devnomads-cli 0.9.0__tar.gz → 0.10.0__tar.gz

{devnomads_cli-0.9.0 → devnomads_cli-0.10.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devnomads-cli
-Version: 0.9.0
+Version: 0.10.0
 Summary: Manage your DevNomads services from the command line
 Author-email: DevNomads <support@devnomads.nl>
 License: MIT
@@ -81,6 +81,18 @@ dncli dns records set example.com www A 192.0.2.1 --ttl 3600
 dncli dns records delete example.com www A
 ```
 
+Anywhere a zone is expected you may pass the service id of a domain
+instead of its name, so the ids from `dncli domains list` work here
+too:
+
+```sh
+dncli dns records list 42
+```
+
+An id always means that domain's own zone. A delegated subzone such
+as `foo.example.com` has no domain service of its own, so address it
+by name.
+
 ## Moving a zone from another provider
 
 `dncli dns transfer` copies a zone from your current DNS provider
@@ -210,8 +222,10 @@ The `.pfx` is unencrypted unless you pass `--passphrase` (alias
 certificate, and the issuing intermediate.
 
 `dncli certs delete <domain>` removes a stored certificate and its
-private key from disk (after confirmation; `--yes` skips it). It only
-deletes the local files - the certificate itself is not revoked.
+private key from disk (after confirmation; `--yes` skips it). By
+default it only deletes the local files; add `--revoke` to also revoke
+the certificate at the CA that issued it (the files are kept if
+revocation fails).
 
 A dehydrated-compatible DNS-01 hook ships as `dncli-dns-hook`:
 

{devnomads_cli-0.9.0 → devnomads_cli-0.10.0}/README.md

@@ -65,6 +65,18 @@ dncli dns records set example.com www A 192.0.2.1 --ttl 3600
 dncli dns records delete example.com www A
 ```
 
+Anywhere a zone is expected you may pass the service id of a domain
+instead of its name, so the ids from `dncli domains list` work here
+too:
+
+```sh
+dncli dns records list 42
+```
+
+An id always means that domain's own zone. A delegated subzone such
+as `foo.example.com` has no domain service of its own, so address it
+by name.
+
 ## Moving a zone from another provider
 
 `dncli dns transfer` copies a zone from your current DNS provider
@@ -194,8 +206,10 @@ The `.pfx` is unencrypted unless you pass `--passphrase` (alias
 certificate, and the issuing intermediate.
 
 `dncli certs delete <domain>` removes a stored certificate and its
-private key from disk (after confirmation; `--yes` skips it). It only
-deletes the local files - the certificate itself is not revoked.
+private key from disk (after confirmation; `--yes` skips it). By
+default it only deletes the local files; add `--revoke` to also revoke
+the certificate at the CA that issued it (the files are kept if
+revocation fails).
 
 A dehydrated-compatible DNS-01 hook ships as `dncli-dns-hook`:
 

{devnomads_cli-0.9.0 → devnomads_cli-0.10.0}/devnomads_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devnomads-cli
-Version: 0.9.0
+Version: 0.10.0
 Summary: Manage your DevNomads services from the command line
 Author-email: DevNomads <support@devnomads.nl>
 License: MIT
@@ -81,6 +81,18 @@ dncli dns records set example.com www A 192.0.2.1 --ttl 3600
 dncli dns records delete example.com www A
 ```
 
+Anywhere a zone is expected you may pass the service id of a domain
+instead of its name, so the ids from `dncli domains list` work here
+too:
+
+```sh
+dncli dns records list 42
+```
+
+An id always means that domain's own zone. A delegated subzone such
+as `foo.example.com` has no domain service of its own, so address it
+by name.
+
 ## Moving a zone from another provider
 
 `dncli dns transfer` copies a zone from your current DNS provider
@@ -210,8 +222,10 @@ The `.pfx` is unencrypted unless you pass `--passphrase` (alias
 certificate, and the issuing intermediate.
 
 `dncli certs delete <domain>` removes a stored certificate and its
-private key from disk (after confirmation; `--yes` skips it). It only
-deletes the local files - the certificate itself is not revoked.
+private key from disk (after confirmation; `--yes` skips it). By
+default it only deletes the local files; add `--revoke` to also revoke
+the certificate at the CA that issued it (the files are kept if
+revocation fails).
 
 A dehydrated-compatible DNS-01 hook ships as `dncli-dns-hook`:
 

{devnomads_cli-0.9.0 → devnomads_cli-0.10.0}/dncli.py

@@ -53,7 +53,7 @@ from rich.markup import escape
 from rich.table import Table
 from typer.core import TyperGroup
 
-__version__ = "0.9.0"
+__version__ = "0.10.0"
 
 # Distribution names, for reporting versions via `dncli version`.
 CLI_PACKAGE = "devnomads-cli"
@@ -673,6 +673,45 @@ def zone_id(zone: str) -> str:
     return zone if zone.endswith(".") else f"{zone}."
 
 
+def resolve_zone(state: AppState, zone: str) -> str:
+    """Map an all-digit domain service id to that domain's zone name; any
+    other value is taken to be a zone name already and passed through.
+
+    An id always means the domain product's own zone. A delegated subzone
+    such as foo.example.com has no domain service of its own, so it can
+    only be addressed by name.
+    """
+
+    text = str(zone)
+    if not text.isdigit():
+        return text.rstrip(".")
+    client = get_client(state)
+    rows = client.request("GET", "/services/domains")
+    if isinstance(rows, dict):
+        rows = rows.get("data", [])
+    match = next(
+        (
+            row
+            for row in (rows or [])
+            if isinstance(row, dict) and str(row.get("service_id")) == text
+        ),
+        None,
+    )
+    if match is None:
+        raise CliError(f"no domain service with id {text}")
+    name = str(match.get("entity") or "").rstrip(".")
+    if not name:
+        raise CliError(f"domain service {text} has no domain name")
+    zones = client.request("GET", "/services/dns/zones")
+    known = {str(item.get("name", "")).rstrip(".").lower() for item in zones or []}
+    if name.lower() not in known:
+        raise CliError(
+            f"{name} (service {text}) is not hosted on DevNomads DNS; "
+            "dncli dns zones list shows your zones"
+        )
+    return name
+
+
 def fqdn(name: str, zone: str) -> str:
     """Absolute record name with trailing dot, PowerDNS style."""
 
@@ -1438,13 +1477,17 @@ def zones_list(
 @zones_app.command("show")
 def zones_show(
     ctx: typer.Context,
-    zone: Annotated[str, typer.Argument(help="Zone name, e.g. example.com.")],
+    zone: Annotated[
+        str,
+        typer.Argument(help="Zone name (example.com) or the service id of a domain."),
+    ],
     output: OutputOption = None,
     columns: ColumnsOption = None,
 ) -> None:
     """Show a DNS zone including its records."""
 
     state = state_from(ctx, output, columns)
+    zone = resolve_zone(state, zone)
     data = get_client(state).request("GET", f"/services/dns/zones/{zone_id(zone)}")
     if resolve_format(state) is not OutputFormat.table or not isinstance(data, dict):
         render(state, data)
@@ -1465,7 +1508,10 @@ def zones_show(
 @records_app.command("list")
 def records_list(
     ctx: typer.Context,
-    zone: Annotated[str, typer.Argument(help="Zone name, e.g. example.com.")],
+    zone: Annotated[
+        str,
+        typer.Argument(help="Zone name (example.com) or the service id of a domain."),
+    ],
     sort: SortOption = None,
     output: OutputOption = None,
     columns: ColumnsOption = None,
@@ -1473,6 +1519,7 @@ def records_list(
     """List the records in a zone, one row per value."""
 
     state = state_from(ctx, output, columns)
+    zone = resolve_zone(state, zone)
     data = get_client(state).request("GET", f"/services/dns/zones/{zone_id(zone)}")
     rrsets = data.get("rrsets", []) if isinstance(data, dict) else []
     render(
@@ -1486,7 +1533,10 @@ def records_list(
 @records_app.command("set")
 def records_set(
     ctx: typer.Context,
-    zone: Annotated[str, typer.Argument(help="Zone name, e.g. example.com.")],
+    zone: Annotated[
+        str,
+        typer.Argument(help="Zone name (example.com) or the service id of a domain."),
+    ],
     name: Annotated[
         str, typer.Argument(help="Record name relative to the zone; @ for the apex.")
     ],
@@ -1504,6 +1554,7 @@ def records_set(
     """Create or replace a record set (PowerDNS REPLACE semantics)."""
 
     state = state_from(ctx)
+    zone = resolve_zone(state, zone)
     rrset = build_rrset(
         zone, name, rtype, changetype="REPLACE", ttl=ttl, contents=content
     )
@@ -1520,7 +1571,10 @@ def records_set(
 @records_app.command("delete")
 def records_delete(
     ctx: typer.Context,
-    zone: Annotated[str, typer.Argument(help="Zone name, e.g. example.com.")],
+    zone: Annotated[
+        str,
+        typer.Argument(help="Zone name (example.com) or the service id of a domain."),
+    ],
     name: Annotated[
         str, typer.Argument(help="Record name relative to the zone; @ for the apex.")
     ],
@@ -1534,6 +1588,7 @@ def records_delete(
     """Delete a whole record set (all values for name + type)."""
 
     state = state_from(ctx)
+    zone = resolve_zone(state, zone)
     rrset = build_rrset(zone, name, rtype, changetype="DELETE")
     _confirm(f"Delete all {rrset['type']} records for {rrset['name']}?", yes)
     payload = {"rrsets": [rrset]}
@@ -1555,7 +1610,12 @@ def dns_transfer(
         ),
     ],
     zone: Annotated[
-        str, typer.Option("--zone", help="Zone name on both sides, e.g. example.com.")
+        str,
+        typer.Option(
+            "--zone",
+            help="Zone name on both sides (example.com), or the service id "
+            "of a DevNomads domain.",
+        ),
     ],
     source_profile: Annotated[
         str | None,
@@ -1583,6 +1643,7 @@ def dns_transfer(
 
     state = state_from(ctx, output, columns)
     client = get_client(state)  # resolve DevNomads credentials first: fail fast
+    zone = resolve_zone(state, zone)
     source = build_source(from_, source_profile)
     zones = client.request("GET", "/services/dns/zones")
     known = {str(item.get("name", "")).rstrip(".") for item in zones or []}
@@ -2479,24 +2540,71 @@ def cert_export(
         sys.stdout.write(_combined_pem(key_text, leaf_text, chain_text))
 
 
+def _revoke_certificate(domain: str, cert_dir: Path) -> None:
+    """Revoke the stored leaf for ``domain`` at the CA that issued it."""
+
+    from cryptography import x509
+
+    acme = _load_acme()
+    cert_path = cert_dir / "cert.pem"
+    try:
+        cert = x509.load_pem_x509_certificate(cert_path.read_bytes())
+    except (OSError, ValueError) as exc:
+        raise CliError(f"could not read {cert_path}: {exc}") from exc
+    provider = _cert_provider(cert_path, cert)
+    directory_url = acme.CA_DIRECTORIES.get(provider)
+    if directory_url is None:
+        raise CliError(
+            f"cannot revoke {domain}: unknown issuing CA"
+            + (f" {provider!r}" if provider else "")
+        )
+    # AcmeClient exposes no revoke of its own; drive the underlying ACME v2
+    # client directly, with the same account key that issued the certificate.
+    wrapper = acme.AcmeClient(
+        str(_account_key_path(provider)), directory_url=directory_url
+    )
+    try:
+        client, _ = wrapper._init_client()
+        client.revoke(cert, 0)  # reason 0: unspecified
+    except acme.AcmeError as exc:
+        raise CliError(f"revocation failed: {exc}") from exc
+    except Exception as exc:
+        if getattr(exc, "code", None) == "alreadyRevoked":
+            err_console.print(f"{domain}: certificate was already revoked")
+            return
+        raise CliError(f"revocation failed: {exc}") from exc
+    err_console.print(f"revoked {domain} at {provider}")
+
+
 @cert_app.command("delete")
 def cert_delete(
     domain: Annotated[
         str, typer.Argument(help="Domain of a previously issued certificate.")
     ],
+    revoke: Annotated[
+        bool,
+        typer.Option(
+            "--revoke",
+            help="Also revoke the certificate at the issuing CA before deleting.",
+        ),
+    ] = False,
     yes: Annotated[
         bool, typer.Option("--yes", "-y", help="Do not ask for confirmation.")
     ] = False,
 ) -> None:
     """Delete a stored certificate and its private key from this machine.
 
-    This only removes the local files; the certificate itself is not revoked.
+    This only removes the local files; pass --revoke to also revoke the
+    certificate at the CA that issued it.
     """
 
     cert_dir = _cert_dir(domain)
     if not cert_dir.is_dir():
         raise CliError(f"no certificate for {domain} in {cert_dir}")
-    _confirm(f"Delete the certificate and private key for {domain}?", yes)
+    action = "Revoke and delete" if revoke else "Delete"
+    _confirm(f"{action} the certificate and private key for {domain}?", yes)
+    if revoke:
+        _revoke_certificate(domain, cert_dir)
     shutil.rmtree(cert_dir)
     err_console.print(f"deleted {cert_dir}")
 

{devnomads_cli-0.9.0 → devnomads_cli-0.10.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "devnomads-cli"
-version = "0.9.0"
+version = "0.10.0"
 description = "Manage your DevNomads services from the command line"
 readme = "README.md"
 requires-python = ">=3.10"

{devnomads_cli-0.9.0 → devnomads_cli-0.10.0}/tests/test_cert.py

@@ -775,6 +775,68 @@ def test_cert_delete_missing(isolated_config):
     assert "no certificate for example.com" in result.output
 
 
+def _fake_revocation(monkeypatch, revoke):
+    """Replace the ACME account/network setup with a stub whose ``revoke``
+    is the given callable."""
+
+    import devnomads.acme as acme
+
+    class FakeClient:
+        def revoke(self, cert, rsn):
+            revoke(cert, rsn)
+
+    monkeypatch.setattr(
+        acme.AcmeClient, "_init_client", lambda self: (FakeClient(), None)
+    )
+
+
+def test_cert_delete_revoke_revokes_then_deletes(isolated_config, monkeypatch):
+    cert_dir = dncli.config_dir() / "certs" / "example.com"
+    _write_cert(cert_dir, days=45, with_key_chain=True)
+    (cert_dir / "provider").write_text("letsencrypt\n")
+    calls = {}
+
+    def revoke(cert, rsn):
+        calls["subject"] = cert.subject.rfc4514_string()
+        calls["rsn"] = rsn
+
+    _fake_revocation(monkeypatch, revoke)
+    result = runner.invoke(app, ["certs", "delete", "example.com", "--revoke", "--yes"])
+    assert result.exit_code == 0, result.output
+    assert calls["rsn"] == 0
+    assert "CN=example.com" in calls["subject"]
+    assert "revoked example.com at letsencrypt" in result.output
+    assert not cert_dir.exists()
+
+
+def test_cert_delete_revoke_failure_keeps_files(isolated_config, monkeypatch):
+    import devnomads.acme as acme
+
+    cert_dir = dncli.config_dir() / "certs" / "example.com"
+    _write_cert(cert_dir, days=45, with_key_chain=True)
+    (cert_dir / "provider").write_text("letsencrypt\n")
+
+    def revoke(cert, rsn):
+        raise acme.AcmeError("boom")
+
+    _fake_revocation(monkeypatch, revoke)
+    result = runner.invoke(app, ["certs", "delete", "example.com", "--revoke", "--yes"])
+    assert result.exit_code != 0
+    assert "revocation failed" in result.output
+    assert (cert_dir / "privkey.pem").is_file()
+
+
+def test_cert_delete_revoke_unknown_provider(isolated_config):
+    # the test cert is self-signed and has no provider marker, so the
+    # issuing CA cannot be determined and revocation must refuse early
+    cert_dir = dncli.config_dir() / "certs" / "example.com"
+    _write_cert(cert_dir, days=45, with_key_chain=True)
+    result = runner.invoke(app, ["certs", "delete", "example.com", "--revoke", "--yes"])
+    assert result.exit_code != 0
+    assert "unknown issuing CA" in result.output
+    assert (cert_dir / "privkey.pem").is_file()
+
+
 def test_cert_delete_requires_confirmation(isolated_config):
     # without --yes and without a TTY the command must refuse and keep the files
     cert_dir = dncli.config_dir() / "certs" / "example.com"

{devnomads_cli-0.9.0 → devnomads_cli-0.10.0}/tests/test_cli.py

@@ -337,6 +337,92 @@ def test_records_delete_with_yes(configured):
     assert payload["rrsets"][0]["changetype"] == "DELETE"
 
 
+# --- service id -> zone name resolution --------------------------------------
+
+DOMAINS = [
+    {"service_id": 42, "type": "domain", "entity": "example.com"},
+    {"service_id": 43, "type": "domain", "entity": "elsewhere.com"},
+]
+
+
+def mock_domains(zones=("example.com.",)):
+    respx.get(f"{API}/services/domains").mock(
+        return_value=Response(200, json={"data": DOMAINS})
+    )
+    respx.get(f"{API}/services/dns/zones").mock(
+        return_value=Response(200, json=[{"id": z, "name": z} for z in zones])
+    )
+
+
+@respx.mock
+def test_records_list_accepts_a_domain_service_id(configured):
+    mock_domains()
+    respx.get(f"{API}/services/dns/zones/example.com.").mock(
+        return_value=Response(200, json=ZONE)
+    )
+    result = runner.invoke(app, ["--out", "json", "dns", "records", "list", "42"])
+    assert result.exit_code == 0, all_output(result)
+    assert json.loads(result.output)[0]["name"] == "www.example.com."
+
+
+@respx.mock
+def test_records_set_by_service_id_builds_names_from_the_zone(configured):
+    mock_domains()
+    route = respx.patch(f"{API}/services/dns/zones/example.com.").mock(
+        return_value=Response(204)
+    )
+    result = runner.invoke(
+        app, ["dns", "records", "set", "42", "www", "A", "192.0.2.1"]
+    )
+    assert result.exit_code == 0, all_output(result)
+    payload = json.loads(route.calls.last.request.content)
+    assert payload["rrsets"][0]["name"] == "www.example.com."
+
+
+@respx.mock
+def test_zones_show_by_service_id(configured):
+    mock_domains()
+    route = respx.get(f"{API}/services/dns/zones/example.com.").mock(
+        return_value=Response(200, json=ZONE)
+    )
+    result = runner.invoke(app, ["--out", "json", "dns", "zones", "show", "42"])
+    assert result.exit_code == 0, all_output(result)
+    assert route.called
+
+
+@respx.mock
+def test_unknown_service_id_fails_clearly(configured):
+    mock_domains()
+    result = runner.invoke(app, ["dns", "records", "list", "999"])
+    assert result.exit_code == 1
+    assert "no domain service with id 999" in all_output(result)
+
+
+@respx.mock
+def test_domain_without_a_devnomads_zone_fails_clearly(configured):
+    # 43 is elsewhere.com: registered with us, DNS hosted somewhere else.
+    mock_domains()
+    result = runner.invoke(app, ["dns", "records", "list", "43"])
+    assert result.exit_code == 1
+    output = all_output(result)
+    assert "elsewhere.com (service 43) is not hosted on DevNomads DNS" in output
+
+
+@respx.mock
+def test_zone_names_do_not_trigger_a_lookup(configured):
+    domains = respx.get(f"{API}/services/domains").mock(
+        return_value=Response(200, json={"data": DOMAINS})
+    )
+    respx.get(f"{API}/services/dns/zones/example.com.").mock(
+        return_value=Response(200, json=ZONE)
+    )
+    result = runner.invoke(
+        app, ["--out", "json", "dns", "records", "list", "example.com"]
+    )
+    assert result.exit_code == 0, all_output(result)
+    assert not domains.called
+
+
 @respx.mock
 def test_api_error_message_and_exit_code(configured):
     respx.get(f"{API}/services").mock(