derivepassphrase.git

@@ -0,0 +1,6 @@

+### Added

+

+  - `derivepassphrase vault --config` now supports an `--unset` option which

+    unsets any given named setting prior to applying any other configuration

+    changes.

+

@@ -1635,6 +1635,28 @@ DEFAULT_NOTES_MARKER = '# - - - - - >8 - - - - -'

     help='overwrite or merge (default) the existing configuration',

     cls=CompatibilityOption,

 )

+@click.option(

+    '--unset',

+    'unset_settings',

+    multiple=True,

+    type=click.Choice([

+        'phrase',

+        'key',

+        'length',

+        'repeat',

+        'lower',

+        'upper',

+        'number',

+        'space',

+        'dash',

+        'symbol',

+    ]),

+    help=(

+        'with --config, also unsets the given setting; '

+        'may be specified multiple times'

+    ),

+    cls=CompatibilityOption,

+)

 @click.version_option(version=dpp.__version__, prog_name=PROG_NAME)

 @standard_logging_options

 @click.argument('service', required=False)

@@ -1662,6 +1684,7 @@ def derivepassphrase_vault(  # noqa: C901,PLR0912,PLR0913,PLR0914,PLR0915

     export_settings: TextIO | pathlib.Path | os.PathLike[str] | None = None,

     import_settings: TextIO | pathlib.Path | os.PathLike[str] | None = None,

     overwrite_config: bool = False,

+    unset_settings: Sequence[str] = (),

 ) -> None:

     """Derive a passphrase using the vault(1) derivation scheme.

@@ -1758,6 +1781,10 @@ def derivepassphrase_vault(  # noqa: C901,PLR0912,PLR0913,PLR0914,PLR0915

             `--merge-existing` (False).  Controls whether config saving

             and config importing overwrite existing configurations, or

             merge them section-wise instead.

+        unset_settings:

+            Command-line argument `--unset`.  If given together with

+            `--config`, unsets the specified settings (in addition to

+            any other changes requested).

     """  # noqa: D301

     logger = logging.getLogger(PROG_NAME)

@@ -2189,13 +2216,20 @@ def derivepassphrase_vault(  # noqa: C901,PLR0912,PLR0913,PLR0914,PLR0915

                             'Setting a global passphrase is ineffective '

                             'because a key is also set.'

                         )

-            if not view.maps[0]:

+            if not view.maps[0] and not unset_settings:

                 settings_type = 'service' if service else 'global'

                 msg = (

                     f'Cannot update {settings_type} settings without '

                     f'actual settings'

                 )

                 raise click.UsageError(msg)

+            for setting in unset_settings:

+                if setting in view.maps[0]:

+                    msg = (

+                        f'Attempted to unset and set --{setting} '

+                        f'at the same time.'

+                    )

+                    raise click.UsageError(msg)

             subtree: dict[str, Any] = (

                 configuration['services'].setdefault(service, {})  # type: ignore[assignment]

                 if service

@@ -2203,6 +2237,9 @@ def derivepassphrase_vault(  # noqa: C901,PLR0912,PLR0913,PLR0914,PLR0915

             )

             if overwrite_config:

                 subtree.clear()

+            else:

+                for setting in unset_settings:

+                    subtree.pop(setting, None)

             subtree.update(view)

             assert _types.is_vault_config(

                 configuration

@@ -1304,6 +1304,32 @@ contents go here

             error=custom_error

         ), 'expected error exit and known error message'

+    def test_225f_store_config_fail_unset_and_set_same_settings(

+        self,

+        monkeypatch: pytest.MonkeyPatch,

+    ) -> None:

+        runner = click.testing.CliRunner(mix_stderr=False)

+        with tests.isolated_vault_config(

+            monkeypatch=monkeypatch,

+            runner=runner,

+            vault_config={'global': {'phrase': 'abc'}, 'services': {}},

+        ):

+            _result = runner.invoke(

+                cli.derivepassphrase_vault,

+                [

+                    '--config',

+                    '--unset=length',

+                    '--length=15',

+                    '--',

+                    DUMMY_SERVICE,

+                ],

+                catch_exceptions=False,

+            )

+        result = tests.ReadableResult.parse(_result)

+        assert result.error_exit(

+            error='Attempted to unset and set --length at the same time.'

+        ), 'expected error exit and known error message'

+

     def test_226_no_arguments(self, monkeypatch: pytest.MonkeyPatch) -> None:

         runner = click.testing.CliRunner(mix_stderr=False)

         with tests.isolated_config(

@@ -2752,17 +2778,27 @@ class ConfigManagementStateMachine(stateful.RuleBasedStateMachine):

         target=configuration,

         config=configuration,

         setting=setting.filter(bool),

+        maybe_unset=strategies.sets(

+            strategies.sampled_from(_valid_properties),

+            max_size=3,

+        ),

         overwrite=strategies.booleans(),

     )

     def set_globals(

         self,

         config: _types.VaultConfig,

         setting: _types.VaultConfigGlobalSettings,

+        maybe_unset: set[str],

         overwrite: bool,

     ) -> _types.VaultConfig:

         cli._save_config(config)

+        config_global = config.get('global', {})

+        maybe_unset = set(maybe_unset) - setting.keys()

         if overwrite:

-            config['global'] = {}

+            config['global'] = config_global = {}

+        elif maybe_unset:

+            for key in maybe_unset:

+                config_global.pop(key, None)  # type: ignore[misc]

         config.setdefault('global', {}).update(setting)

         assert _types.is_vault_config(config)

         # NOTE: This relies on settings_obj containing only the keys

@@ -2774,6 +2810,7 @@ class ConfigManagementStateMachine(stateful.RuleBasedStateMachine):

                 '--config',

                 '--overwrite-existing' if overwrite else '--merge-existing',

             ]

+            + [f'--unset={key}' for key in maybe_unset]

             + [

                 f'--{key}={value}'

                 for key, value in setting.items()

@@ -2791,6 +2828,10 @@ class ConfigManagementStateMachine(stateful.RuleBasedStateMachine):

         config=configuration,

         service=strategies.sampled_from(_known_services),

         setting=setting.filter(bool),

+        maybe_unset=strategies.sets(

+            strategies.sampled_from(_valid_properties),

+            max_size=3,

+        ),

         overwrite=strategies.booleans(),

     )

     def set_service(

@@ -2798,11 +2839,17 @@ class ConfigManagementStateMachine(stateful.RuleBasedStateMachine):

         config: _types.VaultConfig,

         service: str,

         setting: _types.VaultConfigServicesSettings,

+        maybe_unset: set[str],

         overwrite: bool,

     ) -> _types.VaultConfig:

         cli._save_config(config)

+        config_service = config['services'].get(service, {})

+        maybe_unset = set(maybe_unset) - setting.keys()

         if overwrite:

-            config['services'][service] = {}

+            config['services'][service] = config_service = {}

+        elif maybe_unset:

+            for key in maybe_unset:

+                config_service.pop(key, None)  # type: ignore[misc]

         config['services'].setdefault(service, {}).update(setting)

         assert _types.is_vault_config(config)

         # NOTE: This relies on settings_obj containing only the keys

@@ -2814,6 +2861,7 @@ class ConfigManagementStateMachine(stateful.RuleBasedStateMachine):

                 '--config',

                 '--overwrite-existing' if overwrite else '--merge-existing',

             ]

+            + [f'--unset={key}' for key in maybe_unset]

             + [

                 f'--{key}={value}'

                 for key, value in setting.items()