feat(assume): Cloudflare R2 credentials - #57
Draft
cnuss wants to merge 3 commits into
Draft
Conversation
…ndpoints) Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01S2Gf535RGgcd9pCSNjGaGU
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01S2Gf535RGgcd9pCSNjGaGU
When the backend returns `cloudflareR2` on an assume response, --headless exports S3-shaped env vars including AWS_ENDPOINT_URL and AWS_REGION=auto, and --save writes the same into an ~/.aws profile. Choosing an R2 role interactively saves a profile named after the bucket since there is no console to open. AWS roles are unchanged. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01S2Gf535RGgcd9pCSNjGaGU
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds the Cloudflare R2 output path to
saml-to assume. When the backend returnscloudflareR2on the assume response (roles under atype: cloudflare-r2provider), the CLI hands the short-lived credentials to the shell or to an~/.awsprofile. AWS roles are untouched.Depends on backend PR https://github.com/saml-to/github-sls-rest-api/pull/110. Secret delivery companion: saml-to/config-sync-action#14.
Behaviour
--headless: oneexportline withAWS_ACCESS_KEY_ID,AWS_SECRET_ACCESS_KEY,AWS_SESSION_TOKEN,AWS_REGION=auto,AWS_DEFAULT_REGION=auto,AWS_ENDPOINT_URL=<account endpoint>,AWS_REQUEST_CHECKSUM_CALCULATION=when_required,AWS_RESPONSE_CHECKSUM_VALIDATION=when_required. PowerShell output as for AWS.--save <profile>:aws configure setfor the same values (region auto,endpoint_url, keys, checksum settings);--headless --saveprintsAWS_PROFILE.list-roles; if its issuer is an R2 endpoint it saves a profile named after the bucket. Detection is by issuer host (*.r2.cloudflarestorage.com), which the backend sets for r2 providers.Changes
src/helpers/r2/env.ts(pure:buildR2Env,buildR2ProfileSettings,isR2Issuer) + testssrc/helpers/r2/r2Helper.ts:assumeR2(env / profile)src/commands/assume.ts:cloudflareR2dispatch inassumeTerminal;findR2Rolefor the interactive pathapi/github-sls-rest-api: client regenerated from the backend branch's spec (1.0.105-36); previous client was from1.0.82-0, hence the size of that diffyarn test); README section;dist/rebuilt with esbuildTesting
yarn test: 5 unit tests.yarn build: green. Prettier clean on changed files.yarn lintcrashes in this repo before this change (@typescript-eslint/experimental-utilsvs the installed eslint) — not addressed here.acceptance-tests.yml) exercise only the AWS path, which is unchanged.Release
Merge after the backend is live on nonlive; publish as 3.1.0.
🤖 Generated with Claude Code
https://claude.ai/code/session_01S2Gf535RGgcd9pCSNjGaGU