cylera-cli 1.2.2__tar.gz → 1.3.0__tar.gz

{cylera_cli-1.2.2/cylera_cli.egg-info → cylera_cli-1.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cylera-cli
-Version: 1.2.2
+Version: 1.3.0
 Summary: Command-line interface for the Cylera Partner API
 Author-email: Cylera <support@cylera.com>
 License-Expression: MIT
@@ -22,7 +22,7 @@ Classifier: Topic :: System :: Systems Administration
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: cylera-client>=1.2.0
+Requires-Dist: cylera-client>=1.4.0
 Requires-Dist: python-dotenv>=1.2.1
 Requires-Dist: requests>=2.32.5
 Requires-Dist: typer>=0.21.1

{cylera_cli-1.2.2 → cylera_cli-1.3.0}/cylera.py

@@ -31,6 +31,9 @@ from cylera_client import (
     CyleraAuthError,
 )
 
+import cylera_auth
+from cylera_auth import CyleraLoginError
+
 # Available Cylera API endpoints
 CYLERA_URLS = [
     "https://partner.us1.cylera.com/",
@@ -51,12 +54,30 @@ def print_json(data: Any) -> None:
     print(json.dumps(data, indent=2))
 
 
+def base_url_setting() -> Optional[str]:
+    """CYLERA_BASE_URL when set, else the API last signed in to."""
+    load_dotenv(Path.cwd() / ".env")
+    return os.environ.get("CYLERA_BASE_URL") or cylera_auth.default_base_url()
+
+
 def get_client() -> CyleraClient:
-    """Create and return a CyleraClient using environment variables."""
-    base_url = os.environ.get("CYLERA_BASE_URL")
+    """Create and return a CyleraClient using environment variables.
+
+    A username and password, when set, win; otherwise the client uses the
+    WorkOS sign-in stored by 'cylera auth login'.
+    """
+    base_url = base_url_setting()
     username = os.environ.get("CYLERA_USERNAME")
     password = os.environ.get("CYLERA_PASSWORD")
 
+    if base_url and not (username or password) and cylera_auth.stored_login(base_url):
+        try:
+            token = cylera_auth.cylera_token(base_url)
+        except CyleraLoginError as e:
+            print(f"Error: {e}", file=sys.stderr)
+            raise typer.Exit(1)
+        return CyleraClient(token=token, base_url=base_url)
+
     if not base_url or not username or not password:
         print(
             "Error: Missing required environment variables.\n"
@@ -71,10 +92,11 @@ def get_client() -> CyleraClient:
 
 def check_environment() -> bool:
     """Check if required environment variables are set."""
-    load_dotenv(Path.cwd() / ".env")
-    base_url = os.environ.get("CYLERA_BASE_URL")
+    base_url = base_url_setting()
     username = os.environ.get("CYLERA_USERNAME")
     password = os.environ.get("CYLERA_PASSWORD")
+    if base_url and not (username or password):
+        return cylera_auth.stored_login(base_url) is not None
     return bool(base_url and username and password)
 
 
@@ -227,6 +249,84 @@ def init() -> None:
     print("  cylera devices --page-size 5")
 
 
+# Hidden until the Partner API has POST /auth/token_exchange: for now
+# these work only against the identity management prototype.
+auth_app = typer.Typer(
+    help="Sign in to Cylera through WorkOS.", no_args_is_help=True)
+app.add_typer(auth_app, name="auth", hidden=True)
+
+
+def _require_base_url() -> str:
+    base_url = base_url_setting()
+    if not base_url:
+        print("Not signed in. Run 'cylera auth login'.", file=sys.stderr)
+        raise typer.Exit(1)
+    return base_url
+
+
+@auth_app.command("login")
+def auth_login(
+    base_url: Annotated[Optional[str], typer.Option(
+        "--base-url", help="Cylera API endpoint, instead of choosing one")] = None,
+    no_browser: Annotated[bool, typer.Option(
+        "--no-browser", help="Print the sign-in link without opening a browser")] = False,
+) -> None:
+    """Sign in through your browser."""
+    load_dotenv(Path.cwd() / ".env")
+    client_id = os.environ.get("CYLERA_WORKOS_CLIENT_ID")
+    if not client_id:
+        print("Error: Set CYLERA_WORKOS_CLIENT_ID.", file=sys.stderr)
+        raise typer.Exit(1)
+    base_url = base_url or os.environ.get("CYLERA_BASE_URL")
+    if not base_url:
+        base_url = _prompt_base_url()
+        print()
+    try:
+        authentication = cylera_auth.device_login(
+            client_id, show=lambda line: print(line, file=sys.stderr),
+            open_browser=not no_browser)
+        # Exchange before storing anything, so an account Cylera won't
+        # accept isn't left half signed in.
+        token = cylera_auth.exchange_token(base_url, authentication["access_token"])
+    except CyleraLoginError as e:
+        print(f"Error: {e}", file=sys.stderr)
+        raise typer.Exit(1)
+    cylera_auth.save_login(base_url, client_id, authentication)
+
+    with CyleraClient(token=token, base_url=base_url) as client:
+        current = Organization(client).get_organization()
+    print(
+        f"Signed in as {authentication['user']['email']} "
+        f"({current.get('name', 'unknown organization')}) on {base_url}",
+        file=sys.stderr,
+    )
+
+
+@auth_app.command("status")
+def auth_status() -> None:
+    """Show how the CLI signs in to Cylera."""
+    base_url = _require_base_url()
+    username = os.environ.get("CYLERA_USERNAME")
+    if username:
+        print(f"Using the password for {username} on {base_url}")
+        return
+    login = cylera_auth.stored_login(base_url)
+    if login is None:
+        print(f"Not signed in on {base_url}. Run 'cylera auth login'.")
+        raise typer.Exit(1)
+    print(f"Signed in through WorkOS as {login['email']} on {base_url}")
+
+
+@auth_app.command("logout")
+def auth_logout() -> None:
+    """Forget the WorkOS sign-in for the current Cylera API endpoint."""
+    base_url = _require_base_url()
+    if cylera_auth.forget_login(base_url):
+        print(f"Signed out on {base_url}")
+    else:
+        print(f"Not signed in on {base_url}")
+
+
 @app.command()
 def organization() -> None:
     """Get the organization associated with the current credentials."""

cylera_cli-1.3.0/cylera_auth.py

@@ -0,0 +1,188 @@
+"""
+WorkOS sign-in for the Cylera CLI (`cylera auth login`).
+
+Uses the WorkOS CLI Auth flow (the OAuth 2.0 Device Authorization Grant,
+RFC 8628) as a public client: only a client ID, no API key or secret. The
+WorkOS refresh token is stored per Partner API URL; each command refreshes
+it for a WorkOS access token and exchanges that at the Partner API's
+POST /auth/token_exchange for a Cylera token. The Partner API URL last
+signed in to becomes the default, so commands work from any directory.
+
+Prototype: the WorkOS client ID comes from CYLERA_WORKOS_CLIENT_ID rather
+than being discovered from the Partner API.
+"""
+
+import json
+import os
+import time
+import webbrowser
+from pathlib import Path
+from typing import Any, Callable, Optional
+
+import requests
+
+WORKOS_API = "https://api.workos.com/user_management"
+DEVICE_CODE_GRANT = "urn:ietf:params:oauth:grant-type:device_code"
+CREDENTIALS_PATH = Path.home() / ".config" / "cylera" / "credentials.json"
+CONFIG_PATH = Path.home() / ".config" / "cylera" / "config.json"
+
+
+class CyleraLoginError(Exception):
+    """Sign-in failed, or the stored sign-in no longer works."""
+
+
+def _key(base_url: str) -> str:
+    return base_url.rstrip("/")
+
+
+def _read_credentials() -> dict[str, Any]:
+    if not CREDENTIALS_PATH.exists():
+        return {}
+    return json.loads(CREDENTIALS_PATH.read_text())
+
+
+def _write_credentials(credentials: dict[str, Any]) -> None:
+    CREDENTIALS_PATH.parent.mkdir(parents=True, exist_ok=True)
+    # Created owner-only: the refresh token works on its own.
+    fd = os.open(CREDENTIALS_PATH, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
+    with os.fdopen(fd, "w") as f:
+        json.dump(credentials, f, indent=2)
+
+
+def default_base_url() -> Optional[str]:
+    """The Partner API URL last signed in to, or None."""
+    if not CONFIG_PATH.exists():
+        return None
+    return json.loads(CONFIG_PATH.read_text()).get("base_url")
+
+
+def _set_default_base_url(base_url: Optional[str]) -> None:
+    CONFIG_PATH.parent.mkdir(parents=True, exist_ok=True)
+    CONFIG_PATH.write_text(json.dumps({"base_url": base_url}, indent=2))
+
+
+def stored_login(base_url: str) -> Optional[dict[str, Any]]:
+    """The stored sign-in for this Partner API, or None."""
+    return _read_credentials().get(_key(base_url))
+
+
+def _store_login(base_url: str, login: dict[str, Any]) -> None:
+    credentials = _read_credentials()
+    credentials[_key(base_url)] = login
+    _write_credentials(credentials)
+
+
+def forget_login(base_url: str) -> bool:
+    """Delete the stored sign-in for this Partner API. True if there was one."""
+    credentials = _read_credentials()
+    if credentials.pop(_key(base_url), None) is None:
+        return False
+    _write_credentials(credentials)
+    if default_base_url() == base_url:
+        _set_default_base_url(None)
+    return True
+
+
+def _post(path: str, data: dict[str, str]) -> requests.Response:
+    return requests.post(f"{WORKOS_API}/{path}", data=data, timeout=30)
+
+
+def device_login(
+    client_id: str,
+    show: Callable[[str], None] = print,
+    open_browser: bool = True,
+) -> dict[str, Any]:
+    """Run the device flow until the user confirms in the browser.
+
+    Returns WorkOS's authentication response (user, access_token,
+    refresh_token, ...). Raises CyleraLoginError if the user declines or
+    the code expires.
+    """
+    response = _post("authorize/device", {"client_id": client_id})
+    if not response.ok:
+        raise CyleraLoginError(f"WorkOS refused the sign-in request: {response.text}")
+    device = response.json()
+
+    url = device["verification_uri_complete"]
+    show(f"Open this page to sign in: {url}")
+    show(f"Confirm this code matches: {device['user_code']}")
+    if open_browser:
+        webbrowser.open(url)
+
+    interval = device.get("interval", 5)
+    deadline = time.monotonic() + device.get("expires_in", 300)
+    while time.monotonic() < deadline:
+        time.sleep(interval)
+        response = _post("authenticate", {
+            "grant_type": DEVICE_CODE_GRANT,
+            "device_code": device["device_code"],
+            "client_id": client_id,
+        })
+        if response.ok:
+            return response.json()
+        error = response.json().get("error")
+        if error == "authorization_pending":
+            continue
+        if error == "slow_down":
+            interval += 5
+            continue
+        if error == "access_denied":
+            raise CyleraLoginError("Sign-in was declined.")
+        if error == "expired_token":
+            break
+        raise CyleraLoginError(f"WorkOS sign-in failed: {response.text}")
+    raise CyleraLoginError("The sign-in code expired. Run 'cylera auth login' again.")
+
+
+def exchange_token(base_url: str, workos_access_token: str) -> str:
+    """Exchange a WorkOS access token for a Cylera token."""
+    response = requests.post(
+        f"{_key(base_url)}/auth/token_exchange",
+        json={"token": workos_access_token},
+        timeout=30,
+    )
+    if response.status_code == 404:
+        raise CyleraLoginError(
+            "This Cylera API doesn't support signing in through WorkOS yet.")
+    if response.status_code == 401:
+        raise CyleraLoginError(
+            "Cylera refused your WorkOS sign-in. Sign in to the Cylera Portal "
+            "once to move your account to WorkOS, then try again."
+        )
+    response.raise_for_status()
+    return response.json()["token"]
+
+
+def save_login(base_url: str, client_id: str, authentication: dict[str, Any]) -> None:
+    """Store a fresh sign-in's refresh token, and make its Partner API the default."""
+    _store_login(base_url, {
+        "client_id": client_id,
+        "email": authentication["user"]["email"],
+        "refresh_token": authentication["refresh_token"],
+    })
+    _set_default_base_url(base_url)
+
+
+def cylera_token(base_url: str) -> str:
+    """A Cylera token from the stored sign-in.
+
+    Refreshes the WorkOS session (saving the rotated refresh token) and
+    exchanges the new access token. Raises CyleraLoginError if there's no
+    stored sign-in, or WorkOS no longer accepts it.
+    """
+    login = stored_login(base_url)
+    if login is None:
+        raise CyleraLoginError("Not signed in. Run 'cylera auth login'.")
+    response = _post("authenticate", {
+        "grant_type": "refresh_token",
+        "refresh_token": login["refresh_token"],
+        "client_id": login["client_id"],
+    })
+    if not response.ok:
+        if response.json().get("error") == "invalid_grant":
+            forget_login(base_url)
+            raise CyleraLoginError("Your sign-in has expired. Run 'cylera auth login'.")
+        raise CyleraLoginError(f"WorkOS refresh failed: {response.text}")
+    authentication = response.json()
+    _store_login(base_url, {**login, "refresh_token": authentication["refresh_token"]})
+    return exchange_token(base_url, authentication["access_token"])

{cylera_cli-1.2.2 → cylera_cli-1.3.0/cylera_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cylera-cli
-Version: 1.2.2
+Version: 1.3.0
 Summary: Command-line interface for the Cylera Partner API
 Author-email: Cylera <support@cylera.com>
 License-Expression: MIT
@@ -22,7 +22,7 @@ Classifier: Topic :: System :: Systems Administration
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: cylera-client>=1.2.0
+Requires-Dist: cylera-client>=1.4.0
 Requires-Dist: python-dotenv>=1.2.1
 Requires-Dist: requests>=2.32.5
 Requires-Dist: typer>=0.21.1

{cylera_cli-1.2.2 → cylera_cli-1.3.0}/cylera_cli.egg-info/SOURCES.txt

@@ -1,6 +1,7 @@
 LICENSE
 README.md
 cylera.py
+cylera_auth.py
 pyproject.toml
 cylera_cli.egg-info/PKG-INFO
 cylera_cli.egg-info/SOURCES.txt

{cylera_cli-1.2.2 → cylera_cli-1.3.0}/cylera_cli.egg-info/requires.txt

@@ -1,4 +1,4 @@
-cylera-client>=1.2.0
+cylera-client>=1.4.0
 python-dotenv>=1.2.1
 requests>=2.32.5
 typer>=0.21.1

cylera_cli-1.3.0/cylera_cli.egg-info/top_level.txt

@@ -0,0 +1,2 @@
+cylera
+cylera_auth

{cylera_cli-1.2.2 → cylera_cli-1.3.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "cylera-cli"
-version = "1.2.2"
+version = "1.3.0"
 description = "Command-line interface for the Cylera Partner API"
 readme = "README.md"
 license = "MIT"
@@ -23,7 +23,7 @@ classifiers = [
 ]
 requires-python = ">=3.10"
 dependencies = [
-    "cylera-client>=1.2.0",
+    "cylera-client>=1.4.0",
     "python-dotenv>=1.2.1",
     "requests>=2.32.5",
     "typer>=0.21.1",
@@ -42,7 +42,7 @@ requires = ["setuptools>=61.0"]
 build-backend = "setuptools.build_meta"
 
 [tool.setuptools]
-py-modules = ["cylera"]
+py-modules = ["cylera", "cylera_auth"]
 
 [dependency-groups]
 dev = [

cylera_cli-1.2.2/cylera_cli.egg-info/top_level.txt

@@ -1 +0,0 @@
-cylera