derivepassphrase.git

@@ -33,6 +33,9 @@ dependencies = [

   # available in older Pythons (such as typing.Self).  These are loaded from

   # typing_extensions, instead of using explicit version guards.

   "typing_extensions",

+  # We read configuration files in JSON and TOML format.  The latter is

+  # unavailable in the Python standard library until Python 3.11.

+  'tomli; python_version < "3.11"'

 ]

 dynamic = ['version']

@@ -17,6 +17,7 @@ import inspect

 import json

 import logging

 import os

+import sys

 import unicodedata

 import warnings

 from typing import (

@@ -40,6 +41,11 @@ from typing_extensions import (

 import derivepassphrase as dpp

 from derivepassphrase import _types, exporter, ssh_agent, vault

+if sys.version_info >= (3, 11):

+    import tomllib

+else:

+    import tomli as tomllib

+

 if TYPE_CHECKING:

     import pathlib

     import socket

@@ -914,6 +920,8 @@ def _config_filename(

         return path

     elif subsystem == 'vault':  # noqa: RET505

         filename = f'{subsystem}.json'

+    elif subsystem == 'user configuration':

+        filename = 'config.toml'

     elif subsystem == 'old settings.json':

         filename = 'settings.json'

     else:  # pragma: no cover

@@ -1013,6 +1021,27 @@ def _save_config(config: _types.VaultConfig, /) -> None:

         json.dump(config, fileobj)

+def _load_user_config() -> dict[str, Any]:

+    """Load the user config from the application directory.

+

+    The filename is obtained via [`_config_filename`][].

+

+    Returns:

+        The user configuration, as a nested `dict`.

+

+    Raises:

+        OSError:

+            There was an OS error accessing the file.

+        ValueError:

+            The data loaded from the file is not a valid configuration

+            file.

+

+    """

+    filename = _config_filename(subsystem='user configuration')

+    with open(filename, 'rb') as fileobj:

+        return tomllib.load(fileobj)

+

+

 def _get_suitable_ssh_keys(

     conn: ssh_agent.SSHAgentClient | socket.socket | None = None, /

 ) -> Iterator[_types.KeyCommentPair]:

@@ -1780,6 +1809,16 @@ def derivepassphrase_vault(  # noqa: C901,PLR0912,PLR0913,PLR0914,PLR0915

         except Exception as exc:  # noqa: BLE001

             err('Cannot store config: %s', str(exc), exc_info=exc)

+    def get_user_config() -> dict[str, Any]:

+        try:

+            return _load_user_config()

+        except FileNotFoundError:

+            return {}

+        except OSError as e:

+            err('Cannot load user config: %s: %r', e.strerror, e.filename)

+        except Exception as e:  # noqa: BLE001

+            err('Cannot load user config: %s', str(e), exc_info=e)

+

     configuration: _types.VaultConfig

     check_incompatible_options('--phrase', '--key')

@@ -1822,6 +1861,8 @@ def derivepassphrase_vault(  # noqa: C901,PLR0912,PLR0913,PLR0914,PLR0915

             msg = f'{opt_str} does not take a SERVICE argument'

             raise click.UsageError(msg)

+    user_config = get_user_config()

+

     if service == '':  # noqa: PLC1901

         logger.warning(

             'An empty SERVICE is not supported by vault(1).  '

@@ -1429,6 +1429,7 @@ def phrase_from_key(

 def isolated_config(

     monkeypatch: pytest.MonkeyPatch,

     runner: click.testing.CliRunner,

+    main_config_str: str | None = None,

 ) -> Iterator[None]:

     prog_name = cli.PROG_NAME

     env_name = prog_name.replace(' ', '_').upper() + '_PATH'

@@ -1445,6 +1446,13 @@ def isolated_config(

         monkeypatch.delenv(env_name, raising=False)

         config_dir = cli._config_filename(subsystem=None)

         os.makedirs(config_dir, exist_ok=True)

+        if isinstance(main_config_str, str):

+            with open(

+                cli._config_filename('user configuration'),

+                'w',

+                encoding='UTF-8',

+            ) as outfile:

+                outfile.write(main_config_str)

         yield

@@ -1452,12 +1460,15 @@ def isolated_config(

 def isolated_vault_config(

     monkeypatch: pytest.MonkeyPatch,

     runner: click.testing.CliRunner,

-    config: Any,

+    vault_config: Any,

+    main_config_str: str | None = None,

 ) -> Iterator[None]:

-    with isolated_config(monkeypatch=monkeypatch, runner=runner):

+    with isolated_config(

+        monkeypatch=monkeypatch, runner=runner, main_config_str=main_config_str

+    ):

         config_filename = cli._config_filename(subsystem='vault')

         with open(config_filename, 'w', encoding='UTF-8') as outfile:

-            json.dump(config, outfile)

+            json.dump(vault_config, outfile)

         yield

@@ -327,7 +327,7 @@ class TestCLI:

     ) -> None:

         runner = click.testing.CliRunner(mix_stderr=False)

         with tests.isolated_vault_config(

-            monkeypatch=monkeypatch, runner=runner, config=config

+            monkeypatch=monkeypatch, runner=runner, vault_config=config

         ):

             monkeypatch.setattr(

                 vault.Vault, 'phrase_from_key', tests.phrase_from_key

@@ -356,7 +356,7 @@ class TestCLI:

         with tests.isolated_vault_config(

             monkeypatch=monkeypatch,

             runner=runner,

-            config={'services': {DUMMY_SERVICE: DUMMY_CONFIG_SETTINGS}},

+            vault_config={'services': {DUMMY_SERVICE: DUMMY_CONFIG_SETTINGS}},

         ):

             monkeypatch.setattr(

                 cli, '_get_suitable_ssh_keys', tests.suitable_ssh_keys

@@ -420,7 +420,7 @@ class TestCLI:

             monkeypatch.setattr(ssh_agent.SSHAgentClient, 'sign', tests.sign)

             runner = click.testing.CliRunner(mix_stderr=False)

             with tests.isolated_vault_config(

-                monkeypatch=monkeypatch, runner=runner, config=config

+                monkeypatch=monkeypatch, runner=runner, vault_config=config

             ):

                 _result = runner.invoke(

                     cli.derivepassphrase_vault,

@@ -450,7 +450,7 @@ class TestCLI:

             with tests.isolated_vault_config(

                 monkeypatch=monkeypatch,

                 runner=runner,

-                config={

+                vault_config={

                     'global': {'key': DUMMY_KEY1_B64},

                     'services': {

                         DUMMY_SERVICE: {

@@ -510,7 +510,7 @@ class TestCLI:

             with tests.isolated_vault_config(

                 monkeypatch=monkeypatch,

                 runner=runner,

-                config=config,

+                vault_config=config,

             ):

                 _result = runner.invoke(

                     cli.derivepassphrase_vault,

@@ -587,7 +587,7 @@ class TestCLI:

         with tests.isolated_vault_config(

             monkeypatch=monkeypatch,

             runner=runner,

-            config={'global': {'phrase': 'abc'}, 'services': {}},

+            vault_config={'global': {'phrase': 'abc'}, 'services': {}},

         ):

             _result = runner.invoke(

                 cli.derivepassphrase_vault,

@@ -613,7 +613,7 @@ class TestCLI:

             with tests.isolated_vault_config(

                 monkeypatch=monkeypatch,

                 runner=runner,

-                config={'global': {'phrase': 'abc'}, 'services': {}},

+                vault_config={'global': {'phrase': 'abc'}, 'services': {}},

             ):

                 monkeypatch.setattr(

                     cli, '_prompt_for_passphrase', tests.auto_prompt

@@ -644,7 +644,7 @@ class TestCLI:

         with tests.isolated_vault_config(

             monkeypatch=monkeypatch,

             runner=runner,

-            config={'services': {}},

+            vault_config={'services': {}},

         ):

             _result = runner.invoke(

                 cli.derivepassphrase_vault,

@@ -727,7 +727,7 @@ class TestCLI:

         with tests.isolated_vault_config(

             monkeypatch=monkeypatch,

             runner=runner,

-            config={'services': {}},

+            vault_config={'services': {}},

         ):

             _result = runner.invoke(

                 cli.derivepassphrase_vault,

@@ -766,7 +766,7 @@ class TestCLI:

         with tests.isolated_vault_config(

             monkeypatch=pytest.MonkeyPatch(),

             runner=runner,

-            config={'services': {}},

+            vault_config={'services': {}},

         ):

             _result = runner.invoke(

                 cli.derivepassphrase_vault,

@@ -866,7 +866,7 @@ class TestCLI:

     ) -> None:

         runner = click.testing.CliRunner(mix_stderr=False)

         with tests.isolated_vault_config(

-            monkeypatch=monkeypatch, runner=runner, config={}

+            monkeypatch=monkeypatch, runner=runner, vault_config={}

         ):

             _result = runner.invoke(

                 cli.derivepassphrase_vault,

@@ -936,6 +936,8 @@ class TestCLI:

         result = tests.ReadableResult.parse(_result)

         assert result.error_exit(

             error='Cannot load config'

+        ) or result.error_exit(

+            error='Cannot load user config'

         ), 'expected error exit and known error message'

     def test_220_edit_notes_successfully(

@@ -950,7 +952,7 @@ contents go here

         with tests.isolated_vault_config(

             monkeypatch=monkeypatch,

             runner=runner,

-            config={'global': {'phrase': 'abc'}, 'services': {}},

+            vault_config={'global': {'phrase': 'abc'}, 'services': {}},

         ):

             monkeypatch.setattr(click, 'edit', lambda *a, **kw: edit_result)  # noqa: ARG005

             _result = runner.invoke(

@@ -976,7 +978,7 @@ contents go here

         with tests.isolated_vault_config(

             monkeypatch=monkeypatch,

             runner=runner,

-            config={'global': {'phrase': 'abc'}, 'services': {}},

+            vault_config={'global': {'phrase': 'abc'}, 'services': {}},

         ):

             monkeypatch.setattr(click, 'edit', lambda *a, **kw: None)  # noqa: ARG005

             _result = runner.invoke(

@@ -999,7 +1001,7 @@ contents go here

         with tests.isolated_vault_config(

             monkeypatch=monkeypatch,

             runner=runner,

-            config={'global': {'phrase': 'abc'}, 'services': {}},

+            vault_config={'global': {'phrase': 'abc'}, 'services': {}},

         ):

             monkeypatch.setattr(click, 'edit', lambda *a, **kw: 'long\ntext')  # noqa: ARG005

             _result = runner.invoke(

@@ -1025,7 +1027,7 @@ contents go here

         with tests.isolated_vault_config(

             monkeypatch=monkeypatch,

             runner=runner,

-            config={'global': {'phrase': 'abc'}, 'services': {}},

+            vault_config={'global': {'phrase': 'abc'}, 'services': {}},

         ):

             monkeypatch.setattr(click, 'edit', lambda *a, **kw: '\n\n')  # noqa: ARG005

             _result = runner.invoke(

@@ -1096,7 +1098,7 @@ contents go here

         with tests.isolated_vault_config(

             monkeypatch=monkeypatch,

             runner=runner,

-            config={'global': {'phrase': 'abc'}, 'services': {}},

+            vault_config={'global': {'phrase': 'abc'}, 'services': {}},

         ):

             monkeypatch.setattr(

                 cli, '_get_suitable_ssh_keys', tests.suitable_ssh_keys

@@ -1141,7 +1143,7 @@ contents go here

         with tests.isolated_vault_config(

             monkeypatch=monkeypatch,

             runner=runner,

-            config={'global': {'phrase': 'abc'}, 'services': {}},

+            vault_config={'global': {'phrase': 'abc'}, 'services': {}},

         ):

             monkeypatch.setattr(

                 cli, '_get_suitable_ssh_keys', tests.suitable_ssh_keys

@@ -1165,7 +1167,7 @@ contents go here

         with tests.isolated_vault_config(

             monkeypatch=monkeypatch,

             runner=runner,

-            config={'global': {'phrase': 'abc'}, 'services': {}},

+            vault_config={'global': {'phrase': 'abc'}, 'services': {}},

         ):

             custom_error = 'custom error message'

@@ -1193,7 +1195,7 @@ contents go here

         with tests.isolated_vault_config(

             monkeypatch=monkeypatch,

             runner=runner,

-            config={'global': {'phrase': 'abc'}, 'services': {}},

+            vault_config={'global': {'phrase': 'abc'}, 'services': {}},

         ):

             monkeypatch.delenv('SSH_AUTH_SOCK', raising=False)

             _result = runner.invoke(

@@ -1214,7 +1216,7 @@ contents go here

         with tests.isolated_vault_config(

             monkeypatch=monkeypatch,

             runner=runner,

-            config={'global': {'phrase': 'abc'}, 'services': {}},

+            vault_config={'global': {'phrase': 'abc'}, 'services': {}},

         ):

             monkeypatch.setenv('SSH_AUTH_SOCK', os.getcwd())

             _result = runner.invoke(

@@ -1237,7 +1239,7 @@ contents go here

         with tests.isolated_vault_config(

             monkeypatch=monkeypatch,

             runner=runner,

-            config={'global': {'phrase': 'abc'}, 'services': {}},

+            vault_config={'global': {'phrase': 'abc'}, 'services': {}},

         ):

             tests.make_file_readonly(

                 cli._config_filename(subsystem='vault'),

@@ -1261,7 +1263,7 @@ contents go here

         with tests.isolated_vault_config(

             monkeypatch=monkeypatch,

             runner=runner,

-            config={'global': {'phrase': 'abc'}, 'services': {}},

+            vault_config={'global': {'phrase': 'abc'}, 'services': {}},

         ):

             custom_error = 'custom error message'

@@ -1495,7 +1497,9 @@ contents go here

         with tests.isolated_vault_config(

             monkeypatch=monkeypatch,

             runner=runner,

-            config={'services': {DUMMY_SERVICE: DUMMY_CONFIG_SETTINGS.copy()}},

+            vault_config={

+                'services': {DUMMY_SERVICE: DUMMY_CONFIG_SETTINGS.copy()}

+            },

         ):

             _result = runner.invoke(

                 cli.derivepassphrase_vault,

@@ -1517,7 +1521,7 @@ contents go here

         with tests.isolated_vault_config(

             monkeypatch=monkeypatch,

             runner=runner,

-            config={'global': {'phrase': 'abc'}, 'services': {}},

+            vault_config={'global': {'phrase': 'abc'}, 'services': {}},

         ):

             monkeypatch.setenv(

                 'SSH_AUTH_SOCK', "the value doesn't even matter"

@@ -1559,7 +1563,7 @@ class TestCLIUtils:

     ) -> None:

         runner = click.testing.CliRunner()

         with tests.isolated_vault_config(

-            monkeypatch=monkeypatch, runner=runner, config=config

+            monkeypatch=monkeypatch, runner=runner, vault_config=config

         ):

             config_filename = cli._config_filename(subsystem='vault')

             with open(config_filename, encoding='UTF-8') as fileobj:

@@ -1575,7 +1579,7 @@ class TestCLIUtils:

         with contextlib.ExitStack() as stack:

             stack.enter_context(

                 tests.isolated_vault_config(

-                    monkeypatch=monkeypatch, runner=runner, config={}

+                    monkeypatch=monkeypatch, runner=runner, vault_config={}

                 )

             )

             stack.enter_context(

@@ -1862,7 +1866,9 @@ Boo.

         runner = click.testing.CliRunner(mix_stderr=False)

         for start_config in [config, result_config]:

             with tests.isolated_vault_config(

-                monkeypatch=monkeypatch, runner=runner, config=start_config

+                monkeypatch=monkeypatch,

+                runner=runner,

+                vault_config=start_config,

             ):

                 _result = runner.invoke(

                     cli.derivepassphrase_vault,

@@ -2424,7 +2430,7 @@ class ConfigManagementStateMachine(stateful.RuleBasedStateMachine):

             tests.isolated_vault_config(

                 monkeypatch=self.monkeypatch,

                 runner=self.runner,

-                config={'services': {}},

+                vault_config={'services': {}},

             )

         )