ellf-cli 6.0.2__tar.gz → 6.0.3__tar.gz

{ellf_cli-6.0.2/ellf_cli.egg-info → ellf_cli-6.0.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ellf-cli
-Version: 6.0.2
+Version: 6.0.3
 Summary: Ellf Command Line Interface
 Home-page: https://prodi.gy
 Author: ExplosionAI GmbH

{ellf_cli-6.0.2 → ellf_cli-6.0.3}/ellf_cli/about.json

@@ -1,7 +1,7 @@
 {
   "title": "Ellf CLI",
   "name": "ellf-cli",
-  "version": "6.0.2",
+  "version": "6.0.3",
   "summary": "Ellf Command Line Interface",
   "uri": "https://prodi.gy",
   "prog": "ellf",

{ellf_cli-6.0.2 → ellf_cli-6.0.3}/ellf_cli/auth.py

@@ -210,10 +210,11 @@ class AuthStateImpl:
         # PAM lookup-by-address every time the user runs an ellf command.
         # `auth.cluster_id` falls back to the address lookup only if this is None.
         self._cluster_id = settings.cluster_id
-        # Seed org_id from saved settings too: the user's api_token already
-        # carries the org_id in its `oid` claim, but we don't decode the JWT
-        # here. The saved setting reflects whatever was chosen at the last
-        # `ellf login` and stays in sync via set_active_org.
+        # Seed org_id from saved-defaults as a fallback only. The ``org_id``
+        # property reads from the api_token's ``oid`` claim — which is what
+        # PAM authorizes against — and overwrites this value on first access.
+        # The seed is just here to satisfy callers that read ``_org_id``
+        # before any token is fetched.
         self._org_id = settings.org_id
         self._secrets_path = ctx.secrets_path
         self._saved_settings_path = ctx.saved_settings_path
@@ -269,9 +270,22 @@ class AuthStateImpl:
 
     @property
     def org_id(self) -> UUID:
+        # PAM authorizes against the api_token's ``oid`` claim, so the JWT
+        # is the source of truth. The saved-defaults pointer (seeded into
+        # ``_org_id`` in __init__) can drift — e.g. when secrets.json is
+        # restored from backup, when a switch updates the pointer without
+        # re-minting the token, or when an ELLF_API_TOKEN env var injects
+        # a token from a different org. Reading from the JWT keeps every
+        # caller (server-side request bodies, display strings) aligned
+        # with what PAM will actually authorize against.
+        oid = self.get_api_token().header.get("oid")
+        if oid is not None:
+            self._org_id = UUID(oid)
+            return self._org_id
         if self._org_id is None:
-            # Exploits that the login should only have the user's
-            # own org accessible
+            # Token missing the oid claim (older PAM tokens, or an
+            # externally-supplied ELLF_API_TOKEN). Fall back to listing —
+            # the login should only have the user's own org accessible.
             orgs = list(self.client.org.all())
             if not orgs:
                 raise EllfError(message="Could not fetch orgs")

{ellf_cli-6.0.2 → ellf_cli-6.0.3}/ellf_cli/commands/general.py

@@ -152,17 +152,20 @@ def _select_and_persist_org(
 ) -> UUID:
     """Pick an org via pam and write it into SavedSettings.
 
-    If the chosen org differs from the current api_token's org, calls
-    ``/v1/token/switch-org`` to re-issue the token for the target org.
-    The first time a person logs in here we always have *some* api_token
-    (from the device-flow login), but we don't know which org it landed
-    in without a round-trip, so the switch is unconditional when an org
-    is explicitly selected — that's cheap and avoids a JWT decode here.
+    The api_token's JWT carries an ``oid`` claim that PAM authorizes
+    against server-side; the saved-defaults ``org_id`` is only a local
+    display pointer. The two can drift apart (e.g. saved-defaults reset
+    independently, or a prior switch that updated the pointer without
+    re-minting). We compare ``chosen`` to the JWT claim — not the saved
+    pointer — so a ``login --org X`` that finds the pointer already at X
+    but the token issued for Y still calls ``/v1/token/switch-org`` and
+    converges both sides on X.
     """
     chosen = select_org(auth.client, name_or_id)
     settings = get_saved_settings()
-    previous_org_id = settings.org_id
-    if previous_org_id != chosen.org_id:
+    token_oid = auth.get_api_token().header.get("oid")
+    token_org_id = UUID(token_oid) if token_oid else None
+    if token_org_id != chosen.org_id:
         auth.set_active_org(chosen.org_id)
     settings.update("org_id", chosen.org_id)
     settings.save(get_root_cfg().saved_settings_path)

{ellf_cli-6.0.2 → ellf_cli-6.0.3}/ellf_cli/ellf.json

@@ -1,7 +1,7 @@
 {
   "prog": "ellf",
   "help": "Ellf Command Line Interface.",
-  "version": "6.0.1",
+  "version": "6.0.2",
   "extra_key": "_extra",
   "commands": {
     "actions": {

{ellf_cli-6.0.2 → ellf_cli-6.0.3/ellf_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ellf-cli
-Version: 6.0.2
+Version: 6.0.3
 Summary: Ellf Command Line Interface
 Home-page: https://prodi.gy
 Author: ExplosionAI GmbH

{ellf_cli-6.0.2 → ellf_cli-6.0.3}/tests/test_login.py

@@ -1,6 +1,8 @@
 import json
 from pathlib import Path
-from unittest.mock import patch
+from types import SimpleNamespace
+from unittest.mock import MagicMock, patch
+from uuid import uuid4
 
 
 def _plugin_runtime_files(base_dir: Path) -> dict[Path, bytes]:
@@ -154,6 +156,86 @@ def test_install_claude_skills_with_packaged_plugin(tmp_path, monkeypatch):
     assert (dest / "ellf-patterns").is_dir()
 
 
+def _fake_membership(org_id, org_name="acme"):
+    return SimpleNamespace(
+        org_id=org_id,
+        org_name=org_name,
+        user_id=uuid4(),
+        is_org_admin=True,
+        is_org_developer=True,
+    )
+
+
+def _build_select_org_test(tmp_path, monkeypatch, *, jwt_oid, saved_org, chosen_org):
+    """Common scaffolding for _select_and_persist_org tests.
+
+    Patches the three module-level lookups the function depends on
+    (``select_org``, ``get_saved_settings``, ``get_root_cfg``) and returns
+    a mock ``auth`` whose ``get_api_token().header['oid']`` is ``jwt_oid``.
+    """
+    from ellf_cli.commands import general
+    from ellf_cli.config import SavedSettings
+
+    settings = SavedSettings.blank()
+    settings.org_id = saved_org
+    settings_path = tmp_path / "saved-defaults.json"
+    monkeypatch.setattr(general, "get_saved_settings", lambda: settings)
+    monkeypatch.setattr(
+        general,
+        "get_root_cfg",
+        lambda: SimpleNamespace(saved_settings_path=settings_path),
+    )
+    monkeypatch.setattr(
+        general,
+        "select_org",
+        MagicMock(return_value=_fake_membership(chosen_org)),
+    )
+
+    auth = MagicMock()
+    auth.get_api_token.return_value = SimpleNamespace(header={"oid": str(jwt_oid)})
+    return general, auth, settings, settings_path
+
+
+def test_select_and_persist_org_reissues_when_jwt_disagrees(tmp_path, monkeypatch):
+    """Regression: even if saved-defaults already names the chosen org, a
+    mismatched JWT must trigger ``/v1/token/switch-org`` so the local
+    pointer and the server-side authorization converge.
+    """
+    chosen_org = uuid4()
+    jwt_org = uuid4()  # token was issued for a different org
+    general, auth, settings, settings_path = _build_select_org_test(
+        tmp_path,
+        monkeypatch,
+        jwt_oid=jwt_org,
+        saved_org=chosen_org,  # stale pointer already at chosen
+        chosen_org=chosen_org,
+    )
+
+    result = general._select_and_persist_org(auth, chosen_org)
+
+    assert result == chosen_org
+    auth.set_active_org.assert_called_once_with(chosen_org)
+    assert settings.org_id == chosen_org
+    assert json.loads(settings_path.read_text())["org_id"] == str(chosen_org)
+
+
+def test_select_and_persist_org_skips_reissue_when_jwt_matches(tmp_path, monkeypatch):
+    """No token round-trip when the JWT already authorizes the chosen org."""
+    chosen_org = uuid4()
+    general, auth, _, _ = _build_select_org_test(
+        tmp_path,
+        monkeypatch,
+        jwt_oid=chosen_org,
+        saved_org=uuid4(),  # saved-defaults out of sync the other way
+        chosen_org=chosen_org,
+    )
+
+    result = general._select_and_persist_org(auth, chosen_org)
+
+    assert result == chosen_org
+    auth.set_active_org.assert_not_called()
+
+
 def test_install_claude_skills_leaves_existing_settings_untouched(
     tmp_path, monkeypatch
 ):