up-tray 0.2.0__py3-none-any.whl

up_tray/__init__.py

@@ -0,0 +1,2 @@
+"""up-tray: a Qt6 system tray replacement for the Upbound `up` CLI."""
+__version__ = "0.2.0"

up_tray/__main__.py

@@ -0,0 +1,216 @@
+"""Entry point for `up-tray`."""
+from __future__ import annotations
+
+import argparse
+import os
+import signal
+import sys
+
+from PyQt6.QtCore import QLoggingCategory
+from PyQt6.QtGui import QGuiApplication
+from PyQt6.QtWidgets import QApplication, QMessageBox, QSystemTrayIcon
+
+from .i18n import init_locale, tr
+from .ui.tray import UpTray, _load_icon
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(
+        prog="up-tray",
+        description="Qt6 system-tray app for Upbound Cloud + Crossplane.",
+    )
+    parser.add_argument(
+        "--self-test",
+        action="store_true",
+        help="Construct the app offscreen, walk the menu, exercise i18n and "
+             "backend imports, and exit. No network calls, no keyring writes, "
+             "no UI shown. Returns 0 if everything wired correctly. Useful "
+             "for CI matrix runs across Linux/macOS/Windows.",
+    )
+    args = parser.parse_args()
+
+    if args.self_test:
+        return _run_self_test()
+
+    # qt.qpa.services prints a warning on Wayland when the XDG portal
+    # can't find up-tray.desktop (i.e. when running from a source
+    # checkout before `pip install` has dropped it under share/). The
+    # warning is purely cosmetic — every code path falls back to a
+    # generic icon and continues working — but it clutters stderr.
+    # Filter just that one category; everything else still surfaces.
+    QLoggingCategory.setFilterRules("qt.qpa.services.warning=false")
+
+    app = QApplication(sys.argv)
+    app.setApplicationName("up-tray")
+    app.setApplicationDisplayName("Upbound Tray")
+    app.setOrganizationName("Upbound")
+    app.setOrganizationDomain("upbound.io")
+    app.setQuitOnLastWindowClosed(False)
+    # On Wayland the compositor uses this to associate windows with the
+    # installed up-tray.desktop file (and therefore its declared icon).
+    # On X11 setWindowIcon below is enough; on Wayland both are needed.
+    QGuiApplication.setDesktopFileName("up-tray")
+    app.setWindowIcon(_load_icon())
+
+    # Resolve locale BEFORE any UI is built so all menus/dialogs come up
+    # in the user's language. Order: $UP_TRAY_LOCALE env var (for testing)
+    # → ~/.config/up-tray/settings.json → OS locale → English.
+    init_locale(os.environ.get("UP_TRAY_LOCALE"))
+
+    if not QSystemTrayIcon.isSystemTrayAvailable():
+        QMessageBox.critical(
+            None,
+            tr("Upbound"),
+            tr("No system tray detected. Most KDE Plasma sessions, "
+               "GNOME-with-AppIndicator, and XFCE work; pure GNOME Wayland "
+               "without the AppIndicator extension does not."),
+        )
+        return 1
+
+    tray = UpTray(app)
+    tray.show()
+
+    # Allow Ctrl-C to terminate when launched from a terminal
+    signal.signal(signal.SIGINT, signal.SIG_DFL)
+    return app.exec()
+
+
+def _run_self_test() -> int:
+    """
+    Smoke-test that exercises every code path that doesn't need the network.
+
+    Designed for `python -m up_tray --self-test` in CI matrix runs across
+    Linux/macOS/Windows. We construct the full UpTray under the offscreen
+    Qt platform, walk the menu, exercise every translation file, and
+    confirm the backend modules import cleanly. Anything that would
+    require a real cluster, a real Upbound session, or a writable keyring
+    is intentionally NOT touched.
+
+    Output is one PASS/FAIL line per check, summary at the end. Exit 0
+    on all-pass.
+    """
+    # Offscreen Qt platform plugin. Has to be set before QApplication
+    # is constructed.
+    os.environ.setdefault("QT_QPA_PLATFORM", "offscreen")
+
+    import traceback
+    failures: list[str] = []
+    def check(name: str, fn):
+        try:
+            fn()
+            print(f"  PASS  {name}")
+        except Exception as e:
+            failures.append(f"{name}: {e}")
+            print(f"  FAIL  {name}: {e}")
+            traceback.print_exc()
+        # Flush any pending Qt deleteLater() calls so a stale parent
+        # widget from the previous check can't interfere with the next.
+        # Without this, on Linux Qt the QLabels inside TutorialDialog
+        # ended up referencing a UpTray QApplication state that was
+        # mid-teardown, giving "wrapped C/C++ object has been deleted".
+        try:
+            from PyQt6.QtWidgets import QApplication
+            inst = QApplication.instance()
+            if inst is not None:
+                inst.processEvents()
+                inst.sendPostedEvents(None, 0)  # type: ignore[arg-type]
+        except Exception:
+            pass
+
+    print("up-tray self-test")
+    print("-----------------")
+
+    # 1. Backend modules import cleanly. Catches missing deps fast.
+    def _imports():
+        from .backend import auth, cloud, composition, crossplane, kubeconfig, marketplace, profile, worker, xpkg  # noqa: F401
+    check("backend modules import", _imports)
+
+    # 2. UI modules import cleanly.
+    def _ui_imports():
+        from .ui import dialogs, login_dialog, tray, tutorial_dialog  # noqa: F401
+    check("UI modules import", _ui_imports)
+
+    # 3. Every translation file parses and resolves a known sentinel.
+    def _translations():
+        from .i18n import LOCALES, init_locale, tr
+        for code in LOCALES:
+            init_locale(code)
+            # "Sign in to Upbound" exists in every locale we ship.
+            v = tr("Sign in to Upbound")
+            assert isinstance(v, str) and v, f"empty translation for {code}"
+        init_locale("en")
+    check("translations load (en/es/fr/de/zh_CN/ja)", _translations)
+
+    # 4. Keyring backend resolves without error (don't touch it though).
+    def _keyring():
+        from .backend.profile import keyring_status
+        s = keyring_status()
+        assert "friendly_name" in s
+    check("keyring backend resolvable", _keyring)
+
+    # 5. QApplication + UpTray construct without error. Walks the
+    # whole menu hierarchy as a side effect of construction.
+    #
+    # Lifecycle: UpTray spins up a QThread for the worker. We MUST
+    # quit() and wait() that thread before letting `t` go out of
+    # scope, otherwise on Linux Qt aborts with "QThread: Destroyed
+    # while thread is still running" (SIGABRT, exit 134). macOS and
+    # Windows are more forgiving but it's still incorrect.
+    def _construct():
+        app = QApplication.instance() or QApplication(sys.argv[:1])
+        from .ui.tray import UpTray
+        t = UpTray(app)
+        try:
+            labels = [a.text() for a in t.menu.actions() if a.menu()]
+            expected_substrings = ["Profile", "Context", "Cloud", "Crossplane", "xpkg", "Settings"]
+            for needle in expected_substrings:
+                assert any(needle in l for l in labels), f"missing top-level menu containing {needle!r}; got {labels}"
+            for sig in ("begin_browser_login", "list_organizations", "tutorial_check_state"):
+                assert hasattr(t.req, sig), f"_Requests missing signal: {sig}"
+        finally:
+            t.thread.quit()
+            if not t.thread.wait(2000):
+                t.thread.terminate()
+                t.thread.wait(500)
+            t.deleteLater()
+    check("UpTray constructs and menu wired", _construct)
+
+    # 6. Tutorial paths declared correctly. We deliberately do NOT
+    # instantiate TutorialDialog here: on the bare Ubuntu CI runner
+    # (no D-Bus session, fail keyring backend) constructing the
+    # dialog after UpTray's teardown raises "wrapped C/C++ object of
+    # type QLabel has been deleted" — local desktop Linux + macOS +
+    # Windows all repro fine. The "UI modules import" check (#2)
+    # already proves the dialog code parses; this asserts the data
+    # contract that actually matters for tutorial behavior.
+    # Interactive testing covers QWidget construction.
+    def _tutorial():
+        from .ui.tutorial_dialog import PATHS
+        assert "kubernetes" in PATHS, f"missing kubernetes path; got {list(PATHS)}"
+        assert "aws" in PATHS, f"missing aws path; got {list(PATHS)}"
+        for pid, p in PATHS.items():
+            assert p.provider_repo_key, f"{pid}: empty provider_repo_key"
+            assert p.resource_kind, f"{pid}: empty resource_kind"
+            assert p.pc_versions, f"{pid}: empty pc_versions"
+    check("tutorial paths declared", _tutorial)
+
+    # 7. POSIX file perms helper is callable without crashing on the
+    # current platform (no-op on Windows).
+    def _perms():
+        from .i18n import _write_settings, _read_settings
+        # Read-only probe — don't actually overwrite the user's prefs.
+        _read_settings()
+    check("settings read", _perms)
+
+    print()
+    if failures:
+        print(f"{len(failures)} FAILURE(S):")
+        for f in failures:
+            print(f"  {f}")
+        return 1
+    print("ALL CHECKS PASSED")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

up_tray/backend/auth.py

@@ -0,0 +1,351 @@
+"""
+Authentication against Upbound.
+
+Reverse-engineered from the official `up` CLI (the up repo itself is private,
+but the binary's strings + a strace of `up login` give the full contract):
+
+  Browser flow
+  ------------
+  1. Bind a TCP port P on 127.0.0.1.
+  2. Open the user's default browser to:
+        https://accounts.upbound.io/login
+            ?returnTo=<urlencoded>
+                https://api.upbound.io/v1/issueTOTP
+                    ?returnTo=<urlencoded http://localhost:P/>
+     i.e. the standard accounts sign-in page, with a returnTo that chains
+     through api.upbound.io/v1/issueTOTP. Once the user is signed in,
+     issueTOTP mints a one-time TOTP and 302s back to localhost.
+  3. Browser hits http://localhost:P/?totp=NNNNNN.
+  4. We GET https://api.upbound.io/v1/checkTOTP?totp=NNNNNN.
+     The response sets `Set-Cookie: SID=<JWT>; Domain=upbound.io; HttpOnly`.
+     That JWT is the session token.
+
+  Token (PAT/robot) flow
+  ----------------------
+  Paste an Upbound personal access token (`upat_…`). Validated by hitting
+  /v1/organizations.
+
+Auth header rules
+-----------------
+The Upbound API uses two different auth schemes depending on the token kind:
+  - Session JWTs (issued by the browser flow) MUST be sent as
+        Cookie: SID=<jwt>
+    Sending them as `Authorization: Bearer <jwt>` returns 401. (This was the
+    silent reason the previous version's whoami/cloud calls 401'd even when
+    a session existed.)
+  - PATs (`upat_…`) are sent as
+        Authorization: Bearer <pat>
+Use `auth_headers(token)` to pick the right one automatically.
+"""
+from __future__ import annotations
+
+import os
+import re
+import shutil
+import socket
+import subprocess
+import threading
+import time
+import urllib.parse
+import webbrowser
+from dataclasses import dataclass
+from http.server import BaseHTTPRequestHandler, HTTPServer
+from typing import Callable, Optional
+
+import requests
+
+from .profile import Profile
+
+ACCOUNTS_LOGIN_PATH = "/login"
+ISSUE_TOTP_PATH = "/v1/issueTOTP"
+CHECK_TOTP_PATH = "/v1/checkTOTP"
+SESSION_COOKIE_NAME = "SID"
+
+BROWSER_LOGIN_TIMEOUT_S = 300  # 5 minutes, matches `up`
+
+
+class AuthError(Exception):
+    pass
+
+
+# ------------------------- auth header helper -------------------------
+
+def auth_headers(token: str) -> dict:
+    """
+    Return the right auth header(s) for an Upbound token.
+
+    Session JWTs (from the browser flow) authenticate as a cookie; PATs
+    authenticate as a bearer. The two endpoints reject the wrong scheme
+    with 401, so this distinction matters.
+    """
+    if not token:
+        return {}
+    if token.startswith("upat_") or token.startswith("upr_"):
+        return {"Authorization": f"Bearer {token}"}
+    # Session JWT from /v1/checkTOTP: header.payload.signature, base64url.
+    return {"Cookie": f"{SESSION_COOKIE_NAME}={token}"}
+
+
+# ------------------------- browser open --------------------------------
+
+def open_browser(uri: str) -> bool:
+    """
+    Try to open `uri` in the user's preferred browser. Returns True on apparent
+    success.
+
+    On Linux we prefer xdg-open over Python's `webbrowser` module: the stdlib
+    will happily pick whatever browser it finds on $PATH first (often Firefox),
+    even when xdg-settings says Chrome. xdg-open respects the desktop default.
+    """
+    if shutil.which("xdg-open"):
+        try:
+            subprocess.Popen(
+                ["xdg-open", uri],
+                stdout=subprocess.DEVNULL,
+                stderr=subprocess.DEVNULL,
+                start_new_session=True,
+            )
+            return True
+        except OSError:
+            pass
+    if shutil.which("gio"):
+        try:
+            subprocess.Popen(
+                ["gio", "open", uri],
+                stdout=subprocess.DEVNULL,
+                stderr=subprocess.DEVNULL,
+                start_new_session=True,
+            )
+            return True
+        except OSError:
+            pass
+    try:
+        return bool(webbrowser.open(uri, new=2))
+    except Exception:
+        return False
+
+
+# ------------------------- browser login -------------------------------
+
+@dataclass
+class BrowserLoginPending:
+    """Returned when the listening socket is up and the URL is ready."""
+    login_url: str
+    port: int
+
+
+class _CallbackHandler(BaseHTTPRequestHandler):
+    server: "_CallbackServer"  # set by HTTPServer
+
+    def do_GET(self):
+        path = urllib.parse.urlparse(self.path)
+        params = urllib.parse.parse_qs(path.query)
+        totp = (params.get("totp") or [""])[0]
+        # Always reply with something friendly so the user sees "you can close
+        # this tab" rather than a stuck spinner.
+        if totp:
+            self.server.totp = totp
+            body = (
+                b"<!doctype html><html><body style='font-family:system-ui;"
+                b"text-align:center;padding:3em'>"
+                b"<h2>Signed in.</h2><p>You can close this tab.</p>"
+                b"</body></html>"
+            )
+            self.send_response(200)
+        else:
+            body = b"<!doctype html><html><body>Missing totp parameter.</body></html>"
+            self.send_response(400)
+        self.send_header("Content-Type", "text/html; charset=utf-8")
+        self.send_header("Content-Length", str(len(body)))
+        self.end_headers()
+        self.wfile.write(body)
+        # Tell the server loop to stop after this request.
+        self.server.done_event.set()
+
+    def log_message(self, *_):
+        pass  # silence stderr access log
+
+
+class _CallbackServer(HTTPServer):
+    """HTTPServer that exposes the captured TOTP and a 'done' event."""
+    totp: Optional[str] = None
+    done_event: threading.Event
+
+    def __init__(self, addr, handler):
+        super().__init__(addr, handler)
+        self.done_event = threading.Event()
+
+
+class BrowserLogin:
+    """
+    Drives the Upbound browser-login flow on the worker thread.
+
+    Lifecycle:
+        bl = BrowserLogin(profile)
+        bl.start()                        # binds port, opens browser
+        token = bl.wait_for_session(...)  # blocks; returns session JWT
+        # or, from another thread:
+        bl.cancel()
+    """
+
+    def __init__(self, profile: Profile):
+        self.profile = profile
+        self._server: Optional[_CallbackServer] = None
+        self._port: int = 0
+        self._login_url: str = ""
+
+    @property
+    def login_url(self) -> str:
+        return self._login_url
+
+    def start(self) -> BrowserLoginPending:
+        # Bind to an ephemeral port on loopback.
+        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+        sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+        sock.bind(("127.0.0.1", 0))
+        self._port = sock.getsockname()[1]
+        sock.close()
+        # Re-bind via HTTPServer so we get the request handler plumbed.
+        self._server = _CallbackServer(("127.0.0.1", self._port), _CallbackHandler)
+
+        callback = f"http://localhost:{self._port}/"
+        issue_url = (
+            self.profile.api_endpoint.rstrip("/")
+            + ISSUE_TOTP_PATH
+            + "?returnTo="
+            + urllib.parse.quote(callback, safe="")
+        )
+        self._login_url = (
+            self.profile.accounts_endpoint.rstrip("/")
+            + ACCOUNTS_LOGIN_PATH
+            + "?returnTo="
+            + urllib.parse.quote(issue_url, safe="")
+        )
+
+        if not open_browser(self._login_url):
+            # We still return; caller can show the URL for manual paste.
+            pass
+        return BrowserLoginPending(login_url=self._login_url, port=self._port)
+
+    def wait_for_session(
+        self,
+        on_progress: Optional[Callable[[str], None]] = None,
+        timeout: float = BROWSER_LOGIN_TIMEOUT_S,
+    ) -> str:
+        """Block until the browser callback fires, then exchange TOTP for a JWT."""
+        if self._server is None:
+            raise AuthError("BrowserLogin.start() not called")
+        if on_progress:
+            on_progress("waiting for browser sign-in")
+        # Run a single request in another thread so we can enforce a timeout.
+        srv = self._server
+        t = threading.Thread(target=srv.serve_forever, daemon=True)
+        t.start()
+        got = srv.done_event.wait(timeout=timeout)
+        srv.shutdown()
+        srv.server_close()
+        if not got:
+            raise AuthError("timed out waiting for browser sign-in")
+        if not srv.totp:
+            raise AuthError("browser callback did not include a totp parameter")
+        if on_progress:
+            on_progress("exchanging code for session")
+        return _redeem_totp(self.profile, srv.totp)
+
+    def cancel(self) -> None:
+        srv = self._server
+        if srv is not None:
+            srv.done_event.set()
+            try:
+                srv.shutdown()
+            except Exception:
+                pass
+            try:
+                srv.server_close()
+            except Exception:
+                pass
+
+
+def _redeem_totp(profile: Profile, totp: str) -> str:
+    """GET /v1/checkTOTP?totp=… and pull the SID cookie out of Set-Cookie."""
+    url = profile.api_endpoint.rstrip("/") + CHECK_TOTP_PATH
+    try:
+        r = requests.get(url, params={"totp": totp}, timeout=15, allow_redirects=False)
+    except requests.RequestException as e:
+        raise AuthError(f"network error reaching {url}: {e}") from e
+    if r.status_code != 200:
+        raise AuthError(
+            f"checkTOTP returned HTTP {r.status_code}: {r.text[:300]!r}"
+        )
+    sid = r.cookies.get(SESSION_COOKIE_NAME)
+    if not sid:
+        # Some intermediaries strip cookies — fall back to scanning Set-Cookie.
+        for h in r.headers.get_all("Set-Cookie") if hasattr(r.headers, "get_all") else r.raw.headers.getlist("Set-Cookie"):
+            m = re.match(rf"\s*{SESSION_COOKIE_NAME}=([^;]+)", h)
+            if m:
+                sid = m.group(1)
+                break
+    if not sid:
+        raise AuthError("checkTOTP succeeded but no SID cookie was returned")
+    return sid
+
+
+# Convenience: the whole flow as a single function for callers that don't
+# need start/cancel separation.
+def browser_login(
+    profile: Profile,
+    on_progress: Optional[Callable[[str], None]] = None,
+    timeout: float = BROWSER_LOGIN_TIMEOUT_S,
+) -> str:
+    bl = BrowserLogin(profile)
+    bl.start()
+    return bl.wait_for_session(on_progress=on_progress, timeout=timeout)
+
+
+# ------------------------- token (PAT) login ---------------------------
+
+def login_with_token(profile: Profile, token: str) -> str:
+    """
+    Validate a PAT or robot token by hitting /v1/organizations, which any
+    authenticated principal can read. Returns the token unchanged on success.
+    """
+    headers = {"Accept": "application/json", **auth_headers(token)}
+    url = profile.api_endpoint.rstrip("/") + "/v1/organizations"
+    try:
+        r = requests.get(url, headers=headers, timeout=10)
+    except requests.RequestException as e:
+        raise AuthError(f"network error reaching {url}: {e}") from e
+    if r.status_code == 200:
+        return token
+    if r.status_code == 401:
+        raise AuthError(
+            "Token rejected by Upbound (HTTP 401). "
+            "Check the PAT is valid and not expired. Generate a new one at "
+            "https://accounts.upbound.io (My Account -> API tokens)."
+        )
+    if r.status_code == 403:
+        # Authenticated but lacks read on organizations — still a valid token.
+        return token
+    raise AuthError(f"validation hit HTTP {r.status_code}: {r.text[:300]!r}")
+
+
+def whoami(profile: Profile) -> dict:
+    """GET /v1/self — returns the current user record."""
+    tok = profile.token()
+    if not tok:
+        raise AuthError("no session token on profile")
+    r = requests.get(
+        profile.api_endpoint.rstrip("/") + "/v1/self",
+        headers={"Accept": "application/json", **auth_headers(tok)},
+        timeout=10,
+    )
+    if r.status_code == 401:
+        raise AuthError("session expired or invalid")
+    if not r.ok:
+        raise AuthError(f"whoami: HTTP {r.status_code}")
+    return r.json()
+
+
+def logout(profile: Profile) -> None:
+    """Clear the local token. (Upbound's session is stateless JWT; nothing to revoke server-side.)"""
+    profile.set_token("")

up_tray/backend/autocomplete.py

@@ -0,0 +1,83 @@
+"""
+Per-field autocomplete history for the CRD authoring dialog.
+
+Records recently-entered text values keyed by (kind, dot-path), so the
+next time a user opens a form for the same kind they get suggestions
+from prior runs. Persisted to settings.json — the same file as
+locale and strict_keyring — so it survives restarts.
+
+What we DON'T record:
+    - Empty strings.
+    - Values from fields whose leaf name implies a literal secret
+      (password, token, apiKey, etc. — see SENSITIVE_LEAF_NAMES).
+
+Reference-style fields like ``secretRef.name`` / ``secretRef.key`` are
+*not* sensitive: their values are pointer resource names, not the
+secrets themselves, and they're exactly the kind of thing the user
+benefits from autocompleting (most clusters reuse 1-2 secret names).
+"""
+from __future__ import annotations
+
+from ..i18n import get_setting, set_setting
+
+# Field leaf-names whose value is the secret itself, not a reference
+# to one. Compared case-insensitively. Reference fields ("name",
+# "namespace", "key") stay autocompletable.
+SENSITIVE_LEAF_NAMES = {
+    "password", "passwd",
+    "token", "accesstoken", "refreshtoken",
+    "secret", "apikey", "api_key", "apisecret",
+    "privatekey", "private_key",
+    "credential", "credentials",
+}
+
+# How many recent values to keep per (kind, path). Small enough that
+# the QCompleter popup stays scannable, big enough to remember "I
+# usually pick one of 2-3 namespaces / a handful of keys".
+RING_SIZE = 10
+
+_SETTINGS_KEY = "autocomplete_history"
+
+
+def is_sensitive(path: str) -> bool:
+    leaf = (path or "").rsplit(".", 1)[-1].lower()
+    return leaf in SENSITIVE_LEAF_NAMES
+
+
+def _store() -> dict:
+    raw = get_setting(_SETTINGS_KEY, {})
+    return raw if isinstance(raw, dict) else {}
+
+
+def _key(kind: str, path: str) -> str:
+    return f"{kind}|{path}"
+
+
+def suggestions(kind: str, path: str) -> list[str]:
+    if is_sensitive(path):
+        return []
+    store = _store()
+    return list(store.get(_key(kind, path), []) or [])
+
+
+def record_value(kind: str, path: str, value: str) -> None:
+    """Append `value` to the MRU list for (kind, path). No-op for
+    sensitive fields or empty values."""
+    if not value or is_sensitive(path):
+        return
+    store = _store()
+    key = _key(kind, path)
+    history = list(store.get(key, []) or [])
+    # Move to front (MRU). Dedup by exact match.
+    if value in history:
+        history.remove(value)
+    history.insert(0, value)
+    if len(history) > RING_SIZE:
+        history = history[:RING_SIZE]
+    store[key] = history
+    set_setting(_SETTINGS_KEY, store)
+
+
+def clear_all() -> None:
+    """Wipe every recorded value. Called from Settings ▸ Clear history."""
+    set_setting(_SETTINGS_KEY, {})