keboola-cli 0.63.4__py3-none-any.whl

keboola_agent_cli/commands/org.py

@@ -0,0 +1,292 @@
+"""Organization management commands - bulk project onboarding.
+
+Thin CLI layer: parses arguments, calls OrgService, formats output.
+No business logic belongs here.
+"""
+
+import typer
+from rich.console import Console
+from rich.table import Table
+
+from ..constants import DEFAULT_TOKEN_DESCRIPTION, ENV_KBC_STORAGE_API_URL
+from ..errors import ErrorCode, KeboolaApiError
+from ._helpers import (
+    check_cli_permission,
+    get_formatter,
+    get_service,
+    map_error_to_exit_code,
+    resolve_manage_token,
+)
+
+org_app = typer.Typer(help="Organization management")
+
+
+@org_app.callback(invoke_without_command=True)
+def _org_permission_check(ctx: typer.Context) -> None:
+    check_cli_permission(ctx, "org")
+
+
+def _parse_project_ids(value: str | None) -> list[int] | None:
+    """Parse comma-separated project IDs string into a list of ints."""
+    if not value:
+        return None
+    try:
+        return [int(pid.strip()) for pid in value.split(",") if pid.strip()]
+    except ValueError as exc:
+        msg = f"Invalid project ID (must be integers): {exc}"
+        raise typer.BadParameter(msg) from exc
+
+
+def _format_setup_result(console: Console, data: dict) -> None:
+    """Render org setup results as Rich tables with summary."""
+    org_id = data.get("organization_id")
+    stack_url = data.get("stack_url", "")
+    dry_run = data.get("dry_run", False)
+    projects_found = data.get("projects_found", 0)
+    added = data.get("projects_added", [])
+    refreshed = data.get("projects_refreshed", [])
+    skipped = data.get("projects_skipped", [])
+    failed = data.get("projects_failed", [])
+
+    token_expires_in = data.get("token_expires_in")
+    mode_label = "[bold yellow]DRY RUN[/bold yellow] " if dry_run else ""
+    expiry_label = (
+        f", token expiration: [bold]{token_expires_in}s[/bold]" if token_expires_in else ""
+    )
+    org_label = f"Organization [bold]{org_id}[/bold] on " if org_id else ""
+    console.print(
+        f"\n{mode_label}{org_label}{stack_url} -- {projects_found} project(s) found{expiry_label}\n"
+    )
+
+    # Added / would-add table
+    if added:
+        action_label = "Projects to Add" if dry_run else "Projects Added"
+        table = Table(title=action_label)
+        table.add_column("Alias", style="bold cyan")
+        table.add_column("Project ID", justify="right")
+        table.add_column("Project Name")
+        if not dry_run:
+            table.add_column("Token", style="dim")
+
+        for p in added:
+            if dry_run:
+                table.add_row(p["alias"], str(p["project_id"]), p["project_name"])
+            else:
+                table.add_row(
+                    p["alias"], str(p["project_id"]), p["project_name"], p.get("token", "")
+                )
+
+        console.print(table)
+        console.print()
+
+    # Refreshed tokens table
+    if refreshed:
+        action_label = "Tokens to Refresh" if dry_run else "Tokens Refreshed"
+        table = Table(title=action_label)
+        table.add_column("Alias", style="bold cyan")
+        table.add_column("Project ID", justify="right")
+        table.add_column("Project Name")
+        if not dry_run:
+            table.add_column("Token", style="dim")
+
+        for p in refreshed:
+            if dry_run:
+                table.add_row(p["alias"], str(p["project_id"]), p["project_name"])
+            else:
+                table.add_row(
+                    p["alias"], str(p["project_id"]), p["project_name"], p.get("token", "")
+                )
+
+        console.print(table)
+        console.print()
+
+    # Skipped table
+    if skipped:
+        table = Table(title="Projects Skipped")
+        table.add_column("Project ID", justify="right")
+        table.add_column("Project Name")
+        table.add_column("Reason", style="dim")
+
+        for p in skipped:
+            table.add_row(str(p["project_id"]), p["project_name"], p["reason"])
+
+        console.print(table)
+        console.print()
+
+    # Failed table
+    if failed:
+        table = Table(title="Projects Failed")
+        table.add_column("Project ID", justify="right")
+        table.add_column("Project Name")
+        table.add_column("Error", style="bold red")
+
+        for p in failed:
+            table.add_row(str(p["project_id"]), p["project_name"], p["error"])
+
+        console.print(table)
+        console.print()
+
+    # Summary line
+    summary_parts = []
+    if added:
+        verb = "to add" if dry_run else "added"
+        summary_parts.append(f"[bold green]{len(added)}[/bold green] {verb}")
+    if refreshed:
+        verb = "to refresh" if dry_run else "refreshed"
+        summary_parts.append(f"[bold cyan]{len(refreshed)}[/bold cyan] {verb}")
+    if skipped:
+        summary_parts.append(f"[dim]{len(skipped)} skipped[/dim]")
+    if failed:
+        summary_parts.append(f"[bold red]{len(failed)} failed[/bold red]")
+
+    console.print("Summary: " + ", ".join(summary_parts) if summary_parts else "No changes.")
+
+
+@org_app.command("setup")
+def org_setup(
+    ctx: typer.Context,
+    org_id: int | None = typer.Option(
+        None,
+        "--org-id",
+        help="Organization ID (requires org-admin manage token)",
+    ),
+    project_ids_raw: str | None = typer.Option(
+        None,
+        "--project-ids",
+        help="Comma-separated project IDs (works with Personal Access Token)",
+    ),
+    url: str = typer.Option(
+        ...,
+        "--url",
+        envvar=ENV_KBC_STORAGE_API_URL,
+        help="Keboola stack URL (e.g. https://connection.keboola.com)",
+    ),
+    dry_run: bool = typer.Option(
+        False,
+        "--dry-run",
+        help="Preview what would happen without making changes",
+    ),
+    yes: bool = typer.Option(
+        False,
+        "--yes",
+        "-y",
+        help="Skip confirmation prompt",
+    ),
+    token_description: str = typer.Option(
+        DEFAULT_TOKEN_DESCRIPTION,
+        "--token-description",
+        help="Description prefix for created Storage API tokens",
+    ),
+    token_expires_in: int | None = typer.Option(
+        None,
+        "--token-expires-in",
+        min=1,
+        help="Token lifetime in seconds (e.g. 3600 for 1 hour). If not set, tokens never expire.",
+    ),
+    refresh: bool = typer.Option(
+        False,
+        "--refresh",
+        help="Refresh tokens for already-registered projects with invalid tokens",
+    ),
+) -> None:
+    """Set up projects and register them in the kbagent config.
+
+    Two modes:
+
+    \b
+    1. Org admin:    --org-id 123          (lists all projects in the org)
+    2. Project member: --project-ids 1,2,3 (fetches specific projects)
+
+    Creates Storage API tokens and registers projects. Safe to re-run --
+    already registered projects are skipped.
+
+    The Manage API token is read from an interactive hidden prompt by
+    default (since 0.28.0). Pass the top-level --allow-env-manage-token
+    flag to read KBC_MANAGE_API_TOKEN from env (CI/CD). Never passed as
+    a CLI argument.
+    """
+    formatter = get_formatter(ctx)
+    service = get_service(ctx, "org_service")
+
+    # Validate: need at least one of --org-id or --project-ids
+    project_ids = _parse_project_ids(project_ids_raw)
+    if not org_id and not project_ids:
+        formatter.error(
+            message="Provide --org-id (org admin) or --project-ids (project member)",
+            error_code=ErrorCode.USAGE_ERROR,
+        )
+        raise typer.Exit(code=2)
+
+    manage_token = resolve_manage_token(allow_env=ctx.obj["allow_env_manage_token"])
+
+    # Build kwargs shared by preview and real call
+    setup_kwargs: dict = {
+        "stack_url": url,
+        "manage_token": manage_token,
+        "org_id": org_id,
+        "token_description": token_description,
+        "token_expires_in": token_expires_in,
+        "project_ids": project_ids,
+    }
+
+    # Interactive safety: show preview first, then confirm
+    interactive = not formatter.json_mode and not yes and not dry_run
+    if interactive:
+        try:
+            preview = service.setup_organization(**setup_kwargs, dry_run=True)
+        except KeboolaApiError as exc:
+            _handle_api_error(formatter, exc)
+            return
+
+        _format_setup_result(formatter.console, preview)
+
+        would_add = len(preview.get("projects_added", []))
+        would_skip = len(preview.get("projects_skipped", []))
+        if would_add == 0 and not (refresh and would_skip > 0):
+            formatter.console.print("\nNo new projects to add.")
+            return
+
+        if would_add > 0 and not typer.confirm(f"\nProceed to add {would_add} project(s)?"):
+            formatter.console.print("Aborted.")
+            raise typer.Exit(code=0)
+
+    # Execute the actual setup
+    try:
+        result = service.setup_organization(**setup_kwargs, dry_run=dry_run)
+    except KeboolaApiError as exc:
+        _handle_api_error(formatter, exc)
+        return
+
+    # Refresh tokens for skipped (already-registered) projects if requested
+    if refresh and result.get("projects_skipped"):
+        config = ctx.obj["config_store"].load()
+        skipped_ids = {p["project_id"] for p in result["projects_skipped"]}
+        skipped_aliases = [
+            alias for alias, proj in config.projects.items() if proj.project_id in skipped_ids
+        ]
+        if skipped_aliases:
+            try:
+                refresh_result = service.refresh_tokens(
+                    manage_token=manage_token,
+                    aliases=skipped_aliases,
+                    token_description=token_description,
+                    token_expires_in=token_expires_in,
+                    dry_run=dry_run,
+                )
+                result["projects_refreshed"] = refresh_result.get("projects_refreshed", [])
+            except KeboolaApiError as exc:
+                _handle_api_error(formatter, exc)
+                return
+
+    formatter.output(result, _format_setup_result)
+
+
+def _handle_api_error(formatter, exc: KeboolaApiError) -> None:
+    """Handle a KeboolaApiError by outputting it and raising Exit."""
+    exit_code = map_error_to_exit_code(exc)
+    formatter.error(
+        message=exc.message,
+        error_code=exc.error_code,
+        retryable=exc.retryable,
+    )
+    raise typer.Exit(code=exit_code)

keboola_agent_cli/commands/permissions.py

@@ -0,0 +1,360 @@
+"""Permission management commands - list, show, set, reset, check.
+
+Thin CLI layer for managing the firewall-style permission policy.
+No business logic belongs here -- the PermissionEngine handles evaluation.
+
+Security: set and reset require interactive confirmation (type a random code)
+so that an AI agent constrained by the policy cannot bypass it programmatically.
+"""
+
+from typing import Any
+
+import typer
+from rich.console import Console
+from rich.table import Table
+
+from ..config_store import ConfigStore
+from ..constants import EXIT_PERMISSION_DENIED
+from ..errors import ErrorCode
+from ..models import PermissionPolicy
+from ..permissions import PermissionEngine
+from ._helpers import get_formatter, get_service, require_random_code_confirmation
+
+permissions_app = typer.Typer(help="Manage operation permissions (firewall rules)")
+
+
+def _format_operations_table(
+    console: Console,
+    operations: list[dict[str, Any]],
+    category_filter: str | None = None,
+) -> None:
+    """Render a Rich table of operations with their status."""
+    if category_filter:
+        operations = [op for op in operations if op["category"] == category_filter]
+
+    table = Table(title="Operations")
+    table.add_column("Operation", style="bold cyan")
+    table.add_column("Type", style="dim")
+    table.add_column("Category")
+    table.add_column("Status", justify="center")
+    table.add_column("Description", style="dim")
+
+    category_styles = {
+        "read": "green",
+        "write": "yellow",
+        "destructive": "red",
+        "admin": "bold red",
+    }
+
+    for op in operations:
+        cat = op["category"]
+        cat_styled = f"[{category_styles.get(cat, '')}]{cat}[/{category_styles.get(cat, '')}]"
+        status = op["status"]
+        status_styled = (
+            f"[green]{status}[/green]" if status == "allowed" else f"[red]{status}[/red]"
+        )
+        desc = op.get("description", "")
+        table.add_row(op["name"], op["type"], cat_styled, status_styled, desc)
+
+    console.print(table)
+
+
+@permissions_app.command("list")
+def permissions_list(
+    ctx: typer.Context,
+    category: str | None = typer.Option(
+        None,
+        "--category",
+        "-c",
+        help="Filter by risk category: read, write, destructive, admin",
+    ),
+) -> None:
+    """List all operations with their risk category and current allowed/denied status.
+
+    The allowed/denied column reflects the EFFECTIVE policy for this
+    invocation -- i.e. the persisted policy merged with any top-level
+    session flags like ``--deny-writes`` / ``--deny-destructive``. This
+    matches what a command will actually do right now.
+    """
+    from ..cli import apply_firewall_flags
+
+    formatter = get_formatter(ctx)
+    config_store: ConfigStore = get_service(ctx, "config_store")
+    config = config_store.load()
+
+    deny_writes = bool(ctx.obj.get("deny_writes")) if ctx.obj else False
+    deny_destructive = bool(ctx.obj.get("deny_destructive")) if ctx.obj else False
+    effective_policy = apply_firewall_flags(
+        config.permissions,
+        deny_writes=deny_writes,
+        deny_destructive=deny_destructive,
+    )
+
+    engine = PermissionEngine(effective_policy)
+    ops = engine.list_operations()
+
+    if formatter.json_mode:
+        if category:
+            ops = [op for op in ops if op["category"] == category]
+        formatter.output(ops)
+    else:
+        _format_operations_table(formatter.console, ops, category_filter=category)
+        if not engine.active:
+            formatter.err_console.print(
+                "\n[dim]No permission policy active. All operations are allowed.[/dim]"
+            )
+        elif deny_writes or deny_destructive:
+            active_flags = []
+            if deny_writes:
+                active_flags.append("--deny-writes")
+            if deny_destructive:
+                active_flags.append("--deny-destructive")
+            formatter.err_console.print(
+                f"\n[dim]Session firewall active: {' '.join(active_flags)} (not persisted).[/dim]"
+            )
+
+
+@permissions_app.command("show")
+def permissions_show(
+    ctx: typer.Context,
+) -> None:
+    """Show the current active permission policy.
+
+    Reports both the PERSISTED policy (from config.json) and any SESSION
+    firewall layered on top via top-level ``--deny-writes`` /
+    ``--deny-destructive`` flags. Session flags are shown but are never
+    written to config.json -- they apply to this invocation only.
+    """
+    formatter = get_formatter(ctx)
+    config_store: ConfigStore = get_service(ctx, "config_store")
+    config = config_store.load()
+
+    deny_writes = bool(ctx.obj.get("deny_writes")) if ctx.obj else False
+    deny_destructive = bool(ctx.obj.get("deny_destructive")) if ctx.obj else False
+    session_flags: list[str] = []
+    if deny_writes:
+        session_flags.append("--deny-writes")
+    if deny_destructive:
+        session_flags.append("--deny-destructive")
+
+    persisted = config.permissions
+
+    if persisted is None and not session_flags:
+        if formatter.json_mode:
+            formatter.output(
+                {
+                    "active": False,
+                    "message": "No permission policy configured",
+                    "session_flags": [],
+                }
+            )
+        else:
+            formatter.console.print("No permission policy configured. All operations are allowed.")
+        return
+
+    policy_data: dict[str, Any] = {
+        "active": persisted is not None or bool(session_flags),
+        "persisted": (
+            None
+            if persisted is None
+            else {
+                "mode": persisted.mode,
+                "allow": persisted.allow,
+                "deny": persisted.deny,
+            }
+        ),
+        "session_flags": session_flags,
+    }
+
+    # Keep legacy top-level keys when a persisted policy exists so existing
+    # JSON consumers that read policy_data["mode"] / ["allow"] / ["deny"]
+    # remain compatible. Clients that need the new session-layer view read
+    # ``session_flags`` and ``persisted``.
+    if persisted is not None:
+        policy_data["mode"] = persisted.mode
+        policy_data["allow"] = persisted.allow
+        policy_data["deny"] = persisted.deny
+
+    if formatter.json_mode:
+        formatter.output(policy_data)
+        return
+
+    if persisted is not None:
+        mode_desc = (
+            "default-allow (everything allowed unless denied)"
+            if persisted.mode == "allow"
+            else "default-deny (everything denied unless allowed)"
+        )
+        formatter.console.print(f"[bold]Mode:[/bold] {mode_desc}")
+        if persisted.allow:
+            formatter.console.print(f"[bold]Allow:[/bold] {', '.join(persisted.allow)}")
+        if persisted.deny:
+            formatter.console.print(f"[bold]Deny:[/bold] {', '.join(persisted.deny)}")
+    else:
+        formatter.console.print("[dim]No persisted permission policy (config.json is clean).[/dim]")
+
+    if session_flags:
+        formatter.console.print(
+            f"[bold yellow]Session firewall:[/bold yellow] {' '.join(session_flags)} "
+            "[dim](active for this invocation only; not persisted)[/dim]"
+        )
+
+
+@permissions_app.command("set")
+def permissions_set(
+    ctx: typer.Context,
+    mode: str = typer.Option(
+        ...,
+        "--mode",
+        "-m",
+        help="Base mode: 'allow' (default-allow) or 'deny' (default-deny)",
+    ),
+    allow: list[str] | None = typer.Option(
+        None,
+        "--allow",
+        "-a",
+        help="Allowed operation patterns (repeatable)",
+    ),
+    deny: list[str] | None = typer.Option(
+        None,
+        "--deny",
+        "-d",
+        help="Denied operation patterns (repeatable)",
+    ),
+) -> None:
+    """Set the permission policy (firewall rules).
+
+    Requires interactive confirmation (type a random code) to prevent
+    AI agents from modifying permissions programmatically.
+
+    Examples:
+      # Block all write operations (Vojta's use case):
+      kbagent permissions set --mode allow --deny "cli:write" --deny "tool:write"
+
+      # Allow only read operations:
+      kbagent permissions set --mode deny --allow "cli:read" --allow "tool:read"
+
+      # Block specific operations:
+      kbagent permissions set --mode allow --deny "branch.delete" --deny "tool:delete_*"
+    """
+    formatter = get_formatter(ctx)
+
+    if mode not in ("allow", "deny"):
+        formatter.error(
+            message="Mode must be 'allow' or 'deny'",
+            error_code=ErrorCode.VALIDATION_ERROR,
+        )
+        raise typer.Exit(code=2) from None
+
+    require_random_code_confirmation("update permission policy")
+
+    config_store: ConfigStore = get_service(ctx, "config_store")
+    config = config_store.load()
+
+    policy = PermissionPolicy(
+        mode=mode,
+        allow=allow or [],
+        deny=deny or [],
+    )
+    config.permissions = policy
+    config_store.save(config)
+
+    if formatter.json_mode:
+        formatter.output(
+            {
+                "status": "ok",
+                "mode": mode,
+                "allow": policy.allow,
+                "deny": policy.deny,
+            }
+        )
+    else:
+        formatter.console.print("[green]Permission policy updated.[/green]")
+        mode_desc = (
+            "default-allow (everything allowed unless denied)"
+            if mode == "allow"
+            else "default-deny (everything denied unless allowed)"
+        )
+        formatter.console.print(f"  Mode: {mode_desc}")
+        if policy.allow:
+            formatter.console.print(f"  Allow: {', '.join(policy.allow)}")
+        if policy.deny:
+            formatter.console.print(f"  Deny: {', '.join(policy.deny)}")
+
+
+@permissions_app.command("reset")
+def permissions_reset(
+    ctx: typer.Context,
+) -> None:
+    """Remove all permission restrictions.
+
+    Requires interactive confirmation (type a random code) to prevent
+    AI agents from removing the policy programmatically.
+    """
+    formatter = get_formatter(ctx)
+
+    require_random_code_confirmation("remove permission policy")
+
+    config_store: ConfigStore = get_service(ctx, "config_store")
+    config = config_store.load()
+
+    config.permissions = None
+    config_store.save(config)
+
+    if formatter.json_mode:
+        formatter.output({"status": "ok", "message": "Permission policy removed"})
+    else:
+        formatter.console.print(
+            "[green]Permission policy removed. All operations are allowed.[/green]"
+        )
+
+
+@permissions_app.command("check")
+def permissions_check(
+    ctx: typer.Context,
+    operation: str = typer.Argument(
+        help="Operation to check, e.g. 'branch.delete', 'tool:create_config'",
+    ),
+) -> None:
+    """Check if a specific operation is allowed.
+
+    Reflects the EFFECTIVE policy for this invocation: the persisted
+    policy merged with any top-level session flags like ``--deny-writes``
+    or ``--deny-destructive`` (issue #269 sec-19). Pre-fix, ``permissions
+    check`` only consulted the persisted policy, so an AI agent reading
+    its own self-imposed firewall flag would get a misleading answer.
+
+    Exit code 0 = allowed, 6 = denied.
+    """
+    from ..cli import apply_firewall_flags
+
+    formatter = get_formatter(ctx)
+    config_store: ConfigStore = get_service(ctx, "config_store")
+    config = config_store.load()
+
+    deny_writes = bool(ctx.obj.get("deny_writes")) if ctx.obj else False
+    deny_destructive = bool(ctx.obj.get("deny_destructive")) if ctx.obj else False
+    effective_policy = apply_firewall_flags(
+        config.permissions,
+        deny_writes=deny_writes,
+        deny_destructive=deny_destructive,
+    )
+
+    engine = PermissionEngine(effective_policy)
+    allowed = engine.is_allowed(operation)
+
+    if formatter.json_mode:
+        formatter.output(
+            {
+                "operation": operation,
+                "allowed": allowed,
+            }
+        )
+    else:
+        if allowed:
+            formatter.console.print(f"[green]ALLOWED[/green] {operation}")
+        else:
+            formatter.console.print(f"[red]DENIED[/red] {operation}")
+
+    if not allowed:
+        raise typer.Exit(code=EXIT_PERMISSION_DENIED) from None