aoh

commit 58d183cf1c6f734dca02c56707729bd7e286c8c3
parent b3d2b4a7cc91ba4b27d4d6d134c6627a2cb46d2c
Author: Asher Morgan <asher@ashermorgan.net>
Date:   Fri,  4 Sep 2026 19:31:03 -0700

Check for ask pass options in cmdline/extra_args

To make this easier, the cmdline string has also been replaced with the
extra_args list.

Diffstat:
M
README.md
 | 
12
++++++------
M
aoh/playbook.py
 | 
4
++--
M
aoh/runner.py
 | 
4
++--
M
aoh/security.py
 | 
2
+-
M
demo/playbooks.yml
 | 
6
+++---

5 files changed, 14 insertions(+), 14 deletions(-)
diff --git a/README.md b/README.md
@@ -102,9 +102,6 @@ main.yml: # The playbook name
   # to false.
   password: true
 
-  # Additional raw ansible-playbook options
-  cmdline: '--limit aoh' # only run tasks for the current client
-
   # Whether to print Ansible output on the client. Defaults to true.
   output: true
 
@@ -120,6 +117,9 @@ main.yml: # The playbook name
   block_opts:
     - '--list-tags'
 
+  # Additional raw ansible-playbook options
+  extra_args: ['--limit', 'aoh'] # only run tasks for the current client
+
   # Whether to allow clients to use Jinja expressions in ansible-playbook
   # options. Defaults to false.
   jinja: true
@@ -184,7 +184,7 @@ takes, or can be configured to take, to mitigate security risks.
   playbook option.
 
 - **Forcing Ansible Options:** Additional `ansible-playbook` options may be
-  added to every execution via the `cmdline` playbook option. For example, if
+  added to every execution via the `extra_args` playbook option. For example, if
   clients must not be able to trigger the execution of other hosts' tasks, then
-  the `--limit aoh` option should be added to `cmdline`. Consider also adding
-  these options to `block_opts` to prevent clients from modifying them.
+  the `['--limit', 'aoh']` option should be added to `extra_args`. Consider also
+  adding these options to `block_opts` to prevent clients from modifying them.
diff --git a/aoh/playbook.py b/aoh/playbook.py
@@ -21,11 +21,11 @@ class Playbook:
             'host': str,
             'groups': list,
             'password': bool,
-            'cmdline': str,
             'output': bool,
             'jinja': bool,
             'allow_opts': list, # We'll just assume that elements are strings
             'block_opts': list,
+            'extra_args': list,
             'web_description': str,
         }
 
@@ -39,11 +39,11 @@ class Playbook:
         self.host = dict.get('host')
         self.groups = dict.get('groups', [])
         self.password = dict.get('password', False)
-        self.cmdline = dict.get('cmdline', '')
         self.output = dict.get('output', True)
         self.jinja = dict.get('jinja', False)
         self.allow_opts = dict.get('allow_opts', [])
         self.block_opts = dict.get('block_opts', [])
+        self.extra_args = dict.get('extra_args', [])
         self.web_description = dict.get('web_description')
 
         self.path = os.path.abspath(os.path.join(PLAYBOOKS_DIR, self.path))
diff --git a/aoh/runner.py b/aoh/runner.py
@@ -109,8 +109,8 @@ class Runner:
         for pw_type in self.passwords:
             pw_prompt_answers[_PASSWORD_PROMPTS[pw_type]] = \
                     self.passwords[pw_type]
-        cmdline = ' '.join(shlex.quote(arg) for arg in self.args)
-        cmdline += ' ' + self.playbook.cmdline
+        args = self.args + self.playbook.extra_args
+        cmdline = ' '.join(shlex.quote(arg) for arg in args)
 
         def _finished_callback(_):
             self._t_finished = time.time()
diff --git a/aoh/security.py b/aoh/security.py
@@ -86,7 +86,7 @@ def get_required_passwords(playbook, args):
     if playbook.password:
         pw_types.add('aoh_password')
 
-    opts = _get_opts(args)
+    opts = _get_opts(args + playbook.extra_args)
     for opt, pw_type in _CLI_PASSWORD_OPTS.items():
         if opt in opts:
             pw_types.add(pw_type)
diff --git a/demo/playbooks.yml b/demo/playbooks.yml
@@ -22,9 +22,6 @@ main.yml: # The playbook name
   # to false.
   password: true
 
-  # Additional raw ansible-playbook options
-  cmdline: '--limit aoh' # only run tasks for the current client
-
   # Whether to print Ansible output on the client. Defaults to true.
   output: true
 
@@ -40,6 +37,9 @@ main.yml: # The playbook name
   block_opts:
     - '--list-tags'
 
+  # Additional raw ansible-playbook options
+  extra_args: ['--limit', 'aoh'] # only run tasks for the current client
+
   # Whether to allow clients to use Jinja expressions in ansible-playbook
   # options. Defaults to false.
   jinja: true