vaultkit 1.2.0 → 1.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8490da7d9c28171310faf52f3a8b754dd00798d75837ec76eee4b3f3b5ce6aab
-  data.tar.gz: 53ce9b61c202b464b66d9fe3f4d195597a6992c20d5f707247a33da93f196e89
+  metadata.gz: 693839ee170f79bd7012760053b2e0240f2730693741603029182066462b6c20
+  data.tar.gz: 5e200af5f55787dc471f8299f63e33f5aeb2613646aa3f28dd0012142559ca38
 SHA512:
-  metadata.gz: e3f239d9f906313cac41a736d2e352b8be1b429e04fe0b08e8bb24190ee4e186510dd6141306dc1834da7750a2d710e39e246fcfe52b76c1915b2c5196731c1e
-  data.tar.gz: 822c8f6472e7bd4372b439bde33964329cbf93be371407873bbf2725750122633ba145d3d1635a84aebe0454a97d389f13a2014e1999cc2da96dfe60dc3b0a68
+  metadata.gz: 89687754411a6d542d819443638129bfbb1650a0745e18e71e2cb6d677ab71d9d43bb57768af450d3a51a5d821c0297fe485bcaedee687b595220b3b47e69c38
+  data.tar.gz: 2771cbb8bbcb6a1c6570ddeaa9854a232c07f2583195cf9eb0dc2ed8615b52438b6da150cb415b7f95b53f2955e31b5b4101b2157b0c3da1823431dce811e8eb

data/README.md

@@ -232,6 +232,17 @@ VKIT_TOKEN="$APPROVER_TOKEN" vkit approval:approve 42
 `vkit login --endpoint` still reads `VKIT_ENDPOINT` as its default endpoint when
 `VKIT_TOKEN` isn't set.
 
+### TLS certificates
+
+`vkit` checks the control plane's TLS certificate against your system's trusted
+certificates on every HTTPS call, including `vkit login`. If your control plane
+uses a self-signed or private-CA certificate, trust it by pointing
+`SSL_CERT_FILE` at a PEM bundle that includes it:
+
+```bash
+export SSL_CERT_FILE=/path/to/ca-bundle.pem
+```
+
 ---
 
 ## 🔄 Core Workflows
@@ -1174,7 +1185,7 @@ bundle exec rubocop -a
 
 ## 📚 Additional Resources
 
-- **Main Repository**: [github.com/ndbaba1/vaultkitcli.git](https://github.com/ndbaba1/vaultkitcli.git)
+- **Main Repository**: [github.com/vaultkit-inc/vaultkitcli](https://github.com/vaultkit-inc/vaultkitcli)
 - **Documentation**: [docs.vaultkit.io](https://docs.vaultkit.io)
 - **AQL Specification**: [docs.vaultkit.io/aql](https://docs.vaultkit.io/aql)
 - **Policy Reference**: [docs.vaultkit.io/policies](https://docs.vaultkit.io/policies)

data/lib/vkit/cli/base_cli.rb

@@ -317,7 +317,8 @@ module Vkit
         subcommand "tokens", Class.new(Thor) {
 
           # agents tokens list
-          desc "list", "List tokens for an agent"
+          desc "list", "List agent tokens"
+          option :agent, type: :string, desc: "Only show tokens with this agent name"
           option :format, type: :string, default: "table", enum: %w[table json]
           def list
             Commands::AgentTokensListCommand.new.call(

data/lib/vkit/cli/commands/agent_tokens_list_command.rb

@@ -14,13 +14,10 @@ module Vkit
             user = credential_store.user
             org  = user["organization_slug"]
 
-            response =
-              authenticated_client.get(
-                "/api/v1/orgs/#{org}/agent_tokens",
-                params: build_query(options)
-              )
+            response = authenticated_client.get("/api/v1/orgs/#{org}/agent_tokens")
 
             tokens = response["tokens"] || []
+            tokens = tokens.select { |t| t["name"] == options[:agent] } if options[:agent]
 
             print_result(tokens, format)
           end
@@ -28,12 +25,6 @@ module Vkit
 
         private
 
-        def build_query(options)
-          {}.tap do |q|
-            q[:name] = options[:agent] if options[:agent]
-          end
-        end
-
         def print_result(tokens, format)
           if tokens.empty?
             puts "No tokens found."

data/lib/vkit/cli/commands/approval_watch_command.rb

@@ -119,8 +119,8 @@ module Vkit
           end
           puts "Created:   #{format_time(a["created_at"])}"
           puts
-          puts "▶ Approve: vkit approval approve #{a["id"]}"
-          puts "▶ Deny:    vkit approval deny #{a["id"]} --reason \"…\""
+          puts "▶ Approve: vkit approval:approve #{a["id"]}"
+          puts "▶ Deny:    vkit approval:deny #{a["id"]} --reason \"…\""
           puts
         end
 

data/lib/vkit/cli/commands/init_command.rb

@@ -43,7 +43,7 @@ module Vkit
 
           puts "\nNext steps:"
           puts "  1. Review policies in config/policies/"
-          puts "  2. Run: vkit scan <datasource> --apply"
+          puts "  2. Run: vkit scan <datasource> --mode apply"
           puts "  3. Run: vkit policy bundle"
           puts "  4. Run: vkit policy deploy"
 
@@ -71,7 +71,7 @@ module Vkit
                 # VaultKit Dataset Registry
                 #
                 # Populate with:
-                #   vkit scan <datasource> --apply
+                #   vkit scan <datasource> --mode apply
                 #   vkit registry export
                 #
               YAML

data/lib/vkit/cli/commands/policy_pack_upgrade_command.rb

@@ -17,7 +17,9 @@ module Vkit
             if pack_name
               [upgrade_single(manager, pack_name, force)]
             else
-              manager.upgrade_all!(force: force)
+              manager.upgrade_all!(force: force).map do |name, result|
+                summarize(name, result)
+              end
             end
 
           print_summary(results)
@@ -31,8 +33,12 @@ module Vkit
         private
 
         def upgrade_single(manager, pack, force)
-          result = manager.upgrade!(pack, force: force)
+          summarize(pack, manager.upgrade!(pack, force: force))
+        rescue => e
+          { name: pack, status: :failed, error: e.message }
+        end
 
+        def summarize(pack, result)
           if result == :up_to_date
             { name: pack, status: :up_to_date }
           else
@@ -44,8 +50,6 @@ module Vkit
               policies: result[:policies]
             }
           end
-        rescue => e
-          { name: pack, status: :failed, error: e.message }
         end
 
         def print_summary(results)

data/lib/vkit/cli/commands/scan_command.rb

@@ -67,7 +67,7 @@ module Vkit
             clean.each { |d| print_clean(d) }
 
             puts
-            puts "  #{changed.size} changed · run with --apply to update baseline"
+            puts "  #{changed.size} changed · run with --mode apply to update baseline"
           end
 
           # Suggestions are reviewed labels the classifier now disagrees with.

data/lib/vkit/cli.rb

@@ -7,7 +7,7 @@ require_relative "cli/base_cli"
 module Vkit
   module CLI
     def self.start(argv = ARGV)
-      if argv.include?("--version") || argv.include?("-v")
+      if %w[--version -v].include?(argv.first)
         puts "vkit #{Vkit::VERSION}"
         exit 0
       end

data/lib/vkit/core/auth_client.rb

@@ -90,11 +90,7 @@ module Vkit
       end
 
       def http_request(uri, req, allow_non_200: false)
-        http = Net::HTTP.new(uri.host, uri.port)
-        http.use_ssl = uri.scheme == "https"
-        http.verify_mode = OpenSSL::SSL::VERIFY_NONE
-
-        res = http.request(req)
+        res = build_http(uri).request(req)
 
         return res if allow_non_200
 
@@ -105,6 +101,14 @@ module Vkit
         res
       end
 
+      # Certificates are verified against the system trust store. Point
+      # SSL_CERT_FILE at a bundle to trust a self-signed control plane.
+      def build_http(uri)
+        http = Net::HTTP.new(uri.host, uri.port)
+        http.use_ssl = uri.scheme == "https"
+        http
+      end
+
       def parse_json(res)
         JSON.parse(res.body)
       rescue JSON::ParserError

data/lib/vkit/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Vkit
-  VERSION = "1.2.0"
+  VERSION = "1.2.1"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: vaultkit
 version: !ruby/object:Gem::Version
-  version: 1.2.0
+  version: 1.2.1
 platform: ruby
 authors:
 - Nnamdi Ogundu
@@ -124,7 +124,7 @@ licenses:
 - Nonstandard
 metadata:
   rubygems_mfa_required: 'true'
-  source_code_uri: https://github.com/ndbaba1/vaultkitcli
+  source_code_uri: https://github.com/vaultkit-inc/vaultkitcli
 post_install_message:
 rdoc_options: []
 require_paths: