tccli 3.0.1189.1__py2.py3-none-any.whl → 3.0.1191.1__py2.py3-none-any.whl

tccli/__init__.py

@@ -1 +1 @@
-__version__ = '3.0.1189.1'
+__version__ = '3.0.1191.1'

tccli/command.py

@@ -6,6 +6,8 @@ import copy
 import tccli.services as Services
 import tccli.options_define as Options_define
 from collections import OrderedDict
+
+from tccli import oauth
 from tccli.utils import Utils
 from tccli.argument import CLIArgument, CustomArgument, ListArgument, BooleanArgument
 from tccli.exceptions import UnknownArgumentError
@@ -176,12 +178,15 @@ class ServiceCommand(BaseCommand):
         service_model = self._get_service_model()
         for action in service_model["actions"]:
             action_model = service_model["actions"][action]
+            action_caller = action_model.get("action_caller", None)
+            if not action_caller:
+                action_caller = Services.action_caller(self._service_name)()[action]
             command_map[action] = ActionCommand(
                 service_name=self._service_name,
                 version=self._version,
                 action_name=action,
                 action_model=action_model,
-                action_caller=Services.action_caller(self._service_name)()[action],
+                action_caller=action_caller,
             )
         return command_map
 
@@ -286,6 +291,7 @@ class ActionCommand(BaseCommand):
             action_parameters = self.cli_unfold_argument.build_action_parameters(parsed_args)
         else:
             action_parameters = self._build_action_parameters(parsed_args, self.argument_map)
+        oauth.maybe_refresh_credential(parsed_globals.profile if parsed_globals.profile else "default")
         return self._action_caller(action_parameters, vars(parsed_globals))
 
     def create_help_command(self):

tccli/configure.py

@@ -416,16 +416,24 @@ class ConfigureCommand(BasicConfigure):
 
     def init_configures(self):
         config = {}
-        if not self._profile_existed("default.configure")[0]:
+        import argparse
+        parser = argparse.ArgumentParser()
+        parser.add_argument("--profile", type=str)
+        args, _ = parser.parse_known_args()
+        profile = args.profile or "default"
+        profile_file = "%s.configure" % profile
+
+        if not self._profile_existed(profile_file)[0]:
             config = {
                 "region": "ap-guangzhou",
                 "output": "json",
                 "arrayCount": 10,
                 "warning": "off"
             }
-        self._init_configure("default.configure", config)
+        self._init_configure(profile_file, config)
+
         for profile_name in os.listdir(self.cli_path):
-            if profile_name == "default.configure":
+            if profile_name == profile_file:
                 continue
             if profile_name.endswith(".configure"):
                 self._init_configure(profile_name, {})

tccli/loaders.py

@@ -9,6 +9,7 @@ from tccli.utils import Utils
 from tccli import __version__
 from tccli.services import SERVICE_VERSIONS
 from collections import OrderedDict
+import tccli.plugin as plugin
 
 BASE_TYPE = ["int64", "uint64", "string", "float", "bool", "date", "datetime", "datetime_iso", "binary"]
 CLI_BASE_TYPE = ["Integer", "String", "Float", "Timestamp", "Boolean", "Binary"]
@@ -175,7 +176,15 @@ class Loader(object):
         return version[1:5] + "-" + version[5:7] + "-" + version[7:9]
 
     def get_available_services(self):
-        return SERVICE_VERSIONS
+        services = copy.deepcopy(SERVICE_VERSIONS)
+        for name, vers in plugin.import_plugins().items():
+            if name not in services:
+                services[name] = []
+            for ver, spec in vers.items():
+                api_ver = spec["metadata"]["apiVersion"]
+                if api_ver not in services[name]:
+                    services[name].append(api_ver)
+        return services
 
     def get_service_default_version(self, service):
         args = sys.argv[1:]
@@ -194,15 +203,41 @@ class Loader(object):
         services_path = self.get_services_path()
         version = "v" + version.replace('-', '')
         apis_path = os.path.join(services_path, service, version, "api.json")
-        if not os.path.exists(apis_path):
+        model = {
+            "metadata": {},
+            "actions": {},
+            "objects": {},
+        }
+        if os.path.exists(apis_path):
+            if six.PY2:
+                with open(apis_path, 'r') as f:
+                    model = json.load(f)
+            else:
+                with open(apis_path, 'r', encoding='utf-8') as f:
+                    model = json.load(f)
+
+        # merge plugins
+        for plugin_name, vers in plugin.import_plugins().items():
+
+            if plugin_name != service:
+                continue
+
+            for ver, spec in vers.items():
+
+                # 2017-03-12 -> v20170312
+                compact_ver = 'v' + ver.replace('-', '')
+
+                if compact_ver != version:
+                    continue
+
+                model["metadata"].update(spec["metadata"])
+                model["actions"].update(spec["actions"])
+                model["objects"].update(spec["objects"])
+
+        if not model:
             raise Exception("Not find service:%s version:%s model" % (service, version))
 
-        if six.PY2:
-            with open(apis_path, 'r') as f:
-                return json.load(f)
-        else:
-            with open(apis_path, 'r', encoding='utf-8') as f:
-                return json.load(f)
+        return model
 
     def get_service_description(self, service, version):
         service_model = self.get_service_model(service, version)

tccli/oauth.py

@@ -0,0 +1,115 @@
+import json
+import os
+import time
+
+import requests
+import uuid
+
+_API_ENDPOINT = "https://cli.cloud.tencent.com"
+_CRED_REFRESH_SAFE_DUR = 60 * 5
+_ACCESS_REFRESH_SAFE_DUR = 60 * 5
+
+
+def maybe_refresh_credential(profile):
+    cred_path = cred_path_of_profile(profile)
+    try:
+        with open(cred_path, "r") as cred_file:
+            cred = json.load(cred_file)
+    except IOError:
+        # file not found, don't check
+        return
+
+    if cred.get("type") != "oauth":
+        return
+
+    try:
+        now = time.time()
+
+        expires_at = cred["expiresAt"]
+        if expires_at - now > _CRED_REFRESH_SAFE_DUR:
+            return
+
+        token_info = cred["oauth"]
+        site = token_info["site"]
+        access_expires = token_info["expiresAt"]
+        if access_expires - now < _ACCESS_REFRESH_SAFE_DUR:
+            refresh_token = token_info["refreshToken"]
+            open_id = token_info["openId"]
+            new_token = refresh_user_token(refresh_token, open_id, site)
+            token_info.update(new_token)
+
+        access_token = token_info["accessToken"]
+        new_cred = get_temp_cred(access_token, site)
+        save_credential(token_info, new_cred, profile)
+
+    except KeyError as e:
+        print("failed to refresh credential, your credential file(%s) is corrupted, %s" % (cred_path, e))
+
+    except Exception as e:
+        print("failed to refresh credential, %s" % e)
+
+
+def refresh_user_token(ref_token, open_id, site):
+    api_endpoint = _API_ENDPOINT + "/refresh_user_token"
+    body = {
+        "TraceId": str(uuid.uuid4()),
+        "RefreshToken": ref_token,
+        "OpenId": open_id,
+        "Site": site,
+    }
+    http_response = requests.post(api_endpoint, json=body, verify=False)
+    resp = http_response.json()
+
+    if "Error" in resp:
+        raise ValueError("refresh_user_token: %s" % json.dumps(resp))
+
+    return {
+        "accessToken": resp["AccessToken"],
+        "expiresAt": resp["ExpiresAt"],
+    }
+
+
+def get_temp_cred(access_token, site):
+    api_endpoint = _API_ENDPOINT + "/get_temp_cred"
+    body = {
+        "TraceId": str(uuid.uuid4()),
+        "AccessToken": access_token,
+        "Site": site,
+    }
+    http_response = requests.post(api_endpoint, json=body, verify=False)
+    resp = http_response.json()
+
+    if "Error" in resp:
+        raise ValueError("get_temp_key: %s" % json.dumps(resp))
+
+    return {
+        "secretId": resp["SecretId"],
+        "secretKey": resp["SecretKey"],
+        "token": resp["Token"],
+        "expiresAt": resp["ExpiresAt"],
+    }
+
+
+def cred_path_of_profile(profile):
+    return os.path.join(os.path.expanduser("~"), ".tccli", profile + ".credential")
+
+
+def save_credential(token, new_cred, profile):
+    cred_path = cred_path_of_profile(profile)
+
+    cred = {
+        "type": "oauth",
+        "secretId": new_cred["secretId"],
+        "secretKey": new_cred["secretKey"],
+        "token": new_cred["token"],
+        "expiresAt": new_cred["expiresAt"],
+        "oauth": {
+            "openId": token["openId"],
+            "accessToken": token["accessToken"],
+            "expiresAt": token["expiresAt"],
+            "refreshToken": token["refreshToken"],
+            "site": token["site"],
+        },
+    }
+    with open(cred_path, "w") as cred_file:
+        json.dump(cred, cred_file, indent=4)

tccli/plugin.py

@@ -0,0 +1,30 @@
+import importlib
+import logging
+import pkgutil
+
+import tccli.plugins as plugins
+
+_plugins = {}
+_imported = False
+
+
+def import_plugins():
+    global _imported
+
+    if not _imported:
+        _reimport_plugins()
+        _imported = True
+
+    return _plugins
+
+
+def _reimport_plugins():
+    for _, name, _ in pkgutil.iter_modules(plugins.__path__, plugins.__name__ + "."):
+        mod = importlib.import_module(name)
+        register_service = getattr(mod, "register_service", None)
+        if not register_service:
+            logging.warning("invalid module %s" % name)
+            continue
+        register_service(_plugins)
+
+    return _plugins

tccli/plugins/auth/__init__.py

@@ -0,0 +1,59 @@
+# encoding: utf-8
+from tccli.plugins.auth.login import login_command_entrypoint
+from tccli.plugins.auth.logout import logout_command_entrypoint
+
+service_name = "auth"
+service_version = "2024-08-20"
+
+_spec = {
+    "metadata": {
+        "serviceShortName": service_name,
+        "apiVersion": service_version,
+        "description": "auth related commands",
+    },
+    "actions": {
+        "login": {
+            "name": "登陆",
+            "document": "login through sso",
+            "input": "loginRequest",
+            "output": "loginResponse",
+            "action_caller": login_command_entrypoint,
+        },
+        "logout": {
+            "name": "登出",
+            "document": "remove local credential file",
+            "input": "logoutRequest",
+            "output": "logoutResponse",
+            "action_caller": logout_command_entrypoint,
+        },
+    },
+    "objects": {
+        "loginRequest": {
+            "members": [
+                {
+                    "name": "browser",
+                    "member": "string",
+                    "type": "string",
+                    "required": False,
+                    "document": "use browser=no to indicate no browser login mode",
+                },
+            ],
+        },
+        "loginResponse": {
+            "members": [],
+        },
+        "logoutRequest": {
+            "members": [],
+        },
+        "logoutResponse": {
+            "members": [],
+        },
+    },
+    "version": "1.0",
+}
+
+
+def register_service(specs):
+    specs[service_name] = {
+        service_version: _spec,
+    }

tccli/plugins/auth/browser_flow.py

@@ -0,0 +1,88 @@
+import time
+import traceback
+import socket
+from threading import Thread
+from tccli import oauth
+
+try:
+    from urlparse import urlparse, parse_qs
+    from Queue import Queue
+    from BaseHTTPServer import HTTPServer, BaseHTTPRequestHandler
+    from SocketServer import ThreadingTCPServer, TCPServer
+except ImportError:
+    from urllib.parse import urlparse, parse_qs
+    from queue import Queue
+    from http.server import HTTPServer, BaseHTTPRequestHandler
+    from socketserver import ThreadingTCPServer, TCPServer
+
+
+# chrome keeps previous connection alive, so use threading to avoid blocking
+class ThreadingHTTPServer(ThreadingTCPServer):
+    allow_reuse_address = 1
+
+    def server_bind(self):
+        """Override server_bind to store the server name."""
+        TCPServer.server_bind(self)
+        host, port = self.socket.getsockname()[:2]
+        self.server_name = socket.getfqdn(host)
+        self.server_port = port
+
+
+class HTTPHandler(BaseHTTPRequestHandler):
+    result_queue = Queue(1)
+
+    def do_GET(self):
+        try:
+            parsed_url = urlparse(self.path)
+            query_vals = parse_qs(parsed_url.query)
+
+            open_id = query_vals.get("open_id")[0]
+            access_token = query_vals.get("access_token")[0]
+            refresh_token = query_vals.get("refresh_token")[0]
+            expires_at = int(query_vals.get("expires_at")[0])
+            state = query_vals.get("state")[0]
+            redirect_url = query_vals.get("redirect_url")[0]
+            site = query_vals.get("site")[0]
+            token = {
+                "openId": open_id,
+                "accessToken": access_token,
+                "refreshToken": refresh_token,
+                "expiresAt": expires_at,
+                "state": state,
+                "site": site,
+            }
+            cred = oauth.get_temp_cred(token["accessToken"], token["site"])
+            self.result_queue.put((token, cred))
+            self.send_response(307)
+            self.send_header("Location", redirect_url)
+            self.end_headers()
+        except Exception:
+            err = traceback.format_exc()
+            print(err)
+            self.send_response(400)
+            self.end_headers()
+            self.wfile.write("login failed due to the following error:\n\n".encode("utf-8"))
+            self.wfile.write(err.encode("utf-8"))
+            self.wfile.flush()
+
+    # suppress debug message
+    def log_message(self, format, *args):
+        pass
+
+
+def try_run(start_search_port, end_search_port):
+    port = start_search_port
+
+    while port <= end_search_port:
+        server_address = ('', port)
+        try:
+            ThreadingHTTPServer.daemon_threads = True
+            httpd = ThreadingHTTPServer(server_address, HTTPHandler)
+            t = Thread(target=httpd.serve_forever)
+            t.setDaemon(True)
+            t.start()
+            return port, HTTPHandler.result_queue
+        except socket.error:
+            port += 1
+
+    raise socket.error("no port available from range [%d, %d]" % (start_search_port, end_search_port))

tccli/plugins/auth/login.py

@@ -0,0 +1,130 @@
+# coding: utf-8
+import base64
+import json
+import random
+import string
+import sys
+import time
+from six.moves.urllib.parse import urlencode
+import webbrowser
+
+from tccli import oauth
+from tccli.plugins.auth import texts
+
+_APP_ID = 100038427476
+_AUTH_URL = "https://cloud.tencent.com/open/authorize"
+_REDIRECT_URL = "https://cli.cloud.tencent.com/oauth"
+_SITE = "cn"
+_DEFAULT_LANG = "zh-CN"
+
+_START_SEARCH_PORT = 9000
+_END_SEARCH_PORT = _START_SEARCH_PORT + 100
+
+
+def print_message(msg):
+    print(msg)
+    sys.stdout.flush()
+
+
+def login_command_entrypoint(args, parsed_globals):
+    language = parsed_globals.get("language")
+    if not language:
+        language = _DEFAULT_LANG
+    texts.set_lang(language)
+
+    profile = parsed_globals.get("profile", "default")
+    if not profile:
+        profile = "default"
+
+    browser = args.get("browser")
+
+    login(browser != "no", profile, language)
+
+
+def login(use_browser, profile, language):
+    characters = string.ascii_letters + string.digits
+    state = ''.join(random.choice(characters) for _ in range(10))
+
+    if use_browser:
+        token, cred = _get_token(state, language)
+    else:
+        token, cred = _get_token_no_browser(state, language)
+
+    if token["state"] != state:
+        raise ValueError("invalid state %s" % token["state"])
+
+    oauth.save_credential(token, cred, profile)
+
+    print_message("")
+    print_message(texts.get("login_success") % oauth.cred_path_of_profile(profile))
+
+
+def _get_token(state, language):
+    from tccli.plugins.auth import browser_flow
+
+    port, result_queue = browser_flow.try_run(_START_SEARCH_PORT, _END_SEARCH_PORT)
+
+    redirect_params = {
+        "redirect_url": "http://localhost:%d" % port,
+        "lang": language,
+        "site": _SITE,
+    }
+    redirect_query = urlencode(redirect_params)
+    redirect_url = _REDIRECT_URL + "?" + redirect_query
+    url_params = {
+        "scope": "login",
+        "app_id": _APP_ID,
+        "redirect_url": redirect_url,
+        "state": state,
+    }
+    url_query = urlencode(url_params)
+    auth_url = _AUTH_URL + "?" + url_query
+
+    if not webbrowser.open(auth_url):
+        print_message(texts.get("login_failed_due_to_no_browser"))
+        sys.exit(1)
+
+    print_message(texts.get("login_prompt"))
+    print_message(auth_url)
+
+    # use polling to avoid being unresponsive in python2
+    while result_queue.empty():
+        time.sleep(1)
+
+    result = result_queue.get()
+    if isinstance(result, Exception):
+        raise result
+
+    return result
+
+
+def _get_token_no_browser(state, language):
+    redirect_params = {
+        "browser": "no",
+        "lang": language,
+        "site": _SITE,
+    }
+    redirect_query = urlencode(redirect_params)
+    redirect_url = _REDIRECT_URL + "?" + redirect_query
+    url_params = {
+        "scope": "login",
+        "app_id": _APP_ID,
+        "redirect_url": redirect_url,
+        "state": state,
+    }
+    url_query = urlencode(url_params)
+    auth_url = _AUTH_URL + "?" + url_query
+
+    print_message(texts.get("login_prompt_no_browser"))
+    print_message("")
+    print_message(auth_url)
+
+    try:
+        input_func = raw_input
+    except NameError:
+        input_func = input
+
+    user_input = input_func(texts.get("login_prompt_code_no_browser"))
+    token = json.loads(base64.b64decode(user_input))
+    cred = oauth.get_temp_cred(token["accessToken"], token["site"])
+    return token, cred

tccli/plugins/auth/logout.py

@@ -0,0 +1,21 @@
+# coding: utf-8
+import os
+
+from tccli import oauth
+from tccli.plugins.auth import texts
+
+
+def logout_command_entrypoint(args, parsed_globals):
+    language = parsed_globals.get("language")
+    if not language:
+        language = "zh-CN"
+    texts.set_lang(language)
+
+    profile = parsed_globals.get("profile", "default")
+    if not profile:
+        profile = "default"
+
+    cred_path = oauth.cred_path_of_profile(profile)
+    if os.path.exists(cred_path):
+        os.remove(cred_path)
+    print(texts.get("logout") % cred_path)

tccli/plugins/auth/texts.py

@@ -0,0 +1,30 @@
+# encoding: utf-8
+_lang = "zh-CN"
+
+texts = {
+    "zh-CN": {
+        "login_prompt": "您的浏览器已打开, 请根据提示完成登录",
+        "login_prompt_no_browser": "在浏览器中转到以下链接, 并根据提示完成登录:",
+        "login_prompt_code_no_browser": "完成后，输入浏览器中提供的验证码:",
+        "login_failed_due_to_no_browser": "无法打开浏览器, 请尝试添加 '--browser no' 选项",
+        "login_success": "登陆成功, 密钥凭证已被写入: %s",
+        "logout": "登出成功, 密钥凭证已被删除: %s",
+    },
+    "en-US": {
+        "login_prompt": "Your browser is open, please complete the login according to the prompts",
+        "login_prompt_no_browser": "Go to the following link in your browser, and complete the sign-in prompts:",
+        "login_prompt_code_no_browser": "Once finished, enter the verification code provided in your browser:",
+        "login_failed_due_to_no_browser": "Failed to launch browser, please try option '--browser no'",
+        "login_success": "Login succeed, credential has been written to %s",
+        "logout": "Logout succeed, credential has been removed: %s",
+    }
+}
+
+
+def set_lang(lang):
+    global _lang
+    _lang = lang
+
+
+def get(key):
+    return texts[_lang][key]