lager-cli 0.32.3__tar.gz → 0.32.4__tar.gz

{lager_cli-0.32.3/lager_cli.egg-info → lager_cli-0.32.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.2
 Name: lager-cli
-Version: 0.32.3
+Version: 0.32.4
 Summary: Lager CLI - Box and Docker connectivity
 Home-page: https://github.com/lagerdata/lager
 Author: Lager Data

{lager_cli-0.32.3 → lager_cli-0.32.4}/__init__.py

@@ -7,4 +7,4 @@ Lager CLI
 A Command Line Interface for Lager Data
 """
 
-__version__ = '0.32.3'
+__version__ = '0.32.4'

{lager_cli-0.32.3 → lager_cli-0.32.4}/commands/utility/uninstall.py

@@ -603,7 +603,7 @@ def uninstall(ctx, box, ip, user, keep_config, keep_docker_images, remove_all, y
     click.echo("  - Docker containers (lager, pigpio)")
     click.echo("  - Docker network (lagernet)")
     if not keep_docker_images:
-        click.echo("  - Docker images (ALL unused images on the box, not only lager's)")
+        click.echo("  - Docker images (the lager image and dangling layers only)")
     click.echo("  - ~/box directory")
     if not keep_config:
         click.echo("  - /etc/lager directory (saved nets)")
@@ -707,10 +707,15 @@ def uninstall(ctx, box, ip, user, keep_config, keep_docker_images, remove_all, y
         run_ssh("docker network rm lagernet 2>/dev/null", "Removing lagernet network", allow_fail=True)
         click.echo()
 
-        # Remove Docker images (unless --keep-docker-images)
+        # Remove Docker images (unless --keep-docker-images). Scoped to the
+        # lager image plus dangling layers: 'prune -af' would also delete
+        # images belonging to any OTHER stopped container on the box (a
+        # management agent, a user's own services) — infrastructure this
+        # command cannot restore.
         click.secho("[Step 2/5] Cleaning Docker...", fg='cyan')
         if not keep_docker_images:
-            run_ssh("docker image prune -af 2>/dev/null", "Removing Docker images", allow_fail=True)
+            run_ssh("docker rmi -f lager 2>/dev/null", "Removing lager image", allow_fail=True)
+            run_ssh("docker image prune -f 2>/dev/null", "Removing dangling images", allow_fail=True)
             run_ssh("docker builder prune -af 2>/dev/null", "Clearing Docker build cache", allow_fail=True)
         else:
             click.echo("  Skipping Docker image removal (--keep-docker-images)")

{lager_cli-0.32.3 → lager_cli-0.32.4}/deployment/scripts/setup_and_deploy_box.sh

@@ -1339,33 +1339,37 @@ print_info "Ensuring Docker service is enabled (for auto-start on boot)..."
 ssh $SSH_OPTS "${BOX_USER}@${BOX_IP}" "sudo systemctl enable docker >/dev/null 2>&1 || true"
 print_success "Docker service enabled"
 
-print_info "Stopping and removing all existing containers..."
-# Update restart policy first to prevent auto-restart, then force remove all containers
+print_info "Stopping and removing lager containers..."
+# Scoped to the containers this deployment owns (lager, pigpio, and the
+# legacy controller). A box may run third-party containers alongside lager
+# — a management agent, a user's own services — and removing containers we
+# did not create takes down infrastructure this script cannot restore.
+# Update restart policy first to prevent auto-restart, then force remove.
 ssh $SSH_OPTS "${BOX_USER}@${BOX_IP}" "
-    # Disable auto-restart on all containers first
-    docker update --restart=no \$(docker ps -aq) 2>/dev/null || true
-    # Stop all running containers
-    docker stop \$(docker ps -q) 2>/dev/null || true
-    # Remove all containers (running and stopped)
-    docker rm -f \$(docker ps -aq) 2>/dev/null || true
-    # Prune any leftover containers
-    docker container prune -f 2>/dev/null || true
+    for c in lager pigpio controller; do
+        docker update --restart=no \$c 2>/dev/null || true
+        docker stop \$c 2>/dev/null || true
+        docker rm -f \$c 2>/dev/null || true
+    done
     # Wait a moment for Docker to clean up
     sleep 2
 " 2>/dev/null || true
-print_success "All containers cleaned up"
+print_success "Lager containers cleaned up"
 
-print_info "Cleaning up Docker images and build cache to free disk space..."
+print_info "Cleaning up Docker build cache and dangling images..."
 echo ""
+# Dangling-only (no -a): 'prune -af' would also delete images belonging to
+# third-party containers stopped at this moment, which cannot be re-pulled
+# by this script.
 ssh $SSH_OPTS "${BOX_USER}@${BOX_IP}" "
-    echo 'Removing unused Docker images...'
-    docker image prune -af 2>/dev/null || true
+    echo 'Removing dangling Docker images...'
+    docker image prune -f 2>/dev/null || true
     echo 'Removing Docker build cache...'
     docker builder prune -af 2>/dev/null || true
     echo 'Cleanup complete'
 " 2>/dev/null || true
 echo ""
-print_success "Docker images and build cache cleaned up"
+print_success "Docker build cache and dangling images cleaned up"
 
 print_info "Checking available disk space..."
 ssh $SSH_OPTS "${BOX_USER}@${BOX_IP}" "df -h / | tail -n 1 | awk '{print \"Available: \" \$4 \" (\" \$5 \" used)\"}'" 2>/dev/null || true

{lager_cli-0.32.3 → lager_cli-0.32.4}/gateway_auth.py

@@ -99,6 +99,27 @@ def _token_expires_at(access_token):
         return 0.0
 
 
+def _refresh_margin(access_token):
+    """Refresh-ahead margin, capped at a quarter of the token's lifetime.
+
+    A fixed margin at least as large as the token lifetime would classify
+    every freshly issued token as already stale, turning each request into
+    a refresh round-trip — a refresh storm against servers issuing
+    short-lived tokens, with each refresh rotating the refresh-token
+    family and multiplying the chances of losing the session.
+    """
+    try:
+        payload_b64 = access_token.split('.')[1]
+        payload_b64 += '=' * (-len(payload_b64) % 4)
+        payload = json.loads(base64.urlsafe_b64decode(payload_b64))
+        lifetime = float(payload['exp']) - float(payload['iat'])
+    except (IndexError, KeyError, ValueError, TypeError):
+        return EXPIRY_MARGIN_SECONDS
+    if lifetime <= 0:
+        return EXPIRY_MARGIN_SECONDS
+    return min(EXPIRY_MARGIN_SECONDS, max(lifetime / 4.0, 1.0))
+
+
 def save_login(url, access_token, cookies):
     """Store a session: the bearer token plus whatever cookies the auth
     server set at login (typically an httpOnly refresh token)."""
@@ -121,20 +142,35 @@ def clear_login(url=None):
 
 
 def _refresh_access_token(url, entry):
-    """Ask the auth server for a fresh access token, or return None."""
+    """Ask the auth server for a fresh access token, or return None.
+
+    Retries once, but ONLY when the request never reached the server
+    (connection error): the server rotates the refresh token on every
+    successful refresh, so replaying the request after an ambiguous
+    failure (e.g. a read timeout) could trip the server's replay
+    detection and burn the whole session.
+    """
     cookies = entry.get('cookies') or {}
     if not cookies:
         return None
-    try:
-        resp = requests.post(
-            f'{url}/api/auth/refresh',
-            cookies=cookies,
-            timeout=AUTH_SERVER_TIMEOUT,
-        )
-        if resp.status_code != 200:
+    resp = None
+    for _ in range(2):
+        try:
+            resp = requests.post(
+                f'{url}/api/auth/refresh',
+                cookies=cookies,
+                timeout=AUTH_SERVER_TIMEOUT,
+            )
+            break
+        except requests.ConnectionError:
+            continue
+        except requests.RequestException:
             return None
+    if resp is None or resp.status_code != 200:
+        return None
+    try:
         access_token = resp.json().get('accessToken')
-    except (requests.RequestException, ValueError):
+    except ValueError:
         return None
     if not access_token:
         return None
@@ -145,14 +181,26 @@ def _refresh_access_token(url, entry):
 
 
 def access_token_for(url):
-    """Stored access token for an auth server, refreshed if near expiry."""
+    """Stored access token for an auth server, refreshed if near expiry.
+
+    A failed refresh is not immediately fatal: if the stored token has not
+    actually expired, return it anyway and let the gateway judge it — a
+    transient auth-server error should not fail a command whose token is
+    still valid.
+    """
     entry = _load_store().get('authServers', {}).get(url)
     if not entry:
         return None
     access_token = entry.get('accessToken')
-    if access_token and _token_expires_at(access_token) > time.time() + EXPIRY_MARGIN_SECONDS:
+    now = time.time()
+    if access_token and _token_expires_at(access_token) > now + _refresh_margin(access_token):
+        return access_token
+    refreshed = _refresh_access_token(url, entry)
+    if refreshed:
+        return refreshed
+    if access_token and _token_expires_at(access_token) > now:
         return access_token
-    return _refresh_access_token(url, entry)
+    return None
 
 
 def auth_headers_for_box(box_ip):

{lager_cli-0.32.3 → lager_cli-0.32.4/lager_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.2
 Name: lager-cli
-Version: 0.32.3
+Version: 0.32.4
 Summary: Lager CLI - Box and Docker connectivity
 Home-page: https://github.com/lagerdata/lager
 Author: Lager Data