fripa 0.3.0 → 0.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2ac5a037cb023bb2f087a6d3f6482c4ca8fa8a1e7f7b70d7a01d88e8e7e62db8
-  data.tar.gz: a7f6e6894ee51a0195f4555e482e29752188805c0c908791232bc8fa7db272f0
+  metadata.gz: 0e46b8ee8ebb691b57a6f5f72f9bcb5b577bca894aebaefc694f28e621038a2e
+  data.tar.gz: 991e2a655e038c28a19be01f2acf6c1e780504b4adb6279788bfff243e5ee0e1
 SHA512:
-  metadata.gz: be1d590702cd1e50e0995b6e8b65683c691ec0f03522ff755126645566d7f87cbd7be9c311db970900ee6b28a3931a5563cadd7cae1c9d24d3982b6bea94c3c5
-  data.tar.gz: 9acd2a8785b03cabf3a4902db60efdc6e5c895137759c8371ecf7577ce94f8c37daab75631ed81ea4918cfe795ebf74e23af716fcf3bfbfa3fdde4bd2b3e19d3
+  metadata.gz: 9b5bb37ed15a9909fc9e035455dc96dd0204e28b22db211d1a930f16e3f0e93168661a6736d2cbca77cfcab990409684ad7b4e3b4cd9abb2d17e0793bc3cdf64
+  data.tar.gz: 6a0f3c1cf130a5b05e621dc07b6199684dcc4ffd22bcdfa6e0a531bd3c757709d40f1530166157c29360bd33dfbcc576211d0b2916148e344e2130988d4848b8

data/CHANGELOG.md

@@ -6,6 +6,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [0.4.0] - 2026-10-16
+
+### Added
+- `Fripa::Client#batch!`: like `batch`, but raises `Fripa::BatchError` (a `Fripa::ResponseError`) when any command failed. `#errors` lists each failed command (index, method, code, name, message); `#code` and `#message` are those of the first one.
+- Vault batch commands: `vault.add_command`, `archive_command`, `add_member_command` and `delete_command` return `[method, args, options]` for `Client#batch`, so many vault operations go in one request. `archive_command` wraps the data with the transport certificate, like `archive`. When a transport command fails in `batch!`, the certificate is forgotten and fetched again on the next call, as with `archive`.
+
 ## [0.3.0] - 2026-10-15
 
 ### Changed

data/README.md

@@ -273,6 +273,27 @@ result.dig("result", "results").each { |r| puts r["error"] || r["result"] }
 ```
 
 `batch` does not raise for errors in a single command. Check `error` in each result.
+`batch!` raises `Fripa::BatchError` when any command failed. `#errors` lists them, with
+the index, method, code, name and message of each:
+
+```ruby
+client.batch!(["vault_del", ["v1"]], ["vault_del", ["v2"]])
+rescue Fripa::BatchError => e
+  e.errors # => [{ index: 1, method: "vault_del", code: 4001, name: "NotFound", message: "v2: vault not found" }]
+```
+
+The vault resource builds batch commands with `add_command`, `archive_command`,
+`add_member_command` and `delete_command`. They take the same arguments as `add`,
+`archive`, `add_member` and `delete`, so you can set up many vaults in one request:
+
+```ruby
+vault = client.vault
+client.batch!(*%w[v1 v2].flat_map do |cn|
+  [vault.add_command(cn, shared: true),
+   vault.archive_command(cn, data: "secret", shared: true),
+   vault.add_member_command(cn, user: ["alice"], shared: true)]
+end)
+```
 
 #### Using Raw API Calls
 

data/lib/fripa/batch.rb

@@ -0,0 +1,39 @@
+# frozen_string_literal: true
+
+module Fripa
+  # Batch calls for Fripa::Client: many commands in one HTTP request.
+  module Batch
+    # Sends several commands in one HTTP request. Each command is
+    # [method, args = [], options = {}]. Per-command errors are not raised:
+    # check result["result"]["results"][i]["error"].
+    def batch(*commands)
+      requests = commands.map do |method, args = [], options = {}|
+        { method: method, params: [args, options.merge(version: config.api_version)] }
+      end
+      call("batch", requests)
+    end
+
+    # Commands wrapped with the vault transport certificate (see Resources::Vault#archive_command).
+    TRANSPORT_COMMANDS = %w[vault_archive_internal vault_retrieve_internal].freeze
+
+    # Like batch, but raises Fripa::BatchError when any command failed.
+    # Like Resources::Vault#archive, a failed transport command forgets the certificate, so the next
+    # call fetches it again (e.g. after the server renewed it).
+    def batch!(*commands)
+      batch(*commands).tap { |response| BatchError.check!(commands, response) }
+    rescue BatchError => e
+      forget_transport_cert_after(e)
+      raise
+    end
+
+    private
+
+    def forget_transport_cert_after(error)
+      return unless error.errors.any? do |failed|
+        TRANSPORT_COMMANDS.include?(failed[:method]) && failed[:code] != Resources::Vault::NOT_FOUND
+      end
+
+      Resources::Vault.forget_transport_cert(config.base_url.to_s)
+    end
+  end
+end

data/lib/fripa/client.rb

@@ -5,6 +5,8 @@ require "json"
 
 module Fripa
   class Client
+    include Batch
+
     API_PATH = "/ipa/session/json"
     API_VERSION = Configuration::DEFAULT_API_VERSION
     UNAUTHORIZED = 401
@@ -64,16 +66,6 @@ module Fripa
       parse_response(response)
     end
 
-    # Sends several commands in one HTTP request. Each command is
-    # [method, args = [], options = {}]. Per-command errors are not raised:
-    # check result["result"]["results"][i]["error"].
-    def batch(*commands)
-      requests = commands.map do |method, args = [], options = {}|
-        { method: method, params: [args, options.merge(version: config.api_version)] }
-      end
-      call("batch", requests)
-    end
-
     # Shared by Authenticator, so login and API calls reuse one connection.
     def connection
       @connection ||= Faraday.new(url: config.base_url.to_s, request: request_options) do |f|

data/lib/fripa/errors.rb

@@ -15,6 +15,31 @@ module Fripa
     end
   end
 
+  # Raised by Client#batch! when one or more commands of the batch failed. #errors lists them:
+  # { index:, method:, code:, name:, message: }. #code and #message are those of the first one.
+  # #data holds every result of the batch.
+  class BatchError < ResponseError
+    attr_reader :errors
+
+    def initialize(errors, results)
+      @errors = errors
+      first = errors.first
+      super(code: first[:code], message: "#{first[:method]}: #{first[:message]}", data: results)
+    end
+
+    # Raises a BatchError if any result of the batch response holds an error.
+    def self.check!(commands, response)
+      results = response.dig("result", "results") || []
+      errors = results.each_with_index.filter_map do |result, index|
+        next unless result["error"]
+
+        { index: index, method: commands[index].first, code: result["error_code"],
+          name: result["error_name"], message: result["error"] }
+      end
+      raise new(errors, results) if errors.any?
+    end
+  end
+
   # Raised when FreeIPA answers without an error but reports per-entry failures,
   # e.g. group_add_member with a user that does not exist or is already a member.
   # Only raised with config.raise_on_partial_failure = true.

data/lib/fripa/resources/vault.rb

@@ -33,20 +33,14 @@ module Fripa
       end
 
       def add(cn, **scope)
-        validate_identifier!(cn, "cn")
-        call("vault_add_internal", [cn], { ipavaulttype: "standard" }.merge(scope))
+        call(*add_command(cn, **scope))
       end
 
       # ipa_format: true stores the data like `ipa vault-archive`, so the ipa CLI can read it.
       # The default (false) stores the raw bytes, as in previous versions.
       def archive(cn, data:, ipa_format: false, **scope)
-        validate_identifier!(cn, "cn")
-        data = VaultTransport.to_ipa_format(data) if ipa_format
-        payload = VaultTransport.wrap(data, transport_cert_der)
-        with_transport_cert_refresh do
-          call("vault_archive_internal", [cn],
-               binary_encode(payload).merge(wrapping_algo: VaultTransport::WRAPPING_ALGO).merge(scope))
-        end
+        command = archive_command(cn, data:, ipa_format:, **scope)
+        with_transport_cert_refresh { call(*command) }
       end
 
       # ipa_format: true reads data stored by `ipa vault-archive` (or archive with ipa_format: true).
@@ -66,13 +60,36 @@ module Fripa
       end
 
       def add_member(cn, **scope)
-        validate_identifier!(cn, "cn")
-        call("vault_add_member", [cn], scope)
+        call(*add_member_command(cn, **scope))
       end
 
       def delete(cn, **scope)
+        call(*delete_command(cn, **scope))
+      end
+
+      # The *_command methods build [method, args, options] for Client#batch, so many vault
+      # operations go in one request. archive_command wraps the data like archive does.
+      def add_command(cn, **scope)
+        validate_identifier!(cn, "cn")
+        ["vault_add_internal", [cn], { ipavaulttype: "standard" }.merge(scope)]
+      end
+
+      def archive_command(cn, data:, ipa_format: false, **scope)
+        validate_identifier!(cn, "cn")
+        data = VaultTransport.to_ipa_format(data) if ipa_format
+        payload = VaultTransport.wrap(data, transport_cert_der)
+        ["vault_archive_internal", [cn],
+         binary_encode(payload).merge(wrapping_algo: VaultTransport::WRAPPING_ALGO).merge(scope)]
+      end
+
+      def add_member_command(cn, **scope)
+        validate_identifier!(cn, "cn")
+        ["vault_add_member", [cn], scope]
+      end
+
+      def delete_command(cn, **scope)
         validate_identifier!(cn, "cn")
-        call("vault_del", [cn], scope)
+        ["vault_del", [cn], scope]
       end
 
       private

data/lib/fripa/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Fripa
-  VERSION = "0.3.0"
+  VERSION = "0.4.0"
 end

data/lib/fripa.rb

@@ -9,6 +9,7 @@ require_relative "fripa/resources/user"
 require_relative "fripa/resources/group"
 require_relative "fripa/vault_transport"
 require_relative "fripa/resources/vault"
+require_relative "fripa/batch"
 require_relative "fripa/client"
 
 module Fripa

data/sig/fripa.rbs

@@ -54,6 +54,13 @@ module Fripa
     def initialize: (code: Integer?, message: String?, ?data: untyped) -> void
   end
 
+  class BatchError < ResponseError
+    attr_reader errors: Array[Hash[Symbol, untyped]]
+
+    def initialize: (Array[Hash[Symbol, untyped]] errors, Array[json_hash] results) -> void
+    def self.check!: (Array[Array[untyped]] commands, json_hash response) -> void
+  end
+
   class PartialFailureError < ResponseError
     def initialize: (json_hash failed) -> void
     def self.failures: (untyped failed) -> Array[untyped]
@@ -79,6 +86,7 @@ module Fripa
     def authenticator: () -> Authenticator
     def call: (String method, ?Array[untyped] args, ?Hash[Symbol, untyped] options) -> json_hash
     def batch: (*Array[untyped] commands) -> json_hash
+    def batch!: (*Array[untyped] commands) -> json_hash
     def connection: () -> untyped
     def referer: () -> String
   end
@@ -157,6 +165,10 @@ module Fripa
       def retrieve: (String cn, ?ipa_format: bool, **untyped scope) -> String?
       def add_member: (String cn, **untyped scope) -> json_hash
       def delete: (String cn, **untyped scope) -> json_hash
+      def add_command: (String cn, **untyped scope) -> [String, Array[String], Hash[Symbol, untyped]]
+      def archive_command: (String cn, data: String, ?ipa_format: bool, **untyped scope) -> [String, Array[String], Hash[Symbol, untyped]]
+      def add_member_command: (String cn, **untyped scope) -> [String, Array[String], Hash[Symbol, untyped]]
+      def delete_command: (String cn, **untyped scope) -> [String, Array[String], Hash[Symbol, untyped]]
     end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: fripa
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 0.4.0
 platform: ruby
 authors:
 - Bruno Costanzo
@@ -50,6 +50,7 @@ files:
 - README.md
 - lib/fripa.rb
 - lib/fripa/authenticator.rb
+- lib/fripa/batch.rb
 - lib/fripa/client.rb
 - lib/fripa/configuration.rb
 - lib/fripa/errors.rb
@@ -83,7 +84,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.10
+rubygems_version: 4.0.20
 specification_version: 4
 summary: Ruby client for FreeIPA JSON-RPC API
 test_files: []