dataspring-cli 0.3.0__tar.gz → 0.4.1__tar.gz

{dataspring_cli-0.3.0 → dataspring_cli-0.4.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: dataspring-cli
-Version: 0.3.0
+Version: 0.4.1
 Summary: DataSpring CLI - Query metrics and manage dashboards from the terminal
 Project-URL: Homepage, https://dataspring.app
 Project-URL: Documentation, https://dataspring.app/docs

dataspring_cli-0.4.1/cli/auth.py

@@ -0,0 +1,279 @@
+"""CLI authentication: suite standard §3 (/home/dev/workspace/forspring/docs/suite-standards.md).
+
+``dataspring auth login`` runs the device flow (RFC 8628 with PKCE,
+backend/routes_device.py): the CLI shows a code and a URL, a person signed in
+to DataSpring in any browser (this machine needs none) approves it, and the
+CLI collects an ordinary ``ds_`` API key labelled ``CLI on <hostname>`` (one
+per org with ``--all-orgs``, the default).
+
+Credentials live in ``~/.dataspring/credentials.json`` (mode 0600): a profile
+per org and which one is current. ``dataspring auth use <org>`` switches
+profile; a key belongs to its org, so that is the only switching there is
+(hub D-96: no server-side switch). ``--key`` stores a key you already have,
+for CI, and the ``DATASPRING_API_KEY`` environment variable always wins over
+anything stored. ``dataspring auth logout`` revokes the stored keys on the
+server, then forgets them.
+
+Who the person is and which org a key is for are the server's answer to
+``/api/me``; nothing here opens Firestore.
+"""
+
+import base64
+import hashlib
+import json
+import os
+import secrets
+import socket
+import time
+import webbrowser
+from dataclasses import dataclass
+from pathlib import Path
+
+import httpx
+
+ENV_KEY = "DATASPRING_API_KEY"
+
+
+def _host() -> str:
+    """The backend's root (https://dataspring.app; locally http://localhost:8000)."""
+    from settings import get_settings
+
+    return get_settings().mcp_server_base_url.removesuffix("/api")
+
+
+@dataclass(frozen=True)
+class UserContext:
+    """The signed-in user as ``GET /api/me`` reports them.
+
+    Mirrors the fields of ``services.auth.UserContext`` that the CLI shows,
+    without importing the service layer: the CLI wheel ships without it.
+    """
+
+    uid: str
+    email: str
+    org_id: str | None
+    org_name: str | None
+    role: str | None
+
+    @property
+    def has_org(self) -> bool:
+        """False for an account no administrator has added to an org yet.
+
+        Since D25 sign-up creates no organization, so ``/api/me`` answers 200
+        with the three org fields null. The CLI says so rather than crashing
+        on a ``KeyError`` the way it would have.
+        """
+        return self.org_id is not None
+
+
+class AuthenticationError(Exception):
+    """Raised when authentication fails or user is not logged in."""
+    pass
+
+
+class CLIAuthManager:
+    """API keys for the CLI: device-flow login, profiles per org, the env var."""
+
+    CONFIG_DIR = Path.home() / ".dataspring"
+    CREDENTIALS_FILE = CONFIG_DIR / "credentials.json"
+    CONFIG_FILE = CONFIG_DIR / "config.json"
+
+    def __init__(self):
+        """Initialize the auth manager."""
+        self._ensure_config_dir()
+
+    def _ensure_config_dir(self):
+        """Create config directory if it doesn't exist."""
+        self.CONFIG_DIR.mkdir(mode=0o700, parents=True, exist_ok=True)
+
+    # -- stored profiles -------------------------------------------------
+
+    def _load(self) -> dict:
+        """``{current, profiles: {org: {api_key, key_id, org_name, email}}}``;
+        empty for none, or for what an older CLI stored (Google credentials,
+        or CLI tokens): those sign nobody in now."""
+        if not self.CREDENTIALS_FILE.exists():
+            return {}
+        try:
+            data = json.loads(self.CREDENTIALS_FILE.read_text())
+        except json.JSONDecodeError:
+            return {}
+        return data if isinstance(data.get("profiles"), dict) else {}
+
+    def _save(self, data: dict) -> None:
+        self.CREDENTIALS_FILE.write_text(json.dumps(data, indent=2))
+        self.CREDENTIALS_FILE.chmod(0o600)
+
+    def _add_profile(self, data: dict, entry: dict, email: str | None) -> None:
+        data.setdefault("profiles", {})[entry["org_id"]] = {
+            "api_key": entry["api_key"],
+            "key_id": entry.get("key_id"),
+            "org_name": entry.get("org_name") or entry["org_id"],
+            "email": email,
+        }
+
+    def profiles(self) -> dict[str, dict]:
+        return self._load().get("profiles", {})
+
+    def current_org(self) -> str | None:
+        return self._load().get("current")
+
+    def use(self, org_id: str) -> dict:
+        """Make the stored profile for ``org_id`` current."""
+        data = self._load()
+        if org_id not in data.get("profiles", {}):
+            raise AuthenticationError(
+                f"No key for {org_id} on this machine. Run 'dataspring auth login' and approve {org_id}."
+            )
+        data["current"] = org_id
+        self._save(data)
+        return data["profiles"][org_id]
+
+    # -- login -----------------------------------------------------------
+
+    async def login(self, *, all_orgs: bool = False, open_browser: bool = True, timeout: float = 600.0) -> "UserContext":
+        """The device flow: show a code, wait for approval in a browser, store the key(s)."""
+        verifier = secrets.token_urlsafe(48)
+        challenge = base64.urlsafe_b64encode(hashlib.sha256(verifier.encode("ascii")).digest()).rstrip(b"=").decode("ascii")
+        try:
+            r = httpx.post(f"{_host()}/api/device/code", json={
+                "code_challenge": challenge, "code_challenge_method": "S256",
+                "hostname": socket.gethostname(), "all_orgs": all_orgs,
+            }, timeout=15.0)
+        except httpx.HTTPError as e:
+            raise AuthenticationError(f"Could not reach DataSpring: {e}")
+        if r.status_code != 200:
+            raise AuthenticationError(f"Could not start the sign-in (HTTP {r.status_code})")
+        start = r.json()
+        # flush: an agent runs this with stdout redirected, where Python
+        # buffers it; unflushed, the code appeared only after the CLI exited,
+        # too late for anyone to approve it (tick 373).
+        print(f"To sign in, open {start['verification_uri']} and enter the code {start['user_code']}")
+        print(f"  (or open {start['verification_uri_complete']})", flush=True)
+        if open_browser:
+            try:
+                webbrowser.open(start["verification_uri_complete"])
+            except Exception:
+                pass  # no browser on this machine: the URL above is enough
+
+        interval = float(start.get("interval", 5))
+        deadline = time.monotonic() + min(timeout, float(start.get("expires_in", 600)))
+        while time.monotonic() < deadline:
+            time.sleep(interval)
+            r = httpx.post(f"{_host()}/api/device/token", json={"device_code": start["device_code"], "code_verifier": verifier}, timeout=15.0)
+            if r.status_code == 200:
+                body = r.json()
+                data = self._load()
+                self._add_profile(data, body, body.get("email"))
+                for other in body.get("other_orgs") or []:
+                    self._add_profile(data, other, body.get("email"))
+                data["current"] = body["org_id"]
+                self._save(data)
+                if body.get("email"):
+                    self._save_config({"email": body["email"]})
+                return await self.get_user()
+            error = (r.json() or {}).get("error") if r.headers.get("content-type", "").startswith("application/json") else None
+            if error == "authorization_pending":
+                continue
+            if error == "slow_down":
+                interval += 5
+                continue
+            if error == "access_denied":
+                raise AuthenticationError("The sign-in was denied in the browser.")
+            raise AuthenticationError("The sign-in expired or failed. Run 'dataspring auth login' again.")
+        raise AuthenticationError("The sign-in timed out. Run 'dataspring auth login' again.")
+
+    async def store_key(self, key: str) -> "UserContext":
+        """``--key``: keep a key you already have (CI). The server says which org it is for."""
+        me = await self._me(key)
+        data = self._load()
+        self._add_profile(data, {"api_key": key, "key_id": None, "org_id": me["org_id"], "org_name": me.get("org_name")}, me.get("email"))
+        data["current"] = me["org_id"]
+        self._save(data)
+        return self._context(me)
+
+    # -- using the key ---------------------------------------------------
+
+    def get_access_token(self) -> str:
+        """The key requests carry: ``DATASPRING_API_KEY`` if set, else the current profile's.
+
+        Raises:
+            AuthenticationError: If not logged in
+        """
+        if os.environ.get(ENV_KEY):
+            return os.environ[ENV_KEY]
+        data = self._load()
+        profile = data.get("profiles", {}).get(data.get("current") or "")
+        if not profile:
+            raise AuthenticationError("Not logged in. Run 'dataspring auth login' first.")
+        return profile["api_key"]
+
+    async def _me(self, key: str) -> dict:
+        async with httpx.AsyncClient(timeout=15.0) as client:
+            r = await client.get(f"{_host()}/api/me", headers={"Authorization": f"Bearer {key}"})
+        if r.status_code == 401:
+            raise AuthenticationError("This key is unknown or revoked. Run 'dataspring auth login' again.")
+        if r.status_code == 403:
+            raise AuthenticationError(r.json().get("detail", "Access denied"))
+        if r.status_code != 200:
+            raise AuthenticationError(f"Failed to resolve user context (HTTP {r.status_code})")
+        return r.json()
+
+    @staticmethod
+    def _context(me: dict) -> "UserContext":
+        org_id = me.get("org_id")
+        return UserContext(uid=me["uid"], email=me.get("email") or "", org_id=org_id,
+                           org_name=me.get("org_name") or org_id, role=me.get("org_role"))
+
+    async def get_user(self) -> "UserContext":
+        """The person and the key's org, as ``GET /api/me`` reports them."""
+        return self._context(await self._me(self.get_access_token()))
+
+    async def logout(self):
+        """Revoke every stored key on the server, then forget them."""
+        for profile in self.profiles().values():
+            if not profile.get("key_id"):
+                continue  # a --key key: not ours to revoke, just forgotten
+            try:
+                httpx.delete(f"{_host()}/api/keys/{profile['key_id']}",
+                             headers={"Authorization": f"Bearer {profile['api_key']}"}, timeout=10.0)
+            except httpx.HTTPError:
+                pass  # offline: revoke it from /api/keys later
+        if self.CREDENTIALS_FILE.exists():
+            self.CREDENTIALS_FILE.unlink()
+        if self.CONFIG_FILE.exists():
+            self.CONFIG_FILE.unlink()
+
+    def is_logged_in(self) -> bool:
+        if os.environ.get(ENV_KEY):
+            return True
+        data = self._load()
+        return bool(data.get("profiles", {}).get(data.get("current") or ""))
+
+    def get_stored_email(self) -> str | None:
+        """Get stored email from config (doesn't validate the key)."""
+        return self._load_config().get("email")
+
+    def _save_config(self, data: dict):
+        """Save config data (non-sensitive)."""
+        existing = {}
+        if self.CONFIG_FILE.exists():
+            try:
+                existing = json.loads(self.CONFIG_FILE.read_text())
+            except json.JSONDecodeError:
+                pass
+        existing.update(data)
+        self.CONFIG_FILE.write_text(json.dumps(existing, indent=2))
+
+    def _load_config(self) -> dict:
+        """Load config data."""
+        if not self.CONFIG_FILE.exists():
+            return {}
+        try:
+            return json.loads(self.CONFIG_FILE.read_text())
+        except json.JSONDecodeError:
+            return {}
+
+
+# Global auth manager instance
+auth_manager = CLIAuthManager()

{dataspring_cli-0.3.0 → dataspring_cli-0.4.1}/cli/bundled_manifest.py

@@ -6,17 +6,14 @@ the server's to say whether the server has operations this CLI does not
 know. tests/test_skills_surface.py asserts it is current.
 """
 
-MANIFEST_HASH = "76c44516f0729b5b4c1d4b8f17ebd7a3ffbd63b94dae6308c740a4af62db1811"
+MANIFEST_HASH = "eacbe5d755f415a814b50b568eb105ff60693b92fe1ce44d30e39f71670d15d0"
 TOOL_KEYS = (
-    "dashboard_edit",
-    "widget_edit",
-    "page_edit",
-    "section_edit",
     "business_context_edit",
     "semantic_model_edit",
     "metric_edit",
     "quick_metric_edit",
-    "report_edit",
+    "briefing_edit",
+    "verify_numbers",
     "learned_edit",
     "verified_query_edit",
     "warehouse_edit",
@@ -25,12 +22,13 @@ TOOL_KEYS = (
     "update_context",
     "export_data",
     "import_manifest",
-    "render_dashboard",
-    "render_widget",
-    "switch_organization",
     "submit_error_report",
     "secret_edit",
     "run_sql",
     "datacore_edit",
     "datacore_run",
+    "tenant_edit",
+    "board_edit",
+    "board_fetch",
+    "watch_edit",
 )