arcsecond 4.3.0__tar.gz → 4.3.2__tar.gz

{arcsecond-4.3.0 → arcsecond-4.3.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: arcsecond
-Version: 4.3.0
+Version: 4.3.2
 Summary: CLI for arcsecond.io
 Project-URL: Homepage, https://github.com/arcsecond-io/cli
 Project-URL: Issues, https://github.com/arcsecond-io/cli/issues

{arcsecond-4.3.0 → arcsecond-4.3.2}/arcsecond/hosting/stack.py

@@ -229,6 +229,22 @@ def compose_streaming(
     )
 
 
+REGISTRY_REFUSED = (
+    "Docker could not download an Arcsecond image: the registry refused.\n"
+    "Enter the token Arcsecond gave your observatory:  arcsecond token set"
+)
+REGISTRY_REFUSED_NO_TOKEN = (
+    "Docker could not download an Arcsecond image: this machine has no token "
+    "saved, so it asked without one.\n"
+    "Enter the token Arcsecond gave your observatory:  arcsecond token set\n"
+    'It must answer "Token accepted." before Arcsecond.local can be downloaded.'
+)
+REGISTRY_REFUSED_WITH_TOKEN = (
+    "Docker could not download an Arcsecond image: the token this machine holds "
+    "was refused. It may have expired or been replaced — enter the current one "
+    "with  arcsecond token set,  or ask team@arcsecond.io for a new one."
+)
+
 # The compose failures the troubleshooting page used to explain, matched on
 # the daemon's own words so `start` can answer them on the spot.
 _KNOWN_FAILURES = (
@@ -267,8 +283,7 @@ _KNOWN_FAILURES = (
     ),
     (
         ("denied", "unauthorized", "pull access denied"),
-        "Docker could not download an Arcsecond image: the registry refused.\n"
-        "Enter the token Arcsecond gave your observatory:  arcsecond token set",
+        REGISTRY_REFUSED,
     ),
 )
 
@@ -284,6 +299,17 @@ def explain_compose_failure(stderr: str) -> Optional[str]:
 
 def raise_compose_failure(what: str, result: subprocess.CompletedProcess) -> None:
     explanation = explain_compose_failure(result.stderr)
+    if explanation == REGISTRY_REFUSED:
+        # "Unauthorized" reads the same whether the token is wrong or was never
+        # saved (a password store that could not write it, a first `start`
+        # before `token set`); the two call for different words.
+        from . import token  # token imports this module
+
+        explanation = (
+            REGISTRY_REFUSED_WITH_TOKEN
+            if token.has_token()
+            else REGISTRY_REFUSED_NO_TOKEN
+        )
     lines = [f"`{what}` failed (exit code {result.returncode})."]
     if explanation:
         lines += ["", explanation]

{arcsecond-4.3.0 → arcsecond-4.3.2}/arcsecond/hosting/token.py

@@ -4,7 +4,8 @@ From the operator's side there is one fact: Arcsecond sent a token, and it
 has to be entered once so the machine can download Arcsecond.local. What it
 is underneath — a login to the container registry the images are pulled
 from, ghcr.io, as the organisation user — is this module's business, not
-theirs, and the words "registry" and "docker" stay out of what they read.
+theirs, and the words "registry" and "docker" stay out of what they read —
+except when Docker's own password store is what failed, which only they can fix.
 
 The token is asked for without echo, or read from standard input for a
 script, and handed to Docker over a pipe. There is deliberately no
@@ -52,21 +53,23 @@ def docker_config_path() -> Path:
 def has_token() -> bool:
     """Whether Docker on this machine holds a credential for the images.
 
-    Docker lists the registry under `auths` in its config even when the secret
-    itself lives in a credential store (Docker Desktop's, the OS keychain), so
-    the key's presence is the answer in the common case. When the config names
-    a store and lists nothing, the store is asked.
+    When the config names a credential store (Docker Desktop's, `pass`, the OS
+    keychain), the store is the truth and is asked: the empty entry Docker
+    leaves under `auths` survives a store being emptied or replaced, and a
+    machine whose `pass` was never initialised can carry one from an older
+    login. Without a store, the secret sits inline under `auths`. Only when
+    the store cannot answer — its helper missing, or waiting on a passphrase
+    prompt nobody sees — does the entry's presence stand in for it.
     """
     try:
         config = json.loads(docker_config_path().read_text(encoding="utf-8") or "{}")
     except (OSError, ValueError):
         return False
     auths = config.get("auths") or {}
-    if any(REGISTRY in key for key in auths):
-        return True
+    entries = [value for key, value in auths.items() if REGISTRY in key]
     store = (config.get("credHelpers") or {}).get(REGISTRY) or config.get("credsStore")
     if not store:
-        return False
+        return any(isinstance(entry, dict) and entry.get("auth") for entry in entries)
     try:
         probe = subprocess.run(
             [f"docker-credential-{store}", "get"],
@@ -77,8 +80,13 @@ def has_token() -> bool:
             timeout=15,
         )
     except (FileNotFoundError, subprocess.TimeoutExpired, OSError):
+        return bool(entries)
+    if probe.returncode != 0:
+        return False
+    try:
+        return bool(json.loads(probe.stdout or "{}").get("Secret"))
+    except ValueError:
         return False
-    return probe.returncode == 0 and REGISTRY_USER in (probe.stdout or "")
 
 
 def store_token(token: str) -> None:
@@ -96,7 +104,10 @@ def store_token(token: str) -> None:
         token=token + "\n",
     )
     if result.returncode != 0:
-        detail = (result.stderr or result.stdout or "").strip().splitlines()
+        output = (result.stderr or result.stdout or "").strip()
+        if _is_credential_store_failure(output):
+            raise ArcsecondError(_credential_store_advice(output))
+        detail = output.splitlines()
         reason = detail[-1] if detail else "Docker gave no reason"
         raise ArcsecondError(
             f"The token was refused: {reason}\n"
@@ -105,6 +116,43 @@ def store_token(token: str) -> None:
         )
 
 
+# Docker only saves the credential once the registry has accepted it, so these
+# words mean the token was good and the machine's own keychain failed. Docker
+# Desktop on Linux keeps credentials in `pass`, which is empty until someone
+# runs `pass init` — it says so in its install notes, and nobody reads them.
+_CREDENTIAL_STORE_FAILURES = ("error saving credentials", "error storing credentials")
+
+
+def _is_credential_store_failure(output: str) -> bool:
+    lowered = output.lower()
+    return any(words in lowered for words in _CREDENTIAL_STORE_FAILURES)
+
+
+def _credential_store_advice(output: str) -> str:
+    lowered = output.lower()
+    head = (
+        "The token is good — Arcsecond accepted it — but this machine could not "
+        "save it: Docker keeps it in a password store that refused to write.\n"
+    )
+    if "pass init" in lowered or "pass not initialized" in lowered:
+        return head + (
+            "Docker Desktop on Linux uses `pass`, and it has not been set up yet. "
+            "Set it up once, then run `arcsecond token set` again:\n"
+            "    gpg --generate-key          (any name and e-mail; note the key id it prints)\n"
+            "    pass init <that key id>\n"
+            "Or, if this machine runs Docker Engine without Docker Desktop, remove the "
+            f'"credsStore" line from {docker_config_path()} and Docker will keep the '
+            "token in that file instead."
+        )
+    detail = output.splitlines()[-1] if output else ""
+    return head + (
+        f"It said: {detail}\n"
+        'Unlock or repair that store, or remove the "credsStore" line from '
+        f"{docker_config_path()} so Docker keeps the token in that file, then run "
+        "`arcsecond token set` again."
+    )
+
+
 def prompt_for_token() -> str:
     return click.prompt(
         "Access token from Arcsecond (nothing is shown while you type)", hide_input=True

{arcsecond-4.3.0 → arcsecond-4.3.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "arcsecond"
-version = "4.3.0"
+version = "4.3.2"
 authors = [
     { name = "Cedric Foellmi", email = "cedric@arcsecond.io" },
 ]

{arcsecond-4.3.0 → arcsecond-4.3.2}/tests/test_hosting_token.py

@@ -7,6 +7,7 @@ import pytest
 from click.testing import CliRunner
 
 from arcsecond import cli
+from arcsecond.errors import ArcsecondError
 from arcsecond.hosting import local, stack, token
 
 
@@ -65,6 +66,42 @@ def test_a_refused_token_is_explained_without_docker_words(docker):
     assert "registry" not in result.output.lower()
 
 
+def _login_fails_with(monkeypatch, stderr):
+    def fake_run(cmd, input=None, **kwargs):
+        return subprocess.CompletedProcess(cmd, 1, stdout="", stderr=stderr)
+
+    monkeypatch.setattr(token.subprocess, "run", fake_run)
+
+
+def test_an_uninitialised_pass_store_is_not_a_refused_token(docker, monkeypatch):
+    _login_fails_with(
+        monkeypatch,
+        "Error saving credentials: error storing credentials - err: exit status 1, "
+        'out: `pass not initialized: exit status 1: Error: password store is empty. Try "pass init".`',
+    )
+    result = _invoke("token", "set", input="ghp_good\n")
+    assert result.exit_code == 1
+    assert (
+        "token is good" in result.output
+        and "refused" not in result.output.split("\n")[0]
+    )
+    assert "pass init" in result.output and "gpg --generate-key" in result.output
+    assert "team@arcsecond.io" not in result.output
+
+
+def test_any_other_credential_store_failure_names_the_config(
+    docker, monkeypatch, tmp_path
+):
+    _login_fails_with(
+        monkeypatch,
+        "Error saving credentials: error storing credentials - err: exit status 1, out: `keychain locked`",
+    )
+    result = _invoke("token", "set", input="ghp_good\n")
+    assert result.exit_code == 1
+    assert "token is good" in result.output and "keychain locked" in result.output
+    assert "credsStore" in result.output and "gpg" not in result.output
+
+
 def test_chevrons_and_empty_input_never_reach_docker(docker):
     assert "placeholder" in _invoke("token", "set", input="<ghp_good>\n").output
     assert _invoke("token", "set", "--stdin", input="\n").exit_code == 1
@@ -81,12 +118,61 @@ def test_status_reads_dockers_config(docker, tmp_path):
     result = _invoke("token")
     assert result.exit_code == 1 and "no token yet" in result.output
     (tmp_path / "config.json").write_text(
-        json.dumps({"auths": {"ghcr.io": {}}, "credsStore": "desktop"})
+        json.dumps({"auths": {"ghcr.io": {"auth": "YXJjc2Vjb25kLWlvOng="}}})
     )
     result = _invoke("token")
     assert result.exit_code == 0 and "has the token" in result.output
 
 
+def _store_answers(monkeypatch, tmp_path, config, returncode, stdout=""):
+    monkeypatch.setattr(token, "docker_config_path", lambda: tmp_path / "config.json")
+    (tmp_path / "config.json").write_text(json.dumps(config))
+
+    def fake_run(cmd, input=None, **kwargs):
+        return subprocess.CompletedProcess(cmd, returncode, stdout=stdout)
+
+    monkeypatch.setattr(token.subprocess, "run", fake_run)
+
+
+def test_an_empty_entry_is_not_a_token_when_the_store_holds_nothing(
+    monkeypatch, tmp_path
+):
+    # JB's machine: `pass` never initialised, an `auths` entry left behind.
+    _store_answers(
+        monkeypatch,
+        tmp_path,
+        {"auths": {"ghcr.io": {}}, "credsStore": "desktop"},
+        returncode=1,
+        stdout="credentials not found in native keychain",
+    )
+    assert token.has_token() is False
+
+
+def test_a_token_saved_under_another_username_still_counts(monkeypatch, tmp_path):
+    # Before 4.2 the documentation had people log in under their own name.
+    _store_answers(
+        monkeypatch,
+        tmp_path,
+        {"credsStore": "pass"},
+        returncode=0,
+        stdout=json.dumps({"Username": "jb", "Secret": "x"}),
+    )
+    assert token.has_token() is True
+
+
+def test_a_store_that_cannot_answer_falls_back_on_the_entry(monkeypatch, tmp_path):
+    monkeypatch.setattr(token, "docker_config_path", lambda: tmp_path / "config.json")
+    (tmp_path / "config.json").write_text(
+        json.dumps({"auths": {"ghcr.io": {}}, "credsStore": "pass"})
+    )
+
+    def hangs(cmd, **kwargs):
+        raise subprocess.TimeoutExpired(cmd, 15)
+
+    monkeypatch.setattr(token.subprocess, "run", hangs)
+    assert token.has_token() is True
+
+
 def test_has_token_asks_the_credential_store_when_the_config_lists_nothing(
     monkeypatch, tmp_path
 ):
@@ -114,6 +200,27 @@ def test_start_points_at_the_token_when_the_pull_is_denied():
     )
 
 
+@pytest.mark.parametrize(
+    "saved, says, never",
+    [
+        (False, "no token saved", "expired"),
+        (True, "was refused", "no token saved"),
+    ],
+)
+def test_start_tells_a_missing_token_from_a_refused_one(
+    monkeypatch, saved, says, never
+):
+    monkeypatch.setattr(token, "has_token", lambda: saved)
+    result = subprocess.CompletedProcess(
+        [], 1, stderr="Error response from daemon: error from registry: unauthorized"
+    )
+    with pytest.raises(ArcsecondError) as excinfo:
+        stack.raise_compose_failure("docker compose up", result)
+    message = str(excinfo.value)
+    assert says in message and never not in message
+    assert "arcsecond token set" in message
+
+
 # --- setup asks for it -----------------------------------------------------------
 
 

{arcsecond-4.3.0 → arcsecond-4.3.2}/uv.lock

@@ -155,7 +155,7 @@ wheels = [
 
 [[package]]
 name = "arcsecond"
-version = "4.3.0"
+version = "4.3.2"
 source = { editable = "." }
 dependencies = [
     { name = "alpyca" },