doover-cli 0.6.1__tar.gz → 0.6.2__tar.gz

{doover_cli-0.6.1 → doover_cli-0.6.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: doover-cli
-Version: 0.6.1
+Version: 0.6.2
 Summary: CLI for Doover
 License-File: LICENSE
 Requires-Python: >=3.11
@@ -10,7 +10,7 @@ Requires-Dist: docker>=7.1.0
 Requires-Dist: jsf>=0.11.2
 Requires-Dist: paramiko>=3.5.1
 Requires-Dist: prompt-toolkit>=3.0.52
-Requires-Dist: pydoover>=1.5.1
+Requires-Dist: pydoover>=1.12.0
 Requires-Dist: pytz>=2025.2
 Requires-Dist: questionary>=1.10.0
 Requires-Dist: requests>=2.32.3

{doover_cli-0.6.1 → doover_cli-0.6.2}/pyproject.toml

@@ -10,7 +10,7 @@ dependencies = [
     "docker>=7.1.0",
     "jsf>=0.11.2",
     "paramiko>=3.5.1",
-    "pydoover>=1.5.1",
+    "pydoover>=1.12.0",
     "pytz>=2025.2",
     "questionary>=1.10.0",
     "requests>=2.32.3",
@@ -31,6 +31,7 @@ path = "src/doover_cli/__init__.py"
 
 [project.scripts]
 doover = "doover_cli:main"
+docker-credential-doover = "doover_cli.registry:credential_helper"
 
 [dependency-groups]
 dev = [

{doover_cli-0.6.1 → doover_cli-0.6.2}/src/doover_cli/__init__.py

@@ -1,7 +1,7 @@
 from doover_cli.renderer import Renderer
 from typing import Annotated, Optional
 
-__version__ = "0.6.1"
+__version__ = "0.6.2"
 
 import click
 import typer

{doover_cli-0.6.1 → doover_cli-0.6.2}/src/doover_cli/apps/apps.py

@@ -7,6 +7,8 @@ import re
 import shutil
 import socket
 import subprocess
+import sys
+import tempfile
 import time
 from urllib.parse import urlencode
 from pathlib import Path
@@ -26,7 +28,10 @@ import questionary
 from ..config_schema import export as export_config_command
 from ..ui_schema import export as export_ui_command
 from ..utils.api import ProfileAnnotation
+from ..registry import is_doover_registry, login_for_push, publish_github_output
 from ..utils.apps import (
+    PACKAGE_APP_TYPES,
+    discover_apps,
     get_app_directory,
     call_with_uv,
     get_docker_path,
@@ -120,6 +125,20 @@ def _detect_git_commit(root_fp: Path) -> str:
     return result.stdout.strip() if result.returncode == 0 else ""
 
 
+def _is_multi_platform(build_args: str) -> bool:
+    """Whether `build_args` asks for more than one platform.
+
+    Multi-platform changes how the image has to be built: buildx cannot load a
+    multi-platform result into the local daemon, so it must push directly, and
+    the digest has to come from buildx rather than the daemon.
+    """
+    for token in ("--platform", "--platform="):
+        if token in build_args:
+            tail = build_args.split(token, 1)[1].lstrip("= ").split()[0]
+            return "," in tail
+    return False
+
+
 def _build_container(
     root_fp: Path, *, buildx: bool, build_args: str, image_name: str
 ) -> None:
@@ -128,6 +147,29 @@ def _build_container(
     )
 
 
+def _build_and_push_multi_platform(
+    root_fp: Path, *, build_args: str, image_name: str
+) -> str | None:
+    """Build and push a multi-platform image in one step, returning its digest.
+
+    A multi-platform build cannot be loaded into the local daemon, so `build`
+    then `push` does not work -- and `docker inspect` afterwards reports either
+    nothing or the single-platform digest, not the index. buildx writes the real
+    digest to a metadata file, which is the only reliable source.
+    """
+    with tempfile.TemporaryDirectory() as tmp:
+        metadata_fp = Path(tmp) / "metadata.json"
+        shell_run(
+            f"docker buildx build {build_args} --push "
+            f"--metadata-file {metadata_fp} -t {image_name} {str(root_fp)}",
+        )
+        try:
+            metadata = json.loads(metadata_fp.read_text())
+        except (OSError, ValueError):
+            return None
+    return metadata.get("containerimage.digest")
+
+
 def _push_container(image_name: str) -> None:
     shell_run(f"docker push {image_name}")
 
@@ -925,7 +967,13 @@ def publish(
     ] = Path(),
     build_container: Annotated[
         bool,
-        typer.Option(help="Build and push the container image to the registry."),
+        typer.Option(
+            # `--build` is the name this is known by; the longer form is kept so
+            # existing scripts and CI keep working.
+            "--build/--no-build",
+            "--build-container/--no-build-container",
+            help="Build and push the container image to the registry.",
+        ),
     ] = False,
     staging: Annotated[
         bool | None,
@@ -1123,7 +1171,7 @@ def publish(
                 )
             rich.print("[green]Widget uploaded.[/green]")
 
-    if app_config.type in ("PRO", "REP", "INT"):
+    if app_config.type in PACKAGE_APP_TYPES:
         if build_package:
             print("\nBuilding package.zip for upload...")
             shell_run("./build.sh", cwd=root_fp)
@@ -1164,14 +1212,49 @@ def publish(
         build_args = getattr(app_config, "build_args", "") or ""
         if build_args != "NO_BUILD":
             print("\nBuilding and pushing container image to the registry...")
-            _build_container(
-                root_fp,
-                buildx=buildx,
-                build_args=build_args,
-                image_name=image_name,
-            )
-            _push_container(image_name)
-            detected_digest = _get_image_digest(image_name)
+
+            # Pushing to the doover registry needs a credential scoped to this
+            # app's repository, minted against the publish permission we just
+            # exercised. Other registries keep using whatever docker login the
+            # user already has.
+            if is_doover_registry(image_name, _control_base_url()):
+                # `response` is an Application model on create/partial; fall back to
+                # resolving by name for the paths that don't return one.
+                app_id = getattr(response, "id", None)
+                if app_id is None and isinstance(response, dict):
+                    app_id = response.get("id")
+                if app_id is None:
+                    app_id = _resolve_application_id(
+                        client, app_config, staging=resolved_staging
+                    )
+                if not app_id:
+                    raise typer.BadParameter(
+                        "Could not determine the application id to mint a registry "
+                        "credential. Publish the app first."
+                    )
+                login_for_push(client, app_id)
+
+            if _is_multi_platform(build_args):
+                # buildx pushes as part of the build here; see the helper for why
+                # build-then-push cannot work for multi-platform.
+                detected_digest = _build_and_push_multi_platform(
+                    root_fp, build_args=build_args, image_name=image_name
+                )
+            else:
+                _build_container(
+                    root_fp,
+                    buildx=buildx,
+                    build_args=build_args,
+                    image_name=image_name,
+                )
+                _push_container(image_name)
+                detected_digest = _get_image_digest(image_name)
+
+            if detected_digest is None:
+                print(
+                    "Warning: could not determine the pushed image digest. "
+                    "Pass --digest to release against it explicitly."
+                )
         else:
             print("App requested to not build. Skipping build step.")
 
@@ -1193,6 +1276,89 @@ def publish(
     renderer.render(response)
 
 
+@app.command()
+def discover(
+    root: Annotated[Path, typer.Argument(help="Repository root to search.")] = Path(),
+    as_json: Annotated[
+        bool,
+        typer.Option(
+            "--json",
+            help="Emit a single-line JSON array, suitable for a CI matrix.",
+        ),
+    ] = False,
+):
+    """List every application in this repository and how to build it.
+
+    Handles both shapes a repo can take: several app entries in one
+    doover_config.json, and several self-contained app directories each with their
+    own. CI reads this to build its matrix instead of the workflow hard-coding app
+    names, which is what lets one workflow file serve every app repo.
+    """
+    found = discover_apps(root)
+    if not found:
+        print(
+            f"No applications found under {root}. Each app needs a "
+            f"doover_config.json with a `type` set.",
+            file=sys.stderr,
+        )
+        raise typer.Exit(1)
+
+    if as_json:
+        # Compact and on one line so it can be captured straight into a step output.
+        print(json.dumps(found, separators=(",", ":")))
+        raise typer.Exit(0)
+
+    for entry in found:
+        bits = [entry["type"] or "?", entry["language"] or "unknown language"]
+        if entry["widget"]:
+            bits.append("widget")
+        print(f"{entry['name']:<40} {entry['dir']:<24} {', '.join(bits)}")
+
+
+@app.command(name="registry-login")
+def registry_login(
+    app_fp: Annotated[
+        Path, typer.Argument(help="Path to the application directory.")
+    ] = Path(),
+    app_name: Annotated[
+        str | None,
+        typer.Option(help="Which app in doover_config.json, if it defines several."),
+    ] = None,
+    staging: Annotated[
+        bool | None,
+        typer.Option(help="Force staging mode. Defaults to matching the API URL."),
+    ] = None,
+):
+    """`docker login` to the Doover registry for this application.
+
+    For CI, which builds with buildx rather than `publish --build` and so needs
+    the credential in place beforehand. The token is scoped to this application's
+    repository only, and is piped straight into docker -- it is never printed, so
+    it cannot end up in a workflow log or a step output.
+
+    Publish the app first: the credential is minted against its publish
+    permission, and the repository comes from its registered image name.
+    """
+    client, _ = get_state()
+    root_fp = get_app_directory(app_fp)
+    app_config = get_app_config(root_fp, app_name=app_name)
+
+    app_id = _resolve_application_id(
+        client, app_config, staging=_resolve_staging(staging)
+    )
+    if app_id is None:
+        raise typer.BadParameter(
+            f"'{app_config.name}' does not exist yet. Run `doover app publish` "
+            f"before logging in to the registry."
+        )
+
+    target = login_for_push(client, app_id)
+    # Emitted so the build step can tag from the app's registered image name
+    # instead of the workflow repeating it.
+    publish_github_output(target)
+    print(f"Logged in to push {target}")
+
+
 @app.command(name="release")
 def release_command(
     app_fp: Annotated[

{doover_cli-0.6.1 → doover_cli-0.6.2}/src/doover_cli/login.py

@@ -5,6 +5,8 @@ from typer import Typer
 
 from doover_cli.api import DooverCLIAuthClient
 
+from .registry import register_credential_helper, registry_host
+
 from .utils.sentry import capture_handled_exception
 from .utils.state import state
 
@@ -47,3 +49,19 @@ def login(
     print(
         f"Successfully logged into Doover ({environment}). You can now run `doover ... --profile {profile_name}`."
     )
+
+    # Point docker at our credential helper so `docker pull`/`push` against the
+    # doover registry just work, with no `docker login` and no credentials
+    # written to disk. Best-effort: failing to edit the user's docker config is
+    # not a reason to fail the login.
+    try:
+        # Register the registry that belongs to the environment just logged into,
+        # so a staging login makes staging images pullable rather than production's.
+        if register_credential_helper(registry_host(auth.control_base_url)):
+            print(
+                "Configured docker to use your Doover login for "
+                f"{registry_host(auth.control_base_url)} images."
+            )
+    except Exception:
+        if state.debug:
+            raise

doover_cli-0.6.2/src/doover_cli/registry.py

@@ -0,0 +1,373 @@
+"""Docker integration for the doover container registry.
+
+Two things live here:
+
+* ``credential_helper`` -- the ``docker-credential-doover`` entry point. Docker
+  finds credential helpers by name on PATH, so installing the CLI is what makes
+  ``docker pull registry.doover.com/...`` work; there is nothing else to install
+  and no ``docker login`` to run. It hands docker the current session token, and
+  the registry's token realm reads the caller's permissions from their own
+  ``dv-registry`` channel -- so a user reaches exactly the apps they can reach in
+  the UI, resolved live.
+
+* ``login_for_push`` -- a ``docker login`` with a credential scoped to one
+  repository, for pushing a build. Push needs the narrow credential rather than
+  the session, because it is minted by the control plane against the app's
+  publish permission.
+
+The helper protocol is deliberately minimal: docker writes a registry host on
+stdin and expects ``{"ServerURL","Username","Secret"}`` on stdout for ``get``.
+
+Registering the helper for a host means docker routes *every* credential
+operation for it here, ``store`` included -- so the helper has to persist what
+``docker login`` gives it. It used to discard it, which silently defeated
+``login_for_push``: the scoped credential went nowhere and the subsequent push
+fell back to the session token. For a PUBLIC or CORE app that token carries no
+push scope at all (doover-control's ``entitlements_for_user`` excludes those
+apps), so the brokered credential is not an optimisation, it is the only thing
+that can push.
+"""
+
+from __future__ import annotations
+
+import base64
+import json
+import os
+import subprocess
+import sys
+import time
+
+
+class RegistryLoginError(RuntimeError):
+    """`docker login` to the registry failed, carrying what docker reported."""
+
+
+DEFAULT_REGISTRY = "registry.doover.com"
+
+
+def registry_host(control_base_url: str | None = None) -> str:
+    """The registry that belongs to a given control plane.
+
+    Derived rather than configured: every environment names its hosts the same
+    way, so api.doover.com pairs with registry.doover.com and
+    api.staging.udoover.com with registry.staging.udoover.com. Hardcoding the
+    production host meant a staging image was not recognised as ours, so no
+    credential was minted and the push failed with a bare 401.
+    """
+    if not control_base_url:
+        return DEFAULT_REGISTRY
+    host = control_base_url.split("://", 1)[-1].split("/", 1)[0].split(":")[0]
+    if host.startswith("api."):
+        return "registry." + host[len("api.") :]
+    return DEFAULT_REGISTRY
+
+
+def _docker_config_path():
+    from pathlib import Path
+
+    return Path.home() / ".docker" / "config.json"
+
+
+def register_credential_helper(registry: str = DEFAULT_REGISTRY) -> bool:
+    """Point docker at our helper for `registry`, leaving the rest of the file
+    alone. Returns True if the config was changed.
+
+    Merged rather than rewritten: this file is the user's, and usually holds
+    credentials for other registries.
+    """
+    path = _docker_config_path()
+    try:
+        config = json.loads(path.read_text()) if path.exists() else {}
+    except (OSError, ValueError):
+        # A malformed or unreadable config is the user's to fix; silently
+        # replacing it could lose their other registry credentials.
+        return False
+
+    helpers = config.setdefault("credHelpers", {})
+    if helpers.get(registry) == "doover":
+        return False
+
+    helpers[registry] = "doover"
+    path.parent.mkdir(parents=True, exist_ok=True)
+    path.write_text(json.dumps(config, indent=2) + "\n")
+    return True
+
+
+def _credential_store_path():
+    from pathlib import Path
+
+    return Path.home() / ".doover" / "registry-credentials.json"
+
+
+def _read_stored() -> dict:
+    try:
+        entries = json.loads(_credential_store_path().read_text())
+    except (OSError, ValueError):
+        # Nothing stored, or a file we did not write. Falling back to the session
+        # token is always safe; the worst case is a clear entitlement error.
+        return {}
+    return entries if isinstance(entries, dict) else {}
+
+
+def _write_stored(entries: dict) -> None:
+    path = _credential_store_path()
+    path.parent.mkdir(parents=True, exist_ok=True)
+    # 0600 from the moment it exists: these are bearer credentials for pushing
+    # images, so the mode cannot be applied as an afterthought.
+    fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
+    with os.fdopen(fd, "w", encoding="utf-8") as fh:
+        json.dump(entries, fh)
+
+
+def _seconds_until_expiry(secret: str) -> float | None:
+    """Seconds left on `secret`, or None if it carries no readable `exp`.
+
+    Decoded without verifying the signature: the realm is the only thing that
+    needs to trust this token, and all the helper needs to know is whether
+    handing it to docker is pointless. A credential that is not a JWT is treated
+    as non-expiring -- docker gave it to us, so it is not ours to second-guess.
+    """
+    try:
+        payload = secret.split(".")[1]
+        payload += "=" * (-len(payload) % 4)
+        exp = json.loads(base64.urlsafe_b64decode(payload))["exp"]
+        return float(exp) - time.time()
+    except (AttributeError, IndexError, KeyError, TypeError, ValueError):
+        return None
+
+
+# A push credential lives 30 minutes. Handing docker one with only seconds left
+# buys a failed request rather than a completed upload.
+EXPIRY_MARGIN_SECONDS = 30
+
+
+def _token_for_registry(server_url: str) -> str:
+    """A session token valid for `server_url`'s environment.
+
+    Docker hands the helper a registry host and nothing else -- no `--profile`,
+    no environment -- so the profile has to be recovered from that host.
+    Whichever profile's control plane pairs with this registry is the one holding
+    the right token, which is the same pairing `registry_host` applies going the
+    other way.
+
+    Matched on the derived host rather than the profile *name*: several profiles
+    routinely point at the same environment under different names, and a staging
+    push must not be signed with a production token. For the same reason every
+    match is tried rather than just the first -- a long-lived config accumulates
+    profiles whose refresh token has since been invalidated, and one of those
+    sitting earlier in the file must not mask the one that still works.
+    """
+    # Imported here, not at module scope: docker invokes this on every registry
+    # operation, and the CLI's import graph is far too heavy to pay for that.
+    from .api.session import DooverCLISession
+
+    def token_from(session) -> str:
+        session.auth.ensure_token()
+        if not session.auth.token:
+            # Returning an empty secret would make docker retry anonymously and
+            # report a 401 that looks like a permissions problem.
+            raise RuntimeError("session produced no token")
+        return session.auth.token
+
+    # Set in CI, where there is no profile config to read.
+    if os.environ.get("DOOVER_API_TOKEN"):
+        return token_from(DooverCLISession.from_env())
+
+    # GitHub Actions with no stored token: the CLI authenticates over the
+    # trusted-publisher OIDC flow, and there is no profile to match on. A push
+    # never reaches here -- `docker login` stores the brokered credential and the
+    # `get` above serves it -- but a *pull* does, and without this the helper
+    # falls through to a profile config that does not exist on a runner.
+    from .utils.api import _trusted_publisher_provider
+
+    provider = _trusted_publisher_provider()
+    if provider:
+        control_url = os.environ.get("DOOVER_CONTROL_API_BASE_URL")
+        # Same host check as the profile path below: a workflow targeting one
+        # environment must not hand its token to another environment's registry.
+        if registry_host(control_url) != server_url:
+            raise RuntimeError(
+                f"this workflow targets {control_url or 'production'}, which does "
+                f"not serve {server_url}"
+            )
+        return token_from(
+            DooverCLISession.from_trusted_publisher(
+                provider=provider,
+                audience=os.environ.get("DOOVER_OIDC_AUDIENCE"),
+                control_base_url=control_url,
+            )
+        )
+
+    from pydoover.api.auth import ConfigManager
+
+    manager = ConfigManager()
+    candidates = []
+    for name, profile in manager.entries.items():
+        control_url = profile.control_base_url
+        if not profile.token or not control_url:
+            continue
+        host = control_url.split("://", 1)[-1].split("/", 1)[0].split(":")[0]
+        # `registry_host` falls back to production for anything that isn't an
+        # `api.` host, so a local profile would otherwise answer for
+        # registry.doover.com.
+        if host.startswith("api.") and registry_host(control_url) == server_url:
+            candidates.append(name)
+
+    if not candidates:
+        raise RuntimeError(f"no logged-in profile has a control plane for {server_url}")
+
+    failures = []
+    for name in candidates:
+        try:
+            session = DooverCLISession.from_profile(name, config_manager=manager)
+            session.auth.ensure_token()
+        except Exception as e:  # noqa: BLE001 - try the next profile
+            failures.append(f"{name}: {e}")
+            continue
+        if session.auth.token:
+            return session.auth.token
+        failures.append(f"{name}: no token after refresh")
+
+    raise RuntimeError("; ".join(failures))
+
+
+def credential_helper() -> None:
+    """`docker-credential-doover` entry point.
+
+    Never prompts. Docker captures stdin and stdout, so an interactive login
+    would hang the pull; and returning empty credentials would make docker retry
+    anonymously and report a misleading 401. So a missing session exits non-zero
+    with an explanation on stderr instead.
+    """
+    verb = sys.argv[1] if len(sys.argv) > 1 else ""
+
+    # `docker login` sends the credential here as JSON. Keeping it is what makes
+    # a repo-scoped push credential survive to the push.
+    if verb == "store":
+        try:
+            entry = json.loads(sys.stdin.read())
+        except ValueError as e:
+            print(f"doover: malformed credential on stdin ({e})", file=sys.stderr)
+            raise SystemExit(1) from e
+        entries = _read_stored()
+        entries[entry.get("ServerURL") or DEFAULT_REGISTRY] = {
+            "Username": entry.get("Username") or "doover",
+            "Secret": entry.get("Secret") or "",
+        }
+        _write_stored(entries)
+        return
+
+    # `docker logout` sends the bare host.
+    if verb == "erase":
+        entries = _read_stored()
+        if entries.pop(sys.stdin.read().strip(), None) is not None:
+            _write_stored(entries)
+        return
+
+    if verb == "list":
+        print(
+            json.dumps(
+                {
+                    server: entry.get("Username", "doover")
+                    for server, entry in _read_stored().items()
+                }
+            )
+        )
+        return
+    if verb != "get":
+        print(f"unknown verb: {verb!r}", file=sys.stderr)
+        raise SystemExit(2)
+
+    server_url = sys.stdin.read().strip() or DEFAULT_REGISTRY
+
+    # A stored credential wins over the session token: it is the narrow one the
+    # control plane brokered for a specific repository, and for a public or core
+    # app it is the only one that carries push at all.
+    stored = _read_stored().get(server_url)
+    if stored:
+        remaining = _seconds_until_expiry(stored.get("Secret", ""))
+        if remaining is None or remaining > EXPIRY_MARGIN_SECONDS:
+            print(
+                json.dumps(
+                    {
+                        "ServerURL": server_url,
+                        "Username": stored.get("Username", "doover"),
+                        "Secret": stored.get("Secret", ""),
+                    }
+                )
+            )
+            return
+        # Dropped rather than kept and skipped, so a dead push credential cannot
+        # keep shadowing the session token that would still serve pulls.
+        entries = _read_stored()
+        entries.pop(server_url, None)
+        _write_stored(entries)
+
+    try:
+        token = _token_for_registry(server_url)
+    except Exception as e:  # noqa: BLE001 - any failure means "not logged in"
+        print(
+            f"doover: no usable session for {server_url} ({e}).\n"
+            f"Run `doover login` and try again.",
+            file=sys.stderr,
+        )
+        raise SystemExit(1) from e
+
+    # The username is a label only -- the realm resolves the agent from the
+    # token's claims and ignores it.
+    print(json.dumps({"ServerURL": server_url, "Username": "doover", "Secret": token}))
+
+
+def is_doover_registry(
+    image_name: str | None, control_base_url: str | None = None
+) -> bool:
+    """Whether an image lives on this environment's doover registry, and so needs
+    a credential minted by the control plane rather than the user's own docker
+    login."""
+    if not image_name:
+        return False
+    host = image_name.split("/", 1)[0].split(":")[0].lower()
+    return host == registry_host(control_base_url)
+
+
+def publish_github_output(image: str) -> None:
+    """Expose the image reference to later workflow steps.
+
+    Lets a workflow stay identical across app repos: the reference comes from the
+    app's own doover_config.json rather than being spelled out in the yaml, which
+    also removes the chance of it drifting from the registered image name.
+    """
+    output_path = os.environ.get("GITHUB_OUTPUT")
+    if not output_path:
+        return
+    try:
+        with open(output_path, "a", encoding="utf-8") as fh:
+            fh.write(f"image={image}\n")
+    except OSError as e:
+        print(f"could not write GITHUB_OUTPUT: {e}", file=sys.stderr)
+
+
+def login_for_push(control_client, application_id: int | str) -> str:
+    """`docker login` with a credential scoped to one application's repository.
+
+    Returns the repository path to push to. Raises if the app does not publish to
+    the doover registry, which is what stops a stale config pushing into a
+    repository nothing will pull.
+    """
+    result = control_client.mint_registry_token(application_id)
+    registry = result["registry"]
+    completed = subprocess.run(
+        ["docker", "login", registry, "-u", result["username"], "--password-stdin"],
+        input=result["password"],
+        text=True,
+        capture_output=True,
+    )
+    if completed.returncode != 0:
+        # Surface what docker said. Swallowing it leaves only a
+        # CalledProcessError, which says nothing about whether the registry was
+        # unreachable, the certificate was wrong, or the token was rejected.
+        detail = (completed.stderr or completed.stdout or "").strip()
+        raise RegistryLoginError(
+            f"docker login to {registry} failed: {detail or 'no output from docker'}"
+        )
+    return f"{registry}/{result['repository']}"