datex-studio-cli 0.4.13__tar.gz → 0.4.14__tar.gz

{datex_studio_cli-0.4.13 → datex_studio_cli-0.4.14}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: datex-studio-cli
-Version: 0.4.13
+Version: 0.4.14
 Summary: CLI for Datex Studio low-code platform, designed for LLM-based AI agents
 Project-URL: Homepage, https://github.com/datex/datex-studio-cli
 Project-URL: Documentation, https://github.com/datex/datex-studio-cli

{datex_studio_cli-0.4.13 → datex_studio_cli-0.4.14}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "datex-studio-cli"
-version = "0.4.13"
+version = "0.4.14"
 description = "CLI for Datex Studio low-code platform, designed for LLM-based AI agents"
 readme = "README.md"
 license = "MIT"

{datex_studio_cli-0.4.13 → datex_studio_cli-0.4.14}/src/dxs/__init__.py

@@ -1,4 +1,4 @@
 """Datex Studio CLI - Command-line interface for Datex Studio platform."""
 
-__version__ = "0.4.13"
+__version__ = "0.4.14"
 __app_name__ = "dxs"

{datex_studio_cli-0.4.13 → datex_studio_cli-0.4.14}/src/dxs/cli.py

@@ -526,6 +526,7 @@ def register_commands() -> None:
         organization,
         proxy,
         report,
+        reset,
         source,
         studio,
         user,
@@ -549,6 +550,7 @@ def register_commands() -> None:
     cli.add_command(organization.organization)
     cli.add_command(proxy.proxy)
     cli.add_command(report.report)
+    cli.add_command(reset.reset)
     cli.add_command(source.source)
     cli.add_command(studio.studio)
     cli.add_command(user.user)

{datex_studio_cli-0.4.13 → datex_studio_cli-0.4.14}/src/dxs/commands/auth.py

@@ -1,8 +1,10 @@
 """Authentication commands: dxs auth [login|logout|status|list|switch]."""
 
+import secrets
 from collections.abc import Callable
 from datetime import datetime, timedelta, timezone
 from typing import Any
+from urllib.parse import urlencode
 
 import click
 
@@ -10,6 +12,7 @@ from dxs.context import DxsContext, pass_context
 from dxs.core.auth import MSALClient, MultiIdentityTokenCache
 from dxs.core.auth.datex_tenant import claims_are_datex, is_datex_identity
 from dxs.core.auth.decorators import get_access_token
+from dxs.core.auth.tenants import org_needs_tenant_login, tenant_authority_for
 from dxs.core.auth.token_cache import CachedIdentity, get_identity_override
 from dxs.core.footprint import get_footprint_token
 from dxs.utils.errors import AuthenticationError, ValidationError
@@ -48,19 +51,27 @@ def run_standard_device_login(
     *,
     tenant_id: str | None = None,
     domain: str | None = None,
+    external_entra_id: bool | None = None,
     organization_id: int | None = None,
     organization_name: str | None = None,
     api_base_url: str | None = None,
 ) -> CachedIdentity:
     """Run the multi-resource device-code login and save the identity.
 
-    Shared by `dxs auth login`, `dxs auth switch` (external tenant) and `dxs init`.
+    Shared by `dxs auth login`, `dxs auth switch` (foreign tenant) and `dxs init`.
 
-    When ``tenant_id`` is given, authenticates against that external Entra tenant
-    (Footprint-only additional scopes) and persists the identity as external.
-    Otherwise authenticates against the configured home tenant with the full
-    additional-scope set. Org id/name are discovered from ``/organizations/mine``
-    unless ``organization_id`` is supplied (staff switch already knows them).
+    When ``tenant_id`` is given, authenticates against that Entra tenant
+    (Footprint-only additional scopes). Otherwise authenticates against the
+    configured home tenant with the full additional-scope set. Org id/name are
+    discovered from ``/organizations/mine`` unless ``organization_id`` is
+    supplied (staff switch already knows them).
+
+    ``external_entra_id`` records whether the org has a *dedicated* Entra
+    External ID tenant, and is stored verbatim rather than inferred from
+    ``tenant_id``: a customer on their own corporate tenant needs a tenant-scoped
+    login while the flag stays False. Callers that do not know the org record
+    (the ``--tenant-id`` self-service path) leave it None, and it falls back to
+    the historical "a tenant was supplied" inference.
 
     ``api_base_url`` pins the environment used for that org discovery — callers
     that target a non-default environment (e.g. ``dxs init --target qa``) must
@@ -71,7 +82,7 @@ def run_standard_device_login(
 
     cache = MultiIdentityTokenCache()
     settings = get_settings()
-    external = tenant_id is not None
+    external = (tenant_id is not None) if external_entra_id is None else external_entra_id
 
     def _on_consent(resource_name: str, scopes: list[str]) -> None:
         ctx.log(f"Additional consent needed for: {resource_name}")
@@ -636,11 +647,12 @@ def status(ctx: DxsContext) -> None:
             return f"{seconds // 3600} hours"
 
     # Check all cached tokens for each resource.
-    # External-tenant identities must be probed against their own tenant authority;
+    # Foreign-tenant identities must be probed against their own tenant authority;
     # redeeming their refresh token against the default tenant returns invalid_grant.
     settings = get_settings()
-    if active_identity.external_entra_id and active_identity.tenant_id:
-        client = MSALClient.for_tenant(active_identity.tenant_id)
+    foreign_tenant = tenant_authority_for(active_identity)
+    if foreign_tenant:
+        client = MSALClient.for_tenant(foreign_tenant)
     else:
         client = MSALClient()
 
@@ -920,15 +932,15 @@ def consent(
                 )
             )
             raise SystemExit(1)
-        if not org_info.external_entra_id:
+        if not org_needs_tenant_login(org_info):
             ctx.output(
                 single(
                     item={
                         "status": "not_required",
-                        "message": f"Organization '{org}' does not use external authentication",
+                        "message": f"Organization '{org}' authenticates against the Datex home tenant",
                         "organization": org_info.name,
                         "organization_id": org_info.id,
-                        "note": "Admin consent is only required for organizations with external Entra ID tenants",
+                        "note": "Admin consent is only required for organizations with their own Entra tenant",
                     },
                     semantic_key="consent",
                 )
@@ -951,38 +963,49 @@ def consent(
         resolved_domain = org_info.external_entra_id_domain_name
 
     settings = get_settings()
-    base_consent = f"https://login.microsoftonline.com/{resolved_tenant_id}/adminconsent"
-    datex_consent_url = f"{base_consent}?client_id={settings.azure_client_id}"
-    fp_scope = settings.footprint_scope
-    fp_client_id = fp_scope.split("://")[1].split("/")[0] if "://" in fp_scope else None
-    footprint_consent_url = f"{base_consent}?client_id={fp_client_id}" if fp_client_id else None
+    redirect_uri = settings.azure_consent_redirect_uri
+    # Traceability rather than CSRF: nothing in the CLI receives the redirect, so
+    # there is no state to validate against. It lets staff correlate an admin's
+    # "I approved it" with the request they sent.
+    state = f"dxs-{secrets.token_urlsafe(12)}"
+
+    # Only the CLI app needs per-tenant admin consent. The Footprint API app is
+    # consented during customer onboarding in every case, and being a resource app
+    # it has no reply address — its consent URL could only ever fail with
+    # AADSTS500113 before reaching a consent screen.
+    query = urlencode(
+        {
+            "client_id": settings.azure_client_id,
+            "redirect_uri": redirect_uri,
+            "state": state,
+        }
+    )
+    consent_url = f"https://login.microsoftonline.com/{resolved_tenant_id}/adminconsent?{query}"
 
     consent_apps = [
         {
-            "name": "Datex Studio API",
+            "name": "Datex Studio CLI",
             "client_id": settings.azure_client_id,
-            "url": datex_consent_url,
+            "url": consent_url,
         },
     ]
-    if footprint_consent_url and fp_client_id:
-        consent_apps.append(
-            {"name": "Footprint API", "client_id": fp_client_id, "url": footprint_consent_url}
-        )
 
     if open:
         ctx.output(
             single(
                 item={
                     "status": "opening_browser",
-                    "message": f"Opening admin consent pages for {org_name}",
+                    "message": f"Opening the admin consent page for {org_name}",
                     "organization": org_name,
                     "organization_id": org_id,
                     "tenant_id": resolved_tenant_id,
                     "domain": resolved_domain,
+                    "redirect_uri": redirect_uri,
+                    "state": state,
                     "consent_apps": consent_apps,
                     "instructions": (
-                        "A tenant admin must complete the consent flow for BOTH apps. "
-                        "Two browser tabs will open -- approve each one."
+                        "A tenant admin must complete the consent flow. A browser tab "
+                        "will open -- approve it."
                     ),
                 },
                 semantic_key="consent",
@@ -995,15 +1018,18 @@ def consent(
             single(
                 item={
                     "status": "url_generated",
-                    "message": f"Admin consent URLs for {org_name}",
+                    "message": f"Admin consent URL for {org_name}",
                     "organization": org_name,
                     "organization_id": org_id,
                     "tenant_id": resolved_tenant_id,
                     "domain": resolved_domain,
+                    "redirect_uri": redirect_uri,
+                    "state": state,
                     "consent_apps": consent_apps,
                     "instructions": (
-                        "Have a tenant admin open BOTH URLs to grant consent. "
-                        "Both apps must be approved for full CLI functionality."
+                        "Have a tenant admin open this URL and approve it. "
+                        "After approving, the browser lands on a Microsoft page carrying "
+                        "this state value -- that is success, not an error."
                     ),
                 },
                 semantic_key="consent",
@@ -1268,14 +1294,14 @@ def _switch_by_organization(
         )
         raise SystemExit(1)
 
-    # Step 3: Check if external authentication is required
-    if not org_info.external_entra_id:
-        # No external auth needed - provide informative message
+    # Step 3: Check whether this org lives in a tenant of its own
+    if not org_needs_tenant_login(org_info):
+        # Home-tenant org (Datex): the current identity already covers it.
         ctx.output(
             single(
                 item={
                     "status": "no_action_required",
-                    "message": f"Organization '{org_name}' does not require external authentication",
+                    "message": f"Organization '{org_name}' authenticates against the Datex home tenant",
                     "organization": org_info.name,
                     "organization_id": org_info.id,
                     "suggestion": "Your current identity should work with this organization",
@@ -1285,7 +1311,7 @@ def _switch_by_organization(
         )
         return
 
-    # Step 4: External auth required - check if we have identity for that tenant
+    # Step 4: Tenant login required - check if we have identity for that tenant
     if org_info.tenant_id:
         existing_by_tenant = cache.get_identity_by_tenant(org_info.tenant_id)
         if existing_by_tenant and existing_by_tenant.account_username:
@@ -1457,6 +1483,7 @@ def _authenticate_external_tenant(
             on_additional_consent_needed=on_additional_consent_needed,
             tenant_id=org_info.tenant_id,
             domain=org_info.external_entra_id_domain_name,
+            external_entra_id=org_info.external_entra_id,
             organization_id=org_info.id,
             organization_name=org_info.name,
         )
@@ -1553,13 +1580,13 @@ def _login_to_organization(
         )
         raise SystemExit(1)
 
-    # Check if external authentication is required
-    if not org_info.external_entra_id:
+    # Check whether this org lives in a tenant of its own
+    if not org_needs_tenant_login(org_info):
         ctx.output(
             single(
                 item={
                     "status": "no_external_auth",
-                    "message": f"Organization '{org_name}' does not use external authentication",
+                    "message": f"Organization '{org_name}' authenticates against the Datex home tenant",
                     "organization": org_info.name,
                     "organization_id": org_info.id,
                     "suggestion": "Your current identity can access this organization directly",
@@ -1569,7 +1596,7 @@ def _login_to_organization(
         )
         return
 
-    # External auth required - authenticate against external tenant
+    # Tenant login required - authenticate against the org's own tenant
     if not org_info.tenant_id:
         ctx.output_error(
             AuthenticationError(