vaultez-cli 0.1.0 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: '07770618a022bbabf6a89511dbeb1366ead244d90fc938435aba94bb9e7ccbbd'
-  data.tar.gz: 03afca8c6b3846442c78791cddda0232b9882d37104708b31ce8e38e4e985a11
+  metadata.gz: f2898cfe0e904ce07df993ad6cf78fd5c66b0843a6a90dccafe0fc21f94c462a
+  data.tar.gz: 1792ede773e3d10f26b7a233719690ec660402b21ce1e086e7d1a8b47f7706d9
 SHA512:
-  metadata.gz: 5346e840aa94d43ea44fb8c6a0394bc511e1d139bc812f2fcf95c4616619e35a210aa8b94b2d7616b7dfaa271a13bb8759674ae5b752c8d0239fa6742d9a50d4
-  data.tar.gz: 2dda8d7e5fb79f72d3b8b5b65dc338a5af379149b28cd949984a4ce24ad6db86b5d7b9d138eec86f331278d83246da738c5aa0235fcfa723b13c7f32db6a6614
+  metadata.gz: e920faa7ff226351174c5eb7ada3ce7c71e06a8cc0d7dabff2171d60bf7ce244afb52543763351c9705a9951474c3dfe66ae814c1af9b0a1bd089138eb573bea
+  data.tar.gz: 5efac1f679ae408baaf10bef7de70dd0c76601419f3b2b48daccf60fc1e36c635ca5546561623b55628292653e525d23e49c21fd0fbb73ffe075b10eb6d3037f

data/lib/vaultez/cli.rb

@@ -1,4 +1,5 @@
 require "thor"
+require_relative "version"
 require_relative "commands/auth"
 require_relative "commands/fetch"
 require_relative "commands/config_command"
@@ -9,17 +10,30 @@ module Vaultez
     include Vaultez::Commands::Fetch
     include Vaultez::Commands::ConfigCommand
 
-    desc "login", "Authenticate with Vaultez"
+    map %w[--version -v] => :__version
+
+    class_option :token, type: :string, banner: "TOKEN",
+                         desc: "Use a project token instead of the saved session"
+
+    def initialize(*args)
+      super
+      ENV["VAULTEZ_TOKEN"] = options[:token] if options[:token]
+    end
+
+    desc "login", "Authenticate with email, password, and 2FA code"
     long_desc <<~DESC, wrap: false
       Authenticate with your Vaultez account. You will be prompted for your
-      email and password. Your session token is stored in ~/.vaultez/config.yml.
+      email, password, and a two-factor authentication code from your authenticator
+      app (or a backup code). Your session token is stored in ~/.vaultez/config.yml.
+
+      Two-factor authentication is required for all accounts.
 
       Example:
         vaultez login
     DESC
     def login; super; end
 
-    desc "logout", "Log out and revoke your token"
+    desc "logout", "Revoke the current session token"
     long_desc <<~DESC, wrap: false
       Revokes your session token on the server and clears your local credentials.
 
@@ -28,25 +42,36 @@ module Vaultez
     DESC
     def logout; super; end
 
-    desc "fetch", "Fetch companies, projects, or secrets"
+    desc "fetch", "Fetch secrets from a project"
     long_desc <<~DESC, wrap: false
-      Fetch resources from Vaultez. The --company flag is optional when you
-      have a default company set or only belong to one company.
+      Fetch resources from Vaultez.
+
+      USER SESSION (after `vaultez login`):
+        The --company flag is optional when you have a default company set or
+        only belong to one company. Use --project to scope to a project.
 
-      Examples:
         vaultez fetch --companies
         vaultez fetch --company="Acme" --projects
         vaultez fetch --company="Acme" --project="Backend"
         vaultez fetch --company="Acme" --project="Backend" --secret="DATABASE_URL"
+
+      PROJECT TOKEN (VAULTEZ_TOKEN env var or --token flag):
+        When a project token is active, it already knows which project to use.
+        No --project flag is needed.
+
+        VAULTEZ_TOKEN=vz_... vaultez fetch
+        vaultez fetch --token=vz_... --secret="DATABASE_URL"
+
+      Project tokens can be created in the Tokens tab of your project settings.
     DESC
     option :companies, type: :boolean, desc: "List all your companies"
     option :company,   type: :string,  desc: "Company name"
     option :projects,  type: :boolean, desc: "List projects in a company"
     option :project,   type: :string,  desc: "Project name"
-    option :secret,    type: :string,  desc: "Secret name"
+    option :secret,    type: :string,  desc: "Secret name (returns value only)"
     def fetch; super; end
 
-    desc "config", "Configure Vaultez CLI settings"
+    desc "config", "Set default company or token"
     long_desc <<~DESC, wrap: false
       Update your local Vaultez CLI configuration.
 
@@ -55,5 +80,38 @@ module Vaultez
     DESC
     option :"default-company", type: :string, desc: "Set the default company"
     def config; super; end
+
+    desc "__version", "Show the installed CLI version", hide: true
+    def __version
+      puts "vaultez-cli #{Vaultez::VERSION}"
+    end
+
+    def help(command = nil, subcommand: false)
+      if command
+        super
+      else
+        puts "Vaultez CLI — secure secret management from your terminal"
+        puts
+        puts "Usage: vaultez <command> [options]"
+        puts
+        puts "Commands:"
+        puts "  login       Authenticate with email, password, and 2FA code"
+        puts "  logout      Revoke the current session token"
+        puts "  fetch       Fetch secrets from a project"
+        puts "  config      Set default company or token"
+        puts "  help        Show help for any command"
+        puts
+        puts "Options:"
+        puts "  --token     Use a project token instead of the saved session"
+        puts "  --version   Show the installed CLI version"
+        puts
+        puts "Examples:"
+        puts "  vaultez login"
+        puts "  vaultez fetch --project=\"Backend\""
+        puts "  vaultez fetch --project=\"Backend\" --secret=\"DATABASE_URL\""
+        puts "  vaultez fetch --token=\"vz_...\""
+        puts "  vaultez fetch --token=\"vz_...\" --secret=\"DATABASE_URL\""
+      end
+    end
   end
 end

data/lib/vaultez/client.rb

@@ -5,18 +5,23 @@ require "uri"
 module Vaultez
   class Client
     def initialize
-      @api_url = Vaultez::Config.api_url
-      @token   = Vaultez::Config.token
+      @api_url       = Vaultez::Config.api_url
+      @token         = Vaultez::Config.token
+      @project_token = ENV["VAULTEZ_TOKEN"]
     end
 
-    def login(email, password)
-      post("/api/v1/auth/login", { email: email, password: password }, authenticated: false)
+    def login(email, password, otp_code)
+      post("/api/v1/auth/login", { email: email, password: password, otp_code: otp_code }, authenticated: false)
     end
 
     def logout
       delete("/api/v1/auth/logout")
     end
 
+    def project_token_mode?
+      !@project_token.nil?
+    end
+
     def companies
       get("/api/v1/companies")
     end
@@ -53,8 +58,9 @@ module Vaultez
       req["Accept"]       = "application/json"
 
       if authenticated
-        raise Vaultez::NotAuthenticatedError, "Not logged in. Run `vaultez login` first." unless @token
-        req["Authorization"] = "Bearer #{@token}"
+        active_token = @project_token || @token
+        raise Vaultez::NotAuthenticatedError, "Not logged in. Run `vaultez login` first, or set VAULTEZ_TOKEN." unless active_token
+        req["Authorization"] = "Bearer #{active_token}"
       end
 
       req.body = body.to_json if body
@@ -75,9 +81,10 @@ module Vaultez
 
       case response.code.to_i
       when 200, 201 then body
-      when 401 then raise Vaultez::AuthenticationError, body["error"] || "Authentication failed"
-      when 404 then raise Vaultez::NotFoundError,       body["error"] || "Not found"
-      else          raise Vaultez::ApiError,            body["error"] || "API error (#{response.code})"
+      when 401 then raise Vaultez::AuthenticationError,    body["error"] || "Authentication failed"
+      when 403 then raise Vaultez::TwoFactorRequiredError, body["error"] || "Two-factor authentication required"
+      when 404 then raise Vaultez::NotFoundError,          body["error"] || "Not found"
+      else          raise Vaultez::ApiError,               body["error"] || "API error (#{response.code})"
       end
     end
   end

data/lib/vaultez/commands/auth.rb

@@ -11,11 +11,18 @@ module Vaultez
         system("stty echo")
         puts
 
+        puts "One-time code (Proton Authenticator / TOTP): "
+        otp_code = $stdin.gets.chomp
+
         client = Vaultez::Client.new
-        response = client.login(email, password)
+        response = client.login(email, password, otp_code)
 
         Vaultez::Config.set("token", response["token"])
         puts "Logged in successfully."
+      rescue Vaultez::TwoFactorRequiredError => error
+        puts "Error: #{error.message}"
+        puts "Set up two-factor authentication at https://vaultez.app/two_factor/new"
+        exit 1
       rescue Vaultez::AuthenticationError => error
         puts "Error: #{error.message}"
         exit 1

data/lib/vaultez/commands/fetch.rb

@@ -4,7 +4,9 @@ module Vaultez
       def fetch
         client = Vaultez::Client.new
 
-        if options[:companies]
+        if client.project_token_mode?
+          fetch_with_project_token(client)
+        elsif options[:companies]
           fetch_companies(client)
         elsif options[:projects]
           fetch_projects(client)
@@ -29,6 +31,41 @@ module Vaultez
 
       private
 
+      def fetch_with_project_token(client)
+        if options[:secret]
+          secrets = fetch_all_secrets_for_token(client)
+          secret  = secrets.find { |s| s["name"] == options[:secret] }
+          unless secret
+            puts "Error: secret \"#{options[:secret]}\" not found."
+            exit 1
+          end
+          print secret["value"]
+        else
+          secrets = fetch_all_secrets_for_token(client)
+          if secrets.empty?
+            puts "No secrets found."
+            return
+          end
+          secrets.each { |s| puts "#{s["name"]}=#{s["value"]}" }
+        end
+      end
+
+      def fetch_all_secrets_for_token(client)
+        companies = client.companies
+        company   = companies.first
+        unless company
+          puts "Error: no company found for this token."
+          exit 1
+        end
+        projects = client.projects(company["id"])
+        project  = projects.first
+        unless project
+          puts "Error: no project found for this token."
+          exit 1
+        end
+        client.secrets(project["id"])
+      end
+
       def fetch_companies(client)
         companies = client.companies
         if companies.empty?
@@ -71,7 +108,7 @@ module Vaultez
         company = resolve_company(client)
         project = resolve_project(client, company)
         secrets = client.secrets(project["id"])
-        secret  = secrets.find { |secret| secret["name"] == options[:secret] }
+        secret  = secrets.find { |s| s["name"] == options[:secret] }
 
         unless secret
           puts "Error: secret \"#{options[:secret]}\" not found in #{project["name"]}."
@@ -85,7 +122,7 @@ module Vaultez
         companies = client.companies
 
         if options[:company]
-          company = companies.find { |company| company["name"] == options[:company] }
+          company = companies.find { |c| c["name"] == options[:company] }
           unless company
             puts "Error: company \"#{options[:company]}\" not found."
             exit 1
@@ -95,13 +132,11 @@ module Vaultez
 
         default_name = Vaultez::Config.default_company
         if default_name
-          company = companies.find { |company| company["name"] == default_name }
+          company = companies.find { |c| c["name"] == default_name }
           return company if company
         end
 
-        if companies.size == 1
-          return companies.first
-        end
+        return companies.first if companies.size == 1
 
         puts "Error: multiple companies found. Specify one with --company or set a default with `vaultez config --default-company`."
         exit 1
@@ -109,7 +144,7 @@ module Vaultez
 
       def resolve_project(client, company)
         projects = client.projects(company["id"])
-        project  = projects.find { |project| project["name"] == options[:project] }
+        project  = projects.find { |p| p["name"] == options[:project] }
         unless project
           puts "Error: project \"#{options[:project]}\" not found in #{company["name"]}."
           exit 1

data/lib/vaultez/config.rb

@@ -26,7 +26,7 @@ module Vaultez
     end
 
     def self.token
-      get("token")
+      ENV["VAULTEZ_TOKEN"] || get("token")
     end
 
     def self.api_url

data/lib/vaultez/errors.rb

@@ -1,7 +1,8 @@
 module Vaultez
-  class Error                < StandardError; end
-  class NotAuthenticatedError < Error; end
-  class AuthenticationError  < Error; end
-  class NotFoundError        < Error; end
-  class ApiError             < Error; end
+  class Error                  < StandardError; end
+  class NotAuthenticatedError  < Error; end
+  class AuthenticationError    < Error; end
+  class TwoFactorRequiredError < Error; end
+  class NotFoundError          < Error; end
+  class ApiError               < Error; end
 end

data/lib/vaultez/version.rb

@@ -1,3 +1,3 @@
 module Vaultez
-  VERSION = "0.1.0"
+  VERSION = "0.2.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: vaultez-cli
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.2.0
 platform: ruby
 authors:
 - Nur Ketene