dh-cli 0.4.4__tar.gz → 0.4.5__tar.gz

{dh_cli-0.4.4 → dh_cli-0.4.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dh-cli
-Version: 0.4.4
+Version: 0.4.5
 Summary: Dayhoff Labs developer CLI
 Author-email: Dayhoff Labs <dev@dayhofflabs.com>
 License: # PolyForm Noncommercial License 1.0.0

{dh_cli-0.4.4 → dh_cli-0.4.5}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "dh-cli"
-version = "0.4.4"
+version = "0.4.5"
 description = "Dayhoff Labs developer CLI"
 requires-python = ">=3.11"
 readme = "README.md"

{dh_cli-0.4.4 → dh_cli-0.4.5}/src/dh_cli/hz/test.py

@@ -1,5 +1,6 @@
 """Run integration test suites."""
 
+import os
 import re
 from pathlib import Path
 from typing import Optional
@@ -48,6 +49,75 @@ def _resolve_suites(
     return matched
 
 
+def _ensure_jwt_token(env: str, test_dir: Path) -> None:
+    """Ensure HORIZYN_TOKEN is set, prompting interactively if needed.
+
+    Checks (in order): env var with expiry validation, cached token file,
+    then falls back to interactive Cognito passwordless auth.
+    Sets os.environ["HORIZYN_TOKEN"] so child processes inherit it.
+    """
+    import json
+    import subprocess
+    import time
+
+    token_script = test_dir / "get_jwt_token.py"
+    cache_dir = Path.home() / ".horizyn"
+    cache_file = cache_dir / f"token_{env}"
+
+    def _token_valid(token: str) -> bool:
+        """Check JWT expiry without verification (5-minute buffer)."""
+        import base64
+
+        try:
+            payload = token.split(".")[1]
+            padding = 4 - len(payload) % 4
+            if padding != 4:
+                payload += "=" * padding
+            decoded = json.loads(base64.urlsafe_b64decode(payload))
+            return time.time() < (decoded.get("exp", 0) - 300)
+        except Exception:
+            return False
+
+    # 1. Check existing env var
+    existing = os.environ.get("HORIZYN_TOKEN", "")
+    if existing and _token_valid(existing):
+        typer.secho("  Using existing HORIZYN_TOKEN", fg=typer.colors.GREEN)
+        return
+
+    # 2. Check cached token file
+    if cache_file.exists():
+        cached = cache_file.read_text().strip()
+        if cached and _token_valid(cached):
+            os.environ["HORIZYN_TOKEN"] = cached
+            typer.secho(f"  Using cached token from {cache_file}", fg=typer.colors.GREEN)
+            return
+        cache_file.unlink(missing_ok=True)
+
+    # 3. Interactive: run get_jwt_token.py (prompts go to stderr, token to stdout)
+    typer.echo()
+    typer.secho("  No valid token found — starting authentication.", fg=typer.colors.YELLOW)
+    typer.echo()
+
+    result = subprocess.run(
+        ["python3", str(token_script), "--env", env],
+        capture_output=False,
+        stdout=subprocess.PIPE,
+        text=True,
+    )
+
+    if result.returncode != 0 or not result.stdout.strip():
+        typer.secho("  Authentication failed.", fg=typer.colors.RED, err=True)
+        raise typer.Exit(1)
+
+    token = result.stdout.strip()
+    os.environ["HORIZYN_TOKEN"] = token
+
+    # Cache for future runs
+    cache_dir.mkdir(mode=0o700, exist_ok=True)
+    cache_file.write_text(token)
+    cache_file.chmod(0o600)
+
+
 @test_app.command("list")
 def list_tests(
     target: str = typer.Option("local", "--target", "-t", help="local or deployed."),
@@ -98,9 +168,12 @@ def test_deployed(
     test_dir = repo / "test/server/deployed"
 
     if not suites:
+        # run_all_tests.sh handles its own token flow
         run_script(test_dir / "run_all_tests.sh", args=[env], cwd=test_dir)
         return
 
+    _ensure_jwt_token(env, test_dir)
+
     available = _discover_suites(test_dir)
     selected = _resolve_suites(available, suites)