steve-cli 1.0.2__tar.gz → 1.1.1__tar.gz

{steve_cli-1.0.2 → steve_cli-1.1.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: steve-cli
-Version: 1.0.2
+Version: 1.1.1
 Summary: A simple CLI tool to run jobs from jobs.yaml with proper environment setup
 Author: Frank
 License: MIT

{steve_cli-1.0.2 → steve_cli-1.1.1}/pyproject.toml

@@ -5,7 +5,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "steve-cli"
-version = "1.0.2"
+version = "1.1.1"
 description = "A simple CLI tool to run jobs from jobs.yaml with proper environment setup"
 readme = "README.md"
 license = {text = "MIT"}

{steve_cli-1.0.2 → steve_cli-1.1.1}/steve_cli/auth.py

@@ -74,6 +74,8 @@ def get_s3_endpoint(workspace_id: Optional[str] = None) -> Optional[str]:
 
 
 def get_service_url(service: str, workspace_id: Optional[str] = None) -> Optional[str]:
+    import os
+    workspace_id = workspace_id or os.environ.get("WORKSPACE_ID")
     entry = _get_workspace_entry(workspace_id)
     base_url = entry.get("base_url")
     if not base_url or not workspace_id:

{steve_cli-1.0.2 → steve_cli-1.1.1}/steve_cli/cli.py

@@ -940,7 +940,9 @@ def policies():
 @policies.command("apply")
 @click.option('--file', '-f', type=click.Path(path_type=Path),
               help='Path to policies YAML file (default: ./policies/access.yaml)')
-def policies_apply(file: Path | None):
+@click.option('--validate', type=click.Choice(["warn", "error"]), default=None,
+              help='Validate schema/table references against Trino after applying (warn: print issues, error: fail if any found)')
+def policies_apply(file: Path | None, validate: str | None):
     """Apply access policies from a YAML file to the Policy Control Plane."""
     from dotenv import load_dotenv
     load_dotenv(".env", override=False)
@@ -948,7 +950,8 @@ def policies_apply(file: Path | None):
     from steve_cli.policies import PolicyClient
     policies_file = Path(file) if file else None
     try:
-        PolicyClient().apply_from_file(policies_file)
+        branch, sanitized = PolicyClient().apply_from_file(policies_file, validate=validate)
+        click.secho(f"Branch: {branch} → schema suffix __{sanitized}", fg="cyan")
         click.secho("Policies applied successfully.", fg="green")
     except FileNotFoundError as e:
         click.secho(str(e), fg="red", err=True)
@@ -958,6 +961,262 @@ def policies_apply(file: Path | None):
         sys.exit(1)
 
 
+@policies.command("ls")
+def policies_ls():
+    """List all registered PDPs and their attached workspaces."""
+    from dotenv import load_dotenv
+    load_dotenv(".env", override=False)
+    from steve_cli.policies import PolicyClient
+    try:
+        pdps = PolicyClient().list_pdps()
+    except Exception as e:
+        click.secho(f"ERROR: {e}", fg="red", bold=True, err=True)
+        sys.exit(1)
+    if not pdps:
+        click.echo("No PDPs registered.")
+        return
+    for pdp in pdps:
+        workspaces = [w.get("workspace", "") for w in pdp.get("workspaces", [])]
+        policies_count = len(pdp.get("policies", []))
+        click.echo(
+            f"  {click.style(pdp['name'], fg='blue', bold=True)}"
+            f"  {click.style(pdp['type'], fg='cyan')}"
+            f"  {click.style(pdp['endpoint'], fg='bright_black')}"
+        )
+        if workspaces:
+            click.echo(f"    workspaces: {', '.join(workspaces)}")
+        if pdp.get("policies"):
+            names = [p.get("name", p.get("id", "?")) for p in pdp["policies"]]
+            click.echo(f"    policies:   {', '.join(names)}")
+        else:
+            click.echo(f"    policies:   (none)")
+
+
+@policies.command("show")
+@click.argument("pdp_name", required=False, default=None)
+def policies_show(pdp_name: str | None):
+    """Show full policy content for a PDP (interactive if name omitted)."""
+    from dotenv import load_dotenv
+    load_dotenv(".env", override=False)
+    from steve_cli.policies import PolicyClient
+    try:
+        pdps = PolicyClient().list_pdps()
+    except Exception as e:
+        click.secho(f"ERROR: {e}", fg="red", bold=True, err=True)
+        sys.exit(1)
+    if not pdps:
+        click.echo("No PDPs registered.")
+        return
+    if pdp_name is None:
+        pdp_name = questionary.select(
+            "Select a PDP:",
+            choices=[p["name"] for p in pdps],
+        ).ask()
+        if pdp_name is None:
+            sys.exit(0)
+    pdp = next((p for p in pdps if p["name"] == pdp_name), None)
+    if not pdp:
+        click.secho(f"PDP '{pdp_name}' not found.", fg="red", err=True)
+        sys.exit(1)
+    click.echo(f"\n{click.style(pdp['name'], fg='blue', bold=True)}  {pdp['type']}  {pdp['endpoint']}")
+    import json as _json
+    policies_list = pdp.get("policies", [])
+    fragments_list = pdp.get("fragments", [])
+    if not policies_list and not fragments_list:
+        click.echo("  (no policies)")
+        return
+    for pol in policies_list:
+        click.echo(f"\n  {click.style(pol.get('name', pol.get('id', '?')), fg='cyan')}  {click.style('rego', fg='bright_black')}")
+        content = pol.get("content", pol.get("rawContent", ""))
+        if isinstance(content, dict):
+            content = _json.dumps(content, indent=2)
+        for line in str(content).splitlines():
+            click.echo(f"    {line}")
+    for frag in fragments_list:
+        updated = frag.get("updatedAt", frag.get("createdAt", ""))
+        click.echo(f"\n  {click.style(frag.get('workspace', '?'), fg='cyan')}  {click.style(frag.get('syntax', '?'), fg='magenta')}  {click.style(updated, fg='bright_black')}")
+        content = frag.get("content", {})
+        for line in _json.dumps(content, indent=2).splitlines():
+            click.echo(f"    {line}")
+
+
+@policies.command("diff")
+@click.option('--file', '-f', type=click.Path(path_type=Path),
+              help='Path to policies YAML file (default: ./policies/access.yaml)')
+@click.argument("pdp_name", required=False, default=None)
+def policies_diff(file: Path | None, pdp_name: str | None):
+    """Diff local access.yaml (expanded) against what is applied on a PDP."""
+    from dotenv import load_dotenv
+    load_dotenv(".env", override=False)
+    import json as _json
+    import difflib
+    import yaml
+    from steve_cli.policies import PolicyClient
+    from steve_cli.storage.branch import get_branch_prefix
+
+    path = Path(file) if file else Path.cwd() / "policies" / "access.yaml"
+    if not path.exists():
+        click.secho(f"Policies file not found: {path}", fg="red", err=True)
+        sys.exit(1)
+
+    config = yaml.safe_load(path.read_text())
+    local_rules = config.get("rules", [])
+    sanitized = get_branch_prefix()
+    from steve_cli.policies.client import _expand_rules
+    expanded = _expand_rules(local_rules, sanitized)
+    local_text = _json.dumps({"rules": expanded}, indent=2)
+
+    try:
+        client = PolicyClient()
+        pdps = client.list_pdps()
+    except Exception as e:
+        click.secho(f"ERROR: {e}", fg="red", bold=True, err=True)
+        sys.exit(1)
+
+    if not pdps:
+        click.echo("No PDPs registered.")
+        return
+
+    if pdp_name is None:
+        pdp_cfg = config.get("pdp", {})
+        pdp_name = pdp_cfg.get("name")
+        if pdp_name not in [p["name"] for p in pdps]:
+            pdp_name = questionary.select(
+                "Select a PDP to diff against:",
+                choices=[p["name"] for p in pdps],
+            ).ask()
+            if pdp_name is None:
+                sys.exit(0)
+
+    pdp = next((p for p in pdps if p["name"] == pdp_name), None)
+    if not pdp:
+        click.secho(f"PDP '{pdp_name}' not found.", fg="red", err=True)
+        sys.exit(1)
+
+    remote_rules = []
+    for frag in pdp.get("fragments", []):
+        content = frag.get("content", {})
+        if isinstance(content, dict) and "rules" in content:
+            remote_rules.extend(content["rules"])
+    for pol in pdp.get("policies", []):
+        content = pol.get("content", {})
+        if isinstance(content, dict) and "rules" in content:
+            remote_rules.extend(content["rules"])
+    remote_text = _json.dumps({"rules": remote_rules}, indent=2)
+
+    diff = list(difflib.unified_diff(
+        remote_text.splitlines(),
+        local_text.splitlines(),
+        fromfile=f"remote/{pdp_name}",
+        tofile=f"local/{path.name} (branch: {sanitized})",
+        lineterm="",
+    ))
+
+    if not diff:
+        click.secho("No differences.", fg="green")
+        return
+
+    for line in diff:
+        if line.startswith("+"):
+            click.secho(line, fg="green")
+        elif line.startswith("-"):
+            click.secho(line, fg="red")
+        else:
+            click.echo(line)
+
+
+@policies.command("rm")
+@click.argument("pdp_name", required=False, default=None)
+@click.option("--yes", "-y", is_flag=True, default=False, help="Skip confirmation prompt.")
+def policies_rm(pdp_name: str | None, yes: bool):
+    """Delete a registered PDP (interactive if name omitted)."""
+    from dotenv import load_dotenv
+    load_dotenv(".env", override=False)
+    from steve_cli.policies import PolicyClient
+    try:
+        client = PolicyClient()
+        pdps = client.list_pdps()
+    except Exception as e:
+        click.secho(f"ERROR: {e}", fg="red", bold=True, err=True)
+        sys.exit(1)
+    if not pdps:
+        click.echo("No PDPs registered.")
+        return
+    if pdp_name is None:
+        pdp_name = questionary.select(
+            "Select a PDP to delete:",
+            choices=[p["name"] for p in pdps],
+        ).ask()
+        if pdp_name is None:
+            sys.exit(0)
+    pdp = next((p for p in pdps if p["name"] == pdp_name), None)
+    if not pdp:
+        click.secho(f"PDP '{pdp_name}' not found.", fg="red", err=True)
+        sys.exit(1)
+    if not yes:
+        if not questionary.confirm(f"Delete PDP '{pdp_name}'?", default=False).ask():
+            click.echo("Aborted.")
+            return
+    try:
+        client.delete_pdp(pdp["id"])
+        click.secho(f"Deleted PDP '{pdp_name}'.", fg="green")
+    except Exception as e:
+        click.secho(f"ERROR: {e}", fg="red", bold=True, err=True)
+        sys.exit(1)
+
+
+@policies.command("policy-rm")
+@click.argument("pdp_name", required=False, default=None)
+@click.option("--yes", "-y", is_flag=True, default=False, help="Skip confirmation prompt.")
+def policies_policy_rm(pdp_name: str | None, yes: bool):
+    """Delete a raw rego policy from a PDP (interactive if name omitted)."""
+    from dotenv import load_dotenv
+    load_dotenv(".env", override=False)
+    from steve_cli.policies import PolicyClient
+    try:
+        client = PolicyClient()
+        pdps = client.list_pdps()
+    except Exception as e:
+        click.secho(f"ERROR: {e}", fg="red", bold=True, err=True)
+        sys.exit(1)
+    if not pdps:
+        click.echo("No PDPs registered.")
+        return
+    if pdp_name is None:
+        pdp_name = questionary.select(
+            "Select a PDP:",
+            choices=[p["name"] for p in pdps],
+        ).ask()
+        if pdp_name is None:
+            sys.exit(0)
+    pdp = next((p for p in pdps if p["name"] == pdp_name), None)
+    if not pdp:
+        click.secho(f"PDP '{pdp_name}' not found.", fg="red", err=True)
+        sys.exit(1)
+    policies_list = pdp.get("policies", [])
+    if not policies_list:
+        click.echo(f"No policies on PDP '{pdp_name}'.")
+        return
+    choices = [p.get("name", p.get("id", "?")) for p in policies_list]
+    policy_name = questionary.select(
+        "Select a policy to delete:",
+        choices=choices,
+    ).ask()
+    if policy_name is None:
+        sys.exit(0)
+    policy = next((p for p in policies_list if p.get("name", p.get("id")) == policy_name), None)
+    if not yes:
+        if not questionary.confirm(f"Delete policy '{policy_name}' from PDP '{pdp_name}'?", default=False).ask():
+            click.echo("Aborted.")
+            return
+    try:
+        client.delete_pdp_policy(policy["id"])
+        click.secho(f"Deleted policy '{policy_name}' from PDP '{pdp_name}'.", fg="green")
+    except Exception as e:
+        click.secho(f"ERROR: {e}", fg="red", bold=True, err=True)
+        sys.exit(1)
+
+
 @main.command("login")
 @click.option("--token", default=None, help="Service principal token (stp_...) to save")
 @click.option("--workspace", "workspace_id", default=None, help="Workspace ID (defaults to WORKSPACE_ID from .env)")
@@ -1112,6 +1371,7 @@ def status(env_file: tuple, no_check: bool):
     expires_at = entry.get("expires_at", "")
     if token:
         expiry_warn = False
+        token_expired = False
         expiry_str = ", expires never" if not expires_at else ""
         if expires_at:
             try:
@@ -1129,6 +1389,7 @@ def status(env_file: tuple, no_check: bool):
                         ago = f"{s // 86400}d ago"
                     expiry_str = f", expired {ago}"
                     expiry_warn = True
+                    token_expired = True
                 elif total_seconds < 3600:
                     expiry_str = f", expires in {total_seconds // 60}m ⚠"
                     expiry_warn = True
@@ -1163,12 +1424,18 @@ def status(env_file: tuple, no_check: bool):
                 )
                 with urllib.request.urlopen(_req, timeout=4) as _r:
                     _r.read()
-                _row("Auth", f"✓ token valid  (stp_***{token[-4:]}{expiry_str})", "green" if not expiry_warn else "yellow")
+                if token_expired:
+                    _row("Auth", f"✗ token expired  (stp_***{token[-4:]}{expiry_str}) — run: steve login", "red")
+                else:
+                    _row("Auth", f"✓ token valid  (stp_***{token[-4:]}{expiry_str})", "green" if not expiry_warn else "yellow")
             except urllib.error.HTTPError as _e:
                 if _e.code == 401:
                     _row("Auth", f"✗ token invalid/revoked  (stp_***{token[-4:]}{expiry_str})", "red")
                 else:
-                    _row("Auth", f"✓ token valid  (stp_***{token[-4:]}{expiry_str})", "green" if not expiry_warn else "yellow")
+                    if token_expired:
+                        _row("Auth", f"✗ token expired  (stp_***{token[-4:]}{expiry_str}) — run: steve login", "red")
+                    else:
+                        _row("Auth", f"✓ token valid  (stp_***{token[-4:]}{expiry_str})", "green" if not expiry_warn else "yellow")
             except Exception as _e:
                 _row("Auth", f"{token_display}  (validation failed: {_e})", token_color)
         else:
@@ -1212,8 +1479,7 @@ def status(env_file: tuple, no_check: bool):
         if trino_schema_explicit:
             schema = trino_schema_explicit
         elif resolved_workspace:
-            ws_clean = resolved_workspace.lower().replace("-", "_")
-            schema = f"{ws_clean}_{tier}__{branch}"
+            schema = branch
         else:
             schema = f"(workspace not set — set WORKSPACE_NAME)"
         _row(f"Schema {tier}", schema, "cyan" if resolved_workspace or trino_schema_explicit else "yellow")

steve_cli-1.1.1/steve_cli/policies/client.py

@@ -0,0 +1,205 @@
+from __future__ import annotations
+
+import json
+import os
+import re
+from copy import deepcopy
+from pathlib import Path
+from typing import Any, Literal
+
+import httpx
+
+_EMAIL_RE = re.compile(r'^[^@\s]+@[^@\s]+\.[^@\s]+$')
+
+_POLICY_VERSION = "v0"
+
+
+def _expand_schema(schema: str, sanitized_branch: str) -> str:
+    if schema == sanitized_branch or not schema:
+        return sanitized_branch
+    return schema
+
+
+def _expand_rules(rules: list[dict[str, Any]], sanitized_branch: str, workspace: str = "") -> list[dict[str, Any]]:
+    expanded = []
+    for rule in rules:
+        rule = deepcopy(rule)
+        for entry in rule.get("tables", []):
+            if "schema" in entry:
+                entry["schema"] = _expand_schema(entry["schema"], sanitized_branch)
+                if workspace and "catalogs" not in entry:
+                    tier = entry.get("tier", "bronze")
+                    entry["catalogs"] = [f"{workspace}-{tier}"]
+        for entry in rule.get("columns", []):
+            if "schema" in entry:
+                entry["schema"] = _expand_schema(entry["schema"], sanitized_branch)
+        expanded.append(rule)
+    return expanded
+
+
+class PolicyClient:
+    def __init__(
+        self,
+        endpoint: str | None = None,
+        token: str | None = None,
+        workspace_id: str | None = None,
+    ):
+        from steve_cli.auth import get_service_url, get_token
+        if endpoint is None:
+            endpoint = get_service_url("pcp", workspace_id) or "http://policy-control-plane:3010"
+        self.endpoint = endpoint.rstrip("/")
+        self.token = token or get_token(workspace_id) or ""
+
+    def __trpc(self, method: str, path: str, payload: dict | None = None) -> dict:
+        url = f"{self.endpoint}/api/trpc/{path}"
+        headers = {"Authorization": f"Bearer {self.token}"} if self.token else {}
+        if method == "query":
+            resp = httpx.get(url, params={"input": json.dumps(payload or {})}, headers=headers, timeout=10)
+        else:
+            resp = httpx.post(url, json=payload or {}, headers=headers, timeout=10)
+        resp.raise_for_status()
+        data = resp.json()
+        if "error" in data:
+            raise RuntimeError(f"tRPC error on {path}: {data['error']}")
+        result = data.get("result", {})
+        if isinstance(result, list):
+            return result
+        data_inner = result.get("data", result)
+        if isinstance(data_inner, list):
+            return data_inner
+        if isinstance(data_inner, dict):
+            return data_inner.get("json", data_inner)
+        return data_inner
+
+    def _trpc(self, method: str, path: str, payload: dict | None = None) -> dict:
+        try:
+            return self.__trpc(method, path, payload)
+        except httpx.ConnectError as e:
+            raise EnvironmentError(
+                f"Cannot reach Policy Control Plane at {self.endpoint} — "
+                f"run `steve login` to configure credentials"
+            ) from e
+
+    def list_pdps(self) -> list[dict]:
+        return self._trpc("query", "pdp.list") or []
+
+    def list_workspaces(self) -> list[str]:
+        return self._trpc("query", "workspace.list") or []
+
+    def list_workspace_pdps(self, workspace: str) -> list[dict]:
+        return self._trpc("query", "workspace.listPdps", {"workspace": workspace}) or []
+
+    def delete_pdp(self, pdp_id: str) -> dict:
+        return self._trpc("mutation", "pdp.delete", {"id": pdp_id})
+
+    def delete_pdp_policy(self, policy_id: str) -> dict:
+        return self._trpc("mutation", "pdp.policy.delete", {"id": policy_id})
+
+    def register_pdp(self, name: str, endpoint: str, pdp_type: str = "opa", is_default: bool = True) -> dict:
+        return self._trpc("mutation", "pdp.register", {
+            "name": name,
+            "type": pdp_type,
+            "endpoint": endpoint,
+            "isDefault": is_default,
+        })
+
+    def attach_pdp(self, workspace: str, pdp_id: str) -> None:
+        self._trpc("mutation", "workspace.attachPdp", {"workspace": workspace, "pdpId": pdp_id})
+
+    def apply_policies(self, workspace: str, pdp_name: str, rules: list[dict[str, Any]]) -> dict:
+        return self._trpc("mutation", "workspace.applyPolicies", {
+            "workspace": workspace,
+            "fragments": [
+                {
+                    "syntax": "dsl",
+                    "target": pdp_name,
+                    "content": {"rules": rules},
+                }
+            ],
+        })
+
+    def _validate_against_trino(self, rules: list[dict[str, Any]], sanitized_branch: str) -> list[str]:
+        workspace_id = os.environ.get("WORKSPACE_ID")
+        workspace_name = os.environ.get("WORKSPACE_NAME", "")
+
+        seen: dict[str, list[str]] = {}
+        for rule in rules:
+            for entry in list(rule.get("tables", [])) + list(rule.get("columns", [])):
+                schema = entry.get("schema", "")
+                table = entry.get("table", "")
+                if schema and table:
+                    seen.setdefault(schema, [])
+                    if table not in seen[schema]:
+                        seen[schema].append(table)
+
+        results: list[str] = []
+        for schema, tables in seen.items():
+            tier = "bronze"
+            ws_clean = workspace_name.lower().replace("-", "_") if workspace_name else ""
+            catalog = f"{workspace_name}-{tier}" if workspace_name else f"minio-{tier}"
+
+            try:
+                from steve_cli.storage.trino import TrinoStorage
+                storage = TrinoStorage(tier=tier, workspace=workspace_name or None)
+                existing = storage._execute(f'SHOW TABLES FROM "{storage.catalog}".{schema}')
+                existing_names = {r.get("Table", "") for r in existing}
+                catalog = storage.catalog
+            except Exception as exc:
+                results.append(f"⚠ cannot reach Trino to validate schema '{schema}': {exc}")
+                continue
+
+            for table in tables:
+                if table in existing_names:
+                    results.append(f"✓ {catalog}.{schema}.{table}")
+                else:
+                    results.append(
+                        f"⚠ table '{table}' not found in '{catalog}.{schema}'"
+                        + (f" (found: {sorted(existing_names)})" if existing_names else " (schema empty or not found)")
+                    )
+        return results
+
+    def apply_from_file(self, policies_file: Path | None = None, validate: Literal[None, "warn", "error"] = None) -> tuple[str, str]:
+        path = policies_file or Path.cwd() / "policies" / "access.yaml"
+        if not path.exists():
+            raise FileNotFoundError(f"Policies file not found: {path}")
+
+        import yaml
+        config: dict[str, Any] = yaml.safe_load(path.read_text())
+        workspace = config["workspace"]
+        pdp_cfg = config["pdp"]
+        rules = config.get("rules", [])
+
+        invalid_users = [r["user"] for r in rules if not _EMAIL_RE.match(r.get("user", ""))]
+        if invalid_users:
+            raise ValueError(
+                f"Invalid user(s) in rules — expected email addresses, got: {invalid_users}. "
+                f"Use group-based access for wildcard permissions instead."
+            )
+
+        from steve_cli.storage.branch import get_branch_prefix
+        sanitized = get_branch_prefix()
+        branch = sanitized
+        rules = _expand_rules(rules, sanitized, workspace)
+
+        pdp = self.register_pdp(
+            name=pdp_cfg["name"],
+            endpoint=pdp_cfg["endpoint"],
+            pdp_type=pdp_cfg.get("type", "opa"),
+        )
+        self.attach_pdp(workspace, pdp["id"])
+        result = self.apply_policies(workspace, pdp_cfg["name"], rules)
+
+        errors = result.get("errors", [])
+        if errors:
+            reasons = "; ".join(e["reason"] for e in errors)
+            raise RuntimeError(f"Failed to apply {len(errors)} policy fragment(s): {reasons}")
+
+        if validate is not None:
+            issues = self._validate_against_trino(rules, sanitized)
+            failed = [msg for msg in issues if msg.startswith("⚠")]
+            for msg in issues:
+                print(msg)
+            if failed and validate == "error":
+                raise RuntimeError(f"Validation failed: {len(failed)} issue(s) found")
+
+        return branch, sanitized

{steve_cli-1.0.2 → steve_cli-1.1.1}/steve_cli/storage/branch.py

@@ -33,8 +33,24 @@ def get_branch_prefix() -> str:
             branch = result.stdout.strip()
             if branch and branch != "HEAD":
                 return _sanitize(branch)
+            if branch == "HEAD":
+                sha_result = subprocess.run(
+                    ["git", "rev-parse", "--short", "HEAD"],
+                    capture_output=True,
+                    text=True,
+                    timeout=3,
+                )
+                if sha_result.returncode == 0 and sha_result.stdout.strip():
+                    short_sha = sha_result.stdout.strip()
+                    logger.warning(
+                        "Detached HEAD: using commit SHA as branch prefix (sha_%s). "
+                        "Set STEVE_BRANCH to override.",
+                        short_sha,
+                    )
+                    return f"sha_{short_sha}"
     except Exception as exc:
         logger.debug("git branch detection failed: %s", exc)
 
-    logger.warning("Could not detect git branch; defaulting to 'main'")
-    return "main"
+    raise RuntimeError(
+        "Could not detect git branch. Set STEVE_BRANCH=<branch-name> and retry."
+    )

{steve_cli-1.0.2 → steve_cli-1.1.1}/steve_cli/storage/trino.py

@@ -15,9 +15,8 @@ from .branch import get_branch_prefix
 logger = logging.getLogger(__name__)
 
 
-def _derive_schema(tier: str, workspace: str | None, branch: str) -> str:
-    base = f"{workspace.lower().replace('-', '_')}_{tier.lower()}" if workspace else tier.lower()
-    return f"{base}__{branch}"
+def _derive_schema(_tier: str, _workspace: str | None, branch: str) -> str:
+    return branch
 
 
 class TrinoStorage:
@@ -44,7 +43,9 @@ class TrinoStorage:
         self.schema = os.environ.get("TRINO_SCHEMA") or _derive_schema(tier, resolved_workspace, self._branch)
         self.user = os.getenv("TRINO_USER") or resolved_workspace or "admin"
         self._base = trino_endpoint.rstrip("/")
-        self._lakekeeper_endpoint = os.getenv("LAKEKEEPER_ENDPOINT") or get_service_url("lakekeeper", self._workspace_id)
+        _lk_env = os.getenv("LAKEKEEPER_ENDPOINT")
+        _lk_svc = get_service_url("lakekeeper", self._workspace_id)
+        self._lakekeeper_endpoint = _lk_env.rstrip("/") if _lk_env else (_lk_svc.rstrip("/") + "/catalog" if _lk_svc else None)
         self._lakekeeper_warehouse = os.getenv("LAKEKEEPER_WAREHOUSE", default_catalog)
         _iceberg_bucket = os.getenv(f"{tier.upper()}_BUCKET", "")
         if _iceberg_bucket:

{steve_cli-1.0.2 → steve_cli-1.1.1}/steve_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: steve-cli
-Version: 1.0.2
+Version: 1.1.1
 Summary: A simple CLI tool to run jobs from jobs.yaml with proper environment setup
 Author: Frank
 License: MIT

steve_cli-1.0.2/steve_cli/policies/client.py

@@ -1,93 +0,0 @@
-from __future__ import annotations
-
-import json
-from pathlib import Path
-from typing import Any
-
-import httpx
-
-_POLICY_VERSION = "v0"
-
-
-class PolicyClient:
-    def __init__(
-        self,
-        endpoint: str | None = None,
-        token: str | None = None,
-        workspace_id: str | None = None,
-    ):
-        from steve_cli.auth import get_service_url, get_token
-        if endpoint is None:
-            endpoint = get_service_url("pcp", workspace_id) or "http://policy-control-plane:3010"
-        self.endpoint = endpoint.rstrip("/")
-        self.token = token or get_token(workspace_id) or ""
-
-    def __trpc(self, method: str, path: str, payload: dict | None = None) -> dict:
-        url = f"{self.endpoint}/api/trpc/{path}"
-        headers = {"Authorization": f"Bearer {self.token}"} if self.token else {}
-        if method == "query":
-            resp = httpx.get(url, params={"input": json.dumps(payload or {})}, headers=headers, timeout=10)
-        else:
-            resp = httpx.post(url, json=payload or {}, headers=headers, timeout=10)
-        resp.raise_for_status()
-        data = resp.json()
-        if "error" in data:
-            raise RuntimeError(f"tRPC error on {path}: {data['error']}")
-        result = data.get("result", {})
-        return result.get("data", {}).get("json", result.get("data", result))
-
-    def _trpc(self, method: str, path: str, payload: dict | None = None) -> dict:
-        try:
-            return self.__trpc(method, path, payload)
-        except httpx.ConnectError as e:
-            raise EnvironmentError(
-                f"Cannot reach Policy Control Plane at {self.endpoint} — "
-                f"run `steve login` to configure credentials"
-            ) from e
-
-    def register_pdp(self, name: str, endpoint: str, pdp_type: str = "opa", is_default: bool = True) -> dict:
-        return self._trpc("mutation", "pdp.register", {
-            "name": name,
-            "type": pdp_type,
-            "endpoint": endpoint,
-            "isDefault": is_default,
-        })
-
-    def attach_pdp(self, workspace: str, pdp_id: str) -> None:
-        self._trpc("mutation", "workspace.attachPdp", {"workspace": workspace, "pdpId": pdp_id})
-
-    def apply_policies(self, workspace: str, pdp_name: str, rules: list[dict[str, Any]]) -> dict:
-        return self._trpc("mutation", "workspace.applyPolicies", {
-            "workspace": workspace,
-            "fragments": [
-                {
-                    "syntax": "dsl",
-                    "target": pdp_name,
-                    "content": {"rules": rules},
-                }
-            ],
-        })
-
-    def apply_from_file(self, policies_file: Path | None = None) -> None:
-        path = policies_file or Path.cwd() / "policies" / "access.yaml"
-        if not path.exists():
-            raise FileNotFoundError(f"Policies file not found: {path}")
-
-        import yaml
-        config: dict[str, Any] = yaml.safe_load(path.read_text())
-        workspace = config["workspace"]
-        pdp_cfg = config["pdp"]
-        rules = config.get("rules", [])
-
-        pdp = self.register_pdp(
-            name=pdp_cfg["name"],
-            endpoint=pdp_cfg["endpoint"],
-            pdp_type=pdp_cfg.get("type", "opa"),
-        )
-        self.attach_pdp(workspace, pdp["id"])
-        result = self.apply_policies(workspace, pdp_cfg["name"], rules)
-
-        errors = result.get("errors", [])
-        if errors:
-            reasons = "; ".join(e["reason"] for e in errors)
-            raise RuntimeError(f"Failed to apply {len(errors)} policy fragment(s): {reasons}")