glaip-sdk 0.3.0__py3-none-any.whl → 0.5.0__py3-none-any.whl

glaip_sdk/cli/auth.py

@@ -1,24 +1,26 @@
-"""Authentication export helpers for MCP CLI commands.
+"""Authentication export helpers for MCP CLI commands and credential resolution.
 
 This module provides utilities for preparing authentication data for export,
 including interactive secret capture and placeholder generation.
 
-These helpers are distinct from the AIP CLI's own authentication, which always
-relies on the API URL and API key managed via ``aip configure`` / `AIP_API_*`
-environment variables.
+It also provides credential resolution for the AIP CLI, supporting multiple
+account profiles and environment variable overrides.
 
 Authors:
     Raymond Christopher (raymond.christopher@gdplabs.id)
 """
 
-from collections.abc import Iterable, Mapping
+import os
+from collections.abc import Callable, Iterable, Mapping
 from typing import Any
 
 import click
 from rich.console import Console
 
 from glaip_sdk.branding import HINT_PREFIX_STYLE, WARNING_STYLE
-from glaip_sdk.cli.utils import command_hint, format_command_hint
+from glaip_sdk.cli.account_store import AccountNotFoundError, AccountStoreError, get_account_store
+from glaip_sdk.cli.hints import format_command_hint
+from glaip_sdk.cli.utils import command_hint
 
 
 def prepare_authentication_export(
@@ -226,8 +228,8 @@ def _build_api_key_headers(auth: dict[str, Any], key_name: str | None, key_value
     Returns:
         A dictionary of HTTP headers for API key authentication.
     """
-    header_keys = auth.get("header_keys", [key_name] if key_name else [])
-    return {key: key_value for key in header_keys}
+    header_keys = [k for k in auth.get("header_keys", [key_name] if key_name else []) if k]
+    return dict.fromkeys(header_keys, key_value)
 
 
 def _prepare_api_key_auth(
@@ -458,3 +460,217 @@ def _prompt_secret_with_placeholder(
 
     # This line is unreachable as the loop always returns
     # return placeholder
+
+
+# ----------------------------- Credential Resolution ----------------------------- #
+
+
+def resolve_api_url_from_context(
+    ctx: Any,
+    *,
+    get_api_url: Callable[[Any], str | None] | None = None,
+    get_account_name: Callable[[Any], str | None] | None = None,
+) -> str | None:
+    """Resolve API URL from context using account store (CLI/palette ignores env creds).
+
+    Helper function to extract API URL from various context formats.
+    Used by transcript capture and slash session to avoid code duplication.
+
+    Args:
+        ctx: Context object (can be dict, click.Context, or any object with attributes).
+        get_api_url: Optional function to extract api_url from context.
+            If None, tries ctx.obj.get("api_url") or ctx.get("api_url").
+        get_account_name: Optional function to extract account_name from context.
+            If None, tries ctx.obj.get("account_name") or ctx.get("account_name").
+
+    Returns:
+        Resolved API URL or None.
+    """
+    api_url = None
+    account_name = None
+
+    if get_api_url:
+        api_url = get_api_url(ctx)
+    elif isinstance(ctx, dict):
+        api_url = ctx.get("api_url")
+    elif hasattr(ctx, "obj") and isinstance(ctx.obj, dict):
+        api_url = ctx.obj.get("api_url")
+
+    if get_account_name:
+        account_name = get_account_name(ctx)
+    elif isinstance(ctx, dict):
+        account_name = ctx.get("account_name")
+    elif hasattr(ctx, "obj") and isinstance(ctx.obj, dict):
+        account_name = ctx.obj.get("account_name")
+
+    resolved_url, _, _ = resolve_credentials(
+        account_name=account_name,
+        api_url=api_url,
+        api_key=None,
+        ignore_env_creds=True,
+    )
+    return resolved_url
+
+
+def _resolve_account_name(account_name: str | None) -> str | None:
+    """Resolve account name from parameter (env var removed for CLI/palette)."""
+    return account_name
+
+
+def _validate_account_exists(account_name: str | None, store: Any) -> None:
+    """Validate that the specified account exists.
+
+    Raises:
+        AccountNotFoundError: If account_name is specified but account doesn't exist.
+    """
+    if account_name:
+        account = store.get_account(account_name)
+        if not account:
+            raise AccountNotFoundError(
+                f"Account '{account_name}' not found. Run 'aip accounts list' to see available accounts."
+            )
+
+
+def _merge_credentials(
+    api_url: str | None,
+    api_key: str | None,
+    profile_url: str | None,
+    profile_key: str | None,
+    ignore_env_creds: bool,
+) -> tuple[str | None, str | None]:
+    """Merge credentials from multiple sources.
+
+    Args:
+        api_url: Explicit API URL override.
+        api_key: Explicit API key override.
+        profile_url: Profile API URL.
+        profile_key: Profile API key.
+        ignore_env_creds: If True, ignore env vars.
+
+    Returns:
+        Tuple of (final_url, final_key).
+    """
+    if not ignore_env_creds:
+        env_url = os.getenv("AIP_API_URL")
+        env_key = os.getenv("AIP_API_KEY")
+        final_url = api_url or env_url or profile_url
+        final_key = api_key or env_key or profile_key
+    else:
+        final_url = api_url or profile_url
+        final_key = api_key or profile_key
+    return final_url, final_key
+
+
+def _determine_source(
+    api_url: str | None,
+    api_key: str | None,
+    account_name: str | None,
+    store: Any,
+) -> str:
+    """Determine the source of credentials.
+
+    Returns:
+        Source string describing where credentials came from.
+    """
+    if api_url or api_key:
+        return "flag"
+    if account_name:
+        return f"account:{account_name}"
+    active = store.get_active_account()
+    return f"active_profile:{active}" if active else "none"
+
+
+_ENV_WARNING_EMITTED = False
+
+
+def _maybe_warn_env_creds_ignored(ignore_env_creds: bool) -> None:
+    """Emit a one-time warning when env credentials are present but ignored."""
+    global _ENV_WARNING_EMITTED
+
+    if _ENV_WARNING_EMITTED or not ignore_env_creds:
+        return
+
+    if os.getenv("AIP_API_URL") or os.getenv("AIP_API_KEY"):
+        click.echo(
+            "Warning: CLI ignores AIP_API_URL/AIP_API_KEY; use account profiles via 'aip accounts add/use'. "
+            "Python SDK callers can opt in with ignore_env_creds=False.",
+            err=True,
+        )
+        _ENV_WARNING_EMITTED = True
+
+
+def resolve_credentials(
+    account_name: str | None = None,
+    api_url: str | None = None,
+    api_key: str | None = None,
+    *,
+    ignore_env_creds: bool = True,
+) -> tuple[str | None, str | None, str]:
+    """Resolve credentials from multiple sources with precedence.
+
+    For CLI/palette: ignores raw credential env vars (AIP_API_URL/AIP_API_KEY),
+    and only uses explicit account selection (no AIP_ACCOUNT env). Python SDK can use
+    ignore_env_creds=False to honor env vars if needed.
+
+    Precedence order (CLI/palette):
+    1. Explicit parameters (api_url, api_key)
+    2. Account profile (from account_name or active_account)
+
+    Args:
+        account_name: Account name to use, or None for active account.
+        api_url: Explicit API URL override.
+        api_key: Explicit API key override.
+        ignore_env_creds: If True (default), ignore AIP_API_URL/AIP_API_KEY env vars.
+
+    Returns:
+        Tuple of (api_url, api_key, source) where source describes where
+        credentials came from (e.g., "flag", "active_profile", "account:name").
+
+    Raises:
+        click.ClickException: If a requested account does not exist.
+    """
+    _maybe_warn_env_creds_ignored(ignore_env_creds)
+
+    # 1. Explicit parameters take highest precedence
+    if api_url and api_key:
+        return api_url, api_key, "flag"
+
+    # 2. Account profile resolution
+    account_name = _resolve_account_name(account_name)
+    store = get_account_store()
+    try:
+        _validate_account_exists(account_name, store)
+    except AccountNotFoundError as exc:
+        raise click.ClickException(str(exc)) from exc
+
+    try:
+        profile_url, profile_key = store.get_credentials(account_name)
+    except AccountStoreError:
+        profile_url, profile_key = None, None
+
+    final_url, final_key = _merge_credentials(api_url, api_key, profile_url, profile_key, ignore_env_creds)
+    source = _determine_source(api_url, api_key, account_name, store)
+
+    return final_url, final_key, source
+
+
+def get_credentials(
+    account_name: str | None = None,
+    api_url: str | None = None,
+    api_key: str | None = None,
+) -> tuple[str | None, str | None]:
+    """Get credentials for CLI commands (backward compatible wrapper).
+
+    This function maintains backward compatibility with existing code that
+    expects (url, key) tuple. For source information, use resolve_credentials.
+
+    Args:
+        account_name: Account name to use, or None for active account.
+        api_url: Explicit API URL override.
+        api_key: Explicit API key override.
+
+    Returns:
+        Tuple of (api_url, api_key).
+    """
+    url, key, _ = resolve_credentials(account_name, api_url, api_key)
+    return url, key

glaip_sdk/cli/commands/accounts.py

@@ -0,0 +1,414 @@
+"""Account management commands for multi-account profiles.
+
+Authors:
+    Raymond Christopher (raymond.christopher@gdplabs.id)
+"""
+
+import getpass
+import json
+import sys
+
+import click
+from rich.console import Console
+from rich.text import Text
+
+from glaip_sdk.branding import (
+    ACCENT_STYLE,
+    ERROR_STYLE,
+    INFO,
+    NEUTRAL,
+    SUCCESS,
+    SUCCESS_STYLE,
+    WARNING_STYLE,
+)
+from glaip_sdk.cli.account_store import (
+    AccountNotFoundError,
+    AccountStore,
+    AccountStoreError,
+    InvalidAccountNameError,
+    get_account_store,
+)
+from glaip_sdk.cli.commands.common_config import check_connection, render_branding_header
+from glaip_sdk.cli.hints import format_command_hint
+from glaip_sdk.cli.masking import mask_api_key_display
+from glaip_sdk.cli.utils import command_hint
+from glaip_sdk.icons import ICON_TOOL
+from glaip_sdk.rich_components import AIPPanel, AIPTable
+
+console = Console()
+
+
+@click.group()
+def accounts_group() -> None:
+    """Manage multiple account profiles."""
+
+
+_mask_api_key = mask_api_key_display
+
+
+def _print_active_account_footer(store: AccountStore) -> None:
+    """Print footer showing active account."""
+    active = store.get_active_account()
+    if active:
+        account = store.get_account(active)
+        if account:
+            url = account.get("api_url", "")
+            masked_key = _mask_api_key(account.get("api_key"))
+            console.print(f"\n[{SUCCESS_STYLE}]Active account[/]: {active} · {url} · {masked_key}")
+
+
+@accounts_group.command("list")
+@click.option("--json", "output_json", is_flag=True, help="Output in JSON format")
+def list_accounts(output_json: bool) -> None:
+    """List all account profiles."""
+    store = get_account_store()
+    accounts = store.list_accounts()
+    active_account = store.get_active_account()
+
+    if output_json:
+        accounts_list = []
+        for name, account in accounts.items():
+            accounts_list.append(
+                {
+                    "name": name,
+                    "api_url": account.get("api_url", ""),
+                    "has_key": bool(account.get("api_key")),
+                    "active": name == active_account,
+                },
+            )
+        click.echo(json.dumps(accounts_list, indent=2))
+        return
+
+    if not accounts:
+        console.print(f"[{WARNING_STYLE}]No accounts found.[/]")
+        hint = command_hint("accounts add", slash_command="login")
+        if hint:
+            console.print(f"Run {format_command_hint(hint) or hint} to add an account.")
+        return
+
+    # Render table
+    table = AIPTable(title=f"{ICON_TOOL} AIP Accounts")
+    table.add_column("Name", style=INFO, width=20)
+    table.add_column("API URL", style=SUCCESS, width=40)
+    table.add_column("Key (masked)", style=NEUTRAL, width=20)
+    table.add_column("Status", style=SUCCESS_STYLE, width=10)
+
+    for name, account in sorted(accounts.items()):
+        url = account.get("api_url", "")
+        masked_key = _mask_api_key(account.get("api_key"))
+        is_active = name == active_account
+        status = "[bold green]●[/bold green] active" if is_active else ""
+
+        table.add_row(name, url, masked_key, status)
+
+    console.print(table)
+
+    if active_account:
+        console.print(f"\n[{SUCCESS_STYLE}]Active account[/]: {active_account}")
+
+
+def _check_account_overwrite(name: str, store: AccountStore, overwrite: bool) -> dict[str, str] | None:
+    """Check if account exists and handle overwrite logic.
+
+    Args:
+        name: Account name.
+        store: Account store instance.
+        overwrite: Whether to allow overwrite.
+
+    Returns:
+        Existing account dict or None.
+
+    Raises:
+        click.Abort: If account exists and overwrite is False.
+    """
+    existing = store.get_account(name)
+    if existing and not overwrite:
+        console.print(f"[{WARNING_STYLE}]Account '{name}' already exists.[/] Use --yes to overwrite.")
+        raise click.Abort()
+    return existing
+
+
+def _get_credentials_non_interactive(url: str, read_key_from_stdin: bool, name: str) -> tuple[str, str]:
+    """Get credentials in non-interactive mode.
+
+    Args:
+        url: API URL from flag.
+        read_key_from_stdin: Whether to read key from stdin.
+        name: Account name (for error messages).
+
+    Returns:
+        Tuple of (api_url, api_key).
+
+    Raises:
+        click.Abort: If stdin is required but not available, or if --key used without --url.
+    """
+    if read_key_from_stdin:
+        if not sys.stdin.isatty():
+            return url, sys.stdin.read().strip()
+        console.print(
+            f"[{ERROR_STYLE}]Error: --key requires stdin input. "
+            f"Use: cat key.txt | aip accounts add {name} --url {url} --key[/]",
+        )
+        raise click.Abort()
+    # URL provided, prompt for key
+    console.print(f"\n[{ACCENT_STYLE}]AIP API Key[/]:")
+    return url, getpass.getpass("> ")
+
+
+def _get_credentials_interactive(read_key_from_stdin: bool, existing: dict[str, str] | None) -> tuple[str, str]:
+    """Get credentials in interactive mode.
+
+    Args:
+        read_key_from_stdin: Whether --key flag was used.
+        existing: Existing account data.
+
+    Returns:
+        Tuple of (api_url, api_key).
+
+    Raises:
+        click.Abort: If --key used without --url.
+    """
+    if read_key_from_stdin:
+        console.print(
+            f"[{ERROR_STYLE}]Error: --key requires --url. For non-interactive mode, provide both: --url <url> --key[/]",
+        )
+        raise click.Abort()
+    # Fully interactive
+    _render_configuration_header()
+    return _prompt_account_inputs(existing)
+
+
+def _collect_account_credentials(
+    url: str | None,
+    read_key_from_stdin: bool,
+    name: str,
+    existing: dict[str, str] | None,
+) -> tuple[str, str]:
+    """Collect account credentials from various input methods.
+
+    Args:
+        url: Optional URL from flag.
+        read_key_from_stdin: Whether to read key from stdin.
+        name: Account name (for error messages).
+        existing: Existing account data.
+
+    Returns:
+        Tuple of (api_url, api_key).
+
+    Raises:
+        click.Abort: If credentials cannot be collected or are invalid.
+    """
+    if url and read_key_from_stdin:
+        # Non-interactive: URL from flag, key from stdin
+        api_url, api_key = _get_credentials_non_interactive(url, True, name)
+    elif url:
+        # URL provided, prompt for key
+        api_url, api_key = _get_credentials_non_interactive(url, False, name)
+    else:
+        # Fully interactive or error case
+        api_url, api_key = _get_credentials_interactive(read_key_from_stdin, existing)
+
+    if not api_url or not api_key:
+        console.print(f"[{ERROR_STYLE}]Error: Both API URL and API key are required.[/]")
+        raise click.Abort()
+    return api_url, api_key
+
+
+@accounts_group.command("add")
+@click.argument("name")
+@click.option("--url", help="API URL (required for non-interactive mode)")
+@click.option(
+    "--key",
+    "read_key_from_stdin",
+    is_flag=True,
+    help="Read API key from stdin (secure, for scripts). Requires --url.",
+)
+@click.option(
+    "--yes",
+    "overwrite",
+    is_flag=True,
+    help="Overwrite existing account without prompting",
+)
+def add_account(
+    name: str,
+    url: str | None,
+    read_key_from_stdin: bool,
+    overwrite: bool,
+) -> None:
+    """Add or update an account profile.
+
+    NAME is the account name (1-32 chars, alphanumeric, dash, underscore).
+
+    By default, this command runs interactively, prompting for API URL and key.
+    For non-interactive use, both --url and --key (stdin) are required.
+    """
+    store = get_account_store()
+
+    # Check account overwrite
+    existing = _check_account_overwrite(name, store, overwrite)
+
+    # Collect credentials
+    api_url, api_key = _collect_account_credentials(url, read_key_from_stdin, name, existing)
+
+    # Save account
+    try:
+        store.add_account(name, api_url, api_key, overwrite=True)
+        console.print(Text(f"✅ Account '{name}' saved successfully", style=SUCCESS_STYLE))
+        _print_active_account_footer(store)
+    except InvalidAccountNameError as e:
+        console.print(f"[{ERROR_STYLE}]Error: {e}[/]")
+        raise click.Abort() from e
+    except AccountStoreError as e:
+        console.print(f"[{ERROR_STYLE}]Error: {e}[/]")
+        raise click.Abort() from e
+
+
+@accounts_group.command("use")
+@click.argument("name")
+def use_account(name: str) -> None:
+    """Switch to a different account profile."""
+    store = get_account_store()
+
+    try:
+        account = store.get_account(name)
+        if not account:
+            console.print(f"[{ERROR_STYLE}]Error: Account '{name}' not found.[/]")
+            raise click.Abort()
+
+        url = account.get("api_url", "")
+        masked_key = _mask_api_key(account.get("api_key"))
+        api_key = account.get("api_key", "")
+
+        if not url or not api_key:
+            console.print(
+                f"[{ERROR_STYLE}]Error: Account '{name}' is missing credentials. Re-run 'aip accounts add {name}'.[/]"
+            )
+            raise click.Abort()
+
+        # Always validate before switching
+        check_connection(url, api_key, console, abort_on_error=True)
+
+        store.set_active_account(name)
+
+        console.print(
+            AIPPanel(
+                f"[{SUCCESS_STYLE}]Active account ➜ {name}[/]\nAPI URL: {url}\nKey: {masked_key}",
+                title="✅ Account Switched",
+                border_style=SUCCESS,
+            ),
+        )
+    except click.Abort:
+        # check_connection already printed the failure context; just propagate
+        raise
+    except AccountNotFoundError as e:
+        console.print(f"[{ERROR_STYLE}]Error: {e}[/]")
+        raise click.Abort() from e
+    except Exception as e:
+        console.print(f"[{ERROR_STYLE}]Error: {e}[/]")
+        raise click.Abort() from e
+
+
+@accounts_group.command("rename")
+@click.argument("current_name")
+@click.argument("new_name")
+@click.option(
+    "--yes",
+    "overwrite",
+    is_flag=True,
+    help="Overwrite target account if it already exists",
+)
+def rename_account(current_name: str, new_name: str, overwrite: bool) -> None:
+    """Rename an account profile."""
+    store = get_account_store()
+
+    if current_name == new_name:
+        console.print(f"[{WARNING_STYLE}]Source and target names are the same; nothing to rename.[/]")
+        return
+
+    try:
+        if not store.get_account(current_name):
+            console.print(f"[{ERROR_STYLE}]Error: Account '{current_name}' not found.[/]")
+            raise click.Abort()
+
+        # Guard before calling store.rename_account to keep consistent messaging with add --yes
+        if store.get_account(new_name) and not overwrite:
+            console.print(f"[{WARNING_STYLE}]Account '{new_name}' already exists.[/] Use --yes to overwrite.")
+            raise click.Abort()
+
+        store.rename_account(current_name, new_name, overwrite=overwrite)
+        console.print(Text(f"✅ Account '{current_name}' renamed to '{new_name}'", style=SUCCESS_STYLE))
+        _print_active_account_footer(store)
+    except AccountStoreError as e:
+        console.print(f"[{ERROR_STYLE}]Error: {e}[/]")
+        raise click.Abort() from e
+    except Exception as e:  # pragma: no cover - defensive catch-all
+        console.print(f"[{ERROR_STYLE}]Error: {e}[/]")
+        raise click.Abort() from e
+
+
+@accounts_group.command("remove")
+@click.argument("name")
+@click.option("--yes", "force", is_flag=True, help="Skip confirmation prompt")
+def remove_account(name: str, force: bool) -> None:
+    """Remove an account profile."""
+    store = get_account_store()
+
+    account = store.get_account(name)
+    if not account:
+        console.print(f"[{WARNING_STYLE}]Account '{name}' not found.[/]")
+        return
+
+    if not force:
+        console.print(f"[{WARNING_STYLE}]This will remove account '{name}'.[/]")
+        confirm = input("Are you sure? (y/N): ").strip().lower()
+        if confirm not in ["y", "yes"]:
+            console.print("Cancelled.")
+            return
+
+    try:
+        store.remove_account(name)
+        console.print(Text(f"✅ Account '{name}' removed", style=SUCCESS_STYLE))
+
+        # Show new active account if it changed
+        active = store.get_active_account()
+        if active:
+            console.print(f"[{SUCCESS_STYLE}]Active account is now: {active}[/]")
+    except AccountStoreError as e:
+        console.print(f"[{ERROR_STYLE}]Error: {e}[/]")
+        raise click.Abort() from e
+
+
+def _render_configuration_header() -> None:
+    """Display the interactive configuration heading/banner."""
+    render_branding_header(console, "[bold]AIP Account Configuration[/bold]")
+
+
+def _prompt_account_inputs(existing: dict[str, str] | None) -> tuple[str, str]:
+    """Interactively prompt for account credentials."""
+    console.print("\n[bold]Enter your AIP configuration:[/bold]")
+    if existing:
+        console.print("(Leave blank to keep current values)")
+    console.print("─" * 50)
+
+    # Prompt for URL
+    current_url = existing.get("api_url", "") if existing else ""
+    suffix = f"(current: {current_url})" if current_url else ""
+    console.print(f"\n[{ACCENT_STYLE}]AIP API URL[/] {suffix}:")
+    new_url = input("> ").strip()
+    api_url = new_url if new_url else current_url
+    if not api_url:
+        api_url = "https://your-aip-instance.com"
+
+    # Prompt for key
+    current_key_masked = _mask_api_key(existing.get("api_key")) if existing else ""
+    suffix = f"(current: {current_key_masked})" if current_key_masked else ""
+    console.print(f"\n[{ACCENT_STYLE}]AIP API Key[/] {suffix}:")
+    new_key = getpass.getpass("> ")
+    if new_key:
+        api_key = new_key
+    elif existing:
+        api_key = existing.get("api_key", "")
+    else:
+        api_key = ""
+
+    return api_url, api_key

glaip_sdk/cli/commands/agents.py

@@ -34,8 +34,8 @@ from glaip_sdk.cli.agent_config import (
 from glaip_sdk.cli.agent_config import (
     sanitize_agent_config_for_cli as sanitize_agent_config,
 )
-from glaip_sdk.cli.context import get_ctx_value, output_flags
 from glaip_sdk.cli.constants import DEFAULT_AGENT_INSTRUCTION_PREVIEW_LIMIT
+from glaip_sdk.cli.context import get_ctx_value, output_flags
 from glaip_sdk.cli.display import (
     build_resource_result_data,
     display_agent_run_suggestions,
@@ -47,6 +47,7 @@ from glaip_sdk.cli.display import (
     handle_rich_output,
     print_api_error,
 )
+from glaip_sdk.cli.hints import in_slash_mode
 from glaip_sdk.cli.io import (
     fetch_raw_resource_details,
 )
@@ -65,7 +66,6 @@ from glaip_sdk.cli.utils import (
     coerce_to_row,
     get_client,
     handle_resource_export,
-    in_slash_mode,
     output_list,
     output_result,
     spinner_context,