alloy-runtime-cli 0.1.0__py3-none-any.whl

cli/commands/admin/bootstrap_command.py

@@ -0,0 +1,118 @@
+"""Bootstrap admin command implementation."""
+
+import typer
+
+from cli.infrastructure.auth_storage import save_credentials
+from cli.infrastructure.command import async_command
+from cli.infrastructure.config import get_api_url
+from cli.infrastructure.console import Prompt
+from cli.infrastructure.output import print_info, print_success
+from alloy_runtime_sdk.api_client.client import ApiClient
+from alloy_runtime_types.dtos.auth import BootstrapAdminRequest
+
+
+def bootstrap_admin_command(
+    email: str | None = typer.Option(None, "--email", "-e", help="Admin email address"),
+    password: str | None = typer.Option(
+        None, "--password", "-p", help="Password (not recommended for security)"
+    ),
+    name: str | None = typer.Option(None, "--name", "-n", help="Admin display name"),
+    org_name: str = typer.Option(
+        "Platform Team",
+        "--org",
+        "-o",
+        help="Organization name for system admin",
+    ),
+    token: str | None = typer.Option(
+        None,
+        "--token",
+        "-t",
+        envvar="BOOTSTRAP_TOKEN",
+        help="Bootstrap security token (required, can use BOOTSTRAP_TOKEN env var)",
+    ),
+) -> None:
+    """Bootstrap the first system administrator.
+
+    This command creates the initial system admin user when setting up
+    a new instance. It can only be run ONCE - if any users already exist,
+    it will fail with a safety error.
+
+    Examples:
+
+        # Interactive (recommended for security)
+        ai2 admin bootstrap
+
+        # Non-interactive (for automation)
+        ai2 admin bootstrap -e admin@example.com -p SecurePass123 -n "Admin User"
+
+    Security Notes:
+        - Only works on a fresh database with no users
+        - Creates a system_admin user with full privileges
+        - Stores credentials securely with bcrypt
+    """
+    _execute_bootstrap(email, password, name, org_name, token)
+
+
+@async_command
+async def _execute_bootstrap(
+    email: str | None,
+    password: str | None,
+    name: str | None,
+    org_name: str,
+    token: str | None,
+) -> None:
+    """Execute the bootstrap operation."""
+    api_url = get_api_url()
+
+    # Prompt for required fields if not provided
+    if not email:
+        email = Prompt.ask("[cyan]Admin email address[/cyan]")
+
+    if not name:
+        name = Prompt.ask("[cyan]Admin name[/cyan]")
+
+    if not token:
+        token = Prompt.ask(
+            "[cyan]Bootstrap token[/cyan] (from server's BOOTSTRAP_TOKEN env var)",
+            password=True,
+        )
+
+    if not password:
+        while True:
+            password = Prompt.ask("[cyan]Password[/cyan] (min 8 chars)", password=True)
+            confirm = Prompt.ask("[cyan]Confirm password[/cyan]", password=True)
+
+            if password != confirm:
+                print_info("Passwords don't match. Please try again.")
+                continue
+
+            if len(password) < 8:
+                print_info("Password must be at least 8 characters.")
+                continue
+
+            break
+
+    # Create the bootstrap request
+    request = BootstrapAdminRequest(
+        email=email,
+        password=password,
+        name=name,
+        organization_name=org_name,
+        bootstrap_token=token,
+    )
+
+    # Send request to server (no API key needed - bootstrapping fresh system)
+    async with ApiClient(base_url=api_url, api_key="") as client:
+        response = await client.bootstrap_admin(request)
+
+    # Save credentials
+    save_credentials(api_url, response.api_key)
+
+    # Show success
+    print_success(f"System administrator created for {response.name}")
+    print_info(f"Email: {response.email}")
+    print_info(f"Organization ID: {response.organization_id}")
+    print_info("API key saved to ~/.alloy-runtime/config")
+    print_info("")
+    print_info("You are now logged in as the system administrator.")
+    print_info("You can now run admin commands like: [cyan]ai2 sync models[/cyan]")

cli/commands/admin/credentials/create/command.py

@@ -0,0 +1,148 @@
+"""Admin credentials create command implementation."""
+
+from decimal import Decimal
+from typing import Optional
+
+import typer
+
+from cli.commands.admin.credentials.create.presenter import (
+    present_credential_create_success,
+)
+from cli.commands.flag_utils import validate_provider
+from cli.commands.shared_flags import (
+    CREDENTIAL_VALUE,
+    DESCRIPTION,
+    NAME,
+    PROVIDER_REQUIRED,
+)
+from cli.infrastructure.command import async_command, authenticated_client
+from alloy_runtime_types.dtos.credentials import CreateSystemCredentialRequest
+
+
+def admin_credentials_create_command(
+    credential_type_id: str = typer.Option(
+        ...,
+        "--type",
+        help="Credential type (e.g., system_provider)",
+    ),
+    name: str = NAME,
+    plaintext_value: str = CREDENTIAL_VALUE,
+    provider: str = PROVIDER_REQUIRED,
+    description: Optional[str] = DESCRIPTION,
+    priority: int = typer.Option(
+        0,
+        "--priority",
+        help="Selection priority (default: 0)",
+    ),
+    is_default: bool = typer.Option(
+        False,
+        "--default",
+        help="Default credential for provider",
+    ),
+    daily_request_limit: Optional[int] = typer.Option(
+        None,
+        "--daily-limit",
+        help="Daily request limit",
+    ),
+    monthly_cost_limit_usd: Optional[str] = typer.Option(
+        None,
+        "--monthly-cost-limit",
+        help="Monthly USD limit (e.g., 50.00)",
+    ),
+    requests_per_minute_limit: Optional[int] = typer.Option(
+        None,
+        "--rate-limit",
+        help="Requests/minute limit",
+    ),
+) -> None:
+    """Create a system credential (requires system admin).
+
+    SECURITY: Use env var: --value "$OPENAI_API_KEY"
+
+    Examples:
+
+        ai admin credentials create --type system_provider -n "OpenAI" --value "sk-..." -p openai
+        ai admin credentials create --type system_provider -n "Default" --value "sk-..." -p openrouter --default
+    """
+    _execute_create(
+        credential_type_id=credential_type_id,
+        name=name,
+        plaintext_value=plaintext_value,
+        provider=provider,
+        description=description,
+        priority=priority,
+        is_default=is_default,
+        daily_request_limit=daily_request_limit,
+        monthly_cost_limit_usd=monthly_cost_limit_usd,
+        requests_per_minute_limit=requests_per_minute_limit,
+    )
+
+
+@async_command
+async def _execute_create(
+    credential_type_id: str,
+    name: str,
+    plaintext_value: str,
+    provider: str,
+    description: Optional[str],
+    priority: int,
+    is_default: bool,
+    daily_request_limit: Optional[int],
+    monthly_cost_limit_usd: Optional[str],
+    requests_per_minute_limit: Optional[int],
+) -> None:
+    """Execute the credential creation operation.
+
+    Args:
+        credential_type_id: Credential type ID
+        name: Friendly name
+        plaintext_value: API key value
+        provider: Provider key string
+        description: Optional description
+        priority: Priority for selection
+        is_default: Whether this is the default for the provider
+        daily_request_limit: Optional daily request limit
+        monthly_cost_limit_usd: Optional monthly cost limit as string
+        requests_per_minute_limit: Optional rate limit
+
+    Raises:
+        ConfigurationError: If environment variables are missing
+        AuthenticationError: If API key is invalid
+        ForbiddenError: If user is not system admin
+        ValidationError: If request data is invalid
+        ConflictError: If duplicate default credential exists
+        ServerError: If server returns 5xx error
+    """
+    # Validate and convert provider string to enum
+    provider_enum = validate_provider(provider)
+
+    # Convert monthly cost limit string to Decimal if provided
+    monthly_cost_decimal = None
+    if monthly_cost_limit_usd is not None:
+        try:
+            monthly_cost_decimal = Decimal(monthly_cost_limit_usd)
+        except Exception:
+            raise typer.BadParameter(
+                f"Invalid monthly cost limit '{monthly_cost_limit_usd}'. Must be a valid decimal number (e.g., '50.00')"
+            )
+
+    # Build request
+    request = CreateSystemCredentialRequest(
+        credential_type_id=credential_type_id,
+        name=name,
+        plaintext_value=plaintext_value,
+        provider_key=provider_enum,
+        description=description,
+        priority=priority,
+        is_default=is_default,
+        daily_request_limit=daily_request_limit,
+        monthly_cost_limit_usd=monthly_cost_decimal,
+        requests_per_minute_limit=requests_per_minute_limit,
+    )
+
+    # Execute API call with authenticated client
+    async with authenticated_client() as (_config, client):
+        response = await client.create_system_credential(request)
+
+    # Present success output
+    present_credential_create_success(response)

cli/commands/admin/credentials/create/presenter.py

@@ -0,0 +1,16 @@
+"""Presenter for admin credentials create command output."""
+
+from cli.commands.credentials.update.fields import CREDENTIAL_FIELDS
+from cli.infrastructure.output import OutputService
+from alloy_runtime_types.dtos.credentials import SystemCredentialResponse
+
+
+def present_credential_create_success(credential: SystemCredentialResponse) -> None:
+    """Present a successful credential creation with Rich formatting.
+
+    Args:
+        credential: Created credential data from server
+    """
+    output = OutputService.get()
+    output.success(f"Created system credential: {credential.name}")
+    output.entity(credential, "System Credential Details", CREDENTIAL_FIELDS)

cli/commands/admin/credentials/grant/command.py

@@ -0,0 +1,119 @@
+"""Admin credentials grant command implementation."""
+
+from datetime import datetime
+from typing import Optional
+from uuid import UUID
+
+import typer
+
+from cli.commands.admin.credentials.grant.presenter import present_grant_success
+from cli.commands.flag_utils import require_one_of, require_exclusive, validate_uuid
+from cli.infrastructure.command import async_command, authenticated_client
+from alloy_runtime_types.dtos.credentials import GrantSystemCredentialRequest
+
+
+def admin_credentials_grant_command(
+    credential_id: str = typer.Option(
+        ...,
+        "--credential",
+        help="System credential ID",
+    ),
+    user_id: Optional[str] = typer.Option(
+        None,
+        "--user",
+        help="User ID (mutually exclusive with --org)",
+    ),
+    organization_id: Optional[str] = typer.Option(
+        None,
+        "--org",
+        help="Organization ID (mutually exclusive with --user)",
+    ),
+    expires_at: Optional[str] = typer.Option(
+        None,
+        "--expires-at",
+        help="Expiration (ISO 8601)",
+    ),
+) -> None:
+    """Grant system credential access (requires system admin).
+
+    Exactly one of --user or --org required.
+
+    Examples:
+
+        ai admin credentials grant --credential <id> --org <org-id>
+        ai admin credentials grant --credential <id> --user <user-id>
+    """
+    _execute_grant(
+        credential_id=credential_id,
+        user_id=user_id,
+        organization_id=organization_id,
+        expires_at=expires_at,
+    )
+
+
+@async_command
+async def _execute_grant(
+    credential_id: str,
+    user_id: Optional[str],
+    organization_id: Optional[str],
+    expires_at: Optional[str],
+) -> None:
+    """Execute the credential grant operation.
+
+    Args:
+        credential_id: System credential ID (string UUID)
+        user_id: Optional user ID (string UUID)
+        organization_id: Optional organization ID (string UUID)
+        expires_at: Optional expiration datetime (ISO 8601 string)
+
+    Raises:
+        typer.BadParameter: If UUID or datetime format is invalid
+        typer.BadParameter: If neither or both target IDs are provided
+        ConfigurationError: If environment variables are missing
+        AuthenticationError: If API key is invalid
+        ForbiddenError: If user is not system admin
+        ValidationError: If request data is invalid (neither/both targets)
+        ConflictError: If grant already exists
+        ServerError: If server returns 5xx error
+    """
+    # Validate and convert credential_id to UUID
+    credential_uuid = validate_uuid(credential_id, "credential")
+
+    # Validate mutual exclusivity at CLI level for better UX
+    require_one_of(("--user", user_id), ("--org", organization_id))
+    require_exclusive(("--user", user_id), ("--org", organization_id))
+
+    # Convert UUIDs
+    user_uuid: Optional[UUID] = None
+    org_uuid: Optional[UUID] = None
+
+    if user_id:
+        user_uuid = validate_uuid(user_id, "user")
+
+    if organization_id:
+        org_uuid = validate_uuid(organization_id, "organization")
+
+    # Parse expires_at if provided
+    expires_datetime: Optional[datetime] = None
+    if expires_at:
+        try:
+            expires_datetime = datetime.fromisoformat(expires_at.replace("Z", "+00:00"))
+        except ValueError:
+            raise typer.BadParameter(
+                f"Invalid datetime format: '{expires_at}'. Must be ISO 8601 format (e.g., '2025-12-31T23:59:59Z')"
+            )
+
+    # Build request
+    request = GrantSystemCredentialRequest(
+        credential_id=credential_uuid,
+        user_id=user_uuid,
+        organization_id=org_uuid,
+        expires_at=expires_datetime,
+    )
+
+    # Execute API call with authenticated client
+    async with authenticated_client() as (_config, client):
+        response = await client.grant_system_credential(request)
+
+    # Present success output
+    present_grant_success(response)

cli/commands/admin/credentials/grant/fields.py

@@ -0,0 +1,33 @@
+"""Field definitions for system credential grant presentation."""
+
+from typing import Any
+
+from cli.infrastructure.formatting.fields import format_datetime, format_uuid
+from cli.infrastructure.renderers.entity_renderer import FieldConfig
+
+
+def format_optional_uuid(value: Any) -> str:
+    """Format optional UUID value."""
+    return format_uuid(value, short=False) if value else "(not set)"
+
+
+def format_optional_datetime(value: Any) -> str:
+    """Format optional datetime value."""
+    return format_datetime(value) if value else "(not set)"
+
+
+GRANT_FIELDS: list[FieldConfig] = [
+    FieldConfig("id", "Grant ID", lambda v: format_uuid(v, short=False)),
+    FieldConfig(
+        "credential_id", "Credential ID", lambda v: format_uuid(v, short=False)
+    ),
+    FieldConfig("organization_id", "Organization ID", format_optional_uuid),
+    FieldConfig("user_id", "User ID", format_optional_uuid),
+    FieldConfig(
+        "granted_by_user_id",
+        "Granted By User ID",
+        lambda v: format_uuid(v, short=False),
+    ),
+    FieldConfig("granted_at", "Granted At", format_datetime),
+    FieldConfig("expires_at", "Expires At", format_optional_datetime),
+]

cli/commands/admin/credentials/grant/presenter.py

@@ -0,0 +1,23 @@
+"""Presenter for admin credentials grant command output."""
+
+from cli.commands.admin.credentials.grant.fields import GRANT_FIELDS
+from cli.infrastructure.output import OutputService
+from alloy_runtime_types.dtos.credentials import GrantSystemCredentialResponse
+
+
+def present_grant_success(grant: GrantSystemCredentialResponse) -> None:
+    """Present a successful credential grant with Rich formatting.
+
+    Args:
+        grant: Created grant data from server
+    """
+    output = OutputService.get()
+
+    # Determine target type for success message
+    if grant.organization_id:
+        target = f"organization {grant.organization_id}"
+    else:
+        target = f"user {grant.user_id}"
+
+    output.success(f"Granted system credential access to {target}")
+    output.entity(grant, "System Credential Grant Details", GRANT_FIELDS)