keboola-cli 0.65.0__tar.gz → 0.66.0__tar.gz

{keboola_cli-0.65.0 → keboola_cli-0.66.0}/CLAUDE.md

@@ -385,6 +385,14 @@ kbagent feature user-show --project ALIAS --email EMAIL
 kbagent feature user-add --project ALIAS --email EMAIL --feature NAME [--dry-run] [--yes]
 kbagent feature user-remove --project ALIAS --email EMAIL --feature NAME [--dry-run] [--yes]
 
+# token: scoped Storage tokens (Keboola single-bucket-write pattern; acting token needs canManageTokens; secret shown once).
+kbagent token create --project NAME --description DESC [--bucket-write BUCKET ...] [--bucket-read BUCKET ...] [--component-access ID ...] [--can-read-all-file-uploads] [--expires-in N]
+kbagent token delete --project NAME --token-id ID [--yes]
+kbagent token refresh --project NAME --token-id ID [--yes]
+# SDK (importable Client(url,token)) now exposes create_scoped_token / delete_token / refresh_token /
+# create_stream_source / get_stream_source / list_stream_sources / delete_stream_source: dicts on .raw,
+# typed ScopedTokenResult / StreamSourceResult on the facade. See docs/sdk.md.
+
 # permissions: session write/destructive firewall. The top-level --deny-writes / --deny-destructive
 # flags are the one-shot form; `permissions set` persists a policy (mode allow|deny + allow/deny patterns
 # like cli:write, cli:destructive, tool:write). The agent guards rails against mistakes; not a sandbox.
@@ -430,13 +438,11 @@ kbagent data-app create --project ALIAS --name NAME --slug SLUG (--git-repo URL
 #   NO parameters.dataApp.git block, and forces --no-deploy (nothing to run yet). Mutually exclusive with
 #   --git-repo and all --git-*/PAT auth flags. Full flow to a RUNNING managed-repo app (0.65.0+):
 #   (1) create --use-managed-git-repo -> (2) `git-credentials-create --type http_token --permissions
-#   readWrite` + `git push` code to the managed repo URL (from `git-repo`) -> (3) `data-app
-#   git-bind-credential` (mints an http_token ON the app, encrypts it under the project KMS, and writes
-#   parameters.dataApp.git so the runtime's `git clone` can authenticate -- required on stacks that do NOT
-#   inject managed-repo creds at deploy time) -> (4) `data-app deploy`. deploy pins the LATEST
-#   configVersion when a git block is present and omits it for a PURE managed repo (deploys from
-#   managedGitRepoId). Use `data-app runs` to debug a deploy that reverts to stopped (setup-phase
-#   failures, e.g. git-clone "could not read Username", produce no container logs).
+#   readWrite` + `git push` code to the managed repo URL (from `git-repo`) -> (3) `data-app deploy`.
+#   The platform injects the clone credentials at deploy time, so no credential wiring is needed.
+#   deploy pins the LATEST configVersion when a git block is present and omits it for a PURE managed
+#   repo (deploys from managedGitRepoId). Use `data-app runs` to debug a deploy that reverts to
+#   stopped (setup-phase failures produce no container logs).
 kbagent data-app deploy --project NAME --app-id ID [--config-version N] [--wait] [--timeout SECONDS] [--branch ID]
 kbagent data-app start --project NAME --app-id ID [--wait] [--timeout SECONDS]
 kbagent data-app stop --project NAME --app-id ID [--wait] [--timeout SECONDS]
@@ -454,7 +460,6 @@ kbagent data-app git-branches --project NAME --app-id ID
 kbagent data-app git-entrypoints --project NAME --app-id ID
 kbagent data-app git-credentials --project NAME --app-id ID
 kbagent data-app git-credentials-create --project NAME --app-id ID --type ssh_key|http_token --permissions readOnly|readWrite [--public-key KEY | --public-key-file PATH] [--name LABEL] [--yes]
-kbagent data-app git-bind-credential --project NAME --app-id ID [--branch-name main] [--permissions readOnly|readWrite] [--dry-run]
 # git-repo/git-branches/git-entrypoints introspect the deployed-from git repo (sandboxes-service /apps/{id}/git-repo/*); they return 409 "no Git repository configured" until the app has been DEPLOYED at least once (git config syncs Storage->DS record at deploy). git-credentials* manage credentials for a MANAGED repo only; apps from `data-app create --git-repo` are external => git-credentials-create returns 409. http_token mints a ONE-TIME secret (shown once); credentials endpoints need an admin storage token.
 
 kbagent component list [--project NAME] [--type TYPE] [--query QUERY]

{keboola_cli-0.65.0 → keboola_cli-0.66.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: keboola-cli
-Version: 0.65.0
+Version: 0.66.0
 Summary: AI-friendly CLI for managing Keboola projects
 Author-email: Keboola <dev@keboola.com>
 License-Expression: MIT

{keboola_cli-0.65.0 → keboola_cli-0.66.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "keboola-cli"
-version = "0.65.0"
+version = "0.66.0"
 description = "AI-friendly CLI for managing Keboola projects"
 readme = "README.md"
 requires-python = ">=3.12"

{keboola_cli-0.65.0 → keboola_cli-0.66.0}/scripts/hatch_build.py

@@ -138,7 +138,19 @@ def _bundle_ui(repo_root: Path, log: Callable[[str], None] = print) -> None:
     log("no prebuilt dist found; running npm build")
     try:
         subprocess.check_call(
-            [npm, "ci", "--prefer-offline", "--no-audit", "--no-fund"],
+            # --ignore-scripts: do NOT run npm lifecycle scripts from the
+            # (transitive) dependency tree at wheel-build / `git+` install time.
+            # Without it, a compromised dependency's postinstall would execute
+            # arbitrary code on the user's machine during install (GHSA-pfvh).
+            # Verified non-breaking: `tsc -b && vite build` needs no dependency
+            # install-scripts -- vite 8 (rolldown) ships prebuilt platform
+            # binaries rather than fetching them via a postinstall.
+            # NOTE: this also suppresses any *root* web/frontend/package.json
+            # prepare/postinstall script (there is none today). If one is ever
+            # added AND required for the build, invoke it explicitly here rather
+            # than dropping --ignore-scripts, which would re-open the dependency
+            # lifecycle-script RCE surface.
+            [npm, "ci", "--prefer-offline", "--no-audit", "--no-fund", "--ignore-scripts"],
             cwd=frontend_dir,
         )
         subprocess.check_call([npm, "run", "build"], cwd=frontend_dir)

{keboola_cli-0.65.0 → keboola_cli-0.66.0}/src/keboola_agent_cli/__init__.py

@@ -9,6 +9,8 @@ from .result_models import (
     ConfigDetailResult,
     JobResult,
     QueryResult,
+    ScopedTokenResult,
+    StreamSourceResult,
     SyncPushResult,
     UploadTableResult,
 )
@@ -28,6 +30,8 @@ __all__ = [
     "JobIdempotencyStore",
     "JobResult",
     "QueryResult",
+    "ScopedTokenResult",
+    "StreamSourceResult",
     "SyncPushResult",
     "UploadTableResult",
     "__version__",

{keboola_cli-0.65.0 → keboola_cli-0.66.0}/src/keboola_agent_cli/changelog.py

@@ -24,6 +24,49 @@ from .constants import CHANGELOG_HEADLINE_MAX_CHARS
 
 # Ordered newest-first.  Each value is a list of brief one-line descriptions.
 CHANGELOG: dict[str, list[str]] = {
+    "0.66.0": [
+        "New: device-enrollment primitives on the importable library -- a hosted Data App can now mint "
+        "per-device credentials in-process (no CLI subprocess, no master token on the device). "
+        "`Client(url, token)` / `.raw` (`KeboolaClient`) gains `create_scoped_token`, `delete_token`, "
+        "`refresh_token`, and per-device Data Streams `create_stream_source` / `get_stream_source` / "
+        "`list_stream_sources` / `delete_stream_source`. The facade returns typed `ScopedTokenResult` / "
+        "`StreamSourceResult` (exported from the package root); `.raw` returns plain dicts. Built for "
+        "keboola/jasnost device enrollment (ADR 0005).",
+        "New: `create_scoped_token(description, bucket_permissions, component_access, "
+        "can_read_all_file_uploads, expires_in)` generalises `create_short_lived_token` beyond "
+        "component scope -- it maps straight to `POST /v2/storage/tokens` so you can mint the narrow "
+        "'upload Files + write one sink bucket, expiring' token a capture device needs (the Keboola "
+        "single-bucket-write pattern). The acting token must carry `canManageTokens`.",
+        "New: `create_stream_source` provisions a per-device OTLP source AND (for `otlp`, default) its "
+        "logs/metrics/traces sinks + `in.c-otlp-<sourceId>` bucket, and returns `sink_bucket_id` so the "
+        "scoped device token can be granted write on exactly that bucket. Per-device sources are the "
+        "unit of isolated event-plane revocation (`delete_stream_source`) -- no shared-secret rotation. "
+        "`otlp_url` carries the ingest secret unmasked (revealed to the device once, never persisted).",
+        "New: `kbagent token` command group (create | delete | refresh) mirrors the scoped-token "
+        "primitives on the CLI (Project Management). `token create` prints the secret once; `token "
+        "delete` revokes immediately; `token refresh` rotates and invalidates the old value. These are "
+        "Storage-API operations (no manage token).",
+        "Note: contrary to earlier assumptions, a Data Streams source create is authenticated with a "
+        "normal per-project Storage token (NOT a master token) and there is no `masterTokenRequired` "
+        "error code; and a Files upload is NOT gated by `componentAccess` / `canReadAllFileUploads` -- "
+        "any valid Storage token can upload its own Files. `canReadAllFileUploads` only widens reading "
+        "files uploaded by OTHER tokens.",
+    ],
+    "0.65.1": [
+        "BREAKING: Removed `data-app git-bind-credential` (and its `kbagent serve` endpoint). It shipped in "
+        "0.65.0 on a misdiagnosis: managed-repo deploys were failing and we believed the platform "
+        "did not inject the git-clone credential, so the command wired an encrypted credential into "
+        "`parameters.dataApp.git`. A clean reproduction on `data-science.us-east4.gcp` confirmed the "
+        "platform DOES inject the clone credential at deploy time (matching the sandboxes-service "
+        "`testManagedGitRepo.sh` contract) -- the command was unnecessary. The real fix was the "
+        "0.65.0 `configVersion`-omit change; pinning a managed app's no-git-block config is what made "
+        "the runtime demand `dataApp.git.repository` and revert the deploy to stopped.",
+        "Change: Corrected the managed-repo guidance everywhere: the canonical flow is `data-app create "
+        "--use-managed-git-repo` -> `git-credentials-create --type http_token --permissions readWrite` "
+        "+ `git push` your code -> `data-app deploy`. No credential wiring is needed. The earlier "
+        "'platform does not inject credentials' / `could not read Username` framing was wrong "
+        "(GitHub issue #454 closed as not-a-bug).",
+    ],
     "0.65.0": [
         "New: deploy a data app from a Keboola-MANAGED git repository end-to-end. "
         "`data-app create --use-managed-git-repo` provisions an EMPTY Keboola-hosted repo (POST "
@@ -39,7 +82,9 @@ CHANGELOG: dict[str, list[str]] = {
         "credentials at deploy time -- without it the runtime's `git clone` of the managed repo "
         "fails `could not read Username` and the deploy reverts to stopped. The token is encrypted "
         "in place and never printed; `--dry-run` previews what would be wired without minting the "
-        "one-time credential or touching the config.",
+        "one-time credential or touching the config. (Removed in 0.65.1 -- this was based on a "
+        "misdiagnosis; the platform does inject the clone credential, so the command was "
+        "unnecessary. See the 0.65.1 notes.)",
         "New: `data-app runs --project P --app-id ID [--limit N]` lists a data app's recent "
         "deployment attempts with `failure_reason` + `startup_logs`, including setup-phase failures "
         "(e.g. a git-clone error during `app_setup`) that produce no container logs. It works on "

{keboola_cli-0.65.0 → keboola_cli-0.66.0}/src/keboola_agent_cli/cli.py

@@ -35,6 +35,7 @@ from .commands.sharing import sharing_app
 from .commands.storage import storage_app
 from .commands.stream import stream_app
 from .commands.sync import sync_app
+from .commands.token import token_app
 from .commands.tool import tool_app
 from .commands.version import update_command, version_command
 from .commands.workspace import workspace_app
@@ -71,6 +72,7 @@ from .services.sharing_service import SharingService
 from .services.storage_service import StorageService
 from .services.stream_service import StreamService
 from .services.sync_service import SyncService
+from .services.token_service import TokenService
 from .services.variables_service import VariablesService
 from .services.version_service import VersionService
 from .services.workspace_service import WorkspaceService
@@ -98,6 +100,7 @@ _PROJ = "Project Management"
 app.add_typer(project_app, name="project", rich_help_panel=_PROJ)
 app.add_typer(org_app, name="org", rich_help_panel=_PROJ)
 app.add_typer(feature_app, name="feature", rich_help_panel=_PROJ)
+app.add_typer(token_app, name="token", rich_help_panel=_PROJ)
 
 # -- Browse & Inspect --
 _BROWSE = "Browse & Inspect"
@@ -320,6 +323,7 @@ def main(
     search_service = SearchService(config_store=config_store)
     storage_service = StorageService(config_store=config_store)
     stream_service = StreamService(config_store=config_store)
+    token_service = TokenService(config_store=config_store)
     sync_service = SyncService(config_store=config_store)
     variables_service = VariablesService(config_store=config_store)
     encrypt_service = EncryptService(config_store=config_store)
@@ -375,6 +379,7 @@ def main(
     ctx.obj["search_service"] = search_service
     ctx.obj["storage_service"] = storage_service
     ctx.obj["stream_service"] = stream_service
+    ctx.obj["token_service"] = token_service
     ctx.obj["sync_service"] = sync_service
     ctx.obj["variables_service"] = variables_service
     ctx.obj["encrypt_service"] = encrypt_service

{keboola_cli-0.65.0 → keboola_cli-0.66.0}/src/keboola_agent_cli/client.py

@@ -34,16 +34,19 @@ from .constants import (
     METADATA_NOT_FOUND,
     OAUTH_HOST,
     OAUTH_PATH,
+    OTLP_BUCKET_PREFIX,
     QUERY_JOB_MAX_WAIT,
     QUERY_JOB_POLL_INTERVAL,
     QUERY_RESULTS_PAGE_SIZE,
     STORAGE_JOB_MAX_WAIT,
     STORAGE_JOB_POLL_INTERVAL,
+    STREAM_DEFAULT_BRANCH,
     VALID_POLL_STRATEGIES,
 )
 from .errors import ErrorCode, KeboolaApiError
 from .http_base import BaseHttpClient
 from .models import TokenVerifyResponse
+from .stream_client import StreamClient, provision_otlp_sinks, stream_task_source_id
 
 logger = logging.getLogger(__name__)
 
@@ -171,6 +174,9 @@ class KeboolaClient(BaseHttpClient):
         self._queue_client: httpx.Client | None = None
         self._query_client: httpx.Client | None = None
         self._encrypt_client: httpx.Client | None = None
+        # Lazily built on first Data Streams call (per-device OTLP sources); the
+        # Stream control plane is a sibling host reachable from this stack+token.
+        self._stream_client: StreamClient | None = None
         # Cache of project feature flags. Populated lazily on first
         # has_feature() / get_project_features() call so we don't pay an
         # extra verify_token round-trip on every kbagent invocation, and
@@ -199,6 +205,8 @@ class KeboolaClient(BaseHttpClient):
             self._query_client.close()
         if self._encrypt_client is not None:
             self._encrypt_client.close()
+        if self._stream_client is not None:
+            self._stream_client.close()
 
     def __enter__(self) -> "KeboolaClient":
         return self
@@ -376,6 +384,209 @@ class KeboolaClient(BaseHttpClient):
         )
         return response.json()
 
+    def create_scoped_token(
+        self,
+        *,
+        description: str,
+        bucket_permissions: dict[str, str] | None = None,
+        component_access: list[str] | None = None,
+        can_read_all_file_uploads: bool = False,
+        expires_in: int | None = None,
+    ) -> dict[str, Any]:
+        """Create a scoped Storage API token (``POST /v2/storage/tokens``).
+
+        The general form of :meth:`create_short_lived_token`: instead of only a
+        component allow-list it also expresses **bucket** permissions, so a
+        caller can mint the narrow "upload Files + write one sink bucket,
+        expiring, nothing else" token a capture device needs (Keboola's
+        single-bucket-write pattern).
+
+        Note on Files upload: a Files upload (``POST /v2/storage/files/prepare``)
+        is a generic Storage write available to any valid Storage token -- it is
+        **not** gated by ``componentAccess`` or ``canReadAllFileUploads``. Grant
+        ``bucket_permissions={sink_bucket: "write"}`` for the sink write;
+        ``can_read_all_file_uploads`` only widens *reading* files uploaded by
+        *other* tokens (a device sees its own uploads regardless).
+
+        The acting token must carry ``canManageTokens`` (the API rejects the
+        create otherwise -- surfaced as an ``ACCESS_DENIED`` :class:`KeboolaApiError`
+        with the token masked). The returned dict is the raw API response; its
+        ``token`` field is a **one-time** secret reveal -- persist only ``id``
+        (for :meth:`delete_token` / :meth:`refresh_token`) and ``expires``.
+
+        Args:
+            description: Human-readable token description (per-device label).
+            bucket_permissions: ``{bucketId: "read" | "write"}`` grants.
+            component_access: Component IDs the token may run (often empty for a
+                capture device that only uploads Files + streams OTLP).
+            can_read_all_file_uploads: If True the token may read files uploaded
+                by other tokens (default False = only its own uploads).
+            expires_in: Lifetime in seconds; ``None`` = never expires.
+        """
+        data: dict[str, Any] = {"description": description}
+        if expires_in is not None:
+            data["expiresIn"] = str(expires_in)
+        if can_read_all_file_uploads:
+            # Storage API reads this form field as truthy; omit it (=> default
+            # false) rather than sending "0" so an unset scope stays minimal.
+            data["canReadAllFileUploads"] = "1"
+        for bucket_id, permission in (bucket_permissions or {}).items():
+            data[f"bucketPermissions[{bucket_id}]"] = permission
+        if component_access:
+            data["componentAccess[]"] = component_access
+        response = self._request("POST", "/v2/storage/tokens", data=data)
+        return response.json()
+
+    def delete_token(self, token_id: str) -> None:
+        """Revoke a Storage API token immediately (``DELETE /v2/storage/tokens/{id}``).
+
+        Returns 204 and the token stops authenticating at once. Only a
+        **non-master** token can be deleted (the API refuses to delete the master
+        token). Use this for active per-device revocation instead of waiting for
+        the token to expire.
+        """
+        self._request("DELETE", f"/v2/storage/tokens/{quote(str(token_id), safe='')}")
+
+    def refresh_token(self, token_id: str) -> dict[str, Any]:
+        """Rotate a Storage API token (``POST /v2/storage/tokens/{id}/refresh``).
+
+        Generates a **new** token value and returns the updated token dict; the
+        **old** token string becomes immediately invalid (rotation, not
+        additive), so every place using it must be updated. The token id is
+        stable across a refresh.
+        """
+        response = self._request(
+            "POST", f"/v2/storage/tokens/{quote(str(token_id), safe='')}/refresh"
+        )
+        return response.json()
+
+    # ------------------------------------------------------------------
+    # Data Streams (per-device OTLP sources) -- delegate to StreamClient
+    # ------------------------------------------------------------------
+
+    def _get_stream_client(self) -> StreamClient:
+        """Lazily build (and cache) a :class:`StreamClient` over this stack+token.
+
+        The Stream control plane lives on a sibling host (``stream.<region>``)
+        and authenticates with the same Storage token, so it is reachable from
+        the same ``(stack_url, token)`` this client already holds.
+        """
+        if self._stream_client is None:
+            self._stream_client = StreamClient(stack_url=self._stack_url, token=self._token)
+        return self._stream_client
+
+    @staticmethod
+    def _stream_source_detail(
+        source: dict[str, Any], branch_id: str, sink_bucket_id: str | None
+    ) -> dict[str, Any]:
+        """Normalise a raw Stream ``source`` object into the returned detail dict.
+
+        Flattens the OTLP block so the caller gets ``otlp_url`` (with the ingest
+        secret embedded, **unmasked** -- the lib layer hands it to the device
+        once and never persists it) without digging into ``source["otlp"]``. The
+        raw ``source`` is echoed under ``source`` so nothing is lost.
+        """
+        otlp = source.get("otlp") or {}
+        source_id = source.get("sourceId", "")
+        return {
+            "id": source_id,
+            "source_id": source_id,
+            "name": source.get("name", ""),
+            "type": source.get("type", ""),
+            "description": source.get("description", ""),
+            "branch_id": branch_id,
+            "otlp_url": otlp.get("url", ""),
+            "otlp_secret": otlp.get("secret", ""),
+            "base_endpoint": otlp.get("baseUrl", ""),
+            "sink_bucket_id": sink_bucket_id,
+            "source": source,
+        }
+
+    def create_stream_source(
+        self,
+        name: str,
+        *,
+        source_type: str = "otlp",
+        description: str = "",
+        branch_id: str = STREAM_DEFAULT_BRANCH,
+        provision_sinks: bool = True,
+    ) -> dict[str, Any]:
+        """Create a per-device OTLP (or HTTP) stream source and return its detail.
+
+        Async under the hood: the Stream API returns a 202 ``Task`` which is
+        polled to completion here (the caller sees one blocking call). For an
+        ``otlp`` source with ``provision_sinks`` (default) the logs/metrics/traces
+        sinks and the ``in.c-otlp-<sourceId>`` sink bucket are auto-created so
+        OTLP data actually lands in Storage -- and so a scoped device token can be
+        granted ``write`` on that bucket. Pass ``provision_sinks=False`` for a
+        bare source.
+
+        Per-device sources are the unit of isolated event-plane revocation:
+        delete one device's source (:meth:`delete_stream_source`) without
+        rotating a secret shared with other devices.
+
+        Returns a dict with the flattened endpoint: ``id`` / ``source_id``,
+        ``otlp_url`` (secret **unmasked**), ``otlp_secret``, ``sink_bucket_id``
+        (``None`` when no sinks were provisioned), and the raw ``source``.
+        Requires a Storage token privileged to manage Data Streams.
+        """
+        stream = self._get_stream_client()
+        task = stream.create_source(
+            branch_id, name=name, source_type=source_type, description=description or None
+        )
+        finished = stream.wait_for_task(task)
+        source_id = stream_task_source_id(finished) or name
+        sink_bucket_id: str | None = None
+        if provision_sinks and source_type == "otlp":
+            provision_otlp_sinks(stream, branch_id, source_id)
+            sink_bucket_id = f"{OTLP_BUCKET_PREFIX}{source_id}"
+        source = stream.get_source(branch_id, source_id)
+        return self._stream_source_detail(source, branch_id, sink_bucket_id)
+
+    @staticmethod
+    def _sink_bucket_from_sinks(sinks_raw: dict[str, Any]) -> str | None:
+        """Return the bucket of the source's first table sink, or None if it has none.
+
+        Derived from the ACTUAL sinks rather than assumed from the source type,
+        so a source created with ``provision_sinks=False`` (or outside kbagent)
+        truthfully reports ``None`` instead of a bucket that does not exist.
+        """
+        for sink in sinks_raw.get("sinks", []):
+            table_id = (sink.get("table") or {}).get("tableId", "")
+            if "." in table_id:
+                return table_id.rsplit(".", 1)[0]
+        return None
+
+    def get_stream_source(
+        self, source_id: str, *, branch_id: str = STREAM_DEFAULT_BRANCH
+    ) -> dict[str, Any]:
+        """Fetch one stream source's detail (endpoint + secret + sink bucket).
+
+        ``sink_bucket_id`` reflects the source's ACTUAL sinks (``None`` when it
+        has none -- e.g. created with ``provision_sinks=False`` or outside
+        kbagent), so a caller never scopes a device token to a bucket that does
+        not exist.
+        """
+        stream = self._get_stream_client()
+        source = stream.get_source(branch_id, source_id)
+        sinks = stream.list_sinks(branch_id, source.get("sourceId", source_id))
+        return self._stream_source_detail(source, branch_id, self._sink_bucket_from_sinks(sinks))
+
+    def list_stream_sources(
+        self, *, branch_id: str = STREAM_DEFAULT_BRANCH
+    ) -> list[dict[str, Any]]:
+        """List the project's stream sources (raw source objects; find-or-create by name)."""
+        raw = self._get_stream_client().list_sources(branch_id)
+        return list(raw.get("sources", []))
+
+    def delete_stream_source(
+        self, source_id: str, *, branch_id: str = STREAM_DEFAULT_BRANCH
+    ) -> None:
+        """Delete a stream source (per-device revocation) -- async task polled to completion."""
+        stream = self._get_stream_client()
+        task = stream.delete_source(branch_id, source_id)
+        stream.wait_for_task(task)
+
     def global_search(
         self,
         query: str,
@@ -2295,6 +2506,7 @@ class KeboolaClient(BaseHttpClient):
         provider = file_detail.get("provider", "")
         downloader = _CloudDownloader.create(file_detail)
 
+        _assert_safe_download_url(file_detail["url"])
         with httpx.Client(timeout=FILE_DOWNLOAD_TIMEOUT) as http:
             resp = http.get(file_detail["url"])
             resp.raise_for_status()
@@ -2393,6 +2605,7 @@ class KeboolaClient(BaseHttpClient):
         import gzip
         import shutil
 
+        _assert_safe_download_url(url)
         out_path = Path(output_path)
         out_path.parent.mkdir(parents=True, exist_ok=True)
         is_gzipped = url.rstrip("?").split("?")[0].endswith(".gz")
@@ -3101,6 +3314,70 @@ def _build_abs_upload_url(abs_params: dict[str, Any]) -> str:
 # ---------------------------------------------------------------------------
 
 
+def _assert_safe_download_url(url: str) -> None:
+    """Reject a download URL whose host resolves to a non-public address.
+
+    A malicious or compromised Storage API response can return a download URL
+    pointing at the cloud instance-metadata endpoint (169.254.169.254) or
+    localhost; because these fetches carry no Storage token and don't follow
+    redirects, the residual SSRF still writes internal/credential data into the
+    user's download file (GHSA-hjhx-mx7m-8xx2). We resolve the host and allow
+    ONLY globally-routable (public) addresses plus the explicit BYOC private
+    ranges below; everything else -- loopback, link-local (incl. the
+    169.254.169.254 metadata endpoint), CGNAT 100.64.0.0/10, reserved,
+    multicast, unspecified -- is refused.
+
+    RFC1918 + IPv6-ULA *private* ranges are deliberately ALLOWED: BYOC /
+    private-tenant Keboola deployments legitimately serve storage from private
+    endpoints, and the high-value SSRF target (instance metadata) is link-local,
+    not private. An allow-list (public OR explicit private) rather than a
+    block-list of `ipaddress` predicates avoids gaps like CGNAT, which none of
+    `is_loopback/is_link_local/is_reserved/is_multicast/is_unspecified` catch.
+    """
+    import ipaddress
+    import socket
+    from urllib.parse import urlparse
+
+    byoc_private = (
+        ipaddress.ip_network("10.0.0.0/8"),
+        ipaddress.ip_network("172.16.0.0/12"),
+        ipaddress.ip_network("192.168.0.0/16"),
+        ipaddress.ip_network("fc00::/7"),  # IPv6 unique-local
+    )
+
+    host = urlparse(url).hostname
+    if not host:
+        raise KeboolaApiError(
+            message=f"Refusing to download: URL has no host ({url!r}).",
+            status_code=0,
+            error_code=ErrorCode.INVALID_ARGUMENT,
+            retryable=False,
+        )
+    try:
+        resolved = {info[4][0] for info in socket.getaddrinfo(host, None)}
+    except socket.gaierror:
+        # DNS failure is surfaced by the real fetch; don't mask it here.
+        return
+    for addr in resolved:
+        try:
+            ip = ipaddress.ip_address(addr)
+        except ValueError:
+            continue
+        if ip.is_global or any(ip in net for net in byoc_private):
+            continue  # public host, or a BYOC private endpoint -- allowed
+        raise KeboolaApiError(
+            message=(
+                f"Refusing to download from {host} -> {addr}: non-public address "
+                f"(not a public host nor a BYOC private range). This indicates a "
+                f"malicious or compromised Storage API response (possible SSRF, "
+                f"e.g. the cloud instance-metadata endpoint)."
+            ),
+            status_code=0,
+            error_code=ErrorCode.INVALID_ARGUMENT,
+            retryable=False,
+        )
+
+
 class _IterBytesReader:
     """Adapt an httpx iter_bytes() iterator to a .read(n) file-like interface.
 
@@ -3299,6 +3576,7 @@ class _CloudDownloader:
         import gzip
         import shutil
 
+        _assert_safe_download_url(url)
         headers = self._request_headers(url)
         dest_path = Path(dest)
         with (

{keboola_cli-0.65.0 → keboola_cli-0.66.0}/src/keboola_agent_cli/commands/_data_app_git.py

@@ -341,70 +341,3 @@ def register_git_commands(app: typer.Typer) -> None:
                 )
 
         formatter.output(result, _human)
-
-    @app.command("git-bind-credential")
-    def data_app_git_bind_credential(
-        ctx: typer.Context,
-        project: str = typer.Option(..., "--project", help="Project alias"),
-        app_id: str = typer.Option(..., "--app-id", help="Data Science numeric app id"),
-        branch: str = typer.Option(
-            "main", "--branch-name", help="Managed-repo branch to deploy from (default main)."
-        ),
-        permissions: str = typer.Option(
-            "readOnly",
-            "--permissions",
-            help="Credential access level: readOnly (default) | readWrite.",
-        ),
-        dry_run: bool = typer.Option(
-            False,
-            "--dry-run",
-            help="Preview what would be wired (repo/branch/permissions) WITHOUT minting a credential or editing the config.",
-        ),
-    ) -> None:
-        """Make a MANAGED-repo app deployable by wiring a credential into its config.
-
-        A `--use-managed-git-repo` app owns an empty Keboola-hosted repo but its
-        Storage config has no git block. On stacks that do NOT inject managed-repo
-        credentials at deploy time, the runtime's `git clone` of the managed repo
-        fails ("could not read Username") and the deploy reverts to stopped. This
-        command mints a fresh `http_token` ON the app, encrypts it under the
-        project KMS, and writes `parameters.dataApp.git` (repository + placeholder
-        username + encrypted `#password` + branch) so the next `data-app deploy`
-        can clone. The token is encrypted in-place and never printed.
-
-        `--dry-run` validates the app + resolves the managed repo URL but mints
-        nothing and leaves the config untouched -- the http_token is one-time, so
-        a real run that you abort would orphan it.
-        """
-        formatter = get_formatter(ctx)
-        service = get_service(ctx, "data_app_service")
-        try:
-            result = service.bind_managed_credential(
-                project, app_id, branch=branch, permissions=permissions, dry_run=dry_run
-            )
-        except KeboolaApiError as exc:
-            formatter.error(
-                message=exc.message,
-                error_code=exc.error_code,
-                retryable=exc.retryable,
-                details=exc.details,
-            )
-            raise typer.Exit(code=map_error_to_exit_code(exc)) from None
-        except ConfigError as exc:
-            formatter.error(message=exc.message, error_code=ErrorCode.CONFIG_ERROR)
-            raise typer.Exit(code=5) from None
-
-        def _human(c: Console, d: dict) -> None:
-            if d.get("dry_run"):
-                c.print("[bold]DRY RUN -- no credential minted, config unchanged.[/bold]")
-                c.print(f"  [bold]Repository:[/bold] {d.get('repository', '')}")
-                c.print(f"  [bold]Branch:[/bold] {d.get('branch', '')}")
-                c.print(f"  [bold]Permissions:[/bold] {d.get('permissions', '')}")
-                return
-            c.print(f"[bold green]Success:[/bold green] {d['message']}")
-            c.print(f"  [bold]Repository:[/bold] {d.get('repository', '')}")
-            c.print(f"  [bold]Branch:[/bold] {d.get('branch', '')}")
-            c.print(f"  [bold]Permissions:[/bold] {d.get('permissions', '')}")
-            c.print(f"  [bold]Config version:[/bold] {d.get('config_version', '')}")
-
-        formatter.output(result, _human)