quickscale-cli 0.76.0__tar.gz → 0.79.0__tar.gz

{quickscale_cli-0.76.0 → quickscale_cli-0.79.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: quickscale-cli
-Version: 0.76.0
+Version: 0.79.0
 Summary: Command-line interface for QuickScale Django project generator
 License-Expression: Apache-2.0
 Keywords: django,cli,project-generator,saas
@@ -14,7 +14,7 @@ Classifier: Programming Language :: Python :: 3.14
 Classifier: Framework :: Django
 Classifier: Framework :: Django :: 6.0
 Requires-Dist: click (>=8.3.1,<9.0.0)
-Requires-Dist: quickscale-core (>=0.76.0,<0.77.0)
+Requires-Dist: quickscale-core (>=0.79.0,<0.80.0)
 Project-URL: Documentation, https://github.com/Experto-AI/quickscale/tree/main/docs
 Project-URL: Homepage, https://github.com/Experto-AI/quickscale
 Project-URL: Repository, https://github.com/Experto-AI/quickscale

{quickscale_cli-0.76.0 → quickscale_cli-0.79.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "quickscale-cli"
-version = "0.76.0"
+version = "0.79.0"
 description = "Command-line interface for QuickScale Django project generator"
 requires-python = ">=3.14,<4.0"
 readme = "README.md"
@@ -31,7 +31,7 @@ packages = [{include = "quickscale_cli", from = "src"}]
 [tool.poetry.dependencies]
 python = "^3.14"
 click = "^8.3.1"
-quickscale-core = "^0.76.0"
+quickscale-core = "^0.79.0"
 
 [tool.poetry.group.dev.dependencies]
 # Dev dependencies centralized in root pyproject.toml

{quickscale_cli-0.76.0 → quickscale_cli-0.79.0}/src/quickscale_cli/_version.py

@@ -1,2 +1,2 @@
 # Auto-generated by scripts/version_tool.sh
-__version__ = "0.76.0"
+__version__ = "0.79.0"

quickscale_cli-0.79.0/src/quickscale_cli/backups_contract.py

@@ -0,0 +1,128 @@
+"""Shared backups-module configuration helpers.
+
+This module centralizes the non-secret configuration contract used by the
+planner, apply flow, and state persistence for the backups module.
+"""
+
+from __future__ import annotations
+
+from collections.abc import Mapping
+import re
+from typing import Any
+
+from quickscale_cli.notifications_contract import normalize_notifications_module_options
+from quickscale_cli.social_contract import normalize_social_module_options
+
+DEFAULT_BACKUPS_REMOTE_ACCESS_KEY_ID_ENV_VAR = "QUICKSCALE_BACKUPS_REMOTE_ACCESS_KEY_ID"
+DEFAULT_BACKUPS_REMOTE_SECRET_ACCESS_KEY_ENV_VAR = (
+    "QUICKSCALE_BACKUPS_REMOTE_SECRET_ACCESS_KEY"
+)
+
+BACKUPS_REMOTE_ACCESS_KEY_ID_ENV_VAR_OPTION = "remote_access_key_id_env_var"
+BACKUPS_REMOTE_SECRET_ACCESS_KEY_ENV_VAR_OPTION = "remote_secret_access_key_env_var"
+
+_LEGACY_BACKUPS_SECRET_OPTIONS = {
+    "remote_access_key_id": DEFAULT_BACKUPS_REMOTE_ACCESS_KEY_ID_ENV_VAR,
+    "remote_secret_access_key": DEFAULT_BACKUPS_REMOTE_SECRET_ACCESS_KEY_ENV_VAR,
+}
+
+_BACKUPS_ENV_VAR_NAME_PATTERN = re.compile(r"^[A-Z][A-Z0-9_]*$")
+_LIKELY_AWS_ACCESS_KEY_ID_PATTERN = re.compile(r"^(?:AKIA|ASIA)[A-Z0-9]{16}$")
+
+
+def normalize_backups_module_options(
+    options: Mapping[str, Any] | None,
+) -> dict[str, Any]:
+    """Return backups options with legacy raw-secret keys removed.
+
+    Legacy raw credential values are converted into conventional environment-variable
+    references so downstream persistence layers never re-store the secret values.
+    """
+    normalized = dict(options or {})
+
+    legacy_access_key_id = str(normalized.pop("remote_access_key_id", "")).strip()
+    legacy_secret_access_key = str(
+        normalized.pop("remote_secret_access_key", "")
+    ).strip()
+
+    access_key_env_var = str(
+        normalized.get(BACKUPS_REMOTE_ACCESS_KEY_ID_ENV_VAR_OPTION, "")
+    ).strip()
+    secret_access_key_env_var = str(
+        normalized.get(BACKUPS_REMOTE_SECRET_ACCESS_KEY_ENV_VAR_OPTION, "")
+    ).strip()
+
+    if legacy_access_key_id and not access_key_env_var:
+        normalized[BACKUPS_REMOTE_ACCESS_KEY_ID_ENV_VAR_OPTION] = (
+            DEFAULT_BACKUPS_REMOTE_ACCESS_KEY_ID_ENV_VAR
+        )
+    if legacy_secret_access_key and not secret_access_key_env_var:
+        normalized[BACKUPS_REMOTE_SECRET_ACCESS_KEY_ENV_VAR_OPTION] = (
+            DEFAULT_BACKUPS_REMOTE_SECRET_ACCESS_KEY_ENV_VAR
+        )
+
+    return normalized
+
+
+def has_legacy_backups_secret_values(options: Mapping[str, Any] | None) -> bool:
+    """Return whether backups options still include legacy raw-secret keys."""
+    if not options:
+        return False
+
+    for option_name in _LEGACY_BACKUPS_SECRET_OPTIONS:
+        if str(options.get(option_name, "")).strip():
+            return True
+    return False
+
+
+def validate_backups_env_var_reference(option_name: str, value: Any) -> str | None:
+    """Validate a backups env-var reference field.
+
+    Returns an actionable error string when the value is not a safe environment
+    variable name or appears to be a literal credential value.
+    """
+    candidate = str(value).strip()
+    if not candidate:
+        return None
+
+    qualified_option = f"modules.backups.{option_name}"
+    if not _BACKUPS_ENV_VAR_NAME_PATTERN.fullmatch(candidate):
+        return (
+            f"{qualified_option} must be an environment variable name matching "
+            "^[A-Z][A-Z0-9_]*$"
+        )
+
+    if option_name == BACKUPS_REMOTE_ACCESS_KEY_ID_ENV_VAR_OPTION:
+        if _LIKELY_AWS_ACCESS_KEY_ID_PATTERN.fullmatch(candidate):
+            return (
+                f"{qualified_option} must reference an environment variable name, "
+                "not a literal AWS access key id"
+            )
+
+    return None
+
+
+def sanitize_module_options(
+    module_name: str,
+    options: Mapping[str, Any] | None,
+) -> dict[str, Any]:
+    """Return module options safe for config/state persistence."""
+    if module_name == "backups":
+        return normalize_backups_module_options(options)
+    if module_name == "notifications":
+        return normalize_notifications_module_options(options)
+    if module_name == "social":
+        return normalize_social_module_options(dict(options or {}))
+    return dict(options or {})
+
+
+__all__ = [
+    "BACKUPS_REMOTE_ACCESS_KEY_ID_ENV_VAR_OPTION",
+    "BACKUPS_REMOTE_SECRET_ACCESS_KEY_ENV_VAR_OPTION",
+    "DEFAULT_BACKUPS_REMOTE_ACCESS_KEY_ID_ENV_VAR",
+    "DEFAULT_BACKUPS_REMOTE_SECRET_ACCESS_KEY_ENV_VAR",
+    "has_legacy_backups_secret_values",
+    "normalize_backups_module_options",
+    "sanitize_module_options",
+    "validate_backups_env_var_reference",
+]