lnp-devopscli 1.0.0__py3-none-any.whl

dc_cli/__init__.py

@@ -0,0 +1,3 @@
+"""DevOps CLI - LNP Consulting TI."""
+
+__version__ = "1.0.0"

dc_cli/groups/bw.py

@@ -0,0 +1,430 @@
+"""Grupo: dc bw - Bitwarden Secrets Manager."""
+
+from __future__ import annotations
+
+import json
+import os
+import platform
+import shutil
+import subprocess
+import sys
+import tempfile
+import zipfile
+from pathlib import Path
+from urllib.request import urlopen
+
+import click
+
+from ..utils.config import (
+    get_global_config_path,
+    get_section,
+    get_workspace_root,
+    load_dotenv,
+    parse_env_line,
+)
+
+BWS_INSTALL_DIR = Path.home() / ".local" / "bin"
+BWS_PREFERRED_VERSION = (
+    "1.0.0"  # v2.0.0 tem incompatibilidade de token com alguns planos
+)
+
+
+def _detect_bws_asset_name(version: str) -> str | None:
+    """Detecta o nome do asset correto para a plataforma atual."""
+    system = platform.system().lower()
+    machine = platform.machine().lower()
+
+    if machine in ("x86_64", "amd64"):
+        arch = "x86_64"
+    elif machine in ("aarch64", "arm64"):
+        arch = "aarch64"
+    else:
+        return None
+
+    if system == "linux":
+        target = f"{arch}-unknown-linux-gnu"
+    elif system == "darwin":
+        target = f"{arch}-apple-darwin"
+    else:
+        return None
+
+    return f"bws-{target}-{version}.zip"
+
+
+def _install_bws() -> bool:
+    """Baixa e instala o bws CLI automaticamente."""
+    click.echo("[>] Instalando bws CLI...")
+
+    version = BWS_PREFERRED_VERSION
+    asset_name = _detect_bws_asset_name(version)
+    if not asset_name:
+        click.echo(
+            f"[ERRO] Plataforma nao suportada: {platform.system()} {platform.machine()}",
+            err=True,
+        )
+        return False
+
+    download_url = (
+        f"https://github.com/bitwarden/sdk-sm/releases/download/"
+        f"bws-v{version}/{asset_name}"
+    )
+
+    click.echo(f"[>] Baixando bws v{version} ({asset_name})...")
+
+    try:
+        with tempfile.TemporaryDirectory() as tmpdir:
+            zip_path = Path(tmpdir) / asset_name
+            with urlopen(download_url) as resp:
+                zip_path.write_bytes(resp.read())
+
+            with zipfile.ZipFile(zip_path) as zf:
+                zf.extractall(tmpdir)
+
+            bws_bin = Path(tmpdir) / "bws"
+            if not bws_bin.exists():
+                click.echo("[ERRO] Binario 'bws' nao encontrado no zip.", err=True)
+                return False
+
+            BWS_INSTALL_DIR.mkdir(parents=True, exist_ok=True)
+            dest = BWS_INSTALL_DIR / "bws"
+            shutil.copy2(bws_bin, dest)
+            dest.chmod(0o755)
+
+    except Exception as e:
+        click.echo(f"[ERRO] Falha na instalacao: {e}", err=True)
+        return False
+
+    click.echo(f"[OK] bws v{version} instalado em {dest}")
+    return True
+
+
+def _check_bws() -> None:
+    """Verifica se bws CLI esta instalado (instala se necessario) e token configurado."""
+    load_dotenv()
+
+    if not shutil.which("bws"):
+        click.echo("[!] bws CLI nao encontrado.")
+        if not _install_bws():
+            sys.exit(1)
+        if not shutil.which("bws"):
+            click.echo(
+                f"[!] bws instalado em {BWS_INSTALL_DIR}/bws mas nao esta no PATH.\n"
+                f'    Adicione ao PATH: export PATH="{BWS_INSTALL_DIR}:$PATH"',
+                err=True,
+            )
+            sys.exit(1)
+
+    if os.environ.get("BW_ACCESS_TOKEN") and not os.environ.get("BWS_ACCESS_TOKEN"):
+        os.environ["BWS_ACCESS_TOKEN"] = os.environ.get("BW_ACCESS_TOKEN", "")
+
+    if not os.environ.get("BWS_ACCESS_TOKEN"):
+        click.echo(
+            "[ERRO] BW_ACCESS_TOKEN nao definido.\n"
+            "  Exporte a variavel ou adicione no .env.",
+            err=True,
+        )
+        sys.exit(1)
+
+
+def _resolve_env_path(env_path: str) -> Path:
+    """Resolve env_path: relativo a raiz do projeto ou absoluto."""
+    path = Path(env_path).expanduser()
+    if not path.is_absolute():
+        path = get_workspace_root() / path
+    return path
+
+
+def _bws_run(args: list[str]) -> subprocess.CompletedProcess:
+    """Executa comando bws e retorna resultado."""
+    return subprocess.run(
+        ["bws"] + args,
+        capture_output=True,
+        text=True,
+    )
+
+
+def _find_existing_project(name: str) -> str | None:
+    """Busca projeto existente no Bitwarden pelo nome. Retorna ID ou None."""
+    result = _bws_run(["project", "list", "--output", "json"])
+    if result.returncode != 0:
+        return None
+    try:
+        for proj in json.loads(result.stdout):
+            if proj["name"] == name:
+                return proj["id"]
+    except (json.JSONDecodeError, KeyError):
+        pass
+    return None
+
+
+def _save_project_id(project_name: str, project_id: str) -> None:
+    """Salva project_id no config.yaml para o projeto especificado."""
+    import re
+
+    config_path = get_global_config_path()
+    if not config_path.exists():
+        root = get_workspace_root()
+        config_path = root / "config.yaml"
+    content = config_path.read_text()
+
+    pattern = (
+        r"(- name: " + re.escape(project_name) + r"\s+"
+        r"project_id: ).*"
+    )
+    replacement = rf'\g<1>"{project_id}"'
+    new_content = re.sub(pattern, replacement, content)
+
+    if new_content == content:
+        click.echo(
+            f"[!] Nao foi possivel salvar project_id no config.yaml automaticamente.",
+            err=True,
+        )
+        click.echo(f'[i] Adicione manualmente: project_id: "{project_id}"')
+        return
+
+    config_path.write_text(new_content)
+
+
+def _init_project(project: dict) -> bool:
+    """Cria projeto no Bitwarden (ou usa existente) e faz upload do .env local."""
+    name = project["name"]
+    env_dir = _resolve_env_path(project["env_path"])
+    env_file = env_dir / ".env"
+
+    click.echo(f"[>] Buscando projeto '{name}' no Bitwarden...")
+    project_id = _find_existing_project(name)
+
+    if project_id:
+        click.echo(f"[OK] Projeto encontrado (id: {project_id})")
+    else:
+        click.echo(f"[>] Criando projeto '{name}'...")
+        result = _bws_run(["project", "create", name])
+        if result.returncode != 0:
+            click.echo(
+                f"[ERRO] Falha ao criar projeto: {result.stderr.strip()}", err=True
+            )
+            return False
+
+        try:
+            project_data = json.loads(result.stdout)
+            project_id = project_data["id"]
+        except (json.JSONDecodeError, KeyError):
+            click.echo(f"[ERRO] Resposta inesperada do bws: {result.stdout}", err=True)
+            return False
+        click.echo(f"[OK] Projeto criado (id: {project_id})")
+
+    _save_project_id(name, project_id)
+
+    if not env_file.exists():
+        click.echo(f"[!] Arquivo {env_file} nao encontrado, nenhum secret enviado.")
+        return True
+
+    secrets_count = 0
+    with open(env_file) as f:
+        for line in f:
+            parsed = parse_env_line(line)
+            if not parsed:
+                continue
+            key, value = parsed
+
+            result = _bws_run(["secret", "create", key, value, project_id])
+            if result.returncode != 0:
+                click.echo(
+                    f"[ERRO] Falha ao criar secret '{key}': {result.stderr.strip()}",
+                    err=True,
+                )
+            else:
+                secrets_count += 1
+
+    click.echo(f"[OK] {secrets_count} secrets enviados para '{name}'")
+    return True
+
+
+def _sync_project(project: dict) -> bool:
+    """Baixa secrets do Bitwarden e salva no .env."""
+    name = project["name"]
+    project_id = project["project_id"]
+    env_dir = _resolve_env_path(project["env_path"])
+    env_file = env_dir / ".env"
+
+    click.echo(f"[>] Sincronizando '{name}'...")
+
+    result = _bws_run(["secret", "list", project_id, "--output", "env"])
+    if result.returncode != 0:
+        stderr = result.stderr.strip()
+        if "404" in stderr or "Resource not found" in stderr:
+            click.echo(
+                f"[WARN] project_id invalido para '{name}'. Recriando projeto..."
+            )
+            project["project_id"] = ""
+            return _init_project(project)
+        click.echo(f"[ERRO] Falha ao listar secrets: {stderr}", err=True)
+        return False
+
+    raw_output = result.stdout
+    if not raw_output.strip():
+        click.echo(f"[!] Nenhum secret encontrado para '{name}'")
+        return True
+
+    lines = []
+    for line in raw_output.splitlines():
+        parsed = parse_env_line(line)
+        if parsed:
+            lines.append(f"{parsed[0]}={parsed[1]}")
+        else:
+            lines.append(line)
+
+    env_dir.mkdir(parents=True, exist_ok=True)
+    with open(env_file, "w") as f:
+        f.write("\n".join(lines) + "\n")
+
+    click.echo(f"[OK] {name} -> {env_file}")
+    return True
+
+
+def _push_project(project: dict) -> bool:
+    """Faz upload do .env local para o Bitwarden (cria ou atualiza secrets)."""
+    name = project["name"]
+    project_id = project["project_id"]
+    env_dir = _resolve_env_path(project["env_path"])
+    env_file = env_dir / ".env"
+
+    if not project_id:
+        click.echo(f"[SKIP] '{name}' sem project_id (use sync para inicializar)")
+        return False
+
+    if not env_file.exists():
+        click.echo(f"[ERRO] Arquivo {env_file} nao encontrado.", err=True)
+        return False
+
+    click.echo(f"[>] Enviando secrets de '{name}'...")
+
+    result = _bws_run(["secret", "list", project_id, "--output", "json"])
+    existing = {}
+    if result.returncode == 0 and result.stdout.strip():
+        try:
+            for secret in json.loads(result.stdout):
+                existing[secret["key"]] = secret["id"]
+        except (json.JSONDecodeError, KeyError):
+            pass
+
+    updated = 0
+    created = 0
+    with open(env_file) as f:
+        for line in f:
+            parsed = parse_env_line(line)
+            if not parsed:
+                continue
+            key, value = parsed
+
+            if key in existing:
+                r = _bws_run(["secret", "edit", existing[key], "--value", value])
+                if r.returncode == 0:
+                    updated += 1
+                else:
+                    click.echo(
+                        f"[ERRO] Falha ao atualizar '{key}': {r.stderr.strip()}",
+                        err=True,
+                    )
+            else:
+                r = _bws_run(["secret", "create", key, value, project_id])
+                if r.returncode == 0:
+                    created += 1
+                else:
+                    click.echo(
+                        f"[ERRO] Falha ao criar '{key}': {r.stderr.strip()}", err=True
+                    )
+
+    click.echo(f"[OK] '{name}': {created} criados, {updated} atualizados")
+    return True
+
+
+def _filter_projects(projects: list[dict], name: str | None) -> list[dict]:
+    """Filtra projetos por nome, se especificado."""
+    if not name:
+        return projects
+    matched = [p for p in projects if p["name"] == name]
+    if not matched:
+        click.echo(f"[ERRO] Projeto '{name}' nao encontrado no config.yaml.", err=True)
+        click.echo(
+            f"[i] Projetos disponiveis: {', '.join(p['name'] for p in projects)}"
+        )
+        sys.exit(1)
+    return matched
+
+
+@click.group(name="bw")
+def bw_group():
+    """Bitwarden Secrets Manager — sincroniza .env entre projetos."""
+
+
+@bw_group.command()
+@click.argument("project", required=False, default=None)
+def sync(project):
+    """Sincroniza .env do Bitwarden (cria projeto se nao existir).
+
+    Sem argumento sincroniza todos. Com argumento, apenas o projeto especificado.
+
+    \b
+    Uso:
+      dc bw sync              # todos os projetos
+      dc bw sync meu-projeto  # apenas um
+    """
+    _check_bws()
+    config = get_section("bw")
+    projects = _filter_projects(config["projects"], project)
+
+    ok = 0
+    fail = 0
+    for proj in projects:
+        if not proj.get("project_id"):
+            success = _init_project(proj)
+        else:
+            success = _sync_project(proj)
+        if success:
+            ok += 1
+        else:
+            fail += 1
+
+    click.echo(f"\n[i] Resultado: {ok} ok, {fail} falhas")
+    sys.exit(1 if fail else 0)
+
+
+@bw_group.command(name="push")
+@click.argument("project", required=False, default=None)
+def push(project):
+    """Envia .env local para o Bitwarden (cria ou atualiza secrets).
+
+    \b
+    Uso:
+      dc bw push              # todos os projetos
+      dc bw push meu-projeto  # apenas um
+    """
+    _check_bws()
+    config = get_section("bw")
+    projects = _filter_projects(config["projects"], project)
+
+    ok = 0
+    fail = 0
+    for proj in projects:
+        if _push_project(proj):
+            ok += 1
+        else:
+            fail += 1
+
+    click.echo(f"\n[i] Resultado: {ok} ok, {fail} falhas")
+    sys.exit(1 if fail else 0)
+
+
+@bw_group.command(name="list")
+def list_projects():
+    """Lista projetos configurados e status."""
+    config = get_section("bw")
+
+    click.echo(f"{'Nome':<25} {'ID':<40} {'Path'}")
+    click.echo("-" * 90)
+    for proj in config["projects"]:
+        name = proj["name"]
+        pid = proj.get("project_id") or "(nao inicializado)"
+        env_path = str(_resolve_env_path(proj["env_path"]) / ".env")
+        click.echo(f"{name:<25} {pid:<40} {env_path}")