mirror of
https://github.com/HKUDS/CLI-Anything.git
synced 2026-08-28 23:27:04 +08:00
feat: add cli-anything-jumpserver v0.1.0 harness (#346)
* feat: add cli-anything-jumpserver v0.1.0 harness - JUMP server bastion host CLI for AI agents and humans - Covers: assets, users, permissions, accounts, sessions, audit, system - Uses JumpServer REST API with Token authentication - 59 unit tests passing (mock backend) - Includes SKILL.md, registry.json entry, and SOP docs - Proper agent-harness directory structure following project conventions * Fix JumpServer harness validation blockers --------- Co-authored-by: yuhao <itsyuhao@icloud.com>
This commit is contained in:
Ayasaz
@@ -344,3 +344,6 @@ assets/gen_typing_gif.py
|
||||
!/notebooklm/agent-harness/
|
||||
!/intelwatch/
|
||||
!/intelwatch/agent-harness/
|
||||
!/jumpserver/
|
||||
!/jumpserver/agent-harness/
|
||||
!/cli_anything/jumpserver/
|
||||
|
||||
@@ -0,0 +1,145 @@
|
||||
# JumpServer CLI Harness - Standard Operating Procedure
|
||||
|
||||
## Software Overview
|
||||
|
||||
**JumpServer** is the most popular open-source Privileged Access Management (PAM) / bastion host platform. It provides centralized management of assets (servers, databases, network devices, web applications), user authentication and authorization, session auditing and replay, and command filtering.
|
||||
|
||||
- **Website:** https://www.jumpserver.com
|
||||
- **Repository:** https://github.com/jumpserver/jumpserver
|
||||
- **Version:** v4.0
|
||||
- **License:** GPLv3
|
||||
- **Tech Stack:** Django 4.1 + DRF 3.14 + Celery + Channels
|
||||
|
||||
## Architecture
|
||||
|
||||
### Core Components
|
||||
JumpServer is composed of multiple services:
|
||||
- **Core (Django):** REST API server, web UI backend
|
||||
- **KoKo:** SSH/Telnet connector (character protocol)
|
||||
- **Lion:** RDP/VNC connector (graphical protocol)
|
||||
- **Chen:** Database connector (Web DB)
|
||||
- **Lina:** Web UI frontend
|
||||
- **Luna:** Web terminal
|
||||
|
||||
### Data Model (Key Entities)
|
||||
- **Asset:** Polymorphic (Host, Device, Database, Web, Cloud, GPT, Custom)
|
||||
- **Node:** Tree-structured asset organization (key-based path)
|
||||
- **Platform:** Defines protocols, automation methods (Ansible, ping, gather facts, change secret)
|
||||
- **Account:** Credential management (password/SSH key), versioned with history
|
||||
- **User:** Extended Django User with MFA, face recognition, multiple auth sources
|
||||
- **AssetPermission:** Asset access rules linking users/groups to assets/nodes
|
||||
- **Session:** Connection session logging with replay support
|
||||
- **Ticket:** Multi-level approval workflow (login confirm, command confirm, asset apply)
|
||||
- **Gateway/Zone:** SSH tunnel proxy for indirect network access
|
||||
|
||||
### Authentication
|
||||
Supports 15+ auth backends: Local, LDAP, OAuth2, SAML2, OIDC, CAS, RADIUS, SSH Key, Passkey (WebAuthn/FIDO2), WeCom, DingTalk, FeiShu, Lark, Slack
|
||||
|
||||
## CLI Harness Design
|
||||
|
||||
### Command Groups Mapping
|
||||
|
||||
| CLI Group | API Endpoint | Function |
|
||||
|-----------|-------------|----------|
|
||||
| `auth` | `/api/v1/authentication/` | Session management |
|
||||
| `asset` | `/api/v1/assets/` | Asset CRUD, nodes, platforms, gateways, zones |
|
||||
| `user` | `/api/v1/users/` | User/group management, profile |
|
||||
| `perm` | `/api/v1/perms/` | Asset permission rules |
|
||||
| `account` | `/api/v1/accounts/` | Credential management, secrets, templates |
|
||||
| `session` | `/api/v1/terminal/` | Session monitoring, replay, terminals |
|
||||
| `audit` | `/api/v1/audits/` | Login/operate/FTP/password logs |
|
||||
| `ops` | `/api/v1/ops/` | Job execution, playbooks, ad-hoc commands |
|
||||
| `system` | `/api/v1/settings/` | System settings, health checks |
|
||||
| `label` | `/api/v1/labels/` | Label management |
|
||||
| `role` | `/api/v1/rbac/` | Role and binding management |
|
||||
|
||||
### State Model
|
||||
|
||||
```
|
||||
Session (persisted to ~/.jumpserver-cli/session.json):
|
||||
├── base_url : JumpServer instance URL
|
||||
├── username : Authenticated username
|
||||
├── token : Bearer API token
|
||||
├── token_expiry : Token expiration timestamp
|
||||
├── refresh_token : Token refresh credential
|
||||
├── org_id : Current organization (multi-org)
|
||||
└── verify_ssl : SSL verification flag
|
||||
|
||||
CLIState (persisted to ~/.jumpserver-cli/state.json):
|
||||
├── current_org_id : Active org
|
||||
├── selected_asset_ids : Selected assets for batch ops
|
||||
├── selected_node_ids : Selected nodes for batch ops
|
||||
├── last_filters : Previous search filters
|
||||
├── pagination : Page state
|
||||
└── dry_run : Dry run mode flag
|
||||
```
|
||||
|
||||
### Output Format Principles
|
||||
|
||||
1. **table** (default): Human-readable aligned columns
|
||||
2. **json**: Machine-parseable, supports `jq` processing
|
||||
3. **yaml**: Human-readable structured output
|
||||
|
||||
### Dry Run Pattern
|
||||
|
||||
All mutation commands support `--dry-run`:
|
||||
- Skips authentication check
|
||||
- Outputs planned action and payload
|
||||
- Returns exit code 0
|
||||
- Prevents any API calls
|
||||
|
||||
### Error Handling
|
||||
|
||||
- `CLIError`: User-facing error with message + detail
|
||||
- `CLI_ANYTHING_FORCE_INSTALLED=1`: Forces subprocess tests to use installed command
|
||||
- HTTP errors convert to CLIError with API detail message
|
||||
|
||||
## File Structure
|
||||
|
||||
```
|
||||
agent-harness/
|
||||
├── JUMPSERVER.md # This SOP document
|
||||
├── README.md # Installation and usage guide
|
||||
├── setup.py # PyPI package configuration
|
||||
└── cli_anything/ # PEP 420 namespace package (no __init__.py)
|
||||
└── jumpserver/ # Sub-package (has __init__.py)
|
||||
├── __init__.py # Package metadata
|
||||
├── jumpserver_cli.py # Main CLI entry point (Click)
|
||||
├── core/
|
||||
│ ├── __init__.py # Core module exports
|
||||
│ ├── session.py # Session + JumpServerClient
|
||||
│ ├── state.py # CLIState management
|
||||
│ ├── output.py # Output formatting (table/json/yaml)
|
||||
│ ├── commands_auth.py # Auth commands
|
||||
│ ├── commands_asset.py # Asset commands
|
||||
│ ├── commands_user.py # User commands
|
||||
│ ├── commands_perm.py # Permission commands
|
||||
│ ├── commands_account.py # Account commands
|
||||
│ ├── commands_session.py # Session commands
|
||||
│ ├── commands_audit.py # Audit + Ops commands
|
||||
│ └── commands_system.py # System + Label + Role commands
|
||||
├── utils/
|
||||
│ └── __init__.py # Utility functions and decorators
|
||||
├── skills/
|
||||
│ └── SKILL.md # Packaged skill compatibility copy
|
||||
└── tests/
|
||||
├── TEST.md # Test plan and results
|
||||
├── test_core.py # 59 unit tests
|
||||
└── test_full_e2e.py # 44 E2E tests
|
||||
skills/
|
||||
└── cli-anything-jumpserver/
|
||||
└── SKILL.md # Canonical skill definition
|
||||
```
|
||||
|
||||
## Testing Summary
|
||||
|
||||
- **103 tests total** (59 unit + 44 E2E), **100% pass rate**
|
||||
- Unit tests: Session, Client, State, Output formatting, Utilities
|
||||
- E2E tests: CLI discovery, Help output, Parameter validation, Dry run, Output formats, Workflow scenarios
|
||||
|
||||
## Known Limitations
|
||||
|
||||
1. Requires network access to JumpServer API for data-operating commands
|
||||
2. No local caching of assets/users (all queries hit API)
|
||||
3. REPL tab completion is command-aware but not context-aware
|
||||
4. No support for WebSocket operations (session logging, terminal status streaming)
|
||||
@@ -0,0 +1,54 @@
|
||||
# cli-anything-jumpserver
|
||||
|
||||
JumpServer bastion host CLI harness for AI agents and humans.
|
||||
|
||||
## Quick Start
|
||||
|
||||
```bash
|
||||
# Install
|
||||
pip install git+https://github.com/HKUDS/CLI-Anything.git#subdirectory=jumpserver/agent-harness
|
||||
|
||||
# Configure
|
||||
cli-anything-jumpserver config set base_url https://jumpserver.example.com
|
||||
cli-anything-jumpserver config set token YOUR_PRIVATE_TOKEN
|
||||
|
||||
# Test connection
|
||||
cli-anything-jumpserver config test
|
||||
|
||||
# Start using
|
||||
cli-anything-jumpserver asset list
|
||||
cli-anything-jumpserver --interactive
|
||||
```
|
||||
|
||||
## Prerequisites
|
||||
|
||||
- Python 3.10+
|
||||
- JumpServer v3.0+ instance with API access
|
||||
- JumpServer Private Token (generated via Django shell: `u.create_private_token()`)
|
||||
|
||||
## Features
|
||||
|
||||
- Asset management (hosts, devices, databases, clouds, nodes, platforms, gateways)
|
||||
- User management (CRUD, groups, MFA reset, password management)
|
||||
- Permission management (asset permissions, user permissions)
|
||||
- Account management (credentials, secrets, templates)
|
||||
- Session management (list, kill, replay, terminal status)
|
||||
- Audit logs (login, operate, FTP, password change)
|
||||
- System operations (settings, health, labels, roles)
|
||||
|
||||
## Output Formats
|
||||
|
||||
- Table (default, human-readable)
|
||||
- JSON (`--json-output` flag for programmatic consumption)
|
||||
|
||||
## Testing
|
||||
|
||||
```bash
|
||||
# Unit tests (no backend required)
|
||||
pytest cli_anything/jumpserver/tests/test_core.py -v
|
||||
|
||||
# E2E tests (requires JumpServer instance)
|
||||
JUMPSERVER_URL=https://jumpserver.example.com \
|
||||
JUMPSERVER_TOKEN=your_token \
|
||||
pytest cli_anything/jumpserver/tests/test_full_e2e.py -v
|
||||
```
|
||||
@@ -0,0 +1,9 @@
|
||||
"""
|
||||
cli_anything.jumpserver - JumpServer CLI Harness
|
||||
|
||||
A stateful CLI for managing JumpServer bastion host operations.
|
||||
Supports both one-shot commands and interactive REPL mode with --json output.
|
||||
"""
|
||||
|
||||
__version__ = "0.1.0"
|
||||
__author__ = "cli-anything"
|
||||
@@ -0,0 +1,4 @@
|
||||
"""Allow running as python -m cli_anything.jumpserver."""
|
||||
from cli_anything.jumpserver.jumpserver_cli import cli_main
|
||||
|
||||
cli_main()
|
||||
@@ -0,0 +1,15 @@
|
||||
"""
|
||||
Core modules for cli_anything.jumpserver.
|
||||
"""
|
||||
from cli_anything.jumpserver.core.session import Session, JumpServerClient
|
||||
from cli_anything.jumpserver.core.output import format_output
|
||||
from cli_anything.jumpserver.core.state import CLIState, get_state, reset_state
|
||||
|
||||
__all__ = [
|
||||
"Session",
|
||||
"JumpServerClient",
|
||||
"format_output",
|
||||
"CLIState",
|
||||
"get_state",
|
||||
"reset_state",
|
||||
]
|
||||
@@ -0,0 +1,236 @@
|
||||
"""
|
||||
Account management commands for JumpServer CLI.
|
||||
|
||||
Manages asset accounts, templates, automations, and secrets.
|
||||
"""
|
||||
import click
|
||||
|
||||
from cli_anything.jumpserver.core.session import Session
|
||||
from cli_anything.jumpserver.utils import (
|
||||
require_auth,
|
||||
handle_api_error,
|
||||
parse_ids,
|
||||
print_result,
|
||||
mask_sensitive_data,
|
||||
should_emit_human_text,
|
||||
)
|
||||
|
||||
|
||||
@click.group(name="account")
|
||||
def account_group():
|
||||
"""Manage asset accounts and credentials."""
|
||||
pass
|
||||
|
||||
|
||||
# ─── Accounts CRUD ──────────────────────────────────────────
|
||||
|
||||
|
||||
@account_group.command(name="list")
|
||||
@click.option("--search", "-s", default=None, help="Search by username or name")
|
||||
@click.option("--asset", "-a", default=None, help="Filter by asset ID")
|
||||
@click.option("--secret-type", default=None, type=click.Choice(["password", "ssh_key"]), help="Secret type")
|
||||
@click.option("--privileged/--unprivileged", default=None, help="Filter by privileged status")
|
||||
@click.option("--active/--inactive", default=None, help="Filter by active status")
|
||||
@click.option("--limit", default=20, help="Results per page")
|
||||
@click.option("--offset", default=0, help="Pagination offset")
|
||||
@click.option("--output", "-o", type=click.Choice(["table", "json", "yaml"]), default="table", help="Output format")
|
||||
@click.option("--columns", "-c", default="username,name,asset,secret_type,privileged,is_active", help="Comma-separated column names")
|
||||
def list_accounts(search, asset, secret_type, privileged, active, limit, offset, output, columns):
|
||||
"""List asset accounts."""
|
||||
session = Session.load()
|
||||
client = require_auth(session)
|
||||
|
||||
params = {"limit": limit, "offset": offset}
|
||||
if search:
|
||||
params["search"] = search
|
||||
if asset:
|
||||
params["asset"] = asset
|
||||
if secret_type:
|
||||
params["secret_type"] = secret_type
|
||||
if privileged is not None:
|
||||
params["privileged"] = str(privileged).lower()
|
||||
if active is not None:
|
||||
params["is_active"] = str(active).lower()
|
||||
|
||||
resp = client.get("accounts/accounts/", params=params)
|
||||
handle_api_error(resp, "list accounts")
|
||||
print_result(resp.json(), fmt=output, columns=columns)
|
||||
|
||||
|
||||
@account_group.command(name="get")
|
||||
@click.argument("account_id")
|
||||
@click.option("--output", "-o", type=click.Choice(["table", "json", "yaml"]), default="table", help="Output format")
|
||||
def get_account(account_id, output):
|
||||
"""Get account details."""
|
||||
session = Session.load()
|
||||
client = require_auth(session)
|
||||
resp = client.get(f"accounts/accounts/{account_id}/")
|
||||
handle_api_error(resp, "get account")
|
||||
print_result(resp.json(), fmt=output)
|
||||
|
||||
|
||||
@account_group.command(name="create")
|
||||
@click.option("--asset", "-a", required=True, type=int, help="Asset ID")
|
||||
@click.option("--username", required=True, help="Account username")
|
||||
@click.option("--name", default=None, help="Display name")
|
||||
@click.option("--secret-type", default="password", type=click.Choice(["password", "ssh_key"]), help="Secret type")
|
||||
@click.option("--secret", default=None, help="Password or SSH private key")
|
||||
@click.option("--privileged", is_flag=True, help="Is privileged account")
|
||||
@click.option("--active/--inactive", default=True, help="Active status")
|
||||
@click.option("--comment", default=None, help="Comment")
|
||||
@click.option("--output", "-o", type=click.Choice(["table", "json", "yaml"]), default="table", help="Output format")
|
||||
@click.option("--dry-run", is_flag=True, help="Preview without executing")
|
||||
def create_account(asset, username, name, secret_type, secret, privileged, active, comment, output, dry_run):
|
||||
"""Create a new asset account."""
|
||||
data = {
|
||||
"asset": asset,
|
||||
"username": username,
|
||||
"secret_type": secret_type,
|
||||
"privileged": privileged,
|
||||
"is_active": active,
|
||||
}
|
||||
if name:
|
||||
data["name"] = name
|
||||
if secret:
|
||||
data["secret"] = secret
|
||||
if comment:
|
||||
data["comment"] = comment
|
||||
|
||||
if dry_run:
|
||||
print_result(
|
||||
{"action": "create account", "data": mask_sensitive_data(data)},
|
||||
fmt=output,
|
||||
)
|
||||
return
|
||||
|
||||
session = Session.load()
|
||||
client = require_auth(session)
|
||||
resp = client.post("accounts/accounts/", data=data)
|
||||
handle_api_error(resp, "create account")
|
||||
print_result(resp.json(), fmt=output)
|
||||
if should_emit_human_text(output):
|
||||
click.echo(click.style(f"\n✓ Account '{username}' created.", fg="green"))
|
||||
|
||||
|
||||
@account_group.command(name="update")
|
||||
@click.argument("account_id")
|
||||
@click.option("--username", default=None, help="New username")
|
||||
@click.option("--name", default=None, help="New display name")
|
||||
@click.option("--secret-type", default=None, type=click.Choice(["password", "ssh_key"]), help="New secret type")
|
||||
@click.option("--secret", default=None, help="New password or SSH key")
|
||||
@click.option("--privileged/--unprivileged", default=None, help="Set privileged status")
|
||||
@click.option("--active/--inactive", default=None, help="Set active status")
|
||||
@click.option("--output", "-o", type=click.Choice(["table", "json", "yaml"]), default="table", help="Output format")
|
||||
@click.option("--dry-run", is_flag=True, help="Preview without executing")
|
||||
def update_account(account_id, username, name, secret_type, secret, privileged, active, output, dry_run):
|
||||
"""Update an asset account."""
|
||||
data = {}
|
||||
if username is not None:
|
||||
data["username"] = username
|
||||
if name is not None:
|
||||
data["name"] = name
|
||||
if secret_type is not None:
|
||||
data["secret_type"] = secret_type
|
||||
if secret is not None:
|
||||
data["secret"] = secret
|
||||
if privileged is not None:
|
||||
data["privileged"] = privileged
|
||||
if active is not None:
|
||||
data["is_active"] = active
|
||||
|
||||
if dry_run:
|
||||
print_result(
|
||||
{
|
||||
"action": "update account",
|
||||
"id": account_id,
|
||||
"data": mask_sensitive_data(data),
|
||||
},
|
||||
fmt=output,
|
||||
)
|
||||
return
|
||||
|
||||
session = Session.load()
|
||||
client = require_auth(session)
|
||||
resp = client.put(f"accounts/accounts/{account_id}/", data=data)
|
||||
handle_api_error(resp, "update account")
|
||||
print_result(resp.json(), fmt=output)
|
||||
if should_emit_human_text(output):
|
||||
click.echo(click.style(f"\n✓ Account '{account_id}' updated.", fg="green"))
|
||||
|
||||
|
||||
@account_group.command(name="delete")
|
||||
@click.argument("account_id")
|
||||
@click.option("--force", "-f", is_flag=True, help="Skip confirmation")
|
||||
@click.option("--dry-run", is_flag=True, help="Preview without executing")
|
||||
def delete_account(account_id, force, dry_run):
|
||||
"""Delete an asset account."""
|
||||
if dry_run:
|
||||
click.echo(f"[DRY RUN] Would delete account: {account_id}")
|
||||
return
|
||||
if not force:
|
||||
click.confirm(f"Delete account '{account_id}'?", abort=True)
|
||||
|
||||
session = Session.load()
|
||||
client = require_auth(session)
|
||||
resp = client.delete(f"accounts/accounts/{account_id}/")
|
||||
handle_api_error(resp, "delete account")
|
||||
click.echo(click.style(f"✓ Account '{account_id}' deleted.", fg="green"))
|
||||
|
||||
|
||||
# ─── Secrets ─────────────────────────────────────────────────
|
||||
|
||||
|
||||
@account_group.group(name="secret")
|
||||
def secret_group():
|
||||
"""View account secrets/passwords."""
|
||||
pass
|
||||
|
||||
|
||||
@secret_group.command(name="view")
|
||||
@click.argument("account_id")
|
||||
@click.option("--output", "-o", type=click.Choice(["table", "json", "yaml"]), default="table", help="Output format")
|
||||
def view_secret(account_id, output):
|
||||
"""View an account's password/secret (requires permission)."""
|
||||
session = Session.load()
|
||||
client = require_auth(session)
|
||||
resp = client.get(f"accounts/account-secrets/{account_id}/")
|
||||
handle_api_error(resp, "view secret")
|
||||
print_result(resp.json(), fmt=output)
|
||||
|
||||
|
||||
@secret_group.command(name="history")
|
||||
@click.argument("account_id")
|
||||
@click.option("--output", "-o", type=click.Choice(["table", "json", "yaml"]), default="table", help="Output format")
|
||||
def secret_history(account_id, output):
|
||||
"""View password change history for an account."""
|
||||
session = Session.load()
|
||||
client = require_auth(session)
|
||||
resp = client.get(f"accounts/account-secrets/{account_id}/histories/")
|
||||
handle_api_error(resp, "get secret history")
|
||||
print_result(resp.json(), fmt=output)
|
||||
|
||||
|
||||
# ─── Account Templates ──────────────────────────────────────
|
||||
|
||||
|
||||
@account_group.group(name="template")
|
||||
def template_group():
|
||||
"""Manage account templates."""
|
||||
pass
|
||||
|
||||
|
||||
@template_group.command(name="list")
|
||||
@click.option("--search", "-s", default=None, help="Search by name")
|
||||
@click.option("--output", "-o", type=click.Choice(["table", "json", "yaml"]), default="table", help="Output format")
|
||||
def list_templates(search, output):
|
||||
"""List account templates."""
|
||||
session = Session.load()
|
||||
client = require_auth(session)
|
||||
|
||||
params = {}
|
||||
if search:
|
||||
params["search"] = search
|
||||
|
||||
resp = client.get("accounts/account-templates/", params=params)
|
||||
handle_api_error(resp, "list templates")
|
||||
print_result(resp.json(), fmt=output)
|
||||
@@ -0,0 +1,407 @@
|
||||
"""
|
||||
Asset management commands for JumpServer CLI.
|
||||
|
||||
Manages hosts, devices, databases, nodes, platforms, gateways, and zones.
|
||||
"""
|
||||
import click
|
||||
|
||||
from cli_anything.jumpserver.core.session import Session
|
||||
from cli_anything.jumpserver.utils import (
|
||||
require_auth,
|
||||
handle_api_error,
|
||||
parse_ids,
|
||||
print_result,
|
||||
should_emit_human_text,
|
||||
)
|
||||
|
||||
|
||||
@click.group(name="asset")
|
||||
def asset_group():
|
||||
"""Manage assets (hosts, devices, databases, nodes, etc.)."""
|
||||
pass
|
||||
|
||||
|
||||
# ─── Assets CRUD ──────────────────────────────────────────────
|
||||
|
||||
|
||||
@asset_group.command(name="list")
|
||||
@click.option("--type", "-t", "asset_type", type=click.Choice(["host", "device", "database", "web", "cloud", "gpt", "ds", "custom"]), default="host", help="Asset type")
|
||||
@click.option("--search", "-s", default=None, help="Search by name or address")
|
||||
@click.option("--node", "-n", default=None, help="Filter by node ID")
|
||||
@click.option("--platform", "-p", default=None, help="Filter by platform ID")
|
||||
@click.option("--active/--inactive", default=None, help="Filter by active status")
|
||||
@click.option("--limit", default=20, help="Results per page")
|
||||
@click.option("--offset", default=0, help="Pagination offset")
|
||||
@click.option("--output", "-o", type=click.Choice(["table", "json", "yaml"]), default="table", help="Output format")
|
||||
@click.option("--columns", "-c", default=None, help="Comma-separated column names")
|
||||
def list_assets(asset_type, search, node, platform, active, limit, offset, output, columns):
|
||||
"""List assets of a given type."""
|
||||
session = Session.load()
|
||||
client = require_auth(session)
|
||||
|
||||
type_map = {
|
||||
"host": "hosts", "device": "devices", "database": "databases",
|
||||
"web": "webs", "cloud": "clouds", "gpt": "gpts",
|
||||
"ds": "directories", "custom": "customs",
|
||||
}
|
||||
endpoint = type_map.get(asset_type, "hosts")
|
||||
|
||||
params = {"limit": limit, "offset": offset}
|
||||
if search:
|
||||
params["search"] = search
|
||||
if node:
|
||||
params["node"] = node
|
||||
if platform:
|
||||
params["platform"] = platform
|
||||
if active is not None:
|
||||
params["is_active"] = str(active).lower()
|
||||
|
||||
resp = client.get(f"assets/{endpoint}/", params=params)
|
||||
handle_api_error(resp, "list assets")
|
||||
print_result(resp.json(), fmt=output, columns=columns)
|
||||
|
||||
|
||||
@asset_group.command(name="get")
|
||||
@click.argument("asset_id")
|
||||
@click.option("--type", "-t", "asset_type", type=click.Choice(["host", "device", "database", "web", "cloud", "gpt", "ds", "custom"]), default="host", help="Asset type")
|
||||
@click.option("--output", "-o", type=click.Choice(["table", "json", "yaml"]), default="table", help="Output format")
|
||||
def get_asset(asset_id, asset_type, output):
|
||||
"""Get details of a specific asset."""
|
||||
session = Session.load()
|
||||
client = require_auth(session)
|
||||
|
||||
type_map = {
|
||||
"host": "hosts", "device": "devices", "database": "databases",
|
||||
"web": "webs", "cloud": "clouds", "gpt": "gpts",
|
||||
"ds": "directories", "custom": "customs",
|
||||
}
|
||||
endpoint = type_map.get(asset_type, "hosts")
|
||||
|
||||
resp = client.get(f"assets/{endpoint}/{asset_id}/")
|
||||
handle_api_error(resp, "get asset")
|
||||
print_result(resp.json(), fmt=output)
|
||||
|
||||
|
||||
@asset_group.command(name="create")
|
||||
@click.option("--name", required=True, help="Asset name")
|
||||
@click.option("--address", required=True, help="IP address or hostname")
|
||||
@click.option("--platform", "-p", required=True, type=int, help="Platform ID")
|
||||
@click.option("--type", "-t", "asset_type", type=click.Choice(["host", "device", "database", "web", "cloud", "gpt", "ds", "custom"]), default="host", help="Asset type")
|
||||
@click.option("--nodes", default=None, help="Comma-separated node IDs")
|
||||
@click.option("--comment", default=None, help="Comment")
|
||||
@click.option("--domain", default=None, help="Domain (for domain assets)")
|
||||
@click.option("--active/--inactive", default=True, help="Active status")
|
||||
@click.option("--output", "-o", type=click.Choice(["table", "json", "yaml"]), default="table", help="Output format")
|
||||
@click.option("--dry-run", is_flag=True, help="Preview without executing")
|
||||
def create_asset(name, address, platform, asset_type, nodes, comment, domain, active, output, dry_run):
|
||||
"""Create a new asset."""
|
||||
type_map = {
|
||||
"host": "hosts", "device": "devices", "database": "databases",
|
||||
"web": "webs", "cloud": "clouds", "gpt": "gpts",
|
||||
"ds": "directories", "custom": "customs",
|
||||
}
|
||||
endpoint = type_map.get(asset_type, "hosts")
|
||||
|
||||
data = {
|
||||
"name": name,
|
||||
"address": address,
|
||||
"platform": platform,
|
||||
"is_active": active,
|
||||
}
|
||||
if nodes:
|
||||
data["nodes"] = parse_ids(nodes)
|
||||
if comment:
|
||||
data["comment"] = comment
|
||||
if domain:
|
||||
data["domain"] = domain
|
||||
|
||||
if dry_run:
|
||||
print_result({"action": "create", "endpoint": f"assets/{endpoint}/", "data": data}, fmt=output)
|
||||
return
|
||||
|
||||
session = Session.load()
|
||||
client = require_auth(session)
|
||||
|
||||
resp = client.post(f"assets/{endpoint}/", data=data)
|
||||
handle_api_error(resp, "create asset")
|
||||
print_result(resp.json(), fmt=output)
|
||||
if should_emit_human_text(output):
|
||||
click.echo(click.style(f"\n✓ Asset '{name}' created.", fg="green"))
|
||||
|
||||
|
||||
@asset_group.command(name="update")
|
||||
@click.argument("asset_id")
|
||||
@click.option("--type", "-t", "asset_type", type=click.Choice(["host", "device", "database", "web", "cloud", "gpt", "ds", "custom"]), default="host", help="Asset type")
|
||||
@click.option("--name", default=None, help="New name")
|
||||
@click.option("--address", default=None, help="New address")
|
||||
@click.option("--comment", default=None, help="New comment")
|
||||
@click.option("--active/--inactive", default=None, help="Set active status")
|
||||
@click.option("--output", "-o", type=click.Choice(["table", "json", "yaml"]), default="table", help="Output format")
|
||||
@click.option("--dry-run", is_flag=True, help="Preview without executing")
|
||||
def update_asset(asset_id, asset_type, name, address, comment, active, output, dry_run):
|
||||
"""Update an existing asset."""
|
||||
session = Session.load()
|
||||
client = require_auth(session)
|
||||
|
||||
type_map = {
|
||||
"host": "hosts", "device": "devices", "database": "databases",
|
||||
"web": "webs", "cloud": "clouds", "gpt": "gpts",
|
||||
"ds": "directories", "custom": "customs",
|
||||
}
|
||||
endpoint = type_map.get(asset_type, "hosts")
|
||||
|
||||
data = {}
|
||||
if name is not None:
|
||||
data["name"] = name
|
||||
if address is not None:
|
||||
data["address"] = address
|
||||
if comment is not None:
|
||||
data["comment"] = comment
|
||||
if active is not None:
|
||||
data["is_active"] = active
|
||||
|
||||
if dry_run:
|
||||
print_result({"action": "update", "endpoint": f"assets/{endpoint}/{asset_id}/", "data": data}, fmt=output)
|
||||
return
|
||||
|
||||
resp = client.put(f"assets/{endpoint}/{asset_id}/", data=data)
|
||||
handle_api_error(resp, "update asset")
|
||||
print_result(resp.json(), fmt=output)
|
||||
if should_emit_human_text(output):
|
||||
click.echo(click.style(f"\n✓ Asset '{asset_id}' updated.", fg="green"))
|
||||
|
||||
|
||||
@asset_group.command(name="delete")
|
||||
@click.argument("asset_id")
|
||||
@click.option("--type", "-t", "asset_type", type=click.Choice(["host", "device", "database", "web", "cloud", "gpt", "ds", "custom"]), default="host", help="Asset type")
|
||||
@click.option("--force", "-f", is_flag=True, help="Skip confirmation")
|
||||
@click.option("--dry-run", is_flag=True, help="Preview without executing")
|
||||
def delete_asset(asset_id, asset_type, force, dry_run):
|
||||
"""Delete an asset."""
|
||||
if dry_run:
|
||||
click.echo(f"[DRY RUN] Would delete {asset_type} asset: {asset_id}")
|
||||
return
|
||||
|
||||
if not force:
|
||||
click.confirm(f"Delete {asset_type} asset '{asset_id}'?", abort=True)
|
||||
|
||||
session = Session.load()
|
||||
client = require_auth(session)
|
||||
|
||||
type_map = {
|
||||
"host": "hosts", "device": "devices", "database": "databases",
|
||||
"web": "webs", "cloud": "clouds", "gpt": "gpts",
|
||||
"ds": "directories", "custom": "customs",
|
||||
}
|
||||
endpoint = type_map.get(asset_type, "hosts")
|
||||
|
||||
resp = client.delete(f"assets/{endpoint}/{asset_id}/")
|
||||
handle_api_error(resp, "delete asset")
|
||||
click.echo(click.style(f"✓ Asset '{asset_id}' deleted.", fg="green"))
|
||||
|
||||
|
||||
# ─── Nodes ────────────────────────────────────────────────────
|
||||
|
||||
|
||||
@asset_group.group(name="node")
|
||||
def node_group():
|
||||
"""Manage asset nodes (tree organization)."""
|
||||
pass
|
||||
|
||||
|
||||
@node_group.command(name="list")
|
||||
@click.option("--parent", "-p", default=None, help="Parent node ID or key")
|
||||
@click.option("--search", "-s", default=None, help="Search by name")
|
||||
@click.option("--tree", is_flag=True, help="Show full tree")
|
||||
@click.option("--output", "-o", type=click.Choice(["table", "json", "yaml"]), default="table", help="Output format")
|
||||
def list_nodes(parent, search, tree, output):
|
||||
"""List asset nodes."""
|
||||
session = Session.load()
|
||||
client = require_auth(session)
|
||||
|
||||
if tree:
|
||||
resp = client.get("assets/nodes/children/tree/")
|
||||
elif parent:
|
||||
resp = client.get(f"assets/nodes/{parent}/children/")
|
||||
else:
|
||||
params = {}
|
||||
if search:
|
||||
params["search"] = search
|
||||
resp = client.get("assets/nodes/", params=params)
|
||||
|
||||
handle_api_error(resp, "list nodes")
|
||||
data = resp.json()
|
||||
print_result(data, fmt=output)
|
||||
|
||||
if should_emit_human_text(output) and isinstance(data, list):
|
||||
_print_node_tree(data)
|
||||
|
||||
|
||||
def _print_node_tree(nodes, indent=0):
|
||||
"""Helper to print node tree structure."""
|
||||
for node in nodes:
|
||||
prefix = " " * indent + ("├── " if indent > 0 else "")
|
||||
name = node.get("name", node.get("value", str(node)))
|
||||
node_id = node.get("id", "")
|
||||
click.echo(f"{prefix}{name} ({node_id})")
|
||||
children = node.get("children", [])
|
||||
if children:
|
||||
_print_node_tree(children, indent + 1)
|
||||
|
||||
|
||||
@node_group.command(name="create")
|
||||
@click.option("--name", required=True, help="Node name")
|
||||
@click.option("--parent", "-p", default=None, help="Parent node ID")
|
||||
@click.option("--output", "-o", type=click.Choice(["table", "json", "yaml"]), default="table", help="Output format")
|
||||
@click.option("--dry-run", is_flag=True, help="Preview without executing")
|
||||
def create_node(name, parent, output, dry_run):
|
||||
"""Create a new asset node."""
|
||||
session = Session.load()
|
||||
client = require_auth(session)
|
||||
|
||||
data = {"value": name}
|
||||
if parent:
|
||||
data["parent"] = parent
|
||||
|
||||
if dry_run:
|
||||
print_result({"action": "create node", "data": data}, fmt=output)
|
||||
return
|
||||
|
||||
resp = client.post("assets/nodes/", data=data)
|
||||
handle_api_error(resp, "create node")
|
||||
print_result(resp.json(), fmt=output)
|
||||
if should_emit_human_text(output):
|
||||
click.echo(click.style(f"\n✓ Node '{name}' created.", fg="green"))
|
||||
|
||||
|
||||
@node_group.command(name="delete")
|
||||
@click.argument("node_id")
|
||||
@click.option("--force", "-f", is_flag=True, help="Skip confirmation")
|
||||
@click.option("--dry-run", is_flag=True, help="Preview without executing")
|
||||
def delete_node(node_id, force, dry_run):
|
||||
"""Delete an asset node."""
|
||||
if dry_run:
|
||||
click.echo(f"[DRY RUN] Would delete node: {node_id}")
|
||||
return
|
||||
if not force:
|
||||
click.confirm(f"Delete node '{node_id}'?", abort=True)
|
||||
|
||||
session = Session.load()
|
||||
client = require_auth(session)
|
||||
resp = client.delete(f"assets/nodes/{node_id}/")
|
||||
handle_api_error(resp, "delete node")
|
||||
click.echo(click.style(f"✓ Node '{node_id}' deleted.", fg="green"))
|
||||
|
||||
|
||||
@node_group.command(name="add-assets")
|
||||
@click.argument("node_id")
|
||||
@click.option("--assets", "-a", required=True, help="Comma-separated asset IDs")
|
||||
@click.option("--output", "-o", type=click.Choice(["table", "json", "yaml"]), default="table", help="Output format")
|
||||
@click.option("--dry-run", is_flag=True, help="Preview without executing")
|
||||
def add_assets_to_node(node_id, assets, output, dry_run):
|
||||
"""Add assets to a node."""
|
||||
asset_ids = parse_ids(assets)
|
||||
if dry_run:
|
||||
print_result({"action": "add assets to node", "node": node_id, "assets": asset_ids}, fmt=output)
|
||||
return
|
||||
|
||||
session = Session.load()
|
||||
client = require_auth(session)
|
||||
resp = client.post(f"assets/nodes/{node_id}/assets/add/", data={"assets": asset_ids})
|
||||
handle_api_error(resp, "add assets to node")
|
||||
print_result(resp.json(), fmt=output)
|
||||
if should_emit_human_text(output):
|
||||
click.echo(click.style(f"\n✓ Assets added to node '{node_id}'.", fg="green"))
|
||||
|
||||
|
||||
# ─── Platforms ─────────────────────────────────────────────────
|
||||
|
||||
|
||||
@asset_group.group(name="platform")
|
||||
def platform_group():
|
||||
"""Manage asset platforms."""
|
||||
pass
|
||||
|
||||
|
||||
@platform_group.command(name="list")
|
||||
@click.option("--search", "-s", default=None, help="Search by name")
|
||||
@click.option("--category", "-c", default=None, help="Filter by category")
|
||||
@click.option("--output", "-o", type=click.Choice(["table", "json", "yaml"]), default="table", help="Output format")
|
||||
def list_platforms(search, category, output):
|
||||
"""List asset platforms."""
|
||||
session = Session.load()
|
||||
client = require_auth(session)
|
||||
|
||||
params = {}
|
||||
if search:
|
||||
params["search"] = search
|
||||
if category:
|
||||
params["category"] = category
|
||||
|
||||
resp = client.get("assets/platforms/", params=params)
|
||||
handle_api_error(resp, "list platforms")
|
||||
print_result(resp.json(), fmt=output)
|
||||
|
||||
|
||||
# ─── Gateways ──────────────────────────────────────────────────
|
||||
|
||||
|
||||
@asset_group.group(name="gateway")
|
||||
def gateway_group():
|
||||
"""Manage gateways."""
|
||||
pass
|
||||
|
||||
|
||||
@gateway_group.command(name="list")
|
||||
@click.option("--search", "-s", default=None, help="Search by name or address")
|
||||
@click.option("--output", "-o", type=click.Choice(["table", "json", "yaml"]), default="table", help="Output format")
|
||||
def list_gateways(search, output):
|
||||
"""List gateways."""
|
||||
session = Session.load()
|
||||
client = require_auth(session)
|
||||
|
||||
params = {}
|
||||
if search:
|
||||
params["search"] = search
|
||||
|
||||
resp = client.get("assets/gateways/", params=params)
|
||||
handle_api_error(resp, "list gateways")
|
||||
print_result(resp.json(), fmt=output)
|
||||
|
||||
|
||||
@gateway_group.command(name="test")
|
||||
@click.argument("gateway_id")
|
||||
@click.option("--output", "-o", type=click.Choice(["table", "json", "yaml"]), default="table", help="Output format")
|
||||
def test_gateway(gateway_id, output):
|
||||
"""Test gateway connectivity."""
|
||||
session = Session.load()
|
||||
client = require_auth(session)
|
||||
resp = client.get(f"assets/gateways/{gateway_id}/test-connective/")
|
||||
handle_api_error(resp, "test gateway")
|
||||
print_result(resp.json(), fmt=output)
|
||||
|
||||
|
||||
# ─── Zones ─────────────────────────────────────────────────────
|
||||
|
||||
|
||||
@asset_group.group(name="zone")
|
||||
def zone_group():
|
||||
"""Manage zones (network domains)."""
|
||||
pass
|
||||
|
||||
|
||||
@zone_group.command(name="list")
|
||||
@click.option("--search", "-s", default=None, help="Search by name")
|
||||
@click.option("--output", "-o", type=click.Choice(["table", "json", "yaml"]), default="table", help="Output format")
|
||||
def list_zones(search, output):
|
||||
"""List zones."""
|
||||
session = Session.load()
|
||||
client = require_auth(session)
|
||||
|
||||
params = {}
|
||||
if search:
|
||||
params["search"] = search
|
||||
|
||||
resp = client.get("assets/zones/", params=params)
|
||||
handle_api_error(resp, "list zones")
|
||||
print_result(resp.json(), fmt=output)
|
||||
@@ -0,0 +1,217 @@
|
||||
"""
|
||||
Audit and operations commands for JumpServer CLI.
|
||||
|
||||
Manages audit logs, login logs, operate logs, and job execution.
|
||||
"""
|
||||
import click
|
||||
|
||||
from cli_anything.jumpserver.core.session import Session
|
||||
from cli_anything.jumpserver.utils import (
|
||||
require_auth,
|
||||
handle_api_error,
|
||||
print_result,
|
||||
)
|
||||
|
||||
|
||||
@click.group(name="audit")
|
||||
def audit_group():
|
||||
"""View audit logs and reports."""
|
||||
pass
|
||||
|
||||
|
||||
# ─── Login Logs ──────────────────────────────────────────────
|
||||
|
||||
|
||||
@audit_group.command(name="login")
|
||||
@click.option("--search", "-s", default=None, help="Search by username")
|
||||
@click.option("--status", default=None, type=click.Choice(["success", "failed"]), help="Login status")
|
||||
@click.option("--limit", default=20, help="Results per page")
|
||||
@click.option("--offset", default=0, help="Pagination offset")
|
||||
@click.option("--output", "-o", type=click.Choice(["table", "json", "yaml"]), default="table", help="Output format")
|
||||
def login_logs(search, status, limit, offset, output):
|
||||
"""View user login audit logs."""
|
||||
sess = Session.load()
|
||||
client = require_auth(sess)
|
||||
|
||||
params = {"limit": limit, "offset": offset}
|
||||
if search:
|
||||
params["search"] = search
|
||||
if status:
|
||||
params["status"] = "1" if status == "success" else "0"
|
||||
|
||||
resp = client.get("audits/login-logs/", params=params)
|
||||
handle_api_error(resp, "get login logs")
|
||||
print_result(resp.json(), fmt=output)
|
||||
|
||||
|
||||
# ─── Operate Logs ────────────────────────────────────────────
|
||||
|
||||
|
||||
@audit_group.command(name="operate")
|
||||
@click.option("--search", "-s", default=None, help="Search by user or resource")
|
||||
@click.option("--user", "-u", default=None, help="Filter by user ID")
|
||||
@click.option("--action", "-a", default=None, type=click.Choice(["create", "update", "delete"]), help="Action type")
|
||||
@click.option("--resource", "-r", default=None, help="Resource type (e.g., Asset, User)")
|
||||
@click.option("--limit", default=20, help="Results per page")
|
||||
@click.option("--offset", default=0, help="Pagination offset")
|
||||
@click.option("--output", "-o", type=click.Choice(["table", "json", "yaml"]), default="table", help="Output format")
|
||||
@click.option("--columns", "-c", default="user,action,resource_type,resource,datetime", help="Comma-separated column names")
|
||||
def operate_logs(search, user, action, resource, limit, offset, output, columns):
|
||||
"""View resource operation audit logs."""
|
||||
sess = Session.load()
|
||||
client = require_auth(sess)
|
||||
|
||||
params = {"limit": limit, "offset": offset}
|
||||
if search:
|
||||
params["search"] = search
|
||||
if user:
|
||||
params["user"] = user
|
||||
if action:
|
||||
params["action"] = action
|
||||
if resource:
|
||||
params["resource_type"] = resource
|
||||
|
||||
resp = client.get("audits/operate-logs/", params=params)
|
||||
handle_api_error(resp, "get operate logs")
|
||||
print_result(resp.json(), fmt=output, columns=columns)
|
||||
|
||||
|
||||
# ─── FTP Logs ────────────────────────────────────────────────
|
||||
|
||||
|
||||
@audit_group.command(name="ftp")
|
||||
@click.option("--search", "-s", default=None, help="Search by user or filename")
|
||||
@click.option("--user", "-u", default=None, help="Filter by user ID")
|
||||
@click.option("--limit", default=20, help="Results per page")
|
||||
@click.option("--offset", default=0, help="Pagination offset")
|
||||
@click.option("--output", "-o", type=click.Choice(["table", "json", "yaml"]), default="table", help="Output format")
|
||||
def ftp_logs(search, user, limit, offset, output):
|
||||
"""View FTP file transfer audit logs."""
|
||||
sess = Session.load()
|
||||
client = require_auth(sess)
|
||||
|
||||
params = {"limit": limit, "offset": offset}
|
||||
if search:
|
||||
params["search"] = search
|
||||
if user:
|
||||
params["user"] = user
|
||||
|
||||
resp = client.get("audits/ftp-logs/", params=params)
|
||||
handle_api_error(resp, "get FTP logs")
|
||||
print_result(resp.json(), fmt=output)
|
||||
|
||||
|
||||
# ─── Password Change Logs ─────────────────────────────────────
|
||||
|
||||
|
||||
@audit_group.command(name="password")
|
||||
@click.option("--search", "-s", default=None, help="Search by user")
|
||||
@click.option("--limit", default=20, help="Results per page")
|
||||
@click.option("--offset", default=0, help="Pagination offset")
|
||||
@click.option("--output", "-o", type=click.Choice(["table", "json", "yaml"]), default="table", help="Output format")
|
||||
def password_logs(search, limit, offset, output):
|
||||
"""View password change audit logs."""
|
||||
sess = Session.load()
|
||||
client = require_auth(sess)
|
||||
|
||||
params = {"limit": limit, "offset": offset}
|
||||
if search:
|
||||
params["search"] = search
|
||||
|
||||
resp = client.get("audits/password-change-logs/", params=params)
|
||||
handle_api_error(resp, "get password change logs")
|
||||
print_result(resp.json(), fmt=output)
|
||||
|
||||
|
||||
# ─── Activity Logs ────────────────────────────────────────────
|
||||
|
||||
|
||||
@audit_group.command(name="activity")
|
||||
@click.option("--limit", default=20, help="Results per page")
|
||||
@click.option("--offset", default=0, help="Pagination offset")
|
||||
@click.option("--output", "-o", type=click.Choice(["table", "json", "yaml"]), default="table", help="Output format")
|
||||
def activity_logs(limit, offset, output):
|
||||
"""View user activity logs."""
|
||||
sess = Session.load()
|
||||
client = require_auth(sess)
|
||||
|
||||
params = {"limit": limit, "offset": offset}
|
||||
resp = client.get("audits/activities/", params=params)
|
||||
handle_api_error(resp, "get activity logs")
|
||||
print_result(resp.json(), fmt=output)
|
||||
|
||||
|
||||
# ─── Ops / Job Management ────────────────────────────────────
|
||||
|
||||
|
||||
@click.group(name="ops")
|
||||
def ops_group():
|
||||
"""Manage operations and job execution."""
|
||||
pass
|
||||
|
||||
|
||||
@ops_group.command(name="job-list")
|
||||
@click.option("--search", "-s", default=None, help="Search by name")
|
||||
@click.option("--limit", default=20, help="Results per page")
|
||||
@click.option("--offset", default=0, help="Pagination offset")
|
||||
@click.option("--output", "-o", type=click.Choice(["table", "json", "yaml"]), default="table", help="Output format")
|
||||
def job_list(search, limit, offset, output):
|
||||
"""List execution jobs."""
|
||||
sess = Session.load()
|
||||
client = require_auth(sess)
|
||||
|
||||
params = {"limit": limit, "offset": offset}
|
||||
if search:
|
||||
params["search"] = search
|
||||
|
||||
resp = client.get("ops/jobs/", params=params)
|
||||
handle_api_error(resp, "list jobs")
|
||||
print_result(resp.json(), fmt=output)
|
||||
|
||||
|
||||
@ops_group.command(name="job-log")
|
||||
@click.argument("execution_id")
|
||||
@click.option("--output", "-o", type=click.Choice(["table", "json", "yaml"]), default="table", help="Output format")
|
||||
def job_log(execution_id, output):
|
||||
"""Get job execution log."""
|
||||
sess = Session.load()
|
||||
client = require_auth(sess)
|
||||
resp = client.get(f"ops/job-executions/{execution_id}/")
|
||||
handle_api_error(resp, "get job execution")
|
||||
print_result(resp.json(), fmt=output)
|
||||
|
||||
|
||||
@ops_group.command(name="adhoc-list")
|
||||
@click.option("--search", "-s", default=None, help="Search by name")
|
||||
@click.option("--limit", default=20, help="Results per page")
|
||||
@click.option("--offset", default=0, help="Pagination offset")
|
||||
@click.option("--output", "-o", type=click.Choice(["table", "json", "yaml"]), default="table", help="Output format")
|
||||
def adhoc_list(search, limit, offset, output):
|
||||
"""List ad-hoc command executions."""
|
||||
sess = Session.load()
|
||||
client = require_auth(sess)
|
||||
|
||||
params = {"limit": limit, "offset": offset}
|
||||
if search:
|
||||
params["search"] = search
|
||||
|
||||
resp = client.get("ops/adhocs/", params=params)
|
||||
handle_api_error(resp, "list adhoc executions")
|
||||
print_result(resp.json(), fmt=output)
|
||||
|
||||
|
||||
@ops_group.command(name="playbook-list")
|
||||
@click.option("--search", "-s", default=None, help="Search by name")
|
||||
@click.option("--output", "-o", type=click.Choice(["table", "json", "yaml"]), default="table", help="Output format")
|
||||
def playbook_list(search, output):
|
||||
"""List Ansible playbooks."""
|
||||
sess = Session.load()
|
||||
client = require_auth(sess)
|
||||
|
||||
params = {}
|
||||
if search:
|
||||
params["search"] = search
|
||||
|
||||
resp = client.get("ops/playbooks/", params=params)
|
||||
handle_api_error(resp, "list playbooks")
|
||||
print_result(resp.json(), fmt=output)
|
||||
@@ -0,0 +1,148 @@
|
||||
"""
|
||||
Authentication commands for JumpServer CLI.
|
||||
|
||||
Handles login, logout, status, and token management.
|
||||
"""
|
||||
import click
|
||||
|
||||
from cli_anything.jumpserver.core.session import Session
|
||||
from cli_anything.jumpserver.core.output import format_output
|
||||
from cli_anything.jumpserver.core.state import get_state
|
||||
from cli_anything.jumpserver.utils import (
|
||||
require_auth,
|
||||
handle_api_error,
|
||||
print_result,
|
||||
should_emit_human_text,
|
||||
)
|
||||
|
||||
|
||||
@click.group(name="auth")
|
||||
def auth_group():
|
||||
"""Authentication and session management."""
|
||||
pass
|
||||
|
||||
|
||||
@auth_group.command(name="login")
|
||||
@click.option("--url", "-u", required=True, help="JumpServer base URL (e.g., https://jumpserver.example.com)", envvar="JUMPSERVER_URL")
|
||||
@click.option("--username", "-n", required=True, help="Username", envvar="JUMPSERVER_USERNAME")
|
||||
@click.option("--password", "-p", required=True, help="Password", envvar="JUMPSERVER_PASSWORD")
|
||||
@click.option("--org", default=None, help="Organization ID (for multi-org deployments)")
|
||||
@click.option("--insecure", is_flag=True, help="Disable SSL verification")
|
||||
@click.option("--output", "-o", type=click.Choice(["table", "json", "yaml"]), default="table", help="Output format")
|
||||
@click.pass_context
|
||||
def login(ctx, url, username, password, org, insecure, output):
|
||||
"""Authenticate to JumpServer and store session token."""
|
||||
session = Session(
|
||||
base_url=url.rstrip("/"),
|
||||
verify_ssl=not insecure,
|
||||
)
|
||||
if org:
|
||||
session.org_id = org
|
||||
|
||||
try:
|
||||
client = session.get_client()
|
||||
result = client.login(username, password)
|
||||
user_info = client.get_current_user()
|
||||
session._current_user = user_info
|
||||
session.save()
|
||||
|
||||
data = {
|
||||
"status": "authenticated",
|
||||
"username": user_info.get("username", username),
|
||||
"name": user_info.get("name", ""),
|
||||
"role": user_info.get("role", ""),
|
||||
"org_id": session.org_id or "(default)",
|
||||
"url": session.base_url,
|
||||
}
|
||||
print_result(data, fmt=output)
|
||||
if should_emit_human_text(output):
|
||||
click.echo(click.style("\n✓ Login successful. Session saved.", fg="green"))
|
||||
|
||||
except Exception as e:
|
||||
session.clear()
|
||||
raise click.ClickException(f"Login failed: {e}")
|
||||
|
||||
|
||||
@auth_group.command(name="logout")
|
||||
def logout():
|
||||
"""Clear the current session and remove stored credentials."""
|
||||
session = Session.load()
|
||||
if session.is_authenticated():
|
||||
session.clear()
|
||||
click.echo(click.style("✓ Logged out. Session cleared.", fg="green"))
|
||||
else:
|
||||
click.echo("No active session found.")
|
||||
|
||||
|
||||
@auth_group.command(name="status")
|
||||
@click.option("--output", "-o", type=click.Choice(["table", "json", "yaml"]), default="table", help="Output format")
|
||||
def status(output):
|
||||
"""Show current authentication status."""
|
||||
session = Session.load()
|
||||
if not session.is_authenticated():
|
||||
print_result({"status": "not authenticated"}, fmt=output)
|
||||
return
|
||||
|
||||
try:
|
||||
client = session.get_client()
|
||||
user = client.get_current_user()
|
||||
|
||||
data = {
|
||||
"status": "authenticated",
|
||||
"username": user.get("username", "unknown"),
|
||||
"name": user.get("name", ""),
|
||||
"role": user.get("role", ""),
|
||||
"email": user.get("email", ""),
|
||||
"org_id": session.org_id or "default",
|
||||
"url": session.base_url,
|
||||
"token_expires_in": (
|
||||
f"{int(session.token_expiry - __import__('time').time())}s"
|
||||
if session.token_expiry
|
||||
else "unknown"
|
||||
),
|
||||
}
|
||||
print_result(data, fmt=output)
|
||||
|
||||
except Exception as e:
|
||||
data = {
|
||||
"status": "expired",
|
||||
"url": session.base_url,
|
||||
"username": session.username,
|
||||
}
|
||||
if should_emit_human_text(output):
|
||||
click.echo(f"Session exists but API check failed: {e}")
|
||||
print_result(data, fmt=output)
|
||||
|
||||
|
||||
@auth_group.command(name="org")
|
||||
@click.argument("org_id", required=False)
|
||||
@click.option("--list", "list_orgs", is_flag=True, help="List available organizations")
|
||||
@click.option("--output", "-o", type=click.Choice(["table", "json", "yaml"]), default="table", help="Output format")
|
||||
def org(org_id, list_orgs, output):
|
||||
"""Switch or list organizations (multi-org deployments)."""
|
||||
session = Session.load()
|
||||
client = require_auth(session)
|
||||
|
||||
if list_orgs:
|
||||
resp = client.get("orgs/")
|
||||
handle_api_error(resp, "list organizations")
|
||||
data = resp.json()
|
||||
print_result(data, fmt=output)
|
||||
return
|
||||
|
||||
if org_id:
|
||||
resp = client.get(f"orgs/{org_id}/")
|
||||
handle_api_error(resp, "get organization")
|
||||
org_data = resp.json()
|
||||
session.org_id = org_data.get("id", org_id)
|
||||
session.org_name = org_data.get("name", "")
|
||||
session.save()
|
||||
print_result(org_data, fmt=output)
|
||||
if should_emit_human_text(output):
|
||||
click.echo(click.style(f"\n✓ Switched to organization: {session.org_name}", fg="green"))
|
||||
else:
|
||||
current = {
|
||||
"org_id": session.org_id or "(default)",
|
||||
"org_name": session.org_name or "(default)",
|
||||
}
|
||||
print_result(current, fmt=output)
|
||||
@@ -0,0 +1,190 @@
|
||||
"""
|
||||
Permission management commands for JumpServer CLI.
|
||||
|
||||
Manages asset permissions, user/asset/node relations.
|
||||
"""
|
||||
import click
|
||||
|
||||
from cli_anything.jumpserver.core.session import Session
|
||||
from cli_anything.jumpserver.utils import (
|
||||
require_auth,
|
||||
handle_api_error,
|
||||
parse_ids,
|
||||
print_result,
|
||||
should_emit_human_text,
|
||||
)
|
||||
|
||||
|
||||
@click.group(name="perm")
|
||||
def perm_group():
|
||||
"""Manage asset permissions."""
|
||||
pass
|
||||
|
||||
|
||||
@perm_group.command(name="list")
|
||||
@click.option("--search", "-s", default=None, help="Search by name")
|
||||
@click.option("--user", "-u", default=None, help="Filter by user ID")
|
||||
@click.option("--active/--inactive", default=None, help="Filter by active status")
|
||||
@click.option("--limit", default=20, help="Results per page")
|
||||
@click.option("--offset", default=0, help="Pagination offset")
|
||||
@click.option("--output", "-o", type=click.Choice(["table", "json", "yaml"]), default="table", help="Output format")
|
||||
@click.option("--columns", "-c", default="name,users_amount,assets_amount,is_active,date_expired", help="Comma-separated column names")
|
||||
def list_perms(search, user, active, limit, offset, output, columns):
|
||||
"""List asset permissions."""
|
||||
session = Session.load()
|
||||
client = require_auth(session)
|
||||
|
||||
params = {"limit": limit, "offset": offset}
|
||||
if search:
|
||||
params["search"] = search
|
||||
if user:
|
||||
params["user"] = user
|
||||
if active is not None:
|
||||
params["is_active"] = str(active).lower()
|
||||
|
||||
resp = client.get("perms/asset-permissions/", params=params)
|
||||
handle_api_error(resp, "list permissions")
|
||||
print_result(resp.json(), fmt=output, columns=columns)
|
||||
|
||||
|
||||
@perm_group.command(name="get")
|
||||
@click.argument("perm_id")
|
||||
@click.option("--output", "-o", type=click.Choice(["table", "json", "yaml"]), default="table", help="Output format")
|
||||
def get_perm(perm_id, output):
|
||||
"""Get permission details."""
|
||||
session = Session.load()
|
||||
client = require_auth(session)
|
||||
resp = client.get(f"perms/asset-permissions/{perm_id}/")
|
||||
handle_api_error(resp, "get permission")
|
||||
print_result(resp.json(), fmt=output)
|
||||
|
||||
|
||||
@perm_group.command(name="create")
|
||||
@click.option("--name", required=True, help="Permission rule name")
|
||||
@click.option("--users", default=None, help="Comma-separated user IDs")
|
||||
@click.option("--user-groups", default=None, help="Comma-separated user group IDs")
|
||||
@click.option("--assets", default=None, help="Comma-separated asset IDs")
|
||||
@click.option("--nodes", default=None, help="Comma-separated node IDs")
|
||||
@click.option("--actions", default="all", help="Actions (all, connect, upload, download, clipboard_copy, clipboard_paste)")
|
||||
@click.option("--date-start", default=None, help="Start date (YYYY-MM-DD)")
|
||||
@click.option("--date-expired", default=None, help="Expiry date (YYYY-MM-DD)")
|
||||
@click.option("--active/--inactive", default=True, help="Active status")
|
||||
@click.option("--output", "-o", type=click.Choice(["table", "json", "yaml"]), default="table", help="Output format")
|
||||
@click.option("--dry-run", is_flag=True, help="Preview without executing")
|
||||
def create_perm(name, users, user_groups, assets, nodes, actions, date_start, date_expired, active, output, dry_run):
|
||||
"""Create a new asset permission."""
|
||||
data = {
|
||||
"name": name,
|
||||
"is_active": active,
|
||||
}
|
||||
if users:
|
||||
data["users"] = parse_ids(users)
|
||||
if user_groups:
|
||||
data["user_groups"] = parse_ids(user_groups)
|
||||
if assets:
|
||||
data["assets"] = parse_ids(assets)
|
||||
if nodes:
|
||||
data["nodes"] = parse_ids(nodes)
|
||||
if actions:
|
||||
data["actions"] = parse_ids(actions)
|
||||
if date_start:
|
||||
data["date_start"] = date_start
|
||||
if date_expired:
|
||||
data["date_expired"] = date_expired
|
||||
|
||||
if dry_run:
|
||||
print_result({"action": "create permission", "data": data}, fmt=output)
|
||||
return
|
||||
|
||||
session = Session.load()
|
||||
client = require_auth(session)
|
||||
resp = client.post("perms/asset-permissions/", data=data)
|
||||
handle_api_error(resp, "create permission")
|
||||
print_result(resp.json(), fmt=output)
|
||||
if should_emit_human_text(output):
|
||||
click.echo(click.style(f"\n✓ Permission '{name}' created.", fg="green"))
|
||||
|
||||
|
||||
@perm_group.command(name="update")
|
||||
@click.argument("perm_id")
|
||||
@click.option("--name", default=None, help="New name")
|
||||
@click.option("--users", default=None, help="Comma-separated user IDs")
|
||||
@click.option("--user-groups", default=None, help="Comma-separated user group IDs")
|
||||
@click.option("--assets", default=None, help="Comma-separated asset IDs")
|
||||
@click.option("--nodes", default=None, help="Comma-separated node IDs")
|
||||
@click.option("--actions", default=None, help="Actions")
|
||||
@click.option("--active/--inactive", default=None, help="Set active status")
|
||||
@click.option("--output", "-o", type=click.Choice(["table", "json", "yaml"]), default="table", help="Output format")
|
||||
@click.option("--dry-run", is_flag=True, help="Preview without executing")
|
||||
def update_perm(perm_id, name, users, user_groups, assets, nodes, actions, active, output, dry_run):
|
||||
"""Update an asset permission."""
|
||||
data = {}
|
||||
if name is not None:
|
||||
data["name"] = name
|
||||
if users is not None:
|
||||
data["users"] = parse_ids(users)
|
||||
if user_groups is not None:
|
||||
data["user_groups"] = parse_ids(user_groups)
|
||||
if assets is not None:
|
||||
data["assets"] = parse_ids(assets)
|
||||
if nodes is not None:
|
||||
data["nodes"] = parse_ids(nodes)
|
||||
if actions is not None:
|
||||
data["actions"] = parse_ids(actions)
|
||||
if active is not None:
|
||||
data["is_active"] = active
|
||||
|
||||
if dry_run:
|
||||
print_result({"action": "update permission", "id": perm_id, "data": data}, fmt=output)
|
||||
return
|
||||
|
||||
session = Session.load()
|
||||
client = require_auth(session)
|
||||
resp = client.put(f"perms/asset-permissions/{perm_id}/", data=data)
|
||||
handle_api_error(resp, "update permission")
|
||||
print_result(resp.json(), fmt=output)
|
||||
if should_emit_human_text(output):
|
||||
click.echo(click.style(f"\n✓ Permission '{perm_id}' updated.", fg="green"))
|
||||
|
||||
|
||||
@perm_group.command(name="delete")
|
||||
@click.argument("perm_id")
|
||||
@click.option("--force", "-f", is_flag=True, help="Skip confirmation")
|
||||
@click.option("--dry-run", is_flag=True, help="Preview without executing")
|
||||
def delete_perm(perm_id, force, dry_run):
|
||||
"""Delete an asset permission."""
|
||||
if dry_run:
|
||||
click.echo(f"[DRY RUN] Would delete permission: {perm_id}")
|
||||
return
|
||||
if not force:
|
||||
click.confirm(f"Delete permission '{perm_id}'?", abort=True)
|
||||
|
||||
session = Session.load()
|
||||
client = require_auth(session)
|
||||
resp = client.delete(f"perms/asset-permissions/{perm_id}/")
|
||||
handle_api_error(resp, "delete permission")
|
||||
click.echo(click.style(f"✓ Permission '{perm_id}' deleted.", fg="green"))
|
||||
|
||||
|
||||
@perm_group.command(name="users")
|
||||
@click.argument("perm_id")
|
||||
@click.option("--output", "-o", type=click.Choice(["table", "json", "yaml"]), default="table", help="Output format")
|
||||
def perm_users(perm_id, output):
|
||||
"""List users assigned to a permission."""
|
||||
session = Session.load()
|
||||
client = require_auth(session)
|
||||
resp = client.get(f"perms/asset-permissions/{perm_id}/users/all/")
|
||||
handle_api_error(resp, "get permission users")
|
||||
print_result(resp.json(), fmt=output)
|
||||
|
||||
|
||||
@perm_group.command(name="assets")
|
||||
@click.argument("perm_id")
|
||||
@click.option("--output", "-o", type=click.Choice(["table", "json", "yaml"]), default="table", help="Output format")
|
||||
def perm_assets(perm_id, output):
|
||||
"""List assets authorized by a permission."""
|
||||
session = Session.load()
|
||||
client = require_auth(session)
|
||||
resp = client.get(f"perms/asset-permissions/{perm_id}/assets/all/")
|
||||
handle_api_error(resp, "get permission assets")
|
||||
print_result(resp.json(), fmt=output)
|
||||
@@ -0,0 +1,177 @@
|
||||
"""
|
||||
Session and terminal management commands for JumpServer CLI.
|
||||
|
||||
Manages sessions, terminals, commands, and replays.
|
||||
"""
|
||||
import click
|
||||
|
||||
from cli_anything.jumpserver.core.session import Session
|
||||
from cli_anything.jumpserver.utils import (
|
||||
require_auth,
|
||||
handle_api_error,
|
||||
print_result,
|
||||
should_emit_human_text,
|
||||
)
|
||||
|
||||
|
||||
@click.group(name="session")
|
||||
def session_group():
|
||||
"""Manage terminal sessions and replays."""
|
||||
pass
|
||||
|
||||
|
||||
@session_group.command(name="list")
|
||||
@click.option("--search", "-s", default=None, help="Search by user or asset")
|
||||
@click.option("--user", "-u", default=None, help="Filter by user ID")
|
||||
@click.option("--asset", "-a", default=None, help="Filter by asset ID")
|
||||
@click.option("--protocol", "-p", default=None, type=click.Choice(["ssh", "rdp", "vnc", "telnet", "mysql", "redis", "http", "k8s"]), help="Protocol")
|
||||
@click.option("--active/--finished", default=None, help="Filter by session status")
|
||||
@click.option("--limit", default=20, help="Results per page")
|
||||
@click.option("--offset", default=0, help="Pagination offset")
|
||||
@click.option("--output", "-o", type=click.Choice(["table", "json", "yaml"]), default="table", help="Output format")
|
||||
@click.option("--columns", "-c", default="id,user,asset,account,protocol,is_finished,date_start", help="Comma-separated column names")
|
||||
def list_sessions(search, user, asset, protocol, active, limit, offset, output, columns):
|
||||
"""List terminal sessions."""
|
||||
session = Session.load()
|
||||
client = require_auth(session)
|
||||
|
||||
params = {"limit": limit, "offset": offset}
|
||||
if search:
|
||||
params["search"] = search
|
||||
if user:
|
||||
params["user"] = user
|
||||
if asset:
|
||||
params["asset"] = asset
|
||||
if protocol:
|
||||
params["protocol"] = protocol
|
||||
if active is not None:
|
||||
params["is_finished"] = str(not active).lower()
|
||||
|
||||
resp = client.get("terminal/sessions/", params=params)
|
||||
handle_api_error(resp, "list sessions")
|
||||
print_result(resp.json(), fmt=output, columns=columns)
|
||||
|
||||
|
||||
@session_group.command(name="get")
|
||||
@click.argument("session_id")
|
||||
@click.option("--output", "-o", type=click.Choice(["table", "json", "yaml"]), default="table", help="Output format")
|
||||
def get_session(session_id, output):
|
||||
"""Get session details."""
|
||||
session = Session.load()
|
||||
client = require_auth(session)
|
||||
resp = client.get(f"terminal/sessions/{session_id}/")
|
||||
handle_api_error(resp, "get session")
|
||||
print_result(resp.json(), fmt=output)
|
||||
|
||||
|
||||
@session_group.command(name="replay")
|
||||
@click.argument("session_id")
|
||||
@click.option("--output", "-o", type=click.Choice(["table", "json", "yaml"]), default="table", help="Output format")
|
||||
def session_replay(session_id, output):
|
||||
"""Get session replay URL/info."""
|
||||
session = Session.load()
|
||||
client = require_auth(session)
|
||||
resp = client.get(f"terminal/sessions/{session_id}/replay/")
|
||||
handle_api_error(resp, "get replay")
|
||||
data = resp.json()
|
||||
print_result(data, fmt=output)
|
||||
|
||||
if should_emit_human_text(output) and isinstance(data, dict):
|
||||
replay_url = data.get("url", data.get("replay_url", ""))
|
||||
if replay_url:
|
||||
click.echo(f"\n Replay URL: {session.base_url}{replay_url}")
|
||||
|
||||
|
||||
@session_group.command(name="kill")
|
||||
@click.argument("session_id")
|
||||
@click.option("--force", "-f", is_flag=True, help="Skip confirmation")
|
||||
@click.option("--dry-run", is_flag=True, help="Preview without executing")
|
||||
def kill_session(session_id, force, dry_run):
|
||||
"""Kill an active session."""
|
||||
if dry_run:
|
||||
click.echo(f"[DRY RUN] Would kill session: {session_id}")
|
||||
return
|
||||
if not force:
|
||||
click.confirm(f"Kill session '{session_id}'?", abort=True)
|
||||
|
||||
session = Session.load()
|
||||
client = require_auth(session)
|
||||
resp = client.post("terminal/tasks/kill-session/", data={"session": session_id})
|
||||
handle_api_error(resp, "kill session")
|
||||
click.echo(click.style(f"✓ Kill signal sent for session '{session_id}'.", fg="green"))
|
||||
|
||||
|
||||
# ─── Commands ─────────────────────────────────────────────────
|
||||
|
||||
|
||||
@session_group.group(name="command")
|
||||
def command_group():
|
||||
"""View session command history."""
|
||||
pass
|
||||
|
||||
|
||||
@command_group.command(name="list")
|
||||
@click.option("--session", "-s", default=None, help="Filter by session ID")
|
||||
@click.option("--user", "-u", default=None, help="Filter by user ID")
|
||||
@click.option("--search", default=None, help="Search commands")
|
||||
@click.option("--risk", default=None, type=click.Choice(["0", "1", "2", "3", "4", "5"]), help="Risk level (0-5)")
|
||||
@click.option("--limit", default=50, help="Results per page")
|
||||
@click.option("--offset", default=0, help="Pagination offset")
|
||||
@click.option("--output", "-o", type=click.Choice(["table", "json", "yaml"]), default="table", help="Output format")
|
||||
@click.option("--columns", "-c", default="input,user,timestamp,risk_level", help="Comma-separated column names")
|
||||
def list_commands(session, user, search, risk, limit, offset, output, columns):
|
||||
"""List command records."""
|
||||
sess = Session.load()
|
||||
client = require_auth(sess)
|
||||
|
||||
params = {"limit": limit, "offset": offset}
|
||||
if session:
|
||||
params["session"] = session
|
||||
if user:
|
||||
params["user"] = user
|
||||
if search:
|
||||
params["search"] = search
|
||||
if risk:
|
||||
params["risk_level"] = risk
|
||||
|
||||
resp = client.get("terminal/commands/", params=params)
|
||||
handle_api_error(resp, "list commands")
|
||||
print_result(resp.json(), fmt=output, columns=columns)
|
||||
|
||||
|
||||
# ─── Terminals ─────────────────────────────────────────────────
|
||||
|
||||
|
||||
@session_group.group(name="terminal")
|
||||
def terminal_group():
|
||||
"""Manage terminal components."""
|
||||
pass
|
||||
|
||||
|
||||
@terminal_group.command(name="list")
|
||||
@click.option("--search", "-s", default=None, help="Search by name")
|
||||
@click.option("--output", "-o", type=click.Choice(["table", "json", "yaml"]), default="table", help="Output format")
|
||||
def list_terminals(search, output):
|
||||
"""List terminal components (KoKo, Lion, etc.)."""
|
||||
sess = Session.load()
|
||||
client = require_auth(sess)
|
||||
|
||||
params = {}
|
||||
if search:
|
||||
params["search"] = search
|
||||
|
||||
resp = client.get("terminal/terminals/", params=params)
|
||||
handle_api_error(resp, "list terminals")
|
||||
print_result(resp.json(), fmt=output)
|
||||
|
||||
|
||||
@terminal_group.command(name="status")
|
||||
@click.argument("terminal_id")
|
||||
@click.option("--output", "-o", type=click.Choice(["table", "json", "yaml"]), default="table", help="Output format")
|
||||
def terminal_status(terminal_id, output):
|
||||
"""Get terminal component status (CPU, memory, connections)."""
|
||||
sess = Session.load()
|
||||
client = require_auth(sess)
|
||||
resp = client.get(f"terminal/terminals/{terminal_id}/status/")
|
||||
handle_api_error(resp, "get terminal status")
|
||||
print_result(resp.json(), fmt=output)
|
||||
@@ -0,0 +1,158 @@
|
||||
"""
|
||||
Settings and system commands for JumpServer CLI.
|
||||
|
||||
Manages system settings, license, and health checks.
|
||||
"""
|
||||
import click
|
||||
|
||||
from cli_anything.jumpserver.core.session import Session
|
||||
from cli_anything.jumpserver.utils import (
|
||||
require_auth,
|
||||
handle_api_error,
|
||||
print_result,
|
||||
)
|
||||
|
||||
|
||||
@click.group(name="system")
|
||||
def system_group():
|
||||
"""Manage system settings and configuration."""
|
||||
pass
|
||||
|
||||
|
||||
@system_group.command(name="settings")
|
||||
@click.option("--search", "-s", default=None, help="Filter settings by name")
|
||||
@click.option("--category", "-c", default=None, help="Filter by category")
|
||||
@click.option("--output", "-o", type=click.Choice(["table", "json", "yaml"]), default="table", help="Output format")
|
||||
def list_settings(search, category, output):
|
||||
"""List system settings."""
|
||||
sess = Session.load()
|
||||
client = require_auth(sess)
|
||||
|
||||
params = {}
|
||||
if search:
|
||||
params["search"] = search
|
||||
if category:
|
||||
params["category"] = category
|
||||
|
||||
resp = client.get("settings/settings/", params=params)
|
||||
handle_api_error(resp, "get settings")
|
||||
print_result(resp.json(), fmt=output)
|
||||
|
||||
|
||||
@system_group.command(name="health")
|
||||
@click.option("--output", "-o", type=click.Choice(["table", "json", "yaml"]), default="table", help="Output format")
|
||||
def health_check(output):
|
||||
"""Check system health."""
|
||||
sess = Session.load()
|
||||
client = require_auth(sess)
|
||||
|
||||
try:
|
||||
resp = client.get("health/")
|
||||
resp.raise_for_status()
|
||||
data = resp.json()
|
||||
print_result(data, fmt=output)
|
||||
except Exception as e:
|
||||
print_result({"status": "error", "message": str(e)}, fmt=output)
|
||||
|
||||
|
||||
@system_group.command(name="info")
|
||||
@click.option("--output", "-o", type=click.Choice(["table", "json", "yaml"]), default="table", help="Output format")
|
||||
def system_info(output):
|
||||
"""Show system information."""
|
||||
sess = Session.load()
|
||||
client = require_auth(sess)
|
||||
|
||||
try:
|
||||
# Try to get public settings (no auth typically needed)
|
||||
resp = client.get("settings/public/")
|
||||
resp.raise_for_status()
|
||||
data = resp.json()
|
||||
|
||||
info = {
|
||||
"url": sess.base_url,
|
||||
"org": sess.org_id or "default",
|
||||
"version": data.get("XPACK_VERSION", data.get("VERSION", "unknown")),
|
||||
"authenticated": sess.is_authenticated(),
|
||||
"username": sess.username if sess.is_authenticated() else "N/A",
|
||||
}
|
||||
print_result(info, fmt=output)
|
||||
except Exception:
|
||||
info = {
|
||||
"url": sess.base_url,
|
||||
"org": sess.org_id or "default",
|
||||
"authenticated": sess.is_authenticated(),
|
||||
"username": sess.username if sess.is_authenticated() else "N/A",
|
||||
}
|
||||
print_result(info, fmt=output)
|
||||
|
||||
|
||||
# ─── Labels ───────────────────────────────────────────────────
|
||||
|
||||
|
||||
@click.group(name="label")
|
||||
def label_group():
|
||||
"""Manage labels."""
|
||||
pass
|
||||
|
||||
|
||||
@label_group.command(name="list")
|
||||
@click.option("--search", "-s", default=None, help="Search by name")
|
||||
@click.option("--output", "-o", type=click.Choice(["table", "json", "yaml"]), default="table", help="Output format")
|
||||
def list_labels(search, output):
|
||||
"""List labels."""
|
||||
sess = Session.load()
|
||||
client = require_auth(sess)
|
||||
|
||||
params = {}
|
||||
if search:
|
||||
params["search"] = search
|
||||
|
||||
resp = client.get("labels/labels/", params=params)
|
||||
handle_api_error(resp, "get labels")
|
||||
print_result(resp.json(), fmt=output)
|
||||
|
||||
|
||||
# ─── RBAC ─────────────────────────────────────────────────────
|
||||
|
||||
|
||||
@click.group(name="role")
|
||||
def role_group():
|
||||
"""Manage roles and permissions."""
|
||||
pass
|
||||
|
||||
|
||||
@role_group.command(name="list")
|
||||
@click.option("--search", "-s", default=None, help="Search by name")
|
||||
@click.option("--output", "-o", type=click.Choice(["table", "json", "yaml"]), default="table", help="Output format")
|
||||
def list_roles(search, output):
|
||||
"""List roles."""
|
||||
sess = Session.load()
|
||||
client = require_auth(sess)
|
||||
|
||||
params = {}
|
||||
if search:
|
||||
params["search"] = search
|
||||
|
||||
resp = client.get("rbac/roles/", params=params)
|
||||
handle_api_error(resp, "get roles")
|
||||
print_result(resp.json(), fmt=output)
|
||||
|
||||
|
||||
@role_group.command(name="bindings")
|
||||
@click.option("--user", "-u", default=None, help="Filter by user ID")
|
||||
@click.option("--role", "-r", default=None, help="Filter by role ID")
|
||||
@click.option("--output", "-o", type=click.Choice(["table", "json", "yaml"]), default="table", help="Output format")
|
||||
def list_bindings(user, role, output):
|
||||
"""List role bindings."""
|
||||
sess = Session.load()
|
||||
client = require_auth(sess)
|
||||
|
||||
params = {}
|
||||
if user:
|
||||
params["user"] = user
|
||||
if role:
|
||||
params["role"] = role
|
||||
|
||||
resp = client.get("rbac/role-bindings/", params=params)
|
||||
handle_api_error(resp, "get role bindings")
|
||||
print_result(resp.json(), fmt=output)
|
||||
@@ -0,0 +1,300 @@
|
||||
"""
|
||||
User management commands for JumpServer CLI.
|
||||
|
||||
Manages users, user groups, and user-group relations.
|
||||
"""
|
||||
import json
|
||||
|
||||
import click
|
||||
|
||||
from cli_anything.jumpserver.core.session import Session
|
||||
from cli_anything.jumpserver.utils import (
|
||||
require_auth,
|
||||
handle_api_error,
|
||||
parse_ids,
|
||||
print_result,
|
||||
mask_sensitive_data,
|
||||
should_emit_human_text,
|
||||
)
|
||||
|
||||
|
||||
@click.group(name="user")
|
||||
def user_group():
|
||||
"""Manage users and user groups."""
|
||||
pass
|
||||
|
||||
|
||||
# ─── Users CRUD ──────────────────────────────────────────────
|
||||
|
||||
|
||||
@user_group.command(name="list")
|
||||
@click.option("--search", "-s", default=None, help="Search by username or name")
|
||||
@click.option("--source", default=None, help="Filter by source (local, ldap, oauth2, etc.)")
|
||||
@click.option("--active/--inactive", default=None, help="Filter by active status")
|
||||
@click.option("--limit", default=20, help="Results per page")
|
||||
@click.option("--offset", default=0, help="Pagination offset")
|
||||
@click.option("--output", "-o", type=click.Choice(["table", "json", "yaml"]), default="table", help="Output format")
|
||||
@click.option("--columns", "-c", default="username,name,role,source,is_active", help="Comma-separated column names")
|
||||
def list_users(search, source, active, limit, offset, output, columns):
|
||||
"""List users."""
|
||||
session = Session.load()
|
||||
client = require_auth(session)
|
||||
|
||||
params = {"limit": limit, "offset": offset}
|
||||
if search:
|
||||
params["search"] = search
|
||||
if source:
|
||||
params["source"] = source
|
||||
if active is not None:
|
||||
params["is_active"] = str(active).lower()
|
||||
|
||||
resp = client.get("users/users/", params=params)
|
||||
handle_api_error(resp, "list users")
|
||||
print_result(resp.json(), fmt=output, columns=columns)
|
||||
|
||||
|
||||
@user_group.command(name="get")
|
||||
@click.argument("user_id")
|
||||
@click.option("--output", "-o", type=click.Choice(["table", "json", "yaml"]), default="table", help="Output format")
|
||||
def get_user(user_id, output):
|
||||
"""Get user details."""
|
||||
session = Session.load()
|
||||
client = require_auth(session)
|
||||
resp = client.get(f"users/users/{user_id}/")
|
||||
handle_api_error(resp, "get user")
|
||||
print_result(resp.json(), fmt=output)
|
||||
|
||||
|
||||
@user_group.command(name="create")
|
||||
@click.option("--name", required=True, help="Display name")
|
||||
@click.option("--username", required=True, help="Login username")
|
||||
@click.option("--email", required=True, help="Email address")
|
||||
@click.option("--password", default=None, help="Password (required for local users)")
|
||||
@click.option("--role", default="User", type=click.Choice(["Admin", "User", "Auditor"]), help="User role")
|
||||
@click.option("--active/--inactive", default=True, help="Active status")
|
||||
@click.option("--output", "-o", type=click.Choice(["table", "json", "yaml"]), default="table", help="Output format")
|
||||
@click.option("--dry-run", is_flag=True, help="Preview without executing")
|
||||
def create_user(name, username, email, password, role, active, output, dry_run):
|
||||
"""Create a new user."""
|
||||
data = {
|
||||
"name": name,
|
||||
"username": username,
|
||||
"email": email,
|
||||
"role": role,
|
||||
"is_active": active,
|
||||
}
|
||||
if password:
|
||||
data["password"] = password
|
||||
|
||||
if dry_run:
|
||||
print_result(
|
||||
{"action": "create user", "data": mask_sensitive_data(data)},
|
||||
fmt=output,
|
||||
)
|
||||
return
|
||||
|
||||
session = Session.load()
|
||||
client = require_auth(session)
|
||||
resp = client.post("users/users/", data=data)
|
||||
handle_api_error(resp, "create user")
|
||||
print_result(resp.json(), fmt=output)
|
||||
if should_emit_human_text(output):
|
||||
click.echo(click.style(f"\n✓ User '{username}' created.", fg="green"))
|
||||
|
||||
|
||||
@user_group.command(name="update")
|
||||
@click.argument("user_id")
|
||||
@click.option("--name", default=None, help="New display name")
|
||||
@click.option("--email", default=None, help="New email")
|
||||
@click.option("--role", default=None, type=click.Choice(["Admin", "User", "Auditor"]), help="New role")
|
||||
@click.option("--active/--inactive", default=None, help="Set active status")
|
||||
@click.option("--output", "-o", type=click.Choice(["table", "json", "yaml"]), default="table", help="Output format")
|
||||
@click.option("--dry-run", is_flag=True, help="Preview without executing")
|
||||
def update_user(user_id, name, email, role, active, output, dry_run):
|
||||
"""Update a user."""
|
||||
data = {}
|
||||
if name is not None:
|
||||
data["name"] = name
|
||||
if email is not None:
|
||||
data["email"] = email
|
||||
if role is not None:
|
||||
data["role"] = role
|
||||
if active is not None:
|
||||
data["is_active"] = active
|
||||
|
||||
if dry_run:
|
||||
print_result({"action": "update user", "id": user_id, "data": data}, fmt=output)
|
||||
return
|
||||
|
||||
session = Session.load()
|
||||
client = require_auth(session)
|
||||
resp = client.put(f"users/users/{user_id}/", data=data)
|
||||
handle_api_error(resp, "update user")
|
||||
print_result(resp.json(), fmt=output)
|
||||
if should_emit_human_text(output):
|
||||
click.echo(click.style(f"\n✓ User '{user_id}' updated.", fg="green"))
|
||||
|
||||
|
||||
@user_group.command(name="delete")
|
||||
@click.argument("user_id")
|
||||
@click.option("--force", "-f", is_flag=True, help="Skip confirmation")
|
||||
@click.option("--dry-run", is_flag=True, help="Preview without executing")
|
||||
def delete_user(user_id, force, dry_run):
|
||||
"""Delete a user."""
|
||||
if dry_run:
|
||||
click.echo(f"[DRY RUN] Would delete user: {user_id}")
|
||||
return
|
||||
if not force:
|
||||
click.confirm(f"Delete user '{user_id}'?", abort=True)
|
||||
|
||||
session = Session.load()
|
||||
client = require_auth(session)
|
||||
resp = client.delete(f"users/users/{user_id}/")
|
||||
handle_api_error(resp, "delete user")
|
||||
click.echo(click.style(f"✓ User '{user_id}' deleted.", fg="green"))
|
||||
|
||||
|
||||
@user_group.command(name="reset-password")
|
||||
@click.argument("user_id")
|
||||
@click.option("--password", "-p", required=True, help="New password")
|
||||
@click.option("--force", "-f", is_flag=True, help="Skip confirmation")
|
||||
@click.option("--yes", is_flag=True, help="Alias for --force")
|
||||
@click.option("--output", "-o", type=click.Choice(["table", "json", "yaml"]), default="table", help="Output format")
|
||||
@click.option("--dry-run", is_flag=True, help="Preview without executing")
|
||||
def reset_password(user_id, password, force, yes, output, dry_run):
|
||||
"""Reset a user's password."""
|
||||
if dry_run:
|
||||
print_result(
|
||||
{
|
||||
"action": "reset password",
|
||||
"user_id": user_id,
|
||||
"data": mask_sensitive_data({"password": password}),
|
||||
},
|
||||
fmt=output,
|
||||
)
|
||||
return
|
||||
if not (force or yes):
|
||||
click.confirm(f"Reset password for user '{user_id}'?", abort=True)
|
||||
|
||||
session = Session.load()
|
||||
client = require_auth(session)
|
||||
resp = client.post(f"users/users/{user_id}/password/reset/", data={"password": password})
|
||||
handle_api_error(resp, "reset password")
|
||||
if should_emit_human_text(output):
|
||||
click.echo(click.style(f"✓ Password reset for user '{user_id}'.", fg="green"))
|
||||
else:
|
||||
print_result(
|
||||
{"status": "ok", "action": "reset password", "user_id": user_id},
|
||||
fmt=output,
|
||||
)
|
||||
|
||||
|
||||
@user_group.command(name="unblock")
|
||||
@click.argument("user_id")
|
||||
@click.option("--output", "-o", type=click.Choice(["table", "json", "yaml"]), default="table", help="Output format")
|
||||
@click.option("--dry-run", is_flag=True, help="Preview without executing")
|
||||
def unblock_user(user_id, output, dry_run):
|
||||
"""Unblock a locked user."""
|
||||
if dry_run:
|
||||
click.echo(f"[DRY RUN] Would unblock user: {user_id}")
|
||||
return
|
||||
|
||||
session = Session.load()
|
||||
client = require_auth(session)
|
||||
resp = client.post(f"users/users/{user_id}/unblock/")
|
||||
handle_api_error(resp, "unblock user")
|
||||
click.echo(click.style(f"✓ User '{user_id}' unblocked.", fg="green"))
|
||||
|
||||
|
||||
# ─── User Groups ─────────────────────────────────────────────
|
||||
|
||||
|
||||
@user_group.group(name="group")
|
||||
def group_commands():
|
||||
"""Manage user groups."""
|
||||
pass
|
||||
|
||||
|
||||
@group_commands.command(name="list")
|
||||
@click.option("--search", "-s", default=None, help="Search by name")
|
||||
@click.option("--output", "-o", type=click.Choice(["table", "json", "yaml"]), default="table", help="Output format")
|
||||
def list_groups(search, output):
|
||||
"""List user groups."""
|
||||
session = Session.load()
|
||||
client = require_auth(session)
|
||||
|
||||
params = {}
|
||||
if search:
|
||||
params["search"] = search
|
||||
|
||||
resp = client.get("users/groups/", params=params)
|
||||
handle_api_error(resp, "list groups")
|
||||
print_result(resp.json(), fmt=output)
|
||||
|
||||
|
||||
@group_commands.command(name="create")
|
||||
@click.option("--name", required=True, help="Group name")
|
||||
@click.option("--comment", default=None, help="Comment")
|
||||
@click.option("--output", "-o", type=click.Choice(["table", "json", "yaml"]), default="table", help="Output format")
|
||||
@click.option("--dry-run", is_flag=True, help="Preview without executing")
|
||||
def create_group(name, comment, output, dry_run):
|
||||
"""Create a user group."""
|
||||
data = {"name": name}
|
||||
if comment:
|
||||
data["comment"] = comment
|
||||
|
||||
if dry_run:
|
||||
print_result({"action": "create group", "data": data}, fmt=output)
|
||||
return
|
||||
|
||||
session = Session.load()
|
||||
client = require_auth(session)
|
||||
resp = client.post("users/groups/", data=data)
|
||||
handle_api_error(resp, "create group")
|
||||
print_result(resp.json(), fmt=output)
|
||||
if should_emit_human_text(output):
|
||||
click.echo(click.style(f"\n✓ Group '{name}' created.", fg="green"))
|
||||
|
||||
|
||||
@group_commands.command(name="members")
|
||||
@click.argument("group_id")
|
||||
@click.option("--output", "-o", type=click.Choice(["table", "json", "yaml"]), default="table", help="Output format")
|
||||
def group_members(group_id, output):
|
||||
"""List members of a user group."""
|
||||
session = Session.load()
|
||||
client = require_auth(session)
|
||||
resp = client.get(f"users/groups/{group_id}/")
|
||||
handle_api_error(resp, "get group")
|
||||
data = resp.json()
|
||||
print_result(data, fmt=output)
|
||||
|
||||
|
||||
# ─── Profile ─────────────────────────────────────────────────
|
||||
|
||||
|
||||
@user_group.command(name="profile")
|
||||
@click.option("--output", "-o", type=click.Choice(["table", "json", "yaml"]), default="table", help="Output format")
|
||||
def profile(output):
|
||||
"""Show current user profile."""
|
||||
session = Session.load()
|
||||
client = require_auth(session)
|
||||
resp = client.get("users/profile/")
|
||||
handle_api_error(resp, "get profile")
|
||||
print_result(resp.json(), fmt=output)
|
||||
|
||||
|
||||
@user_group.command(name="my-assets")
|
||||
@click.option("--search", "-s", default=None, help="Search by name or address")
|
||||
@click.option("--output", "-o", type=click.Choice(["table", "json", "yaml"]), default="table", help="Output format")
|
||||
def my_assets(search, output):
|
||||
"""List assets the current user can access."""
|
||||
session = Session.load()
|
||||
client = require_auth(session)
|
||||
|
||||
params = {}
|
||||
if search:
|
||||
params["search"] = search
|
||||
|
||||
resp = client.get("perms/my/assets/", params=params)
|
||||
handle_api_error(resp, "list my assets")
|
||||
print_result(resp.json(), fmt=output)
|
||||
@@ -0,0 +1,103 @@
|
||||
"""
|
||||
Output formatting for JumpServer CLI.
|
||||
|
||||
Supports table, JSON, YAML, and human-readable formats.
|
||||
"""
|
||||
import json
|
||||
import sys
|
||||
from typing import Any
|
||||
|
||||
|
||||
def format_output(
|
||||
data: Any,
|
||||
fmt: str = "table",
|
||||
columns: list[str] | None = None,
|
||||
stream=sys.stdout,
|
||||
) -> None:
|
||||
"""Format and print data in the specified format."""
|
||||
if fmt == "json":
|
||||
print(json.dumps(data, indent=2, ensure_ascii=False, default=str), file=stream)
|
||||
elif fmt == "yaml":
|
||||
import yaml
|
||||
|
||||
print(yaml.dump(data, allow_unicode=True, default_flow_style=False), file=stream)
|
||||
elif fmt == "table":
|
||||
_format_table(data, columns, stream)
|
||||
else:
|
||||
print(data, file=stream)
|
||||
|
||||
|
||||
def _format_table(
|
||||
data: Any,
|
||||
columns: list[str] | None = None,
|
||||
stream=sys.stdout,
|
||||
) -> None:
|
||||
"""Format data as a human-readable table."""
|
||||
if isinstance(data, dict):
|
||||
_format_dict_table(data, stream)
|
||||
elif isinstance(data, list) and data and isinstance(data[0], dict):
|
||||
_format_list_table(data, columns, stream)
|
||||
elif isinstance(data, list):
|
||||
if not data:
|
||||
print(" (no results)", file=stream)
|
||||
else:
|
||||
for item in data:
|
||||
print(f" - {item}", file=stream)
|
||||
else:
|
||||
print(data, file=stream)
|
||||
|
||||
|
||||
def _format_dict_table(data: dict, stream) -> None:
|
||||
"""Print a single dict as key-value pairs."""
|
||||
max_key_len = max((len(str(k)) for k in data), default=0)
|
||||
for key, value in data.items():
|
||||
if isinstance(value, (dict, list)):
|
||||
value = json.dumps(value, ensure_ascii=False)
|
||||
print(f" {key:<{max_key_len}} : {value}", file=stream)
|
||||
|
||||
|
||||
def _format_list_table(
|
||||
data: list[dict],
|
||||
columns: list[str] | None = None,
|
||||
stream=sys.stdout,
|
||||
) -> None:
|
||||
"""Print a list of dicts as a table."""
|
||||
if not data:
|
||||
print(" (no results)", file=stream)
|
||||
return
|
||||
|
||||
if columns is None:
|
||||
columns = list(data[0].keys())
|
||||
|
||||
cols = [c for c in columns if any(c in row for row in data)]
|
||||
if not cols:
|
||||
cols = list(data[0].keys())
|
||||
|
||||
col_widths = {}
|
||||
for col in cols:
|
||||
col_widths[col] = max(
|
||||
len(col),
|
||||
max((len(str(row.get(col, ""))) for row in data), default=0),
|
||||
)
|
||||
col_widths[col] = min(col_widths[col], 50)
|
||||
|
||||
header = " " + " ".join(
|
||||
str(col).ljust(col_widths[col]) for col in cols
|
||||
)
|
||||
print(header, file=stream)
|
||||
print(" " + "-" * (len(header) - 2), file=stream)
|
||||
|
||||
for row in data:
|
||||
line = " " + " ".join(
|
||||
_truncate(str(row.get(col, "")), col_widths[col]) for col in cols
|
||||
)
|
||||
print(line, file=stream)
|
||||
|
||||
print(f"\n ({len(data)} result(s))", file=stream)
|
||||
|
||||
|
||||
def _truncate(value: str, width: int) -> str:
|
||||
"""Truncate a string to fit the given width."""
|
||||
if len(value) > width:
|
||||
return value[: width - 3] + "..."
|
||||
return value.ljust(width)
|
||||
@@ -0,0 +1,181 @@
|
||||
"""
|
||||
Session management for JumpServer CLI.
|
||||
|
||||
Manages API connection state, authentication tokens, and session persistence.
|
||||
"""
|
||||
import json
|
||||
import os
|
||||
import time
|
||||
from dataclasses import dataclass, field, asdict
|
||||
from pathlib import Path
|
||||
from typing import Any, Optional
|
||||
from urllib.parse import urljoin
|
||||
|
||||
import requests
|
||||
from requests.adapters import HTTPAdapter
|
||||
from urllib3.util.retry import Retry
|
||||
|
||||
|
||||
SESSION_FILE = Path.home() / ".jumpserver-cli" / "session.json"
|
||||
|
||||
|
||||
@dataclass
|
||||
class Session:
|
||||
"""JumpServer API session state."""
|
||||
|
||||
base_url: str = ""
|
||||
username: str = ""
|
||||
token: str = ""
|
||||
token_expiry: float = 0.0
|
||||
refresh_token: str = ""
|
||||
org_id: str = ""
|
||||
org_name: str = ""
|
||||
verify_ssl: bool = True
|
||||
timeout: int = 60
|
||||
_current_user: dict[str, Any] | None = field(default=None, repr=False)
|
||||
|
||||
def save(self) -> None:
|
||||
"""Persist session to disk."""
|
||||
SESSION_FILE.parent.mkdir(parents=True, exist_ok=True)
|
||||
data = asdict(self)
|
||||
data.pop("_current_user", None)
|
||||
SESSION_FILE.write_text(json.dumps(data, indent=2))
|
||||
|
||||
@classmethod
|
||||
def load(cls) -> "Session":
|
||||
"""Load session from disk, returns empty session if not found."""
|
||||
if SESSION_FILE.exists():
|
||||
try:
|
||||
data = json.loads(SESSION_FILE.read_text())
|
||||
data.pop("_current_user", None)
|
||||
return cls(**data)
|
||||
except (json.JSONDecodeError, TypeError):
|
||||
pass
|
||||
return cls()
|
||||
|
||||
def clear(self) -> None:
|
||||
"""Remove persisted session."""
|
||||
if SESSION_FILE.exists():
|
||||
SESSION_FILE.unlink()
|
||||
|
||||
def is_authenticated(self) -> bool:
|
||||
"""Check if the session has a valid token."""
|
||||
if not self.token:
|
||||
return False
|
||||
if self.token_expiry and time.time() > self.token_expiry:
|
||||
return False
|
||||
return True
|
||||
|
||||
def get_client(self) -> "JumpServerClient":
|
||||
"""Get an API client configured with this session."""
|
||||
return JumpServerClient(self)
|
||||
|
||||
|
||||
class JumpServerClient:
|
||||
"""HTTP client for JumpServer REST API with retry support."""
|
||||
|
||||
def __init__(self, session: Session):
|
||||
self.session = session
|
||||
self._http = requests.Session()
|
||||
self._http.verify = session.verify_ssl
|
||||
self._http.timeout = session.timeout
|
||||
|
||||
retry_strategy = Retry(
|
||||
total=2,
|
||||
backoff_factor=0.5,
|
||||
status_forcelist=[429, 500, 502, 503, 504],
|
||||
allowed_methods=["GET", "HEAD", "OPTIONS"],
|
||||
)
|
||||
adapter = HTTPAdapter(max_retries=retry_strategy)
|
||||
self._http.mount("http://", adapter)
|
||||
self._http.mount("https://", adapter)
|
||||
|
||||
@property
|
||||
def headers(self) -> dict[str, str]:
|
||||
h = {
|
||||
"Accept": "application/json",
|
||||
"Content-Type": "application/json",
|
||||
}
|
||||
if self.session.token:
|
||||
h["Authorization"] = f"Token {self.session.token}"
|
||||
if self.session.org_id:
|
||||
h["X-JMS-ORG"] = self.session.org_id
|
||||
return h
|
||||
|
||||
def _url(self, path: str) -> str:
|
||||
base = self.session.base_url.rstrip("/")
|
||||
return f"{base}/api/v1/{path.lstrip('/')}"
|
||||
|
||||
def request(
|
||||
self, method: str, path: str, **kwargs
|
||||
) -> requests.Response:
|
||||
url = self._url(path)
|
||||
kwargs.setdefault("headers", self.headers)
|
||||
return self._http.request(method, url, **kwargs)
|
||||
|
||||
def get(self, path: str, params: dict | None = None) -> requests.Response:
|
||||
return self.request("GET", path, params=params)
|
||||
|
||||
def post(
|
||||
self, path: str, data: dict | None = None
|
||||
) -> requests.Response:
|
||||
return self.request("POST", path, json=data)
|
||||
|
||||
def put(
|
||||
self, path: str, data: dict | None = None
|
||||
) -> requests.Response:
|
||||
return self.request("PUT", path, json=data)
|
||||
|
||||
def patch(
|
||||
self, path: str, data: dict | None = None
|
||||
) -> requests.Response:
|
||||
return self.request("PATCH", path, json=data)
|
||||
|
||||
def delete(self, path: str) -> requests.Response:
|
||||
return self.request("DELETE", path)
|
||||
|
||||
def login(
|
||||
self, username: str, password: str
|
||||
) -> dict[str, Any]:
|
||||
"""Authenticate and store token."""
|
||||
resp = self.post(
|
||||
"authentication/auth/",
|
||||
data={"username": username, "password": password},
|
||||
)
|
||||
resp.raise_for_status()
|
||||
data = resp.json()
|
||||
self.session.token = data.get("token", "")
|
||||
self.session.username = username
|
||||
self.session.token_expiry = time.time() + 3600 # default 1h
|
||||
self.session.save()
|
||||
return data
|
||||
|
||||
def logout(self) -> None:
|
||||
"""Invalidate the session."""
|
||||
self.session.clear()
|
||||
|
||||
def get_current_user(self) -> dict[str, Any]:
|
||||
"""Get current authenticated user profile."""
|
||||
resp = self.get("users/profile/")
|
||||
resp.raise_for_status()
|
||||
return resp.json()
|
||||
|
||||
def paginate(
|
||||
self, path: str, params: dict | None = None, limit: int = 100
|
||||
):
|
||||
"""Generator that yields results across all pages."""
|
||||
params = (params or {}).copy()
|
||||
params.setdefault("limit", limit)
|
||||
params.setdefault("offset", 0)
|
||||
|
||||
while True:
|
||||
resp = self.get(path, params=params)
|
||||
resp.raise_for_status()
|
||||
data = resp.json()
|
||||
results = data.get("results", data if isinstance(data, list) else [])
|
||||
if not results:
|
||||
break
|
||||
yield from results
|
||||
if len(results) < limit:
|
||||
break
|
||||
params["offset"] += len(results)
|
||||
@@ -0,0 +1,72 @@
|
||||
"""
|
||||
State management for JumpServer CLI.
|
||||
|
||||
Tracks CLI operational state across commands, including current org,
|
||||
selected assets, filters, and pagination.
|
||||
"""
|
||||
import json
|
||||
from dataclasses import dataclass, field
|
||||
from pathlib import Path
|
||||
from typing import Any
|
||||
|
||||
|
||||
STATE_FILE = Path.home() / ".jumpserver-cli" / "state.json"
|
||||
|
||||
|
||||
@dataclass
|
||||
class CLIState:
|
||||
"""Ephemeral CLI operational state."""
|
||||
|
||||
current_org_id: str = ""
|
||||
current_org_name: str = ""
|
||||
selected_asset_ids: list[str] = field(default_factory=list)
|
||||
selected_node_ids: list[str] = field(default_factory=list)
|
||||
last_filters: dict[str, Any] = field(default_factory=dict)
|
||||
pagination: dict[str, int] = field(default_factory=lambda: {"limit": 20, "offset": 0})
|
||||
dry_run: bool = False
|
||||
|
||||
def save(self) -> None:
|
||||
"""Persist state to disk."""
|
||||
STATE_FILE.parent.mkdir(parents=True, exist_ok=True)
|
||||
STATE_FILE.write_text(json.dumps(self.__dict__, indent=2))
|
||||
|
||||
@classmethod
|
||||
def load(cls) -> "CLIState":
|
||||
"""Load state from disk."""
|
||||
if STATE_FILE.exists():
|
||||
try:
|
||||
data = json.loads(STATE_FILE.read_text())
|
||||
return cls(**data)
|
||||
except (json.JSONDecodeError, TypeError):
|
||||
pass
|
||||
return cls()
|
||||
|
||||
def clear_selection(self) -> None:
|
||||
"""Clear current asset/node selection."""
|
||||
self.selected_asset_ids.clear()
|
||||
self.selected_node_ids.clear()
|
||||
|
||||
def set_filters(self, **kwargs) -> None:
|
||||
"""Set search filters."""
|
||||
self.last_filters.update(kwargs)
|
||||
|
||||
def as_dict(self) -> dict[str, Any]:
|
||||
return self.__dict__
|
||||
|
||||
|
||||
# Global state instance (session-scoped)
|
||||
_state: CLIState | None = None
|
||||
|
||||
|
||||
def get_state() -> CLIState:
|
||||
global _state
|
||||
if _state is None:
|
||||
_state = CLIState.load()
|
||||
return _state
|
||||
|
||||
|
||||
def reset_state() -> None:
|
||||
global _state
|
||||
_state = CLIState()
|
||||
if STATE_FILE.exists():
|
||||
STATE_FILE.unlink()
|
||||
@@ -0,0 +1,312 @@
|
||||
#!/usr/bin/env python3
|
||||
"""
|
||||
JumpServer CLI - A stateful command-line interface for JumpServer bastion host.
|
||||
|
||||
Supports both one-shot commands and interactive REPL mode.
|
||||
Output formats: table (default), json, yaml.
|
||||
|
||||
Usage:
|
||||
jumpserver auth login --url https://jumpserver.example.com --username admin
|
||||
jumpserver asset list --type host
|
||||
jumpserver user list --search admin
|
||||
jumpserver session list --active
|
||||
jumpserver # Enter REPL mode
|
||||
"""
|
||||
|
||||
import sys
|
||||
import os
|
||||
import cmd
|
||||
import shlex
|
||||
import json
|
||||
from typing import Any
|
||||
|
||||
import click
|
||||
|
||||
from cli_anything.jumpserver import __version__
|
||||
from cli_anything.jumpserver.core.session import Session
|
||||
from cli_anything.jumpserver.core.state import get_state, reset_state
|
||||
from cli_anything.jumpserver.core.output import format_output
|
||||
from cli_anything.jumpserver.utils import print_result, CLIError, wants_json_output
|
||||
|
||||
# Import command groups
|
||||
from cli_anything.jumpserver.core.commands_auth import auth_group
|
||||
from cli_anything.jumpserver.core.commands_asset import asset_group
|
||||
from cli_anything.jumpserver.core.commands_user import user_group
|
||||
from cli_anything.jumpserver.core.commands_perm import perm_group
|
||||
from cli_anything.jumpserver.core.commands_account import account_group
|
||||
from cli_anything.jumpserver.core.commands_session import session_group
|
||||
from cli_anything.jumpserver.core.commands_audit import audit_group, ops_group
|
||||
from cli_anything.jumpserver.core.commands_system import (
|
||||
system_group,
|
||||
label_group,
|
||||
role_group,
|
||||
)
|
||||
|
||||
|
||||
class JumpserverCLI(click.Group):
|
||||
"""Custom CLI group with global options and REPL support."""
|
||||
|
||||
def __init__(self, *args, **kwargs):
|
||||
super().__init__(*args, **kwargs)
|
||||
self.add_command(auth_group)
|
||||
self.add_command(asset_group)
|
||||
self.add_command(user_group)
|
||||
self.add_command(perm_group)
|
||||
self.add_command(account_group)
|
||||
self.add_command(session_group)
|
||||
self.add_command(audit_group)
|
||||
self.add_command(ops_group)
|
||||
self.add_command(system_group)
|
||||
self.add_command(label_group)
|
||||
self.add_command(role_group)
|
||||
|
||||
@staticmethod
|
||||
def _start_repl(ctx: click.Context) -> None:
|
||||
"""Start interactive REPL mode."""
|
||||
click.echo(click.style(f"JumpServer CLI v{__version__}", fg="cyan", bold=True))
|
||||
session = Session.load()
|
||||
if session.is_authenticated():
|
||||
click.echo(
|
||||
click.style(
|
||||
f"Connected as {session.username} @ {session.base_url}",
|
||||
fg="green",
|
||||
)
|
||||
)
|
||||
else:
|
||||
click.echo(
|
||||
click.style(
|
||||
"Not authenticated. Use 'auth login' to connect.",
|
||||
fg="yellow",
|
||||
)
|
||||
)
|
||||
click.echo('Type "help" for available commands, "exit" to quit.\n')
|
||||
|
||||
repl = JumpServerREPL(ctx)
|
||||
repl.cmdloop()
|
||||
|
||||
|
||||
class JumpServerREPL(cmd.Cmd):
|
||||
"""JumpServer CLI REPL shell."""
|
||||
|
||||
prompt = click.style("jumpserver> ", fg="cyan")
|
||||
|
||||
def __init__(self, cli_ctx: click.Context):
|
||||
super().__init__()
|
||||
self._ctx = cli_ctx
|
||||
self._session = Session.load()
|
||||
self._available_commands = [
|
||||
"auth login", "auth logout", "auth status", "auth org",
|
||||
"asset list", "asset get", "asset create", "asset update", "asset delete",
|
||||
"asset node list", "asset node create", "asset node delete",
|
||||
"asset platform list", "asset gateway list", "asset gateway test",
|
||||
"asset zone list",
|
||||
"user list", "user get", "user create", "user update", "user delete",
|
||||
"user reset-password", "user unblock", "user profile", "user my-assets",
|
||||
"user group list", "user group create", "user group members",
|
||||
"perm list", "perm get", "perm create", "perm update", "perm delete",
|
||||
"perm users", "perm assets",
|
||||
"account list", "account get", "account create", "account update",
|
||||
"account delete", "account secret view", "account secret history",
|
||||
"account template list",
|
||||
"session list", "session get", "session replay", "session kill",
|
||||
"session command list", "session terminal list", "session terminal status",
|
||||
"audit login", "audit operate", "audit ftp", "audit password", "audit activity",
|
||||
"ops job-list", "ops job-log", "ops adhoc-list", "ops playbook-list",
|
||||
"system settings", "system health", "system info",
|
||||
"label list",
|
||||
"role list", "role bindings",
|
||||
"exit", "help",
|
||||
]
|
||||
|
||||
def default(self, line: str) -> None:
|
||||
"""Execute a Click command from the REPL."""
|
||||
if not line.strip():
|
||||
return
|
||||
|
||||
if line.strip() in ("exit", "quit", "q"):
|
||||
return self.do_exit(line)
|
||||
|
||||
# Rebuild CLI context and invoke
|
||||
args = shlex.split(line)
|
||||
try:
|
||||
with self._ctx.scope():
|
||||
self._ctx.args = args
|
||||
cli = JumpserverCLI(name="jumpserver")
|
||||
cli.main(args=args, prog_name="jumpserver", standalone_mode=False)
|
||||
except SystemExit:
|
||||
pass
|
||||
except click.ClickException as e:
|
||||
e.show()
|
||||
except Exception as e:
|
||||
click.echo(click.style(f"Error: {e}", fg="red"))
|
||||
|
||||
def do_exit(self, arg: str) -> bool:
|
||||
"""Exit the REPL."""
|
||||
click.echo("Goodbye!")
|
||||
return True
|
||||
|
||||
def do_EOF(self, arg: str) -> bool:
|
||||
"""Ctrl+D to exit."""
|
||||
click.echo()
|
||||
return self.do_exit(arg)
|
||||
|
||||
def completedefault(self, text: str, line: str, begidx: int, endidx: int) -> list[str]:
|
||||
"""Tab completion for commands."""
|
||||
parts = line[:begidx].split()
|
||||
completions = []
|
||||
|
||||
for cmd in self._available_commands:
|
||||
cmd_parts = cmd.split()
|
||||
if len(cmd_parts) >= len(parts):
|
||||
if all(
|
||||
cmd_parts[i].startswith(parts[i])
|
||||
for i in range(len(parts))
|
||||
):
|
||||
if len(cmd_parts) > len(parts):
|
||||
completions.append(cmd_parts[len(parts)])
|
||||
elif text and cmd_parts[-1].startswith(text):
|
||||
completions.append(cmd_parts[-1])
|
||||
|
||||
return sorted(set(completions))
|
||||
|
||||
def do_help(self, arg: str) -> None:
|
||||
"""Show available commands."""
|
||||
if arg:
|
||||
return self.default(f"{arg} --help")
|
||||
|
||||
click.echo(click.style("\nJumpServer CLI Commands:", bold=True))
|
||||
groups = {
|
||||
"Authentication": ["auth login", "auth logout", "auth status", "auth org"],
|
||||
"Asset Management": [
|
||||
"asset list", "asset get", "asset create", "asset update", "asset delete",
|
||||
"asset node *", "asset platform list", "asset gateway *", "asset zone list",
|
||||
],
|
||||
"User Management": [
|
||||
"user list", "user get", "user create", "user update", "user delete",
|
||||
"user profile", "user my-assets", "user group *",
|
||||
],
|
||||
"Permissions": ["perm list", "perm get", "perm create", "perm update", "perm delete"],
|
||||
"Accounts": ["account list", "account get", "account create", "account update",
|
||||
"account delete", "account secret *", "account template list"],
|
||||
"Sessions": ["session list", "session get", "session replay", "session kill",
|
||||
"session command list", "session terminal *"],
|
||||
"Audit & Ops": ["audit login", "audit operate", "audit ftp", "audit password",
|
||||
"ops job-list", "ops job-log", "ops playbook-list"],
|
||||
"System": ["system settings", "system health", "system info",
|
||||
"label list", "role list", "role bindings"],
|
||||
}
|
||||
|
||||
for group_name, commands in groups.items():
|
||||
click.echo(click.style(f"\n {group_name}:", fg="yellow"))
|
||||
for cmd in commands:
|
||||
click.echo(f" {cmd}")
|
||||
|
||||
click.echo(click.style("\n Session:", fg="yellow"))
|
||||
click.echo(" exit, quit, Ctrl+D - Exit REPL")
|
||||
click.echo(" help <command> - Show command help")
|
||||
click.echo()
|
||||
|
||||
|
||||
@click.group(cls=JumpserverCLI)
|
||||
@click.version_option(version=__version__, prog_name="jumpserver-cli")
|
||||
@click.option(
|
||||
"--json",
|
||||
"output_json",
|
||||
is_flag=True,
|
||||
default=False,
|
||||
help="Output in JSON format",
|
||||
)
|
||||
@click.option(
|
||||
"--json-output",
|
||||
"json_output",
|
||||
is_flag=True,
|
||||
default=False,
|
||||
help="Output in JSON format (shortcut for -o json)",
|
||||
)
|
||||
@click.option(
|
||||
"--interactive", "-i",
|
||||
is_flag=True,
|
||||
default=False,
|
||||
help="Start interactive REPL mode",
|
||||
)
|
||||
@click.option(
|
||||
"--url",
|
||||
default=None,
|
||||
help="JumpServer URL (overrides saved session)",
|
||||
envvar="JUMPSERVER_URL",
|
||||
)
|
||||
@click.pass_context
|
||||
def main(ctx, output_json, json_output, interactive, url):
|
||||
"""JumpServer CLI - Command-line interface for JumpServer bastion host.
|
||||
|
||||
Manage assets, users, permissions, sessions, and more from your terminal.
|
||||
|
||||
\b
|
||||
Quick Start:
|
||||
jumpserver auth login --url https://js.example.com --username admin
|
||||
jumpserver asset list --type host
|
||||
jumpserver --interactive
|
||||
"""
|
||||
ctx.ensure_object(dict)
|
||||
ctx.obj["output_json"] = output_json or json_output
|
||||
|
||||
if url:
|
||||
session = Session.load()
|
||||
session.base_url = url.rstrip("/")
|
||||
session.save()
|
||||
|
||||
if interactive and ctx.invoked_subcommand is None:
|
||||
JumpserverCLI._start_repl(ctx)
|
||||
return
|
||||
|
||||
if ctx.invoked_subcommand is None:
|
||||
click.echo(ctx.get_help())
|
||||
return
|
||||
|
||||
if interactive:
|
||||
ctx.obj["interactive"] = True
|
||||
|
||||
|
||||
def _show_click_error(error: click.ClickException, json_mode: bool) -> None:
|
||||
"""Render Click errors in JSON mode when requested."""
|
||||
if json_mode:
|
||||
click.echo(
|
||||
json.dumps(
|
||||
{"status": "error", "message": error.format_message()},
|
||||
ensure_ascii=False,
|
||||
),
|
||||
err=True,
|
||||
)
|
||||
return
|
||||
error.show()
|
||||
|
||||
|
||||
def cli_main():
|
||||
"""Entry point for console_scripts."""
|
||||
json_mode = wants_json_output()
|
||||
try:
|
||||
main(standalone_mode=False)
|
||||
except click.exceptions.Exit as e:
|
||||
sys.exit(e.exit_code)
|
||||
except KeyboardInterrupt:
|
||||
click.echo("\nInterrupted.")
|
||||
sys.exit(130)
|
||||
except click.Abort:
|
||||
if json_mode:
|
||||
click.echo(
|
||||
json.dumps({"status": "error", "message": "Aborted."}),
|
||||
err=True,
|
||||
)
|
||||
else:
|
||||
click.echo("Aborted!", err=True)
|
||||
sys.exit(1)
|
||||
except CLIError as e:
|
||||
e.show(json_mode=json_mode)
|
||||
sys.exit(1)
|
||||
except click.ClickException as e:
|
||||
_show_click_error(e, json_mode=json_mode)
|
||||
sys.exit(e.exit_code or 1)
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
cli_main()
|
||||
@@ -0,0 +1,350 @@
|
||||
---
|
||||
name: cli-anything-jumpserver
|
||||
description: Stateful CLI harness for JumpServer bastion host management. Supports asset, user, permission, account, session, audit, and operations management via REST API, with both one-shot and interactive REPL modes.
|
||||
version: 0.1.0
|
||||
category: infrastructure
|
||||
tags:
|
||||
- jumpserver
|
||||
- bastion
|
||||
- pam
|
||||
- security
|
||||
- ssh
|
||||
- cli
|
||||
commands:
|
||||
- group: auth
|
||||
description: Authentication and session management
|
||||
subcommands:
|
||||
- name: login
|
||||
description: Authenticate to JumpServer and store session token
|
||||
options: ["--url", "--username", "--password", "--org", "--insecure"]
|
||||
- name: logout
|
||||
description: Clear the current session
|
||||
- name: status
|
||||
description: Show current authentication status
|
||||
- name: org
|
||||
description: Switch or list organizations
|
||||
options: ["--list"]
|
||||
|
||||
- group: asset
|
||||
description: Manage assets (hosts, devices, databases, nodes, platforms, gateways, zones)
|
||||
subcommands:
|
||||
- name: list
|
||||
description: List assets of a given type
|
||||
options: ["--type", "--search", "--node", "--platform", "--active/--inactive", "--limit", "--offset"]
|
||||
- name: get
|
||||
description: Get details of a specific asset
|
||||
- name: create
|
||||
description: Create a new asset
|
||||
options: ["--name", "--address", "--platform", "--type", "--nodes", "--dry-run"]
|
||||
- name: update
|
||||
description: Update an existing asset
|
||||
options: ["--name", "--address", "--comment", "--active/--inactive", "--dry-run"]
|
||||
- name: delete
|
||||
description: Delete an asset
|
||||
options: ["--force", "--dry-run"]
|
||||
- name: node
|
||||
description: Manage asset nodes (tree organization)
|
||||
subcommands:
|
||||
- name: list
|
||||
description: List nodes
|
||||
options: ["--tree", "--parent"]
|
||||
- name: create
|
||||
description: Create a new node
|
||||
- name: delete
|
||||
description: Delete a node
|
||||
- name: add-assets
|
||||
description: Add assets to a node
|
||||
- name: platform
|
||||
description: Manage asset platforms
|
||||
subcommands:
|
||||
- name: list
|
||||
description: List platforms
|
||||
- name: gateway
|
||||
description: Manage gateways
|
||||
subcommands:
|
||||
- name: list
|
||||
description: List gateways
|
||||
- name: test
|
||||
description: Test gateway connectivity
|
||||
- name: zone
|
||||
description: Manage zones
|
||||
subcommands:
|
||||
- name: list
|
||||
description: List zones
|
||||
|
||||
- group: user
|
||||
description: Manage users and user groups
|
||||
subcommands:
|
||||
- name: list
|
||||
description: List users
|
||||
options: ["--search", "--source", "--active/--inactive"]
|
||||
- name: get
|
||||
description: Get user details
|
||||
- name: create
|
||||
description: Create a new user
|
||||
options: ["--name", "--username", "--email", "--password", "--role", "--dry-run"]
|
||||
- name: update
|
||||
description: Update a user
|
||||
- name: delete
|
||||
description: Delete a user
|
||||
- name: reset-password
|
||||
description: Reset a user's password
|
||||
- name: unblock
|
||||
description: Unblock a locked user
|
||||
- name: profile
|
||||
description: Show current user profile
|
||||
- name: my-assets
|
||||
description: List assets the current user can access
|
||||
- name: group
|
||||
description: Manage user groups
|
||||
subcommands:
|
||||
- name: list
|
||||
description: List user groups
|
||||
- name: create
|
||||
description: Create a user group
|
||||
- name: members
|
||||
description: List members of a user group
|
||||
|
||||
- group: perm
|
||||
description: Manage asset permissions
|
||||
subcommands:
|
||||
- name: list
|
||||
description: List asset permissions
|
||||
options: ["--search", "--user", "--active/--inactive"]
|
||||
- name: get
|
||||
description: Get permission details
|
||||
- name: create
|
||||
description: Create a new asset permission
|
||||
options: ["--name", "--users", "--user-groups", "--assets", "--nodes", "--actions", "--dry-run"]
|
||||
- name: update
|
||||
description: Update an asset permission
|
||||
- name: delete
|
||||
description: Delete an asset permission
|
||||
- name: users
|
||||
description: List users assigned to a permission
|
||||
- name: assets
|
||||
description: List assets authorized by a permission
|
||||
|
||||
- group: account
|
||||
description: Manage asset accounts and credentials
|
||||
subcommands:
|
||||
- name: list
|
||||
description: List asset accounts
|
||||
options: ["--search", "--asset", "--secret-type", "--privileged/--unprivileged"]
|
||||
- name: get
|
||||
description: Get account details
|
||||
- name: create
|
||||
description: Create a new asset account
|
||||
options: ["--asset", "--username", "--secret-type", "--secret", "--dry-run"]
|
||||
- name: update
|
||||
description: Update an asset account
|
||||
- name: delete
|
||||
description: Delete an asset account
|
||||
- name: secret
|
||||
description: View account secrets/passwords
|
||||
subcommands:
|
||||
- name: view
|
||||
description: View an account's password/secret
|
||||
- name: history
|
||||
description: View password change history
|
||||
- name: template
|
||||
description: Manage account templates
|
||||
subcommands:
|
||||
- name: list
|
||||
description: List account templates
|
||||
|
||||
- group: session
|
||||
description: Manage terminal sessions and replays
|
||||
subcommands:
|
||||
- name: list
|
||||
description: List terminal sessions
|
||||
options: ["--search", "--user", "--asset", "--protocol", "--active/--finished"]
|
||||
- name: get
|
||||
description: Get session details
|
||||
- name: replay
|
||||
description: Get session replay URL/info
|
||||
- name: kill
|
||||
description: Kill an active session
|
||||
- name: command
|
||||
description: View session command history
|
||||
subcommands:
|
||||
- name: list
|
||||
description: List command records
|
||||
options: ["--session", "--user", "--risk"]
|
||||
- name: terminal
|
||||
description: Manage terminal components
|
||||
subcommands:
|
||||
- name: list
|
||||
description: List terminal components
|
||||
- name: status
|
||||
description: Get terminal component status
|
||||
|
||||
- group: audit
|
||||
description: View audit logs
|
||||
subcommands:
|
||||
- name: login
|
||||
description: View user login audit logs
|
||||
- name: operate
|
||||
description: View resource operation audit logs
|
||||
- name: ftp
|
||||
description: View FTP file transfer audit logs
|
||||
- name: password
|
||||
description: View password change audit logs
|
||||
- name: activity
|
||||
description: View user activity logs
|
||||
|
||||
- group: ops
|
||||
description: Manage operations and job execution
|
||||
subcommands:
|
||||
- name: job-list
|
||||
description: List execution jobs
|
||||
- name: job-log
|
||||
description: Get job execution log
|
||||
- name: adhoc-list
|
||||
description: List ad-hoc command executions
|
||||
- name: playbook-list
|
||||
description: List Ansible playbooks
|
||||
|
||||
- group: system
|
||||
description: Manage system settings
|
||||
subcommands:
|
||||
- name: settings
|
||||
description: List system settings
|
||||
- name: health
|
||||
description: Check system health
|
||||
- name: info
|
||||
description: Show system information
|
||||
|
||||
- group: label
|
||||
description: Manage labels
|
||||
subcommands:
|
||||
- name: list
|
||||
description: List labels
|
||||
|
||||
- group: role
|
||||
description: Manage roles and permissions
|
||||
subcommands:
|
||||
- name: list
|
||||
description: List roles
|
||||
- name: bindings
|
||||
description: List role bindings
|
||||
---
|
||||
|
||||
# cli-anything-jumpserver
|
||||
|
||||
Stateful CLI harness for JumpServer bastion host. Manage assets, users, permissions, accounts, sessions, audits, and more via the JumpServer REST API.
|
||||
|
||||
## Quick Start
|
||||
|
||||
```bash
|
||||
# Install
|
||||
cd agent-harness && pip install -e .
|
||||
|
||||
# Authenticate
|
||||
cli-anything-jumpserver auth login --url https://jumpserver.example.com --username admin
|
||||
|
||||
# List hosts
|
||||
cli-anything-jumpserver asset list --type host
|
||||
|
||||
# Interactive REPL mode
|
||||
cli-anything-jumpserver --interactive
|
||||
```
|
||||
|
||||
## Agent Usage Guidance
|
||||
|
||||
This CLI is designed for AI agent consumption. Key features for agents:
|
||||
|
||||
### JSON Output Mode
|
||||
All commands support `--output json` for machine-parseable output:
|
||||
```bash
|
||||
cli-anything-jumpserver asset list --type host --output json
|
||||
```
|
||||
|
||||
### Dry Run Mode
|
||||
All mutation commands support `--dry-run` to preview without execution:
|
||||
```bash
|
||||
cli-anything-jumpserver asset create --name test --address 10.0.0.1 --platform 1 --dry-run --output json
|
||||
```
|
||||
|
||||
### Environment Variables
|
||||
- `JUMPSERVER_URL` - Default JumpServer URL
|
||||
- `JUMPSERVER_USERNAME` - Default username
|
||||
- `JUMPSERVER_PASSWORD` - Default password
|
||||
|
||||
### Typical Agent Workflows
|
||||
|
||||
**1. Discovery and Inventory**
|
||||
```bash
|
||||
# Check connection
|
||||
cli-anything-jumpserver auth status --output json
|
||||
|
||||
# List all hosts
|
||||
cli-anything-jumpserver asset list --type host --output json
|
||||
|
||||
# Get asset details
|
||||
cli-anything-jumpserver asset get <ID> --type host --output json
|
||||
|
||||
# List all users
|
||||
cli-anything-jumpserver user list --output json
|
||||
```
|
||||
|
||||
**2. User and Permission Management**
|
||||
```bash
|
||||
# Create user
|
||||
cli-anything-jumpserver user create --name "New User" --username newuser --email user@example.com --output json --dry-run
|
||||
|
||||
# Grant asset access
|
||||
cli-anything-jumpserver perm create --name "App Access" --users "user1,user2" --assets "asset1,asset2" --output json --dry-run
|
||||
|
||||
# Verify permissions
|
||||
cli-anything-jumpserver perm users <PERM_ID> --output json
|
||||
```
|
||||
|
||||
**3. Security Audit**
|
||||
```bash
|
||||
# Check failed logins
|
||||
cli-anything-jumpserver audit login --status failed --output json
|
||||
|
||||
# Review operations
|
||||
cli-anything-jumpserver audit operate --action delete --output json
|
||||
|
||||
# Check active sessions
|
||||
cli-anything-jumpserver session list --active --output json
|
||||
|
||||
# View command history
|
||||
cli-anything-jumpserver session command list --risk 5 --output json
|
||||
```
|
||||
|
||||
**4. Session Management**
|
||||
```bash
|
||||
# Monitor active sessions
|
||||
cli-anything-jumpserver session list --active --output json
|
||||
|
||||
# Check terminal health
|
||||
cli-anything-jumpserver session terminal list --output json
|
||||
cli-anything-jumpserver session terminal status <TERMINAL_ID> --output json
|
||||
```
|
||||
|
||||
## Output Formats
|
||||
|
||||
| Format | Flag | Use Case |
|
||||
|--------|------|----------|
|
||||
| Table | `--output table` (default) | Human-readable display |
|
||||
| JSON | `--output json` | Agent consumption, scripting |
|
||||
| YAML | `--output yaml` | Configuration, readability |
|
||||
|
||||
## Exit Codes
|
||||
|
||||
| Code | Meaning |
|
||||
|------|---------|
|
||||
| 0 | Success |
|
||||
| 1 | CLI error (auth, API, etc.) |
|
||||
| 2 | Usage error (invalid options/arguments) |
|
||||
| 130 | Interrupted (Ctrl+C) |
|
||||
|
||||
## File Locations
|
||||
|
||||
| Path | Purpose |
|
||||
|------|---------|
|
||||
| `~/.jumpserver-cli/session.json` | Authentication session |
|
||||
| `~/.jumpserver-cli/state.json` | CLI operational state |
|
||||
@@ -0,0 +1,250 @@
|
||||
# JumpServer CLI Test Plan
|
||||
|
||||
## Overview
|
||||
|
||||
This document outlines the comprehensive test plan for the `cli-anything-jumpserver` CLI harness. Tests are divided into unit tests (synthetic data, no external dependencies) and E2E tests (real CLI execution via subprocess).
|
||||
|
||||
## Test Structure
|
||||
|
||||
```
|
||||
tests/
|
||||
├── TEST.md # This file (plan + results)
|
||||
├── test_core.py # Unit tests (synthetic)
|
||||
└── test_full_e2e.py # E2E tests (subprocess)
|
||||
```
|
||||
|
||||
## 1. Unit Tests (`test_core.py`)
|
||||
|
||||
### 1.1 Session Management
|
||||
- TestSessionInit: Session default values, field types
|
||||
- TestSessionSaveLoad: Round-trip save/load persistence to ~/.jumpserver-cli/session.json
|
||||
- TestSessionAuth: is_authenticated() with valid/expired/no token
|
||||
- TestSessionClear: Clear removes session file
|
||||
|
||||
### 1.2 JumpServerClient
|
||||
- TestClientURL: URL construction for API paths
|
||||
- TestClientHeaders: Correct headers (Authorization, X-JMS-ORG, Content-Type)
|
||||
- TestClientLogin: Mock login flow stores token
|
||||
- TestClientPagination: Paginate yields all pages correctly
|
||||
|
||||
### 1.3 CLIState
|
||||
- TestStateDefaults: Default values
|
||||
- TestStateSaveLoad: Round-trip persistence
|
||||
- TestStateClearSelection: Resets selected assets/nodes
|
||||
- TestStateFilters: Set and retrieve filters
|
||||
|
||||
### 1.4 Output Formatting
|
||||
- TestFormatTable: Table output for list of dicts
|
||||
- TestFormatJSON: JSON output is valid parseable JSON
|
||||
- TestFormatYAML: YAML output is parseable
|
||||
- TestFormatDict: Single dict rendered as key-value
|
||||
- TestFormatEmpty: Empty list shows "(no results)"
|
||||
|
||||
### 1.5 Utilities
|
||||
- TestRequireAuth: Raises when not authenticated, returns client when authenticated
|
||||
- TestHandleAPIError: Handles 400/403/404/500 responses
|
||||
- TestParseIDs: Parses comma-separated IDs correctly, handles None and empty
|
||||
- TestValidateOutputFormat: Accepts valid formats, rejects invalid
|
||||
|
||||
## 2. E2E Tests (`test_full_e2e.py`)
|
||||
|
||||
### 2.1 TestCLISubprocess
|
||||
- Uses `_resolve_cli("cli-anything-jumpserver")` for all subprocess invocations
|
||||
- Always in `--output json` mode for machine-parseable verification
|
||||
- Use `CLI_ANYTHING_FORCE_INSTALLED=1` env for tests
|
||||
|
||||
### 2.2 CLI Discovery
|
||||
- TestCLIInstalled: `which cli-anything-jumpserver` returns valid path
|
||||
- TestVersion: `--version` outputs version string
|
||||
- TestHelp: `--help` produces expected sections
|
||||
|
||||
### 2.3 Auth Flow (with mock server)
|
||||
- TestAuthStatusNoSession: "auth status" without session
|
||||
- TestAuthLoginHelp: "auth login --help" output check
|
||||
- TestAuthArgsValidation: Error on missing required args
|
||||
|
||||
### 2.4 Command Coverage
|
||||
- Test each major command group `--help` output:
|
||||
- asset, user, perm, account, session, audit, ops, system, label, role
|
||||
|
||||
### 2.5 Output Formats
|
||||
- Test JSON output is parseable for each command group
|
||||
- Test output format switch works
|
||||
|
||||
### 2.6 Dry Run
|
||||
- Test `--dry-run` flag exists on mutation commands
|
||||
|
||||
### 2.7 Parameter Validation
|
||||
- Test invalid output format raises error
|
||||
- Test required parameter errors
|
||||
|
||||
## 3. Workflow Test Scenarios
|
||||
|
||||
### 3.1 Full Management Flow (simulated)
|
||||
1. Login → authenticate
|
||||
2. List hosts → verify filtering
|
||||
3. List users → verify search
|
||||
4. Check permissions → verify structure
|
||||
5. List sessions → verify format
|
||||
6. Check audit logs → verify access
|
||||
7. Logout → clean up
|
||||
|
||||
### 3.2 Error Handling
|
||||
- 401 Unauthorized response handling
|
||||
- Connection error handling
|
||||
- Invalid parameter handling
|
||||
|
||||
---
|
||||
|
||||
# Test Results
|
||||
|
||||
**Date:** 2026-05-31
|
||||
**Total:** 103 tests
|
||||
**Passed:** 103 (100%)
|
||||
**Failed:** 0
|
||||
**Duration:** 8.44s
|
||||
|
||||
## Unit Tests (`test_core.py`): 59/59 passed
|
||||
|
||||
```
|
||||
TestSessionInit::test_defaults PASSED
|
||||
TestSessionInit::test_custom_values PASSED
|
||||
TestSessionSaveLoad::test_save_creates_file PASSED
|
||||
TestSessionSaveLoad::test_load_returns_session PASSED
|
||||
TestSessionSaveLoad::test_load_nonexistent_returns_empty PASSED
|
||||
TestSessionSaveLoad::test_load_corrupted_file_returns_empty PASSED
|
||||
TestSessionSaveLoad::test_clear_removes_file PASSED
|
||||
TestSessionSaveLoad::test_clear_nonexistent_file PASSED
|
||||
TestSessionAuth::test_no_token_not_authenticated PASSED
|
||||
TestSessionAuth::test_valid_token_is_authenticated PASSED
|
||||
TestSessionAuth::test_expired_token_not_authenticated PASSED
|
||||
TestSessionAuth::test_no_token_expiry PASSED
|
||||
TestClientURLConstruction::test_basic_url PASSED
|
||||
TestClientURLConstruction::test_strip_trailing_slash PASSED
|
||||
TestClientURLConstruction::test_leading_slash_stripped PASSED
|
||||
TestClientHeaders::test_basic_headers PASSED
|
||||
TestClientHeaders::test_auth_header PASSED
|
||||
TestClientHeaders::test_org_header PASSED
|
||||
TestClientHeaders::test_no_auth_header_without_token PASSED
|
||||
TestClientHeaders::test_no_org_header_without_org PASSED
|
||||
TestClientLogin::test_login_stores_token PASSED
|
||||
TestClientLogin::test_login_raises_on_failure PASSED
|
||||
TestClientPagination::test_paginate_single_page PASSED
|
||||
TestClientPagination::test_paginate_multiple_pages PASSED
|
||||
TestClientPagination::test_paginate_empty PASSED
|
||||
TestCLIState::test_defaults PASSED
|
||||
TestCLIState::test_save_load PASSED
|
||||
TestCLIState::test_clear_selection PASSED
|
||||
TestCLIState::test_set_filters PASSED
|
||||
TestCLIState::test_as_dict PASSED
|
||||
TestGlobalState::test_get_state_returns_instance PASSED
|
||||
TestGlobalState::test_get_state_cached PASSED
|
||||
TestGlobalState::test_reset_state PASSED
|
||||
TestOutputFormatting::test_json_output PASSED
|
||||
TestOutputFormatting::test_json_output_is_parseable PASSED
|
||||
TestOutputFormatting::test_table_output_for_list PASSED
|
||||
TestOutputFormatting::test_table_output_for_dict PASSED
|
||||
TestOutputFormatting::test_table_output_empty_list PASSED
|
||||
TestOutputFormatting::test_yaml_output PASSED
|
||||
TestRequireAuth::test_raises_when_not_authenticated PASSED
|
||||
TestRequireAuth::test_returns_client_when_authenticated PASSED
|
||||
TestHandleAPIError::test_400_raises_cli_error PASSED
|
||||
TestHandleAPIError::test_403_raises_cli_error PASSED
|
||||
TestHandleAPIError::test_404_raises_cli_error PASSED
|
||||
TestHandleAPIError::test_500_with_text_body PASSED
|
||||
TestHandleAPIError::test_200_does_not_raise PASSED
|
||||
TestParseIDs::test_parses_comma_separated PASSED
|
||||
TestParseIDs::test_parses_spaces PASSED
|
||||
TestParseIDs::test_single_id PASSED
|
||||
TestParseIDs::test_none_returns_none PASSED
|
||||
TestParseIDs::test_empty_string_returns_none PASSED
|
||||
TestParseIDs::test_handles_uuid PASSED
|
||||
TestValidateOutputFormat::test_valid_formats PASSED
|
||||
TestValidateOutputFormat::test_case_insensitive PASSED
|
||||
TestValidateOutputFormat::test_invalid_format_raises PASSED
|
||||
TestValidateOutputFormat::test_empty_string_raises PASSED
|
||||
TestCLIError::test_message_only PASSED
|
||||
TestCLIError::test_message_with_detail PASSED
|
||||
TestTruncation::test_truncate_value PASSED
|
||||
```
|
||||
|
||||
## E2E Tests (`test_full_e2e.py`): 44/44 passed
|
||||
|
||||
```
|
||||
TestCLIDiscovery::test_help_output PASSED
|
||||
TestCLIDiscovery::test_version PASSED
|
||||
TestCLIDiscovery::test_help_contains_command_groups PASSED
|
||||
TestAuthCommands::test_auth_help PASSED
|
||||
TestAuthCommands::test_auth_status_no_session PASSED
|
||||
TestAuthCommands::test_auth_login_help PASSED
|
||||
TestAuthCommands::test_auth_login_requires_url PASSED
|
||||
TestAuthCommands::test_auth_org_help PASSED
|
||||
TestAssetCommands::test_asset_help PASSED
|
||||
TestAssetCommands::test_asset_type_option PASSED
|
||||
TestAssetCommands::test_asset_create_requires_params PASSED
|
||||
TestAssetCommands::test_asset_create_has_dry_run PASSED
|
||||
TestAssetCommands::test_asset_update_has_dry_run PASSED
|
||||
TestAssetCommands::test_asset_delete_has_dry_run PASSED
|
||||
TestAssetCommands::test_asset_node_help PASSED
|
||||
TestUserCommands::test_user_help PASSED
|
||||
TestUserCommands::test_user_create_requires_params PASSED
|
||||
TestUserCommands::test_user_profile_help PASSED
|
||||
TestUserCommands::test_user_my_assets_help PASSED
|
||||
TestPermCommands::test_perm_help PASSED
|
||||
TestPermCommands::test_perm_create_has_dry_run PASSED
|
||||
TestPermCommands::test_perm_delete_has_force PASSED
|
||||
TestAccountCommands::test_account_help PASSED
|
||||
TestAccountCommands::test_account_secret_help PASSED
|
||||
TestSessionCommands::test_session_help PASSED
|
||||
TestSessionCommands::test_session_kill_has_force PASSED
|
||||
TestAuditCommands::test_audit_help PASSED
|
||||
TestOpsCommands::test_ops_help PASSED
|
||||
TestSystemCommands::test_system_help PASSED
|
||||
TestOutputFormats::test_json_output_works PASSED
|
||||
TestOutputFormats::test_output_option_table PASSED
|
||||
TestDryRun::test_dry_run_asset_create PASSED
|
||||
TestDryRun::test_dry_run_user_create PASSED
|
||||
TestDryRun::test_dry_run_perm_create PASSED
|
||||
TestDryRun::test_dry_run_asset_delete PASSED
|
||||
TestErrorHandling::test_invalid_output_format PASSED
|
||||
TestErrorHandling::test_missing_required_option PASSED
|
||||
TestREPLMode::test_interactive_flag PASSED
|
||||
TestWorkflow::test_full_help_coverage PASSED
|
||||
TestWorkflow::test_dry_run_mutation_commands PASSED
|
||||
TestWorkflow::test_json_output_for_all_list_commands PASSED
|
||||
TestCLIParameterValidation::test_asset_type_validation PASSED
|
||||
TestCLIParameterValidation::test_output_choice_validation PASSED
|
||||
TestCLIParameterValidation::test_secret_type_validation PASSED
|
||||
```
|
||||
|
||||
## Coverage Summary
|
||||
|
||||
| Category | Tests | Passed | Status |
|
||||
|----------|-------|--------|--------|
|
||||
| Session Management | 8 | 8 | ✓ |
|
||||
| API Client | 9 | 9 | ✓ |
|
||||
| CLI State | 6 | 6 | ✓ |
|
||||
| Output Formatting | 6 | 6 | ✓ |
|
||||
| Error Handling | 10 | 10 | ✓ |
|
||||
| CLI Discovery & Help | 11 | 11 | ✓ |
|
||||
| Auth Commands | 4 | 4 | ✓ |
|
||||
| Asset Commands | 7 | 7 | ✓ |
|
||||
| User Commands | 4 | 4 | ✓ |
|
||||
| Permission Commands | 3 | 3 | ✓ |
|
||||
| Account Commands | 2 | 2 | ✓ |
|
||||
| Session Commands | 2 | 2 | ✓ |
|
||||
| Audit/Ops/System Commands | 3 | 3 | ✓ |
|
||||
| Output Formats (E2E) | 2 | 2 | ✓ |
|
||||
| Dry Run (E2E) | 4 | 4 | ✓ |
|
||||
| Workflow Tests | 3 | 3 | ✓ |
|
||||
| Parameter Validation | 3 | 3 | ✓ |
|
||||
| Utilities | 13 | 13 | ✓ |
|
||||
| **TOTAL** | **103** | **103** | ✓ 100% |
|
||||
|
||||
## Known Gaps (no gaps)
|
||||
|
||||
All planned test categories are covered. The following areas could benefit from additional tests in future iterations:
|
||||
1. Integration tests with a live JumpServer instance (requires test environment)
|
||||
2. REPL interactive mode tests (requires PTY)
|
||||
3. Authentication token refresh tests
|
||||
4. Concurrent session access edge cases
|
||||
@@ -0,0 +1,571 @@
|
||||
"""
|
||||
Unit tests for cli_anything.jumpserver core modules.
|
||||
|
||||
Uses synthetic data with no external dependencies.
|
||||
Mock HTTP responses for client tests.
|
||||
"""
|
||||
import json
|
||||
import io
|
||||
import tempfile
|
||||
import os
|
||||
import sys
|
||||
import time
|
||||
from pathlib import Path
|
||||
from unittest.mock import patch, MagicMock
|
||||
|
||||
import pytest
|
||||
|
||||
# Add agent-harness to path for local testing
|
||||
sys.path.insert(0, str(Path(__file__).resolve().parent.parent.parent.parent))
|
||||
|
||||
from cli_anything.jumpserver.core.session import Session, JumpServerClient, SESSION_FILE
|
||||
from cli_anything.jumpserver.core.state import CLIState, get_state, reset_state, STATE_FILE
|
||||
from cli_anything.jumpserver.core.output import format_output
|
||||
from cli_anything.jumpserver.utils import (
|
||||
require_auth,
|
||||
handle_api_error,
|
||||
parse_ids,
|
||||
validate_output_format,
|
||||
mask_sensitive_data,
|
||||
CLIError,
|
||||
)
|
||||
|
||||
|
||||
# ─── Fixtures ────────────────────────────────────────────────────
|
||||
|
||||
|
||||
@pytest.fixture(autouse=True)
|
||||
def clean_session_state():
|
||||
"""Ensure session and state files don't persist between tests."""
|
||||
for f in (SESSION_FILE, STATE_FILE):
|
||||
if f.exists():
|
||||
f.unlink()
|
||||
reset_state()
|
||||
yield
|
||||
for f in (SESSION_FILE, STATE_FILE):
|
||||
if f.exists():
|
||||
f.unlink()
|
||||
reset_state()
|
||||
|
||||
|
||||
@pytest.fixture
|
||||
def empty_session():
|
||||
return Session()
|
||||
|
||||
|
||||
@pytest.fixture
|
||||
def auth_session():
|
||||
return Session(
|
||||
base_url="https://jumpserver.example.com",
|
||||
username="admin",
|
||||
token="abc123test",
|
||||
token_expiry=time.time() + 3600,
|
||||
org_id="00000000-0000-0000-0000-000000000002",
|
||||
org_name="Default",
|
||||
)
|
||||
|
||||
|
||||
@pytest.fixture
|
||||
def expired_session():
|
||||
return Session(
|
||||
base_url="https://jumpserver.example.com",
|
||||
username="admin",
|
||||
token="expired123",
|
||||
token_expiry=time.time() - 3600,
|
||||
)
|
||||
|
||||
|
||||
# ─── Session Tests ───────────────────────────────────────────────
|
||||
|
||||
|
||||
class TestSessionInit:
|
||||
"""Session default initialization."""
|
||||
|
||||
def test_defaults(self, empty_session):
|
||||
assert empty_session.base_url == ""
|
||||
assert empty_session.username == ""
|
||||
assert empty_session.token == ""
|
||||
assert empty_session.token_expiry == 0.0
|
||||
assert empty_session.verify_ssl is True
|
||||
assert empty_session.timeout == 60
|
||||
|
||||
def test_custom_values(self, auth_session):
|
||||
assert auth_session.base_url == "https://jumpserver.example.com"
|
||||
assert auth_session.username == "admin"
|
||||
assert auth_session.token == "abc123test"
|
||||
assert auth_session.org_id == "00000000-0000-0000-0000-000000000002"
|
||||
|
||||
|
||||
class TestSessionSaveLoad:
|
||||
"""Session save/load round-trip."""
|
||||
|
||||
def test_save_creates_file(self, auth_session):
|
||||
auth_session.save()
|
||||
assert SESSION_FILE.exists()
|
||||
|
||||
def test_load_returns_session(self, auth_session):
|
||||
auth_session.save()
|
||||
loaded = Session.load()
|
||||
assert loaded.base_url == auth_session.base_url
|
||||
assert loaded.username == "admin"
|
||||
assert loaded.token == "abc123test"
|
||||
assert loaded.org_id == auth_session.org_id
|
||||
assert loaded.token_expiry == auth_session.token_expiry
|
||||
|
||||
def test_load_nonexistent_returns_empty(self):
|
||||
if SESSION_FILE.exists():
|
||||
SESSION_FILE.unlink()
|
||||
loaded = Session.load()
|
||||
assert loaded.token == ""
|
||||
assert loaded.base_url == ""
|
||||
|
||||
def test_load_corrupted_file_returns_empty(self):
|
||||
SESSION_FILE.parent.mkdir(parents=True, exist_ok=True)
|
||||
SESSION_FILE.write_text("{not valid json")
|
||||
loaded = Session.load()
|
||||
assert loaded.token == ""
|
||||
|
||||
def test_clear_removes_file(self, auth_session):
|
||||
auth_session.save()
|
||||
assert SESSION_FILE.exists()
|
||||
auth_session.clear()
|
||||
assert not SESSION_FILE.exists()
|
||||
|
||||
def test_clear_nonexistent_file(self, empty_session):
|
||||
empty_session.clear() # should not raise
|
||||
|
||||
|
||||
class TestSessionAuth:
|
||||
"""Authentication state checks."""
|
||||
|
||||
def test_no_token_not_authenticated(self, empty_session):
|
||||
assert not empty_session.is_authenticated()
|
||||
|
||||
def test_valid_token_is_authenticated(self, auth_session):
|
||||
assert auth_session.is_authenticated()
|
||||
|
||||
def test_expired_token_not_authenticated(self, expired_session):
|
||||
assert not expired_session.is_authenticated()
|
||||
|
||||
def test_no_token_expiry(self):
|
||||
s = Session(token="test")
|
||||
# token_expiry defaults to 0.0, which means "no expiry set"
|
||||
# we consider a token without expiry as valid
|
||||
assert s.is_authenticated()
|
||||
|
||||
|
||||
# ─── JumpServerClient Tests ──────────────────────────────────────
|
||||
|
||||
|
||||
class TestClientURLConstruction:
|
||||
"""URL construction from base URL + API path."""
|
||||
|
||||
def test_basic_url(self, auth_session):
|
||||
client = auth_session.get_client()
|
||||
url = client._url("users/users/")
|
||||
assert url == "https://jumpserver.example.com/api/v1/users/users/"
|
||||
|
||||
def test_strip_trailing_slash(self):
|
||||
s = Session(base_url="https://js.example.com/", token="x")
|
||||
client = s.get_client()
|
||||
url = client._url("assets/hosts/")
|
||||
assert url == "https://js.example.com/api/v1/assets/hosts/"
|
||||
|
||||
def test_leading_slash_stripped(self, auth_session):
|
||||
client = auth_session.get_client()
|
||||
url = client._url("/users/profile/")
|
||||
assert url == "https://jumpserver.example.com/api/v1/users/profile/"
|
||||
|
||||
|
||||
class TestClientHeaders:
|
||||
"""HTTP header construction."""
|
||||
|
||||
def test_basic_headers(self, auth_session):
|
||||
client = auth_session.get_client()
|
||||
headers = client.headers
|
||||
assert headers["Accept"] == "application/json"
|
||||
assert headers["Content-Type"] == "application/json"
|
||||
|
||||
def test_auth_header(self, auth_session):
|
||||
client = auth_session.get_client()
|
||||
assert client.headers["Authorization"] == "Token abc123test"
|
||||
|
||||
def test_org_header(self, auth_session):
|
||||
client = auth_session.get_client()
|
||||
assert client.headers["X-JMS-ORG"] == "00000000-0000-0000-0000-000000000002"
|
||||
|
||||
def test_no_auth_header_without_token(self, empty_session):
|
||||
client = empty_session.get_client()
|
||||
assert "Authorization" not in client.headers
|
||||
|
||||
def test_no_org_header_without_org(self):
|
||||
s = Session(base_url="https://js.example.com", token="x")
|
||||
client = s.get_client()
|
||||
assert "X-JMS-ORG" not in client.headers
|
||||
|
||||
|
||||
class TestClientLogin:
|
||||
"""Login flow with mocked responses."""
|
||||
|
||||
@patch("requests.Session.request")
|
||||
def test_login_stores_token(self, mock_request, empty_session):
|
||||
mock_response = MagicMock()
|
||||
mock_response.json.return_value = {"token": "new-token-456"}
|
||||
mock_response.raise_for_status.return_value = None
|
||||
mock_request.return_value = mock_response
|
||||
|
||||
client = empty_session.get_client()
|
||||
result = client.login("admin", "password123")
|
||||
|
||||
assert result["token"] == "new-token-456"
|
||||
assert empty_session.token == "new-token-456"
|
||||
assert empty_session.username == "admin"
|
||||
assert empty_session.is_authenticated()
|
||||
|
||||
@patch("requests.Session.request")
|
||||
def test_login_raises_on_failure(self, mock_request, empty_session):
|
||||
import requests
|
||||
mock_response = MagicMock()
|
||||
mock_response.raise_for_status.side_effect = requests.HTTPError("401 Unauthorized")
|
||||
mock_request.return_value = mock_response
|
||||
|
||||
client = empty_session.get_client()
|
||||
with pytest.raises(requests.HTTPError):
|
||||
client.login("admin", "wrong-password")
|
||||
|
||||
|
||||
class TestClientPagination:
|
||||
"""Pagination helper."""
|
||||
|
||||
@patch("requests.Session.request")
|
||||
def test_paginate_single_page(self, mock_request, auth_session):
|
||||
mock_response = MagicMock()
|
||||
mock_response.json.return_value = {"results": [{"id": 1}, {"id": 2}]}
|
||||
mock_response.raise_for_status.return_value = None
|
||||
mock_request.return_value = mock_response
|
||||
|
||||
client = auth_session.get_client()
|
||||
results = list(client.paginate("assets/hosts/"))
|
||||
|
||||
assert len(results) == 2
|
||||
assert results[0]["id"] == 1
|
||||
|
||||
@patch("requests.Session.request")
|
||||
def test_paginate_multiple_pages(self, mock_request, auth_session):
|
||||
page1 = MagicMock()
|
||||
page1.json.return_value = {"results": [{"id": i} for i in range(100)]}
|
||||
page1.raise_for_status.return_value = None
|
||||
|
||||
page2 = MagicMock()
|
||||
page2.json.return_value = {"results": [{"id": i} for i in range(100, 150)]}
|
||||
page2.raise_for_status.return_value = None
|
||||
|
||||
mock_request.side_effect = [page1, page2]
|
||||
|
||||
client = auth_session.get_client()
|
||||
results = list(client.paginate("assets/hosts/", limit=100))
|
||||
|
||||
assert len(results) == 150
|
||||
assert results[0]["id"] == 0
|
||||
assert results[-1]["id"] == 149
|
||||
|
||||
@patch("requests.Session.request")
|
||||
def test_paginate_empty(self, mock_request, auth_session):
|
||||
mock_response = MagicMock()
|
||||
mock_response.json.return_value = {"results": []}
|
||||
mock_response.raise_for_status.return_value = None
|
||||
mock_request.return_value = mock_response
|
||||
|
||||
client = auth_session.get_client()
|
||||
results = list(client.paginate("assets/hosts/"))
|
||||
assert len(results) == 0
|
||||
|
||||
|
||||
# ─── CLIState Tests ──────────────────────────────────────────────
|
||||
|
||||
|
||||
class TestCLIState:
|
||||
"""CLI operational state tests."""
|
||||
|
||||
def test_defaults(self):
|
||||
state = CLIState()
|
||||
assert state.current_org_id == ""
|
||||
assert state.selected_asset_ids == []
|
||||
assert state.pagination == {"limit": 20, "offset": 0}
|
||||
assert state.dry_run is False
|
||||
|
||||
def test_save_load(self):
|
||||
state = CLIState(
|
||||
current_org_id="org-123",
|
||||
selected_asset_ids=["a1", "a2"],
|
||||
last_filters={"search": "web"},
|
||||
)
|
||||
state.save()
|
||||
assert STATE_FILE.exists()
|
||||
|
||||
loaded = CLIState.load()
|
||||
assert loaded.current_org_id == "org-123"
|
||||
assert loaded.selected_asset_ids == ["a1", "a2"]
|
||||
assert loaded.last_filters == {"search": "web"}
|
||||
|
||||
def test_clear_selection(self):
|
||||
state = CLIState(selected_asset_ids=["a1", "a2"], selected_node_ids=["n1"])
|
||||
state.clear_selection()
|
||||
assert state.selected_asset_ids == []
|
||||
assert state.selected_node_ids == []
|
||||
|
||||
def test_set_filters(self):
|
||||
state = CLIState()
|
||||
state.set_filters(search="test", status="active")
|
||||
assert state.last_filters == {"search": "test", "status": "active"}
|
||||
|
||||
def test_as_dict(self):
|
||||
state = CLIState(dry_run=True)
|
||||
d = state.as_dict()
|
||||
assert isinstance(d, dict)
|
||||
assert d["dry_run"] is True
|
||||
|
||||
|
||||
class TestGlobalState:
|
||||
"""get_state/reset_state functions."""
|
||||
|
||||
def test_get_state_returns_instance(self, clean_session_state):
|
||||
state = get_state()
|
||||
assert isinstance(state, CLIState)
|
||||
|
||||
def test_get_state_cached(self, clean_session_state):
|
||||
s1 = get_state()
|
||||
s2 = get_state()
|
||||
assert s1 is s2 # same instance
|
||||
|
||||
def test_reset_state(self, clean_session_state):
|
||||
state = get_state()
|
||||
state.selected_asset_ids = ["test"]
|
||||
reset_state()
|
||||
new_state = get_state()
|
||||
assert new_state.selected_asset_ids == []
|
||||
assert new_state is not state
|
||||
|
||||
|
||||
# ─── Output Formatting Tests ─────────────────────────────────────
|
||||
|
||||
|
||||
class TestOutputFormatting:
|
||||
"""format_output function tests."""
|
||||
|
||||
def test_json_output(self):
|
||||
data = {"key": "value", "list": [1, 2, 3]}
|
||||
buf = io.StringIO()
|
||||
format_output(data, fmt="json", stream=buf)
|
||||
output = buf.getvalue()
|
||||
parsed = json.loads(output)
|
||||
assert parsed == data
|
||||
|
||||
def test_json_output_is_parseable(self):
|
||||
data = [{"id": 1, "name": "test"}, {"id": 2, "name": "test2"}]
|
||||
buf = io.StringIO()
|
||||
format_output(data, fmt="json", stream=buf)
|
||||
output = buf.getvalue()
|
||||
parsed = json.loads(output)
|
||||
assert len(parsed) == 2
|
||||
|
||||
def test_table_output_for_list(self):
|
||||
data = [{"name": "Alice", "role": "Admin"}, {"name": "Bob", "role": "User"}]
|
||||
buf = io.StringIO()
|
||||
format_output(data, fmt="table", columns=["name", "role"], stream=buf)
|
||||
output = buf.getvalue()
|
||||
assert "Alice" in output
|
||||
assert "Bob" in output
|
||||
assert "Admin" in output
|
||||
assert "2 result" in output
|
||||
|
||||
def test_table_output_for_dict(self):
|
||||
data = {"name": "test-host", "address": "192.168.1.1"}
|
||||
buf = io.StringIO()
|
||||
format_output(data, fmt="table", stream=buf)
|
||||
output = buf.getvalue()
|
||||
assert "name" in output
|
||||
assert "test-host" in output
|
||||
|
||||
def test_table_output_empty_list(self):
|
||||
buf = io.StringIO()
|
||||
format_output([], fmt="table", stream=buf)
|
||||
output = buf.getvalue()
|
||||
assert "no results" in output
|
||||
|
||||
def test_yaml_output(self):
|
||||
data = {"key": "value", "list": [1, 2]}
|
||||
buf = io.StringIO()
|
||||
format_output(data, fmt="yaml", stream=buf)
|
||||
output = buf.getvalue()
|
||||
# Basic check that it contains expected keys
|
||||
assert "key" in output
|
||||
assert "value" in output
|
||||
|
||||
|
||||
class TestPackagingMetadata:
|
||||
"""Package metadata regressions."""
|
||||
|
||||
def test_readme_paths_exist(self):
|
||||
harness_root = Path(__file__).resolve().parents[3]
|
||||
readme_path = harness_root / "cli_anything" / "jumpserver" / "README.md"
|
||||
assert readme_path.exists()
|
||||
assert 'readme = "cli_anything/jumpserver/README.md"' in (
|
||||
harness_root / "pyproject.toml"
|
||||
).read_text()
|
||||
assert 'open("cli_anything/jumpserver/README.md", "r")' in (
|
||||
harness_root / "setup.py"
|
||||
).read_text()
|
||||
|
||||
|
||||
# ─── Utility Tests ───────────────────────────────────────────────
|
||||
|
||||
|
||||
class TestRequireAuth:
|
||||
"""require_auth function."""
|
||||
|
||||
def test_raises_when_not_authenticated(self, empty_session):
|
||||
with pytest.raises(CLIError, match="Not authenticated"):
|
||||
require_auth(empty_session)
|
||||
|
||||
def test_returns_client_when_authenticated(self, auth_session):
|
||||
client = require_auth(auth_session)
|
||||
assert isinstance(client, JumpServerClient)
|
||||
|
||||
|
||||
class TestHandleAPIError:
|
||||
"""handle_api_error function."""
|
||||
|
||||
@patch("requests.Response")
|
||||
def test_400_raises_cli_error(self, mock_resp, auth_session):
|
||||
mock_resp.status_code = 400
|
||||
mock_resp.json.return_value = {"detail": "Bad request"}
|
||||
with pytest.raises(CLIError, match="Bad request"):
|
||||
handle_api_error(mock_resp, "test action")
|
||||
|
||||
@patch("requests.Response")
|
||||
def test_403_raises_cli_error(self, mock_resp, auth_session):
|
||||
mock_resp.status_code = 403
|
||||
mock_resp.json.return_value = {"detail": "Forbidden"}
|
||||
with pytest.raises(CLIError, match="Forbidden"):
|
||||
handle_api_error(mock_resp, "update")
|
||||
|
||||
@patch("requests.Response")
|
||||
def test_404_raises_cli_error(self, mock_resp, auth_session):
|
||||
mock_resp.status_code = 404
|
||||
mock_resp.json.return_value = {"detail": "Not found"}
|
||||
with pytest.raises(CLIError, match="Not found"):
|
||||
handle_api_error(mock_resp, "get")
|
||||
|
||||
@patch("requests.Response")
|
||||
def test_500_with_text_body(self, mock_resp, auth_session):
|
||||
mock_resp.status_code = 500
|
||||
mock_resp.text = "Internal Server Error"
|
||||
mock_resp.json.side_effect = ValueError("not json")
|
||||
with pytest.raises(CLIError, match="Internal Server Error"):
|
||||
handle_api_error(mock_resp, "request")
|
||||
|
||||
@patch("requests.Response")
|
||||
def test_200_does_not_raise(self, mock_resp, auth_session):
|
||||
mock_resp.status_code = 200
|
||||
# should not raise
|
||||
handle_api_error(mock_resp, "get")
|
||||
|
||||
|
||||
class TestParseIDs:
|
||||
"""parse_ids helper."""
|
||||
|
||||
def test_parses_comma_separated(self):
|
||||
result = parse_ids("a,b,c")
|
||||
assert result == ["a", "b", "c"]
|
||||
|
||||
def test_parses_spaces(self):
|
||||
result = parse_ids(" a , b , c ")
|
||||
assert result == ["a", "b", "c"]
|
||||
|
||||
def test_single_id(self):
|
||||
result = parse_ids("only-one")
|
||||
assert result == ["only-one"]
|
||||
|
||||
def test_none_returns_none(self):
|
||||
assert parse_ids(None) is None
|
||||
|
||||
def test_empty_string_returns_none(self):
|
||||
assert parse_ids("") is None
|
||||
assert parse_ids(" ") is None
|
||||
|
||||
def test_handles_uuid(self):
|
||||
ids = "0000-0000-0000,1111-1111-1111"
|
||||
result = parse_ids(ids)
|
||||
assert len(result) == 2
|
||||
|
||||
|
||||
class TestSensitiveDataMasking:
|
||||
"""Sensitive dry-run payload masking."""
|
||||
|
||||
def test_masks_nested_sensitive_values(self):
|
||||
data = {
|
||||
"username": "root",
|
||||
"secret": "super-secret",
|
||||
"nested": {
|
||||
"password": "password123",
|
||||
"tokens": [{"token": "abc123"}],
|
||||
},
|
||||
}
|
||||
|
||||
masked = mask_sensitive_data(data)
|
||||
|
||||
assert masked["username"] == "root"
|
||||
assert masked["secret"] == "********"
|
||||
assert masked["nested"]["password"] == "********"
|
||||
assert masked["nested"]["tokens"][0]["token"] == "********"
|
||||
assert data["secret"] == "super-secret"
|
||||
|
||||
|
||||
class TestValidateOutputFormat:
|
||||
"""validate_output_format function."""
|
||||
|
||||
def test_valid_formats(self):
|
||||
for fmt in ("json", "table", "yaml"):
|
||||
assert validate_output_format(fmt) == fmt
|
||||
|
||||
def test_case_insensitive(self):
|
||||
assert validate_output_format("JSON") == "json"
|
||||
assert validate_output_format("Table") == "table"
|
||||
|
||||
def test_invalid_format_raises(self):
|
||||
with pytest.raises(CLIError, match="Invalid output format"):
|
||||
validate_output_format("xml")
|
||||
|
||||
def test_empty_string_raises(self):
|
||||
with pytest.raises(CLIError, match="Invalid output format"):
|
||||
validate_output_format("")
|
||||
|
||||
|
||||
class TestCLIError:
|
||||
"""CLIError exception."""
|
||||
|
||||
def test_message_only(self):
|
||||
e = CLIError("Something went wrong")
|
||||
assert e.message == "Something went wrong"
|
||||
assert e.detail is None
|
||||
|
||||
def test_message_with_detail(self):
|
||||
e = CLIError("Failed", "Connection refused")
|
||||
assert e.message == "Failed"
|
||||
assert e.detail == "Connection refused"
|
||||
|
||||
|
||||
# ─── Long string truncation ──────────────────────────────────────
|
||||
|
||||
|
||||
class TestTruncation:
|
||||
"""Output truncation helper."""
|
||||
|
||||
def test_truncate_value(self):
|
||||
from cli_anything.jumpserver.core.output import _truncate
|
||||
short = _truncate("hello", 10)
|
||||
assert short == "hello " # padded to width
|
||||
long_val = _truncate("this_is_a_very_long_string", 10)
|
||||
assert long_val.endswith("...")
|
||||
assert len(long_val) == 10
|
||||
@@ -0,0 +1,468 @@
|
||||
"""
|
||||
End-to-end tests for cli-anything-jumpserver CLI.
|
||||
|
||||
Tests the installed CLI command via subprocess.
|
||||
Uses `CLI_ANYTHING_FORCE_INSTALLED=1` env var.
|
||||
"""
|
||||
import json
|
||||
import os
|
||||
import re
|
||||
import shutil
|
||||
import subprocess
|
||||
import sys
|
||||
import tempfile
|
||||
from pathlib import Path
|
||||
from unittest.mock import patch
|
||||
|
||||
|
||||
class TestCLISubprocess:
|
||||
"""Base class for CLI subprocess tests."""
|
||||
|
||||
CLI_NAME = "cli-anything-jumpserver"
|
||||
|
||||
@staticmethod
|
||||
def _resolve_cli(name: str) -> list[str]:
|
||||
"""Resolve installed CLI command; fall back to module execution."""
|
||||
force = os.environ.get("CLI_ANYTHING_FORCE_INSTALLED", "").strip() == "1"
|
||||
path = shutil.which(name)
|
||||
if path:
|
||||
return [path]
|
||||
if force:
|
||||
raise RuntimeError(f"{name} not found in PATH. Install with: pip install -e .")
|
||||
return [sys.executable, "-m", "cli_anything.jumpserver.jumpserver_cli"]
|
||||
|
||||
def _run(self, *args, expected_exit=0, timeout=10, input_text=None):
|
||||
"""Run CLI command and return CompletedProcess."""
|
||||
cmd = self._resolve_cli(self.CLI_NAME) + list(args)
|
||||
with tempfile.TemporaryDirectory(prefix="jumpserver-cli-home-") as home:
|
||||
env = os.environ.copy()
|
||||
env["HOME"] = home
|
||||
harness_root = str(Path(__file__).resolve().parents[3])
|
||||
env["PYTHONPATH"] = (
|
||||
harness_root
|
||||
if not env.get("PYTHONPATH")
|
||||
else f"{harness_root}{os.pathsep}{env['PYTHONPATH']}"
|
||||
)
|
||||
result = subprocess.run(
|
||||
cmd,
|
||||
capture_output=True,
|
||||
text=True,
|
||||
timeout=timeout,
|
||||
input=input_text,
|
||||
env=env,
|
||||
)
|
||||
|
||||
if expected_exit is not None:
|
||||
assert result.returncode == expected_exit, (
|
||||
f"Exit code mismatch for '{' '.join(args)}': "
|
||||
f"got {result.returncode}, stderr={result.stderr[:500]}"
|
||||
)
|
||||
|
||||
return result
|
||||
|
||||
def _run_json(self, *args, expected_exit=0):
|
||||
"""Run with --output json and parse JSON output."""
|
||||
return self._run(*args, "--output", "json", expected_exit=expected_exit)
|
||||
|
||||
def _parse_json(self, result):
|
||||
"""Parse JSON stdout, useful for explicit --output calls."""
|
||||
return json.loads(result.stdout)
|
||||
|
||||
|
||||
class TestCLIDiscovery(TestCLISubprocess):
|
||||
"""CLI availability and help."""
|
||||
|
||||
def test_fallback_cli_uses_module_path(self):
|
||||
with patch.dict(os.environ, {"CLI_ANYTHING_FORCE_INSTALLED": ""}):
|
||||
with patch("shutil.which", return_value=None):
|
||||
assert self._resolve_cli(self.CLI_NAME) == [
|
||||
sys.executable,
|
||||
"-m",
|
||||
"cli_anything.jumpserver.jumpserver_cli",
|
||||
]
|
||||
|
||||
def test_help_output(self):
|
||||
result = self._run("--help")
|
||||
assert "JumpServer CLI" in result.stdout or "Usage:" in result.stdout
|
||||
|
||||
def test_version(self):
|
||||
result = self._run("--version")
|
||||
assert True # version option works
|
||||
|
||||
def test_help_contains_command_groups(self):
|
||||
result = self._run("--help")
|
||||
output = result.stdout
|
||||
expected_groups = ["auth", "asset", "user", "perm", "account", "session", "audit", "ops", "system"]
|
||||
for group in expected_groups:
|
||||
assert group in output.lower(), f"Expected '{group}' in help output"
|
||||
|
||||
|
||||
class TestAuthCommands(TestCLISubprocess):
|
||||
"""Authentication command tests."""
|
||||
|
||||
def test_auth_help(self):
|
||||
result = self._run("auth", "--help")
|
||||
assert "login" in result.stdout
|
||||
|
||||
def test_auth_status_no_session(self):
|
||||
result = self._run_json("auth", "status")
|
||||
data = self._parse_json(result)
|
||||
assert data["status"] == "not authenticated"
|
||||
|
||||
def test_auth_status_global_json(self):
|
||||
result = self._run("--json", "auth", "status")
|
||||
data = self._parse_json(result)
|
||||
assert data["status"] == "not authenticated"
|
||||
|
||||
def test_auth_status_global_json_output_alias(self):
|
||||
result = self._run("--json-output", "auth", "status")
|
||||
data = self._parse_json(result)
|
||||
assert data["status"] == "not authenticated"
|
||||
|
||||
def test_auth_login_help(self):
|
||||
result = self._run("auth", "login", "--help")
|
||||
assert "--url" in result.stdout
|
||||
|
||||
def test_auth_login_requires_url(self):
|
||||
result = self._run("auth", "login", expected_exit=2)
|
||||
|
||||
def test_auth_org_help(self):
|
||||
result = self._run("auth", "org", "--help")
|
||||
assert "--list" in result.stdout
|
||||
|
||||
|
||||
class TestAssetCommands(TestCLISubprocess):
|
||||
"""Asset management command tests."""
|
||||
|
||||
def test_asset_help(self):
|
||||
result = self._run("asset", "--help")
|
||||
assert "list" in result.stdout
|
||||
|
||||
def test_asset_type_option(self):
|
||||
result = self._run("asset", "list", "--help")
|
||||
assert "--type" in result.stdout
|
||||
|
||||
def test_asset_create_requires_params(self):
|
||||
result = self._run("asset", "create", expected_exit=2)
|
||||
|
||||
def test_asset_create_has_dry_run(self):
|
||||
result = self._run("asset", "create", "--help")
|
||||
assert "--dry-run" in result.stdout
|
||||
|
||||
def test_asset_update_has_dry_run(self):
|
||||
result = self._run("asset", "update", "--help")
|
||||
assert "--dry-run" in result.stdout
|
||||
|
||||
def test_asset_delete_has_dry_run(self):
|
||||
result = self._run("asset", "delete", "--help")
|
||||
assert "--dry-run" in result.stdout
|
||||
|
||||
def test_asset_node_help(self):
|
||||
result = self._run("asset", "node", "--help")
|
||||
assert "list" in result.stdout
|
||||
|
||||
|
||||
class TestUserCommands(TestCLISubprocess):
|
||||
"""User management command tests."""
|
||||
|
||||
def test_user_help(self):
|
||||
result = self._run("user", "--help")
|
||||
assert "list" in result.stdout
|
||||
|
||||
def test_user_create_requires_params(self):
|
||||
result = self._run("user", "create", expected_exit=2)
|
||||
|
||||
def test_user_profile_help(self):
|
||||
result = self._run("user", "profile", "--help")
|
||||
assert "output" in result.stdout.lower()
|
||||
|
||||
def test_user_my_assets_help(self):
|
||||
result = self._run("user", "my-assets", "--help")
|
||||
assert "output" in result.stdout.lower()
|
||||
|
||||
def test_reset_password_requires_force_or_confirmation(self):
|
||||
result = self._run(
|
||||
"user",
|
||||
"reset-password",
|
||||
"user-1",
|
||||
"--password",
|
||||
"secret-password",
|
||||
input_text="n\n",
|
||||
expected_exit=1,
|
||||
)
|
||||
assert "Reset password for user 'user-1'?" in result.stdout
|
||||
assert "secret-password" not in result.stdout
|
||||
assert "secret-password" not in result.stderr
|
||||
|
||||
def test_reset_password_force_reaches_json_auth_gate(self):
|
||||
result = self._run(
|
||||
"--json",
|
||||
"user",
|
||||
"reset-password",
|
||||
"user-1",
|
||||
"--password",
|
||||
"secret-password",
|
||||
"--force",
|
||||
expected_exit=1,
|
||||
)
|
||||
assert result.stdout == ""
|
||||
data = json.loads(result.stderr)
|
||||
assert data["status"] == "error"
|
||||
assert "Not authenticated" in data["message"]
|
||||
assert "secret-password" not in result.stderr
|
||||
|
||||
def test_reset_password_has_force_and_yes_options(self):
|
||||
result = self._run("user", "reset-password", "--help")
|
||||
assert "--force" in result.stdout
|
||||
assert "--yes" in result.stdout
|
||||
|
||||
|
||||
class TestPermCommands(TestCLISubprocess):
|
||||
"""Permission management command tests."""
|
||||
|
||||
def test_perm_help(self):
|
||||
result = self._run("perm", "--help")
|
||||
assert "list" in result.stdout
|
||||
|
||||
def test_perm_create_has_dry_run(self):
|
||||
result = self._run("perm", "create", "--help")
|
||||
assert "--dry-run" in result.stdout
|
||||
|
||||
def test_perm_delete_has_force(self):
|
||||
result = self._run("perm", "delete", "--help")
|
||||
assert "--force" in result.stdout
|
||||
|
||||
|
||||
class TestAccountCommands(TestCLISubprocess):
|
||||
"""Account management command tests."""
|
||||
|
||||
def test_account_help(self):
|
||||
result = self._run("account", "--help")
|
||||
assert "list" in result.stdout
|
||||
|
||||
def test_account_secret_help(self):
|
||||
result = self._run("account", "secret", "--help")
|
||||
assert "view" in result.stdout
|
||||
|
||||
|
||||
class TestSessionCommands(TestCLISubprocess):
|
||||
"""Session management command tests."""
|
||||
|
||||
def test_session_help(self):
|
||||
result = self._run("session", "--help")
|
||||
assert "list" in result.stdout
|
||||
|
||||
def test_session_kill_has_force(self):
|
||||
result = self._run("session", "kill", "--help")
|
||||
assert "--force" in result.stdout
|
||||
|
||||
|
||||
class TestAuditCommands(TestCLISubprocess):
|
||||
"""Audit command tests."""
|
||||
|
||||
def test_audit_help(self):
|
||||
result = self._run("audit", "--help")
|
||||
assert "login" in result.stdout
|
||||
|
||||
|
||||
class TestOpsCommands(TestCLISubprocess):
|
||||
"""Operations command tests."""
|
||||
|
||||
def test_ops_help(self):
|
||||
result = self._run("ops", "--help")
|
||||
assert "job-list" in result.stdout
|
||||
|
||||
|
||||
class TestSystemCommands(TestCLISubprocess):
|
||||
"""System command tests."""
|
||||
|
||||
def test_system_help(self):
|
||||
result = self._run("system", "--help")
|
||||
assert "settings" in result.stdout
|
||||
|
||||
|
||||
class TestOutputFormats(TestCLISubprocess):
|
||||
"""Output format verification."""
|
||||
|
||||
def test_json_output_works(self):
|
||||
result = self._run_json("auth", "status")
|
||||
data = self._parse_json(result)
|
||||
assert isinstance(data, dict)
|
||||
assert "status" in data
|
||||
|
||||
def test_output_option_table(self):
|
||||
result = self._run("auth", "status", "--output", "table")
|
||||
assert "not authenticated" in result.stdout.lower()
|
||||
|
||||
def test_unauthenticated_global_json_error_is_parseable(self):
|
||||
result = self._run("--json", "asset", "list", expected_exit=1)
|
||||
assert result.stdout == ""
|
||||
data = json.loads(result.stderr)
|
||||
assert data["status"] == "error"
|
||||
assert "Not authenticated" in data["message"]
|
||||
|
||||
|
||||
class TestDryRun(TestCLISubprocess):
|
||||
"""Dry-run functionality."""
|
||||
|
||||
def test_dry_run_asset_create(self):
|
||||
result = self._run(
|
||||
"asset", "create",
|
||||
"--name", "test-dry",
|
||||
"--address", "10.0.0.1",
|
||||
"--platform", "1",
|
||||
"--type", "host",
|
||||
"--dry-run",
|
||||
"--output", "json",
|
||||
)
|
||||
data = self._parse_json(result)
|
||||
assert data["action"] == "create"
|
||||
|
||||
def test_dry_run_user_create(self):
|
||||
result = self._run(
|
||||
"user", "create",
|
||||
"--name", "Test User",
|
||||
"--username", "testuser",
|
||||
"--email", "test@example.com",
|
||||
"--dry-run",
|
||||
"--output", "json",
|
||||
)
|
||||
data = self._parse_json(result)
|
||||
assert data["action"] == "create user"
|
||||
|
||||
def test_dry_run_perm_create(self):
|
||||
result = self._run(
|
||||
"perm", "create",
|
||||
"--name", "test-perm",
|
||||
"--users", "u1,u2",
|
||||
"--assets", "a1",
|
||||
"--dry-run",
|
||||
"--output", "json",
|
||||
)
|
||||
data = self._parse_json(result)
|
||||
assert data["action"] == "create permission"
|
||||
|
||||
def test_dry_run_account_create_masks_secret_json(self):
|
||||
result = self._run(
|
||||
"account", "create",
|
||||
"--asset", "1",
|
||||
"--username", "root",
|
||||
"--secret", "super-secret",
|
||||
"--dry-run",
|
||||
"--output", "json",
|
||||
)
|
||||
data = self._parse_json(result)
|
||||
assert data["action"] == "create account"
|
||||
assert data["data"]["secret"] == "********"
|
||||
assert "super-secret" not in result.stdout
|
||||
|
||||
def test_dry_run_account_create_masks_secret_text(self):
|
||||
result = self._run(
|
||||
"account", "create",
|
||||
"--asset", "1",
|
||||
"--username", "root",
|
||||
"--secret", "super-secret",
|
||||
"--dry-run",
|
||||
)
|
||||
assert "********" in result.stdout
|
||||
assert "super-secret" not in result.stdout
|
||||
|
||||
def test_dry_run_asset_delete(self):
|
||||
result = self._run(
|
||||
"asset", "delete", "test-id",
|
||||
"--type", "host",
|
||||
"--dry-run",
|
||||
)
|
||||
assert "[DRY RUN]" in result.stdout
|
||||
|
||||
|
||||
class TestErrorHandling(TestCLISubprocess):
|
||||
"""Error handling verification."""
|
||||
|
||||
def test_invalid_output_format(self):
|
||||
result = self._run("asset", "list", "--output", "invalid_format", expected_exit=2)
|
||||
|
||||
def test_missing_required_option(self):
|
||||
result = self._run("asset", "create", "--name", "test", expected_exit=2)
|
||||
|
||||
|
||||
class TestREPLMode(TestCLISubprocess):
|
||||
"""REPL mode entry tests."""
|
||||
|
||||
def test_interactive_flag(self):
|
||||
result = self._run("--help")
|
||||
assert "--interactive" in result.stdout or "-i" in result.stdout
|
||||
|
||||
|
||||
# ─── Workflow Integration Tests ──────────────────────────────────
|
||||
|
||||
|
||||
class TestWorkflow:
|
||||
"""Simulated workflow tests exercising the full CLI lifecycle."""
|
||||
|
||||
def test_full_help_coverage(self):
|
||||
"""Verify all 12+ command groups have valid help."""
|
||||
groups = [
|
||||
"auth", "asset", "asset node", "asset platform", "asset gateway", "asset zone",
|
||||
"user", "user group",
|
||||
"perm",
|
||||
"account", "account secret", "account template",
|
||||
"session", "session command", "session terminal",
|
||||
"audit", "ops",
|
||||
"system", "label", "role",
|
||||
]
|
||||
|
||||
runner = TestCLISubprocess()
|
||||
for group_cmd in groups:
|
||||
args = group_cmd.split() + ["--help"]
|
||||
result = runner._run(*args)
|
||||
assert len(result.stdout) > 20, f"Help output too short for: {group_cmd}"
|
||||
|
||||
def test_dry_run_mutation_commands(self):
|
||||
"""Verify --dry-run works for all create commands."""
|
||||
runner = TestCLISubprocess()
|
||||
|
||||
r = runner._run(
|
||||
"asset", "create", "--name", "x", "--address", "1.1.1.1",
|
||||
"--platform", "1", "--dry-run", "--output", "json",
|
||||
)
|
||||
assert runner._parse_json(r)["action"] == "create"
|
||||
|
||||
r = runner._run(
|
||||
"user", "create", "--name", "X", "--username", "x",
|
||||
"--email", "x@x.com", "--dry-run", "--output", "json",
|
||||
)
|
||||
assert runner._parse_json(r)["action"] == "create user"
|
||||
|
||||
r = runner._run(
|
||||
"perm", "create", "--name", "x", "--users", "1", "--assets", "1",
|
||||
"--dry-run", "--output", "json",
|
||||
)
|
||||
assert runner._parse_json(r)["action"] == "create permission"
|
||||
|
||||
r = runner._run(
|
||||
"account", "create", "--asset", "1", "--username", "root",
|
||||
"--dry-run", "--output", "json",
|
||||
)
|
||||
assert runner._parse_json(r)["action"] == "create account"
|
||||
|
||||
def test_json_output_for_all_list_commands(self):
|
||||
"""Verify commands produce valid JSON in --output json mode."""
|
||||
runner = TestCLISubprocess()
|
||||
r = runner._run("auth", "status", "--output", "json")
|
||||
data = runner._parse_json(r)
|
||||
assert isinstance(data, dict)
|
||||
|
||||
|
||||
class TestCLIParameterValidation(TestCLISubprocess):
|
||||
"""Additional parameter validation tests."""
|
||||
|
||||
def test_asset_type_validation(self):
|
||||
result = self._run("asset", "list", "--type", "invalid", expected_exit=2)
|
||||
|
||||
def test_output_choice_validation(self):
|
||||
result = self._run("auth", "status", "--output", "csv", expected_exit=2)
|
||||
|
||||
def test_secret_type_validation(self):
|
||||
result = self._run("account", "list", "--help")
|
||||
assert "--secret-type" in result.stdout
|
||||
@@ -0,0 +1,201 @@
|
||||
"""
|
||||
Utilities for cli_anything.jumpserver.
|
||||
|
||||
Includes context management, error handling, and helper functions.
|
||||
"""
|
||||
import sys
|
||||
import json
|
||||
from contextlib import contextmanager
|
||||
from typing import Any
|
||||
|
||||
import click
|
||||
|
||||
from cli_anything.jumpserver.core.session import Session, JumpServerClient
|
||||
from cli_anything.jumpserver.core.output import format_output
|
||||
from cli_anything.jumpserver.core.state import get_state
|
||||
|
||||
|
||||
class CLIError(click.ClickException):
|
||||
"""CLI-specific error with formatted message."""
|
||||
|
||||
def __init__(self, message: str, detail: str | None = None):
|
||||
super().__init__(message)
|
||||
self.detail = detail
|
||||
|
||||
def show(self, file=None, json_mode: bool | None = None) -> None:
|
||||
"""Display the error message."""
|
||||
if file is None:
|
||||
file = sys.stderr
|
||||
if json_mode is None:
|
||||
json_mode = is_json_mode()
|
||||
|
||||
if json_mode:
|
||||
payload = {"status": "error", "message": self.message}
|
||||
if self.detail:
|
||||
payload["detail"] = self.detail
|
||||
click.echo(json.dumps(payload, ensure_ascii=False), file=file)
|
||||
return
|
||||
|
||||
click.echo(click.style(f"Error: {self.message}", fg="red"), err=True)
|
||||
if self.detail:
|
||||
click.echo(f" {self.detail}", err=True)
|
||||
|
||||
|
||||
SENSITIVE_KEYS = {
|
||||
"password",
|
||||
"secret",
|
||||
"token",
|
||||
"access_token",
|
||||
"refresh_token",
|
||||
"private_key",
|
||||
"ssh_key",
|
||||
}
|
||||
MASKED_VALUE = "********"
|
||||
|
||||
|
||||
def _iter_context_chain(ctx: click.Context | None):
|
||||
"""Yield the current Click context and its parents."""
|
||||
while ctx is not None:
|
||||
yield ctx
|
||||
ctx = ctx.parent
|
||||
|
||||
|
||||
def is_json_mode() -> bool:
|
||||
"""Return whether the active Click invocation requested JSON output."""
|
||||
ctx = click.get_current_context(silent=True)
|
||||
for current in _iter_context_chain(ctx):
|
||||
obj = current.obj or {}
|
||||
if obj.get("output_json"):
|
||||
return True
|
||||
if current.params.get("output") == "json":
|
||||
return True
|
||||
return False
|
||||
|
||||
|
||||
def wants_json_output(args: list[str] | None = None) -> bool:
|
||||
"""Best-effort JSON mode detection for top-level exception handling."""
|
||||
args = list(sys.argv[1:] if args is None else args)
|
||||
if "--json" in args or "--json-output" in args:
|
||||
return True
|
||||
|
||||
for index, arg in enumerate(args):
|
||||
if arg in {"--output", "-o"}:
|
||||
if index + 1 < len(args) and args[index + 1] == "json":
|
||||
return True
|
||||
elif arg == "--output=json":
|
||||
return True
|
||||
|
||||
return False
|
||||
|
||||
|
||||
def resolve_output_format(fmt: str) -> str:
|
||||
"""Apply global JSON mode to command-local output format defaults."""
|
||||
if fmt == "table" and is_json_mode():
|
||||
return "json"
|
||||
return fmt
|
||||
|
||||
|
||||
def should_emit_human_text(fmt: str = "table") -> bool:
|
||||
"""Return whether companion human text should be printed."""
|
||||
return resolve_output_format(fmt) != "json"
|
||||
|
||||
|
||||
def mask_sensitive_data(value: Any) -> Any:
|
||||
"""Recursively mask sensitive values before echoing dry-run payloads."""
|
||||
if isinstance(value, dict):
|
||||
masked = {}
|
||||
for key, item in value.items():
|
||||
if str(key).lower() in SENSITIVE_KEYS and item not in (None, ""):
|
||||
masked[key] = MASKED_VALUE
|
||||
else:
|
||||
masked[key] = mask_sensitive_data(item)
|
||||
return masked
|
||||
if isinstance(value, list):
|
||||
return [mask_sensitive_data(item) for item in value]
|
||||
return value
|
||||
|
||||
|
||||
def require_auth(session: Session) -> JumpServerClient:
|
||||
"""Ensure the session is authenticated, raise error if not."""
|
||||
if not session.is_authenticated():
|
||||
raise CLIError(
|
||||
"Not authenticated. Please login first.",
|
||||
"Use: jumpserver login --url <URL> --username <USER>",
|
||||
)
|
||||
return session.get_client()
|
||||
|
||||
|
||||
def handle_api_error(response, action: str = "request") -> None:
|
||||
"""Handle API error responses uniformly."""
|
||||
if response.status_code >= 400:
|
||||
try:
|
||||
detail = response.json()
|
||||
except Exception:
|
||||
detail = response.text
|
||||
|
||||
if isinstance(detail, dict):
|
||||
msg = detail.get("detail", detail.get("error", str(detail)))
|
||||
else:
|
||||
msg = str(detail)
|
||||
|
||||
raise CLIError(
|
||||
f"{msg}",
|
||||
f"API {action} failed (HTTP {response.status_code}): {str(msg)[:200]}",
|
||||
)
|
||||
|
||||
|
||||
def parse_ids(value: str | None) -> list[str] | None:
|
||||
"""Parse comma-separated IDs from a string."""
|
||||
if value is None:
|
||||
return None
|
||||
if not value.strip():
|
||||
return None
|
||||
return [v.strip() for v in value.split(",") if v.strip()]
|
||||
|
||||
|
||||
def validate_output_format(fmt: str) -> str:
|
||||
"""Validate and normalize output format."""
|
||||
valid = {"json", "table", "yaml", "csv"}
|
||||
fmt = fmt.lower()
|
||||
if fmt not in valid:
|
||||
raise CLIError(
|
||||
f"Invalid output format: {fmt}",
|
||||
f"Valid formats: {', '.join(sorted(valid))}",
|
||||
)
|
||||
return fmt
|
||||
|
||||
|
||||
def with_output_options(f):
|
||||
"""Decorator to add common output options to Click commands."""
|
||||
f = click.option(
|
||||
"--output", "-o",
|
||||
type=click.Choice(["table", "json", "yaml"]),
|
||||
default="table",
|
||||
help="Output format",
|
||||
)(f)
|
||||
f = click.option(
|
||||
"--columns", "-c",
|
||||
default=None,
|
||||
help="Comma-separated column names to display",
|
||||
)(f)
|
||||
return f
|
||||
|
||||
|
||||
def print_result(
|
||||
data: Any,
|
||||
fmt: str = "table",
|
||||
columns: list[str] | None = None,
|
||||
) -> None:
|
||||
"""Print API response data in the requested format."""
|
||||
fmt = resolve_output_format(fmt)
|
||||
columns_list = None
|
||||
if columns:
|
||||
columns_list = [c.strip() for c in columns.split(",")]
|
||||
|
||||
# Handle paginated API responses
|
||||
if isinstance(data, dict) and "results" in data:
|
||||
format_output(data["results"], fmt=fmt, columns=columns_list)
|
||||
if fmt != "json" and "count" in data:
|
||||
click.echo(f"\nTotal: {data['count']}")
|
||||
else:
|
||||
format_output(data, fmt=fmt, columns=columns_list)
|
||||
@@ -0,0 +1,52 @@
|
||||
[build-system]
|
||||
requires = ["setuptools>=68.0", "wheel"]
|
||||
build-backend = "setuptools.build_meta"
|
||||
|
||||
[project]
|
||||
name = "cli-anything-jumpserver"
|
||||
version = "0.1.0"
|
||||
description = "Stateful CLI harness for JumpServer bastion host management"
|
||||
readme = "cli_anything/jumpserver/README.md"
|
||||
license = { text = "MIT" }
|
||||
authors = [
|
||||
{ name = "cli-anything" }
|
||||
]
|
||||
keywords = ["jumpserver", "bastion", "pam", "cli", "security"]
|
||||
classifiers = [
|
||||
"Development Status :: 4 - Beta",
|
||||
"Environment :: Console",
|
||||
"Intended Audience :: System Administrators",
|
||||
"License :: OSI Approved :: MIT License",
|
||||
"Operating System :: OS Independent",
|
||||
"Programming Language :: Python :: 3",
|
||||
"Programming Language :: Python :: 3.11",
|
||||
"Topic :: System :: Systems Administration",
|
||||
"Topic :: Security",
|
||||
]
|
||||
requires-python = ">=3.11"
|
||||
dependencies = [
|
||||
"click>=8.0",
|
||||
"requests>=2.28",
|
||||
"pyyaml>=6.0",
|
||||
]
|
||||
|
||||
[project.optional-dependencies]
|
||||
dev = [
|
||||
"pytest>=7.0",
|
||||
"pytest-mock>=3.10",
|
||||
]
|
||||
|
||||
[project.urls]
|
||||
Homepage = "https://github.com/cli-anything/cli-anything-jumpserver"
|
||||
Source = "https://github.com/cli-anything/cli-anything-jumpserver"
|
||||
Issues = "https://github.com/cli-anything/cli-anything-jumpserver/issues"
|
||||
|
||||
[project.scripts]
|
||||
cli-anything-jumpserver = "cli_anything.jumpserver.jumpserver_cli:cli_main"
|
||||
|
||||
[tool.setuptools.packages.find]
|
||||
include = ["cli_anything.*"]
|
||||
|
||||
[tool.pytest.ini_options]
|
||||
testpaths = ["cli_anything/jumpserver/tests"]
|
||||
addopts = "-v --tb=short"
|
||||
@@ -0,0 +1,48 @@
|
||||
from setuptools import setup, find_namespace_packages
|
||||
|
||||
with open("cli_anything/jumpserver/README.md", "r") as fh:
|
||||
long_description = fh.read()
|
||||
|
||||
setup(
|
||||
name="cli-anything-jumpserver",
|
||||
version="0.1.0",
|
||||
description="Stateful CLI harness for JumpServer bastion host management",
|
||||
long_description=long_description,
|
||||
long_description_content_type="text/markdown",
|
||||
author="cli-anything",
|
||||
url="https://github.com/cli-anything/cli-anything-jumpserver",
|
||||
project_urls={
|
||||
"Source": "https://github.com/cli-anything/cli-anything-jumpserver",
|
||||
"Tracker": "https://github.com/cli-anything/cli-anything-jumpserver/issues",
|
||||
},
|
||||
python_requires=">=3.11",
|
||||
install_requires=[
|
||||
"click>=8.0",
|
||||
"requests>=2.28",
|
||||
"pyyaml>=6.0",
|
||||
],
|
||||
extras_require={
|
||||
"dev": [
|
||||
"pytest>=7.0",
|
||||
"pytest-mock>=3.10",
|
||||
],
|
||||
},
|
||||
packages=find_namespace_packages(include=["cli_anything.*"]),
|
||||
entry_points={
|
||||
"console_scripts": [
|
||||
"cli-anything-jumpserver=cli_anything.jumpserver.jumpserver_cli:cli_main",
|
||||
],
|
||||
},
|
||||
classifiers=[
|
||||
"Development Status :: 4 - Beta",
|
||||
"Environment :: Console",
|
||||
"Intended Audience :: System Administrators",
|
||||
"License :: OSI Approved :: MIT License",
|
||||
"Operating System :: OS Independent",
|
||||
"Programming Language :: Python :: 3",
|
||||
"Programming Language :: Python :: 3.11",
|
||||
"Topic :: System :: Systems Administration",
|
||||
"Topic :: Security",
|
||||
],
|
||||
keywords="jumpserver bastion pam cli security ssh",
|
||||
)
|
||||
+20
-1
@@ -2,9 +2,28 @@
|
||||
"meta": {
|
||||
"repo": "https://github.com/HKUDS/CLI-Anything",
|
||||
"description": "CLI-Hub — Agent-native stateful CLI interfaces for softwares, codebases, and Web Services",
|
||||
"updated": "2026-04-16"
|
||||
"updated": "2026-06-10"
|
||||
},
|
||||
"clis": [
|
||||
{
|
||||
"name": "jumpserver",
|
||||
"display_name": "JumpServer",
|
||||
"version": "0.1.0",
|
||||
"description": "Bastion host management — manage assets, users, permissions, sessions, accounts, and audit logs via JumpServer REST API",
|
||||
"requires": "JumpServer v3.0+ instance",
|
||||
"homepage": "https://www.jumpserver.org",
|
||||
"source_url": null,
|
||||
"install_cmd": "pip install git+https://github.com/HKUDS/CLI-Anything.git#subdirectory=jumpserver/agent-harness",
|
||||
"entry_point": "cli-anything-jumpserver",
|
||||
"skill_md": "skills/cli-anything-jumpserver/SKILL.md",
|
||||
"category": "devops",
|
||||
"contributors": [
|
||||
{
|
||||
"name": "Ayasaz",
|
||||
"url": "https://github.com/Ayasaz"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "cc-switch",
|
||||
"display_name": "CC Switch",
|
||||
|
||||
@@ -0,0 +1,350 @@
|
||||
---
|
||||
name: "cli-anything-jumpserver"
|
||||
description: Stateful CLI harness for JumpServer bastion host management. Supports asset, user, permission, account, session, audit, and operations management via REST API, with both one-shot and interactive REPL modes.
|
||||
version: 0.1.0
|
||||
category: infrastructure
|
||||
tags:
|
||||
- jumpserver
|
||||
- bastion
|
||||
- pam
|
||||
- security
|
||||
- ssh
|
||||
- cli
|
||||
commands:
|
||||
- group: auth
|
||||
description: Authentication and session management
|
||||
subcommands:
|
||||
- name: login
|
||||
description: Authenticate to JumpServer and store session token
|
||||
options: ["--url", "--username", "--password", "--org", "--insecure"]
|
||||
- name: logout
|
||||
description: Clear the current session
|
||||
- name: status
|
||||
description: Show current authentication status
|
||||
- name: org
|
||||
description: Switch or list organizations
|
||||
options: ["--list"]
|
||||
|
||||
- group: asset
|
||||
description: Manage assets (hosts, devices, databases, nodes, platforms, gateways, zones)
|
||||
subcommands:
|
||||
- name: list
|
||||
description: List assets of a given type
|
||||
options: ["--type", "--search", "--node", "--platform", "--active/--inactive", "--limit", "--offset"]
|
||||
- name: get
|
||||
description: Get details of a specific asset
|
||||
- name: create
|
||||
description: Create a new asset
|
||||
options: ["--name", "--address", "--platform", "--type", "--nodes", "--dry-run"]
|
||||
- name: update
|
||||
description: Update an existing asset
|
||||
options: ["--name", "--address", "--comment", "--active/--inactive", "--dry-run"]
|
||||
- name: delete
|
||||
description: Delete an asset
|
||||
options: ["--force", "--dry-run"]
|
||||
- name: node
|
||||
description: Manage asset nodes (tree organization)
|
||||
subcommands:
|
||||
- name: list
|
||||
description: List nodes
|
||||
options: ["--tree", "--parent"]
|
||||
- name: create
|
||||
description: Create a new node
|
||||
- name: delete
|
||||
description: Delete a node
|
||||
- name: add-assets
|
||||
description: Add assets to a node
|
||||
- name: platform
|
||||
description: Manage asset platforms
|
||||
subcommands:
|
||||
- name: list
|
||||
description: List platforms
|
||||
- name: gateway
|
||||
description: Manage gateways
|
||||
subcommands:
|
||||
- name: list
|
||||
description: List gateways
|
||||
- name: test
|
||||
description: Test gateway connectivity
|
||||
- name: zone
|
||||
description: Manage zones
|
||||
subcommands:
|
||||
- name: list
|
||||
description: List zones
|
||||
|
||||
- group: user
|
||||
description: Manage users and user groups
|
||||
subcommands:
|
||||
- name: list
|
||||
description: List users
|
||||
options: ["--search", "--source", "--active/--inactive"]
|
||||
- name: get
|
||||
description: Get user details
|
||||
- name: create
|
||||
description: Create a new user
|
||||
options: ["--name", "--username", "--email", "--password", "--role", "--dry-run"]
|
||||
- name: update
|
||||
description: Update a user
|
||||
- name: delete
|
||||
description: Delete a user
|
||||
- name: reset-password
|
||||
description: Reset a user's password
|
||||
- name: unblock
|
||||
description: Unblock a locked user
|
||||
- name: profile
|
||||
description: Show current user profile
|
||||
- name: my-assets
|
||||
description: List assets the current user can access
|
||||
- name: group
|
||||
description: Manage user groups
|
||||
subcommands:
|
||||
- name: list
|
||||
description: List user groups
|
||||
- name: create
|
||||
description: Create a user group
|
||||
- name: members
|
||||
description: List members of a user group
|
||||
|
||||
- group: perm
|
||||
description: Manage asset permissions
|
||||
subcommands:
|
||||
- name: list
|
||||
description: List asset permissions
|
||||
options: ["--search", "--user", "--active/--inactive"]
|
||||
- name: get
|
||||
description: Get permission details
|
||||
- name: create
|
||||
description: Create a new asset permission
|
||||
options: ["--name", "--users", "--user-groups", "--assets", "--nodes", "--actions", "--dry-run"]
|
||||
- name: update
|
||||
description: Update an asset permission
|
||||
- name: delete
|
||||
description: Delete an asset permission
|
||||
- name: users
|
||||
description: List users assigned to a permission
|
||||
- name: assets
|
||||
description: List assets authorized by a permission
|
||||
|
||||
- group: account
|
||||
description: Manage asset accounts and credentials
|
||||
subcommands:
|
||||
- name: list
|
||||
description: List asset accounts
|
||||
options: ["--search", "--asset", "--secret-type", "--privileged/--unprivileged"]
|
||||
- name: get
|
||||
description: Get account details
|
||||
- name: create
|
||||
description: Create a new asset account
|
||||
options: ["--asset", "--username", "--secret-type", "--secret", "--dry-run"]
|
||||
- name: update
|
||||
description: Update an asset account
|
||||
- name: delete
|
||||
description: Delete an asset account
|
||||
- name: secret
|
||||
description: View account secrets/passwords
|
||||
subcommands:
|
||||
- name: view
|
||||
description: View an account's password/secret
|
||||
- name: history
|
||||
description: View password change history
|
||||
- name: template
|
||||
description: Manage account templates
|
||||
subcommands:
|
||||
- name: list
|
||||
description: List account templates
|
||||
|
||||
- group: session
|
||||
description: Manage terminal sessions and replays
|
||||
subcommands:
|
||||
- name: list
|
||||
description: List terminal sessions
|
||||
options: ["--search", "--user", "--asset", "--protocol", "--active/--finished"]
|
||||
- name: get
|
||||
description: Get session details
|
||||
- name: replay
|
||||
description: Get session replay URL/info
|
||||
- name: kill
|
||||
description: Kill an active session
|
||||
- name: command
|
||||
description: View session command history
|
||||
subcommands:
|
||||
- name: list
|
||||
description: List command records
|
||||
options: ["--session", "--user", "--risk"]
|
||||
- name: terminal
|
||||
description: Manage terminal components
|
||||
subcommands:
|
||||
- name: list
|
||||
description: List terminal components
|
||||
- name: status
|
||||
description: Get terminal component status
|
||||
|
||||
- group: audit
|
||||
description: View audit logs
|
||||
subcommands:
|
||||
- name: login
|
||||
description: View user login audit logs
|
||||
- name: operate
|
||||
description: View resource operation audit logs
|
||||
- name: ftp
|
||||
description: View FTP file transfer audit logs
|
||||
- name: password
|
||||
description: View password change audit logs
|
||||
- name: activity
|
||||
description: View user activity logs
|
||||
|
||||
- group: ops
|
||||
description: Manage operations and job execution
|
||||
subcommands:
|
||||
- name: job-list
|
||||
description: List execution jobs
|
||||
- name: job-log
|
||||
description: Get job execution log
|
||||
- name: adhoc-list
|
||||
description: List ad-hoc command executions
|
||||
- name: playbook-list
|
||||
description: List Ansible playbooks
|
||||
|
||||
- group: system
|
||||
description: Manage system settings
|
||||
subcommands:
|
||||
- name: settings
|
||||
description: List system settings
|
||||
- name: health
|
||||
description: Check system health
|
||||
- name: info
|
||||
description: Show system information
|
||||
|
||||
- group: label
|
||||
description: Manage labels
|
||||
subcommands:
|
||||
- name: list
|
||||
description: List labels
|
||||
|
||||
- group: role
|
||||
description: Manage roles and permissions
|
||||
subcommands:
|
||||
- name: list
|
||||
description: List roles
|
||||
- name: bindings
|
||||
description: List role bindings
|
||||
---
|
||||
|
||||
# cli-anything-jumpserver
|
||||
|
||||
Stateful CLI harness for JumpServer bastion host. Manage assets, users, permissions, accounts, sessions, audits, and more via the JumpServer REST API.
|
||||
|
||||
## Quick Start
|
||||
|
||||
```bash
|
||||
# Install
|
||||
cd agent-harness && pip install -e .
|
||||
|
||||
# Authenticate
|
||||
cli-anything-jumpserver auth login --url https://jumpserver.example.com --username admin
|
||||
|
||||
# List hosts
|
||||
cli-anything-jumpserver asset list --type host
|
||||
|
||||
# Interactive REPL mode
|
||||
cli-anything-jumpserver --interactive
|
||||
```
|
||||
|
||||
## Agent Usage Guidance
|
||||
|
||||
This CLI is designed for AI agent consumption. Key features for agents:
|
||||
|
||||
### JSON Output Mode
|
||||
All commands support `--output json` for machine-parseable output:
|
||||
```bash
|
||||
cli-anything-jumpserver asset list --type host --output json
|
||||
```
|
||||
|
||||
### Dry Run Mode
|
||||
All mutation commands support `--dry-run` to preview without execution:
|
||||
```bash
|
||||
cli-anything-jumpserver asset create --name test --address 10.0.0.1 --platform 1 --dry-run --output json
|
||||
```
|
||||
|
||||
### Environment Variables
|
||||
- `JUMPSERVER_URL` - Default JumpServer URL
|
||||
- `JUMPSERVER_USERNAME` - Default username
|
||||
- `JUMPSERVER_PASSWORD` - Default password
|
||||
|
||||
### Typical Agent Workflows
|
||||
|
||||
**1. Discovery and Inventory**
|
||||
```bash
|
||||
# Check connection
|
||||
cli-anything-jumpserver auth status --output json
|
||||
|
||||
# List all hosts
|
||||
cli-anything-jumpserver asset list --type host --output json
|
||||
|
||||
# Get asset details
|
||||
cli-anything-jumpserver asset get <ID> --type host --output json
|
||||
|
||||
# List all users
|
||||
cli-anything-jumpserver user list --output json
|
||||
```
|
||||
|
||||
**2. User and Permission Management**
|
||||
```bash
|
||||
# Create user
|
||||
cli-anything-jumpserver user create --name "New User" --username newuser --email user@example.com --output json --dry-run
|
||||
|
||||
# Grant asset access
|
||||
cli-anything-jumpserver perm create --name "App Access" --users "user1,user2" --assets "asset1,asset2" --output json --dry-run
|
||||
|
||||
# Verify permissions
|
||||
cli-anything-jumpserver perm users <PERM_ID> --output json
|
||||
```
|
||||
|
||||
**3. Security Audit**
|
||||
```bash
|
||||
# Check failed logins
|
||||
cli-anything-jumpserver audit login --status failed --output json
|
||||
|
||||
# Review operations
|
||||
cli-anything-jumpserver audit operate --action delete --output json
|
||||
|
||||
# Check active sessions
|
||||
cli-anything-jumpserver session list --active --output json
|
||||
|
||||
# View command history
|
||||
cli-anything-jumpserver session command list --risk 5 --output json
|
||||
```
|
||||
|
||||
**4. Session Management**
|
||||
```bash
|
||||
# Monitor active sessions
|
||||
cli-anything-jumpserver session list --active --output json
|
||||
|
||||
# Check terminal health
|
||||
cli-anything-jumpserver session terminal list --output json
|
||||
cli-anything-jumpserver session terminal status <TERMINAL_ID> --output json
|
||||
```
|
||||
|
||||
## Output Formats
|
||||
|
||||
| Format | Flag | Use Case |
|
||||
|--------|------|----------|
|
||||
| Table | `--output table` (default) | Human-readable display |
|
||||
| JSON | `--output json` | Agent consumption, scripting |
|
||||
| YAML | `--output yaml` | Configuration, readability |
|
||||
|
||||
## Exit Codes
|
||||
|
||||
| Code | Meaning |
|
||||
|------|---------|
|
||||
| 0 | Success |
|
||||
| 1 | CLI error (auth, API, etc.) |
|
||||
| 2 | Usage error (invalid options/arguments) |
|
||||
| 130 | Interrupted (Ctrl+C) |
|
||||
|
||||
## File Locations
|
||||
|
||||
| Path | Purpose |
|
||||
|------|---------|
|
||||
| `~/.jumpserver-cli/session.json` | Authentication session |
|
||||
| `~/.jumpserver-cli/state.json` | CLI operational state |
|
||||
Reference in New Issue
Block a user