aspera-cli 4.27.2 → 4.27.4

data/lib/aspera/cli/wizard.rb

@@ -4,6 +4,8 @@ require 'aspera/oauth/jwt'
 require 'aspera/assert'
 require 'aspera/cli/option_declarator'
 require 'aspera/cli/plugins/factory'
+require 'aspera/rainbow'
+using Rainbow
 
 module Aspera
   module Cli
@@ -15,6 +17,7 @@ module Aspera
       DEFAULT_PRIV_KEY_FILENAME = 'my_private_key.pem' # pragma: allowlist secret
       private_constant :WIZARD_RESULT_KEYS, :DEFAULT_PRIV_KEY_FILENAME
 
+      # Declared by the `config` plugin (`use_options Wizard`)
       option :override, description: 'Wizard: override existing value',                                          allowed: Type::BOOLEAN, default: false
       option :default,  description: 'Wizard: set as default configuration for specified plugin (also: update)', allowed: Type::BOOLEAN, default: true
       option :key_path, description: 'Wizard: path to private key for JWT'
@@ -22,7 +25,6 @@ module Aspera
       def initialize(parent, main_folder)
         @parent = parent
         @main_folder = main_folder
-        self.class.declare_options(options)
       end
 
       # @return [Boolean] false if in test mode to avoid interactive input
@@ -60,7 +62,7 @@ module Aspera
           detection_info = nil
           begin
             Log.log.debug { "detecting #{plugin_name_sym} at #{app_url}" }
-            RestParameters.instance.spinner_cb.call(plugin_name_sym.to_s)
+            Rest::Parameters.instance.spinner_cb.call(plugin_name_sym.to_s)
             detection_info = plugin_klass.detect(app_url)
           rescue OpenSSL::SSL::SSLError => e
             Log.log.warn(e.message)
@@ -76,7 +78,7 @@ module Aspera
           # If there is a redirect, then the detector can override the url.
           found_apps.push({product: plugin_name_sym, name: app_name, url: app_url, version: 'unknown'}.merge(detection_info))
         end
-        RestParameters.instance.spinner_cb.call(action: :success)
+        Rest::Parameters.instance.spinner_cb.call(action: :success)
         Aspera.assert(!found_apps.empty?) { "No known application found at #{app_url}" }
         Aspera.assert(found_apps.all? { |a| a.keys.all?(Symbol) }, 'all app info keys must be symbols')
         return found_apps

data/lib/aspera/coverage.rb

@@ -4,6 +4,7 @@
 if ENV.key?('ENABLE_COVERAGE')
   require 'simplecov'
   require 'securerandom'
+  require 'fileutils'
   # compute development top folder based on this source location
   development_root = File.dirname(File.realpath(__FILE__), 3)
   coverage_dir = 'tmp/coverage'
@@ -32,7 +33,6 @@ if ENV.key?('ENABLE_COVERAGE')
       false
     end
     # no coverage in these files
-    add_filter 'lib/aspera/node_simulator.rb'
     add_filter 'lib/aspera/keychain/macos_security.rb'
     add_filter 'lib/aspera/assert.rb'
   end

data/lib/aspera/environment.rb

@@ -5,11 +5,14 @@ require 'aspera/log'
 require 'aspera/assert'
 require 'rbconfig'
 require 'singleton'
+require 'openssl'
 require 'open3'
 require 'English'
 require 'shellwords'
+require 'aspera/rainbow'
+using Rainbow
 
-# cspell:words MEBI mswin bccwin
+# cspell:words mswin bccwin
 
 module Aspera
   # detect OS, architecture, and specific stuff
@@ -34,8 +37,6 @@ module Aspera
     CPU_LIST = [CPU_X86_64, CPU_ARM64, CPU_PPC64, CPU_PPC64LE, CPU_S390].freeze
 
     BITS_PER_BYTE = 8
-    MEBI = 1024 * 1024
-    BYTES_PER_MEBIBIT = MEBI / BITS_PER_BYTE
 
     I18N_VARS = %w(LC_ALL LC_CTYPE LANG).freeze
 
@@ -48,6 +49,14 @@ module Aspera
 
     PROCESS_MODES = %i[execute background capture].freeze
 
+    # System CA certificate bundles, used when the default locations of Ruby's OpenSSL do not exist
+    CA_BUNDLE_FILES = [
+      '/etc/ssl/certs/ca-certificates.crt', # Debian, Ubuntu, Alpine, Arch
+      '/etc/pki/tls/certs/ca-bundle.crt',   # RHEL, Fedora
+      '/etc/ssl/ca-bundle.pem',             # SUSE
+      '/etc/ssl/cert.pem'                   # macOS, BSD
+    ].freeze
+
     class << self
       def ruby_version
         return RbConfig::CONFIG['RUBY_PROGRAM_VERSION']
@@ -163,8 +172,8 @@ module Aspera
         if force || !File.exist?(path)
           # Windows may give error
           File.unlink(path) rescue nil
-          # content provided by block
-          File.write(path, yield)
+          # content provided by block, file created with restricted access: never readable by others, even briefly
+          File.write(path, yield, perm: mode || 0o600)
           restrict_file_access(path, mode: mode)
         end
         return path
@@ -201,12 +210,16 @@ module Aspera
         I18N_VARS.each { |var| ENV[var] = 'C' }
       end
 
+      # Override detection of Unicode support: `true` or `false`, or `nil` for auto-detection
+      attr_writer :unicode
+
       # @return [Boolean] true if we can display Unicode characters
       # Uses Encoding.locale_charmap for OS-independent detection.
       # Falls back to locale env vars for systems where charmap is not available.
       # https://www.gnu.org/software/libc/manual/html_node/Locale-Categories.html
       # https://pubs.opengroup.org/onlinepubs/7908799/xbd/envvar.html
       def terminal_supports_unicode?
+        return @unicode unless @unicode.nil?
         return false unless terminal?
         locale_charmap_utf8? || I18N_VARS.any? { |var| ENV[var]&.include?('UTF-8') }
       end
@@ -293,6 +306,23 @@ module Aspera
       nil
     end
 
+    # When Ruby's OpenSSL was built on another system (e.g. single executable built on RHEL, used on Ubuntu),
+    # its default CA locations may not exist: use the system CA bundle instead.
+    # @return [String, nil] CA bundle file used, or nil if no change
+    def fix_ca_certificates
+      return if defined?(JRUBY_VERSION)
+      return if [OpenSSL::X509::DEFAULT_CERT_FILE_ENV, OpenSSL::X509::DEFAULT_CERT_DIR_ENV].any? { |var| ENV.key?(var) }
+      return if File.exist?(OpenSSL::X509::DEFAULT_CERT_FILE) || Dir.exist?(OpenSSL::X509::DEFAULT_CERT_DIR)
+      ca_file = CA_BUNDLE_FILES.find { |file| File.file?(file) }
+      return if ca_file.nil?
+      # Used by OpenSSL for new default stores, and by child processes
+      ENV[OpenSSL::X509::DEFAULT_CERT_FILE_ENV] = ca_file
+      # Default store of SSL contexts is initialized when openssl is loaded
+      OpenSSL::SSL::SSLContext::DEFAULT_CERT_STORE.add_file(ca_file)
+      Log.log.debug { "Using system CA certificates: #{ca_file}" }
+      ca_file
+    end
+
     def graphical?
       @default_gui_mode == :graphical
     end

data/lib/aspera/faspex_gw.rb

@@ -2,6 +2,7 @@
 
 require 'aspera/log'
 require 'aspera/assert'
+require 'aspera/mime'
 require 'webrick'
 require 'json'
 
@@ -10,7 +11,7 @@ module Aspera
   class Faspex4GWServlet < WEBrick::HTTPServlet::AbstractServlet
     AOC_API = 'Aspera::Api::AoC'
     FX_API = 'Aspera::Api::Faspex'
-    # @param app_api     [Rest]   API object
+    # @param app_api     [Rest::Client]   API object
     # @param app_context [String] workspace id (aoc only)
     def initialize(server, app_api, app_context)
       Aspera.assert_values(app_api.class.name, [AOC_API, FX_API])

data/lib/aspera/faspex_postproc.rb

@@ -6,6 +6,7 @@ require 'English'
 require 'webrick'
 require 'aspera/log'
 require 'aspera/assert'
+require 'aspera/mime'
 
 module Aspera
   # Start a Faspex-4 style post-processing script using Faspex-5 webhook

data/lib/aspera/graphql.rb

@@ -1,9 +1,9 @@
 # frozen_string_literal: true
 
-require 'aspera/rest_call_error'
+require 'aspera/rest/call_error'
 
 module Aspera
-  # Helper to execute GraphQL queries via a Rest object.
+  # Helper to execute GraphQL queries via a Rest::Client object.
   # Follows the GraphQL-over-HTTP convention: POST {query, variables} to endpoint,
   # parse top-level `data` key, raise on top-level `errors` array.
   module GraphQL
@@ -12,16 +12,16 @@ module Aspera
 
     class << self
       # Execute a GraphQL query loaded from a .graphql file in lib/aspera/api/queries/
-      # @param rest      [Rest]   API object pointing at the GraphQL endpoint
+      # @param rest      [Rest::Client]   API object pointing at the GraphQL endpoint
       # @param name      [String] Base filename without extension (e.g. 'my_query')
       # @param variables [Hash]   GraphQL variables
       # @return [Hash]   The `data` object from the response
-      # @raise [RestCallError] if the response contains GraphQL errors
+      # @raise [Rest::CallError] if the response contains GraphQL errors
       def execute(rest, name, variables = {})
         query = load_query(name)
         response = rest.create(nil, {query: query, variables: variables})
         errors = response['errors']
-        raise RestCallError, errors.map { |e| e['message'] }.join("\n") if errors.is_a?(Array) && !errors.empty?
+        raise Rest::CallError, errors.map { |e| e['message'] }.join("\n") if errors.is_a?(Array) && !errors.empty?
         response['data']
       end
 

data/lib/aspera/json_rpc/client.rb

@@ -2,19 +2,19 @@
 
 # cspell:ignore blankslate jsonrpc
 
-require 'aspera/rest_error_analyzer'
+require 'aspera/rest/error_analyzer'
 require 'aspera/assert'
 require 'aspera/json_rpc/version'
 require 'blankslate'
 
-Aspera::RestErrorAnalyzer.instance.add_simple_handler(name: 'JSON RPC', path: %w[error message], always: true)
+Aspera::Rest::ErrorAnalyzer.instance.add_simple_handler(name: 'JSON RPC', path: %w[error message], always: true)
 
 module Aspera
   module JsonRpc
-    # JSON-RPC 2.0 client over an Aspera::Rest HTTP endpoint.
+    # JSON-RPC 2.0 client over an Aspera::Rest::Client HTTP endpoint.
     # Methods are dispatched dynamically via method_missing.
     # Example:
-    #   client = JsonRpc::Client.new(Rest.new(base_url: 'http://127.0.0.1:33024'))
+    #   client = JsonRpc::Client.new(Rest::Client.new(base_url: 'http://127.0.0.1:33024'))
     #   client.get_info
     #   client.start_transfer(app_id: '...', transfer_spec: {...})
     class Client < BlankSlate
@@ -22,7 +22,7 @@ module Aspera
       reveal :inspect
       reveal :to_s
 
-      # @param api       [Rest]   Aspera REST object pointing at the JSON-RPC endpoint
+      # @param api       [Rest::Client]   Aspera REST object pointing at the JSON-RPC endpoint
       # @param namespace [String, nil] optional method prefix, e.g. "myns."
       def initialize(api, namespace = nil)
         super()

data/lib/aspera/keychain/encrypted_hash.rb

@@ -138,7 +138,7 @@ module Aspera
         end
       end
 
-      # Derive an AES key from +new_password+.
+      # Derive an AES key from `new_password`.
       # @legacy_key is true for vaults created by v4.26.0 or earlier (no kdf field):
       #   key = password truncated/zero-padded to key_bytes (same as symmetric-encryption did).
       # Otherwise PBKDF2 is used. When @kdf_params is nil (new vault or password change)
@@ -181,7 +181,7 @@ module Aspera
           'kdf'     => @kdf_params,
           'data'    => @cipher.encrypt(YAML.dump(@all_secrets))
         }
-        File.write(@path, YAML.dump(vault_info))
+        Environment.write_file_restricted(@path, force: true) { YAML.dump(vault_info) }
       end
     end
   end

data/lib/aspera/keychain/factory.rb

@@ -18,7 +18,8 @@ module Aspera
           Aspera.assert_values(vault_type, LIST.map(&:to_s)) { 'vault.type' }
           case vault_type
           when 'file'
-            info[:file] = info.delete(:name) || 'vault.bin' if info.key?(:name)
+            # `name` (or `file`), default: `vault.bin`
+            info[:file] = info.delete(:name) || info[:file] || 'vault.bin'
             info[:file] = File.join(folder, info[:file]) unless File.absolute_path?(info[:file])
             Aspera.assert(!password.nil?, 'please provide password')
             info[:password] = password

data/lib/aspera/keychain/one_password_api.rb

@@ -16,7 +16,7 @@ module Aspera
       def initialize(url:, token:, vault_id:)
         super()
         @vault_id = vault_id
-        @api = Rest.new(
+        @api = Rest::Client.new(
           base_url: url,
           headers:  {'Authorization' => "Bearer #{token}"}
         )

data/lib/aspera/link_header.rb

@@ -31,7 +31,7 @@ module Aspera
       @links = links
     end
 
-    # Return the href of the first link whose +rel+ attribute matches +rel+.
+    # Return the href of the first link whose `rel` attribute matches `rel`.
     # Comparison is case-insensitive per RFC 7230 s.3.2 and RFC 8288 s.3.
     # Returns nil if no link with that relation exists.
     # @param rel [String]
@@ -41,7 +41,7 @@ module Aspera
     end
 
     class << self
-      # Parse a raw Link header value into a +LinkHeader+ instance.
+      # Parse a raw Link header value into a `LinkHeader` instance.
       # Uses StringScanner so that commas inside <URI> are not treated as separators.
       # @param raw [String, nil]
       # @return [LinkHeader]

data/lib/aspera/log.rb

@@ -1,13 +1,14 @@
 # frozen_string_literal: true
 
 require 'aspera/assert'
-require 'aspera/colors'
 require 'aspera/secret_hider'
 require 'logger'
 require 'pp'
 require 'json'
 require 'singleton'
 require 'stringio'
+require 'aspera/rainbow'
+using Rainbow
 
 # Ignore warnings
 old_verbose = $VERBOSE
@@ -67,6 +68,26 @@ module Aspera
     # Where logs are sent to
     LOG_TYPES = %i[stderr stdout syslog].freeze
 
+    # Logger device for a terminal: the status line (e.g. progress bar) is suspended while a log line is written
+    class TerminalDevice
+      # @param io [IO] Output stream
+      def initialize(io)
+        @io = io
+      end
+
+      # Called by `Logger`
+      # @param message [String] Formatted log line
+      def write(message)
+        status_line = Log.instance.status_line if @io.tty?
+        return @io.write(message) if status_line.nil?
+        status_line.suspend { @io.write(message) }
+      end
+
+      # Standard streams are not closed
+      def close; end
+    end
+    private_constant :TerminalDevice
+
     # Levels are :trace2,:trace1,:debug,:info,:warn,:error,fatal,:unknown
     LEVELS = Logger::Severity.constants.sort { |a, b| Logger::Severity.const_get(a) <=> Logger::Severity.const_get(b) }.map { |c| c.downcase.to_sym }.freeze
 
@@ -118,13 +139,13 @@ module Aspera
 
       # Returns the last 2 containers (module/class) and method caller
       def caller_method
-        stack = caller
-        i = stack.rindex { |line| line.include?('Logger') }
-        frame = stack[i + 1] if i && stack[i + 1]
+        locations = caller_locations
+        # Outermost frame of logging code: Ruby logger, or this file (level methods, dump)
+        i = locations.rindex { |loc| loc.path.end_with?('/logger.rb') || loc.path.eql?(__FILE__) }
+        frame = locations[i + 1] if i
         return '???' unless frame
-        # Extract the "Class::Module::Method" or "Class#method" part
-        full = frame[/'([^']+)'/, 1]
-        return '???' unless full
+        # "Class::Module#method" (Ruby >= 3.4) or "method" (Ruby < 3.4)
+        full = frame.label
         # Split into class/module and method parts
         parts = full.split(/(::|#)/)
         # Reconstruct keeping only last two class/module names + separator + method
@@ -138,12 +159,15 @@ module Aspera
         end
         class_parts = classes.split('::')
         selected_classes = class_parts.last(2).join('::')
+        return method if selected_classes.empty?
         "#{selected_classes}.#{method}"
       end
     end
 
     attr_reader :logger_type, :logger
     attr_accessor :dump_format
+    # [#suspend, nil] Object displaying a status line on the terminal (e.g. progress bar), see TerminalDevice
+    attr_accessor :status_line
 
     # Set the program name used in log output
     # @param value [String] Program name
@@ -195,9 +219,9 @@ module Aspera
       current_severity_integer = @logger&.level || ENV['AS_LOG_LEVEL']&.to_i || Logger::Severity::INFO
       case new_log_type
       when :stderr
-        @logger = Logger.new($stderr, progname: @program_name, formatter: DEFAULT_FORMATTER)
+        @logger = Logger.new(TerminalDevice.new($stderr), progname: @program_name, formatter: DEFAULT_FORMATTER)
       when :stdout
-        @logger = Logger.new($stdout, progname: @program_name, formatter: DEFAULT_FORMATTER)
+        @logger = Logger.new(TerminalDevice.new($stdout), progname: @program_name, formatter: DEFAULT_FORMATTER)
       when :syslog
         require 'syslog/logger'
         # The syslog class automatically creates methods from the severity names.
@@ -223,6 +247,7 @@ module Aspera
 
     def initialize
       @logger = nil
+      @status_line = nil
       @program_name = 'aspera'
       @dump_format = :json
       @logger_type = :stderr
@@ -230,34 +255,29 @@ module Aspera
       self.logger_type = @logger_type
     end
 
-    # Define decoration of levels
-    LVL_DECO = {
-      TRACE2:  %i{dim},
-      TRACE1:  %i{blue},
-      DEBUG:   %i{cyan},
-      INFO:    %i{green},
-      WARN:    %i{bg_brown black},
-      ERROR:   %i{bg_red blink},
-      FATAL:   %i{magenta},
-      UNKNOWN: %i{blink}
+    # Short (4-letters) levels with color (evaluated on each call, as colors can be enabled or disabled by option)
+    LVL_COLOR = {
+      TRACE2:  -> { short_levl(:TRACE2).faint },
+      TRACE1:  -> { short_levl(:TRACE1).blue },
+      DEBUG:   -> { short_levl(:DEBUG).cyan },
+      INFO:    -> { short_levl(:INFO).green },
+      WARN:    -> { short_levl(:WARN).bg(:yellow).black },
+      ERROR:   -> { short_levl(:ERROR).bg(:red).blink },
+      FATAL:   -> { short_levl(:FATAL).magenta },
+      UNKNOWN: -> { short_levl(:UNKNOWN).blink }
     }.freeze
 
-    # Short (4-letters) levels with color
-    LVL_COLOR = LVL_DECO.to_h do |k, v|
-      [k, short_levl(k).apply(*v)]
-    end.freeze
-
-    DEFAULT_FORMATTER = ->(s, _d, _p, m) { "#{LVL_COLOR[s]} #{m}\n" }
+    DEFAULT_FORMATTER = ->(s, _d, _p, m) { "#{LVL_COLOR[s]&.call} #{m}\n" }
 
     # pre-defined formatters
     FORMATTER_LAMBDAS = {
       standard: Logger::Formatter.new,
       default:  DEFAULT_FORMATTER,
-      caller:   ->(s, _d, _p, m) { "#{LVL_COLOR[s]} #{Log.caller_method}\n#{m}\n" }
+      caller:   ->(s, _d, _p, m) { "#{LVL_COLOR[s]&.call} #{Log.caller_method}\n#{m}\n" }
     }.freeze
 
     FORMATTERS = FORMATTER_LAMBDAS.keys
 
-    private_constant :LVL_DECO, :DEFAULT_FORMATTER, :FORMATTER_LAMBDAS
+    private_constant :DEFAULT_FORMATTER, :FORMATTER_LAMBDAS
   end
 end

data/lib/aspera/markdown.rb

@@ -82,6 +82,8 @@ module Aspera
         col_widths = table.transpose.map do |col|
           [col.flat_map { |c| c.to_s.delete('`').split(HTML_BREAK).map(&:size) }.max, COL_WIDTH].min
         end
+        # do not modify caller's table
+        table = table.dup
         headings = table.shift
         table.unshift(col_widths.map { |col_width| '-' * col_width })
         table.unshift(headings)

data/lib/aspera/mime.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+module Aspera
+  # MIME types used in `Content-Type` and `Accept`
+  module Mime
+    # JSON body
+    JSON = 'application/json'
+    # URL encoded form body
+    WWW = 'application/x-www-form-urlencoded'
+    # Plain text body
+    TEXT = 'text/plain'
+    # JSON:API body (https://jsonapi.org)
+    JSON_API = 'application/vnd.api+json'
+    # Check if a media type is JSON: `application/json` or structured syntax suffix `+json` (RFC 6839)
+    # @param mime [String] Media type, without parameters (see `Rest.parse_header`)
+    # @return [Boolean] `true` if JSON
+    def json?(mime) = mime == JSON || mime.end_with?(JSON_SUFFIX) || mime == LEGACY_JSON
+    module_function :json?
+    # Structured syntax suffix for JSON
+    JSON_SUFFIX = '+json'
+    # Non standard type used by some servers for JSON
+    LEGACY_JSON = 'application/x-javascript'
+    private_constant :JSON_SUFFIX, :LEGACY_JSON
+  end
+end