arcsecond 4.3.1__tar.gz → 4.3.2__tar.gz

{arcsecond-4.3.1 → arcsecond-4.3.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: arcsecond
-Version: 4.3.1
+Version: 4.3.2
 Summary: CLI for arcsecond.io
 Project-URL: Homepage, https://github.com/arcsecond-io/cli
 Project-URL: Issues, https://github.com/arcsecond-io/cli/issues

{arcsecond-4.3.1 → arcsecond-4.3.2}/arcsecond/hosting/stack.py

@@ -229,6 +229,22 @@ def compose_streaming(
     )
 
 
+REGISTRY_REFUSED = (
+    "Docker could not download an Arcsecond image: the registry refused.\n"
+    "Enter the token Arcsecond gave your observatory:  arcsecond token set"
+)
+REGISTRY_REFUSED_NO_TOKEN = (
+    "Docker could not download an Arcsecond image: this machine has no token "
+    "saved, so it asked without one.\n"
+    "Enter the token Arcsecond gave your observatory:  arcsecond token set\n"
+    'It must answer "Token accepted." before Arcsecond.local can be downloaded.'
+)
+REGISTRY_REFUSED_WITH_TOKEN = (
+    "Docker could not download an Arcsecond image: the token this machine holds "
+    "was refused. It may have expired or been replaced — enter the current one "
+    "with  arcsecond token set,  or ask team@arcsecond.io for a new one."
+)
+
 # The compose failures the troubleshooting page used to explain, matched on
 # the daemon's own words so `start` can answer them on the spot.
 _KNOWN_FAILURES = (
@@ -267,8 +283,7 @@ _KNOWN_FAILURES = (
     ),
     (
         ("denied", "unauthorized", "pull access denied"),
-        "Docker could not download an Arcsecond image: the registry refused.\n"
-        "Enter the token Arcsecond gave your observatory:  arcsecond token set",
+        REGISTRY_REFUSED,
     ),
 )
 
@@ -284,6 +299,17 @@ def explain_compose_failure(stderr: str) -> Optional[str]:
 
 def raise_compose_failure(what: str, result: subprocess.CompletedProcess) -> None:
     explanation = explain_compose_failure(result.stderr)
+    if explanation == REGISTRY_REFUSED:
+        # "Unauthorized" reads the same whether the token is wrong or was never
+        # saved (a password store that could not write it, a first `start`
+        # before `token set`); the two call for different words.
+        from . import token  # token imports this module
+
+        explanation = (
+            REGISTRY_REFUSED_WITH_TOKEN
+            if token.has_token()
+            else REGISTRY_REFUSED_NO_TOKEN
+        )
     lines = [f"`{what}` failed (exit code {result.returncode})."]
     if explanation:
         lines += ["", explanation]

{arcsecond-4.3.1 → arcsecond-4.3.2}/arcsecond/hosting/token.py

@@ -53,21 +53,23 @@ def docker_config_path() -> Path:
 def has_token() -> bool:
     """Whether Docker on this machine holds a credential for the images.
 
-    Docker lists the registry under `auths` in its config even when the secret
-    itself lives in a credential store (Docker Desktop's, the OS keychain), so
-    the key's presence is the answer in the common case. When the config names
-    a store and lists nothing, the store is asked.
+    When the config names a credential store (Docker Desktop's, `pass`, the OS
+    keychain), the store is the truth and is asked: the empty entry Docker
+    leaves under `auths` survives a store being emptied or replaced, and a
+    machine whose `pass` was never initialised can carry one from an older
+    login. Without a store, the secret sits inline under `auths`. Only when
+    the store cannot answer — its helper missing, or waiting on a passphrase
+    prompt nobody sees — does the entry's presence stand in for it.
     """
     try:
         config = json.loads(docker_config_path().read_text(encoding="utf-8") or "{}")
     except (OSError, ValueError):
         return False
     auths = config.get("auths") or {}
-    if any(REGISTRY in key for key in auths):
-        return True
+    entries = [value for key, value in auths.items() if REGISTRY in key]
     store = (config.get("credHelpers") or {}).get(REGISTRY) or config.get("credsStore")
     if not store:
-        return False
+        return any(isinstance(entry, dict) and entry.get("auth") for entry in entries)
     try:
         probe = subprocess.run(
             [f"docker-credential-{store}", "get"],
@@ -78,8 +80,13 @@ def has_token() -> bool:
             timeout=15,
         )
     except (FileNotFoundError, subprocess.TimeoutExpired, OSError):
+        return bool(entries)
+    if probe.returncode != 0:
+        return False
+    try:
+        return bool(json.loads(probe.stdout or "{}").get("Secret"))
+    except ValueError:
         return False
-    return probe.returncode == 0 and REGISTRY_USER in (probe.stdout or "")
 
 
 def store_token(token: str) -> None:

{arcsecond-4.3.1 → arcsecond-4.3.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "arcsecond"
-version = "4.3.1"
+version = "4.3.2"
 authors = [
     { name = "Cedric Foellmi", email = "cedric@arcsecond.io" },
 ]

{arcsecond-4.3.1 → arcsecond-4.3.2}/tests/test_hosting_token.py

@@ -7,6 +7,7 @@ import pytest
 from click.testing import CliRunner
 
 from arcsecond import cli
+from arcsecond.errors import ArcsecondError
 from arcsecond.hosting import local, stack, token
 
 
@@ -117,12 +118,61 @@ def test_status_reads_dockers_config(docker, tmp_path):
     result = _invoke("token")
     assert result.exit_code == 1 and "no token yet" in result.output
     (tmp_path / "config.json").write_text(
-        json.dumps({"auths": {"ghcr.io": {}}, "credsStore": "desktop"})
+        json.dumps({"auths": {"ghcr.io": {"auth": "YXJjc2Vjb25kLWlvOng="}}})
     )
     result = _invoke("token")
     assert result.exit_code == 0 and "has the token" in result.output
 
 
+def _store_answers(monkeypatch, tmp_path, config, returncode, stdout=""):
+    monkeypatch.setattr(token, "docker_config_path", lambda: tmp_path / "config.json")
+    (tmp_path / "config.json").write_text(json.dumps(config))
+
+    def fake_run(cmd, input=None, **kwargs):
+        return subprocess.CompletedProcess(cmd, returncode, stdout=stdout)
+
+    monkeypatch.setattr(token.subprocess, "run", fake_run)
+
+
+def test_an_empty_entry_is_not_a_token_when_the_store_holds_nothing(
+    monkeypatch, tmp_path
+):
+    # JB's machine: `pass` never initialised, an `auths` entry left behind.
+    _store_answers(
+        monkeypatch,
+        tmp_path,
+        {"auths": {"ghcr.io": {}}, "credsStore": "desktop"},
+        returncode=1,
+        stdout="credentials not found in native keychain",
+    )
+    assert token.has_token() is False
+
+
+def test_a_token_saved_under_another_username_still_counts(monkeypatch, tmp_path):
+    # Before 4.2 the documentation had people log in under their own name.
+    _store_answers(
+        monkeypatch,
+        tmp_path,
+        {"credsStore": "pass"},
+        returncode=0,
+        stdout=json.dumps({"Username": "jb", "Secret": "x"}),
+    )
+    assert token.has_token() is True
+
+
+def test_a_store_that_cannot_answer_falls_back_on_the_entry(monkeypatch, tmp_path):
+    monkeypatch.setattr(token, "docker_config_path", lambda: tmp_path / "config.json")
+    (tmp_path / "config.json").write_text(
+        json.dumps({"auths": {"ghcr.io": {}}, "credsStore": "pass"})
+    )
+
+    def hangs(cmd, **kwargs):
+        raise subprocess.TimeoutExpired(cmd, 15)
+
+    monkeypatch.setattr(token.subprocess, "run", hangs)
+    assert token.has_token() is True
+
+
 def test_has_token_asks_the_credential_store_when_the_config_lists_nothing(
     monkeypatch, tmp_path
 ):
@@ -150,6 +200,27 @@ def test_start_points_at_the_token_when_the_pull_is_denied():
     )
 
 
+@pytest.mark.parametrize(
+    "saved, says, never",
+    [
+        (False, "no token saved", "expired"),
+        (True, "was refused", "no token saved"),
+    ],
+)
+def test_start_tells_a_missing_token_from_a_refused_one(
+    monkeypatch, saved, says, never
+):
+    monkeypatch.setattr(token, "has_token", lambda: saved)
+    result = subprocess.CompletedProcess(
+        [], 1, stderr="Error response from daemon: error from registry: unauthorized"
+    )
+    with pytest.raises(ArcsecondError) as excinfo:
+        stack.raise_compose_failure("docker compose up", result)
+    message = str(excinfo.value)
+    assert says in message and never not in message
+    assert "arcsecond token set" in message
+
+
 # --- setup asks for it -----------------------------------------------------------
 
 

{arcsecond-4.3.1 → arcsecond-4.3.2}/uv.lock

@@ -155,7 +155,7 @@ wheels = [
 
 [[package]]
 name = "arcsecond"
-version = "4.3.1"
+version = "4.3.2"
 source = { editable = "." }
 dependencies = [
     { name = "alpyca" },