aptible-cli 0.19.1 → 0.19.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8984c4633a4c6cfa79a8cba5fa5856079e4388677a4a6726f55eab3506ba82b5
-  data.tar.gz: d593ebd83e743458ea09ea1ffea94bf76679d6a10d12091d0f044701f85e4f5b
+  metadata.gz: f3f0904b2033596eb17ff98125288e5a2adec95ae6e379b95a5b8131b81bfe54
+  data.tar.gz: 9c002c17e22dd77ff79360671d0057455a70ff4ee2311d1466651a5c39b3c1a2
 SHA512:
-  metadata.gz: cc247fe45bb6ec934de142e4ca51e19c369a792ac92defc717b91436b293bb80c3fbbedeebc03efe4dd3cda4e3e983f8c53e95d8da5b30de53dc684bdd2d1a5e
-  data.tar.gz: ac409bc0d1e171f48f1a72035f31e8a69edc9b69e8aa586f6fcc70d52628ff698bc499f21e7b90fd38749b9779473ad6a9701606a843848217b1b3b732551f2c
+  metadata.gz: 0c1b0857f175135e6d7feb64a9a6a7b9633b73823f1f32100473f2f90c5b529a6dcf041b55bf4af47a92af08c425b24f4ce1abfacce3deea74b1e031e0bf5fa0
+  data.tar.gz: ccb65684ab24eb9055adee5e17a04d0a9dbf2cdc496ba1b71a9a6a229e83ee092ad43c2ee660f73b5da95b47b875bdf2d0212d6ede3d932455ff67188d4b47c1

data/Gemfile

@@ -1,6 +1,9 @@
 source 'https://rubygems.org'
 
-gem 'pry', github: 'fancyremarker/pry', branch: 'aptible'
+gem 'pry',
+    git: 'https://github.com/fancyremarker/pry.git',
+    branch: 'aptible'
+
 gem 'activesupport', '~> 4.0'
 gem 'rack', '~> 1.0'
 

data/README.md

@@ -31,6 +31,7 @@ Commands:
   aptible apps                                                                                                                                                                                                                                          # List all applications
   aptible apps:create HANDLE                                                                                                                                                                                                                            # Create a new application
   aptible apps:deprovision                                                                                                                                                                                                                              # Deprovision an app
+  aptible apps:rename OLD_HANDLE NEW_HANDLE [--environment ENVIRONMENT_HANDLE]                                                                                                                                                                          # Rename an app handle. In order for the new app handle to appear in log drain and metric drain destinations, you must restart the app.
   aptible apps:scale SERVICE [--container-count COUNT] [--container-size SIZE_MB]                                                                                                                                                                       # Scale a service
   aptible backup:list DB_HANDLE                                                                                                                                                                                                                         # List backups for a database
   aptible backup:orphaned                                                                                                                                                                                                                               # List backups associated with deprovisioned databases
@@ -50,6 +51,7 @@ Commands:
   aptible db:list                                                                                                                                                                                                                                       # List all databases
   aptible db:modify HANDLE [--iops IOPS] [--volume-type [gp2, gp3]]                                                                                                                                                                                     # Modify a database disk
   aptible db:reload HANDLE                                                                                                                                                                                                                              # Reload a database
+  aptible db:rename OLD_HANDLE NEW_HANDLE [--environment ENVIRONMENT_HANDLE]                                                                                                                                                                            # Rename a database handle. In order for the new database handle to appear in log drain and metric drain destinations, you must reload the database.
   aptible db:replicate HANDLE REPLICA_HANDLE [--container-size SIZE_MB] [--disk-size SIZE_GB] [--logical --version VERSION] [--key-arn KEY_ARN]                                                                                                         # Create a replica/follower of a database
   aptible db:restart HANDLE [--container-size SIZE_MB] [--disk-size SIZE_GB] [--iops IOPS] [--volume-type [gp2, gp3]]                                                                                                                                   # Restart a database
   aptible db:tunnel HANDLE                                                                                                                                                                                                                              # Create a local tunnel to a database
@@ -69,6 +71,7 @@ Commands:
   aptible endpoints:tls:modify [--app APP] ENDPOINT_HOSTNAME                                                                                                                                                                                            # Modify an App TLS Endpoint
   aptible environment:ca_cert                                                                                                                                                                                                                           # Retrieve the CA certificate associated with the environment
   aptible environment:list                                                                                                                                                                                                                              # List all environments
+  aptible environment:rename OLD_HANDLE NEW_HANDLE                                                                                                                                                                                                      # Rename an environment handle. In order for the new environment handle to appear in log drain/metric destinations, you must restart the apps/databases in this environment.
   aptible help [COMMAND]                                                                                                                                                                                                                                # Describe available commands or one specific command
   aptible log_drain:create:datadog HANDLE --url DATADOG_URL --environment ENVIRONMENT [--drain-apps true/false] [--drain_databases true/false] [--drain_ephemeral_sessions true/false] [--drain_proxies true/false]                                     # Create a Datadog Log Drain
   aptible log_drain:create:elasticsearch HANDLE --db DATABASE_HANDLE --environment ENVIRONMENT [--drain-apps true/false] [--drain_databases true/false] [--drain_ephemeral_sessions true/false] [--drain_proxies true/false]                            # Create an Elasticsearch Log Drain
@@ -87,6 +90,8 @@ Commands:
   aptible metric_drain:deprovision HANDLE --environment ENVIRONMENT                                                                                                                                                                                     # Deprovisions a Metric Drain
   aptible metric_drain:list                                                                                                                                                                                                                             # List all Metric Drains
   aptible operation:cancel OPERATION_ID                                                                                                                                                                                                                 # Cancel a running operation
+  aptible operation:follow OPERATION_ID                                                                                                                                                                                                                 # Follow logs of a running operation
+  aptible operation:logs OPERATION_ID                                                                                                                                                                                                                   # View logs for given operation
   aptible rebuild                                                                                                                                                                                                                                       # Rebuild an app, and restart its services
   aptible restart                                                                                                                                                                                                                                       # Restart all services associated with an app
   aptible services                                                                                                                                                                                                                                      # List Services for an App

data/aptible-cli.gemspec

@@ -22,12 +22,13 @@ Gem::Specification.new do |spec|
 
   spec.add_dependency 'aptible-resource', '~> 1.1'
   spec.add_dependency 'aptible-api', '~> 1.2'
-  spec.add_dependency 'aptible-auth', '~> 1.2.3'
+  spec.add_dependency 'aptible-auth', '~> 1.2.4'
   spec.add_dependency 'aptible-billing', '~> 1.0'
   spec.add_dependency 'thor', '~> 0.20.0'
-  spec.add_dependency 'git'
+  spec.add_dependency 'git', '< 1.10'
   spec.add_dependency 'term-ansicolor'
   spec.add_dependency 'chronic_duration', '~> 0.10.6'
+  spec.add_dependency 'cbor'
 
   # Temporarily pin ffi until https://github.com/ffi/ffi/issues/868 is fixed
   spec.add_dependency 'ffi', '<= 1.14.1' if Gem.win_platform?

data/lib/aptible/cli/agent.rb

@@ -145,29 +145,32 @@ module Aptible
 
           # If the user has added a security key and their computer supports it,
           # allow them to use it
-          if u2f && !which('u2f-host').nil?
+          # https://developers.yubico.com/libfido2/Manuals
+          # installation: https://github.com/Yubico/libfido2#installation
+          if u2f && !which('fido2-assert').nil? && !which('fido2-token').nil?
             origin = Aptible::Auth::Resource.new.get.href
             app_id = Aptible::Auth::Resource.new.utf_trusted_facets.href
-
             challenge = u2f.fetch('challenge')
 
-            devices = u2f.fetch('devices').map do |dev|
-              Helpers::SecurityKey::Device.new(
-                dev.fetch('version'), dev.fetch('key_handle')
-              )
-            end
+            device_info = security_key_device(u2f, app_id)
 
-            puts 'Enter your 2FA token or touch your Security Key once it ' \
-                 'starts blinking.'
+            if device_info[:locations].count > 0 && device_info[:device]
+              puts "\nEnter your 2FA token or touch your Security Key " \
+                 'once it starts blinking.'
 
-            mfa_threads << Thread.new do
-              token_options[:u2f] = Helpers::SecurityKey.authenticate(
-                origin, app_id, challenge, devices
-              )
+              mfa_threads << Thread.new do
+                token_options[:u2f] = Helpers::SecurityKey.authenticate(
+                  origin,
+                  app_id,
+                  challenge,
+                  device_info[:device],
+                  device_info[:locations]
+                )
 
-              puts ''
+                puts ''
 
-              q.push(nil)
+                q.push(nil)
+              end
             end
           end
 
@@ -202,6 +205,78 @@ module Aptible
 
       private
 
+      def security_key_device(u2f, app_id)
+        devices = u2f.fetch('devices').map do |dev|
+          version = dev.fetch('version')
+          rp_id =
+            if version == 'U2F_V2'
+              app_id
+            else
+              u2f['payload']['rpId']
+            end
+
+          Helpers::SecurityKey::Device.new(
+            dev.fetch('version'),
+            dev.fetch('key_handle'),
+            dev.fetch('name'),
+            rp_id
+          )
+        end
+
+        result = {
+          locations: [],
+          device: nil
+        }
+
+        device_locations = Helpers::SecurityKey.device_locations
+
+        if device_locations.count.zero?
+          no_keys = 'WARNING: no security keys detected on machine'
+          CLI.logger.warn(no_keys) if device_locations.count.zero?
+        else
+          result[:locations] = device_locations
+          no_creds = 'No credentials associated with user'
+          raise Error, no_creds if devices.count.zero?
+
+          result[:device] = devices[0]
+          if devices.count > 1
+            credential = security_credential(devices)
+            result[:device] = credential
+          end
+        end
+
+        result
+      end
+
+      # The name for our backend model is U2FDevice.
+      # However, really what we are storing is a security credential.
+      # Here we figure out which security credential to pass to fido2-assert.
+      def security_credential(devices)
+        puts 'There are multiple credentials associated ' \
+             'with this user.  Please select the ' \
+             "credential you want to use for authentication:\n"
+
+        device = nil
+        while device.nil?
+          devices.each_with_index do |dev, index|
+            puts "#{index}: #{dev.name}"
+          end
+
+          puts ''
+
+          device_index = ask(
+            'Enter the credential number you want to use: '
+          )
+
+          # https://stackoverflow.com/a/1235990
+          next unless /\A\d+\z/ =~ device_index
+
+          device = devices[device_index.to_i]
+        end
+
+        device
+      end
+
       def deprecated(msg)
         CLI.logger.warn([
           "DEPRECATION NOTICE: #{msg}",

data/lib/aptible/cli/helpers/database.rb

@@ -154,6 +154,19 @@ module Aptible
           raise Thor::Error, err
         end
 
+        def validate_image_type(type)
+          available_types = []
+
+          Aptible::Api::DatabaseImage.all(token: fetch_token).each do |i|
+            return true if i.type == type
+            available_types << i.type
+          end
+
+          err = "No Database Image of type \"#{type}\""
+          err = "#{err}, valid types: #{available_types.uniq.join(', ')}"
+          raise Thor::Error, err
+        end
+
         def render_database(database, account)
           Formatter.render(Renderer.current) do |root|
             root.keyed_object('connection_url') do |node|

data/lib/aptible/cli/helpers/operation.rb

@@ -1,4 +1,5 @@
 require 'aptible/api'
+require 'net/http'
 
 module Aptible
   module CLI
@@ -48,6 +49,15 @@ module Aptible
           operation.update!(cancelled: true)
         end
 
+        def operation_logs(operation)
+          res = get_operation_logs_redirect(operation)
+          s3_file_request = get_operation_logs_s3_file(res.body)
+
+          m = "Printing out results of operation logs for #{operation.id}"
+          CLI.logger.info m
+          puts s3_file_request.body
+        end
+
         def prettify_operation(o)
           bits = [o.status, o.type, "##{o.id}"]
           if o.resource.respond_to?(:handle)
@@ -55,6 +65,37 @@ module Aptible
           end
           bits.join ' '
         end
+
+        private
+
+        def get_operation_logs_redirect(operation)
+          uri = URI(operation.logs_url)
+          headers = { 'Authorization' => "Bearer #{fetch_token}" }
+          http = Net::HTTP.new(uri.host, uri.port)
+          http.use_ssl = true
+          res = http.request(Net::HTTP::Get.new(uri.request_uri, headers))
+          # note: res body with a 200 is target redirect location for download
+          if !res || res.code != '200' || res.body.nil?
+            raise Thor::Error, 'Unable to retrieve the operation\'s logs. '\
+            'If the issue persists please contact support for assistance.'
+          end
+          res
+        end
+
+        def get_operation_logs_s3_file(location)
+          s3_uri = URI(location)
+          http = Net::HTTP.new(s3_uri.host, s3_uri.port)
+          http.use_ssl = true
+
+          # follow the link with redirect and retrieve it from s3 directly
+          res = http.request(Net::HTTP::Get.new(s3_uri.request_uri))
+          if !res || res.code != '200'
+            raise Thor::Error, 'Unable to retrieve operation logs, '\
+              "S3 returned response code #{res.code}. "\
+              'If the issue persists please contact support for assistance.'
+          end
+          res
+        end
       end
     end
   end

data/lib/aptible/cli/helpers/security_key.rb

@@ -1,3 +1,6 @@
+require 'openssl'
+require 'cbor'
+
 module Aptible
   module CLI
     module Helpers
@@ -8,21 +11,32 @@ module Aptible
 
         class AuthenticatorParameters
           attr_reader :origin, :challenge, :app_id, :version, :key_handle
-          attr_reader :request
+          attr_reader :request, :rp_id, :device_location
+          attr_reader :client_data, :assert_str, :version
 
-          def initialize(origin, challenge, app_id, device)
+          def initialize(origin, challenge, app_id, device, device_location)
             @origin = origin
             @challenge = challenge
             @app_id = app_id
             @version = device.version
             @key_handle = device.key_handle
-
-            @request = {
-              'challenge' => challenge,
-              'appId' => app_id,
-              'version' => version,
-              'keyHandle' => key_handle
-            }
+            @rp_id = device.rp_id
+            @version = device.version
+            @device_location = device_location
+            @client_data = {
+              type: 'webauthn.get',
+              challenge: challenge,
+              origin: origin,
+              crossOrigin: false
+            }.to_json
+            key_handle = Base64.strict_encode64(
+              Base64.urlsafe_decode64(device.key_handle)
+            )
+            client_data_hash = Digest::SHA256.base64digest(@client_data)
+            in_str = "#{client_data_hash}\n" \
+              "#{device.rp_id}\n" \
+              "#{key_handle}"
+            @assert_str = in_str
           end
         end
 
@@ -51,9 +65,50 @@ module Aptible
           end
         end
 
-        class Authenticator
+        class DeviceMapper
           attr_reader :pid
 
+          def initialize(pid, out_read, err_read)
+            @pid = pid
+            @out_read = out_read
+            @err_read = err_read
+          end
+
+          def exited(status)
+            out, err = [@out_read, @err_read].map(&:read).map(&:chomp)
+
+            if status.exitstatus == 0
+              U2F_LOGGER.info("#{self.class}: ok: #{out}")
+              [nil, out]
+            else
+              U2F_LOGGER.warn("#{self.class}: err: #{err}")
+              [nil, nil]
+            end
+          ensure
+            [@out_read, @err_read].each(&:close)
+          end
+
+          def self.spawn
+            out_read, out_write = IO.pipe
+            err_read, err_write = IO.pipe
+
+            pid = Process.spawn(
+              'fido2-token -L',
+              out: out_write, err: err_write,
+              close_others: true
+            )
+
+            U2F_LOGGER.debug("#{self}: spawned #{pid}")
+
+            [out_write, err_write].each(&:close)
+
+            new(pid, out_read, err_read)
+          end
+        end
+
+        class Authenticator
+          attr_reader :pid, :auth
+
           def initialize(auth, pid, out_read, err_read)
             @auth = auth
             @pid = pid
@@ -61,13 +116,55 @@ module Aptible
             @err_read = err_read
           end
 
+          def formatted_out(out)
+            arr = out.split("\n")
+            authenticator_data = arr[2]
+            signature = arr[3]
+            appid = auth.app_id if auth.version == 'U2F_V2'
+            client_data_json = Base64.urlsafe_encode64(auth.client_data)
+
+            {
+              id: auth.key_handle,
+              rawId: auth.key_handle,
+              clientExtensionResults: { appid: appid },
+              type: 'public-key',
+              response: {
+                clientDataJSON: client_data_json,
+                authenticatorData: Base64.urlsafe_encode64(
+                  CBOR.decode(
+                    Base64.strict_decode64(authenticator_data)
+                  )
+                ),
+                signature: signature
+              }
+            }
+          end
+
+          def fido_err_msg(err)
+            match = err.match(/(FIDO_ERR.+)/)
+            return nil unless match
+            result = match.captures || []
+            no_cred = "\nCredential not found on device, " \
+                      'are you sure you selected the right ' \
+                      'credential for this device?'
+            err_map = {
+              'FIDO_ERR_NO_CREDENTIALS' => no_cred
+            }
+
+            return err_map[result[0]] if result.count > 0
+
+            nil
+          end
+
           def exited(status)
             out, err = [@out_read, @err_read].map(&:read).map(&:chomp)
 
             if status.exitstatus == 0
               U2F_LOGGER.info("#{self.class} #{@auth.key_handle}: ok: #{out}")
-              [nil, JSON.parse(out)]
+              [nil, out]
             else
+              err_msg = fido_err_msg(err)
+              CLI.logger.error(err_msg) if err_msg
               U2F_LOGGER.warn("#{self.class} #{@auth.key_handle}: err: #{err}")
               [ThrottledAuthenticator.spawn(@auth), nil]
             end
@@ -81,7 +178,7 @@ module Aptible
             err_read, err_write = IO.pipe
 
             pid = Process.spawn(
-              'u2f-host', '-aauthenticate', '-o', auth.origin,
+              "fido2-assert -G #{auth.device_location}",
               in: in_read, out: out_write, err: err_write,
               close_others: true
             )
@@ -90,7 +187,7 @@ module Aptible
 
             [in_read, out_write, err_write].each(&:close)
 
-            in_write.write(auth.request.to_json)
+            in_write.write(auth.assert_str)
             in_write.close
 
             new(auth, pid, out_read, err_read)
@@ -98,18 +195,40 @@ module Aptible
         end
 
         class Device
-          attr_reader :version, :key_handle
+          attr_reader :version, :key_handle, :rp_id, :name
 
-          def initialize(version, key_handle)
+          def initialize(version, key_handle, name, rp_id)
             @version = version
             @key_handle = key_handle
+            @name = name
+            @rp_id = rp_id
           end
         end
 
-        def self.authenticate(origin, app_id, challenge, devices)
-          procs = Hash[devices.map do |device|
+        def self.device_locations
+          w = DeviceMapper.spawn
+          _, status = Process.wait2
+          _, out = w.exited(status)
+          # parse output and only log device
+          matches = out.split("\n").map { |s| s.match(/^(\S+):\s/) }
+          results = []
+          matches.each do |m|
+            capture = m.captures
+            results << capture[0] if m && capture.count.positive?
+          end
+
+          results
+        end
+
+        def self.authenticate(origin, app_id, challenge,
+                              device, device_locations)
+          procs = Hash[device_locations.map do |location|
             params = AuthenticatorParameters.new(
-              origin, challenge, app_id, device
+              origin,
+              challenge,
+              app_id,
+              device,
+              location
             )
             w = Authenticator.spawn(params)
             [w.pid, w]
@@ -124,7 +243,7 @@ module Aptible
               r, out = w.exited(status)
 
               procs[r.pid] = r if r
-              return out if out
+              return w.formatted_out(out) if out
             end
           ensure
             procs.values.map(&:pid).each { |p| Process.kill(:SIGTERM, p) }

data/lib/aptible/cli/subcommands/apps.rb

@@ -94,6 +94,29 @@ module Aptible
                 raise if e.response.status != 404
               end
             end
+
+            desc 'apps:rename OLD_HANDLE NEW_HANDLE [--environment'\
+                 ' ENVIRONMENT_HANDLE]', 'Rename an app handle. In order'\
+                 ' for the new app handle to appear in log drain and metric'\
+                 ' drain destinations, you must restart the app.'
+            option :environment
+            define_method 'apps:rename' do |old_handle, new_handle|
+              env = ensure_environment(options)
+              app = ensure_app(options.merge(app: old_handle))
+              app.update!(handle: new_handle)
+              m1 = "In order for the new app name (#{new_handle}) to appear"\
+                   ' in log drain and metric drain destinations, you must'\
+                   ' restart the app.'
+              m2 = 'You can restart your app with this command: "aptible '\
+                   "restart --app #{new_handle} --environment #{env.handle}\""
+              m3 = 'Warning - Git remote addresses must be updated to match'\
+                   ' the new handle, if using Dockerfile deploy. '\
+                   "(git@beta.aptible.com:#{app.account.handle}"\
+                   "/#{new_handle}.git)"
+              CLI.logger.warn m1
+              CLI.logger.info m2
+              CLI.logger.warn m3
+            end
           end
         end
       end

data/lib/aptible/cli/subcommands/db.rb

@@ -84,6 +84,7 @@ module Aptible
               version = options[:version]
 
               if version && type
+                validate_image_type(type)
                 image = find_database_image(type, version)
                 db_opts[:type] = image.type
                 db_opts[:database_image] = image
@@ -91,6 +92,7 @@ module Aptible
                 raise Thor::Error, '--type is required when passing --version'
               else
                 db_opts[:type] = type || 'postgresql'
+                validate_image_type(db_opts[:type])
               end
 
               database = account.create_database!(db_opts)
@@ -346,6 +348,24 @@ module Aptible
                 end
               end
             end
+
+            desc 'db:rename OLD_HANDLE NEW_HANDLE [--environment'\
+                 ' ENVIRONMENT_HANDLE]', 'Rename a database handle. In order'\
+                 ' for the new database handle to appear in log drain and'\
+                 ' metric drain destinations, you must reload the database.'
+            option :environment
+            define_method 'db:rename' do |old_handle, new_handle|
+              env = ensure_environment(options)
+              db = ensure_database(options.merge(db: old_handle))
+              db.update!(handle: new_handle)
+              m1 = "In order for the new database name (#{new_handle}) to"\
+                   ' appear in log drain and metric drain destinations,'\
+                   ' you must reload the database.'
+              m2 = 'You can reload your database with this command: "aptible'\
+                   " db:reload #{new_handle} --environment #{env.handle}\""
+              CLI.logger.warn m1
+              CLI.logger.info m2
+            end
           end
         end
       end

data/lib/aptible/cli/subcommands/environment.rb

@@ -41,6 +41,25 @@ module Aptible
                 end
               end
             end
+
+            desc 'environment:rename OLD_HANDLE NEW_HANDLE',
+                 'Rename an environment handle. In order for the new'\
+                 ' environment handle to appear in log drain/metric'\
+                 ' destinations, you must restart the apps/databases in'\
+                 ' this environment.'
+            define_method 'environment:rename' do |old_handle, new_handle|
+              env = ensure_environment(options.merge(environment: old_handle))
+              env.update!(handle: new_handle)
+              m1 = "In order for the new environment handle (#{new_handle})"\
+                   ' to appear in log drain and metric drain destinations,'\
+                   ' you must restart the apps and databases in this'\
+                   ' environment. Also be aware of the following resources'\
+                   ' that may need names adjusted:'
+              m2 = "* Git remote URLs (ex: git@beta.aptible.com:#{new_handle}"\
+                   '/APP_HANDLE.git)'
+              m3 = '* Your own external scripts (e.g. for CI/CD)'
+              [m1, m2, m3].each { |val| CLI.logger.info val }
+            end
           end
         end
       end

data/lib/aptible/cli/subcommands/metric_drain.rb

@@ -8,6 +8,7 @@ module Aptible
           'EU1' => 'https://app.datadoghq.eu',
           'US1-FED' => 'https://app.ddog-gov.com'
         }.freeze
+        PATH = '/api/v1/series'.freeze
 
         def self.included(thor)
           thor.class_eval do
@@ -106,7 +107,7 @@ module Aptible
                                      "Valid options are #{sites}"
                 end
 
-                config[:series_url] = site
+                config[:series_url] = site + PATH
               end
               opts = {
                 handle: handle,

data/lib/aptible/cli/subcommands/operation.rb

@@ -16,6 +16,39 @@ module Aptible
               CLI.logger.info m
               o.update!(cancelled: true)
             end
+
+            desc 'operation:follow OPERATION_ID',
+                 'Follow logs of a running operation'
+            define_method 'operation:follow' do |operation_id|
+              o = Aptible::Api::Operation.find(operation_id, token: fetch_token)
+              raise "Operation ##{operation_id} not found" if o.nil?
+
+              if %w(failed succeeded).include? o.status
+                raise Thor::Error, "This operation has already #{o.status}. " \
+                                   'Run the following command to retrieve ' \
+                                   "the operation's logs:\n" \
+                                   "aptible operation:logs #{o.id}"
+              end
+
+              CLI.logger.info "Streaming logs for #{prettify_operation(o)}..."
+
+              attach_to_operation_logs(o)
+            end
+
+            desc 'operation:logs OPERATION_ID', 'View logs for given operation'
+            define_method 'operation:logs' do |operation_id|
+              o = Aptible::Api::Operation.find(operation_id, token: fetch_token)
+              raise "Operation ##{operation_id} not found" if o.nil?
+
+              unless %w(succeeded failed).include? o.status
+                e = 'Error - You can view the logs when operation is complete.'
+                raise Thor::Error, e
+              end
+
+              m = "Requesting operation logs for #{prettify_operation(o)}..."
+              CLI.logger.info m
+              operation_logs(o)
+            end
           end
         end
       end

data/lib/aptible/cli/version.rb

@@ -1,5 +1,5 @@
 module Aptible
   module CLI
-    VERSION = '0.19.1'.freeze
+    VERSION = '0.19.4'.freeze
   end
 end

data/spec/aptible/cli/agent_spec.rb

@@ -187,8 +187,16 @@ describe Aptible::CLI::Agent do
             'u2f' => {
               'challenge' => 'some 123',
               'devices' => [
-                { 'version' => 'U2F_V2', 'key_handle' => '123' },
-                { 'version' => 'U2F_V2', 'key_handle' => '456' }
+                {
+                  'version' => 'U2F_V2',
+                  'key_handle' => '123',
+                  'name' => 'primary'
+                },
+                {
+                  'version' => 'U2F_V2',
+                  'key_handle' => '456',
+                  'name' => 'secondary'
+                }
               ]
             }
           )
@@ -215,16 +223,28 @@ describe Aptible::CLI::Agent do
         end
 
         it 'should call into U2F if supported' do
-          allow(subject).to receive(:which).and_return('u2f-host')
+          allow(subject).to receive(:which).and_return('fido2-token')
+          allow(subject).to receive(:which).and_return('fido2-assert')
           allow(subject).to receive(:ask).with('2FA Token: ') { sleep }
+          allow(subject).to receive(:ask).with(
+            'Enter the credential number you want to use: '
+          ) { '0' }
 
           e = make_oauth2_error(
             'otp_token_required',
             'u2f' => {
               'challenge' => 'some 123',
               'devices' => [
-                { 'version' => 'U2F_V2', 'key_handle' => '123' },
-                { 'version' => 'U2F_V2', 'key_handle' => '456' }
+                {
+                  'version' => 'U2F_V2',
+                  'key_handle' => '123',
+                  'name' => 'primary'
+                },
+                {
+                  'version' => 'U2F_V2',
+                  'key_handle' => '456',
+                  'name' => 'secondary'
+                }
               ]
             }
           )
@@ -238,15 +258,17 @@ describe Aptible::CLI::Agent do
 
           expect(subject).to receive(:puts).with(/security key/i)
 
+          expect(Aptible::CLI::Helpers::SecurityKey)
+            .to receive(:device_locations)
+            .and_return(['ioreg://4295020796'])
+
           expect(Aptible::CLI::Helpers::SecurityKey).to receive(:authenticate)
             .with(
               'https://auth.aptible.com/',
               'https://auth.aptible.com/u2f/trusted_facets',
               'some 123',
-              array_including(
-                instance_of(Aptible::CLI::Helpers::SecurityKey::Device),
-                instance_of(Aptible::CLI::Helpers::SecurityKey::Device)
-              )
+              instance_of(Aptible::CLI::Helpers::SecurityKey::Device),
+              ['ioreg://4295020796']
             ).and_return(u2f)
 
           expect(Aptible::Auth::Token).to receive(:create)

data/spec/aptible/cli/helpers/database_spec.rb

@@ -0,0 +1,36 @@
+require 'spec_helper'
+
+describe Aptible::CLI::Helpers::Database do
+  subject { Class.new.send(:include, described_class).new }
+
+  describe '#validate_image_type' do
+    let(:pg) do
+      Fabricate(:database_image, type: 'postgresql', version: '10')
+    end
+
+    let(:redis) do
+      Fabricate(:database_image, type: 'redis', version: '9.4')
+    end
+
+    let(:token) { 'some-token' }
+
+    before do
+      allow(subject).to receive(:fetch_token).and_return(token)
+      allow(Aptible::Api::DatabaseImage).to receive(:all)
+        .and_return([pg, redis])
+    end
+
+    it 'Raises an error if provided an invalid type' do
+      bad_type = 'cassandra'
+      err = "No Database Image of type \"#{bad_type}\", " \
+            "valid types: #{pg.type}, #{redis.type}"
+      expect do
+        subject.validate_image_type(bad_type)
+      end.to raise_error(Thor::Error, err)
+    end
+
+    it 'Retruns true when provided a valid type' do
+      expect(subject.validate_image_type(pg.type)).to be(true)
+    end
+  end
+end

data/spec/aptible/cli/subcommands/apps_spec.rb

@@ -197,6 +197,47 @@ describe Aptible::CLI::Agent do
     end
   end
 
+  describe '#apps:rename' do
+    before do
+      allow(Aptible::Api::App).to receive(:all) { [app] }
+      allow(Aptible::Api::Account).to receive(:all) { [account] }
+    end
+
+    before(:each) do
+      allow(subject).to receive(:options)
+        .and_return(environment: account.handle)
+    end
+
+    context 'with environment and app' do
+      it 'should rename properly' do
+        expect(app).to receive(:update!)
+          .with(handle: 'hello2').and_return(app)
+        subject.send('apps:rename', 'hello', 'hello2')
+        expect(captured_logs).to include(
+          'In order for the new app name (hello2) to appear in log drain and '\
+          'metric drain destinations, you must restart the app.'
+        )
+        expect(captured_logs).to include(
+          "(git@beta.aptible.com:#{account.handle}/hello2.git)"
+        )
+      end
+      it 'should fail if app does not exist' do
+        expect { subject.send('apps:rename', 'hello2', 'hello3') }
+          .to raise_error(/Could not find app hello/)
+      end
+      it 'should raise error if update fails' do
+        response = Faraday::Response.new(status: 422)
+        error = HyperResource::ClientError.new('ActiveRecord::RecordInvalid:'\
+        ' Validation failed: Handle has already been taken, Handle has already'\
+        ' been taken', response: response)
+        expect(app).to receive(:update!)
+          .with(handle: 'hello2').and_raise(error)
+        expect { subject.send('apps:rename', 'hello', 'hello2') }
+          .to raise_error(HyperResource::ClientError)
+      end
+    end
+  end
+
   describe '#apps:scale' do
     before do
       allow(Aptible::Api::App).to receive(:all) { [app] }

data/spec/aptible/cli/subcommands/db_spec.rb

@@ -22,6 +22,9 @@ describe Aptible::CLI::Agent do
     before do
       allow(Aptible::Api::Account).to receive(:all).and_return([account])
     end
+    before do
+      subject.stub(:validate_image_type) { true }
+    end
 
     def expect_provision_database(create_opts, provision_opts = {})
       db = Fabricate(:database)
@@ -876,4 +879,39 @@ describe Aptible::CLI::Agent do
       expect(captured_output_text).to eq(expected)
     end
   end
+
+  describe '#db:rename' do
+    before do
+      allow(subject).to receive(:options)
+        .and_return(environment: account.handle)
+      allow(Aptible::Api::Account).to receive(:all) { [account] }
+    end
+    context 'with environment and db' do
+      it 'should rename properly' do
+        expect(database).to receive(:update!)
+          .with(handle: 'foo2').and_return(database)
+        subject.send('db:rename', database.handle, 'foo2')
+        expect(captured_logs).to include(
+          'In order for the new database name (foo2) to appear in log drain '\
+          'and metric drain destinations, you must reload the database.'
+        )
+      end
+      it 'should fail if db does not exist' do
+        expect { subject.send('db:rename', 'foo2', 'foo3') }
+          .to raise_error(/Could not find database foo2/)
+      end
+      it 'should raise error if update fails' do
+        response = Faraday::Response.new(status: 500)
+        error = HyperResource::ClientError.new(
+          'An error occurred: Validation failed: Handle has '\
+          'already been taken, Handle has already been taken',
+          response: response
+        )
+        expect(database).to receive(:update!)
+          .with(handle: 'foo2').and_raise(error)
+        expect { subject.send('db:rename', database.handle, 'foo2') }
+          .to raise_error(HyperResource::ClientError)
+      end
+    end
+  end
 end

data/spec/aptible/cli/subcommands/environment_spec.rb

@@ -10,47 +10,82 @@ describe Aptible::CLI::Agent do
 
   let(:token) { double 'token' }
 
-  before do
+  before(:each) do
     allow(subject).to receive(:fetch_token) { token }
     allow(Aptible::Api::Account).to receive(:all).with(token: token)
       .and_return([a1, a2])
   end
 
-  it 'lists avaliable environments' do
-    subject.send('environment:list')
+  describe('#environment:list') do
+    it 'lists avaliable environments' do
+      subject.send('environment:list')
 
-    expect(captured_output_text.split("\n")).to include('foo')
-    expect(captured_output_text.split("\n")).to include('bar')
+      expect(captured_output_text.split("\n")).to include('foo')
+      expect(captured_output_text.split("\n")).to include('bar')
+    end
   end
 
-  it 'fetches certs for all avaliable environments' do
-    subject.send('environment:ca_cert')
-
-    expect(captured_output_text.split("\n")).to include('account 1 cert')
-    expect(captured_output_text.split("\n")).to include('--account 2 cert--')
-
-    expected_accounts = [
-      {
-        'handle' => 'foo',
-        'ca_body' => 'account 1 cert',
-        'created_at' => fmt_time(a1.created_at)
-      },
-      {
-        'handle' => 'bar',
-        'ca_body' => '--account 2 cert--',
-        'created_at' => fmt_time(a2.created_at)
-      }
-    ]
-    expect(captured_output_json.map! { |account| account.except('id') })
-      .to eq(expected_accounts)
-  end
+  describe('#environment:ca_cert') do
+    it 'fetches certs for all avaliable environments' do
+      subject.send('environment:ca_cert')
+
+      expect(captured_output_text.split("\n")).to include('account 1 cert')
+      expect(captured_output_text.split("\n")).to include('--account 2 cert--')
+
+      expected_accounts = [
+        {
+          'handle' => 'foo',
+          'ca_body' => 'account 1 cert',
+          'created_at' => fmt_time(a1.created_at)
+        },
+        {
+          'handle' => 'bar',
+          'ca_body' => '--account 2 cert--',
+          'created_at' => fmt_time(a2.created_at)
+        }
+      ]
+      expect(captured_output_json.map! { |account| account.except('id') })
+        .to eq(expected_accounts)
+    end
 
-  it 'fetches certs for specified environment' do
-    subject.options = { environment: 'foo' }
-    subject.send('environment:ca_cert')
+    it 'fetches certs for specified environment' do
+      subject.options = { environment: 'foo' }
+      subject.send('environment:ca_cert')
+
+      expect(captured_output_text.split("\n")).to include('account 1 cert')
+      expect(captured_output_text.split("\n"))
+        .to_not include('--account 2 cert--')
+    end
+  end
 
-    expect(captured_output_text.split("\n")).to include('account 1 cert')
-    expect(captured_output_text.split("\n"))
-      .to_not include('--account 2 cert--')
+  describe('#environment:rename') do
+    it 'should rename properly' do
+      expect(a1).to receive(:update!)
+        .with(handle: 'foo-renamed').and_return(a1)
+      subject.send('environment:rename', 'foo', 'foo-renamed')
+      expect(captured_logs).to include(
+        'In order for the new environment handle (foo-renamed)'
+      )
+      expect(captured_logs).to include(
+        '* Your own external scripts (e.g. for CI/CD)'
+      )
+      expect(captured_logs).to include(
+        '* Git remote URLs (ex: git@beta.aptible.com:foo-renamed'
+      )
+    end
+    it 'should fail if env does not exist' do
+      expect { subject.send('environment:rename', 'foo1', 'foo2') }
+        .to raise_error(/Could not find environment foo1/)
+    end
+    it 'should raise error if update fails' do
+      response = Faraday::Response.new(status: 422)
+      error = HyperResource::ClientError.new('ActiveRecord::RecordInvalid:'\
+        ' Validation failed: Handle has already been taken, Handle has already'\
+        ' been taken', response: response)
+      expect(a1).to receive(:update!)
+        .with(handle: 'bar').and_raise(error)
+      expect { subject.send('environment:rename', 'foo', 'bar') }
+        .to raise_error(HyperResource::ClientError)
+    end
   end
 end

data/spec/aptible/cli/subcommands/metric_drain_spec.rb

@@ -145,7 +145,7 @@ describe Aptible::CLI::Agent do
           drain_type: :datadog,
           drain_configuration: {
             api_key: 'foobar',
-            series_url: 'https://app.datadoghq.eu'
+            series_url: 'https://app.datadoghq.eu/api/v1/series'
           }
         }
         expect_provision_metric_drain(opts)

data/spec/aptible/cli/subcommands/operation_spec.rb

@@ -3,6 +3,8 @@ require 'spec_helper'
 describe Aptible::CLI::Agent do
   let(:token) { 'some-token' }
   let(:operation) { Fabricate(:operation) }
+  let(:net_http_double) { double('Net::HTTP') }
+  let(:net_http_get_double) { double('Net::HTTP::Get') }
 
   before do
     allow(subject).to receive(:fetch_token).and_return(token)
@@ -26,4 +28,174 @@ describe Aptible::CLI::Agent do
       subject.send('operation:cancel', 1)
     end
   end
+
+  describe '#operation:follow' do
+    it 'fails if the operation cannot be found' do
+      expect(Aptible::Api::Operation).to receive(:find).with(1, token: token)
+        .and_return(nil)
+
+      expect { subject.send('operation:follow', 1) }
+        .to raise_error('Operation #1 not found')
+    end
+
+    it 'connects to a running operation' do
+      op = Fabricate(:operation, status: 'running', type: 'restart')
+      expect(Aptible::Api::Operation).to receive(:find)
+        .with(op.id.to_s, token: token).and_return(op)
+
+      expect(subject).to receive(:attach_to_operation_logs).with(op)
+      subject.send('operation:follow', op.id.to_s)
+    end
+
+    it 'connects to a queued operation' do
+      op = Fabricate(:operation, status: 'queued', type: 'restart')
+      expect(Aptible::Api::Operation).to receive(:find)
+        .with(op.id.to_s, token: token).and_return(op)
+
+      expect(subject).to receive(:attach_to_operation_logs).with(op)
+      subject.send('operation:follow', op.id.to_s)
+    end
+
+    it 'does not connect to a failed operation' do
+      id = 34
+      status = 'failed'
+      op = Fabricate(:operation, id: id, status: status)
+      expect(Aptible::Api::Operation).to receive(:find)
+        .with(op.id.to_s, token: token).and_return(op)
+
+      expect { subject.send('operation:follow', op.id.to_s) }
+        .to raise_error(Thor::Error, /aptible operation:logs #{id}/)
+    end
+
+    it 'does not connect to a succeeded operation' do
+      id = 43
+      status = 'succeeded'
+      op = Fabricate(:operation, id: id, status: status)
+      expect(Aptible::Api::Operation).to receive(:find)
+        .with(op.id.to_s, token: token).and_return(op)
+
+      expect { subject.send('operation:follow', op.id.to_s) }
+        .to raise_error(Thor::Error, /aptible operation:logs #{id}/)
+    end
+  end
+
+  describe '#operation:logs' do
+    it 'sends operation logs request when subcommand sent' do
+      operation_id = SecureRandom.uuid
+      expect(Aptible::Api::Operation).to receive(:find).with(1, token: token)
+        .and_return(Fabricate(
+                      :operation, status: 'succeeded', id: operation_id
+        ))
+
+      # stub out operations call
+      response = instance_double(Net::HTTPResponse, body: 'https://s3.aptible.com/not-real/s3')
+
+      # stub out s3 call
+      s3_response = instance_double(Net::HTTPResponse, body: 'Mock logs')
+
+      allow(Net::HTTP).to receive(:new).twice do |_, _, _|
+        net_http_double
+      end
+      expect(response).to receive(:code).and_return('200')
+      expect(s3_response).to receive(:code).and_return('200')
+      expect(net_http_double).to receive(:use_ssl=).twice
+      expect(net_http_double).to receive(:request).twice do |request|
+        if request.path == "/operations/#{operation_id}/logs"
+          response
+        elsif request.path == '/not-real/s3'
+          s3_response
+        end
+      end
+
+      subject.send('operation:logs', 1)
+    end
+
+    it 'errors when operation is not found' do
+      expect(Aptible::Api::Operation).to receive(:find).with(1, token: token)
+        .and_return(nil)
+
+      expect { subject.send('operation:logs', 1) }
+        .to raise_error('Operation #1 not found')
+    end
+    it 'errors when operation is not status expected' do
+      operation_id = SecureRandom.uuid
+      expect(Aptible::Api::Operation).to receive(:find).with(1, token: token)
+        .and_return(Fabricate(:operation, status: 'queued', id: operation_id))
+
+      expect { subject.send('operation:logs', 1) }
+        .to raise_error('Error - You can view the logs when operation '\
+                        'is complete.')
+    end
+    it 'errors when operation logs are not found' do
+      operation_id = SecureRandom.uuid
+      expect(Aptible::Api::Operation).to receive(:find).with(1, token: token)
+        .and_return(
+          Fabricate(:operation, status: 'succeeded', id: operation_id)
+        )
+
+      # stub out operations call
+      response = Net::HTTPSuccess.new(1.0, '404', 'Not Found')
+      expect_any_instance_of(Net::HTTP)
+        .to receive(:request)
+        .with(an_instance_of(Net::HTTP::Get))
+        .and_return(response)
+
+      expect { subject.send('operation:logs', 1) }
+        .to raise_error('Unable to retrieve the operation\'s logs. '\
+          'If the issue persists please contact support for assistance.')
+    end
+    it 'errors when body is empty' do
+      operation_id = SecureRandom.uuid
+      expect(Aptible::Api::Operation).to receive(:find).with(1, token: token)
+        .and_return(Fabricate(
+                      :operation, status: 'succeeded', id: operation_id
+        ))
+
+      # stub out operations call
+      response = instance_double(Net::HTTPResponse, body: nil)
+
+      allow(Net::HTTP).to receive(:new) do |_, _, _|
+        net_http_double
+      end
+      expect(response).to receive(:code).and_return('200')
+      expect(net_http_double).to receive(:use_ssl=)
+      expect(net_http_double).to receive(:request).and_return(response)
+
+      expect { subject.send('operation:logs', 1) }
+        .to raise_error('Unable to retrieve the operation\'s logs. '\
+          'If the issue persists please contact support for assistance.')
+    end
+    it 'errors when s3 itself returns an error code' do
+      operation_id = SecureRandom.uuid
+      expect(Aptible::Api::Operation).to receive(:find).with(1, token: token)
+        .and_return(Fabricate(
+                      :operation, status: 'succeeded', id: operation_id
+        ))
+
+      # stub out operations call
+      response = instance_double(Net::HTTPResponse, body: 'https://s3.aptible.com/not-real/s3')
+
+      # stub out s3 call (to fail)
+      expect(response).to receive(:code).and_return('200')
+      s3_response = Net::HTTPSuccess.new(1.0, '404', 'Not Found')
+
+      allow(Net::HTTP).to receive(:new).twice do |_, _, _|
+        net_http_double
+      end
+      expect(net_http_double).to receive(:use_ssl=).twice
+      expect(net_http_double).to receive(:request).twice do |request|
+        if request.path == "/operations/#{operation_id}/logs"
+          response
+        elsif request.path == '/not-real/s3'
+          s3_response
+        end
+      end
+
+      expect { subject.send('operation:logs', 1) }
+        .to raise_error('Unable to retrieve operation logs, '\
+                        'S3 returned response code 404. '\
+                        'If the issue persists please contact support for '\
+                        'assistance.')
+    end
+  end
 end

data/spec/fabricators/operation_fabricator.rb

@@ -1,7 +1,12 @@
 class StubOperation < OpenStruct; end
 
+def mock_logs_url(id)
+  "https://api.aptible.com/operations/#{id}/logs"
+end
+
 Fabricator(:operation, from: :stub_operation) do
   status 'queued'
-  resource { Fabricate(:app) }
   errors { Aptible::Resource::Errors.new }
+  resource { Fabricate(:app) }
+  after_save { |operation| operation.logs_url = mock_logs_url(operation.id) }
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: aptible-cli
 version: !ruby/object:Gem::Version
-  version: 0.19.1
+  version: 0.19.4
 platform: ruby
 authors:
 - Frank Macreery
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2021-08-02 00:00:00.000000000 Z
+date: 2022-09-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aptible-resource
@@ -44,14 +44,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.2.3
+        version: 1.2.4
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.2.3
+        version: 1.2.4
 - !ruby/object:Gem::Dependency
   name: aptible-billing
   requirement: !ruby/object:Gem::Requirement
@@ -84,16 +84,16 @@ dependencies:
   name: git
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "<"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '1.10'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "<"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '1.10'
 - !ruby/object:Gem::Dependency
   name: term-ansicolor
   requirement: !ruby/object:Gem::Requirement
@@ -122,6 +122,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: 0.10.6
+- !ruby/object:Gem::Dependency
+  name: cbor
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: activesupport
   requirement: !ruby/object:Gem::Requirement
@@ -312,6 +326,7 @@ files:
 - script/sync-readme-usage
 - spec/aptible/cli/agent_spec.rb
 - spec/aptible/cli/formatter_spec.rb
+- spec/aptible/cli/helpers/database_spec.rb
 - spec/aptible/cli/helpers/git_remote_handle_strategy_spec.rb
 - spec/aptible/cli/helpers/handle_from_git_remote_spec.rb
 - spec/aptible/cli/helpers/operation_spec.rb
@@ -383,13 +398,14 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.3
+rubygems_version: 3.0.3.1
 signing_key:
 specification_version: 4
 summary: Command-line interface for Aptible services
 test_files:
 - spec/aptible/cli/agent_spec.rb
 - spec/aptible/cli/formatter_spec.rb
+- spec/aptible/cli/helpers/database_spec.rb
 - spec/aptible/cli/helpers/git_remote_handle_strategy_spec.rb
 - spec/aptible/cli/helpers/handle_from_git_remote_spec.rb
 - spec/aptible/cli/helpers/operation_spec.rb