flexitracker 0.2.1.dev0__tar.gz → 0.3.0__tar.gz

{flexitracker-0.2.1.dev0 → flexitracker-0.3.0}/.gitignore

@@ -18,3 +18,6 @@ daemon-py/build/
 # Screenshots / MCP artifacts
 .playwright-mcp/
 /*.png
+
+# Personal activity export (migrated into PROD, not for the repo)
+/events.txt

{flexitracker-0.2.1.dev0 → flexitracker-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: flexitracker
-Version: 0.2.1.dev0
+Version: 0.3.0
 Summary: FlexiTracker activity daemon — pure-Python.
 License-Expression: MIT
 Requires-Python: >=3.11
@@ -31,9 +31,10 @@ Windows SmartScreen trust step.
 ## Use
 
 ```bash
-flexitracker configure --key <ACCESS_KEY>   # authorize this machine, then self-test
-flexitracker test                            # connectivity check, sends no data
-flexitracker                                 # run the daemon
+flexitracker login                          # authorize this machine in a browser, then self-test
+flexitracker login --key <ACCESS_KEY>       # headless/scripted: authorize with a pasted key instead
+flexitracker test                           # connectivity check, sends no data
+flexitracker                                # run the daemon
 ```
 
 ## Develop

{flexitracker-0.2.1.dev0 → flexitracker-0.3.0}/README.md

@@ -23,9 +23,10 @@ Windows SmartScreen trust step.
 ## Use
 
 ```bash
-flexitracker configure --key <ACCESS_KEY>   # authorize this machine, then self-test
-flexitracker test                            # connectivity check, sends no data
-flexitracker                                 # run the daemon
+flexitracker login                          # authorize this machine in a browser, then self-test
+flexitracker login --key <ACCESS_KEY>       # headless/scripted: authorize with a pasted key instead
+flexitracker test                           # connectivity check, sends no data
+flexitracker                                # run the daemon
 ```
 
 ## Develop

{flexitracker-0.2.1.dev0 → flexitracker-0.3.0}/install/README.md

@@ -8,10 +8,15 @@ it works on managed machines that block unsigned executables.
 
 ```bash
 uv tool install flexitracker
-flexitracker configure --key <YOUR_ACCESS_KEY>
+flexitracker login
 flexitracker test
 ```
 
+`login` opens your browser to authorize the machine — sign in, approve, and the
+key lands in the config automatically; you never see or paste it. On a
+headless or scripted box, use `flexitracker login --key <YOUR_ACCESS_KEY>`
+with a key from the web UI's "Add machine" button instead.
+
 Then enable auto-start on login:
 
 - **Linux:** `./install.sh` (installs a systemd *user* service).
@@ -25,7 +30,7 @@ If your machine permits running executables, download the standalone
 **Releases** page — it bundles its own Python runtime, so nothing else is needed.
 
 ```bat
-flexitracker.exe configure --key <YOUR_ACCESS_KEY>
+flexitracker.exe login
 flexitracker.exe test
 ```
 

{flexitracker-0.2.1.dev0 → flexitracker-0.3.0}/src/flexitracker/_backend.py

@@ -2,7 +2,7 @@
 
 Mirrors the Rust `option_env!("FLEXITRACKER_BACKEND_URL")`: the release pipeline
 rewrites `BAKED_BACKEND_URL` (from the PROD_BASE_URL variable) so a user runs only
-`flexitracker configure --key <KEY>`. The `FLEXITRACKER_BACKEND_URL` environment
+`flexitracker login`. The `FLEXITRACKER_BACKEND_URL` environment
 variable overrides it, and `--backend-url` overrides both.
 """
 

{flexitracker-0.2.1.dev0 → flexitracker-0.3.0}/src/flexitracker/cli.py

@@ -1,8 +1,9 @@
 """CLI + daemon loop.
 
 Fail-fast: unexpected conditions exit with a clear message rather than being
-silently absorbed. Subcommands: `configure` (authorize + self-test), `test`
-(connectivity check, sends no data), and the default daemon run.
+silently absorbed. Subcommands: `login` (authorize + self-test, browser by
+default or `--key` for headless/scripted setups), `test` (connectivity check,
+sends no data), and the default daemon run.
 """
 
 from __future__ import annotations
@@ -18,7 +19,8 @@ from typing import Optional
 from ._backend import default_backend_url
 from .config import Config
 from .core import machine_descriptor
-from .idle import Sample, SimulatedIdle, platform_source
+from .idle import Sample, platform_source
+from .login import LoginError, browser_login
 from .outbox import Outbox
 from .sender import SenderError, fetch_thresholds, post_batch, whoami
 from .state_machine import Persisted, StateMachine, Tick
@@ -26,12 +28,14 @@ from .state_machine import Persisted, StateMachine, Tick
 HELP = """flexitracker — activity tracking daemon
 
 USAGE:
-    flexitracker configure [--key KEY] [--backend-url URL]   Authorize this machine
+    flexitracker login [--name LABEL] [--backend-url URL]    Authorize this machine (opens a browser)
+    flexitracker login --key KEY [--backend-url URL]         Authorize with a pasted key (no browser)
     flexitracker test                                        Check connectivity (sends no data)
     flexitracker [OPTIONS]                                   Run the daemon
 
 OPTIONS:
-    --key, --account-key KEY   Per-machine access key (saved to config)
+    --key, --account-key KEY   Per-machine access key for `login --key` (saved to config)
+    --name LABEL        Machine label for the browser `login` flow (default: hostname)
     --backend-url URL   Backend base URL (defaults to the built-in one)
     --config PATH       Config file path (default: ~/.config/flexitracker/config.toml)
     --simulate          Post a synthetic day through the real pipeline and exit
@@ -59,8 +63,9 @@ def machine_desc() -> dict:
 
 class Args:
     def __init__(self) -> None:
-        self.cmd = "daemon"  # daemon | configure | test
+        self.cmd = "daemon"  # daemon | login | test
         self.account_key: Optional[str] = None
+        self.name: Optional[str] = None
         self.backend_url: Optional[str] = None
         self.config_path: Optional[Path] = None
         self.simulate = False
@@ -78,12 +83,14 @@ def parse_args(argv: list) -> Args:
             raise ValueError(f"{flag} requires a value")
 
     for arg in it:
-        if arg == "configure":
-            a.cmd = "configure"
+        if arg == "login":
+            a.cmd = "login"
         elif arg in ("test", "--check"):
             a.cmd = "test"
         elif arg in ("--account-key", "--key"):
             a.account_key = take(arg)
+        elif arg == "--name":
+            a.name = take(arg)
         elif arg == "--backend-url":
             a.backend_url = take(arg)
         elif arg == "--config":
@@ -105,12 +112,6 @@ def parse_args(argv: list) -> Args:
     return a
 
 
-def prompt(msg: str) -> str:
-    sys.stdout.write(msg)
-    sys.stdout.flush()
-    return sys.stdin.readline().strip()
-
-
 def self_test(cfg: Config) -> int:
     print(f"Contacting {cfg.backend_url} …")
     try:
@@ -215,28 +216,40 @@ def run(argv: list) -> int:
     if not cfg.backend_url:
         cfg.backend_url = default_backend_url()
 
-    if args.cmd == "configure":
-        if not cfg.access_key:
-            cfg.access_key = prompt("Paste your machine access key: ")
-        if not cfg.access_key:
-            print("error: no access key provided", file=sys.stderr)
-            return 1
+    if args.cmd == "login":
         if not cfg.backend_url:
             print("error: no backend url (pass --backend-url; releases have one built in)", file=sys.stderr)
             return 1
+        if args.account_key:
+            # Manual/headless form: cfg.access_key is already set above from
+            # args.account_key. No browser involved.
+            cfg.save(config_path)
+            print(f"Saved config to {config_path}.")
+            return self_test(cfg)
+        # Default: browser-based device authorization. No key is ever entered
+        # or displayed — a failure here leaves config untouched (nothing is
+        # saved until browser_login returns successfully).
+        label = args.name or machine_desc()["hostname"]
+        try:
+            access_key, machine_id = browser_login(cfg.backend_url, label)
+        except LoginError as e:
+            print(f"error: login failed: {e}", file=sys.stderr)
+            return 1
+        cfg.access_key = access_key
+        cfg.machine_id = machine_id
         cfg.save(config_path)
         print(f"Saved config to {config_path}.")
         return self_test(cfg)
 
     if args.cmd == "test":
         if not cfg.access_key or not cfg.backend_url:
-            print("error: not configured — run `flexitracker configure --key <KEY>` first", file=sys.stderr)
+            print("error: not configured — run `flexitracker login` first", file=sys.stderr)
             return 1
         return self_test(cfg)
 
     # Daemon
     if not cfg.access_key or not cfg.backend_url:
-        print("error: missing access key or backend url (run `flexitracker configure --key <KEY>`)", file=sys.stderr)
+        print("error: missing access key or backend url (run `flexitracker login`)", file=sys.stderr)
         return 1
     cfg.save(config_path)
 

flexitracker-0.3.0/src/flexitracker/login.py

@@ -0,0 +1,106 @@
+"""Browser-based device-authorization login (the `login` command's default flow).
+
+Loopback pattern (`gh auth login --web` / `wrangler login`): bind an ephemeral
+listener on 127.0.0.1, open the backend's /device/authorize in the system
+browser, and receive a one-time authorization code back over the loopback
+redirect. The code is then exchanged for the access key at /device/token — the
+key itself never appears in a URL, not even a loopback one.
+"""
+
+from __future__ import annotations
+
+import http.server
+import secrets
+import threading
+import webbrowser
+from typing import Callable, Optional
+from urllib.parse import parse_qs, urlencode, urlparse
+
+from . import sender
+
+LOGIN_TIMEOUT_SEC = 180
+
+
+class LoginError(Exception):
+    pass
+
+
+class _Result:
+    def __init__(self) -> None:
+        self.code: Optional[str] = None
+        self.error: Optional[str] = None
+
+
+def _handler_factory(result: _Result, expected_state: str, done: threading.Event):
+    class Handler(http.server.BaseHTTPRequestHandler):
+        def do_GET(self) -> None:  # noqa: N802 (stdlib-mandated method name)
+            qs = parse_qs(urlparse(self.path).query)
+            state = (qs.get("state") or [None])[0]
+            code = (qs.get("code") or [None])[0]
+            if state != expected_state:
+                result.error = "callback state mismatch"
+            elif not code:
+                result.error = "no authorization code in callback"
+            else:
+                result.code = code
+            self.send_response(200)
+            self.send_header("Content-Type", "text/html; charset=utf-8")
+            self.end_headers()
+            msg = (
+                "Authorization failed — you can close this tab."
+                if result.error
+                else "FlexiTracker authorized — you can close this tab."
+            )
+            self.wfile.write(msg.encode("utf-8"))
+            done.set()
+
+        def log_message(self, *args) -> None:  # silence default stderr request logging
+            pass
+
+    return Handler
+
+
+def browser_login(
+    backend_url: str,
+    label: str,
+    *,
+    open_browser: Callable[[str], bool] = webbrowser.open,
+    timeout_sec: int = LOGIN_TIMEOUT_SEC,
+) -> tuple[str, str]:
+    """Run the loopback authorization handshake. Returns (access_key, machine_id).
+
+    Raises LoginError on timeout, a state mismatch, a missing/failed callback,
+    or a bad token exchange — in every failure case, no config has been
+    written (the caller only writes config on a successful return).
+    """
+    state = secrets.token_urlsafe(24)
+    result = _Result()
+    done = threading.Event()
+    server = http.server.HTTPServer(("127.0.0.1", 0), _handler_factory(result, state, done))
+    port = server.server_address[1]
+    thread = threading.Thread(target=server.handle_request, daemon=True)
+    thread.start()
+
+    url = (
+        f"{backend_url.rstrip('/')}/device/authorize?"
+        + urlencode({"label": label, "cb": f"127.0.0.1:{port}", "state": state})
+    )
+    print(f"Opening browser to authorize: {url}")
+    if not open_browser(url):
+        print("Could not open a browser automatically — open this URL manually:")
+        print(url)
+
+    finished = done.wait(timeout_sec)
+    server.server_close()
+    if not finished:
+        raise LoginError(f"timed out after {timeout_sec}s waiting for browser approval")
+    if result.error:
+        raise LoginError(result.error)
+    assert result.code is not None  # error is always set above when code is falsy
+
+    data = sender.device_token(backend_url, result.code)
+    access_key = data.get("access_key")
+    machine_id = data.get("machine_id")
+    if not access_key or not machine_id:
+        raise LoginError("malformed token response from backend")
+    return access_key, machine_id

{flexitracker-0.2.1.dev0 → flexitracker-0.3.0}/src/flexitracker/sender.py

@@ -20,9 +20,11 @@ class SenderError(Exception):
     pass
 
 
-def _request(url: str, key: str, method: str, body: Optional[dict]) -> dict:
+def _request(url: str, key: Optional[str], method: str, body: Optional[dict]) -> dict:
     data = None
-    headers = {"authorization": f"Bearer {key}"}
+    headers = {}
+    if key:
+        headers["authorization"] = f"Bearer {key}"
     if body is not None:
         data = json.dumps(body).encode("utf-8")
         headers["content-type"] = "application/json"
@@ -81,6 +83,20 @@ def whoami(base: str, key: str) -> WhoAmI:
     )
 
 
+def device_token(base: str, code: str) -> dict:
+    """Exchange a one-time device-authorization code for the minted access key
+    (the `login` browser flow's final step). No access key is sent — the code
+    itself is the authorization; the endpoint is Access-bypassed like /ingest.
+    """
+    url = f"{base.rstrip('/')}/device/token"
+    try:
+        return _request(url, None, "POST", {"code": code})
+    except urllib.error.HTTPError as e:
+        raise SenderError(f"server returned {e.code}") from e
+    except urllib.error.URLError as e:
+        raise SenderError(str(e.reason)) from e
+
+
 def fetch_thresholds(base: str, key: str, poll_sec: int) -> ThresholdCfg:
     """Fetch current thresholds from the backend (keeps the caller's poll)."""
     url = f"{base.rstrip('/')}/config"

flexitracker-0.3.0/tests/test_cli.py

@@ -0,0 +1,82 @@
+import pytest
+
+from flexitracker import cli as cli_mod
+from flexitracker.cli import parse_args, run
+from flexitracker.config import Config
+from flexitracker.login import LoginError
+
+
+def test_configure_is_no_longer_a_recognized_command():
+    with pytest.raises(ValueError, match="unknown argument: configure"):
+        parse_args(["configure"])
+
+
+def test_login_with_key_writes_config_without_a_browser(tmp_path, monkeypatch):
+    called = []
+    monkeypatch.setattr(cli_mod, "browser_login", lambda *a, **k: called.append(1) or ("AK", "MID"))
+    monkeypatch.setattr(cli_mod, "self_test", lambda cfg: 0)
+    config_path = tmp_path / "config.toml"
+    rc = run(
+        [
+            "login",
+            "--key",
+            "PASTED-KEY",
+            "--backend-url",
+            "https://backend.example",
+            "--config",
+            str(config_path),
+        ]
+    )
+    assert rc == 0
+    assert called == []  # the browser flow was never invoked
+    saved = Config.load(config_path)
+    assert saved.access_key == "PASTED-KEY"
+    assert saved.backend_url == "https://backend.example"
+
+
+def test_login_browser_flow_writes_config_and_runs_self_test(tmp_path, monkeypatch):
+    monkeypatch.setattr(cli_mod, "browser_login", lambda backend_url, label: ("BROWSER-KEY", "BROWSER-MID"))
+    ran_self_test = []
+    monkeypatch.setattr(cli_mod, "self_test", lambda cfg: ran_self_test.append(cfg.access_key) or 0)
+    config_path = tmp_path / "config.toml"
+    rc = run(["login", "--backend-url", "https://backend.example", "--config", str(config_path)])
+    assert rc == 0
+    assert ran_self_test == ["BROWSER-KEY"]
+    saved = Config.load(config_path)
+    assert saved.access_key == "BROWSER-KEY"
+    assert saved.machine_id == "BROWSER-MID"
+
+
+def test_login_name_flag_is_passed_as_the_label(tmp_path, monkeypatch):
+    seen = []
+
+    def fake_browser_login(backend_url, label):
+        seen.append(label)
+        return "K", "M"
+
+    monkeypatch.setattr(cli_mod, "browser_login", fake_browser_login)
+    monkeypatch.setattr(cli_mod, "self_test", lambda cfg: 0)
+    config_path = tmp_path / "config.toml"
+    run(
+        [
+            "login",
+            "--name",
+            "Work laptop",
+            "--backend-url",
+            "https://backend.example",
+            "--config",
+            str(config_path),
+        ]
+    )
+    assert seen == ["Work laptop"]
+
+
+def test_login_browser_failure_writes_no_config(tmp_path, monkeypatch):
+    def boom(*a, **k):
+        raise LoginError("timed out after 180s waiting for browser approval")
+
+    monkeypatch.setattr(cli_mod, "browser_login", boom)
+    config_path = tmp_path / "config.toml"
+    rc = run(["login", "--backend-url", "https://backend.example", "--config", str(config_path)])
+    assert rc == 1
+    assert not config_path.exists()

flexitracker-0.3.0/tests/test_login.py

@@ -0,0 +1,80 @@
+import threading
+import urllib.request
+from urllib.parse import parse_qs, urlparse
+
+import pytest
+
+from flexitracker import login as login_mod
+from flexitracker.login import LoginError, browser_login
+
+
+def _fake_open_browser(*, state_override=None, hit=True):
+    """An open_browser stand-in that (optionally) hits the loopback callback
+    URL embedded in the authorize URL it's given, from a background thread —
+    mimicking the browser completing (or not completing) the approval."""
+
+    def opener(url: str) -> bool:
+        if not hit:
+            return True  # pretend the browser opened, but the user never approves
+        qs = parse_qs(urlparse(url).query)
+        cb = qs["cb"][0]
+        state = state_override if state_override is not None else qs["state"][0]
+        callback_url = f"http://{cb}/?code=the-code&state={state}"
+
+        def hit_callback() -> None:
+            try:
+                urllib.request.urlopen(callback_url, timeout=5)  # noqa: S310
+            except OSError:
+                pass
+
+        threading.Thread(target=hit_callback, daemon=True).start()
+        return True
+
+    return opener
+
+
+def test_successful_exchange_returns_key_and_machine_id(monkeypatch):
+    monkeypatch.setattr(
+        login_mod.sender,
+        "device_token",
+        lambda base, code: {"access_key": "AK", "machine_id": "MID"} if code == "the-code" else {},
+    )
+    access_key, machine_id = browser_login(
+        "https://backend.example", "Work laptop", open_browser=_fake_open_browser(), timeout_sec=5
+    )
+    assert access_key == "AK"
+    assert machine_id == "MID"
+
+
+def test_state_mismatch_is_rejected(monkeypatch):
+    exchanged = []
+    monkeypatch.setattr(login_mod.sender, "device_token", lambda *a: exchanged.append(a) or {})
+    with pytest.raises(LoginError, match="state mismatch"):
+        browser_login(
+            "https://backend.example",
+            "Work laptop",
+            open_browser=_fake_open_browser(state_override="wrong-state"),
+            timeout_sec=5,
+        )
+    assert exchanged == []  # a rejected callback must never reach the token exchange
+
+
+def test_timeout_raises_and_never_exchanges(monkeypatch):
+    exchanged = []
+    monkeypatch.setattr(login_mod.sender, "device_token", lambda *a: exchanged.append(a) or {})
+    with pytest.raises(LoginError, match="timed out"):
+        browser_login(
+            "https://backend.example",
+            "Work laptop",
+            open_browser=_fake_open_browser(hit=False),
+            timeout_sec=0.3,
+        )
+    assert exchanged == []
+
+
+def test_malformed_token_response_raises(monkeypatch):
+    monkeypatch.setattr(login_mod.sender, "device_token", lambda base, code: {})
+    with pytest.raises(LoginError, match="malformed"):
+        browser_login(
+            "https://backend.example", "Work laptop", open_browser=_fake_open_browser(), timeout_sec=5
+        )