PyPI - exante-cli - Versions diffs - 1.0.29__py3-none-any.whl - Mend

exante-cli 1.0.29__py3-none-any.whl

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (33) hide show

exante_cli/__init__.py +8 -0
exante_cli/__main__.py +6 -0
exante_cli/auth.py +38 -0
exante_cli/auth_server.py +317 -0
exante_cli/cli.py +837 -0
exante_cli/client.py +261 -0
exante_cli/commands/__init__.py +2 -0
exante_cli/commands/accounts.py +99 -0
exante_cli/commands/auth_cli.py +68 -0
exante_cli/commands/config_cli.py +79 -0
exante_cli/commands/helpers.py +53 -0
exante_cli/commands/market.py +167 -0
exante_cli/commands/orders.py +394 -0
exante_cli/commands/stream.py +49 -0
exante_cli/commands/symbols.py +151 -0
exante_cli/commands/transactions.py +60 -0
exante_cli/config.py +390 -0
exante_cli/context.py +103 -0
exante_cli/device.py +32 -0
exante_cli/errors.py +183 -0
exante_cli/keystore.py +77 -0
exante_cli/output/__init__.py +87 -0
exante_cli/output/json_out.py +42 -0
exante_cli/output/table.py +136 -0
exante_cli/pkce.py +27 -0
exante_cli/repl.py +71 -0
exante_cli/urls.py +80 -0
exante_cli/util.py +45 -0
exante_cli-1.0.29.dist-info/METADATA +215 -0
exante_cli-1.0.29.dist-info/RECORD +33 -0
exante_cli-1.0.29.dist-info/WHEEL +5 -0
exante_cli-1.0.29.dist-info/entry_points.txt +2 -0
exante_cli-1.0.29.dist-info/top_level.txt +1 -0

exante_cli/__init__.py ADDED Viewed

@@ -0,0 +1,8 @@
+"""Exante CLI — Python port of the Rust terminal client.
+Trade, query, and manage an Exante account from the terminal. This package
+mirrors the behaviour of the original Rust CLI; the Rust sources in ``../src``
+remain the reference while the port is being validated.
+"""
+__version__ = "1.0.29"

exante_cli/__main__.py ADDED Viewed

@@ -0,0 +1,6 @@
+"""Allow ``python -m exante_cli`` to run the CLI."""
+from .cli import main
+if __name__ == "__main__":
+    main()

exante_cli/auth.py ADDED Viewed

@@ -0,0 +1,38 @@
+"""Exante API scopes.
+Requests are signed with HTTP Basic (``app_id:shared_secret``), so scopes are no
+longer used for signing — they are kept only as named constants that command
+modules pass to the client for documentation/symmetry. (The original Rust CLI
+also supported HS256 JWT minting; that path was dropped when the credential model
+became app_id + key only.)
+"""
+from __future__ import annotations
+class scope:
+    """Scope strings defined by the Exante API spec, grouped by resource."""
+    ACCOUNTS = "accounts"
+    SUMMARY = "summary"
+    SYMBOLS = "symbols"
+    FEED = "feed"
+    OHLC = "ohlc"
+    CROSSRATES = "crossrates"
+    CHANGE = "change"
+    ORDERS = "orders"
+    TRANSACTIONS = "transactions"
+    @staticmethod
+    def all_read() -> list[str]:
+        """Full set of read scopes (``orders`` intentionally excluded)."""
+        return [
+            scope.ACCOUNTS,
+            scope.SUMMARY,
+            scope.SYMBOLS,
+            scope.FEED,
+            scope.OHLC,
+            scope.CROSSRATES,
+            scope.CHANGE,
+            scope.TRANSACTIONS,
+        ]

exante_cli/auth_server.py ADDED Viewed

@@ -0,0 +1,317 @@
+"""`exante login` — browser login via Clients Area (PKCE + keychain).
+Implements PYTHON_LOGIN_PLAN.md. Flow:
+1. Generate a PKCE pair; only ``code_challenge`` leaves the process.
+2. Bind a one-shot HTTP server on 127.0.0.1 on a random free port.
+3. Open the browser at Clients Area with ``client_name``, ``device_name``,
+   ``code_challenge`` and the local ``redirect_url``.
+4. The user confirms; Clients Area redirects back to us with ``one_time_token``,
+   the echoed ``code_challenge``, and a ``redirect_url``. We verify the challenge
+   matches our local one.
+5. POST ``{code, one_time_token}`` to the token-exchange endpoint, verify the
+   echoed ``code_challenge`` again, then save **only** ``app_id`` + ``key.key``
+   into the system keychain — or, if no keychain backend is available (headless
+   Linux), fall back to writing them into the config file's ``[auth]`` section.
+6. Only after the keys are stored, redirect the browser back to the callback's
+   ``redirect_url`` (falling back to a local success page if none was supplied).
+The ``code`` (verifier) is never sent to the browser and never logged.
+"""
+from __future__ import annotations
+import html
+import sys
+import webbrowser
+from http.server import BaseHTTPRequestHandler, HTTPServer
+from urllib.parse import parse_qs, urlencode, urlsplit
+import httpx
+from . import config, keystore, pkce, urls
+from .device import device_name
+from .errors import AuthError
+# --- Constants (hard-coded; see §4) -----------------------------------------
+# Hard-coded application name that Clients Area shows/checks.
+CLIENT_NAME = "Exante CLI"
+# The Clients Area / token-exchange URLs are resolved per technical environment
+# from `urls.py` at flow start (see `run`), so they are not module constants.
+AUTH_TIMEOUT_SECS = 1200  # how long we wait for browser confirmation
+_EXCHANGE_TIMEOUT_SECS = 30.0
+def _client_name() -> str:
+    # Clients Area receives the app name with the CLI version appended, separated
+    # by a space (e.g. "Exante CLI 1.0.0") so it reads cleanly once URL-decoded.
+    from . import __version__
+    return f"{CLIENT_NAME} {__version__}"
+# --- Browser response pages -------------------------------------------------
+_SUCCESS_HTML = (
+    b"<!doctype html><html><head><meta charset=utf-8><title>exante-cli</title></head>"
+    b"<body style='font-family:sans-serif'><h2>Authentication successful</h2>"
+    b"<p>You can return to the terminal.</p></body></html>"
+)
+def _error_html(message: str) -> bytes:
+    safe = html.escape(message)
+    return (
+        b"<!doctype html><html><head><meta charset=utf-8><title>exante-cli</title></head>"
+        b"<body style='font-family:sans-serif'><h2>Authentication failed</h2><p>"
+        + safe.encode("utf-8")
+        + b"</p></body></html>"
+    )
+# --- One-shot callback server -----------------------------------------------
+class _CallbackServer(HTTPServer):
+    """HTTPServer carrying flow state for the handler to read/write.
+    The handler does the full token exchange + keychain save inline (so it can
+    redirect the browser back to the ``redirect_url`` Clients Area supplies only
+    after the keys are stored), hence it needs the PKCE ``verifier`` here.
+    """
+    expected_challenge: str = ""
+    verifier: str = ""
+    env: str = "live"  # trading env half of the keychain slot key
+    tech_env: str = "prod"  # technical env half of the keychain slot key
+    token_exchange_url: str = ""  # resolved from the technical env in run()
+    # Result populated by the handler once the flow completes.
+    app_id: str | None = None
+    stored_in: str = "the system keychain"  # where creds landed (keychain/config)
+    error: str | None = None
+    done: bool = False
+    timed_out: bool = False
+    def handle_timeout(self) -> None:
+        # Called by handle_request() when no request arrived within self.timeout.
+        self.timed_out = True
+class _Handler(BaseHTTPRequestHandler):
+    def do_GET(self) -> None:  # noqa: N802 (name fixed by BaseHTTPRequestHandler)
+        server: _CallbackServer = self.server  # type: ignore[assignment]
+        parsed = urlsplit(self.path)
+        # Ignore unrelated probes (favicon, etc.) without ending the wait.
+        if parsed.path not in ("/", ""):
+            self._respond(404, b"not found\n", "text/plain")
+            return
+        params = parse_qs(parsed.query)
+        # Clients Area redirects back with the one-time token, the echoed
+        # code_challenge, and a redirect_url to send the browser to afterwards.
+        one_time_token = (params.get("one_time_token") or [None])[0]
+        challenge = (params.get("code_challenge") or [None])[0]
+        return_url = (params.get("redirect_url") or [None])[0]
+        if not one_time_token or not challenge:
+            server.error = "Callback missing one_time_token or code_challenge."
+            self._respond(400, _error_html(server.error), "text/html")
+            server.done = True
+            return
+        # Binding check #1: the challenge echoed back must be our local one.
+        if challenge != server.expected_challenge:
+            server.error = (
+                "code_challenge mismatch on callback (possible spoofed redirect)."
+            )
+            self._respond(400, _error_html(server.error), "text/html")
+            server.done = True
+            return
+        # Exchange the one-time token for permanent creds and store them, THEN
+        # redirect the browser back to Clients Area's redirect_url. The browser
+        # only leaves the local page once the keys are safely in the keychain.
+        try:
+            app_id, key = _exchange(
+                server.verifier, one_time_token, challenge, server.token_exchange_url
+            )
+        except AuthError as e:
+            # Store the bare message; run() re-wraps it in AuthError, which would
+            # otherwise double the "Authentication failed:" prefix.
+            server.error = e.message
+            self._respond(400, _error_html(e.message), "text/html")
+            server.done = True
+            return
+        # Prefer the system keychain; if no backend is available (typical on
+        # headless Linux), fall back to the config file so the creds we just
+        # exchanged aren't lost. Only a keychain-write failure triggers the
+        # fallback — a config-write failure is fatal (nowhere left to store).
+        try:
+            keystore.save_key(app_id, key, server.env, server.tech_env)
+            server.stored_in = "the system keychain"
+        except AuthError:
+            try:
+                config.save_auth(app_id, key, server.env, server.tech_env)
+                server.stored_in = f"the config file ({config.config_path()})"
+            except Exception as e:  # noqa: BLE001 (surface any write failure)
+                server.error = f"Could not store credentials: {e}"
+                self._respond(400, _error_html(server.error), "text/html")
+                server.done = True
+                return
+        server.app_id = app_id
+        if return_url:
+            self._redirect(return_url)
+        else:
+            self._respond(200, _SUCCESS_HTML, "text/html")
+        server.done = True
+    def _respond(self, status: int, body: bytes, content_type: str) -> None:
+        self.send_response(status)
+        self.send_header("Content-Type", f"{content_type}; charset=utf-8")
+        self.send_header("Content-Length", str(len(body)))
+        self.send_header("Cache-Control", "no-store")
+        self.end_headers()
+        self.wfile.write(body)
+    def _redirect(self, location: str) -> None:
+        self.send_response(302)
+        self.send_header("Location", location)
+        self.send_header("Content-Length", "0")
+        self.send_header("Cache-Control", "no-store")
+        self.end_headers()
+    def log_message(self, format: str, *args) -> None:  # noqa: A002
+        # Silence the default stderr access log; keep the console clean.
+        return
+# --- Token exchange ---------------------------------------------------------
+def _exchange(
+    verifier: str, one_time_token: str, expected_challenge: str, token_exchange_url: str
+) -> tuple[str, str]:
+    """POST {code, one_time_token}, verify the echoed challenge, return (app_id, key)."""
+    try:
+        resp = httpx.post(
+            token_exchange_url,
+            json={"code": verifier, "one_time_token": one_time_token},
+            timeout=_EXCHANGE_TIMEOUT_SECS,
+        )
+    except httpx.HTTPError as e:
+        raise AuthError(f"Token exchange request failed: {e}") from e
+    if resp.status_code < 200 or resp.status_code >= 300:
+        body = resp.text[:400]
+        raise AuthError(f"Token exchange failed (HTTP {resp.status_code}): {body}")
+    try:
+        data = resp.json()
+    except ValueError as e:
+        raise AuthError(f"Token exchange returned non-JSON response: {e}") from e
+    # Binding check #2: the response must echo our local challenge.
+    if data.get("code_challenge") != expected_challenge:
+        raise AuthError("code_challenge mismatch in token-exchange response.")
+    app_id = data.get("app_id")
+    key_obj = data.get("key") or {}
+    key = key_obj.get("key") if isinstance(key_obj, dict) else None
+    if not app_id or not key:
+        raise AuthError("Token exchange response missing app_id or key.")
+    return app_id, key
+# --- Entry point ------------------------------------------------------------
+def run(
+    *,
+    open_browser: bool = True,
+    env: str = "live",
+    tech_env: str = urls.DEFAULT_TECH_ENV,
+) -> None:
+    from . import client
+    # The technical env selects which deployment's URLs we use for this flow.
+    endpoints = urls.endpoints_for(tech_env)
+    verifier = pkce.generate_verifier()
+    challenge = pkce.challenge_from_verifier(verifier)
+    # Port 0 asks the OS for a free port; listen on loopback only.
+    server = _CallbackServer(("127.0.0.1", 0), _Handler)
+    server.expected_challenge = challenge
+    server.verifier = verifier
+    server.env = client.parse_env(env)
+    server.tech_env = tech_env
+    server.token_exchange_url = endpoints.token_exchange_url
+    port = server.server_address[1]
+    # Where Clients Area sends the callback (our one-shot local server). This is
+    # distinct from the `redirect_url` Clients Area later echoes back to us, which
+    # is where we send the browser once the keys are saved.
+    local_redirect_url = f"http://127.0.0.1:{port}"
+    # Selected environment, encoded the way Clients Area expects: live=0, demo=1.
+    env_code = client.env_code(env)
+    query = urlencode(
+        {
+            "client_name": _client_name(),
+            "device_name": device_name(),
+            "code_challenge": challenge,
+            "redirect_url": local_redirect_url,
+            "env": env_code,
+        }
+    )
+    clients_area_url = endpoints.clients_area_auth_url
+    sep = "&" if "?" in clients_area_url else "?"
+    auth_url = f"{clients_area_url}{sep}{query}"
+    print(
+        f"Opening Clients Area to authorize this device ({env}, env={env_code}):",
+        file=sys.stderr,
+    )
+    print(f"  {auth_url}", file=sys.stderr)
+    opened = False
+    if open_browser:
+        try:
+            opened = webbrowser.open(auth_url)
+        except Exception:
+            opened = False
+    if not opened:
+        print(
+            "Could not open a browser automatically — copy the URL above into your browser.",
+            file=sys.stderr,
+        )
+    print("Waiting for confirmation in the browser...", file=sys.stderr)
+    # Single expected callback; loop so unrelated probes don't end the wait.
+    server.timeout = AUTH_TIMEOUT_SECS
+    try:
+        while not server.done:
+            server.handle_request()  # processes one request, or times out
+            if server.timed_out:
+                raise AuthError("Timed out waiting for browser confirmation.")
+    except KeyboardInterrupt:
+        raise AuthError("Authentication cancelled.")
+    finally:
+        server.server_close()
+    if server.error:
+        raise AuthError(server.error)
+    if not server.app_id:
+        raise AuthError("Timed out waiting for browser confirmation.")
+    print(
+        f"Authentication successful. Credentials stored in {server.stored_in} for '{env}'.",
+        file=sys.stderr,
+    )