cli-login 0.2.0__tar.gz → 0.3.0__tar.gz

{cli_login-0.2.0 → cli_login-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: cli-login
-Version: 0.2.0
+Version: 0.3.0
 Summary: One CLI login for every Anthus product: PKCE sign-in, remote approval, secure storage and renewal.
 Author: Anthus AI
 License: MIT

{cli_login-0.2.0 → cli_login-0.3.0}/docs/protocol.md

@@ -95,7 +95,9 @@ The CLI checks:
 - that `redirect_uri` equals its target's `remote_callback_uri`, and that the `approval_url` from `/start` is
   on that URI's origin. A target with a broker must name its remote callback, even when its local sign-in uses a
   loopback callback;
-- that the ID token's `nonce` equals its own;
+- that the ID token's `nonce` equals its own. The one exception: a CLI that asked to enroll (`enroll=` in the
+  Python client) checks the nonce the poll handed over, if there is one. It then runs its enroll step, with its
+  tokens, the transaction and the `enrollment` string, before storing anything;
 - that the approver's email is the expected one, when one is given.
 
 It then passes the response to the session store, which checks issuer, audience, `token_use` and expiry.
@@ -117,7 +119,7 @@ A failure answers `{"ok": false, "error": "unavailable"}` and says nothing more.
 | `operation` | Fields | Effect |
 |---|---|---|
 | `describe` | `transaction` | For a pending, unexpired transaction: `client_id`, `target`, `requester`, `matching_code`, `code_challenge`, `nonce`, `redirect_uri`, `expires_at` |
-| `bind` | `transaction`, `nonce_hash` | Pending to bound, once. After this, nobody else can approve it. |
+| `bind` | `transaction`, `nonce_hash`, optional `nonce` and `enrollment` | Pending to bound, once. After this, nobody else can approve it. A product whose sign-in enrolls each login (the Cyclotron lab, at Prospectus) sets the OpenID `nonce` its approval page uses and an opaque `enrollment` string. The poll hands both to the CLI with the code. |
 | `complete` | `transaction`, `nonce`, `code` | Bound to approved, only when `sha256(nonce)` equals the bound hash |
 | `deny` | `transaction` | Pending or bound to denied |
 

cli_login-0.3.0/project/events/2026-10-30T14-01-17.888Z__bf995622-7f63-4936-9891-4cebf7208cf5.json

@@ -0,0 +1,12 @@
+{
+  "schema_version": 1,
+  "event_id": "bf995622-7f63-4936-9891-4cebf7208cf5",
+  "issue_id": "cli-login-96ed2301-f038-4d76-84bb-b670184ab538",
+  "event_type": "comment_added",
+  "occurred_at": "2026-10-30T14:01:17.888Z",
+  "actor_id": "home",
+  "payload": {
+    "comment_id": "8e2eaf1f-f176-45b7-9f83-ebd9dbac93ee",
+    "comment_author": "home"
+  }
+}

cli_login-0.3.0/project/events/2026-10-30T14-01-17.900Z__e9675700-922f-449e-8b9f-9779917ce373.json

@@ -0,0 +1,12 @@
+{
+  "schema_version": 1,
+  "event_id": "e9675700-922f-449e-8b9f-9779917ce373",
+  "issue_id": "cli-login-96ed2301-f038-4d76-84bb-b670184ab538",
+  "event_type": "state_transition",
+  "occurred_at": "2026-10-30T14:01:17.900Z",
+  "actor_id": "home",
+  "payload": {
+    "from_status": "in_progress",
+    "to_status": "closed"
+  }
+}

{cli_login-0.2.0 → cli_login-0.3.0}/project/issues/cli-login-96ed2301-f038-4d76-84bb-b670184ab538.json

@@ -3,7 +3,7 @@
   "title": "Move Papyrus's CLI login into the library without breaking Mac sessions",
   "description": "Owner: Papyrus session. Move src/papyrus_content/cli_user_auth.py and macos_keychain.py into anthus_cli_login (target, oauth, session, locks, stores/macos), behind a product target the caller supplies. Keep Keychain SERVICE 'papyrus-newsroom-oauth' and the per-site keys, so existing Mac sessions renew unchanged; keep Papyrus's behaviour and port its specs (features_backend/cli-user-auth.feature) as Gherkin here. Done when Papyrus's specs pass against the library with no behaviour change.",
   "type": "story",
-  "status": "in_progress",
+  "status": "closed",
   "priority": 1,
   "assignee": null,
   "creator": null,
@@ -29,11 +29,18 @@
       "text": "Library half done in #1 (merged). Kept in progress: 'without breaking Mac sessions' is only proven once the Papyrus CLI uses the library and an existing Keychain session renews through it. That Papyrus PR (Target per site, namespace papyrus-newsroom-oauth, identity_provider Google, existing state dir) is next after the stores story.",
       "created_at": "2026-10-30T11:58:11.249739Z",
       "comment_type": "default"
+    },
+    {
+      "id": "8e2eaf1f-f176-45b7-9f83-ebd9dbac93ee",
+      "author": "home",
+      "text": "Done. Papyrus adopted cli-login==0.1.0 in AnthusAI/Papyrus#885 (merged to develop). Mac sessions: a scenario seeds an earlier-format Keychain session under papyrus-newsroom-oauth with the unchanged per-site key, and it renews through the library. Live: papyrus doctor on the M1 renewed Ryan's existing shipped.anth.us Keychain session through the library.",
+      "created_at": "2026-10-30T14:01:17.888119Z",
+      "comment_type": "default"
     }
   ],
   "created_at": "2026-10-30T10:52:21.309520Z",
-  "updated_at": "2026-10-30T11:58:11.250332Z",
-  "closed_at": null,
+  "updated_at": "2026-10-30T14:01:17.900618Z",
+  "closed_at": "2026-10-30T14:01:17.900340Z",
   "right_now_summary": null,
   "right_now_updated_at": null,
   "custom": {}

{cli_login-0.2.0 → cli_login-0.3.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "cli-login"
-version = "0.2.0"
+version = "0.3.0"
 description = "One CLI login for every Anthus product: PKCE sign-in, remote approval, secure storage and renewal."
 readme = "README.md"
 requires-python = ">=3.10"

{cli_login-0.2.0 → cli_login-0.3.0}/src/cli_login/__init__.py

@@ -1,4 +1,4 @@
 """One CLI login for every Anthus product. See docs/design.md."""
 
-__version__ = "0.2.0"
+__version__ = "0.3.0"
 PROTOCOL_VERSION = 1

{cli_login-0.2.0 → cli_login-0.3.0}/src/cli_login/broker/handler.py

@@ -184,7 +184,11 @@ class Broker:
             taken = self.store.take(transaction)
             if taken is None:
                 return 400, {"error": "expired_token", "protocol": PROTOCOL_VERSION}
-            return 200, {"protocol": PROTOCOL_VERSION, "code": taken["code"], "redirect_uri": self.config.callback_uri}
+            answer = {"protocol": PROTOCOL_VERSION, "code": taken["code"], "redirect_uri": self.config.callback_uri}
+            for field, name in (("oidc_nonce", "nonce"), ("enrollment", "enrollment")):
+                if taken.get(field):
+                    answer[name] = taken[field]
+            return 200, answer
         if item["state"] == DENIED:
             return 400, {"error": "access_denied", "protocol": PROTOCOL_VERSION}
         self.store.transition(transaction, [PENDING, BOUND], {"last_poll_at": now}, expect={"last_poll_at": last})
@@ -218,10 +222,21 @@ class Broker:
         }
 
     def bind(self, event: dict[str, Any]) -> dict[str, Any]:
+        """Pending to bound, once. A product may also set the OpenID nonce its sign-in uses (for example a central
+        identity challenge's nonce) and an opaque ``enrollment`` string, both handed to the CLI with the code."""
         nonce_hash = event.get("nonce_hash")
         if self._live(event.get("transaction"), [PENDING]) is None or not HEX64.fullmatch(str(nonce_hash or "")):
             return {"ok": False, "error": "unavailable"}
-        bound = self.store.transition(event["transaction"], [PENDING], {"state": BOUND, "nonce_hash": nonce_hash})
+        changes = {"state": BOUND, "nonce_hash": nonce_hash}
+        if "nonce" in event:
+            if not NONCE.fullmatch(str(event["nonce"])):
+                return {"ok": False, "error": "unavailable"}
+            changes["oidc_nonce"] = event["nonce"]
+        if "enrollment" in event:
+            if not isinstance(event["enrollment"], str) or not event["enrollment"]:
+                return {"ok": False, "error": "unavailable"}
+            changes["enrollment"] = event["enrollment"]
+        bound = self.store.transition(event["transaction"], [PENDING], changes)
         return {"ok": True} if bound else {"ok": False, "error": "unavailable"}
 
     def complete(self, event: dict[str, Any]) -> dict[str, Any]:

{cli_login-0.2.0 → cli_login-0.3.0}/src/cli_login/broker/handler_test.py

@@ -1,6 +1,8 @@
 import base64
 import json
 
+import pytest
+
 from cli_login.broker import throttle
 from cli_login.broker.handler import Broker, BrokerConfig, matching_code, sha256_hex
 from cli_login.broker.transactions import MemoryTransactions
@@ -301,3 +303,32 @@ def test_the_ceiling_resets_with_the_window():
     assert b.start(start_body(), "caller-new")[0] == 429
     clock.now += 60
     assert b.start(start_body(), "caller-new")[0] == 200
+
+
+def test_a_product_nonce_and_enrollment_set_at_bind_come_back_once_with_the_code():
+    clock = Clock()
+    b = broker(clock)
+    transaction = started(b)
+    assert b.bind({"transaction": transaction, "nonce_hash": sha256_hex("n"), "nonce": "challenge-nonce-0001",
+                   "enrollment": "sealed-proof"}) == {"ok": True}
+    assert b.complete({"transaction": transaction, "nonce": "n", "code": "code"}) == {"ok": True}
+    clock.now += 5
+    status, answer = b.poll({"transaction": transaction, "poll_secret": SECRET}, "ip")
+    assert status == 200 and answer["nonce"] == "challenge-nonce-0001" and answer["enrollment"] == "sealed-proof"
+
+
+def test_without_a_product_nonce_the_poll_answer_is_unchanged():
+    clock = Clock()
+    b = broker(clock)
+    transaction = started(b)
+    approve(b, transaction)
+    clock.now += 5
+    assert set(b.poll({"transaction": transaction, "poll_secret": SECRET}, "ip")[1]) == {"protocol", "code", "redirect_uri"}
+
+
+@pytest.mark.parametrize("extra", [{"nonce": "short"}, {"nonce": 5}, {"enrollment": ""}, {"enrollment": ["x"]}])
+def test_a_malformed_product_nonce_or_enrollment_is_refused_and_nothing_is_bound(extra):
+    b = broker()
+    transaction = started(b)
+    assert b.bind({"transaction": transaction, "nonce_hash": sha256_hex("n"), **extra}) == {"ok": False, "error": "unavailable"}
+    assert b.describe({"transaction": transaction})["ok"] is True

{cli_login-0.2.0 → cli_login-0.3.0}/src/cli_login/broker/pages.py

@@ -89,12 +89,18 @@ class ApprovalPages:
         privileges: str,
         scope: str = "openid email profile",
         identity_provider: str | None = None,
+        prepare: Callable[[str, Mapping], tuple[str, str]] | None = None,
         token=secrets.token_urlsafe,
     ):
+        """``prepare(transaction, described)``, when given, runs on Approve before the bind and returns the OpenID
+        nonce the sign-in must use and an opaque ``enrollment`` string for the product's own enrollment step (for
+        example a central identity challenge's nonce and its sealed proof). The broker hands both to the CLI with
+        the code; a CLI accepts the nonce only when it asked to enroll."""
         self.invoke, self.authorize_endpoint, self.product = (lambda payload: invoke({**payload, "cli_login": PRIVATE_MARKER})), authorize_endpoint, product
         parts = urlsplit(authorize_endpoint)
         self.form_action = f"'self' {parts.scheme}://{parts.netloc}"
         self.privileges, self.scope, self.identity_provider, self.token = privileges, scope, identity_provider, token
+        self.prepare = prepare
 
     def approve(self, method: str, query: Mapping[str, str], form: Mapping[str, str], cookies: Mapping[str, str]) -> Page:
         if method == "GET":
@@ -114,7 +120,15 @@ class ApprovalPages:
         if not described.get("ok"):
             return _gone()
         nonce = self.token(32)
-        if not self.invoke({"operation": "bind", "transaction": transaction, "nonce_hash": hashlib.sha256(nonce.encode()).hexdigest()}).get("ok"):
+        bind = {"operation": "bind", "transaction": transaction, "nonce_hash": hashlib.sha256(nonce.encode()).hexdigest()}
+        oidc_nonce = described["nonce"]
+        if self.prepare is not None:
+            try:
+                oidc_nonce, enrollment = self.prepare(transaction, described)
+            except Exception:  # noqa: BLE001 - the product's enrollment service is unavailable: nothing is bound
+                return _message(503, "Sign-in is unavailable", "Try the approval link again in a moment.")
+            bind |= {"nonce": oidc_nonce, "enrollment": enrollment}
+        if not self.invoke(bind).get("ok"):
             return _gone()
         query_string = {
             "client_id": described["client_id"],
@@ -122,7 +136,7 @@ class ApprovalPages:
             "redirect_uri": described["redirect_uri"],
             "scope": self.scope,
             "state": f"{transaction}.{nonce}",
-            "nonce": described["nonce"],
+            "nonce": oidc_nonce,
             "code_challenge": described["code_challenge"],
             "code_challenge_method": "S256",
         }

{cli_login-0.2.0 → cli_login-0.3.0}/src/cli_login/broker/pages_test.py

@@ -133,3 +133,42 @@ def test_every_private_call_carries_the_marker():
                           privileges="Act as you.")
     pages.approve("GET", {"t": "x"}, {}, {})
     assert calls and all(call["cli_login"] == "private-v1" for call in calls)
+
+
+def test_a_prepare_hook_sets_the_sign_in_nonce_and_the_enrollment():
+    broker, _, transaction = world()
+    seen = []
+
+    def prepare(t, described):
+        seen.append((t, described["client_id"]))
+        return "challenge-nonce-0001", "sealed-proof"
+
+    pages = ApprovalPages(broker.handle, authorize_endpoint=AUTHORIZE, product="Example", privileges="Act as you.",
+                          prepare=prepare, token=counter())
+    page = pages.approve("GET", {"t": transaction}, {}, {})
+    csrf = cookie(page, CSRF_COOKIE)
+    approved = pages.approve("POST", {}, {"t": transaction, "csrf": csrf, "action": "approve", "confirm": "yes"}, {CSRF_COOKIE: csrf})
+    query = {key: value[0] for key, value in parse_qs(urlsplit(header(approved, "Location")).query).items()}
+    assert seen == [(transaction, "client-1")] and query["nonce"] == "challenge-nonce-0001"
+    item = broker.store.get(transaction)
+    assert item["oidc_nonce"] == "challenge-nonce-0001" and item["enrollment"] == "sealed-proof"
+
+
+def test_when_prepare_fails_nothing_is_bound_and_the_link_still_works():
+    broker, _, transaction = world()
+
+    def prepare(t, described):
+        raise RuntimeError("central identity service unavailable")
+
+    pages = ApprovalPages(broker.handle, authorize_endpoint=AUTHORIZE, product="Example", privileges="Act as you.",
+                          prepare=prepare, token=counter())
+    page = pages.approve("GET", {"t": transaction}, {}, {})
+    csrf = cookie(page, CSRF_COOKIE)
+    failed = pages.approve("POST", {}, {"t": transaction, "csrf": csrf, "action": "approve", "confirm": "yes"}, {CSRF_COOKIE: csrf})
+    assert failed.status == 503 and "central identity" not in failed.body
+    assert broker.describe({"transaction": transaction})["ok"] is True
+
+
+def counter():
+    tokens = iter(f"tok{n:02d}" for n in range(99))
+    return lambda _n: next(tokens)

{cli_login-0.2.0 → cli_login-0.3.0}/src/cli_login/remote.py

@@ -101,6 +101,7 @@ def remote_login(
     host: str | None = None,
     note: str | None = None,
     expected_email: str | None = None,
+    enroll: Callable[[Mapping[str, Any], str, str | None], Any] | None = None,
     token=secrets.token_urlsafe,
 ):
     """Sign in through the target's broker and return what ``store_token_set`` returns.
@@ -113,6 +114,12 @@ def remote_login(
     Whoever approves first owns the session, and the approval URL and code are often relayed through chat. Pass
     ``expected_email`` to refuse, and store nothing, when the person who approved is someone else. The signed-in
     identity is always printed.
+
+    ``enroll(tokens, transaction, enrollment)``, when given, runs after the exchange and the identity checks and
+    before anything is stored; if it raises, nothing is stored. It is for a product whose sign-in needs its own
+    enrollment of each login (the Cyclotron lab enrolls each Cognito login at Prospectus). Only then does the CLI
+    accept an OpenID nonce chosen by the product's approval page, which the broker hands over with the code;
+    without ``enroll`` the CLI checks its own nonce and nothing else.
     """
     broker = getattr(target, "broker_endpoint", None)
     if not broker:
@@ -198,11 +205,15 @@ def remote_login(
     if status != 200:
         raise RemoteLoginError(str(tokens.get("error") or "exchange_refused"), "The sign-in provider refused the code; start the sign-in again.")
     claims = _claims(tokens.get("id_token"))
-    if claims.get("nonce") != nonce:
+    expected_nonce = answer.get("nonce") if enroll is not None and isinstance(answer.get("nonce"), str) else nonce
+    if claims.get("nonce") != expected_nonce:
         raise RemoteLoginError("nonce_mismatch", "The sign-in answered tokens for a different request; nothing was saved.")
     email = claims.get("email") if isinstance(claims.get("email"), str) else None
     if expected_email is not None and (email or "").casefold() != expected_email.casefold():
         raise RemoteLoginError("unexpected_identity", "Someone other than the expected person approved this sign-in; nothing was saved.")
+    if enroll is not None:
+        enrollment = answer.get("enrollment") if isinstance(answer.get("enrollment"), str) else None
+        enroll(tokens, transaction, enrollment)
     record = store_token_set(tokens)
     out(f"Signed in as {email or claims.get('sub', 'an unknown identity')}.")
     return record

{cli_login-0.2.0 → cli_login-0.3.0}/src/cli_login/remote_test.py

@@ -32,7 +32,8 @@ def jwt(claims):
 class World:
     """A real broker in-process, an approver who acts on the Nth poll, and a fake token endpoint."""
 
-    def __init__(self, *, approve_on_poll=2, deny=False):
+    def __init__(self, *, approve_on_poll=2, deny=False, product_nonce=None):
+        self.product_nonce = product_nonce
         self.now = 1000.0
         self.broker = Broker(
             MemoryTransactions(),
@@ -51,12 +52,13 @@ class World:
 
     def approver(self):
         described = self.broker.describe({"transaction": self.transaction})
-        self.issued_nonce = described["nonce"]
+        self.issued_nonce = self.product_nonce or described["nonce"]
         self.challenge = described["code_challenge"]
         if self.deny:
             self.broker.deny({"transaction": self.transaction})
             return
-        self.broker.bind({"transaction": self.transaction, "nonce_hash": sha256_hex("browser")})
+        extra = {"nonce": self.product_nonce, "enrollment": "sealed-proof"} if self.product_nonce else {}
+        self.broker.bind({"transaction": self.transaction, "nonce_hash": sha256_hex("browser"), **extra})
         self.broker.complete({"transaction": self.transaction, "nonce": "browser", "code": "auth-code"})
 
     def http(self, method, url, *, json_body=None, form=None, timeout=30):
@@ -314,3 +316,41 @@ def test_a_loopback_target_still_checks_the_brokers_callback_and_approval_origin
     with pytest.raises(RemoteLoginError) as raised:
         world.login(target=target)
     assert raised.value.code == "invalid_broker_answer" and world.polls == 0
+
+
+def enrolling(world, calls, *, fail=False):
+    def enroll(tokens, transaction, enrollment):
+        calls.append((tokens["refresh_token"], transaction, enrollment))
+        if fail:
+            raise RemoteLoginError("enrollment_refused", "The product refused to enroll this sign-in.")
+    return enroll
+
+
+def test_an_enrolling_sign_in_accepts_the_product_nonce_and_enrolls_before_storing():
+    world, stored, calls = World(product_nonce="challenge-nonce-0001"), [], []
+    remote_login(Target(), stored.append, http=world.http, out=world.printed.append, clock=world.clock, sleep=world.sleep,
+                 host="cloud-box", enroll=enrolling(world, calls))
+    assert calls == [("refresh", world.transaction, "sealed-proof")] and len(stored) == 1
+
+
+def test_without_enroll_a_product_nonce_is_never_accepted():
+    world, stored = World(product_nonce="challenge-nonce-0001"), []
+    with pytest.raises(RemoteLoginError) as raised:
+        remote_login(Target(), stored.append, http=world.http, out=world.printed.append, clock=world.clock,
+                     sleep=world.sleep, host="cloud-box")
+    assert raised.value.code == "nonce_mismatch" and stored == []
+
+
+def test_an_enrolling_sign_in_without_a_product_nonce_keeps_its_own_nonce_check():
+    world, stored, calls = World(), [], []
+    remote_login(Target(), stored.append, http=world.http, out=world.printed.append, clock=world.clock, sleep=world.sleep,
+                 host="cloud-box", enroll=enrolling(world, calls))
+    assert calls[0][2] is None and len(stored) == 1
+
+
+def test_a_refused_enrollment_stores_nothing():
+    world, stored, calls = World(product_nonce="challenge-nonce-0001"), [], []
+    with pytest.raises(RemoteLoginError) as raised:
+        remote_login(Target(), stored.append, http=world.http, out=world.printed.append, clock=world.clock,
+                     sleep=world.sleep, host="cloud-box", enroll=enrolling(world, calls, fail=True))
+    assert raised.value.code == "enrollment_refused" and stored == []