ellf-cli 4.0.41__tar.gz → 4.0.44__tar.gz

{ellf_cli-4.0.41/ellf_cli.egg-info → ellf_cli-4.0.44}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ellf-cli
-Version: 4.0.41
+Version: 4.0.44
 Summary: Ellf Command Line Interface
 Home-page: https://prodi.gy
 Author: ExplosionAI GmbH

{ellf_cli-4.0.41 → ellf_cli-4.0.44}/ellf_cli/about.json

@@ -1,7 +1,7 @@
 {
   "title": "Ellf CLI",
   "name": "ellf-cli",
-  "version": "4.0.41",
+  "version": "4.0.44",
   "summary": "Ellf Command Line Interface",
   "uri": "https://prodi.gy",
   "prog": "ellf",

{ellf_cli-4.0.41 → ellf_cli-4.0.44}/ellf_cli/auth.py

@@ -58,6 +58,12 @@ _R = TypeVar("_R")
 OIDC_SCOPE = "openid profile email"
 OIDC_DEVICE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code"
 AUTH_WAIT_TIME_SECONDS = 60 * 5
+# httpx default is 5s — too tight for the auth round-trip when PAM's
+# load balancer occasionally takes longer than that to respond. A
+# transient network blip during login should not require the user to
+# re-run; pick a value that comfortably outlasts any realistic single
+# request without making a genuinely-down PAM hang noticeably.
+AUTH_REQUEST_TIMEOUT_SECONDS = 15.0
 
 
 class Secrets(Protocol):
@@ -385,6 +391,7 @@ class AuthStateImpl:
             api_response = httpx.post(
                 str(self.pam_url / "api/v1/login"),
                 headers={"authorization": f"Bearer {id_token}"},
+                timeout=AUTH_REQUEST_TIMEOUT_SECONDS,
             )
             if api_response.status_code != 200:
                 err = _format_http_error(api_response)
@@ -426,6 +433,7 @@ class AuthStateImpl:
                 str(self.pam_url / "api/v1/broker/token"),
                 headers={"authorization": f"Bearer {api_token}"},
                 json=body,
+                timeout=AUTH_REQUEST_TIMEOUT_SECONDS,
             )
             if res.status_code != 200:
                 err = _format_http_error(res)
@@ -440,6 +448,7 @@ class AuthStateImpl:
             exchange_res = httpx.post(
                 str(self.broker_url / "api/v1/token/exchange"),
                 json={"token": pam_broker_token},
+                timeout=AUTH_REQUEST_TIMEOUT_SECONDS,
             )
             if exchange_res.status_code != 200:
                 err = _format_http_error(exchange_res)
@@ -459,7 +468,10 @@ class AuthStateImpl:
 
     def _authenticate_device_and_get_id_token(self) -> str:
         try:
-            config_response = httpx.get(str(self.pam_url / "api/v1/cli.json"))
+            config_response = httpx.get(
+                str(self.pam_url / "api/v1/cli.json"),
+                timeout=AUTH_REQUEST_TIMEOUT_SECONDS,
+            )
             config_response.raise_for_status()
         except httpx.HTTPError as exc:
             err = Messages.E033.format(url=self.pam_url)
@@ -467,7 +479,11 @@ class AuthStateImpl:
             raise EllfError(err) from exc
         device_code_url = str(self.pam_url / "api/v1/device/code")
         token_url = str(self.pam_url / "api/v1/device/token")
-        response = httpx.post(device_code_url, json={"scope": OIDC_SCOPE})
+        response = httpx.post(
+            device_code_url,
+            json={"scope": OIDC_SCOPE},
+            timeout=AUTH_REQUEST_TIMEOUT_SECONDS,
+        )
         if response.status_code != 200:
             error_resp = response.json()
             raise CLIError(Messages.E101, error_resp)
@@ -489,6 +505,7 @@ class AuthStateImpl:
                         "grant_type": OIDC_DEVICE_GRANT_TYPE,
                         "device_code": device_code,
                     },
+                    timeout=AUTH_REQUEST_TIMEOUT_SECONDS,
                 )
                 last_check = time.time()
                 token_data = token_response.json()

{ellf_cli-4.0.41 → ellf_cli-4.0.44}/ellf_cli/commands/infra/tls.py

@@ -11,6 +11,7 @@ from radicli import Arg
 from wasabi.printer import Printer
 
 from ...cli import cli
+from ...util import URL
 
 
 class FilePrinter(Printer):
@@ -284,10 +285,19 @@ def _print_trust_commands(ca_path: Path, output_format: str = "human") -> None:
 
 
 def _self_signed(fqdn: str, namespace: str) -> None:
-    """Create a self-signed CA and leaf cert, update ingress."""
+    """Create a self-signed CA and leaf cert, update ingress.
+
+    Accept fqdn with or without a port (e.g. "localhost" or
+    "localhost:8443" for BYOC tunnel setups). K8s Ingress hosts and
+    cert dnsNames are RFC 1123 hostnames — the port has to be stripped
+    before they're used. Mirrors the chart's ``ellf.brokerHostname``
+    helper so the CLI accepts the same flag value users pass to
+    ``infra register --domain``.
+    """
+    hostname = URL.parse(fqdn, scheme="https").hostname
     _create_self_signed_ca()
-    _issue_leaf_cert(fqdn, namespace)
-    _update_ingress_tls(fqdn, namespace)
+    _issue_leaf_cert(hostname, namespace)
+    _update_ingress_tls(hostname, namespace)
 
 
 def _run_via_ssh(host: str, command: str) -> str:

{ellf_cli-4.0.41 → ellf_cli-4.0.44}/ellf_cli/ellf.json

@@ -1,7 +1,7 @@
 {
   "prog": "ellf",
   "help": "Ellf Command Line Interface.",
-  "version": "4.0.40",
+  "version": "4.0.43",
   "extra_key": "_extra",
   "commands": {
     "actions": {

{ellf_cli-4.0.41 → ellf_cli-4.0.44/ellf_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ellf-cli
-Version: 4.0.41
+Version: 4.0.44
 Summary: Ellf Command Line Interface
 Home-page: https://prodi.gy
 Author: ExplosionAI GmbH