vgs-cli 1.35.0.dev1__py3-none-any.whl → 1.35.0.dev2__py3-none-any.whl

vgs_cli-1.35.0.dev2.data/data/vgscli/vgs-cli.yaml

@@ -0,0 +1,17 @@
+apiVersion: 1.0.0
+kind: ServiceAccount
+data:
+  name: vgs-cli
+  {%- if vaults | length == 0 %}
+      {{- cli_warn("Service Account won't have access to any tenants inside the organization. If it needs tenant access, use --tenant <TENANT_ID>.") or "" }}
+  {%- else %}
+  vaults:
+    {%- for vault_id in vaults %}
+    - {{ vault_id }}
+    {%- endfor %}
+  {%- endif %}
+  scopes:
+    - name: access-logs:read
+    - name: organizations:read
+    - name: routes:write
+    - name: vaults:write

{vgs_cli-1.35.0.dev1.dist-info → vgs_cli-1.35.0.dev2.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: vgs-cli
-Version: 1.35.0.dev1
+Version: 1.35.0.dev2
 Summary: VGS Client
 Home-page: https://github.com/verygoodsecurity/vgs-cli
 Author: Very Good Security
@@ -200,9 +200,16 @@ access. The CLI masks generated webhook secrets in its output.
 
 ### Service accounts
 
-Generate a service-account resource for exactly one tenant. Names must contain
-1–20 characters. Save the generated YAML so you can review it before applying
-it.
+Generate a service-account resource and save the YAML so you can review it
+before applying it. The general `vgs-cli` template accepts zero or more tenants;
+when no tenant is supplied, the generated account has no tenant access.
+
+```bash
+vgs generate service-account --template vgs-cli -T <TENANT_ID> > service-account.yaml
+```
+
+Payment-credential templates require exactly one tenant and a name containing
+1–20 characters:
 
 ```bash
 vgs generate service-account --template <TEMPLATE> -T <TENANT_ID> --var name=<NAME> > service-account.yaml
@@ -210,6 +217,7 @@ vgs generate service-account --template <TEMPLATE> -T <TENANT_ID> --var name=<NA
 
 | Template | Purpose |
 | --- | --- |
+| `vgs-cli` | Automate common CLI organization, tenant, route, and access-log operations. |
 | `public-credential-collect` | Collect payment credentials without read access. |
 | `read-credentials-no-pci` | Read tokenized credentials without PCI data. |
 | `read-credentials-with-pci` | Read credentials including PCI data. |

{vgs_cli-1.35.0.dev1.dist-info → vgs_cli-1.35.0.dev2.dist-info}/RECORD

@@ -1,23 +1,24 @@
-vgs_cli-1.35.0.dev1.data/data/vgscli/collect-form-api-schema.yaml,sha256=THuJbLUo7LOr0c1JUo3FPJEc9Jvde59K4JjdlkVF3hw,1246
-vgs_cli-1.35.0.dev1.data/data/vgscli/collect-form-schema.yaml,sha256=vHAN6_Gsg14CeSL41sHEQgboYF-CHF2RaNw72aJ3W8o,1337
-vgs_cli-1.35.0.dev1.data/data/vgscli/credentials-admin.yaml,sha256=acyLd54Cp7l2fpugfjVfYh07-MIE0BX-JVq4lHraE1s,869
-vgs_cli-1.35.0.dev1.data/data/vgscli/form-template.yaml,sha256=VblOlsDLfwZP6wR6nIIX1WSrUAt4leqfMdbXr3xYvWg,934
-vgs_cli-1.35.0.dev1.data/data/vgscli/http-route-template.yaml,sha256=vGHvBXA_6pwFtH1vVRWKiwxb4sahzuLvpqGAlavrStc,1085
-vgs_cli-1.35.0.dev1.data/data/vgscli/notification-integration-schema.yaml,sha256=1qHzS5ZxlhTdrDab6-qJhszwu7cpith2HleX3uAO_4E,1837
-vgs_cli-1.35.0.dev1.data/data/vgscli/notification-template.yaml,sha256=hr36msbrgiTjWligLHVDHMmO49QDzjTwBSLYoBw3WQE,1288
-vgs_cli-1.35.0.dev1.data/data/vgscli/public-credential-collect.yaml,sha256=CiorC-6TMx7M0TI8DHmoRSfVKDpOom2wIr_ilwmHQNA,696
-vgs_cli-1.35.0.dev1.data/data/vgscli/read-credentials-no-pci.yaml,sha256=_kWRne_ARh8v7A_jHG08gwgPG6NqZhrDRyq6L-ULs2M,769
-vgs_cli-1.35.0.dev1.data/data/vgscli/read-credentials-with-pci.yaml,sha256=jWXgFdcqZYisakAt9COM6cjf2-x_Q4eidDLaUh8CZOk,796
-vgs_cli-1.35.0.dev1.data/data/vgscli/service-account-schema.yaml,sha256=L1pjNXgnks15N1wNgf_1GmGcOvxn0nu49v7ersUjFno,1090
-vgs_cli-1.35.0.dev1.data/data/vgscli/sftp-route-template.yaml,sha256=zkT6lIVDgVyzLKgZ8QnyJJooy2egZk1cQthdjan_JrM,853
-vgs_cli-1.35.0.dev1.data/data/vgscli/tenant-schema.yaml,sha256=gBO7xVe2qXSymG0B_45hC11X5nm_jCCAH4Yjs-sbC8g,1457
-vgs_cli-1.35.0.dev1.data/data/vgscli/tenant-template.yaml,sha256=F0wIBkC2dFJUNeJet-FzPX3qrLMHcGIaJvhsDzzAOCc,765
-vgs_cli-1.35.0.dev1.data/data/vgscli/vault-resources.yaml,sha256=95CCxQher3MBQq96bvjZviNgo1rgv_NhCtI8X-oxIpA,26335
-vgs_cli-1.35.0.dev1.data/data/vgscli/vault-schema.yaml,sha256=a-wW7X8RyHr-669wtOZrlxlIfeQVtx8EUfA-3vpYytk,637
-vgs_cli-1.35.0.dev1.data/data/vgscli/vault-template.yaml,sha256=IlDisL3H5LXUDMkhUaouKMarRdu0-pJxpTz8ij_lp_M,383
-vgs_cli-1.35.0.dev1.dist-info/licenses/LICENSE,sha256=NwSyzgDYdzv6O2ns2C6UODGI8LN1VnVe_FPTnWS4eXY,1082
+vgs_cli-1.35.0.dev2.data/data/vgscli/collect-form-api-schema.yaml,sha256=THuJbLUo7LOr0c1JUo3FPJEc9Jvde59K4JjdlkVF3hw,1246
+vgs_cli-1.35.0.dev2.data/data/vgscli/collect-form-schema.yaml,sha256=vHAN6_Gsg14CeSL41sHEQgboYF-CHF2RaNw72aJ3W8o,1337
+vgs_cli-1.35.0.dev2.data/data/vgscli/credentials-admin.yaml,sha256=acyLd54Cp7l2fpugfjVfYh07-MIE0BX-JVq4lHraE1s,869
+vgs_cli-1.35.0.dev2.data/data/vgscli/form-template.yaml,sha256=VblOlsDLfwZP6wR6nIIX1WSrUAt4leqfMdbXr3xYvWg,934
+vgs_cli-1.35.0.dev2.data/data/vgscli/http-route-template.yaml,sha256=vGHvBXA_6pwFtH1vVRWKiwxb4sahzuLvpqGAlavrStc,1085
+vgs_cli-1.35.0.dev2.data/data/vgscli/notification-integration-schema.yaml,sha256=1qHzS5ZxlhTdrDab6-qJhszwu7cpith2HleX3uAO_4E,1837
+vgs_cli-1.35.0.dev2.data/data/vgscli/notification-template.yaml,sha256=hr36msbrgiTjWligLHVDHMmO49QDzjTwBSLYoBw3WQE,1288
+vgs_cli-1.35.0.dev2.data/data/vgscli/public-credential-collect.yaml,sha256=CiorC-6TMx7M0TI8DHmoRSfVKDpOom2wIr_ilwmHQNA,696
+vgs_cli-1.35.0.dev2.data/data/vgscli/read-credentials-no-pci.yaml,sha256=_kWRne_ARh8v7A_jHG08gwgPG6NqZhrDRyq6L-ULs2M,769
+vgs_cli-1.35.0.dev2.data/data/vgscli/read-credentials-with-pci.yaml,sha256=jWXgFdcqZYisakAt9COM6cjf2-x_Q4eidDLaUh8CZOk,796
+vgs_cli-1.35.0.dev2.data/data/vgscli/service-account-schema.yaml,sha256=L1pjNXgnks15N1wNgf_1GmGcOvxn0nu49v7ersUjFno,1090
+vgs_cli-1.35.0.dev2.data/data/vgscli/sftp-route-template.yaml,sha256=zkT6lIVDgVyzLKgZ8QnyJJooy2egZk1cQthdjan_JrM,853
+vgs_cli-1.35.0.dev2.data/data/vgscli/tenant-schema.yaml,sha256=gBO7xVe2qXSymG0B_45hC11X5nm_jCCAH4Yjs-sbC8g,1457
+vgs_cli-1.35.0.dev2.data/data/vgscli/tenant-template.yaml,sha256=F0wIBkC2dFJUNeJet-FzPX3qrLMHcGIaJvhsDzzAOCc,765
+vgs_cli-1.35.0.dev2.data/data/vgscli/vault-resources.yaml,sha256=95CCxQher3MBQq96bvjZviNgo1rgv_NhCtI8X-oxIpA,26335
+vgs_cli-1.35.0.dev2.data/data/vgscli/vault-schema.yaml,sha256=a-wW7X8RyHr-669wtOZrlxlIfeQVtx8EUfA-3vpYytk,637
+vgs_cli-1.35.0.dev2.data/data/vgscli/vault-template.yaml,sha256=IlDisL3H5LXUDMkhUaouKMarRdu0-pJxpTz8ij_lp_M,383
+vgs_cli-1.35.0.dev2.data/data/vgscli/vgs-cli.yaml,sha256=5gCjjloyepaKI6zZfDLeUEWxuRExI-dGJI9RO3omP2k,484
+vgs_cli-1.35.0.dev2.dist-info/licenses/LICENSE,sha256=NwSyzgDYdzv6O2ns2C6UODGI8LN1VnVe_FPTnWS4eXY,1082
 vgscli/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-vgscli/_version.py,sha256=bFXK_xwM7TssYFmK1azB6ulxDG5FLm6_AgpOeKBW0WA,1681
+vgscli/_version.py,sha256=0HHI66nZPGvwbIf40mXNC7yUBONlS3ZLuT9MVF9ALCM,1681
 vgscli/access_logs.py,sha256=G0GjlLjWiC-N6OzK6-RCvWddcVGQlLCLAcyO9pLWIOM,1928
 vgscli/audits_api.py,sha256=6FjpS1yTALio-DejgIS2eDw75ChjDp4GoAGXh4uZExU,3211
 vgscli/auth.py,sha256=vdUZ12nqtefIuSHNmwCFvxoqwS3m6ZP5TqLZFNwKnSU,2104
@@ -26,13 +27,13 @@ vgscli/auth_utils.py,sha256=aC1VI0dFdFeupLS9Okz4uDz-wHhhFabqiLUg2R5vO2s,600
 vgscli/callback_server.py,sha256=oFFF5AGbbwhF7Hsc5fzS7jeGFzIMbebc9Qdq8uEl1PY,1055
 vgscli/calm_api.py,sha256=5ZZhJUCuA2E5X670L-EkB_mL2kqHPrYy-ca6WtwTacg,1384
 vgscli/cert_manager_api.py,sha256=ek25BcyGeUo0pBoqineMTYMgmQaYJfimFFHMljZh5yA,1646
-vgscli/cli_progress.py,sha256=l_JR6pdpdk8KzZIcGudfdleZy2CVyy_HdEnsEHsKFHQ,3105
+vgscli/cli_progress.py,sha256=Kpc7iZo0zO6YX3WynteBELuWSYGVvqEjKLq2E5x4lnE,2520
 vgscli/cli_utils.py,sha256=NzXK29_yIDrB-3T_XdLLB8NCWneQ-cpZFi9mazQL9tQ,3810
-vgscli/click_extensions.py,sha256=oyKTo8Al7j0ay0dmxyrX-ZLDzbbGNLZ41tRZaEj5Rkk,7272
+vgscli/click_extensions.py,sha256=m-RpaPaH69m4caYbuiu0j2blxeyy8c8hA0Tvygw1Mvc,7271
 vgscli/collect_forms.py,sha256=HAg-tvpXxmVq5Zns4v8G0cP-tgYKuWmVFwzuNjieu-A,4619
 vgscli/collect_forms_api.py,sha256=JHnnsOUyStD7yR92LfGqn8DOpnu0l0yqTUMQnWE_NGs,1246
 vgscli/config_file.py,sha256=HB8lANU0qoO09Wnkf-QDzPh2qtrnFcqcetnCaQgtQ3U,1543
-vgscli/errors.py,sha256=Jh2Lmog6kjXjbwEeAshiYZzmBzbMUqlzofHglN_xM1M,11322
+vgscli/errors.py,sha256=9iWS8v6Zq9A3Iqt3G1-NJQEwT4d8DI_JoU7fdiqHg00,11946
 vgscli/file_token_util.py,sha256=537b54paMGw0u5PL5VJgQqQ7awKa9lQP88n3tUc_lyw,771
 vgscli/id_generator.py,sha256=3CbvSOUSyLON76p6M8wUhVQVig8j75_rnWdpxLhBifM,1510
 vgscli/keyring_token_util.py,sha256=cnR72-0AInzujUsIwHoXwPbgprbkllgAXN-AAI3qsPM,4632
@@ -40,7 +41,7 @@ vgscli/notifications.py,sha256=6D8HFDEl3X4V0V9fYZT-9nWYe2KYVahfhRLMF0pbh4I,6252
 vgscli/notifications_api.py,sha256=1EXmRb2fOJrU1QOAZ6gmq8yMjBLhNZGSVs3kRtD2Dfw,2342
 vgscli/payment_accounts_api.py,sha256=wF6K3m7nlKtPmqO9RCpmGFSXYHWtwfhXqNfgI1IGqFI,1665
 vgscli/tenant_configuration.py,sha256=iC33f2lBHDEL4oHPvdlWp_w--u2x_nWOb86jTHumDLg,5881
-vgscli/tenant_creation.py,sha256=MJ5mLCirX4fcZVrCq-YwQmtk3yoxn6TxjxTGFSVWOf4,21768
+vgscli/tenant_creation.py,sha256=9O1i4JsHuEIQt_QkcWYEcenLi8kGJBivcln6LkoHl7U,22230
 vgscli/tenant_provisioning_api.py,sha256=-mQcSECgWG23LKczu1B9J1d7Bb6ZA6lkpr9RegJiiLg,1203
 vgscli/testing.py,sha256=MLrsvy3mEwvjtqyuG0UjwEX-rDkbWUo52aXvu2H2sTk,1437
 vgscli/text.py,sha256=c2d1As7awq8PlEF9NiI6JrjsYYousj9YT0o1xOQ2MQM,172
@@ -48,10 +49,10 @@ vgscli/token_handler.py,sha256=MvtmlicqnGrcopNkTr8Q2RlKE7IDj_sJFxF_39Jd7W8,183
 vgscli/vgs.py,sha256=BiQuHeOuH25zbTdwNOsW_O69YuKsZFTYA2jr9JFRZng,6262
 vgscli/cli/__init__.py,sha256=112ej_l1olouWMRIM8H4-s5C4qiG8-u6RziWT102wNk,2765
 vgscli/cli/commands/__init__.py,sha256=8ptc9-Vzdx0HU3ZeMcKERYjmJyuB5IMjBSF3Igx5yQ4,206
-vgscli/cli/commands/apply.py,sha256=ospWMXXXca8L7RrcP1-XhIINLdGs1t_c3-yLYsUKM7A,26784
+vgscli/cli/commands/apply.py,sha256=jLSllU1Hz8WX3ARL-lU8BtDv72bMzP3fXs0vGDtyoWc,26312
 vgscli/cli/commands/certificate.py,sha256=xQV-G8ZWP9uPFqrczlCpCZkHUt2aJflBP2cc5hjobIw,22930
 vgscli/cli/commands/delete.py,sha256=2nuYKhp0FhoGTcmJUECjRnlYrKLdAgIoIp-y25ViwDg,3873
-vgscli/cli/commands/generate.py,sha256=k6LEiBmvT_cg7SbEvwN39ehMX6I8RlP0gSKgcEL4i4k,5425
+vgscli/cli/commands/generate.py,sha256=cVrU54_o3szgyi7tbMQtMAemx-37xYcFKrAcLcyMglw,5448
 vgscli/cli/commands/get.py,sha256=Xm8bN11vOjnDA3o_uuAkBXM2wtJQZDrTdQY1ykug4LE,11315
 vgscli/cli/types/__init__.py,sha256=a-P-SoGHpLzMg7CL1hhg5x_nf6sHq0qAuGm_AtIITmw,107
 vgscli/cli/types/resource_id.py,sha256=7JILR-KjoVGQDHB40tXJfTcU53iR8wM9Zr24fY5le3o,1172
@@ -66,6 +67,7 @@ vgscli/resource-templates/service-account/credentials-admin.yaml,sha256=acyLd54C
 vgscli/resource-templates/service-account/public-credential-collect.yaml,sha256=CiorC-6TMx7M0TI8DHmoRSfVKDpOom2wIr_ilwmHQNA,696
 vgscli/resource-templates/service-account/read-credentials-no-pci.yaml,sha256=_kWRne_ARh8v7A_jHG08gwgPG6NqZhrDRyq6L-ULs2M,769
 vgscli/resource-templates/service-account/read-credentials-with-pci.yaml,sha256=jWXgFdcqZYisakAt9COM6cjf2-x_Q4eidDLaUh8CZOk,796
+vgscli/resource-templates/service-account/vgs-cli.yaml,sha256=5gCjjloyepaKI6zZfDLeUEWxuRExI-dGJI9RO3omP2k,484
 vgscli/validation-schemas/collect-form-api-schema.yaml,sha256=THuJbLUo7LOr0c1JUo3FPJEc9Jvde59K4JjdlkVF3hw,1246
 vgscli/validation-schemas/collect-form-schema.yaml,sha256=vHAN6_Gsg14CeSL41sHEQgboYF-CHF2RaNw72aJ3W8o,1337
 vgscli/validation-schemas/notification-integration-schema.yaml,sha256=1qHzS5ZxlhTdrDab6-qJhszwu7cpith2HleX3uAO_4E,1837
@@ -73,8 +75,8 @@ vgscli/validation-schemas/service-account-schema.yaml,sha256=L1pjNXgnks15N1wNgf_
 vgscli/validation-schemas/tenant-schema.yaml,sha256=gBO7xVe2qXSymG0B_45hC11X5nm_jCCAH4Yjs-sbC8g,1457
 vgscli/validation-schemas/vault-resources.yaml,sha256=95CCxQher3MBQq96bvjZviNgo1rgv_NhCtI8X-oxIpA,26335
 vgscli/validation-schemas/vault-schema.yaml,sha256=a-wW7X8RyHr-669wtOZrlxlIfeQVtx8EUfA-3vpYytk,637
-vgs_cli-1.35.0.dev1.dist-info/METADATA,sha256=VGBQ3d3gv-GXDP3G8IotQeDfo-AJh_tBzZzn-PBstYo,8630
-vgs_cli-1.35.0.dev1.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
-vgs_cli-1.35.0.dev1.dist-info/entry_points.txt,sha256=wCWhRQiMX4Ja6kkqJlYr8LbuiywpmXyyRAZPsau-_RY,39
-vgs_cli-1.35.0.dev1.dist-info/top_level.txt,sha256=gabTxCWMkl80q6ha_m-hs_1wQMfGntZcv5DEmkl8JEw,7
-vgs_cli-1.35.0.dev1.dist-info/RECORD,,
+vgs_cli-1.35.0.dev2.dist-info/METADATA,sha256=BgcCMIQRMIizLbofbdWzRQKrwq0V5iYsEfO_n22u24U,8984
+vgs_cli-1.35.0.dev2.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+vgs_cli-1.35.0.dev2.dist-info/entry_points.txt,sha256=wCWhRQiMX4Ja6kkqJlYr8LbuiywpmXyyRAZPsau-_RY,39
+vgs_cli-1.35.0.dev2.dist-info/top_level.txt,sha256=gabTxCWMkl80q6ha_m-hs_1wQMfGntZcv5DEmkl8JEw,7
+vgs_cli-1.35.0.dev2.dist-info/RECORD,,

vgscli/_version.py

@@ -6,7 +6,7 @@ from packaging.version import InvalidVersion, Version
 
 from vgscli.text import bold, green
 
-__version__ = "1.35.0.dev1"
+__version__ = "1.35.0.dev2"
 
 
 # noinspection PyBroadException

vgscli/cli/commands/apply.py

@@ -62,26 +62,12 @@ from vgscli.tenant_creation import (
     TenantCreationStageError,
     TenantCreationState,
     TenantCreator,
+    archive_state,
     default_state_path,
 )
 
 logger = logging.getLogger()
 
-TENANT_PROGRESS_LABELS = {
-    "environment": "Resolving environment",
-    "tenant": "Creating tenant",
-    "provisioning": "Waiting for provisioning",
-    "merchant": "Configuring merchant",
-    "account": "Creating payment account",
-    "account_configurations": "Applying account configurations",
-    "collect_form": "Creating default Collect Form",
-}
-
-TENANT_OPERATION_CHOICES = {
-    "1": "resume",
-    "2": "cancel",
-}
-
 
 def _route_error_message(error: exceptions.ClientError) -> str:
     try:
@@ -351,37 +337,20 @@ def _resolve_tenant_organization(data, org_id: Optional[ResourceId]) -> None:
         data["organizationId"] = org_id.base58
 
 
-def _is_interactive_terminal() -> bool:
-    return click.get_text_stream("stdin").isatty()
-
-
-def _choose_existing_tenant_operation(state: TenantCreationState) -> str:
-    if state.status == "complete":
-        raise click.UsageError(
-            "A tenant was already created from this configuration. To create "
-            "another tenant, update the file to use a unique tenant name."
+def _echo_tenant_creation_state(state, state_path) -> None:
+    click.echo(
+        dump_camelized_yaml(
+            {
+                "apiVersion": "1.0.0",
+                "kind": "Tenant",
+                "data": state.output(state_path),
+            }
         )
+    )
 
-    if not _is_interactive_terminal():
-        raise click.UsageError(
-            "A tenant creation already exists for this configuration. Run the "
-            "command in an interactive terminal to resume it or cancel."
-        )
 
-    click.echo(
-        f'An incomplete tenant creation exists for "{state.spec["name"]}".', err=True
-    )
-    click.echo("What would you like to do?", err=True)
-    click.echo("  [1] Resume the existing creation", err=True)
-    click.echo("  [2] Cancel", err=True)
-    choice = click.prompt(
-        "Choice",
-        type=click.Choice(tuple(TENANT_OPERATION_CHOICES)),
-        default="1",
-        show_choices=False,
-        err=True,
-    )
-    return TENANT_OPERATION_CHOICES[choice]
+def _tenant_progress_message(action: str, name: str) -> str:
+    return f'{action} "{name}"'
 
 
 def _apply_tenant_data(
@@ -393,7 +362,7 @@ def _apply_tenant_data(
         "organizationId": data["organizationId"],
     }
     progress = (
-        Spinner("Applying tenant", detail="Creating tenant")
+        Spinner(_tenant_progress_message("Creating tenant", data["name"]))
         if show_progress
         else nullcontext()
     )
@@ -429,12 +398,15 @@ def _apply_tenant_data(
             "password": attributes["credentials"]["secret"],
         }
 
+        if show_progress:
+            progress.update(
+                _tenant_progress_message("Configuring tenant", data["name"])
+            )
+
         vault_mgmt = create_vault_mgmt_api(
             ctx, response.body["data"]["links"]["vault_management_api"]
         )
 
-        if show_progress:
-            progress.update("Waiting for provisioning")
         while True:
             # noinspection PyUnresolvedReferences
             response = vault_mgmt.vaults.retrieve(
@@ -511,6 +483,7 @@ def apply_tenant(
     if resume is not None and state_file is not None:
         raise click.UsageError("--state-file cannot be used with --resume.")
 
+    completed_state = None
     if resume is not None:
         state = TenantCreationState.load(resume)
         resolved_state_file = resume
@@ -536,17 +509,27 @@ def apply_tenant(
                 raise click.UsageError(
                     "The existing tenant creation state does not match this configuration."
                 )
-            operation = _choose_existing_tenant_operation(existing_state)
-            if operation == "cancel":
-                raise click.Abort()
-            if operation == "resume":
+            if existing_state.status == "complete":
+                completed_state = existing_state
+            else:
                 state = existing_state
                 is_resuming = True
 
     try:
-        action = "Resuming tenant" if is_resuming else "Applying tenant"
-        with Spinner(action, detail="Preparing") as progress:
-            account_mgmt = create_account_mgmt_api(ctx)
+        account_mgmt = create_account_mgmt_api(ctx)
+        existing_tenant_name = None
+        configuring_message = _tenant_progress_message(
+            "Configuring tenant", state.spec["name"]
+        )
+        creating_message = _tenant_progress_message(
+            "Creating tenant", state.spec["name"]
+        )
+        initial_message = (
+            configuring_message
+            if completed_state is not None or state.tenant_resource_id
+            else creating_message
+        )
+        with Spinner(initial_message) as progress:
             creator = TenantCreator(
                 account_mgmt=account_mgmt,
                 provisioning_api=create_tenant_provisioning_api(ctx),
@@ -554,37 +537,39 @@ def apply_tenant(
                 calm_api_factory=partial(create_calm_api, ctx),
                 collect_forms_api_factory=partial(create_collect_forms_api, ctx),
                 platform_environment=ctx.obj.env,
-                on_stage=lambda stage: progress.update(TENANT_PROGRESS_LABELS[stage]),
+                on_stage=lambda stage: progress.update(
+                    creating_message
+                    if stage in {"environment", "tenant"}
+                    and not state.tenant_resource_id
+                    else configuring_message
+                ),
             )
 
-            if is_resuming:
-                progress.update("Verifying resume state")
-                creator.verify_resume_state(state)
+            if completed_state is not None:
+                tenant_exists = creator.tenant_exists(completed_state)
+                if tenant_exists:
+                    existing_tenant_name = completed_state.spec["name"]
+                else:
+                    archive_state(resolved_state_file)
+
+            if existing_tenant_name is None:
+                if is_resuming:
+                    creator.verify_resume_state(state)
 
-            creator.run(state, resolved_state_file)
+                creator.run(state, resolved_state_file)
     except TenantCreationStageError as error:
-        click.echo(
-            dump_camelized_yaml(
-                {
-                    "apiVersion": "1.0.0",
-                    "kind": "Tenant",
-                    "data": error.state.output(error.state_path),
-                }
-            )
-        )
+        _echo_tenant_creation_state(error.state, error.state_path)
         raise TenantCreationError(
             error.stage, error.state_path, error.cause, ctx=ctx
         ) from None
 
-    click.echo(
-        dump_camelized_yaml(
-            {
-                "apiVersion": "1.0.0",
-                "kind": "Tenant",
-                "data": state.output(resolved_state_file),
-            }
+    if existing_tenant_name is not None:
+        click.echo(
+            f'Tenant "{existing_tenant_name}" already exists. No changes were made.'
         )
-    )
+        return
+
+    _echo_tenant_creation_state(state, resolved_state_file)
 
 
 @apply.command(

vgscli/cli/commands/generate.py

@@ -151,6 +151,7 @@ def generate_mft_route():
     "-t",
     type=click.Choice(
         [
+            "vgs-cli",
             "public-credential-collect",
             "read-credentials-no-pci",
             "read-credentials-with-pci",

vgscli/cli_progress.py

@@ -2,8 +2,6 @@
 
 import itertools
 import threading
-import time
-from collections.abc import Callable
 from typing import Optional, TextIO
 
 import click
@@ -19,19 +17,14 @@ class Spinner:
         self,
         message: str,
         *,
-        detail: Optional[str] = None,
         stream: Optional[TextIO] = None,
         interval: float = 0.1,
-        monotonic: Callable[[], float] = time.monotonic,
     ) -> None:
         self.message = message
-        self.detail = detail
         self.stream = stream or click.get_text_stream("stderr")
         self.interval = interval
-        self.monotonic = monotonic
         self._stop = threading.Event()
         self._thread: Optional[threading.Thread] = None
-        self._started_at = self.monotonic()
         self._max_width = 0
         try:
             self._enabled = self.stream.isatty()
@@ -39,7 +32,6 @@ class Spinner:
             self._enabled = False
         self._unicode = self._enabled and self._supports_unicode()
         self._frames = self.UNICODE_FRAMES if self._unicode else self.ASCII_FRAMES
-        self._separator = " · " if self._unicode else " - "
 
     def __enter__(self):
         if self._enabled:
@@ -66,17 +58,11 @@ class Spinner:
     def _clear(self) -> None:
         self._write(f"\r{' ' * self._max_width}\r")
 
-    def update(self, detail: str) -> None:
-        self.detail = detail
+    def update(self, message: str) -> None:
+        self.message = message
 
     def _line(self, frame: str) -> str:
-        parts = [self.message]
-        if self.detail:
-            parts.append(self.detail)
-        elapsed = max(0, int(self.monotonic() - self._started_at))
-        minutes, seconds = divmod(elapsed, 60)
-        parts.append(f"{minutes:02d}:{seconds:02d}")
-        return f"{frame} {self._separator.join(parts)}"
+        return f"{frame} {self.message}"
 
     def _supports_unicode(self) -> bool:
         encoding = getattr(self.stream, "encoding", None)

vgscli/click_extensions.py

@@ -121,7 +121,7 @@ def tenant_selection_option(command):
         "tenants",
         type=click.STRING,
         multiple=True,
-        help="Tenant the Service Account may access. Built-in templates require exactly one.",
+        help="Tenant the Service Account may access. Payment templates require exactly one.",
     )(wrapper)
     return click.option(
         "--vault",

vgscli/errors.py

@@ -182,10 +182,25 @@ class TenantCreationError(VgsCliError):
 
         message = f"Tenant creation stopped during {stage}."
         if details:
-            message = f"{message} {', '.join(details)}"
+            detail_message = ", ".join(details)
+            if not detail_message.endswith((".", "!", "?")):
+                detail_message = f"{detail_message}."
+            message = f"{message} {detail_message}"
+
+        if stage == "account" and any(
+            "account already exists" in detail.casefold() for detail in details or []
+        ):
+            self.message = (
+                f"{message} A payment account already uses this tenant name. "
+                "To create a separate tenant, change the tenant name. "
+                "To recover this tenant, contact VGS Support."
+            )
+            self.ctx = ctx
+            return
+
         self.message = (
-            f"{message} Run the same `vgs apply tenant --file` command again "
-            "to resume it."
+            f"{message} Run the same `vgs apply tenant --file` command again; "
+            "the CLI will continue automatically."
         )
         self.ctx = ctx
 

vgscli/resource-templates/service-account/vgs-cli.yaml

@@ -0,0 +1,17 @@
+apiVersion: 1.0.0
+kind: ServiceAccount
+data:
+  name: vgs-cli
+  {%- if vaults | length == 0 %}
+      {{- cli_warn("Service Account won't have access to any tenants inside the organization. If it needs tenant access, use --tenant <TENANT_ID>.") or "" }}
+  {%- else %}
+  vaults:
+    {%- for vault_id in vaults %}
+    - {{ vault_id }}
+    {%- endfor %}
+  {%- endif %}
+  scopes:
+    - name: access-logs:read
+    - name: organizations:read
+    - name: routes:write
+    - name: vaults:write

vgscli/tenant_creation.py

@@ -172,6 +172,19 @@ def default_state_path(request_digest):
     return Path(APP_DIR) / "tenant-operations" / f"{request_digest}.json"
 
 
+def archive_state(path):
+    state_path = Path(path)
+    archive_directory = state_path.parent / "archive"
+    archive_directory.mkdir(mode=0o700, parents=True, exist_ok=True)
+    os.chmod(archive_directory, 0o700)
+    archive_path = archive_directory / (
+        f"{state_path.stem}-{uuid.uuid4().hex}{state_path.suffix}"
+    )
+    os.replace(state_path, archive_path)
+    os.chmod(archive_path, 0o600)
+    return archive_path
+
+
 class TenantCreator:
     def __init__(
         self,
@@ -230,20 +243,20 @@ class TenantCreator:
         state.save(state_path)
         return state
 
-    def verify_resume_state(self, state):
+    def tenant_exists(self, state):
         if not state.tenant_resource_id:
-            return
+            return False
         response = self.provisioning.organization_tenants(state.spec["organizationId"])
-        tenant = next(
-            (
-                item
-                for item in _resources(response)
-                if item.get("id") == state.tenant_resource_id
-                and item.get("attributes", {}).get("identifier") == state.tenant_id
-            ),
-            None,
+        return any(
+            item.get("id") == state.tenant_resource_id
+            and item.get("attributes", {}).get("identifier") == state.tenant_id
+            for item in _resources(response)
         )
-        if tenant is None:
+
+    def verify_resume_state(self, state):
+        if not state.tenant_resource_id:
+            return
+        if not self.tenant_exists(state):
             raise click.UsageError(
                 "The tenant in the resume state is no longer available in the organization."
             )