vaultez-cli 0.1.0 → 0.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: '07770618a022bbabf6a89511dbeb1366ead244d90fc938435aba94bb9e7ccbbd'
-  data.tar.gz: 03afca8c6b3846442c78791cddda0232b9882d37104708b31ce8e38e4e985a11
+  metadata.gz: 5691471c3bf1c3a9c144c9dc7a6a3acb621e786a3ff6c8dda909a37cb840f9cd
+  data.tar.gz: 33fa1a5e4031ec260923526bdb9cc4bc7b99f301fe163cc71407963d92ace921
 SHA512:
-  metadata.gz: 5346e840aa94d43ea44fb8c6a0394bc511e1d139bc812f2fcf95c4616619e35a210aa8b94b2d7616b7dfaa271a13bb8759674ae5b752c8d0239fa6742d9a50d4
-  data.tar.gz: 2dda8d7e5fb79f72d3b8b5b65dc338a5af379149b28cd949984a4ce24ad6db86b5d7b9d138eec86f331278d83246da738c5aa0235fcfa723b13c7f32db6a6614
+  metadata.gz: a2a50894e4fbcb228b1d65579d93689ca22740574b917502a1d91664a7cf63def38e047362a06fb30b323be78e95f3e154de1c9ba1d7b03c1ac6ae6aeadb75bb
+  data.tar.gz: 6f59a21a570e06772789c18b52772420427a81c58840e0db1fa7cb6750bc040c1f8eb9366ca536bd4807b831d5d5e5b8bc0d4895465f33838bae53da12d1c43f

data/lib/vaultez/cli.rb

@@ -1,4 +1,5 @@
 require "thor"
+require_relative "version"
 require_relative "commands/auth"
 require_relative "commands/fetch"
 require_relative "commands/config_command"
@@ -9,17 +10,30 @@ module Vaultez
     include Vaultez::Commands::Fetch
     include Vaultez::Commands::ConfigCommand
 
-    desc "login", "Authenticate with Vaultez"
+    map %w[--version -v] => :__version
+
+    class_option :token, type: :string, banner: "TOKEN",
+                         desc: "Use a project token instead of the saved session"
+
+    def initialize(*args)
+      super
+      ENV["VAULTEZ_TOKEN"] = options[:token] if options[:token]
+    end
+
+    desc "login", "Authenticate with email, password, and 2FA code"
     long_desc <<~DESC, wrap: false
       Authenticate with your Vaultez account. You will be prompted for your
-      email and password. Your session token is stored in ~/.vaultez/config.yml.
+      email, password, and a two-factor authentication code from your authenticator
+      app (or a backup code). Your session token is stored in ~/.vaultez/config.yml.
+
+      Two-factor authentication is required for all accounts.
 
       Example:
         vaultez login
     DESC
     def login; super; end
 
-    desc "logout", "Log out and revoke your token"
+    desc "logout", "Revoke the current session token"
     long_desc <<~DESC, wrap: false
       Revokes your session token on the server and clears your local credentials.
 
@@ -28,25 +42,37 @@ module Vaultez
     DESC
     def logout; super; end
 
-    desc "fetch", "Fetch companies, projects, or secrets"
+    desc "fetch", "Fetch secrets from a project"
     long_desc <<~DESC, wrap: false
-      Fetch resources from Vaultez. The --company flag is optional when you
-      have a default company set or only belong to one company.
+      Fetch resources from Vaultez.
+
+      USER SESSION (after `vaultez login`):
+        The --company flag is optional when you have a default company set or
+        only belong to one company. Use --project to scope to a project.
 
-      Examples:
         vaultez fetch --companies
         vaultez fetch --company="Acme" --projects
         vaultez fetch --company="Acme" --project="Backend"
         vaultez fetch --company="Acme" --project="Backend" --secret="DATABASE_URL"
+
+      PROJECT TOKEN (VAULTEZ_TOKEN env var or --token flag):
+        When a project token is active, it already knows which project to use.
+        No --project flag is needed.
+
+        VAULTEZ_TOKEN=vz_... vaultez fetch
+        vaultez fetch --token=vz_... --secret="DATABASE_URL"
+
+      Project tokens can be created in the Tokens tab of your project settings.
     DESC
     option :companies, type: :boolean, desc: "List all your companies"
     option :company,   type: :string,  desc: "Company name"
     option :projects,  type: :boolean, desc: "List projects in a company"
     option :project,   type: :string,  desc: "Project name"
-    option :secret,    type: :string,  desc: "Secret name"
+    option :secret,    type: :string,  desc: "Secret name (returns value only)"
+    option :json,      type: :boolean, desc: "Output as JSON (errors go to stderr)"
     def fetch; super; end
 
-    desc "config", "Configure Vaultez CLI settings"
+    desc "config", "Set default company or token"
     long_desc <<~DESC, wrap: false
       Update your local Vaultez CLI configuration.
 
@@ -55,5 +81,38 @@ module Vaultez
     DESC
     option :"default-company", type: :string, desc: "Set the default company"
     def config; super; end
+
+    desc "__version", "Show the installed CLI version", hide: true
+    def __version
+      puts "vaultez-cli #{Vaultez::VERSION}"
+    end
+
+    def help(command = nil, subcommand: false)
+      if command
+        super
+      else
+        puts "Vaultez CLI — secure secret management from your terminal"
+        puts
+        puts "Usage: vaultez <command> [options]"
+        puts
+        puts "Commands:"
+        puts "  login       Authenticate with email, password, and 2FA code"
+        puts "  logout      Revoke the current session token"
+        puts "  fetch       Fetch secrets from a project"
+        puts "  config      Set default company or token"
+        puts "  help        Show help for any command"
+        puts
+        puts "Options:"
+        puts "  --token     Use a project token instead of the saved session"
+        puts "  --version   Show the installed CLI version"
+        puts
+        puts "Examples:"
+        puts "  vaultez login"
+        puts "  vaultez fetch --project=\"Backend\""
+        puts "  vaultez fetch --project=\"Backend\" --secret=\"DATABASE_URL\""
+        puts "  vaultez fetch --token=\"vz_...\""
+        puts "  vaultez fetch --token=\"vz_...\" --secret=\"DATABASE_URL\""
+      end
+    end
   end
 end

data/lib/vaultez/client.rb

@@ -5,18 +5,23 @@ require "uri"
 module Vaultez
   class Client
     def initialize
-      @api_url = Vaultez::Config.api_url
-      @token   = Vaultez::Config.token
+      @api_url       = Vaultez::Config.api_url
+      @token         = Vaultez::Config.token
+      @project_token = ENV["VAULTEZ_TOKEN"]
     end
 
-    def login(email, password)
-      post("/api/v1/auth/login", { email: email, password: password }, authenticated: false)
+    def login(email, password, otp_code)
+      post("/api/v1/auth/login", { email: email, password: password, otp_code: otp_code }, authenticated: false)
     end
 
     def logout
       delete("/api/v1/auth/logout")
     end
 
+    def project_token_mode?
+      !@project_token.nil?
+    end
+
     def companies
       get("/api/v1/companies")
     end
@@ -53,8 +58,9 @@ module Vaultez
       req["Accept"]       = "application/json"
 
       if authenticated
-        raise Vaultez::NotAuthenticatedError, "Not logged in. Run `vaultez login` first." unless @token
-        req["Authorization"] = "Bearer #{@token}"
+        active_token = @project_token || @token
+        raise Vaultez::NotAuthenticatedError, "Not logged in. Run `vaultez login` first, or set VAULTEZ_TOKEN." unless active_token
+        req["Authorization"] = "Bearer #{active_token}"
       end
 
       req.body = body.to_json if body
@@ -75,9 +81,10 @@ module Vaultez
 
       case response.code.to_i
       when 200, 201 then body
-      when 401 then raise Vaultez::AuthenticationError, body["error"] || "Authentication failed"
-      when 404 then raise Vaultez::NotFoundError,       body["error"] || "Not found"
-      else          raise Vaultez::ApiError,            body["error"] || "API error (#{response.code})"
+      when 401 then raise Vaultez::AuthenticationError,    body["error"] || "Authentication failed"
+      when 403 then raise Vaultez::TwoFactorRequiredError, body["error"] || "Two-factor authentication required"
+      when 404 then raise Vaultez::NotFoundError,          body["error"] || "Not found"
+      else          raise Vaultez::ApiError,               body["error"] || "API error (#{response.code})"
       end
     end
   end

data/lib/vaultez/commands/auth.rb

@@ -11,11 +11,18 @@ module Vaultez
         system("stty echo")
         puts
 
+        puts "One-time code (Proton Authenticator / TOTP): "
+        otp_code = $stdin.gets.chomp
+
         client = Vaultez::Client.new
-        response = client.login(email, password)
+        response = client.login(email, password, otp_code)
 
         Vaultez::Config.set("token", response["token"])
         puts "Logged in successfully."
+      rescue Vaultez::TwoFactorRequiredError => error
+        puts "Error: #{error.message}"
+        puts "Set up two-factor authentication at https://vaultez.app/two_factor/new"
+        exit 1
       rescue Vaultez::AuthenticationError => error
         puts "Error: #{error.message}"
         exit 1

data/lib/vaultez/commands/fetch.rb

@@ -1,10 +1,14 @@
+require "json"
+
 module Vaultez
   module Commands
     module Fetch
       def fetch
         client = Vaultez::Client.new
 
-        if options[:companies]
+        if client.project_token_mode?
+          fetch_with_project_token(client)
+        elsif options[:companies]
           fetch_companies(client)
         elsif options[:projects]
           fetch_projects(client)
@@ -13,24 +17,73 @@ module Vaultez
         elsif options[:project]
           fetch_secrets(client)
         else
-          puts "Error: not enough options. See `vaultez help fetch`."
-          exit 1
+          fail!("not enough options. See `vaultez help fetch`.")
         end
       rescue Vaultez::NotAuthenticatedError => error
-        puts "Error: #{error.message}"
-        exit 1
+        fail!(error.message)
       rescue Vaultez::NotFoundError => error
-        puts "Error: #{error.message}"
-        exit 1
+        fail!(error.message)
       rescue Vaultez::ApiError => error
-        puts "Error: #{error.message}"
-        exit 1
+        fail!(error.message)
       end
 
       private
 
+      def fail!(message)
+        if options[:json]
+          warn "Error: #{message}"
+        else
+          puts "Error: #{message}"
+        end
+        exit 1
+      end
+
+      def fetch_with_project_token(client)
+        if options[:secret]
+          secrets = fetch_all_secrets_for_token(client)
+          secret  = secrets.find { |s| s["name"] == options[:secret] }
+          unless secret
+            fail!("secret \"#{options[:secret]}\" not found.")
+          end
+          if options[:json]
+            puts secret.to_json
+          else
+            print secret["value"]
+          end
+        else
+          secrets = fetch_all_secrets_for_token(client)
+          if options[:json]
+            puts secrets.to_json
+            return
+          end
+          if secrets.empty?
+            puts "No secrets found."
+            return
+          end
+          secrets.each { |s| puts "#{s["name"]}=#{s["value"]}" }
+        end
+      end
+
+      def fetch_all_secrets_for_token(client)
+        companies = client.companies
+        company   = companies.first
+        unless company
+          fail!("no company found for this token.")
+        end
+        projects = client.projects(company["id"])
+        project  = projects.first
+        unless project
+          fail!("no project found for this token.")
+        end
+        client.secrets(project["id"])
+      end
+
       def fetch_companies(client)
         companies = client.companies
+        if options[:json]
+          puts companies.to_json
+          return
+        end
         if companies.empty?
           puts "No companies found."
           return
@@ -44,6 +97,10 @@ module Vaultez
       def fetch_projects(client)
         company  = resolve_company(client)
         projects = client.projects(company["id"])
+        if options[:json]
+          puts projects.to_json
+          return
+        end
         if projects.empty?
           puts "No projects found in #{company["name"]}."
           return
@@ -58,6 +115,10 @@ module Vaultez
         company = resolve_company(client)
         project = resolve_project(client, company)
         secrets = client.secrets(project["id"])
+        if options[:json]
+          puts secrets.to_json
+          return
+        end
         if secrets.empty?
           puts "No secrets found in #{project["name"]}."
           return
@@ -71,48 +132,46 @@ module Vaultez
         company = resolve_company(client)
         project = resolve_project(client, company)
         secrets = client.secrets(project["id"])
-        secret  = secrets.find { |secret| secret["name"] == options[:secret] }
+        secret  = secrets.find { |s| s["name"] == options[:secret] }
 
         unless secret
-          puts "Error: secret \"#{options[:secret]}\" not found in #{project["name"]}."
-          exit 1
+          fail!("secret \"#{options[:secret]}\" not found in #{project["name"]}.")
         end
 
-        print secret["value"]
+        if options[:json]
+          puts secret.to_json
+        else
+          print secret["value"]
+        end
       end
 
       def resolve_company(client)
         companies = client.companies
 
         if options[:company]
-          company = companies.find { |company| company["name"] == options[:company] }
+          company = companies.find { |c| c["name"] == options[:company] }
           unless company
-            puts "Error: company \"#{options[:company]}\" not found."
-            exit 1
+            fail!("company \"#{options[:company]}\" not found.")
           end
           return company
         end
 
         default_name = Vaultez::Config.default_company
         if default_name
-          company = companies.find { |company| company["name"] == default_name }
+          company = companies.find { |c| c["name"] == default_name }
           return company if company
         end
 
-        if companies.size == 1
-          return companies.first
-        end
+        return companies.first if companies.size == 1
 
-        puts "Error: multiple companies found. Specify one with --company or set a default with `vaultez config --default-company`."
-        exit 1
+        fail!("multiple companies found. Specify one with --company or set a default with `vaultez config --default-company`.")
       end
 
       def resolve_project(client, company)
         projects = client.projects(company["id"])
-        project  = projects.find { |project| project["name"] == options[:project] }
+        project  = projects.find { |p| p["name"] == options[:project] }
         unless project
-          puts "Error: project \"#{options[:project]}\" not found in #{company["name"]}."
-          exit 1
+          fail!("project \"#{options[:project]}\" not found in #{company["name"]}.")
         end
         project
       end

data/lib/vaultez/config.rb

@@ -26,7 +26,7 @@ module Vaultez
     end
 
     def self.token
-      get("token")
+      ENV["VAULTEZ_TOKEN"] || get("token")
     end
 
     def self.api_url

data/lib/vaultez/errors.rb

@@ -1,7 +1,8 @@
 module Vaultez
-  class Error                < StandardError; end
-  class NotAuthenticatedError < Error; end
-  class AuthenticationError  < Error; end
-  class NotFoundError        < Error; end
-  class ApiError             < Error; end
+  class Error                  < StandardError; end
+  class NotAuthenticatedError  < Error; end
+  class AuthenticationError    < Error; end
+  class TwoFactorRequiredError < Error; end
+  class NotFoundError          < Error; end
+  class ApiError               < Error; end
 end

data/lib/vaultez/version.rb

@@ -1,3 +1,3 @@
 module Vaultez
-  VERSION = "0.1.0"
+  VERSION = "0.2.1"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: vaultez-cli
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.2.1
 platform: ruby
 authors:
 - Nur Ketene