memorysync-cli 1.0.2__py3-none-any.whl

memorysync_cli/commands/init.py

@@ -0,0 +1,109 @@
+"""init: store a credential and pick defaults.
+
+The key is verified against the API before it is written. Storing an unverified key
+means the next command fails with something that looks like a network problem, and
+the person has no reason to suspect the thing they just typed.
+
+It is never written to the config file in plain text. It goes to the OS keychain
+where one is reachable, and otherwise to an owner-only encrypted file, and `init`
+says which of the two happened rather than implying a keychain that was never
+there.
+"""
+
+from __future__ import annotations
+
+import getpass
+import os
+import sys
+
+from .. import config as config_module
+from .. import credentials
+from ..errors import auth_error, usage_error
+from ..http import ApiClient
+from ..output import style
+
+
+def init(ctx: dict) -> dict:
+    flags, settings = ctx["flags"], ctx["settings"]
+    profile_name = settings["profile_name"]
+
+    existing = config_module.profile(profile_name)
+    if existing and not flags.get("force"):
+        stored = credentials.read_key(profile_name)
+        if stored:
+            raise usage_error(
+                f'Profile "{profile_name}" already has a key.',
+                "Pass --force to replace it, or --profile <name> to add another.",
+            )
+
+    api_key = flags.get("api_key") or os.environ.get("MEMORYSYNC_API_KEY")
+    if not api_key:
+        if not sys.stdin.isatty():
+            raise usage_error(
+                "No API key given and no terminal to prompt from.",
+                "Pass --api-key, or set MEMORYSYNC_API_KEY.",
+            )
+        # getpass, so the key is not echoed into the terminal or the scrollback.
+        api_key = getpass.getpass("MemorySync API key: ").strip()
+
+    if not api_key:
+        raise usage_error("No API key given.")
+
+    # Verified before storing. A key that cannot read its own plan is not usable,
+    # and finding that out now is far cheaper than on the next command.
+    probe = ApiClient(
+        base_url=settings["base_url"],
+        api_key=api_key,
+        timeout=settings["timeout"],
+    )
+    try:
+        plan = probe.current_plan() or {}
+    except Exception as error:  # noqa: BLE001 - re-raised as an auth failure below
+        raise auth_error(
+            f"That key was refused: {error}",
+            "Check it in the dashboard, or pass --base-url if you are not on production.",
+        ) from None
+
+    tier = credentials.write_key(api_key, profile_name)
+
+    data = config_module.load()
+    entry = data.setdefault("profiles", {}).setdefault(profile_name, {})
+    if flags.get("user"):
+        entry["user"] = flags["user"]
+    if flags.get("project"):
+        entry["project"] = flags["project"]
+    if settings["base_url"] != config_module.DEFAULT_BASE_URL:
+        entry["base_url"] = settings["base_url"]
+    path = config_module.save(data)
+
+    payload = {
+        "profile": profile_name,
+        "stored_in": tier,
+        "config": str(path),
+        "user": entry.get("user"),
+        "project": entry.get("project"),
+        "plan": plan.get("plan") or plan.get("name"),
+    }
+
+    def render() -> str:
+        where = (
+            "the OS keychain"
+            if tier == "keychain"
+            else "an owner-only encrypted file"
+        )
+        lines = [
+            f"{style.green('Ready.')} Profile {style.bold(profile_name)} is set up.",
+            f"{style.dim('key      ')} stored in {where}",
+            f"{style.dim('config   ')} {path}",
+        ]
+        if entry.get("user"):
+            lines.append(f"{style.dim('user     ')} {entry['user']}")
+        else:
+            lines.append(
+                style.dim("no default user; pass --user on each call or re-run with --user")
+            )
+        if payload["plan"]:
+            lines.append(f"{style.dim('plan     ')} {payload['plan']}")
+        return "\n".join(lines)
+
+    return {"data": payload, "text": render}