ermes-cli 1.0.0__py3-none-any.whl

ermes_cli/commands/auth_cmds.py

@@ -0,0 +1,386 @@
+"""`ermes login` / `ermes logout` — Auth0 device-flow auth + project discovery."""
+
+from __future__ import annotations
+
+import re
+import socket
+
+import keyring
+import typer
+from rich.console import Console
+from rich.table import Table
+
+from ermes_cli import admin_api, auth0, keyring_store
+from ermes_cli.config import (
+    DEFAULT_BASE_URL,
+    ConfigError,
+    clear_projects_file,
+    get_active_project_id,
+    get_base_url,
+    load_projects_file,
+    save_projects_file,
+)
+
+console = Console(stderr=True)
+
+
+def _on_user_code(code: auth0.DeviceCode) -> None:
+    """Show the Auth0 device code prompt before opening the browser."""
+    console.print()
+    console.print("[bold cyan]Sign in to Ermes via Auth0[/bold cyan]")
+    console.print(f"  user code:        [bold]{code.user_code}[/bold]")
+    console.print(f"  verification URL: {code.verification_uri_complete}")
+    console.print(
+        "  [dim]Opening your browser… if it doesn't open, paste the URL above.[/dim]"
+    )
+    console.print()
+
+
+def _bootstrap_projects(
+    base_url: str, ermes_jwt: str, admin_email: str | None = None
+) -> tuple[list[admin_api.ProjectSummary], dict[int, admin_api.ProjectKey]]:
+    """Enumerate all projects; keep already-cached per-admin keys.
+
+    Login no longer mints a key on every project (that left 9 hosts holding
+    admin keys to all 240 prod projects — DEV-1136). Keys are provisioned
+    lazily by `ensure_project_key()` on first use. Cached keys survive a
+    re-sync, except legacy shared `cli-managed-<host>` keys, which are
+    dropped so the next use mints a per-admin key. Cached keys are also
+    dropped wholesale when the identity or host changed: a key minted for
+    another admin, or against another Ermes host, must not survive a login.
+    """
+    projects = admin_api.list_all_projects(base_url, ermes_jwt)
+    stored = load_projects_file()
+    same_identity = (
+        (admin_email is None or stored.get("auth0_email") in (None, admin_email))
+        and str(stored.get("base_url") or base_url).rstrip("/") == base_url.rstrip("/")
+    )
+    # Read the cache from the same dict the identity check used, not from disk again.
+    cached = {int(k): v for k, v in (stored.get("projects") or {}).items()} if same_identity else {}
+    keys: dict[int, admin_api.ProjectKey] = {}
+    for project in projects:
+        prev = cached.get(project.id) or {}
+        name = str(prev.get("api_key_name") or "")
+        if prev.get("api_key") and not name.startswith("cli-managed-"):
+            keys[project.id] = admin_api.ProjectKey(
+                id=int(prev.get("api_key_id") or 0),
+                name=name,
+                value=str(prev["api_key"]),
+                scope="secret",
+                role=str(prev.get("role") or ""),
+            )
+    return projects, keys
+
+
+def _hostname() -> str:
+    """Server accepts ^[A-Za-z0-9._-]{1,64}$ for the key name suffix."""
+    return re.sub(r"[^A-Za-z0-9._-]", "-", socket.gethostname())[:64] or "unknown-host"
+
+
+def ensure_project_key(project_id: int) -> str:
+    """Return the cached CLI key for `project_id`, minting it on first use.
+
+    Raises `ConfigError` (never SystemExit — the MCP server calls this too)
+    when there is no Auth0 session or the server refuses.
+    """
+    payload = load_projects_file()
+    projects = payload.get("projects") or {}
+    # pop both spellings so a str-keyed YAML entry never leaves a duplicate
+    proj = projects.pop(project_id, None) or projects.pop(str(project_id), None) or {}
+    if proj.get("api_key"):
+        return str(proj["api_key"])
+    try:
+        api_base, result = _ensure_admin_session()
+        key = admin_api.create_cli_key(
+            api_base, result.ermes_access_token, project_id, _hostname()
+        )
+    except typer.Exit:
+        raise ConfigError("Not logged in. Run `ermes login` first.")
+    except admin_api.AdminAPIError as exc:
+        raise ConfigError(f"Could not provision a CLI key for project {project_id}: {exc}")
+    proj.update({"api_key": key.value, "api_key_id": key.id, "api_key_name": key.name})
+    projects[project_id] = proj
+    payload["projects"] = projects
+    try:
+        save_projects_file(payload)
+    except OSError as exc:
+        raise ConfigError(f"Could not write {exc.filename or 'projects.yml'}: {exc.strerror}")
+    console.print(f"[green]+[/green] Provisioned CLI key `{key.name}` for project {project_id}.")
+    return key.value
+
+
+def _write_projects_file(
+    base_url: str,
+    auth0_email: str | None,
+    organization_id: int,
+    projects: list[admin_api.ProjectSummary],
+    keys: dict[int, admin_api.ProjectKey],
+    active_project_id: int | None,
+) -> None:
+    """Persist projects.yml. Preserve the prior active project if it still exists."""
+    payload: dict = {
+        "auth0_email": auth0_email,
+        "base_url": base_url,
+        "organization_id": organization_id,
+        "active_project": active_project_id,
+        "projects": {},
+    }
+    for project in projects:
+        key = keys.get(project.id)
+        payload["projects"][project.id] = {
+            "name": project.name,
+            "role": project.role,
+            "organization_id": organization_id,
+            "api_key": key.value if key else None,
+            "api_key_id": key.id if key else None,
+            "api_key_name": key.name if key else None,
+        }
+    save_projects_file(payload)
+
+
+def _ensure_admin_session(
+    base_url: str | None = None,
+) -> tuple[str, admin_api.ExchangeResult]:
+    """Return `(api_base, exchange_result)` using cached Auth0 tokens.
+
+    Loads the keychain bundle, transparently refreshes the Auth0 access token
+    via the cached refresh_token when it has expired, then exchanges it for an
+    Ermes admin JWT via `/api/cli/exchange`. Exits (code 1) with an actionable
+    message when the user isn't logged in, the refresh token is dead, or the
+    exchange fails. `base_url` overrides projects.yml's cached base URL.
+    """
+    api_base = base_url or get_base_url()
+    _require_https(api_base)
+    bundle = keyring_store.load()
+    if bundle is None:
+        console.print("[red]Not logged in.[/red] Run `ermes login` first.")
+        raise typer.Exit(code=1)
+    if bundle.base_url and bundle.base_url.rstrip("/") != api_base.rstrip("/"):
+        # The id_token would otherwise be handed to whichever host --base-url names.
+        console.print(
+            f"[red]Logged in to {bundle.base_url}, not {api_base}.[/red] "
+            f"Run `ermes login --base-url {api_base}` to use this host."
+        )
+        raise typer.Exit(code=1)
+
+    if bundle.is_expired():
+        if not bundle.refresh_token:
+            console.print(
+                "[red]Auth0 token expired and no refresh token cached.[/red] "
+                "Run `ermes login` again."
+            )
+            raise typer.Exit(code=1)
+        try:
+            refreshed = auth0.refresh_access_token(bundle.refresh_token)
+            refreshed.base_url = bundle.base_url
+            bundle = refreshed
+            keyring_store.save(bundle)
+            console.print("[green]✓[/green] Refreshed Auth0 access token.")
+        except auth0.AuthError as exc:
+            console.print(
+                f"[red]Refresh failed:[/red] {exc}. "
+                "Run `ermes login` to re-authenticate."
+            )
+            raise typer.Exit(code=1)
+
+    try:
+        result = admin_api.exchange_auth0_token(
+            api_base, bundle.access_token, id_token=bundle.id_token or None
+        )
+    except admin_api.AdminAPIError as exc:
+        console.print(f"[red]Ermes exchange failed:[/red] {exc}")
+        raise typer.Exit(code=1)
+
+    return api_base, result
+
+
+def _require_https(base_url: str) -> None:
+    """Auth0 id_tokens and the minted sk_ keys travel to this host; refuse plaintext
+    except for a local dev stack."""
+    from urllib.parse import urlparse
+
+    parsed = urlparse(base_url)
+    # urllib3 reads `http://evil.example\\@localhost` as host evil.example while
+    # urlparse says localhost; no Ermes URL carries userinfo, so refuse both outright.
+    if "@" in parsed.netloc or "\\" in base_url:
+        console.print(f"[red]--base-url must not contain credentials or backslashes:[/red] {base_url}")
+        raise typer.Exit(code=1)
+    if parsed.scheme == "https" or (
+        parsed.scheme == "http" and parsed.hostname in ("localhost", "127.0.0.1", "::1")
+    ):
+        return
+    console.print(f"[red]--base-url must use https:[/red] {base_url}")
+    raise typer.Exit(code=1)
+
+
+def login(
+    base_url: str = typer.Option(
+        DEFAULT_BASE_URL,
+        "--base-url",
+        help="Ermes API base URL. Defaults to production.",
+        show_default=True,
+    ),
+    open_browser: bool = typer.Option(
+        True,
+        "--open-browser/--no-open-browser",
+        help="Open the Auth0 verification URL in the default browser.",
+    ),
+) -> None:
+    """Authenticate via Auth0 device flow + auto-discover your Ermes projects.
+
+    What this does:
+      1. Starts an Auth0 device flow against the shared `dev-hqiwr-re` tenant.
+      2. Stores the resulting Auth0 tokens in your OS keychain (`ermes-cli` service).
+      3. Trades the Auth0 access token for an Ermes admin JWT via /api/cli/exchange.
+      4. Calls /api/admin/projects/all to enumerate every project you can see.
+      5. Caches the list in `~/.ermes/projects.yml` (chmod 600).
+
+    A per-admin, per-host `sk_` key is provisioned for a project the first
+    time you use it (`ermes use`, `ERMES_PROJECT=…`) — never for every project.
+    """
+    _require_https(base_url)
+    try:
+        bundle = auth0.device_login(
+            open_browser=open_browser,
+            on_user_code=_on_user_code,
+        )
+    except auth0.AuthError as exc:
+        console.print(f"[red]Auth0 login failed:[/red] {exc}")
+        raise typer.Exit(code=1)
+
+    bundle.base_url = base_url
+    keyring_store.save(bundle)
+    console.print("[green]✓[/green] Auth0 tokens stored in OS keychain.")
+
+    try:
+        result = admin_api.exchange_auth0_token(
+            base_url, bundle.access_token, id_token=bundle.id_token or None
+        )
+    except admin_api.AdminAPIError as exc:
+        console.print(f"[red]Ermes exchange failed:[/red] {exc}")
+        raise typer.Exit(code=1)
+
+    console.print(
+        f"[green]✓[/green] Logged in as [bold]{result.admin_email}[/bold] "
+        f"(org {result.organization_id}, role {result.role})."
+    )
+    stored = load_projects_file()
+    if stored and (
+        stored.get("auth0_email") != result.admin_email
+        or str(stored.get("base_url") or "").rstrip("/") != base_url.rstrip("/")
+    ):
+        # The keyring now holds this admin's tokens; the previous admin's cached
+        # keys must not outlive the login even if discovery stops early.
+        clear_projects_file()
+    console.print()
+    console.print("[bold]Discovering projects…[/bold]")
+
+    try:
+        projects, keys = _bootstrap_projects(base_url, result.ermes_access_token, result.admin_email)
+    except admin_api.AdminAPIError as exc:
+        console.print(f"[red]Project discovery failed:[/red] {exc}")
+        raise typer.Exit(code=1)
+
+    prior_active = get_active_project_id()
+    active_id = (
+        prior_active if prior_active in {p.id for p in projects} else (projects[0].id if projects else None)
+    )
+
+    # Written even when empty: a stale projects.yml must not outlive a login
+    # that no longer grants those projects.
+    _write_projects_file(
+        base_url=base_url,
+        auth0_email=result.admin_email,
+        organization_id=result.organization_id,
+        projects=projects,
+        keys=keys,
+        active_project_id=active_id,
+    )
+    if not projects:
+        console.print(
+            "[yellow]No projects found for this admin.[/yellow] "
+            "Visit the Ermes UI to create one, then re-run `ermes login`."
+        )
+        raise typer.Exit(code=0)
+
+    console.print()
+    table = Table(title=f"{len(projects)} project(s) cached at ~/.ermes/projects.yml")
+    table.add_column("ID", justify="right")
+    table.add_column("Name")
+    table.add_column("Role")
+    table.add_column("Active")
+    for p in projects:
+        table.add_row(str(p.id), p.name, p.role, "★" if p.id == active_id else "")
+    console.print(table)
+    console.print(
+        f"\nActive project: [bold]{next(p.name for p in projects if p.id == active_id)}[/bold] "
+        f"(id={active_id}). Switch with `ermes use <name-or-id>`. "
+        "Keys are provisioned per project on first use."
+    )
+
+
+def logout() -> None:
+    """Forget Auth0 tokens + cached projects. Legacy ~/.ermes/config.yml is preserved."""
+    bundle = keyring_store.load()
+    if bundle is not None and bundle.refresh_token and not auth0.revoke_refresh_token(bundle.refresh_token):
+        console.print("[yellow]Could not revoke the refresh token at Auth0; it expires on its own.[/yellow]")
+    try:
+        keyring_store.clear()
+    except keyring.errors.KeyringError as exc:
+        console.print(f"[red]Could not remove the Auth0 tokens from the keyring:[/red] {exc}")
+        raise typer.Exit(code=1)
+    finally:
+        clear_projects_file()
+    console.print("[green]✓[/green] Cleared Auth0 tokens + projects.yml.")
+    console.print(
+        "[dim]Legacy ~/.ermes/config.yml profiles are unchanged. "
+        "Remove them with `ermes config remove <name>` if desired.[/dim]"
+    )
+
+
+def refresh_projects(
+    base_url: str = typer.Option(
+        None,
+        "--base-url",
+        help="Override the API base URL (defaults to projects.yml's value).",
+    ),
+) -> None:
+    """Re-sync projects.yml from the API using the cached Auth0 token.
+
+    Useful when an admin has added you to a new project or revoked an
+    existing key. If the Auth0 access token has expired, this command
+    automatically refreshes it via the cached refresh_token. If the
+    refresh_token itself has expired or been revoked, you'll be told to
+    re-run `ermes login`.
+    """
+    api_base, result = _ensure_admin_session(base_url)
+
+    console.print(f"[green]✓[/green] Authenticated as {result.admin_email}.")
+    console.print("[bold]Re-syncing projects…[/bold]")
+
+    try:
+        projects, keys = _bootstrap_projects(api_base, result.ermes_access_token, result.admin_email)
+    except admin_api.AdminAPIError as exc:
+        console.print(f"[red]Project discovery failed:[/red] {exc}")
+        raise typer.Exit(code=1)
+
+    prior_active = get_active_project_id()
+    active_id = (
+        prior_active if prior_active in {p.id for p in projects} else (projects[0].id if projects else None)
+    )
+
+    _write_projects_file(
+        base_url=api_base,
+        auth0_email=result.admin_email,
+        organization_id=result.organization_id,
+        projects=projects,
+        keys=keys,
+        active_project_id=active_id,
+    )
+    if not projects:
+        console.print("[yellow]No projects found for this admin.[/yellow]")
+        raise typer.Exit(code=0)
+    console.print(
+        f"[green]✓[/green] Cached {len(projects)} project(s). Active: "
+        f"{next(p.name for p in projects if p.id == active_id)} (id={active_id})."
+    )