pql-test 0.1.11__py3-none-any.whl

pql_test/__init__.py

@@ -0,0 +1,33 @@
+"""pql_test package — DAX test runner for PBIP semantic models."""
+
+from __future__ import annotations
+
+__version__ = "0.1.0"
+
+# Expose main modules for easier imports
+from pql_test.runner import (
+    Environment,
+    ModelIdentifier,
+    PqlTest,
+    TestResult,
+    TestSuite,
+    XmlaConnectionOptions,
+    parse_model_identifier,
+    retrieve_tests,
+    retrieve_test_by_name,
+    run_tests_from_model,
+)
+
+__all__ = [
+    "__version__",
+    "Environment",
+    "ModelIdentifier",
+    "PqlTest",
+    "TestResult",
+    "TestSuite",
+    "XmlaConnectionOptions",
+    "parse_model_identifier",
+    "retrieve_tests",
+    "retrieve_test_by_name",
+    "run_tests_from_model",
+]

pql_test/auth/__init__.py

@@ -0,0 +1,37 @@
+"""
+pql_test.auth package — Authentication management for pql-test.
+
+This package provides:
+- Secure credential storage using platform keyring
+- Token acquisition via azure.identity
+- Support for multiple authentication methods (interactive, service principal, managed identity)
+- Backward compatibility with environment variables and CLI flags
+"""
+
+from __future__ import annotations
+
+from pql_test.auth.cloud_config import CloudConfig
+from pql_test.auth.exceptions import (
+    AuthenticationError,
+    CredentialConfigError,
+    CredentialStorageError,
+    TokenAcquisitionError,
+)
+from pql_test.auth.factory import CredentialFactory
+from pql_test.auth.manager import AuthenticationManager
+from pql_test.auth.models import AuthMethod, AuthStatus, CredentialConfig
+from pql_test.auth.store import CredentialStore
+
+__all__ = [
+    "AuthenticationManager",
+    "CredentialConfig",
+    "AuthStatus",
+    "AuthMethod",
+    "CloudConfig",
+    "CredentialStore",
+    "CredentialFactory",
+    "AuthenticationError",
+    "CredentialStorageError",
+    "TokenAcquisitionError",
+    "CredentialConfigError",
+]

pql_test/auth/cloud_config.py

@@ -0,0 +1,63 @@
+"""
+Cloud environment configuration for sovereign clouds.
+"""
+
+from __future__ import annotations
+
+
+class CloudConfig:
+    """Cloud environment configuration for Azure sovereign clouds."""
+
+    ENVIRONMENTS = {
+        "Public": {
+            "authority": "https://login.microsoftonline.com",
+            "resource": "https://analysis.windows.net/powerbi/api",
+        },
+        "USGov": {
+            "authority": "https://login.microsoftonline.us",
+            "resource": "https://analysis.usgovcloudapi.net/powerbi/api",
+        },
+        "USGovHigh": {
+            "authority": "https://login.microsoftonline.us",
+            "resource": "https://high.analysis.usgovcloudapi.net/powerbi/api",
+        },
+        "USGovDoD": {
+            "authority": "https://login.microsoftonline.us",
+            "resource": "https://mil.analysis.usgovcloudapi.net/powerbi/api",
+        },
+        "Germany": {
+            "authority": "https://login.microsoftonline.de",
+            "resource": "https://analysis.cloudapi.de/powerbi/api",
+        },
+        "China": {
+            "authority": "https://login.chinacloudapi.cn",
+            "resource": "https://analysis.chinacloudapi.cn/powerbi/api",
+        },
+    }
+
+    def get_authority(self, environment: str) -> str:
+        """
+        Get Azure AD authority URL for environment.
+
+        Args:
+            environment: Cloud environment name
+
+        Returns:
+            Authority URL for the specified environment (defaults to Public)
+        """
+        env_config = self.ENVIRONMENTS.get(environment, self.ENVIRONMENTS["Public"])
+        return env_config["authority"]
+
+    def get_resource_scope(self, environment: str) -> str:
+        """
+        Get Power BI resource scope for environment.
+
+        Args:
+            environment: Cloud environment name
+
+        Returns:
+            Resource scope URL with /.default suffix
+        """
+        env_config = self.ENVIRONMENTS.get(environment, self.ENVIRONMENTS["Public"])
+        resource = env_config["resource"]
+        return f"{resource}/.default"

pql_test/auth/exceptions.py

@@ -0,0 +1,29 @@
+"""
+Exceptions for authentication operations.
+"""
+
+from __future__ import annotations
+
+
+class AuthenticationError(Exception):
+    """Base class for authentication errors."""
+
+    pass
+
+
+class CredentialStorageError(AuthenticationError):
+    """Error storing or retrieving credentials from keyring."""
+
+    pass
+
+
+class TokenAcquisitionError(AuthenticationError):
+    """Error acquiring access token from Azure AD."""
+
+    pass
+
+
+class CredentialConfigError(AuthenticationError):
+    """Invalid credential configuration."""
+
+    pass

pql_test/auth/factory.py

@@ -0,0 +1,211 @@
+"""
+Credential factory for creating azure.identity credential objects.
+"""
+
+from __future__ import annotations
+
+import os
+from typing import TYPE_CHECKING
+
+try:
+    from azure.identity import (
+        AuthenticationRecord,
+        CertificateCredential,
+        ClientAssertionCredential,
+        ClientSecretCredential,
+        InteractiveBrowserCredential,
+        ManagedIdentityCredential,
+        TokenCachePersistenceOptions,
+    )
+    from azure.core.credentials import TokenCredential
+    HAS_AZURE_IDENTITY = True
+except ImportError:
+    HAS_AZURE_IDENTITY = False
+    AuthenticationRecord = None  # type: ignore[assignment,misc]
+    TokenCachePersistenceOptions = None  # type: ignore[assignment,misc]
+    if TYPE_CHECKING:
+        from azure.core.credentials import TokenCredential
+
+from pql_test.auth.cloud_config import CloudConfig
+from pql_test.auth.exceptions import CredentialConfigError
+from pql_test.auth.models import AuthMethod, CredentialConfig
+
+
+# ---------------------------------------------------------------------------
+# Default interactive client_id
+# ---------------------------------------------------------------------------
+#
+# Power BI's XMLA endpoint only accepts bearer tokens whose `appid` claim
+# matches a client app the gateway trusts.  azure-identity's
+# InteractiveBrowserCredential defaults to the Azure CLI public client
+# (`04b07795-…`), which Power BI XMLA rejects with
+# `Authentication failed for all authenticators`.  Verified empirically:
+# with this client_id removed, a fresh interactive sign-in (cleared cache,
+# no .env) fails against XMLA; with it present, it succeeds.
+#
+# The pql-test project registers its own multi-tenant Azure AD application
+# (public client, delegated Power BI permissions) and ships its client_id
+# here as the default for the INTERACTIVE auth method.  End users grant
+# consent on first sign-in and never have to register their own app.
+#
+# Forks / enterprises that have registered their own pql-test equivalent
+# can override via the PQL_TEST_INTERACTIVE_CLIENT_ID env var without
+# touching the source.
+PQL_TEST_DEFAULT_INTERACTIVE_CLIENT_ID = "e6341730-1a0b-4a9e-9462-a435d224b5fd"
+
+
+def _resolve_interactive_client_id(config_client_id: str | None) -> str:
+    """Resolution order: explicit config > env-var override > bundled default."""
+    if config_client_id:
+        return config_client_id
+    return (
+        os.environ.get("PQL_TEST_INTERACTIVE_CLIENT_ID")
+        or PQL_TEST_DEFAULT_INTERACTIVE_CLIENT_ID
+    )
+
+
+def _persistent_token_cache_options():  # type: ignore[no-untyped-def]
+    """Build ``TokenCachePersistenceOptions`` so MSAL writes tokens to the
+    platform's secure store (Windows DPAPI / macOS Keychain / Linux
+    libsecret).  Without this, every CLI invocation builds a fresh credential
+    with a cold cache and triggers a new interactive sign-in — the user
+    sees a browser tab pop on every ``pql-test`` command.
+
+    Defaults to encrypted-only storage.  Set
+    ``PQL_TEST_ALLOW_UNENCRYPTED_TOKEN_CACHE=1`` on headless Linux without
+    libsecret to opt into unencrypted file-backed caching.
+
+    Returns ``None`` if azure-identity is missing — the caller treats that
+    as "no persistence configured" which falls back to azure-identity's
+    default in-memory cache.
+    """
+    if TokenCachePersistenceOptions is None:
+        return None
+    allow_unencrypted = os.environ.get(
+        "PQL_TEST_ALLOW_UNENCRYPTED_TOKEN_CACHE", ""
+    ).lower() in ("1", "true", "yes")
+    return TokenCachePersistenceOptions(
+        name="pql-test",
+        allow_unencrypted_storage=allow_unencrypted,
+    )
+
+
+class CredentialFactory:
+    """Factory for creating azure.identity credential objects from configuration."""
+
+    def create(
+        self, config: CredentialConfig, cloud_config: CloudConfig
+    ) -> TokenCredential:
+        """
+        Create TokenCredential from configuration.
+
+        Args:
+            config: Credential configuration
+            cloud_config: Cloud environment configuration
+
+        Returns:
+            TokenCredential instance
+
+        Raises:
+            CredentialConfigError: If azure-identity not installed or config is invalid
+        """
+        if not HAS_AZURE_IDENTITY:
+            raise CredentialConfigError(
+                "azure-identity is required for authentication. "
+                "Install with: pip install azure-identity"
+            )
+
+        authority = cloud_config.get_authority(config.environment)
+        cache_opts = _persistent_token_cache_options()
+
+        if config.method == AuthMethod.INTERACTIVE:
+            # Replay the AuthenticationRecord captured on first sign-in so
+            # azure-identity can look up the cached token by homeAccountId
+            # instead of triggering a fresh browser flow.  Without this,
+            # cache_persistence_options writes a cache that's never read.
+            record = None
+            if config.authentication_record_json and AuthenticationRecord is not None:
+                try:
+                    record = AuthenticationRecord.deserialize(
+                        config.authentication_record_json
+                    )
+                except Exception:  # noqa: BLE001
+                    # Corrupted record — fall through to interactive prompt.
+                    record = None
+
+            # When a record is supplied, azure-identity reads tenant_id,
+            # authority, and client_id from it directly — passing those
+            # kwargs ALSO causes a "got multiple values for keyword argument"
+            # TypeError inside MsalCredential.__init__.  Only pass them on
+            # the first-login path where we have no record.
+            if record is not None:
+                return InteractiveBrowserCredential(
+                    cache_persistence_options=cache_opts,
+                    authentication_record=record,
+                )
+            return InteractiveBrowserCredential(
+                tenant_id=config.tenant_id,
+                authority=authority,
+                client_id=_resolve_interactive_client_id(config.client_id),
+                cache_persistence_options=cache_opts,
+            )
+
+        elif config.method == AuthMethod.SERVICE_PRINCIPAL_SECRET:
+            if not all([config.tenant_id, config.client_id, config.client_secret]):
+                raise CredentialConfigError(
+                    "Service principal with secret requires tenant_id, client_id, and client_secret"
+                )
+            return ClientSecretCredential(
+                tenant_id=config.tenant_id,
+                client_id=config.client_id,
+                client_secret=config.client_secret,
+                authority=authority,
+                cache_persistence_options=cache_opts,
+            )
+
+        elif config.method == AuthMethod.SERVICE_PRINCIPAL_CERT:
+            if not all([config.tenant_id, config.client_id, config.certificate_path]):
+                raise CredentialConfigError(
+                    "Service principal with certificate requires tenant_id, client_id, and certificate_path"
+                )
+            return CertificateCredential(
+                tenant_id=config.tenant_id,
+                client_id=config.client_id,
+                certificate_path=config.certificate_path,
+                password=config.certificate_password,
+                authority=authority,
+                cache_persistence_options=cache_opts,
+            )
+
+        elif config.method == AuthMethod.SERVICE_PRINCIPAL_FEDERATED:
+            if not all([config.tenant_id, config.client_id, config.federated_token]):
+                raise CredentialConfigError(
+                    "Federated credential requires tenant_id, client_id, and federated_token"
+                )
+
+            # Note: azure-identity uses ClientAssertionCredential for federated tokens
+            def token_provider() -> str:
+                return config.federated_token or ""
+
+            return ClientAssertionCredential(
+                tenant_id=config.tenant_id,
+                client_id=config.client_id,
+                func=token_provider,
+                authority=authority,
+                cache_persistence_options=cache_opts,
+            )
+
+        elif config.method == AuthMethod.MANAGED_IDENTITY:
+            if config.use_system_assigned_identity:
+                return ManagedIdentityCredential()
+            else:
+                if not config.client_id:
+                    raise CredentialConfigError(
+                        "User-assigned managed identity requires client_id"
+                    )
+                return ManagedIdentityCredential(client_id=config.client_id)
+
+        else:
+            raise CredentialConfigError(
+                f"Unsupported authentication method: {config.method}"
+            )

pql_test/auth/manager.py

@@ -0,0 +1,124 @@
+"""
+Authentication manager — Main interface for authentication operations.
+"""
+
+from __future__ import annotations
+
+from typing import Optional
+
+try:
+    from azure.core.credentials import TokenCredential
+except ImportError:
+    TokenCredential = None  # type: ignore
+
+from pql_test.auth.cloud_config import CloudConfig
+from pql_test.auth.exceptions import TokenAcquisitionError
+from pql_test.auth.factory import CredentialFactory
+from pql_test.auth.models import AuthStatus, CredentialConfig
+from pql_test.auth.store import CredentialStore
+
+
+class AuthenticationManager:
+    """
+    Manages authentication for pql-test.
+
+    Handles credential storage, token acquisition, and authentication state.
+    Provides a unified interface for all authentication methods.
+    """
+
+    def __init__(self, namespace: str = "pql-test"):
+        """
+        Initialize authentication manager.
+
+        Args:
+            namespace: Keyring namespace for credential storage
+        """
+        self._store = CredentialStore(namespace)
+        self._factory = CredentialFactory()
+        self._cloud_config = CloudConfig()
+
+    def save_credential(self, config: CredentialConfig) -> None:
+        """
+        Save credential configuration to secure storage.
+
+        Args:
+            config: Credential configuration to store
+
+        Raises:
+            CredentialStorageError: If credential cannot be stored
+        """
+        self._store.save(config)
+
+    def get_credential(self) -> Optional[TokenCredential]:
+        """
+        Get credential from stored configuration.
+
+        Returns:
+            TokenCredential instance or None if not authenticated
+
+        Raises:
+            CredentialConfigError: If stored config is invalid
+        """
+        config = self._store.load()
+        if config is None:
+            return None
+
+        return self._factory.create(config, self._cloud_config)
+
+    def get_access_token(
+        self, scope: str = "https://analysis.windows.net/powerbi/api/.default"
+    ) -> Optional[str]:
+        """
+        Get access token for the given scope.
+
+        Args:
+            scope: OAuth2 scope for the token
+
+        Returns:
+            Access token string or None if not authenticated
+
+        Raises:
+            TokenAcquisitionError: If token acquisition fails
+        """
+        credential = self.get_credential()
+        if credential is None:
+            return None
+
+        try:
+            token_result = credential.get_token(scope)
+            return token_result.token
+        except Exception as e:
+            raise TokenAcquisitionError(
+                f"Failed to acquire access token: {e}"
+            ) from e
+
+    def clear_credential(self) -> None:
+        """
+        Clear stored credential configuration.
+
+        Raises:
+            CredentialStorageError: If credential cannot be cleared
+        """
+        self._store.delete()
+
+    def get_status(self) -> AuthStatus:
+        """
+        Get current authentication status.
+
+        Returns:
+            AuthStatus with current authentication state
+        """
+        config = self._store.load()
+
+        if config is None:
+            return AuthStatus(authenticated=False)
+
+        return AuthStatus(
+            authenticated=True,
+            method=config.method,
+            account_name=config.account_name,
+            tenant_id=config.tenant_id,
+            client_id=config.client_id,
+            environment=config.environment,
+            token_is_valid=False,  # TODO: Implement token validation
+        )

pql_test/auth/models.py

@@ -0,0 +1,133 @@
+"""
+Data models for authentication configuration and status.
+"""
+
+from __future__ import annotations
+
+import json
+from dataclasses import asdict, dataclass
+from datetime import datetime
+from enum import Enum
+from typing import Optional
+
+
+class AuthMethod(Enum):
+    """Supported authentication methods."""
+
+    INTERACTIVE = "interactive"
+    SERVICE_PRINCIPAL_SECRET = "service_principal_secret"
+    SERVICE_PRINCIPAL_CERT = "service_principal_cert"
+    SERVICE_PRINCIPAL_FEDERATED = "service_principal_federated"
+    MANAGED_IDENTITY = "managed_identity"
+
+
+@dataclass
+class CredentialConfig:
+    """
+    Credential configuration stored in keyring.
+
+    Attributes:
+        method: Authentication method
+        tenant_id: Azure AD tenant ID (optional for some methods)
+        client_id: Client/application ID
+        client_secret: Client secret (service principal with secret only)
+        certificate_path: Path to certificate file (certificate auth only)
+        certificate_password: Certificate password (encrypted cert only)
+        federated_token: Federated credential token (federated auth only)
+        use_system_assigned_identity: Use system-assigned managed identity
+        environment: Cloud environment (Public, USGov, etc.)
+        account_name: Display name for status output
+    """
+
+    method: AuthMethod
+    tenant_id: Optional[str] = None
+    client_id: Optional[str] = None
+    client_secret: Optional[str] = None
+    certificate_path: Optional[str] = None
+    certificate_password: Optional[str] = None
+    federated_token: Optional[str] = None
+    use_system_assigned_identity: bool = False
+    environment: str = "Public"
+    account_name: Optional[str] = None
+    # Serialized azure-identity AuthenticationRecord (JSON) — captured on
+    # interactive sign-in and replayed on subsequent runs so the persistent
+    # MSAL token cache can be looked up silently instead of triggering a
+    # fresh browser flow. Only populated for AuthMethod.INTERACTIVE.
+    authentication_record_json: Optional[str] = None
+
+    def to_dict(self) -> dict:
+        """
+        Serialize to dictionary.
+
+        Returns:
+            Dictionary representation with AuthMethod converted to string
+        """
+        data = asdict(self)
+        data["method"] = self.method.value
+        return data
+
+    def to_json(self) -> str:
+        """
+        Serialize to JSON string.
+
+        Returns:
+            JSON string representation
+        """
+        return json.dumps(self.to_dict())
+
+    @classmethod
+    def from_dict(cls, data: dict) -> CredentialConfig:
+        """
+        Deserialize from dictionary.
+
+        Args:
+            data: Dictionary representation
+
+        Returns:
+            CredentialConfig instance
+        """
+        # Convert method string to enum
+        if "method" in data and isinstance(data["method"], str):
+            data = data.copy()
+            data["method"] = AuthMethod(data["method"])
+        return cls(**data)
+
+    @classmethod
+    def from_json(cls, json_str: str) -> CredentialConfig:
+        """
+        Deserialize from JSON string.
+
+        Args:
+            json_str: JSON string representation
+
+        Returns:
+            CredentialConfig instance
+        """
+        data = json.loads(json_str)
+        return cls.from_dict(data)
+
+
+@dataclass
+class AuthStatus:
+    """
+    Current authentication status.
+
+    Attributes:
+        authenticated: Whether user is authenticated
+        method: Authentication method used (if authenticated)
+        account_name: Display name of authenticated account
+        tenant_id: Azure AD tenant ID
+        client_id: Client/application ID
+        environment: Cloud environment
+        token_expires_at: Token expiration timestamp
+        token_is_valid: Whether token is currently valid (not expired)
+    """
+
+    authenticated: bool
+    method: Optional[AuthMethod] = None
+    account_name: Optional[str] = None
+    tenant_id: Optional[str] = None
+    client_id: Optional[str] = None
+    environment: str = "Public"
+    token_expires_at: Optional[datetime] = None
+    token_is_valid: bool = False