datex-studio-cli 0.4.14__tar.gz → 0.4.16__tar.gz

{datex_studio_cli-0.4.14 → datex_studio_cli-0.4.16}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: datex-studio-cli
-Version: 0.4.14
+Version: 0.4.16
 Summary: CLI for Datex Studio low-code platform, designed for LLM-based AI agents
 Project-URL: Homepage, https://github.com/datex/datex-studio-cli
 Project-URL: Documentation, https://github.com/datex/datex-studio-cli

{datex_studio_cli-0.4.14 → datex_studio_cli-0.4.16}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "datex-studio-cli"
-version = "0.4.14"
+version = "0.4.16"
 description = "CLI for Datex Studio low-code platform, designed for LLM-based AI agents"
 readme = "README.md"
 license = "MIT"

{datex_studio_cli-0.4.14 → datex_studio_cli-0.4.16}/src/dxs/__init__.py

@@ -1,4 +1,4 @@
 """Datex Studio CLI - Command-line interface for Datex Studio platform."""
 
-__version__ = "0.4.14"
+__version__ = "0.4.16"
 __app_name__ = "dxs"

{datex_studio_cli-0.4.14 → datex_studio_cli-0.4.16}/src/dxs/commands/auth.py

@@ -15,7 +15,7 @@ from dxs.core.auth.decorators import get_access_token
 from dxs.core.auth.tenants import org_needs_tenant_login, tenant_authority_for
 from dxs.core.auth.token_cache import CachedIdentity, get_identity_override
 from dxs.core.footprint import get_footprint_token
-from dxs.utils.errors import AuthenticationError, ValidationError
+from dxs.utils.errors import AuthenticationError, DxsError, ValidationError
 from dxs.utils.responses import list_response, single
 from dxs.utils.restricted import restrict_in_restricted_mode
 
@@ -255,8 +255,12 @@ def auth() -> None:
     default=None,
     help="Footprint API app registration client secret (for daemon auth)",
 )
-@click.option("--tenant-id", default=None, help="External Entra tenant ID (customer self-service)")
-@click.option("--domain", default=None, help="External Entra domain name (display only)")
+@click.option("--tenant-id", default=None, help="Entra tenant ID (customer self-service)")
+@click.option(
+    "--domain",
+    default=None,
+    help="Entra domain (e.g. csw-wi.com) — resolves the tenant ID for you",
+)
 @pass_context
 def login(
     ctx: DxsContext,
@@ -275,8 +279,11 @@ def login(
     If you are already authenticated with a different identity, this will
     add a new identity and set it as active (use 'dxs auth switch' to change).
 
-    Optionally specify an organization name to authenticate directly against
-    an external tenant (for organizations with external B2C authentication).
+    Name an organization to authenticate against its own Entra tenant, looked up
+    from the API. On a machine with no credentials that lookup is impossible, so
+    pass --domain instead: it is resolved against Entra's public discovery
+    document and needs no prior authentication. --tenant-id does the same when
+    you already know the GUID.
 
     Use --client-id and --client-secret together to configure daemon (client
     credentials) authentication for the Footprint API, needed for cross-tenant
@@ -284,8 +291,10 @@ def login(
 
     \b
     Examples:
-        dxs auth login           # Login to default tenant
-        dxs auth login CAG       # Login to CAG's external tenant
+        dxs auth login                        # Login to default tenant
+        dxs auth login CAG                    # Login to CAG's tenant (needs an identity)
+        dxs auth login --domain csw-wi.com    # Bootstrap: no identity required
+        dxs auth login --tenant-id <guid>     # Same, when you know the GUID
         dxs auth login CAG --client-id <id> --client-secret <secret>
     """
     _reject_tenant_override(ctx, "login")
@@ -304,20 +313,33 @@ def login(
         )
         raise SystemExit(1)
 
-    if tenant_id and org:
+    if org and (tenant_id or domain):
         ctx.output_error(
             ValidationError(
-                message="Pass either an organization name or --tenant-id, not both",
+                message="Pass either an organization name or --domain/--tenant-id, not both",
                 code="DXS-AUTH-017",
                 suggestions=[
-                    "dxs auth login <org>            # Datex staff / known org",
-                    "dxs auth login --tenant-id <id> # customer self-service",
+                    "dxs auth login <org>               # Datex staff / known org",
+                    "dxs auth login --domain <domain>   # customer self-service",
+                    "dxs auth login --tenant-id <guid>  # when you know the GUID",
                 ],
             )
         )
         raise SystemExit(1)
 
-    if tenant_id:
+    if tenant_id or domain:
+        # Bootstrap path: no API lookup, so it works with an empty credentials
+        # cache. An explicit GUID wins, making the domain lookup free to skip.
+        if not tenant_id:
+            from dxs.core.auth.tenants import normalize_entra_domain, resolve_tenant_id_from_domain
+
+            try:
+                tenant_id = resolve_tenant_id_from_domain(domain)  # type: ignore[arg-type]
+            except DxsError as e:
+                ctx.output_error(e)
+                raise SystemExit(1) from None
+            # Store/display the bare domain, never the sign-in address it came from.
+            domain = normalize_entra_domain(domain)  # type: ignore[arg-type]
 
         def on_device_code_external(device_code: dict[str, Any]) -> None:
             ctx.output(
@@ -873,12 +895,12 @@ def switch(
 @click.option(
     "--tenant-id",
     default=None,
-    help="External Entra tenant ID — self-service; skips the organization lookup",
+    help="Entra tenant ID — self-service; skips the organization lookup",
 )
 @click.option(
     "--domain",
     default=None,
-    help="External Entra domain name (display only)",
+    help="Entra domain (e.g. csw-wi.com) — resolves the tenant ID for you",
 )
 @click.option("--open/--no-open", default=True, help="Open URL in browser (default: yes)")
 @pass_context
@@ -889,33 +911,46 @@ def consent(
     domain: str | None,
     open: bool,
 ) -> None:
-    """Generate admin consent URL(s) for an organization's external tenant.
+    """Generate the admin consent URL for an organization's Entra tenant.
 
-    Provide either an organization NAME (Datex staff — looked up from the API) or
-    a --tenant-id directly (customer self-service — no prior authentication needed).
+    Identify the tenant one of three ways: an organization NAME (Datex staff —
+    looked up from the API), a --domain (resolved against Entra's public
+    discovery document, no authentication needed), or a --tenant-id directly.
     """
     import webbrowser
 
+    from dxs.core.auth.tenants import normalize_entra_domain, resolve_tenant_id_from_domain
     from dxs.utils.config import get_settings
 
-    if not org and not tenant_id:
+    if not org and not tenant_id and not domain:
         ctx.output_error(
             ValidationError(
-                message="Provide an organization name or --tenant-id",
+                message="Provide an organization name, --domain, or --tenant-id",
                 code="DXS-AUTH-016",
                 suggestions=[
-                    "dxs auth consent <org>            # Datex staff (API lookup)",
-                    "dxs auth consent --tenant-id <id> # customer self-service",
+                    "dxs auth consent <org>                 # Datex staff (API lookup)",
+                    "dxs auth consent --domain <domain>     # resolves the tenant for you",
+                    "dxs auth consent --tenant-id <id>      # when you already know the GUID",
                 ],
             )
         )
         raise SystemExit(1)
 
-    if tenant_id:
-        # Self-service: use the supplied descriptor, no API lookup.
+    if tenant_id or domain:
+        # Self-service: no API lookup. An explicit GUID wins over the domain, so
+        # supplying both never costs a network round trip.
         org_name = org or "your organization"
         org_id: int | None = None
-        resolved_tenant_id = tenant_id
+        if tenant_id:
+            resolved_tenant_id = tenant_id
+        else:
+            try:
+                resolved_tenant_id = resolve_tenant_id_from_domain(domain)  # type: ignore[arg-type]
+            except DxsError as e:
+                ctx.output_error(e)
+                raise SystemExit(1) from None
+            # Display the bare domain, never the sign-in address it came from.
+            domain = normalize_entra_domain(domain)  # type: ignore[arg-type]
         resolved_domain = domain
     else:
         org_info = _fetch_organization_by_name(ctx, org)  # type: ignore[arg-type]