menda-bootstrap 0.1.0__tar.gz

menda_bootstrap-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,12 @@
+name: CI
+
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+jobs:
+  ci:
+    uses: mendaml/menda-gh-actions/.github/workflows/python-ci.yml@main

menda_bootstrap-0.1.0/.gitignore

@@ -0,0 +1,207 @@
+# Byte-compiled / optimized / DLL files
+__pycache__/
+*.py[codz]
+*$py.class
+
+# C extensions
+*.so
+
+# Distribution / packaging
+.Python
+build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+lib/
+lib64/
+parts/
+sdist/
+var/
+wheels/
+share/python-wheels/
+*.egg-info/
+.installed.cfg
+*.egg
+MANIFEST
+
+# PyInstaller
+#  Usually these files are written by a python script from a template
+#  before PyInstaller builds the exe, so as to inject date/other infos into it.
+*.manifest
+*.spec
+
+# Installer logs
+pip-log.txt
+pip-delete-this-directory.txt
+
+# Unit test / coverage reports
+htmlcov/
+.tox/
+.nox/
+.coverage
+.coverage.*
+.cache
+nosetests.xml
+coverage.xml
+*.cover
+*.py.cover
+.hypothesis/
+.pytest_cache/
+cover/
+
+# Translations
+*.mo
+*.pot
+
+# Django stuff:
+*.log
+local_settings.py
+db.sqlite3
+db.sqlite3-journal
+
+# Flask stuff:
+instance/
+.webassets-cache
+
+# Scrapy stuff:
+.scrapy
+
+# Sphinx documentation
+docs/_build/
+
+# PyBuilder
+.pybuilder/
+target/
+
+# Jupyter Notebook
+.ipynb_checkpoints
+
+# IPython
+profile_default/
+ipython_config.py
+
+# pyenv
+#   For a library or package, you might want to ignore these files since the code is
+#   intended to run in multiple environments; otherwise, check them in:
+# .python-version
+
+# pipenv
+#   According to pypa/pipenv#598, it is recommended to include Pipfile.lock in version control.
+#   However, in case of collaboration, if having platform-specific dependencies or dependencies
+#   having no cross-platform support, pipenv may install dependencies that don't work, or not
+#   install all needed dependencies.
+#Pipfile.lock
+
+# UV
+#   Similar to Pipfile.lock, it is generally recommended to include uv.lock in version control.
+#   This is especially recommended for binary packages to ensure reproducibility, and is more
+#   commonly ignored for libraries.
+#uv.lock
+
+# poetry
+#   Similar to Pipfile.lock, it is generally recommended to include poetry.lock in version control.
+#   This is especially recommended for binary packages to ensure reproducibility, and is more
+#   commonly ignored for libraries.
+#   https://python-poetry.org/docs/basic-usage/#commit-your-poetrylock-file-to-version-control
+#poetry.lock
+#poetry.toml
+
+# pdm
+#   Similar to Pipfile.lock, it is generally recommended to include pdm.lock in version control.
+#   pdm recommends including project-wide configuration in pdm.toml, but excluding .pdm-python.
+#   https://pdm-project.org/en/latest/usage/project/#working-with-version-control
+#pdm.lock
+#pdm.toml
+.pdm-python
+.pdm-build/
+
+# pixi
+#   Similar to Pipfile.lock, it is generally recommended to include pixi.lock in version control.
+#pixi.lock
+#   Pixi creates a virtual environment in the .pixi directory, just like venv module creates one
+#   in the .venv directory. It is recommended not to include this directory in version control.
+.pixi
+
+# PEP 582; used by e.g. github.com/David-OConnor/pyflow and github.com/pdm-project/pdm
+__pypackages__/
+
+# Celery stuff
+celerybeat-schedule
+celerybeat.pid
+
+# SageMath parsed files
+*.sage.py
+
+# Environments
+.env
+.envrc
+.venv
+env/
+venv/
+ENV/
+env.bak/
+venv.bak/
+
+# Spyder project settings
+.spyderproject
+.spyproject
+
+# Rope project settings
+.ropeproject
+
+# mkdocs documentation
+/site
+
+# mypy
+.mypy_cache/
+.dmypy.json
+dmypy.json
+
+# Pyre type checker
+.pyre/
+
+# pytype static type analyzer
+.pytype/
+
+# Cython debug symbols
+cython_debug/
+
+# PyCharm
+#  JetBrains specific template is maintained in a separate JetBrains.gitignore that can
+#  be found at https://github.com/github/gitignore/blob/main/Global/JetBrains.gitignore
+#  and can be added to the global gitignore or merged into this file.  For a more nuclear
+#  option (not recommended) you can uncomment the following to ignore the entire idea folder.
+#.idea/
+
+# Abstra
+# Abstra is an AI-powered process automation framework.
+# Ignore directories containing user credentials, local state, and settings.
+# Learn more at https://abstra.io/docs
+.abstra/
+
+# Visual Studio Code
+#  Visual Studio Code specific template is maintained in a separate VisualStudioCode.gitignore 
+#  that can be found at https://github.com/github/gitignore/blob/main/Global/VisualStudioCode.gitignore
+#  and can be added to the global gitignore or merged into this file. However, if you prefer, 
+#  you could uncomment the following to ignore the entire vscode folder
+# .vscode/
+
+# Ruff stuff:
+.ruff_cache/
+
+# PyPI configuration file
+.pypirc
+
+# Cursor
+#  Cursor is an AI-powered code editor. `.cursorignore` specifies files/directories to
+#  exclude from AI features like autocomplete and code analysis. Recommended for sensitive data
+#  refer to https://docs.cursor.com/context/ignore-files
+.cursorignore
+.cursorindexingignore
+
+# Marimo
+marimo/_static/
+marimo/_lsp/
+__marimo__/

menda_bootstrap-0.1.0/.python-version

@@ -0,0 +1 @@
+3.12

menda_bootstrap-0.1.0/PKG-INFO

@@ -0,0 +1,12 @@
+Metadata-Version: 2.4
+Name: menda-bootstrap
+Version: 0.1.0
+Summary: Add your description here
+Author-email: jpm2617 <jose.moreno@mendaml.com>
+Requires-Python: >=3.12
+Requires-Dist: keyring>=25.7.0
+Requires-Dist: requests>=2.32.5
+Description-Content-Type: text/markdown
+
+# menda-bootstrap
+A python package used to bootstrap menda projects

menda_bootstrap-0.1.0/README.md

@@ -0,0 +1,2 @@
+# menda-bootstrap
+A python package used to bootstrap menda projects

menda_bootstrap-0.1.0/pyproject.toml

@@ -0,0 +1,152 @@
+[project]
+name = "menda-bootstrap"
+version = "0.1.0"
+description = "Add your description here"
+readme = "README.md"
+authors = [
+    { name = "jpm2617", email = "jose.moreno@mendaml.com" }
+]
+requires-python = ">=3.12"
+dependencies = [
+    "keyring>=25.7.0",
+    "requests>=2.32.5",
+]
+
+[build-system]
+build-backend = "hatchling.build"
+requires = ["hatchling"]
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/menda"]
+
+
+[dependency-groups]
+dev = [
+    "coverage>=7.13.5",
+    "poethepoet>=0.42.1",
+    "pytest>=9.0.2",
+    "ruff>=0.15.7",
+    "ty>=0.0.24",
+]
+
+[project.entry-points."keyring.backends"]
+menda-keyring = "menda.keyring.backend:MendaCodeArtifactKeyring"
+
+# ── Coverage ─────────────────────────────────────────────────────────────
+[tool.coverage.run]
+source = ["src"]
+data_file = ".coverage"
+branch = true
+parallel = true
+relative_files = true
+omit = [
+    "*/tests/*",
+    "*/site-packages/*",
+    "*.egg-info/*"
+]
+
+# ── Ruff ─────────────────────────────────────────────────────────────
+[tool.ruff]
+fix = true
+indent-width = 4
+line-length = 120
+target-version = "py312"
+
+[tool.ruff.lint]
+ignore = [
+  "TRY002", # Create your own exceptions
+  "TRY003", # Avoid specifying long messages outside the exception class
+  "TRY301", # Avoid raise exceptions from err
+  "TRY400", # Avoid logger suggestion of exception instead of error
+  "RUF012", # Mutable class attributes should be annotated with `typing.ClassVar`
+  "E501", # LineTooLong
+  "E731", # DoNotAssignLambda
+  "S104", # Possible binding to all interfaces (HOST = 0.0.0.0)
+  "D100", # Missing docstring in public module
+  "D101", # Missing docstring in public class
+  "D104", # Missing docstring in public package
+  "D107", # Missing docstring in __init__
+  "D203", # 1 blank line required before class docstring
+  "D213", # Multi-line docstring summary should start at the second line
+]
+select = [
+  "YTT", # flake8-2020
+  "S", # flake8-bandit
+  "B", # flake8-bugbear
+  "A", # flake8-builtins
+  "C4", # flake8-comprehensions
+  "T10", # flake8-debugger
+  "SIM", # flake8-simplify
+  "I", # isort
+  "C90", # mccabe
+  "E", # pycodestyle
+  "W", # pycodestyle
+  "F", # pyflakes
+  "PGH", # pygrep-hooks
+  "UP", # pyupgrade
+  "RUF", # ruff
+  "TRY", # tryceratops
+  "D", # flake8-docstrings
+  "ANN", # flake8-annotations — enforce type annotations
+]
+
+[tool.ruff.lint.per-file-ignores]
+"**/tests/*" = ["S101", "S108", "D102", "ANN"]
+
+[tool.ruff.format]
+preview = true
+# Like Black, use double quotes for strings.
+quote-style = "double"
+# Like Black, indent with spaces, rather than tabs.
+indent-style = "space"
+# Like Black, respect magic trailing commas.
+skip-magic-trailing-comma = false
+# Like Black, automatically detect the appropriate line ending.
+line-ending = "auto"
+# Enable auto-formatting of code examples in docstrings. Markdown,
+# reStructuredText code/literal blocks and doctests are all supported.
+#
+# This is currently disabled by default, but it is planned for this
+# to be opt-out in the future.
+docstring-code-format = true
+# Set the line length limit used when formatting code snippets in
+# docstrings.
+#
+# This only has an effect when the `docstring-code-format` setting is
+# enabled.
+docstring-code-line-length = "dynamic"
+
+# ── ty (type checker) ────────────────────────────────────────────────
+[tool.ty.environment]
+python-version = "3.12"
+python = ".venv"
+root = ["./src"]
+
+[tool.ty.src]
+include = ["src", "tests"]
+
+# ── tasks (Using poe) ────────────────────────────────────────────────
+[tool.poe.tasks]
+lint-typing = "ty check"
+lint-style = "ruff check ."
+lint-format = [
+  { cmd = "ruff format" },
+  { cmd = "ruff check --fix" },
+]
+lint-all = ["lint-format", "lint-style", "lint-typing"]
+test-cov = [
+  { cmd = "coverage run -m pytest tests -x -s --capture=tee-sys -v --junitxml=test_coverage.xml" },
+  { cmd = "coverage combine" },
+  { cmd = "coverage xml" },
+  { cmd = "coverage html" },
+]
+
+[tool.poe.tasks.test]
+shell = """
+if [ -n "$PYTEST_MARKERS" ]; then
+  pytest tests -x -s --capture=tee-sys -v -m "$PYTEST_MARKERS"
+else
+  pytest tests -x -s --capture=tee-sys -v
+fi
+"""
+interpreter = "bash"

menda_bootstrap-0.1.0/src/menda/__init__.py

@@ -0,0 +1,3 @@
+from pkgutil import extend_path
+
+__path__ = extend_path(__path__, __name__)

menda_bootstrap-0.1.0/src/menda/error/__init__.py

@@ -0,0 +1 @@
+"""Error types and handling for menda bootstrap package."""

menda_bootstrap-0.1.0/src/menda/error/exceptions.py

@@ -0,0 +1,18 @@
+class ErrorMixIn(Exception):
+    """MixIn for all exceptions in menda-bootstrap package."""
+
+    def __init__(self, message: str, *, status_code: int | None = None) -> None:
+        """Initialize the exception with a message and optional HTTP status code.
+
+        Args:
+            message: The error message to display.
+            status_code: Optional HTTP status code associated with the error.
+
+        """
+        self.status_code = status_code
+        message = f"{message} (status_code: {status_code})" if status_code else message
+        super().__init__(message)
+
+
+class MendaKeyRingError(ErrorMixIn):
+    """Failed to obtain credentials from menda keyring backend."""

menda_bootstrap-0.1.0/src/menda/keyring/auth.py

@@ -0,0 +1,159 @@
+"""Lightweight authentication for menda-cloud APIs.
+
+This module uses only `requests` — no dependency on menda-core.
+Mirrors the resolution logic in menda.auth.task.resolve_auth_config().
+
+Three auth paths:
+1. M2M via env vars: MENDA_CLIENT_ID + MENDA_CLIENT_SECRET + MENDA_HOST
+2. M2M via profile: mendacfg profile with auth_type=m2m, client_id, client_secret
+3. U2M via profile: mendacfg profile with auth_type=u2m, cached device-flow token
+"""
+
+from __future__ import annotations
+
+import configparser
+import os
+import time
+from pathlib import Path
+
+import requests
+
+MENDA_CONFIG_FOLDER = Path.home() / ".menda"
+TOKENS_CACHE_PATH = MENDA_CONFIG_FOLDER / "tokens" / "cache" / ".token"
+
+
+def get_menda_access_token(
+    host: str,
+    client_id: str,
+    client_secret: str,
+) -> str:
+    """Exchange M2M client credentials for a menda access token."""
+    url = f"{host.rstrip('/')}/api/v1/auth/oauth2/token"
+    resp = requests.post(
+        url,
+        params={
+            "grant_type": "client_credentials",
+            "client_id": client_id,
+            "client_secret": client_secret,
+        },
+        timeout=30,
+    )
+    if not resp.ok:
+        raise RuntimeError(f"Failed to authenticate to menda-cloud (HTTP {resp.status_code}): {resp.text}")
+    return resp.json()["access_token"]
+
+
+def _load_profile(profile_id: str) -> dict[str, str]:
+    """Load a profile section from ~/.menda/mendacfg."""
+    mendacfg_path = MENDA_CONFIG_FOLDER / "mendacfg"
+    if not mendacfg_path.exists():
+        raise FileNotFoundError(f"Menda config file not found at {mendacfg_path}. Run 'menda auth configure' first.")
+
+    config = configparser.ConfigParser()
+    config.read(mendacfg_path)
+
+    if profile_id not in config:
+        raise RuntimeError(f"Profile '{profile_id}' not found in {mendacfg_path}")
+
+    return dict(config[profile_id])
+
+
+def _load_cached_token(cache_key: str) -> str | None:
+    """Load a non-expired cached token from the token cache file.
+
+    The cache file is a configparser file at ~/.menda/tokens/cache/.token.
+    Each section is keyed by profile_id (or client_id for env-var M2M).
+
+    Returns:
+        The access token string, or None if not cached or expired.
+
+    """
+    if not TOKENS_CACHE_PATH.exists():
+        return None
+
+    parser = configparser.ConfigParser()
+    parser.read(TOKENS_CACHE_PATH)
+
+    if cache_key not in parser:
+        return None
+
+    section = parser[cache_key]
+    cached_at = section.get("cached_at", "")
+    expires_in = section.get("expires_in", "")
+
+    if cached_at and expires_in:
+        try:
+            elapsed = time.time() - float(cached_at)
+            if elapsed >= (float(expires_in) - 60):
+                return None
+        except (ValueError, TypeError):
+            return None
+
+    token = section.get("id_token") or section.get("access_token")
+    return token if token else None
+
+
+def exchange_for_registry_token(host: str, access_token: str) -> str:
+    """Exchange a menda access token for a CodeArtifact registry token."""
+    url = f"{host.rstrip('/')}/api/v1/auth/registry/token"
+    resp = requests.post(
+        url,
+        headers={
+            "authorizationToken": f"Bearer {access_token}",
+            "Content-Type": "application/json",
+        },
+        timeout=30,
+    )
+    if not resp.ok:
+        raise RuntimeError(f"Failed to get registry token (HTTP {resp.status_code}): {resp.text}")
+    return resp.json()["token"]
+
+
+def resolve_and_get_registry_token() -> str:
+    """Resolve auth method and return a CodeArtifact token.
+
+    Resolution order:
+    1. If MENDA_CLIENT_ID, MENDA_CLIENT_SECRET, MENDA_HOST env vars all set → M2M via env vars.
+    2. Load profile from mendacfg using MENDA_PROFILE_ID (default: "default"):
+       - auth_type=m2m → M2M via profile (on-demand token exchange, with cache).
+       - auth_type=u2m → U2M via cached device-flow token.
+    """
+    client_id = os.environ.get("MENDA_CLIENT_ID")
+    client_secret = os.environ.get("MENDA_CLIENT_SECRET")
+    host = os.environ.get("MENDA_HOST")
+
+    # Path 1: M2M via env vars
+    if client_id and client_secret and host:
+        cached = _load_cached_token(client_id)
+        if cached:
+            return exchange_for_registry_token(host, cached)
+        access_token = get_menda_access_token(host, client_id, client_secret)
+        return exchange_for_registry_token(host, access_token)
+
+    # Load profile
+    profile_id = os.environ.get("MENDA_PROFILE_ID", "default")
+    profile = _load_profile(profile_id)
+
+    profile_host = profile.get("host")
+    if not profile_host:
+        raise RuntimeError(f"No 'host' found in profile '{profile_id}'")
+
+    auth_type = profile.get("auth_type", "u2m")
+
+    # Path 2: M2M via profile
+    if auth_type == "m2m":
+        profile_client_id = profile.get("client_id")
+        profile_client_secret = profile.get("client_secret")
+        if not profile_client_id or not profile_client_secret:
+            raise RuntimeError(f"Profile '{profile_id}' has auth_type=m2m but missing client_id/client_secret")
+        cached = _load_cached_token(profile_id)
+        if cached:
+            return exchange_for_registry_token(profile_host, cached)
+        access_token = get_menda_access_token(profile_host, profile_client_id, profile_client_secret)
+        return exchange_for_registry_token(profile_host, access_token)
+
+    # Path 3: U2M via cached token
+    cached = _load_cached_token(profile_id)
+    if not cached:
+        raise RuntimeError(f"No valid cached token for profile '{profile_id}'. Run 'menda auth login' to authenticate.")
+    return exchange_for_registry_token(profile_host, cached)

menda_bootstrap-0.1.0/src/menda/keyring/backend.py

@@ -0,0 +1,47 @@
+"""Menda CodeArtifact keyring backend.
+
+Discovered by the `keyring` library via the entry point in pyproject.toml.
+When `uv` needs credentials for a CodeArtifact URL, it calls
+`keyring get <url> <username>` which invokes this backend.
+"""
+
+from __future__ import annotations
+
+import re
+
+from keyring.backend import KeyringBackend
+
+from menda.error.exceptions import MendaKeyRingError
+from menda.keyring.auth import resolve_and_get_registry_token
+
+_CODEARTIFACT_URL_PATTERN = re.compile(r"\.d\.codeartifact\.[a-z0-9-]+\.amazonaws\.com")
+
+
+class MendaCodeArtifactKeyring(KeyringBackend):
+    """Keyring backend that vends CodeArtifact tokens via menda-cloud."""
+
+    priority = 10
+
+    @staticmethod
+    def _is_codeartifact_url(url: str) -> bool:
+        """Check if the URL is an AWS CodeArtifact URL."""
+        return bool(_CODEARTIFACT_URL_PATTERN.search(url))
+
+    def get_password(self, service: str, username: str) -> str | None:
+        """Return a CodeArtifact token for the given URL, or None."""
+        if not self._is_codeartifact_url(service):
+            return None
+
+        try:
+            return resolve_and_get_registry_token()
+        except Exception as exc:
+            raise MendaKeyRingError(
+                f"Failed to obtain token from menda keyring backend: {exc}",
+                status_code=500,
+            ) from exc
+
+    def set_password(self, service: str, username: str, password: str) -> None:
+        """No-op. We never write credentials."""
+
+    def delete_password(self, service: str, username: str) -> None:
+        """No-op. We never delete credentials."""