infraclass 1.0.0__tar.gz

infraclass-1.0.0/PKG-INFO

@@ -0,0 +1,11 @@
+Metadata-Version: 2.4
+Name: infraclass
+Version: 1.0.0
+Summary: A fast, predictable, top-down configuration inventory compiler.
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+Requires-Dist: pyyaml>=6.0
+
+# Infraclass
+
+A fast, predictable, top-down configuration inventory compiler for infrastructure management workflows.

infraclass-1.0.0/README.md

@@ -0,0 +1,3 @@
+# Infraclass
+
+A fast, predictable, top-down configuration inventory compiler for infrastructure management workflows.

infraclass-1.0.0/infraclass/__init__.py

@@ -0,0 +1 @@
+from .compiler import compile_node_data

infraclass-1.0.0/infraclass/cli.py

@@ -0,0 +1,97 @@
+# infraclass/cli.py
+import os, sys, yaml, argparse, getpass, secrets, string
+from datetime import datetime
+import infraclass.compiler as xc
+
+class NoAliasDumper(yaml.SafeDumper):
+    def ignore_aliases(self, data): return True
+
+yaml.add_representer(str, lambda d, data: d.represent_scalar('tag:yaml.org,2002:str', data, style='|' if '\n' in data else None), Dumper=NoAliasDumper)
+
+def main():
+    parser = argparse.ArgumentParser(description="Infraclass: Top-Down Infrastructure Inventory Compiler")
+    parser.add_argument("-b", "--base-dir", default="reclass", help="Path to reclass root folder")
+    parser.add_argument("node", nargs="?", help="Name of the node to compile")
+    parser.add_argument("--add-secret", action="store_true", help="Add a new encrypted value securely")
+    parser.add_argument("-f", "--file", help="Optional path to secret file input (used with --add-secret)")
+    parser.add_argument("--remove-secret", metavar="ID", help="Remove a tracking key from the vault")
+    parser.add_argument("--show-secret", metavar="ID", help="Reveal the plaintext value of a tracking key")
+    parser.add_argument("--re-encrypt", action="store_true", help="Re-encrypt the vault using the current recipients file")
+    parser.add_argument("--audit-secrets", action="store_true", help="Check for stale or missing configuration secrets")
+    args = parser.parse_args()
+
+    try:
+        # ----------------------------------------------------
+        # VAULT MANAGEMENT ROUTES
+        # ----------------------------------------------------
+        if args.add_secret:
+            if not sys.stdin.isatty():
+                secret_value = sys.stdin.read().strip()
+                if not secret_value: raise ValueError("Piped input stream was empty.")
+                print("--> Reading secret value directly from piped input.")
+            elif args.file:
+                with open(args.file, "r") as f: secret_value = f.read().strip()
+            else:
+                secret_value = getpass.getpass("Enter passphrase (leave empty to autogenerate a secure one): ").strip()
+                if not secret_value:
+                    secret_value = ''.join(secrets.choice(string.ascii_letters + string.digits) for _ in range(32))
+                    print("--> No passphrase provided. Autogenerated a secure 32-character secret.")
+
+            new_id = xc.add_secret_to_vault(secret_value)
+            print(f"\nMaster vault decrypted safely via in-memory stream.\nGenerated unique tracking identifier: {new_id}\nRe-encrypted master vault back to vault/vault.age successfully.\n\nPaste this reference identifier into your reclass configuration:\n   !secret {new_id}")
+
+        elif args.remove_secret:
+            xc.remove_secret_from_vault(args.remove_secret)
+            print(f"Successfully purged tracker '{args.remove_secret}' from vault/vault.age.")
+
+        elif args.show_secret:
+            print(xc.show_secret_from_vault(args.show_secret))
+
+        elif args.re_encrypt:
+            xc.update_vault_recipients()
+            print("Successfully re-encrypted vault/vault.age using the current recipients file.")
+
+        elif args.audit_secrets:
+            stale, missing = xc.find_stale_secrets(base_dir=args.base_dir)
+            print(f"Auditing vault references inside '{args.base_dir}' against master vault...\n")
+            if stale:
+                print("Stale Secrets (Found in vault/vault.age but NEVER referenced in reclass files):")
+                for k in stale: print(f"  - {k} (Safe to remove via: Infraclass --remove-secret {k})")
+            else:
+                print("✔ No stale secrets found in master vault.")
+            if missing:
+                print("\nMissing Secrets (Tagged as !secret in reclass but NOT found in vault/vault.age!):")
+                for m in missing: print(f"  - {m}")
+
+        # ----------------------------------------------------
+        # COMPILATION ROUTE
+        # ----------------------------------------------------
+        elif args.node:
+            node_data = xc.compile_node_data(args.node, base_dir=args.base_dir)
+            hostname = node_data["node_name"]
+
+            output_blueprint = {
+                "__reclass__": {
+                    "environment": node_data["environment"], "name": hostname, "node": hostname,
+                    "timestamp": datetime.now().strftime("%a %b %d %H:%M:%S %Y"),
+                    "uri": f"yaml_fs:///{os.path.abspath(args.base_dir)}/nodes/{hostname}.yml"
+                },
+                "applications": node_data["applications"], "classes": node_data["classes"],
+                "environment": node_data["environment"], "exports": node_data["exports"],
+                "parameters": {
+                    "_reclass_": {"environment": node_data["environment"], "name": {"full": hostname, "short": hostname.split(".")[0]}},
+                    **{k: node_data["parameters"][k] for k in sorted(node_data["parameters"].keys()) if k != "_reclass_"}
+                }
+            }
+            print(yaml.dump(output_blueprint, default_flow_style=False, sort_keys=False, Dumper=NoAliasDumper))
+            
+        else:
+            parser.print_help()
+            sys.exit(1)
+
+    except Exception as e:
+        print(f"ERROR: {str(e)}", file=sys.stderr)
+        sys.exit(1)
+
+if __name__ == "__main__":
+    main()

infraclass-1.0.0/infraclass/compiler.py

@@ -0,0 +1,203 @@
+# infraclass/compiler.py
+import os, subprocess, sys, yaml, uuid
+from .merging import deep_merge, evaluate_rubouts
+
+_COMPILER_CONTEXT = {"root_dir": os.getcwd()}
+_VAULT_CACHE = None 
+
+# =====================================================================
+# INTERNAL SECRETS ENGINE UTILITIES
+# =====================================================================
+
+def _get_vault_path():
+    """Traverses upward from the current working directory to discover vault/vault.age."""
+    project_root = os.getcwd()
+    while project_root and project_root != os.path.dirname(project_root):
+        if os.path.exists(os.path.join(project_root, "reclass")) or \
+           os.path.exists(os.path.join(project_root, "vault", "vault.age")):
+            break
+        project_root = os.path.dirname(project_root)
+    return os.path.join(project_root, "vault", "vault.age")
+
+def _get_age_key_path():
+    """Resolves the age encryption key path based on systemic environment tags."""
+    creds_dir = os.environ.get("CREDENTIALS_DIRECTORY")
+    if creds_dir and os.path.exists(os.path.join(creds_dir, "age-pq-key")):
+        return os.path.join(creds_dir, "age-pq-key")
+    return os.environ.get("INFRACLASS_AGE_KEY_FILE", os.path.expanduser("~/.config/age/identity.age"))
+
+def _crypt_vault(ciphertext=None, plaintext=None, key_path=None):
+    """Handles core in-memory age encryption and decryption subroutines."""
+    if not os.path.exists(key_path):
+        raise FileNotFoundError(f"Missing age identity key/envelope file at {key_path}")
+
+    if ciphertext is not None:
+        proc = subprocess.run(
+            ["age", "--decrypt", "-i", key_path],
+            input=ciphertext.strip() + "\n", capture_output=True, text=True, check=True
+        )
+        return yaml.load(proc.stdout, Loader=yaml.SafeLoader) or {}
+    
+    vault_path = _get_vault_path()
+    recipients_file = os.path.join(os.path.dirname(vault_path), "recipients")
+    encrypt_flags = ["-R", recipients_file] if os.path.exists(recipients_file) else ["-i", key_path]
+
+    class VaultDumper(yaml.SafeDumper): pass
+    yaml.add_representer(str, lambda d, data: d.represent_scalar('tag:yaml.org,2002:str', data, style='|' if '\n' in data else None), Dumper=VaultDumper)
+
+    proc = subprocess.run(
+        ["age", "--encrypt"] + encrypt_flags + ["-a"],
+        input=yaml.dump(plaintext, default_flow_style=False, Dumper=VaultDumper),
+        capture_output=True, text=True, check=True
+    )
+    return proc.stdout
+
+def _get_cached_vault():
+    """Decrypts the vault once and caches it in memory."""
+    global _VAULT_CACHE
+    if _VAULT_CACHE is not None:
+        return _VAULT_CACHE
+
+    vault_path = _get_vault_path()
+    if os.path.exists(vault_path):
+        with open(vault_path, "r") as f:
+            _VAULT_CACHE = _crypt_vault(ciphertext=f.read(), key_path=_get_age_key_path())
+    else:
+        _VAULT_CACHE = {}
+    return _VAULT_CACHE
+
+def _write_vault(vault_dict, error_msg="Failed to write vault"):
+    """Helper subroutine to sync memory modifications cleanly out to disk."""
+    global _VAULT_CACHE
+    vault_path = _get_vault_path()
+    os.makedirs(os.path.dirname(vault_path), exist_ok=True)
+    try:
+        ciphertext = _crypt_vault(plaintext=vault_dict, key_path=_get_age_key_path())
+        with open(vault_path, "w") as f:
+            f.write(ciphertext)
+        _VAULT_CACHE = vault_dict
+    except subprocess.CalledProcessError as e:
+        raise RuntimeError(f"{error_msg}: {e.stderr.strip()}")
+
+# =====================================================================
+# PUBLIC CORE INTERFACE FUNCTIONS
+# =====================================================================
+
+def add_secret_to_vault(plaintext_value):
+    """Assigns a unique UUID identifier to a secret value, then commits it to the vault."""
+    vault_dict = _get_cached_vault()
+    while True:
+        new_uuid = str(uuid.uuid4())
+        if new_uuid not in vault_dict: break
+    vault_dict[new_uuid] = plaintext_value
+    _write_vault(vault_dict, "Failed to re-encrypt vault using age")
+    return new_uuid
+
+def remove_secret_from_vault(lookup_key):
+    """Pops a specified secret tracking identifier out of the master vault mapping."""
+    vault_dict = _get_cached_vault()
+    clean_key = str(lookup_key).strip().strip("'\"")
+    if clean_key not in vault_dict:
+        raise KeyError(f"Secret key '{clean_key}' does not exist inside the vault.")
+    vault_dict.pop(clean_key)
+    _write_vault(vault_dict, "Failed to re-encrypt vault")
+
+def show_secret_from_vault(lookup_key):
+    """Returns the plaintext configuration value behind an isolated reference ID."""
+    vault_dict = _get_cached_vault()
+    clean_key = str(lookup_key).strip().strip("'\"")
+    if clean_key not in vault_dict:
+        raise KeyError(f"Secret key '{clean_key}' does not exist inside the vault.")
+    return vault_dict[clean_key]
+
+def update_vault_recipients():
+    """Forces an immediate rewrite pass of the vault data block to register updated keys."""
+    _write_vault(_get_cached_vault(), "Failed to re-encrypt vault with updated recipients")
+
+def find_stale_secrets(base_dir="reclass"):
+    """Audits reclass inventory against vault.age to trace unreferenced or broken keys."""
+    referenced_keys = set()
+    class AuditLoader(yaml.SafeLoader): pass
+    AuditLoader.add_constructor('!secret', lambda loader, node: referenced_keys.add(str(loader.construct_scalar(node)).strip().strip("'\"")) or f"!secret {node.value}")
+
+    for root, _, files in os.walk(base_dir):
+        for file in files:
+            if file.endswith((".yml", ".yaml")):
+                try:
+                    with open(os.path.join(root, file), "r") as f: yaml.load(f, Loader=AuditLoader)
+                except Exception: continue
+
+    vault_dict = _get_cached_vault()
+    vault_keys = set(str(k).strip() for k in vault_dict.keys())
+    return sorted(list(vault_keys - referenced_keys)), sorted(list(referenced_keys - vault_keys))
+
+# =====================================================================
+# PYYAML INVENTORY COMPILER HOOKS
+# =====================================================================
+
+def age_decrypt_constructor(loader, node):
+    """Dynamic parser tag constructor used during real-time reclass file loading phases."""
+    lookup_key = str(loader.construct_scalar(node)).strip().strip("'\"")
+    try:
+        vault_dict = _get_cached_vault()
+        return str(vault_dict.get(lookup_key, f"ERROR: Secret key '{lookup_key}' not found in vault.")).strip()
+    except Exception as e:
+        return f"ERROR: Infraclass vault breakdown: {str(e)}"
+
+yaml.add_constructor('!secret', age_decrypt_constructor, Loader=yaml.SafeLoader)
+
+# =====================================================================
+# RECLASS COMPILATION LOGIC ENGINE
+# =====================================================================
+
+def load_yaml_file(filepath):
+    if not os.path.exists(filepath): return {}
+    with open(filepath, "r") as f: return yaml.load(f, Loader=yaml.SafeLoader) or {}
+
+def resolve_class_path(classes_dir, class_name):
+    base_path = os.path.join(classes_dir, *class_name.split("."))
+    return base_path + ".yml" if os.path.exists(base_path + ".yml") else (os.path.join(base_path, "init.yml") if os.path.exists(os.path.join(base_path, "init.yml")) else None)
+
+def compile_node_data(node_name, base_dir="reclass"):
+    classes_dir, nodes_dir = os.path.join(base_dir, "classes"), os.path.join(base_dir, "nodes")
+    filename = node_name if node_name.endswith((".yml", ".yaml")) else f"{node_name}.yml"
+    node_path = os.path.join(nodes_dir, filename)
+    
+    if not os.path.exists(node_path): raise FileNotFoundError(f"Missing node definition file: {node_path}")
+
+    node_raw = load_yaml_file(node_path)
+    merged_parameters, param_origins = {}, {}
+    applications, final_ordered_classes, seen_classes = [], [], set()
+
+    def visit_class(class_name, parent="the Node file"):
+        if class_name in seen_classes: return
+        class_file = resolve_class_path(classes_dir, class_name)
+        if not class_file:
+            raise FileNotFoundError(f"\n[Infraclass Class Missing Error]\n➔ Could not resolve class path for: '{class_name}'\n  - Requested by: {parent}")
+            
+        class_data = load_yaml_file(class_file)
+        current_short_name = os.path.relpath(class_file, base_dir)
+        
+        for sub_class in class_data.get("classes", []): visit_class(sub_class, parent=current_short_name)
+        for app in class_data.get("applications", []):
+            if app not in applications: applications.append(app)
+                
+        deep_merge(merged_parameters, class_data.get("parameters", {}), current_context="", source_b=current_short_name, origin_map=param_origins)
+        if class_name not in final_ordered_classes: final_ordered_classes.append(class_name)
+        seen_classes.add(class_name)
+
+    for starting_class in node_raw.get("classes", []): visit_class(starting_class)
+    for app in node_raw.get("applications", []):
+        if app not in applications: applications.append(app)
+            
+    short_node_name = os.path.relpath(node_path, base_dir)
+    deep_merge(merged_parameters, node_raw.get("parameters", {}), current_context="", source_b=short_node_name, origin_map=param_origins)
+
+    return {
+        "node_name": filename.rsplit(".yml", 1)[0].rsplit(".yaml", 1)[0],
+        "classes": final_ordered_classes,
+        "applications": applications,
+        "environment": node_raw.get("environment", "base"),
+        "exports": node_raw.get("exports", {}),
+        "parameters": evaluate_rubouts(merged_parameters)
+    }

infraclass-1.0.0/infraclass/merging.py

@@ -0,0 +1,54 @@
+def deep_merge(dict_a, dict_b, current_context="", source_b="Incoming", origin_map=None):
+    if origin_map is None:
+        origin_map = {}
+
+    for key, value in dict_b.items():
+        path = f"{current_context}.{key}" if current_context else str(key)
+        
+        if key in dict_a:
+            type_a = type(dict_a[key])
+            type_b = type(value)
+            
+            if isinstance(dict_a[key], dict) and isinstance(value, dict):
+                deep_merge(dict_a[key], value, current_context=path, source_b=source_b, origin_map=origin_map)
+                
+            elif isinstance(dict_a[key], list) and isinstance(value, list):
+                dict_a[key].extend([x for x in value if x not in dict_a[key]])
+                origin_map[path] = source_b
+                
+            elif type_a != type_b and dict_a[key] is not None and value is not None:
+                original_file = origin_map.get(path, "An earlier class")
+                raise TypeError(
+                    f"\n[Wifty Data Type Mismatch Detected]\n"
+                    f"➔ Parameter path: '{path}'\n"
+                    f"  - File 1 ({original_file}) defined a [{type_a.__name__}]:\n"
+                    f"    {dict_a[key]}\n"
+                    f"  - File 2 ({source_b}) tried to overwrite it with a [{type_b.__name__}]:\n"
+                    f"    {value}\n\n"
+                    f"Fix: Check your class ordering or make sure you aren't missing dashes (-) or brackets []!"
+                )
+            else:
+                dict_a[key] = value
+                origin_map[path] = source_b
+        else:
+            dict_a[key] = value
+            origin_map[path] = source_b
+            
+    return dict_a
+
+def evaluate_rubouts(data):
+    if not isinstance(data, dict):
+        return data
+
+    processed = {}
+    for key, value in data.items():
+        evaluated_value = evaluate_rubouts(value)
+        if str(key).startswith('~'):
+            clean_key = str(key)[1:]
+            processed[clean_key] = evaluated_value
+        else:
+            if key in processed and isinstance(processed[key], dict) and isinstance(evaluated_value, dict):
+                processed[key].update(evaluated_value)
+            else:
+                processed[key] = evaluated_value
+    return processed

infraclass-1.0.0/infraclass.egg-info/PKG-INFO

@@ -0,0 +1,11 @@
+Metadata-Version: 2.4
+Name: infraclass
+Version: 1.0.0
+Summary: A fast, predictable, top-down configuration inventory compiler.
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+Requires-Dist: pyyaml>=6.0
+
+# Infraclass
+
+A fast, predictable, top-down configuration inventory compiler for infrastructure management workflows.

infraclass-1.0.0/infraclass.egg-info/SOURCES.txt

@@ -0,0 +1,12 @@
+README.md
+pyproject.toml
+infraclass/__init__.py
+infraclass/cli.py
+infraclass/compiler.py
+infraclass/merging.py
+infraclass.egg-info/PKG-INFO
+infraclass.egg-info/SOURCES.txt
+infraclass.egg-info/dependency_links.txt
+infraclass.egg-info/entry_points.txt
+infraclass.egg-info/requires.txt
+infraclass.egg-info/top_level.txt

infraclass-1.0.0/infraclass.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

infraclass-1.0.0/infraclass.egg-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+infraclass = infraclass.cli:main

infraclass-1.0.0/infraclass.egg-info/requires.txt

@@ -0,0 +1 @@
+pyyaml>=6.0

infraclass-1.0.0/infraclass.egg-info/top_level.txt

@@ -0,0 +1 @@
+infraclass

infraclass-1.0.0/pyproject.toml

@@ -0,0 +1,21 @@
+[build-system]
+requires = ["setuptools>=61.0.0"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "infraclass"
+version = "1.0.0"
+description = "A fast, predictable, top-down configuration inventory compiler."
+readme = "README.md"
+requires-python = ">=3.10"
+dependencies = [
+    "pyyaml>=6.0"
+]
+
+[project.scripts]
+infraclass = "infraclass.cli:main"
+
+# Explicitly tell setuptools to look for your flat layout module folder
+[tool.setuptools.packages.find]
+where = ["."]
+include = ["infraclass*"]

infraclass-1.0.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+