fufu-cloud-cli 0.5.0__py3-none-any.whl

fufu_cloud_cli/__init__.py

@@ -0,0 +1,3 @@
+"""FUFU CLI 與本機部署工具；相容範圍見 capabilities.json。"""
+
+__version__ = "0.5.0"

fufu_cloud_cli/__main__.py

@@ -0,0 +1,9 @@
+import sys
+
+from .cli import entry
+
+if __name__ == "__main__":
+    if len(sys.argv) > 1 and sys.argv[1] in {"fufu", "aws-fufu", "gcloud-fufu", "az-fufu"}:
+        entry(sys.argv[1], sys.argv[2:])
+    else:
+        entry("fufu", sys.argv[1:])

fufu_cloud_cli/api_backend.py

@@ -0,0 +1,302 @@
+"""FUFU credential exchange and tenant-bound API transport (standard library only)."""
+import ipaddress
+import json
+import os
+import re
+import ssl
+import signal
+import threading
+import time
+from contextlib import contextmanager
+from pathlib import Path
+from urllib.error import HTTPError, URLError
+from urllib.parse import quote, urlsplit, urlencode
+from urllib.request import HTTPRedirectHandler, HTTPSHandler, ProxyHandler, Request, build_opener
+
+from .errors import FufuError, require
+
+PROVIDERS = {"aws", "gcp", "azure"}
+MAX_RESPONSE = 2 * 1024 * 1024
+
+
+@contextmanager
+def request_deadline(seconds=20):
+    # Linux CLI 的總期限包含 DNS、連線及持續傳送的小分段回應。
+    enabled = hasattr(signal, 'setitimer') and threading.current_thread() is threading.main_thread()
+    if not enabled:
+        yield
+        return
+    started = time.monotonic()
+    previous_handler = signal.getsignal(signal.SIGALRM)
+    previous_timer = signal.getitimer(signal.ITIMER_REAL)
+    def expired(*args):
+        raise FufuError("API_TIMEOUT", "FUFU API 請求超過總執行期限。")
+    signal.signal(signal.SIGALRM, expired)
+    signal.setitimer(signal.ITIMER_REAL, min(seconds, previous_timer[0]) if previous_timer[0] else seconds)
+    try:
+        yield
+    finally:
+        signal.setitimer(signal.ITIMER_REAL, 0)
+        signal.signal(signal.SIGALRM, previous_handler)
+        if previous_timer[0]:
+            signal.setitimer(signal.ITIMER_REAL, max(0.001, previous_timer[0] - (time.monotonic() - started)), previous_timer[1])
+
+
+class NoRedirect(HTTPRedirectHandler):
+    def redirect_request(self, req, fp, code, msg, headers, newurl):
+        return None
+
+
+def endpoint_url(value):
+    require(isinstance(value, str) and value == value.strip(), "INVALID_ENDPOINT", "請提供有效的 FUFU API endpoint。")
+    parsed = urlsplit(value)
+    loopback = parsed.hostname == "localhost"
+    try:
+        loopback = loopback or ipaddress.ip_address(parsed.hostname).is_loopback
+    except ValueError:
+        pass
+    require(parsed.hostname and not parsed.username and not parsed.password
+            and not parsed.query and not parsed.fragment and parsed.path in {"", "/"}
+            and not any(c.isspace() for c in value) and "\\" not in value
+            and (parsed.scheme == "https" or (parsed.scheme == "http" and loopback)),
+            "INVALID_ENDPOINT", "FUFU endpoint 必須使用 HTTPS；本機 loopback 可使用 HTTP。")
+    _ = parsed.port
+    return value.rstrip("/")
+
+
+def api_selected():
+    mode = os.environ.get("FUFU_BACKEND")
+    require(mode in {None, "api", "local-docker", "docker"}, "INVALID_BACKEND", "FUFU_BACKEND 必須是 api 或 local-docker。")
+    if mode in {"local-docker", "docker"}:
+        return False
+    return mode == "api" or any(os.environ.get(k) for k in (
+        "FUFU_ENDPOINT", "FUFU_CREDENTIAL_FILE", "FUFU_AWS_CREDENTIAL_FILE",
+        "FUFU_GCP_CREDENTIAL_FILE", "FUFU_AZURE_CREDENTIAL_FILE", 'FUFU_SESSION_FILE')) or os.environ.get("AWS_ACCESS_KEY_ID", "").startswith("FUFU")
+
+
+def load_credential(provider=None, filename=None):
+    require(provider is None or provider in PROVIDERS, "INVALID_PROVIDER", "未知的 provider。")
+    filename = filename or (os.environ.get(f"FUFU_{provider.upper()}_CREDENTIAL_FILE") if provider else None) or os.environ.get("FUFU_CREDENTIAL_FILE")
+    if not filename and provider == "gcp":
+        filename = os.environ.get("GOOGLE_APPLICATION_CREDENTIALS")
+    if filename:
+        p = Path(filename).expanduser()
+        require(p.is_file() and p.stat().st_size <= 16384, "INVALID_CREDENTIAL", "憑證檔案不存在或格式無效。")
+        data = json.loads(p.read_text(encoding="utf-8"))
+    elif provider == "aws" and os.environ.get("AWS_ACCESS_KEY_ID", "").startswith("FUFUAWS"):
+        data = {"fufu_version": 1, "fufu_provider": "aws", "fufu_endpoint": os.environ.get("FUFU_ENDPOINT"),
+                "fufu_tenant_id": os.environ.get("FUFU_TENANT_ID"), "aws_access_key_id": os.environ["AWS_ACCESS_KEY_ID"],
+                "aws_secret_access_key": os.environ.get("AWS_SECRET_ACCESS_KEY")}
+    else:
+        raise FufuError("CREDENTIAL_REQUIRED", "請透過 FUFU_CREDENTIAL_FILE 或各 provider 的 FUFU_*_CREDENTIAL_FILE 注入憑證檔案。")
+    require(isinstance(data, dict) and data.get("fufu_version") == 1
+            and data.get("fufu_provider") in PROVIDERS, "INVALID_CREDENTIAL", "需要 FUFU 專用憑證；不接受正式雲端金鑰。")
+    actual = data["fufu_provider"]
+    require(provider is None or actual == provider, "PROVIDER_MISMATCH", "憑證所屬 provider 不符。")
+    fields = {"aws": ("aws_access_key_id", "aws_secret_access_key"), "gcp": ("client_id", "client_secret"), "azure": ("clientId", "clientSecret")}
+    key, secret = (data.get(k) for k in fields[actual])
+    require(isinstance(key, str) and re.fullmatch(r"FUFU" + actual.upper() + r"[A-Za-z0-9_-]{12,100}", key)
+            and isinstance(secret, str) and 24 <= len(secret) <= 1024,
+            "INVALID_CREDENTIAL", "FUFU 憑證欄位無效。")
+    if actual == "gcp":
+        require(data.get("type") == "fufu_service_account", "INVALID_CREDENTIAL", "需要 FUFU service account JSON。")
+    tenant = data.get("fufu_tenant_id")
+    require(isinstance(tenant, str) and re.fullmatch(r"tenant-[a-z0-9]{8,32}", tenant), "INVALID_CREDENTIAL", "憑證缺少有效的 tenant。")
+    require(not os.environ.get("FUFU_TENANT_ID") or os.environ["FUFU_TENANT_ID"] == tenant,
+            "TENANT_MISMATCH", "環境指定的 tenant 與憑證不符。")
+    endpoint = endpoint_url(os.environ.get("FUFU_ENDPOINT") or data.get("fufu_endpoint"))
+    return {"provider": actual, "credential_id": key, "credential_secret": secret, "tenant_id": tenant}, endpoint
+
+
+class ApiClient:
+    def __init__(self, provider=None, filename=None, read_only=False):
+        self.owns_token = True
+        self.opener = build_opener(ProxyHandler({}), NoRedirect(), HTTPSHandler(context=ssl.create_default_context()))
+        if os.environ.get('FUFU_SESSION_FILE') and not filename:
+            p = Path(os.environ['FUFU_SESSION_FILE'])
+            require(p.is_file() and p.stat().st_size <= 16384, 'INVALID_SESSION', 'Session 檔案無效。')
+            session = json.loads(p.read_text())
+            self.endpoint = endpoint_url(session.get('endpoint'))
+            self.provider, self.token = session.get('provider'), session.get('access_token')
+            require(self.provider in PROVIDERS and (provider is None or provider == self.provider)
+                    and isinstance(self.token, str) and re.fullmatch(r'fufu_at_[A-Za-z0-9_-]{43}', self.token)
+                    and session.get('expires_at', 0) > time.time(), 'INVALID_SESSION', 'Session 已過期或 provider 不符。')
+            self.owns_token = False
+            who = self.whoami()
+            require((who.get('role') or (session.get('session_kind') == 'terminal' and who.get('sessionKind') == 'terminal'))
+                    and who.get('kind') == 'cli' and who.get('tenantId') == session.get('tenant_id') and who.get('provider') == self.provider,
+                    'INVALID_SESSION', 'Session 的租戶與 role 無效。')
+            self.check_selectors(who)
+            return
+        credential, self.endpoint = load_credential(provider, filename)
+        self.provider = credential["provider"]
+        self.token = None
+        self.opener = build_opener(ProxyHandler({}), NoRedirect(), HTTPSHandler(context=ssl.create_default_context()))
+        scopes = [f"{self.provider}:read"] + ([] if read_only else [f"{self.provider}:write"])
+        issued = self._request("POST", "/api/auth/token", {**credential, "scopes": scopes,
+            **({'assume_role': os.environ['FUFU_ASSUME_ROLE']} if os.environ.get('FUFU_ASSUME_ROLE') else {})})
+        token = issued.get("access_token")
+        require(isinstance(token, str) and re.fullmatch(r"fufu_at_[A-Za-z0-9_-]{43}", token),
+                "INVALID_RESPONSE", "API 回傳的權杖格式無效。")
+        self.token = token
+        p = issued.get("principal", {})
+        if p.get("provider") != self.provider or p.get("tenantId") != credential["tenant_id"] or p.get("kind") != "cli":
+            self.close()
+            raise FufuError("TENANT_MISMATCH", "API 回覆的身分與憑證不符。")
+        if os.environ.get('FUFU_SELECTED_REGION') or os.environ.get('FUFU_SELECTED_PROJECT'):
+            try: self.check_selectors(self.whoami())
+            except Exception:
+                self.close(); raise
+
+    def check_selectors(self, who):
+        for env, field in [('FUFU_SELECTED_REGION', 'region'), ('FUFU_SELECTED_PROJECT', 'projectId')]:
+            require(not os.environ.get(env) or os.environ[env] == who.get(field), 'RESOURCE_SCOPE_MISMATCH', 'region／project 必須符合目前憑證的 FUFU scope。')
+
+    def _request(self, method, path, body=None, *, large=False):
+        require(path.startswith("/api/") and "\r" not in path and "\n" not in path,
+                "INVALID_REQUEST", "API 路徑無效。")
+        headers = {"Accept": "application/json", "User-Agent": "fufu-cloud-cli"}
+        if self.token:
+            headers["Authorization"] = f"Bearer {self.token}"
+        data = None if body is None else json.dumps(body).encode("utf-8")
+        if data is not None:
+            require(len(data) <= (12 * 1024**2 if large else 65536), "PAYLOAD_LIMIT", "API JSON payload 超過上限。")
+            headers["Content-Type"] = "application/json"
+        req = Request(self.endpoint + path, data=data, headers=headers, method=method)
+        try:
+            with request_deadline(), self.opener.open(req, timeout=15) as response:
+                limit = 9 * 1024**2 if large else MAX_RESPONSE
+                raw = response.read(limit + 1)
+                require(len(raw) <= limit, "RESPONSE_LIMIT", "API 回覆超過大小限制。")
+                return json.loads(raw)
+        except HTTPError as exc:
+            status = exc.code
+            exc.close()
+            codes = {401: "AUTHENTICATION_FAILED", 403: "ACCESS_DENIED", 404: "RESOURCE_NOT_FOUND", 409: "RESOURCE_CONFLICT", 429: "RATE_LIMITED"}
+            raise FufuError(codes.get(status, "API_REQUEST_FAILED"), f"FUFU API 拒絕請求（HTTP {status}）；未輸出憑證或原始回應。") from None
+        except (URLError, TimeoutError, ConnectionError) as exc:
+            raise FufuError("API_UNREACHABLE", "無法在時限內安全連線至 FUFU API。") from None
+
+    def request(self, method, path, body=None):
+        return self._request(method, f"/api/cloud/{self.provider}" + path, body, large=path.startswith(('/compute/', '/s3/', '/storage/', '/control/native')))
+
+    def whoami(self):
+        data = self._request("GET", "/api/auth/whoami")
+        return {k: v for k, v in data.items() if k != "credentialId"}
+
+    def close(self):
+        if self.token and self.owns_token:
+            try:
+                self._request("POST", "/api/auth/revoke", {})
+            except (FufuError, ValueError, OSError):
+                pass
+            finally:
+                self.token = None
+
+    def __enter__(self):
+        return self
+
+    def __exit__(self, *args):
+        self.close()
+
+
+def segment(value):
+    require(isinstance(value, str) and value not in {"", ".", ".."} and "/" not in value,
+            "INVALID_RESOURCE", "資源名稱無效。")
+    return quote(value, safe="")
+
+
+def storage_path(value):
+    parsed = urlsplit(value)
+    require(parsed.scheme == "gs" and parsed.netloc and not parsed.query and not parsed.fragment
+            and not parsed.username and not parsed.password, "INVALID_RESOURCE", "請使用 gs://bucket 或 gs://bucket/object。")
+    return segment(parsed.netloc), parsed.path.lstrip("/")
+
+
+def remote_command(provider, argv, Parser):
+    p = Parser(prog={"aws": "aws-fufu", "gcp": "gcloud-fufu", "azure": "az-fufu"}[provider],
+               description="FUFU API 憑證與租戶資源操作子集；無原生雲端 IAM／部署相容承諾。")
+    roots = p.add_subparsers(dest="service", required=True)
+    if provider == "aws":
+        roots.add_parser("sts").add_subparsers(dest="action", required=True).add_parser("get-caller-identity")
+        sub = roots.add_parser("dynamodb").add_subparsers(dest="action", required=True)
+        sub.add_parser("list-tables")
+        for action in ("create-table", "delete-table", "put-item", "scan"):
+            q = sub.add_parser(action)
+            q.add_argument("--table-name", required=True)
+            if action == "create-table":
+                q.add_argument("--partition-key", default="id", help="FUFU 字串 HASH key；預設 id")
+            if action == "put-item":
+                q.add_argument("--item", required=True, help="DynamoDB AttributeValue JSON，建議 file:// 路徑")
+    elif provider == "gcp":
+        roots.add_parser("auth").add_subparsers(dest="action", required=True).add_parser("list")
+        sub = roots.add_parser("storage").add_subparsers(dest="action", required=True)
+        buckets = sub.add_parser("buckets").add_subparsers(dest="bucket_action", required=True)
+        buckets.add_parser("list")
+        for action in ("create", "delete"):
+            buckets.add_parser(action).add_argument("url")
+        sub.add_parser("ls").add_argument("url")
+        sub.add_parser("cat").add_argument("url")
+        cp = sub.add_parser("cp")
+        cp.add_argument("source")
+        cp.add_argument("destination")
+        sub.add_parser("rm").add_argument("url")
+    else:
+        roots.add_parser("account").add_subparsers(dest="action", required=True).add_parser("show")
+        for group in ("group", "resource"):
+            sub = roots.add_parser(group).add_subparsers(dest="action", required=True)
+            sub.add_parser("list")
+            for action in ("show", "delete"):
+                sub.add_parser(action).add_argument("--name", required=True)
+            if group == "group":
+                q = sub.add_parser("create")
+                q.add_argument("--name", required=True)
+                q.add_argument("--location", default="eastasia")
+    a = p.parse_args(argv)
+    read_only = a.service in {"sts", "auth", "account"} or a.action in {"list", "list-tables", "scan", "show", "ls", "cat"} or getattr(a, "bucket_action", None) == "list" or (a.action == 'cp' and a.source.startswith('gs://'))
+    with ApiClient(provider, read_only=read_only) as api:
+        if a.service in {"sts", "auth", "account"}:
+            return api.whoami()
+        if provider == "aws":
+            if a.action == "list-tables":
+                return api.request("GET", "/dynamodb/tables")
+            path = "/dynamodb/tables/" + segment(a.table_name)
+            if a.action == "create-table":
+                return api.request("POST", "/dynamodb/tables", {"TableName": a.table_name, "PartitionKey": a.partition_key})
+            if a.action == "delete-table":
+                return api.request("DELETE", path)
+            if a.action == "scan":
+                return api.request("GET", path + "/items")
+            from .cli import payload
+            return api.request("POST", path + "/items", {"Item": json.loads(payload(a.item))})
+        if provider == "azure":
+            if a.action == "list":
+                result = api.request("GET", "/resources")
+                return {"value": [r for r in result["value"] if r.get("kind") == "resource-groups"]} if a.service == "group" else result
+            if a.action == "create":
+                return api.request("POST", "/resources", {"name": a.name, "location": a.location})
+            return api.request("GET" if a.action == "show" else "DELETE", "/resources/" + segment(a.name))
+        if a.action == "buckets" and a.bucket_action == "list":
+            return api.request("GET", "/storage/buckets")
+        if a.action == 'cp' and a.source.startswith('gs://'):
+            from .cloud_data import download_bytes
+            require(not a.destination.startswith('gs://'), 'UNSUPPORTED_ARGUMENT', 'cp 目前只支援本機與 Storage 之間傳輸。')
+            bucket, key = storage_path(a.source)
+            require(bool(key), 'INVALID_RESOURCE', '請指定 object 名稱。')
+            result = api.request('GET', '/storage/buckets/' + bucket + '/object?' + urlencode({'name': key, 'encoding': 'base64'}))
+            return download_bytes(a.destination, result['contentBase64'])
+        bucket, key = storage_path(a.destination if a.action == "cp" else a.url)
+        path = "/storage/buckets/" + bucket
+        if a.action == "buckets":
+            require(not key, "INVALID_RESOURCE", "Bucket 操作不接受 object 路徑。")
+            return api.request("POST", "/storage/buckets", {"name": bucket}) if a.bucket_action == "create" else api.request("DELETE", path)
+        if a.action == "ls":
+            require(not key, "UNSUPPORTED_ARGUMENT", "ls 目前只支援 bucket 根目錄。")
+            return api.request("GET", path + "/objects")
+        require(bool(key), "INVALID_RESOURCE", "請指定 object 名稱。")
+        if a.action == "cat":
+            return api.request("GET", path + "/object?" + urlencode({"name": key}))
+        if a.action == "rm":
+            return api.request("DELETE", path + "/object?" + urlencode({"name": key}))
+        from .cloud_data import upload_bytes
+        return api.request("POST", path + "/objects", {"name": key, "contentBase64": upload_bytes(a.source)})