dayhoff-tools 1.0.6__tar.gz → 1.0.7__tar.gz

{dayhoff_tools-1.0.6 → dayhoff_tools-1.0.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: dayhoff-tools
-Version: 1.0.6
+Version: 1.0.7
 Summary: Common tools for all the repos at Dayhoff Labs
 Author: Daniel Martin-Alarcon
 Author-email: dma@dayhofflabs.com

{dayhoff_tools-1.0.6 → dayhoff_tools-1.0.7}/dayhoff_tools/cli/cloud_commands.py

@@ -129,19 +129,25 @@ def _get_env_var(variable: str) -> Optional[str]:
 
 # --- GCP Functions ---
 def _is_gcp_user_authenticated() -> bool:
-    """Check if a user is authenticated with GCP (not a compute service account)."""
-    gcloud_path = _find_executable("gcloud")
-    cmd = [
-        gcloud_path,
-        "auth",
-        "list",
-        "--filter=status:ACTIVE",
-        "--format=value(account)",
-    ]
-    _, stdout, _ = _run_command(cmd, capture=True, check=False)
+    """Check if the current gcloud user authentication is valid and non-interactive.
 
-    account = stdout.strip()
-    return bool(account) and "compute@developer.gserviceaccount.com" not in account
+    Returns:
+        True if `gcloud auth print-access-token --quiet` succeeds (exit code 0),
+        False otherwise (indicating potential need for interactive login).
+    """
+    try:
+        gcloud_path = _find_executable("gcloud")
+        # Attempt to get a token silently. If this fails, login is likely expired or needs interaction.
+        returncode, _, _ = _run_command(
+            [gcloud_path, "auth", "print-access-token", "--quiet"],
+            capture=True,  # We don't need the token, just the exit code
+            check=False,  # Don't raise on failure
+            suppress_output=True,  # Hide any potential output/errors from this check
+        )
+        return returncode == 0
+    except FileNotFoundError:
+        # If gcloud isn't found, they are definitely not authenticated.
+        return False
 
 
 def _get_current_gcp_user() -> str:
@@ -350,51 +356,62 @@ def gcp_use_devcon(
     export: bool = typer.Option(
         False, "--export", "-x", help="Print export commands for the current shell."
     ),
-    auth_first: bool = typer.Option(
-        False, "--auth", "-a", help="Authenticate user first if needed."
-    ),
 ):
-    """Switch to devcon service account impersonation mode."""
+    """Configure gcloud CLI to impersonate the devcon SA by setting RC file variables.
+
+    NOTE: This command DOES NOT automatically update Application Default Credentials (ADC).
+    After running this, or after sourcing the export commands, you may need to run:
+    'gcloud auth application-default login --impersonate-service-account=...' manually
+    if you need libraries (like DVC) to use these credentials.
+
+    Ensures the primary user login is valid first to allow potential impersonation.
+    """
     if not _is_gcp_user_authenticated():
-        if auth_first:
-            print(
-                f"{YELLOW}You need to authenticate first. Running authentication...{NC}",
-                file=sys.stderr,
-            )
-            _run_gcloud_login()
-        else:
-            print(
-                f"{RED}Error: Not authenticated with GCP. Run 'dh gcp login' first or use --auth flag.{NC}",
-                file=sys.stderr,
-            )
-            sys.exit(1)
+        print(
+            f"{RED}Error: GCP user authentication is invalid or requires interactive login.{NC}",
+            file=sys.stderr,
+        )
+        print(
+            f"{YELLOW}Please run 'gcloud auth login' interactively first, then try this command again.{NC}",
+            file=sys.stderr,
+        )
+        sys.exit(1)
 
-    # Modify RC files to persist across sessions
+    # Set gcloud CLI impersonation (persisted to RC files)
     _modify_rc_files("CLOUDSDK_AUTH_IMPERSONATE_SERVICE_ACCOUNT", f"'{GCP_DEVCON_SA}'")
-    _modify_rc_files("GOOGLE_IMPERSONATE_SERVICE_ACCOUNT", f"'{GCP_DEVCON_SA}'")
     _modify_rc_files("GOOGLE_CLOUD_PROJECT", f"'{GCP_PROJECT_ID}'")
 
     if export:
-        # Print export commands for the current shell to stdout
+        # Print export commands for the current shell (for gcloud CLI)
         print(f"export CLOUDSDK_AUTH_IMPERSONATE_SERVICE_ACCOUNT='{GCP_DEVCON_SA}'")
-        print(f"export GOOGLE_IMPERSONATE_SERVICE_ACCOUNT='{GCP_DEVCON_SA}'")
         print(f"export GOOGLE_CLOUD_PROJECT='{GCP_PROJECT_ID}'")
 
-        # Print confirmation to stderr so it doesn't affect eval
+        # Print confirmation and instructions for ADC to stderr
         print(
-            f"{GREEN}GCP service account impersonation for '{GCP_DEVCON_SA}' set up successfully.{NC}",
+            f"{GREEN}GCP gcloud CLI impersonation for '{GCP_DEVCON_SA}' exported.{NC}",
             file=sys.stderr,
         )
-        print(f"{GREEN}You now have standard devcon permissions.{NC}", file=sys.stderr)
-    else:
-        # Just print confirmation
         print(
-            f"{GREEN}Switched to devcon service account impersonation. You now have standard devcon permissions.{NC}"
+            f"{YELLOW}NOTE: ADC file not updated by export. To update ADC for libraries, run:{NC}",
+            file=sys.stderr,
         )
         print(
-            f"Changes will take effect in new shell sessions. To apply in current shell, run:"
+            f"{YELLOW}  gcloud auth application-default login --impersonate-service-account={GCP_DEVCON_SA}{NC}",
+            file=sys.stderr,
         )
+    else:
+        # Print confirmation
+        print(
+            f"{GREEN}RC files updated to use devcon SA for future gcloud CLI sessions.{NC}"
+        )
+        print(f"To apply gcloud CLI settings in current shell, run:")
         print(f'  {YELLOW}eval "$(dh gcp use-devcon --export)"{NC}')
+        print(
+            f"{YELLOW}NOTE: ADC file not updated. To update ADC for libraries, run:{NC}"
+        )
+        print(
+            f"{YELLOW}  gcloud auth application-default login --impersonate-service-account={GCP_DEVCON_SA}{NC}"
+        )
 
 
 @gcp_app.command("use-user")
@@ -402,50 +419,60 @@ def gcp_use_user(
     export: bool = typer.Option(
         False, "--export", "-x", help="Print export commands for the current shell."
     ),
-    auth_first: bool = typer.Option(
-        False, "--auth", "-a", help="Authenticate user first if needed."
-    ),
 ):
-    """Switch to personal account mode (no impersonation)."""
+    """Configure gcloud CLI to use the personal user account by setting RC file variables.
+
+    NOTE: This command DOES NOT automatically update Application Default Credentials (ADC).
+    After running this, or after sourcing the export commands, you may need to run:
+    'gcloud auth application-default login' manually
+    if you need libraries (like DVC) to use your personal credentials.
+
+    Ensures the primary user login is valid first.
+    """
     if not _is_gcp_user_authenticated():
-        if auth_first:
-            print(
-                f"{YELLOW}You need to authenticate first. Running authentication...{NC}",
-                file=sys.stderr,
-            )
-            _run_gcloud_login()
-        else:
-            print(
-                f"{RED}Error: Not authenticated with GCP. Run 'dh gcp login' first or use --auth flag.{NC}",
-                file=sys.stderr,
-            )
-            sys.exit(1)
+        print(
+            f"{RED}Error: GCP user authentication is invalid or requires interactive login.{NC}",
+            file=sys.stderr,
+        )
+        print(
+            f"{YELLOW}Please run 'gcloud auth login' interactively first, then try this command again.{NC}",
+            file=sys.stderr,
+        )
+        sys.exit(1)
 
-    # Modify RC files to persist across sessions
+    # Unset gcloud CLI impersonation (persisted to RC files)
     _modify_rc_files("CLOUDSDK_AUTH_IMPERSONATE_SERVICE_ACCOUNT", None)
-    _modify_rc_files("GOOGLE_IMPERSONATE_SERVICE_ACCOUNT", None)
     _modify_rc_files("GOOGLE_CLOUD_PROJECT", f"'{GCP_PROJECT_ID}'")
 
     if export:
-        # Print export commands for the current shell to stdout
+        # Print export commands for the current shell (for gcloud CLI)
         print(f"unset CLOUDSDK_AUTH_IMPERSONATE_SERVICE_ACCOUNT")
-        print(f"unset GOOGLE_IMPERSONATE_SERVICE_ACCOUNT")
         print(f"export GOOGLE_CLOUD_PROJECT='{GCP_PROJECT_ID}'")
 
-        # Print confirmation to stderr so it doesn't affect eval
+        # Print confirmation and instructions for ADC to stderr
         print(
-            f"{GREEN}Switched to personal account mode. You are now using your own permissions.{NC}",
+            f"{GREEN}GCP gcloud CLI impersonation unset and exported.{NC}",
             file=sys.stderr,
         )
-    else:
-        # Just print confirmation
         print(
-            f"{GREEN}Switched to personal account mode. You are now using your own permissions.{NC}"
+            f"{YELLOW}NOTE: ADC file not updated by export. To update ADC for libraries, run:{NC}",
+            file=sys.stderr,
         )
         print(
-            f"Changes will take effect in new shell sessions. To apply in current shell, run:"
+            f"{YELLOW}  gcloud auth application-default login{NC}",
+            file=sys.stderr,
         )
+    else:
+        # Print confirmation
+        print(
+            f"{GREEN}RC files updated to use personal account for future gcloud CLI sessions.{NC}"
+        )
+        print(f"To apply gcloud CLI settings in current shell, run:")
         print(f'  {YELLOW}eval "$(dh gcp use-user --export)"{NC}')
+        print(
+            f"{YELLOW}NOTE: ADC file not updated. To update ADC for libraries, run:{NC}"
+        )
+        print(f"{YELLOW}  gcloud auth application-default login{NC}")
 
 
 # --- AWS Commands ---

{dayhoff_tools-1.0.6 → dayhoff_tools-1.0.7}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "poetry.core.masonry.api"
 
 [project]
 name = "dayhoff-tools"
-version = "1.0.6"
+version = "1.0.7"
 description = "Common tools for all the repos at Dayhoff Labs"
 authors = [
     {name = "Daniel Martin-Alarcon", email = "dma@dayhofflabs.com"}