assertion-cli 0.5.17__tar.gz → 0.5.18__tar.gz

{assertion_cli-0.5.17 → assertion_cli-0.5.18}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: assertion-cli
-Version: 0.5.17
+Version: 0.5.18
 Summary: CLI for the Assertion API
 Requires-Python: >=3.13
 Description-Content-Type: text/markdown
@@ -54,23 +54,28 @@ asrt verify-status                     # one-shot poll; loop with your own sleep
 ## Authentication
 
 `asrt login` stores your API token in a global, user-level file —
-`~/.assertion/credentials.json` (mode `0600`) — keyed by the repo's path:
+`~/.assertion/credentials.json` (mode `0600`) — with an inverted repo index:
 
 ```json
-{ "version": 1, "repos": { "/abs/path/to/repo": "alk_..." } }
+{
+  "version": 2,
+  "tokens": { "alk_...": ["acme/mvp", "acme/docs"] },
+  "repo_index": { "acme/mvp": "alk_...", "acme/docs": "alk_..." }
+}
 ```
 
 Run it from inside the repo it should authenticate. It validates the token and
 confirms the repo's `origin` remote is connected to a stack in the token's
-workspace before saving, so each repo can target a different workspace. Because
-entries are keyed by path, moving or renaming the repo folder means logging in
-again (which adds a new entry). `asrt logout` removes the current repo's entry;
-`asrt whoami` shows which token is in effect.
+workspace before saving the token against that workspace's stack repos, so each
+repo can target a different workspace while moved folders and fresh clones keep
+working. `asrt logout` removes the current repo's saved auth; `asrt whoami`
+shows which token is in effect.
 
 Token resolution at call time, in order:
 
-1. the entry for the current repo path in `~/.assertion/credentials.json`;
-2. the `ASSERTION_API_TOKEN` environment variable (a backup for CI, or repos
+1. the token in `repo_index` for the current repo's GitHub `owner/repo`;
+2. a legacy entry for the current repo path in `~/.assertion/credentials.json`;
+3. the `ASSERTION_API_TOKEN` environment variable (a backup for CI, or repos
    with no remote that `asrt login` won't store);
 
 with a clear "run `asrt login`" error when neither is present. The API base URL

{assertion_cli-0.5.17 → assertion_cli-0.5.18}/README.md

@@ -41,23 +41,28 @@ asrt verify-status                     # one-shot poll; loop with your own sleep
 ## Authentication
 
 `asrt login` stores your API token in a global, user-level file —
-`~/.assertion/credentials.json` (mode `0600`) — keyed by the repo's path:
+`~/.assertion/credentials.json` (mode `0600`) — with an inverted repo index:
 
 ```json
-{ "version": 1, "repos": { "/abs/path/to/repo": "alk_..." } }
+{
+  "version": 2,
+  "tokens": { "alk_...": ["acme/mvp", "acme/docs"] },
+  "repo_index": { "acme/mvp": "alk_...", "acme/docs": "alk_..." }
+}
 ```
 
 Run it from inside the repo it should authenticate. It validates the token and
 confirms the repo's `origin` remote is connected to a stack in the token's
-workspace before saving, so each repo can target a different workspace. Because
-entries are keyed by path, moving or renaming the repo folder means logging in
-again (which adds a new entry). `asrt logout` removes the current repo's entry;
-`asrt whoami` shows which token is in effect.
+workspace before saving the token against that workspace's stack repos, so each
+repo can target a different workspace while moved folders and fresh clones keep
+working. `asrt logout` removes the current repo's saved auth; `asrt whoami`
+shows which token is in effect.
 
 Token resolution at call time, in order:
 
-1. the entry for the current repo path in `~/.assertion/credentials.json`;
-2. the `ASSERTION_API_TOKEN` environment variable (a backup for CI, or repos
+1. the token in `repo_index` for the current repo's GitHub `owner/repo`;
+2. a legacy entry for the current repo path in `~/.assertion/credentials.json`;
+3. the `ASSERTION_API_TOKEN` environment variable (a backup for CI, or repos
    with no remote that `asrt login` won't store);
 
 with a clear "run `asrt login`" error when neither is present. The API base URL

{assertion_cli-0.5.17 → assertion_cli-0.5.18}/api.py

@@ -9,7 +9,7 @@ import typer
 from pydantic import BaseModel, ValidationError
 
 from credentials import API_TOKEN_ENV, resolve_token
-from git import find_git_root_or_none
+from git import current_repo_full_name, find_git_root_or_none
 from models import (
     CheckpointResponse,
     DecisionResponse,
@@ -35,11 +35,15 @@ def _base_url() -> str:
 def _resolve_token() -> str | None:
     """Token for the current repo, else the shell env-var backup, else None.
 
-    The stored credential (keyed by the exact current git root) is primary; a
-    real `export ASSERTION_API_TOKEN` only fills in when no entry matches — e.g.
-    in CI, or a repo that was moved/renamed and never re-authenticated.
+    Stored credentials are primarily keyed by the current repo's GitHub
+    ``owner/repo`` identity, with the legacy exact git-root path as fallback. A
+    real `export ASSERTION_API_TOKEN` only fills in when no stored entry matches.
     """
-    token = resolve_token(find_git_root_or_none(Path.cwd()))
+    repo_root = find_git_root_or_none(Path.cwd())
+    repo_full_name = (
+        current_repo_full_name(repo_root) if repo_root is not None else None
+    )
+    token = resolve_token(repo_root, repo_full_name)
     if token:
         return token
     env_token = (os.environ.get(API_TOKEN_ENV) or "").strip()
@@ -53,7 +57,7 @@ def _auth_headers() -> dict[str, str]:
         where = f" for {repo_root}" if repo_root else ""
         typer.echo(
             f"No saved Assertion token{where}. Run `asrt login` to authenticate "
-            "this repo (if you moved or renamed the folder, log in again).\n"
+            "this repo.\n"
             f"Alternatively, export {API_TOKEN_ENV} in your shell as a backup.",
             err=True,
         )

{assertion_cli-0.5.17 → assertion_cli-0.5.18}/assertion_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: assertion-cli
-Version: 0.5.17
+Version: 0.5.18
 Summary: CLI for the Assertion API
 Requires-Python: >=3.13
 Description-Content-Type: text/markdown
@@ -54,23 +54,28 @@ asrt verify-status                     # one-shot poll; loop with your own sleep
 ## Authentication
 
 `asrt login` stores your API token in a global, user-level file —
-`~/.assertion/credentials.json` (mode `0600`) — keyed by the repo's path:
+`~/.assertion/credentials.json` (mode `0600`) — with an inverted repo index:
 
 ```json
-{ "version": 1, "repos": { "/abs/path/to/repo": "alk_..." } }
+{
+  "version": 2,
+  "tokens": { "alk_...": ["acme/mvp", "acme/docs"] },
+  "repo_index": { "acme/mvp": "alk_...", "acme/docs": "alk_..." }
+}
 ```
 
 Run it from inside the repo it should authenticate. It validates the token and
 confirms the repo's `origin` remote is connected to a stack in the token's
-workspace before saving, so each repo can target a different workspace. Because
-entries are keyed by path, moving or renaming the repo folder means logging in
-again (which adds a new entry). `asrt logout` removes the current repo's entry;
-`asrt whoami` shows which token is in effect.
+workspace before saving the token against that workspace's stack repos, so each
+repo can target a different workspace while moved folders and fresh clones keep
+working. `asrt logout` removes the current repo's saved auth; `asrt whoami`
+shows which token is in effect.
 
 Token resolution at call time, in order:
 
-1. the entry for the current repo path in `~/.assertion/credentials.json`;
-2. the `ASSERTION_API_TOKEN` environment variable (a backup for CI, or repos
+1. the token in `repo_index` for the current repo's GitHub `owner/repo`;
+2. a legacy entry for the current repo path in `~/.assertion/credentials.json`;
+3. the `ASSERTION_API_TOKEN` environment variable (a backup for CI, or repos
    with no remote that `asrt login` won't store);
 
 with a clear "run `asrt login`" error when neither is present. The API base URL

assertion_cli-0.5.18/credentials.py

@@ -0,0 +1,253 @@
+"""Global, user-level token store at ``~/.assertion/credentials.json``.
+
+The current store keeps plaintext tokens plus an inverted GitHub repo index, so
+reclones or moved folders keep resolving as long as their ``origin`` still
+points at a connected repo:
+
+    {
+      "version": 2,
+      "tokens": {"alk_...": ["acme/mvp"]},
+      "repo_index": {"acme/mvp": "alk_..."}
+    }
+
+The legacy v1 ``repos`` path map is still read as a fallback:
+
+    {"version": 1, "repos": {"/abs/path/to/repo": "alk_..."}}
+
+This module is deliberately git-free and pure stdlib — callers pass in the repo
+root / repo full name (resolved via ``git.py``) and handle their own error
+reporting. Token resolution precedence (repo entry first, then the env-var
+backup) lives in ``api.py``; this module only owns on-disk reads and writes.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+from pathlib import Path
+
+API_TOKEN_ENV = "ASSERTION_API_TOKEN"
+
+CREDENTIALS_FILE_NAME = "credentials.json"
+CREDENTIALS_VERSION = 2
+
+
+def assertion_home() -> Path:
+    """Directory holding global Assertion credentials (``~/.assertion``)."""
+    return Path.home() / ".assertion"
+
+
+def credentials_path() -> Path:
+    return assertion_home() / CREDENTIALS_FILE_NAME
+
+
+def _empty_store() -> dict:
+    return {
+        "version": CREDENTIALS_VERSION,
+        "tokens": {},
+        "repo_index": {},
+        "repos": {},
+    }
+
+
+def load_store() -> dict:
+    """Return the credentials store, tolerating a missing or corrupt file.
+
+    A malformed file is treated as empty rather than crashing every command —
+    the user can re-run ``asrt login`` to repair it.
+    """
+    path = credentials_path()
+    if not path.exists():
+        return _empty_store()
+    try:
+        data = json.loads(path.read_text(encoding="utf-8"))
+    except (json.JSONDecodeError, OSError, ValueError):
+        return _empty_store()
+    if not isinstance(data, dict):
+        return _empty_store()
+    data.setdefault("version", CREDENTIALS_VERSION)
+    if not isinstance(data.get("tokens"), dict):
+        data["tokens"] = {}
+    if not isinstance(data.get("repo_index"), dict):
+        data["repo_index"] = _repo_index_from_tokens(data["tokens"])
+    if not isinstance(data.get("repos"), dict):
+        data["repos"] = {}
+    return data
+
+
+def _repo_key(repo_root: Path) -> str:
+    """Canonical store key for a repo root (absolute, symlinks resolved)."""
+    return str(repo_root.resolve())
+
+
+def _repo_name_key(repo_full_name: str) -> str:
+    return repo_full_name.strip().lower()
+
+
+def _normalize_repo_names(repo_full_names: list[str]) -> list[str]:
+    seen: set[str] = set()
+    normalized: list[str] = []
+    for repo in repo_full_names:
+        key = _repo_name_key(repo)
+        if not key or key in seen:
+            continue
+        seen.add(key)
+        normalized.append(key)
+    return normalized
+
+
+def _repo_index_from_tokens(tokens: dict) -> dict[str, str]:
+    index: dict[str, str] = {}
+    for token, repos in tokens.items():
+        if not isinstance(token, str) or not isinstance(repos, list):
+            continue
+        for repo in repos:
+            key = _repo_name_key(str(repo))
+            if key:
+                index[key] = token
+    return index
+
+
+def _write_store(store: dict) -> Path:
+    home = assertion_home()
+    home.mkdir(parents=True, exist_ok=True)
+    try:
+        home.chmod(0o700)
+    except OSError:
+        pass
+    path = credentials_path()
+    path.write_text(json.dumps(store, indent=2) + "\n", encoding="utf-8")
+    try:
+        path.chmod(0o600)
+    except OSError:
+        pass
+    return path
+
+
+def save_token(
+    token: str, *, repo_root: Path, repo_full_names: list[str] | None = None
+) -> Path:
+    """Persist ``token`` and return the credentials file path.
+
+    ``repo_full_names`` are canonical GitHub ``owner/repo`` names visible to the
+    token. The legacy path entry is still written so older CLIs can read the
+    file during a rolling upgrade.
+    """
+    store = load_store()
+    if repo_full_names is not None:
+        normalized = _normalize_repo_names(repo_full_names)
+        normalized_set = set(normalized)
+        repo_index = store["repo_index"]
+        for repo, indexed_token in list(repo_index.items()):
+            if indexed_token == token or repo in normalized_set:
+                del repo_index[repo]
+        for saved_token, repos in list(store["tokens"].items()):
+            if saved_token == token or not isinstance(repos, list):
+                continue
+            filtered = [
+                _repo_name_key(str(repo))
+                for repo in repos
+                if _repo_name_key(str(repo)) not in normalized_set
+            ]
+            if filtered:
+                store["tokens"][saved_token] = filtered
+            else:
+                del store["tokens"][saved_token]
+            for repo in normalized:
+                if repo_index.get(repo) == saved_token:
+                    del repo_index[repo]
+        store["tokens"][token] = normalized
+        for repo in normalized:
+            repo_index[repo] = token
+    store["repos"][_repo_key(repo_root)] = token
+    return _write_store(store)
+
+
+def remove_token(*, repo_root: Path, repo_full_name: str | None = None) -> bool:
+    """Delete this repo's saved credential. Return ``True`` if one was removed."""
+    store = load_store()
+    key = _repo_key(repo_root)
+    token = store["repos"].pop(key, None)
+    removed = token is not None
+    if repo_full_name is not None:
+        repo_key = _repo_name_key(repo_full_name)
+        indexed_token = store["repo_index"].pop(repo_key, None)
+        target_token = token or indexed_token
+        for saved_token, repos in list(store["tokens"].items()):
+            if target_token is not None and saved_token != target_token:
+                continue
+            if not isinstance(repos, list):
+                continue
+            filtered = [
+                str(repo).strip().lower()
+                for repo in repos
+                if _repo_name_key(str(repo)) != repo_key
+            ]
+            if len(filtered) != len(repos):
+                removed = True
+                if filtered:
+                    store["tokens"][saved_token] = filtered
+                else:
+                    del store["tokens"][saved_token]
+            if saved_token == target_token:
+                break
+        removed = removed or indexed_token is not None
+    if token:
+        repo_refs = 0
+        for saved in store["repos"].values():
+            if saved == token:
+                repo_refs += 1
+        indexed_refs = [
+            indexed_token
+            for indexed_token in store["repo_index"].values()
+            if indexed_token == token
+        ]
+        if (
+            repo_refs == 0
+            and not indexed_refs
+            and token in store["tokens"]
+            and repo_full_name is None
+        ):
+            del store["tokens"][token]
+    if removed:
+        _write_store(store)
+    return removed
+
+
+def resolve_token(
+    repo_root: Path | None, repo_full_name: str | None = None
+) -> str | None:
+    """Return the stored token for ``repo_full_name`` / ``repo_root``.
+
+    Repo-name matching is primary and survives reclones/moved folders. The
+    legacy exact path match is retained so existing credentials keep working.
+    """
+    store = load_store()
+    if repo_full_name is not None:
+        local = _repo_name_key(repo_full_name)
+        token = store["repo_index"].get(local)
+        if token:
+            return token
+    if repo_root is None:
+        return None
+    token = store["repos"].get(_repo_key(repo_root))
+    return token or None
+
+
+def describe_source(
+    repo_root: Path | None, repo_full_name: str | None = None
+) -> str | None:
+    """Describe where the active token comes from, in resolution order.
+
+    Returns a human phrase for ``whoami``, or ``None`` when nothing resolves.
+    """
+    if (
+        repo_full_name is not None
+        and resolve_token(repo_root, repo_full_name) is not None
+    ):
+        return f"the saved token for {repo_full_name.strip().lower()}"
+    if repo_root is not None and resolve_token(repo_root) is not None:
+        return f"the saved token for {_repo_key(repo_root)}"
+    if (os.environ.get(API_TOKEN_ENV) or "").strip():
+        return f"the {API_TOKEN_ENV} environment variable"
+    return None

{assertion_cli-0.5.17 → assertion_cli-0.5.18}/main.py

@@ -125,8 +125,9 @@ def login(
     """Authenticate this repo and save its token under ~/.assertion/.
 
     Generate a token at Settings → Authentication in the dashboard, then run
-    this from inside the repo it should be used for. The token is stored keyed
-    by the repo's path, so each repo can target a different workspace.
+    this from inside any repo it can access. The token is stored with the
+    workspace's stack repos, so moved folders and fresh clones keep working when
+    their `origin` remote matches.
 
     Only repos whose `origin` remote matches a stack in the token's workspace
     are stored; a repo with no remote can't be verified, so use the
@@ -173,7 +174,9 @@ def login(
             "the dashboard, then re-run `asrt login`."
         )
 
-    path = save_token(token, repo_root=repo_root)
+    path = save_token(
+        token, repo_root=repo_root, repo_full_names=[s.repo for s in stack_list]
+    )
     names = ", ".join(f"'{s.name}'" for s in matched)
     typer.echo(f"✓ {local} is connected to stack(s): {names}")
     typer.echo(f"Saved token for {repo_root} to {path}")
@@ -186,7 +189,8 @@ def logout() -> None:
     if repo_root is None:
         exit_with_error("Not inside a git repository.")
 
-    if remove_token(repo_root=repo_root):
+    local = current_repo_full_name(repo_root)
+    if remove_token(repo_root=repo_root, repo_full_name=local):
         typer.echo(f"Removed saved token for {repo_root}.")
     else:
         typer.echo(f"No saved token for {repo_root}.")
@@ -196,7 +200,8 @@ def logout() -> None:
 def whoami() -> None:
     """Show which token would be used here and confirm it works."""
     repo_root = find_git_root_or_none(Path.cwd())
-    source = describe_source(repo_root)
+    local = current_repo_full_name(repo_root) if repo_root is not None else None
+    source = describe_source(repo_root, local)
     if source is None:
         exit_with_error(
             "Not authenticated. Run `asrt login` to save a token for this repo."

{assertion_cli-0.5.17 → assertion_cli-0.5.18}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "assertion-cli"
-version = "0.5.17"
+version = "0.5.18"
 description = "CLI for the Assertion API"
 readme = "README.md"
 requires-python = ">=3.13"

{assertion_cli-0.5.17 → assertion_cli-0.5.18}/templates/SKILL.md

@@ -21,7 +21,7 @@ Before any `asrt` call:
 
 - You are inside a git repository.
 - `asrt install` has been run once in this repo. It installs the skill files you are reading right now (plus the `AGENTS.md` / `CLAUDE.md` pointer and `.gitignore` rules). This is an onboarding step, not a per-run one.
-- `asrt login` has been run once to authenticate this repo. It stores the API token in `~/.assertion/credentials.json` (keyed by repo path) — not in a repo `.env`. If an `asrt` call fails with "No saved Assertion token … run `asrt login`", the user needs to run `asrt login` (or export `ASSERTION_API_TOKEN`); surface that to them rather than retrying.
+- `asrt login` has been run once to authenticate this repo. It stores the API token in `~/.assertion/credentials.json` (keyed by GitHub `owner/repo`) — not in a repo `.env`. If an `asrt` call fails with "No saved Assertion token … run `asrt login`", the user needs to run `asrt login` (or export `ASSERTION_API_TOKEN`); surface that to them rather than retrying.
 - `asrt session start` has been run for this work session. It resets `.assertion/` (except `.assertion/seed.py`) and records the verification base — the merge-base with the upstream tracking branch by default, or an explicit `--from <ref>`. If `asrt checkpoint` or `asrt verify` errors with "No verification base recorded", run `asrt session start` and retry.
 
 **First command sequence for a new work session:**

{assertion_cli-0.5.17 → assertion_cli-0.5.18}/tests/test_auth.py

@@ -43,7 +43,9 @@ def repo(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> Path:
 
 @respx.mock
 def test_login_saves_when_repo_matches_stack(repo: Path) -> None:
-    route = respx.get(STACKS_URL).mock(return_value=_stacks_response("acme/mvp"))
+    route = respx.get(STACKS_URL).mock(
+        return_value=_stacks_response("acme/mvp", "acme/docs")
+    )
 
     result = runner.invoke(main.app, ["login", "--token", "alk_new"])
 
@@ -51,6 +53,8 @@ def test_login_saves_when_repo_matches_stack(repo: Path) -> None:
     assert "connected to stack" in result.output.lower()
     assert route.called
     assert credentials.resolve_token(repo) == "alk_new"
+    assert credentials.resolve_token(None, "acme/mvp") == "alk_new"
+    assert credentials.resolve_token(None, "acme/docs") == "alk_new"
 
 
 @respx.mock

assertion_cli-0.5.18/tests/test_credentials.py

@@ -0,0 +1,189 @@
+from __future__ import annotations
+
+import json
+import stat
+from pathlib import Path
+
+import pytest
+
+import credentials
+
+
+@pytest.fixture(autouse=True)
+def _isolate_home(monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> Path:
+    """Point the store at a throwaway dir and clear the env-var backup."""
+    home = tmp_path / "home"
+    monkeypatch.setattr(credentials, "assertion_home", lambda: home)
+    monkeypatch.delenv(credentials.API_TOKEN_ENV, raising=False)
+    return home
+
+
+@pytest.fixture
+def repo(tmp_path: Path) -> Path:
+    root = tmp_path / "repo"
+    root.mkdir()
+    return root
+
+
+def test_save_and_resolve_round_trip(repo: Path) -> None:
+    credentials.save_token(
+        "alk_one", repo_root=repo, repo_full_names=["acme/mvp", "Acme/Docs"]
+    )
+    assert credentials.resolve_token(repo, "ACME/MVP") == "alk_one"
+
+
+def test_resolve_unknown_repo_returns_none(repo: Path, tmp_path: Path) -> None:
+    credentials.save_token("alk_one", repo_root=repo, repo_full_names=["acme/mvp"])
+    other = tmp_path / "other"
+    other.mkdir()
+    assert credentials.resolve_token(other) is None
+
+
+def test_resolve_none_repo_root() -> None:
+    assert credentials.resolve_token(None) is None
+
+
+def test_save_writes_file_mode_0600(repo: Path) -> None:
+    path = credentials.save_token("alk_one", repo_root=repo)
+    mode = stat.S_IMODE(path.stat().st_mode)
+    assert mode == 0o600
+
+
+def test_store_shape(repo: Path) -> None:
+    path = credentials.save_token(
+        "alk_one", repo_root=repo, repo_full_names=["Acme/MVP", "acme/mvp"]
+    )
+    data = json.loads(path.read_text())
+    assert data["version"] == credentials.CREDENTIALS_VERSION
+    assert data["tokens"]["alk_one"] == ["acme/mvp"]
+    assert data["repo_index"]["acme/mvp"] == "alk_one"
+    assert data["repos"][str(repo.resolve())] == "alk_one"
+
+
+def test_save_is_idempotent_overwrite(repo: Path) -> None:
+    credentials.save_token("alk_one", repo_root=repo, repo_full_names=["acme/mvp"])
+    credentials.save_token("alk_two", repo_root=repo, repo_full_names=["acme/mvp"])
+    assert credentials.resolve_token(repo, "acme/mvp") == "alk_two"
+    store = credentials.load_store()
+    assert len(store["repos"]) == 1
+    assert len(store["tokens"]) == 1
+    assert store["repo_index"] == {"acme/mvp": "alk_two"}
+
+
+def test_distinct_repos_get_distinct_entries(tmp_path: Path) -> None:
+    a, b = tmp_path / "a", tmp_path / "b"
+    a.mkdir()
+    b.mkdir()
+    credentials.save_token("alk_a", repo_root=a, repo_full_names=["acme/a"])
+    credentials.save_token("alk_b", repo_root=b, repo_full_names=["acme/b"])
+    assert credentials.resolve_token(a, "acme/a") == "alk_a"
+    assert credentials.resolve_token(b, "acme/b") == "alk_b"
+
+
+def test_load_store_missing_file_is_empty() -> None:
+    assert credentials.load_store() == {
+        "version": credentials.CREDENTIALS_VERSION,
+        "tokens": {},
+        "repo_index": {},
+        "repos": {},
+    }
+
+
+def test_load_store_tolerates_corrupt_file(_isolate_home: Path) -> None:
+    path = credentials.credentials_path()
+    path.parent.mkdir(parents=True, exist_ok=True)
+    path.write_text("{ not json", encoding="utf-8")
+    assert credentials.load_store() == {
+        "version": credentials.CREDENTIALS_VERSION,
+        "tokens": {},
+        "repo_index": {},
+        "repos": {},
+    }
+
+
+def test_remove_token(repo: Path) -> None:
+    credentials.save_token("alk_one", repo_root=repo, repo_full_names=["acme/mvp"])
+    assert credentials.remove_token(repo_root=repo, repo_full_name="acme/mvp") is True
+    assert credentials.resolve_token(repo, "acme/mvp") is None
+    # Removing again is a no-op.
+    assert credentials.remove_token(repo_root=repo) is False
+
+
+def test_describe_source_repo_entry(repo: Path) -> None:
+    credentials.save_token("alk_one", repo_root=repo, repo_full_names=["acme/mvp"])
+    assert credentials.describe_source(repo, "acme/mvp") == (
+        "the saved token for acme/mvp"
+    )
+
+
+def test_describe_source_env_var(repo: Path, monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setenv(credentials.API_TOKEN_ENV, "alk_env")
+    # No stored entry for this repo -> falls through to the env-var source.
+    assert credentials.describe_source(repo) == (
+        f"the {credentials.API_TOKEN_ENV} environment variable"
+    )
+
+
+def test_describe_source_repo_entry_wins_over_env(
+    repo: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    monkeypatch.setenv(credentials.API_TOKEN_ENV, "alk_env")
+    credentials.save_token("alk_one", repo_root=repo)
+    assert credentials.describe_source(repo) == f"the saved token for {repo.resolve()}"
+
+
+def test_describe_source_none(repo: Path) -> None:
+    assert credentials.describe_source(repo) is None
+
+
+def test_resolve_legacy_path_store(repo: Path) -> None:
+    path = credentials.credentials_path()
+    path.parent.mkdir(parents=True, exist_ok=True)
+    path.write_text(
+        json.dumps({"version": 1, "repos": {str(repo.resolve()): "alk_old"}}),
+        encoding="utf-8",
+    )
+
+    assert credentials.resolve_token(repo, "acme/mvp") == "alk_old"
+
+
+def test_load_store_builds_repo_index_from_token_only_v2_store() -> None:
+    path = credentials.credentials_path()
+    path.parent.mkdir(parents=True, exist_ok=True)
+    path.write_text(
+        json.dumps({"version": 2, "tokens": {"alk_one": ["Acme/MVP"]}}),
+        encoding="utf-8",
+    )
+
+    assert credentials.load_store()["repo_index"] == {"acme/mvp": "alk_one"}
+    assert credentials.resolve_token(None, "acme/mvp") == "alk_one"
+
+
+def test_resolve_repo_name_after_reclone(repo: Path, tmp_path: Path) -> None:
+    moved = tmp_path / "moved"
+    moved.mkdir()
+    credentials.save_token("alk_one", repo_root=repo, repo_full_names=["acme/mvp"])
+
+    assert credentials.resolve_token(moved, "acme/mvp") == "alk_one"
+
+
+def test_remove_token_keeps_other_repo_names(repo: Path) -> None:
+    credentials.save_token(
+        "alk_one", repo_root=repo, repo_full_names=["acme/mvp", "acme/docs"]
+    )
+
+    assert credentials.remove_token(repo_root=repo, repo_full_name="acme/mvp") is True
+    assert credentials.resolve_token(None, "acme/mvp") is None
+    assert credentials.resolve_token(None, "acme/docs") == "alk_one"
+
+
+def test_resaving_same_token_removes_stale_repo_index_entries(repo: Path) -> None:
+    credentials.save_token(
+        "alk_one", repo_root=repo, repo_full_names=["acme/mvp", "acme/docs"]
+    )
+    credentials.save_token("alk_one", repo_root=repo, repo_full_names=["acme/mvp"])
+
+    store = credentials.load_store()
+    assert store["tokens"]["alk_one"] == ["acme/mvp"]
+    assert store["repo_index"] == {"acme/mvp": "alk_one"}
+    assert credentials.resolve_token(None, "acme/docs") is None

assertion_cli-0.5.17/credentials.py

@@ -1,120 +0,0 @@
-"""Global, user-level token store at ``~/.assertion/credentials.json``.
-
-The store is a map of canonicalized git-root path -> API token, so each repo
-resolves to its own workspace token:
-
-    {"version": 1, "repos": {"/abs/path/to/repo": "alk_..."}}
-
-This module is deliberately git-free and pure stdlib — callers pass in the repo
-root (resolved via ``git.py``) and handle their own error reporting. Token
-resolution precedence (repo entry first, then the env-var backup) lives in
-``api.py``; this module only owns on-disk reads and writes.
-"""
-
-from __future__ import annotations
-
-import json
-import os
-from pathlib import Path
-
-API_TOKEN_ENV = "ASSERTION_API_TOKEN"
-
-CREDENTIALS_FILE_NAME = "credentials.json"
-CREDENTIALS_VERSION = 1
-
-
-def assertion_home() -> Path:
-    """Directory holding global Assertion credentials (``~/.assertion``)."""
-    return Path.home() / ".assertion"
-
-
-def credentials_path() -> Path:
-    return assertion_home() / CREDENTIALS_FILE_NAME
-
-
-def _empty_store() -> dict:
-    return {"version": CREDENTIALS_VERSION, "repos": {}}
-
-
-def load_store() -> dict:
-    """Return the credentials store, tolerating a missing or corrupt file.
-
-    A malformed file is treated as empty rather than crashing every command —
-    the user can re-run ``asrt login`` to repair it.
-    """
-    path = credentials_path()
-    if not path.exists():
-        return _empty_store()
-    try:
-        data = json.loads(path.read_text(encoding="utf-8"))
-    except (json.JSONDecodeError, OSError, ValueError):
-        return _empty_store()
-    if not isinstance(data, dict):
-        return _empty_store()
-    data.setdefault("version", CREDENTIALS_VERSION)
-    if not isinstance(data.get("repos"), dict):
-        data["repos"] = {}
-    return data
-
-
-def _repo_key(repo_root: Path) -> str:
-    """Canonical store key for a repo root (absolute, symlinks resolved)."""
-    return str(repo_root.resolve())
-
-
-def _write_store(store: dict) -> Path:
-    home = assertion_home()
-    home.mkdir(parents=True, exist_ok=True)
-    try:
-        home.chmod(0o700)
-    except OSError:
-        pass
-    path = credentials_path()
-    path.write_text(json.dumps(store, indent=2) + "\n", encoding="utf-8")
-    try:
-        path.chmod(0o600)
-    except OSError:
-        pass
-    return path
-
-
-def save_token(token: str, *, repo_root: Path) -> Path:
-    """Persist ``token`` for ``repo_root`` and return the credentials file path."""
-    store = load_store()
-    store["repos"][_repo_key(repo_root)] = token
-    return _write_store(store)
-
-
-def remove_token(*, repo_root: Path) -> bool:
-    """Delete the entry for ``repo_root``. Return ``True`` if one was removed."""
-    store = load_store()
-    key = _repo_key(repo_root)
-    if key in store["repos"]:
-        del store["repos"][key]
-        _write_store(store)
-        return True
-    return False
-
-
-def resolve_token(repo_root: Path | None) -> str | None:
-    """Return the stored token for ``repo_root`` (exact path match), else ``None``.
-
-    No fuzzy or parent-path matching: a moved or never-authenticated repo simply
-    misses, and the caller falls back to the env-var backup.
-    """
-    if repo_root is None:
-        return None
-    token = load_store()["repos"].get(_repo_key(repo_root))
-    return token or None
-
-
-def describe_source(repo_root: Path | None) -> str | None:
-    """Describe where the active token comes from, in resolution order.
-
-    Returns a human phrase for ``whoami``, or ``None`` when nothing resolves.
-    """
-    if repo_root is not None and resolve_token(repo_root) is not None:
-        return f"the saved token for {_repo_key(repo_root)}"
-    if (os.environ.get(API_TOKEN_ENV) or "").strip():
-        return f"the {API_TOKEN_ENV} environment variable"
-    return None

assertion_cli-0.5.17/tests/test_credentials.py

@@ -1,122 +0,0 @@
-from __future__ import annotations
-
-import json
-import stat
-from pathlib import Path
-
-import pytest
-
-import credentials
-
-
-@pytest.fixture(autouse=True)
-def _isolate_home(monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> Path:
-    """Point the store at a throwaway dir and clear the env-var backup."""
-    home = tmp_path / "home"
-    monkeypatch.setattr(credentials, "assertion_home", lambda: home)
-    monkeypatch.delenv(credentials.API_TOKEN_ENV, raising=False)
-    return home
-
-
-@pytest.fixture
-def repo(tmp_path: Path) -> Path:
-    root = tmp_path / "repo"
-    root.mkdir()
-    return root
-
-
-def test_save_and_resolve_round_trip(repo: Path) -> None:
-    credentials.save_token("alk_one", repo_root=repo)
-    assert credentials.resolve_token(repo) == "alk_one"
-
-
-def test_resolve_unknown_repo_returns_none(repo: Path, tmp_path: Path) -> None:
-    credentials.save_token("alk_one", repo_root=repo)
-    other = tmp_path / "other"
-    other.mkdir()
-    assert credentials.resolve_token(other) is None
-
-
-def test_resolve_none_repo_root() -> None:
-    assert credentials.resolve_token(None) is None
-
-
-def test_save_writes_file_mode_0600(repo: Path) -> None:
-    path = credentials.save_token("alk_one", repo_root=repo)
-    mode = stat.S_IMODE(path.stat().st_mode)
-    assert mode == 0o600
-
-
-def test_store_shape(repo: Path) -> None:
-    path = credentials.save_token("alk_one", repo_root=repo)
-    data = json.loads(path.read_text())
-    assert data["version"] == credentials.CREDENTIALS_VERSION
-    assert data["repos"][str(repo.resolve())] == "alk_one"
-
-
-def test_save_is_idempotent_overwrite(repo: Path) -> None:
-    credentials.save_token("alk_one", repo_root=repo)
-    credentials.save_token("alk_two", repo_root=repo)
-    assert credentials.resolve_token(repo) == "alk_two"
-    store = credentials.load_store()
-    assert len(store["repos"]) == 1
-
-
-def test_distinct_repos_get_distinct_entries(tmp_path: Path) -> None:
-    a, b = tmp_path / "a", tmp_path / "b"
-    a.mkdir()
-    b.mkdir()
-    credentials.save_token("alk_a", repo_root=a)
-    credentials.save_token("alk_b", repo_root=b)
-    assert credentials.resolve_token(a) == "alk_a"
-    assert credentials.resolve_token(b) == "alk_b"
-
-
-def test_load_store_missing_file_is_empty() -> None:
-    assert credentials.load_store() == {
-        "version": credentials.CREDENTIALS_VERSION,
-        "repos": {},
-    }
-
-
-def test_load_store_tolerates_corrupt_file(_isolate_home: Path) -> None:
-    path = credentials.credentials_path()
-    path.parent.mkdir(parents=True, exist_ok=True)
-    path.write_text("{ not json", encoding="utf-8")
-    assert credentials.load_store() == {
-        "version": credentials.CREDENTIALS_VERSION,
-        "repos": {},
-    }
-
-
-def test_remove_token(repo: Path) -> None:
-    credentials.save_token("alk_one", repo_root=repo)
-    assert credentials.remove_token(repo_root=repo) is True
-    assert credentials.resolve_token(repo) is None
-    # Removing again is a no-op.
-    assert credentials.remove_token(repo_root=repo) is False
-
-
-def test_describe_source_repo_entry(repo: Path) -> None:
-    credentials.save_token("alk_one", repo_root=repo)
-    assert credentials.describe_source(repo) == f"the saved token for {repo.resolve()}"
-
-
-def test_describe_source_env_var(repo: Path, monkeypatch: pytest.MonkeyPatch) -> None:
-    monkeypatch.setenv(credentials.API_TOKEN_ENV, "alk_env")
-    # No stored entry for this repo -> falls through to the env-var source.
-    assert credentials.describe_source(repo) == (
-        f"the {credentials.API_TOKEN_ENV} environment variable"
-    )
-
-
-def test_describe_source_repo_entry_wins_over_env(
-    repo: Path, monkeypatch: pytest.MonkeyPatch
-) -> None:
-    monkeypatch.setenv(credentials.API_TOKEN_ENV, "alk_env")
-    credentials.save_token("alk_one", repo_root=repo)
-    assert credentials.describe_source(repo) == f"the saved token for {repo.resolve()}"
-
-
-def test_describe_source_none(repo: Path) -> None:
-    assert credentials.describe_source(repo) is None