databar 2.5.0__tar.gz → 2.6.0__tar.gz

{databar-2.5.0/src/databar.egg-info → databar-2.6.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: databar
-Version: 2.5.0
+Version: 2.6.0
 Summary: Official Databar.ai Python SDK and CLI — connect to enrichments, waterfalls, and tables via api.databar.ai
 Author-email: "Databar.ai Team" <info@databar.ai>
 License: MIT License
@@ -81,7 +81,8 @@ Get your API key from [databar.ai](https://databar.ai) → **Integrations**.
 ```bash
 databar login
 ```
-Saves your key to `~/.databar/config`.
+Opens the browser to sign in and saves your workspace API key to `~/.databar/config`.
+For CI or agents, use `databar login --api-key <key>` instead.
 
 **Option 2 — Environment variable:**
 ```bash
@@ -423,7 +424,9 @@ After installing, the `databar` command is available in your terminal.
 ### Authentication
 
 ```bash
-databar login              # save API key interactively
+databar login              # browser OAuth → save API key
+databar login --api-key …  # paste a key (CI / agents)
+databar logout             # remove saved key
 databar whoami             # show name, email, balance, plan
 databar whoami --format json
 ```

{databar-2.5.0 → databar-2.6.0}/README.md

@@ -26,7 +26,8 @@ Get your API key from [databar.ai](https://databar.ai) → **Integrations**.
 ```bash
 databar login
 ```
-Saves your key to `~/.databar/config`.
+Opens the browser to sign in and saves your workspace API key to `~/.databar/config`.
+For CI or agents, use `databar login --api-key <key>` instead.
 
 **Option 2 — Environment variable:**
 ```bash
@@ -368,7 +369,9 @@ After installing, the `databar` command is available in your terminal.
 ### Authentication
 
 ```bash
-databar login              # save API key interactively
+databar login              # browser OAuth → save API key
+databar login --api-key …  # paste a key (CI / agents)
+databar logout             # remove saved key
 databar whoami             # show name, email, balance, plan
 databar whoami --format json
 ```

{databar-2.5.0 → databar-2.6.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "databar"
-version = "2.5.0"
+version = "2.6.0"
 description = "Official Databar.ai Python SDK and CLI — connect to enrichments, waterfalls, and tables via api.databar.ai"
 readme = "README.md"
 license = { file = "LICENSE" }

{databar-2.5.0 → databar-2.6.0}/src/databar/__init__.py

@@ -63,8 +63,11 @@ from .models import (
     WaterfallEnrichment,
     # Flows
     Flow,
+    FlowConfigError,
     FlowConfigOpsResult,
+    FlowCostEstimate,
     FlowDetail,
+    FlowValidateResult,
     FlowInput,
     FlowOutput,
     FlowVersion,
@@ -107,7 +110,7 @@ from .models import (
     Folder,
 )
 
-__version__ = "2.5.0"
+__version__ = "2.6.0"
 __all__ = [
     "DatabarClient",
     # exceptions
@@ -147,8 +150,11 @@ __all__ = [
     "WaterfallEnrichment",
     # flows
     "Flow",
+    "FlowConfigError",
     "FlowConfigOpsResult",
+    "FlowCostEstimate",
     "FlowDetail",
+    "FlowValidateResult",
     "FlowInput",
     "FlowOutput",
     "FlowVersion",

databar-2.6.0/src/databar/cli/_auth.py

@@ -0,0 +1,187 @@
+"""
+API key management and auth-related CLI commands.
+
+Key resolution order (same as MCP server):
+  1. DATABAR_API_KEY environment variable
+  2. ~/.databar/config file
+  3. Error with helpful message pointing to `databar login`
+"""
+
+from __future__ import annotations
+
+import os
+import shutil
+from pathlib import Path
+from typing import Optional
+
+import typer
+
+from databar.client import DatabarClient
+from databar.exceptions import DatabarError
+
+from ._output import console, error, output, success, OutputFormat
+
+CONFIG_DIR = Path.home() / ".databar"
+CONFIG_FILE = CONFIG_DIR / "config"
+
+_KEY_PREFIX = "api_key="
+
+
+def get_api_key() -> str:
+    """
+    Resolve the API key using the standard priority order.
+    Exits with a helpful error if no key is found.
+    """
+    key = os.environ.get("DATABAR_API_KEY")
+    if key:
+        return key.strip()
+
+    if CONFIG_FILE.exists():
+        for line in CONFIG_FILE.read_text().splitlines():
+            if line.startswith(_KEY_PREFIX):
+                key = line[len(_KEY_PREFIX) :].strip()
+                if key:
+                    return key
+
+    error(
+        "No API key found.\n"
+        "  Run [bold]databar login[/bold] to sign in via browser, or set the "
+        "[bold]DATABAR_API_KEY[/bold] environment variable.\n"
+        "  Or paste a key with [bold]databar login --api-key[/bold].",
+        code="auth_missing",
+    )
+    raise typer.Exit(1)  # unreachable but satisfies type checkers
+
+
+def get_client() -> DatabarClient:
+    """Return a configured DatabarClient using the resolved API key."""
+    return DatabarClient(api_key=get_api_key(), client_source="cli")
+
+
+def _save_api_key(api_key: str) -> None:
+    CONFIG_DIR.mkdir(parents=True, exist_ok=True)
+    # Preserve non-key lines (preferred_interface, etc.) when rewriting.
+    other_lines: list[str] = []
+    if CONFIG_FILE.exists():
+        for line in CONFIG_FILE.read_text().splitlines():
+            if not line.startswith(_KEY_PREFIX):
+                other_lines.append(line)
+    body = "\n".join([f"{_KEY_PREFIX}{api_key}", *other_lines]).rstrip() + "\n"
+    CONFIG_FILE.write_text(body)
+    CONFIG_FILE.chmod(0o600)
+
+
+def _path_hint() -> None:
+    if shutil.which("databar") is not None:
+        return
+    import sys
+
+    bin_dir = Path(sys.executable).parent
+    console.print(
+        f"\n[yellow]Note:[/yellow] The [bold]databar[/bold] command is not on your PATH.\n"
+        f"Add this to your shell profile ([dim]~/.zshrc[/dim] or [dim]~/.bashrc[/dim]):\n\n"
+        f'  [bold]export PATH="{bin_dir}:$PATH"[/bold]\n\n'
+        f"Then restart your terminal, or run:\n\n"
+        f"  [bold]source ~/.zshrc[/bold]\n\n"
+        f"Until then, use the full path: [bold]{bin_dir}/databar[/bold]"
+    )
+
+
+# ---------------------------------------------------------------------------
+# CLI commands
+# ---------------------------------------------------------------------------
+
+app = typer.Typer(help="Authentication commands.")
+
+
+@app.command("login")
+def login(
+    api_key: Optional[str] = typer.Option(
+        None,
+        "--api-key",
+        "-k",
+        help="Paste an API key instead of opening the browser.",
+        hide_input=True,
+    ),
+) -> None:
+    """Sign in to Databar (opens the browser) and save your API key."""
+    if api_key is not None:
+        # Explicit --api-key (possibly empty → interactive paste).
+        if not api_key:
+            api_key = typer.prompt("Enter your Databar API key", hide_input=True)
+        api_key = api_key.strip()
+        if not api_key:
+            error("API key cannot be empty.")
+        _save_api_key(api_key)
+        success(f"API key saved to {CONFIG_FILE}")
+        console.print("[dim]Tip: You can also set DATABAR_API_KEY as an environment variable.[/dim]")
+        _path_hint()
+        return
+
+    from ._oauth import run_browser_login
+
+    def _print_url(url: str, *, opened: bool) -> None:
+        if opened:
+            console.print("[dim]Opening browser for Databar login…[/dim]")
+        else:
+            console.print("Open this URL in your browser to continue:")
+        console.print(f"  {url}")
+
+    try:
+        creds = run_browser_login(print_url=_print_url)
+    except RuntimeError as exc:
+        error(str(exc))
+
+    _save_api_key(creds["api_key"])
+    email = creds.get("email") or ""
+    if email:
+        success(f"Logged in as {email}")
+    else:
+        success(f"API key saved to {CONFIG_FILE}")
+    console.print(f"[dim]Credentials saved to {CONFIG_FILE}[/dim]")
+    _path_hint()
+
+
+@app.command("logout")
+def logout() -> None:
+    """Remove the saved API key from ~/.databar/config."""
+    if not CONFIG_FILE.exists():
+        console.print("[dim]Already logged out — no config file found.[/dim]")
+        return
+
+    other_lines = [
+        line
+        for line in CONFIG_FILE.read_text().splitlines()
+        if not line.startswith(_KEY_PREFIX)
+    ]
+    if other_lines:
+        CONFIG_FILE.write_text("\n".join(other_lines).rstrip() + "\n")
+        CONFIG_FILE.chmod(0o600)
+    else:
+        CONFIG_FILE.unlink(missing_ok=True)
+
+    success("Logged out — API key removed from local config.")
+
+
+@app.command("whoami")
+def whoami(
+    fmt: OutputFormat = typer.Option(
+        OutputFormat.TABLE, "--format", "--output", "-f", help="Output format."
+    ),
+) -> None:
+    """Show current user info and credit balance."""
+    client = get_client()
+    try:
+        user = client.get_user()
+    except DatabarError as e:
+        error(e)
+    finally:
+        client.close()
+
+    data = {
+        "name": user.first_name or "(no name)",
+        "email": user.email,
+        "balance": f"{user.balance:.2f} credits",
+        "plan": user.plan,
+    }
+    output(data, fmt)

{databar-2.5.0 → databar-2.6.0}/src/databar/cli/_guide.py

@@ -51,7 +51,8 @@ databar whoami --format json    # verify
 ```
 
 Never run `databar onboard` — interactive wizard, not for agents.
-Never run `databar login` without `--api-key` — will hang on terminal input.
+Never run `databar login` without `--api-key` — opens a browser OAuth flow
+agents cannot complete. Always pass the key non-interactively.
 
 ---
 

databar-2.6.0/src/databar/cli/_oauth.py

@@ -0,0 +1,190 @@
+"""Browser OAuth 2.1 (PKCE) login for `databar login`.
+
+Opens the existing Databar consent screen, catches the authorization code on a
+local loopback redirect, exchanges it for a short-lived bearer token, then
+fetches the workspace API key and writes it to ~/.databar/config.
+"""
+
+from __future__ import annotations
+
+import base64
+import hashlib
+import os
+import secrets
+import threading
+import webbrowser
+from http.server import BaseHTTPRequestHandler, HTTPServer
+from typing import Optional
+from urllib.parse import parse_qs, urlencode, urlparse
+
+import httpx
+
+# Must match oauth.0002_seed_cli_oauth_application / settings.DATABAR_CLI_*.
+OAUTH_CLIENT_ID = "databar-cli"
+OAUTH_REDIRECT_URI = "http://127.0.0.1:53682/callback"
+OAUTH_CALLBACK_PORT = 53682
+OAUTH_SCOPE = "cli:access"
+DEFAULT_OAUTH_ISSUER = "https://databar.ai"
+_LOGIN_TIMEOUT_S = 300
+
+
+def _oauth_issuer() -> str:
+    return (os.environ.get("DATABAR_OAUTH_ISSUER") or DEFAULT_OAUTH_ISSUER).rstrip("/")
+
+
+def _pkce_pair() -> tuple[str, str]:
+    verifier = secrets.token_urlsafe(64)
+    challenge = base64.urlsafe_b64encode(hashlib.sha256(verifier.encode()).digest()).decode().rstrip("=")
+    return verifier, challenge
+
+
+class _CallbackResult:
+    def __init__(self) -> None:
+        self.code: Optional[str] = None
+        self.state: Optional[str] = None
+        self.error: Optional[str] = None
+        self.error_description: Optional[str] = None
+        self.event = threading.Event()
+
+
+def _make_handler(result: _CallbackResult, expected_state: str):
+    class Handler(BaseHTTPRequestHandler):
+        def log_message(self, format: str, *args) -> None:  # noqa: A003
+            return
+
+        def do_GET(self) -> None:  # noqa: N802
+            parsed = urlparse(self.path)
+            if parsed.path.rstrip("/") != "/callback":
+                self.send_response(404)
+                self.end_headers()
+                return
+
+            qs = parse_qs(parsed.query)
+            result.error = (qs.get("error") or [None])[0]
+            result.error_description = (qs.get("error_description") or [None])[0]
+            result.code = (qs.get("code") or [None])[0]
+            result.state = (qs.get("state") or [None])[0]
+
+            if result.error:
+                body = (
+                    b"<html><body><h1>Login failed</h1>"
+                    b"<p>You can close this window and return to the terminal.</p></body></html>"
+                )
+                self.send_response(400)
+            elif result.state != expected_state:
+                result.error = "invalid_state"
+                result.error_description = "OAuth state mismatch"
+                body = (
+                    b"<html><body><h1>Login failed</h1>"
+                    b"<p>State mismatch. Close this window and try again.</p></body></html>"
+                )
+                self.send_response(400)
+            else:
+                body = (
+                    b"<html><body><h1>Logged in</h1>"
+                    b"<p>You can close this window and return to the terminal.</p></body></html>"
+                )
+                self.send_response(200)
+
+            self.send_header("Content-Type", "text/html; charset=utf-8")
+            self.send_header("Content-Length", str(len(body)))
+            self.end_headers()
+            self.wfile.write(body)
+            result.event.set()
+
+    return Handler
+
+
+def _exchange_code(issuer: str, code: str, verifier: str) -> str:
+    response = httpx.post(
+        f"{issuer}/oauth/token/",
+        data={
+            "grant_type": "authorization_code",
+            "code": code,
+            "redirect_uri": OAUTH_REDIRECT_URI,
+            "client_id": OAUTH_CLIENT_ID,
+            "code_verifier": verifier,
+        },
+        headers={"Accept": "application/json"},
+        timeout=30.0,
+    )
+    if response.status_code != 200:
+        detail = response.text[:200]
+        raise RuntimeError(f"Token exchange failed ({response.status_code}): {detail}")
+    payload = response.json()
+    access_token = payload.get("access_token")
+    if not access_token:
+        raise RuntimeError("Token exchange response missing access_token")
+    return access_token
+
+
+def _fetch_api_key(issuer: str, access_token: str) -> dict:
+    response = httpx.get(
+        f"{issuer}/oauth/api/cli-credentials/",
+        headers={"Authorization": f"Bearer {access_token}", "Accept": "application/json"},
+        timeout=30.0,
+    )
+    if response.status_code != 200:
+        detail = response.text[:200]
+        raise RuntimeError(f"Could not fetch API key ({response.status_code}): {detail}")
+    payload = response.json()
+    if not payload.get("api_key"):
+        raise RuntimeError("Credentials response missing api_key")
+    return payload
+
+
+def run_browser_login(*, print_url=None) -> dict:
+    """Run the full browser OAuth flow.
+
+    Returns credentials dict with ``api_key`` and ``email``.
+    ``print_url`` is called with the authorize URL (so the CLI can show it if
+    the browser fails to open).
+    """
+    issuer = _oauth_issuer()
+    verifier, challenge = _pkce_pair()
+    state = secrets.token_urlsafe(24)
+    result = _CallbackResult()
+
+    try:
+        server = HTTPServer(("127.0.0.1", OAUTH_CALLBACK_PORT), _make_handler(result, state))
+    except OSError as exc:
+        raise RuntimeError(
+            f"Port {OAUTH_CALLBACK_PORT} is already in use. "
+            f"Close the other process and run `databar login` again."
+        ) from exc
+
+    thread = threading.Thread(target=server.serve_forever, daemon=True)
+    thread.start()
+
+    params = {
+        "client_id": OAUTH_CLIENT_ID,
+        "redirect_uri": OAUTH_REDIRECT_URI,
+        "response_type": "code",
+        "scope": OAUTH_SCOPE,
+        "code_challenge": challenge,
+        "code_challenge_method": "S256",
+        "state": state,
+    }
+    authorize_url = f"{issuer}/oauth/authorize/?{urlencode(params)}"
+
+    opened = webbrowser.open(authorize_url)
+    if print_url is not None:
+        print_url(authorize_url, opened=opened)
+
+    if not result.event.wait(timeout=_LOGIN_TIMEOUT_S):
+        server.shutdown()
+        thread.join(timeout=2)
+        raise RuntimeError("Timed out waiting for browser login. Run `databar login` again.")
+
+    server.shutdown()
+    thread.join(timeout=2)
+
+    if result.error:
+        desc = result.error_description or result.error
+        raise RuntimeError(f"Login was denied or failed: {desc}")
+
+    if not result.code:
+        raise RuntimeError("No authorization code received from the browser callback.")
+
+    access_token = _exchange_code(issuer, result.code, verifier)
+    return _fetch_api_key(issuer, access_token)

{databar-2.5.0 → databar-2.6.0}/src/databar/cli/_output.py

@@ -19,7 +19,6 @@ from enum import Enum
 from pathlib import Path
 from typing import Any, NoReturn, Optional, Union
 
-import click
 import typer
 from rich import print_json as rich_print_json
 from rich.console import Console
@@ -79,9 +78,26 @@ _HINTS = {
 }
 
 
+def _cli_context():
+    """Active Typer context, or None.
+
+    Typer 0.26+ vendors Click (no ``click`` extra). Older typer uses the
+    standalone package. Private ``typer._click`` is the only way to read
+    the live context after they vendored; fall back to ``click`` for <0.26.
+    """
+    try:
+        from typer._click.globals import get_current_context
+    except ImportError:
+        try:
+            from click import get_current_context
+        except ImportError:
+            return None
+    return get_current_context(silent=True)
+
+
 def _current_format() -> OutputFormat:
     """Read --format from the active Click/Typer context, defaulting to table."""
-    ctx = click.get_current_context(silent=True)
+    ctx = _cli_context()
     if ctx is None:
         return OutputFormat.TABLE
     fmt = ctx.params.get("fmt")

{databar-2.5.0 → databar-2.6.0}/src/databar/client.py

@@ -15,7 +15,7 @@ Endpoint groups:
   - Enrichments: list_enrichments, get_enrichment, run_enrichment[_bulk][_sync],
                  get_param_choices
   - Waterfalls:  list_waterfalls, get_waterfall, run_waterfall[_bulk][_sync]
-  - Flows:       list_flows, get_flow, run_flow[_sync]
+  - Flows:       list_flows, get_flow, run_flow[_bulk][_sync]
   - Tables:      create_table, list_tables, delete_table, rename_table,
                  get_columns, create_column, rename_column, delete_column,
                  get_table_enrichments, add_enrichment, run_table_enrichment,
@@ -75,7 +75,9 @@ from .models import (
     ExporterResponseField,
     Flow,
     FlowConfigOpsResult,
+    FlowCostEstimate,
     FlowDetail,
+    FlowValidateResult,
     FlowVersion,
     FlowVersionDetail,
     RestoreFlowVersionResult,
@@ -127,6 +129,7 @@ class DatabarClient:
         timeout: float = 30.0,
         max_poll_attempts: int = 150,
         poll_interval_s: float = 2.0,
+        client_source: str = "sdk",
     ) -> None:
         resolved_key = api_key or os.environ.get("DATABAR_API_KEY")
         if not resolved_key:
@@ -146,9 +149,20 @@ class DatabarClient:
         self._timeout = timeout
         self._max_poll_attempts = max_poll_attempts
         self._poll_interval_s = poll_interval_s
+        from databar import __version__
+
+        source = client_source if client_source in {"sdk", "cli"} else "sdk"
+        user_agent = f"databar-python/{__version__}"
+        if source == "cli":
+            user_agent = f"{user_agent} cli"
         self._http = httpx.Client(
             base_url=self._base_url,
-            headers={"x-apikey": self._api_key, "Content-Type": "application/json"},
+            headers={
+                "x-apikey": self._api_key,
+                "Content-Type": "application/json",
+                "User-Agent": user_agent,
+                "X-Source": source,
+            },
             timeout=self._timeout,
         )
 
@@ -709,6 +723,25 @@ class DatabarClient:
         data = self._request("PATCH", f"/flows/{flow_id}/config", json=payload)
         return FlowConfigOpsResult.model_validate(data)
 
+    def validate_flow_config(self, config: Dict[str, Any]) -> FlowValidateResult:
+        """Check a (possibly unsaved) config without persisting anything.
+
+        Same checks ``create_flow()`` / ``update_flow()`` run on save. An
+        invalid config does not raise: ``valid`` is False and ``errors``
+        names the node when one is at fault.
+        """
+        data = self._request("POST", "/flows/validate-config", json={"config": config})
+        return FlowValidateResult.model_validate(data)
+
+    def estimate_flow_cost(self, config: Dict[str, Any]) -> FlowCostEstimate:
+        """Credit-cost range of one run of a (possibly unsaved) config.
+
+        ``min``/``max`` because waterfalls stop at the first success and
+        conditions skip branches. Call this before ``run_flow()``.
+        """
+        data = self._request("POST", "/flows/cost-estimate", json={"config": config})
+        return FlowCostEstimate.model_validate(data)
+
     def delete_flow(self, flow_id: str) -> None:
         """Delete a flow.
 
@@ -765,6 +798,24 @@ class DatabarClient:
         task = self.run_flow(flow_id, inputs)
         return self.poll_task(task.task_id)
 
+    def run_flow_bulk(self, flow_id: str, inputs: List[Dict[str, str]]) -> RunResponse:
+        """Submit a flow over many input sets. Returns one task.
+
+        The polled result is aligned to the inputs: one element per input, in the
+        same order as ``inputs``, with ``None`` for inputs that returned no data.
+        """
+        data = self._request("POST", f"/flows/{flow_id}/bulk-run", json={"inputs": inputs})
+        return RunResponse.model_validate(data)
+
+    def run_flow_bulk_sync(self, flow_id: str, inputs: List[Dict[str, str]]) -> Any:
+        """Submit and poll a bulk flow run, returning final data when complete.
+
+        Returns a list aligned to ``inputs``: one element per input in input
+        order, ``None`` for misses (``len(result) == len(inputs)``).
+        """
+        task = self.run_flow_bulk(flow_id, inputs)
+        return self.poll_task(task.task_id)
+
     # -----------------------------------------------------------------------
     # Tables — CRUD
     # -----------------------------------------------------------------------

{databar-2.5.0 → databar-2.6.0}/src/databar/models.py

@@ -450,6 +450,36 @@ class FlowConfigOpsResult(BaseModel):
     flow: Optional[FlowDetail] = None
 
 
+class FlowConfigError(BaseModel):
+    """One reason a flow config would be rejected on save."""
+
+    node_id: Optional[str] = None
+    message: str
+
+
+class FlowValidateResult(BaseModel):
+    """Result of validate_flow_config().
+
+    An invalid config is a valid answer — ``valid`` is False and ``errors``
+    names the node (when known) rather than raising.
+    """
+
+    valid: bool
+    errors: List[FlowConfigError] = Field(default_factory=list)
+
+
+class FlowCostEstimate(BaseModel):
+    """Result of estimate_flow_cost().
+
+    ``min``/``max`` because waterfalls stop at the first success and
+    conditions skip branches. Both are credit amounts as strings.
+    """
+
+    min: str
+    max: str
+    currency: str = "credits"
+
+
 class RestoreFlowVersionResult(BaseModel):
     """Result of restore_flow_version().
 

{databar-2.5.0 → databar-2.6.0/src/databar.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: databar
-Version: 2.5.0
+Version: 2.6.0
 Summary: Official Databar.ai Python SDK and CLI — connect to enrichments, waterfalls, and tables via api.databar.ai
 Author-email: "Databar.ai Team" <info@databar.ai>
 License: MIT License
@@ -81,7 +81,8 @@ Get your API key from [databar.ai](https://databar.ai) → **Integrations**.
 ```bash
 databar login
 ```
-Saves your key to `~/.databar/config`.
+Opens the browser to sign in and saves your workspace API key to `~/.databar/config`.
+For CI or agents, use `databar login --api-key <key>` instead.
 
 **Option 2 — Environment variable:**
 ```bash
@@ -423,7 +424,9 @@ After installing, the `databar` command is available in your terminal.
 ### Authentication
 
 ```bash
-databar login              # save API key interactively
+databar login              # browser OAuth → save API key
+databar login --api-key …  # paste a key (CI / agents)
+databar logout             # remove saved key
 databar whoami             # show name, email, balance, plan
 databar whoami --format json
 ```

{databar-2.5.0 → databar-2.6.0}/src/databar.egg-info/SOURCES.txt

@@ -14,6 +14,7 @@ src/databar.egg-info/top_level.txt
 src/databar/cli/__init__.py
 src/databar/cli/_auth.py
 src/databar/cli/_guide.py
+src/databar/cli/_oauth.py
 src/databar/cli/_onboard.py
 src/databar/cli/_output.py
 src/databar/cli/app.py
@@ -24,4 +25,5 @@ src/databar/cli/tasks.py
 src/databar/cli/waterfalls.py
 tests/test_cli.py
 tests/test_client.py
-tests/test_new_features.py
+tests/test_new_features.py
+tests/test_oauth_login.py

{databar-2.5.0 → databar-2.6.0}/tests/test_cli.py

@@ -175,6 +175,49 @@ def test_login_saves_key(tmp_path, monkeypatch):
     assert "my-secret-key" in config_file.read_text()
 
 
+def test_login_oauth_saves_key(tmp_path, monkeypatch):
+    config_file = tmp_path / "config"
+    monkeypatch.setattr("databar.cli._auth.CONFIG_DIR", tmp_path)
+    monkeypatch.setattr("databar.cli._auth.CONFIG_FILE", config_file)
+    monkeypatch.setattr(
+        "databar.cli._oauth.run_browser_login",
+        lambda print_url=None: {"api_key": "oauth-key", "email": "ada@example.com"},
+    )
+    result = runner.invoke(app, ["login"])
+    assert result.exit_code == 0
+    assert "ada@example.com" in result.output
+    assert "api_key=oauth-key" in config_file.read_text()
+
+
+def test_login_oauth_preserves_other_config_lines(tmp_path, monkeypatch):
+    config_file = tmp_path / "config"
+    config_file.write_text("preferred_interface=cli\napi_key=old\n")
+    monkeypatch.setattr("databar.cli._auth.CONFIG_DIR", tmp_path)
+    monkeypatch.setattr("databar.cli._auth.CONFIG_FILE", config_file)
+    monkeypatch.setattr(
+        "databar.cli._oauth.run_browser_login",
+        lambda print_url=None: {"api_key": "new-key", "email": "ada@example.com"},
+    )
+    result = runner.invoke(app, ["login"])
+    assert result.exit_code == 0
+    text = config_file.read_text()
+    assert "api_key=new-key" in text
+    assert "preferred_interface=cli" in text
+    assert "api_key=old" not in text
+
+
+def test_logout_removes_key(tmp_path, monkeypatch):
+    config_file = tmp_path / "config"
+    config_file.write_text("api_key=secret\npreferred_interface=cli\n")
+    monkeypatch.setattr("databar.cli._auth.CONFIG_DIR", tmp_path)
+    monkeypatch.setattr("databar.cli._auth.CONFIG_FILE", config_file)
+    result = runner.invoke(app, ["logout"])
+    assert result.exit_code == 0
+    text = config_file.read_text()
+    assert "api_key=" not in text
+    assert "preferred_interface=cli" in text
+
+
 def test_whoami_table(monkeypatch):
     mock = _client_mock()
     monkeypatch.setattr("databar.cli._auth.get_client", lambda: mock)
@@ -716,4 +759,11 @@ def test_task_cancel_reports_a_finished_task(monkeypatch):
 def test_version_flag():
     result = runner.invoke(app, ["--version"])
     assert result.exit_code == 0
-    assert "2.5.0" in result.output
+    assert "2.6.0" in result.output
+
+
+def test_output_module_does_not_import_click():
+    # Typer 0.26+ vendors Click; a top-level `import click` crashes a fresh install.
+    import databar.cli._output as out
+
+    assert "click" not in out.__dict__

{databar-2.5.0 → databar-2.6.0}/tests/test_client.py

@@ -68,6 +68,20 @@ def test_client_reads_env_var(monkeypatch):
     c.close()
 
 
+def test_client_identifies_as_sdk():
+    c = DatabarClient(api_key="key")
+    assert c._http.headers["X-Source"] == "sdk"
+    assert str(c._http.headers["User-Agent"]).startswith("databar-python/")
+    c.close()
+
+
+def test_client_identifies_as_cli():
+    c = DatabarClient(api_key="key", client_source="cli")
+    assert c._http.headers["X-Source"] == "cli"
+    assert "cli" in str(c._http.headers["User-Agent"])
+    c.close()
+
+
 def test_client_context_manager(httpx_mock: HTTPXMock):
     httpx_mock.add_response(url=f"{BASE_URL}/user/me", json=user_payload())
     with DatabarClient(api_key="key") as c:
@@ -242,6 +256,25 @@ def test_run_flow_sync(client: DatabarClient, httpx_mock: HTTPXMock):
     assert result == {"full_name": "Alice"}
 
 
+def test_run_flow_bulk_returns_task(client: DatabarClient, httpx_mock: HTTPXMock):
+    httpx_mock.add_response(url=f"{BASE_URL}/flows/flow-uuid-1/bulk-run", json=task_payload("processing"))
+    task = client.run_flow_bulk("flow-uuid-1", [{"email": "a@x.com"}, {"email": "b@x.com"}])
+    assert task.task_id == "task-123"
+    req = httpx_mock.get_requests()[-1]
+    body = json.loads(req.content)
+    assert body == {"inputs": [{"email": "a@x.com"}, {"email": "b@x.com"}]}
+
+
+def test_run_flow_bulk_sync(client: DatabarClient, httpx_mock: HTTPXMock):
+    httpx_mock.add_response(url=f"{BASE_URL}/flows/flow-uuid-1/bulk-run", json=task_payload("processing"))
+    httpx_mock.add_response(
+        url=f"{BASE_URL}/tasks/task-123",
+        json=task_payload("completed", data=[{"full_name": "Alice"}, None]),
+    )
+    result = client.run_flow_bulk_sync("flow-uuid-1", [{"email": "a@x.com"}, {"email": "b@x.com"}])
+    assert result == [{"full_name": "Alice"}, None]
+
+
 # ===========================================================================
 # Tables
 # ===========================================================================
@@ -381,6 +414,33 @@ def test_patch_flow_config_sends_the_op_batch(client: DatabarClient, httpx_mock:
     assert body == {"ops": [{"op": "remove_node", "node_id": "m1"}], "validate_only": False}
 
 
+def test_validate_flow_config_posts_the_config(client: DatabarClient, httpx_mock: HTTPXMock):
+    httpx_mock.add_response(
+        url=f"{BASE_URL}/flows/validate-config",
+        method="POST",
+        json={"valid": False, "errors": [{"node_id": "cond1", "message": "bad formula"}]},
+    )
+    result = client.validate_flow_config({"nodes": []})
+    assert result.valid is False
+    assert result.errors[0].node_id == "cond1"
+    body = json.loads(httpx_mock.get_requests()[-1].content)
+    assert body == {"config": {"nodes": []}}
+
+
+def test_estimate_flow_cost_posts_the_config(client: DatabarClient, httpx_mock: HTTPXMock):
+    httpx_mock.add_response(
+        url=f"{BASE_URL}/flows/cost-estimate",
+        method="POST",
+        json={"min": "0", "max": "2", "currency": "credits"},
+    )
+    result = client.estimate_flow_cost({"nodes": []})
+    assert result.min == "0"
+    assert result.max == "2"
+    assert result.currency == "credits"
+    body = json.loads(httpx_mock.get_requests()[-1].content)
+    assert body == {"config": {"nodes": []}}
+
+
 def test_patch_flow_config_validate_only_returns_no_flow(client: DatabarClient, httpx_mock: HTTPXMock):
     httpx_mock.add_response(
         url=f"{BASE_URL}/flows/flow-uuid-1/config",

databar-2.6.0/tests/test_oauth_login.py

@@ -0,0 +1,61 @@
+"""Unit tests for CLI OAuth helpers (token exchange + credentials fetch)."""
+
+from __future__ import annotations
+
+import httpx
+import pytest
+import respx
+
+from databar.cli._oauth import (
+    OAUTH_CLIENT_ID,
+    OAUTH_REDIRECT_URI,
+    _exchange_code,
+    _fetch_api_key,
+    _pkce_pair,
+)
+
+
+def test_pkce_pair_s256_shape():
+    verifier, challenge = _pkce_pair()
+    assert len(verifier) > 40
+    assert len(challenge) >= 43
+    assert "=" not in challenge
+
+
+@respx.mock
+def test_exchange_code_posts_pkce_fields():
+    route = respx.post("https://databar.ai/oauth/token/").mock(
+        return_value=httpx.Response(200, json={"access_token": "tok", "token_type": "Bearer"})
+    )
+    token = _exchange_code("https://databar.ai", "auth-code", "verifier")
+    assert token == "tok"
+    assert route.called
+    request = route.calls.last.request
+    body = request.content.decode()
+    assert "grant_type=authorization_code" in body
+    assert "code=auth-code" in body
+    assert f"client_id={OAUTH_CLIENT_ID}" in body
+    assert "code_verifier=verifier" in body
+    assert OAUTH_REDIRECT_URI.replace(":", "%3A").replace("/", "%2F") in body or "127.0.0.1" in body
+
+
+@respx.mock
+def test_fetch_api_key_sends_bearer():
+    respx.get("https://databar.ai/oauth/api/cli-credentials/").mock(
+        return_value=httpx.Response(
+            200,
+            json={"api_key": "k", "email": "a@b.com", "workspace_identifier": "w", "workspace_name": "W"},
+        )
+    )
+    payload = _fetch_api_key("https://databar.ai", "tok")
+    assert payload["api_key"] == "k"
+    assert payload["email"] == "a@b.com"
+
+
+@respx.mock
+def test_exchange_code_raises_on_error():
+    respx.post("https://databar.ai/oauth/token/").mock(
+        return_value=httpx.Response(400, text="bad")
+    )
+    with pytest.raises(RuntimeError, match="Token exchange failed"):
+        _exchange_code("https://databar.ai", "bad", "v")

databar-2.5.0/src/databar/cli/_auth.py

@@ -1,125 +0,0 @@
-"""
-API key management and auth-related CLI commands.
-
-Key resolution order (same as MCP server):
-  1. DATABAR_API_KEY environment variable
-  2. ~/.databar/config file
-  3. Error with helpful message pointing to `databar login`
-"""
-
-from __future__ import annotations
-
-import os
-import shutil
-from pathlib import Path
-
-import typer
-
-from databar.client import DatabarClient
-from databar.exceptions import DatabarError
-
-from ._output import console, error, output, success, OutputFormat
-
-CONFIG_DIR = Path.home() / ".databar"
-CONFIG_FILE = CONFIG_DIR / "config"
-
-_KEY_PREFIX = "api_key="
-
-
-def get_api_key() -> str:
-    """
-    Resolve the API key using the standard priority order.
-    Exits with a helpful error if no key is found.
-    """
-    key = os.environ.get("DATABAR_API_KEY")
-    if key:
-        return key.strip()
-
-    if CONFIG_FILE.exists():
-        for line in CONFIG_FILE.read_text().splitlines():
-            if line.startswith(_KEY_PREFIX):
-                key = line[len(_KEY_PREFIX):].strip()
-                if key:
-                    return key
-
-    error(
-        "No API key found.\n"
-        "  Run [bold]databar login[/bold] to save your key, or set the "
-        "[bold]DATABAR_API_KEY[/bold] environment variable.\n"
-        "  Get your key at [link=https://databar.ai]databar.ai[/link] → Integrations.",
-        code="auth_missing",
-    )
-    raise typer.Exit(1)  # unreachable but satisfies type checkers
-
-
-def get_client() -> DatabarClient:
-    """Return a configured DatabarClient using the resolved API key."""
-    return DatabarClient(api_key=get_api_key())
-
-
-# ---------------------------------------------------------------------------
-# CLI commands
-# ---------------------------------------------------------------------------
-
-app = typer.Typer(help="Authentication commands.")
-
-
-@app.command("login")
-def login(
-    api_key: str = typer.Option(
-        None,
-        "--api-key",
-        "-k",
-        help="Your Databar API key. Prompted interactively if not provided.",
-        hide_input=True,
-    )
-) -> None:
-    """Save your Databar API key to ~/.databar/config."""
-    if not api_key:
-        api_key = typer.prompt("Enter your Databar API key", hide_input=True)
-
-    api_key = api_key.strip()
-    if not api_key:
-        error("API key cannot be empty.")
-
-    CONFIG_DIR.mkdir(parents=True, exist_ok=True)
-    CONFIG_FILE.write_text(f"{_KEY_PREFIX}{api_key}\n")
-    CONFIG_FILE.chmod(0o600)
-
-    success(f"API key saved to {CONFIG_FILE}")
-    console.print("[dim]Tip: You can also set DATABAR_API_KEY as an environment variable.[/dim]")
-
-    # Check if the databar binary is on PATH and print a hint if not
-    if shutil.which("databar") is None:
-        import sys
-        bin_dir = Path(sys.executable).parent
-        console.print(
-            f"\n[yellow]Note:[/yellow] The [bold]databar[/bold] command is not on your PATH.\n"
-            f"Add this to your shell profile ([dim]~/.zshrc[/dim] or [dim]~/.bashrc[/dim]):\n\n"
-            f"  [bold]export PATH=\"{bin_dir}:$PATH\"[/bold]\n\n"
-            f"Then restart your terminal, or run:\n\n"
-            f"  [bold]source ~/.zshrc[/bold]\n\n"
-            f"Until then, use the full path: [bold]{bin_dir}/databar[/bold]"
-        )
-
-
-@app.command("whoami")
-def whoami(
-    fmt: OutputFormat = typer.Option(OutputFormat.TABLE, "--format", "--output", "-f", help="Output format.")
-) -> None:
-    """Show current user info and credit balance."""
-    client = get_client()
-    try:
-        user = client.get_user()
-    except DatabarError as e:
-        error(e)
-    finally:
-        client.close()
-
-    data = {
-        "name": user.first_name or "(no name)",
-        "email": user.email,
-        "balance": f"{user.balance:.2f} credits",
-        "plan": user.plan,
-    }
-    output(data, fmt)