nexusquant-cli 0.4.0__tar.gz → 0.5.0__tar.gz

nexusquant_cli-0.4.0/README.md → nexusquant_cli-0.5.0/PKG-INFO

@@ -1,3 +1,17 @@
+Metadata-Version: 2.5
+Name: nexusquant-cli
+Version: 0.5.0
+Summary: NexusQuant CLI for users, strategy providers and admins
+Requires-Python: >=3.10
+Requires-Dist: httpx>=0.27
+Requires-Dist: nexusquant-sdk>=0.2
+Requires-Dist: platformdirs>=4.2
+Requires-Dist: rich>=13.7
+Requires-Dist: typer>=0.12
+Provides-Extra: dev
+Requires-Dist: pytest>=8; extra == 'dev'
+Description-Content-Type: text/markdown
+
 # nexusquant-cli
 
 Command line tool for NexusQuant investors, strategy providers and admins.
@@ -22,8 +36,15 @@ pip install nexusquant-cli
 ```bash
 nexus-cli auth login          # browser login; one login covers every role
 nexus-cli auth whoami         # account, userType, Wall Pro tier, usable roles
+nexus-cli auth login --device # no local browser (server, SSH): approve a link + code from any browser
 ```
 
+`--device` gives you a **Nexus AI token** instead of a Cognito login:
+- It works for investor commands only; provider and admin commands are refused by the server.
+- It is valid for 90 days and can be revoked at any time.
+- `auth logout` revokes it on the server.
+- The same token kind is what the Nexus AI Discord bot uses.
+
 The role is not picked at login — it is the account's `custom:userType` (or the `admin` Cognito group), and the server checks it on every call. `whoami` reads it from the local token; on a 403 the CLI prints which account type is logged in.
 
 Every read takes `--json` for scripting; the default output is a table.

nexusquant_cli-0.4.0/PKG-INFO → nexusquant_cli-0.5.0/README.md

@@ -1,17 +1,3 @@
-Metadata-Version: 2.5
-Name: nexusquant-cli
-Version: 0.4.0
-Summary: NexusQuant CLI for users, strategy providers and admins
-Requires-Python: >=3.10
-Requires-Dist: httpx>=0.27
-Requires-Dist: nexusquant-sdk>=0.2
-Requires-Dist: platformdirs>=4.2
-Requires-Dist: rich>=13.7
-Requires-Dist: typer>=0.12
-Provides-Extra: dev
-Requires-Dist: pytest>=8; extra == 'dev'
-Description-Content-Type: text/markdown
-
 # nexusquant-cli
 
 Command line tool for NexusQuant investors, strategy providers and admins.
@@ -36,8 +22,15 @@ pip install nexusquant-cli
 ```bash
 nexus-cli auth login          # browser login; one login covers every role
 nexus-cli auth whoami         # account, userType, Wall Pro tier, usable roles
+nexus-cli auth login --device # no local browser (server, SSH): approve a link + code from any browser
 ```
 
+`--device` gives you a **Nexus AI token** instead of a Cognito login:
+- It works for investor commands only; provider and admin commands are refused by the server.
+- It is valid for 90 days and can be revoked at any time.
+- `auth logout` revokes it on the server.
+- The same token kind is what the Nexus AI Discord bot uses.
+
 The role is not picked at login — it is the account's `custom:userType` (or the `admin` Cognito group), and the server checks it on every call. `whoami` reads it from the local token; on a 403 the CLI prints which account type is logged in.
 
 Every read takes `--json` for scripting; the default output is a table.

nexusquant_cli-0.5.0/nexusquant_cli/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.5.0"

{nexusquant_cli-0.4.0 → nexusquant_cli-0.5.0}/nexusquant_cli/api_client.py

@@ -6,7 +6,7 @@ from typing import Any
 import httpx
 
 from nexusquant_cli.auth_pkce import ensure_fresh_id_token
-from nexusquant_cli.config import api_base_url, token_override
+from nexusquant_cli.config import api_base_url, stored_nexus_ai_token, token_override
 
 
 class ApiError(RuntimeError):
@@ -20,7 +20,7 @@ class ApiError(RuntimeError):
 
 
 def _headers(*, force_refresh: bool = False) -> dict[str, str]:
-    token = token_override() or ensure_fresh_id_token(force_refresh=force_refresh)
+    token = token_override() or stored_nexus_ai_token() or ensure_fresh_id_token(force_refresh=force_refresh)
     return {
         "Authorization": f"Bearer {token}",
         "Accept": "application/json",
@@ -58,7 +58,8 @@ def request(
         kwargs["json"] = body
     with httpx.Client(timeout=timeout) as client:
         response = client.request(method, url, headers=_headers(), **kwargs)
-        if _is_stale_tier_403(response) and token_override() is None:
+        # Only a Cognito login can be refreshed; a Nexus AI token's tier is checked live by the server.
+        if _is_stale_tier_403(response) and token_override() is None and stored_nexus_ai_token() is None:
             response = client.request(
                 method, url, headers=_headers(force_refresh=True), **kwargs
             )
@@ -68,6 +69,21 @@ def request(
     return response.json()
 
 
+def public_post(path: str, body: Any, *, timeout: float = 30.0) -> tuple[int, Any]:
+    """POST without any credentials (device login). Returns (status, json) instead of raising."""
+    with httpx.Client(timeout=timeout) as client:
+        response = client.post(f"{api_base_url()}{path}", json=body, headers={"Accept": "application/json"})
+    try:
+        return response.status_code, response.json()
+    except json.JSONDecodeError:
+        return response.status_code, {"error": response.text[:200]}
+
+
+def revoke_current_token() -> Any:
+    """DELETE /nexus-ai/tokens/current/ — revoke the Nexus AI token this CLI is using."""
+    return request("DELETE", "/nexus-ai/tokens/current/")
+
+
 def get_json(
     path: str, *, params: dict[str, Any] | None = None, timeout: float = 60.0
 ) -> Any:

{nexusquant_cli-0.4.0 → nexusquant_cli-0.5.0}/nexusquant_cli/config.py

@@ -67,6 +67,13 @@ def token_override() -> str | None:
     return _TOKEN_OVERRIDE
 
 
+def stored_nexus_ai_token() -> str | None:
+    """A Nexus AI token saved by `auth login --device` (investor commands only)."""
+    creds = load_credentials() or {}
+    tok = creds.get("nexus_ai_token")
+    return str(tok) if tok and not creds.get("id_token") else None
+
+
 def load_credentials() -> dict[str, Any] | None:
     if _TOKEN_OVERRIDE is not None:
         return {"id_token": _TOKEN_OVERRIDE}

{nexusquant_cli-0.4.0 → nexusquant_cli-0.5.0}/nexusquant_cli/identity.py

@@ -21,6 +21,10 @@ def _decode_segment(segment: str) -> dict[str, Any]:
 
 def token_claims() -> dict[str, Any] | None:
     creds = load_credentials()
+    if creds and creds.get("nexus_ai_token") and not creds.get("id_token"):
+        # Device login: not a JWT. Investor-only by construction; tier is checked live by the server.
+        return {"email": creds.get("email"), "sub": creds.get("sub"), "nexus_ai_token": True,
+                "nexus_ai_expires_at": creds.get("expires_at")}
     token = (creds or {}).get("id_token")
     if not token:
         return None
@@ -43,7 +47,9 @@ def user_type(claims: dict[str, Any] | None) -> str:
 
 def roles_for(claims: dict[str, Any] | None) -> list[str]:
     """Role groups this login can use. Mirrors the server: admin passes provider
-    checks too; every login is an investor."""
+    checks too; every login is an investor. A Nexus AI token is investor-only."""
+    if (claims or {}).get("nexus_ai_token"):
+        return ["investor"]
     t = user_type(claims)
     if t == "admin":
         return ["admin", "provider", "investor"]

nexusquant_cli-0.5.0/nexusquant_cli/roles/auth.py

@@ -0,0 +1,157 @@
+"""`nexus-cli auth …` — one login for every role.
+
+The role is not chosen at login: it is ``custom:userType`` on the account, and the
+server checks it per request. ``whoami`` shows which role groups apply.
+"""
+
+from __future__ import annotations
+
+import time
+
+import typer
+from rich.console import Console
+
+from nexusquant_cli.auth_pkce import ensure_fresh_id_token, login_and_save
+from nexusquant_cli.commands._util import fail
+from nexusquant_cli.config import CREDENTIALS_PATH, clear_credentials, load_credentials
+from nexusquant_cli.identity import has_wall_pro, roles_for, token_claims, user_type
+
+console = Console()
+
+auth_app = typer.Typer(
+    help="Login / logout. One login covers every role; the account's userType decides "
+    "which of admin / provider / investor commands the server accepts.",
+    no_args_is_help=True,
+)
+
+
+@auth_app.command(
+    "login",
+    help="Log in. Default: open the browser on this machine (Cognito). --device: show a link and code to "
+    "approve from any browser (for servers / no local browser); gets a Nexus AI token that works for "
+    "investor commands only, valid 90 days.",
+)
+def login(
+    device: bool = typer.Option(False, "--device", help="Device login: approve in any browser."),
+    label: str = typer.Option("", "--label", help="Name shown when you approve, e.g. this machine's name."),
+) -> None:
+    if device:
+        _device_login(label)
+        return
+    try:
+        login_and_save()
+    except Exception as e:  # noqa: BLE001
+        fail(console, e)
+    console.print("[green]Logged in.[/green]")
+    whoami(as_json=False)
+
+
+def _device_login(label: str) -> None:
+    import socket
+
+    from nexusquant_cli import api_client
+    from nexusquant_cli.config import save_credentials
+
+    code, body = api_client.public_post("/nexus-ai/device/start/", {"client": "cli", "label": label or socket.gethostname()})
+    if code != 200:
+        fail(console, RuntimeError(f"HTTP {code}: {body}"))
+    d = body.get("data") or {}
+    console.print(f"Open [bold]{d.get('verification_uri')}[/bold]")
+    console.print(f"and approve code [bold cyan]{d.get('user_code')}[/bold cyan] (expires in {int(d.get('expires_in', 600)) // 60} min).")
+    deadline = time.monotonic() + float(d.get("expires_in") or 600)
+    interval = max(2.0, float(d.get("interval") or 5))
+    with console.status("Waiting for approval…"):
+        while time.monotonic() < deadline:
+            time.sleep(interval)
+            code, body = api_client.public_post("/nexus-ai/device/token/", {"device_code": d.get("device_code")})
+            err = (body or {}).get("error_code")
+            if code == 200:
+                data = body.get("data") or {}
+                save_credentials({
+                    "nexus_ai_token": data["access_token"],
+                    "expires_at": data.get("expires_at"),
+                    "sub": (data.get("user") or {}).get("sub"),
+                    "email": (data.get("user") or {}).get("email"),
+                    "saved_at": time.time(),
+                })
+                console.print("[green]Logged in with a Nexus AI token[/green] (investor commands only).")
+                whoami(as_json=False)
+                return
+            if err != "AUTHORIZATION_PENDING":
+                fail(console, RuntimeError(f"{err or code}: {(body or {}).get('error')}"))
+    fail(console, RuntimeError("Timed out waiting for approval. Run `nexus-cli auth login --device` again."))
+
+
+@auth_app.command("logout", help="Delete locally saved tokens (a Nexus AI token is also revoked on the server).")
+def logout() -> None:
+    creds = load_credentials() or {}
+    if creds.get("nexus_ai_token") and not creds.get("id_token"):
+        from nexusquant_cli import api_client
+
+        try:
+            api_client.revoke_current_token()
+            console.print("[dim]Nexus AI token revoked on the server.[/dim]")
+        except Exception as e:  # noqa: BLE001 — still clear locally
+            console.print(f"[yellow]Could not revoke on the server ({e}); clearing locally anyway.[/yellow]")
+    clear_credentials()
+    console.print("[green]Logged out (local tokens removed).[/green]")
+
+
+@auth_app.command("refresh", help="Force-refresh the ID token (e.g. right after a Wall Pro upgrade).")
+def refresh() -> None:
+    try:
+        ensure_fresh_id_token(force_refresh=True)
+    except Exception as e:  # noqa: BLE001
+        fail(console, e)
+    console.print("[green]Token refreshed.[/green]")
+
+
+@auth_app.command("status", help="Whether tokens are saved on this machine (no network call).")
+def status() -> None:
+    creds = load_credentials()
+    if creds and creds.get("id_token"):
+        console.print(f"[green]Logged in.[/green] Credentials: {CREDENTIALS_PATH}")
+    else:
+        console.print("[yellow]Not logged in. Run: nexus-cli auth login[/yellow]")
+        raise typer.Exit(1)
+
+
+@auth_app.command(
+    "whoami",
+    help="Show the logged-in account, its userType, Wall Pro tier, and usable role groups. "
+    "Read from the local token; the server remains the authority.",
+)
+def whoami(
+    as_json: bool = typer.Option(False, "--json", help="Print raw claims subset as JSON."),
+) -> None:
+    claims = token_claims()
+    if claims is None:
+        console.print("[yellow]Not logged in. Run: nexus-cli auth login[/yellow]")
+        raise typer.Exit(1)
+    exp = claims.get("exp")
+    if claims.get("nexus_ai_token"):
+        info = {"email": claims.get("email"), "login": "nexus_ai_token", "roles": ["investor"],
+                "expires_at": claims.get("nexus_ai_expires_at")}
+        if as_json:
+            console.print_json(data=info)
+            return
+        console.print(f"[bold]{info['email']}[/bold]")
+        console.print("login      Nexus AI token (device login) — investor commands only")
+        console.print(f"expires    {info['expires_at']}")
+        return
+    info = {
+        "email": claims.get("email"),
+        "user_type": user_type(claims),
+        "wall_pro": has_wall_pro(claims),
+        "roles": roles_for(claims),
+        "token_expires_in_s": int(exp - time.time()) if isinstance(exp, (int, float)) else None,
+    }
+    if as_json:
+        console.print_json(data=info)
+        return
+    console.print(f"[bold]{info['email']}[/bold]")
+    console.print(f"userType   {info['user_type']}")
+    console.print(f"Wall Pro   {'[green]yes[/green]' if info['wall_pro'] else '[yellow]no[/yellow]'}")
+    console.print(f"roles      {' / '.join(info['roles'])}")
+    if info["token_expires_in_s"] is not None and info["token_expires_in_s"] < 0:
+        console.print("[dim]ID token expired; it is refreshed automatically on the next call.[/dim]")

{nexusquant_cli-0.4.0 → nexusquant_cli-0.5.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "nexusquant-cli"
-version = "0.4.0"
+version = "0.5.0"
 description = "NexusQuant CLI for users, strategy providers and admins"
 readme = "README.md"
 requires-python = ">=3.10"

{nexusquant_cli-0.4.0 → nexusquant_cli-0.5.0}/tests/test_nexus_cli.py

@@ -641,3 +641,73 @@ def test_embedded_broker_gate(argv, confirmed, allowed) -> None:
     from nexusquant_cli import embedded
 
     assert (embedded.validate(argv, write_confirmed=confirmed) is None) is allowed
+
+
+# ── device login (Nexus AI token) ───────────────────────────────────────────
+
+
+@pytest.fixture
+def creds_dir(tmp_path, monkeypatch):
+    from nexusquant_cli import config
+
+    monkeypatch.setattr(config, "CONFIG_DIR", tmp_path)
+    monkeypatch.setattr(config, "CREDENTIALS_PATH", tmp_path / "credentials.json")
+    return tmp_path / "credentials.json"
+
+
+def _device_routes(http: Recorder, outcomes):
+    http.on("POST", "/nexus-ai/device/start/", {"data": {
+        "device_code": "nxdc_x", "user_code": "BCDF-GHJK", "verification_uri": "https://nexusquant.co/link?code=BCDF-GHJK",
+        "expires_in": 600, "interval": 5}})
+    seq = iter(outcomes)
+    http.on("POST", "/nexus-ai/device/token/", lambda r: next(seq))
+
+
+def test_device_login_saves_token_and_uses_it(http: Recorder, creds_dir, monkeypatch) -> None:
+    from nexusquant_cli.roles import auth as auth_mod
+
+    monkeypatch.setattr(auth_mod.time, "sleep", lambda s: None)
+    _device_routes(http, [
+        httpx.Response(400, json={"error_code": "AUTHORIZATION_PENDING"}),
+        httpx.Response(200, json={"data": {"access_token": "nxat_secret_123", "expires_at": "2027-01-08T00:00:00Z",
+                                           "user": {"sub": "sub-1", "email": "a@x.com"}}}),
+    ])
+    result = runner.invoke(app, ["auth", "login", "--device", "--label", "box"])
+    assert result.exit_code == 0, result.output
+    assert "BCDF-GHJK" in result.output and "https://nexusquant.co/link?code=BCDF-GHJK" in result.output
+    assert "investor commands only" in result.output
+    saved = json.loads(creds_dir.read_text())
+    assert saved["nexus_ai_token"] == "nxat_secret_123" and "id_token" not in saved
+    assert http.calls[0][3] == {"client": "cli", "label": "box"}
+    assert "nxat_secret_123" not in result.output
+
+    # 之后的请求用这个 token（http 夹具把 Cognito 登录换成了 "tok"，这里必须不是它）
+    seen = []
+
+    def stats(request: httpx.Request) -> httpx.Response:
+        seen.append(request.headers["Authorization"])
+        return httpx.Response(200, json={"data": {}})
+
+    http.on("GET", "/strategy-signal/statistics/", stats)
+    assert runner.invoke(app, ["investor", "read", "stats", "--json"]).exit_code == 0
+    assert seen == ["Bearer nxat_secret_123"]
+
+    who = runner.invoke(app, ["auth", "whoami", "--json"])
+    assert json.loads(who.output)["roles"] == ["investor"]
+
+    http.on("DELETE", "/nexus-ai/tokens/current/", {"data": {}})
+    out = runner.invoke(app, ["auth", "logout"])
+    assert out.exit_code == 0, out.output
+    assert http.calls[-1][:2] == ("DELETE", "/nexus-ai/tokens/current/")
+    assert not creds_dir.exists()
+
+
+def test_device_login_denied(http: Recorder, creds_dir, monkeypatch) -> None:
+    from nexusquant_cli.roles import auth as auth_mod
+
+    monkeypatch.setattr(auth_mod.time, "sleep", lambda s: None)
+    _device_routes(http, [httpx.Response(400, json={"error_code": "ACCESS_DENIED", "error": "用户拒绝了授权"})])
+    result = runner.invoke(app, ["auth", "login", "--device"])
+    assert result.exit_code == 1
+    assert "ACCESS_DENIED" in result.output
+    assert not creds_dir.exists()

{nexusquant_cli-0.4.0 → nexusquant_cli-0.5.0}/uv.lock

@@ -133,7 +133,7 @@ wheels = [
 
 [[package]]
 name = "nexusquant-cli"
-version = "0.3.0"
+version = "0.5.0"
 source = { editable = "." }
 dependencies = [
     { name = "httpx" },

nexusquant_cli-0.4.0/nexusquant_cli/__init__.py

@@ -1 +0,0 @@
-__version__ = "0.4.0"

nexusquant_cli-0.4.0/nexusquant_cli/roles/auth.py

@@ -1,91 +0,0 @@
-"""`nexus-cli auth …` — one login for every role.
-
-The role is not chosen at login: it is ``custom:userType`` on the account, and the
-server checks it per request. ``whoami`` shows which role groups apply.
-"""
-
-from __future__ import annotations
-
-import time
-
-import typer
-from rich.console import Console
-
-from nexusquant_cli.auth_pkce import ensure_fresh_id_token, login_and_save
-from nexusquant_cli.commands._util import fail
-from nexusquant_cli.config import CREDENTIALS_PATH, clear_credentials, load_credentials
-from nexusquant_cli.identity import has_wall_pro, roles_for, token_claims, user_type
-
-console = Console()
-
-auth_app = typer.Typer(
-    help="Login / logout. One login covers every role; the account's userType decides "
-    "which of admin / provider / investor commands the server accepts.",
-    no_args_is_help=True,
-)
-
-
-@auth_app.command("login", help="Open the browser for Cognito login and save tokens locally.")
-def login() -> None:
-    try:
-        login_and_save()
-    except Exception as e:  # noqa: BLE001
-        fail(console, e)
-    console.print("[green]Logged in.[/green]")
-    whoami(as_json=False)
-
-
-@auth_app.command("logout", help="Delete locally saved tokens.")
-def logout() -> None:
-    clear_credentials()
-    console.print("[green]Logged out (local tokens removed).[/green]")
-
-
-@auth_app.command("refresh", help="Force-refresh the ID token (e.g. right after a Wall Pro upgrade).")
-def refresh() -> None:
-    try:
-        ensure_fresh_id_token(force_refresh=True)
-    except Exception as e:  # noqa: BLE001
-        fail(console, e)
-    console.print("[green]Token refreshed.[/green]")
-
-
-@auth_app.command("status", help="Whether tokens are saved on this machine (no network call).")
-def status() -> None:
-    creds = load_credentials()
-    if creds and creds.get("id_token"):
-        console.print(f"[green]Logged in.[/green] Credentials: {CREDENTIALS_PATH}")
-    else:
-        console.print("[yellow]Not logged in. Run: nexus-cli auth login[/yellow]")
-        raise typer.Exit(1)
-
-
-@auth_app.command(
-    "whoami",
-    help="Show the logged-in account, its userType, Wall Pro tier, and usable role groups. "
-    "Read from the local token; the server remains the authority.",
-)
-def whoami(
-    as_json: bool = typer.Option(False, "--json", help="Print raw claims subset as JSON."),
-) -> None:
-    claims = token_claims()
-    if claims is None:
-        console.print("[yellow]Not logged in. Run: nexus-cli auth login[/yellow]")
-        raise typer.Exit(1)
-    exp = claims.get("exp")
-    info = {
-        "email": claims.get("email"),
-        "user_type": user_type(claims),
-        "wall_pro": has_wall_pro(claims),
-        "roles": roles_for(claims),
-        "token_expires_in_s": int(exp - time.time()) if isinstance(exp, (int, float)) else None,
-    }
-    if as_json:
-        console.print_json(data=info)
-        return
-    console.print(f"[bold]{info['email']}[/bold]")
-    console.print(f"userType   {info['user_type']}")
-    console.print(f"Wall Pro   {'[green]yes[/green]' if info['wall_pro'] else '[yellow]no[/yellow]'}")
-    console.print(f"roles      {' / '.join(info['roles'])}")
-    if info["token_expires_in_s"] is not None and info["token_expires_in_s"] < 0:
-        console.print("[dim]ID token expired; it is refreshed automatically on the next call.[/dim]")