datex-studio-cli 0.4.19__tar.gz → 0.4.20__tar.gz

{datex_studio_cli-0.4.19 → datex_studio_cli-0.4.20}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: datex-studio-cli
-Version: 0.4.19
+Version: 0.4.20
 Summary: CLI for Datex Studio low-code platform, designed for LLM-based AI agents
 Project-URL: Homepage, https://github.com/datex/datex-studio-cli
 Project-URL: Documentation, https://github.com/datex/datex-studio-cli

{datex_studio_cli-0.4.19 → datex_studio_cli-0.4.20}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "datex-studio-cli"
-version = "0.4.19"
+version = "0.4.20"
 description = "CLI for Datex Studio low-code platform, designed for LLM-based AI agents"
 readme = "README.md"
 license = "MIT"

{datex_studio_cli-0.4.19 → datex_studio_cli-0.4.20}/src/dxs/__init__.py

@@ -1,4 +1,4 @@
 """Datex Studio CLI - Command-line interface for Datex Studio platform."""
 
-__version__ = "0.4.19"
+__version__ = "0.4.20"
 __app_name__ = "dxs"

{datex_studio_cli-0.4.19 → datex_studio_cli-0.4.20}/src/dxs/commands/auth.py

@@ -15,6 +15,7 @@ from dxs.core.auth.datex_tenant import (
     is_datex_identity,
 )
 from dxs.core.auth.decorators import get_access_token
+from dxs.core.auth.msal_client import ConsentOutcome
 from dxs.core.auth.tenants import (
     identity_needs_tenant_authority,
     is_foreign_tenant,
@@ -51,6 +52,117 @@ def _reject_tenant_override(ctx: DxsContext, command: str) -> None:
         raise SystemExit(1)
 
 
+def consent_failure_items(outcomes: list[ConsentOutcome] | None) -> list[dict[str, Any]]:
+    """Map failed consent rounds to payload entries (empty when all succeeded).
+
+    AADSTS650057 means the resource is not listed on the CLI app registration —
+    no amount of retrying or user consent can fix that, so it carries an
+    explicit escalation suggestion (issue #135).
+    """
+    items: list[dict[str, Any]] = []
+    for outcome in outcomes or []:
+        if outcome.ok:
+            continue
+        entry: dict[str, Any] = {
+            "resource": outcome.resource,
+            "error": outcome.error,
+            "error_description": outcome.error_description,
+        }
+        if outcome.aadsts_code == "650057":
+            entry["suggestion"] = (
+                "This resource is not listed on the CLI app registration, so consent "
+                "cannot be requested for it — ask an Entra admin to grant tenant-wide "
+                "consent for the resource to the Datex Studio CLI app."
+            )
+        items.append(entry)
+    return items
+
+
+def _run_targeted_consent(ctx: DxsContext, resource_key: str) -> None:
+    """(Re)consent one Datex-internal resource without a full re-login.
+
+    Backs ``dxs auth login --consent devops|crm`` — the recovery path for a
+    user whose login-time consent round was skipped or silently failed
+    (issue #136). Uses the cached Datex identity; the consent round requests
+    the *named* scope so dynamic user consent applies (issue #135).
+    """
+    from dxs.core.auth.datex_tenant import consent_datex_resource
+    from dxs.utils.config import get_settings
+
+    settings = get_settings()
+    if resource_key == "devops":
+        resource = "Azure DevOps"
+        consent_scopes = settings.azure_devops_scopes
+        acquire_scopes = settings.azure_devops_scopes
+        error_code = "DXS-DEVOPS-AUTH-001"
+    else:
+        if not settings.dynamics_crm_url:
+            ctx.output_error(
+                ValidationError(
+                    message=(
+                        "dynamics_crm_url is not configured; there is no Dynamics CRM "
+                        "resource to consent to."
+                    ),
+                    code="DXS-DYNAMICS-CONFIG-001",
+                    suggestions=[
+                        "Run: dxs config set dynamics_crm_url https://yourorg.crm.dynamics.com",
+                        "Then re-run: dxs auth login --consent crm",
+                    ],
+                )
+            )
+            raise SystemExit(1)
+        resource = "Dynamics CRM"
+        consent_scopes = settings.dynamics_crm_consent_scopes
+        acquire_scopes = settings.dynamics_crm_scopes
+        error_code = "DXS-DYNAMICS-AUTH-001"
+
+    def on_device_code(device_code: dict[str, Any]) -> None:
+        ctx.output(
+            single(
+                item={
+                    "status": "awaiting_authentication",
+                    "action_required": {
+                        "type": "device_code",
+                        "instructions": (
+                            f"Sign in with your Datex account to consent to {resource}"
+                        ),
+                        "url": device_code["verification_uri"],
+                        "code": device_code["user_code"],
+                        "expires_in_seconds": device_code["expires_in"],
+                    },
+                    "message": device_code.get("message", ""),
+                },
+                semantic_key="authentication",
+            ),
+            include_metadata=False,
+        )
+
+    try:
+        outcome = consent_datex_resource(
+            consent_scopes=consent_scopes,
+            acquire_scopes=acquire_scopes,
+            resource=resource,
+            error_code=error_code,
+            on_device_code=on_device_code,
+        )
+    except DxsError as e:
+        ctx.output_error(e)
+        raise SystemExit(1) from None
+
+    ctx.output(
+        single(
+            item={
+                "status": "consented",
+                "message": f"Consent for {resource} granted and verified.",
+                "resource": resource,
+                "account": outcome["identity"],
+                "has_token": True,
+            },
+            semantic_key="authentication",
+        )
+    )
+
+
 def run_standard_device_login(
     ctx: DxsContext,
     on_device_code: Callable[[dict[str, Any]], None],
@@ -64,6 +176,7 @@ def run_standard_device_login(
     organization_id: int | None = None,
     organization_name: str | None = None,
     api_base_url: str | None = None,
+    consent_outcomes: list[ConsentOutcome] | None = None,
 ) -> CachedIdentity:
     """Run the multi-resource device-code login and save the identity.
 
@@ -88,6 +201,11 @@ def run_standard_device_login(
     that target a non-default environment (e.g. ``dxs init --target qa``) must
     pass it so the identity is stamped from the same environment its profile is
     detected against, not the stale lru_cached default.
+
+    ``consent_outcomes``, when given, receives one entry per additional consent
+    round so callers can include failures in their success payload. Failed
+    rounds are always logged as warnings here regardless — an additional
+    resource failing never aborts the login, so this is the only signal.
     """
     from dxs.utils.config import get_settings
 
@@ -117,25 +235,36 @@ def run_standard_device_login(
             tenant is known, so DevOps/CRM consent is requested only for Datex
             staff — a customer must never be prompted for Datex-internal
             resources by name.
+
+            The CRM round requests the *named* scope, not ``.default``:
+            ``.default`` is static consent and fails with AADSTS650057 for any
+            first-time user because Dataverse is not listed on the CLI app
+            registration (issue #135). Token acquisition keeps ``.default``.
             """
             internal = (
                 [
                     settings.azure_devops_scopes,
-                    settings.dynamics_crm_scopes,
-                    settings.dynamics_crm_admin_scopes,
-                    settings.data_export_service_scopes,
+                    settings.dynamics_crm_consent_scopes,
                 ]
                 if claims_are_datex(token_response.get("id_token_claims") or {})
                 else []
             )
             return [scopes for scopes in [*internal, [settings.footprint_scope]] if scopes]
 
+    outcomes: list[ConsentOutcome] = consent_outcomes if consent_outcomes is not None else []
     result = client.authenticate_device_code_multi_resource(
         primary_scopes=settings.azure_scopes,
         additional_scope_sets=additional_scope_sets,
         on_device_code=on_device_code,
         on_additional_consent_needed=consent_cb,
+        consent_outcomes=outcomes,
     )
+    for entry in consent_failure_items(outcomes):
+        detail = entry["error_description"] or entry["error"] or "unknown error"
+        warning = f"WARNING: consent for {entry['resource']} was not obtained: {detail}"
+        if "suggestion" in entry:
+            warning += f" {entry['suggestion']}"
+        ctx.log(warning)
 
     saved_identity = cache.save_identity(
         result,
@@ -173,13 +302,16 @@ def _auth_success_item(
     saved_identity: CachedIdentity,
     *,
     message: str = "Successfully authenticated",
+    consent_outcomes: list[ConsentOutcome] | None = None,
 ) -> dict[str, Any]:
     """Build the standard ``authenticated`` response payload shared by the login paths.
 
     The external-tenant descriptor is derived from the saved identity — never from
     which CLI flags were passed — so the payload cannot disagree with the cache
     (a --tenant-id login with the home tenant is persisted as internal). Adds the
-    ``footprint_daemon_auth`` marker when the identity carries daemon creds.
+    ``footprint_daemon_auth`` marker when the identity carries daemon creds, and
+    ``consent_failures`` when an additional consent round failed — the primary
+    login succeeded, so this is where a missing consent becomes visible.
     """
     item: dict[str, Any] = {
         "status": "authenticated",
@@ -194,6 +326,9 @@ def _auth_success_item(
     item["expires_at"] = saved_identity.expires_at.isoformat()
     if saved_identity.footprint_client_id:
         item["footprint_daemon_auth"] = "configured"
+    failures = consent_failure_items(consent_outcomes)
+    if failures:
+        item["consent_failures"] = failures
     return item
 
 
@@ -279,6 +414,16 @@ def auth() -> None:
     default=None,
     help="Entra domain (e.g. csw-wi.com) — resolves the tenant ID for you",
 )
+@click.option(
+    "--consent",
+    "consent_resource",
+    type=click.Choice(["devops", "crm"]),
+    default=None,
+    help=(
+        "Only (re)run the consent round for one Datex-internal resource, using the "
+        "cached Datex identity — no full re-login"
+    ),
+)
 @pass_context
 def login(
     ctx: DxsContext,
@@ -287,6 +432,7 @@ def login(
     client_secret: str | None,
     tenant_id: str | None,
     domain: str | None,
+    consent_resource: str | None,
 ) -> None:
     """Authenticate with Azure Entra using device code flow.
 
@@ -307,6 +453,9 @@ def login(
     credentials) authentication for the Footprint API, needed for cross-tenant
     access where OBO flow is not available.
 
+    Use --consent devops|crm (Datex staff) to grant a missing consent for one
+    internal resource without re-running the whole login.
+
     \b
     Examples:
         dxs auth login                        # Login to default tenant
@@ -314,6 +463,7 @@ def login(
         dxs auth login --domain csw-wi.com    # Bootstrap: no identity required
         dxs auth login --tenant-id <guid>     # Same, when you know the GUID
         dxs auth login CAG --client-id <id> --client-secret <secret>
+        dxs auth login --consent devops       # Grant the missing DevOps consent only
     """
     _reject_tenant_override(ctx, "login")
 
@@ -331,6 +481,23 @@ def login(
         )
         raise SystemExit(1)
 
+    if consent_resource:
+        if org or tenant_id or domain or client_id or client_secret:
+            ctx.output_error(
+                ValidationError(
+                    message=(
+                        "--consent runs a single consent round for the cached Datex "
+                        "identity; it cannot be combined with an organization, tenant, "
+                        "or daemon credentials"
+                    ),
+                    code="DXS-AUTH-024",
+                    suggestions=["Run 'dxs auth login --consent devops|crm' by itself"],
+                )
+            )
+            raise SystemExit(1)
+        _run_targeted_consent(ctx, consent_resource)
+        return
+
     if org and (tenant_id or domain):
         ctx.output_error(
             ValidationError(
@@ -380,6 +547,7 @@ def login(
                 include_metadata=False,
             )
 
+        external_outcomes: list[ConsentOutcome] = []
         try:
             saved_identity = run_standard_device_login(
                 ctx,
@@ -388,12 +556,15 @@ def login(
                 client_secret=client_secret,
                 tenant_id=tenant_id,
                 domain=domain,
+                consent_outcomes=external_outcomes,
             )
         except AuthenticationError as e:
             ctx.output_error(e)
             raise SystemExit(1) from None
 
-        external_success_item = _auth_success_item(saved_identity)
+        external_success_item = _auth_success_item(
+            saved_identity, consent_outcomes=external_outcomes
+        )
         ctx.output(single(item=external_success_item, semantic_key="authentication"))
         return
 
@@ -438,6 +609,7 @@ def login(
             include_metadata=False,
         )
 
+    login_outcomes: list[ConsentOutcome] = []
     try:
         saved_identity = run_standard_device_login(
             ctx,
@@ -445,12 +617,13 @@ def login(
             client_id=client_id,
             client_secret=client_secret,
             on_additional_consent_needed=on_additional_consent_needed,
+            consent_outcomes=login_outcomes,
         )
     except AuthenticationError as e:
         ctx.output_error(e)
         raise SystemExit(1) from None
 
-    success_item = _auth_success_item(saved_identity)
+    success_item = _auth_success_item(saved_identity, consent_outcomes=login_outcomes)
     ctx.output(single(item=success_item, semantic_key="authentication"))
 
 
@@ -1415,7 +1588,9 @@ def _switch_by_organization(
         # Home-tenant org (Datex, or an org with no tenant of its own): the
         # current identity's tokens already cover it, but the org binding on
         # the cached identity must still be re-pointed at the requested org.
-        _rebind_home_tenant_identity(ctx, cache, org_info)
+        _rebind_home_tenant_identity(
+            ctx, cache, org_info, client_id=client_id, client_secret=client_secret
+        )
         return
 
     # Step 4: Reject a misregistered home-tenant org BEFORE any identity lookup —
@@ -1551,6 +1726,8 @@ def _rebind_home_tenant_identity(
     ctx: DxsContext,
     cache: MultiIdentityTokenCache,
     org_info: Any,
+    client_id: str | None = None,
+    client_secret: str | None = None,
 ) -> None:
     """Re-point the active home-tenant identity at ``org_info`` (issue #112).
 
@@ -1561,6 +1738,10 @@ def _rebind_home_tenant_identity(
     made the silent no-op hard to spot — while writes fail with a misleading
     ``DXS-API-400``. Only the two org fields move; tokens and the active
     identity selection stay untouched (the issue #83 contract).
+
+    Supplied daemon credentials are persisted on the active identity on both
+    outcomes (issue #133) — the same contract the other org-switch branches
+    honor. Without credentials, the already-bound outcome writes nothing.
     """
     active = cache.get_active_identity()
     if active is None or identity_needs_tenant_authority(active):
@@ -1587,27 +1768,29 @@ def _rebind_home_tenant_identity(
         )
         raise SystemExit(1)
 
+    storage_key = cache.resolve_stored_key(active) or active.identity_key
+
     already_bound = active.organization_id == org_info.id and (
         (active.organization_name or "").lower() == org_info.name.lower()
     )
     if already_bound:
-        ctx.output(
-            single(
-                item={
-                    "status": "no_action_required",
-                    "message": (
-                        f"Active identity is already bound to organization '{org_info.name}'"
-                    ),
-                    "active_identity": active.account_username,
-                    "organization": org_info.name,
-                    "organization_id": org_info.id,
-                },
-                semantic_key="authentication",
-            )
-        )
+        identity = active
+        if client_id and client_secret:
+            with_creds = cache.update_identity_daemon_creds(storage_key, client_id, client_secret)
+            if with_creds is not None:
+                identity = with_creds
+        item: dict[str, Any] = {
+            "status": "no_action_required",
+            "message": (f"Active identity is already bound to organization '{org_info.name}'"),
+            "active_identity": active.account_username,
+            "organization": org_info.name,
+            "organization_id": org_info.id,
+        }
+        if identity.footprint_client_id:
+            item["footprint_daemon_auth"] = "configured"
+        ctx.output(single(item=item, semantic_key="authentication"))
         return
 
-    storage_key = cache.resolve_stored_key(active) or active.identity_key
     updated = cache.update_identity_org_info(storage_key, org_info.id, org_info.name)
     if updated is None:
         ctx.output_error(
@@ -1618,23 +1801,26 @@ def _rebind_home_tenant_identity(
         )
         raise SystemExit(1)
 
-    ctx.output(
-        single(
-            item={
-                "status": "organization_rebound",
-                "message": (
-                    f"Re-bound the active identity to organization '{org_info.name}' "
-                    "(home tenant; no login required)"
-                ),
-                "active_identity": active.account_username,
-                "organization": org_info.name,
-                "organization_id": org_info.id,
-                "previous_organization": active.organization_name,
-                "previous_organization_id": active.organization_id,
-            },
-            semantic_key="authentication",
-        )
-    )
+    if client_id and client_secret:
+        with_creds = cache.update_identity_daemon_creds(storage_key, client_id, client_secret)
+        if with_creds is not None:
+            updated = with_creds
+
+    item = {
+        "status": "organization_rebound",
+        "message": (
+            f"Re-bound the active identity to organization '{org_info.name}' "
+            "(home tenant; no login required)"
+        ),
+        "active_identity": active.account_username,
+        "organization": org_info.name,
+        "organization_id": org_info.id,
+        "previous_organization": active.organization_name,
+        "previous_organization_id": active.organization_id,
+    }
+    if updated.footprint_client_id:
+        item["footprint_daemon_auth"] = "configured"
+    ctx.output(single(item=item, semantic_key="authentication"))
 
 
 def _handled_home_tenant_external_org(ctx: DxsContext, org_info: Any) -> bool:
@@ -1726,6 +1912,7 @@ def _authenticate_external_tenant(
             include_metadata=False,
         )
 
+    org_outcomes: list[ConsentOutcome] = []
     try:
         ctx.log(f"Initiating device code authentication for {org_info.name}...")
         saved_identity = run_standard_device_login(
@@ -1739,11 +1926,13 @@ def _authenticate_external_tenant(
             external_entra_id=org_info.external_entra_id,
             organization_id=org_info.id,
             organization_name=org_info.name,
+            consent_outcomes=org_outcomes,
         )
 
         success_item = _auth_success_item(
             saved_identity,
             message=f"Successfully authenticated with {org_info.name}",
+            consent_outcomes=org_outcomes,
         )
         ctx.output(single(item=success_item, semantic_key="authentication"))
 

{datex_studio_cli-0.4.19 → datex_studio_cli-0.4.20}/src/dxs/commands/explore.py

@@ -337,7 +337,7 @@ def _build_config_index(client: ApiClient, branch_id: int, ctx: DxsContext) -> C
                     )
         except ApiError as e:
             # Log JSON parse errors as warnings (e.g., endpoints type)
-            if e.code == "DXS-API-JSON-001":
+            if e.code in ("DXS-API-JSON-001", "DXS-API-ROUTE-404"):
                 ctx.log(f"Warning: {ctype} returned non-JSON response")
             # Other API errors are expected (type may not exist)
         except Exception:

{datex_studio_cli-0.4.19 → datex_studio_cli-0.4.20}/src/dxs/commands/init.py

@@ -5,11 +5,12 @@ from typing import Any
 
 import click
 
-from dxs.commands.auth import run_standard_device_login
+from dxs.commands.auth import consent_failure_items, run_standard_device_login
 from dxs.context import DxsContext, pass_context
 from dxs.core.api.client import ApiClient
 from dxs.core.auth import MSALClient, MultiIdentityTokenCache
 from dxs.core.auth.decorators import get_access_token
+from dxs.core.auth.msal_client import ConsentOutcome
 from dxs.core.auth.tenants import is_foreign_tenant
 from dxs.core.onboarding import (
     AuthAction,
@@ -180,6 +181,7 @@ def init(
     # actually persisted.
     external_mode = is_foreign_tenant(tenant_id)
 
+    consent_outcomes: list[ConsentOutcome] = []
     if action is AuthAction.INTERACTIVE:
 
         def on_device_code(dc: dict[str, Any]) -> None:
@@ -204,6 +206,7 @@ def init(
                 tenant_id=tenant_id,
                 domain=domain,
                 api_base_url=effective_api_base_url,
+                consent_outcomes=consent_outcomes,
             )
         except AuthenticationError as e:
             combined = f"{e.message} {e.details}"
@@ -297,18 +300,20 @@ def init(
     if profile is not None and profile.is_staff is not None:
         profile_label = "staff" if profile.is_staff else "customer"
 
-    ctx.output(
-        single(
-            item={
-                "status": "initialized",
-                "message": "Datex Studio CLI is configured.",
-                "organization": profile.org_name if profile else None,
-                "organization_id": profile.org_id if profile else None,
-                "profile": profile_label,
-                "devops_org": profile.devops_org if profile else None,
-                "api_base_url": effective_api_base_url,
-                "footprint_daemon_auth": "configured" if daemon_persisted else None,
-            },
-            semantic_key="init",
-        )
-    )
+    item: dict[str, Any] = {
+        "status": "initialized",
+        "message": "Datex Studio CLI is configured.",
+        "organization": profile.org_name if profile else None,
+        "organization_id": profile.org_id if profile else None,
+        "profile": profile_label,
+        "devops_org": profile.devops_org if profile else None,
+        "api_base_url": effective_api_base_url,
+        "footprint_daemon_auth": "configured" if daemon_persisted else None,
+    }
+    # A failed additional-consent round does not fail init (the primary login
+    # succeeded), but it must be visible next to the success status.
+    consent_failures = consent_failure_items(consent_outcomes)
+    if consent_failures:
+        item["consent_failures"] = consent_failures
+
+    ctx.output(single(item=item, semantic_key="init"))

{datex_studio_cli-0.4.19 → datex_studio_cli-0.4.20}/src/dxs/commands/source.py

@@ -281,12 +281,19 @@ def status(ctx: DxsContext, branch: int | None, repo: int | None) -> None:
         )
 
     client = ApiClient()
-    result = {}
+    result: dict[str, Any] = {}
 
-    # Get locks (requires repo_id)
+    # Get locks (requires repo_id). The locks route takes an applicationGroupId,
+    # so resolve the repo to its group(s) first — same resolution as `source locks`.
     if repo_id:
         ctx.log(f"Fetching locks for repository {repo_id}...")
-        locks_data = client.get(SourceControlEndpoints.locks(repo_id))
+        group_ids = _lock_group_ids(client, repo_id)
+        if group_ids:
+            ctx.log(f"Repository {repo_id} resolved to application group(s) {group_ids}")
+            locks_data = _fetch_locks_for_groups(client, group_ids)
+        else:
+            # Back-compat: the value matched no repository — try it as a group ID.
+            locks_data = client.get(SourceControlEndpoints.locks(repo_id))
         result["locks"] = locks_data
 
     # Get feature branch changes if branch_id provided

{datex_studio_cli-0.4.19 → datex_studio_cli-0.4.20}/src/dxs/core/api/client.py

@@ -224,6 +224,29 @@ class ApiClient:
             content_type = response.headers.get("content-type", "")
             response_preview = response.text[:500] if response.text else "(empty)"
 
+            # An HTML page with a success status from an API path is the SPA
+            # catch-all answering for a route the server does not serve — a
+            # missing route, not a server malfunction.
+            body_head = response.text.lstrip().lower() if response.text else ""
+            is_html_page = body_head.startswith(("<!doctype", "<html"))
+            if "text/html" in content_type.lower() and is_html_page:
+                raise ApiError(
+                    message=("The API route does not exist (server returned the web app instead)"),
+                    code="DXS-API-ROUTE-404",
+                    status_code=response.status_code,
+                    details={
+                        "url": str(response.url),
+                        "content_type": content_type,
+                        "response_preview": response_preview,
+                    },
+                    suggestions=[
+                        "This usually means the CLI command targets an endpoint "
+                        "that has been renamed or removed",
+                        "Check the URL in details.url against the server's API",
+                        "Update the CLI if a newer version repoints this command",
+                    ],
+                ) from e
+
             raise ApiError(
                 message=f"API returned non-JSON response (status {response.status_code})",
                 code="DXS-API-JSON-001",