keboola-cli 0.63.4__py3-none-any.whl

keboola_agent_cli/server/routers/data_apps.py

@@ -0,0 +1,384 @@
+"""Data App endpoints (lifecycle, secrets, password)."""
+
+from __future__ import annotations
+
+import os
+from pathlib import Path
+from typing import Any
+
+from fastapi import APIRouter, Depends, HTTPException, Query
+from pydantic import BaseModel
+
+from ..dependencies import ServiceRegistry, get_manage_token, get_registry
+
+router = APIRouter(prefix="/data-apps", tags=["data-apps"])
+
+
+def _resolve_git_pat(git_pat_env: str | None, git_pat_file: str | None) -> str | None:
+    """Resolve git PAT from env var name or file path to the actual token value."""
+    if git_pat_env is not None:
+        value = os.environ.get(git_pat_env, "")
+        if not value:
+            raise HTTPException(
+                status_code=400,
+                detail=f"Environment variable {git_pat_env!r} is unset or empty.",
+            )
+        return value
+    if git_pat_file is not None:
+        try:
+            return Path(git_pat_file).read_text(encoding="utf-8").strip()
+        except OSError as exc:
+            raise HTTPException(
+                status_code=400,
+                detail=f"Cannot read PAT file {git_pat_file!r}: {exc}",
+            ) from exc
+    return None
+
+
+class DataAppCreate(BaseModel):
+    name: str
+    description: str = ""
+    slug: str
+    git_repo: str
+    git_branch: str = "main"
+    git_public: bool = False
+    git_username: str | None = None
+    git_pat_plaintext: str | None = None
+    git_pat_encrypted: str | None = None
+    auth: str = "password"
+    size: str = "tiny"
+    auto_suspend_after_seconds: int = 900
+    type: str = "python-js"
+    branch_id: int | None = None
+    deploy: bool = True
+    wait: bool = False
+    timeout_seconds: float = 600.0
+    keep_on_failure: bool = False
+    dry_run: bool = False
+
+
+class SecretsSet(BaseModel):
+    secrets: dict[str, str]
+    branch_id: int | None = None
+    allow_plaintext_on_encrypt_failure: bool = False
+    dry_run: bool = False
+
+
+class SecretsRemove(BaseModel):
+    keys: list[str]
+    branch_id: int | None = None
+    dry_run: bool = False
+
+
+class RepoValidate(BaseModel):
+    git_repo: str
+    git_branch: str = "main"
+    git_public: bool = True
+    git_pat_env: str | None = None
+    git_pat_file: str | None = None
+    type: str = "python-js"
+    strict: bool = False
+
+
+class GitCredentialCreate(BaseModel):
+    type: str
+    permissions: str
+    public_key: str | None = None
+    name: str | None = None
+
+
+@router.get("", summary="List data apps across projects")
+def list_apps(
+    project: list[str] | None = Query(None),
+    branch_id: int | None = None,
+    registry: ServiceRegistry = Depends(get_registry),
+) -> dict[str, Any]:
+    """List data apps in one or more projects. Mirrors `kbagent data-app list`."""
+    return registry.data_app.list_data_apps(aliases=project, branch_id=branch_id)
+
+
+@router.get("/{project}/{app_id}", summary="Get data app detail")
+def detail(
+    project: str,
+    app_id: str,
+    branch_id: int | None = None,
+    registry: ServiceRegistry = Depends(get_registry),
+) -> dict[str, Any]:
+    """Fetch detail for a single data app. Mirrors `kbagent data-app detail`."""
+    return registry.data_app.get_data_app(alias=project, app_id=app_id, branch_id=branch_id)
+
+
+@router.post("/{project}", summary="Create a data app")
+def create(
+    project: str, body: DataAppCreate, registry: ServiceRegistry = Depends(get_registry)
+) -> dict[str, Any]:
+    """Create a new data app, optionally deploy and wait. Mirrors `kbagent data-app create`."""
+    return registry.data_app.create_data_app(
+        alias=project,
+        name=body.name,
+        description=body.description,
+        slug=body.slug,
+        git_repo=body.git_repo,
+        git_branch=body.git_branch,
+        git_public=body.git_public,
+        git_username=body.git_username,
+        git_pat_plaintext=body.git_pat_plaintext,
+        git_pat_encrypted=body.git_pat_encrypted,
+        auth=body.auth,
+        size=body.size,
+        auto_suspend_after_seconds=body.auto_suspend_after_seconds,
+        type_=body.type,
+        branch_id=body.branch_id,
+        deploy=body.deploy,
+        wait=body.wait,
+        timeout_seconds=body.timeout_seconds,
+        keep_on_failure=body.keep_on_failure,
+        dry_run=body.dry_run,
+    )
+
+
+@router.post("/{project}/{app_id}/deploy", summary="Deploy a data app version")
+def deploy(
+    project: str,
+    app_id: str,
+    config_version: int | None = None,
+    wait: bool = False,
+    timeout_seconds: float = 600.0,
+    branch_id: int | None = None,
+    registry: ServiceRegistry = Depends(get_registry),
+) -> dict[str, Any]:
+    """Deploy the configured version of a data app. Mirrors `kbagent data-app deploy`."""
+    return registry.data_app.deploy_data_app(
+        alias=project,
+        app_id=app_id,
+        config_version=str(config_version) if config_version is not None else None,
+        wait=wait,
+        timeout_seconds=timeout_seconds,
+        branch_id=branch_id,
+    )
+
+
+@router.post("/{project}/{app_id}/start", summary="Start a data app")
+def start(
+    project: str,
+    app_id: str,
+    wait: bool = False,
+    timeout_seconds: float = 600.0,
+    registry: ServiceRegistry = Depends(get_registry),
+) -> dict[str, Any]:
+    """Start a deployed data app. Mirrors `kbagent data-app start`."""
+    return registry.data_app.start_data_app(
+        alias=project, app_id=app_id, wait=wait, timeout_seconds=timeout_seconds
+    )
+
+
+@router.post("/{project}/{app_id}/stop", summary="Stop a data app")
+def stop(
+    project: str,
+    app_id: str,
+    wait: bool = False,
+    timeout_seconds: float = 600.0,
+    registry: ServiceRegistry = Depends(get_registry),
+) -> dict[str, Any]:
+    """Stop a running data app. Mirrors `kbagent data-app stop`."""
+    return registry.data_app.stop_data_app(
+        alias=project, app_id=app_id, wait=wait, timeout_seconds=timeout_seconds
+    )
+
+
+@router.delete("/{project}/{app_id}", summary="Delete a data app")
+def delete(
+    project: str, app_id: str, registry: ServiceRegistry = Depends(get_registry)
+) -> dict[str, Any]:
+    """Delete a data app and its configuration. Mirrors `kbagent data-app delete`."""
+    return registry.data_app.delete_data_app(alias=project, app_id=app_id)
+
+
+@router.get("/{project}/{app_id}/password", summary="Get data app access password")
+def password(
+    project: str,
+    app_id: str,
+    manage_token: str | None = Depends(get_manage_token),
+    registry: ServiceRegistry = Depends(get_registry),
+) -> dict[str, Any]:
+    """Fetch the password for a password-protected data app. Mirrors `kbagent data-app password`."""
+    if not manage_token:
+        raise HTTPException(status_code=401, detail="Missing X-Manage-Token header.")
+    return registry.data_app.get_data_app_password(
+        alias=project, app_id=app_id, manage_token=manage_token
+    )
+
+
+@router.get("/{project}/{app_id}/logs", summary="Tail data app container logs")
+def logs(
+    project: str,
+    app_id: str,
+    lines: int | None = None,
+    since: str | None = None,
+    registry: ServiceRegistry = Depends(get_registry),
+) -> dict[str, Any]:
+    """Tail container logs for a data app. Mirrors `kbagent data-app logs`.
+
+    Query params ``lines`` and ``since`` are mutually exclusive (the
+    service raises ``KeboolaApiError(INVALID_ARGUMENT)`` if both are
+    set). ``since`` must be ISO 8601 WITH timezone.
+
+    Default-behavior asymmetry (deliberate): the CLI applies a 500-line
+    default when neither ``--lines`` nor ``--since`` is set (terminal
+    UX: predictable output for an operator at a tty). The REST route
+    and the service preserve the raw API contract: ``lines=None,
+    since=None`` returns the full current container buffer. REST
+    consumers (data-app dashboards, monitoring agents) typically want
+    the whole buffer; pass ``?lines=N`` for a cap that matches the CLI.
+
+    Note: the response ``text`` field can echo runtime secrets the app
+    printed to stdout/stderr; the envelope is reproduced verbatim with
+    no masking. Callers consuming this over SSE / scheduled-agent
+    persisted runs should consider secret hygiene.
+    """
+    return registry.data_app.get_app_logs(alias=project, app_id=app_id, lines=lines, since=since)
+
+
+@router.get("/{project}/{app_id}/secrets", summary="List data app secrets")
+def secrets_list(
+    project: str,
+    app_id: str,
+    branch_id: int | None = None,
+    show_fingerprint: bool = False,
+    registry: ServiceRegistry = Depends(get_registry),
+) -> dict[str, Any]:
+    """List secret keys configured on a data app. Mirrors `kbagent data-app secrets-list`."""
+    return registry.data_app.list_data_app_secrets(
+        alias=project,
+        app_id=app_id,
+        branch_id=branch_id,
+        show_fingerprint=show_fingerprint,
+    )
+
+
+@router.get("/{project}/{app_id}/secrets/{key:path}", summary="Get a single data app secret")
+def secrets_get(
+    project: str,
+    app_id: str,
+    key: str,
+    branch_id: int | None = None,
+    registry: ServiceRegistry = Depends(get_registry),
+) -> dict[str, Any]:
+    """Read a single secret value on a data app. Mirrors `kbagent data-app secrets-get`."""
+    return registry.data_app.get_data_app_secret(
+        alias=project, app_id=app_id, key=key, branch_id=branch_id
+    )
+
+
+@router.put("/{project}/{app_id}/secrets", summary="Set data app secrets")
+def secrets_set(
+    project: str,
+    app_id: str,
+    body: SecretsSet,
+    registry: ServiceRegistry = Depends(get_registry),
+) -> dict[str, Any]:
+    """Set or update encrypted secrets on a data app. Mirrors `kbagent data-app secrets-set`."""
+    return registry.data_app.set_data_app_secrets(
+        alias=project,
+        app_id=app_id,
+        secrets=body.secrets,
+        branch_id=body.branch_id,
+        allow_plaintext_on_encrypt_failure=body.allow_plaintext_on_encrypt_failure,
+        dry_run=body.dry_run,
+    )
+
+
+@router.post("/{project}/{app_id}/secrets/remove", summary="Remove data app secrets")
+def secrets_remove(
+    project: str,
+    app_id: str,
+    body: SecretsRemove,
+    registry: ServiceRegistry = Depends(get_registry),
+) -> dict[str, Any]:
+    """Remove one or more secrets from a data app. Mirrors `kbagent data-app secrets-remove`."""
+    return registry.data_app.remove_data_app_secrets(
+        alias=project,
+        app_id=app_id,
+        keys=body.keys,
+        branch_id=body.branch_id,
+        dry_run=body.dry_run,
+    )
+
+
+@router.post("/validate-repo", summary="Validate a data app git repo")
+def validate_repo(
+    body: RepoValidate, registry: ServiceRegistry = Depends(get_registry)
+) -> dict[str, Any]:
+    """Validate that a git repo is a deployable data app. Mirrors `kbagent data-app validate-repo`."""
+    git_pat = _resolve_git_pat(body.git_pat_env, body.git_pat_file)
+    return registry.repo_validate.validate_repo(
+        git_repo=body.git_repo,
+        git_branch=body.git_branch,
+        git_public=body.git_public,
+        git_pat=git_pat,
+        type_=body.type,
+        strict=body.strict,
+    )
+
+
+@router.get("/{project}/{app_id}/git-repo", summary="Get a data app's git repository")
+def git_repo(
+    project: str, app_id: str, registry: ServiceRegistry = Depends(get_registry)
+) -> dict[str, Any]:
+    """Show clone URLs of the app's configured git repo. Mirrors `kbagent data-app git-repo`.
+
+    Returns 409 until the app has been deployed at least once (the git block is
+    synced from the Storage config into the Data Science app record at deploy
+    time).
+    """
+    return registry.data_app_git.get_data_app_git_repo(alias=project, app_id=app_id)
+
+
+@router.get("/{project}/{app_id}/git-repo/branches", summary="List a data app's git branches")
+def git_branches(
+    project: str, app_id: str, registry: ServiceRegistry = Depends(get_registry)
+) -> dict[str, Any]:
+    """List remote branches of the app's git repo. Mirrors `kbagent data-app git-branches`."""
+    return registry.data_app_git.list_data_app_git_branches(alias=project, app_id=app_id)
+
+
+@router.get("/{project}/{app_id}/git-repo/entrypoints", summary="List a data app's git entrypoints")
+def git_entrypoints(
+    project: str, app_id: str, registry: ServiceRegistry = Depends(get_registry)
+) -> dict[str, Any]:
+    """List root-level .py entrypoints. Mirrors `kbagent data-app git-entrypoints`."""
+    return registry.data_app_git.list_data_app_git_entrypoints(alias=project, app_id=app_id)
+
+
+@router.get("/{project}/{app_id}/git-repo/credentials", summary="List managed git credentials")
+def git_credentials(
+    project: str, app_id: str, registry: ServiceRegistry = Depends(get_registry)
+) -> dict[str, Any]:
+    """List credentials of the app's MANAGED git repo. Mirrors `kbagent data-app git-credentials`.
+
+    The credential secret is never returned here; needs an admin storage token.
+    """
+    return registry.data_app_git.list_data_app_git_credentials(alias=project, app_id=app_id)
+
+
+@router.post("/{project}/{app_id}/git-repo/credentials", summary="Create a managed git credential")
+def git_credentials_create(
+    project: str,
+    app_id: str,
+    body: GitCredentialCreate,
+    registry: ServiceRegistry = Depends(get_registry),
+) -> dict[str, Any]:
+    """Mint a git credential for the app's MANAGED git repo.
+
+    Mirrors `kbagent data-app git-credentials-create`. For ``type=http_token``
+    the response carries a one-time ``secret``. Needs an admin storage token;
+    external repos return 409.
+    """
+    return registry.data_app_git.create_data_app_git_credential(
+        alias=project,
+        app_id=app_id,
+        type_=body.type,
+        permissions=body.permissions,
+        public_key=body.public_key,
+        name=body.name,
+    )

keboola_agent_cli/server/routers/dev_portal.py

@@ -0,0 +1,67 @@
+"""Developer Portal reads (list/get).
+
+Only the read surface is exposed over REST. The write commands
+(`create`, `patch`, `upload-icon`, `publish`, `deprecate`) are deliberately
+CLI-only: they require a human to type a random confirmation code on a real
+TTY, which has no meaning over HTTP. Identity management
+(`identity add/edit/remove/...`) is likewise CLI-only because it handles
+login credentials that must not travel over this API. See
+`plugins/kbagent/skills/kbagent/references/dev-portal-workflow.md`.
+"""
+
+from __future__ import annotations
+
+from typing import Any
+
+from fastapi import APIRouter, Depends, HTTPException
+
+from ..dependencies import ServiceRegistry, get_registry
+
+router = APIRouter(prefix="/dev-portal", tags=["dev-portal"])
+
+
+def _resolve_identity(registry: ServiceRegistry, identity: str | None) -> str:
+    """Resolve the identity alias: explicit query param, else the configured default."""
+    if identity:
+        return identity
+    default = registry.dev_portal.current_identity()
+    if not default:
+        raise HTTPException(
+            status_code=400,
+            detail=(
+                "No Developer Portal identity selected. Pass ?identity=<alias>, "
+                "or set a default via `kbagent dev-portal identity use <alias>`."
+            ),
+        )
+    return default
+
+
+@router.get("/apps", summary="List Developer Portal apps for a vendor")
+def list_apps(
+    vendor: str,
+    identity: str | None = None,
+    registry: ServiceRegistry = Depends(get_registry),
+) -> list[dict[str, Any]]:
+    """List all apps for a vendor. Mirrors `kbagent dev-portal list --vendor`."""
+    alias = _resolve_identity(registry, identity)
+    return registry.dev_portal.list_apps(alias, vendor)
+
+
+@router.get("/apps/{app}", summary="Get one Developer Portal app")
+def get_app(
+    app: str,
+    identity: str | None = None,
+    registry: ServiceRegistry = Depends(get_registry),
+) -> dict[str, Any]:
+    """Full portal entry for one app. `app` is VENDOR.APP_ID, e.g. keboola.ex-foo.
+
+    Mirrors `kbagent dev-portal get --app`.
+    """
+    if "." not in app:
+        raise HTTPException(
+            status_code=400,
+            detail=f"app must be in VENDOR.APP_ID form (e.g. keboola.ex-foo), got: {app!r}",
+        )
+    vendor, _ = app.split(".", 1)
+    alias = _resolve_identity(registry, identity)
+    return registry.dev_portal.get_app(alias, vendor, app)

keboola_agent_cli/server/routers/encrypt.py

@@ -0,0 +1,35 @@
+"""Encryption endpoint."""
+
+from __future__ import annotations
+
+from typing import Any
+
+from fastapi import APIRouter, Depends
+from pydantic import BaseModel
+
+from ..dependencies import ServiceRegistry, get_registry
+
+router = APIRouter(prefix="/encrypt", tags=["encrypt"])
+
+
+class EncryptRequest(BaseModel):
+    project: str
+    component_id: str
+    values: dict[str, str]
+
+
+@router.post("/values", summary="Encrypt secret values")
+def encrypt_values(
+    body: EncryptRequest, registry: ServiceRegistry = Depends(get_registry)
+) -> dict[str, Any]:
+    """Encrypt one or more values for a specific project + component pair.
+
+    Returns the same keys with `KBC::ProjectSecure::...` ciphertexts. Use
+    this before writing secret values into a configuration so they are
+    never persisted in plaintext. Mirrors `kbagent encrypt values`.
+    """
+    return registry.encrypt.encrypt(
+        alias=body.project,
+        component_id=body.component_id,
+        input_data=body.values,
+    )

keboola_agent_cli/server/routers/feature.py

@@ -0,0 +1,179 @@
+"""Feature-flag endpoints (stack catalogue / project / user) -- all require a manage token.
+
+1:1 mirror of the `kbagent feature` command group. Every operation hits the
+Manage API and therefore needs the per-request Manage token alongside the
+standard bearer token, exactly like the `members` and `org` routers.
+"""
+
+from __future__ import annotations
+
+from typing import Any
+
+from fastapi import APIRouter, Depends, HTTPException
+from pydantic import BaseModel
+
+from ..dependencies import ServiceRegistry, get_manage_token, get_registry
+
+router = APIRouter(prefix="/feature", tags=["feature"])
+
+# Every feature endpoint hits the Manage API, so each needs the per-request
+# Manage token alongside the bearer token. Declaring the joint requirement
+# here surfaces it as a separate scheme in the Swagger UI "Authorize" dialog.
+_NEEDS_MANAGE_TOKEN: dict[str, Any] = {"security": [{"BearerAuth": [], "ManageToken": []}]}
+
+
+class ProjectFeatureBody(BaseModel):
+    feature: str
+    dry_run: bool = False
+
+
+class UserFeatureBody(BaseModel):
+    email: str
+    feature: str
+    dry_run: bool = False
+
+
+def _require_manage(token: str | None) -> str:
+    if not token:
+        raise HTTPException(status_code=401, detail="Missing X-Manage-Token header.")
+    return token
+
+
+@router.get("/{project}/list", summary="Stack feature catalogue", openapi_extra=_NEEDS_MANAGE_TOKEN)
+def list_features(
+    project: str,
+    manage_token: str | None = Depends(get_manage_token),
+    registry: ServiceRegistry = Depends(get_registry),
+) -> dict[str, Any]:
+    """Every feature defined on the stack `project` points at. The alias only
+    resolves the stack URL -- the catalogue is stack-wide. Mirrors
+    `kbagent feature list`.
+    """
+    return registry.feature.list_stack_features(
+        manage_token=_require_manage(manage_token), alias=project
+    )
+
+
+@router.get(
+    "/{project}/project-show",
+    summary="Project's assigned features",
+    openapi_extra=_NEEDS_MANAGE_TOKEN,
+)
+def project_show(
+    project: str,
+    manage_token: str | None = Depends(get_manage_token),
+    registry: ServiceRegistry = Depends(get_registry),
+) -> dict[str, Any]:
+    """Features assigned to `project`. Mirrors `kbagent feature project-show`."""
+    return registry.feature.list_project_features(
+        manage_token=_require_manage(manage_token), alias=project
+    )
+
+
+@router.post(
+    "/{project}/project-add",
+    summary="Enable a feature on a project",
+    openapi_extra=_NEEDS_MANAGE_TOKEN,
+)
+def project_add(
+    project: str,
+    body: ProjectFeatureBody,
+    manage_token: str | None = Depends(get_manage_token),
+    registry: ServiceRegistry = Depends(get_registry),
+) -> dict[str, Any]:
+    """Enable a feature on `project`. Pass `dry_run=true` to preview. Mirrors
+    `kbagent feature project-add`.
+    """
+    return registry.feature.add_project_feature(
+        manage_token=_require_manage(manage_token),
+        alias=project,
+        feature=body.feature,
+        dry_run=body.dry_run,
+    )
+
+
+@router.post(
+    "/{project}/project-remove",
+    summary="Disable a feature on a project",
+    openapi_extra=_NEEDS_MANAGE_TOKEN,
+)
+def project_remove(
+    project: str,
+    body: ProjectFeatureBody,
+    manage_token: str | None = Depends(get_manage_token),
+    registry: ServiceRegistry = Depends(get_registry),
+) -> dict[str, Any]:
+    """Disable a feature on `project` (destructive). Pass `dry_run=true` to
+    preview. Mirrors `kbagent feature project-remove`.
+    """
+    return registry.feature.remove_project_feature(
+        manage_token=_require_manage(manage_token),
+        alias=project,
+        feature=body.feature,
+        dry_run=body.dry_run,
+    )
+
+
+@router.get(
+    "/{project}/user-show",
+    summary="User's assigned features",
+    openapi_extra=_NEEDS_MANAGE_TOKEN,
+)
+def user_show(
+    project: str,
+    email: str,
+    manage_token: str | None = Depends(get_manage_token),
+    registry: ServiceRegistry = Depends(get_registry),
+) -> dict[str, Any]:
+    """Features assigned to `email` on the alias's stack. Mirrors
+    `kbagent feature user-show`.
+    """
+    return registry.feature.list_user_features(
+        manage_token=_require_manage(manage_token), alias=project, email=email
+    )
+
+
+@router.post(
+    "/{project}/user-add",
+    summary="Enable a feature on a user",
+    openapi_extra=_NEEDS_MANAGE_TOKEN,
+)
+def user_add(
+    project: str,
+    body: UserFeatureBody,
+    manage_token: str | None = Depends(get_manage_token),
+    registry: ServiceRegistry = Depends(get_registry),
+) -> dict[str, Any]:
+    """Enable a feature on a user. Pass `dry_run=true` to preview. Mirrors
+    `kbagent feature user-add`.
+    """
+    return registry.feature.add_user_feature(
+        manage_token=_require_manage(manage_token),
+        alias=project,
+        email=body.email,
+        feature=body.feature,
+        dry_run=body.dry_run,
+    )
+
+
+@router.post(
+    "/{project}/user-remove",
+    summary="Disable a feature on a user",
+    openapi_extra=_NEEDS_MANAGE_TOKEN,
+)
+def user_remove(
+    project: str,
+    body: UserFeatureBody,
+    manage_token: str | None = Depends(get_manage_token),
+    registry: ServiceRegistry = Depends(get_registry),
+) -> dict[str, Any]:
+    """Disable a feature on a user (destructive). Pass `dry_run=true` to
+    preview. Mirrors `kbagent feature user-remove`.
+    """
+    return registry.feature.remove_user_feature(
+        manage_token=_require_manage(manage_token),
+        alias=project,
+        email=body.email,
+        feature=body.feature,
+        dry_run=body.dry_run,
+    )