morphy-cli 0.5.0__py3-none-any.whl

morphy_cli/__init__.py

@@ -0,0 +1 @@
+

morphy_cli/__main__.py

@@ -0,0 +1,3 @@
+from .main import main
+
+main()

morphy_cli/auth.py

@@ -0,0 +1,321 @@
+"""Authentication and session management for MORPHY CLI using Supabase Auth and OS keyring."""
+
+import json
+import os
+from pathlib import Path
+import time
+from typing import Any, Optional
+import httpx
+import keyring
+
+CONFIG_DIR = Path.home() / ".morphy"
+CONFIG_FILE = CONFIG_DIR / "config.json"
+FALLBACK_TOKEN_FILE = CONFIG_DIR / ".tokens"
+KEYRING_SERVICE = "morphy-cli"
+
+
+class AuthError(Exception):
+    """Authentication or session error with user-actionable message."""
+    pass
+
+
+class Session:
+    """Holds authenticated session details."""
+
+    def __init__(
+        self,
+        access_token: str,
+        refresh_token: str,
+        user_id: str,
+        email: str,
+        expires_at: float,
+    ):
+        self.access_token = access_token
+        self.refresh_token = refresh_token
+        self.user_id = user_id
+        self.email = email
+        self.expires_at = expires_at
+
+    @property
+    def is_expired(self) -> bool:
+        """Returns True if the access token has expired or is expiring in <= 60s."""
+        return time.time() >= (self.expires_at - 60)
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "access_token": self.access_token,
+            "refresh_token": self.refresh_token,
+            "user_id": self.user_id,
+            "email": self.email,
+            "expires_at": self.expires_at,
+        }
+
+    @classmethod
+    def from_dict(cls, data: dict[str, Any]) -> "Session":
+        return cls(
+            access_token=data["access_token"],
+            refresh_token=data["refresh_token"],
+            user_id=data["user_id"],
+            email=data["email"],
+            expires_at=data["expires_at"],
+        )
+
+
+def load_config() -> tuple[str, str]:
+    """Load Supabase URL and anon key from env vars or ~/.morphy/config.json."""
+    url = os.getenv("MORPHY_SUPABASE_URL")
+    key = os.getenv("MORPHY_SUPABASE_ANON_KEY") or os.getenv("MORPHY_SUPABASE_PUBLIC_KEY")
+
+    if not url or not key:
+        if CONFIG_FILE.is_file():
+            try:
+                data = json.loads(CONFIG_FILE.read_text(encoding="utf-8"))
+                url = url or data.get("supabase_url")
+                key = key or data.get("supabase_anon_key")
+            except Exception:
+                pass
+
+    url = (url or "http://127.0.0.1:54321").rstrip("/")
+    key = key or ""
+    return url, key
+
+
+def save_config(supabase_url: str, supabase_anon_key: str) -> None:
+    """Save Supabase configuration to ~/.morphy/config.json."""
+    CONFIG_DIR.mkdir(parents=True, exist_ok=True)
+    payload = {
+        "supabase_url": supabase_url.rstrip("/"),
+        "supabase_anon_key": supabase_anon_key,
+    }
+    CONFIG_FILE.write_text(json.dumps(payload, indent=2), encoding="utf-8")
+
+
+class AuthManager:
+    """Manages Supabase sessions, token refreshing, and OS credential storage."""
+
+    def __init__(self, supabase_url: Optional[str] = None, supabase_key: Optional[str] = None):
+        cfg_url, cfg_key = load_config()
+        self.supabase_url = (supabase_url or cfg_url).rstrip("/")
+        self.supabase_key = supabase_key if supabase_key is not None else cfg_key
+        self.current_session: Optional[Session] = None
+        self._keyring_key = f"refresh:{self.supabase_url}"
+
+    def _headers(self) -> dict[str, str]:
+        headers = {"apikey": self.supabase_key}
+        if self.current_session and self.current_session.access_token:
+            headers["Authorization"] = f"Bearer {self.current_session.access_token}"
+        return headers
+
+    def _store_refresh_token(self, refresh_token: str, session: Session) -> None:
+        stored = False
+        try:
+            keyring.set_password(KEYRING_SERVICE, self._keyring_key, refresh_token)
+            stored = True
+        except Exception:
+            stored = False
+
+        # Fallback file if keyring fails (e.g. headless CI or container)
+        if not stored:
+            try:
+                CONFIG_DIR.mkdir(parents=True, exist_ok=True)
+                FALLBACK_TOKEN_FILE.write_text(
+                    json.dumps(session.to_dict()),
+                    encoding="utf-8"
+                )
+                try:
+                    os.chmod(FALLBACK_TOKEN_FILE, 0o600)
+                except Exception:
+                    pass
+            except Exception:
+                pass
+
+    def _get_stored_refresh_token(self) -> Optional[str]:
+        try:
+            token = keyring.get_password(KEYRING_SERVICE, self._keyring_key)
+            if token:
+                return token
+        except Exception:
+            pass
+
+        if FALLBACK_TOKEN_FILE.is_file():
+            try:
+                data = json.loads(FALLBACK_TOKEN_FILE.read_text(encoding="utf-8"))
+                return data.get("refresh_token")
+            except Exception:
+                pass
+        return None
+
+    def _clear_stored_tokens(self) -> None:
+        try:
+            keyring.delete_password(KEYRING_SERVICE, self._keyring_key)
+        except Exception:
+            pass
+
+        if FALLBACK_TOKEN_FILE.is_file():
+            try:
+                FALLBACK_TOKEN_FILE.unlink(missing_ok=True)
+            except Exception:
+                pass
+
+    def login(self, email: str, password: str) -> Session:
+        """Authenticate with Supabase GoTrue using email and password."""
+        if not self.supabase_key:
+            raise AuthError(
+                "Supabase Anon Key is not configured. Set MORPHY_SUPABASE_ANON_KEY or run config."
+            )
+
+        endpoint = f"{self.supabase_url}/auth/v1/token?grant_type=password"
+        payload = {"email": email, "password": password}
+
+        try:
+            with httpx.Client(timeout=15.0) as client:
+                res = client.post(endpoint, json=payload, headers={"apikey": self.supabase_key})
+        except httpx.HTTPError as exc:
+            raise AuthError(f"Network error during authentication: {exc}")
+
+        if res.status_code != 200:
+            try:
+                err_data = res.json()
+                detail = err_data.get("msg") or err_data.get("error_description") or res.text
+            except Exception:
+                detail = res.text
+            raise AuthError(f"Login failed ({res.status_code}): {detail}")
+
+        data = res.json()
+        expires_in = data.get("expires_in", 3600)
+        user_info = data.get("user", {})
+
+        session = Session(
+            access_token=data["access_token"],
+            refresh_token=data["refresh_token"],
+            user_id=user_info.get("id", ""),
+            email=user_info.get("email", email),
+            expires_at=time.time() + expires_in,
+        )
+        self.current_session = session
+        self._store_refresh_token(session.refresh_token, session)
+        return session
+
+    def refresh(self) -> Session:
+        """Refresh current session using refresh token."""
+        refresh_token = (
+            self.current_session.refresh_token
+            if self.current_session
+            else self._get_stored_refresh_token()
+        )
+        if not refresh_token:
+            raise AuthError("No active session or refresh token found. Please /login.")
+
+        endpoint = f"{self.supabase_url}/auth/v1/token?grant_type=refresh_token"
+        payload = {"refresh_token": refresh_token}
+
+        try:
+            with httpx.Client(timeout=15.0) as client:
+                res = client.post(endpoint, json=payload, headers={"apikey": self.supabase_key})
+        except httpx.HTTPError as exc:
+            raise AuthError(f"Network error during token refresh: {exc}")
+
+        if res.status_code != 200:
+            self._clear_stored_tokens()
+            self.current_session = None
+            raise AuthError("Session expired or refresh token invalid. Please /login again.")
+
+        data = res.json()
+        expires_in = data.get("expires_in", 3600)
+        user_info = data.get("user", {})
+
+        session = Session(
+            access_token=data["access_token"],
+            refresh_token=data["refresh_token"],
+            user_id=user_info.get("id", self.current_session.user_id if self.current_session else ""),
+            email=user_info.get("email", self.current_session.email if self.current_session else ""),
+            expires_at=time.time() + expires_in,
+        )
+        self.current_session = session
+        self._store_refresh_token(session.refresh_token, session)
+        return session
+
+    def restore_session(self) -> Optional[Session]:
+        """Attempt to restore or refresh a session from saved token."""
+        env_token = os.getenv("MORPHY_ACCESS_TOKEN")
+        if env_token:
+            self.current_session = Session(
+                access_token=env_token,
+                refresh_token="",
+                user_id="",
+                email="",
+                expires_at=time.time() + 86400,
+            )
+            return self.current_session
+
+        refresh_token = self._get_stored_refresh_token()
+        if not refresh_token:
+            return None
+
+        try:
+            return self.refresh()
+        except Exception:
+            return None
+
+    def get_valid_token(self) -> str:
+        """Return a valid access token, refreshing if necessary."""
+        if not self.current_session:
+            restored = self.restore_session()
+            if not restored:
+                env_token = os.getenv("MORPHY_ACCESS_TOKEN")
+                if env_token:
+                    return env_token
+                raise AuthError("Authentication required. Please run /login.")
+
+        if self.current_session.is_expired:
+            self.refresh()
+
+        return self.current_session.access_token
+
+    def logout(self) -> None:
+        """Sign out and invalidate session credentials."""
+        if self.current_session and self.current_session.access_token and self.supabase_key:
+            try:
+                endpoint = f"{self.supabase_url}/auth/v1/logout"
+                with httpx.Client(timeout=8.0) as client:
+                    client.post(
+                        endpoint,
+                        headers={
+                            "apikey": self.supabase_key,
+                            "Authorization": f"Bearer {self.current_session.access_token}",
+                        },
+                    )
+            except Exception:
+                pass
+
+        self._clear_stored_tokens()
+        self.current_session = None
+
+    def status(self) -> dict[str, Any]:
+        """Return current status dictionary."""
+        token = os.getenv("MORPHY_ACCESS_TOKEN")
+        if token and not self.current_session:
+            return {
+                "authenticated": True,
+                "source": "MORPHY_ACCESS_TOKEN environment variable",
+                "email": "injected-environment-session",
+                "supabase_url": self.supabase_url,
+            }
+
+        if not self.current_session:
+            restored = self.restore_session()
+            if not restored:
+                return {
+                    "authenticated": False,
+                    "supabase_url": self.supabase_url,
+                }
+
+        remaining_sec = max(0, int(self.current_session.expires_at - time.time()))
+        return {
+            "authenticated": True,
+            "email": self.current_session.email,
+            "user_id": self.current_session.user_id,
+            "expires_in_seconds": remaining_sec,
+            "supabase_url": self.supabase_url,
+        }
+

morphy_cli/client.py

@@ -0,0 +1,192 @@
+"""Shared HTTP client for the MORPHY engine."""
+
+import os
+from typing import Any, Callable, Optional, Union
+from uuid import UUID
+from urllib.parse import urlsplit
+import httpx
+
+
+class EngineError(Exception):
+    """Error returned by the MORPHY engine with an actionable message."""
+
+    def __init__(self, status_code: int, detail: str):
+        self.status_code = status_code
+        self.detail = detail
+        super().__init__(detail)
+
+
+_STATUS_HINTS = {
+    401: "Sign in again — your session may have expired.",
+    403: "Access denied. Check your database permissions.",
+    409: "An administrator must connect this database first.",
+    413: "The input or result is too large. Narrow your query or CSV.",
+    422: "Validation or generation failed. Check the SQL syntax or permitted schema.",
+    502: "The database is unreachable. Check the connection and credentials.",
+    503: "The engine or a required service is unavailable.",
+}
+
+
+class MorphyClient:
+    """Thin wrapper around httpx for the MORPHY engine API."""
+
+    def __init__(
+        self,
+        base_url: str,
+        database: Optional[Union[UUID, str]] = None,
+        token: Optional[Union[str, Callable[[], str]]] = None,
+    ):
+        self.base_url = base_url.rstrip("/")
+        self.database: Optional[UUID] = UUID(str(database)) if database else None
+        self._token_source = token
+        self._validate_endpoint(self.base_url)
+
+        self._http = httpx.Client(
+            base_url=self.base_url,
+            timeout=195.0,
+            follow_redirects=False,
+        )
+
+    def _validate_endpoint(self, url: str) -> None:
+        if self.database:
+            endpoint = urlsplit(url)
+            if endpoint.scheme != "https" and not (
+                endpoint.scheme == "http"
+                and endpoint.hostname in {"localhost", "127.0.0.1", "::1"}
+            ):
+                raise SystemExit(
+                    "Use HTTPS or a loopback address for authenticated requests."
+                )
+
+    def _get_token(self) -> Optional[str]:
+        if callable(self._token_source):
+            try:
+                return self._token_source()
+            except Exception:
+                return None
+        if self._token_source:
+            return str(self._token_source)
+        return os.getenv("MORPHY_ACCESS_TOKEN")
+
+    def set_token_source(self, source: Union[str, Callable[[], str], None]) -> None:
+        self._token_source = source
+
+    def set_database(self, database: Optional[Union[UUID, str]]) -> None:
+        if database is None:
+            self.database = None
+        else:
+            try:
+                self.database = UUID(str(database))
+            except ValueError:
+                self.database = str(database)  # type: ignore
+        self._validate_endpoint(self.base_url)
+
+    @property
+    def prefix(self) -> str:
+        return f"/api/engine/databases/{self.database}" if self.database else "/api/sample"
+
+    @property
+    def is_live(self) -> bool:
+        return self.database is not None
+
+    def close(self) -> None:
+        self._http.close()
+
+    def _build_headers(self) -> dict[str, str]:
+        headers: dict[str, str] = {}
+        if self.database:
+            token = self._get_token()
+            if not token:
+                raise SystemExit(
+                    "Set MORPHY_ACCESS_TOKEN or run /login to authenticate live database queries."
+                )
+            headers["Authorization"] = f"Bearer {token}"
+        return headers
+
+    def _request(
+        self,
+        method: str,
+        path: str,
+        payload: Optional[Any] = None,
+        content: Optional[bytes] = None,
+        headers: Optional[dict[str, str]] = None,
+    ) -> Any:
+        req_headers = self._build_headers()
+        if headers:
+            req_headers.update(headers)
+
+        try:
+            if method == "GET":
+                response = self._http.get(path, headers=req_headers)
+            elif method == "POST":
+                response = self._http.post(path, json=payload, headers=req_headers)
+            elif method == "PUT":
+                if content is not None:
+                    response = self._http.put(path, content=content, headers=req_headers)
+                else:
+                    response = self._http.put(path, json=payload, headers=req_headers)
+            else:
+                raise ValueError(f"Unsupported method: {method}")
+        except httpx.ConnectError as err:
+            raise EngineError(503, f"Cannot connect to engine at {self.base_url}. Service unavailable.") from err
+        except httpx.TimeoutException as err:
+            raise EngineError(504, "Engine request timed out.") from err
+        except httpx.HTTPError as err:
+            raise EngineError(500, f"HTTP communication failed: {err}") from err
+
+        if response.is_error:
+            try:
+                detail = response.json().get("detail", response.text)
+            except Exception:
+                detail = response.text
+            hint = _STATUS_HINTS.get(response.status_code, "")
+            message = str(detail)
+            if hint and hint not in message:
+                message = f"{message}\n{hint}"
+            raise EngineError(response.status_code, message)
+        return response.json()
+
+    def health(self) -> dict[str, Any]:
+        return self._request("GET", "/api/health")
+
+    def schema(self) -> dict[str, Any]:
+        return self._request("GET", self.prefix + "/schema")
+
+    def generate(self, question: str) -> dict[str, Any]:
+        return self._request("POST", self.prefix + "/generate", payload={"question": question})
+
+    def query(self, sql: str) -> dict[str, Any]:
+        return self._request("POST", self.prefix + "/query", payload={"sql": sql})
+
+    def connect_database(self, uri: str) -> dict[str, Any]:
+        """Save and test PostgreSQL connection URI on the active database."""
+        if not self.database:
+            raise EngineError(400, "Select a database first using /use-db <id>")
+        return self._request(
+            "PUT",
+            f"/api/engine/databases/{self.database}/connection",
+            payload={"uri": uri},
+        )
+
+    def import_csv(self, csv_data: Union[str, bytes]) -> dict[str, Any]:
+        """Import UTF-8 CSV data into the active SQLite/CSV database."""
+        if not self.database:
+            raise EngineError(400, "Select a database first using /use-db <id>")
+        raw_bytes = csv_data.encode("utf-8") if isinstance(csv_data, str) else csv_data
+        if len(raw_bytes) > 1_048_576:
+            raise EngineError(413, "Choose a UTF-8 CSV up to 1 MB.")
+        return self._request(
+            "PUT",
+            f"/api/engine/databases/{self.database}/import",
+            content=raw_bytes,
+            headers={"Content-Type": "text/csv; charset=utf-8"},
+        )
+
+    def render_panel(
+        self, dashboard_id: Union[UUID, str], query_id: Union[UUID, str]
+    ) -> dict[str, Any]:
+        """Render a saved dashboard panel under the caller's RLS policy."""
+        return self._request(
+            "POST",
+            f"/api/engine/dashboards/{dashboard_id}/panels/{query_id}/render",
+        )

morphy_cli/completer.py

@@ -0,0 +1,65 @@
+"""Slash-command completion for the MORPHY interactive shell."""
+
+from prompt_toolkit.completion import Completer, Completion
+
+
+# Commands available in the interactive shell.
+_ALL_COMMANDS = [
+    ("/help", "Show available commands"),
+    ("/schema", "Display the permitted database schema"),
+    ("/examples", "List curated example questions"),
+    ("/ask", "Generate SQL from a natural-language question"),
+    ("/sql", "Execute a read-only SQL query"),
+    ("/login", "Sign in with email and password"),
+    ("/logout", "Sign out and clear saved credentials"),
+    ("/status", "Display authentication, active org and database status"),
+    ("/orgs", "List your organizations"),
+    ("/use-org", "Switch active organization context (/use-org <id>)"),
+    ("/dbs", "List databases in active organization"),
+    ("/use-db", "Switch active target database context (/use-db <id|sample>)"),
+    ("/connect", "Save and verify PostgreSQL connection (/connect <uri>)"),
+    ("/import", "Import UTF-8 CSV into active database (/import <file.csv>)"),
+    ("/profile", "View or claim your user profile"),
+    ("/members", "List members of active organization"),
+    ("/invites", "List pending invitations"),
+    ("/invite", "Invite a user to active organization (/invite <username>)"),
+    ("/accept", "Accept an organization invitation (/accept <id>)"),
+    ("/withdraw", "Withdraw a pending invitation (/withdraw <id>)"),
+    ("/save-query", "Save current or specified SQL query (/save-query <name> [sql])"),
+    ("/queries", "List saved queries"),
+    ("/run-query", "Run a saved query by name (/run-query <name>)"),
+    ("/delete-query", "Delete a saved query (/delete-query <name>)"),
+    ("/dashboards", "List saved dashboards"),
+    ("/dashboard", "Display summary dashboard or render a saved dashboard (/dashboard [render <id>])"),
+    ("/dashboard-create", "Create a saved dashboard (/dashboard-create <title> [shared])"),
+    ("/dashboard-add", "Add a query panel to dashboard (/dashboard-add <dash_id> <query_id>)"),
+    ("/permissions", "Show effective permissions on active database"),
+    ("/perm-revoke", "Revoke permissions for a role or user (/perm-revoke <role|user>)"),
+    ("/export", "Export last query result to CSV file (/export <file.csv>)"),
+    ("/json", "Display last query result formatted as JSON"),
+    ("/exit", "Leave the session"),
+    ("/quit", "Leave the session"),
+]
+
+
+class SlashCompleter(Completer):
+    """Tab-complete slash commands in the MORPHY REPL."""
+
+    def __init__(self, *, is_live: bool = False):
+        self._commands = list(_ALL_COMMANDS)
+
+    def get_completions(self, document, complete_event):
+        text = document.text_before_cursor.lstrip()
+        # Only complete at the beginning of the line and when starting with '/'.
+        if document.cursor_position != len(document.text_before_cursor.lstrip()):
+            return
+        if not text.startswith("/"):
+            return
+        for name, description in self._commands:
+            if name.startswith(text):
+                yield Completion(
+                    name,
+                    start_position=-len(text),
+                    display=name,
+                    display_meta=description,
+                )