intflow-authctl 0.2.1__tar.gz → 0.2.2__tar.gz

{intflow_authctl-0.2.1 → intflow_authctl-0.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: intflow-authctl
-Version: 0.2.1
+Version: 0.2.2
 Summary: Intflow Auth operator CLI.
 Author: Intflow
 License: Proprietary
@@ -114,3 +114,23 @@ through your approved secret delivery mechanism and remove it when no longer nee
 Public clients cannot hold secrets. Use confidential clients for trusted backends,
 register exact callback URLs, and use PKCE S256. Add `offline_access` only when
 refresh tokens are needed. App administrator assignment is a separate operation.
+
+## Recovery and local diagnostics
+
+`intflow-authctl --version` identifies the installed version and distribution.
+`doctor` remains read-only; `doctor --check-store` explicitly tests local storage
+with a temporary nonsecret write/read/delete probe and needs no login or server.
+Login runs the same preflight before requesting browser approval.
+
+Login polling honors server intervals and bounded HTTP 429 Retry-After guidance.
+It does not retry transport failures or 5xx responses, because one-time redemption
+may already have succeeded. Re-login never revokes server tokens. It removes only
+a previous local entry owned by the same config; legacy/shared entries are retained
+with a warning to preserve other profiles. Local logout can clear a config whose
+keyring entry is already missing. Use `logout --revoke` for explicit remote revocation.
+
+`tokens create --name automation --ttl 1h --secret-file /private/new-token.json`
+stores the full one-time response in a new protected file and returns `token_file`
+instead of the bearer. Without that option, existing one-time JSON stdout is unchanged.
+If issuance succeeds but storage fails, inspect and explicitly revoke the unused
+token before repeating issuance. File output uses the same protections as client secrets.

{intflow_authctl-0.2.1 → intflow_authctl-0.2.2}/README.md

@@ -93,3 +93,23 @@ through your approved secret delivery mechanism and remove it when no longer nee
 Public clients cannot hold secrets. Use confidential clients for trusted backends,
 register exact callback URLs, and use PKCE S256. Add `offline_access` only when
 refresh tokens are needed. App administrator assignment is a separate operation.
+
+## Recovery and local diagnostics
+
+`intflow-authctl --version` identifies the installed version and distribution.
+`doctor` remains read-only; `doctor --check-store` explicitly tests local storage
+with a temporary nonsecret write/read/delete probe and needs no login or server.
+Login runs the same preflight before requesting browser approval.
+
+Login polling honors server intervals and bounded HTTP 429 Retry-After guidance.
+It does not retry transport failures or 5xx responses, because one-time redemption
+may already have succeeded. Re-login never revokes server tokens. It removes only
+a previous local entry owned by the same config; legacy/shared entries are retained
+with a warning to preserve other profiles. Local logout can clear a config whose
+keyring entry is already missing. Use `logout --revoke` for explicit remote revocation.
+
+`tokens create --name automation --ttl 1h --secret-file /private/new-token.json`
+stores the full one-time response in a new protected file and returns `token_file`
+instead of the bearer. Without that option, existing one-time JSON stdout is unchanged.
+If issuance succeeds but storage fails, inspect and explicitly revoke the unused
+token before repeating issuance. File output uses the same protections as client secrets.

{intflow_authctl-0.2.1 → intflow_authctl-0.2.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "intflow-authctl"
-version = "0.2.1"
+version = "0.2.2"
 description = "Intflow Auth operator CLI."
 readme = "README.md"
 requires-python = ">=3.12"

{intflow_authctl-0.2.1 → intflow_authctl-0.2.2}/src/intflow_authctl/__init__.py

@@ -1,3 +1,3 @@
 """Internal implementation package for the Intflow Auth operator CLI."""
 
-__version__ = "0.2.1"
+__version__ = "0.2.2"

{intflow_authctl-0.2.1 → intflow_authctl-0.2.2}/src/intflow_authctl/api_client.py

@@ -6,7 +6,7 @@ import httpx
 
 from intflow_authctl.constants import DEFAULT_AUTHCTL_TIMEOUT_SECONDS
 from intflow_authctl.discovery import permission_hint
-from intflow_authctl.errors import AuthctlError
+from intflow_authctl.errors import AuthctlError, AuthctlHttpError
 from intflow_authctl.validation import _normalize_base_url
 
 MAX_RETRY_AFTER_SECONDS = 86_400
@@ -46,6 +46,7 @@ def _api_request_without_auth(
     *,
     client_factory,
     json_body: dict[str, object] | None = None,
+    timeout_seconds: float = DEFAULT_AUTHCTL_TIMEOUT_SECONDS,
 ) -> dict[str, object]:
     return _api_request_to_base_url(
         base_url,
@@ -55,6 +56,7 @@ def _api_request_without_auth(
         json_body=json_body,
         params=None,
         client_factory=client_factory,
+        timeout_seconds=timeout_seconds,
     )
 
 
@@ -67,13 +69,14 @@ def _api_request_to_base_url(
     client_factory,
     json_body: dict[str, object] | None,
     params: dict[str, object] | None,
+    timeout_seconds: float = DEFAULT_AUTHCTL_TIMEOUT_SECONDS,
 ) -> dict[str, object]:
     base_url = _normalize_base_url(base_url)
     try:
         with client_factory(
             base_url=base_url,
             headers=headers,
-            timeout=DEFAULT_AUTHCTL_TIMEOUT_SECONDS,
+            timeout=min(timeout_seconds, DEFAULT_AUTHCTL_TIMEOUT_SECONDS),
         ) as client:
             request_kwargs: dict[str, object] = {"params": params}
             if json_body is not None:
@@ -93,10 +96,12 @@ def _api_request_to_base_url(
     if response.status_code >= 400:
         retry_after = _retry_after_seconds(response.headers.get("retry-after"))
         retry_message = "" if retry_after is None else f" Retry after {retry_after} seconds."
-        raise AuthctlError(
+        raise AuthctlHttpError(
             f"Admin API request failed: {response.status_code} "
             f"{_safe_error_message(response)}.{retry_message}"
-            f"{permission_hint(response.status_code, method, path)}"
+            f"{permission_hint(response.status_code, method, path)}",
+            response.status_code,
+            retry_after,
         )
     if response.status_code == 204 or not response.content:
         return {"status": "ok"}

{intflow_authctl-0.2.1 → intflow_authctl-0.2.2}/src/intflow_authctl/commands.py

@@ -1,6 +1,7 @@
 """Command dispatch for the Intflow Auth operator CLI."""
 
 import argparse
+import math
 import os
 import time
 import webbrowser
@@ -17,13 +18,14 @@ from intflow_authctl.clients import _run_authctl_clients_command
 from intflow_authctl.config import (
     _authctl_config_path,
     _authctl_credential_store,
+    _check_credential_storage,
     _delete_authctl_config,
     _load_authctl_config,
     _save_authctl_config,
 )
 from intflow_authctl.credentials import AuthctlCredentialStore
 from intflow_authctl.discovery import documentation
-from intflow_authctl.errors import AuthctlError
+from intflow_authctl.errors import AuthctlError, AuthctlHttpError
 from intflow_authctl.external_access import _run_authctl_external_access_command
 from intflow_authctl.tokens import _run_authctl_tokens_command
 from intflow_authctl.users import _run_authctl_users_command
@@ -51,6 +53,7 @@ def _run_authctl_command(
             webbrowser.open(str(result["api_docs"]))
         return result
     if args.command == "login":
+        _check_credential_storage(config_path, selected_credential_store)
         if args.token is not None:
             print(
                 "WARNING: --token is deprecated because command arguments may enter "
@@ -76,9 +79,9 @@ def _run_authctl_command(
         )
 
     if args.command == "logout":
-        config = _load_authctl_config(config_path, selected_credential_store)
-        _warn_if_file_config(config, config_path, error_output)
         if args.revoke:
+            config = _load_authctl_config(config_path, selected_credential_store)
+            _warn_if_file_config(config, config_path, error_output)
             token_id = config.get("token_id")
             if not isinstance(token_id, str) or not token_id:
                 whoami = _api_request(
@@ -104,6 +107,17 @@ def _run_authctl_command(
         _delete_authctl_config(config_path, selected_credential_store)
         return {"status": "logged_out"}
 
+    if args.command == "doctor" and args.check_store:
+        _check_credential_storage(config_path, selected_credential_store)
+        return {
+            "status": "ok",
+            "checks": ["config_writable", "credential_store_probe"],
+            "credential_backend": (
+                selected_credential_store.backend_name if selected_credential_store else "file"
+            ),
+            "next": "intflow-authctl login",
+        }
+
     config = _load_authctl_config(config_path, selected_credential_store)
     _warn_if_file_config(config, config_path, error_output)
     if args.command in {"whoami", "doctor"}:
@@ -207,6 +221,9 @@ def _run_authctl_browser_login(
 ) -> dict[str, object]:
     base_url = _normalize_base_url(args.base_url)
     ttl_seconds = _parse_ttl_seconds(args.ttl)
+    timeout = _positive_float(args.timeout_seconds, "timeout-seconds")
+    if not math.isfinite(args.poll_interval):
+        raise AuthctlError("poll-interval must be finite.")
     start_body: dict[str, object] = {
         "name": args.name,
         "ttl_seconds": ttl_seconds,
@@ -227,28 +244,58 @@ def _run_authctl_browser_login(
     if not args.no_browser:
         webbrowser.open(verification_uri)
 
-    deadline = time.monotonic() + _positive_float(args.timeout_seconds, "timeout-seconds")
-    poll_interval = max(args.poll_interval, 0.0)
+    deadline = time.monotonic() + timeout
+    advertised = transaction.get("poll_interval_seconds")
+    server_interval = (
+        float(advertised)
+        if isinstance(advertised, (float, int)) and math.isfinite(advertised) and advertised > 0
+        else 2.0
+    )
+    poll_interval = max(args.poll_interval, server_interval, 1.0)
     while True:
-        response = _api_request_without_auth(
-            base_url,
-            "POST",
-            f"/v1/cli-login-transactions/{transaction_id}:redeem",
-            json_body={"poll_secret": poll_secret},
-            client_factory=client_factory,
-        )
+        remaining = deadline - time.monotonic()
+        if remaining <= 0:
+            raise AuthctlError("CLI login timed out before browser approval completed.")
+        try:
+            response = _api_request_without_auth(
+                base_url,
+                "POST",
+                f"/v1/cli-login-transactions/{transaction_id}:redeem",
+                json_body={"poll_secret": poll_secret},
+                client_factory=client_factory,
+                timeout_seconds=remaining,
+            )
+        except AuthctlHttpError as exc:
+            # Retry only a definite rejection before redemption; never replay a lost response.
+            if exc.status != 429:
+                raise
+            delay = max(poll_interval, exc.retry_after or server_interval)
+            print(
+                "Login polling was rate limited; waiting within the login deadline.",
+                file=error_output,
+            )
+            time.sleep(min(delay, max(deadline - time.monotonic(), 0.0)))
+            continue
         if response.get("status") != "pending":
             token = _required_response_string(response, "token")
             operator_token = response.get("operator_token")
             config: dict[str, object] = {"base_url": base_url, "token": token}
             if isinstance(operator_token, dict) and operator_token.get("id"):
                 config["token_id"] = str(operator_token["id"])
-            _save_authctl_config(
-                config_path,
-                config,
-                token=token,
-                credential_store=credential_store,
-            )
+            try:
+                _save_authctl_config(
+                    config_path,
+                    config,
+                    token=token,
+                    credential_store=credential_store,
+                )
+            except (AuthctlError, OSError):
+                raise AuthctlError(
+                    "Login token was issued but local storage failed. Run doctor --check-store, "
+                    "then log in again; inspect tokens list and explicitly revoke "
+                    "the unused token. "
+                    "No token was printed or automatically revoked."
+                ) from None
             return {
                 "status": "logged_in",
                 "base_url": base_url,

{intflow_authctl-0.2.1 → intflow_authctl-0.2.2}/src/intflow_authctl/config.py

@@ -72,9 +72,7 @@ def _load_authctl_config(
     if not isinstance(service, str) or not isinstance(account, str):
         raise AuthctlError(f"Invalid CLI config file: {path}")
     if credential_store is None:
-        raise AuthctlError(
-            "CLI config uses an OS credential store; use --credential-store auto."
-        )
+        raise AuthctlError("CLI config uses an OS credential store; use --credential-store auto.")
     store = credential_store
     if backend != store.backend_name:
         raise AuthctlError(f"Invalid CLI config file: {path}")
@@ -95,9 +93,11 @@ def _save_authctl_config(
     token: str,
     credential_store: AuthctlCredentialStore | None,
 ) -> None:
+    previous = _load_raw_authctl_config(path)
+    path.parent.mkdir(parents=True, exist_ok=True)
     stored_config = dict(config)
     stored_config.pop("token", None)
-    credential_account = _credential_account(stored_config)
+    credential_account = f"{_credential_account(stored_config)}|local-{secrets.token_hex(16)}"
     secret_stored = False
     if credential_store is not None:
         try:
@@ -112,6 +112,7 @@ def _save_authctl_config(
                     "credential_backend": credential_store.backend_name,
                     "credential_service": AUTHCTL_CREDENTIAL_SERVICE,
                     "credential_account": credential_account,
+                    "credential_owner": _config_owner(path),
                 }
             )
         except AuthctlCredentialStoreError as exc:
@@ -122,7 +123,6 @@ def _save_authctl_config(
     else:
         stored_config.update({"credential_backend": "file", "token": token})
 
-    path.parent.mkdir(parents=True, exist_ok=True)
     temporary_path = path.with_name(f".{path.name}.{secrets.token_hex(8)}.tmp")
     replaced = False
     try:
@@ -150,7 +150,72 @@ def _save_authctl_config(
         if secret_stored and credential_store is not None:
             with suppress(AuthctlCredentialStoreError):
                 credential_store.delete_password(AUTHCTL_CREDENTIAL_SERVICE, credential_account)
-        raise
+        raise AuthctlError(
+            "Could not save CLI configuration; the previous login was retained where possible."
+        ) from None
+    if (
+        previous
+        and previous.get("credential_account")
+        and previous.get("credential_backend") != "file"
+    ):
+        if (
+            credential_store is not None
+            and previous.get("credential_backend") == credential_store.backend_name
+            and previous.get("credential_owner") == _config_owner(path)
+            and previous.get("credential_service") == AUTHCTL_CREDENTIAL_SERVICE
+        ):
+            try:
+                credential_store.delete_password(
+                    AUTHCTL_CREDENTIAL_SERVICE, str(previous["credential_account"])
+                )
+            except AuthctlCredentialStoreError:
+                _storage_warning(
+                    "Login saved, but the previous local credential could not be removed."
+                )
+        else:
+            _storage_warning(
+                "Previous legacy/shared credential retained to protect other profiles."
+            )
+
+
+def _storage_warning(message: str) -> None:
+    # Diagnostics must not interfere with successful persistence or expose secrets.
+    import sys
+
+    print(f"WARNING: {message} Remote tokens were not revoked.", file=sys.stderr)
+
+
+def _config_owner(path: Path) -> str:
+    return os.path.normcase(os.path.abspath(path))
+
+
+def _check_credential_storage(path: Path, store: AuthctlCredentialStore | None) -> None:
+    probe = f"probe-{secrets.token_hex(16)}"
+    temporary = path.parent / f".authctl-{probe}"
+    try:
+        path.parent.mkdir(parents=True, exist_ok=True)
+        if path.exists() and not path.is_file():
+            raise OSError("Not a file")
+        descriptor = os.open(temporary, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
+        with os.fdopen(descriptor, "w") as probe_file:
+            probe_file.write(probe)
+            probe_file.flush()
+            os.fsync(probe_file.fileno())
+        if store is not None:
+            try:
+                store.set_password(AUTHCTL_CREDENTIAL_SERVICE, probe, probe)
+                if store.get_password(AUTHCTL_CREDENTIAL_SERVICE, probe) != probe:
+                    raise AuthctlCredentialStoreError("Probe failed")
+            finally:
+                store.delete_password(AUTHCTL_CREDENTIAL_SERVICE, probe)
+    except (OSError, AuthctlCredentialStoreError):
+        raise AuthctlError(
+            "Credential storage is unavailable; no login request was sent. Check config directory "
+            "and OS keyring, or explicitly select --credential-store file if acceptable."
+        ) from None
+    finally:
+        with suppress(OSError):
+            temporary.unlink(missing_ok=True)
 
 
 def _delete_authctl_config(
@@ -168,7 +233,8 @@ def _delete_authctl_config(
                 )
             store = credential_store
             try:
-                store.delete_password(service, account)
+                if store.get_password(service, account) is not None:
+                    store.delete_password(service, account)
             except AuthctlCredentialStoreError as exc:
                 raise AuthctlError(
                     "Stored CLI credential could not be deleted; local config was retained."

intflow_authctl-0.2.2/src/intflow_authctl/errors.py

@@ -0,0 +1,14 @@
+"""Error types for the Intflow Auth operator CLI."""
+
+
+class AuthctlError(RuntimeError):
+    """Raised when the routine Admin API CLI cannot complete a command."""
+
+
+class AuthctlHttpError(AuthctlError):
+    """Structured HTTP metadata without retaining upstream bodies or credentials."""
+
+    def __init__(self, message: str, status: int, retry_after: int | None) -> None:
+        super().__init__(message)
+        self.status = status
+        self.retry_after = retry_after

{intflow_authctl-0.2.1 → intflow_authctl-0.2.2}/src/intflow_authctl/output.py

@@ -30,24 +30,21 @@ def _print_table(
 ) -> None:
     columns, rows = _table_shape(args, payload)
     rendered_rows = [
-        [_format_table_value(row.get(field)) for field, _title in columns]
-        for row in rows
+        [_format_table_value(row.get(field)) for field, _title in columns] for row in rows
     ]
     headers = [title for _field, title in columns]
     widths = [
         max(len(headers[index]), *(len(row[index]) for row in rendered_rows))
         for index in range(len(headers))
     ]
-    header_line = "  ".join(
-        header.ljust(widths[index]) for index, header in enumerate(headers)
-    )
+    header_line = "  ".join(header.ljust(widths[index]) for index, header in enumerate(headers))
     print(header_line, file=output)
     print("  ".join("-" * width for width in widths), file=output)
     for row in rendered_rows:
         print("  ".join(value.ljust(widths[index]) for index, value in enumerate(row)), file=output)
     next_cursor = payload.get("next_cursor")
     if isinstance(next_cursor, str) and next_cursor:
-        print(f"Next cursor: {next_cursor}", file=output)
+        print(f"Next cursor: {_safe_table_text(next_cursor)}", file=output)
 
 
 def _table_shape(
@@ -123,10 +120,7 @@ def _table_shape(
             ("correlation_id", "CORRELATION"),
             ("occurred_at", "OCCURRED_AT"),
         ], _response_list(payload, "events")
-    if (
-        args.command == "external-access"
-        and args.external_access_command == "list"
-    ):
+    if args.command == "external-access" and args.external_access_command == "list":
         return [
             ("id", "ID"),
             ("email", "EMAIL"),
@@ -167,10 +161,22 @@ def _format_table_value(value: object) -> str:
     if isinstance(value, bool):
         return "true" if value else "false"
     if isinstance(value, list):
-        return ",".join(str(item) for item in value)
+        return ",".join(_safe_table_text(str(item)) for item in value)
     if isinstance(value, dict):
         return json.dumps(value, ensure_ascii=False, default=_json_default)
-    return str(value)
+    return _safe_table_text(str(value))
+
+
+def _safe_table_text(value: str) -> str:
+    return "".join(
+        f"\\u{ord(char):04x}"
+        if ord(char) < 32
+        or 127 <= ord(char) <= 159
+        or 0x202A <= ord(char) <= 0x202E
+        or 0x2066 <= ord(char) <= 0x2069
+        else char
+        for char in value
+    )
 
 
 def _json_default(value: Any) -> str:

{intflow_authctl-0.2.1 → intflow_authctl-0.2.2}/src/intflow_authctl/parser.py

@@ -5,6 +5,7 @@ import difflib
 import re
 from typing import NoReturn
 
+from intflow_authctl import __version__
 from intflow_authctl.constants import (
     AUTHCTL_CONFIG_ENV,
     DEFAULT_AUTHCTL_BASE_URL,
@@ -138,6 +139,9 @@ def _build_authctl_parser() -> argparse.ArgumentParser:
         "--config",
         help=f"Credential config path. Defaults to ${AUTHCTL_CONFIG_ENV} or user config.",
     )
+    parser.add_argument(
+        "--version", "-V", action="version", version=f"intflow-authctl {__version__} (python)"
+    )
     parser.add_argument(
         "--credential-store",
         choices=["auto", "file"],
@@ -153,12 +157,18 @@ def _build_authctl_parser() -> argparse.ArgumentParser:
         parser_class=AuthctlArgumentParser,
     )
 
-    subparsers.add_parser(
+    doctor_parser = subparsers.add_parser(
         "doctor",
         help="Check credentials and current roles/scopes without changes.",
         description="Read-only check of configuration, credentials and Admin API identity. "
         "Run login first. This does not grant roles or change credentials.",
     )
+    doctor_parser.add_argument(
+        "--check-store",
+        action="store_true",
+        help="Test local storage before login using a temporary nonsecret "
+        "write/read/delete probe. No server request.",
+    )
     docs_parser = subparsers.add_parser(
         "docs", help="Show onboarding guidance and API documentation links."
     )
@@ -228,7 +238,8 @@ def _build_authctl_parser() -> argparse.ArgumentParser:
         "--poll-interval",
         type=float,
         default=2.0,
-        help="Seconds between browser-approval polling attempts. Defaults to 2.",
+        help="Seconds between polling attempts. Defaults to 2; server minimum "
+        "and Retry-After take precedence.",
     )
     login_parser.add_argument(
         "--timeout-seconds",
@@ -471,6 +482,11 @@ def _build_authctl_parser() -> argparse.ArgumentParser:
         formatter_class=argparse.RawDescriptionHelpFormatter,
     )
     token_create_parser.add_argument("--name", required=True, help="Operator token name.")
+    token_create_parser.add_argument(
+        "--secret-file",
+        help="Save the one-time token response to a NEW protected file "
+        "instead of printing the token.",
+    )
     token_create_parser.add_argument(
         "--scope",
         action="append",

{intflow_authctl-0.2.1 → intflow_authctl-0.2.2}/src/intflow_authctl/secret_output.py

@@ -13,7 +13,10 @@ from intflow_authctl.errors import AuthctlError
 
 
 def with_secret_file(
-    path: str | None, operation: Callable[[], dict[str, object]]
+    path: str | None,
+    operation: Callable[[], dict[str, object]],
+    *,
+    secret_field: str = "client_secret",
 ) -> dict[str, object]:
     if path is None:
         return operation()
@@ -49,9 +52,9 @@ def with_secret_file(
                 "Cannot protect --secret-file; no remote mutation was attempted."
             ) from None
         result = operation()
-        if not isinstance(result.get("client_secret"), str):
+        if not isinstance(result.get(secret_field), str):
             raise AuthctlError(
-                "Response omitted client_secret; inspect the client before retrying."
+                f"Response omitted {secret_field}; inspect the resource before retrying."
             )
         try:
             data = (json.dumps(result, indent=2) + "\n").encode()
@@ -60,14 +63,19 @@ def with_secret_file(
                 output_file.flush()
                 os.fsync(output_file.fileno())
         except OSError:
+            if secret_field == "token":
+                raise AuthctlError(
+                    "Token was issued but secret storage failed. Inspect tokens list and revoke "
+                    "the unused token before creating another."
+                ) from None
             raise AuthctlError(
                 "Client was changed but secret storage failed. "
                 "Inspect the client and rotate its secret "
                 "to a working destination; do not repeat client creation."
             ) from None
         completed = True
-        return {k: v for k, v in result.items() if k != "client_secret"} | {
-            "client_secret_file": str(target)
+        return {k: v for k, v in result.items() if k != secret_field} | {
+            f"{secret_field}_file": str(target)
         }
     finally:
         os.close(fd)

{intflow_authctl-0.2.1 → intflow_authctl-0.2.2}/src/intflow_authctl/tokens.py

@@ -7,6 +7,7 @@ from typing import TextIO
 from intflow_authctl.api_client import _api_request
 from intflow_authctl.command_utils import _request_params
 from intflow_authctl.errors import AuthctlError
+from intflow_authctl.secret_output import with_secret_file
 from intflow_authctl.validation import _normalize_base_url, _parse_ttl_seconds
 
 
@@ -46,12 +47,16 @@ def _run_authctl_tokens_command(
             body["ttl_seconds"] = _parse_ttl_seconds(args.ttl)
         elif args.expires_at:
             body["expires_at"] = args.expires_at
-        return _api_request(
-            config,
-            "POST",
-            "/v1/admin/operator-tokens",
-            json_body=body,
-            client_factory=client_factory,
+        return with_secret_file(
+            args.secret_file,
+            lambda: _api_request(
+                config,
+                "POST",
+                "/v1/admin/operator-tokens",
+                json_body=body,
+                client_factory=client_factory,
+            ),
+            secret_field="token",
         )
     if args.tokens_command == "create-no-expiry":
         whoami = _api_request(

{intflow_authctl-0.2.1 → intflow_authctl-0.2.2}/src/intflow_authctl/validation.py

@@ -2,6 +2,7 @@
 
 import argparse
 import ipaddress
+import math
 from urllib.parse import urlsplit
 
 from intflow_authctl.errors import AuthctlError
@@ -24,8 +25,8 @@ class OAuthClientValidationError(ValueError):
 
 
 def _positive_float(value: float, name: str) -> float:
-    if value <= 0:
-        raise AuthctlError(f"{name} must be positive.")
+    if not math.isfinite(value) or value <= 0:
+        raise AuthctlError(f"{name} must be positive and finite.")
     return value
 
 
@@ -161,9 +162,7 @@ def _normalize_base_url(value: str) -> str:
     if not normalized:
         raise AuthctlError("--base-url must not be empty.")
     if len(normalized) > MAX_ADMIN_BASE_URL_LENGTH:
-        raise AuthctlError(
-            f"--base-url must be at most {MAX_ADMIN_BASE_URL_LENGTH} characters."
-        )
+        raise AuthctlError(f"--base-url must be at most {MAX_ADMIN_BASE_URL_LENGTH} characters.")
     if any(character.isspace() for character in normalized) or "\\" in normalized:
         raise AuthctlError("--base-url must not contain whitespace or backslashes.")
     if "?" in normalized or "#" in normalized:

intflow_authctl-0.2.1/src/intflow_authctl/errors.py

@@ -1,5 +0,0 @@
-"""Error types for the Intflow Auth operator CLI."""
-
-
-class AuthctlError(RuntimeError):
-    """Raised when the routine Admin API CLI cannot complete a command."""