buildify-cli 1.0.0__py3-none-any.whl

buildify_cli/config.py

@@ -0,0 +1,593 @@
+from __future__ import annotations
+
+import os
+import re
+import stat
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any, Optional
+
+try:
+    import tomllib  # py311+
+except ModuleNotFoundError:
+    import tomli as tomllib  # type: ignore[no-redef]
+
+import tomli_w
+
+DEFAULT_BASE_URL = "https://openapi.buildify.cn"
+ENV_BASE_URL = "BUILDIFY_OPENAPI_BASE_URL"
+ENV_API_KEY = "BUILDIFY_OPENAPI_API_KEY"
+ENV_PROFILE = "BUILDIFY_OPENAPI_PROFILE"
+ENV_JSON = "BUILDIFY_OPENAPI_JSON"
+# Set to 1/true/yes to never prompt for a missing key (CI / non-interactive).
+ENV_NO_PROMPT = "BUILDIFY_OPENAPI_NO_PROMPT"
+
+# ~/.buildifyrc 与 buildify-publish 共用；开放 API 的配置放在独立 section 下，
+# 避免两套密钥（发布 / 编排）互相覆盖。
+RC_SECTION = "openapi"
+
+RC_KEYS = frozenset({"base_url", "api_key"})
+
+RC_FILE_MODE = stat.S_IRUSR | stat.S_IWUSR  # 0600 — owner read/write only
+
+# 旧的单密钥写在 [openapi].api_key，列出时当作这个名字。与 profiles.default 冲突时以具名档为准。
+LEGACY_PROFILE_NAME = "default"
+WORKSPACE_FILENAME = ".buildify-workspace"
+PROFILE_NAME_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$")
+_PROFILE_META_KEYS = ("tenant_id", "key_name", "key_prefix")
+
+MISSING_API_KEY_REASON = "missing_api_key"
+PROFILE_REQUIRED_REASON = "profile_required"
+PROFILE_NOT_FOUND_REASON = "profile_not_found"
+WORKSPACE_KEY_MISSING_REASON = "workspace_key_missing"
+
+API_KEY_SETUP_GUIDE = """如何获取：
+  1. 打开 Buildify 控制台，进入当前工作空间
+  2. 空间设置 → 开放 API 密钥 → 创建
+  3. 复制完整密钥（格式 keyId.secret）。明文只显示一次，请立刻保存；之后只能看到前缀
+
+如何保存到本机（任选其一，<名字> 自定，不会改默认空间）：
+  - 交互输入（推荐，输入时隐藏）：buildify config add-profile <名字>
+  - 管道写入，避免出现在 argv / shell 历史：
+      printf '%s' '你的密钥' | buildify config add-profile <名字>
+  - 只有一把密钥时也可以：buildify config set-key api_key
+
+密钥写入 ~/.buildifyrc 的 [openapi] 段，文件权限 600（仅当前用户可读写）。
+
+安全注意：
+  - 不要使用 --api-key 或把密钥写在命令行参数里（会出现在进程列表和 shell 历史）
+  - 不要把密钥写进项目仓库、会提交的 .env、issue 或聊天记录
+  - 不要截图完整密钥；配置文件不要提交到 git
+  - Agent 保存后只应展示掩码（config show），不要回显明文"""
+
+MISSING_API_KEY_USER_MESSAGE = (
+    "未配置开放 API 密钥，无法调用编排接口。\n\n" + API_KEY_SETUP_GUIDE
+)
+
+MISSING_API_KEY_AGENT_INSTRUCTIONS = (
+    "Stop authoring. Show the user how to create an Open API key in the console "
+    "(workspace settings → Open API keys → Create) and ask them to provide the "
+    "full keyId.secret once. Save with stdin: printf '%s' '<key>' | buildify "
+    "config add-profile <name>. Never echo the secret, never pass --api-key, never "
+    "write it into the repo, never run `config use` unless they asked to change "
+    "the default workspace. Then run: buildify --json key test."
+)
+
+PROFILE_REQUIRED_USER_MESSAGE = (
+    "本机保存了多个工作空间的密钥，这次没有选定用哪一个。\n"
+    "请选择配置档名称，之后的命令加上 --profile <name>。\n"
+    "不要执行 config use，除非明确要求更换默认工作空间。"
+)
+
+PROFILE_REQUIRED_AGENT_INSTRUCTIONS = (
+    "Stop. Show the user the profiles list (name, tenantId, keyName) and ask which "
+    "workspace to use once. Then pass --profile <name> on every subsequent command. "
+    "Do not run `buildify config use` unless the user explicitly asked to change the "
+    "default workspace. Never print api_key or the secret."
+)
+
+WORKSPACE_KEY_MISSING_USER_MESSAGE = (
+    "当前项目钉住了一个工作空间，但本机没有对上的开放 API 密钥。\n"
+    "请在该工作空间的控制台创建密钥，再用 config add-profile 保存。"
+)
+
+WORKSPACE_KEY_MISSING_AGENT_INSTRUCTIONS = (
+    "Stop. This repo is pinned to a workspace id and no local profile matches it. "
+    "Ask the user to create an Open API key in that workspace and save it with "
+    "stdin: printf '%s' '<key>' | buildify config add-profile <name>. "
+    "Do not author against a different workspace. Never echo the secret, never "
+    "pass --api-key, never run `config use` unless they asked to change the default."
+)
+
+
+def config_file_path() -> Path:
+    """~/.buildifyrc — TOML section [openapi], keys: base_url, api_key."""
+    return Path.home() / ".buildifyrc"
+
+
+@dataclass
+class StoredProfile:
+    """One local key. ``legacy`` means it is stored as [openapi].api_key, not under profiles."""
+
+    name: str
+    api_key: str
+    tenant_id: Optional[str] = None
+    key_name: Optional[str] = None
+    key_prefix: Optional[str] = None
+    legacy: bool = False
+
+
+@dataclass
+class ResolvedConfig:
+    base_url: str
+    api_key: Optional[str]
+    json_output: bool
+    profile: Optional[str] = None
+    tenant_id: Optional[str] = None
+    # Set when a key cannot be chosen (multiple profiles, unknown name, or workspace pin miss).
+    auth_error: Optional[dict[str, Any]] = None
+
+
+def _read_toml_file(path: Path) -> dict[str, Any]:
+    if not path.is_file():
+        return {}
+    return tomllib.loads(path.read_bytes().decode("utf-8"))
+
+
+def load_raw_config() -> dict[str, Any]:
+    return _read_toml_file(config_file_path())
+
+
+def load_file_config() -> dict[str, Any]:
+    section = load_raw_config().get(RC_SECTION)
+    return section if isinstance(section, dict) else {}
+
+
+def normalize_base_url(url: str) -> str:
+    return url.strip().rstrip("/")
+
+
+def _opt_str(value: Any) -> Optional[str]:
+    if value is None:
+        return None
+    text = str(value).strip()
+    return text or None
+
+
+def validate_profile_name(name: str) -> str:
+    n = name.strip()
+    if not PROFILE_NAME_RE.match(n):
+        raise ValueError(
+            "profile name must match [A-Za-z0-9][A-Za-z0-9._-]{0,63}"
+        )
+    return n
+
+
+def list_stored_profiles(section: Optional[dict[str, Any]] = None) -> list[StoredProfile]:
+    """Named profiles plus the legacy [openapi].api_key as ``default`` when that name is free."""
+    if section is None:
+        section = load_file_config()
+    found: list[StoredProfile] = []
+    names: set[str] = set()
+    table = section.get("profiles")
+    if isinstance(table, dict):
+        for raw_name, body in table.items():
+            if not isinstance(body, dict):
+                continue
+            key = _opt_str(body.get("api_key"))
+            if not key:
+                continue
+            name = str(raw_name)
+            names.add(name)
+            found.append(StoredProfile(
+                name=name,
+                api_key=key,
+                tenant_id=_opt_str(body.get("tenant_id")),
+                key_name=_opt_str(body.get("key_name")),
+                key_prefix=_opt_str(body.get("key_prefix")),
+            ))
+    legacy = _opt_str(section.get("api_key"))
+    if legacy and LEGACY_PROFILE_NAME not in names:
+        found.append(StoredProfile(
+            name=LEGACY_PROFILE_NAME,
+            api_key=legacy,
+            tenant_id=_opt_str(section.get("tenant_id")),
+            key_name=_opt_str(section.get("key_name")),
+            key_prefix=_opt_str(section.get("key_prefix")),
+            legacy=True,
+        ))
+    return found
+
+
+def profile_public(profile: StoredProfile, current: Optional[str]) -> dict[str, Any]:
+    """Fields safe to print. Never includes api_key."""
+    return {
+        "name": profile.name,
+        "tenantId": profile.tenant_id,
+        "keyName": profile.key_name,
+        "keyPrefix": profile.key_prefix,
+        "current": profile.name == current,
+    }
+
+
+def _public_profiles(profiles: list[StoredProfile], current: Optional[str]) -> list[dict[str, Any]]:
+    return [profile_public(p, current) for p in profiles]
+
+
+def find_workspace_id(start: Optional[Path] = None) -> Optional[str]:
+    """Walk from ``start`` (default cwd) toward the filesystem root for ``.buildify-workspace``."""
+    cur = (start or Path.cwd()).resolve()
+    if cur.is_file():
+        cur = cur.parent
+    for directory in (cur, *cur.parents):
+        candidate = directory / WORKSPACE_FILENAME
+        if not candidate.is_file():
+            continue
+        workspace_id = _read_workspace_id(candidate)
+        if workspace_id:
+            return workspace_id
+    return None
+
+
+def _read_workspace_id(path: Path) -> Optional[str]:
+    try:
+        text = path.read_text(encoding="utf-8")
+    except OSError:
+        return None
+    for line in text.splitlines():
+        stripped = line.strip()
+        if stripped and not stripped.startswith("#"):
+            return stripped
+    return None
+
+
+def _selected(base: str, json_output: bool, profile: StoredProfile) -> ResolvedConfig:
+    return ResolvedConfig(
+        base_url=base,
+        api_key=profile.api_key,
+        json_output=json_output,
+        profile=profile.name,
+        tenant_id=profile.tenant_id,
+    )
+
+
+def resolve_config(
+    *,
+    cli_base_url: Optional[str],
+    cli_api_key: Optional[str],
+    cli_json: bool = False,
+    cli_profile: Optional[str] = None,
+    cwd: Optional[Path] = None,
+) -> ResolvedConfig:
+    file_cfg = load_file_config()
+    base = cli_base_url or os.environ.get(ENV_BASE_URL) or file_cfg.get("base_url")
+    if not base or not str(base).strip():
+        base = DEFAULT_BASE_URL
+    base = normalize_base_url(str(base))
+
+    json_env = os.environ.get(ENV_JSON, "").strip().lower() in ("1", "true", "yes")
+    json_output = bool(cli_json) or json_env
+    profiles = list_stored_profiles(file_cfg)
+    by_name = {p.name: p for p in profiles}
+    current = _opt_str(file_cfg.get("current"))
+
+    explicit = _opt_str(cli_api_key) or _opt_str(os.environ.get(ENV_API_KEY))
+    if explicit:
+        matched = next((p for p in profiles if p.api_key == explicit), None)
+        return ResolvedConfig(
+            base_url=base,
+            api_key=explicit,
+            json_output=json_output,
+            profile=matched.name if matched else None,
+            tenant_id=matched.tenant_id if matched else None,
+        )
+
+    requested = _opt_str(cli_profile) or _opt_str(os.environ.get(ENV_PROFILE))
+    if requested:
+        found = by_name.get(requested)
+        if found is None:
+            return ResolvedConfig(
+                base_url=base,
+                api_key=None,
+                json_output=json_output,
+                auth_error=profile_not_found_payload(requested, profiles, current),
+            )
+        return _selected(base, json_output, found)
+
+    workspace_id = find_workspace_id(cwd)
+    if workspace_id:
+        matches = [p for p in profiles if p.tenant_id == workspace_id]
+        if len(matches) == 1:
+            return _selected(base, json_output, matches[0])
+        if len(matches) > 1:
+            current_match = next((p for p in matches if p.name == current), None)
+            if current_match is not None:
+                return _selected(base, json_output, current_match)
+            return ResolvedConfig(
+                base_url=base,
+                api_key=None,
+                json_output=json_output,
+                auth_error=profile_required_payload(matches, current, workspace_id),
+            )
+        return ResolvedConfig(
+            base_url=base,
+            api_key=None,
+            json_output=json_output,
+            auth_error=workspace_key_missing_payload(workspace_id, profiles, current),
+        )
+
+    if current and current in by_name:
+        return _selected(base, json_output, by_name[current])
+
+    if len(profiles) == 1:
+        return _selected(base, json_output, profiles[0])
+
+    if not profiles:
+        return ResolvedConfig(base_url=base, api_key=None, json_output=json_output)
+
+    return ResolvedConfig(
+        base_url=base,
+        api_key=None,
+        json_output=json_output,
+        auth_error=profile_required_payload(profiles, current),
+    )
+
+
+def env_flag(name: str) -> bool:
+    return os.environ.get(name, "").strip().lower() in ("1", "true", "yes")
+
+
+def normalize_api_key(value: str) -> str:
+    """Strip and reject empty / whitespace / obviously malformed keys."""
+    v = value.strip()
+    if not v:
+        raise ValueError("api_key cannot be empty")
+    if any(c.isspace() for c in v):
+        raise ValueError("api_key must not contain whitespace")
+    if "." not in v:
+        raise ValueError("api_key must be keyId.secret")
+    return v
+
+
+def missing_api_key_payload() -> dict[str, Any]:
+    """Machine-readable hint for agents when no key is configured."""
+    return {
+        "reason": MISSING_API_KEY_REASON,
+        "configPath": str(config_file_path()),
+        "section": RC_SECTION,
+        "howToGet": [
+            "Open the Buildify console and enter the current workspace",
+            "Workspace settings → Open API keys → Create",
+            "Copy the full key (keyId.secret). The secret is shown only once",
+        ],
+        "howToSave": "printf '%s' '<key>' | buildify config add-profile <name>",
+        "userMessage": MISSING_API_KEY_USER_MESSAGE.strip(),
+        "agentInstructions": MISSING_API_KEY_AGENT_INSTRUCTIONS,
+        "security": [
+            "Do not pass --api-key (visible in process list and shell history)",
+            "Do not write the key into the project tree or commit it",
+            f"{config_file_path()} is created with mode 600",
+            "After saving, only show the masked value from `config show`",
+        ],
+    }
+
+
+def profile_required_payload(
+    profiles: list[StoredProfile],
+    current: Optional[str],
+    workspace_id: Optional[str] = None,
+) -> dict[str, Any]:
+    data: dict[str, Any] = {
+        "reason": PROFILE_REQUIRED_REASON,
+        "profiles": _public_profiles(profiles, current),
+        "userMessage": PROFILE_REQUIRED_USER_MESSAGE.strip(),
+        "agentInstructions": PROFILE_REQUIRED_AGENT_INSTRUCTIONS,
+        "howToSelect": "buildify --profile <name> --json key test",
+    }
+    if workspace_id:
+        data["workspaceId"] = workspace_id
+    return data
+
+
+def profile_not_found_payload(
+    name: str,
+    profiles: list[StoredProfile],
+    current: Optional[str],
+) -> dict[str, Any]:
+    return {
+        "reason": PROFILE_NOT_FOUND_REASON,
+        "profile": name,
+        "profiles": _public_profiles(profiles, current),
+        "userMessage": f"没有名为 {name} 的配置档。请从已保存的配置档里选一个。",
+        "agentInstructions": PROFILE_REQUIRED_AGENT_INSTRUCTIONS,
+    }
+
+
+def workspace_key_missing_payload(
+    workspace_id: str,
+    profiles: list[StoredProfile],
+    current: Optional[str],
+) -> dict[str, Any]:
+    return {
+        "reason": WORKSPACE_KEY_MISSING_REASON,
+        "workspaceId": workspace_id,
+        "profiles": _public_profiles(profiles, current),
+        "userMessage": WORKSPACE_KEY_MISSING_USER_MESSAGE.strip(),
+        "agentInstructions": WORKSPACE_KEY_MISSING_AGENT_INSTRUCTIONS,
+        "howToSave": "printf '%s' '<key>' | buildify config add-profile <name>",
+    }
+
+
+def _ordered(value: Any) -> Any:
+    """tomli_w rejects a table key that appears before a scalar at the same level."""
+    if not isinstance(value, dict):
+        return value
+    scalars = {k: v for k, v in value.items() if not isinstance(v, dict)}
+    tables = {k: _ordered(v) for k, v in value.items() if isinstance(v, dict)}
+    return {**scalars, **tables}
+
+
+def _save_raw(raw: dict[str, Any]) -> Path:
+    path = config_file_path()
+    path.parent.mkdir(parents=True, exist_ok=True)
+    path.write_text(tomli_w.dumps(_ordered(raw)), encoding="utf-8")
+    try:
+        path.chmod(RC_FILE_MODE)
+    except OSError:
+        pass
+    return path
+
+
+def _section_for_update() -> tuple[dict[str, Any], dict[str, Any]]:
+    raw = load_raw_config()
+    section = raw.get(RC_SECTION)
+    if not isinstance(section, dict):
+        section = {}
+        raw[RC_SECTION] = section
+    return raw, section
+
+
+def _write_section(updates: dict[str, Any]) -> Path:
+    raw, section = _section_for_update()
+    section.update(updates)
+    raw[RC_SECTION] = section
+    return _save_raw(raw)
+
+
+def _clear_meta(body: dict[str, Any]) -> None:
+    for key in _PROFILE_META_KEYS:
+        body.pop(key, None)
+
+
+def save_profile(name: str, api_key: str) -> Path:
+    """Store a key under profiles.<name>. Does not change ``current``."""
+    n = validate_profile_name(name)
+    key = normalize_api_key(api_key)
+    raw, section = _section_for_update()
+    if n == LEGACY_PROFILE_NAME and not isinstance(section.get("profiles"), dict):
+        section["api_key"] = key
+        _clear_meta(section)
+    elif n == LEGACY_PROFILE_NAME and LEGACY_PROFILE_NAME not in (section.get("profiles") or {}):
+        section["api_key"] = key
+        _clear_meta(section)
+    else:
+        table = section.get("profiles")
+        if not isinstance(table, dict):
+            table = {}
+            section["profiles"] = table
+        body = table.get(n)
+        if not isinstance(body, dict):
+            body = {}
+            table[n] = body
+        body["api_key"] = key
+        _clear_meta(body)
+    raw[RC_SECTION] = section
+    return _save_raw(raw)
+
+
+def set_current_profile(name: str) -> Path:
+    n = validate_profile_name(name)
+    raw, section = _section_for_update()
+    known = {p.name for p in list_stored_profiles(section)}
+    if n not in known:
+        raise ValueError(f"profile {n!r} does not exist")
+    section["current"] = n
+    raw[RC_SECTION] = section
+    return _save_raw(raw)
+
+
+def remove_profile(name: str) -> Path:
+    n = validate_profile_name(name)
+    raw, section = _section_for_update()
+    table = section.get("profiles")
+    removed = False
+    if isinstance(table, dict) and n in table:
+        del table[n]
+        if not table:
+            section.pop("profiles", None)
+        removed = True
+    if n == LEGACY_PROFILE_NAME and _opt_str(section.get("api_key")):
+        section.pop("api_key", None)
+        _clear_meta(section)
+        removed = True
+    if not removed:
+        raise ValueError(f"profile {n!r} does not exist")
+    if _opt_str(section.get("current")) == n:
+        section.pop("current", None)
+    raw[RC_SECTION] = section
+    return _save_raw(raw)
+
+
+def apply_key_test_metadata(profile_name: Optional[str], data: dict[str, Any]) -> bool:
+    """Cache tenantId / keyName / keyPrefix from a successful key test. Returns whether it wrote."""
+    if not profile_name or not isinstance(data, dict):
+        return False
+    fields = {
+        "tenant_id": _opt_str(data.get("tenantId") or data.get("tenant_id")),
+        "key_name": _opt_str(data.get("keyName") or data.get("key_name")),
+        "key_prefix": _opt_str(data.get("keyPrefix") or data.get("key_prefix")),
+    }
+    fields = {k: v for k, v in fields.items() if v}
+    if not fields:
+        return False
+    raw, section = _section_for_update()
+    target = next((p for p in list_stored_profiles(section) if p.name == profile_name), None)
+    if target is None:
+        return False
+    if target.legacy:
+        section.update(fields)
+    else:
+        table = section.get("profiles")
+        if not isinstance(table, dict) or not isinstance(table.get(profile_name), dict):
+            return False
+        table[profile_name].update(fields)
+    raw[RC_SECTION] = section
+    _save_raw(raw)
+    return True
+
+
+def write_rc_key(key: str, value: str) -> Path:
+    """Write a single allowed key into the [openapi] section of ~/.buildifyrc."""
+    k = key.strip()
+    if k not in RC_KEYS:
+        raise ValueError(f"unsupported config key {key!r}; allowed: {', '.join(sorted(RC_KEYS))}")
+    if k == "base_url":
+        v = normalize_base_url(value)
+        if not v:
+            raise ValueError("base_url cannot be empty")
+    else:
+        v = normalize_api_key(value)
+        raw, section = _section_for_update()
+        current = _opt_str(section.get("current"))
+        table = section.get("profiles")
+        named = isinstance(table, dict) and current and isinstance(table.get(current), dict)
+        if named:
+            table[current]["api_key"] = v
+            _clear_meta(table[current])
+        elif current and current != LEGACY_PROFILE_NAME and not named:
+            raise ValueError(f"current profile {current!r} does not exist")
+        else:
+            section["api_key"] = v
+            _clear_meta(section)
+        raw[RC_SECTION] = section
+        return _save_raw(raw)
+    return _write_section({k: v})
+
+
+def write_config_file(base_url: Optional[str] = None, api_key: Optional[str] = None) -> Path:
+    updates: dict[str, str] = {}
+    if base_url is not None:
+        updates["base_url"] = normalize_base_url(base_url)
+    if api_key is not None:
+        updates["api_key"] = normalize_api_key(api_key)
+    return _write_section(updates)
+
+
+def mask_api_key(api_key: str) -> str:
+    s = api_key.strip()
+    if "." in s:
+        kid, _, _rest = s.partition(".")
+        return f"{kid}.***"
+    if len(s) <= 4:
+        return "***"
+    return s[:2] + "***" + s[-2:]