Merge pull request #130 from twobraids/secrets

my take on not exposing secrets

Author: twobraids

configman/config_manager.py

@@ -187,7 +187,8 @@ def __init__(
             'admin.conf',
             'admin.dump_conf',
             'admin.print_conf',
-            'admin.strict'
+            'admin.strict',
+            'admin.expose_secrets',
         ]
         self.options_banned_from_help = options_banned_from_help
 
@@ -292,18 +293,13 @@ def get_config(self, mapping_class=DotDictWithAcquisition):
             return config
 
     #--------------------------------------------------------------------------
-    def output_summary(self,
-                       output_stream=sys.stdout,
-                       block_password=True):
+    def output_summary(self, output_stream=sys.stdout):
         """outputs a usage tip and the list of acceptable commands.
         This is useful as the output of the 'help' option.
 
         parameters:
             output_stream - an open file-like object suitable for use as the
                             target of a print statement
-            block_password - a boolean driving the use of a string of * in
-                             place of the value for any object containing the
-                             substring 'passowrd'
         """
         if self.app_name or self.app_description:
             print >> output_stream, 'Application:',
@@ -316,10 +312,8 @@ def output_summary(self,
 
         names_list = self.get_option_names()
         print >> output_stream, (
-            "usage:\n",
-            self.app_invocation_name,
-            "[OPTIONS]..."
-        ),
+            "usage:\n%s [OPTIONS]..." % self.app_invocation_name
+        )
         bracket_count = 0
         for key in names_list:
             an_option = self.option_definitions[key]
@@ -359,7 +353,8 @@ def output_summary(self,
             except KeyError:
                 default = option.value
             if default is not None:
-                if 'password' in name.lower():
+                if ((option.secret or 'password' in name.lower())
+                    and not self.option_definitions.admin.expose_secrets.default):
                     default = '*********'
                 if name not in ('help',):
                     # don't bother with certain dead obvious ones
@@ -448,6 +443,18 @@ def write_conf(self, config_file_type, opener, skip_keys=None):
         else:
             option_defs = self.option_definitions
 
+        # find all of the secret options and overwrite their values with '*' * 16
+        if not self.option_definitions.admin.expose_secrets.default:
+            for a_key in option_defs.keys_breadth_first():
+                an_option = option_defs[a_key]
+                if ((not a_key.startswith('admin'))
+                    and isinstance(an_option, Option)
+                    and an_option.secret
+                ):
+                    # force the option to be a string of *
+                    option_defs[a_key].value = '*' * 16
+                    option_defs[a_key].from_string_converter = str
+
         value_sources.write(config_file_type,
                             option_defs,
                             opener)
@@ -468,7 +475,10 @@ def log_config(self, logger):
                   if key not in self.admin_controls_list]
         config.sort()
         for key, val in config:
-            if 'password' in key.lower():
+            if (
+                self.option_definitions[key].secret
+                or 'password' in key.lower()
+            ):
                 logger.info('%s: *********', key)
             else:
                 try:
@@ -800,6 +810,11 @@ def _setup_admin_options(self, values_source_list):
             doc='mismatched options generate exceptions rather'
                 ' than just warnings'
         )
+        admin.add_option(
+            name='expose_secrets',
+            default=False,
+            doc='should options marked secret get written out or hidden?'
+        )
         # only offer the config file admin options if they've been requested in
         # the values source list
         if ConfigFileFutureProxy in values_source_list:
@@ -847,13 +862,6 @@ def _option_sort(x_tuple):
         else:
             return key
 
-    #--------------------------------------------------------------------------
-    @staticmethod
-    def _block_password(qkey, key, value, block_password=True):
-        if block_password and 'password' in key.lower():
-            value = '*********'
-        return qkey, key, value
-
     #--------------------------------------------------------------------------
     def _get_option(self, name):
         try:

configman/namespace.py

@@ -82,8 +82,8 @@ def add_option(self, name, *args, **kwargs):
         setattr(current_namespace, an_option.name, an_option)
 
     #--------------------------------------------------------------------------
-    def add_aggregation(self, name, function):
-        an_aggregation = Aggregation(name, function)
+    def add_aggregation(self, name, function, secret=False):
+        an_aggregation = Aggregation(name, function, secret)
         setattr(self, name, an_aggregation)
 
     #--------------------------------------------------------------------------
@@ -137,4 +137,3 @@ def ref_value_namespace(self):
         # the __setattr__ method, this is the only way to actually force a
         # value to become an attribute rather than member of the dict
         object.__setattr__(self, '_reference_value_from', True)
-

configman/option.py

@@ -60,6 +60,7 @@ def __init__(
         likely_to_be_changed=False,
         not_for_definition=False,
         reference_value_from=None,
+        secret=False,
     ):
         self.name = name
         self.short_form = short_form
@@ -86,6 +87,7 @@ def __init__(
         self.likely_to_be_changed = likely_to_be_changed
         self.not_for_definition = not_for_definition
         self.reference_value_from = reference_value_from
+        self.secret = secret
 
     #--------------------------------------------------------------------------
     def __str__(self):
@@ -205,7 +207,8 @@ def copy(self):
             is_argument=self.is_argument,
             likely_to_be_changed=self.likely_to_be_changed,
             not_for_definition=self.not_for_definition,
-            reference_value_from=self.reference_value_from
+            reference_value_from=self.reference_value_from,
+            secret=self.secret,
         )
         return o
 
@@ -216,14 +219,16 @@ class Aggregation(object):
     def __init__(
         self,
         name,
-        function
+        function,
+        secret=False,
     ):
         self.name = name
         if isinstance(function, basestring):
             self.function = conv.class_converter(function)
         else:
             self.function = function
         self.value = None
+        self.secret = secret
 
     #--------------------------------------------------------------------------
     def aggregate(self, all_options, local_namespace, args):