aspera-cli 4.26.2 → 4.27.0

data/lib/aspera/cli/plugins/ats.rb

@@ -15,23 +15,94 @@ module Aspera
       # Access Aspera Transfer Service
       # https://developer.ibm.com/aspera/docs/ats-api-reference/creating-ats-api-keys/
       class Ats < Base
+        application_name 'Aspera Transfer Service'
         # columns for list of cloud providers
         CLOUD_TABLE = %w[id name].freeze
         private_constant :CLOUD_TABLE
+
+        option :ibm_api_key, description: 'IBM API key, see https://cloud.ibm.com/iam/apikeys'
+        option :instance,    description: 'ATS instance in ibm cloud'
+        option :ats_key,     description: 'ATS key identifier (ats_xxx)'
+        option :ats_secret,  description: 'ATS key secret'
+        option :cloud,       description: 'Cloud provider'
+        option :region,      description: 'Cloud region'
+
         def initialize(api: nil, **base_args)
           super(**base_args)
           @ats_api_open = Api::Ats.new
           @ats_api_auth = api
-          options.declare(:ibm_api_key, 'IBM API key, see https://cloud.ibm.com/iam/apikeys')
-          options.declare(:instance, 'ATS instance in ibm cloud')
-          options.declare(:ats_key, 'ATS key identifier (ats_xxx)')
-          options.declare(:ats_secret, 'ATS key secret')
-          options.declare(:cloud, 'Cloud provider')
-          options.declare(:region, 'Cloud region')
           options.parse_options!
           Node.declare_options(options)
         end
 
+        # --- DSL ---
+
+        command :cluster,    description: 'Display general ATS cluster information (public API, no auth)'
+        command :access_key, description: 'Manage ATS access keys'
+        command :api_key,    description: 'Manage credential to access ATS API', condition: :api_key_available?
+        command :aws_trust_policy, description: 'Show AWS trust policy', action: lambda{Result::SingleObject.new(ats_api.read('aws/trustpolicy', {region: options.get_option(:region, mandatory: true)}))}
+
+        commands_under(:cluster) do
+          command :clouds, description: 'List cloud providers', action: lambda{Result::ObjectList.new(@ats_api_open.cloud_names.map{ |k, v| CLOUD_TABLE.zip([k, v]).to_h})}
+          command :list,   description: 'List ATS servers',     action: lambda{Result::ObjectList.new(@ats_api_open.all_servers, fields: %w[id cloud region])}
+          command :show,   description: 'Show a specific server'
+        end
+
+        commands_under(:access_key) do
+          command :create,      description: 'Create an access key',
+            arguments: [{name: :params, type: Hash, mandatory: false, default: {}}]
+          command(:list,        description: 'List access keys', action: lambda do
+            res = ats_api.read('access_keys', query_read_delete(default: {'offset' => 0, 'max_results' => 1000}))
+            Result::ObjectList.new(res['data'], fields: ['name', 'id', 'created.at', 'modified.at'])
+          end)
+          command :show,        description: 'Show an access key',
+            arguments: [{name: :access_key_id, type: :identifier}],
+            action: ->(access_key_id:, **){Result::SingleObject.new(ats_api.read("access_keys/#{access_key_id}"))}
+          command :modify,      description: 'Modify an access key',
+            arguments: [{name: :access_key_id, type: :identifier}, {name: :params, type: Hash}]
+          command :delete,      description: 'Delete an access key',
+            arguments: [{name: :access_key_id, type: :identifier}]
+          command :node,        description: 'Execute node commands via ATS access key',
+            arguments: [{name: :access_key_id, type: :identifier}],
+            setup: :setup_ak_node
+          command :cluster,     description: 'Show cluster info for an access key',
+            arguments: [{name: :access_key_id, type: :identifier}]
+          command :entitlement, description: 'Show ATS entitlement for an access key',
+            arguments: [{name: :access_key_id, type: :identifier}]
+        end
+
+        commands_under(%i[access_key node]) do
+          Node::COMMANDS_GEN4.each do |cmd|
+            command(cmd, description: "Node Gen4 #{cmd} command")
+          end
+        end
+
+        commands_under(:api_key) do
+          command(:instances, description: 'List ATS instances in IBM Cloud', action: lambda do
+            instances = ats_api_v2_auth_ibm.read('instances')
+            Log.log.warn{"more instances remaining: #{instances['remaining']}"} unless instances['remaining'].to_i.eql?(0)
+            Result::ValueList.new(instances['data'], name: 'instance')
+          end)
+          command :create, description: 'Create an ATS API key',
+            arguments: [{name: :params, type: Hash, mandatory: false, default: {}}],
+            action: ->(params:, **){Result::SingleObject.new(build_ats_ibm_api_with_instance.create('api_keys', params))}
+          command :list,   description: 'List ATS API keys', action: lambda{Result::ValueList.new(build_ats_ibm_api_with_instance.read('api_keys', {'offset' => 0, 'max_results' => 1000})['data'], name: 'ats_id')}
+          command :show,   description: 'Show an ATS API key',
+            arguments: [{name: :api_key_id, type: :identifier}],
+            action: ->(api_key_id:, **){Result::SingleObject.new(build_ats_ibm_api_with_instance.read("api_keys/#{api_key_id}"))}
+          command :delete, description: 'Delete an ATS API key',
+            arguments: [{name: :api_key_id, type: :identifier}]
+        end
+
+        # --- conditions ---
+
+        # api_key sub-tree is only available when authenticated via ATS key (not injected API)
+        def api_key_available?
+          @ats_api_auth.nil?
+        end
+
+        # --- helpers ---
+
         def server_by_cloud_region
           # TODO: provide list ?
           cloud = options.get_option(:cloud, mandatory: true).upcase
@@ -52,113 +123,6 @@ module Aspera
           )
         end
 
-        def execute_action_access_key
-          commands = %i[create list show modify delete node cluster entitlement]
-          command = options.get_next_command(commands)
-          # those do not require access key id
-          access_key_id = options.instance_identifier unless %i[create list].include?(command)
-          case command
-          when :create
-            params = value_create_modify(command: command, default: {})
-            server_data = nil
-            # if transfer_server_id not provided, get it from command line options
-            if !params.key?('transfer_server_id')
-              server_data = server_by_cloud_region
-              params['transfer_server_id'] = server_data['id']
-            end
-            Log.log.debug{"using params: #{params}".bg_red.gray}
-            if params.key?('storage')
-              case params['storage']['type']
-              # here we need somehow to map storage type to field to get for auth end point
-              when 'ibm-s3'
-                server_data2 = nil
-                if server_data.nil?
-                  server_data2 = @ats_api_open.all_servers.find{ |s| s['id'].eql?(params['transfer_server_id'])}
-                  raise "no such transfer server id: #{params['transfer_server_id']}" if server_data2.nil?
-                else
-                  server_data2 = @ats_api_open.all_servers.find do |s|
-                    s['cloud'].eql?(server_data['cloud']) &&
-                      s['region'].eql?(server_data['region']) &&
-                      s.key?('s3_authentication_endpoint')
-                  end
-                  raise "no such transfer server id: #{params['transfer_server_id']}" if server_data2.nil?
-                  # specific one do not have s3 end point in id
-                  params['transfer_server_id'] = server_data2['id']
-                end
-                params['storage']['endpoint'] = server_data2['s3_authentication_endpoint'] if !params['storage'].key?('authentication_endpoint')
-              end
-            end
-            res = ats_api.create('access_keys', params)
-            return Result::SingleObject.new(res)
-            # TODO : action : modify, with "PUT"
-          when :list
-            params = query_read_delete(default: {'offset' => 0, 'max_results' => 1000})
-            res = ats_api.read('access_keys', params)
-            return Result::ObjectList.new(res['data'], fields: ['name', 'id', 'created.at', 'modified.at'])
-          when :show
-            res = ats_api.read("access_keys/#{access_key_id}")
-            return Result::SingleObject.new(res)
-          when :modify
-            params = value_create_modify(command: command)
-            params['id'] = access_key_id
-            ats_api.update("access_keys/#{access_key_id}", params)
-            return Result::Status.new('modified')
-          when :entitlement
-            ak = ats_api.read("access_keys/#{access_key_id}")
-            api_bss = Api::Alee.new(ak['license']['entitlement_id'], ak['license']['customer_id'])
-            return Result::SingleObject.new(api_bss.read('entitlement'))
-          when :delete
-            ats_api.delete("access_keys/#{access_key_id}")
-            return Result::Status.new("deleted #{access_key_id}")
-          when :node
-            ak_data = ats_api.read("access_keys/#{access_key_id}")
-            server_data = @ats_api_open.all_servers.find{ |i| i['id'].start_with?(ak_data['transfer_server_id'])}
-            raise Cli::Error, 'no such server found' if server_data.nil?
-            node_url = server_data['transfer_setup_url']
-            api_node = Api::Node.new(
-              base_url: node_url,
-              auth:     {
-                type:     :basic,
-                username: access_key_id,
-                password: config.lookup_secret(url: node_url, username: access_key_id)
-              }
-            )
-            command = options.get_next_command(Node::COMMANDS_GEN4)
-            return Node.new(context: context, api: api_node).execute_command_gen4(command, ak_data['root_file_id'])
-          when :cluster
-            ats_url = ats_api.base_url
-            api_ak_auth = Rest.new(
-              base_url: ats_url,
-              auth:     {
-                type:     :basic,
-                username: access_key_id,
-                password: config.lookup_secret(url: ats_url, username: access_key_id)
-              }
-            )
-            return Result::SingleObject.new(api_ak_auth.read('servers'))
-          else Aspera.error_unexpected_value(command)
-          end
-        end
-
-        def execute_action_cluster_open
-          command = options.get_next_command(%i[clouds list show])
-          case command
-          when :clouds
-            return Result::ObjectList.new(@ats_api_open.cloud_names.map{ |k, v| CLOUD_TABLE.zip([k, v]).to_h})
-          when :list
-            return Result::ObjectList.new(@ats_api_open.all_servers, fields: %w[id cloud region])
-          when :show
-            if options.get_option(:cloud) || options.get_option(:region)
-              server_data = server_by_cloud_region
-            else
-              server_id = options.instance_identifier
-              server_data = @ats_api_open.all_servers.find{ |i| i['id'].eql?(server_id)}
-              raise BadIdentifier.new('server', server_id) if server_data.nil?
-            end
-            return Result::SingleObject.new(server_data)
-          end
-        end
-
         def ats_api_v2_auth_ibm(rest_add_headers = {})
           return Rest.new(
             base_url: "#{Api::Ats::SERVICE_BASE_URL}/v2",
@@ -177,60 +141,135 @@ module Aspera
           )
         end
 
-        def execute_action_api_key
-          command = options.get_next_command(%i[instances create list show delete])
-          concerned_id = options.instance_identifier if %i[show delete].include?(command)
-          rest_add_header = {}
-          if !command.eql?(:instances)
-            instance = options.get_option(:instance)
-            if instance.nil?
-              # Take the first Aspera on Cloud transfer service instance ID if not provided by user
-              instance = ats_api_v2_auth_ibm.read('instances')['data'].first
-              formatter.display_status("using first instance: #{instance}")
+        def action_cluster_show
+          if options.get_option(:cloud) || options.get_option(:region)
+            server_data = server_by_cloud_region
+          else
+            server_id = options.instance_identifier
+            server_data = @ats_api_open.all_servers.find{ |i| i['id'].eql?(server_id)}
+            raise BadIdentifier.new('server', server_id) if server_data.nil?
+          end
+          Result::SingleObject.new(server_data)
+        end
+
+        def action_access_key_create(params: {}, **)
+          server_data = nil
+          # if transfer_server_id not provided, get it from command line options
+          if !params.key?('transfer_server_id')
+            server_data = server_by_cloud_region
+            params['transfer_server_id'] = server_data['id']
+          end
+          Log.log.debug{"using params: #{params}".bg_red.gray}
+          if params.key?('storage')
+            case params['storage']['type']
+            # here we need somehow to map storage type to field to get for auth end point
+            when 'ibm-s3'
+              server_data2 = nil
+              if server_data.nil?
+                server_data2 = @ats_api_open.all_servers.find{ |s| s['id'].eql?(params['transfer_server_id'])}
+                raise "no such transfer server id: #{params['transfer_server_id']}" if server_data2.nil?
+              else
+                server_data2 = @ats_api_open.all_servers.find do |s|
+                  s['cloud'].eql?(server_data['cloud']) &&
+                    s['region'].eql?(server_data['region']) &&
+                    s.key?('s3_authentication_endpoint')
+                end
+                raise "no such transfer server id: #{params['transfer_server_id']}" if server_data2.nil?
+                # specific one do not have s3 end point in id
+                params['transfer_server_id'] = server_data2['id']
+              end
+              params['storage']['endpoint'] = server_data2['s3_authentication_endpoint'] if !params['storage'].key?('authentication_endpoint')
             end
-            rest_add_header = {'X-ATS-Service-Instance-Id' => instance}
           end
-          ats_ibm_api = ats_api_v2_auth_ibm(rest_add_header)
-          case command
-          when :instances
-            instances = ats_ibm_api.read('instances')
-            Log.log.warn{"more instances remaining: #{instances['remaining']}"} unless instances['remaining'].to_i.eql?(0)
-            return Result::ValueList.new(instances['data'], name: 'instance')
-          when :create
-            created_key = ats_ibm_api.create('api_keys', value_create_modify(command: command, default: {}))
-            return Result::SingleObject.new(created_key)
-          when :list # list known api keys in ATS (this require an api_key ...)
-            res = ats_ibm_api.read('api_keys', {'offset' => 0, 'max_results' => 1000})
-            return Result::ValueList.new(res['data'], name: 'ats_id')
-          when :show # show one of api_key in ATS
-            res = ats_ibm_api.read("api_keys/#{concerned_id}")
-            return Result::SingleObject.new(res)
-          when :delete
-            ats_ibm_api.delete("api_keys/#{concerned_id}")
-            return Result::Status.new("deleted #{concerned_id}")
-          else Aspera.error_unexpected_value(command)
+          res = ats_api.create('access_keys', params)
+          return Result::SingleObject.new(res)
+          # TODO : action : modify, with "PUT"
+        end
+
+        def action_access_key_modify(params:, access_key_id:, **)
+          params['id'] = access_key_id
+          ats_api.update("access_keys/#{access_key_id}", params)
+          return Result::Status.new('modified')
+        end
+
+        def action_access_key_delete(access_key_id:, **)
+          ats_api.delete("access_keys/#{access_key_id}")
+          Result::Status.new("deleted #{access_key_id}")
+        end
+
+        def action_access_key_entitlement(access_key_id:, **)
+          ak = ats_api.read("access_keys/#{access_key_id}")
+          api_bss = Api::Alee.new(ak['license']['entitlement_id'], ak['license']['customer_id'])
+          return Result::SingleObject.new(api_bss.read('entitlement'))
+        end
+
+        # Build the Node plugin for an ATS access key.
+        # access_key_id: is already in ctx via arguments: on the :node command.
+        # @return [Hash] context hash containing :ak_node_plugin and :ak_root_file_id
+        def setup_ak_node(access_key_id:, **)
+          ak_data = ats_api.read("access_keys/#{access_key_id}")
+          server_data = @ats_api_open.all_servers.find{ |i| i['id'].start_with?(ak_data['transfer_server_id'])}
+          Aspera.assert(!server_data.nil?, type: Cli::Error){'no such server found'}
+          node_url = server_data['transfer_setup_url']
+          api_node = Api::Node.new(
+            base_url: node_url,
+            auth:     {
+              type:     :basic,
+              username: access_key_id,
+              password: context.secret_finder.lookup(url: node_url, username: access_key_id)
+            }
+          )
+          {
+            ak_node_plugin:  Node.new(context: context, api: api_node),
+            ak_root_file_id: ak_data['root_file_id']
+          }
+        end
+
+        # One handler per COMMANDS_GEN4 - delegates to the Node plugin's DSL registry.
+        Node::COMMANDS_GEN4.each do |cmd|
+          define_action_method([:access_key, :node, cmd]) do |ak_node_plugin:, ak_root_file_id:, **|
+            # For permission: the handler consumes the path first then re-dispatches to sub-commands.
+            # Calling dispatch_from_registry with skip_setup would bypass path consumption and fail.
+            next ak_node_plugin.send(:"action_access_keys_do_#{cmd}", do_root_file_id: ak_root_file_id) if cmd.eql?(:permission)
+            ak_node_plugin.dispatch_from_registry([:access_keys, :do, cmd], {do_root_file_id: ak_root_file_id}, skip_setup: true)
           end
         end
 
-        ACTIONS = %i[cluster access_key api_key aws_trust_policy].freeze
-
-        # called for legacy and AoC
-        def execute_action
-          actions = ACTIONS.dup
-          actions.delete(:api_key) unless @ats_api_auth.nil?
-          command = options.get_next_command(actions)
-          case command
-          when :cluster # display general ATS cluster information, this uses public API, no auth
-            return execute_action_cluster_open
-          when :access_key
-            return execute_action_access_key
-          when :api_key # manage credential to access ATS API
-            return execute_action_api_key
-          when :aws_trust_policy
-            res = ats_api.read('aws/trustpolicy', {region: options.get_option(:region, mandatory: true)})
-            return Result::SingleObject.new(res)
-          else Aspera.error_unexpected_value(command)
+        def action_api_key_instances
+          instances = ats_api_v2_auth_ibm.read('instances')
+          Log.log.warn{"more instances remaining: #{instances['remaining']}"} unless instances['remaining'].to_i.eql?(0)
+          Result::ValueList.new(instances['data'], name: 'instance')
+        end
+
+        def action_api_key_delete(api_key_id:, **)
+          build_ats_ibm_api_with_instance.delete("api_keys/#{api_key_id}")
+          Result::Status.new("deleted #{api_key_id}")
+        end
+
+        def action_access_key_cluster(access_key_id:, **)
+          ats_url = ats_api.base_url
+          api_ak_auth = Rest.new(
+            base_url: ats_url,
+            auth:     {
+              type:     :basic,
+              username: access_key_id,
+              password: context.secret_finder.lookup(url: ats_url, username: access_key_id)
+            }
+          )
+          return Result::SingleObject.new(api_ak_auth.read('servers'))
+        end
+
+        private
+
+        # Build the IBM Cloud ATS v2 API with an instance header.
+        # Reads instance from options; falls back to first available instance.
+        def build_ats_ibm_api_with_instance
+          instance = options.get_option(:instance)
+          if instance.nil?
+            instance = ats_api_v2_auth_ibm.read('instances')['data'].first
+            formatter.display_status("using first instance: #{instance}")
           end
+          ats_api_v2_auth_ibm({'X-ATS-Service-Instance-Id' => instance})
         end
       end
     end