1password-secrets 0.0.1.dev241__tar.gz → 0.0.1.dev247__tar.gz

{1password_secrets-0.0.1.dev241 → 1password_secrets-0.0.1.dev247}/1password_secrets.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: 1password-secrets
-Version: 0.0.1.dev241
+Version: 0.0.1.dev247
 Summary: 1password-secrets is a set of utilities to sync 1password secrets.
 Home-page: https://github.com/significa/fly-1password-secrets
 Author: Significa

{1password_secrets-0.0.1.dev241 → 1password_secrets-0.0.1.dev247}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: 1password-secrets
-Version: 0.0.1.dev241
+Version: 0.0.1.dev247
 Summary: 1password-secrets is a set of utilities to sync 1password secrets.
 Home-page: https://github.com/significa/fly-1password-secrets
 Author: Significa

{1password_secrets-0.0.1.dev241 → 1password_secrets-0.0.1.dev247}/onepassword_secrets/cli.py

@@ -12,7 +12,7 @@ from .commands import (
 )
 from .constants import DEFAULT_REMOTE_NAME
 from .errors import UserError
-from .logs import logger
+from .logs import console, logger
 
 try:
     APP_VERSION = version("1password-secrets")
@@ -85,19 +85,28 @@ def main():
         logger.setLevel(logging.DEBUG)
 
     try:
-        if args.subcommand == "fly":
-            if args.action == "import":
-                import_1password_secrets_to_fly(args.app_name, vault=args.vault)
-            elif args.action == "edit":
-                edit_1password_fly_secrets(args.app_name, vault=args.vault)
-
-        elif args.subcommand == "local":
-            if args.action == "pull":
-                pull_local_secrets(remote=args.remote, vault=args.vault)
-            elif args.action == "push":
-                push_local_secrets(remote=args.remote, vault=args.vault)
-            elif args.action == "create":
-                create_local_secrets(args.secrets_file_path, vault=args.vault, remote=args.remote)
+        run_subcommand(args)
 
     except UserError:
         sys.exit(1)
+
+    except KeyboardInterrupt:
+        console.print()
+        console.print("[yellow]Aborted by user[/yellow]")
+        sys.exit(130)
+
+
+def run_subcommand(args):
+    if args.subcommand == "fly":
+        if args.action == "import":
+            import_1password_secrets_to_fly(args.app_name, vault=args.vault)
+        elif args.action == "edit":
+            edit_1password_fly_secrets(args.app_name, vault=args.vault)
+
+    elif args.subcommand == "local":
+        if args.action == "pull":
+            pull_local_secrets(remote=args.remote, vault=args.vault)
+        elif args.action == "push":
+            push_local_secrets(remote=args.remote, vault=args.vault)
+        elif args.action == "create":
+            create_local_secrets(args.secrets_file_path, vault=args.vault, remote=args.remote)

{1password_secrets-0.0.1.dev241 → 1password_secrets-0.0.1.dev247}/onepassword_secrets/commands.py

@@ -1,6 +1,7 @@
 """High level workflows wiring 1Password, Fly and the local filesystem together."""
 
 import json
+import os
 import subprocess
 from datetime import datetime, timezone
 from tempfile import NamedTemporaryFile
@@ -21,7 +22,7 @@ from .op import (
     update_1password_custom_field,
     update_1password_secrets,
 )
-from .prompts import boolean_prompt, prompt_secret_diff
+from .prompts import SecretDiff, boolean_prompt, prompt_secret_diff
 from .utils import get_file_contents
 
 
@@ -43,37 +44,47 @@ def edit_1password_fly_secrets(app_id, vault=None):
 
     current_raw_secrets = get_envs_from_1password(item_id, vault=vault)
 
-    with NamedTemporaryFile("w+", suffix=".env") as file:
-        file.writelines(current_raw_secrets)
-        file.flush()
-
-        console.print()
-        console.print(
-            Panel(
-                "[bold]Edit the secrets in your editor, then save and close the file to continue.[/bold]\n"
-                "[dim]Waiting for editor to close...[/dim]",
-                title="Editor",
-                border_style="cyan",
+    # delete=False so that the file is still around for the editor to open on every platform,
+    # cleaned up in the finally block below no matter how we leave this function.
+    file = NamedTemporaryFile("w+", suffix=".env", delete=False)  # noqa: SIM115
+
+    try:
+        with file:
+            file.writelines(current_raw_secrets)
+            file.flush()
+
+            console.print()
+            console.print(
+                Panel(
+                    "[bold]Edit the secrets in your editor, then save and close the file to continue.[/bold]\n"
+                    "[dim]Waiting for editor to close...[/dim]",
+                    title="Editor",
+                    border_style="cyan",
+                )
             )
-        )
 
-        editor_command_args = ["code", "--wait", "--disable-extensions", file.name]
-        debug_command(editor_command_args)
-        editor_output = subprocess.check_output(editor_command_args)  # noqa: S603
-        debug_command(editor_command_args, output=editor_output, returncode=0)
+            editor_command_args = ["code", "--wait", "--disable-extensions", file.name]
+            debug_command(editor_command_args)
+            editor_output = subprocess.check_output(editor_command_args)  # noqa: S603
+            debug_command(editor_command_args, output=editor_output, returncode=0)
 
-        console.print("[green]Editor closed.[/green]")
-        console.print()
+            console.print("[green]Editor closed.[/green]")
+            console.print()
 
-        file.seek(0)
-        new_raw_secrets = file.read()
+            file.seek(0)
+            new_raw_secrets = file.read()
 
-    update_1password_secrets(
-        item_id,
-        new_raw_secrets=new_raw_secrets,
-        previous_raw_secrets=current_raw_secrets,
-        vault=vault,
-    )
+        update_1password_secrets(
+            item_id,
+            new_raw_secrets=new_raw_secrets,
+            previous_raw_secrets=current_raw_secrets,
+            vault=vault,
+        )
+    finally:
+        try:
+            os.unlink(file.name)
+        except FileNotFoundError:
+            pass
 
     console.print()
     if boolean_prompt(f"Secrets updated in 1Password. Import to Fly app '{app_id}'"):
@@ -91,11 +102,17 @@ def pull_local_secrets(remote=DEFAULT_REMOTE_NAME, vault=None):
     previous_raw_secrets = get_file_contents(env_file_name, raise_if_not_found=False)
 
     if previous_raw_secrets:
-        prompt_secret_diff(
+        diff = prompt_secret_diff(
             previous_raw_secrets=previous_raw_secrets,
             new_raw_secrets=secrets,
+            apply_prompt=f"Pull these changes into {env_file_name}",
+            cosmetic_prompt=f"Pull the file into {env_file_name} anyway",
         )
 
+        if diff == SecretDiff.IDENTICAL:
+            console.print(f"[dim]No changes detected, {env_file_name} is already up to date[/dim]")
+            return
+
     with open(env_file_name, "w") as file:
         file.writelines(secrets)
 

{1password_secrets-0.0.1.dev241 → 1password_secrets-0.0.1.dev247}/onepassword_secrets/fly.py

@@ -4,6 +4,7 @@ import json
 import subprocess
 
 import requests
+from rich.table import Table
 
 from .constants import FLY_API_TIMEOUT_SECONDS, FLY_MACHINES_API_ENDPOINT
 from .errors import raise_error
@@ -90,13 +91,8 @@ def set_fly_secrets(app_id, values, token=None) -> None:
     )
 
 
-def deploy_fly_secrets(app_id):
-    """Deploy secrets to a Fly app using the fly CLI."""
-    console.print()
-    console.print(f"[bold cyan]Deploying secrets to Fly app '{app_id}'...[/bold cyan]")
-    console.print()
-
-    command_args = ["fly", "secrets", "deploy", "-a", app_id]
+def run_fly_command(command_args, failure_message):
+    """Run a fly CLI command, raising a user-facing error if it is unavailable or fails."""
     debug_command(command_args)
 
     try:
@@ -107,7 +103,26 @@ def deploy_fly_secrets(app_id):
     debug_command(command_args, returncode=result.returncode)
 
     if result.returncode != 0:
-        raise_error(f"Failed to deploy secrets (exit code {result.returncode})")
+        raise_error(f"{failure_message} (exit code {result.returncode})")
+
+
+def deploy_fly_secrets(app_id):
+    """Sync and deploy secrets to a Fly app using the fly CLI."""
+    console.print()
+    console.print(
+        f"[bold cyan]Syncing secrets on Fly app '{app_id}' (fly secrets sync)...[/bold cyan]"
+    )
+    console.print()
+
+    run_fly_command(["fly", "secrets", "sync", "-a", app_id], "Failed to sync secrets")
+
+    console.print()
+    console.print(
+        f"[bold cyan]Deploying secrets to Fly app '{app_id}' (fly secrets deploy)...[/bold cyan]"
+    )
+    console.print()
+
+    run_fly_command(["fly", "secrets", "deploy", "-a", app_id], "Failed to deploy secrets")
 
     console.print()
     console.print(f"[bold green]Secrets deployed to Fly app '{app_id}'[/bold green]")
@@ -122,12 +137,24 @@ def update_fly_secrets(app_id, secrets):
 
     deletions = {}
 
-    if len(secrets_names_in_fly_only) > 0 and boolean_prompt(
-        "The following secrets will be deleted from Fly.io: {}. Are you sure".format(
-            ", ".join(sorted(secrets_names_in_fly_only))
+    if len(secrets_names_in_fly_only) > 0:
+        table = Table(
+            title="Secrets that only exist on Fly.io",
+            show_header=True,
+            header_style="bold",
         )
-    ):
-        deletions = dict.fromkeys(secrets_names_in_fly_only, None)
+        table.add_column("#", style="dim", justify="right")
+        table.add_column("Secret", style="red")
+
+        for index, name in enumerate(sorted(secrets_names_in_fly_only), start=1):
+            table.add_row(str(index), name)
+
+        console.print()
+        console.print(table)
+        console.print()
+
+        if boolean_prompt(f"Delete these {len(secrets_names_in_fly_only)} secrets from Fly.io"):
+            deletions = dict.fromkeys(secrets_names_in_fly_only, None)
 
     values = {**secrets, **deletions}
 
@@ -141,5 +168,5 @@ def update_fly_secrets(app_id, secrets):
     console.print()
     console.print(f"[bold green]Secrets staged on Fly app '{app_id}'[/bold green]")
 
-    if boolean_prompt("Deploy secrets now (run fly secrets deploy)?"):
+    if boolean_prompt("Deploy secrets now ( fly secrets sync && fly secrets deploy)?"):
         deploy_fly_secrets(app_id)

{1password_secrets-0.0.1.dev241 → 1password_secrets-0.0.1.dev247}/onepassword_secrets/op.py

@@ -12,7 +12,7 @@ from .constants import (
 )
 from .errors import raise_error
 from .logs import console, debug_command, logger
-from .prompts import prompt_secret_diff
+from .prompts import SecretDiff, boolean_prompt, prompt_secret_diff
 from .utils import first
 
 
@@ -159,11 +159,16 @@ def update_1password_secrets(item_id, new_raw_secrets, previous_raw_secrets=None
     if previous_raw_secrets is None:
         previous_raw_secrets = get_envs_from_1password(item_id)
 
-    prompt_secret_diff(
+    diff = prompt_secret_diff(
         previous_raw_secrets=previous_raw_secrets,
         new_raw_secrets=new_raw_secrets,
     )
 
+    if diff == SecretDiff.IDENTICAL:
+        console.print("[dim]No changes detected[/dim]")
+        if not boolean_prompt("Proceed anyway"):
+            raise_error("Aborted by user")
+
     logger.debug(f"Updating 1password secret note content for item {item_id!r}")
     run_1password_command(
         "item",

{1password_secrets-0.0.1.dev241 → 1password_secrets-0.0.1.dev247}/onepassword_secrets/prompts.py

@@ -1,3 +1,5 @@
+from enum import Enum
+
 import inquirer
 from rich.table import Table
 from rich.text import Text
@@ -22,7 +24,30 @@ def boolean_prompt(prompt: str, default: bool = False) -> bool:
     return answers["confirm"]
 
 
-def prompt_secret_diff(previous_raw_secrets, new_raw_secrets):
+class SecretDiff(str, Enum):
+    """Outcome of comparing two raw env file contents."""
+
+    CHANGED = "changed"
+    """Env var keys were added, removed or had their value changed."""
+
+    COSMETIC = "cosmetic"
+    """No env var differences, but the file contents differ (comments, ordering, spacing)."""
+
+    IDENTICAL = "identical"
+    """Both files are equivalent."""
+
+
+def prompt_secret_diff(
+    previous_raw_secrets,
+    new_raw_secrets,
+    apply_prompt: str = "Apply these changes",
+    cosmetic_prompt: str = "Apply these changes anyway",
+) -> SecretDiff:
+    """Show the diff between two env files and ask for confirmation when relevant.
+
+    Returns the kind of difference found. Nothing is prompted when the contents are
+    equivalent - it is up to the caller to decide what to do in that case.
+    """
     previous_parsed_secrets = get_secrets_from_envs(previous_raw_secrets)
     new_parsed_secrets = get_secrets_from_envs(new_raw_secrets)
 
@@ -38,10 +63,19 @@ def prompt_secret_diff(previous_raw_secrets, new_raw_secrets):
     ]
 
     if len(deleted_keys) == 0 and len(added_keys) == 0 and len(keys_whos_value_changed) == 0:
-        console.print("[dim]No changes detected[/dim]")
-        if not boolean_prompt("Proceed anyway"):
+        if previous_raw_secrets.strip() == new_raw_secrets.strip():
+            return SecretDiff.IDENTICAL
+
+        console.print(
+            "[dim]No environment variable differences, "
+            "but the file structure or comments changed[/dim]"
+        )
+        console.print()
+
+        if not boolean_prompt(cosmetic_prompt, default=True):
             raise_error("Aborted by user")
-        return
+
+        return SecretDiff.COSMETIC
 
     # Build a rich table for the diff
     table = Table(title="Change Summary", show_header=True, header_style="bold")
@@ -67,5 +101,7 @@ def prompt_secret_diff(previous_raw_secrets, new_raw_secrets):
     console.print(table)
     console.print()
 
-    if not boolean_prompt("Apply these changes"):
+    if not boolean_prompt(apply_prompt):
         raise_error("Aborted by user")
+
+    return SecretDiff.CHANGED