trustarc-cli 1.0.0__py3-none-any.whl

ta/__init__.py

@@ -0,0 +1 @@
+__version__ = "1.0.0"

ta/commands/auth/__init__.py

@@ -0,0 +1 @@
+from ta.commands.auth.command import app as app

ta/commands/auth/command.py

@@ -0,0 +1,91 @@
+import time
+
+import httpx
+import typer
+from rich.console import Console
+
+from ta.lib.auth import auth_file, load_tokens, login, logout
+from ta.lib.auth_servers import AUTH_BASE_URLS
+from ta.lib.catalog_cache import evict_catalog
+from ta.lib.config import UnknownEnvError, load_config, saved_env
+
+
+def _help() -> str:
+    try:
+        return f"Manage authentication with the identity provider (env: {saved_env()})."
+    except UnknownEnvError:
+        return "Manage authentication with the identity provider."
+
+
+app = typer.Typer(help=_help(), no_args_is_help=True)
+console = Console()
+
+
+def _resolve_env(env: str | None) -> str:
+    if not env:
+        return load_config()["env"]
+    if env not in AUTH_BASE_URLS:
+        console.print(f"[red]Unknown env: {env}[/red]  Valid: {', '.join(AUTH_BASE_URLS)}")
+        raise typer.Exit(1)
+    return env
+
+
+@app.command("login")
+def login_cmd(
+    env: str = typer.Option(None, "--env", "-e", help="Target env (defaults to current config env)"),
+):
+    """Log in via browser (OAuth Authorization Code + PKCE)."""
+    env = _resolve_env(env)
+    try:
+        tokens = login(env)
+    except RuntimeError as e:
+        console.print(f"[red]Login failed:[/red] {e}")
+        raise typer.Exit(1) from e
+    expires = tokens.get("expires_at")
+    exp_str = f" (expires in {expires - int(time.time())}s)" if expires else ""
+    evict_catalog(env)
+    console.print(f"[green]Logged in to {env}[/green]{exp_str}")
+    console.print(f"[dim]Saved to {auth_file(env)}[/dim]")
+
+
+@app.command("logout")
+def logout_cmd(
+    env: str = typer.Option(None, "--env", "-e", help="Target env (defaults to current config env)"),
+):
+    """Revoke and clear saved tokens."""
+    env = _resolve_env(env)
+    logout(env)
+    evict_catalog(env)
+    console.print(f"[green]Logged out of {env}[/green]")
+
+
+@app.command("status")
+def status_cmd(
+    env: str = typer.Option(None, "--env", "-e", help="Target env (defaults to current config env)"),
+):
+    """Show authentication status."""
+    env = _resolve_env(env)
+    tokens = load_tokens(env)
+    if not tokens:
+        console.print(f"[yellow]Not logged in to {env}[/yellow]")
+        raise typer.Exit(1)
+
+    now = int(time.time())
+    remaining = tokens.get("expires_at", 0) - now
+    console.print(f"[bold]Env:[/bold] {env}")
+    if remaining > 0:
+        console.print(f"[green]Token valid[/green] ({remaining}s remaining)")
+    else:
+        console.print("[yellow]Token expired[/yellow] — `ta auth login` or it will auto-refresh on next use")
+
+    access = tokens.get("access_token")
+    userinfo_url = (tokens.get("oauth") or {}).get("userinfo_endpoint")
+    if userinfo_url and access:
+        try:
+            r = httpx.get(userinfo_url, headers={"Authorization": f"Bearer {access}"}, timeout=10)
+            if r.status_code == 200:
+                info = r.json()
+                email = info.get("email") or info.get("sub")
+                console.print(f"[bold]User:[/bold] {email}")
+        except httpx.HTTPError:
+            pass

ta/commands/config/__init__.py

@@ -0,0 +1 @@
+from ta.commands.config.command import app as app

ta/commands/config/command.py

@@ -0,0 +1,57 @@
+import typer
+from rich.console import Console
+
+from ta.lib.auth import load_tokens
+from ta.lib.config import CONFIG_FILE, DEFAULT_CONFIG, UnknownEnvError, load_config, save_config, saved_env
+from ta.lib.services import ENVS
+
+app = typer.Typer(help="Manage ta configuration.", no_args_is_help=True)
+console = Console()
+
+
+@app.command("show")
+def show():
+    """Show current configuration."""
+    try:
+        cfg = load_config()
+    except UnknownEnvError as e:
+        console.print(f"[yellow]{e}[/yellow]")
+        raise typer.Exit(1) from e
+    token_status = (
+        "[green]logged in[/green]" if load_tokens(cfg["env"]) else "[dim](not logged in — run `ta auth login`)[/dim]"
+    )
+    console.print(f"\n[bold]Env:[/bold]   {cfg['env']}")
+    console.print(f"[bold]Auth:[/bold]  {token_status}")
+    console.print("\n[bold]Services:[/bold]")
+    for name, spec_url in sorted(cfg["services"].items()):
+        console.print(f"  {name}: {spec_url}")
+    console.print()
+
+
+@app.command("setup")
+def setup():
+    """Set up or update config file."""
+    try:
+        current_env = saved_env()
+    except UnknownEnvError as e:
+        console.print(f"[yellow]Saved env '{e.env}' is no longer supported — pick another one.[/yellow]")
+        current_env = DEFAULT_CONFIG["env"]
+
+    console.print("\nConfiguration (press Enter to keep current):\n")
+    env = typer.prompt(f"  env ({'/'.join(ENVS)})", default=current_env)
+    if env not in ENVS:
+        console.print(f"[red]Unknown env: {env}[/red]")
+        raise typer.Exit(1)
+
+    save_config({"env": env})
+    console.print(f"\n[green]Saved {CONFIG_FILE}[/green]")
+
+
+@app.command("reset")
+def reset_config():
+    """Delete config file and use defaults."""
+    if CONFIG_FILE.exists():
+        CONFIG_FILE.unlink()
+        console.print(f"[green]Deleted {CONFIG_FILE}[/green]")
+    else:
+        console.print("[dim]No config file to delete[/dim]")

ta/commands/self_update/__init__.py

@@ -0,0 +1,2 @@
+from ta.commands.self_update.command import self_update as self_update
+from ta.commands.self_update.command import upgrade_command as upgrade_command

ta/commands/self_update/command.py

@@ -0,0 +1,36 @@
+import subprocess
+import sys
+from pathlib import Path
+
+import typer
+
+from ta import __version__
+from ta.lib.update_check import PACKAGE_NAME, is_newer, latest_version
+
+
+def upgrade_command(prefix: str = sys.prefix) -> list[str]:
+    parts = Path(prefix).parts
+    if "pipx" in parts:
+        return ["pipx", "upgrade", PACKAGE_NAME]
+    if "uv" in parts and "tools" in parts:
+        return ["uv", "tool", "upgrade", PACKAGE_NAME]
+    return [sys.executable, "-m", "pip", "install", "--upgrade", PACKAGE_NAME]
+
+
+def self_update():
+    """Update ta to the latest version."""
+    latest = latest_version(force=True)
+    if latest and not is_newer(latest):
+        typer.echo(f"Already up to date ({__version__})")
+        raise typer.Exit()
+
+    if latest:
+        typer.echo(f"Updating {__version__} → {latest}...")
+    else:
+        typer.echo("Checking for updates...")
+
+    try:
+        result = subprocess.run(upgrade_command())
+    except FileNotFoundError:
+        result = subprocess.run([sys.executable, "-m", "pip", "install", "--upgrade", PACKAGE_NAME])
+    raise typer.Exit(result.returncode)

ta/commands/services/__init__.py

@@ -0,0 +1 @@
+from ta.commands.services.command import services as services

ta/commands/services/command.py

@@ -0,0 +1,37 @@
+import typer
+from rich.console import Console
+from rich.table import Table
+
+from ta.lib.auth import get_access_token
+from ta.lib.config import load_config
+
+console = Console()
+
+
+def services(
+    refresh: bool = typer.Option(False, "--refresh", help="Re-fetch the service catalog from the server."),
+):
+    """List configured services."""
+    cfg = load_config(refresh_catalog=refresh)
+    if not cfg["services"]:
+        if not get_access_token(cfg["env"]):
+            console.print(
+                f"[yellow]Not logged in to '{cfg['env']}'. Run `ta auth login` to load the service catalog.[/yellow]"
+            )
+            return
+        console.print(
+            f"[yellow]No services available for env '{cfg['env']}'. "
+            f"The service catalog could not be reached — check connectivity and try again.[/yellow]"
+        )
+        return
+    if refresh:
+        console.print("[green]Catalog refreshed.[/green]")
+    catalog = cfg["catalog"]
+    table = Table(title="Services", title_style="bold", show_lines=False, header_style="bold cyan")
+    table.add_column("Code", style="bold")
+    table.add_column("Name", style="dim")
+    table.add_column("Description")
+    for name in sorted(cfg["services"]):
+        entry = catalog[name]
+        table.add_row(name, entry.get("name", ""), entry.get("description", ""))
+    console.print(table)

ta/lib/analytics.py

@@ -0,0 +1,63 @@
+import contextlib
+import json
+import os
+import subprocess
+import sys
+
+import httpx
+
+from ta.lib.auth_servers import ARC_API_URLS
+
+_TIMEOUT_S = 10.0
+_WORKER = [sys.executable, "-I", "-m", "ta.lib.analytics"]
+
+
+def report_tool_call(
+    env: str,
+    token: str,
+    app: str,
+    resource: str,
+    action: str,
+    method: str,
+    status_code: int | None,
+    error_type: str | None = None,
+) -> None:
+    base_url = ARC_API_URLS.get(env)
+    if os.getenv("DO_NOT_TRACK") or not base_url or not token:
+        return
+    report = {
+        "url": f"{base_url}/api/analytics/tool-calls",
+        "token": token,
+        "payload": {
+            "app": app,
+            "resource": resource,
+            "action": action,
+            "method": method,
+            "status_code": status_code,
+            "error_type": error_type,
+        },
+    }
+    with contextlib.suppress(OSError):
+        process = subprocess.Popen(
+            _WORKER,
+            stdin=subprocess.PIPE,
+            stdout=subprocess.DEVNULL,
+            stderr=subprocess.DEVNULL,
+            start_new_session=True,
+        )
+        process.stdin.write(json.dumps(report).encode())
+        process.stdin.close()
+
+
+def _send(report: dict) -> None:
+    with contextlib.suppress(httpx.HTTPError):
+        httpx.post(
+            report["url"],
+            json=report["payload"],
+            headers={"Authorization": f"Bearer {report['token']}"},
+            timeout=_TIMEOUT_S,
+        )
+
+
+if __name__ == "__main__":
+    _send(json.load(sys.stdin))

ta/lib/auth.py

@@ -0,0 +1,212 @@
+import base64
+import hashlib
+import http.server
+import json
+import os
+import secrets
+import socket
+import threading
+import time
+import webbrowser
+from pathlib import Path
+from urllib.parse import parse_qs, urlencode, urlparse
+
+import httpx
+
+from ta.lib.auth_servers import auth_server_for
+from ta.lib.config import CONFIG_DIR
+
+AUTH_DIR = CONFIG_DIR / "auth"
+REFRESH_LEEWAY_SECONDS = 60
+CALLBACK_PORT = 8765
+
+
+def auth_file(env: str) -> Path:
+    return AUTH_DIR / f"{env}.json"
+
+
+def load_tokens(env: str) -> dict | None:
+    path = auth_file(env)
+    if not path.exists():
+        return None
+    with open(path) as f:
+        return json.load(f)
+
+
+def save_tokens(env: str, tokens: dict) -> None:
+    AUTH_DIR.mkdir(mode=0o700, parents=True, exist_ok=True)
+    AUTH_DIR.chmod(0o700)
+    path = auth_file(env)
+    fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
+    path.chmod(0o600)
+    with os.fdopen(fd, "w") as f:
+        json.dump(tokens, f, indent=2)
+
+
+def clear_tokens(env: str) -> None:
+    path = auth_file(env)
+    if path.exists():
+        path.unlink()
+
+
+def login(env: str) -> dict:
+    port = CALLBACK_PORT
+    verifier, challenge = _pkce()
+    state = secrets.token_urlsafe(16)
+
+    received: dict[str, str | None] = {"code": None, "state": None, "error": None}
+    done = threading.Event()
+
+    class Handler(http.server.BaseHTTPRequestHandler):
+        def do_GET(self):
+            if self.path.startswith("/callback"):
+                qs = parse_qs(urlparse(self.path).query)
+                received["code"] = qs.get("code", [None])[0]
+                received["state"] = qs.get("state", [None])[0]
+                received["error"] = qs.get("error", [None])[0]
+                self.send_response(200)
+                self.send_header("Content-Type", "text/html; charset=utf-8")
+                self.end_headers()
+                body = (
+                    "Login successful. You can close this window."
+                    if received["code"]
+                    else f"Login failed: {received['error']}"
+                )
+                self.wfile.write(f"<html><body><h1>{body}</h1></body></html>".encode())
+                done.set()
+            else:
+                self.send_response(404)
+                self.end_headers()
+
+        def log_message(self, *_):
+            pass
+
+    server, redirect_uri = _serve_callback(Handler, port)
+    cfg = auth_server_for(env, redirect_uri)
+    thread = threading.Thread(target=server.serve_forever, daemon=True)
+    thread.start()
+
+    params = {
+        "client_id": cfg["client_id"],
+        "response_type": "code",
+        "redirect_uri": redirect_uri,
+        "scope": cfg.get("scope", "openid"),
+        "state": state,
+        "code_challenge": challenge,
+        "code_challenge_method": "S256",
+    }
+    auth_url = f"{cfg['authorization_endpoint']}?{urlencode(params)}"
+
+    print(f"Opening browser to log in ({env})...")
+    print(f"If it doesn't open, visit:\n  {auth_url}\n")
+    webbrowser.open(auth_url)
+
+    if not done.wait(timeout=300):
+        server.shutdown()
+        raise RuntimeError("Login timed out")
+    server.shutdown()
+
+    if received["error"]:
+        raise RuntimeError(f"Authorization error: {received['error']}")
+    if not received["code"]:
+        raise RuntimeError("No authorization code received")
+    if received["state"] != state:
+        raise RuntimeError("State mismatch — possible CSRF")
+
+    data = {
+        "grant_type": "authorization_code",
+        "code": received["code"],
+        "redirect_uri": redirect_uri,
+        "client_id": cfg["client_id"],
+        "code_verifier": verifier,
+    }
+    resp = httpx.post(cfg["token_endpoint"], data=data, timeout=30)
+    if resp.status_code != 200:
+        raise RuntimeError(f"Token exchange failed: {resp.status_code} {resp.text}")
+
+    tokens = resp.json()
+    tokens["saved_at"] = int(time.time())
+    if "expires_in" in tokens:
+        tokens["expires_at"] = tokens["saved_at"] + int(tokens["expires_in"])
+    tokens["oauth"] = {
+        "client_id": cfg["client_id"],
+        "token_endpoint": cfg["token_endpoint"],
+        "revocation_endpoint": cfg.get("revocation_endpoint"),
+        "userinfo_endpoint": cfg.get("userinfo_endpoint"),
+    }
+    save_tokens(env, tokens)
+    return tokens
+
+
+def refresh(env: str) -> dict | None:
+    tokens = load_tokens(env)
+    if not tokens or not tokens.get("refresh_token"):
+        return None
+    oauth = tokens.get("oauth") or {}
+    token_endpoint = oauth.get("token_endpoint")
+    client_id = oauth.get("client_id")
+    if not token_endpoint or not client_id:
+        return None
+    data = {
+        "grant_type": "refresh_token",
+        "refresh_token": tokens["refresh_token"],
+        "client_id": client_id,
+    }
+    resp = httpx.post(token_endpoint, data=data, timeout=30)
+    if resp.status_code != 200:
+        return None
+    new_tokens = resp.json()
+    new_tokens["saved_at"] = int(time.time())
+    if "expires_in" in new_tokens:
+        new_tokens["expires_at"] = new_tokens["saved_at"] + int(new_tokens["expires_in"])
+    if "refresh_token" not in new_tokens and tokens.get("refresh_token"):
+        new_tokens["refresh_token"] = tokens["refresh_token"]
+    new_tokens["oauth"] = oauth
+    save_tokens(env, new_tokens)
+    return new_tokens
+
+
+def get_access_token(env: str) -> str | None:
+    tokens = load_tokens(env)
+    if not tokens:
+        return None
+    if "expires_at" in tokens and tokens["expires_at"] - time.time() < REFRESH_LEEWAY_SECONDS:
+        refreshed = refresh(env)
+        if refreshed:
+            tokens = refreshed
+    return tokens.get("access_token")
+
+
+def logout(env: str) -> None:
+    tokens = load_tokens(env)
+    if tokens:
+        oauth = tokens.get("oauth") or {}
+        revoke = oauth.get("revocation_endpoint")
+        client_id = oauth.get("client_id")
+        if revoke and client_id and tokens.get("refresh_token"):
+            try:
+                httpx.post(
+                    revoke,
+                    data={"token": tokens["refresh_token"], "client_id": client_id},
+                    timeout=10,
+                )
+            except httpx.HTTPError:
+                pass
+    clear_tokens(env)
+
+
+class _IPv6Server(http.server.HTTPServer):
+    address_family = socket.AF_INET6
+
+
+def _serve_callback(handler: type, port: int) -> tuple[http.server.HTTPServer, str]:
+    try:
+        return _IPv6Server(("::1", port), handler), f"http://[::1]:{port}/callback"
+    except OSError:
+        return http.server.HTTPServer(("127.0.0.1", port), handler), f"http://127.0.0.1:{port}/callback"
+
+
+def _pkce() -> tuple[str, str]:
+    verifier = secrets.token_urlsafe(64)
+    challenge = base64.urlsafe_b64encode(hashlib.sha256(verifier.encode()).digest()).rstrip(b"=").decode()
+    return verifier, challenge

ta/lib/auth_servers.py

@@ -0,0 +1,56 @@
+import httpx
+
+ARC_API_URLS: dict[str, str] = {
+    "dev": "https://arc.dev.trustarc.com",
+    "qa": "https://arc.qa.trustarc.com",
+    "prod-us": "https://arc.trustarc.com",
+    "prod-eu": "https://arc.trustarc.eu",
+    "prod-india": "https://arc.trustarc.in",
+}
+
+AUTH_BASE_URLS: dict[str, str] = {env: f"{url}/api/mcp" for env, url in ARC_API_URLS.items()}
+
+FEATURE_MANAGER_API_URLS: dict[str, str] = {
+    "dev": "https://feature.dev.trustarc.com",
+    "qa": "https://feature.qa.trustarc.com",
+    "prod-us": "https://feature.trustarc.com",
+    "prod-eu": "https://feature.trustarc.eu",
+    "prod-india": "https://feature.trustarc.in",
+}
+
+SCOPE = "openid"
+
+
+def discover(env: str) -> dict:
+    base = AUTH_BASE_URLS.get(env)
+    if not base:
+        raise RuntimeError(f"No auth base URL configured for env '{env}'")
+    oauth_resp = httpx.get(f"{base}/.well-known/oauth-authorization-server", timeout=30)
+    oauth_resp.raise_for_status()
+    oauth_md = oauth_resp.json()
+    oidc_resp = httpx.get(f"{base}/.well-known/openid-configuration", timeout=30)
+    oidc_md = oidc_resp.json() if oidc_resp.status_code == 200 else {}
+    return {
+        "registration_endpoint": oauth_md["registration_endpoint"],
+        "authorization_endpoint": oauth_md["authorization_endpoint"],
+        "token_endpoint": oauth_md["token_endpoint"],
+        "revocation_endpoint": oauth_md.get("revocation_endpoint"),
+        "userinfo_endpoint": oidc_md.get("userinfo_endpoint"),
+        "scope": SCOPE,
+    }
+
+
+def register(registration_endpoint: str, redirect_uri: str) -> str:
+    resp = httpx.post(
+        registration_endpoint,
+        json={"redirect_uris": [redirect_uri]},
+        timeout=30,
+    )
+    resp.raise_for_status()
+    return resp.json()["client_id"]
+
+
+def auth_server_for(env: str, redirect_uri: str) -> dict:
+    cfg = discover(env)
+    cfg["client_id"] = register(cfg["registration_endpoint"], redirect_uri)
+    return cfg

ta/lib/catalog_cache.py

@@ -0,0 +1,72 @@
+import json
+import time
+from pathlib import Path
+
+import httpx
+
+from ta.lib.auth_servers import ARC_API_URLS
+from ta.lib.urls import to_public_url
+
+CATALOG_DIR = Path.home() / ".ta" / "catalog"
+CATALOG_CACHE_TTL_SECONDS = 600
+
+
+def _catalog_cache_path(env: str) -> Path:
+    return CATALOG_DIR / f"{env}.json"
+
+
+def _read_cache(path: Path) -> dict | None:
+    if not path.exists():
+        return None
+    with open(path) as f:
+        return json.load(f)
+
+
+def _fetch_catalog(env: str) -> dict:
+    base = ARC_API_URLS.get(env)
+    if not base:
+        raise RuntimeError(f"No ARC API URL configured for env '{env}'")
+    from ta.lib.auth import get_access_token
+
+    token = get_access_token(env)
+    headers = {"Authorization": f"Bearer {token}"} if token else {}
+    resp = httpx.get(f"{base}/api/mcp/services", headers=headers, timeout=30)
+    resp.raise_for_status()
+    catalog: dict[str, dict] = {}
+    for entry in resp.json().get("services", []):
+        catalog[entry["key"]] = {
+            "name": entry.get("name", ""),
+            "description": entry.get("description", ""),
+            "base_url": to_public_url(entry.get("base_url")),
+            "spec_path": entry["spec_path"],
+            "prefix": entry["prefix"],
+            "include_tags": entry["include_tags"],
+        }
+    return catalog
+
+
+def evict_catalog(env: str) -> None:
+    _catalog_cache_path(env).unlink(missing_ok=True)
+
+
+def load_catalog(env: str, *, force: bool = False) -> dict:
+    path = _catalog_cache_path(env)
+    if not force and path.exists() and (time.time() - path.stat().st_mtime) < CATALOG_CACHE_TTL_SECONDS:
+        cached = _read_cache(path)
+        if cached is not None:
+            return cached
+
+    try:
+        catalog = _fetch_catalog(env)
+    except httpx.HTTPError as e:
+        stale = _read_cache(path)
+        if stale is not None:
+            return stale
+        raise RuntimeError(
+            f"Could not fetch service catalog for env '{env}' and no cached copy is available: {e}"
+        ) from e
+
+    path.parent.mkdir(parents=True, exist_ok=True)
+    with open(path, "w") as f:
+        json.dump(catalog, f)
+    return catalog