qualys-cli 0.1.6__tar.gz → 0.1.7__tar.gz

{qualys_cli-0.1.6 → qualys_cli-0.1.7}/CHANGELOG.md

@@ -6,6 +6,18 @@ to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [0.1.7] — 2026-07-17
+
+### Fixed
+- `--dry-run` / `--explain` now renders JSON **array** request bodies instead
+  of dropping them to `null`. Commands that send a bare JSON array — e.g.
+  `etm report bulk-delete`, which `DELETE`s `/reports` with a raw
+  `["id", …]` body — previously showed `"body": null` in the explain output.
+  Because that JSON is the documented contract parsed by the `mcp`, `serve`,
+  and `batch` consumers, the actual payload was invisible to them and to
+  anyone auditing a request before sending it. Array bodies are now shown
+  (and secret-redacted) in both the human panel and the machine-readable JSON.
+
 ## [0.1.6] — 2026-07-17
 
 ### Security
@@ -217,7 +229,8 @@ Initial public release.
 - Ruff lint clean (E, F, I, UP, B, C4, SIM rule sets).
 - Codegen pipeline (`scripts/`) is opt-in via the `codegen` extra.
 
-[Unreleased]: https://github.com/qualys/qualys-cli/compare/v0.1.5...HEAD
+[Unreleased]: https://github.com/qualys/qualys-cli/compare/v0.1.6...HEAD
+[0.1.6]: https://github.com/qualys/qualys-cli/compare/v0.1.5...v0.1.6
 [0.1.5]: https://github.com/qualys/qualys-cli/compare/v0.1.4...v0.1.5
 [0.1.4]: https://github.com/qualys/qualys-cli/compare/v0.1.2...v0.1.4
 [0.1.2]: https://github.com/qualys/qualys-cli/compare/v0.1.1...v0.1.2

{qualys_cli-0.1.6 → qualys_cli-0.1.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: qualys-cli
-Version: 0.1.6
+Version: 0.1.7
 Summary: Unified command-line interface for the Qualys Cloud Platform REST APIs (VM, PC, PM, ETM, WAS, TotalCloud, Cloud Agent, Container Security, CSAM, Subscription, Asset, and User management).
 Project-URL: Homepage, https://www.qualys.com
 Author-email: Qualys <support@qualys.com>

{qualys_cli-0.1.6 → qualys_cli-0.1.7}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "qualys-cli"
-version = "0.1.6"
+version = "0.1.7"
 description = "Unified command-line interface for the Qualys Cloud Platform REST APIs (VM, PC, PM, ETM, WAS, TotalCloud, Cloud Agent, Container Security, CSAM, Subscription, Asset, and User management)."
 readme = { file = "README.md", content-type = "text/markdown" }
 license = { file = "LICENSE" }

qualys_cli-0.1.7/src/qualys_cli/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.1.7"

{qualys_cli-0.1.6 → qualys_cli-0.1.7}/src/qualys_cli/_docs/usage.html

@@ -612,7 +612,7 @@ body.filtering.no-match section.module{display:none}
 <aside class="sidebar" aria-label="Documentation navigation">
   <div class="side-header">
     <img src="https://ik.imagekit.io/qualys/image/logo/qualys.svg" alt="Qualys">
-    <span class="ver">v0.1.3</span>
+    <span class="ver">v0.1.7</span>
   </div>
   <div class="side-search">
     <input type="search" id="filter" placeholder="Search commands…"
@@ -696,7 +696,7 @@ body.filtering.no-match section.module{display:none}
     <div class="hero-stats">
       <div class="hero-stat"><span class="n">28</span><span class="l">Modules</span></div>
       <div class="hero-stat"><span class="n">228</span><span class="l">Commands</span></div>
-      <div class="hero-stat"><span class="n">v0.1.3</span><span class="l">Version</span></div>
+      <div class="hero-stat"><span class="n">v0.1.7</span><span class="l">Version</span></div>
       <div class="hero-stat"><span class="n">3.12+</span><span class="l">Python</span></div>
       <div class="hero-stat"><span class="n">MIT</span><span class="l">License</span></div>
     </div>

{qualys_cli-0.1.6 → qualys_cli-0.1.7}/src/qualys_cli/client.py

@@ -408,11 +408,12 @@ class QualysClient:
             url      fully-qualified request URL (profile + path)
             auth     "basic" or "jwt"
             params   query string as a JSON object (redacted)
-            body     request body normalised to a JSON object whenever
-                     possible. If the original body was a JSON string we
-                     parse it back so callers see structure, not a string.
-                     If the body is non-JSON (XML, form-encoded), it is
-                     surfaced as a string preview. ``null`` if no body.
+            body     request body normalised to a JSON value (object or
+                     array) whenever possible. If the original body was a
+                     JSON string we parse it back so callers see structure,
+                     not a string. If the body is non-JSON (XML,
+                     form-encoded), it is surfaced as a string preview.
+                     ``null`` if no body.
             headers  request headers (Authorization redacted)
 
         This contract is the public surface that MCP / serve / batch
@@ -432,7 +433,7 @@ class QualysClient:
 
         # Redact secrets in the rendered body / params
         params = _audit.redact_mapping(dict(kwargs.get("params") or {}))
-        if isinstance(body, dict):
+        if isinstance(body, (dict, list)):
             body = _audit.redact_mapping(body)
         elif isinstance(body, str):
             # Try to round-trip a string body back into a dict — ``post_xml``
@@ -457,7 +458,7 @@ class QualysClient:
         lines.append(f"[dim]auth:[/dim] {self.auth_type}")
         if params:
             lines.append(f"[dim]params:[/dim] {_json.dumps(params, default=str)}")
-        if isinstance(body, dict):
+        if isinstance(body, (dict, list)):
             lines.append(f"[dim]body:[/dim] {_json.dumps(body, default=str, indent=2)}")
         elif isinstance(body, str):
             preview = body if len(body) < 400 else body[:400] + "…"
@@ -468,7 +469,7 @@ class QualysClient:
         if not _console.is_terminal:
             payload = {
                 "method": method, "url": url, "auth": self.auth_type,
-                "params": params, "body": body if isinstance(body, (dict, str)) else None,
+                "params": params, "body": body if isinstance(body, (dict, list, str)) else None,
                 "headers": hdrs,
             }
             print(_json.dumps(payload, default=str))

{qualys_cli-0.1.6 → qualys_cli-0.1.7}/tests/test_features.py

@@ -180,6 +180,24 @@ def test_dry_run_via_cli(monkeypatch):
     assert not bad.called
 
 
+@respx.mock
+def test_dry_run_renders_list_body(monkeypatch):
+    """A JSON *array* request body (e.g. `etm report bulk-delete`) must appear
+    in the --explain output, not be flattened to null.
+
+    The dry-run JSON is the contract MCP/serve/batch callers parse; a list
+    body silently rendered as null hid the actual payload. Regression guard.
+    """
+    _env(monkeypatch)
+    respx.post(f"{BASE}/auth").mock(return_value=httpx.Response(200, content=b"tok"))
+    result = runner.invoke(
+        app, ["--dry-run", "etm", "report", "bulk-delete", "101,102,103", "--yes"]
+    )
+    assert result.exit_code == 0, result.output
+    payload = json.loads(result.output.strip().splitlines()[-1])
+    assert payload["body"] == ["101", "102", "103"], payload
+
+
 # ── Audit HMAC chain ────────────────────────────────────────────────────────
 
 def test_audit_chain_intact(monkeypatch, tmp_path):

qualys_cli-0.1.6/src/qualys_cli/__init__.py

@@ -1 +0,0 @@
-__version__ = "0.1.6"