apizit-cli 0.2.0b2__tar.gz → 0.2.0b3__tar.gz

{apizit_cli-0.2.0b2 → apizit_cli-0.2.0b3}/PKG-INFO

@@ -1,7 +1,7 @@
 Metadata-Version: 2.4
 Name: apizit-cli
-Version: 0.2.0b2
-Summary: Launch Python APIs with APIZIT from your terminal or CI.
+Version: 0.2.0b3
+Summary: Launch supported Python, JavaScript, TypeScript or Java APIs from your terminal or CI.
 Author: APIZIT
 Classifier: Development Status :: 4 - Beta
 Classifier: Environment :: Console
@@ -20,6 +20,9 @@ Requires-Dist: pathspec<2,>=1
 
 Launch supported Python, JavaScript, TypeScript or Java projects as managed public APIs, inspect logs and manage releases from your terminal.
 
+Managed adapters cover Flask, FastAPI, Django, Express, NestJS and Spring Boot; APIZIT Linking
+provides declarative Python routes. Run a scan to confirm the project's version and structure.
+
 APIZIT is an advanced beta. This source version defaults to `https://api.apizit.com/v1`.
 Version `0.2.0b1` uses its original dev default; use `--endpoint` explicitly with that version.
 Check the official CLI documentation for package availability and current workspace capabilities.

{apizit_cli-0.2.0b2 → apizit_cli-0.2.0b3}/README.md

@@ -2,6 +2,9 @@
 
 Launch supported Python, JavaScript, TypeScript or Java projects as managed public APIs, inspect logs and manage releases from your terminal.
 
+Managed adapters cover Flask, FastAPI, Django, Express, NestJS and Spring Boot; APIZIT Linking
+provides declarative Python routes. Run a scan to confirm the project's version and structure.
+
 APIZIT is an advanced beta. This source version defaults to `https://api.apizit.com/v1`.
 Version `0.2.0b1` uses its original dev default; use `--endpoint` explicitly with that version.
 Check the official CLI documentation for package availability and current workspace capabilities.

{apizit_cli-0.2.0b2 → apizit_cli-0.2.0b3}/pyproject.toml

@@ -4,8 +4,8 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "apizit-cli"
-version = "0.2.0b2"
-description = "Launch Python APIs with APIZIT from your terminal or CI."
+version = "0.2.0b3"
+description = "Launch supported Python, JavaScript, TypeScript or Java APIs from your terminal or CI."
 readme = "README.md"
 requires-python = ">=3.12"
 authors = [{name = "APIZIT"}]

{apizit_cli-0.2.0b2 → apizit_cli-0.2.0b3}/src/apizit_cli/__init__.py

@@ -1,3 +1,3 @@
 """The APIZIT HTTP client. Importing this package never initializes a session."""
 
-__version__ = "0.2.0b2"
+__version__ = "0.2.0b3"

{apizit_cli-0.2.0b2 → apizit_cli-0.2.0b3}/src/apizit_cli/authentication.py

@@ -255,6 +255,8 @@ class NativeSession:
         )
         callback = urlsplit(configuration["redirect_uri"])
         outcome = {}
+        page_loaded = False
+        cleanup_nonce = secrets.token_urlsafe(24)
         deadline = time.monotonic() + timeout
 
         class Callback(BaseHTTPRequestHandler):
@@ -264,12 +266,22 @@ class NativeSession:
 
             def do_GET(self):
                 parsed = urlsplit(self.path)
+                if (
+                    parsed.path == "/complete"
+                    and not parsed.query
+                    and not parsed.scheme
+                    and not parsed.netloc
+                    and self.headers.get("Host") == callback.netloc
+                ):
+                    self._page("Return to the APIZIT terminal.", status=200)
+                    return
                 try:
                     query = parse_qs(parsed.query, max_num_fields=8, strict_parsing=True)
                 except ValueError:
                     query = {}
                 valid = (
                     parsed.path == callback.path
+                    and not outcome
                     and not parsed.scheme
                     and not parsed.netloc
                     and self.headers.get("Host") == callback.netloc
@@ -281,18 +293,59 @@ class NativeSession:
                         or (len(query.get("error", [])) == 1 and 0 < len(query["error"][0]) <= 256)
                     )
                 )
-                if valid and len(query.get("code", [])) == 1 and 0 < len(query["code"][0]) <= 4096:
-                    outcome["code"] = query["code"][0]
-                elif valid and "error" in query:
-                    outcome["error"] = True
-                self.send_response(200 if valid else 400)
-                self.send_header("Content-Type", "text/plain; charset=utf-8")
+                self._page(
+                    "Return to the APIZIT terminal." if valid else "Invalid login callback.",
+                    status=200 if valid else 400,
+                )
+                # Finish sending the cleanup script before allowing the server to shut down.
+                if valid:
+                    outcome["received_at"] = time.monotonic()
+                    if "code" in query:
+                        outcome["code"] = query["code"][0]
+                    else:
+                        outcome["error"] = True
+
+            def _page(self, message, *, status):
+                body = (
+                    '<!doctype html><html lang="en"><head><meta charset="utf-8">'
+                    "<title>APIZIT sign-in</title>"
+                    f'<script nonce="{cleanup_nonce}">'
+                    'history.replaceState(null,"","/complete");'
+                    'fetch("/complete",{method:"POST",credentials:"omit",cache:"no-store",'
+                    f'headers:{{"X-APIZIT-Page":"{cleanup_nonce}"}}}}).catch(()=>{{}});'
+                    "</script></head><body><main><h1>APIZIT sign-in</h1>"
+                    f"<p>{message}</p></main></body></html>"
+                ).encode("utf-8")
+                self.send_response(status)
+                self.send_header("Content-Type", "text/html; charset=utf-8")
+                self.send_header("Content-Length", str(len(body)))
                 self.send_header("Cache-Control", "no-store")
-                self.send_header("Content-Security-Policy", "default-src 'none'")
+                self.send_header("Referrer-Policy", "no-referrer")
+                self.send_header("X-Content-Type-Options", "nosniff")
+                self.send_header(
+                    "Content-Security-Policy",
+                    f"default-src 'none'; script-src 'nonce-{cleanup_nonce}'; "
+                    "connect-src 'self'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'",
+                )
                 self.end_headers()
-                self.wfile.write(
-                    b"Return to the APIZIT terminal." if valid else b"Invalid login callback."
+                self.wfile.write(body)
+                self.wfile.flush()
+
+            def do_POST(self):
+                nonlocal page_loaded
+                valid = (
+                    self.path == "/complete"
+                    and self.headers.get("Host") == callback.netloc
+                    and hmac.compare_digest(
+                        self.headers.get("X-APIZIT-Page", "").encode(), cleanup_nonce.encode()
+                    )
                 )
+                if valid and outcome:
+                    page_loaded = True
+                self.send_response(204 if valid else 400)
+                self.send_header("Cache-Control", "no-store")
+                self.send_header("Content-Length", "0")
+                self.end_headers()
 
             def log_message(self, *_args):
                 pass
@@ -327,6 +380,12 @@ class NativeSession:
             server.timeout = 1
             while not outcome and time.monotonic() < deadline:
                 server.handle_request()
+            # The browser acknowledges after replacing its current history entry. A bounded
+            # grace period also accommodates clients without JavaScript without blocking login.
+            cleanup_deadline = min(deadline, outcome.get("received_at", deadline) + 2)
+            while outcome and not page_loaded and time.monotonic() < cleanup_deadline:
+                server.timeout = min(0.2, max(0, cleanup_deadline - time.monotonic()))
+                server.handle_request()
         finally:
             server.server_close()
         if "code" not in outcome:

{apizit_cli-0.2.0b2 → apizit_cli-0.2.0b3}/src/apizit_cli/main.py

@@ -51,7 +51,15 @@ def build_parser():
     add_options(common, GLOBAL_OPTIONS, global_options=True)
     parser = Parser(
         prog="apizit",
-        description="Launch Python as a managed public API. APIZIT development beta.",
+        description=(
+            "Launch supported Python, JavaScript, TypeScript or Java projects as managed public "
+            "APIs. Framework support follows the APIZIT compatibility guide. APIZIT prelaunch beta."
+        ),
+        epilog=(
+            "Managed frameworks: Flask, FastAPI, Django, Express, NestJS and Spring Boot. "
+            "APIZIT Linking supports declarative Python routes. Run a scan to confirm that your "
+            "project's version and structure are compatible."
+        ),
         parents=[common],
         allow_abbrev=False,
     )

{apizit_cli-0.2.0b2 → apizit_cli-0.2.0b3}/src/apizit_cli.egg-info/PKG-INFO

@@ -1,7 +1,7 @@
 Metadata-Version: 2.4
 Name: apizit-cli
-Version: 0.2.0b2
-Summary: Launch Python APIs with APIZIT from your terminal or CI.
+Version: 0.2.0b3
+Summary: Launch supported Python, JavaScript, TypeScript or Java APIs from your terminal or CI.
 Author: APIZIT
 Classifier: Development Status :: 4 - Beta
 Classifier: Environment :: Console
@@ -20,6 +20,9 @@ Requires-Dist: pathspec<2,>=1
 
 Launch supported Python, JavaScript, TypeScript or Java projects as managed public APIs, inspect logs and manage releases from your terminal.
 
+Managed adapters cover Flask, FastAPI, Django, Express, NestJS and Spring Boot; APIZIT Linking
+provides declarative Python routes. Run a scan to confirm the project's version and structure.
+
 APIZIT is an advanced beta. This source version defaults to `https://api.apizit.com/v1`.
 Version `0.2.0b1` uses its original dev default; use `--endpoint` explicitly with that version.
 Check the official CLI documentation for package availability and current workspace capabilities.