manifold-cli 0.0.39__py3-none-any.whl

manifold_cli/clients/runner_home.py

@@ -0,0 +1,165 @@
+"""Reader and writer for the one file a runner home holds.
+
+The homes live under one root, `<config dir>/runners` unless
+`MANIFOLD_RUNNERS_DIR` moves them, one directory per runner id. A box with one
+runner has one home and needs no `--runner`; a box with several is asked which.
+"""
+
+import logging
+from pathlib import Path
+from typing import NamedTuple
+from uuid import UUID
+
+from pydantic import ValidationError
+
+from manifold_cli.clients.credentials import write_private_file
+from manifold_cli.models.errors import AmbiguousRunnerHomeError, NoRunnerHomeError
+from manifold_cli.models.runner_home import HOME_FILE_NAME, RunnerHome
+
+logger = logging.getLogger(__name__)
+
+
+class RunnerHomes:
+    """The root the runner homes sit under, one directory per runner id."""
+
+    def __init__(self, root: Path):
+        self._root = root
+
+    def resolve(self, handle: str | None) -> "RunnerHomeClient":
+        """The home a command acts on, which has to exist.
+
+        Falls back to the only home when the caller passes no handle, so a
+        command on a single-runner box can omit it.
+
+        Raises NoRunnerHomeError when no home answers to the handle or the box
+        has none, and AmbiguousRunnerHomeError when several do.
+        """
+        homes = self.all()
+        if handle is not None:
+            homes = [home for home in homes if home.answers_to(handle)]
+            if len(homes) == 0:
+                raise NoRunnerHomeError(f"No runner home here answers to '{handle}'.")
+        if len(homes) == 0:
+            raise NoRunnerHomeError
+        if len(homes) > 1:
+            raise AmbiguousRunnerHomeError(sorted(home.handle() for home in homes))
+        return homes[0]
+
+    def named(self, name: str) -> "RegisteredRunner | None":
+        """The home holding this runner name, with what it holds.
+
+        A home whose file cannot be read carries a name nothing can match, so
+        it is absent here and the server's name uniqueness is what refuses the
+        second registration.
+        """
+        for home in self.all():
+            stored = home.load()
+            if stored is not None and stored.name == name:
+                return RegisteredRunner(home, stored)
+        return None
+
+    def for_runner(self, runner_id: UUID) -> "RunnerHomeClient":
+        """The home for this runner id, whether or not it exists yet."""
+        return RunnerHomeClient(self._root / str(runner_id) / HOME_FILE_NAME)
+
+    def all(self) -> list["RunnerHomeClient"]:
+        """Every home on this box, by id.
+
+        A directory under the root without the file is not a home: an
+        interrupted registration leaves one, and it holds no credential.
+        """
+        if not self._root.is_dir():
+            return []
+        return [
+            RunnerHomeClient(entry / HOME_FILE_NAME)
+            for entry in sorted(self._root.iterdir())
+            if (entry / HOME_FILE_NAME).is_file()
+        ]
+
+    def handles(self) -> list[str]:
+        """What the homes on this box answer to, alphabetically."""
+        return sorted(home.handle() for home in self.all())
+
+
+class RunnerHomeClient:
+    """One runner home, read and written as a whole.
+
+    The file carries the minted token, so it is written owner-readable and
+    replaced rather than edited in place. Registration is the only writer.
+    """
+
+    def __init__(self, path: Path):
+        self._path = path
+
+    @property
+    def path(self) -> Path:
+        return self._path
+
+    @property
+    def runner_id(self) -> str:
+        """The id keying this home, which is the directory it sits in."""
+        return self._path.parent.name
+
+    def exists(self) -> bool:
+        return self._path.is_file()
+
+    def answers_to(self, handle: str) -> bool:
+        """Whether `--runner <handle>` picks this home.
+
+        The id matches on a leading fragment, so an operator types enough of it
+        to be unambiguous rather than the whole of it. A name the server has
+        since changed no longer matches, which is what the id is here for.
+        """
+        if len(handle) == 0:
+            return False
+        if self.runner_id.startswith(handle.lower()):
+            return True
+        stored = self.load()
+        return stored is not None and stored.name == handle
+
+    def handle(self) -> str:
+        """What this home answers to, for a message that lists several.
+
+        A home whose file cannot be read has no name to give, so it gives the
+        id, which is the only handle left that reaches it.
+        """
+        stored = self.load()
+        if stored is None:
+            return self.runner_id
+        return stored.name
+
+    def load(self) -> RunnerHome | None:
+        try:
+            raw = self._path.read_text()
+        except FileNotFoundError:
+            return None
+        try:
+            return RunnerHome.model_validate_json(raw)
+        except ValidationError:
+            logger.warning("runner home at %s is malformed; ignoring", self._path)
+            return None
+
+    def save(self, home: RunnerHome) -> None:
+        # Owner-only: a homes root outside a user's own tree is otherwise
+        # listable by everyone on the box, and the token sits in here.
+        self._path.parent.mkdir(parents=True, exist_ok=True, mode=0o700)
+        write_private_file(self._path, home.model_dump_json())
+
+    def clear(self) -> None:
+        """Remove the home, file and directory both.
+
+        A home is its file, so blanking the token would leave a directory no
+        command can complete: nothing installs a token into an existing home,
+        and registering over it writes a new one under the new id anyway.
+        """
+        self._path.unlink(missing_ok=True)
+        parent = self._path.parent
+        if parent.is_dir() and len(list(parent.iterdir())) == 0:
+            parent.rmdir()
+
+
+class RegisteredRunner(NamedTuple):
+    """A home on this box and the document it holds."""
+
+    home: RunnerHomeClient
+    stored: RunnerHome

manifold_cli/clients/workos.py

@@ -0,0 +1,99 @@
+"""WorkOS CLI Auth (OAuth 2.0 Device Authorization Grant, RFC 8628).
+
+Docs: https://workos.com/docs/authkit/cli-auth
+RFC 8628: https://datatracker.ietf.org/doc/html/rfc8628
+"""
+
+import logging
+from collections.abc import Callable
+from typing import Any
+
+import httpx
+
+from manifold_cli.models.auth import (
+    CliConfig,
+    DeviceAuthorization,
+    PollPending,
+    TokenResponse,
+)
+from manifold_cli.models.errors import WorkOSAuthError
+
+logger = logging.getLogger(__name__)
+
+DEVICE_CODE_GRANT = "urn:ietf:params:oauth:grant-type:device_code"
+REFRESH_TOKEN_GRANT = "refresh_token"
+
+
+class WorkOSDeviceClient:
+    def __init__(self, config_provider: Callable[[], CliConfig]):
+        self._config_provider = config_provider
+        self._cached_config: CliConfig | None = None
+        self._client = httpx.Client()
+
+    def _config(self) -> CliConfig:
+        if self._cached_config is None:
+            self._cached_config = self._config_provider()
+        return self._cached_config
+
+    def start_device_authorization(self) -> DeviceAuthorization:
+        config = self._config()
+        response = self._client.post(
+            config.authorization_endpoint,
+            data={"client_id": config.workos_client_id},
+        )
+        if response.is_error:
+            body = _safe_json(response)
+            raise WorkOSAuthError(
+                error=body.get("error", "authorization_request_failed"),
+                description=body.get("error_description") or response.text,
+            )
+        return DeviceAuthorization.model_validate(response.json())
+
+    def poll_token(self, device_code: str) -> TokenResponse | PollPending:
+        config = self._config()
+        response = self._client.post(
+            config.token_endpoint,
+            data={
+                "grant_type": DEVICE_CODE_GRANT,
+                "device_code": device_code,
+                "client_id": config.workos_client_id,
+            },
+        )
+        if response.is_success:
+            return TokenResponse.model_validate(response.json())
+        body = _safe_json(response)
+        error = body.get("error", "")
+        if error == PollPending.PENDING.value:
+            return PollPending.PENDING
+        if error == PollPending.SLOW_DOWN.value:
+            return PollPending.SLOW_DOWN
+        raise WorkOSAuthError(
+            error=error or "token_request_failed",
+            description=body.get("error_description"),
+        )
+
+    def refresh(self, refresh_token: str) -> TokenResponse:
+        config = self._config()
+        response = self._client.post(
+            config.token_endpoint,
+            data={
+                "grant_type": REFRESH_TOKEN_GRANT,
+                "refresh_token": refresh_token,
+                "client_id": config.workos_client_id,
+            },
+        )
+        if response.is_success:
+            return TokenResponse.model_validate(response.json())
+        body = _safe_json(response)
+        raise WorkOSAuthError(
+            error=body.get("error", "refresh_failed"),
+            description=body.get("error_description"),
+        )
+
+
+def _safe_json(response: httpx.Response) -> dict[str, Any]:
+    try:
+        data = response.json()
+    except ValueError:
+        return {}
+    return data if isinstance(data, dict) else {}

manifold_cli/commands/auth.py

@@ -0,0 +1,101 @@
+import typer
+from rich.console import Console
+from rich.markup import escape
+
+from manifold_cli.commands.organization import (
+    NO_ORGANIZATION_MESSAGE,
+    ORGANIZATION_CALL_ERRORS,
+    exit_for_call_error,
+)
+from manifold_cli.dependencies import Dependencies
+from manifold_cli.models.auth import AuthState, DeviceAuthorization
+from manifold_cli.models.errors import ManifoldApiError, WorkOSAuthError
+
+SKILLS_HINT = (
+    "Run [bold]npx skills add bifrostai/manifold-skills --all[/bold] "
+    "to install agent skills."
+)
+
+
+def register(app: typer.Typer, deps: Dependencies) -> None:
+    console = Console()
+    auth_app = typer.Typer(
+        name="auth",
+        help="Manage Manifold authentication.",
+        no_args_is_help=True,
+    )
+    app.add_typer(auth_app)
+
+    @auth_app.command()
+    def login() -> None:
+        """Log in to Manifold via WorkOS device authorization."""
+
+        def show(device_auth: DeviceAuthorization) -> None:
+            console.print(
+                f"Visit [bold]{escape(device_auth.verification_uri_complete)}[/bold]\n"
+                f"and confirm code [bold]{escape(device_auth.user_code)}[/bold]."
+            )
+
+        try:
+            deps.auth_service.login(on_device_code=show)
+        except (ManifoldApiError, WorkOSAuthError) as exc:
+            console.print(f"[red]Login failed:[/red] {escape(str(exc))}")
+            raise typer.Exit(1) from exc
+
+        console.print("[green]Login successful.[/green]")
+        if _report_organizations(console, deps):
+            console.print(SKILLS_HINT)
+
+    @auth_app.command()
+    def logout() -> None:
+        """Forget local credentials."""
+        deps.auth_service.logout()
+        console.print("Logged out.")
+
+    @auth_app.command()
+    def status() -> None:
+        """Show whether you are logged in to Manifold."""
+        try:
+            result = deps.auth_service.status()
+        except ORGANIZATION_CALL_ERRORS as exc:
+            raise exit_for_call_error(console, exc) from exc
+
+        match result.state:
+            case AuthState.LOGGED_OUT:
+                console.print(
+                    "Not logged in. Run `manifold auth login` to authenticate."
+                )
+            case AuthState.SESSION_EXPIRED:
+                console.print(
+                    "[yellow]Session expired.[/yellow] "
+                    "Run `manifold auth login` to re-authenticate."
+                )
+            case AuthState.LOGGED_IN:
+                assert result.user is not None
+                console.print(
+                    f"[green]Logged in as[/green] "
+                    f"[bold]{escape(result.user.email)}[/bold]"
+                )
+
+
+def _report_organizations(console: Console, deps: Dependencies) -> bool:
+    """Print the caller's organizations and report whether one was found.
+
+    Best-effort login epilogue: expected network, API, auth, and
+    response-shape failures are downgraded to a warning so they never fail the
+    login. A bug in this function itself still surfaces.
+    """
+    try:
+        organizations = deps.organization_service.list()
+    except ORGANIZATION_CALL_ERRORS as exc:
+        console.print(
+            f"[yellow]Could not check your organizations:[/yellow] {escape(str(exc))}"
+        )
+        return False
+
+    if not organizations:
+        console.print(NO_ORGANIZATION_MESSAGE)
+        return False
+    slugs = ", ".join(organization.slug for organization in organizations)
+    console.print(f"Organization: [bold]{slugs}[/bold]")
+    return True