hap-cli 0.8.13__tar.gz → 0.8.14__tar.gz

{hap_cli-0.8.13 → hap_cli-0.8.14}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: hap-cli
-Version: 0.8.13
+Version: 0.8.14
 Summary: CLI harness for Mingdao HAP - Enterprise no-code platform
 Author: hap-cli
 License: Apache-2.0

{hap_cli-0.8.13 → hap_cli-0.8.14}/hap_cli/__init__.py

@@ -1,3 +1,3 @@
 """CLI harness for Mingdao HAP (hap-cli)."""
 
-__version__ = "0.8.13"
+__version__ = "0.8.14"

{hap_cli-0.8.13 → hap_cli-0.8.14}/hap_cli/core/cli_access.py

@@ -127,6 +127,42 @@ def _record(key: str, result: str, now: float) -> None:
     _memo[key] = now + _ttl_for(result)
 
 
+def clear_cache(profile: str | None = None) -> None:
+    """Drop cached access verdicts so the next request re-checks live.
+
+    Called on logout: a previously cached "allowed" verdict must not
+    outlive the credentials it was granted under. Without that, logging
+    out and back in would keep running commands off the stale verdict
+    even after the org's CLI switch was turned off — the user would
+    expect the gate to re-evaluate on the fresh login.
+
+    With ``profile`` given, only that profile's entries (keys
+    ``"<profile>|<orgId>"``) are removed; with ``None``, every entry is
+    cleared. Both the in-process memo and the on-disk state file are
+    updated.
+    """
+    if profile is None:
+        _memo.clear()
+        try:
+            save_state({})
+        except Exception as e:
+            logger.warning("failed to clear cli-access cache: %s", e)
+        return
+
+    prefix = f"{profile}|"
+    for key in [k for k in _memo if k.startswith(prefix)]:
+        _memo.pop(key, None)
+    state = load_state()
+    remaining = {k: v for k, v in state.items() if not k.startswith(prefix)}
+    if remaining != state:
+        try:
+            save_state(remaining)
+        except Exception as e:
+            logger.warning(
+                "failed to clear cli-access cache for profile %s: %s", profile, e
+            )
+
+
 # Sentinel distinguishing "endpoint not deployed in this environment"
 # from other no-verdict outcomes (network error, unexpected payload).
 # 404 is environment-wide, not per-org, so batch callers can stop

{hap_cli-0.8.13 → hap_cli-0.8.14}/hap_cli/core/session.py

@@ -1145,6 +1145,14 @@ def delete_profile(name: str) -> None:
     doc["profiles"] = profiles
     _write_config(doc)
 
+    # Logging out must drop any cached CLI-access verdict for this
+    # profile: a stale "allowed" must not let commands keep running after
+    # the org may have turned its CLI switch off. Imported lazily to
+    # avoid a module-load cycle (cli_access imports this module).
+    from hap_cli.core import cli_access
+
+    cli_access.clear_cache(name)
+
 
 def resolve_profile_name(cli_opt: Optional[str] = None) -> str:
     """Resolve which profile to act on: --profile > $HAP_PROFILE > active."""

{hap_cli-0.8.13 → hap_cli-0.8.14}/hap_cli/tests/test_cli_access.py

@@ -661,3 +661,78 @@ class TestAnnotateOrgs404ShortCircuit:
         s = self._session()
         with patch("requests.get", return_value=_resp({}, status=404)):
             assert cli_access.probe_cli_access_with_session(s, "org-1") is None
+
+
+# ── clear_cache (logout must drop cached verdicts) ───────────────────────
+
+
+class TestClearCache:
+    def test_clear_one_profile_only(self):
+        cli_access.save_state(
+            {
+                "prod|org-1": {"checked_at": time.time(), "result": "allowed"},
+                "prod|org-2": {"checked_at": time.time(), "result": "pass_404"},
+                "sandbox|org-9": {"checked_at": time.time(), "result": "allowed"},
+            }
+        )
+        cli_access._memo.update(
+            {
+                "prod|org-1": time.time() + 999,
+                "sandbox|org-9": time.time() + 999,
+            }
+        )
+        cli_access.clear_cache("prod")
+        state = _state()
+        assert "prod|org-1" not in state
+        assert "prod|org-2" not in state
+        assert "sandbox|org-9" in state  # untouched
+        assert "prod|org-1" not in cli_access._memo
+        assert "sandbox|org-9" in cli_access._memo
+
+    def test_clear_does_not_match_prefix_siblings(self):
+        # "prod" must not wipe "prod2"'s entries.
+        cli_access.save_state(
+            {
+                "prod|org-1": {"checked_at": time.time(), "result": "allowed"},
+                "prod2|org-1": {"checked_at": time.time(), "result": "allowed"},
+            }
+        )
+        cli_access.clear_cache("prod")
+        state = _state()
+        assert "prod|org-1" not in state
+        assert "prod2|org-1" in state
+
+    def test_clear_all(self):
+        cli_access.save_state(
+            {
+                "prod|org-1": {"checked_at": time.time(), "result": "allowed"},
+                "sandbox|org-9": {"checked_at": time.time(), "result": "allowed"},
+            }
+        )
+        cli_access._memo["prod|org-1"] = time.time() + 999
+        cli_access.clear_cache()
+        assert _state() == {}
+        assert cli_access._memo == {}
+
+    def test_clear_missing_profile_is_noop(self):
+        cli_access.save_state(
+            {"prod|org-1": {"checked_at": time.time(), "result": "allowed"}}
+        )
+        cli_access.clear_cache("ghost")  # no such profile -> no error
+        assert "prod|org-1" in _state()
+
+    def test_logout_clears_cached_verdict(self, org_session):
+        # End to end: an allowed verdict is cached, then logging out the
+        # profile drops it so a fresh login re-probes (and can now be
+        # denied if the org's CLI switch was turned off meanwhile).
+        from hap_cli.core.session import delete_profile, save_profile
+
+        save_profile("prod", {"login_url": "https://www.mingdao.com"})
+        with patch("requests.get", return_value=_resp(_status_payload(True))) as mock_get:
+            ensure_cli_access(org_session)
+            assert mock_get.call_count == 1
+        assert "prod|org-1" in _state()
+
+        delete_profile("prod")
+        assert "prod|org-1" not in _state()
+        assert "prod|org-1" not in cli_access._memo

{hap_cli-0.8.13 → hap_cli-0.8.14}/hap_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: hap-cli
-Version: 0.8.13
+Version: 0.8.14
 Summary: CLI harness for Mingdao HAP - Enterprise no-code platform
 Author: hap-cli
 License: Apache-2.0