arcsecond 4.3.1__tar.gz → 4.3.3__tar.gz

{arcsecond-4.3.1 → arcsecond-4.3.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: arcsecond
-Version: 4.3.1
+Version: 4.3.3
 Summary: CLI for arcsecond.io
 Project-URL: Homepage, https://github.com/arcsecond-io/cli
 Project-URL: Issues, https://github.com/arcsecond-io/cli/issues

{arcsecond-4.3.1 → arcsecond-4.3.3}/arcsecond/api/endpoint.py

@@ -8,7 +8,16 @@ from arcsecond.api.constants import API_AUTH_PATH_VERIFY, API_AUTH_PATH_VERIFY_P
 from arcsecond.errors import ArcsecondError
 
 SAFE_METHODS = ["GET", "OPTIONS"]
-WRITABLE_MEMBERSHIPS = ["superadmin", "admin", "member"]
+
+# The portal roles allowed to write. Both "owner" and "superadmin" are listed
+# because they are the same role: the backend renamed "superadmin" to "owner",
+# and this tool talks to installations on either side of that update.
+# Observatories update the tool independently of their installation, so a
+# freshly updated tool can still be pointed at an installation that has not
+# been updated yet and answers "superadmin".
+#
+# "superadmin" can go once no supported installation predates the rename.
+WRITABLE_MEMBERSHIPS = ["owner", "superadmin", "admin", "member"]
 
 
 class ArcsecondAPIEndpoint(object):

{arcsecond-4.3.1 → arcsecond-4.3.3}/arcsecond/api/resources.py

@@ -11,6 +11,7 @@ class ArcsecondTargetListsResource(ArcsecondAPIEndpoint):
         "id",
         "pk",
         "object",
+        "coordinates",
         "name",
         "identifier",
         "target_class",

{arcsecond-4.3.1 → arcsecond-4.3.3}/arcsecond/hosting/stack.py

@@ -229,6 +229,22 @@ def compose_streaming(
     )
 
 
+REGISTRY_REFUSED = (
+    "Docker could not download an Arcsecond image: the registry refused.\n"
+    "Enter the token Arcsecond gave your observatory:  arcsecond token set"
+)
+REGISTRY_REFUSED_NO_TOKEN = (
+    "Docker could not download an Arcsecond image: this machine has no token "
+    "saved, so it asked without one.\n"
+    "Enter the token Arcsecond gave your observatory:  arcsecond token set\n"
+    'It must answer "Token accepted." before Arcsecond.local can be downloaded.'
+)
+REGISTRY_REFUSED_WITH_TOKEN = (
+    "Docker could not download an Arcsecond image: the token this machine holds "
+    "was refused. It may have expired or been replaced — enter the current one "
+    "with  arcsecond token set,  or ask team@arcsecond.io for a new one."
+)
+
 # The compose failures the troubleshooting page used to explain, matched on
 # the daemon's own words so `start` can answer them on the spot.
 _KNOWN_FAILURES = (
@@ -267,8 +283,7 @@ _KNOWN_FAILURES = (
     ),
     (
         ("denied", "unauthorized", "pull access denied"),
-        "Docker could not download an Arcsecond image: the registry refused.\n"
-        "Enter the token Arcsecond gave your observatory:  arcsecond token set",
+        REGISTRY_REFUSED,
     ),
 )
 
@@ -284,6 +299,17 @@ def explain_compose_failure(stderr: str) -> Optional[str]:
 
 def raise_compose_failure(what: str, result: subprocess.CompletedProcess) -> None:
     explanation = explain_compose_failure(result.stderr)
+    if explanation == REGISTRY_REFUSED:
+        # "Unauthorized" reads the same whether the token is wrong or was never
+        # saved (a password store that could not write it, a first `start`
+        # before `token set`); the two call for different words.
+        from . import token  # token imports this module
+
+        explanation = (
+            REGISTRY_REFUSED_WITH_TOKEN
+            if token.has_token()
+            else REGISTRY_REFUSED_NO_TOKEN
+        )
     lines = [f"`{what}` failed (exit code {result.returncode})."]
     if explanation:
         lines += ["", explanation]

{arcsecond-4.3.1 → arcsecond-4.3.3}/arcsecond/hosting/token.py

@@ -53,21 +53,23 @@ def docker_config_path() -> Path:
 def has_token() -> bool:
     """Whether Docker on this machine holds a credential for the images.
 
-    Docker lists the registry under `auths` in its config even when the secret
-    itself lives in a credential store (Docker Desktop's, the OS keychain), so
-    the key's presence is the answer in the common case. When the config names
-    a store and lists nothing, the store is asked.
+    When the config names a credential store (Docker Desktop's, `pass`, the OS
+    keychain), the store is the truth and is asked: the empty entry Docker
+    leaves under `auths` survives a store being emptied or replaced, and a
+    machine whose `pass` was never initialised can carry one from an older
+    login. Without a store, the secret sits inline under `auths`. Only when
+    the store cannot answer — its helper missing, or waiting on a passphrase
+    prompt nobody sees — does the entry's presence stand in for it.
     """
     try:
         config = json.loads(docker_config_path().read_text(encoding="utf-8") or "{}")
     except (OSError, ValueError):
         return False
     auths = config.get("auths") or {}
-    if any(REGISTRY in key for key in auths):
-        return True
+    entries = [value for key, value in auths.items() if REGISTRY in key]
     store = (config.get("credHelpers") or {}).get(REGISTRY) or config.get("credsStore")
     if not store:
-        return False
+        return any(isinstance(entry, dict) and entry.get("auth") for entry in entries)
     try:
         probe = subprocess.run(
             [f"docker-credential-{store}", "get"],
@@ -78,8 +80,13 @@ def has_token() -> bool:
             timeout=15,
         )
     except (FileNotFoundError, subprocess.TimeoutExpired, OSError):
+        return bool(entries)
+    if probe.returncode != 0:
+        return False
+    try:
+        return bool(json.loads(probe.stdout or "{}").get("Secret"))
+    except ValueError:
         return False
-    return probe.returncode == 0 and REGISTRY_USER in (probe.stdout or "")
 
 
 def store_token(token: str) -> None:

{arcsecond-4.3.1 → arcsecond-4.3.3}/arcsecond/targets.py

@@ -116,9 +116,12 @@ def _plan_manual(
 ) -> "ArcsecondTargetPayloadPlan":
     """The plan for coordinates the user gave us themselves.
 
-    The backend takes manual coordinates only as an 'AstronomicalObject', so
-    that class is assumed here and anything inferred is set aside — with a
-    warning, since silently ignoring what was inferred would be worse.
+    They go as the target's own `coordinates`, which take precedence over the
+    catalogue's — offset or not, the user is assumed right — and need no
+    object: the backend names one after the fact when the catalogue knows the
+    name. Only an 'AstronomicalObject' may carry them, so that class is
+    assumed here and anything inferred is set aside — with a warning, since
+    silently ignoring what was inferred would be worse.
     """
     if user_target_class and user_target_class != TARGET_CLASS_ASTRONOMICAL_OBJECT:
         errors.append(
@@ -142,11 +145,7 @@ def _plan_manual(
         errors.append("Manual coordinates require a target name.")
 
     payload["target_class"] = effective_target_class
-    payload["mode"] = TARGET_MODE_MANUAL
-    payload["object"] = {
-        "name": effective_name or effective_identifier,
-        "equatorial_coordinates": effective_coordinates,
-    }
+    payload["coordinates"] = effective_coordinates
 
     return ArcsecondTargetPayloadPlan(
         payload=payload,

{arcsecond-4.3.1 → arcsecond-4.3.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "arcsecond"
-version = "4.3.1"
+version = "4.3.3"
 authors = [
     { name = "Cedric Foellmi", email = "cedric@arcsecond.io" },
 ]

{arcsecond-4.3.1 → arcsecond-4.3.3}/tests/api/test_config.py

@@ -4,6 +4,7 @@ from pathlib import Path
 import pytest
 
 from arcsecond.api.config import CONFIG_DIR_ENV_VAR, ArcsecondConfig
+from arcsecond.api.endpoint import WRITABLE_MEMBERSHIPS
 from arcsecond.errors import ArcsecondError
 from arcsecond.options import State
 from tests.utils import random_string, save_test_credentials
@@ -145,11 +146,22 @@ def test_config_memberships():
     config = ArcsecondConfig(api_name=random_api_name)
     assert config.memberships == {}
     ms = [
-        {"organisation": "oma", "role": "superadmin"},
+        {"organisation": "oma", "role": "owner"},
         {"organisation": "arcsecond", "role": "member"},
     ]
     config.save_memberships(ms)
-    assert config.memberships == {"oma": "superadmin", "arcsecond": "member"}
+    assert config.memberships == {"oma": "owner", "arcsecond": "member"}
+
+
+def test_owner_membership_is_writable():
+    assert "owner" in WRITABLE_MEMBERSHIPS
+
+
+def test_superadmin_membership_is_still_writable():
+    # An installation that predates the rename of "superadmin" to "owner"
+    # still answers with the old name, and the tool must keep treating it as
+    # the same role until no supported installation does.
+    assert "superadmin" in WRITABLE_MEMBERSHIPS
 
 
 def test_config_access_key():
@@ -192,10 +204,8 @@ def test_default_logged_in_state():
 def test_default_logged_in_with_membership_state():
     random_api_name = random_string()
     save_test_credentials(
-        random_api_name, "cedric", [{"organisation": "saao", "role": "superadmin"}]
+        random_api_name, "cedric", [{"organisation": "saao", "role": "owner"}]
     )
     assert ArcsecondConfig(api_name=random_api_name).is_logged_in is True
     assert ArcsecondConfig(api_name=random_api_name).username == "cedric"
-    assert ArcsecondConfig(api_name=random_api_name).memberships == {
-        "saao": "superadmin"
-    }
+    assert ArcsecondConfig(api_name=random_api_name).memberships == {"saao": "owner"}

{arcsecond-4.3.1 → arcsecond-4.3.3}/tests/test_hosting_database.py

@@ -330,13 +330,17 @@ def test_failed_recreate_reports_but_keeps_the_new_password(tmp_path, monkeypatc
     assert "password was changed successfully" in result.output
 
 
-def test_the_data_worker_is_recreated_only_where_the_compose_file_has_it(tmp_path, monkeypatch):
+def test_the_data_worker_is_recreated_only_where_the_compose_file_has_it(
+    tmp_path, monkeypatch
+):
     """docker-compose.yml 7.3 added it; naming it on an older install would
     make `docker compose up` fail outright."""
     monkeypatch.chdir(tmp_path)
     compose = Path(tmp_path) / "docker-compose.yml"
 
-    compose.write_text("services:\n  worker:\n    container_name: arcsecond-worker\n", encoding="utf-8")
+    compose.write_text(
+        "services:\n  worker:\n    container_name: arcsecond-worker\n", encoding="utf-8"
+    )
     assert database._services_to_recreate() == ["backend", "worker", "beat"]
 
     compose.write_text(
@@ -344,4 +348,10 @@ def test_the_data_worker_is_recreated_only_where_the_compose_file_has_it(tmp_pat
         "  # >>> arcsecond:alerts\n  alerts:\n  # <<< arcsecond:alerts\n",
         encoding="utf-8",
     )
-    assert database._services_to_recreate() == ["backend", "worker", "beat", "dataworker", "alerts"]
+    assert database._services_to_recreate() == [
+        "backend",
+        "worker",
+        "beat",
+        "dataworker",
+        "alerts",
+    ]

{arcsecond-4.3.1 → arcsecond-4.3.3}/tests/test_hosting_token.py

@@ -7,6 +7,7 @@ import pytest
 from click.testing import CliRunner
 
 from arcsecond import cli
+from arcsecond.errors import ArcsecondError
 from arcsecond.hosting import local, stack, token
 
 
@@ -117,12 +118,61 @@ def test_status_reads_dockers_config(docker, tmp_path):
     result = _invoke("token")
     assert result.exit_code == 1 and "no token yet" in result.output
     (tmp_path / "config.json").write_text(
-        json.dumps({"auths": {"ghcr.io": {}}, "credsStore": "desktop"})
+        json.dumps({"auths": {"ghcr.io": {"auth": "YXJjc2Vjb25kLWlvOng="}}})
     )
     result = _invoke("token")
     assert result.exit_code == 0 and "has the token" in result.output
 
 
+def _store_answers(monkeypatch, tmp_path, config, returncode, stdout=""):
+    monkeypatch.setattr(token, "docker_config_path", lambda: tmp_path / "config.json")
+    (tmp_path / "config.json").write_text(json.dumps(config))
+
+    def fake_run(cmd, input=None, **kwargs):
+        return subprocess.CompletedProcess(cmd, returncode, stdout=stdout)
+
+    monkeypatch.setattr(token.subprocess, "run", fake_run)
+
+
+def test_an_empty_entry_is_not_a_token_when_the_store_holds_nothing(
+    monkeypatch, tmp_path
+):
+    # JB's machine: `pass` never initialised, an `auths` entry left behind.
+    _store_answers(
+        monkeypatch,
+        tmp_path,
+        {"auths": {"ghcr.io": {}}, "credsStore": "desktop"},
+        returncode=1,
+        stdout="credentials not found in native keychain",
+    )
+    assert token.has_token() is False
+
+
+def test_a_token_saved_under_another_username_still_counts(monkeypatch, tmp_path):
+    # Before 4.2 the documentation had people log in under their own name.
+    _store_answers(
+        monkeypatch,
+        tmp_path,
+        {"credsStore": "pass"},
+        returncode=0,
+        stdout=json.dumps({"Username": "jb", "Secret": "x"}),
+    )
+    assert token.has_token() is True
+
+
+def test_a_store_that_cannot_answer_falls_back_on_the_entry(monkeypatch, tmp_path):
+    monkeypatch.setattr(token, "docker_config_path", lambda: tmp_path / "config.json")
+    (tmp_path / "config.json").write_text(
+        json.dumps({"auths": {"ghcr.io": {}}, "credsStore": "pass"})
+    )
+
+    def hangs(cmd, **kwargs):
+        raise subprocess.TimeoutExpired(cmd, 15)
+
+    monkeypatch.setattr(token.subprocess, "run", hangs)
+    assert token.has_token() is True
+
+
 def test_has_token_asks_the_credential_store_when_the_config_lists_nothing(
     monkeypatch, tmp_path
 ):
@@ -150,6 +200,27 @@ def test_start_points_at_the_token_when_the_pull_is_denied():
     )
 
 
+@pytest.mark.parametrize(
+    "saved, says, never",
+    [
+        (False, "no token saved", "expired"),
+        (True, "was refused", "no token saved"),
+    ],
+)
+def test_start_tells_a_missing_token_from_a_refused_one(
+    monkeypatch, saved, says, never
+):
+    monkeypatch.setattr(token, "has_token", lambda: saved)
+    result = subprocess.CompletedProcess(
+        [], 1, stderr="Error response from daemon: error from registry: unauthorized"
+    )
+    with pytest.raises(ArcsecondError) as excinfo:
+        stack.raise_compose_failure("docker compose up", result)
+    message = str(excinfo.value)
+    assert says in message and never not in message
+    assert "arcsecond token set" in message
+
+
 # --- setup asks for it -----------------------------------------------------------
 
 

{arcsecond-4.3.1 → arcsecond-4.3.3}/tests/test_targets_planning.py

@@ -13,11 +13,14 @@ def test_plan_target_payload_uses_manual_astroobject_when_coordinates_are_provid
     assert plan.target_class == "AstronomicalObject"
     assert plan.mode == "manual"
     assert plan.payload["target_class"] == "AstronomicalObject"
-    assert plan.payload["mode"] == "manual"
-    assert plan.payload["object"]["equatorial_coordinates"] == {
+    # The user's coordinates are the target's own; no object is sent, the
+    # backend names one when the catalogue knows the name.
+    assert plan.payload["coordinates"] == {
         "right_ascension": 344.366,
         "declination": 20.768,
     }
+    assert "mode" not in plan.payload
+    assert "object" not in plan.payload
     assert "ignored" in plan.warnings[0]
 
 

{arcsecond-4.3.1 → arcsecond-4.3.3}/uv.lock

@@ -155,7 +155,7 @@ wheels = [
 
 [[package]]
 name = "arcsecond"
-version = "4.3.1"
+version = "4.3.3"
 source = { editable = "." }
 dependencies = [
     { name = "alpyca" },