avios-cli 0.1.2__tar.gz → 0.1.3__tar.gz

{avios_cli-0.1.2 → avios_cli-0.1.3}/CHANGELOG.md

@@ -6,6 +6,20 @@ to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [0.1.3] - 2026-07-24
+
+### Fixed
+- **Login never actually captured an authenticated session.** The dashboard is a
+  client-side SPA, so `wait_for_url("**/manage-avios/**")` matched the initial
+  navigation immediately and the browser closed before login — saving anonymous
+  cookies, so every call then failed with "Session expired". Login now polls
+  `/auth-gateway/user` until it returns 200 (i.e. you're actually logged in) and
+  only then captures the cookies.
+- Login launches your **system Chrome** (`channel="chrome"`) when available, so no
+  150 MB Chromium download is needed; falls back to bundled Chromium.
+- Corrected the Chromium install command to `uvx --from playwright playwright
+  install chromium`.
+
 ## [0.1.2] - 2026-07-24
 
 ### Fixed
@@ -49,7 +63,8 @@ to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 - Reward-flight **availability** search is not yet implemented (needs a British
   Airways capture).
 
-[Unreleased]: https://github.com/alexechoi/avios-cli/compare/v0.1.2...HEAD
+[Unreleased]: https://github.com/alexechoi/avios-cli/compare/v0.1.3...HEAD
+[0.1.3]: https://github.com/alexechoi/avios-cli/compare/v0.1.2...v0.1.3
 [0.1.2]: https://github.com/alexechoi/avios-cli/compare/v0.1.1...v0.1.2
 [0.1.1]: https://github.com/alexechoi/avios-cli/compare/v0.1.0...v0.1.1
 [0.1.0]: https://github.com/alexechoi/avios-cli/releases/tag/v0.1.0

{avios_cli-0.1.2 → avios_cli-0.1.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: avios-cli
-Version: 0.1.2
+Version: 0.1.3
 Summary: A CLI and TUI for avios.com — view your Avios balance and transactions from the terminal.
 Project-URL: Homepage, https://github.com/alexechoi/avios-cli
 Project-URL: Repository, https://github.com/alexechoi/avios-cli
@@ -78,22 +78,27 @@ uv run avios --help
 ## Log in
 
 avios.com has no credential API — login is Auth0 Universal Login behind hCaptcha and
-SMS/passkey MFA — so `avios login` rides a real browser session (like `gh`/`aws`
-login). Login needs the **`login` extra**, so run it with `avios-cli[login]`:
+SMS/passkey MFA — so `avios login` opens a real browser, **waits while you finish
+logging in** (password, captcha, SMS code), and captures the session once you land
+on the dashboard. It needs the **`login` extra**:
 
 ```bash
-# open a browser and log in once (first run also downloads Chromium):
-uvx --from 'avios-cli[login]' playwright install chromium
 uvx --from 'avios-cli[login]' avios login
+```
+
+It launches your installed **Google Chrome** (no extra download). If you don't have
+Chrome, install Playwright's browser once with
+`uvx --from playwright playwright install chromium`.
 
-# ...or skip the browser download and import the cookie from Chrome you're
-# already logged into avios.com with:
+Prefer not to open a browser? Import the cookie from a Chrome you're already logged
+into avios.com with:
+
+```bash
 uvx --from 'avios-cli[login]' avios login --from-browser
 ```
 
-If you installed with `pip install "avios-cli[login]"`, just run `avios login`
-(and `playwright install chromium` once). Plain `uvx avios-cli login` won't work —
-the isolated environment doesn't include the `login` extra.
+Plain `uvx avios-cli login` won't work — the isolated environment doesn't include
+the `login` extra.
 
 Your session cookie is stored at `~/.config/avios/state.json` (mode `600`). It
 expires after ~a day; just run `avios login` again. Run `avios logout` to remove it.

{avios_cli-0.1.2 → avios_cli-0.1.3}/README.md

@@ -43,22 +43,27 @@ uv run avios --help
 ## Log in
 
 avios.com has no credential API — login is Auth0 Universal Login behind hCaptcha and
-SMS/passkey MFA — so `avios login` rides a real browser session (like `gh`/`aws`
-login). Login needs the **`login` extra**, so run it with `avios-cli[login]`:
+SMS/passkey MFA — so `avios login` opens a real browser, **waits while you finish
+logging in** (password, captcha, SMS code), and captures the session once you land
+on the dashboard. It needs the **`login` extra**:
 
 ```bash
-# open a browser and log in once (first run also downloads Chromium):
-uvx --from 'avios-cli[login]' playwright install chromium
 uvx --from 'avios-cli[login]' avios login
+```
+
+It launches your installed **Google Chrome** (no extra download). If you don't have
+Chrome, install Playwright's browser once with
+`uvx --from playwright playwright install chromium`.
 
-# ...or skip the browser download and import the cookie from Chrome you're
-# already logged into avios.com with:
+Prefer not to open a browser? Import the cookie from a Chrome you're already logged
+into avios.com with:
+
+```bash
 uvx --from 'avios-cli[login]' avios login --from-browser
 ```
 
-If you installed with `pip install "avios-cli[login]"`, just run `avios login`
-(and `playwright install chromium` once). Plain `uvx avios-cli login` won't work —
-the isolated environment doesn't include the `login` extra.
+Plain `uvx avios-cli login` won't work — the isolated environment doesn't include
+the `login` extra.
 
 Your session cookie is stored at `~/.config/avios/state.json` (mode `600`). It
 expires after ~a day; just run `avios login` again. Run `avios logout` to remove it.

{avios_cli-0.1.2 → avios_cli-0.1.3}/src/avios/__init__.py

@@ -3,4 +3,4 @@
 View your Avios balance, transactions and account details from the terminal.
 """
 
-__version__ = "0.1.2"
+__version__ = "0.1.3"

{avios_cli-0.1.2 → avios_cli-0.1.3}/src/avios/auth.py

@@ -20,10 +20,12 @@ from __future__ import annotations
 from collections.abc import Callable, Iterable
 from typing import Any, Protocol
 
+from avios import endpoints
 from avios.session import Session
 
 DASHBOARD_PATH = "/manage-avios/dashboard"
 LOGIN_TIMEOUT_MS = 300_000  # 5 minutes to complete password + captcha + MFA
+LOGIN_POLL_MS = 2_000  # how often to check whether the session is authenticated
 SUPPORTED_BROWSERS = ("chrome", "firefox", "edge", "brave", "safari", "chromium")
 
 
@@ -51,46 +53,78 @@ def login_via_browser(
     *,
     headless: bool = False,
     timeout_ms: int = LOGIN_TIMEOUT_MS,
+    playwright_factory: Any = None,
 ) -> int:
-    """Open a browser, wait for the user to log in, and save the session cookie.
+    """Open a browser, wait until the user is actually logged in, save the cookie.
 
-    Returns the number of avios.com cookies captured.
+    Returns the number of avios.com cookies captured. ``playwright_factory`` is an
+    injection point for tests; production uses the real ``sync_playwright``.
     """
     session = session or Session()
+    factory = playwright_factory or _import_sync_playwright()
+    base_url = session.settings.base_url
+
+    with factory() as pw:
+        browser = _launch_browser(pw, headless=headless)
+        ctx = browser.new_context(user_agent=session.settings.user_agent)
+        page = ctx.new_page()
+        page.goto(f"{base_url}{DASHBOARD_PATH}")
+        authed = _wait_for_auth(ctx, page, base_url, timeout_ms)
+        cookies = list(ctx.cookies())
+        browser.close()
+
+    if not authed:
+        raise LoginError("Timed out waiting for login. Run `avios login` again.")
+    session.save_cookies(cookies)
+    return len(_only_avios(cookies))
+
+
+def _import_sync_playwright() -> Any:
     try:
         from playwright.sync_api import sync_playwright
     except ImportError as exc:
         raise LoginError(
             "Playwright isn't installed. Log in using the 'login' extra:\n"
             "  uvx --from 'avios-cli[login]' avios login\n"
-            "  (first time only: uvx --from 'avios-cli[login]' playwright install chromium)\n"
+            "  (first time only: uvx --from playwright playwright install chromium)\n"
             "Or import the cookie from Chrome instead (no browser download):\n"
             "  uvx --from 'avios-cli[login]' avios login --from-browser"
         ) from exc
+    return sync_playwright
 
-    base_url = session.settings.base_url
-    with sync_playwright() as pw:  # pragma: no cover - requires a real browser
-        try:
-            browser = pw.chromium.launch(headless=headless)
-        except Exception as exc:
-            raise LoginError(
-                "Couldn't launch Chromium. Install the browser once with:\n"
-                "  uvx --from 'avios-cli[login]' playwright install chromium"
-            ) from exc
-        ctx = browser.new_context(user_agent=session.settings.user_agent)
-        page = ctx.new_page()
-        page.goto(f"{base_url}{DASHBOARD_PATH}")
-        try:
-            page.wait_for_url("**/manage-avios/**", timeout=timeout_ms)
-            page.wait_for_timeout(1500)  # let the session cookie settle
-        except Exception as exc:
-            browser.close()
-            raise LoginError("Did not reach the dashboard in time. Please try again.") from exc
-        cookies = list(ctx.cookies())
-        browser.close()
 
-    session.save_cookies(cookies)
-    return len(_only_avios(cookies))
+def _wait_for_auth(ctx: Any, page: Any, base_url: str, timeout_ms: int) -> bool:
+    """Poll the auth endpoint until the session is authenticated (or time out).
+
+    The dashboard is a client-side SPA, so its URL is NOT a reliable signal — it
+    matches the moment we navigate, before login. ``/auth-gateway/user`` returns
+    401 until logged in, then 200.
+    """
+    for _ in range(max(1, timeout_ms // LOGIN_POLL_MS)):
+        if _is_authenticated(ctx, base_url):
+            return True
+        page.wait_for_timeout(LOGIN_POLL_MS)
+    return False
+
+
+def _is_authenticated(ctx: Any, base_url: str) -> bool:
+    try:
+        return bool(ctx.request.get(f"{base_url}{endpoints.AUTH_USER}").ok)
+    except Exception:
+        return False
+
+
+def _launch_browser(pw: Any, *, headless: bool) -> Any:
+    """Launch the user's system Chrome if available, else bundled Chromium."""
+    for kwargs in ({"channel": "chrome"}, {}):
+        try:
+            return pw.chromium.launch(headless=headless, **kwargs)
+        except Exception:
+            continue
+    raise LoginError(
+        "Couldn't launch a browser. Install Chromium once with:\n"
+        "  uvx --from playwright playwright install chromium"
+    )
 
 
 def _default_loader(browser: str) -> Callable[[], Iterable[_RawCookie]]:

{avios_cli-0.1.2 → avios_cli-0.1.3}/src/avios/cli.py

@@ -110,7 +110,8 @@ def login(
         else:
             console.print(
                 "Opening a browser — log in normally (password, captcha, SMS code). "
-                "I'll capture the session once you reach the dashboard."
+                "Keep the window open; it waits until you reach the dashboard, then "
+                "captures your session automatically."
             )
             count = login_via_browser(session, headless=headless)
     except LoginError as exc:

{avios_cli-0.1.2 → avios_cli-0.1.3}/src/avios/endpoints.py

@@ -11,6 +11,10 @@ BALANCE = "/en-GB/spend-avios/api/avios-balance"
 # Balance under the manage-avios API — kept as a fallback.
 BALANCE_ALT = "/manage-avios/api/user/current/balance"
 
+# Auth-gateway endpoint: 401 when unauthenticated, 200 once logged in. Used as the
+# "is the browser session authenticated yet?" signal during login.
+AUTH_USER = "/auth-gateway/user"
+
 PROFILE = "/manage-avios/api/user/current"
 OVERVIEW = "/manage-avios/api/user/current/dashboard-overview"
 TRANSACTIONS = "/manage-avios/api/user/current/transactions"

avios_cli-0.1.3/tests/test_auth.py

@@ -0,0 +1,243 @@
+"""Tests for the login helpers.
+
+The Playwright browser flow can't be automated (Auth0 + hCaptcha + MFA need a
+human), so we test the cookie-conversion/import helpers and the missing-dependency
+paths. ``browser_cookie3`` is faked via ``sys.modules`` so tests don't depend on
+the optional ``login`` extra or a real browser profile.
+"""
+
+from __future__ import annotations
+
+import sys
+import types
+
+import pytest
+
+from avios.auth import (
+    LoginError,
+    _default_loader,
+    _only_avios,
+    _to_cookie_dicts,
+    import_from_browser,
+    login_via_browser,
+)
+from avios.config import Settings
+from avios.session import Session
+
+
+class FakeCookie:
+    def __init__(self, name: str, value: str, domain: str) -> None:
+        self.name = name
+        self.value = value
+        self.domain = domain
+
+
+def _session(settings: Settings) -> Session:
+    return Session(settings)
+
+
+def test_to_cookie_dicts() -> None:
+    raw = [FakeCookie("appSession", "abc", "www.avios.com")]
+    assert _to_cookie_dicts(raw) == [
+        {"name": "appSession", "value": "abc", "domain": "www.avios.com"}
+    ]
+
+
+def test_only_avios_filters_foreign_domains() -> None:
+    cookies = [
+        {"name": "appSession", "value": "abc", "domain": "www.avios.com"},
+        {"name": "_ga", "value": "junk", "domain": ".google.com"},
+    ]
+    assert _only_avios(cookies) == [cookies[0]]
+
+
+def test_import_from_browser_saves_only_avios(settings: Settings) -> None:
+    session = _session(settings)
+    count = import_from_browser(
+        session,
+        loader=lambda: [
+            FakeCookie("appSession", "abc", "www.avios.com"),
+            FakeCookie("_ga", "junk", ".google.com"),
+        ],
+    )
+    assert count == 1
+    assert session.is_authenticated()
+    assert session.load_cookies() == [
+        {"name": "appSession", "value": "abc", "domain": "www.avios.com"}
+    ]
+
+
+def test_import_from_browser_no_cookies_raises(settings: Settings) -> None:
+    with pytest.raises(LoginError, match="No avios.com cookies"):
+        import_from_browser(_session(settings), loader=lambda: [FakeCookie("_ga", "j", ".x.com")])
+
+
+def _fake_bc3(monkeypatch: pytest.MonkeyPatch, **funcs: object) -> None:
+    module = types.ModuleType("browser_cookie3")
+    for name, fn in funcs.items():
+        setattr(module, name, fn)
+    monkeypatch.setitem(sys.modules, "browser_cookie3", module)
+
+
+def test_default_loader_passes_domain(monkeypatch: pytest.MonkeyPatch) -> None:
+    seen: dict[str, str] = {}
+
+    def chrome(**kwargs: str) -> list[FakeCookie]:
+        seen.update(kwargs)
+        return [FakeCookie("appSession", "x", "www.avios.com")]
+
+    _fake_bc3(monkeypatch, chrome=chrome)
+    loader = _default_loader("chrome")
+    cookies = list(loader())
+    assert seen["domain_name"] == "avios.com"
+    assert cookies[0].name == "appSession"
+
+
+def test_default_loader_unknown_browser(monkeypatch: pytest.MonkeyPatch) -> None:
+    _fake_bc3(monkeypatch, chrome=lambda **k: [])
+    with pytest.raises(LoginError, match="Unknown browser"):
+        _default_loader("nope")
+
+
+def test_login_via_browser_without_playwright(
+    settings: Settings, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    monkeypatch.setitem(sys.modules, "playwright", None)
+    monkeypatch.setitem(sys.modules, "playwright.sync_api", None)
+    with pytest.raises(LoginError, match="Playwright isn't installed"):
+        login_via_browser(_session(settings))
+
+
+# --- fake Playwright, to exercise the poll-until-authenticated flow --------------
+class _FakeResponse:
+    def __init__(self, ok: bool) -> None:
+        self.ok = ok
+
+
+class _FakeRequest:
+    """Auth endpoint returns 401 until `ok_after` calls, then 200."""
+
+    def __init__(self, ok_after: int) -> None:
+        self.ok_after = ok_after
+        self.calls = 0
+
+    def get(self, url: str) -> _FakeResponse:
+        self.calls += 1
+        return _FakeResponse(self.calls >= self.ok_after)
+
+
+class _FakePage:
+    def goto(self, url: str) -> None:
+        pass
+
+    def wait_for_timeout(self, ms: int) -> None:
+        pass
+
+
+class _FakeContext:
+    def __init__(self, ok_after: int, cookies: list[dict[str, str]]) -> None:
+        self.request = _FakeRequest(ok_after)
+        self._cookies = cookies
+
+    def new_page(self) -> _FakePage:
+        return _FakePage()
+
+    def cookies(self) -> list[dict[str, str]]:
+        return self._cookies
+
+
+class _FakeBrowser:
+    def __init__(self, ctx: _FakeContext) -> None:
+        self._ctx = ctx
+        self.closed = False
+
+    def new_context(self, **kwargs: object) -> _FakeContext:
+        return self._ctx
+
+    def close(self) -> None:
+        self.closed = True
+
+
+class _FakePlaywright:
+    def __init__(self, browser: _FakeBrowser) -> None:
+        self.chromium = _FakeChromium(browser)
+
+
+class _FakeChromium:
+    def __init__(self, browser: _FakeBrowser) -> None:
+        self._browser = browser
+        self.launches: list[str | None] = []
+
+    def launch(self, **kwargs: object) -> _FakeBrowser:
+        self.launches.append(kwargs.get("channel"))  # type: ignore[arg-type]
+        return self._browser
+
+
+class _FakeFactory:
+    """Callable that returns a context manager yielding a fake Playwright."""
+
+    def __init__(self, browser: _FakeBrowser) -> None:
+        self._pw = _FakePlaywright(browser)
+
+    def __call__(self) -> _FakeFactory:
+        return self
+
+    def __enter__(self) -> _FakePlaywright:
+        return self._pw
+
+    def __exit__(self, *args: object) -> bool:
+        return False
+
+
+def test_login_captures_only_after_authenticated(settings: Settings) -> None:
+    cookies = [
+        {"name": "appSession", "value": "x", "domain": "www.avios.com"},
+        {"name": "_ga", "value": "junk", "domain": ".google.com"},
+    ]
+    ctx = _FakeContext(ok_after=3, cookies=cookies)
+    browser = _FakeBrowser(ctx)
+    session = _session(settings)
+
+    count = login_via_browser(session, timeout_ms=100_000, playwright_factory=_FakeFactory(browser))
+
+    assert count == 1  # only the avios cookie
+    assert session.load_cookies() == cookies
+    assert browser.closed
+    assert ctx.request.calls >= 3  # polled until authenticated, not immediately
+
+
+def test_login_times_out_without_saving(settings: Settings) -> None:
+    ctx = _FakeContext(
+        ok_after=999, cookies=[{"name": "appSession", "value": "x", "domain": "www.avios.com"}]
+    )
+    browser = _FakeBrowser(ctx)
+    session = _session(settings)
+
+    with pytest.raises(LoginError, match="Timed out"):
+        login_via_browser(session, timeout_ms=6_000, playwright_factory=_FakeFactory(browser))
+
+    assert session.is_authenticated() is False  # nothing saved on timeout
+    assert browser.closed
+
+
+def test_launch_browser_prefers_chrome_then_falls_back() -> None:
+    from avios.auth import _launch_browser
+
+    class Chromium:
+        def __init__(self) -> None:
+            self.channels: list[str | None] = []
+
+        def launch(self, **kwargs: object) -> str:
+            channel = kwargs.get("channel")
+            self.channels.append(channel)  # type: ignore[arg-type]
+            if channel == "chrome":
+                raise RuntimeError("no system chrome")
+            return "browser"
+
+    class PW:
+        def __init__(self) -> None:
+            self.chromium = Chromium()
+
+    pw = PW()
+    assert _launch_browser(pw, headless=True) == "browser"
+    assert pw.chromium.channels == ["chrome", None]

avios_cli-0.1.2/tests/test_auth.py

@@ -1,108 +0,0 @@
-"""Tests for the login helpers.
-
-The Playwright browser flow can't be automated (Auth0 + hCaptcha + MFA need a
-human), so we test the cookie-conversion/import helpers and the missing-dependency
-paths. ``browser_cookie3`` is faked via ``sys.modules`` so tests don't depend on
-the optional ``login`` extra or a real browser profile.
-"""
-
-from __future__ import annotations
-
-import sys
-import types
-
-import pytest
-
-from avios.auth import (
-    LoginError,
-    _default_loader,
-    _only_avios,
-    _to_cookie_dicts,
-    import_from_browser,
-    login_via_browser,
-)
-from avios.config import Settings
-from avios.session import Session
-
-
-class FakeCookie:
-    def __init__(self, name: str, value: str, domain: str) -> None:
-        self.name = name
-        self.value = value
-        self.domain = domain
-
-
-def _session(settings: Settings) -> Session:
-    return Session(settings)
-
-
-def test_to_cookie_dicts() -> None:
-    raw = [FakeCookie("appSession", "abc", "www.avios.com")]
-    assert _to_cookie_dicts(raw) == [
-        {"name": "appSession", "value": "abc", "domain": "www.avios.com"}
-    ]
-
-
-def test_only_avios_filters_foreign_domains() -> None:
-    cookies = [
-        {"name": "appSession", "value": "abc", "domain": "www.avios.com"},
-        {"name": "_ga", "value": "junk", "domain": ".google.com"},
-    ]
-    assert _only_avios(cookies) == [cookies[0]]
-
-
-def test_import_from_browser_saves_only_avios(settings: Settings) -> None:
-    session = _session(settings)
-    count = import_from_browser(
-        session,
-        loader=lambda: [
-            FakeCookie("appSession", "abc", "www.avios.com"),
-            FakeCookie("_ga", "junk", ".google.com"),
-        ],
-    )
-    assert count == 1
-    assert session.is_authenticated()
-    assert session.load_cookies() == [
-        {"name": "appSession", "value": "abc", "domain": "www.avios.com"}
-    ]
-
-
-def test_import_from_browser_no_cookies_raises(settings: Settings) -> None:
-    with pytest.raises(LoginError, match="No avios.com cookies"):
-        import_from_browser(_session(settings), loader=lambda: [FakeCookie("_ga", "j", ".x.com")])
-
-
-def _fake_bc3(monkeypatch: pytest.MonkeyPatch, **funcs: object) -> None:
-    module = types.ModuleType("browser_cookie3")
-    for name, fn in funcs.items():
-        setattr(module, name, fn)
-    monkeypatch.setitem(sys.modules, "browser_cookie3", module)
-
-
-def test_default_loader_passes_domain(monkeypatch: pytest.MonkeyPatch) -> None:
-    seen: dict[str, str] = {}
-
-    def chrome(**kwargs: str) -> list[FakeCookie]:
-        seen.update(kwargs)
-        return [FakeCookie("appSession", "x", "www.avios.com")]
-
-    _fake_bc3(monkeypatch, chrome=chrome)
-    loader = _default_loader("chrome")
-    cookies = list(loader())
-    assert seen["domain_name"] == "avios.com"
-    assert cookies[0].name == "appSession"
-
-
-def test_default_loader_unknown_browser(monkeypatch: pytest.MonkeyPatch) -> None:
-    _fake_bc3(monkeypatch, chrome=lambda **k: [])
-    with pytest.raises(LoginError, match="Unknown browser"):
-        _default_loader("nope")
-
-
-def test_login_via_browser_without_playwright(
-    settings: Settings, monkeypatch: pytest.MonkeyPatch
-) -> None:
-    monkeypatch.setitem(sys.modules, "playwright", None)
-    monkeypatch.setitem(sys.modules, "playwright.sync_api", None)
-    with pytest.raises(LoginError, match="Playwright isn't installed"):
-        login_via_browser(_session(settings))