freemyid 0.2.0.dev1__py3-none-any.whl

freemyid/doctor.py

@@ -0,0 +1,374 @@
+"""`freemyid doctor`: is this computer ready to run Free My ID? OWNER: automation-engineer.
+
+Every check returns ok / warn / fail plus one plain fix line, and never raises. Checks are
+read-only: nothing is installed, no login is attempted, and the only network traffic is a
+TCP/TLS hello to the user's own mail servers (allowed by NetPolicy), skipped with
+``network=False``.
+"""
+from __future__ import annotations
+
+import importlib
+import os
+import shutil
+import socket
+import ssl
+import sys
+from collections.abc import Callable
+from dataclasses import asdict, dataclass
+from datetime import date
+from pathlib import Path
+from typing import TYPE_CHECKING, Any, Literal
+
+from . import paths
+
+if TYPE_CHECKING:  # pragma: no cover
+    from .models import MailboxConfig, Profile
+
+Status = Literal["ok", "warn", "fail"]
+REGISTRY_WARN_DAYS = 120
+NET_TIMEOUT_S = 5.0
+
+
+@dataclass
+class Check:
+    id: str
+    title: str
+    status: Status
+    detail: str
+    fix: str = ""
+
+    def as_dict(self) -> dict[str, str]:
+        return asdict(self)
+
+
+def _guard(cid: str, title: str, fn: Callable[[], Check]) -> Check:
+    try:
+        return fn()
+    except Exception as e:  # noqa: BLE001 - a broken check must not break the others
+        return Check(cid, title, "warn", f"could not check ({type(e).__name__})",
+                     "Run `freemyid doctor -v` and send the log to whoever helps you.")
+
+
+# --------------------------------------------------------------------------- python
+
+
+def check_python() -> Check:
+    v = sys.version_info
+    frozen = bool(getattr(sys, "frozen", False))
+    how = "installed app (frozen build)" if frozen else f"Python at {sys.executable}"
+    detail = f"Python {v.major}.{v.minor}.{v.micro}, {how}"
+    if (v.major, v.minor) < (3, 12):
+        return Check("python", "Python", "fail", detail,
+                     "Free My ID needs Python 3.12 or newer: `pipx install --python python3.12 "
+                     "freemyid`.")
+    return Check("python", "Python", "ok", detail)
+
+
+# --------------------------------------------------------------------------- home folder
+
+
+def check_home() -> Check:
+    h = paths.home()
+    if not h.is_dir():
+        return Check("home", "Data folder", "fail", f"{h} is missing",
+                     f"Create it with `mkdir -p {h}` or set FREEMYID_HOME.")
+    if not os.access(h, os.W_OK):
+        return Check("home", "Data folder", "fail", f"{h} is not writable",
+                     f"Make it yours again: `chown -R $USER {h}`.")
+    if sys.platform != "win32":
+        mode = h.stat().st_mode & 0o777
+        if mode & 0o077:
+            return Check("home", "Data folder", "warn",
+                         f"{h} can be read by other users (mode {mode:o})",
+                         f"Make it private: `chmod 700 {h}`.")
+        return Check("home", "Data folder", "ok", f"{h} (private, mode {mode:o})")
+    return Check("home", "Data folder", "ok", str(h))
+
+
+# --------------------------------------------------------------------------- secrets
+
+
+def check_secrets() -> Check:
+    """Which secrets backend holds the encryption key, and can it be used right now."""
+    from . import secret_backends as sb
+    from .crypto import KeyUnavailable
+    title = "Secrets backend"
+    keychain = sb.KeyringBackend().usable()
+    try:
+        be = sb.select()
+    except KeyUnavailable as e:
+        return Check("secrets", title, "fail", str(e),
+                     "Unlock or start the keychain, then consider `freemyid secrets migrate "
+                     "--to passphrase`.")
+    except ValueError as e:   # unknown backend name in config.yaml
+        return Check("secrets", title, "fail", str(e),
+                     "Fix `secrets_backend` in config.yaml (keyring, passphrase or "
+                     "systemd-creds), or remove it for automatic choice.")
+    extra = "" if be.name == "keyring" else (
+        "; system keychain also available" if keychain else "; no system keychain")
+    if be.usable():
+        if be.name == "passphrase" and not os.environ.get(sb.PASSPHRASE_FILE_ENV):
+            return Check("secrets", title, "warn",
+                         f"passphrase, typed at a prompt{extra}",
+                         f"Scheduled and headless runs can't type it: set "
+                         f"{sb.PASSPHRASE_FILE_ENV} to a file only you can read (chmod 600), "
+                         "or use systemd credentials.")
+        return Check("secrets", title, "ok", f"{be.name}{extra}")
+    fixes = {
+        "keyring": "Install and unlock a keychain (GNOME Keyring or KWallet), or run "
+                   "`freemyid secrets migrate --to passphrase`.",
+        "passphrase": f"Set {sb.PASSPHRASE_FILE_ENV} to a file only you can read (chmod 600), "
+                      "or run Free My ID in a terminal.",
+        "systemd-creds": f"Add LoadCredential={sb.CRED_NAME}:<path> to the service.",
+    }
+    return Check("secrets", title, "fail", f"{be.name} is selected but not usable here{extra}",
+                 fixes.get(be.name, "Run `freemyid secrets status`."))
+
+
+# --------------------------------------------------------------------------- data store
+
+
+def check_store(out: dict[str, Any]) -> Check:
+    """Opens the encrypted database if it exists; puts the profiles in out['profiles']."""
+    if not paths.db_path().exists():
+        return Check("store", "Saved people", "warn", "nobody is set up yet",
+                     "Run `freemyid setup` (or `freemyid setup --from config.yaml`).")
+    from .consent import consent_ok
+    from .crypto import KeyUnavailable
+    from .storage import Store
+    try:
+        st = Store()
+    except KeyUnavailable as e:
+        return Check("store", "Saved people", "fail", f"cannot unlock the data ({e})",
+                     "Unlock your keychain, or restore the key; see the Secrets check.")
+    try:
+        profiles = st.list_profiles()
+        ok = sum(1 for p in profiles if consent_ok(p, st)[0])
+    finally:
+        st.close()
+    out["profiles"] = profiles
+    if not profiles:
+        return Check("store", "Saved people", "warn", "nobody is set up yet",
+                     "Run `freemyid setup` (or `freemyid setup --from config.yaml`).")
+    if ok < len(profiles):
+        return Check("store", "Saved people", "warn",
+                     f"{len(profiles)} saved, {len(profiles) - ok} without valid permission",
+                     "Open Free My ID and give permission again (`freemyid profile list`).")
+    return Check("store", "Saved people", "ok", f"{len(profiles)} saved, all with permission")
+
+
+# --------------------------------------------------------------------------- browser
+
+
+def playwright_browsers_dir() -> Path:
+    env = os.environ.get("PLAYWRIGHT_BROWSERS_PATH")
+    if env and env != "0":
+        return Path(env)
+    if env == "0":
+        try:
+            import playwright
+            return Path(playwright.__file__).parent / "driver" / "package" / ".local-browsers"
+        except ImportError:
+            pass
+    if sys.platform == "win32":
+        return Path(os.environ.get("LOCALAPPDATA", Path.home())) / "ms-playwright"
+    if sys.platform == "darwin":
+        return Path.home() / "Library" / "Caches" / "ms-playwright"
+    return Path(os.environ.get("XDG_CACHE_HOME", Path.home() / ".cache")) / "ms-playwright"
+
+
+_CHANNEL_PATHS: dict[str, dict[str, list[str]]] = {
+    "chrome": {
+        "linux": ["google-chrome", "google-chrome-stable", "/opt/google/chrome/chrome"],
+        "darwin": ["/Applications/Google Chrome.app/Contents/MacOS/Google Chrome"],
+        "win32": [r"%ProgramFiles%\Google\Chrome\Application\chrome.exe",
+                  r"%ProgramFiles(x86)%\Google\Chrome\Application\chrome.exe",
+                  r"%LOCALAPPDATA%\Google\Chrome\Application\chrome.exe"],
+    },
+    "msedge": {
+        "linux": ["microsoft-edge", "microsoft-edge-stable", "/opt/microsoft/msedge/msedge"],
+        "darwin": ["/Applications/Microsoft Edge.app/Contents/MacOS/Microsoft Edge"],
+        "win32": [r"%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe",
+                  r"%ProgramFiles%\Microsoft\Edge\Application\msedge.exe"],
+    },
+}
+
+
+def system_browser(channel: str | None) -> str | None:
+    if not channel:
+        return None
+    plat = "linux" if sys.platform.startswith("linux") else sys.platform
+    for cand in _CHANNEL_PATHS.get(channel, {}).get(plat, []):
+        c = os.path.expandvars(cand)
+        if os.sep in c or "/" in c:
+            if Path(c).is_file():
+                return c
+        elif shutil.which(c):
+            return shutil.which(c)
+    return None
+
+
+def check_browser() -> Check:
+    from . import config as cfgmod
+    cfg = cfgmod.load()
+    title = "Browser for automatic removals"
+    if not getattr(cfg, "browser_automation", True):
+        return Check("browser", title, "ok", "automatic tier is turned off (email and "
+                     "assisted removals still work)")
+    try:
+        importlib.import_module("playwright")
+    except ImportError:
+        return Check("browser", title, "warn", "Playwright is not installed",
+                     "`pipx inject freemyid playwright` (or reinstall Free My ID), then "
+                     "`playwright install chromium`.")
+    exe = os.environ.get("FREEMYID_BROWSER_EXECUTABLE")
+    if exe:
+        if Path(exe).is_file():
+            return Check("browser", title, "ok", f"FREEMYID_BROWSER_EXECUTABLE ({exe})")
+        return Check("browser", title, "fail", f"FREEMYID_BROWSER_EXECUTABLE points to a "
+                     f"missing file ({exe})", "Fix or unset FREEMYID_BROWSER_EXECUTABLE.")
+    channels = (["msedge"] if sys.platform == "win32" else []) + [cfg.browser_channel or ""]
+    for ch in dict.fromkeys(c for c in channels if c):
+        if system_browser(ch):
+            return Check("browser", title, "ok", f"system browser ({ch})")
+    d = playwright_browsers_dir()
+    found = sorted(d.glob("chromium-*")) + sorted(d.glob("chromium_headless_shell-*")) \
+        if d.is_dir() else []
+    if found:
+        return Check("browser", title, "ok", f"Playwright Chromium ({found[-1].name})")
+    return Check("browser", title, "warn", "no Chrome, Edge or Playwright Chromium found",
+                 "Run `playwright install chromium` (email and assisted removals work "
+                 "without it).")
+
+
+# --------------------------------------------------------------------------- scheduler
+
+
+def check_scheduler() -> Check:
+    from . import scheduler
+    title = "Background checks"
+    try:
+        detail = scheduler.status()
+    except Exception as e:  # noqa: BLE001
+        return Check("scheduler", title, "warn", f"could not read status ({type(e).__name__})",
+                     "Run `freemyid schedule install`.")
+    low = detail.lower()
+    if "not supported" in low:
+        return Check("scheduler", title, "warn", detail,
+                     "Use cron or a container scheduler to run `freemyid run --headless`.")
+    if "not installed" in low:
+        return Check("scheduler", title, "warn", "not installed",
+                     "Run `freemyid schedule install` (or run `freemyid run --headless` from "
+                     "cron/systemd yourself).")
+    return Check("scheduler", title, "ok", detail)
+
+
+# --------------------------------------------------------------------------- mailbox
+
+
+def _is_loopback(host: str) -> bool:
+    return host in ("localhost", "127.0.0.1", "::1")
+
+
+def probe(host: str, port: int, tls: bool, timeout: float = NET_TIMEOUT_S) -> str | None:
+    """TCP connect (and a TLS handshake when `tls`). None if fine, else a short reason.
+
+    No login: nothing but the TLS hello is sent.
+    """
+    try:
+        with socket.create_connection((host, port), timeout=timeout) as s:
+            if tls:
+                ctx = ssl.create_default_context()
+                with ctx.wrap_socket(s, server_hostname=host):
+                    pass
+    except ssl.SSLError as e:
+        return f"TLS failed ({type(e).__name__})"
+    except (OSError, RuntimeError) as e:
+        return f"cannot connect ({type(e).__name__})"
+    return None
+
+
+def _mailbox_targets(mb: MailboxConfig) -> list[tuple[str, str, int, bool]]:
+    imap_tls = mb.imap_ssl and not _is_loopback(mb.imap_host)
+    smtp_tls = (not mb.smtp_starttls and mb.smtp_port == 465
+                and not _is_loopback(mb.smtp_host))
+    return [("incoming", mb.imap_host, mb.imap_port, imap_tls),
+            ("outgoing", mb.smtp_host, mb.smtp_port, smtp_tls)]
+
+
+def check_mailboxes(profiles: list[Profile] | None, network: bool = True,
+                    prober: Callable[[str, int, bool], str | None] | None = None) -> Check:
+    title = "Removal mailbox"
+    with_mb = [p for p in (profiles or []) if p.mailbox]
+    if not with_mb:
+        return Check("mailbox", title, "warn", "no removal mailbox set up",
+                     "Add one with `freemyid profile edit <name>` so removal emails can be "
+                     "sent and replies read.")
+    if not network:
+        return Check("mailbox", title, "ok", f"{len(with_mb)} configured (not contacted: "
+                     "--offline)")
+    from .netpolicy import NetPolicy
+    pol = NetPolicy(None, with_mb, allow_loopback=True)
+    prober = prober or probe
+    problems: list[str] = []
+    for p in with_mb:
+        assert p.mailbox is not None
+        for which, host, port, tls in _mailbox_targets(p.mailbox):
+            if not pol.is_allowed(host):
+                problems.append(f"{p.label}: {which} server not allowed")
+                continue
+            why = prober(host, port, tls)
+            if why:
+                problems.append(f"{p.label}: {which} {host}:{port} {why}")
+    if problems:
+        return Check("mailbox", title, "fail", "; ".join(problems),
+                     "Check the internet connection and the mail server names "
+                     "(`freemyid profile edit <name>`); for Proton, start Proton Mail Bridge.")
+    return Check("mailbox", title, "ok", f"{len(with_mb)} reachable (no login attempted)")
+
+
+# --------------------------------------------------------------------------- registry
+
+
+def check_registry(today: date | None = None) -> Check:
+    from . import config as cfgmod
+    from . import registry as regmod
+    title = "Broker list"
+    reg = regmod.load_registry()
+    age = ((today or date.today()) - reg.updated).days
+    detail = (f"{regmod.registry_source()} list, version {reg.version}, "
+              f"{len(reg.brokers)} brokers, updated {age} day(s) ago")
+    fix = ("Run `freemyid registry update`." if cfgmod.load().registry_url else
+           "Install the latest Free My ID version to get the newest broker list.")
+    if regmod.load_warnings:
+        return Check("registry", title, "warn", detail + "; " + "; ".join(regmod.load_warnings),
+                     fix)
+    if age > REGISTRY_WARN_DAYS:
+        return Check("registry", title, "warn", detail, fix)
+    return Check("registry", title, "ok", detail)
+
+
+# --------------------------------------------------------------------------- all
+
+
+def run_checks(network: bool = True,
+               prober: Callable[[str, int, bool], str | None] | None = None) -> list[Check]:
+    box: dict[str, Any] = {}
+    checks = [
+        _guard("python", "Python", check_python),
+        _guard("home", "Data folder", check_home),
+        _guard("secrets", "Secrets backend", check_secrets),
+        _guard("store", "Saved people", lambda: check_store(box)),
+        _guard("browser", "Browser for automatic removals", check_browser),
+        _guard("scheduler", "Background checks", check_scheduler),
+        _guard("mailbox", "Removal mailbox",
+               lambda: check_mailboxes(box.get("profiles"), network, prober)),
+        _guard("registry", "Broker list", check_registry),
+    ]
+    return checks
+
+
+def doc(checks: list[Check]) -> dict[str, Any]:
+    counts = {s: sum(1 for c in checks if c.status == s) for s in ("ok", "warn", "fail")}
+    return {"schema": "doctor/1", "ok": counts["fail"] == 0, "counts": counts,
+            "checks": [c.as_dict() for c in checks]}

freemyid/engine/_dev/__init__.py

@@ -0,0 +1,101 @@
+"""Dev fixtures: a fake registry, a local fixture web server and a fake inbox.
+
+Used by tests/test_e2e_dryrun.py and `python -m freemyid.engine._dev.devrun`. Nothing here
+talks to the internet:
+
+* `fixture_registry()`  fake brokers on reserved `.example` hosts (registry.yaml).
+* `fixture_server()`    context manager: serves `site/<host>/<path>` on 127.0.0.1:<random>
+                        and sets FREEMYID_DEV_FIXTURES=<base url> while active. With that set,
+                        BrowserManager answers every allowlisted request from this server
+                        (route.fetch -> route.fulfill) and the runner/outbox use FakeMailer.
+* `fixture_inbox()`     broker_id -> raw .eml messages for FakeMailer.
+"""
+from __future__ import annotations
+
+import contextlib
+import os
+import threading
+from collections.abc import Iterator
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+from pathlib import Path
+from urllib.parse import unquote, urlsplit
+
+from ...models import Registry
+from ..outbox import DEV_FIXTURES_ENV
+
+DEV_DIR = Path(__file__).resolve().parent
+SITE_DIR = DEV_DIR / "site"
+INBOX_DIR = DEV_DIR / "inbox"
+REGISTRY_PATH = DEV_DIR / "registry.yaml"
+
+
+def fixture_registry() -> Registry:
+    from ...registry import load_registry
+    return load_registry(REGISTRY_PATH)
+
+
+def fixture_inbox() -> dict[str, list[bytes]]:
+    out: dict[str, list[bytes]] = {}
+    for f in sorted(INBOX_DIR.glob("*.eml")):
+        out.setdefault(f.stem.split(".")[0], []).append(f.read_bytes())
+    return out
+
+
+def resolve(path: str) -> Path | None:
+    """Map '/<host>/<path>' to a file under SITE_DIR (path, path.html, path/index.html)."""
+    rel = unquote(urlsplit(path).path).lstrip("/")
+    if not rel or "\\" in rel or any(p in ("..", "") for p in rel.rstrip("/").split("/")):
+        return None
+    base = (SITE_DIR / rel.rstrip("/")).resolve()
+    if SITE_DIR.resolve() not in base.parents:
+        return None
+    for cand in (base, base.with_name(base.name + ".html"), base / "index.html"):
+        if cand.is_file():
+            return cand
+    return None
+
+
+class _Handler(BaseHTTPRequestHandler):
+    def _serve(self) -> None:
+        if self.command == "POST":
+            n = int(self.headers.get("Content-Length") or 0)
+            self.rfile.read(min(n, 1_000_000))
+        f = resolve(self.path)
+        if f is None:
+            body = b"<html><body><h1>Not found</h1></body></html>"
+            self.send_response(404)
+        else:
+            body = f.read_bytes()
+            self.send_response(200)
+        ctype = "text/html; charset=utf-8" if f is None or f.suffix in (".html", "") \
+            else "application/octet-stream"
+        self.send_header("Content-Type", ctype)
+        self.send_header("Content-Length", str(len(body)))
+        self.end_headers()
+        self.wfile.write(body)
+
+    do_GET = _serve
+    do_POST = _serve
+
+    def log_message(self, format: str, *args: object) -> None:
+        return
+
+
+@contextlib.contextmanager
+def fixture_server() -> Iterator[str]:
+    """Serve the fixture site on 127.0.0.1 and point the engine at it. Yields the base URL."""
+    srv = ThreadingHTTPServer(("127.0.0.1", 0), _Handler)
+    t = threading.Thread(target=srv.serve_forever, daemon=True)
+    t.start()
+    base = f"http://127.0.0.1:{srv.server_address[1]}"
+    old = os.environ.get(DEV_FIXTURES_ENV)
+    os.environ[DEV_FIXTURES_ENV] = base
+    try:
+        yield base
+    finally:
+        if old is None:
+            os.environ.pop(DEV_FIXTURES_ENV, None)
+        else:
+            os.environ[DEV_FIXTURES_ENV] = old
+        srv.shutdown()
+        srv.server_close()

freemyid/engine/_dev/devrun.py

@@ -0,0 +1,101 @@
+"""Run the whole loop end to end against the dev fixtures. No internet, no real email.
+
+    .venv/bin/python -m freemyid.engine._dev.devrun                 # `freemyid run --dry-run`
+    .venv/bin/python -m freemyid.engine._dev.devrun --no-mailbox    # D2 manual-send path
+    .venv/bin/python -m freemyid.engine._dev.devrun --submit        # fixture "submissions"
+    .venv/bin/python -m freemyid.engine._dev.devrun --scheduled     # quiet D4 run
+
+It makes a throwaway FREEMYID_HOME (weak test key, fake person Jane Q Testperson), installs
+the fixture registry as that home's registry cache, starts the fixture server and calls the
+real CLI. `--submit` enables "real" submissions in the throwaway home only: every request is
+answered by the local fixture server and mail goes to FakeMailer.
+"""
+from __future__ import annotations
+
+import argparse
+import os
+import shutil
+import sys
+import tempfile
+from pathlib import Path
+
+
+def _setup_home(home: Path, *, mailbox: bool, submit: bool) -> None:
+    os.environ["FREEMYID_HOME"] = str(home)
+    os.environ.setdefault("FREEMYID_TEST_KEY", "devrun-weak-key-fake-data-only")
+    os.environ["FREEMYID_ALLOW_TEST_KEY"] = "1"
+    from freemyid import config as cfgmod
+    from freemyid import paths
+    from freemyid.consent import CURRENT_TEXT_VERSION
+    from freemyid.models import Address, Consent, ConsentBasis, MailboxConfig, PersonName, Profile
+    from freemyid.storage import Store
+
+    from . import REGISTRY_PATH
+    shutil.copyfile(REGISTRY_PATH, paths.registry_cache_path())
+    cfg = cfgmod.Config(min_delay_s=0, max_delay_s=0, max_retries=1,
+                        real_submissions_enabled=submit)
+    cfgmod.save(cfg)
+    store = Store()
+    if not store.list_profiles():
+        mb = MailboxConfig(address="removals.testperson@mail.example",
+                           imap_host="imap.mail.example", smtp_host="smtp.mail.example",
+                           username="removals.testperson@mail.example") if mailbox else None
+        store.save_profile(Profile(
+            label="Tester",
+            consent=Consent(basis=ConsentBasis.SELF, attested_by="Jane Q Testperson",
+                            text_version=CURRENT_TEXT_VERSION),
+            name=PersonName(first="Jane", middle="Q", last="Testperson"),
+            addresses=[Address(city="Springfield", state="IL", zip="62704", current=True)],
+            age=46, relatives=["John Testperson"], mailbox=mb))
+    store.close()
+
+
+def _show(home: Path) -> None:
+    from freemyid.storage import Store
+    store = Store()
+    print("\n--- statuses (broker: state / tier)")
+    for st in sorted(store.list_statuses(), key=lambda s: s.broker_id):
+        print(f"  {st.broker_id:12} {st.state.value:22} {st.tier.value if st.tier else '-'}")
+    print("--- open to-dos")
+    for t in store.list_todos():
+        print(f"  {t.kind.value:20} {t.broker_id or '-':12} {t.title}  "
+              f"[copy: {', '.join(t.copy_fields)}]")
+    print("--- requests")
+    for r in store.list_requests():
+        print(f"  {r.broker_id:12} {r.kind.value:12} {r.status.value:20} dry_run={r.dry_run}")
+    n = sum(len(store.list_evidence(p.id)) for p in store.list_profiles())
+    print(f"--- evidence: {n} item(s)")
+    store.close()
+
+
+def main(argv: list[str] | None = None) -> int:
+    ap = argparse.ArgumentParser(description=__doc__.splitlines()[0])
+    ap.add_argument("--home", type=Path, help="FREEMYID_HOME to use (default: new temp dir)")
+    ap.add_argument("--no-mailbox", action="store_true")
+    ap.add_argument("--submit", action="store_true", help="fixture submissions, not dry run")
+    ap.add_argument("--scheduled", action="store_true")
+    ap.add_argument("--keep", action="store_true", help="keep the temp home")
+    a = ap.parse_args(argv)
+    home = a.home or Path(tempfile.mkdtemp(prefix="freemyid-devrun-"))
+    _setup_home(home, mailbox=not a.no_mailbox, submit=a.submit)
+
+    from freemyid.cli import app
+
+    from . import fixture_server
+    args = ["run"] + ([] if a.submit else ["--dry-run"]) + (["--scheduled"] if a.scheduled
+                                                           else [])
+    code = 0
+    with fixture_server() as base:
+        print(f"fixture server: {base}  home: {home}")
+        try:
+            app(args, standalone_mode=False)
+        except SystemExit as e:
+            code = int(e.code or 0)
+    _show(home)
+    if not a.keep and not a.home:
+        shutil.rmtree(home, ignore_errors=True)
+    return code
+
+
+if __name__ == "__main__":
+    sys.exit(main())

freemyid/engine/_dev/inbox/devauto.eml

@@ -0,0 +1,7 @@
+From: Dev Auto People <noreply@devauto.example>
+To: removals.testperson@mail.example
+Subject: Confirm your opt-out
+Content-Type: text/html; charset=utf-8
+
+<p>Click to confirm: <a href="https://devauto.example/confirm?token=dev123">confirm</a></p>
+<p>Not this one: <a href="https://evil.example/steal">x</a></p>