current-cli 0.1.28__tar.gz → 0.1.29__tar.gz

{current_cli-0.1.28 → current_cli-0.1.29}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: current-cli
-Version: 0.1.28
+Version: 0.1.29
 Summary: Command line interface for the Current API, generated from its OpenAPI schema at runtime
 Author-email: Orin <your-email@example.com>
 License-Expression: MIT

{current_cli-0.1.28 → current_cli-0.1.29}/current_cli/schema.yml

@@ -63,10 +63,170 @@ paths:
               schema:
                 $ref: '#/components/schemas/Me'
           description: ''
+  /api/accounts/auth/mfa/admin-reset/:
+    post:
+      operationId: accounts_auth_mfa_admin_reset_create
+      description: |-
+        Superadmin-only: clear a user's TOTP enrollment so they can enroll a
+        new device, for when they've lost their authenticator app. There are no
+        recovery codes, so this is the only way back in for such a user.
+      tags:
+      - accounts
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/MFAAdminResetRequestRequest'
+          application/x-www-form-urlencoded:
+            schema:
+              $ref: '#/components/schemas/MFAAdminResetRequestRequest'
+          multipart/form-data:
+            schema:
+              $ref: '#/components/schemas/MFAAdminResetRequestRequest'
+        required: true
+      security:
+      - MessagingJobTokenAuth: []
+      - tokenAuth: []
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/DetailResponse'
+          description: ''
+  /api/accounts/auth/mfa/confirm/:
+    post:
+      operationId: accounts_auth_mfa_confirm_create
+      description: |-
+        Confirm enrollment with a code from the authenticator app. Mid-login,
+        this also finishes sign-in (a confirmed device is proof of the second
+        factor); from Account Settings, it just turns MFA on.
+      tags:
+      - accounts
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/MFAConfirmRequestRequest'
+          application/x-www-form-urlencoded:
+            schema:
+              $ref: '#/components/schemas/MFAConfirmRequestRequest'
+          multipart/form-data:
+            schema:
+              $ref: '#/components/schemas/MFAConfirmRequestRequest'
+        required: true
+      security:
+      - MessagingJobTokenAuth: []
+      - tokenAuth: []
+      - {}
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/VerifyMagicLinkResponse'
+          description: ''
+  /api/accounts/auth/mfa/disable/:
+    post:
+      operationId: accounts_auth_mfa_disable_create
+      description: |-
+        Turn off TOTP for the current user. Refused when MFA is still
+        required for this account (platform superadmin, a workspace admin
+        anywhere, or a workspace that requires it of members) — the setting
+        would just be silently re-enforced at the next sign-in otherwise.
+      tags:
+      - accounts
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/MFADisableRequestRequest'
+          application/x-www-form-urlencoded:
+            schema:
+              $ref: '#/components/schemas/MFADisableRequestRequest'
+          multipart/form-data:
+            schema:
+              $ref: '#/components/schemas/MFADisableRequestRequest'
+        required: true
+      security:
+      - MessagingJobTokenAuth: []
+      - tokenAuth: []
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/DetailResponse'
+          description: ''
+  /api/accounts/auth/mfa/setup/:
+    post:
+      operationId: accounts_auth_mfa_setup_create
+      description: |-
+        Start (or restart) TOTP enrollment: mints a new secret and returns
+        the otpauth:// URI for the authenticator app's QR scanner. Callable
+        mid-login (with the pending ticket) or from Account Settings (while
+        authenticated) — the secret isn't active until ``confirm`` succeeds.
+      tags:
+      - accounts
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/MFATicketRequestRequest'
+          application/x-www-form-urlencoded:
+            schema:
+              $ref: '#/components/schemas/MFATicketRequestRequest'
+          multipart/form-data:
+            schema:
+              $ref: '#/components/schemas/MFATicketRequestRequest'
+      security:
+      - MessagingJobTokenAuth: []
+      - tokenAuth: []
+      - {}
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/MFASetupResponse'
+          description: ''
+  /api/accounts/auth/mfa/verify/:
+    post:
+      operationId: accounts_auth_mfa_verify_create
+      description: |-
+        Complete sign-in with a code from an already-enrolled authenticator
+        app, exchanging the pending-login ticket for a real auth token.
+      tags:
+      - accounts
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/MFAVerifyRequestRequest'
+          application/x-www-form-urlencoded:
+            schema:
+              $ref: '#/components/schemas/MFAVerifyRequestRequest'
+          multipart/form-data:
+            schema:
+              $ref: '#/components/schemas/MFAVerifyRequestRequest'
+        required: true
+      security:
+      - {}
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/VerifyMagicLinkResponse'
+          description: ''
   /api/accounts/auth/verify/:
     post:
       operationId: accounts_auth_verify_create
-      description: Exchange a magic-link token for an auth token.
+      description: |-
+        Exchange a magic-link token for an auth token — or, when the account
+        needs a second factor, a short-lived ticket for the MFA challenge/setup
+        step instead. A real auth token is never issued before that second
+        factor is satisfied.
       tags:
       - accounts
       requestBody:
@@ -305,11 +465,8 @@ paths:
     delete:
       operationId: contacts_contacts_addresses_destroy
       description: |-
-        Remove an address. Editing a member contact is admin-only (same
-        as ``add_address``); removing a *verified* address is admin-only
-        regardless of contact, since verification is what makes an address
-        approval-capable — a member must not be able to unilaterally strip
-        that off their own directory entry.
+        Remove an address. Admin-only regardless of contact type or
+        verification state — a member can neither see nor mutate addresses.
       parameters:
       - in: path
         name: address_id
@@ -1263,8 +1420,10 @@ paths:
   /api/projects/projects/:
     get:
       operationId: projects_projects_list
-      description: Projects across the caller's workspaces. Any member can create
-        and edit.
+      description: |-
+        Projects across the caller's workspaces. Any member can create a
+        project (including its initial field values); editing the fields of an
+        existing project is admin-only.
       parameters:
       - in: query
         name: workspace
@@ -1287,8 +1446,10 @@ paths:
           description: ''
     post:
       operationId: projects_projects_create
-      description: Projects across the caller's workspaces. Any member can create
-        and edit.
+      description: |-
+        Projects across the caller's workspaces. Any member can create a
+        project (including its initial field values); editing the fields of an
+        existing project is admin-only.
       tags:
       - projects
       requestBody:
@@ -1316,8 +1477,10 @@ paths:
   /api/projects/projects/{id}/:
     get:
       operationId: projects_projects_retrieve
-      description: Projects across the caller's workspaces. Any member can create
-        and edit.
+      description: |-
+        Projects across the caller's workspaces. Any member can create a
+        project (including its initial field values); editing the fields of an
+        existing project is admin-only.
       parameters:
       - in: path
         name: id
@@ -1340,8 +1503,10 @@ paths:
           description: ''
     put:
       operationId: projects_projects_update
-      description: Projects across the caller's workspaces. Any member can create
-        and edit.
+      description: |-
+        Projects across the caller's workspaces. Any member can create a
+        project (including its initial field values); editing the fields of an
+        existing project is admin-only.
       parameters:
       - in: path
         name: id
@@ -1376,8 +1541,10 @@ paths:
           description: ''
     patch:
       operationId: projects_projects_partial_update
-      description: Projects across the caller's workspaces. Any member can create
-        and edit.
+      description: |-
+        Projects across the caller's workspaces. Any member can create a
+        project (including its initial field values); editing the fields of an
+        existing project is admin-only.
       parameters:
       - in: path
         name: id
@@ -1411,8 +1578,10 @@ paths:
           description: ''
     delete:
       operationId: projects_projects_destroy
-      description: Projects across the caller's workspaces. Any member can create
-        and edit.
+      description: |-
+        Projects across the caller's workspaces. Any member can create a
+        project (including its initial field values); editing the fields of an
+        existing project is admin-only.
       parameters:
       - in: path
         name: id
@@ -2311,8 +2480,10 @@ paths:
   /api/workflows/workflows/:
     get:
       operationId: workflows_workflows_list
-      description: Workflows across the caller's workspaces. Any member can create
-        and edit.
+      description: |-
+        Workflows (actions) across the caller's workspaces. Any member can
+        read; only admins can create, edit (including enable/disable), or
+        delete a binding.
       parameters:
       - in: query
         name: workspace
@@ -2335,8 +2506,10 @@ paths:
           description: ''
     post:
       operationId: workflows_workflows_create
-      description: Workflows across the caller's workspaces. Any member can create
-        and edit.
+      description: |-
+        Workflows (actions) across the caller's workspaces. Any member can
+        read; only admins can create, edit (including enable/disable), or
+        delete a binding.
       tags:
       - workflows
       requestBody:
@@ -2364,8 +2537,10 @@ paths:
   /api/workflows/workflows/{id}/:
     get:
       operationId: workflows_workflows_retrieve
-      description: Workflows across the caller's workspaces. Any member can create
-        and edit.
+      description: |-
+        Workflows (actions) across the caller's workspaces. Any member can
+        read; only admins can create, edit (including enable/disable), or
+        delete a binding.
       parameters:
       - in: path
         name: id
@@ -2388,8 +2563,10 @@ paths:
           description: ''
     put:
       operationId: workflows_workflows_update
-      description: Workflows across the caller's workspaces. Any member can create
-        and edit.
+      description: |-
+        Workflows (actions) across the caller's workspaces. Any member can
+        read; only admins can create, edit (including enable/disable), or
+        delete a binding.
       parameters:
       - in: path
         name: id
@@ -2424,8 +2601,10 @@ paths:
           description: ''
     patch:
       operationId: workflows_workflows_partial_update
-      description: Workflows across the caller's workspaces. Any member can create
-        and edit.
+      description: |-
+        Workflows (actions) across the caller's workspaces. Any member can
+        read; only admins can create, edit (including enable/disable), or
+        delete a binding.
       parameters:
       - in: path
         name: id
@@ -2459,8 +2638,10 @@ paths:
           description: ''
     delete:
       operationId: workflows_workflows_destroy
-      description: Workflows across the caller's workspaces. Any member can create
-        and edit.
+      description: |-
+        Workflows (actions) across the caller's workspaces. Any member can
+        read; only admins can create, edit (including enable/disable), or
+        delete a binding.
       parameters:
       - in: path
         name: id
@@ -3103,6 +3284,7 @@ components:
           type: array
           items:
             $ref: '#/components/schemas/ContactAddress'
+          nullable: true
           readOnly: true
         created_at:
           type: string
@@ -3166,18 +3348,6 @@ components:
       required:
       - kind
       - value
-    ContactAddressRequest:
-      type: object
-      properties:
-        kind:
-          $ref: '#/components/schemas/KindEnum'
-        value:
-          type: string
-          minLength: 1
-          maxLength: 255
-      required:
-      - kind
-      - value
     ContactListResponse:
       type: object
       description: |-
@@ -3246,6 +3416,13 @@ components:
           format: uuid
       required:
       - workspace
+    DetailResponse:
+      type: object
+      properties:
+        detail:
+          type: string
+      required:
+      - detail
     EmojiEnum:
       enum:
       - eyes
@@ -3588,6 +3765,67 @@ components:
           type: string
       required:
       - detail
+    MFAAdminResetRequestRequest:
+      type: object
+      properties:
+        email:
+          type: string
+          format: email
+          minLength: 1
+      required:
+      - email
+    MFAConfirmRequestRequest:
+      type: object
+      properties:
+        ticket:
+          type: string
+        code:
+          type: string
+          minLength: 1
+          maxLength: 8
+      required:
+      - code
+    MFADisableRequestRequest:
+      type: object
+      properties:
+        code:
+          type: string
+          minLength: 1
+          maxLength: 8
+      required:
+      - code
+    MFASetupResponse:
+      type: object
+      properties:
+        secret:
+          type: string
+        otpauth_url:
+          type: string
+      required:
+      - otpauth_url
+      - secret
+    MFATicketRequestRequest:
+      type: object
+      description: |-
+        A setup/confirm call during login carries the pending ticket instead
+        of an auth token, since issuing a real token before the second factor is
+        verified would defeat the point.
+      properties:
+        ticket:
+          type: string
+    MFAVerifyRequestRequest:
+      type: object
+      properties:
+        ticket:
+          type: string
+          minLength: 1
+        code:
+          type: string
+          minLength: 1
+          maxLength: 8
+      required:
+      - code
+      - ticket
     ManifestEntry:
       type: object
       properties:
@@ -3635,6 +3873,12 @@ components:
         is_superadmin:
           type: boolean
           readOnly: true
+        mfa_enabled:
+          type: boolean
+          readOnly: true
+        mfa_required:
+          type: boolean
+          readOnly: true
       required:
       - email
       - first_name
@@ -3642,6 +3886,8 @@ components:
       - is_superadmin
       - last_name
       - memberships
+      - mfa_enabled
+      - mfa_required
     MeMembership:
       type: object
       description: Inline workspace + role for the /auth/me/ payload.
@@ -4053,6 +4299,8 @@ components:
           type: string
           minLength: 1
           maxLength: 64
+        require_mfa_for_members:
+          type: boolean
     Project:
       type: object
       properties:
@@ -4894,14 +5142,25 @@ components:
       - token
     VerifyMagicLinkResponse:
       type: object
+      description: |-
+        Either a completed sign-in (``token`` + ``user``) or an MFA challenge
+        (``mfa_required`` true, with a ``ticket`` to carry into the next call).
       properties:
+        mfa_required:
+          type: boolean
+        mfa_enrolled:
+          type: boolean
+        ticket:
+          type: string
         token:
           type: string
+          nullable: true
         user:
-          $ref: '#/components/schemas/User'
+          allOf:
+          - $ref: '#/components/schemas/User'
+          nullable: true
       required:
-      - token
-      - user
+      - mfa_required
     Workflow:
       type: object
       properties:
@@ -5259,6 +5518,8 @@ components:
         timezone:
           type: string
           maxLength: 64
+        require_mfa_for_members:
+          type: boolean
       required:
       - created_at
       - id
@@ -5388,6 +5649,8 @@ components:
           type: string
           minLength: 1
           maxLength: 64
+        require_mfa_for_members:
+          type: boolean
       required:
       - name
   securitySchemes:

{current_cli-0.1.28 → current_cli-0.1.29}/llms.txt

@@ -52,9 +52,68 @@ Current user with workspace memberships.
 
 GET /api/accounts/auth/me/
 
+### current accounts auth mfa admin-reset create
+
+Superadmin-only: clear a user's TOTP enrollment so they can enroll a
+new device, for when they've lost their authenticator app. There are no
+recovery codes, so this is the only way back in for such a user.
+
+POST /api/accounts/auth/mfa/admin-reset/
+
+Options:
+- `--data` (required) - Request body as JSON: inline, @file.json, or - for stdin.
+
+### current accounts auth mfa confirm create
+
+Confirm enrollment with a code from the authenticator app. Mid-login,
+this also finishes sign-in (a confirmed device is proof of the second
+factor); from Account Settings, it just turns MFA on.
+
+POST /api/accounts/auth/mfa/confirm/
+
+Options:
+- `--data` (required) - Request body as JSON: inline, @file.json, or - for stdin.
+
+### current accounts auth mfa disable create
+
+Turn off TOTP for the current user. Refused when MFA is still
+required for this account (platform superadmin, a workspace admin
+anywhere, or a workspace that requires it of members) — the setting
+would just be silently re-enforced at the next sign-in otherwise.
+
+POST /api/accounts/auth/mfa/disable/
+
+Options:
+- `--data` (required) - Request body as JSON: inline, @file.json, or - for stdin.
+
+### current accounts auth mfa setup create
+
+Start (or restart) TOTP enrollment: mints a new secret and returns
+the otpauth:// URI for the authenticator app's QR scanner. Callable
+mid-login (with the pending ticket) or from Account Settings (while
+authenticated) — the secret isn't active until ``confirm`` succeeds.
+
+POST /api/accounts/auth/mfa/setup/
+
+Options:
+- `--data` (required) - Request body as JSON: inline, @file.json, or - for stdin.
+
+### current accounts auth mfa verify create
+
+Complete sign-in with a code from an already-enrolled authenticator
+app, exchanging the pending-login ticket for a real auth token.
+
+POST /api/accounts/auth/mfa/verify/
+
+Options:
+- `--data` (required) - Request body as JSON: inline, @file.json, or - for stdin.
+
 ### current accounts auth verify create
 
-Exchange a magic-link token for an auth token.
+Exchange a magic-link token for an auth token — or, when the account
+needs a second factor, a short-lived ticket for the MFA challenge/setup
+step instead. A real auth token is never issued before that second
+factor is satisfied.
 
 POST /api/accounts/auth/verify/
 
@@ -86,11 +145,8 @@ Options:
 
 ### current contacts addresses destroy <id> <address_id>
 
-Remove an address. Editing a member contact is admin-only (same
-as ``add_address``); removing a *verified* address is admin-only
-regardless of contact, since verification is what makes an address
-approval-capable — a member must not be able to unilaterally strip
-that off their own directory entry.
+Remove an address. Admin-only regardless of contact type or
+verification state — a member can neither see nor mutate addresses.
 
 DELETE /api/contacts/contacts/{id}/addresses/{address_id}/
 
@@ -427,7 +483,9 @@ GET /api/observations/observations/{id}/
 
 ### current projects create
 
-Projects across the caller's workspaces. Any member can create and edit.
+Projects across the caller's workspaces. Any member can create a
+project (including its initial field values); editing the fields of an
+existing project is admin-only.
 
 POST /api/projects/projects/
 
@@ -436,7 +494,9 @@ Options:
 
 ### current projects destroy <id>
 
-Projects across the caller's workspaces. Any member can create and edit.
+Projects across the caller's workspaces. Any member can create a
+project (including its initial field values); editing the fields of an
+existing project is admin-only.
 
 DELETE /api/projects/projects/{id}/
 
@@ -506,7 +566,9 @@ Options:
 
 ### current projects list
 
-Projects across the caller's workspaces. Any member can create and edit.
+Projects across the caller's workspaces. Any member can create a
+project (including its initial field values); editing the fields of an
+existing project is admin-only.
 
 GET /api/projects/projects/
 
@@ -515,7 +577,9 @@ Options:
 
 ### current projects partial-update <id>
 
-Projects across the caller's workspaces. Any member can create and edit.
+Projects across the caller's workspaces. Any member can create a
+project (including its initial field values); editing the fields of an
+existing project is admin-only.
 
 PATCH /api/projects/projects/{id}/
 
@@ -524,7 +588,9 @@ Options:
 
 ### current projects retrieve <id>
 
-Projects across the caller's workspaces. Any member can create and edit.
+Projects across the caller's workspaces. Any member can create a
+project (including its initial field values); editing the fields of an
+existing project is admin-only.
 
 GET /api/projects/projects/{id}/
 
@@ -554,7 +620,9 @@ Options:
 
 ### current projects update <id>
 
-Projects across the caller's workspaces. Any member can create and edit.
+Projects across the caller's workspaces. Any member can create a
+project (including its initial field values); editing the fields of an
+existing project is admin-only.
 
 PUT /api/projects/projects/{id}/
 
@@ -661,7 +729,9 @@ Show the current user and workspace memberships.
 
 ### current workflows create
 
-Workflows across the caller's workspaces. Any member can create and edit.
+Workflows (actions) across the caller's workspaces. Any member can
+read; only admins can create, edit (including enable/disable), or
+delete a binding.
 
 POST /api/workflows/workflows/
 
@@ -702,13 +772,17 @@ GET /api/workflows/definitions/{id}/
 
 ### current workflows destroy <id>
 
-Workflows across the caller's workspaces. Any member can create and edit.
+Workflows (actions) across the caller's workspaces. Any member can
+read; only admins can create, edit (including enable/disable), or
+delete a binding.
 
 DELETE /api/workflows/workflows/{id}/
 
 ### current workflows list
 
-Workflows across the caller's workspaces. Any member can create and edit.
+Workflows (actions) across the caller's workspaces. Any member can
+read; only admins can create, edit (including enable/disable), or
+delete a binding.
 
 GET /api/workflows/workflows/
 
@@ -717,7 +791,9 @@ Options:
 
 ### current workflows partial-update <id>
 
-Workflows across the caller's workspaces. Any member can create and edit.
+Workflows (actions) across the caller's workspaces. Any member can
+read; only admins can create, edit (including enable/disable), or
+delete a binding.
 
 PATCH /api/workflows/workflows/{id}/
 
@@ -726,7 +802,9 @@ Options:
 
 ### current workflows retrieve <id>
 
-Workflows across the caller's workspaces. Any member can create and edit.
+Workflows (actions) across the caller's workspaces. Any member can
+read; only admins can create, edit (including enable/disable), or
+delete a binding.
 
 GET /api/workflows/workflows/{id}/
 
@@ -827,7 +905,9 @@ POST /api/workflows/runs/{id}/unarchive/
 
 ### current workflows update <id>
 
-Workflows across the caller's workspaces. Any member can create and edit.
+Workflows (actions) across the caller's workspaces. Any member can
+read; only admins can create, edit (including enable/disable), or
+delete a binding.
 
 PUT /api/workflows/workflows/{id}/
 

{current_cli-0.1.28 → current_cli-0.1.29}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "current-cli"
-version = "0.1.28"
+version = "0.1.29"
 description = "Command line interface for the Current API, generated from its OpenAPI schema at runtime"
 readme = "README.md"
 requires-python = ">=3.10"