cloudsmith-cli 1.20.1__tar.gz → 1.21.0__tar.gz

{cloudsmith_cli-1.20.1/cloudsmith_cli.egg-info → cloudsmith_cli-1.21.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cloudsmith-cli
-Version: 1.20.1
+Version: 1.21.0
 Summary: Cloudsmith Command-Line Interface (CLI)
 Author-email: Cloudsmith Ltd <support@cloudsmith.io>
 License-Expression: Apache-2.0

{cloudsmith_cli-1.20.1 → cloudsmith_cli-1.21.0}/cloudsmith_cli/cli/commands/credential_helper/__init__.py

@@ -10,6 +10,7 @@ import click
 
 from ..main import main
 from .docker import docker as docker_cmd
+from .generic import generic as generic_cmd
 from .manage import install_cmd, list_cmd, uninstall_cmd
 
 
@@ -32,6 +33,7 @@ def credential_helper():
 
 
 credential_helper.add_command(docker_cmd, name="docker")
+credential_helper.add_command(generic_cmd, name="generic")
 credential_helper.add_command(install_cmd, name="install")
 credential_helper.add_command(uninstall_cmd, name="uninstall")
 credential_helper.add_command(list_cmd, name="list")

cloudsmith_cli-1.21.0/cloudsmith_cli/cli/commands/credential_helper/generic.py

@@ -0,0 +1,62 @@
+# Copyright 2026 Cloudsmith Ltd
+"""
+Generic credential helper command.
+
+Emits a versioned JSON credential document.
+"""
+
+import sys
+
+import click
+
+from ....credential_helpers.generic import execute
+from ...decorators import (
+    common_api_auth_options,
+    common_cli_config_options,
+    resolve_credentials,
+)
+
+
+@click.command()
+@common_cli_config_options
+@common_api_auth_options
+@resolve_credentials
+def generic(opts):
+    """
+    Emit a Cloudsmith credential as JSON.
+
+    Resolves a credential through the full provider chain and writes a
+    versioned JSON document to stdout.  Takes no arguments: a Cloudsmith token
+    is organisation-wide, so the host it will be used against does not change
+    which credential resolves.
+
+    \b
+    Output (stdout):
+        JSON: {"version": 1, "username": "token", "password": "<token>"}
+
+    \b
+    Exit codes:
+        0: Success
+        1: No credential could be resolved
+
+    Examples:
+
+    \b
+        # Resolve a credential
+        $ cloudsmith credential-helper generic
+
+    \b
+        # Extract just the token
+        $ cloudsmith credential-helper generic | jq -r .password
+
+    \b
+    Environment variables:
+        CLOUDSMITH_API_KEY: API key for authentication (optional)
+    """
+    exit_code, stdout, stderr = execute(credential=opts.credential)
+
+    if stdout is not None:
+        click.echo(stdout)
+    if stderr is not None:
+        click.echo(stderr, err=True)
+    sys.exit(exit_code)

{cloudsmith_cli-1.20.1 → cloudsmith_cli-1.21.0}/cloudsmith_cli/cli/decorators.py

@@ -246,9 +246,6 @@ def common_api_auth_options(f):
             opts.api_key_from_flag = None
             opts.api_key_from_env = None
 
-        # Keep opts.api_key populated for any code that still reads it directly.
-        if api_key:
-            opts.api_key = api_key
         kwargs["opts"] = opts
         return ctx.invoke(f, *args, **kwargs)
 

{cloudsmith_cli-1.20.1 → cloudsmith_cli-1.21.0}/cloudsmith_cli/cli/exceptions.py

@@ -7,7 +7,6 @@ import sys
 import click
 
 from ..core.api.exceptions import ApiException
-from ..core.keyring import get_access_token
 
 
 @contextlib.contextmanager
@@ -171,16 +170,17 @@ def get_error_hint(ctx, opts, exc):
 def get_401_error_hint(ctx, opts, exc):
     """Get the hint for a 401/Unauthorised error."""
     # pylint: disable=unused-argument
-    if opts.api_key:
+    credential = getattr(opts, "credential", None)
+
+    if credential and credential.auth_type == "bearer":
+        return "Since you have an SSO access token set, this probably means that it has expired. Try getting a new token with 'cloudsmith auth', then try again."
+
+    if credential:
         return (
             "Since you have an API key set, this probably means "
             "you don't have the permission to perform this action."
         )
 
-    access_token = get_access_token(opts.api_host)
-    if access_token:
-        return "Since you have an SSO access token set, this probably means that it has expired. Try getting a new token with 'cloudsmith auth', then try again."
-
     if ctx.info_name == "token":
         # This is already the token command
         return (

{cloudsmith_cli-1.20.1 → cloudsmith_cli-1.21.0}/cloudsmith_cli/cli/webserver.py

@@ -1,5 +1,4 @@
 import html
-import os
 import socket
 from functools import cached_property
 from http.server import BaseHTTPRequestHandler, HTTPServer
@@ -7,6 +6,7 @@ from urllib.parse import parse_qsl, unquote, urlparse
 
 import click
 
+from .. import templates
 from ..core.api.exceptions import ApiException
 from ..core.api.init import initialise_api
 from ..core.credentials.models import CredentialResult
@@ -16,32 +16,12 @@ from .saml import exchange_2fa_token
 
 def get_template_path(template_name):
     """Get the absolute path to a template file."""
-    base_dir = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
-    return os.path.join(base_dir, "templates", template_name)
+    return templates.template_path(template_name)
 
 
 def render_template(template_name, **context):
-    """
-    Render a template with the given context.
-
-    Args:
-        template_name: Name of the template file
-        context: Dictionary of variables to replace in the template
-
-    Returns:
-        Rendered HTML content
-    """
-    template_path = get_template_path(template_name)
-
-    with open(template_path, encoding="utf-8") as file:
-        content = file.read()
-
-    # Replace placeholders with context values
-    for key, value in context.items():
-        placeholder = f"<!-- {key.upper()}_PLACEHOLDER -->"
-        content = content.replace(placeholder, value if value else "")
-
-    return content
+    """Render a template with the given context (see :func:`cloudsmith_cli.templates.render`)."""
+    return templates.render(template_name, **context)
 
 
 class AuthenticationWebServer(HTTPServer):

{cloudsmith_cli-1.20.1 → cloudsmith_cli-1.21.0}/cloudsmith_cli/core/api/files.py

@@ -97,10 +97,11 @@ def upload_file(upload_url, upload_fields, filepath, callback=None):
 def multi_part_upload_file(
     opts, upload_url, owner, repo, filepath, callback, upload_id
 ):
+    headers = opts.credential.auth_headers() if opts.credential else {}
+
     with open(filepath, "rb") as f:
         chunk_number = 1
         session = create_requests_session()
-        headers = {"X-Api-Key": opts.api_key}
         while chunk := f.read(CHUNK_SIZE):
             resp = session.put(
                 upload_url,

{cloudsmith_cli-1.20.1 → cloudsmith_cli-1.21.0}/cloudsmith_cli/core/config.py

@@ -117,9 +117,9 @@ def new_config_messaging(has_errors, opts, create, api_key):
         click.secho("Oops, please fix the errors and try again!", fg="red")
         return
 
-    if opts.api_key != api_key:
+    if opts.api_key_from_file != api_key:
         click.echo()
-        if opts.api_key:
+        if opts.api_key_from_file:
             click.secho(
                 "Note: The above API key doesn't match what you have in "
                 "your default credentials config file.",

{cloudsmith_cli-1.20.1 → cloudsmith_cli-1.21.0}/cloudsmith_cli/core/credentials/models.py

@@ -42,3 +42,15 @@ class CredentialResult:
     source_name: str
     source_detail: str | None = None
     auth_type: Literal["api_key", "bearer"] = "api_key"
+
+    def auth_headers(self) -> dict[str, str]:
+        """Return the headers that authenticate a raw request with this credential.
+
+        The two headers are not interchangeable: a raw JWT in ``X-Api-Key`` is
+        rejected outright, aborting the auth chain before the SSO
+        authenticators run.
+        """
+        if self.auth_type == "bearer":
+            return {"Authorization": f"Bearer {self.api_key}"}
+
+        return {"X-Api-Key": self.api_key}

{cloudsmith_cli-1.20.1 → cloudsmith_cli-1.21.0}/cloudsmith_cli/core/download.py

@@ -5,12 +5,11 @@ import hashlib
 import os
 
 import click
-import cloudsmith_api
 import requests
 from rich.console import Console
 from rich.table import Table
 
-from . import keyring, ratelimits, utils
+from . import ratelimits, utils
 from .api.exceptions import catch_raise_api_exception
 from .api.packages import get_packages_api, list_packages
 from .rest import create_requests_session
@@ -36,21 +35,14 @@ def resolve_auth(
     headers = {}
     auth_source = "none"
 
-    # Follow the same authentication logic as the API initialization
-    # Priority: explicit --api-key > SSO token > configured API key
+    credential = getattr(opts, "credential", None)
 
-    # Only attempt keyring operations if keyring is enabled
-    config = cloudsmith_api.Configuration()
-    access_token = keyring.get_access_token(config.host)
-    api_key = api_key_opt or getattr(opts, "api_key", None)
-
-    if api_key:
-        # Prioritize API key (from --api-key option or CLOUDSMITH_API_KEY env var) over SSO
-        headers["X-Api-Key"] = api_key
+    if api_key_opt:
+        headers["X-Api-Key"] = api_key_opt
         auth_source = "api-key"
-    elif access_token:
-        headers["Authorization"] = f"Bearer {access_token}"
-        auth_source = "sso"
+    elif credential:
+        headers = credential.auth_headers()
+        auth_source = "sso" if credential.auth_type == "bearer" else "api-key"
 
     return session, headers, auth_source
 

cloudsmith_cli-1.21.0/cloudsmith_cli/credential_helpers/generic.py

@@ -0,0 +1,63 @@
+# Copyright 2026 Cloudsmith Ltd
+"""
+Generic credential helper runtime.
+
+Emits a versioned JSON credential document.
+"""
+
+import json
+import logging
+
+logger = logging.getLogger(__name__)
+
+PROTOCOL_VERSION = 1
+
+_REFUSAL_MESSAGE = (
+    "Error: Unable to retrieve credentials. "
+    "Provide credentials via the CLOUDSMITH_API_KEY environment variable, "
+    "credentials.ini, the system keyring, or an OIDC service. "
+    "Verify current authentication with `cloudsmith whoami --verbose`."
+)
+
+
+def build_response(credential):
+    """
+    Build the versioned credential document.
+
+    Args:
+        credential: Pre-resolved CredentialResult from the provider chain
+
+    Returns:
+        dict: The credential document, or None when no credential is available
+    """
+    if not credential or not credential.api_key:
+        return None
+
+    return {
+        "version": PROTOCOL_VERSION,
+        "username": "token",
+        "password": credential.api_key,
+    }
+
+
+def execute(credential=None) -> tuple[int, str | None, str | None]:
+    """
+    Resolve a credential into a versioned JSON document.
+
+    Args:
+        credential: Pre-resolved CredentialResult from the provider chain
+
+    Returns:
+        A (exit_code, stdout_text, stderr_text) tuple.  Either text value may
+        be None if there is nothing to write to that stream.  The document is
+        serialised in one step, so a partial document can never be emitted.
+    """
+    try:
+        response = build_response(credential)
+        if response is None:
+            return (1, None, _REFUSAL_MESSAGE)
+
+        return (0, json.dumps(response), None)
+    except Exception as exc:  # pylint: disable=broad-except
+        logger.debug("generic credential-helper failed: %s", exc, exc_info=True)
+        return (1, None, _REFUSAL_MESSAGE)

cloudsmith_cli-1.21.0/cloudsmith_cli/data/VERSION

@@ -0,0 +1 @@
+1.21.0

cloudsmith_cli-1.21.0/cloudsmith_cli/templates/__init__.py

@@ -0,0 +1,27 @@
+"""Templates for the Cloudsmith CLI (HTML pages, config-file templates).
+
+Templates use ``<!-- KEY_PLACEHOLDER -->`` markers so the files stay valid
+HTML/XML and get normal editor validation; :func:`render` substitutes them.
+"""
+
+import os
+
+
+def template_path(name):
+    """Return the absolute path to the template *name* in this package."""
+    return os.path.join(os.path.dirname(os.path.abspath(__file__)), name)
+
+
+def render(name, **context):
+    """Render template *name*, replacing ``<!-- KEY_PLACEHOLDER -->`` markers.
+
+    Each ``context`` key ``foo`` replaces ``<!-- FOO_PLACEHOLDER -->`` with its
+    value (empty string when falsy).  Callers are responsible for escaping
+    values for the target format (e.g. XML-escaping).
+    """
+    with open(template_path(name), encoding="utf-8") as handle:
+        content = handle.read()
+    for key, value in context.items():
+        placeholder = f"<!-- {key.upper()}_PLACEHOLDER -->"
+        content = content.replace(placeholder, value if value else "")
+    return content

{cloudsmith_cli-1.20.1 → cloudsmith_cli-1.21.0/cloudsmith_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cloudsmith-cli
-Version: 1.20.1
+Version: 1.21.0
 Summary: Cloudsmith Command-Line Interface (CLI)
 Author-email: Cloudsmith Ltd <support@cloudsmith.io>
 License-Expression: Apache-2.0

{cloudsmith_cli-1.20.1 → cloudsmith_cli-1.21.0}/cloudsmith_cli.egg-info/SOURCES.txt

@@ -51,6 +51,7 @@ cloudsmith_cli/cli/commands/vulnerabilities.py
 cloudsmith_cli/cli/commands/whoami.py
 cloudsmith_cli/cli/commands/credential_helper/__init__.py
 cloudsmith_cli/cli/commands/credential_helper/docker.py
+cloudsmith_cli/cli/commands/credential_helper/generic.py
 cloudsmith_cli/cli/commands/credential_helper/manage.py
 cloudsmith_cli/cli/commands/metrics/__init__.py
 cloudsmith_cli/cli/commands/metrics/command.py
@@ -122,6 +123,7 @@ cloudsmith_cli/credential_helpers/__init__.py
 cloudsmith_cli/credential_helpers/backends.py
 cloudsmith_cli/credential_helpers/common.py
 cloudsmith_cli/credential_helpers/custom_domains.py
+cloudsmith_cli/credential_helpers/generic.py
 cloudsmith_cli/credential_helpers/launchers.py
 cloudsmith_cli/credential_helpers/docker/__init__.py
 cloudsmith_cli/credential_helpers/docker/installer.py

cloudsmith_cli-1.20.1/cloudsmith_cli/data/VERSION

@@ -1 +0,0 @@
-1.20.1

cloudsmith_cli-1.20.1/cloudsmith_cli/templates/__init__.py

@@ -1,3 +0,0 @@
-"""
-HTML templates for Cloudsmith CLI interface.
-"""