aws: add role delegation and MFA support as per IAM Best Practices (#8419)

* Added role delegation support and MFA support as per IAM Best Practices

* fix: grep with color enabled breaks profile parsing

* fix: compatible with MacOS basic sed

* docs: Added jq as a dependency

* feat: added variable session duration, if the role to be assumed permits it.

* bug: incorrect assigment for session length

* fix: profile extraction failed with some versions of sed

Fixed the issue that resulted from merging upstream changes to allow "." in the profile name

* fix: broken profile parsing when profile name contains "@"

plugins/aws/README.md

@@ -3,7 +3,7 @@
 This plugin provides completion support for [awscli](https://docs.aws.amazon.com/cli/latest/reference/index.html)
 and a few utilities to manage AWS profiles and display them in the prompt.
 
-To use it, add `aws` to the plugins array in your zshrc file.
+To use it, make sure [jq](https://stedolan.github.io/jq/download/) is installed, and add `aws` to the plugins array in your zshrc file.
 
 ```zsh
 plugins=(... aws)

plugins/aws/aws.plugin.zsh

@@ -5,7 +5,7 @@ function agp() {
 # AWS profile selection
 function asp() {
   if [[ -z "$1" ]]; then
-    unset AWS_DEFAULT_PROFILE AWS_PROFILE AWS_EB_PROFILE
+    unset AWS_DEFAULT_PROFILE AWS_PROFILE AWS_EB_PROFILE AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY AWS_SESSION_TOKEN
     echo AWS profile cleared.
     return
   fi
@@ -18,9 +18,61 @@ function asp() {
     return 1
   fi
 
-  export AWS_DEFAULT_PROFILE=$1
-  export AWS_PROFILE=$1
-  export AWS_EB_PROFILE=$1
+  local exists="$(aws configure get aws_access_key_id --profile $1)"
+  local role_arn="$(aws configure get role_arn --profile $1)"
+  local aws_access_key_id=""
+  local aws_secret_access_key=""
+  local aws_session_token=""
+  if [[ -n $exists || -n $role_arn ]]; then
+    if [[ -n $role_arn ]]; then
+      local mfa_serial="$(aws configure get mfa_serial --profile $1)"
+      local mfa_token=""
+      local mfa_opt=""
+      if [[ -n $mfa_serial ]]; then
+        echo "Please enter your MFA token for $mfa_serial:"
+        read mfa_token
+        echo "Please enter the session duration in seconds (900-43200; default: 3600, which is the default maximum for a role):"
+        read sess_duration
+        if [[ -z $sess_duration ]]; then
+          sess_duration = 3600
+        fi
+        mfa_opt="--serial-number $mfa_serial --token-code $mfa_token --duration-seconds $sess_duration"
+      fi
+
+      local ext_id="$(aws configure get external_id --profile $1)"
+      local extid_opt=""
+      if [[ -n $ext_id ]]; then
+        extid_opt="--external-id $ext_id"
+      fi
+
+      local profile=$1
+      local source_profile="$(aws configure get source_profile --profile $1)"
+      if [[ -n $source_profile ]]; then
+        profile=$source_profile
+      fi
+
+      echo "Assuming role $role_arn using profile $profile"
+      local assume_cmd=(aws sts assume-role "--profile=$profile" "--role-arn $role_arn" "--role-session-name "$profile"" "$mfa_opt" "$extid_opt")
+      local JSON="$(eval ${assume_cmd[@]})"
+
+      aws_access_key_id="$(echo $JSON | jq -r '.Credentials.AccessKeyId')"
+      aws_secret_access_key="$(echo $JSON | jq -r '.Credentials.SecretAccessKey')"
+      aws_session_token="$(echo $JSON | jq -r '.Credentials.SessionToken')"
+    else
+      aws_access_key_id="$(aws configure get aws_access_key_id --profile $1)"
+      aws_secret_access_key="$(aws configure get aws_secret_access_key --profile $1)"
+      aws_session_token=""
+    fi
+
+    export AWS_DEFAULT_PROFILE=$1
+    export AWS_PROFILE=$1
+    export AWS_EB_PROFILE=$1
+    export AWS_ACCESS_KEY_ID=$aws_access_key_id
+    export AWS_SECRET_ACCESS_KEY=$aws_secret_access_key
+    [[ -z "$aws_session_token" ]] && unset AWS_SESSION_TOKEN || export AWS_SESSION_TOKEN=$aws_session_token
+
+    echo "Switched to AWS Profile: $1";
+  fi
 }
 
 function aws_change_access_key() {
@@ -41,7 +93,7 @@ function aws_change_access_key() {
 
 function aws_profiles() {
   [[ -r "${AWS_CONFIG_FILE:-$HOME/.aws/config}" ]] || return 1
-  grep '\[profile' "${AWS_CONFIG_FILE:-$HOME/.aws/config}"|sed -e 's/.*profile \([a-zA-Z0-9@_\.-]*\).*/\1/'
+  grep --color=never -Eo '\[.*\]' "${AWS_CONFIG_FILE:-$HOME/.aws/config}" | sed -E 's/^[[:space:]]*\[(profile)?[[:space:]]*([-_[:alnum:]\.@]+)\][[:space:]]*$/\2/g'
 }
 
 function _aws_profiles() {

plugins/gitfast/_git

@@ -2,25 +2,24 @@
 
 # zsh completion wrapper for git
 #
-# Copyright (c) 2012-2013 Felipe Contreras <felipe.contreras@gmail.com>
+# Copyright (c) 2012-2020 Felipe Contreras <felipe.contreras@gmail.com>
 #
-# You need git's bash completion script installed somewhere, by default it
-# would be the location bash-completion uses.
+# The recommended way to install this script is to make a copy of it as a
+# file named '_git' inside any directory in your fpath.
 #
-# If your script is somewhere else, you can configure it on your ~/.zshrc:
-#
-#  zstyle ':completion:*:*:git:*' script ~/.git-completion.zsh
-#
-# The recommended way to install this script is to copy to '~/.zsh/_git', and
-# then add the following to your ~/.zshrc file:
+# For example, create a directory '~/.zsh/', copy this file to '~/.zsh/_git',
+# and then add the following to your ~/.zshrc file:
 #
 #  fpath=(~/.zsh $fpath)
-
-complete ()
-{
-	# do nothing
-	return 0
-}
+#
+# You need git's bash completion script installed. By default bash-completion's
+# location will be used (e.g. pkg-config --variable=completionsdir bash-completion).
+#
+# If your bash completion script is somewhere else, you can specify the
+# location in your ~/.zshrc:
+#
+#  zstyle ':completion:*:*:git:*' script ~/.git-completion.bash
+#
 
 zstyle -T ':completion:*:*:git:*' tag-order && \
 	zstyle ':completion:*:*:git:*' tag-order 'common-commands'
@@ -30,16 +29,17 @@ if [ -z "$script" ]; then
 	local -a locations
 	local e
 	locations=(
-		"$(dirname ${funcsourcetrace[1]%:*})/git-completion.bash"
-		'/etc/bash_completion.d/git' # fedora, old debian
-		'/usr/share/bash-completion/completions/git' # arch, ubuntu, new debian
-		'/usr/share/bash-completion/git' # gentoo
+		"$(dirname ${funcsourcetrace[1]%:*})"/git-completion.bash
+		"$HOME/.local/share/bash-completion/completions/git"
+		"$(pkg-config --variable=completionsdir bash-completion)"/git
+		'/usr/share/bash-completion/completions/git'
+		'/etc/bash_completion.d/git' # old debian
 		)
 	for e in $locations; do
 		test -f $e && script="$e" && break
 	done
 fi
-ZSH_VERSION='' . "$script"
+GIT_SOURCING_ZSH_COMPLETION=y . "$script"
 
 __gitcomp ()
 {
@@ -50,13 +50,35 @@ __gitcomp ()
 	case "$cur_" in
 	--*=)
 		;;
+	--no-*)
+		local c IFS=$' \t\n'
+		local -a array
+		for c in ${=1}; do
+			if [[ $c == "--" ]]; then
+				continue
+			fi
+			c="$c${4-}"
+			case $c in
+			--*=|*.) ;;
+			*) c="$c " ;;
+			esac
+			array+=("$c")
+		done
+		compset -P '*[=:]'
+		compadd -Q -S '' -p "${2-}" -a -- array && _ret=0
+		;;
 	*)
 		local c IFS=$' \t\n'
 		local -a array
 		for c in ${=1}; do
+			if [[ $c == "--" ]]; then
+				c="--no-...${4-}"
+				array+=("$c ")
+				break
+			fi
 			c="$c${4-}"
 			case $c in
-			--*=*|*.) ;;
+			--*=|*.) ;;
 			*) c="$c " ;;
 			esac
 			array+=("$c")
@@ -71,35 +93,57 @@ __gitcomp_direct ()
 {
 	emulate -L zsh
 
-	local IFS=$'\n'
 	compset -P '*[=:]'
-	compadd -Q -- ${=1} && _ret=0
+	compadd -Q -S '' -- ${(f)1} && _ret=0
 }
 
 __gitcomp_nl ()
 {
 	emulate -L zsh
 
-	local IFS=$'\n'
 	compset -P '*[=:]'
-	compadd -Q -S "${4- }" -p "${2-}" -- ${=1} && _ret=0
+	compadd -Q -S "${4- }" -p "${2-}" -- ${(f)1} && _ret=0
 }
 
 __gitcomp_nl_append ()
 {
 	emulate -L zsh
 
-	local IFS=$'\n'
-	compadd -Q -S "${4- }" -p "${2-}" -- ${=1} && _ret=0
+	compset -P '*[=:]'
+	compadd -Q -S "${4- }" -p "${2-}" -- ${(f)1} && _ret=0
+}
+
+__gitcomp_file_direct ()
+{
+	emulate -L zsh
+
+	compadd -f -- ${(f)1} && _ret=0
 }
 
 __gitcomp_file ()
 {
 	emulate -L zsh
 
-	local IFS=$'\n'
-	compset -P '*[=:]'
-	compadd -Q -p "${2-}" -f -- ${=1} && _ret=0
+	compadd -f -p "${2-}" -- ${(f)1} && _ret=0
+}
+
+_git_zsh ()
+{
+	__gitcomp "v1.0"
+}
+
+__git_complete_command ()
+{
+	emulate -L zsh
+
+	local command="$1"
+	local completion_func="_git_${command//-/_}"
+	if (( $+functions[$completion_func] )); then
+		emulate ksh -c $completion_func
+		return 0
+	else
+		return 1
+	fi
 }
 
 __git_zsh_bash_func ()
@@ -108,14 +152,12 @@ __git_zsh_bash_func ()
 
 	local command=$1
 
-	local completion_func="_git_${command//-/_}"
-	declare -f $completion_func >/dev/null && $completion_func && return
+	__git_complete_command "$command" && return
 
 	local expansion=$(__git_aliased_command "$command")
 	if [ -n "$expansion" ]; then
 		words[1]=$expansion
-		completion_func="_git_${expansion//-/_}"
-		declare -f $completion_func >/dev/null && $completion_func
+		__git_complete_command "$expansion"
 	fi
 }
 
@@ -140,9 +182,11 @@ __git_zsh_cmd_common ()
 	push:'update remote refs along with associated objects'
 	rebase:'forward-port local commits to the updated upstream head'
 	reset:'reset current HEAD to the specified state'
+	restore:'restore working tree files'
 	rm:'remove files from the working tree and from the index'
 	show:'show various types of objects'
 	status:'show the working tree status'
+	switch:'switch branches'
 	tag:'create, list, delete or verify a tag object signed with GPG')
 	_describe -t common-commands 'common commands' list && _ret=0
 }
@@ -150,8 +194,9 @@ __git_zsh_cmd_common ()
 __git_zsh_cmd_alias ()
 {
 	local -a list
-	list=(${${${(0)"$(git config -z --get-regexp '^alias\.')"}#alias.}%$'\n'*})
-	_describe -t alias-commands 'aliases' list $* && _ret=0
+	list=(${${(0)"$(git config -z --get-regexp '^alias\.*')"}#alias.})
+	list=(${(f)"$(printf "%s:alias for '%s'\n" ${(f@)list})"})
+	_describe -t alias-commands 'aliases' list && _ret=0
 }
 
 __git_zsh_cmd_all ()
@@ -189,10 +234,13 @@ __git_zsh_main ()
 
 	case $state in
 	(command)
-		_alternative \
-                         'alias-commands:alias:__git_zsh_cmd_alias' \
-                         'common-commands:common:__git_zsh_cmd_common' \
-                         'all-commands:all:__git_zsh_cmd_all' && _ret=0
+		_tags common-commands alias-commands all-commands
+		while _tags; do
+			_requested common-commands && __git_zsh_cmd_common
+			_requested alias-commands && __git_zsh_cmd_alias
+			_requested all-commands && __git_zsh_cmd_all
+			let _ret || break
+		done
 		;;
 	(arg)
 		local command="${words[1]}" __git_dir
@@ -227,6 +275,8 @@ _git ()
 		emulate ksh -c __${service}_main
 	elif (( $+functions[_${service}] )); then
 		emulate ksh -c _${service}
+	elif ((	$+functions[_${service//-/_}] )); then
+		emulate ksh -c _${service//-/_}
 	fi
 
 	let _ret && _default && _ret=0

plugins/gitfast/git-prompt.sh

@@ -70,6 +70,15 @@
 # state symbols by setting GIT_PS1_STATESEPARATOR. The default separator
 # is SP.
 #
+# When there is an in-progress operation such as a merge, rebase,
+# revert, cherry-pick, or bisect, the prompt will include information
+# related to the operation, often in the form "|<OPERATION-NAME>".
+#
+# When the repository has a sparse-checkout, a notification of the form
+# "|SPARSE" will be included in the prompt.  This can be shortened to a
+# single '?' character by setting GIT_PS1_COMPRESSSPARSESTATE, or omitted
+# by setting GIT_PS1_OMITSPARSESTATE.
+#
 # By default, __git_ps1 will compare HEAD to your SVN upstream if it can
 # find one, or @{upstream} otherwise.  Once you have set
 # GIT_PS1_SHOWUPSTREAM, you can override it on a per-repository basis by
@@ -88,7 +97,8 @@
 # If you would like a colored hint about the current dirty state, set
 # GIT_PS1_SHOWCOLORHINTS to a nonempty value. The colors are based on
 # the colored output of "git status -sb" and are available only when
-# using __git_ps1 for PROMPT_COMMAND or precmd.
+# using __git_ps1 for PROMPT_COMMAND or precmd in Bash,
+# but always available in Zsh.
 #
 # If you would like __git_ps1 to do nothing in the case when the current
 # directory is set up to be ignored by git, then set
@@ -286,6 +296,37 @@ __git_eread ()
 	test -r "$1" && IFS=$'\r\n' read "$2" <"$1"
 }
 
+# see if a cherry-pick or revert is in progress, if the user has committed a
+# conflict resolution with 'git commit' in the middle of a sequence of picks or
+# reverts then CHERRY_PICK_HEAD/REVERT_HEAD will not exist so we have to read
+# the todo file.
+__git_sequencer_status ()
+{
+	local todo
+	if test -f "$g/CHERRY_PICK_HEAD"
+	then
+		r="|CHERRY-PICKING"
+		return 0;
+	elif test -f "$g/REVERT_HEAD"
+	then
+		r="|REVERTING"
+		return 0;
+	elif __git_eread "$g/sequencer/todo" todo
+	then
+		case "$todo" in
+		p[\ \	]|pick[\ \	]*)
+			r="|CHERRY-PICKING"
+			return 0
+		;;
+		revert[\ \	]*)
+			r="|REVERTING"
+			return 0
+		;;
+		esac
+	fi
+	return 1
+}
+
 # __git_ps1 accepts 0 or 1 arguments (i.e., format string)
 # when called from PS1 using command substitution
 # in this mode it prints text to add to bash PS1 prompt (includes branch name)
@@ -390,6 +431,13 @@ __git_ps1 ()
 		return $exit
 	fi
 
+	local sparse=""
+	if [ -z "${GIT_PS1_COMPRESSSPARSESTATE}" ] &&
+	   [ -z "${GIT_PS1_OMITSPARSESTATE}" ] &&
+	   [ "$(git config --bool core.sparseCheckout)" = "true" ]; then
+		sparse="|SPARSE"
+	fi
+
 	local r=""
 	local b=""
 	local step=""
@@ -398,11 +446,7 @@ __git_ps1 ()
 		__git_eread "$g/rebase-merge/head-name" b
 		__git_eread "$g/rebase-merge/msgnum" step
 		__git_eread "$g/rebase-merge/end" total
-		if [ -f "$g/rebase-merge/interactive" ]; then
-			r="|REBASE-i"
-		else
-			r="|REBASE-m"
-		fi
+		r="|REBASE"
 	else
 		if [ -d "$g/rebase-apply" ]; then
 			__git_eread "$g/rebase-apply/next" step
@@ -417,10 +461,8 @@ __git_ps1 ()
 			fi
 		elif [ -f "$g/MERGE_HEAD" ]; then
 			r="|MERGING"
-		elif [ -f "$g/CHERRY_PICK_HEAD" ]; then
-			r="|CHERRY-PICKING"
-		elif [ -f "$g/REVERT_HEAD" ]; then
-			r="|REVERTING"
+		elif __git_sequencer_status; then
+			:
 		elif [ -f "$g/BISECT_LOG" ]; then
 			r="|BISECTING"
 		fi
@@ -467,6 +509,7 @@ __git_ps1 ()
 	local i=""
 	local s=""
 	local u=""
+	local h=""
 	local c=""
 	local p=""
 
@@ -499,6 +542,11 @@ __git_ps1 ()
 			u="%${ZSH_VERSION+%}"
 		fi
 
+		if [ -n "${GIT_PS1_COMPRESSSPARSESTATE}" ] &&
+		   [ "$(git config --bool core.sparseCheckout)" = "true" ]; then
+			h="?"
+		fi
+
 		if [ -n "${GIT_PS1_SHOWUPSTREAM-}" ]; then
 			__git_ps1_show_upstream
 		fi
@@ -519,8 +567,8 @@ __git_ps1 ()
 		b="\${__git_ps1_branch_name}"
 	fi
 
-	local f="$w$i$s$u"
-	local gitstring="$c$b${f:+$z$f}$r$p"
+	local f="$h$w$i$s$u"
+	local gitstring="$c$b${f:+$z$f}${sparse}$r$p"
 
 	if [ $pcmode = yes ]; then
 		if [ "${__git_printf_supports_v-}" != yes ]; then

plugins/gitfast/update

@@ -1,9 +1,8 @@
 #!/bin/sh
 
-url="https://git.kernel.org/pub/scm/git/git.git/plain/contrib/completion"
-version="2.16.0"
+url="https://raw.githubusercontent.com/felipec/git-completion"
+version="1.0"
 
-curl -s -o _git "${url}/git-completion.zsh?h=v${version}" &&
-curl -s -o git-completion.bash "${url}/git-completion.bash?h=v${version}" &&
-curl -s -o git-prompt.sh "${url}/git-prompt.sh?h=v${version}" &&
-git apply updates.patch
+curl -s -o _git "${url}/v${version}/git-completion.zsh" &&
+curl -s -o git-completion.bash "${url}/v${version}/git-completion.bash" &&
+curl -s -o git-prompt.sh "${url}/v${version}/git-prompt.sh"

plugins/gitfast/updates.patch

@@ -1,56 +0,0 @@
-diff --git b/plugins/gitfast/_git a/plugins/gitfast/_git
-index e2554130..a2e3bef5 100644
---- b/plugins/gitfast/_git
-+++ a/plugins/gitfast/_git
-@@ -30,7 +30,7 @@ if [ -z "$script" ]; then
- 	local -a locations
- 	local e
- 	locations=(
--		$(dirname ${funcsourcetrace[1]%:*})/git-completion.bash
-+		"$(dirname ${funcsourcetrace[1]%:*})/git-completion.bash"
- 		'/etc/bash_completion.d/git' # fedora, old debian
- 		'/usr/share/bash-completion/completions/git' # arch, ubuntu, new debian
- 		'/usr/share/bash-completion/git' # gentoo
-@@ -214,8 +214,10 @@ _git ()
- 
- 	if (( $+functions[__${service}_zsh_main] )); then
- 		__${service}_zsh_main
--	else
-+	elif (( $+functions[__${service}_main] )); then
- 		emulate ksh -c __${service}_main
-+	elif (( $+functions[_${service}] )); then
-+		emulate ksh -c _${service}
- 	fi
- 
- 	let _ret && _default && _ret=0
-diff --git b/plugins/gitfast/git-completion.bash a/plugins/gitfast/git-completion.bash
-index 9c8f7380..14012cab 100644
---- b/plugins/gitfast/git-completion.bash
-+++ a/plugins/gitfast/git-completion.bash
-@@ -2915,6 +2915,6 @@ __git_complete gitk __gitk_main
- # when the user has tab-completed the executable name and consequently
- # included the '.exe' suffix.
- #
--if [ Cygwin = "$(uname -o 2>/dev/null)" ]; then
-+if [[ "$OSTYPE" = cygwin* ]]; then
- __git_complete git.exe __git_main
- fi
-diff --git b/plugins/gitfast/git-prompt.sh a/plugins/gitfast/git-prompt.sh
-index 97eacd78..c1de34eb 100644
---- b/plugins/gitfast/git-prompt.sh
-+++ a/plugins/gitfast/git-prompt.sh
-@@ -502,9 +502,11 @@ __git_ps1 ()
- 
- 	local z="${GIT_PS1_STATESEPARATOR-" "}"
- 
--	# NO color option unless in PROMPT_COMMAND mode
--	if [ $pcmode = yes ] && [ -n "${GIT_PS1_SHOWCOLORHINTS-}" ]; then
--		__git_ps1_colorize_gitstring
-+	# NO color option unless in PROMPT_COMMAND mode or it's Zsh
-+	if [ -n "${GIT_PS1_SHOWCOLORHINTS-}" ]; then
-+		if [ $pcmode = yes ] || [ -n "${ZSH_VERSION-}" ]; then
-+			__git_ps1_colorize_gitstring
-+		fi
- 	fi
- 
- 	b=${b##refs/heads/}