mammoth-cli 2.0.9__tar.gz → 2.0.11__tar.gz

{mammoth_cli-2.0.9 → mammoth_cli-2.0.11}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mammoth-cli
-Version: 2.0.9
+Version: 2.0.11
 Summary: Command-line interface for the Mammoth Analytics platform
 Project-URL: homepage, https://mammoth.io
 Project-URL: repository, https://github.com/EdgeMetric/mammothsdk

{mammoth_cli-2.0.9 → mammoth_cli-2.0.11}/mammoth_cli/__init__.py

@@ -6,7 +6,7 @@ not implement a second HTTP client and does not call private SDK members.
 
 from __future__ import annotations
 
-__version__ = "2.0.9"
+__version__ = "2.0.11"
 
 # The versioned machine output envelope contract.
 SCHEMA_VERSION = 1

{mammoth_cli-2.0.9 → mammoth_cli-2.0.11}/mammoth_cli/bundled_skill/mammoth-cli/references/auth.md

@@ -72,6 +72,11 @@ present and its endpoint matches, verify the live connection:
 mammoth doctor --profile PROFILE --output json --no-input
 ```
 
+`doctor` also lists the projects the credential can see (`projects` check)
+and verifies that `--project` or the selected project is one of them
+(`project_context` check). Pick the project id from that list; the API does
+not expose write permission, so the first write is what proves it.
+
 Do not continue to schema discovery or business operations after an
 authentication or doctor failure. The `app` server prefix is the production
 default; release or other environment credentials do not imply authorization

{mammoth_cli-2.0.9 → mammoth_cli-2.0.11}/mammoth_cli/commands/auth.py

@@ -27,6 +27,7 @@ from mammoth_cli.context.resolver import (
 )
 from mammoth_cli.contracts.auth import LoginRequest
 from mammoth_cli.errors.envelope import (
+    CODE_AUTHENTICATION_FAILED,
     CODE_CONFIRMATION_DECLINED,
     CODE_CONFIRMATION_REQUIRED,
     CODE_INVALID_WORKSPACE_ID,
@@ -135,6 +136,34 @@ def _validate_login_document(document: dict[str, Any]) -> LoginRequest:
         ) from exc
 
 
+def _masked_receipt(value: str) -> str:
+    """Describe a secret without revealing it: its length and last four characters."""
+    if len(value) <= 4:
+        return f"{len(value)} characters"
+    return f"{len(value)} characters, ending in …{value[-4:]}"
+
+
+def _prompt_secret(label: str) -> str:
+    """Prompt for one secret with hidden input, then confirm what was captured.
+
+    A hidden prompt shows nothing while typing, so a paste that silently
+    carried a newline or trailing space, or an empty return, used to surface
+    only later as an opaque 401. Surrounding whitespace is stripped, an empty
+    entry is rejected here, and a masked receipt (length and last four
+    characters, never the value) is printed to stderr as feedback.
+    """
+    value = typer.prompt(label, hide_input=True).strip()
+    if not value:
+        raise CliError(
+            code="login_input_required",
+            message=f"The {label} was empty.",
+            exit_status=EXIT_USAGE,
+            hint=f"Paste the {label} at the hidden prompt; nothing is echoed while you type.",
+        )
+    typer.echo(f"  {label}: {_masked_receipt(value)}", err=True)
+    return str(value)
+
+
 def _prompt_blockers(invocation: Invocation) -> list[str]:
     """Reasons this invocation cannot interactively prompt, in report order.
 
@@ -190,8 +219,8 @@ def _run_login(
         # Two flows, nothing else: a terminal prompts for everything (key,
         # secret, then workspace id), and non-interactive uses --input. The
         # workspace is asked last, after the credentials.
-        api_key = typer.prompt("API key", hide_input=True)
-        api_secret = typer.prompt("API secret", hide_input=True)
+        api_key = _prompt_secret("API key")
+        api_secret = _prompt_secret("API secret")
         effective_workspace = typer.prompt("Workspace id", type=int)
         effective_prefix = server_prefix
     else:
@@ -231,6 +260,32 @@ def _run_login(
     service = service_factory.build_service(resolved_auth, timeout=invocation.timeout)
     try:
         service.check_connection()
+    except CliError as exc:
+        if exc.code == CODE_AUTHENTICATION_FAILED:
+            # Say exactly what was tried, without the secret: the endpoint,
+            # the workspace, and a masked receipt of the key. Credentials are
+            # per environment, and a release key typed at a production login
+            # is the common cause of an otherwise opaque 401.
+            exc.details = {
+                **exc.details,
+                "endpoint_base_url": resolved_base_url,
+                "workspace_id": effective_workspace,
+                # Receipts only (length and last four characters). The output
+                # layer redacts any key that looks like a credential, so these
+                # are named for what they are: descriptions, not values.
+                "credential_receipt": {
+                    "key": _masked_receipt(api_key),
+                    "second_value_length": len(api_secret),
+                },
+            }
+            exc.hint = (
+                f"{resolved_base_url} rejected this key/secret for workspace "
+                f"{effective_workspace}. Credentials are per environment: a key issued on "
+                "one Mammoth server does not authenticate on another. Check the key, the "
+                "secret, the workspace id, and that --server-prefix matches where the key "
+                "was issued."
+            )
+        raise
     finally:
         service.close()
 

{mammoth_cli-2.0.9 → mammoth_cli-2.0.11}/mammoth_cli/commands/doctor.py

@@ -111,6 +111,16 @@ def _safe_connection_diagnostics(error: CliError, *, debug: bool) -> dict[str, A
     return result
 
 
+_PROJECT_LIMIT = 20
+
+
+def _visible_projects(service: Any) -> list[dict[str, Any]]:
+    """Return the projects this credential can list, or an empty list."""
+    response = service.list_projects(limit=_PROJECT_LIMIT + 1)
+    projects = response.get("projects", []) if isinstance(response, dict) else []
+    return [p for p in projects if isinstance(p, dict)]
+
+
 def doctor(invocation: Invocation) -> HandlerResult:
     """Run environment and connectivity diagnostics.
 
@@ -168,10 +178,12 @@ def doctor(invocation: Invocation) -> HandlerResult:
 
     connection_ok = False
     connection_detail = "not attempted"
+    projects: list[dict[str, Any]] | None = None
     if auth_ok:
         try:
             with open_service(invocation) as (service, _auth):
                 service.check_connection()
+                projects = _visible_projects(service)
             connection_ok = True
             connection_detail = "authenticated request succeeded"
         except CliError as error:
@@ -185,11 +197,56 @@ def doctor(invocation: Invocation) -> HandlerResult:
     if not auth_ok:
         checks.append(_check("connection", connection_ok, connection_detail))
 
+    # Authentication proves an identity, not a place to work. Report the
+    # projects this credential can see and whether the selected project is
+    # one of them. The API exposes no role or permission data, so write
+    # access is claimed by nobody here: the first write reports it.
+    selected_project = resolved_project(invocation)
+    if projects is not None:
+        visible_ids = [p.get("id") for p in projects]
+        checks.append(
+            {
+                **_check(
+                    "projects",
+                    bool(projects),
+                    (
+                        f"{len(projects)} project(s) visible in workspace"
+                        if projects
+                        else "no projects visible to this credential in the workspace"
+                    ),
+                ),
+                "projects": [
+                    {"id": p.get("id"), "name": p.get("name")} for p in projects[:_PROJECT_LIMIT]
+                ],
+                "truncated": len(projects) > _PROJECT_LIMIT,
+            }
+        )
+        if selected_project is None:
+            # Not a failure: every command accepts --project explicitly. It is
+            # reported so an agent knows it still has to choose one.
+            project_ok = True
+            project_detail = "no project selected; pass --project per command or set one"
+        elif selected_project in visible_ids:
+            project_ok, project_detail = True, f"project {selected_project} is visible"
+        else:
+            project_ok = False
+            project_detail = f"project {selected_project} is not among the visible projects"
+        checks.append(
+            {
+                **_check("project_context", project_ok, project_detail),
+                "project_id": selected_project,
+                "write_access": "not verifiable from the API; the first write reports it",
+            }
+        )
+
     recommendations: list[str] = []
     if record is None or not credentials.has_credentials(profile_name):
         login_profile = f" --profile {shlex.quote(profile_name)}" if profile_name else ""
         recommendations.append(f"mammoth auth login{login_profile}")
-    elif resolved_project(invocation) is None:
+    elif selected_project is None or (
+        projects is not None and selected_project not in [p.get("id") for p in projects]
+    ):
+        recommendations.append("mammoth project list --output json --no-input")
         recommendations.append("mammoth context project use PROJECT_ID")
     if not connection_ok and auth_ok and not invocation.debug:
         debug_profile = f" --profile {shlex.quote(profile_name)}" if profile_name else ""

{mammoth_cli-2.0.9 → mammoth_cli-2.0.11}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "mammoth-cli"
-version = "2.0.9"
+version = "2.0.11"
 description = "Command-line interface for the Mammoth Analytics platform"
 authors = [{name = "Mammoth Analytics", email = "support@mammoth.io"}]
 readme = "README.md"