multicloud-cli 0.2.0__tar.gz → 0.3.0__tar.gz

{multicloud_cli-0.2.0 → multicloud_cli-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: multicloud-cli
-Version: 0.2.0
+Version: 0.3.0
 Summary: mctl: the Multicloud command line: sign in, connect your cloud account, run pools
 Project-URL: Homepage, https://multicloud.io
 Author-email: Multicloud Team <info@multicloud.io>
@@ -54,6 +54,7 @@ OpenTofu or Terraform 1.5 or later.
 mctl auth login                       # opens your browser; sign in as you do on multicloud.io
 mkdir multicloud-aws && cd multicloud-aws
 mctl cloud-account create --cloud AWS --account 123456789012 --region us-east-1
+export AWS_REGION=us-east-1           # Terraform needs a region when your AWS profile has none
 mctl cloud-account apply 7            # init, plan, asks you, apply, then waits for "Ready"
 ```
 
@@ -81,6 +82,7 @@ mctl cloud-account verify 7 --wait
 | `mctl overview` / `billing` | Setup checklist, alerts and pool counts; payment gate status. Read access or a member sign-in. |
 | `mctl extend create NAME` | Make an Extend pool. Owner sign-in only. |
 | `mctl peering create\|list\|show\|revoke POOL ...` | Manage the peerings of an Extend pool. Owner sign-in only. |
+| `mctl ssh allow\|list\|revoke`, `mctl node list`, `mctl ssh NODE [-y] [-- ssh args]` | Operators only (role `multicloud-admins`): open tcp/22 on a node for your own IPv4 address, list the nodes and the grants, connect. Details: `mctl ssh --help`. |
 
 The connect code reaches Terraform only through the environment of the `apply` process.
 `mctl` never prints a key or a token, and only `mctl cloud-account token` prints a connect code.

{multicloud_cli-0.2.0 → multicloud_cli-0.3.0}/README.md

@@ -23,6 +23,7 @@ OpenTofu or Terraform 1.5 or later.
 mctl auth login                       # opens your browser; sign in as you do on multicloud.io
 mkdir multicloud-aws && cd multicloud-aws
 mctl cloud-account create --cloud AWS --account 123456789012 --region us-east-1
+export AWS_REGION=us-east-1           # Terraform needs a region when your AWS profile has none
 mctl cloud-account apply 7            # init, plan, asks you, apply, then waits for "Ready"
 ```
 
@@ -50,6 +51,7 @@ mctl cloud-account verify 7 --wait
 | `mctl overview` / `billing` | Setup checklist, alerts and pool counts; payment gate status. Read access or a member sign-in. |
 | `mctl extend create NAME` | Make an Extend pool. Owner sign-in only. |
 | `mctl peering create\|list\|show\|revoke POOL ...` | Manage the peerings of an Extend pool. Owner sign-in only. |
+| `mctl ssh allow\|list\|revoke`, `mctl node list`, `mctl ssh NODE [-y] [-- ssh args]` | Operators only (role `multicloud-admins`): open tcp/22 on a node for your own IPv4 address, list the nodes and the grants, connect. Details: `mctl ssh --help`. |
 
 The connect code reaches Terraform only through the environment of the `apply` process.
 `mctl` never prints a key or a token, and only `mctl cloud-account token` prints a connect code.

multicloud_cli-0.3.0/multicloud_cli/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.3.0"

{multicloud_cli-0.2.0 → multicloud_cli-0.3.0}/multicloud_cli/api.py

@@ -52,12 +52,12 @@ def _detail_text(data: Any) -> Optional[str]:
 
 
 def _send(method: str, url: str, body: Optional[Dict[str, Any]], headers: Dict[str, str],
-          params: Optional[Dict[str, Any]] = None) -> requests.Response:
+          params: Optional[Dict[str, Any]] = None, ipv4_only: bool = False) -> requests.Response:
     extra = {"params": params} if params else {}  # a list value becomes one repeated key
     try:
         # No redirects: requests would carry the credential header to another host.
         return net.request(method, url, json=body, timeout=TIMEOUT_S, allow_redirects=False, headers=headers,
-                           **extra)
+                           ipv4_only=ipv4_only, **extra)
     except requests.RequestException as ex:
         raise ApiError(f"Could not reach the API: {ex}")
 
@@ -84,24 +84,31 @@ def _sso_org(slug: Optional[str], token: str, explicit: bool = True) -> str:
 def call(method: str, org: Optional[str], path: str = "", *, body: Optional[Dict[str, Any]] = None,
          headers: Optional[Dict[str, str]] = None, accept: Iterable[int] = (200, 201, 202),
          scope: Optional[str] = None, pass_codes: Iterable[str] = (),
-         params: Optional[Dict[str, Any]] = None, org_scoped: bool = True) -> Dict[str, Any]:
+         params: Optional[Dict[str, Any]] = None, org_scoped: bool = True,
+         ipv4_only: bool = False, prefer_sso: bool = False) -> Dict[str, Any]:
     """One API call. Returns the JSON body with ``_status`` added; raises ``ApiError`` on other statuses.
 
     ``scope`` names the API key scope this call needs; a 401 or 403 then says that it may be missing.
     A failed answer whose error code is in ``pass_codes`` is returned like a success.
     ``params`` are query parameters. ``org_scoped=False`` calls ``/api/v1{path}`` with no organization in the URL:
     an SSO call then needs no organization, and ``MULTICLOUD_API_KEY`` needs none either (a stored key still
-    needs one to be found)."""
+    needs one to be found). ``ipv4_only`` connects over IPv4 only (the SSH grant routes). ``prefer_sso`` keeps the
+    SSO token on a platform route even when the named org has a stored key or ``MULTICLOUD_API_KEY`` is set: the
+    operator routes check a realm role,
+    which an API key never holds."""
     slug = config.get_org(org)
     try:
         use_sso = False
-        if not os.environ.get("MULTICLOUD_API_KEY"):  # the key path needs no issuer
+        if prefer_sso or not os.environ.get("MULTICLOUD_API_KEY"):  # the key path needs no issuer
             issuer = config.get_issuer()
             use_sso = auth.load_sso(issuer) is not None
-            if use_sso and not org_scoped and slug and auth.get_key(slug)[0]:
+            if use_sso and not org_scoped and not prefer_sso and slug and auth.get_key(slug)[0]:
                 # A stored key of the named org wins for the platform routes (the catalog): it holds its scope
                 # explicitly, while an SSO token may not reach them.
                 use_sso = False
+            if prefer_sso and not use_sso:
+                raise ApiError("This command needs an SSO sign-in; an API key never reaches it. Run: mctl auth login",
+                               exit_code=exitcodes.AUTH)
         base = config.get_api_url()
         if use_sso:
             token = auth.fresh_access_token(issuer)
@@ -124,14 +131,15 @@ def call(method: str, org: Optional[str], path: str = "", *, body: Optional[Dict
     except config.ConfigError as ex:
         raise ApiError(str(ex))
     url = f"{base}/api/v1/orgs/{quote(slug, safe='')}{path}" if org_scoped else f"{base}/api/v1{path}"
-    r = _send(method, url, body, {**credential, **(headers or {})}, params)
+    r = _send(method, url, body, {**credential, **(headers or {})}, params, ipv4_only)
     if r.status_code == 401 and use_sso:
         # The access token was refused (the session may have ended on the server): refresh once and retry once.
         try:
             token = auth.fresh_access_token(issuer, rejected=token)
         except auth.AuthError as ex:
             raise ApiError(str(ex), 401)
-        r = _send(method, url, body, {"Authorization": f"Bearer {token}", **(headers or {})}, params)
+        r = _send(method, url, body, {"Authorization": f"Bearer {token}", **(headers or {})}, params,
+                  ipv4_only)
     try:
         data = r.json() if r.text else {}
     except ValueError:

{multicloud_cli-0.2.0 → multicloud_cli-0.3.0}/multicloud_cli/main.py

@@ -10,7 +10,9 @@ from .auth import auth
 from .catalog import catalog
 from .cloud_account import cloud_account
 from .extend import extend, peering
+from .node import node
 from .pool import pool
+from .ssh import ssh
 
 
 def _broken_pipe() -> int:
@@ -55,6 +57,8 @@ mctl.add_command(overview)
 mctl.add_command(billing)
 mctl.add_command(extend)
 mctl.add_command(peering)
+mctl.add_command(ssh)
+mctl.add_command(node)
 
 
 def _run() -> int:

multicloud_cli-0.3.0/multicloud_cli/net.py

@@ -0,0 +1,30 @@
+"""Every HTTP request of ``mctl`` goes through ``request``, which adds ``User-Agent: mctl/<version>``."""
+from typing import Any
+
+import requests
+from requests.adapters import HTTPAdapter
+
+from . import __version__
+
+USER_AGENT = f"mctl/{__version__}"
+
+
+class IPv4Adapter(HTTPAdapter):
+    """Connects over IPv4 only. Binding the local end to ``0.0.0.0`` makes urllib3 skip every IPv6 (AAAA) address:
+    its socket cannot bind there, so the next address is tried."""
+
+    def init_poolmanager(self, connections, maxsize, block=False, **pool_kwargs):
+        pool_kwargs["source_address"] = ("0.0.0.0", 0)
+        super().init_poolmanager(connections, maxsize, block, **pool_kwargs)
+
+
+def request(method: str, url: str, ipv4_only: bool = False, **kw: Any) -> requests.Response:
+    """One request. ``ipv4_only`` connects over IPv4 only: the SSH grant routes read the address of the caller as
+    the API sees it, and ``api.multicloud.io`` has AAAA records."""
+    kw["headers"] = {"User-Agent": USER_AGENT, **(kw.get("headers") or {})}
+    if ipv4_only:
+        with requests.Session() as session:
+            session.mount("https://", IPv4Adapter())
+            session.mount("http://", IPv4Adapter())
+            return session.request(method, url, **kw)
+    return requests.request(method, url, **kw)

multicloud_cli-0.3.0/multicloud_cli/node.py

@@ -0,0 +1,60 @@
+"""``mctl node``: the nodes of the platform clusters, for operators.
+
+These commands call ``GET /api/v1/operator/nodes`` (not scoped to an organization). They need the SSO sign-in of
+an operator (realm role ``multicloud-admins``). ``mctl ssh NODE`` uses the same list.
+"""
+from typing import Any, Dict, List, Optional
+
+import click
+
+from . import api, exitcodes
+from .orgopt import org_group
+from .output import dump as _dump, echo as _echo, json_option, no_headers_option, quiet_option, run, table as _table
+
+
+class NodeError(exitcodes.CliError):
+    pass
+
+
+def fetch_nodes(org, cluster: Optional[str] = None) -> Dict[str, Any]:
+    """The answer of ``GET /operator/nodes``; ``cluster`` is a cluster id or slug."""
+    try:
+        return api.call("GET", org, "/operator/nodes", org_scoped=False, prefer_sso=True,
+                        params={"cluster": cluster} if cluster else None)
+    except api.ApiError as ex:
+        text = str(ex)
+        if ex.status == 403:
+            text += " (These commands need the multicloud-admins role.)"
+        raise NodeError(text, ex.exit_code)
+
+
+def format_nodes(nodes: List[Dict[str, Any]], headers: bool = True) -> str:
+    return _table(("NODE", "CLUSTER", "PROVIDER", "REGION", "IP", "STATUS"), [
+        (str(n.get("id")), str(n.get("cluster_slug") or n.get("cluster_id")), str(n.get("provider")),
+         str(n.get("region")), str(n.get("public_ip") or "-"), str(n.get("status"))) for n in nodes], headers)
+
+
+@click.group(cls=org_group("node_org"))
+@click.option("--org", default=None, help="Organization slug (default: MULTICLOUD_ORG)")
+@click.pass_context
+def node(ctx, org):
+    """List the nodes of the platform clusters (operators only; sign in first: mctl auth login)."""
+    ctx.ensure_object(dict)
+    ctx.obj["node_org"] = org
+
+
+@node.command("list")
+@click.option("--cluster", default=None, help="Only the nodes of this cluster (id or slug)")
+@json_option
+@quiet_option
+@no_headers_option
+@click.pass_context
+def list_nodes(ctx, cluster, as_json, quiet, no_headers):
+    """List nodes: node id, cluster, provider, region, public IP and status."""
+    data = run(ctx.obj.get("node_org"), lambda org: fetch_nodes(org, cluster), (NodeError,))
+    if as_json:
+        return _dump(data)
+    nodes = data.get("nodes", [])
+    if quiet:
+        return _echo("\n".join(str(n.get("id")) for n in nodes))
+    _echo(format_nodes(nodes, not no_headers))

multicloud_cli-0.3.0/multicloud_cli/ssh.py

@@ -0,0 +1,260 @@
+"""``mctl ssh``: open tcp/22 on the platform nodes for your own IP, and connect.
+
+These commands call ``/api/v1/ssh-access`` and ``/api/v1/operator/nodes`` (not scoped to an organization). They
+need the SSO sign-in of an operator (realm role ``multicloud-admins``). Every ssh-access call goes over IPv4
+only: the API takes the address of the caller from the connection, and ``api.multicloud.io`` has AAAA records,
+so an IPv6 connection would open a rule for an address that SSH never uses.
+``mctl ssh NODE`` finds your grant, opens or extends one when needed, waits for the firewall rule and runs ``ssh``.
+A ``NODE`` is a node id or a public IP (see ``mctl node list``).
+"""
+import os
+import socket
+import sys
+import time
+from datetime import datetime, timezone
+from typing import Any, Dict, List, Optional, Tuple
+
+import click
+
+from . import api, exitcodes
+from .duration import duration_option
+from .node import NodeError, fetch_nodes
+from .orgopt import org_group
+from .output import dump as _dump, echo as _echo, json_option, no_headers_option, plain as _plain, quiet_option, run, table as _table
+
+PORT = 22
+MIN_TTL_S, MAX_TTL_S = 300, 28800  # the API accepts 5 minutes to 8 hours
+REFRESH_BELOW_S = 30 * 60  # mctl ssh extends a grant that has this much time left or less
+WAIT_S, WAIT_EVERY_S, PROBE_S = 150, 5, 3.0
+DEFAULT_USER = "multicloud"
+_sleep = time.sleep  # tests patch these names
+_clock = time.monotonic
+
+
+class SshError(exitcodes.CliError):
+    pass
+
+
+def _stdin_is_tty() -> bool:
+    return sys.stdin.isatty()
+
+
+def _port_open(ip: str, port: int = PORT, timeout_s: float = PROBE_S) -> bool:
+    try:
+        with socket.create_connection((ip, port), timeout=timeout_s):
+            return True
+    except OSError:
+        return False
+
+
+def wait_for_port(ip: str, port: int = PORT, timeout_s: int = WAIT_S, every_s: int = WAIT_EVERY_S,
+                  note: Optional[str] = None) -> bool:
+    """Try a TCP connect (3 s timeout) every ``every_s`` seconds until it works or ``timeout_s`` passed.
+    ``note`` is printed to stderr once, after the first failed try."""
+    deadline = _clock() + timeout_s
+    noted = False
+    while True:
+        if _port_open(ip, port):
+            return True
+        if note and not noted:
+            click.echo(note, err=True)
+            noted = True
+        if _clock() >= deadline:
+            return False
+        _sleep(every_s)
+
+
+def _call(org, method: str, path: str, **kw) -> Dict[str, Any]:
+    """A grant call: always over IPv4."""
+    try:
+        return api.call(method, org, path, org_scoped=False, ipv4_only=True, prefer_sso=True, **kw)
+    except api.ApiError as ex:
+        text = str(ex)
+        if ex.status == 403:
+            text += " (These commands need the multicloud-admins role.)"
+        raise SshError(text, ex.exit_code)
+
+
+def _source(org) -> str:
+    data = _call(org, "GET", "/ssh-access/source")
+    source = str(data.get("source") or "")
+    if data.get("family", 4) != 4 or ":" in source or not source:
+        raise SshError(f"The API sees your address as '{source}', not as IPv4. SSH grants need an IPv4 source. "
+                       "Check your network: curl -4 https://checkip.amazonaws.com")
+    return source
+
+
+def _seconds_left(g: Dict[str, Any]) -> float:
+    try:
+        at = datetime.fromisoformat(str(g.get("expires_at")).replace("Z", "+00:00"))
+    except ValueError:
+        return 0
+    if at.tzinfo is None:
+        at = at.replace(tzinfo=timezone.utc)
+    return (at - datetime.now(timezone.utc)).total_seconds()
+
+
+def _scope(g: Dict[str, Any]) -> str:
+    return f"cluster {g['cluster_id']}" if g.get("cluster_id") is not None else "all platform clusters"
+
+
+def _cluster_id(org, ref: Optional[str]) -> Optional[int]:
+    """The id for ``--cluster``: a number as it is, a slug through the nodes of that cluster."""
+    if ref is None:
+        return None
+    if ref.isascii() and ref.isdigit():
+        return int(ref)
+    nodes = fetch_nodes(org, ref).get("nodes", [])
+    if not nodes:
+        raise SshError(f"No nodes found for cluster '{ref}', so its id is unknown. "
+                       "If the cluster exists, use its numeric id.", exitcodes.NOT_FOUND)
+    return int(nodes[0]["cluster_id"])
+
+
+class SshGroup(org_group("ssh_org")):
+    """A group whose first argument may be a node: ``mctl ssh 12`` runs the hidden ``connect`` command."""
+
+    def resolve_command(self, ctx, args):
+        if args and not args[0].startswith("-") and self.get_command(ctx, args[0]) is None:
+            return "connect", self.commands["connect"], args
+        return super().resolve_command(ctx, args)
+
+    def collect_usage_pieces(self, ctx):
+        return ["[OPTIONS] COMMAND [ARGS]...", "|", "NODE [-y] [-- SSH_ARGS]..."]
+
+
+@click.group(cls=SshGroup)
+@click.option("--org", default=None, help="Organization slug (default: MULTICLOUD_ORG)")
+@click.pass_context
+def ssh(ctx, org):
+    """Open SSH access to platform nodes and connect (operators only; sign in first: mctl auth login).
+
+    mctl ssh NODE [-y|--yes] [-- SSH_ARGS]... connects to a node (id or public IP from mctl node list).
+    It opens tcp/22 for your IP when needed, waits for the firewall rule, then runs ssh. Everything after --
+    goes to ssh. The grant calls use IPv4 only."""
+    ctx.ensure_object(dict)
+    ctx.obj["ssh_org"] = org
+
+
+def _run(ctx, fn):
+    return run(ctx.obj.get("ssh_org"), fn, (SshError, NodeError, api.ApiError))
+
+
+def _grant_text(row: Dict[str, Any]) -> str:
+    return f"grant {row.get('id')}: tcp/22 open for {row.get('cidr')} until {row.get('expires_at')} ({_scope(row)})"
+
+
+@ssh.command()
+@click.option("--for", "ttl", default="1h", show_default=True, callback=duration_option,
+              help="How long the rule lasts: 5m to 8h (30m, 1h, 90s)")
+@click.option("--cluster", default=None, help="Only this cluster (id or slug). Default: all platform clusters")
+@json_option
+@click.pass_context
+def allow(ctx, ttl, cluster, as_json):
+    """Open tcp/22 for your IP, or extend the grant you have."""
+    def go(org):
+        if not MIN_TTL_S <= ttl <= MAX_TTL_S:
+            raise SshError(f"--for must be between 5m and 8h, not {ttl} seconds.", exitcodes.USAGE)
+        return _call(org, "POST", "/ssh-access", body={"cluster_id": _cluster_id(org, cluster), "ttl_seconds": ttl})
+    data = _run(ctx, go)
+    if as_json:
+        return _dump(data)
+    click.echo(f"{'Extended' if data.get('_status') == 200 else 'Created'} {_grant_text(_plain(data))}")
+
+
+@ssh.command("list")
+@click.option("--include-expired", is_flag=True, help="Also the grants that ended in the last 7 days")
+@json_option
+@quiet_option
+@no_headers_option
+@click.pass_context
+def list_(ctx, include_expired, as_json, quiet, no_headers):
+    """List the active grants (all people, all kinds)."""
+    params = {"include_expired": "true"} if include_expired else None
+    data = _run(ctx, lambda org: _call(org, "GET", "/ssh-access", params=params))
+    if as_json:
+        return _dump(data)
+    grants = data.get("grants", [])
+    if quiet:
+        return _echo("\n".join(str(g.get("id")) for g in grants))
+    _echo(_table(("ID", "KIND", "CIDR", "CLUSTER", "CREATED_BY", "EXPIRES_AT"), [
+        (str(g.get("id")), str(g.get("kind")), str(g.get("cidr")),
+         str(g["cluster_id"]) if g.get("cluster_id") is not None else "-", str(g.get("created_by") or "-"),
+         str(g.get("expires_at"))) for g in grants], not no_headers))
+
+
+@ssh.command()
+@click.argument("grant_id", metavar="ID", type=int)
+@json_option
+@click.pass_context
+def revoke(ctx, grant_id, as_json):
+    """Revoke a grant. The firewall rule ends within about 2 minutes."""
+    data = _run(ctx, lambda org: _call(org, "DELETE", f"/ssh-access/{grant_id}"))
+    if as_json:
+        return _dump(data)
+    click.echo(f"Revoked grant {grant_id}.")
+
+
+def _find_node(org, ref: str) -> Dict[str, Any]:
+    nodes: List[Dict[str, Any]] = fetch_nodes(org).get("nodes", [])
+    found = [n for n in nodes if str(n.get("id")) == ref] or [n for n in nodes if n.get("public_ip") == ref]
+    if not found:
+        raise SshError(f"No node '{ref}'. Run: mctl node list", exitcodes.NOT_FOUND)
+    return found[0]
+
+
+def _exec(node: Dict[str, Any], extra: Tuple[str, ...]) -> None:
+    sys.stdout.flush()
+    sys.stderr.flush()
+    try:
+        os.execvp("ssh", ["ssh", f"{node.get('ssh_user') or DEFAULT_USER}@{node['public_ip']}", *extra])
+    except OSError as ex:
+        raise SshError(f"Could not run ssh: {ex}")
+
+
+def _connect(org, ref: str, yes: bool, extra: Tuple[str, ...]) -> None:
+    node = _find_node(org, ref)
+    ip = node.get("public_ip")
+    if not ip:
+        raise SshError(f"Node {node.get('id')} has no public IP yet (status: {node.get('status')}). "
+                       "Try again when the node is ready.")
+    cluster_id = node["cluster_id"]
+    source = _source(org)
+    grants = _call(org, "GET", "/ssh-access").get("grants", [])
+    mine = [g for g in grants if str(g.get("kind")).upper() == "OPERATOR" and g.get("cidr") == f"{source}/32"
+            and g.get("cluster_id") in (cluster_id, None)]
+    exact = [g for g in mine if g.get("cluster_id") == cluster_id]
+    if exact:
+        best = max(exact, key=_seconds_left)
+        grant_id = best["id"]
+        if _seconds_left(best) <= REFRESH_BELOW_S:
+            _call(org, "POST", "/ssh-access", body={"cluster_id": cluster_id})  # extends the same grant
+    elif mine and _port_open(ip, PORT):
+        # A grant for all platform clusters, and the port answers: the node is on a platform cluster.
+        return _exec(node, extra)
+    else:
+        # No grant, or only a grant for all platform clusters and the port is closed (a customer pool node).
+        slug = node.get("cluster_slug") or cluster_id
+        if not yes:
+            if not _stdin_is_tty():
+                raise SshError(f"Your IP {source} has no SSH access to {slug}. Run: "
+                               f"mctl ssh allow --cluster {cluster_id}   (then run this command again, "
+                               "or add --yes)", exitcodes.PENDING)
+            if not click.confirm(f"Your IP {source} has no SSH access to {slug}. "
+                                 f"Open tcp/22 for {source} for 1h?", default=True, err=True):
+                raise SshError("You answered no. No SSH access was opened.")
+        grant_id = _call(org, "POST", "/ssh-access", body={"cluster_id": cluster_id})["id"]
+    if not wait_for_port(ip, PORT, WAIT_S, WAIT_EVERY_S, note=f"waiting for the firewall rule (grant {grant_id})"):
+        raise SshError(f"tcp/22 on {ip} did not open within {WAIT_S} s (grant {grant_id}). The scheduler applies "
+                       f"grants about every minute. Run the command again in a minute.", exitcodes.PENDING)
+    _exec(node, extra)
+
+
+@ssh.command("connect", hidden=True)
+@click.argument("node_ref", metavar="NODE")
+@click.argument("ssh_args", nargs=-1, type=click.UNPROCESSED, metavar="[SSH_ARGS]...")
+@click.option("-y", "--yes", is_flag=True, help="Open tcp/22 without asking")
+@click.pass_context
+def connect(ctx, node_ref, ssh_args, yes):
+    """Connect to a node (id or public IP); put the ssh options after --."""
+    _run(ctx, lambda org: _connect(org, node_ref, yes, ssh_args))

{multicloud_cli-0.2.0 → multicloud_cli-0.3.0}/tests/test_catalog.py

@@ -5,7 +5,7 @@ import pytest
 import requests
 from click.testing import CliRunner
 
-from multicloud_cli import api, auth
+from multicloud_cli import api, auth, exitcodes
 from multicloud_cli.catalog import FILTERS
 from multicloud_cli.main import mctl
 
@@ -324,3 +324,31 @@ def test_a_stored_key_of_the_named_org_wins_over_sso_for_the_catalog(net, ring,
     monkeypatch.setattr(auth, "fresh_access_token", lambda issuer, **kw: "tok")
     assert invoke("--org", "acme", "providers").exit_code == 0
     assert net["calls"][-1][2]["headers"].get("X-API-Key") == "stored-key"
+
+
+def test_stored_key_wins_on_catalog_but_prefer_sso_keeps_the_token(net, ring, monkeypatch):
+    monkeypatch.delenv("MULTICLOUD_API_KEY")
+    token = sso_login(ring, monkeypatch)
+    auth.store_key("acme", "mca_stored")
+    api.call("GET", "acme", "/catalog/providers", org_scoped=False)
+    assert net["calls"][0][2]["headers"]["X-API-Key"] == "mca_stored"
+    api.call("GET", "acme", "/ssh-access", org_scoped=False, prefer_sso=True)
+    headers = net["calls"][1][2]["headers"]
+    assert headers["Authorization"] == f"Bearer {token}" and "X-API-Key" not in headers
+
+
+def test_prefer_sso_beats_the_env_key(net, ring, monkeypatch):
+    token = sso_login(ring, monkeypatch)  # MULTICLOUD_API_KEY stays set by the net fixture
+    api.call("GET", None, "/ssh-access", org_scoped=False, prefer_sso=True)
+    headers = net["calls"][0][2]["headers"]
+    assert headers["Authorization"] == f"Bearer {token}" and "X-API-Key" not in headers
+    api.call("GET", None, "/catalog/providers", org_scoped=False)
+    assert net["calls"][1][2]["headers"]["X-API-Key"] == "fake-key-0000"
+
+
+def test_prefer_sso_without_sso_login_asks_for_it(net, ring):
+    # MULTICLOUD_API_KEY stays set by the net fixture; an operator route never accepts it.
+    with pytest.raises(api.ApiError) as ex:
+        api.call("GET", None, "/ssh-access", org_scoped=False, prefer_sso=True)
+    assert "mctl auth login" in str(ex.value) and ex.value.exit_code == exitcodes.AUTH
+    assert net["calls"] == []

multicloud_cli-0.3.0/tests/test_ssh.py

@@ -0,0 +1,353 @@
+"""mctl ssh and mctl node: SSH access grants for operators. The API is faked at the ``api.call`` seam."""
+import json
+from datetime import datetime, timedelta, timezone
+
+import pytest
+import requests
+from click.testing import CliRunner
+
+from multicloud_cli import api, net
+from multicloud_cli import ssh as ssh_mod
+from multicloud_cli.main import mctl
+
+SOURCE = "46.116.212.65"
+NODE = {"id": 12, "cluster_id": 5, "cluster_slug": "platform-a", "provider": "aws", "region": "us-east-1",
+        "public_ip": "203.0.113.7", "status": "ready", "ssh_user": "ubuntu"}
+NODE_BARE = {"id": 13, "cluster_id": 5, "cluster_slug": "platform-a", "provider": "gce", "region": "europe-west4",
+             "public_ip": "203.0.113.8", "status": "ready", "ssh_user": None}
+NODE_NO_IP = {"id": 14, "cluster_id": 5, "cluster_slug": "platform-a", "provider": "aws", "region": "us-east-1",
+              "public_ip": None, "status": "provisioning", "ssh_user": None}
+
+
+def runner():
+    try:
+        return CliRunner(mix_stderr=False)
+    except TypeError:
+        return CliRunner()
+
+
+def iso(seconds_from_now):
+    return (datetime.now(timezone.utc) + timedelta(seconds=seconds_from_now)).isoformat()
+
+
+def grant(gid=7, cluster_id=5, left_s=7200, cidr=SOURCE + "/32", kind="OPERATOR"):
+    return {"id": gid, "kind": kind, "cidr": cidr, "cluster_id": cluster_id, "org_slug": None,
+            "created_by": "ada@example.test", "created_at": iso(-60), "expires_at": iso(left_s), "revoked_at": None}
+
+
+class FakeApi:
+    """Answers the routes of the ssh-access API in memory and records every call."""
+
+    def __init__(self):
+        self.calls = []
+        self.source = {"source": SOURCE, "family": 4}
+        self.grants = []
+        self.nodes = [NODE, NODE_BARE, NODE_NO_IP]
+        self.created = grant(gid=99, cluster_id=5, left_s=3600)
+
+    def posts(self):
+        return [c for c in self.calls if c[0] == "POST"]
+
+    def __call__(self, method, org, path, **kw):
+        self.calls.append((method, path, kw))
+        if path == "/ssh-access/source":
+            return {**self.source, "_status": 200}
+        if path == "/ssh-access" and method == "GET":
+            return {"grants": self.grants, "_status": 200}
+        if path == "/ssh-access" and method == "POST":
+            body = kw["body"]
+            return {**self.created, "cluster_id": body.get("cluster_id"), "_status": 201}
+        if path.startswith("/ssh-access/") and method == "DELETE":
+            return {**grant(gid=int(path.rsplit("/", 1)[1])), "revoked_at": iso(0), "_status": 200}
+        if path == "/operator/nodes":
+            wanted = (kw.get("params") or {}).get("cluster")
+            nodes = [n for n in self.nodes if wanted is None or wanted in (str(n["cluster_id"]), n["cluster_slug"])]
+            return {"nodes": nodes, "_status": 200}
+        raise AssertionError(f"unexpected call {method} {path}")
+
+
+@pytest.fixture
+def fake(monkeypatch):
+    f = FakeApi()
+    monkeypatch.setattr(api, "call", f)
+    state = {"probes": [True], "clock": 0.0, "slept": [], "exec": [], "tty": False}
+
+    def probe(ip, port=22, timeout_s=3.0):
+        state.setdefault("probed", []).append((ip, port))
+        return state["probes"].pop(0) if len(state["probes"]) > 1 else state["probes"][0]
+
+    def sleep(s):
+        state["slept"].append(s)
+        state["clock"] += s
+    monkeypatch.setattr(ssh_mod, "_port_open", probe)
+    monkeypatch.setattr(ssh_mod, "_sleep", sleep)
+    monkeypatch.setattr(ssh_mod, "_clock", lambda: state["clock"])
+    monkeypatch.setattr(ssh_mod.os, "execvp", lambda file, args: state["exec"].append((file, list(args))))
+    monkeypatch.setattr(ssh_mod, "_stdin_is_tty", lambda: state["tty"])
+    f.state = state
+    return f
+
+
+def invoke(*args, **kw):
+    return runner().invoke(mctl, list(args), **kw)
+
+
+# --- allow, list, revoke -----------------------------------------------------------------------------------------
+
+def test_allow_default_one_hour(fake):
+    r = invoke("ssh", "allow")
+    assert r.exit_code == 0, r.stderr
+    method, path, kw = fake.calls[0]
+    assert (method, path, kw["body"]) == ("POST", "/ssh-access", {"cluster_id": None, "ttl_seconds": 3600})
+    assert "99" in r.stdout and SOURCE + "/32" in r.stdout and fake.created["expires_at"] in r.stdout
+
+
+def test_allow_for_and_cluster_id(fake):
+    r = invoke("ssh", "allow", "--for", "2h", "--cluster", "5")
+    assert r.exit_code == 0, r.stderr
+    assert fake.calls[0][2]["body"] == {"cluster_id": 5, "ttl_seconds": 7200}
+
+
+def test_allow_cluster_slug_resolves_to_id(fake):
+    r = invoke("ssh", "allow", "--cluster", "platform-a")
+    assert r.exit_code == 0, r.stderr
+    assert fake.calls[0][:2] == ("GET", "/operator/nodes") and fake.calls[0][2]["params"] == {"cluster": "platform-a"}
+    assert fake.calls[1][2]["body"]["cluster_id"] == 5
+
+
+def test_allow_unknown_cluster_slug_is_not_found(fake):
+    r = invoke("ssh", "allow", "--cluster", "nope")
+    assert r.exit_code == 4 and "numeric id" in r.stderr and not fake.posts()
+
+
+@pytest.mark.parametrize("value", ["9h", "29000", "1m"])
+def test_for_over_eight_hours_is_usage_error(fake, value):
+    r = invoke("ssh", "allow", "--for", value)
+    assert r.exit_code == 2 and not fake.calls
+
+
+def test_allow_eight_hours_is_accepted(fake):
+    assert invoke("ssh", "allow", "--for", "8h").exit_code == 0
+    assert fake.calls[0][2]["body"]["ttl_seconds"] == 28800
+
+
+def test_allow_uses_ipv4_transport(fake):
+    fake.grants = [grant()]
+    assert invoke("ssh", "allow").exit_code == 0
+    assert invoke("ssh", "list").exit_code == 0
+    assert invoke("ssh", "revoke", "7").exit_code == 0
+    fake.state["tty"] = False
+    assert invoke("ssh", "12", "--yes").exit_code == 0
+    grant_calls = [c for c in fake.calls if c[1].startswith("/ssh-access")]
+    assert len(grant_calls) == 5
+    assert all(c[2].get("ipv4_only") is True for c in grant_calls), grant_calls
+
+
+def test_ipv4_adapter_binds_ipv4():
+    adapter = net.IPv4Adapter()
+    assert adapter.poolmanager.connection_pool_kw["source_address"] == ("0.0.0.0", 0)
+
+
+def test_api_call_passes_ipv4_only_to_the_transport(monkeypatch):
+    from .helpers import reply
+    monkeypatch.setenv("MULTICLOUD_API_KEY", "fake-key-0000")
+    seen = []
+    monkeypatch.setattr(net, "request", lambda m, u, **kw: seen.append(kw) or reply(200, {"source": SOURCE}))
+    api.call("GET", None, "/ssh-access/source", org_scoped=False, ipv4_only=True)
+    api.call("GET", None, "/operator/nodes", org_scoped=False)
+    assert [kw["ipv4_only"] for kw in seen] == [True, False]
+
+
+def test_net_request_ipv4_only_uses_the_adapter(monkeypatch):
+    seen = {}
+
+    def session_request(self, method, url, **kw):
+        seen["adapter"] = self.get_adapter(url)
+        seen["kw"] = kw
+        return "r"
+    monkeypatch.setattr(requests.Session, "request", session_request)
+    monkeypatch.setattr(requests, "request", lambda *a, **kw: pytest.fail("plain path used"))
+    assert net.request("GET", "https://api.multicloud.io/x", ipv4_only=True, timeout=1) == "r"
+    assert isinstance(seen["adapter"], net.IPv4Adapter) and "ipv4_only" not in seen["kw"]
+    assert seen["kw"]["headers"]["User-Agent"] == net.USER_AGENT
+
+
+def test_list_table(fake):
+    fake.grants = [grant(gid=7, cluster_id=5), grant(gid=8, cluster_id=None, kind="OPERATOR")]
+    r = invoke("ssh", "list")
+    assert r.exit_code == 0, r.stderr
+    lines = r.stdout.splitlines()
+    assert lines[0].split() == ["ID", "KIND", "CIDR", "CLUSTER", "CREATED_BY", "EXPIRES_AT"]
+    assert lines[1].split()[:5] == ["7", "OPERATOR", SOURCE + "/32", "5", "ada@example.test"]
+    assert lines[2].split()[3] == "-"
+    assert fake.calls[0][2].get("params") in (None, {})
+
+
+def test_list_include_expired_and_json(fake):
+    fake.grants = [grant()]
+    r = invoke("ssh", "list", "--include-expired", "--json")
+    assert fake.calls[0][2]["params"] == {"include_expired": "true"}
+    assert json.loads(r.stdout) == {"grants": fake.grants}
+
+
+def test_revoke(fake):
+    r = invoke("ssh", "revoke", "7")
+    assert r.exit_code == 0, r.stderr
+    assert fake.calls[0][:2] == ("DELETE", "/ssh-access/7") and "7" in r.stdout
+
+
+def test_revoke_forbidden_is_exit_3(fake, monkeypatch):
+    def forbidden(method, org, path, **kw):
+        raise api.ApiError("multicloud-admins role needed", 403)
+    monkeypatch.setattr(api, "call", forbidden)
+    r = invoke("ssh", "revoke", "7")
+    assert r.exit_code == 3 and "multicloud-admins" in r.stderr
+
+
+# --- mctl ssh NODE -----------------------------------------------------------------------------------------------
+
+def test_ssh_node_refreshes_when_less_than_30_min_left(fake):
+    fake.grants = [grant(gid=7, cluster_id=5, left_s=600)]
+    r = invoke("ssh", "12")
+    assert r.exit_code == 0, r.stderr
+    assert [c[2]["body"] for c in fake.posts()] == [{"cluster_id": 5}]
+    assert fake.state["exec"] == [("ssh", ["ssh", "ubuntu@203.0.113.7"])]
+
+
+def test_ssh_node_skips_refresh_when_fresh(fake):
+    fake.grants = [grant(gid=7, cluster_id=5, left_s=7200)]
+    r = invoke("ssh", "12")
+    assert r.exit_code == 0, r.stderr
+    assert not fake.posts() and fake.state["exec"]
+
+
+def test_ssh_node_no_grant_prompts_then_creates(fake):
+    fake.state["tty"] = True
+    fake.state["probes"] = [True]
+    r = invoke("ssh", "12", input="y\n")
+    assert r.exit_code == 0, r.stderr
+    assert f"Your IP {SOURCE} has no SSH access to platform-a. Open tcp/22 for {SOURCE} for 1h?" in r.stderr
+    assert [c[2]["body"] for c in fake.posts()] == [{"cluster_id": 5}]
+    assert fake.state["probed"] == [("203.0.113.7", 22)] and fake.state["exec"]
+
+
+def test_ssh_node_no_grant_declined_exits_without_post(fake):
+    fake.state["tty"] = True
+    r = invoke("ssh", "12", input="n\n")
+    assert r.exit_code == 1 and not fake.posts() and not fake.state["exec"]
+
+
+def test_ssh_node_no_tty_no_yes_exits_pending_with_hint(fake):
+    r = invoke("ssh", "12")
+    assert r.exit_code == 5 and "mctl ssh allow --cluster 5" in r.stderr
+    assert not fake.posts() and not fake.state["exec"]
+
+
+def test_ssh_node_yes_flag_skips_prompt(fake):
+    r = invoke("ssh", "12", "-y")
+    assert r.exit_code == 0, r.stderr
+    assert "Open tcp/22" not in r.stderr + r.stdout
+    assert [c[2]["body"] for c in fake.posts()] == [{"cluster_id": 5}] and fake.state["exec"]
+
+
+def test_ssh_node_by_public_ip(fake):
+    fake.grants = [grant(cluster_id=5)]
+    r = invoke("ssh", "203.0.113.8")
+    assert r.exit_code == 0, r.stderr
+    assert fake.state["exec"][0][1] == ["ssh", "multicloud@203.0.113.8"]
+
+
+def test_grant_for_other_ip_does_not_count(fake):
+    fake.grants = [grant(cluster_id=5, cidr="198.51.100.9/32"), grant(gid=8, cluster_id=None, cidr="198.51.100.9/32")]
+    r = invoke("ssh", "12", "--yes")
+    assert r.exit_code == 0, r.stderr
+    assert len(fake.posts()) == 1 and fake.posts()[0][2]["body"] == {"cluster_id": 5}
+
+
+def test_grant_of_another_cluster_or_kind_does_not_count(fake):
+    fake.grants = [grant(cluster_id=6), grant(gid=8, cluster_id=5, kind="CI")]
+    r = invoke("ssh", "12", "--yes")
+    assert r.exit_code == 0, r.stderr
+    assert len(fake.posts()) == 1
+
+
+def test_null_cluster_grant_used_when_port_answers(fake):
+    fake.grants = [grant(cluster_id=None)]
+    fake.state["probes"] = [True]
+    r = invoke("ssh", "12")
+    assert r.exit_code == 0, r.stderr
+    assert not fake.posts() and fake.state["exec"] and fake.state["probed"] == [("203.0.113.7", 22)]
+
+
+def test_null_cluster_grant_unreachable_opens_cluster_grant(fake):
+    fake.grants = [grant(cluster_id=None)]
+    fake.state["probes"] = [False, True]  # the probe fails, then the port opens after the new grant
+    r = invoke("ssh", "12", "--yes")
+    assert r.exit_code == 0, r.stderr
+    assert [c[2]["body"] for c in fake.posts()] == [{"cluster_id": 5}] and fake.state["exec"]
+
+
+def test_ssh_node_execs_ssh_with_ssh_user(fake):
+    fake.grants = [grant(cluster_id=5)]
+    r = invoke("ssh", "12", "--", "-v", "-L", "8080:localhost:80")
+    assert r.exit_code == 0, r.stderr
+    assert fake.state["exec"] == [("ssh", ["ssh", "ubuntu@203.0.113.7", "-v", "-L", "8080:localhost:80"])]
+    fake.state["exec"].clear()
+    invoke("ssh", "13")
+    assert fake.state["exec"] == [("ssh", ["ssh", "multicloud@203.0.113.8"])]
+
+
+def test_ssh_node_timeout_exit_pending(fake):
+    fake.grants = [grant(cluster_id=5)]
+    fake.state["probes"] = [False]
+    r = invoke("ssh", "12")
+    assert r.exit_code == 5 and not fake.state["exec"]
+    assert "waiting for the firewall rule (grant 7)" in r.stderr and r.stderr.count("waiting for the firewall") == 1
+    assert fake.state["clock"] >= 150 and set(fake.state["slept"]) == {5}
+
+
+def test_unknown_node_exit_not_found(fake):
+    r = invoke("ssh", "999")
+    assert r.exit_code == 4 and not [c for c in fake.calls if c[1].startswith("/ssh-access")]
+
+
+def test_node_without_public_ip_is_an_error(fake):
+    r = invoke("ssh", "14")
+    assert r.exit_code == 1 and "public IP" in r.stderr and not fake.posts()
+
+
+def test_non_ipv4_source_is_refused(fake):
+    fake.source = {"source": "2001:db8::1", "family": 6}
+    r = invoke("ssh", "12", "--yes")
+    assert r.exit_code == 1 and "IPv4" in r.stderr and not fake.posts()
+
+
+def test_wait_for_port_returns_true_when_it_opens(fake):
+    fake.state["probes"] = [False, False, True]
+    assert ssh_mod.wait_for_port("203.0.113.7", note="waiting") is True
+    assert fake.state["slept"] == [5, 5]
+
+
+def test_ssh_group_help_lists_subcommands_and_node_usage():
+    r = invoke("ssh", "--help")
+    assert r.exit_code == 0
+    for word in ("allow", "list", "revoke", "NODE"):
+        assert word in r.stdout
+
+
+# --- mctl node ---------------------------------------------------------------------------------------------------
+
+def test_node_list_table(fake):
+    r = invoke("node", "list")
+    assert r.exit_code == 0, r.stderr
+    lines = r.stdout.splitlines()
+    assert lines[0].split() == ["NODE", "CLUSTER", "PROVIDER", "REGION", "IP", "STATUS"]
+    assert lines[1].split() == ["12", "platform-a", "aws", "us-east-1", "203.0.113.7", "ready"]
+    assert lines[3].split()[4] == "-"
+
+
+def test_node_list_cluster_filter_and_json(fake):
+    r = invoke("node", "list", "--cluster", "platform-a", "--json")
+    assert fake.calls[0][2]["params"] == {"cluster": "platform-a"}
+    assert len(json.loads(r.stdout)["nodes"]) == 3
+    assert invoke("node", "list", "-q").stdout == "12\n13\n14\n"

multicloud_cli-0.2.0/multicloud_cli/__init__.py

@@ -1 +0,0 @@
-__version__ = "0.2.0"

multicloud_cli-0.2.0/multicloud_cli/net.py

@@ -1,13 +0,0 @@
-"""Every HTTP request of ``mctl`` goes through ``request``, which adds ``User-Agent: mctl/<version>``."""
-from typing import Any
-
-import requests
-
-from . import __version__
-
-USER_AGENT = f"mctl/{__version__}"
-
-
-def request(method: str, url: str, **kw: Any) -> requests.Response:
-    kw["headers"] = {"User-Agent": USER_AGENT, **(kw.get("headers") or {})}
-    return requests.request(method, url, **kw)