induscode 0.1.0__py3-none-any.whl

induscode/console/overlays/auth.py

@@ -0,0 +1,503 @@
+"""Auth overlays — the sign-in / sign-out, OAuth-flow, and plugin dialogs.
+
+Port of TS ``src/console/overlays/auth.tsx``. This module owns the four modal
+kinds tied to credentials and host-supplied overlays: the provider sign-in
+launcher (``signIn``), the sign-out confirmation (``signOut``), the in-flight
+OAuth device/redirect flow (``oauth``), and a plugin-supplied overlay
+(``plugin``).
+
+Dialog-API inversion (port plan analysis 02, risk 1) — the redesigned spots:
+
+- **Sign-in hand-off.** TS dispatched ``modal:open { kind: "oauth" }`` from
+  inside the sign-in dialog and let the host re-route. Here the chain is an
+  *awaited sub-flow*: :func:`run_sign_in` awaits the provider pick (or skips
+  it for a ``/login <provider>`` payload) and then awaits
+  :func:`_run_auth_entry` directly, so the reducer sees exactly one
+  ``modal:open``/``modal:close`` pair per user-raised overlay.
+- **The parked resolver.** TS parked a ``pending.current`` callback ref the
+  dialog's submit fulfilled. Here the framework
+  :class:`~indusagi.react_ink.OAuthDialog` *is* the prompt seam: its
+  ``ask()`` parks an :class:`asyncio.Future` that Enter resolves, and the
+  whole login choreography runs as a ``flow`` worker the dialog drives —
+  the launch adapter's :class:`~induscode.launch.OAuthLoginCallbacks` are
+  bridged onto the dialog's ``update_state``/``ask`` seams.
+- **Completion.** TS closed the modal from inside the callback chain; here
+  the flow returns exit code 0, the dialog dismisses itself with that code,
+  and this module's post-await code binds a model + returns the success
+  status event. A failed flow posts the TS ``"Sign-in did not complete."``
+  progress line and keeps the dialog open (Esc then cancels).
+"""
+
+from __future__ import annotations
+
+import asyncio
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, Any, Final
+
+from rich.text import Text
+from textual.binding import Binding
+from textual.screen import ModalScreen
+from textual.widgets import Static
+
+from indusagi.react_ink import (
+    AuthRedirectInfo,
+    DialogFrame,
+    LoginDialog,
+    LoginProviderOption,
+    OAuthDialog,
+    OAuthOverlayState,
+    SavedAccountOption,
+)
+
+from induscode.console.contract import (
+    ConsoleEvent,
+    OverlayServices,
+    StatusMessage,
+    StatusSet,
+)
+from induscode.launch import OAuthAuthorization, OAuthLoginCallbacks, OAuthPrompt
+
+if TYPE_CHECKING:
+    from textual.app import App, ComposeResult
+
+__all__ = [
+    "PluginOverlayScreen",
+    "PluginRequest",
+    "login_provider_rows",
+    "read_entry_mode",
+    "read_plugin_request",
+    "read_provider_id",
+    "read_requested_provider",
+    "run_oauth_flow",
+    "run_plugin",
+    "run_sign_in",
+    "run_sign_out",
+    "saved_account_rows",
+    "seed_oauth_state",
+    "select_provider_model",
+]
+
+
+# ---------------------------------------------------------------------------
+# Payload narrowing (TS readRequestedProvider / readProviderId / readEntryMode)
+# ---------------------------------------------------------------------------
+
+
+def read_requested_provider(payload: object | None) -> str | None:
+    """Narrow the opaque sign-in payload to a requested provider id, when one
+    was carried (from ``/login <provider>``). ``None`` for a bare launcher."""
+    if isinstance(payload, dict):
+        provider_id = payload.get("providerId")
+        if isinstance(provider_id, str) and len(provider_id) > 0:
+            return provider_id
+    return None
+
+
+def read_provider_id(payload: object | None) -> str:
+    """Narrow the opaque oauth payload to the provider id it carries."""
+    if isinstance(payload, dict):
+        provider_id = payload.get("providerId")
+        if isinstance(provider_id, str):
+            return provider_id
+    return ""
+
+
+def read_entry_mode(payload: object | None) -> str:
+    """Narrow the opaque payload to its entry mode; defaults to the OAuth
+    flow (``"apiKey"`` is the only other recognised mode)."""
+    if isinstance(payload, dict) and payload.get("mode") == "apiKey":
+        return "apiKey"
+    return "oauth"
+
+
+# ---------------------------------------------------------------------------
+# Directory / vault projections
+# ---------------------------------------------------------------------------
+
+
+def login_provider_rows(services: OverlayServices) -> list[LoginProviderOption]:
+    """The merged login directory as framework dialog rows, tolerant of any
+    directory fault (the TS provider-list try/catch)."""
+    try:
+        return [
+            LoginProviderOption(id=entry.id, label=entry.label, authKind=entry.auth_kind)
+            for entry in services.list_login_providers()
+        ]
+    except Exception:
+        return []
+
+
+async def saved_account_rows(services: OverlayServices) -> list[SavedAccountOption]:
+    """Every saved account across the known providers, as sign-out rows.
+
+    A provider whose vault read fails contributes nothing; a directory fault
+    yields the rows gathered so far (TS semantics verbatim, label included:
+    ``"{provider label} · {accountId}"``).
+    """
+    rows: list[SavedAccountOption] = []
+    try:
+        providers = services.list_login_providers()
+    except Exception:
+        return rows
+    for provider in providers:
+        try:
+            names = await services.vault.list_accounts(provider.id)
+        except Exception:
+            names = []
+        for account_id in names:
+            rows.append(
+                SavedAccountOption(
+                    provider=provider.id,
+                    accountId=account_id,
+                    label=f"{provider.label} · {account_id}",
+                )
+            )
+    return rows
+
+
+def _provider_name(services: OverlayServices, provider_id: str) -> str:
+    """The human label for a provider id, falling back to the id itself."""
+    try:
+        for entry in services.list_login_providers():
+            if entry.id == provider_id:
+                return entry.label
+    except Exception:
+        pass
+    return provider_id
+
+
+def select_provider_model(services: OverlayServices, provider_id: str) -> None:
+    """Bind the session to a model from a freshly-authenticated provider, so
+    a chat turn works immediately after sign-in without a manual ``/model``
+    round-trip.
+
+    Best-effort: a provider with no catalog entry, or a conductor that
+    rejects the switch, is silently left on the current model. The catalog
+    lists a provider's models oldest-first and some early entries are retired
+    (they 404), so the *newest* entry is preferred.
+    """
+    try:
+        cards = [
+            card
+            for card in services.conductor.available_models()
+            if card.provider == provider_id
+        ]
+        if cards:
+            services.conductor.select_model(cards[-1].id)
+    except Exception:
+        # Leave the session on its current model.
+        pass
+
+
+# ---------------------------------------------------------------------------
+# signIn — the provider launcher
+# ---------------------------------------------------------------------------
+
+
+async def run_sign_in(
+    app: "App[Any]",
+    payload: object | None,
+    services: OverlayServices | None,
+) -> tuple[ConsoleEvent, ...]:
+    """The provider sign-in launcher flow.
+
+    Lists the merged login directory and routes the chosen entry by its auth
+    kind into :func:`_run_auth_entry` — a browser provider opens the OAuth
+    choreography, an api-key provider opens the inline key input. When the
+    payload names a known provider (``/login anthropic``), the picker is
+    skipped entirely and that provider's entry flow opens straight away.
+    """
+    if services is None:
+        return ()
+    providers = login_provider_rows(services)
+
+    requested = read_requested_provider(payload)
+    direct = (
+        next((p for p in providers if p.id == requested), None)
+        if requested is not None
+        else None
+    )
+    if direct is not None:
+        mode = "oauth" if direct.authKind == "oauth" else "apiKey"
+        return await _run_auth_entry(app, services, direct.id, mode)
+
+    chosen = await app.push_screen_wait(LoginDialog(mode="login", providers=providers))
+    if not isinstance(chosen, LoginProviderOption):
+        return ()
+    mode = "oauth" if chosen.authKind == "oauth" else "apiKey"
+    return await _run_auth_entry(app, services, chosen.id, mode)
+
+
+# ---------------------------------------------------------------------------
+# signOut — the saved-account remover
+# ---------------------------------------------------------------------------
+
+
+async def run_sign_out(
+    app: "App[Any]",
+    payload: object | None,
+    services: OverlayServices | None,
+) -> tuple[ConsoleEvent, ...]:
+    """The sign-out confirmation flow: enumerate every saved account across
+    the known providers and remove the chosen one through the vault."""
+    if services is None:
+        return ()
+    accounts = await saved_account_rows(services)
+    chosen = await app.push_screen_wait(LoginDialog(mode="logout", accounts=accounts))
+    if isinstance(chosen, SavedAccountOption):
+        try:
+            await services.vault.remove(chosen.provider, chosen.accountId)
+        except Exception:
+            # Swallow: closing the overlay is the right end state regardless.
+            pass
+    return ()
+
+
+# ---------------------------------------------------------------------------
+# oauth — the in-flight browser / api-key entry flow
+# ---------------------------------------------------------------------------
+
+
+def seed_oauth_state(provider_id: str, provider_name: str, mode: str) -> OAuthOverlayState:
+    """Seed a fresh overlay state for a provider, before the flow reports
+    anything (the TS ``seedOAuthState`` verbatim)."""
+    entry_mode = "apiKey" if mode == "apiKey" else "oauth"
+    return OAuthOverlayState(
+        providerId=provider_id,
+        providerName=provider_name,
+        mode=entry_mode,
+        inputLabel=(
+            f"{provider_name} API key" if entry_mode == "apiKey" else "Authorization code"
+        ),
+        inputValue="",
+        accountId="default",
+        accountName="Default",
+    )
+
+
+async def run_oauth_flow(
+    app: "App[Any]",
+    payload: object | None,
+    services: OverlayServices | None,
+) -> tuple[ConsoleEvent, ...]:
+    """The ``oauth`` modal kind: narrow the payload and run the entry flow."""
+    if services is None:
+        return ()
+    return await _run_auth_entry(
+        app, services, read_provider_id(payload), read_entry_mode(payload)
+    )
+
+
+async def _run_auth_entry(
+    app: "App[Any]",
+    services: OverlayServices,
+    provider_id: str,
+    mode: str,
+) -> tuple[ConsoleEvent, ...]:
+    """The shared credential-entry flow behind ``signIn`` and ``oauth``."""
+    provider_name = _provider_name(services, provider_id)
+    if mode == "apiKey":
+        return await _run_api_key_entry(app, services, provider_id, provider_name)
+    return await _run_browser_login(app, services, provider_id, provider_name)
+
+
+async def _run_api_key_entry(
+    app: "App[Any]",
+    services: OverlayServices,
+    provider_id: str,
+    provider_name: str,
+) -> tuple[ConsoleEvent, ...]:
+    """Collect an API key through the entry dialog and persist it.
+
+    The TS ``saveApiKey`` ignored an empty submit and kept the dialog open;
+    the Python dialog dismisses on every Enter, so an empty submit re-raises
+    the dialog (same observable behaviour: nothing is stored until a
+    non-empty key is entered or the user cancels).
+    """
+    state = seed_oauth_state(provider_id, provider_name, "apiKey")
+    key = ""
+    while True:
+        result = await app.push_screen_wait(OAuthDialog(state))
+        if result is None:
+            return ()
+        key = result.value.strip()
+        if len(key) > 0:
+            break
+
+    account = state.accountId or "default"
+    try:
+        await services.vault.put_api_key(provider_id, account, key, True)
+        select_provider_model(services, provider_id)
+        status = StatusMessage(kind="success", text=f"Saved your {provider_name} API key.")
+    except Exception:
+        status = StatusMessage(
+            kind="error", text=f"Could not save the {provider_name} API key."
+        )
+    return (StatusSet(status=status),)
+
+
+async def _run_browser_login(
+    app: "App[Any]",
+    services: OverlayServices,
+    provider_id: str,
+    provider_name: str,
+) -> tuple[ConsoleEvent, ...]:
+    """Drive the launch adapter's browser sign-in through the entry dialog.
+
+    The :class:`~induscode.launch.OAuthLoginCallbacks` bag is bridged onto
+    the dialog's seams (risk-1 redesign; module docstring):
+
+    - ``on_auth``     → ``update_state(authInfo=..., progress=...)`` plus the
+      automatic Chrome-first browser launch via ``services.open_login_url``
+      (the dialog renders the instructions and URL on their own rows, so the
+      progress line carries a DISTINCT status — never a copy of the
+      instructions);
+    - ``on_prompt``   → the dialog's ``ask()`` (a parked ``asyncio.Future``
+      resolved by Enter — the TS ``pending.current`` resolver);
+    - ``on_progress`` → ``update_state(progress=...)``.
+
+    Success persists through the vault inside ``start_oauth_login``; this
+    flow then binds a model for the provider and returns the success status.
+    """
+    state = seed_oauth_state(provider_id, provider_name, "oauth")
+
+    async def flow(io: OAuthDialog) -> int:
+        def on_progress(message: str) -> None:
+            io.update_state(progress=message)
+
+        async def on_auth(info: OAuthAuthorization) -> None:
+            io.update_state(
+                authInfo=AuthRedirectInfo(url=info.url, instructions=info.instructions),
+                progress="Opening your browser to sign in…",
+            )
+            opened = await services.open_login_url(info.url)
+            io.update_state(
+                progress=(
+                    "Opened the login URL in your browser. Finish there, then paste "
+                    "the code if prompted."
+                    if opened
+                    else "Could not open a browser automatically — open the URL above, "
+                    "then paste the code if prompted."
+                )
+            )
+
+        async def on_prompt(prompt: OAuthPrompt) -> str:
+            io.update_state(inputLabel=prompt.message)
+            return await io.ask(prompt.message)
+
+        callbacks = OAuthLoginCallbacks(
+            on_auth=on_auth, on_prompt=on_prompt, on_progress=on_progress
+        )
+        try:
+            await services.start_oauth_login(provider_id, callbacks, services.vault)
+        except asyncio.CancelledError:
+            raise
+        except Exception:
+            io.update_state(progress="Sign-in did not complete.")
+            return 1
+        return 0
+
+    result = await app.push_screen_wait(OAuthDialog(state, flow=flow))
+    if result is not None and result.exit_code == 0:
+        select_provider_model(services, provider_id)
+        return (
+            StatusSet(
+                status=StatusMessage(kind="success", text=f"Signed in to {provider_name}.")
+            ),
+        )
+    return ()
+
+
+# ---------------------------------------------------------------------------
+# plugin — the host-supplied overlay
+# ---------------------------------------------------------------------------
+
+
+@dataclass(frozen=True, slots=True)
+class PluginRequest:
+    """The narrowed shape of a plugin overlay request (TS ``PluginRequest``)."""
+
+    #: The surface name (``mcp``, ``memory``, ``composio``, …).
+    surface: str
+    #: A human title for the frame, when the command supplied one.
+    title: str | None = None
+    #: The real, command-gathered body text to render.
+    text: str | None = None
+
+
+def read_plugin_request(payload: object | None) -> PluginRequest:
+    """Narrow the opaque plugin payload into a :class:`PluginRequest`."""
+    if isinstance(payload, dict):
+        surface = payload.get("surface")
+        title = payload.get("title")
+        text = payload.get("text")
+        return PluginRequest(
+            surface=surface if isinstance(surface, str) else "plugin",
+            title=title if isinstance(title, str) else None,
+            text=text if isinstance(text, str) else None,
+        )
+    return PluginRequest(surface="plugin")
+
+
+#: The TS plugin-dialog footer, string identical.
+_PLUGIN_FOOTER: Final[str] = "esc to close"
+
+
+class PluginOverlayScreen(ModalScreen[None]):
+    """A plugin-supplied overlay: the command-gathered body text rendered
+    line-by-line in a labelled :class:`~indusagi.react_ink.DialogFrame`.
+
+    A request that carries no text (an unknown surface) falls back to naming
+    the surface so the frame is never empty. Esc dismisses with ``None``.
+    """
+
+    BINDINGS = [Binding("escape", "close_overlay", "Close", show=False)]
+
+    DEFAULT_CSS = """
+    PluginOverlayScreen {
+        align: center middle;
+    }
+    PluginOverlayScreen .plugin-line {
+        height: auto;
+    }
+    """
+
+    def __init__(
+        self,
+        request: PluginRequest,
+        *,
+        name: str | None = None,
+        id: str | None = None,
+        classes: str | None = None,
+    ) -> None:
+        super().__init__(name=name, id=id, classes=classes)
+        self._request = request
+
+    def compose(self) -> "ComposeResult":
+        request = self._request
+        body = (
+            request.text
+            if request.text is not None
+            else f"No data available for the {request.surface} surface."
+        )
+        with DialogFrame(
+            title=request.title if request.title is not None else "Plugin surface",
+            subtitle=request.surface,
+            footer=_PLUGIN_FOOTER,
+        ):
+            for line in body.split("\n"):
+                yield Static(Text(line if len(line) > 0 else " "), classes="plugin-line")
+
+    def action_close_overlay(self) -> None:
+        self.dismiss(None)
+
+
+async def run_plugin(
+    app: "App[Any]",
+    payload: object | None,
+    services: OverlayServices | None,
+) -> tuple[ConsoleEvent, ...]:
+    """The plugin overlay flow. The only kind that renders without runtime
+    services (the TS group special-cased it the same way)."""
+    await app.push_screen_wait(PluginOverlayScreen(read_plugin_request(payload)))
+    return ()