current-cli 0.1.59__tar.gz → 0.1.60__tar.gz

{current_cli-0.1.59 → current_cli-0.1.60}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: current-cli
-Version: 0.1.59
+Version: 0.1.60
 Summary: Command line interface for the Current API, generated from its OpenAPI schema at runtime
 Author-email: Orin <your-email@example.com>
 License-Expression: MIT
@@ -41,6 +41,13 @@ current tasks create --data '{"name": "Order beams", "workspace": "..."}'
 current workspaces members list <workspace_id>
 ```
 
+`current login` emails a magic link: paste the whole link (or just its token)
+when asked. Accounts that require two-factor authentication — Orin Labs
+superadmins, workspace admins, and members of workspaces that require it —
+are then asked for an authenticator code. An account with no authenticator
+enrolled yet is shown a setup link and secret key to add to an authenticator
+app, and confirms the first code to finish signing in.
+
 The CLI points at `https://api.current.orinlabs.ai` by default. For local
 development, run `current config set base_url http://localhost:8000`.
 

{current_cli-0.1.59 → current_cli-0.1.60}/README.md

@@ -28,6 +28,13 @@ current tasks create --data '{"name": "Order beams", "workspace": "..."}'
 current workspaces members list <workspace_id>
 ```
 
+`current login` emails a magic link: paste the whole link (or just its token)
+when asked. Accounts that require two-factor authentication — Orin Labs
+superadmins, workspace admins, and members of workspaces that require it —
+are then asked for an authenticator code. An account with no authenticator
+enrolled yet is shown a setup link and secret key to add to an authenticator
+app, and confirms the first code to finish signing in.
+
 The CLI points at `https://api.current.orinlabs.ai` by default. For local
 development, run `current config set base_url http://localhost:8000`.
 

{current_cli-0.1.59 → current_cli-0.1.60}/current_cli/docs.py

@@ -24,6 +24,11 @@ current login you@example.com                          # magic-link sign in, sto
 current config set default_workspace <workspace-uuid>  # used when --workspace is omitted
 ```
 
+`current login` asks for the sign-in link from the email (or its token). An
+account that requires two-factor authentication is also asked for an
+authenticator code; one with no device enrolled yet is shown a setup link
+and secret key to add to an authenticator app first.
+
 The CLI speaks to `https://api.current.orinlabs.ai` by default. For another
 server (for example local development), set
 `current config set base_url http://localhost:8000`.

{current_cli-0.1.59 → current_cli-0.1.60}/current_cli/main.py

@@ -4,6 +4,7 @@ from __future__ import annotations
 
 import os
 import sys
+from urllib.parse import parse_qs, urlsplit
 
 import click
 
@@ -16,12 +17,87 @@ MAGIC_LINK_PATH = "/api/accounts/auth/magic-link/"
 VERIFY_PATH = "/api/accounts/auth/verify/"
 LOGOUT_PATH = "/api/accounts/auth/logout/"
 ME_PATH = "/api/accounts/auth/me/"
+MFA_VERIFY_PATH = "/api/accounts/auth/mfa/verify/"
+MFA_SETUP_PATH = "/api/accounts/auth/mfa/setup/"
+MFA_CONFIRM_PATH = "/api/accounts/auth/mfa/confirm/"
+
+# Tries at the authenticator code before login gives up. The pending-login
+# ticket outlives these by far (10 minutes), so a typo costs a retry, not
+# another magic link.
+MFA_MAX_ATTEMPTS = 3
+
+
+def _magic_token(value: str) -> str:
+    """The magic-link token from what the user pasted: the whole sign-in link
+    from the email (``.../auth/verify?token=...``) or the bare token."""
+    value = value.strip()
+    if "token=" in value:
+        tokens = parse_qs(urlsplit(value).query or value).get("token")
+        if tokens:
+            return tokens[0]
+    return value
+
+
+def _detail(response) -> str:
+    try:
+        body = response.json()
+    except ValueError:
+        return response.text
+    if isinstance(body, dict) and isinstance(body.get("detail"), str):
+        return body["detail"]
+    return response.text
+
+
+def _fail(response) -> None:
+    """Exit on a failed sign-in step. An expired pending-login ticket gets a
+    plain instruction instead of the raw API error."""
+    if "ticket" in _detail(response).lower():
+        click.echo("The sign-in expired. Run `current login` again.", err=True)
+        raise SystemExit(1)
+    http.render_response(response)
+    raise SystemExit(1)
+
+
+def _second_factor(ticket: str, enrolled: bool) -> dict:
+    """Finish a sign-in that needs two-factor authentication and return the
+    login payload. An enrolled account verifies a code; an account without a
+    device enrolls one first, and confirming it completes the sign-in."""
+    if enrolled:
+        click.echo("This account requires two-factor authentication.")
+        path = MFA_VERIFY_PATH
+    else:
+        setup = http.request(
+            "post", MFA_SETUP_PATH, json_body={"ticket": ticket}, authenticated=False
+        )
+        if setup.status_code >= 400:
+            _fail(setup)
+        enrollment = setup.json()
+        click.echo("This account requires two-factor authentication. Add it to an")
+        click.echo("authenticator app with the setup link or the secret key:")
+        click.echo(f"  Setup link: {enrollment['otpauth_url']}")
+        click.echo(f"  Secret key: {enrollment['secret']}")
+        path = MFA_CONFIRM_PATH
+
+    for attempt in range(1, MFA_MAX_ATTEMPTS + 1):
+        code = "".join(click.prompt("Authenticator code").split())
+        response = http.request(
+            "post", path, json_body={"ticket": ticket, "code": code}, authenticated=False
+        )
+        if response.status_code < 400:
+            return response.json()
+        retryable = response.status_code == 400 and "ticket" not in _detail(response).lower()
+        if retryable and attempt < MFA_MAX_ATTEMPTS:
+            click.echo(f"{_detail(response)} Try again.", err=True)
+            continue
+        _fail(response)
+    raise AssertionError("unreachable")
 
 
 @click.command()
 @click.argument("email")
 def login(email: str) -> None:
-    """Sign in with a magic link and store the auth token."""
+    """Sign in with a magic link (and an authenticator code when the account
+    requires two-factor authentication) and store the auth token."""
     response = http.request(
         "post", MAGIC_LINK_PATH, json_body={"email": email}, authenticated=False
     )
@@ -34,7 +110,7 @@ def login(email: str) -> None:
         click.echo("Using debug token from the API (DEBUG mode).")
     else:
         click.echo(f"Magic link sent to {email}.")
-        magic_token = click.prompt("Paste the token from the sign-in link")
+        magic_token = _magic_token(click.prompt("Paste the sign-in link or its token"))
 
     verify = http.request(
         "post", VERIFY_PATH, json_body={"token": magic_token}, authenticated=False
@@ -44,6 +120,11 @@ def login(email: str) -> None:
         return
 
     payload = verify.json()
+    if payload.get("mfa_required"):
+        payload = _second_factor(payload["ticket"], bool(payload.get("mfa_enrolled")))
+
+    # Saved only once a real token is in hand: a sign-in abandoned part-way
+    # leaves the previous config as it was.
     config_store.set_value("token", payload["token"])
     config_store.set_value("email", email)
     click.echo(f"Logged in as {email}.")

{current_cli-0.1.59 → current_cli-0.1.60}/llms.txt

@@ -11,6 +11,11 @@ current login you@example.com                          # magic-link sign in, sto
 current config set default_workspace <workspace-uuid>  # used when --workspace is omitted
 ```
 
+`current login` asks for the sign-in link from the email (or its token). An
+account that requires two-factor authentication is also asked for an
+authenticator code; one with no device enrolled yet is shown a setup link
+and secret key to add to an authenticator app first.
+
 The CLI speaks to `https://api.current.orinlabs.ai` by default. For another
 server (for example local development), set
 `current config set base_url http://localhost:8000`.
@@ -559,7 +564,8 @@ Options:
 
 ### current login <email>
 
-Sign in with a magic link and store the auth token.
+Sign in with a magic link (and an authenticator code when the account
+    requires two-factor authentication) and store the auth token.
 
 ### current logout
 

{current_cli-0.1.59 → current_cli-0.1.60}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "current-cli"
-version = "0.1.59"
+version = "0.1.60"
 description = "Command line interface for the Current API, generated from its OpenAPI schema at runtime"
 readme = "README.md"
 requires-python = ">=3.10"

current_cli-0.1.60/tests/test_auth.py

@@ -0,0 +1,213 @@
+"""The login flow must match the API's magic-link contract."""
+
+import json
+
+import httpx
+
+from current_cli import config
+
+
+def make_auth_handler(debug_token: str | None = "magic-1"):
+    def handler(request: httpx.Request) -> httpx.Response:
+        if request.url.path == "/api/accounts/auth/magic-link/":
+            payload = {"detail": "Magic link sent."}
+            if debug_token:
+                payload["debug_token"] = debug_token
+            return httpx.Response(200, json=payload)
+        if request.url.path == "/api/accounts/auth/verify/":
+            body = json.loads(request.content)
+            if body["token"] != "magic-1":
+                return httpx.Response(400, json={"detail": "Invalid or expired link."})
+            return httpx.Response(
+                200, json={"token": "drf-token", "user": {"email": "dev@example.com"}}
+            )
+        if request.url.path == "/api/accounts/auth/me/":
+            return httpx.Response(200, json={"email": "dev@example.com"})
+        if request.url.path == "/api/accounts/auth/logout/":
+            return httpx.Response(200, json={"detail": "Successfully logged out."})
+        return httpx.Response(404, json={"detail": "Not found."})
+
+    return handler
+
+
+def test_login_with_debug_token(cli, runner, transport_factory):
+    transport = transport_factory(make_auth_handler())
+
+    result = runner.invoke(cli, ["login", "dev@example.com"])
+
+    assert result.exit_code == 0, result.output
+    assert config.get("token") == "drf-token"
+    assert config.get("email") == "dev@example.com"
+    magic, verify = transport.requests
+    assert json.loads(magic.content) == {"email": "dev@example.com"}
+    assert json.loads(verify.content) == {"token": "magic-1"}
+
+
+def test_login_prompts_without_debug_token(cli, runner, transport_factory):
+    transport_factory(make_auth_handler(debug_token=None))
+
+    result = runner.invoke(cli, ["login", "dev@example.com"], input="magic-1\n")
+
+    assert result.exit_code == 0, result.output
+    assert config.get("token") == "drf-token"
+
+
+def test_login_bad_token_fails(cli, runner, transport_factory):
+    transport_factory(make_auth_handler(debug_token="wrong"))
+
+    result = runner.invoke(cli, ["login", "dev@example.com"])
+
+    assert result.exit_code == 1
+    assert config.get("token") is None
+
+
+def test_whoami_sends_token(cli, runner, transport_factory):
+    config.set_value("token", "drf-token")
+    transport = transport_factory(make_auth_handler())
+
+    result = runner.invoke(cli, ["whoami"])
+
+    assert result.exit_code == 0, result.output
+    assert transport.requests[0].headers["Authorization"] == "Token drf-token"
+    assert json.loads(result.output) == {"email": "dev@example.com"}
+
+
+def test_logout_clears_token(cli, runner, transport_factory):
+    config.set_value("token", "drf-token")
+    transport = transport_factory(make_auth_handler())
+
+    result = runner.invoke(cli, ["logout"])
+
+    assert result.exit_code == 0, result.output
+    assert config.get("token") is None
+    assert transport.requests[0].url.path == "/api/accounts/auth/logout/"
+
+
+def test_config_set_and_get(cli, runner):
+    result = runner.invoke(cli, ["config", "set", "default_workspace", "ws-1"])
+    assert result.exit_code == 0, result.output
+
+    result = runner.invoke(cli, ["config", "get", "default_workspace"])
+    assert result.exit_code == 0
+    assert result.output.strip() == "ws-1"
+
+
+def make_mfa_handler(*, enrolled: bool, code: str = "123456", ticket_valid: bool = True):
+    """The API's MFA login branch: verify answers with a ticket instead of a
+    token, and a code (after enrollment, when not enrolled) completes it."""
+
+    def handler(request: httpx.Request) -> httpx.Response:
+        path = request.url.path
+        body = json.loads(request.content) if request.content else {}
+        if path == "/api/accounts/auth/magic-link/":
+            return httpx.Response(200, json={"detail": "Magic link sent."})
+        if path == "/api/accounts/auth/verify/":
+            if body["token"] != "magic-1":
+                return httpx.Response(400, json={"detail": "Invalid or expired link."})
+            return httpx.Response(
+                200, json={"mfa_required": True, "mfa_enrolled": enrolled, "ticket": "ticket-1"}
+            )
+        if not ticket_valid or body.get("ticket") != "ticket-1":
+            status = 400 if path.endswith("/verify/") else 403
+            return httpx.Response(status, json={"detail": "Invalid or expired ticket."})
+        if path == "/api/accounts/auth/mfa/setup/":
+            return httpx.Response(
+                200,
+                json={"secret": "SECRET", "otpauth_url": "otpauth://totp/Current?secret=SECRET"},
+            )
+        if path in ("/api/accounts/auth/mfa/verify/", "/api/accounts/auth/mfa/confirm/"):
+            if body["code"] != code:
+                return httpx.Response(400, json={"detail": "Incorrect code."})
+            return httpx.Response(
+                200,
+                json={
+                    "mfa_required": False,
+                    "token": "drf-token",
+                    "user": {"email": "a@orinlabs.ai"},
+                },
+            )
+        return httpx.Response(404, json={"detail": "Not found."})
+
+    return handler
+
+
+def test_login_with_enrolled_mfa(cli, runner, transport_factory):
+    transport = transport_factory(make_mfa_handler(enrolled=True))
+
+    result = runner.invoke(cli, ["login", "a@orinlabs.ai"], input="magic-1\n123 456\n")
+
+    assert result.exit_code == 0, result.output
+    assert config.get("token") == "drf-token"
+    paths = [r.url.path for r in transport.requests]
+    assert paths[-1] == "/api/accounts/auth/mfa/verify/"
+    assert json.loads(transport.requests[-1].content) == {"ticket": "ticket-1", "code": "123456"}
+
+
+def test_login_enrolls_mfa_when_not_enrolled(cli, runner, transport_factory):
+    transport = transport_factory(make_mfa_handler(enrolled=False))
+
+    result = runner.invoke(cli, ["login", "a@orinlabs.ai"], input="magic-1\n123456\n")
+
+    assert result.exit_code == 0, result.output
+    assert "otpauth://totp/Current?secret=SECRET" in result.output
+    assert "SECRET" in result.output
+    assert config.get("token") == "drf-token"
+    paths = [r.url.path for r in transport.requests]
+    assert paths[-2:] == ["/api/accounts/auth/mfa/setup/", "/api/accounts/auth/mfa/confirm/"]
+
+
+def test_login_retries_incorrect_code(cli, runner, transport_factory):
+    transport_factory(make_mfa_handler(enrolled=True))
+
+    result = runner.invoke(cli, ["login", "a@orinlabs.ai"], input="magic-1\n000000\n123456\n")
+
+    assert result.exit_code == 0, result.output
+    assert "Incorrect code. Try again." in result.output
+    assert config.get("token") == "drf-token"
+
+
+def test_login_gives_up_after_three_incorrect_codes(cli, runner, transport_factory):
+    transport = transport_factory(make_mfa_handler(enrolled=True))
+
+    result = runner.invoke(
+        cli, ["login", "a@orinlabs.ai"], input="magic-1\n000000\n000000\n000000\n"
+    )
+
+    assert result.exit_code == 1
+    assert config.get("token") is None
+    verifies = [r for r in transport.requests if r.url.path == "/api/accounts/auth/mfa/verify/"]
+    assert len(verifies) == 3
+
+
+def test_login_expired_ticket_says_to_start_again(cli, runner, transport_factory):
+    transport_factory(make_mfa_handler(enrolled=True, ticket_valid=False))
+
+    result = runner.invoke(cli, ["login", "a@orinlabs.ai"], input="magic-1\n123456\n")
+
+    assert result.exit_code == 1
+    assert "Run `current login` again." in result.output
+    assert config.get("token") is None
+
+
+def test_login_expired_ticket_during_enrollment(cli, runner, transport_factory):
+    transport_factory(make_mfa_handler(enrolled=False, ticket_valid=False))
+
+    result = runner.invoke(cli, ["login", "a@orinlabs.ai"], input="magic-1\n")
+
+    assert result.exit_code == 1
+    assert "Run `current login` again." in result.output
+    assert config.get("token") is None
+
+
+def test_login_accepts_pasted_sign_in_link(cli, runner, transport_factory):
+    transport = transport_factory(make_auth_handler(debug_token=None))
+
+    result = runner.invoke(
+        cli,
+        ["login", "dev@example.com"],
+        input="https://current.orinlabs.ai/auth/verify?token=magic-1\n",
+    )
+
+    assert result.exit_code == 0, result.output
+    assert json.loads(transport.requests[1].content) == {"token": "magic-1"}
+    assert config.get("token") == "drf-token"

current_cli-0.1.59/tests/test_auth.py

@@ -1,92 +0,0 @@
-"""The login flow must match the API's magic-link contract."""
-
-import json
-
-import httpx
-
-from current_cli import config
-
-
-def make_auth_handler(debug_token: str | None = "magic-1"):
-    def handler(request: httpx.Request) -> httpx.Response:
-        if request.url.path == "/api/accounts/auth/magic-link/":
-            payload = {"detail": "Magic link sent."}
-            if debug_token:
-                payload["debug_token"] = debug_token
-            return httpx.Response(200, json=payload)
-        if request.url.path == "/api/accounts/auth/verify/":
-            body = json.loads(request.content)
-            if body["token"] != "magic-1":
-                return httpx.Response(400, json={"detail": "Invalid or expired link."})
-            return httpx.Response(
-                200, json={"token": "drf-token", "user": {"email": "dev@example.com"}}
-            )
-        if request.url.path == "/api/accounts/auth/me/":
-            return httpx.Response(200, json={"email": "dev@example.com"})
-        if request.url.path == "/api/accounts/auth/logout/":
-            return httpx.Response(200, json={"detail": "Successfully logged out."})
-        return httpx.Response(404, json={"detail": "Not found."})
-
-    return handler
-
-
-def test_login_with_debug_token(cli, runner, transport_factory):
-    transport = transport_factory(make_auth_handler())
-
-    result = runner.invoke(cli, ["login", "dev@example.com"])
-
-    assert result.exit_code == 0, result.output
-    assert config.get("token") == "drf-token"
-    assert config.get("email") == "dev@example.com"
-    magic, verify = transport.requests
-    assert json.loads(magic.content) == {"email": "dev@example.com"}
-    assert json.loads(verify.content) == {"token": "magic-1"}
-
-
-def test_login_prompts_without_debug_token(cli, runner, transport_factory):
-    transport_factory(make_auth_handler(debug_token=None))
-
-    result = runner.invoke(cli, ["login", "dev@example.com"], input="magic-1\n")
-
-    assert result.exit_code == 0, result.output
-    assert config.get("token") == "drf-token"
-
-
-def test_login_bad_token_fails(cli, runner, transport_factory):
-    transport_factory(make_auth_handler(debug_token="wrong"))
-
-    result = runner.invoke(cli, ["login", "dev@example.com"])
-
-    assert result.exit_code == 1
-    assert config.get("token") is None
-
-
-def test_whoami_sends_token(cli, runner, transport_factory):
-    config.set_value("token", "drf-token")
-    transport = transport_factory(make_auth_handler())
-
-    result = runner.invoke(cli, ["whoami"])
-
-    assert result.exit_code == 0, result.output
-    assert transport.requests[0].headers["Authorization"] == "Token drf-token"
-    assert json.loads(result.output) == {"email": "dev@example.com"}
-
-
-def test_logout_clears_token(cli, runner, transport_factory):
-    config.set_value("token", "drf-token")
-    transport = transport_factory(make_auth_handler())
-
-    result = runner.invoke(cli, ["logout"])
-
-    assert result.exit_code == 0, result.output
-    assert config.get("token") is None
-    assert transport.requests[0].url.path == "/api/accounts/auth/logout/"
-
-
-def test_config_set_and_get(cli, runner):
-    result = runner.invoke(cli, ["config", "set", "default_workspace", "ws-1"])
-    assert result.exit_code == 0, result.output
-
-    result = runner.invoke(cli, ["config", "get", "default_workspace"])
-    assert result.exit_code == 0
-    assert result.output.strip() == "ws-1"