ravmem-cli 0.1.0__py3-none-any.whl

ravmem/cli/auth.py

@@ -0,0 +1,675 @@
+"""ravmem auth — authentication and authorization management."""
+
+from __future__ import annotations
+
+from typing import Optional
+
+import typer
+
+app = typer.Typer(
+    name="auth",
+    help="Manage authentication tokens, users, and roles",
+    no_args_is_help=True,
+)
+
+
+def _console():
+    from rich.console import Console
+    return Console()
+
+
+def _get_client(token: str | None = None):
+    """Build a client, optionally overriding the api_key with *token*."""
+    from ravmem.client.config import load_config
+    from ravmem.client.api import RavMemClient
+
+    cfg = load_config()
+    if not cfg.get("server_url"):
+        typer.echo(
+            "Remote server not configured. Run 'ravmem remote config --url <URL>' first.",
+            err=True,
+        )
+        raise typer.Exit(1)
+
+    api_key = token or cfg.get("api_key") or None
+    return RavMemClient(base_url=cfg["server_url"], api_key=api_key)
+
+
+def _handle_http_error(exc) -> None:
+    import httpx
+    if not isinstance(exc, httpx.HTTPStatusError):
+        typer.echo(f"Error: {exc}", err=True)
+        return
+    code = exc.response.status_code
+    try:
+        detail = exc.response.json().get("detail", exc.response.text)
+    except Exception:
+        detail = exc.response.text
+    if code == 401:
+        typer.echo("Error: authentication required — check your token.", err=True)
+    elif code == 403:
+        typer.echo("Error: permission denied.", err=True)
+    elif code == 404:
+        typer.echo(f"Error: not found — {detail}", err=True)
+    elif code == 409:
+        typer.echo(f"Error: conflict — {detail}", err=True)
+    elif code == 503:
+        typer.echo(f"Error: server unavailable — {detail}", err=True)
+    else:
+        typer.echo(f"Error {code}: {detail}", err=True)
+
+
+@app.command("login")
+def login(
+    username: str = typer.Option(..., "--username", "-u", help="Username"),
+    password: str = typer.Option(..., "--password", "-p", help="Password", hide_input=True),
+):
+    """Authenticate with the server and save the API key locally."""
+    import httpx
+    from ravmem.client.config import load_config, save_config
+
+    client = _get_client()
+    try:
+        result = client._request(
+            "POST", "/api/auth/login",
+            json={"username": username, "password": password}
+        )
+    except httpx.HTTPStatusError as exc:
+        _handle_http_error(exc)
+        raise typer.Exit(1)
+    finally:
+        client.close()
+
+    token = result["access_token"]
+    cfg = load_config()
+    cfg["api_key"] = token
+    save_config(cfg)
+
+    console = _console()
+    console.print(f"\n[bold green]Logged in as '{username}'.[/bold green]")
+    console.print(f"API key saved to local configuration.\n")
+
+
+@app.command("me")
+def me():
+    """Show details of the current authenticated user."""
+    import httpx
+
+    client = _get_client()
+    try:
+        user = client._request("GET", "/api/auth/me")
+    except httpx.HTTPStatusError as exc:
+        _handle_http_error(exc)
+        raise typer.Exit(1)
+    finally:
+        client.close()
+
+    console = _console()
+    console.print(f"\n[bold]Current User:[/bold]")
+    console.print(f"  ID:    {user['id']}")
+    console.print(f"  Email: {user['email']}")
+    console.print(f"  Name:  {user['name']}")
+    console.print(f"  Role:  {user.get('role', '—')}\n")
+
+
+# ---------------------------------------------------------------------------
+# Admin token
+# ---------------------------------------------------------------------------
+
+@app.command("reset-admin-token")
+def reset_admin_token(
+    token: Optional[str] = typer.Option(
+        None,
+        "--token", "-t",
+        help="Current admin token (reads RAVMEM_ADMIN_TOKEN env var if omitted)",
+        envvar="RAVMEM_ADMIN_TOKEN",
+    ),
+):
+    """Rotate the admin token. Requires the current admin token.
+
+    The old token is invalidated immediately. The new token is printed once.
+    """
+    import httpx
+
+    if not token:
+        typer.echo(
+            "Current admin token required. Pass --token or set RAVMEM_ADMIN_TOKEN.",
+            err=True,
+        )
+        raise typer.Exit(1)
+
+    client = _get_client(token=token)
+    try:
+        result = client._request("POST", "/api/auth/admin/reset-token")
+    except httpx.HTTPStatusError as exc:
+        _handle_http_error(exc)
+        raise typer.Exit(1)
+    finally:
+        client.close()
+
+    console = _console()
+    console.print("\n[bold green]Admin token rotated successfully.[/bold green]")
+    console.print(f"\n[bold]New token:[/bold] {result['token']}\n")
+    console.print("[yellow]Save this token — it will not be shown again.[/yellow]")
+    console.print("Update RAVMEM_ADMIN_TOKEN and restart, or pass --token on each CLI call.\n")
+
+
+# ---------------------------------------------------------------------------
+# Users
+# ---------------------------------------------------------------------------
+
+@app.command("create-user")
+def create_user(
+    email: str = typer.Option(..., "--email", "-e", help="User email address"),
+    name: str = typer.Option(..., "--name", "-n", help="User display name"),
+):
+    """Create a new user (admin only)."""
+    import httpx
+
+    client = _get_client()
+    try:
+        user = client._request("POST", "/api/auth/users", json={"email": email, "name": name})
+    except httpx.HTTPStatusError as exc:
+        _handle_http_error(exc)
+        raise typer.Exit(1)
+    finally:
+        client.close()
+
+    console = _console()
+    console.print(f"\n[bold green]User created.[/bold green]")
+    console.print(f"  ID:    {user['id']}")
+    console.print(f"  Email: {user['email']}")
+    console.print(f"  Name:  {user['name']}\n")
+
+
+@app.command("list-users")
+def list_users(
+    output_json: bool = typer.Option(False, "--json", help="Output raw JSON"),
+):
+    """List all users (admin only)."""
+    import httpx
+    import json
+    from rich.table import Table
+
+    client = _get_client()
+    try:
+        users = client._request("GET", "/api/auth/users")
+    except httpx.HTTPStatusError as exc:
+        _handle_http_error(exc)
+        raise typer.Exit(1)
+    finally:
+        client.close()
+
+    if output_json:
+        typer.echo(json.dumps(users, indent=2, default=str))
+        return
+
+    console = _console()
+    if not users:
+        console.print("No users found.")
+        return
+
+    table = Table(show_header=True, header_style="bold")
+    table.add_column("ID")
+    table.add_column("Email")
+    table.add_column("Name")
+    table.add_column("Status")
+    table.add_column("Created")
+    for u in users:
+        status_style = "green" if u.get("status") == "active" else "red"
+        table.add_row(
+            u.get("id", ""),
+            u.get("email", ""),
+            u.get("name", ""),
+            f"[{status_style}]{u.get('status', '')}[/{status_style}]",
+            u.get("created_at", "")[:10],
+        )
+    console.print(table)
+
+
+@app.command("delete-user")
+def delete_user(
+    user_id: str = typer.Argument(..., help="User ID to delete"),
+    yes: bool = typer.Option(False, "--yes", "-y", help="Skip confirmation prompt"),
+):
+    """Delete a user and all their tokens/roles (admin only)."""
+    import httpx
+
+    if not yes:
+        typer.confirm(f"Are you sure you want to delete user '{user_id}'? This cannot be undone.", abort=True)
+
+    client = _get_client()
+    try:
+        client._request("DELETE", f"/api/auth/users/{user_id}")
+    except httpx.HTTPStatusError as exc:
+        _handle_http_error(exc)
+        raise typer.Exit(1)
+    finally:
+        client.close()
+
+    _console().print(f"[green]User '{user_id}' deleted.[/green]")
+
+
+# ---------------------------------------------------------------------------
+# Tokens
+# ---------------------------------------------------------------------------
+
+@app.command("create-token")
+def create_token(
+    user: str = typer.Option(..., "--user", "-u", help="User ID to create token for"),
+    name: str = typer.Option(..., "--name", "-n", help="Token name / description"),
+    expires_in: Optional[str] = typer.Option(
+        None, "--expires-in", help="Expiry: e.g. 30d, 24h, 60m. Omit for never-expiring."
+    ),
+):
+    """Create an API token. Admin can create for any user; users for themselves only."""
+    import httpx
+
+    client = _get_client()
+    body: dict = {"user_id": user, "name": name}
+    if expires_in:
+        body["expires_in"] = expires_in
+
+    try:
+        result = client._request("POST", "/api/auth/tokens", json=body)
+    except httpx.HTTPStatusError as exc:
+        _handle_http_error(exc)
+        raise typer.Exit(1)
+    finally:
+        client.close()
+
+    console = _console()
+    console.print(f"\n[bold green]Token created.[/bold green]")
+    console.print(f"  ID:      {result['id']}")
+    console.print(f"  Name:    {result['name']}")
+    console.print(f"  Expires: {result.get('expires_at') or 'never'}")
+    console.print(f"\n[bold]Token:[/bold] {result['token']}\n")
+    console.print("[yellow]Save this token — it will not be shown again.[/yellow]\n")
+
+
+@app.command("revoke-token")
+def revoke_token(
+    token_id: Optional[str] = typer.Option(None, "--token-id", help="Token ID to revoke"),
+    user: Optional[str] = typer.Option(None, "--user", help="User ID (use with --all)"),
+    all_tokens: bool = typer.Option(False, "--all", help="Revoke all tokens for --user"),
+):
+    """Revoke a token by ID, or all tokens for a user (admin only)."""
+    import httpx
+
+    if all_tokens and not user:
+        typer.echo("Error: --all requires --user", err=True)
+        raise typer.Exit(1)
+    if not all_tokens and not token_id:
+        typer.echo("Error: provide --token-id, or --user with --all", err=True)
+        raise typer.Exit(1)
+
+    client = _get_client()
+    try:
+        if all_tokens:
+            result = client._request(
+                "DELETE", "/api/auth/tokens/_all",
+                params={"user": user},
+            )
+            _console().print(f"[green]Revoked {result.get('revoked', 0)} token(s) for user {user}.[/green]")
+        else:
+            client._request("DELETE", f"/api/auth/tokens/{token_id}")
+            _console().print(f"[green]Token {token_id} revoked.[/green]")
+    except httpx.HTTPStatusError as exc:
+        _handle_http_error(exc)
+        raise typer.Exit(1)
+    finally:
+        client.close()
+
+
+@app.command("list-tokens")
+def list_tokens(
+    user: Optional[str] = typer.Option(None, "--user", "-u", help="Filter by user ID (admin only for other users)"),
+    output_json: bool = typer.Option(False, "--json", help="Output raw JSON"),
+):
+    """List API tokens. Admin sees all; users see only their own."""
+    import httpx
+    import json
+    from rich.table import Table
+
+    client = _get_client()
+    params = {}
+    if user:
+        params["user_id"] = user
+
+    try:
+        tokens = client._request("GET", "/api/auth/tokens", params=params if params else None)
+    except httpx.HTTPStatusError as exc:
+        _handle_http_error(exc)
+        raise typer.Exit(1)
+    finally:
+        client.close()
+
+    if output_json:
+        typer.echo(json.dumps(tokens, indent=2, default=str))
+        return
+
+    console = _console()
+    if not tokens:
+        console.print("No tokens found.")
+        return
+
+    table = Table(show_header=True, header_style="bold")
+    table.add_column("ID")
+    table.add_column("User")
+    table.add_column("Name")
+    table.add_column("Status")
+    table.add_column("Expires")
+    table.add_column("Last Used")
+    table.add_column("Created")
+    for t in tokens:
+        status_style = "green" if t.get("status") == "active" else "red"
+        table.add_row(
+            t.get("id", ""),
+            t.get("user_id", ""),
+            t.get("name", ""),
+            f"[{status_style}]{t.get('status', '')}[/{status_style}]",
+            t.get("expires_at") or "never",
+            t.get("last_used_at") or "—",
+            t.get("created_at", "")[:10],
+        )
+    console.print(table)
+
+
+# ---------------------------------------------------------------------------
+# Roles (Phase 3)
+# ---------------------------------------------------------------------------
+
+@app.command("create-role")
+def create_role(
+    name: str = typer.Option(..., "--name", "-n", help="Role name"),
+):
+    """Create a new role with no permissions (admin only)."""
+    import httpx
+    client = _get_client()
+    try:
+        role = client._request("POST", "/api/auth/roles", json={"name": name})
+    except httpx.HTTPStatusError as exc:
+        _handle_http_error(exc)
+        raise typer.Exit(1)
+    finally:
+        client.close()
+    _console().print(f"[green]Role '{role['name']}' created (id: {role['id']}).[/green]")
+
+
+@app.command("delete-role")
+def delete_role(
+    name: str = typer.Option(..., "--name", "-n", help="Role name"),
+):
+    """Delete a role. Blocked if users are assigned to it (admin only)."""
+    import httpx
+    client = _get_client()
+    try:
+        client._request("DELETE", f"/api/auth/roles/{name}")
+    except httpx.HTTPStatusError as exc:
+        _handle_http_error(exc)
+        raise typer.Exit(1)
+    finally:
+        client.close()
+    _console().print(f"[green]Role '{name}' deleted.[/green]")
+
+
+@app.command("add-permission")
+def add_permission(
+    role: str = typer.Option(..., "--role", "-r", help="Role name"),
+    permission: str = typer.Option(..., "--permission", "-p", help="Permission string (e.g. branch:read)"),
+):
+    """Add a permission to a role (admin only)."""
+    import httpx
+    client = _get_client()
+    try:
+        result = client._request("POST", f"/api/auth/roles/{role}/permissions", json={"permission": permission})
+    except httpx.HTTPStatusError as exc:
+        _handle_http_error(exc)
+        raise typer.Exit(1)
+    finally:
+        client.close()
+    _console().print(f"[green]Permission '{permission}' added to role '{role}'.[/green]")
+    _console().print(f"  Current permissions: {result.get('permissions', [])}")
+
+
+@app.command("remove-permission")
+def remove_permission(
+    role: str = typer.Option(..., "--role", "-r", help="Role name"),
+    permission: str = typer.Option(..., "--permission", "-p", help="Permission string to remove"),
+):
+    """Remove a permission from a role (admin only)."""
+    import httpx
+    client = _get_client()
+    try:
+        result = client._request("DELETE", f"/api/auth/roles/{role}/permissions/{permission}")
+    except httpx.HTTPStatusError as exc:
+        _handle_http_error(exc)
+        raise typer.Exit(1)
+    finally:
+        client.close()
+    _console().print(f"[green]Permission '{permission}' removed from role '{role}'.[/green]")
+
+
+@app.command("list-roles")
+def list_roles(
+    output_json: bool = typer.Option(False, "--json", help="Output raw JSON"),
+):
+    """List all roles and their permissions (admin only)."""
+    import httpx
+    import json
+    from rich.table import Table
+
+    client = _get_client()
+    try:
+        roles = client._request("GET", "/api/auth/roles")
+    except httpx.HTTPStatusError as exc:
+        _handle_http_error(exc)
+        raise typer.Exit(1)
+    finally:
+        client.close()
+
+    if output_json:
+        typer.echo(json.dumps(roles, indent=2, default=str))
+        return
+
+    console = _console()
+    if not roles:
+        console.print("No roles found.")
+        return
+
+    table = Table(show_header=True, header_style="bold")
+    table.add_column("ID")
+    table.add_column("Name")
+    table.add_column("Permissions")
+    for r in roles:
+        perms = ", ".join(r.get("permissions", [])) or "—"
+        table.add_row(r.get("id", ""), r.get("name", ""), perms)
+    console.print(table)
+
+
+@app.command("show-role")
+def show_role(
+    name: str = typer.Option(..., "--name", "-n", help="Role name"),
+    output_json: bool = typer.Option(False, "--json", help="Output raw JSON"),
+):
+    """Show permissions for a single role (admin only)."""
+    import httpx
+    import json
+    client = _get_client()
+    try:
+        role = client._request("GET", f"/api/auth/roles/{name}")
+    except httpx.HTTPStatusError as exc:
+        _handle_http_error(exc)
+        raise typer.Exit(1)
+    finally:
+        client.close()
+
+    if output_json:
+        typer.echo(json.dumps(role, indent=2, default=str))
+        return
+
+    console = _console()
+    console.print(f"\n[bold]Role:[/bold] {role['name']} ({role['id']})")
+    perms = role.get("permissions", [])
+    if perms:
+        for p in perms:
+            console.print(f"  • {p}")
+    else:
+        console.print("  (no permissions)")
+    console.print()
+
+
+@app.command("assign-role")
+def assign_role(
+    user: str = typer.Option(..., "--user", "-u", help="User ID"),
+    role: str = typer.Option(..., "--role", "-r", help="Role name"),
+):
+    """Assign a role to a user (admin only)."""
+    import httpx
+    client = _get_client()
+    try:
+        client._request("POST", "/api/auth/roles/assign", json={"user_id": user, "role": role})
+    except httpx.HTTPStatusError as exc:
+        _handle_http_error(exc)
+        raise typer.Exit(1)
+    finally:
+        client.close()
+    _console().print(f"[green]Role '{role}' assigned to user {user}.[/green]")
+
+
+@app.command("unassign-role")
+def unassign_role(
+    user: str = typer.Option(..., "--user", "-u", help="User ID"),
+    role: str = typer.Option(..., "--role", "-r", help="Role name"),
+):
+    """Unassign a role from a user (admin only)."""
+    import httpx
+    client = _get_client()
+    try:
+        client._request("DELETE", "/api/auth/roles/assign", json={"user_id": user, "role": role})
+    except httpx.HTTPStatusError as exc:
+        _handle_http_error(exc)
+        raise typer.Exit(1)
+    finally:
+        client.close()
+    _console().print(f"[green]Role '{role}' unassigned from user {user}.[/green]")
+
+
+# ---------------------------------------------------------------------------
+# Rate Limit Tiers (Phase 3)
+# ---------------------------------------------------------------------------
+
+@app.command("set-tier")
+def set_tier(
+    role: str = typer.Option(..., "--role", "-r", help="Role name"),
+    tier: str = typer.Option(..., "--tier", "-t", help="Tier: high | standard | restricted"),
+):
+    """Set the rate-limit tier for a role (admin only).
+
+    Valid tiers: high, standard, restricted.
+    The 'admin' tier is reserved and cannot be assigned to roles.
+
+    Example:
+      ravmem auth set-tier --role ci-agents --tier high
+    """
+    import httpx
+    client = _get_client()
+    try:
+        result = client._request("PUT", f"/api/auth/roles/{role}/tier", json={"tier": tier})
+    except httpx.HTTPStatusError as exc:
+        _handle_http_error(exc)
+        raise typer.Exit(1)
+    finally:
+        client.close()
+    _console().print(f"[green]Rate-limit tier for role '{role}' set to '{tier}'.[/green]")
+    if result.get("rate_limit_tier"):
+        _console().print(f"  Confirmed tier: {result['rate_limit_tier']}")
+
+
+# ---------------------------------------------------------------------------
+# Branch Policies (Phase 4)
+# ---------------------------------------------------------------------------
+
+@app.command("add-branch-policy")
+def add_branch_policy(
+    role: str = typer.Option(..., "--role", "-r", help="Role name"),
+    permission: str = typer.Option(..., "--permission", "-p", help="Permission (e.g. branch:create)"),
+    pattern: str = typer.Option(..., "--pattern", help="Python regex (e.g. 'feat/.*')"),
+):
+    """Add a branch name regex policy to a role (admin only).
+
+    Pattern is validated immediately. Invalid patterns are rejected.
+
+    Example:
+      ravmem auth add-branch-policy --role developer --permission branch:create --pattern "feat/.*"
+    """
+    import httpx
+    client = _get_client()
+    try:
+        result = client._request(
+            "POST", "/api/auth/branch-policies",
+            json={"role": role, "permission": permission, "pattern": pattern},
+        )
+    except httpx.HTTPStatusError as exc:
+        _handle_http_error(exc)
+        raise typer.Exit(1)
+    finally:
+        client.close()
+    _console().print(f"[green]Branch policy added:[/green] role={role}, permission={permission}, pattern={pattern!r}")
+
+
+@app.command("remove-branch-policy")
+def remove_branch_policy(
+    role: str = typer.Option(..., "--role", "-r", help="Role name"),
+    permission: str = typer.Option(..., "--permission", "-p", help="Permission"),
+    pattern: str = typer.Option(..., "--pattern", help="Exact pattern to remove"),
+):
+    """Remove a branch policy from a role (admin only)."""
+    import httpx
+    client = _get_client()
+    try:
+        client._request(
+            "DELETE", "/api/auth/branch-policies",
+            json={"role": role, "permission": permission, "pattern": pattern},
+        )
+    except httpx.HTTPStatusError as exc:
+        _handle_http_error(exc)
+        raise typer.Exit(1)
+    finally:
+        client.close()
+    _console().print(f"[green]Branch policy removed:[/green] role={role}, permission={permission}, pattern={pattern!r}")
+
+
+@app.command("list-branch-policies")
+def list_branch_policies(
+    role: str = typer.Option(..., "--role", "-r", help="Role name"),
+):
+    """List all branch policies for a role (admin only)."""
+    import httpx
+    from rich.table import Table
+
+    client = _get_client()
+    try:
+        policies = client._request("GET", "/api/auth/branch-policies", params={"role": role})
+    except httpx.HTTPStatusError as exc:
+        _handle_http_error(exc)
+        raise typer.Exit(1)
+    finally:
+        client.close()
+
+    console = _console()
+    if not policies:
+        console.print(f"No branch policies found for role '{role}'.")
+        return
+
+    table = Table(show_header=True, header_style="bold")
+    table.add_column("ID")
+    table.add_column("Permission")
+    table.add_column("Pattern")
+    for pol in policies:
+        table.add_row(
+            pol.get("id", ""),
+            pol.get("permission", ""),
+            pol.get("branch_pattern", ""),
+        )
+    console.print(table)