holivia 0.11.0 → 0.13.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 84ddfe49ff566c2f626f07970ac5fa2ff0cc952cdb6f289097e0763076305db6
-  data.tar.gz: 8617737191faf7127efbe37451cbbc0fb3c8a237be30a8ddffe6ec437a32f4e3
+  metadata.gz: 5727339aa56fea9ffe71d4f5e0c49fdcd91a2d120aa3f88f7ff33f6a7b6eb49a
+  data.tar.gz: 6860e618178ca2b72dd346ec6f02b900cb1aaf48299db21bd6b2e98b6944ad9e
 SHA512:
-  metadata.gz: 43fba8847a1a234f0c64bcf409f42ae0af64e3298e5ed58f42764b85f08506b80914aeea5f9eb7c42621ff3fbba83641beb1f750d170837e23db7042717d7ad3
-  data.tar.gz: aeef43e300e7c9977ff147c8c352689540328a6981fa0ae317fe09ba56b82b57789a43e1596a4c06a2b3fcc923a16cfb8118373631b8f06b18a71f2f1d477bf3
+  metadata.gz: 573b090f0d92ee3676f920992e1c60f71b17b423627a000a4f4d118a1f394657670ce40c19d378f29bf4f56b2f54b682716d66ee70b80db1c7ccf1b088742d37
+  data.tar.gz: 26a6014d2c1351a3c2887c406ea572e7c5b73874077533c96c667ef8f11329e3a749954ae2ba141356066d51eff1ec970e758faa236d96687218db48f794d7da

data/CHANGELOG.md

@@ -1,5 +1,23 @@
 ## [Unreleased]
 
+## [0.13.0] - 2026-09-30
+
+- Replace terminal password login with browser OAuth authorization using PKCE and existing password/company SSO sign-in.
+- Require CLI upgrade and a new login; remove `--email`/`--password` and legacy `/api/v1/auth/*` endpoints.
+- Use two-hour access tokens, rotating refresh tokens without a fixed expiry, and server revocation for logout.
+- Store per-environment credentials atomically with owner-only permissions and omit credentials from debug logs.
+- Keep browser and CLI sessions independent; existing API permissions continue to apply.
+- Redirect browser authorization callbacks to the localized Holivia completion page while the CLI exchanges tokens separately.
+- Requires the matching Holivia OAuth server deployment and provisioning of the public CLI application.
+
+## [0.12.0] - 2026-09-16
+
+- Add `holivia tag` commands for catalogue CRUD and incremental topic-link management through repeatable `--topic-tag-json` flags or stdin JSON
+- Add read-only `holivia topic index` and `holivia topic show` commands with topic filters and pagination
+- Document tag permissions, association IDs, stdin precedence, asynchronous translation, and deletion behavior
+- Move gem development into the SANTEZ monorepo while preserving standalone installation and the `holivia` executable
+- Tag commands require the corresponding backoffice tag API deployment
+
 ## [0.11.0] - 2026-07-26
 
 - Add `holivia support-phone-numbers` commands for backoffice support phone number CRUD and filtering

data/README.md

@@ -73,21 +73,23 @@ holivia env debug --false
 
 ## Authentication
 
-Log in interactively:
+Log in through your browser using your existing password or company SSO:
 
 ```bash
 holivia login
 ```
 
-Or pass credentials directly:
-
-```bash
-holivia login --email user@example.com --password secret
-```
+The CLI opens a browser and prints a URL you can open manually on the same computer. A temporary loopback listener receives the callback. Browserless login is not supported.
 
 Credentials are stored per environment in `~/.holivia/credentials.<env>.json`. Access tokens are sent as bearer tokens, and the CLI automatically refreshes credentials after a `401` response when a refresh token is available.
 
-Log out and remove stored credentials for the current environment:
+Access tokens expire after two hours. Refresh tokens have no fixed expiry and rotate when used. Credential files are replaced atomically with owner-only permissions. Pundit permissions still determine which API operations the user may perform.
+
+Existing users must upgrade the CLI and run `holivia login` again. The old `/api/v1/auth/login`, `/api/v1/auth/refresh`, and `/api/v1/auth/logout` endpoints and `--email`/`--password` flags have been removed.
+
+The database migration drops the legacy `auth_tokens` table. Rolling it back restores the table structure only; deleted or revoked credentials are not restored. Users must log in again.
+
+Logout revokes this CLI session and removes credentials for the current environment. Other CLI sessions and browser sessions remain signed in. If the server cannot be reached, credentials are retained so logout can be retried:
 
 ```bash
 holivia logout
@@ -330,6 +332,63 @@ Publish it:
 holivia highlight publish 123
 ```
 
+## Tags And Topic Links
+
+Tag reads require a content, therapist, or patient viewer/manager role, or `dev`. Creating, updating, and deleting tags and their topic links require `patient_manager` or `dev`. Topic discovery requires `content_viewer`, `content_manager`, or `dev`: patient-manager access alone is insufficient, but permits linking a known topic ID. A `403` means the account lacks the required role for that operation.
+
+Discover topics and inspect existing tags:
+
+```bash
+holivia topic index --page 1 --per-page 25
+holivia topic index --theme-id 3 --slug work-pressure
+holivia topic show 12
+holivia tag index --page 1 --per-page 25
+```
+
+All IDs below are examples: replace `3` with a theme ID, `12`, `13`, and `14` with IDs from topic responses, and `42` with `tag.id` returned by creation or listing. Use `81` only after reading the actual association ID from `tag.topic_tags[].id` in `tag show`; it is not `topic_id`. Both hidden and visible links are returned with topic summaries.
+
+Create and inspect a tag:
+
+```bash
+holivia tag create \
+  --code work_pressure \
+  --name-fr "Pression au travail" \
+  --name-en "Work pressure" \
+  --description "Support for work pressure" \
+  --topic-tag-json '{"topic_id":12,"hidden":false}'
+holivia tag show 42
+```
+
+Update only supplied fields; omitted scalar fields remain unchanged. Clear a description with `--description ""` without deleting the tag. Changes to French/English names schedule asynchronous translation after commit: the worker fills missing translations, prefers English as its source, and falls back to French. It does not overwrite existing translations; inspect the tag again later for newly translated names.
+
+```bash
+holivia tag update 42 --description ""
+holivia tag update 42 --topic-tag-json '{"topic_id":13}' --topic-tag-json '{"topic_id":14}'
+holivia tag update 42 --topic-tag-json '{"id":81,"topic_id":13}'
+holivia tag update 42 --topic-tag-json '{"id":81,"hidden":true}'
+holivia tag update 42 --topic-tag-json '{"id":81,"_destroy":true}'
+```
+
+These are separate operation examples: choose the needed change, and reassign only to a topic not already linked to that tag. Repeated flags add multiple changes to `topic_tags_attributes`. Removing an association keeps the tag and topic. `hidden` and `_destroy` must be JSON booleans. Scalar and link changes in one request save atomically; an invalid link prevents the entire write.
+
+Both create and update accept root-level stdin JSON. Stdin wins over flags on duplicate top-level keys, including replacing the flag-built association array for that request:
+
+```bash
+printf '%s\n' '{"code":"rest","name_fr":"Repos","name_en":"Rest"}' | holivia tag create
+printf '%s\n' '{"description":"From stdin","topic_tags_attributes":[{"id":81,"hidden":false}]}' | holivia tag update 42 --description "From flags"
+printf '%s\n' '{"topic_tags_attributes":[]}' | holivia tag update 42 --topic-tag-json '{"topic_id":13}'
+```
+
+Topic-link updates are incremental. Omitting `topic_tags_attributes` or sending `[]` preserves existing links; it never clears the persisted list. Use each association's `id` with `_destroy: true` to remove it.
+
+Delete the tag when it is no longer needed:
+
+```bash
+holivia tag delete 42
+```
+
+Deletion removes the tag's patient, therapist, and selfcare assignments plus topic/theme links. Patients, therapists, selfcare contents, topics, and themes remain. A successful API `204` produces `{"deleted":true,"id":42}`; failures do not print success.
+
 ## Files And Uploads
 
 Selfcare create and update commands can upload images with `--image <path>`.
@@ -356,16 +415,19 @@ Crisis and collective intervention create and update commands accept nested cont
 
 ## Development
 
-After checking out the repo, run:
+Use `bin/holivia` from the SANTEZ root to run the checked-out gem source.
+
+After checking out SANTEZ, enter the gem directory and run:
 
 ```bash
+cd gems/holivia
 bin/setup
 ```
 
 Run the test suite with:
 
 ```bash
-rake spec
+bundle exec rake test
 ```
 
 Open an interactive console with:
@@ -386,11 +448,11 @@ To release a new version, update the version number in `lib/holivia/version.rb`,
 bundle exec rake release
 ```
 
-This creates a git tag, pushes commits and tags, and publishes the `.gem` file to [RubyGems.org](https://rubygems.org).
+This creates a `holivia-v<version>` git tag, pushes commits and the tag, and publishes the `.gem` file to [RubyGems.org](https://rubygems.org). Run releases from a clean, merged SANTEZ checkout.
 
 ## Contributing
 
-Bug reports and pull requests are welcome on GitHub at https://github.com/Holivia-Team/holivia-ruby.
+Bug reports and pull requests are welcome in the [SANTEZ repository](https://github.com/Holivia-Team/SANTEZ/tree/dockerized-staging/gems/holivia).
 
 ## License
 
@@ -398,4 +460,4 @@ The gem is available as open source under the terms of the [MIT License](https:/
 
 ## Code Of Conduct
 
-Everyone interacting in the Holivia project's codebases, issue trackers, chat rooms, and mailing lists is expected to follow the [code of conduct](https://github.com/Holivia-Team/holivia-ruby/blob/master/CODE_OF_CONDUCT.md).
+Everyone interacting in the Holivia project's codebases, issue trackers, chat rooms, and mailing lists is expected to follow the [code of conduct](https://github.com/Holivia-Team/SANTEZ/blob/dockerized-staging/gems/holivia/CODE_OF_CONDUCT.md).

data/SKILL.md

@@ -16,7 +16,7 @@ Use `holivia` in examples below. If working from a checkout before installation,
 
 - Never invent API URLs, credentials, IDs, enum values, or content model fields.
 - Never print, store, or commit passwords, access tokens, refresh tokens, or files under `~/.holivia/credentials.*.json`.
-- Prefer interactive `holivia login` when a human can enter credentials. Use `--password` only when the user explicitly provides it for automation.
+- Use `holivia login` and let the user authenticate in their browser. Terminal email/password flags are no longer supported.
 - Before creating or updating content, run `holivia selfcare schema` and use its returned enum values and permitted item params as the source of truth.
 - Before creating or updating intervention catalog items, run `holivia intervention schema` and use its returned enum values and locales as the source of truth.
 - Before creating or updating HR home highlights, run `holivia highlight schema` and use its returned enum values and locales as the source of truth.
@@ -90,19 +90,19 @@ Debug logging may expose request details. Do not enable it in shared logs unless
 
 Credentials are stored per environment at `~/.holivia/credentials.<env>.json`. The CLI sends the access token as a bearer token and refreshes credentials automatically after a `401` response when possible.
 
-Interactive login:
+Browser login using your existing password or company SSO:
 
 ```bash
 holivia login
 ```
 
-Non-interactive login:
+A browser on the same computer is required. If it does not open automatically, open the printed URL manually. Do not ask for terminal credentials; browserless login is not supported.
 
-```bash
-holivia login --email user@example.com --password secret
-```
+Access tokens expire after two hours. Refresh tokens have no fixed expiry and rotate when used. Credential files are replaced atomically with owner-only permissions. Pundit permissions still determine which API operations the user may perform.
 
-Logout for the current environment:
+Existing users must upgrade the CLI and run `holivia login` again. The old `/api/v1/auth/login`, `/api/v1/auth/refresh`, and `/api/v1/auth/logout` endpoints and `--email`/`--password` flags have been removed.
+
+Logout revokes this CLI session and removes credentials for the current environment. Other CLI sessions and browser sessions remain signed in. If the server cannot be reached, credentials are retained so logout can be retried:
 
 ```bash
 holivia logout
@@ -295,6 +295,64 @@ holivia objective show 123
 
 Objective translated fields are returned in the default locale, currently `fr`.
 
+## Tags And Topic Links
+
+Permissions: tag reads allow content, therapist, or patient viewer/manager roles and `dev`. Tag writes and deletion require `patient_manager` or `dev`. Topic discovery requires `content_viewer`, `content_manager`, or `dev`. A patient manager may link a known topic ID without topic-read access. Treat a `403` as a missing role for that operation; do not assume tag-write access grants topic discovery.
+
+Discover topics and tags, then obtain IDs from their JSON responses:
+
+```bash
+holivia topic index --page 1 --per-page 25
+holivia topic index --theme-id 3 --slug work-pressure
+holivia topic show 12
+holivia tag index --page 1 --per-page 25
+```
+
+The following IDs are examples, not real targets: `3` is a theme ID; `12`, `13`, and `14` are topic IDs from discovery; `42` is `tag.id` from creation/listing. `81` is a TopicTag association ID from `tag.topic_tags[].id` returned by `tag show`, distinct from `topic_id`. Hidden links are included in that response.
+
+```bash
+holivia tag create \
+  --code work_pressure \
+  --name-fr "Pression au travail" \
+  --name-en "Work pressure" \
+  --topic-tag-json '{"topic_id":12,"hidden":false}'
+holivia tag show 42
+```
+
+Use the appropriate operation below rather than blindly executing every example. Reassignment must target a topic not already linked to the tag:
+
+```bash
+# Add links; repeated flags form topic_tags_attributes
+holivia tag update 42 --topic-tag-json '{"topic_id":13}' --topic-tag-json '{"topic_id":14}'
+# Reassign one existing link
+holivia tag update 42 --topic-tag-json '{"id":81,"topic_id":13}'
+# Change visibility, then remove just that association
+holivia tag update 42 --topic-tag-json '{"id":81,"hidden":true}'
+holivia tag update 42 --topic-tag-json '{"id":81,"_destroy":true}'
+# Clear description while keeping the tag
+holivia tag update 42 --description ""
+```
+
+Create/update scalar flags are `--code`, `--name-fr`, `--name-en`, and `--description`. Updates preserve omitted fields. French/English name changes enqueue translation after commit; missing translations are filled asynchronously using English first, French as fallback. Existing translations are not overwritten. Read again later when waiting for translated names.
+
+Both write commands accept root-level stdin JSON. Stdin overrides duplicate top-level flag keys, including the complete flag-built `topic_tags_attributes` array for that request:
+
+```bash
+printf '%s\n' '{"code":"rest","name_fr":"Repos","name_en":"Rest"}' | holivia tag create
+printf '%s\n' '{"description":"From stdin","topic_tags_attributes":[{"id":81,"hidden":false}]}' | holivia tag update 42 --description "From flags"
+printf '%s\n' '{"topic_tags_attributes":[]}' | holivia tag update 42 --topic-tag-json '{"topic_id":13}'
+```
+
+Omitted association input and `[]` are no-ops: existing links remain. Use association IDs and `_destroy: true` for removal. Use JSON booleans for `hidden` and `_destroy`. Scalar and association changes are atomic; correct a failed request rather than assuming some links were saved. Malformed flag JSON is rejected locally; unknown/foreign association IDs return `404`, and invalid fields or duplicate links return `422`.
+
+Delete a tag with:
+
+```bash
+holivia tag delete 42
+```
+
+This removes patient, therapist, and selfcare taggings and topic/theme links while retaining all linked patients, therapists, contents, topics, and themes. Report deletion only after the CLI returns `{"deleted":true,"id":42}` following API success.
+
 ## Enterprises
 
 Find an enterprise id:

data/ai-skills/add-holivia-cli-endpoint.md

@@ -2,9 +2,12 @@
 
 Keep endpoint commands thin and consistent with the nearest existing resource. Implement the API contract at the command layer; reuse the shared client for transport, authentication, retries, response parsing, and API errors.
 
+The gem lives in the SANTEZ monorepo under `gems/holivia`. Paths in this guide are relative to that directory unless stated otherwise.
+
 ## Inspect Before Editing
 
-1. Read `CLAUDE.md` and check the worktree for user changes.
+1. Read the repository root `AGENTS.md` and check the worktree for user changes.
+   Read `ai-rules/cli-development.md` at the repository root for bundle selection, executable isolation, and verification commands.
 2. Establish the endpoint contract from the request or authoritative API material: HTTP verb, exact path, path parameters, query parameters, body keys and types, file fields, response shape, and required CLI name. Do not invent missing contract details.
 3. Read these architecture files:
    - `lib/holivia/cli.rb` for top-level registration.
@@ -102,16 +105,18 @@ Keep these tests at the CLI-to-client boundary. Do not make network requests. Ad
 
 ## Verify and Review
 
+Run these commands with `gems/holivia` as the working directory and its Gemfile explicitly selected. Follow `ai-rules/cli-development.md` at the repository root for execution-environment guidance, including changes spanning Rails and the CLI.
+
 Run the narrow test first:
 
 ```bash
-bundle exec ruby -Itest test/holivia/commands/test_<resource>.rb
+BUNDLE_GEMFILE="$PWD/Gemfile" bundle exec ruby -Itest test/holivia/commands/test_<resource>.rb
 ```
 
-Then run the repository checks:
+Then run the full CLI tests and lint, bypassing the Rails `bin/rake` wrapper:
 
 ```bash
-bundle exec rake
+BUNDLE_GEMFILE="$PWD/Gemfile" bundle exec ruby -e 'load Gem.bin_path("rake", "rake")'
 ```
 
 Before finishing, inspect the diff and confirm:

data/exe/holivia

@@ -9,7 +9,10 @@ rescue Holivia::ApiError => e
   warn "Error (#{e.status}): #{e.message}"
   warn JSON.pretty_generate(e.details) if e.details.is_a?(Hash)
   exit 1
-rescue Holivia::ConfigError => e
+rescue Holivia::ConfigError, Holivia::BrowserLogin::Error, OptionParser::ParseError, Faraday::Error => e
   warn "Error: #{e.message}"
   exit 1
+rescue Interrupt
+  warn "Cancelled."
+  exit 130
 end

data/lib/holivia/auth.rb

@@ -2,15 +2,20 @@
 
 require "json"
 require "fileutils"
+require "tempfile"
 
 module Holivia
   class Auth
-    def initialize(client: Client.new(auth: nil))
-      @client = client
+    def initialize(client: nil, configuration: Holivia.configuration)
+      @client = client || Client.new(base_url: configuration.base_url, auth: nil)
+      @credentials_path = configuration.credentials_path.dup.freeze
     end
 
-    def login(email:, password:)
-      response = client.post("/api/v1/auth/login", body: { email: email, password: password })
+    def login(code:, code_verifier:, redirect_uri:)
+      response = client.post_form("/oauth/token", body: {
+                                    grant_type: "authorization_code", client_id: BrowserLogin::CLIENT_ID,
+                                    code: code, code_verifier: code_verifier, redirect_uri: redirect_uri
+                                  })
       store_tokens(response)
       response
     end
@@ -18,15 +23,25 @@ module Holivia
     def refresh
       raise ApiError.new("No refresh token. Run `holivia login`.", status: 401) unless refresh_token
 
-      response = client.post("/api/v1/auth/refresh", headers: { "Authorization" => "Bearer #{refresh_token}" })
+      response = client.post_form("/oauth/token", body: {
+                                    grant_type: "refresh_token", client_id: BrowserLogin::CLIENT_ID,
+                                    refresh_token: refresh_token
+                                  })
       store_tokens(response)
       response
+    rescue ApiError => e
+      raise unless e.details.is_a?(Hash) && e.details["error"] == "invalid_grant"
+
+      raise ApiError.new("Session expired or revoked. Run `holivia login`.", status: 401)
     end
 
     def logout
-      raise ApiError.new("Already logged out.", status: 401) unless access_token
+      raise ApiError.new("Already logged out.", status: 401) unless refresh_token
 
-      response = client.delete("/api/v1/auth/logout", headers: { "Authorization" => "Bearer #{access_token}" })
+      response = client.post_form("/oauth/revoke", body: {
+                                    client_id: BrowserLogin::CLIENT_ID, token: refresh_token,
+                                    token_type_hint: "refresh_token"
+                                  })
       FileUtils.rm_f(credentials_path)
       response
     end
@@ -41,7 +56,7 @@ module Holivia
 
     private
 
-    attr_reader :client
+    attr_reader :client, :credentials_path
 
     def credentials
       return nil unless File.exist?(credentials_path)
@@ -50,17 +65,14 @@ module Holivia
     end
 
     def store_tokens(data)
-      FileUtils.mkdir_p(File.dirname(credentials_path))
-
-      File.write(credentials_path, JSON.pretty_generate(
-                                     "access_token" => data["access_token"],
-                                     "refresh_token" => data["refresh_token"]
-                                   ))
-      File.chmod(0o600, credentials_path)
-    end
-
-    def credentials_path
-      Holivia.configuration.credentials_path
+      directory = File.dirname(credentials_path)
+      FileUtils.mkdir_p(directory, mode: 0o700)
+      Tempfile.create(["credentials", ".json"], directory) do |file|
+        file.write(JSON.pretty_generate(data.slice("access_token", "refresh_token")))
+        file.flush
+        file.fsync
+        File.rename(file.path, credentials_path)
+      end
     end
   end
 end

data/lib/holivia/browser_login.rb

@@ -0,0 +1,125 @@
+# frozen_string_literal: true
+
+require "digest"
+require "securerandom"
+require "socket"
+require "timeout"
+require "uri"
+
+module Holivia
+  class BrowserLogin
+    class Error < StandardError; end
+
+    CLIENT_ID = "holivia-cli"
+
+    def initialize(base_url: Holivia.configuration.base_url, output: $stderr, timeout: 180, browser_launcher: nil)
+      @base_url = base_url.dup.freeze
+      @output = output
+      @timeout = timeout
+      @browser_launcher = browser_launcher || method(:launch_browser)
+    end
+
+    def call
+      verifier = SecureRandom.urlsafe_base64(32)
+      state = SecureRandom.urlsafe_base64(32)
+      server = TCPServer.new("127.0.0.1", 0)
+      redirect_uri = "http://127.0.0.1:#{server.addr[1]}/callback"
+
+      Timeout.timeout(@timeout, Error, "Browser login timed out. Run holivia login to try again.") do
+        open_browser(authorization_url(verifier, state, redirect_uri))
+        code = receive_code(server, state)
+        { code: code, code_verifier: verifier, redirect_uri: redirect_uri }
+      end
+    ensure
+      server&.close
+    end
+
+    private
+
+    def authorization_url(verifier, state, redirect_uri)
+      url = URI.join(@base_url, "/oauth/authorize")
+      url.query = URI.encode_www_form(
+        client_id: CLIENT_ID, response_type: "code", redirect_uri: redirect_uri,
+        code_challenge: [Digest::SHA256.digest(verifier)].pack("m0").tr("+/", "-_").delete("="),
+        code_challenge_method: "S256", state: state
+      )
+      url.to_s
+    end
+
+    def open_browser(url)
+      @output.puts "Open this URL in a browser on this computer to log in:\n#{url}"
+      @browser_launcher.call(url)
+    end
+
+    def launch_browser(url)
+      command = RUBY_PLATFORM.include?("darwin") ? "open" : "xdg-open"
+      system(command, url, out: File::NULL, err: File::NULL)
+    end
+
+    def receive_code(server, state)
+      loop do
+        code = handle_callback(server.accept, state)
+        return code if code
+      end
+    end
+
+    def handle_callback(socket, state)
+      params = callback_params(socket.gets("\r\n\r\n", 8192))
+      unless valid_callback?(params, state)
+        respond(socket, "400 Bad Request", "Invalid login callback.")
+        return nil
+      end
+
+      complete_callback(socket, params)
+    rescue SystemCallError, IOError
+      nil # A disconnected browser must not prevent a later valid callback.
+    ensure
+      socket.close
+    end
+
+    def callback_params(request)
+      return {} unless request&.end_with?("\r\n\r\n")
+
+      match = request.lines.first.match(%r{\AGET /callback\?([^\s]+) HTTP/1\.[01]\r\n\z})
+      return {} unless match
+
+      pairs = URI.decode_www_form(match[1])
+      return {} unless pairs.map(&:first).uniq.length == pairs.length
+
+      pairs.to_h
+    rescue ArgumentError
+      {}
+    end
+
+    def valid_callback?(params, state)
+      return false unless params["state"] == state
+
+      code = params["code"]
+      error = params["error"]
+      (code && !code.empty? && error.nil?) || (error && !error.empty? && code.nil?)
+    end
+
+    def complete_callback(socket, params)
+      if params["error"]
+        respond(socket, "200 OK", "Authorization was not granted. Return to the terminal.")
+        raise Error, "Authorization was not granted. Run holivia login to try again."
+      end
+
+      redirect_to_completion(socket)
+      params.fetch("code")
+    end
+
+    def redirect_to_completion(socket)
+      url = URI.join(@base_url, "/oauth/complete")
+      socket.write "HTTP/1.1 303 See Other\r\nLocation: #{url}\r\n" \
+                   "Referrer-Policy: no-referrer\r\nCache-Control: no-store\r\n" \
+                   "Content-Length: 0\r\nConnection: close\r\n\r\n"
+    end
+
+    def respond(socket, status, message)
+      socket.write "HTTP/1.1 #{status}\r\nContent-Type: text/plain; charset=utf-8\r\n" \
+                   "Content-Length: #{message.bytesize}\r\nCache-Control: no-store\r\n" \
+                   "Connection: close\r\n\r\n#{message}"
+    end
+  end
+end

data/lib/holivia/cli/help.rb

@@ -17,7 +17,7 @@ module Holivia
           Config stored at ~/.holivia/config.yml. Defaults to staging if no config exists.
 
         Authentication:
-          holivia login [--email EMAIL --password PASSWORD]  Log in (flags or interactive prompt)
+          holivia login                                    Log in through your browser (password or company SSO)
           holivia logout                         Log out and clear stored credentials
           Tokens are stored at ~/.holivia/credentials.<env>.json and refreshed automatically on 401.
 
@@ -50,6 +50,29 @@ module Holivia
           holivia objective show <id>                                  Show one objective
           Translated fields are returned in the default locale (fr).
 
+        Topics:
+          holivia topic index [--theme-id ID --slug SLUG --page N --per-page N]  List topics
+          holivia topic show <id>                Show one topic by numeric ID
+          Requires content_viewer, content_manager, or dev. Patient-manager access alone is insufficient.
+
+        Tags:
+          holivia tag index [--page N --per-page N]  List tags
+          holivia tag show <id>                  Show one tag with its topic links
+          holivia tag create [options]           Create a tag
+          holivia tag update <id> [options]      Update a tag
+          holivia tag delete <id>                Delete a tag and its assignments and links; keep linked records
+          Write options: --code CODE --name-fr NAME --name-en NAME --description TEXT.
+          Piped JSON is merged after flags; stdin wins on duplicate keys.
+          Includes hidden links. Each topic_tags entry has an association ID distinct from its topic_id.
+          Create/update accept repeatable --topic-tag-json JSON flags, forming topic_tags_attributes:
+            Add: --topic-tag-json '{"topic_id":12,"hidden":false}'
+            Reassign: --topic-tag-json '{"id":81,"topic_id":13}'
+            Visibility: --topic-tag-json '{"id":81,"hidden":true}'
+            Remove link: --topic-tag-json '{"id":81,"_destroy":true}'
+          Example IDs: 12/13 are topic IDs; 81 is an association ID returned by tag show.
+          Changes are incremental: omitted links and [] preserve existing links; [] does not clear them.
+          Stdin topic_tags_attributes replaces the flag-built array for this request, not persisted links.
+
         Enterprises:
           holivia enterprise index [--query TEXT --headquarter-id ID --user-id ID --page N --per-page N]
                                                 Find enterprises and their enterprise_id values

data/lib/holivia/cli.rb

@@ -9,6 +9,8 @@ require_relative "commands/slide"
 require_relative "commands/env"
 require_relative "commands/item"
 require_relative "commands/objective"
+require_relative "commands/topic"
+require_relative "commands/tag"
 require_relative "commands/appointment"
 require_relative "commands/communication_item"
 require_relative "commands/intervention_item"
@@ -28,6 +30,8 @@ module Holivia
       when "env" then Commands::Env.route(args)
       when "selfcare" then Commands::Selfcare.route(args)
       when "objective" then Commands::Objective.route(args)
+      when "topic" then Commands::Topic.route(args)
+      when "tag" then Commands::Tag.route(args)
       when "appointment" then Commands::Appointment.route(args)
       when "communication" then Commands::CommunicationItem.route(args)
       when "intervention" then Commands::InterventionItem.route(args)

data/lib/holivia/client.rb

@@ -2,6 +2,7 @@
 
 require "faraday"
 require "faraday/multipart"
+require "uri"
 
 module Holivia
   class Client
@@ -15,6 +16,16 @@ module Holivia
       request(:post, path, body:, headers:)
     end
 
+    def post_form(path, body: {})
+      response = connection.post(path) do |req|
+        req.headers["Accept"] = "application/json"
+        req.headers["Content-Type"] = "application/x-www-form-urlencoded"
+        req.body = URI.encode_www_form(body)
+      end
+
+      handle_response(response)
+    end
+
     def get(path, params: {}, headers: {})
       request(:get, path, params:, headers:)
     end
@@ -59,7 +70,7 @@ module Holivia
       @connection ||= http.new(url: base_url) do |f|
         f.request :multipart
         f.request :json
-        f.response :logger if Holivia.configuration.debug?
+        f.response :logger, nil, headers: false, bodies: false if Holivia.configuration.debug?
         f.response :json
         f.adapter Faraday.default_adapter
       end
@@ -77,6 +88,8 @@ module Holivia
       return "Request failed" unless body.is_a?(Hash)
 
       error = body["error"]
+      return [error, body["error_description"]].compact.join(": ") if error.is_a?(String)
+
       error.is_a?(Hash) ? (error["message"] || "Request failed") : (error || "Request failed")
     end
 

data/lib/holivia/commands/auth.rb

@@ -1,23 +1,19 @@
 # frozen_string_literal: true
 
-require "io/console"
 require "optparse"
 
 module Holivia
   module Commands
     class Auth
       def login(args = [])
-        options = {}
         OptionParser.new do |opts|
-          opts.banner = "Usage: holivia login [--email EMAIL --password PASSWORD]"
-          opts.on("--email EMAIL") { |v| options[:email] = v }
-          opts.on("--password PASSWORD") { |v| options[:password] = v }
+          opts.banner = "Usage: holivia login"
         end.parse!(args)
+        raise OptionParser::InvalidArgument, args.join(" ") unless args.empty?
 
-        email = options[:email] || prompt("Email: ")
-        password = options[:password] || prompt_secret("Password: ")
-
-        Holivia::Auth.new.login(email: email, password: password)
+        auth = Holivia::Auth.new
+        exchange = BrowserLogin.new.call
+        auth.login(**exchange)
         puts "Logged in successfully."
       end
 
@@ -25,20 +21,6 @@ module Holivia
         Holivia::Auth.new.logout
         puts "Logged out successfully."
       end
-
-      private
-
-      def prompt(label)
-        print label
-        $stdin.gets.chomp
-      end
-
-      def prompt_secret(label)
-        print label
-        result = $stdin.noecho(&:gets).chomp
-        puts
-        result
-      end
     end
   end
 end

data/lib/holivia/commands/tag.rb

@@ -0,0 +1,101 @@
+# frozen_string_literal: true
+
+require_relative "base"
+
+module Holivia
+  module Commands
+    class Tag < Base
+      BASE_PATH = "/api/v1/backoffice/tags"
+
+      def self.route(args)
+        subcommand = args.shift
+        case subcommand
+        when "index" then new.index(args)
+        when "show"  then new.show(args)
+        when "create" then new.create(args)
+        when "update" then new.update(args)
+        when "delete" then new.delete(args)
+        else warn "Unknown tag command: #{subcommand}"
+             exit 1
+        end
+      end
+
+      def index(args = [])
+        params = {}
+        OptionParser.new do |opts|
+          opts.banner = "Usage: holivia tag index [options]"
+          opts.on("--page N", Integer) { |v| params[:page] = v }
+          opts.on("--per-page N", Integer) { |v| params[:per_page] = v }
+        end.parse!(args)
+
+        output(client.get(BASE_PATH, params: params))
+      end
+
+      def show(args = [])
+        id = args.shift
+        abort "Usage: holivia tag show <id>" unless id
+
+        output(client.get("#{BASE_PATH}/#{id}"))
+      end
+
+      def create(args = [])
+        options = parse_write_options(args, "Usage: holivia tag create [options]")
+        abort "No options provided. Use --help for usage." if options.empty?
+
+        output(client.post(BASE_PATH, body: options))
+      end
+
+      def update(args = [])
+        id = args.shift
+        abort "Usage: holivia tag update <id> [options]" unless id
+
+        options = parse_write_options(args, "Usage: holivia tag update <id> [options]")
+        abort "No options provided. Use --help for usage." if options.empty?
+
+        output(client.patch("#{BASE_PATH}/#{id}", body: options))
+      end
+
+      def delete(args = [])
+        id = args.shift
+        abort "Usage: holivia tag delete <id>" unless id
+
+        client.delete("#{BASE_PATH}/#{id}")
+        output(deleted: true, id: id.to_i)
+      end
+
+      private
+
+      def parse_write_options(args, banner)
+        options = {}
+        OptionParser.new do |opts|
+          opts.banner = banner
+          opts.on("--code CODE") { |v| options[:code] = v }
+          opts.on("--name-fr NAME") { |v| options[:name_fr] = v }
+          opts.on("--name-en NAME") { |v| options[:name_en] = v }
+          opts.on("--description TEXT") { |v| options[:description] = v }
+          opts.on("--topic-tag-json JSON", "Repeat for multiple changes") { |v| append_topic_tag(options, v) }
+          add_topic_link_help(opts)
+        end.parse!(args)
+        options.merge(piped_json)
+      end
+
+      def add_topic_link_help(opts)
+        opts.separator "Piped JSON is merged after flags; stdin wins on duplicate keys."
+        opts.separator "Topic links are incremental; omitted links and [] preserve existing links."
+        opts.separator "Use topic_id to add; id is the association ID from tag show, not the topic ID."
+        opts.separator 'Add: {"topic_id":12,"hidden":false}; reassign: {"id":81,"topic_id":13}.'
+        opts.separator 'Visibility: {"id":81,"hidden":true}; remove: {"id":81,"_destroy":true}.'
+      end
+
+      def append_topic_tag(options, json)
+        link = JSON.parse(json, symbolize_names: true)
+        abort "--topic-tag-json must be a JSON object (for example: '{\"topic_id\":12}')." unless link.is_a?(Hash)
+
+        options[:topic_tags_attributes] ||= []
+        options[:topic_tags_attributes] << link
+      rescue JSON::ParserError
+        abort "Invalid JSON for --topic-tag-json. Pass one JSON object (for example: '{\"topic_id\":12}')."
+      end
+    end
+  end
+end

data/lib/holivia/commands/topic.rb

@@ -0,0 +1,41 @@
+# frozen_string_literal: true
+
+require_relative "base"
+
+module Holivia
+  module Commands
+    class Topic < Base
+      BASE_PATH = "/api/v1/backoffice/topics"
+
+      def self.route(args)
+        subcommand = args.shift
+        case subcommand
+        when "index" then new.index(args)
+        when "show"  then new.show(args)
+        else warn "Unknown topic command: #{subcommand}"
+             exit 1
+        end
+      end
+
+      def index(args = [])
+        params = {}
+        OptionParser.new do |opts|
+          opts.banner = "Usage: holivia topic index [options]"
+          opts.on("--theme-id ID", Integer) { |v| params[:theme_id] = v }
+          opts.on("--slug SLUG") { |v| params[:slug] = v }
+          opts.on("--page N", Integer) { |v| params[:page] = v }
+          opts.on("--per-page N", Integer) { |v| params[:per_page] = v }
+        end.parse!(args)
+
+        output(client.get(BASE_PATH, params: params))
+      end
+
+      def show(args = [])
+        id = args.shift
+        abort "Usage: holivia topic show <id>" unless id
+
+        output(client.get("#{BASE_PATH}/#{id}"))
+      end
+    end
+  end
+end

data/lib/holivia/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Holivia
-  VERSION = "0.11.0"
+  VERSION = "0.13.0"
 end

data/lib/holivia.rb

@@ -7,6 +7,7 @@ require_relative "holivia/api_error"
 require_relative "holivia/config_error"
 require_relative "holivia/client"
 require_relative "holivia/auth"
+require_relative "holivia/browser_login"
 
 module Holivia
   class << self

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: holivia
 version: !ruby/object:Gem::Version
-  version: 0.11.0
+  version: 0.13.0
 platform: ruby
 authors:
 - Holivia
@@ -45,15 +45,10 @@ executables:
 extensions: []
 extra_rdoc_files: []
 files:
-- ".agents/skills/add-holivia-cli-endpoint/SKILL.md"
-- ".agents/skills/add-holivia-cli-endpoint/agents/openai.yaml"
-- ".rubocop.yml"
 - CHANGELOG.md
-- CLAUDE.md
 - CODE_OF_CONDUCT.md
 - LICENSE.txt
 - README.md
-- Rakefile
 - SKILL.md
 - ai-skills/add-holivia-cli-endpoint.md
 - example_content.xml
@@ -62,6 +57,7 @@ files:
 - lib/holivia.rb
 - lib/holivia/api_error.rb
 - lib/holivia/auth.rb
+- lib/holivia/browser_login.rb
 - lib/holivia/cli.rb
 - lib/holivia/cli/help.rb
 - lib/holivia/client.rb
@@ -82,19 +78,20 @@ files:
 - lib/holivia/commands/selfcare_objective.rb
 - lib/holivia/commands/slide.rb
 - lib/holivia/commands/support_phone_number.rb
+- lib/holivia/commands/tag.rb
+- lib/holivia/commands/topic.rb
 - lib/holivia/config_error.rb
 - lib/holivia/configuration.rb
 - lib/holivia/env_manager.rb
 - lib/holivia/version.rb
-- mise.toml
 - sig/holivia.rbs
-homepage: https://github.com/Holivia-Team/holivia-ruby
+homepage: https://github.com/Holivia-Team/SANTEZ/tree/dockerized-staging/gems/holivia
 licenses:
 - MIT
 metadata:
-  homepage_uri: https://github.com/Holivia-Team/holivia-ruby
-  source_code_uri: https://github.com/Holivia-Team/holivia-ruby
-  changelog_uri: https://github.com/Holivia-Team/holivia-ruby/blob/main/CHANGELOG.md
+  homepage_uri: https://github.com/Holivia-Team/SANTEZ/tree/dockerized-staging/gems/holivia
+  source_code_uri: https://github.com/Holivia-Team/SANTEZ/tree/dockerized-staging/gems/holivia
+  changelog_uri: https://github.com/Holivia-Team/SANTEZ/blob/dockerized-staging/gems/holivia/CHANGELOG.md
   rubygems_mfa_required: 'true'
 rdoc_options: []
 require_paths:
@@ -110,7 +107,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.9
+rubygems_version: 4.0.10
 specification_version: 4
 summary: Ruby client and CLI for the Holivia API
 test_files: []

data/.agents/skills/add-holivia-cli-endpoint/SKILL.md

@@ -1,10 +0,0 @@
----
-name: add-holivia-cli-endpoint
-description: Add, extend, or review Holivia Ruby CLI commands that expose API endpoints while preserving the repository's routing, option parsing, HTTP, JSON output, help, and Minitest conventions. Use when implementing a new top-level CLI resource, adding an action or CRUD endpoint to an existing resource, exposing filters or request fields, adding multipart uploads, or checking an endpoint implementation for architectural consistency.
----
-
-# Add a Holivia CLI Endpoint
-
-Read `../../../ai-skills/add-holivia-cli-endpoint.md` completely before taking any task action. Treat that file as the canonical workflow and follow it for the rest of the task.
-
-If the file cannot be read, stop and report that the canonical guide is unavailable instead of reconstructing its instructions from memory.

data/.agents/skills/add-holivia-cli-endpoint/agents/openai.yaml

@@ -1,4 +0,0 @@
-interface:
-  display_name: "Add Holivia CLI Endpoint"
-  short_description: "Add API endpoints using the existing CLI design"
-  default_prompt: "Use $add-holivia-cli-endpoint to add this API endpoint consistently to the Holivia CLI."

data/.rubocop.yml

@@ -1,31 +0,0 @@
-AllCops:
-  TargetRubyVersion: 3.1
-  NewCops: enable
-  SuggestExtensions: false
-
-Style/Documentation:
-  Enabled: false
-
-Metrics/ClassLength:
-  Exclude:
-    - "test/**/*"
-
-Metrics/AbcSize:
-  Max: 20
-
-Metrics/MethodLength:
-  Max: 12
-  Exclude:
-    - "test/**/*"
-
-Metrics/ParameterLists:
-  Max: 6
-
-Naming/VariableNumber:
-  CheckMethodNames: false
-
-Style/StringLiterals:
-  EnforcedStyle: double_quotes
-
-Style/StringLiteralsInInterpolation:
-  EnforcedStyle: double_quotes

data/CLAUDE.md

@@ -1,17 +0,0 @@
-## Project
-
-This is the `holivia` Ruby gem — an API client library and CLI for the Holivia platform.
-
-- **Gem name**: `holivia` (published on RubyGems.org)
-- **Executable**: `holivia`
-- **Repo**: `Holivia-Team/holivia-ruby`
-
-## General Behavior
-
-When asked for design options, architecture discussion, or planning — respond directly with ideas/options FIRST. Do not explore the codebase or use Task agents before answering the question. Only look at code if the user asks you to implement something.
-
-When making changes, stay strictly within the scope of what was requested. Do not add, remove, or refactor code that wasn't asked for. If you think adjacent changes would be beneficial, mention them but wait for approval before making them.
-
-When asked to commit changes, choose the appropriate workflow:
-- **Full commit** (`/commit` skill): When Ruby files are changed — runs rubocop, rspec, and creates atomic conventional commits.
-- **Quick commit**: When only non-Ruby files are changed (markdown, config, etc.) — just stage, write a conventional commit message, and commit directly.

data/Rakefile

@@ -1,15 +0,0 @@
-# frozen_string_literal: true
-
-require "bundler/gem_tasks"
-require "rake/testtask"
-
-Rake::TestTask.new(:test) do |t|
-  t.libs << "test"
-  t.test_files = FileList["test/**/test_*.rb"]
-end
-
-require "rubocop/rake_task"
-
-RuboCop::RakeTask.new
-
-task default: %i[test rubocop]

data/mise.toml

@@ -1,2 +0,0 @@
-[tools]
-ruby = "3.4.8"