avios-cli 0.2.1__tar.gz → 0.4.1__tar.gz

{avios_cli-0.2.1 → avios_cli-0.4.1}/CHANGELOG.md

@@ -6,6 +6,66 @@ to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [0.4.1] - 2026-07-27
+
+### Fixed
+- **Finnair balance/transactions failed with 403 immediately after login.** Login
+  captured the API key from the first `api.finnair.com` request (`getgauth`), which
+  uses a *different* `x-api-key` than the loyalty balance/transactions endpoints —
+  so every data call sent the wrong key and was refused. Login now captures
+  credentials only from a loyalty API request (`/d/loyalty-service/legacy/current/api/`),
+  which carries the key those endpoints accept. Fixes #28.
+- A Finnair `403 Forbidden` is no longer mislabelled "session expired"; the message
+  now names the real cause (likely a stale/wrong API key) and includes the response.
+  Fixes #29.
+
+## [0.4.0] - 2026-07-27
+
+### Added
+- **British Airways reward-flight availability.** `avios flights ORIGIN DEST`
+  supports exact-date and month-calendar searches, cabin/passenger filters,
+  available-only output by default, `--show-unavailable`, and scriptable JSON.
+- Return journeys run two independent one-way searches with the route reversed
+  for the inbound leg.
+- Typed reward calendar, day, flight, and cabin-availability models plus an
+  isolated parser for avios.com's authenticated React Server Components stream.
+- The Textual app now has Dashboard and Reward Flights tabs. The search tab keeps
+  network work off the event loop and renders outbound/inbound results separately.
+
+### Changed
+- BA browser-assisted login warms the separate `spend-avios` flight-search app
+  before saving cookies.
+
+### Security
+- Reward-search action tokens from the private RSC response are ignored and never
+  stored; tests use a small sanitized fixture rather than the captured HAR.
+
+## [0.3.0] - 2026-07-27
+
+### Added
+- **Multiple accounts, one per programme.** Log into several Avios programmes and
+  keep their sessions side by side: `avios login [programme]` (default `ba`),
+  `avios logout [programme]` (or `avios logout` for all), and a new `avios accounts`
+  roster showing each balance and status. Programmes: British Airways (`ba`),
+  Iberia (`iberia`), Aer Lingus (`aerlingus`), Finnair Plus (`finnair`).
+- **Combined views.** `balance` sums every account into a combined total (a single
+  account keeps the individual/household detail); `transactions`/`pending` merge
+  across accounts newest-first with a Programme column. `--account/-a` filters any
+  data command to one programme.
+- **Multi-account TUI.** `avios tui` shows a combined balance header (per-programme
+  breakdown) and a Programme column, loading every account concurrently.
+- **Finnair Plus** via Finnair's CAS/OAuth browser login + loyalty API (balance,
+  profile, transactions); token-backed account storage alongside cookie accounts.
+- Programme-aware browser login (per-programme login URL + isolated Chrome profile)
+  and a shared, backend-aware aggregation layer (`aggregate.py`) used by the CLI
+  and TUI. Per-account failures are captured, so one expired session never hides
+  the others.
+
+### Changed
+- Sessions are now stored per programme at `~/.config/avios/accounts/<programme>.json`
+  (mode `600`); the old single `state.json` is migrated to `accounts/ba.json` on
+  first run.
+
 ## [0.2.1] - 2026-07-27
 
 ### Fixed
@@ -127,7 +187,10 @@ to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 - Reward-flight **availability** search is not yet implemented (needs a British
   Airways capture).
 
-[Unreleased]: https://github.com/alexechoi/avios-cli/compare/v0.2.1...HEAD
+[Unreleased]: https://github.com/alexechoi/avios-cli/compare/v0.4.1...HEAD
+[0.4.1]: https://github.com/alexechoi/avios-cli/compare/v0.4.0...v0.4.1
+[0.4.0]: https://github.com/alexechoi/avios-cli/compare/v0.3.0...v0.4.0
+[0.3.0]: https://github.com/alexechoi/avios-cli/compare/v0.2.1...v0.3.0
 [0.2.1]: https://github.com/alexechoi/avios-cli/compare/v0.2.0...v0.2.1
 [0.2.0]: https://github.com/alexechoi/avios-cli/compare/v0.1.6...v0.2.0
 [0.1.6]: https://github.com/alexechoi/avios-cli/compare/v0.1.5...v0.1.6

{avios_cli-0.2.1 → avios_cli-0.4.1}/PKG-INFO

@@ -1,7 +1,7 @@
 Metadata-Version: 2.4
 Name: avios-cli
-Version: 0.2.1
-Summary: A CLI and TUI for avios.com — view your Avios balance and transactions from the terminal.
+Version: 0.4.1
+Summary: A CLI and TUI for Avios balances, transactions, and BA reward-flight availability.
 Project-URL: Homepage, https://github.com/alexechoi/avios-cli
 Project-URL: Repository, https://github.com/alexechoi/avios-cli
 Project-URL: Issues, https://github.com/alexechoi/avios-cli/issues
@@ -39,18 +39,24 @@ Description-Content-Type: text/markdown
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
 [![Python](https://img.shields.io/badge/python-3.10%2B-blue.svg)](https://www.python.org/)
 
-A **CLI and TUI for [avios.com](https://www.avios.com)** — check your Avios balance,
-browse your transactions and manage your account without leaving the terminal.
+A **CLI and TUI for your Avios programmes** — check balances, browse transactions,
+and search British Airways reward-flight availability without leaving the terminal.
+British Airways, Iberia, and Aer Lingus use avios.com; Finnair Plus uses Finnair's
+own OAuth and loyalty API.
 
 > ⚠️ **Unofficial.** This project is not affiliated with, authorised by, or endorsed by
-> Avios, British Airways or IAG Loyalty. It drives the same private endpoints the
-> avios.com website uses, with your own logged-in session. Use at your own risk; it may
-> break at any time and may be against the provider's terms of service.
+> Avios, British Airways, Finnair or IAG Loyalty. It drives the same private endpoints
+> the providers' websites use, with your own logged-in session. Use at your own risk;
+> it may break at any time and may be against the provider's terms of service.
 
 ![avios TUI dashboard](docs/dashboard.svg)
 
 <sub>The <code>avios tui</code> dashboard (demo data). Regenerate with <code>uv run python scripts/screenshot.py</code>.</sub>
 
+![avios reward-flight search](docs/reward-flights.svg)
+
+<sub>Direct BA reward-seat availability by date and cabin (synthetic demo data).</sub>
+
 ## Status
 
 Early alpha, built in the open. See the [roadmap](#roadmap).
@@ -84,6 +90,7 @@ on the dashboard. It needs the **`login` extra**:
 
 ```bash
 uvx --from 'avios-cli[login]' avios login
+uvx --from 'avios-cli[login]' avios login finnair
 ```
 
 It launches your installed **Google Chrome** (no extra download). If you don't have
@@ -113,22 +120,42 @@ browser. Use `--from-browser` instead: log into avios.com in your normal Chrome
 (you'll get one normal captcha), then run
 `uvx --from 'avios-cli[login]' avios login --from-browser`.
 
-Your session cookie is stored at `~/.config/avios/state.json` (mode `600`). It
-expires after ~a day; just run `avios login` again. Run `avios logout` to remove it.
+Finnair uses a different CAS/OAuth flow. `avios login finnair` opens the Finnair Plus
+balance page, lets you complete password and MFA in the real browser, and captures the
+OAuth session from the authenticated loyalty request. `--from-browser` is not available
+for Finnair because browser-cookie import cannot read that token.
+
+Each programme session is stored at `~/.config/avios/accounts/<programme>.json`
+(mode `600`). Sessions expire; just log in to that programme again. Use
+`avios logout <programme>` for one account or `avios logout` for all accounts.
+For BA, browser-assisted login also opens the reward-flight finder briefly so its
+separate `spend-avios` session is captured.
 
 ## Usage
 
+Commands span **all logged-in accounts** by default and show a combined total; add
+`--account/-a <programme>` to focus on one.
+
 ```bash
-avios balance                  # total / individual / household Avios
-avios transactions --limit 20  # recent transactions (date, description, Avios, type)
-avios pending                  # pending Avios
+avios accounts                 # every logged-in account: balance + status
+avios balance                  # per-account balances + combined total
+avios transactions --limit 20  # recent transactions, merged across accounts
+avios pending                  # pending Avios, merged across accounts
+avios balance --account iberia # just one programme
 avios overview                 # dashboard summary
 avios whoami                   # name, tier, membership, email
 avios raw /shell/api/users/current/accounts   # hit any endpoint directly
+
+# Direct British Airways reward-seat availability:
+avios flights LON ABZ --date 2026-11-05
+avios flights LON ABZ --date 2026-11-05 --return-date 2026-11-12
+avios flights LON ABZ --month 2026-11 --cabin economy --cabin business
+avios flights LON ABZ --month 2026-11 --return-month 2026-12 --json
 ```
 
-Add `--json` to `balance`, `transactions`, `pending` or `whoami` for scriptable
-output. Non-BA Avios programmes can set `AVIOS_OPCO` (default `BAEC`).
+Add `--json` to `accounts`, `balance`, `transactions`, `pending`, `whoami`, or
+`flights` for scriptable output. With a single account, `balance` keeps the
+individual/household breakdown.
 
 ## TUI
 
@@ -136,8 +163,19 @@ output. Non-BA Avios programmes can set `AVIOS_OPCO` (default `BAEC`).
 avios tui
 ```
 
-A full-screen dashboard: your balance in the header and a scrollable transactions
-table. Press `r` to refresh, `q` to quit.
+A tabbed full-screen application:
+
+- **Dashboard** — combined balance header and transactions across every account.
+- **Reward Flights** — BA date/calendar search with optional reverse-route return,
+  cabin/passenger controls, and independent outbound/inbound result tables.
+
+Press `r` to refresh the dashboard and `q` to quit. Reward searches run only when
+you press Search or Enter.
+
+Reward search is an unofficial, availability-only view. It currently supports
+direct BA flights, three-letter airport/city codes, and seat counts by cabin. It
+does not price, book, or show taxes/fees or connecting flights. Return journeys
+are two independent one-way searches.
 
 ## Roadmap
 
@@ -147,7 +185,8 @@ table. Press `r` to refresh, `q` to quit.
 - [x] Browser-assisted `avios login`
 - [x] CLI commands
 - [x] Textual TUI dashboard
-- [ ] Reward-flight **availability** search _(coming soon — needs a British Airways capture)_
+- [x] Multiple accounts (BA, Iberia, Aer Lingus, Finnair) with combined views
+- [x] British Airways reward-flight **availability** search (CLI + TUI)
 
 ## Development
 
@@ -163,8 +202,9 @@ See [CONTRIBUTING.md](CONTRIBUTING.md) for the full workflow and
 
 ## Security
 
-No passwords are handled or stored — only your session cookie, kept locally at
-`~/.config/avios/state.json` (mode `600`). See [SECURITY.md](SECURITY.md).
+No passwords are handled or stored — only programme session cookies or OAuth tokens,
+kept locally under `~/.config/avios/accounts/` (mode `600`). See
+[SECURITY.md](SECURITY.md).
 
 ## License
 

avios_cli-0.4.1/README.md

@@ -0,0 +1,176 @@
+# avios-cli
+
+[![CI](https://github.com/alexechoi/avios-cli/actions/workflows/ci.yml/badge.svg)](https://github.com/alexechoi/avios-cli/actions/workflows/ci.yml)
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
+[![Python](https://img.shields.io/badge/python-3.10%2B-blue.svg)](https://www.python.org/)
+
+A **CLI and TUI for your Avios programmes** — check balances, browse transactions,
+and search British Airways reward-flight availability without leaving the terminal.
+British Airways, Iberia, and Aer Lingus use avios.com; Finnair Plus uses Finnair's
+own OAuth and loyalty API.
+
+> ⚠️ **Unofficial.** This project is not affiliated with, authorised by, or endorsed by
+> Avios, British Airways, Finnair or IAG Loyalty. It drives the same private endpoints
+> the providers' websites use, with your own logged-in session. Use at your own risk;
+> it may break at any time and may be against the provider's terms of service.
+
+![avios TUI dashboard](docs/dashboard.svg)
+
+<sub>The <code>avios tui</code> dashboard (demo data). Regenerate with <code>uv run python scripts/screenshot.py</code>.</sub>
+
+![avios reward-flight search](docs/reward-flights.svg)
+
+<sub>Direct BA reward-seat availability by date and cabin (synthetic demo data).</sub>
+
+## Status
+
+Early alpha, built in the open. See the [roadmap](#roadmap).
+
+## Install
+
+Requires Python 3.10+.
+
+```bash
+uvx avios-cli --help     # run without installing
+# or install it, then use the `avios` command:
+pip install avios-cli
+avios --help
+```
+
+Or from source, for development:
+
+```bash
+git clone https://github.com/alexechoi/avios-cli
+cd avios-cli
+uv sync
+uv run avios --help
+```
+
+## Log in
+
+avios.com has no credential API — login is Auth0 Universal Login behind hCaptcha and
+SMS/passkey MFA — so `avios login` opens a real browser, **waits while you finish
+logging in** (password, captcha, SMS code), and captures the session once you land
+on the dashboard. It needs the **`login` extra**:
+
+```bash
+uvx --from 'avios-cli[login]' avios login
+uvx --from 'avios-cli[login]' avios login finnair
+```
+
+It launches your installed **Google Chrome** (no extra download). If you don't have
+Chrome, install Playwright's browser once with
+`uvx --from playwright playwright install chromium`.
+
+Prefer not to open a browser? Import the cookie from a Chrome you're already logged
+into avios.com with:
+
+```bash
+uvx --from 'avios-cli[login]' avios login --from-browser
+```
+
+This scans **all your Chrome profiles** and uses whichever one is actually logged
+into avios.com (it tells you which). If you have several profiles, you can target
+one directly:
+
+```bash
+uvx --from 'avios-cli[login]' avios login --from-browser --profile "Profile 1"
+```
+
+Plain `uvx avios-cli login` won't work — the isolated environment doesn't include
+the `login` extra.
+
+**Stuck in an endless captcha loop?** That's bot detection on the automated
+browser. Use `--from-browser` instead: log into avios.com in your normal Chrome
+(you'll get one normal captcha), then run
+`uvx --from 'avios-cli[login]' avios login --from-browser`.
+
+Finnair uses a different CAS/OAuth flow. `avios login finnair` opens the Finnair Plus
+balance page, lets you complete password and MFA in the real browser, and captures the
+OAuth session from the authenticated loyalty request. `--from-browser` is not available
+for Finnair because browser-cookie import cannot read that token.
+
+Each programme session is stored at `~/.config/avios/accounts/<programme>.json`
+(mode `600`). Sessions expire; just log in to that programme again. Use
+`avios logout <programme>` for one account or `avios logout` for all accounts.
+For BA, browser-assisted login also opens the reward-flight finder briefly so its
+separate `spend-avios` session is captured.
+
+## Usage
+
+Commands span **all logged-in accounts** by default and show a combined total; add
+`--account/-a <programme>` to focus on one.
+
+```bash
+avios accounts                 # every logged-in account: balance + status
+avios balance                  # per-account balances + combined total
+avios transactions --limit 20  # recent transactions, merged across accounts
+avios pending                  # pending Avios, merged across accounts
+avios balance --account iberia # just one programme
+avios overview                 # dashboard summary
+avios whoami                   # name, tier, membership, email
+avios raw /shell/api/users/current/accounts   # hit any endpoint directly
+
+# Direct British Airways reward-seat availability:
+avios flights LON ABZ --date 2026-11-05
+avios flights LON ABZ --date 2026-11-05 --return-date 2026-11-12
+avios flights LON ABZ --month 2026-11 --cabin economy --cabin business
+avios flights LON ABZ --month 2026-11 --return-month 2026-12 --json
+```
+
+Add `--json` to `accounts`, `balance`, `transactions`, `pending`, `whoami`, or
+`flights` for scriptable output. With a single account, `balance` keeps the
+individual/household breakdown.
+
+## TUI
+
+```bash
+avios tui
+```
+
+A tabbed full-screen application:
+
+- **Dashboard** — combined balance header and transactions across every account.
+- **Reward Flights** — BA date/calendar search with optional reverse-route return,
+  cabin/passenger controls, and independent outbound/inbound result tables.
+
+Press `r` to refresh the dashboard and `q` to quit. Reward searches run only when
+you press Search or Enter.
+
+Reward search is an unofficial, availability-only view. It currently supports
+direct BA flights, three-letter airport/city codes, and seat counts by cabin. It
+does not price, book, or show taxes/fees or connecting flights. Return journeys
+are two independent one-way searches.
+
+## Roadmap
+
+- [x] Project scaffolding, packaging and CI
+- [x] Session + cookie storage layer
+- [x] Typed API client (balance, transactions, accounts, profile)
+- [x] Browser-assisted `avios login`
+- [x] CLI commands
+- [x] Textual TUI dashboard
+- [x] Multiple accounts (BA, Iberia, Aer Lingus, Finnair) with combined views
+- [x] British Airways reward-flight **availability** search (CLI + TUI)
+
+## Development
+
+```bash
+uv sync            # installs the project + the `dev` dependency-group
+uv run ruff check .
+uv run mypy src
+uv run pytest
+```
+
+See [CONTRIBUTING.md](CONTRIBUTING.md) for the full workflow and
+[CHANGELOG.md](CHANGELOG.md) for release notes.
+
+## Security
+
+No passwords are handled or stored — only programme session cookies or OAuth tokens,
+kept locally under `~/.config/avios/accounts/` (mode `600`). See
+[SECURITY.md](SECURITY.md).
+
+## License
+
+[MIT](LICENSE)

avios_cli-0.4.1/SECURITY.md

@@ -0,0 +1,32 @@
+# Security Policy
+
+## How avios-cli handles your credentials
+
+- **No passwords are ever handled or stored.** Login happens in a real browser
+  (the programme's normal login and MFA); avios-cli only captures the resulting
+  **session cookie or OAuth token**.
+- Sessions are stored locally under `~/.config/avios/accounts/` with file mode
+  `600` (owner read/write only). Each credential is sent only to its programme's
+  API in the requests you make.
+- `avios logout` deletes stored sessions. They also expire on the server side.
+- `AVIOS_COOKIE` may be set to supply a cookie via the environment instead of the
+  stored file — avoid committing it or storing it in shell history.
+- Reward-flight search sends the same saved BA cookie only to `www.avios.com`.
+  The RSC response's short-lived action tokens are neither exposed nor persisted.
+
+## Unofficial software
+
+avios-cli is **not affiliated with Avios, British Airways, Finnair or IAG
+Loyalty** and uses private, undocumented endpoints. Using it may breach the
+provider's terms of service and could affect your account. Use at your own risk.
+
+## Reporting a vulnerability
+
+Please **do not** open a public issue for security problems. Instead, use GitHub's
+private vulnerability reporting:
+**Security → Report a vulnerability** on the repository, or open a private draft
+advisory. We'll acknowledge within a few days.
+
+## Supported versions
+
+This is pre-1.0 software; only the latest release on `main` is supported.