pipecatcloud 0.4.0__tar.gz → 0.4.1__tar.gz

{pipecatcloud-0.4.0 → pipecatcloud-0.4.1}/CHANGELOG.md

@@ -5,6 +5,39 @@ All notable changes to **Pipecat Cloud** will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.4.1] - 2026-03-30
+
+### Added
+
+- **Personal Access Token (PAT) support**: Authenticate with the CLI using a
+  PAT instead of interactive OAuth login. Set `PIPECAT_TOKEN=pcc_pat_...` as an
+  environment variable, or run `pcc auth use-pat <token>` to store it to config.
+  PATs work with all CLI commands and inherit the user's org memberships.
+
+- `pcc auth use-pat` command: Validates a PAT against the API and stores it for
+  persistent use without needing an environment variable.
+
+- `pcc auth whoami` now shows the current auth method (PAT or OAuth).
+
+### Changed
+
+- **OAuth2 authentication**: `pcc auth login` now uses industry-standard
+  OAuth2 Authorization Code + PKCE, replacing the custom device-code flow.
+  Tokens auto-refresh transparently — no more "please run `pcc auth login`"
+  interruptions.
+
+- `pcc auth logout` now revokes tokens server-side. Previously, logout only
+  deleted local credentials and the token remained valid until expiry.
+
+- `pcc auth whoami` now displays the user's email address instead of the
+  internal user ID.
+
+### Fixed
+
+- Credentials file with overly permissive permissions is now automatically
+  repaired to 600 instead of issuing a suppressible warning. If repair fails,
+  the CLI refuses to load the token.
+
 ## [0.4.0] - 2026-03-29
 
 ### Added

{pipecatcloud-0.4.0 → pipecatcloud-0.4.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pipecatcloud
-Version: 0.4.0
+Version: 0.4.1
 Summary: Cloud hosting for Pipecat AI applications
 License: BSD 2-Clause License
 Project-URL: Website, https://docs.pipecat.daily.co/

{pipecatcloud-0.4.0 → pipecatcloud-0.4.1}/src/pipecatcloud/api.py

@@ -5,6 +5,7 @@
 #
 
 import json
+import time
 from functools import wraps
 from typing import Callable, List, Optional, Union
 
@@ -52,6 +53,62 @@ class _API:
             return {}
         return {"Authorization": f"Bearer {override_token or self.token}"}
 
+    def _is_pat(self) -> bool:
+        """Check if the current token is a Personal Access Token."""
+        return bool(self.token and self.token.startswith("pcc_pat_"))
+
+    def _is_token_expired(self) -> bool:
+        """Check if the current OAuth token is near expiry.
+
+        Returns False for PATs (they don't expire via OAuth) and for
+        non-OAuth tokens (no token_expires_at stored).
+        """
+        if self._is_pat():
+            return False
+
+        from pipecatcloud.cli.config import config as cli_config
+
+        expires_at = cli_config.get("token_expires_at")
+        if expires_at is None:
+            return False
+        # Refresh 60 seconds before actual expiry to avoid race conditions
+        return time.time() > (float(expires_at) - 60)
+
+    async def _refresh_oauth_token(self) -> Optional[str]:
+        """Refresh the OAuth access token using the stored refresh token.
+
+        Updates both the on-disk config and the in-memory token on this API
+        instance. Returns the new access token, or None if refresh failed
+        (in which case the request will proceed with the expired token and
+        the server will return 401, prompting re-login).
+        """
+        from pipecatcloud.cli.config import config as cli_config, update_user_config
+
+        # Inline import: auth.py → cli/api.py → api.py creates a circular
+        # dependency at module load time. Importing here (at call time)
+        # breaks the cycle.
+        from pipecatcloud.cli.commands.auth import refresh_access_token
+
+        refresh_token = cli_config.get("refresh_token")
+        if not refresh_token:
+            return None
+
+        tokens = await refresh_access_token(refresh_token)
+        if not tokens:
+            return None
+
+        new_token = tokens["access_token"]
+        new_refresh = tokens.get("refresh_token", refresh_token)
+        expires_at = time.time() + tokens.get("expires_in", 86400)
+
+        update_user_config(
+            token=new_token,
+            refresh_token=new_refresh,
+            token_expires_at=expires_at,
+        )
+        self.token = new_token
+        return new_token
+
     async def _base_request(
         self,
         method: str,
@@ -61,6 +118,15 @@ class _API:
         not_found_is_empty: bool = False,
         override_token: Optional[str] = None,
     ) -> Optional[dict]:
+        # Auto-refresh expired OAuth tokens before making the request.
+        # Only runs for CLI usage (self.is_cli) and only when an OAuth
+        # refresh_token is stored (token_expires_at is set). Old device-code
+        # tokens are unaffected since _is_token_expired() returns False.
+        if self.is_cli and not override_token and self._is_token_expired():
+            new_token = await self._refresh_oauth_token()
+            if new_token is None:
+                logger.debug("Token refresh failed, proceeding with expired token")
+
         async with aiohttp.ClientSession() as session:
             logger.debug(f"Request: {method} {url} {params} {json}")