bt-cli 0.4.48__tar.gz → 0.4.49__tar.gz

{bt_cli-0.4.48 → bt_cli-0.4.49}/CLAUDE.md

@@ -1,6 +1,6 @@
 # BT-CLI
 
-BeyondTrust Platform CLI for Password Safe, Entitle, PRA, EPM Windows, EPM Linux, and the BeyondTrust Secrets API. **Version: 0.4.48**
+BeyondTrust Platform CLI for Password Safe, Entitle, PRA, EPM Windows, EPM Linux, and the BeyondTrust Secrets API. **Version: 0.4.49**
 
 ## Setup
 

{bt_cli-0.4.48 → bt_cli-0.4.49}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: bt-cli
-Version: 0.4.48
+Version: 0.4.49
 Summary: BeyondTrust Platform CLI (unofficial) - Password Safe, Entitle, PRA, EPM
 Author-email: Dave Grendysz <dgrendysz@beyondtrust.com>
 License: MIT

{bt_cli-0.4.48 → bt_cli-0.4.49}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "bt-cli"
-version = "0.4.48"
+version = "0.4.49"
 description = "BeyondTrust Platform CLI (unofficial) - Password Safe, Entitle, PRA, EPM"
 readme = "README.md"
 requires-python = ">=3.9"

{bt_cli-0.4.48 → bt_cli-0.4.49}/src/bt_cli/__init__.py

@@ -1,3 +1,3 @@
 """BeyondTrust Unified Admin CLI."""
 
-__version__ = "0.4.48"
+__version__ = "0.4.49"

{bt_cli-0.4.48 → bt_cli-0.4.49}/src/bt_cli/secrets/commands/dynamic.py

@@ -46,6 +46,32 @@ def _dynamic_row(item: dict) -> dict:
     }
 
 
+def _apply_hint(full_path: str, fmt: GenerateFormat) -> str:
+    """Build a one-line apply-recipe in syntax valid for the chosen format.
+
+    `eval $(...)`, `| iex`, and `for /f` all swallow comment lines harmlessly,
+    so embedding the hint costs nothing when the output is piped through —
+    it's just discoverable for users who run the command on its own first.
+
+    Non-shell formats (env / dotenv / json) get no hint: env/dotenv are for
+    writing to files, json is for scripts; neither has a single canonical
+    apply command.
+    """
+    if fmt is GenerateFormat.EXPORT:
+        return f"# Tip: apply with -> eval $(bt secrets dynamic generate {full_path})"
+    if fmt is GenerateFormat.POWERSHELL:
+        return (
+            f"# Tip: apply with -> "
+            f"bt secrets dynamic generate {full_path} --format powershell | iex"
+        )
+    if fmt is GenerateFormat.CMD:
+        return (
+            f'REM Tip: apply with -> for /f "delims=" %i in '
+            f"('bt secrets dynamic generate {full_path} --format cmd') do %i"
+        )
+    return ""
+
+
 def _format_credentials(secret: dict, fmt: GenerateFormat) -> str:
     """Format an AWS STS credential triplet in the requested shape.
 
@@ -227,6 +253,9 @@ def generate(
         print_error("Unrecognized credential shape; printing raw payload")
         print_json(secret)
         raise typer.Exit(1)
+    hint = _apply_hint(full_path, format_)
+    if hint:
+        text = f"{text}\n{hint}"
     typer.echo(text)
 
 

{bt_cli-0.4.48 → bt_cli-0.4.49}/tests/secrets/test_commands.py

@@ -194,6 +194,57 @@ class TestDynamic:
         assert "export AWS_SESSION_TOKEN=TOK-FAKE" in result.stdout
         # PAT must not leak in any form
         assert "PAT_test" not in result.stdout
+        # Inline apply-hint includes the actual path the user passed
+        assert "eval $(bt secrets dynamic generate lab/aws/ec2-readonly)" in result.stdout
+
+    @respx.mock
+    def test_dynamic_generate_powershell_hint(self, env_overrides):
+        respx.post(_url("/dynamic/ec2-readonly/generate")).mock(
+            return_value=httpx.Response(201, json={"secret": {
+                "accessKeyId": "ASIA-FAKE", "secretAccessKey": "SAK-FAKE",
+                "sessionToken": "TOK-FAKE", "expiration": "2026-01-01T00:00:00Z",
+            }})
+        )
+        result = CliRunner().invoke(
+            secrets_app, ["dynamic", "generate", "lab/aws/ec2-readonly", "--format", "powershell"],
+        )
+        assert result.exit_code == 0
+        assert "--format powershell | iex" in result.stdout
+        # Hint must use # (valid PowerShell comment); not REM
+        assert "REM Tip" not in result.stdout
+
+    @respx.mock
+    def test_dynamic_generate_cmd_hint(self, env_overrides):
+        respx.post(_url("/dynamic/ec2-readonly/generate")).mock(
+            return_value=httpx.Response(201, json={"secret": {
+                "accessKeyId": "ASIA-FAKE", "secretAccessKey": "SAK-FAKE",
+                "sessionToken": "TOK-FAKE", "expiration": "2026-01-01T00:00:00Z",
+            }})
+        )
+        result = CliRunner().invoke(
+            secrets_app, ["dynamic", "generate", "lab/aws/ec2-readonly", "--format", "cmd"],
+        )
+        assert result.exit_code == 0
+        assert "for /f" in result.stdout
+        assert "--format cmd" in result.stdout
+        # cmd format must use REM (not #) for the apply hint
+        assert "REM Tip" in result.stdout
+
+    @respx.mock
+    def test_dynamic_generate_no_hint_for_non_shell_formats(self, env_overrides):
+        """env / dotenv / json shouldn't carry an apply hint — no canonical apply mode."""
+        respx.post(_url("/dynamic/ec2-readonly/generate")).mock(
+            return_value=httpx.Response(201, json={"secret": {
+                "accessKeyId": "ASIA-FAKE", "secretAccessKey": "SAK-FAKE",
+                "sessionToken": "TOK-FAKE", "expiration": "2026-01-01T00:00:00Z",
+            }})
+        )
+        for fmt in ("env", "dotenv"):
+            result = CliRunner().invoke(
+                secrets_app, ["dynamic", "generate", "lab/aws/ec2-readonly", "--format", fmt],
+            )
+            assert result.exit_code == 0, fmt
+            assert "Tip: apply with" not in result.stdout, fmt
 
     @respx.mock
     def test_dynamic_generate_json(self, env_overrides):