Merge ~maxiberta/snapstore-client:env-auth into snapstore-client:master

[Maximiliano Bertacchini]

Add support for exporting and using auth token for non-interactive use cases

If found, the STORE_ADMIN_TOKEN env is used as authentication token, with the same format as the "admin-account.macaroon" included in exported store bundles.

Closes https://warthogs.atlassian.net/browse/SN-682.

[Przemysław Suliga (suligap)]

Thanks! This works but has some issues I think. Left some comments.

1eb3f6c... by Maximiliano Bertacchini on 2022-06-21

Extend the documentation around export token

16d37a0... by Maximiliano Bertacchini on 2022-06-21

Add validation to the ttl option in export token

5b57c24... by Maximiliano Bertacchini on 2022-06-21

Use plain request.Session instead of craft_store.StoreClient for authed sessions

[Maximiliano Bertacchini (maxiberta)]

All comments addressed. Thanks!

[Przemysław Suliga (suligap)]

+1 thanks!

Optional suggestion is to move both newly added export_token() functions to separate modules vs adding them to cli.stores and logic.stores.

review: Approve

fc4b705... by Maximiliano Bertacchini on 2022-06-22

Move the "export token" subcommand from cli.stores to cli.common

719faa3... by Maximiliano Bertacchini on 2022-06-22

Move export_token() from logic.stores to logic.accounts

7266727... by Maximiliano Bertacchini on 2022-06-22

Add some extra logging around exporting token

[Przemysław Suliga (suligap)]

review: Approve

diff --git a/store_admin/cli/common.py b/store_admin/cli/common.py
index 754cc35..3033c61 100644
--- a/store_admin/cli/common.py
+++ b/store_admin/cli/common.py
@@ -6,11 +6,14 @@ import click
 import requests.exceptions
 
 from store_admin.defaults import get_sso_url
+from store_admin.logic import accounts
 from store_admin.logic.login import login as logic_login
 from store_admin.logic.registration import register as logic_register
 
 logger = logging.getLogger(__name__)
 
+one_year_in_secs = 60 * 60 * 24 * 365
+
 
 @click.command()
 @click.argument("proxy_url")
@@ -102,3 +105,31 @@ def register(url, output, offline, channel, arch):
             f"Could not write to the specified file path: {output}. Please "
             "provide a path that is writable"
         )
+
+
[e-mail](name="token")
[e-mail](
+    "--ttl",
+    type=int,
+    default=one_year_in_secs,  # 1 year (seconds)
+    help=(
+        "How long the authentication token should be valid, in seconds "
+        f"(must be between 60s and 1 year) [default: {one_year_in_secs} (1 year)]"
+    ),
+)
+def export_token(ttl):
+    """Export an admin token for your IoT App Store.
+
+    The resulting token is valid for `ttl` seconds (max. 1 year) and has permissions
+    "store_admin" and "package_access".
+
+    Set the environment variable `STORE_ADMIN_TOKEN=<token>` to skip
+    interactive login prompts in the `export snaps` and `export store` subcommands
+    (e.g. for CI/automation).
+    """
+    if not (60 <= ttl <= one_year_in_secs):
+        raise click.BadParameter(
+            f"ttl must be between 60 and {one_year_in_secs} seconds (1 year)"
+        )
+
+    accounts.export_token(ttl=ttl)
diff --git a/store_admin/cli/runner.py b/store_admin/cli/runner.py
index 9778936..03c172e 100644
--- a/store_admin/cli/runner.py
+++ b/store_admin/cli/runner.py
@@ -81,4 +81,5 @@ remove.add_command(overrides.remove_overrides)
 
 # Commands under export
 export.add_command(stores.export_store)
+export.add_command(common.export_token)
 export.add_command(snaps.export_snap)
diff --git a/store_admin/cli/snaps.py b/store_admin/cli/snaps.py
index 9be410c..0afac13 100644
--- a/store_admin/cli/snaps.py
+++ b/store_admin/cli/snaps.py
@@ -76,6 +76,8 @@ def export_snap(snap_names, channels, architectures, store_id, export_dir):
 
     To export IoT App Store snaps, use the --store option - you will be asked to
     log in. Only authorized accounts can export not publicly available snaps.
+
+    See the `export token` subcommand for non-interactive authentication.
     """
     tarball_paths = snaps.export(
         snap_names, channels, architectures, store_id, export_dir
diff --git a/store_admin/cli/stores.py b/store_admin/cli/stores.py
index 47e0c34..053986a 100644
--- a/store_admin/cli/stores.py
+++ b/store_admin/cli/stores.py
@@ -62,5 +62,7 @@ def export_store(store_id, channels, architectures, skip_snaps, account_key_ids)
     """Export your IoT App Store data for import to the offline store.
 
     STORE_ID: Store ID of a "device view" app store.
+
+    See the `export token` subcommand for non-interactive authentication.
     """
     stores.export(store_id, channels, architectures, skip_snaps, account_key_ids)
diff --git a/store_admin/logic/accounts.py b/store_admin/logic/accounts.py
index 8eca23d..5440af1 100644
--- a/store_admin/logic/accounts.py
+++ b/store_admin/logic/accounts.py
@@ -8,7 +8,8 @@ from urllib.parse import urljoin
 import requests
 from pymacaroons import Macaroon
 
-from .. import exceptions
+from .http_client import STORE_ADMIN_ENV_AUTH_KEY, get_developer_session
+from .. import defaults, exceptions
 
 
 logger = logging.getLogger(__name__)
@@ -53,3 +54,20 @@ def get_account_details(dashboard_root, authed_session, auth_token):
             "validation": "unproven",
         },
     }
+
+
+def export_token(ttl):
+    logger.info("Logging in as store admin...")
+    # store_admin permission for accessing store data.
+    # package_access permission for downloading store snaps.
+    permissions = ["store_admin", "package_access"]
+
+    _, auth_token = get_developer_session(
+        defaults.get_dashboard_url(),
+        permissions=permissions,
+        ttl=ttl,
+        use_env=False,
+    )
+    logger.info(f"Exported token with permissions={permissions!r} and ttl={ttl!r}")
+    logger.info("Usage:")
+    logger.info(f"    export {STORE_ADMIN_ENV_AUTH_KEY}={auth_token}")
diff --git a/store_admin/logic/http_client.py b/store_admin/logic/http_client.py
index 067f9c8..110e278 100644
--- a/store_admin/logic/http_client.py
+++ b/store_admin/logic/http_client.py
@@ -2,13 +2,20 @@
 # Copyright 2022 Canonical Ltd.  This software is licensed under the
 # GNU General Public License version 3 (see the file LICENSE).
 
+import logging
+import os
+
 import requests
 from requests.adapters import HTTPAdapter, Retry
 from craft_store import Auth, StoreClient, endpoints
 
 
+logger = logging.getLogger(__name__)
+
 APP_NAME = "store-admin"
 USER_AGENT = APP_NAME
+STORE_ADMIN_ENV_AUTH_KEY = "STORE_ADMIN_TOKEN"
+CRAFT_STORE_ENV_AUTH_KEY = "CRAFT_STORE_TOKEN"
 _session = None
 
 
@@ -34,33 +41,34 @@ def get_session(unique=False):
     return session
 
 
-def get_store_client(base_url):
-    store_client = StoreClient(
-        base_url=base_url,
+def get_developer_session(dashboard_root, permissions=None, ttl=None, use_env=True):
+    auth_token = None
+    if use_env and STORE_ADMIN_ENV_AUTH_KEY in os.environ:
+        # Non-interactive authentication
+        logger.debug("Using auth token found in env for non-interactive login")
+        auth_token = os.getenv(STORE_ADMIN_ENV_AUTH_KEY)
+        os.environ[CRAFT_STORE_ENV_AUTH_KEY] = Auth.encode_credentials(auth_token)
+
+    client = StoreClient(
+        base_url=dashboard_root,
         storage_base_url="",  # No uploads expected.
         endpoints=endpoints.SNAP_STORE,  # SCA.
         user_agent=USER_AGENT,
         application_name=APP_NAME,
+        environment_auth=CRAFT_STORE_ENV_AUTH_KEY if use_env else None,
         ephemeral=True,
     )
-    return store_client
-
-
-def get_store_admin_auth_token(store_client, permissions):
-    credentials = store_client.login(
-        # https://dashboard.snapcraft.io/docs/v2/en/tokens.html
-        permissions=permissions,
-        description="store-admin export",
-        ttl=60 * 60,  # 1h.
-    )
-    # Decode from craft-store internal credential storage.
-    return Auth.decode_credentials(credentials)
-
 
-def get_developer_session(dashboard_root, permissions=None):
-    client = get_store_client(dashboard_root)
-    # User/browser interaction
-    auth_token = get_store_admin_auth_token(client, permissions)
+    if not auth_token:
+        # User/browser interaction
+        logger.debug("No auth token found in env: proceeding with interactive login")
+        craft_store_auth = client.login(
+            # https://dashboard.snapcraft.io/docs/v2/en/tokens.html
+            permissions=permissions,
+            description="store-admin export",
+            ttl=ttl or 60 * 60,  # 1h.
+        )
+        auth_token = Auth.decode_credentials(craft_store_auth)
 
     session = get_session(unique=True)
     session.headers["Authorization"] = f"Macaroon {auth_token}"
diff --git a/store_admin/logic/tests/test_accounts.py b/store_admin/logic/tests/test_accounts.py
index 72ef9c0..b11bec0 100644
--- a/store_admin/logic/tests/test_accounts.py
+++ b/store_admin/logic/tests/test_accounts.py
@@ -5,10 +5,15 @@
 import pytest
 import requests
 from pymacaroons import Macaroon, MACAROON_V2
+from unittest import mock
 
 from store_admin import exceptions
 from store_admin.logic import accounts
 
+
+PATCH_PREFIX = "store_admin.logic.accounts."
+
+
 # extract_external_id() tests
 
 
@@ -60,3 +65,22 @@ def test_get_account_details_whoami_api_error(
     assert caplog.records[-1].msg.startswith(
         "Failed to fetch account details: 503 Server Error"
     )
+
+
+# export_token() tests
+
+
+def test_export_token(caplog, dashboard_root):
+    with mock.patch(
+        PATCH_PREFIX + "get_developer_session",
+        return_value=(requests.Session(), "mock-token"),
+    ) as mock_get_developer_session:
+        accounts.export_token(42)
+
+    mock_get_developer_session.assert_called_once_with(
+        dashboard_root,
+        permissions=["store_admin", "package_access"],
+        ttl=42,
+        use_env=False,
+    )
+    assert caplog.records[-1].msg == "    export STORE_ADMIN_TOKEN=mock-token"
diff --git a/store_admin/logic/tests/test_http_client.py b/store_admin/logic/tests/test_http_client.py
index 4497940..f805dbb 100644
--- a/store_admin/logic/tests/test_http_client.py
+++ b/store_admin/logic/tests/test_http_client.py
@@ -2,6 +2,7 @@
 # Copyright 2022 Canonical Ltd.  This software is licensed under the
 # GNU General Public License version 3 (see the file LICENSE).
 
+import os
 from unittest import mock
 
 from craft_store import Auth
@@ -9,9 +10,6 @@ from craft_store import Auth
 from store_admin.logic import http_client
 
 
-PATCH_PREFIX = "store_admin.logic.http_client."
-
-
 # get_session() tests
 
 
@@ -26,18 +24,17 @@ def test_get_session_unique():
 # get_developer_session() tests
 
 
[e-mail](os.environ, {}, clear=True)
 def test_get_developer_session(dashboard_root, requests_mock):
     mock_credentials = Auth.encode_credentials("mock-credentials")
-
-    with mock.patch(
-        PATCH_PREFIX + "StoreClient.login", return_value=mock_credentials
+    with mock.patch.object(
+        http_client.StoreClient, "login", return_value=mock_credentials
     ) as mock_craft_store_client_login:
         session, auth_token = http_client.get_developer_session(
             dashboard_root, permissions=["package_view"]
         )
 
     assert auth_token == "mock-credentials"
-
     mock_craft_store_client_login.assert_called_once_with(
         permissions=["package_view"], description="store-admin export", ttl=3600
     )
@@ -46,3 +43,54 @@ def test_get_developer_session(dashboard_root, requests_mock):
     session.get(dashboard_root)
     [call] = requests_mock.calls
     assert call.request.headers["Authorization"] == "Macaroon mock-credentials"
+
+
[e-mail](os.environ, {}, clear=True)
+def test_get_developer_session_with_custom_ttl(dashboard_root, requests_mock):
+    mock_credentials = Auth.encode_credentials("mock-credentials")
+    with mock.patch.object(
+        http_client.StoreClient, "login", return_value=mock_credentials
+    ) as mock_craft_store_client_login:
+        session, auth_token = http_client.get_developer_session(
+            dashboard_root, permissions=["package_view"], ttl=42
+        )
+
+    assert auth_token == "mock-credentials"
+    mock_craft_store_client_login.assert_called_once_with(
+        permissions=["package_view"], description="store-admin export", ttl=42
+    )
+
+
[e-mail](os.environ, {http_client.STORE_ADMIN_ENV_AUTH_KEY: "mock-credentials"})
+def test_get_developer_session_with_store_admin_token(dashboard_root, requests_mock):
+    mock_credentials = Auth.encode_credentials("mock-credentials")
+    with mock.patch.object(
+        http_client.StoreClient, "login", return_value=mock_credentials
+    ) as mock_craft_store_client_login:
+        session, auth_token = http_client.get_developer_session(
+            dashboard_root, permissions=["package_view"]
+        )
+
+    assert auth_token == "mock-credentials"
+    mock_craft_store_client_login.assert_not_called()
+
+    requests_mock.add("GET", dashboard_root, json={})
+    session.get(dashboard_root)
+    [call] = requests_mock.calls
+    assert call.request.headers["Authorization"] == "Macaroon mock-credentials"
+
+
[e-mail](os.environ, {http_client.STORE_ADMIN_ENV_AUTH_KEY: "ignore-me"})
+def test_get_developer_session_with_no_env_flag(dashboard_root, requests_mock):
+    mock_credentials = Auth.encode_credentials("mock-credentials")
+    with mock.patch.object(
+        http_client.StoreClient, "login", return_value=mock_credentials
+    ) as mock_craft_store_client_login:
+        session, auth_token = http_client.get_developer_session(
+            dashboard_root, permissions=["package_view"], use_env=False
+        )
+
+    assert auth_token == "mock-credentials"
+    mock_craft_store_client_login.assert_called_once_with(
+        permissions=["package_view"], description="store-admin export", ttl=3600
+    )