agentcore-cli 0.31.1__py3-none-any.whl

agentcore/primitives/auth_utils.py

@@ -0,0 +1,77 @@
+"""JWT authorizer helpers (port of src/cli/primitives/auth-utils.ts).
+
+Custom claims / private endpoints are passed as camelCase JSON dicts (or schema models).
+"""
+
+from collections.abc import Callable
+from dataclasses import dataclass
+from typing import Any
+
+from agentcore.lib import set_env_var
+from agentcore.lib.schemas.io.config_io import to_jsonable
+from agentcore.primitives.credential_utils import (
+    compute_default_credential_env_var_name,
+    compute_managed_oauth_credential_name,
+)
+
+
+@dataclass
+class JwtConfigOptions:
+    """Flat JWT config from TUI/CLI (pre-schema-transformation)."""
+
+    discovery_url: str
+    allowed_audience: list[str] | None = None
+    allowed_clients: list[str] | None = None
+    allowed_scopes: list[str] | None = None
+    custom_claims: list[Any] | None = None
+    client_id: str | None = None
+    client_secret: str | None = None
+    private_endpoint: Any = None
+    private_endpoint_overrides: list[Any] | None = None
+
+
+def build_authorizer_config_from_jwt_config(jwt_config: JwtConfigOptions) -> dict[str, Any]:
+    """Build the nested authorizerConfiguration (camelCase JSON) from a flat JWT config."""
+    authorizer: dict[str, Any] = {"discoveryUrl": jwt_config.discovery_url}
+    if jwt_config.allowed_audience:
+        authorizer["allowedAudience"] = list(jwt_config.allowed_audience)
+    if jwt_config.allowed_clients:
+        authorizer["allowedClients"] = list(jwt_config.allowed_clients)
+    if jwt_config.allowed_scopes:
+        authorizer["allowedScopes"] = list(jwt_config.allowed_scopes)
+    if jwt_config.custom_claims:
+        authorizer["customClaims"] = to_jsonable(list(jwt_config.custom_claims))
+    if jwt_config.private_endpoint:
+        authorizer["privateEndpoint"] = to_jsonable(jwt_config.private_endpoint)
+    if jwt_config.private_endpoint_overrides:
+        authorizer["privateEndpointOverrides"] = to_jsonable(list(jwt_config.private_endpoint_overrides))
+    return {"customJwtAuthorizer": authorizer}
+
+
+def create_managed_oauth_credential(
+    resource_name: str,
+    jwt_config: JwtConfigOptions,
+    write_project_spec: Callable[[Any], None],
+    read_project_spec: Callable[[], Any],
+    config_root: str | None = None,
+) -> None:
+    """Add a managed inbound OAuth credential and write its client id/secret to .env.local."""
+    credential_name = compute_managed_oauth_credential_name(resource_name)
+    project = to_jsonable(read_project_spec())
+    if any(c["name"] == credential_name for c in project.get("credentials", [])):
+        return
+    project.setdefault("credentials", []).append(
+        {
+            "authorizerType": "OAuthCredentialProvider",
+            "name": credential_name,
+            "discoveryUrl": jwt_config.discovery_url,
+            "vendor": "CustomOauth2",
+            "managed": True,
+            "usage": "inbound",
+        }
+    )
+    write_project_spec(project)
+
+    prefix = compute_default_credential_env_var_name(credential_name)
+    set_env_var(f"{prefix}_CLIENT_ID", jwt_config.client_id or "", config_root)
+    set_env_var(f"{prefix}_CLIENT_SECRET", jwt_config.client_secret or "", config_root)

agentcore/primitives/base.py

@@ -0,0 +1,178 @@
+"""Base class for add/remove resources (port of src/cli/primitives/BasePrimitive.ts).
+
+Each primitive owns its add/remove logic and registers `agentcore add <kind>` and
+`agentcore remove <kind>` on the shared Typer groups. Upstream falls back to an Ink TUI when
+no flags are given; here the fallback is `add_interactive()` / the prompt-based remove flow.
+"""
+
+import json
+from abc import ABC, abstractmethod
+from collections.abc import Callable
+from dataclasses import dataclass, field
+from typing import Any, ClassVar
+
+import typer
+
+from agentcore.cli import interactive
+from agentcore.cli.errors import get_error_message
+from agentcore.lib.result import Err, Ok
+from agentcore.lib.schemas.io.config_io import ConfigIO
+from agentcore.lib.schemas.io.path_resolver import find_config_root
+
+SOURCE_CODE_NOTE = (
+    "Your agent app source code has not been modified. "
+    "Deploy with `agentcore deploy` to apply your removal changes to AWS."
+)
+PASSTHROUGH_PROTOCOL_TYPES = ("MCP", "A2A", "INFERENCE", "CUSTOM")
+ADDITIONAL_PARAMS_JSON_ERROR = "--additional-params must be a valid JSON object"
+
+
+@dataclass
+class SchemaChange:
+    file: str
+    before: Any
+    after: Any
+
+
+@dataclass
+class RemovalPreview:
+    """Port of operations/remove/types.ts RemovalPreview."""
+
+    summary: list[str] = field(default_factory=list)
+    directories_to_delete: list[str] = field(default_factory=list)
+    schema_changes: list[SchemaChange] = field(default_factory=list)
+
+
+@dataclass
+class RemovableResource:
+    name: str
+    extra: dict[str, Any] = field(default_factory=dict)
+
+
+def emit_json(payload: dict[str, Any]) -> None:
+    """Print like upstream's JSON.stringify: compact, with ``None`` (undefined) keys dropped."""
+    typer.echo(json.dumps({k: v for k, v in payload.items() if v is not None}, separators=(",", ":")))
+
+
+class BasePrimitive(ABC):
+    kind: ClassVar[str]
+    """Resource kind, used as the subcommand name (e.g. 'agent', 'gateway-target')."""
+    label: ClassVar[str]
+    """Human-readable label (e.g. 'Agent', 'Gateway Target')."""
+    article: ClassVar[str] = "a"
+
+    def __init__(self, config_io: ConfigIO | None = None):
+        self._config_io = config_io
+
+    @property
+    def config_io(self) -> ConfigIO:
+        # Primitives are module-level singletons, so resolve the project on each use rather than
+        # caching it: one process may touch several projects (create, tests).
+        return self._config_io if self._config_io is not None else ConfigIO()
+
+    # --- contract -----------------------------------------------------------------------
+
+    @abstractmethod
+    def add(self, options: Any) -> Ok[dict[str, Any]] | Err[Exception]: ...
+
+    @abstractmethod
+    def remove(self, name: str) -> Ok[Any] | Err[Exception]: ...
+
+    @abstractmethod
+    def preview_remove(self, name: str) -> RemovalPreview: ...
+
+    @abstractmethod
+    def get_removable(self) -> list[RemovableResource]: ...
+
+    @abstractmethod
+    def register_commands(self, add_app: typer.Typer, remove_app: typer.Typer) -> None: ...
+
+    def add_interactive(self) -> None:
+        """Prompt-based replacement for upstream's addScreen(). Override per primitive."""
+        typer.echo(f"Interactive add for {self.label.lower()} is not available; use flags (see --help).", err=True)
+        raise typer.Exit(1)
+
+    # --- shared helpers for agentcore.json ----------------------------------------------
+
+    def read_project_spec(self, config_io: ConfigIO | None = None):
+        return (config_io or self.config_io).read_project_spec()
+
+    def write_project_spec(self, spec, config_io: ConfigIO | None = None) -> None:
+        (config_io or self.config_io).write_project_spec(spec)
+
+    def update_project_spec(self, mutate: Callable[[Any], Any], config_io: ConfigIO | None = None):
+        return (config_io or self.config_io).update_project_spec(mutate)
+
+    def check_duplicate(self, items, name: str, label: str | None = None) -> None:
+        if any(item.name == name for item in items):
+            raise ValueError(f'{label or self.label} "{name}" already exists.')
+
+    # --- standard remove subcommand -----------------------------------------------------
+
+    def register_remove_subcommand(self, remove_app: typer.Typer) -> None:
+        @remove_app.command(self.kind, help=f"Remove {self.article} {self.label.lower()} from the project")
+        def remove_command(
+            name: str | None = typer.Option(None, "--name", help="Name of resource to remove [non-interactive]"),
+            yes: bool = typer.Option(False, "-y", "--yes", help="Skip confirmation prompt [non-interactive]"),
+            as_json: bool = typer.Option(False, "--json", help="Output as JSON [non-interactive]"),
+        ) -> None:
+            self._run_remove(name, yes, as_json)
+
+    def _run_remove(self, name: str | None, yes: bool, as_json: bool) -> None:
+        try:
+            if not find_config_root():
+                typer.echo("No agentcore project found. Run `agentcore create` first.", err=True)
+                raise typer.Exit(1)
+
+            if name or yes or as_json:  # any flag triggers non-interactive mode
+                if not name:
+                    emit_json({"success": False, "error": "--name is required"})
+                    raise typer.Exit(1)
+                result = self.remove(name)
+                emit_json(
+                    {
+                        "success": result.success,
+                        "resourceType": self.kind,
+                        "resourceName": name,
+                        "message": f"Removed {self.label.lower()} '{name}'" if result.success else None,
+                        "note": SOURCE_CODE_NOTE if result.success else None,
+                        "error": None if result.success else get_error_message(result.error),
+                    }
+                )
+                raise typer.Exit(0 if result.success else 1)
+
+            interactive.require_tty()
+            self.remove_interactive()
+        except typer.Exit:
+            raise
+        except Exception as exc:  # noqa: BLE001 - top-level command boundary, as upstream
+            if as_json:
+                emit_json({"success": False, "error": get_error_message(exc)})
+            else:
+                typer.echo(f"Error: {get_error_message(exc)}", err=True)
+            raise typer.Exit(1) from None
+
+    def remove_interactive(self) -> None:
+        """Prompt-based replacement for upstream's RemoveFlow screen."""
+        removable = self.get_removable()
+        if not removable:
+            typer.echo(f"No {self.label.lower()} resources to remove.")
+            return
+        name = interactive.select(
+            f"Select {self.article} {self.label.lower()} to remove",
+            [interactive.Choice(r.name, r.name) for r in removable],
+        )
+        preview = self.preview_remove(name)
+        for line in preview.summary:
+            typer.echo(f"  {line}")
+        for directory in preview.directories_to_delete:
+            typer.echo(f"  Delete directory: {directory}")
+        if not interactive.confirm(f"Remove {self.label.lower()} '{name}'?", default=False):
+            typer.echo("Cancelled.")
+            return
+        result = self.remove(name)
+        if not result.success:
+            typer.echo(f"Error: {get_error_message(result.error)}", err=True)
+            raise typer.Exit(1)
+        typer.echo(f"Removed {self.label.lower()} '{name}'")
+        typer.echo(SOURCE_CODE_NOTE)