mozbridge-cli 0.1.0__py3-none-any.whl

mozbridge_cli/__init__.py

@@ -0,0 +1,3 @@
+"""Mozbridge CLI — login / whoami / logout against the real Mozbridge platform."""
+
+__version__ = "0.1.0"

mozbridge_cli/__main__.py

@@ -0,0 +1,4 @@
+from .main import app_main
+
+if __name__ == "__main__":
+    app_main()

mozbridge_cli/api.py

@@ -0,0 +1,274 @@
+"""Thin wrappers around the real, already-shipped Mozbridge REST API.
+
+Used by `link`, `build`, and `publish`. No new backend endpoints — every
+function here calls a route that already exists in
+backend/app/features/{identity,projects}/router.py.
+
+Auth note (resolved for this slice): `require_deploy_scope` —
+`backend/app/features/identity/token_scopes.py` — is built from
+`require_token_scopes(...)`, whose check body is:
+
+    def _check(user: User = Depends(get_current_user)) -> None:
+        if not is_service_identity(user):
+            return
+        ...
+
+`is_service_identity` is only true for `mz_`-prefixed ServiceTokens (it
+checks `_token_payload.is_service_token` / the synthetic `svc:system` user).
+A plain human Logto access token — exactly what `mozbridge login` already
+caches — makes `is_service_identity` False, so `require_deploy_scope` is a
+complete no-op for it. The only real gates a human token hits are
+`get_current_org` (needs `X-Organization-Id` + org membership via Permify)
+and `get_valid_project` (project must belong to that org). Both are ordinary
+membership checks, not a service-token requirement. So: yes, the cached
+human session token works against create_source_upload/trigger_build today,
+with no ServiceToken minting needed.
+"""
+
+from __future__ import annotations
+
+import httpx
+
+from . import config
+
+
+class ApiError(Exception):
+    """Raised when the Mozbridge API returns a response we can't recover from."""
+
+
+def _headers(access_token: str, org_id: int | None = None) -> dict[str, str]:
+    headers = {"Authorization": f"Bearer {access_token}"}
+    if org_id is not None:
+        headers["X-Organization-Id"] = str(org_id)
+    return headers
+
+
+def _raise_for_status(resp: httpx.Response, action: str) -> None:
+    if 200 <= resp.status_code < 300:
+        return
+    try:
+        detail = resp.json().get("detail")
+    except ValueError:
+        detail = None
+    detail = detail or resp.text or f"HTTP {resp.status_code}"
+    raise ApiError(f"Could not {action}: {detail}")
+
+
+def list_organizations(client: httpx.Client, access_token: str) -> list[dict]:
+    """GET /api/v1/organizations — orgs the current human session can see."""
+    url = f"{config.API_BASE_URL}{config.ORGANIZATIONS_PATH}"
+    try:
+        resp = client.get(url, headers=_headers(access_token))
+    except httpx.HTTPError as exc:
+        raise ApiError(f"Could not reach Mozbridge API: {exc}") from exc
+    _raise_for_status(resp, "list organizations")
+    return resp.json()
+
+
+def list_projects(client: httpx.Client, access_token: str, org_id: int) -> list[dict]:
+    """GET /api/v1/projects?organization_id=... — projects visible in org_id."""
+    url = f"{config.API_BASE_URL}{config.PROJECTS_PATH}"
+    try:
+        resp = client.get(
+            url,
+            params={"organization_id": org_id},
+            headers=_headers(access_token, org_id),
+        )
+    except httpx.HTTPError as exc:
+        raise ApiError(f"Could not reach Mozbridge API: {exc}") from exc
+    _raise_for_status(resp, "list projects")
+    return resp.json()
+
+
+def create_source_upload(client: httpx.Client, access_token: str, org_id: int, project_id: int) -> dict:
+    """POST /api/v1/projects/{project_id}/source-uploads.
+
+    Returns {upload_id, put_url, expires_at, max_bytes, instructions}.
+    """
+    url = f"{config.API_BASE_URL}{config.PROJECTS_PATH}/{project_id}/source-uploads"
+    try:
+        resp = client.post(url, headers=_headers(access_token, org_id))
+    except httpx.HTTPError as exc:
+        raise ApiError(f"Could not reach Mozbridge API: {exc}") from exc
+    _raise_for_status(resp, "create a source upload session")
+    return resp.json()
+
+
+def put_source_upload_bytes(
+    client: httpx.Client,
+    access_token: str,
+    org_id: int,
+    put_url: str,
+    data: bytes,
+) -> None:
+    """PUT the zip bytes to the put_url returned by create_source_upload.
+
+    Per the endpoint's own `instructions` string: Authorization: Bearer
+    <token> and X-Organization-Id: <org_id> are both required.
+    """
+    try:
+        resp = client.put(
+            put_url,
+            content=data,
+            headers={**_headers(access_token, org_id), "Content-Type": "application/zip"},
+        )
+    except httpx.HTTPError as exc:
+        raise ApiError(f"Could not reach Mozbridge API: {exc}") from exc
+    _raise_for_status(resp, "upload the build source")
+
+
+def get_project(client: httpx.Client, access_token: str, org_id: int, project_id: int) -> dict:
+    """GET /api/v1/projects/{project_id} — schemas.Project (name/slug/status/config/...)."""
+    url = f"{config.API_BASE_URL}{config.PROJECTS_PATH}/{project_id}"
+    try:
+        resp = client.get(url, headers=_headers(access_token, org_id))
+    except httpx.HTTPError as exc:
+        raise ApiError(f"Could not reach Mozbridge API: {exc}") from exc
+    _raise_for_status(resp, "fetch the project")
+    return resp.json()
+
+
+def list_project_deployments(
+    client: httpx.Client, access_token: str, org_id: int, project_id: int
+) -> list[dict]:
+    """GET /api/v1/projects/{project_id}/deployments — list[schemas.ProjectDeployment].
+
+    Backend orders these newest-first (ProjectService.list_project_deployments
+    sorts by deployed_at.desc()), so the caller can just slice the front of
+    the list for "N most recent" without re-sorting client-side.
+    """
+    url = f"{config.API_BASE_URL}{config.PROJECTS_PATH}/{project_id}/deployments"
+    try:
+        resp = client.get(url, headers=_headers(access_token, org_id))
+    except httpx.HTTPError as exc:
+        raise ApiError(f"Could not reach Mozbridge API: {exc}") from exc
+    _raise_for_status(resp, "list deployments")
+    return resp.json()
+
+
+def rollback_project(client: httpx.Client, access_token: str, org_id: int, project_id: int) -> dict:
+    """POST /api/v1/projects/{project_id}/rollback — roll back to the previous deployment.
+
+    No request body is sent: router.py:694 (rollback_project_or_site) takes
+    an optional schemas.SiteRollbackRequest whose own defaults
+    (to="previous", environment="prod") are exactly what an un-targeted
+    `mozbridge rollback` should ask for, and it has no `confirm` field to
+    satisfy — confirmation gating for this route is CLI/MCP-side only.
+    Omitting the body here keeps this the same request an empty-body POST
+    has always been, same pattern as trigger_build's optional overrides in
+    this module.
+
+    Returns {"status": "enqueued", "action": "rollback", "task_id": ...} for
+    app-shaped projects, or a SitePublishResponse-shaped body (task_id,
+    revision, status, preview_url) for site-shaped ones — both carry the
+    operation id under "task_id".
+    """
+    url = f"{config.API_BASE_URL}{config.PROJECTS_PATH}/{project_id}/rollback"
+    try:
+        resp = client.post(url, headers=_headers(access_token, org_id))
+    except httpx.HTTPError as exc:
+        raise ApiError(f"Could not reach Mozbridge API: {exc}") from exc
+    _raise_for_status(resp, "roll back the project")
+    return resp.json()
+
+
+def rollback_project_to(
+    client: httpx.Client, access_token: str, org_id: int, project_id: int, deployment_id: int
+) -> dict:
+    """POST /api/v1/projects/{project_id}/rollback/{deployment_id} — roll back to one specific deployment.
+
+    router.py:2964 (rollback_to_specific) takes only the deployment_id path
+    param — no request body, no `confirm` field server-side either.
+
+    Returns {"status": "enqueued", "action": "rollback", "target_task": ...}
+    — note the operation id key here is "target_task", not "task_id" like
+    every other trigger-an-operation response in this module.
+    """
+    url = f"{config.API_BASE_URL}{config.PROJECTS_PATH}/{project_id}/rollback/{deployment_id}"
+    try:
+        resp = client.post(url, headers=_headers(access_token, org_id))
+    except httpx.HTTPError as exc:
+        raise ApiError(f"Could not reach Mozbridge API: {exc}") from exc
+    _raise_for_status(resp, "roll back the project")
+    return resp.json()
+
+
+def trigger_build(
+    client: httpx.Client,
+    access_token: str,
+    org_id: int,
+    project_id: int,
+    upload_id: str,
+    *,
+    image_name: str | None = None,
+    context_path: str | None = None,
+    dockerfile_path: str | None = None,
+) -> dict:
+    """POST /api/v1/projects/{project_id}/build with source_type='upload'.
+
+    image_name/context_path/dockerfile_path are optional per-call
+    overrides — backend/app/features/projects/schemas.py:BuildRequest and
+    BuildService._trigger_build_from_upload already accept all three
+    independently, no backend changes needed. Omitted fields are left out
+    of the request body entirely (rather than sent as explicit nulls) so
+    the backend's own defaults apply unchanged — this keeps the
+    single-component call byte-for-byte the same request as before these
+    kwargs existed.
+
+    Returns {"status": "enqueued", "action": "build", "task_id": ...}.
+    """
+    payload: dict = {"source_type": "upload", "upload_id": upload_id}
+    if image_name is not None:
+        payload["image_name"] = image_name
+    if context_path is not None:
+        payload["context_path"] = context_path
+    if dockerfile_path is not None:
+        payload["dockerfile_path"] = dockerfile_path
+    url = f"{config.API_BASE_URL}{config.PROJECTS_PATH}/{project_id}/build"
+    try:
+        resp = client.post(
+            url,
+            json=payload,
+            headers=_headers(access_token, org_id),
+        )
+    except httpx.HTTPError as exc:
+        raise ApiError(f"Could not reach Mozbridge API: {exc}") from exc
+    _raise_for_status(resp, "trigger the build")
+    return resp.json()
+
+
+def trigger_prebuilt_build(
+    client: httpx.Client,
+    access_token: str,
+    org_id: int,
+    project_id: int,
+    image_name: str,
+    image_digest: str,
+) -> dict:
+    """POST /api/v1/projects/{project_id}/build with source_type='prebuilt'.
+
+    Used by `mozbridge publish --local`: the image was already built and
+    pushed by the CLI itself (see local_build.py), so this call carries no
+    upload_id — only the image_name/image_digest for the backend to verify
+    against the real registry and register
+    (BuildService._trigger_build_from_prebuilt). Uses the caller's regular
+    LOGIN session access_token, exactly like `trigger_build` above — never
+    the separate MOZBRIDGE_BUILD_TOKEN used only for
+    runtime_secrets.fetch_runtime_secrets.
+
+    Returns {"status": "enqueued", "action": "build", "task_id": ...} same
+    shape as trigger_build, though task_id is always null here — a prebuilt
+    registration has no Celery task to dispatch, it's already done.
+    """
+    payload = {"source_type": "prebuilt", "image_name": image_name, "image_digest": image_digest}
+    url = f"{config.API_BASE_URL}{config.PROJECTS_PATH}/{project_id}/build"
+    try:
+        resp = client.post(
+            url,
+            json=payload,
+            headers=_headers(access_token, org_id),
+        )
+    except httpx.HTTPError as exc:
+        raise ApiError(f"Could not reach Mozbridge API: {exc}") from exc
+    _raise_for_status(resp, "register the prebuilt image")
+    return resp.json()

mozbridge_cli/auth.py

@@ -0,0 +1,179 @@
+"""RFC 8628 OAuth 2.0 Device Authorization Grant against Logto.
+
+Endpoints and behavior confirmed against Logto's own docs / RFC 8628:
+
+  POST {LOGTO_ENDPOINT}/oidc/device/auth
+    body: client_id=<id>&scope=openid offline_access profile
+    -> device_code, user_code, verification_uri, verification_uri_complete,
+       expires_in, interval (default 5s if absent)
+
+  POST {LOGTO_ENDPOINT}/oidc/token
+    body: client_id=<id>
+          &grant_type=urn:ietf:params:oauth:grant-type:device_code
+          &device_code=<code>
+    -> access_token, id_token, refresh_token, token_type, expires_in, scope
+
+Polling errors (standard OAuth device-flow codes):
+  authorization_pending -> keep polling at the current interval
+  slow_down              -> increase the interval and keep polling
+  expired_token          -> give up, tell the user to re-run login
+  access_denied          -> user declined, give up
+"""
+
+from __future__ import annotations
+
+import time
+from collections.abc import Callable
+from dataclasses import dataclass
+
+import httpx
+
+from . import config
+
+GRANT_TYPE_DEVICE_CODE = "urn:ietf:params:oauth:grant-type:device_code"
+DEFAULT_POLL_INTERVAL = 5
+SLOW_DOWN_INCREMENT = 5
+
+
+class DeviceLoginError(Exception):
+    """Raised when the device flow cannot succeed and the user must re-run login."""
+
+
+class AccessDenied(DeviceLoginError):
+    pass
+
+
+class ExpiredToken(DeviceLoginError):
+    pass
+
+
+class RefreshError(Exception):
+    """Raised when a refresh_token exchange fails — session is fully expired."""
+
+
+@dataclass
+class DeviceAuthorization:
+    device_code: str
+    user_code: str
+    verification_uri: str
+    verification_uri_complete: str | None
+    expires_in: int
+    interval: int
+
+
+def start_device_authorization(client: httpx.Client) -> DeviceAuthorization:
+    resp = client.post(
+        config.DEVICE_AUTH_URL,
+        data={"client_id": config.LOGTO_CLIENT_ID, "scope": config.DEVICE_SCOPE},
+    )
+    resp.raise_for_status()
+    data = resp.json()
+    return DeviceAuthorization(
+        device_code=data["device_code"],
+        user_code=data["user_code"],
+        verification_uri=data["verification_uri"],
+        verification_uri_complete=data.get("verification_uri_complete"),
+        expires_in=int(data.get("expires_in", 600)),
+        interval=int(data.get("interval") or DEFAULT_POLL_INTERVAL),
+    )
+
+
+def _poll_once(client: httpx.Client, device_code: str) -> dict | None:
+    """One poll of the token endpoint. Returns the token response on success,
+    None to keep polling (caller decides how long to wait), or raises on a
+    terminal error.
+    """
+    resp = client.post(
+        config.TOKEN_URL,
+        data={
+            "client_id": config.LOGTO_CLIENT_ID,
+            "grant_type": GRANT_TYPE_DEVICE_CODE,
+            "device_code": device_code,
+        },
+    )
+    if resp.status_code == 200:
+        return resp.json()
+
+    try:
+        body = resp.json()
+    except ValueError:
+        resp.raise_for_status()
+        raise DeviceLoginError(f"Unexpected response from token endpoint: {resp.status_code}")
+
+    error = body.get("error")
+    if error == "authorization_pending":
+        return None
+    if error == "slow_down":
+        raise _SlowDown()
+    if error == "expired_token":
+        raise ExpiredToken("The login request expired. Run `mozbridge login` again.")
+    if error == "access_denied":
+        raise AccessDenied("Login was declined.")
+
+    # Any other error is treated as terminal — surface it plainly.
+    detail = body.get("error_description") or error or f"HTTP {resp.status_code}"
+    raise DeviceLoginError(f"Login failed: {detail}")
+
+
+class _SlowDown(Exception):
+    """Internal signal: increase the poll interval and keep polling."""
+
+
+def poll_for_token(
+    client: httpx.Client,
+    authorization: DeviceAuthorization,
+    *,
+    sleep: Callable[[float], None] | None = None,
+    now: Callable[[], float] | None = None,
+) -> dict:
+    """Poll the token endpoint per RFC 8628 until success or a terminal error.
+
+    Raises ExpiredToken, AccessDenied, or DeviceLoginError on failure.
+
+    `sleep`/`now` are resolved from the `time` module at call time (rather
+    than bound as default-argument values) so tests can monkeypatch
+    `time.sleep` / `time.time` globally instead of having to pass fakes
+    through every caller, including the CLI's own `login` command.
+    """
+    do_sleep = sleep or time.sleep
+    do_now = now or time.time
+
+    interval = authorization.interval or DEFAULT_POLL_INTERVAL
+    deadline = do_now() + authorization.expires_in
+
+    while True:
+        if do_now() >= deadline:
+            raise ExpiredToken("The login request expired. Run `mozbridge login` again.")
+
+        do_sleep(interval)
+
+        try:
+            result = _poll_once(client, authorization.device_code)
+        except _SlowDown:
+            interval += SLOW_DOWN_INCREMENT
+            continue
+
+        if result is not None:
+            return result
+        # authorization_pending: loop and poll again after `interval`.
+
+
+def refresh_access_token(client: httpx.Client, refresh_token: str) -> dict:
+    """Exchange a refresh_token for a new token set. Raises RefreshError on failure."""
+    resp = client.post(
+        config.TOKEN_URL,
+        data={
+            "grant_type": "refresh_token",
+            "refresh_token": refresh_token,
+            "client_id": config.LOGTO_CLIENT_ID,
+        },
+    )
+    if resp.status_code == 200:
+        return resp.json()
+
+    try:
+        body = resp.json()
+        detail = body.get("error_description") or body.get("error") or f"HTTP {resp.status_code}"
+    except ValueError:
+        detail = f"HTTP {resp.status_code}"
+    raise RefreshError(f"Session refresh failed: {detail}")

mozbridge_cli/build.py

@@ -0,0 +1,108 @@
+"""Zip the current directory into a build artifact (`mozbridge build`).
+
+This is a dry-run-adjacent primitive: it produces the zip a `publish` would
+upload, without uploading it, so a later `mozbridge diff`/dry-run command
+can build on it. It does not talk to the network.
+"""
+
+from __future__ import annotations
+
+import fnmatch
+import os
+import tempfile
+import zipfile
+from dataclasses import dataclass
+from pathlib import Path
+
+# Always excluded, regardless of what .gitignore says.
+DEFAULT_IGNORE_DIRS = {
+    ".git",
+    ".mozbridge",
+    "__pycache__",
+    "node_modules",
+    ".venv",
+    "venv",
+    ".pytest_cache",
+    ".mypy_cache",
+    ".ruff_cache",
+    "dist",
+    "build",
+    ".next",
+    ".turbo",
+}
+DEFAULT_IGNORE_FILE_PATTERNS = (
+    "*.pyc",
+    "*.pyo",
+    ".DS_Store",
+)
+
+
+@dataclass
+class BuildResult:
+    zip_path: Path
+    size_bytes: int
+    file_count: int
+
+
+def _load_gitignore_patterns(cwd: Path) -> list[str]:
+    """Best-effort read of `cwd`'s own .gitignore, one glob pattern per line.
+
+    This is a simple glob matcher, not a full git-compatible parser (no
+    negation, no anchoring semantics) — good enough to keep obvious noise
+    (build output, coverage files, editor droppings) out of the zip.
+    """
+    gitignore = cwd / ".gitignore"
+    if not gitignore.exists():
+        return []
+    try:
+        lines = gitignore.read_text().splitlines()
+    except OSError:
+        return []
+    return [line.strip() for line in lines if line.strip() and not line.strip().startswith("#")]
+
+
+def _matches_gitignore(rel_path: str, name: str, patterns: list[str]) -> bool:
+    for pattern in patterns:
+        p = pattern.rstrip("/")
+        if fnmatch.fnmatch(name, p) or fnmatch.fnmatch(rel_path, p):
+            return True
+    return False
+
+
+def build_zip(cwd: Path, *, dest: Path | None = None) -> BuildResult:
+    """Zip `cwd` into `dest` (a fresh temp file if not given).
+
+    Excludes DEFAULT_IGNORE_DIRS/DEFAULT_IGNORE_FILE_PATTERNS unconditionally,
+    plus anything `cwd`'s own .gitignore matches, best effort. The caller
+    owns cleanup of the returned zip_path.
+    """
+    if dest is None:
+        fd, tmp_name = tempfile.mkstemp(prefix="mozbridge-build-", suffix=".zip")
+        os.close(fd)
+        dest = Path(tmp_name)
+
+    gitignore_patterns = _load_gitignore_patterns(cwd)
+    file_count = 0
+
+    with zipfile.ZipFile(dest, "w", zipfile.ZIP_DEFLATED) as zf:
+        for root, dirs, files in os.walk(cwd):
+            root_path = Path(root)
+            dirs[:] = [
+                d
+                for d in dirs
+                if d not in DEFAULT_IGNORE_DIRS
+                and not _matches_gitignore(str((root_path / d).relative_to(cwd)), d, gitignore_patterns)
+            ]
+            for name in files:
+                file_path = root_path / name
+                if file_path == dest:
+                    continue
+                if any(fnmatch.fnmatch(name, pat) for pat in DEFAULT_IGNORE_FILE_PATTERNS):
+                    continue
+                rel_str = str(file_path.relative_to(cwd))
+                if _matches_gitignore(rel_str, name, gitignore_patterns):
+                    continue
+                zf.write(file_path, arcname=rel_str)
+                file_count += 1
+
+    return BuildResult(zip_path=dest, size_bytes=dest.stat().st_size, file_count=file_count)