leverage 2.2.0rc2__tar.gz → 2.2.0rc3__tar.gz

{leverage-2.2.0rc2 → leverage-2.2.0rc3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: leverage
-Version: 2.2.0rc2
+Version: 2.2.0rc3
 Summary: Binbash Leverage Command-Line tool.
 Home-page: https://github.com/binbashar/leverage
 License: MIT
@@ -21,10 +21,10 @@ Classifier: Topic :: Software Development :: Build Tools
 Requires-Dist: boto3 (==1.33.2)
 Requires-Dist: click (==8.0.1)
 Requires-Dist: configupdater (==3.2)
-Requires-Dist: docker (==6.1.0)
-Requires-Dist: dockerpty (==0.4.1)
 Requires-Dist: docutils (==0.17.1)
 Requires-Dist: jinja2 (==3.0.1)
+Requires-Dist: prompt-toolkit (==3.0.51)
+Requires-Dist: python-dateutil (>=2.9.0.post0,<3.0.0)
 Requires-Dist: python-hcl2 (==7.3.1)
 Requires-Dist: questionary (==1.10.0)
 Requires-Dist: requests (==2.31)

{leverage-2.2.0rc2 → leverage-2.2.0rc3}/leverage/__init__.py

@@ -4,13 +4,7 @@
 
 # pylint: disable=wrong-import-position
 
-__version__ = "2.2.0rc2"
-__toolbox_version__ = "1.3.5-0.2.0"
-
-MINIMUM_VERSIONS = {
-    "TERRAFORM": "1.3.5",
-    "TOOLBOX": "0.2.4",
-}
+__version__ = "2.2.0rc3"
 
 import sys
 from shutil import which

leverage-2.2.0rc3/leverage/_backend_config.py

@@ -0,0 +1,172 @@
+"""Utilities for modifying Terraform backend configuration."""
+
+import re
+from pathlib import Path
+from typing import Union, Optional
+
+import hcl2
+import lark
+
+from leverage._utils import ExitError
+
+
+def set_backend_key(config_file_path: Union[str, Path], key: str) -> None:
+    """
+    Set or update the backend key in a Terraform config.tf file.
+
+    This function modifies the Terraform backend configuration to set the S3 state key.
+    It preserves all comments, formatting, and other HCL code in the file by using
+    string manipulation to surgically modify only the key attribute.
+
+    Args:
+        config_file_path: Path to the config.tf file
+        key: The backend key value to set (e.g., "apps-devstg/notifications/terraform.tfstate")
+
+    Raises:
+        ExitError: If the file cannot be found, cannot be parsed, or does not contain a
+        terraform block with an S3 backend
+    """
+    config_file_path = Path(config_file_path)
+
+    # Validate file exists
+    if not config_file_path.exists():
+        raise ExitError(1, f"Config file not found: {config_file_path}")
+
+    # Read the file content
+    content = config_file_path.read_text()
+
+    # Parse the config file to validate structure
+    try:
+        config_tf = hcl2.loads(content)
+    except Exception as e:
+        raise ExitError(1, f"Failed to parse config.tf: {e}")
+
+    # Validate that the file contains a terraform backend block with S3
+    if not (
+        "terraform" in config_tf
+        and config_tf["terraform"]
+        and isinstance(config_tf["terraform"], list)
+        and "backend" in config_tf["terraform"][0]
+        and config_tf["terraform"][0]["backend"]
+        and isinstance(config_tf["terraform"][0]["backend"], list)
+        and "s3" in config_tf["terraform"][0]["backend"][0]
+    ):
+        raise ExitError(
+            1,
+            f"Malformed config.tf: File must contain a terraform block with an S3 backend. "
+            f"Expected structure:\n"
+            f"terraform {{\n"
+            f'  backend "s3" {{\n'
+            f"    # configuration\n"
+            f"  }}\n"
+            f"}}",
+        )
+
+    # Check if key already exists
+    backend_config = config_tf["terraform"][0]["backend"][0]["s3"]
+    key_exists = "key" in backend_config
+
+    # Modify the file content
+    modified_content = _modify_backend_key(content, key, key_exists)
+
+    # Write back to file
+    config_file_path.write_text(modified_content)
+
+
+def _modify_backend_key(content: str, key: str, key_exists: bool) -> str:
+    """
+    Modify the backend key in the HCL content.
+
+    Args:
+        content: The original file content
+        key: The new key value
+        key_exists: Whether the key attribute already exists
+
+    Returns:
+        Modified content with the key set
+    """
+    # Pattern to find the backend "s3" block
+    # This matches: backend "s3" { ... }
+    backend_pattern = r'(backend\s+"s3"\s*\{)'
+
+    if key_exists:
+        # Update existing key
+        # Match: key = "anything" or key = "anything" with various whitespace/quotes
+        key_pattern = r'(\s*key\s*=\s*)"[^"]*"'
+        replacement = r'\1"' + key + '"'
+
+        modified = re.sub(key_pattern, replacement, content)
+
+        return modified
+    else:
+        # Add new key attribute
+        # Find the backend "s3" block and add the key after the opening brace
+        def add_key(match):
+            # Get the matched backend opening
+            backend_opening = match.group(1)
+
+            # Find the indentation by looking at the next line
+            remaining = content[match.end() :]
+            next_line_match = re.search(r"\n(\s*)", remaining)
+            if next_line_match:
+                indent = next_line_match.group(1)
+            else:
+                indent = "    "  # Default to 4 spaces
+
+            # Add the key attribute with proper indentation
+            return f'{backend_opening}\n{indent}key = "{key}"'
+
+        modified = re.sub(backend_pattern, add_key, content, count=1)
+
+        return modified
+
+
+def get_backend_key(config_file: Union[str, Path]) -> Optional[str]:
+    """
+    Get the current backend key from a Terraform config.tf file.
+
+    Args:
+        config_file: Path to the config.tf file
+
+    Returns:
+        The backend key if it exists, None otherwise
+
+    Example:
+        >>> get_backend_key("/path/to/config.tf")
+        'apps-devstg/layer/terraform.tfstate'
+    """
+    config_file = Path(config_file)
+
+    if not config_file.exists():
+        raise ExitError(1, f"Config file not found: {config_file}")
+
+    try:
+        config_content = config_file.read_text()
+        config_tf = hcl2.loads(config_content)
+
+        if (
+            "terraform" in config_tf
+            and config_tf["terraform"]
+            and isinstance(config_tf["terraform"], list)
+            and "backend" in config_tf["terraform"][0]
+            and config_tf["terraform"][0]["backend"]
+            and isinstance(config_tf["terraform"][0]["backend"], list)
+            and "s3" in config_tf["terraform"][0]["backend"][0]
+        ):
+            return config_tf["terraform"][0]["backend"][0]["s3"].get("key")
+        else:
+            raise ExitError(
+                1,
+                f"Malformed [bold]config.tf[/bold] file. Missing backend block.\n"
+                f"In some cases you may want to skip this check by using the --skip-validation flag, "
+                f"e.g. the first time you initialize a tf-backend layer.",
+            )
+
+    except lark.exceptions.UnexpectedInput as error:
+        raise ExitError(
+            1,
+            f"Possible invalid expression in [bold]config.tf[/bold] near line {error.line}, column {error.column}\n"
+            f"{error.get_context(config_content)}",
+        )
+    except Exception:
+        raise ExitError(1, f"Malformed [bold]config.tf[/bold] file. Unable to parse.")

{leverage-2.2.0rc2 → leverage-2.2.0rc3}/leverage/_internals.py

@@ -27,7 +27,9 @@ class State:
     def __init__(self):
         self._verbosity = None
         self.module = Module()
-        self.container = None
+        self.config = None
+        self.paths = None
+        self.runner = None
 
     @property
     def verbosity(self):
@@ -41,13 +43,25 @@ class State:
 pass_state = click.make_pass_decorator(State, ensure=True)
 
 
-def pass_container(command):
-    """Decorator to pass the current container to the command."""
+def pass_runner(command):
+    """Decorator to pass the current runner (Terraform/OpenTofu runner) to the command."""
 
     @wraps(command)
     def new_command(*args, **kwargs):
         ctx = click.get_current_context()
 
-        return command(ctx.obj.container, *args, **kwargs)
+        return command(ctx.obj.runner, *args, **kwargs)
+
+    return new_command
+
+
+def pass_paths(command):
+    """Decorator to pass the current project paths to the command."""
+
+    @wraps(command)
+    def new_command(*args, **kwargs):
+        ctx = click.get_current_context()
+
+        return command(ctx.obj.paths, *args, **kwargs)
 
     return new_command

{leverage-2.2.0rc2 → leverage-2.2.0rc3}/leverage/_utils.py

@@ -3,15 +3,13 @@
 """
 
 from pathlib import Path
-from subprocess import run
-from subprocess import PIPE
+from subprocess import PIPE, run
+from typing import List, Optional
 
 import hcl2
 import lark
-from click.exceptions import Exit
+from click.exceptions import ClickException
 from configupdater import ConfigUpdater
-from docker import DockerClient
-from docker.models.containers import Container
 
 from leverage import logger
 
@@ -64,56 +62,17 @@ def git(command):
     run(command, stdout=PIPE, stderr=PIPE, check=True)
 
 
-class CustomEntryPoint:
-    """
-    Set a custom entrypoint on the container while entering the context.
-    Once outside, return it to its original value.
-    """
-
-    def __init__(self, container, entrypoint):
-        self.container = container
-        self.old_entrypoint = container.entrypoint
-        self.new_entrypoint = entrypoint
-
-    def __enter__(self):
-        self.container.entrypoint = self.new_entrypoint
-
-    def __exit__(self, *args, **kwargs):
-        self.container.entrypoint = self.old_entrypoint
-
-
-class AwsCredsEntryPoint(CustomEntryPoint):
-    """
-    Fetching AWS credentials by setting the SSO/MFA entrypoints.
-    """
-
-    def __init__(self, container, override_entrypoint=None):
-        auth_method = container.auth_method()
-
-        new_entrypoint = f"{auth_method}{container.entrypoint if override_entrypoint is None else override_entrypoint}"
-        super(AwsCredsEntryPoint, self).__init__(container, entrypoint=new_entrypoint)
-
-    def __exit__(self, *args, **kwargs):
-        super(AwsCredsEntryPoint, self).__exit__(*args, **kwargs)
-        if self.container.mfa_enabled:
-            self.container.environment.update(
-                {
-                    "AWS_SHARED_CREDENTIALS_FILE": self.container.environment["AWS_SHARED_CREDENTIALS_FILE"].replace(
-                        ".aws", "tmp"
-                    ),
-                    "AWS_CONFIG_FILE": self.container.environment["AWS_CONFIG_FILE"].replace(".aws", "tmp"),
-                }
-            )
-
-
-class ExitError(Exit):
+class ExitError(ClickException):
     """
     Raise an Exit exception but also print an error description.
     """
 
     def __init__(self, exit_code: int, error_description: str):
-        logger.error(error_description)
-        super(ExitError, self).__init__(exit_code)
+        self.exit_code = exit_code
+        super(ExitError, self).__init__(message=error_description)
+
+    def show(self):
+        logger.error(self.message)
 
 
 def parse_tf_file(file: Path):
@@ -134,31 +93,12 @@ def parse_tf_file(file: Path):
         return parsed
 
 
-class ContainerSession:
-    """
-    Handle the start/stop cycle of a container.
-    Useful when you need to keep your container alive to share context between multiple commands.
-    """
-
-    def __init__(self, docker_client: DockerClient, container_data):
-        self.docker_client = docker_client
-        self.container_data = container_data
-
-    def __enter__(self) -> Container:
-        self.docker_client.api.start(self.container_data)
-        return self.docker_client.containers.get(self.container_data["Id"])
-
-    def __exit__(self, exc_type, exc_value, exc_tb):
-        self.docker_client.api.stop(self.container_data)
-        self.docker_client.api.remove_container(self.container_data)
-
-
-def key_finder(d: dict, target: str, avoid: str = None):
+def key_finder(d: dict, target: str, avoid: Optional[str] = None) -> List[str]:
     """
     Iterate over a dict of dicts and/or lists of dicts, looking for a key with value "target".
     Collect and return all the values that matches "target" as key.
     """
-    values = []
+    values: List[str] = []
 
     for key, value in d.items():
         if isinstance(value, dict):

leverage-2.2.0rc3/leverage/leverage.py

@@ -0,0 +1,43 @@
+"""
+    Binbash Leverage Command-line tool.
+"""
+
+import click
+
+from leverage import __version__, conf
+from leverage._internals import pass_state
+from leverage.path import NotARepositoryError, PathsHandler
+from leverage.modules import aws, credentials, run, project, tofu, terraform, tfautomv, kubectl
+
+
+@click.group(invoke_without_command=True)
+@click.option("-v", "--verbose", is_flag=True, help="Increase output verbosity.")
+@click.version_option(version=__version__)
+@pass_state
+@click.pass_context
+def leverage(context, state, verbose):
+    """Leverage Reference Architecture projects command-line tool."""
+    # --verbose | -v
+    state.verbosity = verbose
+    if context.invoked_subcommand is None:
+        # leverage called with no subcommand
+        click.echo(context.get_help())
+
+    try:
+        state.config = conf.load()
+    except NotARepositoryError:
+        return
+    state.paths = PathsHandler(state.config)
+
+
+# Add modules to leverage
+leverage.add_command(run)
+leverage.add_command(project)
+leverage.add_command(tofu)
+leverage.add_command(tofu, name="tf")
+leverage.add_command(terraform)
+leverage.add_command(credentials)
+leverage.add_command(aws)
+leverage.add_command(tfautomv)
+leverage.add_command(kubectl)
+leverage.add_command(kubectl, name="kc")

{leverage-2.2.0rc2 → leverage-2.2.0rc3}/leverage/modules/__init__.py

@@ -1,6 +1,7 @@
 from .run import run
 from .project import project
+from .aws import aws
 from .tf import tofu, terraform
+from .credentials import credentials
 from .tfautomv import tfautomv
 from .kubectl import kubectl
-from .shell import shell

{leverage-2.2.0rc2 → leverage-2.2.0rc3}/leverage/modules/auth.py

@@ -1,5 +1,7 @@
 import time
+import json
 from pathlib import Path
+from datetime import datetime
 from configparser import NoSectionError, NoOptionError
 
 import boto3
@@ -7,6 +9,7 @@ from botocore.exceptions import ClientError
 from configupdater import ConfigUpdater
 
 from leverage import logger
+from leverage.path import PathsHandler
 from leverage._utils import key_finder, ExitError, get_or_create_section, parse_tf_file
 
 
@@ -21,10 +24,14 @@ def get_layer_profile(raw_profile: str, config_updater: ConfigUpdater, tf_profil
         raise SkipProfile
 
     # if it is exactly that variable, we already know the layer profile is tf_profile
-    layer_profile = tf_profile if raw_profile == "${var.profile}" else None
+    layer_profile = tf_profile if raw_profile in ("${var.profile}", "each.value.profile") else None
 
     # replace variables with their corresponding values
-    raw = raw_profile.replace("${var.profile}", tf_profile).replace("${var.project}", project)
+    raw = (
+        raw_profile.replace("${var.profile}", tf_profile)
+        .replace("${var.project}", project)
+        .replace("each.value.profile", tf_profile)
+    )
 
     # the project and the role are at the beginning and end of the string
     _, *account_name, _ = raw.split("-")
@@ -57,15 +64,15 @@ def update_config_section(updater: ConfigUpdater, layer_profile: str, data: dict
     updater.update_file()
 
 
-def get_profiles(cli):
+def get_profiles(paths: PathsHandler):
     """
     Get the AWS profiles present on the layer by parsing some tf files.
     """
     raw_profiles = set()
     # these are files from the layer we are currently on
-    for name in ("config.tf", "locals.tf"):
+    for name in ("config.tf", "locals.tf", "runtime.tf"):
         try:
-            tf_config = parse_tf_file(Path(cli.paths.cwd / name))
+            tf_config = parse_tf_file(Path(paths.cwd / name))
         except FileNotFoundError:
             continue
 
@@ -74,25 +81,65 @@ def get_profiles(cli):
         raw_profiles.update(set(key_finder(tf_config, "profile", "lookup")))
 
     # the profile value from <layer>/config/backend.tfvars
-    backend_config = parse_tf_file(cli.paths.local_backend_tfvars)
+    backend_config = parse_tf_file(paths.backend_tfvars)
     tf_profile = backend_config["profile"]
 
     return tf_profile, raw_profiles
 
 
-def refresh_layer_credentials(cli):
-    tf_profile, raw_profiles = get_profiles(cli)
+def get_sso_access_token(sso_token_file: Path) -> str:
+    """
+    Get the SSO access token from the token file.
+    """
+    return json.loads(sso_token_file.read_text())["accessToken"]
+
+
+def check_sso_token(paths: PathsHandler):
+    """Check for the existence and validity of the SSO token to be used to get credentials."""
+
+    # Adding `token` file name to this function in order to
+    # meet the requirement regarding to have just one
+    # token file in the sso/cache
+    sso_role = paths.account_conf.get("sso_role")
+    token_file = paths.sso_cache / sso_role
+
+    token_files = list(paths.sso_cache.glob("*"))
+    if not token_files:
+        raise ExitError(1, "No AWS SSO token found. Please log in or configure SSO.")
+
+    if token_file not in token_files and paths.sso_token_file not in token_files:
+        raise ExitError(
+            1,
+            "No valid AWS SSO token found for current account.\n"
+            "Please log out and reconfigure SSO before proceeding.",
+        )
+
+    token = json.loads(paths.sso_token_file.read_text())
+    expiry = datetime.strptime(token.get("expiresAt"), "%Y-%m-%dT%H:%M:%SZ")
+    renewal = datetime.now()
+
+    if expiry < renewal:
+        raise ExitError(
+            1,
+            "AWS SSO token has expired, please log back in by running [bold]leverage aws sso login[/bold]"
+            " to refresh your credentials before re-running the last command.",
+        )
+
+
+def refresh_layer_credentials(paths: PathsHandler):
+    tf_profile, raw_profiles = get_profiles(paths)
     config_updater = ConfigUpdater()
-    config_updater.read(cli.paths.host_aws_profiles_file)
+    config_updater.read(paths.aws_config_file)
 
-    client = boto3.client("sso", region_name=cli.sso_region_from_main_profile)
+    region = config_updater.get(f"profile {paths.project}-sso", "sso_region").value
+    client = boto3.client("sso", region_name=region)
     for raw in raw_profiles:
         try:
             account_id, account_name, sso_role, layer_profile = get_layer_profile(
                 raw,
                 config_updater,
                 tf_profile,
-                cli.project,
+                paths.project,
             )
         except SkipProfile:
             continue
@@ -119,7 +166,7 @@ def refresh_layer_credentials(cli):
             credentials = client.get_role_credentials(
                 roleName=sso_role,
                 accountId=account_id,
-                accessToken=cli.get_sso_access_token(),
+                accessToken=get_sso_access_token(paths.sso_token_file),
             )["roleCredentials"]
         except ClientError as error:
             if error.response["Error"]["Code"] in ("AccessDeniedException", "ForbiddenException"):
@@ -129,6 +176,8 @@ def refresh_layer_credentials(cli):
                     " in this account.\nPlease check with your administrator or try"
                     " running [bold]leverage aws configure sso[/bold].",
                 )
+            else:
+                raise ExitError(50, f"Error retrieving role credentials: {error}")
 
         # update expiration on aws/<project>/config
         logger.info(f"Writing {layer_profile} profile")
@@ -140,10 +189,9 @@ def refresh_layer_credentials(cli):
             },
         )
         # write credentials on aws/<project>/credentials (create the file if it doesn't exist first)
-        creds_path = Path(cli.paths.host_aws_credentials_file)
-        creds_path.touch(exist_ok=True)
+        paths.aws_credentials_file.touch(exist_ok=True)
         credentials_updater = ConfigUpdater()
-        credentials_updater.read(cli.paths.host_aws_credentials_file)
+        credentials_updater.read(paths.aws_credentials_file)
 
         update_config_section(
             credentials_updater,