menda-cli 0.2.2__tar.gz → 0.2.4__tar.gz

{menda_cli-0.2.2 → menda_cli-0.2.4}/.github/workflows/ci.yml

@@ -10,3 +10,6 @@ on:
 jobs:
   ci:
     uses: mendaml/menda-gh-actions/.github/workflows/python-ci.yml@v1
+    permissions:
+      contents: read
+      id-token: write

{menda_cli-0.2.2 → menda_cli-0.2.4}/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 All notable changes to this project will be documented in this file.
 
+## [0.2.4] - 2026-04-21
+
+### Features
+
+- Menda 622 fix device auth login issues (#18) ([59cb101](https://github.com/mendaml/menda-cli/commit/59cb1015bc7535c1bcaa0134b19d05d1ece7b44e))
+
+## [0.2.3] - 2026-04-14
+
+### Features
+
+- Implement fetch_tenant_config and update device authorization flow (#16) ([9c31568](https://github.com/mendaml/menda-cli/commit/9c315689d07f24996928f7ab641e98de1c598b26))
+
 ## [0.2.2] - 2026-04-06
 
 ### Features

{menda_cli-0.2.2 → menda_cli-0.2.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: menda-cli
-Version: 0.2.2
+Version: 0.2.4
 Summary: A CLI for building, deploying and managing menda data products.
 Author-email: jpm2617 <jose.moreno@mendaml.com>
 Requires-Python: >=3.11

{menda_cli-0.2.2 → menda_cli-0.2.4}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "menda-cli"
-version = "0.2.2"
+version = "0.2.4"
 description = "A CLI for building, deploying and managing menda data products."
 readme = "README.md"
 authors = [

{menda_cli-0.2.2 → menda_cli-0.2.4}/src/menda/auth/api.py

@@ -6,6 +6,7 @@ AUTHORIZATION_PATH = "/auth/device/authorize"
 TOKEN_PATH = "/auth/device/token"  # noqa: S105
 WHOAMI_PATH = "/auth/whoami"
 OAUTH2_TOKEN_PATH = "/auth/oauth2/token"  # noqa: S105
+CONFIG_PATH = "/auth/discovery"
 
 
 class AuthRoutes:
@@ -82,6 +83,11 @@ class AuthRoutes:
             payload["code_verifier"] = code_verifier
         return session.post(url=OAUTH2_TOKEN_PATH, params=payload)
 
+    @classmethod
+    def config(cls, session: requests.Session, hostname: str) -> requests.Response:
+        """Get tenant configuration by hostname."""
+        return session.get(CONFIG_PATH, params={"hostname": hostname})
+
     @classmethod
     def whoami(cls, session: requests.Session, token: str) -> requests.Response:
         """Get current user info."""

menda_cli-0.2.4/src/menda/auth/http.py

@@ -0,0 +1,98 @@
+"""HTTP session factory for auth API calls."""
+
+import typing
+from functools import partial
+from urllib.parse import urlparse
+
+import requests
+
+from menda.cli.exceptions import NetworkError
+
+API_VERSION = "/api/v1"
+
+
+class CustomRequestsSession(requests.Session):
+    """Requests session with custom methods."""
+
+    def delete_with_payload(self, **kwargs: typing.Any) -> requests.Response:  # noqa: ANN401
+        """DELETE with request body support."""
+        return self.request(method="DELETE", **kwargs)
+
+
+def _translate_connection_error(err: requests.exceptions.RequestException, base_url: str) -> NetworkError:
+    """Convert a low-level requests exception into a user-friendly NetworkError."""
+    host = urlparse(base_url).hostname or base_url
+
+    if isinstance(err, requests.exceptions.SSLError):
+        return NetworkError(
+            message=f"TLS/SSL handshake failed when contacting '{host}'.",
+            context=f"network:ssl:{host}",
+            suggestion=(
+                "Check that the host URL in your mendacfg profile is correct "
+                "and that your system clock and CA certificates are up to date."
+            ),
+        )
+
+    if isinstance(err, requests.exceptions.ConnectTimeout):
+        return NetworkError(
+            message=f"Timed out while connecting to '{host}'.",
+            context=f"network:timeout:{host}",
+            suggestion="Check your network connection or try again in a moment.",
+        )
+
+    if isinstance(err, requests.exceptions.ReadTimeout):
+        return NetworkError(
+            message=f"Timed out while waiting for a response from '{host}'.",
+            context=f"network:timeout:{host}",
+            suggestion="The service may be slow or unavailable — please try again.",
+        )
+
+    if isinstance(err, requests.exceptions.ConnectionError):
+        cause = str(err.__cause__) if err.__cause__ else str(err)
+        is_dns = "resolve" in cause.lower() or "name or service" in cause.lower() or "nodename" in cause.lower()
+        if is_dns:
+            return NetworkError(
+                message=f"Could not resolve '{host}'.",
+                context=f"network:dns:{host}",
+                suggestion=(
+                    "Check the 'host' value in your mendacfg profile and confirm you have internet connectivity."
+                ),
+            )
+        return NetworkError(
+            message=f"Could not connect to '{host}'.",
+            context=f"network:connection:{host}",
+            suggestion=("Verify the host is reachable and that the 'host' value in your mendacfg profile is correct."),
+        )
+
+    return NetworkError(
+        message=f"Network error while contacting '{host}': {err}",
+        context=f"network:other:{host}",
+        suggestion="Check your network connection and profile configuration.",
+    )
+
+
+def requests_session(base_url: str) -> CustomRequestsSession:
+    """Create a requests session with a base URL prepended to all requests.
+
+    Connection-layer failures (DNS, TLS, timeouts, refused connections) are
+    translated into NetworkError so users see a concise, actionable message
+    instead of a requests/urllib3 traceback.
+    """
+
+    def new_request(
+        base_url: str,
+        f: typing.Callable,
+        method: str,
+        url: str,
+        *args: typing.Any,  # noqa: ANN401
+        **kwargs: typing.Any,  # noqa: ANN401
+    ) -> requests.Response:
+        try:
+            return f(method, base_url + API_VERSION + url, *args, **kwargs)
+        except requests.exceptions.RequestException as err:
+            raise _translate_connection_error(err, base_url) from err
+
+    base_url = "" if base_url is None else base_url.rstrip("/")
+    s = CustomRequestsSession()
+    s.request = partial(new_request, base_url, s.request)  # ty:ignore[invalid-assignment]
+    return s

{menda_cli-0.2.2 → menda_cli-0.2.4}/src/menda/auth/oauth2/client.py

@@ -13,13 +13,38 @@ from menda.auth.api import AuthRoutes
 from menda.auth.exceptions import AuthenticationError
 
 logger = structlog.get_logger()
-
-CLIENT_ID = "device"
 SCOPE = ["openid"]
 GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code"
 CALLBACK_PATH = "/auth/device/callback"
 
 
+def fetch_tenant_config(session: requests.Session, host: str) -> str:
+    """Fetch app_client_id for the tenant from the config endpoint."""
+    from urllib.parse import urlparse
+
+    hostname = urlparse(host).hostname
+    if not hostname:
+        raise AuthenticationError(detail=f"Invalid host URL: {host}")
+    response = AuthRoutes.config(session=session, hostname=hostname)
+    try:
+        body = response.json()
+    except Exception as err:
+        raise AuthenticationError(
+            code=response.status_code,
+            detail=f"Failed to resolve tenant config for '{hostname}': server returned non-JSON response (status {response.status_code})",
+        ) from err
+    if response.status_code == 200:
+        app_client_id = body.get("app_client_id")
+        if not app_client_id:
+            raise AuthenticationError(
+                code=response.status_code,
+                detail=f"Tenant config for '{hostname}' is missing app_client_id",
+            )
+        return app_client_id
+    detail = body.get("detail", "Failed to resolve tenant config")
+    raise AuthenticationError(code=response.status_code, detail=detail)
+
+
 def poll_for_token(interval: int, expires_in: int, api: typing.Callable[[], requests.Response]) -> requests.Response:
     """Poll an API endpoint at intervals until success or timeout."""
     deadline = time.time() + expires_in
@@ -42,10 +67,10 @@ def is_device_code_in_valid_state(state: str) -> bool:
     return state in ["authorized", "pending"]
 
 
-def authorize_device(session: requests.Session, code_challenge: str) -> models.DeviceAuthResponseModel:
+def authorize_device(session: requests.Session, code_challenge: str, client_id: str) -> models.DeviceAuthResponseModel:
     """Request device authorization."""
     response = AuthRoutes.authorize_device(
-        session=session, client_id=CLIENT_ID, scope=SCOPE, code_challenge=code_challenge, code_challenge_method="S256"
+        session=session, client_id=client_id, scope=SCOPE, code_challenge=code_challenge, code_challenge_method="S256"
     )
     if response and response.status_code == 200:
         return models.DeviceAuthResponseModel(**response.json())
@@ -63,6 +88,7 @@ def login_with_device(
     device_model: models.DeviceAuthResponseModel,
     host: str,
     code_verifier: str,
+    client_id: str,
 ) -> models.CredentialsModel:
     """Complete device flow login."""
     response = poll_for_token(
@@ -70,7 +96,7 @@ def login_with_device(
         expires_in=device_model.expires_in,
         api=lambda: AuthRoutes.token(
             session=session,
-            client_id=CLIENT_ID,
+            client_id=client_id,
             redirect_uri=urljoin(host, CALLBACK_PATH),
             device_code=device_model.device_code,
             grant_type=GRANT_TYPE,

{menda_cli-0.2.2 → menda_cli-0.2.4}/src/menda/auth/task.py

@@ -145,13 +145,20 @@ def login(console: Console, profile_id: str | None) -> None:
     session = requests_session(base_url=profile_data.host)
     code_verifier, code_challenge = pkce.generate_pkce_pair(48)
 
-    device_model = client.authorize_device(session=session, code_challenge=code_challenge)
+    # Resolve real app_client_id before device auth
+    client_id = client.fetch_tenant_config(session=session, host=profile_data.host)
+
+    device_model = client.authorize_device(session=session, code_challenge=code_challenge, client_id=client_id)
     verification_url = urljoin(profile_data.host, device_model.verification_uri_complete)
     console.info(f"Opening browser for authentication: {verification_url}")
     client.open_browser(verification_url)
 
     credentials = client.login_with_device(
-        session=session, device_model=device_model, host=profile_data.host, code_verifier=code_verifier
+        session=session,
+        device_model=device_model,
+        host=profile_data.host,
+        code_verifier=code_verifier,
+        client_id=client_id,
     )
 
     token.cache_token(credentials=credentials, profile_id=profile_id)

{menda_cli-0.2.2 → menda_cli-0.2.4}/src/menda/logging.py

@@ -10,6 +10,7 @@ the CLI package.
 """
 
 import structlog
+from structlog.dev import ConsoleRenderer, RichTracebackFormatter, plain_traceback
 from structlog.processors import ExceptionRenderer
 from structlog.typing import Processor
 
@@ -49,9 +50,14 @@ def configure_logging(log_level: str, json_output: bool = False, show_locals: bo
             structlog.processors.JSONRenderer(),
         ]
     else:
+        # structlog's default rich formatter has show_locals=True, which leaks
+        # internal state (config values, tokens, etc.) into end-user tracebacks.
+        # Opt into a formatter that honors our flag and defaults to off.
+        exception_formatter = RichTracebackFormatter(show_locals=True) if show_locals else plain_traceback
         renderers = [
-            structlog.dev.ConsoleRenderer(
+            ConsoleRenderer(
                 colors=True,
+                exception_formatter=exception_formatter,
                 level_styles={
                     "debug": "\033[36m",
                     "info": "\033[32m",

menda_cli-0.2.4/tests/auth/oauth2/test_client.py

@@ -0,0 +1,82 @@
+"""Tests for fetch_tenant_config."""
+
+from unittest.mock import MagicMock, patch
+
+import pytest
+
+from menda.auth.exceptions import AuthenticationError
+from menda.auth.oauth2.client import fetch_tenant_config
+
+
+def _mock_response(status_code: int, json_data: dict | None = None, json_raises: bool = False) -> MagicMock:
+    response = MagicMock()
+    response.status_code = status_code
+    if json_raises:
+        response.json.side_effect = ValueError("No JSON")
+    else:
+        response.json.return_value = json_data
+    return response
+
+
+class TestFetchTenantConfig:
+    @patch("menda.auth.oauth2.client.AuthRoutes.config")
+    def test_returns_app_client_id_on_success(self, mock_config: MagicMock) -> None:
+        session = MagicMock()
+        mock_config.return_value = _mock_response(200, {"app_client_id": "abc123", "userpool_id": "us-east-1_xyz"})
+
+        result = fetch_tenant_config(session, "https://acme.cloud.mendaml.com")
+
+        assert result == "abc123"
+        mock_config.assert_called_once_with(session=session, hostname="acme.cloud.mendaml.com")
+
+    @patch("menda.auth.oauth2.client.AuthRoutes.config")
+    def test_raises_on_empty_app_client_id(self, mock_config: MagicMock) -> None:
+        session = MagicMock()
+        mock_config.return_value = _mock_response(200, {"app_client_id": "", "userpool_id": "us-east-1_xyz"})
+
+        with pytest.raises(AuthenticationError, match="missing app_client_id"):
+            fetch_tenant_config(session, "https://acme.cloud.mendaml.com")
+
+    @patch("menda.auth.oauth2.client.AuthRoutes.config")
+    def test_raises_on_missing_app_client_id(self, mock_config: MagicMock) -> None:
+        session = MagicMock()
+        mock_config.return_value = _mock_response(200, {"userpool_id": "us-east-1_xyz"})
+
+        with pytest.raises(AuthenticationError, match="missing app_client_id"):
+            fetch_tenant_config(session, "https://acme.cloud.mendaml.com")
+
+    @patch("menda.auth.oauth2.client.AuthRoutes.config")
+    def test_raises_on_non_json_response(self, mock_config: MagicMock) -> None:
+        session = MagicMock()
+        mock_config.return_value = _mock_response(200, json_raises=True)
+
+        with pytest.raises(AuthenticationError, match="non-JSON response"):
+            fetch_tenant_config(session, "http://localhost:3000")
+
+    @patch("menda.auth.oauth2.client.AuthRoutes.config")
+    def test_raises_on_404(self, mock_config: MagicMock) -> None:
+        session = MagicMock()
+        mock_config.return_value = _mock_response(
+            404, {"detail": "No tenant configuration found for hostname: unknown"}
+        )
+
+        with pytest.raises(AuthenticationError, match="No tenant configuration found"):
+            fetch_tenant_config(session, "https://unknown.mendaml.com")
+
+    @patch("menda.auth.oauth2.client.AuthRoutes.config")
+    def test_raises_on_server_error(self, mock_config: MagicMock) -> None:
+        session = MagicMock()
+        mock_config.return_value = _mock_response(500, {"detail": "Internal Server Error"})
+
+        with pytest.raises(AuthenticationError) as exc_info:
+            fetch_tenant_config(session, "https://acme.cloud.mendaml.com")
+        assert exc_info.value.code == 500
+
+    @patch("menda.auth.oauth2.client.AuthRoutes.config")
+    def test_parses_hostname_from_url(self, mock_config: MagicMock) -> None:
+        session = MagicMock()
+        mock_config.return_value = _mock_response(200, {"app_client_id": "abc123"})
+
+        fetch_tenant_config(session, "https://acme.cloud.mendaml.com:8443/some/path")
+
+        mock_config.assert_called_once_with(session=session, hostname="acme.cloud.mendaml.com")

{menda_cli-0.2.2 → menda_cli-0.2.4}/tests/cli/auth/test_login.py

@@ -43,6 +43,7 @@ class TestLoginCommand:
 
         self.env_patcher.stop()
 
+    @mock.patch("menda.auth.oauth2.client.fetch_tenant_config", return_value="test-app-client-id")
     @mock.patch("menda.auth.oauth2.client.authorize_device")
     @mock.patch("menda.auth.oauth2.client.open_browser")
     @mock.patch("menda.auth.oauth2.client.login_with_device")
@@ -55,6 +56,7 @@ class TestLoginCommand:
         mock_login_with_device: mock.Mock,
         mock_open_browser: mock.Mock,
         mock_authorize_device: mock.Mock,
+        mock_fetch_tenant_config: mock.Mock,
         setup_and_teardown: pytest.FixtureRequest,
     ) -> None:
         """Test successful login flow."""
@@ -93,6 +95,7 @@ class TestLoginCommand:
         mock_cache_token.assert_called_once_with(credentials=credentials, profile_id="test_profile")
         logger.info("All mocks verified successfully")
 
+    @mock.patch("menda.auth.oauth2.client.fetch_tenant_config", return_value="test-app-client-id")
     @mock.patch("menda.auth.oauth2.client.authorize_device")
     @mock.patch("menda.auth.oauth2.client.open_browser")
     @mock.patch("menda.auth.oauth2.client.login_with_device")
@@ -103,6 +106,7 @@ class TestLoginCommand:
         mock_login_with_device: mock.Mock,
         mock_open_browser: mock.Mock,
         mock_authorize_device: mock.Mock,
+        mock_fetch_tenant_config: mock.Mock,
         setup_and_teardown: pytest.FixtureRequest,
     ) -> None:
         """Test login flow with authentication error."""

{menda_cli-0.2.2 → menda_cli-0.2.4}/uv.lock

@@ -415,7 +415,7 @@ wheels = [
 
 [[package]]
 name = "menda-cli"
-version = "0.2.2"
+version = "0.2.4"
 source = { editable = "." }
 dependencies = [
     { name = "click" },

menda_cli-0.2.2/src/menda/auth/http.py

@@ -1,35 +0,0 @@
-"""HTTP session factory for auth API calls."""
-
-import typing
-from functools import partial
-
-import requests
-
-API_VERSION = "/api/v1"
-
-
-class CustomRequestsSession(requests.Session):
-    """Requests session with custom methods."""
-
-    def delete_with_payload(self, **kwargs: typing.Any) -> requests.Response:  # noqa: ANN401
-        """DELETE with request body support."""
-        return self.request(method="DELETE", **kwargs)
-
-
-def requests_session(base_url: str) -> CustomRequestsSession:
-    """Create a requests session with a base URL prepended to all requests."""
-
-    def new_request(
-        base_url: str,
-        f: typing.Callable,
-        method: str,
-        url: str,
-        *args: typing.Any,  # noqa: ANN401
-        **kwargs: typing.Any,  # noqa: ANN401
-    ) -> requests.Response:
-        return f(method, base_url + API_VERSION + url, *args, **kwargs)
-
-    base_url = "" if base_url is None else base_url.rstrip("/")
-    s = CustomRequestsSession()
-    s.request = partial(new_request, base_url, s.request)  # ty:ignore[invalid-assignment]
-    return s