clue2app-cli 0.2.7__py3-none-any.whl

clue2app_cli/auth.py

@@ -0,0 +1,343 @@
+"""
+Authentication module for Clue2App CLI.
+
+Handles user authentication, token management, and login/logout functionality.
+"""
+
+import time
+import webbrowser
+import secrets
+import platform
+import base64
+import json
+from datetime import datetime
+from typing import Optional, Dict, Any
+
+import click
+import requests
+import keyring
+from rich.console import Console
+from rich.prompt import Prompt, Confirm
+from rich.panel import Panel
+from rich.spinner import Spinner
+
+from . import config
+from .version import __version__
+
+console = Console()
+
+# Constants
+SERVICE_NAME = "clue2app-cli"
+KEYRING_USERNAME = "default"
+POLLING_INTERVAL = 5  # seconds
+MAX_POLLING_ATTEMPTS = 60  # 5 minutes total
+
+# User-Agent string
+USER_AGENT = f"Clue2App-CLI/{__version__} ({platform.system()} {platform.release()})"
+
+
+class AuthenticationError(Exception):
+    """Custom exception for authentication errors."""
+    pass
+
+
+def parse_jwt_token(token: str) -> Dict[str, Any]:
+    """Parse JWT token and extract payload."""
+    try:
+        # Split token into parts
+        parts = token.split('.')
+        if len(parts) != 3:
+            raise ValueError("Invalid JWT token format")
+
+        # Decode payload (second part)
+        payload = parts[1]
+        # Add padding if needed
+        payload += '=' * (4 - len(payload) % 4)
+        # Decode base64
+        decoded = base64.b64decode(payload)
+        # Parse JSON
+        return json.loads(decoded)
+    except Exception as e:
+        raise AuthenticationError(f"Failed to parse JWT token: {e}")
+
+
+def save_user_info(token_data: Dict[str, Any]) -> bool:
+    """Save user information from token data."""
+    try:
+        creds = config.load_credentials()
+        creds.update({
+            "user_id": token_data.get("sub"),
+            "username": token_data.get("username"),
+            "email": token_data.get("email"),
+            "last_login": datetime.now().isoformat()
+        })
+        return config.save_credentials(creds)
+    except Exception:
+        return False
+
+
+class APIClient:
+    """Simple API client for Clue2App authentication."""
+
+    def __init__(self):
+        self.auth_base_url = config.get_config_value("auth.base_url", "https://auth.control.apps.clue2.app")
+        self.auth_version = config.get_config_value("auth.version", "v1")
+        self.auth_timeout = config.get_config_value("auth.timeout", 30)
+        self.console_url = config.get_config_value("auth.console_url", "https://console.control.apps.clue2.app")
+        self.headers = {
+            "User-Agent": USER_AGENT,
+            "Accept": "application/json",
+            "Content-Type": "application/json"
+        }
+
+    def generate_auth_code(self) -> str:
+        """Generate a random authentication code."""
+        return secrets.token_urlsafe(32)
+
+    def start_browser_auth(self, code: str) -> None:
+        """Open browser for authentication."""
+        auth_url = f"{self.console_url}/cli-login?code={code}"
+        webbrowser.open(auth_url)
+
+    def validate_auth_code(self, code: str) -> Optional[str]:
+        """Check if the authentication code has been validated."""
+        try:
+            response = requests.post(
+                f"{self.auth_base_url}/api/auth/validate-cli-code",
+                json={"authCode": code},
+                headers=self.headers,
+                timeout=self.auth_timeout
+            )
+            if response.status_code == 200:
+                return response.text
+            elif response.status_code == 404:
+                return None  # Code not yet validated
+            else:
+                response.raise_for_status()
+        except requests.exceptions.RequestException as e:
+            raise AuthenticationError(f"Code validation failed: {e}")
+
+
+def get_access_token() -> Optional[str]:
+    """Get the current access token from file storage."""
+    try:
+        # Use file-based storage (avoids keyring password prompts)
+        creds = config.load_credentials()
+        return creds.get("access_token")
+    except Exception:
+        return None
+
+
+def save_access_token(token: str) -> bool:
+    """Save access token to file."""
+    try:
+        # Save to credentials file (avoids keyring password prompts)
+        creds = config.load_credentials()
+        creds["access_token"] = token
+        return config.save_credentials(creds)
+    except Exception:
+        return False
+
+
+def clear_access_token() -> bool:
+    """Clear stored access token."""
+    try:
+        # Clear from credentials file
+        creds = config.load_credentials()
+        if "access_token" in creds:
+            del creds["access_token"]
+            config.save_credentials(creds)
+        return config.clear_credentials()
+    except Exception:
+        return False
+
+
+def get_current_user() -> Optional[str]:
+    """Get current logged-in user."""
+    creds = config.load_credentials()
+    return creds.get("username") or creds.get("email")
+
+
+def is_authenticated() -> bool:
+    """Check if user is currently authenticated with a valid (non-expired) token."""
+    token = get_access_token()
+    if not token:
+        return False
+
+    # Check if token is expired
+    try:
+        token_data = parse_jwt_token(token)
+        exp = token_data.get("exp")
+        if exp:
+            import time
+            # Token is expired if exp is in the past
+            if exp < time.time():
+                return False
+    except:
+        # If we can't parse the token, treat as not authenticated
+        return False
+
+    return True
+
+
+@click.group()
+def auth_commands():
+    """Authentication related commands."""
+    pass
+
+
+@auth_commands.command(name="login")
+@click.option('--remember/--no-remember', default=True, help='Remember login credentials')
+def login(remember: bool):
+    """
+    🔐 Login to your Clue2App account
+
+    Authenticate with the Clue2App platform using your browser.
+    Your credentials will be stored securely for future use.
+    """
+    console.print("[bold blue]🔐 Clue2App Login[/bold blue]")
+
+    # Check if already logged in
+    if is_authenticated():
+        current_user = get_current_user()
+        if not Confirm.ask(f"Already logged in as [bold]{current_user}[/bold]. Login as different user?"):
+            console.print("✅ [green]Already authenticated[/green]")
+            return
+
+    # Create API client
+    client = APIClient()
+
+    try:
+        # Generate auth code
+        auth_code = client.generate_auth_code()
+
+        # Open browser for authentication
+        console.print("\n[yellow]Opening your browser for authentication...[/yellow]")
+        client.start_browser_auth(auth_code)
+
+        # Poll for authentication completion
+        console.print("\n[bold green]Waiting for authentication...[/bold green]")
+        console.print("Please complete the authentication in your browser.")
+
+        auth_result = None
+        attempts = 0
+
+        with console.status("[bold blue]Checking authentication status...[/bold blue]", spinner="dots"):
+            while attempts < MAX_POLLING_ATTEMPTS:
+                auth_result = client.validate_auth_code(auth_code)
+                if auth_result:
+                    break
+
+                time.sleep(POLLING_INTERVAL)
+                attempts += 1
+
+        if not auth_result:
+            raise AuthenticationError("Authentication timed out. Please try again.")
+
+        # Parse JWT token and save user info
+        token_data = parse_jwt_token(auth_result)
+
+        # Save authentication data
+        if remember:
+            save_access_token(auth_result)
+            save_user_info(token_data)
+
+        console.print()
+        console.print("✅ [bold green]Login successful![/bold green]")
+
+        # Display user info
+        username = token_data.get("username") or token_data.get("email")
+        if username:
+            console.print(f"   Logged in as: [bold]{username}[/bold]")
+
+        if remember:
+            console.print("   Credentials saved for future use")
+
+    except AuthenticationError as e:
+        console.print()
+        console.print(f"[red]❌ Authentication failed:[/red] {e}")
+        raise click.Abort()
+    except Exception as e:
+        console.print()
+        console.print(f"[red]❌ Login error:[/red] {e}")
+        raise click.Abort()
+
+
+@auth_commands.command(name="logout")
+@click.option('--force', '-f', is_flag=True, help='Force logout without confirmation')
+def logout(force: bool):
+    """
+    🚪 Logout from your Clue2App account
+
+    Sign out and clear stored credentials.
+    """
+    if not is_authenticated():
+        console.print("[yellow]⚠️  Not currently logged in[/yellow]")
+        return
+
+    current_user = get_current_user()
+
+    if not force:
+        if not Confirm.ask(f"Logout from account [bold]{current_user}[/bold]?"):
+            console.print("Logout cancelled")
+            return
+
+    console.print()
+    with console.status("[bold blue]Logging out...[/bold blue]", spinner="dots"):
+        try:
+            # Clear local credentials
+            clear_access_token()
+
+            console.print()
+            console.print("✅ [bold green]Logged out successfully[/bold green]")
+
+        except Exception as e:
+            console.print()
+            console.print(f"[yellow]⚠️  Logout completed (with warnings): {e}[/yellow]")
+
+
+@auth_commands.command(name="status")
+def auth_status():
+    """
+    📊 Show authentication status
+
+    Display current login status and user information.
+    """
+    console.print("[bold blue]🔐 Authentication Status[/bold blue]")
+    console.print()
+
+    if is_authenticated():
+        current_user = get_current_user()
+        creds = config.load_credentials()
+
+        console.print(f"✅ [green]Authenticated[/green] as [bold]{current_user}[/bold]")
+
+        last_login = creds.get("last_login")
+        if last_login:
+            try:
+                login_time = datetime.fromisoformat(last_login)
+                console.print(f"   Last login: {login_time.strftime('%Y-%m-%d %H:%M:%S')}")
+            except ValueError:
+                pass
+
+        # Show token status
+        if get_access_token():
+            console.print("   🔑 [green]Access token[/green]: Available")
+    else:
+        console.print("❌ [red]Not authenticated[/red]")
+        console.print("   Run [bold green]c2a login[/bold green] to authenticate")
+
+
+# Register login and logout as top-level commands too
+@click.command()
+@click.option('--remember/--no-remember', default=True, help='Remember login credentials')
+def login_command(remember: bool):
+    """🔐 Login to your Clue2App account"""
+    login.callback(remember)
+
+
+@click.command()
+@click.option('--force', '-f', is_flag=True, help='Force logout without confirmation')
+def logout_command(force: bool):
+    """🚪 Logout from your Clue2App account"""
+    logout.callback(force)

clue2app_cli/config.py

@@ -0,0 +1,316 @@
+"""
+Configuration management for Clue2App CLI.
+
+Handles configuration file creation, reading, and updating.
+"""
+
+import os
+import json
+import toml
+from pathlib import Path
+from typing import Dict, Any, Optional
+
+import click
+from rich.console import Console
+
+console = Console()
+
+# Configuration file names
+CONFIG_FILE = "config.toml"
+CREDENTIALS_FILE = "credentials.json"
+
+
+def get_config_dir() -> Path:
+    """Get the configuration directory for the CLI."""
+    if os.name == 'nt':  # Windows
+        config_dir = Path(os.environ.get('APPDATA', '~')) / '.c2a'
+    else:  # Unix-like systems
+        config_dir = Path.home() / '.c2a'
+
+    return config_dir
+
+
+def ensure_config_dir() -> Path:
+    """Ensure the configuration directory exists and return its path."""
+    config_dir = get_config_dir()
+    config_dir.mkdir(parents=True, exist_ok=True)
+    return config_dir
+
+
+def get_config_file() -> Path:
+    """Get the path to the configuration file."""
+    return get_config_dir() / CONFIG_FILE
+
+
+def get_credentials_file() -> Path:
+    """Get the path to the credentials file."""
+    return get_config_dir() / CREDENTIALS_FILE
+
+
+def load_config() -> Dict[str, Any]:
+    """Load configuration from file."""
+    config_file = get_config_file()
+
+    if not config_file.exists():
+        return get_default_config()
+
+    try:
+        with open(config_file, 'r') as f:
+            config = toml.load(f)
+        return config
+    except Exception as e:
+        console.print(f"[red]Error loading config:[/red] {e}")
+        return get_default_config()
+
+
+def save_config(config: Dict[str, Any]) -> bool:
+    """Save configuration to file."""
+    try:
+        ensure_config_dir()
+        config_file = get_config_file()
+
+        with open(config_file, 'w') as f:
+            toml.dump(config, f)
+
+        return True
+    except Exception as e:
+        console.print(f"[red]Error saving config:[/red] {e}")
+        return False
+
+
+def get_default_config() -> Dict[str, Any]:
+    """Get default configuration."""
+    return {
+        "api": {
+            "base_url": "https://coordinator.control.apps.clue2.app",
+            "version": "v1",
+            "timeout": 30
+        },
+        "auth": {
+            "base_url": "https://auth.control.apps.clue2.app",
+            "console_url": "https://console.control.apps.clue2.app",
+            "version": "v1",
+            "timeout": 30,
+            "auto_refresh": True,
+            "remember_me": True
+        },
+        "cli": {
+            "output_format": "table",
+            "color": True,
+            "paging": True
+        }
+    }
+
+
+def get_config_value(key: str, default: Any = None) -> Any:
+    """Get a configuration value using dot notation (e.g., 'api.base_url')."""
+    config = load_config()
+
+    keys = key.split('.')
+    value = config
+
+    try:
+        for k in keys:
+            value = value[k]
+        return value
+    except (KeyError, TypeError):
+        return default
+
+
+def set_config_value(key: str, value: Any) -> bool:
+    """Set a configuration value using dot notation."""
+    config = load_config()
+
+    keys = key.split('.')
+    current = config
+
+    # Navigate to the parent of the key we want to set
+    for k in keys[:-1]:
+        if k not in current:
+            current[k] = {}
+        current = current[k]
+
+    # Set the value
+    current[keys[-1]] = value
+
+    return save_config(config)
+
+
+def load_credentials() -> Dict[str, Any]:
+    """Load stored credentials."""
+    creds_file = get_credentials_file()
+
+    if not creds_file.exists():
+        return {}
+
+    try:
+        with open(creds_file, 'r') as f:
+            return json.load(f)
+    except Exception as e:
+        console.print(f"[red]Error loading credentials:[/red] {e}")
+        return {}
+
+
+def save_credentials(credentials: Dict[str, Any]) -> bool:
+    """Save credentials to file."""
+    try:
+        ensure_config_dir()
+        creds_file = get_credentials_file()
+
+        with open(creds_file, 'w') as f:
+            json.dump(credentials, f, indent=2)
+
+        # Set restrictive permissions on credentials file
+        os.chmod(creds_file, 0o600)
+
+        return True
+    except Exception as e:
+        console.print(f"[red]Error saving credentials:[/red] {e}")
+        return False
+
+
+def clear_credentials() -> bool:
+    """Clear stored credentials."""
+    try:
+        creds_file = get_credentials_file()
+        if creds_file.exists():
+            creds_file.unlink()
+        return True
+    except Exception as e:
+        console.print(f"[red]Error clearing credentials:[/red] {e}")
+        return False
+
+
+# Initialize configuration on first import
+def initialize_config():
+    """Initialize configuration with defaults if it doesn't exist."""
+    config_file = get_config_file()
+    if not config_file.exists():
+        default_config = get_default_config()
+        save_config(default_config)
+
+
+# Auto-initialize
+try:
+    initialize_config()
+except Exception:
+    # Silently fail if we can't initialize config
+    pass
+
+
+# Context management for active project
+def get_active_project() -> Optional[Dict[str, Any]]:
+    """Get the currently active/selected project."""
+    return get_config_value("context.project", None)
+
+
+def set_active_project(project_id: str, project_name: str, namespace: str) -> bool:
+    """Set the active project context."""
+    config = load_config()
+    if "context" not in config:
+        config["context"] = {}
+    config["context"]["project"] = {
+        "id": project_id,
+        "name": project_name,
+        "namespace": namespace
+    }
+    return save_config(config)
+
+
+def clear_active_project() -> bool:
+    """Clear the active project context."""
+    config = load_config()
+    if "context" in config and "project" in config["context"]:
+        del config["context"]["project"]
+        return save_config(config)
+    return True
+
+
+class ConfigManager:
+    """
+    Configuration manager class for CLI commands.
+
+    Provides a class-based interface for managing CLI configuration.
+    """
+
+    def __init__(self):
+        """Initialize the ConfigManager."""
+        ensure_config_dir()
+
+    def get_config(self, key: str) -> Any:
+        """
+        Get a configuration value using dot notation.
+
+        Args:
+            key: Configuration key in dot notation (e.g., 'api.base_url')
+
+        Returns:
+            The configuration value, or None if not found
+        """
+        return get_config_value(key)
+
+    def set_config(self, key: str, value: Any) -> bool:
+        """
+        Set a configuration value using dot notation.
+
+        Args:
+            key: Configuration key in dot notation (e.g., 'api.base_url')
+            value: Value to set
+
+        Returns:
+            True if successful, False otherwise
+        """
+        # Try to convert value to appropriate type
+        converted_value = self._convert_value(value)
+        return set_config_value(key, converted_value)
+
+    def reset_config(self) -> bool:
+        """
+        Reset configuration to default values.
+
+        Returns:
+            True if successful, False otherwise
+        """
+        default_config = get_default_config()
+        return save_config(default_config)
+
+    def get_all(self) -> Dict[str, Any]:
+        """
+        Get all configuration values.
+
+        Returns:
+            Dictionary containing all configuration
+        """
+        return load_config()
+
+    def _convert_value(self, value: str) -> Any:
+        """
+        Convert a string value to the appropriate type.
+
+        Args:
+            value: String value to convert
+
+        Returns:
+            Converted value (int, float, bool, or string)
+        """
+        if isinstance(value, str):
+            # Try boolean
+            if value.lower() in ('true', 'yes', '1'):
+                return True
+            if value.lower() in ('false', 'no', '0'):
+                return False
+
+            # Try integer
+            try:
+                return int(value)
+            except ValueError:
+                pass
+
+            # Try float
+            try:
+                return float(value)
+            except ValueError:
+                pass
+
+        # Return as-is
+        return value

clue2app_cli/core_client.py

@@ -0,0 +1,46 @@
+"""Thin HTTP client for talking to the platform's `core` service.
+
+Lets the CLI call core's REST endpoints (creds/scan, services/health,
+images/safety-drift, code/audit, etc.) without needing kubectl on the
+caller's machine. Core does the privileged cluster I/O on the user's
+behalf.
+
+URL resolution:
+  1. `CORE_SERVICE_URL` env var (overrides everything; for staging/dev)
+  2. The default public ingress URL (production)
+
+There's no auth header today because core's read endpoints are open on
+the ingress — same as how the agents call them. Add bearer-token
+support here when core grows authn.
+"""
+from __future__ import annotations
+
+import os
+from typing import Any, Optional
+
+import requests
+
+
+DEFAULT_CORE_URL = "https://core.control.apps.clue2.app"
+
+
+def core_base_url():
+    return os.environ.get("CORE_SERVICE_URL", DEFAULT_CORE_URL).rstrip("/")
+
+
+def core_post(path, body=None, timeout=60.0):
+    """POST JSON to a core endpoint. Returns the decoded response.
+    Raises requests.HTTPError on transport failures or 5xx; 4xx
+    surfaces as a response with the error in the body."""
+    url = core_base_url() + path
+    resp = requests.post(url, json=body or {}, timeout=timeout)
+    resp.raise_for_status()
+    return resp.json()
+
+
+def core_get(path, params=None, timeout=30.0):
+    """GET from a core endpoint. Returns the decoded response."""
+    url = core_base_url() + path
+    resp = requests.get(url, params=params or {}, timeout=timeout)
+    resp.raise_for_status()
+    return resp.json()