doploy-cli 0.2.3__tar.gz → 0.2.6__tar.gz

{doploy_cli-0.2.3 → doploy_cli-0.2.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: doploy-cli
-Version: 0.2.3
+Version: 0.2.6
 Summary: doploy CLI: watch builds, read logs, and drive Odoo deployments from a terminal
 License: MIT
 Project-URL: Homepage, https://doploy.io

{doploy_cli-0.2.3 → doploy_cli-0.2.6}/doploy_cli/main.py

@@ -20,8 +20,14 @@ import webbrowser
 import stat
 import sys
 import time
+from contextlib import contextmanager
 from pathlib import Path
 
+try:
+    import fcntl
+except ImportError:  # Windows: no cross-process lock, refresh as before
+    fcntl = None
+
 from typing import Optional
 
 import httpx
@@ -39,9 +45,34 @@ def _load_config() -> dict:
 
 
 def _save_config(cfg: dict) -> None:
+    # Write-then-rename so a concurrent reader never sees a half-written file
+    # (it would parse as {} and report "not logged in").
+    CONFIG_PATH.parent.mkdir(parents=True, exist_ok=True)
+    tmp = CONFIG_PATH.with_name(f'{CONFIG_PATH.name}.{os.getpid()}.tmp')
+    tmp.unlink(missing_ok=True)  # leftover from a crashed run
+    # Created 0600 (token inside) and O_EXCL: never readable by other users,
+    # never follows a planted symlink.
+    fd = os.open(tmp, os.O_WRONLY | os.O_CREAT | os.O_EXCL, stat.S_IRUSR | stat.S_IWUSR)
+    with os.fdopen(fd, 'w') as fh:
+        fh.write(json.dumps(cfg, indent=2) + '\n')
+    os.replace(tmp, CONFIG_PATH)
+
+
+@contextmanager
+def _refresh_lock():
+    """Serialize token refresh across doploy processes. The server rotates the
+    refresh token on every use and revokes the whole grant if an already-used
+    one is presented again, so two processes refreshing at once log you out."""
+    if fcntl is None:
+        yield
+        return
     CONFIG_PATH.parent.mkdir(parents=True, exist_ok=True)
-    CONFIG_PATH.write_text(json.dumps(cfg, indent=2) + '\n')
-    CONFIG_PATH.chmod(stat.S_IRUSR | stat.S_IWUSR)  # 0600: token inside
+    with open(CONFIG_PATH.with_name(CONFIG_PATH.name + '.lock'), 'w') as fh:
+        fcntl.flock(fh, fcntl.LOCK_EX)
+        try:
+            yield
+        finally:
+            fcntl.flock(fh, fcntl.LOCK_UN)
 
 
 class Client:
@@ -56,21 +87,30 @@ class Client:
     def _refresh_access_token(self) -> bool:
         if not self.refresh or not self.refresh.get('refresh_token'):
             return False
-        r = _oauth_token_request(self.base, {
-            'grant_type': 'refresh_token',
-            'refresh_token': self.refresh['refresh_token'],
-            'client_id': self.refresh['client_id'],
-        })
-        if r is None:
-            return False
-        self.token = r['access_token']
-        self.refresh['refresh_token'] = r['refresh_token']
-        self.refresh['expires_at'] = time.time() + int(r.get('expires_in') or 3600)
-        cfg = _load_config()
-        cfg.update(access_token=self.token, refresh_token=self.refresh['refresh_token'],
-                   expires_at=self.refresh['expires_at'])
-        _save_config(cfg)
-        return True
+        with _refresh_lock():
+            # Another process may have refreshed while we waited for the lock:
+            # use its tokens instead of replaying our now-rotated refresh token.
+            cfg = _load_config()
+            if cfg.get('refresh_token') and cfg['refresh_token'] != self.refresh['refresh_token']:
+                self.token = cfg.get('access_token') or ''
+                self.refresh['refresh_token'] = cfg['refresh_token']
+                self.refresh['expires_at'] = cfg.get('expires_at', 0)
+                return True
+            r = _oauth_token_request(self.base, {
+                'grant_type': 'refresh_token',
+                'refresh_token': self.refresh['refresh_token'],
+                'client_id': self.refresh['client_id'],
+            })
+            if r is None:
+                return False
+            self.token = r['access_token']
+            self.refresh['refresh_token'] = r['refresh_token']
+            self.refresh['expires_at'] = time.time() + int(r.get('expires_in') or 3600)
+            cfg = _load_config()
+            cfg.update(access_token=self.token, refresh_token=self.refresh['refresh_token'],
+                       expires_at=self.refresh['expires_at'])
+            _save_config(cfg)
+            return True
 
     def request(self, method: str, path: str, **kw):
         if self.refresh and self.refresh.get('expires_at', 0) < time.time() + 30:
@@ -143,8 +183,12 @@ def _free_port() -> int:
         return s.getsockname()[1]
 
 
-def _wait_for_callback(port: int, state: str, timeout: float = 300.0) -> str:
-    """Serve one loopback request and return the OAuth `code` it carried."""
+def _wait_for_callback(port: int, state: str, done_url: str, timeout: float = 300.0) -> str:
+    """Serve one loopback request and return the OAuth `code` it carried.
+
+    The browser is sent on to ``done_url?status=...`` (a branded page hosted by
+    the doploy server) rather than shown bare text from this loopback server.
+    """
     from urllib.parse import parse_qs, urlparse
     result: dict = {}
 
@@ -152,15 +196,15 @@ def _wait_for_callback(port: int, state: str, timeout: float = 300.0) -> str:
         def do_GET(self):  # noqa: N802
             q = parse_qs(urlparse(self.path).query)
             if q.get('state', [''])[0] != state:
-                body, result['error'] = 'State mismatch. Close this tab and retry.', 'state mismatch'
+                status, result['error'] = 'error', 'state mismatch'
             elif q.get('error'):
-                body, result['error'] = 'Login cancelled. You can close this tab.', q['error'][0]
+                status, result['error'] = 'cancelled', q['error'][0]
             else:
-                body, result['code'] = 'Logged in to doploy. You can close this tab.', q.get('code', [''])[0]
-            self.send_response(200)
-            self.send_header('Content-Type', 'text/html')
+                status, result['code'] = 'ok', q.get('code', [''])[0]
+            self.send_response(302)
+            self.send_header('Location', f'{done_url}?status={status}')
+            self.send_header('Content-Length', '0')
             self.end_headers()
-            self.wfile.write(f'<html><body style="font-family:sans-serif"><p>{body}</p></body></html>'.encode())
 
         def log_message(self, *a):  # silence
             pass
@@ -201,7 +245,7 @@ def _browser_login(base: str) -> None:
     print('Opening your browser to sign in to doploy. If it does not open, visit:')
     print(f'  {url}')
     webbrowser.open(url)
-    code = _wait_for_callback(port, state)
+    code = _wait_for_callback(port, state, f'{issuer}/cli/complete')
 
     tok = _oauth_token_request(base, {
         'grant_type': 'authorization_code', 'code': code, 'redirect_uri': redirect_uri,
@@ -573,7 +617,7 @@ def main(argv=None):
                     help='required when targeting production')
     sp.set_defaults(func=cmd_restart)
 
-    sp = sub.add_parser('logs', help='tail build logs (build, test or odoo source)')
+    sp = sub.add_parser('logs', help='tail build logs (build, test, or odoo source)')
     sp.add_argument('build_id', type=int)
     sp.add_argument('--source', choices=['build', 'test', 'odoo'], default='build')
     sp.add_argument('--lines', type=int, default=200, help='tail length (max 2000)')

{doploy_cli-0.2.3 → doploy_cli-0.2.6}/doploy_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: doploy-cli
-Version: 0.2.3
+Version: 0.2.6
 Summary: doploy CLI: watch builds, read logs, and drive Odoo deployments from a terminal
 License: MIT
 Project-URL: Homepage, https://doploy.io

{doploy_cli-0.2.3 → doploy_cli-0.2.6}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "doploy-cli"
-version = "0.2.3"
+version = "0.2.6"
 description = "doploy CLI: watch builds, read logs, and drive Odoo deployments from a terminal"
 readme = "README.md"
 license = { text = "MIT" }