localghost 4.2.0__tar.gz → 4.2.1__tar.gz

{localghost-4.2.0 → localghost-4.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: localghost
-Version: 4.2.0
+Version: 4.2.1
 Summary: Localghost serves local applications at friendly .localhost URLs
 Keywords: localghost,localhost,docker,compose,traefik,development,proxy
 Author: SmileyChris

{localghost-4.2.0 → localghost-4.2.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "localghost"
-version = "4.2.0"
+version = "4.2.1"
 description = "Localghost serves local applications at friendly .localhost URLs"
 readme = "README.md"
 requires-python = ">=3.11"

{localghost-4.2.0 → localghost-4.2.1}/src/localghost/cli.py

@@ -31,6 +31,8 @@ from .config import (
     write_run_config,
 )
 from .feedback import (
+    LIME,
+    MINT,
     action,
     choices,
     compose_dry_run,
@@ -41,6 +43,7 @@ from .feedback import (
     routes,
     run_plan,
     sign_off,
+    styled,
     success,
     title,
     warning,
@@ -90,11 +93,14 @@ from .tailscale import (
     API as TailscaleAPI,
 )
 from .tailscale import (
+    DNS_CONSOLE_URL,
+    MACHINES_CONSOLE_URL,
     OAUTH_CONSOLE_URL,
     POLICY_CONSOLE_URL,
     TailnetHub,
     TailscaleError,
     TailscaleState,
+    tag_in_use,
     tailnet_hubs,
 )
 from .tailscale import (
@@ -1252,7 +1258,7 @@ def _refuse_active_mapping(
             f"split DNS for .{suffix} already points at "
             f"{', '.join(active)} — another machine may be hosting this "
             "suffix. Choose a different --suffix, or pass --takeover to "
-            "replace the mapping."
+            f"replace the mapping. Split DNS is listed at {DNS_CONSOLE_URL}."
         )
 
 
@@ -1310,31 +1316,41 @@ def _resolve_tailscale_credential(
             info("Using the OAuth credential stored in the system keyring.")
             return stored.client_id, stored.client_secret
         if tag is not None:
-            details(
-                [
+            client = "Add OAuth credential"
+            if tag_in_use(tag):
+                # A device already carries the tag, so only the client is left.
+                success(f"The {tag} device tag is already allowed on the tailnet.")
+                steps = [(client, OAUTH_CONSOLE_URL)]
+                indent = ""
+            else:
+                steps = [
                     ("1. Allow the device tag", POLICY_CONSOLE_URL),
                     (
                         "   Add to the policy file",
                         f'"tagOwners": {{"{tag}": ["autogroup:admin"]}}',
                     ),
-                    ("2. Create an OAuth client", OAUTH_CONSOLE_URL),
-                    (
-                        "   Scopes",
-                        f"auth_keys (with {tag} allowed) and dns:write",
-                    ),
-                ],
-                title=(
-                    "Tailscale admin-console setup (already done? enter that "
-                    "client's id and secret)"
-                ),
+                    (f"2. {client}", OAUTH_CONSOLE_URL),
+                ]
+                indent = "   "
+            details(steps)
+            styled(
+                [
+                    (f"{indent}with scopes ", "default"),
+                    ("DNS: Write", MINT),
+                    (", ", "default"),
+                    ("Auth Keys: Write", MINT),
+                    (" (", "default"),
+                    (tag, MINT),
+                    (")", "default"),
+                ]
             )
         else:
             details(
-                [("OAuth client with dns:write", OAUTH_CONSOLE_URL)],
+                [("OAuth credential with DNS: Write", OAUTH_CONSOLE_URL)],
                 title="No OAuth credential is stored in the system keyring",
             )
     if not client_id:
-        client_id = click.prompt("Client id")
+        client_id = click.prompt("Client ID")
     if not client_secret:
         client_secret = click.prompt("Client secret", hide_input=True)
     return client_id, client_secret
@@ -1399,14 +1415,18 @@ def tailscale_unshare(
         "`localghost trust remove` on each to revoke."
     )
     info(
-        f"Remove the offline tagged localghost-{state.node_label} device in the "
-        "Tailscale admin console."
+        f"Remove the offline tagged localghost-{state.node_label} device at "
+        f"{MACHINES_CONSOLE_URL}."
     )
 
 
 def _forget_tailscale_credential() -> None:
     if delete_tailscale_credential():
         info("The OAuth credential was removed from the system keyring.")
+        info(
+            "The OAuth client itself still exists; revoke it on the Trust "
+            f"credentials page ({OAUTH_CONSOLE_URL}) if no other machine uses it."
+        )
     else:
         info("No OAuth credential was stored in the system keyring.")
 
@@ -1515,14 +1535,17 @@ def _trust_tailnet_hub(target: str | None) -> None:
 def _share_trust(suffix: str, certificate: PublicCertificate) -> None:
     """Show another tailnet machine how to trust this hub's root."""
     action(
-        f"Trust https://*.{suffix} on other machines",
+        f"To trust https://*.{suffix} on other machines",
         f"uvx localghost tailscale trust {suffix}",
     )
     # The fingerprint is for clients that cannot ask Tailscale for the hub;
     # the plain command above is the way forward for everyone else.
     info(
-        "Without the tailscale CLI, add --fingerprint "
-        f"{certificate.fingerprint} to pin the root."
+        [
+            ("Without the tailscale CLI, add ", "default"),
+            (f"--fingerprint {certificate.fingerprint}", LIME),
+            (" to pin the root.", "default"),
+        ]
     )
 
 

{localghost-4.2.0 → localghost-4.2.1}/src/localghost/feedback.py

@@ -106,7 +106,7 @@ def details(
             console.print(Text(title, style="bold"))
         table = Table.grid(padding=(0, 1))
         table.add_column(style="bold")
-        table.add_column(style=MINT)
+        table.add_column(style=MINT, overflow="fold")
         for label, value in entries:
             table.add_row(label, value)
         console.print(table)
@@ -117,6 +117,16 @@ def details(
     console.print("\n".join(lines), soft_wrap=True)
 
 
+def styled(parts: Iterable[tuple[str, str]], *, err: bool = False) -> None:
+    """Show one line of (text, style) parts; plain text off a terminal."""
+    entries = list(parts)
+    console = _console(err)
+    if _rich_terminal(err):
+        console.print(Text.assemble(*entries))
+        return
+    console.print("".join(text for text, _ in entries), soft_wrap=True)
+
+
 def choices(title: str, items: Iterable[tuple[str, str, bool]]) -> None:
     """Show interactive choices with the same terminal hierarchy as other output."""
     entries = list(items)
@@ -141,7 +151,7 @@ def choices(title: str, items: Iterable[tuple[str, str, bool]]) -> None:
     console.print("\n".join(lines), soft_wrap=True)
 
 
-def info(message: str, *, err: bool = False) -> None:
+def info(message: str | list[tuple[str, str]], *, err: bool = False) -> None:
     _message(message, MINT, err=err)
 
 
@@ -171,7 +181,7 @@ def _labeled_block(rows: list[tuple[str, str]], *, heading: str, err: bool) -> N
         console = _console(err)
         console.print(Text.assemble(("▌ ", MINT), (heading, "bold")))
         table = Table.grid(padding=(0, 1))
-        table.add_column(style=MINT)
+        table.add_column(style=MINT, overflow="fold")
         table.add_column(style="bold")
         table.add_column()
         for label, value in rows:
@@ -269,12 +279,17 @@ def interrupt_break() -> None:
         _console(False).print()
 
 
-def _message(message: str, color: str, *, err: bool, symbol: str = "•") -> None:
+def _message(
+    message: str | list[tuple[str, str]], color: str, *, err: bool, symbol: str = "•"
+) -> None:
+    """Show a message; one given as (text, style) parts can highlight a command."""
+    parts = [message] if isinstance(message, str) else message
     console = _console(err)
     if _rich_terminal(err):
-        console.print(Text.assemble((f"{symbol} ", color), message))
+        console.print(Text.assemble((f"{symbol} ", color), *parts))
     else:
-        console.print(message, soft_wrap=True)
+        plain = "".join(part if isinstance(part, str) else part[0] for part in parts)
+        console.print(plain, soft_wrap=True)
 
 
 def _console(err: bool) -> Console:

{localghost-4.2.0 → localghost-4.2.1}/src/localghost/tailscale.py

@@ -25,8 +25,10 @@ from .paths import state_directory
 
 API_ROOT = "https://api.tailscale.com/api/v2"
 TOKEN_URL = f"{API_ROOT}/oauth/token"
-OAUTH_CONSOLE_URL = "https://login.tailscale.com/admin/settings/oauth"
-POLICY_CONSOLE_URL = "https://login.tailscale.com/admin/acls/file"
+OAUTH_CONSOLE_URL = "https://console.tailscale.com/admin/settings/trust-credentials"
+POLICY_CONSOLE_URL = "https://console.tailscale.com/admin/acls/file"
+MACHINES_CONSOLE_URL = "https://console.tailscale.com/admin/machines"
+DNS_CONSOLE_URL = "https://console.tailscale.com/admin/dns"
 KEYRING_SERVICE = "localghost-tailscale"
 _SUFFIX = re.compile(r"^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$")
 
@@ -329,7 +331,8 @@ class API:
             if exc.code == 403:
                 raise TailscaleError(
                     f"the OAuth client may not create auth keys: it needs the "
-                    f"auth_keys scope with {tag} allowed ({OAUTH_CONSOLE_URL})"
+                    f"Auth Keys: Write scope with {tag} selected (Trust "
+                    f"credentials page, {OAUTH_CONSOLE_URL})"
                 ) from exc
             raise
         try:
@@ -341,8 +344,8 @@ class API:
     def _dns_scope_guidance(exc: APIError) -> TailscaleError:
         if exc.code == 403:
             return TailscaleError(
-                "the OAuth client lacks the dns:write scope; recreate it at "
-                f"{OAUTH_CONSOLE_URL}"
+                "the OAuth client lacks the DNS: Write scope; recreate it on the "
+                f"Trust credentials page ({OAUTH_CONSOLE_URL})"
             )
         return exc
 
@@ -435,13 +438,8 @@ class TailnetHub:
         )  # fmt: skip
 
 
-def tailnet_hubs(tag: str = "tag:localghost") -> list[TailnetHub] | None:
-    """The online localghost gateways in this client's network map.
-
-    The names and addresses come from the coordination server through the
-    local Tailscale client, not from DNS, so split DNS cannot redirect them.
-    None means there is no tailscale CLI to ask.
-    """
+def _network_map_peers() -> dict | None:
+    """The peers in this client's network map; None without a tailscale CLI."""
     try:
         result = subprocess.run(
             ["tailscale", "status", "--json"],
@@ -454,9 +452,32 @@ def tailnet_hubs(tag: str = "tag:localghost") -> list[TailnetHub] | None:
     if result.returncode != 0:
         return None
     try:
-        peers = json.loads(result.stdout).get("Peer") or {}
+        return json.loads(result.stdout).get("Peer") or {}
     except (json.JSONDecodeError, AttributeError):
         return None
+
+
+def tag_in_use(tag: str) -> bool:
+    """Whether a device in this client's network map, online or not, has tag.
+
+    A device can only carry a tag its owner allowed, so this proves the
+    policy file once allowed it. False proves nothing: the policy may hide
+    tagged devices from this client.
+    """
+    peers = _network_map_peers() or {}
+    return any(tag in (peer.get("Tags") or ()) for peer in peers.values())
+
+
+def tailnet_hubs(tag: str = "tag:localghost") -> list[TailnetHub] | None:
+    """The online localghost gateways in this client's network map.
+
+    The names and addresses come from the coordination server through the
+    local Tailscale client, not from DNS, so split DNS cannot redirect them.
+    None means there is no tailscale CLI to ask.
+    """
+    peers = _network_map_peers()
+    if peers is None:
+        return None
     hubs = [
         TailnetHub(
             str(peer["DNSName"]).lower().removesuffix("."),