Repository: certbot/certbot

Issue:
Handle --redirect flag appropriately
The client does not properly handle the case when `--redirect` is specified on the command line. The root of the problem is this argument is treated as a binary variable in `cli.py` (`True` or `False`) and a ternary variable in `client.py` (`True`, `False`, or `None`). The resulting behavior is if `--redirect` is not specified on the command line, `client.py` assumes the user does not want a redirect.

The simple fix is to prompt the user on whether or not they want a redirect if `--redirect` is not included on the command line. A better fix is to allow the user to specify whether or not they want a redirect on the command line and prompting them if nothing is specified.



Discussion:
I'd like to contribute and was thinking that I'd start with this. Looking over the option parsing, there doesn't seem to be a consistent `--foo` + `--no-foo` pattern. This would be quite a good match though, or would `--redirect ARG` be more idiomatic?

The `--foo` + `--no-foo` is pretty simple to implement as

```
parser.add_argument('--foo', dest='foo', action='store_true', help='Turn on foo')
parser.add_argument('--no-foo', dest='foo', action='store_false', help='Turn off foo')
parser.set_defaults(foo=None)
```

but the problem with that is a spurious "(default: None)" in the help text for both arguments.

@ilkka, welcome to the project. If you'd be interested in trying to tackle this, we'd certainly appreciate the help. If you run into any issues, don't hesitate to contact us.

I think `--redirect` or `--no-redirect` is probably the preferred approach and can mimicked by enhancements in the future.


Resolving patch:
diff --git a/letsencrypt/cli.py b/letsencrypt/cli.py
--- a/letsencrypt/cli.py
+++ b/letsencrypt/cli.py
@@ -436,6 +436,7 @@ def run(args, config, plugins):  # pylint: disable=too-many-branches,too-many-lo
     le_client.deploy_certificate(
         domains, lineage.privkey, lineage.cert,
         lineage.chain, lineage.fullchain)
+
     le_client.enhance_config(domains, args.redirect)
 
     if len(lineage.available_versions("cert")) == 1:
@@ -804,11 +805,14 @@ def create_parser(plugins, args):
     helpful.add(
         "security", "-B", "--rsa-key-size", type=int, metavar="N",
         default=flag_default("rsa_key_size"), help=config_help("rsa_key_size"))
-    # TODO: resolve - assumes binary logic while client.py assumes ternary.
     helpful.add(
         "security", "-r", "--redirect", action="store_true",
         help="Automatically redirect all HTTP traffic to HTTPS for the newly "
-             "authenticated vhost.")
+             "authenticated vhost.", dest="redirect", default=None)
+    helpful.add(
+        "security", "-n", "--no-redirect", action="store_false",
+        help="Do not automatically redirect all HTTP traffic to HTTPS for the newly "
+             "authenticated vhost.", dest="redirect", default=None)
     helpful.add(
         "security", "--strict-permissions", action="store_true",
         help="Require that all configuration files are owned by the current "


Test patch:
diff --git a/tests/integration/_common.sh b/tests/integration/_common.sh
--- a/tests/integration/_common.sh
+++ b/tests/integration/_common.sh
@@ -20,6 +20,7 @@ letsencrypt_test () {
         --manual-test-mode \
         $store_flags \
         --text \
+        --no-redirect \
         --agree-dev-preview \
         --agree-tos \
         --email "" \