cloudsmith-cli 1.20.0__py3-none-any.whl

cloudsmith_cli/cli/webserver.py

@@ -0,0 +1,263 @@
+import html
+import os
+import socket
+from functools import cached_property
+from http.server import BaseHTTPRequestHandler, HTTPServer
+from urllib.parse import parse_qsl, unquote, urlparse
+
+import click
+
+from ..core.api.exceptions import ApiException
+from ..core.api.init import initialise_api
+from ..core.credentials.models import CredentialResult
+from ..core.keyring import store_sso_tokens
+from .saml import exchange_2fa_token
+
+
+def get_template_path(template_name):
+    """Get the absolute path to a template file."""
+    base_dir = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+    return os.path.join(base_dir, "templates", template_name)
+
+
+def render_template(template_name, **context):
+    """
+    Render a template with the given context.
+
+    Args:
+        template_name: Name of the template file
+        context: Dictionary of variables to replace in the template
+
+    Returns:
+        Rendered HTML content
+    """
+    template_path = get_template_path(template_name)
+
+    with open(template_path, encoding="utf-8") as file:
+        content = file.read()
+
+    # Replace placeholders with context values
+    for key, value in context.items():
+        placeholder = f"<!-- {key.upper()}_PLACEHOLDER -->"
+        content = content.replace(placeholder, value if value else "")
+
+    return content
+
+
+class AuthenticationWebServer(HTTPServer):
+    def __init__(
+        self, server_address, RequestHandlerClass, bind_and_activate=True, **kwargs
+    ):
+        self.owner = kwargs.get("owner")
+        self.session = kwargs.get("session")
+        self.debug = kwargs.get("debug", False)
+        self.refresh_api_on_success = kwargs.get("refresh_api_on_success", False)
+        self.api_opts = kwargs.get("api_opts")
+        self.sso_access_token = None
+        self.exception = None
+
+        super().__init__(
+            server_address, RequestHandlerClass, bind_and_activate=bind_and_activate
+        )
+
+        self.socket.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+
+    @property
+    def api_host(self):
+        """Get the API host from api_opts."""
+        return self.api_opts.host if self.api_opts else None
+
+    def refresh_api_config_after_auth(self):
+        """Refresh the API configuration to pick up newly stored SSO tokens."""
+        if not self.api_opts:
+            return
+
+        initialise_api(
+            debug=self.api_opts.debug,
+            host=self.api_opts.host,
+            proxy=getattr(self.api_opts, "proxy", None),
+            ssl_verify=getattr(self.api_opts, "ssl_verify", True),
+            user_agent=getattr(self.api_opts, "user_agent", None),
+            headers=getattr(self.api_opts, "headers", None),
+            rate_limit=getattr(self.api_opts, "rate_limit", True),
+            credential=(
+                CredentialResult(
+                    api_key=self.sso_access_token,
+                    source_name="sso",
+                    auth_type="bearer",
+                )
+                if self.sso_access_token
+                else None
+            ),
+        )
+
+    def finish_request(self, request, client_address):
+        self.RequestHandlerClass(
+            request,
+            client_address,
+            self,
+            owner=self.owner,
+            debug=self.debug,
+            session=self.session,
+            refresh_api_on_success=self.refresh_api_on_success,
+            server_instance=self,
+        )
+
+    def _handle_request_noblock(self):
+        # override to allow exceptions to bubble up to the CLI
+        try:
+            request, client_address = self.get_request()
+        except OSError:
+            return
+        if self.verify_request(request, client_address):
+            try:
+                self.process_request(request, client_address)
+            except (  # pylint: disable=broad-exception-caught
+                Exception,
+                ApiException,
+            ) as exc:
+                self.handle_error(request, client_address)
+                self.exception = exc
+                self.shutdown_request(request)
+            except BaseException:
+                self.shutdown_request(request)
+                raise
+        else:
+            self.shutdown_request(request)
+
+    def handle_error(self, request, client_address):
+        if self.debug:
+            super().handle_error(request, client_address)
+
+    def shutdown_request(self, request):
+        super().shutdown_request(request)
+        if self.exception:
+            exc = self.exception
+            self.exception = None  # Clear to prevent re-raising
+            raise exc
+
+
+class AuthenticationWebRequestHandler(BaseHTTPRequestHandler):
+    def __init__(self, request, client_address, server, **kwargs):
+        self.owner = kwargs.get("owner")
+        self.debug = kwargs.get("debug", False)
+        self.session = kwargs.get("session")
+        self.refresh_api_on_success = kwargs.get("refresh_api_on_success", False)
+        self.server_instance = kwargs.get("server_instance")
+
+        super().__init__(request, client_address, server)
+
+    @property
+    def api_host(self):
+        """Get the API host from the server instance."""
+        return self.server_instance.api_host if self.server_instance else None
+
+    def _return_response(self, status=200, message=None):
+        self.send_response(status)
+        self.send_header("Content-Type", "text/html; charset=utf-8")
+        self.end_headers()
+
+        self.wfile.write(message.encode("utf-8"))
+
+    def _return_success_response(self):
+        html_content = render_template("auth_success.html")
+        self._return_response(message=html_content)
+
+    def _return_error_response(self, error_message=None):
+        error_details = ""
+        if error_message:
+            safe_error = html.escape(unquote(error_message))
+            error_details = f"<p class='error-details'>Error: {safe_error}</p>"
+
+        html_content = render_template("auth_error.html", error_details=error_details)
+
+        self._return_response(
+            status=500,
+            message=html_content,
+        )
+
+    def log_request(self, code="-", size="-"):
+        if self.debug:
+            return super().log_request(code=code, size=size)
+
+        return
+
+    def log_error(self, format, *args):  # pylint: disable=redefined-builtin
+        if self.debug:
+            return super().log_error(format, *args)
+
+        return
+
+    @cached_property
+    def url(self):
+        return urlparse(self.path)
+
+    @cached_property
+    def query_data(self):
+        return dict(parse_qsl(self.url.query))
+
+    def do_GET(self):
+        access_token = self.query_data.get("access_token")
+        refresh_token = self.query_data.get("refresh_token")
+        two_factor_token = self.query_data.get("two_factor_token")
+        error = self.query_data.get("error")
+
+        if error:
+            click.secho(
+                f"\nAuthentication error received: {unquote(error)}", fg="red", err=True
+            )
+            self._return_error_response(error)
+            return
+
+        try:
+            if access_token:
+                # Store the access token on the server instance so it can be
+                # passed directly to initialise_api(), avoiding a keyring
+                # roundtrip (critical when CLOUDSMITH_NO_KEYRING is set).
+                if self.server_instance:
+                    self.server_instance.sso_access_token = access_token
+
+                if not store_sso_tokens(self.api_host, access_token, refresh_token):
+                    click.echo(
+                        "SSO tokens not stored (CLOUDSMITH_NO_KEYRING is set)",
+                        err=True,
+                    )
+
+                if self.refresh_api_on_success and self.server_instance:
+                    self.server_instance.refresh_api_config_after_auth()
+
+                self._return_success_response()
+                return
+
+            if two_factor_token:
+                totp_token = click.prompt(
+                    "Please enter your 2FA token", hide_input=True, type=str, err=True
+                )
+
+                access_token, refresh_token = exchange_2fa_token(
+                    self.api_host, two_factor_token, totp_token, session=self.session
+                )
+
+                # Store the access token on the server instance (same as above)
+                if self.server_instance:
+                    self.server_instance.sso_access_token = access_token
+
+                if not store_sso_tokens(self.api_host, access_token, refresh_token):
+                    click.echo(
+                        "SSO tokens not stored (CLOUDSMITH_NO_KEYRING is set)",
+                        err=True,
+                    )
+
+                if self.refresh_api_on_success and self.server_instance:
+                    self.server_instance.refresh_api_config_after_auth()
+
+                click.secho("\nAuthentication complete", fg="green", err=True)
+                self._return_success_response()
+                return
+        except Exception as exc:
+            self._return_error_response()
+            raise exc
+
+        click.secho("\nNo valid authentication parameters received", fg="red", err=True)
+        self._return_error_response()
+        return

cloudsmith_cli/core/__init__.py

@@ -0,0 +1 @@
+"""Non-CLI functionality."""

cloudsmith_cli/core/api/__init__.py

@@ -0,0 +1 @@
+"""Cloudsmith API Wrappers."""

cloudsmith_cli/core/api/distros.py

@@ -0,0 +1,31 @@
+"""API - Files endpoints."""
+
+import cloudsmith_api
+
+from .. import ratelimits
+from .exceptions import catch_raise_api_exception
+from .init import get_api_client
+
+
+def get_distros_api():
+    """Get the distros API client."""
+    return get_api_client(cloudsmith_api.DistrosApi)
+
+
+def list_distros(package_format=None):
+    """List available distributions."""
+    client = get_distros_api()
+
+    # pylint: disable=fixme
+    # TODO(ls): Add package format param on the server-side to filter distros
+    # instead of doing it here.
+    with catch_raise_api_exception():
+        distros, _, headers = client.distros_list_with_http_info()
+
+    ratelimits.maybe_rate_limit(client, headers)
+
+    return [
+        distro.to_dict()
+        for distro in distros
+        if not package_format or distro.format == package_format
+    ]

cloudsmith_cli/core/api/entitlements.py

@@ -0,0 +1,130 @@
+"""API - entitlements endpoints."""
+
+import cloudsmith_api
+
+from .. import ratelimits
+from ..pagination import PageInfo
+from .exceptions import catch_raise_api_exception
+from .init import get_api_client
+
+
+def get_entitlements_api():
+    """Get the entitlements API client."""
+    return get_api_client(cloudsmith_api.EntitlementsApi)
+
+
+def list_entitlements(owner, repo, page, page_size, show_tokens):
+    """Get a list of entitlements on a repository."""
+    client = get_entitlements_api()
+
+    with catch_raise_api_exception():
+        data, _, headers = client.entitlements_list_with_http_info(
+            owner=owner,
+            repo=repo,
+            page=page,
+            page_size=page_size,
+            show_tokens=show_tokens,
+        )
+
+    ratelimits.maybe_rate_limit(client, headers)
+    page_info = PageInfo.from_headers(headers)
+    entitlements = [ent.to_dict() for ent in data]  # pylint: disable=no-member
+    return entitlements, page_info
+
+
+def create_entitlement(owner, repo, name, token, show_tokens):
+    """Create an entitlement in a repository."""
+    client = get_entitlements_api()
+
+    data = {}
+    if name is not None:
+        data["name"] = name
+
+    if token is not None:
+        data["token"] = token
+
+    with catch_raise_api_exception():
+        data, _, headers = client.entitlements_create_with_http_info(
+            owner=owner, repo=repo, data=data, show_tokens=show_tokens
+        )
+
+    ratelimits.maybe_rate_limit(client, headers)
+    return data.to_dict()  # pylint: disable=no-member
+
+
+def delete_entitlement(owner, repo, identifier):
+    """Delete an entitlement from a repository."""
+    client = get_entitlements_api()
+
+    with catch_raise_api_exception():
+        _, _, headers = client.entitlements_delete_with_http_info(
+            owner=owner, repo=repo, identifier=identifier
+        )
+
+    ratelimits.maybe_rate_limit(client, headers)
+
+
+def update_entitlement(owner, repo, identifier, name, token, show_tokens):
+    """Update an entitlement in a repository."""
+    client = get_entitlements_api()
+
+    data = {}
+    if name is not None:
+        data["name"] = name
+
+    if token is not None:
+        data["token"] = token
+
+    with catch_raise_api_exception():
+        data, _, headers = client.entitlements_partial_update_with_http_info(
+            owner=owner,
+            repo=repo,
+            identifier=identifier,
+            data=data,
+            show_tokens=show_tokens,
+        )
+
+    ratelimits.maybe_rate_limit(client, headers)
+    return data.to_dict()  # pylint: disable=no-member
+
+
+def refresh_entitlement(owner, repo, identifier, show_tokens):
+    """Refresh an entitlement in a repository."""
+    client = get_entitlements_api()
+
+    with catch_raise_api_exception():
+        data, _, headers = client.entitlements_refresh_with_http_info(
+            owner=owner, repo=repo, identifier=identifier, show_tokens=show_tokens
+        )
+
+    ratelimits.maybe_rate_limit(client, headers)
+    return data.to_dict()
+
+
+def sync_entitlements(owner, repo, source, show_tokens):
+    """Sync entitlements from another repository."""
+    client = get_entitlements_api()
+
+    with catch_raise_api_exception():
+        data, _, headers = client.entitlements_sync_with_http_info(
+            owner=owner, repo=repo, data={"source": source}, show_tokens=show_tokens
+        )
+
+    ratelimits.maybe_rate_limit(client, headers)
+    page_info = PageInfo.from_headers(headers)
+    entitlements = [ent.to_dict() for ent in data.tokens]
+    return entitlements, page_info
+
+
+def restrict_entitlement(owner, repo, identifier, data):
+    """Restrict entitlement token using provided restrictions."""
+
+    client = get_entitlements_api()
+
+    with catch_raise_api_exception():
+        data, _, headers = client.entitlements_partial_update_with_http_info(
+            owner=owner, repo=repo, identifier=identifier, data=data
+        )
+
+    ratelimits.maybe_rate_limit(client, headers)
+    return data.to_dict()  # pylint: disable=no-member

cloudsmith_cli/core/api/exceptions.py

@@ -0,0 +1,57 @@
+"""API - Exceptions."""
+
+import contextlib
+import http.client
+import json
+
+from cloudsmith_api.rest import ApiException as _ApiException
+
+
+class ApiException(Exception):
+    """Exception raised by the Cloudsmith API."""
+
+    def __init__(self, status, detail=None, headers=None, body=None, fields=None):
+        """Create a new APIException."""
+        super().__init__()
+        self.status = status
+        if status == 422:
+            self.status_description = "Unprocessable Entity"
+        else:
+            self.status_description = http.client.responses.get(
+                status, "Unknown Status"
+            )
+        self.detail = detail
+        self.headers = headers or {}
+        self.body = body
+        self.fields = fields or {}
+
+
+@contextlib.contextmanager
+def catch_raise_api_exception():
+    """Context manager that translates upstream API exceptions."""
+    try:
+        yield
+    except _ApiException as exc:
+        detail = None
+        fields = None
+
+        if exc.body:
+            try:
+                # pylint: disable=no-member
+                data = json.loads(exc.body)
+                detail = data.get("detail", None)
+                fields = data.get("fields", None)
+            except ValueError:
+                pass
+
+        detail = detail or exc.reason
+
+        raise ApiException(
+            exc.status, detail=detail, headers=exc.headers, body=exc.body, fields=fields
+        )
+
+
+class TwoFactorRequiredException(Exception):
+    def __init__(self, two_factor_token):
+        self.two_factor_token = two_factor_token
+        super().__init__("Two-factor authentication is required")

cloudsmith_cli/core/api/files.py

@@ -0,0 +1,131 @@
+"""API - Files endpoints."""
+
+import os
+
+import click
+import cloudsmith_api
+import requests
+from requests_toolbelt import MultipartEncoder, MultipartEncoderMonitor
+
+from .. import ratelimits
+from ..rest import create_requests_session
+from ..utils import calculate_file_md5
+from .exceptions import ApiException, catch_raise_api_exception
+from .init import get_api_client
+
+CHUNK_SIZE = 1024 * 1024 * 100
+
+
+def get_files_api():
+    """Get the files API client."""
+    return get_api_client(cloudsmith_api.FilesApi)
+
+
+def validate_request_file_upload(owner, repo, filepath, md5_checksum=None):
+    """Validate parameters for requesting a file upload."""
+    client = get_files_api()
+    md5_checksum = md5_checksum or calculate_file_md5(filepath)
+
+    with catch_raise_api_exception():
+        _, _, headers = client.files_validate_with_http_info(
+            owner=owner,
+            repo=repo,
+            data={"filename": os.path.basename(filepath), "md5_checksum": md5_checksum},
+        )
+
+    ratelimits.maybe_rate_limit(client, headers)
+    return md5_checksum
+
+
+def request_file_upload(
+    owner, repo, filepath, md5_checksum=None, is_multi_part_upload=False
+):
+    """Request a new package file upload (for creating packages)."""
+    client = get_files_api()
+    md5_checksum = md5_checksum or calculate_file_md5(filepath)
+
+    method = "put_parts" if is_multi_part_upload else "post"
+
+    with catch_raise_api_exception():
+        data, _, headers = client.files_create_with_http_info(
+            owner=owner,
+            repo=repo,
+            data={
+                "filename": os.path.basename(filepath),
+                "md5_checksum": md5_checksum,
+                "method": method,
+            },
+        )
+
+    # pylint: disable=no-member
+    # Pylint detects the returned value as a tuple
+    ratelimits.maybe_rate_limit(client, headers)
+    return data.identifier, data.upload_url, data.upload_fields
+
+
+def upload_file(upload_url, upload_fields, filepath, callback=None):
+    """Upload a pre-signed file to Cloudsmith."""
+    upload_fields = list(upload_fields.items())
+    upload_fields.append(
+        ("file", (os.path.basename(filepath), click.open_file(filepath, "rb")))
+    )
+    encoder = MultipartEncoder(upload_fields)
+    monitor = MultipartEncoderMonitor(encoder, callback=callback)
+
+    config = cloudsmith_api.Configuration()
+    if config.proxy:
+        proxies = {"http": config.proxy, "https": config.proxy}
+    else:
+        proxies = None
+
+    headers = {"content-type": monitor.content_type}
+
+    client = get_files_api()
+    headers["user-agent"] = client.api_client.user_agent
+
+    session = create_requests_session()
+    resp = session.post(upload_url, data=monitor, headers=headers, proxies=proxies)
+
+    try:
+        resp.raise_for_status()
+    except requests.RequestException as exc:
+        raise ApiException(
+            resp.status_code, headers=exc.response.headers, body=exc.response.content
+        )
+
+
+def multi_part_upload_file(
+    opts, upload_url, owner, repo, filepath, callback, upload_id
+):
+    with open(filepath, "rb") as f:
+        chunk_number = 1
+        session = create_requests_session()
+        headers = {"X-Api-Key": opts.api_key}
+        while chunk := f.read(CHUNK_SIZE):
+            resp = session.put(
+                upload_url,
+                headers=headers,
+                data=chunk,
+                params={
+                    "upload_id": upload_id,
+                    "part_number": chunk_number,
+                },
+            )
+            try:
+                resp.raise_for_status()
+            except requests.RequestException as exc:
+                raise ApiException(
+                    resp.status_code,
+                    headers=exc.response.headers,
+                    body=exc.response.content,
+                )
+            callback()
+            chunk_number += 1
+
+    api = get_files_api()
+    api.files_complete(
+        owner,
+        repo,
+        identifier=upload_id,
+        data={"upload_id": upload_id, "complete": True},
+    )