termius-mcp 3.0.0__py3-none-any.whl

termius/__init__.py

@@ -0,0 +1,3 @@
+# -*- coding: utf-8 -*-
+"""Termius Cloud MCP server."""
+__version__ = '3.0.0'

termius/account/__init__.py

@@ -0,0 +1,2 @@
+# -*- coding: utf-8 -*-
+"""Account login and settings."""

termius/account/managers.py

@@ -0,0 +1,226 @@
+# -*- coding: utf-8 -*-
+"""Module with Account manager."""
+import base64
+import uuid
+
+from six.moves import configparser
+from ..core.api import API
+from ..core.device import DeviceIdentity
+from ..core.exceptions import (
+    ApiError, AuthyTokenIssue, NotMigratedError,
+    OptionNotSetException, OtpTokenRequired,
+)
+from ..cloud.client.grpc_login import GrpcLoginClient
+from ..cloud.client.browser_sso import BrowserSso
+
+_SCHEMA_NAMES = {
+    0: 'v3',
+    1: 'v3',
+    2: 'v5',
+    '0': 'v3',
+    '1': 'v3',
+    '2': 'v5',
+    'undefined': 'v3',
+    'v3': 'v3',
+    'v5': 'v5',
+}
+
+
+def _camel(name):
+    parts = name.split('_')
+    return parts[0] + ''.join(part[:1].upper() + part[1:] for part in parts[1:])
+
+
+def _b64_field(credentials, payload, *keys):
+    """Pick a credential string, accepting camelCase aliases."""
+    for source in (credentials, payload):
+        if not isinstance(source, dict):
+            continue
+        for key in keys:
+            value = source.get(key)
+            if value not in (None, ''):
+                if isinstance(value, (bytes, bytearray)):
+                    return base64.b64encode(bytes(value)).decode('ascii')
+                return value
+    return None
+
+
+def _encryption_schema(value, default='v3'):
+    if value is None:
+        return default
+    mapped = _SCHEMA_NAMES.get(value)
+    if mapped:
+        return mapped
+    mapped = _SCHEMA_NAMES.get(str(value).lower())
+    if mapped:
+        return mapped
+    if isinstance(value, str) and value:
+        return value
+    return default
+
+
+class AccountManager(object):
+    """Class to keep logic for login and logout."""
+
+    setting_names = ('synchronize_key', 'agent_forwarding')
+
+    def __init__(self, config):
+        """Create new account manager."""
+        self.config = config
+        self.api = API()
+        self.device = DeviceIdentity(config)
+
+    def login(self, username, password, authy_token=None, firebase_token=None):
+        """Retrieve apikey and crypto settings from server."""
+        device = self.device.to_json()
+        login_email = '' if firebase_token else username
+        try:
+            payload = GrpcLoginClient().login(
+                login_email, password, device,
+                authy_token=authy_token,
+                firebase_token=firebase_token,
+                account_email=username,
+            )
+        except (AuthyTokenIssue, OtpTokenRequired):
+            raise
+        except NotMigratedError:
+            payload = self.api.login(
+                login_email or username, password, authy_token=authy_token,
+                device=device, firebase_token=firebase_token,
+            )
+
+        credentials = payload.get('credentials') or payload
+        token = credentials.get('token') or payload.get('token')
+        hmac_salt = _b64_field(
+            credentials, payload, 'hmac_salt', 'hmacSalt',
+        )
+        salt = _b64_field(credentials, payload, 'salt')
+        if not token:
+            raise OptionNotSetException('Login response did not include a token')
+        if not salt or not hmac_salt:
+            raise OptionNotSetException(
+                'Login response missing vault salts (salt/hmac_salt). '
+                'Sign in again after upgrading termius-cli.'
+            )
+
+        self.config.set('User', 'username', username)
+        self.config.set('User', 'apikey', token)
+        self.config.set('User', 'token_type', 'device')
+        self.config.set('User', 'hmac_salt', hmac_salt)
+        self.config.set('User', 'salt', salt)
+
+        bulk = payload.get('bulk_account') or {}
+        account = bulk.get('account') or payload.get('account') or {}
+        schema = (
+            (account.get('feature_toggles') or {}).get('encryption_schema')
+            or (account.get('featureToggles') or {}).get('encryptionSchema')
+            or payload.get('encryption_schema')
+            or 'v3'
+        )
+        self.config.set('User', 'encryption_schema', _encryption_schema(schema))
+        user_id = account.get('user_id')
+        if user_id:
+            self.config.set('User', 'user_id', str(user_id))
+        team = bulk.get('team') or payload.get('team') or {}
+        if team:
+            self.config.set('User', 'is_team', 'yes')
+            self.config.set(
+                'User', 'can_manage_team',
+                'yes' if team.get('is_owner') else 'no',
+            )
+        pkset = credentials.get('personal_keyset') or credentials.get(
+            'personalKeyset'
+        ) or {}
+        if isinstance(pkset, dict):
+            for key in (
+                'public_key', 'encrypted_private_key', 'encrypted_personal_key',
+            ):
+                value = pkset.get(key) or pkset.get(_camel(key))
+                if value:
+                    self.config.set('User', key, value)
+        self.config.write()
+        return payload
+
+    def login_with_sso(self, password, provider='google', authy_token=None,
+                       callback_url=None, log=None):
+        """Browser SSO, then encryption-password login."""
+        identity = self.prepare_sso(
+            provider=provider, callback_url=callback_url, log=log,
+            open_browser=False,
+        )
+        return self.login(
+            identity['email'], password, authy_token=authy_token,
+            firebase_token=identity['firebase_token'],
+        )
+
+    def prepare_sso(self, provider='google', callback_url=None, log=None,
+                    open_browser=False):
+        """Run browser Google/Apple SSO and detect the Termius account."""
+        sso = BrowserSso(
+            provider=provider, open_browser=open_browser, log=log
+        ).authenticate(
+            callback_url=callback_url
+        )
+        detected = self.api.detect_sso_action(sso['firebase_token'])
+        action = detected.get('action')
+        email = detected.get('email') or sso.get('email')
+        firebase_token = (
+            detected.get('firebase_token') or sso['firebase_token']
+        )
+        if action == 'sign-up':
+            raise ApiError(
+                'This Google account is not a Termius account yet. '
+                'Finish sign-up in the Termius app first, then retry.'
+            )
+        if not email:
+            raise ApiError('SSO did not return an email address')
+        return {'email': email, 'firebase_token': firebase_token, 'action': action}
+
+    def set_settings(self, dictionary):
+        """Store settings."""
+        filtered_settings = {
+            k: (dictionary[k] and 'yes') or 'no' for k in self.setting_names
+        }
+        for k, i in filtered_settings.items():
+            self.config.set('Settings', k, i)
+        self.config.write()
+
+    def get_settings(self):
+        """Get settings or return default."""
+        return {
+            i: self.config.get_safe('Settings', i, default='yes') == 'yes'
+            for i in self.setting_names
+        }
+
+    def logout(self):
+        """Remove apikey and other credentials."""
+        self.config.remove_section('User')
+        self.config.remove_section('Settings')
+        self.config.remove_section('CloudSynchronization')
+        self.config.write()
+
+    @property
+    def analytics_id(self):
+        """Get or create analytics id for device."""
+        try:
+            client_id = self.config.get('User', 'analytics_id')
+        except (configparser.NoSectionError, configparser.NoOptionError):
+            client_id = uuid.uuid4()
+
+            self.config.set('User', 'analytics_id', client_id)
+            self.config.write()
+
+        return client_id
+
+    @property
+    def username(self):
+        """Get username."""
+        try:
+            return self.config.get('User', 'username')
+        except (configparser.NoSectionError, configparser.NoOptionError):
+            raise OptionNotSetException
+
+    @property
+    def encryption_schema(self):
+        """Return stored encryption schema (v3 or v5)."""
+        return self.config.get_safe('User', 'encryption_schema', default='v3')

termius/cli.py

@@ -0,0 +1,317 @@
+# -*- coding: utf-8 -*-
+"""Terminal commands for Termius Cloud login."""
+from __future__ import unicode_literals
+
+import argparse
+import getpass
+import os
+import sys
+
+from .core.exceptions import (
+    ApiError, AuthyTokenIssue, OptionNotSetException, OtpTokenRequired,
+)
+from .runtime import Runtime
+from .session import (
+    login_email, login_google_complete, login_google_start, logout,
+)
+from .sync import status_payload
+from .vault import VAULT_ENV
+
+
+class CliError(Exception):
+    """User-facing CLI failure."""
+
+
+class CliContext(object):
+    """IO and runtime for one CLI invocation."""
+
+    def __init__(self, runtime, prompt, secret, stdout, stderr, isatty):
+        self.runtime = runtime
+        self.prompt = prompt
+        self.secret = secret
+        self.stdout = stdout
+        self.stderr = stderr
+        self.isatty = isatty
+
+
+_LOGIN_ERRORS = (
+    ApiError, AuthyTokenIssue, CliError, OptionNotSetException,
+    OtpTokenRequired, ValueError,
+)
+
+
+def build_parser():
+    """Return the argparse parser for terminal commands."""
+    parser = argparse.ArgumentParser(
+        prog='termius',
+        description=(
+            'Termius Cloud MCP server. With no arguments, speak MCP on '
+            'stdin/stdout. Use login to sign in from a terminal.'
+        ),
+    )
+    sub = parser.add_subparsers(dest='command', metavar='command')
+    login = sub.add_parser(
+        'login',
+        help='Sign in with Google, email and password, or OTP',
+        description=(
+            'Sign in to Termius Cloud from a terminal. google prints an SSO '
+            'URL. email prompts for the vault password. If 2FA is on, the '
+            'command prompts for OTP.'
+        ),
+    )
+    login.add_argument(
+        'method',
+        nargs='?',
+        choices=('google', 'email'),
+        help='google SSO or email/password. Prompt if omitted on a TTY.',
+    )
+    login.add_argument(
+        '-u', '--username',
+        help='Termius email (email method)',
+    )
+    login.add_argument(
+        '--otp',
+        help='Authenticator / Authy code if 2FA is on',
+    )
+    login.add_argument(
+        '--no-remember',
+        action='store_true',
+        help='Do not write the vault password to ~/.termius/vault',
+    )
+    sub.add_parser(
+        'logout',
+        help='Sign out and clear local inventory',
+    )
+    sub.add_parser(
+        'status',
+        help='Show login state without syncing',
+    )
+    return parser
+
+
+def run(argv, runtime=None, prompt=None, secret=None, stdout=None,
+        stderr=None, isatty=None):
+    """Run a terminal command. Return a process exit code."""
+    stdout = sys.stdout if stdout is None else stdout
+    stderr = sys.stderr if stderr is None else stderr
+    parser = build_parser()
+    args = parser.parse_args(argv)
+    if not args.command:
+        parser.print_help(stderr)
+        return 2
+    context = CliContext(
+        runtime=runtime or Runtime(),
+        prompt=prompt or _stdin_prompt,
+        secret=secret or getpass.getpass,
+        stdout=stdout,
+        stderr=stderr,
+        isatty=sys.stdin.isatty() if isatty is None else isatty,
+    )
+    return _dispatch(args, context)
+
+
+def _dispatch(args, context):
+    handlers = {
+        'login': cmd_login,
+        'logout': cmd_logout,
+        'status': cmd_status,
+    }
+    try:
+        return handlers[args.command](args, context)
+    except _LOGIN_ERRORS as exc:
+        return _fail(context.stderr, _error_message(exc))
+
+
+def cmd_login(args, context):
+    """Sign in with Google SSO or email and password."""
+    method = _login_method(args, context)
+    if method == 'google':
+        return cmd_login_google(args, context)
+    return cmd_login_email(args, context)
+
+
+def cmd_login_google(args, context):
+    """Print the desktop SSO URL, then finish with a pasted callback."""
+    started = login_google_start()
+    _print_google_instructions(context.stderr, started['url'])
+    callback = context.prompt('Paste callback URL: ').strip()
+    if not callback:
+        raise CliError('callback URL is required')
+    data = _google_complete(
+        context.runtime,
+        callback,
+        _vault_password(context),
+        args.otp,
+        not args.no_remember,
+        context,
+    )
+    _print_signed_in(context.stdout, data)
+    return 0
+
+
+def cmd_login_email(args, context):
+    """Sign in with email, vault password, and OTP when required."""
+    data = _email_complete(
+        context.runtime,
+        _email_username(args, context),
+        _vault_password(context),
+        args.otp,
+        not args.no_remember,
+        context,
+    )
+    _print_signed_in(context.stdout, data)
+    return 0
+
+
+def cmd_logout(args, context):
+    """Clear the cloud session and local inventory."""
+    del args
+    logout(context.runtime)
+    _write_line(context.stdout, 'Signed out.')
+    return 0
+
+
+def cmd_status(args, context):
+    """Print login state. Does not pull."""
+    del args
+    data = status_payload(context.runtime)
+    if not data['logged_in']:
+        _write_line(context.stdout, 'Not signed in.')
+        return 0
+    stale = 'stale' if data['stale'] else 'fresh'
+    _write_line(
+        context.stdout,
+        'Signed in as {}, {} hosts, cache {}.'.format(
+            data['username'] or 'unknown', data['hosts'], stale,
+        ),
+    )
+    return 0
+
+
+def _login_method(args, context):
+    if args.method:
+        return args.method
+    if args.username:
+        return 'email'
+    return _prompt_method(context)
+
+
+def _prompt_method(context):
+    if not context.isatty:
+        raise CliError('specify google or email')
+    raw = context.prompt(
+        'Sign-in method (google/email) [google]: '
+    ).strip().lower()
+    if not raw:
+        return 'google'
+    if raw not in ('google', 'email'):
+        raise CliError('method must be google or email')
+    return raw
+
+
+def _email_username(args, context):
+    if args.username:
+        username = args.username.strip()
+        if username:
+            return username
+    return _prompt_username(context)
+
+
+def _prompt_username(context):
+    if not context.isatty:
+        raise CliError('username is required for email login (use -u)')
+    username = context.prompt('Email: ').strip()
+    if not username:
+        raise CliError('username is required for email login')
+    return username
+
+
+def _vault_password(context):
+    env = os.environ.get(VAULT_ENV)
+    if env:
+        return env
+    password = context.secret('Vault encryption password: ')
+    if not password:
+        raise CliError('vault encryption password is required')
+    return password
+
+
+def _google_complete(runtime, callback, password, otp, remember, context):
+    try:
+        return login_google_complete(
+            runtime, callback, password,
+            otp=otp, remember_password=remember,
+        )
+    except ValueError as exc:
+        if not _is_otp_required(exc) or otp:
+            raise
+        return login_google_complete(
+            runtime, callback, password,
+            otp=_require_otp(context), remember_password=remember,
+        )
+
+
+def _email_complete(runtime, username, password, otp, remember, context):
+    try:
+        return login_email(
+            runtime, username, password,
+            otp=otp, remember_password=remember,
+        )
+    except ValueError as exc:
+        if not _is_otp_required(exc) or otp:
+            raise
+        return login_email(
+            runtime, username, password,
+            otp=_require_otp(context), remember_password=remember,
+        )
+
+
+def _is_otp_required(exc):
+    return 'requires otp' in str(exc).lower()
+
+
+def _require_otp(context):
+    code = context.prompt('OTP: ').strip()
+    if not code:
+        raise CliError('otp is required')
+    return code
+
+
+def _print_google_instructions(stream, url):
+    _write_line(stream, 'Open this URL in a browser:')
+    _write_line(stream, '')
+    _write_line(stream, '  {}'.format(url))
+    _write_line(stream, '')
+    _write_line(stream, 'Sign in with Google.')
+    _write_line(
+        stream,
+        'When the page tries to open Termius, copy the '
+        'termius://app/continue-sso?... URL.',
+    )
+    _write_line(stream, 'Paste that URL below.')
+
+
+def _print_signed_in(stream, data):
+    _write_line(stream, 'Signed in as {}.'.format(data['username']))
+
+
+def _error_message(exc):
+    if isinstance(exc, CliError):
+        return str(exc)
+    return 'Login failed: {}'.format(exc)
+
+
+def _fail(stream, message):
+    _write_line(stream, message)
+    return 1
+
+
+def _write_line(stream, text):
+    stream.write(text)
+    if not text.endswith('\n'):
+        stream.write('\n')
+    stream.flush()
+
+
+def _stdin_prompt(message):
+    return input(message)

termius/cloud/__init__.py

@@ -0,0 +1,2 @@
+# -*- coding: utf-8 -*-
+"""Termius Cloud sync and crypto."""

termius/cloud/client/__init__.py

@@ -0,0 +1,2 @@
+# -*- coding: utf-8 -*-
+"""Package to process calls to sync cloud."""