tracebit-python 0.1.0__tar.gz → 0.1.1__tar.gz

{tracebit_python-0.1.0 → tracebit_python-0.1.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: tracebit-python
-Version: 0.1.0
+Version: 0.1.1
 Summary: CLI for managing Tracebit canary credentials on headless servers
 License: Apache-2.0
 Project-URL: Repository, https://github.com/SiteRelEnby/tracebit-python
@@ -21,6 +21,8 @@ Requires-Python: >=3.8
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: requests>=2.20
+Provides-Extra: dev
+Requires-Dist: pytest>=7.0; extra == "dev"
 Dynamic: license-file
 
 # tracebit-python
@@ -96,11 +98,11 @@ see an alert on the Tracebit dashboard within a few minutes.
 
 ### 5. Keep credentials fresh
 
-Canary credentials expire after ~24 hours. Set up a cron job to refresh them:
+Canary credentials expire after ~12 hours. Set up a cron job to refresh them:
 
 ```bash
 # crontab -e
-0 */12 * * * /path/to/tracebit refresh
+0 */6 * * * /path/to/tracebit refresh --hours 4
 ```
 
 ## Commands
@@ -132,10 +134,7 @@ from cron.
 
 | Option | Default | Description |
 |--------|---------|-------------|
-| `--hours` | `13` | Refresh credentials expiring within this many hours |
-
-With 24h credentials and a 12h cron, the default of 13 hours ensures every
-cron run refreshes credentials.
+| `--hours` | `2` | Refresh credentials expiring within this many hours |
 
 ### `tracebit trigger aws`
 

{tracebit_python-0.1.0 → tracebit_python-0.1.1}/README.md

@@ -71,11 +71,11 @@ see an alert on the Tracebit dashboard within a few minutes.
 
 ### 5. Keep credentials fresh
 
-Canary credentials expire after ~24 hours. Set up a cron job to refresh them:
+Canary credentials expire after ~12 hours. Set up a cron job to refresh them:
 
 ```bash
 # crontab -e
-0 */12 * * * /path/to/tracebit refresh
+0 */6 * * * /path/to/tracebit refresh --hours 4
 ```
 
 ## Commands
@@ -107,10 +107,7 @@ from cron.
 
 | Option | Default | Description |
 |--------|---------|-------------|
-| `--hours` | `13` | Refresh credentials expiring within this many hours |
-
-With 24h credentials and a 12h cron, the default of 13 hours ensures every
-cron run refreshes credentials.
+| `--hours` | `2` | Refresh credentials expiring within this many hours |
 
 ### `tracebit trigger aws`
 

{tracebit_python-0.1.0 → tracebit_python-0.1.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "tracebit-python"
-version = "0.1.0"
+version = "0.1.1"
 description = "CLI for managing Tracebit canary credentials on headless servers"
 readme = "README.md"
 requires-python = ">=3.8"
@@ -28,6 +28,9 @@ classifiers = [
 ]
 dependencies = ["requests>=2.20"]
 
+[project.optional-dependencies]
+dev = ["pytest>=7.0"]
+
 [project.urls]
 Repository = "https://github.com/SiteRelEnby/tracebit-python"
 Issues = "https://github.com/SiteRelEnby/tracebit-python/issues"
@@ -37,3 +40,6 @@ tracebit = "tracebit.cli:main"
 
 [tool.setuptools.packages.find]
 where = ["src"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]

tracebit_python-0.1.1/src/tracebit/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.1.1"

{tracebit_python-0.1.0 → tracebit_python-0.1.1}/src/tracebit/api.py

@@ -35,7 +35,7 @@ class TracebitClient:
                           source_type="endpoint", labels=None):
         body = {
             "name": name,
-            "types": types,
+            "credentialTypes": types,
             "source": source,
             "sourceType": source_type,
         }

{tracebit_python-0.1.0 → tracebit_python-0.1.1}/src/tracebit/cli.py

@@ -18,6 +18,15 @@ from .state import (
 )
 
 
+def _quiet(args):
+    return getattr(args, "quiet", False)
+
+
+def _log(args, msg):
+    if not _quiet(args):
+        print(msg)
+
+
 def _get_client(args):
     token = getattr(args, "token", None) or load_token()
     if not token:
@@ -60,7 +69,7 @@ def cmd_configure(args):
         sys.exit(1)
 
     save_token(token)
-    print("Token saved to ~/.config/tracebit/token")
+    _log(args, "Token saved to ~/.config/tracebit/token")
 
 
 def cmd_deploy_aws(args):
@@ -114,13 +123,13 @@ def cmd_deploy_aws(args):
         for old in existing:
             try:
                 client.remove_credentials(old["name"], "aws")
-                print(f"Expired previous canary '{old['name']}' on Tracebit.")
+                _log(args, f"Expired previous canary '{old['name']}' on Tracebit.")
             except TracebitError:
                 pass
             remove_credential(old["name"], "aws")
 
     # issue credentials
-    print(f"Issuing AWS canary credentials (name={name}, profile={profile})...")
+    _log(args, f"Issuing AWS canary credentials (name={name}, profile={profile})...")
     try:
         result = client.issue_credentials(
             name=name, types=["aws"], source="tracebit-python",
@@ -143,12 +152,12 @@ def cmd_deploy_aws(args):
         secret_access_key=aws["awsSecretAccessKey"],
         session_token=aws["awsSessionToken"],
     )
-    print(f"Credentials written to ~/.aws/credentials [{profile}]")
+    _log(args, f"Credentials written to ~/.aws/credentials [{profile}]")
 
     # confirm deployment
     try:
         client.confirm_credentials(aws["awsConfirmationId"])
-        print("Deployment confirmed with Tracebit.")
+        _log(args, "Deployment confirmed with Tracebit.")
     except TracebitError as e:
         print(f"Warning: Could not confirm deployment: {e}", file=sys.stderr)
 
@@ -170,7 +179,7 @@ def cmd_deploy_aws(args):
             "access_key_id": aws["awsAccessKeyId"],
             "expiration": aws["awsExpiration"],
         }, indent=2))
-    else:
+    elif not _quiet(args):
         print(f"\nCanary deployed successfully!")
         print(f"  Profile:    {profile}")
         print(f"  Region:     {region}")
@@ -185,16 +194,23 @@ def cmd_refresh(args):
     expiring = get_expiring_credentials(hours=hours)
 
     if not expiring:
-        print("No credentials need refreshing.")
+        _log(args, "No credentials need refreshing.")
         return
 
     failures = 0
     for cred in expiring:
         if cred["type"] != "aws":
-            print(f"Skipping non-AWS credential: {cred['name']}")
+            _log(args, f"Skipping non-AWS credential: {cred['name']}")
             continue
 
-        print(f"Refreshing AWS credential '{cred['name']}'...")
+        exp = cred.get("expiration", "")
+        try:
+            exp_dt = datetime.fromisoformat(exp.replace("Z", "+00:00"))
+            remaining = (exp_dt - datetime.now(timezone.utc)).total_seconds() / 3600
+            _log(args, f"Refreshing AWS credential '{cred['name']}' "
+                       f"(expires in {remaining:.1f}h, threshold {hours}h)...")
+        except (ValueError, TypeError):
+            _log(args, f"Refreshing AWS credential '{cred['name']}'...")
         try:
             result = client.issue_credentials(
                 name=cred["name"], types=["aws"], source="tracebit-python",
@@ -235,7 +251,7 @@ def cmd_refresh(args):
             "confirmation_id": aws["awsConfirmationId"],
             "labels": cred.get("labels", {}),
         })
-        print(f"  Refreshed. New expiration: {aws['awsExpiration']}")
+        _log(args, f"  Refreshed. New expiration: {aws['awsExpiration']}")
 
     if failures:
         print(f"\n{failures} credential(s) failed to refresh.", file=sys.stderr)
@@ -262,7 +278,7 @@ def cmd_trigger_aws(args):
         cred = aws_creds[0]
 
     profile = cred["profile"]
-    print(f"Triggering canary credential (profile={profile})...")
+    _log(args, f"Triggering canary credential (profile={profile})...")
 
     try:
         result = subprocess.run(
@@ -270,12 +286,12 @@ def cmd_trigger_aws(args):
             capture_output=True, text=True, timeout=10,
         )
         if result.returncode == 0 and "arn:aws:sts::" in result.stdout:
-            print("Canary triggered successfully!")
-            print(result.stdout.strip())
+            _log(args, "Canary triggered successfully!")
+            _log(args, result.stdout.strip())
         else:
-            print("Trigger command ran but output was unexpected:")
+            _log(args, "Trigger command ran but output was unexpected:")
             if result.stdout:
-                print(result.stdout.strip())
+                _log(args, result.stdout.strip())
             if result.stderr:
                 print(result.stderr.strip(), file=sys.stderr)
     except FileNotFoundError:
@@ -293,7 +309,7 @@ def cmd_show(args):
     """Display deployed canary credentials."""
     creds = load_credentials()
     if not creds:
-        print("No canary credentials deployed.")
+        _log(args, "No canary credentials deployed.")
         return
 
     if args.json_output:
@@ -314,15 +330,15 @@ def cmd_show(args):
             except ValueError:
                 pass
 
-        print(f"  Name:       {c['name']}")
-        print(f"  Type:       {c['type']}")
+        _log(args, f"  Name:       {c['name']}")
+        _log(args, f"  Type:       {c['type']}")
         if c["type"] == "aws":
-            print(f"  Profile:    {c.get('profile', 'n/a')}")
-            print(f"  Region:     {c.get('region', 'n/a')}")
-        print(f"  Expires:    {exp_str}{status}")
+            _log(args, f"  Profile:    {c.get('profile', 'n/a')}")
+            _log(args, f"  Region:     {c.get('region', 'n/a')}")
+        _log(args, f"  Expires:    {exp_str}{status}")
         if c.get("labels"):
-            print(f"  Labels:     {c['labels']}")
-        print()
+            _log(args, f"  Labels:     {c['labels']}")
+        _log(args, "")
 
 
 def cmd_remove(args):
@@ -336,33 +352,39 @@ def cmd_remove(args):
         matches = creds
 
     if not matches:
-        print("No matching credentials found.")
+        _log(args, "No matching credentials found.")
         return
 
     for c in matches:
         # expire server-side
         try:
             client.remove_credentials(c["name"], c["type"])
-            print(f"Expired '{c['name']}' ({c['type']}) on Tracebit.")
+            _log(args, f"Expired '{c['name']}' ({c['type']}) on Tracebit.")
         except TracebitError as e:
             print(f"Warning: Could not expire server-side: {e}", file=sys.stderr)
 
         if c["type"] == "aws":
             remove_aws_credentials(c.get("profile", ""))
-            print(f"Removed AWS profile '{c.get('profile')}' from ~/.aws/")
+            _log(args, f"Removed AWS profile '{c.get('profile')}' from ~/.aws/")
         remove_credential(c["name"], c["type"])
-        print(f"Removed credential '{c['name']}' ({c['type']}) from state.")
+        _log(args, f"Removed credential '{c['name']}' ({c['type']}) from state.")
 
 
 def main():
+    from . import __version__
+
     parser = argparse.ArgumentParser(
         prog="tracebit",
         description="Manage Tracebit canary credentials",
     )
+    parser.add_argument("--version", action="version",
+                        version=f"%(prog)s {__version__}")
     parser.add_argument("--token", help="API token (overrides env/config)")
     parser.add_argument("--base-url", help="Override Tracebit API base URL")
     parser.add_argument("--json", dest="json_output", action="store_true",
                         help="Output in JSON format where supported")
+    parser.add_argument("-q", "--quiet", action="store_true",
+                        help="Suppress informational output (errors still print to stderr)")
 
     sub = parser.add_subparsers(dest="command")
 
@@ -387,8 +409,8 @@ def main():
 
     # refresh
     p_refresh = sub.add_parser("refresh", help="Refresh expiring credentials")
-    p_refresh.add_argument("--hours", type=float, default=13,
-                           help="Refresh credentials expiring within this many hours (default: 13)")
+    p_refresh.add_argument("--hours", type=float, default=2,
+                           help="Refresh credentials expiring within this many hours (default: 2)")
 
     # trigger
     p_trigger = sub.add_parser("trigger", help="Test-fire a canary credential")

{tracebit_python-0.1.0 → tracebit_python-0.1.1}/src/tracebit_python.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: tracebit-python
-Version: 0.1.0
+Version: 0.1.1
 Summary: CLI for managing Tracebit canary credentials on headless servers
 License: Apache-2.0
 Project-URL: Repository, https://github.com/SiteRelEnby/tracebit-python
@@ -21,6 +21,8 @@ Requires-Python: >=3.8
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: requests>=2.20
+Provides-Extra: dev
+Requires-Dist: pytest>=7.0; extra == "dev"
 Dynamic: license-file
 
 # tracebit-python
@@ -96,11 +98,11 @@ see an alert on the Tracebit dashboard within a few minutes.
 
 ### 5. Keep credentials fresh
 
-Canary credentials expire after ~24 hours. Set up a cron job to refresh them:
+Canary credentials expire after ~12 hours. Set up a cron job to refresh them:
 
 ```bash
 # crontab -e
-0 */12 * * * /path/to/tracebit refresh
+0 */6 * * * /path/to/tracebit refresh --hours 4
 ```
 
 ## Commands
@@ -132,10 +134,7 @@ from cron.
 
 | Option | Default | Description |
 |--------|---------|-------------|
-| `--hours` | `13` | Refresh credentials expiring within this many hours |
-
-With 24h credentials and a 12h cron, the default of 13 hours ensures every
-cron run refreshes credentials.
+| `--hours` | `2` | Refresh credentials expiring within this many hours |
 
 ### `tracebit trigger aws`
 

{tracebit_python-0.1.0 → tracebit_python-0.1.1}/src/tracebit_python.egg-info/SOURCES.txt

@@ -12,4 +12,8 @@ src/tracebit_python.egg-info/SOURCES.txt
 src/tracebit_python.egg-info/dependency_links.txt
 src/tracebit_python.egg-info/entry_points.txt
 src/tracebit_python.egg-info/requires.txt
-src/tracebit_python.egg-info/top_level.txt
+src/tracebit_python.egg-info/top_level.txt
+tests/test_api.py
+tests/test_aws.py
+tests/test_config.py
+tests/test_state.py

tracebit_python-0.1.1/src/tracebit_python.egg-info/requires.txt

@@ -0,0 +1,4 @@
+requests>=2.20
+
+[dev]
+pytest>=7.0

tracebit_python-0.1.1/tests/test_api.py

@@ -0,0 +1,89 @@
+from unittest.mock import MagicMock, patch
+import pytest
+import requests
+
+from tracebit.api import TracebitClient, TracebitError
+
+
+@pytest.fixture
+def client():
+    return TracebitClient("test-token", base_url="https://example.com")
+
+
+def mock_response(status_code=200, json_data=None, text=""):
+    resp = MagicMock()
+    resp.status_code = status_code
+    resp.json.return_value = json_data or {}
+    resp.text = text
+    resp.raise_for_status = MagicMock()
+    if status_code >= 400:
+        resp.raise_for_status.side_effect = requests.HTTPError(response=resp)
+    return resp
+
+
+def test_client_sets_auth_header(client):
+    assert client.session.headers["Authorization"] == "Bearer test-token"
+
+
+def test_generate_metadata(client):
+    data = {"awsProfileName": "staging", "awsRegion": "us-east-1"}
+    with patch.object(client.session, "get", return_value=mock_response(json_data=data)) as m:
+        result = client.generate_metadata()
+    m.assert_called_once_with("https://example.com/api/v1/credentials/generate-metadata")
+    assert result["awsRegion"] == "us-east-1"
+
+
+def test_issue_credentials_sends_correct_body(client):
+    resp_data = {"aws": {"awsAccessKeyId": "KEY", "awsConfirmationId": "abc"}}
+    with patch.object(client.session, "post", return_value=mock_response(json_data=resp_data)) as m:
+        client.issue_credentials(name="myserver", types=["aws"], labels={"env": "prod"})
+    body = m.call_args.kwargs["json"]
+    assert body["name"] == "myserver"
+    assert body["credentialTypes"] == ["aws"]
+    assert body["source"] == "tracebit-python"
+    assert {"name": "env", "value": "prod"} in body["labels"]
+
+
+def test_issue_credentials_no_labels(client):
+    with patch.object(client.session, "post", return_value=mock_response()) as m:
+        client.issue_credentials(name="myserver", types=["aws"])
+    body = m.call_args.kwargs["json"]
+    assert "labels" not in body
+
+
+def test_confirm_credentials(client):
+    with patch.object(client.session, "post", return_value=mock_response(status_code=204)) as m:
+        client.confirm_credentials("my-guid")
+    body = m.call_args.kwargs["json"]
+    assert body["id"] == "my-guid"
+
+
+def test_confirm_credentials_404_raises(client):
+    with patch.object(client.session, "post", return_value=mock_response(status_code=404)):
+        with pytest.raises(TracebitError, match="not found"):
+            client.confirm_credentials("bad-guid")
+
+
+def test_remove_credentials(client):
+    with patch.object(client.session, "post", return_value=mock_response(status_code=204)) as m:
+        client.remove_credentials("myserver", "aws")
+    body = m.call_args.kwargs["json"]
+    assert body["name"] == "myserver"
+    assert body["type"] == "aws"
+    m.assert_called_once_with(
+        "https://example.com/api/_internal/v1/cli/remove",
+        json=body,
+    )
+
+
+def test_401_raises_tracebit_error(client):
+    with patch.object(client.session, "get", return_value=mock_response(status_code=401)):
+        with pytest.raises(TracebitError, match="Authentication failed"):
+            client.generate_metadata()
+
+
+def test_400_raises_tracebit_error(client):
+    with patch.object(client.session, "post",
+                      return_value=mock_response(status_code=400, text="bad request")):
+        with pytest.raises(TracebitError, match="bad request"):
+            client.issue_credentials("x", ["aws"])

tracebit_python-0.1.1/tests/test_aws.py

@@ -0,0 +1,125 @@
+import configparser
+import pytest
+from tracebit import aws as aws_mod
+
+
+@pytest.fixture(autouse=True)
+def tmp_aws(tmp_path, monkeypatch):
+    """Redirect ~/.aws/ to a temp directory for every test."""
+    aws_dir = tmp_path / ".aws"
+    monkeypatch.setattr(aws_mod, "AWS_DIR", aws_dir)
+    monkeypatch.setattr(aws_mod, "CREDENTIALS_FILE", aws_dir / "credentials")
+    monkeypatch.setattr(aws_mod, "CONFIG_FILE", aws_dir / "config")
+
+
+def deploy(**kwargs):
+    defaults = dict(
+        profile="staging",
+        region="us-east-1",
+        access_key_id="AKIAIOSFODNN7EXAMPLE",
+        secret_access_key="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
+        session_token="AQoXnyc//token",
+    )
+    defaults.update(kwargs)
+    aws_mod.deploy_aws_credentials(**defaults)
+
+
+def test_deploy_creates_credentials_file():
+    deploy()
+    assert aws_mod.CREDENTIALS_FILE.exists()
+
+
+def test_deploy_writes_profile():
+    deploy(profile="myprofile", access_key_id="MYKEY")
+    creds = configparser.ConfigParser()
+    creds.read(str(aws_mod.CREDENTIALS_FILE))
+    assert creds.has_section("myprofile")
+    assert creds.get("myprofile", "aws_access_key_id") == "MYKEY"
+
+
+def test_deploy_writes_session_token():
+    deploy(session_token="mysessiontoken")
+    creds = configparser.ConfigParser()
+    creds.read(str(aws_mod.CREDENTIALS_FILE))
+    assert creds.get("staging", "aws_session_token") == "mysessiontoken"
+
+
+def test_deploy_writes_config():
+    deploy(profile="myprofile", region="eu-west-1")
+    cfg = configparser.ConfigParser()
+    cfg.read(str(aws_mod.CONFIG_FILE))
+    assert cfg.has_section("profile myprofile")
+    assert cfg.get("profile myprofile", "region") == "eu-west-1"
+
+
+def test_deploy_file_permissions():
+    deploy()
+    assert oct(aws_mod.CREDENTIALS_FILE.stat().st_mode)[-3:] == "600"
+    assert oct(aws_mod.CONFIG_FILE.stat().st_mode)[-3:] == "600"
+
+
+def test_deploy_dir_permissions():
+    deploy()
+    assert oct(aws_mod.AWS_DIR.stat().st_mode)[-3:] == "700"
+
+
+def test_deploy_overwrites_existing_profile():
+    deploy(access_key_id="OLDKEY")
+    deploy(access_key_id="NEWKEY")
+    creds = configparser.ConfigParser()
+    creds.read(str(aws_mod.CREDENTIALS_FILE))
+    assert creds.get("staging", "aws_access_key_id") == "NEWKEY"
+    # should only be one section
+    assert len(creds.sections()) == 1
+
+
+def test_deploy_preserves_other_profiles():
+    deploy(profile="staging")
+    deploy(profile="production")
+    creds = configparser.ConfigParser()
+    creds.read(str(aws_mod.CREDENTIALS_FILE))
+    assert creds.has_section("staging")
+    assert creds.has_section("production")
+
+
+def test_profile_exists_true():
+    deploy(profile="staging")
+    assert aws_mod.profile_exists("staging") is True
+
+
+def test_profile_exists_false():
+    assert aws_mod.profile_exists("nonexistent") is False
+
+
+def test_remove_credentials():
+    deploy(profile="staging")
+    aws_mod.remove_aws_credentials("staging")
+    creds = configparser.ConfigParser()
+    creds.read(str(aws_mod.CREDENTIALS_FILE))
+    assert not creds.has_section("staging")
+
+
+def test_remove_leaves_other_profiles():
+    deploy(profile="staging")
+    deploy(profile="production")
+    aws_mod.remove_aws_credentials("staging")
+    creds = configparser.ConfigParser()
+    creds.read(str(aws_mod.CREDENTIALS_FILE))
+    assert not creds.has_section("staging")
+    assert creds.has_section("production")
+
+
+def test_remove_nonexistent_profile_is_safe():
+    deploy(profile="staging")
+    aws_mod.remove_aws_credentials("nonexistent")  # should not raise
+
+
+def test_get_aws_credentials():
+    deploy(profile="staging", access_key_id="MYKEY", secret_access_key="MYSECRET")
+    cred = aws_mod.get_aws_credentials("staging")
+    assert cred["aws_access_key_id"] == "MYKEY"
+    assert cred["aws_secret_access_key"] == "MYSECRET"
+
+
+def test_get_aws_credentials_missing():
+    assert aws_mod.get_aws_credentials("missing") is None

tracebit_python-0.1.1/tests/test_config.py

@@ -0,0 +1,60 @@
+import pytest
+from tracebit import config as config_mod
+
+
+@pytest.fixture(autouse=True)
+def tmp_config(tmp_path, monkeypatch):
+    monkeypatch.setattr(config_mod, "CONFIG_DIR", tmp_path)
+    monkeypatch.setattr(config_mod, "TOKEN_FILE", tmp_path / "token")
+    monkeypatch.delenv("TRACEBIT_API_TOKEN", raising=False)
+    monkeypatch.delenv("TRACEBIT_URL", raising=False)
+
+
+def test_load_token_from_env(monkeypatch):
+    monkeypatch.setenv("TRACEBIT_API_TOKEN", "my-token")
+    assert config_mod.load_token() == "my-token"
+
+
+def test_load_token_strips_whitespace(monkeypatch):
+    monkeypatch.setenv("TRACEBIT_API_TOKEN", "  my-token  ")
+    assert config_mod.load_token() == "my-token"
+
+
+def test_load_token_from_file(tmp_path):
+    token_file = tmp_path / "token"
+    token_file.write_text("file-token\n")
+    config_mod.TOKEN_FILE.__class__  # already patched via fixture
+    import tracebit.config as cm
+    cm.TOKEN_FILE = token_file
+    assert cm.load_token() == "file-token"
+
+
+def test_load_token_env_takes_priority(monkeypatch, tmp_path):
+    token_file = tmp_path / "token"
+    token_file.write_text("file-token\n")
+    import tracebit.config as cm
+    cm.TOKEN_FILE = token_file
+    monkeypatch.setenv("TRACEBIT_API_TOKEN", "env-token")
+    assert cm.load_token() == "env-token"
+
+
+def test_load_token_missing():
+    assert config_mod.load_token() is None
+
+
+def test_save_token(tmp_path):
+    import tracebit.config as cm
+    cm.CONFIG_DIR = tmp_path
+    cm.TOKEN_FILE = tmp_path / "token"
+    cm.save_token("saved-token")
+    assert cm.TOKEN_FILE.read_text().strip() == "saved-token"
+    assert oct(cm.TOKEN_FILE.stat().st_mode)[-3:] == "600"
+
+
+def test_get_base_url_default():
+    assert config_mod.get_base_url() == "https://community.tracebit.com"
+
+
+def test_get_base_url_from_env(monkeypatch):
+    monkeypatch.setenv("TRACEBIT_URL", "https://my-tracebit.example.com/")
+    assert config_mod.get_base_url() == "https://my-tracebit.example.com"

tracebit_python-0.1.1/tests/test_state.py

@@ -0,0 +1,129 @@
+import json
+from datetime import datetime, timezone, timedelta
+from unittest.mock import patch
+
+import pytest
+
+from tracebit.state import (
+    save_credential,
+    load_credentials,
+    remove_credential,
+    get_credential,
+    get_expiring_credentials,
+)
+
+
+@pytest.fixture(autouse=True)
+def tmp_state(tmp_path, monkeypatch):
+    """Redirect state file to a temp directory for every test."""
+    import tracebit.state as state_mod
+    monkeypatch.setattr(state_mod, "STATE_DIR", tmp_path)
+    monkeypatch.setattr(state_mod, "STATE_FILE", tmp_path / "state.json")
+
+
+def make_cred(**kwargs):
+    base = {
+        "name": "test-server",
+        "type": "aws",
+        "profile": "staging",
+        "region": "us-east-1",
+        "expiration": "2099-01-01T00:00:00Z",
+        "confirmation_id": "abc-123",
+        "labels": {},
+    }
+    base.update(kwargs)
+    return base
+
+
+def test_save_and_load():
+    cred = make_cred()
+    save_credential(cred)
+    creds = load_credentials()
+    assert len(creds) == 1
+    assert creds[0]["name"] == "test-server"
+    assert creds[0]["profile"] == "staging"
+
+
+def test_save_replaces_same_name_and_type():
+    save_credential(make_cred(profile="old"))
+    save_credential(make_cred(profile="new"))
+    creds = load_credentials()
+    assert len(creds) == 1
+    assert creds[0]["profile"] == "new"
+
+
+def test_save_keeps_different_type():
+    save_credential(make_cred(type="aws"))
+    save_credential(make_cred(type="ssh"))
+    assert len(load_credentials()) == 2
+
+
+def test_remove_by_name_and_type():
+    save_credential(make_cred())
+    remove_credential("test-server", "aws")
+    assert load_credentials() == []
+
+
+def test_remove_by_name_only():
+    save_credential(make_cred(type="aws"))
+    save_credential(make_cred(type="ssh"))
+    remove_credential("test-server")
+    assert load_credentials() == []
+
+
+def test_remove_leaves_others():
+    save_credential(make_cred(name="server-a"))
+    save_credential(make_cred(name="server-b"))
+    remove_credential("server-a", "aws")
+    creds = load_credentials()
+    assert len(creds) == 1
+    assert creds[0]["name"] == "server-b"
+
+
+def test_get_credential():
+    save_credential(make_cred())
+    c = get_credential("test-server", "aws")
+    assert c is not None
+    assert c["profile"] == "staging"
+
+
+def test_get_credential_not_found():
+    assert get_credential("missing", "aws") is None
+
+
+def test_load_empty_state():
+    assert load_credentials() == []
+
+
+def test_state_file_permissions(tmp_path, monkeypatch):
+    import tracebit.state as state_mod
+    state_file = tmp_path / "state.json"
+    monkeypatch.setattr(state_mod, "STATE_FILE", state_file)
+    save_credential(make_cred())
+    assert oct(state_file.stat().st_mode)[-3:] == "600"
+
+
+def test_get_expiring_soon():
+    soon = (datetime.now(timezone.utc) + timedelta(hours=1)).strftime(
+        "%Y-%m-%dT%H:%M:%SZ"
+    )
+    save_credential(make_cred(expiration=soon))
+    expiring = get_expiring_credentials(hours=2)
+    assert len(expiring) == 1
+
+
+def test_get_not_expiring():
+    far = (datetime.now(timezone.utc) + timedelta(hours=10)).strftime(
+        "%Y-%m-%dT%H:%M:%SZ"
+    )
+    save_credential(make_cred(expiration=far))
+    assert get_expiring_credentials(hours=2) == []
+
+
+def test_get_already_expired():
+    past = (datetime.now(timezone.utc) - timedelta(hours=1)).strftime(
+        "%Y-%m-%dT%H:%M:%SZ"
+    )
+    save_credential(make_cred(expiration=past))
+    expiring = get_expiring_credentials(hours=2)
+    assert len(expiring) == 1

tracebit_python-0.1.0/src/tracebit/__init__.py

@@ -1 +0,0 @@
-__version__ = "0.1.0"

tracebit_python-0.1.0/src/tracebit_python.egg-info/requires.txt

@@ -1 +0,0 @@
-requests>=2.20