fufu-cloud-cli 0.9.0__tar.gz → 0.9.2__tar.gz

{fufu_cloud_cli-0.9.0/src/fufu_cloud_cli.egg-info → fufu_cloud_cli-0.9.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fufu-cloud-cli
-Version: 0.9.0
+Version: 0.9.2
 Summary: FUFU Cloud CLI for tenant-scoped mock cloud development and deployment
 License-Expression: LicenseRef-Proprietary
 Requires-Python: >=3.10
@@ -22,12 +22,19 @@ Dynamic: license-file
 `gcloud-fufu`、`az-fufu`、`wrangler-fufu`。這是 AWS、Google Cloud、Azure 與 Cloudflare 的**明確子集**，
 只供 FUFU mock 環境使用；不會把部署轉送到正式雲端。
 
+0.9.2 新增 `gcloud-fufu secrets versions describe`，以 metadata 權限查看版本狀態而不讀取秘密；GCP 秘密內容不可為空。配套後端依真實 GCP 驗證修正 Editor／Viewer 等角色的明列權限子集、Gen 1 HTTP invoker 與 Pub/Sub 的 0 秒預設 ack deadline。這些新能力需要同步更新 FUFU 服務端；沒有完整 Google IAM、SDK／ADC 或自動擴縮相容保證。
+
+0.9.1 統一所有 CLI API 請求的 `User-Agent: fufu-cloud-cli`，涵蓋物件傳輸、
+Cloudflare 靜態檔案部署、IaC 遠端 state 與 Cloud Shell session，避免沿用
+Python 預設識別而遇到 Cloudflare HTTP 403／1010。識別標頭不取代 credential
+或 IAM；HTTPS 驗證、禁止重新導向與不使用環境代理的行為保留。
+
 0.8.0 包含資源配額、分段傳輸、Terraform 核心子集與 Cloudflare 靜態部署／R2。需要同步更新服務端；CLI 安裝成功不表示任意 FUFU 服務端都已有這些能力。
 
 ## Cloudflare 前端部署與 R2
 
 ```bash
-pip install 'fufu-cloud-cli==0.8.0'
+pip install 'fufu-cloud-cli==0.9.2'
 export FUFU_CLOUDFLARE_CREDENTIAL_FILE=/run/secrets/fufu-cloudflare.json
 wrangler-fufu capabilities
 wrangler-fufu pages project create frontend --production-branch main

{fufu_cloud_cli-0.9.0 → fufu_cloud_cli-0.9.2}/README.md

@@ -4,12 +4,19 @@
 `gcloud-fufu`、`az-fufu`、`wrangler-fufu`。這是 AWS、Google Cloud、Azure 與 Cloudflare 的**明確子集**，
 只供 FUFU mock 環境使用；不會把部署轉送到正式雲端。
 
+0.9.2 新增 `gcloud-fufu secrets versions describe`，以 metadata 權限查看版本狀態而不讀取秘密；GCP 秘密內容不可為空。配套後端依真實 GCP 驗證修正 Editor／Viewer 等角色的明列權限子集、Gen 1 HTTP invoker 與 Pub/Sub 的 0 秒預設 ack deadline。這些新能力需要同步更新 FUFU 服務端；沒有完整 Google IAM、SDK／ADC 或自動擴縮相容保證。
+
+0.9.1 統一所有 CLI API 請求的 `User-Agent: fufu-cloud-cli`，涵蓋物件傳輸、
+Cloudflare 靜態檔案部署、IaC 遠端 state 與 Cloud Shell session，避免沿用
+Python 預設識別而遇到 Cloudflare HTTP 403／1010。識別標頭不取代 credential
+或 IAM；HTTPS 驗證、禁止重新導向與不使用環境代理的行為保留。
+
 0.8.0 包含資源配額、分段傳輸、Terraform 核心子集與 Cloudflare 靜態部署／R2。需要同步更新服務端；CLI 安裝成功不表示任意 FUFU 服務端都已有這些能力。
 
 ## Cloudflare 前端部署與 R2
 
 ```bash
-pip install 'fufu-cloud-cli==0.8.0'
+pip install 'fufu-cloud-cli==0.9.2'
 export FUFU_CLOUDFLARE_CREDENTIAL_FILE=/run/secrets/fufu-cloudflare.json
 wrangler-fufu capabilities
 wrangler-fufu pages project create frontend --production-branch main

{fufu_cloud_cli-0.9.0 → fufu_cloud_cli-0.9.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "fufu-cloud-cli"
-version = "0.9.0"
+version = "0.9.2"
 description = "FUFU Cloud CLI for tenant-scoped mock cloud development and deployment"
 readme = "README.md"
 requires-python = ">=3.10"

{fufu_cloud_cli-0.9.0 → fufu_cloud_cli-0.9.2}/src/fufu_cloud_cli/__init__.py

@@ -1,3 +1,3 @@
 """FUFU CLI 與本機部署工具；相容範圍見 capabilities.json。"""
 
-__version__ = "0.9.0"
+__version__ = "0.9.2"

{fufu_cloud_cli-0.9.0 → fufu_cloud_cli-0.9.2}/src/fufu_cloud_cli/api_backend.py

@@ -19,6 +19,7 @@ PROVIDERS = {"aws", "gcp", "azure", "cloudflare"}
 from .limits import JSON_BODY_BYTES, JSON_RESPONSE_BYTES
 
 MAX_RESPONSE = 8 * 1024 * 1024
+HTTP_USER_AGENT = "fufu-cloud-cli"
 
 
 @contextmanager
@@ -49,6 +50,15 @@ class NoRedirect(HTTPRedirectHandler):
         return None
 
 
+def api_opener():
+    """Keep the CLI identity on every request, including binary and IaC traffic."""
+    opener = build_opener(ProxyHandler({}), NoRedirect(), HTTPSHandler(context=ssl.create_default_context()))
+    # Python-urllib's default identity can trigger Cloudflare error 1010. Set
+    # this at the transport boundary so new request paths inherit it as well.
+    opener.addheaders = [("User-Agent", HTTP_USER_AGENT)]
+    return opener
+
+
 def endpoint_url(value):
     require(isinstance(value, str) and value == value.strip(), "INVALID_ENDPOINT", "請提供有效的 FUFU API endpoint。")
     parsed = urlsplit(value)
@@ -113,7 +123,7 @@ def load_credential(provider=None, filename=None):
 class ApiClient:
     def __init__(self, provider=None, filename=None, read_only=False):
         self.owns_token = True
-        self.opener = build_opener(ProxyHandler({}), NoRedirect(), HTTPSHandler(context=ssl.create_default_context()))
+        self.opener = api_opener()
         if os.environ.get('FUFU_SESSION_FILE') and not filename:
             p = Path(os.environ['FUFU_SESSION_FILE'])
             require(p.is_file() and p.stat().st_size <= 16384, 'INVALID_SESSION', 'Session 檔案無效。')
@@ -133,7 +143,6 @@ class ApiClient:
         credential, self.endpoint = load_credential(provider, filename)
         self.provider = credential["provider"]
         self.token = None
-        self.opener = build_opener(ProxyHandler({}), NoRedirect(), HTTPSHandler(context=ssl.create_default_context()))
         scopes = [f"{self.provider}:read"] + ([] if read_only else [f"{self.provider}:write"])
         issued = self._request("POST", "/api/auth/token", {**credential, "scopes": scopes,
             **({'assume_role': os.environ['FUFU_ASSUME_ROLE']} if os.environ.get('FUFU_ASSUME_ROLE') else {})})
@@ -157,7 +166,7 @@ class ApiClient:
     def _request(self, method, path, body=None, *, large=False):
         require(path.startswith("/api/") and "\r" not in path and "\n" not in path,
                 "INVALID_REQUEST", "API 路徑無效。")
-        headers = {"Accept": "application/json", "User-Agent": "fufu-cloud-cli"}
+        headers = {"Accept": "application/json"}
         if self.token:
             headers["Authorization"] = f"Bearer {self.token}"
         data = None if body is None else json.dumps(body).encode("utf-8")

{fufu_cloud_cli-0.9.0 → fufu_cloud_cli-0.9.2}/src/fufu_cloud_cli/secrets.py

@@ -7,7 +7,7 @@ from .api_backend import ApiClient, api_selected
 from .errors import require
 
 
-def input_data(filename=None, variable=None):
+def input_data(filename=None, variable=None, minimum=0):
     if variable:
         require(variable in os.environ, 'MISSING_ENV', '秘密環境變數未注入。')
         raw = os.environ[variable].encode()
@@ -17,6 +17,7 @@ def input_data(filename=None, variable=None):
         require(file.is_file() and not file.is_symlink() and file.stat().st_size <= 65536, 'INVALID_SECRET', '秘密來源必須是不超過 64 KiB 的一般檔案。')
         raw = file.read_bytes()
     require(len(raw) <= 65536, 'SECRET_LIMIT', '秘密上限為 64 KiB。')
+    require(len(raw) >= minimum, 'INVALID_SECRET', 'GCP 秘密內容不可為空。')
     return base64.b64encode(raw).decode()
 
 
@@ -46,8 +47,8 @@ def command(provider, argv, Parser):
                 q.add_argument('--replication-policy', choices=['automatic'], default='automatic')
                 src = q.add_mutually_exclusive_group(); src.add_argument('--data-file'); src.add_argument('--secret-env')
         versions = s.add_parser('versions').add_subparsers(dest='version_action', required=True)
-        for action in ['add', 'list', 'access', 'enable', 'disable', 'destroy']:
-            q = versions.add_parser(action); q.set_defaults(operation='versions' if action == 'list' else action)
+        for action in ['add', 'list', 'describe', 'access', 'enable', 'disable', 'destroy']:
+            q = versions.add_parser(action); q.set_defaults(operation={'list': 'versions', 'describe': 'describe-version'}.get(action, action))
             if action in {'add', 'list'}: q.add_argument('name')
             else: q.add_argument('version'); q.add_argument('--secret', dest='name', required=True)
             if action == 'add':
@@ -60,14 +61,14 @@ def command(provider, argv, Parser):
     if getattr(args, 'secret_string', None):
         require(args.secret_string.startswith('file://'), 'SECRET_FILE_REQUIRED', '--secret-string 只接受 file:// 路徑；亦可使用 --secret-env。')
         source = args.secret_string[7:]
-    if source is not None or variable: body['data'] = input_data(source, variable)
+    if source is not None or variable: body['data'] = input_data(source, variable, minimum=1 if provider == 'gcp' else 0)
     version = getattr(args, 'version', None) or getattr(args, 'version_id', None) or getattr(args, 'client_request_token', None)
     if version is not None: body['version'] = version
     destination = getattr(args, 'out_file', None)
     if destination:
         file = Path(destination)
         require(not file.exists() and not file.is_symlink() and file.parent.is_dir(), 'OUTPUT_EXISTS', '秘密輸出必須是新檔案。')
-    with ApiClient(provider, read_only=op in {'list', 'describe', 'versions', 'access'}) as api:
+    with ApiClient(provider, read_only=op in {'list', 'describe', 'describe-version', 'versions', 'access'}) as api:
         result = api.request('POST', '/secrets/' + op, body)
     if destination:
         raw = base64.b64decode(result['data'], validate=True)

{fufu_cloud_cli-0.9.0 → fufu_cloud_cli-0.9.2/src/fufu_cloud_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fufu-cloud-cli
-Version: 0.9.0
+Version: 0.9.2
 Summary: FUFU Cloud CLI for tenant-scoped mock cloud development and deployment
 License-Expression: LicenseRef-Proprietary
 Requires-Python: >=3.10
@@ -22,12 +22,19 @@ Dynamic: license-file
 `gcloud-fufu`、`az-fufu`、`wrangler-fufu`。這是 AWS、Google Cloud、Azure 與 Cloudflare 的**明確子集**，
 只供 FUFU mock 環境使用；不會把部署轉送到正式雲端。
 
+0.9.2 新增 `gcloud-fufu secrets versions describe`，以 metadata 權限查看版本狀態而不讀取秘密；GCP 秘密內容不可為空。配套後端依真實 GCP 驗證修正 Editor／Viewer 等角色的明列權限子集、Gen 1 HTTP invoker 與 Pub/Sub 的 0 秒預設 ack deadline。這些新能力需要同步更新 FUFU 服務端；沒有完整 Google IAM、SDK／ADC 或自動擴縮相容保證。
+
+0.9.1 統一所有 CLI API 請求的 `User-Agent: fufu-cloud-cli`，涵蓋物件傳輸、
+Cloudflare 靜態檔案部署、IaC 遠端 state 與 Cloud Shell session，避免沿用
+Python 預設識別而遇到 Cloudflare HTTP 403／1010。識別標頭不取代 credential
+或 IAM；HTTPS 驗證、禁止重新導向與不使用環境代理的行為保留。
+
 0.8.0 包含資源配額、分段傳輸、Terraform 核心子集與 Cloudflare 靜態部署／R2。需要同步更新服務端；CLI 安裝成功不表示任意 FUFU 服務端都已有這些能力。
 
 ## Cloudflare 前端部署與 R2
 
 ```bash
-pip install 'fufu-cloud-cli==0.8.0'
+pip install 'fufu-cloud-cli==0.9.2'
 export FUFU_CLOUDFLARE_CREDENTIAL_FILE=/run/secrets/fufu-cloudflare.json
 wrangler-fufu capabilities
 wrangler-fufu pages project create frontend --production-branch main