insightfactory-cli 1.2.0.dev34__tar.gz → 1.3.0.dev39__tar.gz

insightfactory_cli-1.3.0.dev39/.github/workflows/claude.yml

@@ -0,0 +1,144 @@
+# =======================================================
+# GitHub Actions Workflow: Claude Code Assistant
+#
+# Purpose: AI-powered code review and assistance, on demand only.
+#          Triggered by mentioning @claude in a PR comment, an issue
+#          comment, or an inline PR review comment (e.g. `@claude review`).
+#          @agent-review on a PR runs Claude and Codex together through the
+#          shared agent review instead. There is no automatic review on PR open.
+#
+# =======================================================
+
+name: Claude Workflow
+
+on:
+  issue_comment:
+    types: [created]
+  pull_request_review_comment:
+    types: [created]
+
+# No `permissions:` block here on purpose. A called workflow may only reduce the
+# caller's grant, never raise it, and GitHub validates that at startup -- so
+# capping this to `contents: read` made every run fail with `startup_failure`
+# before any job ran. if_s_claude_review.yml declares the scopes it needs
+# (id-token/pull-requests/issues write, actions read); leaving the caller
+# unrestricted is what every other repo in the org that calls it does.
+
+jobs:
+  claude:
+    # Author gating. The comment body is attacker-controlled and the call below
+    # inherits every secret, so restrict the trigger to people with write-ish
+    # access rather than anyone who can leave a comment.
+    if: |
+      contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association) &&
+      contains(github.event.comment.body, '@claude')
+    uses: insightfactory-ai/if_sre_github_actions/.github/workflows/if_s_claude_review.yml@main
+    secrets: inherit
+    with:
+      # CONSTRAINT: the value below is interpolated inside a double-quoted CLI argument with no
+      # escaping. Do NOT include ASCII double-quote characters. Use single quotes or backticks
+      # if you need to quote something. Newlines are fine.
+      append_system_prompt: |
+        This repository (insightfactory-cli) is the production Python `if-cli`, published to public
+        PyPI. Read CLAUDE.md and README.md before reviewing; the rules below are the ones that get
+        violated most often.
+
+        Runtime and layout:
+        - Runtime code is stdlib-only. Flag any new runtime dependency in pyproject.toml or any
+          import outside the standard library.
+        - Keep one module per CLI command under `src/if_cli/commands/`.
+        - Do not suggest third-party HTTP, OAuth, or CLI frameworks; the codebase uses urllib and
+          argparse deliberately.
+
+        Security and auth:
+        - A profile's bearer token must never be sent outside that profile's factory origin. Flag
+          any code path that could forward a token to another host.
+        - OAuth uses authorization-code flow with PKCE and a loopback-only (`127.0.0.1`) callback.
+          The CLI is a public client with no client secret.
+        - Do not commit credentials, access tokens, refresh tokens, or client secrets in code,
+          tests, or fixtures. Fixtures must use neutral hostnames such as `factory.example`.
+
+        On-disk compatibility:
+        - Profiles and tokens must be written only through the atomic private-file helpers
+          (`write_private_file` in config.py): `0o600` files, `0o700` directories, atomic replace
+          via temp file.
+        - The Node CLI is retired. Profile sections keep the Node layout (`~/.insightfactory`,
+          `INSIGHTFACTORY_CONFIG_DIR` override). `token-cache.json` is version 2: keyed by
+          profile name, with the host in each entry. Older `if-cli` releases and the Node CLI
+          cannot read it, and that is accepted. Reading a version 1 cache must keep working.
+
+        Programmatic API (breaking-change surface):
+        - These four symbols are a supported in-process surface documented in README.md:
+          `if_cli.config.load_config`, `if_cli.config.get_profile`, `if_cli.oauth.get_valid_token`,
+          `if_cli.runtime.CliError`.
+        - They must raise `CliError` on failure (never `SystemExit`), never write to stdout, never
+          launch a browser or block on interactive input, and use only bounded waits.
+        - Changing signatures, behaviour, or removing any of them requires a major version bump.
+
+        Tests:
+        - `tests/` uses isolated config dirs via `INSIGHTFACTORY_CONFIG_DIR`; never smoke-test
+          against `~/.insightfactory`.
+
+  agent-review:
+    # Claude and Codex review the PR together, one matrix job each. The shared
+    # workflow's request check refuses anything but a PR comment from someone with
+    # write access that names @agent-review as a whole word.
+    if: >-
+      contains(github.event.comment.body, '@agent-review')
+      && (github.event_name == 'pull_request_review_comment' || github.event.issue.pull_request)
+    permissions:
+      id-token: write
+      contents: read
+      pull-requests: write
+      issues: write
+      actions: read
+      checks: read
+      statuses: read
+    uses: insightfactory-ai/if_sre_github_actions/.github/workflows/if_s_agent_review.yml@main
+    secrets: inherit
+    with:
+      # A reviewer approves only an approved verdict with no P0, P1 or P2, and a
+      # person from the required team still approves every PR (the Approvers
+      # ruleset on develop, test and main).
+      allow_agent_approval: true
+      # The same instructions as the @claude job above; keep the two in step.
+      append_system_prompt: |
+        This repository (insightfactory-cli) is the production Python `if-cli`, published to public
+        PyPI. Read CLAUDE.md and README.md before reviewing; the rules below are the ones that get
+        violated most often.
+
+        Runtime and layout:
+        - Runtime code is stdlib-only. Flag any new runtime dependency in pyproject.toml or any
+          import outside the standard library.
+        - Keep one module per CLI command under `src/if_cli/commands/`.
+        - Do not suggest third-party HTTP, OAuth, or CLI frameworks; the codebase uses urllib and
+          argparse deliberately.
+
+        Security and auth:
+        - A profile's bearer token must never be sent outside that profile's factory origin. Flag
+          any code path that could forward a token to another host.
+        - OAuth uses authorization-code flow with PKCE and a loopback-only (`127.0.0.1`) callback.
+          The CLI is a public client with no client secret.
+        - Do not commit credentials, access tokens, refresh tokens, or client secrets in code,
+          tests, or fixtures. Fixtures must use neutral hostnames such as `factory.example`.
+
+        On-disk compatibility:
+        - Profiles and tokens must be written only through the atomic private-file helpers
+          (`write_private_file` in config.py): `0o600` files, `0o700` directories, atomic replace
+          via temp file.
+        - The Node CLI is retired. Profile sections keep the Node layout (`~/.insightfactory`,
+          `INSIGHTFACTORY_CONFIG_DIR` override). `token-cache.json` is version 2: keyed by
+          profile name, with the host in each entry. Older `if-cli` releases and the Node CLI
+          cannot read it, and that is accepted. Reading a version 1 cache must keep working.
+
+        Programmatic API (breaking-change surface):
+        - These four symbols are a supported in-process surface documented in README.md:
+          `if_cli.config.load_config`, `if_cli.config.get_profile`, `if_cli.oauth.get_valid_token`,
+          `if_cli.runtime.CliError`.
+        - They must raise `CliError` on failure (never `SystemExit`), never write to stdout, never
+          launch a browser or block on interactive input, and use only bounded waits.
+        - Changing signatures, behaviour, or removing any of them requires a major version bump.
+
+        Tests:
+        - `tests/` uses isolated config dirs via `INSIGHTFACTORY_CONFIG_DIR`; never smoke-test
+          against `~/.insightfactory`.

{insightfactory_cli-1.2.0.dev34 → insightfactory_cli-1.3.0.dev39}/CHANGELOG.md

@@ -11,6 +11,40 @@ that: every PR into `develop` must add an entry here, and a tag whose version ha
 section fails rather than releasing an empty page. The version only moves when the
 last one has been released, so a cycle's PRs share a section.
 
+## 1.3.0
+
+### Changed
+
+- Internal only: a PR comment naming `@agent-review` runs the shared Claude and
+  Codex review, which can approve a PR that a person from the required team
+  still approves. The CLI itself is unchanged.
+- `logout` names the profile as well as the host in its output, for example
+  `✓ cleared cached token for profile 'dev' (https://factory.example)`, because
+  two profiles can now share a host.
+
+### Fixed
+
+- The token cache is keyed by profile, not by host. Before, two profiles on the
+  same factory host shared one token, so signing in as a second account on one
+  profile silently replaced the other profile's token, and that profile then
+  acted as the second account. Each profile now keeps its own token through
+  `login`, refresh, `token`, `api`, `mcp`, `profiles`, `set-token` and `logout`.
+  Each entry records the host that issued it, and a profile whose `host` changes
+  stops using it, so the token is not sent to the new origin.
+- `token-cache.json` moves to version 2. The CLI reads a version 1 cache and
+  gives each host's token to every profile on that host, so upgrading needs no
+  new login. The first write saves version 2. Older `if-cli` releases cannot
+  read version 2 and stop on every command, `login` included. To downgrade,
+  move `token-cache.json` aside, then sign in to each profile again.
+- A version 1 cache cannot say which account its host entry holds. If two
+  profiles on one host signed in as different accounts before this release, both
+  start out holding whichever account signed in last. Run
+  `if-cli login -p <profile>` once for each such profile to give it its own
+  account.
+- Internal only: the test that `mcp` answers `initialize` before the catalogue
+  build finishes allows 3 seconds instead of 1, because starting the subprocess
+  on a CI runner took just over a second and failed the test at random.
+
 ## 1.2.0
 
 ### Added

{insightfactory_cli-1.2.0.dev34 → insightfactory_cli-1.3.0.dev39}/CLAUDE.md

@@ -22,8 +22,9 @@ uv run ty check
 - OAuth uses authorization-code flow with PKCE and a loopback-only callback.
 - Store profiles and tokens through the atomic private-file helpers.
 - The Node CLI is retired; `[factory <name>]` sections are Python-only. Profile
-  sections and the token store keep the Node layout (`~/.insightfactory`,
-  `INSIGHTFACTORY_CONFIG_DIR` override).
+  sections keep the Node layout (`~/.insightfactory`, `INSIGHTFACTORY_CONFIG_DIR`
+  override). `token-cache.json` is version 2: keyed by profile name, with the
+  host in each entry. An older `if-cli` cannot read it.
 - Do not commit credentials, access tokens, refresh tokens, or client secrets.
 - Test fixtures use only neutral hostnames (`factory.example`).
 - Do not publish to PyPI from a developer machine. Publishing happens in CI: the

{insightfactory_cli-1.2.0.dev34 → insightfactory_cli-1.3.0.dev39}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: insightfactory-cli
-Version: 1.2.0.dev34
+Version: 1.3.0.dev39
 Summary: Profile-based authentication CLI for the InsightFactory Interfaces API
 Project-URL: Homepage, https://insightfactory.ai
 Author-email: "insightfactory.ai Support" <support@insightfactory.ai>
@@ -27,9 +27,9 @@ Description-Content-Type: text/markdown
 Profile-based authentication CLI for the InsightFactory Interfaces API. It
 installs the `if-cli` command, which logs in through the browser with OAuth
 authorization code and PKCE, refreshes tokens, and makes authenticated API
-calls. Profiles live in `~/.insightfactory` in the same layout the Node
-`@insightfactory-ai/if-cli` uses, so both implementations can share one config
-directory.
+calls. Profiles live in `~/.insightfactory` in the same layout the retired Node
+`@insightfactory-ai/if-cli` used. The token cache uses its own format, described
+under "How authentication works".
 
 This is the production Python CLI, published to public PyPI. It needs Python
 3.10 or newer.
@@ -229,8 +229,20 @@ rejected.
 - Profiles live in `~/.insightfactory/config`, one per customer and environment.
 - The CLI manages the profile file and regenerates it on updates. Comments and
   empty sections are not preserved.
-- Tokens are cached by host in `~/.insightfactory/token-cache.json` with file
-  mode `0600`.
+- Tokens are cached per profile in `~/.insightfactory/token-cache.json` with
+  file mode `0600`. Two profiles on the same host can sign in as different
+  accounts, and each keeps its own token. Each entry records the host that
+  issued it, and a profile uses it only while its `host` still matches, so a
+  token never goes to another origin after a host change.
+- `if-cli` 1.3.0 and later write version 2 of the cache, keyed by profile
+  name. They read the older version 1 cache, keyed by host, and give its token
+  to every profile on that host, so an upgrade needs no new login. Older
+  `if-cli` releases and the Node CLI cannot read version 2 and stop on every
+  command, `login` included. To downgrade, move `token-cache.json` aside, then
+  sign in to each profile again.
+- A version 1 cache holds one account per host. If two profiles on one host
+  signed in as different accounts before 1.3.0, both start out as whichever
+  account signed in last. Run `if-cli login -p <profile>` once for each of them.
 - The configuration directory is `0700`. Configuration and cache updates are
   atomic.
 - Remote factory, authorization, and token endpoints must use HTTPS. HTTP is
@@ -512,9 +524,12 @@ differ:
 - **`--version`** reads the installed package metadata from `1.0.0` onward
   rather than an npm `package.json`.
 
-On-disk profile and token-cache paths, JSON shapes, and file permissions stay
-compatible with the Node CLI, so you can switch implementations without
-re-authenticating.
+On-disk profile and token-cache paths and file permissions match the Node CLI.
+The token cache's JSON shape does not: `if-cli` keys it by profile (version 2),
+which the Node CLI and older `if-cli` releases cannot read. The Python CLI
+still reads a Node-written version 1 cache, so moving from Node to Python needs
+no new login. To move back, move `token-cache.json` aside and sign in to each
+profile again.
 
 ## Licence
 

{insightfactory_cli-1.2.0.dev34 → insightfactory_cli-1.3.0.dev39}/README.md

@@ -3,9 +3,9 @@
 Profile-based authentication CLI for the InsightFactory Interfaces API. It
 installs the `if-cli` command, which logs in through the browser with OAuth
 authorization code and PKCE, refreshes tokens, and makes authenticated API
-calls. Profiles live in `~/.insightfactory` in the same layout the Node
-`@insightfactory-ai/if-cli` uses, so both implementations can share one config
-directory.
+calls. Profiles live in `~/.insightfactory` in the same layout the retired Node
+`@insightfactory-ai/if-cli` used. The token cache uses its own format, described
+under "How authentication works".
 
 This is the production Python CLI, published to public PyPI. It needs Python
 3.10 or newer.
@@ -205,8 +205,20 @@ rejected.
 - Profiles live in `~/.insightfactory/config`, one per customer and environment.
 - The CLI manages the profile file and regenerates it on updates. Comments and
   empty sections are not preserved.
-- Tokens are cached by host in `~/.insightfactory/token-cache.json` with file
-  mode `0600`.
+- Tokens are cached per profile in `~/.insightfactory/token-cache.json` with
+  file mode `0600`. Two profiles on the same host can sign in as different
+  accounts, and each keeps its own token. Each entry records the host that
+  issued it, and a profile uses it only while its `host` still matches, so a
+  token never goes to another origin after a host change.
+- `if-cli` 1.3.0 and later write version 2 of the cache, keyed by profile
+  name. They read the older version 1 cache, keyed by host, and give its token
+  to every profile on that host, so an upgrade needs no new login. Older
+  `if-cli` releases and the Node CLI cannot read version 2 and stop on every
+  command, `login` included. To downgrade, move `token-cache.json` aside, then
+  sign in to each profile again.
+- A version 1 cache holds one account per host. If two profiles on one host
+  signed in as different accounts before 1.3.0, both start out as whichever
+  account signed in last. Run `if-cli login -p <profile>` once for each of them.
 - The configuration directory is `0700`. Configuration and cache updates are
   atomic.
 - Remote factory, authorization, and token endpoints must use HTTPS. HTTP is
@@ -488,9 +500,12 @@ differ:
 - **`--version`** reads the installed package metadata from `1.0.0` onward
   rather than an npm `package.json`.
 
-On-disk profile and token-cache paths, JSON shapes, and file permissions stay
-compatible with the Node CLI, so you can switch implementations without
-re-authenticating.
+On-disk profile and token-cache paths and file permissions match the Node CLI.
+The token cache's JSON shape does not: `if-cli` keys it by profile (version 2),
+which the Node CLI and older `if-cli` releases cannot read. The Python CLI
+still reads a Node-written version 1 cache, so moving from Node to Python needs
+no new login. To move back, move `token-cache.json` aside and sign in to each
+profile again.
 
 ## Licence
 

{insightfactory_cli-1.2.0.dev34 → insightfactory_cli-1.3.0.dev39}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "insightfactory-cli"
-version = "1.2.0.dev34"
+version = "1.3.0.dev39"
 description = "Profile-based authentication CLI for the InsightFactory Interfaces API"
 readme = "README.md"
 requires-python = ">=3.10"

insightfactory_cli-1.3.0.dev39/src/if_cli/cache.py

@@ -0,0 +1,318 @@
+from __future__ import annotations
+
+import hashlib
+import json
+import math
+import os
+import time
+from collections.abc import Callable
+from typing import NoReturn, TypedDict, TypeGuard, TypeVar
+
+from if_cli.config import cache_file, get_profile, is_factory_section, load_config, write_private_file
+from if_cli.constants import EXPIRY_SLACK_SECONDS
+from if_cli.runtime import die, is_record
+
+CACHE_LOCK_STALE_MS = 30_000
+CACHE_VERSION = 2
+HOST_KEYED_CACHE_VERSION = 1
+
+
+class CacheEntry(TypedDict, total=False):
+    host: str
+    grant: str
+    access_token: str
+    refresh_token: str
+    expires_at: float
+    token_endpoint: str
+    client_id: str
+
+
+class TokenCache(TypedDict):
+    """Version 2 keys `tokens` by profile name. Each entry records the host it was
+    issued for, and is used only while the profile still points at that host."""
+
+    version: int
+    tokens: dict[str, CacheEntry]
+
+
+class TokenOwner(TypedDict):
+    """The part of a `Profile` that owns a cache entry."""
+
+    name: str
+    host: str
+
+
+def empty_cache() -> TokenCache:
+    return {"version": CACHE_VERSION, "tokens": {}}
+
+
+def entry_for(cache: TokenCache, owner: TokenOwner) -> CacheEntry | None:
+    """The profile's entry, unless it was issued for a host the profile no longer
+    names: a bearer token never goes to an origin other than the one it came from."""
+    entry = cache["tokens"].get(owner["name"])
+    if entry is None or entry.get("host") != owner["host"]:
+        return None
+    return entry
+
+
+def _siblings(cache: TokenCache, owner: TokenOwner, grant: str | None) -> list[str]:
+    """Other profiles on the same host that share the owner's `grant`.
+
+    Only a version 1 cache produces these: it held one entry per host, which the
+    upgrade copies to every profile on that host, marking the copies with one
+    `grant` id. They are one sign-in, so a rotation or rejection on one applies to
+    all of them; leaving a sibling on the rotated-out refresh token would replay it
+    on its next refresh. The id outlives a cleared refresh token, so a refresh that
+    lands after a peer's invalid_grant still reaches every sibling. A login or a
+    pasted token starts a fresh entry without it, which ends the sharing.
+    """
+    if not grant:
+        return []
+    return [
+        name
+        for name, entry in cache["tokens"].items()
+        if name != owner["name"] and entry.get("host") == owner["host"] and entry.get("grant") == grant
+    ]
+
+
+def _positive_integer_env(name: str, fallback: int) -> int:
+    raw = os.environ.get(name)
+    if raw is None:
+        return fallback
+    try:
+        value = float(raw)
+    except (TypeError, ValueError):
+        return fallback
+    if math.isfinite(value) and value == int(value) and value > 0:
+        return int(value)
+    return fallback
+
+
+def _cache_lock_file() -> str:
+    return f"{cache_file()}.lock"
+
+
+def _cache_lock_attempts() -> int:
+    return _positive_integer_env("INSIGHTFACTORY_CACHE_LOCK_ATTEMPTS", 200)
+
+
+def _cache_lock_retry_ms() -> int:
+    return _positive_integer_env("INSIGHTFACTORY_CACHE_LOCK_RETRY_MS", 25)
+
+
+def is_fresh(entry: CacheEntry, now_seconds: float | None = None) -> bool:
+    if now_seconds is None:
+        now_seconds = time.time()
+    return entry["expires_at"] - EXPIRY_SLACK_SECONDS > now_seconds
+
+
+def _is_cache_entry(value: object, *, with_host: bool) -> TypeGuard[CacheEntry]:
+    if not is_record(value):
+        return False
+    if with_host and not isinstance(value.get("host"), str):
+        return False
+    if "grant" in value and not isinstance(value.get("grant"), str):
+        return False
+    access_token = value.get("access_token")
+    expires_at = value.get("expires_at")
+    token_endpoint = value.get("token_endpoint")
+    refresh_token = value.get("refresh_token")
+    client_id = value.get("client_id")
+    return (
+        isinstance(access_token, str)
+        and isinstance(expires_at, (int, float))
+        and not isinstance(expires_at, bool)
+        and math.isfinite(float(expires_at))
+        and isinstance(token_endpoint, str)
+        and ("refresh_token" not in value or isinstance(refresh_token, str))
+        and ("client_id" not in value or isinstance(client_id, str))
+    )
+
+
+def _invalid_structure() -> NoReturn:
+    die(f"token cache {cache_file()} has an invalid structure; move it aside and log in again")
+
+
+def _parse_entries(tokens_value: dict[str, object], *, with_host: bool) -> dict[str, CacheEntry]:
+    tokens: dict[str, CacheEntry] = {}
+    for key, entry in tokens_value.items():
+        if not _is_cache_entry(entry, with_host=with_host):
+            die(f"token cache entry for {key} is invalid; move {cache_file()} aside and log in again")
+        tokens[key] = entry
+    return tokens
+
+
+def _from_host_keyed(tokens_by_host: dict[str, CacheEntry]) -> dict[str, CacheEntry]:
+    """Give each configured profile the version 1 entry for its host.
+
+    A host entry with no profile left on that host is unreachable, so it is
+    dropped. A profile that does not resolve gets nothing, as it could not have
+    used a token before either.
+    """
+    config = load_config()
+    tokens: dict[str, CacheEntry] = {}
+    for section in config:
+        if is_factory_section(section):
+            continue
+        name = "DEFAULT" if section == "" else section
+        try:
+            host = get_profile(config, name)["host"]
+        except Exception:
+            # Not only CliError: a bad port raises ValueError or OverflowError. One
+            # broken profile must not stop every other profile's cache read.
+            continue
+        entry = tokens_by_host.get(host)
+        if entry is not None:
+            migrated = entry.copy()
+            migrated["host"] = host
+            tokens[name] = migrated
+    hosts = [entry["host"] for entry in tokens.values()]
+    for entry in tokens.values():
+        refresh_token = entry.get("refresh_token")
+        if refresh_token and hosts.count(entry["host"]) > 1:
+            # Derived, not random: every process reading the same version 1 file
+            # agrees on it until the first write saves version 2.
+            entry["grant"] = hashlib.sha256(f"{entry['host']}\n{refresh_token}".encode()).hexdigest()[:32]
+    return tokens
+
+
+def _parse_cache(raw: str) -> TokenCache:
+    value: object = json.loads(raw)
+    if not is_record(value):
+        _invalid_structure()
+    tokens_value = value.get("tokens")
+    if not is_record(tokens_value):
+        _invalid_structure()
+    version = value.get("version")
+    if version == CACHE_VERSION:
+        return {"version": CACHE_VERSION, "tokens": _parse_entries(tokens_value, with_host=True)}
+    if version == HOST_KEYED_CACHE_VERSION:
+        tokens_by_host = _parse_entries(tokens_value, with_host=False)
+        return {"version": CACHE_VERSION, "tokens": _from_host_keyed(tokens_by_host)}
+    _invalid_structure()
+
+
+def load_cache() -> TokenCache:
+    try:
+        with open(cache_file(), encoding="utf-8") as handle:
+            return _parse_cache(handle.read())
+    except FileNotFoundError:
+        return empty_cache()
+    except json.JSONDecodeError:
+        die(f"token cache {cache_file()} is not valid JSON; move it aside and log in again")
+
+
+def _save_cache(cache: TokenCache) -> None:
+    write_private_file(cache_file(), f"{json.dumps(cache, indent=2)}\n")
+
+
+T = TypeVar("T")
+
+
+def with_cache_lock(operation: Callable[[], T]) -> T:
+    lock_file = _cache_lock_file()
+    os.makedirs(os.path.dirname(lock_file), mode=0o700, exist_ok=True)
+    attempts = _cache_lock_attempts()
+    retry_ms = _cache_lock_retry_ms()
+    for _attempt in range(attempts):
+        try:
+            descriptor = os.open(lock_file, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
+        except FileExistsError:
+            try:
+                mtime_ms = os.stat(lock_file).st_mtime * 1000
+                if time.time() * 1000 - mtime_ms > CACHE_LOCK_STALE_MS:
+                    os.unlink(lock_file)
+                    continue
+            except OSError:
+                pass
+            time.sleep(retry_ms / 1000)
+            continue
+        try:
+            return operation()
+        finally:
+            os.close(descriptor)
+            try:
+                os.unlink(lock_file)
+            except OSError:
+                pass
+    die(f"timed out waiting for token cache lock {lock_file}")
+
+
+def clear_token(owner: TokenOwner) -> bool:
+    """Remove the profile's entry, whichever host it was issued for."""
+
+    def operation() -> bool:
+        cache = load_cache()
+        if owner["name"] not in cache["tokens"]:
+            return False
+        del cache["tokens"][owner["name"]]
+        _save_cache(cache)
+        return True
+
+    return with_cache_lock(operation)
+
+
+def clear_refresh_token_if_matches(owner: TokenOwner, rejected_token: str) -> bool:
+    def operation() -> bool:
+        cache = load_cache()
+        entry = entry_for(cache, owner)
+        if not entry or entry.get("refresh_token") != rejected_token:
+            return False
+        for name in _siblings(cache, owner, entry.get("grant")):
+            if cache["tokens"][name].get("refresh_token") == rejected_token:
+                cache["tokens"][name].pop("refresh_token", None)
+        entry.pop("refresh_token", None)
+        _save_cache(cache)
+        return True
+
+    return with_cache_lock(operation)
+
+
+def store_tokens(
+    owner: TokenOwner,
+    token_response: dict[str, object],
+    token_endpoint: str,
+    client_id: str | None = None,
+    *,
+    replace: bool = False,
+) -> CacheEntry:
+    """Write the profile's entry. `replace` starts it afresh (a login or a pasted
+    token); otherwise it updates the entry in place (a refresh)."""
+
+    def operation() -> CacheEntry:
+        cache = load_cache()
+        previous = None if replace else entry_for(cache, owner)
+        expires_in_raw = token_response.get("expires_in")
+        if (
+            isinstance(expires_in_raw, bool)
+            or not isinstance(expires_in_raw, (int, float))
+            or not math.isfinite(float(expires_in_raw))
+        ):
+            expires_in: int | float = 3600
+        else:
+            expires_in = expires_in_raw
+        entry: CacheEntry = previous.copy() if previous is not None else {}
+        access_token = token_response.get("access_token")
+        if not isinstance(access_token, str):
+            die("token response did not include a valid access token")
+        entry["host"] = owner["host"]
+        entry["access_token"] = access_token
+        entry["expires_at"] = int(math.floor(time.time()) + expires_in)
+        entry["token_endpoint"] = token_endpoint
+        if client_id:
+            entry["client_id"] = client_id
+        else:
+            entry.pop("client_id", None)
+        refresh_token = token_response.get("refresh_token")
+        if isinstance(refresh_token, str) and refresh_token:
+            entry["refresh_token"] = refresh_token
+        elif replace:
+            entry.pop("refresh_token", None)
+        if previous is not None:
+            for name in _siblings(cache, owner, previous.get("grant")):
+                cache["tokens"][name] = entry.copy()
+        cache["tokens"][owner["name"]] = entry
+        _save_cache(cache)
+        return entry
+
+    return with_cache_lock(operation)

{insightfactory_cli-1.2.0.dev34 → insightfactory_cli-1.3.0.dev39}/src/if_cli/commands/logout.py

@@ -14,7 +14,6 @@ LOGOUT_OPTIONS: Options = {
 def logout_command(argv: list[str]) -> None:
     values, _positionals = parse_args(argv, options=LOGOUT_OPTIONS)
     profile = get_profile(load_config(), resolve_profile_name(values["profile"]))
-    removed = clear_token(profile["host"])
-    sys.stdout.write(
-        f"✓ cleared cached token for {profile['host']}\n" if removed else f"no cached token for {profile['host']}\n"
-    )
+    removed = clear_token(profile)
+    target = f"profile '{profile['name']}' ({profile['host']})"
+    sys.stdout.write(f"✓ cleared cached token for {target}\n" if removed else f"no cached token for {target}\n")