deployforge 0.1.0__py3-none-any.whl

deployforge/providers/base.py

@@ -0,0 +1,151 @@
+"""Deployment provider abstraction.
+
+All cloud integrations go through :class:`DeploymentProvider`. Every backend
+operation is performed through :class:`HttpClient` so the network layer can be
+mocked cleanly in tests. Providers raise :class:`ProviderError` on failures.
+"""
+
+from __future__ import annotations
+
+import time
+from abc import ABC, abstractmethod
+from dataclasses import dataclass, field
+from typing import Any
+
+import requests
+
+from deployforge.errors import AuthenticationError, ProviderError
+
+DEFAULT_TIMEOUT = 30.0
+
+
+class HttpClient:
+    """Thin wrapper around ``requests`` with typed error handling."""
+
+    def __init__(self, timeout: float = DEFAULT_TIMEOUT) -> None:
+        self.timeout = timeout
+
+    def request(self, method: str, url: str, **kwargs: Any) -> Any:
+        """Perform an HTTP request and return the parsed JSON body.
+
+        Raises :class:`ProviderError` for HTTP errors and transport failures.
+        """
+        try:
+            response = requests.request(method, url, timeout=self.timeout, **kwargs)
+        except requests.RequestException as exc:
+            raise ProviderError(f"Network error while contacting {url}: {exc}") from exc
+
+        if response.status_code in (401, 403):
+            raise AuthenticationError(
+                f"Authentication failed for {url.split('/')[2]}. "
+                "Check your API token or run 'deployforge doctor'."
+            )
+        if response.status_code >= 400:
+            detail = _error_detail(response)
+            message = f"HTTP {response.status_code} from {url}: {detail}"
+            raise ProviderError(message, status_code=response.status_code)
+        if response.status_code == 204 or not response.text:
+            return None
+        try:
+            return response.json()
+        except ValueError as exc:
+            raise ProviderError(f"Invalid JSON response from {url}") from exc
+
+
+def _error_detail(response: requests.Response) -> str:
+    try:
+        data = response.json()
+    except ValueError:
+        return response.text[:300]
+    if isinstance(data, dict):
+        message = data.get("message") or data.get("error") or data.get("detail")
+        if isinstance(message, str) and message:
+            return message[:300]
+    return response.text[:300]
+
+
+@dataclass
+class AuthInfo:
+    authenticated: bool
+    provider: str
+    account: str | None = None
+    source: str = "env"
+
+    def describe(self) -> str:
+        if self.authenticated:
+            return f"{self.provider} authenticated"
+        return f"{self.provider} not authenticated"
+
+
+@dataclass
+class DeploymentResult:
+    provider: str
+    project_name: str
+    service_id: str
+    url: str | None = None
+    status: str = "created"
+    extra: dict[str, Any] = field(default_factory=dict)
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "provider": self.provider,
+            "project_name": self.project_name,
+            "service_id": self.service_id,
+            "url": self.url,
+            "status": self.status,
+        }
+
+
+@dataclass
+class DeployStatus:
+    provider: str
+    state: str
+    url: str | None
+    message: str | None = None
+
+
+class DeploymentProvider(ABC):
+    """Interface every deployment provider must implement."""
+
+    name: str = "abstract"
+
+    def __init__(self, client: HttpClient | None = None) -> None:
+        self.http = client or HttpClient()
+
+    @abstractmethod
+    def authenticate(self) -> AuthInfo: ...
+
+    @abstractmethod
+    def create_project(self, *, name: str, **kwargs: Any) -> DeploymentResult: ...
+
+    @abstractmethod
+    def deploy(self, project: DeploymentResult, *, ref: str | None = None) -> DeploymentResult: ...
+
+    @abstractmethod
+    def get_status(self, project: DeploymentResult) -> DeployStatus: ...
+
+    @abstractmethod
+    def get_url(self, project: DeploymentResult) -> str | None: ...
+
+    @abstractmethod
+    def get_logs(self, project: DeploymentResult) -> list[str]: ...
+
+    def set_env(self, project: DeploymentResult, key: str, value: str) -> None:
+        raise ProviderError(f"{self.name} does not support setting environment variables.")
+
+    def poll_until_ready(
+        self,
+        project: DeploymentResult,
+        timeout: int = 900,
+        interval: float = 8.0,
+        on_progress: Any | None = None,
+    ) -> DeployStatus:
+        deadline = time.monotonic() + timeout
+        while time.monotonic() < deadline:
+            status = self.get_status(project)
+            if on_progress is not None:
+                on_progress(status)
+            if status.state in {"ready", "error", "canceled"}:
+                return status
+            time.sleep(interval)
+        return self.get_status(project)

deployforge/providers/render.py

@@ -0,0 +1,218 @@
+"""Render deployment provider.
+
+Uses the documented Render REST API (https://api.render.com). Web services
+are created and polled through official endpoints. Deploys with ``autoDeploy``
+so future GitHub pushes redeploy automatically.
+"""
+
+from __future__ import annotations
+
+from typing import Any
+
+from deployforge.errors import ProviderError
+from deployforge.providers.base import (
+    AuthInfo,
+    DeploymentProvider,
+    DeploymentResult,
+    DeployStatus,
+    HttpClient,
+)
+
+API_BASE = "https://api.render.com/v1"
+
+RENDER_ENV_MAP = {
+    "python": "python3",
+    "node": "node",
+}
+
+_LIVE_STATES = {"Live", "live"}
+_BUILD_STATES = {"Build in progress", "Provisioning", "Pending", "Scheduled", "Deploying"}
+_ERROR_STATES = {"Deploy failed", "Build failed", "Canceled", "Canceled and rollback"}
+
+
+class RenderProvider(DeploymentProvider):
+    name = "render"
+
+    def __init__(self, api_key: str | None, client: HttpClient | None = None) -> None:
+        super().__init__(client)
+        self.api_key = api_key
+        self._owner_id: str | None = None
+
+    def _headers(self) -> dict[str, str]:
+        if not self.api_key:
+            raise ProviderError(
+                "Render authentication is missing. Set RENDER_API_KEY or run 'deployforge config'."
+            )
+        return {"Authorization": f"Bearer {self.api_key}", "Accept": "application/json"}
+
+    def _get_owner_id(self) -> str:
+        if self._owner_id:
+            return self._owner_id
+        data = self.http.request("GET", f"{API_BASE}/owners", headers=self._headers())
+        if not isinstance(data, list) or not data:
+            raise ProviderError("Render returned no owners; check your API key.")
+        owner = data[0]
+        if not isinstance(owner, dict) or not owner.get("id"):
+            raise ProviderError("Render returned an unexpected owner object.")
+        self._owner_id = str(owner["id"])
+        return self._owner_id
+
+    def authenticate(self) -> AuthInfo:
+        if not self.api_key:
+            return AuthInfo(authenticated=False, provider="render")
+        try:
+            data = self.http.request("GET", f"{API_BASE}/owners", headers=self._headers())
+        except ProviderError:
+            return AuthInfo(authenticated=False, provider="render")
+        if isinstance(data, list) and data:
+            account = None
+            owner = data[0]
+            if isinstance(owner, dict) and isinstance(owner.get("name"), str):
+                account = owner["name"]
+            return AuthInfo(authenticated=True, provider="render", account=account)
+        return AuthInfo(authenticated=False, provider="render")
+
+    def create_project(
+        self,
+        *,
+        name: str,
+        repo: str | None = None,
+        runtime: str | None = None,
+        root_directory: str | None = None,
+        build_command: str | None = None,
+        start_command: str | None = None,
+        plan: str = "starter",
+        branch: str = "main",
+        health_check_path: str | None = None,
+        **kwargs: Any,
+    ) -> DeploymentResult:
+        if not repo or not runtime:
+            raise ProviderError("Render requires a repository and runtime to deploy.")
+        owner_id = self._get_owner_id()
+        payload: dict[str, Any] = {
+            "type": "web_service",
+            "name": name,
+            "env": RENDER_ENV_MAP.get(runtime, runtime),
+            "plan": plan,
+            "repo": repo,
+            "branch": branch,
+            "autoDeploy": True,
+        }
+        if root_directory and root_directory not in (".", ""):
+            payload["rootDir"] = root_directory
+        if build_command:
+            payload["buildCommand"] = build_command
+        if start_command:
+            payload["startCommand"] = start_command
+        if health_check_path:
+            payload["healthCheckPath"] = health_check_path
+        data = self.http.request(
+            "POST",
+            f"{API_BASE}/services?ownerId={owner_id}",
+            headers=self._headers(),
+            json=payload,
+        )
+        if not isinstance(data, dict) or not data.get("id"):
+            raise ProviderError("Render did not return a service id.")
+        service_id = str(data["id"])
+        url = None
+        details = data.get("serviceDetails")
+        if isinstance(details, dict) and isinstance(details.get("url"), str):
+            url = details["url"]
+        return DeploymentResult(
+            provider="render",
+            project_name=str(data.get("name") or name),
+            service_id=service_id,
+            url=url,
+            status="created",
+            extra={"owner_id": owner_id},
+        )
+
+    def set_env(self, project: DeploymentResult, key: str, value: str) -> None:
+        payload = {"envVars": [{"key": key, "value": value}]}
+        self.http.request(
+            "PUT",
+            f"{API_BASE}/services/{project.service_id}/env-vars",
+            headers=self._headers(),
+            json=payload,
+        )
+
+    def deploy(self, project: DeploymentResult, *, ref: str | None = None) -> DeploymentResult:
+        # Render deploys automatically on push when autoDeploy is enabled.
+        # Pushing the branch or triggering via service is handled by Render.
+        status = self.get_status(project)
+        return DeploymentResult(
+            provider="render",
+            project_name=project.project_name,
+            service_id=project.service_id,
+            url=status.url,
+            status=status.state,
+            extra=project.extra,
+        )
+
+    def get_status(self, project: DeploymentResult) -> DeployStatus:
+        data = self.http.request(
+            "GET",
+            f"{API_BASE}/services/{project.service_id}",
+            headers=self._headers(),
+        )
+        if not isinstance(data, dict):
+            raise ProviderError("Render returned an unexpected service response.")
+        url = None
+        details = data.get("serviceDetails")
+        if isinstance(details, dict) and isinstance(details.get("url"), str):
+            url = details["url"]
+
+        deploys = self.http.request(
+            "GET",
+            f"{API_BASE}/services/{project.service_id}/deploys",
+            headers=self._headers(),
+        )
+        latest_status = "Live"
+        if isinstance(deploys, list) and deploys:
+            first = deploys[0]
+            if isinstance(first, dict):
+                latest_status = str(first.get("status") or "Live")
+
+        if latest_status in _LIVE_STATES:
+            return DeployStatus(provider="render", state="ready", url=url)
+        if latest_status in _ERROR_STATES:
+            message = None
+            if isinstance(deploys, list) and deploys and isinstance(deploys[0], dict):
+                message = (
+                    deploys[0].get("commit", {}).get("message")
+                    if isinstance(deploys[0].get("commit"), dict)
+                    else None
+                )
+            return DeployStatus(
+                provider="render", state="error", url=url, message=message or latest_status
+            )
+        return DeployStatus(provider="render", state="building", url=url)
+
+    def get_url(self, project: DeploymentResult) -> str | None:
+        return self.get_status(project).url
+
+    def get_logs(self, project: DeploymentResult) -> list[str]:
+        deploys = self.http.request(
+            "GET",
+            f"{API_BASE}/services/{project.service_id}/deploys",
+            headers=self._headers(),
+        )
+        logs: list[str] = []
+        if not isinstance(deploys, list):
+            return logs
+        for deploy in deploys[:10]:
+            if not isinstance(deploy, dict):
+                continue
+            commit = deploy.get("commit")
+            message = None
+            if isinstance(commit, dict):
+                message = commit.get("message")
+                ref = commit.get("id", "unknown")[:9]
+            else:
+                ref = "n/a"
+            line = f"[{deploy.get('status')}] ref {ref}"
+            if isinstance(message, str) and message:
+                line += f" — {message[:80]}"
+            logs.append(line)
+        return logs

deployforge/providers/vercel.py

@@ -0,0 +1,205 @@
+"""Vercel deployment provider.
+
+Uses the documented Vercel REST API (https://api.vercel.com). Frameworks and
+git repositories are connected through official project/deployment endpoints.
+"""
+
+from __future__ import annotations
+
+from typing import Any
+
+from deployforge.errors import ProviderError
+from deployforge.providers.base import (
+    AuthInfo,
+    DeploymentProvider,
+    DeploymentResult,
+    DeployStatus,
+    HttpClient,
+)
+
+API_BASE = "https://api.vercel.com"
+
+# Vercel preset names for supported frameworks.
+FRAMEWORK_PRESETS: dict[str, str | None] = {
+    "Next.js": "nextjs",
+    "React": "create-react-app",
+    "Vite": "vite",
+    "Vue": "vue",
+    "Nuxt": "nuxtjs",
+    "Angular": "angular",
+    "Astro": "astro",
+    "Svelte": "svelte",
+    "SvelteKit": "sveltekit",
+    "Static HTML": None,
+}
+
+_STATE_READY = {"READY"}
+_STATE_ERROR = {"ERROR", "ERROR_BUILD", "ERROR_DEPLOYMENT", "ERROR_INSPECTOR_BLOCKED"}
+
+
+class VercelProvider(DeploymentProvider):
+    name = "vercel"
+
+    def __init__(self, token: str | None, client: HttpClient | None = None) -> None:
+        super().__init__(client)
+        self.token = token
+
+    # -- HTTP helpers -------------------------------------------------------
+
+    def _headers(self) -> dict[str, str]:
+        if not self.token:
+            raise ProviderError(
+                "Vercel authentication is missing. Set VERCEL_TOKEN or run 'deployforge config'."
+            )
+        return {
+            "Authorization": f"Bearer {self.token}",
+            "Accept": "application/json",
+        }
+
+    # -- DeploymentProvider -------------------------------------------------
+
+    def authenticate(self) -> AuthInfo:
+        if not self.token:
+            return AuthInfo(authenticated=False, provider="vercel")
+        data = self.http.request("GET", f"{API_BASE}/v2/user", headers=self._headers())
+        user = data.get("user") if isinstance(data, dict) else None
+        account = user.get("username") if isinstance(user, dict) else None
+        return AuthInfo(authenticated=True, provider="vercel", account=account)
+
+    def create_project(
+        self,
+        *,
+        name: str,
+        repo: str | None = None,
+        directory: str | None = None,
+        framework: str | None = None,
+        private: bool = True,
+        **kwargs: Any,
+    ) -> DeploymentResult:
+        if not repo:
+            raise ProviderError("Vercel requires a GitHub repository to deploy.")
+        payload: dict[str, Any] = {
+            "name": name,
+            "gitRepository": {"type": "github", "repo": repo},
+            "public": not private,
+        }
+        preset = FRAMEWORK_PRESETS.get(framework or "", framework)
+        if preset:
+            payload["framework"] = preset
+        if directory and directory not in (".", ""):
+            payload["rootDirectory"] = directory
+
+        data = self.http.request(
+            "POST",
+            f"{API_BASE}/v10/projects",
+            headers=self._headers(),
+            json=payload,
+        )
+        if not isinstance(data, dict):
+            msg = "Vercel returned an unexpected response while creating the project."
+            raise ProviderError(msg)
+        project_id = str(data.get("id") or "")
+        project_name = str(data.get("name") or name)
+        if not project_id:
+            raise ProviderError("Vercel did not return a project id.")
+        return DeploymentResult(
+            provider="vercel",
+            project_name=project_name,
+            service_id=project_id,
+            status="created",
+            extra={"framework": framework},
+        )
+
+    def set_env(self, project: DeploymentResult, key: str, value: str) -> None:
+        payload = {
+            "key": key,
+            "value": value,
+            "target": ["production", "preview", "development"],
+            "type": "encrypted",
+        }
+        self.http.request(
+            "POST",
+            f"{API_BASE}/v10/projects/{project.service_id}/env",
+            headers=self._headers(),
+            json=payload,
+        )
+
+    def deploy(self, project: DeploymentResult, *, ref: str | None = None) -> DeploymentResult:
+        payload: dict[str, Any] = {
+            "name": project.project_name,
+            "target": "production",
+            "gitSource": {"type": "github", "ref": ref or "main"},
+        }
+        try:
+            data = self.http.request(
+                "POST",
+                f"{API_BASE}/v13/deployments",
+                headers=self._headers(),
+                json=payload,
+            )
+        except ProviderError:
+            # With a git-connected project, a push triggers deployment
+            # automatically; we re-check the project for an active deployment.
+            return project
+        if not isinstance(data, dict):
+            return project
+        deployment_id = str(data.get("id") or "") or project.service_id
+        return DeploymentResult(
+            provider="vercel",
+            project_name=project.project_name,
+            service_id=deployment_id,
+            status="building",
+            extra=project.extra,
+        )
+
+    def get_status(self, project: DeploymentResult) -> DeployStatus:
+        data = self.http.request(
+            "GET",
+            f"{API_BASE}/v13/deployments/{project.service_id}",
+            headers=self._headers(),
+        )
+        if not isinstance(data, dict):
+            raise ProviderError("Vercel returned an unexpected deployment status.")
+        state = str(data.get("readyState") or data.get("state") or "QUEUED")
+        if state in _STATE_READY:
+            url = self._url_from_deployment(data)
+            return DeployStatus(provider="vercel", state="ready", url=url)
+        if state in _STATE_ERROR:
+            return DeployStatus(
+                provider="vercel",
+                state="error",
+                url=None,
+                message=f"Vercel deployment failed ({state}).",
+            )
+        return DeployStatus(provider="vercel", state="building", url=None)
+
+    @staticmethod
+    def _url_from_deployment(data: dict[str, Any]) -> str | None:
+        aliases = data.get("alias")
+        if isinstance(aliases, list) and aliases and isinstance(aliases[0], str):
+            return f"https://{aliases[0]}"
+        url = data.get("url")
+        if isinstance(url, str) and url:
+            return f"https://{url}"
+        return None
+
+    def get_url(self, project: DeploymentResult) -> str | None:
+        status = self.get_status(project)
+        return status.url
+
+    def get_logs(self, project: DeploymentResult) -> list[str]:
+        data = self.http.request(
+            "GET",
+            f"{API_BASE}/v13/deployments/{project.service_id}",
+            headers=self._headers(),
+        )
+        if not isinstance(data, dict):
+            return []
+        logs: list[str] = []
+        if data.get("createdAt"):
+            logs.append(f"Deployment created (id {project.service_id})")
+        if data.get("readyState"):
+            logs.append(f"State: {data['readyState']}")
+        if data.get("errorMessage"):
+            logs.append(f"Error: {data['errorMessage']}")
+        return logs

deployforge/security/__init__.py

@@ -0,0 +1,4 @@
+from deployforge.security.scanner import SecurityReport, scan_project
+from deployforge.security.secrets import Finding, fingerprint
+
+__all__ = ["Finding", "SecurityReport", "fingerprint", "scan_project"]

deployforge/security/gitignore.py

@@ -0,0 +1,35 @@
+"""Gitignore validation.
+
+Checks that a project's ``.gitignore`` covers the most sensitive file kinds so
+the security gate can report drift before a deployment.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+REQUIRED_RULES = (
+    ".env*",
+    "*.pem",
+    "*.key",
+    "credentials.json",
+    "service-account.json",
+)
+
+
+def validate_gitignore(root: Path) -> tuple[bool, list[str]]:
+    """Return (ok, missing_rules) for the project's ``.gitignore``."""
+    gitignore = root / ".gitignore"
+    if not gitignore.exists():
+        return True, []
+    try:
+        lines = [line.strip() for line in gitignore.read_text(encoding="utf-8").splitlines()]
+    except OSError:
+        return True, []
+    present = {line for line in lines if line and not line.startswith("#")}
+    missing = [rule for rule in REQUIRED_RULES if not any(_matches(rule, line) for line in present)]
+    return not missing, missing
+
+
+def _matches(rule: str, line: str) -> bool:
+    return line.endswith(rule) or line == rule