oed-cli 0.1.4__tar.gz → 0.1.6__tar.gz

{oed_cli-0.1.4/src/oed_cli.egg-info → oed_cli-0.1.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: oed-cli
-Version: 0.1.4
+Version: 0.1.6
 Summary: oed — openEuler Infra command line. Auto-discovered, AI-friendly.
 Author: oed-cli contributors
 License: Apache-2.0
@@ -97,7 +97,7 @@ pip install -e .
 Verify:
 
 ```bash
-oed --version       # → oed, version 0.1.4
+oed --version       # → oed, version 0.1.6
 ```
 
 ---
@@ -108,6 +108,22 @@ oed --version       # → oed, version 0.1.4
 pip install oed-cli
 oed cve getSecurityNoticeByCveId --cve-id CVE-2019-10082
 ```
+#### (optional) Call an AtomGit operation — store a token once
+
+Operations on the `ag` (AtomGit) service authenticate via an `access_token`
+query parameter. Store a personal access token once, and every `oed ag ...`
+call injects it automatically:
+
+```bash
+oed ag login
+```
+
+Then `oed ag listAuthenticatedUserIssues` just works — no per-call token
+flag needed. Full details (`oed ag login --token <pat> [--no-verify]`,
+`--status`, `oed ag logout`, how the token is stored, auto-injection rules)
+are in the [AtomGit (`ag`) authentication](#atomgit-ag-authentication)
+section below.
+
 
 That's it. `oed` discovers the service from the gateway, pulls its OpenAPI
 spec, derives `--cve-id` from the declared `query` parameter, fills WAF-safe
@@ -217,13 +233,16 @@ oed software-package-server getSoftwarePackage --id 12345 --language zh_CN
 # Integer / number flags auto-coerce from string
 oed software-package-server listSoftwarePackages --page-num 1 --count-per-page 5
 
-# POST with JSON body — Content-Type auto-set
+# POST with JSON body — request bodies go via `--json`, never `--params`
 oed software-package-server applyNewSoftwarePackage \
   --json '{"pkg_name":"demo","version":"1.0.0"}'
 
-# Bulk JSON for scripts — `--params` is the escape hatch when you have many fields
+# Bulk query/path params for scripts — `--params` only covers query/path, not the body
 oed cve getSecurityNoticeByCveId --params '{"cveId":"1"}'
 
+# If you send body fields via `--params` on a POST, oed refuses with a
+# `body_fields_via_params` error and a `--json` hint instead of a gateway 400.
+
 # Raw OpenAPI spec, for debugging
 oed schema cve | jq '.paths | keys'
 ```
@@ -373,6 +392,8 @@ to eyeball `oed services` output every week.
 | Chinese output garbled on Windows                  | console codepage not UTF-8     | `chcp 65001`, or pipe `\| python`, or `PYTHONIOENCODING=utf-8 oed …` |
 | `error="spec_missing"` (exit 4) on a known service | upstream hasn't published the spec yet | wait for the gateway-side OpenAPI yaml; nothing to do on the oed side |
 | `error="ag_token_missing"` on an `ag` call | operation needs a token, none stored | `oed ag login` (or pass `--access-token <pat>`) |
+| `error="body_fields_via_params"` (exit 1) on a POST | body fields were passed via `--params` (which only covers query/path) | resend the fields with `--json '{...}'` — `oed <service> <op> --help` lists the body schema |
+| `error="gateway_managed_param"` (exit 1) on a `forum` call | `Api-Key` / `Api-Username` were passed (`--api-key` or `--params`) | drop them — `oed` auto-fills both placeholder headers on every `forum` call and the gateway converts them |
 | A `cve` call exits 2 (`waf_block`)      | spec points to a `.test.osinfra.cn` host | already handled — `oed` reads `base_url` from the discovery feed (no fallback) and ignores the spec's `x-apigateway-backend.httpEndpoints.address` for the host |
 
 ### Offline mode

{oed_cli-0.1.4 → oed_cli-0.1.6}/README.md

@@ -63,7 +63,7 @@ pip install -e .
 Verify:
 
 ```bash
-oed --version       # → oed, version 0.1.4
+oed --version       # → oed, version 0.1.6
 ```
 
 ---
@@ -74,6 +74,22 @@ oed --version       # → oed, version 0.1.4
 pip install oed-cli
 oed cve getSecurityNoticeByCveId --cve-id CVE-2019-10082
 ```
+#### (optional) Call an AtomGit operation — store a token once
+
+Operations on the `ag` (AtomGit) service authenticate via an `access_token`
+query parameter. Store a personal access token once, and every `oed ag ...`
+call injects it automatically:
+
+```bash
+oed ag login
+```
+
+Then `oed ag listAuthenticatedUserIssues` just works — no per-call token
+flag needed. Full details (`oed ag login --token <pat> [--no-verify]`,
+`--status`, `oed ag logout`, how the token is stored, auto-injection rules)
+are in the [AtomGit (`ag`) authentication](#atomgit-ag-authentication)
+section below.
+
 
 That's it. `oed` discovers the service from the gateway, pulls its OpenAPI
 spec, derives `--cve-id` from the declared `query` parameter, fills WAF-safe
@@ -183,13 +199,16 @@ oed software-package-server getSoftwarePackage --id 12345 --language zh_CN
 # Integer / number flags auto-coerce from string
 oed software-package-server listSoftwarePackages --page-num 1 --count-per-page 5
 
-# POST with JSON body — Content-Type auto-set
+# POST with JSON body — request bodies go via `--json`, never `--params`
 oed software-package-server applyNewSoftwarePackage \
   --json '{"pkg_name":"demo","version":"1.0.0"}'
 
-# Bulk JSON for scripts — `--params` is the escape hatch when you have many fields
+# Bulk query/path params for scripts — `--params` only covers query/path, not the body
 oed cve getSecurityNoticeByCveId --params '{"cveId":"1"}'
 
+# If you send body fields via `--params` on a POST, oed refuses with a
+# `body_fields_via_params` error and a `--json` hint instead of a gateway 400.
+
 # Raw OpenAPI spec, for debugging
 oed schema cve | jq '.paths | keys'
 ```
@@ -339,6 +358,8 @@ to eyeball `oed services` output every week.
 | Chinese output garbled on Windows                  | console codepage not UTF-8     | `chcp 65001`, or pipe `\| python`, or `PYTHONIOENCODING=utf-8 oed …` |
 | `error="spec_missing"` (exit 4) on a known service | upstream hasn't published the spec yet | wait for the gateway-side OpenAPI yaml; nothing to do on the oed side |
 | `error="ag_token_missing"` on an `ag` call | operation needs a token, none stored | `oed ag login` (or pass `--access-token <pat>`) |
+| `error="body_fields_via_params"` (exit 1) on a POST | body fields were passed via `--params` (which only covers query/path) | resend the fields with `--json '{...}'` — `oed <service> <op> --help` lists the body schema |
+| `error="gateway_managed_param"` (exit 1) on a `forum` call | `Api-Key` / `Api-Username` were passed (`--api-key` or `--params`) | drop them — `oed` auto-fills both placeholder headers on every `forum` call and the gateway converts them |
 | A `cve` call exits 2 (`waf_block`)      | spec points to a `.test.osinfra.cn` host | already handled — `oed` reads `base_url` from the discovery feed (no fallback) and ignores the spec's `x-apigateway-backend.httpEndpoints.address` for the host |
 
 ### Offline mode

{oed_cli-0.1.4 → oed_cli-0.1.6}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "oed-cli"
-version = "0.1.4"
+version = "0.1.6"
 description = "oed — openEuler Infra command line. Auto-discovered, AI-friendly."
 readme = "README.md"
 requires-python = ">=3.10"

{oed_cli-0.1.4 → oed_cli-0.1.6}/src/oed_cli/__init__.py

@@ -2,5 +2,5 @@
 
 from __future__ import annotations
 
-__version__ = "0.1.4"
+__version__ = "0.1.6"
 __all__ = ["__version__"]

{oed_cli-0.1.4 → oed_cli-0.1.6}/src/oed_cli/invoke.py

@@ -127,6 +127,36 @@ def _render_response(resp: httpx.Response) -> Any:
         }
 
 
+# Api-Key / Api-Username are Discourse auth headers that the gateway (APIG)
+# injects during its header conversion. oed must neither send them nor let
+# callers supply them — surfacing them makes agents hunt for credentials that
+# are already handled upstream.
+GATEWAY_MANAGED_PARAMS = frozenset({"Api-Key", "Api-Username"})
+
+
+def _reject_gateway_managed_params(params: dict[str, Any] | None) -> None:
+    """Refuse Api-Key / Api-Username supplied by the caller.
+
+    ``forum`` authenticates at the gateway layer; the spec still declares
+    these as required header params, so agents reading the raw spec keep
+    trying to "fill" them. An explicit error is the strongest signal that
+    the value is injected upstream and must not be supplied.
+    """
+
+    supplied = sorted(k for k in (params or {}) if k in GATEWAY_MANAGED_PARAMS)
+    if not supplied:
+        return
+    raise UserError(
+        f"{', '.join(supplied)} are injected by the gateway and must not be supplied",
+        kind="gateway_managed_param",
+        hint=(
+            "Api-Key / Api-Username are auto-filled by oed as placeholder "
+            "headers on every forum call, then converted by the gateway — "
+            "do not supply them."
+        ),
+    )
+
+
 def _inject_ag_token(op: Operation, query_params: dict[str, Any]) -> None:
     """Auto-fill the ``access_token`` query param for AtomGit operations.
 
@@ -154,6 +184,32 @@ def _inject_ag_token(op: Operation, query_params: dict[str, Any]) -> None:
         )
 
 
+def _reject_body_fields_via_params(op: Operation, unused: list[str]) -> None:
+    """Turn a common misuse into an actionable error instead of an opaque 400.
+
+    ``--params`` only carries query/path parameters. Body fields passed that
+    way land in ``unused`` and the request goes out with ``body: null``, which
+    the gateway rejects with a generic 400. When those keys line up with the
+    operation's request-body schema, raise a hint that names the right flag.
+    """
+
+    if op.body_schema is None or not unused:
+        return
+    body_props = set(op.body_schema.get("properties") or {})
+    body_keys = sorted(k for k in unused if k in body_props)
+    if not body_keys:
+        return
+    raise UserError(
+        f"{', '.join(body_keys)} match request-body fields for this operation "
+        "but no body was sent",
+        kind="body_fields_via_params",
+        hint=(
+            "`--params` only covers query/path parameters; request bodies go "
+            f"through `--json '{{...}}'`. See `oed <service> {op.display_name} --help`."
+        ),
+    )
+
+
 def call_operation(
     op: Operation,
     *,
@@ -175,7 +231,10 @@ def call_operation(
     """
 
     path_params, query_params, unused = _select_params(op, params)
+    _reject_gateway_managed_params(params)
     query_params = coerce_param_types(op, query_params)
+    if body is None:
+        _reject_body_fields_via_params(op, unused)
 
     filled_path, missing = _fill_path(op.path, path_params)
     if missing:
@@ -189,8 +248,11 @@ def call_operation(
     _inject_ag_token(op, query_params)
     url = f"{op.base_url}{filled_path}"
 
-    # Discourse (forum) authenticates via Api-Key/Api-Username; inert sentinel
-    # until login lands, so the request shape stays visible without leaking a real credential.
+    # Discourse (forum) authenticates via Api-Key / Api-Username headers. oed
+    # fills them with the gateway's expected placeholder — the APIG header
+    # conversion swaps them for the real credentials at the edge, so oed MUST
+    # send them or the gateway rejects the call. Callers never supply values
+    # themselves; _reject_gateway_managed_params enforces that.
     api_headers: dict[str, str] = {}
     if op.service_name == "forum":
         api_headers = {"Api-Key": "oed-placeholder", "Api-Username": "oed-placeholder"}
@@ -283,9 +345,10 @@ def describe_operation(op: Operation) -> dict[str, Any]:
         "description": op.description,
         "path_params": [p["name"] for p in op.path_params],
         "query_params": [p["name"] for p in op.query_params],
+        "has_body": op.body_schema is not None,
         "body_required": op.body_required,
     }
-    if op.body_required:
+    if op.body_schema is not None:
         out["body_required_fields"] = _body_field_summary(op.body_schema)
     if op.display_name != op.operation_id:
         out["operation_id_raw"] = op.operation_id
@@ -346,6 +409,7 @@ def describe_operation_help(op: Operation, service) -> dict[str, Any]:
         "url": f"{op.base_url}{rendered}",
         "summary": op.summary,
         "description": op.description,
+        "has_body": op.body_schema is not None,
         "body_required": op.body_required,
         "parameters": params,
         "usage": _usage_example(op),
@@ -353,7 +417,7 @@ def describe_operation_help(op: Operation, service) -> dict[str, Any]:
     }
     if name != op.operation_id:
         out["operation_id_raw"] = op.operation_id
-    if op.body_required:
+    if op.body_schema is not None:
         out["body_required_fields"] = _body_field_summary(op.body_schema)
         out["body_schema"] = op.body_schema
     return out
@@ -368,17 +432,25 @@ def _usage_example(op: Operation) -> str:
             continue
         flag = f"--{to_flag(p['name'])} <value>"
         parts.append(flag if p.get("required") else f"[{flag}]")
-    if op.body_required:
+    if op.body_schema is not None:
         parts.append("--json '{...}'")
     parts.append("[--dry-run]")
     return " ".join(parts)
 
 
 def _usage_examples(op: Operation) -> list[str]:
-    """A couple of ready-to-paste example commands."""
+    """A couple of ready-to-paste example commands.
+
+    The ``--params`` example only makes sense when the operation declares
+    query/path params. A body-only operation gets a ``--json`` example
+    instead — otherwise agents get steered into sending body fields via
+    ``--params``, which silently drops them (``--params`` never carries a
+    request body).
+    """
 
     name = op.display_name
     examples: list[str] = []
+    has_params = any(p.get("in") in {"query", "path"} for p in op.parameters)
     required = [
         p
         for p in op.parameters
@@ -390,7 +462,12 @@ def _usage_examples(op: Operation) -> list[str]:
         cmd += "".join(f" --{to_flag(p['name'])} <value>" for p in required)
         cmd += " [--dry-run]"
         examples.append(cmd)
-    examples.append(f"oed <service> {name} --params '{name}_PARAMS_JSON'")
+    if op.body_schema is not None:
+        examples.append(f"oed <service> {name} --json '{{\"...\"}}'")
+    if has_params:
+        examples.append(f"oed <service> {name} --params '{name}_PARAMS_JSON'")
+    if not examples:
+        examples.append(f"oed <service> {name} [--dry-run]")
     return examples
 
 

{oed_cli-0.1.4 → oed_cli-0.1.6}/src/oed_cli/main.py

@@ -50,6 +50,7 @@ from .dynamic import (
 )
 from .errors import NotFoundError, OedError
 from .invoke import (
+    GATEWAY_MANAGED_PARAMS,
     call_operation,
     describe_operation_help,
     describe_service,
@@ -184,6 +185,16 @@ def _merge_params(
         if flag_key in _VALUE_FLAGS or flag_key in _BOOL_FLAGS:
             continue
         if flag_key not in declared:
+            if flag_key.lower() in {p.lower() for p in GATEWAY_MANAGED_PARAMS}:
+                raise OedError(
+                    f"--{flag_key} is injected by the gateway for forum calls",
+                    kind="gateway_managed_param",
+                    hint=(
+                        "Do not pass Api-Key / Api-Username — oed auto-fills "
+                        "the placeholder headers on every forum call and the "
+                        "gateway converts them."
+                    ),
+                )
             raise OedError(
                 f"unknown flag: --{flag_key}",
                 kind="unknown_flag",
@@ -205,7 +216,8 @@ _AG_LOGIN_INSTRUCTIONS = (
     "AtomGit login\n"
     "=============\n"
     "1. Open https://atomgit.com and sign in.\n"
-    "2. Create a personal access token under Settings https://atomgit.com/setting > Access Tokens https://atomgit.com/setting/token-classic/create "
+    "2. Create a personal access token under Settings "
+    "(https://atomgit.com/setting/token-classic/create)\n"
     "3. Paste the token below. It is stored encrypted for this Windows/Linux user "
     "and is never echoed back.\n"
 )

{oed_cli-0.1.4 → oed_cli-0.1.6/src/oed_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: oed-cli
-Version: 0.1.4
+Version: 0.1.6
 Summary: oed — openEuler Infra command line. Auto-discovered, AI-friendly.
 Author: oed-cli contributors
 License: Apache-2.0
@@ -97,7 +97,7 @@ pip install -e .
 Verify:
 
 ```bash
-oed --version       # → oed, version 0.1.4
+oed --version       # → oed, version 0.1.6
 ```
 
 ---
@@ -108,6 +108,22 @@ oed --version       # → oed, version 0.1.4
 pip install oed-cli
 oed cve getSecurityNoticeByCveId --cve-id CVE-2019-10082
 ```
+#### (optional) Call an AtomGit operation — store a token once
+
+Operations on the `ag` (AtomGit) service authenticate via an `access_token`
+query parameter. Store a personal access token once, and every `oed ag ...`
+call injects it automatically:
+
+```bash
+oed ag login
+```
+
+Then `oed ag listAuthenticatedUserIssues` just works — no per-call token
+flag needed. Full details (`oed ag login --token <pat> [--no-verify]`,
+`--status`, `oed ag logout`, how the token is stored, auto-injection rules)
+are in the [AtomGit (`ag`) authentication](#atomgit-ag-authentication)
+section below.
+
 
 That's it. `oed` discovers the service from the gateway, pulls its OpenAPI
 spec, derives `--cve-id` from the declared `query` parameter, fills WAF-safe
@@ -217,13 +233,16 @@ oed software-package-server getSoftwarePackage --id 12345 --language zh_CN
 # Integer / number flags auto-coerce from string
 oed software-package-server listSoftwarePackages --page-num 1 --count-per-page 5
 
-# POST with JSON body — Content-Type auto-set
+# POST with JSON body — request bodies go via `--json`, never `--params`
 oed software-package-server applyNewSoftwarePackage \
   --json '{"pkg_name":"demo","version":"1.0.0"}'
 
-# Bulk JSON for scripts — `--params` is the escape hatch when you have many fields
+# Bulk query/path params for scripts — `--params` only covers query/path, not the body
 oed cve getSecurityNoticeByCveId --params '{"cveId":"1"}'
 
+# If you send body fields via `--params` on a POST, oed refuses with a
+# `body_fields_via_params` error and a `--json` hint instead of a gateway 400.
+
 # Raw OpenAPI spec, for debugging
 oed schema cve | jq '.paths | keys'
 ```
@@ -373,6 +392,8 @@ to eyeball `oed services` output every week.
 | Chinese output garbled on Windows                  | console codepage not UTF-8     | `chcp 65001`, or pipe `\| python`, or `PYTHONIOENCODING=utf-8 oed …` |
 | `error="spec_missing"` (exit 4) on a known service | upstream hasn't published the spec yet | wait for the gateway-side OpenAPI yaml; nothing to do on the oed side |
 | `error="ag_token_missing"` on an `ag` call | operation needs a token, none stored | `oed ag login` (or pass `--access-token <pat>`) |
+| `error="body_fields_via_params"` (exit 1) on a POST | body fields were passed via `--params` (which only covers query/path) | resend the fields with `--json '{...}'` — `oed <service> <op> --help` lists the body schema |
+| `error="gateway_managed_param"` (exit 1) on a `forum` call | `Api-Key` / `Api-Username` were passed (`--api-key` or `--params`) | drop them — `oed` auto-fills both placeholder headers on every `forum` call and the gateway converts them |
 | A `cve` call exits 2 (`waf_block`)      | spec points to a `.test.osinfra.cn` host | already handled — `oed` reads `base_url` from the discovery feed (no fallback) and ignores the spec's `x-apigateway-backend.httpEndpoints.address` for the host |
 
 ### Offline mode

{oed_cli-0.1.4 → oed_cli-0.1.6}/src/oed_cli.egg-info/SOURCES.txt

@@ -18,6 +18,7 @@ src/oed_cli.egg-info/dependency_links.txt
 src/oed_cli.egg-info/entry_points.txt
 src/oed_cli.egg-info/requires.txt
 src/oed_cli.egg-info/top_level.txt
+tests/test_ag_auth_cli.py
 tests/test_auth.py
 tests/test_cli.py
 tests/test_dynamic.py

oed_cli-0.1.6/tests/test_ag_auth_cli.py

@@ -0,0 +1,153 @@
+"""CLI-level tests for ``oed ag login / logout / status`` (v0.4 auth).
+
+These run the real ``main()`` dispatcher end to end: the token store points at
+a throwaway cache dir and the AtomGit verify backend is stubbed, so no network
+or real credentials are involved.
+"""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+import pytest
+
+ROOT = Path(__file__).resolve().parents[1]
+SRC = ROOT / "src"
+if str(SRC) not in sys.path:
+    sys.path.insert(0, str(SRC))
+
+
+@pytest.fixture()
+def ag_env(monkeypatch, tmp_path):
+    """Isolate the token store and stub the verify backend used by ``login``."""
+
+    from oed_cli import main as main_mod
+
+    monkeypatch.setenv("OED_CACHE_DIR", str(tmp_path))
+
+    class FakeService:
+        service_name = "ag"
+        name = "openeuler/ag"
+
+    class FakeOp:
+        service_name = "ag"
+        operation_id = "listAuthenticatedUserIssues"
+        display_name = "listAuthenticatedUserIssues"
+
+    state = {
+        "main": main_mod.main,
+        "verify_result": {"ok": True},
+        "resolve_error": None,
+        "call_error": None,
+    }
+
+    def _resolve(name):
+        if state["resolve_error"] is not None:
+            raise state["resolve_error"]
+        return FakeService()
+
+    monkeypatch.setattr(main_mod, "resolve_service_by_name", _resolve)
+    monkeypatch.setattr(main_mod, "fetch_service_spec", lambda svc, **kw: {})
+    monkeypatch.setattr(main_mod, "resolve_runtime_gateway", lambda svc: "https://apig.osinfra.cn")
+    monkeypatch.setattr(main_mod, "operations_table", lambda spec, name, base_url="": {})
+    monkeypatch.setattr(main_mod, "resolve_operation", lambda table, name: FakeOp())
+
+    def _call(op, **kw):
+        if state["call_error"] is not None:
+            raise state["call_error"]
+        return state["verify_result"]
+
+    monkeypatch.setattr(main_mod, "call_operation", _call)
+    return state
+
+
+def test_ag_login_help(capsys, ag_env):
+    assert ag_env["main"](["ag", "login", "--help"]) == 0
+    assert '"help_for": "ag login"' in capsys.readouterr().out
+
+
+def test_ag_login_status_reports_unconfigured(capsys, ag_env):
+    assert ag_env["main"](["ag", "login", "--status"]) == 0
+    assert '"configured": false' in capsys.readouterr().out
+
+
+def test_ag_login_status_configured(capsys, ag_env):
+    assert ag_env["main"](["ag", "login", "--token", "t", "--no-verify"]) == 0
+    assert ag_env["main"](["ag", "login", "--status"]) == 0
+    assert '"configured": true' in capsys.readouterr().out
+
+
+def test_ag_login_empty_token_flag(capsys, ag_env):
+    assert ag_env["main"](["ag", "login", "--token", ""]) == 1
+    assert '"missing_flag_value"' in capsys.readouterr().err
+
+
+def test_ag_login_interactive_prompt(capsys, ag_env, monkeypatch):
+    monkeypatch.setattr("click.prompt", lambda *a, **k: "prompted-token")
+    assert ag_env["main"](["ag", "login"]) == 0
+    assert "AtomGit login" in capsys.readouterr().err
+
+
+def test_ag_login_interactive_abort(capsys, ag_env, monkeypatch):
+    from click import Abort
+
+    monkeypatch.setattr("click.prompt", lambda *a, **k: (_ for _ in ()).throw(Abort()))
+    assert ag_env["main"](["ag", "login"]) == 1
+    assert '"aborted"' in capsys.readouterr().err
+
+
+def test_ag_login_whitespace_token(capsys, ag_env):
+    assert ag_env["main"](["ag", "login", "--token", "   "]) == 1
+    assert '"missing_token"' in capsys.readouterr().err
+
+
+def test_ag_login_verify_success_and_store(capsys, ag_env):
+    assert ag_env["main"](["ag", "login", "--token", "good-token"]) == 0
+    assert '"configured": true' in capsys.readouterr().out
+
+
+def test_ag_login_no_verify_skips_backend(capsys, ag_env):
+    assert ag_env["main"](["ag", "login", "--token", "t", "--no-verify"]) == 0
+
+
+def test_ag_login_verify_rejected_token(capsys, ag_env):
+    ag_env["verify_result"] = {"ok": False}
+    assert ag_env["main"](["ag", "login", "--token", "bad-token"]) == 1
+    assert '"invalid_token"' in capsys.readouterr().err
+
+
+def test_ag_login_verify_backend_missing_is_ok(capsys, ag_env):
+    from oed_cli.errors import NotFoundError
+
+    ag_env["resolve_error"] = NotFoundError("no ag service")
+    assert ag_env["main"](["ag", "login", "--token", "t"]) == 0
+
+
+def test_ag_login_verify_resolve_error(capsys, ag_env):
+    from oed_cli.errors import UserError
+
+    ag_env["resolve_error"] = UserError("boom", kind="boom")
+    assert ag_env["main"](["ag", "login", "--token", "t"]) == 1
+
+
+def test_ag_login_verify_call_error(capsys, ag_env):
+    from oed_cli.errors import UserError
+
+    ag_env["call_error"] = UserError("upstream boom", kind="boom")
+    assert ag_env["main"](["ag", "login", "--token", "t"]) == 1
+
+
+def test_ag_logout(capsys, ag_env):
+    assert ag_env["main"](["ag", "logout"]) == 0
+    assert '"was_set": false' in capsys.readouterr().out
+
+
+def test_ag_logout_help(capsys, ag_env):
+    assert ag_env["main"](["ag", "logout", "--help"]) == 0
+    assert '"help_for": "ag logout"' in capsys.readouterr().out
+
+
+def test_ag_login_too_many_positional(capsys, ag_env):
+    assert ag_env["main"](["ag", "login", "extra", "--token", "t"]) == 1
+    assert '"too_many_positional"' in capsys.readouterr().err

{oed_cli-0.1.4 → oed_cli-0.1.6}/tests/test_auth.py

@@ -105,3 +105,28 @@ def test_dpapi_marker_unreadable_off_windows(isolated, monkeypatch):
     )
     monkeypatch.setattr(isolated, "_is_windows", lambda: False)
     assert isolated.read_token("ag") is None
+
+
+def test_version_mismatch_returns_none(isolated):
+    p = isolated.token_path("ag")
+    p.parent.mkdir(parents=True, exist_ok=True)
+    p.write_text(
+        json.dumps(
+            {"version": 99, "service": "ag", "encryption": "base64", "secret": "eA=="}
+        ),
+        encoding="utf-8",
+    )
+    assert isolated.read_token("ag") is None
+
+
+def test_unknown_encryption_marker_returns_none(isolated, monkeypatch):
+    monkeypatch.setattr(isolated, "_is_windows", lambda: False)
+    p = isolated.token_path("ag")
+    p.parent.mkdir(parents=True, exist_ok=True)
+    p.write_text(
+        json.dumps(
+            {"version": 1, "service": "ag", "encryption": "unknown", "secret": "c2VjcmV0"}
+        ),
+        encoding="utf-8",
+    )
+    assert isolated.read_token("ag") is None

{oed_cli-0.1.4 → oed_cli-0.1.6}/tests/test_dynamic.py

@@ -153,6 +153,14 @@ def patched(monkeypatch):
     monkeypatch.setattr(dyn, "fetch_discovery", lambda **_: fake_feed)
     monkeypatch.setattr(dyn, "fetch_service_spec", lambda svc, **_: SAMPLE_SPEC)
 
+    # main.py binds fetch_service_spec by value at import time, so rebind it
+    # here too — otherwise these tests only pass if main happens to be imported
+    # after the dyn patches above (order-dependent when other test files import
+    # main first).
+    from oed_cli import main as main_mod
+
+    monkeypatch.setattr(main_mod, "fetch_service_spec", lambda svc, **_: SAMPLE_SPEC)
+
     # Stub http request so we can verify URL building without going to network
 
     captured = {}
@@ -518,8 +526,9 @@ def test_call_operation_post_sends_body(patched):
 
 
 def test_call_operation_forum_sends_api_headers(patched):
-    """Forum (Discourse) requests carry the Api-Key / Api-Username sentinels
-    on the real request and in the dry-run view."""
+    """Forum (Discourse) requests carry the Api-Key / Api-Username placeholder
+    headers on the real request and in the dry-run view — the gateway converts
+    them, so oed must send them or the call is rejected."""
 
     from oed_cli.dynamic import operations_table
     from oed_cli.invoke import call_operation
@@ -538,6 +547,24 @@ def test_call_operation_forum_sends_api_headers(patched):
     assert dry["request"]["headers"]["Api-Username"] == "oed-placeholder"
 
 
+def test_call_operation_rejects_gateway_managed_params(patched):
+    """Api-Key / Api-Username are injected by the gateway; passing them via
+    params is refused with a hint instead of being silently forwarded."""
+
+    from oed_cli.dynamic import operations_table
+    from oed_cli.errors import UserError
+    from oed_cli.invoke import call_operation
+
+    table = operations_table(SAMPLE_SPEC, "forum", base_url="https://apig.osinfra.cn")
+    op = table["API_getSoftwarePackage"]
+
+    with pytest.raises(UserError) as excinfo:
+        call_operation(op, params={"id": "1", "Api-Key": "super-secret"})
+    err = excinfo.value.to_dict()
+    assert err["error"] == "gateway_managed_param"
+    assert "injected by the gateway" in err["message"]
+
+
 def test_call_operation_non_forum_omits_api_headers(patched):
     """Non-forum services get no extra auth headers."""
 

{oed_cli-0.1.4 → oed_cli-0.1.6}/tests/test_invoke.py

@@ -198,3 +198,100 @@ def test_ag_dry_run_masks_stored_token(captured):
     dry = call_operation(op, dry_run=True)
     assert dry["request"]["query"]["access_token"] == "<stored>"
     assert "super-secret-token" not in str(dry)
+
+
+# ── request-body visibility & the --params-vs--json trap ────────────────────
+# Regression for the forum createTopicPostPM incident: the gateway spec marks
+# body fields required at the *schema* level but never sets requestBody.required,
+# so body_required=False and old help hid the body entirely while still showing
+# a --params example — which silently drops body fields (body: null → 400).
+
+BODY_SPEC = {
+    "openapi": "3.0.3",
+    "info": {"title": "forum", "version": "1.0.0"},
+    "paths": {
+        "/posts": {
+            "post": {
+                "summary": "create a topic post",
+                "operationId": "createTopicPostPM",
+                "requestBody": {
+                    "content": {
+                        "application/json": {
+                            "schema": {
+                                "type": "object",
+                                "required": ["raw"],
+                                "properties": {
+                                    "title": {"type": "string"},
+                                    "raw": {"type": "string"},
+                                },
+                            }
+                        }
+                    }
+                },
+            }
+        },
+        "/plain": {
+            "get": {"summary": "no params, no body", "operationId": "getPlain", "parameters": []},
+        },
+    },
+}
+
+
+def _body_op(name: str):
+    from oed_cli.dynamic import operations_table
+
+    return operations_table(BODY_SPEC, "forum", base_url="https://apig.osinfra.cn")[name]
+
+
+def test_help_exposes_body_when_not_marked_required():
+    """A body present but not marked requestBody.required still surfaces in help."""
+    from types import SimpleNamespace
+
+    from oed_cli.invoke import describe_operation_help
+
+    op = _body_op("createTopicPostPM")
+    svc = SimpleNamespace(name="openeuler/forum", service_name="forum", title="forum")
+    doc = describe_operation_help(op, svc)
+    assert doc["has_body"] is True
+    assert doc["body_required"] is False
+    fields = {f["name"]: f for f in doc["body_required_fields"]}
+    assert set(fields) == {"title", "raw"}
+    assert fields["raw"]["required"] is True
+    assert fields["title"]["required"] is False
+    assert "title" in doc["body_schema"]["properties"]
+    assert "--json" in doc["usage"]
+
+
+def test_body_only_op_usage_uses_json_not_params():
+    from oed_cli.invoke import _usage_examples
+
+    examples = _usage_examples(_body_op("createTopicPostPM"))
+    assert examples and "--json" in examples[0]
+    assert all("--params" not in ex for ex in examples)
+
+
+def test_no_params_no_body_usage_is_dry_run():
+    from oed_cli.invoke import _usage_example, _usage_examples
+
+    op = _body_op("getPlain")
+    assert _usage_example(op) == "oed <service> getPlain [--dry-run]"
+    assert _usage_examples(op) == ["oed <service> getPlain [--dry-run]"]
+
+
+def test_body_fields_via_params_raises_hint(captured):
+    from oed_cli.errors import UserError
+    from oed_cli.invoke import call_operation
+
+    op = _body_op("createTopicPostPM")
+    with pytest.raises(UserError) as exc:
+        call_operation(op, params={"title": "hi", "raw": "body"})
+    assert exc.value.kind == "body_fields_via_params"
+    assert "--json" in exc.value.hint
+
+
+def test_body_fields_via_params_ok_when_json_passed(captured):
+    from oed_cli.invoke import call_operation
+
+    op = _body_op("createTopicPostPM")
+    call_operation(op, params={"title": "hi"}, body={"raw": "body"})
+    assert captured["body"] == {"raw": "body"}