hap-cli 0.8.12__tar.gz → 0.8.14__tar.gz

{hap_cli-0.8.12 → hap_cli-0.8.14}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: hap-cli
-Version: 0.8.12
+Version: 0.8.14
 Summary: CLI harness for Mingdao HAP - Enterprise no-code platform
 Author: hap-cli
 License: Apache-2.0

{hap_cli-0.8.12 → hap_cli-0.8.14}/hap_cli/__init__.py

@@ -1,3 +1,3 @@
 """CLI harness for Mingdao HAP (hap-cli)."""
 
-__version__ = "0.8.12"
+__version__ = "0.8.14"

{hap_cli-0.8.12 → hap_cli-0.8.14}/hap_cli/commands/post_cmd.py

@@ -425,8 +425,8 @@ def _normalize_scope(scope: str) -> str:
         "fav=your favorites, group=posts in a group (requires --group-id)."
     ),
 )
-@click.option("--account-id", default="", help="Member id (required when --scope=user)")
-@click.option("--group-id", default="", help="Group id (required when --scope=group)")
+@click.option("--account-id", default="", help="Show only this member's posts")
+@click.option("--group-id", default="", help="Show only this group's posts")
 @click.option("-k", "--keywords", default="", help="Keyword filter")
 @click.option("--start-date", default="", help="Only posts on or after this date (YYYY-MM-DD)")
 @click.option("--end-date", default="", help="Only posts on or before this date (YYYY-MM-DD)")

{hap_cli-0.8.12 → hap_cli-0.8.14}/hap_cli/core/cli_access.py

@@ -127,6 +127,42 @@ def _record(key: str, result: str, now: float) -> None:
     _memo[key] = now + _ttl_for(result)
 
 
+def clear_cache(profile: str | None = None) -> None:
+    """Drop cached access verdicts so the next request re-checks live.
+
+    Called on logout: a previously cached "allowed" verdict must not
+    outlive the credentials it was granted under. Without that, logging
+    out and back in would keep running commands off the stale verdict
+    even after the org's CLI switch was turned off — the user would
+    expect the gate to re-evaluate on the fresh login.
+
+    With ``profile`` given, only that profile's entries (keys
+    ``"<profile>|<orgId>"``) are removed; with ``None``, every entry is
+    cleared. Both the in-process memo and the on-disk state file are
+    updated.
+    """
+    if profile is None:
+        _memo.clear()
+        try:
+            save_state({})
+        except Exception as e:
+            logger.warning("failed to clear cli-access cache: %s", e)
+        return
+
+    prefix = f"{profile}|"
+    for key in [k for k in _memo if k.startswith(prefix)]:
+        _memo.pop(key, None)
+    state = load_state()
+    remaining = {k: v for k, v in state.items() if not k.startswith(prefix)}
+    if remaining != state:
+        try:
+            save_state(remaining)
+        except Exception as e:
+            logger.warning(
+                "failed to clear cli-access cache for profile %s: %s", profile, e
+            )
+
+
 # Sentinel distinguishing "endpoint not deployed in this environment"
 # from other no-verdict outcomes (network error, unexpected payload).
 # 404 is environment-wide, not per-org, so batch callers can stop

{hap_cli-0.8.12 → hap_cli-0.8.14}/hap_cli/core/post.py

@@ -72,7 +72,31 @@ def get_post_list(
     For ``lType == "project"`` (org-wide feed), ``range`` follows the
     frontend convention when not overridden: no projectId → 0
     (cross-network), concrete projectId → 2.
+
+    Effective-scope derivation (mirrors ``postActions.loadPosts``): the
+    server keys off ``lType`` to decide which feed to read, and silently
+    ignores ``aId`` / ``gID`` when they don't match the declared scope.
+    The frontend therefore derives the effective ``lType`` from the
+    presence of the ids — a group id forces ``group``, an account id
+    forces ``user`` — rather than trusting the nominal list type. We do
+    the same so that e.g. ``--account-id`` filters the author feed even
+    when the caller left the scope at its org-wide default.
+
+    ``myself`` is handled specially: the bare ``lType=myself`` scope
+    lists the caller's posts but the server drops keyword / date filters
+    on it. The product's "我的"(My) tab actually routes through
+    ``lType=user`` with the caller's own accountId, so we resolve
+    ``myself`` to that shape when the session knows the caller's id
+    (falling back to the raw scope otherwise).
     """
+    if list_type == "myself" and not account_id and not group_id and session.account_id:
+        account_id = session.account_id
+
+    if group_id:
+        list_type = "group"
+    elif account_id:
+        list_type = "user"
+
     data: dict[str, Any] = {
         "fType": source_type or "feed",
         "lType": list_type,

{hap_cli-0.8.12 → hap_cli-0.8.14}/hap_cli/core/session.py

@@ -1145,6 +1145,14 @@ def delete_profile(name: str) -> None:
     doc["profiles"] = profiles
     _write_config(doc)
 
+    # Logging out must drop any cached CLI-access verdict for this
+    # profile: a stale "allowed" must not let commands keep running after
+    # the org may have turned its CLI switch off. Imported lazily to
+    # avoid a module-load cycle (cli_access imports this module).
+    from hap_cli.core import cli_access
+
+    cli_access.clear_cache(name)
+
 
 def resolve_profile_name(cli_opt: Optional[str] = None) -> str:
     """Resolve which profile to act on: --profile > $HAP_PROFILE > active."""

{hap_cli-0.8.12 → hap_cli-0.8.14}/hap_cli/tests/test_cli_access.py

@@ -661,3 +661,78 @@ class TestAnnotateOrgs404ShortCircuit:
         s = self._session()
         with patch("requests.get", return_value=_resp({}, status=404)):
             assert cli_access.probe_cli_access_with_session(s, "org-1") is None
+
+
+# ── clear_cache (logout must drop cached verdicts) ───────────────────────
+
+
+class TestClearCache:
+    def test_clear_one_profile_only(self):
+        cli_access.save_state(
+            {
+                "prod|org-1": {"checked_at": time.time(), "result": "allowed"},
+                "prod|org-2": {"checked_at": time.time(), "result": "pass_404"},
+                "sandbox|org-9": {"checked_at": time.time(), "result": "allowed"},
+            }
+        )
+        cli_access._memo.update(
+            {
+                "prod|org-1": time.time() + 999,
+                "sandbox|org-9": time.time() + 999,
+            }
+        )
+        cli_access.clear_cache("prod")
+        state = _state()
+        assert "prod|org-1" not in state
+        assert "prod|org-2" not in state
+        assert "sandbox|org-9" in state  # untouched
+        assert "prod|org-1" not in cli_access._memo
+        assert "sandbox|org-9" in cli_access._memo
+
+    def test_clear_does_not_match_prefix_siblings(self):
+        # "prod" must not wipe "prod2"'s entries.
+        cli_access.save_state(
+            {
+                "prod|org-1": {"checked_at": time.time(), "result": "allowed"},
+                "prod2|org-1": {"checked_at": time.time(), "result": "allowed"},
+            }
+        )
+        cli_access.clear_cache("prod")
+        state = _state()
+        assert "prod|org-1" not in state
+        assert "prod2|org-1" in state
+
+    def test_clear_all(self):
+        cli_access.save_state(
+            {
+                "prod|org-1": {"checked_at": time.time(), "result": "allowed"},
+                "sandbox|org-9": {"checked_at": time.time(), "result": "allowed"},
+            }
+        )
+        cli_access._memo["prod|org-1"] = time.time() + 999
+        cli_access.clear_cache()
+        assert _state() == {}
+        assert cli_access._memo == {}
+
+    def test_clear_missing_profile_is_noop(self):
+        cli_access.save_state(
+            {"prod|org-1": {"checked_at": time.time(), "result": "allowed"}}
+        )
+        cli_access.clear_cache("ghost")  # no such profile -> no error
+        assert "prod|org-1" in _state()
+
+    def test_logout_clears_cached_verdict(self, org_session):
+        # End to end: an allowed verdict is cached, then logging out the
+        # profile drops it so a fresh login re-probes (and can now be
+        # denied if the org's CLI switch was turned off meanwhile).
+        from hap_cli.core.session import delete_profile, save_profile
+
+        save_profile("prod", {"login_url": "https://www.mingdao.com"})
+        with patch("requests.get", return_value=_resp(_status_payload(True))) as mock_get:
+            ensure_cli_access(org_session)
+            assert mock_get.call_count == 1
+        assert "prod|org-1" in _state()
+
+        delete_profile("prod")
+        assert "prod|org-1" not in _state()
+        assert "prod|org-1" not in cli_access._memo

{hap_cli-0.8.12 → hap_cli-0.8.14}/hap_cli/tests/test_core.py

@@ -3232,6 +3232,104 @@ class TestPost:
         # project scope with no projectId → cross-network range.
         assert body["range"] == 0
 
+    # ---- Effective-scope derivation (pd-openweb postActions.loadPosts) ----
+    # The feed derives the effective lType from the presence of an account
+    # id / group id, not just the nominal list_type: an account id forces
+    # the member feed, a group id forces the group feed. Without that
+    # derivation an `aId` sent under lType=project is silently ignored by
+    # the server.
+
+    @patch("hap_cli.core.session.requests.post")
+    def test_account_id_forces_user_scope(self, mock_post, mock_session):
+        """An account id under the org scope must promote lType to user."""
+        mock_post.return_value = _mock_response({"postList": []})
+        from hap_cli.core import post as post_mod
+        post_mod.get_post_list(
+            mock_session,
+            list_type="project",
+            account_id="u-1",
+        )
+        body = mock_post.call_args[1]["json"]
+        assert body["lType"] == "user"
+        assert body["aId"] == "u-1"
+        # User scope is cross-network — no range constraint.
+        assert "range" not in body
+
+    @patch("hap_cli.core.session.requests.post")
+    def test_group_id_forces_group_scope(self, mock_post, mock_session):
+        """A group id under the org scope must promote lType to group."""
+        mock_post.return_value = _mock_response({"postList": []})
+        from hap_cli.core import post as post_mod
+        post_mod.get_post_list(
+            mock_session,
+            list_type="project",
+            group_id="g-1",
+        )
+        body = mock_post.call_args[1]["json"]
+        assert body["lType"] == "group"
+        assert body["gID"] == "g-1"
+        assert "range" not in body
+
+    @patch("hap_cli.core.session.requests.post")
+    def test_group_id_wins_over_account_id(self, mock_post, mock_session):
+        """When both ids are present the group feed wins (frontend order)."""
+        mock_post.return_value = _mock_response({"postList": []})
+        from hap_cli.core import post as post_mod
+        post_mod.get_post_list(
+            mock_session,
+            list_type="project",
+            account_id="u-1",
+            group_id="g-1",
+        )
+        body = mock_post.call_args[1]["json"]
+        assert body["lType"] == "group"
+
+    @patch("hap_cli.core.session.requests.post")
+    def test_myself_resolves_to_current_user_feed(self, mock_post, mock_session):
+        """`myself` routes through the caller's user feed so keyword/date
+        filters actually apply (the bare lType=myself scope ignores them)."""
+        mock_session.account_id = "me-1"
+        mock_post.return_value = _mock_response({"postList": []})
+        from hap_cli.core import post as post_mod
+        post_mod.get_post_list(
+            mock_session,
+            list_type="myself",
+            keywords="report",
+        )
+        body = mock_post.call_args[1]["json"]
+        assert body["lType"] == "user"
+        assert body["aId"] == "me-1"
+        assert body["keywords"] == "report"
+
+    @patch("hap_cli.core.session.requests.post")
+    def test_myself_without_resolved_account_falls_back(self, mock_post, mock_session):
+        """If the caller's account id is unknown, `myself` passes through
+        unchanged rather than silently becoming an empty user feed."""
+        mock_session.account_id = ""
+        mock_post.return_value = _mock_response({"postList": []})
+        from hap_cli.core import post as post_mod
+        post_mod.get_post_list(mock_session, list_type="myself")
+        body = mock_post.call_args[1]["json"]
+        assert body["lType"] == "myself"
+        assert "aId" not in body
+
+    @patch("hap_cli.core.session.requests.post")
+    def test_search_account_id_forces_user_scope(self, mock_post, mock_session):
+        """search_posts shares the derivation — an author filter promotes
+        the request to the member feed."""
+        mock_post.return_value = _mock_response({"postList": []})
+        from hap_cli.core import post as post_mod
+        post_mod.search_posts(
+            mock_session,
+            keywords="launch",
+            list_type="project",
+            account_id="u-1",
+        )
+        body = mock_post.call_args[1]["json"]
+        assert body["lType"] == "user"
+        assert body["aId"] == "u-1"
+        assert body["keywords"] == "launch"
+
     # ---- Wave 2: search_posts (GetPostListByLegacyPara) ----
 
     @patch("hap_cli.core.session.requests.post")

{hap_cli-0.8.12 → hap_cli-0.8.14}/hap_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: hap-cli
-Version: 0.8.12
+Version: 0.8.14
 Summary: CLI harness for Mingdao HAP - Enterprise no-code platform
 Author: hap-cli
 License: Apache-2.0