cli-login 0.1.0__tar.gz → 0.2.0__tar.gz

{cli_login-0.1.0 → cli_login-0.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: cli-login
-Version: 0.1.0
+Version: 0.2.0
 Summary: One CLI login for every Anthus product: PKCE sign-in, remote approval, secure storage and renewal.
 Author: Anthus AI
 License: MIT

{cli_login-0.1.0 → cli_login-0.2.0}/docs/protocol.md

@@ -151,3 +151,6 @@ Every page sends:
   every read.
 - The poll interval starts at 5 seconds, and each `slow_down` adds 5.
 - The rate limits per caller are 10 starts and 120 polls a minute.
+- All callers together share a ceiling of 100 starts a minute. Past it, every start answers `429` with
+  `retry_after` until the window ends. The broker logs `cli_login_start_ceiling`, and the template turns that log
+  line into an alarm.

{cli_login-0.1.0 → cli_login-0.2.0}/infra/broker.yaml

@@ -138,6 +138,31 @@ Resources:
       Action: lambda:InvokeFunction
       Principal: !Ref InvokerRoleArn
 
+  StartCeilingFilter:
+    Type: AWS::Logs::MetricFilter
+    Properties:
+      LogGroupName: !Ref BrokerLogs
+      FilterPattern: '{ $.event = "cli_login_start_ceiling" }'
+      MetricTransformations:
+        - MetricNamespace: cli-login
+          MetricName: StartCeilingReached
+          MetricValue: "1"
+          DefaultValue: 0
+
+  StartCeilingAlarm:
+    Type: AWS::CloudWatch::Alarm
+    Properties:
+      AlarmDescription: The cli-login broker refused starts at its ceiling across all callers (a flood from many addresses)
+      Namespace: cli-login
+      MetricName: StartCeilingReached
+      Statistic: Sum
+      Period: 300
+      EvaluationPeriods: 1
+      Threshold: 0
+      ComparisonOperator: GreaterThanThreshold
+      TreatMissingData: notBreaching
+      AlarmActions: !If [HasAlarmTopic, [!Ref AlarmTopicArn], !Ref "AWS::NoValue"]
+
   ThrottledAlarm:
     Type: AWS::CloudWatch::Alarm
     Properties:

{cli_login-0.1.0 → cli_login-0.2.0}/infra/broker_template_test.py

@@ -31,3 +31,10 @@ def test_the_function_url_takes_no_credentials_and_the_broker_is_bounded():
 def test_the_broker_may_only_read_and_write_its_own_table():
     assert "Resource: !GetAtt Transactions.Arn" in resource("BrokerRole")
     assert "AttributeName: expires_at" in resource("Transactions")
+
+
+def test_the_start_ceiling_is_logged_counted_and_alarmed():
+    assert "$.event = \"cli_login_start_ceiling\"" in resource("StartCeilingFilter")
+    assert "LogGroupName: !Ref BrokerLogs" in resource("StartCeilingFilter")
+    alarm = resource("StartCeilingAlarm")
+    assert "MetricName: StartCeilingReached" in alarm and "Namespace: cli-login" in alarm and "Dimensions" not in alarm

{cli_login-0.1.0 → cli_login-0.2.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "cli-login"
-version = "0.1.0"
+version = "0.2.0"
 description = "One CLI login for every Anthus product: PKCE sign-in, remote approval, secure storage and renewal."
 readme = "README.md"
 requires-python = ">=3.10"

{cli_login-0.1.0 → cli_login-0.2.0}/src/cli_login/__init__.py

@@ -1,4 +1,4 @@
 """One CLI login for every Anthus product. See docs/design.md."""
 
-__version__ = "0.1.0"
+__version__ = "0.2.0"
 PROTOCOL_VERSION = 1

{cli_login-0.1.0 → cli_login-0.2.0}/src/cli_login/broker/handler.py

@@ -104,6 +104,10 @@ class Broker:
     def start(self, body: dict[str, Any], caller: str) -> tuple[int, dict[str, Any]]:
         if not throttle.allowed(self.store, "start", caller, throttle.START, self.now()):
             return 429, {"error": "too_many_requests", "retry_after": throttle.START.window_seconds}
+        if not throttle.allowed(self.store, "start", throttle.EVERYONE, throttle.ALL_STARTS, self.now()):
+            # One line the template's metric filter counts, so a flood raises the broker's alarm.
+            print(json.dumps({"event": "cli_login_start_ceiling", "limit": throttle.ALL_STARTS.calls}))
+            return 429, {"error": "too_many_requests", "retry_after": throttle.ALL_STARTS.window_seconds}
         try:
             if body.get("protocol") != PROTOCOL_VERSION:
                 return 400, {"error": "unsupported_protocol", "protocol": PROTOCOL_VERSION}

{cli_login-0.1.0 → cli_login-0.2.0}/src/cli_login/broker/handler_test.py

@@ -282,3 +282,22 @@ def test_the_config_requires_its_client_targets_and_https_pages():
         "BROKER_CALLBACK_URI": "https://a.example.test/cli/callback",
     })
     assert config.targets == ("https://a.example.test",)
+
+
+def test_starts_across_all_callers_have_one_ceiling_and_say_so_in_the_log(capsys):
+    b = broker()
+    callers = [f"198.51.100.{n}" for n in range(throttle.ALL_STARTS.calls // throttle.START.calls + 2)]
+    statuses = [b.start(start_body(), caller)[0] for caller in callers for _ in range(throttle.START.calls)]
+    assert statuses.count(200) == throttle.ALL_STARTS.calls
+    assert b.start(start_body(), "203.0.113.200") == (429, {"error": "too_many_requests", "retry_after": 60})
+    assert '"event": "cli_login_start_ceiling"' in capsys.readouterr().out
+
+
+def test_the_ceiling_resets_with_the_window():
+    clock = Clock()
+    b = broker(clock)
+    for n in range(throttle.ALL_STARTS.calls):
+        b.start(start_body(), f"caller-{n}")
+    assert b.start(start_body(), "caller-new")[0] == 429
+    clock.now += 60
+    assert b.start(start_body(), "caller-new")[0] == 200

{cli_login-0.1.0 → cli_login-0.2.0}/src/cli_login/broker/throttle.py

@@ -1,8 +1,9 @@
-"""Per-caller rate limits for the broker's public routes.
+"""Rate limits for the broker's public routes.
 
 The broker's ``/start`` and ``/poll`` take calls from anyone who can reach the function URL, so each caller (its
-source address) gets a fixed number of calls per window. A CLI that polls one transaction faster than its
-interval is told ``slow_down`` separately, by the poll itself.
+source address, or its IPv6 /64) gets a fixed number of calls per window. Starts also have one ceiling across all
+callers, for a flood spread over many addresses; real use is a handful of sign-ins a day. A CLI that polls one
+transaction faster than its interval is told ``slow_down`` separately, by the poll itself.
 """
 
 from __future__ import annotations
@@ -18,6 +19,8 @@ class Limit:
 
 START = Limit(calls=10, window_seconds=60)
 POLL = Limit(calls=120, window_seconds=60)
+ALL_STARTS = Limit(calls=100, window_seconds=60)
+EVERYONE = "*"  # the caller name the ceiling across all callers is counted under; never a real address
 
 
 def allowed(store, route: str, caller: str, limit: Limit, now: int) -> bool:

{cli_login-0.1.0 → cli_login-0.2.0}/src/cli_login/session.py

@@ -29,7 +29,16 @@ class Session:
         state_dir=None,
         login_command: str = "login",
         identity_provider: str | None = None,
+        api_token: str = "id",
+        authorization_scheme: str | None = None,
     ):
+        """``api_token`` names the token ``headers()`` hands to the API: ``"id"`` (Papyrus's AppSync) or ``"access"``
+        (an API that checks Cognito access tokens, such as the Cyclotron lab). ``authorization_scheme`` prefixes it,
+        for example ``"Bearer"``. The access token is only ever held in memory, never stored."""
+        if api_token not in ("id", "access"):
+            raise ValueError('api_token is "id" or "access"')
+        if authorization_scheme not in (None, "Bearer"):
+            raise ValueError('authorization_scheme is None or "Bearer"')
         self.target = target
         self.store = store if store is not None else open_store(target)
         self.provider = provider if provider is not None else HTTPProvider()
@@ -38,6 +47,8 @@ class Session:
         self.state_dir = state_dir if state_dir is not None else default_state_dir(target.namespace)
         self.login_command = login_command
         self.identity_provider = identity_provider
+        self.api_token = api_token
+        self.authorization_scheme = authorization_scheme
         self._token = None
         self._expires = 0.0
         self._subject = None
@@ -102,6 +113,17 @@ class Session:
             ):
                 raise ValueError()
             expires = min(float(claims["exp"]), self.clock() + float(response["expires_in"]))
+            if self.api_token == "access":
+                value = response["access_token"]
+                access = json.loads(base64.urlsafe_b64decode(value.split(".")[1] + "==="))
+                if (
+                    access["iss"] != expected.issuer
+                    or access["client_id"] != expected.client_id
+                    or access["token_use"] != "access"
+                    or access["sub"] != claims["sub"]
+                ):
+                    raise ValueError()
+                expires = min(expires, float(access["exp"]))
             if (
                 not math.isfinite(expires)
                 or not math.isfinite(float(response["expires_in"]))
@@ -172,7 +194,8 @@ class Session:
                         self._token = None
                     raise OAuthError(error.code, transient=error.transient, login_command=self.login_command) from None
                 self.store_token_set(response, previous=record)
-            return {"content-type": "application/json", "Authorization": self._token}
+            token = self._token if self.authorization_scheme is None else f"{self.authorization_scheme} {self._token}"
+            return {"content-type": "application/json", "Authorization": token}
 
     def status(self) -> dict:
         try:

{cli_login-0.1.0 → cli_login-0.2.0}/src/cli_login/session_test.py

@@ -223,3 +223,63 @@ def test_a_corrupt_stored_record_is_an_error_with_guidance(world):
     store.data[target.key] = "not json"
     with pytest.raises(AuthError, match="tool login"):
         new().headers(target.api_endpoint)
+
+
+def test_by_default_headers_hand_out_the_bare_id_token_exactly_as_in_0_1_0(world):
+    target, _clock, _store, _provider, _seen, new = world
+    session = new()
+    session.login()
+    headers = session.headers(target.api_endpoint)
+    assert headers == {"content-type": "application/json", "Authorization": session._token}
+    assert json.loads(__import__("base64").urlsafe_b64decode(headers["Authorization"].split(".")[1] + "==="))["token_use"] == "id"
+
+
+def test_an_access_token_api_gets_the_access_token_with_its_scheme(world):
+    target, _clock, _store, _provider, _seen, new = world
+    session = new(api_token="access", authorization_scheme="Bearer")
+    session.login()
+    scheme, _, token = session.headers(target.api_endpoint)["Authorization"].partition(" ")
+    claims = json.loads(__import__("base64").urlsafe_b64decode(token.split(".")[1] + "==="))
+    assert scheme == "Bearer" and claims["token_use"] == "access" and claims["client_id"] == target.client_id
+
+
+def test_the_access_token_is_never_stored(world):
+    target, _clock, store, _provider, _seen, new = world
+    session = new(api_token="access", authorization_scheme="Bearer")
+    session.login()
+    record = json.loads(store.data[target.key])
+    assert set(record) == {"subject", "label", "refresh_token", "created_at"}
+    assert session._token not in store.data[target.key]
+
+
+@pytest.mark.parametrize("change", [{"client_id": "other"}, {"token_use": "id"}, {"issuer": "https://elsewhere.example.test/p"},
+                                    {"subject": "someone-else"}])
+def test_a_mismatched_access_token_is_refused_and_nothing_is_saved(world, change):
+    from .testing import make_access_token
+
+    _target, clock, store, _provider, _seen, new = world
+    session = new(api_token="access")
+    response = {"id_token": make_id_token(clock()), "access_token": make_access_token(clock(), **change),
+                "refresh_token": "r", "expires_in": 3600}
+    with pytest.raises(AuthError):
+        session.store_token_set(response)
+    assert store.data == {}
+
+
+def test_a_short_lived_access_token_is_renewed_before_it_lapses(world):
+    from .testing import make_access_token
+
+    _target, clock, _store, _provider, _seen, new = world
+    session = new(api_token="access")
+    session.store_token_set({"id_token": make_id_token(clock()), "access_token": make_access_token(clock(), lifetime=300),
+                             "refresh_token": "r", "expires_in": 3600})
+    assert session._expires == clock() + 300
+
+
+def test_a_session_names_only_known_token_choices():
+    from .testing import make_target
+
+    with pytest.raises(ValueError):
+        Session(make_target(), store=FakeStore(), api_token="refresh")
+    with pytest.raises(ValueError):
+        Session(make_target(), store=FakeStore(), authorization_scheme="Basic")

{cli_login-0.1.0 → cli_login-0.2.0}/src/cli_login/testing.py

@@ -43,6 +43,15 @@ def make_id_token(now, *, subject="person-1", issuer=ISSUER, audience=CLIENT_ID,
     return encode({"alg": "RS256"}) + "." + encode(claims) + ".fixture-signature"
 
 
+def make_access_token(now, *, subject="person-1", issuer=ISSUER, client_id=CLIENT_ID, token_use="access", lifetime=3600):
+    claims = {"iss": issuer, "client_id": client_id, "sub": subject, "token_use": token_use, "exp": now + lifetime}
+
+    def encode(value):
+        return base64.urlsafe_b64encode(json.dumps(value).encode()).decode().rstrip("=")
+
+    return encode({"alg": "RS256"}) + "." + encode(claims) + ".fixture-signature"
+
+
 class FakeClock:
     def __init__(self, now=1000.0):
         self.now = now
@@ -97,6 +106,7 @@ class FakeProvider:
             raise self.failure
         return {
             "id_token": make_id_token(self.clock(), subject=self.subject, issuer=self.issuer),
+            "access_token": make_access_token(self.clock(), subject=self.subject, issuer=self.issuer),
             "refresh_token": "refresh-secret-" + str(len(self.calls)),
             "expires_in": 3600,
         }