Joseph Doherty
e2f433e849
Every CLI option that can carry a secret gets a `--<name>-file <path|->`
sibling ('-' reads stdin), so the value stays out of the process list and
shell history: --password-file (global), --primary-config-file /
--backup-config-file (data-connection create|update), --auth-config-file
(external-system create|update), --connection-string-file (db-connection
create|update), --credentials-file (notification smtp create|update) and
--auth-token-file (notification sms create|update). Follows the existing
--config-file convention; `@path` is avoided because System.CommandLine
expands @-tokens as response files.
The value is read at parse time; a missing/unreadable/empty source, or '-'
on a terminal stdin, is a parse error naming option + path only, never the
content. Inline and file forms are mutually exclusive, at most one option
may read stdin, and one trailing line break is stripped. Inline forms keep
working.
docker/seed-sites.sh and docker-env2/seed-sites.sh now write the MxGateway
config (windev gateway key) to a mode-600 temp file removed by an EXIT trap
and pass --primary-config-file; seed-flow-outbound-demo.sh pipes its rig
connection string via --connection-string-file -. CLI README (new "Secrets
from a file or stdin" section + per-command tables), Component-CLI.md and
both docker READMEs updated.
Claude-Session: https://claude.ai/code/session_01GT67ACmpMR7b9LGRPLijMi
64 lines
4.1 KiB
C#
64 lines
4.1 KiB
C#
using System.CommandLine;
|
|
using ZB.MOM.WW.ScadaBridge.CLI.Commands;
|
|
|
|
namespace ZB.MOM.WW.ScadaBridge.CLI;
|
|
|
|
/// <summary>Constructs the production CLI command tree for execution and surface verification.</summary>
|
|
public static class CliApplication
|
|
{
|
|
/// <summary>Builds an independent root command with every supported operation.</summary>
|
|
/// <returns>The configured CLI root.</returns>
|
|
public static RootCommand BuildRoot()
|
|
{
|
|
var rootCommand = new RootCommand("ScadaBridge CLI — manage the ScadaBridge SCADA system");
|
|
|
|
var urlOption = new Option<string>("--url") { Description = "Management API URL", Recursive = true };
|
|
var usernameOption = new Option<string>("--username") { Description = "LDAP username", Recursive = true };
|
|
var passwordOption = new Option<string>("--password") { Description = "LDAP password", Recursive = true };
|
|
// No DefaultValueFactory: format precedence (explicit --format -> config/env -> "json")
|
|
// is resolved by CommandHelpers.ResolveFormat, which needs to distinguish an absent flag.
|
|
// CliOptions.CreateFormatOption also constrains the accepted values (json/table).
|
|
var formatOption = CliOptions.CreateFormatOption();
|
|
|
|
rootCommand.Add(urlOption);
|
|
rootCommand.Add(usernameOption);
|
|
rootCommand.Add(passwordOption);
|
|
rootCommand.Add(formatOption);
|
|
|
|
// Register command groups
|
|
rootCommand.Add(TemplateCommands.Build(urlOption, formatOption, usernameOption, passwordOption));
|
|
rootCommand.Add(InstanceCommands.Build(urlOption, formatOption, usernameOption, passwordOption));
|
|
rootCommand.Add(SiteCommands.Build(urlOption, formatOption, usernameOption, passwordOption));
|
|
rootCommand.Add(DeployCommands.Build(urlOption, formatOption, usernameOption, passwordOption));
|
|
var dataConnectionCommand = DataConnectionCommands.Build(urlOption, formatOption, usernameOption, passwordOption);
|
|
// Attach the site-routed browse/search/verify-endpoint/certs subcommands (actor parity, arch-review C4).
|
|
ConnectionBrowseCommands.AddTo(dataConnectionCommand, urlOption, formatOption, usernameOption, passwordOption);
|
|
rootCommand.Add(dataConnectionCommand);
|
|
rootCommand.Add(ExternalSystemCommands.Build(urlOption, formatOption, usernameOption, passwordOption));
|
|
rootCommand.Add(NotificationCommands.Build(urlOption, formatOption, usernameOption, passwordOption));
|
|
rootCommand.Add(SecurityCommands.Build(urlOption, formatOption, usernameOption, passwordOption));
|
|
rootCommand.Add(AuditLogCommands.Build(urlOption, formatOption, usernameOption, passwordOption));
|
|
rootCommand.Add(AuditCommands.Build(urlOption, formatOption, usernameOption, passwordOption));
|
|
rootCommand.Add(HealthCommands.Build(urlOption, formatOption, usernameOption, passwordOption));
|
|
rootCommand.Add(DebugCommands.Build(urlOption, formatOption, usernameOption, passwordOption));
|
|
rootCommand.Add(SharedSchemaCommands.Build(urlOption, formatOption, usernameOption, passwordOption));
|
|
rootCommand.Add(SharedScriptCommands.Build(urlOption, formatOption, usernameOption, passwordOption));
|
|
rootCommand.Add(DbConnectionCommands.Build(urlOption, formatOption, usernameOption, passwordOption));
|
|
rootCommand.Add(ApiMethodCommands.Build(urlOption, formatOption, usernameOption, passwordOption));
|
|
rootCommand.Add(BundleCommands.Build(urlOption, formatOption, usernameOption, passwordOption));
|
|
rootCommand.Add(CachedCallCommands.Build(urlOption, formatOption, usernameOption, passwordOption));
|
|
rootCommand.Add(SecuredWriteCommands.Build(urlOption, formatOption, usernameOption, passwordOption));
|
|
rootCommand.Add(FlowDebugCommands.Build(urlOption, formatOption, usernameOption, passwordOption));
|
|
|
|
// After every group: the --password / --password-file exclusivity check is per command.
|
|
CliOptions.AddPasswordFileOption(rootCommand, passwordOption);
|
|
|
|
rootCommand.SetAction(_ =>
|
|
{
|
|
Console.WriteLine("Use --help to see available commands.");
|
|
});
|
|
|
|
return rootCommand;
|
|
}
|
|
}
|