aspera-cli 4.27.0 → 4.27.1

data/lib/aspera/schema/documentation.rb

@@ -28,7 +28,7 @@ module Aspera
         @agent_columns = agent_columns
         @code_highlight = code_highlight
         @columns = %w[name type description]
-        @columns.insert(-2, *Agent::Factory::ALL.values.map{ |i| i[:short].to_s}.sort) if @agent_columns
+        @columns.insert(-2, *Agent::Factory::ALL.values.map { |i| i[:short].to_s }.sort) if @agent_columns
         # Sections: each entry is {header: row_or_nil, rows: []}
         # A flat schema produces a single section with no header.
         @sections = [{header: nil, rows: []}]
@@ -36,7 +36,7 @@ module Aspera
 
       def rows
         @sections.flat_map do |section|
-          sorted = section[:rows].sort_by{ |i| i['name']}
+          sorted = section[:rows].sort_by { |i| i['name'] }
           section[:header] ? [section[:header]] + sorted : sorted
         end
       end
@@ -47,7 +47,7 @@ module Aspera
       # First row is the titles (for Markdown table generation)
       # @return [Array<Array<String>>]
       def table
-        [@columns] + rows.map{ |row| @columns.map{ |field| row[field]}}
+        [@columns] + rows.map { |row| @columns.map { |field| row[field] } }
       end
 
       # Generate a documentation table from a JSON schema for transfer specifications
@@ -58,9 +58,9 @@ module Aspera
       # @param schema [Reader] The JSON schema to process
       # @return [Documentation]
       def build(schema = nil)
-        code = @code_highlight ? ->(c){"`#{c}`"} : ->(c){c}
+        code = @code_highlight ? ->(c) { "`#{c}`" } : ->(c) { c }
         schema ||= @schema
-        render_title = ->(title){title.gsub(Markdown::FORMATS){@formatter.markdown_text(Regexp.last_match)}}
+        render_title = ->(title) { title.gsub(Markdown::FORMATS) { @formatter.markdown_text(Regexp.last_match) } }
         on_variant = ->(variant_reader, discriminant_property, discriminant_value) do
           title = variant_reader.current['title'] || variant_reader.current['description']
           header =
@@ -80,8 +80,14 @@ module Aspera
         schema.each_property(on_variant: on_variant) do |property_schema, _name, property_full_name|
           node = property_schema.current
           # Manual table
-          item_type = JSON_TYPE_TO_DOC.fetch(node['type'], node['type'])
-          item_type = "#{item_type}[#{JSON_TYPE_TO_DOC.fetch(node.dig('items', 'type'), node.dig('items', 'type'))}]" if node['type'].eql?('array') && node.dig('items', 'type').is_a?(String)
+          item_type =
+            if node['type'].is_a?(Array)
+              node['type'].map { |t| JSON_TYPE_TO_DOC.fetch(t, t) }.join(', ')
+            elsif node['type'].eql?('array') && node.dig('items', 'type').is_a?(String)
+              "#{JSON_TYPE_TO_DOC.fetch(node['type'], node['type'])}[#{JSON_TYPE_TO_DOC.fetch(node.dig('items', 'type'), node.dig('items', 'type'))}]"
+            else
+              JSON_TYPE_TO_DOC.fetch(node['type'], node['type'])
+            end
           item = {
             'name'        => code.call(property_full_name),
             'type'        => code.call(item_type),
@@ -90,7 +96,7 @@ module Aspera
           # Render Markdown formatting and split lines
           item['description'] =
             node['description']
-              .gsub(Markdown::FORMATS){@formatter.markdown_text(Regexp.last_match)}
+              .gsub(Markdown::FORMATS) { @formatter.markdown_text(Regexp.last_match) }
               .split("\n") if node.key?('description')
           item['description'].unshift("DEPRECATED: #{node['x-deprecation']}") if node.key?('x-deprecation')
           # Add flags for supported agents in doc
@@ -98,17 +104,17 @@ module Aspera
           Agent::Factory::ALL.each_key do |sym|
             agents.push(sym) if node['x-agents'].nil? || node['x-agents'].include?(sym.to_s)
           end
-          Aspera.assert(agents.include?(:direct)){"#{property_full_name}: x-cli-option requires agent direct (or nil)"} if node['x-cli-option']
+          Aspera.assert(agents.include?(:direct)) { "#{property_full_name}: x-cli-option requires agent direct (or nil)" } if node['x-cli-option']
           if @agent_columns
             Agent::Factory::ALL.each do |sym, names|
               item[names[:short].to_s] = @formatter.tick(agents.include?(sym))
             end
           else
-            item['description'].push("(#{agents.map{ |i| Agent::Factory::ALL[i][:short].to_s.upcase}.sort.join(', ')})") unless agents.length.eql?(Agent::Factory::ALL.length)
+            item['description'].push("(#{agents.map { |i| Agent::Factory::ALL[i][:short].to_s.upcase }.sort.join(', ')})") unless agents.length.eql?(Agent::Factory::ALL.length)
           end
           # Only keep lines that are usable in supported agents
           next if agents.empty?
-          item['description'].push("Allowed values: #{node['enum'].map{ |v| @formatter.markdown_text("`#{v}`")}.join(', ')}.") if node.key?('enum')
+          item['description'].push("Allowed values: #{node['enum'].map { |v| @formatter.markdown_text("`#{v}`") }.join(', ')}.") if node.key?('enum')
           item['description'].push("Default: #{@formatter.markdown_text("`#{node['default']}`")}.") if node.key?('default')
           item['description'].push("Example: #{@formatter.markdown_text("`#{node['example']}`")}.") if node.key?('example')
           if @include_option

data/lib/aspera/schema/reader.rb

@@ -42,12 +42,12 @@ module Aspera
       def dig(*path)
         current = @current
         path.each do |p|
-          Aspera.assert(current.key?(p)){"schema: #{p} in #{path}"}
+          Aspera.assert(current.key?(p)) { "schema: #{p} in #{path}" }
           current = current[p]
-          Aspera.assert_type(current, Hash){'schema'}
+          Aspera.assert_type(current, Hash) { 'schema' }
           if current.key?('$ref')
             ref = current['$ref']
-            Aspera.assert(ref.start_with?('#/')){"schema $ref must start with '#/': #{ref}"}
+            Aspera.assert(ref.start_with?('#/')) { "schema $ref must start with '#/': #{ref}" }
             current = @root.dig(*ref[2..].split('/'))
           end
         end
@@ -56,7 +56,7 @@ module Aspera
 
       # Resolve a $ref string to a Reader
       def resolve_ref(ref)
-        Aspera.assert(ref.start_with?('#/')){"schema $ref must start with '#/': #{ref}"}
+        Aspera.assert(ref.start_with?('#/')) { "schema $ref must start with '#/': #{ref}" }
         Reader.new(@root, @root.dig(*ref[2..].split('/')))
       end
 
@@ -98,6 +98,15 @@ module Aspera
           end
           return
         end
+        if @current.key?('allOf')
+          # Merge all branches: each branch contributes its properties (no variants)
+          @current['allOf'].each do |branch_node|
+            ref = branch_node['$ref']
+            branch_reader = ref ? resolve_ref(ref) : Reader.new(@root, branch_node)
+            branch_reader.each_property(prefix, on_variant: on_variant, &block)
+          end
+          return
+        end
         properties = dig('properties')
         properties.current.each_key do |name|
           property_full_name = "#{prefix}#{name}"
@@ -117,6 +126,71 @@ module Aspera
               array_item_schema.each_property("#{property_full_name}[].", on_variant: on_variant, &block) if array_item_schema.current['properties']
             end
           end
+          # allOf without explicit type: object — recurse to merge all branches
+          property_schema.each_property("#{property_full_name}.", on_variant: on_variant, &block) if node['allOf']
+        end
+      end
+
+      # Convert this schema to a flat array of field descriptors.
+      # Returns raw semantic fields with no ANSI or formatting, suitable for
+      # JSON/YAML output or MCP consumption. An AI or script can use the result
+      # directly to build a valid payload.
+      #
+      # Each Hash entry contains:
+      #   name        [String]  dot/bracket-path of the field (e.g. "recipients[].name")
+      #   type        [String]  JSON type string (e.g. "string", "boolean", "Array[object]")
+      #   required    [Boolean] true when the field is in its immediate parent's required list
+      #   description [String]  human description (may contain Markdown **bold** / `code`)
+      #   default     [Object]  (optional) default value as native Ruby type
+      #   enum        [Array]   (optional) list of allowed string values
+      #
+      # @return [Array<Hash>]
+      def to_rows
+        rows = []
+        collect_rows(rows, self, '')
+        rows
+      end
+
+      private
+
+      # Recursively collect rows from a schema node, passing each property's own
+      # parent `required` array so that only direct-parent membership is checked.
+      def collect_rows(rows, reader, prefix)
+        return unless reader.current.key?('properties')
+        parent_required = Set.new(Array(reader.current['required']))
+        props_reader = reader.dig('properties')
+        props_reader.current.each_key do |name|
+          prop_reader  = props_reader.dig(name)
+          node         = prop_reader.current
+          full_name    = "#{prefix}#{name}"
+          type_val =
+            if node['type'].is_a?(Array)
+              node['type'].join(', ')
+            elsif node['type'].eql?('array') && node.dig('items', 'type').is_a?(String)
+              "Array[#{node.dig('items', 'type')}]"
+            else
+              node['type'].to_s
+            end
+          row = {
+            'name'        => full_name,
+            'type'        => type_val,
+            'required'    => parent_required.include?(name),
+            'description' => node['description'].to_s
+          }
+          row['default'] = node['default'] if node.key?('default')
+          row['enum']    = node['enum']    if node.key?('enum')
+          rows << row
+          # Recurse into nested object or array-of-objects
+          case node['type']
+          when 'object'
+            collect_rows(rows, prop_reader, "#{full_name}.") if node['properties']
+          when 'array'
+            if node['items']
+              item_reader = prop_reader.dig('items')
+              collect_rows(rows, item_reader, "#{full_name}[].") if item_reader.current['properties']
+            end
+          end
+          collect_rows(rows, prop_reader, "#{full_name}.") if node['allOf']
         end
       end
     end

data/lib/aspera/schema/registry.rb

@@ -18,21 +18,32 @@ module Aspera
           LOCATIONS.key?(sym)
         end
 
+        # Split a component string into registry key and optional path prefix.
+        # Syntax: 'key' or 'key+/prefix' (e.g. 'shares+/api/v1')
+        # @param component [String] registry key with optional '+/prefix'
+        # @return [Array(String, String)] [key, prefix] where prefix may be ''
+        def split_component(component)
+          key, prefix = component.split('+', 2)
+          [key, prefix || '']
+        end
+
         # Get path to request body schema, no check if it exists
-        # @param component [String] registry key (e.g. 'faspex', 'aoc')
-        # @param endpoint  [String] endpoint path without leading slash (e.g. 'packages.post')
+        # @param component [String] registry key, optionally with path prefix (e.g. 'shares+/api/v1')
+        # @param endpoint  [String] endpoint path without leading slash (e.g. 'data/shares.post')
         # @return [String] schema path usable in schema: keyword
         def req_body(component, endpoint)
-          "#{component}:paths./#{endpoint}.requestBody.content.application/json.schema"
+          key, prefix = split_component(component)
+          "#{key}:paths.#{prefix}/#{endpoint}.requestBody.content.application/json.schema"
         end
 
         # Get path to query parameters for a GET endpoint
-        # @param component [String] registry key (e.g. 'faspex', 'aoc')
-        # @param endpoint  [String] resource path without leading slash (e.g. 'packages')
+        # @param component [String] registry key, optionally with path prefix (e.g. 'shares+/api/v1')
+        # @param endpoint  [String] resource path without leading slash (e.g. 'data/shares')
         # @param method    [String] HTTP method (default: 'get')
         # @return [String] schema path usable in query_schema: keyword
         def query_params(component, endpoint, method: 'get')
-          "#{component}:paths./#{endpoint}.#{method}#{QUERY_PARAMS_SUFFIX}"
+          key, prefix = split_component(component)
+          "#{key}:paths.#{prefix}/#{endpoint}.#{method}#{QUERY_PARAMS_SUFFIX}"
         end
       end
 
@@ -43,6 +54,9 @@ module Aspera
         opts:         'aspera/cli/options.schema.yaml',
         aoc:          'aspera/schema/IBM Aspera on Cloud API-0.2.6-enhanced.yaml',
         faspex:       'aspera/schema/IBM Aspera Faspex API-5.0-enhanced.yaml',
+        faspio:       'aspera/schema/IBM Aspera faspio Gateway API-1.0.0.yaml',
+        node:         'aspera/schema/IBM Aspera Node API-4.4.6.yaml',
+        shares:       'aspera/schema/IBM_Aspera_Shares.yaml',
         async_tables: 'aspera/schema/async_tables.yaml'
       }
 
@@ -52,6 +66,9 @@ module Aspera
       SYNC_ARGS = 'args'
       AOC = 'aoc'
       FASPEX = 'faspex'
+      FASPIO = 'faspio'
+      NODE = 'node'
+      SHARES = 'shares+/api/v1'
       ASYNC_TABLES = 'async_tables'
       LOG_OPTIONS             = "#{OPTIONS}:components.schemas.LogOptions"
       DIRECT_AGENT_OPTIONS    = "#{OPTIONS}:components.schemas.DirectAgentOptions"
@@ -62,7 +79,9 @@ module Aspera
       SMTP_OPTIONS            = "#{OPTIONS}:components.schemas.SmtpOptions"
       HTTP_OPTIONS            = "#{OPTIONS}:components.schemas.HttpOptions"
       VAULT_OPTIONS           = "#{OPTIONS}:components.schemas.VaultOptions"
+      VAULT_SECRET            = "#{OPTIONS}:components.schemas.VaultSecret"
       IMAGE_OPTIONS           = "#{OPTIONS}:components.schemas.ImageOptions"
+      OUT_OPTIONS             = "#{OPTIONS}:components.schemas.OutOptions"
       PACKAGE_FOLDER_OPTIONS  = "#{OPTIONS}:components.schemas.PackageFolderOptions"
 
       REQ_BODY = '.requestBody.content.application/json.schema'
@@ -84,7 +103,7 @@ module Aspera
       def reader(name_path)
         name, path = name_path.split(':', 2)
         sym = name.to_sym
-        Aspera.assert(Registry.known?(sym)){"schema: #{sym}"}
+        Aspera.assert(Registry.known?(sym)) { "schema: #{sym}" }
         spec_file = File.join(@main_folder, LOCATIONS[sym])
         @cache[sym] = Yaml.safe_load(File.read(spec_file)) if spec_file.end_with?('.yaml') && !@cache.key?(sym)
         @cache[sym] = JSON.parse(File.read(spec_file)) if spec_file.end_with?('.json') && !@cache.key?(sym)

data/lib/aspera/secret_hider.rb

@@ -52,7 +52,7 @@ module Aspera
       return lambda do |severity, date_time, program_name, msg|
         if msg.is_a?(String) && !@log_secrets
           REGEX_LOG_REPLACES.each do |reg_ex|
-            msg = msg.gsub(reg_ex){"#{Regexp.last_match(:begin)}#{HIDDEN_PASSWORD}#{Regexp.last_match(:end)}"}
+            msg = msg.gsub(reg_ex) { "#{Regexp.last_match(:begin)}#{HIDDEN_PASSWORD}#{Regexp.last_match(:end)}" }
           end
         end
         original_formatter.call(severity, date_time, program_name, msg)
@@ -63,7 +63,7 @@ module Aspera
     # @param value [String] Input string possibly containing a private key
     # @return [String] String with private key replaced by placeholder
     def hide_secrets_in_string(value)
-      return value.gsub(REGEX_LOG_REPLACES.first){"#{Regexp.last_match(:begin)}#{HIDDEN_PASSWORD}#{Regexp.last_match(:end)}"}
+      return value.gsub(REGEX_LOG_REPLACES.first) { "#{Regexp.last_match(:begin)}#{HIDDEN_PASSWORD}#{Regexp.last_match(:end)}" }
     end
 
     # @param keyword [String, Symbol] Key name to check
@@ -74,17 +74,17 @@ module Aspera
       # only Strings can be secrets, not booleans, or hash, arrays
       return false unless keyword.is_a?(String) && value.is_a?(String)
       # those are not secrets
-      return false if KEY_FALSE_POSITIVES.any?{ |f| f.match?(keyword)}
+      return false if KEY_FALSE_POSITIVES.any? { |f| f.match?(keyword) }
       return true if ADDITIONAL_KEYS_TO_HIDE.include?(keyword)
       # check if keyword (name) contains an element that designate it as a secret
-      ALL_SECRETS.any?{ |kw| keyword.include?(kw)}
+      ALL_SECRETS.any? { |kw| keyword.include?(kw) }
     end
 
     # Hides recursively secrets in Hash or Array of Hash
     def deep_remove_secret(obj)
       case obj
       when Array
-        obj.each{ |i| deep_remove_secret(i)}
+        obj.each { |i| deep_remove_secret(i) }
       when Hash
         obj.each do |k, v|
           if secret?(k, v)

data/lib/aspera/ssh.rb

@@ -8,77 +8,110 @@ module Aspera
   # A simple wrapper around Net::SSH
   # executes one command and get its result from stdout
   class Ssh
+    # Raised when the remote command fails or cannot be started
     class Error < Aspera::Error
     end
+    # Regexp matching ecdsa/ecdh-sha2 algorithm names (JRuby workaround)
+    EXCLUDE_ECDSHA2 = /^ecd(sa|h)-sha2/
+
     class << self
-      # HACK: disable some key type
+      # Removes ed25519 keys from the default identity list used by Net::SSH.
+      # Called when the `ed25519` gem is absent or explicitly disabled via
+      # `ASCLI_ENABLE_ED25519=false`.
+      # @return [void]
       def disable_ed25519_keys
         Log.log.debug('Disabling SSH ed25519 user keys')
         old_verbose = $VERBOSE
         $VERBOSE = nil
         Net::SSH::Authentication::Session.class_eval do
           define_method(:default_keys) do
-            %w[.ssh .ssh2].product(%w[rsa dsa ecdsa]).map{"~/#{_1}/id_#{_2}"}.freeze
+            %w[.ssh .ssh2].product(%w[rsa dsa ecdsa]).map { "~/#{_1}/id_#{_2}" }.freeze
           end
           private(:default_keys)
-        end rescue nil
+        end
         $VERBOSE = old_verbose
       end
 
-      # HACK: disable some algorithms
+      # Returns Net::SSH option overrides that exclude all ecdsa/ecdh-sha2 algorithms.
+      # Merge the result into `ssh_options` passed to {Ssh#initialize} to avoid
+      # mutating Net::SSH internal constants.
+      # @return [Hash{Symbol => Array<String>}] `:host_key` and `:kex` filtered lists
+      def no_ecd_sha2_options
+        Log.log.debug('Building SSH options without ecdsa/ecdh-sha2')
+        {
+          host_key: Net::SSH::Transport::Algorithms::ALGORITHMS[:host_key].reject { |a| a.match?(EXCLUDE_ECDSHA2) },
+          kex:      Net::SSH::Transport::Algorithms::ALGORITHMS[:kex].reject {      |a| a.match?(EXCLUDE_ECDSHA2) }
+        }
+      end
+
+      # Mutates Net::SSH internal algorithm lists to remove ecdsa/ecdh-sha2 entries globally.
+      # Kept for backwards compatibility and JRuby usage; prefer {no_ecd_sha2_options} for new code.
+      # @return [void]
       def disable_ecd_sha2_algorithms
-        Log.log.debug('Disabling SSH ecdsa')
-        Net::SSH::Transport::Algorithms::ALGORITHMS.each_value{ |a| a.reject!{ |a| a =~ /^ecd(sa|h)-sha2/}}
-        Net::SSH::KnownHosts::SUPPORTED_TYPE.reject!{ |t| t =~ /^ecd(sa|h)-sha2/}
+        Log.log.debug('Disabling SSH ecdsa (global)')
+        Net::SSH::Transport::Algorithms::ALGORITHMS.each_value { |a| a.reject! { |a| a.match?(EXCLUDE_ECDSHA2) } }
+        Net::SSH::KnownHosts::SUPPORTED_TYPE.reject! { |t| t.match?(EXCLUDE_ECDSHA2) }
       end
     end
-    # ssh_options: same as Net::SSH.start
-    # see: https://net-ssh.github.io/net-ssh/classes/Net/SSH.html#method-c-start
+    # @param host        [String]            remote server address
+    # @param username    [String]            SSH user name
+    # @param ssh_options [Hash{Symbol => Object}] options forwarded to `Net::SSH.start`
+    #   (see {https://net-ssh.github.io/net-ssh/classes/Net/SSH.html#method-c-start Net::SSH.start}).
+    #   Defaults are injected for `:logger`, `:verbose`, and `:use_agent` if absent.
     def initialize(host, username, ssh_options)
       Aspera.assert_type(host, String)
       Aspera.assert_type(username, String)
       Aspera.assert_type(ssh_options, Hash)
+      Aspera.assert_hash_all(ssh_options, Symbol, nil)
       @host = host
       @username = username
       @ssh_options = ssh_options.dup
       @ssh_options[:logger] = Log.log unless @ssh_options.key?(:logger)
       @ssh_options[:verbose] = :warn unless @ssh_options.key?(:verbose)
+      # @ssh_options[:verbose] = :debug
       @ssh_options[:use_agent] = false unless @ssh_options.key?(:use_agent)
-      Log.log.debug{"ssh:#{@username}@#{@host}"}
+      Log.log.debug { "ssh:#{@username}@#{@host}" }
       Log.dump(:ssh_options, @ssh_options)
     end
 
-    # Anything on stderr raises an exception
-    def execute(cmd, input: nil, exception: false)
+    # Executes a single command on the remote host over a new SSH session.
+    # @param cmd   [String]      shell command to execute remotely
+    # @param input [String, nil] data written to the command's stdin, or `nil`
+    # @return [String] concatenated stdout of the remote command
+    # @raise [Error] if the channel cannot be opened or the remote command exits with a non-zero status
+    def execute(cmd, input: nil)
       Aspera.assert_type(cmd, String)
-      Log.log.debug{"cmd=#{cmd}"}
+      Log.log.debug { "cmd=#{cmd}" }
+      # @type response [Array<String>]
       response = []
+      # @type error [Array<String>]
       error = []
+      exit_code = nil
+      # @param session [Net::SSH::Connection::Session]
       Net::SSH.start(@host, @username, @ssh_options) do |session|
-        ssh_channel = session.open_channel do |channel|
-          # prepare stdout processing
-          channel.on_data{ |_chan, data| response.push(data)}
-          # prepare stderr processing, stderr if type = 1
-          channel.on_extended_data do |_chan, _type, data|
-            error.push(data)
-          end
-          channel.on_request('exit-status') do |_ch, data|
+        # @param channel [Net::SSH::Connection::Channel]
+        session.open_channel do |channel|
+          # Register stdout/stderr before exec so no data is missed (e.g. ForceCommand errors)
+          channel.on_data { |_ch, data| response.push(data) }
+          channel.on_extended_data { |_ch, type, data| error.push(data) if type.eql?(1) }
+          # @param data [Net::SSH::Buffer]
+          channel.on_request('exit-status') do |_channel, data|
+            Log.dump(:data, data, level: :trace1)
             exit_code = data.read_long
-            next if exit_code.zero?
-            error_message = "#{cmd}: exit #{exit_code}, #{error.join.chomp}"
-            raise Error, error_message if exception
-            # Happens when windows user hasn't logged in and created home account.
-            error_message += "\nHint: home not created in Windows?" if data.include?('Could not chdir to home directory')
-            Log.log.debug(error_message)
           end
           # send command to SSH channel (execute) cspell: disable-next-line
-          channel.send('cexe'.reverse, cmd){ |_ch, _success| channel.send_data(input) unless input.nil?}
+          channel.send('cexe'.reverse, cmd) do |_ch, success|
+            raise Error, "could not execute command: #{cmd}" unless success
+            channel.send_data(input) unless input.nil?
+          end
         end
-        # wait for channel to finish (command exit)
-        ssh_channel.wait
-        # main SSH session loop
+        # wait for channel to finish and flush the session
         session.loop
       end
+      error_text = error.join
+      hint = error_text.include?('Could not chdir to home directory') ? "\nHint: home not created in Windows?" : ''
+      raise Error, "#{cmd}: exit #{exit_code}, #{error_text.chomp}#{hint}" if exit_code&.nonzero?
+      Log.log.error { "#{error_text}#{hint}" } unless error_text.empty?
       # response as single string
       return response.join
     end

data/lib/aspera/ssl.rb

@@ -13,15 +13,15 @@ module Aspera
       attr_reader :extra_options
 
       def option_list=(options)
-        Aspera.assert_type(options, Array){'ssl_options'}
+        Aspera.assert_type(options, Array) { 'ssl_options' }
         options.each do |opt|
-          Aspera.assert_type(opt, String, Integer){'Expected String or Integer in ssl_options'}
+          Aspera.assert_type(opt, String, Integer) { 'Expected String or Integer in ssl_options' }
           case opt
           when Integer
             @extra_options = opt
           when String
             name = "OP_#{opt.start_with?('-') ? opt[1..] : opt}".upcase
-            Aspera.assert(OpenSSL::SSL.const_defined?(name), type: Cli::BadArgument){"Unknown ssl_option: #{name}, use one of: #{OpenSSL::SSL.constants.grep(/^OP_/).map{ |c| c.to_s.sub(/^OP_/, '')}.join(', ')}"}
+            Aspera.assert(OpenSSL::SSL.const_defined?(name), type: Cli::BadArgument) { "Unknown ssl_option: #{name}, use one of: #{OpenSSL::SSL.constants.grep(/^OP_/).map { |c| c.to_s.sub(/^OP_/, '') }.join(', ')}" }
             if opt.start_with?('-')
               @extra_options &= ~OpenSSL::SSL.const_get(name)
             else

data/lib/aspera/sync/database.rb

@@ -25,7 +25,7 @@ class SqLite3Wrapper
     end
   else
     def execute(sql)
-      db = SQLite3::Database.new(@db_path).tap{ |d| d.results_as_hash = true}
+      db = SQLite3::Database.new(@db_path).tap { |d| d.results_as_hash = true }
       begin
         normalize_rows(db.execute(sql))
       ensure
@@ -46,7 +46,7 @@ class SqLite3Wrapper
   private
 
   def normalize_rows(rows)
-    rows.map{ |r| r.transform_keys(&:to_s)}
+    rows.map { |r| r.transform_keys(&:to_s) }
   end
 end
 

data/lib/aspera/sync/operations.rb

@@ -90,14 +90,14 @@ module Aspera
         def start(sync_info, opt_ts = nil)
           Log.dump(:sync_params_initial, sync_info)
           Aspera.assert_type(sync_info, Hash)
-          Aspera.assert(PARAM_KEYS.any?{ |k| sync_info.key?(k)}, 'At least one of `local` or `sessions` must be present in async parameters', type: Error)
+          Aspera.assert(PARAM_KEYS.any? { |k| sync_info.key?(k) }, 'At least one of `local` or `sessions` must be present in async parameters', type: Error)
           exec_spec = ExecSpec.new(exec: :async)
           if sync_info.key?('local')
             # `conf` format
-            Aspera.assert_type(sync_info['local'], Hash){'local'}
+            Aspera.assert_type(sync_info['local'], Hash) { 'local' }
             remote = sync_info['remote']
-            Aspera.assert_type(remote, Hash){'remote'}
-            Aspera.assert_type(remote['path'], String){'remote path'}
+            Aspera.assert_type(remote, Hash) { 'remote' }
+            Aspera.assert_type(remote['path'], String) { 'remote path' }
             # get transfer spec if possible, and feed back to new structure
             if block_given?
               transfer_spec = yield(direction_sym(sync_info), sync_info['local']['path'], remote['path'])
@@ -125,8 +125,8 @@ module Aspera
             Aspera.assert_type(sync_info['sessions'].first, Hash)
             if block_given?
               sync_info['sessions'].each do |session|
-                Aspera.assert_type(session['local_dir'], String){'local_dir'}
-                Aspera.assert_type(session['remote_dir'], String){'remote_dir'}
+                Aspera.assert_type(session['local_dir'], String) { 'local_dir' }
+                Aspera.assert_type(session['remote_dir'], String) { 'remote_dir' }
                 transfer_spec = yield(direction_sym(session), session['local_dir'], session['remote_dir'])
                 Log.dump(:auth_ts, transfer_spec)
                 transfer_spec.deep_merge!(opt_ts) unless opt_ts.nil?
@@ -155,7 +155,7 @@ module Aspera
 
         # Parse output of asyncadmin
         def parse_status(stdout)
-          Log.log.trace1{"stdout=#{stdout}"}
+          Log.log.trace1 { "stdout=#{stdout}" }
           result = {}
           ids = nil
           stdout.split("\n").each do |line|
@@ -175,7 +175,7 @@ module Aspera
         # @param sync_info [Hash] sync parameters in conf or args format
         # @return [Hash] parsed output of asyncadmin
         def admin_status(sync_info)
-          Aspera.assert(PARAM_KEYS.any?{ |k| sync_info.key?(k)}, 'At least one of `local` or `sessions` must be present in async parameters', type: Error)
+          Aspera.assert(PARAM_KEYS.any? { |k| sync_info.key?(k) }, 'At least one of `local` or `sessions` must be present in async parameters', type: Error)
           arguments = [ASYNC_ADMIN_EXECUTABLE, '--quiet']
           if sync_info.key?('local')
             # `conf` format
@@ -207,7 +207,7 @@ module Aspera
         # @param sync_info [Hash] sync parameters in conf or args format
         # @return [String, nil] Path to "local DB dir", i.e. folder that contains folders that contain `snap.db`
         def local_db_folder(sync_info)
-          Aspera.assert(PARAM_KEYS.any?{ |k| sync_info.key?(k)}, 'At least one of `local` or `sessions` must be present in async parameters', type: Error)
+          Aspera.assert(PARAM_KEYS.any? { |k| sync_info.key?(k) }, 'At least one of `local` or `sessions` must be present in async parameters', type: Error)
           if sync_info.key?('local')
             # `conf` format
             if sync_info.key?('local_db_dir')
@@ -231,7 +231,7 @@ module Aspera
         end
 
         def session_name(sync_info)
-          Aspera.assert(PARAM_KEYS.any?{ |k| sync_info.key?(k)}, 'At least one of `local` or `sessions` must be present in async parameters', type: Error)
+          Aspera.assert(PARAM_KEYS.any? { |k| sync_info.key?(k) }, 'At least one of `local` or `sessions` must be present in async parameters', type: Error)
           if sync_info.key?('local')
             # `conf` format
             return sync_info['name']
@@ -243,7 +243,7 @@ module Aspera
 
         def session_db_file(sync_info)
           db_file = File.join(local_db_folder(sync_info), PRIVATE_FOLDER, session_name(sync_info), ASYNC_DB)
-          Aspera.assert(File.exist?(db_file)){"Database file #{db_file} does not exist"}
+          Aspera.assert(File.exist?(db_file)) { "Database file #{db_file} does not exist" }
           db_file
         end
 
@@ -284,7 +284,7 @@ module Aspera
         # @param option [String] Option to search
         # @return [Array,nil] with path/schema for that option
         def find_option(schema, path, option)
-          if %w[x-cli-option x-cli-short].any?{ |i| schema[i].eql?(option)}
+          if %w[x-cli-option x-cli-short].any? { |i| schema[i].eql?(option) }
             Log.log.debug('Special') if schema['x-cli-special']
             return [path, schema]
           end
@@ -322,7 +322,7 @@ module Aspera
               end
             end
             path, props = find_option(CONF_SCHEMA, [], option)
-            Aspera.assert(!path.nil?){"Option not found: #{option}"}
+            Aspera.assert(!path.nil?) { "Option not found: #{option}" }
             last_key = path.pop
             # navigate in the current result to insert the value
             current = result

data/lib/aspera/temp_file_manager.rb

@@ -3,6 +3,7 @@
 require 'singleton'
 require 'fileutils'
 require 'etc'
+require 'tempfile'
 
 module Aspera
   # create a temp file name for a given folder
@@ -40,7 +41,7 @@ module Aspera
     def delete_file(filepath)
       File.delete(filepath) if @cleanup_on_exit
     rescue => e
-      Log.log.warn{"Problem deleting file: #{filepath}: #{e.message}"}
+      Log.log.warn { "Problem deleting file: #{filepath}: #{e.message}" }
     end
 
     # Call this on process exit
@@ -51,11 +52,16 @@ module Aspera
       @created_files = []
     end
 
-    # Ensure that provided folder exists, or create it, generate a unique filename
+    # Ensure that provided folder exists, or create it, atomically create and reserve a unique file.
+    # The file is created immediately (O_EXCL) to prevent TOCTOU race conditions.
     # @return [String] path to that unique file
     def new_file_path_in_folder(temp_folder, prefix: nil, suffix: nil)
       FileUtils.mkdir_p(temp_folder)
-      new_file = File.join(temp_folder, [prefix, SecureRandom.uuid, suffix].compact.join('-'))
+      basename = [prefix || 'aspera', SecureRandom.uuid].join('-')
+      # Tempfile.new creates the file atomically with O_EXCL; close keeps it on disk
+      tmp = Tempfile.new([basename, suffix ? "-#{suffix}" : ''], temp_folder)
+      tmp.close
+      new_file = tmp.path
       @created_files.push(new_file)
       new_file
     end
@@ -72,6 +78,20 @@ module Aspera
       new_file_path_in_folder(@global_temp, prefix: prefix, suffix: suffix)
     end
 
+    # Generate a unique directory path inside the global temp folder (does NOT create it).
+    # Unlike new_file_path_global, the caller is expected to use the path as a directory.
+    # @return [String] path to a unique (not yet existing) directory
+    def new_dir_path_global(prefix = nil)
+      username =
+        begin
+          Etc.getlogin || Etc.getpwuid(Process.uid).name || 'unknown_user'
+        rescue StandardError
+          'unknown_user'
+        end
+      dir_name = [prefix, username, SecureRandom.uuid].compact.join('-')
+      File.join(@global_temp, dir_name)
+    end
+
     # Garbage collect undeleted files
     def cleanup_expired(temp_folder)
       Dir.entries(temp_folder).each do |name|
@@ -79,7 +99,7 @@ module Aspera
         age_sec = (Time.now - File.stat(file_path).mtime).to_i
         # check age of file, delete too old
         if File.file?(file_path) && (age_sec > FILE_LIST_AGE_MAX_SEC)
-          Log.log.debug{"garbage collecting #{name}"}
+          Log.log.debug { "garbage collecting #{name}" }
           delete_file(file_path)
         end
       end