turnout 0.7.0

A developer's switchyard: point local apps at any backend stand, keep servers and secrets at hand, build and deploy from any directory
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183

use std::io::Read;

use anyhow::{Context, Result, bail};
use dialoguer::{Input, Password};

use crate::cli::PassCommand;
use crate::model::Credential;
use crate::{pick, secrets, store};

pub fn run(command: PassCommand) -> Result<()> {
    match command {
        PassCommand::Set { server, kind, login } => set(server, &kind, login),
        PassCommand::Copy { server, kind, login, show } => copy(server, kind, login, show),
        PassCommand::Show { server } => show(server),
        PassCommand::List => list(),
        PassCommand::Remove { server, kind, assume_yes } => remove(server, kind, assume_yes),
    }
}

/// Resolve the (server, kind) pair a command works on. A given server narrows
/// the choice to its own kinds; with neither argument the picker lists
/// everything stored.
fn resolve(server: Option<String>, kind: Option<String>, prompt: &str) -> Result<(String, String)> {
    let credentials = store::load_credentials()?;
    match (server, kind) {
        (Some(server), Some(kind)) => Ok((server, kind)),
        (Some(server), None) => {
            let matching: Vec<&Credential> = credentials.iter().filter(|c| c.server == server).collect();
            match matching.as_slice() {
                [] => bail!("no access saved for '{server}' - run `turnout pass set {server}`"),
                [only] => Ok((server.clone(), only.kind.clone())),
                _ => {
                    let owned: Vec<Credential> = matching.into_iter().cloned().collect();
                    pick::credential(&owned, None, prompt)
                }
            }
        }
        (None, kind) => pick::credential(&credentials, kind.as_deref(), prompt),
    }
}

fn set(server: Option<String>, kind: &str, login: Option<String>) -> Result<()> {
    let servers = store::load_servers()?;
    if servers.is_empty() {
        bail!("no servers in the catalog yet - run `turnout server add` first");
    }
    let interactive = pick::interactive();

    let server = match server {
        Some(server) => server,
        None => pick::server(&servers, "Server")?,
    };
    if !servers.iter().any(|s| s.name == server) {
        bail!("no server named '{server}' - see `turnout server list`");
    }

    let mut credentials = store::load_credentials()?;
    let existing = credentials.iter().position(|c| c.server == server && c.kind == kind);

    let login = match login {
        Some(login) => login,
        None => {
            pick::ensure_interactive("--login is required")?;
            let current = existing.map(|i| credentials[i].login.clone()).unwrap_or_default();
            let mut input = Input::new().with_prompt("Login");
            if !current.is_empty() {
                input = input.default(current);
            }
            input.interact_text()?
        }
    };

    let secret = if interactive {
        Password::new()
            .with_prompt(format!("Secret ({kind})"))
            .with_confirmation("Repeat to confirm", "Values do not match")
            .interact()?
    } else {
        // Scripted use: the secret arrives on stdin so it never lands in shell history.
        let mut buffer = String::new();
        std::io::stdin().read_to_string(&mut buffer).context("cannot read the secret from stdin")?;
        buffer.trim_end_matches(['\r', '\n']).to_string()
    };
    if secret.is_empty() {
        if interactive {
            bail!("empty secret - nothing saved");
        }
        // Off-terminal the secret comes from stdin, so an empty one usually
        // means nothing was piped in rather than that an empty value was meant.
        bail!("no secret on stdin - pipe it in, e.g. `echo \"$PASSWORD\" | turnout pass set {server} --kind {kind}`");
    }

    secrets::set(&server, kind, &secret)?;
    match existing {
        Some(index) => credentials[index].login = login,
        None => credentials.push(Credential {
            server: server.clone(),
            kind: kind.to_string(),
            login,
        }),
    }
    credentials.sort_by(|a, b| (a.server.as_str(), a.kind.as_str()).cmp(&(b.server.as_str(), b.kind.as_str())));
    store::save_credentials(&credentials)?;
    println!("Access to '{server}' ({kind}) saved.");
    Ok(())
}

fn copy(server: Option<String>, kind: Option<String>, login: bool, show: bool) -> Result<()> {
    let (server, kind) = resolve(server, kind, "Copy access for")?;
    let (server, kind) = (server.as_str(), kind.as_str());
    let credentials = store::load_credentials()?;
    let credential = credentials
        .iter()
        .find(|c| c.server == server && c.kind == kind)
        .ok_or_else(|| anyhow::anyhow!("no access saved for '{server}' ({kind}) - run `turnout pass set {server}`"))?;
    let (value, what) = if login {
        (credential.login.clone(), "Login")
    } else {
        (secrets::get(server, kind)?, "Secret")
    };
    if show {
        println!("{value}");
        return Ok(());
    }
    arboard::Clipboard::new()
        .and_then(|mut clipboard| clipboard.set_text(value))
        .context("cannot access the clipboard (use --show to print instead)")?;
    println!("{what} for '{server}' ({kind}) copied to the clipboard.");
    Ok(())
}

fn show(server: Option<String>) -> Result<()> {
    let credentials = store::load_credentials()?;
    let server = match server {
        Some(server) => server,
        // Only servers that actually have access saved are worth showing.
        None => pick::credential(&credentials, None, "Show access for")?.0,
    };
    let server = server.as_str();
    let matching: Vec<&Credential> = credentials.iter().filter(|c| c.server == server).collect();
    if matching.is_empty() {
        println!("No access saved for '{server}'.");
        return Ok(());
    }
    println!("{server}");
    for credential in matching {
        println!("  {:10} login {}", credential.kind, credential.login);
    }
    println!("Secrets are stored in the OS keyring; copy with `turnout pass copy {server}`.");
    Ok(())
}

fn list() -> Result<()> {
    let credentials = store::load_credentials()?;
    if credentials.is_empty() {
        println!("No access saved yet - run `turnout pass set`.");
        return Ok(());
    }
    let width = credentials.iter().map(|c| c.server.len()).max().unwrap_or(0);
    for credential in credentials {
        println!("{:width$}  {:10} login {}", credential.server, credential.kind, credential.login);
    }
    Ok(())
}

fn remove(server: Option<String>, kind: Option<String>, assume_yes: bool) -> Result<()> {
    let (server, kind) = resolve(server, kind, "Remove access for")?;
    let (server, kind) = (server.as_str(), kind.as_str());
    let mut credentials = store::load_credentials()?;
    if !credentials.iter().any(|c| c.server == server && c.kind == kind) {
        bail!("no access saved for '{server}' ({kind})");
    }
    let confirmed = pick::confirm_destructive(format!("Remove access to '{server}' ({kind})?"), assume_yes)?;
    if !confirmed {
        println!("Cancelled.");
        return Ok(());
    }
    secrets::delete(server, kind)?;
    credentials.retain(|c| !(c.server == server && c.kind == kind));
    store::save_credentials(&credentials)?;
    println!("Access to '{server}' ({kind}) removed.");
    Ok(())
}