@alicloud/fun/lib/ram.js

'use strict';
var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
    return new (P || (P = Promise))(function (resolve, reject) {
        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
        function step(result) { result.done ? resolve(result.value) : new P(function (resolve) { resolve(result.value); }).then(fulfilled, rejected); }
        step((generator = generator.apply(thisArg, _arguments || [])).next());
    });
};
const Ram = require('@alicloud/ram');
const getProfile = require('./profile').getProfile;
const promiseRetry = require('./retry');
const { red } = require('colors');
const debug = require('debug')('fun:ram');
const _ = require('lodash');
const { throwProcessedPopPermissionError } = require('./error-message');
const FNF_ASSUME_ROLE_POLICY = {
    'Statement': [
        {
            'Action': 'sts:AssumeRole',
            'Effect': 'Allow',
            'Principal': {
                'Service': [
                    'fnf.aliyuncs.com'
                ]
            }
        }
    ],
    'Version': '1'
};
const getRamClient = () => __awaiter(this, void 0, void 0, function* () {
    const profile = yield getProfile();
    const ram = new Ram({
        accessKeyId: profile.accessKeyId,
        accessKeySecret: profile.accessKeySecret,
        endpoint: 'https://ram.aliyuncs.com',
        opts: {
            timeout: profile.timeout * 1000
        }
    });
    const realRequest = ram.request.bind(ram);
    ram.request = (action, params, options) => __awaiter(this, void 0, void 0, function* () {
        try {
            return yield realRequest(action, params, options);
        }
        catch (ex) {
            yield throwProcessedPopPermissionError(ex, action);
            throw ex;
        }
    });
    return ram;
});
function normalizeRoleOrPoliceName(roleName) {
    return roleName.replace(/_/g, '-');
}
function deletePolicyNotDefaultVersion(ram, policyName) {
    return __awaiter(this, void 0, void 0, function* () {
        const listResponse = yield ram.listPolicyVersions({
            PolicyType: 'Custom',
            PolicyName: policyName
        });
        const versions = (listResponse.PolicyVersions || {}).PolicyVersion;
        if (versions) {
            for (let version of versions) {
                if (version.IsDefaultVersion === false) {
                    yield ram.deletePolicyVersion({
                        PolicyName: policyName,
                        VersionId: version.VersionId
                    });
                }
            }
        }
    });
}
function makePolicy(policyName, policyDocument) {
    return __awaiter(this, void 0, void 0, function* () {
        const ram = yield getRamClient();
        let exists = true;
        yield promiseRetry((retry, times) => __awaiter(this, void 0, void 0, function* () {
            try {
                try {
                    yield ram.getPolicy({
                        PolicyType: 'Custom',
                        PolicyName: policyName
                    });
                }
                catch (ex) {
                    if (ex.code !== 'EntityNotExist.Policy') {
                        throw ex;
                    }
                    else {
                        exists = false;
                    }
                }
                if (!exists) {
                    yield ram.createPolicy({
                        PolicyName: policyName,
                        Description: 'generated by fc fun',
                        PolicyDocument: JSON.stringify(policyDocument)
                    });
                }
                else {
                    // avoid limitExceeded.Policy.Version
                    yield deletePolicyNotDefaultVersion(ram, policyName);
                    yield ram.createPolicyVersion({
                        PolicyName: policyName,
                        PolicyDocument: JSON.stringify(policyDocument),
                        SetAsDefault: true
                    });
                }
            }
            catch (ex) {
                if (ex.code && ex.code === 'NoPermission') {
                    throw ex;
                }
                console.log(red(`retry ${times} times`));
                retry(ex);
            }
        }));
    });
}
function attachPolicyToRole(policyName, roleName, policyType = 'System') {
    return __awaiter(this, void 0, void 0, function* () {
        const ram = yield getRamClient();
        yield promiseRetry((retry, times) => __awaiter(this, void 0, void 0, function* () {
            try {
                const policies = yield ram.listPoliciesForRole({
                    RoleName: roleName
                });
                var policy = policies.Policies.Policy.find((item) => {
                    return _.toLower(item.PolicyName) === _.toLower(policyName);
                });
                if (!policy) {
                    yield ram.attachPolicyToRole({
                        PolicyType: policyType,
                        PolicyName: policyName,
                        RoleName: roleName
                    });
                }
            }
            catch (ex) {
                if (ex.code && ex.code === 'NoPermission') {
                    throw ex;
                }
                debug('error when attachPolicyToRole: %s, policyName %s, error is: \n%O', roleName, policyName, ex);
                console.log(red(`retry ${times} times`));
                retry(ex);
            }
        }));
    });
}
function getRamRole(ramClient, roleName) {
    return __awaiter(this, void 0, void 0, function* () {
        try {
            return yield ramClient.getRole({
                RoleName: roleName
            });
        }
        catch (ex) {
            debug('error when getRole: %s, error is: \n%O', roleName, ex);
            if (ex.name !== 'EntityNotExist.RoleError') {
                throw ex;
            }
        }
    });
}
function makeRole(roleName, createRoleIfNotExist, description = 'FunctionCompute Default Role', assumeRolePolicy) {
    return __awaiter(this, void 0, void 0, function* () {
        const ram = yield getRamClient();
        var role;
        yield promiseRetry((retry, times) => __awaiter(this, void 0, void 0, function* () {
            try {
                role = yield getRamRole(ram, roleName);
                if (!assumeRolePolicy) {
                    assumeRolePolicy = {
                        'Statement': [
                            {
                                'Action': 'sts:AssumeRole',
                                'Effect': 'Allow',
                                'Principal': {
                                    'Service': [
                                        'fc.aliyuncs.com'
                                    ]
                                }
                            }
                        ],
                        'Version': '1'
                    };
                }
                if (!role && createRoleIfNotExist) {
                    role = yield ram.createRole({
                        RoleName: roleName,
                        Description: description,
                        AssumeRolePolicyDocument: JSON.stringify(assumeRolePolicy)
                    });
                }
                else if (!role) {
                    throw new Error(`role ${roleName} not exist`);
                }
            }
            catch (ex) {
                debug('error when makeRole: %s, error is: \n%O', roleName, ex);
                if (ex.code && ex.code.startsWith('InvalidParameter')) {
                    throw ex;
                }
                else if (ex.code && ex.code === 'NoPermission') {
                    throw ex;
                }
                else {
                    console.log(red(`retry ${times} times`));
                    retry(ex);
                }
            }
        }));
        return role;
    });
}
function makeAndAttachPolicy(policyName, policyDocument, roleName) {
    return __awaiter(this, void 0, void 0, function* () {
        debug('begin makePolicy');
        yield makePolicy(policyName, policyDocument);
        debug('begin attachPolicyToRole');
        yield attachPolicyToRole(policyName, roleName, 'Custom');
    });
}
module.exports = {
    makeRole, makePolicy,
    attachPolicyToRole, makeAndAttachPolicy,
    normalizeRoleOrPoliceName,
    FNF_ASSUME_ROLE_POLICY
};