|
| 1 | +// |
| 2 | +// SecretsStorageAWSError.swift |
| 3 | +// xcodeinstall |
| 4 | +// |
| 5 | +// Created by Kiro AI |
| 6 | +// |
| 7 | + |
| 8 | +#if canImport(FoundationEssentials) |
| 9 | +import FoundationEssentials |
| 10 | +#else |
| 11 | +import Foundation |
| 12 | +#endif |
| 13 | + |
| 14 | +/// Errors thrown by AWS Secrets Manager operations |
| 15 | +enum SecretsStorageAWSError: Error, LocalizedError { |
| 16 | + case invalidRegion(region: String) |
| 17 | + case secretDoesNotExist(secretname: String) |
| 18 | + case noCredentialProvider(profileName: String?, underlyingError: Error) |
| 19 | + |
| 20 | + var errorDescription: String? { |
| 21 | + switch self { |
| 22 | + case .invalidRegion(let region): |
| 23 | + return "Invalid AWS region: '\(region)'" |
| 24 | + case .secretDoesNotExist(let secretname): |
| 25 | + return "AWS secret '\(secretname)' does not exist" |
| 26 | + case .noCredentialProvider(let profileName, let underlyingError): |
| 27 | + return buildCredentialErrorMessage(profileName: profileName, underlyingError: underlyingError) |
| 28 | + } |
| 29 | + } |
| 30 | + |
| 31 | + /// Builds a context-aware error message based on the profile configuration |
| 32 | + private func buildCredentialErrorMessage(profileName: String?, underlyingError: Error) -> String { |
| 33 | + let underlyingMessage = "\(underlyingError)" |
| 34 | + |
| 35 | + // Check if this looks like an expired/invalid credential vs missing configuration |
| 36 | + let isExpiredCredential = underlyingMessage.contains("expired") |
| 37 | + || underlyingMessage.contains("invalid") |
| 38 | + || underlyingMessage.contains("UnrecognizedClientException") |
| 39 | + || underlyingMessage.contains("InvalidClientTokenId") |
| 40 | + |
| 41 | + if let profileName = profileName { |
| 42 | + // Try to detect the profile type |
| 43 | + let profileType = detectProfileType(profileName: profileName) |
| 44 | + |
| 45 | + var message = "Your AWS session has expired or credentials are invalid for profile '\(profileName)'. " |
| 46 | + |
| 47 | + switch profileType { |
| 48 | + case .sso: |
| 49 | + message += "Please reauthenticate using:\n aws sso login --profile \(profileName)" |
| 50 | + case .login: |
| 51 | + message += "Please reauthenticate using:\n aws login --profile \(profileName)" |
| 52 | + case .staticCredentials: |
| 53 | + message += "Please verify your credentials in ~/.aws/credentials or reauthenticate using:\n aws configure --profile \(profileName)" |
| 54 | + case .unknown: |
| 55 | + message += "Please reauthenticate using one of:\n" |
| 56 | + message += " aws sso login --profile \(profileName) (if using IAM Identity Center)\n" |
| 57 | + message += " aws login --profile \(profileName) (if using console credentials)\n" |
| 58 | + message += " aws configure --profile \(profileName) (to update static credentials)" |
| 59 | + } |
| 60 | + |
| 61 | + if !isExpiredCredential { |
| 62 | + message += "\n\nNote: If the profile doesn't exist, verify it's configured in ~/.aws/config or ~/.aws/credentials" |
| 63 | + } |
| 64 | + |
| 65 | + return message |
| 66 | + } else { |
| 67 | + // No profile specified |
| 68 | + var message = "Your AWS session has expired or no credentials are configured. " |
| 69 | + message += "Please reauthenticate using one of:\n" |
| 70 | + message += " aws login (for console credentials)\n" |
| 71 | + message += " aws sso login (for IAM Identity Center)\n" |
| 72 | + message += " aws configure (for static credentials)\n" |
| 73 | + message += " export AWS_ACCESS_KEY_ID=... (for environment variables)" |
| 74 | + |
| 75 | + return message |
| 76 | + } |
| 77 | + } |
| 78 | + |
| 79 | + /// Detects the type of AWS profile by reading the config file |
| 80 | + private func detectProfileType(profileName: String) -> ProfileType { |
| 81 | + let configPath = FileManager.default.homeDirectoryForCurrentUser |
| 82 | + .appendingPathComponent(".aws") |
| 83 | + .appendingPathComponent("config") |
| 84 | + |
| 85 | + guard let configContent = try? String(contentsOf: configPath, encoding: .utf8) else { |
| 86 | + return .unknown |
| 87 | + } |
| 88 | + |
| 89 | + // Look for the profile section |
| 90 | + // Note: The default profile can use either [default] or [profile default] |
| 91 | + let profileSections = profileName == "default" |
| 92 | + ? ["[default]", "[profile default]"] |
| 93 | + : ["[profile \(profileName)]"] |
| 94 | + |
| 95 | + var profileRange: Range<String.Index>? |
| 96 | + |
| 97 | + for section in profileSections { |
| 98 | + if let range = configContent.range(of: section) { |
| 99 | + profileRange = range |
| 100 | + break |
| 101 | + } |
| 102 | + } |
| 103 | + |
| 104 | + guard let range = profileRange else { |
| 105 | + return .unknown |
| 106 | + } |
| 107 | + |
| 108 | + // Extract the profile section content (until next section or end) |
| 109 | + let startIndex = range.upperBound |
| 110 | + let remainingContent = configContent[startIndex...] |
| 111 | + |
| 112 | + let sectionContent: String |
| 113 | + if let nextSectionRange = remainingContent.range(of: "\n[") { |
| 114 | + sectionContent = String(remainingContent[..<nextSectionRange.lowerBound]) |
| 115 | + } else { |
| 116 | + sectionContent = String(remainingContent) |
| 117 | + } |
| 118 | + |
| 119 | + // Check for SSO configuration |
| 120 | + if sectionContent.contains("sso_start_url") || |
| 121 | + sectionContent.contains("sso_session") || |
| 122 | + sectionContent.contains("sso_account_id") { |
| 123 | + return .sso |
| 124 | + } |
| 125 | + |
| 126 | + // Check for login configuration (console credentials) |
| 127 | + // The aws login command creates a login_session entry |
| 128 | + if sectionContent.contains("login_session") { |
| 129 | + return .login |
| 130 | + } |
| 131 | + |
| 132 | + // Check if credentials file has static credentials for this profile |
| 133 | + let credentialsPath = FileManager.default.homeDirectoryForCurrentUser |
| 134 | + .appendingPathComponent(".aws") |
| 135 | + .appendingPathComponent("credentials") |
| 136 | + |
| 137 | + if let credentialsContent = try? String(contentsOf: credentialsPath, encoding: .utf8), |
| 138 | + credentialsContent.contains("[\(profileName)]") { |
| 139 | + return .staticCredentials |
| 140 | + } |
| 141 | + |
| 142 | + // If profile exists in config but we can't determine the type |
| 143 | + return .unknown |
| 144 | + } |
| 145 | + |
| 146 | + enum ProfileType { |
| 147 | + case sso |
| 148 | + case login |
| 149 | + case staticCredentials |
| 150 | + case unknown |
| 151 | + } |
| 152 | +} |
0 commit comments