pcf-toolkit 0.2.5__py3-none-any.whl → 0.2.6__py3-none-any.whl

pcf_toolkit/proxy/cli.py

@@ -43,7 +43,7 @@ from pcf_toolkit.proxy.config import (
     render_dist_path,
     write_default_config,
 )
-from pcf_toolkit.proxy.doctor import CheckResult, run_doctor
+from pcf_toolkit.proxy.doctor import CheckResult, check_mitmproxy_certificate, run_doctor
 from pcf_toolkit.proxy.mitm import ensure_mitmproxy, find_mitmproxy, spawn_mitmproxy
 from pcf_toolkit.proxy.server import spawn_http_server
 from pcf_toolkit.rich_help import RichTyperCommand, RichTyperGroup
@@ -365,6 +365,9 @@ def start(
             creationflags=creationflags,
         )
 
+    if not detach:
+        _maybe_prompt_for_cert_trust()
+
     if log_handle is not None:
         log_handle.close()
 
@@ -546,9 +549,84 @@ def _apply_fixes(results: list[CheckResult], config: ProxyConfig) -> None:
             except Exception as exc:  # noqa: BLE001
                 typer.secho(f"Failed to install mitmproxy: {exc}", fg=typer.colors.RED)
         if result.name == "mitmproxy_cert" and result.status == "warn":
+            if _is_interactive() and _supports_cert_install():
+                if typer.confirm(
+                    "Install mitmproxy CA into the system trust store? This requires sudo.",
+                    default=False,
+                ):
+                    _install_mitmproxy_cert()
+                    continue
             typer.secho(result.fix or "", fg=typer.colors.YELLOW)
 
 
+def _supports_cert_install() -> bool:
+    return sys.platform == "darwin" or sys.platform.startswith("linux")
+
+
+def _maybe_prompt_for_cert_trust() -> None:
+    cert_result = check_mitmproxy_certificate()
+    if cert_result.status == "ok":
+        return
+
+    typer.secho(f"[{cert_result.status.upper()}] {cert_result.name}: {cert_result.message}", fg=typer.colors.YELLOW)
+    if _is_interactive() and _supports_cert_install():
+        if typer.confirm(
+            "Install mitmproxy CA into the system trust store? This requires sudo.",
+            default=False,
+        ):
+            _install_mitmproxy_cert()
+            return
+    if cert_result.fix:
+        typer.secho(cert_result.fix, fg=typer.colors.YELLOW)
+
+
+def _install_mitmproxy_cert() -> None:
+    cert_path = Path.home() / ".mitmproxy" / "mitmproxy-ca-cert.pem"
+    if not cert_path.exists():
+        typer.secho("mitmproxy CA cert not found. Run the proxy once to generate it.", fg=typer.colors.RED)
+        return
+
+    if sys.platform == "darwin":
+        _run_privileged(
+            [
+                "sudo",
+                "security",
+                "add-trusted-cert",
+                "-d",
+                "-r",
+                "trustRoot",
+                "-k",
+                "/Library/Keychains/System.keychain",
+                str(cert_path),
+            ],
+            "Trusting mitmproxy CA in System Keychain...",
+        )
+        return
+
+    if sys.platform.startswith("linux"):
+        if shutil.which("update-ca-certificates"):
+            target = Path("/usr/local/share/ca-certificates/mitmproxy-ca-cert.crt")
+            _run_privileged(["sudo", "cp", str(cert_path), str(target)], "Copying cert into CA store...")
+            _run_privileged(["sudo", "update-ca-certificates"], "Updating CA certificates...")
+            return
+        if shutil.which("update-ca-trust"):
+            target = Path("/etc/pki/ca-trust/source/anchors/mitmproxy-ca-cert.pem")
+            _run_privileged(["sudo", "cp", str(cert_path), str(target)], "Copying cert into CA trust anchors...")
+            _run_privileged(["sudo", "update-ca-trust", "extract"], "Updating CA trust...")
+            return
+
+    typer.secho("Automatic install not supported on this platform.", fg=typer.colors.YELLOW)
+
+
+def _run_privileged(command: list[str], message: str) -> None:
+    typer.secho(message, fg=typer.colors.CYAN)
+    try:
+        subprocess.run(command, check=True)
+        typer.secho("Done.", fg=typer.colors.GREEN)
+    except subprocess.CalledProcessError as exc:
+        typer.secho(f"Command failed: {exc}", fg=typer.colors.RED)
+
+
 def _print_results(results: list[CheckResult]) -> None:
     """Prints doctor check results with color coding.
 

pcf_toolkit/proxy/doctor.py

@@ -3,7 +3,9 @@
 from __future__ import annotations
 
 import os
+import shutil
 import socket
+import subprocess
 import sys
 from dataclasses import dataclass
 from pathlib import Path
@@ -97,6 +99,11 @@ def run_doctor(
     return results
 
 
+def check_mitmproxy_certificate() -> CheckResult:
+    """Returns a single check result for mitmproxy certificate trust."""
+    return _check_certificates()[0]
+
+
 def _check_ports(config: ProxyConfig) -> list[CheckResult]:
     """Checks if proxy and HTTP server ports are available.
 
@@ -168,11 +175,30 @@ def _check_certificates() -> list[CheckResult]:
     cert_dir = Path.home() / ".mitmproxy"
     cert_file = cert_dir / "mitmproxy-ca-cert.pem"
     if cert_file.exists():
+        trusted = _is_cert_trusted(cert_file)
+        if trusted is True:
+            return [
+                CheckResult(
+                    name="mitmproxy_cert",
+                    status="ok",
+                    message="mitmproxy CA cert is trusted.",
+                )
+            ]
+        if trusted is False:
+            return [
+                CheckResult(
+                    name="mitmproxy_cert",
+                    status="warn",
+                    message="mitmproxy CA cert exists but is not trusted.",
+                    fix=_cert_fix_instructions(cert_dir),
+                )
+            ]
         return [
             CheckResult(
                 name="mitmproxy_cert",
-                status="ok",
-                message=f"mitmproxy CA cert found at {cert_file}",
+                status="warn",
+                message="mitmproxy CA cert found but trust status is unknown.",
+                fix=_cert_fix_instructions(cert_dir),
             )
         ]
     return [
@@ -275,5 +301,68 @@ def _cert_fix_instructions(cert_dir: Path) -> str:
     if os.name == "nt":
         return f"Run: certutil -addstore -f Root {cert_path} (elevated)"
     if sys.platform == "darwin":
-        return f"Run: sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain {cert_path}"
-    return f"Run: sudo cp {cert_path} /usr/local/share/ca-certificates/ && sudo update-ca-certificates"
+        return (
+            "Run: sudo security add-trusted-cert -d -r trustRoot "
+            f"-k /Library/Keychains/System.keychain {cert_path}"
+        )
+    if shutil.which("update-ca-certificates"):
+        return (
+            f"Run: sudo cp {cert_path} /usr/local/share/ca-certificates/mitmproxy-ca-cert.crt "
+            "&& sudo update-ca-certificates"
+        )
+    if shutil.which("update-ca-trust"):
+        return (
+            f"Run: sudo cp {cert_path} /etc/pki/ca-trust/source/anchors/mitmproxy-ca-cert.pem "
+            "&& sudo update-ca-trust extract"
+        )
+    return f"Trust the cert manually: {cert_path}"
+
+
+def _is_cert_trusted(cert_path: Path) -> bool | None:
+    """Best-effort check for whether the mitmproxy CA is trusted."""
+    if sys.platform == "darwin":
+        return _is_cert_trusted_macos(cert_path)
+    if sys.platform.startswith("linux"):
+        return _is_cert_trusted_linux(cert_path)
+    if os.name == "nt":
+        return _is_cert_trusted_windows(cert_path)
+    return None
+
+
+def _is_cert_trusted_macos(cert_path: Path) -> bool | None:
+    try:
+        result = subprocess.run(
+            [
+                "security",
+                "find-certificate",
+                "-c",
+                "mitmproxy",
+                "-a",
+                "/Library/Keychains/System.keychain",
+            ],
+            capture_output=True,
+            text=True,
+            check=False,
+        )
+    except FileNotFoundError:
+        return None
+    if result.returncode != 0:
+        return False
+    return bool(result.stdout.strip())
+
+
+def _is_cert_trusted_linux(cert_path: Path) -> bool:
+    candidates = [
+        Path("/usr/local/share/ca-certificates/mitmproxy-ca-cert.crt"),
+        Path("/etc/ssl/certs/mitmproxy-ca-cert.pem"),
+        Path("/etc/ssl/certs/mitmproxy-ca-cert.crt"),
+        Path("/etc/pki/ca-trust/source/anchors/mitmproxy-ca-cert.pem"),
+        Path("/etc/pki/ca-trust/source/anchors/mitmproxy-ca-cert.crt"),
+    ]
+    return any(path.exists() for path in candidates)
+
+
+def _is_cert_trusted_windows(cert_path: Path) -> bool | None:
+    # Implementing a reliable trust-store check on Windows is non-trivial here.
+    # Fall back to unknown and let the CLI provide instructions.
+    return None

{pcf_toolkit-0.2.5.dist-info → pcf_toolkit-0.2.6.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pcf-toolkit
-Version: 0.2.5
+Version: 0.2.6
 Summary: PCF toolkit CLI for manifest authoring and local proxy development.
 Author-email: Vectorfy Co - Andrew M <contact@vectorfy.co>
 License: <div align="center">

{pcf_toolkit-0.2.5.dist-info → pcf_toolkit-0.2.6.dist-info}/RECORD

@@ -16,16 +16,16 @@ pcf_toolkit/data/schema_snapshot.json,sha256=87tr3NDBF9IshguUpxkNl-rNK3jpdHA9-2l
 pcf_toolkit/data/spec_raw.json,sha256=U6WtINyuJei3LLEfTOqyee_-tUfr_3UE-hkKE4S5oDQ,112224
 pcf_toolkit/proxy/__init__.py,sha256=ivhtZia35IJinxfZOoL2bcp7PyL0U7KxavqSp4nyDL0,37
 pcf_toolkit/proxy/browser.py,sha256=9a-sPvnM_W0Vg2nA_uYgSRmfaej6acgtl4OekDzI9wk,4561
-pcf_toolkit/proxy/cli.py,sha256=xIwbezSM0jgn-NZyfQNtq4MjVQz_t3FTZMAxD8eKTEI,55172
+pcf_toolkit/proxy/cli.py,sha256=8U15hzZb9bLenJgoI9POaN4J8Ev2AxcdN7WahQFxBks,58181
 pcf_toolkit/proxy/config.py,sha256=-uKI96Fhc8CWKJ2Cws5yOpPzLVDd7ZeRhdvgC_hNDks,9753
-pcf_toolkit/proxy/doctor.py,sha256=XQTvPi7z9T3i0agcYTpjrlqe8zwlsM9mC-sc9f1y36s,7977
+pcf_toolkit/proxy/doctor.py,sha256=VApvsScXbMmlj2dZY5xRQYyzS0eXtS4iOt41RVaMc44,10891
 pcf_toolkit/proxy/mitm.py,sha256=bKawnEqIsM8wASHfJGr1GQTeipSdHRwRrLNceXm8TTw,5624
 pcf_toolkit/proxy/server.py,sha256=Xt6dgw5MjBDP_GiHxD5iUQTAdULkyTP7e5erVWkNbfk,1152
 pcf_toolkit/proxy/addons/__init__.py,sha256=NI3FmO7tBhNGvy5O6r2cTgqxpmts8NVCQ4Sk2jNmlCM,32
 pcf_toolkit/proxy/addons/redirect_bundle.py,sha256=2neGzVjbUGjw7X94Si1MGcxi2rhdkcpVTNtA9Pua4g8,2072
-pcf_toolkit-0.2.5.dist-info/licenses/LICENSE.md,sha256=KVBxRZbs2pIY2yrA50_E8As1atJXuRw9tRAJ_vreyF4,8639
-pcf_toolkit-0.2.5.dist-info/METADATA,sha256=d17ad-HS-2gjsCzYuIPpkygPedcdHlEcD6LeKfvBcjQ,25773
-pcf_toolkit-0.2.5.dist-info/WHEEL,sha256=_zCd3N1l69ArxyTb8rzEoP9TpbYXkqRFSNOD5OuxnTs,91
-pcf_toolkit-0.2.5.dist-info/entry_points.txt,sha256=ieMDIFZ1D0i8lWqoUYQAtsbU3dzIt6vxx21jtDMncNo,52
-pcf_toolkit-0.2.5.dist-info/top_level.txt,sha256=0TURCNKgchkb-VxvC0o7jWJWJSp64d2ZVzZnRbj9GG8,12
-pcf_toolkit-0.2.5.dist-info/RECORD,,
+pcf_toolkit-0.2.6.dist-info/licenses/LICENSE.md,sha256=KVBxRZbs2pIY2yrA50_E8As1atJXuRw9tRAJ_vreyF4,8639
+pcf_toolkit-0.2.6.dist-info/METADATA,sha256=rVktwGe9uLifJEzM-1-z2NlnDrwiWiJj1VPYxzB63vE,25773
+pcf_toolkit-0.2.6.dist-info/WHEEL,sha256=_zCd3N1l69ArxyTb8rzEoP9TpbYXkqRFSNOD5OuxnTs,91
+pcf_toolkit-0.2.6.dist-info/entry_points.txt,sha256=ieMDIFZ1D0i8lWqoUYQAtsbU3dzIt6vxx21jtDMncNo,52
+pcf_toolkit-0.2.6.dist-info/top_level.txt,sha256=0TURCNKgchkb-VxvC0o7jWJWJSp64d2ZVzZnRbj9GG8,12
+pcf_toolkit-0.2.6.dist-info/RECORD,,