PyPI - haru-cli - Versions diffs - 0.1.3__tar.gz → 0.1.4__tar.gz - Mend

haru-cli 0.1.3tar.gz → 0.1.4tar.gz

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (94) hide show

{haru_cli-0.1.3 → haru_cli-0.1.4}/CHANGELOG.md RENAMED Viewed

@@ -9,6 +9,22 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Added
+- The login callback now serves a proper local result page (dark themed,
+  approval/denial card): "Request approved" on success, "Request denied"
+  with the reason on error, missing parameters, or a state mismatch —
+  rendered server-side with no JavaScript.
+### Security
+- Login result pages ship strict browser security headers: CSP
+  (`default-src 'none'`, inline styles only, `frame-ancestors 'none'`),
+  `X-Content-Type-Options: nosniff`, `X-Frame-Options: DENY`,
+  `Referrer-Policy: no-referrer`, and `Cache-Control: no-store`; error
+  descriptions are HTML-escaped, and the `state` parameter is now also
+  validated in the callback handler before the browser is answered.
+### Added
 - Browser-only login: `haru login` now discovers your accessible AWS
   accounts and permission-set roles from Identity Center after sign-in
   (auto-selected when unambiguous, prompted otherwise) and remembers the

{haru_cli-0.1.3 → haru_cli-0.1.4}/PKG-INFO RENAMED Viewed

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: haru-cli
-Version: 0.1.3
+Version: 0.1.4
 Summary: Secure, scriptable CLI for Amazon Bedrock Claude models via the AWS Strands Agents SDK.
 Author: haru-cli maintainers
 License-Expression: Apache-2.0

{haru_cli-0.1.3 → haru_cli-0.1.4}/pyproject.toml RENAMED Viewed

@@ -1,6 +1,6 @@
 [project]
 name = "haru-cli"
-version = "0.1.3"
+version = "0.1.4"
 description = "Secure, scriptable CLI for Amazon Bedrock Claude models via the AWS Strands Agents SDK."
 readme = "README.md"
 license = "Apache-2.0"

{haru_cli-0.1.3 → haru_cli-0.1.4}/src/haru/auth/sso.py RENAMED Viewed

@@ -6,6 +6,7 @@ endpoint, capture the code on a 127.0.0.1 loopback listener, and exchange it
 with ``CreateToken``. Only loopback redirect URIs are accepted.
 """
+import html
 import secrets
 import time
 import webbrowser
@@ -13,6 +14,7 @@ from collections.abc import Callable
 from dataclasses import dataclass
 from datetime import UTC, datetime, timedelta
 from http.server import BaseHTTPRequestHandler, HTTPServer
+from string import Template
 from typing import Any, cast
 from urllib.parse import parse_qs, urlencode, urlsplit
@@ -26,9 +28,74 @@ from haru.errors import AuthError
 _LOOPBACK_HOST = "127.0.0.1"
 _CALLBACK_PATH = "/oauth/callback"
 _AUTHORIZE_SCOPES = "sso:account:access"
-_CALLBACK_RESPONSE = (
-    b"<html><body><p>Sign-in complete. You can close this window and return to haru.</p>"
-    b"</body></html>"
+# Self-contained result page: inline CSS and inline SVG only — no scripts and
+# no external resources. The outcome is rendered server-side (unlike client
+# scripting, this works under the strict CSP below) and the strict CSP
+# enforces the no-script, no-resource policy in the browser.
+_PAGE_TEMPLATE = Template("""<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>$title</title>
+<style>
+    html { height: 100%; }
+    body {
+        box-sizing: border-box; min-height: 100%; margin: 0; padding: 15px 30px;
+        display: flex; flex-direction: column; justify-content: center;
+        align-items: center; min-width: 400px;
+        font-family: Verdana, Geneva, Tahoma, sans-serif; font-size: 0.9rem;
+        background-color: #000000; color: #e0e0e0;
+    }
+    .logo { font-size: 2rem; font-weight: bold; letter-spacing: 0.04em;
+            margin-bottom: 50px; color: #ffffff; }
+    .logo span { color: #7b5cfa; }
+    .request {
+        border: 1px solid; border-radius: 6px; padding: 20px 24px;
+        display: flex; flex-direction: row; align-items: flex-start; gap: 10px;
+    }
+    .request h4 { margin: 0 0 4px 0; }
+    .request p { margin: 0; opacity: 0.85; }
+    .approval { background-color: rgba(46, 204, 113, 0.08); border-color: #2ecc71; }
+    .approval h4, .approval p { color: #2ecc71; }
+    .denial { background-color: rgba(231, 76, 60, 0.08); border-color: #e74c3c; }
+    .denial h4, .denial p { color: #e74c3c; }
+    .icon { flex-shrink: 0; margin-top: 2px; margin-right: 5px; }
+    .hint { color: #a0a0b8; text-align: center; margin-top: 24px; }
+</style>
+</head>
+<body>
+    <div class="logo">haru <span>CLI</span></div>
+    <div>
+        <div class="request $variant">
+            <svg class="icon" width="18" height="18" viewBox="0 0 24 24" fill="none"
+                 stroke="$stroke" stroke-width="2" stroke-linecap="round"
+                 stroke-linejoin="round">$icon</svg>
+            <div>
+                <h4>$heading</h4>
+                <p>$message</p>
+            </div>
+        </div>
+        <p class="hint">$footer</p>
+    </div>
+</body>
+</html>""")
+_CHECK_ICON = '<polyline points="20 6 9 17 4 12"></polyline>'
+_CROSS_ICON = (
+    '<line x1="18" y1="6" x2="6" y2="18"></line><line x1="6" y1="6" x2="18" y2="18"></line>'
+)
+_SECURITY_HEADERS = (
+    (
+        "Content-Security-Policy",
+        "default-src 'none'; style-src 'unsafe-inline'; frame-ancestors 'none'",
+    ),
+    ("X-Content-Type-Options", "nosniff"),
+    ("X-Frame-Options", "DENY"),
+    ("Referrer-Policy", "no-referrer"),
+    ("Cache-Control", "no-store"),
 )
@@ -142,6 +209,7 @@ def run_login(
         registration = register_client(oidc, sso.client_name, sso.start_url, redirect_uri)
         verifier, challenge = generate_pkce_pair()
         state = secrets.token_urlsafe(32)
+        server.expected_state = state
         open_url(
             build_authorize_url(
                 sso.sso_region, registration.client_id, redirect_uri, state, challenge
@@ -159,6 +227,7 @@ class _CallbackServer(HTTPServer):
     """Loopback HTTP server that records the OAuth callback query parameters."""
     callback_params: dict[str, list[str]] | None = None
+    expected_state: str | None = None
 class _CallbackHandler(BaseHTTPRequestHandler):
@@ -166,20 +235,71 @@ class _CallbackHandler(BaseHTTPRequestHandler):
     def do_GET(self) -> None:
         parsed = urlsplit(self.path)
+        if parsed.path == "/favicon.ico":
+            self.send_response(204)
+            self.end_headers()
+            return
         if parsed.path != _CALLBACK_PATH:
             self.send_error(404)
             return
         server = cast(_CallbackServer, self.server)
-        server.callback_params = parse_qs(parsed.query)
+        params = parse_qs(parsed.query)
+        server.callback_params = params
+        self._respond(_render_outcome(params, server.expected_state))
+    def _respond(self, page: bytes) -> None:
         self.send_response(200)
-        self.send_header("Content-Type", "text/html")
+        self.send_header("Content-Type", "text/html; charset=utf-8")
+        self.send_header("Content-Length", str(len(page)))
+        for header, value in _SECURITY_HEADERS:
+            self.send_header(header, value)
         self.end_headers()
-        self.wfile.write(_CALLBACK_RESPONSE)
+        self.wfile.write(page)
     def log_message(self, format: str, *args: object) -> None:
         """Silence default request logging; callback URLs must never be logged."""
+def _render_outcome(params: dict[str, list[str]], expected_state: str | None) -> bytes:
+    """Render the approval or denial page for the callback the browser sent."""
+    error = params.get("error", [""])[0]
+    if error:
+        description = params.get("error_description", [""])[0]
+        reason = f"{error}: {description}" if description else error
+        return _failure_page(html.escape(reason))
+    codes = params.get("code")
+    states = params.get("state")
+    if not codes or not states:
+        return _failure_page("The sign-in response was missing required parameters")
+    if expected_state is not None and not secrets.compare_digest(states[0], expected_state):
+        return _failure_page("The sign-in response failed a security check (state mismatch)")
+    return _success_page()
+def _success_page() -> bytes:
+    return _PAGE_TEMPLATE.substitute(
+        title="haru CLI authentication",
+        variant="approval",
+        stroke="#2ecc71",
+        icon=_CHECK_ICON,
+        heading="Request approved",
+        message="haru CLI has been given the requested permissions",
+        footer="You can close this window and start using haru CLI",
+    ).encode("utf-8")
+def _failure_page(reason: str) -> bytes:
+    return _PAGE_TEMPLATE.substitute(
+        title="haru CLI authentication",
+        variant="denial",
+        stroke="#e74c3c",
+        icon=_CROSS_ICON,
+        heading="Request denied",
+        message=reason,
+        footer="You can close this window and re-run haru login",
+    ).encode("utf-8")
 def _start_loopback_server(port: int) -> _CallbackServer:
     """Bind the loopback callback server (port 0 selects an ephemeral port)."""
     try:

{haru_cli-0.1.3 → haru_cli-0.1.4}/tests/unit/test_sso.py RENAMED Viewed

@@ -151,6 +151,21 @@ def _get(url: str) -> None:
         pass
+class _Capture:
+    """Fetch a URL from a thread, capturing body, headers, and status."""
+    def __init__(self) -> None:
+        self.body = ""
+        self.headers: dict[str, str] = {}
+        self.status = 0
+    def fetch(self, url: str) -> None:
+        with urllib.request.urlopen(url) as response:  # noqa: S310 - loopback URL
+            self.status = response.status
+            self.headers = {key.lower(): value for key, value in response.headers.items()}
+            self.body = response.read().decode("utf-8")
 def test_loopback_callback_roundtrip() -> None:
     """The loopback server captures code and state from a real local request."""
     server = _start_loopback_server(0)
@@ -194,7 +209,7 @@ def test_callback_ignores_other_paths() -> None:
         def _hit_wrong_then_right() -> None:
             with contextlib.suppress(urllib.error.HTTPError):
-                _get(f"http://127.0.0.1:{port}/favicon.ico")
+                _get(f"http://127.0.0.1:{port}/wrong-path")
             _get(f"http://127.0.0.1:{port}/oauth/callback?code=abc&state=xyz")
         thread = threading.Thread(target=_hit_wrong_then_right)
@@ -206,6 +221,110 @@ def test_callback_ignores_other_paths() -> None:
     assert (code, state) == ("abc", "xyz")
+def _serve_one(url: str, server: Any) -> _Capture:
+    """Serve exactly one request to ``url``, returning the captured response."""
+    capture = _Capture()
+    thread = threading.Thread(target=capture.fetch, args=(url,))
+    thread.start()
+    server.timeout = 10.0
+    server.handle_request()
+    thread.join(timeout=10.0)
+    return capture
+def test_success_page_content_and_security_headers() -> None:
+    """A valid callback renders the success page with strict browser headers."""
+    server = _start_loopback_server(0)
+    try:
+        server.expected_state = "xyz"
+        port = server.server_address[1]
+        capture = _serve_one(f"http://127.0.0.1:{port}/oauth/callback?code=abc&state=xyz", server)
+    finally:
+        server.server_close()
+    assert capture.status == 200
+    assert "Request approved" in capture.body
+    assert "start using haru CLI" in capture.body
+    assert capture.headers["content-type"] == "text/html; charset=utf-8"
+    assert capture.headers["content-length"] == str(len(capture.body.encode("utf-8")))
+    csp = capture.headers["content-security-policy"]
+    assert "default-src 'none'" in csp
+    assert "frame-ancestors 'none'" in csp
+    assert capture.headers["x-content-type-options"] == "nosniff"
+    assert capture.headers["x-frame-options"] == "DENY"
+    assert capture.headers["referrer-policy"] == "no-referrer"
+    assert capture.headers["cache-control"] == "no-store"
+    assert "<script" not in capture.body
+    assert "src=" not in capture.body
+    assert "href=" not in capture.body
+def test_denied_callback_renders_failure_page() -> None:
+    """An error callback shows the failure page, and the CLI still errors."""
+    server = _start_loopback_server(0)
+    try:
+        port = server.server_address[1]
+        url = (
+            f"http://127.0.0.1:{port}/oauth/callback"
+            "?error=access_denied&error_description=User+denied"
+        )
+        capture = _serve_one(url, server)
+        with pytest.raises(AuthError, match="access_denied"):
+            _await_callback(server, timeout_seconds=1.0)
+    finally:
+        server.server_close()
+    assert "Request denied" in capture.body
+    assert "access_denied" in capture.body
+    assert "Request approved" not in capture.body
+def test_forged_state_renders_failure_page() -> None:
+    """A state mismatch shows the failure page in the browser."""
+    server = _start_loopback_server(0)
+    try:
+        server.expected_state = "expected"
+        port = server.server_address[1]
+        capture = _serve_one(
+            f"http://127.0.0.1:{port}/oauth/callback?code=abc&state=forged", server
+        )
+    finally:
+        server.server_close()
+    assert "Request denied" in capture.body
+    assert "security check" in capture.body
+def test_error_description_is_escaped() -> None:
+    """HTML in the error description cannot inject markup into the page."""
+    server = _start_loopback_server(0)
+    try:
+        port = server.server_address[1]
+        url = (
+            f"http://127.0.0.1:{port}/oauth/callback"
+            "?error=access_denied&error_description=%3Cscript%3Ealert(1)%3C/script%3E"
+        )
+        capture = _serve_one(url, server)
+    finally:
+        server.server_close()
+    assert "<script" not in capture.body
+    assert "&lt;script&gt;" in capture.body
+def test_favicon_request_is_quiet() -> None:
+    """Browsers requesting /favicon.ico get an empty 204, not an error page."""
+    server = _start_loopback_server(0)
+    try:
+        port = server.server_address[1]
+        capture = _serve_one(f"http://127.0.0.1:{port}/favicon.ico", server)
+    finally:
+        server.server_close()
+    assert capture.status == 204
+    assert capture.body == ""
 def test_callback_missing_state() -> None:
     """A callback without a state parameter raises AuthError."""
     server = _start_loopback_server(0)

{haru_cli-0.1.3 → haru_cli-0.1.4}/uv.lock RENAMED Viewed

@@ -633,7 +633,7 @@ wheels = [
 [[package]]
 name = "haru-cli"
-version = "0.1.3"
+version = "0.1.4"
 source = { editable = "." }
 dependencies = [
     { name = "boto3" },