delphi-code 0.2.0__tar.gz → 0.2.1__tar.gz

{delphi_code-0.2.0 → delphi_code-0.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: delphi-code
-Version: 0.2.0
+Version: 0.2.1
 Summary: Offline local code search for agents
 Author: Mark Dorofeev
 License-Expression: Apache-2.0
@@ -168,7 +168,7 @@ delphi-code add github.com/octo/tools
 delphi-code add
 ```
 
-Choose Bitbucket or GitHub (asked only when both have credentials), then a Bitbucket workspace or GitHub account (skipped when there is only one). Then check repositories in a list you can filter by typing. Repositories you already track start checked, so unchecking one stops tracking it and deletes its index. After you confirm, the new repositories are indexed. Filter options and `--ref` apply to the repositories you add. The prompts are drawn on stderr, and stdout still receives one JSON object with the added repositories under `repos` and the untracked ones under `removed`. Cancelling changes nothing and reports `"cancelled": true`. Without a terminal, `add` requires sources.
+Choose Bitbucket or GitHub (asked only when both have credentials), then a Bitbucket workspace or GitHub account (skipped when there is only one). If your Bitbucket credentials may not list workspaces, you type the workspace name instead; `BITBUCKET_WORKSPACE` pre-fills it. Then check repositories in a list you can filter by typing. Repositories you already track start checked, so unchecking one stops tracking it and deletes its index. After you confirm, the new repositories are indexed. Filter options and `--ref` apply to the repositories you add. The prompts are drawn on stderr, and stdout still receives one JSON object with the added repositories under `repos` and the untracked ones under `removed`. Cancelling changes nothing and reports `"cancelled": true`. Without a terminal, `add` requires sources.
 
 **Credentials.** Git never prompts. Credentials from the environment reach git through `GIT_ASKPASS`, never in URLs or arguments, and take precedence over configured git credentials. Listing repositories for the picker uses the services' REST APIs. The API requests run in a separate process, like the model download in `setup`, so the main process keeps its network guard.
 
@@ -177,7 +177,7 @@ Choose Bitbucket or GitHub (asked only when both have credentials), then a Bitbu
 | Cloning | `BITBUCKET_USERNAME` and `BITBUCKET_APP_PASSWORD`, otherwise git's own credentials | `GITHUB_TOKEN` or `GH_TOKEN`, otherwise git's own credentials (`gh auth setup-git` configures them) |
 | Listing for the picker | The same variables (with `BITBUCKET_EMAIL` in place of the username when set), otherwise the credentials git has stored for bitbucket.org | `GITHUB_TOKEN` or `GH_TOKEN`, otherwise `gh auth token`, otherwise the token git has stored for github.com |
 
-Bitbucket has replaced app passwords with API tokens. An API token also works in `BITBUCKET_APP_PASSWORD`. Git over HTTPS takes the username that Bitbucket shows for it, and the REST API takes your Atlassian account email, which you set in `BITBUCKET_EMAIL`.
+Bitbucket has replaced app passwords with API tokens. An API token also works in `BITBUCKET_APP_PASSWORD`. Git over HTTPS takes the username that Bitbucket shows for it, and the REST API takes your Atlassian account email, which you set in `BITBUCKET_EMAIL`. Cloning and listing a workspace's repositories need the `read:repository:bitbucket` scope. Listing your workspaces also needs `read:workspace:bitbucket`; without it, the picker asks for the workspace name. An error names the credentials that were used and the scopes Bitbucket requires.
 
 `DELPHI_CODE_BITBUCKET_GIT_BASE` and `DELPHI_CODE_GITHUB_GIT_BASE` send clones to another base URL, such as a mirror, and `DELPHI_CODE_BITBUCKET_API_BASE` and `DELPHI_CODE_GITHUB_API_BASE` do the same for the APIs. Result links still point to bitbucket.org and github.com.
 

{delphi_code-0.2.0 → delphi_code-0.2.1}/README.md

@@ -138,7 +138,7 @@ delphi-code add github.com/octo/tools
 delphi-code add
 ```
 
-Choose Bitbucket or GitHub (asked only when both have credentials), then a Bitbucket workspace or GitHub account (skipped when there is only one). Then check repositories in a list you can filter by typing. Repositories you already track start checked, so unchecking one stops tracking it and deletes its index. After you confirm, the new repositories are indexed. Filter options and `--ref` apply to the repositories you add. The prompts are drawn on stderr, and stdout still receives one JSON object with the added repositories under `repos` and the untracked ones under `removed`. Cancelling changes nothing and reports `"cancelled": true`. Without a terminal, `add` requires sources.
+Choose Bitbucket or GitHub (asked only when both have credentials), then a Bitbucket workspace or GitHub account (skipped when there is only one). If your Bitbucket credentials may not list workspaces, you type the workspace name instead; `BITBUCKET_WORKSPACE` pre-fills it. Then check repositories in a list you can filter by typing. Repositories you already track start checked, so unchecking one stops tracking it and deletes its index. After you confirm, the new repositories are indexed. Filter options and `--ref` apply to the repositories you add. The prompts are drawn on stderr, and stdout still receives one JSON object with the added repositories under `repos` and the untracked ones under `removed`. Cancelling changes nothing and reports `"cancelled": true`. Without a terminal, `add` requires sources.
 
 **Credentials.** Git never prompts. Credentials from the environment reach git through `GIT_ASKPASS`, never in URLs or arguments, and take precedence over configured git credentials. Listing repositories for the picker uses the services' REST APIs. The API requests run in a separate process, like the model download in `setup`, so the main process keeps its network guard.
 
@@ -147,7 +147,7 @@ Choose Bitbucket or GitHub (asked only when both have credentials), then a Bitbu
 | Cloning | `BITBUCKET_USERNAME` and `BITBUCKET_APP_PASSWORD`, otherwise git's own credentials | `GITHUB_TOKEN` or `GH_TOKEN`, otherwise git's own credentials (`gh auth setup-git` configures them) |
 | Listing for the picker | The same variables (with `BITBUCKET_EMAIL` in place of the username when set), otherwise the credentials git has stored for bitbucket.org | `GITHUB_TOKEN` or `GH_TOKEN`, otherwise `gh auth token`, otherwise the token git has stored for github.com |
 
-Bitbucket has replaced app passwords with API tokens. An API token also works in `BITBUCKET_APP_PASSWORD`. Git over HTTPS takes the username that Bitbucket shows for it, and the REST API takes your Atlassian account email, which you set in `BITBUCKET_EMAIL`.
+Bitbucket has replaced app passwords with API tokens. An API token also works in `BITBUCKET_APP_PASSWORD`. Git over HTTPS takes the username that Bitbucket shows for it, and the REST API takes your Atlassian account email, which you set in `BITBUCKET_EMAIL`. Cloning and listing a workspace's repositories need the `read:repository:bitbucket` scope. Listing your workspaces also needs `read:workspace:bitbucket`; without it, the picker asks for the workspace name. An error names the credentials that were used and the scopes Bitbucket requires.
 
 `DELPHI_CODE_BITBUCKET_GIT_BASE` and `DELPHI_CODE_GITHUB_GIT_BASE` send clones to another base URL, such as a mirror, and `DELPHI_CODE_BITBUCKET_API_BASE` and `DELPHI_CODE_GITHUB_API_BASE` do the same for the APIs. Result links still point to bitbucket.org and github.com.
 

{delphi_code-0.2.0 → delphi_code-0.2.1}/delphi_code/hosts.py

@@ -8,7 +8,7 @@ import subprocess
 import sys
 from typing import Any, NamedTuple
 from urllib.error import HTTPError, URLError
-from urllib.parse import quote, urlencode
+from urllib.parse import quote, urlencode, urlsplit
 from urllib.request import Request, urlopen
 
 if __package__:
@@ -24,6 +24,11 @@ class Owner(NamedTuple):
     name: str
 
 
+class ApiCredentials(NamedTuple):
+    authorization: str
+    source: str
+
+
 class Repository(NamedTuple):
     host: str
     owner: str
@@ -43,6 +48,7 @@ class RepositoryHost:
     default_api_base: str
     credentials_hint: str
     rejected_credentials_hint = ""
+    missing_permission_hint = ""
 
     def __init__(self, api_authorization=None):
         self._given_api_authorization = api_authorization
@@ -57,11 +63,14 @@ class RepositoryHost:
     def permalink_template(self, owner, repository, commit):
         raise NotImplementedError
 
+    def suggested_owner(self):
+        return None
+
     def clone_credentials(self):
         raise NotImplementedError
 
     def has_api_credentials(self):
-        return bool(self._available_api_authorization)
+        return self._available_api_credentials is not None
 
     def owners(self):
         return [Owner(**item) for item in self._list_in_child_process("owners")]
@@ -69,7 +78,7 @@ class RepositoryHost:
     def repositories(self, owner):
         return [Repository(**item) for item in self._list_in_child_process("repositories", owner)]
 
-    def _find_api_authorization(self):
+    def _find_api_credentials(self):
         raise NotImplementedError
 
     def _list_owners(self):
@@ -93,19 +102,21 @@ class RepositoryHost:
         return os.environ.get(f"{self._variable_prefix}_API_BASE", self.default_api_base).rstrip("/")
 
     @cached_property
-    def _available_api_authorization(self):
-        return self._given_api_authorization or self._find_api_authorization()
+    def _available_api_credentials(self):
+        if self._given_api_authorization:
+            return ApiCredentials(self._given_api_authorization, "given credentials")
+        return self._find_api_credentials()
 
     @property
-    def _api_authorization(self):
-        authorization = self._available_api_authorization
-        if not authorization:
+    def _api_credentials(self):
+        credentials = self._available_api_credentials
+        if credentials is None:
             raise Failure(
                 "remote_auth_missing",
                 f"Listing {self.name} repositories needs credentials: {self.credentials_hint}",
                 ExitCode.RUNTIME_ASSETS,
             )
-        return authorization
+        return credentials
 
     def _repository(self, owner, slug, description, private):
         return Repository(self.domain, owner, slug, description or "", bool(private))
@@ -129,7 +140,8 @@ class RepositoryHost:
             return json.load(response), (response.headers.get("Link") if response.headers else None) or ""
 
     def _list_in_child_process(self, listing, *arguments) -> list[dict]:
-        environment = dict(os.environ, DELPHI_CODE_API_AUTHORIZATION=self._api_authorization)
+        credentials = self._api_credentials
+        environment = dict(os.environ, DELPHI_CODE_API_AUTHORIZATION=credentials.authorization)
         try:
             result = subprocess.run(
                 [sys.executable, __file__, self.domain, listing, *arguments],
@@ -152,10 +164,18 @@ class RepositoryHost:
         if result.returncode == 0:
             return payload
         error = payload.get("error", {})
-        if error.get("status") in (401, 403):
+        if error.get("status") == 401:
             raise Failure(
                 "remote_auth_failed",
-                f"{self.name} refused the credentials: {error['message']}. {self.rejected_credentials_hint or self.credentials_hint}",
+                f"{self.name} rejected the {credentials.source}: {error['message']}. "
+                f"{self.rejected_credentials_hint or self.credentials_hint}",
+                ExitCode.OPERATION,
+            )
+        if error.get("status") == 403:
+            raise Failure(
+                "remote_permission_denied",
+                f"{self.name} accepted the {credentials.source} but refused {error.get('path')}: {error['message']}. "
+                f"{self.missing_permission_hint}",
                 ExitCode.OPERATION,
             )
         raise Failure(
@@ -170,39 +190,43 @@ class Bitbucket(RepositoryHost):
     default_api_base = "https://api.bitbucket.org/2.0"
     credentials_hint = "set BITBUCKET_USERNAME and BITBUCKET_APP_PASSWORD, or store git credentials for bitbucket.org"
     rejected_credentials_hint = "With an API token, set BITBUCKET_EMAIL to your Atlassian account email"
+    missing_permission_hint = (
+        "Listing needs an API token with the scopes read:user:bitbucket, read:workspace:bitbucket and "
+        "read:repository:bitbucket, or an app password with Account, Workspace membership and Repositories read access"
+    )
     _repository_fields = "next,values.slug,values.description,values.is_private"
 
     def permalink_template(self, owner, repository, commit):
         return f"{self.web_url(owner, repository)}/src/{commit}/{{path}}#lines-{{start}}:{{end}}"
 
+    def suggested_owner(self):
+        return os.environ.get("BITBUCKET_WORKSPACE")
+
     def clone_credentials(self):
         username, password = os.environ.get("BITBUCKET_USERNAME"), os.environ.get("BITBUCKET_APP_PASSWORD")
         return (username, password) if username and password else None
 
-    def _find_api_authorization(self):
-        username = os.environ.get("BITBUCKET_EMAIL") or os.environ.get("BITBUCKET_USERNAME")
-        password = os.environ.get("BITBUCKET_APP_PASSWORD")
-        credentials = (username, password) if username and password else _git_stored_credentials(self.domain)
-        return "Basic " + base64.b64encode(":".join(credentials).encode()).decode() if credentials else None
+    def _find_api_credentials(self):
+        username_variable = "BITBUCKET_EMAIL" if os.environ.get("BITBUCKET_EMAIL") else "BITBUCKET_USERNAME"
+        username, password = os.environ.get(username_variable), os.environ.get("BITBUCKET_APP_PASSWORD")
+        if username and password:
+            source = f"{username_variable} and BITBUCKET_APP_PASSWORD from the environment"
+        else:
+            stored = _git_stored_credentials(self.domain)
+            if stored is None:
+                return None
+            (username, password), source = stored, f"git credentials stored for {self.domain}"
+        return ApiCredentials("Basic " + base64.b64encode(f"{username}:{password}".encode()).decode(), source)
 
     def _workspaces_url(self):
         return f"{self._api_base}/user/workspaces?pagelen={PAGE_LENGTH}"
 
-    def _legacy_workspaces_url(self):
-        return f"{self._api_base}/user/permissions/workspaces?pagelen={PAGE_LENGTH}"
-
     def _repositories_url(self, workspace):
         query = urlencode({"role": "member", "pagelen": PAGE_LENGTH, "sort": "slug", "fields": self._repository_fields})
         return f"{self._api_base}/repositories/{quote(workspace)}?{query}"
 
     def _list_owners(self):
-        try:
-            memberships = self._fetch_pages(self._workspaces_url())
-        except HTTPError as exc:
-            exc.close()
-            if exc.code not in (404, 410):
-                raise
-            memberships = self._fetch_pages(self._legacy_workspaces_url())
+        memberships = self._fetch_pages(self._workspaces_url())
         names_by_slug = {}
         for membership in memberships:
             workspace = membership.get("workspace", membership)
@@ -228,6 +252,9 @@ class GitHub(RepositoryHost):
     owner_noun = "account"
     default_api_base = "https://api.github.com"
     credentials_hint = "set GITHUB_TOKEN, sign in with gh auth login, or store git credentials for github.com"
+    missing_permission_hint = (
+        "Listing needs a classic token with the repo scope, or a fine-grained token with Metadata read access"
+    )
     _next_link = re.compile(r'<([^>]+)>;\s*rel="next"')
 
     def permalink_template(self, owner, repository, commit):
@@ -237,12 +264,16 @@ class GitHub(RepositoryHost):
         token = _github_environment_token()
         return ("x-access-token", token) if token else None
 
-    def _find_api_authorization(self):
-        token = _github_environment_token() or _gh_token(self.domain)
-        if not token:
-            stored = _git_stored_credentials(self.domain)
-            token = stored[1] if stored else None
-        return f"Bearer {token}" if token else None
+    def _find_api_credentials(self):
+        for source, find_token in (
+            ("GITHUB_TOKEN or GH_TOKEN from the environment", _github_environment_token),
+            ("token from gh auth token", lambda: _gh_token(self.domain)),
+            (f"token stored in git credentials for {self.domain}", lambda: _git_stored_token(self.domain)),
+        ):
+            token = find_token()
+            if token:
+                return ApiCredentials(f"Bearer {token}", source)
+        return None
 
     def owners(self):
         owners = sorted({repository.owner for repository in self._accessible_repositories}, key=str.lower)
@@ -304,6 +335,11 @@ def _gh_token(domain):
     return result.stdout.strip() if result.returncode == 0 and result.stdout.strip() else None
 
 
+def _git_stored_token(domain):
+    stored = _git_stored_credentials(domain)
+    return stored[1] if stored else None
+
+
 def _git_stored_credentials(domain):
     environment = {name: value for name, value in os.environ.items() if name not in {"GIT_ASKPASS", "SSH_ASKPASS"}}
     environment["GIT_TERMINAL_PROMPT"] = "0"
@@ -324,14 +360,44 @@ def _git_stored_credentials(domain):
     return fields["username"], fields["password"]
 
 
+def _error_body(exc):
+    try:
+        return exc.read()
+    except (OSError, ValueError):
+        return b""
+    finally:
+        exc.close()
+
+
+def _service_error_message(body):
+    try:
+        payload = json.loads(body)
+    except ValueError:
+        return None
+    if not isinstance(payload, dict):
+        return None
+    bitbucket_error = payload.get("error")
+    if not isinstance(bitbucket_error, dict):
+        return payload.get("message")
+    message, detail = bitbucket_error.get("message"), bitbucket_error.get("detail")
+    if isinstance(detail, dict):
+        detail = "; ".join(f"{name}: {_listed(value)}" for name, value in detail.items())
+    return f"{message} ({detail})" if message and detail else message or detail
+
+
+def _listed(value):
+    return ", ".join(map(str, value)) if isinstance(value, list) else str(value)
+
+
 def main(arguments):
     domain, listing, *listing_arguments = arguments
     host = HOSTS_BY_DOMAIN[domain](os.environ["DELPHI_CODE_API_AUTHORIZATION"])
     try:
         items = host._list_owners() if listing == "owners" else host._list_repositories(*listing_arguments)
     except HTTPError as exc:
-        exc.close()
-        print(json.dumps({"error": {"status": exc.code, "message": f"HTTP {exc.code} {exc.reason}"}}))
+        reason = _service_error_message(_error_body(exc)) or exc.reason
+        path = urlsplit(exc.url).path if exc.url else None
+        print(json.dumps({"error": {"status": exc.code, "path": path, "message": f"HTTP {exc.code} {reason}"}}))
         return 1
     except (URLError, OSError, ValueError, KeyError, TypeError) as exc:
         print(json.dumps({"error": {"status": None, "message": str(exc)}}))

{delphi_code-0.2.0 → delphi_code-0.2.1}/delphi_code/picker.py

@@ -78,7 +78,12 @@ class RepositoryPicker:
     def _choose_owner(self, host):
         import questionary
 
-        owners = host.owners()
+        try:
+            owners = host.owners()
+        except Failure as failure:
+            if failure.code != "remote_permission_denied":
+                raise
+            return self._type_owner(host)
         if not owners:
             raise Failure("remote_empty", f"Your {host.name} account has no repositories", ExitCode.USAGE)
         if len(owners) == 1:
@@ -91,6 +96,16 @@ class RepositoryPicker:
             **self._terminal,
         ).ask()
 
+    def _type_owner(self, host):
+        import questionary
+
+        answer = questionary.text(
+            f"These credentials cannot list {host.name} {host.owner_noun}s. {host.name} {host.owner_noun} to index:",
+            default=host.suggested_owner() or "",
+            **self._terminal,
+        ).ask()
+        return (answer or "").strip() or None
+
     def _choose_repositories(self, owner, repositories, tracked_keys):
         import questionary
 

{delphi_code-0.2.0 → delphi_code-0.2.1}/delphi_code/sources.py

@@ -110,7 +110,8 @@ class GitRemoteSource:
         return Revision(branch, commit)
 
     def _named_revision(self, ref):
-        commits = dict((name, value) for value, name in self._remote_refs(f"refs/heads/{ref}", f"refs/tags/{ref}"))
+        advertised = self._remote_refs(f"refs/heads/{ref}", f"refs/tags/{ref}", f"refs/tags/{ref}^{{}}")
+        commits = dict((name, value) for value, name in advertised)
         commit = (
             commits.get(f"refs/heads/{ref}") or commits.get(f"refs/tags/{ref}^{{}}") or commits.get(f"refs/tags/{ref}")
         )

{delphi_code-0.2.0 → delphi_code-0.2.1}/delphi_code.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: delphi-code
-Version: 0.2.0
+Version: 0.2.1
 Summary: Offline local code search for agents
 Author: Mark Dorofeev
 License-Expression: Apache-2.0
@@ -168,7 +168,7 @@ delphi-code add github.com/octo/tools
 delphi-code add
 ```
 
-Choose Bitbucket or GitHub (asked only when both have credentials), then a Bitbucket workspace or GitHub account (skipped when there is only one). Then check repositories in a list you can filter by typing. Repositories you already track start checked, so unchecking one stops tracking it and deletes its index. After you confirm, the new repositories are indexed. Filter options and `--ref` apply to the repositories you add. The prompts are drawn on stderr, and stdout still receives one JSON object with the added repositories under `repos` and the untracked ones under `removed`. Cancelling changes nothing and reports `"cancelled": true`. Without a terminal, `add` requires sources.
+Choose Bitbucket or GitHub (asked only when both have credentials), then a Bitbucket workspace or GitHub account (skipped when there is only one). If your Bitbucket credentials may not list workspaces, you type the workspace name instead; `BITBUCKET_WORKSPACE` pre-fills it. Then check repositories in a list you can filter by typing. Repositories you already track start checked, so unchecking one stops tracking it and deletes its index. After you confirm, the new repositories are indexed. Filter options and `--ref` apply to the repositories you add. The prompts are drawn on stderr, and stdout still receives one JSON object with the added repositories under `repos` and the untracked ones under `removed`. Cancelling changes nothing and reports `"cancelled": true`. Without a terminal, `add` requires sources.
 
 **Credentials.** Git never prompts. Credentials from the environment reach git through `GIT_ASKPASS`, never in URLs or arguments, and take precedence over configured git credentials. Listing repositories for the picker uses the services' REST APIs. The API requests run in a separate process, like the model download in `setup`, so the main process keeps its network guard.
 
@@ -177,7 +177,7 @@ Choose Bitbucket or GitHub (asked only when both have credentials), then a Bitbu
 | Cloning | `BITBUCKET_USERNAME` and `BITBUCKET_APP_PASSWORD`, otherwise git's own credentials | `GITHUB_TOKEN` or `GH_TOKEN`, otherwise git's own credentials (`gh auth setup-git` configures them) |
 | Listing for the picker | The same variables (with `BITBUCKET_EMAIL` in place of the username when set), otherwise the credentials git has stored for bitbucket.org | `GITHUB_TOKEN` or `GH_TOKEN`, otherwise `gh auth token`, otherwise the token git has stored for github.com |
 
-Bitbucket has replaced app passwords with API tokens. An API token also works in `BITBUCKET_APP_PASSWORD`. Git over HTTPS takes the username that Bitbucket shows for it, and the REST API takes your Atlassian account email, which you set in `BITBUCKET_EMAIL`.
+Bitbucket has replaced app passwords with API tokens. An API token also works in `BITBUCKET_APP_PASSWORD`. Git over HTTPS takes the username that Bitbucket shows for it, and the REST API takes your Atlassian account email, which you set in `BITBUCKET_EMAIL`. Cloning and listing a workspace's repositories need the `read:repository:bitbucket` scope. Listing your workspaces also needs `read:workspace:bitbucket`; without it, the picker asks for the workspace name. An error names the credentials that were used and the scopes Bitbucket requires.
 
 `DELPHI_CODE_BITBUCKET_GIT_BASE` and `DELPHI_CODE_GITHUB_GIT_BASE` send clones to another base URL, such as a mirror, and `DELPHI_CODE_BITBUCKET_API_BASE` and `DELPHI_CODE_GITHUB_API_BASE` do the same for the APIs. Result links still point to bitbucket.org and github.com.
 

{delphi_code-0.2.0 → delphi_code-0.2.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "delphi-code"
-version = "0.2.0"
+version = "0.2.1"
 description = "Offline local code search for agents"
 readme = "README.md"
 requires-python = ">=3.12"

{delphi_code-0.2.0 → delphi_code-0.2.1}/tests/test_picker.py

@@ -6,6 +6,7 @@ from pathlib import Path
 import subprocess
 import sys
 import tempfile
+from typing import NamedTuple
 import unittest
 from unittest.mock import MagicMock, patch
 from urllib.error import HTTPError
@@ -15,7 +16,7 @@ from prompt_toolkit.input import create_pipe_input
 from prompt_toolkit.output import DummyOutput
 
 from delphi_code import hosts
-from delphi_code.errors import Failure
+from delphi_code.errors import ExitCode, Failure
 from delphi_code.hosts import Bitbucket, GitHub, Owner, Repository, configured_hosts
 from delphi_code.picker import RepositoryPicker, TrackingChanges
 
@@ -29,12 +30,18 @@ def answering(value):
 class FakeHost:
     owner_noun = "workspace"
 
-    def __init__(self, owners, repositories, name="Bitbucket"):
+    def __init__(self, owners, repositories, name="Bitbucket", suggested_owner=None):
         self._owners, self._repositories, self.name = owners, repositories, name
+        self._suggested_owner = suggested_owner
 
     def owners(self):
+        if isinstance(self._owners, Failure):
+            raise self._owners
         return self._owners
 
+    def suggested_owner(self):
+        return self._suggested_owner
+
     def repositories(self, owner):
         return [repository for repository in self._repositories if repository.owner == owner]
 
@@ -108,6 +115,28 @@ class Picking(unittest.TestCase):
         with patch("questionary.select", answering(None)):
             self.assertIsNone(two_hosts.choose(set()))
 
+    def test_owner_is_typed_when_listing_owners_is_forbidden(self):
+        forbidden = Failure("remote_permission_denied", "lacks read:workspace:bitbucket", ExitCode.OPERATION)
+        host = FakeHost(forbidden, ACME, suggested_owner="acme")
+        with (
+            patch("questionary.text", answering("  acme ")) as text,
+            patch("questionary.checkbox", answering(["bitbucket.org/acme/api"])),
+            patch("questionary.confirm", answering(True)),
+        ):
+            changes = RepositoryPicker([host], terminal={}).choose(set())
+        self.assertEqual(text.call_args.kwargs["default"], "acme")
+        self.assertEqual(changes, TrackingChanges(["bitbucket.org/acme/api"], []))
+        for cancelled in (None, "   "):
+            with patch("questionary.text", answering(cancelled)):
+                self.assertIsNone(RepositoryPicker([FakeHost(forbidden, ACME)], terminal={}).choose(set()))
+
+    def test_other_listing_failures_are_not_turned_into_questions(self):
+        unavailable = Failure("remote_unavailable", "down", ExitCode.OPERATION)
+        with patch("questionary.text") as text, self.assertRaises(Failure) as raised:
+            RepositoryPicker([FakeHost(unavailable, ACME)], terminal={}).choose(set())
+        self.assertEqual(raised.exception.code, "remote_unavailable")
+        text.assert_not_called()
+
     def test_unchanged_selection_needs_no_confirmation(self):
         with (
             patch("questionary.checkbox", answering(["bitbucket.org/acme/api"])),
@@ -165,6 +194,20 @@ class FakeResponse(io.BytesIO):
         self.headers = {"Link": link}
 
 
+class HttpFailure(NamedTuple):
+    status: int
+    body: object = None
+
+
+BITBUCKET_SCOPE_ERROR = {
+    "type": "error",
+    "error": {
+        "message": "Your credentials lack one or more required privilege scopes.",
+        "detail": {"granted": ["repository"], "required": ["account"]},
+    },
+}
+
+
 class HostListingScript(unittest.TestCase):
     def setUp(self):
         self.enterContext(
@@ -184,8 +227,10 @@ class HostListingScript(unittest.TestCase):
         def urlopen(request, timeout, context):
             requests.append(request)
             page = pages_by_path[urlsplit(request.full_url).path]
-            if isinstance(page, int):
-                raise HTTPError(request.full_url, page, "Refused", {}, io.BytesIO())
+            if isinstance(page, HttpFailure):
+                raise HTTPError(
+                    request.full_url, page.status, "Refused", {}, io.BytesIO(json.dumps(page.body).encode())
+                )
             return page if isinstance(page, FakeResponse) else FakeResponse(page)
 
         self.enterContext(patch.object(hosts, "urlopen", side_effect=urlopen))
@@ -218,20 +263,6 @@ class HostListingScript(unittest.TestCase):
         )
         self.assertEqual(requests[0].get_header("Authorization"), "Basic bWU6cHc=")
 
-    def test_bitbucket_workspaces_fall_back_to_the_permissions_endpoint(self):
-        self.serve(
-            {
-                "/2.0/user/workspaces": 410,
-                "/2.0/user/permissions/workspaces": {
-                    "values": [{"workspace": {"slug": "zeta", "name": "Zeta"}}, {"workspace": {"slug": "acme"}}]
-                },
-            }
-        )
-        self.assertEqual(
-            self.listed("bitbucket.org", "owners"),
-            (0, [{"slug": "acme", "name": "acme"}, {"slug": "zeta", "name": "Zeta"}]),
-        )
-
     def test_github_pages_follow_link_headers(self):
         self.serve(
             {
@@ -252,11 +283,30 @@ class HostListingScript(unittest.TestCase):
         )
 
     def test_http_errors_are_reported_as_json(self):
-        self.serve({"/2.0/user/workspaces": 401})
+        self.serve({"/2.0/user/workspaces": HttpFailure(401)})
+        self.assertEqual(
+            self.listed("bitbucket.org", "owners"),
+            (1, {"error": {"status": 401, "path": "/2.0/user/workspaces", "message": "HTTP 401 Refused"}}),
+        )
+
+    def test_bitbucket_scope_errors_name_the_missing_scopes(self):
+        self.serve(
+            {
+                "/2.0/user/workspaces": HttpFailure(403, BITBUCKET_SCOPE_ERROR),
+            }
+        )
+        code, output = self.listed("bitbucket.org", "owners")
+        self.assertEqual((code, output["error"]["status"], output["error"]["path"]), (1, 403, "/2.0/user/workspaces"))
         self.assertEqual(
-            self.listed("bitbucket.org", "owners"), (1, {"error": {"status": 401, "message": "HTTP 401 Refused"}})
+            output["error"]["message"],
+            "HTTP 403 Your credentials lack one or more required privilege scopes. (granted: repository; required: account)",
         )
 
+    def test_github_error_messages_are_reported(self):
+        self.serve({"/user/repos": HttpFailure(403, {"message": "Resource not accessible by personal access token"})})
+        _, output = self.listed("github.com", "repositories")
+        self.assertEqual(output["error"]["message"], "HTTP 403 Resource not accessible by personal access token")
+
 
 class Hosts(unittest.TestCase):
     def setUp(self):
@@ -306,6 +356,24 @@ class Hosts(unittest.TestCase):
         self.assertEqual(raised.exception.code, "remote_auth_failed")
         self.assertIn("BITBUCKET_EMAIL", str(raised.exception))
 
+    def test_forbidden_listing_names_the_credentials_used_and_the_scopes_needed(self):
+        self.isolate_git_and_gh().write_text("https://stored-user:stored-pass@bitbucket.org\n")
+        bitbucket = Bitbucket()
+        self.assertTrue(bitbucket.has_api_credentials())
+        forbidden = subprocess.CompletedProcess(
+            [],
+            1,
+            json.dumps({"error": {"status": 403, "path": "/2.0/user/workspaces", "message": "HTTP 403 lacks scopes"}}),
+            "",
+        )
+        with patch("delphi_code.hosts.subprocess.run", return_value=forbidden), self.assertRaises(Failure) as raised:
+            bitbucket.owners()
+        self.assertEqual(raised.exception.code, "remote_permission_denied")
+        message = str(raised.exception)
+        self.assertIn("accepted the git credentials stored for bitbucket.org but refused /2.0/user/workspaces", message)
+        self.assertIn("read:workspace:bitbucket", message)
+        self.assertNotIn("BITBUCKET_EMAIL", message)
+
     def authorization_sent(self, host):
         self.assertTrue(host.has_api_credentials())
         answered = subprocess.CompletedProcess([], 0, "[]", "")

{delphi_code-0.2.0 → delphi_code-0.2.1}/tests/test_sources.py

@@ -49,7 +49,8 @@ class LocalHostWithApiRepository(unittest.TestCase):
         git("config", "user.name", "Test", cwd=self.work)
         self.commit("parse.py", "def parse(text):\n    return text\n")
         git("tag", "v1", cwd=self.work)
-        git("push", "-q", "origin", "main", "v1", cwd=self.work)
+        git("tag", "--annotate", "v1-annotated", "--message", "release", cwd=self.work)
+        git("push", "-q", "origin", "main", "v1", "v1-annotated", cwd=self.work)
 
     def commit(self, name, text):
         (self.work / name).write_text(text)
@@ -98,6 +99,7 @@ class RemoteGitCheckouts(LocalHostWithApiRepository):
         head = git("rev-parse", "HEAD", cwd=self.work)
         self.assertEqual(source.latest_revision(None), ("main", head))
         self.assertEqual(source.latest_revision("v1"), ("v1", head))
+        self.assertEqual(source.latest_revision("v1-annotated"), ("v1-annotated", head))
         with self.assertRaises(Failure) as raised:
             source.latest_revision("missing")
         self.assertEqual(raised.exception.code, "remote_ref_missing")