intflow-authctl 0.2.2__tar.gz → 0.2.3__tar.gz

intflow_authctl-0.2.3/PKG-INFO

@@ -0,0 +1,53 @@
+Metadata-Version: 2.4
+Name: intflow-authctl
+Version: 0.2.3
+Summary: Intflow Auth operator CLI.
+Author: Intflow
+License: Proprietary
+Requires-Python: >=3.12
+Requires-Dist: httpx<1,>=0.28
+Requires-Dist: keyring<26,>=25
+Provides-Extra: dev
+Requires-Dist: build<2,>=1.2; extra == 'dev'
+Requires-Dist: hatchling==1.31.0; extra == 'dev'
+Requires-Dist: mypy<3,>=1.13; extra == 'dev'
+Requires-Dist: packaging<27,>=24; extra == 'dev'
+Requires-Dist: pytest-cov<8,>=6; extra == 'dev'
+Requires-Dist: pytest-timeout<3,>=2.4; extra == 'dev'
+Requires-Dist: pytest<10,>=8; extra == 'dev'
+Requires-Dist: ruff<1,>=0.9; extra == 'dev'
+Requires-Dist: twine<7,>=6; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# intflow-authctl
+
+Intflow Auth 운영자용 CLI의 Python 배포판입니다. 권한을 받은 운영자가 사용자, OAuth client, 운영자 토큰, 감사 기록을 관리할 때 씁니다. 서비스 자체나 데이터베이스 migration은 들어 있지 않습니다.
+
+## 요구 사항
+
+- Python 3.12 이상
+- Intflow Auth `operator` 또는 `admin` 역할
+
+## 설치
+
+```bash
+python -m pip install --user --upgrade intflow-authctl
+```
+
+## 사용 예
+
+```bash
+intflow-authctl login
+intflow-authctl whoami
+intflow-authctl clients list
+intflow-authctl clients rotate-secret <oauth-client-id> --secret-file /private/rotation.json
+intflow-authctl logout --revoke
+```
+
+로그인한 운영자 신원과 client 목록을 확인합니다. 교체한 client secret은 `--secret-file`로 지정한 보호된 새 파일에만 저장되고, `logout --revoke`는 서버 토큰도 폐기합니다. 운영자 자격증명은 지원되는 OS 자격증명 저장소에 둡니다.
+
+## 문서
+
+- 명령과 옵션: `intflow-authctl --help`와 `intflow-authctl docs`, 접근 진단은 `intflow-authctl doctor`
+- 상세 문서: 저장소 `yeon3724/intflow-auth`의 `docs/operations.md` (Routine administration, 영어)
+- 저장소: `yeon3724/intflow-auth` (읽기 전용 미러 `intflow/intflow-auth`)

intflow_authctl-0.2.3/README.md

@@ -0,0 +1,32 @@
+# intflow-authctl
+
+Intflow Auth 운영자용 CLI의 Python 배포판입니다. 권한을 받은 운영자가 사용자, OAuth client, 운영자 토큰, 감사 기록을 관리할 때 씁니다. 서비스 자체나 데이터베이스 migration은 들어 있지 않습니다.
+
+## 요구 사항
+
+- Python 3.12 이상
+- Intflow Auth `operator` 또는 `admin` 역할
+
+## 설치
+
+```bash
+python -m pip install --user --upgrade intflow-authctl
+```
+
+## 사용 예
+
+```bash
+intflow-authctl login
+intflow-authctl whoami
+intflow-authctl clients list
+intflow-authctl clients rotate-secret <oauth-client-id> --secret-file /private/rotation.json
+intflow-authctl logout --revoke
+```
+
+로그인한 운영자 신원과 client 목록을 확인합니다. 교체한 client secret은 `--secret-file`로 지정한 보호된 새 파일에만 저장되고, `logout --revoke`는 서버 토큰도 폐기합니다. 운영자 자격증명은 지원되는 OS 자격증명 저장소에 둡니다.
+
+## 문서
+
+- 명령과 옵션: `intflow-authctl --help`와 `intflow-authctl docs`, 접근 진단은 `intflow-authctl doctor`
+- 상세 문서: 저장소 `yeon3724/intflow-auth`의 `docs/operations.md` (Routine administration, 영어)
+- 저장소: `yeon3724/intflow-auth` (읽기 전용 미러 `intflow/intflow-auth`)

{intflow_authctl-0.2.2 → intflow_authctl-0.2.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "intflow-authctl"
-version = "0.2.2"
+version = "0.2.3"
 description = "Intflow Auth operator CLI."
 readme = "README.md"
 requires-python = ">=3.12"

intflow_authctl-0.2.3/src/intflow_authctl/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.2.3"

{intflow_authctl-0.2.2 → intflow_authctl-0.2.3}/src/intflow_authctl/api_client.py

@@ -1,5 +1,3 @@
-"""HTTP transport helpers for the Intflow Auth operator CLI."""
-
 import re
 
 import httpx

{intflow_authctl-0.2.2 → intflow_authctl-0.2.3}/src/intflow_authctl/audit.py

@@ -1,5 +1,3 @@
-"""Audit-event command handlers for authctl."""
-
 import argparse
 
 from intflow_authctl.api_client import _api_request

{intflow_authctl-0.2.2 → intflow_authctl-0.2.3}/src/intflow_authctl/cli.py

@@ -1,5 +1,3 @@
-"""Operator Admin API command-line entry point."""
-
 import sys
 from typing import TextIO
 
@@ -39,7 +37,7 @@ def authctl_main(
     client_factory=httpx.Client,
     credential_store: AuthctlCredentialStore | None = None,
 ) -> None:
-    """Run the routine operator Admin API CLI."""
+
     parser = _build_authctl_parser()
     args = parser.parse_args(argv)
     try:

{intflow_authctl-0.2.2 → intflow_authctl-0.2.3}/src/intflow_authctl/clients.py

@@ -1,5 +1,3 @@
-"""OAuth client command handlers for authctl."""
-
 import argparse
 
 from intflow_authctl.api_client import _api_request
@@ -63,6 +61,8 @@ def _run_authctl_clients_command(
         }
         if args.admin_access_required:
             create_body["admin_access_required"] = True
+        if args.assignment_required:
+            create_body["assignment_required"] = True
         return with_secret_file(
             args.secret_file,
             lambda: _api_request(
@@ -89,6 +89,10 @@ def _run_authctl_clients_command(
             update_body["admin_access_required"] = True
         if args.no_admin_access_required:
             update_body["admin_access_required"] = False
+        if args.assignment_required:
+            update_body["assignment_required"] = True
+        if args.no_assignment_required:
+            update_body["assignment_required"] = False
         if not update_body:
             raise AuthctlError("At least one client update field is required.")
         return _api_request(
@@ -123,6 +127,18 @@ def _run_authctl_clients_command(
             config,
             client_factory=client_factory,
         )
+    if args.clients_command == "roles":
+        return _run_authctl_client_roles_command(
+            args,
+            config,
+            client_factory=client_factory,
+        )
+    if args.clients_command == "pending-roles":
+        return _run_authctl_client_pending_roles_command(
+            args,
+            config,
+            client_factory=client_factory,
+        )
     raise AuthctlError(f"Unsupported clients command: {args.clients_command}")
 
 
@@ -158,6 +174,65 @@ def _run_authctl_client_admins_command(
     raise AuthctlError(f"Unsupported clients admins command: {args.client_admins_command}")
 
 
+def _run_authctl_client_roles_command(
+    args: argparse.Namespace,
+    config: dict[str, object],
+    *,
+    client_factory,
+) -> dict[str, object]:
+    base_path = f"/v1/admin/clients/{args.client_id}"
+    if args.client_roles_command == "list":
+        return _api_request(
+            config,
+            "GET",
+            f"{base_path}/role-assignments",
+            params=_request_params(args, "limit", "cursor", extra={"role_name": args.role}),
+            client_factory=client_factory,
+        )
+    if args.client_roles_command in {"grant", "revoke"}:
+        return _api_request(
+            config,
+            "PUT" if args.client_roles_command == "grant" else "DELETE",
+            f"{base_path}/roles/{args.role_name}/users/{args.user_id}",
+            client_factory=client_factory,
+        )
+    raise AuthctlError(f"Unsupported clients roles command: {args.client_roles_command}")
+
+
+def _run_authctl_client_pending_roles_command(
+    args: argparse.Namespace,
+    config: dict[str, object],
+    *,
+    client_factory,
+) -> dict[str, object]:
+    base_path = f"/v1/admin/clients/{args.client_id}/pending-role-grants"
+    command = args.client_pending_roles_command
+    if command == "list":
+        return _api_request(
+            config,
+            "GET",
+            base_path,
+            params=_request_params(args, "email", "limit", "cursor"),
+            client_factory=client_factory,
+        )
+    if command == "create":
+        return _api_request(
+            config,
+            "POST",
+            base_path,
+            json_body={"email": args.email, "role_name": args.role_name},
+            client_factory=client_factory,
+        )
+    if command == "delete":
+        return _api_request(
+            config,
+            "DELETE",
+            f"{base_path}/{args.grant_id}",
+            client_factory=client_factory,
+        )
+    raise AuthctlError(f"Unsupported clients pending-roles command: {command}")
+
+
 def _validate_cli_redirect_uris(values: list[str]) -> tuple[str, ...]:
     try:
         return validate_redirect_uris(values)

{intflow_authctl-0.2.2 → intflow_authctl-0.2.3}/src/intflow_authctl/command_utils.py

@@ -1,5 +1,3 @@
-"""Shared helpers for authctl command-family modules."""
-
 import argparse
 
 from intflow_authctl.output import _response_list
@@ -10,11 +8,7 @@ def _request_params(
     *names: str,
     extra: dict[str, object] | None = None,
 ) -> dict[str, object] | None:
-    params = {
-        name: value
-        for name in names
-        if (value := getattr(args, name, None)) is not None
-    }
+    params = {name: value for name in names if (value := getattr(args, name, None)) is not None}
     if extra is not None:
         params.update({name: value for name, value in extra.items() if value is not None})
     return params or None

{intflow_authctl-0.2.2 → intflow_authctl-0.2.3}/src/intflow_authctl/commands.py

@@ -1,5 +1,3 @@
-"""Command dispatch for the Intflow Auth operator CLI."""
-
 import argparse
 import math
 import os
@@ -266,7 +264,6 @@ def _run_authctl_browser_login(
                 timeout_seconds=remaining,
             )
         except AuthctlHttpError as exc:
-            # Retry only a definite rejection before redemption; never replay a lost response.
             if exc.status != 429:
                 raise
             delay = max(poll_interval, exc.retry_after or server_interval)

{intflow_authctl-0.2.2 → intflow_authctl-0.2.3}/src/intflow_authctl/config.py

@@ -1,5 +1,3 @@
-"""Credential configuration helpers for the Intflow Auth operator CLI."""
-
 import argparse
 import json
 import os
@@ -179,7 +177,7 @@ def _save_authctl_config(
 
 
 def _storage_warning(message: str) -> None:
-    # Diagnostics must not interfere with successful persistence or expose secrets.
+
     import sys
 
     print(f"WARNING: {message} Remote tokens were not revoked.", file=sys.stderr)

{intflow_authctl-0.2.2 → intflow_authctl-0.2.3}/src/intflow_authctl/constants.py

@@ -1,5 +1,3 @@
-"""Constants for the Intflow Auth operator CLI."""
-
 AUTHCTL_CONFIG_ENV = "INTFLOW_AUTHCTL_CONFIG"
 AUTHCTL_CREDENTIAL_SERVICE = "intflow-authctl"
 DEFAULT_AUTHCTL_BASE_URL = "https://id.intflow.dev"

{intflow_authctl-0.2.2 → intflow_authctl-0.2.3}/src/intflow_authctl/credentials.py

@@ -1,49 +1,43 @@
-"""Credential-store adapters for the intflow-authctl CLI."""
-
 from importlib import import_module
 from typing import Protocol
 
 
 class AuthctlCredentialStore(Protocol):
-    """Minimal credential-store interface used by intflow-authctl."""
-
     backend_name: str
 
     def get_password(self, service: str, account: str) -> str | None:
-        """Return one stored secret or None."""
+        pass
 
     def set_password(self, service: str, account: str, password: str) -> None:
-        """Store one secret."""
+        pass
 
     def delete_password(self, service: str, account: str) -> None:
-        """Delete one secret."""
+        pass
 
 
 class AuthctlCredentialStoreError(RuntimeError):
-    """Raised when a credential-store backend is unavailable or fails."""
+    pass
 
 
 class KeyringAuthctlCredentialStore:
-    """Credential-store adapter backed by the optional keyring package."""
-
     backend_name = "keyring"
 
     def get_password(self, service: str, account: str) -> str | None:
-        """Return one stored secret or None."""
+
         try:
             return self._keyring().get_password(service, account)
         except Exception as exc:
             raise AuthctlCredentialStoreError("Credential store lookup failed.") from exc
 
     def set_password(self, service: str, account: str, password: str) -> None:
-        """Store one secret."""
+
         try:
             self._keyring().set_password(service, account, password)
         except Exception as exc:
             raise AuthctlCredentialStoreError("Credential store write failed.") from exc
 
     def delete_password(self, service: str, account: str) -> None:
-        """Delete one secret."""
+
         try:
             self._keyring().delete_password(service, account)
         except Exception as exc:

{intflow_authctl-0.2.2 → intflow_authctl-0.2.3}/src/intflow_authctl/discovery.py

@@ -1,4 +1,7 @@
-"""Offline onboarding and locally authored permission guidance."""
+def _is_app_role_path(path: str) -> bool:
+    return any(
+        part in path for part in ("/admins", "/roles/", "/role-assignments", "/pending-role-grants")
+    )
 
 
 def permission_hint(status: int, method: str, path: str) -> str:
@@ -8,7 +11,7 @@ def permission_hint(status: int, method: str, path: str) -> str:
         return ""
     resource = None
     if path.startswith("/v1/admin/clients"):
-        resource = "app_roles" if "/admins" in path else "clients"
+        resource = "app_roles" if _is_app_role_path(path) else "clients"
     elif path.startswith("/v1/admin/operator-tokens"):
         resource = "tokens"
     elif path.startswith("/v1/admin/audit"):

{intflow_authctl-0.2.2 → intflow_authctl-0.2.3}/src/intflow_authctl/errors.py

@@ -1,13 +1,8 @@
-"""Error types for the Intflow Auth operator CLI."""
-
-
 class AuthctlError(RuntimeError):
-    """Raised when the routine Admin API CLI cannot complete a command."""
+    pass
 
 
 class AuthctlHttpError(AuthctlError):
-    """Structured HTTP metadata without retaining upstream bodies or credentials."""
-
     def __init__(self, message: str, status: int, retry_after: int | None) -> None:
         super().__init__(message)
         self.status = status

{intflow_authctl-0.2.2 → intflow_authctl-0.2.3}/src/intflow_authctl/external_access.py

@@ -1,5 +1,3 @@
-"""Temporary external Google access command handlers."""
-
 import argparse
 from urllib.parse import quote
 
@@ -42,6 +40,4 @@ def _run_authctl_external_access_command(
             json_body=body,
             client_factory=client_factory,
         )
-    raise AuthctlError(
-        f"Unsupported external-access command: {args.external_access_command}"
-    )
+    raise AuthctlError(f"Unsupported external-access command: {args.external_access_command}")

{intflow_authctl-0.2.2 → intflow_authctl-0.2.3}/src/intflow_authctl/output.py

@@ -1,5 +1,3 @@
-"""Output rendering helpers for the Intflow Auth operator CLI."""
-
 import argparse
 import json
 from datetime import datetime
@@ -110,6 +108,31 @@ def _table_shape(
             ("role_name", "ROLE"),
             ("assigned_at", "ASSIGNED_AT"),
         ], _response_list(payload, "admins")
+    if (
+        args.command == "clients"
+        and args.clients_command == "roles"
+        and args.client_roles_command == "list"
+    ):
+        return [
+            ("id", "ID"),
+            ("client_id", "CLIENT_ID"),
+            ("user_id", "USER_ID"),
+            ("role_name", "ROLE"),
+            ("assigned_by_user_id", "ASSIGNED_BY"),
+            ("assigned_at", "ASSIGNED_AT"),
+        ], _response_list(payload, "assignments")
+    if (
+        args.command == "clients"
+        and args.clients_command == "pending-roles"
+        and args.client_pending_roles_command == "list"
+    ):
+        return [
+            ("id", "ID"),
+            ("email", "EMAIL"),
+            ("role_name", "ROLE"),
+            ("expires_at", "EXPIRES_AT"),
+            ("consumed_at", "CONSUMED_AT"),
+        ], _response_list(payload, "grants")
     if args.command == "audit" and args.audit_command == "list":
         return [
             ("id", "ID"),

{intflow_authctl-0.2.2 → intflow_authctl-0.2.3}/src/intflow_authctl/parser.py

@@ -1,5 +1,3 @@
-"""Argument parser construction for the Intflow Auth operator CLI."""
-
 import argparse
 import difflib
 import re
@@ -12,6 +10,7 @@ from intflow_authctl.constants import (
     DEFAULT_AUTHCTL_LOGIN_TTL,
 )
 from intflow_authctl.validation import (
+    APP_ROLE_NAMES,
     OAUTH_CLIENT_TYPES,
     OPERATOR_ADMIN_TOKEN_STATUSES,
     ROLE_NAMES,
@@ -24,8 +23,6 @@ from intflow_authctl.validation import (
 
 
 class AuthctlArgumentParser(argparse.ArgumentParser):
-    """ArgumentParser with lightweight command typo suggestions."""
-
     def error(self, message: str) -> NoReturn:
         suggestion = _invalid_choice_suggestion(message)
         if suggestion is None:
@@ -543,7 +540,8 @@ def _build_authctl_parser() -> argparse.ArgumentParser:
             '  intflow-authctl clients find --name "Console"\n'
             '  intflow-authctl clients create --name "Console" --client-type public '
             "--redirect-uri https://app.example/callback --scope openid --scope email\n"
-            "  intflow-authctl clients admins grant <client_id> <user_id>"
+            "  intflow-authctl clients admins grant <client_id> <user_id>\n"
+            "  intflow-authctl clients roles grant <client_id> lead <user_id>"
         ),
         formatter_class=argparse.RawDescriptionHelpFormatter,
     )
@@ -584,7 +582,8 @@ def _build_authctl_parser() -> argparse.ArgumentParser:
     client_create_parser.description = (
         "Use public without a trusted backend; confidential requires secret storage. "
         "Callbacks match exactly; PKCE S256 is required. Use openid email profile; offline_access "
-        "also enables refresh grants. admin_access_required defaults to false and grants no roles. "
+        "also enables refresh grants. admin_access_required and assignment_required default to "
+        "false and grant no roles. "
         "Required scope: admin:clients:write. Without --secret-file the secret is printed once."
     )
     client_create_parser.add_argument(
@@ -619,6 +618,11 @@ def _build_authctl_parser() -> argparse.ArgumentParser:
         action="store_true",
         help="Require app-admin assignment before users can authorize this client.",
     )
+    client_create_parser.add_argument(
+        "--assignment-required",
+        action="store_true",
+        help="Require any application role assignment before users can authorize this client.",
+    )
     client_update_parser = client_subparsers.add_parser("update", help="Update an OAuth client.")
     client_update_parser.add_argument("client_id", help="OAuth client ID to update.")
     client_update_parser.add_argument("--name", help="New OAuth client display name.")
@@ -648,6 +652,17 @@ def _build_authctl_parser() -> argparse.ArgumentParser:
         action="store_true",
         help="Allow normal authorization without app-admin assignment.",
     )
+    assignment_group = client_update_parser.add_mutually_exclusive_group()
+    assignment_group.add_argument(
+        "--assignment-required",
+        action="store_true",
+        help="Require any application role assignment before users can authorize this client.",
+    )
+    assignment_group.add_argument(
+        "--no-assignment-required",
+        action="store_true",
+        help="Allow normal authorization without an application role assignment.",
+    )
     client_disable_parser = client_subparsers.add_parser(
         "disable",
         help="Disable an OAuth client.",
@@ -716,6 +731,103 @@ def _build_authctl_parser() -> argparse.ArgumentParser:
     )
     client_admins_revoke_parser.add_argument("client_id", help="OAuth client ID.")
     client_admins_revoke_parser.add_argument("user_id", help="Internal users.id to revoke.")
+    client_roles_parser = client_subparsers.add_parser(
+        "roles",
+        help="Manage application role assignments for an OAuth client.",
+        description=(
+            "Manage application role assignments for one OAuth client.\n\n"
+            "The roles are admin, lead and member. The client's access tokens carry "
+            "every role a user holds in app_roles. These are not Intflow Auth "
+            "management roles.\n\n"
+            "Use an internal users.id value for <user_id>. Run "
+            "intflow-authctl users list or users get to look up internal user IDs."
+        ),
+        formatter_class=argparse.RawDescriptionHelpFormatter,
+    )
+    client_roles_subparsers = client_roles_parser.add_subparsers(
+        dest="client_roles_command",
+        required=True,
+        parser_class=AuthctlArgumentParser,
+    )
+    client_roles_list_parser = client_roles_subparsers.add_parser(
+        "list",
+        help="List application role assignments for an OAuth client.",
+    )
+    client_roles_list_parser.add_argument("client_id", help="OAuth client ID.")
+    client_roles_list_parser.add_argument(
+        "--role",
+        choices=APP_ROLE_NAMES,
+        help="Return only assignments of this application role.",
+    )
+    _add_pagination_arguments(client_roles_list_parser)
+    _add_output_format_argument(client_roles_list_parser)
+    client_roles_grant_parser = client_roles_subparsers.add_parser(
+        "grant",
+        help="Grant an application role to an internal user.",
+    )
+    client_roles_grant_parser.add_argument("client_id", help="OAuth client ID.")
+    client_roles_grant_parser.add_argument(
+        "role_name",
+        choices=APP_ROLE_NAMES,
+        help="Application role to grant.",
+    )
+    client_roles_grant_parser.add_argument("user_id", help="Internal users.id to grant.")
+    client_roles_revoke_parser = client_roles_subparsers.add_parser(
+        "revoke",
+        help="Revoke an application role from an internal user.",
+    )
+    client_roles_revoke_parser.add_argument("client_id", help="OAuth client ID.")
+    client_roles_revoke_parser.add_argument(
+        "role_name",
+        choices=APP_ROLE_NAMES,
+        help="Application role to revoke.",
+    )
+    client_roles_revoke_parser.add_argument("user_id", help="Internal users.id to revoke.")
+    client_pending_roles_parser = client_subparsers.add_parser(
+        "pending-roles",
+        help="Manage pending application role grants for an OAuth client.",
+        description=(
+            "Manage pending application role grants for one OAuth client.\n\n"
+            "A pending grant names a company e-mail address that has not signed in yet. "
+            "The first sign-in of the verified intflow.ai account with that address "
+            "turns it into an application role assignment once. A grant expires after "
+            "90 days. These are not Intflow Auth management roles."
+        ),
+        formatter_class=argparse.RawDescriptionHelpFormatter,
+    )
+    client_pending_roles_subparsers = client_pending_roles_parser.add_subparsers(
+        dest="client_pending_roles_command",
+        required=True,
+        parser_class=AuthctlArgumentParser,
+    )
+    client_pending_roles_list_parser = client_pending_roles_subparsers.add_parser(
+        "list",
+        help="List pending application role grants for an OAuth client.",
+    )
+    client_pending_roles_list_parser.add_argument("client_id", help="OAuth client ID.")
+    client_pending_roles_list_parser.add_argument(
+        "--email",
+        help="Return only the grants of this company e-mail address.",
+    )
+    _add_pagination_arguments(client_pending_roles_list_parser)
+    _add_output_format_argument(client_pending_roles_list_parser)
+    client_pending_roles_create_parser = client_pending_roles_subparsers.add_parser(
+        "create",
+        help="Create a pending application role grant for a company e-mail address.",
+    )
+    client_pending_roles_create_parser.add_argument("client_id", help="OAuth client ID.")
+    client_pending_roles_create_parser.add_argument(
+        "role_name",
+        choices=APP_ROLE_NAMES,
+        help="Application role to grant at the first sign-in.",
+    )
+    client_pending_roles_create_parser.add_argument("email", help="Company e-mail address.")
+    client_pending_roles_delete_parser = client_pending_roles_subparsers.add_parser(
+        "delete",
+        help="Delete a pending application role grant.",
+    )
+    client_pending_roles_delete_parser.add_argument("client_id", help="OAuth client ID.")
+    client_pending_roles_delete_parser.add_argument("grant_id", help="Pending grant ID.")
 
     external_access_parser = subparsers.add_parser(
         "external-access",

{intflow_authctl-0.2.2 → intflow_authctl-0.2.3}/src/intflow_authctl/secret_output.py

@@ -1,5 +1,3 @@
-"""Protect a new secret file before performing any remote mutation."""
-
 import json
 import os
 import re

{intflow_authctl-0.2.2 → intflow_authctl-0.2.3}/src/intflow_authctl/tokens.py

@@ -1,5 +1,3 @@
-"""Operator token command handlers for authctl."""
-
 import argparse
 import webbrowser
 from typing import TextIO

{intflow_authctl-0.2.2 → intflow_authctl-0.2.3}/src/intflow_authctl/users.py

@@ -1,5 +1,3 @@
-"""User command handlers for authctl."""
-
 import argparse
 
 from intflow_authctl.api_client import _api_request

{intflow_authctl-0.2.2 → intflow_authctl-0.2.3}/src/intflow_authctl/validation.py

@@ -1,5 +1,3 @@
-"""Validation helpers for the Intflow Auth operator CLI."""
-
 import argparse
 import ipaddress
 import math
@@ -13,6 +11,7 @@ OAUTH_GRANT_TYPES = ("authorization_code", "refresh_token")
 OAUTH_SCOPES = ("openid", "email", "profile", "offline_access")
 OPERATOR_ADMIN_TOKEN_STATUSES = ("active", "revoked", "expired")
 ROLE_NAMES = ("user", "operator", "admin")
+APP_ROLE_NAMES = ("admin", "lead", "member")
 USER_STATUSES = ("active", "suspended")
 HTTP_LOOPBACK_REDIRECT_HOSTS = frozenset({"localhost", "127.0.0.1", "::1"})
 ADMIN_BASE_URL_LOOPBACK_HOSTS = HTTP_LOOPBACK_REDIRECT_HOSTS
@@ -21,7 +20,7 @@ OAUTH_SCOPE_SET = frozenset(OAUTH_SCOPES)
 
 
 class OAuthClientValidationError(ValueError):
-    """Raised when CLI OAuth client metadata violates registration policy."""
+    pass
 
 
 def _positive_float(value: float, name: str) -> float:
@@ -65,7 +64,7 @@ def _non_empty_search_text(value: str) -> str:
 
 
 def validate_redirect_uris(values: list[str] | tuple[str, ...]) -> tuple[str, ...]:
-    """Validate, trim, and deduplicate OAuth redirect URIs without service imports."""
+
     validated: list[str] = []
     seen: set[str] = set()
     for value in values:
@@ -80,7 +79,7 @@ def validate_redirect_uris(values: list[str] | tuple[str, ...]) -> tuple[str, ..
 
 
 def validate_oauth_scopes(values: list[str] | tuple[str, ...]) -> tuple[str, ...]:
-    """Validate, trim, and deduplicate OAuth scopes without service imports."""
+
     validated: list[str] = []
     seen: set[str] = set()
     for value in values:

intflow_authctl-0.2.2/PKG-INFO

@@ -1,136 +0,0 @@
-Metadata-Version: 2.4
-Name: intflow-authctl
-Version: 0.2.2
-Summary: Intflow Auth operator CLI.
-Author: Intflow
-License: Proprietary
-Requires-Python: >=3.12
-Requires-Dist: httpx<1,>=0.28
-Requires-Dist: keyring<26,>=25
-Provides-Extra: dev
-Requires-Dist: build<2,>=1.2; extra == 'dev'
-Requires-Dist: hatchling==1.31.0; extra == 'dev'
-Requires-Dist: mypy<3,>=1.13; extra == 'dev'
-Requires-Dist: packaging<27,>=24; extra == 'dev'
-Requires-Dist: pytest-cov<8,>=6; extra == 'dev'
-Requires-Dist: pytest-timeout<3,>=2.4; extra == 'dev'
-Requires-Dist: pytest<10,>=8; extra == 'dev'
-Requires-Dist: ruff<1,>=0.9; extra == 'dev'
-Requires-Dist: twine<7,>=6; extra == 'dev'
-Description-Content-Type: text/markdown
-
-# intflow-authctl
-
-`intflow-authctl` is the Python operator CLI package for Intflow Auth.
-
-## Install
-
-```powershell
-py -3.12 -m pip install --user --upgrade intflow-authctl
-```
-
-## CLI
-
-```powershell
-intflow-authctl login
-intflow-authctl whoami
-intflow-authctl users list
-intflow-authctl tokens create-no-expiry
-intflow-authctl clients list
-intflow-authctl clients rotate-secret <oauth-client-id> --grace-seconds 0
-intflow-authctl logout --revoke
-```
-
-The CLI is intended for authorized Intflow operators. It manages local operator
-credentials through the supported credential backends and communicates with an
-Intflow Auth deployment over the Admin API.
-
-After CLI login, an `admin`-role user can run `tokens create-no-expiry` to
-verify the current CLI identity and open the browser-only issuance page on the
-same Auth service. Use `--no-browser` to print the URL only. The CLI bearer token
-is never added to the URL or passed to the browser.
-
-Failed commands return a nonzero exit code and write a bounded diagnostic to
-stderr. Admin HTTP failures include only the status, a validated service error
-code when present, and bounded `Retry-After` guidance. Upstream descriptions,
-malformed bodies, credentials, and raw transport causes are not rendered.
-Automation should parse JSON stdout only after a successful command.
-
-## Package Scope
-
-This distribution contains only the operator CLI, Admin API client, output and
-validation logic, and credential-store adapters. It does not contain the Auth
-service, database models, migrations, or service bootstrap commands.
-
-## Requirements
-
-- Python 3.12 or later.
-- Access to an authorized Intflow Auth deployment.
-
-
-## Discover commands and diagnose access
-
-No repository checkout is needed to explore the installed CLI:
-
-```text
-intflow-authctl --help
-intflow-authctl docs
-intflow-authctl login
-intflow-authctl doctor
-intflow-authctl clients create --help
-intflow-authctl users find --help
-```
-
-Every command has `--help`, including nested commands. `docs` works offline and
-prints onboarding guidance plus links to the API documentation and OpenAPI.
-`docs --open` opens the documentation only when requested; use `--base-url` for
-a different Auth deployment. `doctor` makes one read-only `whoami` request and
-shows the current identity, effective scopes and token metadata without printing
-the bearer token. Missing/expired credentials return exit code 2 with login guidance.
-
-A company account does not automatically grant Auth management access. A 403
-explains the required token scope where known, but server roles and target
-restrictions still apply. When using `login --scope`, repeat it for **all** needed
-scopes; it replaces the default scope selection. `logout --revoke` requires
-`admin:tokens:write`; if remote revocation fails, local credentials remain.
-
-## Save a client secret without printing it
-
-```text
-intflow-authctl clients create --name "Internal app" --client-type confidential --redirect-uri https://app.example/callback --scope openid --scope email --scope profile --secret-file /private/new-client.json
-intflow-authctl clients rotate-secret CLIENT_ID --grace-seconds 60 --secret-file /private/new-rotation.json
-```
-
-Choose a new file in a private existing directory outside the repository. The
-file contains the complete response JSON, including `client_secret`; stdout
-contains metadata and `client_secret_file` instead. The CLI refuses to overwrite
-an existing file and protects the empty file **before** contacting the server
-(POSIX 0600; Windows current-user DACL with inherited access removed).
-If storage fails after the server changes the client, inspect the client and
-rotate to a working destination; do not repeat creation. Without `--secret-file`,
-the existing one-time secret JSON output remains unchanged. Transfer the file
-through your approved secret delivery mechanism and remove it when no longer needed.
-
-Public clients cannot hold secrets. Use confidential clients for trusted backends,
-register exact callback URLs, and use PKCE S256. Add `offline_access` only when
-refresh tokens are needed. App administrator assignment is a separate operation.
-
-## Recovery and local diagnostics
-
-`intflow-authctl --version` identifies the installed version and distribution.
-`doctor` remains read-only; `doctor --check-store` explicitly tests local storage
-with a temporary nonsecret write/read/delete probe and needs no login or server.
-Login runs the same preflight before requesting browser approval.
-
-Login polling honors server intervals and bounded HTTP 429 Retry-After guidance.
-It does not retry transport failures or 5xx responses, because one-time redemption
-may already have succeeded. Re-login never revokes server tokens. It removes only
-a previous local entry owned by the same config; legacy/shared entries are retained
-with a warning to preserve other profiles. Local logout can clear a config whose
-keyring entry is already missing. Use `logout --revoke` for explicit remote revocation.
-
-`tokens create --name automation --ttl 1h --secret-file /private/new-token.json`
-stores the full one-time response in a new protected file and returns `token_file`
-instead of the bearer. Without that option, existing one-time JSON stdout is unchanged.
-If issuance succeeds but storage fails, inspect and explicitly revoke the unused
-token before repeating issuance. File output uses the same protections as client secrets.

intflow_authctl-0.2.2/README.md

@@ -1,115 +0,0 @@
-# intflow-authctl
-
-`intflow-authctl` is the Python operator CLI package for Intflow Auth.
-
-## Install
-
-```powershell
-py -3.12 -m pip install --user --upgrade intflow-authctl
-```
-
-## CLI
-
-```powershell
-intflow-authctl login
-intflow-authctl whoami
-intflow-authctl users list
-intflow-authctl tokens create-no-expiry
-intflow-authctl clients list
-intflow-authctl clients rotate-secret <oauth-client-id> --grace-seconds 0
-intflow-authctl logout --revoke
-```
-
-The CLI is intended for authorized Intflow operators. It manages local operator
-credentials through the supported credential backends and communicates with an
-Intflow Auth deployment over the Admin API.
-
-After CLI login, an `admin`-role user can run `tokens create-no-expiry` to
-verify the current CLI identity and open the browser-only issuance page on the
-same Auth service. Use `--no-browser` to print the URL only. The CLI bearer token
-is never added to the URL or passed to the browser.
-
-Failed commands return a nonzero exit code and write a bounded diagnostic to
-stderr. Admin HTTP failures include only the status, a validated service error
-code when present, and bounded `Retry-After` guidance. Upstream descriptions,
-malformed bodies, credentials, and raw transport causes are not rendered.
-Automation should parse JSON stdout only after a successful command.
-
-## Package Scope
-
-This distribution contains only the operator CLI, Admin API client, output and
-validation logic, and credential-store adapters. It does not contain the Auth
-service, database models, migrations, or service bootstrap commands.
-
-## Requirements
-
-- Python 3.12 or later.
-- Access to an authorized Intflow Auth deployment.
-
-
-## Discover commands and diagnose access
-
-No repository checkout is needed to explore the installed CLI:
-
-```text
-intflow-authctl --help
-intflow-authctl docs
-intflow-authctl login
-intflow-authctl doctor
-intflow-authctl clients create --help
-intflow-authctl users find --help
-```
-
-Every command has `--help`, including nested commands. `docs` works offline and
-prints onboarding guidance plus links to the API documentation and OpenAPI.
-`docs --open` opens the documentation only when requested; use `--base-url` for
-a different Auth deployment. `doctor` makes one read-only `whoami` request and
-shows the current identity, effective scopes and token metadata without printing
-the bearer token. Missing/expired credentials return exit code 2 with login guidance.
-
-A company account does not automatically grant Auth management access. A 403
-explains the required token scope where known, but server roles and target
-restrictions still apply. When using `login --scope`, repeat it for **all** needed
-scopes; it replaces the default scope selection. `logout --revoke` requires
-`admin:tokens:write`; if remote revocation fails, local credentials remain.
-
-## Save a client secret without printing it
-
-```text
-intflow-authctl clients create --name "Internal app" --client-type confidential --redirect-uri https://app.example/callback --scope openid --scope email --scope profile --secret-file /private/new-client.json
-intflow-authctl clients rotate-secret CLIENT_ID --grace-seconds 60 --secret-file /private/new-rotation.json
-```
-
-Choose a new file in a private existing directory outside the repository. The
-file contains the complete response JSON, including `client_secret`; stdout
-contains metadata and `client_secret_file` instead. The CLI refuses to overwrite
-an existing file and protects the empty file **before** contacting the server
-(POSIX 0600; Windows current-user DACL with inherited access removed).
-If storage fails after the server changes the client, inspect the client and
-rotate to a working destination; do not repeat creation. Without `--secret-file`,
-the existing one-time secret JSON output remains unchanged. Transfer the file
-through your approved secret delivery mechanism and remove it when no longer needed.
-
-Public clients cannot hold secrets. Use confidential clients for trusted backends,
-register exact callback URLs, and use PKCE S256. Add `offline_access` only when
-refresh tokens are needed. App administrator assignment is a separate operation.
-
-## Recovery and local diagnostics
-
-`intflow-authctl --version` identifies the installed version and distribution.
-`doctor` remains read-only; `doctor --check-store` explicitly tests local storage
-with a temporary nonsecret write/read/delete probe and needs no login or server.
-Login runs the same preflight before requesting browser approval.
-
-Login polling honors server intervals and bounded HTTP 429 Retry-After guidance.
-It does not retry transport failures or 5xx responses, because one-time redemption
-may already have succeeded. Re-login never revokes server tokens. It removes only
-a previous local entry owned by the same config; legacy/shared entries are retained
-with a warning to preserve other profiles. Local logout can clear a config whose
-keyring entry is already missing. Use `logout --revoke` for explicit remote revocation.
-
-`tokens create --name automation --ttl 1h --secret-file /private/new-token.json`
-stores the full one-time response in a new protected file and returns `token_file`
-instead of the bearer. Without that option, existing one-time JSON stdout is unchanged.
-If issuance succeeds but storage fails, inspect and explicitly revoke the unused
-token before repeating issuance. File output uses the same protections as client secrets.

intflow_authctl-0.2.2/src/intflow_authctl/__init__.py

@@ -1,3 +0,0 @@
-"""Internal implementation package for the Intflow Auth operator CLI."""
-
-__version__ = "0.2.2"