cli-login 0.1.0__tar.gz → 0.3.0__tar.gz

{cli_login-0.1.0 → cli_login-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: cli-login
-Version: 0.1.0
+Version: 0.3.0
 Summary: One CLI login for every Anthus product: PKCE sign-in, remote approval, secure storage and renewal.
 Author: Anthus AI
 License: MIT

{cli_login-0.1.0 → cli_login-0.3.0}/docs/protocol.md

@@ -95,7 +95,9 @@ The CLI checks:
 - that `redirect_uri` equals its target's `remote_callback_uri`, and that the `approval_url` from `/start` is
   on that URI's origin. A target with a broker must name its remote callback, even when its local sign-in uses a
   loopback callback;
-- that the ID token's `nonce` equals its own;
+- that the ID token's `nonce` equals its own. The one exception: a CLI that asked to enroll (`enroll=` in the
+  Python client) checks the nonce the poll handed over, if there is one. It then runs its enroll step, with its
+  tokens, the transaction and the `enrollment` string, before storing anything;
 - that the approver's email is the expected one, when one is given.
 
 It then passes the response to the session store, which checks issuer, audience, `token_use` and expiry.
@@ -117,7 +119,7 @@ A failure answers `{"ok": false, "error": "unavailable"}` and says nothing more.
 | `operation` | Fields | Effect |
 |---|---|---|
 | `describe` | `transaction` | For a pending, unexpired transaction: `client_id`, `target`, `requester`, `matching_code`, `code_challenge`, `nonce`, `redirect_uri`, `expires_at` |
-| `bind` | `transaction`, `nonce_hash` | Pending to bound, once. After this, nobody else can approve it. |
+| `bind` | `transaction`, `nonce_hash`, optional `nonce` and `enrollment` | Pending to bound, once. After this, nobody else can approve it. A product whose sign-in enrolls each login (the Cyclotron lab, at Prospectus) sets the OpenID `nonce` its approval page uses and an opaque `enrollment` string. The poll hands both to the CLI with the code. |
 | `complete` | `transaction`, `nonce`, `code` | Bound to approved, only when `sha256(nonce)` equals the bound hash |
 | `deny` | `transaction` | Pending or bound to denied |
 
@@ -151,3 +153,6 @@ Every page sends:
   every read.
 - The poll interval starts at 5 seconds, and each `slow_down` adds 5.
 - The rate limits per caller are 10 starts and 120 polls a minute.
+- All callers together share a ceiling of 100 starts a minute. Past it, every start answers `429` with
+  `retry_after` until the window ends. The broker logs `cli_login_start_ceiling`, and the template turns that log
+  line into an alarm.

{cli_login-0.1.0 → cli_login-0.3.0}/infra/broker.yaml

@@ -138,6 +138,31 @@ Resources:
       Action: lambda:InvokeFunction
       Principal: !Ref InvokerRoleArn
 
+  StartCeilingFilter:
+    Type: AWS::Logs::MetricFilter
+    Properties:
+      LogGroupName: !Ref BrokerLogs
+      FilterPattern: '{ $.event = "cli_login_start_ceiling" }'
+      MetricTransformations:
+        - MetricNamespace: cli-login
+          MetricName: StartCeilingReached
+          MetricValue: "1"
+          DefaultValue: 0
+
+  StartCeilingAlarm:
+    Type: AWS::CloudWatch::Alarm
+    Properties:
+      AlarmDescription: The cli-login broker refused starts at its ceiling across all callers (a flood from many addresses)
+      Namespace: cli-login
+      MetricName: StartCeilingReached
+      Statistic: Sum
+      Period: 300
+      EvaluationPeriods: 1
+      Threshold: 0
+      ComparisonOperator: GreaterThanThreshold
+      TreatMissingData: notBreaching
+      AlarmActions: !If [HasAlarmTopic, [!Ref AlarmTopicArn], !Ref "AWS::NoValue"]
+
   ThrottledAlarm:
     Type: AWS::CloudWatch::Alarm
     Properties:

{cli_login-0.1.0 → cli_login-0.3.0}/infra/broker_template_test.py

@@ -31,3 +31,10 @@ def test_the_function_url_takes_no_credentials_and_the_broker_is_bounded():
 def test_the_broker_may_only_read_and_write_its_own_table():
     assert "Resource: !GetAtt Transactions.Arn" in resource("BrokerRole")
     assert "AttributeName: expires_at" in resource("Transactions")
+
+
+def test_the_start_ceiling_is_logged_counted_and_alarmed():
+    assert "$.event = \"cli_login_start_ceiling\"" in resource("StartCeilingFilter")
+    assert "LogGroupName: !Ref BrokerLogs" in resource("StartCeilingFilter")
+    alarm = resource("StartCeilingAlarm")
+    assert "MetricName: StartCeilingReached" in alarm and "Namespace: cli-login" in alarm and "Dimensions" not in alarm

cli_login-0.3.0/project/events/2026-10-30T14-01-17.888Z__bf995622-7f63-4936-9891-4cebf7208cf5.json

@@ -0,0 +1,12 @@
+{
+  "schema_version": 1,
+  "event_id": "bf995622-7f63-4936-9891-4cebf7208cf5",
+  "issue_id": "cli-login-96ed2301-f038-4d76-84bb-b670184ab538",
+  "event_type": "comment_added",
+  "occurred_at": "2026-10-30T14:01:17.888Z",
+  "actor_id": "home",
+  "payload": {
+    "comment_id": "8e2eaf1f-f176-45b7-9f83-ebd9dbac93ee",
+    "comment_author": "home"
+  }
+}

cli_login-0.3.0/project/events/2026-10-30T14-01-17.900Z__e9675700-922f-449e-8b9f-9779917ce373.json

@@ -0,0 +1,12 @@
+{
+  "schema_version": 1,
+  "event_id": "e9675700-922f-449e-8b9f-9779917ce373",
+  "issue_id": "cli-login-96ed2301-f038-4d76-84bb-b670184ab538",
+  "event_type": "state_transition",
+  "occurred_at": "2026-10-30T14:01:17.900Z",
+  "actor_id": "home",
+  "payload": {
+    "from_status": "in_progress",
+    "to_status": "closed"
+  }
+}

{cli_login-0.1.0 → cli_login-0.3.0}/project/issues/cli-login-96ed2301-f038-4d76-84bb-b670184ab538.json

@@ -3,7 +3,7 @@
   "title": "Move Papyrus's CLI login into the library without breaking Mac sessions",
   "description": "Owner: Papyrus session. Move src/papyrus_content/cli_user_auth.py and macos_keychain.py into anthus_cli_login (target, oauth, session, locks, stores/macos), behind a product target the caller supplies. Keep Keychain SERVICE 'papyrus-newsroom-oauth' and the per-site keys, so existing Mac sessions renew unchanged; keep Papyrus's behaviour and port its specs (features_backend/cli-user-auth.feature) as Gherkin here. Done when Papyrus's specs pass against the library with no behaviour change.",
   "type": "story",
-  "status": "in_progress",
+  "status": "closed",
   "priority": 1,
   "assignee": null,
   "creator": null,
@@ -29,11 +29,18 @@
       "text": "Library half done in #1 (merged). Kept in progress: 'without breaking Mac sessions' is only proven once the Papyrus CLI uses the library and an existing Keychain session renews through it. That Papyrus PR (Target per site, namespace papyrus-newsroom-oauth, identity_provider Google, existing state dir) is next after the stores story.",
       "created_at": "2026-10-30T11:58:11.249739Z",
       "comment_type": "default"
+    },
+    {
+      "id": "8e2eaf1f-f176-45b7-9f83-ebd9dbac93ee",
+      "author": "home",
+      "text": "Done. Papyrus adopted cli-login==0.1.0 in AnthusAI/Papyrus#885 (merged to develop). Mac sessions: a scenario seeds an earlier-format Keychain session under papyrus-newsroom-oauth with the unchanged per-site key, and it renews through the library. Live: papyrus doctor on the M1 renewed Ryan's existing shipped.anth.us Keychain session through the library.",
+      "created_at": "2026-10-30T14:01:17.888119Z",
+      "comment_type": "default"
     }
   ],
   "created_at": "2026-10-30T10:52:21.309520Z",
-  "updated_at": "2026-10-30T11:58:11.250332Z",
-  "closed_at": null,
+  "updated_at": "2026-10-30T14:01:17.900618Z",
+  "closed_at": "2026-10-30T14:01:17.900340Z",
   "right_now_summary": null,
   "right_now_updated_at": null,
   "custom": {}

{cli_login-0.1.0 → cli_login-0.3.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "cli-login"
-version = "0.1.0"
+version = "0.3.0"
 description = "One CLI login for every Anthus product: PKCE sign-in, remote approval, secure storage and renewal."
 readme = "README.md"
 requires-python = ">=3.10"

{cli_login-0.1.0 → cli_login-0.3.0}/src/cli_login/__init__.py

@@ -1,4 +1,4 @@
 """One CLI login for every Anthus product. See docs/design.md."""
 
-__version__ = "0.1.0"
+__version__ = "0.3.0"
 PROTOCOL_VERSION = 1

{cli_login-0.1.0 → cli_login-0.3.0}/src/cli_login/broker/handler.py

@@ -104,6 +104,10 @@ class Broker:
     def start(self, body: dict[str, Any], caller: str) -> tuple[int, dict[str, Any]]:
         if not throttle.allowed(self.store, "start", caller, throttle.START, self.now()):
             return 429, {"error": "too_many_requests", "retry_after": throttle.START.window_seconds}
+        if not throttle.allowed(self.store, "start", throttle.EVERYONE, throttle.ALL_STARTS, self.now()):
+            # One line the template's metric filter counts, so a flood raises the broker's alarm.
+            print(json.dumps({"event": "cli_login_start_ceiling", "limit": throttle.ALL_STARTS.calls}))
+            return 429, {"error": "too_many_requests", "retry_after": throttle.ALL_STARTS.window_seconds}
         try:
             if body.get("protocol") != PROTOCOL_VERSION:
                 return 400, {"error": "unsupported_protocol", "protocol": PROTOCOL_VERSION}
@@ -180,7 +184,11 @@ class Broker:
             taken = self.store.take(transaction)
             if taken is None:
                 return 400, {"error": "expired_token", "protocol": PROTOCOL_VERSION}
-            return 200, {"protocol": PROTOCOL_VERSION, "code": taken["code"], "redirect_uri": self.config.callback_uri}
+            answer = {"protocol": PROTOCOL_VERSION, "code": taken["code"], "redirect_uri": self.config.callback_uri}
+            for field, name in (("oidc_nonce", "nonce"), ("enrollment", "enrollment")):
+                if taken.get(field):
+                    answer[name] = taken[field]
+            return 200, answer
         if item["state"] == DENIED:
             return 400, {"error": "access_denied", "protocol": PROTOCOL_VERSION}
         self.store.transition(transaction, [PENDING, BOUND], {"last_poll_at": now}, expect={"last_poll_at": last})
@@ -214,10 +222,21 @@ class Broker:
         }
 
     def bind(self, event: dict[str, Any]) -> dict[str, Any]:
+        """Pending to bound, once. A product may also set the OpenID nonce its sign-in uses (for example a central
+        identity challenge's nonce) and an opaque ``enrollment`` string, both handed to the CLI with the code."""
         nonce_hash = event.get("nonce_hash")
         if self._live(event.get("transaction"), [PENDING]) is None or not HEX64.fullmatch(str(nonce_hash or "")):
             return {"ok": False, "error": "unavailable"}
-        bound = self.store.transition(event["transaction"], [PENDING], {"state": BOUND, "nonce_hash": nonce_hash})
+        changes = {"state": BOUND, "nonce_hash": nonce_hash}
+        if "nonce" in event:
+            if not NONCE.fullmatch(str(event["nonce"])):
+                return {"ok": False, "error": "unavailable"}
+            changes["oidc_nonce"] = event["nonce"]
+        if "enrollment" in event:
+            if not isinstance(event["enrollment"], str) or not event["enrollment"]:
+                return {"ok": False, "error": "unavailable"}
+            changes["enrollment"] = event["enrollment"]
+        bound = self.store.transition(event["transaction"], [PENDING], changes)
         return {"ok": True} if bound else {"ok": False, "error": "unavailable"}
 
     def complete(self, event: dict[str, Any]) -> dict[str, Any]:

{cli_login-0.1.0 → cli_login-0.3.0}/src/cli_login/broker/handler_test.py

@@ -1,6 +1,8 @@
 import base64
 import json
 
+import pytest
+
 from cli_login.broker import throttle
 from cli_login.broker.handler import Broker, BrokerConfig, matching_code, sha256_hex
 from cli_login.broker.transactions import MemoryTransactions
@@ -282,3 +284,51 @@ def test_the_config_requires_its_client_targets_and_https_pages():
         "BROKER_CALLBACK_URI": "https://a.example.test/cli/callback",
     })
     assert config.targets == ("https://a.example.test",)
+
+
+def test_starts_across_all_callers_have_one_ceiling_and_say_so_in_the_log(capsys):
+    b = broker()
+    callers = [f"198.51.100.{n}" for n in range(throttle.ALL_STARTS.calls // throttle.START.calls + 2)]
+    statuses = [b.start(start_body(), caller)[0] for caller in callers for _ in range(throttle.START.calls)]
+    assert statuses.count(200) == throttle.ALL_STARTS.calls
+    assert b.start(start_body(), "203.0.113.200") == (429, {"error": "too_many_requests", "retry_after": 60})
+    assert '"event": "cli_login_start_ceiling"' in capsys.readouterr().out
+
+
+def test_the_ceiling_resets_with_the_window():
+    clock = Clock()
+    b = broker(clock)
+    for n in range(throttle.ALL_STARTS.calls):
+        b.start(start_body(), f"caller-{n}")
+    assert b.start(start_body(), "caller-new")[0] == 429
+    clock.now += 60
+    assert b.start(start_body(), "caller-new")[0] == 200
+
+
+def test_a_product_nonce_and_enrollment_set_at_bind_come_back_once_with_the_code():
+    clock = Clock()
+    b = broker(clock)
+    transaction = started(b)
+    assert b.bind({"transaction": transaction, "nonce_hash": sha256_hex("n"), "nonce": "challenge-nonce-0001",
+                   "enrollment": "sealed-proof"}) == {"ok": True}
+    assert b.complete({"transaction": transaction, "nonce": "n", "code": "code"}) == {"ok": True}
+    clock.now += 5
+    status, answer = b.poll({"transaction": transaction, "poll_secret": SECRET}, "ip")
+    assert status == 200 and answer["nonce"] == "challenge-nonce-0001" and answer["enrollment"] == "sealed-proof"
+
+
+def test_without_a_product_nonce_the_poll_answer_is_unchanged():
+    clock = Clock()
+    b = broker(clock)
+    transaction = started(b)
+    approve(b, transaction)
+    clock.now += 5
+    assert set(b.poll({"transaction": transaction, "poll_secret": SECRET}, "ip")[1]) == {"protocol", "code", "redirect_uri"}
+
+
+@pytest.mark.parametrize("extra", [{"nonce": "short"}, {"nonce": 5}, {"enrollment": ""}, {"enrollment": ["x"]}])
+def test_a_malformed_product_nonce_or_enrollment_is_refused_and_nothing_is_bound(extra):
+    b = broker()
+    transaction = started(b)
+    assert b.bind({"transaction": transaction, "nonce_hash": sha256_hex("n"), **extra}) == {"ok": False, "error": "unavailable"}
+    assert b.describe({"transaction": transaction})["ok"] is True

{cli_login-0.1.0 → cli_login-0.3.0}/src/cli_login/broker/pages.py

@@ -89,12 +89,18 @@ class ApprovalPages:
         privileges: str,
         scope: str = "openid email profile",
         identity_provider: str | None = None,
+        prepare: Callable[[str, Mapping], tuple[str, str]] | None = None,
         token=secrets.token_urlsafe,
     ):
+        """``prepare(transaction, described)``, when given, runs on Approve before the bind and returns the OpenID
+        nonce the sign-in must use and an opaque ``enrollment`` string for the product's own enrollment step (for
+        example a central identity challenge's nonce and its sealed proof). The broker hands both to the CLI with
+        the code; a CLI accepts the nonce only when it asked to enroll."""
         self.invoke, self.authorize_endpoint, self.product = (lambda payload: invoke({**payload, "cli_login": PRIVATE_MARKER})), authorize_endpoint, product
         parts = urlsplit(authorize_endpoint)
         self.form_action = f"'self' {parts.scheme}://{parts.netloc}"
         self.privileges, self.scope, self.identity_provider, self.token = privileges, scope, identity_provider, token
+        self.prepare = prepare
 
     def approve(self, method: str, query: Mapping[str, str], form: Mapping[str, str], cookies: Mapping[str, str]) -> Page:
         if method == "GET":
@@ -114,7 +120,15 @@ class ApprovalPages:
         if not described.get("ok"):
             return _gone()
         nonce = self.token(32)
-        if not self.invoke({"operation": "bind", "transaction": transaction, "nonce_hash": hashlib.sha256(nonce.encode()).hexdigest()}).get("ok"):
+        bind = {"operation": "bind", "transaction": transaction, "nonce_hash": hashlib.sha256(nonce.encode()).hexdigest()}
+        oidc_nonce = described["nonce"]
+        if self.prepare is not None:
+            try:
+                oidc_nonce, enrollment = self.prepare(transaction, described)
+            except Exception:  # noqa: BLE001 - the product's enrollment service is unavailable: nothing is bound
+                return _message(503, "Sign-in is unavailable", "Try the approval link again in a moment.")
+            bind |= {"nonce": oidc_nonce, "enrollment": enrollment}
+        if not self.invoke(bind).get("ok"):
             return _gone()
         query_string = {
             "client_id": described["client_id"],
@@ -122,7 +136,7 @@ class ApprovalPages:
             "redirect_uri": described["redirect_uri"],
             "scope": self.scope,
             "state": f"{transaction}.{nonce}",
-            "nonce": described["nonce"],
+            "nonce": oidc_nonce,
             "code_challenge": described["code_challenge"],
             "code_challenge_method": "S256",
         }

{cli_login-0.1.0 → cli_login-0.3.0}/src/cli_login/broker/pages_test.py

@@ -133,3 +133,42 @@ def test_every_private_call_carries_the_marker():
                           privileges="Act as you.")
     pages.approve("GET", {"t": "x"}, {}, {})
     assert calls and all(call["cli_login"] == "private-v1" for call in calls)
+
+
+def test_a_prepare_hook_sets_the_sign_in_nonce_and_the_enrollment():
+    broker, _, transaction = world()
+    seen = []
+
+    def prepare(t, described):
+        seen.append((t, described["client_id"]))
+        return "challenge-nonce-0001", "sealed-proof"
+
+    pages = ApprovalPages(broker.handle, authorize_endpoint=AUTHORIZE, product="Example", privileges="Act as you.",
+                          prepare=prepare, token=counter())
+    page = pages.approve("GET", {"t": transaction}, {}, {})
+    csrf = cookie(page, CSRF_COOKIE)
+    approved = pages.approve("POST", {}, {"t": transaction, "csrf": csrf, "action": "approve", "confirm": "yes"}, {CSRF_COOKIE: csrf})
+    query = {key: value[0] for key, value in parse_qs(urlsplit(header(approved, "Location")).query).items()}
+    assert seen == [(transaction, "client-1")] and query["nonce"] == "challenge-nonce-0001"
+    item = broker.store.get(transaction)
+    assert item["oidc_nonce"] == "challenge-nonce-0001" and item["enrollment"] == "sealed-proof"
+
+
+def test_when_prepare_fails_nothing_is_bound_and_the_link_still_works():
+    broker, _, transaction = world()
+
+    def prepare(t, described):
+        raise RuntimeError("central identity service unavailable")
+
+    pages = ApprovalPages(broker.handle, authorize_endpoint=AUTHORIZE, product="Example", privileges="Act as you.",
+                          prepare=prepare, token=counter())
+    page = pages.approve("GET", {"t": transaction}, {}, {})
+    csrf = cookie(page, CSRF_COOKIE)
+    failed = pages.approve("POST", {}, {"t": transaction, "csrf": csrf, "action": "approve", "confirm": "yes"}, {CSRF_COOKIE: csrf})
+    assert failed.status == 503 and "central identity" not in failed.body
+    assert broker.describe({"transaction": transaction})["ok"] is True
+
+
+def counter():
+    tokens = iter(f"tok{n:02d}" for n in range(99))
+    return lambda _n: next(tokens)

{cli_login-0.1.0 → cli_login-0.3.0}/src/cli_login/broker/throttle.py

@@ -1,8 +1,9 @@
-"""Per-caller rate limits for the broker's public routes.
+"""Rate limits for the broker's public routes.
 
 The broker's ``/start`` and ``/poll`` take calls from anyone who can reach the function URL, so each caller (its
-source address) gets a fixed number of calls per window. A CLI that polls one transaction faster than its
-interval is told ``slow_down`` separately, by the poll itself.
+source address, or its IPv6 /64) gets a fixed number of calls per window. Starts also have one ceiling across all
+callers, for a flood spread over many addresses; real use is a handful of sign-ins a day. A CLI that polls one
+transaction faster than its interval is told ``slow_down`` separately, by the poll itself.
 """
 
 from __future__ import annotations
@@ -18,6 +19,8 @@ class Limit:
 
 START = Limit(calls=10, window_seconds=60)
 POLL = Limit(calls=120, window_seconds=60)
+ALL_STARTS = Limit(calls=100, window_seconds=60)
+EVERYONE = "*"  # the caller name the ceiling across all callers is counted under; never a real address
 
 
 def allowed(store, route: str, caller: str, limit: Limit, now: int) -> bool:

{cli_login-0.1.0 → cli_login-0.3.0}/src/cli_login/remote.py

@@ -101,6 +101,7 @@ def remote_login(
     host: str | None = None,
     note: str | None = None,
     expected_email: str | None = None,
+    enroll: Callable[[Mapping[str, Any], str, str | None], Any] | None = None,
     token=secrets.token_urlsafe,
 ):
     """Sign in through the target's broker and return what ``store_token_set`` returns.
@@ -113,6 +114,12 @@ def remote_login(
     Whoever approves first owns the session, and the approval URL and code are often relayed through chat. Pass
     ``expected_email`` to refuse, and store nothing, when the person who approved is someone else. The signed-in
     identity is always printed.
+
+    ``enroll(tokens, transaction, enrollment)``, when given, runs after the exchange and the identity checks and
+    before anything is stored; if it raises, nothing is stored. It is for a product whose sign-in needs its own
+    enrollment of each login (the Cyclotron lab enrolls each Cognito login at Prospectus). Only then does the CLI
+    accept an OpenID nonce chosen by the product's approval page, which the broker hands over with the code;
+    without ``enroll`` the CLI checks its own nonce and nothing else.
     """
     broker = getattr(target, "broker_endpoint", None)
     if not broker:
@@ -198,11 +205,15 @@ def remote_login(
     if status != 200:
         raise RemoteLoginError(str(tokens.get("error") or "exchange_refused"), "The sign-in provider refused the code; start the sign-in again.")
     claims = _claims(tokens.get("id_token"))
-    if claims.get("nonce") != nonce:
+    expected_nonce = answer.get("nonce") if enroll is not None and isinstance(answer.get("nonce"), str) else nonce
+    if claims.get("nonce") != expected_nonce:
         raise RemoteLoginError("nonce_mismatch", "The sign-in answered tokens for a different request; nothing was saved.")
     email = claims.get("email") if isinstance(claims.get("email"), str) else None
     if expected_email is not None and (email or "").casefold() != expected_email.casefold():
         raise RemoteLoginError("unexpected_identity", "Someone other than the expected person approved this sign-in; nothing was saved.")
+    if enroll is not None:
+        enrollment = answer.get("enrollment") if isinstance(answer.get("enrollment"), str) else None
+        enroll(tokens, transaction, enrollment)
     record = store_token_set(tokens)
     out(f"Signed in as {email or claims.get('sub', 'an unknown identity')}.")
     return record

{cli_login-0.1.0 → cli_login-0.3.0}/src/cli_login/remote_test.py

@@ -32,7 +32,8 @@ def jwt(claims):
 class World:
     """A real broker in-process, an approver who acts on the Nth poll, and a fake token endpoint."""
 
-    def __init__(self, *, approve_on_poll=2, deny=False):
+    def __init__(self, *, approve_on_poll=2, deny=False, product_nonce=None):
+        self.product_nonce = product_nonce
         self.now = 1000.0
         self.broker = Broker(
             MemoryTransactions(),
@@ -51,12 +52,13 @@ class World:
 
     def approver(self):
         described = self.broker.describe({"transaction": self.transaction})
-        self.issued_nonce = described["nonce"]
+        self.issued_nonce = self.product_nonce or described["nonce"]
         self.challenge = described["code_challenge"]
         if self.deny:
             self.broker.deny({"transaction": self.transaction})
             return
-        self.broker.bind({"transaction": self.transaction, "nonce_hash": sha256_hex("browser")})
+        extra = {"nonce": self.product_nonce, "enrollment": "sealed-proof"} if self.product_nonce else {}
+        self.broker.bind({"transaction": self.transaction, "nonce_hash": sha256_hex("browser"), **extra})
         self.broker.complete({"transaction": self.transaction, "nonce": "browser", "code": "auth-code"})
 
     def http(self, method, url, *, json_body=None, form=None, timeout=30):
@@ -314,3 +316,41 @@ def test_a_loopback_target_still_checks_the_brokers_callback_and_approval_origin
     with pytest.raises(RemoteLoginError) as raised:
         world.login(target=target)
     assert raised.value.code == "invalid_broker_answer" and world.polls == 0
+
+
+def enrolling(world, calls, *, fail=False):
+    def enroll(tokens, transaction, enrollment):
+        calls.append((tokens["refresh_token"], transaction, enrollment))
+        if fail:
+            raise RemoteLoginError("enrollment_refused", "The product refused to enroll this sign-in.")
+    return enroll
+
+
+def test_an_enrolling_sign_in_accepts_the_product_nonce_and_enrolls_before_storing():
+    world, stored, calls = World(product_nonce="challenge-nonce-0001"), [], []
+    remote_login(Target(), stored.append, http=world.http, out=world.printed.append, clock=world.clock, sleep=world.sleep,
+                 host="cloud-box", enroll=enrolling(world, calls))
+    assert calls == [("refresh", world.transaction, "sealed-proof")] and len(stored) == 1
+
+
+def test_without_enroll_a_product_nonce_is_never_accepted():
+    world, stored = World(product_nonce="challenge-nonce-0001"), []
+    with pytest.raises(RemoteLoginError) as raised:
+        remote_login(Target(), stored.append, http=world.http, out=world.printed.append, clock=world.clock,
+                     sleep=world.sleep, host="cloud-box")
+    assert raised.value.code == "nonce_mismatch" and stored == []
+
+
+def test_an_enrolling_sign_in_without_a_product_nonce_keeps_its_own_nonce_check():
+    world, stored, calls = World(), [], []
+    remote_login(Target(), stored.append, http=world.http, out=world.printed.append, clock=world.clock, sleep=world.sleep,
+                 host="cloud-box", enroll=enrolling(world, calls))
+    assert calls[0][2] is None and len(stored) == 1
+
+
+def test_a_refused_enrollment_stores_nothing():
+    world, stored, calls = World(product_nonce="challenge-nonce-0001"), [], []
+    with pytest.raises(RemoteLoginError) as raised:
+        remote_login(Target(), stored.append, http=world.http, out=world.printed.append, clock=world.clock,
+                     sleep=world.sleep, host="cloud-box", enroll=enrolling(world, calls, fail=True))
+    assert raised.value.code == "enrollment_refused" and stored == []

{cli_login-0.1.0 → cli_login-0.3.0}/src/cli_login/session.py

@@ -29,7 +29,16 @@ class Session:
         state_dir=None,
         login_command: str = "login",
         identity_provider: str | None = None,
+        api_token: str = "id",
+        authorization_scheme: str | None = None,
     ):
+        """``api_token`` names the token ``headers()`` hands to the API: ``"id"`` (Papyrus's AppSync) or ``"access"``
+        (an API that checks Cognito access tokens, such as the Cyclotron lab). ``authorization_scheme`` prefixes it,
+        for example ``"Bearer"``. The access token is only ever held in memory, never stored."""
+        if api_token not in ("id", "access"):
+            raise ValueError('api_token is "id" or "access"')
+        if authorization_scheme not in (None, "Bearer"):
+            raise ValueError('authorization_scheme is None or "Bearer"')
         self.target = target
         self.store = store if store is not None else open_store(target)
         self.provider = provider if provider is not None else HTTPProvider()
@@ -38,6 +47,8 @@ class Session:
         self.state_dir = state_dir if state_dir is not None else default_state_dir(target.namespace)
         self.login_command = login_command
         self.identity_provider = identity_provider
+        self.api_token = api_token
+        self.authorization_scheme = authorization_scheme
         self._token = None
         self._expires = 0.0
         self._subject = None
@@ -102,6 +113,17 @@ class Session:
             ):
                 raise ValueError()
             expires = min(float(claims["exp"]), self.clock() + float(response["expires_in"]))
+            if self.api_token == "access":
+                value = response["access_token"]
+                access = json.loads(base64.urlsafe_b64decode(value.split(".")[1] + "==="))
+                if (
+                    access["iss"] != expected.issuer
+                    or access["client_id"] != expected.client_id
+                    or access["token_use"] != "access"
+                    or access["sub"] != claims["sub"]
+                ):
+                    raise ValueError()
+                expires = min(expires, float(access["exp"]))
             if (
                 not math.isfinite(expires)
                 or not math.isfinite(float(response["expires_in"]))
@@ -172,7 +194,8 @@ class Session:
                         self._token = None
                     raise OAuthError(error.code, transient=error.transient, login_command=self.login_command) from None
                 self.store_token_set(response, previous=record)
-            return {"content-type": "application/json", "Authorization": self._token}
+            token = self._token if self.authorization_scheme is None else f"{self.authorization_scheme} {self._token}"
+            return {"content-type": "application/json", "Authorization": token}
 
     def status(self) -> dict:
         try:

{cli_login-0.1.0 → cli_login-0.3.0}/src/cli_login/session_test.py

@@ -223,3 +223,63 @@ def test_a_corrupt_stored_record_is_an_error_with_guidance(world):
     store.data[target.key] = "not json"
     with pytest.raises(AuthError, match="tool login"):
         new().headers(target.api_endpoint)
+
+
+def test_by_default_headers_hand_out_the_bare_id_token_exactly_as_in_0_1_0(world):
+    target, _clock, _store, _provider, _seen, new = world
+    session = new()
+    session.login()
+    headers = session.headers(target.api_endpoint)
+    assert headers == {"content-type": "application/json", "Authorization": session._token}
+    assert json.loads(__import__("base64").urlsafe_b64decode(headers["Authorization"].split(".")[1] + "==="))["token_use"] == "id"
+
+
+def test_an_access_token_api_gets_the_access_token_with_its_scheme(world):
+    target, _clock, _store, _provider, _seen, new = world
+    session = new(api_token="access", authorization_scheme="Bearer")
+    session.login()
+    scheme, _, token = session.headers(target.api_endpoint)["Authorization"].partition(" ")
+    claims = json.loads(__import__("base64").urlsafe_b64decode(token.split(".")[1] + "==="))
+    assert scheme == "Bearer" and claims["token_use"] == "access" and claims["client_id"] == target.client_id
+
+
+def test_the_access_token_is_never_stored(world):
+    target, _clock, store, _provider, _seen, new = world
+    session = new(api_token="access", authorization_scheme="Bearer")
+    session.login()
+    record = json.loads(store.data[target.key])
+    assert set(record) == {"subject", "label", "refresh_token", "created_at"}
+    assert session._token not in store.data[target.key]
+
+
+@pytest.mark.parametrize("change", [{"client_id": "other"}, {"token_use": "id"}, {"issuer": "https://elsewhere.example.test/p"},
+                                    {"subject": "someone-else"}])
+def test_a_mismatched_access_token_is_refused_and_nothing_is_saved(world, change):
+    from .testing import make_access_token
+
+    _target, clock, store, _provider, _seen, new = world
+    session = new(api_token="access")
+    response = {"id_token": make_id_token(clock()), "access_token": make_access_token(clock(), **change),
+                "refresh_token": "r", "expires_in": 3600}
+    with pytest.raises(AuthError):
+        session.store_token_set(response)
+    assert store.data == {}
+
+
+def test_a_short_lived_access_token_is_renewed_before_it_lapses(world):
+    from .testing import make_access_token
+
+    _target, clock, _store, _provider, _seen, new = world
+    session = new(api_token="access")
+    session.store_token_set({"id_token": make_id_token(clock()), "access_token": make_access_token(clock(), lifetime=300),
+                             "refresh_token": "r", "expires_in": 3600})
+    assert session._expires == clock() + 300
+
+
+def test_a_session_names_only_known_token_choices():
+    from .testing import make_target
+
+    with pytest.raises(ValueError):
+        Session(make_target(), store=FakeStore(), api_token="refresh")
+    with pytest.raises(ValueError):
+        Session(make_target(), store=FakeStore(), authorization_scheme="Basic")

{cli_login-0.1.0 → cli_login-0.3.0}/src/cli_login/testing.py

@@ -43,6 +43,15 @@ def make_id_token(now, *, subject="person-1", issuer=ISSUER, audience=CLIENT_ID,
     return encode({"alg": "RS256"}) + "." + encode(claims) + ".fixture-signature"
 
 
+def make_access_token(now, *, subject="person-1", issuer=ISSUER, client_id=CLIENT_ID, token_use="access", lifetime=3600):
+    claims = {"iss": issuer, "client_id": client_id, "sub": subject, "token_use": token_use, "exp": now + lifetime}
+
+    def encode(value):
+        return base64.urlsafe_b64encode(json.dumps(value).encode()).decode().rstrip("=")
+
+    return encode({"alg": "RS256"}) + "." + encode(claims) + ".fixture-signature"
+
+
 class FakeClock:
     def __init__(self, now=1000.0):
         self.now = now
@@ -97,6 +106,7 @@ class FakeProvider:
             raise self.failure
         return {
             "id_token": make_id_token(self.clock(), subject=self.subject, issuer=self.issuer),
+            "access_token": make_access_token(self.clock(), subject=self.subject, issuer=self.issuer),
             "refresh_token": "refresh-secret-" + str(len(self.calls)),
             "expires_in": 3600,
         }