cli: implement enable-ci travis --refresh command (canonical#932)

This will allow users to refresh credentials bound to expire after 1 year
(clock-ticking bomb) or more likely when there is a SSO password change
(rotation).

Travis 'deploy' phase will fail on expired credentials, so users will know
when it's time to refresh.

LP: #1646660

Author: Celso Providelo

snapcraft/integrations/__init__.py

@@ -27,7 +27,7 @@
 )
 
 
-def enable_ci(ci_system):
+def enable_ci(ci_system, refresh_only):
     if not ci_system:
         # XXX cprov 20161116: we could possibly auto-detect currently
         # integration systems in master ?
@@ -45,7 +45,9 @@ def enable_ci(ci_system):
     module = importlib.import_module(
         'snapcraft.integrations.{}'.format(ci_system))
 
-    print(module.__doc__)
-
-    if input('Continue (y/N): ') == 'y':
-        module.enable()
+    if refresh_only:
+        module.refresh()
+    else:
+        print(module.__doc__)
+        if input('Continue (y/N): ') == 'y':
+            module.enable()

snapcraft/integrations/tests/test_travis.py

@@ -45,25 +45,22 @@
 """
 
 
-class TravisTestCase(tests.TestCase):
+class TravisPreconditionsTestCase(tests.TestCase):
 
-    def setUp(self):
-        super().setUp()
-        self.fake_logger = fixtures.FakeLogger(level=logging.DEBUG)
-        self.useFixture(self.fake_logger)
-        self.fake_terminal = tests.fixture_setup.FakeTerminal()
-        self.useFixture(self.fake_terminal)
+    scenarios = [
+        ('enable', {'entry_point': 'enable'}),
+        ('refresh', {'entry_point': 'refresh'}),
+    ]
 
-    def make_travis_yml(self, content):
-        with open('.travis.yml', 'w') as fd:
-            fd.write(content)
+    def run_command(self, cmd):
+        getattr(travis, cmd)()
 
     @mock.patch('subprocess.check_call')
-    def test_enable_missing_travis_cli(self, mock_check_call):
+    def test_missing_travis_cli(self, mock_check_call):
         mock_check_call.side_effect = [FileNotFoundError()]
 
         with self.assertRaises(RequiredCommandNotFound) as raised:
-            travis.enable()
+            self.run_command(self.entry_point)
 
         self.assertEqual([
             'Travis CLI (`travis`) is not available.',
@@ -74,25 +71,26 @@ def test_enable_missing_travis_cli(self, mock_check_call):
         ], str(raised.exception).splitlines())
 
     @mock.patch('subprocess.check_call')
-    def test_enable_broken_travis_cli(self, mock_check_call):
+    def test_broken_travis_cli(self, mock_check_call):
         mock_check_call.side_effect = [
             subprocess.CalledProcessError(1, 'test')]
 
         with self.assertRaises(RequiredCommandFailure) as raised:
-            travis.enable()
+            self.run_command(self.entry_point)
 
         self.assertEqual([
-            'Travis CLI (`travis version`) is not functional.',
+            'Travis CLI (`travis settings`) is not functional or you are '
+            'not allowed to access this repository settings.',
             'Make sure it works correctly in your system before trying this '
             'command again.',
         ], str(raised.exception).splitlines())
 
     @mock.patch('subprocess.check_call')
-    def test_enable_missing_git(self, mock_check_call):
+    def test_missing_git(self, mock_check_call):
         mock_check_call.side_effect = [None, FileNotFoundError()]
 
         with self.assertRaises(RequiredCommandNotFound) as raised:
-            travis.enable()
+            self.run_command(self.entry_point)
 
         self.assertEqual([
             'Git (`git`) is not available, this tool cannot verify its '
@@ -103,12 +101,12 @@ def test_enable_missing_git(self, mock_check_call):
         ], str(raised.exception).splitlines())
 
     @mock.patch('subprocess.check_call')
-    def test_enable_broken_git_repo(self, mock_check_call):
+    def test_broken_git_repo(self, mock_check_call):
         mock_check_call.side_effect = [
             None, subprocess.CalledProcessError(1, 'test')]
 
         with self.assertRaises(RequiredCommandFailure) as raised:
-            travis.enable()
+            self.run_command(self.entry_point)
 
         self.assertEqual([
             'The current directory is not a Git repository.',
@@ -117,18 +115,32 @@ def test_enable_broken_git_repo(self, mock_check_call):
         ], str(raised.exception).splitlines())
 
     @mock.patch('subprocess.check_call')
-    def test_enable_missing_travis_setup(self, mock_check_call):
+    def test_missing_travis_setup(self, mock_check_call):
         mock_check_call.side_effect = [None, None]
 
         with self.assertRaises(RequiredPathDoesNotExist) as raised:
-            travis.enable()
+            self.run_command(self.entry_point)
 
         self.assertEqual([
             'Travis project is not initialized for the current directory.',
             'Please initialize Travis project (e.g. `travis init`) with '
             'appropriate parameters.',
         ], str(raised.exception).splitlines())
 
+
+class TravisSuccessfulTestCase(tests.TestCase):
+
+    def setUp(self):
+        super().setUp()
+        self.fake_logger = fixtures.FakeLogger(level=logging.DEBUG)
+        self.useFixture(self.fake_logger)
+        self.fake_terminal = tests.fixture_setup.FakeTerminal()
+        self.useFixture(self.fake_terminal)
+
+    def make_travis_yml(self, content):
+        with open('.travis.yml', 'w') as fd:
+            fd.write(content)
+
     @mock.patch('subprocess.check_output')
     @mock.patch('subprocess.check_call')
     @mock.patch('builtins.input')
@@ -188,8 +200,8 @@ def test_enable_successfully(
 
         # Descriptive logging ...
         self.assertEqual([
-            'Enabling Travis testbeds to push and release "foo" snaps '
-            'to edge channel in series 16',
+            "Enabling Travis testbeds to push and release 'foo' snaps "
+            "to edge channel in series '16'",
             'Acquiring specific authorization information ...',
             'Login successful.',
             'Encrypting authorization for Travis and adjusting project '
@@ -201,3 +213,58 @@ def test_enable_successfully(
             'Also make sure you add the new '
             '`.snapcraft/travis_snapcraft.cfg` file.',
         ], self.fake_logger.output.splitlines()[1:])
+
+    @mock.patch('subprocess.check_output')
+    @mock.patch('subprocess.check_call')
+    @mock.patch('builtins.input')
+    @mock.patch('getpass.getpass')
+    @mock.patch.object(storeapi.StoreClient, 'login')
+    @mock.patch.object(storeapi.SCAClient, 'get_account_information')
+    def test_refresh_successfully(
+            self, mock_get_account_information, mock_login, mock_getpass,
+            mock_input, mock_check_call, mock_check_output):
+        mock_input.side_effect = ['[email protected]', '123456']
+        mock_getpass.return_value = 'secret'
+        mock_login.side_effect = [
+            storeapi.errors.StoreTwoFactorAuthenticationRequired(), None]
+        mock_get_account_information.return_value = {'account_id': 'abcd'}
+
+        mock_check_call.side_effect = [None, None]
+        mock_check_output.side_effect = [None]
+        self.make_snapcraft_yaml(test_snapcraft_yaml)
+        self.make_travis_yml('after_success: ["<travis-cli-decrypt>"]')
+
+        travis.refresh()
+
+        # Attenuated credentials requested from the Store.
+        mock_login.assert_called_with(
+            '[email protected]', 'secret',
+            one_time_password='123456', acls=None, save=False,
+            channels=['edge'], packages=[{'series': '16', 'name': 'foo'}])
+
+        # Credentials encrypted with travis CLI.
+        mock_check_output.assert_called_with(
+            ['travis', 'encrypt-file', '--force',
+             '--add', 'after_success', '--decrypt-to',
+             travis.LOCAL_CONFIG_FILENAME,
+             mock.ANY, travis.ENCRYPTED_CONFIG_FILENAME],
+            stderr=subprocess.PIPE)
+
+        # '.travis.yml' updated only with the decrypt command.
+        with open('.travis.yml') as fd:
+            travis_conf = yaml.load(fd)
+            self.assertEqual([
+                '<travis-cli-decrypt>',
+            ], travis_conf['after_success'])
+
+        # Descriptive logging ...
+        self.assertEqual([
+            'Refreshing credentials to push and release "foo" snaps to '
+            'edge channel in series 16',
+            'Acquiring specific authorization information ...',
+            'Login successful.',
+            'Encrypting authorization for Travis and adjusting project '
+            'to automatically decrypt and use it during "after_success".',
+            'Done. Please commit the changes to '
+            '`.snapcraft/travis_snapcraft.cfg` file.',
+        ], self.fake_logger.output.splitlines()[1:])