24490d5ddb
Closes the audit's High-severity CLI coverage gap, raising the count
from ~25 to ~40+ subcommands and bringing the integration test count
from 63 to 73.
- pic triggers {ls, rm, create-kv, create-cron, create-dead-letter,
create-from-json}: three per-kind wrappers cover the most common
trigger shapes; the generic create-from-json is the escape hatch
for docs/files/pubsub/email/queue and any future advanced retry
knobs — body JSON inline, via @<file>, or "-" for stdin.
- pic dead-letters {ls, show, replay, resolve}: full operator
workflow for the dispatcher's dead_letters rows, including the
--unresolved filter and the per-row replay + manual-resolve actions.
- pic secrets {ls, set, rm}: list names + updated_at, set values
via stdin (the only secure channel — inline values would leak
into shell history), and delete by name. --json on set treats
stdin as raw JSON for non-string values.
Ten new integration tests follow the established #[ignore] pattern,
gated on DATABASE_URL. All 73 ignored tests pass against the local
dev stack.
The `pic admin reset-password` server-binary subcommand exists on
the picloud binary side already; the audit's "surface it in pic
--help" note is a one-line addition deferred to Stage 6 with the
other small UX touches.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
56 lines
1.8 KiB
Rust
56 lines
1.8 KiB
Rust
//! `pic secrets` subcommands: `ls`, `set`, `rm`.
|
|
//!
|
|
//! Set reads the secret value from stdin (the only safe channel —
|
|
//! inline values would leak into shell history). The value is sent
|
|
//! as a JSON string; pass `--json` to interpret stdin as raw JSON
|
|
//! (numbers, maps, …) instead.
|
|
|
|
use std::io::Read;
|
|
|
|
use anyhow::{anyhow, Context, Result};
|
|
|
|
use crate::client::Client;
|
|
use crate::config;
|
|
use crate::output::{OutputMode, Table};
|
|
|
|
pub async fn ls(app: &str, mode: OutputMode) -> Result<()> {
|
|
let creds = config::resolve()?;
|
|
let client = Client::from_creds(&creds)?;
|
|
let resp = client.secrets_list(app).await?;
|
|
let mut table = Table::new(["name", "updated_at"]);
|
|
for s in resp.secrets {
|
|
table.row([s.name, s.updated_at.to_rfc3339()]);
|
|
}
|
|
table.print(mode);
|
|
Ok(())
|
|
}
|
|
|
|
pub async fn set(app: &str, name: &str, as_json: bool) -> Result<()> {
|
|
let creds = config::resolve()?;
|
|
let client = Client::from_creds(&creds)?;
|
|
let mut buf = String::new();
|
|
std::io::stdin()
|
|
.read_to_string(&mut buf)
|
|
.context("read secret value from stdin")?;
|
|
let trimmed = buf.trim_end_matches(['\n', '\r']);
|
|
if trimmed.is_empty() {
|
|
return Err(anyhow!("empty stdin — secret value must not be empty"));
|
|
}
|
|
let value = if as_json {
|
|
serde_json::from_str(trimmed).map_err(|e| anyhow!("parse stdin as JSON: {e}"))?
|
|
} else {
|
|
serde_json::Value::String(trimmed.to_string())
|
|
};
|
|
client.secrets_set(app, name, value).await?;
|
|
println!("Set secret {name}");
|
|
Ok(())
|
|
}
|
|
|
|
pub async fn rm(app: &str, name: &str) -> Result<()> {
|
|
let creds = config::resolve()?;
|
|
let client = Client::from_creds(&creds)?;
|
|
client.secrets_delete(app, name).await?;
|
|
println!("Deleted secret {name}");
|
|
Ok(())
|
|
}
|