mozbridge-cli 0.7.0__tar.gz → 0.8.0__tar.gz

{mozbridge_cli-0.7.0 → mozbridge_cli-0.8.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: mozbridge-cli
-Version: 0.7.0
+Version: 0.8.0
 Summary: Command-line client for the Mozbridge deployment platform: SSO login, build, publish, status, and rollback for any project hosted on Mozbridge.
 Project-URL: Homepage, https://mozbridge.com
 Project-URL: Documentation, https://github.com/jessin01/mozbridge/blob/main/cli/docs/commands.md

{mozbridge_cli-0.7.0 → mozbridge_cli-0.8.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "mozbridge-cli"
-version = "0.7.0"
+version = "0.8.0"
 description = "Command-line client for the Mozbridge deployment platform: SSO login, build, publish, status, and rollback for any project hosted on Mozbridge."
 readme = "README.md"
 requires-python = ">=3.10"

{mozbridge_cli-0.7.0 → mozbridge_cli-0.8.0}/src/mozbridge_cli/auth.py

@@ -64,7 +64,11 @@ class DeviceAuthorization:
 def start_device_authorization(client: httpx.Client) -> DeviceAuthorization:
     resp = client.post(
         config.DEVICE_AUTH_URL,
-        data={"client_id": config.LOGTO_CLIENT_ID, "scope": config.DEVICE_SCOPE},
+        data={
+            "client_id": config.LOGTO_CLIENT_ID,
+            "scope": config.DEVICE_SCOPE,
+            "resource": config.LOGTO_RESOURCE,
+        },
     )
     resp.raise_for_status()
     data = resp.json()
@@ -89,6 +93,7 @@ def _poll_once(client: httpx.Client, device_code: str) -> dict | None:
             "client_id": config.LOGTO_CLIENT_ID,
             "grant_type": GRANT_TYPE_DEVICE_CODE,
             "device_code": device_code,
+            "resource": config.LOGTO_RESOURCE,
         },
     )
     if resp.status_code == 200:
@@ -166,6 +171,7 @@ def refresh_access_token(client: httpx.Client, refresh_token: str) -> dict:
             "grant_type": "refresh_token",
             "refresh_token": refresh_token,
             "client_id": config.LOGTO_CLIENT_ID,
+            "resource": config.LOGTO_RESOURCE,
         },
     )
     if resp.status_code == 200:

{mozbridge_cli-0.7.0 → mozbridge_cli-0.8.0}/src/mozbridge_cli/config.py

@@ -24,6 +24,27 @@ from pathlib import Path
 LOGTO_ENDPOINT = os.environ.get("MOZBRIDGE_LOGTO_ENDPOINT", "https://auth.mozbridge.com").rstrip("/")
 LOGTO_CLIENT_ID = os.environ.get("MOZBRIDGE_LOGTO_CLIENT_ID", "7zkurxlp5x98iw217wrhw")
 
+# Resource indicator (RFC 8707) the token request must carry so Logto stamps
+# the issued access token's `aud` claim with something the backend actually
+# accepts. Found live, 2026-09-14, immediately after the client_id fix above:
+# device-flow login succeeded (a real session.json got written) but every
+# subsequent API call 401'd with "Session is no longer valid" — decoding the
+# actual issued access_token showed it was a bare OPAQUE string, not a JWT at
+# all (no dots) — exactly what Logto issues when no `resource` is requested.
+# The backend (`backend/app/features/identity/auth.py`'s `verify_token`)
+# needs a real JWT with an `aud` claim matching its own `LOGTO_RESOURCE` env
+# var to accept a token at all.
+#
+# `https://api.mozbridge.com` (guessed from mcp/mozbridge_mcp/oauth.py's own
+# fallback default) was WRONG — confirmed via a live GET .../api/resources:
+# the real registered resource is named "Mozbridge API" with indicator
+# `https://mozbridge.com` (no `api.` subdomain). Cross-checked directly
+# against production's actual `LOGTO_RESOURCE` env var
+# (`https://mozbridge.com,https://mcp.mozbridge.com/mcp`) — this value is
+# the first of the two, confirmed to be in the backend's own accepted list,
+# not inferred from adjacent code a second time.
+LOGTO_RESOURCE = os.environ.get("MOZBRIDGE_LOGTO_RESOURCE", "https://mozbridge.com")
+
 DEVICE_AUTH_URL = f"{LOGTO_ENDPOINT}/oidc/device/auth"
 TOKEN_URL = f"{LOGTO_ENDPOINT}/oidc/token"
 

{mozbridge_cli-0.7.0 → mozbridge_cli-0.8.0}/tests/test_login.py

@@ -38,6 +38,45 @@ def test_start_device_authorization_uses_server_interval():
     assert result.interval == 7
 
 
+def test_start_device_authorization_sends_resource_indicator():
+    # Regression test: without `resource` in this request, Logto issues a
+    # bare opaque access_token (no dots — not a JWT at all) instead of a
+    # signed JWT with an `aud` claim, and the backend's verify_token 401s
+    # every API call even after a successful login. Found live, 2026-09-14,
+    # by decoding an actual issued access_token and seeing it had zero dots.
+    with respx.mock:
+        route = _device_auth_route()
+        with httpx.Client() as client:
+            auth.start_device_authorization(client)
+
+    sent = route.calls.last.request.content.decode()
+    assert "resource=" in sent
+
+
+def test_poll_once_sends_resource_indicator():
+    with respx.mock:
+        route = respx.post(config.TOKEN_URL).mock(
+            return_value=httpx.Response(200, json={"access_token": "tok", "token_type": "Bearer"})
+        )
+        with httpx.Client() as client:
+            auth._poll_once(client, "devcode-123")
+
+    sent = route.calls.last.request.content.decode()
+    assert "resource=" in sent
+
+
+def test_refresh_access_token_sends_resource_indicator():
+    with respx.mock:
+        route = respx.post(config.TOKEN_URL).mock(
+            return_value=httpx.Response(200, json={"access_token": "tok", "token_type": "Bearer"})
+        )
+        with httpx.Client() as client:
+            auth.refresh_access_token(client, "refresh-abc")
+
+    sent = route.calls.last.request.content.decode()
+    assert "resource=" in sent
+
+
 def test_happy_path_login_pending_then_success():
     """authorization_pending a couple of times, then a successful token response."""
     responses = [