1password-secrets 0.0.1.dev236__tar.gz → 0.0.1.dev238__tar.gz

{1password_secrets-0.0.1.dev236 → 1password_secrets-0.0.1.dev238}/1password_secrets.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: 1password-secrets
-Version: 0.0.1.dev236
+Version: 0.0.1.dev238
 Summary: 1password-secrets is a set of utilities to sync 1password secrets.
 Home-page: https://github.com/significa/fly-1password-secrets
 Author: Significa

1password_secrets-0.0.1.dev238/1password_secrets.egg-info/SOURCES.txt

@@ -0,0 +1,22 @@
+README.md
+pyproject.toml
+setup.py
+1password_secrets.egg-info/PKG-INFO
+1password_secrets.egg-info/SOURCES.txt
+1password_secrets.egg-info/dependency_links.txt
+1password_secrets.egg-info/entry_points.txt
+1password_secrets.egg-info/requires.txt
+1password_secrets.egg-info/top_level.txt
+onepassword_secrets/__init__.py
+onepassword_secrets/__main__.py
+onepassword_secrets/cli.py
+onepassword_secrets/commands.py
+onepassword_secrets/constants.py
+onepassword_secrets/envs.py
+onepassword_secrets/errors.py
+onepassword_secrets/fly.py
+onepassword_secrets/git.py
+onepassword_secrets/logs.py
+onepassword_secrets/op.py
+onepassword_secrets/prompts.py
+onepassword_secrets/utils.py

{1password_secrets-0.0.1.dev236 → 1password_secrets-0.0.1.dev238}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: 1password-secrets
-Version: 0.0.1.dev236
+Version: 0.0.1.dev238
 Summary: 1password-secrets is a set of utilities to sync 1password secrets.
 Home-page: https://github.com/significa/fly-1password-secrets
 Author: Significa

1password_secrets-0.0.1.dev238/onepassword_secrets/__init__.py

@@ -0,0 +1,3 @@
+from .cli import main
+
+__all__ = ["main"]

1password_secrets-0.0.1.dev238/onepassword_secrets/__main__.py

@@ -0,0 +1,4 @@
+from .cli import main
+
+if __name__ == "__main__":
+    main()

1password_secrets-0.0.1.dev238/onepassword_secrets/cli.py

@@ -0,0 +1,103 @@
+import argparse
+import logging
+import sys
+from importlib.metadata import version
+
+from .commands import (
+    create_local_secrets,
+    edit_1password_fly_secrets,
+    import_1password_secrets_to_fly,
+    pull_local_secrets,
+    push_local_secrets,
+)
+from .constants import DEFAULT_REMOTE_NAME
+from .errors import UserError
+from .logs import logger
+
+try:
+    APP_VERSION = version("1password-secrets")
+except ImportError:
+    APP_VERSION = "unknown"
+
+
+def main():
+    parser = argparse.ArgumentParser(
+        description="1password-secrets is a set of utilities to sync 1Password secrets."
+    )
+
+    parser.add_argument(
+        "-v",
+        "--version",
+        action="version",
+        version=f"%(prog)s {APP_VERSION}",
+        help="show program's version number and exit",
+    )
+
+    parser.add_argument(
+        "--debug",
+        action=argparse.BooleanOptionalAction,
+        default=False,
+        help=(
+            "run in debug mode, logging every command, HTTP request and response "
+            "(authorization headers and the fly auth token are redacted)"
+        ),
+    )
+
+    parser.add_argument(
+        "--vault",
+        type=str,
+        default=None,
+        help=(
+            "Specify a vault name or id to operate on. "
+            "Defaults to all vaults across the logged in account."
+        ),
+    )
+
+    parser.add_argument(
+        "--remote",
+        type=str,
+        default=DEFAULT_REMOTE_NAME,
+        help='Construct secret name based on this git remote. Defaults to "origin"',
+    )
+
+    subparsers = parser.add_subparsers(dest="subcommand", required=True)
+
+    fly_parser = subparsers.add_parser("fly", help="manage fly secrets")
+    fly_parser.add_argument("action", type=str, choices=["import", "edit"])
+    fly_parser.add_argument("app_name", type=str, help="fly application name")
+
+    local_parser = subparsers.add_parser("local", help="manage local secrets")
+    local_subparsers = local_parser.add_subparsers(dest="action", required=True)
+
+    local_subparsers.add_parser("pull")
+    local_subparsers.add_parser("push")
+
+    create_parser = local_subparsers.add_parser("create")
+    create_parser.add_argument(
+        "secrets_file_path",
+        type=str,
+        help="secrets file path",
+    )
+
+    args = parser.parse_args()
+
+    if args.debug:
+        logger.setLevel(logging.DEBUG)
+
+    try:
+        if args.subcommand == "fly":
+            if args.action == "import":
+                import_1password_secrets_to_fly(args.app_name, vault=args.vault)
+            elif args.action == "edit":
+                edit_1password_fly_secrets(args.app_name, vault=args.vault)
+
+        elif args.subcommand == "local":
+            if args.action == "pull":
+                pull_local_secrets(remote=args.remote, vault=args.vault)
+            elif args.action == "push":
+                push_local_secrets(remote=args.remote, vault=args.vault)
+            elif args.action == "create":
+                create_local_secrets(args.secrets_file_path, vault=args.vault, remote=args.remote)
+
+    except UserError:
+        sys.exit(1)

1password_secrets-0.0.1.dev238/onepassword_secrets/commands.py

@@ -0,0 +1,141 @@
+"""High level workflows wiring 1Password, Fly and the local filesystem together."""
+
+import json
+import subprocess
+from datetime import datetime, timezone
+from tempfile import NamedTemporaryFile
+
+from rich.panel import Panel
+
+from .constants import DATE_FORMAT, DEFAULT_ENV_FILE_NAME, DEFAULT_REMOTE_NAME
+from .envs import get_secrets_from_envs
+from .fly import update_fly_secrets
+from .git import get_secret_name_label_from_current_directory
+from .logs import console, debug_command, logger
+from .op import (
+    create_1password_secrets,
+    get_1password_env_file_item_id,
+    get_envs_from_1password,
+    get_filename_from_1password,
+    get_item_share_link,
+    update_1password_custom_field,
+    update_1password_secrets,
+)
+from .prompts import boolean_prompt, prompt_secret_diff
+from .utils import get_file_contents
+
+
+def import_1password_secrets_to_fly(app_id, vault=None):
+    item_id = get_1password_env_file_item_id(f"fly:{app_id}", vault=vault)
+
+    secrets = get_secrets_from_envs(get_envs_from_1password(item_id, vault=vault))
+
+    logger.debug(f"Secrets loaded from env: {json.dumps(secrets, indent=2)}\n")
+
+    update_fly_secrets(app_id, secrets)
+
+    now_formatted = datetime.now(tz=timezone.utc).strftime(DATE_FORMAT)
+    update_1password_custom_field(item_id, "last imported at", now_formatted, vault=vault)
+
+
+def edit_1password_fly_secrets(app_id, vault=None):
+    item_id = get_1password_env_file_item_id(f"fly:{app_id}", vault=vault)
+
+    current_raw_secrets = get_envs_from_1password(item_id, vault=vault)
+
+    with NamedTemporaryFile("w+", suffix=".env") as file:
+        file.writelines(current_raw_secrets)
+        file.flush()
+
+        console.print()
+        console.print(
+            Panel(
+                "[bold]Edit the secrets in your editor, then save and close the file to continue.[/bold]\n"
+                "[dim]Waiting for editor to close...[/dim]",
+                title="Editor",
+                border_style="cyan",
+            )
+        )
+
+        editor_command_args = ["code", "--wait", "--disable-extensions", file.name]
+        debug_command(editor_command_args)
+        editor_output = subprocess.check_output(editor_command_args)  # noqa: S603
+        debug_command(editor_command_args, output=editor_output, returncode=0)
+
+        console.print("[green]Editor closed.[/green]")
+        console.print()
+
+        file.seek(0)
+        new_raw_secrets = file.read()
+
+    update_1password_secrets(
+        item_id,
+        new_raw_secrets=new_raw_secrets,
+        previous_raw_secrets=current_raw_secrets,
+        vault=vault,
+    )
+
+    console.print()
+    if boolean_prompt(f"Secrets updated in 1Password. Import to Fly app '{app_id}'"):
+        import_1password_secrets_to_fly(app_id, vault=vault)
+
+
+def pull_local_secrets(remote=DEFAULT_REMOTE_NAME, vault=None):
+    secret_note_label = get_secret_name_label_from_current_directory(remote=remote)
+    item_id = get_1password_env_file_item_id(secret_note_label, vault=vault)
+
+    secrets = get_envs_from_1password(item_id, vault=vault)
+
+    env_file_name = get_filename_from_1password(item_id, vault=vault) or DEFAULT_ENV_FILE_NAME
+
+    previous_raw_secrets = get_file_contents(env_file_name, raise_if_not_found=False)
+
+    if previous_raw_secrets:
+        prompt_secret_diff(
+            previous_raw_secrets=previous_raw_secrets,
+            new_raw_secrets=secrets,
+        )
+
+    with open(env_file_name, "w") as file:
+        file.writelines(secrets)
+
+    console.print(f"[bold green]Successfully updated {env_file_name} from 1Password[/bold green]")
+
+
+def push_local_secrets(remote=DEFAULT_REMOTE_NAME, vault=None):
+    secret_note_label = get_secret_name_label_from_current_directory(remote=remote)
+    item_id = get_1password_env_file_item_id(secret_note_label, vault=vault)
+
+    env_file_name = get_filename_from_1password(item_id) or DEFAULT_ENV_FILE_NAME
+
+    secrets = get_file_contents(env_file_name, raise_if_not_found=True)
+
+    update_1password_secrets(item_id, secrets, vault=vault)
+
+    console.print(
+        f"[bold green]Successfully pushed secrets from {env_file_name} to 1Password[/bold green]"
+    )
+
+
+def create_local_secrets(secrets_file_path, vault=None, remote=DEFAULT_REMOTE_NAME):
+    secret_note_label = get_secret_name_label_from_current_directory(remote=remote)
+
+    raw_secrets = get_file_contents(secrets_file_path, raise_if_not_found=True)
+
+    title = f"{secrets_file_path} local development {secret_note_label}"
+
+    item = create_1password_secrets(
+        file_path=secrets_file_path, raw_secrets=raw_secrets, title=title, vault=vault
+    )
+
+    item_url = get_item_share_link(item["id"], vault=vault)
+
+    app_url = item_url.replace("https://start.1password.com/", "onepassword://")
+
+    console.print()
+    console.print(f"[bold green]Item '{title}' created in 1Password![/bold green]")
+    console.print()
+    console.print(
+        Panel(f"[link={item_url}]{item_url}[/link]", title="Web Link", border_style="blue")
+    )
+    console.print(Panel(f"[link={app_url}]{app_url}[/link]", title="App Link", border_style="blue"))

1password_secrets-0.0.1.dev238/onepassword_secrets/constants.py

@@ -0,0 +1,10 @@
+FLY_MACHINES_API_ENDPOINT = "https://api.machines.dev/v1"
+FLY_API_TIMEOUT_SECONDS = 30
+DATE_FORMAT = "%Y/%m/%d %H:%M:%S"
+DEFAULT_ENV_FILE_NAME = ".env"
+ONE_PASSWORD_FILE_PATH_FIELD_NAME = "file_name"  # noqa: S105
+ONE_PASSWORD_NOTES_CONTENT_FIELD_NAME = "notesPlain"  # noqa: S105
+ONE_PASSWORD_SECURE_NOTE_CATEGORY = "Secure Note"  # noqa: S105
+DEFAULT_REMOTE_NAME = "origin"
+REDACTED_PLACEHOLDER = "<REDACTED>"  # noqa: S105
+SENSITIVE_HEADER_NAMES = frozenset({"authorization", "proxy-authorization", "cookie", "set-cookie"})

1password_secrets-0.0.1.dev238/onepassword_secrets/envs.py

@@ -0,0 +1,20 @@
+from io import StringIO
+
+from dotenv import dotenv_values
+
+from .errors import raise_error
+
+
+def get_secrets_from_envs(input: str):
+    secrets = dotenv_values(stream=StringIO(input))
+
+    keys_with_values_null_values = [key for key, value in secrets.items() if value is None]
+
+    if len(keys_with_values_null_values) > 0:
+        raise_error(
+            "Failed to parse env file, values for the following keys are null: {}".format(
+                ", ".join(keys_with_values_null_values)
+            )
+        )
+
+    return secrets

1password_secrets-0.0.1.dev238/onepassword_secrets/errors.py

@@ -0,0 +1,12 @@
+from typing import NoReturn
+
+from .logs import console
+
+
+class UserError(RuntimeError):
+    pass
+
+
+def raise_error(message) -> NoReturn:
+    console.print(f"[bold red]Error:[/bold red] {message}")
+    raise UserError(message)

1password_secrets-0.0.1.dev238/onepassword_secrets/fly.py

@@ -0,0 +1,145 @@
+"""Interactions with Fly.io: the machines REST API and the `fly` CLI."""
+
+import json
+import subprocess
+
+import requests
+
+from .constants import FLY_API_TIMEOUT_SECONDS, FLY_MACHINES_API_ENDPOINT
+from .errors import raise_error
+from .logs import console, debug_command, debug_request, debug_response
+from .prompts import boolean_prompt
+
+
+def get_fly_auth_token():
+    command_args = ["fly", "auth", "token", "--json"]
+    output = subprocess.check_output(command_args)  # noqa: S603
+    debug_command(command_args, output=output, returncode=0, redact_output=True)
+
+    return json.loads(output)["token"]
+
+
+def make_fly_api_request(
+    method,
+    path,
+    json_body=None,
+    token=None,
+    status_message="Communicating with Fly.io",
+):
+    url = f"{FLY_MACHINES_API_ENDPOINT}{path}"
+    headers = {
+        "Authorization": f"Bearer {token or get_fly_auth_token()}",
+        "Content-Type": "application/json",
+    }
+
+    debug_request(method, url, headers, json_body)
+
+    with console.status(f"[bold cyan]{status_message}...", spinner="dots"):
+        try:
+            response = requests.request(
+                method,
+                url,
+                headers=headers,
+                json=json_body,
+                timeout=FLY_API_TIMEOUT_SECONDS,
+            )
+        except requests.RequestException as error:
+            raise_error(f"Failed to reach the Fly API: {error}")
+
+    debug_response(response)
+
+    if not response.ok:
+        try:
+            body = response.json()
+        except ValueError:
+            body = response.text
+
+        message = body.get("error") if isinstance(body, dict) else body
+        raise_error(f"Fly API error ({response.status_code}): {message or 'unknown error'}")
+
+    if not response.content:
+        return None
+
+    try:
+        return response.json()
+    except ValueError:
+        return None
+
+
+def get_fly_secret_names(app_id, token=None) -> set[str]:
+    response = (
+        make_fly_api_request(
+            "GET",
+            f"/apps/{app_id}/secrets",
+            token=token,
+            status_message="Fetching current Fly secrets",
+        )
+        or {}
+    )
+
+    return {secret["name"] for secret in response.get("secrets") or [] if secret.get("name")}
+
+
+def set_fly_secrets(app_id, values, token=None) -> None:
+    make_fly_api_request(
+        "POST",
+        f"/apps/{app_id}/secrets",
+        json_body={"values": values},
+        token=token,
+        status_message="Uploading secrets to Fly",
+    )
+
+
+def deploy_fly_secrets(app_id):
+    """Deploy secrets to a Fly app using the fly CLI."""
+    console.print()
+    console.print(f"[bold cyan]Deploying secrets to Fly app '{app_id}'...[/bold cyan]")
+    console.print()
+
+    command_args = ["fly", "secrets", "deploy", "-a", app_id]
+    debug_command(command_args)
+
+    try:
+        result = subprocess.run(command_args, check=False)  # noqa: S603
+    except FileNotFoundError:
+        raise_error("The 'fly' CLI was not found. See https://fly.io/docs/flyctl/install/")
+
+    debug_command(command_args, returncode=result.returncode)
+
+    if result.returncode != 0:
+        raise_error(f"Failed to deploy secrets (exit code {result.returncode})")
+
+    console.print()
+    console.print(f"[bold green]Secrets deployed to Fly app '{app_id}'[/bold green]")
+
+
+def update_fly_secrets(app_id, secrets):
+    token = get_fly_auth_token()
+
+    secret_names_in_fly = get_fly_secret_names(app_id, token=token)
+
+    secrets_names_in_fly_only = secret_names_in_fly.difference(secrets.keys())
+
+    deletions = {}
+
+    if len(secrets_names_in_fly_only) > 0 and boolean_prompt(
+        "The following secrets will be deleted from Fly.io: {}. Are you sure".format(
+            ", ".join(sorted(secrets_names_in_fly_only))
+        )
+    ):
+        deletions = dict.fromkeys(secrets_names_in_fly_only, None)
+
+    values = {**secrets, **deletions}
+
+    if not values:
+        console.print()
+        console.print("[dim]No secret changes to push to Fly.[/dim]")
+        return
+
+    set_fly_secrets(app_id, values, token=token)
+
+    console.print()
+    console.print(f"[bold green]Secrets staged on Fly app '{app_id}'[/bold green]")
+
+    if boolean_prompt("Deploy secrets now (run fly secrets deploy)?"):
+        deploy_fly_secrets(app_id)

1password_secrets-0.0.1.dev238/onepassword_secrets/git.py

@@ -0,0 +1,66 @@
+import os
+import re
+import subprocess
+
+from .constants import DEFAULT_REMOTE_NAME
+from .logs import console, debug_command
+
+
+def get_git_remote_name(remote=DEFAULT_REMOTE_NAME) -> tuple[str | None, str | None]:
+    git_repository_regex = r"^(\w+)(:\/\/|@)([^\/:]+)[\/:]([^\/:]+)\/(.+).git$"
+
+    git_remote_url = None
+    command_args = ["git", "config", "--get", f"remote.{remote}.url"]
+
+    try:
+        git_remote_url = (
+            subprocess.check_output(command_args)  # noqa: S603
+            .decode("utf-8")
+            .strip()
+        )
+        debug_command(command_args, output=git_remote_url, returncode=0)
+
+    except FileNotFoundError:
+        debug_command(command_args, output="git not in the PATH")
+        return ("git not in the PATH", None)
+
+    except subprocess.CalledProcessError as error:
+        exit_code, _command = error.args
+        debug_command(command_args, returncode=exit_code)
+
+        if exit_code == 1:
+            return (f"Either not in a git repository or remote {remote!r} is not set", None)
+
+        return (f"Failed to retrieve the git remote {remote!r} url", None)
+
+    regex_match = re.match(git_repository_regex, git_remote_url)
+
+    if regex_match is None:
+        return (f'Failed to parse git remote "{remote}"', None)
+
+    return (
+        None,
+        f"{regex_match.group(4)}/{regex_match.group(5)}",
+    )
+
+
+def get_secret_name_label_from_current_directory(remote=DEFAULT_REMOTE_NAME) -> str:
+    """
+    Returns a predictable label for identifying the secrets based on the current directory.
+    If within a git repository with a remote named "origin" (and git is installed), it will output
+     something like: `repo:my-org/my-repo` or `repo:my-org/my-team/my-repo`.
+    Otherwise it will return the name of the directory as `local-dir:my-directory-name`.
+    """
+
+    error_message, git_remote_name = get_git_remote_name(remote=remote)
+
+    if not error_message:
+        return f"repo:{git_remote_name}"
+
+    directory_name = os.path.basename(os.getcwd())
+    label = f"local-dir:{directory_name}"
+
+    console.print(
+        f"[dim]{error_message}, using the label based on the current directory: {label!r}[/dim]"
+    )
+    return label

1password_secrets-0.0.1.dev238/onepassword_secrets/logs.py

@@ -0,0 +1,90 @@
+import json
+import logging
+
+from rich.console import Console
+
+from .constants import REDACTED_PLACEHOLDER, SENSITIVE_HEADER_NAMES
+
+console = Console()
+
+
+def _setup_logger():
+    class Formatter(logging.Formatter):
+        def format(self, record):
+            if record.levelno == logging.INFO:
+                self._style._fmt = "%(message)s"
+            else:
+                self._style._fmt = "%(levelname)s: %(message)s"
+            return super().format(record)
+
+    logger = logging.getLogger()
+    logger.setLevel(logging.INFO)
+
+    if logger.hasHandlers():
+        logger.handlers.clear()
+
+    stdout_handler = logging.StreamHandler()
+    stdout_handler.setFormatter(Formatter())
+    logger.addHandler(stdout_handler)
+
+    return logger
+
+
+logger = _setup_logger()
+
+
+def redact_headers(headers) -> dict:
+    return {
+        name: (REDACTED_PLACEHOLDER if name.lower() in SENSITIVE_HEADER_NAMES else value)
+        for name, value in dict(headers or {}).items()
+    }
+
+
+def format_command(command_args) -> str:
+    return " ".join((f'"{arg}"' if " " in arg else arg) for arg in command_args)
+
+
+def debug_enabled() -> bool:
+    return logger.isEnabledFor(logging.DEBUG)
+
+
+def debug_request(method, url, headers, json_body) -> None:
+    if not debug_enabled():
+        return
+
+    lines = [f"Request: {method} {url}", "Request headers:"]
+    lines += [f"  {name}: {value}" for name, value in redact_headers(headers).items()]
+
+    if json_body is not None:
+        lines += ["Request body:", json.dumps(json_body, indent=2)]
+
+    logger.debug("\n".join(lines))
+
+
+def debug_response(response) -> None:
+    if not debug_enabled():
+        return
+
+    lines = [f"Response: {response.status_code}", "Response headers:"]
+    lines += [f"  {name}: {value}" for name, value in redact_headers(response.headers).items()]
+    lines += ["Response body:", response.text]
+
+    logger.debug("\n".join(lines))
+
+
+def debug_command(command_args, output=None, returncode=None, redact_output=False) -> None:
+    if not debug_enabled():
+        return
+
+    lines = [f"Running command: {format_command(command_args)}"]
+
+    if returncode is not None:
+        lines.append(f"Exit code: {returncode}")
+
+    if output is not None:
+        if isinstance(output, bytes):
+            output = output.decode("utf-8", errors="replace")
+
+        lines += ["Output:", REDACTED_PLACEHOLDER if redact_output else output]
+
+    logger.debug("\n".join(lines))