lumos-identity-cli 0.0.0.dev1__py3-none-any.whl

lumos/__init__.py

@@ -0,0 +1,4 @@
+import importlib.metadata
+
+__app_name__ = "lumos"
+__version__ = importlib.metadata.version("lumos-identity-cli")

lumos/__main__.py

@@ -0,0 +1,9 @@
+from lumos.cli import lumos
+
+
+def main():
+    lumos()
+
+
+if __name__ == "__main__":
+    main()

lumos/cli.py

@@ -0,0 +1,96 @@
+import os
+
+from click_extra import Context, echo, group, option, pass_context
+
+from lumos import __version__
+from lumos.common.client import ApiClient
+from lumos.common.helpers import authenticate
+from lumos.common.helpers import login as _login
+from lumos.common.helpers import logout as _logout
+from lumos.common.helpers import setup as _setup
+from lumos.common.logging import logdebug
+
+client = ApiClient()
+
+
+@group(
+    context_settings={"help_option_names": ["-h", "--help"]},
+    version=__version__,
+)
+@option("--debug", is_flag=True, help="Enable debug mode", hidden=True)
+@pass_context
+def lumos(ctx: Context, debug: bool) -> None:
+    """Lumos CLI - Command line interface for Lumos"""
+    if debug:
+        os.environ["DEBUG"] = "1"
+        logdebug("🐞 Debug mode enabled")
+
+
+@lumos.command("whoami", help="Show information about the currently logged in user.")
+@option("--username", is_flag=True, help="Show the current user's username only")
+@option("--id", "show_id", is_flag=True, help="Show the current user's ID only")
+@authenticate
+def whoami(username: bool, show_id: bool) -> None:
+    user = client.get_current_user()
+    if username:
+        echo(user.email)
+        return
+    if show_id:
+        echo(user.id)
+        return
+    msg = f" 💻 Logged in as {user.given_name} {user.family_name} ({user.email})"
+    if scope := os.environ.get("SCOPE"):
+        msg += f" as {scope}"
+    echo(msg)
+    echo(f"Your ID is {user.id}, if you need to reference it")
+
+
+@lumos.command(
+    "setup",
+    help="Setup your Lumos CLI. Can be used to login or change your authentication method.",
+)
+def setup():
+    _setup(show_overwrite_prompt=True)
+    # Call whoami command programmatically
+    ctx = Context(whoami)
+    ctx.invoke(whoami, username=False, show_id=False)
+
+
+@lumos.command(
+    "login",
+    help="Login to your Lumos account via OAuth. You must be logged in to Lumos on your browser.",
+)
+@option(
+    "--admin",
+    is_flag=True,
+    help="Log in as an admin, if you have the permission to do so",
+)
+def login(admin: bool):
+    _logout()
+    _login(admin)
+    # Call whoami command programmatically
+    ctx = Context(whoami)
+    ctx.invoke(whoami, username=False, show_id=False)
+
+
+@lumos.command("logout", help="Logout of your Lumos account.")
+def logout():
+    _logout()
+    echo(" 👋 Logged out!")
+
+
+# Import and register subcommands
+def register_subcommands():
+    """Register all subcommands after the main CLI group is defined"""
+    from lumos.list_collections.cli import list_group
+    from lumos.request.cli import request
+
+    lumos.add_command(request)
+    lumos.add_command(list_group, name="list")
+
+
+# Register subcommands at module load time
+register_subcommands()
+
+if __name__ == "__main__":
+    lumos()

lumos/common/__init__.py

@@ -0,0 +1 @@
+# Common utilities for Lumos CLI

lumos/common/client.py

@@ -0,0 +1,479 @@
+import os
+import time
+import webbrowser
+from abc import abstractmethod
+from typing import Any, ClassVar
+from uuid import UUID
+
+import requests
+from click_extra import confirm, echo
+
+from lumos import __version__
+from lumos.common.client_helpers import check_version_header
+from lumos.common.keyhelpers import write_key
+from lumos.common.logging import logdebug_request, logdebug_response
+from lumos.common.models import (
+    AccessRequest,
+    App,
+    AppSetting,
+    Group,
+    Permission,
+    SupportRequestStatus,
+    User,
+)
+
+
+class BaseClient:
+    url: str
+
+    def __init__(self, url: str):
+        self.url = url
+
+    def get(self, endpoint: str, params: dict | None = None):
+        """Function to call an API endpoint and return the response."""
+        if params is None:
+            params = {}
+        return self._send_request("GET", endpoint, params=params)
+
+    def get_paged(
+        self,
+        endpoint: str,
+        params: dict | None = None,
+        page_size: int = 100,
+        page: int = 1,
+    ) -> tuple[list[dict[str, Any]], int, int, int, int]:
+        """Function to call an API endpoint and return the paged response."""
+        if params is None:
+            params = {}
+        params = {**params, "size": page_size, "page": page}
+        response = self.get(endpoint, params=params)
+        if response:
+            return (
+                response["items"],
+                len(response["items"]),
+                int(response["total"]),
+                int(response["page"]),
+                int(response["pages"]),
+            )
+        return [], 0, 0, 0, 0
+
+    def get_all(
+        self,
+        endpoint: str,
+        params: dict | None = None,
+    ) -> tuple[list[dict[str, Any]], int, int, int, int]:
+        """Function to call an API endpoint and return all the results."""
+        if params is None:
+            params = {}
+        all_results: list[Any] = []
+        page = 1
+        while True:
+            results, _, total, _, pages = self.get_paged(endpoint, params=params, page=page, page_size=100)
+            if total == 0:
+                break
+            all_results.extend(results)
+            if page == pages:
+                break
+            if (
+                page == 1
+                and total > 5000
+                and not confirm(
+                    f"Warning: {total} results found. This may take a while. Do you want to continue?",
+                    default=True,
+                )
+            ):
+                raise SystemExit(1)
+            page += 1
+            time.sleep(0.15)
+        count = len(all_results)
+        return all_results, count, count, 1, 1
+
+    def get_all_or_paged(
+        self,
+        endpoint: str,
+        params: dict | None = None,
+        all: bool = False,
+        page_size: int = 100,
+        page: int = 1,
+    ) -> tuple[list[dict[str, Any]], int, int, int, int]:
+        if params is None:
+            params = {}
+        """Function to call an API endpoint and return all the results."""
+        if all:
+            return self.get_all(endpoint, params=params)
+        return self.get_paged(endpoint, params=params, page_size=page_size, page=page)
+
+    def post(self, endpoint: str, body: dict[str, Any]):
+        """Function to call an API endpoint and return the response."""
+        return self._send_request("POST", endpoint, body=body)
+
+    def delete(self, endpoint: str, params: dict | None = None):
+        if params is None:
+            params = {}
+        return self._send_request("DELETE", endpoint, params=params)
+
+    def _send_request(
+        self,
+        method: str,
+        endpoint: str,
+        body: dict | None = None,
+        params: dict | None = None,
+        retry: int = 0,
+    ):
+        if params is None:
+            params = {}
+        if retry > 3:
+            echo("Too many retries. Exiting.", err=True)
+            raise SystemExit(1)
+        url, headers = self._get_url_and_headers(endpoint)
+        logdebug_request(url, headers, body, params, method)
+
+        response = requests.request(method, url, headers=headers, json=body, params=params)
+
+        logdebug_response(response)
+
+        if not check_version_header(response):
+            raise SystemExit(1)
+
+        if response.ok:
+            if response.status_code == 204:
+                return None
+            return response.json()
+        if response.status_code == 429:
+            echo("We're being rate limited. Waiting a sec.", err=True)
+            retry += 1
+            time.sleep(retry)
+            return self._send_request(method, endpoint, body, params, retry)
+        if response.status_code == 401:
+            if retry > 1 or not (scope := os.environ.get("SCOPE")):
+                echo(
+                    "Something went wrong with authorization. Try logging in again.",
+                    err=True,
+                )
+                raise SystemExit(1)
+            echo(
+                "Something went wrong with authorization. Trying to log in again.",
+                err=True,
+            )
+            AuthClient().authenticate(scope == "admin")
+            return self._send_request(method, endpoint, body, params, retry + 1)
+        if response.status_code == 403:
+            echo("You don't have permission to do that.", err=True)
+            raise SystemExit(1)
+
+        if response.status_code == 404:
+            echo("Not found.", err=True)
+            raise SystemExit(1)
+
+        echo(f"An error occurred (status code {response.status_code})", err=True)
+        if response.status_code == 409 or response.status_code == 422:
+            response_json = response.json()
+            if detail := response_json.get("detail"):
+                echo(detail, err=True)
+
+        raise SystemExit(1)
+
+    @abstractmethod
+    def _get_url_and_headers(self, endpoint: str) -> tuple[str, dict[str, str]]:
+        pass
+
+
+class AuthClient(BaseClient):
+    GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code"
+    HEADERS: ClassVar[dict[str, str]] = {
+        "content-type": "application/x-www-form-urlencoded",
+        "User-Agent": f"lumos-cli/{__version__}",
+    }
+
+    def __init__(self):
+        auth_url: str | None = None
+        if os.environ.get("DEV_MODE"):
+            auth_url = os.environ.get("AUTH_URL")
+        super().__init__(auth_url or "https://b.app.lumosidentity.com")
+
+    def _get_url_and_headers(self, endpoint: str) -> tuple[str, dict[str, str]]:
+        return f"{self.url}/b/oauth/{endpoint}", self.HEADERS
+
+    def _get_client_id(self) -> str:
+        if auth_url := os.environ.get("AUTH_URL"):
+            if "localhost" in auth_url:
+                return "IHcwQtVXJH8RVrPag3Tqi17KDdI6X9Ja"
+            if "qa" in auth_url:
+                return "37o8paGpj1BvV6NOFmVO21cG8L9ePSCs"
+            if "staging" in auth_url:
+                return "tLPbUcyJZZyEvuxTo5deyFQXkO9iXZyx"
+        return "XfsajAwB6pl2XyNYwzrVkTI15ISbQ2dR"
+
+    def authenticate(self, admin: bool = False):
+        url, headers = self._get_url_and_headers("device/code")
+        client_id = self._get_client_id()
+        scope = "admin" if admin else "user"
+        params = {
+            "client_id": client_id,
+            "scope": scope,
+        }
+        logdebug_request(url, headers, None, params, "POST")
+
+        response = requests.post(url, headers=headers, params=params)
+        if not check_version_header(response):
+            raise SystemExit(1)
+
+        if not response.ok:
+            echo("Something went wrong.")
+            logdebug_response(response)
+            raise SystemExit(1)
+
+        device_auth_data = response.json()
+
+        verification_uri_complete = device_auth_data["verification_uri_complete"]
+        if os.environ.get("DEV_MODE"):
+            if url.startswith("http://"):
+                verification_uri_complete = verification_uri_complete.replace("https://", "http://")
+            if "localhost:3000" in verification_uri_complete:
+                verification_uri_complete = verification_uri_complete.replace("localhost:3000", "localhost:8080")
+
+        webbrowser.open(verification_uri_complete)
+
+        token_data = {
+            "client_id": client_id,
+            "device_code": device_auth_data["device_code"],
+            "grant_type": self.GRANT_TYPE,
+        }
+        token_url, _ = self._get_url_and_headers("token")
+        echo(
+            f" 🔑 Please go to {verification_uri_complete} to authenticate. You must already be logged in to Lumos on your browser."
+        )
+
+        logdebug_request(token_url, headers, token_data, None, "POST")
+
+        wait = 0
+        while True:
+            print(
+                " ⏰ Waiting" + ("." * (wait % 10)) + (" " * (10 - (wait % 10))),
+                end="\r",
+            )
+            token_response = requests.post(token_url, headers=headers, data=token_data)
+            if token_response.status_code == 400:
+                echo(f"Bad request: {token_response.json()}")
+                raise SystemExit(1)
+            logdebug_response(token_response)
+            if token_response.status_code != 200:
+                time.sleep(1)
+                wait += 1
+            else:
+                token_data = token_response.json()
+                token = token_data["access_token"]
+                break
+            if wait > 60:
+                echo("Timed out waiting for authentication.")
+                raise SystemExit(1)
+        echo(" ✅ Authenticated!")
+        write_key(token, scope)
+
+
+class ApiClient(BaseClient):
+    def __init__(self):
+        api_url: str | None = None
+        if os.environ.get("DEV_MODE"):
+            api_url = os.environ.get("API_URL")
+        super().__init__(api_url or "https://api.lumos.com")
+
+    def _get_url_and_headers(self, endpoint: str) -> tuple[str, dict[str, str]]:
+        api_key = os.environ.get("API_KEY")
+        headers = {
+            "Authorization": f"Bearer {api_key}",
+            "Accept": "application/json",
+            "User-Agent": f"lumos-cli/{__version__}",
+        }
+        return f"{self.url}/{endpoint}", headers
+
+    def get_current_user_id(self) -> UUID:
+        if not os.environ.get("USER_ID"):
+            user = self.get_current_user()
+            os.environ["USER_ID"] = str(user.id)
+            return user.id
+        return UUID(os.environ["USER_ID"])
+
+    def get_current_user(self) -> User:
+        user = self.get("users/current")
+        if user:
+            os.environ["USER_ID"] = user["id"]
+            return User(**user)
+        echo("You are not logged in", err=True)
+        raise SystemExit(1)
+
+    def get_appstore_app(self, id: UUID) -> App | None:
+        raw_app = self.get(f"appstore/apps/{id}")
+        if raw_app:
+            return App(**raw_app)
+        return None
+
+    def get_appstore_app_setting(self, id: UUID) -> AppSetting:
+        raw_setting = self.get(f"appstore/apps/{id}/settings")
+        return AppSetting(**raw_setting)
+
+    def get_request_status(self, id: UUID) -> AccessRequest | None:
+        raw_request = self.get(f"appstore/access_requests/{id}")
+        return self._create_access_request(raw_request)
+
+    def cancel_access_request(self, id: UUID, reason: str | None) -> None:
+        params = {}
+        if reason:
+            params["reason"] = reason
+        self.delete(f"appstore/access_requests/{id}", params)
+
+    def _create_access_request(self, raw_request: dict | None) -> AccessRequest | None:
+        if not raw_request:
+            return None
+        return AccessRequest(**raw_request)
+
+    def get_appstore_apps(
+        self,
+        name_search: str | None = None,
+        all: bool = False,
+        page_size: int = 100,
+        page: int = 1,
+    ) -> tuple[list[App], int, int]:
+        endpoint = "appstore/apps"
+        params: dict[str, Any] = {}
+        if name_search:
+            params["name_search"] = name_search
+        raw_apps, count, total, _, _ = self.get_all_or_paged(
+            endpoint, params=params, all=all, page_size=page_size, page=page
+        )
+        apps: list[App] = []
+        for item in raw_apps:
+            apps.append(App(**item))
+        return apps, count, total
+
+    def get_my_apps(self, for_user: UUID | None = None) -> list[App]:
+        user = for_user or self.get_current_user_id()
+        statuses = SupportRequestStatus.PENDING_STATUSES + SupportRequestStatus.SUCCESS_STATUSES
+        access_requests, _, _, _, _ = self.get_access_requests(
+            target_user_id=user,
+            status=statuses,
+            all=True,
+        )
+        return access_requests
+
+    def get_access_requests(
+        self,
+        target_user_id: UUID | None = None,
+        status: list[str] | None = None,
+        all: bool = False,
+        page_size: int = 100,
+        page: int = 1,
+    ) -> tuple[list[AccessRequest], int, int, int, int]:
+        params: dict[str, Any] = {"sort": "desc"}
+        if target_user_id:
+            params["target_user_id"] = str(target_user_id)
+        if status and len(status) > 0:
+            params["statuses"] = [str(s) for s in status]
+
+        endpoint = "appstore/access_requests"
+        raw_access_requests, count, total, page, pages = self.get_all_or_paged(
+            endpoint, params=params, all=all, page=page, page_size=page_size
+        )
+        access_requests: list[AccessRequest] = []
+        for item in raw_access_requests:
+            access_request = self._create_access_request(item)
+            if access_request:
+                access_requests.append(access_request)
+        return access_requests, count, total, page, pages
+
+    def get_users(
+        self,
+        like: str | None = None,
+        all: bool = False,
+        page_size: int = 100,
+        page: int = 1,
+    ) -> tuple[list[User], int, int]:
+        endpoint = "users"
+        params: dict[str, Any] = {}
+        if like:
+            params["search_term"] = like
+        raw_users, count, total, _, _ = self.get_all_or_paged(
+            endpoint, params=params, all=all, page_size=page_size, page=page
+        )
+
+        users: list[User] = []
+        for item in raw_users:
+            users.append(User(**item))
+        return users, count, total
+
+    def get_app_requestable_permissions(
+        self,
+        app_id: UUID,
+        search_term: str | None = None,
+        all: bool = False,
+        page_size: int = 100,
+        page: int = 1,
+    ) -> tuple[list[Permission], int, int]:
+        endpoint = "appstore/requestable_permissions"
+        params: dict[str, Any] = {
+            "app_id": str(app_id),
+            "in_app_store": True,
+        }
+        if search_term:
+            params["search_term"] = search_term
+
+        raw_permissions, count, total, _, _ = self.get_all_or_paged(
+            endpoint, params=params, all=all, page_size=page_size, page=page
+        )
+
+        return [self._create_permission(item) for item in raw_permissions], count, total
+
+    def get_groups(
+        self,
+        app_id: UUID | None,
+        search_term: str | None = None,
+        all: bool = False,
+        page_size: int = 25,
+        page: int = 1,
+    ) -> tuple[list[Group], int, int]:
+        endpoint = "groups"
+        params: dict[str, Any] = {}
+        if app_id:
+            params["app_id"] = str(app_id)
+        if search_term:
+            params["name"] = search_term
+
+        raw_permissions, count, total, _, _ = self.get_all_or_paged(
+            endpoint, params=params, all=all, page_size=page_size, page=page
+        )
+
+        return [Group(**item) for item in raw_permissions], count, total
+
+    def get_app_requestable_permission(self, permission_id: UUID) -> Permission | None:
+        item = self.get(f"appstore/requestable_permissions/{permission_id}")
+        if not item:
+            return None
+        return self._create_permission(item)
+
+    def _create_permission(self, raw_permission: dict) -> Permission:
+        permission = Permission(**raw_permission)
+        durations = raw_permission["request_config"]["request_fulfillment_config"]["time_based_access"]
+        permission.duration_options = durations
+        return permission
+
+    def create_access_request(
+        self,
+        app_id: UUID,
+        note: str,
+        expiration_in_seconds: int | None,
+        permission_ids: list[UUID] | None = None,
+        target_user_id: UUID | None = None,
+    ) -> AccessRequest | None:
+        body: dict[str, Any] = {
+            "app_id": str(app_id),
+            "note": note,
+        }
+        if permission_ids:
+            body["requestable_permission_ids"] = [str(p) for p in permission_ids]
+        if expiration_in_seconds:
+            body["expiration_in_seconds"] = expiration_in_seconds
+        if target_user_id:
+            body["target_user_id"] = str(target_user_id)
+        response = self.post("appstore/access_request", body)
+
+        return AccessRequest(**response[0]) if response else None

lumos/common/client_helpers.py

@@ -0,0 +1,40 @@
+import os
+
+import requests
+from click_extra import secho
+
+from lumos import __version__
+
+
+def check_version_header(response: requests.Response) -> bool:
+    if os.environ.get("WARNED"):
+        return True
+    if not (version_header_string := response.headers.get("X-CLI-Version")):
+        return True
+
+    current_version = parse_version(__version__)
+    header_version = parse_version(version_header_string)
+    cont, error_message = check_version(current_version, header_version)
+
+    if error_message:
+        secho(error_message, fg="cyan" if cont else "red")
+    return cont
+
+
+def check_version(current_version: list[int], header_version: list[int]) -> tuple[bool, str | None]:
+    if current_version[0] < header_version[0]:
+        return (
+            False,
+            "A new version of the CLI is available. Please run `brew upgrade lumos` to proceed.",
+        )
+    if current_version[0] == header_version[0] and current_version[1] < header_version[1]:
+        os.environ["WARNED"] = "1"
+        return (
+            True,
+            "There's an update available to the CLI. Please run `brew upgrade lumos`.",
+        )
+    return True, None
+
+
+def parse_version(version: str) -> list[int]:
+    return [int(v) for v in version.split(".")]