cloudsmith-cli 1.26.0__tar.gz → 1.28.0__tar.gz

{cloudsmith_cli-1.26.0/cloudsmith_cli.egg-info → cloudsmith_cli-1.28.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cloudsmith-cli
-Version: 1.26.0
+Version: 1.28.0
 Summary: Cloudsmith Command-Line Interface (CLI)
 Author-email: Cloudsmith Ltd <support@cloudsmith.io>
 License-Expression: Apache-2.0
@@ -23,6 +23,7 @@ Classifier: Topic :: Utilities
 Requires-Python: >=3.10.0
 Description-Content-Type: text/markdown
 License-File: LICENSE
+Requires-Dist: certifi>=2024.7.4
 Requires-Dist: click!=8.3.0,>=8.2
 Requires-Dist: click-configfile>=0.2.3
 Requires-Dist: click-didyoumean>=0.0.3
@@ -32,13 +33,16 @@ Requires-Dist: cloudsmith-api<3.0,>=2.0.31
 Requires-Dist: keyring>=25.4.1
 Requires-Dist: keyrings-alt>=5.0.2
 Requires-Dist: keyrings-cryptfile>=1.3.9
-Requires-Dist: mcp==1.28.1
-Requires-Dist: PyJWT[crypto]>=2.0.0
-Requires-Dist: python-toon==0.1.2
+Requires-Dist: cryptography>=50.0.0
+Requires-Dist: mcp==2.2.0
+Requires-Dist: pydantic-settings>=2.14.2
+Requires-Dist: PyJWT[crypto]>=2.13.0
+Requires-Dist: python-toon==0.1.3
 Requires-Dist: requests>=2.18.4
 Requires-Dist: requests_toolbelt>=1.0.0
 Requires-Dist: rich>=13.0.0
 Requires-Dist: semver>=2.7.9
+Requires-Dist: starlette>=1.3.1
 Requires-Dist: urllib3>=2.5
 Requires-Dist: tomlkit>=0.15.0
 Provides-Extra: aws
@@ -370,7 +374,7 @@ cloudsmith auth --owner example
 Beginning authentication for the example org ...
 Your organization's SAML IDP URL is: https://example.com/some-saml-idp
 
-Starting webserver to begin authentication ...
+Waiting for the authentication callback on port 12400 ...
 
 Authentication complete
 ```
@@ -381,7 +385,7 @@ The CLI opens the IDP URL in your browser automatically. If it can't (for exampl
 cloudsmith auth --owner example --no-browser
 ```
 
-*Note:* The authentication callback is served on `127.0.0.1:12400`, so the browser you open the URL in must be running on the same machine as the CLI.
+*Note:* The authentication callback is served on `127.0.0.1`, on the first free port between `12400` and `12404`. The browser you open the URL in must run on the same machine as the CLI.
 
 #### Getting Your API Key
 

{cloudsmith_cli-1.26.0 → cloudsmith_cli-1.28.0}/README.md

@@ -321,7 +321,7 @@ cloudsmith auth --owner example
 Beginning authentication for the example org ...
 Your organization's SAML IDP URL is: https://example.com/some-saml-idp
 
-Starting webserver to begin authentication ...
+Waiting for the authentication callback on port 12400 ...
 
 Authentication complete
 ```
@@ -332,7 +332,7 @@ The CLI opens the IDP URL in your browser automatically. If it can't (for exampl
 cloudsmith auth --owner example --no-browser
 ```
 
-*Note:* The authentication callback is served on `127.0.0.1:12400`, so the browser you open the URL in must be running on the same machine as the CLI.
+*Note:* The authentication callback is served on `127.0.0.1`, on the first free port between `12400` and `12404`. The browser you open the URL in must run on the same machine as the CLI.
 
 #### Getting Your API Key
 

{cloudsmith_cli-1.26.0 → cloudsmith_cli-1.28.0}/cloudsmith_cli/cli/commands/auth.py

@@ -3,7 +3,13 @@
 import webbrowser
 
 import click
+import requests
 
+from ...core.sso import (
+    SsoRenewalStatus,
+    get_access_token_expiry,
+    renew_sso_session,
+)
 from .. import decorators, utils, validators
 from ..exceptions import handle_api_exceptions
 from ..saml import create_configured_session, get_idp_url
@@ -13,7 +19,86 @@ from .tokens import create, request_api_key
 
 # Authentication server configuration
 AUTH_SERVER_HOST = "127.0.0.1"
-AUTH_SERVER_PORT = 12400
+AUTH_REDIRECT_HOST = "localhost"
+AUTH_SERVER_PORTS = (12400, 12401, 12402, 12403, 12404)
+
+
+def _create_auth_server(opts, owner, session, enable_token_creation, profile):
+    """Create an authentication server on the first available callback port."""
+    last_error = None
+
+    for port in AUTH_SERVER_PORTS:
+        try:
+            server = AuthenticationWebServer(
+                (AUTH_SERVER_HOST, port),
+                AuthenticationWebRequestHandler,
+                owner=owner,
+                session=session,
+                debug=opts.debug,
+                refresh_api_on_success=enable_token_creation,
+                api_opts=opts.api_config,
+                profile=profile,
+            )
+            return server, port
+        except OSError as exc:
+            last_error = exc
+
+    ports = ", ".join(str(port) for port in AUTH_SERVER_PORTS)
+    raise click.ClickException(
+        "Could not start the authentication callback server. "
+        f"Every candidate port is unavailable: {ports}. "
+        f"The last error was: {last_error}. "
+        "Stop the process that holds one of these ports, then try again."
+    ) from last_error
+
+
+def _renew_existing_sso_session(opts, profile):
+    """Return a usable existing SSO session, or fall back to browser auth."""
+    renewal = renew_sso_session(opts.api_config.host, opts.session, profile=profile)
+    if renewal.status in (
+        SsoRenewalStatus.RENEWED,
+        SsoRenewalStatus.CURRENT,
+    ):
+        return renewal
+    if renewal.status == SsoRenewalStatus.FAILED and isinstance(
+        renewal.error, requests.RequestException
+    ):
+        raise click.ClickException(
+            "The SSO session has expired and Cloudsmith could not be reached. "
+            "Check your connection, then run 'cloudsmith auth' again."
+        ) from renewal.error
+    return None
+
+
+def _report_active_sso_session(opts, renewal, use_stderr=False):
+    """Report the usable SSO session without exposing its access token."""
+    expires_at = get_access_token_expiry(renewal.access_token)
+    data = {
+        "authenticated": True,
+        "method": "sso",
+        "status": renewal.status.value,
+        "expires_at": expires_at,
+        "renewal_error": str(renewal.error) if renewal.error else None,
+    }
+    if utils.maybe_print_as_json(opts, data):
+        return
+
+    if renewal.status == SsoRenewalStatus.RENEWED:
+        click.secho("SSO session renewed.", fg="green", err=use_stderr)
+    elif renewal.error:
+        click.secho(
+            "The SSO session could not be renewed; the existing access token "
+            "remains active.",
+            fg="yellow",
+            err=use_stderr,
+        )
+    else:
+        click.secho("SSO session is active.", fg="green", err=use_stderr)
+    if expires_at:
+        click.echo(
+            f"Access token expires at {utils.fmt_datetime(expires_at)}.",
+            err=use_stderr,
+        )
 
 
 def _perform_saml_authentication(
@@ -28,50 +113,52 @@ def _perform_saml_authentication(
     session = create_configured_session(opts)
     api_host = opts.api_config.host
 
-    idp_url = get_idp_url(api_host, owner, session=session)
-
-    click.echo(
-        f"Your Workspace's SAML IDP URL is: {click.style(idp_url, bold=True)}",
-        err=use_stderr,
+    auth_server, port = _create_auth_server(
+        opts, owner, session, enable_token_creation, profile
     )
-    click.echo(err=use_stderr)
+    redirect_url = f"http://{AUTH_REDIRECT_HOST}:{port}"
 
-    if no_browser:
+    try:
         click.echo(
-            "Skipping automatic browser launch (--no-browser). "
-            "Please open the URL above manually to continue.",
+            f"Waiting for the authentication callback on port {port} ... ",
             err=use_stderr,
         )
-    else:
-        try:
-            browser_opened = webbrowser.open(idp_url)
-        except Exception:
-            # Browser launch failures vary by platform (webbrowser.Error on
-            # Cygwin/headless, anything else elsewhere), so catch broadly and
-            # fall back to the manual URL rather than crashing.
-            browser_opened = False
-
-        if not browser_opened:
+
+        idp_url = get_idp_url(
+            api_host, owner, redirect_url=redirect_url, session=session
+        )
+
+        click.echo(
+            f"Your Workspace's SAML IDP URL is: {click.style(idp_url, bold=True)}",
+            err=use_stderr,
+        )
+        click.echo(err=use_stderr)
+
+        if no_browser:
             click.echo(
-                "Couldn't open a browser automatically. "
+                "Skipping automatic browser launch (--no-browser). "
                 "Please open the URL above manually to continue.",
                 err=use_stderr,
             )
+        else:
+            try:
+                browser_opened = webbrowser.open(idp_url)
+            except Exception:
+                # Browser launch failures vary by platform (webbrowser.Error on
+                # Cygwin/headless, anything else elsewhere), so catch broadly and
+                # fall back to the manual URL rather than crashing.
+                browser_opened = False
 
-    click.echo("Starting webserver to begin authentication ... ", err=use_stderr)
-
-    auth_server = AuthenticationWebServer(
-        (AUTH_SERVER_HOST, AUTH_SERVER_PORT),
-        AuthenticationWebRequestHandler,
-        owner=owner,
-        session=session,
-        debug=opts.debug,
-        refresh_api_on_success=enable_token_creation,
-        api_opts=opts.api_config,
-        profile=profile,
-    )
+            if not browser_opened:
+                click.echo(
+                    "Couldn't open a browser automatically. "
+                    "Please open the URL above manually to continue.",
+                    err=use_stderr,
+                )
 
-    auth_server.handle_request()
+        auth_server.handle_request()
+    finally:
+        auth_server.server_close()
 
 
 @main.command(aliases=["auth"])
@@ -165,6 +252,14 @@ def authenticate(
             err=True,
         )
 
+    if not force and not token and not request_api_key_flag:
+        session_result = _renew_existing_sso_session(
+            opts, profile=ctx.meta.get("profile")
+        )
+        if session_result:
+            _report_active_sso_session(opts, session_result, use_stderr)
+            return
+
     workspace = opts.org or click.prompt("Workspace", err=use_stderr)
     workspace = validators.validate_owner(ctx, None, workspace)[0]
     opts.org = workspace

{cloudsmith_cli-1.26.0 → cloudsmith_cli-1.28.0}/cloudsmith_cli/cli/commands/credential_helper/__init__.py

@@ -14,6 +14,7 @@ from .docker import docker as docker_cmd
 from .generic import generic as generic_cmd
 from .manage import install_cmd, list_cmd, uninstall_cmd
 from .pnpm import pnpm as pnpm_cmd
+from .terraform import terraform as terraform_cmd
 
 
 @click.group()
@@ -26,18 +27,20 @@ def credential_helper():
     manager automatically, or run the runtime command directly for debugging.
 
     Examples:
+
+    \b
         # Install Docker credential helper
         $ cloudsmith credential-helper install docker
-
+    \b
         # Install pnpm credential helper
         $ cloudsmith credential-helper install pnpm
-
+    \b
         # Install cargo credential helper
         $ cloudsmith credential-helper install cargo
-
+    \b
         # Test Docker credential helper directly
         $ echo "docker.cloudsmith.io" | cloudsmith credential-helper docker
-
+    \b
         # Test pnpm credential helper directly
         $ cloudsmith credential-helper pnpm npm.cloudsmith.io
     """
@@ -50,5 +53,6 @@ credential_helper.add_command(install_cmd, name="install")
 credential_helper.add_command(uninstall_cmd, name="uninstall")
 credential_helper.add_command(list_cmd, name="list")
 credential_helper.add_command(cargo_cmd, name="cargo")
+credential_helper.add_command(terraform_cmd, name="terraform")
 
 main.add_command(credential_helper, name="credential-helper")

{cloudsmith_cli-1.26.0 → cloudsmith_cli-1.28.0}/cloudsmith_cli/cli/commands/credential_helper/docker.py

@@ -33,23 +33,30 @@ def docker(opts, operation):
     ``workspace`` in ``config.ini``; legacy aliases are also accepted - and a
     valid API key/token).
 
+    \b
     Input (stdin):
         Server URL as plain text (e.g. "docker.cloudsmith.io")
 
+    \b
     Output (stdout):
         JSON: {"Username": "token", "Secret": "<cloudsmith-token>"}
 
+    \b
     Exit codes:
         0: Success
         1: Error (no credentials available, not a Cloudsmith registry, etc.)
 
+    \b
     Examples:
+
+    \b
         # Manual testing
         $ echo "docker.cloudsmith.io" | cloudsmith credential-helper docker
-
+    \b
         # Called by Docker via launcher
         $ echo "docker.cloudsmith.io" | docker-credential-cloudsmith get
 
+    \b
     Environment variables:
         CLOUDSMITH_API_KEY: API key for authentication (optional)
         CLOUDSMITH_WORKSPACE: Workspace slug (CLOUDSMITH_ORG is also accepted)

{cloudsmith_cli-1.26.0 → cloudsmith_cli-1.28.0}/cloudsmith_cli/cli/commands/credential_helper/manage.py

@@ -15,6 +15,15 @@ import click
 from cloudsmith_cli.credential_helpers.cargo.installer import CargoInstaller
 from cloudsmith_cli.credential_helpers.generic import PartialInstallError
 from cloudsmith_cli.credential_helpers.pnpm.installer import PNPMInstaller
+from cloudsmith_cli.credential_helpers.terraform.installer import (
+    TerraformHelperExeNotFound,
+    TerraformInstaller,
+    TerraformPluginDirError,
+    _terraformrc_path,
+)
+from cloudsmith_cli.credential_helpers.terraform.terraformrc import (
+    TerraformrcConflictError,
+)
 
 from ....credential_helpers.docker.installer import DockerInstaller
 from ... import utils
@@ -33,6 +42,7 @@ _INSTALLERS: dict[str, type] = {
     "docker": DockerInstaller,
     "pnpm": PNPMInstaller,
     "cargo": CargoInstaller,
+    "terraform": TerraformInstaller,
 }
 
 
@@ -65,6 +75,72 @@ def _get_installer(name: str):
     return cls()
 
 
+def _terraform_helper_args(ctx, opts, repo: str | None = None) -> tuple[str, ...]:
+    """Build the terraformrc ``args`` list from the resolved config.
+
+    Baking ``--org``/``-r``/``-P`` into the block means ``terraform init`` works
+    with no environment variables and no hand-edited config. Only values
+    actually supplied are written, so an install without ``--org``/``--repo``/
+    ``-P`` leaves ``args = []``.
+
+    A non-default ``--config-file``/``--credentials-file`` is also baked in: the
+    helper is later invoked by ``terraform init`` in a fresh process with none
+    of this invocation's flags, so without pinning them Terraform would resolve
+    credentials from the default search path instead of the files the operator
+    installed with.
+    """
+    args: list[str] = []
+    if opts.org:
+        args.extend(["--org", opts.org])
+    if repo:
+        args.extend(["-r", repo])
+    profile = ctx.meta.get("profile")
+    if profile:
+        args.extend(["-P", profile])
+    config_file = ctx.meta.get("config_file")
+    if config_file:
+        args.extend(["--config-file", config_file])
+    creds_file = ctx.meta.get("creds_file")
+    if creds_file:
+        args.extend(["--credentials-file", creds_file])
+    return tuple(args)
+
+
+_REPO_FLAGS = ("-r", "--repo", "--repository")
+
+
+def _terraform_next_steps(helper_args: tuple[str, ...]) -> list[str]:
+    """Return the post-install guidance for the required repository.
+
+    Terraform never tells the credentials helper which repository is being
+    requested, so the helper needs the repository supplied out-of-band. If it
+    was not baked into the generated ``args`` at install time, tell the user how
+    to provide it: set ``CLOUDSMITH_REPO`` or add ``--repo`` to the terraformrc
+    ``args``. Returns an empty list when a repository is already configured.
+    """
+    has_repo = any(
+        a in _REPO_FLAGS or a.split("=", 1)[0] in _REPO_FLAGS for a in helper_args
+    )
+    if has_repo:
+        return []
+    rc_path = _terraformrc_path()
+    return [
+        (
+            "Next steps: the Terraform helper requires a repository, which"
+            " Terraform does not pass to credentials helpers. Provide it in one"
+            " of these ways:"
+        ),
+        (
+            "  - export CLOUDSMITH_REPO=<your-repo> in the environment that runs"
+            " `terraform init`, or"
+        ),
+        (
+            f"  - add it to the args in {rc_path}, e.g."
+            ' args = ["--repo", "<your-repo>", ...].'
+        ),
+    ]
+
+
 # ---------------------------------------------------------------------------
 # install
 # ---------------------------------------------------------------------------
@@ -99,6 +175,16 @@ def _get_installer(name: str):
     default=False,
     help="Bypass the custom-domain cache and fetch fresh data from the API.",
 )
+@click.option(
+    "-r",
+    "--repo",
+    "--repository",
+    "repo",
+    default=None,
+    help="Terraform only: bake this repository into the terraformrc `args` "
+    "list (as `-r <repo>`) so `terraform init` needs no CLOUDSMITH_REPO env "
+    "var. Terraform does not pass the repository to a credentials helper.",
+)
 @common_cli_config_options
 @common_cli_output_options
 @common_api_auth_options
@@ -113,6 +199,7 @@ def install_cmd(
     dry_run: bool,
     no_discover: bool,
     refresh: bool,
+    repo: str | None,
 ) -> None:
     """Install a credential helper launcher and configure the package manager.
 
@@ -140,19 +227,41 @@ def install_cmd(
     \b
         # Disable automatic custom-domain discovery
         $ cloudsmith credential-helper install HELPER --no-discover
+
+    \b
+        # Terraform: bake the repository into the terraformrc args so
+        # `terraform init` needs no CLOUDSMITH_REPO env var
+        $ cloudsmith credential-helper install terraform --org acme --repo my-repo
     """
     installer = _get_installer(helper)
+
+    install_kwargs = {
+        "bin_dir": bin_dir,
+        "domains": domains,
+        "dry_run": dry_run,
+        "discover": not no_discover,
+        "refresh": refresh,
+        "org": opts.org,
+        "credential": opts.credential,
+        "api_host": opts.api_host,
+    }
+
+    # Terraform bakes the resolved org/profile into the terraformrc `args` list
+    # so `terraform init` needs neither env vars nor a hand-edited config. The
+    # wrapper forwards these to the CLI ahead of the hostname at call time.
+    helper_args: tuple[str, ...] = ()
+    if helper == "terraform":
+        helper_args = _terraform_helper_args(ctx, opts, repo)
+        install_kwargs["helper_args"] = helper_args
+
     try:
-        actions = installer.install(
-            bin_dir=bin_dir,
-            domains=domains,
-            dry_run=dry_run,
-            discover=not no_discover,
-            refresh=refresh,
-            org=opts.org,
-            credential=opts.credential,
-            api_host=opts.api_host,
-        )
+        actions = installer.install(**install_kwargs)
+    except (
+        TerraformrcConflictError,
+        TerraformHelperExeNotFound,
+        TerraformPluginDirError,
+    ) as exc:
+        raise click.ClickException(str(exc))
     except OSError as exc:
         raise click.ClickException(
             f"Failed to install {helper!r} credential helper: {exc}"
@@ -166,11 +275,17 @@ def install_cmd(
     use_stderr = utils.should_use_stderr(opts)
     warnings = [a for a in actions if a.startswith("WARNING")]
     normal = [a for a in actions if not a.startswith("WARNING")]
+
+    next_steps: list[str] = []
+    if helper == "terraform":
+        next_steps = _terraform_next_steps(helper_args)
+
     data = {
         "helper": helper,
         "dry_run": dry_run,
         "actions": normal,
         "warnings": warnings,
+        "next_steps": next_steps,
     }
     if utils.maybe_print_as_json(opts, data):
         sys.exit(ec)
@@ -181,6 +296,8 @@ def install_cmd(
         click.echo(f"  {action}" if dry_run else action, err=use_stderr)
     for warning in warnings:
         click.secho(f"  {warning}" if dry_run else warning, err=True, fg="yellow")
+    for line in next_steps:
+        click.secho(line, err=use_stderr, fg="cyan")
     sys.exit(ec)