indico-cli 0.4.4__tar.gz → 0.5.1__tar.gz

indico_cli-0.5.1/.gitlab-ci.yml

@@ -0,0 +1,23 @@
+stages:
+  - publish
+
+# Publish to PyPI on git tag. The acc-py index (acc-py-repo.cern.ch) is a Nexus
+# group that proxies PyPI, so it serves this package from PyPI automatically
+# once its metadata cache refreshes. Publishing to the acc-py hosted repo is not
+# possible for a package that exists on PyPI (Nexus returns 409 Conflict), so
+# PyPI is the single source of truth.
+publish-pypi:
+  stage: publish
+  image: python:3.12-slim
+  rules:
+    - if: $CI_COMMIT_TAG =~ /^v\d+\.\d+\.\d+/
+  script:
+    - apt-get update && apt-get install -y git
+    - git fetch --tags
+    - pip install build twine
+    - python -m build
+    - twine upload --skip-existing dist/*
+  variables:
+    TWINE_USERNAME: __token__
+    TWINE_PASSWORD: $PYPI_API_TOKEN
+    GIT_DEPTH: 0

{indico_cli-0.4.4 → indico_cli-0.5.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: indico-cli
-Version: 0.4.4
+Version: 0.5.1
 Summary: CLI tool for interacting with Indico event management systems
 Project-URL: Repository, https://gitlab.cern.ch/cern-agent-skills/indico-cli
 License: MIT
@@ -50,6 +50,11 @@ Or use the `configure` command to save credentials:
 indico-cli configure --base-url https://indico.cern.ch --token indp_...
 ```
 
+Saved credentials live in `$XDG_CONFIG_HOME/indico-cli/config.json` (or
+`~/.config/indico-cli/config.json` when `XDG_CONFIG_HOME` is unset), written with
+owner-only permissions (`0600`). Inspect or reset them with `indico-cli config
+show`, `indico-cli config path`, and `indico-cli config clear`.
+
 API tokens can be generated at `<your-indico-url>/user/preferences/api`. Required scopes: `read:legacy_api`, `write:legacy_api` (for create operations), `read:user` (optional).
 
 ## Usage
@@ -117,6 +122,9 @@ indico-cli create-event-with-agenda --title "Workshop" --category-id 4648 \
 | Command | Description |
 |---------|-------------|
 | `configure` | Save Indico base URL and API token, and verify the connection. |
+| `config show` | Show the saved base URL and a masked token, plus the config file path. |
+| `config path` | Print the path to the config file. |
+| `config clear` | Delete the saved configuration (use `--yes` to skip the prompt). |
 | `user-info` | Show the current user's name, email, and admin status. |
 | `search-events` | List events in a category, with optional date range and public-only filter. |
 | `search-by-term` | Full-text search across categories, events, contributions, attachments, and notes. |

{indico_cli-0.4.4 → indico_cli-0.5.1}/README.md

@@ -27,6 +27,11 @@ Or use the `configure` command to save credentials:
 indico-cli configure --base-url https://indico.cern.ch --token indp_...
 ```
 
+Saved credentials live in `$XDG_CONFIG_HOME/indico-cli/config.json` (or
+`~/.config/indico-cli/config.json` when `XDG_CONFIG_HOME` is unset), written with
+owner-only permissions (`0600`). Inspect or reset them with `indico-cli config
+show`, `indico-cli config path`, and `indico-cli config clear`.
+
 API tokens can be generated at `<your-indico-url>/user/preferences/api`. Required scopes: `read:legacy_api`, `write:legacy_api` (for create operations), `read:user` (optional).
 
 ## Usage
@@ -94,6 +99,9 @@ indico-cli create-event-with-agenda --title "Workshop" --category-id 4648 \
 | Command | Description |
 |---------|-------------|
 | `configure` | Save Indico base URL and API token, and verify the connection. |
+| `config show` | Show the saved base URL and a masked token, plus the config file path. |
+| `config path` | Print the path to the config file. |
+| `config clear` | Delete the saved configuration (use `--yes` to skip the prompt). |
 | `user-info` | Show the current user's name, email, and admin status. |
 | `search-events` | List events in a category, with optional date range and public-only filter. |
 | `search-by-term` | Full-text search across categories, events, contributions, attachments, and notes. |

indico_cli-0.5.1/docs/superpowers/plans/2026-06-04-secure-config-storage.md

@@ -0,0 +1,543 @@
+# Secure Config Storage + `config` Commands Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Store the Indico token+URL in a generic config file with owner-only permissions, and add `config show/path/clear` commands to inspect and manage it.
+
+**Architecture:** Extract on-disk config persistence from `cli.py` into a new focused module `indico_cli/config.py` that honors `XDG_CONFIG_HOME` and writes the file as `0600` (dir `0700`). `cli.py` imports from it and gains a `config` Click group. Credential resolution (args -> env -> file) is unchanged.
+
+**Tech Stack:** Python 3.12, Click 8, pytest, Click `CliRunner` for CLI tests.
+
+**Linting:** Before every Python commit, run `uvx ruff check indico_cli tests` and fix anything it reports. The repo is not typed (no `[tool.mypy]`, no type-checking config), so mypy is skipped. Docs-only commits (Task 4) need no lint.
+
+---
+
+## File Structure
+
+- **Create** `indico_cli/config.py` — on-disk credential config: path resolution, load/save (with permission hardening), clear, token masking. Single responsibility.
+- **Create** `tests/test_config.py` — unit tests for `config.py` (tmp `XDG_CONFIG_HOME`).
+- **Create** `tests/test_cli_config.py` — Click `CliRunner` tests for the `config` group.
+- **Modify** `indico_cli/cli.py` — import from `config.py`, delete the inline config code, add the `config` command group.
+- **Modify** `README.md` — document the `config` commands and file permissions.
+- **Modify** `skills/indico-skill/SKILL.md` — mention `config show/path/clear`.
+
+---
+
+## Task 1: Create the `config` module (with tests)
+
+**Files:**
+- Create: `indico_cli/config.py`
+- Test: `tests/test_config.py`
+
+- [ ] **Step 1: Write the failing tests**
+
+Create `tests/test_config.py`:
+
+```python
+"""Unit tests for indico_cli.config on-disk credential storage."""
+
+import os
+import stat
+from pathlib import Path
+
+import pytest
+
+from indico_cli import config
+
+
+@pytest.fixture
+def tmp_xdg(tmp_path, monkeypatch):
+    """Point config storage at a temp XDG_CONFIG_HOME."""
+    monkeypatch.setenv("XDG_CONFIG_HOME", str(tmp_path))
+    return tmp_path
+
+
+def test_get_config_path_honors_xdg(tmp_xdg):
+    assert config.get_config_path() == tmp_xdg / "indico-cli" / "config.json"
+
+
+def test_get_config_path_defaults_to_home(monkeypatch):
+    monkeypatch.delenv("XDG_CONFIG_HOME", raising=False)
+    assert config.get_config_path() == Path.home() / ".config" / "indico-cli" / "config.json"
+
+
+def test_save_then_load_roundtrips(tmp_xdg):
+    config.save_config("https://indico.cern.ch", "indp_secrettoken")
+    assert config.load_config() == {
+        "base_url": "https://indico.cern.ch",
+        "token": "indp_secrettoken",
+    }
+
+
+@pytest.mark.skipif(os.name == "nt", reason="POSIX permissions only")
+def test_save_sets_owner_only_permissions(tmp_xdg):
+    config.save_config("https://indico.cern.ch", "indp_secrettoken")
+    config_file = config.get_config_path()
+    assert stat.S_IMODE(config_file.stat().st_mode) == 0o600
+    assert stat.S_IMODE(config_file.parent.stat().st_mode) == 0o700
+
+
+def test_load_returns_empty_when_missing(tmp_xdg):
+    assert config.load_config() == {}
+
+
+def test_load_returns_empty_on_corrupt_json(tmp_xdg):
+    config_file = config.get_config_path()
+    config_file.parent.mkdir(parents=True, exist_ok=True)
+    config_file.write_text("{not valid json")
+    assert config.load_config() == {}
+
+
+def test_clear_removes_file_and_returns_true(tmp_xdg):
+    config.save_config("https://indico.cern.ch", "indp_secrettoken")
+    assert config.clear_config() is True
+    assert not config.get_config_path().exists()
+
+
+def test_clear_returns_false_when_nothing(tmp_xdg):
+    assert config.clear_config() is False
+
+
+def test_mask_token_empty():
+    assert config.mask_token("") == "(none)"
+
+
+def test_mask_token_short():
+    assert config.mask_token("indp_123") == "****"
+
+
+def test_mask_token_normal():
+    assert config.mask_token("indp_abcdefgh1234") == "indp_...1234"
+```
+
+- [ ] **Step 2: Run tests to verify they fail**
+
+Run: `uv run pytest tests/test_config.py -v`
+Expected: FAIL — `ModuleNotFoundError: No module named 'indico_cli.config'` (or `AttributeError`).
+
+- [ ] **Step 3: Write the module**
+
+Create `indico_cli/config.py`:
+
+```python
+#!/usr/bin/env python3
+"""On-disk credential configuration for indico-cli.
+
+Stores the Indico base URL and API token in a generic config file
+(``$XDG_CONFIG_HOME/indico-cli/config.json`` or
+``~/.config/indico-cli/config.json``). The file holds a token, so it is written
+with owner-only permissions (0600).
+"""
+
+import json
+import os
+from pathlib import Path
+
+APP_DIR_NAME = "indico-cli"
+CONFIG_FILENAME = "config.json"
+
+
+def get_config_path() -> Path:
+    """Return the config file path, honoring XDG_CONFIG_HOME.
+
+    Computed on each call so runtime/test environment changes are respected.
+    Falls back to ~/.config when XDG_CONFIG_HOME is unset (backward compatible).
+    """
+    base = os.environ.get("XDG_CONFIG_HOME")
+    config_home = Path(base) if base else Path.home() / ".config"
+    return config_home / APP_DIR_NAME / CONFIG_FILENAME
+
+
+def load_config() -> dict:
+    """Load saved configuration, returning an empty dict on any failure."""
+    config_file = get_config_path()
+    if config_file.exists():
+        try:
+            return json.loads(config_file.read_text())
+        except (json.JSONDecodeError, OSError):
+            return {}
+    return {}
+
+
+def save_config(base_url: str, token: str) -> None:
+    """Persist configuration with owner-only permissions (dir 0700, file 0600)."""
+    config_file = get_config_path()
+    config_dir = config_file.parent
+    config_dir.mkdir(parents=True, exist_ok=True)
+    config_file.write_text(
+        json.dumps({"base_url": base_url, "token": token}, indent=2)
+    )
+    # Best-effort permission hardening. A filesystem without POSIX permission
+    # bits (e.g. some Windows setups) must not crash the save.
+    try:
+        os.chmod(config_dir, 0o700)
+        os.chmod(config_file, 0o600)
+    except OSError:
+        pass
+
+
+def clear_config() -> bool:
+    """Delete the config file. Return True if a file was removed."""
+    config_file = get_config_path()
+    if config_file.exists():
+        config_file.unlink()
+        return True
+    return False
+
+
+def mask_token(token: str) -> str:
+    """Return a masked representation of a token, safe for display."""
+    if not token:
+        return "(none)"
+    if len(token) <= 8:
+        return "****"
+    return f"{token[:5]}...{token[-4:]}"
+```
+
+- [ ] **Step 4: Run tests to verify they pass**
+
+Run: `uv run pytest tests/test_config.py -v`
+Expected: PASS (all tests; the permissions test is skipped only on Windows).
+
+- [ ] **Step 5: Lint, then commit**
+
+Run: `uvx ruff check indico_cli tests` (fix any reported issues, then re-run until clean).
+
+```bash
+git add indico_cli/config.py tests/test_config.py
+git commit -m "feat: add config module with XDG path and 0600 permissions"
+```
+
+---
+
+## Task 2: Wire `cli.py` to the config module
+
+Replace the inline config code in `cli.py` with imports from `indico_cli.config`, keeping `configure` and `get_client` behavior identical. This is a refactor verified by the existing test suite.
+
+**Files:**
+- Modify: `indico_cli/cli.py` (lines ~8, 15-32, 94-95)
+
+- [ ] **Step 1: Remove the now-unused `pathlib` import**
+
+In `indico_cli/cli.py`, delete this line (Task 1's module owns path handling now; `click.Path` is unrelated):
+
+```python
+from pathlib import Path
+```
+
+- [ ] **Step 2: Replace the inline config block with an import**
+
+Delete this entire block (currently lines 15-32):
+
+```python
+CONFIG_DIR = Path.home() / ".config" / "indico-cli"
+CONFIG_FILE = CONFIG_DIR / "config.json"
+
+
+def load_config() -> dict:
+    """Load saved configuration from disk, returning empty dict on failure."""
+    if CONFIG_FILE.exists():
+        try:
+            return json.loads(CONFIG_FILE.read_text())
+        except (json.JSONDecodeError, OSError):
+            return {}
+    return {}
+
+
+def save_config(base_url: str, token: str) -> None:
+    """Persist configuration to ~/.config/indico-cli/config.json."""
+    CONFIG_DIR.mkdir(parents=True, exist_ok=True)
+    CONFIG_FILE.write_text(json.dumps({"base_url": base_url, "token": token}, indent=2))
+```
+
+Replace it with this import (place it just below `from indico_cli.indico_api import IndicoAPI, IndicoClient`):
+
+```python
+from indico_cli.config import (
+    clear_config,
+    get_config_path,
+    load_config,
+    mask_token,
+    save_config,
+)
+```
+
+- [ ] **Step 3: Update the `configure` command's saved-path message**
+
+In the `configure` command, replace:
+
+```python
+        save_config(base_url, token)
+        click.echo(f"Configuration saved to {CONFIG_FILE}")
+```
+
+with:
+
+```python
+        save_config(base_url, token)
+        click.echo(f"Configuration saved to {get_config_path()}")
+```
+
+- [ ] **Step 4: Run the full test suite**
+
+Run: `uv run pytest -v`
+Expected: PASS — all existing tests plus `tests/test_config.py`. No import errors.
+
+- [ ] **Step 5: Smoke-test the CLI loads**
+
+Run: `uv run indico-cli --help`
+Expected: the help text lists existing commands and exits 0 (no traceback).
+
+- [ ] **Step 6: Lint, then commit**
+
+Run: `uvx ruff check indico_cli tests` (fix any reported issues, then re-run until clean).
+
+```bash
+git add indico_cli/cli.py
+git commit -m "refactor: use indico_cli.config for credential persistence"
+```
+
+---
+
+## Task 3: Add the `config` command group (with tests)
+
+**Files:**
+- Modify: `indico_cli/cli.py` (add group after the `configure` command, before `user-info`)
+- Test: `tests/test_cli_config.py`
+
+- [ ] **Step 1: Write the failing CLI tests**
+
+Create `tests/test_cli_config.py`:
+
+```python
+"""CLI tests for the `config` command group."""
+
+import json
+
+import pytest
+from click.testing import CliRunner
+
+from indico_cli.cli import cli
+
+
+@pytest.fixture
+def tmp_xdg(tmp_path, monkeypatch):
+    monkeypatch.setenv("XDG_CONFIG_HOME", str(tmp_path))
+    monkeypatch.delenv("INDICO_BASE_URL", raising=False)
+    monkeypatch.delenv("INDICO_API_TOKEN", raising=False)
+    return tmp_path
+
+
+def _write_config(tmp_path, base_url="https://indico.cern.ch", token="indp_abcdefgh1234"):
+    config_file = tmp_path / "indico-cli" / "config.json"
+    config_file.parent.mkdir(parents=True, exist_ok=True)
+    config_file.write_text(json.dumps({"base_url": base_url, "token": token}))
+    return config_file
+
+
+def test_config_show_masks_token(tmp_xdg):
+    _write_config(tmp_xdg)
+    result = CliRunner().invoke(cli, ["config", "show"])
+    assert result.exit_code == 0
+    assert "indp_...1234" in result.output
+    assert "indp_abcdefgh1234" not in result.output
+    assert "https://indico.cern.ch" in result.output
+
+
+def test_config_show_no_config(tmp_xdg):
+    result = CliRunner().invoke(cli, ["config", "show"])
+    assert result.exit_code == 0
+    assert "No saved configuration" in result.output
+
+
+def test_config_show_notes_env_override(tmp_xdg, monkeypatch):
+    _write_config(tmp_xdg)
+    monkeypatch.setenv("INDICO_API_TOKEN", "indp_envtoken")
+    result = CliRunner().invoke(cli, ["config", "show"])
+    assert result.exit_code == 0
+    assert "INDICO_API_TOKEN" in result.output
+    assert "override" in result.output
+
+
+def test_config_path_prints_path(tmp_xdg):
+    result = CliRunner().invoke(cli, ["config", "path"])
+    assert result.exit_code == 0
+    assert str(tmp_xdg / "indico-cli" / "config.json") in result.output
+
+
+def test_config_clear_with_yes(tmp_xdg):
+    _write_config(tmp_xdg)
+    result = CliRunner().invoke(cli, ["config", "clear", "--yes"])
+    assert result.exit_code == 0
+    assert not (tmp_xdg / "indico-cli" / "config.json").exists()
+
+
+def test_config_clear_nothing(tmp_xdg):
+    result = CliRunner().invoke(cli, ["config", "clear", "--yes"])
+    assert result.exit_code == 0
+    assert "Nothing to clear" in result.output
+
+
+def test_config_clear_aborts_without_confirmation(tmp_xdg):
+    _write_config(tmp_xdg)
+    result = CliRunner().invoke(cli, ["config", "clear"], input="n\n")
+    assert result.exit_code != 0  # click confirm abort -> non-zero exit
+    assert (tmp_xdg / "indico-cli" / "config.json").exists()
+```
+
+- [ ] **Step 2: Run tests to verify they fail**
+
+Run: `uv run pytest tests/test_cli_config.py -v`
+Expected: FAIL — `config` is not a command (Click reports "No such command 'config'").
+
+- [ ] **Step 3: Expand the config import, then add the `config` group to `cli.py`**
+
+First, widen the existing import line in `indico_cli/cli.py` (Task 2 left it importing only the three names it used) to also bring in `clear_config` and `mask_token`:
+
+```python
+from indico_cli.config import (
+    clear_config,
+    get_config_path,
+    load_config,
+    mask_token,
+    save_config,
+)
+```
+
+Then insert this block immediately after the `configure` command function (after its final line, before the `user-info` command). It uses `load_config`, `get_config_path`, `clear_config`, `mask_token` and the already-imported `os`/`click`:
+
+```python
+@cli.group("config")
+def config_group():
+    """Inspect and manage saved Indico CLI configuration."""
+
+
+@config_group.command("show")
+def config_show():
+    """Show saved configuration (token masked)."""
+    cfg = load_config()
+    path = get_config_path()
+    if not cfg:
+        click.echo(f"No saved configuration at {path}")
+    else:
+        click.echo(f"Config file:  {path}")
+        click.echo(f"Base URL:     {cfg.get('base_url', '(none)')}")
+        click.echo(f"Token:        {mask_token(cfg.get('token', ''))}")
+    overrides = [
+        name for name in ("INDICO_BASE_URL", "INDICO_API_TOKEN") if os.getenv(name)
+    ]
+    if overrides:
+        click.echo(
+            f"Note: {' and '.join(overrides)} set in environment; "
+            "these override the config file."
+        )
+
+
+@config_group.command("path")
+def config_path():
+    """Print the path to the config file."""
+    path = get_config_path()
+    state = "exists" if path.exists() else "does not exist"
+    click.echo(f"{path} ({state})")
+
+
+@config_group.command("clear")
+@click.option("--yes", "-y", is_flag=True, default=False, help="Skip the confirmation prompt")
+def config_clear(yes):
+    """Delete the saved configuration file."""
+    path = get_config_path()
+    if not path.exists():
+        click.echo("Nothing to clear")
+        return
+    if not yes:
+        click.confirm(f"Delete saved configuration at {path}?", abort=True)
+    clear_config()
+    click.echo(f"Removed {path}")
+```
+
+- [ ] **Step 4: Run the CLI tests to verify they pass**
+
+Run: `uv run pytest tests/test_cli_config.py -v`
+Expected: PASS (all 7 tests).
+
+- [ ] **Step 5: Run the full suite**
+
+Run: `uv run pytest -v`
+Expected: PASS — everything green.
+
+- [ ] **Step 6: Lint, then commit**
+
+Run: `uvx ruff check indico_cli tests` (fix any reported issues, then re-run until clean).
+
+```bash
+git add indico_cli/cli.py tests/test_cli_config.py
+git commit -m "feat: add config show/path/clear commands"
+```
+
+---
+
+## Task 4: Documentation
+
+**Files:**
+- Modify: `README.md`
+- Modify: `skills/indico-skill/SKILL.md`
+
+- [ ] **Step 1: Update the README commands table**
+
+In `README.md`, in the "All Commands" table, add these three rows immediately after the `configure` row:
+
+```markdown
+| `config show` | Show the saved base URL and a masked token, plus the config file path. |
+| `config path` | Print the path to the config file. |
+| `config clear` | Delete the saved configuration (use `--yes` to skip the prompt). |
+```
+
+- [ ] **Step 2: Add a permissions/location note to the README Configuration section**
+
+In `README.md`, append this paragraph to the "Configuration" section (after the `configure` example block, before the "API tokens can be generated..." line):
+
+```markdown
+Saved credentials live in `$XDG_CONFIG_HOME/indico-cli/config.json` (or
+`~/.config/indico-cli/config.json` when `XDG_CONFIG_HOME` is unset), written with
+owner-only permissions (`0600`). Inspect or reset them with `indico-cli config
+show`, `indico-cli config path`, and `indico-cli config clear`.
+```
+
+- [ ] **Step 3: Update SKILL.md Configure section**
+
+In `skills/indico-skill/SKILL.md`, immediately after the line
+`Environment variables \`INDICO_BASE_URL\` and \`INDICO_API_TOKEN\` override the config file.`,
+add:
+
+```markdown
+
+Inspect or reset saved credentials with `uvx indico-cli config show` (token
+masked), `uvx indico-cli config path`, or `uvx indico-cli config clear`. The
+config file is written with `0600` permissions.
+```
+
+- [ ] **Step 4: Commit**
+
+```bash
+git add README.md skills/indico-skill/SKILL.md
+git commit -m "docs: document config show/path/clear and file permissions"
+```
+
+---
+
+## Self-Review
+
+**Spec coverage:**
+- Harden permissions (dir 0700, file 0600) -> Task 1 `save_config` + permission test.
+- `config` group `show`/`path`/`clear` -> Task 3.
+- Extract dedicated module -> Task 1 (`config.py`) + Task 2 (wire-in).
+- Honor `XDG_CONFIG_HOME` -> Task 1 `get_config_path` + test.
+- `mask_token` format -> Task 1 + tests.
+- `config show` env-override note -> Task 3 + `test_config_show_notes_env_override`.
+- No-file / nothing-to-clear exit-0 states -> Task 3 + tests.
+- Docs (README + SKILL.md) -> Task 4.
+- Resolution unchanged (args -> env -> file) -> Task 2 verified by full suite.
+
+**Placeholder scan:** none — every code/test step shows complete content.
+
+**Type/name consistency:** `get_config_path`, `load_config`, `save_config`, `clear_config`, `mask_token` are defined in Task 1 and used with identical names in Tasks 2-3. Click group function `config_group` (command name `config`) does not shadow the imported names. `--yes/-y` flag matches between command and test.