captive-cli 1.2.0 → 1.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 29616a82b79478784474098a994449670c0e5ba17c4ddbc10b773168adbd5480
-  data.tar.gz: 5dfa16e3181afafa0f3800bfbacce3b07ab0eac18f3863a785b58b66fa4726d4
+  metadata.gz: 377f77798282f817bcd1632482c5075ca10f8c65f1b5ce9abc4e7d3f1aeae2ee
+  data.tar.gz: ef1dc980b18c772c703a7b94ee35a3c35049b22d84ffeca742ee5ce569a32f7e
 SHA512:
-  metadata.gz: 66462246f725f169bdd2c74e41bf896774fc821961afd12171455b1c4ce2ef94006c3f091203bb7495f8ba70e97e15a6c194ac21100a38b3072c8c6f960f8955
-  data.tar.gz: 4c78529a60c79c0021dcb53a8f124b9fd4a706caa05cb22bb65a4f3a25687b0c288f329301c51628c6f9b216822d7ddbc3e745698f609c2834dc181d93eaef12
+  metadata.gz: e058db4108f3da4be9dd9c6e5699f1cdb5419463cfe93300cd96dbd8bf612894f23bf97fab095480edc22e70a9c98f4e172e56edb78e8c1108bac3c66b1918be
+  data.tar.gz: 8f199adf232216645878442735570e5ee04a70dd4a8f43031bd0e24d67c12f7af7f5ab8ba7e4de2accfb6143a5801f09fa5b173cf80ed88a9e43ceff5d31a3f2

data/lib/captive/cli/dependencies.rb

@@ -24,6 +24,7 @@ module Captive
     def apps_api  = @apps_api  ||= Dashboard::AppsResource.new(api: dashboard)
     def env_api   = @env_api   ||= Dashboard::EnvVarsResource.new(api: dashboard)
     def crons_api = @crons_api ||= Dashboard::ScheduledTasksResource.new(api: dashboard)
+    def domains_api = @domains_api ||= Dashboard::DomainsResource.new(api: dashboard)
 
     def active_kubeconfig
       env_kc = ENV["KUBECONFIG"]

data/lib/captive/cli.rb

@@ -6,8 +6,11 @@ require_relative "cli/dependencies"
 require_relative "commands/apps_commands"
 require_relative "commands/env_commands"
 require_relative "commands/crons_commands"
+require_relative "commands/domains_commands"
 require_relative "commands/db_commands"
 require_relative "commands/user_login"
+require_relative "commands/auth_commands"
+require_relative "credentials_store"
 require_relative "dashboard_client"
 require_relative "github_device_flow"
 require_relative "cluster_endpoint"
@@ -23,13 +26,7 @@ module Captive
     def self.start(args = ARGV, config = {})
       args = [ "help", args.first ] if args.length == 2 && %w[--help -h].include?(args.last)
 
-      case UpdateChecker.new.check
-      when :blocked
-        warn "Version #{VERSION} n'est plus supportée. Mettez à jour : brew upgrade captive-studio/tap/captive-cli"
-        exit 1
-      when :update_available
-        warn "⚠ Nouvelle version disponible. Mettez à jour : brew upgrade captive-studio/tap/captive-cli"
-      end
+      check_for_update unless args.first(2) == %w[auth token]
       super
     rescue AuthError, NotAuthenticatedError, NoTtyError, MissingDependencyError, DashboardError => e
       warn e.message
@@ -40,6 +37,19 @@ module Captive
       exit 1
     end
 
+    # kubectl appelle `captive auth token` à chaque commande : ni requête réseau en plus, ni
+    # avertissement à afficher.
+    def self.check_for_update
+      case UpdateChecker.new.check
+      when :blocked
+        warn "Version #{VERSION} n'est plus supportée. Mettez à jour : brew upgrade captive-studio/tap/captive-cli"
+        exit 1
+      when :update_available
+        warn "⚠ Nouvelle version disponible. Mettez à jour : brew upgrade captive-studio/tap/captive-cli"
+      end
+    end
+    private_class_method :check_for_update
+
     # ── Subcommands ─────────────────────────────────────────────────────────
     desc "apps SUBCOMMAND", "Gestion des apps"
     subcommand "apps", Commands::AppsCommands
@@ -53,6 +63,12 @@ module Captive
     desc "crons SUBCOMMAND", "Tâches planifiées d'une app"
     subcommand "crons", Commands::CronsCommands
 
+    desc "domains SUBCOMMAND", "Domaines d'une app"
+    subcommand "domains", Commands::DomainsCommands
+
+    desc "auth SUBCOMMAND", "Jeton pour kubectl", hide: true
+    subcommand "auth", Commands::AuthCommands
+
     # ── Root commands ────────────────────────────────────────────────────────
     map "--version" => :version
     desc "version", "Affiche la version de la CLI"
@@ -69,7 +85,7 @@ module Captive
       Commands::UserLogin.new(
         github:          GithubDeviceFlow.new,
         cluster:         ClusterEndpoint.new,
-        token_path:      File.expand_path("~/.config/captive/token"),
+        store:           CredentialsStore.new,
         kubeconfig_path: File.expand_path("~/.config/captive/kubeconfig")
       ).call
       puts "Authentifié avec succès."

data/lib/captive/commands/auth_commands.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+require_relative "auth_token"
+require_relative "../session_token"
+
+module Captive
+  module Commands
+    # `captive auth` : ce dont kubectl a besoin pour s'authentifier, masqué de l'aide.
+    class AuthCommands < Thor
+      def self.exit_on_failure? = true
+
+      desc "token", "Imprime un ExecCredential pour kubectl (appelé par le kubeconfig)"
+      def token = AuthToken.new(session: SessionToken.new).call
+    end
+  end
+end

data/lib/captive/commands/auth_token.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+require "json"
+require "time"
+
+module Captive
+  module Commands
+    # Le plugin d'authentification exec de kubectl : un ExecCredential sur stdout, et rien d'autre.
+    class AuthToken
+      def initialize(session:, out: $stdout)
+        @session = session
+        @out     = out
+      end
+
+      def call
+        @out.puts JSON.generate(exec_credential(@session.current))
+      end
+
+      private
+
+      def exec_credential(credentials)
+        expires_at = credentials.expires_at
+        status = { token: credentials.access_token }
+        status[:expirationTimestamp] = expires_at.utc.iso8601 if expires_at
+        { apiVersion: "client.authentication.k8s.io/v1", kind: "ExecCredential", status: status }
+      end
+    end
+  end
+end

data/lib/captive/commands/domain_announcer.rb

@@ -0,0 +1,32 @@
+# frozen_string_literal: true
+
+require_relative "../errors"
+
+module Captive
+  module Commands
+    # Dit ce qu'est devenu un geste sur un Domaine. Sans attente, la demande est seulement
+    # acceptée ; avec une attente, le bloc la reçoit et rend le Domaine appliqué.
+    class DomainAnnouncer
+      def initialize(paint:, presenter:, waiter: nil)
+        @paint     = paint
+        @presenter = presenter
+        @waiter    = waiter
+      end
+
+      def call(message)
+        return puts(@paint.green("  ✓ #{message} : #{CLIDependencies::ASYNC_NOTICE}")) unless @waiter
+
+        applied(message, yield(@waiter))
+      rescue PollTimeout => timeout
+        abort @paint.red("✗ Timeout : #{timeout.message}")
+      end
+
+      private
+
+      def applied(message, entry)
+        puts @paint.green("  ✓ #{message} : appliqué")
+        puts "  #{@presenter.line(entry)}" if entry
+      end
+    end
+  end
+end

data/lib/captive/commands/domain_wait.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+require_relative "../poller"
+require_relative "../errors"
+
+module Captive
+  module Commands
+    # Attend que le cluster reflète un geste sur un Domaine : ni en attente ni échoué, et
+    # présent (absent après une suppression). Le DNS n'entre pas en compte : il dépend du
+    # propriétaire du Domaine, pas de Captive.
+    class DomainWait
+      def initialize(domains:, poller: nil, timeout: 600)
+        @domains = domains
+        @poller  = poller || Poller.new(interval: 10, timeout: timeout)
+      end
+
+      # Rend le Domaine tel que le cluster le montre une fois le geste appliqué.
+      def until_applied(app, hostname)
+        entry = nil
+        poll(app, hostname) { |found| (entry = found) && !found["pending"] }
+        entry
+      end
+
+      def until_gone(app, hostname)
+        poll(app, hostname, &:nil?)
+        nil
+      end
+
+      private
+
+      def poll(app, hostname)
+        @poller.poll_until(context: "#{hostname} sur #{app}") do
+          yield check(hostname, @domains.find(app, hostname))
+        end
+      end
+
+      def check(hostname, entry)
+        return entry unless entry&.fetch("failed", false)
+
+        raise DomainChangeFailed, "#{hostname} : #{entry["failure_reason"] || "échec"}"
+      end
+    end
+  end
+end

data/lib/captive/commands/domains_commands.rb

@@ -0,0 +1,108 @@
+# frozen_string_literal: true
+
+module Captive
+  module Commands
+    # Les Domaines d'une app via le dashboard. Chaque geste est appliqué plus tard par
+    # captive-platform ; --wait attend que le cluster le reflète.
+    class DomainsCommands < Thor
+      include CLIDependencies
+
+      def self.exit_on_failure? = true
+
+      WAIT_OPTIONS = {
+        wait:    { type: :boolean, desc: "Attend que le changement soit appliqué" },
+        timeout: { type: :numeric, default: 600, desc: "Attente max en secondes avec --wait" },
+      }.freeze
+
+      def self.wait_options
+        WAIT_OPTIONS.each { |name, settings| method_option(name, **settings) }
+      end
+
+      desc "list APP", "Liste les domaines de l'app et l'état de leur DNS"
+      long_desc <<~DESC
+        \x05Exemple :
+        \x05  captive domains list my-app
+        \x05  captive domains list my-app --refresh
+      DESC
+      method_option :refresh, type: :boolean, desc: "Vérifie à nouveau le DNS sans attendre le cache"
+      def list(app)
+        entries = options[:refresh] ? domains_api.recheck(app) : domains_api.list(app)
+        return puts(paint.dim("Aucun domaine.")) if entries.empty?
+
+        entries.each { |entry| puts presenter.line(entry) }
+      end
+
+      desc "add APP DOMAINE", "Ajoute un domaine à l'app"
+      long_desc <<~DESC
+        L'enregistrement DNS à créer s'affiche ensuite dans `captive domains list`.
+
+        \x05Exemple :
+        \x05  captive domains add my-app www.example.fr --wait
+      DESC
+      wait_options
+      def add(app, hostname)
+        domains_api.add(app, hostname)
+        announcer.call("#{hostname} ajouté") { |wait| wait.until_applied(app, hostname) }
+        puts paint.dim("  DNS à créer : captive domains list #{app}") unless options[:wait]
+      end
+
+      desc "rm APP DOMAINE", "Supprime un domaine de l'app"
+      long_desc <<~DESC
+        Le domaine cesse aussitôt de servir l'app : il faut le retaper pour confirmer.
+
+        \x05Exemple :
+        \x05  captive domains rm my-app www.example.fr
+        \x05  captive domains rm my-app www.example.fr --yes
+      DESC
+      method_option :yes, type: :boolean, desc: "Supprime sans demander de confirmation"
+      wait_options
+      def rm(app, hostname)
+        confirm_removal(hostname)
+        domains_api.remove(app, hostname)
+        announcer.call("#{hostname} supprimé") { |wait| wait.until_gone(app, hostname) }
+      end
+
+      desc "redirect APP DOMAINE", "Redirige un domaine vers un autre domaine de l'app"
+      long_desc <<~DESC
+        \x05Exemple :
+        \x05  captive domains redirect my-app example.fr --to www.example.fr
+      DESC
+      method_option :to, type: :string, required: true, desc: "Domaine servi vers lequel rediriger"
+      method_option :status, type: :numeric, default: 301, enum: [ 301, 302 ], desc: "Code HTTP de redirection"
+      wait_options
+      def redirect(app, hostname)
+        target = options[:to]
+        domains_api.redirect(app, hostname, { to: target, status: options[:status] })
+        announcer.call("#{hostname} redirigé vers #{target}") { |wait| wait.until_applied(app, hostname) }
+      end
+
+      desc "serve APP DOMAINE", "Repasse un domaine redirigé en domaine servi"
+      long_desc <<~DESC
+        \x05Exemple :
+        \x05  captive domains serve my-app example.fr
+      DESC
+      wait_options
+      def serve(app, hostname)
+        domains_api.serve(app, hostname)
+        announcer.call("#{hostname} servi") { |wait| wait.until_applied(app, hostname) }
+      end
+
+      private
+
+      def presenter = Presenter::Domain.new(paint: paint)
+      def domain_wait = DomainWait.new(domains: domains_api, timeout: options[:timeout])
+
+      def announcer
+        DomainAnnouncer.new(paint: paint, presenter: presenter, waiter: (domain_wait if options[:wait]))
+      end
+
+      def confirm_removal(hostname)
+        return if options[:yes]
+        return if ask("Retape #{hostname} pour confirmer la suppression :").to_s.strip == hostname
+
+        warn paint.red("Abandon : rien n'a été supprimé.")
+        exit 1
+      end
+    end
+  end
+end

data/lib/captive/commands/user_login.rb

@@ -9,36 +9,36 @@ module Captive
         def open(url) = system(open_cmd, url)
       end
 
-      def initialize(github:, cluster:, token_path:, kubeconfig_path:,
+      def initialize(github:, cluster:, store:, kubeconfig_path:,
                      ui: method(:puts), browser: Browser.new("open"))
         @github          = github
         @cluster         = cluster
-        @token_path      = token_path
+        @store           = store
         @kubeconfig_path = kubeconfig_path
         @ui              = ui
         @browser         = browser
       end
 
       def call
-        ensure_dirs
         device = @github.request_device_code
         @browser.open(device[:verification_uri])
         @ui.call("Entre le code sur #{device[:verification_uri]} : #{device[:user_code]}")
-        token = @github.poll_token(device_code: device[:device_code], interval: device[:interval])
-        File.write(@token_path, token)
-        File.chmod(0o600, @token_path)
-        File.write(@kubeconfig_path, kubeconfig_content(token))
-        File.chmod(0o600, @kubeconfig_path)
+        credentials = @github.poll_token(device_code: device[:device_code], interval: device[:interval])
+        @store.write(credentials)
+        write_kubeconfig(@cluster.fetch(credentials.access_token))
       end
 
       private
 
-      def ensure_dirs
-        [ @token_path, @kubeconfig_path ].each { |p| FileUtils.mkdir_p(File.dirname(p)) }
+      def write_kubeconfig(endpoint)
+        FileUtils.mkdir_p(File.dirname(@kubeconfig_path))
+        File.write(@kubeconfig_path, kubeconfig_content(endpoint))
+        File.chmod(0o600, @kubeconfig_path)
       end
 
-      def kubeconfig_content(token)
-        endpoint = @cluster.fetch(token)
+      # Pas de jeton dans le kubeconfig : kubectl demande à `captive auth token` un jeton
+      # renouvelé quand il le faut.
+      def kubeconfig_content(endpoint)
         <<~YAML
           apiVersion: v1
           kind: Config
@@ -50,7 +50,14 @@ module Captive
           users:
             - name: captive-user
               user:
-                token: #{token}
+                exec:
+                  apiVersion: client.authentication.k8s.io/v1
+                  command: captive
+                  args:
+                    - auth
+                    - token
+                  interactiveMode: Never
+                  provideClusterInfo: false
           contexts:
             - name: captive
               context:

data/lib/captive/credentials.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+require "time"
+
+module Captive
+  # Les jetons GitHub de l'utilisateur et leurs échéances. Un jeton sans `expires_at` vient d'une
+  # GitHub App sans expiration (ou de l'ancien fichier `token`) : il n'est jamais renouvelé.
+  Credentials = Data.define(:access_token, :refresh_token, :expires_at, :refresh_token_expires_at) do
+    def self.from_github(data, now:)
+      new(access_token:             data.fetch("access_token"),
+          refresh_token:            data["refresh_token"],
+          expires_at:               after(now, data["expires_in"]),
+          refresh_token_expires_at: after(now, data["refresh_token_expires_in"]))
+    end
+
+    def self.from_json_hash(hash)
+      new(access_token:             hash.fetch("access_token"),
+          refresh_token:            hash["refresh_token"],
+          expires_at:               parse_time(hash["expires_at"]),
+          refresh_token_expires_at: parse_time(hash["refresh_token_expires_at"]))
+    end
+
+    def self.after(now, seconds) = seconds && (now + seconds.to_i)
+    def self.parse_time(value)   = value && Time.iso8601(value)
+    private_class_method :after, :parse_time
+
+    def initialize(access_token:, refresh_token: nil, expires_at: nil, refresh_token_expires_at: nil) = super
+
+    # Moins de `margin` secondes de validité : on renouvelle avant qu'une requête n'échoue.
+    def expiring?(now, margin: 300) = expirable? && expires_at - now < margin
+    def expirable?                  = !expires_at.nil?
+    def refreshable?(now)           = !refresh_token.nil? && (refresh_token_expires_at.nil? || refresh_token_expires_at > now)
+
+    def to_json_hash
+      {
+        "access_token"             => access_token,
+        "refresh_token"            => refresh_token,
+        "expires_at"               => expires_at&.utc&.iso8601,
+        "refresh_token_expires_at" => refresh_token_expires_at&.utc&.iso8601,
+      }
+    end
+  end
+end

data/lib/captive/credentials_store.rb

@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+require "fileutils"
+require "json"
+require "securerandom"
+require_relative "credentials"
+require_relative "errors"
+
+module Captive
+  # Où vivent les jetons : `credentials.json` (0600, écrit atomiquement), et en repli l'ancien
+  # fichier `token` des postes qui ne se sont pas reconnectés depuis l'arrivée du renouvellement.
+  class CredentialsStore
+    DIR = File.expand_path("~/.config/captive")
+
+    def initialize(dir: DIR)
+      @path        = File.join(dir, "credentials.json")
+      @legacy_path = File.join(dir, "token")
+      @lock_path   = File.join(dir, "credentials.lock")
+    end
+
+    def read
+      return Credentials.from_json_hash(JSON.parse(File.read(@path))) if File.exist?(@path)
+      return Credentials.new(access_token: File.read(@legacy_path).strip) if File.exist?(@legacy_path)
+
+      raise NotAuthenticatedError, "Pas de session active. Lance : captive login"
+    end
+
+    # Un fichier temporaire renommé : un lecteur concurrent voit l'ancien contenu ou le nouveau,
+    # jamais un fichier à moitié écrit.
+    def write(credentials)
+      FileUtils.mkdir_p(File.dirname(@path))
+      tmp = "#{@path}.#{SecureRandom.hex(4)}.tmp"
+      File.write(tmp, JSON.pretty_generate(credentials.to_json_hash), perm: 0o600)
+      File.rename(tmp, @path)
+    end
+
+    # Verrou inter-processus : deux commandes (ou kubectl et une commande) ne renouvellent pas en
+    # même temps un refresh_token à usage unique.
+    def exclusively
+      FileUtils.mkdir_p(File.dirname(@lock_path))
+      File.open(@lock_path, File::RDWR | File::CREAT, 0o600) do |lock|
+        lock.flock(File::LOCK_EX)
+        yield
+      end
+    end
+  end
+end

data/lib/captive/dashboard/app_path.rb

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+module Captive
+  module Dashboard
+    # Le chemin d'une collection rattachée à une app (`/apps/:app/<collection>`), et d'un de
+    # ses éléments, chaque segment encodé.
+    AppPath = Data.define(:collection) do
+      def call(app, key = nil)
+        base = "/apps/#{DashboardApi.segment(app)}/#{collection}"
+        key ? "#{base}/#{DashboardApi.segment(key)}" : base
+      end
+    end
+  end
+end

data/lib/captive/dashboard/domains_resource.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+module Captive
+  module Dashboard
+    # Les Domaines d'une app : lus du cluster, modifiés via captive-platform (réponse 202).
+    # `recheck` relit le DNS sans attendre le cache ; une redirection est `{ to:, status: }`.
+    class DomainsResource
+      PATH = AppPath.new("domains")
+
+      def initialize(api:)
+        @api = api
+      end
+
+      def list(app)                 = @api.get(path(app))
+      def recheck(app)              = @api.get("#{path(app)}?refresh=1")
+      def find(app, hostname)       = list(app).find { |domain| domain["hostname"] == hostname }
+      def add(app, hostname)        = @api.post(path(app), { hostname: hostname })
+      def remove(app, hostname)     = @api.delete(path(app, hostname))
+      def serve(app, hostname)      = @api.patch(path(app, hostname), { mode: "serve" })
+      def redirect(app, hostname, rule) = @api.patch(path(app, hostname), rule)
+
+      private
+
+      def path(...) = PATH.call(...)
+    end
+  end
+end

data/lib/captive/dashboard/env_vars_resource.rb

@@ -4,6 +4,8 @@ module Captive
   module Dashboard
     # Les variables d'environnement d'une app : lues du Secret, écrites par set-env.
     class EnvVarsResource
+      PATH = AppPath.new("env_vars")
+
       def initialize(api:)
         @api = api
       end
@@ -18,10 +20,7 @@ module Captive
 
       private
 
-      def path(app, key = nil)
-        base = "/apps/#{DashboardApi.segment(app)}/env_vars"
-        key ? "#{base}/#{DashboardApi.segment(key)}" : base
-      end
+      def path(...) = PATH.call(...)
     end
   end
 end

data/lib/captive/dashboard/scheduled_tasks_resource.rb

@@ -4,6 +4,8 @@ module Captive
   module Dashboard
     # Les tâches planifiées d'une app : lues du cluster, déclarées via captive-platform.
     class ScheduledTasksResource
+      PATH = AppPath.new("scheduled_tasks")
+
       def initialize(api:)
         @api = api
       end
@@ -23,10 +25,7 @@ module Captive
 
       private
 
-      def path(app, name = nil)
-        base = "/apps/#{DashboardApi.segment(app)}/scheduled_tasks"
-        name ? "#{base}/#{DashboardApi.segment(name)}" : base
-      end
+      def path(...) = PATH.call(...)
     end
   end
 end

data/lib/captive/dashboard_api.rb

@@ -3,11 +3,12 @@
 require "net/http"
 require "uri"
 require "json"
-require_relative "token_file"
+require_relative "session_token"
 require_relative "dashboard_response"
 
 module Captive
-  # Le transport JSON vers l'API du dashboard : jeton GitHub en Bearer, timeouts courts, et
+  # Le transport JSON vers l'API du dashboard : jeton GitHub en Bearer (rejoué une fois renouvelé
+  # sur un 401), timeouts courts, et
   # erreurs HTTP traduites par DashboardResponse. Les chemins sont relatifs à /api.
   class DashboardApi
     BASE_URL = "https://dashboard.captive.dev"
@@ -17,7 +18,7 @@ module Captive
 
     def self.segment(value) = URI.encode_uri_component(value.to_s)
 
-    def initialize(token: TokenFile.new, base_url: BASE_URL, starter: Net::HTTP.method(:start),
+    def initialize(token: SessionToken.new, base_url: BASE_URL, starter: Net::HTTP.method(:start),
                    read_timeout: 15)
       @token        = token
       @base_url     = base_url
@@ -34,17 +35,18 @@ module Captive
 
     def request(verb, path, body = nil)
       uri = URI.parse("#{@base_url}/api#{path}")
-      req = build(verb, uri, body)
-      response = @starter.call(uri.host, uri.port, use_ssl: uri.scheme == "https",
-                                                   open_timeout: 5, read_timeout: @read_timeout) do |http|
-        http.request(req)
+      response = @token.authorize do |token|
+        @starter.call(uri.host, uri.port, use_ssl: uri.scheme == "https",
+                                          open_timeout: 5, read_timeout: @read_timeout) do |http|
+          http.request(build(verb, uri, body, token))
+        end
       end
       DashboardResponse.new(response).parse
     end
 
-    def build(verb, uri, body)
+    def build(verb, uri, body, token)
       req = VERBS.fetch(verb).new(uri.request_uri)
-      req["Authorization"] = "Bearer #{@token.read}"
+      req["Authorization"] = "Bearer #{token}"
       req["Accept"] = "application/json"
       if body
         req["Content-Type"] = "application/json"

data/lib/captive/dashboard_client.rb

@@ -5,22 +5,24 @@ require "uri"
 require "json"
 require "time"
 require_relative "errors"
+require_relative "session_token"
 
 module Captive
   class DashboardClient
     DASHBOARD_URL = "https://dashboard.captive.dev"
-    TOKEN_PATH    = File.expand_path("~/.config/captive/token")
 
     PAGE_SIZE = 500
 
-    def logs(app, start_at: nil, end_at: nil, limit: nil)
-      token = read_token
+    def initialize(session: SessionToken.new)
+      @session = session
+    end
 
+    def logs(app, start_at: nil, end_at: nil, limit: nil)
       if start_at || end_at
-        fetch_all(app, token, start_at:, end_at:)
+        fetch_all(app, start_at:, end_at:)
       else
         uri      = build_uri(app, limit: limit || PAGE_SIZE)
-        response = get(uri, token)
+        response = get(uri)
         page, _  = extract_page(handle_response(response))
         page
       end
@@ -34,20 +36,20 @@ module Captive
       body[:command] = command if command
       body[:session] = session if session
 
-      post(uri, read_token, body)
+      post(uri, body)
     end
 
     private
 
     # Pagine en remontant depuis end_at vers start_at (direction backward côté Loki).
     # Chaque page utilise le ts du log le plus ancien comme prochain curseur `before`.
-    def fetch_all(app, token, start_at:, end_at:)
+    def fetch_all(app, start_at:, end_at:)
       pages  = []
       cursor = end_at
 
       loop do
         uri      = build_uri(app, start_at:, before: cursor, limit: PAGE_SIZE)
-        response = get(uri, token)
+        response = get(uri)
         page, has_more = extract_page(handle_response(response))
 
         break if page.empty?
@@ -74,12 +76,6 @@ module Captive
       end
     end
 
-    def read_token
-      raise NotAuthenticatedError, "Pas de session active. Lance : captive login" unless File.exist?(TOKEN_PATH)
-
-      File.read(TOKEN_PATH).strip
-    end
-
     def build_uri(app, start_at: nil, end_at: nil, before: nil, limit:)
       params = { limit: }
       params[:start_at] = start_at.utc.iso8601(3) if start_at
@@ -90,21 +86,25 @@ module Captive
       uri
     end
 
-    def get(uri, token)
-      Net::HTTP.start(uri.host, uri.port, use_ssl: uri.scheme == "https",
-                      open_timeout: 5, read_timeout: 30) do |http|
-        http.get(uri.request_uri, "Authorization" => "Bearer #{token}", "Accept" => "application/json")
+    def get(uri)
+      @session.authorize do |token|
+        Net::HTTP.start(uri.host, uri.port, use_ssl: uri.scheme == "https",
+                        open_timeout: 5, read_timeout: 30) do |http|
+          http.get(uri.request_uri, "Authorization" => "Bearer #{token}", "Accept" => "application/json")
+        end
       end
     end
 
     # Timeouts courts : une console ne doit pas attendre un dashboard qui ne répond pas.
-    def post(uri, token, body)
-      Net::HTTP.start(uri.host, uri.port, use_ssl: uri.scheme == "https",
-                      open_timeout: 2, read_timeout: 5) do |http|
-        http.post(uri.request_uri, JSON.generate(body),
-                  "Authorization" => "Bearer #{token}",
-                  "Accept"        => "application/json",
-                  "Content-Type"  => "application/json")
+    def post(uri, body)
+      @session.authorize do |token|
+        Net::HTTP.start(uri.host, uri.port, use_ssl: uri.scheme == "https",
+                        open_timeout: 2, read_timeout: 5) do |http|
+          http.post(uri.request_uri, JSON.generate(body),
+                    "Authorization" => "Bearer #{token}",
+                    "Accept"        => "application/json",
+                    "Content-Type"  => "application/json")
+        end
       end
     end
 

data/lib/captive/errors.rb

@@ -9,6 +9,11 @@ module Captive
   class ExecError < StandardError; end
   class AuthError < StandardError; end
   class NotAuthenticatedError < StandardError; end
+
+  # Le refresh_token a expiré ou GitHub le refuse : seul un nouveau `captive login` rétablit l'accès.
+  class SessionExpiredError < AuthError
+    def initialize(message = "Session expirée. Lance : captive login") = super
+  end
   class NoTtyError < StandardError; end
   class MissingDependencyError < StandardError; end
 
@@ -19,4 +24,5 @@ module Captive
   class NotFoundError < DashboardError; end
   class ValidationError < DashboardError; end
   class ServiceUnavailableError < DashboardError; end
+  class DomainChangeFailed < DashboardError; end
 end

data/lib/captive/github_device_flow.rb

@@ -1,13 +1,15 @@
 # frozen_string_literal: true
 
 require_relative "http_client"
+require_relative "credentials"
 
 module Captive
   class GithubDeviceFlow
     CLIENT_ID = "Iv23liHr9n6eK4XhwtnP"
 
-    def initialize(http: HttpClient.new)
-      @http = http
+    def initialize(http: HttpClient.new, clock: -> { Time.now })
+      @http  = http
+      @clock = clock
     end
 
     RETRIABLE_ERRORS = %w[authorization_pending slow_down].freeze
@@ -19,7 +21,7 @@ module Captive
         data = @http.post("https://github.com/login/oauth/access_token",
                           client_id: CLIENT_ID, device_code: device_code,
                           grant_type: "urn:ietf:params:oauth:grant-type:device_code")
-        return data["access_token"] if data["access_token"]
+        return Credentials.from_github(data, now: @clock.call) if data["access_token"]
         raise DeviceFlowError, data["error"] unless RETRIABLE_ERRORS.include?(data["error"])
       end
     end

data/lib/captive/loader.rb

@@ -13,11 +13,14 @@ require_relative "one_off_spec"
 require_relative "session_id"
 require_relative "poller"
 require_relative "dashboard_api"
+require_relative "dashboard/app_path"
 require_relative "dashboard/apps_resource"
 require_relative "dashboard/env_vars_resource"
 require_relative "dashboard/scheduled_tasks_resource"
+require_relative "dashboard/domains_resource"
 require_relative "presenter/app_info"
 require_relative "presenter/scheduled_task"
+require_relative "presenter/domain"
 require_relative "activity_trail"
 require_relative "errors"
 require_relative "ui/spinner"
@@ -28,6 +31,8 @@ require_relative "commands/one_off_session"
 require_relative "commands/run"
 require_relative "commands/logs"
 require_relative "commands/apps_restart"
+require_relative "commands/domain_wait"
+require_relative "commands/domain_announcer"
 require_relative "commands/db_dump"
 require_relative "commands/db_restore"
 

data/lib/captive/presenter/domain.rb

@@ -0,0 +1,51 @@
+# frozen_string_literal: true
+
+module Captive
+  module Presenter
+    # Une ligne par Domaine : son nom, son état (servi, redirigé, en attente, échoué) et ce que
+    # dit le DNS. Un geste en cours masque le diagnostic, qui ne vaut que pour l'état atteint.
+    class Domain
+      HEALTH = { "certificate_pending" => "certificat en cours", "invalid" => "route refusée" }.freeze
+
+      def initialize(paint:)
+        @paint = paint
+      end
+
+      def line(entry)
+        change = change(entry)
+        [ entry["hostname"], change || reached(entry), (health(entry) unless change) ].compact.join("  ")
+      end
+
+      private
+
+      # Un geste en attente ou échoué ; nil quand le Domaine est dans l'état demandé.
+      def change(entry)
+        return failure(entry) if entry["failed"]
+
+        @paint.yellow("en attente (#{entry["pending_change"]})") if entry["pending"]
+      end
+
+      def reached(entry)
+        redirect = entry["redirect"]
+        return "→ #{redirect["to"]} (#{redirect["status"]})" if redirect
+
+        entry["primary"] ? "servi, principal" : "servi"
+      end
+
+      def failure(entry)
+        reason = entry["failure_reason"]
+        @paint.red(reason ? "échoué : #{reason}" : "échoué")
+      end
+
+      def health(entry)
+        status = entry["health"]
+        return @paint.green("✓") if status == "valid"
+
+        expected = entry.dig("dns", "expected")
+        return @paint.red("DNS à créer : #{expected.values_at("type", "name").join(" ")} → #{expected["value"]}") if expected
+
+        @paint.yellow(HEALTH.fetch(status, status.to_s))
+      end
+    end
+  end
+end

data/lib/captive/session_token.rb

@@ -0,0 +1,60 @@
+# frozen_string_literal: true
+
+require_relative "credentials_store"
+require_relative "token_refresher"
+require_relative "errors"
+
+module Captive
+  # La source unique du jeton envoyé au dashboard et à kubectl : renouvelé quand il expire dans
+  # moins de 5 minutes, ou quand le dashboard le refuse (401).
+  class SessionToken
+    INVALID = "Token invalide ou expiré. Lance : captive login"
+
+    def initialize(store: CredentialsStore.new, refresher: TokenRefresher.new, clock: -> { Time.now })
+      @store     = store
+      @refresher = refresher
+      @clock     = clock
+    end
+
+    def current
+      now         = @clock.call
+      credentials = @store.read
+      return credentials unless credentials.expiring?(now)
+
+      renew { |fresh| fresh.expiring?(now) }
+    end
+
+    # Après un 401 sur `stale_token` : renouvelle, sauf si un autre processus l'a déjà fait.
+    def refresh(stale_token)
+      renew { |fresh| fresh.access_token == stale_token }.access_token
+    end
+
+    # Pour les transports : la requête est rejouée une fois avec un jeton renouvelé sur un 401.
+    def authorize
+      token    = current.access_token
+      response = yield token
+      return response unless response.code.to_i == 401
+
+      yield refresh(token)
+    end
+
+    private
+
+    # Sous verrou, on relit : si un autre processus a renouvelé entre-temps, son jeton suffit.
+    def renew(&stale)
+      @store.exclusively do
+        fresh = @store.read
+        next fresh unless stale.call(fresh)
+
+        @refresher.refresh(refreshable(fresh).refresh_token).tap { |credentials| @store.write(credentials) }
+      end
+    end
+
+    def refreshable(credentials)
+      return credentials if credentials.refreshable?(@clock.call)
+      raise SessionExpiredError if credentials.expirable?
+
+      raise AuthError, INVALID
+    end
+  end
+end

data/lib/captive/shell_completions.rb

@@ -2,12 +2,13 @@
 
 module Captive
   module ShellCompletions
-    ROOT_COMMANDS = %w[apps env crons db login whoami console run logs version completions].freeze
+    ROOT_COMMANDS = %w[apps env crons domains db login whoami console run logs version completions].freeze
 
     SUBCOMMANDS = {
       "apps" => %w[list info restart rebuild],
       "env"  => %w[list set unset],
       "crons" => %w[list add edit rm suspend resume trigger runs],
+      "domains" => %w[list add rm redirect serve],
       "db"   => %w[restore],
     }.freeze
 
@@ -23,6 +24,7 @@ module Captive
             apps)  COMPREPLY=($(compgen -W "#{SUBCOMMANDS["apps"].join(" ")}" -- "$cur")); return ;;
             env)   COMPREPLY=($(compgen -W "#{SUBCOMMANDS["env"].join(" ")}" -- "$cur")); return ;;
             crons) COMPREPLY=($(compgen -W "#{SUBCOMMANDS["crons"].join(" ")}" -- "$cur")); return ;;
+            domains) COMPREPLY=($(compgen -W "#{SUBCOMMANDS["domains"].join(" ")}" -- "$cur")); return ;;
             db)    COMPREPLY=($(compgen -W "#{SUBCOMMANDS["db"].join(" ")}" -- "$cur")); return ;;
           esac
 

data/lib/captive/token_refresher.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+require_relative "http_client"
+require_relative "credentials"
+require_relative "errors"
+require_relative "github_device_flow"
+
+module Captive
+  # Échange un refresh_token contre de nouveaux jetons. Jeton issu du device flow : pas de
+  # client_secret. L'échange est à usage unique et invalide l'ancien couple de jetons.
+  class TokenRefresher
+    URL = "https://github.com/login/oauth/access_token"
+
+    def initialize(http: HttpClient.new, clock: -> { Time.now })
+      @http  = http
+      @clock = clock
+    end
+
+    def refresh(refresh_token)
+      data = @http.post(URL, client_id: GithubDeviceFlow::CLIENT_ID, grant_type: "refresh_token",
+                             refresh_token: refresh_token)
+      raise SessionExpiredError unless data["access_token"]
+
+      Credentials.from_github(data, now: @clock.call)
+    end
+  end
+end

data/lib/captive/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Captive
-  VERSION = "1.2.0"
+  VERSION = "1.4.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: captive-cli
 version: !ruby/object:Gem::Version
-  version: 1.2.0
+  version: 1.4.0
 platform: ruby
 authors:
 - Captive Studio
@@ -109,6 +109,8 @@ files:
 - lib/captive/cluster_endpoint.rb
 - lib/captive/commands/apps_commands.rb
 - lib/captive/commands/apps_restart.rb
+- lib/captive/commands/auth_commands.rb
+- lib/captive/commands/auth_token.rb
 - lib/captive/commands/console.rb
 - lib/captive/commands/cron_declaration.rb
 - lib/captive/commands/crons_commands.rb
@@ -118,13 +120,20 @@ files:
 - lib/captive/commands/db_psql.rb
 - lib/captive/commands/db_restore.rb
 - lib/captive/commands/db_target.rb
+- lib/captive/commands/domain_announcer.rb
+- lib/captive/commands/domain_wait.rb
+- lib/captive/commands/domains_commands.rb
 - lib/captive/commands/env_commands.rb
 - lib/captive/commands/env_set.rb
 - lib/captive/commands/logs.rb
 - lib/captive/commands/one_off_session.rb
 - lib/captive/commands/run.rb
 - lib/captive/commands/user_login.rb
+- lib/captive/credentials.rb
+- lib/captive/credentials_store.rb
+- lib/captive/dashboard/app_path.rb
 - lib/captive/dashboard/apps_resource.rb
+- lib/captive/dashboard/domains_resource.rb
 - lib/captive/dashboard/env_vars_resource.rb
 - lib/captive/dashboard/scheduled_tasks_resource.rb
 - lib/captive/dashboard_api.rb
@@ -142,13 +151,15 @@ files:
 - lib/captive/poller.rb
 - lib/captive/presenter/ansi_stripper.rb
 - lib/captive/presenter/app_info.rb
+- lib/captive/presenter/domain.rb
 - lib/captive/presenter/log_colorizer.rb
 - lib/captive/presenter/log_line.rb
 - lib/captive/presenter/scheduled_task.rb
 - lib/captive/session_id.rb
+- lib/captive/session_token.rb
 - lib/captive/shell_completions.rb
 - lib/captive/terminal.rb
-- lib/captive/token_file.rb
+- lib/captive/token_refresher.rb
 - lib/captive/ui/banner.rb
 - lib/captive/ui/spinner.rb
 - lib/captive/update_checker.rb

data/lib/captive/token_file.rb

@@ -1,20 +0,0 @@
-# frozen_string_literal: true
-
-require_relative "errors"
-
-module Captive
-  # Le jeton GitHub écrit par `captive login`, qui authentifie toutes les requêtes au dashboard.
-  class TokenFile
-    PATH = File.expand_path("~/.config/captive/token")
-
-    def initialize(path: PATH)
-      @path = path
-    end
-
-    def read
-      raise NotAuthenticatedError, "Pas de session active. Lance : captive login" unless File.exist?(@path)
-
-      File.read(@path).strip
-    end
-  end
-end