menda-cli 0.2.2__tar.gz → 0.2.3__tar.gz

{menda_cli-0.2.2 → menda_cli-0.2.3}/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 All notable changes to this project will be documented in this file.
 
+## [0.2.3] - 2026-04-14
+
+### Features
+
+- Implement fetch_tenant_config and update device authorization flow (#16) ([9c31568](https://github.com/mendaml/menda-cli/commit/9c315689d07f24996928f7ab641e98de1c598b26))
+
 ## [0.2.2] - 2026-04-06
 
 ### Features

{menda_cli-0.2.2 → menda_cli-0.2.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: menda-cli
-Version: 0.2.2
+Version: 0.2.3
 Summary: A CLI for building, deploying and managing menda data products.
 Author-email: jpm2617 <jose.moreno@mendaml.com>
 Requires-Python: >=3.11

{menda_cli-0.2.2 → menda_cli-0.2.3}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "menda-cli"
-version = "0.2.2"
+version = "0.2.3"
 description = "A CLI for building, deploying and managing menda data products."
 readme = "README.md"
 authors = [

{menda_cli-0.2.2 → menda_cli-0.2.3}/src/menda/auth/api.py

@@ -6,6 +6,7 @@ AUTHORIZATION_PATH = "/auth/device/authorize"
 TOKEN_PATH = "/auth/device/token"  # noqa: S105
 WHOAMI_PATH = "/auth/whoami"
 OAUTH2_TOKEN_PATH = "/auth/oauth2/token"  # noqa: S105
+CONFIG_PATH = "/system/config"
 
 
 class AuthRoutes:
@@ -82,6 +83,11 @@ class AuthRoutes:
             payload["code_verifier"] = code_verifier
         return session.post(url=OAUTH2_TOKEN_PATH, params=payload)
 
+    @classmethod
+    def config(cls, session: requests.Session, hostname: str) -> requests.Response:
+        """Get tenant configuration by hostname."""
+        return session.get(CONFIG_PATH, params={"hostname": hostname})
+
     @classmethod
     def whoami(cls, session: requests.Session, token: str) -> requests.Response:
         """Get current user info."""

{menda_cli-0.2.2 → menda_cli-0.2.3}/src/menda/auth/oauth2/client.py

@@ -13,13 +13,40 @@ from menda.auth.api import AuthRoutes
 from menda.auth.exceptions import AuthenticationError
 
 logger = structlog.get_logger()
-
-CLIENT_ID = "device"
 SCOPE = ["openid"]
 GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code"
 CALLBACK_PATH = "/auth/device/callback"
 
 
+def fetch_tenant_config(session: requests.Session, host: str) -> str:
+    """Fetch app_client_id for the tenant from the config endpoint."""
+    from urllib.parse import urlparse
+
+    hostname = urlparse(host).hostname
+    if not hostname:
+        raise AuthenticationError(
+            detail=f"Invalid host URL: {host}"
+        )
+    response = AuthRoutes.config(session=session, hostname=hostname)
+    try:
+        body = response.json()
+    except Exception as err:
+        raise AuthenticationError(
+            code=response.status_code,
+            detail=f"Failed to resolve tenant config for '{hostname}': server returned non-JSON response (status {response.status_code})",
+        ) from err
+    if response.status_code == 200:
+        app_client_id = body.get("app_client_id")
+        if not app_client_id:
+            raise AuthenticationError(
+                code=response.status_code,
+                detail=f"Tenant config for '{hostname}' is missing app_client_id",
+            )
+        return app_client_id
+    detail = body.get("detail", "Failed to resolve tenant config")
+    raise AuthenticationError(code=response.status_code, detail=detail)
+
+
 def poll_for_token(interval: int, expires_in: int, api: typing.Callable[[], requests.Response]) -> requests.Response:
     """Poll an API endpoint at intervals until success or timeout."""
     deadline = time.time() + expires_in
@@ -42,10 +69,10 @@ def is_device_code_in_valid_state(state: str) -> bool:
     return state in ["authorized", "pending"]
 
 
-def authorize_device(session: requests.Session, code_challenge: str) -> models.DeviceAuthResponseModel:
+def authorize_device(session: requests.Session, code_challenge: str, client_id: str) -> models.DeviceAuthResponseModel:
     """Request device authorization."""
     response = AuthRoutes.authorize_device(
-        session=session, client_id=CLIENT_ID, scope=SCOPE, code_challenge=code_challenge, code_challenge_method="S256"
+        session=session, client_id=client_id, scope=SCOPE, code_challenge=code_challenge, code_challenge_method="S256"
     )
     if response and response.status_code == 200:
         return models.DeviceAuthResponseModel(**response.json())
@@ -63,6 +90,7 @@ def login_with_device(
     device_model: models.DeviceAuthResponseModel,
     host: str,
     code_verifier: str,
+    client_id: str,
 ) -> models.CredentialsModel:
     """Complete device flow login."""
     response = poll_for_token(
@@ -70,7 +98,7 @@ def login_with_device(
         expires_in=device_model.expires_in,
         api=lambda: AuthRoutes.token(
             session=session,
-            client_id=CLIENT_ID,
+            client_id=client_id,
             redirect_uri=urljoin(host, CALLBACK_PATH),
             device_code=device_model.device_code,
             grant_type=GRANT_TYPE,

{menda_cli-0.2.2 → menda_cli-0.2.3}/src/menda/auth/task.py

@@ -145,13 +145,20 @@ def login(console: Console, profile_id: str | None) -> None:
     session = requests_session(base_url=profile_data.host)
     code_verifier, code_challenge = pkce.generate_pkce_pair(48)
 
-    device_model = client.authorize_device(session=session, code_challenge=code_challenge)
+    # Resolve real app_client_id before device auth
+    client_id = client.fetch_tenant_config(session=session, host=profile_data.host)
+
+    device_model = client.authorize_device(session=session, code_challenge=code_challenge, client_id=client_id)
     verification_url = urljoin(profile_data.host, device_model.verification_uri_complete)
     console.info(f"Opening browser for authentication: {verification_url}")
     client.open_browser(verification_url)
 
     credentials = client.login_with_device(
-        session=session, device_model=device_model, host=profile_data.host, code_verifier=code_verifier
+        session=session,
+        device_model=device_model,
+        host=profile_data.host,
+        code_verifier=code_verifier,
+        client_id=client_id,
     )
 
     token.cache_token(credentials=credentials, profile_id=profile_id)

menda_cli-0.2.3/tests/auth/oauth2/test_client.py

@@ -0,0 +1,82 @@
+"""Tests for fetch_tenant_config."""
+
+from unittest.mock import MagicMock, patch
+
+import pytest
+
+from menda.auth.exceptions import AuthenticationError
+from menda.auth.oauth2.client import fetch_tenant_config
+
+
+def _mock_response(status_code: int, json_data: dict | None = None, json_raises: bool = False) -> MagicMock:
+    response = MagicMock()
+    response.status_code = status_code
+    if json_raises:
+        response.json.side_effect = ValueError("No JSON")
+    else:
+        response.json.return_value = json_data
+    return response
+
+
+class TestFetchTenantConfig:
+    @patch("menda.auth.oauth2.client.AuthRoutes.config")
+    def test_returns_app_client_id_on_success(self, mock_config: MagicMock) -> None:
+        session = MagicMock()
+        mock_config.return_value = _mock_response(200, {"app_client_id": "abc123", "userpool_id": "us-east-1_xyz"})
+
+        result = fetch_tenant_config(session, "https://acme.cloud.mendaml.com")
+
+        assert result == "abc123"
+        mock_config.assert_called_once_with(session=session, hostname="acme.cloud.mendaml.com")
+
+    @patch("menda.auth.oauth2.client.AuthRoutes.config")
+    def test_raises_on_empty_app_client_id(self, mock_config: MagicMock) -> None:
+        session = MagicMock()
+        mock_config.return_value = _mock_response(200, {"app_client_id": "", "userpool_id": "us-east-1_xyz"})
+
+        with pytest.raises(AuthenticationError, match="missing app_client_id"):
+            fetch_tenant_config(session, "https://acme.cloud.mendaml.com")
+
+    @patch("menda.auth.oauth2.client.AuthRoutes.config")
+    def test_raises_on_missing_app_client_id(self, mock_config: MagicMock) -> None:
+        session = MagicMock()
+        mock_config.return_value = _mock_response(200, {"userpool_id": "us-east-1_xyz"})
+
+        with pytest.raises(AuthenticationError, match="missing app_client_id"):
+            fetch_tenant_config(session, "https://acme.cloud.mendaml.com")
+
+    @patch("menda.auth.oauth2.client.AuthRoutes.config")
+    def test_raises_on_non_json_response(self, mock_config: MagicMock) -> None:
+        session = MagicMock()
+        mock_config.return_value = _mock_response(200, json_raises=True)
+
+        with pytest.raises(AuthenticationError, match="non-JSON response"):
+            fetch_tenant_config(session, "http://localhost:3000")
+
+    @patch("menda.auth.oauth2.client.AuthRoutes.config")
+    def test_raises_on_404(self, mock_config: MagicMock) -> None:
+        session = MagicMock()
+        mock_config.return_value = _mock_response(
+            404, {"detail": "No tenant configuration found for hostname: unknown"}
+        )
+
+        with pytest.raises(AuthenticationError, match="No tenant configuration found"):
+            fetch_tenant_config(session, "https://unknown.mendaml.com")
+
+    @patch("menda.auth.oauth2.client.AuthRoutes.config")
+    def test_raises_on_server_error(self, mock_config: MagicMock) -> None:
+        session = MagicMock()
+        mock_config.return_value = _mock_response(500, {"detail": "Internal Server Error"})
+
+        with pytest.raises(AuthenticationError) as exc_info:
+            fetch_tenant_config(session, "https://acme.cloud.mendaml.com")
+        assert exc_info.value.code == 500
+
+    @patch("menda.auth.oauth2.client.AuthRoutes.config")
+    def test_parses_hostname_from_url(self, mock_config: MagicMock) -> None:
+        session = MagicMock()
+        mock_config.return_value = _mock_response(200, {"app_client_id": "abc123"})
+
+        fetch_tenant_config(session, "https://acme.cloud.mendaml.com:8443/some/path")
+
+        mock_config.assert_called_once_with(session=session, hostname="acme.cloud.mendaml.com")

{menda_cli-0.2.2 → menda_cli-0.2.3}/tests/cli/auth/test_login.py

@@ -43,6 +43,7 @@ class TestLoginCommand:
 
         self.env_patcher.stop()
 
+    @mock.patch("menda.auth.oauth2.client.fetch_tenant_config", return_value="test-app-client-id")
     @mock.patch("menda.auth.oauth2.client.authorize_device")
     @mock.patch("menda.auth.oauth2.client.open_browser")
     @mock.patch("menda.auth.oauth2.client.login_with_device")
@@ -55,6 +56,7 @@ class TestLoginCommand:
         mock_login_with_device: mock.Mock,
         mock_open_browser: mock.Mock,
         mock_authorize_device: mock.Mock,
+        mock_fetch_tenant_config: mock.Mock,
         setup_and_teardown: pytest.FixtureRequest,
     ) -> None:
         """Test successful login flow."""
@@ -93,6 +95,7 @@ class TestLoginCommand:
         mock_cache_token.assert_called_once_with(credentials=credentials, profile_id="test_profile")
         logger.info("All mocks verified successfully")
 
+    @mock.patch("menda.auth.oauth2.client.fetch_tenant_config", return_value="test-app-client-id")
     @mock.patch("menda.auth.oauth2.client.authorize_device")
     @mock.patch("menda.auth.oauth2.client.open_browser")
     @mock.patch("menda.auth.oauth2.client.login_with_device")
@@ -103,6 +106,7 @@ class TestLoginCommand:
         mock_login_with_device: mock.Mock,
         mock_open_browser: mock.Mock,
         mock_authorize_device: mock.Mock,
+        mock_fetch_tenant_config: mock.Mock,
         setup_and_teardown: pytest.FixtureRequest,
     ) -> None:
         """Test login flow with authentication error."""

{menda_cli-0.2.2 → menda_cli-0.2.3}/uv.lock

@@ -415,7 +415,7 @@ wheels = [
 
 [[package]]
 name = "menda-cli"
-version = "0.2.2"
+version = "0.2.3"
 source = { editable = "." }
 dependencies = [
     { name = "click" },