@@ -7,6 +7,8 @@

 (fw.lu:defclass+ cj-developer-role ((cj-organization-role (account)))

   ())

+(fw.lu:defclass+ cj-provisioner-role ((cj-organization-role (account)))

+  ())

 (defgeneric arn-for (type account resource)

   (:method-combination list :most-specific-last)

@@ -26,8 +28,16 @@

     "cjorganization")

   (:method list ((type (eql :role)) account (role cj-developer-role))

     "CJDeveloperAccessRole")

+  (:method list ((type (eql :role)) account (role cj-provisioner-role))

+    "CJProvisionerAccessRole")

   (:method list ((type (eql :role)) account (role string))

     role))

 (defun cj-organization-role-arn (role)

   (arn-for :role (account role) role))

+

+(defgeneric session-duration (role)

+  (:method ((role cj-developer-role))

+    :max)

+  (:method ((role cj-provisioner-role))

+    #.(* 60 60)))

@@ -30,6 +30,10 @@

                      :selection-callback 'account-selected

                      :callback-type :data

                      :reader account-selector)

+   (role-selector capi:option-pane

+                  :items '(:|Developer Role| :|Provisioner Role|)

+                  :reader role-selector

+                  :selected-item keyword:|Developer Role|)

    (action-buttons capi:push-button-panel

                    :items '(:|Open Web Console|

                             :|Authorize iTerm|

@@ -46,6 +50,7 @@

                     go-button))

    (data-layout  capi:column-layout

                  '(account-selector

+                   role-selector

                    :separator

                    user-input

                    mfa-input

@@ -5,4 +5,50 @@

                                :url url)

                 :title "Management Console"

                 :best-width 1280

-                :best-height 800))

+                :best-height 800)

+  #+(or)

+  (let* ((history (make-instance 'capi:list-panel

+                                 :items (list (make-instance 'capi:item

+                                                             :text "start"

+                                                             :data "https://foo.com"))

+                                 :selection-callback

+                                 (lambda (data interface)

+                                   (capi:display-message "~S" data))

+                                 :visible-max-width '(:character 20)))

+         (browser (make-instance 'capi:browser-pane

+                                 :url url

+                                 :before-navigate-callback

+                                 (lambda (pane url &key &allow-other-keys)

+                                   (declare (ignore pane))

+                                   (capi:apply-in-pane-process-if-alive

+                                    history

+                                    (lambda ()

+                                      (capi:append-items history

+                                                         (list (make-instance 'capi:item

+                                                                              :collection history

+                                                                              :data url))))))

+                                 :navigate-complete-callback

+                                 (lambda (pane url _)

+                                   (declare (ignore _))

+                                   (capi:apply-in-pane-process-if-alive

+                                    history

+                                    (lambda ()

+                                      (setf (capi:collection-items history)

+                                            (concatenate 'simple-vector

+                                                         (capi:collection-items history)

+                                                         (list (make-instance 'capi:item

+                                                                              :text

+                                                                              (capi:browser-pane-title pane)

+                                                                              :data url)))))))

+                                 :new-window-callback

+                                 (lambda (pane url &key &allow-other-keys)

+                                   (capi:apply-in-pane-process-if-alive

+                                    pane 'capi:browser-pane-navigate pane url)

+                                   nil)

+                                 ))

+         (browser-interface (make-instance 'capi:row-layout

+                                           :description (list history browser))))

+    (capi:contain browser-interface

+                  :title "Management Console"

+                  :best-width 1280

+                  :best-height 800)))

@@ -17,7 +17,10 @@

                 (aws/sts:assume-role :role-arn role-arn

                                      :role-session-name (session-name)

                                      :serial-number mfa-serial-number

-                                     :duration-seconds #.(* 12 60 60)

+                                     :duration-seconds (if (eql (mfa-tool.aws-utils:session-duration role)

+                                                                :max)

+                                                           #.(* 12 60 60)

+                                                           (mfa-tool.aws-utils:session-duration role))

                                      :token-code token))

     (change-mfa-token (new-token)

                       :interactive read-new-mfa-token

@@ -11,10 +11,12 @@

 (defun current-account (interface)

   (cdr (capi:choice-selected-item (account-selector interface))))

+(defun current-role (interface)

+  (capi:choice-selected-item (role-selector interface)))

 (defun credentials-for-account (interface account)

-   (gethash account 

-            (assumed-credentials interface)))

+  (gethash account

+           (assumed-credentials interface)))

 (defun (setf credentials-for-account) (new-credentials interface account)

   (setf (gethash account

                  (assumed-credentials interface))

@@ -69,7 +71,9 @@

                                           (change-mfa-token new-code))

                                    (capi:abort-callback)))))))

           (authenticate user-name

-                        (cj-developer-role account)

+                        (ecase (current-role interface)

+                          (:|Developer Role| (cj-developer-role account))

+                          (:|Provisioner Role| (cj-provisioner-role account)))

                         token))

       (with-open-file (stream (make-pathname :name ""

                                              :type "cj-aws"

@@ -1,15 +1,18 @@

 (defpackage :mfa-tool.aws-utils

   (:use :cl)

   (:export #:cj-organization-role

+           #:cj-provisioner-role

            #:cj-developer-role

            #:arn-for

-           #:cj-organization-role-arn))

+           #:cj-organization-role-arn

+           #:session-duration))

 (defpackage :mfa-tool

   (:use :cl)

   (:import-from :mfa-tool.aws-utils

                 #:cj-organization-role-arn

                 #:cj-developer-role

+                #:cj-provisioner-role

                 #:arn-for)

   (:export :main

    :url