current-cli 0.1.58__tar.gz → 0.1.60__tar.gz

{current_cli-0.1.58 → current_cli-0.1.60}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: current-cli
-Version: 0.1.58
+Version: 0.1.60
 Summary: Command line interface for the Current API, generated from its OpenAPI schema at runtime
 Author-email: Orin <your-email@example.com>
 License-Expression: MIT
@@ -41,6 +41,13 @@ current tasks create --data '{"name": "Order beams", "workspace": "..."}'
 current workspaces members list <workspace_id>
 ```
 
+`current login` emails a magic link: paste the whole link (or just its token)
+when asked. Accounts that require two-factor authentication — Orin Labs
+superadmins, workspace admins, and members of workspaces that require it —
+are then asked for an authenticator code. An account with no authenticator
+enrolled yet is shown a setup link and secret key to add to an authenticator
+app, and confirms the first code to finish signing in.
+
 The CLI points at `https://api.current.orinlabs.ai` by default. For local
 development, run `current config set base_url http://localhost:8000`.
 

{current_cli-0.1.58 → current_cli-0.1.60}/README.md

@@ -28,6 +28,13 @@ current tasks create --data '{"name": "Order beams", "workspace": "..."}'
 current workspaces members list <workspace_id>
 ```
 
+`current login` emails a magic link: paste the whole link (or just its token)
+when asked. Accounts that require two-factor authentication — Orin Labs
+superadmins, workspace admins, and members of workspaces that require it —
+are then asked for an authenticator code. An account with no authenticator
+enrolled yet is shown a setup link and secret key to add to an authenticator
+app, and confirms the first code to finish signing in.
+
 The CLI points at `https://api.current.orinlabs.ai` by default. For local
 development, run `current config set base_url http://localhost:8000`.
 

{current_cli-0.1.58 → current_cli-0.1.60}/current_cli/docs.py

@@ -24,6 +24,11 @@ current login you@example.com                          # magic-link sign in, sto
 current config set default_workspace <workspace-uuid>  # used when --workspace is omitted
 ```
 
+`current login` asks for the sign-in link from the email (or its token). An
+account that requires two-factor authentication is also asked for an
+authenticator code; one with no device enrolled yet is shown a setup link
+and secret key to add to an authenticator app first.
+
 The CLI speaks to `https://api.current.orinlabs.ai` by default. For another
 server (for example local development), set
 `current config set base_url http://localhost:8000`.

{current_cli-0.1.58 → current_cli-0.1.60}/current_cli/main.py

@@ -4,6 +4,7 @@ from __future__ import annotations
 
 import os
 import sys
+from urllib.parse import parse_qs, urlsplit
 
 import click
 
@@ -16,12 +17,87 @@ MAGIC_LINK_PATH = "/api/accounts/auth/magic-link/"
 VERIFY_PATH = "/api/accounts/auth/verify/"
 LOGOUT_PATH = "/api/accounts/auth/logout/"
 ME_PATH = "/api/accounts/auth/me/"
+MFA_VERIFY_PATH = "/api/accounts/auth/mfa/verify/"
+MFA_SETUP_PATH = "/api/accounts/auth/mfa/setup/"
+MFA_CONFIRM_PATH = "/api/accounts/auth/mfa/confirm/"
+
+# Tries at the authenticator code before login gives up. The pending-login
+# ticket outlives these by far (10 minutes), so a typo costs a retry, not
+# another magic link.
+MFA_MAX_ATTEMPTS = 3
+
+
+def _magic_token(value: str) -> str:
+    """The magic-link token from what the user pasted: the whole sign-in link
+    from the email (``.../auth/verify?token=...``) or the bare token."""
+    value = value.strip()
+    if "token=" in value:
+        tokens = parse_qs(urlsplit(value).query or value).get("token")
+        if tokens:
+            return tokens[0]
+    return value
+
+
+def _detail(response) -> str:
+    try:
+        body = response.json()
+    except ValueError:
+        return response.text
+    if isinstance(body, dict) and isinstance(body.get("detail"), str):
+        return body["detail"]
+    return response.text
+
+
+def _fail(response) -> None:
+    """Exit on a failed sign-in step. An expired pending-login ticket gets a
+    plain instruction instead of the raw API error."""
+    if "ticket" in _detail(response).lower():
+        click.echo("The sign-in expired. Run `current login` again.", err=True)
+        raise SystemExit(1)
+    http.render_response(response)
+    raise SystemExit(1)
+
+
+def _second_factor(ticket: str, enrolled: bool) -> dict:
+    """Finish a sign-in that needs two-factor authentication and return the
+    login payload. An enrolled account verifies a code; an account without a
+    device enrolls one first, and confirming it completes the sign-in."""
+    if enrolled:
+        click.echo("This account requires two-factor authentication.")
+        path = MFA_VERIFY_PATH
+    else:
+        setup = http.request(
+            "post", MFA_SETUP_PATH, json_body={"ticket": ticket}, authenticated=False
+        )
+        if setup.status_code >= 400:
+            _fail(setup)
+        enrollment = setup.json()
+        click.echo("This account requires two-factor authentication. Add it to an")
+        click.echo("authenticator app with the setup link or the secret key:")
+        click.echo(f"  Setup link: {enrollment['otpauth_url']}")
+        click.echo(f"  Secret key: {enrollment['secret']}")
+        path = MFA_CONFIRM_PATH
+
+    for attempt in range(1, MFA_MAX_ATTEMPTS + 1):
+        code = "".join(click.prompt("Authenticator code").split())
+        response = http.request(
+            "post", path, json_body={"ticket": ticket, "code": code}, authenticated=False
+        )
+        if response.status_code < 400:
+            return response.json()
+        retryable = response.status_code == 400 and "ticket" not in _detail(response).lower()
+        if retryable and attempt < MFA_MAX_ATTEMPTS:
+            click.echo(f"{_detail(response)} Try again.", err=True)
+            continue
+        _fail(response)
+    raise AssertionError("unreachable")
 
 
 @click.command()
 @click.argument("email")
 def login(email: str) -> None:
-    """Sign in with a magic link and store the auth token."""
+    """Sign in with a magic link (and an authenticator code when the account
+    requires two-factor authentication) and store the auth token."""
     response = http.request(
         "post", MAGIC_LINK_PATH, json_body={"email": email}, authenticated=False
     )
@@ -34,7 +110,7 @@ def login(email: str) -> None:
         click.echo("Using debug token from the API (DEBUG mode).")
     else:
         click.echo(f"Magic link sent to {email}.")
-        magic_token = click.prompt("Paste the token from the sign-in link")
+        magic_token = _magic_token(click.prompt("Paste the sign-in link or its token"))
 
     verify = http.request(
         "post", VERIFY_PATH, json_body={"token": magic_token}, authenticated=False
@@ -44,6 +120,11 @@ def login(email: str) -> None:
         return
 
     payload = verify.json()
+    if payload.get("mfa_required"):
+        payload = _second_factor(payload["ticket"], bool(payload.get("mfa_enrolled")))
+
+    # Saved only once a real token is in hand: a sign-in abandoned part-way
+    # leaves the previous config as it was.
     config_store.set_value("token", payload["token"])
     config_store.set_value("email", email)
     click.echo(f"Logged in as {email}.")

{current_cli-0.1.58 → current_cli-0.1.60}/current_cli/schema.yml

@@ -1973,6 +1973,37 @@ paths:
               schema:
                 $ref: '#/components/schemas/OptionUsage'
           description: ''
+  /api/projects/field-definitions/query-metadata/:
+    get:
+      operationId: projects_field_definitions_query_metadata_retrieve
+      description: Discover field keys, labels, types, and the workspace clock.
+      parameters:
+      - in: query
+        name: fields
+        schema:
+          type: string
+        description: Optional comma-separated field keys
+      - in: query
+        name: offset
+        schema:
+          type: integer
+      - in: query
+        name: workspace
+        schema:
+          type: string
+        description: Filter by workspace UUID
+      tags:
+      - projects
+      security:
+      - MessagingJobTokenAuth: []
+      - tokenAuth: []
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/FieldDiscovery'
+          description: ''
   /api/projects/projects/:
     get:
       operationId: projects_projects_list
@@ -2379,6 +2410,162 @@ paths:
               schema:
                 $ref: '#/components/schemas/ProjectInventoryResponse'
           description: ''
+  /api/projects/projects/query-fields/:
+    post:
+      operationId: projects_projects_query_fields_create
+      description: Read canonical field snapshots. This POST does not write project
+        state.
+      tags:
+      - projects
+      requestBody:
+        content:
+          application/json:
+            schema:
+              additionalProperties: false
+              properties:
+                fields:
+                  items:
+                    type: string
+                  maxItems: 8
+                  minItems: 1
+                  title: Fields
+                  type: array
+                project_ids:
+                  anyOf:
+                  - items:
+                      type: string
+                    maxItems: 200
+                    type: array
+                  - type: 'null'
+                  default: null
+                  title: Project Ids
+                as_of:
+                  default: latest
+                  title: As Of
+                  type: string
+                compare_to:
+                  anyOf:
+                  - type: string
+                  - type: 'null'
+                  default: null
+                  title: Compare To
+                filters:
+                  items:
+                    additionalProperties: false
+                    properties:
+                      field:
+                        title: Field
+                        type: string
+                      target:
+                        enum:
+                        - as_of
+                        - compare_to
+                        - changed
+                        - delta_days
+                        title: Target
+                        type: string
+                      op:
+                        enum:
+                        - eq
+                        - ne
+                        - in
+                        - not_in
+                        - lt
+                        - lte
+                        - gt
+                        - gte
+                        - is_empty
+                        - is_missing
+                        - is_set
+                        title: Op
+                        type: string
+                      value:
+                        anyOf:
+                        - type: string
+                        - type: integer
+                        - type: number
+                        - type: boolean
+                        - items:
+                            anyOf:
+                            - type: string
+                            - type: integer
+                            - type: number
+                            - type: boolean
+                          type: array
+                        - type: 'null'
+                        title: Value
+                    required:
+                    - field
+                    - target
+                    - op
+                    - value
+                    title: FieldPredicate
+                    type: object
+                  maxItems: 20
+                  title: Filters
+                  type: array
+                sort:
+                  anyOf:
+                  - additionalProperties: false
+                    properties:
+                      field:
+                        title: Field
+                        type: string
+                      target:
+                        enum:
+                        - as_of
+                        - compare_to
+                        - changed
+                        - delta_days
+                        title: Target
+                        type: string
+                      direction:
+                        enum:
+                        - asc
+                        - desc
+                        title: Direction
+                        type: string
+                    required:
+                    - field
+                    - target
+                    - direction
+                    title: FieldSort
+                    type: object
+                  - type: 'null'
+                  default: null
+                limit:
+                  default: 20
+                  maximum: 50
+                  minimum: 1
+                  title: Limit
+                  type: integer
+                cursor:
+                  anyOf:
+                  - maxLength: 12000
+                    minLength: 1
+                    type: string
+                  - type: 'null'
+                  default: null
+                  title: Cursor
+                workspace:
+                  format: uuid
+                  title: Workspace
+                  type: string
+              required:
+              - fields
+              - workspace
+              title: FieldQueryRequest
+              type: object
+      security:
+      - MessagingJobTokenAuth: []
+      - tokenAuth: []
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/FieldQueryResponse'
+          description: ''
   /api/projects/projects/search/:
     get:
       operationId: projects_projects_search_retrieve
@@ -5814,6 +6001,51 @@ components:
       required:
       - items
       - next_cursor
+    FieldComparison:
+      type: object
+      properties:
+        as_of:
+          $ref: '#/components/schemas/FieldSnapshot'
+        compare_to:
+          $ref: '#/components/schemas/FieldSnapshot'
+        changed:
+          type: boolean
+          nullable: true
+        delta_days:
+          type: integer
+          nullable: true
+      required:
+      - as_of
+    FieldDiscovery:
+      type: object
+      properties:
+        timezone:
+          type: string
+        now:
+          type: string
+          format: date-time
+        current_month_start:
+          type: string
+          format: date-time
+        time_basis:
+          type: string
+        fields:
+          type: array
+          items:
+            $ref: '#/components/schemas/QueryFieldDescriptor'
+        total:
+          type: integer
+        next_offset:
+          type: integer
+          nullable: true
+      required:
+      - current_month_start
+      - fields
+      - next_offset
+      - now
+      - time_basis
+      - timezone
+      - total
     FieldOption:
       type: object
       properties:
@@ -5886,6 +6118,112 @@ components:
       - workflow_name
       - written_by_email
       - written_by_name
+    FieldQueryCounts:
+      type: object
+      properties:
+        candidate:
+          type: integer
+        matched:
+          type: integer
+        unevaluable:
+          type: integer
+        unmatched:
+          type: integer
+        matched_with_missing_history:
+          type: integer
+      required:
+      - candidate
+      - matched
+      - matched_with_missing_history
+      - unevaluable
+      - unmatched
+    FieldQueryItem:
+      type: object
+      properties:
+        project_id:
+          type: string
+          format: uuid
+        fields:
+          type: object
+          additionalProperties:
+            $ref: '#/components/schemas/FieldComparison'
+      required:
+      - fields
+      - project_id
+    FieldQueryResponse:
+      type: object
+      properties:
+        timezone:
+          type: string
+        time_basis:
+          type: string
+        as_of:
+          type: string
+          format: date-time
+        compare_to:
+          type: string
+          format: date-time
+          nullable: true
+        query_clock:
+          type: string
+          format: date-time
+        fields:
+          type: array
+          items:
+            $ref: '#/components/schemas/QueryFieldDescriptor'
+        counts:
+          $ref: '#/components/schemas/FieldQueryCounts'
+        items:
+          type: array
+          items:
+            $ref: '#/components/schemas/FieldQueryItem'
+        next_cursor:
+          type: string
+          nullable: true
+      required:
+      - as_of
+      - compare_to
+      - counts
+      - fields
+      - items
+      - next_cursor
+      - query_clock
+      - time_basis
+      - timezone
+    FieldSnapshot:
+      type: object
+      properties:
+        state:
+          $ref: '#/components/schemas/FieldSnapshotStateEnum'
+        value:
+          nullable: true
+        display:
+          nullable: true
+        write_id:
+          type: string
+          format: uuid
+        recorded_at:
+          type: string
+          format: date-time
+        source:
+          type: string
+        evidence_observation_ids:
+          type: array
+          items:
+            type: string
+      required:
+      - state
+      - value
+    FieldSnapshotStateEnum:
+      enum:
+      - value
+      - empty
+      - missing
+      type: string
+      description: |-
+        * `value` - value
+        * `empty` - empty
+        * `missing` - missing
     FileDeleteRequestRequest:
       type: object
       properties:
@@ -7373,6 +7711,26 @@ components:
           pattern: ^[a-zA-Z0-9][a-zA-Z0-9_-]{0,79}$
       required:
       - batch_id
+    QueryFieldDescriptor:
+      type: object
+      properties:
+        id:
+          type: string
+          format: uuid
+        key:
+          type: string
+        label:
+          type: string
+        data_type:
+          type: string
+        is_array:
+          type: boolean
+      required:
+      - data_type
+      - id
+      - is_array
+      - key
+      - label
     QuickCapture:
       type: object
       description: |-

{current_cli-0.1.58 → current_cli-0.1.60}/llms.txt

@@ -11,6 +11,11 @@ current login you@example.com                          # magic-link sign in, sto
 current config set default_workspace <workspace-uuid>  # used when --workspace is omitted
 ```
 
+`current login` asks for the sign-in link from the email (or its token). An
+account that requires two-factor authentication is also asked for an
+authenticator code; one with no device enrolled yet is shown a setup link
+and secret key to add to an authenticator app first.
+
 The CLI speaks to `https://api.current.orinlabs.ai` by default. For another
 server (for example local development), set
 `current config set base_url http://localhost:8000`.
@@ -559,7 +564,8 @@ Options:
 
 ### current login <email>
 
-Sign in with a magic link and store the auth token.
+Sign in with a magic link (and an authenticator code when the account
+    requires two-factor authentication) and store the auth token.
 
 ### current logout
 
@@ -744,6 +750,17 @@ PATCH /api/projects/field-definitions/{id}/
 Options:
 - `--data` (required) - Request body as JSON: inline, @file.json, or - for stdin.
 
+### current projects field-definitions query-metadata retrieve
+
+Discover field keys, labels, types, and the workspace clock.
+
+GET /api/projects/field-definitions/query-metadata/
+
+Options:
+- `--fields` - Optional comma-separated field keys
+- `--offset`
+- `--workspace` - Filter by workspace UUID
+
 ### current projects field-definitions retrieve <id>
 
 Workspace-level custom field definitions. Only admins can mutate.
@@ -805,6 +822,15 @@ PATCH /api/projects/projects/{id}/
 Options:
 - `--data` (required) - Request body as JSON: inline, @file.json, or - for stdin.
 
+### current projects query-fields create
+
+Read canonical field snapshots. This POST does not write project state.
+
+POST /api/projects/projects/query-fields/
+
+Options:
+- `--data` (required) - Request body as JSON: inline, @file.json, or - for stdin.
+
 ### current projects retrieve <id>
 
 Projects across the caller's workspaces. Any member can create a

{current_cli-0.1.58 → current_cli-0.1.60}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "current-cli"
-version = "0.1.58"
+version = "0.1.60"
 description = "Command line interface for the Current API, generated from its OpenAPI schema at runtime"
 readme = "README.md"
 requires-python = ">=3.10"

current_cli-0.1.60/tests/test_auth.py

@@ -0,0 +1,213 @@
+"""The login flow must match the API's magic-link contract."""
+
+import json
+
+import httpx
+
+from current_cli import config
+
+
+def make_auth_handler(debug_token: str | None = "magic-1"):
+    def handler(request: httpx.Request) -> httpx.Response:
+        if request.url.path == "/api/accounts/auth/magic-link/":
+            payload = {"detail": "Magic link sent."}
+            if debug_token:
+                payload["debug_token"] = debug_token
+            return httpx.Response(200, json=payload)
+        if request.url.path == "/api/accounts/auth/verify/":
+            body = json.loads(request.content)
+            if body["token"] != "magic-1":
+                return httpx.Response(400, json={"detail": "Invalid or expired link."})
+            return httpx.Response(
+                200, json={"token": "drf-token", "user": {"email": "dev@example.com"}}
+            )
+        if request.url.path == "/api/accounts/auth/me/":
+            return httpx.Response(200, json={"email": "dev@example.com"})
+        if request.url.path == "/api/accounts/auth/logout/":
+            return httpx.Response(200, json={"detail": "Successfully logged out."})
+        return httpx.Response(404, json={"detail": "Not found."})
+
+    return handler
+
+
+def test_login_with_debug_token(cli, runner, transport_factory):
+    transport = transport_factory(make_auth_handler())
+
+    result = runner.invoke(cli, ["login", "dev@example.com"])
+
+    assert result.exit_code == 0, result.output
+    assert config.get("token") == "drf-token"
+    assert config.get("email") == "dev@example.com"
+    magic, verify = transport.requests
+    assert json.loads(magic.content) == {"email": "dev@example.com"}
+    assert json.loads(verify.content) == {"token": "magic-1"}
+
+
+def test_login_prompts_without_debug_token(cli, runner, transport_factory):
+    transport_factory(make_auth_handler(debug_token=None))
+
+    result = runner.invoke(cli, ["login", "dev@example.com"], input="magic-1\n")
+
+    assert result.exit_code == 0, result.output
+    assert config.get("token") == "drf-token"
+
+
+def test_login_bad_token_fails(cli, runner, transport_factory):
+    transport_factory(make_auth_handler(debug_token="wrong"))
+
+    result = runner.invoke(cli, ["login", "dev@example.com"])
+
+    assert result.exit_code == 1
+    assert config.get("token") is None
+
+
+def test_whoami_sends_token(cli, runner, transport_factory):
+    config.set_value("token", "drf-token")
+    transport = transport_factory(make_auth_handler())
+
+    result = runner.invoke(cli, ["whoami"])
+
+    assert result.exit_code == 0, result.output
+    assert transport.requests[0].headers["Authorization"] == "Token drf-token"
+    assert json.loads(result.output) == {"email": "dev@example.com"}
+
+
+def test_logout_clears_token(cli, runner, transport_factory):
+    config.set_value("token", "drf-token")
+    transport = transport_factory(make_auth_handler())
+
+    result = runner.invoke(cli, ["logout"])
+
+    assert result.exit_code == 0, result.output
+    assert config.get("token") is None
+    assert transport.requests[0].url.path == "/api/accounts/auth/logout/"
+
+
+def test_config_set_and_get(cli, runner):
+    result = runner.invoke(cli, ["config", "set", "default_workspace", "ws-1"])
+    assert result.exit_code == 0, result.output
+
+    result = runner.invoke(cli, ["config", "get", "default_workspace"])
+    assert result.exit_code == 0
+    assert result.output.strip() == "ws-1"
+
+
+def make_mfa_handler(*, enrolled: bool, code: str = "123456", ticket_valid: bool = True):
+    """The API's MFA login branch: verify answers with a ticket instead of a
+    token, and a code (after enrollment, when not enrolled) completes it."""
+
+    def handler(request: httpx.Request) -> httpx.Response:
+        path = request.url.path
+        body = json.loads(request.content) if request.content else {}
+        if path == "/api/accounts/auth/magic-link/":
+            return httpx.Response(200, json={"detail": "Magic link sent."})
+        if path == "/api/accounts/auth/verify/":
+            if body["token"] != "magic-1":
+                return httpx.Response(400, json={"detail": "Invalid or expired link."})
+            return httpx.Response(
+                200, json={"mfa_required": True, "mfa_enrolled": enrolled, "ticket": "ticket-1"}
+            )
+        if not ticket_valid or body.get("ticket") != "ticket-1":
+            status = 400 if path.endswith("/verify/") else 403
+            return httpx.Response(status, json={"detail": "Invalid or expired ticket."})
+        if path == "/api/accounts/auth/mfa/setup/":
+            return httpx.Response(
+                200,
+                json={"secret": "SECRET", "otpauth_url": "otpauth://totp/Current?secret=SECRET"},
+            )
+        if path in ("/api/accounts/auth/mfa/verify/", "/api/accounts/auth/mfa/confirm/"):
+            if body["code"] != code:
+                return httpx.Response(400, json={"detail": "Incorrect code."})
+            return httpx.Response(
+                200,
+                json={
+                    "mfa_required": False,
+                    "token": "drf-token",
+                    "user": {"email": "a@orinlabs.ai"},
+                },
+            )
+        return httpx.Response(404, json={"detail": "Not found."})
+
+    return handler
+
+
+def test_login_with_enrolled_mfa(cli, runner, transport_factory):
+    transport = transport_factory(make_mfa_handler(enrolled=True))
+
+    result = runner.invoke(cli, ["login", "a@orinlabs.ai"], input="magic-1\n123 456\n")
+
+    assert result.exit_code == 0, result.output
+    assert config.get("token") == "drf-token"
+    paths = [r.url.path for r in transport.requests]
+    assert paths[-1] == "/api/accounts/auth/mfa/verify/"
+    assert json.loads(transport.requests[-1].content) == {"ticket": "ticket-1", "code": "123456"}
+
+
+def test_login_enrolls_mfa_when_not_enrolled(cli, runner, transport_factory):
+    transport = transport_factory(make_mfa_handler(enrolled=False))
+
+    result = runner.invoke(cli, ["login", "a@orinlabs.ai"], input="magic-1\n123456\n")
+
+    assert result.exit_code == 0, result.output
+    assert "otpauth://totp/Current?secret=SECRET" in result.output
+    assert "SECRET" in result.output
+    assert config.get("token") == "drf-token"
+    paths = [r.url.path for r in transport.requests]
+    assert paths[-2:] == ["/api/accounts/auth/mfa/setup/", "/api/accounts/auth/mfa/confirm/"]
+
+
+def test_login_retries_incorrect_code(cli, runner, transport_factory):
+    transport_factory(make_mfa_handler(enrolled=True))
+
+    result = runner.invoke(cli, ["login", "a@orinlabs.ai"], input="magic-1\n000000\n123456\n")
+
+    assert result.exit_code == 0, result.output
+    assert "Incorrect code. Try again." in result.output
+    assert config.get("token") == "drf-token"
+
+
+def test_login_gives_up_after_three_incorrect_codes(cli, runner, transport_factory):
+    transport = transport_factory(make_mfa_handler(enrolled=True))
+
+    result = runner.invoke(
+        cli, ["login", "a@orinlabs.ai"], input="magic-1\n000000\n000000\n000000\n"
+    )
+
+    assert result.exit_code == 1
+    assert config.get("token") is None
+    verifies = [r for r in transport.requests if r.url.path == "/api/accounts/auth/mfa/verify/"]
+    assert len(verifies) == 3
+
+
+def test_login_expired_ticket_says_to_start_again(cli, runner, transport_factory):
+    transport_factory(make_mfa_handler(enrolled=True, ticket_valid=False))
+
+    result = runner.invoke(cli, ["login", "a@orinlabs.ai"], input="magic-1\n123456\n")
+
+    assert result.exit_code == 1
+    assert "Run `current login` again." in result.output
+    assert config.get("token") is None
+
+
+def test_login_expired_ticket_during_enrollment(cli, runner, transport_factory):
+    transport_factory(make_mfa_handler(enrolled=False, ticket_valid=False))
+
+    result = runner.invoke(cli, ["login", "a@orinlabs.ai"], input="magic-1\n")
+
+    assert result.exit_code == 1
+    assert "Run `current login` again." in result.output
+    assert config.get("token") is None
+
+
+def test_login_accepts_pasted_sign_in_link(cli, runner, transport_factory):
+    transport = transport_factory(make_auth_handler(debug_token=None))
+
+    result = runner.invoke(
+        cli,
+        ["login", "dev@example.com"],
+        input="https://current.orinlabs.ai/auth/verify?token=magic-1\n",
+    )
+
+    assert result.exit_code == 0, result.output
+    assert json.loads(transport.requests[1].content) == {"token": "magic-1"}
+    assert config.get("token") == "drf-token"

current_cli-0.1.58/tests/test_auth.py

@@ -1,92 +0,0 @@
-"""The login flow must match the API's magic-link contract."""
-
-import json
-
-import httpx
-
-from current_cli import config
-
-
-def make_auth_handler(debug_token: str | None = "magic-1"):
-    def handler(request: httpx.Request) -> httpx.Response:
-        if request.url.path == "/api/accounts/auth/magic-link/":
-            payload = {"detail": "Magic link sent."}
-            if debug_token:
-                payload["debug_token"] = debug_token
-            return httpx.Response(200, json=payload)
-        if request.url.path == "/api/accounts/auth/verify/":
-            body = json.loads(request.content)
-            if body["token"] != "magic-1":
-                return httpx.Response(400, json={"detail": "Invalid or expired link."})
-            return httpx.Response(
-                200, json={"token": "drf-token", "user": {"email": "dev@example.com"}}
-            )
-        if request.url.path == "/api/accounts/auth/me/":
-            return httpx.Response(200, json={"email": "dev@example.com"})
-        if request.url.path == "/api/accounts/auth/logout/":
-            return httpx.Response(200, json={"detail": "Successfully logged out."})
-        return httpx.Response(404, json={"detail": "Not found."})
-
-    return handler
-
-
-def test_login_with_debug_token(cli, runner, transport_factory):
-    transport = transport_factory(make_auth_handler())
-
-    result = runner.invoke(cli, ["login", "dev@example.com"])
-
-    assert result.exit_code == 0, result.output
-    assert config.get("token") == "drf-token"
-    assert config.get("email") == "dev@example.com"
-    magic, verify = transport.requests
-    assert json.loads(magic.content) == {"email": "dev@example.com"}
-    assert json.loads(verify.content) == {"token": "magic-1"}
-
-
-def test_login_prompts_without_debug_token(cli, runner, transport_factory):
-    transport_factory(make_auth_handler(debug_token=None))
-
-    result = runner.invoke(cli, ["login", "dev@example.com"], input="magic-1\n")
-
-    assert result.exit_code == 0, result.output
-    assert config.get("token") == "drf-token"
-
-
-def test_login_bad_token_fails(cli, runner, transport_factory):
-    transport_factory(make_auth_handler(debug_token="wrong"))
-
-    result = runner.invoke(cli, ["login", "dev@example.com"])
-
-    assert result.exit_code == 1
-    assert config.get("token") is None
-
-
-def test_whoami_sends_token(cli, runner, transport_factory):
-    config.set_value("token", "drf-token")
-    transport = transport_factory(make_auth_handler())
-
-    result = runner.invoke(cli, ["whoami"])
-
-    assert result.exit_code == 0, result.output
-    assert transport.requests[0].headers["Authorization"] == "Token drf-token"
-    assert json.loads(result.output) == {"email": "dev@example.com"}
-
-
-def test_logout_clears_token(cli, runner, transport_factory):
-    config.set_value("token", "drf-token")
-    transport = transport_factory(make_auth_handler())
-
-    result = runner.invoke(cli, ["logout"])
-
-    assert result.exit_code == 0, result.output
-    assert config.get("token") is None
-    assert transport.requests[0].url.path == "/api/accounts/auth/logout/"
-
-
-def test_config_set_and_get(cli, runner):
-    result = runner.invoke(cli, ["config", "set", "default_workspace", "ws-1"])
-    assert result.exit_code == 0, result.output
-
-    result = runner.invoke(cli, ["config", "get", "default_workspace"])
-    assert result.exit_code == 0
-    assert result.output.strip() == "ws-1"