albus-cli 0.7.0__tar.gz → 0.8.0__tar.gz

{albus_cli-0.7.0 → albus_cli-0.8.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: albus-cli
-Version: 0.7.0
+Version: 0.8.0
 Summary: Command-line client for the Albus REST API
 Project-URL: Homepage, https://github.com/albusgroup/albus-cli
 Project-URL: Repository, https://github.com/albusgroup/albus-cli
@@ -9,7 +9,7 @@ Author: Albus
 License-Expression: MIT
 License-File: LICENSE
 Requires-Python: >=3.11
-Requires-Dist: albus-sdk==0.14.0
+Requires-Dist: albus-sdk==0.16.0
 Requires-Dist: typer<0.28,>=0.26.8
 Description-Content-Type: text/markdown
 

{albus_cli-0.7.0 → albus_cli-0.8.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "albus-cli"
-version = "0.7.0"
+version = "0.8.0"
 description = "Command-line client for the Albus REST API"
 readme = "README.md"
 license = "MIT"
@@ -13,7 +13,7 @@ authors = [{ name = "Albus" }]
 dependencies = [
     # Pinned, not floated: the published CLI states the one SDK version it was
     # tested against, and bumping it is a reviewed edit made when releasing.
-    "albus-sdk==0.14.0",
+    "albus-sdk==0.16.0",
     "typer>=0.26.8,<0.28",
 ]
 

{albus_cli-0.7.0 → albus_cli-0.8.0}/src/albus_cli/client.py

@@ -45,6 +45,17 @@ class _Used:
 _used: _Used | None = None
 
 
+@dataclass(frozen=True)
+class Selection:
+    """A client on the browser session and the session it was read
+    from, for `organization use` and `default`: what they save
+    afterwards must be keyed to the sign-in they validated, not
+    whichever one is stored by then."""
+
+    api: Albus
+    session: credentials.Session
+
+
 def base_url(configured: str | None) -> str:
     """The API a command talks to, spelled as the credential store keys
     it. The SDK picks its first server when none is configured."""
@@ -67,15 +78,13 @@ def client(
     if key:
         # The environment wins over a stored session deliberately, so CI
         # and agent harnesses inject a credential without touching disk.
-        return _client(base_url, timeout, organization, api_key=key)
+        return _client(base_url, timeout, organization, key, api_key=True)
 
-    stored = credentials.load(base_url)
+    stored = credentials.session(base_url)
     if stored is None:
         raise _signed_out(base_url)
 
-    return bearer_client(
-        base_url, timeout, organization, _current(base_url, stored)
-    )
+    return _session_client(base_url, timeout, organization, stored)
 
 
 def signed_in_client(
@@ -85,16 +94,21 @@ def signed_in_client(
     only a human bearer token for use it directly: an API key is a 401
     there, and the environment winning would be a 401 nobody asked
     for."""
-    stored = credentials.load(base_url)
-    if stored is None:
-        raise NotSignedIn(
-            f"not signed in to {base_url}. This command needs a browser "
-            f"session, which {API_KEY_ENV} cannot stand in for: run "
-            "`albus login`."
-        )
+    stored = _signed_in(base_url)
+    return _session_client(base_url, timeout, organization, stored)
 
-    return bearer_client(
-        base_url, timeout, organization, _current(base_url, stored)
+
+def selection(
+    base_url: str, timeout: float | None, organization: str | None
+) -> Selection:
+    """A client on the browser session acting in exactly `organization`
+    — none meaning the server's default, not the saved one. The
+    organization commands read `/whoami` through it before they write,
+    so a request that fails leaves the selection as it was."""
+    stored = _signed_in(base_url)
+    current = _current(base_url, stored.credential)
+    return Selection(
+        bearer_client(base_url, timeout, organization, current), stored
     )
 
 
@@ -120,7 +134,7 @@ def bearer_client(
     """A client on one credential, for `login` reading back the session
     it just stored rather than whatever precedence would pick."""
     return _client(
-        base_url, timeout, organization, access_token=credential.access_token
+        base_url, timeout, organization, credential.access_token, api_key=False
     )
 
 
@@ -197,6 +211,34 @@ def shadows_logout() -> str | None:
     return _shadowing("commands stay authenticated until it is unset.")
 
 
+def _signed_in(base_url: str) -> credentials.Session:
+    stored = credentials.session(base_url)
+    if stored is None:
+        raise NotSignedIn(
+            f"not signed in to {base_url}. This command needs a browser "
+            f"session, which {API_KEY_ENV} cannot stand in for: run "
+            "`albus login`."
+        )
+
+    return stored
+
+
+def _session_client(
+    base_url: str,
+    timeout: float | None,
+    organization: str | None,
+    stored: credentials.Session,
+) -> Albus:
+    """A client on a stored session, acting in the organization named on
+    the command line, else the one saved with the session."""
+    return bearer_client(
+        base_url,
+        timeout,
+        organization or stored.organization,
+        _current(base_url, stored.credential),
+    )
+
+
 def _signed_out(base_url: str) -> NotSignedIn:
     """Nothing stored to authenticate with, whether this command found
     no entry or a concurrent `logout` removed it."""
@@ -226,33 +268,28 @@ def _client(
     base_url: str,
     timeout: float | None,
     organization: str | None,
+    credential: str,
     *,
-    api_key: str | None = None,
-    access_token: str | None = None,
+    api_key: bool,
 ) -> Albus:
+    """A client sending `credential`, which is an API key or a session's
+    access token: both are a bearer token on the wire, and the SDK takes
+    either as its one `api_key`. Which it was is what `rejected` needs
+    to know."""
     global _used
-    _used = _Used(base_url=base_url, api_key=api_key is not None)
-    return _built(
-        base_url,
-        timeout,
-        organization,
-        api_key=api_key,
-        access_token=access_token,
-    )
+    _used = _Used(base_url=base_url, api_key=api_key)
+    return _built(base_url, timeout, organization, credential)
 
 
 def _built(
     base_url: str,
     timeout: float | None,
     organization: str | None,
-    *,
-    api_key: str | None = None,
-    access_token: str | None = None,
+    credential: str | None = None,
 ) -> Albus:
     headers = {ORGANIZATION_HEADER: organization} if organization else {}
     return Albus(
-        api_key=api_key,
-        access_token=access_token,
+        api_key=credential,
         server_url=base_url,
         client=httpx.Client(
             follow_redirects=True, timeout=timeout, headers=headers

{albus_cli-0.7.0 → albus_cli-0.8.0}/src/albus_cli/commands/auth.py

@@ -45,8 +45,8 @@ def login(ctx: typer.Context, no_browser: NoBrowser = False) -> None:
     )
     # A browser session authenticates a user, so `/whoami` names one;
     # an account it did not name is not one to claim under "Signed in".
-    user = signed_in.auth.whoami().user
-    output.done(_signed_in(user))
+    caller = signed_in.auth.whoami()
+    output.done(_signed_in(caller.user))
     output.field("API", api)
     output.field("Credential", output.abbreviated(credentials.path()))
     if session.refresh_token is None:
@@ -55,6 +55,8 @@ def login(ctx: typer.Context, no_browser: NoBrowser = False) -> None:
             "access token expires: enable Allow Offline Access on the API."
         )
 
+    output.emit(caller)
+
     _also(client.shadows_session())
     _next_steps()
 

{albus_cli-0.7.0 → albus_cli-0.8.0}/src/albus_cli/commands/organization.py

@@ -5,7 +5,8 @@ from typing import Annotated, Literal
 
 import typer
 
-from albus_cli.context import sdk
+from albus_cli import client, credentials
+from albus_cli.context import base_url, sdk, timeout
 from albus_cli.output import emit
 
 app = typer.Typer(
@@ -25,6 +26,36 @@ def get(ctx: typer.Context) -> None:
     emit(sdk(ctx).organization.get_organization())
 
 
+@app.command("use")
+def use(
+    ctx: typer.Context,
+    organization_id: Annotated[
+        str, typer.Argument(metavar="ORGANIZATION_ID", help="Organization ID.")
+    ],
+) -> None:
+    """Persist the organization the browser session acts in."""
+    if not organization_id:
+        raise typer.BadParameter("ORGANIZATION_ID must not be empty.")
+
+    _select(ctx, organization_id)
+
+
+@app.command("default")
+def default(ctx: typer.Context) -> None:
+    """Use the earliest-joined organization by default."""
+    _select(ctx, None)
+
+
+def _select(ctx: typer.Context, organization_id: str | None) -> None:
+    """Prove the membership with `/whoami`, then save it against the
+    session that proved it."""
+    api = base_url(ctx)
+    selected = client.selection(api, timeout(ctx), organization_id)
+    caller = selected.api.auth.whoami()
+    credentials.set_organization(api, organization_id, selected.session)
+    emit(caller)
+
+
 @app.command("rename")
 def rename(
     ctx: typer.Context,

{albus_cli-0.7.0 → albus_cli-0.8.0}/src/albus_cli/credentials.py

@@ -9,6 +9,7 @@ and a half-written file would look like a broken login.
 import fcntl
 import json
 import os
+import secrets
 import tempfile
 from collections.abc import Callable, Iterator
 from contextlib import contextmanager
@@ -22,6 +23,10 @@ FILE_NAME = "credentials.json"
 VERSION = 1
 FILE_MODE = 0o600
 DIRECTORY_MODE = 0o700
+ORGANIZATION_ID = "organization_id"
+# Names one sign-in. Renewal rotates the tokens but keeps this, so it
+# is what tells a refreshed session from a replaced one.
+SESSION_ID = "session_id"
 
 
 class CorruptFile(Exception):
@@ -31,6 +36,17 @@ class CorruptFile(Exception):
         super().__init__(f"{file} is not a credentials file: {reason}")
 
 
+class SessionReplaced(Exception):
+    """The stored session changed under a command that had validated it:
+    a concurrent `login` or `logout` for the same API."""
+
+    def __init__(self, base_url: str) -> None:
+        super().__init__(
+            f"the session for {base_url} changed while this command ran. "
+            "Run it again."
+        )
+
+
 @dataclass(frozen=True)
 class Credential:
     access_token: str
@@ -40,36 +56,102 @@ class Credential:
     expires_at: float
 
 
+@dataclass(frozen=True)
+class Session:
+    """A stored browser session: the credential and the organization it
+    acts in, read from one version of the entry. Read separately, a
+    concurrent sign-in could pair one account's token with another's
+    organization."""
+
+    credential: Credential
+    organization: str | None
+    # None for an entry written before sign-ins were named.
+    identity: str | None
+
+
 def path() -> Path:
     """The credentials file the CLI reads first and always writes."""
     return _directory() / FILE_NAME
 
 
 def load(base_url: str) -> Credential | None:
-    """The stored credential for base_url, or None if there is none.
+    """The stored credential for base_url, or None if there is none."""
+    stored = session(base_url)
+    return stored.credential if stored else None
+
+
+def session(base_url: str) -> Session | None:
+    """The stored session for base_url, or None if there is none.
 
     A file or entry this version cannot read counts as "none": the
     caller then tells the user to sign in, which is the fix either way.
     Readers take no lock because every write lands by rename.
     """
-    primary = path()
-    file = primary if primary.exists() else _legacy_path()
     try:
-        entries = _entries(file)
+        entry = _stored_entries().get(_key(base_url))
     except (OSError, CorruptFile):
         return None
 
-    return _credential(entries.get(_key(base_url)))
+    credential = _credential(entry)
+    if credential is None:
+        return None
+
+    return Session(credential, _selected_organization(entry), _identity(entry))
 
 
 def save(base_url: str, credential: Credential) -> None:
-    _replace_entry(base_url, asdict(credential))
+    """Store a fresh sign-in, under a name no earlier sign-in had."""
+    _replace_entry(
+        base_url, {**asdict(credential), SESSION_ID: secrets.token_hex(16)}
+    )
 
 
 def delete(base_url: str) -> None:
     _replace_entry(base_url, None)
 
 
+def organization(base_url: str) -> str | None:
+    """The browser session's saved organization, if it still has one."""
+    stored = session(base_url)
+    return stored.organization if stored else None
+
+
+def set_organization(
+    base_url: str, organization_id: str | None, validated: Session
+) -> None:
+    """Remember or clear the selected organization for one browser session.
+
+    `validated` is the session the caller proved the membership with; the
+    write goes through only while the entry is still that sign-in, so
+    one that landed in between does not inherit another account's
+    organization. A renewal in between is the same sign-in and does not
+    stand in the way. A session still living in the legacy file is carried
+    into the primary one with its neighbours, since that is the only
+    file this version writes.
+    """
+    target = path()
+    directory = target.parent
+    directory.mkdir(parents=True, exist_ok=True, mode=DIRECTORY_MODE)
+    directory.chmod(DIRECTORY_MODE)
+
+    with _lock(directory):
+        entries = _stored_entries()
+        fields = _mapping(entries.get(_key(base_url)))
+        if fields is None or _credential(fields) is None:
+            raise SessionReplaced(base_url)
+
+        if _identity(fields) != validated.identity:
+            raise SessionReplaced(base_url)
+
+        if organization_id is None:
+            fields.pop(ORGANIZATION_ID, None)
+        else:
+            fields[ORGANIZATION_ID] = organization_id
+
+        entries[_key(base_url)] = fields
+        _write(target, {"version": VERSION, "credentials": entries})
+
+
 def renew(
     base_url: str, mint: Callable[[Credential], Credential]
 ) -> Credential | None:
@@ -102,7 +184,16 @@ def renew(
         if minted == current:
             return current
 
-        entries[_key(base_url)] = asdict(minted)
+        entry = asdict(minted)
+        stored = entries.get(_key(base_url))
+        for name, kept in (
+            (ORGANIZATION_ID, _selected_organization(stored)),
+            (SESSION_ID, _identity(stored)),
+        ):
+            if kept is not None:
+                entry[name] = kept
+
+        entries[_key(base_url)] = entry
         _write(target, {"version": VERSION, "credentials": entries})
         return minted
 
@@ -124,6 +215,13 @@ def _legacy_path() -> Path:
     return Path.home() / ".albus" / FILE_NAME
 
 
+def _stored_entries() -> dict[str, object]:
+    """The entries of the file a reader sees: the primary one, or the
+    legacy one while the primary has never been written."""
+    primary = path()
+    return _entries(primary if primary.exists() else _legacy_path())
+
+
 def _key(base_url: str) -> str:
     return base_url.rstrip("/")
 
@@ -238,6 +336,23 @@ def _credential(entry: object) -> Credential | None:
     return Credential(access_token, refresh_token, float(expires_at))
 
 
+def _selected_organization(entry: object) -> str | None:
+    return _text(entry, ORGANIZATION_ID)
+
+
+def _identity(entry: object) -> str | None:
+    return _text(entry, SESSION_ID)
+
+
+def _text(entry: object, name: str) -> str | None:
+    fields = _mapping(entry)
+    if fields is None:
+        return None
+
+    value = fields.get(name)
+    return value if isinstance(value, str) else None
+
+
 def _mapping(value: object) -> dict[str, object] | None:
     if not isinstance(value, dict):
         return None

{albus_cli-0.7.0 → albus_cli-0.8.0}/src/albus_cli/main.py

@@ -119,7 +119,11 @@ def health(ctx: typer.Context) -> None:
 def main() -> None:
     try:
         app()
-    except (NotSignedIn, oauth.LoginError) as unauthenticated:
+    except (
+        NotSignedIn,
+        oauth.LoginError,
+        credentials.SessionReplaced,
+    ) as unauthenticated:
         fail(str(unauthenticated))
     except credentials.CorruptFile as corrupt:
         fail(f"{corrupt}. Delete or repair it, then run `albus login`.")

{albus_cli-0.7.0 → albus_cli-0.8.0}/tests/test_auth.py

@@ -75,7 +75,6 @@ def test_api_key_wins_over_a_stored_session(
 
     assert result.exit_code == 0, result.output
     assert albus.init_kwargs[0]["api_key"] == "env-key"
-    assert albus.init_kwargs[0]["access_token"] is None
 
 
 def test_stored_session_authenticates_with_a_bearer_token(
@@ -86,8 +85,7 @@ def test_stored_session_authenticates_with_a_bearer_token(
     result = runner.invoke(app, ["sessions", "list"])
 
     assert result.exit_code == 0, result.output
-    assert signed_out.init_kwargs[0]["access_token"] == "stored-access"
-    assert signed_out.init_kwargs[0]["api_key"] is None
+    assert signed_out.init_kwargs[0]["api_key"] == "stored-access"
 
 
 def test_expired_session_is_refreshed_and_stored(
@@ -111,7 +109,7 @@ def test_expired_session_is_refreshed_and_stored(
 
     assert result.exit_code == 0, result.output
     assert grants == ["refresh"]
-    assert signed_out.init_kwargs[0]["access_token"] == "renewed-access"
+    assert signed_out.init_kwargs[0]["api_key"] == "renewed-access"
     saved = credentials.load(BASE_URL)
     assert saved is not None
     assert saved.access_token == "renewed-access"
@@ -157,7 +155,7 @@ def test_a_session_expiring_within_the_leeway_is_refreshed(
     )
 
     assert runner.invoke(app, ["sessions", "list"]).exit_code == 0
-    assert signed_out.init_kwargs[0]["access_token"] == "renewed-access"
+    assert signed_out.init_kwargs[0]["api_key"] == "renewed-access"
 
 
 def test_rejected_refresh_reports_an_expired_session(
@@ -206,7 +204,7 @@ def test_no_credential_names_both_ways_to_get_one(
     assert "ALBUS_API_KEY" in reported
 
 
-def test_login_stores_the_session_and_names_the_account(
+def test_login_stores_the_session_and_prints_whoami(
     signed_out: FakeAlbus, monkeypatch: pytest.MonkeyPatch, config_dir: Path
 ) -> None:
     announced: list[str] = []
@@ -230,6 +228,8 @@ def test_login_stores_the_session_and_names_the_account(
     assert announced == ["cli"]
     assert "https://albus.us.auth0.com/authorize" in result.output
     assert "Signed in as carlo@albus.sh in Albus" in result.output
+    assert '"active_organization"' in result.output
+    assert '"organizations"' in result.output
     assert "https://albus.sh/api" in result.output
     assert str(config_dir / "credentials.json") in result.output
     saved = credentials.load(BASE_URL)
@@ -239,7 +239,7 @@ def test_login_stores_the_session_and_names_the_account(
     # The account is resolved over the API with the new credential,
     # never by reading the token.
     assert signed_out.calls[-1].name == "whoami"
-    assert signed_out.init_kwargs[-1]["access_token"] == "fresh-access"
+    assert signed_out.init_kwargs[-1]["api_key"] == "fresh-access"
 
 
 def signs_in(
@@ -270,7 +270,7 @@ def test_login_names_the_account_it_just_signed_in_as(
 
     assert result.exit_code == 0, result.output
     assert "as carlo@albus.sh" in result.output
-    assert albus.init_kwargs[-1]["access_token"] == "fresh-access"
+    assert albus.init_kwargs[-1]["api_key"] == "fresh-access"
 
 
 def test_login_says_an_api_key_shadows_the_new_session(
@@ -441,7 +441,6 @@ def test_whoami_names_the_caller_the_next_command_sends(
 
     assert runner.invoke(app, ["whoami"]).exit_code == 0
     assert albus.init_kwargs[0]["api_key"] == "env-key"
-    assert albus.init_kwargs[0]["access_token"] is None
 
 
 def test_whoami_works_with_only_an_api_key(

{albus_cli-0.7.0 → albus_cli-0.8.0}/tests/test_billing.py

@@ -72,8 +72,7 @@ def test_checkout_uses_the_session_over_an_api_key(
         "success_url": "https://example.com/ok",
         "cancel_url": "https://example.com/back",
     }
-    assert albus.init_kwargs[0]["access_token"] == "stored-access"
-    assert albus.init_kwargs[0]["api_key"] is None
+    assert albus.init_kwargs[0]["api_key"] == "stored-access"
     assert json.loads(result.stdout)["url"].startswith("https://")
 
 

{albus_cli-0.7.0 → albus_cli-0.8.0}/tests/test_cli.py

@@ -6,7 +6,8 @@ import pytest
 from albus_sdk import errors, models
 from typer.testing import CliRunner
 
-from albus_cli import client
+from albus_cli import client, credentials
+from albus_cli.credentials import Credential
 from albus_cli.main import app, main
 from tests.conftest import FakeAlbus
 
@@ -234,6 +235,30 @@ def test_without_an_org_the_server_picks_the_organization(
     assert sent_organization(albus) is None
 
 
+def test_saved_org_selects_the_organization_for_a_browser_session(
+    albus: FakeAlbus, monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    monkeypatch.setenv(credentials.CONFIG_DIR_ENV, str(tmp_path / "config"))
+    monkeypatch.delenv(credentials.XDG_CONFIG_HOME_ENV, raising=False)
+    monkeypatch.setenv("HOME", str(tmp_path / "home"))
+    monkeypatch.delenv(client.API_KEY_ENV, raising=False)
+    credentials.save(
+        "https://api.albus.sh",
+        Credential("access", "refresh", 1_800_000_000),
+    )
+    stored = credentials.session("https://api.albus.sh")
+    assert stored is not None
+    credentials.set_organization("https://api.albus.sh", "o2", stored)
+
+    result = runner.invoke(
+        app,
+        ["--base-url", "https://api.albus.sh", "sessions", "list"],
+    )
+
+    assert result.exit_code == 0, result.output
+    assert sent_organization(albus) == "o2"
+
+
 def test_secret_value_read_from_stdin(albus: FakeAlbus) -> None:
     result = runner.invoke(
         app, ["secrets", "create", "gemini-key"], input="s3cret\n"

{albus_cli-0.7.0 → albus_cli-0.8.0}/tests/test_credentials.py

@@ -31,6 +31,13 @@ def credential(access_token: str = "access") -> Credential:
     )
 
 
+def stored() -> credentials.Session:
+    """The session as a command reads it before acting on it."""
+    session = credentials.session(BASE_URL)
+    assert session is not None
+    return session
+
+
 def test_saved_credential_round_trips() -> None:
     credentials.save(BASE_URL, credential())
 
@@ -101,7 +108,9 @@ def test_a_trailing_slash_is_the_same_entry() -> None:
     credentials.save(f"{BASE_URL}/", credential())
 
     assert credentials.load(BASE_URL) == credential()
-    assert entries() == {BASE_URL: entry("access")}
+    assert entries() == {
+        BASE_URL: {**entry("access"), "session_id": stored().identity}
+    }
 
 
 def test_two_base_urls_do_not_collide() -> None:
@@ -126,6 +135,114 @@ def test_delete_keeps_the_other_entries() -> None:
     assert credentials.load(other) is not None
 
 
+def test_saved_organization_round_trips_with_a_credential() -> None:
+    credentials.save(BASE_URL, credential())
+
+    credentials.set_organization(BASE_URL, "42", stored())
+
+    assert credentials.organization(BASE_URL) == "42"
+    assert credentials.load(BASE_URL) == credential()
+
+
+def test_saving_a_fresh_login_clears_the_saved_organization() -> None:
+    credentials.save(BASE_URL, credential())
+    credentials.set_organization(BASE_URL, "42", stored())
+
+    credentials.save(BASE_URL, credential("new-login"))
+
+    assert credentials.organization(BASE_URL) is None
+
+
+def test_session_reads_credential_and_organization_together() -> None:
+    credentials.save(BASE_URL, credential())
+    credentials.set_organization(BASE_URL, "42", stored())
+
+    assert credentials.session(BASE_URL) == credentials.Session(
+        credential(), "42", stored().identity
+    )
+
+
+def test_legacy_session_can_select_an_organization(tmp_path: Path) -> None:
+    legacy = tmp_path / "home/.albus/credentials.json"
+    other = "https://other.example/api"
+    write_document(
+        legacy,
+        {
+            "version": 1,
+            "credentials": {BASE_URL: entry("legacy"), other: entry("kept")},
+        },
+    )
+
+    credentials.set_organization(BASE_URL, "42", stored())
+
+    assert credentials.organization(BASE_URL) == "42"
+    assert credentials.load(BASE_URL) == credential("legacy")
+    assert credentials.load(other) == credential("kept")
+    assert json.loads(legacy.read_text())["credentials"][BASE_URL] == entry(
+        "legacy"
+    )
+
+
+def test_set_organization_refuses_a_session_it_did_not_validate() -> None:
+    """The entry a concurrent `login` wrote is another account's; a
+    `logout` leaves none. Neither takes the organization."""
+    credentials.save(BASE_URL, credential())
+    validated = stored()
+
+    credentials.save(BASE_URL, credential())
+
+    with pytest.raises(credentials.SessionReplaced):
+        credentials.set_organization(BASE_URL, "42", validated)
+
+    credentials.delete(BASE_URL)
+
+    with pytest.raises(credentials.SessionReplaced):
+        credentials.set_organization(BASE_URL, "42", validated)
+
+    assert credentials.organization(BASE_URL) is None
+
+
+def test_set_organization_accepts_a_session_renewed_meanwhile() -> None:
+    """Renewal rotates every token but is the same sign-in, and must
+    not read as a replacement."""
+    credentials.save(BASE_URL, credential())
+    validated = stored()
+
+    credentials.renew(BASE_URL, lambda current: credential("renewed"))
+    credentials.set_organization(BASE_URL, "42", validated)
+
+    assert credentials.session(BASE_URL) == credentials.Session(
+        credential("renewed"), "42", validated.identity
+    )
+
+
+def test_login_over_an_unnamed_session_is_a_replacement(
+    tmp_path: Path,
+) -> None:
+    """An entry from before sign-ins were named has no identity; the
+    login that replaces it has one, so it is told apart all the same."""
+    write_document(
+        tmp_path / "home/.albus/credentials.json",
+        {"version": 1, "credentials": {BASE_URL: entry("legacy")}},
+    )
+    validated = stored()
+    assert validated.identity is None
+
+    credentials.save(BASE_URL, credential())
+
+    with pytest.raises(credentials.SessionReplaced):
+        credentials.set_organization(BASE_URL, "42", validated)
+
+
+def test_refresh_keeps_the_saved_organization() -> None:
+    credentials.save(BASE_URL, credential())
+    credentials.set_organization(BASE_URL, "42", stored())
+
+    credentials.renew(BASE_URL, lambda current: credential("renewed"))
+
+    assert credentials.organization(BASE_URL) == "42"
+
+
 def test_delete_without_a_file_writes_nothing() -> None:
     """Signing out must not be what creates the credentials file."""
     credentials.delete(BASE_URL)

{albus_cli-0.7.0 → albus_cli-0.8.0}/tests/test_health.py

@@ -25,7 +25,6 @@ def test_health_needs_no_credential(
 
     assert result.exit_code == 0, result.output
     assert json.loads(result.stdout) == {"status": "ok"}
-    assert albus.init_kwargs[0]["access_token"] is None
     assert albus.init_kwargs[0]["api_key"] is None
 
 

{albus_cli-0.7.0 → albus_cli-0.8.0}/tests/test_invites.py

@@ -76,8 +76,7 @@ def test_the_session_is_used_over_an_api_key(
     result = runner.invoke(app, ["invites", "create", "new@example.com"])
 
     assert result.exit_code == 0, result.output
-    assert signed_in.init_kwargs[0]["access_token"] == "stored-access"
-    assert signed_in.init_kwargs[0]["api_key"] is None
+    assert signed_in.init_kwargs[0]["api_key"] == "stored-access"
 
 
 def test_list(signed_in: FakeAlbus) -> None:
@@ -86,7 +85,7 @@ def test_list(signed_in: FakeAlbus) -> None:
     assert result.exit_code == 0, result.output
     assert signed_in.calls[0].name == "list_invites"
     assert json.loads(result.stdout)["invites"][0]["id"] == "i1"
-    assert signed_in.init_kwargs[0]["api_key"] is None
+    assert signed_in.init_kwargs[0]["api_key"] == "stored-access"
 
 
 def test_revoke_prints_nothing(signed_in: FakeAlbus) -> None:

albus_cli-0.8.0/tests/test_organization.py

@@ -0,0 +1,165 @@
+"""`albus organization` maps one command to each `/organization` operation
+and accepts either credential, since the API does."""
+
+import json
+from pathlib import Path
+
+import pytest
+from typer.testing import CliRunner
+
+from albus_cli import client, credentials
+from albus_cli.credentials import Credential
+from albus_cli.main import app
+from tests.conftest import FakeAlbus
+from tests.test_cli import sent_organization
+
+runner = CliRunner()
+
+BASE_URL = "https://albus.sh/api"
+SESSION = Credential("access", "refresh", 1_800_000_000)
+
+
+@pytest.fixture(autouse=True)
+def config_dir(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> Path:
+    """Point the store at tmp_path so the real ~/.config is untouched."""
+    directory = tmp_path / "config"
+    monkeypatch.setenv(credentials.CONFIG_DIR_ENV, str(directory))
+    monkeypatch.delenv(credentials.XDG_CONFIG_HOME_ENV, raising=False)
+    monkeypatch.setenv("HOME", str(tmp_path / "home"))
+    return directory
+
+
+@pytest.fixture
+def signed_in(albus: FakeAlbus, monkeypatch: pytest.MonkeyPatch) -> FakeAlbus:
+    """The SDK fake behind a stored browser session, with no API key:
+    `use` and `default` act on the session alone."""
+    monkeypatch.delenv(client.API_KEY_ENV, raising=False)
+    credentials.save(BASE_URL, SESSION)
+    return albus
+
+
+def stored() -> credentials.Session:
+    session = credentials.session(BASE_URL)
+    assert session is not None
+    return session
+
+
+def test_get(albus: FakeAlbus) -> None:
+    result = runner.invoke(app, ["organization", "get"])
+
+    assert result.exit_code == 0, result.output
+    assert albus.calls[0].name == "get_organization"
+
+
+def test_use_persists_a_membership(signed_in: FakeAlbus) -> None:
+    result = runner.invoke(app, ["organization", "use", "o2"])
+
+    assert result.exit_code == 0, result.output
+    assert signed_in.calls[0].name == "whoami"
+    assert sent_organization(signed_in) == "o2"
+    assert credentials.organization(BASE_URL) == "o2"
+
+
+def test_use_needs_a_browser_session(albus: FakeAlbus) -> None:
+    result = runner.invoke(app, ["organization", "use", "o2"])
+
+    assert result.exit_code != 0
+    assert albus.calls == []
+    assert credentials.organization(BASE_URL) is None
+
+
+def test_use_rejects_an_empty_id(signed_in: FakeAlbus) -> None:
+    credentials.set_organization(BASE_URL, "o2", stored())
+
+    result = runner.invoke(app, ["organization", "use", ""])
+
+    assert result.exit_code != 0
+    assert signed_in.calls == []
+    assert credentials.organization(BASE_URL) == "o2"
+
+
+def test_use_refuses_to_save_onto_a_session_that_replaced_the_one_it_checked(
+    signed_in: FakeAlbus, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    """A `login` landing between `/whoami` and the write is another
+    account, whose session must not inherit this one's organization."""
+    whoami = signed_in.auth.whoami
+
+    def logged_in_meanwhile(**kwargs: object) -> object:
+        credentials.save(BASE_URL, Credential("other", None, 1_800_000_000))
+        return whoami(**kwargs)
+
+    monkeypatch.setattr(signed_in.auth, "whoami", logged_in_meanwhile)
+
+    result = runner.invoke(app, ["organization", "use", "o2"])
+
+    assert isinstance(result.exception, credentials.SessionReplaced)
+    assert credentials.organization(BASE_URL) is None
+
+
+def test_default_clears_the_saved_membership(signed_in: FakeAlbus) -> None:
+    credentials.set_organization(BASE_URL, "o2", stored())
+
+    result = runner.invoke(app, ["organization", "default"])
+
+    assert result.exit_code == 0, result.output
+    assert sent_organization(signed_in) is None
+    assert credentials.organization(BASE_URL) is None
+    active = json.loads(result.stdout)["user"]["active_organization"]
+    assert active["name"] == "Albus"
+
+
+def test_default_keeps_the_saved_membership_when_the_request_fails(
+    signed_in: FakeAlbus, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    credentials.set_organization(BASE_URL, "o2", stored())
+
+    def refused(**kwargs: object) -> None:
+        raise ConnectionError("refused")
+
+    monkeypatch.setattr(signed_in.auth, "whoami", refused)
+
+    result = runner.invoke(app, ["organization", "default"])
+
+    assert result.exit_code != 0
+    assert credentials.organization(BASE_URL) == "o2"
+
+
+def test_rename(albus: FakeAlbus) -> None:
+    result = runner.invoke(app, ["organization", "rename", "Albus Labs"])
+
+    assert result.exit_code == 0, result.output
+    assert albus.calls[0].name == "update_organization"
+    assert albus.calls[0].kwargs == {"name": "Albus Labs"}
+
+
+def test_members(albus: FakeAlbus) -> None:
+    result = runner.invoke(app, ["organization", "members"])
+
+    assert result.exit_code == 0, result.output
+    assert albus.calls[0].name == "list_organization_members"
+    assert json.loads(result.stdout)["members"][0]["user_id"] == "u1"
+
+
+def test_set_role(albus: FakeAlbus) -> None:
+    result = runner.invoke(app, ["organization", "set-role", "u1", "member"])
+
+    assert result.exit_code == 0, result.output
+    assert albus.calls[0].name == "set_organization_member_role"
+    assert albus.calls[0].kwargs == {"user_id": "u1", "role": "member"}
+
+
+def test_set_role_rejects_an_unknown_role(albus: FakeAlbus) -> None:
+    result = runner.invoke(app, ["organization", "set-role", "u1", "owner"])
+
+    assert result.exit_code != 0
+    assert albus.calls == []
+
+
+def test_remove_member_prints_nothing(albus: FakeAlbus) -> None:
+    result = runner.invoke(app, ["organization", "remove-member", "u1"])
+
+    assert result.exit_code == 0, result.output
+    assert albus.calls[0].name == "remove_organization_member"
+    assert albus.calls[0].kwargs == {"user_id": "u1"}
+    assert result.stdout == ""

{albus_cli-0.7.0 → albus_cli-0.8.0}/tests/test_tokens.py

@@ -85,8 +85,7 @@ def test_the_session_is_used_over_an_api_key(
     monkeypatch.setenv(client.API_KEY_ENV, "env-key")
 
     assert runner.invoke(app, ["tokens", "list"]).exit_code == 0
-    assert signed_in.init_kwargs[0]["access_token"] == "stored-access"
-    assert signed_in.init_kwargs[0]["api_key"] is None
+    assert signed_in.init_kwargs[0]["api_key"] == "stored-access"
 
 
 def test_only_an_api_key_asks_for_a_sign_in(

{albus_cli-0.7.0 → albus_cli-0.8.0}/uv.lock

@@ -8,7 +8,7 @@ resolution-markers = [
 
 [[package]]
 name = "albus-cli"
-version = "0.7.0"
+version = "0.8.0"
 source = { editable = "." }
 dependencies = [
     { name = "albus-sdk" },
@@ -24,7 +24,7 @@ dev = [
 
 [package.metadata]
 requires-dist = [
-    { name = "albus-sdk", specifier = "==0.14.0" },
+    { name = "albus-sdk", specifier = "==0.16.0" },
     { name = "typer", specifier = ">=0.26.8,<0.28" },
 ]
 
@@ -37,16 +37,16 @@ dev = [
 
 [[package]]
 name = "albus-sdk"
-version = "0.14.0"
+version = "0.16.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "httpcore" },
     { name = "httpx" },
     { name = "pydantic" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/e3/ed/6833e825d1eba3cdd241f105532d3c935d26a1395922a8836fc8d18eeb9f/albus_sdk-0.14.0.tar.gz", hash = "sha256:192eeed8c07a2485f71a95e6572e80b18c200764316cc012cae1cfee08552699", size = 107954, upload-time = "2026-09-06T02:39:59.857Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/99/b1/17e68fe0ee1af1205b3133b41d68b40c60d1895fe561de4085617fd6ad56/albus_sdk-0.16.0.tar.gz", hash = "sha256:61fd36f55cbd0fa59f6dd038caeb1fe7364aa0e590c7341517ae116595b5b548", size = 89838, upload-time = "2026-09-08T02:46:29.364Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/6d/1a/59dfd146603452b1dd0f3db5e1a85e3cba6c72a08981f062d300fad32926/albus_sdk-0.14.0-py3-none-any.whl", hash = "sha256:419fa1147acef93e48fbcdeeed8f2355ac807a44638bb1679400f992d8a9ae7c", size = 173652, upload-time = "2026-09-06T02:39:58.475Z" },
+    { url = "https://files.pythonhosted.org/packages/26/0e/22e4d6437a71c3faa7caeca4bb5d7af5a491b043c46e715e30aab905ca6a/albus_sdk-0.16.0-py3-none-any.whl", hash = "sha256:8409e81c1745043ca41fc5783ec89f8c206987bb9f0e62f7bfacae7e4e8d3633", size = 146438, upload-time = "2026-09-08T02:46:28.184Z" },
 ]
 
 [[package]]

albus_cli-0.7.0/tests/test_organization.py

@@ -1,59 +0,0 @@
-"""`albus organization` maps one command to each `/organization` operation
-and accepts either credential, since the API does."""
-
-import json
-
-from typer.testing import CliRunner
-
-from albus_cli.main import app
-from tests.conftest import FakeAlbus
-
-runner = CliRunner()
-
-
-def test_get(albus: FakeAlbus) -> None:
-    result = runner.invoke(app, ["organization", "get"])
-
-    assert result.exit_code == 0, result.output
-    assert albus.calls[0].name == "get_organization"
-    assert json.loads(result.stdout)["name"] == "Albus"
-
-
-def test_rename(albus: FakeAlbus) -> None:
-    result = runner.invoke(app, ["organization", "rename", "Albus Labs"])
-
-    assert result.exit_code == 0, result.output
-    assert albus.calls[0].name == "update_organization"
-    assert albus.calls[0].kwargs == {"name": "Albus Labs"}
-
-
-def test_members(albus: FakeAlbus) -> None:
-    result = runner.invoke(app, ["organization", "members"])
-
-    assert result.exit_code == 0, result.output
-    assert albus.calls[0].name == "list_organization_members"
-    assert json.loads(result.stdout)["members"][0]["user_id"] == "u1"
-
-
-def test_set_role(albus: FakeAlbus) -> None:
-    result = runner.invoke(app, ["organization", "set-role", "u1", "member"])
-
-    assert result.exit_code == 0, result.output
-    assert albus.calls[0].name == "set_organization_member_role"
-    assert albus.calls[0].kwargs == {"user_id": "u1", "role": "member"}
-
-
-def test_set_role_rejects_an_unknown_role(albus: FakeAlbus) -> None:
-    result = runner.invoke(app, ["organization", "set-role", "u1", "owner"])
-
-    assert result.exit_code != 0
-    assert albus.calls == []
-
-
-def test_remove_member_prints_nothing(albus: FakeAlbus) -> None:
-    result = runner.invoke(app, ["organization", "remove-member", "u1"])
-
-    assert result.exit_code == 0, result.output
-    assert albus.calls[0].name == "remove_organization_member"
-    assert albus.calls[0].kwargs == {"user_id": "u1"}
-    assert result.stdout == ""