|
| 1 | +import fs from 'fs-extra'; |
| 2 | +import path from 'path'; |
| 3 | +import { SYSTEM_PATHS } from '../system/paths.js'; |
| 4 | + |
| 5 | +export type PolicyUpdateChannel = 'stable' | 'beta'; |
| 6 | +export type PolicyScope = 'User' | 'Machine'; |
| 7 | + |
| 8 | +export interface EnterprisePolicy { |
| 9 | + updates?: { |
| 10 | + enabled?: boolean; |
| 11 | + channel?: PolicyUpdateChannel; |
| 12 | + pinnedVersion?: string; |
| 13 | + }; |
| 14 | + auth?: { |
| 15 | + allowUserLogin?: boolean; |
| 16 | + allowAdcLogin?: boolean; |
| 17 | + allowServiceAccountKey?: boolean; |
| 18 | + allowedScopes?: PolicyScope[]; |
| 19 | + }; |
| 20 | +} |
| 21 | + |
| 22 | +export interface ResolvedUpgradePolicy { |
| 23 | + channel?: PolicyUpdateChannel; |
| 24 | + targetVersion?: string; |
| 25 | +} |
| 26 | + |
| 27 | +export function getPolicyPath(): string { |
| 28 | + const fromEnv = process.env.CLOUDSQLCTL_POLICY_PATH; |
| 29 | + if (fromEnv) return path.resolve(fromEnv); |
| 30 | + return SYSTEM_PATHS.POLICY_FILE; |
| 31 | +} |
| 32 | + |
| 33 | +function normalizeVersion(version: string): string { |
| 34 | + return version.startsWith('v') ? version.slice(1) : version; |
| 35 | +} |
| 36 | + |
| 37 | +export async function readPolicy(): Promise<EnterprisePolicy | null> { |
| 38 | + const policyPath = getPolicyPath(); |
| 39 | + if (!await fs.pathExists(policyPath)) return null; |
| 40 | + |
| 41 | + const content = await fs.readFile(policyPath, 'utf8'); |
| 42 | + try { |
| 43 | + return JSON.parse(content) as EnterprisePolicy; |
| 44 | + } catch (error) { |
| 45 | + throw new Error(`Invalid policy.json at ${policyPath}: ${error instanceof Error ? error.message : String(error)}`); |
| 46 | + } |
| 47 | +} |
| 48 | + |
| 49 | +export function resolveUpgradePolicy(policy: EnterprisePolicy | null, options: { channel?: string; version?: string; pin?: string; unpin?: boolean; }) { |
| 50 | + if (!policy) return {} satisfies ResolvedUpgradePolicy; |
| 51 | + |
| 52 | + if (policy.updates?.enabled === false) { |
| 53 | + throw new Error('Updates are disabled by enterprise policy.'); |
| 54 | + } |
| 55 | + |
| 56 | + const enforcedChannel = policy.updates?.channel; |
| 57 | + if (enforcedChannel && options.channel && options.channel !== enforcedChannel) { |
| 58 | + throw new Error(`Update channel is restricted by enterprise policy (allowed: ${enforcedChannel}).`); |
| 59 | + } |
| 60 | + |
| 61 | + const enforcedPinned = policy.updates?.pinnedVersion; |
| 62 | + if (enforcedPinned) { |
| 63 | + if (options.pin || options.unpin) { |
| 64 | + throw new Error('Pin/unpin is managed by enterprise policy.'); |
| 65 | + } |
| 66 | + |
| 67 | + const requested = options.version ? normalizeVersion(options.version) : undefined; |
| 68 | + const enforced = normalizeVersion(enforcedPinned); |
| 69 | + if (requested && requested !== enforced) { |
| 70 | + throw new Error(`Target version is restricted by enterprise policy (allowed: ${enforced}).`); |
| 71 | + } |
| 72 | + |
| 73 | + return { channel: enforcedChannel, targetVersion: enforced }; |
| 74 | + } |
| 75 | + |
| 76 | + return { channel: enforcedChannel }; |
| 77 | +} |
| 78 | + |
| 79 | +export function assertPolicyAllowsAuth(policy: EnterprisePolicy | null, action: 'login' | 'adc' | 'set-service-account', scope?: PolicyScope) { |
| 80 | + if (!policy) return; |
| 81 | + |
| 82 | + if (action === 'login' && policy.auth?.allowUserLogin === false) { |
| 83 | + throw new Error('Interactive gcloud login is disabled by enterprise policy.'); |
| 84 | + } |
| 85 | + if (action === 'adc' && policy.auth?.allowAdcLogin === false) { |
| 86 | + throw new Error('ADC login is disabled by enterprise policy.'); |
| 87 | + } |
| 88 | + if (action === 'set-service-account' && policy.auth?.allowServiceAccountKey === false) { |
| 89 | + throw new Error('Service account key management is disabled by enterprise policy.'); |
| 90 | + } |
| 91 | + |
| 92 | + if (action === 'set-service-account' && scope && policy.auth?.allowedScopes && !policy.auth.allowedScopes.includes(scope)) { |
| 93 | + throw new Error(`Scope '${scope}' is not allowed by enterprise policy.`); |
| 94 | + } |
| 95 | +} |
| 96 | + |
0 commit comments