feat: Typer CLI implementation with cognito device authorization flow #93
Conversation
| To access the help mode for the CLI, simply append the `--help` flag to any command. For example: | ||
|
|
||
| ```bash | ||
| sbt-aws-cli --help |
There was a problem hiding this comment.
Does the actual executable have to be called sbt-aws-cli? Couldn't we make it just sbt-aws or even sbt?
There was a problem hiding this comment.
I don't know for certain, but I think a lot of the funcs in this file are utilities native to Javascript. btoa and atob are two examples. There might be others, including the url decoding/encoding. I would prefer to use a library for this stuff, rather than re-implement ourselves (especially with no tests). Thoughts?
|
|
||
| //Function a random string based of the required lenght and format | ||
| // length: length of the random string to generate | ||
| // client_id: format of the randrom string to generate |
There was a problem hiding this comment.
I left an overall comment on this file, but this func specifically seems like it could pulled from uuid? Also, re: docs, there is no client_id parameter. Chars?
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| print("Configuring with:") | ||
| print(f"CONTROL_PLANE_STACK_NAME: {control_plane_stack}") | ||
| print(f"CLIENT_ID: {client_id}") | ||
| print(f"CLIENT_SECRET: {client_secret}") |
Check failure
Code scanning / CodeQL
Clear-text logging of sensitive information High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI about 1 month ago
To fix the problem, we need to ensure that sensitive information such as client_secret is not logged in clear text. Instead of logging the actual value, we can log a placeholder or a masked version of the sensitive data. This way, we maintain the ability to debug without exposing sensitive information.
The best way to fix this issue without changing existing functionality is to replace the logging of client_secret with a masked version. We can replace the actual value with a string indicating that it is a secret, such as "****" or "REDACTED".
| @@ -116,3 +116,3 @@ | ||
| print(f"CLIENT_ID: {client_id}") | ||
| print(f"CLIENT_SECRET: {client_secret}") | ||
| print("CLIENT_SECRET: ****") | ||
| print(f"FQDN: {fqdn}") |
Reason for this change
Builders want more flexible methods of interacting with the SBT Control plane and a CLI client provides them an additional way to leverage the platform.
Description of changes
sbt-aws-cli.pyproject.tomlfile.cli-auth.tswhich houses resources for OAuth 2.0 device authorization flow to ensure secure authentication for CLI usersDescription of how you validated changes
Checklist
By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of the project license.