calkit-python 0.41.22__tar.gz → 0.41.23__tar.gz

{calkit_python-0.41.22 → calkit_python-0.41.23}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: calkit-python
-Version: 0.41.22
+Version: 0.41.23
 Summary: Reproducibility simplified.
 Project-URL: Homepage, https://calkit.org
 Project-URL: Issues, https://github.com/calkit/calkit/issues

{calkit_python-0.41.22 → calkit_python-0.41.23}/calkit/cli/overleaf.py

@@ -16,6 +16,20 @@ from calkit.cli import AliasGroup, raise_error, warn
 
 overleaf_app = typer.Typer(cls=AliasGroup, no_args_is_help=True)
 
+# Shown when a pull from Overleaf fails, most commonly due to an invalid or
+# expired token. Calkit authenticates only with the token in its config, but a
+# stale token cached by the OS credential manager from an earlier version can
+# still interfere, so we point users there as a fallback.
+PULL_FAILED_MESSAGE = (
+    "Failed to pull from Overleaf; "
+    "check that your Overleaf token is valid\n"
+    "Run 'calkit config get overleaf_token' and ensure that it matches one in "
+    "your Overleaf account settings (https://overleaf.com/user/settings).\n"
+    "If it looks correct but pulling still fails, delete any saved "
+    "'git.overleaf.com' credential from your OS credential manager (Windows "
+    "Credential Manager, macOS Keychain, or your Linux keyring) and try again."
+)
+
 
 def _extract_title_from_tex(tex_file_path: str) -> str | None:
     """Extract the title from a LaTeX file."""
@@ -169,8 +183,6 @@ def import_publication(
     ] = False,
 ):
     """Import a publication from an Overleaf project."""
-    import git
-
     from calkit.cli.main import ignore as git_ignore
     from calkit.cli.new import new_latex_stage
 
@@ -202,16 +214,13 @@ def import_publication(
     overleaf_dir = os.path.join(".calkit", "overleaf")
     os.makedirs(overleaf_dir, exist_ok=True)
     git_ignore(overleaf_dir, no_commit=no_commit)
-    overleaf_project_dir = os.path.join(overleaf_dir, overleaf_project_id)
-    git_clone_url = calkit.overleaf.get_git_remote_url(
-        project_id=overleaf_project_id, token=overleaf_token
-    )
+    overleaf_project_dir = calkit.overleaf.get_project_dir(overleaf_project_id)
     if os.path.isdir(overleaf_project_dir):
         warn("This Overleaf project has already been cloned; removing")
         shutil.rmtree(overleaf_project_dir)
     # Clone the Overleaf project
     typer.echo("Cloning Overleaf project")
-    git.Repo.clone_from(git_clone_url, overleaf_project_dir)
+    calkit.overleaf.clone(overleaf_project_id, overleaf_token)
     # Detect target path if not specified
     if target_path is None:
         ol_contents = os.listdir(
@@ -428,8 +437,6 @@ def sync(
     ] = False,
 ):
     """Sync folders with Overleaf."""
-    import git
-
     # TODO: We should probably ensure the pipeline isn't stale
     # Read all synced folders, fixing legacy schema if applicable
     overleaf_info = calkit.overleaf.get_sync_info(fix_legacy=True)
@@ -504,32 +511,15 @@ def sync(
                     "or use --auto-commit/-a to automatically commit them."
                 )
         # Ensure we've cloned the Overleaf project
-        overleaf_project_dir = os.path.join(
-            ".calkit", "overleaf", overleaf_project_id
+        overleaf_repo = calkit.overleaf.get_repo(
+            overleaf_project_id, str(overleaf_token)
         )
-        overleaf_remote_url = calkit.overleaf.get_git_remote_url(
-            project_id=overleaf_project_id, token=str(overleaf_token)
-        )
-        if not os.path.isdir(overleaf_project_dir):
-            overleaf_repo = git.Repo.clone_from(
-                overleaf_remote_url, to_path=overleaf_project_dir
-            )
-        else:
-            overleaf_repo = calkit.git.get_repo(overleaf_project_dir)
         # Pull the latest version in the Overleaf project
         typer.echo("Pulling the latest version from Overleaf")
-        # Ensure that our current Overleaf remote URL is correct
-        overleaf_repo.git.remote("set-url", "origin", overleaf_remote_url)
         try:
             overleaf_repo.git.pull()
         except Exception:
-            raise_error(
-                "Failed to pull from Overleaf; "
-                "check that your Overleaf token is valid\n"
-                "Run 'calkit config get overleaf_token' and ensure that "
-                "it matches one in your Overleaf account settings "
-                "(https://overleaf.com/user/settings)"
-            )
+            raise_error(PULL_FAILED_MESSAGE)
         if resolve:
             last_sync_commit = resolving_info["last_overleaf_commit"]
         else:
@@ -608,8 +598,6 @@ def get_status(
     ] = None,
 ):
     """Check the status of folders synced with Overleaf in a project."""
-    import git
-
     # Read all synced folders, fixing legacy schema if applicable
     overleaf_info = calkit.overleaf.get_sync_info(fix_legacy=False)
     if not overleaf_info:
@@ -642,32 +630,18 @@ def get_status(
         )
         wdir = path_in_project
         # Ensure we've cloned the Overleaf project
-        overleaf_project_dir = os.path.join(
-            ".calkit", "overleaf", overleaf_project_id
+        overleaf_project_dir = calkit.overleaf.get_project_dir(
+            overleaf_project_id
         )
-        overleaf_remote_url = calkit.overleaf.get_git_remote_url(
-            project_id=overleaf_project_id, token=str(overleaf_token)
+        overleaf_repo = calkit.overleaf.get_repo(
+            overleaf_project_id, str(overleaf_token)
         )
-        if not os.path.isdir(overleaf_project_dir):
-            overleaf_repo = git.Repo.clone_from(
-                overleaf_remote_url, to_path=overleaf_project_dir
-            )
-        else:
-            overleaf_repo = calkit.git.get_repo(overleaf_project_dir)
         # Pull the latest version in the Overleaf project
         typer.echo("Pulling the latest version from Overleaf")
-        # Ensure that our current Overleaf remote URL is correct
-        overleaf_repo.git.remote("set-url", "origin", overleaf_remote_url)
         try:
             overleaf_repo.git.pull()
         except Exception:
-            raise_error(
-                "Failed to pull from Overleaf; "
-                "check that your Overleaf token is valid\n"
-                "Run 'calkit config get overleaf_token' and ensure that "
-                "it matches one in your Overleaf account settings "
-                "(https://overleaf.com/user/settings)"
-            )
+            raise_error(PULL_FAILED_MESSAGE)
         last_sync_commit = sync_data.get("last_sync_commit")
         if last_sync_commit:
             commits_since = calkit.overleaf.get_commits_since_last_sync(

{calkit_python-0.41.22 → calkit_python-0.41.23}/calkit/overleaf.py

@@ -30,6 +30,69 @@ def get_git_remote_url(project_id: str, token: str) -> str:
     return f"https://git:{token}@git.overleaf.com/{project_id}"
 
 
+# Git config options that force authentication to use only the token embedded
+# in the Overleaf remote URL, never a credential saved in the operating
+# system's credential store (macOS Keychain, Windows Credential Manager, etc.).
+# An expired token can linger in that store and shadow a freshly set one, which
+# otherwise makes it impossible to recover a project after a token expires.
+_CREDENTIAL_CLONE_OPTIONS = [
+    "-c credential.helper=",
+    "-c credential.interactive=false",
+]
+
+
+def _disable_credential_store(repo: git.Repo) -> None:
+    """Configure a cloned Overleaf repo so git authenticates only with the
+    token embedded in its remote URL, ignoring the OS credential store.
+
+    Setting an empty ``credential.helper`` in the repo's local config resets
+    the list of helpers inherited from the system and global config, so no
+    stale token can be read from (or written to) the credential store.
+    """
+    repo.git.config("credential.helper", "")
+    repo.git.config("credential.interactive", "false")
+
+
+def get_project_dir(project_id: str) -> str:
+    """Return the local directory into which an Overleaf project is cloned,
+    relative to the Calkit project working directory.
+    """
+    return os.path.join(".calkit", "overleaf", project_id)
+
+
+def clone(project_id: str, token: str) -> git.Repo:
+    """Clone an Overleaf project, authenticating only with ``token``."""
+    repo = git.Repo.clone_from(
+        get_git_remote_url(project_id=project_id, token=token),
+        get_project_dir(project_id),
+        multi_options=_CREDENTIAL_CLONE_OPTIONS,
+        allow_unsafe_options=True,
+    )
+    _disable_credential_store(repo)
+    return repo
+
+
+def get_repo(project_id: str, token: str) -> git.Repo:
+    """Return the Overleaf repo for ``project_id``, cloning it if it does not
+    yet exist.
+
+    When the repo already exists, its remote URL is refreshed so a freshly set
+    token takes effect, and credential handling is reset so a stale token from
+    the OS credential store is never used.
+    """
+    dest = get_project_dir(project_id)
+    if not os.path.isdir(dest):
+        return clone(project_id, token)
+    repo = calkit.git.get_repo(dest)
+    repo.git.remote(
+        "set-url",
+        "origin",
+        get_git_remote_url(project_id=project_id, token=token),
+    )
+    _disable_credential_store(repo)
+    return repo
+
+
 def project_id_to_url(project_id: str) -> str:
     return f"https://www.overleaf.com/project/{project_id}"
 

{calkit_python-0.41.22 → calkit_python-0.41.23}/calkit/tests/cli/test_overleaf.py

@@ -409,3 +409,35 @@ def test_overleaf_sync_trailing_slash_or_space(tmp_dir):
         text=True,
     )
     assert res2.returncode == 0, f"Trailing space sync failed: {res2.stderr}"
+
+
+def test_get_repo_disables_credential_store(tmp_dir):
+    # Set up a repo to act as the Overleaf remote (in the test env the remote
+    # URL is a local directory)
+    pid = str(uuid.uuid4())
+    _make_temp_overleaf_project(pid)
+    dest = calkit.overleaf.get_project_dir(pid)
+    # A fresh clone should reset the credential helper for that repo so only
+    # the token in its remote URL is used, never a stale one from the OS
+    # credential store
+    repo = calkit.overleaf.clone(pid, "sometoken")
+    assert os.path.isdir(os.path.join(dest, ".git"))
+    assert repo.git.config(["--local", "--get", "credential.helper"]) == ""
+    assert (
+        repo.git.config(["--local", "--get", "credential.interactive"])
+        == "false"
+    )
+    # Opening an already-cloned project should refresh the remote URL so an
+    # updated token takes effect, and keep the credential store disabled
+    repo2 = calkit.overleaf.get_repo(pid, "newtoken")
+    assert repo2.git.remote(
+        ["get-url", "origin"]
+    ) == calkit.overleaf.get_git_remote_url(pid, "newtoken")
+    assert repo2.git.config(["--local", "--get", "credential.helper"]) == ""
+    # A project that has not yet been cloned should be cloned
+    pid2 = str(uuid.uuid4())
+    _make_temp_overleaf_project(pid2)
+    calkit.overleaf.get_repo(pid2, "sometoken")
+    assert os.path.isdir(
+        os.path.join(calkit.overleaf.get_project_dir(pid2), ".git")
+    )