id       = "awsume"
name     = "AWSume"
homepage = "https://awsu.me"
description = "Awsume is a convenient way to manage session tokens and assume role credentials."
# The logo awsu.me shows in its own header.
icon     = "https://awsu.me/logo.png"
executables   = ["awsume"]

[dotfiles]

# https://awsu.me/general/config.html: "Awsume's configuration file can be found
# at ~/.awsume/config.yaml by default. If the XDG_CONFIG_HOME environment
# variable is set then it can be found at: ${XDG_CONFIG_HOME}/awsume/config.yaml"
# — awsume/awsumepy/lib/constants.py picks between the same two. The second is
# the XDG config home itself, so it is written as [configHome] rather than as
# that variable's default.
paths = [
  "~/.awsume/config.yaml",
  "[configHome]/awsume/config.yaml",
]

# constants.py: AWSUME_CACHE_DIR holds cached session credentials and
# AWSUME_LOG_DIR holds the debug log. Both move under XDG_CACHE_HOME /
# XDG_STATE_HOME when those are set, so both spellings are carved out.
# Short-lived machine state, and the cache carries live AWS session tokens.
# The cache home is written [xdgCache] for the same reason config.yaml above is
# [configHome]: constants.py reads the variable itself
# (`AWSUME_CACHE_DIR = XDG_CACHE_HOME / 'awsume'`) on every platform and never
# touches ~/Library/Caches, so the XDG half of the pair is the one that names
# what awsume opens. Note that awsume branches on the variable being *set*, not
# on its default: with XDG_CACHE_HOME unset the cache is ~/.awsume/cache, listed
# above, and never ~/.cache/awsume. $XDG_STATE_HOME has no placeholder, so the
# log directory keeps its literal spelling.
exclude = [
  "~/.awsume/cache/",
  "~/.awsume/logs/",
  "[xdgCache]/awsume/",
  "~/.local/state/awsume/logs/",
]

# awsume reads the profiles it assumes from ~/.aws/config and ~/.aws/credentials
# (constants.py: DEFAULT_CONFIG_FILE / DEFAULT_CREDENTIALS_FILE), which are the
# aws entry's files. Its own config file holds preferences only.
secret = []

# Read once per invocation.
side_effect = false

# No machine_lines: colors, fuzzy matching, default region, role duration and
# session name are preferences that should follow the user.

[commands]
format = 1
label = "Assume an AWS role"
description = "Assume a profile or role and export its credentials, or open the AWS console. SAML, web identity, plugin and JSON credential options are left out."
quality = "ai-draft"
base = "fig:awsume"
parser = { end_of_options = "--", interleave = "permute", long_equals = true, short_attached = true, short_bundles = true }

[[commands.source]]
id = "fig"
kind = "completion"
url = "https://github.com/withfig/autocomplete/blob/master/src/awsume.ts"
license = "MIT"

[[commands.field]]
id = "profile"
label = "Profile"
description = "Profile name from your AWS config."
type = "string"
position = 0
sources = ["fig"]

[[commands.field]]
id = "region"
label = "Region"
type = "string"
option = ["--region"]
sources = ["fig"]

[[commands.field]]
id = "role_arn"
label = "Role ARN"
description = "Role ARN or <partition>:<account_id>:<role_name>."
type = "string"
option = ["--role-arn"]
sources = ["fig"]

[[commands.field]]
id = "source_profile"
label = "Source profile"
description = "Used with a role ARN."
type = "string"
option = ["--source-profile"]
sources = ["fig"]

[[commands.field]]
id = "mfa_token"
label = "MFA token"
type = "string"
option = ["--mfa-token"]
sources = ["fig"]

[[commands.field]]
id = "external_id"
label = "External ID"
type = "string"
option = ["--external-id"]
sources = ["fig"]

[[commands.field]]
id = "session_name"
label = "Role session name"
type = "string"
option = ["--session-name"]
sources = ["fig"]

[[commands.field]]
id = "role_duration"
label = "Role duration (seconds)"
type = "integer"
option = ["--role-duration"]
sources = ["fig"]

[[commands.field]]
id = "output_profile"
label = "Output profile"
description = "Profile to write credentials to."
type = "string"
option = ["--output-profile", "-o"]
sources = ["fig"]

[[commands.field]]
id = "refresh"
label = "Force refresh"
type = "boolean"
option = ["--refresh", "-r"]
sources = ["fig"]

[[commands.field]]
id = "auto_refresh"
label = "Auto refresh"
type = "boolean"
option = ["--auto-refresh", "-a"]
sources = ["fig"]

[[commands.field]]
id = "show_commands"
label = "Show export commands"
type = "boolean"
option = ["--show-commands", "-s"]
sources = ["fig"]

[[commands.field]]
id = "unset"
label = "Unset AWS variables"
type = "boolean"
option = ["--unset", "-u"]
sources = ["fig"]

[[commands.field]]
id = "console"
label = "Open AWS console"
type = "boolean"
option = ["--console", "-c"]
sources = ["fig"]

[[commands.field]]
id = "console_service"
label = "Console service"
description = "Open the console on a specific service."
type = "string"
option = ["--console-service"]
sources = ["fig"]

[[commands.task]]
id = "assume"
label = "Assume profile"
fields = ["profile", "region", "mfa_token"]
required = ["profile"]

[[commands.task]]
id = "console"
label = "Open console"
fields = ["profile", "console", "console_service"]
required = ["profile"]
set = { console = [true] }

[[commands.task]]
id = "unset"
label = "Unset credentials"
fields = ["unset"]
required = []
set = { unset = [true] }
lock = ["unset"]

[[commands.group]]
id = "basic"
label = "Basic"
fields = ["profile", "region", "unset", "console"]

[[commands.group]]
id = "advanced"
label = "Advanced"
fields = ["role_arn", "source_profile", "mfa_token", "external_id", "session_name", "role_duration", "output_profile", "refresh", "auto_refresh", "show_commands", "console_service"]