captive-cli 1.2.0 → 1.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 29616a82b79478784474098a994449670c0e5ba17c4ddbc10b773168adbd5480
-  data.tar.gz: 5dfa16e3181afafa0f3800bfbacce3b07ab0eac18f3863a785b58b66fa4726d4
+  metadata.gz: f79f7992c692e80419a6da77317d0e3d50d72ee4b48d41ea6001fa3e8a968400
+  data.tar.gz: 43220b3bb3e0b9cdaae4bf96de10d80eb3145af3f52584bff1c73fb45d4e7349
 SHA512:
-  metadata.gz: 66462246f725f169bdd2c74e41bf896774fc821961afd12171455b1c4ce2ef94006c3f091203bb7495f8ba70e97e15a6c194ac21100a38b3072c8c6f960f8955
-  data.tar.gz: 4c78529a60c79c0021dcb53a8f124b9fd4a706caa05cb22bb65a4f3a25687b0c288f329301c51628c6f9b216822d7ddbc3e745698f609c2834dc181d93eaef12
+  metadata.gz: cec86c2467edb73bb4c46c520c2fb793c1c4b67800213d5ef68348aa2ddae4c91b25e85d82fe73e599fc7cb188aee96b63feb5674b10885e7aa7100027f240ac
+  data.tar.gz: a69f88f24623b2329515daff60be1df8d3092046c51cd20b995cb6a0ba58a176dc29898640a07cdc6d9904315b10a321b7d7f6cc9cb7c301e768e991d55a3980

data/lib/captive/cli.rb

@@ -8,6 +8,8 @@ require_relative "commands/env_commands"
 require_relative "commands/crons_commands"
 require_relative "commands/db_commands"
 require_relative "commands/user_login"
+require_relative "commands/auth_commands"
+require_relative "credentials_store"
 require_relative "dashboard_client"
 require_relative "github_device_flow"
 require_relative "cluster_endpoint"
@@ -23,13 +25,7 @@ module Captive
     def self.start(args = ARGV, config = {})
       args = [ "help", args.first ] if args.length == 2 && %w[--help -h].include?(args.last)
 
-      case UpdateChecker.new.check
-      when :blocked
-        warn "Version #{VERSION} n'est plus supportée. Mettez à jour : brew upgrade captive-studio/tap/captive-cli"
-        exit 1
-      when :update_available
-        warn "⚠ Nouvelle version disponible. Mettez à jour : brew upgrade captive-studio/tap/captive-cli"
-      end
+      check_for_update unless args.first(2) == %w[auth token]
       super
     rescue AuthError, NotAuthenticatedError, NoTtyError, MissingDependencyError, DashboardError => e
       warn e.message
@@ -40,6 +36,19 @@ module Captive
       exit 1
     end
 
+    # kubectl appelle `captive auth token` à chaque commande : ni requête réseau en plus, ni
+    # avertissement à afficher.
+    def self.check_for_update
+      case UpdateChecker.new.check
+      when :blocked
+        warn "Version #{VERSION} n'est plus supportée. Mettez à jour : brew upgrade captive-studio/tap/captive-cli"
+        exit 1
+      when :update_available
+        warn "⚠ Nouvelle version disponible. Mettez à jour : brew upgrade captive-studio/tap/captive-cli"
+      end
+    end
+    private_class_method :check_for_update
+
     # ── Subcommands ─────────────────────────────────────────────────────────
     desc "apps SUBCOMMAND", "Gestion des apps"
     subcommand "apps", Commands::AppsCommands
@@ -53,6 +62,9 @@ module Captive
     desc "crons SUBCOMMAND", "Tâches planifiées d'une app"
     subcommand "crons", Commands::CronsCommands
 
+    desc "auth SUBCOMMAND", "Jeton pour kubectl", hide: true
+    subcommand "auth", Commands::AuthCommands
+
     # ── Root commands ────────────────────────────────────────────────────────
     map "--version" => :version
     desc "version", "Affiche la version de la CLI"
@@ -69,7 +81,7 @@ module Captive
       Commands::UserLogin.new(
         github:          GithubDeviceFlow.new,
         cluster:         ClusterEndpoint.new,
-        token_path:      File.expand_path("~/.config/captive/token"),
+        store:           CredentialsStore.new,
         kubeconfig_path: File.expand_path("~/.config/captive/kubeconfig")
       ).call
       puts "Authentifié avec succès."

data/lib/captive/commands/auth_commands.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+require_relative "auth_token"
+require_relative "../session_token"
+
+module Captive
+  module Commands
+    # `captive auth` : ce dont kubectl a besoin pour s'authentifier, masqué de l'aide.
+    class AuthCommands < Thor
+      def self.exit_on_failure? = true
+
+      desc "token", "Imprime un ExecCredential pour kubectl (appelé par le kubeconfig)"
+      def token = AuthToken.new(session: SessionToken.new).call
+    end
+  end
+end

data/lib/captive/commands/auth_token.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+require "json"
+require "time"
+
+module Captive
+  module Commands
+    # Le plugin d'authentification exec de kubectl : un ExecCredential sur stdout, et rien d'autre.
+    class AuthToken
+      def initialize(session:, out: $stdout)
+        @session = session
+        @out     = out
+      end
+
+      def call
+        @out.puts JSON.generate(exec_credential(@session.current))
+      end
+
+      private
+
+      def exec_credential(credentials)
+        expires_at = credentials.expires_at
+        status = { token: credentials.access_token }
+        status[:expirationTimestamp] = expires_at.utc.iso8601 if expires_at
+        { apiVersion: "client.authentication.k8s.io/v1", kind: "ExecCredential", status: status }
+      end
+    end
+  end
+end

data/lib/captive/commands/user_login.rb

@@ -9,36 +9,36 @@ module Captive
         def open(url) = system(open_cmd, url)
       end
 
-      def initialize(github:, cluster:, token_path:, kubeconfig_path:,
+      def initialize(github:, cluster:, store:, kubeconfig_path:,
                      ui: method(:puts), browser: Browser.new("open"))
         @github          = github
         @cluster         = cluster
-        @token_path      = token_path
+        @store           = store
         @kubeconfig_path = kubeconfig_path
         @ui              = ui
         @browser         = browser
       end
 
       def call
-        ensure_dirs
         device = @github.request_device_code
         @browser.open(device[:verification_uri])
         @ui.call("Entre le code sur #{device[:verification_uri]} : #{device[:user_code]}")
-        token = @github.poll_token(device_code: device[:device_code], interval: device[:interval])
-        File.write(@token_path, token)
-        File.chmod(0o600, @token_path)
-        File.write(@kubeconfig_path, kubeconfig_content(token))
-        File.chmod(0o600, @kubeconfig_path)
+        credentials = @github.poll_token(device_code: device[:device_code], interval: device[:interval])
+        @store.write(credentials)
+        write_kubeconfig(@cluster.fetch(credentials.access_token))
       end
 
       private
 
-      def ensure_dirs
-        [ @token_path, @kubeconfig_path ].each { |p| FileUtils.mkdir_p(File.dirname(p)) }
+      def write_kubeconfig(endpoint)
+        FileUtils.mkdir_p(File.dirname(@kubeconfig_path))
+        File.write(@kubeconfig_path, kubeconfig_content(endpoint))
+        File.chmod(0o600, @kubeconfig_path)
       end
 
-      def kubeconfig_content(token)
-        endpoint = @cluster.fetch(token)
+      # Pas de jeton dans le kubeconfig : kubectl demande à `captive auth token` un jeton
+      # renouvelé quand il le faut.
+      def kubeconfig_content(endpoint)
         <<~YAML
           apiVersion: v1
           kind: Config
@@ -50,7 +50,14 @@ module Captive
           users:
             - name: captive-user
               user:
-                token: #{token}
+                exec:
+                  apiVersion: client.authentication.k8s.io/v1
+                  command: captive
+                  args:
+                    - auth
+                    - token
+                  interactiveMode: Never
+                  provideClusterInfo: false
           contexts:
             - name: captive
               context:

data/lib/captive/credentials.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+require "time"
+
+module Captive
+  # Les jetons GitHub de l'utilisateur et leurs échéances. Un jeton sans `expires_at` vient d'une
+  # GitHub App sans expiration (ou de l'ancien fichier `token`) : il n'est jamais renouvelé.
+  Credentials = Data.define(:access_token, :refresh_token, :expires_at, :refresh_token_expires_at) do
+    def self.from_github(data, now:)
+      new(access_token:             data.fetch("access_token"),
+          refresh_token:            data["refresh_token"],
+          expires_at:               after(now, data["expires_in"]),
+          refresh_token_expires_at: after(now, data["refresh_token_expires_in"]))
+    end
+
+    def self.from_json_hash(hash)
+      new(access_token:             hash.fetch("access_token"),
+          refresh_token:            hash["refresh_token"],
+          expires_at:               parse_time(hash["expires_at"]),
+          refresh_token_expires_at: parse_time(hash["refresh_token_expires_at"]))
+    end
+
+    def self.after(now, seconds) = seconds && (now + seconds.to_i)
+    def self.parse_time(value)   = value && Time.iso8601(value)
+    private_class_method :after, :parse_time
+
+    def initialize(access_token:, refresh_token: nil, expires_at: nil, refresh_token_expires_at: nil) = super
+
+    # Moins de `margin` secondes de validité : on renouvelle avant qu'une requête n'échoue.
+    def expiring?(now, margin: 300) = expirable? && expires_at - now < margin
+    def expirable?                  = !expires_at.nil?
+    def refreshable?(now)           = !refresh_token.nil? && (refresh_token_expires_at.nil? || refresh_token_expires_at > now)
+
+    def to_json_hash
+      {
+        "access_token"             => access_token,
+        "refresh_token"            => refresh_token,
+        "expires_at"               => expires_at&.utc&.iso8601,
+        "refresh_token_expires_at" => refresh_token_expires_at&.utc&.iso8601,
+      }
+    end
+  end
+end

data/lib/captive/credentials_store.rb

@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+require "fileutils"
+require "json"
+require "securerandom"
+require_relative "credentials"
+require_relative "errors"
+
+module Captive
+  # Où vivent les jetons : `credentials.json` (0600, écrit atomiquement), et en repli l'ancien
+  # fichier `token` des postes qui ne se sont pas reconnectés depuis l'arrivée du renouvellement.
+  class CredentialsStore
+    DIR = File.expand_path("~/.config/captive")
+
+    def initialize(dir: DIR)
+      @path        = File.join(dir, "credentials.json")
+      @legacy_path = File.join(dir, "token")
+      @lock_path   = File.join(dir, "credentials.lock")
+    end
+
+    def read
+      return Credentials.from_json_hash(JSON.parse(File.read(@path))) if File.exist?(@path)
+      return Credentials.new(access_token: File.read(@legacy_path).strip) if File.exist?(@legacy_path)
+
+      raise NotAuthenticatedError, "Pas de session active. Lance : captive login"
+    end
+
+    # Un fichier temporaire renommé : un lecteur concurrent voit l'ancien contenu ou le nouveau,
+    # jamais un fichier à moitié écrit.
+    def write(credentials)
+      FileUtils.mkdir_p(File.dirname(@path))
+      tmp = "#{@path}.#{SecureRandom.hex(4)}.tmp"
+      File.write(tmp, JSON.pretty_generate(credentials.to_json_hash), perm: 0o600)
+      File.rename(tmp, @path)
+    end
+
+    # Verrou inter-processus : deux commandes (ou kubectl et une commande) ne renouvellent pas en
+    # même temps un refresh_token à usage unique.
+    def exclusively
+      FileUtils.mkdir_p(File.dirname(@lock_path))
+      File.open(@lock_path, File::RDWR | File::CREAT, 0o600) do |lock|
+        lock.flock(File::LOCK_EX)
+        yield
+      end
+    end
+  end
+end

data/lib/captive/dashboard_api.rb

@@ -3,11 +3,12 @@
 require "net/http"
 require "uri"
 require "json"
-require_relative "token_file"
+require_relative "session_token"
 require_relative "dashboard_response"
 
 module Captive
-  # Le transport JSON vers l'API du dashboard : jeton GitHub en Bearer, timeouts courts, et
+  # Le transport JSON vers l'API du dashboard : jeton GitHub en Bearer (rejoué une fois renouvelé
+  # sur un 401), timeouts courts, et
   # erreurs HTTP traduites par DashboardResponse. Les chemins sont relatifs à /api.
   class DashboardApi
     BASE_URL = "https://dashboard.captive.dev"
@@ -17,7 +18,7 @@ module Captive
 
     def self.segment(value) = URI.encode_uri_component(value.to_s)
 
-    def initialize(token: TokenFile.new, base_url: BASE_URL, starter: Net::HTTP.method(:start),
+    def initialize(token: SessionToken.new, base_url: BASE_URL, starter: Net::HTTP.method(:start),
                    read_timeout: 15)
       @token        = token
       @base_url     = base_url
@@ -34,17 +35,18 @@ module Captive
 
     def request(verb, path, body = nil)
       uri = URI.parse("#{@base_url}/api#{path}")
-      req = build(verb, uri, body)
-      response = @starter.call(uri.host, uri.port, use_ssl: uri.scheme == "https",
-                                                   open_timeout: 5, read_timeout: @read_timeout) do |http|
-        http.request(req)
+      response = @token.authorize do |token|
+        @starter.call(uri.host, uri.port, use_ssl: uri.scheme == "https",
+                                          open_timeout: 5, read_timeout: @read_timeout) do |http|
+          http.request(build(verb, uri, body, token))
+        end
       end
       DashboardResponse.new(response).parse
     end
 
-    def build(verb, uri, body)
+    def build(verb, uri, body, token)
       req = VERBS.fetch(verb).new(uri.request_uri)
-      req["Authorization"] = "Bearer #{@token.read}"
+      req["Authorization"] = "Bearer #{token}"
       req["Accept"] = "application/json"
       if body
         req["Content-Type"] = "application/json"

data/lib/captive/dashboard_client.rb

@@ -5,22 +5,24 @@ require "uri"
 require "json"
 require "time"
 require_relative "errors"
+require_relative "session_token"
 
 module Captive
   class DashboardClient
     DASHBOARD_URL = "https://dashboard.captive.dev"
-    TOKEN_PATH    = File.expand_path("~/.config/captive/token")
 
     PAGE_SIZE = 500
 
-    def logs(app, start_at: nil, end_at: nil, limit: nil)
-      token = read_token
+    def initialize(session: SessionToken.new)
+      @session = session
+    end
 
+    def logs(app, start_at: nil, end_at: nil, limit: nil)
       if start_at || end_at
-        fetch_all(app, token, start_at:, end_at:)
+        fetch_all(app, start_at:, end_at:)
       else
         uri      = build_uri(app, limit: limit || PAGE_SIZE)
-        response = get(uri, token)
+        response = get(uri)
         page, _  = extract_page(handle_response(response))
         page
       end
@@ -34,20 +36,20 @@ module Captive
       body[:command] = command if command
       body[:session] = session if session
 
-      post(uri, read_token, body)
+      post(uri, body)
     end
 
     private
 
     # Pagine en remontant depuis end_at vers start_at (direction backward côté Loki).
     # Chaque page utilise le ts du log le plus ancien comme prochain curseur `before`.
-    def fetch_all(app, token, start_at:, end_at:)
+    def fetch_all(app, start_at:, end_at:)
       pages  = []
       cursor = end_at
 
       loop do
         uri      = build_uri(app, start_at:, before: cursor, limit: PAGE_SIZE)
-        response = get(uri, token)
+        response = get(uri)
         page, has_more = extract_page(handle_response(response))
 
         break if page.empty?
@@ -74,12 +76,6 @@ module Captive
       end
     end
 
-    def read_token
-      raise NotAuthenticatedError, "Pas de session active. Lance : captive login" unless File.exist?(TOKEN_PATH)
-
-      File.read(TOKEN_PATH).strip
-    end
-
     def build_uri(app, start_at: nil, end_at: nil, before: nil, limit:)
       params = { limit: }
       params[:start_at] = start_at.utc.iso8601(3) if start_at
@@ -90,21 +86,25 @@ module Captive
       uri
     end
 
-    def get(uri, token)
-      Net::HTTP.start(uri.host, uri.port, use_ssl: uri.scheme == "https",
-                      open_timeout: 5, read_timeout: 30) do |http|
-        http.get(uri.request_uri, "Authorization" => "Bearer #{token}", "Accept" => "application/json")
+    def get(uri)
+      @session.authorize do |token|
+        Net::HTTP.start(uri.host, uri.port, use_ssl: uri.scheme == "https",
+                        open_timeout: 5, read_timeout: 30) do |http|
+          http.get(uri.request_uri, "Authorization" => "Bearer #{token}", "Accept" => "application/json")
+        end
       end
     end
 
     # Timeouts courts : une console ne doit pas attendre un dashboard qui ne répond pas.
-    def post(uri, token, body)
-      Net::HTTP.start(uri.host, uri.port, use_ssl: uri.scheme == "https",
-                      open_timeout: 2, read_timeout: 5) do |http|
-        http.post(uri.request_uri, JSON.generate(body),
-                  "Authorization" => "Bearer #{token}",
-                  "Accept"        => "application/json",
-                  "Content-Type"  => "application/json")
+    def post(uri, body)
+      @session.authorize do |token|
+        Net::HTTP.start(uri.host, uri.port, use_ssl: uri.scheme == "https",
+                        open_timeout: 2, read_timeout: 5) do |http|
+          http.post(uri.request_uri, JSON.generate(body),
+                    "Authorization" => "Bearer #{token}",
+                    "Accept"        => "application/json",
+                    "Content-Type"  => "application/json")
+        end
       end
     end
 

data/lib/captive/errors.rb

@@ -9,6 +9,11 @@ module Captive
   class ExecError < StandardError; end
   class AuthError < StandardError; end
   class NotAuthenticatedError < StandardError; end
+
+  # Le refresh_token a expiré ou GitHub le refuse : seul un nouveau `captive login` rétablit l'accès.
+  class SessionExpiredError < AuthError
+    def initialize(message = "Session expirée. Lance : captive login") = super
+  end
   class NoTtyError < StandardError; end
   class MissingDependencyError < StandardError; end
 

data/lib/captive/github_device_flow.rb

@@ -1,13 +1,15 @@
 # frozen_string_literal: true
 
 require_relative "http_client"
+require_relative "credentials"
 
 module Captive
   class GithubDeviceFlow
     CLIENT_ID = "Iv23liHr9n6eK4XhwtnP"
 
-    def initialize(http: HttpClient.new)
-      @http = http
+    def initialize(http: HttpClient.new, clock: -> { Time.now })
+      @http  = http
+      @clock = clock
     end
 
     RETRIABLE_ERRORS = %w[authorization_pending slow_down].freeze
@@ -19,7 +21,7 @@ module Captive
         data = @http.post("https://github.com/login/oauth/access_token",
                           client_id: CLIENT_ID, device_code: device_code,
                           grant_type: "urn:ietf:params:oauth:grant-type:device_code")
-        return data["access_token"] if data["access_token"]
+        return Credentials.from_github(data, now: @clock.call) if data["access_token"]
         raise DeviceFlowError, data["error"] unless RETRIABLE_ERRORS.include?(data["error"])
       end
     end

data/lib/captive/session_token.rb

@@ -0,0 +1,60 @@
+# frozen_string_literal: true
+
+require_relative "credentials_store"
+require_relative "token_refresher"
+require_relative "errors"
+
+module Captive
+  # La source unique du jeton envoyé au dashboard et à kubectl : renouvelé quand il expire dans
+  # moins de 5 minutes, ou quand le dashboard le refuse (401).
+  class SessionToken
+    INVALID = "Token invalide ou expiré. Lance : captive login"
+
+    def initialize(store: CredentialsStore.new, refresher: TokenRefresher.new, clock: -> { Time.now })
+      @store     = store
+      @refresher = refresher
+      @clock     = clock
+    end
+
+    def current
+      now         = @clock.call
+      credentials = @store.read
+      return credentials unless credentials.expiring?(now)
+
+      renew { |fresh| fresh.expiring?(now) }
+    end
+
+    # Après un 401 sur `stale_token` : renouvelle, sauf si un autre processus l'a déjà fait.
+    def refresh(stale_token)
+      renew { |fresh| fresh.access_token == stale_token }.access_token
+    end
+
+    # Pour les transports : la requête est rejouée une fois avec un jeton renouvelé sur un 401.
+    def authorize
+      token    = current.access_token
+      response = yield token
+      return response unless response.code.to_i == 401
+
+      yield refresh(token)
+    end
+
+    private
+
+    # Sous verrou, on relit : si un autre processus a renouvelé entre-temps, son jeton suffit.
+    def renew(&stale)
+      @store.exclusively do
+        fresh = @store.read
+        next fresh unless stale.call(fresh)
+
+        @refresher.refresh(refreshable(fresh).refresh_token).tap { |credentials| @store.write(credentials) }
+      end
+    end
+
+    def refreshable(credentials)
+      return credentials if credentials.refreshable?(@clock.call)
+      raise SessionExpiredError if credentials.expirable?
+
+      raise AuthError, INVALID
+    end
+  end
+end

data/lib/captive/token_refresher.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+require_relative "http_client"
+require_relative "credentials"
+require_relative "errors"
+require_relative "github_device_flow"
+
+module Captive
+  # Échange un refresh_token contre de nouveaux jetons. Jeton issu du device flow : pas de
+  # client_secret. L'échange est à usage unique et invalide l'ancien couple de jetons.
+  class TokenRefresher
+    URL = "https://github.com/login/oauth/access_token"
+
+    def initialize(http: HttpClient.new, clock: -> { Time.now })
+      @http  = http
+      @clock = clock
+    end
+
+    def refresh(refresh_token)
+      data = @http.post(URL, client_id: GithubDeviceFlow::CLIENT_ID, grant_type: "refresh_token",
+                             refresh_token: refresh_token)
+      raise SessionExpiredError unless data["access_token"]
+
+      Credentials.from_github(data, now: @clock.call)
+    end
+  end
+end

data/lib/captive/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Captive
-  VERSION = "1.2.0"
+  VERSION = "1.3.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: captive-cli
 version: !ruby/object:Gem::Version
-  version: 1.2.0
+  version: 1.3.0
 platform: ruby
 authors:
 - Captive Studio
@@ -109,6 +109,8 @@ files:
 - lib/captive/cluster_endpoint.rb
 - lib/captive/commands/apps_commands.rb
 - lib/captive/commands/apps_restart.rb
+- lib/captive/commands/auth_commands.rb
+- lib/captive/commands/auth_token.rb
 - lib/captive/commands/console.rb
 - lib/captive/commands/cron_declaration.rb
 - lib/captive/commands/crons_commands.rb
@@ -124,6 +126,8 @@ files:
 - lib/captive/commands/one_off_session.rb
 - lib/captive/commands/run.rb
 - lib/captive/commands/user_login.rb
+- lib/captive/credentials.rb
+- lib/captive/credentials_store.rb
 - lib/captive/dashboard/apps_resource.rb
 - lib/captive/dashboard/env_vars_resource.rb
 - lib/captive/dashboard/scheduled_tasks_resource.rb
@@ -146,9 +150,10 @@ files:
 - lib/captive/presenter/log_line.rb
 - lib/captive/presenter/scheduled_task.rb
 - lib/captive/session_id.rb
+- lib/captive/session_token.rb
 - lib/captive/shell_completions.rb
 - lib/captive/terminal.rb
-- lib/captive/token_file.rb
+- lib/captive/token_refresher.rb
 - lib/captive/ui/banner.rb
 - lib/captive/ui/spinner.rb
 - lib/captive/update_checker.rb

data/lib/captive/token_file.rb

@@ -1,20 +0,0 @@
-# frozen_string_literal: true
-
-require_relative "errors"
-
-module Captive
-  # Le jeton GitHub écrit par `captive login`, qui authentifie toutes les requêtes au dashboard.
-  class TokenFile
-    PATH = File.expand_path("~/.config/captive/token")
-
-    def initialize(path: PATH)
-      @path = path
-    end
-
-    def read
-      raise NotAuthenticatedError, "Pas de session active. Lance : captive login" unless File.exist?(@path)
-
-      File.read(@path).strip
-    end
-  end
-end