bt-cli 0.4.57__tar.gz → 0.4.58__tar.gz

{bt_cli-0.4.57 → bt_cli-0.4.58}/.github/workflows/release.yml

@@ -48,6 +48,7 @@ jobs:
         with:
           name: bt-linux-amd64
           path: dist/bt-linux-amd64
+          retention-days: 7
 
   # Build macOS and Windows binaries
   build-binaries:
@@ -96,6 +97,7 @@ jobs:
         with:
           name: ${{ matrix.asset_name }}
           path: dist/${{ matrix.asset_name }}
+          retention-days: 7
 
   # Build Python package
   build-package:
@@ -125,6 +127,7 @@ jobs:
         with:
           name: python-package
           path: dist/*
+          retention-days: 7
 
   # Create GitHub release with all artifacts
   release:
@@ -251,6 +254,7 @@ jobs:
           path: dist
 
       - name: Publish to PyPI
+        # No password — uses Trusted Publishing (OIDC) via the registered
+        # PyPI publisher for this repo/workflow/environment; also enables
+        # PEP 740 attestations, which an explicit password would disable.
         uses: pypa/gh-action-pypi-publish@release/v1
-        with:
-          password: ${{ secrets.PYPI_API_TOKEN }}

{bt_cli-0.4.57 → bt_cli-0.4.58}/CLAUDE.md

@@ -1,6 +1,6 @@
 # BT-CLI
 
-BeyondTrust Platform CLI for Password Safe, Entitle, PRA, EPM Windows, EPM Linux, and the BeyondTrust Secrets API. **Version: 0.4.57**
+BeyondTrust Platform CLI for Password Safe, Entitle, PRA, EPM Windows, EPM Linux, and the BeyondTrust Secrets API. **Version: 0.4.58**
 
 ## Setup
 
@@ -39,7 +39,7 @@ Use these slash commands for detailed product guidance:
 | Product | Command | Key Operations |
 |---------|---------|----------------|
 | Cross-product | `bt quick` | `pasm-onboard`, `pasm-offboard`, `pasm-search` |
-| Password Safe | `bt pws` | `systems`, `accounts`, `credentials`, `secrets`, `quick` |
+| Password Safe | `bt pws` | `systems`, `accounts`, `credentials`, `sessions`, `secrets`, `audit`, `quick` |
 | PRA | `bt pra` | `jump-items`, `vault`, `jump-groups`, `quick` |
 | Entitle | `bt entitle` | `integrations`, `resources`, `bundles`, `permissions` |
 | EPM Windows | `bt epmw` | `computers`, `groups`, `policies`, `requests`, `quick` |
@@ -81,6 +81,7 @@ PASSWORD=$(bt pws quick checkout -s server -a admin --raw)
 - PRA K8s tunnels: Require Linux jumpoint
 - PWS assets: Must create via workgroup endpoint
 - ECM integration: PWS system name must match PRA jump item name
+- **PWS `/Sessions` ignores `limit`/`offset`** and returns the full session *history* every call — never `paginate()` it (infinite loop); `list_sessions` does a single GET and `bt pws sessions list` caps display client-side. `Status` codes (live-confirmed): 0=Not started, 1=Active, 2=Completed, 5=Locked, 7=Terminated; `--active`=Status 1. Active sessions have `EndTime`==`StartTime` (placeholder, not null) — identify live sessions by Status, not timestamps. **`terminate` = `POST /Sessions/{id}/Terminate`** (symmetric w/ `/Lock`); `/Sessions/{id}` is GET/PUT only (DELETE → 405).
 - Entitle permissions: Use server-side filters (`--resource`, `--user`, `--integration`) - dataset can be 20k+ records
 - Entitle users: Use `--all` flag only when needed - default fetches first page only
 - Windows builds: Rich must be pinned to `<14.0.0` (Rich 14 has PyInstaller unicode issues)

{bt_cli-0.4.57 → bt_cli-0.4.58}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: bt-cli
-Version: 0.4.57
+Version: 0.4.58
 Summary: BeyondTrust Platform CLI (unofficial) - Password Safe, Entitle, PRA, EPM
 Author-email: Dave Grendysz <dgrendysz@beyondtrust.com>
 License: MIT

{bt_cli-0.4.57 → bt_cli-0.4.58}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "bt-cli"
-version = "0.4.57"
+version = "0.4.58"
 description = "BeyondTrust Platform CLI (unofficial) - Password Safe, Entitle, PRA, EPM"
 readme = "README.md"
 requires-python = ">=3.9"

{bt_cli-0.4.57 → bt_cli-0.4.58}/src/bt_cli/__init__.py

@@ -1,3 +1,3 @@
 """BeyondTrust Unified Admin CLI."""
 
-__version__ = "0.4.57"
+__version__ = "0.4.58"

{bt_cli-0.4.57 → bt_cli-0.4.58}/src/bt_cli/data/skills/pws/SKILL.md

@@ -13,6 +13,7 @@ description: Password Safe commands for credentials, systems, accounts, secrets,
 - `bt pws secrets safes delete` - Deletes entire safe
 - `bt pws secrets folders delete` - Deletes folder and contents
 - `bt pws quick offboard` - Removes system + accounts + asset
+- `bt pws sessions terminate` - Ends an active session (cannot be resumed; use `suspend` to lock instead)
 
 List affected resources first, then ask for explicit confirmation.
 
@@ -38,6 +39,11 @@ bt pws quick search root -o json
 # Rotate password
 bt pws quick rotate -s "axion-finapp-01" -a "root"
 
+# Test stored credential (non-destructive - does NOT rotate)
+# Exit 0 = valid, 2 = failed the test
+bt pws quick test -s "axion-finapp-01" -a "root"
+bt pws accounts test <account_id>
+
 # Onboard system (asset + system + account)
 # First find your workgroup and functional account IDs (see "Discover IDs" below)
 bt pws quick onboard -n "my-server" -i "10.0.1.50" -w <workgroup_id>
@@ -144,6 +150,55 @@ bt pws credentials show <request_id>
 bt pws credentials checkin <request_id>
 ```
 
+## Sessions (view / suspend / terminate)
+
+```bash
+# List sessions - newest first, capped at 25 by default
+bt pws sessions list
+bt pws sessions list --active        # only live sessions (started, not ended)
+bt pws sessions list --all -o json   # full history
+bt pws sessions get <session_id>
+
+# Suspend = lock (user disconnected, session can be resumed)
+bt pws sessions suspend <session_id>
+
+# Terminate = end permanently (cannot be resumed) - prompts unless --force
+bt pws sessions terminate <session_id>
+bt pws sessions terminate <session_id> --force
+```
+
+**Gotchas:**
+- `/Sessions` returns session **history**, not just active sessions, and **ignores `limit`/`offset`** (returns the full set every call - the client does a single GET, the CLI caps display client-side). Use `--active` for the live ones.
+- `Status` codes confirmed live: **0 = Not started, 1 = Active, 2 = Completed, 5 = Locked, 7 = Terminated** (3/9 are other terminal states). `--active` filters on Status == 1.
+- An **active session's `EndTime` is a placeholder equal to `StartTime`** (not null), so you can't identify live sessions by timestamps alone - use the Status code. `suspend` moves Status 1 → 5 (Locked); `terminate` moves it → 7 (Terminated).
+- **`terminate` is `POST /Sessions/{id}/Terminate`** (symmetric with `/Lock`). `/Sessions/{id}` only allows GET/PUT - a DELETE returns 405.
+
+## Permissions (Secrets Safe)
+
+Safe permission grant/revoke is already supported (this is the "assign permissions via API" capability):
+
+```bash
+bt pws secrets safes permissions-options          # list valid flags
+bt pws secrets safes permissions <safe_id>        # show current grants
+bt pws secrets safes grant <safe_id> --user <uid> --permissions "Read,Edit"
+bt pws secrets safes grant <safe_id> --group <gid> --permissions "Manage" --expires <iso8601>
+bt pws secrets safes revoke <safe_id> --user <uid>
+```
+
+**Valid permission flags:** `None, Read, Create, Edit, Delete, Share, Manage` (`Manage` = full control / manage permissions).
+
+## Audit Evidence Export
+
+SIEM is the primary audit channel; these commands pull ad-hoc evidence (request + session history):
+
+```bash
+bt pws audit export --file evidence.json                 # both, JSON
+bt pws audit export --requests --status approved --file reqs.csv --format csv
+bt pws audit export --sessions -o json                   # stdout
+```
+
+**Note:** with `--format csv` and both sections, files are split (`evidence-requests.csv`, `evidence-sessions.csv`) since CSV is single-table.
+
 ## CSV Import/Export
 
 ```bash

{bt_cli-0.4.57 → bt_cli-0.4.58}/src/bt_cli/pws/client/passwordsafe.py

@@ -288,6 +288,26 @@ class PasswordSafeMixin:
         # Use POST to trigger immediate password change
         return self.post(f"/ManagedAccounts/{account_id}/Credentials/Change")
 
+    def test_managed_account_credential(
+        self: "PasswordSafeClient",
+        account_id: int,
+    ) -> dict[str, Any]:
+        """Test the stored credential for a managed account.
+
+        Tests whether the credential currently stored in Password Safe still
+        authenticates against the target system, using the configured
+        functional account. This is non-destructive — it does not rotate or
+        change the password.
+
+        Args:
+            account_id: Managed account ID to test
+
+        Returns:
+            Response with a ``Success`` boolean indicating whether the
+            credential authenticated successfully.
+        """
+        return self.post(f"/ManagedAccounts/{account_id}/Credentials/Test")
+
     # =========================================================================
     # Credential Requests (Checkout/Checkin)
     # =========================================================================
@@ -525,7 +545,14 @@ class PasswordSafeMixin:
         if status:
             params["status"] = status
 
-        return self.paginate("/Sessions", params=params)
+        # NOTE: /Sessions ignores limit/offset and returns the full set on every
+        # call, so paginate() would loop forever. Use a single GET and normalize.
+        result = self.get("/Sessions", params=params)
+        if isinstance(result, list):
+            return result
+        if isinstance(result, dict) and "Data" in result:
+            return result["Data"]
+        return []
 
     def get_session(self: "PasswordSafeClient", session_id: int) -> dict[str, Any]:
         """Get a session by ID.
@@ -552,13 +579,16 @@ class PasswordSafeMixin:
     def terminate_session(self: "PasswordSafeClient", session_id: int) -> dict[str, Any]:
         """Terminate an active session.
 
+        Note: /Sessions/{id} only allows GET/PUT (DELETE returns 405). Termination
+        is a POST to the /Terminate sub-resource, symmetric with /Lock.
+
         Args:
             session_id: Session ID to terminate
 
         Returns:
             Response from termination
         """
-        return self.delete(f"/Sessions/{session_id}")
+        return self.post(f"/Sessions/{session_id}/Terminate")
 
     # =========================================================================
     # Applications

{bt_cli-0.4.57 → bt_cli-0.4.58}/src/bt_cli/pws/commands/__init__.py

@@ -11,6 +11,7 @@ app = typer.Typer(
 # Import and register command groups
 from . import auth, systems, accounts, assets, workgroups, platforms, users
 from . import credentials, config, databases, directories, clouds, secrets, quick, functional, search, attributes
+from . import sessions, audit
 from .import_export import import_app, export_app
 
 app.add_typer(auth.app, name="auth", help="Authentication commands")
@@ -21,6 +22,8 @@ app.add_typer(assets.app, name="assets", help="BeyondInsight assets")
 app.add_typer(workgroups.app, name="workgroups", help="Manage workgroups")
 app.add_typer(platforms.app, name="platforms", help="View available platforms")
 app.add_typer(credentials.app, name="credentials", help="Credential checkout/checkin")
+app.add_typer(sessions.app, name="sessions", help="View and control active sessions")
+app.add_typer(audit.app, name="audit", help="Export audit evidence (request/session history)")
 app.add_typer(config.app, name="config", help="View Password Safe configuration")
 app.add_typer(databases.app, name="databases", help="Manage database instances")
 app.add_typer(directories.app, name="directories", help="Manage directories (Entra ID, AD)")

{bt_cli-0.4.57 → bt_cli-0.4.58}/src/bt_cli/pws/commands/accounts.py

@@ -372,6 +372,53 @@ def rotate_password(
         raise typer.Exit(1)
 
 
+@app.command("test")
+def test_credential(
+    account_id: int = typer.Argument(..., help="Managed account ID to test"),
+) -> None:
+    """Test the stored credential for a managed account.
+
+    Checks whether the password Password Safe currently holds still
+    authenticates against the target system (using the functional account).
+    This is non-destructive — it does NOT rotate or change the password.
+
+    Exit code 0 = credential valid, 2 = credential failed the test.
+    """
+    try:
+        with get_client() as client:
+            client.authenticate()
+
+            # Get account details for display
+            account = client.get_managed_account(account_id)
+            account_name = account.get("AccountName", "Unknown")
+            system_name = account.get("SystemName", str(account.get("ManagedSystemID", "?")))
+
+            console.print(f"Testing credential for [cyan]{account_name}[/cyan] on [yellow]{system_name}[/yellow]...")
+
+            result = client.test_managed_account_credential(account_id)
+
+            success = bool(result.get("Success")) if isinstance(result, dict) else False
+
+            if success:
+                console.print(f"[green]Credential test PASSED for {account_name}@{system_name}[/green]")
+            else:
+                console.print(f"[red]Credential test FAILED for {account_name}@{system_name}[/red]")
+                console.print("[dim]The stored password no longer authenticates. Consider rotating: bt pws accounts rotate {0}[/dim]".format(account_id))
+                raise typer.Exit(2)
+
+    except typer.Exit:
+        raise
+    except httpx.HTTPStatusError as e:
+        print_api_error(e, "test credential")
+        raise typer.Exit(1)
+    except httpx.RequestError as e:
+        print_api_error(e, "test credential")
+        raise typer.Exit(1)
+    except Exception as e:
+        print_api_error(e, "test credential")
+        raise typer.Exit(1)
+
+
 # =============================================================================
 # Synced Accounts
 # =============================================================================

bt_cli-0.4.58/src/bt_cli/pws/commands/audit.py

@@ -0,0 +1,117 @@
+"""CLI commands for exporting Password Safe audit evidence.
+
+These commands export request and session history as evidence artifacts. They
+are NOT a replacement for the SIEM audit stream - the platform's SIEM output is
+the primary, tamper-evident audit channel. Use this for ad-hoc evidence pulls
+(e.g. attaching request/session history to a ticket or access review).
+"""
+
+import csv
+import json
+
+import httpx
+import typer
+from rich.console import Console
+
+from ...core.output import print_api_error
+from ..client.base import get_client
+
+app = typer.Typer(no_args_is_help=True, help="Export audit evidence (request/session history)")
+console = Console()
+
+
+def _flatten(rows: list[dict]) -> list[dict]:
+    """Stable union of keys across rows for CSV columns."""
+    cols: list[str] = []
+    for r in rows:
+        for k in r.keys():
+            if k not in cols:
+                cols.append(k)
+    return cols
+
+
+def _write_csv(path: str, rows: list[dict]) -> None:
+    cols = _flatten(rows)
+    with open(path, "w", newline="", encoding="utf-8") as f:
+        writer = csv.DictWriter(f, fieldnames=cols, extrasaction="ignore")
+        writer.writeheader()
+        for r in rows:
+            writer.writerow({k: ("" if r.get(k) is None else r.get(k)) for k in cols})
+
+
+@app.command("export")
+def export_audit(
+    requests: bool = typer.Option(False, "--requests", help="Include credential request history"),
+    sessions: bool = typer.Option(False, "--sessions", help="Include session history"),
+    status: str = typer.Option(None, "--status", "-s", help="Filter requests by status"),
+    file: str = typer.Option(None, "--file", help="Write evidence to this file (otherwise prints to stdout)"),
+    fmt: str = typer.Option("json", "--format", help="Output format when writing a file: json or csv"),
+    output: str = typer.Option("json", "--output", "-o", help="Stdout format when no --file: json or table"),
+) -> None:
+    """Export request and/or session history as audit evidence.
+
+    Defaults to BOTH requests and sessions when neither flag is given.
+    Note: SIEM is the primary audit channel - this is for ad-hoc evidence pulls.
+
+    Examples:
+        bt pws audit export --file evidence.json
+        bt pws audit export --requests --status approved --file requests.csv --format csv
+        bt pws audit export --sessions -o json
+    """
+    # Default: include both when neither is specified
+    if not requests and not sessions:
+        requests = sessions = True
+
+    try:
+        with get_client() as client:
+            client.authenticate()
+
+            evidence: dict[str, list[dict]] = {}
+            if requests:
+                evidence["requests"] = client.list_requests(status=status, limit=None)
+            if sessions:
+                evidence["sessions"] = client.list_sessions()
+
+        # Write to file
+        if file:
+            if fmt == "csv":
+                # CSV is single-table; pick the one section requested, or split into two files.
+                sections = [k for k in ("requests", "sessions") if k in evidence]
+                if len(sections) == 1:
+                    _write_csv(file, evidence[sections[0]])
+                    written = [file]
+                else:
+                    # Two sections: derive per-section filenames (foo.csv -> foo-requests.csv)
+                    base = file[:-4] if file.lower().endswith(".csv") else file
+                    written = []
+                    for sec in sections:
+                        path = f"{base}-{sec}.csv"
+                        _write_csv(path, evidence[sec])
+                        written.append(path)
+            else:
+                with open(file, "w", encoding="utf-8") as f:
+                    json.dump(evidence, f, indent=2, default=str)
+                written = [file]
+
+            counts = ", ".join(f"{k}={len(v)}" for k, v in evidence.items())
+            console.print(f"[green]Audit evidence exported ({counts}).[/green]")
+            for p in written:
+                console.print(f"  [cyan]{p}[/cyan]")
+            return
+
+        # No file: print to stdout
+        if output == "json":
+            console.print_json(json.dumps(evidence, default=str))
+        else:
+            for section, rows in evidence.items():
+                console.print(f"[bold]{section}[/bold]: {len(rows)} records")
+
+    except httpx.HTTPStatusError as e:
+        print_api_error(e, "export audit evidence")
+        raise typer.Exit(1)
+    except httpx.RequestError as e:
+        print_api_error(e, "export audit evidence")
+        raise typer.Exit(1)
+    except Exception as e:
+        print_api_error(e, "export audit evidence")
+        raise typer.Exit(1)

{bt_cli-0.4.57 → bt_cli-0.4.58}/src/bt_cli/pws/commands/quick.py

@@ -492,6 +492,98 @@ def quick_rotate(
         raise typer.Exit(1)
 
 
+@app.command("test")
+def quick_test(
+    system: str = typer.Option(..., "--system", "-s", help="System name (partial match supported)"),
+    account: str = typer.Option(..., "--account", "-a", help="Account name"),
+) -> None:
+    """Find an account and test its stored credential.
+
+    Combines: find system -> find account -> test credential
+
+    Non-destructive — checks whether the password Password Safe holds still
+    authenticates against the system, without rotating it.
+
+    Exit code 0 = credential valid, 2 = credential failed the test.
+
+    Examples:
+        bt pws quick test -s "axion-finapp-01" -a "root"
+        bt pws quick test -s axion -a svc-backup
+    """
+    try:
+        with get_client() as client:
+            client.authenticate()
+
+            # Step 1: Find the system
+            console.print(f"[dim]Finding system '{system}'...[/dim]")
+            systems = client.list_managed_systems(search=system)
+
+            if not systems:
+                print_error(f"No system found matching '{system}'")
+                raise typer.Exit(1)
+
+            # Try exact match first, then partial
+            matched_system = None
+            for s in systems:
+                if s.get("SystemName", "").lower() == system.lower():
+                    matched_system = s
+                    break
+
+            if not matched_system:
+                matched_system = systems[0]
+                if len(systems) > 1:
+                    console.print(f"[yellow]Multiple matches found, using: {matched_system.get('SystemName')}[/yellow]")
+
+            system_id = matched_system.get("ManagedSystemID")
+            system_name = matched_system.get("SystemName")
+
+            # Step 2: Find the account
+            console.print(f"[dim]Finding account '{account}' on {system_name}...[/dim]")
+            accounts = client.list_managed_accounts(system_id=system_id)
+
+            matched_account = None
+            for acc in accounts:
+                if acc.get("AccountName", "").lower() == account.lower():
+                    matched_account = acc
+                    break
+
+            if not matched_account:
+                print_error(f"Account '{account}' not found on system '{system_name}'")
+                if accounts:
+                    console.print("[dim]Available accounts:[/dim]")
+                    for acc in accounts[:10]:
+                        console.print(f"  - {acc.get('AccountName')}")
+                raise typer.Exit(1)
+
+            account_id = matched_account.get("AccountId", matched_account.get("ManagedAccountID"))
+            account_name = matched_account.get("AccountName")
+
+            # Step 3: Test the credential
+            console.print(f"[dim]Testing credential for {account_name}@{system_name}...[/dim]")
+            result = client.test_managed_account_credential(account_id)
+
+            success = bool(result.get("Success")) if isinstance(result, dict) else False
+
+        if success:
+            print_success(f"Credential test PASSED for {account_name}@{system_name}")
+        else:
+            print_error(f"Credential test FAILED for {account_name}@{system_name}")
+            console.print("[dim]The stored password no longer authenticates. Consider: bt pws quick rotate -s ... -a ...[/dim]")
+            raise typer.Exit(2)
+
+    except typer.Exit:
+        raise
+    except httpx.HTTPStatusError as e:
+        print_api_error(e, "quick test")
+        raise typer.Exit(1)
+    except httpx.RequestError as e:
+        print_api_error(e, "quick test")
+        raise typer.Exit(1)
+    except Exception as e:
+        print_api_error(e, "quick test")
+        raise typer.Exit(1)
+
+
 @app.command("find-secret")
 def quick_find_secret(
     query: str = typer.Argument(..., help="Search term (searches folders and secrets)"),