devnomads-cli 0.9.0__tar.gz → 0.9.1__tar.gz

{devnomads_cli-0.9.0 → devnomads_cli-0.9.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devnomads-cli
-Version: 0.9.0
+Version: 0.9.1
 Summary: Manage your DevNomads services from the command line
 Author-email: DevNomads <support@devnomads.nl>
 License: MIT
@@ -210,8 +210,10 @@ The `.pfx` is unencrypted unless you pass `--passphrase` (alias
 certificate, and the issuing intermediate.
 
 `dncli certs delete <domain>` removes a stored certificate and its
-private key from disk (after confirmation; `--yes` skips it). It only
-deletes the local files - the certificate itself is not revoked.
+private key from disk (after confirmation; `--yes` skips it). By
+default it only deletes the local files; add `--revoke` to also revoke
+the certificate at the CA that issued it (the files are kept if
+revocation fails).
 
 A dehydrated-compatible DNS-01 hook ships as `dncli-dns-hook`:
 

{devnomads_cli-0.9.0 → devnomads_cli-0.9.1}/README.md

@@ -194,8 +194,10 @@ The `.pfx` is unencrypted unless you pass `--passphrase` (alias
 certificate, and the issuing intermediate.
 
 `dncli certs delete <domain>` removes a stored certificate and its
-private key from disk (after confirmation; `--yes` skips it). It only
-deletes the local files - the certificate itself is not revoked.
+private key from disk (after confirmation; `--yes` skips it). By
+default it only deletes the local files; add `--revoke` to also revoke
+the certificate at the CA that issued it (the files are kept if
+revocation fails).
 
 A dehydrated-compatible DNS-01 hook ships as `dncli-dns-hook`:
 

{devnomads_cli-0.9.0 → devnomads_cli-0.9.1}/devnomads_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devnomads-cli
-Version: 0.9.0
+Version: 0.9.1
 Summary: Manage your DevNomads services from the command line
 Author-email: DevNomads <support@devnomads.nl>
 License: MIT
@@ -210,8 +210,10 @@ The `.pfx` is unencrypted unless you pass `--passphrase` (alias
 certificate, and the issuing intermediate.
 
 `dncli certs delete <domain>` removes a stored certificate and its
-private key from disk (after confirmation; `--yes` skips it). It only
-deletes the local files - the certificate itself is not revoked.
+private key from disk (after confirmation; `--yes` skips it). By
+default it only deletes the local files; add `--revoke` to also revoke
+the certificate at the CA that issued it (the files are kept if
+revocation fails).
 
 A dehydrated-compatible DNS-01 hook ships as `dncli-dns-hook`:
 

{devnomads_cli-0.9.0 → devnomads_cli-0.9.1}/dncli.py

@@ -53,7 +53,7 @@ from rich.markup import escape
 from rich.table import Table
 from typer.core import TyperGroup
 
-__version__ = "0.9.0"
+__version__ = "0.9.1"
 
 # Distribution names, for reporting versions via `dncli version`.
 CLI_PACKAGE = "devnomads-cli"
@@ -2479,24 +2479,71 @@ def cert_export(
         sys.stdout.write(_combined_pem(key_text, leaf_text, chain_text))
 
 
+def _revoke_certificate(domain: str, cert_dir: Path) -> None:
+    """Revoke the stored leaf for ``domain`` at the CA that issued it."""
+
+    from cryptography import x509
+
+    acme = _load_acme()
+    cert_path = cert_dir / "cert.pem"
+    try:
+        cert = x509.load_pem_x509_certificate(cert_path.read_bytes())
+    except (OSError, ValueError) as exc:
+        raise CliError(f"could not read {cert_path}: {exc}") from exc
+    provider = _cert_provider(cert_path, cert)
+    directory_url = acme.CA_DIRECTORIES.get(provider)
+    if directory_url is None:
+        raise CliError(
+            f"cannot revoke {domain}: unknown issuing CA"
+            + (f" {provider!r}" if provider else "")
+        )
+    # AcmeClient exposes no revoke of its own; drive the underlying ACME v2
+    # client directly, with the same account key that issued the certificate.
+    wrapper = acme.AcmeClient(
+        str(_account_key_path(provider)), directory_url=directory_url
+    )
+    try:
+        client, _ = wrapper._init_client()
+        client.revoke(cert, 0)  # reason 0: unspecified
+    except acme.AcmeError as exc:
+        raise CliError(f"revocation failed: {exc}") from exc
+    except Exception as exc:
+        if getattr(exc, "code", None) == "alreadyRevoked":
+            err_console.print(f"{domain}: certificate was already revoked")
+            return
+        raise CliError(f"revocation failed: {exc}") from exc
+    err_console.print(f"revoked {domain} at {provider}")
+
+
 @cert_app.command("delete")
 def cert_delete(
     domain: Annotated[
         str, typer.Argument(help="Domain of a previously issued certificate.")
     ],
+    revoke: Annotated[
+        bool,
+        typer.Option(
+            "--revoke",
+            help="Also revoke the certificate at the issuing CA before deleting.",
+        ),
+    ] = False,
     yes: Annotated[
         bool, typer.Option("--yes", "-y", help="Do not ask for confirmation.")
     ] = False,
 ) -> None:
     """Delete a stored certificate and its private key from this machine.
 
-    This only removes the local files; the certificate itself is not revoked.
+    This only removes the local files; pass --revoke to also revoke the
+    certificate at the CA that issued it.
     """
 
     cert_dir = _cert_dir(domain)
     if not cert_dir.is_dir():
         raise CliError(f"no certificate for {domain} in {cert_dir}")
-    _confirm(f"Delete the certificate and private key for {domain}?", yes)
+    action = "Revoke and delete" if revoke else "Delete"
+    _confirm(f"{action} the certificate and private key for {domain}?", yes)
+    if revoke:
+        _revoke_certificate(domain, cert_dir)
     shutil.rmtree(cert_dir)
     err_console.print(f"deleted {cert_dir}")
 

{devnomads_cli-0.9.0 → devnomads_cli-0.9.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "devnomads-cli"
-version = "0.9.0"
+version = "0.9.1"
 description = "Manage your DevNomads services from the command line"
 readme = "README.md"
 requires-python = ">=3.10"

{devnomads_cli-0.9.0 → devnomads_cli-0.9.1}/tests/test_cert.py

@@ -775,6 +775,68 @@ def test_cert_delete_missing(isolated_config):
     assert "no certificate for example.com" in result.output
 
 
+def _fake_revocation(monkeypatch, revoke):
+    """Replace the ACME account/network setup with a stub whose ``revoke``
+    is the given callable."""
+
+    import devnomads.acme as acme
+
+    class FakeClient:
+        def revoke(self, cert, rsn):
+            revoke(cert, rsn)
+
+    monkeypatch.setattr(
+        acme.AcmeClient, "_init_client", lambda self: (FakeClient(), None)
+    )
+
+
+def test_cert_delete_revoke_revokes_then_deletes(isolated_config, monkeypatch):
+    cert_dir = dncli.config_dir() / "certs" / "example.com"
+    _write_cert(cert_dir, days=45, with_key_chain=True)
+    (cert_dir / "provider").write_text("letsencrypt\n")
+    calls = {}
+
+    def revoke(cert, rsn):
+        calls["subject"] = cert.subject.rfc4514_string()
+        calls["rsn"] = rsn
+
+    _fake_revocation(monkeypatch, revoke)
+    result = runner.invoke(app, ["certs", "delete", "example.com", "--revoke", "--yes"])
+    assert result.exit_code == 0, result.output
+    assert calls["rsn"] == 0
+    assert "CN=example.com" in calls["subject"]
+    assert "revoked example.com at letsencrypt" in result.output
+    assert not cert_dir.exists()
+
+
+def test_cert_delete_revoke_failure_keeps_files(isolated_config, monkeypatch):
+    import devnomads.acme as acme
+
+    cert_dir = dncli.config_dir() / "certs" / "example.com"
+    _write_cert(cert_dir, days=45, with_key_chain=True)
+    (cert_dir / "provider").write_text("letsencrypt\n")
+
+    def revoke(cert, rsn):
+        raise acme.AcmeError("boom")
+
+    _fake_revocation(monkeypatch, revoke)
+    result = runner.invoke(app, ["certs", "delete", "example.com", "--revoke", "--yes"])
+    assert result.exit_code != 0
+    assert "revocation failed" in result.output
+    assert (cert_dir / "privkey.pem").is_file()
+
+
+def test_cert_delete_revoke_unknown_provider(isolated_config):
+    # the test cert is self-signed and has no provider marker, so the
+    # issuing CA cannot be determined and revocation must refuse early
+    cert_dir = dncli.config_dir() / "certs" / "example.com"
+    _write_cert(cert_dir, days=45, with_key_chain=True)
+    result = runner.invoke(app, ["certs", "delete", "example.com", "--revoke", "--yes"])
+    assert result.exit_code != 0
+    assert "unknown issuing CA" in result.output
+    assert (cert_dir / "privkey.pem").is_file()
+
+
 def test_cert_delete_requires_confirmation(isolated_config):
     # without --yes and without a TTY the command must refuse and keep the files
     cert_dir = dncli.config_dir() / "certs" / "example.com"