stuff
This commit is contained in:
369
services/passbolt_client.py
Normal file
369
services/passbolt_client.py
Normal file
@@ -0,0 +1,369 @@
|
||||
"""Passbolt CLI integration for secure credential management."""
|
||||
|
||||
import subprocess
|
||||
import json
|
||||
import os
|
||||
from dataclasses import dataclass
|
||||
from typing import Optional, List, Dict, Any
|
||||
from enum import Enum
|
||||
from pathlib import Path
|
||||
|
||||
|
||||
class PassboltResourceType(Enum):
|
||||
"""Types of resources in Passbolt."""
|
||||
PASSWORD = "password"
|
||||
PASSWORD_WITH_DESCRIPTION = "password-with-description"
|
||||
PASSWORD_STRING = "password-string"
|
||||
TOTP = "totp"
|
||||
|
||||
|
||||
class PassboltError(Exception):
|
||||
"""Exception raised for Passbolt operations."""
|
||||
pass
|
||||
|
||||
|
||||
@dataclass
|
||||
class PassboltCredential:
|
||||
"""Represents credentials retrieved from Passbolt."""
|
||||
resource_id: str
|
||||
name: str
|
||||
username: Optional[str] = None
|
||||
password: Optional[str] = None
|
||||
uri: Optional[str] = None
|
||||
description: Optional[str] = None
|
||||
resource_type: PassboltResourceType = PassboltResourceType.PASSWORD
|
||||
|
||||
|
||||
@dataclass
|
||||
class PassboltResource:
|
||||
"""Represents a Passbolt resource."""
|
||||
id: str
|
||||
name: str
|
||||
username: Optional[str] = None
|
||||
uri: Optional[str] = None
|
||||
resource_type: str = "password"
|
||||
folder_parent_id: Optional[str] = None
|
||||
personal: bool = False
|
||||
|
||||
|
||||
class PassboltClient:
|
||||
"""Client for interacting with Passbolt through the CLI."""
|
||||
|
||||
def __init__(self, passbolt_cli_path: str = "passbolt"):
|
||||
"""Initialize Passbolt client.
|
||||
|
||||
Args:
|
||||
passbolt_cli_path: Path to the passbolt CLI executable
|
||||
"""
|
||||
self.cli_path = passbolt_cli_path
|
||||
self._check_cli_available()
|
||||
self._check_authentication()
|
||||
|
||||
def _check_cli_available(self) -> None:
|
||||
"""Check if Passbolt CLI is available."""
|
||||
try:
|
||||
subprocess.run([self.cli_path, '--version'],
|
||||
capture_output=True, check=True)
|
||||
except (subprocess.CalledProcessError, FileNotFoundError):
|
||||
raise PassboltError(
|
||||
f"Passbolt CLI not found at '{self.cli_path}'. "
|
||||
"Please install: https://github.com/passbolt/go-passbolt-cli"
|
||||
)
|
||||
|
||||
def _check_authentication(self) -> None:
|
||||
"""Check if authenticated with Passbolt."""
|
||||
try:
|
||||
# Try to list resources to check auth
|
||||
self._run_passbolt(['list', '--json'], check=True)
|
||||
except PassboltError:
|
||||
raise PassboltError(
|
||||
"Not authenticated with Passbolt. "
|
||||
"Please run: passbolt auth login"
|
||||
)
|
||||
|
||||
def _run_passbolt(self, args: List[str], check: bool = True) -> subprocess.CompletedProcess:
|
||||
"""Run a Passbolt CLI command.
|
||||
|
||||
Args:
|
||||
args: Command arguments
|
||||
check: Whether to check return code
|
||||
|
||||
Returns:
|
||||
Completed process result
|
||||
"""
|
||||
try:
|
||||
result = subprocess.run(
|
||||
[self.cli_path] + args,
|
||||
capture_output=True,
|
||||
text=True,
|
||||
check=check
|
||||
)
|
||||
return result
|
||||
except subprocess.CalledProcessError as e:
|
||||
raise PassboltError(f"Passbolt command failed: {e.stderr}")
|
||||
|
||||
def get_credential(self, resource_id: str) -> PassboltCredential:
|
||||
"""Get a credential by resource ID.
|
||||
|
||||
Args:
|
||||
resource_id: UUID of the Passbolt resource
|
||||
|
||||
Returns:
|
||||
PassboltCredential object with username and password
|
||||
"""
|
||||
# Get the full resource
|
||||
result = self._run_passbolt(['get', '--id', resource_id, '--json'])
|
||||
|
||||
try:
|
||||
data = json.loads(result.stdout)
|
||||
except json.JSONDecodeError:
|
||||
raise PassboltError(f"Failed to parse Passbolt response")
|
||||
|
||||
# Extract fields based on resource type
|
||||
credential = PassboltCredential(
|
||||
resource_id=resource_id,
|
||||
name=data.get('name', ''),
|
||||
username=data.get('username'),
|
||||
password=data.get('password'),
|
||||
uri=data.get('uri'),
|
||||
description=data.get('description')
|
||||
)
|
||||
|
||||
# Determine resource type
|
||||
if 'resource_type' in data:
|
||||
try:
|
||||
credential.resource_type = PassboltResourceType(
|
||||
data['resource_type'])
|
||||
except ValueError:
|
||||
pass # Keep default
|
||||
|
||||
return credential
|
||||
|
||||
def get_field(self, resource_id: str, field: str) -> str:
|
||||
"""Get a specific field from a resource.
|
||||
|
||||
Args:
|
||||
resource_id: UUID of the Passbolt resource
|
||||
field: Field name (e.g., 'password', 'username', 'uri')
|
||||
|
||||
Returns:
|
||||
Field value as string
|
||||
"""
|
||||
result = self._run_passbolt(
|
||||
['get', '--id', resource_id, '--field', field])
|
||||
return result.stdout.strip()
|
||||
|
||||
def get_password(self, resource_id: str) -> str:
|
||||
"""Get just the password for a resource.
|
||||
|
||||
Args:
|
||||
resource_id: UUID of the Passbolt resource
|
||||
|
||||
Returns:
|
||||
Password string
|
||||
"""
|
||||
return self.get_field(resource_id, 'password')
|
||||
|
||||
def get_username(self, resource_id: str) -> str:
|
||||
"""Get just the username for a resource.
|
||||
|
||||
Args:
|
||||
resource_id: UUID of the Passbolt resource
|
||||
|
||||
Returns:
|
||||
Username string
|
||||
"""
|
||||
return self.get_field(resource_id, 'username')
|
||||
|
||||
def list_resources(self, folder_id: Optional[str] = None,
|
||||
search: Optional[str] = None) -> List[PassboltResource]:
|
||||
"""List available resources.
|
||||
|
||||
Args:
|
||||
folder_id: Optional folder ID to filter by
|
||||
search: Optional search term
|
||||
|
||||
Returns:
|
||||
List of PassboltResource objects
|
||||
"""
|
||||
args = ['list', '--json']
|
||||
|
||||
if folder_id:
|
||||
args.extend(['--folder', folder_id])
|
||||
if search:
|
||||
args.extend(['--filter', search])
|
||||
|
||||
result = self._run_passbolt(args)
|
||||
|
||||
try:
|
||||
data = json.loads(result.stdout)
|
||||
except json.JSONDecodeError:
|
||||
return []
|
||||
|
||||
resources = []
|
||||
for item in data:
|
||||
resources.append(PassboltResource(
|
||||
id=item['id'],
|
||||
name=item.get('name', ''),
|
||||
username=item.get('username'),
|
||||
uri=item.get('uri'),
|
||||
resource_type=item.get('resource_type', 'password'),
|
||||
folder_parent_id=item.get('folder_parent_id'),
|
||||
personal=item.get('personal', False)
|
||||
))
|
||||
|
||||
return resources
|
||||
|
||||
def find_resource_by_name(self, name: str) -> Optional[PassboltResource]:
|
||||
"""Find a resource by name.
|
||||
|
||||
Args:
|
||||
name: Name of the resource to find
|
||||
|
||||
Returns:
|
||||
First matching PassboltResource or None
|
||||
"""
|
||||
resources = self.list_resources(search=name)
|
||||
for resource in resources:
|
||||
if resource.name == name:
|
||||
return resource
|
||||
return None
|
||||
|
||||
def create_resource(self, name: str, username: str, password: str,
|
||||
uri: Optional[str] = None,
|
||||
description: Optional[str] = None,
|
||||
folder_id: Optional[str] = None) -> str:
|
||||
"""Create a new password resource.
|
||||
|
||||
Args:
|
||||
name: Resource name
|
||||
username: Username
|
||||
password: Password
|
||||
uri: Optional URI/URL
|
||||
description: Optional description
|
||||
folder_id: Optional folder to place resource in
|
||||
|
||||
Returns:
|
||||
ID of created resource
|
||||
"""
|
||||
args = ['create', 'resource',
|
||||
'--name', name,
|
||||
'--username', username,
|
||||
'--password', password]
|
||||
|
||||
if uri:
|
||||
args.extend(['--uri', uri])
|
||||
if description:
|
||||
args.extend(['--description', description])
|
||||
if folder_id:
|
||||
args.extend(['--folder', folder_id])
|
||||
|
||||
result = self._run_passbolt(args)
|
||||
|
||||
# Parse the ID from output
|
||||
# Output format: "Resource created: <id>"
|
||||
for line in result.stdout.split('\n'):
|
||||
if 'created' in line.lower() and ':' in line:
|
||||
parts = line.split(':', 1)
|
||||
if len(parts) == 2:
|
||||
return parts[1].strip()
|
||||
|
||||
raise PassboltError("Failed to parse created resource ID")
|
||||
|
||||
def update_resource(self, resource_id: str,
|
||||
name: Optional[str] = None,
|
||||
username: Optional[str] = None,
|
||||
password: Optional[str] = None,
|
||||
uri: Optional[str] = None,
|
||||
description: Optional[str] = None) -> None:
|
||||
"""Update an existing resource.
|
||||
|
||||
Args:
|
||||
resource_id: ID of resource to update
|
||||
name: New name (optional)
|
||||
username: New username (optional)
|
||||
password: New password (optional)
|
||||
uri: New URI (optional)
|
||||
description: New description (optional)
|
||||
"""
|
||||
args = ['update', 'resource', '--id', resource_id]
|
||||
|
||||
if name:
|
||||
args.extend(['--name', name])
|
||||
if username:
|
||||
args.extend(['--username', username])
|
||||
if password:
|
||||
args.extend(['--password', password])
|
||||
if uri:
|
||||
args.extend(['--uri', uri])
|
||||
if description:
|
||||
args.extend(['--description', description])
|
||||
|
||||
self._run_passbolt(args)
|
||||
|
||||
def delete_resource(self, resource_id: str) -> None:
|
||||
"""Delete a resource.
|
||||
|
||||
Args:
|
||||
resource_id: ID of resource to delete
|
||||
"""
|
||||
self._run_passbolt(['delete', 'resource', '--id', resource_id])
|
||||
|
||||
def share_resource(self, resource_id: str, user_id: str,
|
||||
permission: str = "read") -> None:
|
||||
"""Share a resource with another user.
|
||||
|
||||
Args:
|
||||
resource_id: ID of resource to share
|
||||
user_id: ID of user to share with
|
||||
permission: Permission level ('read', 'update', 'owner')
|
||||
"""
|
||||
self._run_passbolt([
|
||||
'share', 'resource',
|
||||
'--id', resource_id,
|
||||
'--user', user_id,
|
||||
'--permission', permission
|
||||
])
|
||||
|
||||
def list_folders(self) -> List[Dict[str, Any]]:
|
||||
"""List all folders.
|
||||
|
||||
Returns:
|
||||
List of folder dictionaries
|
||||
"""
|
||||
result = self._run_passbolt(['list', 'folder', '--json'])
|
||||
|
||||
try:
|
||||
return json.loads(result.stdout)
|
||||
except json.JSONDecodeError:
|
||||
return []
|
||||
|
||||
def get_folder_by_name(self, name: str) -> Optional[Dict[str, Any]]:
|
||||
"""Find a folder by name.
|
||||
|
||||
Args:
|
||||
name: Folder name to search for
|
||||
|
||||
Returns:
|
||||
Folder dictionary or None
|
||||
"""
|
||||
folders = self.list_folders()
|
||||
for folder in folders:
|
||||
if folder.get('name') == name:
|
||||
return folder
|
||||
return None
|
||||
|
||||
def validate_resource_id(self, resource_id: str) -> bool:
|
||||
"""Check if a resource ID exists and is accessible.
|
||||
|
||||
Args:
|
||||
resource_id: UUID of the resource
|
||||
|
||||
Returns:
|
||||
True if resource exists and is accessible
|
||||
"""
|
||||
try:
|
||||
self._run_passbolt(['get', '--id', resource_id, '--field', 'name'])
|
||||
return True
|
||||
except PassboltError:
|
||||
return False
|
||||
Reference in New Issue
Block a user