minitest-cli 0.16.1__tar.gz → 0.16.2__tar.gz

{minitest_cli-0.16.1 → minitest_cli-0.16.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: minitest-cli
-Version: 0.16.1
+Version: 0.16.2
 Summary: Minitest CLI – command-line interface for the Minitest testing platform
 Project-URL: Homepage, https://minitap.ai/
 Project-URL: Source, https://github.com/minitap-ai/minitest-cli

{minitest_cli-0.16.1 → minitest_cli-0.16.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "minitest-cli"
-version = "0.16.1"
+version = "0.16.2"
 description = "Minitest CLI – command-line interface for the Minitest testing platform"
 readme = "README.md"
 license = "MIT"

{minitest_cli-0.16.1 → minitest_cli-0.16.2}/src/minitest_cli/core/credentials.py

@@ -23,6 +23,7 @@ class Credentials(BaseModel):
     expires_at: float
     user_id: str
     email: str
+    client_id: str | None = None
 
     @property
     def is_expired(self) -> bool:

{minitest_cli-0.16.1 → minitest_cli-0.16.2}/src/minitest_cli/core/oauth.py

@@ -31,19 +31,27 @@ _ASSETS = importlib.resources.files("minitest_cli.assets")
 def refresh_token(settings: Settings, creds: Credentials) -> Credentials | None:
     """Refresh an expired access token, saving new credentials to disk.
 
-    Returns None on a transient failure. Raises SessionRevokedError when the
-    auth server rejects the token (4xx) so callers can clear it and re-login.
+    OAuth sessions must refresh against the same client that created them, so a
+    persisted client_id is required. Returns None on a transient failure. Raises
+    SessionRevokedError when the token can never succeed (missing client_id, or a
+    4xx rejection) so callers can clear it and re-login.
     """
     if not settings.supabase_url or not settings.supabase_publishable_key:
         return None
+    if not creds.client_id:
+        raise SessionRevokedError
 
     supabase_url = settings.supabase_url.rstrip("/")
     try:
         response = httpx.post(
-            f"{supabase_url}/auth/v1/token?grant_type=refresh_token",
-            json={"refresh_token": creds.refresh_token},
+            f"{supabase_url}/auth/v1/oauth/token",
+            data={
+                "grant_type": "refresh_token",
+                "refresh_token": creds.refresh_token,
+                "client_id": creds.client_id,
+            },
             headers={
-                "Content-Type": "application/json",
+                "Content-Type": "application/x-www-form-urlencoded",
                 "apikey": settings.supabase_publishable_key,
             },
             timeout=15.0,
@@ -64,21 +72,11 @@ def refresh_token(settings: Settings, creds: Credentials) -> Credentials | None:
     if not isinstance(data, dict):
         return None
 
-    return parse_and_save_token_response(settings, data)
+    return parse_and_save_token_response(settings, data, creds.client_id)
 
 
 def oauth_pkce_login(settings: Settings) -> Credentials:
-    """Run the full OAuth PKCE login flow via Supabase's OAuth2 server.
-
-    Steps:
-      1. Start local callback server
-      2. Dynamically register an OAuth2 client with Supabase
-      3. Generate PKCE code verifier + challenge
-      4. Open browser to Supabase authorize endpoint (shows hosted sign-in page)
-      5. Wait for callback with authorization code
-      6. Exchange code + verifier for tokens at Supabase token endpoint
-      7. Save and return credentials
-    """
+    """Run the full OAuth PKCE login flow via Supabase's OAuth2 server."""
     supabase_url = settings.supabase_url.rstrip("/")
 
     # PKCE challenge: base64url(sha256(verifier)) without padding
@@ -191,7 +189,7 @@ def oauth_pkce_login(settings: Settings) -> Credentials:
     if not isinstance(response_data, dict):
         auth_error("Token exchange returned unexpected response format.")
 
-    creds = parse_and_save_token_response(settings, response_data)
+    creds = parse_and_save_token_response(settings, response_data, client_id)
     if creds is None:
         auth_error("Failed to parse token response.")
 

{minitest_cli-0.16.1 → minitest_cli-0.16.2}/src/minitest_cli/core/token_exchange.py

@@ -43,8 +43,14 @@ def get_apikey_header(settings: Settings) -> str:
     )
 
 
-def parse_and_save_token_response(settings: Settings, data: dict[str, Any]) -> Credentials | None:
-    """Parse a Supabase token response and persist credentials."""
+def parse_and_save_token_response(
+    settings: Settings, data: dict[str, Any], client_id: str | None = None
+) -> Credentials | None:
+    """Parse a Supabase token response and persist credentials.
+
+    client_id is the OAuth client that owns the session; it must be persisted
+    so refresh_token can re-authenticate against the same client.
+    """
     try:
         user = data.get("user", {})
         if not isinstance(user, dict):
@@ -65,6 +71,7 @@ def parse_and_save_token_response(settings: Settings, data: dict[str, Any]) -> C
             expires_at=time.time() + int(expires_in),
             user_id=user_id,
             email=email,
+            client_id=client_id,
         )
         save_credentials(settings, creds)
         return creds

{minitest_cli-0.16.1 → minitest_cli-0.16.2}/tests/test_auth.py

@@ -45,6 +45,7 @@ def _make_credentials(**overrides):
         "expires_at": time.time() + 3600,  # 1 hour from now
         "user_id": "user-789",
         "email": "test@example.com",
+        "client_id": "client-abc",
     }
     defaults.update(overrides)
     return Credentials(**defaults)
@@ -283,10 +284,19 @@ class TestRefreshToken:
         assert result is not None
         assert result.access_token == "new-access"
         assert result.refresh_token == "new-refresh"
-        # Credentials should be saved to disk
+        assert result.client_id == "client-abc"
         loaded = load_credentials(settings)
         assert loaded is not None
         assert loaded.access_token == "new-access"
+        assert loaded.client_id == "client-abc"
+
+    def test_raises_session_revoked_without_client_id(self, tmp_path):
+        """A session stored before client_id was persisted can never refresh."""
+        settings = _make_settings(tmp_path)
+        legacy_creds = _make_credentials(client_id=None)
+
+        with pytest.raises(SessionRevokedError):
+            refresh_token(settings, legacy_creds)
 
     def test_returns_none_on_transient_network_error(self, tmp_path):
         """A network-level failure is transient — creds are worth keeping and retrying."""
@@ -320,9 +330,10 @@ class TestRefreshToken:
         settings = _make_settings(tmp_path, supabase_publishable_key="")
         assert refresh_token(settings, _make_credentials()) is None
 
-    def test_sends_correct_request(self, tmp_path):
+    def test_refreshes_against_oauth_endpoint_with_client_id(self, tmp_path):
+        """OAuth sessions must refresh at /oauth/token with the owning client_id."""
         settings = _make_settings(tmp_path)
-        old_creds = _make_credentials(refresh_token="my-refresh")
+        old_creds = _make_credentials(refresh_token="my-refresh", client_id="client-xyz")
 
         mock_response = MagicMock()
         mock_response.status_code = 200
@@ -332,16 +343,18 @@ class TestRefreshToken:
             "expires_in": 3600,
             "user": {"id": "u", "email": "e@e.com"},
         }
-        mock_response.raise_for_status = MagicMock()
 
         with patch("minitest_cli.core.oauth.httpx.post", return_value=mock_response) as mock_post:
             refresh_token(settings, old_creds)
 
         mock_post.assert_called_once()
         call_args = mock_post.call_args
-        assert "grant_type=refresh_token" in call_args.args[0]
-        assert call_args.kwargs["json"]["refresh_token"] == "my-refresh"
-        assert call_args.kwargs["headers"]["apikey"] == "test-publishable-key"
+        assert call_args.args[0].endswith("/auth/v1/oauth/token")
+        assert call_args.kwargs["data"] == {
+            "grant_type": "refresh_token",
+            "refresh_token": "my-refresh",
+            "client_id": "client-xyz",
+        }
 
 
 class TestDecodeJwtClaims:

{minitest_cli-0.16.1 → minitest_cli-0.16.2}/uv.lock

@@ -141,7 +141,7 @@ wheels = [
 
 [[package]]
 name = "minitest-cli"
-version = "0.16.1"
+version = "0.16.2"
 source = { editable = "." }
 dependencies = [
     { name = "httpx" },