conjur-cli 4.13.1 → 4.14.0

checksums.yaml

@@ -1,7 +1,15 @@
 ---
-SHA1:
-  metadata.gz: 8e1f0f7628065a0ce442b2265afe5f31ead8eaca
-  data.tar.gz: 7779ade9cf9b10d8814e127d2e696a24fb5d6606
+!binary "U0hBMQ==":
+  metadata.gz: !binary |-
+    YzdkNTU4NDk0N2QyMmNiOWJkMDA3MzZkZmNhMTg2NjZiNTQzZTMwYw==
+  data.tar.gz: !binary |-
+    ODE1ODg4ZGMyZGYzYTBiYTNmNzMzMWZlNjUwYjdjZjc4NDZjYWJkOA==
 SHA512:
-  metadata.gz: 4caf67febf27ac99ccbb1183a5371f04c6c768b643172f78bef981917762da18d5cbc519b92675b54f1acb0af867e75fde053f4747d4a397a6f7730e4a47cbe8
-  data.tar.gz: 0efb81a0af8cdb3ec276a980507003a0785cdffc04b483f360f208dbb6971064fb53115d3b23a89b33368f979a29ceafad12d4764794145041612f2f5e69c826
+  metadata.gz: !binary |-
+    NzE2OGU2MWI2NTI4ZjQyZjBmMDQyOTQ2ZDM5OTY1YTBjNWY2MmJjMDQ0ZTNj
+    MmM2ZjkzMjRmMTZkN2UxZjc3MmM5NTAxNjg4ZjE4YjE5Y2NiMTA4ZDI2OGQy
+    YTgxZWJiZjZjZjBlMDVhZjM2OWZiOTMyYTYzMzY4MTA2YjhmYWM=
+  data.tar.gz: !binary |-
+    NjlhMjllYzZjNDMwOTdmYjg0Nzc4MGU1ZWY0ZTg3Y2JiN2EyMmJkNWMzYmIx
+    YWY5Y2U0NmE3NmJmNGYyYTRhMzdlODk1ODZkN2YzYjJiZTBmMWU5Zjg2MWFh
+    NGI3NGQ2NjU3NDBmY2NiYWY0NTAzMWU0ZDM3MjZiZDY5NGI3YTk=

data/Gemfile

@@ -1,5 +1,7 @@
 source 'https://rubygems.org'
 
+#ruby-gemset=conjur-cli
+
 # Specify your gem's dependencies in conjur.gemspec
 gemspec
 

data/lib/conjur/authn.rb

@@ -81,8 +81,7 @@ module Conjur::Authn
     end
     
     def ask_for_credentials(options = {})
-      raise "No credentials provided or found" if options[:noask]
-
+      raise "No Conjur credentials provided or found" if options[:noask]
 
       # also use stderr here, because we might be prompting for a password as part
       # of a command like user:create that we'd want to send to a file.

data/lib/conjur/command/dsl_command.rb

@@ -28,7 +28,18 @@ class Conjur::DSLCommand < Conjur::Command
       filename = nil
       script = if script = args.pop
         filename = script
-        script = File.read(script)
+        script = if File.exists?(script)
+          File.read(script)
+        else
+          require 'open-uri'
+          uri = URI.parse(script)
+          raise "Unable to read this kind of URL : #{script}" unless uri.respond_to?(:read)
+          begin
+            uri.read
+          rescue OpenURI::HTTPError
+            raise "Unable to read URI #{script} : #{$!.message}"
+          end
+        end
       else
         STDIN.read
       end

data/lib/conjur/command/env.rb

@@ -79,7 +79,8 @@ RUNLONGDESC
         env = get_env_object(options)
         runtime_environment = Hash[ env.obtain(api).map {|k,v| [k.upcase, v] } ]
         if Conjur.log 
-          Conjur.log << "Running command in the prepared environment: #{args}"
+          Conjur.log << "[conjur env] Loaded environment #{runtime_environment.keys}\n"
+          Conjur.log << "[conjur env] Running command #{args}\n"
         end
         Kernel.system(runtime_environment, *args) or exit($?.to_i) # keep original exit code in case of failure
       end

data/lib/conjur/command/init.rb

@@ -45,17 +45,16 @@ class Conjur::Command::Init < Conjur::Command
 
     c.desc "Conjur organization account name (not required for appliance)"
     c.flag ["a", "account"]
-    
+
     c.desc "Conjur SSL certificate (will be obtained from host unless provided by this option)"
     c.flag ["c", "certificate"]
 
     c.desc "File to write the configuration to"
-    c.default_value File.expand_path('~/.conjurrc')
-    c.flag ["f","file"]
-    
+    c.flag ["f", "file"]
+
     c.desc "Force overwrite of existing files"
     c.flag "force"
-    
+
     c.action do |global_options,options,args|
       hl = HighLine.new $stdin, $stderr
 
@@ -65,7 +64,7 @@ class Conjur::Command::Init < Conjur::Command
       if hostname
         Conjur.configuration.core_url = "https://#{hostname}/api"
       end
-      
+
       account = options[:account]
       account ||= if hostname
         account = Conjur::Core::API.info['account'] or raise "Expecting 'account' in Core info"
@@ -73,7 +72,7 @@ class Conjur::Command::Init < Conjur::Command
         # using .to_s to overcome https://github.com/JEG2/highline/issues/69
         hl.ask("Enter your organization account name: ").to_s
       end
-      
+
       if (certificate = options[:certificate]).blank?
         unless hostname.blank?
           connect_hostname = if hostname.include?(':')
@@ -91,28 +90,37 @@ class Conjur::Command::Init < Conjur::Command
           exit_now! "You decided not to trust the certificate" unless hl.ask("Trust this certificate (yes/no): ").strip == "yes"
         end
       end
-      
+
       exit_now! "account is required" if account.blank?
-      
-      config = { 
+
+      config = {
         account: account,
         plugins: []
       }
-      
+
       config[:appliance_url] = "https://#{hostname}/api" unless hostname.blank?
-      
+
+      config_file = File.expand_path('~/.conjurrc')
+
+      if !options[:file].nil?
+        config_file = File.expand_path(options[:file])
+      elsif ENV['CONJURRC']
+        config_file = File.expand_path(ENV['CONJURRC'])
+      end
+
       unless certificate.blank?
-        cert_file = File.join(File.dirname(options[:file]), "conjur-#{account}.pem")
+        cert_file = File.join(File.dirname(config_file), "conjur-#{account}.pem")
         config[:cert_file] = cert_file
         write_file(cert_file, options[:force]) do |f|
           f.puts certificate
         end
         puts "Wrote certificate to #{cert_file}"
       end
-      
-      write_file(options[:file], options[:force]) do |f|
+
+      write_file(config_file, options[:force]) do |f|
         f.puts YAML.dump(config.stringify_keys)
       end
+
       puts "Wrote configuration to #{options[:file]}"
     end
   end

data/lib/conjur/config.rb

@@ -24,7 +24,7 @@ require 'active_support/core_ext/hash/indifferent_access'
 module Conjur
   class Config
     @@attributes = {}
-    
+
     class << self
       def clear
         @@attributes = {}
@@ -46,9 +46,9 @@ module Conjur
       end
 
       def default_config_files
-        ['/etc/conjur.conf', user_config_files].flatten
+        ['/etc/conjur.conf', user_config_files].flatten.uniq
       end
-      
+
       def load(config_files = default_config_files)
         require 'yaml'
         require 'conjur/log'
@@ -65,12 +65,12 @@ module Conjur
           end
         end
       end
-      
+
       def apply
         require 'conjur/configuration'
         keys = Config.keys.dup
         keys.delete(:plugins)
-        
+
         cfg = Conjur.configuration
         keys.each do |k|
           if Conjur.configuration.respond_to?("#{k}_env_var") && (env_var = Conjur.configuration.send("#{k}_env_var")) && (v = ENV[env_var])
@@ -82,7 +82,7 @@ module Conjur
           value = Config[k]
           cfg.set k, value if value
         end
-  
+
         if Conjur.log
           begin
             require 'conjur/api'
@@ -95,11 +95,11 @@ module Conjur
           OpenSSL::SSL::SSLContext::DEFAULT_CERT_STORE.add_file Config[:cert_file]
         end
       end
-      
+
       def inspect
         @@attributes.inspect
       end
-      
+
       def plugins
         plugins = @@attributes['plugins']
         if plugins
@@ -108,16 +108,16 @@ module Conjur
           []
         end
       end
-      
+
       def merge(a)
         a = {} unless a
         @@attributes.deep_merge!(a.stringify_keys)
       end
-      
+
       def keys
         @@attributes.keys.map(&:to_sym)
       end
-      
+
       def [](key)
         @@attributes[key.to_s]
       end

data/lib/conjur/dsl/runner.rb

@@ -9,6 +9,7 @@ module Conjur
       include Conjur::IdentifierManipulation
       
       attr_reader :script, :filename, :context
+      attr_reader :policy_role, :policy_resource
       
       def initialize(script, filename = nil)
         @context = {
@@ -16,9 +17,10 @@ module Conjur
           "api_keys" => {}
         }
         
-        @context['env'] = Conjur.env unless Conjur.env == 'production'
+        @context['env']   = Conjur.env unless Conjur.env == 'production'
         @context['stack'] = Conjur.stack unless Conjur.stack == 'v4'
-        @context['appliance_url'] = Conjur.configuration.appliance_url unless Conjur.configuration.appliance_url.nil?
+        @context['appliance_url']   = Conjur.configuration.appliance_url unless Conjur.configuration.appliance_url.nil?
+        @context['ssl_certificate'] = File.read(Conjur::Config[:cert_file]) unless Conjur::Config[:cert_file].nil?
 
         @script = script
         @filename = filename
@@ -89,9 +91,11 @@ module Conjur
       
       def policy id, &block
         self.role "policy", id do |role|
+          @policy_role = role
           context["policy"] = role.identifier
           self.owns do
-            self.resource "policy", id do
+            self.resource "policy", id do |resource|
+              @policy_resource = resource
               scope id do
                 block.call if block_given?
               end

data/lib/conjur/version.rb

@@ -1,5 +1,5 @@
 #
-# Copyright (C) 2013 Conjur Inc
+# Copyright (C) 2014 Conjur Inc
 #
 # Permission is hereby granted, free of charge, to any person obtaining a copy of
 # this software and associated documentation files (the "Software"), to deal in
@@ -19,6 +19,6 @@
 # CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 #
 module Conjur
-  VERSION = "4.13.1"
+  VERSION = "4.14.0"
   ::Version=VERSION
 end

data/spec/command/init_spec.rb

@@ -1,7 +1,5 @@
 require 'spec_helper'
 
-tmpdir = Dir.mktmpdir
-
 GITHUB_FP = "SHA1 Fingerprint=A0:C4:A7:46:00:ED:A7:2D:C0:BE:CB:9A:8C:B6:07:CA:58:EE:74:5E"
 GITHUB_CERT = <<EOF
 -----BEGIN CERTIFICATE-----
@@ -41,10 +39,6 @@ XX4C2NesiZcLYbc2n7B9O+63M2k=
 EOF
 
 describe Conjur::Command::Init do
-  it "properly defaults to a file path" do
-    expect(Conjur::CLI.commands[:init].flags[:f].default_value).to eq("#{ENV['HOME']}/.conjurrc")
-  end
-
   describe ".get_certificate" do
     it "returns the right certificate from github" do
       fingerprint, certificate = Conjur::Command::Init.get_certificate('github.com:443')
@@ -57,12 +51,14 @@ describe Conjur::Command::Init do
     before {
       File.stub(:exists?).and_return false
     }
+
     context "auto-fetching fingerprint" do
       before {
         HighLine.any_instance.stub(:ask).with("Enter the hostname (and optional port) of your Conjur endpoint: ").and_return "the-host"
         Conjur::Command::Init.stub get_certificate: ["the-fingerprint", nil]
         HighLine.any_instance.stub(:ask).with(/^Trust this certificate/).and_return "yes"
       }
+
       describe_command 'init' do
         it "fetches account and writes config file" do
           # Stub hostname
@@ -71,6 +67,7 @@ describe Conjur::Command::Init do
           invoke
         end
       end
+
       describe_command 'init -a the-account' do
         it "writes config file" do
           File.should_receive(:open)
@@ -78,11 +75,13 @@ describe Conjur::Command::Init do
         end
       end
     end
+
     describe_command 'init -a the-account -h foobar' do
       it "can't get the cert" do
         expect { invoke }.to raise_error(GLI::CustomExit, /unable to retrieve certificate/i)
       end
     end
+
     # KEG: These tests have a nasty habit of hanging
 #    describe_command 'init -a the-account -h google.com' do
 #      it "writes the config and cert" do
@@ -98,25 +97,71 @@ describe Conjur::Command::Init do
 #        invoke
 #      end
 #    end
+
     describe_command 'init -a the-account -h localhost -c the-cert' do
       it "writes config and cert files" do
         File.should_receive(:open).twice
         invoke
       end
     end
+
     context "in a temp dir" do
-      describe_command "init -f #{tmpdir}/.conjurrc -a the-account -h localhost -c the-cert" do
+      tmpdir = Dir.mktmpdir
+
+      shared_examples "check config and cert files" do |file, env|
+        around do |example|
+          Dir.foreach(tmpdir) {|f|
+            fn = File.join(tmpdir, f)
+            File.delete(fn) if f != '.' && f != '..'
+          }
+          f = ENV.delete 'CONJURRC'
+          if not env.nil?
+            ENV['CONJURRC'] = env
+          end
+          example.run
+          ENV['CONJURRC'] = f
+        end
+
         it "writes config and cert files" do
           invoke
-          
-          expect(YAML.load(File.read(File.join(tmpdir, ".conjurrc")))).to eq({
+
+          expect(YAML.load(File.read(file))).to eq({
             account: 'the-account',
             appliance_url: "https://localhost/api",
-            cert_file: "#{tmpdir}/conjur-the-account.pem",
+            cert_file: File.join(File.dirname(file), "conjur-the-account.pem"),
             plugins: [],
           }.stringify_keys)
+        end
+      end
+      
+      context "default behavior" do
+        describe_command "init -a the-account -h localhost -c the-cert" do
+          before(:each) {
+            File.stub(:expand_path).and_call_original
+            File.stub(:expand_path).with('~/.conjurrc').and_return("#{tmpdir}/.conjurrc")
+          }
+  
+          include_examples "check config and cert files", "#{tmpdir}/.conjurrc"
+        end
+      end
 
-          File.read(File.join(tmpdir, "conjur-the-account.pem")).should == "the-cert\n"
+      context "explicit output file" do
+        describe_command "init -f #{tmpdir}/.conjurrc2 -a the-account -h localhost -c the-cert" do
+          include_examples "check config and cert files", File.join(tmpdir, ".conjurrc2")
+        end
+      end
+
+      context "to CONJURRC" do
+        describe_command "init -a the-account -h localhost -c the-cert" do
+          file = File.join(tmpdir, ".conjurrc_env")
+          include_examples "check config and cert files", file, file
+        end
+      end
+      
+      context "explicit output file overrides CONJURRC" do
+        describe_command "init -f #{tmpdir}/.conjurrc_2 -a the-account -h localhost -c the-cert" do
+          ENV['CONJURRC'] = "#{tmpdir}/.conjurrc_env_2"
+          include_examples "check config and cert files", File.join(tmpdir, ".conjurrc_2")
         end
       end
     end

data/spec/command/policy_spec.rb

@@ -22,7 +22,8 @@ describe Conjur::Command::Policy do
       double("resource", exists?: true).as_null_object
     end
     before {
-      File.stub(:read).with("policy-body").and_return "{}"
+      File.stub(:exists?).with("policy.rb").and_return true
+      File.stub(:read).with("policy.rb").and_return "{}"
       Conjur::DSL::Runner.any_instance.stub(:api).and_return api
     }
     before {
@@ -32,7 +33,17 @@ describe Conjur::Command::Policy do
       api.stub(:resource).with("the-account:policy:#{collection}/the-policy-1.0.0").and_return resource
     }
     
-    describe_command 'policy:load --collection the-collection policy-body' do
+    describe_command 'policy:load --collection the-collection http://example.com/policy.rb' do
+      let(:collection) { "the-collection" }
+      before {
+        File.stub(:exists?).with("http://example.com/policy.rb").and_return false
+        URI.stub(:parse).with("http://example.com/policy.rb").and_return double(:uri, read: "{}")
+      }
+      it "creates the policy" do
+        invoke.should == 0
+      end
+    end
+    describe_command 'policy:load --collection the-collection policy.rb' do
       let(:collection) { "the-collection" }
       it "creates the policy" do
         invoke.should == 0
@@ -43,7 +54,7 @@ describe Conjur::Command::Policy do
       before {
         stub_const("ENV", "USER" => "alice", "HOSTNAME" => "localhost")
       }
-      describe_command 'policy:load --as-group the-group policy-body' do
+      describe_command 'policy:load --as-group the-group policy.rb' do
         let(:group) { double(:group, exists?: true) }
         it "creates the policy" do
           Conjur::Command.api.stub(:role).with("the-account:group:the-group").and_return group
@@ -52,7 +63,7 @@ describe Conjur::Command::Policy do
           invoke.should == 0
         end
       end
-      describe_command 'policy:load policy-body' do
+      describe_command 'policy:load policy.rb' do
         it "creates the policy with default collection" do
           invoke.should == 0
         end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: conjur-cli
 version: !ruby/object:Gem::Version
-  version: 4.13.1
+  version: 4.14.0
 platform: ruby
 authors:
 - Rafał Rzepecki
@@ -9,125 +9,125 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2014-08-15 00:00:00.000000000 Z
+date: 2014-09-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ! '>='
       - !ruby/object:Gem::Version
         version: '0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ! '>='
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
   name: conjur-api
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ! '>='
       - !ruby/object:Gem::Version
         version: 4.10.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ! '>='
       - !ruby/object:Gem::Version
         version: 4.10.0
 - !ruby/object:Gem::Dependency
   name: gli
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ! '>='
       - !ruby/object:Gem::Version
         version: 2.8.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ! '>='
       - !ruby/object:Gem::Version
         version: 2.8.0
 - !ruby/object:Gem::Dependency
   name: highline
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ! '>='
       - !ruby/object:Gem::Version
         version: '0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ! '>='
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
   name: netrc
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ! '>='
       - !ruby/object:Gem::Version
         version: '0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ! '>='
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
   name: methadone
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ! '>='
       - !ruby/object:Gem::Version
         version: '0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ! '>='
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
   name: deep_merge
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ! '>='
       - !ruby/object:Gem::Version
         version: '0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ! '>='
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
   name: cas_rest_client
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ! '>='
       - !ruby/object:Gem::Version
         version: '0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ! '>='
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
   name: rspec
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ! '>='
       - !ruby/object:Gem::Version
         version: '2.14'
     - - <
@@ -137,7 +137,7 @@ dependencies:
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ! '>='
       - !ruby/object:Gem::Version
         version: '2.14'
     - - <
@@ -147,28 +147,28 @@ dependencies:
   name: simplecov
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ! '>='
       - !ruby/object:Gem::Version
         version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ! '>='
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
   name: aruba
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ! '>='
       - !ruby/object:Gem::Version
         version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ! '>='
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
@@ -302,12 +302,12 @@ require_paths:
 - lib
 required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
-  - - '>='
+  - - ! '>='
     - !ruby/object:Gem::Version
       version: '0'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
-  - - '>='
+  - - ! '>='
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []