orchestra-cli 0.5.2__tar.gz → 0.5.3__tar.gz

{orchestra_cli-0.5.2 → orchestra_cli-0.5.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: orchestra-cli
-Version: 0.5.2
+Version: 0.5.3
 Summary: Orchestra CLI. Perform operations with Orchestra locally.
 Author-email: Orchestra Technologies <support@getorchestra.io>
 Requires-Python: >=3.10

{orchestra_cli-0.5.2 → orchestra_cli-0.5.3}/orchestra_cli/src/login.py

@@ -15,6 +15,7 @@ from ..utils.api import (
     api_client,
     fail_with_response,
     request_or_exit,
+    support_id_headers,
     token_response_to_credentials,
 )
 from ..utils.constants import get_base_url
@@ -83,6 +84,7 @@ def login():
     response = request_or_exit(
         httpx.get,
         f"{base_url}/.well-known/oauth-authorization-server",
+        headers=support_id_headers(),
         timeout=30,
     )
     if response.status_code != 200:
@@ -111,6 +113,7 @@ def login():
                 "response_types": ["code"],
                 "token_endpoint_auth_method": "none",
             },
+            headers=support_id_headers(),
             timeout=30,
         )
         if response.status_code not in (200, 201):
@@ -151,6 +154,7 @@ def login():
             "client_id": client_id,
             "code_verifier": verifier,
         },
+        headers=support_id_headers(),
         timeout=30,
     )
     if response.status_code != 200:

{orchestra_cli-0.5.2 → orchestra_cli-0.5.3}/orchestra_cli/src/migrate_pipeline.py

@@ -138,7 +138,7 @@ def _download_pipeline_yaml(
 
     response = request_or_exit(
         client.get,
-        get_api_url("pipeline/data"),
+        get_api_url("pipelines/data"),
         params=params,
     )
     if response.status_code != 200:

{orchestra_cli-0.5.2 → orchestra_cli-0.5.3}/orchestra_cli/src/run_pipeline.py

@@ -18,6 +18,7 @@ from ..utils.api import (
     fail_with_response,
     request_or_exit,
     require_credential,
+    response_error_text,
 )
 from ..utils.constants import get_api_url, get_base_url
 from ..utils.git import GitAction, confirm_git_warnings_or_exit, prepare_git_backed_run_target
@@ -163,7 +164,7 @@ def _load_pipeline_data_for_task_resolution(
 
     response = request_or_exit(
         client.get,
-        get_api_url("pipeline/data"),
+        get_api_url("pipelines/data"),
         params=selector.to_payload(),
     )
     if response.status_code != 200:
@@ -535,7 +536,7 @@ def _poll_until_terminal(
                 poll_status_display = None
                 typer.echo(red(f"❌ Status check failed with HTTP {status_resp.status_code}"))
                 try:
-                    typer.echo(yellow(indent_message(status_resp.text)))
+                    typer.echo(yellow(indent_message(response_error_text(status_resp))))
                 except Exception:
                     pass
                 raise typer.Exit(code=1)

{orchestra_cli-0.5.2 → orchestra_cli-0.5.3}/orchestra_cli/src/validate_pipeline.py

@@ -6,7 +6,7 @@ import httpx
 import typer
 import yaml
 
-from ..utils.api import request_or_exit
+from ..utils.api import request_or_exit, response_error_text, support_id_headers
 from ..utils.constants import get_api_url
 from ..utils.styling import bold, green, indent_message, red, yellow
 from ..utils.yaml_loader import echo_invalid_yaml, exit_if_unsupported_extension, load_yaml
@@ -67,7 +67,13 @@ def validate(
         echo_invalid_yaml(file, err)
         raise typer.Exit(code=1)
 
-    response = request_or_exit(httpx.post, get_api_url("pipelines/schema"), json=data, timeout=10)
+    response = request_or_exit(
+        httpx.post,
+        get_api_url("pipelines/schema"),
+        json=data,
+        headers=support_id_headers(),
+        timeout=10,
+    )
 
     if response.status_code == 200:
         typer.echo(green("✅ Validation passed!"))
@@ -82,5 +88,5 @@ def validate(
         else:
             typer.echo(errors)
     except Exception:
-        typer.echo(response.text)
+        typer.echo(response_error_text(response))
     raise typer.Exit(code=1)

{orchestra_cli-0.5.2 → orchestra_cli-0.5.3}/orchestra_cli/tests/test_migrate_pipeline.py

@@ -38,7 +38,7 @@ def test_migrate_success_uses_default_branch_without_working_branch(
     )
     httpx_mock.add_response(
         method="GET",
-        url="https://app.getorchestra.io/api/engine/public/pipeline/data?alias=demo&version=3",
+        url="https://app.getorchestra.io/api/engine/public/pipelines/data?alias=demo&version=3",
         text="name: remote\nversion: 1\n",
         status_code=200,
     )
@@ -100,7 +100,7 @@ def test_migrate_prompts_for_latest_version_and_prints_compare_link(
     )
     httpx_mock.add_response(
         method="GET",
-        url="https://app.getorchestra.io/api/engine/public/pipeline/data?alias=demo&version=5",
+        url="https://app.getorchestra.io/api/engine/public/pipelines/data?alias=demo&version=5",
         text="name: remote\n",
         status_code=200,
     )
@@ -170,7 +170,7 @@ def test_migrate_uses_local_file_when_conflict_choice_is_local(
     )
     httpx_mock.add_response(
         method="GET",
-        url="https://app.getorchestra.io/api/engine/public/pipeline/data?alias=demo&version=1",
+        url="https://app.getorchestra.io/api/engine/public/pipelines/data?alias=demo&version=1",
         text="name: remote\n",
         status_code=200,
     )
@@ -271,7 +271,7 @@ def test_migrate_branch_protection_offer_retries_with_suggested_branch(
     )
     httpx_mock.add_response(
         method="GET",
-        url="https://app.getorchestra.io/api/engine/public/pipeline/data?alias=demo&version=1",
+        url="https://app.getorchestra.io/api/engine/public/pipelines/data?alias=demo&version=1",
         text="name: remote\n",
         status_code=200,
     )
@@ -337,7 +337,7 @@ def test_migrate_accepts_nonexistent_parent_directory_inside_repo(
     )
     httpx_mock.add_response(
         method="GET",
-        url="https://app.getorchestra.io/api/engine/public/pipeline/data?alias=demo&version=1",
+        url="https://app.getorchestra.io/api/engine/public/pipelines/data?alias=demo&version=1",
         text="name: remote\n",
         status_code=200,
     )
@@ -398,7 +398,7 @@ def test_migrate_force_skips_version_prompt(monkeypatch, tmp_path: Path, httpx_m
     )
     httpx_mock.add_response(
         method="GET",
-        url="https://app.getorchestra.io/api/engine/public/pipeline/data?alias=demo&version=2",
+        url="https://app.getorchestra.io/api/engine/public/pipelines/data?alias=demo&version=2",
         text="name: remote\n",
         status_code=200,
     )
@@ -469,7 +469,7 @@ def test_migrate_force_skips_branch_recovery_prompt(
     )
     httpx_mock.add_response(
         method="GET",
-        url="https://app.getorchestra.io/api/engine/public/pipeline/data?alias=demo&version=1",
+        url="https://app.getorchestra.io/api/engine/public/pipelines/data?alias=demo&version=1",
         text="name: remote\n",
         status_code=200,
     )
@@ -536,7 +536,7 @@ def test_migrate_fails_before_writing_when_reprompted_path_is_outside_repo(
     )
     httpx_mock.add_response(
         method="GET",
-        url="https://app.getorchestra.io/api/engine/public/pipeline/data?alias=demo&version=1",
+        url="https://app.getorchestra.io/api/engine/public/pipelines/data?alias=demo&version=1",
         text="name: remote\n",
         status_code=200,
     )

{orchestra_cli-0.5.2 → orchestra_cli-0.5.3}/orchestra_cli/tests/test_run_pipeline.py

@@ -288,7 +288,7 @@ def test_run_with_task_and_overrides(httpx_mock: HTTPXMock, monkeypatch, tmp_pat
 
     httpx_mock.add_response(
         method="GET",
-        url="https://app.getorchestra.io/api/engine/public/pipeline/data?alias=demo",
+        url="https://app.getorchestra.io/api/engine/public/pipelines/data?alias=demo",
         text="\n".join(
             [
                 "name: demo",
@@ -366,7 +366,7 @@ def test_run_task_name_resolves_from_remote_pipeline_data(
 
     httpx_mock.add_response(
         method="GET",
-        url="https://app.getorchestra.io/api/engine/public/pipeline/data?alias=demo",
+        url="https://app.getorchestra.io/api/engine/public/pipelines/data?alias=demo",
         text="\n".join(
             [
                 "name: demo",
@@ -419,7 +419,7 @@ def test_run_task_name_resolves_from_remote_json_pipeline_definition(
 
     httpx_mock.add_response(
         method="GET",
-        url="https://app.getorchestra.io/api/engine/public/pipeline/data?alias=demo",
+        url="https://app.getorchestra.io/api/engine/public/pipelines/data?alias=demo",
         json={
             "name": "demo",
             "pipeline": {
@@ -471,7 +471,7 @@ def test_run_task_name_ignores_metadata_only_wrapper_and_uses_top_level_pipeline
 
     httpx_mock.add_response(
         method="GET",
-        url="https://app.getorchestra.io/api/engine/public/pipeline/data?alias=demo",
+        url="https://app.getorchestra.io/api/engine/public/pipelines/data?alias=demo",
         json={
             "data": {"page": 1, "total": 1},
             "pipeline": {

{orchestra_cli-0.5.2 → orchestra_cli-0.5.3}/orchestra_cli/tests/utils/test_api.py

@@ -1,3 +1,4 @@
+import re
 import time
 from types import SimpleNamespace
 from urllib.parse import parse_qs
@@ -8,7 +9,7 @@ import typer
 from pytest_httpx import HTTPXMock
 
 import orchestra_cli.utils.api as api_module
-from orchestra_cli.utils.api import require_credential
+from orchestra_cli.utils.api import SUPPORT_ID_HEADER, api_client, require_credential
 from orchestra_cli.utils.credentials import load_credentials, save_credentials
 
 TOKEN_ENDPOINT = "https://app.getorchestra.io/oauth/token"
@@ -125,6 +126,25 @@ def test_refresh_server_error_is_not_reported_as_expired_login(httpx_mock: HTTPX
     assert "expired" not in output
 
 
+def test_waf_blocked_refresh_keeps_login_and_shows_support_id(httpx_mock: HTTPXMock, capsys):
+    cache_login(time.time() - 1)
+    httpx_mock.add_response(
+        method="POST",
+        url=TOKEN_ENDPOINT,
+        status_code=403,
+        headers={"content-type": "text/html"},
+        text="<html><head><title>403 Forbidden</title></head></html>",
+    )
+
+    with pytest.raises(typer.Exit):
+        require_credential()
+    request = httpx_mock.get_request(url=TOKEN_ENDPOINT)
+    assert request is not None
+    support_id = request.headers[SUPPORT_ID_HEADER]
+    assert f"Contact Orchestra support with ID: {support_id}" in capsys.readouterr().out
+    assert load_credentials() is not None
+
+
 def test_rejected_refresh_uses_token_another_process_just_rotated_in(httpx_mock: HTTPXMock):
     cache_login(time.time() - 1)
 
@@ -227,3 +247,43 @@ def test_other_errors_get_no_account_hint(response, capsys):
     api_module.fail_with_response("Fetch pipelines", response)
 
     assert ACCOUNT_HINT not in capsys.readouterr().out
+
+
+def test_requests_carry_a_support_id(httpx_mock: HTTPXMock, monkeypatch):
+    monkeypatch.setenv("ORCHESTRA_API_KEY", "account-key")
+    httpx_mock.add_response(url="https://app.getorchestra.io/api/engine/public/pipelines")
+
+    api_client().get("https://app.getorchestra.io/api/engine/public/pipelines")
+
+    request = httpx_mock.get_request()
+    assert request is not None
+    assert re.fullmatch(r"[0-9a-f]{12}", request.headers[SUPPORT_ID_HEADER])
+
+
+def test_waf_block_shows_support_id_instead_of_its_page(capsys):
+    response = httpx.Response(
+        403,
+        headers={"content-type": "text/html"},
+        text="<html><head><title>403 Forbidden</title></head></html>",
+        request=httpx.Request(
+            "GET",
+            "https://app.getorchestra.io",
+            headers={SUPPORT_ID_HEADER: "0123456789ab"},
+        ),
+    )
+
+    api_module.fail_with_response("Fetch pipelines", response)
+
+    out = capsys.readouterr().out
+    assert "Your request was blocked. Contact Orchestra support with ID: 0123456789ab" in out
+    assert "<html>" not in out
+
+
+def test_json_403_is_not_treated_as_waf_block(capsys):
+    response = httpx.Response(403, json={"detail": "Not allowed"})
+
+    api_module.fail_with_response("Fetch pipelines", response)
+
+    out = capsys.readouterr().out
+    assert "Not allowed" in out
+    assert "blocked" not in out

{orchestra_cli-0.5.2 → orchestra_cli-0.5.3}/orchestra_cli/utils/api.py

@@ -8,6 +8,7 @@ transport errors, or hand-roll JSON-vs-text error rendering themselves.
 
 import json
 import os
+import secrets
 import time
 from collections.abc import Callable
 from typing import Any
@@ -22,6 +23,8 @@ from .styling import indent_message, red, yellow
 # Refresh this long before expiry so a token cannot lapse mid-request.
 _REFRESH_MARGIN_SECONDS = 60
 
+SUPPORT_ID_HEADER = "X-Orchestra-Support-Id"
+
 
 def account_id_option() -> Any:
     """Return the ``--account-id`` option, whose value a command passes to ``api_client()``."""
@@ -33,6 +36,11 @@ def account_id_option() -> Any:
     )
 
 
+def support_id_headers() -> dict[str, str]:
+    """Tag a request with a fresh ID that support can look up in the WAF logs."""
+    return {SUPPORT_ID_HEADER: secrets.token_hex(6)}
+
+
 def require_credential() -> str:
     """Return the bearer credential for API calls, or exit with code 1.
 
@@ -77,6 +85,7 @@ def _refresh(credentials: dict) -> dict | None:
                 "refresh_token": credentials["refresh_token"],
                 "client_id": credentials["client_id"],
             },
+            headers=support_id_headers(),
             timeout=30,
         )
     except httpx.HTTPError as e:
@@ -85,7 +94,7 @@ def _refresh(credentials: dict) -> dict | None:
             return credentials
         typer.echo(red(f"HTTP request failed: {e}"))
         raise typer.Exit(code=1)
-    if 400 <= response.status_code < 500:
+    if 400 <= response.status_code < 500 and not is_waf_block(response):
         # Another CLI process may have refreshed first, rotating the refresh token
         # this one sent; its saved result is then still good. Otherwise the login
         # itself is unusable (invalid_grant, or a registration that has since expired)
@@ -128,6 +137,7 @@ class _OrchestraAuth(httpx.Auth):
         self._scoped = scoped
 
     def auth_flow(self, request: httpx.Request):
+        request.headers.update(support_id_headers())
         request.headers["Authorization"] = f"Bearer {require_credential()}"
         # After require_credential(), which drops a dead login, so a key never gets its default.
         if self._scoped:
@@ -172,8 +182,22 @@ def echo_response_error_body(response: httpx.Response) -> None:
         return
     except Exception:
         pass
-    if response.text:
-        typer.echo(yellow(indent_message(response.text)))
+    text = response_error_text(response)
+    if text:
+        typer.echo(yellow(indent_message(text)))
+
+
+def is_waf_block(response: httpx.Response) -> bool:
+    """Orchestra's own 403s are JSON, so an HTML 403 is the WAF's block page."""
+    return response.status_code == 403 and "text/html" in response.headers.get("content-type", "")
+
+
+def response_error_text(response: httpx.Response) -> str:
+    """Return the body, or the support ID to quote if the WAF blocked the request."""
+    if is_waf_block(response):
+        support_id = response.request.headers.get(SUPPORT_ID_HEADER)
+        return f"Your request was blocked. Contact Orchestra support with ID: {support_id}"
+    return response.text
 
 
 def fail_with_response(action: str, response: httpx.Response) -> typer.Exit:

{orchestra_cli-0.5.2 → orchestra_cli-0.5.3}/orchestra_cli/utils/yaml_loader.py

@@ -13,6 +13,7 @@ import httpx
 import typer
 import yaml
 
+from .api import response_error_text, support_id_headers
 from .constants import get_api_url
 from .styling import indent_message, red, yellow
 
@@ -114,7 +115,12 @@ def load_yaml(file: Path) -> tuple[dict | None, str | None]:
 def validate_yaml_with_api(data: dict) -> tuple[bool, str | None]:
     """POST a YAML payload to the schema endpoint and return ``(ok, err_message)``."""
     try:
-        response = httpx.post(get_api_url("pipelines/schema"), json=data, timeout=15)
+        response = httpx.post(
+            get_api_url("pipelines/schema"),
+            json=data,
+            headers=support_id_headers(),
+            timeout=15,
+        )
     except Exception as e:
         return False, f"HTTP request failed: {e}"
 
@@ -124,7 +130,7 @@ def validate_yaml_with_api(data: dict) -> tuple[bool, str | None]:
         errors = response.json()
         return False, json.dumps(errors, indent=2)
     except Exception:
-        return False, response.text
+        return False, response_error_text(response)
 
 
 def load_validated_pipeline_data(path: Path) -> dict:

{orchestra_cli-0.5.2 → orchestra_cli-0.5.3}/orchestra_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: orchestra-cli
-Version: 0.5.2
+Version: 0.5.3
 Summary: Orchestra CLI. Perform operations with Orchestra locally.
 Author-email: Orchestra Technologies <support@getorchestra.io>
 Requires-Python: >=3.10

{orchestra_cli-0.5.2 → orchestra_cli-0.5.3}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "orchestra-cli"
-version = "0.5.2"
+version = "0.5.3"
 description = "Orchestra CLI. Perform operations with Orchestra locally."
 readme = "README.md"
 authors = [