aspera-cli 4.27.5 → 4.28.0

data/lib/aspera/id_generator.rb

@@ -9,13 +9,14 @@ module Aspera
     class << self
       # Generate an ID from a list of object IDs
       # The generated ID is safe as file name
+      # In URLs keep only the host name, we assume only one instance on a given host.
       # @param ids [Array] the object IDs (can be nested, will be flattened, and nils removed)
       # @return [String] the generated ID
       def from_list(*ids)
         safe_char = Environment.instance.safe_filename_character
         # compact: remove nils
         id = ids.flatten.compact.map do |i|
-          i.is_a?(String) && i.start_with?('https://') ? URI.parse(i).host : i.to_s
+          i.is_a?(String) && i.start_with?('http://', 'https://') ? URI.parse(i).host : i.to_s
         end.join(safe_char)
         # keep dot for extension only (nicer)
         return Environment.instance.sanitized_filename(id.gsub('.', safe_char)).downcase

data/lib/aspera/json_rpc/client.rb

@@ -1,27 +1,54 @@
 # frozen_string_literal: true
 
-# cspell:ignore blankslate jsonrpc
+# cspell:ignore jsonrpc
 
 require 'aspera/rest/error_analyzer'
+require 'aspera/rest/call_error'
 require 'aspera/assert'
 require 'aspera/json_rpc/version'
-require 'blankslate'
 
-Aspera::Rest::ErrorAnalyzer.instance.add_simple_handler(name: 'JSON RPC', path: %w[error message], always: true)
+# Error in non-2XX response. Error in 2XX response is raised by the client.
+Aspera::Rest::ErrorAnalyzer.instance.add_simple_handler(name: 'JSON RPC', path: %w[error message])
 
 module Aspera
+  # JSON-RPC 2.0 over HTTP
   module JsonRpc
+    class << self
+      # Send a JSON-RPC request
+      # @param api    [Rest::Client] Aspera REST object pointing at the JSON-RPC endpoint
+      # @param method [String]       JSON-RPC method
+      # @param args   [Array]        Arguments of call: a single Hash is sent as named params
+      # @param id     [Integer]      Request id
+      # @return [Object] `result` of response
+      # @raise [Rest::CallError] on JSON-RPC error, or invalid response
+      def request(api, method, args, id)
+        args = args.first if args.size == 1 && args.first.is_a?(Hash)
+        data = api.create('', {
+          jsonrpc: VERSION,
+          method:  method,
+          params:  args,
+          id:      id
+        })
+        Aspera.assert_type(data, Hash, type: Rest::CallError) { 'JSON-RPC response' }
+        Aspera.assert(data['jsonrpc'] == VERSION, type: Rest::CallError) { "JSON-RPC: bad version in response: #{data['jsonrpc']}" }
+        Aspera.assert(data.key?('result') ^ data.key?('error'), type: Rest::CallError) { 'JSON-RPC: response must have either result or error' }
+        # id is null if server could not read it from request
+        Aspera.assert(data['id'] == id || (data.key?('error') && data['id'].nil?), type: Rest::CallError) { "JSON-RPC: bad id in response: #{data['id']}, expected #{id}" }
+        return data['result'] if data.key?('result')
+        error = data['error']
+        Aspera.assert(error.is_a?(Hash) && error['code'].is_a?(Integer) && error['message'].is_a?(String), type: Rest::CallError) { "JSON-RPC: bad error in response: #{error}" }
+        raise Rest::CallError, "#{error['message']} (code: #{error['code']})"
+      end
+    end
+
     # JSON-RPC 2.0 client over an Aspera::Rest::Client HTTP endpoint.
     # Methods are dispatched dynamically via method_missing.
+    # Based on BasicObject, so that methods of Object are sent as JSON-RPC requests.
     # Example:
     #   client = JsonRpc::Client.new(Rest::Client.new(base_url: 'http://127.0.0.1:33024'))
     #   client.get_info
     #   client.start_transfer(app_id: '...', transfer_spec: {...})
-    class Client < BlankSlate
-      reveal :instance_variable_get
-      reveal :inspect
-      reveal :to_s
-
+    class Client < BasicObject
       # @param api       [Rest::Client]   Aspera REST object pointing at the JSON-RPC endpoint
       # @param namespace [String, nil] optional method prefix, e.g. "myns."
       def initialize(api, namespace = nil)
@@ -31,32 +58,24 @@ module Aspera
         @request_id = 0
       end
 
-      def respond_to_missing?(_sym, _include_private = false)
-        true
-      end
+      # @return [String] Class and URL of JSON-RPC endpoint
+      def inspect = "#<#{Client.name} #{@api.base_url}>"
+
+      # @return [String] Same as {#inspect}
+      def to_s = inspect
+
+      # Ruby checks it before implicit conversions (`to_ary`, `to_str`, ...): those are not JSON-RPC methods
+      # @param _sym             [Symbol]  Method name
+      # @param _include_private [Boolean] Also private methods
+      # @return [false]
+      def respond_to_missing?(_sym, _include_private = false) = false
 
       # Dispatch any Ruby method call as a JSON-RPC request
-      def method_missing(method, *args, &block)
-        args = args.first if args.size == 1 && args.first.is_a?(Hash)
-        data = @api.create('', {
-          jsonrpc: VERSION,
-          method:  "#{@namespace}#{method}",
-          params:  args,
-          id:      @request_id += 1
-        })
-        Aspera.assert_type(data, Hash) { 'response' }
-        Aspera.assert(data['jsonrpc'] == VERSION, 'bad version in response')
-        Aspera.assert(data.key?('id'), 'missing id in response')
-        Aspera.assert(!(data.key?('error') && data.key?('result')), 'both error and response')
-        Aspera.assert(
-          !data.key?('error') ||
-          data['error'].is_a?(Hash) &&
-          data['error']['code'].is_a?(Integer) &&
-          data['error']['message'].is_a?(String),
-          'bad error response'
-        )
-        return data['result']
-      end
+      # @param method [Symbol] JSON-RPC method, without namespace
+      # @param args   [Array]  Arguments of call: a single Hash is sent as named params, else positional params
+      # @return [Object] `result` of response
+      # @raise [Rest::CallError] on JSON-RPC error, or invalid response
+      def method_missing(method, *args) = JsonRpc.request(@api, "#{@namespace}#{method}", args, @request_id += 1)
     end
   end
 end

data/lib/aspera/json_rpc/version.rb

@@ -2,6 +2,7 @@
 
 module Aspera
   module JsonRpc
+    # Protocol version: value of `jsonrpc` in request and response
     VERSION = '2.0'
   end
 end

data/lib/aspera/keychain/base.rb

@@ -20,6 +20,11 @@ module Aspera
         end
         Aspera.assert(options.key?(:label), 'label is required')
       end
+
+      # Labels are unique: `set` does not overwrite an existing secret
+      def assert_new_label(label)
+        Aspera.assert(get(label: label, exception: false).nil?) { "secret #{label} already exist, delete first" }
+      end
     end
   end
 end

data/lib/aspera/keychain/encrypted_hash.rb

@@ -40,7 +40,8 @@ module Aspera
         if File.exist?(@path)
           vault_file = File.read(@path)
           if vault_file.start_with?('---')
-            vault_info = YAML.parse(vault_file).to_ruby
+            vault_info = Yaml.safe_load(vault_file)
+            Aspera.assert_type(vault_info, Hash) { "Invalid vault file: #{@path}" }
             sorted_keys = vault_info.keys.sort
             Aspera.assert(sorted_keys == FILE_KEYS || sorted_keys == FILE_KEYS_KDF) { "Invalid vault file: #{@path}: #{sorted_keys}" }
             @cipher_name = vault_info['cipher']
@@ -82,7 +83,7 @@ module Aspera
       def set(options)
         validate_set(options)
         label = options.delete(:label)
-        Aspera.assert(!@all_secrets.key?(label)) { "secret #{label} already exist, delete first" }
+        assert_new_label(label)
         @all_secrets[label] = options.symbolize_keys
         save
       end
@@ -95,12 +96,15 @@ module Aspera
       end
 
       def delete(label:)
+        Aspera.assert(@all_secrets.key?(label)) { "Label not found: #{label}" }
         @all_secrets.delete(label)
         save
       end
 
       def change_password(password)
         # Generate new KDF params so a password change also re-salts the vault
+        # (and migrates a legacy vault to PBKDF2)
+        @legacy_key = false
         @kdf_params = nil
         @cipher = cipher(password)
         save

data/lib/aspera/keychain/factory.rb

@@ -15,7 +15,6 @@ module Aspera
           Aspera.assert_hash_all(info, Symbol, String) { 'vault info shall have only string values' }
           info = info.symbolize_keys
           vault_type = info.delete(:type)
-          Aspera.assert_values(vault_type, LIST.map(&:to_s)) { 'vault.type' }
           case vault_type
           when 'file'
             # `name` (or `file`), default: `vault.bin`
@@ -40,7 +39,6 @@ module Aspera
             Keychain::HashicorpVault.new(**info)
           when '1password'
             source = info.delete(:source) || 'api'
-            Aspera.assert_values(source, %w[api cli]) { 'vault.source' }
             case source
             when 'api'
               require 'aspera/keychain/one_password_api'
@@ -49,8 +47,9 @@ module Aspera
             when 'cli'
               require 'aspera/keychain/one_password_cli'
               Keychain::OnePasswordCli.new(**info)
+            else Aspera.error_unexpected_value(source, type: ParameterError) { 'vault.source' }
             end
-          else Aspera.error_unexpected_value(vault_type)
+          else Aspera.error_unexpected_value(vault_type, type: ParameterError) { 'vault.type' }
           end
         end
       end

data/lib/aspera/keychain/hashicorp_vault.rb

@@ -32,7 +32,8 @@ module Aspera
       def all
         metadata_path = STORE_PATH.sub('/data/', '/metadata/')
         return Vault.logical.list(metadata_path).filter_map do |label|
-          get(label: label).merge(label: label)
+          # KV v2: deleted secrets are still listed in metadata
+          get(label: label, exception: false)&.merge(label: label)
         end
       end
 
@@ -41,6 +42,7 @@ module Aspera
       def set(options)
         validate_set(options)
         label = options.fetch(:label)
+        assert_new_label(label)
         data = {
           username:    options[:username],
           password:    options[:password],
@@ -51,12 +53,13 @@ module Aspera
       end
 
       def get(label:, exception: true)
-        secret = Vault.logical.read(path(label))
-        if secret.nil?
+        # KV v2: a deleted secret may have metadata but no data
+        data = Vault.logical.read(path(label))&.data&.[](:data)
+        if data.nil?
           raise "Secret '#{label}' not found" if exception
           return
         end
-        return secret.data[:data]
+        return data
       end
 
       def delete(label:)

data/lib/aspera/keychain/macos_security.rb

@@ -18,7 +18,10 @@ module Aspera
         DOMAINS = %i[user system common dynamic].freeze
         LIST_OPTIONS = {
           domain: :c
-        }
+        }.freeze
+        KEYCHAIN_OPTIONS = {
+          password: :p
+        }.freeze
         ADD_PASS_OPTIONS = {
           account:  :a,
           creator:  :c,
@@ -37,8 +40,17 @@ module Aspera
           password: :w,
           getpass:  :g
         }.freeze
+        # Exit code of `security` when the item is not found
+        EXIT_ITEM_NOT_FOUND = 44
         class << self
-          def execute(command, options = nil, supported = nil, last_opt = nil)
+          # Execute a `security` CLI command with given options
+          # @param command   [String]                  The security sub-command
+          # @param options   [Hash, nil]               Command options
+          # @param supported [Hash, nil]               Mapping of option keys to CLI flags
+          # @param last_opt  [String, nil]             Trailing argument (e.g. keychain path)
+          # @param exception [Boolean]                 Whether to raise on non-zero exit
+          # @return [Array(String, String, Process::Status)] stdout, stderr, status
+          def execute(command, options = nil, supported = nil, last_opt = nil, exception: true)
             url = options&.delete(:url)
             if !url.nil?
               uri = URI.parse(url)
@@ -54,43 +66,82 @@ module Aspera
               Aspera.assert(supported.key?(k)) { "unknown option: #{k}" }
               next if v.nil?
               command_args.push("-#{supported[k]}")
-              command_args.push(v.shellescape) unless v.empty?
+              # No shell is involved: value is passed as is
+              command_args.push(v.to_s) unless v.to_s.empty?
             end
             command_args.push(last_opt) unless last_opt.nil?
-            Environment.secure_execute(*command_args, mode: :capture).first
+            Environment.secure_execute(*command_args, mode: :capture, exception: exception)
           end
 
+          # Parse output of list command into Keychain objects
+          # @param output [String] Raw CLI output
+          # @return [Array<Keychain>] List of keychain instances
           def key_chains(output)
             output.split("\n").collect { |line| new(line.strip.gsub(/^"|"$/, '')) }
           end
 
+          # Get the macOS default keychain
+          # @return [Keychain] Default keychain instance
           def default
-            key_chains(execute('default-keychain')).first
+            key_chains(execute('default-keychain').first).first
           end
 
+          # Get the macOS login keychain
+          # @return [Keychain] Login keychain instance
           def login
-            key_chains(execute('login-keychain')).first
+            key_chains(execute('login-keychain').first).first
           end
 
+          # List keychains in the search list or domain
+          # @param options [Hash] Domain options
+          # @return [Array<Keychain>] List of keychains
           def list(options = {})
             Aspera.assert_values(options[:domain], DOMAINS, type: ParameterError) { 'domain' } unless options[:domain].nil?
-            key_chains(execute('list-keychains', options, LIST_OPTIONS))
+            key_chains(execute('list-keychains', options, LIST_OPTIONS).first)
           end
 
+          # Find a keychain by its short name (without `.keychain-db` extension)
+          # @param name [String] Keychain name
+          # @return [Keychain, nil] Matching keychain or nil
           def by_name(name)
             list.find { |kc| kc.path.end_with?("/#{name}.keychain-db") }
           end
+
+          # Create a new macOS keychain file
+          # @param path     [String] File path for the new keychain
+          # @param password [String] Password for the new keychain
+          # @return [Keychain] Created keychain instance
+          def create(path, password:)
+            execute('create-keychain', {password: password}, KEYCHAIN_OPTIONS, path)
+            new(path)
+          end
+
+          # Set the keychain search list
+          # @param keychain_list [Array<Keychain>] Ordered list of keychains
+          # @return [Array(String, String, Process::Status)] Execution result
+          def search_list=(keychain_list)
+            Environment.secure_execute(SECURITY_UTILITY, 'list-keychains', '-s', *keychain_list.map(&:path), mode: :capture)
+          end
         end
         attr_reader :path
 
+        # @param path [String] File path of the keychain
         def initialize(path)
           @path = path
         end
 
+        # Decode a hexadecimal encoded string into UTF-8
+        # @param string [String] Hex string
+        # @return [String] Decoded string
         def decode_hex_blob(string)
           [string].pack('H*').force_encoding('UTF-8')
         end
 
+        # Perform generic or internet password operation (add, find, delete)
+        # @param operation [Symbol] :add, :find, or :delete
+        # @param pass_type [Symbol] :generic or :internet
+        # @param options   [Hash]   Operation options (account, service, password, label, etc.)
+        # @return [Hash, nil] Parsed attributes for :find, or nil
         def password(operation, pass_type, options)
           Aspera.assert_values(operation, %i[add find delete]) { 'operation' }
           Aspera.assert_values(pass_type, %i[generic internet]) { 'pass_type' }
@@ -98,11 +149,15 @@ module Aspera
           missing = (operation.eql?(:add) ? %i[account service password] : %i[label]) - options.keys
           Aspera.assert(missing.empty?) { "missing options: #{missing}" }
           options[:getpass] = '' if operation.eql?(:find)
-          output = self.class.execute("#{operation}-#{pass_type}-password", options, ADD_PASS_OPTIONS, @path)
-          raise output.gsub(/^.*: /, '') if output.start_with?('security: ')
+          stdout, stderr, status = self.class.execute("#{operation}-#{pass_type}-password", options, ADD_PASS_OPTIONS, @path, exception: false)
+          unless status.success?
+            return if operation.eql?(:find) && status.exitstatus.eql?(EXIT_ITEM_NOT_FOUND)
+            raise Error, stderr.strip.gsub(/^.*: /, '')
+          end
           return unless operation.eql?(:find)
           attributes = {}
-          output.split("\n").each do |line|
+          # Attributes are on stdout, password (option -g) is on stderr
+          "#{stdout}\n#{stderr}".split("\n").each do |line|
             case line
             when /^keychain: "(.+)"/
               # ignore
@@ -120,10 +175,47 @@ module Aspera
           end
           return attributes
         end
+
+        # Unlock this keychain with its password
+        # @param password [String] Password of the keychain
+        # @return [Array(String, String, Process::Status)] Execution result
+        def unlock(password:)
+          self.class.execute('unlock-keychain', {password: password}, KEYCHAIN_OPTIONS, @path)
+        end
+
+        # Lock this keychain
+        # @return [Array(String, String, Process::Status)] Execution result
+        def lock
+          self.class.execute('lock-keychain', nil, nil, @path)
+        end
+
+        # Delete this keychain file from disk
+        # @return [Array(String, String, Process::Status)] Execution result
+        def delete
+          self.class.execute('delete-keychain', nil, nil, @path)
+        end
+
+        # Configure settings for this keychain (lock timeout, lock on sleep)
+        # @param timeout       [Integer, nil] Inactivity timeout in seconds
+        # @param lock_on_sleep [Boolean]      Whether to lock when system sleeps
+        # @return [Array(String, String, Process::Status)] Execution result
+        def set_settings(timeout: nil, lock_on_sleep: false)
+          args = [SECURITY_UTILITY, 'set-keychain-settings']
+          args.push('-l') if lock_on_sleep
+          args.push('-u', '-t', timeout.to_s) if timeout
+          args.push(@path)
+          Environment.secure_execute(*args, mode: :capture)
+        end
       end
     end
 
+    # Vault backend implementation wrapping macOS system keychain
     class MacosSystem < Base
+      # Account is mandatory in keychain: used when no username is provided
+      NO_ACCOUNT = 'none'
+      private_constant :NO_ACCOUNT
+
+      # @param name [String, nil] Specific keychain name, or nil for default
       def initialize(name: nil)
         super()
         @keychain_name = name.nil? ? 'default keychain' : name
@@ -131,25 +223,35 @@ module Aspera
         Aspera.assert(!@keychain.nil?) { "no such keychain #{name}" }
       end
 
+      # @return [Hash] Vault information metadata
       def info
         return {
           keychain: @keychain_name
         }
       end
 
+      # Overview of all secrets (not supported on macOS due to OS restrictions)
+      # @raise [Error] Always raised
       def all
         # the only way to list is `dump-keychain` which triggers security alert
         raise Error, 'overview not implemented, use macos keychain app'
       end
 
+      # Store a secret in the keychain
+      # @param options [Hash] Secret attributes (label, password, username, description)
+      # @return [Hash, nil] Result
       def set(options)
         validate_set(options)
         @keychain.password(
           :add, :generic, service: options[:label],
-          account: options[:username] || 'none', password: options[:password], comment: options[:description]
+          account: options[:username] || NO_ACCOUNT, password: options[:password], comment: options[:description]
         )
       end
 
+      # Retrieve a secret by label
+      # @param label     [String]  Secret label identifier
+      # @param exception [Boolean] Whether to raise if not found
+      # @return [Hash, nil] Secret attributes or nil
       def get(label:, exception: true)
         info = @keychain.password(:find, :generic, label: label)
         if info.nil?
@@ -158,13 +260,17 @@ module Aspera
         end
         return {
           label:       label,
+          username:    (info['acct'] unless info['acct'].eql?(NO_ACCOUNT)),
           password:    info['password'],
           description: info['icmt'] # cspell: disable-line
-        }
+        }.compact
       end
 
+      # Delete a secret by label
+      # @param label [String] Secret label identifier
+      # @return [Hash, nil] Result
       def delete(label:)
-        raise Error, 'delete not implemented, use macos keychain app'
+        @keychain.password(:delete, :generic, label: label)
       end
     end
   end

data/lib/aspera/keychain/one_password_api.rb

@@ -42,6 +42,7 @@ module Aspera
 
       def set(options)
         validate_set(options)
+        Aspera.assert(resolve_id(options[:label], exception: false).nil?) { "secret #{options[:label]} already exist, delete first" }
         @api.create("v1/vaults/#{@vault_id}/items", build_item(options))
         nil
       end
@@ -60,10 +61,12 @@ module Aspera
 
       private
 
-      # Resolve an item id from its title; raises if ambiguous or missing
+      # Resolve an item id from its title, or else from its id; raises if ambiguous or missing
       def resolve_id(label, exception: true)
         items = @api.read("v1/vaults/#{@vault_id}/items", {filter: "title eq \"#{label}\""})
         raise "Multiple secrets found with label '#{label}': use id to disambiguate" if items.length > 1
+        # No title matches: the identifier may be an item id
+        items = @api.read("v1/vaults/#{@vault_id}/items").select { |item| item['id'] == label } if items.empty?
         raise "Secret '#{label}' not found" if items.empty? && exception
         items.first&.fetch('id')
       end
@@ -72,14 +75,16 @@ module Aspera
         fields = []
         fields << {'id' => FIELD_USERNAME, 'type' => 'STRING',    'value' => options[:username]}    if options[:username]
         fields << {'id' => FIELD_PASSWORD, 'type' => 'CONCEALED', 'value' => options[:password]}    if options[:password]
-        fields << {'id' => FIELD_URL,      'type' => 'URL',       'value' => options[:url]}         if options[:url]
         fields << {'id' => FIELD_NOTES_ID, 'type' => 'STRING',    'value' => options[:description]} if options[:description]
-        {
+        item = {
           'title'    => options[:label],
           'category' => ITEM_CATEGORY.upcase,
           'vault'    => {'id' => @vault_id},
           'fields'   => fields
         }
+        # Website of the item
+        item['urls'] = [{'href' => options[:url], 'primary' => true}] if options[:url]
+        item
       end
     end
   end

data/lib/aspera/keychain/one_password_base.rb

@@ -18,16 +18,21 @@ module Aspera
       private
 
       # Convert a 1Password item JSON object to a keychain secret Hash.
-      # Accepts both API Connect items (field keyed by 'id') and CLI items
-      # (field keyed by 'id' falling back to 'label').
+      # Same JSON schema for API Connect and CLI items.
+      # Built-in fields are found by `id`, custom fields (generated `id`) by `label`.
+      # URL is the website of the item, or a custom field `url` (created by previous versions).
       def item_to_secret(item)
-        fields = Array(item['fields']).to_h { |f| [f['id'] || f['label'], f['value']] }
-        secret = {label: item['title']}
-        secret[:username]    = fields[FIELD_USERNAME] unless fields[FIELD_USERNAME].nil?
-        secret[:password]    = fields[FIELD_PASSWORD] unless fields[FIELD_PASSWORD].nil?
-        secret[:url]         = fields[FIELD_URL]      unless fields[FIELD_URL].nil?
-        secret[:description] = fields[FIELD_NOTES_ID] unless fields[FIELD_NOTES_ID].nil?
-        return secret
+        fields = Array(item['fields'])
+        by_id = fields.to_h { |f| [f['id'], f['value']] }
+        by_label = fields.to_h { |f| [f['label'], f['value']] }
+        urls = Array(item['urls'])
+        values = {
+          username:    by_id[FIELD_USERNAME] || by_label[FIELD_USERNAME],
+          password:    by_id[FIELD_PASSWORD] || by_label[FIELD_PASSWORD],
+          url:         (urls.find { |u| u['primary'] } || urls.first)&.[]('href') || by_id[FIELD_URL] || by_label[FIELD_URL],
+          description: by_id[FIELD_NOTES_ID] || by_label[FIELD_NOTES_ID]
+        }
+        return {label: item['title']}.merge(values.compact)
       end
     end
   end

data/lib/aspera/keychain/one_password_cli.rb

@@ -42,10 +42,11 @@ module Aspera
 
       def set(options)
         validate_set(options)
+        assert_new_label(options[:label])
         args = ['item', 'create', '--category', ITEM_CATEGORY, "--title=#{options[:label]}"]
+        args << "--url=#{options[:url]}"                            if options[:url]
         args << "#{FIELD_USERNAME}=#{options[:username]}"           if options[:username]
         args << "#{FIELD_PASSWORD}[password]=#{options[:password]}" if options[:password]
-        args << "#{FIELD_URL}[url]=#{options[:url]}"                if options[:url]
         args << "#{FIELD_NOTES_ID}=#{options[:description]}"        if options[:description]
         op_run(*args)
         nil
@@ -53,8 +54,9 @@ module Aspera
 
       def get(label:, id: nil, exception: true)
         identifier = id || label
-        stdout, _stderr, status = op_capture('item', 'get', identifier, '--format=json')
+        stdout, stderr, status = op_capture('item', 'get', identifier, '--format=json', exception: false)
         if !status.success?
+          raise "Multiple secrets found with label '#{label}': use id to disambiguate, or option vault to restrict" if stderr.to_s.match?(/more than one item/i)
           raise "Secret '#{label}' not found" if exception
           return
         end

data/lib/aspera/log.rb

@@ -110,11 +110,8 @@ module Aspera
         return unless instance.logger.send(:"#{level}?")
         Aspera.assert(object.nil? || block.nil?, 'Use either object, or block, not both')
         object = yield if block_given?
-        instance.logger.send(level, obj_dump(name, object))
-      end
-
-      # @return [String] Dump of object
-      def obj_dump(name, object)
+        # Secrets hidden by key name in the structure, whatever the dump format (the log formatter then hides secrets in text)
+        object = SecretHider.instance.hidden_copy(object) unless SecretHider.instance.log_secrets
         dump_text =
           case instance.dump_format
           when :json
@@ -123,7 +120,7 @@ module Aspera
             PP.pp(object, +'')
           else Aspera.error_unexpected_value(instance.dump_format) { 'dump format' }
           end
-        "#{name.to_s.green}(#{instance.dump_format})#{object.class}=\n#{dump_text}"
+        instance.logger.send(level, "#{name.to_s.green}(#{instance.dump_format})#{object.class}=\n#{dump_text}")
       end
 
       # Capture the output of $stderr and log it at debug level