keboola-cli 0.63.4__py3-none-any.whl

keboola_agent_cli/commands/encrypt.py

@@ -0,0 +1,145 @@
+"""Encrypt command -- encrypt secret values via Keboola Encryption API.
+
+Thin CLI layer: parses arguments, calls EncryptService, formats output.
+No business logic belongs here.
+"""
+
+import json
+import os
+import sys
+from pathlib import Path
+
+import typer
+
+from ..errors import ConfigError, ErrorCode, KeboolaApiError
+from ._helpers import (
+    check_cli_permission,
+    get_formatter,
+    get_service,
+    map_error_to_exit_code,
+)
+
+encrypt_app = typer.Typer(
+    help="Encrypt secret values via Keboola Encryption API (one-way, no decrypt)"
+)
+
+
+@encrypt_app.callback(invoke_without_command=True)
+def _encrypt_permission_check(ctx: typer.Context) -> None:
+    check_cli_permission(ctx, "encrypt")
+
+
+@encrypt_app.command("values")
+def encrypt_values(
+    ctx: typer.Context,
+    project: str = typer.Option(
+        ...,
+        "--project",
+        help="Project alias",
+    ),
+    component_id: str = typer.Option(
+        ...,
+        "--component-id",
+        help="Keboola component ID (e.g. keboola.python-transformation-v2)",
+    ),
+    input_data: str = typer.Option(
+        ...,
+        "--input",
+        help="JSON to encrypt: inline JSON, @file.json, or - for stdin",
+    ),
+    output_file: Path | None = typer.Option(
+        None,
+        "--output-file",
+        help="Write result to file (0600 permissions) instead of stdout",
+    ),
+) -> None:
+    """Encrypt #-prefixed secret values for a Keboola component.
+
+    Input must be a JSON object with #-prefixed keys and string values.
+    Already-encrypted values (KBC:: prefix) pass through unchanged.
+
+    The Keboola Encryption API is one-way -- there is no decrypt endpoint.
+    Encrypted values can only be used by Keboola components at runtime.
+
+    Examples:
+        kbagent encrypt values --project my-proj --component-id keboola.ex-db-snowflake --input '{"#password": "secret"}'
+        echo '{"#token": "abc"}' | kbagent encrypt values --project my-proj --component-id keboola.ex-db-snowflake --input -
+        kbagent encrypt values --project my-proj --component-id keboola.ex-db-snowflake --input @secrets.json --output-file encrypted.json
+    """
+    formatter = get_formatter(ctx)
+    service = get_service(ctx, "encrypt_service")
+
+    # Parse input
+    try:
+        parsed = _parse_input(input_data)
+    except (json.JSONDecodeError, FileNotFoundError, ValueError) as exc:
+        formatter.error(message=str(exc), error_code=ErrorCode.INPUT_ERROR)
+        raise typer.Exit(code=2) from None
+
+    if not isinstance(parsed, dict):
+        formatter.error(
+            message="Input must be a JSON object (dict), not " + type(parsed).__name__,
+            error_code=ErrorCode.INPUT_ERROR,
+        )
+        raise typer.Exit(code=2) from None
+
+    try:
+        result = service.encrypt(alias=project, component_id=component_id, input_data=parsed)
+    except ConfigError as exc:
+        formatter.error(message=exc.message, error_code=ErrorCode.CONFIG_ERROR)
+        raise typer.Exit(code=5) from None
+    except KeboolaApiError as exc:
+        exit_code = map_error_to_exit_code(exc)
+        formatter.error(
+            message=exc.message,
+            error_code=exc.error_code,
+            retryable=exc.retryable,
+        )
+        raise typer.Exit(code=exit_code) from None
+
+    if output_file:
+        # Atomic create with 0600 -- avoids the race window between
+        # write_text() (which uses the user's umask, often 0644) and a
+        # subsequent chmod (issue #269 sec-06). On the chmod-after-write
+        # pattern, another local user could read the encrypted secrets in
+        # the brief window before the chmod ran.
+        payload = json.dumps(result, indent=2).encode("utf-8")
+        fd = os.open(
+            str(output_file),
+            os.O_WRONLY | os.O_CREAT | os.O_TRUNC,
+            0o600,
+        )
+        try:
+            os.write(fd, payload)
+        finally:
+            os.close(fd)
+        if not formatter.json_mode:
+            formatter.console.print(f"Encrypted values written to {output_file}")
+
+    formatter.output(result, lambda c, d: c.print_json(json.dumps(d, indent=2)))
+
+
+def _parse_input(raw: str) -> dict:
+    """Parse input from inline JSON, @file, or stdin.
+
+    Args:
+        raw: One of:
+            - "-" to read from stdin
+            - "@path/to/file.json" to read from a file
+            - Inline JSON string
+
+    Returns:
+        Parsed JSON as a dict.
+
+    Raises:
+        json.JSONDecodeError: If JSON parsing fails.
+        FileNotFoundError: If @file does not exist.
+    """
+    if raw == "-":
+        return json.loads(sys.stdin.read())
+    if raw.startswith("@"):
+        file_path = Path(raw[1:])
+        if not file_path.is_file():
+            raise FileNotFoundError(f"Input file not found: {file_path}")
+        return json.loads(file_path.read_text(encoding="utf-8"))
+    return json.loads(raw)

keboola_agent_cli/commands/feature.py

@@ -0,0 +1,311 @@
+"""Feature-flag management commands (super-admin Manage API).
+
+Thin CLI layer: parses arguments, calls FeatureService, formats output.
+No business logic belongs here.
+
+All operations require a super-admin Manage API token. It is read from an
+interactive hidden prompt by default (never persisted, never a CLI argument);
+pass the top-level --allow-env-manage-token to read KBC_MANAGE_API_TOKEN from
+env (CI/CD). See ``resolve_manage_token`` for the full default-deny policy.
+"""
+
+from __future__ import annotations
+
+from typing import Any, NoReturn
+
+import typer
+from rich.console import Console
+from rich.table import Table
+
+from ..errors import ConfigError, ErrorCode, KeboolaApiError
+from ._helpers import (
+    check_cli_permission,
+    get_formatter,
+    get_service,
+    map_error_to_exit_code,
+    resolve_manage_token,
+)
+
+feature_app = typer.Typer(help="Feature flag management (requires super-admin Manage API token)")
+
+
+@feature_app.callback(invoke_without_command=True)
+def _feature_permission_check(ctx: typer.Context) -> None:
+    check_cli_permission(ctx, "feature")
+
+
+def _handle_errors(formatter: Any, exc: Exception) -> NoReturn:
+    """Map a ConfigError / KeboolaApiError to a structured error + Exit."""
+    if isinstance(exc, ConfigError):
+        formatter.error(error_code=ErrorCode.CONFIG_ERROR, message=exc.message)
+        raise typer.Exit(code=5) from None
+    if isinstance(exc, KeboolaApiError):
+        exit_code = map_error_to_exit_code(exc)
+        formatter.error(error_code=exc.error_code, message=exc.message, retryable=exc.retryable)
+        raise typer.Exit(code=exit_code) from None
+    raise exc
+
+
+def _format_feature_catalogue(console: Console, data: dict[str, Any]) -> None:
+    """Render the stack feature catalogue as a Rich table."""
+    features = data.get("features") or []
+    title = f"Features on {data.get('stack_url', '')} ({len(features)} total)"
+    console.print(_feature_table(title, features))
+
+
+# Optional feature columns, in display order: (data key, header, Rich style).
+_OPTIONAL_FEATURE_COLUMNS: tuple[tuple[str, str, str | None], ...] = (
+    ("title", "Title", None),
+    ("type", "Type", "dim"),
+    ("description", "Description", "dim"),
+)
+
+
+def _present_optional_columns(
+    features: list[dict[str, Any]],
+) -> list[tuple[str, str, str | None]]:
+    """Return the optional columns at least one feature actually populates.
+
+    Project/user feature arrays come back from the Manage API as bare strings
+    (normalised to name-only), so Title/Type/Description would be uniformly
+    empty -- we drop those columns rather than render dead space. The stack
+    catalogue, which carries metadata, keeps whichever columns it populates.
+    """
+    return [
+        col
+        for col in _OPTIONAL_FEATURE_COLUMNS
+        if any(str(feat.get(col[0], "")).strip() for feat in features)
+    ]
+
+
+def _feature_table(title: str, features: list[dict[str, Any]]) -> Table:
+    """Build a Rich table for a feature list, omitting empty optional columns."""
+    table = Table(title=title)
+    table.add_column("Name", style="bold cyan")
+    columns = _present_optional_columns(features)
+    for _key, header, style in columns:
+        table.add_column(header, style=style)
+    for feat in features:
+        row = [feat.get("name", ""), *(str(feat.get(key, "")) for key, _, _ in columns)]
+        table.add_row(*row)
+    return table
+
+
+def _format_assigned_features(console: Console, data: dict[str, Any]) -> None:
+    """Render features assigned to a project or user as a Rich table."""
+    features = data.get("features") or []
+    owner = (
+        f"project [cyan]{data.get('alias')}[/cyan] (id={data.get('project_id')})"
+        if "project_id" in data
+        else f"user [cyan]{data.get('email')}[/cyan]"
+    )
+    if not features:
+        console.print(f"No features assigned to {owner}.")
+        return
+    console.print(_feature_table(f"Features assigned to {owner} ({len(features)} total)", features))
+
+
+def _format_write_result(console: Console, data: dict[str, Any]) -> None:
+    """Render the outcome of an add/remove operation."""
+    status = data.get("status", "")
+    feature = data.get("feature", "")
+    target = (
+        f"project [cyan]{data.get('alias')}[/cyan] (id={data.get('project_id')})"
+        if "project_id" in data
+        else f"user [cyan]{data.get('email')}[/cyan]"
+    )
+    if status == "dry_run":
+        verb = "add to" if data.get("action") == "add" else "remove from"
+        console.print(
+            f"[bold yellow]DRY RUN[/bold yellow] would {verb} {target}: feature [bold]{feature}[/bold]"
+        )
+    elif status == "added":
+        console.print(f"[bold green]Added[/bold green] feature [bold]{feature}[/bold] to {target}.")
+    elif status == "removed":
+        console.print(f"[bold red]Removed[/bold red] feature [bold]{feature}[/bold] from {target}.")
+
+
+# ── Stack catalogue ───────────────────────────────────────────────────
+
+
+@feature_app.command("list")
+def feature_list(
+    ctx: typer.Context,
+    project: str = typer.Option(
+        ..., "--project", "-p", help="Project alias (used to resolve the stack URL)"
+    ),
+) -> None:
+    """List all feature flags defined on the stack."""
+    formatter = get_formatter(ctx)
+    manage_token = resolve_manage_token(allow_env=ctx.obj["allow_env_manage_token"])
+    service = get_service(ctx, "feature_service")
+    try:
+        result = service.list_stack_features(manage_token=manage_token, alias=project)
+    except (ConfigError, KeboolaApiError) as exc:
+        _handle_errors(formatter, exc)
+    formatter.output(result, _format_feature_catalogue)
+
+
+# ── Project features ──────────────────────────────────────────────────
+
+
+@feature_app.command("project-show")
+def feature_project_show(
+    ctx: typer.Context,
+    project: str = typer.Option(..., "--project", "-p", help="Project alias"),
+) -> None:
+    """Show feature flags assigned to a project."""
+    formatter = get_formatter(ctx)
+    manage_token = resolve_manage_token(allow_env=ctx.obj["allow_env_manage_token"])
+    service = get_service(ctx, "feature_service")
+    try:
+        result = service.list_project_features(manage_token=manage_token, alias=project)
+    except (ConfigError, KeboolaApiError) as exc:
+        _handle_errors(formatter, exc)
+    formatter.output(result, _format_assigned_features)
+
+
+@feature_app.command("project-add")
+def feature_project_add(
+    ctx: typer.Context,
+    project: str = typer.Option(..., "--project", "-p", help="Project alias"),
+    feature: str = typer.Option(..., "--feature", "-f", help="Feature name to enable"),
+    dry_run: bool = typer.Option(False, "--dry-run", help="Preview without making changes"),
+    yes: bool = typer.Option(False, "--yes", "-y", help="Skip confirmation prompt"),
+) -> None:
+    """Enable a feature flag on a project."""
+    formatter = get_formatter(ctx)
+    if (
+        not dry_run
+        and not formatter.json_mode
+        and not yes
+        and not typer.confirm(f"Add feature '{feature}' to project {project}?")
+    ):
+        formatter.console.print("Aborted.")
+        raise typer.Exit(code=0)
+    manage_token = resolve_manage_token(allow_env=ctx.obj["allow_env_manage_token"])
+    service = get_service(ctx, "feature_service")
+    try:
+        result = service.add_project_feature(
+            manage_token=manage_token, alias=project, feature=feature, dry_run=dry_run
+        )
+    except (ConfigError, KeboolaApiError) as exc:
+        _handle_errors(formatter, exc)
+    formatter.output(result, _format_write_result)
+
+
+@feature_app.command("project-remove")
+def feature_project_remove(
+    ctx: typer.Context,
+    project: str = typer.Option(..., "--project", "-p", help="Project alias"),
+    feature: str = typer.Option(..., "--feature", "-f", help="Feature name to disable"),
+    dry_run: bool = typer.Option(False, "--dry-run", help="Preview without making changes"),
+    yes: bool = typer.Option(False, "--yes", "-y", help="Skip confirmation prompt"),
+) -> None:
+    """Disable a feature flag on a project (destructive)."""
+    formatter = get_formatter(ctx)
+    if (
+        not dry_run
+        and not formatter.json_mode
+        and not yes
+        and not typer.confirm(
+            f"Remove feature '{feature}' from project {project}? This is destructive."
+        )
+    ):
+        formatter.console.print("Aborted.")
+        raise typer.Exit(code=0)
+    manage_token = resolve_manage_token(allow_env=ctx.obj["allow_env_manage_token"])
+    service = get_service(ctx, "feature_service")
+    try:
+        result = service.remove_project_feature(
+            manage_token=manage_token, alias=project, feature=feature, dry_run=dry_run
+        )
+    except (ConfigError, KeboolaApiError) as exc:
+        _handle_errors(formatter, exc)
+    formatter.output(result, _format_write_result)
+
+
+# ── User features ─────────────────────────────────────────────────────
+
+
+@feature_app.command("user-show")
+def feature_user_show(
+    ctx: typer.Context,
+    project: str = typer.Option(
+        ..., "--project", "-p", help="Project alias (used to resolve the stack URL)"
+    ),
+    email: str = typer.Option(..., "--email", "-e", help="User email address"),
+) -> None:
+    """Show feature flags assigned to a user."""
+    formatter = get_formatter(ctx)
+    manage_token = resolve_manage_token(allow_env=ctx.obj["allow_env_manage_token"])
+    service = get_service(ctx, "feature_service")
+    try:
+        result = service.list_user_features(manage_token=manage_token, alias=project, email=email)
+    except (ConfigError, KeboolaApiError) as exc:
+        _handle_errors(formatter, exc)
+    formatter.output(result, _format_assigned_features)
+
+
+@feature_app.command("user-add")
+def feature_user_add(
+    ctx: typer.Context,
+    project: str = typer.Option(
+        ..., "--project", "-p", help="Project alias (used to resolve the stack URL)"
+    ),
+    email: str = typer.Option(..., "--email", "-e", help="User email address"),
+    feature: str = typer.Option(..., "--feature", "-f", help="Feature name to enable"),
+    dry_run: bool = typer.Option(False, "--dry-run", help="Preview without making changes"),
+    yes: bool = typer.Option(False, "--yes", "-y", help="Skip confirmation prompt"),
+) -> None:
+    """Enable a feature flag on a user."""
+    formatter = get_formatter(ctx)
+    if (
+        not dry_run
+        and not formatter.json_mode
+        and not yes
+        and not typer.confirm(f"Add feature '{feature}' to user {email}?")
+    ):
+        formatter.console.print("Aborted.")
+        raise typer.Exit(code=0)
+    manage_token = resolve_manage_token(allow_env=ctx.obj["allow_env_manage_token"])
+    service = get_service(ctx, "feature_service")
+    try:
+        result = service.add_user_feature(
+            manage_token=manage_token, alias=project, email=email, feature=feature, dry_run=dry_run
+        )
+    except (ConfigError, KeboolaApiError) as exc:
+        _handle_errors(formatter, exc)
+    formatter.output(result, _format_write_result)
+
+
+@feature_app.command("user-remove")
+def feature_user_remove(
+    ctx: typer.Context,
+    project: str = typer.Option(
+        ..., "--project", "-p", help="Project alias (used to resolve the stack URL)"
+    ),
+    email: str = typer.Option(..., "--email", "-e", help="User email address"),
+    feature: str = typer.Option(..., "--feature", "-f", help="Feature name to disable"),
+    dry_run: bool = typer.Option(False, "--dry-run", help="Preview without making changes"),
+    yes: bool = typer.Option(False, "--yes", "-y", help="Skip confirmation prompt"),
+) -> None:
+    """Disable a feature flag on a user (destructive)."""
+    formatter = get_formatter(ctx)
+    if (
+        not dry_run
+        and not formatter.json_mode
+        and not yes
+        and not typer.confirm(f"Remove feature '{feature}' from user {email}? This is destructive.")
+    ):
+        formatter.console.print("Aborted.")
+        raise typer.Exit(code=0)
+    manage_token = resolve_manage_token(allow_env=ctx.obj["allow_env_manage_token"])
+    service = get_service(ctx, "feature_service")
+    try:
+        result = service.remove_user_feature(
+            manage_token=manage_token, alias=project, email=email, feature=feature, dry_run=dry_run
+        )
+    except (ConfigError, KeboolaApiError) as exc:
+        _handle_errors(formatter, exc)
+    formatter.output(result, _format_write_result)