Merge ~troyanov/maas:backport-fix-1980436-3.2 into maas:3.2

[Anton Troyanov]

fix(cli): pass CA certs to httpbakery

Fixes bug #1980436

(cherry picked from commit 894bf33c54dedeeaed3c5d6d77c16259a7de34e5)

[MAAS Lander (maas-lander)]

UNIT TESTS
-b backport-fix-1980436-3.2 lp:~troyanov/maas/+git/maas into -b 3.2 lp:~maas-committers/maas

STATUS: SUCCESS
COMMIT: dec18257fe2bf4b75dabd32893ac77b7eea1b3fc

review: Approve

[MAAS Lander (maas-lander)]

LANDING
-b backport-fix-1980436-3.2 lp:~troyanov/maas/+git/maas into -b 3.2 lp:~maas-committers/maas

STATUS: FAILED BUILD
LOG: http://maas-ci.internal:8080/job/maas/job/branch-tester/13119/consoleText

diff --git a/src/maascli/auth.py b/src/maascli/auth.py
index 9c359d7..b01f265 100644
--- a/src/maascli/auth.py
+++ b/src/maascli/auth.py
@@ -27,7 +27,7 @@ def try_getpass(prompt):
         return None
 
 
-def get_apikey_via_macaroon(url):
+def get_apikey_via_macaroon(url, ca_certs=None, insecure=False):
     """Try to get an API key using a macaroon.
 
     httpbakery is used to create a new API token. If the MAAS server supports
@@ -38,10 +38,15 @@ def get_apikey_via_macaroon(url):
     If the MAAS server doesn't support macaroons, None is returned.
 
     """
+    verify = True
+    if insecure:
+        verify = False
+    elif ca_certs:
+        verify = str(ca_certs)
     url = url.strip("/")
     client = httpbakery.Client()
     resp = client.request(
-        "POST", f"{url}/account/?op=create_authorisation_token"
+        "POST", f"{url}/account/?op=create_authorisation_token", verify=verify
     )
     if resp.status_code != 200:
         # Most likely the MAAS server doesn't support macaroons.
@@ -50,7 +55,7 @@ def get_apikey_via_macaroon(url):
     return "{consumer_key}:{token_key}:{token_secret}".format(**result)
 
 
-def obtain_credentials(url, credentials):
+def obtain_credentials(url, credentials, ca_certs=None, insecure=False):
     """Prompt for credentials if possible.
 
     If the credentials are "-" then read from stdin without interactive
@@ -59,7 +64,9 @@ def obtain_credentials(url, credentials):
     if credentials == "-":
         credentials = sys.stdin.readline().strip()
     elif credentials is None:
-        credentials = get_apikey_via_macaroon(url)
+        credentials = get_apikey_via_macaroon(
+            url, ca_certs=ca_certs, insecure=insecure
+        )
         if credentials is None:
             credentials = try_getpass(
                 "API key (leave empty for anonymous access): "
diff --git a/src/maascli/cli.py b/src/maascli/cli.py
index 4929633..36f8601 100644
--- a/src/maascli/cli.py
+++ b/src/maascli/cli.py
@@ -90,10 +90,6 @@ class cmd_login(Command):
                 "You cannot use both cacerts and insecure arguments."
             )
 
-        # Try and obtain credentials interactively if they're not given, or
-        # read them from stdin if they're specified as "-".
-        credentials = obtain_credentials(options.url, options.credentials)
-
         cacerts = None
         # temporary cacerts file, used to check for bogus credentials
         # if credentials are correct, cacerts content is stored in profile
@@ -109,6 +105,12 @@ class cmd_login(Command):
             cacerts_path = Path(cacerts_path)
             cacerts_path.write_text(cacerts)
 
+        # Try and obtain credentials interactively if they're not given, or
+        # read them from stdin if they're specified as "-".
+        credentials = obtain_credentials(
+            options.url, options.credentials, cacerts_path, options.insecure
+        )
+
         # Check for bogus credentials. Do this early so that the user is not
         # surprised when next invoking the MAAS CLI.
         if credentials is not None: