insightfactory-cli 1.3.0.dev37__tar.gz → 1.3.0.dev39__tar.gz

{insightfactory_cli-1.3.0.dev37 → insightfactory_cli-1.3.0.dev39}/.github/workflows/claude.yml

@@ -62,9 +62,10 @@ jobs:
         - Profiles and tokens must be written only through the atomic private-file helpers
           (`write_private_file` in config.py): `0o600` files, `0o700` directories, atomic replace
           via temp file.
-        - On-disk profile and token-cache paths, JSON shapes, and file permissions must stay
-          byte-compatible with the Node `@insightfactory-ai/if-cli` so users can switch
-          implementations without re-authenticating.
+        - The Node CLI is retired. Profile sections keep the Node layout (`~/.insightfactory`,
+          `INSIGHTFACTORY_CONFIG_DIR` override). `token-cache.json` is version 2: keyed by
+          profile name, with the host in each entry. Older `if-cli` releases and the Node CLI
+          cannot read it, and that is accepted. Reading a version 1 cache must keep working.
 
         Programmatic API (breaking-change surface):
         - These four symbols are a supported in-process surface documented in README.md:
@@ -125,9 +126,10 @@ jobs:
         - Profiles and tokens must be written only through the atomic private-file helpers
           (`write_private_file` in config.py): `0o600` files, `0o700` directories, atomic replace
           via temp file.
-        - On-disk profile and token-cache paths, JSON shapes, and file permissions must stay
-          byte-compatible with the Node `@insightfactory-ai/if-cli` so users can switch
-          implementations without re-authenticating.
+        - The Node CLI is retired. Profile sections keep the Node layout (`~/.insightfactory`,
+          `INSIGHTFACTORY_CONFIG_DIR` override). `token-cache.json` is version 2: keyed by
+          profile name, with the host in each entry. Older `if-cli` releases and the Node CLI
+          cannot read it, and that is accepted. Reading a version 1 cache must keep working.
 
         Programmatic API (breaking-change surface):
         - These four symbols are a supported in-process surface documented in README.md:

{insightfactory_cli-1.3.0.dev37 → insightfactory_cli-1.3.0.dev39}/CHANGELOG.md

@@ -18,6 +18,32 @@ last one has been released, so a cycle's PRs share a section.
 - Internal only: a PR comment naming `@agent-review` runs the shared Claude and
   Codex review, which can approve a PR that a person from the required team
   still approves. The CLI itself is unchanged.
+- `logout` names the profile as well as the host in its output, for example
+  `✓ cleared cached token for profile 'dev' (https://factory.example)`, because
+  two profiles can now share a host.
+
+### Fixed
+
+- The token cache is keyed by profile, not by host. Before, two profiles on the
+  same factory host shared one token, so signing in as a second account on one
+  profile silently replaced the other profile's token, and that profile then
+  acted as the second account. Each profile now keeps its own token through
+  `login`, refresh, `token`, `api`, `mcp`, `profiles`, `set-token` and `logout`.
+  Each entry records the host that issued it, and a profile whose `host` changes
+  stops using it, so the token is not sent to the new origin.
+- `token-cache.json` moves to version 2. The CLI reads a version 1 cache and
+  gives each host's token to every profile on that host, so upgrading needs no
+  new login. The first write saves version 2. Older `if-cli` releases cannot
+  read version 2 and stop on every command, `login` included. To downgrade,
+  move `token-cache.json` aside, then sign in to each profile again.
+- A version 1 cache cannot say which account its host entry holds. If two
+  profiles on one host signed in as different accounts before this release, both
+  start out holding whichever account signed in last. Run
+  `if-cli login -p <profile>` once for each such profile to give it its own
+  account.
+- Internal only: the test that `mcp` answers `initialize` before the catalogue
+  build finishes allows 3 seconds instead of 1, because starting the subprocess
+  on a CI runner took just over a second and failed the test at random.
 
 ## 1.2.0
 

{insightfactory_cli-1.3.0.dev37 → insightfactory_cli-1.3.0.dev39}/CLAUDE.md

@@ -22,8 +22,9 @@ uv run ty check
 - OAuth uses authorization-code flow with PKCE and a loopback-only callback.
 - Store profiles and tokens through the atomic private-file helpers.
 - The Node CLI is retired; `[factory <name>]` sections are Python-only. Profile
-  sections and the token store keep the Node layout (`~/.insightfactory`,
-  `INSIGHTFACTORY_CONFIG_DIR` override).
+  sections keep the Node layout (`~/.insightfactory`, `INSIGHTFACTORY_CONFIG_DIR`
+  override). `token-cache.json` is version 2: keyed by profile name, with the
+  host in each entry. An older `if-cli` cannot read it.
 - Do not commit credentials, access tokens, refresh tokens, or client secrets.
 - Test fixtures use only neutral hostnames (`factory.example`).
 - Do not publish to PyPI from a developer machine. Publishing happens in CI: the

{insightfactory_cli-1.3.0.dev37 → insightfactory_cli-1.3.0.dev39}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: insightfactory-cli
-Version: 1.3.0.dev37
+Version: 1.3.0.dev39
 Summary: Profile-based authentication CLI for the InsightFactory Interfaces API
 Project-URL: Homepage, https://insightfactory.ai
 Author-email: "insightfactory.ai Support" <support@insightfactory.ai>
@@ -27,9 +27,9 @@ Description-Content-Type: text/markdown
 Profile-based authentication CLI for the InsightFactory Interfaces API. It
 installs the `if-cli` command, which logs in through the browser with OAuth
 authorization code and PKCE, refreshes tokens, and makes authenticated API
-calls. Profiles live in `~/.insightfactory` in the same layout the Node
-`@insightfactory-ai/if-cli` uses, so both implementations can share one config
-directory.
+calls. Profiles live in `~/.insightfactory` in the same layout the retired Node
+`@insightfactory-ai/if-cli` used. The token cache uses its own format, described
+under "How authentication works".
 
 This is the production Python CLI, published to public PyPI. It needs Python
 3.10 or newer.
@@ -229,8 +229,20 @@ rejected.
 - Profiles live in `~/.insightfactory/config`, one per customer and environment.
 - The CLI manages the profile file and regenerates it on updates. Comments and
   empty sections are not preserved.
-- Tokens are cached by host in `~/.insightfactory/token-cache.json` with file
-  mode `0600`.
+- Tokens are cached per profile in `~/.insightfactory/token-cache.json` with
+  file mode `0600`. Two profiles on the same host can sign in as different
+  accounts, and each keeps its own token. Each entry records the host that
+  issued it, and a profile uses it only while its `host` still matches, so a
+  token never goes to another origin after a host change.
+- `if-cli` 1.3.0 and later write version 2 of the cache, keyed by profile
+  name. They read the older version 1 cache, keyed by host, and give its token
+  to every profile on that host, so an upgrade needs no new login. Older
+  `if-cli` releases and the Node CLI cannot read version 2 and stop on every
+  command, `login` included. To downgrade, move `token-cache.json` aside, then
+  sign in to each profile again.
+- A version 1 cache holds one account per host. If two profiles on one host
+  signed in as different accounts before 1.3.0, both start out as whichever
+  account signed in last. Run `if-cli login -p <profile>` once for each of them.
 - The configuration directory is `0700`. Configuration and cache updates are
   atomic.
 - Remote factory, authorization, and token endpoints must use HTTPS. HTTP is
@@ -512,9 +524,12 @@ differ:
 - **`--version`** reads the installed package metadata from `1.0.0` onward
   rather than an npm `package.json`.
 
-On-disk profile and token-cache paths, JSON shapes, and file permissions stay
-compatible with the Node CLI, so you can switch implementations without
-re-authenticating.
+On-disk profile and token-cache paths and file permissions match the Node CLI.
+The token cache's JSON shape does not: `if-cli` keys it by profile (version 2),
+which the Node CLI and older `if-cli` releases cannot read. The Python CLI
+still reads a Node-written version 1 cache, so moving from Node to Python needs
+no new login. To move back, move `token-cache.json` aside and sign in to each
+profile again.
 
 ## Licence
 

{insightfactory_cli-1.3.0.dev37 → insightfactory_cli-1.3.0.dev39}/README.md

@@ -3,9 +3,9 @@
 Profile-based authentication CLI for the InsightFactory Interfaces API. It
 installs the `if-cli` command, which logs in through the browser with OAuth
 authorization code and PKCE, refreshes tokens, and makes authenticated API
-calls. Profiles live in `~/.insightfactory` in the same layout the Node
-`@insightfactory-ai/if-cli` uses, so both implementations can share one config
-directory.
+calls. Profiles live in `~/.insightfactory` in the same layout the retired Node
+`@insightfactory-ai/if-cli` used. The token cache uses its own format, described
+under "How authentication works".
 
 This is the production Python CLI, published to public PyPI. It needs Python
 3.10 or newer.
@@ -205,8 +205,20 @@ rejected.
 - Profiles live in `~/.insightfactory/config`, one per customer and environment.
 - The CLI manages the profile file and regenerates it on updates. Comments and
   empty sections are not preserved.
-- Tokens are cached by host in `~/.insightfactory/token-cache.json` with file
-  mode `0600`.
+- Tokens are cached per profile in `~/.insightfactory/token-cache.json` with
+  file mode `0600`. Two profiles on the same host can sign in as different
+  accounts, and each keeps its own token. Each entry records the host that
+  issued it, and a profile uses it only while its `host` still matches, so a
+  token never goes to another origin after a host change.
+- `if-cli` 1.3.0 and later write version 2 of the cache, keyed by profile
+  name. They read the older version 1 cache, keyed by host, and give its token
+  to every profile on that host, so an upgrade needs no new login. Older
+  `if-cli` releases and the Node CLI cannot read version 2 and stop on every
+  command, `login` included. To downgrade, move `token-cache.json` aside, then
+  sign in to each profile again.
+- A version 1 cache holds one account per host. If two profiles on one host
+  signed in as different accounts before 1.3.0, both start out as whichever
+  account signed in last. Run `if-cli login -p <profile>` once for each of them.
 - The configuration directory is `0700`. Configuration and cache updates are
   atomic.
 - Remote factory, authorization, and token endpoints must use HTTPS. HTTP is
@@ -488,9 +500,12 @@ differ:
 - **`--version`** reads the installed package metadata from `1.0.0` onward
   rather than an npm `package.json`.
 
-On-disk profile and token-cache paths, JSON shapes, and file permissions stay
-compatible with the Node CLI, so you can switch implementations without
-re-authenticating.
+On-disk profile and token-cache paths and file permissions match the Node CLI.
+The token cache's JSON shape does not: `if-cli` keys it by profile (version 2),
+which the Node CLI and older `if-cli` releases cannot read. The Python CLI
+still reads a Node-written version 1 cache, so moving from Node to Python needs
+no new login. To move back, move `token-cache.json` aside and sign in to each
+profile again.
 
 ## Licence
 

{insightfactory_cli-1.3.0.dev37 → insightfactory_cli-1.3.0.dev39}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "insightfactory-cli"
-version = "1.3.0.dev37"
+version = "1.3.0.dev39"
 description = "Profile-based authentication CLI for the InsightFactory Interfaces API"
 readme = "README.md"
 requires-python = ">=3.10"

insightfactory_cli-1.3.0.dev39/src/if_cli/cache.py

@@ -0,0 +1,318 @@
+from __future__ import annotations
+
+import hashlib
+import json
+import math
+import os
+import time
+from collections.abc import Callable
+from typing import NoReturn, TypedDict, TypeGuard, TypeVar
+
+from if_cli.config import cache_file, get_profile, is_factory_section, load_config, write_private_file
+from if_cli.constants import EXPIRY_SLACK_SECONDS
+from if_cli.runtime import die, is_record
+
+CACHE_LOCK_STALE_MS = 30_000
+CACHE_VERSION = 2
+HOST_KEYED_CACHE_VERSION = 1
+
+
+class CacheEntry(TypedDict, total=False):
+    host: str
+    grant: str
+    access_token: str
+    refresh_token: str
+    expires_at: float
+    token_endpoint: str
+    client_id: str
+
+
+class TokenCache(TypedDict):
+    """Version 2 keys `tokens` by profile name. Each entry records the host it was
+    issued for, and is used only while the profile still points at that host."""
+
+    version: int
+    tokens: dict[str, CacheEntry]
+
+
+class TokenOwner(TypedDict):
+    """The part of a `Profile` that owns a cache entry."""
+
+    name: str
+    host: str
+
+
+def empty_cache() -> TokenCache:
+    return {"version": CACHE_VERSION, "tokens": {}}
+
+
+def entry_for(cache: TokenCache, owner: TokenOwner) -> CacheEntry | None:
+    """The profile's entry, unless it was issued for a host the profile no longer
+    names: a bearer token never goes to an origin other than the one it came from."""
+    entry = cache["tokens"].get(owner["name"])
+    if entry is None or entry.get("host") != owner["host"]:
+        return None
+    return entry
+
+
+def _siblings(cache: TokenCache, owner: TokenOwner, grant: str | None) -> list[str]:
+    """Other profiles on the same host that share the owner's `grant`.
+
+    Only a version 1 cache produces these: it held one entry per host, which the
+    upgrade copies to every profile on that host, marking the copies with one
+    `grant` id. They are one sign-in, so a rotation or rejection on one applies to
+    all of them; leaving a sibling on the rotated-out refresh token would replay it
+    on its next refresh. The id outlives a cleared refresh token, so a refresh that
+    lands after a peer's invalid_grant still reaches every sibling. A login or a
+    pasted token starts a fresh entry without it, which ends the sharing.
+    """
+    if not grant:
+        return []
+    return [
+        name
+        for name, entry in cache["tokens"].items()
+        if name != owner["name"] and entry.get("host") == owner["host"] and entry.get("grant") == grant
+    ]
+
+
+def _positive_integer_env(name: str, fallback: int) -> int:
+    raw = os.environ.get(name)
+    if raw is None:
+        return fallback
+    try:
+        value = float(raw)
+    except (TypeError, ValueError):
+        return fallback
+    if math.isfinite(value) and value == int(value) and value > 0:
+        return int(value)
+    return fallback
+
+
+def _cache_lock_file() -> str:
+    return f"{cache_file()}.lock"
+
+
+def _cache_lock_attempts() -> int:
+    return _positive_integer_env("INSIGHTFACTORY_CACHE_LOCK_ATTEMPTS", 200)
+
+
+def _cache_lock_retry_ms() -> int:
+    return _positive_integer_env("INSIGHTFACTORY_CACHE_LOCK_RETRY_MS", 25)
+
+
+def is_fresh(entry: CacheEntry, now_seconds: float | None = None) -> bool:
+    if now_seconds is None:
+        now_seconds = time.time()
+    return entry["expires_at"] - EXPIRY_SLACK_SECONDS > now_seconds
+
+
+def _is_cache_entry(value: object, *, with_host: bool) -> TypeGuard[CacheEntry]:
+    if not is_record(value):
+        return False
+    if with_host and not isinstance(value.get("host"), str):
+        return False
+    if "grant" in value and not isinstance(value.get("grant"), str):
+        return False
+    access_token = value.get("access_token")
+    expires_at = value.get("expires_at")
+    token_endpoint = value.get("token_endpoint")
+    refresh_token = value.get("refresh_token")
+    client_id = value.get("client_id")
+    return (
+        isinstance(access_token, str)
+        and isinstance(expires_at, (int, float))
+        and not isinstance(expires_at, bool)
+        and math.isfinite(float(expires_at))
+        and isinstance(token_endpoint, str)
+        and ("refresh_token" not in value or isinstance(refresh_token, str))
+        and ("client_id" not in value or isinstance(client_id, str))
+    )
+
+
+def _invalid_structure() -> NoReturn:
+    die(f"token cache {cache_file()} has an invalid structure; move it aside and log in again")
+
+
+def _parse_entries(tokens_value: dict[str, object], *, with_host: bool) -> dict[str, CacheEntry]:
+    tokens: dict[str, CacheEntry] = {}
+    for key, entry in tokens_value.items():
+        if not _is_cache_entry(entry, with_host=with_host):
+            die(f"token cache entry for {key} is invalid; move {cache_file()} aside and log in again")
+        tokens[key] = entry
+    return tokens
+
+
+def _from_host_keyed(tokens_by_host: dict[str, CacheEntry]) -> dict[str, CacheEntry]:
+    """Give each configured profile the version 1 entry for its host.
+
+    A host entry with no profile left on that host is unreachable, so it is
+    dropped. A profile that does not resolve gets nothing, as it could not have
+    used a token before either.
+    """
+    config = load_config()
+    tokens: dict[str, CacheEntry] = {}
+    for section in config:
+        if is_factory_section(section):
+            continue
+        name = "DEFAULT" if section == "" else section
+        try:
+            host = get_profile(config, name)["host"]
+        except Exception:
+            # Not only CliError: a bad port raises ValueError or OverflowError. One
+            # broken profile must not stop every other profile's cache read.
+            continue
+        entry = tokens_by_host.get(host)
+        if entry is not None:
+            migrated = entry.copy()
+            migrated["host"] = host
+            tokens[name] = migrated
+    hosts = [entry["host"] for entry in tokens.values()]
+    for entry in tokens.values():
+        refresh_token = entry.get("refresh_token")
+        if refresh_token and hosts.count(entry["host"]) > 1:
+            # Derived, not random: every process reading the same version 1 file
+            # agrees on it until the first write saves version 2.
+            entry["grant"] = hashlib.sha256(f"{entry['host']}\n{refresh_token}".encode()).hexdigest()[:32]
+    return tokens
+
+
+def _parse_cache(raw: str) -> TokenCache:
+    value: object = json.loads(raw)
+    if not is_record(value):
+        _invalid_structure()
+    tokens_value = value.get("tokens")
+    if not is_record(tokens_value):
+        _invalid_structure()
+    version = value.get("version")
+    if version == CACHE_VERSION:
+        return {"version": CACHE_VERSION, "tokens": _parse_entries(tokens_value, with_host=True)}
+    if version == HOST_KEYED_CACHE_VERSION:
+        tokens_by_host = _parse_entries(tokens_value, with_host=False)
+        return {"version": CACHE_VERSION, "tokens": _from_host_keyed(tokens_by_host)}
+    _invalid_structure()
+
+
+def load_cache() -> TokenCache:
+    try:
+        with open(cache_file(), encoding="utf-8") as handle:
+            return _parse_cache(handle.read())
+    except FileNotFoundError:
+        return empty_cache()
+    except json.JSONDecodeError:
+        die(f"token cache {cache_file()} is not valid JSON; move it aside and log in again")
+
+
+def _save_cache(cache: TokenCache) -> None:
+    write_private_file(cache_file(), f"{json.dumps(cache, indent=2)}\n")
+
+
+T = TypeVar("T")
+
+
+def with_cache_lock(operation: Callable[[], T]) -> T:
+    lock_file = _cache_lock_file()
+    os.makedirs(os.path.dirname(lock_file), mode=0o700, exist_ok=True)
+    attempts = _cache_lock_attempts()
+    retry_ms = _cache_lock_retry_ms()
+    for _attempt in range(attempts):
+        try:
+            descriptor = os.open(lock_file, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
+        except FileExistsError:
+            try:
+                mtime_ms = os.stat(lock_file).st_mtime * 1000
+                if time.time() * 1000 - mtime_ms > CACHE_LOCK_STALE_MS:
+                    os.unlink(lock_file)
+                    continue
+            except OSError:
+                pass
+            time.sleep(retry_ms / 1000)
+            continue
+        try:
+            return operation()
+        finally:
+            os.close(descriptor)
+            try:
+                os.unlink(lock_file)
+            except OSError:
+                pass
+    die(f"timed out waiting for token cache lock {lock_file}")
+
+
+def clear_token(owner: TokenOwner) -> bool:
+    """Remove the profile's entry, whichever host it was issued for."""
+
+    def operation() -> bool:
+        cache = load_cache()
+        if owner["name"] not in cache["tokens"]:
+            return False
+        del cache["tokens"][owner["name"]]
+        _save_cache(cache)
+        return True
+
+    return with_cache_lock(operation)
+
+
+def clear_refresh_token_if_matches(owner: TokenOwner, rejected_token: str) -> bool:
+    def operation() -> bool:
+        cache = load_cache()
+        entry = entry_for(cache, owner)
+        if not entry or entry.get("refresh_token") != rejected_token:
+            return False
+        for name in _siblings(cache, owner, entry.get("grant")):
+            if cache["tokens"][name].get("refresh_token") == rejected_token:
+                cache["tokens"][name].pop("refresh_token", None)
+        entry.pop("refresh_token", None)
+        _save_cache(cache)
+        return True
+
+    return with_cache_lock(operation)
+
+
+def store_tokens(
+    owner: TokenOwner,
+    token_response: dict[str, object],
+    token_endpoint: str,
+    client_id: str | None = None,
+    *,
+    replace: bool = False,
+) -> CacheEntry:
+    """Write the profile's entry. `replace` starts it afresh (a login or a pasted
+    token); otherwise it updates the entry in place (a refresh)."""
+
+    def operation() -> CacheEntry:
+        cache = load_cache()
+        previous = None if replace else entry_for(cache, owner)
+        expires_in_raw = token_response.get("expires_in")
+        if (
+            isinstance(expires_in_raw, bool)
+            or not isinstance(expires_in_raw, (int, float))
+            or not math.isfinite(float(expires_in_raw))
+        ):
+            expires_in: int | float = 3600
+        else:
+            expires_in = expires_in_raw
+        entry: CacheEntry = previous.copy() if previous is not None else {}
+        access_token = token_response.get("access_token")
+        if not isinstance(access_token, str):
+            die("token response did not include a valid access token")
+        entry["host"] = owner["host"]
+        entry["access_token"] = access_token
+        entry["expires_at"] = int(math.floor(time.time()) + expires_in)
+        entry["token_endpoint"] = token_endpoint
+        if client_id:
+            entry["client_id"] = client_id
+        else:
+            entry.pop("client_id", None)
+        refresh_token = token_response.get("refresh_token")
+        if isinstance(refresh_token, str) and refresh_token:
+            entry["refresh_token"] = refresh_token
+        elif replace:
+            entry.pop("refresh_token", None)
+        if previous is not None:
+            for name in _siblings(cache, owner, previous.get("grant")):
+                cache["tokens"][name] = entry.copy()
+        cache["tokens"][owner["name"]] = entry
+        _save_cache(cache)
+        return entry
+
+    return with_cache_lock(operation)

{insightfactory_cli-1.3.0.dev37 → insightfactory_cli-1.3.0.dev39}/src/if_cli/commands/logout.py

@@ -14,7 +14,6 @@ LOGOUT_OPTIONS: Options = {
 def logout_command(argv: list[str]) -> None:
     values, _positionals = parse_args(argv, options=LOGOUT_OPTIONS)
     profile = get_profile(load_config(), resolve_profile_name(values["profile"]))
-    removed = clear_token(profile["host"])
-    sys.stdout.write(
-        f"✓ cleared cached token for {profile['host']}\n" if removed else f"no cached token for {profile['host']}\n"
-    )
+    removed = clear_token(profile)
+    target = f"profile '{profile['name']}' ({profile['host']})"
+    sys.stdout.write(f"✓ cleared cached token for {target}\n" if removed else f"no cached token for {target}\n")

{insightfactory_cli-1.3.0.dev37 → insightfactory_cli-1.3.0.dev39}/src/if_cli/commands/profiles.py

@@ -5,7 +5,7 @@ import sys
 import time
 from typing import Literal, TypedDict
 
-from if_cli.cache import TokenCache, is_fresh, load_cache
+from if_cli.cache import TokenCache, empty_cache, entry_for, is_fresh, load_cache
 from if_cli.cli import Options, parse_args
 from if_cli.colour import Colour, colourise
 from if_cli.config import config_file, get_profile, is_factory_section, load_config
@@ -57,7 +57,7 @@ def summarize_profiles(
             )
             continue
 
-        entry = cache["tokens"].get(profile["host"])
+        entry = entry_for(cache, profile)
         token: ProfileTokenSummary
         if cache_error:
             token = {"status": "unknown", "error": cache_error}
@@ -99,7 +99,7 @@ def profiles_command(argv: list[str] | None = None) -> None:
         sys.stdout.write(f"no profiles configured in {config_file()}\n")
         return
 
-    cache: TokenCache = {"version": 1, "tokens": {}}
+    cache: TokenCache = empty_cache()
     cache_error: str | None = None
     try:
         cache = load_cache()

{insightfactory_cli-1.3.0.dev37 → insightfactory_cli-1.3.0.dev39}/src/if_cli/commands/set_token.py

@@ -48,7 +48,7 @@ def set_token_command(argv: list[str]) -> None:
     if expiry is not None and expiry <= now:
         die("the provided access token is already expired")
     entry = store_tokens(
-        profile["host"],
+        profile,
         {
             "access_token": token,
             "expires_in": 3600 if expiry is None else expiry - now,

{insightfactory_cli-1.3.0.dev37 → insightfactory_cli-1.3.0.dev39}/src/if_cli/oauth.py

@@ -14,6 +14,7 @@ from urllib.parse import parse_qsl, urlencode, urlparse, urlunparse
 from if_cli.cache import (
     CacheEntry,
     clear_refresh_token_if_matches,
+    entry_for,
     is_fresh,
     load_cache,
     store_tokens,
@@ -334,10 +335,10 @@ def login(profile: Profile, no_browser: bool, options: dict[str, str] | None = N
             "redirect_uri": redirect_uri,
         },
     )
-    return store_tokens(profile["host"], tokens, metadata["token_endpoint"], client_id, replace=True)
+    return store_tokens(profile, tokens, metadata["token_endpoint"], client_id, replace=True)
 
 
-def _refresh(host: str, entry: CacheEntry, refresh_token: str, client_id: str) -> CacheEntry:
+def _refresh(profile: Profile, entry: CacheEntry, refresh_token: str, client_id: str) -> CacheEntry:
     tokens = _token_request(
         entry["token_endpoint"],
         {
@@ -346,12 +347,12 @@ def _refresh(host: str, entry: CacheEntry, refresh_token: str, client_id: str) -
             "refresh_token": refresh_token,
         },
     )
-    return store_tokens(host, tokens, entry["token_endpoint"], client_id)
+    return store_tokens(profile, tokens, entry["token_endpoint"], client_id)
 
 
-def _wait_for_fresh_token(host: str, *, exclude: str | None = None) -> str | None:
+def _wait_for_fresh_token(profile: Profile, *, exclude: str | None = None) -> str | None:
     for attempt in range(RECOVERY_POLL_ATTEMPTS):
-        entry = load_cache()["tokens"].get(host)
+        entry = entry_for(load_cache(), profile)
         if entry and is_fresh(entry) and entry["access_token"] != exclude:
             return entry["access_token"]
         if attempt + 1 < RECOVERY_POLL_ATTEMPTS:
@@ -360,7 +361,7 @@ def _wait_for_fresh_token(host: str, *, exclude: str | None = None) -> str | Non
 
 
 def get_valid_token(profile: Profile, *, force_refresh: bool = False) -> str:
-    entry = load_cache()["tokens"].get(profile["host"])
+    entry = entry_for(load_cache(), profile)
     if not entry:
         die(f"no cached token for {profile['host']} — run: if-cli login -p {profile['name']}")
     if not force_refresh and is_fresh(entry):
@@ -374,32 +375,30 @@ def get_valid_token(profile: Profile, *, force_refresh: bool = False) -> str:
     if refresh_token:
         client_id = entry.get("client_id")
         if not client_id:
-            clear_refresh_token_if_matches(profile["host"], refresh_token)
+            clear_refresh_token_if_matches(profile, refresh_token)
             die(
                 f"could not refresh token for {profile['host']}: no client id cached — "
                 f"run: if-cli login -p {profile['name']}"
             )
         try:
-            return _refresh(profile["host"], entry, refresh_token, client_id)["access_token"]
+            return _refresh(profile, entry, refresh_token, client_id)["access_token"]
         except Exception as error:
             failure: BaseException = error
             if isinstance(error, TokenRequestError) and error.invalidates_refresh_token:
-                cleared = clear_refresh_token_if_matches(profile["host"], refresh_token)
+                cleared = clear_refresh_token_if_matches(profile, refresh_token)
                 if cleared:
                     recovered_access_token = _wait_for_fresh_token(
-                        profile["host"], exclude=entry["access_token"] if force_refresh else None
+                        profile, exclude=entry["access_token"] if force_refresh else None
                     )
                     if recovered_access_token:
                         return recovered_access_token
                 else:
-                    recovered = load_cache()["tokens"].get(profile["host"])
+                    recovered = entry_for(load_cache(), profile)
                     recovered_refresh = recovered.get("refresh_token") if recovered else None
                     recovered_client_id = recovered.get("client_id") if recovered else None
                     if recovered and recovered_refresh and recovered_refresh != refresh_token and recovered_client_id:
                         try:
-                            return _refresh(profile["host"], recovered, recovered_refresh, recovered_client_id)[
-                                "access_token"
-                            ]
+                            return _refresh(profile, recovered, recovered_refresh, recovered_client_id)["access_token"]
                         except Exception as retry_error:
                             failure = retry_error
             detail = f": {failure}" if isinstance(failure, Exception) else ""

insightfactory_cli-1.3.0.dev39/tests/cache_writer.py

@@ -0,0 +1,16 @@
+from __future__ import annotations
+
+import sys
+
+from if_cli.cache import store_tokens
+
+
+def main() -> None:
+    name, host, token = sys.argv[1], sys.argv[2], sys.argv[3]
+    store_tokens(
+        {"name": name, "host": host}, {"access_token": token, "expires_in": 60}, "https://auth.example/token", "client"
+    )
+
+
+if __name__ == "__main__":
+    main()