datex-studio-cli 0.4.18__tar.gz → 0.4.19__tar.gz

{datex_studio_cli-0.4.18 → datex_studio_cli-0.4.19}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: datex-studio-cli
-Version: 0.4.18
+Version: 0.4.19
 Summary: CLI for Datex Studio low-code platform, designed for LLM-based AI agents
 Project-URL: Homepage, https://github.com/datex/datex-studio-cli
 Project-URL: Documentation, https://github.com/datex/datex-studio-cli

{datex_studio_cli-0.4.18 → datex_studio_cli-0.4.19}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "datex-studio-cli"
-version = "0.4.18"
+version = "0.4.19"
 description = "CLI for Datex Studio low-code platform, designed for LLM-based AI agents"
 readme = "README.md"
 license = "MIT"

{datex_studio_cli-0.4.18 → datex_studio_cli-0.4.19}/src/dxs/__init__.py

@@ -1,4 +1,4 @@
 """Datex Studio CLI - Command-line interface for Datex Studio platform."""
 
-__version__ = "0.4.18"
+__version__ = "0.4.19"
 __app_name__ = "dxs"

{datex_studio_cli-0.4.18 → datex_studio_cli-0.4.19}/src/dxs/commands/auth.py

@@ -16,6 +16,7 @@ from dxs.core.auth.datex_tenant import (
 )
 from dxs.core.auth.decorators import get_access_token
 from dxs.core.auth.tenants import (
+    identity_needs_tenant_authority,
     is_foreign_tenant,
     is_home_tenant,
     org_needs_tenant_login,
@@ -148,9 +149,12 @@ def run_standard_device_login(
         external_entra_id_domain_name=domain if external else None,
     )
     # Capture the stored key NOW; update_identity_org_info must not change the key
-    # out from under us, and the computed key depends on org name (unknown until
-    # discovery on the external-discover path).
-    identity_key = saved_identity.identity_key
+    # out from under us, and the computed key changes once discovery fills in the
+    # org name on the external-discover path. Resolve rather than recompute: a
+    # legacy bare-keyed record for the same account+tenant is updated in place,
+    # so the stored key can be the bare username while the computed key is
+    # username#tenant.
+    identity_key = cache.resolve_stored_key(saved_identity) or saved_identity.identity_key
 
     if organization_id is None:
         org_info = _fetch_organization_info(ctx, base_url=api_base_url)
@@ -487,8 +491,29 @@ def logout(ctx: DxsContext, identity: str | None, logout_all: bool) -> None:
         return
 
     if identity:
-        # Logout specific identity
+        # Logout specific identity. Resolve a bare username to its storage key
+        # (external identities live under username#org / username#tenant_id);
+        # several matches means the selector is ambiguous — never guess which
+        # identity to remove.
+        storage_key = identity
         existing = cache.get_identity(identity)
+        if not existing:
+            matches = cache.find_identity_keys_by_username(identity)
+            if len(matches) > 1:
+                ctx.output_error(
+                    AuthenticationError(
+                        message=f"'{identity}' matches more than one identity.",
+                        code="DXS-AUTH-011",
+                        suggestions=[
+                            "Pass one of these exact identities to 'dxs auth logout':",
+                            *matches,
+                        ],
+                    )
+                )
+                raise SystemExit(1)
+            if matches:
+                storage_key = matches[0]
+                existing = cache.get_identity(storage_key)
         if not existing:
             ctx.output(
                 single(
@@ -503,7 +528,7 @@ def logout(ctx: DxsContext, identity: str | None, logout_all: bool) -> None:
             return
 
         was_active = cache.get_active_identity() == existing
-        cache.remove_identity(identity)
+        cache.remove_identity(storage_key)
 
         remaining = cache.list_identities()
         ctx.output(
@@ -538,7 +563,9 @@ def logout(ctx: DxsContext, identity: str | None, logout_all: bool) -> None:
         return
 
     account_name = active.account_username
-    cache.remove_identity(account_name or "")
+    # Remove by the real storage key — external identities are not stored
+    # under the bare username.
+    cache.remove_identity(cache.resolve_stored_key(active) or account_name or "")
 
     remaining = cache.list_identities()
     ctx.output(
@@ -1230,8 +1257,30 @@ def _switch_by_username(
     """Switch to an identity by username (original behavior)."""
     cache = MultiIdentityTokenCache()
 
-    # Check if identity exists
+    # Check if identity exists. External identities are stored under
+    # disambiguated keys (username#org, username#tenant_id), so a bare
+    # username that is not itself a storage key still resolves when it
+    # matches exactly one identity. Matching several is the same-UPN
+    # multi-tenant case: refuse to guess and list the candidates.
+    storage_key = username
     existing = cache.get_identity(username)
+    if not existing:
+        matches = cache.find_identity_keys_by_username(username)
+        if len(matches) > 1:
+            ctx.output_error(
+                AuthenticationError(
+                    message=f"'{username}' matches more than one identity.",
+                    code="DXS-AUTH-011",
+                    suggestions=[
+                        "Pass one of these exact identities to 'dxs auth switch':",
+                        *matches,
+                    ],
+                )
+            )
+            raise SystemExit(1)
+        if matches:
+            storage_key = matches[0]
+            existing = cache.get_identity(storage_key)
     if not existing:
         # List available identities for suggestion
         available = cache.list_identities()
@@ -1254,7 +1303,7 @@ def _switch_by_username(
     # Check if token is expired
     if existing.is_expired():
         # Try to refresh
-        refreshed = cache.try_refresh_identity(username)
+        refreshed = cache.try_refresh_identity(storage_key)
         if not refreshed:
             ctx.output_error(
                 AuthenticationError(
@@ -1271,7 +1320,7 @@ def _switch_by_username(
 
     # Switch to the new identity
     try:
-        new_identity = cache.set_active_identity(username)
+        new_identity = cache.set_active_identity(storage_key)
     except KeyError:
         ctx.output_error(
             AuthenticationError(
@@ -1283,7 +1332,7 @@ def _switch_by_username(
 
     # Persist daemon credentials on the identity if supplied
     if client_id and client_secret:
-        updated = cache.update_identity_daemon_creds(username, client_id, client_secret)
+        updated = cache.update_identity_daemon_creds(storage_key, client_id, client_secret)
         if updated is not None:
             new_identity = updated
 
@@ -1291,7 +1340,7 @@ def _switch_by_username(
         "status": "switched",
         "message": f"Switched to {username}",
         "previous_identity": previous_username,
-        "active_identity": username,
+        "active_identity": storage_key,
         "organization": new_identity.organization_name,
         "organization_id": new_identity.organization_id,
     }
@@ -1343,19 +1392,30 @@ def _switch_by_organization(
 
     # Step 3: Check whether this org lives in a tenant of its own
     if not org_needs_tenant_login(org_info):
-        # Home-tenant org (Datex): the current identity already covers it.
-        ctx.output(
-            single(
-                item={
-                    "status": "no_action_required",
-                    "message": f"Organization '{org_name}' authenticates against the Datex home tenant",
-                    "organization": org_info.name,
-                    "organization_id": org_info.id,
-                    "suggestion": "Your current identity should work with this organization",
-                },
-                semantic_key="authentication",
+        # No device login is needed — but "no login" is not "no action".
+        if org_info.external_entra_id:
+            # Flagged external yet resolving to no foreign tenant: a
+            # misregistered org record must never capture the caller's
+            # identity (see _handled_home_tenant_external_org).
+            if _handled_home_tenant_external_org(ctx, org_info):
+                return
+            ctx.output_error(
+                AuthenticationError(
+                    message=(
+                        f"Organization '{org_name}' requires external authentication "
+                        "but has no tenant ID configured"
+                    ),
+                    code="DXS-AUTH-012",
+                    suggestions=[
+                        "Contact your organization administrator to configure the tenant ID"
+                    ],
+                )
             )
-        )
+            raise SystemExit(1)
+        # Home-tenant org (Datex, or an org with no tenant of its own): the
+        # current identity's tokens already cover it, but the org binding on
+        # the cached identity must still be re-pointed at the requested org.
+        _rebind_home_tenant_identity(ctx, cache, org_info)
         return
 
     # Step 4: Reject a misregistered home-tenant org BEFORE any identity lookup —
@@ -1368,9 +1428,14 @@ def _switch_by_organization(
     if org_info.tenant_id:
         existing_by_tenant = cache.get_identity_by_tenant(org_info.tenant_id)
         if existing_by_tenant and existing_by_tenant.account_username:
-            # Update org info and activate
+            # Update org info and activate. Resolve the real storage key: a
+            # self-service identity is stored under username#tenant_id (legacy
+            # files: the bare username), never looked up by bare username alone.
+            tenant_storage_key = (
+                cache.resolve_stored_key(existing_by_tenant) or existing_by_tenant.account_username
+            )
             cache.update_identity_org_info(
-                existing_by_tenant.account_username,
+                tenant_storage_key,
                 org_info.id,
                 org_info.name,
             )
@@ -1410,10 +1475,11 @@ def _activate_existing_identity(
 ) -> None:
     """Activate an existing cached identity."""
     # The identity's computed identity_key can diverge from its actual storage
-    # key: a customer external identity is stored under the bare username (org
-    # name unknown at save time), then discovery sets the org name, which makes
-    # identity_key recompute to username#org while the stored key stays bare.
-    # Resolve the real storage key for all cache operations.
+    # key: a customer external identity is stored under username#tenant_id
+    # (legacy files: the bare username) because the org name is unknown at save
+    # time; discovery then sets the org name, which makes identity_key recompute
+    # to username#org while the stored key never changes. Resolve the real
+    # storage key for all cache operations.
     storage_key = cache.resolve_stored_key(identity) or identity.identity_key
 
     # Check if token is expired
@@ -1481,6 +1547,96 @@ def _fetch_organization_by_name(ctx: DxsContext, org_name: str) -> Any:
         return None
 
 
+def _rebind_home_tenant_identity(
+    ctx: DxsContext,
+    cache: MultiIdentityTokenCache,
+    org_info: Any,
+) -> None:
+    """Re-point the active home-tenant identity at ``org_info`` (issue #112).
+
+    A home-tenant org needs no device login, but "no login required" never
+    meant "no action required": the organization binding lives on the cached
+    identity, and the API resolves the caller's user record through it. Reads
+    against Datex-owned resources work under the old binding — which is what
+    made the silent no-op hard to spot — while writes fail with a misleading
+    ``DXS-API-400``. Only the two org fields move; tokens and the active
+    identity selection stay untouched (the issue #83 contract).
+    """
+    active = cache.get_active_identity()
+    if active is None or identity_needs_tenant_authority(active):
+        # Nothing safe to re-bind: either no identity is cached, or the active
+        # identity belongs to a foreign tenant and its tokens cannot serve a
+        # home-tenant org. Fail closed rather than claim success.
+        described = (
+            f"the active identity '{active.account_username}' belongs to another tenant"
+            if active
+            else "no identity is cached"
+        )
+        ctx.output_error(
+            AuthenticationError(
+                message=(
+                    f"Organization '{org_info.name}' authenticates against the Datex "
+                    f"home tenant, but {described}"
+                ),
+                code="DXS-AUTH-018",
+                suggestions=[
+                    "Run 'dxs auth switch <username>' to activate a home-tenant identity first",
+                    f"Or run 'dxs auth login {org_info.name}' to sign in with one",
+                ],
+            )
+        )
+        raise SystemExit(1)
+
+    already_bound = active.organization_id == org_info.id and (
+        (active.organization_name or "").lower() == org_info.name.lower()
+    )
+    if already_bound:
+        ctx.output(
+            single(
+                item={
+                    "status": "no_action_required",
+                    "message": (
+                        f"Active identity is already bound to organization '{org_info.name}'"
+                    ),
+                    "active_identity": active.account_username,
+                    "organization": org_info.name,
+                    "organization_id": org_info.id,
+                },
+                semantic_key="authentication",
+            )
+        )
+        return
+
+    storage_key = cache.resolve_stored_key(active) or active.identity_key
+    updated = cache.update_identity_org_info(storage_key, org_info.id, org_info.name)
+    if updated is None:
+        ctx.output_error(
+            AuthenticationError(
+                message=f"Identity '{storage_key}' not found",
+                code="DXS-AUTH-010",
+            )
+        )
+        raise SystemExit(1)
+
+    ctx.output(
+        single(
+            item={
+                "status": "organization_rebound",
+                "message": (
+                    f"Re-bound the active identity to organization '{org_info.name}' "
+                    "(home tenant; no login required)"
+                ),
+                "active_identity": active.account_username,
+                "organization": org_info.name,
+                "organization_id": org_info.id,
+                "previous_organization": active.organization_name,
+                "previous_organization_id": active.organization_id,
+            },
+            semantic_key="authentication",
+        )
+    )
+
+
 def _handled_home_tenant_external_org(ctx: DxsContext, org_info: Any) -> bool:
     """Report and stop when an org flagged external points at the home tenant.
 
@@ -1642,9 +1798,10 @@ def _login_to_organization(
     # First, we need to be able to call the API - check if we have any valid identity
     active = cache.get_active_identity()
     if not active or active.is_expired():
-        # Try to refresh
+        # Try to refresh (no username -> the active identity, whatever its
+        # storage key; the bare username is not the key for external identities)
         if active:
-            cache.try_refresh_identity(active.account_username)
+            cache.try_refresh_identity()
             active = cache.get_active_identity()
 
         if not active or active.is_expired():

{datex_studio_cli-0.4.18 → datex_studio_cli-0.4.19}/src/dxs/commands/branch.py

@@ -1,5 +1,6 @@
 """Branch commands: dxs branch [list|show|create|roles|shell|validate|candelete|search]."""
 
+from collections.abc import Callable
 from concurrent.futures import ThreadPoolExecutor, as_completed
 from datetime import datetime
 from typing import Any
@@ -7,7 +8,14 @@ from typing import Any
 import click
 
 from dxs.cli import DxsContext, pass_context
-from dxs.commands.validation_report import server_error_messages
+from dxs.commands.branch_commit_guard import (
+    all_changed_refs,
+    fetch_commit_preflight,
+    guarded_commit,
+    modification_bucket,
+    validate_branch_or_raise,
+    verify_config_refs,
+)
 from dxs.core.api import (
     ApiClient,
     ApplicationGroupEndpoints,
@@ -817,10 +825,13 @@ def candelete(ctx: DxsContext, branch_id: int) -> None:
 @click.argument("branch_id", type=int)
 @click.option(
     "--force",
+    "--yes",
     "-f",
+    "-y",
+    "force",
     is_flag=True,
     default=False,
-    help="Skip confirmation and delete immediately",
+    help="Skip confirmation and delete immediately (--yes/-y are aliases)",
 )
 @pass_context
 @require_auth
@@ -837,7 +848,7 @@ def delete(ctx: DxsContext, branch_id: int, force: bool) -> None:
 
     \b
     Options:
-        --force, -f  Skip confirmation prompt
+        --force, -f  Skip confirmation prompt (--yes/-y are aliases)
 
     \b
     Examples:
@@ -1362,22 +1373,7 @@ def publish(
     if not force:
         # Validate the branch first
         ctx.log(f"Validating branch {branch_id}...")
-        errors = client.post(BranchEndpoints.validate(branch_id))
-        if not isinstance(errors, list):
-            errors = [errors] if errors else []
-
-        if errors:
-            error_messages = server_error_messages(errors)
-            suggestions = error_messages[:5]
-            if len(error_messages) > 5:
-                suggestions.append(
-                    f"... and {len(error_messages) - 5} more; run 'dxs branch validate "
-                    f"{branch_id}' for the full list"
-                )
-            raise ValidationError(
-                message=f"Branch {branch_id} has validation errors",
-                suggestions=suggestions,
-            )
+        validate_branch_or_raise(client, branch_id)
 
         # Confirm publish
         if not click.confirm(
@@ -1426,6 +1422,55 @@ def publish(
     )
 
 
+def _commit_confirmation_summary(
+    branch_name: str,
+    branch_id: int,
+    selected: list[str] | None,
+    preflight: dict[str, Any],
+) -> str:
+    """Human-readable summary of what a commit is about to merge, for click.confirm."""
+
+    def _breakdown(configs: list[dict[str, Any]]) -> str:
+        tallies = {"created": 0, "updated": 0, "deleted": 0}
+        for cfg in configs:
+            bucket = modification_bucket(str(cfg.get("modificationTypeId", "")))
+            if bucket:
+                tallies[bucket] += 1
+        parts = [f"{count} {bucket}" for bucket, count in tallies.items() if count]
+        return ", ".join(parts) if parts else "no modification details"
+
+    total = preflight["counts"]["total"]
+    lines: list[str] = []
+    if selected is None:
+        lines.append(
+            f"Commit branch '{branch_name}' (ID: {branch_id}) to Main: "
+            f"all {total} changed config(s) ({_breakdown(preflight['configs'])})."
+        )
+    else:
+        selected_set = set(selected)
+        selected_configs = [
+            c for c in preflight["configs"] if c.get("referenceName") in selected_set
+        ]
+        lines.append(
+            f"Commit branch '{branch_name}' (ID: {branch_id}) to Main: "
+            f"{len(selected)} of {total} changed config(s) ({_breakdown(selected_configs)})."
+        )
+        leftovers = [r for r in preflight["changed_refs"] if r not in selected_set]
+        if leftovers:
+            lines.append(
+                f"{len(leftovers)} changed config(s) not selected will transfer to a new "
+                f"feature branch: {', '.join(leftovers)}."
+            )
+    if preflight["non_config_changes"]:
+        lines.append(
+            "Non-config changes also on this branch: "
+            + ", ".join(preflight["non_config_changes"])
+            + "."
+        )
+    lines.append("Commit to Main?")
+    return "\n".join(lines)
+
+
 @branch.command("commit")
 @click.argument("branch_id", type=int)
 @click.option("--title", "-t", required=True, help="Commit title")
@@ -1435,13 +1480,27 @@ def publish(
     "config_refs",
     multiple=True,
     help="Reference name of a changed config to commit (repeatable). "
-    "Omit with --all-changes to commit everything modified.",
+    "Use --all-changes instead to commit every modified config.",
 )
 @click.option(
     "--all-changes",
     is_flag=True,
     default=False,
-    help="Commit all modified configs on the branch.",
+    help="Commit all modified configs on the branch (their reference names are "
+    "resolved from the branch's change list and sent explicitly).",
+)
+@click.option(
+    "--force",
+    "-f",
+    is_flag=True,
+    default=False,
+    help="Skip validation and confirmation",
+)
+@click.option(
+    "--dry-run",
+    is_flag=True,
+    default=False,
+    help="Show what would be committed without mutating anything",
 )
 @pass_context
 @require_auth
@@ -1453,12 +1512,27 @@ def commit(
     description: str,
     config_refs: tuple[str, ...],
     all_changes: bool,
+    force: bool,
+    dry_run: bool,
 ) -> None:
     """Commit (merge) a feature branch into its Main branch.
 
+    Committing is irreversible, so unless --force is given the command verifies
+    the branch's organization, checks each --config ref against the branch's
+    actual changes, validates the branch server-side, and asks for confirmation
+    with a summary of what will be merged. A partial commit transfers the
+    uncommitted leftovers to a new feature branch (reported as new_branch_id).
+
+    --all-changes resolves the branch's changed configs and commits that
+    explicit list (the API requires one). It always fetches the branch's
+    change list — --force skips only validation and confirmation — and fails
+    when the branch has nothing changed.
+
     \b
     Examples:
         dxs source branch commit 3101 --title "bump Module1" -d "Re-pin Module1" --config appConfig
+        dxs source branch commit 3101 -t "release" -d "everything" --all-changes
+        dxs source branch commit 3101 -t "bump" -d "re-pin" --config appConfig --dry-run
     """
     if not config_refs and not all_changes:
         raise ValidationError(
@@ -1470,21 +1544,114 @@ def commit(
         )
 
     client = ApiClient()
-    request_data: dict[str, Any] = {"title": title, "description": description}
-    if not all_changes:
-        request_data["configs"] = list(config_refs)
 
-    ctx.log(f"Committing branch {branch_id}...")
-    result = client.post(SourceControlEndpoints.commit(branch_id), data=request_data)
+    if dry_run:
+        ctx.log(f"Fetching changes for branch {branch_id}...")
+        preflight = fetch_commit_preflight(client, branch_id)
+        if all_changes:
+            refs = all_changed_refs(preflight, branch_id)
+        else:
+            refs = list(config_refs)
+            verify_config_refs(refs, preflight["changed_refs"], branch_id)
+        item: dict[str, Any] = {
+            "dry_run": True,
+            "branch_id": branch_id,
+            "title": title,
+            "all_changes": all_changes,
+            "configs_to_commit": refs,
+            "changes": preflight["counts"],
+            "non_config_changes": preflight["non_config_changes"],
+        }
+        if not all_changes:
+            leftovers = [r for r in preflight["changed_refs"] if r not in set(refs)]
+            if leftovers:
+                item["configs_not_selected"] = leftovers
+                item["note"] = (
+                    "The configs not selected would transfer to a new feature branch "
+                    "(newBranchId in the commit result)."
+                )
+        ctx.output(single(item=item, semantic_key="commit_result"))
+        return
 
-    ctx.output(
-        single(
-            item={
-                "branch_id": branch_id,
-                "title": title,
-                "new_branch_id": (result or {}).get("newBranchId"),
-                "result": result,
-            },
-            semantic_key="commit_result",
+    # Check organization mismatch - committing to Main requires ownership
+    ctx.log(f"Fetching branch {branch_id}...")
+    branch_info = client.get(BranchEndpoints.get(branch_id))
+    branch_name = branch_info.get("name", f"Branch {branch_id}")
+    repo_id = branch_info.get("applicationDefinitionId")
+    if repo_id:
+        ctx.log("Verifying organization access...")
+        repo_info = client.get(RepoEndpoints.get(repo_id))
+        org_id = repo_info.get("organizationId")
+        org_name = (
+            repo_info.get("organization", {}).get("name") if repo_info.get("organization") else None
         )
+        if org_id:
+            verify_org_match(org_id, org_name)
+
+    selected: list[str]
+    confirm_cb: Callable[[], bool] | None = None
+    if all_changes or not force:
+        # Preflight: the commit endpoint rejects a body without configs, so
+        # --all-changes needs the branch's change list to build the explicit
+        # config list even under --force. The non-force path needs it anyway,
+        # to check --config refs against the branch's actual changes and build
+        # the confirmation summary from what the server says is modified.
+        ctx.log(f"Fetching changes for branch {branch_id}...")
+        preflight = fetch_commit_preflight(client, branch_id)
+        if all_changes:
+            selected = all_changed_refs(preflight, branch_id)
+        else:
+            selected = list(config_refs)
+            verify_config_refs(selected, preflight["changed_refs"], branch_id)
+
+        if not force:
+            prompt = _commit_confirmation_summary(
+                branch_name, branch_id, None if all_changes else selected, preflight
+            )
+
+            def _confirm() -> bool:
+                return click.confirm(prompt)
+
+            confirm_cb = _confirm
+            ctx.log(f"Validating branch {branch_id}...")
+    else:
+        selected = list(config_refs)
+
+    committed, result = guarded_commit(
+        client,
+        branch_id,
+        title=title,
+        description=description,
+        configs=selected,
+        validate=not force,
+        confirm=confirm_cb,
     )
+
+    if not committed:
+        ctx.output(
+            single(
+                item={"committed": False, "reason": "User cancelled"},
+                semantic_key="commit_result",
+                branch_id=branch_id,
+            )
+        )
+        return
+
+    result = result or {}
+    new_branch_id = result.get("newBranchId")
+    item = {
+        "committed": True,
+        "branch_id": branch_id,
+        "title": title,
+        "new_branch_id": new_branch_id,
+        "result": result,
+    }
+    if new_branch_id and result.get("transferredUncommittedChanges"):
+        note = (
+            f"Uncommitted changes were transferred to new feature branch {new_branch_id}; "
+            f"the configs not committed here continue there."
+        )
+        item["note"] = note
+        ctx.log(note)
+
+    ctx.output(single(item=item, semantic_key="commit_result"))