systemlink-cli 2.1.0__tar.gz → 2.3.0__tar.gz

{systemlink_cli-2.1.0 → systemlink_cli-2.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: systemlink-cli
-Version: 2.1.0
+Version: 2.3.0
 Summary: SystemLink Integrator CLI - cross-platform CLI for SystemLink workflows and templates.
 License-File: LICENSE
 Author: Fred Visser
@@ -18,6 +18,7 @@ Requires-Dist: cryptography (>=49.0.0)
 Requires-Dist: filelock (>=3.20,<4)
 Requires-Dist: httpcore2 (>=2.10.0,<3) ; extra == "mcp"
 Requires-Dist: httpx2 (>=2.12.0,<3) ; extra == "mcp"
+Requires-Dist: idna (>=3.10,<4)
 Requires-Dist: keyring (>=25.6.0,<26.0.0)
 Requires-Dist: mcp (>=2,<3) ; extra == "mcp"
 Requires-Dist: msgpack (>=1.1,<2) ; extra == "managed-client"

{systemlink_cli-2.1.0 → systemlink_cli-2.3.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "systemlink-cli"
-version = "2.1.0"
+version = "2.3.0"
 description = "SystemLink Integrator CLI - cross-platform CLI for SystemLink workflows and templates."
 authors = ["Fred Visser <fred.visser@emerson.com>"]
 packages = [{ include = "slcli" }]
@@ -29,6 +29,7 @@ click = ">=7.1.2"
 filelock = ">=3.20,<4"
 keyring = "^25.6.0"
 requests = "^2.32.4"
+idna = ">=3.10,<4"
 tabulate = "^0.10.0"
 truststore = ">=0.9,<0.11"
 watchdog = "^6.0.0"

{systemlink_cli-2.1.0 → systemlink_cli-2.3.0}/slcli/_version.py

@@ -1,4 +1,4 @@
 """Version information for slcli."""
 
 # This file is auto-generated. Do not edit manually.
-__version__ = "2.1.0"
+__version__ = "2.3.0"

{systemlink_cli-2.1.0 → systemlink_cli-2.3.0}/slcli/config_click.py

@@ -6,6 +6,7 @@ import os
 import re
 import ssl
 import sys
+from pathlib import Path
 from typing import Any, NoReturn, Optional
 from urllib.parse import urlparse
 
@@ -26,14 +27,16 @@ from .platform import (
 from .profiles import Profile, ProfileConfig, check_config_file_permissions
 from .rich_output import render_table
 from .ssl_trust import (
+    get_managed_trust_path,
     get_managed_trust_records,
     get_ssl_server_origin,
     inspect_server_certificate,
+    load_ca_certificate,
     remove_managed_trust,
     save_managed_certificate,
 )
 from .table_utils import output_formatted_list
-from .utils import ExitCodes, get_base_url, get_base_url_resolution
+from .utils import ExitCodes, get_base_url_resolution
 
 API_KEY_LENGTH = 42
 API_KEY_PATTERN = re.compile(rf"^[A-Za-z0-9_-]{{{API_KEY_LENGTH}}}$")
@@ -765,12 +768,31 @@ def register_config_commands(cli: Any) -> None:
             )
 
         certificate_details = certificate.to_dict()
+        trusted_certificate = None
+        try:
+            trusted_path = get_managed_trust_path(certificate.origin)
+            if trusted_path is not None:
+                trusted_certificate = json.loads(
+                    trusted_path.with_suffix(".json").read_text(encoding="utf-8")
+                )
+                trusted_certificate["origin"] = certificate.origin
+                trusted_certificate.setdefault("trust-type", "leaf")
+        except (OSError, ValueError) as exc:
+            click.echo(f"Could not read managed certificate metadata: {exc}.", err=True)
+            trusted_certificate = None
         if output_format == "json":
+            certificate_details["trusted-certificate"] = trusted_certificate
             click.echo(json.dumps(certificate_details, indent=2))
             return
 
         click.echo(f"Server certificate for {certificate_details.get('origin', 'unknown')}")
         _show_certificate_details(certificate_details)
+        if trusted_certificate:
+            kind = "CA" if trusted_certificate.get("trust-type") == "ca" else "leaf"
+            click.echo(f"\nTrusted {kind} certificate for this origin")
+            _show_certificate_details(trusted_certificate)
+        else:
+            click.echo("\nNo managed trust certificate for this origin.")
 
     @trust.command(name="list")
     @click.option(
@@ -794,13 +816,14 @@ def register_config_commands(cli: Any) -> None:
             [
                 str(record.get("origin", "")),
                 str(record.get("fingerprint", "")),
+                "CA" if record.get("trust-type") == "ca" else "leaf",
                 "yes" if record.get("self-signed") else "no",
             ]
             for record in records
         ]
         render_table(
-            headers=["SERVER", "SHA-256", "SELF-SIGNED"],
-            column_widths=[40, 64, 12],
+            headers=["SERVER", "SHA-256", "TRUST TYPE", "SELF-SIGNED"],
+            column_widths=[40, 64, 10, 12],
             rows=rows,
             show_total=True,
             total_label="certificate(s)",
@@ -808,30 +831,47 @@ def register_config_commands(cli: Any) -> None:
 
     @trust.command(name="add")
     @click.option("--url", help="HTTPS server URL (defaults to the active API URL)")
+    @click.option(
+        "--certificate",
+        type=click.Path(exists=True, dir_okay=False, path_type=Path),
+        help="Import one public CA certificate (PEM or DER), scoped to this server origin",
+    )
     @click.option(
         "--fingerprint",
         required=True,
         help="Expected SHA-256 fingerprint of the certificate to trust",
     )
-    def add_trusted_certificate(url: Optional[str], fingerprint: str) -> None:
-        """Trust a server certificate after verifying its fingerprint."""
-        server_url = url or get_base_url()
+    def add_trusted_certificate(
+        url: Optional[str], certificate: Optional[Path], fingerprint: str
+    ) -> None:
+        """Trust a live server certificate or imported CA after fingerprint verification."""
+        server_url = url or get_base_url_resolution().value
         try:
             expected_fingerprint = _normalize_fingerprint(fingerprint)
-            certificate = inspect_server_certificate(server_url)
+            trusted_certificate = (
+                load_ca_certificate(server_url, certificate)
+                if certificate is not None
+                else inspect_server_certificate(server_url)
+            )
         except (OSError, ValueError, ssl.SSLError) as exc:
-            _exit_with_validation_error(f"Could not inspect the server certificate: {exc}.")
+            _exit_with_validation_error(f"Could not load the certificate: {exc}.")
 
-        _show_certificate_warning(certificate.to_dict())
-        if certificate.fingerprint != expected_fingerprint:
+        _show_certificate_details(trusted_certificate.to_dict(), err=True)
+        if trusted_certificate.fingerprint != expected_fingerprint:
             _exit_with_validation_error(
-                "The server certificate fingerprint does not match the supplied fingerprint."
+                "The certificate fingerprint does not match the supplied fingerprint."
+            )
+        if trusted_certificate.trust_type == "ca":
+            click.echo(
+                "Trusting certificates issued by this CA for this origin only; "
+                "hostname and validity verification remain enabled.",
+                err=True,
             )
         try:
-            path = save_managed_certificate(certificate)
+            path = save_managed_certificate(trusted_certificate)
         except OSError as exc:
             _exit_with_validation_error(f"Could not save the trusted certificate: {exc}.")
-        click.echo(f"✓ Trusted certificate for {certificate.origin}")
+        click.echo(f"✓ Trusted certificate for {trusted_certificate.origin}")
         click.echo(f"  Certificate file: {path}")
 
     @trust.command(name="remove")
@@ -839,7 +879,7 @@ def register_config_commands(cli: Any) -> None:
     @click.option("--force", is_flag=True, help="Skip confirmation prompt")
     def remove_trusted_certificate(url: Optional[str], force: bool) -> None:
         """Remove a server certificate from the managed trust store."""
-        server_url = url or get_base_url()
+        server_url = url or get_base_url_resolution().value
         try:
             origin = get_ssl_server_origin(server_url)
         except ValueError as exc:

{systemlink_cli-2.1.0 → systemlink_cli-2.3.0}/slcli/main.py

@@ -35,7 +35,7 @@ from .rich_output import install_rich_output, render_table
 from .routine_click import register_routine_commands
 from .skill_click import register_skill_commands
 from .spec_click import register_spec_commands
-from .ssl_trust import OS_TRUST_INJECTED, OS_TRUST_REASON
+from .ssl_trust import OS_TRUST_INJECTED, OS_TRUST_REASON, create_explicit_tls_context
 from .state_click import register_state_commands
 from .system_click import register_system_commands
 from .tag_click import register_tag_commands
@@ -143,11 +143,11 @@ def _build_tls_debug_context(ssl_verify: Union[bool, str]) -> ssl.SSLContext:
         return ctx
 
     if isinstance(ssl_verify, str):
-        return ssl.create_default_context(cafile=ssl_verify)
+        return create_explicit_tls_context(ssl_verify)
 
     verify_env = os.environ.get("REQUESTS_CA_BUNDLE") or os.environ.get("SSL_CERT_FILE")
     if verify_env:
-        return ssl.create_default_context(cafile=verify_env)
+        return create_explicit_tls_context(verify_env)
 
     if OS_TRUST_INJECTED:
         try:

{systemlink_cli-2.1.0 → systemlink_cli-2.3.0}/slcli/managed_client/transport.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import socket
+import threading
 from collections import deque
 from dataclasses import dataclass
 from urllib.parse import urlsplit
@@ -12,6 +13,7 @@ from .protocol import MAX_FRAME_SIZE, MessagePackStream, SaltMessage
 
 DEFAULT_REQUEST_PORT = 4506
 DEFAULT_PUBLISH_PORT = 4505
+IDLE_RECEIVE_POLL_INTERVAL = 0.1
 
 
 @dataclass(frozen=True)
@@ -53,6 +55,7 @@ class SaltChannel:
         self._decoder = MessagePackStream(max_frame_size=max_frame_size)
         self._pending: deque[SaltMessage] = deque()
         self._closed = False
+        self._receive_lock = threading.RLock()
 
     @classmethod
     def connect(
@@ -80,7 +83,7 @@ class SaltChannel:
             raise TransportError("Unable to send a Salt message.") from error
 
     def receive(self, *, ignore_timeout: bool = False) -> SaltMessage:
-        """Read until one complete Salt MessagePack message is available."""
+        """Read a complete Salt message, polling for closure when ignoring timeouts."""
         if self._closed:
             raise TransportError("The Salt channel is closed.")
         if self._pending:
@@ -89,7 +92,23 @@ class SaltChannel:
             if self._closed:
                 raise TransportError("The Salt channel is closed.")
             try:
-                data = self._connection.recv(65536)
+                with self._receive_lock:
+                    if self._closed:
+                        raise TransportError("The Salt channel is closed.")
+                    if ignore_timeout:
+                        timeout = self._connection.gettimeout()
+                        self._connection.settimeout(
+                            IDLE_RECEIVE_POLL_INTERVAL
+                            if timeout is None
+                            else min(timeout, IDLE_RECEIVE_POLL_INTERVAL)
+                        )
+                        try:
+                            data = self._connection.recv(65536)
+                        finally:
+                            if not self._closed:
+                                self._connection.settimeout(timeout)
+                    else:
+                        data = self._connection.recv(65536)
             except socket.timeout as error:
                 if ignore_timeout:
                     continue
@@ -105,7 +124,7 @@ class SaltChannel:
                 return self._pending.popleft()
 
     def close(self) -> None:
-        """Close the socket and release its file descriptor."""
+        """Interrupt active reads before releasing the socket descriptor."""
         if self._closed:
             return
         self._closed = True
@@ -113,7 +132,8 @@ class SaltChannel:
             self._connection.shutdown(socket.SHUT_RDWR)
         except OSError:
             pass
-        try:
-            self._connection.close()
-        except OSError:
-            pass
+        with self._receive_lock:
+            try:
+                self._connection.close()
+            except OSError:
+                pass

{systemlink_cli-2.1.0 → systemlink_cli-2.3.0}/slcli/policy_click.py

@@ -18,6 +18,7 @@ from .policy_utils import (
     _format_template_list_row,
     _load_statements_from_file,
     _parse_properties_from_cli,
+    _validate_statements,
 )
 from .universal_handlers import FilteredResponse, UniversalResponseHandler
 from .utils import (
@@ -534,6 +535,86 @@ def register_policy_commands(cli: Any) -> None:
         except Exception as exc:
             handle_api_error(exc)
 
+    @template_group.command(name="update")
+    @click.argument("template_id")
+    @click.option("--name", type=str, default=None, help="New policy template name")
+    @click.option(
+        "--type",
+        "template_type",
+        type=click.Choice(["user", "service"], case_sensitive=False),
+        default=None,
+        help="New policy template type",
+    )
+    @click.option(
+        "--statements-file",
+        type=click.Path(exists=True, dir_okay=False),
+        default=None,
+        help='JSON file containing a statements list or an object with a "statements" list',
+    )
+    @click.option(
+        "--properties",
+        "-p",
+        multiple=True,
+        help="Updated custom properties as key=value (repeatable)",
+    )
+    @click.option(
+        "--format",
+        "-f",
+        type=click.Choice(["table", "json"]),
+        default="table",
+        show_default=True,
+        help="Output format",
+    )
+    def update_template(
+        template_id: str,
+        name: Optional[str],
+        template_type: Optional[str],
+        statements_file: Optional[str],
+        properties: Tuple[str, ...],
+        format: str,
+    ) -> None:
+        """Update selected fields on a reusable policy template."""
+        from .utils import check_readonly_mode
+
+        check_readonly_mode("update a policy template")
+
+        try:
+            payload: Dict[str, Any] = {}
+            if name is not None:
+                payload["name"] = name
+            if template_type is not None:
+                payload["type"] = template_type.lower()
+            if statements_file is not None:
+                statements = _load_statements_from_file(statements_file)
+                is_valid, error_message = _validate_statements(
+                    statements,
+                    require_workspace=False,
+                )
+                if not is_valid:
+                    raise ValueError(error_message or "Invalid statements")
+                payload["statements"] = statements
+            if properties:
+                payload["properties"] = _parse_properties_from_cli(properties)
+            if not payload:
+                raise ValueError("At least one update option is required")
+        except ValueError as exc:
+            click.echo(f"✗ Error: {exc}", err=True)
+            sys.exit(ExitCodes.INVALID_INPUT)
+
+        try:
+            url = f"{get_base_url()}/niauth/v1/policy-templates/{template_id}"
+            current_template = make_api_request("GET", url, payload=None).json()
+            merged_payload = {
+                field: current_template[field]
+                for field in ("name", "type", "statements", "properties")
+                if field in current_template
+            }
+            merged_payload.update(payload)
+            resp = make_api_request("PUT", url, payload=merged_payload)
+            _display_template_details(resp.json(), format)
+        except Exception as exc:
+            handle_api_error(exc)
+
     @template_group.command(name="list")
     @click.option(
         "--type",

{systemlink_cli-2.1.0 → systemlink_cli-2.3.0}/slcli/skills/slcli/references/commands.md

@@ -746,6 +746,7 @@ slcli auth policy diff <POLICY_ID_1> <POLICY_ID_2>  # Compare two policies
 # Policy templates
 slcli auth template list [-t INT] [-f json]
 slcli auth template create --name TEXT --statements-file PATH [--type user|service] [-p KEY=VALUE] [-f json]
+slcli auth template update TEMPLATE_ID [--name TEXT] [--type user|service] [--statements-file PATH] [-p KEY=VALUE] [-f json]
 slcli auth template get <TEMPLATE_ID> [-f json]
 slcli auth template delete <TEMPLATE_ID>
 ```
@@ -759,6 +760,10 @@ or an object with a `statements` array, for example:
 [{"actions": ["testresult:Read"], "resource": ["*"]}]
 ```
 
+`auth template update` fetches the current template and preserves unspecified
+fields before sending `PUT /niauth/v1/policy-templates/{template-id}`.
+Supplied statements and properties replace their existing values.
+
 Workspace fields are not required. Properties are repeatable string-valued
 `key=value` pairs. JSON output returns the full created template, including
 its ID. Apply that ID to a workspace using `auth policy create TEMPLATE_ID