cloudsmith-cli 1.20.0__py3-none-any.whl

cloudsmith_cli/cli/commands/whoami.py

@@ -0,0 +1,188 @@
+"""CLI/Commands - Retrieve authentication status."""
+
+import click
+
+from ...core import keyring
+from ...core.api.exceptions import ApiException
+from ...core.api.user import get_token_metadata, get_user_brief
+from .. import decorators, utils
+from ..exceptions import handle_api_exceptions
+from .main import main
+
+
+def _get_active_method(api_config):
+    """Inspect API config to determine SSO, API key, or no auth."""
+    headers = getattr(api_config, "headers", {}) or {}
+    if headers.get("Authorization", "").startswith("Bearer "):
+        return "sso_token"
+    if (getattr(api_config, "api_key", {}) or {}).get("X-Api-Key"):
+        return "api_key"
+    return "none"
+
+
+def _get_api_key_source(opts):
+    """Determine where the API key was loaded from.
+
+    Uses the credential provider chain result attached by initialise_api.
+    """
+    credential = getattr(opts, "credential", None)
+    if credential and credential.auth_type == "api_key":
+        return {
+            "configured": True,
+            "source": credential.source_detail or credential.source_name,
+            "source_key": credential.source_name,
+        }
+
+    return {"configured": False, "source": None, "source_key": None}
+
+
+def _get_sso_status(api_host):
+    """Return SSO token status from the system keyring."""
+    enabled = keyring.should_use_keyring()
+    has_tokens = enabled and keyring.has_sso_tokens(api_host)
+    refreshed = keyring.get_refresh_attempted_at(api_host) if has_tokens else None
+
+    return {
+        "configured": has_tokens,
+        "keyring_enabled": enabled,
+        "source": "System Keyring" if has_tokens else None,
+        "last_refreshed": utils.fmt_datetime(refreshed) if refreshed else None,
+    }
+
+
+def _get_verbose_auth_data(opts, api_host):
+    """Gather all auth details for verbose output."""
+    api_key_info = _get_api_key_source(opts)
+    sso_info = _get_sso_status(api_host)
+
+    # Fetch token metadata (extra API call, graceful fallback)
+    token_meta = None
+    if api_key_info["configured"]:
+        try:
+            token_meta = get_token_metadata()
+        except ApiException:
+            token_meta = None
+
+    created = token_meta.get("created") if token_meta else None
+    api_key_info["slug"] = token_meta["slug"] if token_meta else None
+    api_key_info["created"] = utils.fmt_datetime(created) if created else None
+
+    return {
+        "active_method": _get_active_method(opts.api_config),
+        "api_key": api_key_info,
+        "sso": sso_info,
+    }
+
+
+def _print_user_line(name, username, email):
+    """Print a styled user identity line."""
+    styled_name = click.style(name or "Unknown", fg="cyan")
+    styled_slug = click.style(username or "Unknown", fg="magenta")
+    email_part = f", email: {click.style(email, fg='green')}" if email else ""
+    click.echo(f"User: {styled_name} (slug: {styled_slug}{email_part})")
+
+
+def _print_verbose_text(data):
+    """Print verbose authentication details as styled text."""
+    click.echo()
+    _print_user_line(data["name"], data["username"], data.get("email"))
+
+    auth = data["auth"]
+    active = auth["active_method"]
+    ak = auth["api_key"]
+    sso = auth["sso"]
+
+    click.echo()
+    if active == "sso_token":
+        click.secho("Authentication Method: SSO Token (primary)", fg="cyan", bold=True)
+        if sso.get("source"):
+            click.echo(f"  Source: {sso['source']}")
+        if sso.get("last_refreshed"):
+            click.echo(
+                f"  Last Refreshed: {sso['last_refreshed']} (refreshes every 30 min)"
+            )
+        if ak["configured"]:
+            click.echo()
+            click.secho("API Key: Also configured", fg="yellow")
+            if ak.get("source"):
+                click.echo(f"  Source: {ak['source']}")
+            click.echo("  Note: SSO token is being used instead")
+    elif active == "api_key":
+        if ak.get("source_key") == "oidc":
+            click.secho(
+                "Authentication Method: OIDC Auto-Discovery", fg="cyan", bold=True
+            )
+        else:
+            click.secho("Authentication Method: API Key", fg="cyan", bold=True)
+        for label, field in [
+            ("Source", "source"),
+            ("Token Slug", "slug"),
+            ("Created", "created"),
+        ]:
+            if ak.get(field):
+                click.echo(f"  {label}: {ak[field]}")
+    else:
+        click.secho("Authentication Method: None (anonymous)", fg="yellow", bold=True)
+
+    if active != "sso_token":
+        click.echo()
+        if not sso["keyring_enabled"]:
+            click.secho(
+                "SSO Status: Keyring disabled (CLOUDSMITH_NO_KEYRING)", fg="yellow"
+            )
+        elif sso["configured"]:
+            click.secho("SSO Status: Configured (not active)", fg="yellow")
+            click.echo(f"  Source: {sso['source']}")
+        else:
+            click.echo("SSO Status: Not configured")
+            click.echo("  Keyring: Enabled (no tokens stored)")
+
+
+@main.command()
+@decorators.common_cli_config_options
+@decorators.common_cli_output_options
+@decorators.common_api_auth_options
+@decorators.initialise_api
+@click.pass_context
+def whoami(ctx, opts):
+    """Retrieve your current authentication status."""
+    use_stderr = utils.should_use_stderr(opts)
+
+    click.echo(
+        "Retrieving your authentication status from the API ... ",
+        nl=False,
+        err=use_stderr,
+    )
+
+    context_msg = "Failed to retrieve your authentication status!"
+    with handle_api_exceptions(ctx, opts=opts, context_msg=context_msg):
+        with utils.maybe_spinner(opts):
+            is_auth, username, email, name = get_user_brief()
+    click.secho("OK", fg="green", err=use_stderr)
+
+    data = {
+        "is_authenticated": is_auth,
+        "username": username,
+        "email": email,
+        "name": name,
+    }
+
+    if opts.verbose:
+        api_host = getattr(opts.api_config, "host", None) or opts.api_host
+        data["auth"] = _get_verbose_auth_data(opts, api_host)
+
+    if utils.maybe_print_as_json(opts, data):
+        if not is_auth:
+            ctx.exit(1)
+        return
+
+    if not is_auth:
+        click.echo("You are authenticated as:")
+        click.secho("Nobody (i.e. anonymous user)", fg="yellow")
+        ctx.exit(1)
+
+    if opts.verbose:
+        _print_verbose_text(data)
+    else:
+        click.echo("You are authenticated as:")
+        _print_user_line(name, username, email)