granny-devops 0.12.1__tar.gz → 0.13.0__tar.gz

{granny_devops-0.12.1 → granny_devops-0.13.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: granny-devops
-Version: 0.12.1
+Version: 0.13.0
 Summary: Cloud tools collection -- AWS infrastructure, CDN, and DevOps automation
 Author-email: Martin Wieser <martin.wieser@pseekoo.com>
 License: MIT License
@@ -301,10 +301,13 @@ granny authentik add-user-to-group user@example.com     # defaults to dash_admin
 granny authentik api GET /api/v3/core/users/me/        # generic escape hatch
 
 # Zitadel admin (self-hosted OIDC server — same shape as authentik)
-#   Point granny at your Zitadel: set ZITADEL_DOMAIN + a machine credential:
+#   ZITADEL_DOMAIN  (e.g. https://id.example.com) — plain config, NOT a secret;
+#     set it via env or .env/.deploy.env (granny auto-loads those). Not vaulted.
+#   Plus one machine credential:
 #     ZITADEL_API_TOKEN  (a PAT, used as a bearer), OR
 #     ZITADEL_SA_KEY / ZITADEL_SA_KEY_FILE  (service-account key JSON; JWT-profile auth)
-#   Vault keys (with the [vault] extra): granny/infra/zitadel-domain, -api-token, -sa-key
+#   Secret vault keys (with the [vault] extra): granny/infra/zitadel-api-token, -sa-key
+#   Mint a PAT reproducibly:  granny zitadel create-pat iam-admin --expiration 2027-06-27T00:00:00Z
 granny zitadel create-project platform
 granny zitadel create-oidc-app platform my-app \
   --redirect-uri https://app.example.com/oidc/callback

{granny_devops-0.12.1 → granny_devops-0.13.0}/README.md

@@ -168,10 +168,13 @@ granny authentik add-user-to-group user@example.com     # defaults to dash_admin
 granny authentik api GET /api/v3/core/users/me/        # generic escape hatch
 
 # Zitadel admin (self-hosted OIDC server — same shape as authentik)
-#   Point granny at your Zitadel: set ZITADEL_DOMAIN + a machine credential:
+#   ZITADEL_DOMAIN  (e.g. https://id.example.com) — plain config, NOT a secret;
+#     set it via env or .env/.deploy.env (granny auto-loads those). Not vaulted.
+#   Plus one machine credential:
 #     ZITADEL_API_TOKEN  (a PAT, used as a bearer), OR
 #     ZITADEL_SA_KEY / ZITADEL_SA_KEY_FILE  (service-account key JSON; JWT-profile auth)
-#   Vault keys (with the [vault] extra): granny/infra/zitadel-domain, -api-token, -sa-key
+#   Secret vault keys (with the [vault] extra): granny/infra/zitadel-api-token, -sa-key
+#   Mint a PAT reproducibly:  granny zitadel create-pat iam-admin --expiration 2027-06-27T00:00:00Z
 granny zitadel create-project platform
 granny zitadel create-oidc-app platform my-app \
   --redirect-uri https://app.example.com/oidc/callback

{granny_devops-0.12.1 → granny_devops-0.13.0}/granny/__init__.py

@@ -1,6 +1,6 @@
 """Granny -- Cloud tools collection for AWS infrastructure and DevOps automation."""
 
-__version__ = "0.12.1"
+__version__ = "0.13.0"
 __all__ = [
     "get_secret",
     "load_secrets_into_env",

{granny_devops-0.12.1 → granny_devops-0.13.0}/granny/cli/zitadel.py

@@ -275,19 +275,61 @@ def delete_user_cmd(user: str, dry_run: bool) -> None:
     click.echo(json.dumps({"user": user, "deleted": True}, indent=2))
 
 
+# ── personal access tokens ─────────────────────────────────────────────────
+
+
+@zitadel.command("create-pat")
+@click.argument("user")
+@click.option(
+    "--expiration",
+    default=None,
+    help="RFC3339 expiry, e.g. 2027-06-27T00:00:00Z (omit for non-expiring).",
+)
+@click.option("--dry-run", is_flag=True, help="Change nothing.")
+def create_pat_cmd(user: str, expiration: str | None, dry_run: bool) -> None:
+    """Mint a personal access token for machine USER (userName or id).
+
+    Prints {tokenId, token}. The token is shown ONCE — capture it and store it
+    at vault `granny/infra/zitadel-api-token` (or export ZITADEL_API_TOKEN).
+    """
+    if dry_run:
+        click.echo(f"[DRY RUN] Would create a PAT for {user!r} (expiration={expiration})")
+        return
+    client = _client()
+    out = client.create_pat(_resolve_user(client, user), expiration_date=expiration)
+    click.echo(json.dumps({"tokenId": out.get("tokenId"), "token": out.get("token")}, indent=2))
+
+
+@zitadel.command("revoke-pat")
+@click.argument("user")
+@click.argument("token_id")
+@click.option("--dry-run", is_flag=True, help="Change nothing.")
+def revoke_pat_cmd(user: str, token_id: str, dry_run: bool) -> None:
+    """Revoke PAT TOKEN_ID belonging to machine USER (userName or id)."""
+    if dry_run:
+        click.echo(f"[DRY RUN] Would revoke PAT {token_id} of {user!r}")
+        return
+    client = _client()
+    client.delete_pat(_resolve_user(client, user), token_id)
+    click.echo(json.dumps({"user": user, "tokenId": token_id, "revoked": True}, indent=2))
+
+
 # ── list ─────────────────────────────────────────────────────────────────
 
 
 @zitadel.command("list")
-@click.argument("kind", type=click.Choice(["users", "projects", "apps", "roles"]))
+@click.argument("kind", type=click.Choice(["users", "projects", "apps", "roles", "pats"]))
 @click.option(
     "--project", default=None, help="Project (id or name) — required for apps/roles."
 )
+@click.option(
+    "--user", default=None, help="User (userName or id) — required for pats."
+)
 @click.option(
     "--json", "as_json", is_flag=True, help="Emit full JSON instead of a table."
 )
-def list_cmd(kind: str, project: str | None, as_json: bool) -> None:
-    """List Zitadel objects of KIND (users | projects | apps | roles)."""
+def list_cmd(kind: str, project: str | None, user: str | None, as_json: bool) -> None:
+    """List Zitadel objects of KIND (users | projects | apps | roles | pats)."""
     client = _client()
     if kind == "users":
         rows = client.list_users()
@@ -295,6 +337,12 @@ def list_cmd(kind: str, project: str | None, as_json: bool) -> None:
     elif kind == "projects":
         rows = client.list_projects()
         cols = ("id", "name", "state")
+    elif kind == "pats":
+        if not user:
+            click.echo("--user is required for `list pats`", err=True)
+            sys.exit(1)
+        rows = client.list_pats(_resolve_user(client, user))
+        cols = ("id", "expirationDate", "creationDate")
     else:
         if not project:
             click.echo(f"--project is required for `list {kind}`", err=True)

{granny_devops-0.12.1 → granny_devops-0.13.0}/granny/credentials/secrets.py

@@ -172,9 +172,10 @@ SECRET_MAP: dict[str, str] = {
     # superuser-issued token (Authentik UI → Directory → Tokens). Falls back
     # to AK_TOKEN env var in granny.authentik.AuthentikClient.from_environment.
     "AUTHENTIK_API_TOKEN": "authentik-api-token",
-    # Zitadel OIDC server (`granny zitadel …`): the IdP base URL, an optional
-    # PAT, and the service-account key JSON used for JWT-profile machine auth.
-    "ZITADEL_DOMAIN": "zitadel-domain",
+    # Zitadel OIDC server (`granny zitadel …`): an optional PAT and the
+    # service-account key JSON used for JWT-profile machine auth. The IdP base
+    # URL (ZITADEL_DOMAIN) is plain config, NOT a secret — set it via env /
+    # .env / .deploy.env, so it is deliberately not mapped to the vault.
     "ZITADEL_API_TOKEN": "zitadel-api-token",
     "ZITADEL_SA_KEY": "zitadel-sa-key",
     # Elasticsearch / Kibana security API credentials for `granny elk …`.

{granny_devops-0.12.1 → granny_devops-0.13.0}/granny/zitadel/client.py

@@ -109,7 +109,9 @@ class ZitadelClient:
     def from_environment(cls) -> "ZitadelClient":
         """Build a client from env vars + granny's secret pipeline.
 
-        Base URL: ``ZITADEL_DOMAIN`` (e.g. ``https://id.pseekoo.io``).
+        Base URL: ``ZITADEL_DOMAIN`` (e.g. ``https://id.pseekoo.io``) — this is
+        plain config, NOT a secret, so set it via env / .env / .deploy.env; it
+        is deliberately not vault-resolved.
 
         Credential resolution (first match wins):
 
@@ -121,10 +123,15 @@ class ZitadelClient:
         """
         from granny.credentials import get_secret
 
-        base_url = os.environ.get("ZITADEL_DOMAIN") or get_secret("ZITADEL_DOMAIN")
+        # The IdP base URL is config, not a secret — env / .env / .deploy.env
+        # only (deliberately not vault-resolved).
+        base_url = os.environ.get("ZITADEL_DOMAIN")
         if not base_url:
             raise ZitadelError(
-                0, "ZITADEL_DOMAIN is not set (e.g. https://id.pseekoo.io)."
+                0,
+                "ZITADEL_DOMAIN is not set. It is config, not a secret — set it "
+                "via env or .env/.deploy.env, e.g. "
+                "ZITADEL_DOMAIN=https://id.pseekoo.io",
             )
 
         pat = os.environ.get("ZITADEL_API_TOKEN") or get_secret("ZITADEL_API_TOKEN")
@@ -431,6 +438,28 @@ class ZitadelClient:
         """Delete a user by id."""
         self.request("DELETE", f"/management/v1/users/{user_id}")
 
+    # ── Personal access tokens (machine-user bearer tokens) ───────────────
+    # A PAT is a long-lived bearer for a machine user — what other projects
+    # store at vault ``granny/infra/zitadel-api-token`` so granny authenticates
+    # without the service-account key. The token value is returned ONCE.
+
+    def list_pats(self, user_id: str) -> list[dict[str, Any]]:
+        data = self.request(
+            "POST", f"/management/v1/users/{user_id}/pats/_search", body={"queries": []}
+        )
+        return (data or {}).get("result", []) or []
+
+    def create_pat(self, user_id: str, *, expiration_date: str | None = None) -> dict[str, Any]:
+        """Create a PAT for ``user_id``. Returns {tokenId, token} (token shown once)."""
+        body: dict[str, Any] = {}
+        if expiration_date:
+            body["expirationDate"] = expiration_date
+        return self.request("POST", f"/management/v1/users/{user_id}/pats", body=body)
+
+    def delete_pat(self, user_id: str, token_id: str) -> None:
+        """Revoke a PAT by its token id."""
+        self.request("DELETE", f"/management/v1/users/{user_id}/pats/{token_id}")
+
     # ── Project roles + user grants (Zitadel's analog to Authentik groups) ─
     # Zitadel has no flat "groups": authorization is modeled as project ROLES
     # (defined on a project) plus user GRANTS (a user granted a set of role

{granny_devops-0.12.1 → granny_devops-0.13.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "granny-devops"
-version = "0.12.1"
+version = "0.13.0"
 description = "Cloud tools collection -- AWS infrastructure, CDN, and DevOps automation"
 readme = "README.md"
 license = { file = "LICENSE" }