valdtech-cli 0.1.0__py3-none-any.whl

valdtech_cli/config.py

@@ -0,0 +1,196 @@
+from __future__ import annotations
+
+from dataclasses import dataclass
+from datetime import datetime, timedelta, timezone
+import json
+import os
+from pathlib import Path
+import tempfile
+from typing import Any
+from urllib.parse import urlsplit
+
+from .errors import CliError, ExitCode
+
+
+@dataclass(frozen=True, slots=True)
+class Context:
+    name: str
+    api_url: str
+    issuer: str
+    client_id: str
+    scopes: tuple[str, ...]
+
+    @classmethod
+    def from_dict(cls, name: str, value: dict[str, Any]) -> "Context":
+        return cls(
+            name=name,
+            api_url=_validated_base_url(value.get("apiUrl"), "apiUrl"),
+            issuer=_validated_base_url(value.get("issuer"), "issuer"),
+            client_id=_required_string(value.get("clientId"), "clientId"),
+            scopes=tuple(_required_string(item, "scope") for item in value.get("scopes", [])),
+        )
+
+    def public_dict(self) -> dict[str, Any]:
+        return {
+            "name": self.name,
+            "apiUrl": self.api_url,
+            "issuer": self.issuer,
+            "clientId": self.client_id,
+            "scopes": list(self.scopes),
+        }
+
+
+@dataclass(frozen=True, slots=True)
+class AccessToken:
+    value: str
+    expires_at: datetime
+
+    @property
+    def expired(self) -> bool:
+        return self.expires_at <= datetime.now(timezone.utc)
+
+
+class ConfigStore:
+    def __init__(self, root: Path | None = None):
+        self.root = root or _default_config_root()
+        self.config_path = self.root / "contexts.json"
+        self.token_root = self.root / "tokens"
+
+    def use_context(self, context: Context | None, name: str) -> Context:
+        document = self._load_document()
+        contexts = document.setdefault("contexts", {})
+        if context is not None:
+            contexts[name] = {
+                "apiUrl": context.api_url,
+                "issuer": context.issuer,
+                "clientId": context.client_id,
+                "scopes": list(context.scopes),
+            }
+        if name not in contexts:
+            raise CliError(
+                f"Context '{name}' does not exist; provide its connection options first.",
+                ExitCode.VALIDATION,
+                "context-not-found",
+            )
+        document["currentContext"] = name
+        self._write_json(self.config_path, document)
+        return Context.from_dict(name, contexts[name])
+
+    def current_context(self, override: str | None = None) -> Context:
+        document = self._load_document()
+        name = override or document.get("currentContext")
+        if not name:
+            raise CliError(
+                "No current context. Run 'valdtechctl context use' first.",
+                ExitCode.VALIDATION,
+                "context-required",
+            )
+        value = document.get("contexts", {}).get(name)
+        if value is None:
+            raise CliError("The current context is invalid.", ExitCode.VALIDATION, "context-invalid")
+        return Context.from_dict(name, value)
+
+    def list_contexts(self) -> tuple[str | None, list[Context]]:
+        document = self._load_document()
+        contexts = [Context.from_dict(name, value) for name, value in document.get("contexts", {}).items()]
+        return document.get("currentContext"), sorted(contexts, key=lambda item: item.name)
+
+    def save_token(self, context_name: str, value: str, expires_in: int) -> AccessToken:
+        if not value or expires_in <= 0:
+            raise CliError("The token response is invalid.", ExitCode.AUTHENTICATION, "invalid-token-response")
+        expires_at = datetime.now(timezone.utc) + timedelta(seconds=expires_in)
+        self._write_json(
+            self.token_root / f"{_safe_context_filename(context_name)}.json",
+            {"accessToken": value, "expiresAt": expires_at.isoformat()},
+        )
+        return AccessToken(value, expires_at)
+
+    def load_token(self, context_name: str) -> AccessToken | None:
+        environment_token = os.environ.get("VALDTECH_ACCESS_TOKEN")
+        if environment_token:
+            return AccessToken(environment_token, datetime.max.replace(tzinfo=timezone.utc))
+        path = self.token_root / f"{_safe_context_filename(context_name)}.json"
+        if not path.exists():
+            return None
+        try:
+            document = json.loads(path.read_text(encoding="utf-8"))
+            token = _required_string(document.get("accessToken"), "accessToken")
+            expires_at = datetime.fromisoformat(_required_string(document.get("expiresAt"), "expiresAt"))
+            if expires_at.tzinfo is None:
+                raise ValueError("timezone required")
+            return AccessToken(token, expires_at.astimezone(timezone.utc))
+        except (OSError, ValueError, TypeError, json.JSONDecodeError) as error:
+            raise CliError("Stored authentication state is invalid.", ExitCode.AUTHENTICATION, "token-invalid") from error
+
+    def _load_document(self) -> dict[str, Any]:
+        if not self.config_path.exists():
+            return {"contractVersion": "valdtechctl.context.v1", "currentContext": None, "contexts": {}}
+        try:
+            document = json.loads(self.config_path.read_text(encoding="utf-8"))
+        except (OSError, json.JSONDecodeError) as error:
+            raise CliError("The context file is invalid.", ExitCode.VALIDATION, "context-file-invalid") from error
+        if document.get("contractVersion") != "valdtechctl.context.v1" or not isinstance(document.get("contexts"), dict):
+            raise CliError("The context file version is unsupported.", ExitCode.VALIDATION, "context-version-unsupported")
+        return document
+
+    def _write_json(self, path: Path, value: dict[str, Any]) -> None:
+        path.parent.mkdir(parents=True, exist_ok=True, mode=0o700)
+        os.chmod(path.parent, 0o700)
+        payload = (json.dumps(value, indent=2, sort_keys=True) + "\n").encode()
+        descriptor, temporary_name = tempfile.mkstemp(prefix=f".{path.name}.", dir=path.parent)
+        try:
+            os.fchmod(descriptor, 0o600)
+            with os.fdopen(descriptor, "wb") as output:
+                output.write(payload)
+                output.flush()
+                os.fsync(output.fileno())
+            os.replace(temporary_name, path)
+            os.chmod(path, 0o600)
+        except BaseException:
+            try:
+                os.unlink(temporary_name)
+            except FileNotFoundError:
+                pass
+            raise
+
+
+def build_context(name: str, api_url: str, issuer: str, client_id: str, scopes: list[str]) -> Context:
+    if not scopes or len(scopes) > 32:
+        raise CliError("Between 1 and 32 scopes are required.", ExitCode.VALIDATION, "scope-required")
+    return Context(
+        name=_required_string(name, "name"),
+        api_url=_validated_base_url(api_url, "apiUrl"),
+        issuer=_validated_base_url(issuer, "issuer"),
+        client_id=_required_string(client_id, "clientId"),
+        scopes=tuple(dict.fromkeys(_required_string(scope, "scope") for scope in scopes)),
+    )
+
+
+def _default_config_root() -> Path:
+    explicit = os.environ.get("VALDTECH_CONFIG_HOME")
+    if explicit:
+        return Path(explicit).expanduser()
+    xdg = os.environ.get("XDG_CONFIG_HOME")
+    return (Path(xdg).expanduser() if xdg else Path.home() / ".config") / "valdtech"
+
+
+def _validated_base_url(value: Any, field: str) -> str:
+    text = _required_string(value, field).rstrip("/")
+    parsed = urlsplit(text)
+    local_http = parsed.scheme == "http" and parsed.hostname in {"localhost", "127.0.0.1", "::1"}
+    if (parsed.scheme != "https" and not local_http) or not parsed.netloc:
+        raise CliError(f"{field} must use HTTPS (HTTP is allowed only for loopback).", ExitCode.VALIDATION, "unsafe-url")
+    if parsed.username or parsed.password or parsed.query or parsed.fragment:
+        raise CliError(f"{field} must not contain credentials, a query, or a fragment.", ExitCode.VALIDATION, "unsafe-url")
+    return text
+
+
+def _required_string(value: Any, field: str) -> str:
+    if not isinstance(value, str) or not value.strip() or len(value) > 2048:
+        raise CliError(f"{field} is required and must be bounded.", ExitCode.VALIDATION, "invalid-value")
+    return value.strip()
+
+
+def _safe_context_filename(name: str) -> str:
+    digest = __import__("hashlib").sha256(name.encode()).hexdigest()[:16]
+    return f"context-{digest}"

valdtech_cli/errors.py

@@ -0,0 +1,49 @@
+from __future__ import annotations
+
+from dataclasses import dataclass
+from enum import IntEnum
+from typing import Any
+
+
+class ExitCode(IntEnum):
+    SUCCESS = 0
+    USAGE = 2
+    VALIDATION = 10
+    AUTHENTICATION = 11
+    CONFLICT = 12
+    PARTIAL_EXTERNAL_EFFECT = 13
+    SERVER_FAILURE = 14
+    NETWORK_FAILURE = 15
+    CANCELLED = 16
+
+
+@dataclass(slots=True)
+class CliError(Exception):
+    message: str
+    exit_code: ExitCode
+    code: str
+    details: Any = None
+
+    def __str__(self) -> str:
+        return self.message
+
+
+class ApiError(CliError):
+    def __init__(self, message: str, status: int, details: Any = None):
+        super().__init__(
+            message=message,
+            exit_code=_exit_code_for_status(status),
+            code=f"http-{status}",
+            details=details,
+        )
+        self.status = status
+
+
+def _exit_code_for_status(status: int) -> ExitCode:
+    if status in (401, 403):
+        return ExitCode.AUTHENTICATION
+    if status in (409, 410):
+        return ExitCode.CONFLICT
+    if status in (400, 404, 422):
+        return ExitCode.VALIDATION
+    return ExitCode.SERVER_FAILURE

valdtech_cli/http.py

@@ -0,0 +1,145 @@
+from __future__ import annotations
+
+from dataclasses import dataclass
+import json
+import socket
+from typing import Any
+from urllib.error import HTTPError, URLError
+from urllib.parse import urlencode, urljoin
+from urllib.request import HTTPRedirectHandler, Request, build_opener
+
+from . import __version__
+from .errors import ApiError, CliError, ExitCode
+
+
+MAX_RESPONSE_BYTES = 8 * 1024 * 1024
+
+
+@dataclass(frozen=True, slots=True)
+class HttpResponse:
+    status: int
+    content_type: str
+    body: bytes
+
+    def json(self) -> Any:
+        try:
+            return json.loads(self.body.decode("utf-8"))
+        except (UnicodeDecodeError, json.JSONDecodeError) as error:
+            raise CliError("The server returned invalid JSON.", ExitCode.SERVER_FAILURE, "invalid-server-json") from error
+
+
+class _NoRedirectHandler(HTTPRedirectHandler):
+    def redirect_request(self, req, fp, code, msg, headers, newurl):  # noqa: ANN001
+        return None
+
+
+class HttpClient:
+    def __init__(self, base_url: str, timeout: float, access_token: str | None = None):
+        self.base_url = base_url.rstrip("/") + "/"
+        self.timeout = timeout
+        self.access_token = access_token
+        self._opener = build_opener(_NoRedirectHandler())
+
+    def get(self, path_or_url: str, *, authenticated: bool = True) -> HttpResponse:
+        return self._send("GET", path_or_url, None, authenticated=authenticated)
+
+    def post_json(
+        self,
+        path_or_url: str,
+        value: Any,
+        *,
+        headers: dict[str, str] | None = None,
+        authenticated: bool = True,
+        sensitive_values: tuple[str, ...] = (),
+    ) -> HttpResponse:
+        payload = json.dumps(value, separators=(",", ":"), ensure_ascii=False).encode("utf-8")
+        return self._send(
+            "POST",
+            path_or_url,
+            payload,
+            content_type="application/json",
+            headers=headers,
+            authenticated=authenticated,
+            sensitive_values=sensitive_values,
+        )
+
+    def post_form(
+        self,
+        path_or_url: str,
+        value: dict[str, str],
+        *,
+        sensitive_values: tuple[str, ...] = (),
+    ) -> HttpResponse:
+        payload = urlencode(value).encode("ascii")
+        return self._send(
+            "POST",
+            path_or_url,
+            payload,
+            content_type="application/x-www-form-urlencoded",
+            authenticated=False,
+            sensitive_values=sensitive_values,
+        )
+
+    def _send(
+        self,
+        method: str,
+        path_or_url: str,
+        payload: bytes | None,
+        *,
+        content_type: str | None = None,
+        headers: dict[str, str] | None = None,
+        authenticated: bool,
+        sensitive_values: tuple[str, ...] = (),
+    ) -> HttpResponse:
+        url = path_or_url if "://" in path_or_url else urljoin(self.base_url, path_or_url.lstrip("/"))
+        request_headers = {"Accept": "application/json", "User-Agent": f"valdtechctl/{__version__}"}
+        if content_type:
+            request_headers["Content-Type"] = content_type
+        if authenticated:
+            if not self.access_token:
+                raise CliError("Authentication is required. Run 'valdtechctl login'.", ExitCode.AUTHENTICATION, "login-required")
+            request_headers["Authorization"] = f"Bearer {self.access_token}"
+        if headers:
+            request_headers.update(headers)
+        request = Request(url, data=payload, method=method, headers=request_headers)
+        try:
+            with self._opener.open(request, timeout=self.timeout) as response:
+                body = _bounded_read(response)
+                return HttpResponse(response.status, response.headers.get_content_type(), body)
+        except HTTPError as error:
+            body = _bounded_read(error)
+            details = _safe_error_details(body, sensitive_values) if error.code < 500 else None
+            raise ApiError(f"The server rejected the request with HTTP {error.code}.", error.code, details) from None
+        except (URLError, TimeoutError, socket.timeout, OSError) as error:
+            raise CliError("The server could not be reached within the configured timeout.", ExitCode.NETWORK_FAILURE, "network-failure") from error
+
+
+def _bounded_read(response) -> bytes:  # noqa: ANN001
+    body = response.read(MAX_RESPONSE_BYTES + 1)
+    if len(body) > MAX_RESPONSE_BYTES:
+        raise CliError("The server response exceeded the client limit.", ExitCode.SERVER_FAILURE, "response-too-large")
+    return body
+
+
+def _safe_error_details(body: bytes, sensitive_values: tuple[str, ...]) -> Any:
+    try:
+        value = json.loads(body.decode("utf-8"))
+    except (UnicodeDecodeError, json.JSONDecodeError):
+        return None
+    return redact(value, tuple(item for item in sensitive_values if item))
+
+
+def redact(value: Any, sensitive_values: tuple[str, ...]) -> Any:
+    if isinstance(value, dict):
+        return {
+            key: "[REDACTED]" if any(marker in key.lower() for marker in ("token", "secret", "password")) else redact(item, sensitive_values)
+            for key, item in value.items()
+        }
+    if isinstance(value, list):
+        return [redact(item, sensitive_values) for item in value]
+    if isinstance(value, str):
+        result = value
+        for secret in sensitive_values:
+            result = result.replace(secret, "[REDACTED]")
+        return result
+    return value

valdtech_cli/output.py

@@ -0,0 +1,76 @@
+from __future__ import annotations
+
+import json
+import sys
+from typing import Any
+
+
+CONTRACT_VERSION = "valdtechctl.output.v1"
+
+
+def emit(command: str, result: Any, output_format: str, *, raw_text: str | None = None) -> None:
+    if output_format == "text" and raw_text is not None:
+        sys.stdout.write(raw_text)
+        return
+    envelope = {"contractVersion": CONTRACT_VERSION, "command": command, "ok": True, "result": result}
+    _write(envelope, output_format)
+
+
+def emit_error(command: str, code: str, message: str, details: Any, output_format: str) -> None:
+    print(f"Error: {message}", file=sys.stderr)
+    if output_format == "text":
+        return
+    envelope = {
+        "contractVersion": CONTRACT_VERSION,
+        "command": command,
+        "ok": False,
+        "error": {"code": code, "message": message, "details": details},
+    }
+    _write(envelope, output_format)
+
+
+def _write(value: Any, output_format: str) -> None:
+    if output_format == "yaml":
+        sys.stdout.write(_yaml(value))
+    else:
+        json.dump(value, sys.stdout, indent=2, sort_keys=True, ensure_ascii=False)
+        sys.stdout.write("\n")
+
+
+def _yaml(value: Any, indent: int = 0) -> str:
+    prefix = " " * indent
+    if isinstance(value, dict):
+        lines: list[str] = []
+        for key in sorted(value):
+            item = value[key]
+            safe_key = _yaml_scalar(str(key))
+            if isinstance(item, (dict, list)):
+                lines.append(f"{prefix}{safe_key}:")
+                lines.append(_yaml(item, indent + 2).rstrip("\n"))
+            else:
+                lines.append(f"{prefix}{safe_key}: {_yaml_scalar(item)}")
+        return "\n".join(lines) + "\n"
+    if isinstance(value, list):
+        if not value:
+            return f"{prefix}[]\n"
+        lines = []
+        for item in value:
+            if isinstance(item, (dict, list)):
+                lines.append(f"{prefix}-")
+                lines.append(_yaml(item, indent + 2).rstrip("\n"))
+            else:
+                lines.append(f"{prefix}- {_yaml_scalar(item)}")
+        return "\n".join(lines) + "\n"
+    return f"{prefix}{_yaml_scalar(value)}\n"
+
+
+def _yaml_scalar(value: Any) -> str:
+    if value is None:
+        return "null"
+    if value is True:
+        return "true"
+    if value is False:
+        return "false"
+    if isinstance(value, (int, float)):
+        return str(value)
+    return json.dumps(str(value), ensure_ascii=False)

valdtech_cli-0.1.0.dist-info/METADATA

@@ -0,0 +1,10 @@
+Metadata-Version: 2.3
+Name: valdtech-cli
+Version: 0.1.0
+Summary: Thin, automation-safe client for the Valdtech Provisioning API
+Requires-Python: >=3.11
+Provides-Extra: workload
+Requires-Dist: cryptography==46.0.7; extra == "workload"
+Description-Content-Type: text/plain
+
+Thin, automation-safe client for the Valdtech Provisioning API.

valdtech_cli-0.1.0.dist-info/RECORD

@@ -0,0 +1,12 @@
+valdtech_cli-0.1.0.dist-info/METADATA,sha256=NpLVqIIPcIV584jSi-JyepwQNLVnqYVY1eJ2EyYBsak,336
+valdtech_cli-0.1.0.dist-info/WHEEL,sha256=1tgGR2fx_p-bU7vlX210gXT1E28A2BPs8cCHPP8CoXI,95
+valdtech_cli-0.1.0.dist-info/entry_points.txt,sha256=3zxXPQDE8HGVFqry2MMU3pQ8tsdlAKp3qs8zIgMUUmE,54
+valdtech_cli/__init__.py,sha256=fS1d3atNEyjmXfBAyTucQijz7avggMpPCXapoW24qWc,56
+valdtech_cli/__main__.py,sha256=zRDmnd5hoEn16bRoQMzXpk9IPud9uPoJlxY2B2AOzJQ,61
+valdtech_cli/auth.py,sha256=wAUc2_oYtwo-Isu8tjoZrKL62LPWBD7SoD67M-b9Bqg,7936
+valdtech_cli/cli.py,sha256=FLgWi89xJNJ0XnlOvWBlpHoilC9MGb7tD0isZ8RL2sM,31963
+valdtech_cli/config.py,sha256=LqKD2SPhfroUFJy1b6veJkXMK51k8ehWZN9BlaSDngs,8370
+valdtech_cli/errors.py,sha256=D9J7Bju9NWm3XcTgcABbU0D3qiLtcRY9Gncv6rHp8Ys,1127
+valdtech_cli/http.py,sha256=gQvOLbFCg3IkY-T9Rf5ImZhsvCnodEAtQRaMZskWmgY,5411
+valdtech_cli/output.py,sha256=477k3FSPUPbvVblffNSRYxDb95_UJGvJcbL1bXebsFY,2438
+valdtech_cli-0.1.0.dist-info/RECORD,,

valdtech_cli-0.1.0.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: valdtech-build-backend 1
+Root-Is-Purelib: true
+Tag: py3-none-any

valdtech_cli-0.1.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+valdtechctl = valdtech_cli.cli:main