blog-cli 0.2.4__tar.gz → 0.3.0__tar.gz

{blog_cli-0.2.4 → blog_cli-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: blog-cli
-Version: 0.2.4
+Version: 0.3.0
 Summary: Agent-friendly CLI for managing a blog. Create drafts, upload media, generate time-limited preview links.
 Author: tanaka-mambinge
 License: MIT
@@ -14,6 +14,7 @@ Classifier: Topic :: Internet :: WWW/HTTP
 Requires-Python: >=3.13
 Description-Content-Type: text/markdown
 Requires-Dist: httpx>=0.28
+Requires-Dist: keyring>=25
 Requires-Dist: typer>=0.16
 Provides-Extra: dev
 Requires-Dist: asgi-lifespan>=2.1; extra == "dev"

{blog_cli-0.2.4 → blog_cli-0.3.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "blog-cli"
-version = "0.2.4"
+version = "0.3.0"
 description = "Agent-friendly CLI for managing a blog. Create drafts, upload media, generate time-limited preview links."
 readme = "README.md"
 requires-python = ">=3.13"
@@ -19,6 +19,7 @@ classifiers = [
 ]
 dependencies = [
   "httpx>=0.28",
+  "keyring>=25",
   "typer>=0.16",
 ]
 

{blog_cli-0.2.4 → blog_cli-0.3.0}/src/blog_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: blog-cli
-Version: 0.2.4
+Version: 0.3.0
 Summary: Agent-friendly CLI for managing a blog. Create drafts, upload media, generate time-limited preview links.
 Author: tanaka-mambinge
 License: MIT
@@ -14,6 +14,7 @@ Classifier: Topic :: Internet :: WWW/HTTP
 Requires-Python: >=3.13
 Description-Content-Type: text/markdown
 Requires-Dist: httpx>=0.28
+Requires-Dist: keyring>=25
 Requires-Dist: typer>=0.16
 Provides-Extra: dev
 Requires-Dist: asgi-lifespan>=2.1; extra == "dev"

{blog_cli-0.2.4 → blog_cli-0.3.0}/src/blog_cli.egg-info/SOURCES.txt

@@ -10,6 +10,8 @@ src/personal_cli/__init__.py
 src/personal_cli/__main__.py
 src/personal_cli/cli.py
 src/personal_cli/client.py
+src/personal_cli/credentials.py
 src/personal_cli/formatting.py
+src/personal_cli/setup_server.py
 tests/test_cli.py
 tests/test_client.py

{blog_cli-0.2.4 → blog_cli-0.3.0}/src/blog_cli.egg-info/requires.txt

@@ -1,4 +1,5 @@
 httpx>=0.28
+keyring>=25
 typer>=0.16
 
 [dev]

{blog_cli-0.2.4 → blog_cli-0.3.0}/src/personal_cli/cli.py

@@ -3,22 +3,33 @@ from __future__ import annotations
 import asyncio
 import importlib.metadata
 from pathlib import Path
+from typing import Callable, TypeVar
 
 import typer
 
-from personal_cli.client import ArticleApiClient, CLIError, get_default_config
+from personal_cli.client import ArticleApiClient, CLIError, get_config
+from personal_cli.credentials import (
+    CredentialError,
+    CredentialStore,
+    MissingCredentialError,
+)
 from personal_cli.formatting import emit_result, read_markdown_from_source
+from personal_cli.setup_server import run_setup
 
 app = typer.Typer(help="Agent-facing article CLI.")
 article_app = typer.Typer(help="Manage articles.")
 blog_app = typer.Typer(help="Manage blog posts.")
 project_app = typer.Typer(help="Manage projects.")
 media_app = typer.Typer(help="Manage media uploads.")
+keys_app = typer.Typer(help="Manage stored credentials.")
 
 app.add_typer(article_app, name="article")
 article_app.add_typer(blog_app, name="blog")
 article_app.add_typer(project_app, name="project")
 app.add_typer(media_app, name="media")
+app.add_typer(keys_app, name="keys")
+
+Result = TypeVar("Result")
 
 
 def get_version() -> str:
@@ -33,8 +44,14 @@ def cli_version() -> None:
     typer.echo(get_version())
 
 
-def build_client(server_url: str | None = None, insecure: bool = False) -> ArticleApiClient:
-    url, api_key, _ = get_default_config()
+def _emit(message: str) -> None:
+    typer.echo(message, err=True)
+
+
+def build_client(
+    server_url: str | None = None, insecure: bool = False
+) -> ArticleApiClient:
+    url, api_key, _ = get_config()
     return ArticleApiClient(server_url or url, api_key=api_key, verify=not insecure)
 
 
@@ -42,6 +59,28 @@ def run(coro):
     return asyncio.run(coro)
 
 
+def _run(operation: Callable[[], Result]) -> Result:
+    """Run an operation, opening the setup page when credentials are missing/rejected."""
+    while True:
+        try:
+            return operation()
+        except MissingCredentialError:
+            run_setup(
+                CredentialStore(),
+                output=_emit,
+                prompt="Credentials are missing. Open this link in your browser",
+            )
+        except CLIError as exc:
+            if exc.status_code not in (401, 403):
+                raise
+            _emit("The server rejected the stored API key. Re-enter it in the setup page.")
+            run_setup(
+                CredentialStore(),
+                output=_emit,
+                prompt="Enter replacement credentials in your browser",
+            )
+
+
 @article_app.command("list")
 def article_list(
     type_filter: str = typer.Option("all", "--type", help="all, blog, or project."),
@@ -50,10 +89,13 @@ def article_list(
     insecure: bool = typer.Option(False, "--insecure", help="Skip SSL verification."),
     server_url: str | None = typer.Option(None, "--server-url", help="FastAPI base URL."),
 ) -> None:
-    try:
+    def _op() -> None:
         client = build_client(server_url, insecure=insecure)
         articles = run(client.list_articles(status=status, type_filter=type_filter))
         emit_result(articles, json_output=json_output)
+
+    try:
+        _run(_op)
     except CLIError as exc:
         typer.echo(str(exc), err=True)
         raise typer.Exit(code=1) from exc
@@ -66,10 +108,13 @@ def article_show(
     insecure: bool = typer.Option(False, "--insecure", help="Skip SSL verification."),
     server_url: str | None = typer.Option(None, "--server-url", help="FastAPI base URL."),
 ) -> None:
-    try:
+    def _op() -> None:
         client = build_client(server_url, insecure=insecure)
         article = run(client.get_article(slug))
         emit_result(article, json_output=json_output)
+
+    try:
+        _run(_op)
     except CLIError as exc:
         typer.echo(str(exc), err=True)
         raise typer.Exit(code=1) from exc
@@ -88,7 +133,7 @@ def blog_create(
     insecure: bool = typer.Option(False, "--insecure", help="Skip SSL verification."),
     server_url: str | None = typer.Option(None, "--server-url", help="FastAPI base URL."),
 ) -> None:
-    try:
+    def _op() -> None:
         body = read_markdown_from_source(markdown=markdown, markdown_file=markdown_file)
         client = build_client(server_url, insecure=insecure)
         payload = {
@@ -105,6 +150,9 @@ def blog_create(
         }
         article = run(client.create_article(payload))
         emit_result(article, json_output=json_output)
+
+    try:
+        _run(_op)
     except CLIError as exc:
         typer.echo(str(exc), err=True)
         raise typer.Exit(code=1) from exc
@@ -126,7 +174,7 @@ def project_create(
     insecure: bool = typer.Option(False, "--insecure", help="Skip SSL verification."),
     server_url: str | None = typer.Option(None, "--server-url", help="FastAPI base URL."),
 ) -> None:
-    try:
+    def _op() -> None:
         body = read_markdown_from_source(markdown=markdown, markdown_file=markdown_file)
         client = build_client(server_url, insecure=insecure)
         payload = {
@@ -143,6 +191,9 @@ def project_create(
         }
         article = run(client.create_article(payload))
         emit_result(article, json_output=json_output)
+
+    try:
+        _run(_op)
     except CLIError as exc:
         typer.echo(str(exc), err=True)
         raise typer.Exit(code=1) from exc
@@ -166,7 +217,7 @@ def article_update(
     insecure: bool = typer.Option(False, "--insecure", help="Skip SSL verification."),
     server_url: str | None = typer.Option(None, "--server-url", help="FastAPI base URL."),
 ) -> None:
-    try:
+    def _op() -> None:
         if cover_image is not None and clear_cover_image:
             raise CLIError("Use either --cover-image or --clear-cover-image, not both.")
         client = build_client(server_url, insecure=insecure)
@@ -193,6 +244,9 @@ def article_update(
             payload["markdown"] = read_markdown_from_source(markdown=markdown, markdown_file=markdown_file)
         article = run(client.update_article(slug, payload))
         emit_result(article, json_output=json_output)
+
+    try:
+        _run(_op)
     except CLIError as exc:
         typer.echo(str(exc), err=True)
         raise typer.Exit(code=1) from exc
@@ -206,10 +260,13 @@ def article_publish(
     insecure: bool = typer.Option(False, "--insecure", help="Skip SSL verification."),
     server_url: str | None = typer.Option(None, "--server-url", help="FastAPI base URL."),
 ) -> None:
-    try:
+    def _op() -> None:
         client = build_client(server_url, insecure=insecure)
         article = run(client.publish_article(slug, {"published_by": published_by} if published_by else None))
         emit_result(article, json_output=json_output)
+
+    try:
+        _run(_op)
     except CLIError as exc:
         typer.echo(str(exc), err=True)
         raise typer.Exit(code=1) from exc
@@ -222,10 +279,13 @@ def article_delete(
     insecure: bool = typer.Option(False, "--insecure", help="Skip SSL verification."),
     server_url: str | None = typer.Option(None, "--server-url", help="FastAPI base URL."),
 ) -> None:
-    try:
+    def _op() -> None:
         client = build_client(server_url, insecure=insecure)
         result = run(client.delete_article(slug))
         emit_result(result, json_output=json_output)
+
+    try:
+        _run(_op)
     except CLIError as exc:
         typer.echo(str(exc), err=True)
         raise typer.Exit(code=1) from exc
@@ -238,10 +298,13 @@ def article_unarchive(
     insecure: bool = typer.Option(False, "--insecure", help="Skip SSL verification."),
     server_url: str | None = typer.Option(None, "--server-url", help="FastAPI base URL."),
 ) -> None:
-    try:
+    def _op() -> None:
         client = build_client(server_url, insecure=insecure)
         article = run(client.unarchive_article(slug))
         emit_result(article, json_output=json_output)
+
+    try:
+        _run(_op)
     except CLIError as exc:
         typer.echo(str(exc), err=True)
         raise typer.Exit(code=1) from exc
@@ -256,12 +319,15 @@ def article_preview(
     insecure: bool = typer.Option(False, "--insecure", help="Skip SSL verification."),
     server_url: str | None = typer.Option(None, "--server-url", help="FastAPI base URL."),
 ) -> None:
-    try:
-        _, _, default_site_url = get_default_config()
+    def _op() -> None:
+        _, _, default_site_url = get_config()
         resolved_site_url = site_url or default_site_url
         client = build_client(server_url, insecure=insecure)
         result = run(client.generate_preview(slug, ttl_hours=ttl_hours, base_url=resolved_site_url))
         emit_result(result, json_output=json_output)
+
+    try:
+        _run(_op)
     except CLIError as exc:
         typer.echo(str(exc), err=True)
         raise typer.Exit(code=1) from exc
@@ -274,10 +340,13 @@ def article_revoke_preview(
     insecure: bool = typer.Option(False, "--insecure", help="Skip SSL verification."),
     server_url: str | None = typer.Option(None, "--server-url", help="FastAPI base URL."),
 ) -> None:
-    try:
+    def _op() -> None:
         client = build_client(server_url, insecure=insecure)
         result = run(client.revoke_preview(slug))
         emit_result(result, json_output=json_output)
+
+    try:
+        _run(_op)
     except CLIError as exc:
         typer.echo(str(exc), err=True)
         raise typer.Exit(code=1) from exc
@@ -291,10 +360,13 @@ def tag_list(
     insecure: bool = typer.Option(False, "--insecure", help="Skip SSL verification."),
     server_url: str | None = typer.Option(None, "--server-url", help="FastAPI base URL."),
 ) -> None:
-    try:
+    def _op() -> None:
         client = build_client(server_url, insecure=insecure)
         result = run(client.list_tags(slug))
         emit_result(result, json_output=json_output)
+
+    try:
+        _run(_op)
     except CLIError as exc:
         typer.echo(str(exc), err=True)
         raise typer.Exit(code=1) from exc
@@ -308,10 +380,13 @@ def tag_add(
     insecure: bool = typer.Option(False, "--insecure", help="Skip SSL verification."),
     server_url: str | None = typer.Option(None, "--server-url", help="FastAPI base URL."),
 ) -> None:
-    try:
+    def _op() -> None:
         client = build_client(server_url, insecure=insecure)
         result = run(client.attach_tags(slug, tag))
         emit_result(result, json_output=json_output)
+
+    try:
+        _run(_op)
     except CLIError as exc:
         typer.echo(str(exc), err=True)
         raise typer.Exit(code=1) from exc
@@ -325,12 +400,15 @@ def tag_remove(
     insecure: bool = typer.Option(False, "--insecure", help="Skip SSL verification."),
     server_url: str | None = typer.Option(None, "--server-url", help="FastAPI base URL."),
 ) -> None:
-    try:
+    def _op() -> None:
         client = build_client(server_url, insecure=insecure)
         for t in tag:
             run(client.remove_tag(slug, t))
         result = run(client.list_tags(slug))
         emit_result(result, json_output=json_output)
+
+    try:
+        _run(_op)
     except CLIError as exc:
         typer.echo(str(exc), err=True)
         raise typer.Exit(code=1) from exc
@@ -344,10 +422,13 @@ def media_upload(
     insecure: bool = typer.Option(False, "--insecure", help="Skip SSL verification."),
     server_url: str | None = typer.Option(None, "--server-url", help="FastAPI base URL."),
 ) -> None:
-    try:
+    def _op() -> None:
         client = build_client(server_url, insecure=insecure)
         result = run(client.upload_media(name, path))
         emit_result(result, json_output=json_output)
+
+    try:
+        _run(_op)
     except CLIError as exc:
         typer.echo(str(exc), err=True)
         raise typer.Exit(code=1) from exc
@@ -361,10 +442,13 @@ def media_update(
     insecure: bool = typer.Option(False, "--insecure", help="Skip SSL verification."),
     server_url: str | None = typer.Option(None, "--server-url", help="FastAPI base URL."),
 ) -> None:
-    try:
+    def _op() -> None:
         client = build_client(server_url, insecure=insecure)
         result = run(client.update_media(name, path))
         emit_result(result, json_output=json_output)
+
+    try:
+        _run(_op)
     except CLIError as exc:
         typer.echo(str(exc), err=True)
         raise typer.Exit(code=1) from exc
@@ -377,15 +461,56 @@ def media_delete(
     insecure: bool = typer.Option(False, "--insecure", help="Skip SSL verification."),
     server_url: str | None = typer.Option(None, "--server-url", help="FastAPI base URL."),
 ) -> None:
-    try:
+    def _op() -> None:
         client = build_client(server_url, insecure=insecure)
         result = run(client.delete_media(name))
         emit_result(result, json_output=json_output)
+
+    try:
+        _run(_op)
     except CLIError as exc:
         typer.echo(str(exc), err=True)
         raise typer.Exit(code=1) from exc
 
 
+@keys_app.command("revoke")
+def keys_revoke(
+    json_output: bool = typer.Option(False, "--json", help="Emit JSON output."),
+) -> None:
+    """Revoke the stored personal-cli credentials."""
+    try:
+        revoked = CredentialStore().remove()
+        emit_result(
+            {"revoked": revoked, "message": "Credentials revoked." if revoked else "No credentials were stored."},
+            json_output=json_output,
+        )
+    except CredentialError as exc:
+        typer.echo(str(exc), err=True)
+        raise typer.Exit(code=1) from exc
+
+
+@keys_app.command("show")
+def keys_show(
+    json_output: bool = typer.Option(False, "--json", help="Emit JSON output."),
+) -> None:
+    """Show whether credentials are stored (API key is masked)."""
+    try:
+        server_url, api_key, site_url = get_config()
+        emit_result(
+            {
+                "server_url": server_url,
+                "api_key": f"{api_key[:4]}...{api_key[-4:]}" if len(api_key) > 8 else "****",
+                "site_url": site_url,
+            },
+            json_output=json_output,
+        )
+    except MissingCredentialError:
+        emit_result({"stored": False}, json_output=json_output)
+    except CredentialError as exc:
+        typer.echo(str(exc), err=True)
+        raise typer.Exit(code=1) from exc
+
+
 def main() -> None:
     app()
 

{blog_cli-0.2.4 → blog_cli-0.3.0}/src/personal_cli/client.py

@@ -136,39 +136,8 @@ class ArticleApiClient:
         return dict(result)
 
 
-def get_default_config() -> tuple[str, str | None, str]:
-    import os
-    _load_dotenv()
-    server_url = os.environ.get("PERSONAL_SERVER_URL")
-    if not server_url:
-        raise CLIError("PERSONAL_SERVER_URL is not set.")
-    api_key = os.environ.get("PERSONAL_API_KEY")
-    if not api_key:
-        raise CLIError("PERSONAL_API_KEY is not set.")
-    site_url = os.environ.get("PERSONAL_SITE_URL", "")
-    return (server_url, api_key, site_url)
-
-
-def _load_dotenv() -> None:
-    import os
-    from pathlib import Path
-
-    candidates = [
-        Path.cwd() / ".env",
-        Path(__file__).resolve().parents[3] / ".env",
-    ]
-    for env_path in candidates:
-        if not env_path.exists():
-            continue
-        with env_path.open() as f:
-            for line in f:
-                line = line.strip()
-                if not line or line.startswith("#"):
-                    continue
-                if "=" not in line:
-                    continue
-                key, _, value = line.partition("=")
-                key = key.strip()
-                value = value.strip().strip("'\"")
-                os.environ[key] = value
-        break
+def get_config() -> tuple[str, str, str]:
+    """Read stored credentials from the OS credential store."""
+    from .credentials import CredentialStore
+
+    return CredentialStore().get()

blog_cli-0.3.0/src/personal_cli/credentials.py

@@ -0,0 +1,100 @@
+from __future__ import annotations
+
+import json
+import os
+from typing import Any
+
+import keyring
+from keyring.errors import PasswordDeleteError
+
+
+SERVICE_NAME = "personal-cli"
+ACCOUNT_NAME = "default"
+_REQUIRED_FIELDS = ("server_url", "api_key", "site_url")
+
+
+class CredentialError(RuntimeError):
+    """An actionable error accessing the operating system credential store."""
+
+
+class MissingCredentialError(CredentialError):
+    """No credentials have been stored yet."""
+
+
+def _service_name() -> str:
+    if os.environ.get("PERSONAL_CLI_ENV", "").strip().lower() == "dev":
+        return f"{SERVICE_NAME}-dev"
+    return SERVICE_NAME
+
+
+def _normalize(value: str) -> str:
+    return value.strip().strip("\"'").strip()
+
+
+class CredentialStore:
+    """Store the personal-cli server credentials in the OS credential store.
+
+    The three values (server_url, api_key, site_url) are serialized as JSON
+    under a single keyring entry so they stay atomic. The service name is
+    suffixed with ``-dev`` when ``PERSONAL_CLI_ENV=dev`` so local testing
+    never touches production credentials.
+    """
+
+    def __init__(self, backend: Any | None = None) -> None:
+        self._backend = backend or keyring
+
+    def add(self, *, server_url: str, api_key: str, site_url: str) -> None:
+        server_url = _normalize(server_url)
+        api_key = _normalize(api_key)
+        site_url = _normalize(site_url)
+        if not server_url:
+            raise CredentialError("Server URL cannot be empty.")
+        if not api_key:
+            raise CredentialError("API key cannot be empty.")
+        if not site_url:
+            raise CredentialError("Site URL cannot be empty.")
+        payload = json.dumps(
+            {"server_url": server_url, "api_key": api_key, "site_url": site_url}
+        )
+        try:
+            self._backend.set_password(_service_name(), ACCOUNT_NAME, payload)
+        except Exception as exc:
+            raise CredentialError(
+                "Could not access the operating system credential store. "
+                "Configure a native keyring backend and try again."
+            ) from exc
+
+    def get(self) -> tuple[str, str, str]:
+        try:
+            raw = self._backend.get_password(_service_name(), ACCOUNT_NAME)
+        except Exception as exc:
+            raise CredentialError(
+                "Could not access the operating system credential store. "
+                "Configure a native keyring backend and try again."
+            ) from exc
+        if not raw:
+            raise MissingCredentialError(
+                "No credentials are stored. Run a command to trigger the setup page."
+            )
+        try:
+            values = json.loads(raw)
+        except json.JSONDecodeError as exc:
+            raise CredentialError("Stored credentials are corrupted.") from exc
+        missing = [field for field in _REQUIRED_FIELDS if not values.get(field)]
+        if missing:
+            raise MissingCredentialError(
+                f"Stored credentials are incomplete (missing: {', '.join(missing)})."
+            )
+        return values["server_url"], values["api_key"], values["site_url"]
+
+    def remove(self) -> bool:
+        try:
+            self._backend.delete_password(_service_name(), ACCOUNT_NAME)
+        except PasswordDeleteError:
+            return False
+        except Exception as exc:
+            raise CredentialError(
+                "Could not access the operating system credential store. "
+                "Configure a native keyring backend and try again."
+            ) from exc
+        return True

blog_cli-0.3.0/src/personal_cli/setup_server.py

@@ -0,0 +1,228 @@
+from __future__ import annotations
+
+import html
+import os
+import secrets
+import threading
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+from typing import Callable
+from urllib.parse import parse_qs, urlencode, urlparse
+
+import httpx
+
+from .credentials import CredentialError, CredentialStore
+
+
+SETUP_PATH = "/setup"
+SETUP_PORT = 3234
+
+
+def _page(
+    message: str = "",
+    *,
+    error: bool = False,
+    token: str = "",
+    server_url: str = "",
+    site_url: str = "",
+    success: bool = False,
+) -> bytes:
+    action = f"{SETUP_PATH}?{urlencode({'token': token})}"
+    if success:
+        return f"""<!doctype html>
+<html lang="en">
+<head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+<title>Personal CLI setup</title>
+<style>
+:root {{ color-scheme: light; font-family: Inter, ui-sans-serif, system-ui, sans-serif; }}
+* {{ box-sizing: border-box; }}
+body {{ margin: 0; min-height: 100vh; background: linear-gradient(135deg,#f4f7ff,#fff 55%,#eefbf7); color: #172033; }}
+dialog {{ border: 0; border-radius: 1.25rem; padding: 0; max-width: 26rem; width: calc(100% - 2rem); box-shadow: 0 24px 60px rgba(24,39,75,.18); overflow: hidden; top: 50%; transform: translateY(-50%); margin: 0 auto; }}
+dialog::backdrop {{ background: rgba(23,32,51,.45); backdrop-filter: blur(4px); }}
+.modal {{ padding: 2.75rem 2rem 2.25rem; text-align: center; }}
+.check {{ display: grid; place-items: center; width: 4rem; height: 4rem; margin: 0 auto 1.25rem; border-radius: 50%; background: #edfff6; color: #087443; }}
+.check svg {{ width: 2.25rem; height: 2.25rem; }}
+h2 {{ margin: 0 0 .5rem; font-size: 1.5rem; letter-spacing: -.02em; }}
+.modal p {{ margin: 0; color: #667085; line-height: 1.55; font-size: .95rem; }}
+</style></head>
+<body>
+<dialog open>
+  <div class="modal">
+    <div class="check"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="3" stroke-linecap="round" stroke-linejoin="round"><polyline points="20 6 9 17 4 12"></polyline></svg></div>
+    <h2>Credentials saved</h2>
+    <p>Your server URL, API key, and site URL are stored in your operating system credential store. You can close this browser window.</p>
+  </div>
+</dialog>
+</body></html>""".encode("utf-8")
+
+    escaped_message = html.escape(message)
+    message_html = (
+        f'<p class="{"error" if error else "success"}">{escaped_message}</p>'
+        if message
+        else ""
+    )
+    return f"""<!doctype html>
+<html lang="en">
+<head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+<title>Personal CLI setup</title>
+<style>
+:root {{ color-scheme: light; font-family: Inter, ui-sans-serif, system-ui, sans-serif; }}
+* {{ box-sizing: border-box; }}
+body {{ margin: 0; min-height: 100vh; background: linear-gradient(135deg,#f4f7ff,#fff 55%,#eefbf7); color: #172033; }}
+.shell {{ max-width: 42rem; margin: 0 auto; padding: 4rem 1.25rem; }}
+.eyebrow {{ color: #536dfe; font-size: .78rem; font-weight: 800; letter-spacing: .12em; text-transform: uppercase; }}
+h1 {{ margin: .5rem 0 .75rem; font-size: clamp(2rem,5vw,2.75rem); letter-spacing: -.04em; }}
+.intro {{ color: #667085; line-height: 1.6; margin: 0 0 2rem; }}
+.card {{ padding: 1.5rem; border: 1px solid #e4e7ec; border-radius: 1rem; background: rgba(255,255,255,.86); box-shadow: 0 10px 30px rgba(24,39,75,.07); }}
+label {{ display: block; margin: 1rem 0 .4rem; font-size: .85rem; font-weight: 700; }}
+input {{ width: 100%; padding: .85rem 1rem; border: 1px solid #d0d5dd; border-radius: .65rem; font: inherit; background: #fff; }}
+input:focus {{ outline: 3px solid #dfe3ff; border-color: #536dfe; }}
+button {{ margin-top: 1.5rem; width: 100%; padding: .9rem 1rem; border: 0; border-radius: .65rem; background: #536dfe; color: white; font-weight: 750; cursor: pointer; box-shadow: 0 8px 18px rgba(83,109,254,.25); font: inherit; }}
+button:hover {{ background: #4256d6; }}
+.notice {{ margin: 1rem 0; padding: .85rem 1rem; border-radius: .65rem; }}
+.error {{ color: #a4262c; background: #fff0f0; }} .success {{ color: #087443; background: #edfff6; }}
+.footnote {{ color: #667085; font-size: .8rem; text-align: center; margin-top: 1.5rem; }}
+</style></head>
+<body><main class="shell"><div class="eyebrow">Personal CLI</div><h1>Connect your backend</h1>
+<p class="intro">Enter your personal server URL, API key, and site URL. They are saved to your operating system credential store and never sent to the agent chat.</p>
+{message_html}
+<form method="post" action="{html.escape(action)}" class="card">
+<label for="server-url">Server URL</label>
+<input id="server-url" name="server_url" type="url" required placeholder="https://api.example.com" value="{html.escape(server_url)}">
+<label for="api-key">API key</label>
+<input id="api-key" name="api_key" type="password" autocomplete="off" required placeholder="Enter your API key">
+<label for="site-url">Site URL</label>
+<input id="site-url" name="site_url" type="url" required placeholder="https://example.com" value="{html.escape(site_url)}">
+<button type="submit">Save credentials</button>
+</form>
+<div class="footnote">You can revoke later with <code>blog-cli keys revoke</code>.</div>
+</main></body></html>""".encode("utf-8")
+
+
+def _validate(server_url: str, api_key: str, site_url: str) -> str | None:
+    """Hit the server to confirm the URL + key work. Returns error message or None."""
+    try:
+        with httpx.Client(
+            base_url=server_url.rstrip("/"),
+            headers={"Authorization": f"Bearer {api_key}"},
+            timeout=10.0,
+            verify=True,
+        ) as client:
+            response = client.get("/api/v1/articles", params={"type": "all"})
+    except httpx.HTTPError as exc:
+        return f"Could not reach the server: {exc}"
+    if response.status_code in (401, 403):
+        return "The server rejected that API key."
+    if response.status_code >= 500:
+        return f"The server returned an error ({response.status_code})."
+    return None
+
+
+class _SetupServer(ThreadingHTTPServer):
+    allow_reuse_address = True
+
+    def __init__(
+        self,
+        store: CredentialStore,
+        token: str,
+        port: int = SETUP_PORT,
+        bind_host: str = "127.0.0.1",
+    ) -> None:
+        try:
+            super().__init__((bind_host, port), _SetupHandler)
+        except OSError:
+            super().__init__((bind_host, 0), _SetupHandler)
+        self.store = store
+        self.token = token
+        self.consumed = False
+
+
+class _SetupHandler(BaseHTTPRequestHandler):
+    server: _SetupServer
+
+    def log_message(self, format: str, *args: object) -> None:
+        return
+
+    def _authorized(self) -> bool:
+        query = parse_qs(urlparse(self.path).query)
+        return urlparse(self.path).path == SETUP_PATH and query.get("token") == [
+            self.server.token
+        ]
+
+    def _send(self, status: int, body: bytes) -> None:
+        self.send_response(status)
+        self.send_header("Content-Type", "text/html; charset=utf-8")
+        self.send_header("Content-Length", str(len(body)))
+        self.send_header("Cache-Control", "no-store")
+        self.end_headers()
+        self.wfile.write(body)
+
+    def do_GET(self) -> None:
+        if not self._authorized():
+            self._send(404, _page("Setup page not found.", error=True))
+            return
+        if self.server.consumed:
+            self._send(410, _page("This setup link has already been used.", error=True))
+            return
+        self._send(200, _page(token=self.server.token))
+
+    def do_POST(self) -> None:
+        if not self._authorized():
+            self._send(404, _page("Setup page not found.", error=True))
+            return
+        if self.server.consumed:
+            self._send(410, _page("This setup link has already been used.", error=True))
+            return
+        try:
+            length = min(int(self.headers.get("Content-Length", "0")), 64 * 1024)
+            values = parse_qs(
+                self.rfile.read(length).decode("utf-8"), keep_blank_values=True
+            )
+            server_url = values.get("server_url", [""])[0].strip().strip("\"'").strip()
+            api_key = values.get("api_key", [""])[0].strip().strip("\"'").strip()
+            site_url = values.get("site_url", [""])[0].strip().strip("\"'").strip()
+            if not (server_url and api_key and site_url):
+                raise CredentialError("All three fields are required.")
+
+            error = _validate(server_url, api_key, site_url)
+            if error:
+                self._send(
+                    400,
+                    _page(
+                        error,
+                        error=True,
+                        token=self.server.token,
+                        server_url=server_url,
+                        site_url=site_url,
+                    ),
+                )
+                return
+            self.server.store.add(
+                server_url=server_url, api_key=api_key, site_url=site_url
+            )
+        except (ValueError, UnicodeDecodeError, CredentialError) as exc:
+            self._send(400, _page(str(exc), error=True, token=self.server.token))
+            return
+
+        self.server.consumed = True
+        self._send(200, _page(success=True))
+        threading.Thread(target=self.server.shutdown, daemon=True).start()
+
+
+def run_setup(
+    store: CredentialStore,
+    output: Callable[[str], None] = print,
+    prompt: str = "Credentials are missing. Open this link in your browser",
+) -> None:
+    """Serve the one-time local setup page until credentials are saved."""
+    token = secrets.token_urlsafe(32)
+    server = _SetupServer(
+        store,
+        token,
+        bind_host=os.environ.get("PERSONAL_CLI_SETUP_BIND_HOST", "127.0.0.1"),
+    )
+    url = f"http://127.0.0.1:{server.server_port}{SETUP_PATH}?{urlencode({'token': token})}"
+    output(f"{prompt}: {url}")
+    try:
+        server.serve_forever()
+    finally:
+        server.server_close()

{blog_cli-0.2.4 → blog_cli-0.3.0}/tests/test_cli.py

@@ -7,6 +7,29 @@ import pytest
 from typer.testing import CliRunner
 
 from personal_cli.cli import app
+from personal_cli.credentials import (
+    CredentialError,
+    CredentialStore,
+    MissingCredentialError,
+)
+
+
+class FakeKeyringBackend:
+    def __init__(self) -> None:
+        self._store: dict[str, dict[str, str]] = {}
+
+    def set_password(self, service: str, account: str, password: str) -> None:
+        self._store.setdefault(service, {})[account] = password
+
+    def get_password(self, service: str, account: str) -> str | None:
+        return self._store.get(service, {}).get(account)
+
+    def delete_password(self, service: str, account: str) -> None:
+        if account not in self._store.get(service, {}):
+            from keyring.errors import PasswordDeleteError
+
+            raise PasswordDeleteError("not found")
+        del self._store[service][account]
 
 
 class FakeApiClient:
@@ -77,16 +100,52 @@ class FakeApiClient:
         return {"deleted": True, "name": name}
 
 
+VALID_CREDS = {
+    "server_url": "http://testserver",
+    "api_key": "test-key",
+    "site_url": "http://testsite",
+}
+
+
 @pytest.fixture()
 def runner() -> CliRunner:
     return CliRunner()
 
 
+@pytest.fixture()
+def fake_backend() -> FakeKeyringBackend:
+    return FakeKeyringBackend()
+
+
+@pytest.fixture(autouse=True)
+def credential_store(monkeypatch: pytest.MonkeyPatch, fake_backend: FakeKeyringBackend) -> FakeKeyringBackend:
+    """Every CredentialStore() instance uses the fake in-memory backend."""
+    real_init = CredentialStore.__init__
+
+    def _init(self, backend=None):
+        real_init(self, backend=fake_backend)
+
+    monkeypatch.setattr(CredentialStore, "__init__", _init)
+    return fake_backend
+
+
+@pytest.fixture(autouse=True)
+def seeded_credentials(credential_store: FakeKeyringBackend) -> None:
+    """Pre-seed valid credentials so commands can build a client."""
+    credential_store.set_password(
+        "personal-cli",
+        "default",
+        json.dumps(VALID_CREDS),
+    )
+
+
 @pytest.fixture(autouse=True)
-def config_env(monkeypatch: pytest.MonkeyPatch) -> None:
-    monkeypatch.setenv("PERSONAL_SERVER_URL", "http://testserver")
-    monkeypatch.setenv("PERSONAL_API_KEY", "test-key")
-    monkeypatch.setenv("PERSONAL_SITE_URL", "http://testsite")
+def stub_run_setup(monkeypatch: pytest.MonkeyPatch) -> None:
+    """Never start the real setup server during tests."""
+    def _noop_run_setup(*args, **kwargs):
+        raise AssertionError("run_setup was called during a test that pre-seeded credentials.")
+
+    monkeypatch.setattr("personal_cli.cli.run_setup", _noop_run_setup)
 
 
 @pytest.fixture()
@@ -204,3 +263,71 @@ def test_media_cli_smoke(monkeypatch, runner: CliRunner, client: FakeApiClient,
     deleted = json.loads(delete_result.stdout)
     assert deleted["deleted"] is True
     assert deleted["name"] == "hero-image"
+
+
+def test_keys_show_reports_stored_credentials(runner: CliRunner) -> None:
+    result = runner.invoke(app, ["keys", "show", "--json"])
+    assert result.exit_code == 0
+    shown = json.loads(result.stdout)
+    assert shown["server_url"] == "http://testserver"
+    assert shown["site_url"] == "http://testsite"
+    assert "api_key" in shown
+    assert shown["api_key"] != "test-key"
+
+
+def test_keys_revoke_clears_credentials(
+    runner: CliRunner, credential_store: FakeKeyringBackend
+) -> None:
+    revoke_result = runner.invoke(app, ["keys", "revoke", "--json"])
+    assert revoke_result.exit_code == 0
+    revoked = json.loads(revoke_result.stdout)
+    assert revoked["revoked"] is True
+
+    assert credential_store.get_password("personal-cli", "default") is None
+
+    second_revoke = runner.invoke(app, ["keys", "revoke", "--json"])
+    assert second_revoke.exit_code == 0
+    assert json.loads(second_revoke.stdout)["revoked"] is False
+
+
+def test_keys_show_when_empty(runner: CliRunner, credential_store: FakeKeyringBackend) -> None:
+    credential_store.delete_password("personal-cli", "default")
+    result = runner.invoke(app, ["keys", "show", "--json"])
+    assert result.exit_code == 0
+    assert json.loads(result.stdout) == {"stored": False}
+
+
+def test_missing_credentials_triggers_setup(
+    monkeypatch: pytest.MonkeyPatch,
+    runner: CliRunner,
+    credential_store: FakeKeyringBackend,
+) -> None:
+    credential_store.delete_password("personal-cli", "default")
+
+    setup_calls: list[int] = []
+
+    def _fake_run_setup(store, output=None, prompt=""):
+        output(f"{prompt}: http://127.0.0.1:3233/setup?token=fake")
+        setup_calls.append(1)
+        store.add(
+            server_url=VALID_CREDS["server_url"],
+            api_key=VALID_CREDS["api_key"],
+            site_url=VALID_CREDS["site_url"],
+        )
+
+    monkeypatch.setattr("personal_cli.cli.run_setup", _fake_run_setup)
+
+    attempts: list[int] = []
+
+    def _flaky_build_client(server_url=None, insecure=False):
+        attempts.append(1)
+        if len(attempts) == 1:
+            raise MissingCredentialError("missing")
+        return FakeApiClient()
+
+    monkeypatch.setattr("personal_cli.cli.build_client", _flaky_build_client)
+    monkeypatch.setattr("personal_cli.cli.run", lambda coro: __import__("asyncio").run(coro))
+
+    result = runner.invoke(app, ["article", "list", "--json"])
+    assert setup_calls, "run_setup should have been called"
+    assert result.exit_code == 0