aptible-cli 0.26.4 → 0.26.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1c756f930a26ab5b060f01270b80c9ec2963c8f739be4ffcd2a5d56e9dac2860
-  data.tar.gz: 55fdde5cde257bd36c6c16a17e7f639745f85947b1cf40269c0d73ab0093615c
+  metadata.gz: 96e4d08173fd6d471b8a0a4f625d5bc1b3cf22af4c6cf2bb71fb3da109bc27af
+  data.tar.gz: 53ff531ac50e1a925a7c6ddc01bf5cdc7c972333e4f7ef72e5af83b0001c5ae0
 SHA512:
-  metadata.gz: 01122dab06813f9b67100c11e6e59ec6942f5263340efc26bbf73440b51c39c7cd0be7258b987fa39056092b29bf181ded4d14423d27ff795cd18bf85b97fe96
-  data.tar.gz: d7ed67882c43c958dcc60c7ef5ba518f3eb6ad72ca014f4c0b761478f2748054af64286aca26b8ac97b5ca5ea03964bc34fd422d3cf42f4996b4c6949815d870
+  metadata.gz: dec6c2d62bbe07eb89627dad9c1984133e7768f4b87316ac3029a1fd94f71d22418ca6b3ad73efa445425e60cd620d75d9653b23e4da10c7f28a62b6fc460d69
+  data.tar.gz: fd1b7ab666de7e4e13300ba4057d265edf919f40abaddcac96a90f9437b8ad23144775f4fc49124bae2af06f668aea57bdf976eeffa1fab60a7e01abb5ffd241

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    aptible-cli (0.26.4)
+    aptible-cli (0.26.6)
       activesupport (>= 4.0, < 6.0)
       aptible-api (~> 1.12)
       aptible-auth (~> 1.4)

data/lib/aptible/cli/helpers/app.rb

@@ -110,12 +110,9 @@ module Aptible
             end
           end
 
-          apps = apps_from_handle(s.app_handle, environment)
+          app = app_from_handle(s.app_handle, environment)
 
-          case apps.count
-          when 1
-            return apps.first
-          when 0
+          if app.nil?
             err_bits = ['Could not find app', s.app_handle]
             if environment
               err_bits << 'in environment'
@@ -125,11 +122,9 @@ module Aptible
             end
             err_bits << s.explain
             raise Thor::Error, err_bits.join(' ')
-          else
-            err = "Multiple apps named #{s.app_handle} exist, please specify " \
-                  'with --environment'
-            raise Thor::Error, err
           end
+
+          app
         end
 
         def ensure_service(options, type)
@@ -166,13 +161,20 @@ module Aptible
           )
         end
 
-        def apps_from_handle(handle, environment)
-          # TODO: This should probably use each_app for more efficiency.
-          if environment
-            environment.apps
-          else
-            apps_all
-          end.select { |a| a.handle == handle }
+        def app_from_handle(handle, environment)
+          url = "/find/app?handle=#{handle}"
+          url += "&environment=#{environment.handle}" unless environment.nil?
+
+          Aptible::Api::App.find_by_url(
+            url,
+            token: fetch_token
+          )
+        rescue HyperResource::ClientError => e
+          raise unless e.body.is_a?(Hash) &&
+                       e.body['error'] == 'multiple_resources_found'
+          raise Thor::Error,
+                "Multiple apps named #{handle} exist, please specify " \
+                'with --environment'
         end
 
         def extract_env(args)

data/lib/aptible/cli/helpers/database.rb

@@ -36,16 +36,10 @@ module Aptible
             raise Thor::Error,
                   "Could not find environment #{environment_handle}"
           end
-          databases = databases_from_handle(db_handle, environment)
-          case databases.count
-          when 1
-            return databases.first
-          when 0
-            raise Thor::Error, "Could not find database #{db_handle}"
-          else
-            err = 'Multiple databases exist, please specify with --environment'
-            raise Thor::Error, err
-          end
+          db = database_from_handle(db_handle, environment)
+          raise Thor::Error, "Could not find database #{db_handle}" if db.nil?
+
+          db
         end
 
         def databases_href
@@ -140,20 +134,27 @@ module Aptible
           external_rds_databases_all.find { |a| a.handle == handle }
         end
 
-        def databases_from_handle(handle, environment)
-          databases = if environment
-                        environment.databases
-                      else
-                        databases_all
-                      end
-          databases.select { |a| a.handle == handle }
+        def database_from_handle(handle, environment)
+          url = "/find/database?handle=#{handle}"
+          url += "&environment=#{environment.handle}" unless environment.nil?
+
+          Aptible::Api::Database.find_by_url(
+            url,
+            token: fetch_token
+          )
+        rescue HyperResource::ClientError => e
+          raise unless e.body.is_a?(Hash) &&
+                       e.body['error'] == 'multiple_resources_found'
+          raise Thor::Error,
+                'Multiple databases exist, please specify ' \
+                'with --environment'
         end
 
         def clone_database(source, dest_handle)
           op = source.create_operation!(type: 'clone', handle: dest_handle)
           attach_to_operation_logs(op)
 
-          databases_from_handle(dest_handle, source.account).first
+          database_from_handle(dest_handle, source.account)
         end
 
         def replicate_database(source, dest_handle, options)
@@ -177,7 +178,7 @@ module Aptible
           op = source.create_operation!(replication_params)
           attach_to_operation_logs(op)
 
-          replica = databases_from_handle(dest_handle, source.account).first
+          replica = database_from_handle(dest_handle, source.account)
           attach_to_operation_logs(replica.operations.last)
           replica
         end

data/lib/aptible/cli/helpers/environment.rb

@@ -42,10 +42,11 @@ module Aptible
 
         def environment_from_handle(handle)
           return nil unless handle
-          href = environment_href
-          Aptible::Api::Account.all(token: fetch_token, href: href).find do |a|
-            a.handle == handle
-          end
+
+          Aptible::Api::Account.find_by_url(
+            "/find/account?handle=#{handle}",
+            token: fetch_token
+          )
         end
 
         def environment_map(accounts)

data/lib/aptible/cli/helpers/vhost/option_set_builder.rb

@@ -14,6 +14,35 @@ module Aptible
             alb
           ).freeze
 
+          SSL_PROTOCOL_VALUES = [
+            'TLSv1 TLSv1.1 TLSv1.2',
+            'TLSv1 TLSv1.1 TLSv1.2 PFS',
+            'TLSv1.1 TLSv1.2',
+            'TLSv1.1 TLSv1.2 PFS',
+            'TLSv1.2',
+            'TLSv1.2 PFS',
+            'TLSv1.2 PFS TLSv1.3',
+            'TLSv1.3'
+          ].freeze
+
+          ALB_PROTOCOL_VALUES = SSL_PROTOCOL_VALUES
+
+          ELB_PROTOCOL_VALUES =
+            SSL_PROTOCOL_VALUES.reject { |v| v.include?(' PFS') }.freeze
+
+          SSL_PROTOCOL_ALB_DESC = (
+            'Specify the allowed SSL protocols. Valid options: ' +
+            ALB_PROTOCOL_VALUES.map { |v| "\"#{v}\"" }.join(', ') +
+            '. PFS options require an HTTPS (ALB) endpoint. ' \
+            'Use "default" to reset to the platform default'
+          ).freeze
+
+          SSL_PROTOCOL_ELB_DESC = (
+            'Specify the allowed SSL protocols. Valid options: ' +
+            ELB_PROTOCOL_VALUES.map { |v| "\"#{v}\"" }.join(', ') +
+            '. Use "default" to reset to the platform default'
+          ).freeze
+
           def initialize(&block)
             FLAGS.each { |f| instance_variable_set("@#{f}", false) }
             instance_exec(&block) if block
@@ -53,6 +82,14 @@ module Aptible
                   )
                 end
 
+                option(
+                  :idle_timeout,
+                  type: :string,
+                  desc: 'Timeout (seconds) to enforce idle timeouts while ' \
+                        'sending and receiving responses. Use "default" to ' \
+                        'reset to the platform default'
+                )
+
                 if builder.alb?
                   option(
                     :load_balancing_algorithm_type,
@@ -69,6 +106,50 @@ module Aptible
                     desc: "Share this Endpoint's load balancer with other " \
                           'Endpoints'
                   )
+
+                  option(
+                    :force_ssl,
+                    type: :boolean,
+                    desc: 'Redirect all HTTP requests to HTTPS, and ' \
+                          'enable the Strict-Transport-Security header (HSTS)'
+                  )
+
+                  option(
+                    :maintenance_page_url,
+                    type: :string,
+                    desc: 'The URL of a maintenance page to cache and serve ' \
+                          'when requests time out, or your app is unhealthy. ' \
+                          'Use "default" to reset to the platform default'
+                  )
+
+                  option(
+                    :release_healthcheck_timeout,
+                    type: :string,
+                    desc: 'Timeout (seconds) to wait for your app to ' \
+                          'respond to a release health check. Use "default" ' \
+                          'to reset to the platform default'
+                  )
+
+                  option(
+                    :show_elb_healthchecks,
+                    type: :boolean,
+                    desc: 'Show all runtime health check requets in the ' \
+                          "endpoint's logs"
+                  )
+
+                  option(
+                    :ssl_protocols_override,
+                    type: :string,
+                    desc: SSL_PROTOCOL_ALB_DESC
+                  )
+
+                  option(
+                    :strict_health_checks,
+                    type: :boolean,
+                    desc: 'Require containers to respond to health checks ' \
+                          'with a 200 OK HTTP response.'
+                  )
+
                 end
               end
 
@@ -128,6 +209,27 @@ module Aptible
                   desc: 'The fingerprint of an existing Certificate to use ' \
                         'on this Endpoint'
                 )
+
+                unless builder.alb?
+                  option(
+                    :ssl_protocols_override,
+                    type: :string,
+                    desc: SSL_PROTOCOL_ELB_DESC
+                  )
+
+                  option(
+                    :ssl_ciphers_override,
+                    type: :string,
+                    desc: 'Specify the allowed SSL ciphers. ' \
+                          'Use "default" to reset to the platform default'
+                  )
+
+                  option(
+                    :disable_weak_cipher_suites,
+                    type: :boolean,
+                    desc: 'Block the SSLv3 protocol and RC4 ciphers'
+                  )
+                end
               end
             end
           end
@@ -137,6 +239,7 @@ module Aptible
             verify_option_conflicts(options)
 
             params = {}
+            settings = {}
 
             params[:ip_whitelist] = options.delete(:ip_whitelist) do
               create? ? [] : nil
@@ -203,6 +306,56 @@ module Aptible
               params[:shared] = options.delete(:shared)
             end
 
+            if (proto = options[:ssl_protocols_override]) &&
+               proto != 'default'
+              unless ALB_PROTOCOL_VALUES.include?(proto)
+                raise Thor::Error,
+                      "Invalid --ssl-protocols-override: \"#{proto}\". " \
+                      "Valid options are: #{ALB_PROTOCOL_VALUES.join(', ')}"
+              end
+
+              if !ELB_PROTOCOL_VALUES.include?(proto) && !alb?
+                raise Thor::Error,
+                      "Invalid --ssl-protocols-override: \"#{proto}\". " \
+                      'PFS options are only valid for an HTTPS (ALB) endpoint. ' \
+                      "Valid options are: #{ELB_PROTOCOL_VALUES.join(', ')}"
+              end
+            end
+
+            vhost_settings = %i(
+              idle_timeout
+              maintenance_page_url
+              release_healthcheck_timeout
+              ssl_protocols_override
+              ssl_ciphers_override
+            )
+
+            vhost_settings.each do |key|
+              val = options.delete(key)
+              next if val.nil?
+
+              settings[key.to_s.upcase] = case val
+                                          when 'default'
+                                            ''
+                                          else
+                                            val
+                                          end
+            end
+
+            boolean_vhost_settings = %i(
+              force_ssl
+              show_elb_healthchecks
+              strict_health_checks
+              disable_weak_cipher_suites
+            )
+
+            boolean_vhost_settings.each do |key|
+              value = options.delete(key)
+              next if value.nil?
+
+              settings[key.to_s.upcase] = value.to_s
+            end
+
             options.delete(:environment)
 
             # NOTE: This is here to ensure that specs don't test for options
@@ -210,7 +363,7 @@ module Aptible
             # this.
             raise "Unexpected options: #{options}" if options.any?
 
-            params.delete_if { |_, v| v.nil? }
+            [params.delete_if { |_, v| v.nil? }, settings]
           end
 
           FLAGS.each do |f|

data/lib/aptible/cli/helpers/vhost.rb

@@ -2,8 +2,11 @@ module Aptible
   module CLI
     module Helpers
       module Vhost
-        def provision_vhost_and_explain(service, vhost)
-          op = vhost.create_operation!(type: 'provision')
+        def provision_vhost_and_explain(service, vhost, settings)
+          op = vhost.create_operation!(
+            type: 'provision',
+            **(settings.empty? ? {} : { settings: settings })
+          )
           attach_to_operation_logs(op)
 
           Formatter.render(Renderer.current) do |root|

data/lib/aptible/cli/renderer/text.rb

@@ -7,7 +7,9 @@ module Aptible
         POST_PROCESSED_KEYS = {
           'Tls' => 'TLS',
           'Dns' => 'DNS',
-          'Ip' => 'IP'
+          'Ip' => 'IP',
+          'Ssl' => 'SSL',
+          'Elb' => 'ELB'
         }.freeze
 
         def visit(node, io)

data/lib/aptible/cli/resource_formatter.rb

@@ -213,6 +213,12 @@ module Aptible
 
           node.value('internal', vhost.internal)
 
+          unless vhost.current_setting.nil?
+            vhost.current_setting.settings.each do |k, v|
+              node.value(k.downcase, v)
+            end
+          end
+
           ip_whitelist = if vhost.ip_whitelist.any?
                            vhost.ip_whitelist.join(' ')
                          else

data/lib/aptible/cli/subcommands/backup.rb

@@ -67,7 +67,7 @@ module Aptible
 
               account = destination_account || backup.account
 
-              database = databases_from_handle(handle, account).first
+              database = database_from_handle(handle, account)
               render_database(database, account)
             end
 

data/lib/aptible/cli/subcommands/endpoints.rb

@@ -27,13 +27,18 @@ module Aptible
               service = database.service
               raise Thor::Error, 'Database is not provisioned' if service.nil?
 
+              prepared_params, settings = database_create_flags.prepare(
+                database.account,
+                options
+              )
+
               vhost = service.create_vhost!(
                 type: 'tcp',
                 platform: 'elb',
-                **database_create_flags.prepare(database.account, options)
+                **prepared_params
               )
 
-              provision_vhost_and_explain(service, vhost)
+              provision_vhost_and_explain(service, vhost, settings)
             end
 
             database_modify_flags = Helpers::Vhost::OptionSetBuilder.new do
@@ -49,9 +54,14 @@ module Aptible
 
               database = ensure_database(options.merge(db: options[:database]))
               vhost = find_vhost(each_service(database), hostname)
-              vhost.update!(**database_modify_flags.prepare(database.account,
-                                                            options))
-              provision_vhost_and_explain(vhost.service, vhost)
+
+              prepared_params, settings = database_modify_flags.prepare(
+                database.account,
+                options
+              )
+
+              vhost.update!(**prepared_params)
+              provision_vhost_and_explain(vhost.service, vhost, settings)
             end
 
             tcp_create_flags = Helpers::Vhost::OptionSetBuilder.new do
@@ -246,18 +256,26 @@ module Aptible
             no_commands do
               def create_app_vhost(flags, options, process_type, **attrs)
                 service = ensure_service(options, process_type)
+
+                prepared_params, settings =
+                  flags.prepare(service.account, options)
+
                 vhost = service.create_vhost!(
-                  **flags.prepare(service.account, options),
+                  **prepared_params,
                   **attrs
                 )
-                provision_vhost_and_explain(service, vhost)
+                provision_vhost_and_explain(service, vhost, settings)
               end
 
               def modify_app_vhost(flags, options, hostname)
                 app = ensure_app(options)
                 vhost = find_vhost(each_service(app), hostname)
-                vhost.update!(**flags.prepare(vhost.service.account, options))
-                provision_vhost_and_explain(vhost.service, vhost)
+
+                prepared_params, settings =
+                  flags.prepare(vhost.service.account, options)
+
+                vhost.update!(**prepared_params)
+                provision_vhost_and_explain(vhost.service, vhost, settings)
               end
             end
           end

data/lib/aptible/cli/version.rb

@@ -1,5 +1,5 @@
 module Aptible
   module CLI
-    VERSION = '0.26.4'.freeze
+    VERSION = '0.26.6'.freeze
   end
 end

data/spec/aptible/cli/helpers/vhost/option_set_builder_spec.rb

@@ -0,0 +1,94 @@
+require 'spec_helper'
+
+describe Aptible::CLI::Helpers::Vhost::OptionSetBuilder do
+  def register_options(builder)
+    klass = Class.new(Thor) { include Aptible::CLI::Helpers::App }
+    builder.declare_options(klass)
+    klass.instance_variable_get(:@method_options)
+  end
+
+  describe '--ssl-protocols-override option description' do
+    context 'HTTPS endpoints (ALB, alb! flag set)' do
+      let(:builder) do
+        described_class.new do
+          app!
+          tls!
+          alb!
+        end
+      end
+
+      it 'includes PFS values' do
+        desc = register_options(builder)[:ssl_protocols_override].description
+        expect(desc).to include('PFS')
+      end
+    end
+
+    context 'TLS endpoints (ELB, tls! without alb!)' do
+      let(:builder) do
+        described_class.new do
+          app!
+          tls!
+        end
+      end
+
+      it 'does not include PFS values' do
+        desc = register_options(builder)[:ssl_protocols_override].description
+        expect(desc).not_to include('PFS')
+      end
+
+      it 'is still present' do
+        expect(register_options(builder)).to have_key(:ssl_protocols_override)
+      end
+    end
+
+    context 'gRPC endpoints (ELB, tls! without alb!)' do
+      let(:builder) do
+        described_class.new do
+          app!
+          port!
+          tls!
+        end
+      end
+
+      it 'does not include PFS values' do
+        desc = register_options(builder)[:ssl_protocols_override].description
+        expect(desc).not_to include('PFS')
+      end
+    end
+
+    context 'TCP endpoints (no tls! flag)' do
+      let(:builder) do
+        described_class.new do
+          app!
+          ports!
+        end
+      end
+
+      it 'is absent' do
+        expect(register_options(builder)).not_to have_key(:ssl_protocols_override)
+      end
+    end
+  end
+
+  describe 'SSL_PROTOCOL_ALB_DESC' do
+    subject { described_class::SSL_PROTOCOL_ALB_DESC }
+
+    it 'lists all PFS protocol values' do
+      pfs_values = described_class::SSL_PROTOCOL_VALUES.select { |v| v.include?('PFS') }
+      pfs_values.each { |v| is_expected.to include(v) }
+    end
+  end
+
+  describe 'SSL_PROTOCOL_ELB_DESC' do
+    subject { described_class::SSL_PROTOCOL_ELB_DESC }
+
+    it 'contains no PFS values' do
+      is_expected.not_to include('PFS')
+    end
+
+    it 'lists all non-PFS protocol values' do
+      non_pfs_values = described_class::SSL_PROTOCOL_VALUES.reject { |v| v.include?('PFS') }
+      non_pfs_values.each { |v| is_expected.to include(v) }
+    end
+  end
+end

data/spec/aptible/cli/resource_formatter_spec.rb

@@ -25,6 +25,9 @@ describe Aptible::CLI::ResourceFormatter do
         shared: false
       )
 
+      vhost.current_configuration = Fabricate(:setting, settings: {},
+                                                        vhost: vhost)
+
       expected = [
         'Id: 12',
         'Hostname: foo.io',