mainsequence 9.0.1.dev30__py3-none-any.whl → 9.0.1.dev31__py3-none-any.whl

mainsequence/cli/config.py

@@ -756,6 +756,24 @@ def secure_store_available() -> bool:
     return _secure_keyring_backend() is not None
 
 
+def saved_session_summary(backend: str | None = None) -> dict:
+    """
+    Describe the saved session of a backend without any token value.
+
+    `usable` says whether its refresh token has not expired by its own claim,
+    `expires_at` is that claim in epoch seconds (None when absent) and
+    `username` is the recorded user. The process environment is not consulted.
+    """
+    tokens = _read_secure_tokens(backend)
+    refresh = (tokens.get("refresh") or "").strip()
+    expires_at = token_expiry(refresh)
+    return {
+        "username": str(tokens.get("username") or ""),
+        "expires_at": expires_at,
+        "usable": bool(refresh) and (expires_at is None or expires_at > int(time.time())),
+    }
+
+
 def stored_session_available(backend: str | None = None) -> bool:
     """
     Return whether the credential store holds a renewable session for a backend.

mainsequence/client/utils.py

@@ -70,42 +70,145 @@ def set_mainsequence_endpoint(endpoint: str) -> None:
     AUTH_ENDPOINT = normalized
 
 
-def _jwt_reauth_hint() -> str:
+_SESSION_TOKEN_VARIABLES = ("MAINSEQUENCE_ACCESS_TOKEN", "MAINSEQUENCE_REFRESH_TOKEN")
+# Renewal answers that refuse the credentials, as opposed to a backend that failed.
+_REFUSED_RENEWAL_STATUSES = frozenset({400, 401, 403})
+
+
+def _format_utc(epoch: int) -> str:
+    return datetime.datetime.fromtimestamp(epoch, tz=datetime.UTC).strftime(
+        "%Y-%m-%d %H:%M UTC"
+    )
+
+
+def _session_backend() -> str:
+    return (AUTH_ENDPOINT or "").rstrip("/")
+
+
+def _login_command(backend: str) -> str:
     """
-    Say how to repair rejected JWT credentials, according to where they came from.
+    Return the CLI command that signs in to `backend`.
 
-    A pair that was already in the process environment wins over the saved CLI
-    session. When that pair is stale the saved session is not tried, because the
-    pair may belong to another user or backend; the message names it instead.
+    `mainsequence login` alone signs in to the configured backend. Another
+    backend needs its address and the folder that holds its repositories.
     """
     try:
-        from mainsequence import bootstrap
         from mainsequence.cli import config as cli_config
 
-        from_environment = bootstrap.credential_source() == bootstrap.CREDENTIALS_FROM_ENVIRONMENT
-        saved_session = from_environment and cli_config.stored_session_available()
+        configured = cli_config.normalize_backend_url(
+            cli_config.get_persistent_config().get("backend_url")
+        )
     except Exception:
-        from_environment, saved_session = False, False
+        configured = ""
+    if not backend or backend == configured:
+        return "`mainsequence login`"
+    return f"`mainsequence login {backend} <base folder>`"
+
+
+def _env_file_holding_process_credentials() -> pathlib.Path | None:
+    """
+    Return the working directory's `.env` when it holds this process's tokens.
+
+    IDE run configurations, launchers and dotenv calls load that file into a
+    process's environment. Values are compared here and never shown.
+    """
+    from mainsequence.cli import config as cli_config
+
+    env_path = pathlib.Path.cwd() / ".env"
+    try:
+        lines = env_path.read_text(encoding="utf-8").splitlines()
+    except (OSError, UnicodeError):
+        return None
+    for line in lines:
+        key = cli_config.env_line_key(line)
+        if key not in _SESSION_TOKEN_VARIABLES:
+            continue
+        value = line.split("=", 1)[1].split(" #", 1)[0].strip().strip("\"'")
+        if value and value == (os.environ.get(key) or "").strip():
+            return env_path
+    return None
+
+
+def _jwt_reauth_hint(refresh_token: str | None = None) -> str:
+    """
+    Say why the backend refused this process's credentials and how to repair them.
+
+    The facts come from this process and this machine: the refresh token's own
+    expiry, whether the credentials were already in the environment when the SDK
+    started (and which `.env` holds them, when one does), and the saved session
+    of the backend. A pair from the environment wins over the saved session, so
+    the saved session is named and not used: the pair may belong to another user
+    or backend. No token value is included.
+    """
+    backend = _session_backend()
+    refresh = refresh_token if refresh_token is not None else os.getenv("MAINSEQUENCE_REFRESH_TOKEN")
+    expiry = _decode_jwt_exp(refresh)
+    try:
+        from mainsequence import bootstrap
+
+        source = bootstrap.credential_source()
+        from_environment = source == bootstrap.CREDENTIALS_FROM_ENVIRONMENT
+        from_store = source == bootstrap.CREDENTIALS_FROM_STORE
+    except Exception:
+        from_environment = from_store = False
+    login = _login_command(backend)
+
+    parts = []
+    if expiry is not None and expiry <= int(time.time()):
+        parts.append(f" The refresh token expired on {_format_utc(expiry)}.")
+    elif expiry is not None:
+        parts.append(
+            " The refresh token has not expired: the backend revoked it, or it was "
+            "issued by another backend."
+        )
 
     if from_environment:
-        return (
-            " The rejected credentials were set in this process's environment "
-            "(MAINSEQUENCE_ACCESS_TOKEN / MAINSEQUENCE_REFRESH_TOKEN) before the SDK "
-            "started: a shell export, an IDE run configuration, or a `.env` file that "
-            "your tooling loads. "
-            + (
-                "A saved CLI session exists for this backend and was not used. Remove "
-                "those variables to use it."
-                if saved_session
-                else "No saved CLI session exists for this backend. Remove those "
-                "variables and run `mainsequence login`."
+        try:
+            env_file = _env_file_holding_process_credentials()
+        except Exception:
+            env_file = None
+        try:
+            from mainsequence.cli import config as cli_config
+
+            saved = cli_config.saved_session_summary(backend)
+        except Exception:
+            saved = {"usable": False, "username": "", "expires_at": None}
+        if env_file is not None:
+            parts.append(
+                f" These credentials come from the token lines of {env_file}, not from "
+                "your saved session."
+            )
+            cleanup = f"run `mainsequence refresh-token` in {env_file.parent} to remove those lines"
+        else:
+            parts.append(
+                " These credentials were in this process's environment "
+                "(MAINSEQUENCE_ACCESS_TOKEN / MAINSEQUENCE_REFRESH_TOKEN) when it started, "
+                "set by the program that started it, not taken from your saved session."
+            )
+            cleanup = "start the process without those two variables"
+        if saved["usable"]:
+            who = f" ({saved['username']})" if saved["username"] else ""
+            until = (
+                f", valid until {_format_utc(saved['expires_at'])}"
+                if saved["expires_at"] is not None
+                else ""
+            )
+            parts.append(
+                f" Your saved session for {backend}{who} is usable{until}: "
+                f"{cleanup}, and the next start uses it."
             )
+        else:
+            parts.append(
+                f" There is no usable saved session for {backend}. Sign in with {login}, "
+                f"then {cleanup}."
+            )
+    elif from_store:
+        parts.append(
+            f" These credentials are your saved session for {backend}. Sign in again with {login}."
         )
-    return (
-        " Refresh your credentials with `mainsequence logout` and "
-        "`mainsequence login`. If this code runs in a separate shell or IDE, "
-        "use `mainsequence login --export` and load the exported env vars there."
-    )
+    else:
+        parts.append(f" Sign in with {login}.")
+    return "".join(parts)
 
 
 def _env_has_value(name: str) -> bool:
@@ -397,10 +500,14 @@ class JWTAuthProvider(BaseAuthProvider):
             if not force and not self._needs_refresh():
                 return
 
+            backend = _session_backend()
             if not self.refresh_token:
                 if self.access_token and not force:
                     return
-                raise AuthError("JWT refresh token is missing." + _jwt_reauth_hint())
+                raise AuthError(
+                    f"Main Sequence cannot renew the session of this process for {backend}: "
+                    "it has no refresh token." + _jwt_reauth_hint(self.refresh_token)
+                )
 
             http_client = session or requests
 
@@ -411,16 +518,24 @@ class JWTAuthProvider(BaseAuthProvider):
                 timeout=self.timeout,
             )
 
+            if r.status_code in _REFUSED_RENEWAL_STATUSES:
+                raise AuthError(
+                    f"Main Sequence refused to renew the session of this process for {backend} "
+                    f"(HTTP {r.status_code})." + _jwt_reauth_hint(self.refresh_token)
+                )
             if r.status_code != 200:
+                # The backend failed; the credentials were not judged.
                 raise AuthError(
-                    f"JWT refresh failed with status {r.status_code}." + _jwt_reauth_hint()
+                    f"Main Sequence could not renew the session of this process for {backend}: "
+                    f"the backend answered HTTP {r.status_code}. Try again when it is available."
                 )
 
             data = r.json()
             access = data.get("access")
             if not access:
                 raise AuthError(
-                    "JWT refresh response did not include access token." + _jwt_reauth_hint()
+                    f"Main Sequence renewed the session for {backend} without an access token."
+                    + _jwt_reauth_hint(self.refresh_token)
                 )
 
             # Important if ROTATE_REFRESH_TOKENS=True
@@ -604,15 +719,12 @@ def make_request(
 
             if r.status_code == 401 and loaders is not None and not auth_retried:
                 logger.warning(f"Error {r.status_code}; forcing auth refresh once")
-                try:
-                    s.headers.update(loaders.refresh_headers(force=True, session=s))
-                    req = get_req(session=s)
-                    auth_retried = True
-                    continue
-                except AuthError:
-                    logger.exception("Auth refresh failed")
-                    keep_request = False
-                    break
+                # A refused renewal raises AuthError: it is reported below with the
+                # reason and the repair, not as a traceback.
+                s.headers.update(loaders.refresh_headers(force=True, session=s))
+                req = get_req(session=s)
+                auth_retried = True
+                continue
 
             keep_request = False
             break

{mainsequence-9.0.1.dev30.dist-info → mainsequence-9.0.1.dev31.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mainsequence
-Version: 9.0.1.dev30
+Version: 9.0.1.dev31
 Summary: Main Sequence SDK
 Author-email: Main Sequence GmbH <dev@main-sequence.io>
 License-Expression: MIT

{mainsequence-9.0.1.dev30.dist-info → mainsequence-9.0.1.dev31.dist-info}/RECORD

@@ -23,7 +23,7 @@ mainsequence/cli/api.py,sha256=r9D0lSaw2Ah-39i04w9JgNkg3yjq88TLesB63B6nvug,12858
 mainsequence/cli/browser_auth.py,sha256=C-Sbpt0Pr9Pv3Z9dO80TMk7zPcaaZ-4zvW0tbRVMrTU,9863
 mainsequence/cli/cli.py,sha256=RYtT5DDCvoIrZQixAQWycJyqHxa4kD0xxoXj3DU7_0Y,275424
 mainsequence/cli/code_repository_status.py,sha256=SHEnU8YSWFowPG6dEdE4Yd8CS1tIcJSE1MXFLfvD3Os,5975
-mainsequence/cli/config.py,sha256=IT42UzG93uBhR98yUyg8YR-wMlQAgfx8UrybJcpih7Y,44884
+mainsequence/cli/config.py,sha256=4AGDEUPAJ1GzoDX3FzYYFvGMKfeAXM38Kh7Yv-OQLQQ,45595
 mainsequence/cli/docker_utils.py,sha256=eAnp9MI042cHWwKasA5IF2I7INL3A6tV2JX-cSIe7rc,10687
 mainsequence/cli/doctor.py,sha256=_1XHd72jheRDt7dEJHd6hbBSSpCPpMwwFDUOLcdkii8,4550
 mainsequence/cli/local_ops.py,sha256=oeYA2KXDLEjiENVZYJCc5-loNZxK3PK4G4sXldrDfm4,6495
@@ -43,16 +43,16 @@ mainsequence/client/models_foundry.py,sha256=iN1jJzDokfniEQF0Ac5eepAB7L5pVjJnKav
 mainsequence/client/models_helpers.py,sha256=rE7wPc9llKkctAKdJcak0kXJagjLivUzO2ebUGhz1M8,45820
 mainsequence/client/models_user.py,sha256=BU_hfn4-4KqYz3nsaPlXuYZmUG6_-7YM892mkM92Zyo,37613
 mainsequence/client/observability.py,sha256=_WrDKCaNk_TXmKElKCXC1inork6Exxxe8FRY4m1GI9s,16008
-mainsequence/client/utils.py,sha256=ZJNmUh9JNslznNMYvTGy26h0V9SMvYVqMX3Pva8l0lw,27549
+mainsequence/client/utils.py,sha256=fQur4p-ojLWTMcNWlYWx7uZKbGNEc4c2kJq1Wl_w070,31925
 mainsequence/client/value_sets.py,sha256=7TA-mpuAd3hOduNgO1WTQQTuNOGaFgue-VqCsDWKaC8,6181
 mainsequence/instrumentation/__init__.py,sha256=J_9XmfjprElvz0u2t9rTyJT0kFdyKpxdbkdQiaw28_U,316
 mainsequence/instrumentation/utils.py,sha256=b-ihjSioAepeLfMpudM2SqCtvnxMqIXileHx3klBCQU,3377
 mainsequence/server/__init__.py,sha256=559DiiBcCP6veWRmK2mXUEbsl7gbZofTvsbTUFjn0VE,82
 mainsequence/server/caller_assertions.py,sha256=5q8LZrDYozaonG1eBb9P8DojKQlB2i2qUJwO5VhsrW4,9780
 mainsequence/server/fastapi.py,sha256=tD1aVuJOgoBTu7H8bs9IldPNYRT4fhkr1leN3KZP1pI,10521
-mainsequence-9.0.1.dev30.dist-info/licenses/LICENSE,sha256=b6Ecsk8wjsEby3lbSzdljR6hHiFGHBizt9iWV2p1c_I,1074
-mainsequence-9.0.1.dev30.dist-info/METADATA,sha256=Q29OofPgcbN1MAT1LORvrCW5DOi5sG1epdwOEw7xqLk,7435
-mainsequence-9.0.1.dev30.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
-mainsequence-9.0.1.dev30.dist-info/entry_points.txt,sha256=XGAOq3-mF2lWWpeRJvoaWyMarRcK167mH1g124aGdUs,88
-mainsequence-9.0.1.dev30.dist-info/top_level.txt,sha256=BFeblM_Q9q0cUWBvTxnfWcWQEHtf5XZi9nOS-Gdfwus,28
-mainsequence-9.0.1.dev30.dist-info/RECORD,,
+mainsequence-9.0.1.dev31.dist-info/licenses/LICENSE,sha256=b6Ecsk8wjsEby3lbSzdljR6hHiFGHBizt9iWV2p1c_I,1074
+mainsequence-9.0.1.dev31.dist-info/METADATA,sha256=tBbhF0Sh9XpmEJpvbriT_X9qLEDwZ5tRQqHdiM2wBPU,7435
+mainsequence-9.0.1.dev31.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+mainsequence-9.0.1.dev31.dist-info/entry_points.txt,sha256=XGAOq3-mF2lWWpeRJvoaWyMarRcK167mH1g124aGdUs,88
+mainsequence-9.0.1.dev31.dist-info/top_level.txt,sha256=BFeblM_Q9q0cUWBvTxnfWcWQEHtf5XZi9nOS-Gdfwus,28
+mainsequence-9.0.1.dev31.dist-info/RECORD,,