devnomads-cli 0.5.8__tar.gz → 0.6.0__tar.gz

{devnomads_cli-0.5.8 → devnomads_cli-0.6.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devnomads-cli
-Version: 0.5.8
+Version: 0.6.0
 Summary: Manage your DevNomads services from the command line
 Author-email: DevNomads <support@devnomads.nl>
 License: MIT

{devnomads_cli-0.5.8 → devnomads_cli-0.6.0}/devnomads_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devnomads-cli
-Version: 0.5.8
+Version: 0.6.0
 Summary: Manage your DevNomads services from the command line
 Author-email: DevNomads <support@devnomads.nl>
 License: MIT

{devnomads_cli-0.5.8 → devnomads_cli-0.6.0}/dncli.py

@@ -27,6 +27,7 @@ import io
 import json
 import logging
 import os
+import re
 import secrets
 import stat
 import sys
@@ -51,7 +52,7 @@ from rich.markup import escape
 from rich.table import Table
 from typer.core import TyperGroup
 
-__version__ = "0.5.8"
+__version__ = "0.6.0"
 
 # Distribution names, for reporting versions via `dncli version`.
 CLI_PACKAGE = "devnomads-cli"
@@ -90,6 +91,10 @@ ENV_CONFIG_DIR = "DN_CONFIG_DIR"
 ENV_EAB_KID = "DN_ZEROSSL_EAB_KID"
 ENV_EAB_HMAC_KEY = "DN_ZEROSSL_EAB_HMAC_KEY"
 PROVIDERS = ("auroradns", "transip")
+# DevNomads keys are a long alphanumeric token (Laravel Sanctum style),
+# optionally carrying a numeric "<id>|" prefix. Matched loosely, for a
+# warning only - never to reject a key outright.
+API_KEY_RE = re.compile(r"^(?:\d+\|)?[A-Za-z0-9]{40,}$")
 REQUEST_TIMEOUT = 30.0
 RECORD_COLUMNS = ["name", "type", "ttl", "content", "disabled"]
 
@@ -1243,30 +1248,46 @@ def configure(
 
     if ctx.invoked_subcommand:
         return
+    if provider is not None and provider not in PROVIDERS:
+        raise CliError(
+            f"unknown provider '{provider}' (available: {', '.join(PROVIDERS)})"
+        )
+
+    profile = typer.prompt("Profile name", default=profile, err=True)
+
     if provider is None:
         section = profile
-        values = {
-            "api_key": typer.prompt("DevNomads API key", hide_input=True, err=True)
-        }
     elif provider == "auroradns":
         section = f"auroradns:{profile}"
+    else:  # transip
+        section = f"transip:{profile}"
+
+    parser = load_credentials()
+    if parser.has_section(section) and not typer.confirm(
+        f"profile '{section}' already exists; overwrite it?", err=True
+    ):
+        raise typer.Abort()
+
+    if provider is None:
+        api_key = typer.prompt("DevNomads API key", hide_input=True, err=True)
+        if not API_KEY_RE.match(api_key.strip()) and not typer.confirm(
+            "that does not look like a DevNomads API key; use it anyway?", err=True
+        ):
+            raise typer.Abort()
+        values = {"api_key": api_key}
+    elif provider == "auroradns":
         values = {
             "api_key": typer.prompt("AuroraDNS API key", hide_input=True, err=True),
             "secret_key": typer.prompt(
                 "AuroraDNS secret key", hide_input=True, err=True
             ),
         }
-    elif provider == "transip":
-        section = f"transip:{profile}"
+    else:  # transip
         login = typer.prompt("TransIP login name", err=True)
         key_source = typer.prompt("Path to TransIP private key (PEM)", err=True)
         key_path = _import_private_key(Path(key_source).expanduser(), profile)
         values = {"login": login, "private_key_file": str(key_path)}
-    else:
-        raise CliError(
-            f"unknown provider '{provider}' (available: {', '.join(PROVIDERS)})"
-        )
-    parser = load_credentials()
+
     if not parser.has_section(section):
         parser.add_section(section)
     for key, value in values.items():
@@ -1274,6 +1295,37 @@ def configure(
     save_credentials(parser)
     err_console.print(f"profile '{section}' written to {credentials_path()}")
 
+    if provider is None:
+        _verify_devnomads_key(
+            parser.get(section, "api_url", fallback=DEFAULT_API_URL),
+            values["api_key"],
+        )
+
+
+def _verify_devnomads_key(api_url: str, api_key: str) -> None:
+    """Best-effort check that a freshly stored key actually authenticates.
+
+    There is no no-op auth endpoint, so this hits the cheapest one -
+    GET /handles. A 401 is reported as a warning (the key is still stored);
+    network or other errors are ignored so `configure` works offline.
+    """
+
+    try:
+        with ApiClient(
+            api_url,
+            api_key,
+            user_agent=f"dncli/{__version__}",
+            timeout=REQUEST_TIMEOUT,
+        ) as client:
+            client.request("GET", "/handles")
+    except AuthError:
+        err_console.print(
+            "warning: the key was stored, but the API rejected it (401) - "
+            "double-check the token"
+        )
+    except DevNomadsError:
+        pass  # offline or transient; can't verify, so don't complain
+
 
 def _import_private_key(source: Path, profile: str) -> Path:
     try:

{devnomads_cli-0.5.8 → devnomads_cli-0.6.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "devnomads-cli"
-version = "0.5.8"
+version = "0.6.0"
 description = "Manage your DevNomads services from the command line"
 readme = "README.md"
 requires-python = ">=3.10"

{devnomads_cli-0.5.8 → devnomads_cli-0.6.0}/tests/test_cli.py

@@ -5,7 +5,7 @@ import stat
 
 import pytest
 import respx
-from httpx import Response
+from httpx import ConnectError, Response
 from typer.testing import CliRunner
 
 import dncli
@@ -14,6 +14,11 @@ from dncli import app
 API = "https://api.test"
 runner = CliRunner()
 
+# a token shaped like a real DevNomads key (passes the loose format check)
+VALID_KEY = "LL2bKLzNOQaEvKKcXVdfmdCteJPWmbNkWclmOOos514764bb"
+# configure verifies a stored key against this endpoint at the default api_url
+HANDLES = f"{dncli.DEFAULT_API_URL}/handles"
+
 
 def all_output(result):
     """Combined stdout + stderr; result.output mixes both on every
@@ -391,25 +396,105 @@ def test_unknown_profile_fails_clearly(configured):
     assert "'nope' not found" in all_output(result)
 
 
+@respx.mock
 def test_configure_writes_profile(isolated_config):
-    result = runner.invoke(app, ["configure"], input="dn_secretkey123456\n")
+    respx.get(HANDLES).mock(return_value=Response(200, json={"data": []}))
+    # first prompt is the profile name; empty line accepts the "default" default
+    result = runner.invoke(app, ["configure"], input=f"\n{VALID_KEY}\n")
     assert result.exit_code == 0
     path = dncli.credentials_path()
     assert stat.S_IMODE(path.stat().st_mode) == 0o600
     parser = dncli.load_credentials()
-    assert parser["default"]["api_key"] == "dn_secretkey123456"
+    assert parser["default"]["api_key"] == VALID_KEY
     # the API URL is hard coded, never prompted for or stored
     assert "api_url" not in parser["default"]
 
 
+@respx.mock
+def test_configure_verifies_key_with_no_handles(isolated_config):
+    # an account with zero handles still returns 200 - a valid key, no warning
+    respx.get(HANDLES).mock(return_value=Response(200, json={"data": []}))
+    result = runner.invoke(app, ["configure"], input=f"\n{VALID_KEY}\n")
+    assert result.exit_code == 0
+    assert "rejected" not in all_output(result)
+    assert dncli.load_credentials()["default"]["api_key"] == VALID_KEY
+
+
+@respx.mock
+def test_configure_warns_when_api_rejects_key(isolated_config):
+    respx.get(HANDLES).mock(return_value=Response(401, json={"message": "no"}))
+    result = runner.invoke(app, ["configure"], input=f"\n{VALID_KEY}\n")
+    assert result.exit_code == 0  # non-blocking: the key is still stored
+    assert "rejected it (401)" in all_output(result)
+    assert dncli.load_credentials()["default"]["api_key"] == VALID_KEY
+
+
+@respx.mock
+def test_configure_verify_ignores_network_errors(isolated_config):
+    respx.get(HANDLES).mock(side_effect=ConnectError("offline"))
+    result = runner.invoke(app, ["configure"], input=f"\n{VALID_KEY}\n")
+    assert result.exit_code == 0  # offline configure still succeeds
+    assert "rejected" not in all_output(result)
+    assert dncli.load_credentials()["default"]["api_key"] == VALID_KEY
+
+
+@respx.mock
+def test_configure_prompts_for_profile_name(isolated_config):
+    respx.get(HANDLES).mock(return_value=Response(200, json={"data": []}))
+    # typing a name at the profile prompt overrides the "default" default
+    result = runner.invoke(app, ["configure"], input=f"acme\n{VALID_KEY}\n")
+    assert result.exit_code == 0
+    parser = dncli.load_credentials()
+    assert parser["acme"]["api_key"] == VALID_KEY
+    assert not parser.has_section("default")
+
+
+@respx.mock
 def test_configure_named_profile(write_profile):
+    respx.get(HANDLES).mock(return_value=Response(200, json={"data": []}))
     write_profile(api_key="existing")
     result = runner.invoke(
-        app, ["configure", "--profile", "acme"], input="acme-key-9876543\n"
+        app, ["configure", "--profile", "acme"], input=f"\n{VALID_KEY}\n"
     )
     assert result.exit_code == 0
     parser = dncli.load_credentials()
-    assert parser["acme"]["api_key"] == "acme-key-9876543"
+    assert parser["acme"]["api_key"] == VALID_KEY
+    assert parser["default"]["api_key"] == "existing"  # untouched
+
+
+@respx.mock
+def test_configure_confirms_before_overwrite(write_profile):
+    respx.get(HANDLES).mock(return_value=Response(200, json={"data": []}))
+    write_profile(api_key="existing")
+    result = runner.invoke(app, ["configure"], input=f"\ny\n{VALID_KEY}\n")
+    assert result.exit_code == 0
+    assert "already exists" in all_output(result)
+    parser = dncli.load_credentials()
+    assert parser["default"]["api_key"] == VALID_KEY
+
+
+@respx.mock
+def test_configure_warns_on_malformed_key(isolated_config):
+    respx.get(HANDLES).mock(return_value=Response(200, json={"data": []}))
+    # a key that fails the loose format check; "y" accepts it anyway
+    result = runner.invoke(app, ["configure"], input="\nnot-a-real-key\ny\n")
+    assert result.exit_code == 0
+    assert "does not look like" in all_output(result)
+    parser = dncli.load_credentials()
+    assert parser["default"]["api_key"] == "not-a-real-key"
+
+
+def test_configure_malformed_key_declined_aborts(isolated_config):
+    result = runner.invoke(app, ["configure"], input="\nnot-a-real-key\nn\n")
+    assert result.exit_code == 1
+    assert not dncli.load_credentials().has_section("default")
+
+
+def test_configure_abort_leaves_profile_untouched(write_profile):
+    write_profile(api_key="existing")
+    result = runner.invoke(app, ["configure"], input="\nn\n")
+    assert result.exit_code == 1
+    parser = dncli.load_credentials()
     assert parser["default"]["api_key"] == "existing"  # untouched
 
 
@@ -419,7 +504,7 @@ def test_configure_transip_provider(isolated_config, tmp_path):
     result = runner.invoke(
         app,
         ["configure", "--provider", "transip", "--profile", "personal"],
-        input=f"loek\n{key_file}\n",
+        input=f"\nloek\n{key_file}\n",
     )
     assert result.exit_code == 0
     parser = dncli.load_credentials()
@@ -437,7 +522,7 @@ def test_configure_rejects_non_pem_key(isolated_config, tmp_path):
     result = runner.invoke(
         app,
         ["configure", "--provider", "transip"],
-        input=f"loek\n{bogus}\n",
+        input=f"\nloek\n{bogus}\n",
     )
     assert result.exit_code == 1
     assert "PEM" in all_output(result)