ocmo-cli 0.8.19__py3-none-any.whl

ocmo_cli/commands/can_i.py

@@ -0,0 +1,51 @@
+"""ocmo can-i — check permissions."""
+
+from __future__ import annotations
+
+import sys
+
+import click
+
+from .._client import OcmoCtx
+from .._errors import sdk_command
+from .._options import can_i_output_option, namespace_option
+from .._output import as_dict
+from .._output_manifest import emit_command_output
+
+
+@click.command(
+    "can-i",
+    help="Check whether the current principal may perform one or more operations.",
+)
+@click.argument("operations", nargs=-1, required=True, metavar="OPERATION...")
+@namespace_option()
+@can_i_output_option()
+@click.option("--resource", default=None, help="Tree path for in-namespace permission probes.")
+@click.pass_obj
+@sdk_command
+def can_i_cmd(
+    ctx: OcmoCtx,
+    operations: tuple[str, ...],
+    namespace: str | None,
+    output_fmt: str | None,
+    resource: str | None,
+) -> None:
+    """Examples:
+
+    ocmo can-i config:read config:write -n prod
+    ocmo can-i secret:read --namespace prod --resource app/db
+    """
+    ns = namespace or ctx.namespace
+    result = ctx.client().can_i(
+        operations=list(operations),
+        namespace=ns,
+        resource=resource,
+    )
+    data = as_dict(result)
+    emit_command_output("can-i", data, output_fmt, ctx_fmt=ctx.output)
+    allowed = data.get("allowed")
+    if isinstance(allowed, dict):
+        if not all(allowed.values()):
+            sys.exit(4)
+    elif not allowed:
+        sys.exit(4)

ocmo_cli/commands/completion.py

@@ -0,0 +1,59 @@
+"""ocmo completion — emit shell completion scripts.
+
+Completion works offline (no network required).
+"""
+
+from __future__ import annotations
+
+import os
+
+import click
+from click.shell_completion import get_completion_class
+
+_SHELLS = ("bash", "zsh", "fish")
+
+
+@click.command("completion")
+@click.argument("shell", type=click.Choice(list(_SHELLS)), required=False)
+def completion_cmd(shell: str | None) -> None:
+    """Emit a shell completion script.
+
+    \b
+    Usage:
+      # bash
+      source <(ocmo completion bash)
+
+      # zsh
+      source <(ocmo completion zsh)
+
+      # fish
+      ocmo completion fish | source
+    """
+    if not shell:
+        detected = _detect_shell()
+        if detected:
+            shell = detected
+        else:
+            raise click.UsageError(f"SHELL is required. Valid options: {', '.join(_SHELLS)}")
+
+    comp_cls = get_completion_class(shell)
+    if comp_cls is None:
+        raise click.UsageError(f"Unsupported shell: {shell}")
+
+    from ocmo_cli.main import cli
+
+    env_var = f"_{_prog_name().upper()}_COMPLETE"
+    comp = comp_cls(cli, ctx_args={}, prog_name=_prog_name(), complete_var=env_var)
+    click.echo(comp.source(), nl=False)
+
+
+def _detect_shell() -> str | None:
+    shell_path = os.environ.get("SHELL", "")
+    for s in _SHELLS:
+        if s in shell_path:
+            return s
+    return None
+
+
+def _prog_name() -> str:
+    return "ocmo"

ocmo_cli/commands/config_cmd.py

@@ -0,0 +1,235 @@
+"""ocmo config — manage the local configuration file and contexts."""
+
+from __future__ import annotations
+
+from typing import Any
+
+import click
+
+from .._auth_resolve import ensure_auth_entry
+from .._click_groups import ConfigPathHelpGroup
+from .._config import (
+    Context,
+    format_config_path_note,
+    load_config,
+    save_config,
+)
+from .._output import err
+
+_SETTABLE_CONTEXT_KEYS = ("server", "namespace", "token-file", "auth")
+
+_CONFIG_HELP = """\
+Manage local CLI configuration (server, contexts, auth).
+"""
+
+
+@click.group("config", cls=ConfigPathHelpGroup, help=_CONFIG_HELP)
+def config_group() -> None:
+    """Manage local CLI configuration (server, contexts, auth)."""
+
+
+@config_group.command("view")
+@click.option(
+    "--show-secrets", is_flag=True, default=False, help="Show credential fields (CAUTION: may expose secrets)."
+)
+def view_cmd(show_secrets: bool) -> None:
+    """Print the current configuration file, redacting credentials by default."""
+    import yaml  # deferred
+
+    cfg = load_config()
+    raw: dict[str, Any] = {
+        "current-context": cfg.current_context,
+        "contexts": {},
+        "auths": {},
+    }
+    for name, ctx in cfg.contexts.items():
+        raw["contexts"][name] = {
+            "server": ctx.server,
+            "namespace": ctx.namespace,
+            "auth": ctx.auth,
+        }
+        if ctx.token_file:
+            raw["contexts"][name]["token-file"] = ctx.token_file
+
+    for name, auth in cfg.auths.items():
+        entry: dict[str, Any] = {"mode": auth.mode}
+        if auth.issuer:
+            entry["issuer"] = auth.issuer
+        if auth.client_id:
+            entry["client_id"] = auth.client_id
+        if show_secrets:
+            if auth.client_secret:
+                entry["client_secret"] = auth.client_secret
+            if auth.token:
+                entry["token"] = auth.token
+        else:
+            if auth.client_secret:
+                entry["client_secret"] = "***REDACTED***"
+            if auth.token:
+                entry["token"] = "***REDACTED***"
+        if auth.client_secret_file:
+            entry["client_secret_file"] = auth.client_secret_file
+        if auth.token_file:
+            entry["token_file"] = auth.token_file
+        raw["auths"][name] = entry
+
+    print(yaml.safe_dump(raw, default_flow_style=False), end="")
+    print(f"\n# {format_config_path_note()}")
+
+
+@config_group.command("get-contexts")
+def get_contexts_cmd() -> None:
+    """List available contexts."""
+    cfg = load_config()
+    if not cfg.contexts:
+        print("No contexts configured.")
+        return
+    current = cfg.current_context
+    for name, ctx in cfg.contexts.items():
+        marker = "*" if name == current else " "
+        print(f"{marker} {name:20s}  {ctx.server:40s}  {ctx.namespace}")
+
+
+@config_group.command("current-context")
+def current_context_cmd() -> None:
+    """Print the name of the current context."""
+    cfg = load_config()
+    print(cfg.current_context or "(none)")
+
+
+@config_group.command("current-ns")
+def current_ns_cmd() -> None:
+    """Print the effective namespace (OCMO_NAMESPACE or current context)."""
+    cfg = load_config()
+    print(cfg.namespace() or "(none)")
+
+
+@config_group.command("use-context")
+@click.argument("name")
+def use_context_cmd(name: str) -> None:
+    """Set the current context."""
+    cfg = load_config()
+    if name not in cfg.contexts:
+        available = list(cfg.contexts)
+        err(
+            f"Context {name!r} not found. "
+            + (f"Available: {', '.join(available)}" if available else "No contexts configured.")
+        )
+        raise SystemExit(1)
+    cfg.current_context = name
+    save_config(cfg)
+    print(f"Switched to context {name!r}.")
+
+
+@config_group.command("set-context")
+@click.argument("name")
+@click.option("--server", default=None)
+@click.option("--namespace", default=None)
+@click.option("--auth", default=None)
+@click.option("--token-file", default=None)
+def set_context_cmd(
+    name: str,
+    server: str | None,
+    namespace: str | None,
+    auth: str | None,
+    token_file: str | None,
+) -> None:
+    """Create or update a named context."""
+    cfg = load_config()
+    ctx = cfg.contexts.get(name, Context())
+    if server:
+        ctx.server = server
+    if namespace:
+        ctx.namespace = namespace
+    if auth:
+        ctx.auth = auth
+        ensure_auth_entry(cfg, auth)
+    if token_file:
+        ctx.token_file = token_file
+    cfg.contexts[name] = ctx
+    save_config(cfg)
+    print(f"Context {name!r} updated.")
+
+
+@config_group.command("set-auth")
+@click.argument("name")
+@click.option("--mode", default=None, help="Auth mode (default: oidc).")
+@click.option("--issuer", default=None, help="OIDC issuer URL.")
+@click.option("--client-id", default=None, help="OIDC client ID.")
+@click.option("--client-secret", default=None, help="OIDC client secret (inline).")
+@click.option("--client-secret-file", default=None, help="Path to OIDC client secret file.")
+@click.option("--token", default=None, help="Bearer or resolver token (inline).")
+@click.option("--token-file", default=None, help="Path to bearer/resolver token file.")
+def set_auth_cmd(
+    name: str,
+    mode: str | None,
+    issuer: str | None,
+    client_id: str | None,
+    client_secret: str | None,
+    client_secret_file: str | None,
+    token: str | None,
+    token_file: str | None,
+) -> None:
+    """Create or update a named auth block.
+
+    ``issuer`` and ``client_id`` are optional in the config file; at runtime they
+    are resolved from environment variables or ``GET /api/version`` for the context
+    server when unset.
+    """
+    cfg = load_config()
+    entry = ensure_auth_entry(cfg, name, mode=mode or "oidc")
+    if mode:
+        entry.mode = mode
+    if issuer is not None:
+        entry.issuer = issuer
+    if client_id is not None:
+        entry.client_id = client_id
+    if client_secret is not None:
+        entry.client_secret = client_secret
+    if client_secret_file is not None:
+        entry.client_secret_file = client_secret_file
+    if token is not None:
+        entry.token = token
+    if token_file is not None:
+        entry.token_file = token_file
+    cfg.auths[name] = entry
+    save_config(cfg)
+    print(f"Auth {name!r} updated.")
+
+
+@config_group.command("set")
+@click.argument("key", type=click.Choice(list(_SETTABLE_CONTEXT_KEYS)))
+@click.argument("value")
+def set_cmd(key: str, value: str) -> None:
+    """Set a field in the current context.
+
+    \b
+    Supported keys:
+      server       — API base URL
+      namespace    — default namespace for -n
+      token-file   — path to a resolver or bearer token file
+      auth         — name of an auths: entry to attach
+    """
+    cfg = load_config()
+    if not cfg.current_context:
+        # Create a default context
+        cfg.current_context = "default"
+        if "default" not in cfg.contexts:
+            cfg.contexts["default"] = Context()
+
+    ctx_name = cfg.current_context
+    ctx = cfg.contexts.get(ctx_name, Context())
+
+    if key == "server":
+        ctx.server = value
+    elif key == "namespace":
+        ctx.namespace = value
+    elif key == "token-file":
+        ctx.token_file = value
+    elif key == "auth":
+        ctx.auth = value
+        ensure_auth_entry(cfg, value)
+
+    cfg.contexts[ctx_name] = ctx
+    save_config(cfg)
+    print(f"Set {key} = {value!r} in context {ctx_name!r}.")

ocmo_cli/commands/describe.py

@@ -0,0 +1,109 @@
+"""ocmo describe — read or set an item's description.
+
+Read: no --description flag → fetch and print description to stdout.
+Write: --description flag → POST description to the API.
+"""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+import click
+
+from .._address import parse_address_or_exit
+from .._client import OcmoCtx
+from .._errors import sdk_command
+from .._mutating import run_mutating
+from .._options import namespace_option, yes_option
+from .._output import as_dict
+
+_DESCRIBE_HELP = """\
+Read or set the Markdown description of a tree item.
+
+Without --description, prints the current description. With --description, replaces it.
+
+\b
+Examples:
+  ocmo -n prod describe app/web
+  ocmo -n prod describe app/web --description "Production web config"
+  ocmo -n prod describe app/web --description ./NOTES.md
+  echo "My description" | ocmo -n prod describe app/web --description -
+"""
+
+
+def resolve_description_value(value: str) -> str:
+    """Resolve --description to text from a literal, stdin, or file path."""
+    if value == "-":
+        return sys.stdin.read()
+    if value.startswith("/") or value.startswith("."):
+        return Path(value).read_text(encoding="utf-8")
+    return value
+
+
+@click.command("describe", help=_DESCRIBE_HELP)
+@click.argument("address")
+@click.option(
+    "--description",
+    "description_value",
+    default=None,
+    metavar="TEXT|-|PATH",
+    help=("New description text, '-' for stdin, or a file path starting with '/' or '.'."),
+)
+@namespace_option()
+@yes_option(help="Skip overwrite confirmation.")
+@click.pass_obj
+@sdk_command
+def describe_cmd(
+    ctx: OcmoCtx,
+    address: str,
+    description_value: str | None,
+    namespace: str | None,
+    yes: bool,
+) -> None:
+    """Read or set the description of a tree item.
+
+    \b
+    Read (no --description):
+      ocmo -n prod describe app/web
+
+    Write (--description):
+      ocmo -n prod describe app/web --description "Notes for operators"
+      ocmo -n prod describe app/web --description ./NOTES.md
+      ocmo -n prod describe app/web --description -   # from stdin
+    """
+    path, _version = parse_address_or_exit(address)
+
+    view = ctx.namespace_view(namespace)
+
+    if description_value is not None:
+        content = resolve_description_value(description_value)
+        ns = ctx.require_namespace(namespace)
+
+        from .._dry_run import format_describe_dry_run  # deferred
+
+        def _action() -> None:
+            view.describe_item(path=path, description=content)
+            print(f"Description updated for {path!r}.")
+
+        run_mutating(
+            ctx,
+            dry_run=False,
+            yes=yes,
+            plan_lines=[
+                format_describe_dry_run(
+                    path=path,
+                    namespace=ns,
+                    char_count=len(content),
+                )
+            ],
+            confirm_message=f"Overwrite description for {path!r}?",
+            action=_action,
+            abort_exit_code=1,
+            abort_via_err=True,
+        )
+    else:
+        item = view.get_item(path=path)
+        data = as_dict(item)
+        description = data.get("description") or ""
+        print(description, end="" if description.endswith("\n") else "\n")

ocmo_cli/commands/diff.py

@@ -0,0 +1,86 @@
+"""ocmo diff — coloured unified diff between two versions or two items."""
+
+from __future__ import annotations
+
+import sys
+
+import click
+
+from .._address import AddressError
+from .._client import OcmoCtx
+from .._diff_input import diff_sdk_kwargs, parse_diff_spec, render_diff_response
+from .._errors import sdk_command
+from .._exit import USAGE_ERROR
+from .._options import namespace_option, tree_version_option
+
+
+@click.command("diff")
+@click.argument("addresses", nargs=-1, required=True)
+@tree_version_option()
+@click.option("--from-version", default=None, metavar="VER", help="Left-side version or tag.")
+@click.option("--to-version", default=None, metavar="VER", help="Right-side version or tag.")
+@click.option(
+    "--reveal",
+    is_flag=True,
+    default=False,
+    help="Decrypt secret values for diff (requires secret:read).",
+)
+@namespace_option()
+@click.pass_obj
+@sdk_command
+def diff_cmd(
+    ctx: OcmoCtx,
+    addresses: tuple[str, ...],
+    version_flag: str | None,
+    from_version: str | None,
+    to_version: str | None,
+    reveal: bool,
+    namespace: str | None,
+) -> None:
+    """Show a unified diff between two versions or two items.
+
+    \b
+    Examples:
+      ocmo -n prod diff app/web
+      ocmo -n prod diff app/web@2..13
+      ocmo -n prod diff app/web --from-version 3 --to-version 5
+      ocmo -n prod diff app/web@2 app/staging/web@14
+    """
+    try:
+        spec = parse_diff_spec(
+            addresses,
+            version_flag=version_flag,
+            from_version=from_version,
+            to_version=to_version,
+        )
+    except AddressError as e:
+        print(f"Error: {e}", file=sys.stderr)
+        raise SystemExit(USAGE_ERROR)
+
+    path, kwargs = diff_sdk_kwargs(spec, reveal=reveal)
+    result = ctx.namespace_view(namespace).diff_item(path=path, **kwargs)
+
+    if getattr(result, "decryption_required", False):
+        print(
+            "Error: secret diff requires --reveal to compare decrypted values.",
+            file=sys.stderr,
+        )
+        raise SystemExit(USAGE_ERROR)
+
+    diff_text = render_diff_response(result)
+    if sys.stdout.isatty():
+        _print_coloured_diff(diff_text)
+    else:
+        print(diff_text, end="" if diff_text.endswith("\n") else "\n")
+
+
+def _print_coloured_diff(text: str) -> None:
+    try:
+        from rich.console import Console
+        from rich.syntax import Syntax
+
+        console = Console()
+        syntax = Syntax(text, "diff", theme="monokai", line_numbers=False)
+        console.print(syntax)
+    except ImportError:
+        print(text, end="" if text.endswith("\n") else "\n")