cloudsmith-cli 1.26.0__tar.gz → 1.27.0__tar.gz

{cloudsmith_cli-1.26.0/cloudsmith_cli.egg-info → cloudsmith_cli-1.27.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cloudsmith-cli
-Version: 1.26.0
+Version: 1.27.0
 Summary: Cloudsmith Command-Line Interface (CLI)
 Author-email: Cloudsmith Ltd <support@cloudsmith.io>
 License-Expression: Apache-2.0
@@ -32,13 +32,16 @@ Requires-Dist: cloudsmith-api<3.0,>=2.0.31
 Requires-Dist: keyring>=25.4.1
 Requires-Dist: keyrings-alt>=5.0.2
 Requires-Dist: keyrings-cryptfile>=1.3.9
+Requires-Dist: cryptography>=50.0.0
 Requires-Dist: mcp==1.28.1
-Requires-Dist: PyJWT[crypto]>=2.0.0
+Requires-Dist: pydantic-settings>=2.14.2
+Requires-Dist: PyJWT[crypto]>=2.13.0
 Requires-Dist: python-toon==0.1.2
 Requires-Dist: requests>=2.18.4
 Requires-Dist: requests_toolbelt>=1.0.0
 Requires-Dist: rich>=13.0.0
 Requires-Dist: semver>=2.7.9
+Requires-Dist: starlette>=1.3.1
 Requires-Dist: urllib3>=2.5
 Requires-Dist: tomlkit>=0.15.0
 Provides-Extra: aws
@@ -370,7 +373,7 @@ cloudsmith auth --owner example
 Beginning authentication for the example org ...
 Your organization's SAML IDP URL is: https://example.com/some-saml-idp
 
-Starting webserver to begin authentication ...
+Waiting for the authentication callback on port 12400 ...
 
 Authentication complete
 ```
@@ -381,7 +384,7 @@ The CLI opens the IDP URL in your browser automatically. If it can't (for exampl
 cloudsmith auth --owner example --no-browser
 ```
 
-*Note:* The authentication callback is served on `127.0.0.1:12400`, so the browser you open the URL in must be running on the same machine as the CLI.
+*Note:* The authentication callback is served on `127.0.0.1`, on the first free port between `12400` and `12404`. The browser you open the URL in must run on the same machine as the CLI.
 
 #### Getting Your API Key
 

{cloudsmith_cli-1.26.0 → cloudsmith_cli-1.27.0}/README.md

@@ -321,7 +321,7 @@ cloudsmith auth --owner example
 Beginning authentication for the example org ...
 Your organization's SAML IDP URL is: https://example.com/some-saml-idp
 
-Starting webserver to begin authentication ...
+Waiting for the authentication callback on port 12400 ...
 
 Authentication complete
 ```
@@ -332,7 +332,7 @@ The CLI opens the IDP URL in your browser automatically. If it can't (for exampl
 cloudsmith auth --owner example --no-browser
 ```
 
-*Note:* The authentication callback is served on `127.0.0.1:12400`, so the browser you open the URL in must be running on the same machine as the CLI.
+*Note:* The authentication callback is served on `127.0.0.1`, on the first free port between `12400` and `12404`. The browser you open the URL in must run on the same machine as the CLI.
 
 #### Getting Your API Key
 

{cloudsmith_cli-1.26.0 → cloudsmith_cli-1.27.0}/cloudsmith_cli/cli/commands/auth.py

@@ -3,7 +3,13 @@
 import webbrowser
 
 import click
+import requests
 
+from ...core.sso import (
+    SsoRenewalStatus,
+    get_access_token_expiry,
+    renew_sso_session,
+)
 from .. import decorators, utils, validators
 from ..exceptions import handle_api_exceptions
 from ..saml import create_configured_session, get_idp_url
@@ -13,7 +19,86 @@ from .tokens import create, request_api_key
 
 # Authentication server configuration
 AUTH_SERVER_HOST = "127.0.0.1"
-AUTH_SERVER_PORT = 12400
+AUTH_REDIRECT_HOST = "localhost"
+AUTH_SERVER_PORTS = (12400, 12401, 12402, 12403, 12404)
+
+
+def _create_auth_server(opts, owner, session, enable_token_creation, profile):
+    """Create an authentication server on the first available callback port."""
+    last_error = None
+
+    for port in AUTH_SERVER_PORTS:
+        try:
+            server = AuthenticationWebServer(
+                (AUTH_SERVER_HOST, port),
+                AuthenticationWebRequestHandler,
+                owner=owner,
+                session=session,
+                debug=opts.debug,
+                refresh_api_on_success=enable_token_creation,
+                api_opts=opts.api_config,
+                profile=profile,
+            )
+            return server, port
+        except OSError as exc:
+            last_error = exc
+
+    ports = ", ".join(str(port) for port in AUTH_SERVER_PORTS)
+    raise click.ClickException(
+        "Could not start the authentication callback server. "
+        f"Every candidate port is unavailable: {ports}. "
+        f"The last error was: {last_error}. "
+        "Stop the process that holds one of these ports, then try again."
+    ) from last_error
+
+
+def _renew_existing_sso_session(opts, profile):
+    """Return a usable existing SSO session, or fall back to browser auth."""
+    renewal = renew_sso_session(opts.api_config.host, opts.session, profile=profile)
+    if renewal.status in (
+        SsoRenewalStatus.RENEWED,
+        SsoRenewalStatus.CURRENT,
+    ):
+        return renewal
+    if renewal.status == SsoRenewalStatus.FAILED and isinstance(
+        renewal.error, requests.RequestException
+    ):
+        raise click.ClickException(
+            "The SSO session has expired and Cloudsmith could not be reached. "
+            "Check your connection, then run 'cloudsmith auth' again."
+        ) from renewal.error
+    return None
+
+
+def _report_active_sso_session(opts, renewal, use_stderr=False):
+    """Report the usable SSO session without exposing its access token."""
+    expires_at = get_access_token_expiry(renewal.access_token)
+    data = {
+        "authenticated": True,
+        "method": "sso",
+        "status": renewal.status.value,
+        "expires_at": expires_at,
+        "renewal_error": str(renewal.error) if renewal.error else None,
+    }
+    if utils.maybe_print_as_json(opts, data):
+        return
+
+    if renewal.status == SsoRenewalStatus.RENEWED:
+        click.secho("SSO session renewed.", fg="green", err=use_stderr)
+    elif renewal.error:
+        click.secho(
+            "The SSO session could not be renewed; the existing access token "
+            "remains active.",
+            fg="yellow",
+            err=use_stderr,
+        )
+    else:
+        click.secho("SSO session is active.", fg="green", err=use_stderr)
+    if expires_at:
+        click.echo(
+            f"Access token expires at {utils.fmt_datetime(expires_at)}.",
+            err=use_stderr,
+        )
 
 
 def _perform_saml_authentication(
@@ -28,50 +113,52 @@ def _perform_saml_authentication(
     session = create_configured_session(opts)
     api_host = opts.api_config.host
 
-    idp_url = get_idp_url(api_host, owner, session=session)
-
-    click.echo(
-        f"Your Workspace's SAML IDP URL is: {click.style(idp_url, bold=True)}",
-        err=use_stderr,
+    auth_server, port = _create_auth_server(
+        opts, owner, session, enable_token_creation, profile
     )
-    click.echo(err=use_stderr)
+    redirect_url = f"http://{AUTH_REDIRECT_HOST}:{port}"
 
-    if no_browser:
+    try:
         click.echo(
-            "Skipping automatic browser launch (--no-browser). "
-            "Please open the URL above manually to continue.",
+            f"Waiting for the authentication callback on port {port} ... ",
             err=use_stderr,
         )
-    else:
-        try:
-            browser_opened = webbrowser.open(idp_url)
-        except Exception:
-            # Browser launch failures vary by platform (webbrowser.Error on
-            # Cygwin/headless, anything else elsewhere), so catch broadly and
-            # fall back to the manual URL rather than crashing.
-            browser_opened = False
-
-        if not browser_opened:
+
+        idp_url = get_idp_url(
+            api_host, owner, redirect_url=redirect_url, session=session
+        )
+
+        click.echo(
+            f"Your Workspace's SAML IDP URL is: {click.style(idp_url, bold=True)}",
+            err=use_stderr,
+        )
+        click.echo(err=use_stderr)
+
+        if no_browser:
             click.echo(
-                "Couldn't open a browser automatically. "
+                "Skipping automatic browser launch (--no-browser). "
                 "Please open the URL above manually to continue.",
                 err=use_stderr,
             )
+        else:
+            try:
+                browser_opened = webbrowser.open(idp_url)
+            except Exception:
+                # Browser launch failures vary by platform (webbrowser.Error on
+                # Cygwin/headless, anything else elsewhere), so catch broadly and
+                # fall back to the manual URL rather than crashing.
+                browser_opened = False
 
-    click.echo("Starting webserver to begin authentication ... ", err=use_stderr)
-
-    auth_server = AuthenticationWebServer(
-        (AUTH_SERVER_HOST, AUTH_SERVER_PORT),
-        AuthenticationWebRequestHandler,
-        owner=owner,
-        session=session,
-        debug=opts.debug,
-        refresh_api_on_success=enable_token_creation,
-        api_opts=opts.api_config,
-        profile=profile,
-    )
+            if not browser_opened:
+                click.echo(
+                    "Couldn't open a browser automatically. "
+                    "Please open the URL above manually to continue.",
+                    err=use_stderr,
+                )
 
-    auth_server.handle_request()
+        auth_server.handle_request()
+    finally:
+        auth_server.server_close()
 
 
 @main.command(aliases=["auth"])
@@ -165,6 +252,14 @@ def authenticate(
             err=True,
         )
 
+    if not force and not token and not request_api_key_flag:
+        session_result = _renew_existing_sso_session(
+            opts, profile=ctx.meta.get("profile")
+        )
+        if session_result:
+            _report_active_sso_session(opts, session_result, use_stderr)
+            return
+
     workspace = opts.org or click.prompt("Workspace", err=use_stderr)
     workspace = validators.validate_owner(ctx, None, workspace)[0]
     opts.org = workspace

{cloudsmith_cli-1.26.0 → cloudsmith_cli-1.27.0}/cloudsmith_cli/cli/commands/credential_helper/__init__.py

@@ -14,6 +14,7 @@ from .docker import docker as docker_cmd
 from .generic import generic as generic_cmd
 from .manage import install_cmd, list_cmd, uninstall_cmd
 from .pnpm import pnpm as pnpm_cmd
+from .terraform import terraform as terraform_cmd
 
 
 @click.group()
@@ -50,5 +51,6 @@ credential_helper.add_command(install_cmd, name="install")
 credential_helper.add_command(uninstall_cmd, name="uninstall")
 credential_helper.add_command(list_cmd, name="list")
 credential_helper.add_command(cargo_cmd, name="cargo")
+credential_helper.add_command(terraform_cmd, name="terraform")
 
 main.add_command(credential_helper, name="credential-helper")

{cloudsmith_cli-1.26.0 → cloudsmith_cli-1.27.0}/cloudsmith_cli/cli/commands/credential_helper/manage.py

@@ -15,6 +15,15 @@ import click
 from cloudsmith_cli.credential_helpers.cargo.installer import CargoInstaller
 from cloudsmith_cli.credential_helpers.generic import PartialInstallError
 from cloudsmith_cli.credential_helpers.pnpm.installer import PNPMInstaller
+from cloudsmith_cli.credential_helpers.terraform.installer import (
+    TerraformHelperExeNotFound,
+    TerraformInstaller,
+    TerraformPluginDirError,
+    _terraformrc_path,
+)
+from cloudsmith_cli.credential_helpers.terraform.terraformrc import (
+    TerraformrcConflictError,
+)
 
 from ....credential_helpers.docker.installer import DockerInstaller
 from ... import utils
@@ -33,6 +42,7 @@ _INSTALLERS: dict[str, type] = {
     "docker": DockerInstaller,
     "pnpm": PNPMInstaller,
     "cargo": CargoInstaller,
+    "terraform": TerraformInstaller,
 }
 
 
@@ -65,6 +75,72 @@ def _get_installer(name: str):
     return cls()
 
 
+def _terraform_helper_args(ctx, opts, repo: str | None = None) -> tuple[str, ...]:
+    """Build the terraformrc ``args`` list from the resolved config.
+
+    Baking ``--org``/``-r``/``-P`` into the block means ``terraform init`` works
+    with no environment variables and no hand-edited config. Only values
+    actually supplied are written, so an install without ``--org``/``--repo``/
+    ``-P`` leaves ``args = []``.
+
+    A non-default ``--config-file``/``--credentials-file`` is also baked in: the
+    helper is later invoked by ``terraform init`` in a fresh process with none
+    of this invocation's flags, so without pinning them Terraform would resolve
+    credentials from the default search path instead of the files the operator
+    installed with.
+    """
+    args: list[str] = []
+    if opts.org:
+        args.extend(["--org", opts.org])
+    if repo:
+        args.extend(["-r", repo])
+    profile = ctx.meta.get("profile")
+    if profile:
+        args.extend(["-P", profile])
+    config_file = ctx.meta.get("config_file")
+    if config_file:
+        args.extend(["--config-file", config_file])
+    creds_file = ctx.meta.get("creds_file")
+    if creds_file:
+        args.extend(["--credentials-file", creds_file])
+    return tuple(args)
+
+
+_REPO_FLAGS = ("-r", "--repo", "--repository")
+
+
+def _terraform_next_steps(helper_args: tuple[str, ...]) -> list[str]:
+    """Return the post-install guidance for the required repository.
+
+    Terraform never tells the credentials helper which repository is being
+    requested, so the helper needs the repository supplied out-of-band. If it
+    was not baked into the generated ``args`` at install time, tell the user how
+    to provide it: set ``CLOUDSMITH_REPO`` or add ``--repo`` to the terraformrc
+    ``args``. Returns an empty list when a repository is already configured.
+    """
+    has_repo = any(
+        a in _REPO_FLAGS or a.split("=", 1)[0] in _REPO_FLAGS for a in helper_args
+    )
+    if has_repo:
+        return []
+    rc_path = _terraformrc_path()
+    return [
+        (
+            "Next steps: the Terraform helper requires a repository, which"
+            " Terraform does not pass to credentials helpers. Provide it in one"
+            " of these ways:"
+        ),
+        (
+            "  - export CLOUDSMITH_REPO=<your-repo> in the environment that runs"
+            " `terraform init`, or"
+        ),
+        (
+            f"  - add it to the args in {rc_path}, e.g."
+            ' args = ["--repo", "<your-repo>", ...].'
+        ),
+    ]
+
+
 # ---------------------------------------------------------------------------
 # install
 # ---------------------------------------------------------------------------
@@ -99,6 +175,16 @@ def _get_installer(name: str):
     default=False,
     help="Bypass the custom-domain cache and fetch fresh data from the API.",
 )
+@click.option(
+    "-r",
+    "--repo",
+    "--repository",
+    "repo",
+    default=None,
+    help="Terraform only: bake this repository into the terraformrc `args` "
+    "list (as `-r <repo>`) so `terraform init` needs no CLOUDSMITH_REPO env "
+    "var. Terraform does not pass the repository to a credentials helper.",
+)
 @common_cli_config_options
 @common_cli_output_options
 @common_api_auth_options
@@ -113,6 +199,7 @@ def install_cmd(
     dry_run: bool,
     no_discover: bool,
     refresh: bool,
+    repo: str | None,
 ) -> None:
     """Install a credential helper launcher and configure the package manager.
 
@@ -140,19 +227,41 @@ def install_cmd(
     \b
         # Disable automatic custom-domain discovery
         $ cloudsmith credential-helper install HELPER --no-discover
+
+    \b
+        # Terraform: bake the repository into the terraformrc args so
+        # `terraform init` needs no CLOUDSMITH_REPO env var
+        $ cloudsmith credential-helper install terraform --org acme --repo my-repo
     """
     installer = _get_installer(helper)
+
+    install_kwargs = {
+        "bin_dir": bin_dir,
+        "domains": domains,
+        "dry_run": dry_run,
+        "discover": not no_discover,
+        "refresh": refresh,
+        "org": opts.org,
+        "credential": opts.credential,
+        "api_host": opts.api_host,
+    }
+
+    # Terraform bakes the resolved org/profile into the terraformrc `args` list
+    # so `terraform init` needs neither env vars nor a hand-edited config. The
+    # wrapper forwards these to the CLI ahead of the hostname at call time.
+    helper_args: tuple[str, ...] = ()
+    if helper == "terraform":
+        helper_args = _terraform_helper_args(ctx, opts, repo)
+        install_kwargs["helper_args"] = helper_args
+
     try:
-        actions = installer.install(
-            bin_dir=bin_dir,
-            domains=domains,
-            dry_run=dry_run,
-            discover=not no_discover,
-            refresh=refresh,
-            org=opts.org,
-            credential=opts.credential,
-            api_host=opts.api_host,
-        )
+        actions = installer.install(**install_kwargs)
+    except (
+        TerraformrcConflictError,
+        TerraformHelperExeNotFound,
+        TerraformPluginDirError,
+    ) as exc:
+        raise click.ClickException(str(exc))
     except OSError as exc:
         raise click.ClickException(
             f"Failed to install {helper!r} credential helper: {exc}"
@@ -166,11 +275,17 @@ def install_cmd(
     use_stderr = utils.should_use_stderr(opts)
     warnings = [a for a in actions if a.startswith("WARNING")]
     normal = [a for a in actions if not a.startswith("WARNING")]
+
+    next_steps: list[str] = []
+    if helper == "terraform":
+        next_steps = _terraform_next_steps(helper_args)
+
     data = {
         "helper": helper,
         "dry_run": dry_run,
         "actions": normal,
         "warnings": warnings,
+        "next_steps": next_steps,
     }
     if utils.maybe_print_as_json(opts, data):
         sys.exit(ec)
@@ -181,6 +296,8 @@ def install_cmd(
         click.echo(f"  {action}" if dry_run else action, err=use_stderr)
     for warning in warnings:
         click.secho(f"  {warning}" if dry_run else warning, err=True, fg="yellow")
+    for line in next_steps:
+        click.secho(line, err=use_stderr, fg="cyan")
     sys.exit(ec)
 
 

cloudsmith_cli-1.27.0/cloudsmith_cli/cli/commands/credential_helper/terraform.py

@@ -0,0 +1,151 @@
+# Copyright 2026 Cloudsmith Ltd
+"""
+Terraform credentials helper command.
+
+Implements the ``get`` verb of Terraform's credentials-helper protocol for
+Cloudsmith registries.  The installed ``terraform-credentials-cloudsmith``
+launcher forwards Terraform's invocation to this command.
+
+See: https://developer.hashicorp.com/terraform/internals/credentials-helpers
+"""
+
+import sys
+
+import click
+
+from ....credential_helpers.terraform import execute
+from ...decorators import (
+    common_api_auth_options,
+    common_cli_config_options,
+    resolve_credentials,
+)
+
+
+@click.command(context_settings={"ignore_unknown_options": True})
+@click.option(
+    "-r",
+    "--repo",
+    "--repository",
+    "repo",
+    required=True,
+    envvar="CLOUDSMITH_REPO",
+    help="The Cloudsmith repository the registry serves. Terraform does not "
+    "pass the repository to a credentials helper, so it must be configured "
+    "here (e.g. in the terraformrc args) to build a repository-scoped token.",
+)
+@click.argument("params", nargs=-1, type=click.UNPROCESSED)
+@common_cli_config_options
+@common_api_auth_options
+@resolve_credentials
+def terraform(opts, repo, params):
+    """
+    Terraform credentials helper for Cloudsmith registries.
+
+    Resolves the token for a Cloudsmith Terraform registry and prints it in
+    Terraform's expected JSON credentials format: ``{"token": "..."}``.
+
+    Provides credentials for all Cloudsmith Terraform registries:
+    ``*.cloudsmith.io``, ``*.cloudsmith.com``, and any custom domains
+    configured for the organisation (requires an organisation - ``--org``,
+    CLOUDSMITH_ORG or ``org`` in ``config.ini`` - and a valid API key/token).
+
+    Accepts Terraform's calling convention — an optional verb (``get``,
+    ``store``, ``forget``) followed by the hostname — so the on-PATH launcher
+    can forward Terraform's arguments verbatim.  When no verb is given the
+    action is ``get``.  When no hostname is given it is read from stdin.  Only
+    ``get`` is served; ``store``/``forget`` return an error and a non-zero exit.
+    ``store`` first drains its stdin payload (the credentials Terraform sends)
+    before erroring, as the protocol requires, so Terraform sees the exit status
+    rather than a broken pipe.
+
+    A hostname that is not a Cloudsmith registry yields an empty object
+    (``{}``) and exit 0 so Terraform falls back to its own credential sources.
+
+    \b
+    Input (arguments or stdin):
+        [VERB] HOSTNAME — e.g. "get terraform.cloudsmith.io" or just
+        "terraform.cloudsmith.io"; HOSTNAME alone may also come from stdin.
+
+    \b
+    Output (stdout):
+        JSON: {"token": "<cloudsmith-token>"}  (Cloudsmith host, token found)
+        JSON: {}                               (not a Cloudsmith host)
+
+    \b
+    Exit codes:
+        0: Token returned, or the host is not a Cloudsmith registry
+        1: Cloudsmith host with no credentials available, or an error occurred
+
+    The token is scoped to the repository. On a standard
+    ``*.cloudsmith.io``/``*.cloudsmith.com`` host it is ``{org}/{repo}/{token}``
+    and the organisation is required (``--org``, ``CLOUDSMITH_ORG`` or ``org``
+    in ``config.ini``); a standard host requested without an organisation is a
+    non-zero exit. On a custom domain — which is already bound to a single
+    organisation — the org is omitted and the token is ``{repo}/{token}``. The
+    repository is always required (``-r/--repo/--repository`` or
+    ``CLOUDSMITH_REPO``): Terraform does not tell a credentials helper which
+    repository is being requested. A non-Cloudsmith host still returns ``{}``
+    and exit 0. The profile can also be supplied with ``-P/--profile``. The
+    launcher forwards Terraform's ``args`` verbatim, so a terraformrc block such
+    as ``credentials_helper "cloudsmith" { args = ["--org=acme",
+    "--repo=my-repo", "-P", "ci"] }`` reaches this command as those options.
+
+    \b
+    Examples:
+        # Direct usage
+        $ cloudsmith credential-helper terraform --repo my-repo terraform.cloudsmith.io
+        {"token": "..."}
+
+        # Terraform's calling convention (verb + hostname)
+        $ cloudsmith credential-helper terraform --repo my-repo get terraform.cloudsmith.io
+
+        # Select an org and profile explicitly (no env vars needed)
+        $ cloudsmith credential-helper terraform --org=acme -P ci get terraform.cloudsmith.io
+
+    \b
+    Environment variables:
+        CLOUDSMITH_API_KEY: API key for authentication (optional)
+        CLOUDSMITH_ORG:     Organisation slug (required to scope the token)
+        CLOUDSMITH_REPO:    Repository slug the registry serves (required)
+        CLOUDSMITH_PROFILE: Configuration profile to load (optional)
+    """
+    # Terraform passes "<verb> <hostname>"; direct/manual use may pass just the
+    # hostname (verb defaults to "get") or nothing (hostname read from stdin).
+    verb = "get"
+    hostname: str | None = None
+    if len(params) >= 2:
+        verb, hostname = params[-2], params[-1]
+    elif len(params) == 1:
+        hostname = params[0]
+
+    # The `store` verb sends the new credentials as a JSON object on stdin. The
+    # protocol requires an unsupported store implementation to consume the whole
+    # payload before returning an error, otherwise Terraform can see a broken
+    # pipe instead of the helper's exit status. Drain stdin here; the payload is
+    # discarded because this helper never stores credentials.
+    if verb == "store":
+        try:
+            sys.stdin.read()
+        except (OSError, ValueError):
+            pass
+
+    if not hostname:
+        try:
+            hostname = sys.stdin.read().strip()
+        except (OSError, ValueError):
+            hostname = ""
+
+    exit_code, stdout, stderr = execute(
+        verb,
+        hostname,
+        credential=opts.credential,
+        api_host=opts.api_host,
+        org=opts.org,
+        repo=repo,
+    )
+
+    if stdout is not None:
+        click.echo(stdout)
+    if stderr is not None:
+        click.echo(stderr, err=True)
+    sys.exit(exit_code)