evo-cli 0.34.0__tar.gz → 0.34.1__tar.gz

{evo_cli-0.34.0 → evo_cli-0.34.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: evo_cli
-Version: 0.34.0
+Version: 0.34.1
 Summary: Evolution CLI - a developer toolbox for setting up dev machines
 Author: maycuatroi
 Project-URL: Homepage, https://github.com/maycuatroi/evo-cli

evo_cli-0.34.1/evo_cli/VERSION

@@ -0,0 +1 @@
+0.34.1

{evo_cli-0.34.0 → evo_cli-0.34.1}/evo_cli/openvpn.py

@@ -503,12 +503,26 @@ def quote(value):
     return '"' + value.replace("\\", "\\\\").replace('"', '\\"') + '"'
 
 
+def rejection_reason(line):
+    """The server's text in a Verification Failed notice, for the user; a dynamic challenge keeps only its prompt.
+
+    OpenVPN writes >PASSWORD:Verification Failed: 'Auth' ['REASON'] (the brackets are its own). A CRV1 challenge
+    carries a state ID and the username besides its prompt, so neither is shown.
+    """
+    reason = line.partition("['")[2].rpartition("']")[0]
+    if reason.startswith("CRV1:"):
+        return "dynamic challenge, not supported: " + reason.split(":", 4)[-1]
+    return reason
+
+
 def auth_commands(line, profile):
     # OpenVPN itself caches server-issued session tokens. This notification needs no reply.
     if line.startswith(">PASSWORD:Auth-Token:"):
         return ""
     if "Verification Failed" in line:
-        raise CredentialError("VPN authentication rejected; check password/OTP enrollment before retrying.")
+        reason = rejection_reason(line)
+        detail = f": {reason}" if reason else "; check password/OTP enrollment before retrying"
+        raise CredentialError(f"VPN authentication rejected{detail}.")
     if "Need 'Auth' username/password" not in line:
         raise CredentialError("Unsupported authentication challenge (private-key password or dynamic challenge).")
     username, password = profile.get("username", ""), profile.get("password", "")
@@ -715,7 +729,9 @@ def worker(name, timeout):
                                     state.pop("since", None)
                                 if fields[1] == "AUTH_PENDING":
                                     # Signing in happens in the browser: allow the time the server gives it.
-                                    wait = int(fields[2]) if fields[2].isdigit() else 300
+                                    # "timeout 180" in OpenVPN 2.6, a bare number in older notes.
+                                    wait = fields[2].split()[-1] if fields[2] else ""
+                                    wait = int(wait) if wait.isdigit() else 300
                                     deadline = max(deadline, time.monotonic() + wait)
                                     state["auth_expires"] = time.time() + wait
                                 if fields[1] == "RECONNECTING":

{evo_cli-0.34.0 → evo_cli-0.34.1}/evo_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: evo_cli
-Version: 0.34.0
+Version: 0.34.1
 Summary: Evolution CLI - a developer toolbox for setting up dev machines
 Author: maycuatroi
 Project-URL: Homepage, https://github.com/maycuatroi/evo-cli

{evo_cli-0.34.0 → evo_cli-0.34.1}/tests/test_openvpn.py

@@ -261,10 +261,23 @@ def test_static_challenge_uses_scrv1_and_fresh_totp(monkeypatch):
     assert "SCRV1:cGFzcw==:NjU0MzIx" in vpn.auth_commands(line, profile)
 
 
-def test_auth_rejection_does_not_retry_or_leak_challenge():
+@pytest.mark.parametrize(
+    "line,shown,hidden",
+    [
+        (">PASSWORD:Verification Failed: 'Auth'", "check password/OTP enrollment", None),
+        (">PASSWORD:Verification Failed: 'Auth' ['SAML user does not match']", ": SAML user does not match.", None),
+        (
+            ">PASSWORD:Verification Failed: 'Auth' ['CRV1:R,E:state-id-secret:dXNlcg==:Enter token PIN']",
+            "dynamic challenge, not supported: Enter token PIN",
+            "state-id-secret",
+        ),
+    ],
+)
+def test_auth_rejection_shows_the_reason_but_not_the_challenge_state(line, shown, hidden):
     with pytest.raises(CredentialError) as exc:
-        vpn.auth_commands(">PASSWORD:Verification Failed: 'Auth' ['sensitive']", {})
-    assert "sensitive" not in str(exc.value)
+        vpn.auth_commands(line, {})
+    assert shown in str(exc.value)
+    assert not hidden or (hidden not in str(exc.value) and "dXNlcg==" not in str(exc.value))
 
 
 def test_auth_token_is_a_notification_not_a_prompt():
@@ -489,7 +502,7 @@ with socket.socket(socket.AF_UNIX) as s:
     held = b'hold off\\n' not in seen
     if sys.argv[2] == 'webauth':
         # Access Server SAML: no password prompt, a browser sign-in instead.
-        s.sendall(b'>STATE:1,AUTH_PENDING,120,,,,,\\n')
+        s.sendall(b'>STATE:1,AUTH_PENDING,timeout 120,,,,,\\n')
         s.sendall(b'>INFOMSG:WEB_AUTH::https://vpn.example/auth/1\\n')
     else:
         auth()

evo_cli-0.34.0/evo_cli/VERSION

@@ -1 +0,0 @@
-0.34.0