mainsequence 9.0.1.dev30__tar.gz → 9.0.1.dev31__tar.gz

{mainsequence-9.0.1.dev30/mainsequence.egg-info → mainsequence-9.0.1.dev31}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mainsequence
-Version: 9.0.1.dev30
+Version: 9.0.1.dev31
 Summary: Main Sequence SDK
 Author-email: Main Sequence GmbH <dev@main-sequence.io>
 License-Expression: MIT

{mainsequence-9.0.1.dev30 → mainsequence-9.0.1.dev31}/mainsequence/cli/config.py

@@ -756,6 +756,24 @@ def secure_store_available() -> bool:
     return _secure_keyring_backend() is not None
 
 
+def saved_session_summary(backend: str | None = None) -> dict:
+    """
+    Describe the saved session of a backend without any token value.
+
+    `usable` says whether its refresh token has not expired by its own claim,
+    `expires_at` is that claim in epoch seconds (None when absent) and
+    `username` is the recorded user. The process environment is not consulted.
+    """
+    tokens = _read_secure_tokens(backend)
+    refresh = (tokens.get("refresh") or "").strip()
+    expires_at = token_expiry(refresh)
+    return {
+        "username": str(tokens.get("username") or ""),
+        "expires_at": expires_at,
+        "usable": bool(refresh) and (expires_at is None or expires_at > int(time.time())),
+    }
+
+
 def stored_session_available(backend: str | None = None) -> bool:
     """
     Return whether the credential store holds a renewable session for a backend.

{mainsequence-9.0.1.dev30 → mainsequence-9.0.1.dev31}/mainsequence/client/utils.py

@@ -70,42 +70,145 @@ def set_mainsequence_endpoint(endpoint: str) -> None:
     AUTH_ENDPOINT = normalized
 
 
-def _jwt_reauth_hint() -> str:
+_SESSION_TOKEN_VARIABLES = ("MAINSEQUENCE_ACCESS_TOKEN", "MAINSEQUENCE_REFRESH_TOKEN")
+# Renewal answers that refuse the credentials, as opposed to a backend that failed.
+_REFUSED_RENEWAL_STATUSES = frozenset({400, 401, 403})
+
+
+def _format_utc(epoch: int) -> str:
+    return datetime.datetime.fromtimestamp(epoch, tz=datetime.UTC).strftime(
+        "%Y-%m-%d %H:%M UTC"
+    )
+
+
+def _session_backend() -> str:
+    return (AUTH_ENDPOINT or "").rstrip("/")
+
+
+def _login_command(backend: str) -> str:
     """
-    Say how to repair rejected JWT credentials, according to where they came from.
+    Return the CLI command that signs in to `backend`.
 
-    A pair that was already in the process environment wins over the saved CLI
-    session. When that pair is stale the saved session is not tried, because the
-    pair may belong to another user or backend; the message names it instead.
+    `mainsequence login` alone signs in to the configured backend. Another
+    backend needs its address and the folder that holds its repositories.
     """
     try:
-        from mainsequence import bootstrap
         from mainsequence.cli import config as cli_config
 
-        from_environment = bootstrap.credential_source() == bootstrap.CREDENTIALS_FROM_ENVIRONMENT
-        saved_session = from_environment and cli_config.stored_session_available()
+        configured = cli_config.normalize_backend_url(
+            cli_config.get_persistent_config().get("backend_url")
+        )
     except Exception:
-        from_environment, saved_session = False, False
+        configured = ""
+    if not backend or backend == configured:
+        return "`mainsequence login`"
+    return f"`mainsequence login {backend} <base folder>`"
+
+
+def _env_file_holding_process_credentials() -> pathlib.Path | None:
+    """
+    Return the working directory's `.env` when it holds this process's tokens.
+
+    IDE run configurations, launchers and dotenv calls load that file into a
+    process's environment. Values are compared here and never shown.
+    """
+    from mainsequence.cli import config as cli_config
+
+    env_path = pathlib.Path.cwd() / ".env"
+    try:
+        lines = env_path.read_text(encoding="utf-8").splitlines()
+    except (OSError, UnicodeError):
+        return None
+    for line in lines:
+        key = cli_config.env_line_key(line)
+        if key not in _SESSION_TOKEN_VARIABLES:
+            continue
+        value = line.split("=", 1)[1].split(" #", 1)[0].strip().strip("\"'")
+        if value and value == (os.environ.get(key) or "").strip():
+            return env_path
+    return None
+
+
+def _jwt_reauth_hint(refresh_token: str | None = None) -> str:
+    """
+    Say why the backend refused this process's credentials and how to repair them.
+
+    The facts come from this process and this machine: the refresh token's own
+    expiry, whether the credentials were already in the environment when the SDK
+    started (and which `.env` holds them, when one does), and the saved session
+    of the backend. A pair from the environment wins over the saved session, so
+    the saved session is named and not used: the pair may belong to another user
+    or backend. No token value is included.
+    """
+    backend = _session_backend()
+    refresh = refresh_token if refresh_token is not None else os.getenv("MAINSEQUENCE_REFRESH_TOKEN")
+    expiry = _decode_jwt_exp(refresh)
+    try:
+        from mainsequence import bootstrap
+
+        source = bootstrap.credential_source()
+        from_environment = source == bootstrap.CREDENTIALS_FROM_ENVIRONMENT
+        from_store = source == bootstrap.CREDENTIALS_FROM_STORE
+    except Exception:
+        from_environment = from_store = False
+    login = _login_command(backend)
+
+    parts = []
+    if expiry is not None and expiry <= int(time.time()):
+        parts.append(f" The refresh token expired on {_format_utc(expiry)}.")
+    elif expiry is not None:
+        parts.append(
+            " The refresh token has not expired: the backend revoked it, or it was "
+            "issued by another backend."
+        )
 
     if from_environment:
-        return (
-            " The rejected credentials were set in this process's environment "
-            "(MAINSEQUENCE_ACCESS_TOKEN / MAINSEQUENCE_REFRESH_TOKEN) before the SDK "
-            "started: a shell export, an IDE run configuration, or a `.env` file that "
-            "your tooling loads. "
-            + (
-                "A saved CLI session exists for this backend and was not used. Remove "
-                "those variables to use it."
-                if saved_session
-                else "No saved CLI session exists for this backend. Remove those "
-                "variables and run `mainsequence login`."
+        try:
+            env_file = _env_file_holding_process_credentials()
+        except Exception:
+            env_file = None
+        try:
+            from mainsequence.cli import config as cli_config
+
+            saved = cli_config.saved_session_summary(backend)
+        except Exception:
+            saved = {"usable": False, "username": "", "expires_at": None}
+        if env_file is not None:
+            parts.append(
+                f" These credentials come from the token lines of {env_file}, not from "
+                "your saved session."
+            )
+            cleanup = f"run `mainsequence refresh-token` in {env_file.parent} to remove those lines"
+        else:
+            parts.append(
+                " These credentials were in this process's environment "
+                "(MAINSEQUENCE_ACCESS_TOKEN / MAINSEQUENCE_REFRESH_TOKEN) when it started, "
+                "set by the program that started it, not taken from your saved session."
+            )
+            cleanup = "start the process without those two variables"
+        if saved["usable"]:
+            who = f" ({saved['username']})" if saved["username"] else ""
+            until = (
+                f", valid until {_format_utc(saved['expires_at'])}"
+                if saved["expires_at"] is not None
+                else ""
+            )
+            parts.append(
+                f" Your saved session for {backend}{who} is usable{until}: "
+                f"{cleanup}, and the next start uses it."
             )
+        else:
+            parts.append(
+                f" There is no usable saved session for {backend}. Sign in with {login}, "
+                f"then {cleanup}."
+            )
+    elif from_store:
+        parts.append(
+            f" These credentials are your saved session for {backend}. Sign in again with {login}."
         )
-    return (
-        " Refresh your credentials with `mainsequence logout` and "
-        "`mainsequence login`. If this code runs in a separate shell or IDE, "
-        "use `mainsequence login --export` and load the exported env vars there."
-    )
+    else:
+        parts.append(f" Sign in with {login}.")
+    return "".join(parts)
 
 
 def _env_has_value(name: str) -> bool:
@@ -397,10 +500,14 @@ class JWTAuthProvider(BaseAuthProvider):
             if not force and not self._needs_refresh():
                 return
 
+            backend = _session_backend()
             if not self.refresh_token:
                 if self.access_token and not force:
                     return
-                raise AuthError("JWT refresh token is missing." + _jwt_reauth_hint())
+                raise AuthError(
+                    f"Main Sequence cannot renew the session of this process for {backend}: "
+                    "it has no refresh token." + _jwt_reauth_hint(self.refresh_token)
+                )
 
             http_client = session or requests
 
@@ -411,16 +518,24 @@ class JWTAuthProvider(BaseAuthProvider):
                 timeout=self.timeout,
             )
 
+            if r.status_code in _REFUSED_RENEWAL_STATUSES:
+                raise AuthError(
+                    f"Main Sequence refused to renew the session of this process for {backend} "
+                    f"(HTTP {r.status_code})." + _jwt_reauth_hint(self.refresh_token)
+                )
             if r.status_code != 200:
+                # The backend failed; the credentials were not judged.
                 raise AuthError(
-                    f"JWT refresh failed with status {r.status_code}." + _jwt_reauth_hint()
+                    f"Main Sequence could not renew the session of this process for {backend}: "
+                    f"the backend answered HTTP {r.status_code}. Try again when it is available."
                 )
 
             data = r.json()
             access = data.get("access")
             if not access:
                 raise AuthError(
-                    "JWT refresh response did not include access token." + _jwt_reauth_hint()
+                    f"Main Sequence renewed the session for {backend} without an access token."
+                    + _jwt_reauth_hint(self.refresh_token)
                 )
 
             # Important if ROTATE_REFRESH_TOKENS=True
@@ -604,15 +719,12 @@ def make_request(
 
             if r.status_code == 401 and loaders is not None and not auth_retried:
                 logger.warning(f"Error {r.status_code}; forcing auth refresh once")
-                try:
-                    s.headers.update(loaders.refresh_headers(force=True, session=s))
-                    req = get_req(session=s)
-                    auth_retried = True
-                    continue
-                except AuthError:
-                    logger.exception("Auth refresh failed")
-                    keep_request = False
-                    break
+                # A refused renewal raises AuthError: it is reported below with the
+                # reason and the repair, not as a traceback.
+                s.headers.update(loaders.refresh_headers(force=True, session=s))
+                req = get_req(session=s)
+                auth_retried = True
+                continue
 
             keep_request = False
             break

{mainsequence-9.0.1.dev30 → mainsequence-9.0.1.dev31/mainsequence.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mainsequence
-Version: 9.0.1.dev30
+Version: 9.0.1.dev31
 Summary: Main Sequence SDK
 Author-email: Main Sequence GmbH <dev@main-sequence.io>
 License-Expression: MIT

{mainsequence-9.0.1.dev30 → mainsequence-9.0.1.dev31}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "mainsequence"
-version = "9.0.1.dev30"
+version = "9.0.1.dev31"
 description = "Main Sequence SDK"
 readme = "README.md"
 requires-python = ">=3.13"

mainsequence-9.0.1.dev31/tests/test_auth_bootstrap.py

@@ -0,0 +1,339 @@
+"""Authentication compatibility for normal CLI-backed SDK processes."""
+
+from __future__ import annotations
+
+import base64
+import json
+import os
+import subprocess
+import sys
+import time
+from pathlib import Path
+from types import SimpleNamespace
+
+import pytest
+
+from mainsequence.bootstrap import prime_runtime_env
+from mainsequence.cli import config
+
+
+@pytest.fixture
+def bootstrap(monkeypatch, tmp_path):
+    monkeypatch.chdir(tmp_path)
+    for key in ("MAINSEQUENCE_ENDPOINT", "MAINSEQUENCE_ACCESS_TOKEN", "MAINSEQUENCE_REFRESH_TOKEN"):
+        monkeypatch.delenv(key, raising=False)
+    monkeypatch.setattr(config, "backend_url", lambda: "https://saved.example.test")
+    monkeypatch.setattr(
+        config, "get_tokens", lambda: {"access": "saved-access", "refresh": "saved-refresh"}
+    )
+    return tmp_path
+
+
+def test_saved_cli_session_is_available_to_sdk_process(bootstrap):
+    prime_runtime_env()
+    assert os.environ["MAINSEQUENCE_ENDPOINT"] == "https://saved.example.test"
+    assert os.environ["MAINSEQUENCE_ACCESS_TOKEN"] == "saved-access"
+    assert os.environ["MAINSEQUENCE_REFRESH_TOKEN"] == "saved-refresh"
+
+
+def test_saved_session_brings_its_user_name_with_its_tokens(bootstrap, monkeypatch):
+    monkeypatch.setenv("MAINSEQUENCE_USERNAME", "")
+    monkeypatch.setattr(
+        config,
+        "get_tokens",
+        lambda: {
+            "username": "ada@example.com",
+            "access": "saved-access",
+            "refresh": "saved-refresh",
+        },
+    )
+    prime_runtime_env()
+    assert os.environ["MAINSEQUENCE_USERNAME"] == "ada@example.com"
+
+
+def test_explicit_process_credentials_are_not_given_the_saved_user_name(bootstrap, monkeypatch):
+    monkeypatch.setenv("MAINSEQUENCE_USERNAME", "")
+    monkeypatch.setenv("MAINSEQUENCE_ACCESS_TOKEN", "explicit")
+    monkeypatch.setattr(
+        config,
+        "get_tokens",
+        lambda: {"username": "ada@example.com", "access": "explicit", "refresh": ""},
+    )
+    prime_runtime_env()
+    # Whose token the environment carries is not known.
+    assert os.environ["MAINSEQUENCE_USERNAME"] == ""
+
+
+def test_bootstrap_preserves_explicit_process_credentials_and_endpoint(bootstrap, monkeypatch):
+    for key in ("MAINSEQUENCE_ENDPOINT", "MAINSEQUENCE_ACCESS_TOKEN", "MAINSEQUENCE_REFRESH_TOKEN"):
+        monkeypatch.setenv(key, "explicit")
+    prime_runtime_env()
+    assert all(
+        os.environ[key] == "explicit"
+        for key in (
+            "MAINSEQUENCE_ENDPOINT",
+            "MAINSEQUENCE_ACCESS_TOKEN",
+            "MAINSEQUENCE_REFRESH_TOKEN",
+        )
+    )
+
+
+def test_checkout_endpoint_precedes_saved_backend(bootstrap):
+    (bootstrap / ".env").write_text("MAINSEQUENCE_ENDPOINT=https://checkout.example.test\n")
+    prime_runtime_env()
+    assert os.environ["MAINSEQUENCE_ENDPOINT"] == "https://checkout.example.test"
+
+
+def test_unavailable_login_store_does_not_block_unauthenticated_source_import(
+    bootstrap, monkeypatch
+):
+    def unavailable():
+        raise RuntimeError("store unavailable")
+
+    monkeypatch.setattr(config, "get_tokens", unavailable)
+    prime_runtime_env()
+    assert "MAINSEQUENCE_ACCESS_TOKEN" not in os.environ
+
+
+@pytest.fixture
+def credential_source(bootstrap, monkeypatch):
+    from mainsequence import bootstrap as bootstrap_module
+
+    monkeypatch.setattr(bootstrap_module, "_credential_source", None)
+    for key in ("MAIN_SEQUENCE_USER_TOKEN", "MAIN_SEQUENCE_REFRESH_TOKEN"):
+        monkeypatch.delenv(key, raising=False)
+    return bootstrap_module.credential_source
+
+
+def test_bootstrap_records_credentials_taken_from_the_saved_session(credential_source):
+    prime_runtime_env()
+    assert credential_source() == "store"
+
+
+def test_bootstrap_records_credentials_already_in_the_environment(credential_source, monkeypatch):
+    monkeypatch.setenv("MAINSEQUENCE_REFRESH_TOKEN", "explicit")
+    prime_runtime_env()
+    assert credential_source() == "environment"
+
+
+def test_bootstrap_records_that_no_credentials_were_found(credential_source, monkeypatch):
+    monkeypatch.setattr(config, "get_tokens", lambda: {})
+    prime_runtime_env()
+    assert credential_source() is None
+
+
+def _jwt(expires_at: int) -> str:
+    def part(data: dict) -> str:
+        return base64.urlsafe_b64encode(json.dumps(data).encode()).decode().rstrip("=")
+
+    return f"{part({'alg': 'none'})}.{part({'exp': expires_at, 'token_type': 'refresh'})}.signature"
+
+
+@pytest.fixture
+def refused(monkeypatch, tmp_path):
+    """A process whose environment pair the backend refused, on a machine with a saved session."""
+    from mainsequence import bootstrap as bootstrap_module
+    from mainsequence.client import utils
+
+    now = int(time.time())
+    expired_at, saved_until = now - 13 * 3600, now + 4 * 86400
+    refresh = _jwt(expired_at)
+    monkeypatch.chdir(tmp_path)
+    monkeypatch.setattr(utils, "AUTH_ENDPOINT", "http://127.0.0.1:8000")
+    monkeypatch.setattr(bootstrap_module, "_credential_source", "environment")
+    monkeypatch.setattr(
+        config, "get_persistent_config", lambda: {"backend_url": "http://127.0.0.1:8000"}
+    )
+    monkeypatch.setattr(
+        config,
+        "saved_session_summary",
+        lambda backend=None: {
+            "usable": backend == "http://127.0.0.1:8000",
+            "username": "dev@example.test",
+            "expires_at": saved_until,
+        },
+    )
+    monkeypatch.setenv("MAINSEQUENCE_ACCESS_TOKEN", "copied-access")
+    monkeypatch.setenv("MAINSEQUENCE_REFRESH_TOKEN", refresh)
+    return SimpleNamespace(
+        utils=utils, directory=tmp_path, refresh=refresh, expired_at=expired_at, saved_until=saved_until
+    )
+
+
+def test_refused_pair_from_a_dotenv_names_the_file_the_expiry_and_the_repair(refused):
+    utils = refused.utils
+    env_file = refused.directory / ".env"
+    env_file.write_text(
+        "MAINSEQUENCE_ENDPOINT=http://127.0.0.1:8000\n"
+        f"export MAINSEQUENCE_REFRESH_TOKEN='{refused.refresh}' # exported by a tool\n"
+    )
+
+    hint = utils._jwt_reauth_hint()
+
+    assert f" The refresh token expired on {utils._format_utc(refused.expired_at)}." in hint
+    assert f" These credentials come from the token lines of {env_file}, not from your saved session." in hint
+    assert (
+        " Your saved session for http://127.0.0.1:8000 (dev@example.test) is usable, valid until "
+        f"{utils._format_utc(refused.saved_until)}: run `mainsequence refresh-token` in "
+        f"{refused.directory} to remove those lines, and the next start uses it."
+    ) in hint
+    assert refused.refresh not in hint
+    assert "copied-access" not in hint
+
+
+def test_refused_pair_set_by_the_starting_program_says_to_start_without_it(refused):
+    (refused.directory / ".env").write_text("MAINSEQUENCE_REFRESH_TOKEN=another-value\n")
+
+    hint = refused.utils._jwt_reauth_hint()
+
+    assert "set by the program that started it, not taken from your saved session." in hint
+    assert ": start the process without those two variables, and the next start uses it." in hint
+
+
+def test_refused_pair_without_a_usable_saved_session_says_to_sign_in_first(refused, monkeypatch):
+    monkeypatch.setattr(
+        config,
+        "saved_session_summary",
+        lambda backend=None: {"usable": False, "username": "", "expires_at": None},
+    )
+
+    assert (
+        " There is no usable saved session for http://127.0.0.1:8000. Sign in with "
+        "`mainsequence login`, then start the process without those two variables."
+    ) in refused.utils._jwt_reauth_hint()
+
+
+def test_signing_in_to_another_backend_names_it_and_its_base_folder(refused, monkeypatch):
+    monkeypatch.setattr(
+        config, "get_persistent_config", lambda: {"backend_url": "https://api.main-sequence.app/"}
+    )
+    monkeypatch.setattr(
+        config,
+        "saved_session_summary",
+        lambda backend=None: {"usable": False, "username": "", "expires_at": None},
+    )
+
+    assert (
+        "Sign in with `mainsequence login http://127.0.0.1:8000 <base folder>`"
+        in refused.utils._jwt_reauth_hint()
+    )
+
+
+def test_refused_token_that_has_not_expired_is_called_revoked(refused, monkeypatch):
+    monkeypatch.setenv("MAINSEQUENCE_REFRESH_TOKEN", _jwt(int(time.time()) + 3600))
+
+    assert (
+        " The refresh token has not expired: the backend revoked it, or it was issued by "
+        "another backend."
+    ) in refused.utils._jwt_reauth_hint()
+
+
+def test_refused_saved_session_says_to_sign_in_again_and_does_not_read_the_store(refused, monkeypatch):
+    from mainsequence import bootstrap as bootstrap_module
+
+    monkeypatch.setattr(bootstrap_module, "_credential_source", "store")
+    monkeypatch.setattr(
+        config, "saved_session_summary", lambda backend=None: pytest.fail("The store was read")
+    )
+    monkeypatch.setattr(
+        config, "stored_session_available", lambda backend=None: pytest.fail("The store was read")
+    )
+
+    hint = refused.utils._jwt_reauth_hint()
+
+    assert hint.endswith(
+        " These credentials are your saved session for http://127.0.0.1:8000. "
+        "Sign in again with `mainsequence login`."
+    )
+
+
+def test_renewal_refusal_and_backend_failure_read_differently(refused, monkeypatch):
+    utils = refused.utils
+
+    class Answer:
+        status_code = 401
+
+        def json(self):
+            return {}
+
+    monkeypatch.setattr(utils.requests, "post", lambda *args, **kwargs: Answer())
+    provider = utils.JWTAuthProvider(
+        access_token="copied-access",
+        refresh_token=refused.refresh,
+        refresh_url="http://127.0.0.1:8000/auth/jwt-token/token/refresh/",
+    )
+
+    with pytest.raises(utils.AuthError) as refusal:
+        provider.refresh(force=True)
+    assert str(refusal.value).startswith(
+        "Main Sequence refused to renew the session of this process for "
+        "http://127.0.0.1:8000 (HTTP 401). The refresh token expired on "
+    )
+
+    Answer.status_code = 503
+    with pytest.raises(utils.AuthError) as failure:
+        provider.refresh(force=True)
+    assert str(failure.value) == (
+        "Main Sequence could not renew the session of this process for "
+        "http://127.0.0.1:8000: the backend answered HTTP 503. Try again when it is available."
+    )
+
+
+def test_request_reports_a_refused_renewal_with_its_reason(refused):
+    utils = refused.utils
+
+    class Answer:
+        status_code = 401
+        text = '{"detail": "Given token not valid for any token type"}'
+
+    class Session:
+        headers: dict = {}
+
+        def get(self, url, **kwargs):
+            return Answer()
+
+    class Loaders:
+        def refresh_headers(self, force=False, session=None):
+            if force:
+                raise utils.AuthError("Main Sequence refused to renew the session." + utils._jwt_reauth_hint())
+            return {"Authorization": "Bearer copied-access"}
+
+    response = utils.make_request(Session(), "GET", "http://127.0.0.1:8000/api/v1/users/me/", Loaders())
+
+    assert response.status_code == 401
+    assert response.code == "auth_error"
+    assert response.text.startswith("Main Sequence refused to renew the session.")
+    assert "start the process without those two variables" in response.text
+    assert "Given token not valid" not in response.text
+
+
+def test_package_import_bootstraps_before_client_endpoint_and_provider_initialization(tmp_path):
+    script = """
+import sys
+import types
+config = types.ModuleType("mainsequence.cli.config")
+config.backend_url = lambda: "https://saved.example.test"
+config.get_tokens = lambda: {"access": "saved-access", "refresh": "saved-refresh"}
+cli = types.ModuleType("mainsequence.cli")
+cli.__path__ = []
+cli.config = config
+sys.modules[cli.__name__] = cli
+sys.modules[config.__name__] = config
+from mainsequence.client import utils
+assert utils.MAINSEQUENCE_ENDPOINT == "https://saved.example.test"
+assert utils.loaders.auth_headers["Authorization"] == "Bearer saved-access"
+"""
+    environment = {
+        key: value
+        for key, value in os.environ.items()
+        if not key.startswith(("MAINSEQUENCE_", "MAIN_SEQUENCE_"))
+    }
+    environment["PYTHONPATH"] = str(Path(__file__).resolve().parents[1])
+    result = subprocess.run(
+        [sys.executable, "-c", script],
+        cwd=tmp_path,
+        env=environment,
+        capture_output=True,
+        text=True,
+    )
+    assert result.returncode == 0, result.stderr

mainsequence-9.0.1.dev30/tests/test_auth_bootstrap.py

@@ -1,182 +0,0 @@
-"""Authentication compatibility for normal CLI-backed SDK processes."""
-
-from __future__ import annotations
-
-import os
-import subprocess
-import sys
-from pathlib import Path
-
-import pytest
-
-from mainsequence.bootstrap import prime_runtime_env
-from mainsequence.cli import config
-
-
-@pytest.fixture
-def bootstrap(monkeypatch, tmp_path):
-    monkeypatch.chdir(tmp_path)
-    for key in ("MAINSEQUENCE_ENDPOINT", "MAINSEQUENCE_ACCESS_TOKEN", "MAINSEQUENCE_REFRESH_TOKEN"):
-        monkeypatch.delenv(key, raising=False)
-    monkeypatch.setattr(config, "backend_url", lambda: "https://saved.example.test")
-    monkeypatch.setattr(
-        config, "get_tokens", lambda: {"access": "saved-access", "refresh": "saved-refresh"}
-    )
-    return tmp_path
-
-
-def test_saved_cli_session_is_available_to_sdk_process(bootstrap):
-    prime_runtime_env()
-    assert os.environ["MAINSEQUENCE_ENDPOINT"] == "https://saved.example.test"
-    assert os.environ["MAINSEQUENCE_ACCESS_TOKEN"] == "saved-access"
-    assert os.environ["MAINSEQUENCE_REFRESH_TOKEN"] == "saved-refresh"
-
-
-def test_saved_session_brings_its_user_name_with_its_tokens(bootstrap, monkeypatch):
-    monkeypatch.setenv("MAINSEQUENCE_USERNAME", "")
-    monkeypatch.setattr(
-        config,
-        "get_tokens",
-        lambda: {
-            "username": "ada@example.com",
-            "access": "saved-access",
-            "refresh": "saved-refresh",
-        },
-    )
-    prime_runtime_env()
-    assert os.environ["MAINSEQUENCE_USERNAME"] == "ada@example.com"
-
-
-def test_explicit_process_credentials_are_not_given_the_saved_user_name(bootstrap, monkeypatch):
-    monkeypatch.setenv("MAINSEQUENCE_USERNAME", "")
-    monkeypatch.setenv("MAINSEQUENCE_ACCESS_TOKEN", "explicit")
-    monkeypatch.setattr(
-        config,
-        "get_tokens",
-        lambda: {"username": "ada@example.com", "access": "explicit", "refresh": ""},
-    )
-    prime_runtime_env()
-    # Whose token the environment carries is not known.
-    assert os.environ["MAINSEQUENCE_USERNAME"] == ""
-
-
-def test_bootstrap_preserves_explicit_process_credentials_and_endpoint(bootstrap, monkeypatch):
-    for key in ("MAINSEQUENCE_ENDPOINT", "MAINSEQUENCE_ACCESS_TOKEN", "MAINSEQUENCE_REFRESH_TOKEN"):
-        monkeypatch.setenv(key, "explicit")
-    prime_runtime_env()
-    assert all(
-        os.environ[key] == "explicit"
-        for key in (
-            "MAINSEQUENCE_ENDPOINT",
-            "MAINSEQUENCE_ACCESS_TOKEN",
-            "MAINSEQUENCE_REFRESH_TOKEN",
-        )
-    )
-
-
-def test_checkout_endpoint_precedes_saved_backend(bootstrap):
-    (bootstrap / ".env").write_text("MAINSEQUENCE_ENDPOINT=https://checkout.example.test\n")
-    prime_runtime_env()
-    assert os.environ["MAINSEQUENCE_ENDPOINT"] == "https://checkout.example.test"
-
-
-def test_unavailable_login_store_does_not_block_unauthenticated_source_import(
-    bootstrap, monkeypatch
-):
-    def unavailable():
-        raise RuntimeError("store unavailable")
-
-    monkeypatch.setattr(config, "get_tokens", unavailable)
-    prime_runtime_env()
-    assert "MAINSEQUENCE_ACCESS_TOKEN" not in os.environ
-
-
-@pytest.fixture
-def credential_source(bootstrap, monkeypatch):
-    from mainsequence import bootstrap as bootstrap_module
-
-    monkeypatch.setattr(bootstrap_module, "_credential_source", None)
-    for key in ("MAIN_SEQUENCE_USER_TOKEN", "MAIN_SEQUENCE_REFRESH_TOKEN"):
-        monkeypatch.delenv(key, raising=False)
-    return bootstrap_module.credential_source
-
-
-def test_bootstrap_records_credentials_taken_from_the_saved_session(credential_source):
-    prime_runtime_env()
-    assert credential_source() == "store"
-
-
-def test_bootstrap_records_credentials_already_in_the_environment(credential_source, monkeypatch):
-    monkeypatch.setenv("MAINSEQUENCE_REFRESH_TOKEN", "explicit")
-    prime_runtime_env()
-    assert credential_source() == "environment"
-
-
-def test_bootstrap_records_that_no_credentials_were_found(credential_source, monkeypatch):
-    monkeypatch.setattr(config, "get_tokens", lambda: {})
-    prime_runtime_env()
-    assert credential_source() is None
-
-
-def test_rejected_environment_pair_is_named_instead_of_the_saved_session(monkeypatch):
-    from mainsequence import bootstrap as bootstrap_module
-    from mainsequence.client import utils
-
-    monkeypatch.setattr(bootstrap_module, "_credential_source", "environment")
-    monkeypatch.setattr(config, "stored_session_available", lambda backend=None: True)
-    hint = utils._jwt_reauth_hint()
-    assert "MAINSEQUENCE_ACCESS_TOKEN / MAINSEQUENCE_REFRESH_TOKEN" in hint
-    assert "A saved CLI session exists for this backend and was not used." in hint
-
-    monkeypatch.setattr(config, "stored_session_available", lambda backend=None: False)
-    hint = utils._jwt_reauth_hint()
-    assert "No saved CLI session exists for this backend." in hint
-    assert "mainsequence login" in hint
-
-
-def test_rejected_saved_session_keeps_the_login_hint_and_does_not_read_the_store(monkeypatch):
-    from mainsequence import bootstrap as bootstrap_module
-    from mainsequence.client import utils
-
-    store_reads = []
-    monkeypatch.setattr(bootstrap_module, "_credential_source", "store")
-    monkeypatch.setattr(
-        config, "stored_session_available", lambda backend=None: store_reads.append(1) or True
-    )
-
-    hint = utils._jwt_reauth_hint()
-
-    assert "`mainsequence logout` and `mainsequence login`" in hint
-    assert store_reads == []
-
-
-def test_package_import_bootstraps_before_client_endpoint_and_provider_initialization(tmp_path):
-    script = """
-import sys
-import types
-config = types.ModuleType("mainsequence.cli.config")
-config.backend_url = lambda: "https://saved.example.test"
-config.get_tokens = lambda: {"access": "saved-access", "refresh": "saved-refresh"}
-cli = types.ModuleType("mainsequence.cli")
-cli.__path__ = []
-cli.config = config
-sys.modules[cli.__name__] = cli
-sys.modules[config.__name__] = config
-from mainsequence.client import utils
-assert utils.MAINSEQUENCE_ENDPOINT == "https://saved.example.test"
-assert utils.loaders.auth_headers["Authorization"] == "Bearer saved-access"
-"""
-    environment = {
-        key: value
-        for key, value in os.environ.items()
-        if not key.startswith(("MAINSEQUENCE_", "MAIN_SEQUENCE_"))
-    }
-    environment["PYTHONPATH"] = str(Path(__file__).resolve().parents[1])
-    result = subprocess.run(
-        [sys.executable, "-c", script],
-        cwd=tmp_path,
-        env=environment,
-        capture_output=True,
-        text=True,
-    )
-    assert result.returncode == 0, result.stderr