mozbridge-cli 0.1.0__py3-none-any.whl

mozbridge_cli/compose.py

@@ -0,0 +1,181 @@
+"""Discover and parse Docker Compose build components for `mozbridge publish`.
+
+Most real Mozbridge tenants (orphimuse: backend+frontend+2 celery; pratios:
+backend+celery+frontend+redis+alloy) are multi-service, not the single
+whole-directory image `publish` has always built. This module reads
+whatever compose file the user already has and turns each buildable
+service into a `Component` — `publish` then runs the existing
+single-component upload+trigger_build flow once per component (see
+main.py), never once per compose file.
+
+No backend changes and no cli/ -> backend/ import: this is a small,
+independent, best-effort YAML read, not a Compose-spec validator. Server
+side pre-flight (app_compose_file, compose_contract.py) is the real
+enforcement point for a project that opts into it.
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from pathlib import Path
+
+import yaml
+
+from . import config
+
+# Docker Compose's own file discovery order:
+# https://docs.docker.com/compose/compose-file/ ("Compose file names").
+# Do not invent a new default name here — this reads a file the user
+# already has, it doesn't declare a new platform-owned one.
+COMPOSE_FILENAMES = ("docker-compose.yml", "compose.yaml", "docker-compose.yaml")
+
+
+@dataclass
+class Component:
+    """One compose service with a `build:` key, ready to publish as an image."""
+
+    service_name: str
+    # As written in compose (bare string or build.context), relative to the compose file's dir.
+    context_path: str
+    # As written in compose (build.dockerfile), relative to context_path per Compose convention.
+    dockerfile_path: str
+
+
+def find_compose_file(cwd: Path) -> Path | None:
+    """Return the first compose file present in `cwd`, in Docker's own discovery order."""
+    for name in COMPOSE_FILENAMES:
+        candidate = cwd / name
+        if candidate.is_file():
+            return candidate
+    return None
+
+
+def parse_components(compose_path: Path) -> list[Component]:
+    """Return one Component per top-level service that has a `build:` key.
+
+    Best-effort: an unreadable, malformed, or structurally unexpected
+    compose file yields an empty list rather than raising. `publish`
+    treats an empty list exactly like "no compose file found" and falls
+    back to the single-component path — never a hard failure just because
+    this best-effort read couldn't make sense of the file.
+    """
+    try:
+        raw = compose_path.read_text()
+    except OSError:
+        return []
+    try:
+        data = yaml.safe_load(raw)
+    except yaml.YAMLError:
+        return []
+
+    if not isinstance(data, dict):
+        return []
+    services = data.get("services")
+    if not isinstance(services, dict):
+        return []
+
+    components: list[Component] = []
+    for service_name, service_def in services.items():
+        if not isinstance(service_def, dict):
+            continue
+        build = service_def.get("build")
+        if isinstance(build, str):
+            context_path = build or "."
+            dockerfile_path = "Dockerfile"
+        elif isinstance(build, dict):
+            context_path = str(build.get("context") or ".")
+            dockerfile_path = str(build.get("dockerfile") or "Dockerfile")
+        else:
+            # No `build:` key (image: only), or a shape we don't recognize.
+            continue
+        components.append(
+            Component(
+                service_name=str(service_name),
+                context_path=context_path,
+                dockerfile_path=dockerfile_path,
+            )
+        )
+    return components
+
+
+def group_by_context(cwd: Path, components: list[Component]) -> dict[Path, list[Component]]:
+    """Group components by resolved build-context directory.
+
+    Two services whose compose `build.context` spells the same directory
+    differently (`.` vs `./`, `./backend` vs `backend`) land in the same
+    group, keyed by the resolved absolute path — so `publish` zips and
+    uploads that context exactly once and reuses the same upload_id for
+    every component in the group, instead of re-uploading identical bytes.
+    Dict order follows first-seen component order (dicts are
+    insertion-ordered), so publish progress prints in a stable order.
+    """
+    groups: dict[Path, list[Component]] = {}
+    for component in components:
+        resolved = (cwd / component.context_path).resolve()
+        groups.setdefault(resolved, []).append(component)
+    return groups
+
+
+def default_image_name(org_slug: str, project_slug: str) -> str:
+    """The SAME base image name the backend would compute when image_name is
+    omitted (see config.GHCR_ORG's docstring for why this is derived
+    client-side): f"ghcr.io/{ghcr_org}/mozbridge-tenants/{org_slug}/{project_slug}".
+
+    Used directly by the single-component fallback path (no compose file /
+    no buildable services) of both regular `publish` (implicitly, via the
+    backend's own default) and `publish --local` (explicitly, since a
+    prebuilt registration always requires a concrete image_name — there is
+    no server-side default to fall back on when the CLI itself pushed the
+    image).
+    """
+    return f"ghcr.io/{config.GHCR_ORG}/mozbridge-tenants/{org_slug}/{project_slug}"
+
+
+def image_name_for(org_slug: str, project_slug: str, service_name: str) -> str:
+    """`default_image_name`, suffixed with the component's service name so N
+    components never collide on one image.
+    """
+    return f"{default_image_name(org_slug, project_slug)}-{service_name}"
+
+
+@dataclass
+class ResolvedComponent:
+    """A `Component` with every value `publish` actually sends to
+    `trigger_build` filled in — the single source of truth `publish` and
+    `diff` both read, so they can't silently diverge.
+    """
+
+    service_name: str
+    image_name: str
+    # Local, resolved build-context directory (what gets zipped and uploaded).
+    context_dir: Path
+    # Always "." — components are zipped and uploaded per-context, so the
+    # context is the root of that upload, exactly as `publish` sends it.
+    context_path: str
+    dockerfile_path: str
+
+
+def resolve_components(
+    cwd: Path, org_slug: str, project_slug: str, components: list[Component]
+) -> dict[Path, list[ResolvedComponent]]:
+    """Group `components` by resolved build context and compute exactly the
+    image_name/context_path/dockerfile_path each would be published with.
+
+    This is the shared computation behind both `mozbridge publish` (which
+    sends these values to `trigger_build`) and `mozbridge diff` (which only
+    prints them) — refactored out so the two can never silently drift apart.
+    """
+    groups = group_by_context(cwd, components)
+    resolved: dict[Path, list[ResolvedComponent]] = {}
+    for context_dir, group_components in groups.items():
+        resolved[context_dir] = [
+            ResolvedComponent(
+                service_name=component.service_name,
+                image_name=image_name_for(org_slug, project_slug, component.service_name),
+                context_dir=context_dir,
+                context_path=".",
+                dockerfile_path=component.dockerfile_path,
+            )
+            for component in group_components
+        ]
+    return resolved

mozbridge_cli/config.py

@@ -0,0 +1,76 @@
+"""Static configuration and environment-var overrides for the Mozbridge CLI.
+
+All values here have real, working defaults (see cli/README.md) so the CLI
+works out of the box for a human running `mozbridge login`. The env vars
+exist for testing and for pointing at a non-production Mozbridge instance.
+"""
+
+from __future__ import annotations
+
+import os
+from pathlib import Path
+
+# Logto tenant serving Mozbridge's real, provisioned Native (public) client.
+LOGTO_ENDPOINT = os.environ.get("MOZBRIDGE_LOGTO_ENDPOINT", "https://auth.mozbridge.com").rstrip("/")
+LOGTO_CLIENT_ID = os.environ.get("MOZBRIDGE_LOGTO_CLIENT_ID", "swdtsuiz6dgzack1g75x3")
+
+DEVICE_AUTH_URL = f"{LOGTO_ENDPOINT}/oidc/device/auth"
+TOKEN_URL = f"{LOGTO_ENDPOINT}/oidc/token"
+
+DEVICE_SCOPE = "openid offline_access profile"
+
+# Mozbridge API base — same env var convention already used across the
+# backend (see backend/app/features/projects/router.py).
+API_BASE_URL = (
+    os.environ.get("MOZBRIDGE_PUBLIC_API_URL")
+    or os.environ.get("PUBLIC_API_URL")
+    or "https://api.mozbridge.com"
+).rstrip("/")
+
+# GET /api/v1/auth/me: gated by the generic get_current_user dependency (not
+# a service-token-only endpoint like /api/v1/tokens/me), returns the human
+# user's profile (id, email, username, full_name, is_superuser,
+# is_platform_admin). This is the right whoami target for a Logto human
+# bearer token.
+WHOAMI_PATH = "/api/v1/auth/me"
+
+# GET /api/v1/organizations: lists orgs the caller is a member of (see
+# backend/app/features/identity/router.py:list_my_organizations). Gated by
+# the generic get_current_user dependency — no X-Organization-Id needed.
+ORGANIZATIONS_PATH = "/api/v1/organizations"
+
+# /api/v1/projects[...]: see backend/app/features/projects/router.py. Every
+# route under this prefix that mutates or lists project-scoped state also
+# depends on get_current_org, which requires an X-Organization-Id header.
+PROJECTS_PATH = "/api/v1/projects"
+
+# Mirrors backend/app/config.py:Settings.ghcr_org — the platform's own GHCR
+# account, used to build the SAME default image-name base the backend would
+# compute (BuildService._trigger_build_from_upload) when image_name is
+# omitted: f"ghcr.io/{ghcr_org}/mozbridge-tenants/{org_slug}/{project_slug}".
+# No API response returns this value back to the client (create_source_upload
+# and trigger_build's response bodies both omit it — see api.py), so a
+# multi-component `publish`, which must send distinct explicit image_name
+# values per component to avoid all components colliding on one image, needs
+# it client-side to build a name that actually matches where the backend's
+# own default would have pushed a single-component build. Same pattern as
+# every other platform constant in this file (LOGTO_CLIENT_ID, API_BASE_URL):
+# a real, working default plus an env var escape hatch for pointing at a
+# non-default backend deployment.
+GHCR_ORG = os.environ.get("MOZBRIDGE_GHCR_ORG", "jessin01")
+
+
+def config_dir() -> Path:
+    """Directory holding the cached session file.
+
+    Overridable via MOZBRIDGE_CONFIG_DIR (used by tests to isolate a fake
+    HOME instead of touching the real one).
+    """
+    override = os.environ.get("MOZBRIDGE_CONFIG_DIR")
+    if override:
+        return Path(override)
+    return Path.home() / ".config" / "mozbridge"
+
+
+def session_path() -> Path:
+    return config_dir() / "session.json"

mozbridge_cli/link.py

@@ -0,0 +1,90 @@
+"""Per-project-repo link state: `.mozbridge/link.json` in the CURRENT directory.
+
+Deliberately distinct from the CLI's own config dir (~/.config/mozbridge,
+see config.py) — this records which Mozbridge org/project a given repo
+checkout is linked to, so it is per-repo working-tree state, not per-user
+CLI state. It should be gitignored, not committed (see `ensure_gitignored`).
+"""
+
+from __future__ import annotations
+
+import json
+from dataclasses import asdict, dataclass
+from pathlib import Path
+
+LINK_DIR_NAME = ".mozbridge"
+LINK_FILE_NAME = "link.json"
+
+
+@dataclass
+class Link:
+    org_id: int
+    org_slug: str
+    project_id: int
+    project_slug: str
+
+    def to_dict(self) -> dict:
+        return asdict(self)
+
+
+def link_dir(cwd: Path) -> Path:
+    return cwd / LINK_DIR_NAME
+
+
+def link_path(cwd: Path) -> Path:
+    return link_dir(cwd) / LINK_FILE_NAME
+
+
+def load_link(cwd: Path) -> Link | None:
+    """Return the link for `cwd`, or None if absent/unreadable/malformed."""
+    path = link_path(cwd)
+    if not path.exists():
+        return None
+    try:
+        data = json.loads(path.read_text())
+        return Link(
+            org_id=int(data["org_id"]),
+            org_slug=str(data["org_slug"]),
+            project_id=int(data["project_id"]),
+            project_slug=str(data["project_slug"]),
+        )
+    except (OSError, json.JSONDecodeError, KeyError, TypeError, ValueError):
+        return None
+
+
+def save_link(cwd: Path, link: Link) -> Path:
+    d = link_dir(cwd)
+    d.mkdir(parents=True, exist_ok=True)
+    path = link_path(cwd)
+    path.write_text(json.dumps(link.to_dict(), indent=2) + "\n")
+    return path
+
+
+def ensure_gitignored(cwd: Path) -> str:
+    """Best-effort: append `.mozbridge/` to an existing .gitignore in `cwd`.
+
+    Never creates a .gitignore that didn't already exist — `cwd` may not be
+    a repo this tool owns, and conjuring one into existence for an arbitrary
+    directory is out of scope. Returns a human-readable status line.
+    """
+    gitignore = cwd / ".gitignore"
+    entry = f"{LINK_DIR_NAME}/"
+    if not gitignore.exists():
+        return f"Note: no .gitignore found here — add `{entry}` to one yourself."
+    try:
+        content = gitignore.read_text()
+    except OSError:
+        return f"Note: could not read .gitignore — add `{entry}` to it yourself."
+
+    existing = {line.strip() for line in content.splitlines()}
+    if entry in existing or LINK_DIR_NAME in existing:
+        return ".gitignore already excludes .mozbridge/."
+
+    try:
+        with gitignore.open("a") as f:
+            if content and not content.endswith("\n"):
+                f.write("\n")
+            f.write(f"{entry}\n")
+    except OSError:
+        return f"Note: could not update .gitignore — add `{entry}` to it yourself."
+    return "Added .mozbridge/ to .gitignore."

mozbridge_cli/local_build.py

@@ -0,0 +1,140 @@
+"""Local docker build/login/push for `mozbridge publish --local`.
+
+Every function here shells out to the real `docker` binary on the
+developer's own machine — the one part of this CLI that is NOT a thin HTTP
+wrapper. macOS-only (see main.py's module docstring): no Windows-specific
+code paths here (no cmd.exe quoting, no Docker Desktop-for-Windows named
+pipe handling).
+"""
+
+from __future__ import annotations
+
+import re
+import subprocess
+import uuid
+from pathlib import Path
+
+# Every image name this CLI computes (compose.default_image_name /
+# compose.image_name_for) is rooted at ghcr.io/<GHCR_ORG>/... — matching
+# backend Settings.ghcr_org. The runtime-secrets response
+# (backend/app/services/cicd_runtime_secrets.py) never emits a separate
+# registry-host key: GHCR_TOKEN/GHCR_USER are always ghcr.io credentials,
+# so there is nothing to parse a registry URL out of.
+REGISTRY = "ghcr.io"
+
+# A real `docker push` success ends with a line shaped like:
+#   latest: digest: sha256:2c26b46b68ffc68ff99b453c1d30413413422d706483bfa0f98a5e886266e7ae size: 1787
+_DIGEST_RE = re.compile(r"digest:\s*(sha256:[0-9a-f]{64})")
+
+
+class DockerError(Exception):
+    """Base for every docker-subprocess failure this module raises."""
+
+
+class DockerUnavailableError(DockerError):
+    """`docker` isn't installed, or its daemon isn't reachable."""
+
+
+class DockerBuildError(DockerError):
+    pass
+
+
+class DockerLoginError(DockerError):
+    pass
+
+
+class DockerPushError(DockerError):
+    pass
+
+
+def local_tag() -> str:
+    """A short, collision-resistant tag for one locally-built image."""
+    return f"local-{uuid.uuid4().hex[:12]}"
+
+
+def check_docker_available() -> None:
+    """Raise DockerUnavailableError with a clear, actionable message if
+    `docker` isn't on PATH or its daemon can't be reached.
+
+    Checked once, up front, before any build is attempted — never inferred
+    after the fact by pattern-matching a build's own cryptic failure text.
+    """
+    try:
+        result = subprocess.run(
+            ["docker", "version", "--format", "{{.Server.Version}}"],
+            capture_output=True,
+            text=True,
+            timeout=15,
+        )
+    except FileNotFoundError as exc:
+        raise DockerUnavailableError(
+            "`docker` is not installed (or not on PATH). Install Docker Desktop "
+            "or the docker CLI, then try `mozbridge publish --local` again."
+        ) from exc
+    except subprocess.TimeoutExpired as exc:
+        raise DockerUnavailableError(
+            "Timed out waiting for `docker version` to respond — is the Docker "
+            "daemon starting up or stuck? Try again once `docker ps` works."
+        ) from exc
+
+    if result.returncode != 0:
+        detail = (result.stderr or result.stdout or "").strip()
+        raise DockerUnavailableError(
+            f"Docker daemon is not reachable: {detail or 'docker version failed'}. "
+            "Start Docker Desktop (or the docker daemon) and try again."
+        )
+
+
+def docker_build(context_dir: Path, dockerfile_path: str, tag: str) -> None:
+    """`docker build -t <tag> -f <context_dir>/<dockerfile_path> <context_dir>`."""
+    dockerfile = context_dir / dockerfile_path
+    cmd = ["docker", "build", "-t", tag, "-f", str(dockerfile), str(context_dir)]
+    try:
+        result = subprocess.run(cmd, capture_output=True, text=True)
+    except FileNotFoundError as exc:
+        raise DockerUnavailableError("`docker` is not installed (or not on PATH).") from exc
+    if result.returncode != 0:
+        detail = (result.stderr or result.stdout or "docker build failed").strip()
+        raise DockerBuildError(detail)
+
+
+def docker_login(registry: str, username: str, password: str) -> None:
+    """`docker login <registry> -u <username> --password-stdin`, password piped
+    via stdin so it never appears in the process list or shell history.
+    """
+    cmd = ["docker", "login", registry, "-u", username, "--password-stdin"]
+    try:
+        result = subprocess.run(cmd, input=password, capture_output=True, text=True)
+    except FileNotFoundError as exc:
+        raise DockerUnavailableError("`docker` is not installed (or not on PATH).") from exc
+    if result.returncode != 0:
+        detail = (result.stderr or result.stdout or "docker login failed").strip()
+        raise DockerLoginError(detail)
+
+
+def docker_push(tag: str) -> str:
+    """`docker push <tag>`, returning the real pushed digest (sha256:...).
+
+    Parsed from `docker push`'s own final "<ref>: digest: sha256:... size:
+    N" stdout line — the authoritative source that is always present on a
+    successful push — rather than a follow-up `docker inspect
+    --format='{{index .RepoDigests 0}}'` against the local image: RepoDigests
+    is only reliably populated by some local image-store configurations
+    after a push, so trusting the push command's own output avoids a
+    second, environment-dependent point of failure.
+    """
+    cmd = ["docker", "push", tag]
+    try:
+        result = subprocess.run(cmd, capture_output=True, text=True)
+    except FileNotFoundError as exc:
+        raise DockerUnavailableError("`docker` is not installed (or not on PATH).") from exc
+    if result.returncode != 0:
+        detail = (result.stderr or result.stdout or "docker push failed").strip()
+        raise DockerPushError(detail)
+
+    match = _DIGEST_RE.search(result.stdout)
+    if not match:
+        raise DockerPushError(
+            f"docker push succeeded but no digest could be parsed from its output:\n{result.stdout.strip()}"
+        )
+    return match.group(1)