supa.cc 0.3.0__py3-none-any.whl

supa_cc/__init__.py

@@ -0,0 +1,2 @@
+"""Supa.cc - CLI para gerenciamento de contas Supabase."""
+__version__ = "0.3.0"

supa_cc/__main__.py

@@ -0,0 +1,188 @@
+import subprocess
+import click
+import supa_cc
+from .auth import classify_local_failure, normalize_exit_code
+from .environment import detect_environment
+from .installation import installation_guidance
+from .tui import run as run_tui
+from .strings import CLIStrings as Textos
+
+def _exit_with_local_failure(error):
+    result = classify_local_failure(error)
+    click.echo(Textos.MSG_ERROR.format(result.message), err=True)
+    raise click.exceptions.Exit(normalize_exit_code(result.exit_code) or 1)
+
+
+def _check_for_updates():
+    """Verifica se há uma versão mais recente disponível."""
+    import os
+
+    update_hint = installation_guidance(detect_environment()).update_hint
+    pkg_dir = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+    git_dir = os.path.join(pkg_dir, ".git")
+
+    if not os.path.isdir(git_dir):
+        return f"Para verificar atualizações, clone o repositório ou execute: {update_hint}"
+
+    try:
+        local = subprocess.run(
+            ["git", "rev-parse", "--short", "HEAD"],
+            capture_output=True, text=True, check=True, timeout=5, cwd=pkg_dir,
+        )
+        remote = subprocess.run(
+            ["git", "ls-remote", "origin", "HEAD"],
+            capture_output=True, text=True, check=True, timeout=5, cwd=pkg_dir,
+        )
+        local_hash = local.stdout.strip()
+        remote_hash = remote.stdout.split()[0][:7] if remote.stdout else local_hash
+        if remote_hash != local_hash:
+            return f"Nova versão disponível! (local: {local_hash} → remoto: {remote_hash})"
+        return "Você está na versão mais recente."
+    except (subprocess.CalledProcessError, subprocess.TimeoutExpired):
+        return f"Não foi possível verificar atualizações. Verifique sua conexão ou execute: {update_hint}"
+    except FileNotFoundError:
+        return f"Git não encontrado. Para atualizar, execute: {update_hint}"
+
+
+@click.group(invoke_without_command=True)
+@click.version_option(version=supa_cc.__version__, prog_name="supa.cc")
+@click.pass_context
+def main(ctx):
+    """Gerenciador de Contas Supabase"""
+    if ctx.invoked_subcommand is None:
+        try:
+            exit_code = run_tui()
+        except Exception as error:
+            _exit_with_local_failure(error)
+        if exit_code:
+            ctx.exit(normalize_exit_code(exit_code) or 1)
+
+
+@main.command()
+def version():
+    """Mostra a versão e verifica atualizações."""
+    click.echo(f"Supa.cc v{supa_cc.__version__}")
+    click.echo(_check_for_updates())
+
+
+@main.command()
+@click.argument("name")
+def add(name):
+    """Adicionar nova conta."""
+    from .accounts import AccountManager
+
+    token = click.prompt(
+        Textos.PROMPT_ACCESS_TOKEN,
+        hide_input=True,
+        confirmation_prompt=False,
+    )
+    try:
+        manager = AccountManager()
+        manager.add(name, token)
+        click.echo(Textos.MSG_ACCOUNT_ADDED.format(name))
+    except Exception as error:
+        _exit_with_local_failure(error)
+
+
+@main.command("list")
+def list_accounts_command():
+    """Listar contas cadastradas."""
+    from .accounts import AccountManager
+    try:
+        manager = AccountManager()
+        accounts = manager.list()
+    except Exception as error:
+        _exit_with_local_failure(error)
+    if not accounts:
+        click.echo(Textos.MSG_NO_ACCOUNTS)
+        return
+
+    for account in accounts:
+        click.echo(f"  {account.name}")
+
+
+@main.command()
+@click.argument("name")
+def switch(name):
+    """Alternar conta ativa."""
+    from .accounts import AccountManager
+    try:
+        manager = AccountManager()
+        result = manager.set_active(name)
+    except Exception as error:
+        _exit_with_local_failure(error)
+    if result.ok:
+        click.echo(result.message)
+        return
+    click.echo(result.message, err=True)
+    raise click.exceptions.Exit(normalize_exit_code(result.exit_code) or 1)
+
+
+@main.command(
+    context_settings={
+        "ignore_unknown_options": True,
+        "allow_extra_args": True,
+    }
+)
+@click.argument("arguments", nargs=-1, required=True, type=click.UNPROCESSED)
+def run(arguments):
+    """Executar a Supabase CLI com a conta ativa, usando PAT somente no ambiente."""
+    from .accounts import AccountManager
+
+    stdout = click.get_text_stream("stdout")
+    stderr = click.get_text_stream("stderr")
+
+    def stdout_sink(text):
+        stdout.write(text)
+        stdout.flush()
+
+    def stderr_sink(text):
+        stderr.write(text)
+        stderr.flush()
+
+    try:
+        result = AccountManager().run_active(
+            [argument for argument in arguments],
+            stdout_sink=stdout_sink,
+            stderr_sink=stderr_sink,
+        )
+    except Exception as error:
+        _exit_with_local_failure(error)
+    if not result.ok:
+        click.echo(result.message, err=True)
+        raise click.exceptions.Exit(normalize_exit_code(result.exit_code) or 1)
+
+
+@main.command()
+@click.option("--account", type=str, default=None)
+@click.option("--live", is_flag=True, default=False)
+@click.option("--json", "as_json", is_flag=True, default=False)
+def doctor(account, live, as_json):
+    """Diagnosticar executáveis, índice, ambiente e autenticação opcional."""
+    from .diagnostics import DiagnosticService
+
+    try:
+        report = DiagnosticService().run(account=account, live=live)
+    except Exception as error:
+        _exit_with_local_failure(error)
+    click.echo(report.to_json() if as_json else report.to_human())
+    if not report.ok:
+        raise click.exceptions.Exit(normalize_exit_code(report.exit_code) or 1)
+
+
+@main.command()
+@click.argument("name")
+@click.confirmation_option(prompt=Textos.MSG_CONFIRM_REMOVE)
+def remove(name):
+    """Remover conta cadastrada."""
+    from .accounts import AccountManager
+    try:
+        manager = AccountManager()
+        manager.remove(name)
+    except Exception as error:
+        _exit_with_local_failure(error)
+    click.echo(Textos.MSG_ACCOUNT_REMOVED.format(name))
+
+
+if __name__ == "__main__":
+    main()

supa_cc/account_store.py

@@ -0,0 +1,284 @@
+import hashlib
+import json
+import os
+import stat
+from contextlib import contextmanager
+from pathlib import Path
+from typing import Iterator, List, Optional
+
+from .auth import (
+    AccountIndexInvalidError,
+    AccountIndexReadError,
+    AccountTransactionError,
+    is_valid_account_name,
+)
+from .credentials import CredentialStore, create_credential_store
+from .environment import Environment, detect_environment
+from .file_lock import acquire_file_lock, release_file_lock, validate_lock_file
+from .models import Account, AccountSummary
+from .state import atomic_write_text, read_text
+
+
+KEYCHAIN_SERVICE = "supa.cc.supabase.accounts.v2"
+_INDEX_MAX_BYTES = 1024 * 1024
+
+
+def _is_windows() -> bool:
+    return os.name == "nt"
+
+
+def _validated_unique_names(names: List[str]) -> List[str]:
+    unique_names = []
+    seen = set()
+    for name in names:
+        if not is_valid_account_name(name):
+            raise AccountIndexInvalidError(
+                "O índice local de contas contém um nome inválido."
+            )
+        if name not in seen:
+            seen.add(name)
+            unique_names.append(name)
+    return unique_names
+
+
+def safe_load_json_index(path: Path) -> Optional[List[str]]:
+    """Lê o índice; None significa exclusivamente que ele não existe."""
+    try:
+        contents = read_text(path, _INDEX_MAX_BYTES)
+    except OSError:
+        raise AccountIndexReadError(
+            "Não foi possível ler o índice local de contas."
+        ) from None
+    if contents is None:
+        return None
+
+    try:
+        data = json.loads(contents)
+    except json.JSONDecodeError:
+        raise AccountIndexInvalidError(
+            "O índice local de contas é inválido."
+        ) from None
+
+    if not isinstance(data, dict) or not isinstance(data.get("accounts"), list):
+        raise AccountIndexInvalidError(
+            "O índice local de contas é inválido."
+        )
+    return _validated_unique_names(data["accounts"])
+
+
+class AccountStore:
+    def __init__(
+        self,
+        index_path: Optional[Path] = None,
+        service: str = KEYCHAIN_SERVICE,
+        credential_store: Optional[CredentialStore] = None,
+        environment: Optional[Environment] = None,
+    ):
+        environment = environment if environment is not None else detect_environment()
+        self.index_path = (
+            Path(index_path)
+            if index_path is not None
+            else environment.config_directory() / "accounts.json"
+        )
+        self.credential_store = (
+            credential_store
+            if credential_store is not None
+            else create_credential_store(environment, service=service)
+        )
+        stored_service = getattr(self.credential_store, "service", None)
+        self.service = stored_service if isinstance(stored_service, str) else service
+
+    @property
+    def index_lock_path(self) -> Path:
+        return self.index_path.with_name(f".{self.index_path.name}.lock")
+
+    def _ensure_index_parent(self) -> None:
+        self.index_path.parent.mkdir(parents=True, exist_ok=True)
+        if not _is_windows():
+            self.index_path.parent.chmod(0o700)
+
+    @contextmanager
+    def _index_lock(self) -> Iterator[None]:
+        self._ensure_index_parent()
+        flags = os.O_CREAT | os.O_RDWR | getattr(os, "O_NOFOLLOW", 0)
+        descriptor = os.open(self.index_lock_path, flags, 0o600)
+        locked = False
+        try:
+            if not _is_windows():
+                os.fchmod(descriptor, 0o600)
+            validate_lock_file(descriptor, self.index_lock_path)
+            acquire_file_lock(descriptor)
+            locked = True
+            validate_lock_file(descriptor, self.index_lock_path)
+            yield
+        finally:
+            if locked:
+                release_file_lock(descriptor)
+            os.close(descriptor)
+
+    def _read_index_locked(self) -> List[str]:
+        names = safe_load_json_index(self.index_path)
+        return [] if names is None else names
+
+    def _write_index_locked(self, names: List[str]) -> None:
+        unique_names = _validated_unique_names(names)
+        self._ensure_index_parent()
+        data = json.dumps({"accounts": unique_names}, indent=2)
+        atomic_write_text(self.index_path, data)
+
+    def _read_token_uncached(self, name: str) -> Optional[str]:
+        return self.credential_store.get(name)
+
+    def _write_token_verified(self, account: Account) -> None:
+        self.credential_store.set(account)
+
+    def _delete_token(self, name: str) -> None:
+        self.credential_store.delete(name)
+
+    @staticmethod
+    def _backup_name(name: str) -> str:
+        digest = hashlib.sha256(name.encode("utf-8")).hexdigest()
+        return f"!supa.cc-backup!{digest}"
+
+    def _backup_failure(self) -> AccountTransactionError:
+        return AccountTransactionError(
+            "A credencial temporária da transação não pôde ser confirmada com segurança."
+        )
+
+    def create_account_backup(self, name: str) -> None:
+        """Copia a credencial para armazenamento seguro fora do índice público."""
+        backup_name = self._backup_name(name)
+        try:
+            token = self._read_token_uncached(name)
+            if token is None:
+                raise self._backup_failure()
+            self._write_token_verified(Account(name=backup_name, token=token))
+            if self._read_token_uncached(backup_name) != token:
+                raise self._backup_failure()
+        except AccountTransactionError:
+            raise
+        except Exception:
+            raise self._backup_failure() from None
+
+    def read_account_backup(self, name: str) -> Optional[Account]:
+        try:
+            token = self._read_token_uncached(self._backup_name(name))
+        except Exception:
+            raise self._backup_failure() from None
+        return Account(name=name, token=token) if token is not None else None
+
+    def restore_account_backup(self, name: str) -> None:
+        backup = self.read_account_backup(name)
+        if backup is None:
+            raise self._backup_failure()
+        try:
+            self._write_token_verified(backup)
+            if self._read_token_uncached(name) != backup.token:
+                raise self._backup_failure()
+        except AccountTransactionError:
+            raise
+        except Exception:
+            raise self._backup_failure() from None
+
+    def delete_account_backup(self, name: str) -> None:
+        backup_name = self._backup_name(name)
+        try:
+            self._delete_token(backup_name)
+            if self._read_token_uncached(backup_name) is not None:
+                raise self._backup_failure()
+        except AccountTransactionError:
+            raise
+        except Exception:
+            raise self._backup_failure() from None
+
+    def _restore_token_best_effort(self, name: str, token: Optional[str]) -> bool:
+        try:
+            if token is None:
+                self._delete_token(name)
+            else:
+                self._write_token_verified(Account(name=name, token=token))
+        except Exception:
+            return False
+        return True
+
+    def _ensure_initialized(self) -> None:
+        self._read_index()
+
+    def save_account(self, account: Account) -> None:
+        """Salva e confirma uma credencial sem alterar nomes do índice."""
+        self._ensure_initialized()
+        self._write_token_verified(account)
+
+    def get_account(self, name: str) -> Optional[Account]:
+        """Recupera uma credencial diretamente do armazenamento autoritativo."""
+        token = self._read_token_uncached(name)
+        if token:
+            return Account(name=name, token=token)
+        return None
+
+    def list_accounts(self) -> List[AccountSummary]:
+        """Lista nomes sem recuperar tokens do Keychain."""
+        return [AccountSummary(name=name) for name in self._read_index()]
+
+    def delete_account(self, name: str) -> None:
+        """Remove uma credencial sem alterar nomes do índice."""
+        self._ensure_initialized()
+        self._delete_token(name)
+
+    def update_index(self, names: List[str]) -> None:
+        """Substitui o índice sob lock, sem sobrescrever conteúdo inválido."""
+        unique_names = _validated_unique_names(names)
+        with self._index_lock():
+            safe_load_json_index(self.index_path)
+            self._write_index_locked(unique_names)
+
+    def add_account(self, account: Account) -> None:
+        """Grava credencial e nome como uma transação lógica serializada."""
+        with self._index_lock():
+            names = self._read_index_locked()
+            previous_token = self._read_token_uncached(account.name)
+            try:
+                self._write_token_verified(account)
+                if account.name not in names:
+                    names.append(account.name)
+                self._write_index_locked(names)
+            except Exception:
+                if not self._restore_token_best_effort(
+                    account.name,
+                    previous_token,
+                ):
+                    raise AccountTransactionError(
+                        "A operação falhou e não pôde ser revertida com segurança."
+                    ) from None
+                raise
+
+    def remove_account(self, name: str) -> None:
+        """Remove credencial e nome com rollback best-effort sob lock."""
+        with self._index_lock():
+            names = self._read_index_locked()
+            previous_token = self._read_token_uncached(name)
+            try:
+                self._delete_token(name)
+                names = [existing for existing in names if existing != name]
+                self._write_index_locked(names)
+            except Exception:
+                if (
+                    previous_token is not None
+                    and not self._restore_token_best_effort(name, previous_token)
+                ):
+                    raise AccountTransactionError(
+                        "A operação falhou e não pôde ser revertida com segurança."
+                    ) from None
+                raise
+
+    def _read_index(self) -> List[str]:
+        names = safe_load_json_index(self.index_path)
+        if names is not None:
+            return names
+
+        with self._index_lock():
+            names = safe_load_json_index(self.index_path)
+            if names is None:
+                names = []
+                self._write_index_locked(names)
+            return names