datex-studio-cli 0.4.11__tar.gz → 0.4.12__tar.gz

{datex_studio_cli-0.4.11 → datex_studio_cli-0.4.12}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: datex-studio-cli
-Version: 0.4.11
+Version: 0.4.12
 Summary: CLI for Datex Studio low-code platform, designed for LLM-based AI agents
 Project-URL: Homepage, https://github.com/datex/datex-studio-cli
 Project-URL: Documentation, https://github.com/datex/datex-studio-cli

{datex_studio_cli-0.4.11 → datex_studio_cli-0.4.12}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "datex-studio-cli"
-version = "0.4.11"
+version = "0.4.12"
 description = "CLI for Datex Studio low-code platform, designed for LLM-based AI agents"
 readme = "README.md"
 license = "MIT"
@@ -152,6 +152,7 @@ python_functions = ["test_*"]
 addopts = "-v --tb=short"
 markers = [
     "fidelity: cross-engine SSIM fidelity tests (require agent-browser + ARJS)",
+    "internal_commands_gated: exercise the devops/crm visibility gate (no DXS_INTERNAL_COMMANDS override)",
 ]
 
 [tool.coverage.run]

{datex_studio_cli-0.4.11 → datex_studio_cli-0.4.12}/src/dxs/__init__.py

@@ -1,4 +1,4 @@
 """Datex Studio CLI - Command-line interface for Datex Studio platform."""
 
-__version__ = "0.4.11"
+__version__ = "0.4.12"
 __app_name__ = "dxs"

{datex_studio_cli-0.4.11 → datex_studio_cli-0.4.12}/src/dxs/cli.py

@@ -8,6 +8,7 @@ import click
 
 from dxs import __app_name__, __version__
 from dxs.context import DxsContext, pass_context  # re-exported for backward compat
+from dxs.core.auth.datex_tenant import DATEX_INTERNAL_COMMANDS, internal_commands_available
 from dxs.core.output import OutputFormat, format_error
 from dxs.core.output.redaction import (
     AUTHOR_VERBOSE_FIELDS as _AUTHOR_VERBOSE_FIELDS,  # noqa: F401 — re-exported
@@ -77,7 +78,29 @@ CONTEXT_SETTINGS = {
 
 
 class DxsGroup(click.Group):
-    """Custom Group that shows global options in subcommand help."""
+    """Custom Group that shows global options in subcommand help.
+
+    Also gates the Datex-internal command groups (``devops``, ``crm``). The gate
+    is applied at lookup time rather than at registration so it reflects the
+    identity cache as of *this* invocation — registration happens once at import.
+    """
+
+    def _is_gated(self, cmd_name: str) -> bool:
+        """Whether ``cmd_name`` is Datex-internal and unavailable to this user."""
+        return cmd_name in DATEX_INTERNAL_COMMANDS and not internal_commands_available()
+
+    def list_commands(self, ctx: click.Context) -> list[str]:
+        """List visible subcommands, omitting unavailable Datex-internal groups."""
+        return [name for name in super().list_commands(ctx) if not self._is_gated(name)]
+
+    def get_command(self, ctx: click.Context, cmd_name: str) -> click.Command | None:
+        """Resolve a subcommand, refusing unavailable Datex-internal groups."""
+        if self._is_gated(cmd_name):
+            ctx.fail(
+                f"'{cmd_name}' is a Datex-internal command group and requires a "
+                "Datex tenant identity. Run 'dxs auth login' with your Datex account."
+            )
+        return super().get_command(ctx, cmd_name)
 
     def format_options(self, ctx: click.Context, formatter: click.HelpFormatter) -> None:
         """Write options to the formatter, including global options."""

{datex_studio_cli-0.4.11 → datex_studio_cli-0.4.12}/src/dxs/commands/auth.py

@@ -8,6 +8,7 @@ import click
 
 from dxs.context import DxsContext, pass_context
 from dxs.core.auth import MSALClient, MultiIdentityTokenCache
+from dxs.core.auth.datex_tenant import claims_are_datex, is_datex_identity
 from dxs.core.auth.decorators import get_access_token
 from dxs.core.auth.token_cache import CachedIdentity, get_identity_override
 from dxs.core.footprint import get_footprint_token
@@ -78,23 +79,33 @@ def run_standard_device_login(
     consent_cb = on_additional_consent_needed or _on_consent
 
     ctx.log("Initiating device code authentication...")
+    additional_scope_sets: Any
     if tenant_id is not None:
         client = MSALClient.for_tenant(tenant_id, scopes=settings.azure_scopes)
         # External tenants only need Studio API + Footprint; DevOps/CRM are not relevant.
         additional_scope_sets = [[settings.footprint_scope]]
     else:
         client = MSALClient(scopes=settings.azure_scopes)
-        additional_scope_sets = [
-            scopes
-            for scopes in [
-                settings.azure_devops_scopes,
-                settings.dynamics_crm_scopes,
-                settings.dynamics_crm_admin_scopes,
-                settings.data_export_service_scopes,
-                [settings.footprint_scope],
-            ]
-            if scopes
-        ]
+
+        def additional_scope_sets(token_response: dict[str, Any]) -> list[list[str]]:
+            """Choose consent scopes from the claims of whoever just signed in.
+
+            The home-tenant path is also what customers hit before their own
+            tenant is known, so DevOps/CRM consent is requested only for Datex
+            staff — a customer must never be prompted for Datex-internal
+            resources by name.
+            """
+            internal = (
+                [
+                    settings.azure_devops_scopes,
+                    settings.dynamics_crm_scopes,
+                    settings.dynamics_crm_admin_scopes,
+                    settings.data_export_service_scopes,
+                ]
+                if claims_are_datex(token_response.get("id_token_claims") or {})
+                else []
+            )
+            return [scopes for scopes in [*internal, [settings.footprint_scope]] if scopes]
 
     result = client.authenticate_device_code_multi_resource(
         primary_scopes=settings.azure_scopes,
@@ -638,17 +649,21 @@ def status(ctx: DxsContext) -> None:
             "name": "Datex Studio API",
             "scopes": settings.azure_scopes,
         },
-        "azure_devops": {
-            "name": "Azure DevOps API",
-            "scopes": settings.azure_devops_scopes,
-        },
     }
 
-    if settings.dynamics_crm_scopes:
-        resources["dynamics_crm"] = {
-            "name": "Dynamics CRM API",
-            "scopes": settings.dynamics_crm_scopes,
+    # DevOps and CRM are Datex-internal. Probing them with a customer identity
+    # only ever yields noise, so omit those rows entirely unless the identity
+    # being reported is a Datex one.
+    if is_datex_identity(active_identity):
+        resources["azure_devops"] = {
+            "name": "Azure DevOps API",
+            "scopes": settings.azure_devops_scopes,
         }
+        if settings.dynamics_crm_scopes:
+            resources["dynamics_crm"] = {
+                "name": "Dynamics CRM API",
+                "scopes": settings.dynamics_crm_scopes,
+            }
 
     resources["footprint"] = {
         "name": "Footprint API",

datex_studio_cli-0.4.12/src/dxs/core/auth/datex_tenant.py

@@ -0,0 +1,265 @@
+"""Datex-tenant (staff-only) identity resolution.
+
+Azure DevOps and Dynamics CRM are Datex-internal resources: they live in the
+Datex Entra tenant and only Datex staff can reach them. Two consequences drive
+this module.
+
+**Customers must never see them.** A customer authenticates either against their
+own tenant (``external_entra_id``) or, for organizations that do not require
+external auth, as a B2B guest inside the Datex tenant. Neither can use
+``dxs devops`` or ``dxs crm``, so those groups are hidden from ``--help`` and
+their token rows are omitted from ``dxs auth status``.
+
+**Staff must keep them across an identity switch.** ``dxs auth switch CAG``
+makes a customer identity active, but the cached Datex identity is still valid;
+DevOps/CRM tokens are therefore minted from *that* identity rather than from
+whichever one happens to be active. The rotated refresh token is written back
+onto the Datex identity so it stays alive while work happens elsewhere.
+"""
+
+import os
+from collections.abc import Mapping
+from typing import Any
+
+from dxs.core.auth.msal_client import MSALClient
+from dxs.core.auth.token_cache import (
+    CachedIdentity,
+    MultiIdentityTokenCache,
+    get_identity_override,
+)
+from dxs.utils.config import get_settings
+from dxs.utils.errors import AuthenticationError
+
+# Command groups that require a Datex-tenant identity.
+DATEX_INTERNAL_COMMANDS = frozenset({"crm", "devops"})
+
+# Entra stamps B2B guest UPNs with this marker (``user_theirdomain.com#EXT#@…``).
+# It is the signal that separates a customer invited into the Datex tenant from
+# an actual Datex staff member, since both carry the Datex ``tid``.
+GUEST_UPN_MARKER = "#EXT#"
+
+# Escape hatch for support and CI: force the internal command groups on or off
+# regardless of the cached identities.
+INTERNAL_COMMANDS_ENV = "DXS_INTERNAL_COMMANDS"
+
+# Pre-acquired resource tokens injected by an external host (e.g. Sidekick).
+# Their presence means the caller has already arranged internal access.
+INJECTED_RESOURCE_TOKEN_ENV = ("DXS_DEVOPS_TOKEN", "DXS_DYNAMICS_TOKEN")
+
+_TRUTHY = {"1", "true", "yes", "on"}
+_FALSY = {"0", "false", "no", "off"}
+
+
+def _home_tenant_id() -> str:
+    """The Datex tenant ID (``azure_tenant_id``, the CLI's configured home tenant)."""
+    return get_settings().azure_tenant_id
+
+
+def _is_guest_upn(username: str | None) -> bool:
+    """Whether a username is a B2B guest UPN rather than a native account."""
+    return GUEST_UPN_MARKER in (username or "").upper()
+
+
+def is_datex_identity(identity: CachedIdentity) -> bool:
+    """Whether ``identity`` is a Datex staff identity.
+
+    Requires the Datex tenant *and* a native (non-guest) account. The tenant
+    check alone is not enough: organizations with ``externalEntraId=false``
+    authenticate their users against the Datex tenant as guests, so they would
+    otherwise be mistaken for staff.
+    """
+    if identity.external_entra_id:
+        return False
+    if not identity.tenant_id or identity.tenant_id.lower() != _home_tenant_id().lower():
+        return False
+    return not _is_guest_upn(identity.account_username)
+
+
+def resolve_datex_identity(
+    cache: MultiIdentityTokenCache | None = None,
+) -> tuple[str, CachedIdentity] | None:
+    """Find the cached Datex identity, whatever identity is currently active.
+
+    Prefers the explicitly selected identity (``--tenant`` override, else the
+    persisted active one) when it is itself a Datex identity, so staff with more
+    than one Datex account keep control over which is used. Otherwise picks a
+    usable one, favouring identities that still hold a refresh token.
+
+    Args:
+        cache: Token cache to read. Defaults to the real credentials file.
+
+    Returns:
+        ``(storage_key, identity)`` for the chosen identity, or None when the
+        cache holds no Datex identity.
+    """
+    cache = cache or MultiIdentityTokenCache()
+
+    candidates = [
+        (key, identity)
+        for key, identity, _is_active in cache.list_identities()
+        if is_datex_identity(identity)
+    ]
+    if not candidates:
+        return None
+
+    selected_key = get_identity_override()
+    if selected_key is None:
+        selected_key = next(
+            (key for key, _identity, is_active in cache.list_identities() if is_active), None
+        )
+    for key, identity in candidates:
+        if key == selected_key:
+            return (key, identity)
+
+    # No selected Datex identity — prefer one that can still mint tokens.
+    candidates.sort(key=lambda c: (not bool(c[1].refresh_token), c[1].is_expired(), c[0]))
+    return candidates[0]
+
+
+def has_datex_identity(cache: MultiIdentityTokenCache | None = None) -> bool:
+    """Whether any cached identity belongs to the Datex tenant."""
+    return resolve_datex_identity(cache) is not None
+
+
+def claims_are_datex(claims: Mapping[str, Any]) -> bool:
+    """Whether a set of token claims describes a Datex staff account.
+
+    The claims equivalent of :func:`is_datex_identity`, for deciding before an
+    identity has been persisted — notably at login, where the consent prompts a
+    user sees must not mention Datex-internal resources.
+    """
+    tenant_id = claims.get("tid")
+    if not tenant_id or str(tenant_id).lower() != _home_tenant_id().lower():
+        return False
+    username = claims.get("upn") or claims.get("preferred_username") or claims.get("email")
+    return not _is_guest_upn(username)
+
+
+def _injected_identity_is_datex() -> bool | None:
+    """Classify an injected ``DXS_ACCESS_TOKEN`` from its own claims.
+
+    Returns None when no access token is injected, so the caller can fall back
+    to inspecting the credentials file.
+    """
+    token = os.environ.get("DXS_ACCESS_TOKEN")
+    if not token:
+        return None
+
+    from dxs.core.auth.decorators import _decode_jwt_payload
+
+    return claims_are_datex(_decode_jwt_payload(token) or {})
+
+
+def internal_commands_available() -> bool:
+    """Whether the Datex-internal command groups should be exposed.
+
+    Resolution order: the ``DXS_INTERNAL_COMMANDS`` override, an explicitly
+    injected resource token, the claims of an injected ``DXS_ACCESS_TOKEN``,
+    then the cached identities.
+    """
+    override = os.environ.get(INTERNAL_COMMANDS_ENV, "").strip().lower()
+    if override in _TRUTHY:
+        return True
+    if override in _FALSY:
+        return False
+
+    if any(os.environ.get(var) for var in INJECTED_RESOURCE_TOKEN_ENV):
+        return True
+
+    injected = _injected_identity_is_datex()
+    if injected is not None:
+        return injected
+
+    try:
+        return has_datex_identity()
+    except Exception:  # noqa: BLE001 - visibility must never break help rendering
+        return False
+
+
+def _no_datex_identity_error(resource: str) -> AuthenticationError:
+    """Build the 'this resource needs a Datex login' error."""
+    return AuthenticationError(
+        message=(
+            f"{resource} requires a Datex tenant identity, and none is cached. "
+            "This command group is only available to Datex staff."
+        ),
+        code="DXS-AUTH-020",
+        suggestions=[
+            "Run 'dxs auth login' with your Datex account",
+            "Your active identity does not need to change — the Datex identity is "
+            "used for this resource automatically",
+        ],
+    )
+
+
+def acquire_datex_resource_token(
+    scopes: list[str],
+    *,
+    resource: str,
+    error_code: str,
+    extra_suggestions: list[str] | None = None,
+) -> str:
+    """Mint an access token for a Datex-internal resource.
+
+    Redeems the cached Datex identity's refresh token against the Datex tenant
+    authority, independently of which identity is active, and persists the
+    rotated refresh token back onto that identity.
+
+    Args:
+        scopes: OAuth scopes for the target resource.
+        resource: Human-readable resource name, used in error messages.
+        error_code: Error code to attach when acquisition fails.
+        extra_suggestions: Additional suggestions for the failure path.
+
+    Returns:
+        An access token for ``scopes``.
+
+    Raises:
+        AuthenticationError: If no Datex identity is cached, or the refresh
+            token could not be redeemed.
+    """
+    cache = MultiIdentityTokenCache()
+    resolved = resolve_datex_identity(cache)
+    if resolved is None:
+        raise _no_datex_identity_error(resource)
+
+    identity_key, identity = resolved
+    if not identity.refresh_token:
+        raise AuthenticationError(
+            message=(
+                f"Could not acquire {resource} token: the cached Datex identity "
+                f"({identity_key}) has no refresh token."
+            ),
+            code=error_code,
+            details={"error": "no_refresh_token", "identity": identity_key},
+            suggestions=["Run 'dxs auth login' with your Datex account"],
+        )
+
+    # Datex identities are always home-tenant, so the default authority applies.
+    client = MSALClient(scopes=scopes)
+    result: dict[str, Any] = client.refresh_access_token_detailed(
+        refresh_token=identity.refresh_token, scopes=scopes
+    )
+
+    if "access_token" in result:
+        rotated = result.get("refresh_token")
+        if rotated:
+            # Keep the Datex identity alive even though it is not the active one.
+            cache.update_refresh_token(rotated, username=identity_key)
+        return str(result["access_token"])
+
+    error = result.get("error", "unknown_error")
+    error_description = result.get("error_description") or "Token acquisition failed."
+    raise AuthenticationError(
+        message=f"Could not acquire {resource} token: {error_description}",
+        code=error_code,
+        details={
+            "error": error,
+            "error_description": error_description,
+            "identity": identity_key,
+        },
+        suggestions=[
+            "Run 'dxs auth login' with your Datex account to refresh credentials",
+            *(extra_suggestions or []),
+        ],
+    )

{datex_studio_cli-0.4.11 → datex_studio_cli-0.4.12}/src/dxs/core/auth/msal_client.py

@@ -151,7 +151,9 @@ class MSALClient:
         self,
         primary_scopes: list[str],
         additional_scopes: list[str] | None = None,
-        additional_scope_sets: list[list[str]] | None = None,
+        additional_scope_sets: list[list[str]]
+        | Callable[[dict[str, Any]], list[list[str]]]
+        | None = None,
         on_device_code: Callable[[dict[str, Any]], None] | None = None,
         on_additional_consent_needed: Callable[[str, list[str]], None] | None = None,
     ) -> dict[str, Any]:
@@ -164,7 +166,11 @@ class MSALClient:
         Args:
             primary_scopes: Scopes for primary resource (e.g., Datex API)
             additional_scopes: Scopes for a single additional resource (deprecated, use additional_scope_sets)
-            additional_scope_sets: List of scope lists for multiple additional resources
+            additional_scope_sets: List of scope lists for multiple additional
+                resources, or a callable receiving the primary token response and
+                returning that list. The callable form lets the caller choose
+                which resources to request consent for based on *who* just
+                authenticated — the identity is not known until then.
             on_device_code: Callback to handle the device code response
             on_additional_consent_needed: Callback when additional consent is needed (resource_name, scopes)
 
@@ -222,7 +228,11 @@ class MSALClient:
                     details={"error": error, "error_description": error_desc},
                 )
 
-        # Build list of all additional scope sets to acquire
+        # Build list of all additional scope sets to acquire. A callable is
+        # resolved now that the primary identity's claims are known.
+        if callable(additional_scope_sets):
+            additional_scope_sets = additional_scope_sets(result)
+
         all_additional_scopes: list[list[str]] = []
         if additional_scopes:
             all_additional_scopes.append(additional_scopes)

{datex_studio_cli-0.4.11 → datex_studio_cli-0.4.12}/src/dxs/core/devops/client.py

@@ -16,14 +16,14 @@ DEVOPS_RESOURCE_ID = "499b84ac-1321-427f-aa17-267ca6975798"
 def get_devops_token() -> str:
     """Get an OAuth token for Azure DevOps API.
 
-    Uses the existing MSAL client to acquire a token with the
-    Azure DevOps user_impersonation scope.
+    Azure DevOps is a Datex-internal resource, so the token is minted from the
+    cached Datex-tenant identity rather than from whichever identity is active.
+    That keeps ``dxs devops`` working after ``dxs auth switch <customer org>``.
 
     Priority:
         0. DXS_DEVOPS_TOKEN environment variable (direct token from external auth)
         1. DXS_REFRESH_TOKEN environment variable (OBO flow)
-        2. MSAL silent acquisition (cached token)
-        3. File-based refresh token
+        2. The cached Datex identity's refresh token
 
     Returns:
         Access token for Azure DevOps API
@@ -33,8 +33,8 @@ def get_devops_token() -> str:
     """
     import os
 
+    from dxs.core.auth.datex_tenant import acquire_datex_resource_token
     from dxs.core.auth.msal_client import MSALClient
-    from dxs.core.auth.token_cache import MultiIdentityTokenCache
 
     # Priority 0: DXS_DEVOPS_TOKEN environment variable (direct token)
     # Used when an external tool (e.g., Sidekick) provides a pre-acquired DevOps token
@@ -48,13 +48,10 @@ def get_devops_token() -> str:
     if not devops_scopes:
         devops_scopes = [f"{DEVOPS_RESOURCE_ID}/user_impersonation"]
 
-    # Track the error from env token attempt for better error reporting
-    env_token_error: str | None = None
-    env_token_error_desc: str | None = None
-
     # Priority 1: DXS_REFRESH_TOKEN environment variable (OBO flow)
     env_refresh_token = os.environ.get("DXS_REFRESH_TOKEN")
     if env_refresh_token:
+        env_error: dict[str, Any]
         try:
             msal_client = MSALClient(scopes=devops_scopes)
             result = msal_client._app.acquire_token_by_refresh_token(
@@ -65,67 +62,42 @@ def get_devops_token() -> str:
                 return cast(str, result["access_token"])
             # Capture MSAL error response for reporting
             if result:
-                env_token_error = result.get("error", "unknown_error")
-                env_token_error_desc = result.get(
-                    "error_description", "OBO token acquisition failed"
-                )
+                env_error = {
+                    "error": result.get("error", "unknown_error"),
+                    "error_description": result.get(
+                        "error_description", "OBO token acquisition failed"
+                    ),
+                }
             else:
-                env_token_error = "no_result"
-                env_token_error_desc = "No response from OBO token refresh"
+                env_error = {
+                    "error": "no_result",
+                    "error_description": "No response from OBO token refresh",
+                }
         except Exception as e:
-            env_token_error = "exception"
-            env_token_error_desc = f"OBO token acquisition failed: {e}"
-
-    # Priority 2: Try to get token from MSAL silent acquisition.
-    # External-tenant identities must use their own tenant authority; the home
-    # authority returns invalid_grant for their refresh tokens.
-    cache = MultiIdentityTokenCache()
-    identity = cache.get_active_identity()
-    if identity and identity.external_entra_id and identity.tenant_id:
-        msal_client = MSALClient.for_tenant(tenant_id=identity.tenant_id, scopes=devops_scopes)
-    else:
-        msal_client = MSALClient(scopes=devops_scopes)
-    result = msal_client.acquire_token_silent()
-    if result and "access_token" in result:
-        return cast(str, result["access_token"])
-
-    # Priority 3: Try using the stored refresh token from file cache
-    if identity and identity.refresh_token:
-        try:
-            result = msal_client._app.acquire_token_by_refresh_token(
-                refresh_token=identity.refresh_token,
-                scopes=devops_scopes,
-            )
-            if result and "access_token" in result:
-                return cast(str, result["access_token"])
-
-            error = result.get("error") if result else "no_result"
-            error_desc = (
-                result.get("error_description") if result else "No response from token refresh"
-            )
-        except Exception as e:
-            error = "exception"
-            error_desc = str(e)
-    else:
-        # If env token was tried but failed, report that error instead
-        if env_token_error:
-            error = env_token_error
-            error_desc = env_token_error_desc
-        else:
-            error = "no_refresh_token"
-            error_desc = (
-                "No refresh token available (set DXS_REFRESH_TOKEN or run 'dxs auth login')"
-            )
-
-    raise AuthenticationError(
-        message=f"Could not acquire Azure DevOps token: {error_desc}",
-        code="DXS-DEVOPS-AUTH-001",
-        details={"error": error, "error_description": error_desc},
-        suggestions=[
-            "Set DXS_REFRESH_TOKEN environment variable for OBO flow",
-            "Run 'dxs auth login' to authenticate with refresh token",
-            "Ensure your account has Azure DevOps access",
-        ],
+            env_error = {
+                "error": "exception",
+                "error_description": f"OBO token acquisition failed: {e}",
+            }
+
+        # An injected refresh token is an explicit instruction about which
+        # credential to use; do not silently fall back to a cached identity.
+        raise AuthenticationError(
+            message=f"Could not acquire Azure DevOps token: {env_error['error_description']}",
+            code="DXS-DEVOPS-AUTH-001",
+            details=env_error,
+            suggestions=[
+                "Verify DXS_REFRESH_TOKEN is current and consented for Azure DevOps",
+                "Run 'dxs auth login' to authenticate with refresh token",
+                "Ensure your account has Azure DevOps access",
+            ],
+        )
+
+    # Priority 2: The cached Datex identity, whichever identity is active.
+    return acquire_datex_resource_token(
+        devops_scopes,
+        resource="Azure DevOps",
+        error_code="DXS-DEVOPS-AUTH-001",
+        extra_suggestions=["Ensure your account has Azure DevOps access"],
     )