cloudsmith-cli 1.20.0__py3-none-any.whl

cloudsmith_cli/core/credentials/oidc/detectors/github_actions.py

@@ -0,0 +1,64 @@
+# Copyright 2026 Cloudsmith Ltd
+"""GitHub Actions OIDC detector.
+
+Fetches an OIDC token via the Actions runtime HTTP endpoint, using the
+``ACTIONS_ID_TOKEN_REQUEST_URL`` and ``ACTIONS_ID_TOKEN_REQUEST_TOKEN``
+variables exposed when a workflow requests ``id-token: write`` permission.
+
+References:
+    https://docs.github.com/en/actions/reference/security/oidc
+    https://docs.cloudsmith.com/authentication/setup-cloudsmith-to-authenticate-with-oidc-in-github-actions
+"""
+
+from __future__ import annotations
+
+import os
+from urllib.parse import quote
+
+from ....rest import create_requests_session as create_session
+from .base import EnvironmentDetector
+
+DEFAULT_AUDIENCE = "cloudsmith"
+
+
+class GitHubActionsDetector(EnvironmentDetector):
+    """Detects GitHub Actions and fetches an OIDC token via HTTP request."""
+
+    name = "GitHub Actions"
+    id = "github"
+
+    def detect(self) -> bool:
+        return (
+            os.environ.get("GITHUB_ACTIONS") == "true"
+            and bool(os.environ.get("ACTIONS_ID_TOKEN_REQUEST_URL"))
+            and bool(os.environ.get("ACTIONS_ID_TOKEN_REQUEST_TOKEN"))
+        )
+
+    def get_token(self) -> str:
+        request_url = os.environ["ACTIONS_ID_TOKEN_REQUEST_URL"]
+        request_token = os.environ["ACTIONS_ID_TOKEN_REQUEST_TOKEN"]
+
+        audience = self.context.oidc_audience or DEFAULT_AUDIENCE
+        separator = "&" if "?" in request_url else "?"
+        url = f"{request_url}{separator}audience={quote(audience, safe='')}"
+
+        session = self.context.session or create_session()
+        try:
+            response = session.get(
+                url,
+                headers={
+                    "Authorization": f"Bearer {request_token}",
+                    "Accept": "application/json; api-version=2.0",
+                },
+                timeout=30,
+            )
+            response.raise_for_status()
+
+            data = response.json()
+            token = data.get("value")
+            if not token:
+                raise ValueError("GitHub Actions OIDC response did not contain a token")
+            return token
+        finally:
+            if not self.context.session:
+                session.close()

cloudsmith_cli/core/credentials/oidc/detectors/gitlab_ci.py

@@ -0,0 +1,49 @@
+# Copyright 2026 Cloudsmith Ltd
+"""GitLab CI OIDC detector.
+
+Reads an OIDC token from environment variables populated by GitLab's
+``id_tokens`` configuration in ``.gitlab-ci.yml``.
+
+References:
+    https://docs.gitlab.com/ci/cloud_services/
+    https://docs.cloudsmith.com/integrations/integrating-with-gitlab-cicd
+"""
+
+from __future__ import annotations
+
+import os
+
+from .base import EnvironmentDetector
+
+
+class GitLabCIDetector(EnvironmentDetector):
+    """Detects GitLab CI and reads an OIDC token from an environment variable.
+
+    GitLab requires users to configure ``id_tokens`` in ``.gitlab-ci.yml``,
+    minting a token with ``aud`` set to the Cloudsmith OIDC endpoint and
+    exposing it as ``CLOUDSMITH_OIDC_TOKEN``. The legacy ``CI_JOB_JWT``/
+    ``CI_JOB_JWT_V2`` variables are deliberately not consulted: they were
+    removed in GitLab 17.0, carry the GitLab instance URL as their audience
+    (not the Cloudsmith audience the token exchange validates), and were
+    auto-injected into every job on older instances.
+    """
+
+    name = "GitLab CI"
+    id = "gitlab"
+
+    TOKEN_ENV_VAR = "CLOUDSMITH_OIDC_TOKEN"
+
+    def detect(self) -> bool:
+        if os.environ.get("GITLAB_CI") != "true":
+            return False
+        return bool(os.environ.get(self.TOKEN_ENV_VAR))
+
+    def get_token(self) -> str:
+        token = os.environ.get(self.TOKEN_ENV_VAR)
+        if token:
+            return token
+        raise ValueError(
+            "GitLab CI detected but no OIDC token found. "
+            "Configure id_tokens in .gitlab-ci.yml and expose it as "
+            + self.TOKEN_ENV_VAR
+        )

cloudsmith_cli/core/credentials/oidc/exchange.py

@@ -0,0 +1,87 @@
+"""Cloudsmith OIDC token exchange.
+
+Exchanges a vendor OIDC JWT for a short-lived Cloudsmith API token
+via the POST /openid/{org}/ endpoint.
+
+References:
+    https://help.cloudsmith.io/docs/openid-connect
+"""
+
+from __future__ import annotations
+
+import logging
+from typing import TYPE_CHECKING
+
+import requests
+
+from ...rest import create_requests_session as create_session
+
+if TYPE_CHECKING:
+    from ... import CredentialContext
+
+logger = logging.getLogger(__name__)
+
+
+def exchange_oidc_token(
+    context: CredentialContext,
+    org: str,
+    service_slug: str,
+    oidc_token: str,
+) -> str:
+    """Exchange a vendor OIDC JWT for a Cloudsmith API token.
+
+    Raises:
+        OidcExchangeError: If the exchange fails.
+    """
+    host = context.api_host.rstrip("/")
+    if not host.startswith("http"):
+        host = f"https://{host}"
+
+    url = f"{host}/openid/{org}/"
+    payload = {
+        "oidc_token": oidc_token,
+        "service_slug": service_slug,
+    }
+
+    session = context.session or create_session()
+
+    try:
+        try:
+            response = session.post(
+                url,
+                json=payload,
+                timeout=30,
+            )
+        except requests.exceptions.RequestException as exc:
+            raise OidcExchangeError(
+                f"OIDC token exchange request failed: {exc}"
+            ) from exc
+
+        if response.status_code in (200, 201):
+            data = response.json()
+            token = data.get("token")
+            if not token or not isinstance(token, str) or not token.strip():
+                raise OidcExchangeError(
+                    "Cloudsmith OIDC exchange returned an empty or invalid token"
+                )
+            return token
+
+        try:
+            error_json = response.json()
+            error_detail = error_json.get(
+                "detail", error_json.get("error", str(error_json))
+            )
+        except Exception:  # pylint: disable=broad-exception-caught
+            error_detail = response.text[:200]
+
+        raise OidcExchangeError(
+            f"OIDC token exchange failed with {response.status_code}: "
+            f"{error_detail}"
+        )
+    finally:
+        if not context.session:
+            session.close()
+
+
+class OidcExchangeError(Exception):
+    """Raised when the OIDC token exchange with Cloudsmith fails."""

cloudsmith_cli/core/credentials/provider.py

@@ -0,0 +1,17 @@
+"""Base credential provider interface."""
+
+from __future__ import annotations
+
+from abc import ABC, abstractmethod
+
+from .models import CredentialContext, CredentialResult
+
+
+class CredentialProvider(ABC):
+    """Base class for credential providers."""
+
+    name: str = "base"
+
+    @abstractmethod
+    def resolve(self, context: CredentialContext) -> CredentialResult | None:
+        """Attempt to resolve credentials. Return CredentialResult or None."""

cloudsmith_cli/core/credentials/providers/__init__.py

@@ -0,0 +1,15 @@
+"""Credential providers for the Cloudsmith CLI."""
+
+from .cli_flag import CLIFlagProvider
+from .credentials_file import CredentialsFileProvider
+from .env_var import EnvVarProvider
+from .keyring_provider import KeyringProvider
+from .oidc_provider import OidcProvider
+
+__all__ = [
+    "CLIFlagProvider",
+    "CredentialsFileProvider",
+    "EnvVarProvider",
+    "KeyringProvider",
+    "OidcProvider",
+]

cloudsmith_cli/core/credentials/providers/cli_flag.py

@@ -0,0 +1,24 @@
+"""CLI flag credential provider."""
+
+from __future__ import annotations
+
+from ..models import CredentialContext, CredentialResult
+from ..provider import CredentialProvider
+
+
+class CLIFlagProvider(CredentialProvider):
+    """Resolves credentials from the --api-key CLI flag."""
+
+    name = "cli_flag"
+
+    def resolve(self, context: CredentialContext) -> CredentialResult | None:
+        api_key = context.api_key_from_flag
+        if api_key and api_key.strip():
+            api_key = api_key.strip()
+            suffix = api_key[-4:]
+            return CredentialResult(
+                api_key=api_key,
+                source_name="cli_flag",
+                source_detail=f"--api-key flag (ends with ...{suffix})",
+            )
+        return None

cloudsmith_cli/core/credentials/providers/credentials_file.py

@@ -0,0 +1,24 @@
+"""Credentials file provider."""
+
+from __future__ import annotations
+
+from ..models import CredentialContext, CredentialResult
+from ..provider import CredentialProvider
+
+
+class CredentialsFileProvider(CredentialProvider):
+    """Resolves credentials from the api_key stored in credentials.ini."""
+
+    name = "credentials_file"
+
+    def resolve(self, context: CredentialContext) -> CredentialResult | None:
+        api_key = context.api_key_from_file
+        if api_key and api_key.strip():
+            api_key = api_key.strip()
+            suffix = api_key[-4:]
+            return CredentialResult(
+                api_key=api_key,
+                source_name="credentials_file",
+                source_detail=f"credentials.ini (ends with ...{suffix})",
+            )
+        return None

cloudsmith_cli/core/credentials/providers/env_var.py

@@ -0,0 +1,24 @@
+"""Environment variable credential provider."""
+
+from __future__ import annotations
+
+from ..models import CredentialContext, CredentialResult
+from ..provider import CredentialProvider
+
+
+class EnvVarProvider(CredentialProvider):
+    """Resolves credentials from the CLOUDSMITH_API_KEY environment variable."""
+
+    name = "env_var"
+
+    def resolve(self, context: CredentialContext) -> CredentialResult | None:
+        api_key = context.api_key_from_env
+        if api_key and api_key.strip():
+            api_key = api_key.strip()
+            suffix = api_key[-4:]
+            return CredentialResult(
+                api_key=api_key,
+                source_name="env_var",
+                source_detail=f"CLOUDSMITH_API_KEY env var (ends with ...{suffix})",
+            )
+        return None

cloudsmith_cli/core/credentials/providers/keyring_provider.py

@@ -0,0 +1,59 @@
+"""Keyring credential provider."""
+
+from __future__ import annotations
+
+import logging
+
+from ....cli.saml import refresh_access_token
+from ....core import keyring
+from ..models import CredentialContext, CredentialResult
+from ..provider import CredentialProvider
+
+logger = logging.getLogger(__name__)
+
+
+class KeyringProvider(CredentialProvider):
+    """Resolves credentials from SAML tokens stored in the system keyring."""
+
+    name = "keyring"
+
+    def resolve(self, context: CredentialContext) -> CredentialResult | None:
+        if not keyring.should_use_keyring():
+            return None
+
+        api_host = context.api_host
+        access_token = keyring.get_access_token(api_host)
+
+        if not access_token:
+            return None
+
+        try:
+            if keyring.should_refresh_access_token(api_host):
+                if not context.session:
+                    logger.debug(
+                        "Session unavailable; skipping token refresh, using existing token"
+                    )
+                else:
+                    refresh_token = keyring.get_refresh_token(api_host)
+                    new_access_token, new_refresh_token = refresh_access_token(
+                        api_host,
+                        access_token,
+                        refresh_token,
+                        session=context.session,
+                    )
+                    keyring.store_sso_tokens(
+                        api_host, new_access_token, new_refresh_token
+                    )
+                    access_token = new_access_token
+        except Exception:  # pylint: disable=broad-exception-caught
+            keyring.update_refresh_attempted_at(api_host)
+            context.keyring_refresh_failed = True
+            logger.debug("Failed to refresh SAML token", exc_info=True)
+            return None
+
+        return CredentialResult(
+            api_key=access_token,
+            source_name="keyring",
+            source_detail="SAML token from system keyring",
+            auth_type="bearer",
+        )

cloudsmith_cli/core/credentials/providers/oidc_provider.py

@@ -0,0 +1,115 @@
+"""OIDC credential provider."""
+
+from __future__ import annotations
+
+import logging
+
+from ..models import CredentialContext, CredentialResult
+from ..provider import CredentialProvider
+
+logger = logging.getLogger(__name__)
+
+
+class OidcProvider(CredentialProvider):
+    """Resolves credentials via OIDC auto-discovery.
+
+    Requires CLOUDSMITH_ORG and CLOUDSMITH_SERVICE_SLUG to be set (via env
+    vars or click options).  Auto-detects the environment, fetches the vendor
+    OIDC JWT, and exchanges it for a short-lived Cloudsmith API token.
+    """
+
+    name = "oidc"
+
+    def resolve(  # pylint: disable=too-many-return-statements
+        self, context: CredentialContext
+    ) -> CredentialResult | None:
+        if context.oidc_discovery_disabled:
+            if context.debug:
+                logger.debug(
+                    "OidcProvider: OIDC auto-discovery disabled via "
+                    "CLOUDSMITH_OIDC_DISCOVERY_DISABLED"
+                )
+            return None
+
+        org = context.oidc_org
+        service_slug = context.oidc_service_slug
+
+        if not org or not service_slug:
+            if context.debug:
+                logger.debug(
+                    "OidcProvider: CLOUDSMITH_ORG and/or CLOUDSMITH_SERVICE_SLUG "
+                    "not set, skipping OIDC auto-discovery"
+                )
+            return None
+
+        from ..oidc.cache import get_cached_token, store_cached_token
+
+        # Check cache BEFORE environment detection — detection can be expensive
+        # (e.g. boto3 credential resolution, IMDS calls) and is unnecessary when
+        # we already hold a valid exchanged token.
+        cached = get_cached_token(context.api_host, org, service_slug)
+        if cached:
+            logger.debug("OidcProvider: Using cached OIDC token")
+            return CredentialResult(
+                api_key=cached,
+                source_name="oidc",
+                source_detail=f"OIDC [cached] (org: {org}, service: {service_slug})",
+            )
+
+        from ..oidc.detectors import detect_environment
+        from ..oidc.exchange import OidcExchangeError, exchange_oidc_token
+
+        detector = detect_environment(context=context)
+        if detector is None:
+            if context.debug:
+                logger.debug(
+                    "OidcProvider: No supported OIDC environment detected, skipping"
+                )
+            return None
+
+        try:
+            vendor_token = detector.get_token()
+        except Exception:  # pylint: disable=broad-exception-caught
+            logger.warning(
+                "OIDC: Failed to retrieve identity token from %s. "
+                "Use --debug for details.",
+                detector.name,
+            )
+            logger.debug(
+                "OidcProvider: %s token retrieval error",
+                detector.name,
+                exc_info=True,
+            )
+            return None
+
+        if not vendor_token:
+            logger.warning("OIDC: %s detector returned an empty token.", detector.name)
+            return None
+
+        try:
+            cloudsmith_token = exchange_oidc_token(
+                context=context,
+                org=org,
+                service_slug=service_slug,
+                oidc_token=vendor_token,
+            )
+        except OidcExchangeError as exc:
+            logger.warning("OIDC: Token exchange failed: %s", exc)
+            return None
+        except Exception:  # pylint: disable=broad-exception-caught
+            logger.warning(
+                "OIDC: Token exchange failed unexpectedly. Use --debug for details."
+            )
+            logger.debug("OidcProvider: OIDC token exchange error", exc_info=True)
+            return None
+
+        if not cloudsmith_token:
+            return None
+
+        store_cached_token(context.api_host, org, service_slug, cloudsmith_token)
+
+        return CredentialResult(
+            api_key=cloudsmith_token,
+            source_name="oidc",
+            source_detail=f"OIDC via {detector.name} (org: {org}, service: {service_slug})",
+        )