datex-studio-cli 0.4.10__tar.gz → 0.4.12__tar.gz

{datex_studio_cli-0.4.10 → datex_studio_cli-0.4.12}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: datex-studio-cli
-Version: 0.4.10
+Version: 0.4.12
 Summary: CLI for Datex Studio low-code platform, designed for LLM-based AI agents
 Project-URL: Homepage, https://github.com/datex/datex-studio-cli
 Project-URL: Documentation, https://github.com/datex/datex-studio-cli

{datex_studio_cli-0.4.10 → datex_studio_cli-0.4.12}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "datex-studio-cli"
-version = "0.4.10"
+version = "0.4.12"
 description = "CLI for Datex Studio low-code platform, designed for LLM-based AI agents"
 readme = "README.md"
 license = "MIT"
@@ -152,6 +152,7 @@ python_functions = ["test_*"]
 addopts = "-v --tb=short"
 markers = [
     "fidelity: cross-engine SSIM fidelity tests (require agent-browser + ARJS)",
+    "internal_commands_gated: exercise the devops/crm visibility gate (no DXS_INTERNAL_COMMANDS override)",
 ]
 
 [tool.coverage.run]

{datex_studio_cli-0.4.10 → datex_studio_cli-0.4.12}/src/dxs/__init__.py

@@ -1,4 +1,4 @@
 """Datex Studio CLI - Command-line interface for Datex Studio platform."""
 
-__version__ = "0.4.10"
+__version__ = "0.4.12"
 __app_name__ = "dxs"

{datex_studio_cli-0.4.10 → datex_studio_cli-0.4.12}/src/dxs/cli.py

@@ -8,6 +8,7 @@ import click
 
 from dxs import __app_name__, __version__
 from dxs.context import DxsContext, pass_context  # re-exported for backward compat
+from dxs.core.auth.datex_tenant import DATEX_INTERNAL_COMMANDS, internal_commands_available
 from dxs.core.output import OutputFormat, format_error
 from dxs.core.output.redaction import (
     AUTHOR_VERBOSE_FIELDS as _AUTHOR_VERBOSE_FIELDS,  # noqa: F401 — re-exported
@@ -16,7 +17,7 @@ from dxs.core.output.redaction import (
     _redact_secrets,  # noqa: F401 — re-exported
     _strip_concise,  # noqa: F401 — re-exported
 )
-from dxs.utils.config import get_settings
+from dxs.utils.config import get_settings, resolve_target_url
 from dxs.utils.errors import DxsError
 
 # Re-export so that existing `from dxs.cli import DxsContext, pass_context` still works
@@ -77,7 +78,29 @@ CONTEXT_SETTINGS = {
 
 
 class DxsGroup(click.Group):
-    """Custom Group that shows global options in subcommand help."""
+    """Custom Group that shows global options in subcommand help.
+
+    Also gates the Datex-internal command groups (``devops``, ``crm``). The gate
+    is applied at lookup time rather than at registration so it reflects the
+    identity cache as of *this* invocation — registration happens once at import.
+    """
+
+    def _is_gated(self, cmd_name: str) -> bool:
+        """Whether ``cmd_name`` is Datex-internal and unavailable to this user."""
+        return cmd_name in DATEX_INTERNAL_COMMANDS and not internal_commands_available()
+
+    def list_commands(self, ctx: click.Context) -> list[str]:
+        """List visible subcommands, omitting unavailable Datex-internal groups."""
+        return [name for name in super().list_commands(ctx) if not self._is_gated(name)]
+
+    def get_command(self, ctx: click.Context, cmd_name: str) -> click.Command | None:
+        """Resolve a subcommand, refusing unavailable Datex-internal groups."""
+        if self._is_gated(cmd_name):
+            ctx.fail(
+                f"'{cmd_name}' is a Datex-internal command group and requires a "
+                "Datex tenant identity. Run 'dxs auth login' with your Datex account."
+            )
+        return super().get_command(ctx, cmd_name)
 
     def format_options(self, ctx: click.Context, formatter: click.HelpFormatter) -> None:
         """Write options to the formatter, including global options."""
@@ -104,6 +127,33 @@ class DxsGroup(click.Group):
                         formatter.write_dl(global_opts)
 
 
+def _apply_tenant_override(tenant: str) -> None:
+    """Resolve a --tenant selector and pin identity resolution to it.
+
+    Raises:
+        AuthenticationError: If DXS_ACCESS_TOKEN is set (that token bypasses
+            identity resolution, so --tenant could not take effect), or if the
+            selector does not resolve to exactly one stored identity.
+    """
+    import os
+
+    from dxs.core.auth.token_cache import MultiIdentityTokenCache, set_identity_override
+    from dxs.utils.errors import AuthenticationError
+
+    if os.environ.get("DXS_ACCESS_TOKEN"):
+        raise AuthenticationError(
+            message="--tenant cannot be used while DXS_ACCESS_TOKEN is set.",
+            code="DXS-AUTH-012",
+            suggestions=[
+                "DXS_ACCESS_TOKEN is used verbatim and already fixes the identity",
+                "Unset DXS_ACCESS_TOKEN to select a stored identity with --tenant",
+            ],
+        )
+
+    cache = MultiIdentityTokenCache()
+    set_identity_override(cache.resolve_selector(tenant))
+
+
 @click.group(cls=DxsGroup, context_settings=CONTEXT_SETTINGS)
 @click.version_option(version=__version__, prog_name=__app_name__)
 @click.option(
@@ -142,6 +192,14 @@ class DxsGroup(click.Group):
     default=None,
     help="API target environment (dev, qa, or prod; default: prod)",
 )
+@click.option(
+    "--tenant",
+    type=str,
+    envvar="DXS_TENANT",
+    default=None,
+    help="Run as a specific logged-in identity for this command only "
+    "(org name, Entra domain, tenant ID, or username). See 'dxs auth list'.",
+)
 @click.option(
     "-O",
     "--output",
@@ -215,6 +273,7 @@ def cli(
     branch: int | None,
     repo: int | None,
     target: str | None,
+    tenant: str | None,
     output_format: str | None,
     verbose: bool,
     quiet: bool,
@@ -232,10 +291,12 @@ def cli(
 
     \b
     Examples:
+        dxs init
         dxs auth login
         dxs source log --repo 10
         dxs source history userGrid --branch 100
         dxs config list
+        dxs --tenant MGD schema entities        # run one command as another identity
 
     \b
     Environment Variables:
@@ -244,6 +305,7 @@ def cli(
         DXS_BRANCH      Default branch ID
         DXS_REPO        Default repository ID
         DXS_TARGET      API target environment (dev, qa, prod)
+        DXS_TENANT      Identity to run as (see --tenant)
 
     \b
     Configuration:
@@ -258,12 +320,7 @@ def cli(
 
     # Set API base URL based on target environment
     if target:
-        target_urls = {
-            "dev": "https://dev.wavelength.host/api",
-            "qa": "https://qa.wavelength.host/api",
-            "prod": "https://wavelength.host/api",
-        }
-        os.environ["DXS_API_BASE_URL"] = target_urls[target.lower()]
+        os.environ["DXS_API_BASE_URL"] = resolve_target_url(target)
 
     # Load settings
     settings = get_settings()
@@ -288,6 +345,17 @@ def cli(
         dxs_ctx.output_format = OutputFormat(settings.default_output_format.lower())
     set_last_output_format(dxs_ctx.output_format)
 
+    # Pin identity resolution for this invocation only (never persisted).
+    # Deliberately after output-format resolution so a bad selector renders as
+    # a normal error envelope rather than a bare traceback.
+    if tenant:
+        try:
+            _apply_tenant_override(tenant)
+        except DxsError as e:
+            dxs_ctx.output_error(e)
+            ctx.exit(1)
+        dxs_ctx.tenant = tenant
+
     # Set verbosity (--verbose enables debug output, --quiet suppresses progress)
     dxs_ctx.verbose = verbose
     if quiet_src == click.core.ParameterSource.COMMANDLINE:
@@ -428,6 +496,7 @@ def register_commands() -> None:
         endpoint,
         env,
         function,
+        init,
         marketplace,
         odata,
         organization,
@@ -440,6 +509,7 @@ def register_commands() -> None:
 
     cli.add_command(api.api)
     cli.add_command(auth.auth)
+    cli.add_command(init.init)
     cli.add_command(config.config)
     cli.add_command(config.config, name="settings")
     cli.add_command(configuration.configuration)