cloudsmith-cli 1.25.0__tar.gz → 1.27.0__tar.gz

{cloudsmith_cli-1.25.0/cloudsmith_cli.egg-info → cloudsmith_cli-1.27.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cloudsmith-cli
-Version: 1.25.0
+Version: 1.27.0
 Summary: Cloudsmith Command-Line Interface (CLI)
 Author-email: Cloudsmith Ltd <support@cloudsmith.io>
 License-Expression: Apache-2.0
@@ -32,14 +32,18 @@ Requires-Dist: cloudsmith-api<3.0,>=2.0.31
 Requires-Dist: keyring>=25.4.1
 Requires-Dist: keyrings-alt>=5.0.2
 Requires-Dist: keyrings-cryptfile>=1.3.9
+Requires-Dist: cryptography>=50.0.0
 Requires-Dist: mcp==1.28.1
-Requires-Dist: PyJWT[crypto]>=2.0.0
+Requires-Dist: pydantic-settings>=2.14.2
+Requires-Dist: PyJWT[crypto]>=2.13.0
 Requires-Dist: python-toon==0.1.2
 Requires-Dist: requests>=2.18.4
 Requires-Dist: requests_toolbelt>=1.0.0
 Requires-Dist: rich>=13.0.0
 Requires-Dist: semver>=2.7.9
+Requires-Dist: starlette>=1.3.1
 Requires-Dist: urllib3>=2.5
+Requires-Dist: tomlkit>=0.15.0
 Provides-Extra: aws
 Requires-Dist: boto3[crt]>=1.26.0; extra == "aws"
 Provides-Extra: all
@@ -369,7 +373,7 @@ cloudsmith auth --owner example
 Beginning authentication for the example org ...
 Your organization's SAML IDP URL is: https://example.com/some-saml-idp
 
-Starting webserver to begin authentication ...
+Waiting for the authentication callback on port 12400 ...
 
 Authentication complete
 ```
@@ -380,7 +384,7 @@ The CLI opens the IDP URL in your browser automatically. If it can't (for exampl
 cloudsmith auth --owner example --no-browser
 ```
 
-*Note:* The authentication callback is served on `127.0.0.1:12400`, so the browser you open the URL in must be running on the same machine as the CLI.
+*Note:* The authentication callback is served on `127.0.0.1`, on the first free port between `12400` and `12404`. The browser you open the URL in must run on the same machine as the CLI.
 
 #### Getting Your API Key
 

{cloudsmith_cli-1.25.0 → cloudsmith_cli-1.27.0}/README.md

@@ -321,7 +321,7 @@ cloudsmith auth --owner example
 Beginning authentication for the example org ...
 Your organization's SAML IDP URL is: https://example.com/some-saml-idp
 
-Starting webserver to begin authentication ...
+Waiting for the authentication callback on port 12400 ...
 
 Authentication complete
 ```
@@ -332,7 +332,7 @@ The CLI opens the IDP URL in your browser automatically. If it can't (for exampl
 cloudsmith auth --owner example --no-browser
 ```
 
-*Note:* The authentication callback is served on `127.0.0.1:12400`, so the browser you open the URL in must be running on the same machine as the CLI.
+*Note:* The authentication callback is served on `127.0.0.1`, on the first free port between `12400` and `12404`. The browser you open the URL in must run on the same machine as the CLI.
 
 #### Getting Your API Key
 

{cloudsmith_cli-1.25.0 → cloudsmith_cli-1.27.0}/cloudsmith_cli/__init__.py

@@ -3,8 +3,6 @@
 import warnings
 
 import click
-import urllib3
 
 click.disable_unicode_literals_warning = True
-urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
 warnings.filterwarnings("ignore", category=ResourceWarning)

{cloudsmith_cli-1.25.0 → cloudsmith_cli-1.27.0}/cloudsmith_cli/cli/command.py

@@ -1,5 +1,6 @@
 """CLI - Group/Command classes."""
 
+import importlib
 from collections import OrderedDict
 
 import click.exceptions
@@ -50,12 +51,25 @@ def _format_click_exception_as_json(exception):
 
 
 class AliasGroup(DYMGroup):
-    """A command group with DYM and alias support."""
+    """A command group with DYM, alias and lazy-subcommand support.
+
+    ``lazy_commands`` maps a command name to the module that registers it.
+    The module is imported on first use, which keeps startup fast because
+    an invocation imports only the module of the invoked command.
+    ``lazy_aliases`` supplies the alias map for those commands up front.
+    """
 
     def __init__(self, *args, **kwargs):
+        lazy_commands = kwargs.pop("lazy_commands", None)
+        lazy_aliases = kwargs.pop("lazy_aliases", None)
         super().__init__(*args, **kwargs)
+        self.lazy_commands = dict(lazy_commands or {})
         self.aliases = OrderedDict()
         self.inverse = {}
+        for name, aliases in (lazy_aliases or {}).items():
+            self.aliases[name] = aliases
+            for alias in aliases:
+                self.inverse[alias] = name
 
     def resolve_command(self, ctx, args):
         try:
@@ -74,7 +88,7 @@ class AliasGroup(DYMGroup):
             raise
 
     def list_commands(self, ctx):
-        commands = super().list_commands(ctx)
+        commands = sorted(set(super().list_commands(ctx)) | set(self.lazy_commands))
 
         if getattr(ctx, "showing_help", False):
             for k, v in enumerate(commands):
@@ -99,7 +113,11 @@ class AliasGroup(DYMGroup):
         except KeyError:
             pass
 
-        return super().get_command(ctx, cmd_name)
+        cmd = super().get_command(ctx, cmd_name)
+        if cmd is None and cmd_name in self.lazy_commands:
+            importlib.import_module(self.lazy_commands[cmd_name])
+            cmd = super().get_command(ctx, cmd_name)
+        return cmd
 
     def command(self, *args, **kwargs):
         def decorator(f):

cloudsmith_cli-1.27.0/cloudsmith_cli/cli/commands/__init__.py

@@ -0,0 +1,6 @@
+"""CLI/Commands.
+
+Command modules register themselves with the ``main`` group on import.
+The ``main`` group imports them lazily through ``registry.LAZY_COMMANDS``,
+so this package must not import them here.
+"""

cloudsmith_cli-1.27.0/cloudsmith_cli/cli/commands/auth.py

@@ -0,0 +1,305 @@
+"""CLI/Commands - Authenticate the user."""
+
+import webbrowser
+
+import click
+import requests
+
+from ...core.sso import (
+    SsoRenewalStatus,
+    get_access_token_expiry,
+    renew_sso_session,
+)
+from .. import decorators, utils, validators
+from ..exceptions import handle_api_exceptions
+from ..saml import create_configured_session, get_idp_url
+from ..webserver import AuthenticationWebRequestHandler, AuthenticationWebServer
+from .main import main
+from .tokens import create, request_api_key
+
+# Authentication server configuration
+AUTH_SERVER_HOST = "127.0.0.1"
+AUTH_REDIRECT_HOST = "localhost"
+AUTH_SERVER_PORTS = (12400, 12401, 12402, 12403, 12404)
+
+
+def _create_auth_server(opts, owner, session, enable_token_creation, profile):
+    """Create an authentication server on the first available callback port."""
+    last_error = None
+
+    for port in AUTH_SERVER_PORTS:
+        try:
+            server = AuthenticationWebServer(
+                (AUTH_SERVER_HOST, port),
+                AuthenticationWebRequestHandler,
+                owner=owner,
+                session=session,
+                debug=opts.debug,
+                refresh_api_on_success=enable_token_creation,
+                api_opts=opts.api_config,
+                profile=profile,
+            )
+            return server, port
+        except OSError as exc:
+            last_error = exc
+
+    ports = ", ".join(str(port) for port in AUTH_SERVER_PORTS)
+    raise click.ClickException(
+        "Could not start the authentication callback server. "
+        f"Every candidate port is unavailable: {ports}. "
+        f"The last error was: {last_error}. "
+        "Stop the process that holds one of these ports, then try again."
+    ) from last_error
+
+
+def _renew_existing_sso_session(opts, profile):
+    """Return a usable existing SSO session, or fall back to browser auth."""
+    renewal = renew_sso_session(opts.api_config.host, opts.session, profile=profile)
+    if renewal.status in (
+        SsoRenewalStatus.RENEWED,
+        SsoRenewalStatus.CURRENT,
+    ):
+        return renewal
+    if renewal.status == SsoRenewalStatus.FAILED and isinstance(
+        renewal.error, requests.RequestException
+    ):
+        raise click.ClickException(
+            "The SSO session has expired and Cloudsmith could not be reached. "
+            "Check your connection, then run 'cloudsmith auth' again."
+        ) from renewal.error
+    return None
+
+
+def _report_active_sso_session(opts, renewal, use_stderr=False):
+    """Report the usable SSO session without exposing its access token."""
+    expires_at = get_access_token_expiry(renewal.access_token)
+    data = {
+        "authenticated": True,
+        "method": "sso",
+        "status": renewal.status.value,
+        "expires_at": expires_at,
+        "renewal_error": str(renewal.error) if renewal.error else None,
+    }
+    if utils.maybe_print_as_json(opts, data):
+        return
+
+    if renewal.status == SsoRenewalStatus.RENEWED:
+        click.secho("SSO session renewed.", fg="green", err=use_stderr)
+    elif renewal.error:
+        click.secho(
+            "The SSO session could not be renewed; the existing access token "
+            "remains active.",
+            fg="yellow",
+            err=use_stderr,
+        )
+    else:
+        click.secho("SSO session is active.", fg="green", err=use_stderr)
+    if expires_at:
+        click.echo(
+            f"Access token expires at {utils.fmt_datetime(expires_at)}.",
+            err=use_stderr,
+        )
+
+
+def _perform_saml_authentication(
+    opts,
+    owner,
+    enable_token_creation=False,
+    use_stderr=False,
+    no_browser=False,
+    profile=None,
+):
+    """Perform SAML authentication via web browser and local web server."""
+    session = create_configured_session(opts)
+    api_host = opts.api_config.host
+
+    auth_server, port = _create_auth_server(
+        opts, owner, session, enable_token_creation, profile
+    )
+    redirect_url = f"http://{AUTH_REDIRECT_HOST}:{port}"
+
+    try:
+        click.echo(
+            f"Waiting for the authentication callback on port {port} ... ",
+            err=use_stderr,
+        )
+
+        idp_url = get_idp_url(
+            api_host, owner, redirect_url=redirect_url, session=session
+        )
+
+        click.echo(
+            f"Your Workspace's SAML IDP URL is: {click.style(idp_url, bold=True)}",
+            err=use_stderr,
+        )
+        click.echo(err=use_stderr)
+
+        if no_browser:
+            click.echo(
+                "Skipping automatic browser launch (--no-browser). "
+                "Please open the URL above manually to continue.",
+                err=use_stderr,
+            )
+        else:
+            try:
+                browser_opened = webbrowser.open(idp_url)
+            except Exception:
+                # Browser launch failures vary by platform (webbrowser.Error on
+                # Cygwin/headless, anything else elsewhere), so catch broadly and
+                # fall back to the manual URL rather than crashing.
+                browser_opened = False
+
+            if not browser_opened:
+                click.echo(
+                    "Couldn't open a browser automatically. "
+                    "Please open the URL above manually to continue.",
+                    err=use_stderr,
+                )
+
+        auth_server.handle_request()
+    finally:
+        auth_server.server_close()
+
+
+@main.command(aliases=["auth"])
+@click.option(
+    "-t",
+    "--token",
+    default=False,
+    is_flag=True,
+    help="[DEPRECATED: Use --request-api-key] Retrieve a user API token after successful authentication.",
+)
+@click.option(
+    "-f",
+    "--force",
+    default=False,
+    is_flag=True,
+    help="[DEPRECATED: Use --request-api-key] Force refresh of user API token without prompts.",
+)
+@click.option(
+    "--save-config",
+    default=False,
+    is_flag=True,
+    help="Save the new API key to your configuration files.",
+)
+@click.option(
+    "--json",
+    default=False,
+    is_flag=True,
+    help="[DEPRECATED: Use --output-format json] Output token details in JSON format.",
+)
+@click.option(
+    "--request-api-key",
+    "request_api_key_flag",
+    default=False,
+    is_flag=True,
+    help="Retrieve API token (auto-creates or auto-rotates, no prompts). "
+    "Warning: If token exists, this will rotate it and invalidate the old key.",
+)
+@click.option(
+    "--no-browser",
+    default=False,
+    is_flag=True,
+    help="Don't try to open a browser automatically; print the SAML IDP URL to "
+    "open manually instead.",
+)
+@decorators.common_cli_config_options
+@decorators.common_cli_output_options
+@decorators.initialise_api
+@click.pass_context
+def authenticate(
+    ctx,
+    opts,
+    token,
+    force,
+    save_config,
+    json,
+    request_api_key_flag,
+    no_browser,
+):
+    """Authenticate to Cloudsmith using the Workspace's SAML setup."""
+    # Validate mutual exclusivity
+    if request_api_key_flag and (token or force):
+        raise click.UsageError(
+            "--request-api-key cannot be used with --token or --force. "
+            "Use --request-api-key alone for fully automated token retrieval."
+        )
+
+    # Determine if we should redirect info messages to stderr
+    use_stderr = request_api_key_flag or json or utils.should_use_stderr(opts)
+
+    if token:
+        click.secho(
+            "DEPRECATION WARNING: The `--token` flag is deprecated and will be removed in a future release. "
+            "Please use `--request-api-key` instead.",
+            fg="yellow",
+            err=True,
+        )
+
+    if force:
+        click.secho(
+            "DEPRECATION WARNING: The `--force` flag is deprecated and will be removed in a future release. "
+            "Please use `--request-api-key` instead (force is implied).",
+            fg="yellow",
+            err=True,
+        )
+
+    if json and not utils.should_use_stderr(opts):
+        click.secho(
+            "DEPRECATION WARNING: The `--json` flag is deprecated and will be removed in a future release. "
+            "Please use `--output-format json` instead.",
+            fg="yellow",
+            err=True,
+        )
+
+    if not force and not token and not request_api_key_flag:
+        session_result = _renew_existing_sso_session(
+            opts, profile=ctx.meta.get("profile")
+        )
+        if session_result:
+            _report_active_sso_session(opts, session_result, use_stderr)
+            return
+
+    workspace = opts.org or click.prompt("Workspace", err=use_stderr)
+    workspace = validators.validate_owner(ctx, None, workspace)[0]
+    opts.org = workspace
+
+    click.echo(
+        "Beginning authentication for the "
+        f"{click.style(workspace, bold=True)} Workspace ... ",
+        err=use_stderr,
+    )
+
+    # Determine if we need to refresh API after SSO (required for token operations)
+    enable_token_creation = token or request_api_key_flag
+
+    context_message = "Failed to authenticate via SSO!"
+    with handle_api_exceptions(ctx, opts=opts, context_msg=context_message):
+        _perform_saml_authentication(
+            opts,
+            workspace,
+            enable_token_creation=enable_token_creation,
+            use_stderr=use_stderr,
+            no_browser=no_browser,
+            profile=ctx.meta.get("profile"),
+        )
+
+    if request_api_key_flag:
+        # Non-interactive token retrieval
+        new_token = request_api_key(ctx, opts, save_config=save_config)
+
+        if not new_token:
+            raise click.ClickException(
+                "Failed to retrieve API token. No token was returned."
+            )
+
+        # Check if JSON output is requested
+        if utils.maybe_print_as_json(opts, new_token):
+            return
+
+        # Default: output only the raw token value to stdout
+        click.echo(new_token.key)
+        return
+
+    if token:
+        ctx.invoke(create, opts=opts, save_config=save_config, force=force, json=json)

{cloudsmith_cli-1.25.0 → cloudsmith_cli-1.27.0}/cloudsmith_cli/cli/commands/copy.py

@@ -71,14 +71,26 @@ def copy(
         ),
         maybe_spinner(opts),
     ):
-        _, new_slug = copy_package(
+        slug_perm, new_slug = copy_package(
             owner=owner, repo=source, identifier=slug, destination=destination
         )
 
     click.secho("OK", fg="green", err=use_stderr)
 
+    click.echo(
+        "Copied: {owner}/{repo}/{slug} ({slug_perm})".format(
+            owner=click.style(owner, fg="magenta"),
+            repo=click.style(destination, fg="magenta"),
+            slug=click.style(new_slug, fg="green"),
+            slug_perm=click.style(slug_perm, bold=True),
+        ),
+        err=use_stderr,
+    )
+
     if no_wait_for_sync:
-        utils.maybe_print_status_json(opts, {"slug": new_slug, "status": "OK"})
+        utils.maybe_print_status_json(
+            opts, {"slug": new_slug, "slug_perm": slug_perm, "status": "OK"}
+        )
         return
 
     wait_for_package_sync(
@@ -92,4 +104,6 @@ def copy(
         attempts=sync_attempts,
     )
 
-    utils.maybe_print_status_json(opts, {"slug": new_slug, "status": "OK"})
+    utils.maybe_print_status_json(
+        opts, {"slug": new_slug, "slug_perm": slug_perm, "status": "OK"}
+    )

{cloudsmith_cli-1.25.0 → cloudsmith_cli-1.27.0}/cloudsmith_cli/cli/commands/credential_helper/__init__.py

@@ -9,10 +9,12 @@ that follow their respective credential helper protocols.
 import click
 
 from ..main import main
+from .cargo import cargo as cargo_cmd
 from .docker import docker as docker_cmd
 from .generic import generic as generic_cmd
 from .manage import install_cmd, list_cmd, uninstall_cmd
 from .pnpm import pnpm as pnpm_cmd
+from .terraform import terraform as terraform_cmd
 
 
 @click.group()
@@ -31,6 +33,9 @@ def credential_helper():
         # Install pnpm credential helper
         $ cloudsmith credential-helper install pnpm
 
+        # Install cargo credential helper
+        $ cloudsmith credential-helper install cargo
+
         # Test Docker credential helper directly
         $ echo "docker.cloudsmith.io" | cloudsmith credential-helper docker
 
@@ -45,5 +50,7 @@ credential_helper.add_command(generic_cmd, name="generic")
 credential_helper.add_command(install_cmd, name="install")
 credential_helper.add_command(uninstall_cmd, name="uninstall")
 credential_helper.add_command(list_cmd, name="list")
+credential_helper.add_command(cargo_cmd, name="cargo")
+credential_helper.add_command(terraform_cmd, name="terraform")
 
 main.add_command(credential_helper, name="credential-helper")

cloudsmith_cli-1.27.0/cloudsmith_cli/cli/commands/credential_helper/cargo.py

@@ -0,0 +1,94 @@
+# Copyright 2026 Cloudsmith Ltd
+"""
+Cargo credential provider command.
+
+Implements the Cargo credential provider protocol for Cloudsmith registries.
+
+See: https://doc.rust-lang.org/cargo/reference/credential-provider-protocol.html
+"""
+
+import sys
+
+import click
+
+from ....credential_helpers.cargo import execute
+from ...decorators import common_api_auth_options, resolve_credentials
+
+
+@click.command(context_settings={"ignore_unknown_options": True})
+@click.option(
+    "--cargo-plugin",
+    is_flag=True,
+    default=False,
+    hidden=True,
+    help="Passed by Cargo when invoking this command as a credential provider.",
+)
+@click.argument("provider_args", nargs=-1, type=click.UNPROCESSED)
+@common_api_auth_options
+@resolve_credentials
+def cargo(opts, cargo_plugin, provider_args):  # pylint: disable=unused-argument
+    """
+    Cargo credential provider for Cloudsmith registries.
+
+    Speaks the Cargo credential provider protocol: a newline-delimited JSON
+    conversation on stdin/stdout, starting with a hello message that announces
+    the supported protocol versions, then one response per request.
+
+    Provides credentials for all Cloudsmith Cargo registries: ``*.cloudsmith.io``,
+    ``*.cloudsmith.com``, and any custom domains configured for the Workspace
+    (requires a Workspace - ``--workspace``, CLOUDSMITH_WORKSPACE, or
+    ``workspace`` in ``config.ini``; legacy aliases are also accepted - and a
+    valid API key/token).
+
+    A registry that is not a Cloudsmith one is answered with
+    ``url-not-supported`` so Cargo falls through to the next configured
+    credential provider.  ``cargo login``/``cargo logout`` are answered with
+    ``operation-not-supported``: credentials come from the Cloudsmith CLI's own
+    provider chain, so there is nothing to store or clear.
+
+    \b
+    Input (stdin):
+        One JSON request per line, e.g.
+        {"v":1,"kind":"get","operation":"read",
+         "registry":{"index-url":"sparse+https://cargo.cloudsmith.io/org/repo/"}}
+
+    \b
+    Output (stdout):
+        {"v":[1]}
+        {"Ok":{"kind":"get","token":"<cloudsmith-token>","cache":"session",
+               "operation_independent":true}}
+
+    \b
+    Exit codes:
+        0: Session completed
+        1: No credentials available, or the session broke down
+
+    \b
+    Examples:
+        # Manual testing
+        $ echo '{"v":1,"kind":"get","operation":"read","registry":{"index-url":"sparse+https://cargo.cloudsmith.io/org/repo/"}}' \\
+            | cloudsmith credential-helper cargo
+
+        # Called by Cargo via the launcher
+        $ cargo-credential-cloudsmith --cargo-plugin
+
+    \b
+    Environment variables:
+        CLOUDSMITH_API_KEY: API key for authentication (optional)
+        CLOUDSMITH_WORKSPACE: Workspace slug (CLOUDSMITH_ORG is also accepted)
+    """
+    # `provider_args` collects the extra arguments Cargo appends from the
+    # credential-provider config entry.  This provider takes no configuration
+    # of its own, so they are accepted and ignored rather than rejected — an
+    # unknown-option error would surface as an authentication failure.
+    exit_code, stderr = execute(
+        sys.stdin,
+        sys.stdout,
+        credential=opts.credential,
+        api_host=opts.api_host,
+        org=opts.org,
+    )
+
+    if stderr is not None:
+        click.echo(stderr, err=True)
+    sys.exit(exit_code)

{cloudsmith_cli-1.25.0 → cloudsmith_cli-1.27.0}/cloudsmith_cli/cli/commands/credential_helper/docker.py

@@ -28,9 +28,10 @@ def docker(opts, operation):
     (get/store/erase/list).
 
     Provides credentials for all Cloudsmith Docker registries: ``*.cloudsmith.io``,
-    ``*.cloudsmith.com``, and any custom domains configured for the organisation
-    (requires an organisation - ``--org``, CLOUDSMITH_ORG or ``org`` in
-    ``config.ini`` - and a valid API key/token).
+    ``*.cloudsmith.com``, and any custom domains configured for the Workspace
+    (requires a Workspace - ``--workspace``, CLOUDSMITH_WORKSPACE, or
+    ``workspace`` in ``config.ini``; legacy aliases are also accepted - and a
+    valid API key/token).
 
     Input (stdin):
         Server URL as plain text (e.g. "docker.cloudsmith.io")
@@ -51,7 +52,7 @@ def docker(opts, operation):
 
     Environment variables:
         CLOUDSMITH_API_KEY: API key for authentication (optional)
-        CLOUDSMITH_ORG:     Organisation slug (required for custom domain support)
+        CLOUDSMITH_WORKSPACE: Workspace slug (CLOUDSMITH_ORG is also accepted)
     """
     exit_code, stdout, stderr = execute(
         operation,

{cloudsmith_cli-1.25.0 → cloudsmith_cli-1.27.0}/cloudsmith_cli/cli/commands/credential_helper/generic.py

@@ -27,7 +27,7 @@ def generic(opts):
 
     Resolves a credential through the full provider chain and writes a
     versioned JSON document to stdout.  Takes no arguments: a Cloudsmith token
-    is organisation-wide, so the host it will be used against does not change
+    is Workspace-wide, so the host it will be used against does not change
     which credential resolves.
 
     \b