failproofai 1.0.1 → 1.0.2-beta.0

package/.next/standalone/fp-cloud-cli/tests/test_auth.py

@@ -0,0 +1,98 @@
+from __future__ import annotations
+
+import json
+from datetime import datetime, timezone
+
+import httpx
+import pytest
+import respx
+
+from fp_cli import auth, config
+from fp_cli.errors import ApiError, AuthError, NetworkError
+
+BASE = "http://dash.test"
+
+
+@respx.mock
+def test_request_otp_ok():
+    route = respx.post(f"{BASE}/api/auth/otp/request").mock(
+        return_value=httpx.Response(200, json={"ok": True})
+    )
+    auth.request_otp(BASE, "me@test")
+    assert route.called
+    assert json.loads(route.calls.last.request.read()) == {"email": "me@test"}
+    # Marks a CLI login so the server emails the paste-into-terminal OTP variant.
+    assert route.calls.last.request.headers["X-AgentEye-Client"] == "cli"
+
+
+@respx.mock
+def test_request_otp_server_error_raises():
+    respx.post(f"{BASE}/api/auth/otp/request").mock(return_value=httpx.Response(502))
+    with pytest.raises(ApiError):
+        auth.request_otp(BASE, "me@test")
+
+
+@respx.mock
+def test_verify_otp_reads_token_from_set_cookie_not_body():
+    # The dashboard returns user + expires_in_secs in the body and the token only
+    # in the Set-Cookie header — verify we read it from the cookie.
+    respx.post(f"{BASE}/api/auth/otp/verify").mock(
+        return_value=httpx.Response(
+            200,
+            json={"user": {"id": "u1", "email": "me@test"}, "expires_in_secs": 3600},
+            headers={"set-cookie": "ae_session=tok-xyz; HttpOnly; Path=/; Max-Age=3600"},
+        )
+    )
+    token, expires_in, user = auth.verify_otp(BASE, "me@test", "123456")
+    assert token == "tok-xyz"
+    assert expires_in == 3600
+    assert user["email"] == "me@test"
+
+
+@respx.mock
+def test_verify_otp_wrong_code_is_auth_error():
+    respx.post(f"{BASE}/api/auth/otp/verify").mock(return_value=httpx.Response(401, json={}))
+    with pytest.raises(AuthError):
+        auth.verify_otp(BASE, "me@test", "000000")
+
+
+@respx.mock
+def test_verify_otp_without_cookie_is_auth_error():
+    respx.post(f"{BASE}/api/auth/otp/verify").mock(
+        return_value=httpx.Response(200, json={"user": {}, "expires_in_secs": 3600})
+    )
+    with pytest.raises(AuthError):
+        auth.verify_otp(BASE, "me@test", "123456")
+
+
+@respx.mock
+def test_verify_otp_network_error():
+    respx.post(f"{BASE}/api/auth/otp/verify").mock(side_effect=httpx.ConnectError("down"))
+    with pytest.raises(NetworkError):
+        auth.verify_otp(BASE, "me@test", "123456")
+
+
+def test_persist_session_computes_expiry_and_writes_0600(home):
+    cfg = config.CliConfig()
+    now = datetime(2026, 5, 25, 12, 0, 0, tzinfo=timezone.utc)
+    auth.persist_session(cfg, BASE, "tok", 3600, {"email": "me@test", "id": "u1"}, now=now)
+
+    reloaded = config.load_config()
+    assert reloaded.session_token == "tok"
+    assert reloaded.expires_at == "2026-05-25T13:00:00Z"
+    assert reloaded.email == "me@test"
+    assert reloaded.user_id == "u1"
+    assert reloaded.base_url == BASE
+    assert not config.is_expired(reloaded, now=now)
+
+
+@respx.mock
+def test_logout_is_best_effort_on_network_error():
+    respx.post(f"{BASE}/api/auth/logout").mock(side_effect=httpx.ConnectError("down"))
+    # Must not raise even though the server is unreachable.
+    auth.logout(BASE, "tok")
+
+
+def test_logout_noop_without_token():
+    # No registered routes — if it tried to call out, respx would complain.
+    auth.logout(BASE, None)

package/.next/standalone/fp-cloud-cli/tests/test_auth_mode.py

@@ -0,0 +1,272 @@
+"""API-key auth mode: precedence, the empty-string rule, what goes on the wire, and
+what never touches disk.
+
+The wire assertions here are deliberately NEGATIVE as well as positive. "The bearer
+header is set" passes just as happily when the CLI *also* attaches the operator's
+`ae_session` cookie — which would hand a human's session to `/v1` from a CI box, and
+no positive-only test would ever notice.
+"""
+
+from __future__ import annotations
+
+import json
+
+import httpx
+import pytest
+import respx
+
+from fp_cli import config
+from fp_cli._context import AppState, AuthMode, resolve_auth
+from fp_cli.app import app
+
+BASE = "http://dash.test"
+KEY = "ak_live_abc123"
+
+
+def _mock_keys(mock):
+    """Mock BOTH surfaces so a wrong-mode request is a wrong URL, not a network error."""
+    return (
+        mock.get(f"{BASE}/api/keys").mock(return_value=httpx.Response(200, json=[])),
+        mock.get(f"{BASE}/v1/keys").mock(return_value=httpx.Response(200, json=[])),
+    )
+
+
+def _run_keys_list(runner, argv, env=None):
+    """Run `keys list` with both surfaces mocked → (result, api_route, v1_route)."""
+    with respx.mock(assert_all_called=False) as mock:
+        api_route, v1_route = _mock_keys(mock)
+        result = runner.invoke(app, [*argv, "--json", "keys", "list"], env=env or {})
+    return result, api_route, v1_route
+
+
+# --- precedence ladder ------------------------------------------------------
+
+
+def test_api_key_flag_selects_key_mode(home, runner):
+    result, api_route, v1_route = _run_keys_list(runner, ["--base-url", BASE, "--api-key", KEY])
+    assert result.exit_code == 0, result.output
+    assert v1_route.called and not api_route.called
+
+
+def test_token_flag_beats_api_key_env(home, runner):
+    # An explicit flag outranks any env var, including the key's.
+    result, api_route, v1_route = _run_keys_list(
+        runner, ["--base-url", BASE, "--token", "tok"], env={"FP_API_KEY": KEY}
+    )
+    assert result.exit_code == 0, result.output
+    assert api_route.called and not v1_route.called
+
+
+def test_api_key_env_beats_token_env(home, runner):
+    # Between two env vars the KEY wins — the documented rung.
+    result, api_route, v1_route = _run_keys_list(
+        runner,
+        ["--base-url", BASE],
+        env={"FP_API_KEY": KEY, "FP_TOKEN": "tok"},
+    )
+    assert result.exit_code == 0, result.output
+    assert v1_route.called and not api_route.called
+
+
+def test_token_env_beats_saved_session(home, runner):
+    config.save_config(config.CliConfig(base_url=BASE, session_token="saved-tok",
+                                        expires_at="2999-01-01T00:00:00Z"))
+    with respx.mock(assert_all_called=False) as mock:
+        api_route, _v1 = _mock_keys(mock)
+        result = runner.invoke(app, ["--json", "keys", "list"], env={"FP_TOKEN": "env-tok"})
+    assert result.exit_code == 0, result.output
+    assert "ae_session=env-tok" in api_route.calls.last.request.headers.get("cookie", "")
+
+
+def test_api_key_env_beats_saved_session(home, runner):
+    config.save_config(config.CliConfig(base_url=BASE, session_token="saved-tok",
+                                        expires_at="2999-01-01T00:00:00Z"))
+    result, api_route, v1_route = _run_keys_list(
+        runner, [], env={"FP_API_KEY": KEY}
+    )
+    assert result.exit_code == 0, result.output
+    assert v1_route.called and not api_route.called
+
+
+def test_saved_session_when_nothing_else(logged_in, runner):
+    result, api_route, v1_route = _run_keys_list(runner, [])
+    assert result.exit_code == 0, result.output
+    assert api_route.called and not v1_route.called
+
+
+def test_no_credential_at_all_exits_4(home, runner):
+    with respx.mock(assert_all_called=False) as mock:
+        catch_all = mock.route().mock(return_value=httpx.Response(200, json=[]))
+        result = runner.invoke(app, ["--base-url", BASE, "keys", "list"])
+    assert result.exit_code == 4, result.output
+    assert catch_all.call_count == 0  # never opened a connection
+
+
+# --- resolve_auth, unit ------------------------------------------------------
+
+
+@pytest.mark.parametrize(
+    "kwargs,expected",
+    [
+        # flag key, flag token, env key, env token, saved token
+        (dict(api_key=KEY, api_key_on_cli=True, token=None, token_on_cli=False, saved_token=None),
+         (AuthMode.API_KEY, KEY, None)),
+        (dict(api_key=None, api_key_on_cli=False, token="t", token_on_cli=True, saved_token=None),
+         (AuthMode.SESSION, None, "t")),
+        (dict(api_key=KEY, api_key_on_cli=False, token="t", token_on_cli=False, saved_token=None),
+         (AuthMode.API_KEY, KEY, None)),
+        (dict(api_key=None, api_key_on_cli=False, token="t", token_on_cli=False, saved_token="s"),
+         (AuthMode.SESSION, None, "t")),
+        (dict(api_key=None, api_key_on_cli=False, token=None, token_on_cli=False, saved_token="s"),
+         (AuthMode.SESSION, None, "s")),
+        (dict(api_key=None, api_key_on_cli=False, token=None, token_on_cli=False, saved_token=None),
+         (AuthMode.NONE, None, None)),
+        # `--api-key ""` is key mode with NO credential — never a fallback to the
+        # saved session (mirrors the established `--token ""` rule).
+        (dict(api_key="", api_key_on_cli=True, token=None, token_on_cli=False, saved_token="s"),
+         (AuthMode.API_KEY, "", None)),
+    ],
+)
+def test_resolve_auth_precedence(kwargs, expected):
+    assert resolve_auth(**kwargs) == expected
+
+
+def test_both_flags_is_a_usage_error():
+    from fp_cli import _click_compat as click
+
+    with pytest.raises(click.UsageError):
+        resolve_auth(api_key=KEY, api_key_on_cli=True, token="t", token_on_cli=True,
+                     saved_token=None)
+
+
+def test_both_flags_exits_2_with_zero_http_calls(logged_in, runner):
+    with respx.mock(assert_all_called=False) as mock:
+        catch_all = mock.route().mock(return_value=httpx.Response(200, json=[]))
+        result = runner.invoke(
+            app, ["--base-url", BASE, "--api-key", KEY, "--token", "tok", "keys", "list"]
+        )
+    assert result.exit_code == 2, result.output
+    assert catch_all.call_count == 0  # never guessed which one you meant
+
+
+# --- the empty-string rule ---------------------------------------------------
+
+
+def test_empty_api_key_does_not_fall_back_to_saved_session(logged_in, runner):
+    """`--api-key ""` (an unset CI var) must not silently act as the logged-in human."""
+    with respx.mock(assert_all_called=False) as mock:
+        catch_all = mock.route().mock(return_value=httpx.Response(200, json=[]))
+        result = runner.invoke(app, ["--base-url", BASE, "--api-key", "", "keys", "list"])
+    assert result.exit_code == 4, result.output  # key mode, no credential
+    assert catch_all.call_count == 0
+
+
+# --- what goes on the wire (both directions) ---------------------------------
+
+
+def test_key_mode_sends_bearer_and_no_cookie(logged_in, runner):
+    # `logged_in` seeds a saved session on purpose: the cookie is available, and must
+    # still not be sent.
+    result, _api, v1_route = _run_keys_list(runner, ["--base-url", BASE, "--api-key", KEY])
+    assert result.exit_code == 0, result.output
+    headers = v1_route.calls.last.request.headers
+    assert headers["authorization"] == f"Bearer {KEY}"
+    assert "cookie" not in headers, "an API-key request must never carry ae_session"
+
+
+def test_session_mode_sends_cookie_and_no_bearer(logged_in, runner):
+    result, api_route, _v1 = _run_keys_list(runner, [])
+    assert result.exit_code == 0, result.output
+    headers = api_route.calls.last.request.headers
+    assert "ae_session=tok" in headers.get("cookie", "")
+    assert "authorization" not in headers
+
+
+# --- the org header ----------------------------------------------------------
+
+
+def test_key_mode_never_sends_the_saved_org(home, runner):
+    config.save_config(config.CliConfig(base_url=BASE, org="human-org"))
+    result, _api, v1_route = _run_keys_list(runner, ["--api-key", KEY])
+    assert result.exit_code == 0, result.output
+    assert "x-agenteye-org" not in v1_route.calls.last.request.headers
+
+
+def test_key_mode_sends_an_explicit_org(home, runner):
+    config.save_config(config.CliConfig(base_url=BASE, org="human-org"))
+    result, _api, v1_route = _run_keys_list(runner, ["--api-key", KEY, "--org", "acme"])
+    assert result.exit_code == 0, result.output
+    assert v1_route.calls.last.request.headers["x-agenteye-org"] == "acme"
+
+
+def test_session_mode_still_sends_the_saved_org(home, runner):
+    config.save_config(config.CliConfig(base_url=BASE, session_token="tok",
+                                        expires_at="2999-01-01T00:00:00Z", org="human-org"))
+    result, api_route, _v1 = _run_keys_list(runner, [])
+    assert result.exit_code == 0, result.output
+    assert api_route.calls.last.request.headers["x-agenteye-org"] == "human-org"
+
+
+# --- the key never reaches disk ---------------------------------------------
+
+
+def test_api_key_is_never_persisted(home, runner):
+    result, _api, _v1 = _run_keys_list(runner, ["--base-url", BASE, "--api-key", KEY])
+    assert result.exit_code == 0, result.output
+    path = config.config_path()
+    on_disk = path.read_text() if path.exists() else ""
+    assert KEY not in on_disk
+    # And no field quietly holds it either (a new CliConfig field would be the way
+    # this regresses).
+    assert KEY not in json.dumps(config.load_config().__dict__)
+
+
+def test_api_key_is_not_persisted_by_whoami(home, runner):
+    result = runner.invoke(app, ["--base-url", BASE, "--api-key", KEY, "--json", "whoami"])
+    assert result.exit_code == 0, result.output
+    path = config.config_path()
+    assert KEY not in (path.read_text() if path.exists() else "")
+
+
+# --- whoami in key mode is the documented exception --------------------------
+
+
+def test_whoami_key_mode_exits_0_with_honest_shape(logged_in, runner):
+    with respx.mock(assert_all_called=False) as mock:
+        catch_all = mock.route().mock(return_value=httpx.Response(200, json={}))
+        result = runner.invoke(
+            app, ["--base-url", BASE, "--api-key", KEY, "--org", "acme", "--json", "whoami"]
+        )
+    assert result.exit_code == 0, result.output
+    assert json.loads(result.stdout) == {
+        "logged_in": False,
+        "auth_mode": "api_key",
+        "active_org": "acme",
+    }
+    assert catch_all.call_count == 0  # a key has no identity to look up
+
+
+def test_whoami_key_mode_reports_no_org_when_none_given(home, runner):
+    config.save_config(config.CliConfig(base_url=BASE, org="human-org"))
+    result = runner.invoke(app, ["--api-key", KEY, "--json", "whoami"])
+    assert result.exit_code == 0, result.output
+    # The SAVED org is not the key's org, so it must not be reported as active.
+    assert json.loads(result.stdout)["active_org"] is None
+
+
+def test_whoami_human_shapes_carry_auth_mode(home, runner):
+    result = runner.invoke(app, ["--base-url", BASE, "--json", "whoami"])
+    assert result.exit_code == 0, result.output
+    assert json.loads(result.stdout) == {"logged_in": False, "auth_mode": "none"}
+
+
+# --- AppState default --------------------------------------------------------
+
+
+def test_appstate_defaults_to_none_mode():
+    # An AppState built by another path (tests, embedders) must never be silently
+    # treated as key mode.
+    state = AppState(json=False, base_url=None, token=None, timeout=30.0,
+                     config=config.CliConfig())
+    assert state.auth_mode is AuthMode.NONE
+    assert state.api_key is None

package/.next/standalone/fp-cloud-cli/tests/test_click_compat.py

@@ -0,0 +1,118 @@
+"""Guard the contract that ``fp_cli/_click_compat.py`` exists to hold.
+
+Typer 0.26 vendored Click and now catches only *its* Click's exceptions. Every way
+that coupling breaks is silent — the CLI imports, compiles, and passes every happy
+path while typed errors exit 1 with an empty stderr and the telemetry flag catalog
+quietly empties. These are the alarms.
+"""
+
+from __future__ import annotations
+
+import ast
+import pathlib
+
+import typer
+from typer.testing import CliRunner
+
+from fp_cli import _click_compat, analytics_registry
+from fp_cli.errors import ForbiddenError, KeyModeUnsupportedError, NotFoundError
+
+_PACKAGE = pathlib.Path(__file__).resolve().parent.parent / "fp_cli"
+
+
+def test_the_package_scan_actually_has_something_to_scan():
+    """`_PACKAGE` is a path literal, so a package rename makes it point at nothing.
+
+    Every scanning test below then walks an empty directory, finds zero violations and
+    passes — the guard silently stops guarding. This is the tripwire for that: it caught
+    nothing during the agenteye -> fp_cli rename only because the literal was updated in
+    the same pass, which is exactly the kind of thing that is remembered once.
+    """
+    assert _PACKAGE.is_dir(), f"{_PACKAGE} does not exist — the scanning tests are vacuous"
+    modules = list(_PACKAGE.rglob("*.py"))
+    assert len(modules) > 20, (
+        f"only {len(modules)} modules found under {_PACKAGE}; the scan is not seeing the package"
+    )
+
+
+def _click_imports(path: pathlib.Path) -> list[str]:
+    """Every direct `import click` / `from click import …` in one module."""
+    tree = ast.parse(path.read_text(encoding="utf-8"), filename=str(path))
+    hits = []
+    for node in ast.walk(tree):
+        if isinstance(node, ast.Import):
+            hits += [a.name for a in node.names if a.name == "click" or a.name.startswith("click.")]
+        elif isinstance(node, ast.ImportFrom):
+            if node.module and (node.module == "click" or node.module.startswith("click.")):
+                hits.append(node.module)
+    return hits
+
+
+def test_package_never_imports_click_directly():
+    """The pip `click` distribution is not necessarily the Click Typer is running.
+
+    Binding to it directly is the whole bug: `raise click.UsageError(...)` from the wrong
+    Click is not caught by Typer's runner, so a clean exit-2 usage error becomes exit 1 with
+    nothing on stderr. `_click_compat` is the only module allowed to name `click`.
+    """
+    offenders = {
+        str(path.relative_to(_PACKAGE)): names
+        for path in sorted(_PACKAGE.rglob("*.py"))
+        if path.name != "_click_compat.py" and (names := _click_imports(path))
+    }
+    assert not offenders, (
+        f"import Click via `from . import _click_compat as click`, not directly: {offenders}"
+    )
+
+
+def test_typed_errors_reach_typers_handler():
+    """A typed error must still be *caught* by Typer: its message on stderr, its exit code.
+
+    Asserted through a real command run rather than an isinstance check, because what matters
+    is the runner's behaviour — which is what silently changed under typer 0.26.
+    """
+    app = typer.Typer()
+
+    @app.command()
+    def boom() -> None:
+        raise ForbiddenError("nope", hint="ask an admin")
+
+    result = CliRunner().invoke(app, [])
+    assert result.exit_code == 5, result.output  # not 1: uncaught would collapse to 1
+    assert "nope" in result.output
+
+
+def test_error_exit_codes_are_distinct_per_class():
+    """The exit-code contract is documented in `--help` and scripted against."""
+    assert ForbiddenError("x").exit_code == 5
+    assert NotFoundError("x").exit_code == 6
+    # Key mode reuses exit 2 rather than adding a seventh code — the table is a scripted
+    # contract restated in `app.py`, `cli/skill/SKILL.md` and `enterprise-docs/cli.md`.
+    assert KeyModeUnsupportedError("x").exit_code == 2
+    assert issubclass(ForbiddenError, _click_compat.ClickException)
+    # Through the shim, not pip Click: bind it to the wrong Click and every key-mode
+    # refusal escapes uncaught as exit 1 with an empty stderr.
+    assert issubclass(KeyModeUnsupportedError, _click_compat.ClickException)
+
+
+def test_is_option_recognises_typer_options():
+    """Typer's vendored Click has no `Option` class, so `isinstance` cannot answer this.
+
+    If a future Click stops setting `param_type_name`, this fails loudly instead of quietly
+    dropping every flag from the telemetry catalog.
+    """
+    from typer.main import get_command
+
+    from fp_cli.app import app as real_app
+
+    params = get_command(real_app).params
+    assert params, "the root command should declare the global options"
+    assert any(_click_compat.is_option(p) for p in params)
+    assert all(not _click_compat.is_option(p) for p in params if p.param_type_name == "argument")
+
+
+def test_flag_catalog_is_populated():
+    """The catalog is derived by walking the real command tree; empty means the walk broke."""
+    _known, _leaves, flags, value_flags = analytics_registry.build()
+    assert "--json" in flags and "--base-url" in value_flags
+    assert len(flags) > 50, f"flag catalog collapsed to {len(flags)} entries"