bevor-cli 0.1.0__py3-none-any.whl

bevor_cli/commands/analyses/retry.py

@@ -0,0 +1,77 @@
+"""``bevor analysis retry`` — retry a failed pipeline."""
+
+from typing import Optional
+
+import typer
+from bevor_sdk._sync.resources._modules import EventResource
+from bevor_sdk.types import ID
+from bevor_sdk.types.requests.security import VersionBodyDict
+
+from bevor_cli import output
+from bevor_cli.annotations.confirmations import NO_WAIT, SILENT
+from bevor_cli.client import BevorInternalClient
+from bevor_cli.commands.analyses.run import render_status
+from bevor_cli.configuration.creds import Credentials
+from bevor_cli.configuration.state import State
+
+
+def retry_analysis(
+    version: Optional[str] = typer.Option(
+        None,
+        "--version",
+        help="Version id to retry (default: configured analysis head).",
+    ),
+    no_wait: NO_WAIT = False,
+    silent: SILENT = False,
+) -> None:
+    """Retry failed segments of a Bevor Security pipeline run for the configured analysis head (or ``--version``). See `bevor analyses run`."""
+    creds = Credentials.load()
+    creds.require_token()
+
+    state = State.load()
+    workspace_id = state.validate_workspace()
+
+    client = BevorInternalClient(
+        creds=creds, workspace_id=workspace_id, project_id=state.validate_project()
+    )
+
+    wait = not no_wait
+
+    opts: VersionBodyDict = {}
+    if version:
+        v_ = client.analysis_versions.get(ID(version))
+        analysis_id = v_.analysis_meta.id
+        version_id = v_.id
+        opts["version_id"] = version_id
+    else:
+        analysis_id = state.validate_analysis()
+
+    run_result = client.analyses.retry(analysis_id, opts, with_streaming=wait)
+
+    if wait and isinstance(run_result, EventResource):
+        ep_map = {}
+        eps = client.analyses.entrypoints(analysis_id, opts)
+        for ep in eps.results:
+            ep_map[ep.node.id] = (ep.node.short_id, ep.node.name, ep.pipeline_status)
+
+        if not silent:
+            with output.spinner("Analysis running…"):
+                for event in run_result.stream_completion():
+                    if event.id in ep_map:
+                        short_id, name, _ = ep_map[event.id]
+                        ep_map[event.id] = (short_id, name, event.status)
+                        render_status(ep_map)
+        else:
+            for event in run_result.stream_completion():
+                if event.id in ep_map:
+                    short_id, name, _ = ep_map[event.id]
+                    ep_map[event.id] = (short_id, name, event.status)
+
+        n_failures = sum(1 if status == "failed" else 0 for _, _, status in ep_map.values())
+        if n_failures > 0:
+            output.success(f"Analysis finished, {n_failures} failed.")
+        else:
+            output.success("Analysis finished")
+
+    else:
+        output.success("Retry queued.")

bevor_cli/commands/analyses/run.py

@@ -0,0 +1,87 @@
+"""``bevor analysis run`` — trigger analysis execution."""
+
+from typing import Mapping, Optional, Tuple
+
+import typer
+from bevor_sdk._sync.resources._modules import EventResource
+from bevor_sdk.types import ID
+from bevor_sdk.types.literals import AnalysisRunStatus
+from bevor_sdk.types.requests.security import RunAnalysisBodyDict
+from rich.live import Live
+from rich.table import Table
+
+from bevor_cli import output
+from bevor_cli.annotations.confirmations import NO_WAIT, SILENT
+from bevor_cli.client import BevorInternalClient
+from bevor_cli.configuration.creds import Credentials
+from bevor_cli.configuration.state import State
+
+
+def render_status(ep_map: Mapping[ID, Tuple[str, str, AnalysisRunStatus]]) -> Table:
+    table = Table.grid(padding=(0, 1))
+    for k in sorted(ep_map.keys()):
+        short_id, name, status = ep_map[k]
+        table.add_row(f"Entrypoint: {name} ({short_id})", f"Status: {status}")
+    return table
+
+
+def run_analysis(
+    version: Optional[str] = typer.Option(
+        None,
+        "--version",
+        help="Version id to run (default: configured analysis head).",
+    ),
+    no_wait: NO_WAIT = False,
+    silent: SILENT = False,
+) -> None:
+    """Start a run of Bevor Security pipeline for the configured analysis head (or ``--version``)."""
+    creds = Credentials.load()
+    creds.require_token()
+
+    state = State.load()
+    workspace_id = state.validate_workspace()
+
+    wait = not no_wait
+    client = BevorInternalClient(
+        creds=creds, workspace_id=workspace_id, project_id=state.validate_project()
+    )
+
+    opts: RunAnalysisBodyDict = {}
+    if version:
+        v_ = client.analysis_versions.get(ID(version))
+        analysis_id = v_.analysis_meta.id
+        version_id = v_.id
+        opts["version_id"] = version_id
+    else:
+        analysis_id = state.validate_analysis()
+
+    run_result = client.analyses.run(analysis_id, opts, with_streaming=wait)
+
+    if wait and isinstance(run_result, EventResource):
+        ep_map = {}
+        eps = client.analyses.entrypoints(analysis_id, opts)
+        for ep in eps.results:
+            if ep.pipeline_status != "not_run" and ep.is_analyzed_in_current:
+                ep_map[ep.node.id] = (ep.node.short_id, ep.node.name, ep.pipeline_status)
+
+        if not silent:
+            with Live(render_status(ep_map), console=output.console, refresh_per_second=8) as live:
+                for event in run_result.stream_completion():
+                    if event.id in ep_map:
+                        short_id, name, _ = ep_map[event.id]
+                        ep_map[event.id] = (short_id, name, event.status)
+                        live.update(render_status(ep_map))
+        else:
+            for event in run_result.stream_completion():
+                if event.id in ep_map:
+                    short_id, name, _ = ep_map[event.id]
+                    ep_map[event.id] = (short_id, name, event.status)
+
+        n_failures = sum(1 if status == "failed" else 0 for _, _, status in ep_map.values())
+        if n_failures > 0:
+            output.success(f"Analysis finished, {n_failures} failed.")
+        else:
+            output.success("Analysis finished")
+
+    else:
+        output.success("Run queued")

bevor_cli/commands/analyses/select.py

@@ -0,0 +1,85 @@
+"""``bevor analyses select`` — set the selected analysis."""
+
+from typing import Optional
+
+import questionary
+import typer
+from bevor_sdk.exceptions import NotFoundError
+from bevor_sdk.types import ID
+from bevor_sdk.types.requests.security import AnalysesQueryParams
+from bevor_sdk.types.responses.security import AnalysisSchema
+
+from bevor_cli import output
+from bevor_cli.client import BevorInternalClient
+from bevor_cli.configuration.creds import Credentials
+from bevor_cli.configuration.settings import Settings
+from bevor_cli.configuration.state import State
+from bevor_cli.select import _CANCEL, _select
+
+
+def select_analysis(
+    analysis_id: Optional[str] = typer.Argument(
+        None, help="Analysis id to select. Prompts with a list when omitted."
+    ),
+    page: Optional[int] = typer.Option(None, "--page", help="Page number to query"),
+    page_size: Optional[int] = typer.Option(None, "--page-size", help="Max analyses to fetch."),
+) -> None:
+    """Select an analysis in the selected project by id, or pick one from a list."""
+
+    creds = Credentials.load()
+    creds.require_token()
+
+    state = State.load()
+    workspace_id = state.validate_workspace()
+
+    client = BevorInternalClient(
+        creds=creds, workspace_id=workspace_id, project_id=state.validate_project()
+    )
+
+    if analysis_id:
+        try:
+            analysis_ = client.analyses.get(ID(analysis_id))
+        except NotFoundError:
+            output.error("analysis not found in the configured project")
+            raise typer.Exit(1)
+
+        if state.code_id != analysis_.version.code_version.id:
+            output.info("Updating code configuration")
+
+        state.set_analysis(analysis_)
+        state.save()
+        return
+
+    settings = Settings.load()
+
+    analyses = client.analyses.list(
+        AnalysesQueryParams(page_size=page_size or settings.default_page_size, page=page)
+    )
+
+    if not analyses.results:
+        output.error("No analyses found.", hint="Run `bevor analyses create` to create one.")
+        raise typer.Exit(1)
+
+    choices = [
+        questionary.Choice(
+            title=(
+                f"{a.name}  · {a.version.code_version.id}  "
+                f"{a.user.username}  "
+                f"{a.id}  {a.created_at.date()}"
+            ),
+            value=a,
+        )
+        for a in analyses.results
+    ] + [questionary.Choice(title="↵ Cancel", value=_CANCEL)]
+
+    analysis: AnalysisSchema | None = _select("Select an analysis:", choices)
+    if analysis is None:
+        raise typer.Exit(0)
+
+    if analysis.version.code_version.id != state.code_id:
+        output.info("Updating code configuration")
+
+    state.set_analysis(analysis)
+
+    output.info("Updated analysis configuration")
+    state.save()

bevor_cli/commands/analyses/set_head.py

@@ -0,0 +1,45 @@
+"""``bevor analyses set-head`` — move HEAD to a version; keep analysis_id in config."""
+
+import typer
+from bevor_sdk.types import ID
+from bevor_sdk.types.requests.security import SetHeadBodyDict
+
+from bevor_cli import output
+from bevor_cli.client import BevorInternalClient
+from bevor_cli.configuration.creds import Credentials
+from bevor_cli.configuration.state import State
+
+
+def set_analysis_head(
+    version_id: str = typer.Argument(..., help="Analysis version id to set as HEAD."),
+) -> None:
+    """Move the analysis HEAD to ``version_id``. This will change which analysis versions you act on."""
+    creds = Credentials.load()
+    creds.require_token()
+
+    state = State.load()
+    workspace_id = state.validate_workspace()
+    analysis_id = state.validate_analysis()
+
+    client = BevorInternalClient(
+        creds=creds, workspace_id=workspace_id, project_id=state.validate_project()
+    )
+
+    analysis_source = client.analyses(analysis_id)
+
+    analysis = analysis_source.get()
+    version = client.analysis_versions.get(ID(version_id))
+
+    if version.analysis_meta.id != analysis.id:
+        output.error(
+            f"Version {version_id} belongs to analysis {version.analysis_meta.id}, "
+            f"not the configured analysis {analysis_id}.",
+            hint="Run `bevor analyses select <analysis-id>` first, or pass a version of the configured analysis.",
+        )
+        raise typer.Exit(1)
+
+    result = analysis_source.set_head(SetHeadBodyDict(version_id=ID(version_id)))
+    state.set_analysis(result)
+    state.save()
+
+    output.success(f"HEAD set to {result.version.id}. Analysis {result.id} retained in config.")

bevor_cli/commands/analyses/transitions.py

@@ -0,0 +1,90 @@
+"""``bevor analysis transitions``."""
+
+from typing import Optional
+
+import typer
+from bevor_sdk.types import ID
+from bevor_sdk.types.literals import FindingTransitionReason
+from bevor_sdk.types.requests.security import TransitionQueryParams
+from rich.table import Table
+from rich.text import Text
+
+from bevor_cli.annotations.confirmations import JSON_OUT
+from bevor_cli.annotations.query import ORDER, ORDER_BY, PAGE, PAGE_SIZE
+from bevor_cli.client import BevorInternalClient
+from bevor_cli.commands.analyses.diff import _snapshot
+from bevor_cli.commands.findings.get import LEVEL_COLORS
+from bevor_cli.configuration.creds import Credentials
+from bevor_cli.configuration.settings import Settings
+from bevor_cli.configuration.state import State
+from bevor_cli.output import console
+
+
+def list_transitions(
+    page: PAGE = None,
+    page_size: PAGE_SIZE = None,
+    order: ORDER = None,
+    order_by: ORDER_BY = None,
+    reason: Optional[FindingTransitionReason] = typer.Option(
+        None, "--reason", help="Only show transitions with this reason (e.g. remediated)."
+    ),
+    version: Optional[str] = typer.Option(
+        None,
+        "--version",
+        help="Version id (default: configured analysis head).",
+    ),
+    project_wide: bool = typer.Option(
+        False, "--project-wide", help="List transitions across the whole project instead."
+    ),
+    json_out: JSON_OUT = False,
+) -> None:
+    """List finding transitions into the configured analysis head (or ``--version``), or across the whole project
+    with ``--project-wide``. Filter with ``--reason``, e.g. ``--reason remediated``."""
+    creds = Credentials.load()
+    creds.require_token()
+
+    state = State.load()
+    settings = Settings.load()
+    workspace_id = state.validate_workspace()
+
+    client = BevorInternalClient(
+        creds=creds, workspace_id=workspace_id, project_id=state.validate_project()
+    )
+
+    query_params = TransitionQueryParams(
+        page=page,
+        page_size=page_size or settings.default_page_size,
+        order=order,
+        order_by=order_by,
+        reason=reason,
+    )
+
+    if version:
+        query_params["after_version_id"] = ID(version)
+    elif not project_wide:
+        analysis = client.analyses.get(state.validate_analysis())
+        query_params["after_version_id"] = analysis.version.id
+
+    result = client.transitions.list(options=query_params)
+
+    if json_out:
+        console.print_json(result.model_dump_json(indent=2))
+        return
+
+    if not result.results:
+        console.print("No transitions.")
+        return
+
+    table = Table("Reason", "Type", "Level", "Name", "Version", "Created")
+    for item in result.results:
+        snapshot = _snapshot(item)
+        table.add_row(
+            item.reason,
+            snapshot.type,
+            Text(snapshot.level, style=LEVEL_COLORS[snapshot.level]),
+            snapshot.name,
+            str(item.after_version.id),
+            str(item.created_at.date()),
+        )
+
+    console.print(table)

bevor_cli/commands/analyses/view.py

@@ -0,0 +1,94 @@
+"""``bevor analyses view`` — show an analysis (the selected one by default) or a specific version."""
+
+from typing import Optional
+
+import typer
+from bevor_sdk.types import ID
+from rich.table import Table
+
+from bevor_cli.annotations.confirmations import JSON_OUT
+from bevor_cli.client import BevorInternalClient
+from bevor_cli.configuration.creds import Credentials
+from bevor_cli.configuration.state import State
+from bevor_cli.output import console
+
+
+def view_analysis(
+    analysis_id: Optional[str] = typer.Argument(
+        None, help="Analysis id. Defaults to the selected analysis."
+    ),
+    version: Optional[str] = typer.Option(
+        None,
+        "--version",
+        help="Act on this analysis version id instead of the configured analysis head.",
+    ),
+    json_out: JSON_OUT = False,
+) -> None:
+    """Print details for an analysis head (the selected analysis by default), or a specific ``--version``."""
+    creds = Credentials.load()
+    creds.require_token()
+
+    state = State.load()
+    workspace_id = state.validate_workspace()
+
+    client = BevorInternalClient(
+        creds=creds, workspace_id=workspace_id, project_id=state.validate_project()
+    )
+
+    if version is not None:
+        version_ = client.analysis_versions.get(ID(version))
+        analysis_meta_ = version_.analysis_meta
+    else:
+        analysis = client.analyses.get(state.validate_analysis(analysis_id))
+        version_ = analysis.version
+        analysis_meta_ = analysis
+
+    if json_out:
+        console.print_json(version_.model_dump_json(indent=2))
+        return
+
+    in_sync = state.code_id is not None and str(state.code_id) == str(version_.code_version.id)
+
+    table = Table(show_header=False, box=None, padding=(0, 1))
+    table.add_column(style="bold")
+    table.add_column()
+
+    table.add_row("Analysis ID", str(analysis_meta_.id))
+    table.add_row("Version ID", str(version_.id))
+    table.add_row("Name", analysis_meta_.name)
+    table.add_row("Trigger", str(version_.trigger))
+    table.add_row("Owner", str(analysis_meta_.is_owner))
+    table.add_row("Findings", str(version_.n_findings))
+    table.add_row(
+        "Code version",
+        version_.code_version.id,
+    )
+    table.add_row("Is head", str(version_.is_head))
+    table.add_row("Created at", str(version_.created_at.date()))
+    table.add_row("Created by", analysis_meta_.user.username)
+
+    if version_.merged_from_version:
+        table.add_row(
+            "Merged from",
+            f"{version_.merged_from_version.id}",
+        )
+    if version_.parent_version:
+        table.add_row(
+            "Parent version",
+            f"{version_.parent_version.id}",
+        )
+    if version_.forked_from_version:
+        table.add_row(
+            "Forked from",
+            f"{version_.forked_from_version.id}",
+        )
+    if version_.child_versions:
+        table.add_row("N Children", str(len(version_.child_versions)))
+    if version_.forked_versions:
+        table.add_row("N Forks", str(len(version_.forked_versions)))
+    if version_.merged_versions:
+        table.add_row("N Merges From", str(len(version_.merged_versions)))
+
+    table.add_row("In sync w/ .bevor code", str(in_sync))
+
+    console.print(table)

bevor_cli/commands/auth/__init__.py

@@ -0,0 +1,7 @@
+"""Top-level auth commands."""
+
+from .login import login
+from .logout import logout
+from .whoami import whoami
+
+__all__ = ["login", "logout", "whoami"]

bevor_cli/commands/auth/login.py

@@ -0,0 +1,135 @@
+"""``bevor login``."""
+
+import json
+import platform
+import secrets
+import socket
+import threading
+from queue import Empty, Queue
+from typing import List
+from urllib.parse import urlencode
+
+import httpx
+import typer
+
+from bevor_cli import output
+from bevor_cli.client import BevorInternalBusinessClient
+from bevor_cli.configuration.creds import Credentials
+from bevor_cli.settings import API_URL, APP_URL
+
+_LISTEN_TIMEOUT_S = 360.0
+
+
+def _cli_client_ip() -> str:
+    try:
+        with socket.socket(socket.AF_INET, socket.SOCK_DGRAM) as s:
+            s.settimeout(0.2)
+            s.connect(("8.8.8.8", 80))
+            return s.getsockname()[0]
+    except OSError:
+        return "127.0.0.1"
+
+
+def _sse_listen(token: str, result: Queue) -> None:
+    url = f"{API_URL.rstrip('/')}/v1/events/cli?token={token}"
+    try:
+        timeout = httpx.Timeout(_LISTEN_TIMEOUT_S + 30.0, connect=30.0)
+        with httpx.Client(timeout=timeout) as client:
+            with client.stream("GET", url) as response:
+                response.raise_for_status()
+                pending: List[str] = []
+                for line in response.iter_lines():
+                    if line == "":
+                        for row in pending:
+                            if row.startswith("data: "):
+                                payload = json.loads(row[6:])
+                                t = payload.get("type")
+                                if t == "authorized":
+                                    result.put(("ok", payload))
+                                    return
+                                if t == "closed":
+                                    result.put(("closed", payload))
+                                    return
+                        pending = []
+                        continue
+                    if line.startswith(":"):
+                        continue
+                    pending.append(line)
+        result.put(("closed", {"reason": "stream_ended"}))
+    except Exception as exc:
+        result.put(("error", exc))
+
+
+def login() -> None:
+    """Log in via browser.
+
+    Opens your default browser to authenticate with Bevor. Your credentials
+    are stored locally and used for subsequent commands.
+    """
+
+    creds = Credentials.load()
+
+    if creds.is_authenticated:
+        output.info("Already authenticated.")
+        return
+
+    session_id = secrets.token_urlsafe(24)
+    auth_url = f"{APP_URL.rstrip('/')}/cli-auth?{urlencode({'session_id': session_id})}"
+
+    device_name = socket.gethostname() or "unknown"
+    os_name = platform.platform()
+    ip_address = _cli_client_ip()
+
+    client = BevorInternalBusinessClient(creds=creds)
+
+    exchange_data = client.post(
+        "/v1/cli-tokens/exchange",
+        json={
+            "session_id": session_id,
+            "ip_address": ip_address,
+            "device_name": device_name,
+            "os_name": os_name,
+        },
+    ).json()
+
+    token = exchange_data["token"]
+
+    result: Queue = Queue(maxsize=1)
+    thread = threading.Thread(
+        target=_sse_listen,
+        args=(token, result),
+        daemon=True,
+    )
+    thread.start()
+
+    output.console.print(
+        f"If the browser does not open automatically, visit [bold blue link {auth_url}]{auth_url}[/]!"
+    )
+    typer.launch(auth_url)
+
+    with output.console.status("Waiting for login (complete in the browser)...", spinner="dots"):
+        try:
+            kind, payload = result.get(timeout=_LISTEN_TIMEOUT_S)
+        except Empty:
+            output.error("Timed out waiting for login.")
+            raise typer.Exit(1)
+
+    if kind == "error":
+        output.error(f"SSE error: {payload}")
+        raise typer.Exit(1)
+    if kind == "closed":
+        reason = payload.get("reason", "")
+        msg = "Login cancelled or closed."
+        if reason:
+            msg += f" ({reason})"
+        output.error(msg)
+        raise typer.Exit(1)
+
+    raw = payload["token"]
+    bearer = raw if raw.startswith("cli_") else f"cli_{raw}"
+    creds = Credentials.save(token=bearer)
+
+    client = BevorInternalBusinessClient(creds=creds)
+    user = client.me()
+
+    output.success(f"Logged in as {user.email or user.username}")

bevor_cli/commands/auth/logout.py

@@ -0,0 +1,23 @@
+"""``bevor logout``."""
+
+from bevor_cli import output
+from bevor_cli.client import BevorInternalBusinessClient
+from bevor_cli.configuration.creds import Credentials
+
+
+def logout() -> None:
+    """Remove stored credentials."""
+    creds = Credentials.load()
+
+    if not creds.is_authenticated:
+        output.info("Not currently authenticated")
+        return
+
+    client = BevorInternalBusinessClient(creds=creds)
+
+    try:
+        client.delete("/v1/cli-tokens/revoke/current")
+    except Exception:
+        pass  # still clear local credentials
+    creds.delete()
+    output.success("Logged out.")

bevor_cli/commands/auth/whoami.py

@@ -0,0 +1,21 @@
+"""``bevor whoami``."""
+
+from bevor_cli import output
+from bevor_cli.annotations.confirmations import JSON_OUT
+from bevor_cli.client import BevorInternalBusinessClient
+from bevor_cli.configuration.creds import Credentials
+
+
+def whoami(json_out: JSON_OUT = False) -> None:
+    """Show the currently authenticated user."""
+    creds = Credentials.load()
+    creds.require_token()
+
+    client = BevorInternalBusinessClient(creds=creds)
+
+    user = client.me()
+
+    if json_out:
+        output.console.print_json(user.model_dump_json(indent=2))
+    else:
+        output.console.print(user.email or user.username)