praetorian-cli 2.4.3__tar.gz → 2.4.4__tar.gz

{praetorian_cli-2.4.3/praetorian_cli.egg-info → praetorian_cli-2.4.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: praetorian-cli
-Version: 2.4.3
+Version: 2.4.4
 Summary: For interacting with the Guard API
 Home-page: https://github.com/praetorian-inc/praetorian-cli
 Author: Praetorian

{praetorian_cli-2.4.3 → praetorian_cli-2.4.4}/praetorian_cli/handlers/get.py

@@ -4,7 +4,7 @@ import click
 
 from praetorian_cli.handlers.chariot import chariot
 from praetorian_cli.handlers.cli_decorators import cli_handler, praetorian_only
-from praetorian_cli.handlers.utils import print_json
+from praetorian_cli.handlers.utils import error, print_json
 
 
 @chariot.group()
@@ -259,31 +259,49 @@ def configuration(chariot, key):
 
 @get.command()
 @cli_handler
-@click.argument('credential_id', required=True)
+@click.argument('credential_id', required=False, default='')
 @click.option('--category', default='env-integration', help='The category of the credential (e.g., integration, cloud)')
 @click.option('--type', default='default', help='The type of credential (e.g., aws, gcp, azure, static, ssh_key, json)')
 @click.option('--format', default='token', help='The format of the credential response')
+@click.option('--resolution',
+              type=click.Choice(['by-target', 'from-parent'], case_sensitive=False),
+              default='by-target',
+              show_default=True,
+              help='How the broker should locate the credential. '
+                   'by-target: use the supplied CREDENTIAL_ID as-is. '
+                   'from-parent: walk DISCOVERED ancestors of --resource-key to find one with a matching credential.')
+@click.option('--resource-key', default=None,
+              help='Asset/resource key to scope the lookup. Required when --resolution=from-parent.')
 @click.option('--parameters', nargs=2, multiple=True, help='Additional parameters, as --parameters key value')
-def credential(chariot, credential_id, category, type, format, parameters):
+def credential(chariot, credential_id, category, type, format, resolution, resource_key, parameters):
     """ Get a specific credential
 
     Retrieve a specific credential using the credential broker.
 
     \b
     Argument:
-        - CREDENTIAL_ID: the ID of the credential to retrieve
+        - CREDENTIAL_ID: the ID of the credential to retrieve. Required for
+          --resolution=by-target; optional for from-parent.
 
     \b
     Example usages:
         - guard get credential aws-prod --category integration --type aws --format json
         - guard get credential ssh-key-1 --category cloud --type ssh_key --format pem
+        - guard get credential --resolution from-parent --resource-key '#asset#example.com#1.2.3.4' --type aws
     """
-    
+    if resolution == 'by-target' and not credential_id:
+        error('CREDENTIAL_ID is required when --resolution=by-target.')
+    if resolution == 'from-parent' and not resource_key:
+        error('--resource-key is required when --resolution=from-parent.')
+
     params = {}
     if parameters:
         params = {key: value for key, value in parameters}
-    
-    result = chariot.credentials.get(credential_id, category, type, [format], **params)
+
+    result = chariot.credentials.get(
+        credential_id, category, type, [format],
+        resolution=resolution, resource_key=resource_key, **params,
+    )
     output = chariot.credentials.format_output(result)
     click.echo(output)
 

{praetorian_cli-2.4.3 → praetorian_cli-2.4.4}/praetorian_cli/sdk/entities/credentials.py

@@ -72,11 +72,14 @@ class Credentials:
         """
         return self.api.search.by_key_prefix('#credential', offset=offset, pages=pages)
 
-    def get(self, credential_id, category, type, format, **parameters):
+    def get(self, credential_id, category, type, format, resolution='by-target',
+            resource_key=None, **parameters):
         """
         Get a specific credential using the credential broker.
 
-        :param credential_id: The ID of the credential to retrieve
+        :param credential_id: The ID of the credential to retrieve. Required for
+            resolution='by-target'; optional for 'from-parent' (broker walks the
+            graph if empty).
         :type credential_id: str
         :param category: The category of the credential ('integration', 'cloud', 'env-integration')
         :type category: str
@@ -84,6 +87,13 @@ class Credentials:
         :type type: str
         :param format: The format of the credential response ('token', 'file', 'env')
         :type format: str or list
+        :param resolution: How the broker should locate the credential. One of
+            'by-target' (use credential_id as-is; default) or 'from-parent'
+            (walk DISCOVERED ancestors of resource_key).
+        :type resolution: str
+        :param resource_key: Asset/resource key the credential is scoped to.
+            Required when resolution='from-parent'.
+        :type resource_key: str or None
         :param parameters: Additional parameters required for the credential request (e.g., region, role_arn)
         :type parameters: dict
         :return: The processed credential response based on the requested format
@@ -101,8 +111,11 @@ class Credentials:
             'Category': category,
             'Type': type,
             'Format': broker_format,
-            'Parameters': parameters
+            'Resolution': resolution,
+            'Parameters': parameters,
         }
+        if resource_key:
+            request['ResourceKey'] = resource_key
         response = self.api.post('broker', request)
         return self._process_credential_output(response, format)
 

{praetorian_cli-2.4.3 → praetorian_cli-2.4.4}/praetorian_cli/sdk/test/test_credentials.py

@@ -9,6 +9,7 @@ from click.testing import CliRunner
 # Click commands on the `chariot` group via decorators at import time.
 import praetorian_cli.handlers.add  # noqa: F401
 import praetorian_cli.handlers.delete  # noqa: F401
+import praetorian_cli.handlers.get  # noqa: F401
 import praetorian_cli.handlers.update  # noqa: F401
 from praetorian_cli.handlers.chariot import chariot
 from praetorian_cli.sdk.entities.assets import Assets
@@ -46,6 +47,89 @@ class TestCredentialsAdd:
         })
 
 
+class TestCredentialsGet:
+    def test_get_builds_broker_request_with_resolution_by_target(self):
+        """The broker rejects Get requests without Resolution (PR #5457). The
+        CLI always passes an explicit credential_id, so Resolution must be
+        'by-target' — anything else either ignores the id (global) or requires
+        a ResourceKey the CLI doesn't have (from-parent)."""
+        api = MagicMock()
+        api.post.return_value = {'credentialValue': {'token': 'abc'}}
+        creds = Credentials(api=api)
+
+        creds.get(
+            credential_id='e699e73e-e371-4117-9192-e32147dfe98c',
+            category='env-integration',
+            type='aws',
+            format=['token'],
+            accountId='123456789012',
+        )
+
+        api.post.assert_called_once_with('broker', {
+            'Operation': 'get',
+            'CredentialID': 'e699e73e-e371-4117-9192-e32147dfe98c',
+            'Category': 'env-integration',
+            'Type': 'aws',
+            'Format': ['token'],
+            'Resolution': 'by-target',
+            'Parameters': {'accountId': '123456789012'},
+        })
+
+    def test_get_rewrites_credential_process_format_to_token(self):
+        """`credential-process` is a client-side format — the broker sees
+        'token' and the SDK assembles the AWS credential_process JSON from the
+        response."""
+        api = MagicMock()
+        api.post.return_value = {
+            'credentialValue': {
+                'accessKeyId': 'ASIA...',
+                'secretAccessKey': 'secret',
+                'sessionToken': 'session',
+                'expiration': '2026-04-10T12:00:00Z',
+            }
+        }
+        creds = Credentials(api=api)
+
+        creds.get(
+            credential_id='abc-123',
+            category='env-integration',
+            type='aws',
+            format=['credential-process'],
+        )
+
+        sent = api.post.call_args.args[1]
+        assert sent['Format'] == ['token']
+        assert sent['Resolution'] == 'by-target'
+
+    def test_get_with_from_parent_sends_resource_key(self):
+        """from-parent: broker walks DISCOVERED ancestors of ResourceKey for a
+        matching credential. ResourceKey is required, CredentialID may be
+        empty."""
+        api = MagicMock()
+        api.post.return_value = {'ok': True}
+        creds = Credentials(api=api)
+
+        creds.get(
+            credential_id='',
+            category='env-integration',
+            type='aws',
+            format=['token'],
+            resolution='from-parent',
+            resource_key='#asset#example.com#1.2.3.4',
+        )
+
+        api.post.assert_called_once_with('broker', {
+            'Operation': 'get',
+            'CredentialID': '',
+            'Category': 'env-integration',
+            'Type': 'aws',
+            'Format': ['token'],
+            'Resolution': 'from-parent',
+            'Parameters': {},
+            'ResourceKey': '#asset#example.com#1.2.3.4',
+        })
+
+
 class TestCredentialsDelete:
     def test_delete_builds_broker_request(self):
         api = MagicMock()
@@ -105,6 +189,8 @@ def fake_sdk():
     sdk = MagicMock()
     sdk.credentials.add.return_value = {'ok': True}
     sdk.credentials.delete.return_value = {'ok': True}
+    sdk.credentials.get.return_value = {'credentialValue': {'token': 'abc'}}
+    sdk.credentials.format_output.side_effect = lambda r: str(r)
     sdk.assets.update.return_value = {'ok': True}
     return sdk
 
@@ -251,6 +337,76 @@ class TestDeleteCredential:
         )
 
 
+class TestGetCredentialCLI:
+    """`guard get credential ...` — verifies the --resolution flag and its
+    interaction with CREDENTIAL_ID / --resource-key."""
+
+    def test_default_resolution_is_by_target(self, runner, fake_sdk):
+        result = _invoke(runner, fake_sdk, [
+            'get', 'credential', 'cred-abc-123',
+            '--category', 'env-integration',
+            '--type', 'aws',
+        ])
+        assert result.exit_code == 0, result.output
+        fake_sdk.credentials.get.assert_called_once_with(
+            'cred-abc-123', 'env-integration', 'aws', ['token'],
+            resolution='by-target', resource_key=None,
+        )
+
+    def test_explicit_by_target_passes_through(self, runner, fake_sdk):
+        result = _invoke(runner, fake_sdk, [
+            'get', 'credential', 'cred-abc-123',
+            '--resolution', 'by-target',
+            '--type', 'aws',
+        ])
+        assert result.exit_code == 0, result.output
+        kwargs = fake_sdk.credentials.get.call_args.kwargs
+        assert kwargs['resolution'] == 'by-target'
+        assert kwargs['resource_key'] is None
+
+    def test_from_parent_requires_resource_key(self, runner, fake_sdk):
+        result = _invoke(runner, fake_sdk, [
+            'get', 'credential',
+            '--resolution', 'from-parent',
+            '--type', 'aws',
+        ])
+        assert result.exit_code != 0
+        assert '--resource-key' in result.output
+        fake_sdk.credentials.get.assert_not_called()
+
+    def test_from_parent_with_resource_key(self, runner, fake_sdk):
+        result = _invoke(runner, fake_sdk, [
+            'get', 'credential',
+            '--resolution', 'from-parent',
+            '--resource-key', '#asset#example.com#1.2.3.4',
+            '--type', 'aws',
+        ])
+        assert result.exit_code == 0, result.output
+        fake_sdk.credentials.get.assert_called_once_with(
+            '', 'env-integration', 'aws', ['token'],
+            resolution='from-parent',
+            resource_key='#asset#example.com#1.2.3.4',
+        )
+
+    def test_by_target_requires_credential_id(self, runner, fake_sdk):
+        result = _invoke(runner, fake_sdk, [
+            'get', 'credential',
+            '--resolution', 'by-target',
+            '--type', 'aws',
+        ])
+        assert result.exit_code != 0
+        assert 'CREDENTIAL_ID' in result.output
+        fake_sdk.credentials.get.assert_not_called()
+
+    def test_invalid_resolution_value_is_rejected(self, runner, fake_sdk):
+        result = _invoke(runner, fake_sdk, [
+            'get', 'credential', 'cred-abc-123',
+            '--resolution', 'nope',
+        ])
+        assert result.exit_code != 0
+        assert 'nope' in result.output or "'by-target'" in result.output
+
+
 class TestUpdateAssetSecret:
     def test_update_asset_with_secret_passes_through(self, runner, fake_sdk):
         result = _invoke(runner, fake_sdk, [

{praetorian_cli-2.4.3 → praetorian_cli-2.4.4/praetorian_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: praetorian-cli
-Version: 2.4.3
+Version: 2.4.4
 Summary: For interacting with the Guard API
 Home-page: https://github.com/praetorian-inc/praetorian-cli
 Author: Praetorian

{praetorian_cli-2.4.3 → praetorian_cli-2.4.4}/setup.cfg

@@ -1,6 +1,6 @@
 [metadata]
 name = praetorian-cli
-version = 2.4.3
+version = 2.4.4
 author = Praetorian
 author_email = support@praetorian.com
 description = For interacting with the Guard API