: granted})
+				if err != nil {
+					t.Fatal(err)
+				}
+				token := &oauth2.Token{AccessToken: fmt.Sprintf(".%s.", base64.RawURLEncoding.EncodeToString(payload))}
+				got, missing, err := cliauth.HasScopesFlexible(token, required)
+				if err != nil {
+					t.Fatal(err)
+				}
+				if got != want {
+					t.Errorf("granted %q: expected allowed=%v, got %v (missing %v)", granted, want, got, missing)
+				}
+			}
+		})
+	}
+}

cmd/pterm.go

@@ -67,7 +67,7 @@ func StartSources(ctx context.Context, cmd *cobra.Command, args []string) (conte
 		_, _ = multi.Stop()
 	}()
 
-	ctx, oi, token, err := login(ctx, cmd, []string{"explore:read", "changes:write", "config:write", "request:receive", "api:read", "sources:read"}, multi.NewWriter())
+	ctx, oi, token, err := login(ctx, cmd, terraformWorkflowScopes(), multi.NewWriter())
 	if err != nil {
 		return ctx, sdp.OvermindInstance{}, nil, nil, err
 	}
@@ -284,3 +284,11 @@ func heartbeatOptions(oi sdp.OvermindInstance, token *oauth2.Token) *discovery.H
 	}
 }
 
+// Discovery runs local sources but does not change account configuration.
+func localDiscoveryScopes() []string {
+	return []string{"explore:read", "request:receive"}
+}
+
+func terraformWorkflowScopes() []string {
+	return append(localDiscoveryScopes(), "changes:write", "sources:read")
+}

go.mod

@@ -39,7 +39,7 @@ require (
 	cloud.google.com/go/compute v1.70.0
 	cloud.google.com/go/container v1.55.0
 	cloud.google.com/go/dataplex v1.37.0
-	cloud.google.com/go/dataproc/v2 v2.26.0
+	cloud.google.com/go/dataproc/v2 v2.27.0
 	cloud.google.com/go/eventarc v1.26.0
 	cloud.google.com/go/filestore v1.17.0
 	cloud.google.com/go/functions v1.26.0
@@ -49,15 +49,15 @@ require (
 	cloud.google.com/go/monitoring v1.31.0
 	cloud.google.com/go/networksecurity v0.20.0
 	cloud.google.com/go/orgpolicy v1.21.0
-	cloud.google.com/go/redis v1.26.0
+	cloud.google.com/go/redis v1.27.0
 	cloud.google.com/go/resourcemanager v1.17.0
 	cloud.google.com/go/run v1.23.0
 	cloud.google.com/go/secretmanager v1.22.0
 	cloud.google.com/go/securitycentermanagement v1.7.0
 	cloud.google.com/go/spanner v1.96.1
 	cloud.google.com/go/storage v1.69.0
 	cloud.google.com/go/storagetransfer v1.20.0
-	connectrpc.com/connect v1.21.0 // v1.19.0 was faulty, wait until it is above this version
+	connectrpc.com/connect v1.21.1 // v1.19.0 was faulty, wait until it is above this version
 	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.23.3
 	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.15.0
 	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/authorization/armauthorization/v3 v3.0.0-beta.3
@@ -75,10 +75,10 @@ require (
 	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/privatedns/armprivatedns/v2 v2.0.0
 	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armresources/v4 v4.0.0
 	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/sql/armsql/v2 v2.0.0-beta.9
-	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/storage/armstorage/v4 v4.2.0
+	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/storage/armstorage/v4 v4.3.0
 	github.com/Masterminds/semver/v3 v3.5.0
 	github.com/MrAlias/otel-schema-utils v0.4.0-alpha
-	github.com/auth0/go-jwt-middleware/v3 v3.3.0
+	github.com/auth0/go-jwt-middleware/v3 v3.4.0
 	github.com/aws/aws-sdk-go-v2 v1.47.3
 	github.com/aws/aws-sdk-go-v2/config v1.33.9
 	github.com/aws/aws-sdk-go-v2/credentials v1.20.9
@@ -111,7 +111,7 @@ require (
 	github.com/cenkalti/backoff/v7 v7.0.1
 	github.com/coder/websocket v1.8.15
 	github.com/getsentry/sentry-go v0.49.0
-	github.com/go-jose/go-jose/v4 v4.1.5
+	github.com/go-jose/go-jose/v4 v4.1.6
 	github.com/google/btree v1.1.3
 	github.com/google/uuid v1.6.0
 	github.com/googleapis/gax-go/v2 v2.26.2

go.sum

@@ -44,8 +44,8 @@ cloud.google.com/go/datacatalog v1.33.0 h1:8V80PpoAGdOOr2QhBrp4wZ66MDCbATdAB/fmV
 cloud.google.com/go/datacatalog v1.33.0/go.mod h1:/EMN04S73fZcPdtNg86VYLDrhi2HheMehQtMCS86Klk=
 cloud.google.com/go/dataplex v1.37.0 h1:Nt1zvTC879HUk+il7TJWTk2BZnSOPlOuXqyb9XRtC/8=
 cloud.google.com/go/dataplex v1.37.0/go.mod h1:EqGmwvw+tTX8kRPXNcOcCqrx7o2icnpCW7ODIBGUiHI=
-cloud.google.com/go/dataproc/v2 v2.26.0 h1:Dhf/jVy5Ivu3oEdCQ5LhFo2mXINXZM1/AwgedODk5c0=
-cloud.google.com/go/dataproc/v2 v2.26.0/go.mod h1:uyClvchFI+/HcSHAReHFg6f7V8IYuuVL57KakLJ12pU=
+cloud.google.com/go/dataproc/v2 v2.27.0 h1:9jrXmdIGoIApA+wF8V362BIDjyWq7Tum4AcZ7caCAYI=
+cloud.google.com/go/dataproc/v2 v2.27.0/go.mod h1:Nn5Uo3WDtJQGVD+i8LSQdqJzSgRosjrQ3ARUtZrsWGo=
 cloud.google.com/go/eventarc v1.26.0 h1:qrJ8Hx96KLDqU9yQdmAly6Cq1w0d5t/SOOpDWRFrfNQ=
 cloud.google.com/go/eventarc v1.26.0/go.mod h1:vjPsVSad+d/UNOd4k/3/E9CX/5p8k0ChjxoBU7H6I2I=
 cloud.google.com/go/filestore v1.17.0 h1:/sp09tHMDNC0UahjSG7IqVJT7XR2V4wiG4s6ej0ancw=
@@ -66,8 +66,8 @@ cloud.google.com/go/networksecurity v0.20.0 h1:89TlCISilA1nOHufVz+9+h6upTIvwYQ9H
 cloud.google.com/go/networksecurity v0.20.0/go.mod h1:+gZyaZn7oVuUALmlTVnF+YRcFsIymhuBFkL3M3zleYA=
 cloud.google.com/go/orgpolicy v1.21.0 h1:s3uFI4QL135pvkMlachOuL0pRntCgc4V1148gCUzg+4=
 cloud.google.com/go/orgpolicy v1.21.0/go.mod h1:IhaTu3E5NmfcdyorGVJozZDTTEqJnAK7suiLgq32gW8=
-cloud.google.com/go/redis v1.26.0 h1:RgLGd28s+EBqXxwk82SMn0aU0WvlmFezpniY9MGhgNQ=
-cloud.google.com/go/redis v1.26.0/go.mod h1:nHRRMFXWJv7GfVQEbg0sQzN1MGIkl/q0mSOYG2l6Ylg=
+cloud.google.com/go/redis v1.27.0 h1:tubqTSuapccI4oo/Epobb6s5TfF/pMlchgopmu+nuIY=
+cloud.google.com/go/redis v1.27.0/go.mod h1:685IBrLuzuK+qONqcZOSfkeF8tCn4nWinMHqhkHSYlM=
 cloud.google.com/go/resourcemanager v1.17.0 h1:XIM2tIYQ/x3BNn0+eWdRSiMLpErl4/WM4aezbHULR10=
 cloud.google.com/go/resourcemanager v1.17.0/go.mod h1:IQT7djVg7KWNzEUt8QVeoHQ3Y8IqizmuscnEswU4MAo=
 cloud.google.com/go/run v1.23.0 h1:JvTkOn+8h+QicGzBPWjgSrwpTcs2b6zJkusfEnmvkGo=
@@ -84,8 +84,8 @@ cloud.google.com/go/storagetransfer v1.20.0 h1:UuuynGTx2F0b+NpkaU8trMeKyBn77kAxy
 cloud.google.com/go/storagetransfer v1.20.0/go.mod h1:+ugm2/5mJ8EaH+iSFkArsiHHcwi2WsazcdtTGAW8x1k=
 cloud.google.com/go/trace v1.16.0 h1:GmQovzFc5F0CNfl0VLgL64aoTtu7xsM0YajW2GlG9+E=
 cloud.google.com/go/trace v1.16.0/go.mod h1:r+bdAn16dKLSV1G2D5v3e58IlQlizfxWrUfjx7kM7X0=
-connectrpc.com/connect v1.21.0 h1:LhqSJt7jHf5NJBo9Jq/t/9FjcYAideif0mg+qe2jCUs=
-connectrpc.com/connect v1.21.0/go.mod h1:A2ygJrukXwWy32vkCAAHNVguZrqZ+jeZ9rGRnGR4dN4=
+connectrpc.com/connect v1.21.1 h1:h2kacdlzXpZU2OQFSv98xkjYXNUSr/ptxmGVbS/+CRM=
+connectrpc.com/connect v1.21.1/go.mod h1:fhMcVJ5w6r/yTYhnkEbW6+sIF7OZ5Ay7KYgmfebh2ek=
 dario.cat/mergo v1.0.0 h1:AGCNq9Evsj31mOgNPcLyXc+4PNABt905YmuqPYYpBWk=
 dario.cat/mergo v1.0.0/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk=
 github.com/Azure/azure-sdk-for-go/sdk/azcore v1.23.3 h1:qgnWTiWs1G7AqcKZegFvkJD1bmXJcaDU3uC0ELSgZ5U=
@@ -134,8 +134,8 @@ github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armresources/v4
 github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armresources/v4 v4.0.0/go.mod h1:IJLGVEPS/CqR2k0Q+EzmHqus1F69g5TCYzLFSWUM0Yw=
 github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/sql/armsql/v2 v2.0.0-beta.9 h1:NuDFx/l+n+xZoEQxih0Qr19MrD9awtNww9Ev1HDmPWY=
 github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/sql/armsql/v2 v2.0.0-beta.9/go.mod h1:tqP6YJ3nUnAJKv0IlQV0sDyg9pIu+ZXfuInBsCAfiU0=
-github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/storage/armstorage/v4 v4.2.0 h1:lu3BSyR6E7pgc4JRPuF4h7+M6XMuK+HwgiH3CYEQG5c=
-github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/storage/armstorage/v4 v4.2.0/go.mod h1:ALlHLzp+izhdNlBjJTu87A1bl4EO6CJtJSZZ0K/dowg=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/storage/armstorage/v4 v4.3.0 h1:ziTTNNlj/MyXkkXPE0Cd0xGKq3/HISdr8JVTc4Bb9zA=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/storage/armstorage/v4 v4.3.0/go.mod h1:VJEKRuG/GfVIZZ3oVRsiU5p2L7t+5xUpYGuFOMwrY8g=
 github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1 h1:WJTmL004Abzc5wDB5VtZG2PJk5ndYDgVacGqfirKxjM=
 github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1/go.mod h1:tCcJZ0uHAmvjsVYzEFivsRTN00oz5BEsRgQHu5JZ9WE=
 github.com/AzureAD/microsoft-authentication-library-for-go v1.10.1 h1:0O6j18nQDoIff6/mtosT5LNU2WehEwp+LqfX6699oqY=
@@ -183,8 +183,8 @@ github.com/apparentlymart/go-textseg/v15 v15.0.0 h1:uYvfpb3DyLSCGWnctWKGj857c6ew
 github.com/apparentlymart/go-textseg/v15 v15.0.0/go.mod h1:K8XmNZdhEBkdlyDdvbmmsvpAG721bKi0joRfFdHIWJ4=
 github.com/apparentlymart/go-textseg/v17 v17.0.1 h1:bpMXRgQ5cEoRNuQke1a80/Nl6w3G5eoIbWo9f3gXkAs=
 github.com/apparentlymart/go-textseg/v17 v17.0.1/go.mod h1:fa8X4jgGeevslICIY6LcdjkSecWnXmYd9Lk34z/VxZs=
-github.com/auth0/go-jwt-middleware/v3 v3.3.0 h1:nRALRLGsUdWgxX0knqwp60YxiYypeZYfhr+yFCvHoGY=
-github.com/auth0/go-jwt-middleware/v3 v3.3.0/go.mod h1:WXL/zFf3nuQJWQOVj3hGUQ289ixKVSrFGwZn6LxaQsw=
+github.com/auth0/go-jwt-middleware/v3 v3.4.0 h1:hdF7tN8X6hXMlRkUVUC9Gf4FI2eM9SGO5hfeAWDeQA0=
+github.com/auth0/go-jwt-middleware/v3 v3.4.0/go.mod h1:pZRxro4VRQywl7EDrbOYu2eonP6EtJ2ez4vYmW4F0hg=
 github.com/aws/aws-sdk-go-v2 v1.47.3 h1:HRoT/MkNi3bjO5xF4dCzLzvVmkvRGHj3/cLINDnJejk=
 github.com/aws/aws-sdk-go-v2 v1.47.3/go.mod h1:xSl+OSI5ZUw6bSMupWc218zE5Pl+65MCCu3ySWFY99A=
 github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.22 h1:oiEmPz/YMMeh/JvAE8xSxNCIsvWE6lpFe4ZPlyFykQI=
@@ -355,8 +355,8 @@ github.com/go-git/go-billy/v5 v5.8.0 h1:I8hjc3LbBlXTtVuFNJuwYuMiHvQJDq1AT6u4DwDz
 github.com/go-git/go-billy/v5 v5.8.0/go.mod h1:RpvI/rw4Vr5QA+Z60c6d6LXH0rYJo0uD5SqfmrrheCY=
 github.com/go-git/go-git/v5 v5.19.2 h1:wkfn7vOlUBu8ivAWKBWisTiwJK4jYHzTF8Ndv1LyGqY=
 github.com/go-git/go-git/v5 v5.19.2/go.mod h1:QqCBE1EFN5ddFmrliLQ3/ntRCUjZU3EJuwuB/jWEHjk=
-github.com/go-jose/go-jose/v4 v4.1.5 h1:RjgjO2LOtWOJKUC5wpwY9LR3B3vwVAz6JS2YHfYU6eA=
-github.com/go-jose/go-jose/v4 v4.1.5/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
+github.com/go-jose/go-jose/v4 v4.1.6 h1:sNRkftxFJxwsILiQukqp5z83QBSmntVwmgRY7AqBDO4=
+github.com/go-jose/go-jose/v4 v4.1.6/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8=
 github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=