aspera-cli 4.27.0 → 4.27.2

data/lib/aspera/cli/wizard.rb

@@ -2,25 +2,22 @@
 
 require 'aspera/oauth/jwt'
 require 'aspera/assert'
+require 'aspera/cli/option_declarator'
 require 'aspera/cli/plugins/factory'
 
 module Aspera
   module Cli
     # The wizard detects applications and generates a config
     class Wizard
+      extend OptionDeclarator
+
       WIZARD_RESULT_KEYS = %i[preset_value test_args].freeze
       DEFAULT_PRIV_KEY_FILENAME = 'my_private_key.pem' # pragma: allowlist secret
       private_constant :WIZARD_RESULT_KEYS, :DEFAULT_PRIV_KEY_FILENAME
 
-      class << self
-        # Declare all wizard CLI options (metadata only - no handler binding yet).
-        # @param options [Aspera::Cli::Parser]
-        def declare_options(options)
-          options.declare(:override,  description: 'Wizard: override existing value',                                                    allowed: Allowed::TYPES_BOOLEAN, default: false)
-          options.declare(:default,   description: 'Wizard: set as default configuration for specified plugin (also: update)',           allowed: Allowed::TYPES_BOOLEAN, default: true)
-          options.declare(:key_path,  description: 'Wizard: path to private key for JWT')
-        end
-      end
+      option :override, description: 'Wizard: override existing value',                                          allowed: Type::BOOLEAN, default: false
+      option :default,  description: 'Wizard: set as default configuration for specified plugin (also: update)', allowed: Type::BOOLEAN, default: true
+      option :key_path, description: 'Wizard: path to private key for JWT'
 
       def initialize(parent, main_folder)
         @parent = parent
@@ -42,7 +39,7 @@ module Aspera
       end
 
       def check_email(email)
-        Aspera.assert(email =~ /\A[\w+\-.]+@[a-z\d\-.]+\.[a-z]+\z/i, type: ParameterError){"Username shall be an email: #{email}"}
+        Aspera.assert(email =~ /\A[\w+\-.]+@[a-z\d\-.]+\.[a-z]+\z/i, type: ParameterError) { "Username shall be an email: #{email}" }
       end
 
       # Find a plugin, and issue the "require"
@@ -62,14 +59,14 @@ module Aspera
           next unless plugin_klass.respond_to?(:detect)
           detection_info = nil
           begin
-            Log.log.debug{"detecting #{plugin_name_sym} at #{app_url}"}
+            Log.log.debug { "detecting #{plugin_name_sym} at #{app_url}" }
             RestParameters.instance.spinner_cb.call(plugin_name_sym.to_s)
             detection_info = plugin_klass.detect(app_url)
           rescue OpenSSL::SSL::SSLError => e
             Log.log.warn(e.message)
             Log.log.warn('Use option --insecure=yes to allow unchecked certificate') if e.message.include?('cert')
           rescue StandardError => e
-            Log.log.debug{"detect error: [#{e.class}] #{e}"}
+            Log.log.debug { "detect error: [#{e.class}] #{e}" }
             next
           end
           next if detection_info.nil?
@@ -80,8 +77,8 @@ module Aspera
           found_apps.push({product: plugin_name_sym, name: app_name, url: app_url, version: 'unknown'}.merge(detection_info))
         end
         RestParameters.instance.spinner_cb.call(action: :success)
-        Aspera.assert(!found_apps.empty?){"No known application found at #{app_url}"}
-        Aspera.assert(found_apps.all?{ |a| a.keys.all?(Symbol)}, 'all app info keys must be symbols')
+        Aspera.assert(!found_apps.empty?) { "No known application found at #{app_url}" }
+        Aspera.assert(found_apps.all? { |a| a.keys.all?(Symbol) }, 'all app info keys must be symbols')
         return found_apps
       end
 
@@ -125,14 +122,14 @@ module Aspera
       # @param apps [Array] list of detected apps
       def find(apps, preset_name: '')
         identification = if apps.length.eql?(1)
-          Log.log.debug{"Detected: #{identification}"}
+          Log.log.debug { "Detected: #{identification}" }
           apps.first
         else
           formatter.display_status('Multiple applications detected, please select from:')
           require 'aspera/cli/result'
           formatter.display_results(Result::ObjectList.new(apps, fields: %w[product url version]))
-          answer = options.prompt_user_input_in_list('product', apps.map{ |a| a[:product]})
-          apps.find{ |a| a[:product].eql?(answer)}
+          answer = options.prompt_user_input_in_list('product', apps.map { |a| a[:product] })
+          apps.find { |a| a[:product].eql?(answer) }
         end
         wiz_preset_name = preset_name
         Log.dump(:identification, identification)
@@ -142,11 +139,11 @@ module Aspera
         options.add_option_preset({url: wiz_url}, 'wizard')
         # Instantiate plugin: command line options will be known, e.g. private_key, and wizard can be called
         plugin_instance = Plugins::Factory.instance.plugin_class(identification[:product]).new(context: @parent.context)
-        Aspera.assert(plugin_instance.respond_to?(:wizard), type: Cli::BadArgument){"Detected: #{identification[:product]}, but this application has no wizard"}
+        Aspera.assert(plugin_instance.respond_to?(:wizard), type: Cli::BadArgument) { "Detected: #{identification[:product]}, but this application has no wizard" }
         # Call the wizard
         wizard_result = plugin_instance.wizard(self, wiz_url)
-        Log.log.debug{"wizard result: #{wizard_result}"}
-        Aspera.assert(WIZARD_RESULT_KEYS.eql?(wizard_result.keys.sort)){"missing or extra keys in wizard result: #{wizard_result.keys}"}
+        Log.log.debug { "wizard result: #{wizard_result}" }
+        Aspera.assert(WIZARD_RESULT_KEYS.eql?(wizard_result.keys.sort)) { "missing or extra keys in wizard result: #{wizard_result.keys}" }
         # Get preset name from user or default
         if wiz_preset_name.empty?
           elements = [

data/lib/aspera/colors.rb

@@ -52,9 +52,9 @@ class String
           0 # by default reset all
         end
       )
-      define_method(name){"#{begin_seq}#{self}#{end_seq}"}
+      define_method(name) { "#{begin_seq}#{self}#{end_seq}" }
     else
-      define_method(name){self}
+      define_method(name) { self }
     end
   end
 
@@ -62,7 +62,7 @@ class String
   # @param colors [Array<Symbol>] List of decorations.
   # @return [String] Enhanced String.
   def apply(*colors)
-    colors.reduce(self){ |s, c| s.public_send(c)}
+    colors.reduce(self) { |s, c| s.public_send(c) }
   end
 
   # Transform capitalized to snake case

data/lib/aspera/command_line_builder.rb

@@ -62,16 +62,17 @@ module Aspera
       # @param ascp [Boolean] `true` if `ascp`
       # @return [Schema::Reader] The JSON schema
       def validate_schema(schema, ascp: false)
-        Aspera.assert_type(schema, Schema::Reader){'schema'}
-        Aspera.assert(schema.current.key?('properties')){"Schema must have 'properties': #{schema}"}
+        Aspera.assert_type(schema, Schema::Reader) { 'schema' }
+        Aspera.assert(schema.current.key?('properties')) { "Schema must have 'properties': #{schema}" }
         schema.each_property do |property_schema, name, _full_name|
           node = property_schema.current
           unsupported_keys = node.keys - PROPERTY_KEYS
-          Aspera.assert(unsupported_keys.empty?){"Unsupported definition keys: #{unsupported_keys}"}
-          Aspera.assert(node.key?('type') || node.key?('enum')){"Missing type for #{name} in #{schema.current.dig('description').current}"}
-          Aspera.assert(node['type'].eql?('boolean')){"switch must be bool: #{name}"} if node['x-cli-switch'] && !node['x-cli-special']
+          Aspera.assert(unsupported_keys.empty?) { "Unsupported definition keys: #{unsupported_keys}" }
+          Aspera.assert(node.key?('type') || node.key?('enum')) { "Missing type for #{name} in #{schema.current.dig('description').current}" }
+          Aspera.assert(node['type'].eql?('boolean')) { "switch must be bool: #{name}" } if node['x-cli-switch'] && !node['x-cli-special']
+          Aspera.assert(node['x-cli-switch']) { "boolean direct option must have x-cli-switch: #{name}" } if node['type'].eql?('boolean') && node.key?('x-cli-option') && supported_by_agent(:direct, node) && !node['x-cli-special']
           node['x-cli-option'] = "--#{name.to_s.tr('_', '-')}" if node['x-cli-option'].eql?(true) || (node['x-cli-switch'].eql?(true) && !node.key?('x-cli-option'))
-          Aspera.assert(DIRECT_PROPERTIES.any?{ |i| node.key?(i)}, name, type: :warn) if ascp && supported_by_agent(:direct, node)
+          Aspera.assert(DIRECT_PROPERTIES.any? { |i| node.key?(i) }, name, type: :warn) if ascp && supported_by_agent(:direct, node)
           node.freeze
         end
         schema
@@ -104,7 +105,7 @@ module Aspera
       Log.dump(:exec_spec, @result)
       # warn about non translated arguments
       @object.each_pair do |name, value|
-        Log.log.warn{"Unknown transfer spec parameter: #{name} = \"#{value}\""} unless @processed_parameters.include?(name)
+        Log.log.warn { "Unknown transfer spec parameter: #{name} = \"#{value}\"" } unless @processed_parameters.include?(name)
       end
       # set result
       exec_spec.env.merge!(@result.env)
@@ -116,7 +117,7 @@ module Aspera
     def add_command_line_options(*options)
       options = options.first if options.first.is_a?(Array) && options.length.eql?(1)
       Aspera.assert_type(options, Array)
-      options.each{ |o| @result.args.push(o.to_s)}
+      options.each { |o| @result.args.push(o.to_s) }
     end
 
     def process_params
@@ -138,11 +139,11 @@ module Aspera
       properties = @schema['properties'][name]
       # should not happen
       if properties.nil?
-        Log.log.warn{"Unknown parameter #{name}"}
+        Log.log.warn { "Unknown parameter #{name}" }
         return
       end
       # check mandatory parameter (nil is valid value), TODO: change exception ?
-      Aspera.assert(!(@schema['required']&.include?(name) && !properties['x-cli-special'] && !@object.key?(name)), type: Transfer::Error){"Missing mandatory parameter: #{name}"}
+      Aspera.assert(!(@schema['required']&.include?(name) && !properties['x-cli-special'] && !@object.key?(name)), type: Transfer::Error) { "Missing mandatory parameter: #{name}" }
       parameter_value = @object[name]
       # no default setting
       # parameter_value=properties['default'] if parameter_value.nil? and properties.has_key?('default')
@@ -155,7 +156,7 @@ module Aspera
           when 'object' then [Hash]
           when 'integer' then [Integer]
           when 'boolean' then [TrueClass, FalseClass]
-          else Aspera.error_unexpected_value(properties['type']){"Property #{name}"}
+          else Aspera.error_unexpected_value(properties['type']) { "Property #{name}" }
           end
         end.flatten
       # check that value is of expected type
@@ -168,7 +169,7 @@ module Aspera
       return if parameter_value.nil?
 
       # check that value is of an accepted type (string, integer, boolean)
-      Aspera.assert(!(properties.key?('enum') && !properties['enum'].include?(parameter_value))){"Enum value #{parameter_value} is not allowed for #{name}"}
+      Aspera.assert(!(properties.key?('enum') && !properties['enum'].include?(parameter_value))) { "Enum value #{parameter_value} is not allowed for #{name}" }
 
       # convert some values if value on command line needs processing from value in structure
       if (convert = properties['x-cli-convert'])
@@ -176,9 +177,9 @@ module Aspera
           case convert
           when Hash then convert[parameter_value]
           when String then @convert.send(convert, parameter_value)
-          else Aspera.error_unexpected_value(convert){"Conversion type for #{name} is Hash or String only."}
+          else Aspera.error_unexpected_value(convert) { "Conversion type for #{name} is Hash or String only." }
           end
-        Aspera.assert(!converted_value.nil?){"No conversion for: #{name}=#{parameter_value}"}
+        Aspera.assert(!converted_value.nil?) { "No conversion for: #{name}=#{parameter_value}" }
         parameter_value = converted_value
       end
 
@@ -199,14 +200,14 @@ module Aspera
           add_command_line_options(properties['x-cli-option'])
         when false
           add_command_line_options(properties['x-cli-false']) if properties.key?('x-cli-false')
-        else Aspera.error_unexpected_value(parameter_value){name}
+        else Aspera.error_unexpected_value(parameter_value) { name }
         end
       else
         # transform into command line option with value
         # parameter_value=parameter_value.to_s if parameter_value.is_a?(Integer)
         parameter_value = [parameter_value] unless parameter_value.is_a?(Array)
         # if transfer_spec value is an array, applies option many times
-        parameter_value.each{ |v| add_command_line_options(properties['x-cli-option'], v)}
+        parameter_value.each { |v| add_command_line_options(properties['x-cli-option'], v) }
       end
     end
   end

data/lib/aspera/command_line_converter.rb

@@ -19,7 +19,7 @@ module Aspera
         case value
         when 'yes' then return true
         when 'no' then return false
-        else Aspera.error_unexpected_value(value){'only: yes or no: '}
+        else Aspera.error_unexpected_value(value) { 'only: yes or no: ' }
         end
       end
 

data/lib/aspera/coverage.rb

@@ -27,12 +27,11 @@ if ENV.key?('ENABLE_COVERAGE')
     # assert usually do not trigger
     add_filter do |source_file|
       source_file.lines.each do |line|
-        line.skipped! if no_cov_functions.any?{ |i| line.src.include?(i)}
+        line.skipped! if no_cov_functions.any? { |i| line.src.include?(i) }
       end
       false
     end
     # no coverage in these files
-    add_filter 'lib/aspera/cli/plugins/faspex.rb'
     add_filter 'lib/aspera/node_simulator.rb'
     add_filter 'lib/aspera/keychain/macos_security.rb'
     add_filter 'lib/aspera/assert.rb'

data/lib/aspera/data_repository.rb

@@ -24,7 +24,7 @@ module Aspera
     # @return [String] decoded data
     def item(name)
       index = ELEMENTS.index(name)
-      Aspera.assert(index, type: ParameterError){"Unknown data item #{name} (#{name.class})"}
+      Aspera.assert(index, type: ParameterError) { "Unknown data item #{name} (#{name.class})" }
       raw_data = data(START_INDEX + index)
       case name
       when :dsa, :rsa

data/lib/aspera/dot_container.rb

@@ -14,7 +14,7 @@ module Aspera
       def dotted_to_container(path, value, result = nil)
         Aspera.assert_array_all(path, String)
         # Typed keys
-        keys = path.map{ |k| int_or_string(k)}
+        keys = path.map { |k| int_or_string(k) }
         # Create, or re-use first level container
         current = (result ||= new_hash_or_array_from_key(keys.first))
         # walk the path, and create sub-containers if necessary
@@ -73,19 +73,19 @@ module Aspera
             add_elements(path, current)
           when Array
             # Array has no nested structures: list of Strings
-            if current.none?{ |i| i.is_a?(Array) || i.is_a?(Hash)}
+            if current.none? { |i| i.is_a?(Array) || i.is_a?(Hash) }
               to_insert = current.map(&:to_s)
             # Array of Hashes with only 'name' keys: list of Strings
-            elsif current.all?{ |i| i.is_a?(Hash) && i.keys == ['name']}
-              to_insert = current.map{ |i| i['name']}
+            elsif current.all? { |i| i.is_a?(Hash) && i.keys == ['name'] }
+              to_insert = current.map { |i| i['name'] }
             # Array of Hashes with only 'name' and 'value' keys: Hash of key/values
-            elsif current.all?{ |i| i.is_a?(Hash) && i.key?('name') && i.key?('value') && i.length <= 3}
+            elsif current.all? { |i| i.is_a?(Hash) && i.key?('name') && i.key?('value') && i.length <= 3 }
               # if there is an extra key, other than 'name' and 'value', insert that key as is
-              add_elements(path, current.flat_map{ |h| h.except('name', 'value').to_a})
+              add_elements(path, current.flat_map { |h| h.except('name', 'value').to_a })
               # Insert name/value pairs as Hash
-              add_elements(path, current.to_h{ |h| h.values_at('name', 'value')})
+              add_elements(path, current.to_h { |h| h.values_at('name', 'value') })
             else
-              add_elements(path, current.each_with_index.map{ |v, i| [i, v]})
+              add_elements(path, current.each_with_index.map { |v, i| [i, v] })
             end
           else
             to_insert = current

data/lib/aspera/environment.rb

@@ -118,11 +118,11 @@ module Aspera
       def secure_execute(*cmd, mode: :execute, **kwargs)
         cmd = cmd.map(&:to_s)
         Aspera.assert(cmd.size.positive?, 'executable must be present', type: ArgumentError)
-        Aspera.assert_values(mode, PROCESS_MODES, type: ArgumentError){'mode'}
+        Aspera.assert_values(mode, PROCESS_MODES, type: ArgumentError) { 'mode' }
         Log.log.debug do
           parts = [mode.to_s, 'command:']
-          kwargs[:env]&.each{ |k, v| parts << "#{k}=#{shell_escape_pretty(v.to_s)}"}
-          cmd.each{ |a| parts << shell_escape_pretty(a)}
+          kwargs[:env]&.each { |k, v| parts << "#{k}=#{shell_escape_pretty(v.to_s)}" }
+          cmd.each { |a| parts << shell_escape_pretty(a) }
           parts.join(' ')
         end
         case mode
@@ -142,7 +142,7 @@ module Aspera
           # https://docs.ruby-lang.org/en/master/Open3.html#method-c-capture3
           # https://docs.ruby-lang.org/en/master/Process.html#module-Process-label-Execution+Options
           argv = [kwargs.delete(:env)].compact + cmd
-          exception = kwargs.delete(:exception){true}
+          exception = kwargs.delete(:exception) { true }
           result = Open3.capture3(*argv, **kwargs)
           Log.dump(:stdout, result[0], level: :trace1)
           Log.dump(:stderr, result[1], level: :trace1)
@@ -182,7 +182,7 @@ module Aspera
           elsif File.directory?(path)
             mode = 0o700
           else
-            Log.log.debug{"No restriction can be set for #{path}"}
+            Log.log.debug { "No restriction can be set for #{path}" }
           end
         end
         File.chmod(mode, path) unless mode.nil?
@@ -198,7 +198,7 @@ module Aspera
 
       # force locale to C so that unicode characters are not used
       def force_terminal_c
-        I18N_VARS.each{ |var| ENV[var] = 'C'}
+        I18N_VARS.each { |var| ENV[var] = 'C' }
       end
 
       # @return [Boolean] true if we can display Unicode characters
@@ -208,7 +208,7 @@ module Aspera
       # https://pubs.opengroup.org/onlinepubs/7908799/xbd/envvar.html
       def terminal_supports_unicode?
         return false unless terminal?
-        locale_charmap_utf8? || I18N_VARS.any?{ |var| ENV[var]&.include?('UTF-8')}
+        locale_charmap_utf8? || I18N_VARS.any? { |var| ENV[var]&.include?('UTF-8') }
       end
 
       private
@@ -237,11 +237,11 @@ module Aspera
           OS_WINDOWS
         when /darwin/, /mac os/
           OS_MACOS
-        when /linux/
+        when /linux/, /cosmo/
           OS_LINUX
         when /aix/
           OS_AIX
-        else Aspera.error_unexpected_value(RbConfig::CONFIG['host_os']){'host_os'}
+        else Aspera.error_unexpected_value(RbConfig::CONFIG['host_os']) { 'host_os' }
         end
       @cpu =
         case RbConfig::CONFIG['host_cpu']
@@ -253,7 +253,7 @@ module Aspera
           CPU_S390
         when /arm/, /aarch64/
           CPU_ARM64
-        else Aspera.error_unexpected_value(RbConfig::CONFIG['host_cpu']){'host_cpu'}
+        else Aspera.error_unexpected_value(RbConfig::CONFIG['host_cpu']) { 'host_cpu' }
         end
       @executable_extension = @os.eql?(OS_WINDOWS) ? '.exe' : nil
       # :text or :graphical depending on the environment
@@ -289,7 +289,7 @@ module Aspera
     def fix_home
       return unless @os.eql?(OS_WINDOWS) && ENV.key?('USERPROFILE') && Dir.exist?(ENV.fetch('USERPROFILE', nil))
       ENV['HOME'] = ENV.fetch('USERPROFILE', nil)
-      Log.log.debug{"Windows: set HOME to USERPROFILE: #{Dir.home}"}
+      Log.log.debug { "Windows: set HOME to USERPROFILE: #{Dir.home}" }
       nil
     end
 
@@ -305,7 +305,7 @@ module Aspera
       when Environment::OS_MACOS then self.class.secure_execute('open', uri.to_s)
       when Environment::OS_WINDOWS then self.class.secure_execute('start', 'explorer', %Q{"#{uri}"})
       when Environment::OS_LINUX   then self.class.secure_execute('xdg-open', uri.to_s)
-      else Aspera.error_unexpected_value(os){'no graphical open method'}
+      else Aspera.error_unexpected_value(os) { 'no graphical open method' }
       end
       nil
     end
@@ -336,7 +336,7 @@ module Aspera
         else
           puts "USER ACTION: open this:\n#{the_url.to_s.red}\n"
         end
-      else Aspera.error_unexpected_value(@url_method){'URL open method'}
+      else Aspera.error_unexpected_value(@url_method) { 'URL open method' }
       end
     end
 

data/lib/aspera/faspex_gw.rb

@@ -44,7 +44,7 @@ module Aspera
       package_data = {
         'title'      => faspex_pkg_delivery['title'],
         'note'       => faspex_pkg_delivery['note'],
-        'recipients' => faspex_pkg_delivery['recipients'].map{ |name| {'name'=>name}}
+        'recipients' => faspex_pkg_delivery['recipients'].map { |name| {'name'=>name} }
       }
       package = @app_api.create('packages', package_data)
       # TODO: option to send from remote source or httpgw
@@ -70,7 +70,7 @@ module Aspera
         begin
           Aspera.assert(!request.body.nil?, 'payload missing')
           faspex_pkg_parameters = JSON.parse(request.body)
-          Log.log.debug{"faspex pkg create parameters=#{faspex_pkg_parameters}"}
+          Log.dump(:faspex_pkg_parameters, faspex_pkg_parameters)
           # compare string, as class is not yet known here
           faspex_package_create_result =
             case @app_api.class.name
@@ -80,7 +80,7 @@ module Aspera
               faspex4_send_to_faspex5(faspex_pkg_parameters)
             else Aspera.error_unexpected_value(@app_api.class.name)
             end
-          Log.log.debug{"faspex_package_create_result=#{faspex_package_create_result}"}
+          Log.dump(:faspex_package_create_result, faspex_package_create_result)
           response.status = 200
           response.content_type = Mime::JSON
           response.body = JSON.generate(faspex_package_create_result)
@@ -89,7 +89,7 @@ module Aspera
           response['Content-Type'] = Mime::JSON
           response.body = {error: e.message, stacktrace: e.backtrace}.to_json
           Log.log.error(e.message)
-          Log.log.debug{e.backtrace.join("\n")}
+          Log.log.debug { e.backtrace.join("\n") }
         end
       else
         response.status = 400

data/lib/aspera/faspex_postproc.rb

@@ -16,18 +16,18 @@ module Aspera
       @parameters = parameters.symbolize_keys
       Log.dump(:post_proc_parameters, @parameters)
       not_allowed = @parameters.keys - ALLOWED_PARAMETERS
-      Aspera.assert(not_allowed.empty?){"unsupported parameters: #{not_allowed.join(', ')}"}
+      Aspera.assert(not_allowed.empty?) { "unsupported parameters: #{not_allowed.join(', ')}" }
       @parameters[:script_folder] ||= '.'
       @parameters[:fail_on_error] ||= false
       @parameters[:timeout_seconds] ||= 60
       super(server)
-      Log.log.debug{'Faspex4PostProcServlet initialized'}
+      Log.log.debug { 'Faspex4PostProcServlet initialized' }
     end
 
     # :reek:UncommunicativeMethodName
     def do_POST(request, response)
-      Log.log.debug{"request=#{request.path}"}
-      Log.log.debug{"query=#{request.query}"}
+      Log.log.debug { "request=#{request.path}" }
+      Log.dump(:query, request.query)
       begin
         # Only accept requests on the root
         if !request.path.start_with?(@parameters[:root])
@@ -44,9 +44,14 @@ module Aspera
         end
         # build script path by removing domain and adding script folder
         script_file = request.path[@parameters[:root].size..]
-        Log.log.debug{"script file=#{script_file}"}
+        Log.log.debug { "script file=#{script_file}" }
         script_path = File.join(@parameters[:script_folder], script_file)
-        Log.log.debug{"script=#{script_path}"}
+        # Resolve the real path and ensure it stays within script_folder (prevents path traversal)
+        resolved_script_folder = File.realpath(@parameters[:script_folder])
+        resolved_script_path = File.realpath(script_path)
+        Aspera.assert(resolved_script_path.start_with?("#{resolved_script_folder}/")) { 'Script path traversal attempt detected' }
+        script_path = resolved_script_path
+        Log.log.debug { "script=#{script_path}" }
         webhook_parameters = JSON.parse(request.body)
         Log.dump(:webhook_parameters, webhook_parameters)
         process_status = nil
@@ -55,7 +60,7 @@ module Aspera
           Environment.secure_eval(File.read(script_path), __FILE__, __LINE__).call(webhook_parameters)
         else
           # env expects only strings
-          environment = webhook_parameters.each_with_object({}){ |(k, v), h| h[k] = v.to_s}
+          environment = webhook_parameters.each_with_object({}) { |(k, v), h| h[k] = v.to_s }
           post_proc_pid = Environment.secure_execute(script_path, mode: :background, env: environment)
           Timeout.timeout(@parameters[:timeout_seconds]) do
             # "wait" for process to avoid zombie
@@ -63,12 +68,12 @@ module Aspera
             post_proc_pid = nil
           end
           process_status = $CHILD_STATUS
-          Aspera.assert(process_status.success? || !@parameters[:fail_on_error]){"script #{script_path} failed with code #{process_status.exitstatus}"}
+          Aspera.assert(process_status.success? || !@parameters[:fail_on_error]) { "script #{script_path} failed with code #{process_status.exitstatus}" }
         end
         response.status = 200
         response.content_type = Mime::JSON
         response.body = JSON.generate({status: 'success', script: script_path, exit_code: process_status&.exitstatus})
-        Log.log.debug{'Script executed successfully'}
+        Log.log.debug { 'Script executed successfully' }
       rescue => e
         Log.log.error("Script failed: #{e.class}:#{e.message}")
         if !post_proc_pid.nil?

data/lib/aspera/graphql.rb

@@ -21,14 +21,16 @@ module Aspera
         query = load_query(name)
         response = rest.create(nil, {query: query, variables: variables})
         errors = response['errors']
-        raise RestCallError, errors.map{ |e| e['message']}.join("\n") if errors.is_a?(Array) && !errors.empty?
+        raise RestCallError, errors.map { |e| e['message'] }.join("\n") if errors.is_a?(Array) && !errors.empty?
         response['data']
       end
 
       private
 
       def load_query(name)
-        File.read(File.join(QUERIES_FOLDER, "#{name}.graphql"))
+        candidate = File.realpath(File.join(QUERIES_FOLDER, "#{name}.graphql"))
+        Aspera.assert(candidate.start_with?("#{QUERIES_FOLDER}/")) { "Invalid GraphQL query name: #{name}" }
+        File.read(candidate)
       end
     end
   end

data/lib/aspera/hash_ext.rb

@@ -5,14 +5,14 @@ class ::Hash
   # @param second [Hash] Hash to merge into self
   # @return [Hash] New merged hash
   def deep_merge(second)
-    merge(second){ |_key, v1, v2| v1.is_a?(Hash) && v2.is_a?(Hash) ? v1.deep_merge(v2) : v2}
+    merge(second) { |_key, v1, v2| v1.is_a?(Hash) && v2.is_a?(Hash) ? v1.deep_merge(v2) : v2 }
   end
 
   # Recursively merge another hash in-place, with nested hashes merged deeply
   # @param second [Hash] Hash to merge into self
   # @return [Hash] self
   def deep_merge!(second)
-    merge!(second){ |_key, v1, v2| v1.is_a?(Hash) && v2.is_a?(Hash) ? v1.deep_merge!(v2) : v2}
+    merge!(second) { |_key, v1, v2| v1.is_a?(Hash) && v2.is_a?(Hash) ? v1.deep_merge!(v2) : v2 }
   end
 
   # Recursively iterate through hash and execute block on leaf values

data/lib/aspera/json_rpc/client.rb

@@ -44,7 +44,7 @@ module Aspera
           params:  args,
           id:      @request_id += 1
         })
-        Aspera.assert_type(data, Hash){'response'}
+        Aspera.assert_type(data, Hash) { 'response' }
         Aspera.assert(data['jsonrpc'] == VERSION, 'bad version in response')
         Aspera.assert(data.key?('id'), 'missing id in response')
         Aspera.assert(!(data.key?('error') && data.key?('result')), 'both error and response')

data/lib/aspera/keychain/base.rb

@@ -4,12 +4,19 @@ module Aspera
   module Keychain
     class Base
       CONTENT_KEYS = %i[label username password url description].freeze
+
+      # Returns a lightweight list: one Hash per secret with :label (and :id if the backend has one).
+      # Override in subclasses that can provide this cheaply without fetching full item details.
+      def ids
+        all.map { |s| s.slice(:id, :label).compact }
+      end
+
       def validate_set(options)
-        Aspera.assert_type(options, Hash){'options'}
+        Aspera.assert_type(options, Hash) { 'options' }
         unsupported = options.keys - CONTENT_KEYS
-        Aspera.assert(unsupported.empty?){"unsupported options: #{unsupported}, use #{CONTENT_KEYS.join(', ')}"}
+        Aspera.assert(unsupported.empty?) { "unsupported options: #{unsupported}, use #{CONTENT_KEYS.join(', ')}" }
         options.each_pair do |k, v|
-          Aspera.assert_type(v, String){k.to_s}
+          Aspera.assert_type(v, String) { k.to_s }
         end
         Aspera.assert(options.key?(:label), 'label is required')
       end