hound-cli 0.1.0__py3-none-any.whl

hound_cli/targets/configure.py

@@ -0,0 +1,163 @@
+"""Collect and store the access details Hound uses on a target."""
+
+import click
+import questionary
+
+from hound_cli.aws import aws_client, get_secret, put_secret
+from hound_cli.roster import load_roster
+from hound_cli.ui import MENU_STYLE
+
+DISPLAY_FIELDS = ("email", "username", "role", "phone_number")
+ACCOUNTS_KEY = "accounts"
+OPERATOR_NOTES_KEY = "operator_notes"
+
+
+def _print_agent_access(config: dict) -> None:
+    """Print target accounts grouped by agent, including passwords."""
+    accounts = config.get(ACCOUNTS_KEY, {})
+    if not isinstance(accounts, dict):
+        return
+    if not accounts:
+        click.echo("  No target accounts")
+        return
+    for agent_id, fields in sorted(accounts.items()):
+        if not isinstance(fields, dict):
+            continue
+        click.echo(f"  {agent_id}:")
+        for key in DISPLAY_FIELDS:
+            if key in fields:
+                click.echo(f"    {key:14s} {fields[key]}")
+        click.echo(f"    {'password':14s} {fields.get('password') or 'not set'}")
+        click.echo(f"    {'sms mfa':14s} {'yes' if fields.get('phone_number') else 'no'}")
+
+
+def _print_operator_notes(config: dict) -> None:
+    """Print the full operator notes or their explicit absence."""
+    click.echo(f"  {config.get(OPERATOR_NOTES_KEY) or 'not set'}")
+
+
+def _configure_agent(agent_name: str, agent: dict, current: dict | None = None) -> dict:
+    """Configure target-specific fields for an agent.
+
+    Existing values survive an empty prompt during a merge.
+    """
+    click.echo(f"\n  Configuring {agent_name}:")
+    fields = dict(current) if isinstance(current, dict) else {}
+
+    if agent.get("email"):
+        fields["email"] = agent["email"]
+
+    username = click.prompt(
+        "Target username (optional)",
+        default=fields.get("username", ""),
+        show_default=bool(fields.get("username")),
+    )
+    if username:
+        fields["username"] = username
+
+    password = click.prompt(
+        "Target password (optional)",
+        default=fields.get("password", ""),
+        show_default=bool(fields.get("password")),
+        hide_input=False,
+    )
+    if password:
+        fields["password"] = password
+
+    role = click.prompt(
+        "Role (optional)",
+        default=fields.get("role", ""),
+        show_default=bool(fields.get("role")),
+    )
+    if role:
+        fields["role"] = role
+
+    if agent.get("phone_number"):
+        if click.confirm("Does the target use SMS MFA?", default=bool(fields.get("phone_number"))):
+            fields["phone_number"] = agent["phone_number"]
+        else:
+            fields.pop("phone_number", None)
+    elif click.confirm("Does the target use SMS MFA?"):
+        click.echo(f"Warning: agent '{agent_name}' has no phone number in the roster.")
+        fields.pop("phone_number", None)
+
+    return fields
+
+
+def _accounts(config: dict) -> dict:
+    accounts = config.get(ACCOUNTS_KEY)
+    if not isinstance(accounts, dict):
+        raise click.ClickException("Existing target configuration must be replaced before it can be edited.")
+    return accounts
+
+
+def _prompt_agent_access(client, current_accounts: dict | None = None) -> dict:
+    """Collect the complete set of target accounts for this test."""
+    if not click.confirm("Use target accounts for this test?", default=None):
+        return {}
+
+    current_accounts = current_accounts or {}
+    roster = load_roster(client)
+    choices = [questionary.Choice(name, checked=name in current_accounts) for name in sorted(roster)]
+    selected = questionary.checkbox("Select agents", choices=choices, style=MENU_STYLE).unsafe_ask()
+    if selected is None:
+        raise click.Abort()
+    if not selected:
+        raise click.ClickException("Select at least one agent, or answer no when asked about target accounts.")
+
+    return {name: _configure_agent(name, roster[name], current_accounts.get(name)) for name in selected}
+
+
+def prepare_target_access(domain: str) -> None:
+    """Ensure Hound has explicit access details for a launch target."""
+    client = aws_client("secretsmanager")
+    secret_id = f"hound/targets/{domain}"
+
+    existing = get_secret(client, secret_id)
+    if existing is not None and not isinstance(existing, dict):
+        raise click.ClickException("Target secret must be a JSON object.")
+    supported = existing is not None and isinstance(existing.get(ACCOUNTS_KEY), dict)
+    if existing is not None and not supported:
+        click.echo("\nExisting target access uses an unsupported format and must be replaced.")
+
+    config = dict(existing) if supported else {}
+    agent_access_changed = not supported
+
+    click.echo("\nAgent access")
+    if supported:
+        _print_agent_access(config)
+        if click.confirm("\nUpdate agent access?", default=False):
+            config[ACCOUNTS_KEY] = _prompt_agent_access(client, _accounts(config))
+            agent_access_changed = True
+    else:
+        if existing is None:
+            click.echo(f"No agent access is stored for {domain}.")
+        config[ACCOUNTS_KEY] = _prompt_agent_access(client)
+
+    click.echo("\nOperator notes")
+    _print_operator_notes(config)
+    notes_prompt = "Update operator notes?" if config.get(OPERATOR_NOTES_KEY) else "Add operator notes?"
+    operator_notes_changed = False
+    if click.confirm(f"\n{notes_prompt}", default=False):
+        operator_notes = click.prompt(
+            "Operator notes (leave empty to clear)",
+            default="",
+            show_default=False,
+        )
+        if operator_notes:
+            config[OPERATOR_NOTES_KEY] = operator_notes
+        else:
+            config.pop(OPERATOR_NOTES_KEY, None)
+        operator_notes_changed = True
+
+    if not agent_access_changed and not operator_notes_changed:
+        return
+
+    put_secret(client, secret_id, config)
+    if agent_access_changed and operator_notes_changed:
+        saved = "Agent access and operator notes"
+    elif agent_access_changed:
+        saved = "Agent access"
+    else:
+        saved = "Operator notes"
+    click.echo(f"\n{saved} saved for {domain}.")

hound_cli/targets/verification.py

@@ -0,0 +1,81 @@
+"""Show and check a target's DNS testing authorization."""
+
+import click
+
+from hound_cli.aws import _aws_account_id, operator_only
+from hound_cli.contracts.domain import (
+    VerificationUnavailable,
+    is_ip_target,
+    verification_hash,
+    verification_record_names,
+    verification_txt_present,
+    verification_txt_value,
+)
+from hound_cli.workflows.selection import selected_domain
+
+
+def _check_authorization(domain: str) -> bool:
+    expected_hash = verification_hash(_aws_account_id(), domain)
+    try:
+        return verification_txt_present(domain, expected_hash)
+    except VerificationUnavailable as exc:
+        raise click.ClickException(f"Could not check authorization for {domain}: {exc}") from exc
+
+
+def _show_required_record(domain: str, *, ask_owner: bool) -> None:
+    value = verification_txt_value(verification_hash(_aws_account_id(), domain))
+    names = verification_record_names(domain)
+    if ask_owner:
+        heading = (
+            "Ask the target owner to add one of these DNS TXT records:"
+            if len(names) > 1
+            else "Ask the target owner to add this DNS TXT record:"
+        )
+    else:
+        heading = (
+            "Hound accepts either of these DNS TXT records:" if len(names) > 1 else "Hound accepts this DNS TXT record:"
+        )
+    click.echo(f"\n{heading}")
+    for index, name in enumerate(names):
+        if index:
+            click.echo("\nOR")
+        click.echo(f"\n  Name:  {name}")
+        click.echo(f"  Value: {value}")
+
+
+def require_launch_authorization(domain: str, *, skip_dns_check: bool) -> str:
+    """Check authorization before launch and return its review label."""
+    if skip_dns_check:
+        return "DNS check explicitly skipped"
+    if is_ip_target(domain):
+        raise click.ClickException(
+            "IP targets cannot use DNS authorization. Confirm authorization out of band, "
+            "then rerun with --skip-dns-check."
+        )
+    if _check_authorization(domain):
+        click.echo("\nTesting authorization: Authorized")
+        return "Authorized"
+
+    click.echo(f"\nTesting authorization\n\nTarget: {domain}\nStatus: Not authorized")
+    _show_required_record(domain, ask_owner=True)
+    click.echo(f"\nCheck again with:\n  hound auth --domain {domain}")
+    raise click.ClickException(f"Launch stopped: {domain} is not authorized for testing.")
+
+
+@click.command(name="auth")
+@click.option("--domain", help="Use this exact target domain.")
+@operator_only
+def authorization(domain: str | None) -> None:
+    """Show and check DNS authorization for a target."""
+    domain = selected_domain(domain)
+    click.echo(f"Testing authorization\n\nTarget: {domain}")
+    if is_ip_target(domain):
+        click.echo(
+            "Status: DNS authorization is unavailable for IP targets.\n\n"
+            "Confirm authorization out of band, then launch with --skip-dns-check."
+        )
+        return
+
+    authorized = _check_authorization(domain)
+    click.echo(f"Status: {'Authorized' if authorized else 'Not authorized'}")
+    _show_required_record(domain, ask_owner=not authorized)

hound_cli/ui.py

@@ -0,0 +1,5 @@
+"""Shared interactive CLI presentation."""
+
+import questionary
+
+MENU_STYLE = questionary.Style([("highlighted", "reverse")])

hound_cli/workflows/__init__.py

@@ -0,0 +1 @@
+"""Engagement and retest workflow commands."""