Live verification scoring + standalone score command

.github/workflows/pre-commit.yaml

@@ -140,6 +140,10 @@ jobs:
       - name: Run check-only hooks
         id: precommit-check
         if: ${{ !cancelled() }}
+        env:
+          # terraform_validate has no stages restriction, so pre-commit
+          # runs it in the manual stage too. Keep it skipped here as well.
+          SKIP: terraform_validate
         run: |
           pre-commit run --show-diff-on-failure --color=always --all-files --hook-stage manual
 

ad/GOAD-variant-1/files/dc02/sysvol_scripts/secret.ps1

@@ -8,6 +8,6 @@
 
 # secret stored :
 $keyData = 177, 252, 228, 64, 28, 91, 12, 201, 20, 91, 21, 139, 255, 65, 9, 247, 41, 55, 164, 28, 75, 132, 143, 71, 62, 191, 211, 61, 154, 61, 216, 91
-$secret="76492d1116743f0423413b16050a5345MgB8AGkAcwBDACsAUwArADIAcABRAEcARABnAGYAMwA3AEEAcgBFAEIAYQB2AEEAPQA9AHwAZQAwADgANAA2ADQAMABiADYANAAwADYANgA1ADcANgAxAGIAMQBhAGQANQBlAGYAYQBiADQAYQA2ADkAZgBlAGQAMQAzADAANQAyADUAMgAyADYANAA3ADAAZABiAGEAOAA0AGUAOQBkAGMAZABmAGEANAAyADkAZgAyADIAMwA="
+$secret="76492d1116743f0423413b16050a5345MgB8ADIAWQBrAHkAUABYAHMAMABRAEgAWgA0AGMAZwB1ADgAVgBDAC8AMgBCAGcAPQA9AHwANgBjAGYAYgBlAGIANwBlADEAMQAyADUAMgBlADYAYQA1ADYAYwAyAGQAZgA4AGEAYgAwADgAMgAyAGEAYQAzAGMAZgA5ADQANwBjADIANgAzAGYAMQBkAGIAYQBiAGIAYQAyADgAZAA1AGEAOAAyADUAZAA4ADgAYgBhADAAYgA="
 
-# T.L.
+# B.J.

cli/cmd/bastion.go

@@ -108,37 +108,54 @@ func azureClientFromProvider(prov provider.Provider) (*azure.Client, error) {
 	return ap.Client(), nil
 }
 
-func bastionContext(ctx context.Context) (*azure.Client, *azure.BastionHost, *config.Config, error) {
+func bastionContext(ctx context.Context) (*azure.Client, *azure.BastionHost, *config.Config, provider.Provider, error) {
 	cfg, err := config.Get()
 	if err != nil {
-		return nil, nil, nil, err
+		return nil, nil, nil, nil, err
 	}
 	prov, err := cfg.NewProvider(ctx)
 	if err != nil {
-		return nil, nil, nil, err
+		return nil, nil, nil, nil, err
 	}
 	client, err := azureClientFromProvider(prov)
 	if err != nil {
-		return nil, nil, nil, err
+		return nil, nil, nil, nil, err
 	}
 	if _, err := client.VerifyCredentials(ctx); err != nil {
-		return nil, nil, nil, err
+		return nil, nil, nil, nil, err
 	}
 	host, err := client.DiscoverBastion(ctx, cfg.Env)
 	if err != nil {
-		return nil, nil, nil, fmt.Errorf("discover bastion: %w", err)
+		return nil, nil, nil, nil, fmt.Errorf("discover bastion: %w", err)
 	}
 	if host == nil {
-		return nil, nil, nil, fmt.Errorf(
+		return nil, nil, nil, nil, fmt.Errorf(
 			"no Azure Bastion host found for env=%s. Deploy with: "+
 				"DREADGOAD_ENABLE_AZURE_BASTION=true dreadgoad infra apply --module bastion "+
 				"(or use --with-bastion on infra apply)", cfg.Env)
 	}
-	return client, host, cfg, nil
+	return client, host, cfg, prov, nil
+}
+
+// bastionWithVM resolves the bastion, verifies tunneling, and looks up the
+// target VM. Common setup shared by ssh, rdp, and tunnel subcommands.
+func bastionWithVM(ctx context.Context, host string) (*azure.Client, *azure.BastionHost, *config.Config, string, error) {
+	client, bh, cfg, prov, err := bastionContext(ctx)
+	if err != nil {
+		return nil, nil, nil, "", err
+	}
+	if !bh.TunnelingEnabled {
+		return nil, nil, nil, "", fmt.Errorf("bastion %s does not have tunneling enabled; requires bastion_tunneling_enabled=true on a Standard/Premium SKU", bh.Name)
+	}
+	vmID, err := resolveAzureHost(ctx, prov, cfg, host)
+	if err != nil {
+		return nil, nil, nil, "", err
+	}
+	return client, bh, cfg, vmID, nil
 }
 
 func runBastionStatus(cmd *cobra.Command, args []string) error {
-	ctx := context.Background()
+	ctx := cmd.Context()
 	cfg, err := config.Get()
 	if err != nil {
 		return err
@@ -179,20 +196,8 @@ func runBastionStatus(cmd *cobra.Command, args []string) error {
 }
 
 func runBastionSSH(cmd *cobra.Command, args []string) error {
-	ctx := context.Background()
-	client, host, cfg, err := bastionContext(ctx)
-	if err != nil {
-		return err
-	}
-	if !host.TunnelingEnabled {
-		return fmt.Errorf("bastion %s does not have tunneling enabled; ssh requires bastion_tunneling_enabled=true on a Standard/Premium SKU", host.Name)
-	}
-
-	prov, err := cfg.NewProvider(ctx)
-	if err != nil {
-		return err
-	}
-	vmID, err := resolveAzureHost(ctx, prov, cfg, args[0])
+	ctx := cmd.Context()
+	client, host, cfg, vmID, err := bastionWithVM(ctx, args[0])
 	if err != nil {
 		return err
 	}
@@ -203,7 +208,7 @@ func runBastionSSH(cmd *cobra.Command, args []string) error {
 
 	// Auto-pick the ephemeral key for known VM roles. A failed live lookup
 	// is non-fatal — we just fall back to the user-supplied flag values.
-	if defaults := resolveRoleDefaults(client, ctx, cfg.Env, args[0]); defaults != nil && defaults.sshKey != "" {
+	if defaults := resolveRoleDefaults(ctx, client, cfg.Env, args[0]); defaults != nil && defaults.sshKey != "" {
 		if !cmd.Flags().Changed("auth-type") {
 			authType = defaults.authType
 		}
@@ -228,7 +233,7 @@ type roleDefaults struct {
 
 // resolveRoleDefaults looks up a VM by hostname and returns SSH defaults based
 // on its Role tag. Returns nil if the VM is not found or has no known role.
-func resolveRoleDefaults(client *azure.Client, ctx context.Context, env, hostname string) *roleDefaults {
+func resolveRoleDefaults(ctx context.Context, client *azure.Client, env, hostname string) *roleDefaults {
 	inst, err := client.FindInstanceByHostname(ctx, env, hostname)
 	if err != nil {
 		return nil
@@ -244,7 +249,7 @@ func resolveRoleDefaults(client *azure.Client, ctx context.Context, env, hostnam
 		return &roleDefaults{
 			authType: "ssh-key",
 			user:     "kali",
-			sshKey:   kaliKeyPath(env, inst.Name),
+			sshKey:   azure.KaliKeyPath(env, inst.Name),
 		}
 	default:
 		return nil
@@ -272,40 +277,9 @@ func controllerKeyPath(env, vmName string) string {
 	return path
 }
 
-// kaliKeyPath derives the conventional ephemeral private-key path the
-// terraform-azure-kali module writes. VM names follow
-// "{env}-{deployment}-kali-vm"; the module writes to
-// "~/.dreadgoad/keys/azure-{env}-{deployment}-kali".
-func kaliKeyPath(env, vmName string) string {
-	deployment := strings.TrimSuffix(strings.TrimPrefix(vmName, env+"-"), "-kali-vm")
-	if deployment == "" || deployment == vmName {
-		return ""
-	}
-	home, err := os.UserHomeDir()
-	if err != nil {
-		return ""
-	}
-	path := filepath.Join(home, ".dreadgoad", "keys", fmt.Sprintf("azure-%s-%s-kali", env, deployment))
-	if _, err := os.Stat(path); err != nil {
-		return ""
-	}
-	return path
-}
-
 func runBastionRDP(cmd *cobra.Command, args []string) error {
-	ctx := context.Background()
-	client, host, cfg, err := bastionContext(ctx)
-	if err != nil {
-		return err
-	}
-	if !host.TunnelingEnabled {
-		return fmt.Errorf("bastion %s does not have tunneling enabled; rdp requires bastion_tunneling_enabled=true on a Standard/Premium SKU", host.Name)
-	}
-	prov, err := cfg.NewProvider(ctx)
-	if err != nil {
-		return err
-	}
-	vmID, err := resolveAzureHost(ctx, prov, cfg, args[0])
+	ctx := cmd.Context()
+	client, host, _, vmID, err := bastionWithVM(ctx, args[0])
 	if err != nil {
 		return err
 	}
@@ -315,19 +289,8 @@ func runBastionRDP(cmd *cobra.Command, args []string) error {
 }
 
 func runBastionTunnel(cmd *cobra.Command, args []string) error {
-	ctx := context.Background()
-	client, host, cfg, err := bastionContext(ctx)
-	if err != nil {
-		return err
-	}
-	if !host.TunnelingEnabled {
-		return fmt.Errorf("bastion %s does not have tunneling enabled; tunnel requires bastion_tunneling_enabled=true on a Standard/Premium SKU", host.Name)
-	}
-	prov, err := cfg.NewProvider(ctx)
-	if err != nil {
-		return err
-	}
-	vmID, err := resolveAzureHost(ctx, prov, cfg, args[0])
+	ctx := cmd.Context()
+	client, host, _, vmID, err := bastionWithVM(ctx, args[0])
 	if err != nil {
 		return err
 	}