flwr-nightly 1.26.0.dev20260121__py3-none-any.whl → 1.26.0.dev20260122__py3-none-any.whl

flwr/cli/app.py

@@ -67,17 +67,17 @@ app.command(**ALLOW_EXTRAS)(log)
 app.command("list", **ALLOW_EXTRAS)(ls)
 app.command(hidden=True, **ALLOW_EXTRAS)(ls)
 app.command(**ALLOW_EXTRAS)(stop)
-app.command()(login)
+app.command(**ALLOW_EXTRAS)(login)
 app.command(**ALLOW_EXTRAS)(pull)
 
 # Create supernode command group
 supernode_app = typer.Typer(help="Manage SuperNodes")
-supernode_app.command()(supernode_register)
-supernode_app.command()(supernode_unregister)
+supernode_app.command(**ALLOW_EXTRAS)(supernode_register)
+supernode_app.command(**ALLOW_EXTRAS)(supernode_unregister)
 # Make it appear as "list"
-supernode_app.command("list")(supernode_list)
+supernode_app.command("list", **ALLOW_EXTRAS)(supernode_list)
 # Hide "ls" command (left as alias)
-supernode_app.command(hidden=True)(supernode_list)
+supernode_app.command(hidden=True, **ALLOW_EXTRAS)(supernode_list)
 app.add_typer(supernode_app, name="supernode")
 
 # Create app command group
@@ -89,9 +89,9 @@ app.add_typer(app_app, name="app")
 # Create federation command group
 federation_app = typer.Typer(help="Manage Federations")
 # Make it appear as "list"
-federation_app.command("list")(federation_list)
+federation_app.command("list", **ALLOW_EXTRAS)(federation_list)
 # Hide "ls" command (left as alias)
-federation_app.command(hidden=True)(federation_list)
+federation_app.command(hidden=True, **ALLOW_EXTRAS)(federation_list)
 app.add_typer(federation_app, name="federation")
 
 # Create config command group

flwr/cli/app_cmd/publish.py

@@ -23,7 +23,6 @@ import requests
 import typer
 from requests import Response
 
-from flwr.common.constant import FAB_CONFIG_FILE
 from flwr.supercore.constant import (
     APP_PUBLISH_EXCLUDE_PATTERNS,
     APP_PUBLISH_INCLUDE_PATTERNS,
@@ -33,18 +32,17 @@ from flwr.supercore.constant import (
     MAX_TOTAL_BYTES,
     MIME_MAP,
     PLATFORM_API_URL,
+    SUPERGRID_ADDRESS,
     UTF8,
 )
 from flwr.supercore.version import package_version as flwr_version
 
 from ..auth_plugin.oidc_cli_plugin import OidcCliPlugin
-from ..config_utils import (
-    load_and_validate,
-    process_loaded_project_config,
-    validate_federation_in_project_config,
+from ..utils import (
+    build_pathspec,
+    load_cli_auth_plugin_from_connection,
+    load_gitignore_patterns,
 )
-from ..constant import FEDERATION_CONFIG_HELP_MESSAGE
-from ..utils import build_pathspec, load_cli_auth_plugin, load_gitignore_patterns
 
 
 # pylint: disable=too-many-locals
@@ -55,35 +53,13 @@ def publish(
             help="Project directory to upload (defaults to current directory)."
         ),
     ] = Path("."),
-    federation: Annotated[
-        str | None,
-        typer.Argument(
-            help="Name of the federation used for login before publishing app."
-        ),
-    ] = None,
-    federation_config_overrides: Annotated[
-        list[str] | None,
-        typer.Option(
-            "--federation-config",
-            help=FEDERATION_CONFIG_HELP_MESSAGE,
-        ),
-    ] = None,
 ) -> None:
     """Publish a Flower App to the Flower Platform.
 
     This command uploads your app project to the Flower Platform. Files are filtered
     based on .gitignore patterns and allowed file extensions.
     """
-    # Load configs
-    pyproject_path = app / FAB_CONFIG_FILE if app else None
-    config, errors, warnings = load_and_validate(pyproject_path, check_module=False)
-    config = process_loaded_project_config(config, errors, warnings)
-    federation, federation_config = validate_federation_in_project_config(
-        federation, config, federation_config_overrides
-    )
-
-    # Load the authentication plugin
-    auth_plugin = load_cli_auth_plugin(app, federation, federation_config)
+    auth_plugin = load_cli_auth_plugin_from_connection(SUPERGRID_ADDRESS)
     auth_plugin.load_tokens()
     if not isinstance(auth_plugin, OidcCliPlugin) or not auth_plugin.access_token:
         typer.secho(

flwr/cli/app_cmd/review.py

@@ -28,8 +28,7 @@ from cryptography.hazmat.primitives.asymmetric import ed25519
 
 from flwr.common import now
 from flwr.common.config import get_flwr_dir
-from flwr.common.constant import FAB_CONFIG_FILE
-from flwr.supercore.constant import PLATFORM_API_URL
+from flwr.supercore.constant import PLATFORM_API_URL, SUPERGRID_ADDRESS
 from flwr.supercore.primitives.asymmetric_ed25519 import (
     create_message_to_sign,
     load_private_key,
@@ -39,14 +38,8 @@ from flwr.supercore.utils import parse_app_spec, request_download_link
 from flwr.supercore.version import package_version as flwr_version
 
 from ..auth_plugin.oidc_cli_plugin import OidcCliPlugin
-from ..config_utils import (
-    load_and_validate,
-    process_loaded_project_config,
-    validate_federation_in_project_config,
-)
-from ..constant import FEDERATION_CONFIG_HELP_MESSAGE
 from ..install import install_from_fab
-from ..utils import load_cli_auth_plugin
+from ..utils import load_cli_auth_plugin_from_connection
 
 TRY_AGAIN_MESSAGE = "Please try again or press CTRL+C to abort.\n"
 
@@ -60,38 +53,11 @@ def review(
             "Version is optional; defaults to the latest."
         ),
     ],
-    app_dir_login: Annotated[
-        Path,
-        typer.Argument(
-            help="Project directory to used for login before reviewing app."
-        ),
-    ] = Path("."),
-    federation: Annotated[
-        str | None,
-        typer.Argument(
-            help="Name of the federation used for login before reviewing app."
-        ),
-    ] = None,
-    federation_config_overrides: Annotated[
-        list[str] | None,
-        typer.Option(
-            "--federation-config",
-            help=FEDERATION_CONFIG_HELP_MESSAGE,
-        ),
-    ] = None,
 ) -> None:
     """Download a FAB for <APP-ID>, unpack it for manual review, and upon confirmation
     sign & submit the review to the Platform."""
-    # Load configs
-    pyproject_path = app_dir_login / FAB_CONFIG_FILE if app_dir_login else None
-    config, errors, warnings = load_and_validate(pyproject_path, check_module=False)
-    config = process_loaded_project_config(config, errors, warnings)
-    federation, federation_config = validate_federation_in_project_config(
-        federation, config, federation_config_overrides
-    )
+    auth_plugin = load_cli_auth_plugin_from_connection(SUPERGRID_ADDRESS)
 
-    # Load the authentication plugin
-    auth_plugin = load_cli_auth_plugin(app_dir_login, federation, federation_config)
     auth_plugin.load_tokens()
     if not isinstance(auth_plugin, OidcCliPlugin) or not auth_plugin.access_token:
         typer.secho(

flwr/cli/auth_plugin/auth_plugin.py

@@ -17,7 +17,6 @@
 
 from abc import ABC, abstractmethod
 from collections.abc import Sequence
-from pathlib import Path
 
 from flwr.common.typing import AccountAuthCredentials, AccountAuthLoginDetails
 from flwr.proto.control_pb2_grpc import ControlStub
@@ -35,8 +34,8 @@ class CliAuthPlugin(ABC):
 
     Parameters
     ----------
-    credentials_path : Path
-        Path to the Flower account's authentication credentials file.
+    host : str
+        The address of the SuperLink Control API server.
     """
 
     @staticmethod
@@ -66,20 +65,16 @@ class CliAuthPlugin(ABC):
         """
 
     @abstractmethod
-    def __init__(self, credentials_path: Path):
+    def __init__(self, host: str):
         """Abstract constructor."""
 
     @abstractmethod
     def store_tokens(self, credentials: AccountAuthCredentials) -> None:
-        """Store authentication tokens to the `credentials_path`.
-
-        The credentials, including tokens, will be saved as a JSON file
-        at `credentials_path`.
-        """
+        """Store authentication tokens to the credential store."""
 
     @abstractmethod
     def load_tokens(self) -> None:
-        """Load authentication tokens from the `credentials_path`."""
+        """Load authentication tokens from the credential store."""
 
     @abstractmethod
     def write_tokens_to_metadata(

flwr/cli/auth_plugin/noop_auth_plugin.py

@@ -16,7 +16,6 @@
 
 
 from collections.abc import Sequence
-from pathlib import Path
 
 from flwr.common.typing import AccountAuthCredentials, AccountAuthLoginDetails
 from flwr.proto.control_pb2_grpc import ControlStub
@@ -57,7 +56,7 @@ class NoOpCliAuthPlugin(CliAuthPlugin):
         """
         raise LoginError("Account authentication is not enabled on this SuperLink.")
 
-    def __init__(self, credentials_path: Path) -> None:
+    def __init__(self, host: str = "") -> None:
         pass
 
     def store_tokens(self, credentials: AccountAuthCredentials) -> None:

flwr/cli/auth_plugin/oidc_cli_plugin.py

@@ -15,27 +15,25 @@
 """Flower CLI account auth plugin for OIDC."""
 
 
-import json
 import time
 import webbrowser
 from collections.abc import Sequence
-from pathlib import Path
-from typing import Any
 
 import typer
 
-from flwr.common.constant import (
-    ACCESS_TOKEN_KEY,
-    AUTHN_TYPE_JSON_KEY,
-    REFRESH_TOKEN_KEY,
-    AuthnType,
+from flwr.cli.constant import (
+    ACCESS_TOKEN_STORE_KEY,
+    AUTHN_TYPE_STORE_KEY,
+    REFRESH_TOKEN_STORE_KEY,
 )
+from flwr.common.constant import ACCESS_TOKEN_KEY, REFRESH_TOKEN_KEY, AuthnType
 from flwr.common.typing import AccountAuthCredentials, AccountAuthLoginDetails
 from flwr.proto.control_pb2 import (  # pylint: disable=E0611
     GetAuthTokensRequest,
     GetAuthTokensResponse,
 )
 from flwr.proto.control_pb2_grpc import ControlStub
+from flwr.supercore.credential_store import get_credential_store
 
 from .auth_plugin import CliAuthPlugin, LoginError
 
@@ -47,10 +45,11 @@ class OidcCliPlugin(CliAuthPlugin):
     access to Flower SuperLink.
     """
 
-    def __init__(self, credentials_path: Path):
+    def __init__(self, host: str):
         self.access_token: str | None = None
         self.refresh_token: str | None = None
-        self.credentials_path = credentials_path
+        self.host = host
+        self.store = get_credential_store()
 
     @staticmethod
     def login(
@@ -109,32 +108,29 @@ class OidcCliPlugin(CliAuthPlugin):
         raise LoginError("Process timed out.")
 
     def store_tokens(self, credentials: AccountAuthCredentials) -> None:
-        """Store authentication tokens to the `credentials_path`.
+        """Store authentication tokens to the credential store."""
+        host = self.host
+        # Retrieve tokens
+        access_token = credentials.access_token
+        refresh_token = credentials.refresh_token
 
-        The credentials, including tokens, will be saved as a JSON file
-        at `credentials_path`.
-        """
-        self.access_token = credentials.access_token
-        self.refresh_token = credentials.refresh_token
-        json_dict = {
-            AUTHN_TYPE_JSON_KEY: AuthnType.OIDC,
-            ACCESS_TOKEN_KEY: credentials.access_token,
-            REFRESH_TOKEN_KEY: credentials.refresh_token,
-        }
+        # Store tokens in the credential store
+        self.store.set(AUTHN_TYPE_STORE_KEY % host, AuthnType.OIDC.encode("utf-8"))
+        self.store.set(ACCESS_TOKEN_STORE_KEY % host, access_token.encode("utf-8"))
+        self.store.set(REFRESH_TOKEN_STORE_KEY % host, refresh_token.encode("utf-8"))
 
-        with open(self.credentials_path, "w", encoding="utf-8") as file:
-            json.dump(json_dict, file, indent=4)
+        # Update internal state
+        self.access_token = access_token
+        self.refresh_token = refresh_token
 
     def load_tokens(self) -> None:
-        """Load authentication tokens from the `credentials_path`."""
-        with open(self.credentials_path, encoding="utf-8") as file:
-            json_dict: dict[str, Any] = json.load(file)
-            access_token = json_dict.get(ACCESS_TOKEN_KEY)
-            refresh_token = json_dict.get(REFRESH_TOKEN_KEY)
+        """Load authentication tokens from the credential store."""
+        access_token_bytes = self.store.get(ACCESS_TOKEN_STORE_KEY % self.host)
+        refresh_token_bytes = self.store.get(REFRESH_TOKEN_STORE_KEY % self.host)
 
-        if isinstance(access_token, str) and isinstance(refresh_token, str):
-            self.access_token = access_token
-            self.refresh_token = refresh_token
+        if access_token_bytes is not None and refresh_token_bytes is not None:
+            self.access_token = access_token_bytes.decode("utf-8")
+            self.refresh_token = refresh_token_bytes.decode("utf-8")
 
     def write_tokens_to_metadata(
         self, metadata: Sequence[tuple[str, str | bytes]]

flwr/cli/constant.py

@@ -14,6 +14,7 @@
 # ==============================================================================
 """Constants for CLI commands."""
 
+from flwr.supercore.constant import SUPERGRID_ADDRESS
 
 # General help message for config overrides
 CONFIG_HELP_MESSAGE = (
@@ -96,11 +97,11 @@ class SimulationBackendConfigTomlKey:
 FLOWER_CONFIG_FILE = "config.toml"
 
 # The default configuration for the Flower config file
-DEFAULT_FLOWER_CONFIG_TOML = """[superlink]
+DEFAULT_FLOWER_CONFIG_TOML = f"""[superlink]
 default = "local"
 
 [superlink.supergrid]
-address = "supergrid.flower.ai"
+address = "{SUPERGRID_ADDRESS}"
 enable-account-auth = true
 federation = "YOUR-FEDERATION-HERE"
 
@@ -109,3 +110,8 @@ options.num-supernodes = 10
 options.backend.client-resources.num-cpus = 1
 options.backend.client-resources.num-gpus = 0
 """
+
+# Keys for storing account auth credentials in the credential store
+AUTHN_TYPE_STORE_KEY = "flower.account-auth.%s.authn-type"
+ACCESS_TOKEN_STORE_KEY = "flower.account-auth.%s.oidc-access-token"
+REFRESH_TOKEN_STORE_KEY = "flower.account-auth.%s.oidc-refresh-token"

flwr/cli/federation/ls.py

@@ -16,22 +16,17 @@
 
 
 import io
-from pathlib import Path
-from typing import Annotated, Any, cast
+from typing import Annotated, Any
 
 import typer
 from rich.console import Console
 from rich.table import Table
 from rich.text import Text
 
-from flwr.cli.config_utils import (
-    exit_if_no_address,
-    load_and_validate,
-    process_loaded_project_config,
-    validate_federation_in_project_config,
-)
+from flwr.cli.config_migration import migrate
+from flwr.cli.flower_config import read_superlink_connection
 from flwr.cli.ls import _get_status_style
-from flwr.common.constant import FAB_CONFIG_FILE, NOOP_ACCOUNT_NAME, CliOutputFormat
+from flwr.common.constant import NOOP_ACCOUNT_NAME, CliOutputFormat
 from flwr.common.logger import print_json_error, redirect_output, restore_output
 from flwr.common.serde import run_from_proto
 from flwr.proto.control_pb2 import (  # pylint: disable=E0611
@@ -46,18 +41,14 @@ from flwr.proto.node_pb2 import NodeInfo  # pylint: disable=E0611
 from flwr.supercore.utils import humanize_duration
 
 from ..run_utils import RunRow, format_runs
-from ..utils import flwr_cli_grpc_exc_handler, init_channel, load_cli_auth_plugin
+from ..utils import flwr_cli_grpc_exc_handler, init_channel_from_connection
 
 
 def ls(  # pylint: disable=R0914, R0913, R0917, R0912
     ctx: typer.Context,
-    app: Annotated[
-        Path,
-        typer.Argument(help="Path of the Flower project"),
-    ] = Path("."),
-    toml_federation: Annotated[
+    superlink: Annotated[
         str | None,
-        typer.Argument(help="Name of the federation"),
+        typer.Argument(help="Name of the SuperLink connection."),
     ] = None,
     output_format: Annotated[
         str,
@@ -77,29 +68,22 @@ def ls(  # pylint: disable=R0914, R0913, R0917, R0912
     ] = None,
 ) -> None:
     """List available federations."""
-    # Resolve command used (list or ls)
-    command_name = cast(str, ctx.command.name) if ctx.command else "ls"
-
     suppress_output = output_format == CliOutputFormat.JSON
     captured_output = io.StringIO()
+
+    if suppress_output:
+        redirect_output(captured_output)
+
+    # Migrate legacy usage if any
+    migrate(superlink, args=ctx.args)
+
+    # Read superlink connection configuration
+    superlink_connection = read_superlink_connection(superlink)
+    channel = None
+
     try:
-        if suppress_output:
-            redirect_output(captured_output)
-        typer.secho("Loading project configuration... ", fg=typer.colors.BLUE)
-
-        pyproject_path = app / FAB_CONFIG_FILE if app else None
-        config, errors, warnings = load_and_validate(pyproject_path, check_module=False)
-        config = process_loaded_project_config(config, errors, warnings)
-        toml_federation_name, federation_config = validate_federation_in_project_config(
-            toml_federation, config
-        )
-        exit_if_no_address(federation_config, f"federation {command_name}")
-        channel = None
         try:
-            auth_plugin = load_cli_auth_plugin(
-                app, toml_federation_name, federation_config
-            )
-            channel = init_channel(app, federation_config, auth_plugin)
+            channel = init_channel_from_connection(superlink_connection)
             stub = ControlStub(channel)
 
             if federation:

flwr/cli/login/login.py

@@ -15,20 +15,13 @@
 """Flower command line interface `login` command."""
 
 
-from pathlib import Path
-from typing import Annotated
+from typing import Annotated, cast
 
 import typer
 
 from flwr.cli.auth_plugin import LoginError, NoOpCliAuthPlugin
-from flwr.cli.config_utils import (
-    exit_if_no_address,
-    get_insecure_flag,
-    load_and_validate,
-    process_loaded_project_config,
-    validate_federation_in_project_config,
-)
 from flwr.cli.constant import FEDERATION_CONFIG_HELP_MESSAGE
+from flwr.cli.utils import init_channel_from_connection
 from flwr.common.typing import AccountAuthLoginDetails
 from flwr.proto.control_pb2 import (  # pylint: disable=E0611
     GetLoginDetailsRequest,
@@ -36,58 +29,51 @@ from flwr.proto.control_pb2 import (  # pylint: disable=E0611
 )
 from flwr.proto.control_pb2_grpc import ControlStub
 
-from ..utils import (
-    account_auth_enabled,
-    flwr_cli_grpc_exc_handler,
-    init_channel,
-    load_cli_auth_plugin,
-)
+from ..config_migration import migrate, warn_if_federation_config_overrides
+from ..flower_config import read_superlink_connection
+from ..utils import flwr_cli_grpc_exc_handler, load_cli_auth_plugin_from_connection
 
 
-def login(  # pylint: disable=R0914
-    app: Annotated[
-        Path,
-        typer.Argument(help="Path of the Flower App to run."),
-    ] = Path("."),
-    federation: Annotated[
+def login(
+    ctx: typer.Context,
+    superlink: Annotated[
         str | None,
-        typer.Argument(help="Name of the federation to login into."),
+        typer.Argument(help="Name of the SuperLink connection."),
     ] = None,
     federation_config_overrides: Annotated[
         list[str] | None,
         typer.Option(
             "--federation-config",
             help=FEDERATION_CONFIG_HELP_MESSAGE,
+            hidden=True,
         ),
     ] = None,
 ) -> None:
     """Login to Flower SuperLink."""
-    typer.secho("Loading project configuration... ", fg=typer.colors.BLUE)
+    # Warn `--federation-config` is ignored
+    warn_if_federation_config_overrides(federation_config_overrides)
 
-    pyproject_path = app / "pyproject.toml" if app else None
-    config, errors, warnings = load_and_validate(pyproject_path, check_module=False)
+    # Migrate legacy usage if any
+    migrate(superlink, args=ctx.args)
 
-    config = process_loaded_project_config(config, errors, warnings)
-    federation, federation_config = validate_federation_in_project_config(
-        federation, config, federation_config_overrides
-    )
-    exit_if_no_address(federation_config, "login")
+    # Read superlink connection configuration
+    superlink_connection = read_superlink_connection(superlink)
+    superlink = superlink_connection.name
 
     # Check if `enable-account-auth` is set to `true`
-
-    if not account_auth_enabled(federation_config):
+    if not superlink_connection.enable_account_auth:
         typer.secho(
-            "❌ Account authentication is not enabled for the federation "
-            f"'{federation}'. To enable it, set `enable-account-auth = true` "
-            "in the federation configuration.",
+            "❌ Account authentication is not enabled for the SuperLink connection "
+            f"'{superlink}'. To enable it, set `enable-account-auth = true` "
+            "in the configuration.",
             fg=typer.colors.RED,
             bold=True,
             err=True,
         )
         raise typer.Exit(code=1)
+
     # Check if insecure flag is set to `True`
-    insecure = get_insecure_flag(federation_config)
-    if insecure:
+    if superlink_connection.insecure:
         typer.secho(
             "❌ `flwr login` requires TLS to be enabled. `insecure` must NOT be set to "
             "`true` in the federation configuration.",
@@ -97,7 +83,7 @@ def login(  # pylint: disable=R0914
         )
         raise typer.Exit(code=1)
 
-    channel = init_channel(app, federation_config, NoOpCliAuthPlugin(Path()))
+    channel = init_channel_from_connection(superlink_connection, NoOpCliAuthPlugin())
     stub = ControlStub(channel)
 
     login_request = GetLoginDetailsRequest()
@@ -105,8 +91,9 @@ def login(  # pylint: disable=R0914
         login_response: GetLoginDetailsResponse = stub.GetLoginDetails(login_request)
 
     # Get the auth plugin
-    authn_type = login_response.authn_type
-    auth_plugin = load_cli_auth_plugin(app, federation, federation_config, authn_type)
+    authn_plugin = load_cli_auth_plugin_from_connection(
+        cast(str, superlink_connection.address), login_response.authn_type
+    )
 
     # Login
     details = AccountAuthLoginDetails(
@@ -118,7 +105,7 @@ def login(  # pylint: disable=R0914
     )
     try:
         with flwr_cli_grpc_exc_handler():
-            credentials = auth_plugin.login(details, stub)
+            credentials = authn_plugin.login(details, stub)
         typer.secho(
             "✅ Login successful.",
             fg=typer.colors.GREEN,
@@ -134,4 +121,4 @@ def login(  # pylint: disable=R0914
         raise typer.Exit(code=1) from None
 
     # Store the tokens
-    auth_plugin.store_tokens(credentials)
+    authn_plugin.store_tokens(credentials)