valdtech-cli 0.1.0__tar.gz

valdtech_cli-0.1.0/PKG-INFO

@@ -0,0 +1,10 @@
+Metadata-Version: 2.3
+Name: valdtech-cli
+Version: 0.1.0
+Summary: Thin, automation-safe client for the Valdtech Provisioning API
+Requires-Python: >=3.11
+Provides-Extra: workload
+Requires-Dist: cryptography==46.0.7; extra == "workload"
+Description-Content-Type: text/plain
+
+Thin, automation-safe client for the Valdtech Provisioning API.

valdtech_cli-0.1.0/build.py

@@ -0,0 +1,30 @@
+"""Build local universal Valdtech CLI artifacts without network access."""
+
+from __future__ import annotations
+
+import argparse
+from pathlib import Path
+
+import valdtech_build_backend as backend
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--output-dir", required=True)
+    parser.add_argument("--wheel", action=argparse.BooleanOptionalAction, default=True)
+    parser.add_argument("--sdist", action=argparse.BooleanOptionalAction, default=True)
+    parser.add_argument("--pyz", action=argparse.BooleanOptionalAction, default=True)
+    args = parser.parse_args()
+    output = Path(args.output_dir)
+    output.mkdir(parents=True, exist_ok=True)
+    if args.wheel:
+        print(output / backend.build_wheel(output))
+    if args.sdist:
+        print(output / backend.build_sdist(output))
+    if args.pyz:
+        print(output / backend.build_zipapp(output / "valdtechctl.pyz"))
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

valdtech_cli-0.1.0/pyproject.toml

@@ -0,0 +1,32 @@
+[build-system]
+requires = []
+build-backend = "valdtech_build_backend"
+backend-path = ["."]
+
+[project]
+name = "valdtech-cli"
+dynamic = ["version"]
+description = "Thin, automation-safe client for the Valdtech Provisioning API"
+requires-python = ">=3.11"
+dependencies = []
+authors = [{ name = "Valdtech" }]
+classifiers = [
+  "Development Status :: 3 - Alpha",
+  "Environment :: Console",
+  "Programming Language :: Python :: 3",
+  "Programming Language :: Python :: 3 :: Only",
+  "Programming Language :: Python :: 3.11",
+  "Programming Language :: Python :: 3.12",
+  "Programming Language :: Python :: 3.13",
+  "Programming Language :: Python :: 3.14",
+]
+
+[project.optional-dependencies]
+workload = ["cryptography==46.0.7"]
+
+[project.scripts]
+valdtechctl = "valdtech_cli.cli:main"
+
+[project.urls]
+Documentation = "https://github.com/ValdtechSSO/valdtechsecurity"
+Source = "https://github.com/ValdtechSSO/valdtechsecurity"

valdtech_cli-0.1.0/src/valdtech_cli/__init__.py

@@ -0,0 +1,3 @@
+"""Valdtech Provisioning CLI."""
+
+__version__ = "0.1.0"

valdtech_cli-0.1.0/src/valdtech_cli/__main__.py

@@ -0,0 +1,4 @@
+from valdtech_cli.cli import main
+
+
+raise SystemExit(main())

valdtech_cli-0.1.0/src/valdtech_cli/auth.py

@@ -0,0 +1,201 @@
+from __future__ import annotations
+
+from dataclasses import dataclass
+import sys
+import time
+from typing import Any, Callable
+import webbrowser
+import base64
+import json
+from pathlib import Path
+import uuid
+
+from .config import AccessToken, ConfigStore, Context
+from .errors import ApiError, CliError, ExitCode
+from .http import HttpClient
+
+
+@dataclass(frozen=True, slots=True)
+class LoginResult:
+    token: AccessToken
+    granted_scope: str | None
+
+
+def workload_login(
+    context: Context,
+    store: ConfigStore,
+    timeout: float,
+    private_key_file: str,
+    key_id: str | None,
+    password: str | None,
+) -> LoginResult:
+    try:
+        from cryptography.hazmat.primitives import hashes, serialization
+        from cryptography.hazmat.primitives.asymmetric import padding
+    except ImportError as error:
+        raise CliError(
+            "Workload login requires the optional 'workload' dependency.",
+            ExitCode.AUTHENTICATION,
+            "workload-dependency-missing",
+        ) from error
+
+    issuer_client = HttpClient(context.issuer, timeout)
+    discovery = _object(issuer_client.get(
+        f"{context.issuer}/.well-known/openid-configuration",
+        authenticated=False,
+    ).json(), "discovery")
+    token_endpoint = _https_endpoint(discovery.get("token_endpoint"), "token_endpoint")
+    try:
+        key_bytes = Path(private_key_file).read_bytes()
+        private_key = serialization.load_pem_private_key(
+            key_bytes,
+            password=password.encode("utf-8") if password else None,
+        )
+    except (OSError, ValueError, TypeError) as error:
+        raise CliError(
+            "The workload private key could not be loaded.",
+            ExitCode.AUTHENTICATION,
+            "workload-private-key-invalid",
+        ) from error
+
+    now = int(time.time())
+    header: dict[str, str] = {"alg": "RS256", "typ": "JWT"}
+    if key_id:
+        header["kid"] = key_id
+    claims = {
+        "iss": context.client_id,
+        "sub": context.client_id,
+        "aud": token_endpoint,
+        "iat": now,
+        "exp": now + 300,
+        "jti": str(uuid.uuid4()),
+    }
+    signing_input = f"{_b64json(header)}.{_b64json(claims)}".encode("ascii")
+    try:
+        signature = private_key.sign(signing_input, padding.PKCS1v15(), hashes.SHA256())
+    except (AttributeError, TypeError, ValueError) as error:
+        raise CliError(
+            "The workload key is not an RSA signing key.",
+            ExitCode.AUTHENTICATION,
+            "workload-signing-key-invalid",
+        ) from error
+    assertion = f"{signing_input.decode('ascii')}.{_b64(signature)}"
+    token_document = _object(issuer_client.post_form(
+        token_endpoint,
+        {
+            "grant_type": "client_credentials",
+            "client_id": context.client_id,
+            "scope": " ".join(context.scopes),
+            "client_assertion_type": "urn:ietf:params:oauth:client-assertion-type:jwt-bearer",
+            "client_assertion": assertion,
+        },
+        sensitive_values=(assertion,),
+    ).json(), "token response")
+    access_token = _required(token_document, "access_token")
+    expires_in = _positive_int(token_document.get("expires_in"), "expires_in")
+    stored = store.save_token(context.name, access_token, expires_in)
+    scope = token_document.get("scope") if isinstance(token_document.get("scope"), str) else None
+    return LoginResult(stored, scope)
+
+
+def device_login(
+    context: Context,
+    store: ConfigStore,
+    timeout: float,
+    *,
+    open_browser: bool = False,
+    sleeper: Callable[[float], None] = time.sleep,
+) -> LoginResult:
+    issuer_client = HttpClient(context.issuer, timeout)
+    discovery_url = f"{context.issuer}/.well-known/openid-configuration"
+    discovery = _object(issuer_client.get(discovery_url, authenticated=False).json(), "discovery")
+    device_endpoint = _https_endpoint(discovery.get("device_authorization_endpoint"), "device_authorization_endpoint")
+    token_endpoint = _https_endpoint(discovery.get("token_endpoint"), "token_endpoint")
+    response = _object(
+        issuer_client.post_form(
+            device_endpoint,
+            {"client_id": context.client_id, "scope": " ".join(context.scopes)},
+        ).json(),
+        "device authorization response",
+    )
+    device_code = _required(response, "device_code")
+    user_code = _required(response, "user_code")
+    verification_uri = _required(response, "verification_uri")
+    verification_complete = response.get("verification_uri_complete")
+    expires_in = _positive_int(response.get("expires_in"), "expires_in")
+    interval = max(_positive_int(response.get("interval", 5), "interval"), 1)
+
+    print(f"Open {verification_uri} and enter code {user_code}.", file=sys.stderr)
+    if open_browser:
+        webbrowser.open(str(verification_complete or verification_uri), new=2)
+
+    deadline = time.monotonic() + min(expires_in, max(int(timeout), 1) * 20)
+    while time.monotonic() < deadline:
+        sleeper(interval)
+        try:
+            token_response = issuer_client.post_form(
+                token_endpoint,
+                {
+                    "grant_type": "urn:ietf:params:oauth:grant-type:device_code",
+                    "device_code": device_code,
+                    "client_id": context.client_id,
+                },
+                sensitive_values=(device_code,),
+            )
+            token_document = _object(token_response.json(), "token response")
+        except ApiError as error:
+            if error.status != 400 or not isinstance(error.details, dict):
+                raise
+            token_document = error.details
+        error = token_document.get("error")
+        if error == "authorization_pending":
+            continue
+        if error == "slow_down":
+            interval += 5
+            continue
+        if error:
+            raise CliError("Device authorization was not completed.", ExitCode.AUTHENTICATION, str(error))
+        access_token = _required(token_document, "access_token")
+        token_expires = _positive_int(token_document.get("expires_in"), "expires_in")
+        stored = store.save_token(context.name, access_token, token_expires)
+        scope = token_document.get("scope") if isinstance(token_document.get("scope"), str) else None
+        return LoginResult(stored, scope)
+    raise CliError("Device authorization expired before completion.", ExitCode.AUTHENTICATION, "device-authorization-expired")
+
+
+def _object(value: Any, name: str) -> dict[str, Any]:
+    if not isinstance(value, dict):
+        raise CliError(f"The {name} is invalid.", ExitCode.AUTHENTICATION, "invalid-auth-response")
+    return value
+
+
+def _required(value: dict[str, Any], key: str) -> str:
+    item = value.get(key)
+    if not isinstance(item, str) or not item:
+        raise CliError("The authorization server response is incomplete.", ExitCode.AUTHENTICATION, "invalid-auth-response")
+    return item
+
+
+def _positive_int(value: Any, key: str) -> int:
+    if not isinstance(value, int) or isinstance(value, bool) or value <= 0:
+        raise CliError(f"The authorization server returned an invalid {key}.", ExitCode.AUTHENTICATION, "invalid-auth-response")
+    return value
+
+
+def _https_endpoint(value: Any, key: str) -> str:
+    from urllib.parse import urlsplit
+
+    endpoint = value if isinstance(value, str) else ""
+    parsed = urlsplit(endpoint)
+    local_http = parsed.scheme == "http" and parsed.hostname in {"localhost", "127.0.0.1", "::1"}
+    if not endpoint or (parsed.scheme != "https" and not local_http) or parsed.username or parsed.password:
+        raise CliError(f"Discovery returned an unsafe {key}.", ExitCode.AUTHENTICATION, "unsafe-auth-endpoint")
+    return endpoint
+
+
+def _b64json(value: dict[str, Any]) -> str:
+    return _b64(json.dumps(value, separators=(",", ":"), sort_keys=True).encode("utf-8"))
+
+
+def _b64(value: bytes) -> str:
+    return base64.urlsafe_b64encode(value).rstrip(b"=").decode("ascii")