ellf-cli 20.0.3__tar.gz → 20.0.4__tar.gz

{ellf_cli-20.0.3/ellf_cli.egg-info → ellf_cli-20.0.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ellf-cli
-Version: 20.0.3
+Version: 20.0.4
 Summary: Ellf Command Line Interface
 Home-page: https://prodi.gy
 Author: ExplosionAI GmbH

{ellf_cli-20.0.3 → ellf_cli-20.0.4}/ellf_cli/auth.py

@@ -60,7 +60,9 @@ _R = TypeVar("_R")
 
 OIDC_SCOPE = "openid profile email"
 OIDC_DEVICE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code"
-AUTH_WAIT_TIME_SECONDS = 60 * 5
+# How long to wait for the browser when the server doesn't say how long
+# its code lasts (RFC 8628 ``expires_in``).
+DEFAULT_DEVICE_CODE_EXPIRY_SECONDS = 60 * 10
 # httpx default is 5s — too tight for the auth round-trip when PAM's
 # load balancer occasionally takes longer than that to respond. A
 # transient network blip during login should not require the user to
@@ -628,10 +630,10 @@ class AuthStateImpl:
             )
 
     def _authenticate_device_and_get_id_token(self) -> tuple[str, str | None]:
-        # The device flow needs a human at a browser and then polls for up
-        # to AUTH_WAIT_TIME_SECONDS. Without a terminal there is nobody to
+        # The device flow needs a human at a browser and then polls until
+        # the code expires. Without a terminal there is nobody to
         # complete the sign-in, and the login URL is invisible inside a
-        # pipe's block buffer — the run just looks hung for five minutes.
+        # pipe's block buffer — the run just looks hung for ten minutes.
         # Fail fast instead; ELLF_HEADLESS_LOGIN opts scripted flows that
         # consume the login_required JSON back into the old behaviour.
         if not isatty(sys.stdin) and not os.environ.get("ELLF_HEADLESS_LOGIN"):
@@ -664,9 +666,13 @@ class AuthStateImpl:
         if not (device_code and user_code and uri and interval and uri_complete):
             raise CLIError(Messages.E032, data)
         print_login_info(uri_complete, uri, user_code, no_browser=self.no_browser)
-        last_check = 0
-        for _ in range(AUTH_WAIT_TIME_SECONDS):
-            if time.time() > (last_check + int(interval)):
+        # Waiting for the code's whole lifetime: a person who approves in the
+        # browser after the CLI stops polling is told it worked, and isn't.
+        expires_in = int(data.get("expires_in") or DEFAULT_DEVICE_CODE_EXPIRY_SECONDS)
+        deadline = time.monotonic() + expires_in
+        last_check = 0.0
+        while time.monotonic() < deadline:
+            if time.monotonic() > (last_check + int(interval)):
                 token_response = httpx.post(
                     token_url,
                     json={
@@ -675,7 +681,7 @@ class AuthStateImpl:
                     },
                     timeout=AUTH_REQUEST_TIMEOUT_SECONDS,
                 )
-                last_check = time.time()
+                last_check = time.monotonic()
                 token_data = self._safe_json(token_response, token_url)
                 if token_response.status_code == 200:
                     id_token = token_data.get("id_token")
@@ -685,5 +691,13 @@ class AuthStateImpl:
                         )
                     ellf_core_token = token_data.get("access_token")
                     return id_token, ellf_core_token
+                error = token_data.get("error")
+                if error == "slow_down":
+                    interval = int(interval) + 5
+                elif (
+                    token_response.status_code < 500
+                    and error != "authorization_pending"
+                ):
+                    raise EllfIDTokenError(Messages.E195)
             time.sleep(1)
         raise EllfIDTokenError(Messages.E031)

{ellf_cli-20.0.3 → ellf_cli-20.0.4}/ellf_cli/ellf.json

@@ -1,7 +1,7 @@
 {
   "prog": "ellf",
   "help": "Ellf Command Line Interface.",
-  "version": "20.0.3",
+  "version": "20.0.4",
   "extra_key": "_extra",
   "commands": {
     "actions": {

{ellf_cli-20.0.3 → ellf_cli-20.0.4}/ellf_cli/messages.py

@@ -35,7 +35,7 @@ class Messages:
     E028 = "Could not deregister {noun} {name}: cluster error"
     E029 = "Could not deregister {noun} {name}: {noun} not found"
     E030 = "Could not deregister {noun} {name}: forbidden"
-    E031 = "Login failed: timed out waiting for browser authentication"
+    E031 = "Login failed: timed out waiting for browser authentication. Run `ellf login` to try again."
     E032 = "Login failed: the device authentication API sent an incomplete response"
     E033 = "Login failed: unable to load CLI config from {url}"
     E034 = "{code} {reason} for URL {url}"
@@ -318,6 +318,7 @@ ellf secret create my-credentials OPENAI_API_KEY="sk-..." CUSTOM_SECRET=-
     E192 = "Annotators can't log in via the CLI. Ask an admin of your organization '{org}' to upgrade your role to developer, then run `{command}` again."
     E193 = "Deleting a project has to be confirmed via a terminal. Run `ellf projects delete {name}` again in an interactive terminal session."
     E194 = "Wrong project name, so {name} was not deleted"
+    E195 = "Login failed: the login was cancelled in the browser, or its code has expired. Run `ellf login` to try again."
 
 
 #  fmt: on

ellf_cli-20.0.4/ellf_cli/version/20.0.3_2026-10-14-14-29-16_patch_070af1c4-f9d9-4f97-8112-058de90d3ea8

@@ -0,0 +1,3 @@
+20.0.3
+patch
+070af1c4-f9d9-4f97-8112-058de90d3ea8

{ellf_cli-20.0.3 → ellf_cli-20.0.4/ellf_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ellf-cli
-Version: 20.0.3
+Version: 20.0.4
 Summary: Ellf Command Line Interface
 Home-page: https://prodi.gy
 Author: ExplosionAI GmbH

{ellf_cli-20.0.3 → ellf_cli-20.0.4}/ellf_cli.egg-info/SOURCES.txt

@@ -332,6 +332,7 @@ ellf_cli/version/19.0.9_2026-10-01-15-57-35_patch_143863cb-8f63-4ef7-bd78-c1114f
 ellf_cli/version/20.0.0_2026-10-10-09-36-17_patch_d2618f39-cdc9-4d3a-ba40-1a0ad6265f3b
 ellf_cli/version/20.0.1_2026-10-11-10-24-33_patch_e29a8713-eecb-4eb1-9641-789d3cfab21a
 ellf_cli/version/20.0.2_2026-10-12-07-22-24_patch_f4053ad1-8fcd-4591-a68d-bf1e23485ba7
+ellf_cli/version/20.0.3_2026-10-14-14-29-16_patch_070af1c4-f9d9-4f97-8112-058de90d3ea8
 ellf_cli/version/__init__.py
 ellf_cli/version/read_version.py
 tests/test_agents.py

{ellf_cli-20.0.3 → ellf_cli-20.0.4}/tests/test_auth.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+from collections.abc import Sequence
 from pathlib import Path
 
 import pytest
@@ -128,3 +129,79 @@ class TestPamHostResolution:
 
         SavedSettings.blank().save(root_cfg.saved_settings_path)
         assert self._resolve(root_cfg) == DEFAULT_PAM_HOST
+
+
+class TestDeviceLogin:
+    """Polling for the browser's approval in ``ellf login``."""
+
+    def _run(self, monkeypatch, polls: Sequence[tuple[int, dict]], *, expires_in=600):
+        import httpx
+
+        from ellf_cli import auth as auth_module
+        from ellf_cli.util import URL
+
+        clock = {"now": 0.0}
+        posted: list[str] = []
+        responses = iter(polls)
+
+        def fake_post(url, **kwargs):
+            posted.append(url)
+            if url.endswith("/device/code"):
+                body = {
+                    "device_code": "dc",
+                    "user_code": "ABCD-1234",
+                    "verification_uri": "https://x/auth/device",
+                    "verification_uri_complete": "https://x/auth/device?user_code=ABCD-1234",
+                    "interval": 5,
+                    "expires_in": expires_in,
+                }
+                return httpx.Response(200, json=body)
+            status, body = next(responses)
+            return httpx.Response(status, json=body)
+
+        def fake_sleep(seconds):
+            clock["now"] += seconds
+
+        monkeypatch.setattr(auth_module, "isatty", lambda _: True)
+        monkeypatch.setattr(auth_module, "print_login_info", lambda *a, **k: None)
+        monkeypatch.setattr(
+            auth_module.httpx,
+            "get",
+            lambda url, **k: httpx.Response(
+                200, json={}, request=httpx.Request("GET", url)
+            ),
+        )
+        monkeypatch.setattr(auth_module.httpx, "post", fake_post)
+        monkeypatch.setattr(auth_module.time, "sleep", fake_sleep)
+        monkeypatch.setattr(auth_module.time, "monotonic", lambda: clock["now"])
+        auth = object.__new__(auth_module.AuthStateImpl)
+        auth._pam_url = URL.parse("https://x")
+        auth.no_browser = True
+        return auth._authenticate_device_and_get_id_token(), clock, posted
+
+    def test_waits_past_five_minutes_for_approval(self, monkeypatch):
+        pending = (400, {"error": "authorization_pending"})
+        approved = (200, {"id_token": "id", "access_token": "core"})
+        tokens, clock, _ = self._run(monkeypatch, [pending] * 60 + [approved])
+        assert tokens == ("id", "core")
+        assert clock["now"] > 300
+
+    def test_gives_up_when_the_code_expires(self, monkeypatch):
+        from ellf_cli.errors import EllfIDTokenError
+
+        pending = (400, {"error": "authorization_pending"})
+        with pytest.raises(EllfIDTokenError, match="timed out"):
+            self._run(monkeypatch, [pending] * 1000, expires_in=60)
+
+    def test_stops_when_cancelled_in_browser(self, monkeypatch):
+        from ellf_cli.errors import EllfIDTokenError
+
+        pending = (400, {"error": "authorization_pending"})
+        with pytest.raises(EllfIDTokenError, match="cancelled"):
+            self._run(monkeypatch, [pending, (400, {"error": "invalid_grant"})])
+
+    def test_keeps_polling_through_server_errors(self, monkeypatch):
+        flaky = (502, {"error": "OIDC provider unreachable"})
+        approved = (200, {"id_token": "id"})
+        tokens, _, _ = self._run(monkeypatch, [flaky, approved])
+        assert tokens == ("id", None)