devnomads-cli 0.11.2__tar.gz → 0.12.0__tar.gz

{devnomads_cli-0.11.2 → devnomads_cli-0.12.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devnomads-cli
-Version: 0.11.2
+Version: 0.12.0
 Summary: Manage your DevNomads services from the command line
 Author-email: DevNomads <support@devnomads.nl>
 License: MIT
@@ -245,9 +245,9 @@ DNS-01 challenge records would not be visible to the CA.
 
 The certificate is always written to `~/.config/dncli/certs/<domain>/`
 as `cert.pem`, `fullchain.pem`, `chain.pem`, and `privkey.pem` (0600).
-Pass `--out <file>` to additionally export a single PEM bundle of
-exactly three blocks - the key, the certificate, and the issuing
-intermediate, in that order. Add `-v`/`--verbose` for detailed ACME
+Pass `--out <file>` to additionally export a single PEM bundle of the
+key, the certificate, and the full chain (intermediate plus any
+cross-signed roots), in that order. Add `-v`/`--verbose` for detailed ACME
 progress.
 
 Keys are ECDSA P-384 by default. Pick another with `--key-type`
@@ -289,8 +289,11 @@ dncli certs export example.com --format pfx --out bundle.pfx --passphrase secret
 ```
 
 The `.pfx` is unencrypted unless you pass `--passphrase` (alias
-`--password`). Both bundle formats carry the same three items: key,
-certificate, and the issuing intermediate.
+`--password`). Both bundle formats carry the same items: key,
+certificate, and the full chain. The chain includes the cross-signs:
+with Let's Encrypt's current hierarchy the path to a trusted root runs
+through the intermediate (e.g. YE2), Root YE (cross-signed by ISRG
+Root X2) and ISRG Root X2 (cross-signed by ISRG Root X1).
 
 `dncli certs delete <domain>` removes a stored certificate and its
 private key from disk (after confirmation; `--yes` skips it). By

{devnomads_cli-0.11.2 → devnomads_cli-0.12.0}/README.md

@@ -229,9 +229,9 @@ DNS-01 challenge records would not be visible to the CA.
 
 The certificate is always written to `~/.config/dncli/certs/<domain>/`
 as `cert.pem`, `fullchain.pem`, `chain.pem`, and `privkey.pem` (0600).
-Pass `--out <file>` to additionally export a single PEM bundle of
-exactly three blocks - the key, the certificate, and the issuing
-intermediate, in that order. Add `-v`/`--verbose` for detailed ACME
+Pass `--out <file>` to additionally export a single PEM bundle of the
+key, the certificate, and the full chain (intermediate plus any
+cross-signed roots), in that order. Add `-v`/`--verbose` for detailed ACME
 progress.
 
 Keys are ECDSA P-384 by default. Pick another with `--key-type`
@@ -273,8 +273,11 @@ dncli certs export example.com --format pfx --out bundle.pfx --passphrase secret
 ```
 
 The `.pfx` is unencrypted unless you pass `--passphrase` (alias
-`--password`). Both bundle formats carry the same three items: key,
-certificate, and the issuing intermediate.
+`--password`). Both bundle formats carry the same items: key,
+certificate, and the full chain. The chain includes the cross-signs:
+with Let's Encrypt's current hierarchy the path to a trusted root runs
+through the intermediate (e.g. YE2), Root YE (cross-signed by ISRG
+Root X2) and ISRG Root X2 (cross-signed by ISRG Root X1).
 
 `dncli certs delete <domain>` removes a stored certificate and its
 private key from disk (after confirmation; `--yes` skips it). By

{devnomads_cli-0.11.2 → devnomads_cli-0.12.0}/devnomads_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devnomads-cli
-Version: 0.11.2
+Version: 0.12.0
 Summary: Manage your DevNomads services from the command line
 Author-email: DevNomads <support@devnomads.nl>
 License: MIT
@@ -245,9 +245,9 @@ DNS-01 challenge records would not be visible to the CA.
 
 The certificate is always written to `~/.config/dncli/certs/<domain>/`
 as `cert.pem`, `fullchain.pem`, `chain.pem`, and `privkey.pem` (0600).
-Pass `--out <file>` to additionally export a single PEM bundle of
-exactly three blocks - the key, the certificate, and the issuing
-intermediate, in that order. Add `-v`/`--verbose` for detailed ACME
+Pass `--out <file>` to additionally export a single PEM bundle of the
+key, the certificate, and the full chain (intermediate plus any
+cross-signed roots), in that order. Add `-v`/`--verbose` for detailed ACME
 progress.
 
 Keys are ECDSA P-384 by default. Pick another with `--key-type`
@@ -289,8 +289,11 @@ dncli certs export example.com --format pfx --out bundle.pfx --passphrase secret
 ```
 
 The `.pfx` is unencrypted unless you pass `--passphrase` (alias
-`--password`). Both bundle formats carry the same three items: key,
-certificate, and the issuing intermediate.
+`--password`). Both bundle formats carry the same items: key,
+certificate, and the full chain. The chain includes the cross-signs:
+with Let's Encrypt's current hierarchy the path to a trusted root runs
+through the intermediate (e.g. YE2), Root YE (cross-signed by ISRG
+Root X2) and ISRG Root X2 (cross-signed by ISRG Root X1).
 
 `dncli certs delete <domain>` removes a stored certificate and its
 private key from disk (after confirmation; `--yes` skips it). By

{devnomads_cli-0.11.2 → devnomads_cli-0.12.0}/dncli.py

@@ -43,6 +43,7 @@ from pathlib import Path
 from typing import (
     Annotated,
     Any,
+    Callable,
     ContextManager,
     Iterable,
     Literal,
@@ -64,7 +65,7 @@ from rich.markup import escape
 from rich.table import Table
 from typer.core import TyperGroup
 
-__version__ = "0.11.2"
+__version__ = "0.12.0"
 
 # Distribution names, for reporting versions via `dncli version`.
 CLI_PACKAGE = "devnomads-cli"
@@ -268,13 +269,28 @@ def devnomads_profiles(parser: configparser.ConfigParser) -> list[str]:
     return [section for section in parser.sections() if ":" not in section]
 
 
-def resolve_credentials(state: AppState) -> tuple[str, str]:
-    """Resolve (api_key, api_url): flag > env > profile > [default]."""
+def _profile_section(
+    state: AppState,
+) -> tuple[configparser.ConfigParser, str, configparser.SectionProxy | None]:
+    """The credentials, the active profile name and its section (if any)."""
 
     parser = load_credentials()
     profile = state.profile or os.environ.get(ENV_PROFILE) or DEFAULT_PROFILE
+    return parser, profile, parser[profile] if parser.has_section(profile) else None
+
+
+def resolve_api_url(state: AppState) -> str:
+    """The API URL of the active profile; no API key needed."""
+
+    _, _, section = _profile_section(state)
+    return section.get("api_url", DEFAULT_API_URL) if section else DEFAULT_API_URL
+
+
+def resolve_credentials(state: AppState) -> tuple[str, str]:
+    """Resolve (api_key, api_url): flag > env > profile > [default]."""
+
+    parser, profile, section = _profile_section(state)
     explicit = bool(state.profile or os.environ.get(ENV_PROFILE))
-    section = parser[profile] if parser.has_section(profile) else None
     api_url = section.get("api_url", DEFAULT_API_URL) if section else DEFAULT_API_URL
     api_key = (
         state.api_key
@@ -703,6 +719,7 @@ class DevNomadsClient:
 
     def __init__(self, api_url: str, api_key: str, *, debug: bool = False) -> None:
         self.debug = debug
+        self.api_url = api_url
         self._client = ApiClient(
             api_url,
             api_key,
@@ -775,7 +792,7 @@ class DevNomadsClient:
             response = self._client.send(
                 method, path, params=params, json_body=json_body, timeout=timeout
             )
-        check_api_version(response.headers.get("x-api-version"))
+        check_api_version(response.headers.get("x-api-version"), self.api_url)
         return response
 
 
@@ -802,19 +819,35 @@ def _error_message(status: int, detail: str) -> str:
 
 
 _api_version_warned = False
+_api_spec_checked = False
 
 
-def check_api_version(reported: str | None) -> None:
-    """Warn once per run when the API's major version (X-Api-Version header)
-    differs from the one this dncli was generated for: commands may then
-    send or expect the wrong fields. Silent while the API sends no header."""
+def _api_compatible(have: tuple[int, int, int], built: tuple[int, int, int]) -> bool:
+    """Same major version. Before 1.0 the minor version counts as the major
+    one, as in semver: a 0.x API may change anything in a minor release."""
 
-    global _api_version_warned
+    size = 2 if built[0] == 0 else 1
+    return have[:size] == built[:size]
+
+
+def check_api_version(reported: str | None, api_url: str | None = None) -> None:
+    """Warn once per run when the API's version is incompatible with the one
+    this dncli was generated for: commands may then send or expect the wrong
+    fields. The API's version comes from its X-Api-Version header; while it
+    sends none, from the cached version of its OpenAPI spec (see
+    cached_api_version)."""
+
+    global _api_version_warned, _api_spec_checked
+    if _api_version_warned:
+        return
+    if reported is None and api_url is not None and not _api_spec_checked:
+        _api_spec_checked = True
+        reported = cached_api_version(api_url)
     have, built = _version_tuple(reported), _version_tuple(API_VERSION)
-    if _api_version_warned or have is None or built is None or have[0] == built[0]:
+    if have is None or built is None or _api_compatible(have, built):
         return
     _api_version_warned = True
-    if have[0] > built[0]:
+    if have > built:
         advice = f"update dncli: {upgrade_command()}"
     else:
         advice = "this dncli is newer than the API; some commands may fail"
@@ -1431,9 +1464,16 @@ def version_cmd(
     output: OutputOption = None,
     columns: ColumnsOption = None,
 ) -> None:
-    """Show the dncli and devnomads library versions."""
+    """Show the dncli and devnomads library versions, and the API version
+    dncli was built for next to the one the API runs."""
 
-    render(state_from(ctx, output, columns), _versions())
+    state = state_from(ctx, output, columns)
+    api_url = resolve_api_url(state)
+    api = api_spec_version(api_url)
+    if api is not None:
+        remember_api_version(api_url, api)
+    versions = {**_versions(), "api-built-for": API_VERSION}
+    render(state, {**versions, "api": api or "unreachable"})
 
 
 @app.command("upgrade")
@@ -2317,26 +2357,34 @@ def _write_cert_files(
         (out_dir / name).write_text(content)
 
 
-def _first_cert(pem: str) -> str:
-    """The first PEM certificate block in ``pem`` (the issuing intermediate
-    of a chain), or "" if there is none."""
+def _pem_certs(pem: str) -> list[str]:
+    """Every PEM certificate block in ``pem``, in order, each ending in a
+    single newline. Whatever sits between blocks - such as the blank line
+    Let's Encrypt puts between the certificates of a chain - is dropped."""
 
     begin = "-----BEGIN CERTIFICATE-----"
     end = "-----END CERTIFICATE-----"
+    certs = []
     start = pem.find(begin)
-    if start == -1:
-        return ""
-    stop = pem.find(end, start)
-    if stop == -1:
-        return ""
-    return pem[start : stop + len(end)] + "\n"
+    while start != -1:
+        stop = pem.find(end, start)
+        if stop == -1:
+            break
+        certs.append(pem[start : stop + len(end)] + "\n")
+        start = pem.find(begin, stop)
+    return certs
 
 
 def _combined_pem(privkey: str, leaf: str, chain: str) -> str:
-    """One PEM bundle of exactly three blocks: key, then leaf certificate,
-    then the single issuing intermediate (the rest of the chain is dropped)."""
+    """One PEM bundle: key, then leaf certificate, then the whole chain.
+
+    The chain is kept intact, cross-signs included: with the ISRG "gen-Y"
+    hierarchy the path to a trusted root runs through YE2, Root YE
+    (cross-signed by ISRG Root X2) and ISRG Root X2 (cross-signed by
+    ISRG Root X1), and a bundle with only the issuing intermediate
+    verifies nowhere."""
 
-    parts = [privkey, leaf, _first_cert(chain)]
+    parts = [privkey, leaf, *_pem_certs(chain)]
     return "".join(p if p.endswith("\n") else p + "\n" for p in parts if p)
 
 
@@ -2355,7 +2403,7 @@ def _export_pkcs12(
     name: str,
     passphrase: str | None = None,
 ) -> None:
-    """Write a PKCS#12 (.pfx) bundle of key + leaf + single intermediate at
+    """Write a PKCS#12 (.pfx) bundle of key + leaf + the whole chain at
     0600. Unencrypted unless ``passphrase`` is given."""
 
     from cryptography import x509
@@ -2366,12 +2414,7 @@ def _export_pkcs12(
     try:
         key = serialization.load_pem_private_key(privkey.encode(), password=None)
         cert = x509.load_pem_x509_certificate(leaf.encode())
-        intermediate = _first_cert(chain)
-        cas = (
-            [x509.load_pem_x509_certificate(intermediate.encode())]
-            if intermediate
-            else None
-        )
+        cas = [x509.load_pem_x509_certificate(c.encode()) for c in _pem_certs(chain)]
     except ValueError as exc:
         raise CliError(f"could not read stored certificate files: {exc}") from exc
     if not isinstance(key, (rsa.RSAPrivateKey, ec.EllipticCurvePrivateKey)):
@@ -2624,7 +2667,7 @@ def cert_issue(
         typer.Option(
             "--out",
             help="Also export a single PEM bundle (key + certificate + "
-            "intermediate) to this file.",
+            "chain) to this file.",
         ),
     ] = None,
     verbose: Annotated[
@@ -2810,9 +2853,9 @@ def cert_export(
         ),
     ] = None,
 ) -> None:
-    """Re-export an issued certificate as one bundle (key + cert + intermediate).
+    """Re-export an issued certificate as one bundle (key + cert + chain).
 
-    The default PEM bundle is three blocks; --format pfx writes a PKCS#12 file.
+    The default is a PEM bundle; --format pfx writes a PKCS#12 file.
     """
 
     cert_dir = _cert_dir(domain)
@@ -3303,7 +3346,7 @@ def _wait_for_batch(
 
 # --- BEGIN GENERATED COMMANDS (tools/generate.py; do not edit by hand) ---
 
-API_VERSION = "1.0.0"
+API_VERSION = "0.6.13"
 SKILL_MD = """\
 ---
 name: devnomads
@@ -3412,6 +3455,9 @@ Job `status` is one of `queued`, `running`, `completed`, `failed`,
   will be lost.
 - Database services cannot be deleted from dncli at the moment; use
   `dncli services discontinue` or the portal.
+- `dncli servers reinstall <id>` and `dncli servers snapshots restore` keep
+  the service but overwrite its disks. Both need the server shut down
+  (`dncli servers state <id> shutdown`). Confirm with the user first.
 
 ## Where values come from
 
@@ -3421,7 +3467,6 @@ Job `status` is one of `queued`, `running`, `completed`, `failed`,
 | `--product-sku` | `dncli products list` (match `type`) |
 | `--cluster-id` (sites) and allowed `--php-version` | `dncli sites clusters list` (`php_versions`) |
 | `--cluster-id` (containers, databases, proxies) | `dncli <group> clusters list` |
-| `--hypervisor-id` | `dncli servers hypervisors list` (optional) |
 | `--ipv4-network-id`, `--ipv6-network-id` | `dncli servers networks list` (same `vlan`) |
 | `--key-id` | `dncli keys list` |
 | `--handle-id-*`, `--handle-id` | `dncli handles list` |
@@ -4169,6 +4214,10 @@ def gen_keys_store(
 @gen_products.command("list")
 def gen_products_index(
     ctx: typer.Context,
+    filter_type: str | None = typer.Option(
+        None,
+        help="Filter products by exact product type. Multiple types may be separated by commas.",
+    ),
     sort: str | None = _SORT_OPT,
     timeout: int = _TIMEOUT_OPT,
     output: OutputFormat | None = _OUTPUT_OPT,
@@ -4184,6 +4233,7 @@ def gen_products_index(
         "GET",
         "/products",
         {},
+        query={"filter[type]": filter_type},
         sort=sort,
         timeout=timeout,
         output=output,
@@ -8008,6 +8058,44 @@ def gen_services_servers_networks_index(
     )
 
 
+@gen_servers.command("reinstall")
+def gen_services_servers_reinstall(
+    ctx: typer.Context,
+    service_id: str = typer.Argument(
+        ...,
+        metavar="SERVICE_ID",
+        help="Service id, or the service's unique entity name (usually its domain or name).",
+    ),
+    template: str = typer.Option(
+        ..., help="Operating system to install, for example debian-13."
+    ),
+    root_pw: str = typer.Option(..., help="New root password: 8-32 ASCII characters."),
+    yes: bool = _YES_OPT,
+    wait: bool = _WAIT_OPT,
+    timeout: int = _TIMEOUT_OPT,
+    output: OutputFormat | None = _OUTPUT_OPT,
+    columns: str | None = _COLUMNS_OPT,
+) -> None:
+    """Reinstall the operating system of a server.
+
+    The server must be shut down. Everything on its disks is lost."""
+
+    _generated_call(
+        ctx,
+        "POST",
+        "/services/servers/{serviceId}/reinstall",
+        {"serviceId": service_id},
+        body={"template": template, "root_pw": root_pw},
+        resolve="/services/servers",
+        confirm="Reinstall this server, erasing everything on its disks",
+        yes=yes,
+        wait=wait,
+        timeout=timeout,
+        output=output,
+        select=columns,
+    )
+
+
 @gen_servers.command("show")
 def gen_services_servers_show(
     ctx: typer.Context,
@@ -8205,22 +8293,9 @@ def gen_services_servers_store(
         help="Server product, the `sku` of a product of type server in `dncli products list`; sets memory, CPUs and disk.",
     ),
     name: str = typer.Option(..., help="Server name; also its hostname."),
-    hypervisor_id: int | None = typer.Option(
-        None,
-        help="Hypervisor to place it on, from `dncli servers hypervisors list`; omit to let DevNomads choose.",
-    ),
-    template: Literal[
-        "almalinux-8",
-        "almalinux-9",
-        "almalinux-10",
-        "almalinux-10-kitten",
-        "rockylinux-8",
-        "rockylinux-9",
-        "debian-12",
-        "debian-13",
-        "ubuntu-22.04",
-        "ubuntu-24.04",
-    ] = typer.Option(..., help="Operating system to install."),
+    template: str = typer.Option(
+        ..., help="Operating system to install, for example debian-13."
+    ),
     ipv4_network_id: int = typer.Option(
         ...,
         help="IPv4 network, from `dncli servers networks list`; same VLAN as the IPv6 one.",
@@ -8247,7 +8322,6 @@ def gen_services_servers_store(
             "client_id": client_id,
             "product_sku": product_sku,
             "name": name,
-            "hypervisor_id": hypervisor_id,
             "template": template,
             "ipv4_network_id": ipv4_network_id,
             "ipv6_network_id": ipv6_network_id,
@@ -8268,19 +8342,25 @@ def gen_services_servers_update(
         help="Service id, or the service's unique entity name (usually its domain or name).",
     ),
     name: str | None = typer.Option(None, help="New name."),
+    product_sku: str | None = typer.Option(
+        None,
+        help="New server product, the `sku` of a product of type server in `dncli products list`; sets memory, CPUs and disk.",
+    ),
+    wait: bool = _WAIT_OPT,
     timeout: int = _TIMEOUT_OPT,
     output: OutputFormat | None = _OUTPUT_OPT,
     columns: str | None = _COLUMNS_OPT,
 ) -> None:
-    """Rename a server."""
+    """Rename a server or move it to another product."""
 
     _generated_call(
         ctx,
         "PUT",
         "/services/servers/{serviceId}",
         {"serviceId": service_id},
-        body={"name": name},
+        body={"name": name, "product_sku": product_sku},
         resolve="/services/servers",
+        wait=wait,
         timeout=timeout,
         output=output,
         select=columns,
@@ -9214,10 +9294,15 @@ def gen_services_spams_transports_show(
 # ---------------------------------------------------------------------------
 # Update notice: at most once a day, dncli asks PyPI for the latest release in
 # the background and, on an interactive terminal, says so after the command.
+# The API's version is checked the same way, from its OpenAPI spec, while the
+# API sends no X-Api-Version header.
 
 PYPI_URL = f"https://pypi.org/pypi/{CLI_PACKAGE}/json"
 UPDATE_CHECK_INTERVAL = 24 * 3600
 UPDATE_CHECK_TIMEOUT = 2.0
+API_SPEC_PATH = "/docs?api-docs.json"
+# the background fetches and notify_update share update-check.json
+_update_state_lock = threading.Lock()
 
 
 def _update_state_path() -> Path:
@@ -9269,6 +9354,13 @@ def latest_version() -> str | None:
         return None
 
 
+def _change_update_state(change: Callable[[dict[str, Any]], None]) -> None:
+    with _update_state_lock:
+        state = _read_update_state()
+        change(state)
+        _write_update_state(state)
+
+
 def _fetch_latest_version() -> None:
     """Ask PyPI for the latest release and remember it. Any failure is
     ignored: the check must never get in the way of a command."""
@@ -9276,9 +9368,65 @@ def _fetch_latest_version() -> None:
     latest = latest_version()
     if latest is None:
         return
-    state = _read_update_state()
-    state.update(latest=str(latest), checked_at=time.time())
-    _write_update_state(state)
+    _change_update_state(
+        lambda state: state.update(latest=str(latest), checked_at=time.time())
+    )
+
+
+def api_spec_version(api_url: str) -> str | None:
+    """The version in the API's OpenAPI spec (info.version), or None when
+    the spec cannot be fetched."""
+
+    try:
+        response = httpx.get(
+            api_url.rstrip("/") + API_SPEC_PATH,
+            timeout=UPDATE_CHECK_TIMEOUT,
+            headers={"User-Agent": user_agent()},
+        )
+        response.raise_for_status()
+        return str(response.json()["info"]["version"])
+    except Exception:  # best effort, like the PyPI check
+        return None
+
+
+def remember_api_version(api_url: str, version: str) -> None:
+    """Cache the API's version, per API URL (profiles may use another API)."""
+
+    def change(state: dict[str, Any]) -> None:
+        apis = state.get("api")
+        if not isinstance(apis, dict):
+            apis = state["api"] = {}
+        apis[api_url.rstrip("/")] = {"version": version, "checked_at": time.time()}
+
+    _change_update_state(change)
+
+
+def _fetch_api_version(api_url: str) -> None:
+    version = api_spec_version(api_url)
+    if version is not None:
+        remember_api_version(api_url, version)
+
+
+def cached_api_version(api_url: str) -> str | None:
+    """The API's version from its spec as cached by an earlier run, and a
+    background refresh when that is more than a day old. The spec is too
+    large to fetch on every run. Like the update notice, only at a
+    terminal."""
+
+    if not _update_check_enabled():
+        return None
+    apis = _read_update_state().get("api")
+    entry = apis.get(api_url.rstrip("/")) if isinstance(apis, dict) else None
+    entry = entry if isinstance(entry, dict) else {}
+    checked = entry.get("checked_at", 0)
+    if not isinstance(checked, (int, float)) or (
+        time.time() - checked >= UPDATE_CHECK_INTERVAL
+    ):
+        threading.Thread(
+            target=_fetch_api_version, args=(api_url,), daemon=True
+        ).start()
+    version = entry.get("version")
+    return version if isinstance(version, str) else None
 
 
 def start_update_check() -> None:
@@ -9316,8 +9464,7 @@ def notify_update() -> None:
         f"{__version__}): {upgrade_command()}",
         soft_wrap=True,
     )
-    state["notified_at"] = time.time()
-    _write_update_state(state)
+    _change_update_state(lambda state: state.update(notified_at=time.time()))
 
 
 # Hidden spelling of --yes, for when you really, really mean it. Click cannot

{devnomads_cli-0.11.2 → devnomads_cli-0.12.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "devnomads-cli"
-version = "0.11.2"
+version = "0.12.0"
 description = "Manage your DevNomads services from the command line"
 readme = "README.md"
 requires-python = ">=3.10"

{devnomads_cli-0.11.2 → devnomads_cli-0.12.0}/tests/test_cert.py

@@ -13,8 +13,15 @@ runner = CliRunner()
 LEAF = "-----BEGIN CERTIFICATE-----\nLEAF\n-----END CERTIFICATE-----\n"
 INTERMEDIATE = "-----BEGIN CERTIFICATE-----\nINTER\n-----END CERTIFICATE-----\n"
 ROOT = "-----BEGIN CERTIFICATE-----\nROOT\n-----END CERTIFICATE-----\n"
-# Let's Encrypt returns a multi-cert chain (intermediate + cross-signs/roots).
+# Let's Encrypt returns a multi-cert chain (intermediate + cross-signs).
 CHAIN = INTERMEDIATE + ROOT
+#: The gen-Y chain as Let's Encrypt returns it: a blank line before every
+#: certificate after the first. The bodies are stand-ins.
+GEN_Y_CHAIN = (
+    "-----BEGIN CERTIFICATE-----\nYE2\n-----END CERTIFICATE-----\n"
+    "\n-----BEGIN CERTIFICATE-----\nROOTYE\n-----END CERTIFICATE-----\n"
+    "\n-----BEGIN CERTIFICATE-----\nX2BYX1\n-----END CERTIFICATE-----\n"
+)
 FULLCHAIN = LEAF + CHAIN
 KEY = b"-----BEGIN PRIVATE KEY-----\nKEY\n-----END PRIVATE KEY-----\n"
 
@@ -346,11 +353,8 @@ def test_issue_out_exports_combined_pem(
     default_dir = dncli.config_dir() / "certs" / "example.com"
     assert (default_dir / "fullchain.pem").read_text() == FULLCHAIN
     assert (default_dir / "chain.pem").read_text() == CHAIN
-    # ...and the combined file is exactly key + leaf + first intermediate,
-    # i.e. the rest of the chain (roots) is dropped.
-    assert out.read_text() == KEY.decode() + LEAF + INTERMEDIATE
-    assert ROOT not in out.read_text()
-    assert out.read_text().count("BEGIN CERTIFICATE") == 2
+    # ...and the combined file is key + leaf + the whole chain.
+    assert out.read_text() == KEY.decode() + LEAF + INTERMEDIATE + ROOT
     assert stat.S_IMODE(out.stat().st_mode) == 0o600
 
 
@@ -363,15 +367,20 @@ def test_our_zone_for_matches_longest_suffix():
     assert dncli._our_zone_for("other.org", zones) is None
 
 
-def test_first_cert_takes_only_the_intermediate():
-    assert dncli._first_cert(INTERMEDIATE + ROOT) == INTERMEDIATE
-    assert dncli._first_cert("no cert here") == ""
+def test_pem_certs_splits_every_block():
+    assert dncli._pem_certs(INTERMEDIATE + ROOT) == [INTERMEDIATE, ROOT]
+    assert dncli._pem_certs("no cert here") == []
 
 
-def test_combined_pem_is_three_blocks(tmp_path):
-    bundle = dncli._combined_pem(KEY.decode(), LEAF, INTERMEDIATE + ROOT)
-    assert bundle == KEY.decode() + LEAF + INTERMEDIATE
-    assert bundle.count("BEGIN CERTIFICATE") == 2  # leaf + one intermediate
+def test_combined_pem_keeps_the_whole_gen_y_chain():
+    """Dropping the cross-signs leaves a chain ending at Root YE, which
+    common trust stores do not have: nothing can verify it."""
+
+    bundle = dncli._combined_pem(KEY.decode(), LEAF, GEN_Y_CHAIN)
+    assert bundle.count("BEGIN CERTIFICATE") == 4  # leaf + three chain certs
+    assert bundle.index("YE2") < bundle.index("ROOTYE") < bundle.index("X2BYX1")
+    # no blank lines, so the bundle survives HAProxy's `<<` runtime-API payload
+    assert "\n\n" not in bundle
 
 
 def test_export_combined_pem_mode(tmp_path):
@@ -379,7 +388,7 @@ def test_export_combined_pem_mode(tmp_path):
     dncli._export_combined_pem(
         out, privkey=KEY.decode(), leaf=LEAF, chain=INTERMEDIATE + ROOT
     )
-    assert out.read_text() == KEY.decode() + LEAF + INTERMEDIATE
+    assert out.read_text() == KEY.decode() + LEAF + INTERMEDIATE + ROOT
     assert stat.S_IMODE(out.stat().st_mode) == 0o600
 
 
@@ -620,11 +629,9 @@ def test_cert_export_to_file(configured, isolated_config, tmp_path):
     result = runner.invoke(app, ["certs", "export", "example.com", "--out", str(out)])
     assert result.exit_code == 0, result.output
     text = out.read_text()
-    # order: private key, then leaf certificate, then the one intermediate
-    assert text.index("EC PRIVATE KEY") < text.index("INTER")
-    # only the first intermediate (not the root), and exactly three blocks
-    assert "ROOT" not in text
-    assert text.count("BEGIN CERTIFICATE") == 2
+    # order: private key, then leaf certificate, then the whole chain
+    assert text.index("EC PRIVATE KEY") < text.index("INTER") < text.index("ROOT")
+    assert text.count("BEGIN CERTIFICATE") == 3
     assert stat.S_IMODE(out.stat().st_mode) == 0o600
 
 
@@ -636,7 +643,7 @@ def test_cert_export_to_stdout(configured, isolated_config):
     assert result.exit_code == 0, result.output
     assert "BEGIN CERTIFICATE" in result.stdout
     assert "INTER" in result.stdout
-    assert "ROOT" not in result.stdout
+    assert "ROOT" in result.stdout
 
 
 def test_cert_export_missing(isolated_config):
@@ -723,8 +730,8 @@ def test_cert_export_pfx_no_passphrase(configured, isolated_config, tmp_path):
     key, cert, cas = pkcs12.load_key_and_certificates(out.read_bytes(), None)
     assert key is not None
     assert cert.subject == leaf.subject
-    # only the issuing intermediate, not the root
-    assert [c.subject for c in cas] == [inter.subject]
+    # the whole chain, in order
+    assert [c.subject for c in cas] == [inter.subject, root.subject]
     assert stat.S_IMODE(out.stat().st_mode) == 0o600
 
 

{devnomads_cli-0.11.2 → devnomads_cli-0.12.0}/tests/test_cli.py

@@ -40,12 +40,32 @@ def test_version():
     assert any(line.startswith("devnomads ") for line in result.output.splitlines())
 
 
+@respx.mock
 def test_version_command_json():
+    respx.get(f"{dncli.DEFAULT_API_URL}/docs?api-docs.json").mock(
+        return_value=Response(200, json={"info": {"version": "0.7.1"}})
+    )
     result = runner.invoke(app, ["version", "--out", "json"])
     assert result.exit_code == 0
     data = json.loads(result.output)
-    assert set(data) == {"devnomads-cli", "devnomads"}
+    assert set(data) == {"devnomads-cli", "devnomads", "api-built-for", "api"}
     assert all(data.values())  # every version resolved to something
+    assert data["api-built-for"] == dncli.API_VERSION
+    assert data["api"] == "0.7.1"
+    # and remembered for the version check of later runs
+    assert dncli._read_update_state()["api"][dncli.DEFAULT_API_URL]["version"] == (
+        "0.7.1"
+    )
+
+
+@respx.mock
+def test_version_command_without_the_api():
+    respx.get(f"{dncli.DEFAULT_API_URL}/docs?api-docs.json").mock(
+        return_value=Response(503)
+    )
+    result = runner.invoke(app, ["version", "--out", "json"])
+    assert result.exit_code == 0
+    assert json.loads(result.output)["api"] == "unreachable"
 
 
 @respx.mock

{devnomads_cli-0.11.2 → devnomads_cli-0.12.0}/tests/test_generate.py

@@ -32,6 +32,8 @@ def test_snake_case_conversion():
     assert generate.snake("instanceId") == "instance_id"
     # python keywords get an underscore suffix
     assert generate.snake("import") == "import_"
+    # bracketed query parameters become plain identifiers
+    assert generate.snake("filter[type]") == "filter_type"
 
 
 def test_action_mapping_index_becomes_list():
@@ -210,6 +212,28 @@ def test_query_parameters_become_options():
     assert [(o.name, o.py_type) for o in op.query] == [("lines", "int")]
 
 
+def test_bracketed_query_parameter_keeps_its_wire_name():
+    spec = make_spec(
+        {
+            "/products": {
+                "get": {
+                    "operationId": "products.index",
+                    "parameters": [
+                        {"name": "filter[type]", "in": "query", "schema": {}}
+                    ],
+                }
+            }
+        }
+    )
+    ops = generate.parse_operations(spec, {})
+    assert [(o.name, o.python_name) for o in ops[0].query] == [
+        ("filter[type]", "filter_type")
+    ]
+    source = generate.render_source(ops)
+    assert "filter_type: str | None" in source
+    assert '"filter[type]": filter_type' in source
+
+
 def test_destroy_becomes_delete():
     spec = make_spec(
         {"/services/sites/{serviceId}": {"delete": {"operationId": "x.sites.destroy"}}}

{devnomads_cli-0.11.2 → devnomads_cli-0.12.0}/tests/test_versions.py

@@ -96,6 +96,7 @@ class _Dummy:
 @pytest.fixture
 def api_warning(monkeypatch):
     monkeypatch.setattr(dncli, "_api_version_warned", False)
+    monkeypatch.setattr(dncli, "_api_spec_checked", False)
     monkeypatch.setattr(dncli, "API_VERSION", "1.4.0")
 
 
@@ -118,6 +119,67 @@ def test_older_api_major_warns(api_warning, capsys):
     assert "newer than the API" in capsys.readouterr().err
 
 
+def test_minor_counts_as_major_before_1_0(api_warning, monkeypatch, capsys):
+    monkeypatch.setattr(dncli, "API_VERSION", "0.6.13")
+    dncli.check_api_version("0.6.20")
+    assert capsys.readouterr().err == ""
+    dncli.check_api_version("0.7.0")
+    err = capsys.readouterr().err
+    assert "the API reports 0.7.0" in err and "update dncli" in err
+
+
+API = "https://api.test"
+
+
+def test_cached_spec_version_stands_in_for_the_header(api_warning, interactive, capsys):
+    write_state(api={API: {"version": "2.0.0", "checked_at": dncli.time.time()}})
+    dncli.check_api_version(None, API + "/")
+    assert "the API reports 2.0.0" in capsys.readouterr().err
+
+
+def test_header_wins_over_the_cached_spec_version(api_warning, interactive, capsys):
+    write_state(api={API: {"version": "2.0.0", "checked_at": dncli.time.time()}})
+    dncli.check_api_version("1.5.0", API)
+    assert capsys.readouterr().err == ""
+
+
+def test_cached_spec_version_is_only_used_at_a_terminal(api_warning, capsys):
+    write_state(api={API: {"version": "2.0.0", "checked_at": dncli.time.time()}})
+    dncli.check_api_version(None, API)
+    assert capsys.readouterr().err == ""
+
+
+def test_stale_spec_version_is_refreshed_in_the_background(
+    api_warning, interactive, monkeypatch
+):
+    started = []
+    monkeypatch.setattr(
+        dncli.threading, "Thread", lambda **kw: started.append(kw) or _Dummy()
+    )
+    write_state(api={API: {"version": "1.4.0", "checked_at": 0}})
+    dncli.check_api_version(None, API)
+    # looked up once per run, not on every response
+    dncli.check_api_version(None, API)
+    assert [kw["args"] for kw in started] == [(API,)]
+
+
+@respx.mock
+def test_fetch_stores_the_api_spec_version():
+    respx.get(f"{API}/docs?api-docs.json").mock(
+        return_value=Response(200, json={"info": {"version": "0.6.13"}})
+    )
+    dncli._fetch_api_version(API)
+    entry = dncli._read_update_state()["api"][API]
+    assert entry["version"] == "0.6.13"
+
+
+@respx.mock
+def test_api_spec_fetch_failures_are_ignored():
+    respx.get(f"{API}/docs?api-docs.json").mock(return_value=Response(500))
+    dncli._fetch_api_version(API)
+    assert dncli._read_update_state() == {}
+
+
 def test_upgrade_required_message():
     message = dncli._error_message(426, "Upgrade Required")
     assert "no longer supported" in message