kodeco 0.1.0 → 0.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9a8113bf48c09c6754ee161ccd1568779c99d1d873f943b31cb4c4901e9bd474
-  data.tar.gz: f3ec99a38bbb68e90fc594d7702d1ddad0b3a916c3768d47e706b328f960ca07
+  metadata.gz: 92f1b3f3a2c07ef7de80d5e2bcf2e7dd6989cd5baa29c56d085ea8fe61294e66
+  data.tar.gz: 75794675c957b94474ece30dfaebb15c2c28f3b0798208b48242aa7989fb1e94
 SHA512:
-  metadata.gz: 4a2ca478260ec6f8475be66981d8ae253dd6da00b2c3f23b249039332da5b355a18dc1783f99cd259e78264fd0fe898aabd5ac07f1a4ee8eef5631c63c042f27
-  data.tar.gz: b36b0bfb1eb73c2db436102551a85736a7825ab18803641177a1b0d2a061ad784a75c38d3e9d7a406bfec916e972134f6b82a1bc60d44781c3bbbc49cdc6f315
+  metadata.gz: 95eac6af137ca2809784e1adc765a4143a54bf7f0891236f105810645b5296de87c08367012c72a304361dd96a82940aa31efe85bb2036eaf58a029f7bcf1a6b
+  data.tar.gz: 846d4357394ca12d042e4cf57476975866289452a0f3b74f764d0300e5503a0657e5efd45646ed155a531a4e1db39ddce6d39ebebfae2ed2650e078922232212

data/README.md

@@ -34,8 +34,10 @@ for lists.
 `login` uses guardpost's device-code flow: it prints a code and a link to
 approve it, and opens the link in a browser when run in a terminal. The
 default scopes are `users:read support:read orders:read learning:read
-flags:read`. If you lack a grant for one of them, approval fails; run
-`kodeco login --scopes "..."` and leave it out.
+flags:read`. Scopes other than `flags:read` need a grant from a guardpost
+admin. A login gets whichever of the requested scopes you hold, and `login`
+lists any that weren't granted; a grant added later needs a fresh
+`kodeco login`.
 
 `logout` deletes the local credentials. guardpost has no revoke endpoint, so
 the server session lasts up to 7 days unless an admin revokes it.

data/lib/periscope/cli.rb

@@ -68,9 +68,25 @@ module Periscope
       opener = method(:open_browser) if @stdout.tty? && opts.fetch(:browser, true)
       login = Login.new(config: config, store: store, http: http, out: @json ? @stderr : @stdout,
                         opener: opener, **@login_options)
-      credentials = login.call(opts[:scopes] || Login::DEFAULT_SCOPES)
-      result = { "logged_in" => true, "scope" => credentials["scope"], "apps" => credentials["access_tokens"].keys }
-      emit(result) { "Logged in to #{config.url('guardpost')} with scope: #{credentials['scope']}" }
+      requested = (opts[:scopes] || Login::DEFAULT_SCOPES).split
+      result = login_result(requested, login.call(requested.join(" ")))
+      emit(result) { login_text(result["granted"], result["missing"]) }
+    end
+
+    # guardpost approves a login with only the scopes the user holds, so
+    # compare what was asked for with what came back.
+    def login_result(requested, credentials)
+      granted = credentials["scope"].to_s.split
+      { "logged_in" => true, "requested" => requested, "granted" => granted, "missing" => requested - granted,
+        "scope" => credentials["scope"], "apps" => credentials["access_tokens"].keys }
+    end
+
+    def login_text(granted, missing)
+      text = "Logged in with: #{granted.empty? ? '(no scopes)' : granted.join(', ')}"
+      return text if missing.empty?
+
+      "#{text}\nNot granted: #{missing.join(', ')}. Ask an admin to add them on your guardpost user page, " \
+        "then run kodeco login again."
     end
 
     def cmd_logout

data/lib/periscope/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Periscope
-  VERSION = "0.1.0"
+  VERSION = "0.1.1"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kodeco
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.1.1
 platform: ruby
 authors:
 - Kodeco