envpass-cli 0.1.3__tar.gz

envpass_cli-0.1.3/PKG-INFO

@@ -0,0 +1,50 @@
+Metadata-Version: 2.4
+Name: envpass-cli
+Version: 0.1.3
+Summary: Client and CLI for envpass: encrypted environment variables for every project, service and environment.
+Keywords: env,dotenv,secrets,environment-variables,cli,envpass
+License-Expression: MIT
+Classifier: Programming Language :: Python :: 3
+Classifier: Environment :: Console
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Build Tools
+Requires-Python: >=3.9
+Project-URL: Homepage, https://envpass.dev
+Project-URL: Documentation, https://envpass.dev/docs
+Description-Content-Type: text/markdown
+
+# envpass-cli
+
+Python client and CLI for [envpass](https://envpass.dev): encrypted environment variables for every project, service and environment. No dependencies.
+
+## CLI
+
+```bash
+uvx envpass-cli login                         # sign in through your browser
+uvx envpass-cli link -w acme -p shop -e dev   # save defaults to .envpass.json (no secrets inside)
+uvx envpass-cli pull                          # write .env
+uvx envpass-cli pull -e prod -o -             # print to stdout
+uvx envpass-cli run -e dev -- python app.py   # run with values injected, masked in output
+```
+
+`pipx run envpass-cli …` and `pip install envpass-cli` work too.
+
+In CI, use a service token instead of `login`:
+
+```bash
+ENVPASS_TOKEN=ep_live_… uvx envpass-cli pull -e prod
+```
+
+Options can also come from `ENVPASS_WORKSPACE`, `ENVPASS_PROJECT`, `ENVPASS_ENV`, `ENVPASS_SERVICE` and `ENVPASS_URL`.
+
+## Library
+
+```python
+from envpass import Envpass, load_env
+
+load_env("prod")
+
+client = Envpass(token="ep_live_…")
+entries = client.resolve({"environment": "prod", "service": "api"})
+workspaces = client.request("GET", "/api/v1/workspaces")
+```

envpass_cli-0.1.3/README.md

@@ -0,0 +1,35 @@
+# envpass-cli
+
+Python client and CLI for [envpass](https://envpass.dev): encrypted environment variables for every project, service and environment. No dependencies.
+
+## CLI
+
+```bash
+uvx envpass-cli login                         # sign in through your browser
+uvx envpass-cli link -w acme -p shop -e dev   # save defaults to .envpass.json (no secrets inside)
+uvx envpass-cli pull                          # write .env
+uvx envpass-cli pull -e prod -o -             # print to stdout
+uvx envpass-cli run -e dev -- python app.py   # run with values injected, masked in output
+```
+
+`pipx run envpass-cli …` and `pip install envpass-cli` work too.
+
+In CI, use a service token instead of `login`:
+
+```bash
+ENVPASS_TOKEN=ep_live_… uvx envpass-cli pull -e prod
+```
+
+Options can also come from `ENVPASS_WORKSPACE`, `ENVPASS_PROJECT`, `ENVPASS_ENV`, `ENVPASS_SERVICE` and `ENVPASS_URL`.
+
+## Library
+
+```python
+from envpass import Envpass, load_env
+
+load_env("prod")
+
+client = Envpass(token="ep_live_…")
+entries = client.resolve({"environment": "prod", "service": "api"})
+workspaces = client.request("GET", "/api/v1/workspaces")
+```

envpass_cli-0.1.3/pyproject.toml

@@ -0,0 +1,63 @@
+[project]
+name = "envpass-cli"
+version = "0.1.3"
+description = "Client and CLI for envpass: encrypted environment variables for every project, service and environment."
+readme = "README.md"
+license = "MIT"
+requires-python = ">=3.9"
+dependencies = []
+keywords = [
+    "env",
+    "dotenv",
+    "secrets",
+    "environment-variables",
+    "cli",
+    "envpass",
+]
+classifiers = [
+    "Programming Language :: Python :: 3",
+    "Environment :: Console",
+    "Topic :: Security",
+    "Topic :: Software Development :: Build Tools",
+]
+
+[project.urls]
+Homepage = "https://envpass.dev"
+Documentation = "https://envpass.dev/docs"
+
+[project.scripts]
+envpass = "envpass.cli:main"
+envpass-cli = "envpass.cli:main"
+
+[tool.uv.build-backend]
+module-name = "envpass"
+
+[tool.ruff]
+line-length = 100
+target-version = "py39"
+
+[tool.ruff.lint]
+select = [
+    "E",
+    "F",
+    "I",
+    "UP",
+    "B",
+    "SIM",
+]
+
+[tool.mypy]
+strict = true
+python_version = "3.10"
+files = ["src"]
+
+[build-system]
+requires = ["uv_build>=0.9,<0.14"]
+build-backend = "uv_build"
+
+[dependency-groups]
+dev = [
+    "pytest>=8",
+    "ruff>=0.8",
+    "mypy>=1.13",
+]

envpass_cli-0.1.3/pyproject.toml.orig

@@ -0,0 +1,45 @@
+[project]
+name = "envpass-cli"
+version = "0.1.3"
+description = "Client and CLI for envpass: encrypted environment variables for every project, service and environment."
+readme = "README.md"
+license = "MIT"
+requires-python = ">=3.9"
+dependencies = []
+keywords = ["env", "dotenv", "secrets", "environment-variables", "cli", "envpass"]
+classifiers = [
+  "Programming Language :: Python :: 3",
+  "Environment :: Console",
+  "Topic :: Security",
+  "Topic :: Software Development :: Build Tools",
+]
+
+[project.urls]
+Homepage = "https://envpass.dev"
+Documentation = "https://envpass.dev/docs"
+
+[project.scripts]
+envpass = "envpass.cli:main"
+envpass-cli = "envpass.cli:main"
+
+[tool.uv.build-backend]
+module-name = "envpass"
+
+[build-system]
+requires = ["uv_build>=0.9,<0.14"]
+build-backend = "uv_build"
+
+[dependency-groups]
+dev = ["pytest>=8", "ruff>=0.8", "mypy>=1.13"]
+
+[tool.ruff]
+line-length = 100
+target-version = "py39"
+
+[tool.ruff.lint]
+select = ["E", "F", "I", "UP", "B", "SIM"]
+
+[tool.mypy]
+strict = true
+python_version = "3.10"
+files = ["src"]

envpass_cli-0.1.3/src/envpass/__init__.py

@@ -0,0 +1,20 @@
+from __future__ import annotations
+
+from ._version import __version__
+from .client import Envpass, EnvpassError, ExportFormat, Me, ResolvedEntry, Source, load_env
+from .config import DEFAULT_URL, ProjectLink
+from .mask import mask_text
+
+__all__ = [
+    "DEFAULT_URL",
+    "Envpass",
+    "EnvpassError",
+    "ExportFormat",
+    "Me",
+    "ProjectLink",
+    "ResolvedEntry",
+    "Source",
+    "__version__",
+    "load_env",
+    "mask_text",
+]

envpass_cli-0.1.3/src/envpass/__main__.py

@@ -0,0 +1,3 @@
+from .cli import main
+
+raise SystemExit(main())

envpass_cli-0.1.3/src/envpass/_version.py

@@ -0,0 +1,8 @@
+from __future__ import annotations
+
+from importlib.metadata import PackageNotFoundError, version
+
+try:
+    __version__ = version("envpass-cli")
+except PackageNotFoundError:
+    __version__ = "0.0.0"

envpass_cli-0.1.3/src/envpass/cli.py

@@ -0,0 +1,212 @@
+from __future__ import annotations
+
+import argparse
+import contextlib
+import json
+import os
+import signal
+import subprocess
+import sys
+import threading
+from typing import IO, Any
+
+from ._version import __version__
+from .client import Envpass, EnvpassError
+from .config import (
+    ProjectLink,
+    base_url,
+    forget_token,
+    resolve_scope,
+    save_token,
+    stored_token,
+    write_project_link,
+)
+from .device import device_login, open_browser
+from .mask import Masker
+
+NOT_SIGNED_IN = "Not signed in. Run `envpass login` or set ENVPASS_TOKEN."
+
+
+def _fail(message: str, code: int = 1) -> int:
+    print(f"envpass: {message}", file=sys.stderr)
+    return code
+
+
+def _parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(
+        prog="envpass",
+        description="Encrypted environment variables for every project, service and environment.",
+    )
+    parser.add_argument("--version", action="version", version=__version__)
+    parser.add_argument(
+        "--url", help="envpass server (default https://envpass.dev, or ENVPASS_URL)"
+    )
+    scope = argparse.ArgumentParser(add_help=False)
+    scope.add_argument("-w", "--workspace", help="workspace slug")
+    scope.add_argument("-p", "--project", help="project slug")
+    scope.add_argument("-e", "--env", dest="environment", help="environment slug, e.g. dev or prod")
+    scope.add_argument("-s", "--service", help='service slug, or "shared"')
+    scope.add_argument("--url", dest="url_sub", help=argparse.SUPPRESS)
+
+    commands = parser.add_subparsers(dest="command", metavar="command")
+    login = commands.add_parser("login", help="sign in through your browser", parents=[scope])
+    login.add_argument(
+        "--no-browser", action="store_true", help="print the link instead of opening a browser"
+    )
+    commands.add_parser("logout", help="forget the saved login", parents=[scope])
+    commands.add_parser("whoami", help="show who the current token belongs to", parents=[scope])
+    commands.add_parser("link", help="save defaults to .envpass.json", parents=[scope])
+    pull = commands.add_parser("pull", help="write resolved values to a file", parents=[scope])
+    pull.add_argument("-o", "--out", default=".env", help='output file, or "-" for stdout')
+    pull.add_argument("-f", "--format", default="dotenv", choices=["dotenv", "shell", "json"])
+    run = commands.add_parser("run", help="run a command with the values injected", parents=[scope])
+    run.add_argument("--no-mask", action="store_true", help="show secret values in the output")
+    run.add_argument("cmd", nargs=argparse.REMAINDER, help="-- command [args...]")
+    return parser
+
+
+def _pump(source: IO[bytes], target: Any, masker: Masker) -> None:
+    while True:
+        chunk = os.read(source.fileno(), 65536)
+        if not chunk:
+            break
+        text = masker.feed(chunk.decode("utf-8", "replace"))
+        if text:
+            target.write(text)
+            target.flush()
+    rest = masker.flush()
+    if rest:
+        target.write(rest)
+        target.flush()
+
+
+def _run(client: Envpass, scope: ProjectLink, cmd: list[str], mask: bool) -> int:
+    if cmd and cmd[0] == "--":
+        cmd = cmd[1:]
+    if not cmd:
+        return _fail("Usage: envpass run [-e env] -- <command> [args...]")
+    entries = client.resolve(scope)
+    env = {**os.environ, **{entry["key"]: entry["value"] for entry in entries}}
+    try:
+        if not mask:
+            return subprocess.call(cmd, env=env)
+        process = subprocess.Popen(cmd, env=env, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
+    except FileNotFoundError:
+        return _fail(f"Could not start {cmd[0]}: command not found", 127)
+    secrets = [entry["value"] for entry in entries]
+    threads = [
+        threading.Thread(target=_pump, args=(process.stdout, sys.stdout, Masker(secrets))),
+        threading.Thread(target=_pump, args=(process.stderr, sys.stderr, Masker(secrets))),
+    ]
+    for thread in threads:
+        thread.start()
+
+    def forward(signum: int, _frame: object) -> None:
+        process.send_signal(signum)
+
+    signal.signal(signal.SIGINT, forward)
+    signal.signal(signal.SIGTERM, forward)
+    code = process.wait()
+    for thread in threads:
+        thread.join()
+    return code if code >= 0 else 128 - code
+
+
+def main(argv: list[str] | None = None) -> int:
+    args = _parser().parse_args(argv)
+    if not args.command:
+        _parser().print_help()
+        return 0
+    url = base_url(getattr(args, "url_sub", None) or args.url)
+    flags = ProjectLink(
+        workspace=args.workspace,
+        project=args.project,
+        environment=args.environment,
+        service=args.service,
+    )
+    try:
+        if args.command == "login":
+
+            def show(code: dict[str, Any]) -> None:
+                link = code.get("verification_uri_complete") or code["verification_uri"]
+                message = f"\nOpen {link}\nand confirm the code: {code['user_code']}\n"
+                print(f"{message}\nWaiting for approval…", file=sys.stderr)
+                if not args.no_browser:
+                    open_browser(link)
+
+            token = device_login(url, show)
+            path = save_token(url, token)
+            me = Envpass(url, token).me()
+            print(f"Signed in. Token saved to {path}", file=sys.stderr)
+            if me["workspaces"]:
+                slugs = ", ".join(w["slug"] for w in me["workspaces"])
+                print(f"Workspaces: {slugs}", file=sys.stderr)
+            return 0
+
+        if args.command == "logout":
+            saved = stored_token(url)
+            if saved:
+                with contextlib.suppress(EnvpassError):
+                    Envpass(url, saved).request("POST", "/api/auth/sign-out", body={})
+            removed = forget_token(url)
+            print(
+                f"Signed out of {url}" if removed else f"No saved login for {url}", file=sys.stderr
+            )
+            return 0
+
+        if args.command == "link":
+            scope = resolve_scope(flags)
+            if not scope.get("workspace") or not scope.get("project"):
+                return _fail("Pass --workspace and --project.")
+            path = write_project_link(scope)
+            print(f"Saved {path}. It holds no secrets and is safe to commit.", file=sys.stderr)
+            return 0
+
+        client = Envpass(url)
+        if not client.has_token:
+            return _fail(NOT_SIGNED_IN)
+
+        if args.command == "whoami":
+            me = client.me()
+            token_info = me["token"]
+            if token_info:
+                print(
+                    f"Service token {token_info['id']} ({token_info['access']}) "
+                    f"for project {token_info['projectId']}"
+                )
+            else:
+                print(f"User {me['userId']}")
+                for ws in me["workspaces"]:
+                    print(f"  {ws['slug']}{' (owner)' if ws['isOwner'] else ''}")
+            return 0
+
+        if args.command == "pull":
+            if args.format == "json":
+                values = {e["key"]: e["value"] for e in client.resolve(flags)}
+                text = json.dumps(values, indent=2) + "\n"
+            else:
+                text = client.resolve_text(flags, args.format)
+            if args.out == "-":
+                sys.stdout.write(text)
+                return 0
+            fd = os.open(args.out, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
+            with os.fdopen(fd, "w", encoding="utf-8") as handle:
+                handle.write(text)
+            count = sum(1 for line in text.splitlines() if "=" in line or ":" in line)
+            print(f"Wrote {args.out} ({count} values). Keep it out of git.", file=sys.stderr)
+            return 0
+
+        if args.command == "run":
+            return _run(client, flags, list(args.cmd), not args.no_mask)
+
+        return _fail(f'Unknown command "{args.command}". Run `envpass --help`.')
+    except EnvpassError as error:
+        return _fail(f"{error}{f' ({error.code})' if error.code else ''}")
+    except (RuntimeError, ValueError) as error:
+        return _fail(str(error))
+    except KeyboardInterrupt:
+        return 130
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

envpass_cli-0.1.3/src/envpass/client.py

@@ -0,0 +1,156 @@
+from __future__ import annotations
+
+import json
+import os
+import urllib.error
+import urllib.parse
+import urllib.request
+from typing import Any, Literal, TypedDict
+
+from ._version import __version__
+from .config import ProjectLink, base_url, resolve_scope, resolve_token
+
+Source = Literal["shared", "service", "personal"]
+ExportFormat = Literal["dotenv", "json", "shell"]
+
+
+class ResolvedEntry(TypedDict):
+    key: str
+    value: str
+    source: Source
+
+
+class Workspace(TypedDict):
+    id: str
+    name: str
+    slug: str
+    isOwner: bool
+
+
+class TokenInfo(TypedDict):
+    id: str
+    workspaceId: str
+    projectId: str
+    serviceId: str | None
+    access: Literal["read", "write"]
+
+
+class Me(TypedDict):
+    actor: Literal["user", "token"]
+    userId: str
+    token: TokenInfo | None
+    workspaces: list[Workspace]
+
+
+class EnvpassError(Exception):
+    def __init__(self, message: str, status: int, code: str | None = None) -> None:
+        super().__init__(message)
+        self.status = status
+        self.code = code
+
+
+class Envpass:
+    def __init__(
+        self,
+        base_url_: str | None = None,
+        token: str | None = None,
+        user_agent: str | None = None,
+        timeout: float = 30.0,
+    ) -> None:
+        self.url = base_url(base_url_)
+        self.token = resolve_token(self.url, token)
+        self.timeout = timeout
+        self.user_agent = user_agent or f"envpass-python/{__version__}"
+
+    @property
+    def has_token(self) -> bool:
+        return bool(self.token)
+
+    def request(
+        self,
+        method: str,
+        path: str,
+        query: dict[str, str | None] | None = None,
+        body: Any = None,
+        raw: bool = False,
+    ) -> Any:
+        url = f"{self.url}{path}"
+        params = {k: v for k, v in (query or {}).items() if v}
+        if params:
+            url = f"{url}?{urllib.parse.urlencode(params)}"
+        headers = {"user-agent": self.user_agent, "accept": "application/json"}
+        if self.token:
+            headers["authorization"] = f"Bearer {self.token}"
+        data = None
+        if body is not None:
+            data = json.dumps(body).encode("utf-8")
+            headers["content-type"] = "application/json"
+        request = urllib.request.Request(url, data=data, method=method, headers=headers)
+        try:
+            with urllib.request.urlopen(request, timeout=self.timeout) as response:
+                text = response.read().decode("utf-8")
+        except urllib.error.HTTPError as error:
+            payload = error.read().decode("utf-8", "replace")
+            try:
+                detail = json.loads(payload).get("error", {})
+            except ValueError:
+                detail = {}
+            raise EnvpassError(
+                detail.get("message") or f"Request failed with status {error.code}",
+                error.code,
+                detail.get("code"),
+            ) from None
+        except urllib.error.URLError as error:
+            raise EnvpassError(f"Could not reach {self.url}: {error.reason}", 0) from None
+        return text if raw else json.loads(text)
+
+    def me(self) -> Me:
+        result: Me = self.request("GET", "/api/v1/me")
+        return result
+
+    def _scope_query(self, scope: ProjectLink | None) -> dict[str, str | None]:
+        resolved = resolve_scope(scope or {})
+        if not resolved.get("environment"):
+            raise EnvpassError(
+                "No environment. Pass --env, set ENVPASS_ENV, or run `envpass link`.",
+                400,
+                "invalid",
+            )
+        return {
+            "workspace": resolved.get("workspace"),
+            "project": resolved.get("project"),
+            "environment": resolved.get("environment"),
+            "service": resolved.get("service"),
+        }
+
+    def resolve(self, scope: ProjectLink | None = None) -> list[ResolvedEntry]:
+        query = {**self._scope_query(scope), "format": "json"}
+        result: list[ResolvedEntry] = self.request("GET", "/api/v1/resolve", query)["entries"]
+        return result
+
+    def resolve_text(
+        self, scope: ProjectLink | None = None, fmt: Literal["dotenv", "shell"] = "dotenv"
+    ) -> str:
+        query = {**self._scope_query(scope), "format": fmt}
+        text: str = self.request("GET", "/api/v1/resolve", query, raw=True)
+        return text
+
+
+def load_env(
+    environment: str | None = None,
+    *,
+    workspace: str | None = None,
+    project: str | None = None,
+    service: str | None = None,
+    token: str | None = None,
+    base_url_: str | None = None,
+    override: bool = False,
+) -> dict[str, str]:
+    client = Envpass(base_url_, token)
+    entries = client.resolve(
+        ProjectLink(workspace=workspace, project=project, environment=environment, service=service)
+    )
+    for entry in entries:
+        if override or entry["key"] not in os.environ:
+            os.environ[entry["key"]] = entry["value"]
+    return {entry["key"]: entry["value"] for entry in entries}

envpass_cli-0.1.3/src/envpass/config.py

@@ -0,0 +1,120 @@
+from __future__ import annotations
+
+import json
+import os
+from pathlib import Path
+from typing import TypedDict
+
+DEFAULT_URL = "https://envpass.dev"
+PROJECT_FILE = ".envpass.json"
+
+
+class ProjectLink(TypedDict, total=False):
+    workspace: str | None
+    project: str | None
+    environment: str | None
+    service: str | None
+
+
+def base_url(explicit: str | None = None) -> str:
+    return (explicit or os.environ.get("ENVPASS_URL") or DEFAULT_URL).rstrip("/")
+
+
+def _credentials_path() -> Path:
+    root = os.environ.get("XDG_CONFIG_HOME") or str(Path.home() / ".config")
+    return Path(root) / "envpass" / "credentials.json"
+
+
+def _read_credentials() -> dict[str, dict[str, str]]:
+    path = _credentials_path()
+    if not path.exists():
+        return {}
+    try:
+        data = json.loads(path.read_text("utf-8"))
+    except (OSError, ValueError):
+        return {}
+    return data if isinstance(data, dict) else {}
+
+
+def _write_credentials(credentials: dict[str, dict[str, str]]) -> Path:
+    path = _credentials_path()
+    path.parent.mkdir(parents=True, exist_ok=True, mode=0o700)
+    fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
+    with os.fdopen(fd, "w", encoding="utf-8") as handle:
+        handle.write(json.dumps(credentials, indent=2) + "\n")
+    os.chmod(path, 0o600)
+    return path
+
+
+def save_token(url: str, token: str) -> Path:
+    from datetime import datetime, timezone
+
+    credentials = _read_credentials()
+    credentials[url] = {"token": token, "savedAt": datetime.now(timezone.utc).isoformat()}
+    return _write_credentials(credentials)
+
+
+def forget_token(url: str) -> bool:
+    credentials = _read_credentials()
+    if url not in credentials:
+        return False
+    del credentials[url]
+    if credentials:
+        _write_credentials(credentials)
+    else:
+        _credentials_path().unlink(missing_ok=True)
+    return True
+
+
+def stored_token(url: str) -> str | None:
+    entry = _read_credentials().get(url)
+    return entry.get("token") if isinstance(entry, dict) else None
+
+
+def resolve_token(url: str, explicit: str | None = None) -> str | None:
+    return explicit or os.environ.get("ENVPASS_TOKEN") or stored_token(url)
+
+
+def find_project_file(start: Path | None = None) -> Path | None:
+    directory = (start or Path.cwd()).resolve()
+    for candidate_dir in [directory, *directory.parents]:
+        candidate = candidate_dir / PROJECT_FILE
+        if candidate.exists():
+            return candidate
+    return None
+
+
+def read_project_link(start: Path | None = None) -> ProjectLink:
+    path = find_project_file(start)
+    if path is None:
+        return {}
+    try:
+        data = json.loads(path.read_text("utf-8"))
+    except ValueError as error:
+        raise ValueError(f"{path} is not valid JSON") from error
+    if not isinstance(data, dict):
+        return {}
+    link: ProjectLink = {}
+    for key in ("workspace", "project", "environment", "service"):
+        value = data.get(key)
+        if isinstance(value, str):
+            link[key] = value  # type: ignore[literal-required,unused-ignore]
+    return link
+
+
+def write_project_link(link: ProjectLink, directory: Path | None = None) -> Path:
+    path = (directory or Path.cwd()) / PROJECT_FILE
+    clean = {k: v for k, v in link.items() if v}
+    path.write_text(json.dumps(clean, indent=2) + "\n", "utf-8")
+    return path
+
+
+def resolve_scope(flags: ProjectLink, start: Path | None = None) -> ProjectLink:
+    file = read_project_link(start)
+    env = os.environ
+    return ProjectLink(
+        workspace=flags.get("workspace") or env.get("ENVPASS_WORKSPACE") or file.get("workspace"),
+        project=flags.get("project") or env.get("ENVPASS_PROJECT") or file.get("project"),
+        environment=flags.get("environment") or env.get("ENVPASS_ENV") or file.get("environment"),
+        service=flags.get("service") or env.get("ENVPASS_SERVICE") or file.get("service"),
+    )

envpass_cli-0.1.3/src/envpass/device.py

@@ -0,0 +1,73 @@
+from __future__ import annotations
+
+import json
+import time
+import urllib.error
+import urllib.request
+import webbrowser
+from typing import Any, Callable
+
+CLI_CLIENT_ID = "envpass-cli"
+
+
+def _post(url: str, body: dict[str, Any]) -> tuple[int, dict[str, Any]]:
+    request = urllib.request.Request(
+        url,
+        data=json.dumps(body).encode("utf-8"),
+        method="POST",
+        headers={"content-type": "application/json", "accept": "application/json"},
+    )
+    try:
+        with urllib.request.urlopen(request, timeout=30) as response:
+            return response.status, json.loads(response.read().decode("utf-8"))
+    except urllib.error.HTTPError as error:
+        try:
+            return error.code, json.loads(error.read().decode("utf-8"))
+        except ValueError:
+            return error.code, {}
+
+
+def open_browser(url: str) -> None:
+    try:
+        webbrowser.open(url)
+    except Exception:
+        return
+
+
+def device_login(
+    url: str,
+    on_code: Callable[[dict[str, Any]], None],
+    post: Callable[[str, dict[str, Any]], tuple[int, dict[str, Any]]] = _post,
+    sleep: Callable[[float], None] = time.sleep,
+) -> str:
+    status, code = post(f"{url}/api/auth/device/code", {"client_id": CLI_CLIENT_ID})
+    if status >= 400 or "device_code" not in code:
+        raise RuntimeError(f"Could not start login ({status})")
+    on_code(code)
+    interval = max(1, int(code.get("interval", 5)))
+    deadline = time.monotonic() + int(code.get("expires_in", 900))
+    while time.monotonic() < deadline:
+        sleep(interval)
+        _, body = post(
+            f"{url}/api/auth/device/token",
+            {
+                "grant_type": "urn:ietf:params:oauth:grant-type:device_code",
+                "device_code": code["device_code"],
+                "client_id": CLI_CLIENT_ID,
+            },
+        )
+        token = body.get("access_token")
+        if isinstance(token, str):
+            return token
+        error = body.get("error")
+        if error == "authorization_pending":
+            continue
+        if error == "slow_down":
+            interval += 5
+            continue
+        if error == "access_denied":
+            raise RuntimeError("Login was denied in the browser.")
+        if error == "expired_token":
+            break
+        raise RuntimeError(str(body.get("error_description") or error or "Login failed"))
+    raise RuntimeError("The login code expired. Run `envpass login` again.")

envpass_cli-0.1.3/src/envpass/mask.py

@@ -0,0 +1,43 @@
+from __future__ import annotations
+
+from collections.abc import Iterable
+
+MASK = "***"
+MIN_LENGTH = 4
+
+
+def _secrets(values: Iterable[str]) -> list[str]:
+    return sorted({v for v in values if len(v) >= MIN_LENGTH}, key=len, reverse=True)
+
+
+def mask_text(text: str, values: Iterable[str]) -> str:
+    for secret in _secrets(values):
+        text = text.replace(secret, MASK)
+    return text
+
+
+def partial_suffix(text: str, secrets: list[str]) -> int:
+    longest = 0
+    for secret in secrets:
+        for k in range(min(len(secret) - 1, len(text)), longest, -1):
+            if text.endswith(secret[:k]):
+                longest = k
+                break
+    return longest
+
+
+class Masker:
+    def __init__(self, values: Iterable[str]) -> None:
+        self.secrets = _secrets(values)
+        self.pending = ""
+
+    def feed(self, chunk: str) -> str:
+        self.pending = mask_text(self.pending + chunk, self.secrets)
+        keep = partial_suffix(self.pending, self.secrets)
+        emit = self.pending[: len(self.pending) - keep]
+        self.pending = self.pending[len(emit) :]
+        return emit
+
+    def flush(self) -> str:
+        rest, self.pending = self.pending, ""
+        return rest