aspera-cli 4.15.0 → 4.17.0

data/lib/aspera/cli/plugins/config.rb

@@ -1,17 +1,17 @@
 # frozen_string_literal: true
 
-# cspell:ignore initdemo genkey asperasoft
+# cspell:ignore initdemo genkey pubkey asperasoft
 require 'aspera/cli/basic_auth_plugin'
 require 'aspera/cli/extended_value'
 require 'aspera/cli/version'
 require 'aspera/cli/formatter'
 require 'aspera/cli/info'
 require 'aspera/cli/transfer_progress'
-require 'aspera/fasp/installation'
-require 'aspera/fasp/products'
-require 'aspera/fasp/parameters'
-require 'aspera/fasp/transfer_spec'
-require 'aspera/fasp/error_info'
+require 'aspera/ascp/installation'
+require 'aspera/ascp/products'
+require 'aspera/transfer/error_info'
+require 'aspera/transfer/parameters'
+require 'aspera/transfer/spec'
 require 'aspera/keychain/encrypted_hash'
 require 'aspera/keychain/macos_security'
 require 'aspera/proxy_auto_config'
@@ -19,9 +19,12 @@ require 'aspera/open_application'
 require 'aspera/persistency_action_once'
 require 'aspera/id_generator'
 require 'aspera/persistency_folder'
+require 'aspera/data_repository'
 require 'aspera/line_logger'
 require 'aspera/rest'
 require 'aspera/log'
+require 'aspera/assert'
+require 'aspera/oauth'
 require 'open3'
 require 'date'
 require 'erb'
@@ -30,31 +33,31 @@ module Aspera
   module Cli
     module Plugins
       # manage the CLI config file
-      class Config < Aspera::Cli::Plugin
+      class Config < Cli::Plugin
         # folder in $HOME for application files (config, cache)
         ASPERA_HOME_FOLDER_NAME = '.aspera'
         # default config file
         DEFAULT_CONFIG_FILENAME = 'config.yaml'
+        DEFAULT_VAULT_FILENAME = 'vault.bin'
         # reserved preset names
         CONF_PRESET_CONFIG = 'config'
         CONF_PRESET_VERSION = 'version'
-        CONF_PRESET_DEFAULT = 'default'
+        CONF_PRESET_DEFAULTS = 'default'
         CONF_PRESET_GLOBAL = 'global_common_defaults'
+        # special name to identify value of default
         GLOBAL_DEFAULT_KEYWORD = 'GLOBAL'
-        CONF_PLUGIN_SYM = :config # Plugins::Config.name.split('::').last.downcase.to_sym
         CONF_GLOBAL_SYM = :config
         # folder containing custom plugins in user's config folder
         ASPERA_PLUGINS_FOLDERNAME = 'plugins'
         PERSISTENCY_FOLDER = 'persist_store'
-        RUBY_FILE_EXT = '.rb'
         ASPERA = 'aspera'
         SERVER_COMMAND = 'server'
         APP_NAME_SDK = 'sdk'
         CONNECT_WEB_URL = 'https://d3gcli72yxqn2z.cloudfront.net/connect'
         CONNECT_VERSIONS = 'connectversions.js' # cspell: disable-line
         TRANSFER_SDK_ARCHIVE_URL = 'https://ibm.biz/aspera_transfer_sdk'
-        DEMO = 'demo'
-        DEMO_SERVER_PRESET = 'demoserver' # cspell: disable-line
+        DEMO_SERVER = 'demo'
+        DEMO_PRESET = 'demoserver' # cspell: disable-line
         EMAIL_TEST_TEMPLATE = <<~END_OF_TEMPLATE
           From: <%=from_name%> <<%=from_email%>>
           To: <<%=to%>>
@@ -77,14 +80,13 @@ module Aspera
         private_constant :DEFAULT_CONFIG_FILENAME,
           :CONF_PRESET_CONFIG,
           :CONF_PRESET_VERSION,
-          :CONF_PRESET_DEFAULT,
+          :CONF_PRESET_DEFAULTS,
           :CONF_PRESET_GLOBAL,
           :ASPERA_PLUGINS_FOLDERNAME,
-          :RUBY_FILE_EXT,
           :ASPERA,
-          :DEMO,
           :TRANSFER_SDK_ARCHIVE_URL,
-          :DEMO_SERVER_PRESET,
+          :DEMO_SERVER,
+          :DEMO_PRESET,
           :EMAIL_TEST_TEMPLATE,
           :EXTEND_PRESET,
           :EXTEND_VAULT,
@@ -114,23 +116,11 @@ module Aspera
             File.dirname(File.expand_path(__FILE__))
           end
 
-          # name of englobing module
-          # @return "Aspera::Cli::Plugins"
-          def module_full_name
-            return Module.nesting[2].to_s
-          end
-
           # @return main folder where code is, i.e. .../lib
           # go up as many times as englobing modules (not counting class, as it is a file)
           def gem_src_root
-            File.expand_path(module_full_name.gsub('::', '/').gsub(%r{[^/]+}, '..'), gem_plugins_folder)
-          end
-
-          # instantiate a plugin
-          # plugins must be Capitalized
-          def plugin_class(plugin_name_sym)
-            # Module.nesting[2] is Aspera::Cli::Plugins
-            return Object.const_get("#{module_full_name}::#{plugin_name_sym.to_s.capitalize}")
+            # Module.nesting[2] is Cli::Plugins
+            File.expand_path(Module.nesting[2].to_s.gsub('::', '/').gsub(%r{[^/]+}, '..'), gem_plugins_folder)
           end
 
           # deep clone hash so that it does not get modified in case of display and secret hide
@@ -141,25 +131,25 @@ module Aspera
           # return product family folder (~/.aspera)
           def module_family_folder
             user_home_folder = Dir.home
-            raise Cli::Error, "Home folder does not exist: #{user_home_folder}. Check your user environment." unless Dir.exist?(user_home_folder)
+            Aspera.assert(Dir.exist?(user_home_folder), exception_class: Cli::Error){"Home folder does not exist: #{user_home_folder}. Check your user environment."}
             return File.join(user_home_folder, ASPERA_HOME_FOLDER_NAME)
           end
 
           # return product config folder (~/.aspera/<name>)
           def default_app_main_folder(app_name:)
-            raise 'app_name must be a non-empty String' unless app_name.is_a?(String) && !app_name.empty?
+            Aspera.assert_type(app_name, String)
+            Aspera.assert(!app_name.empty?)
             return File.join(module_family_folder, app_name)
           end
         end # self
 
-        def initialize(env, params)
-          raise 'Internal Error: env and params must be Hash' unless env.is_a?(Hash) && params.is_a?(Hash)
-          raise 'Internal Error: missing param' unless %i[gem help name version].eql?(params.keys.sort)
+        def initialize(gem:, name:, help:, version:, **env)
           # we need to defer parsing of options until we have the config file, so we can use @extend with @preset
-          super(env)
-          @info = params
-          @plugins = {}
-          @plugin_lookup_folders = []
+          super(**env)
+          @gem = gem
+          @name = name
+          @help = help
+          @version = version
           @use_plugin_defaults = true
           @config_presets = nil
           @config_checksum_on_disk = nil
@@ -168,6 +158,7 @@ module Aspera
           @pac_exec = nil
           @sdk_default_location = false
           @option_insecure = false
+          @option_warn_insecure_cert = true
           @option_ignore_cert_host_port = []
           @option_http_options = {}
           @ssl_warned_urls = []
@@ -175,7 +166,9 @@ module Aspera
           @proxy_credentials = nil
           @main_folder = nil
           @option_config_file = nil
+          # store is used for ruby https
           @certificate_store = nil
+          # paths are used for ascp
           @certificate_paths = nil
           @progress_bar = nil
           # option to set main folder
@@ -183,14 +176,14 @@ module Aspera
             :home, 'Home folder for tool',
             handler: {o: self, m: :main_folder},
             types: String,
-            default: self.class.default_app_main_folder(app_name: @info[:name]))
+            default: self.class.default_app_main_folder(app_name: @name))
           options.parse_options!
-          Log.log.debug{"#{@info[:name]} folder: #{@main_folder}"}
-          # data persistency manager
-          env[:persistency] = PersistencyFolder.new(File.join(@main_folder, PERSISTENCY_FOLDER))
+          Log.log.debug{"#{@name} folder: #{@main_folder}"}
+          # data persistency manager, created by config plugin
+          @persistency = PersistencyFolder.new(File.join(@main_folder, PERSISTENCY_FOLDER))
           # set folders for plugin lookup
-          add_plugin_lookup_folder(self.class.gem_plugins_folder)
-          add_plugin_lookup_folder(File.join(@main_folder, ASPERA_PLUGINS_FOLDERNAME))
+          PluginFactory.instance.add_lookup_folder(self.class.gem_plugins_folder)
+          PluginFactory.instance.add_lookup_folder(File.join(@main_folder, ASPERA_PLUGINS_FOLDERNAME))
           # option to set config file
           options.declare(
             :config_file, 'Path to YAML file with preset configuration',
@@ -222,10 +215,10 @@ module Aspera
           options.declare(:test_mode, 'Wizard: skip private key check step', values: :bool, default: false)
           options.declare(:key_path, 'Wizard: path to private key for JWT')
           # Transfer SDK options
-          options.declare(:ascp_path, 'Path to ascp', handler: {o: Fasp::Installation.instance, m: :ascp_path})
+          options.declare(:ascp_path, 'Path to ascp', handler: {o: Ascp::Installation.instance, m: :ascp_path})
           options.declare(:use_product, 'Use ascp from specified product', handler: {o: self, m: :option_use_product})
           options.declare(:sdk_url, 'URL to get SDK', default: TRANSFER_SDK_ARCHIVE_URL)
-          options.declare(:sdk_folder, 'SDK folder path', handler: {o: Fasp::Installation.instance, m: :sdk_folder})
+          options.declare(:sdk_folder, 'SDK folder path', handler: {o: Ascp::Installation.instance, m: :sdk_folder})
           options.declare(:progress_bar, 'Display progress bar', values: :bool, default: Environment.terminal?)
           # email options
           options.declare(:smtp, 'SMTP configuration', types: Hash)
@@ -233,16 +226,17 @@ module Aspera
           options.declare(:notify_template, 'Email ERB template for notification of transfers')
           # HTTP options
           options.declare(:insecure, 'Do not validate any HTTPS certificate', values: :bool, handler: {o: self, m: :option_insecure}, default: :no)
-          options.declare(:ignore_certificate, 'List of HTTPS url where to no validate certificate', types: Array, handler: {o: self, m: :option_ignore_cert_host_port})
+          options.declare(:ignore_certificate, 'Do not validate HTTPS certificate for these URLs', types: Array, handler: {o: self, m: :option_ignore_cert_host_port})
+          options.declare(:silent_insecure, 'Issue a warning if certificate is ignored', values: :bool, handler: {o: self, m: :option_warn_insecure_cert}, default: :yes)
           options.declare(:cert_stores, 'List of folder with trusted certificates', types: [Array, String], handler: {o: self, m: :trusted_cert_locations})
           options.declare(:http_options, 'Options for HTTP/S socket', types: Hash, handler: {o: self, m: :option_http_options}, default: {})
-          options.declare(:cache_tokens, 'Save and reuse Oauth tokens', values: :bool, handler: {o: self, m: :option_cache_tokens})
+          options.declare(:cache_tokens, 'Save and reuse OAuth tokens', values: :bool, handler: {o: self, m: :option_cache_tokens})
           options.declare(:fpac, 'Proxy auto configuration script')
           options.declare(:proxy_credentials, 'HTTP proxy credentials (user and password)', types: Array)
           options.parse_options!
           @progress_bar = TransferProgress.new if options.get_option(:progress_bar)
           # Check SDK folder is set or not, for compatibility, we check in two places
-          sdk_folder = Fasp::Installation.instance.sdk_folder rescue nil
+          sdk_folder = Ascp::Installation.instance.sdk_folder rescue nil
           if sdk_folder.nil?
             @sdk_default_location = true
             Log.log.debug('SDK folder is not set, checking default')
@@ -252,19 +246,19 @@ module Aspera
             if !Dir.exist?(sdk_folder)
               Log.log.debug{"not exists: #{sdk_folder}"}
               # former location
-              former_sdk_folder = File.join(self.class.default_app_main_folder(app_name: @info[:name]), APP_NAME_SDK)
+              former_sdk_folder = File.join(self.class.default_app_main_folder(app_name: @name), APP_NAME_SDK)
               Log.log.debug{"checking: #{former_sdk_folder}"}
               sdk_folder = former_sdk_folder if Dir.exist?(former_sdk_folder)
             end
             Log.log.debug{"using: #{sdk_folder}"}
-            Fasp::Installation.instance.sdk_folder = sdk_folder
+            Ascp::Installation.instance.sdk_folder = sdk_folder
           end
           pac_script = options.get_option(:fpac)
           # create PAC executor
-          @pac_exec = Aspera::ProxyAutoConfig.new(pac_script).register_uri_generic unless pac_script.nil?
+          @pac_exec = ProxyAutoConfig.new(pac_script).register_uri_generic unless pac_script.nil?
           proxy_user_pass = options.get_option(:proxy_credentials)
           if !proxy_user_pass.nil?
-            raise Cli::BadArgument, "proxy_credentials shall have two elements (#{proxy_user_pass.length})" unless proxy_user_pass.length.eql?(2)
+            Aspera.assert(proxy_user_pass.length.eql?(2), exception_class: Cli::BadArgument){"proxy_credentials shall have two elements (#{proxy_user_pass.length})"}
             @proxy_credentials = {user: proxy_user_pass[0], pass: proxy_user_pass[1]}
             @pac_exec.proxy_user = @proxy_credentials[:user]
             @pac_exec.proxy_pass = @proxy_credentials[:pass]
@@ -273,34 +267,36 @@ module Aspera
             user_agent:  PROGRAM_NAME,
             session_cb:  lambda{|http_session|update_http_session(http_session)},
             progress_bar: @progress_bar)
-          Oauth.persist_mgr = persistency if @option_cache_tokens
-          Fasp::Parameters.file_list_folder = File.join(@main_folder, 'filelists') # cspell: disable-line
-          Aspera::RestErrorAnalyzer.instance.log_file = File.join(@main_folder, 'rest_exceptions.log')
+          OAuth::Factory.instance.persist_mgr = persistency if @option_cache_tokens
+          Transfer::Parameters.file_list_folder = File.join(@main_folder, 'filelists') # cspell: disable-line
+          RestErrorAnalyzer.instance.log_file = File.join(@main_folder, 'rest_exceptions.log')
           # register aspera REST call error handlers
-          Aspera::RestErrorsAspera.register_handlers
+          RestErrorsAspera.register_handlers
         end
 
-        attr_accessor :main_folder, :option_cache_tokens, :option_insecure, :option_http_options
+        attr_accessor :main_folder, :option_cache_tokens, :option_insecure, :option_warn_insecure_cert, :option_http_options
         attr_reader :option_ignore_cert_host_port, :progress_bar
 
+        # add files, folders or default locations to the certificate store
         def trusted_cert_locations=(path_list)
           path_list = [path_list] unless path_list.is_a?(Array)
+          Aspera.assert_type(path_list, Array){'cert locations'}
           if @certificate_store.nil?
             Log.log.debug('Creating SSL Cert store')
             @certificate_store = OpenSSL::X509::Store.new
-            @certificate_store.set_default_paths
             @certificate_paths = []
           end
 
           path_list.each do |path|
-            raise 'Expecting a String for cert location' unless path.is_a?(String)
-            Log.log.debug("Adding cert location: #{path}")
+            Aspera.assert_type(path, String){'Expecting a String for certificate location'}
+            paths_to_add = [path]
+            Log.log.debug{"Adding cert location: #{path}"}
             if path.eql?(ExtendedValue::DEF)
-              path = OpenSSL::X509::DEFAULT_CERT_DIR
-              @certificate_store.add_path(path)
-              @certificate_paths.push(path)
-              path = OpenSSL::X509::DEFAULT_CERT_FILE
-              @certificate_store.add_file(path)
+              @certificate_store.set_default_paths
+              paths_to_add = [
+                OpenSSL::X509::DEFAULT_CERT_DIR,
+                OpenSSL::X509::DEFAULT_CERT_FILE
+              ].select{|f|File.exist?(f)}
             elsif File.file?(path)
               @certificate_store.add_file(path)
             elsif File.directory?(path)
@@ -308,39 +304,57 @@ module Aspera
             else
               raise "No such file or folder: #{path}"
             end
-            @certificate_paths.push(path)
+            paths_to_add.each do |p|
+              pp = [File.realpath(p)]
+              if File.directory?(p)
+                pp = Dir.entries(p)
+                  .map{|e|File.realpath(File.join(p, e))}
+                  .select{|entry|File.file?(entry)}
+              end
+              @certificate_paths.concat(pp)
+            end
           end
+          @certificate_paths.uniq!
         end
 
-        def trusted_cert_locations(files_only: false)
-          locations = if @certificate_paths.nil?
-            [OpenSSL::X509::DEFAULT_CERT_DIR, OpenSSL::X509::DEFAULT_CERT_FILE]
-          else
-            @certificate_paths
+        # returns only files
+        def trusted_cert_locations
+          locations = @certificate_paths
+          if locations.nil?
+            # compute default locations
+            self.trusted_cert_locations = ExtendedValue::DEF
+            locations = @certificate_paths
+            # restore defaults
+            @certificate_paths = @certificate_store = nil
           end
-          locations = locations.select{|f|File.file?(f)} if files_only
           return locations
         end
 
         def option_ignore_cert_host_port=(url_list)
           url_list.each do |url|
             uri = URI.parse(url)
+            raise "Expecting https scheme: #{url}" unless uri.scheme.eql?('https')
             @option_ignore_cert_host_port.push([uri.host, uri.port].freeze)
           end
         end
 
         def ignore_cert?(address, port)
           endpoint = [address, port].freeze
-          Log.log.debug{"ignore cert? #{endpoint}"}
-          return false unless @option_insecure || @option_ignore_cert_host_port.any?(endpoint)
-          base_url = "https://#{address}:#{port}"
-          if !@ssl_warned_urls.include?(base_url)
-            formatter.display_message(
-              :error,
-              "#{Formatter::WARNING_FLASH} Ignoring certificate for: #{base_url}. Do not deactivate certificate verification in production.")
-            @ssl_warned_urls.push(base_url)
+          ignore_cert = false
+          if @option_insecure || @option_ignore_cert_host_port.any?(endpoint)
+            ignore_cert = true
+            if @option_warn_insecure_cert
+              base_url = "https://#{address}:#{port}"
+              if !@ssl_warned_urls.include?(base_url)
+                formatter.display_message(
+                  :error,
+                  "#{Formatter::WARNING_FLASH} Ignoring certificate for: #{base_url}. Do not deactivate certificate verification in production.")
+                @ssl_warned_urls.push(base_url)
+              end
+            end
           end
-          return true
+          Log.log.debug{"ignore cert? #{endpoint} -> #{ignore_cert}"}
+          return ignore_cert
         end
 
         # called every time a new REST HTTP session is opened to set user-provided options
@@ -370,7 +384,7 @@ module Aspera
         def check_gem_version
           latest_version =
             begin
-              Rest.new(base_url: 'https://rubygems.org/api/v1').read("versions/#{@info[:gem]}/latest.json")[:data]['version']
+              Rest.new(base_url: 'https://rubygems.org/api/v1').read("versions/#{@gem}/latest.json")[:data]['version']
             rescue StandardError
               Log.log.warn('Could not retrieve latest gem version on rubygems.')
               '0'
@@ -382,10 +396,10 @@ module Aspera
             end
           end
           return {
-            name:        @info[:gem],
-            current:     Aspera::Cli::VERSION,
+            name:        @gem,
+            current:     Cli::VERSION,
             latest:      latest_version,
-            need_update: Gem::Version.new(Aspera::Cli::VERSION) < Gem::Version.new(latest_version)
+            need_update: Gem::Version.new(Cli::VERSION) < Gem::Version.new(latest_version)
           }
         end
 
@@ -418,8 +432,8 @@ module Aspera
         # retrieve structure from cloud (CDN) with all versions available
         def connect_versions
           if @connect_versions.nil?
-            api_connect_cdn = Rest.new({base_url: CONNECT_WEB_URL})
-            javascript = api_connect_cdn.call({operation: 'GET', subpath: CONNECT_VERSIONS})
+            api_connect_cdn = Rest.new(base_url: CONNECT_WEB_URL)
+            javascript = api_connect_cdn.call(operation: 'GET', subpath: CONNECT_VERSIONS)
             # get result on one line
             connect_versions_javascript = javascript[:http].body.gsub(/\r?\n\s*/, '')
             Log.log.debug{"javascript=[\n#{connect_versions_javascript}\n]"}
@@ -443,25 +457,25 @@ module Aspera
           return nil
         end
 
-        # get the default global preset, or init a new one
+        # get the default global preset, or set default one
         def global_default_preset
-          global_default_preset_name = get_plugin_default_config_name(CONF_GLOBAL_SYM)
-          if global_default_preset_name.nil?
-            global_default_preset_name = CONF_PRESET_GLOBAL.to_s
-            set_preset_key(CONF_PRESET_DEFAULT, CONF_GLOBAL_SYM, global_default_preset_name)
+          result = get_plugin_default_config_name(CONF_GLOBAL_SYM)
+          if result.nil?
+            result = CONF_PRESET_GLOBAL
+            set_preset_key(CONF_PRESET_DEFAULTS, CONF_GLOBAL_SYM, result)
           end
-          return global_default_preset_name
+          return result
         end
 
         def set_preset_key(preset, param_name, param_value)
-          raise "Parameter name must be a String or Symbol, not #{param_name.class}" unless [String, Symbol].include?(param_name.class)
+          Aspera.assert_values(param_name.class, [String, Symbol]){'parameter'}
           param_name = param_name.to_s
           selected_preset = @config_presets[preset]
           if selected_preset.nil?
             Log.log.debug{"No such preset name: #{preset}, initializing"}
             selected_preset = @config_presets[preset] = {}
           end
-          raise "expecting Hash for #{preset}.#{param_name}" unless selected_preset.is_a?(Hash)
+          Aspera.assert_type(selected_preset, Hash){"#{preset}.#{param_name}"}
           if selected_preset.key?(param_name)
             if selected_preset[param_name].eql?(param_value)
               Log.log.warn{"keeping same value for #{preset}: #{param_name}: #{param_value}"}
@@ -482,7 +496,7 @@ module Aspera
         end
 
         # $HOME/.aspera/`program_name`
-        attr_reader :gem_url, :plugins
+        attr_reader :gem_url
         attr_accessor :option_config_file
 
         # @return the hash from name (also expands possible includes)
@@ -493,7 +507,7 @@ module Aspera
           include_path = include_path.clone # avoid messing up if there are multiple branches
           current = @config_presets
           config_name.split(PRESET_DIG_SEPARATOR).each do |name|
-            raise Cli::Error, "Expecting Hash for sub key: #{include_path} (#{current.class})" unless current.is_a?(Hash)
+            Aspera.assert_type(current, Hash, exception_class: Cli::Error){"sub key: #{include_path}"}
             include_path.push(name)
             current = current[name]
             raise Cli::Error, "No such config preset: #{include_path}" if current.nil?
@@ -503,7 +517,7 @@ module Aspera
         end
 
         def option_use_product=(value)
-          Fasp::Installation.instance.use_ascp_from_product(value)
+          Ascp::Installation.instance.use_ascp_from_product(value)
         end
 
         def option_use_product
@@ -511,15 +525,14 @@ module Aspera
         end
 
         def option_plugin_folder=(value)
-          case value
-          when String then add_plugin_lookup_folder(value)
-          when Array then value.each{|f|add_plugin_lookup_folder(f)}
-          else raise "folder shall be Array or String, not #{value.class}"
-          end
+          Aspera.assert_values(value.class, [String, Array]){'plugin folder'}
+          value = [value] if value.is_a?(String)
+          Aspera.assert(value.all?(String)){'plugin folder'}
+          value.each{|f|PluginFactory.instance.add_lookup_folder(f)}
         end
 
         def option_plugin_folder
-          return @plugin_lookup_folders
+          return PluginFactory.instance.lookup_folders
         end
 
         def option_preset; 'write-only option'; end
@@ -558,18 +571,18 @@ module Aspera
           end
           files_to_copy = []
           Log.log.debug{Log.dump('Available_presets', @config_presets)}
-          raise 'Expecting YAML Hash' unless @config_presets.is_a?(Hash)
+          Aspera.assert_type(@config_presets, Hash){'config file YAML'}
           # check there is at least the config section
-          raise "Cannot find key: #{CONF_PRESET_CONFIG}" unless @config_presets.key?(CONF_PRESET_CONFIG)
+          Aspera.assert(@config_presets.key?(CONF_PRESET_CONFIG)){"Cannot find key: #{CONF_PRESET_CONFIG}"}
           version = @config_presets[CONF_PRESET_CONFIG][CONF_PRESET_VERSION]
           raise 'No version found in config section.' if version.nil?
           Log.log.debug{"conf version: #{version}"}
           # VVV if there are any conversion needed, those happen here.
           # fix bug in 4.4 (creating key "true" in "default" preset)
-          @config_presets[CONF_PRESET_DEFAULT].delete(true) if @config_presets[CONF_PRESET_DEFAULT].is_a?(Hash)
+          @config_presets[CONF_PRESET_DEFAULTS].delete(true) if @config_presets[CONF_PRESET_DEFAULTS].is_a?(Hash)
           # ^^^ Place new compatibility code before this line
           # set version to current
-          @config_presets[CONF_PRESET_CONFIG][CONF_PRESET_VERSION] = @info[:version]
+          @config_presets[CONF_PRESET_CONFIG][CONF_PRESET_VERSION] = @version
           unless files_to_copy.empty?
             Log.log.warn('Copying referenced files')
             files_to_copy.each do |file|
@@ -584,7 +597,7 @@ module Aspera
           Log.log.debug{"-> #{e.class.name} : #{e}"}
           if File.exist?(@option_config_file)
             # then there is a problem with that file.
-            new_name = "#{@option_config_file}.pre#{@info[:version]}.manual_conversion_needed"
+            new_name = "#{@option_config_file}.pre#{@version}.manual_conversion_needed"
             File.rename(@option_config_file, new_name)
             Log.log.warn{"Renamed config file to #{new_name}."}
             Log.log.warn('Manual Conversion is required. Next time, a new empty file will be created.')
@@ -592,33 +605,6 @@ module Aspera
           raise Cli::Error, e.to_s
         end
 
-        # find plugins in defined paths
-        def add_plugins_from_lookup_folders
-          @plugin_lookup_folders.each do |folder|
-            next unless File.directory?(folder)
-            # TODO: add gem root to load path ? and require short folder ?
-            # $LOAD_PATH.push(folder) if i[:add_path]
-            Dir.entries(folder).select{|file|file.end_with?(RUBY_FILE_EXT)}.each do |source|
-              add_plugin_info(File.join(folder, source))
-            end
-          end
-        end
-
-        def add_plugin_lookup_folder(folder)
-          @plugin_lookup_folders.unshift(folder)
-        end
-
-        def add_plugin_info(path)
-          raise "ERROR: plugin path must end with #{RUBY_FILE_EXT}" if !path.end_with?(RUBY_FILE_EXT)
-          plugin_symbol = File.basename(path, RUBY_FILE_EXT).to_sym
-          req = path.gsub(/#{RUBY_FILE_EXT}$/o, '')
-          if @plugins.key?(plugin_symbol)
-            Log.log.warn{"skipping plugin already registered: #{plugin_symbol}"}
-            return
-          end
-          @plugins[plugin_symbol] = {source: path, require_stanza: req}
-        end
-
         # Find a plugin, and issue the "require"
         # @return [Hash] plugin info: { product: , url:, version: }
         def identify_plugins_for_url
@@ -626,33 +612,36 @@ module Aspera
           check_only = options.get_next_argument('plugin name', mandatory: false)
           check_only = check_only.to_sym unless check_only.nil?
           found_apps = []
-          plugins.each do |plugin_name_sym, plugin_info|
+          my_self_plugin_sym = self.class.name.split('::').last.downcase.to_sym
+          PluginFactory.instance.plugins.each do |plugin_name_sym, plugin_info|
             # no detection for internal plugin
-            next if plugin_name_sym.eql?(CONF_PLUGIN_SYM)
+            next if plugin_name_sym.eql?(my_self_plugin_sym)
             next if check_only && !check_only.eql?(plugin_name_sym)
             # load plugin class
             require plugin_info[:require_stanza]
-            detect_plugin_class = self.class.plugin_class(plugin_name_sym)
+            detect_plugin_class = PluginFactory.plugin_class(plugin_name_sym)
             # requires detection method
             next unless detect_plugin_class.respond_to?(:detect)
             detection_info = nil
             begin
+              Log.log.debug{"detecting #{plugin_name_sym} at #{app_url}"}
               detection_info = detect_plugin_class.detect(app_url)
             rescue OpenSSL::SSL::SSLError => e
               Log.log.warn(e.message)
               Log.log.warn('Use option --insecure=yes to allow unchecked certificate') if e.message.include?('cert')
             rescue StandardError => e
-              Log.log.debug{"detect error: #{e}"}
+              Log.log.debug{"detect error: [#{e.class}] #{e}"}
               next
             end
             next if detection_info.nil?
-            raise 'internal error' if detection_info.key?(:url) && !detection_info[:url].is_a?(String)
+            Aspera.assert_type(detection_info, Hash)
+            Aspera.assert_type(detection_info[:url], String) if detection_info.key?(:url)
             app_name = detect_plugin_class.respond_to?(:application_name) ? detect_plugin_class.application_name : detect_plugin_class.name.split('::').last
             # if there is a redirect, then the detector can override the url.
             found_apps.push({product: plugin_name_sym, name: app_name, url: app_url, version: 'unknown'}.merge(detection_info))
           end # loop
           raise "No known application found at #{app_url}" if found_apps.empty?
-          raise 'Internal error' unless found_apps.all?{|a|a.keys.all?(Symbol)}
+          Aspera.assert(found_apps.all?{|a|a.keys.all?(Symbol)})
           return found_apps
         end
 
@@ -666,10 +655,10 @@ module Aspera
           case command
           when :list
             return {type: :object_list, data: connect_versions, fields: %w[id title version]}
-          when :info # shows files used
+          when :info
             one_res.delete('links')
             return {type: :single_object, data: one_res}
-          when :version # shows files used
+          when :version
             all_links = one_res['links']
             command = options.get_next_command(%i[list download open])
             if %i[download open].include?(command)
@@ -678,15 +667,15 @@ module Aspera
               raise 'no such value' if one_link.nil?
             end
             case command
-            when :list # shows files used
+            when :list
               return {type: :object_list, data: all_links}
             when :download
-              folder_dest = transfer.destination_folder(Fasp::TransferSpec::DIRECTION_RECEIVE)
+              folder_dest = transfer.destination_folder(Transfer::Spec::DIRECTION_RECEIVE)
               # folder_dest=self.options.get_next_argument('destination folder')
-              api_connect_cdn = Rest.new({base_url: CONNECT_WEB_URL})
+              api_connect_cdn = Rest.new(base_url: CONNECT_WEB_URL)
               file_url = one_link['href']
               filename = file_url.gsub(%r{.*/}, '')
-              api_connect_cdn.call({operation: 'GET', subpath: file_url, save_to_file: File.join(folder_dest, filename)})
+              api_connect_cdn.call(operation: 'GET', subpath: file_url, save_to_file: File.join(folder_dest, filename))
               return Main.result_status("Downloaded: #{filename}")
             when :open
               OpenApplication.instance.uri(one_link['href'])
@@ -702,79 +691,47 @@ module Aspera
             return execute_connect_action
           when :use
             ascp_path = options.get_next_argument('path to ascp')
-            ascp_version = Fasp::Installation.instance.get_ascp_version(ascp_path)
+            ascp_version = Ascp::Installation.instance.get_ascp_version(ascp_path)
             formatter.display_status("ascp version: #{ascp_version}")
             set_global_default(:ascp_path, ascp_path)
             return Main.result_nothing
-          when :show # shows files used
-            return {type: :status, data: Fasp::Installation.instance.path(:ascp)}
-          when :info # shows files used
-            data = Fasp::Installation.instance.file_paths
-            # read PATHs from ascp directly, and pvcl modules as well
-            Open3.popen3(data['ascp'], '-DDL-') do |_stdin, _stdout, stderr, thread|
-              last_line = ''
-              while (line = stderr.gets)
-                line.chomp!
-                last_line = line
-                case line
-                when /^DBG Path ([^ ]+) (dir|file) +: (.*)$/
-                  data[Regexp.last_match(1)] = Regexp.last_match(3)
-                when /^DBG Added module group:"(?<module>[^"]+)" name:"(?<scheme>[^"]+)", version:"(?<version>[^"]+)" interface:"(?<interface>[^"]+)"$/
-                  c = Regexp.last_match.named_captures.symbolize_keys
-                  data[c[:interface]] ||= {}
-                  data[c[:interface]][c[:module]] ||= []
-                  data[c[:interface]][c[:module]].push("#{c[:scheme]} v#{c[:version]}")
-                when %r{^DBG License result \(/license/(\S+)\): (.+)$}
-                  data[Regexp.last_match(1)] = Regexp.last_match(2)
-                when /^LOG (.+) version ([0-9.]+)$/
-                  data['product_name'] = Regexp.last_match(1)
-                  data['product_version'] = Regexp.last_match(2)
-                when /^LOG Initializing FASP version ([^,]+),/
-                  data['ascp_version'] = Regexp.last_match(1)
-                end
-              end
-              if !thread.value.exitstatus.eql?(1) && !data.key?('root')
-                raise last_line
-              end
-            end
-            # ascp's openssl directory
-            ascp_file = data['ascp']
-            File.binread(ascp_file).scan(/[\x20-\x7E]{4,}/) do |match|
-              if (m = match.match(/OPENSSLDIR.*"(.*)"/))
-                data['openssldir'] = m[1]
-              end
-            end if File.file?(ascp_file)
-            data['uuid'] = Fasp::Installation.instance.ssh_cert_uuid
-            # log is "-" no need to display
-            data.delete('log')
-            # show command line transfer spec
+          when :show
+            return {type: :status, data: Ascp::Installation.instance.path(:ascp)}
+          when :info
+            # collect info from ascp executable
+            data = Ascp::Installation.instance.ascp_info
+            # add command line transfer spec
             data['ts'] = transfer.updated_ts
+            # add keys
+            DataRepository::ELEMENTS.each_with_object(data){|i, h|h[i.to_s] = DataRepository.instance.item(i)}
+            # declare those as secrets
+            SecretHider::ADDITIONAL_KEYS_TO_HIDE.push(*DataRepository::ELEMENTS.map(&:to_s))
             return {type: :single_object, data: data}
           when :products
             command = options.get_next_command(%i[list use])
             case command
             when :list
-              return {type: :object_list, data: Fasp::Products.installed_products, fields: %w[name app_root]}
+              return {type: :object_list, data: Ascp::Products.installed_products, fields: %w[name app_root]}
             when :use
               default_product = options.get_next_argument('product name')
-              Fasp::Installation.instance.use_ascp_from_product(default_product)
-              set_global_default(:ascp_path, Fasp::Installation.instance.path(:ascp))
+              Ascp::Installation.instance.use_ascp_from_product(default_product)
+              set_global_default(:ascp_path, Ascp::Installation.instance.path(:ascp))
               return Main.result_nothing
             end
           when :install
             # reset to default location, if older default was used
-            Fasp::Installation.instance.sdk_folder = self.class.default_app_main_folder(app_name: APP_NAME_SDK) if @sdk_default_location
-            v = Fasp::Installation.instance.install_sdk(options.get_option(:sdk_url, mandatory: true))
+            Ascp::Installation.instance.sdk_folder = self.class.default_app_main_folder(app_name: APP_NAME_SDK) if @sdk_default_location
+            v = Ascp::Installation.instance.install_sdk(options.get_option(:sdk_url, mandatory: true))
             return Main.result_status("Installed version #{v}")
           when :spec
             return {
               type:   :object_list,
-              data:   Fasp::Parameters.man_table,
-              fields: [%w[name type], Fasp::Parameters::SUPPORTED_AGENTS_SHORT.map(&:to_s), %w[description]].flatten.freeze
+              data:   Transfer::Parameters.man_table,
+              fields: [%w[name type], Transfer::Parameters::SUPPORTED_AGENTS_SHORT.map(&:to_s), %w[description]].flatten.freeze
             }
           when :errors
             error_data = []
-            Fasp::ERROR_INFO.each_pair do |code, prop|
+            Transfer::ERROR_INFO.each_pair do |code, prop|
               error_data.push(code: code, mnemonic: prop[:c], retry: prop[:r], info: prop[:a])
             end
             return {type: :object_list, data: error_data}
@@ -887,6 +844,7 @@ module Aspera
           open
           documentation
           genkey
+          pubkey
           remote_certificate
           gem
           plugins
@@ -918,36 +876,45 @@ module Aspera
           when :documentation
             section = options.get_next_argument('private key file path', mandatory: false)
             section = "##{section}" unless section.nil?
-            OpenApplication.instance.uri("#{@info[:help]}#{section}")
+            OpenApplication.instance.uri("#{@help}#{section}")
             return Main.result_nothing
           when :genkey # generate new rsa key
             private_key_path = options.get_next_argument('private key file path')
             private_key_length = options.get_next_argument('size in bits', mandatory: false, type: Integer, default: DEFAULT_PRIV_KEY_LENGTH)
             self.class.generate_rsa_private_key(path: private_key_path, length: private_key_length)
             return Main.result_status("Generated #{private_key_length} bit RSA key: #{private_key_path}")
+          when :pubkey # get pub key
+            private_key_pem = options.get_next_argument('private key PEM value')
+            return Main.result_status(OpenSSL::PKey::RSA.new(private_key_pem).public_key.to_s)
           when :remote_certificate
+            cert_action = options.get_next_command(%i[chain only name])
             remote_url = options.get_next_argument('remote URL')
-            @option_insecure = true
-            remote_certificate = Rest.start_http_session(remote_url).peer_cert
-            remote_certificate.subject.to_a.find { |name, _, _| name == 'CN' }[1]
-            formatter.display_status("CN=#{remote_certificate.subject.to_a.find { |name, _, _| name == 'CN' }[1] rescue ''}")
-            return Main.result_status(remote_certificate.to_pem)
+            remote_chain = Rest.remote_certificate_chain(remote_url, as_string: false)
+            raise "No certificate found for #{remote_url}" unless remote_chain&.first
+            case cert_action
+            when :chain
+              return Main.result_status(remote_chain.map(&:to_pem).join("\n"))
+            when :only
+              return Main.result_status(remote_chain.first.to_pem)
+            when :name
+              return Main.result_status(remote_chain.first.subject.to_a.find { |name, _, _| name == 'CN' }[1])
+            end
           when :echo # display the content of a value given on command line
             return Formatter.auto_type(options.get_next_argument('value'))
           when :flush_tokens
-            deleted_files = Oauth.flush_tokens
+            deleted_files = OAuth::Factory.instance.flush_tokens
             return {type: :value_list, data: deleted_files, name: 'file'}
           when :plugins
             case options.get_next_command(%i[list create])
             when :list
               result = []
-              @plugins.each do |name, info|
+              PluginFactory.instance.plugins.each do |name, info|
                 require info[:require_stanza]
-                plugin_class = self.class.plugin_class(name)
+                plugin_klass = PluginFactory.plugin_class(name)
                 result.push({
                   plugin: name,
-                  detect: Formatter.tick(plugin_class.respond_to?(:detect)),
-                  wizard: Formatter.tick(plugin_class.respond_to?(:wizard)),
+                  detect: Formatter.tick(plugin_klass.respond_to?(:detect)),
+                  wizard: Formatter.tick(plugin_klass.respond_to?(:wizard)),
                   path:   info[:source]
                 })
               end
@@ -984,8 +951,7 @@ module Aspera
             return wizard_find(apps)
           when :coffee
             if OpenApplication.instance.url_method.eql?(:text)
-              require 'aspera/preview/terminal'
-              return Main.result_status(Preview::Terminal.build(Rest.new(base_url: COFFEE_IMAGE).read('')[:http].body))
+              return Main.result_picture_in_terminal(options, Rest.new(base_url: COFFEE_IMAGE).read('')[:http].body)
             end
             OpenApplication.instance.uri(COFFEE_IMAGE)
             return Main.result_nothing
@@ -994,8 +960,8 @@ module Aspera
           when :gem
             case options.get_next_command(%i[path version name])
             when :path then return Main.result_status(self.class.gem_src_root)
-            when :version then return Main.result_status(Aspera::Cli::VERSION)
-            when :name then return Main.result_status(@info[:gem])
+            when :version then return Main.result_status(Cli::VERSION)
+            when :name then return Main.result_status(@gem)
             end
           when :folder
             return Main.result_status(@main_folder)
@@ -1014,24 +980,24 @@ module Aspera
           when :check_update
             return {type: :single_object, data: check_gem_version}
           when :initdemo
-            if @config_presets.key?(DEMO_SERVER_PRESET)
-              Log.log.warn{"Demo server preset already present: #{DEMO_SERVER_PRESET}"}
+            if @config_presets.key?(DEMO_PRESET)
+              Log.log.warn{"Demo server preset already present: #{DEMO_PRESET}"}
             else
-              Log.log.info{"Creating Demo server preset: #{DEMO_SERVER_PRESET}"}
-              @config_presets[DEMO_SERVER_PRESET] = {
-                'url'                                    => "ssh://#{DEMO}.asperasoft.com:33001",
+              Log.log.info{"Creating Demo server preset: #{DEMO_PRESET}"}
+              @config_presets[DEMO_PRESET] = {
+                'url'                                    => "ssh://#{DEMO_SERVER}.asperasoft.com:33001",
                 'username'                               => ASPERA,
-                'ssAP'.downcase.reverse + 'drow'.reverse => DEMO + ASPERA # cspell:disable-line
+                'ssAP'.downcase.reverse + 'drow'.reverse => DEMO_SERVER + ASPERA # cspell:disable-line
               }
             end
-            @config_presets[CONF_PRESET_DEFAULT] ||= {}
-            if @config_presets[CONF_PRESET_DEFAULT].key?(SERVER_COMMAND)
-              Log.log.warn{"Server default preset already set to: #{@config_presets[CONF_PRESET_DEFAULT][SERVER_COMMAND]}"}
-              Log.log.warn{"Use #{DEMO_SERVER_PRESET} for demo: -P#{DEMO_SERVER_PRESET}"} unless
-                DEMO_SERVER_PRESET.eql?(@config_presets[CONF_PRESET_DEFAULT][SERVER_COMMAND])
+            @config_presets[CONF_PRESET_DEFAULTS] ||= {}
+            if @config_presets[CONF_PRESET_DEFAULTS].key?(SERVER_COMMAND)
+              Log.log.warn{"Server default preset already set to: #{@config_presets[CONF_PRESET_DEFAULTS][SERVER_COMMAND]}"}
+              Log.log.warn{"Use #{DEMO_PRESET} for demo: -P#{DEMO_PRESET}"} unless
+                DEMO_PRESET.eql?(@config_presets[CONF_PRESET_DEFAULTS][SERVER_COMMAND])
             else
-              @config_presets[CONF_PRESET_DEFAULT][SERVER_COMMAND] = DEMO_SERVER_PRESET
-              Log.log.info{"Setting server default preset to : #{DEMO_SERVER_PRESET}"}
+              @config_presets[CONF_PRESET_DEFAULTS][SERVER_COMMAND] = DEMO_PRESET
+              Log.log.info{"Setting server default preset to : #{DEMO_PRESET}"}
             end
             return Main.result_status('Done')
           when :vault then execute_vault
@@ -1041,9 +1007,9 @@ module Aspera
             exception_class_name = options.get_next_argument('exception class name', mandatory: true)
             exception_text = options.get_next_argument('exception text', mandatory: true)
             exception_class = Object.const_get(exception_class_name)
-            raise "#{exception_class} is not an exception: #{exception_class.class}" unless exception_class <= Exception
+            Aspera.assert(exception_class <= Exception){"#{exception_class} is not an exception: #{exception_class.class}"}
             raise exception_class, exception_text
-          else raise 'INTERNAL ERROR: wrong case'
+          else Aspera.error_unreachable_line
           end
         end
 
@@ -1058,15 +1024,17 @@ module Aspera
             apps.find{|a|a[:product].eql?(answer)}
           end
           wiz_url = identification[:url]
-          Log.log.debug{Log.dump(:identification, identification, :ruby)}
+          Log.log.debug{Log.dump(:identification, identification)}
           formatter.display_status("Using: #{identification[:name]} at #{wiz_url}".bold)
           # set url for instantiation of plugin
           options.add_option_preset({url: wiz_url})
           # instantiate plugin: command line options will be known and wizard can be called
-          wiz_plugin_class = self.class.plugin_class(identification[:product])
-          raise Cli::BadArgument, "Detected: #{identification[:product]}, but this application has no wizard" unless wiz_plugin_class.respond_to?(:wizard)
+          wiz_plugin_class = PluginFactory.plugin_class(identification[:product])
+          Aspera.assert(wiz_plugin_class.respond_to?(:wizard), exception_class: Cli::BadArgument) do
+            "Detected: #{identification[:product]}, but this application has no wizard"
+          end
           # instantiate plugin: command line options will be known, e.g. private_key
-          plugin_instance = wiz_plugin_class.new(@agents)
+          plugin_instance = wiz_plugin_class.new(**init_params)
           wiz_params = {
             object: plugin_instance
           }
@@ -1089,7 +1057,7 @@ module Aspera
               formatter.display_status('Using existing key:')
             else
               formatter.display_status("Generating #{DEFAULT_PRIV_KEY_LENGTH} bit RSA key...")
-              Config.generate_rsa_private_key(path: private_key_path)
+              self.class.generate_rsa_private_key(path: private_key_path)
               formatter.display_status('Created key:')
             end
             formatter.display_status(private_key_path)
@@ -1102,7 +1070,7 @@ module Aspera
           # finally, call the wizard
           wizard_result = wiz_plugin_class.wizard(**wiz_params)
           Log.log.debug{"wizard result: #{wizard_result}"}
-          raise "Internal error: missing or extra keys in wizard result: #{wizard_result.keys}" unless WIZARD_RESULT_KEYS.eql?(wizard_result.keys.sort)
+          Aspera.assert(WIZARD_RESULT_KEYS.eql?(wizard_result.keys.sort)){"missing or extra keys in wizard result: #{wizard_result.keys}"}
           # get preset name from user or default
           wiz_preset_name = options.get_option(:id)
           if wiz_preset_name.nil?
@@ -1118,22 +1086,22 @@ module Aspera
           # Write configuration file
           formatter.display_status("Preparing preset: #{wiz_preset_name}")
           # init defaults if necessary
-          @config_presets[CONF_PRESET_DEFAULT] ||= {}
+          @config_presets[CONF_PRESET_DEFAULTS] ||= {}
           option_override = options.get_option(:override, mandatory: true)
           raise Cli::Error, "A default configuration already exists for plugin '#{identification[:product]}' (use --override=yes or --default=no)" \
-            if !option_override && options.get_option(:default, mandatory: true) && @config_presets[CONF_PRESET_DEFAULT].key?(identification[:product])
+            if !option_override && options.get_option(:default, mandatory: true) && @config_presets[CONF_PRESET_DEFAULTS].key?(identification[:product])
           raise Cli::Error, "Preset already exists: #{wiz_preset_name}  (use --override=yes or --id=<name>)" \
             if !option_override && @config_presets.key?(wiz_preset_name)
           @config_presets[wiz_preset_name] = wizard_result[:preset_value].stringify_keys
           test_args = wizard_result[:test_args]
           if options.get_option(:default, mandatory: true)
             formatter.display_status("Setting config preset as default for #{identification[:product]}")
-            @config_presets[CONF_PRESET_DEFAULT][identification[:product].to_s] = wiz_preset_name
+            @config_presets[CONF_PRESET_DEFAULTS][identification[:product].to_s] = wiz_preset_name
           else
             test_args = "-P#{wiz_preset_name} #{test_args}"
           end
           # TODO: actually test the command
-          return Main.result_status("You can test with:\n#{@info[:name]} #{identification[:product]} #{test_args}")
+          return Main.result_status("You can test with:\n#{@name} #{identification[:product]} #{test_args}")
         end
 
         # @return [Hash] email server setting with defaults if not defined
@@ -1151,11 +1119,11 @@ module Aspera
             25
           end
           smtp[:from_email] ||= smtp[:username] if smtp.key?(:username)
-          smtp[:from_name] ||= smtp[:from_email].gsub(/@.*$/, '').gsub(/[^a-zA-Z]/, ' ').capitalize if smtp.key?(:username)
-          smtp[:domain] ||= smtp[:from_email].gsub(/^.*@/, '') if smtp.key?(:from_email)
+          smtp[:from_name] ||= smtp[:from_email].sub(/@.*$/, '').gsub(/[^a-zA-Z]/, ' ').capitalize if smtp.key?(:username)
+          smtp[:domain] ||= smtp[:from_email].sub(/^.*@/, '') if smtp.key?(:from_email)
           # check minimum required
           %i[server port domain].each do |n|
-            raise "Missing mandatory smtp parameter: #{n}" unless smtp.key?(n)
+            Aspera.assert(smtp.key?(n)){"Missing mandatory smtp parameter: #{n}"}
           end
           Log.log.debug{"smtp=#{smtp}"}
           return smtp
@@ -1169,7 +1137,7 @@ module Aspera
           values[:from_name] ||= mail_conf[:from_name]
           values[:from_email] ||= mail_conf[:from_email]
           %i[from_name from_email].each do |n|
-            raise "Missing email parameter: #{n}" unless values.key?(n)
+            Aspera.assert(values.key?(n)){"Missing email parameter: #{n}"}
           end
           start_options = [mail_conf[:domain]]
           start_options.push(mail_conf[:username], mail_conf[:password], :login) if mail_conf.key?(:username) && mail_conf.key?(:password)
@@ -1177,7 +1145,7 @@ module Aspera
           template_binding = Environment.empty_binding
           # add variables to binding
           values.each do |k, v|
-            raise "key (#{k.class}) must be Symbol" unless k.is_a?(Symbol)
+            Aspera.assert_type(k, Symbol)
             template_binding.local_variable_set(k, v)
           end
           # execute template
@@ -1211,19 +1179,19 @@ module Aspera
         # returns [String] name if config_presets has default
         # returns nil if there is no config or bypass default params
         def get_plugin_default_config_name(plugin_name_sym)
-          raise 'internal error: config_presets shall be defined' if @config_presets.nil?
+          Aspera.assert(!@config_presets.nil?){'config_presets shall be defined'}
           if !@use_plugin_defaults
             Log.log.debug('skip default config')
             return nil
           end
-          if @config_presets.key?(CONF_PRESET_DEFAULT) &&
-              @config_presets[CONF_PRESET_DEFAULT].key?(plugin_name_sym.to_s)
-            default_config_name = @config_presets[CONF_PRESET_DEFAULT][plugin_name_sym.to_s]
+          if @config_presets.key?(CONF_PRESET_DEFAULTS) &&
+              @config_presets[CONF_PRESET_DEFAULTS].key?(plugin_name_sym.to_s)
+            default_config_name = @config_presets[CONF_PRESET_DEFAULTS][plugin_name_sym.to_s]
             if !@config_presets.key?(default_config_name)
               Log.log.error do
                 "Default config name [#{default_config_name}] specified for plugin [#{plugin_name_sym}], but it does not exist in config file.\n" \
                   'Please fix the issue: either create preset with one parameter: ' \
-                  "(#{@info[:name]} config id #{default_config_name} init @json:'{}') or remove default (#{@info[:name]} config id default remove #{plugin_name_sym})."
+                  "(#{@name} config id #{default_config_name} init @json:'{}') or remove default (#{@name} config id default remove #{plugin_name_sym})."
               end
             end
             raise Cli::Error, "Config name [#{default_config_name}] must be a hash, check config file." if !@config_presets[default_config_name].is_a?(Hash)
@@ -1235,16 +1203,17 @@ module Aspera
         # TODO: delete: ALLOWED_KEYS = %i[password username description].freeze
         # @return [Hash] result of execution of vault command
         def execute_vault
-          command = options.get_next_command(%i[list show create delete password])
+          command = options.get_next_command(%i[info list show create delete password])
           case command
+          when :info
+            return {type: :single_object, data: vault_info}
           when :list
             return {type: :object_list, data: vault.list}
           when :show
             return {type: :single_object, data: vault.get(label: options.get_next_argument('label'))}
           when :create
-            label = options.get_next_argument('label')
-            info = options.get_next_argument('info Hash')
-            raise 'info must be Hash' unless info.is_a?(Hash)
+            label = options.get_next_argument('label', type: String)
+            info = options.get_next_argument('info', type: Hash)
             info = info.symbolize_keys
             info[:label] = label
             vault.set(info)
@@ -1253,7 +1222,7 @@ module Aspera
             vault.delete(label: options.get_next_argument('label'))
             return Main.result_status('Password deleted')
           when :password
-            raise 'Vault does not support password change' unless vault.respond_to?(:password=)
+            Aspera.assert(vault.respond_to?(:password=)){'Vault does not support password change'}
             new_password = options.get_next_argument('new_password')
             vault.password = new_password
             vault.save
@@ -1263,36 +1232,45 @@ module Aspera
 
         # @return [String] value from vault matching <name>.<param>
         def vault_value(name)
-          m = name.match(/^(.+)\.(.+)$/)
-          raise 'vault name shall match <name>.<param>' if m.nil?
+          m = name.split('.')
+          raise 'vault name shall match <name>.<param>' unless m.length.eql?(2)
           # this raise exception if label not found:
-          info = vault.get(label: m[1])
-          value = info[m[2].to_sym]
-          raise "no such entry value: #{m[2]}" if value.nil?
+          info = vault.get(label: m[0])
+          value = info[m[1].to_sym]
+          raise "no such entry value: #{m[1]}" if value.nil?
           return value
         end
 
+        def vault_info
+          info = options.get_option(:vault) || {}
+          info = info.symbolize_keys
+          info[:type] ||= 'file'
+          info[:name] ||= (info[:type].eql?('file') ? DEFAULT_VAULT_FILENAME : PROGRAM_NAME)
+          Aspera.assert(info.keys.sort == %i[name type]) {"vault info shall have exactly keys 'type' and 'name'"}
+          Aspera.assert(info.values.all?(String)){'vault info shall have only string values'}
+          info[:password] = options.get_option(:vault_password, mandatory: true)
+          return info
+        end
+
         # @return [Object] vault, from options or cache
         def vault
           if @vault.nil?
-            vault_info = options.get_option(:vault) || {'type' => 'file', 'name' => 'vault.bin'}
-            vault_password = options.get_option(:vault_password, mandatory: true)
-            vault_type = vault_info['type'] || 'file'
-            vault_name = vault_info['name'] || (vault_type.eql?('file') ? 'vault.bin' : PROGRAM_NAME)
-            case vault_type
+            info = vault_info
+            case info[:type]
             when 'file'
               # absolute_path? introduced in ruby 2.7
-              vault_path = vault_name.eql?(File.absolute_path(vault_name)) ? vault_name : File.join(@main_folder, vault_name)
-              @vault = Keychain::EncryptedHash.new(vault_path, vault_password)
+              @vault = Keychain::EncryptedHash.new(
+                info[:name].eql?(File.absolute_path(info[:name])) ? info[:name] : File.join(@main_folder, info[:name]),
+                info[:password])
             when 'system'
               case Environment.os
               when Environment::OS_X
-                @vault = Keychain::MacosSystem.new(vault_name, vault_password)
+                @vault = Keychain::MacosSystem.new(info[:name], info[:password])
               else
                 raise 'not implemented for this OS'
               end
             else
-              raise Cli::BadArgument, "Unknown vault type: #{vault_type}"
+              raise Cli::BadArgument, "Unknown vault type: #{info[:type]}"
             end
           end
           raise 'No vault defined' if @vault.nil?
@@ -1301,14 +1279,14 @@ module Aspera
 
         # version of URL without trailing "/" and removing default port
         def canonical_url(url)
-          url.gsub(%r{/+$}, '').gsub(%r{^(https://[^/]+):443$}, '\1')
+          url.sub(%r{/+$}, '').sub(%r{^(https://[^/]+):443$}, '\1')
         end
 
         def lookup_preset(url:, username:)
           # remove extra info to maximize match
           url = canonical_url(url)
           Log.log.debug{"Lookup preset for #{username}@#{url}"}
-          @config_presets.each do |_k, v|
+          @config_presets.each_value do |v|
             next unless v.is_a?(Hash)
             conf_url = v['url'].is_a?(String) ? canonical_url(v['url']) : nil
             return self.class.protect_presets(v) if conf_url.eql?(url) && v['username'].eql?(username)