derivepassphrase.git

@@ -182,10 +182,6 @@ def validate_vault_config(  # noqa: C901,PLR0912,PLR0915

         json_path_str = as_json_path_string(json_path)

         return f'vault config entry {json_path_str} is not an integer'

-    err_key_and_phrase = (

-        '"key" and "phrase" specified on the same vault config level'

-    )

-

     def err_derivepassphrase_extension(

         key: str, json_path: Sequence[str], /

     ) -> str:

@@ -234,8 +230,6 @@ def validate_vault_config(  # noqa: C901,PLR0912,PLR0915

                     )

             elif not allow_unknown_settings:

                 raise ValueError(err_unknown_setting(key, ('global',)))

-        if 'key' in o_global and 'phrase' in o_global:

-            raise ValueError(err_key_and_phrase)

     if not isinstance(obj.get('services'), dict):

         raise TypeError(err_not_a_dict(['services']))

     for sv_name, service in obj['services'].items():

@@ -284,8 +278,6 @@ def validate_vault_config(  # noqa: C901,PLR0912,PLR0915

                 raise ValueError(

                     err_unknown_setting(key, ['services', sv_name])

                 )

-        if 'key' in service and 'phrase' in service:

-            raise ValueError(err_key_and_phrase)

 def is_vault_config(obj: Any) -> TypeIs[VaultConfig]:  # noqa: ANN401

@@ -1574,17 +1574,12 @@ def derivepassphrase_vault(  # noqa: C901,PLR0912,PLR0913,PLR0914,PLR0915

             # If either --key or --phrase are given, use that setting.

             # Otherwise, if both key and phrase are set in the config,

-            # one must be global (ignore it) and one must be

-            # service-specific (use that one). Otherwise, if only one of

-            # key and phrase is set in the config, use that one.  In all

-            # these above cases, set the phrase via

-            # derivepassphrase.vault.Vault.phrase_from_key if a key is

-            # given. Finally, if nothing is set, error out.

+            # use the key.  Otherwise, if only one of key and phrase is

+            # set in the config, use that one.  In all these above

+            # cases, set the phrase via vault.Vault.phrase_from_key if

+            # a key is given.  Finally, if nothing is set, error out.

             if use_key or use_phrase:

                 kwargs['phrase'] = key_to_phrase(key) if use_key else phrase

-            elif kwargs.get('phrase') and kwargs.get('key'):

-                if any('key' in m for m in settings.maps[:2]):

-                    kwargs['phrase'] = key_to_phrase(kwargs['key'])

             elif kwargs.get('key'):

                 kwargs['phrase'] = key_to_phrase(kwargs['key'])

             elif kwargs.get('phrase'):

@@ -19,7 +19,7 @@ from typing import TYPE_CHECKING

 import pytest

 from typing_extensions import NamedTuple, Self, assert_never

-from derivepassphrase import _types, cli, ssh_agent

+from derivepassphrase import _types, cli, ssh_agent, vault

 __all__ = ()

@@ -721,6 +721,18 @@ def list_keys(self: Any = None) -> list[_types.KeyCommentPair]:

     return list1 + list2

+def sign(

+    self: Any, key: bytes | bytearray, message: bytes | bytearray

+) -> bytes:

+    del self  # Unused.

+    assert message == vault.Vault._UUID

+    for value in SUPPORTED_KEYS.values():

+        if value['public_key_data'] == key:  # pragma: no branch

+            assert value['expected_signature'] is not None

+            return value['expected_signature']

+    raise AssertionError

+

+

 def list_keys_singleton(self: Any = None) -> list[_types.KeyCommentPair]:

     del self  # Unused.

     Pair = _types.KeyCommentPair  # noqa: N806

@@ -16,9 +16,8 @@ import click.testing

 import pytest

 from typing_extensions import NamedTuple

-import derivepassphrase as dpp

 import tests

-from derivepassphrase import _types, cli, ssh_agent

+from derivepassphrase import _types, cli, ssh_agent, vault

 if TYPE_CHECKING:

     from collections.abc import Callable

@@ -225,7 +224,7 @@ class TestCLI:

     ) -> None:

         monkeypatch.setattr(cli, '_prompt_for_passphrase', tests.auto_prompt)

         option = f'--{charset_name}'

-        charset = dpp.vault.Vault._CHARSETS[charset_name].decode('ascii')

+        charset = vault.Vault._CHARSETS[charset_name].decode('ascii')

         runner = click.testing.CliRunner(mix_stderr=False)

         with tests.isolated_config(

             monkeypatch=monkeypatch,

@@ -304,7 +303,7 @@ class TestCLI:

             monkeypatch=monkeypatch, runner=runner, config=config

         ):

             monkeypatch.setattr(

-                dpp.vault.Vault, 'phrase_from_key', tests.phrase_from_key

+                vault.Vault, 'phrase_from_key', tests.phrase_from_key

             )

             _result = runner.invoke(

                 cli.derivepassphrase_vault,

@@ -336,7 +335,7 @@ class TestCLI:

                 cli, '_get_suitable_ssh_keys', tests.suitable_ssh_keys

             )

             monkeypatch.setattr(

-                dpp.vault.Vault, 'phrase_from_key', tests.phrase_from_key

+                vault.Vault, 'phrase_from_key', tests.phrase_from_key

             )

             _result = runner.invoke(

                 cli.derivepassphrase_vault,

@@ -386,22 +385,12 @@ class TestCLI:

         config: dict[str, Any],

         key_index: int,

     ) -> None:

-        def sign(

-            _: Any, key: bytes | bytearray, message: bytes | bytearray

-        ) -> bytes:

-            del message  # Unused.

-            for value in tests.SUPPORTED_KEYS.values():

-                if value['public_key_data'] == key:

-                    assert value['expected_signature'] is not None

-                    return value['expected_signature']

-            raise AssertionError

-

         with monkeypatch.context():

             monkeypatch.setenv('SSH_AUTH_SOCK', running_ssh_agent)

             monkeypatch.setattr(

                 ssh_agent.SSHAgentClient, 'list_keys', tests.list_keys

             )

-            monkeypatch.setattr(ssh_agent.SSHAgentClient, 'sign', sign)

+            monkeypatch.setattr(ssh_agent.SSHAgentClient, 'sign', tests.sign)

             runner = click.testing.CliRunner(mix_stderr=False)

             with tests.isolated_vault_config(

                 monkeypatch=monkeypatch, runner=runner, config=config

@@ -422,7 +411,14 @@ class TestCLI:

     def test_205_service_phrase_if_key_in_global_config(

         self,

         monkeypatch: pytest.MonkeyPatch,

+        running_ssh_agent: str,

     ) -> None:

+        with monkeypatch.context():

+            monkeypatch.setenv('SSH_AUTH_SOCK', running_ssh_agent)

+            monkeypatch.setattr(

+                ssh_agent.SSHAgentClient, 'list_keys', tests.list_keys

+            )

+            monkeypatch.setattr(ssh_agent.SSHAgentClient, 'sign', tests.sign)

             runner = click.testing.CliRunner(mix_stderr=False)

             with tests.isolated_vault_config(

                 monkeypatch=monkeypatch,

@@ -447,10 +443,10 @@ class TestCLI:

         assert _result.stdout_bytes, 'expected program output'

         last_line = _result.stdout_bytes.splitlines(True)[-1]

         assert (

-            last_line.rstrip(b'\n') != DUMMY_RESULT_KEY1

-        ), 'known false output: key-based instead of phrase-based'

+            last_line.rstrip(b'\n') != DUMMY_RESULT_PASSPHRASE

+        ), 'known false output: phrase-based instead of key-based'

         assert (

-            last_line.rstrip(b'\n') == DUMMY_RESULT_PASSPHRASE

+            last_line.rstrip(b'\n') == DUMMY_RESULT_KEY1

         ), 'expected known output'

     @pytest.mark.parametrize(

@@ -1559,7 +1555,7 @@ Boo.

     def test_204_phrase_from_key_manually(self) -> None:

         assert (

-            dpp.vault.Vault(

+            vault.Vault(

                 phrase=DUMMY_PHRASE_FROM_KEY1, **DUMMY_CONFIG_SETTINGS

             ).generate(DUMMY_SERVICE)

             == DUMMY_RESULT_KEY1

@@ -1844,7 +1840,7 @@ class TestCLITransition:

     ) -> None:

         monkeypatch.setattr(cli, '_prompt_for_passphrase', tests.auto_prompt)

         option = f'--{charset_name}'

-        charset = dpp.vault.Vault._CHARSETS[charset_name].decode('ascii')

+        charset = vault.Vault._CHARSETS[charset_name].decode('ascii')

         runner = click.testing.CliRunner(mix_stderr=False)

         with tests.isolated_config(

             monkeypatch=monkeypatch,

@@ -22,7 +22,7 @@ from derivepassphrase import _types

         ),

         (

             {'global': {'phrase': 'abc', 'key': '...'}, 'services': {}},

-            'incompatible config values: global.key and global.phrase',

+            '',

         ),

         ({'services': None}, 'bad config value: services'),

         ({'services': {2: {}}}, 'bad config value: services."2"'),

@@ -62,10 +62,7 @@ from derivepassphrase import _types

         ({'services': {'sv': {'length': 10, 'phrase': '...'}}}, ''),

         ({'services': {'sv': {'length': 10, 'key': '...'}}}, ''),

         ({'services': {'sv': {'upper': 10, 'key': '...'}}}, ''),

-        (

-            {'services': {'sv': {'phrase': 'abc', 'key': '...'}}},

-            'incompatible config values: services.sv.key and services.sv.phrase',  # noqa: E501

-        ),

+        ({'services': {'sv': {'phrase': 'abc', 'key': '...'}}}, ''),

         (

             {

                 'global': {'phrase': 'abc'},