envpass-cli 0.1.6__tar.gz → 0.2.7__tar.gz

{envpass_cli-0.1.6 → envpass_cli-0.2.7}/PKG-INFO

@@ -1,7 +1,7 @@
 Metadata-Version: 2.4
 Name: envpass-cli
-Version: 0.1.6
-Summary: Client and CLI for envpass: encrypted environment variables for every project, service and environment.
+Version: 0.2.7
+Summary: Client and CLI for envpass: encrypted environment variables for every project and environment.
 Keywords: env,dotenv,secrets,environment-variables,cli,envpass
 License-Expression: MIT
 Classifier: Programming Language :: Python :: 3
@@ -15,7 +15,7 @@ Description-Content-Type: text/markdown
 
 # envpass-cli
 
-Python client and CLI for [envpass](https://envpass.dev): encrypted environment variables for every project, service and environment. No dependencies.
+Python client and CLI for [envpass](https://envpass.dev): encrypted environment variables for every project and environment. No dependencies.
 
 ## CLI
 
@@ -25,6 +25,8 @@ uvx envpass-cli link -w acme -p shop -e dev   # save defaults to .envpass.json (
 uvx envpass-cli pull                          # write .env
 uvx envpass-cli pull -e prod -o -             # print to stdout
 uvx envpass-cli run -e dev -- python app.py   # run with values injected, masked in output
+uvx envpass-cli webhooks list                 # webhooks and syncs need `login`
+uvx envpass-cli syncs run <id>                # push a sync now
 ```
 
 `pipx run envpass-cli …` and `pip install envpass-cli` work too.
@@ -35,7 +37,7 @@ In CI, use a service token instead of `login`:
 ENVPASS_TOKEN=ep_live_… uvx envpass-cli pull -e prod
 ```
 
-Options can also come from `ENVPASS_WORKSPACE`, `ENVPASS_PROJECT`, `ENVPASS_ENV`, `ENVPASS_SERVICE` and `ENVPASS_URL`.
+Options can also come from `ENVPASS_WORKSPACE`, `ENVPASS_PROJECT`, `ENVPASS_ENV` and `ENVPASS_URL`.
 
 ## Library
 
@@ -45,6 +47,7 @@ from envpass import Envpass, load_env
 load_env("prod")
 
 client = Envpass(token="ep_live_…")
-entries = client.resolve({"environment": "prod", "service": "api"})
+entries = client.resolve({"environment": "prod"})
+webhooks = client.list_webhooks({"workspace": "acme"})
 workspaces = client.request("GET", "/api/v1/workspaces")
 ```

{envpass_cli-0.1.6 → envpass_cli-0.2.7}/README.md

@@ -1,6 +1,6 @@
 # envpass-cli
 
-Python client and CLI for [envpass](https://envpass.dev): encrypted environment variables for every project, service and environment. No dependencies.
+Python client and CLI for [envpass](https://envpass.dev): encrypted environment variables for every project and environment. No dependencies.
 
 ## CLI
 
@@ -10,6 +10,8 @@ uvx envpass-cli link -w acme -p shop -e dev   # save defaults to .envpass.json (
 uvx envpass-cli pull                          # write .env
 uvx envpass-cli pull -e prod -o -             # print to stdout
 uvx envpass-cli run -e dev -- python app.py   # run with values injected, masked in output
+uvx envpass-cli webhooks list                 # webhooks and syncs need `login`
+uvx envpass-cli syncs run <id>                # push a sync now
 ```
 
 `pipx run envpass-cli …` and `pip install envpass-cli` work too.
@@ -20,7 +22,7 @@ In CI, use a service token instead of `login`:
 ENVPASS_TOKEN=ep_live_… uvx envpass-cli pull -e prod
 ```
 
-Options can also come from `ENVPASS_WORKSPACE`, `ENVPASS_PROJECT`, `ENVPASS_ENV`, `ENVPASS_SERVICE` and `ENVPASS_URL`.
+Options can also come from `ENVPASS_WORKSPACE`, `ENVPASS_PROJECT`, `ENVPASS_ENV` and `ENVPASS_URL`.
 
 ## Library
 
@@ -30,6 +32,7 @@ from envpass import Envpass, load_env
 load_env("prod")
 
 client = Envpass(token="ep_live_…")
-entries = client.resolve({"environment": "prod", "service": "api"})
+entries = client.resolve({"environment": "prod"})
+webhooks = client.list_webhooks({"workspace": "acme"})
 workspaces = client.request("GET", "/api/v1/workspaces")
 ```

{envpass_cli-0.1.6 → envpass_cli-0.2.7}/pyproject.toml

@@ -1,7 +1,7 @@
 [project]
 name = "envpass-cli"
-version = "0.1.6"
-description = "Client and CLI for envpass: encrypted environment variables for every project, service and environment."
+version = "0.2.7"
+description = "Client and CLI for envpass: encrypted environment variables for every project and environment."
 readme = "README.md"
 license = "MIT"
 requires-python = ">=3.9"

{envpass_cli-0.1.6 → envpass_cli-0.2.7}/pyproject.toml.orig

@@ -1,7 +1,7 @@
 [project]
 name = "envpass-cli"
-version = "0.1.6"
-description = "Client and CLI for envpass: encrypted environment variables for every project, service and environment."
+version = "0.2.7"
+description = "Client and CLI for envpass: encrypted environment variables for every project and environment."
 readme = "README.md"
 license = "MIT"
 requires-python = ">=3.9"

{envpass_cli-0.1.6 → envpass_cli-0.2.7}/src/envpass/cli.py

@@ -22,6 +22,7 @@ from .config import (
     write_project_link,
 )
 from .device import device_login, open_browser
+from .integrations import syncs_command, webhooks_command
 from .mask import Masker
 
 NOT_SIGNED_IN = "Not signed in. Run `envpass login` or set ENVPASS_TOKEN."
@@ -35,7 +36,7 @@ def _fail(message: str, code: int = 1) -> int:
 def _parser() -> argparse.ArgumentParser:
     parser = argparse.ArgumentParser(
         prog="envpass",
-        description="Encrypted environment variables for every project, service and environment.",
+        description="Encrypted environment variables for every project and environment.",
     )
     parser.add_argument("--version", action="version", version=__version__)
     parser.add_argument(
@@ -45,7 +46,6 @@ def _parser() -> argparse.ArgumentParser:
     scope.add_argument("-w", "--workspace", help="workspace slug")
     scope.add_argument("-p", "--project", help="project slug")
     scope.add_argument("-e", "--env", dest="environment", help="environment slug, e.g. dev or prod")
-    scope.add_argument("-s", "--service", help='service slug, or "shared"')
     scope.add_argument("--url", dest="url_sub", help=argparse.SUPPRESS)
 
     commands = parser.add_subparsers(dest="command", metavar="command")
@@ -62,9 +62,97 @@ def _parser() -> argparse.ArgumentParser:
     run = commands.add_parser("run", help="run a command with the values injected", parents=[scope])
     run.add_argument("--no-mask", action="store_true", help="show secret values in the output")
     run.add_argument("cmd", nargs=argparse.REMAINDER, help="-- command [args...]")
+    _integration_parsers(commands)
     return parser
 
 
+def _integration_parsers(commands: Any) -> None:
+    server = argparse.ArgumentParser(add_help=False)
+    server.add_argument("--url", dest="url_sub", help=argparse.SUPPRESS)
+    workspace = argparse.ArgumentParser(add_help=False)
+    workspace.add_argument("-w", "--workspace", help="workspace slug")
+    project = argparse.ArgumentParser(add_help=False)
+    project.add_argument("-p", "--project", help="project slug")
+    listing = argparse.ArgumentParser(add_help=False)
+    listing.add_argument("--json", action="store_true", help="print raw JSON")
+    needs_login = "Needs `envpass login`, not a service token."
+
+    webhooks = commands.add_parser(
+        "webhooks",
+        help="list, add, remove and test the workspace's webhooks",
+        description=f"Manage the workspace's webhooks. {needs_login}",
+    )
+    hooks = webhooks.add_subparsers(dest="action", metavar="action")
+    hooks.add_parser("list", help="list webhooks", parents=[workspace, server, listing])
+    add = hooks.add_parser(
+        "add",
+        help="register a webhook and print its signing secret once",
+        description="Register a webhook. The signing secret is printed once: store it.",
+        parents=[workspace],
+    )
+    add.add_argument(
+        "--url",
+        dest="webhook_url",
+        metavar="URL",
+        help="endpoint to POST to (point at your envpass server with ENVPASS_URL)",
+    )
+    add.add_argument(
+        "--event",
+        dest="events",
+        action="append",
+        metavar="EVENT",
+        help="secrets.changed, sync.succeeded or sync.failed; repeat for more "
+        "(default secrets.changed and sync.failed)",
+    )
+    add.add_argument(
+        "-e",
+        "--env",
+        dest="environments",
+        action="append",
+        metavar="ENV",
+        help="only these environments; repeat for more (default all)",
+    )
+    add.add_argument(
+        "-p",
+        "--project",
+        dest="projects",
+        action="append",
+        metavar="PROJECT",
+        help="only these projects; repeat for more (default all)",
+    )
+    add.add_argument(
+        "-f", "--format", help="json or slack (default slack for Slack URLs, json otherwise)"
+    )
+    add.add_argument("--description", help="a note to tell webhooks apart")
+    remove = hooks.add_parser("remove", help="delete a webhook", parents=[workspace, server])
+    remove.add_argument("id", nargs="?", help="webhook id")
+    test = hooks.add_parser(
+        "test", help="send a test event (exit code 1 if it fails)", parents=[workspace, server]
+    )
+    test.add_argument("id", nargs="?", help="webhook id")
+    deliveries = hooks.add_parser(
+        "deliveries", help="show recent deliveries", parents=[workspace, server, listing]
+    )
+    deliveries.add_argument("id", nargs="?", help="webhook id")
+    deliveries.add_argument("--limit", help="how many to show, 1-100 (default 25)")
+
+    syncs = commands.add_parser(
+        "syncs",
+        help="list, run, pause and resume the project's syncs",
+        description=f"Manage the project's syncs. {needs_login}",
+    )
+    actions = syncs.add_subparsers(dest="action", metavar="action")
+    scope = [workspace, project, server]
+    actions.add_parser("list", help="list the project's syncs", parents=[*scope, listing])
+    for name, text in (
+        ("run", "push a sync now"),
+        ("pause", "stop a sync from running"),
+        ("resume", "turn a paused sync back on"),
+    ):
+        action = actions.add_parser(name, help=text, parents=scope)
+        action.add_argument("id", nargs="?", help="sync id")
+
+
 def _pump(source: IO[bytes], target: Any, masker: Masker) -> None:
     while True:
         chunk = os.read(source.fileno(), 65536)
@@ -119,10 +207,9 @@ def main(argv: list[str] | None = None) -> int:
         return 0
     url = base_url(getattr(args, "url_sub", None) or args.url)
     flags = ProjectLink(
-        workspace=args.workspace,
-        project=args.project,
-        environment=args.environment,
-        service=args.service,
+        workspace=getattr(args, "workspace", None),
+        project=getattr(args, "project", None),
+        environment=getattr(args, "environment", None),
     )
     try:
         if args.command == "login":
@@ -199,6 +286,12 @@ def main(argv: list[str] | None = None) -> int:
         if args.command == "run":
             return _run(client, flags, list(args.cmd), not args.no_mask)
 
+        if args.command == "webhooks":
+            return webhooks_command(client, args, flags)
+
+        if args.command == "syncs":
+            return syncs_command(client, args, flags)
+
         return _fail(f'Unknown command "{args.command}". Run `envpass --help`.')
     except EnvpassError as error:
         return _fail(f"{error}{f' ({error.code})' if error.code else ''}")

envpass_cli-0.2.7/src/envpass/client.py

@@ -0,0 +1,397 @@
+from __future__ import annotations
+
+import json
+import os
+import urllib.error
+import urllib.parse
+import urllib.request
+from typing import Any, Literal, TypedDict
+
+from ._version import __version__
+from .config import ProjectLink, base_url, resolve_scope, resolve_token
+
+Source = Literal["shared", "personal"]
+ExportFormat = Literal["dotenv", "json", "shell"]
+WebhookEvent = Literal["secrets.changed", "sync.succeeded", "sync.failed"]
+WebhookFormat = Literal["json", "slack"]
+DeliveryStatus = Literal["pending", "retrying", "success", "failed"]
+
+WEBHOOK_EVENTS: tuple[WebhookEvent, ...] = ("secrets.changed", "sync.succeeded", "sync.failed")
+DEFAULT_WEBHOOK_EVENTS: tuple[WebhookEvent, ...] = ("secrets.changed", "sync.failed")
+USER_LOGIN_REQUIRED = (
+    "Webhooks and syncs need a user login, not a service token. "
+    "Run `envpass login` and unset ENVPASS_TOKEN."
+)
+
+
+class ResolvedEntry(TypedDict):
+    key: str
+    value: str
+    source: Source
+
+
+class Workspace(TypedDict):
+    id: str
+    name: str
+    slug: str
+    isOwner: bool
+
+
+class TokenInfo(TypedDict):
+    id: str
+    workspaceId: str
+    projectId: str
+    access: Literal["read", "write"]
+
+
+class Me(TypedDict):
+    actor: Literal["user", "token"]
+    userId: str
+    token: TokenInfo | None
+    workspaces: list[Workspace]
+
+
+class Environment(TypedDict):
+    id: str
+    workspaceId: str
+    slug: str
+    name: str
+    position: int
+    isProduction: bool
+    allowPersonalOverrides: bool
+    createdAt: str
+
+
+class LastDelivery(TypedDict):
+    status: DeliveryStatus
+    createdAt: str
+    responseStatus: int | None
+
+
+class Webhook(TypedDict):
+    id: str
+    url: str
+    description: str | None
+    format: WebhookFormat
+    events: list[str]
+    projectIds: list[str]
+    environmentIds: list[str]
+    enabled: bool
+    disabledReason: str | None
+    consecutiveFailures: int
+    createdAt: str
+    updatedAt: str
+    lastDelivery: LastDelivery | None
+
+
+class CreatedWebhook(TypedDict):
+    webhook: Webhook
+    secret: str
+
+
+class WebhookTestResult(TypedDict):
+    ok: bool
+    responseStatus: int | None
+    durationMs: int
+    error: str | None
+
+
+class WebhookDelivery(TypedDict):
+    id: str
+    eventId: str
+    eventType: str
+    status: DeliveryStatus
+    attempts: int
+    responseStatus: int | None
+    error: str | None
+    durationMs: int | None
+    payload: dict[str, Any]
+    createdAt: str
+    lastAttemptAt: str | None
+    deliveredAt: str | None
+
+
+class Connection(TypedDict):
+    id: str
+    provider: Literal["vercel", "github"]
+    name: str
+    account: str
+    teamId: str | None
+    teamSlug: str | None
+    createdAt: str
+    lastUsedAt: str | None
+    createdByName: str | None
+    syncs: int
+
+
+class Sync(TypedDict):
+    id: str
+    projectId: str
+    environmentId: str
+    environmentSlug: str
+    environmentName: str
+    connectionId: str
+    connectionName: str
+    provider: Literal["vercel", "github"]
+    target: dict[str, Any]
+    destination: str
+    enabled: bool
+    status: Literal["pending", "running", "ok", "error"]
+    lastError: str | None
+    lastResult: dict[str, Any] | None
+    lastSyncedAt: str | None
+    lastRunStartedAt: str | None
+    managedKeys: int
+    createdAt: str
+    createdByName: str | None
+
+
+class EnvpassError(Exception):
+    def __init__(self, message: str, status: int, code: str | None = None) -> None:
+        super().__init__(message)
+        self.status = status
+        self.code = code
+
+
+def _segment(value: str) -> str:
+    return urllib.parse.quote(value, safe="")
+
+
+def _pick_ids(items: list[Any], refs: list[str], kind: str, workspace: Workspace) -> list[str]:
+    ids: list[str] = []
+    for ref in refs:
+        match = next((item for item in items if ref in (item["slug"], item["id"])), None)
+        if match is None:
+            raise EnvpassError(f'No {kind} "{ref}" in {workspace["slug"]}', 404, "not_found")
+        ids.append(str(match["id"]))
+    return ids
+
+
+class Envpass:
+    def __init__(
+        self,
+        base_url_: str | None = None,
+        token: str | None = None,
+        user_agent: str | None = None,
+        timeout: float = 30.0,
+    ) -> None:
+        self.url = base_url(base_url_)
+        self.token = resolve_token(self.url, token)
+        self.timeout = timeout
+        self.user_agent = user_agent or f"envpass-python/{__version__}"
+
+    @property
+    def has_token(self) -> bool:
+        return bool(self.token)
+
+    def request(
+        self,
+        method: str,
+        path: str,
+        query: dict[str, str | None] | None = None,
+        body: Any = None,
+        raw: bool = False,
+    ) -> Any:
+        url = f"{self.url}{path}"
+        params = {k: v for k, v in (query or {}).items() if v}
+        if params:
+            url = f"{url}?{urllib.parse.urlencode(params)}"
+        headers = {"user-agent": self.user_agent, "accept": "application/json"}
+        if self.token:
+            headers["authorization"] = f"Bearer {self.token}"
+        data = None
+        if body is not None:
+            data = json.dumps(body).encode("utf-8")
+            headers["content-type"] = "application/json"
+        request = urllib.request.Request(url, data=data, method=method, headers=headers)
+        try:
+            with urllib.request.urlopen(request, timeout=self.timeout) as response:
+                text = response.read().decode("utf-8")
+        except urllib.error.HTTPError as error:
+            payload = error.read().decode("utf-8", "replace")
+            try:
+                detail = json.loads(payload).get("error", {})
+            except ValueError:
+                detail = {}
+            raise EnvpassError(
+                detail.get("message") or f"Request failed with status {error.code}",
+                error.code,
+                detail.get("code"),
+            ) from None
+        except urllib.error.URLError as error:
+            raise EnvpassError(f"Could not reach {self.url}: {error.reason}", 0) from None
+        return text if raw else json.loads(text)
+
+    def me(self) -> Me:
+        result: Me = self.request("GET", "/api/v1/me")
+        return result
+
+    def _scope_query(self, scope: ProjectLink | None) -> dict[str, str | None]:
+        resolved = resolve_scope(scope or {})
+        if not resolved.get("environment"):
+            raise EnvpassError(
+                "No environment. Pass --env, set ENVPASS_ENV, or run `envpass link`.",
+                400,
+                "invalid",
+            )
+        return {
+            "workspace": resolved.get("workspace"),
+            "project": resolved.get("project"),
+            "environment": resolved.get("environment"),
+        }
+
+    def resolve(self, scope: ProjectLink | None = None) -> list[ResolvedEntry]:
+        query = {**self._scope_query(scope), "format": "json"}
+        result: list[ResolvedEntry] = self.request("GET", "/api/v1/resolve", query)["entries"]
+        return result
+
+    def resolve_text(
+        self, scope: ProjectLink | None = None, fmt: Literal["dotenv", "shell"] = "dotenv"
+    ) -> str:
+        query = {**self._scope_query(scope), "format": fmt}
+        text: str = self.request("GET", "/api/v1/resolve", query, raw=True)
+        return text
+
+    def _require_user(self) -> None:
+        if self.token and self.token.startswith("ep_"):
+            raise EnvpassError(USER_LOGIN_REQUIRED, 403, "forbidden")
+
+    def workspace(self, scope: ProjectLink | None = None) -> Workspace:
+        self._require_user()
+        ref = resolve_scope(scope or {}).get("workspace")
+        workspaces: list[Workspace] = self.request("GET", "/api/v1/workspaces")["workspaces"]
+        if ref:
+            for candidate in workspaces:
+                if ref in (candidate["slug"], candidate["id"]):
+                    return candidate
+            raise EnvpassError(f'No workspace "{ref}" for this login', 404, "not_found")
+        if len(workspaces) == 1:
+            return workspaces[0]
+        raise EnvpassError(
+            "No workspace. Pass --workspace, set ENVPASS_WORKSPACE, or run `envpass link`.",
+            400,
+            "invalid",
+        )
+
+    def _workspace_path(self, scope: ProjectLink | None) -> str:
+        return f"/api/v1/workspaces/{_segment(self.workspace(scope)['id'])}"
+
+    def _project_path(self, scope: ProjectLink | None) -> str:
+        workspace = self.workspace(scope)
+        ref = resolve_scope(scope or {}).get("project")
+        if not ref:
+            raise EnvpassError(
+                "No project. Pass --project, set ENVPASS_PROJECT, or run `envpass link`.",
+                400,
+                "invalid",
+            )
+        base = f"/api/v1/workspaces/{_segment(workspace['id'])}"
+        projects = self.request("GET", f"{base}/projects")["projects"]
+        [project_id] = _pick_ids(projects, [ref], "project", workspace)
+        return f"{base}/projects/{_segment(project_id)}"
+
+    def list_environments(self, scope: ProjectLink | None = None) -> list[Environment]:
+        path = f"{self._workspace_path(scope)}/environments"
+        result: list[Environment] = self.request("GET", path)["environments"]
+        return result
+
+    def list_webhooks(self, scope: ProjectLink | None = None) -> list[Webhook]:
+        result: list[Webhook] = self.request("GET", f"{self._workspace_path(scope)}/webhooks")[
+            "webhooks"
+        ]
+        return result
+
+    def create_webhook(
+        self,
+        url: str,
+        *,
+        events: list[WebhookEvent] | None = None,
+        environments: list[str] | None = None,
+        projects: list[str] | None = None,
+        fmt: WebhookFormat | None = None,
+        description: str | None = None,
+        scope: ProjectLink | None = None,
+    ) -> CreatedWebhook:
+        workspace = self.workspace(scope)
+        base = f"/api/v1/workspaces/{_segment(workspace['id'])}"
+        environment_ids: list[str] = []
+        project_ids: list[str] = []
+        if environments:
+            listed = self.request("GET", f"{base}/environments")["environments"]
+            environment_ids = _pick_ids(listed, environments, "environment", workspace)
+        if projects:
+            listed = self.request("GET", f"{base}/projects")["projects"]
+            project_ids = _pick_ids(listed, projects, "project", workspace)
+        body: dict[str, Any] = {
+            "url": url,
+            "events": list(events or DEFAULT_WEBHOOK_EVENTS),
+            "environmentIds": environment_ids,
+            "projectIds": project_ids,
+        }
+        if fmt is not None:
+            body["format"] = fmt
+        if description is not None:
+            body["description"] = description
+        result: CreatedWebhook = self.request("POST", f"{base}/webhooks", body=body)
+        return result
+
+    def _webhook_path(self, webhook_id: str, scope: ProjectLink | None) -> str:
+        return f"{self._workspace_path(scope)}/webhooks/{_segment(webhook_id)}"
+
+    def delete_webhook(self, webhook_id: str, scope: ProjectLink | None = None) -> None:
+        self.request("DELETE", self._webhook_path(webhook_id, scope))
+
+    def test_webhook(self, webhook_id: str, scope: ProjectLink | None = None) -> WebhookTestResult:
+        result: WebhookTestResult = self.request(
+            "POST", f"{self._webhook_path(webhook_id, scope)}/test"
+        )
+        return result
+
+    def list_webhook_deliveries(
+        self,
+        webhook_id: str,
+        limit: int | None = None,
+        before: str | None = None,
+        scope: ProjectLink | None = None,
+    ) -> list[WebhookDelivery]:
+        query = {"limit": None if limit is None else str(limit), "before": before}
+        path = f"{self._webhook_path(webhook_id, scope)}/deliveries"
+        result: list[WebhookDelivery] = self.request("GET", path, query)["deliveries"]
+        return result
+
+    def list_connections(self, scope: ProjectLink | None = None) -> list[Connection]:
+        path = f"{self._workspace_path(scope)}/connections"
+        result: list[Connection] = self.request("GET", path)["connections"]
+        return result
+
+    def list_syncs(self, scope: ProjectLink | None = None) -> list[Sync]:
+        result: list[Sync] = self.request("GET", f"{self._project_path(scope)}/syncs")["syncs"]
+        return result
+
+    def run_sync(self, sync_id: str, scope: ProjectLink | None = None) -> None:
+        self.request("POST", f"{self._project_path(scope)}/syncs/{_segment(sync_id)}/run")
+
+    def set_sync_enabled(
+        self, sync_id: str, enabled: bool, scope: ProjectLink | None = None
+    ) -> None:
+        path = f"{self._project_path(scope)}/syncs/{_segment(sync_id)}"
+        self.request("PATCH", path, body={"enabled": enabled})
+
+
+def load_env(
+    environment: str | None = None,
+    *,
+    workspace: str | None = None,
+    project: str | None = None,
+    token: str | None = None,
+    base_url_: str | None = None,
+    override: bool = False,
+) -> dict[str, str]:
+    client = Envpass(base_url_, token)
+    entries = client.resolve(
+        ProjectLink(workspace=workspace, project=project, environment=environment)
+    )
+    for entry in entries:
+        if override or entry["key"] not in os.environ:
+            os.environ[entry["key"]] = entry["value"]
+    return {entry["key"]: entry["value"] for entry in entries}

{envpass_cli-0.1.6 → envpass_cli-0.2.7}/src/envpass/config.py

@@ -13,7 +13,6 @@ class ProjectLink(TypedDict, total=False):
     workspace: str | None
     project: str | None
     environment: str | None
-    service: str | None
 
 
 def base_url(explicit: str | None = None) -> str:
@@ -95,7 +94,7 @@ def read_project_link(start: Path | None = None) -> ProjectLink:
     if not isinstance(data, dict):
         return {}
     link: ProjectLink = {}
-    for key in ("workspace", "project", "environment", "service"):
+    for key in ("workspace", "project", "environment"):
         value = data.get(key)
         if isinstance(value, str):
             link[key] = value  # type: ignore[literal-required,unused-ignore]
@@ -116,5 +115,4 @@ def resolve_scope(flags: ProjectLink, start: Path | None = None) -> ProjectLink:
         workspace=flags.get("workspace") or env.get("ENVPASS_WORKSPACE") or file.get("workspace"),
         project=flags.get("project") or env.get("ENVPASS_PROJECT") or file.get("project"),
         environment=flags.get("environment") or env.get("ENVPASS_ENV") or file.get("environment"),
-        service=flags.get("service") or env.get("ENVPASS_SERVICE") or file.get("service"),
     )

envpass_cli-0.2.7/src/envpass/integrations.py

@@ -0,0 +1,219 @@
+from __future__ import annotations
+
+import argparse
+import json
+import re
+import sys
+from typing import Any, cast
+
+from .client import WEBHOOK_EVENTS, Envpass, WebhookEvent, WebhookFormat, WebhookTestResult
+from .config import ProjectLink
+
+WEBHOOKS_USAGE = "Usage: envpass webhooks <list|add|remove|test|deliveries>"
+SYNCS_USAGE = "Usage: envpass syncs <list|run|pause|resume>"
+
+
+def table(header: list[str], rows: list[list[str]]) -> str:
+    every = [header, *rows]
+    widths = [max(len(row[i]) for row in every) for i in range(len(header))]
+    lines = [
+        "  ".join(
+            cell if i == len(row) - 1 else cell.ljust(widths[i]) for i, cell in enumerate(row)
+        )
+        for row in every
+    ]
+    return "\n".join(lines) + "\n"
+
+
+def _one_line(text: str | None) -> str:
+    return " ".join(text.split()) if text else "-"
+
+
+def _json(value: Any) -> str:
+    return json.dumps(value, indent=2, ensure_ascii=False) + "\n"
+
+
+def _require_id(args: argparse.Namespace, usage: str) -> str:
+    value = getattr(args, "id", None)
+    if not value:
+        raise ValueError(usage)
+    return str(value)
+
+
+def _describe_test(result: WebhookTestResult) -> str:
+    status = result["responseStatus"]
+    code = "no response" if status is None else f"HTTP {status}"
+    detail = f": {_one_line(result['error'])}" if result["error"] else ""
+    outcome = "Delivered" if result["ok"] else "Failed"
+    return f"{outcome}: {code} in {result['durationMs']}ms{detail}\n"
+
+
+def _parse_limit(limit: str | None) -> int | None:
+    if limit is None:
+        return None
+    if not re.fullmatch(r"[0-9]+", limit) or not 1 <= int(limit) <= 100:
+        raise ValueError("--limit must be a whole number from 1 to 100")
+    return int(limit)
+
+
+def _parse_events(events: list[str] | None) -> list[WebhookEvent] | None:
+    if not events:
+        return None
+    for event in events:
+        if event not in WEBHOOK_EVENTS:
+            raise ValueError(f"--event must be one of {', '.join(WEBHOOK_EVENTS)}")
+    return cast("list[WebhookEvent]", events)
+
+
+def _parse_format(fmt: str | None) -> WebhookFormat | None:
+    if fmt is None:
+        return None
+    if fmt not in ("json", "slack"):
+        raise ValueError("--format must be json or slack")
+    return cast("WebhookFormat", fmt)
+
+
+def _out(text: str) -> None:
+    sys.stdout.write(text)
+
+
+def _err(text: str) -> None:
+    sys.stderr.write(text)
+
+
+def webhooks_command(client: Envpass, args: argparse.Namespace, flags: ProjectLink) -> int:
+    action = getattr(args, "action", None)
+    scope = ProjectLink(workspace=flags.get("workspace"))
+    if action == "list":
+        webhooks = client.list_webhooks(scope)
+        if args.json:
+            _out(_json(webhooks))
+            return 0
+        if not webhooks:
+            _err("No webhooks.\n")
+            return 0
+        slugs = {env["id"]: env["slug"] for env in client.list_environments(scope)}
+        rows = []
+        for hook in webhooks:
+            last = hook["lastDelivery"]
+            delivery = "-"
+            if last:
+                code = last["responseStatus"]
+                delivery = f"{last['status']} {'' if code is None else code}".strip()
+            environments = ",".join(slugs.get(i, i) for i in hook["environmentIds"]) or "all"
+            rows.append(
+                [
+                    hook["id"],
+                    hook["url"],
+                    ",".join(hook["events"]),
+                    environments,
+                    "on" if hook["enabled"] else "off",
+                    delivery,
+                ]
+            )
+        _out(table(["ID", "URL", "EVENTS", "ENVIRONMENTS", "ENABLED", "LAST DELIVERY"], rows))
+        return 0
+
+    if action == "add":
+        if not args.webhook_url:
+            raise ValueError("Usage: envpass webhooks add --url <url> [options]")
+        created = client.create_webhook(
+            args.webhook_url,
+            events=_parse_events(args.events),
+            environments=args.environments,
+            projects=args.projects,
+            fmt=_parse_format(args.format),
+            description=args.description,
+            scope=scope,
+        )
+        webhook = created["webhook"]
+        _out(f"Webhook {webhook['id']} created for {webhook['url']}\n")
+        _out(f"Signing secret: {created['secret']}\n")
+        _err(
+            "Store the signing secret now: it is shown only once. "
+            "Use it to verify the envpass-signature header.\n"
+        )
+        return 0
+
+    if action == "remove":
+        webhook_id = _require_id(args, "Usage: envpass webhooks remove <id>")
+        client.delete_webhook(webhook_id, scope)
+        _err(f"Removed webhook {webhook_id}\n")
+        return 0
+
+    if action == "test":
+        webhook_id = _require_id(args, "Usage: envpass webhooks test <id>")
+        result = client.test_webhook(webhook_id, scope)
+        _out(_describe_test(result))
+        return 0 if result["ok"] else 1
+
+    if action == "deliveries":
+        webhook_id = _require_id(args, "Usage: envpass webhooks deliveries <id> [--limit N]")
+        deliveries = client.list_webhook_deliveries(
+            webhook_id, limit=_parse_limit(args.limit), scope=scope
+        )
+        if args.json:
+            _out(_json(deliveries))
+            return 0
+        if not deliveries:
+            _err("No deliveries yet.\n")
+            return 0
+        rows = [
+            [
+                d["id"],
+                d["eventType"],
+                d["status"],
+                "-" if d["responseStatus"] is None else str(d["responseStatus"]),
+                str(d["attempts"]),
+                "-" if d["durationMs"] is None else f"{d['durationMs']}ms",
+                d["createdAt"],
+                _one_line(d["error"]),
+            ]
+            for d in deliveries
+        ]
+        header = ["ID", "EVENT", "STATUS", "CODE", "ATTEMPTS", "DURATION", "CREATED", "ERROR"]
+        _out(table(header, rows))
+        return 0
+
+    raise ValueError(WEBHOOKS_USAGE)
+
+
+def syncs_command(client: Envpass, args: argparse.Namespace, flags: ProjectLink) -> int:
+    action = getattr(args, "action", None)
+    scope = ProjectLink(workspace=flags.get("workspace"), project=flags.get("project"))
+    if action == "list":
+        syncs = client.list_syncs(scope)
+        if args.json:
+            _out(_json(syncs))
+            return 0
+        if not syncs:
+            _err("No syncs.\n")
+            return 0
+        rows = [
+            [
+                sync["id"],
+                sync["destination"],
+                sync["environmentSlug"],
+                sync["status"] if sync["enabled"] else "paused",
+                sync["lastSyncedAt"] or "never",
+                _one_line(sync["lastError"]),
+            ]
+            for sync in syncs
+        ]
+        header = ["ID", "DESTINATION", "ENVIRONMENT", "STATUS", "LAST SYNCED", "LAST ERROR"]
+        _out(table(header, rows))
+        return 0
+
+    if action == "run":
+        sync_id = _require_id(args, "Usage: envpass syncs run <id>")
+        client.run_sync(sync_id, scope)
+        _err(f"Queued sync {sync_id}\n")
+        return 0
+
+    if action in ("pause", "resume"):
+        sync_id = _require_id(args, f"Usage: envpass syncs {action} <id>")
+        client.set_sync_enabled(sync_id, action == "resume", scope)
+        _err(f"{'Resumed' if action == 'resume' else 'Paused'} sync {sync_id}\n")
+        return 0
+
+    raise ValueError(SYNCS_USAGE)

envpass_cli-0.1.6/src/envpass/client.py

@@ -1,156 +0,0 @@
-from __future__ import annotations
-
-import json
-import os
-import urllib.error
-import urllib.parse
-import urllib.request
-from typing import Any, Literal, TypedDict
-
-from ._version import __version__
-from .config import ProjectLink, base_url, resolve_scope, resolve_token
-
-Source = Literal["shared", "service", "personal"]
-ExportFormat = Literal["dotenv", "json", "shell"]
-
-
-class ResolvedEntry(TypedDict):
-    key: str
-    value: str
-    source: Source
-
-
-class Workspace(TypedDict):
-    id: str
-    name: str
-    slug: str
-    isOwner: bool
-
-
-class TokenInfo(TypedDict):
-    id: str
-    workspaceId: str
-    projectId: str
-    serviceId: str | None
-    access: Literal["read", "write"]
-
-
-class Me(TypedDict):
-    actor: Literal["user", "token"]
-    userId: str
-    token: TokenInfo | None
-    workspaces: list[Workspace]
-
-
-class EnvpassError(Exception):
-    def __init__(self, message: str, status: int, code: str | None = None) -> None:
-        super().__init__(message)
-        self.status = status
-        self.code = code
-
-
-class Envpass:
-    def __init__(
-        self,
-        base_url_: str | None = None,
-        token: str | None = None,
-        user_agent: str | None = None,
-        timeout: float = 30.0,
-    ) -> None:
-        self.url = base_url(base_url_)
-        self.token = resolve_token(self.url, token)
-        self.timeout = timeout
-        self.user_agent = user_agent or f"envpass-python/{__version__}"
-
-    @property
-    def has_token(self) -> bool:
-        return bool(self.token)
-
-    def request(
-        self,
-        method: str,
-        path: str,
-        query: dict[str, str | None] | None = None,
-        body: Any = None,
-        raw: bool = False,
-    ) -> Any:
-        url = f"{self.url}{path}"
-        params = {k: v for k, v in (query or {}).items() if v}
-        if params:
-            url = f"{url}?{urllib.parse.urlencode(params)}"
-        headers = {"user-agent": self.user_agent, "accept": "application/json"}
-        if self.token:
-            headers["authorization"] = f"Bearer {self.token}"
-        data = None
-        if body is not None:
-            data = json.dumps(body).encode("utf-8")
-            headers["content-type"] = "application/json"
-        request = urllib.request.Request(url, data=data, method=method, headers=headers)
-        try:
-            with urllib.request.urlopen(request, timeout=self.timeout) as response:
-                text = response.read().decode("utf-8")
-        except urllib.error.HTTPError as error:
-            payload = error.read().decode("utf-8", "replace")
-            try:
-                detail = json.loads(payload).get("error", {})
-            except ValueError:
-                detail = {}
-            raise EnvpassError(
-                detail.get("message") or f"Request failed with status {error.code}",
-                error.code,
-                detail.get("code"),
-            ) from None
-        except urllib.error.URLError as error:
-            raise EnvpassError(f"Could not reach {self.url}: {error.reason}", 0) from None
-        return text if raw else json.loads(text)
-
-    def me(self) -> Me:
-        result: Me = self.request("GET", "/api/v1/me")
-        return result
-
-    def _scope_query(self, scope: ProjectLink | None) -> dict[str, str | None]:
-        resolved = resolve_scope(scope or {})
-        if not resolved.get("environment"):
-            raise EnvpassError(
-                "No environment. Pass --env, set ENVPASS_ENV, or run `envpass link`.",
-                400,
-                "invalid",
-            )
-        return {
-            "workspace": resolved.get("workspace"),
-            "project": resolved.get("project"),
-            "environment": resolved.get("environment"),
-            "service": resolved.get("service"),
-        }
-
-    def resolve(self, scope: ProjectLink | None = None) -> list[ResolvedEntry]:
-        query = {**self._scope_query(scope), "format": "json"}
-        result: list[ResolvedEntry] = self.request("GET", "/api/v1/resolve", query)["entries"]
-        return result
-
-    def resolve_text(
-        self, scope: ProjectLink | None = None, fmt: Literal["dotenv", "shell"] = "dotenv"
-    ) -> str:
-        query = {**self._scope_query(scope), "format": fmt}
-        text: str = self.request("GET", "/api/v1/resolve", query, raw=True)
-        return text
-
-
-def load_env(
-    environment: str | None = None,
-    *,
-    workspace: str | None = None,
-    project: str | None = None,
-    service: str | None = None,
-    token: str | None = None,
-    base_url_: str | None = None,
-    override: bool = False,
-) -> dict[str, str]:
-    client = Envpass(base_url_, token)
-    entries = client.resolve(
-        ProjectLink(workspace=workspace, project=project, environment=environment, service=service)
-    )
-    for entry in entries:
-        if override or entry["key"] not in os.environ:
-            os.environ[entry["key"]] = entry["value"]
-    return {entry["key"]: entry["value"] for entry in entries}