sovaria-cli 0.2.0__py3-none-any.whl

apps/cli/src/commands/keys.py

@@ -0,0 +1,120 @@
+"""Project-scoped API key management."""
+
+from __future__ import annotations
+
+from urllib.parse import quote
+
+import typer
+
+from apps.cli.src.utils.api_client import CLIRequestError, call_api, parse_json_arg
+from apps.cli.src.utils.display import print_json, print_success, print_warning
+
+app = typer.Typer(help="Project API keys (anon / service_role / custom)")
+
+
+@app.command("list")
+def list_keys(
+    profile: str | None = typer.Option(None, "--profile"),
+    org_id: str | None = typer.Option(None, "--org"),
+    project_id: str | None = typer.Option(None, "--project"),
+    env_id: str | None = typer.Option(None, "--env"),
+) -> None:
+    """List API keys for the current project."""
+    try:
+        result = call_api(
+            method="GET",
+            path="/api/v1/apikeys",
+            profile=profile,
+            org_id=org_id,
+            project_id=project_id,
+            env_id=env_id,
+            require_scope=True,
+        )
+    except CLIRequestError as exc:
+        typer.echo(str(exc), err=True)
+        raise typer.Exit(1) from exc
+    print_json(result)
+
+
+@app.command("create")
+def create_key(
+    name: str = typer.Option(..., "--name", help="Human-readable key name"),
+    role: str = typer.Option("service_role", "--role", help="Key role label"),
+    metadata: str | None = typer.Option(None, "--metadata", help="JSON object"),
+    profile: str | None = typer.Option(None, "--profile"),
+    org_id: str | None = typer.Option(None, "--org"),
+    project_id: str | None = typer.Option(None, "--project"),
+    env_id: str | None = typer.Option(None, "--env"),
+) -> None:
+    """Create a new project API key. The secret is shown once."""
+    parsed = parse_json_arg(metadata, label="--metadata") if metadata else {}
+    if parsed is not None and not isinstance(parsed, dict):
+        raise typer.BadParameter("--metadata must be a JSON object")
+    try:
+        result = call_api(
+            method="POST",
+            path="/api/v1/apikeys",
+            profile=profile,
+            org_id=org_id,
+            project_id=project_id,
+            env_id=env_id,
+            require_scope=True,
+            body={"name": name, "role": role, "metadata": parsed or {}},
+        )
+    except CLIRequestError as exc:
+        typer.echo(str(exc), err=True)
+        raise typer.Exit(1) from exc
+    print_json(result)
+    print_warning("Store the secret now — it cannot be retrieved again.")
+
+
+@app.command("ensure-defaults")
+def ensure_defaults(
+    profile: str | None = typer.Option(None, "--profile"),
+    org_id: str | None = typer.Option(None, "--org"),
+    project_id: str | None = typer.Option(None, "--project"),
+    env_id: str | None = typer.Option(None, "--env"),
+) -> None:
+    """Bootstrap default anon + service_role keys if missing."""
+    try:
+        result = call_api(
+            method="POST",
+            path="/api/v1/apikeys/ensure-defaults",
+            profile=profile,
+            org_id=org_id,
+            project_id=project_id,
+            env_id=env_id,
+            require_scope=True,
+            body={},
+        )
+    except CLIRequestError as exc:
+        typer.echo(str(exc), err=True)
+        raise typer.Exit(1) from exc
+    print_json(result)
+    print_success("Default API keys ensured.")
+
+
+@app.command("revoke")
+def revoke_key(
+    key_id: str = typer.Argument(..., help="API key ID"),
+    profile: str | None = typer.Option(None, "--profile"),
+    org_id: str | None = typer.Option(None, "--org"),
+    project_id: str | None = typer.Option(None, "--project"),
+    env_id: str | None = typer.Option(None, "--env"),
+) -> None:
+    """Revoke an API key."""
+    try:
+        result = call_api(
+            method="DELETE",
+            path=f"/api/v1/apikeys/{quote(key_id, safe='')}",
+            profile=profile,
+            org_id=org_id,
+            project_id=project_id,
+            env_id=env_id,
+            require_scope=True,
+        )
+    except CLIRequestError as exc:
+        typer.echo(str(exc), err=True)
+        raise typer.Exit(1) from exc
+    print_json(result)
+    print_success(f"Revoked key {key_id}")