Skip to content

Commit

Permalink
bug: include key_id for #2
Browse files Browse the repository at this point in the history
  • Loading branch information
@ryanvade
ryanvade authored Apr 11, 2021
1 parent 31fc65c commit 296ea7d
Show file tree
Hide file tree
Showing 4 changed files with 271 additions and 208 deletions.
246 changes: 136 additions & 110 deletions __tests__/index.test.ts
View file
Original file line number Diff line number Diff line change
@@ -1,130 +1,156 @@
import * as AWSMock from "aws-sdk-mock";
import nock from "nock";
import { getIamUserName, createNewAccessKeyForUser, deleteAccessKey, getRepositorySecretsPublicKey, updateSecret } from "../src/index";
import {
getIamUserName,
createNewAccessKeyForUser,
deleteAccessKey,
getRepositorySecretsPublicKey,
updateSecret,
} from "../src/index";

describe("index", () => {
beforeEach(() => {
process.env.AWS_ACCESS_KEY_ID = "SOME_ACCESS_KEY";
process.env.AWS_SECRET_ACCESS_KEY = "SOME_SECRET_KEY";
process.env.AWS_DEFAULT_REGION = "us-east-1";
process.env.GITHUB_REPOSITORY = "test/repo";
process.env.GITHUB_ACTION = "test-action";
process.env[`INPUT_${"GITHUB_TOKEN".replace(/ /g, '_').toUpperCase()}`] = "SOME_GITHUB_TOKEN";
beforeEach(() => {
process.env.AWS_ACCESS_KEY_ID = "SOME_ACCESS_KEY";
process.env.AWS_SECRET_ACCESS_KEY = "SOME_SECRET_KEY";
process.env.AWS_DEFAULT_REGION = "us-east-1";
process.env.GITHUB_REPOSITORY = "test/repo";
process.env.GITHUB_ACTION = "test-action";
process.env[`INPUT_${"GITHUB_TOKEN".replace(/ /g, "_").toUpperCase()}`] =
"SOME_GITHUB_TOKEN";
});

describe("getIamUserName", () => {
const name = "IAM_USER_NAME";
it("returns a provided username if it exists", async () => {
process.env[`INPUT_${name.replace(/ /g, "_").toUpperCase()}`] =
"testUser";
const userName = await getIamUserName();
expect(userName).toBe("testUser");
});

describe("getIamUserName", () => {
const name = "IAM_USER_NAME";
it("returns a provided username if it exists", async () => {
process.env[`INPUT_${name.replace(/ /g, '_').toUpperCase()}`] = "testUser";
const userName = await getIamUserName();
expect(userName).toBe("testUser");
it("returns a username from STS", async () => {
delete process.env[`INPUT_${name.replace(/ /g, "_").toUpperCase()}`];
AWSMock.mock("STS", "getCallerIdentity", () => {
return new Promise((resolve) => {
resolve({
UserId: "SOME_USER_ID",
Account: "123456789123",
Arn: "arn:aws:iam::123456789123:user/TestUser",
});
});
});

it("returns a username from STS", async () => {
delete process.env[`INPUT_${name.replace(/ /g, '_').toUpperCase()}`];
AWSMock.mock("STS", "getCallerIdentity", () => {
return new Promise((resolve) => {
resolve({
UserId: "SOME_USER_ID",
Account: "123456789123",
Arn: "arn:aws:iam::123456789123:user/TestUser"
});
});

});

const userName = await getIamUserName();
expect(userName).toBe("TestUser");
AWSMock.restore();
});

it("throws an error if a user arn is not returned", async () => {
delete process.env[`INPUT_${name.replace(/ /g, '_').toUpperCase()}`];
AWSMock.mock("STS", "getCallerIdentity", () => {
return new Promise((resolve) => {
resolve({
Account: "123456789123"
});
});

});

await expect(getIamUserName()).rejects.toThrowError("Cannot get current IAM User username");
AWSMock.restore();
});
const userName = await getIamUserName();
expect(userName).toBe("TestUser");
AWSMock.restore();
});

describe("createNewAccessKeyForUser", () => {
it("creates a new access key", async () => {
const accessKey = {
UserName: "TestUser",
AccessKeyId: "TEST_SOME_ACCESS_KEY",
Status: "Active",
SecretAccessKey: "TEST_SOME_SECRET_KEY",
CreateDate: new Date()
};

AWSMock.mock("IAM", "createAccessKey", () => {
return new Promise((resolve) => {
resolve({
AccessKey: accessKey
})
})
});

const response = await createNewAccessKeyForUser("TestUser");

expect(response).toEqual(accessKey);

AWSMock.restore();
it("throws an error if a user arn is not returned", async () => {
delete process.env[`INPUT_${name.replace(/ /g, "_").toUpperCase()}`];
AWSMock.mock("STS", "getCallerIdentity", () => {
return new Promise((resolve) => {
resolve({
Account: "123456789123",
});
});
});
});

describe("deleteAccessKey", () => {
it("deletes an access key", async () => {
AWSMock.mock("IAM", "deleteAccessKey", (params: any) => {
expect(params).toEqual({ UserName: "TestUser", AccessKeyId: process.env.AWS_ACCESS_KEY_ID });
return new Promise((resolve) => {
resolve({});
});
});

const response = deleteAccessKey("TestUser", process.env.AWS_ACCESS_KEY_ID || "", {
AccessKeyId: "TEST_SOME_ACCESS_KEY_ID",
SecretAccessKey: "TEST_SOME_SECRET_ACCESS_KEY",
UserName: "TestUser",
Status: "Active"
});
expect(response).toBeTruthy();
AWSMock.restore();
});
await expect(getIamUserName()).rejects.toThrowError(
"Cannot get current IAM User username"
);
AWSMock.restore();
});
});

describe("createNewAccessKeyForUser", () => {
it("creates a new access key", async () => {
const accessKey = {
UserName: "TestUser",
AccessKeyId: "TEST_SOME_ACCESS_KEY",
Status: "Active",
SecretAccessKey: "TEST_SOME_SECRET_KEY",
CreateDate: new Date(),
};

AWSMock.mock("IAM", "createAccessKey", () => {
return new Promise((resolve) => {
resolve({
AccessKey: accessKey,
});
});
});

describe("getRepositorySecretsPublicKey", () => {
it("can get the repository public key", async () => {
const scope = nock("https://api.github.com").get("/repos/test/repo/actions/secrets/public-key").reply(200, {
key_id: "SOME_KEY_ID",
key: "SOME_KEY"
});

const response = await getRepositorySecretsPublicKey();
const response = await createNewAccessKeyForUser("TestUser");

expect(response).toEqual({
key_id: "SOME_KEY_ID",
key: "SOME_KEY"
});
expect(response).toEqual(accessKey);

scope.done();
AWSMock.restore();
});
});

describe("deleteAccessKey", () => {
it("deletes an access key", async () => {
AWSMock.mock("IAM", "deleteAccessKey", (params: any) => {
expect(params).toEqual({
UserName: "TestUser",
AccessKeyId: process.env.AWS_ACCESS_KEY_ID,
});
return new Promise((resolve) => {
resolve({});
});
});

const response = deleteAccessKey(
"TestUser",
process.env.AWS_ACCESS_KEY_ID || "",
{
AccessKeyId: "TEST_SOME_ACCESS_KEY_ID",
SecretAccessKey: "TEST_SOME_SECRET_ACCESS_KEY",
UserName: "TestUser",
Status: "Active",
}
);
expect(response).toBeTruthy();
AWSMock.restore();
});
});

describe("getRepositorySecretsPublicKey", () => {
it("can get the repository public key", async () => {
const scope = nock("https://api.github.com")
.get("/repos/test/repo/actions/secrets/public-key")
.reply(200, {
key_id: "SOME_KEY_ID",
key: "SOME_KEY",
});

describe("updateSecret", () => {
it("can update a github action repository secret", async () => {
const scope = nock("https://api.github.com").put("/repos/test/repo/actions/secrets/TEST-SECRET-NAME").reply(204);
const response = await getRepositorySecretsPublicKey();

const response = await updateSecret("TEST-SECRET-NAME", "TEST_SOME_ACCESS_KEY", { key_id: "SOME_KEY", key: "wSXrksYGOupypWCJbux1hLU8ZeTpIgAqG65YaK0Za18="});
expect(response.status).toEqual(204);
scope.done();
});
})
});
expect(response).toEqual({
key_id: "SOME_KEY_ID",
key: "SOME_KEY",
});

scope.done();
});
});

describe("updateSecret", () => {
it("can update a github action repository secret", async () => {
const scope = nock("https://api.github.com")
.put("/repos/test/repo/actions/secrets/TEST-SECRET-NAME")
.reply(204);

const response = await updateSecret(
"TEST-SECRET-NAME",
"TEST_SOME_ACCESS_KEY",
{
key_id: "SOME_KEY",
key: "wSXrksYGOupypWCJbux1hLU8ZeTpIgAqG65YaK0Za18=",
}
);
expect(response.status).toEqual(204);
scope.done();
});
});
});
31 changes: 19 additions & 12 deletions dist/index.js
View file
Original file line number Diff line number Diff line change
Expand Up @@ -105,9 +105,11 @@ function createNewAccessKeyForUser(username) {
switch (_a.label) {
case 0:
iam = new aws_sdk_1.IAM();
return [4 /*yield*/, iam.createAccessKey({
UserName: username
}).promise()];
return [4 /*yield*/, iam
.createAccessKey({
UserName: username,
})
.promise()];
case 1:
response = _a.sent();
return [2 /*return*/, response.AccessKey];
Expand All @@ -124,15 +126,17 @@ function deleteAccessKey(username, oldAccessKeyId, newAccessKey) {
case 0:
creds = new aws_sdk_1.Credentials({
accessKeyId: newAccessKey.AccessKeyId,
secretAccessKey: newAccessKey.SecretAccessKey
secretAccessKey: newAccessKey.SecretAccessKey,
});
iam = new aws_sdk_1.IAM({
credentials: creds
credentials: creds,
});
return [4 /*yield*/, iam.deleteAccessKey({
return [4 /*yield*/, iam
.deleteAccessKey({
UserName: username,
AccessKeyId: oldAccessKeyId
}).promise()];
AccessKeyId: oldAccessKeyId,
})
.promise()];
case 1:
response = _a.sent();
return [2 /*return*/, response.$response];
Expand All @@ -151,7 +155,7 @@ function getRepositorySecretsPublicKey() {
repo = github.context.repo;
return [4 /*yield*/, octokit.request("GET /repos/{owner}/{repo}/actions/secrets/public-key", {
owner: repo.owner,
repo: repo.repo
repo: repo.repo,
})];
case 1:
response = _a.sent();
Expand All @@ -178,7 +182,8 @@ function updateSecret(secretName, secretValue, publicKey) {
owner: repo.owner,
repo: repo.repo,
secret_name: secretName,
encrypted_value: encrypted
encrypted_value: encrypted,
key_id: publicKey.key_id,
})];
case 1:
response = _a.sent();
Expand All @@ -204,7 +209,9 @@ function run() {
return [4 /*yield*/, getIamUserName()];
case 2:
username = _a.sent();
accessKeySecretName = core.getInput("ACCESS_KEY_ID_SECRET_NAME", { required: true });
accessKeySecretName = core.getInput("ACCESS_KEY_ID_SECRET_NAME", {
required: true,
});
secretAccessKeySecretName = core.getInput("SECRET_ACCESS_KEY_SECRET_NAME", { required: true });
core.debug("Access Key ID Secret Name: " + accessKeySecretName);
core.debug("Secret Access Key Secret Name: " + secretAccessKeySecretName);
Expand All @@ -216,7 +223,7 @@ function run() {
publicKey = _a.sent();
return [4 /*yield*/, Promise.all([
updateSecret(accessKeySecretName, newAccessKey.AccessKeyId, publicKey),
updateSecret(secretAccessKeySecretName, newAccessKey.SecretAccessKey, publicKey)
updateSecret(secretAccessKeySecretName, newAccessKey.SecretAccessKey, publicKey),
])];
case 5:
_a.sent();
Expand Down
2 changes: 1 addition & 1 deletion dist/index.js.map
View file

Large diffs are not rendered by default.

Loading

0 comments on commit 296ea7d

Please sign in to comment.