cmdbsyncer-enterprise 0.1.1__tar.gz

cmdbsyncer_enterprise-0.1.1/PKG-INFO

@@ -0,0 +1,7 @@
+Metadata-Version: 2.4
+Name: cmdbsyncer-enterprise
+Version: 0.1.1
+Summary: Enterprise features for cmdbsyncer (requires license)
+Author-email: Kuhn & Ruess GmbH <info@kuhn-ruess.de>
+Requires-Python: >=3.10
+Requires-Dist: authlib>=1.3

cmdbsyncer_enterprise-0.1.1/README.md

@@ -0,0 +1,250 @@
+# cmdbsyncer-enterprise
+
+Commercial add-on for [cmdbsyncer](https://github.com/Kuhn-Ruess-GmbH/cmdbsyncer)
+by Kuhn & Ruess GmbH. Adds licensed enterprise features to the open-source core
+via a graceful import mechanism — the OSS stays fully functional without this
+package.
+
+## Features
+
+| Feature key        | Description                                              |
+| ------------------ | -------------------------------------------------------- |
+| `remote_user`      | Web-server-provided `REMOTE_USER` single sign-on login   |
+
+Additional features are enabled by the license claims and registered at import
+time. See *Adding a feature* below.
+
+## Architecture
+
+```text
++------------------+       +----------------------------+
+|  cmdbsyncer      |       |  cmdbsyncer_enterprise     |
+|  (OSS)           |       |  (this package)            |
+|                  |       |                            |
+|  application/    |       |  __init__.py               |
+|    enterprise.py |<------+    load_and_verify()       |
+|    run_hook(...) |       |    register_feature(...)   |
++------------------+       +----------------------------+
+                                    ^
+                                    | reads
+                                    |
+                           /etc/cmdbsyncer/license.jwt
+                           (RS256-signed, verified against
+                            embedded public_key.pem)
+```
+
+- The OSS module `application/enterprise.py` imports `cmdbsyncer_enterprise`
+  inside a `try/except ImportError`. If the package is absent, missing a
+  license, or the license is invalid/expired, the import fails silently and
+  all enterprise hooks become no-ops.
+- On a valid license, this package registers each feature listed in the
+  license claims against the OSS hook registry, binding it to its handler.
+- OSS call sites use `run_hook('<feature_name>', ...)`; a missing hook
+  returns `None` and the OSS falls back to its default behaviour.
+
+## Requirements
+
+- Python 3.10+
+- cmdbsyncer OSS installed in the same environment
+- `authlib >= 1.3` (declared as a dependency)
+
+## Installation (customer)
+
+```sh
+pip install cmdbsyncer-enterprise
+```
+
+Place the license file provided by Kuhn & Ruess GmbH at:
+
+```text
+/etc/cmdbsyncer/license.jwt
+```
+
+Or set an alternate path via environment variable:
+
+```sh
+export CMDBSYNCER_LICENSE=/opt/cmdbsyncer/license.jwt
+```
+
+Restart cmdbsyncer. On successful activation you will see a log line like:
+
+```text
+cmdbsyncer-enterprise active (license CUST-2026-001, customer Acme Corp,
+expires 1778284800, features ['remote_user'])
+```
+
+If the log stays silent and enterprise features are inactive, check the
+application log for the `ImportError` message — it will name the exact
+failure (missing file, bad signature, expired).
+
+## Configuration
+
+### `remote_user` feature
+
+Enable it in cmdbsyncer's `local_config.py`:
+
+```python
+REMOTE_USER_LOGIN = True
+```
+
+Your reverse proxy (Apache / nginx / etc.) must authenticate the user and
+set the `REMOTE_USER` WSGI environ variable. Make sure the proxy strips
+any client-supplied value before forwarding the request — otherwise
+anyone could impersonate any user by sending the header directly.
+
+Users matched by `request.remote_user` are resolved against the `name`
+field of the cmdbsyncer user model; disabled users are rejected.
+
+## Development setup (internal)
+
+```sh
+git clone git@github.com:Kuhn-Ruess-GmbH/cmdbsyncer-enterprise.git
+cd cmdbsyncer-enterprise
+
+# Generate the RSA keypair once (keep private_key.pem OUT of the repo):
+openssl genrsa -out private_key.pem 4096
+openssl rsa -in private_key.pem -pubout \
+    -out src/cmdbsyncer_enterprise/public_key.pem
+
+# Install the package editable into the cmdbsyncer venv for testing:
+cd /path/to/cmdbsyncer
+./venv/bin/pip install -e /path/to/cmdbsyncer-enterprise
+```
+
+`private_key.pem` and all `*.jwt` files are `.gitignore`-d. Store the
+private key in the company password manager — it is the root of trust
+for every customer license ever issued.
+
+## Issuing a license
+
+```sh
+./tools/issue_license.py \
+    --customer "Acme Corp" \
+    --license-id CUST-2026-001 \
+    --features remote_user \
+    --days 365 \
+    --private-key ./private_key.pem \
+    --out license.jwt
+```
+
+Claims written into the JWT:
+
+| Claim        | Meaning                                  |
+| ------------ | ---------------------------------------- |
+| `license_id` | Unique identifier for the license        |
+| `customer`   | Customer name (free text)                |
+| `features`   | List of feature keys to enable           |
+| `iat`        | Issued-at (Unix timestamp, UTC)          |
+| `exp`        | Expiry (Unix timestamp, UTC) — enforced  |
+
+Deliver `license.jwt` plus the matching wheel to the customer.
+
+## Building a release wheel
+
+```sh
+make build
+```
+
+The sdist and wheel land in `dist/`. The embedded `public_key.pem` is
+shipped as package data (see `pyproject.toml`).
+
+## Publishing to PyPI
+
+The package itself contains no secrets — only the RSA **public** key is
+shipped. Private key and customer licenses are never part of the wheel,
+so publishing to the public PyPI is safe. Without a matching license
+file the package is a pure no-op.
+
+### One-time setup
+
+1. Create an account on [PyPI](https://pypi.org/account/register/).
+2. Generate an API token at *Account settings → API tokens*. Scope it
+   to the `cmdbsyncer-enterprise` project once it exists; for the very
+   first upload the token must be account-wide.
+3. Copy the token into `./.pypirc` (gitignored, `chmod 600`) by
+   replacing `pypi-REPLACE_WITH_YOUR_TOKEN`:
+
+   ```ini
+   [distutils]
+   index-servers =
+       pypi
+
+   [pypi]
+   username = __token__
+   password = pypi-<your-token>
+   ```
+
+4. Install the publishing tools into the venv:
+
+   ```sh
+   pip install --upgrade build twine
+   ```
+
+### Release procedure
+
+1. Bump `version` in `pyproject.toml` (PyPI refuses re-uploads of an
+   existing version).
+2. Run the full release pipeline:
+
+   ```sh
+   make release
+   ```
+
+   This runs `clean → build → check → upload → tag` and pushes the
+   git tag `v<version>`.
+
+Individual targets are available for partial runs:
+
+```sh
+make build     # sdist + wheel into dist/
+make check     # twine check dist/*
+make upload    # twine upload using ./.pypirc
+make tag       # git tag & push v<version>
+make clean     # remove build artefacts
+make version   # print current version
+```
+
+After publication customers install with:
+
+```sh
+pip install cmdbsyncer-enterprise
+```
+
+and still need their individual `license.jwt` for any feature to
+activate.
+
+## Adding a feature
+
+1. **OSS side** — in cmdbsyncer, add a hook call where the feature belongs:
+
+   ```python
+   from application.enterprise import run_hook
+   result = run_hook('my_feature', arg1, arg2)
+   if result:
+       ...
+   ```
+
+2. **Enterprise side** — implement the handler:
+
+   ```text
+   src/cmdbsyncer_enterprise/<area>/<module>.py
+   ```
+
+3. Wire it into the feature map in
+   `src/cmdbsyncer_enterprise/__init__.py`:
+
+   ```python
+   from .<area>.<module> import my_handler
+
+   _feature_hooks = {
+       'remote_user_login': login_handler,
+       'my_feature': my_handler,
+   }
+   ```
+
+4. Include `my_feature` in the `--features` list when issuing licenses.
+
+## License
+
+Proprietary — Copyright (c) Kuhn & Ruess GmbH. All rights reserved.
+Use requires a valid license agreement.

cmdbsyncer_enterprise-0.1.1/pyproject.toml

@@ -0,0 +1,19 @@
+[build-system]
+requires = ["setuptools>=68", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "cmdbsyncer-enterprise"
+version = "0.1.1"
+description = "Enterprise features for cmdbsyncer (requires license)"
+authors = [{ name = "Kuhn & Ruess GmbH", email = "info@kuhn-ruess.de" }]
+requires-python = ">=3.10"
+dependencies = [
+    "authlib>=1.3",
+]
+
+[tool.setuptools.packages.find]
+where = ["src"]
+
+[tool.setuptools.package-data]
+cmdbsyncer_enterprise = ["public_key.pem"]

cmdbsyncer_enterprise-0.1.1/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

cmdbsyncer_enterprise-0.1.1/src/cmdbsyncer_enterprise/__init__.py

@@ -0,0 +1,35 @@
+"""
+cmdbsyncer enterprise add-on.
+
+On import, verifies the deployed license file and — if valid — registers the
+licensed features with the OSS `application.enterprise` registry. An invalid
+or expired license raises ImportError so the OSS code falls back cleanly.
+"""
+import logging
+
+from application.enterprise import register_feature
+
+from .license import load_and_verify
+from .auth.remote_user import login_handler
+
+log = logging.getLogger(__name__)
+
+_license = load_and_verify()
+
+_feature_hooks = {
+    'remote_user': login_handler,
+}
+
+for _feature in _license.get('features', []):
+    hook = _feature_hooks.get(_feature)
+    register_feature(_feature, hook)
+
+register_feature('license_info', lambda: dict(_license))
+
+log.info(
+    "cmdbsyncer-enterprise active (license %s, customer %s, expires %s, features %s)",
+    _license.get('license_id'),
+    _license.get('customer'),
+    _license.get('exp'),
+    _license.get('features'),
+)

cmdbsyncer_enterprise-0.1.1/src/cmdbsyncer_enterprise/auth/remote_user.py

@@ -0,0 +1,20 @@
+"""
+Remote user login handler.
+
+Invoked by the OSS `auth.views.login` view via the enterprise hook registry.
+Receives the Flask request and returns a matching User instance (or None).
+"""
+from application.models.user import User
+
+
+def login_handler(request):
+    """Look up the user named by `request.remote_user`. Returns User or None."""
+    name = request.remote_user
+    if not name:
+        return None
+
+    user_result = User.objects(name=name, disabled__ne=True)
+    if not user_result:
+        return None
+
+    return user_result[0]

cmdbsyncer_enterprise-0.1.1/src/cmdbsyncer_enterprise/license.py

@@ -0,0 +1,34 @@
+"""
+License loading and verification.
+
+Reads a JWT license file from `CMDBSYNCER_LICENSE` (default:
+`/etc/cmdbsyncer/license.jwt`) and verifies it against the embedded RSA
+public key. Any failure (missing file, bad signature, expired) is raised as
+ImportError so the OSS `application.enterprise` graceful-import path kicks in.
+"""
+import os
+from pathlib import Path
+
+from authlib.jose import jwt, JoseError
+
+_PUBKEY_PATH = Path(__file__).parent / "public_key.pem"
+_DEFAULT_LICENSE_PATH = "/etc/cmdbsyncer/license.jwt"
+
+
+def load_and_verify():
+    """Return verified license claims as a dict, or raise ImportError."""
+    license_path = os.environ.get('CMDBSYNCER_LICENSE', _DEFAULT_LICENSE_PATH)
+
+    try:
+        public_key = _PUBKEY_PATH.read_bytes()
+        token = Path(license_path).read_text(encoding='utf-8').strip()
+    except FileNotFoundError as exp:
+        raise ImportError(f"Enterprise license not found: {exp}") from exp
+
+    try:
+        claims = jwt.decode(token, public_key)
+        claims.validate()
+    except JoseError as exp:
+        raise ImportError(f"Enterprise license invalid: {exp}") from exp
+
+    return dict(claims)

cmdbsyncer_enterprise-0.1.1/src/cmdbsyncer_enterprise/public_key.pem

@@ -0,0 +1,14 @@
+-----BEGIN PUBLIC KEY-----
+MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAqguX90vtqNacdU68nTPB
+hb7Etbh65xB354Bf9igqnHlD5qcACJhSnb6YlruvYcuS555YSzHo+wAeWlASGxpl
+YzQnlk5jfIexJWuEPIBucGYypIrgVot22nQOQIeaXPSXBJpJM7l0b6fNlJeKKkt9
+3brF3p+kG0EmIVQBH9lgSfzyCVDPlGhDFyRmPBcN+5U24OAtzbDOOrUTZCGBHpCx
++BxkEsDigm4eZy4X2Daa+oXM42gd9pJUW9dsJZcX5Chc6umFr4ZyLSS+YWqLtLzJ
+d+25VtJC14OPmm6XC0p3hD0buRDHKc40I7lCxrKH8DS6TWhfp2hwzDOwX+Ks7N6d
+BrfW/07MAQQ6WG8wOeQTklXsNL5POPWGA9okU2/ZXTKygYFcOYcc8Gux9sEBtt92
+2ql49aO3yqtA5KUpXg32c7xPPvyJY7J98d782615/r/JJEWVqhd8Y6bKAU3hDIws
++XWgBikHudMtDg+GyQQ8PToRmeHh96cU3jRZA6vQiyA6ZvcYns6Ok/Y0BYgCpDlX
+Zrv4KJI0n5kdfLYYII4BMAiRyODo8fWj1sZSiBkAYwqQzm8Bix/4D9zRfrSH4z5X
+yg/GPw91MjRhW1OH4PNynjvi0tDtWXPNq6towshuXBcljeFlhwZfSC5dKksFzo6H
+SGFmHhTj3E7urLon5wFrTIMCAwEAAQ==
+-----END PUBLIC KEY-----

cmdbsyncer_enterprise-0.1.1/src/cmdbsyncer_enterprise.egg-info/PKG-INFO

@@ -0,0 +1,7 @@
+Metadata-Version: 2.4
+Name: cmdbsyncer-enterprise
+Version: 0.1.1
+Summary: Enterprise features for cmdbsyncer (requires license)
+Author-email: Kuhn & Ruess GmbH <info@kuhn-ruess.de>
+Requires-Python: >=3.10
+Requires-Dist: authlib>=1.3

cmdbsyncer_enterprise-0.1.1/src/cmdbsyncer_enterprise.egg-info/SOURCES.txt

@@ -0,0 +1,12 @@
+README.md
+pyproject.toml
+src/cmdbsyncer_enterprise/__init__.py
+src/cmdbsyncer_enterprise/license.py
+src/cmdbsyncer_enterprise/public_key.pem
+src/cmdbsyncer_enterprise.egg-info/PKG-INFO
+src/cmdbsyncer_enterprise.egg-info/SOURCES.txt
+src/cmdbsyncer_enterprise.egg-info/dependency_links.txt
+src/cmdbsyncer_enterprise.egg-info/requires.txt
+src/cmdbsyncer_enterprise.egg-info/top_level.txt
+src/cmdbsyncer_enterprise/auth/__init__.py
+src/cmdbsyncer_enterprise/auth/remote_user.py

cmdbsyncer_enterprise-0.1.1/src/cmdbsyncer_enterprise.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

cmdbsyncer_enterprise-0.1.1/src/cmdbsyncer_enterprise.egg-info/requires.txt

@@ -0,0 +1 @@
+authlib>=1.3

cmdbsyncer_enterprise-0.1.1/src/cmdbsyncer_enterprise.egg-info/top_level.txt

@@ -0,0 +1 @@
+cmdbsyncer_enterprise