feat(cli): real auth, delete commands, api-keys, JSON output, env override
Address the review findings on the CLI surface: * `pic login` now prompts for username + password and POSTs to `/api/v1/admin/auth/login`. `--token` (and `PICLOUD_TOKEN`) still works for paste-a-bearer flows (CI, long-lived API keys). Falls back to a plain stdin read when no controlling tty is attached. * `pic logout` revokes the session server-side and deletes the local credentials file. Idempotent. * `PICLOUD_URL` / `PICLOUD_TOKEN` now override the on-disk credentials file for every command via `config::resolve`, not just for `pic login`. Matches gcloud/aws/kubectl semantics. * New commands: `pic apps delete [--force]`, `pic apps show`, `pic scripts delete`, `pic api-keys mint|ls|rm`, plus top-level `pic invoke` / `pic deploy` shortcuts. * `pic scripts ls` (no `--app`) now issues a single `GET /admin/scripts` + one `apps_list` in parallel and joins client-side, instead of walking N+1 per-app calls that aborted on the first 404 — the bug the test suite was retrying around. * Global `--output tsv|json` flag wired through every list/show and through `whoami` / `logs`. TSV stays pipe-friendly; JSON is a real array of objects (or a flat object for single-row views). * `whoami` and `logs` now emit labeled output instead of headerless tab lines, consistent with the existing `apps ls` / `scripts ls`. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
MechaCat02
201
crates/picloud-cli/src/cmds/api_keys.rs
Normal file
201
crates/picloud-cli/src/cmds/api_keys.rs
Normal file
@@ -0,0 +1,201 @@
|
||||
//! `pic api-keys` — long-lived bearer-key management.
|
||||
//!
|
||||
//! Server semantics (mirrored from `manager-core/src/api_keys_api.rs`):
|
||||
//! * `raw_token` is returned **once** on mint and never again.
|
||||
//! * `app_id` (optional `--app`) binds the key to one app; instance
|
||||
//! scopes (`instance:*`) are rejected when `--app` is also set.
|
||||
//! * `scopes` is a `text[]` in the wire form (`script:read`, …).
|
||||
|
||||
use anyhow::{anyhow, Result};
|
||||
use chrono::{DateTime, Utc};
|
||||
use picloud_shared::Scope;
|
||||
|
||||
use crate::client::{Client, MintApiKeyBody};
|
||||
use crate::config;
|
||||
use crate::output::{KvBlock, OutputMode, Table};
|
||||
|
||||
pub async fn mint(
|
||||
name: &str,
|
||||
scope_strs: &[String],
|
||||
app_ident: Option<&str>,
|
||||
expires: Option<&str>,
|
||||
mode: OutputMode,
|
||||
) -> Result<()> {
|
||||
let creds = config::resolve()?;
|
||||
let client = Client::from_creds(&creds)?;
|
||||
|
||||
let scopes = parse_scopes(scope_strs)?;
|
||||
let expires_at = expires.map(parse_expires).transpose()?;
|
||||
let app_id = match app_ident {
|
||||
Some(ident) => Some(client.apps_get(ident).await?.app.id),
|
||||
None => None,
|
||||
};
|
||||
|
||||
let body = MintApiKeyBody {
|
||||
name,
|
||||
scopes: &scopes,
|
||||
app_id,
|
||||
expires_at,
|
||||
};
|
||||
let resp = client.apikeys_mint(&body).await?;
|
||||
|
||||
let mut block = KvBlock::new();
|
||||
block
|
||||
.field("id", resp.key.id.to_string())
|
||||
.field("name", resp.key.name.clone())
|
||||
.field("prefix", resp.key.prefix.clone())
|
||||
.field(
|
||||
"scopes",
|
||||
resp.key
|
||||
.scopes
|
||||
.iter()
|
||||
.map(|s| s.as_str())
|
||||
.collect::<Vec<_>>()
|
||||
.join(","),
|
||||
)
|
||||
.field(
|
||||
"app_id",
|
||||
resp.key
|
||||
.app_id
|
||||
.map(|a| a.to_string())
|
||||
.unwrap_or_else(|| "-".into()),
|
||||
)
|
||||
.field(
|
||||
"expires_at",
|
||||
resp.key
|
||||
.expires_at
|
||||
.map(|t| t.to_rfc3339())
|
||||
.unwrap_or_else(|| "-".into()),
|
||||
)
|
||||
.field("token", resp.raw_token.clone());
|
||||
block.print(mode);
|
||||
if matches!(mode, OutputMode::Tsv) {
|
||||
// The token row is human-easy-to-miss in a wall of metadata;
|
||||
// call it out exactly once on the human path. Skip on JSON
|
||||
// since machine consumers don't need the nudge.
|
||||
eprintln!("Save this token — it will not be shown again.");
|
||||
}
|
||||
Ok(())
|
||||
}
|
||||
|
||||
pub async fn ls(mode: OutputMode) -> Result<()> {
|
||||
let creds = config::resolve()?;
|
||||
let client = Client::from_creds(&creds)?;
|
||||
let keys = client.apikeys_list().await?;
|
||||
let mut table = Table::new([
|
||||
"id",
|
||||
"name",
|
||||
"prefix",
|
||||
"scopes",
|
||||
"app_id",
|
||||
"expires_at",
|
||||
"last_used_at",
|
||||
"created_at",
|
||||
]);
|
||||
for k in keys {
|
||||
table.row([
|
||||
k.id.to_string(),
|
||||
k.name,
|
||||
k.prefix,
|
||||
k.scopes
|
||||
.iter()
|
||||
.map(|s| s.as_str())
|
||||
.collect::<Vec<_>>()
|
||||
.join(","),
|
||||
k.app_id
|
||||
.map(|a| a.to_string())
|
||||
.unwrap_or_else(|| "-".into()),
|
||||
k.expires_at
|
||||
.map(|t| t.to_rfc3339())
|
||||
.unwrap_or_else(|| "-".into()),
|
||||
k.last_used_at
|
||||
.map(|t| t.to_rfc3339())
|
||||
.unwrap_or_else(|| "-".into()),
|
||||
k.created_at.to_rfc3339(),
|
||||
]);
|
||||
}
|
||||
table.print(mode);
|
||||
Ok(())
|
||||
}
|
||||
|
||||
pub async fn rm(id: &str) -> Result<()> {
|
||||
let creds = config::resolve()?;
|
||||
let client = Client::from_creds(&creds)?;
|
||||
client.apikeys_delete(id).await?;
|
||||
println!("Revoked api-key {id}");
|
||||
Ok(())
|
||||
}
|
||||
|
||||
fn parse_scopes(raw: &[String]) -> Result<Vec<Scope>> {
|
||||
if raw.is_empty() {
|
||||
return Err(anyhow!(
|
||||
"at least one `--scope` is required (e.g. --scope script:read)"
|
||||
));
|
||||
}
|
||||
raw.iter()
|
||||
.map(|s| Scope::from_wire(s).ok_or_else(|| anyhow!("unknown scope: {s}")))
|
||||
.collect()
|
||||
}
|
||||
|
||||
/// `--expires` accepts either RFC 3339 (`2026-12-31T23:59:59Z`) or a
|
||||
/// shorthand `<N>d` / `<N>h` / `<N>m` (days / hours / minutes from now).
|
||||
/// Shorthand wins for the common "key good for 30 days" case; full
|
||||
/// RFC 3339 keeps the door open for precise cutoffs.
|
||||
fn parse_expires(raw: &str) -> Result<DateTime<Utc>> {
|
||||
if let Some(spec) = raw.strip_suffix('d') {
|
||||
let days: i64 = spec.parse().map_err(|_| anyhow!("bad days: {raw}"))?;
|
||||
return Ok(Utc::now() + chrono::Duration::days(days));
|
||||
}
|
||||
if let Some(spec) = raw.strip_suffix('h') {
|
||||
let hours: i64 = spec.parse().map_err(|_| anyhow!("bad hours: {raw}"))?;
|
||||
return Ok(Utc::now() + chrono::Duration::hours(hours));
|
||||
}
|
||||
if let Some(spec) = raw.strip_suffix('m') {
|
||||
let mins: i64 = spec.parse().map_err(|_| anyhow!("bad minutes: {raw}"))?;
|
||||
return Ok(Utc::now() + chrono::Duration::minutes(mins));
|
||||
}
|
||||
DateTime::parse_from_rfc3339(raw)
|
||||
.map(|d| d.with_timezone(&Utc))
|
||||
.map_err(|e| anyhow!("expected RFC 3339 or `<N>d/h/m`, got {raw:?}: {e}"))
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
|
||||
#[test]
|
||||
fn parse_scopes_accepts_wire_form() {
|
||||
let scopes = parse_scopes(&["script:read".into(), "log:read".into()]).unwrap();
|
||||
assert_eq!(scopes, vec![Scope::ScriptRead, Scope::LogRead]);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn parse_scopes_rejects_empty() {
|
||||
let err = parse_scopes(&[]).unwrap_err();
|
||||
assert!(format!("{err}").contains("at least one"));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn parse_scopes_rejects_unknown() {
|
||||
let err = parse_scopes(&["script:nope".into()]).unwrap_err();
|
||||
assert!(format!("{err}").contains("unknown scope"));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn parse_expires_days_shorthand() {
|
||||
let d = parse_expires("7d").unwrap();
|
||||
let diff = (d - Utc::now()).num_days();
|
||||
assert!((6..=7).contains(&diff), "got {diff}");
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn parse_expires_rfc3339_passes_through() {
|
||||
let d = parse_expires("2030-01-01T00:00:00Z").unwrap();
|
||||
assert_eq!(d.timestamp(), 1893456000);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn parse_expires_garbage_errors() {
|
||||
assert!(parse_expires("tomorrow").is_err());
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user