oed-cli 0.1.2__tar.gz → 0.1.4__tar.gz

{oed_cli-0.1.2/src/oed_cli.egg-info → oed_cli-0.1.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: oed-cli
-Version: 0.1.2
+Version: 0.1.4
 Summary: oed — openEuler Infra command line. Auto-discovered, AI-friendly.
 Author: oed-cli contributors
 License: Apache-2.0
@@ -97,7 +97,7 @@ pip install -e .
 Verify:
 
 ```bash
-oed --version       # → oed, version 0.1.2
+oed --version       # → oed, version 0.1.4
 ```
 
 ---
@@ -230,6 +230,49 @@ oed schema cve | jq '.paths | keys'
 
 ---
 
+## AtomGit (`ag`) authentication
+
+AtomGit operations authenticate through the `access_token` query parameter
+declared on their spec. Store a personal access token once, and every
+`oed ag ...` call uses it automatically:
+
+```bash
+# Interactive (prompts for the token, never echoes it back)
+oed ag login
+
+# Non-interactive — good for CI / scripts
+oed ag login --token <pat>
+
+# Skip validating the token against AtomGit before storing
+oed ag login --token <pat> --no-verify
+
+# Just report whether a token is configured (no network, no prompt)
+oed ag login --status
+
+# Forget the stored token
+oed ag logout
+```
+
+Token storage:
+
+- Windows: encrypted at rest for the current user via DPAPI (no extra deps).
+- Elsewhere: base64, which is documented obfuscation, **not** encryption.
+- Lives under the cache dir (`tokens/ag.json`); `oed cache clear` never
+  touches credentials.
+
+Auto-injection on real calls:
+
+- If the operation declares `access_token` and you don't pass one, the stored
+  token is filled in automatically — `oed ag listAuthenticatedUserIssues` just
+  works.
+- An explicit `--access-token <pat>` always wins over the stored one.
+- If the operation requires a token and none is available anywhere, you get a
+  clear `ag_token_missing` error with a hint, instead of an opaque gateway 401.
+- `--dry-run` and request echo views mask the token as `<stored>` — the real
+  value only ever goes out on the wire.
+
+---
+
 ## Local development
 
 ### Clone and install (editable)
@@ -248,9 +291,10 @@ invocation. Drop it with `pip uninstall oed-cli` when you're done.
 python -m pytest -q
 ```
 
-41 tests cover v0.1 + v0.2 dispatch, the operation-help cheatsheet,
+58 tests cover v0.1 + v0.2 dispatch, the operation-help cheatsheet,
 per-parameter flag coercion, the `API_`-prefix alias, the
-`resolve_runtime_gateway` no-fallback semantics, and every exit code path.
+`resolve_runtime_gateway` no-fallback semantics, every exit code path, and
+v0.4's `ag` token store (DPAPI/base64) + auto-injection.
 They monkeypatch the discovery layer so no gateway access is needed.
 
 ### Smoke-test against the live gateway
@@ -328,6 +372,7 @@ to eyeball `oed services` output every week.
 | `oed info` hangs or `waf_block` exit 2             | gateway unreachable / WAF      | confirm `curl https://api-gateway.osinfra.cn`; see `context/discoverAPI.md` §6 |
 | Chinese output garbled on Windows                  | console codepage not UTF-8     | `chcp 65001`, or pipe `\| python`, or `PYTHONIOENCODING=utf-8 oed …` |
 | `error="spec_missing"` (exit 4) on a known service | upstream hasn't published the spec yet | wait for the gateway-side OpenAPI yaml; nothing to do on the oed side |
+| `error="ag_token_missing"` on an `ag` call | operation needs a token, none stored | `oed ag login` (or pass `--access-token <pat>`) |
 | A `cve` call exits 2 (`waf_block`)      | spec points to a `.test.osinfra.cn` host | already handled — `oed` reads `base_url` from the discovery feed (no fallback) and ignores the spec's `x-apigateway-backend.httpEndpoints.address` for the host |
 
 ### Offline mode

{oed_cli-0.1.2 → oed_cli-0.1.4}/README.md

@@ -63,7 +63,7 @@ pip install -e .
 Verify:
 
 ```bash
-oed --version       # → oed, version 0.1.2
+oed --version       # → oed, version 0.1.4
 ```
 
 ---
@@ -196,6 +196,49 @@ oed schema cve | jq '.paths | keys'
 
 ---
 
+## AtomGit (`ag`) authentication
+
+AtomGit operations authenticate through the `access_token` query parameter
+declared on their spec. Store a personal access token once, and every
+`oed ag ...` call uses it automatically:
+
+```bash
+# Interactive (prompts for the token, never echoes it back)
+oed ag login
+
+# Non-interactive — good for CI / scripts
+oed ag login --token <pat>
+
+# Skip validating the token against AtomGit before storing
+oed ag login --token <pat> --no-verify
+
+# Just report whether a token is configured (no network, no prompt)
+oed ag login --status
+
+# Forget the stored token
+oed ag logout
+```
+
+Token storage:
+
+- Windows: encrypted at rest for the current user via DPAPI (no extra deps).
+- Elsewhere: base64, which is documented obfuscation, **not** encryption.
+- Lives under the cache dir (`tokens/ag.json`); `oed cache clear` never
+  touches credentials.
+
+Auto-injection on real calls:
+
+- If the operation declares `access_token` and you don't pass one, the stored
+  token is filled in automatically — `oed ag listAuthenticatedUserIssues` just
+  works.
+- An explicit `--access-token <pat>` always wins over the stored one.
+- If the operation requires a token and none is available anywhere, you get a
+  clear `ag_token_missing` error with a hint, instead of an opaque gateway 401.
+- `--dry-run` and request echo views mask the token as `<stored>` — the real
+  value only ever goes out on the wire.
+
+---
+
 ## Local development
 
 ### Clone and install (editable)
@@ -214,9 +257,10 @@ invocation. Drop it with `pip uninstall oed-cli` when you're done.
 python -m pytest -q
 ```
 
-41 tests cover v0.1 + v0.2 dispatch, the operation-help cheatsheet,
+58 tests cover v0.1 + v0.2 dispatch, the operation-help cheatsheet,
 per-parameter flag coercion, the `API_`-prefix alias, the
-`resolve_runtime_gateway` no-fallback semantics, and every exit code path.
+`resolve_runtime_gateway` no-fallback semantics, every exit code path, and
+v0.4's `ag` token store (DPAPI/base64) + auto-injection.
 They monkeypatch the discovery layer so no gateway access is needed.
 
 ### Smoke-test against the live gateway
@@ -294,6 +338,7 @@ to eyeball `oed services` output every week.
 | `oed info` hangs or `waf_block` exit 2             | gateway unreachable / WAF      | confirm `curl https://api-gateway.osinfra.cn`; see `context/discoverAPI.md` §6 |
 | Chinese output garbled on Windows                  | console codepage not UTF-8     | `chcp 65001`, or pipe `\| python`, or `PYTHONIOENCODING=utf-8 oed …` |
 | `error="spec_missing"` (exit 4) on a known service | upstream hasn't published the spec yet | wait for the gateway-side OpenAPI yaml; nothing to do on the oed side |
+| `error="ag_token_missing"` on an `ag` call | operation needs a token, none stored | `oed ag login` (or pass `--access-token <pat>`) |
 | A `cve` call exits 2 (`waf_block`)      | spec points to a `.test.osinfra.cn` host | already handled — `oed` reads `base_url` from the discovery feed (no fallback) and ignores the spec's `x-apigateway-backend.httpEndpoints.address` for the host |
 
 ### Offline mode

{oed_cli-0.1.2 → oed_cli-0.1.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "oed-cli"
-version = "0.1.2"
+version = "0.1.4"
 description = "oed — openEuler Infra command line. Auto-discovered, AI-friendly."
 readme = "README.md"
 requires-python = ">=3.10"

{oed_cli-0.1.2 → oed_cli-0.1.4}/src/oed_cli/__init__.py

@@ -1,6 +1,6 @@
-"""oed-cli — openEuler Infra command line, auto-discovered, AI-friendly."""
-
-from __future__ import annotations
-
-__version__ = "0.1.2"
-__all__ = ["__version__"]
+"""oed-cli — openEuler Infra command line, auto-discovered, AI-friendly."""
+
+from __future__ import annotations
+
+__version__ = "0.1.4"
+__all__ = ["__version__"]

oed_cli-0.1.4/src/oed_cli/auth.py

@@ -0,0 +1,176 @@
+"""Local secret storage for ``oed`` authentication tokens.
+
+On Windows, tokens are encrypted at rest for the current Windows user via
+DPAPI (``CryptProtectData`` / ``CryptUnprotectData`` through ctypes) — a real
+encryption boundary with zero runtime dependencies. Non-Windows platforms fall
+back to base64, which is documented obfuscation and NOT encryption.
+
+The on-disk schema is versioned and keyed by ``service`` so a future general
+``oed login`` can share this store with the ``ag``-specific token here.
+"""
+
+from __future__ import annotations
+
+import base64
+import contextlib
+import ctypes
+import datetime as _dt
+import json
+import platform
+from pathlib import Path
+from typing import Any
+
+from .discovery import _cache_dir
+from .errors import UserError
+
+_SCHEMA_VERSION = 1
+_DPAPI_ENTROPY = b"oed-cli:ag:v1"
+_CRYPTPROTECT_UI_FORBIDDEN = 0x1
+
+
+class _DATA_BLOB(ctypes.Structure):
+    _fields_ = [("cbData", ctypes.c_ulong), ("pbData", ctypes.POINTER(ctypes.c_char))]
+
+
+def _is_windows() -> bool:
+    return platform.system() == "Windows"
+
+
+def token_path(service: str = "ag") -> Path:
+    """Return the on-disk path for ``service``'s encrypted token.
+
+    Lives under the shared cache dir (honors ``OED_CACHE_DIR``) in a ``tokens/``
+    subdirectory so ``oed cache clear`` (which only unlinks ``discovery.json``)
+    can never wipe credentials.
+    """
+
+    return _cache_dir() / "tokens" / f"{service}.json"
+
+
+def _win32_crypt(data: bytes, *, protect: bool) -> bytes:
+    """Protect/unprotect ``data`` with DPAPI scoped to the current Windows user."""
+
+    windll = ctypes.windll
+    func = windll.crypt32.CryptProtectData if protect else windll.crypt32.CryptUnprotectData
+    func.argtypes = [
+        ctypes.POINTER(_DATA_BLOB),  # pDataIn
+        ctypes.c_wchar_p,            # szDataDescr
+        ctypes.POINTER(_DATA_BLOB),  # pOptionalEntropy
+        ctypes.c_void_p,             # pvReserved
+        ctypes.c_void_p,             # pPromptStruct
+        ctypes.c_ulong,              # dwFlags
+        ctypes.POINTER(_DATA_BLOB),  # pDataOut
+    ]
+    func.restype = ctypes.c_int
+
+    # keep the backing buffers referenced for the duration of the call
+    inp = ctypes.create_string_buffer(data, len(data))
+    in_blob = _DATA_BLOB(len(data), ctypes.cast(inp, ctypes.POINTER(ctypes.c_char)))
+    ent = ctypes.create_string_buffer(_DPAPI_ENTROPY, len(_DPAPI_ENTROPY))
+    ent_blob = _DATA_BLOB(len(_DPAPI_ENTROPY), ctypes.cast(ent, ctypes.POINTER(ctypes.c_char)))
+    out_blob = _DATA_BLOB()
+
+    ok = func(
+        ctypes.byref(in_blob),
+        None,
+        ctypes.byref(ent_blob),
+        None,
+        None,
+        _CRYPTPROTECT_UI_FORBIDDEN,
+        ctypes.byref(out_blob),
+    )
+    if not ok:
+        side = "protect" if protect else "unprotect"
+        raise UserError(
+            f"Windows DPAPI could not {side} the token",
+            kind="dpapi_failed",
+            hint="Retry, or file an issue if it persists.",
+        )
+    try:
+        return ctypes.string_at(out_blob.pbData, out_blob.cbData)
+    finally:
+        windll.kernel32.LocalFree(out_blob.pbData)
+
+
+def _encrypt(plain: str) -> tuple[str, str]:
+    """Return ``(base64 blob, schema encryption marker)`` for ``plain``."""
+
+    raw = plain.encode("utf-8")
+    if _is_windows():
+        return base64.b64encode(_win32_crypt(raw, protect=True)).decode("ascii"), "dpapi"
+    return base64.b64encode(raw).decode("ascii"), "base64"
+
+
+def store_token(token: str, *, service: str = "ag") -> Path:
+    """Encrypt ``token`` and write it to disk for ``service``.
+
+    Never stores plaintext; raises :class:`UserError` if the write fails.
+    """
+
+    blob, encryption = _encrypt(token)
+    payload: dict[str, Any] = {
+        "version": _SCHEMA_VERSION,
+        "service": service,
+        "encryption": encryption,
+        "secret": blob,
+        "created_at": _dt.datetime.now(_dt.timezone.utc).isoformat(),
+    }
+    path = token_path(service)
+    try:
+        path.parent.mkdir(parents=True, exist_ok=True)
+        path.write_text(json.dumps(payload, ensure_ascii=False), encoding="utf-8")
+    except OSError as exc:
+        raise UserError(
+            f"could not write token store {path}: {exc}",
+            kind="token_store_write_failed",
+            hint="Check the directory is writable, or set OED_CACHE_DIR.",
+        ) from exc
+    return path
+
+
+def read_token(service: str = "ag") -> str | None:
+    """Return the decrypted token for ``service``, or ``None``.
+
+    Any read failure (missing file, corrupt JSON, undecryptable blob) degrades
+    silently to ``None`` so callers fall through to the missing-token path.
+    """
+
+    try:
+        raw = json.loads(token_path(service).read_text(encoding="utf-8"))
+        if raw.get("version") != _SCHEMA_VERSION or raw.get("service") != service:
+            return None
+        secret = base64.b64decode(raw["secret"])
+        if raw.get("encryption") == "dpapi" and _is_windows():
+            return _win32_crypt(secret, protect=False).decode("utf-8")
+        if raw.get("encryption") == "base64":
+            return secret.decode("utf-8")
+        return None
+    except Exception:
+        return None
+
+
+def token_info(service: str = "ag") -> dict[str, Any] | None:
+    """Return ``{encryption, created_at}`` metadata for the stored token, or ``None``."""
+
+    try:
+        raw = json.loads(token_path(service).read_text(encoding="utf-8"))
+        return {
+            "encryption": raw.get("encryption"),
+            "created_at": raw.get("created_at"),
+        }
+    except Exception:
+        return None
+
+
+def clear_token(service: str = "ag") -> bool:
+    """Delete ``service``'s stored token; return whether one existed."""
+
+    path = token_path(service)
+    if not path.is_file():
+        return False
+    with contextlib.suppress(OSError):
+        path.unlink()
+    return True
+
+
+__all__ = ["clear_token", "read_token", "store_token", "token_info", "token_path"]

{oed_cli-0.1.2 → oed_cli-0.1.4}/src/oed_cli/invoke.py

@@ -24,6 +24,7 @@ from typing import Any
 import httpx
 
 from . import http as http_mod
+from .auth import read_token
 from .dynamic import Operation, coerce_param_types, to_flag
 from .errors import NetworkError, UserError
 from .http import _is_waf_block, _resolve_user_agent
@@ -126,6 +127,33 @@ def _render_response(resp: httpx.Response) -> Any:
         }
 
 
+def _inject_ag_token(op: Operation, query_params: dict[str, Any]) -> None:
+    """Auto-fill the ``access_token`` query param for AtomGit operations.
+
+    ``ag`` authenticates every request through the ``access_token`` query
+    parameter declared on its spec (用户授权码). When the caller didn't
+    pass one explicitly, fall back to the locally stored token from
+    ``oed ag login``. A required token that isn't available anywhere
+    raises a hint instead of failing inside the gateway; optional ones
+    simply go without.
+    """
+
+    declared = next(
+        (p for p in op.query_params if p.get("name") == "access_token"), None
+    )
+    if op.service_name != "ag" or declared is None or "access_token" in query_params:
+        return
+    token = read_token("ag")
+    if token:
+        query_params["access_token"] = token
+    elif declared.get("required"):
+        raise UserError(
+            "this AtomGit operation requires an access_token",
+            kind="ag_token_missing",
+            hint="Store one with `oed ag login`, or pass `--access-token <pat>`.",
+        )
+
+
 def call_operation(
     op: Operation,
     *,
@@ -158,16 +186,28 @@ def call_operation(
         )
 
     query_params = {k: v for k, v in query_params.items() if v is not None}
+    _inject_ag_token(op, query_params)
     url = f"{op.base_url}{filled_path}"
 
+    # Discourse (forum) authenticates via Api-Key/Api-Username; inert sentinel
+    # until login lands, so the request shape stays visible without leaking a real credential.
+    api_headers: dict[str, str] = {}
+    if op.service_name == "forum":
+        api_headers = {"Api-Key": "oed-placeholder", "Api-Username": "oed-placeholder"}
+
     request_headers: dict[str, str] = {"User-Agent": _resolve_user_agent(user_agent)}
     if body is not None:
         request_headers["Content-Type"] = "application/json"
+    # Mask credentials in any echoed request view (dry-run / include_request):
+    # the real token still goes out on the wire, it just never round-trips
+    # back to the terminal.
     request_view: dict[str, Any] = {
         "method": op.backend.method,
         "url": url,
-        "query": query_params,
-        "headers": request_headers,
+        "query": {
+            k: ("<stored>" if k == "access_token" else v) for k, v in query_params.items()
+        },
+        "headers": {**request_headers, **api_headers},
         "body": body,
     }
 
@@ -191,6 +231,7 @@ def call_operation(
         url,
         params=query_params if query_params else None,
         body=body,
+        headers=api_headers,
         timeout=timeout,
         user_agent=user_agent,
     )