runtime-sdk 0.4.49__py3-none-win_arm64.whl

runtime_sdk/__init__.py

@@ -0,0 +1,18 @@
+from importlib.metadata import PackageNotFoundError, version
+
+from runtime_sdk.client import RuntimeAPIError, RuntimeClient
+from runtime_sdk.config import RuntimeConfig, RuntimeConfigError, WorkOSSession
+
+try:
+    __version__ = version("runtime-sdk")
+except PackageNotFoundError:  # pragma: no cover - local source tree fallback
+    __version__ = "0.0.0"
+
+__all__ = [
+    "RuntimeAPIError",
+    "RuntimeClient",
+    "RuntimeConfig",
+    "RuntimeConfigError",
+    "WorkOSSession",
+    "__version__",
+]

runtime_sdk/account.py

@@ -0,0 +1,243 @@
+from __future__ import annotations
+
+import json
+import os
+import tempfile
+import time
+import webbrowser
+from pathlib import Path
+from typing import Any
+
+from runtime_sdk import output as cli_output
+from runtime_sdk.auth import (
+    authenticated_client,
+    clear_credentials,
+    save_api_key,
+    save_session,
+    session_from_payload,
+)
+from runtime_sdk.client import RuntimeAPIError, RuntimeClient
+from runtime_sdk.config import RuntimeConfig
+
+
+DEVICE_STATE_ENV = "RUNTIME_DEVICE_STATE_FILE"
+SLOW_DOWN_SECONDS = 5
+
+
+def handle_login(
+    config: RuntimeConfig,
+    *,
+    api_key: str | None,
+    no_open: bool,
+) -> int:
+    if os.environ.get("RUNTIME_API_KEY", "").strip():
+        return cli_output.report_error(
+            "RUNTIME_API_KEY is set; unset it before saving another credential"
+        )
+    if api_key is not None:
+        return _login_with_api_key(config, api_key)
+    return _login_with_device(config, no_open=no_open)
+
+
+def _login_with_api_key(config: RuntimeConfig, api_key: str) -> int:
+    if not api_key:
+        if not cli_output.interactive():
+            return cli_output.report_error("api key is required")
+        api_key = cli_output.prompt_password("API key") or ""
+    if not api_key:
+        return cli_output.report_error("api key is required")
+
+    identity = RuntimeClient(base_url=config.base_url, credential=api_key).whoami()
+    save_api_key(config, api_key)
+    return cli_output.report_success({"message": "logged in with API key", **identity})
+
+
+def _login_with_device(config: RuntimeConfig, *, no_open: bool) -> int:
+    client = RuntimeClient(base_url=config.base_url)
+    device = _device_response(client.start_device_login())
+    _publish_device_state(device)
+
+    verification_uri = str(device["verification_uri"])
+    complete_uri = str(device.get("verification_uri_complete") or verification_uri)
+    print(f"Open {verification_uri}", file=os.sys.stderr)
+    print(f"Enter code: {device['user_code']}", file=os.sys.stderr)
+    if not no_open:
+        webbrowser.open(complete_uri)
+
+    interval = int(device["interval"])
+    deadline = time.monotonic() + int(device["expires_in"])
+    while time.monotonic() < deadline:
+        time.sleep(interval)
+        try:
+            payload = client.poll_device_login(str(device["device_code"]))
+        except RuntimeAPIError as exc:
+            if exc.status_code == 202:
+                continue
+            if exc.status_code == 429:
+                interval += SLOW_DOWN_SECONDS
+                continue
+            if exc.status_code == 403:
+                raise RuntimeAPIError("WorkOS sign-in was denied", status_code=403) from exc
+            if exc.status_code == 410:
+                raise RuntimeAPIError("WorkOS sign-in expired", status_code=410) from exc
+            raise
+
+        session = session_from_payload(payload)
+        save_session(config, session)
+        return cli_output.report_success(
+            {
+                "message": "logged in",
+                "organization_id": session.organization_id,
+                "session_id": session.session_id,
+            }
+        )
+
+    raise RuntimeAPIError("WorkOS sign-in expired", status_code=410)
+
+
+def _device_response(payload: dict[str, Any]) -> dict[str, Any]:
+    required_strings = (
+        "device_code",
+        "user_code",
+        "verification_uri",
+    )
+    required_integers = ("expires_in", "interval")
+    for field in required_strings:
+        if not isinstance(payload.get(field), str) or not str(payload[field]).strip():
+            raise RuntimeAPIError("server returned an invalid device login")
+    complete = payload.get("verification_uri_complete")
+    if complete is not None and (not isinstance(complete, str) or not complete.strip()):
+        raise RuntimeAPIError("server returned an invalid device login")
+    for field in required_integers:
+        if not isinstance(payload.get(field), int) or int(payload[field]) <= 0:
+            raise RuntimeAPIError("server returned an invalid device login")
+    return payload
+
+
+def _publish_device_state(device: dict[str, Any]) -> None:
+    raw_path = os.environ.get(DEVICE_STATE_ENV)
+    if not raw_path:
+        return
+    path = Path(raw_path)
+    public_state = {
+        key: device.get(key)
+        for key in (
+            "user_code",
+            "verification_uri",
+            "verification_uri_complete",
+            "expires_in",
+            "interval",
+        )
+    }
+    path.parent.mkdir(parents=True, exist_ok=True, mode=0o700)
+    fd, temporary_path = tempfile.mkstemp(prefix=".device-", dir=path.parent)
+    try:
+        os.fchmod(fd, 0o600)
+        with os.fdopen(fd, "w", encoding="utf-8") as file:
+            json.dump(public_state, file)
+            file.write("\n")
+            file.flush()
+            os.fsync(file.fileno())
+        os.replace(temporary_path, path)
+    finally:
+        try:
+            os.unlink(temporary_path)
+        except FileNotFoundError:
+            pass
+
+
+def handle_whoami(config: RuntimeConfig) -> int:
+    if (err := cli_output.require_auth(config)) is not None:
+        return err
+    return cli_output.report_success(authenticated_client(config).whoami())
+
+
+def handle_tui_state(config: RuntimeConfig) -> int:
+    if (err := cli_output.require_auth(config)) is not None:
+        return err
+
+    client = authenticated_client(config)
+    identity = client.whoami()
+    computers = client.list_computers().get("computers") or []
+    provider_credentials = (
+        client.list_provider_credentials().get("provider_credentials") or []
+    )
+    github_installations = client.list_github_installations().get("installations") or []
+    default_network_policy = client.get_default_network()
+    return cli_output.report_success(
+        {
+            "identity": identity,
+            "computers": computers,
+            "provider_credentials": provider_credentials,
+            "github_installations": github_installations,
+            "default_network_policy": default_network_policy,
+        }
+    )
+
+
+def handle_logout(config: RuntimeConfig) -> int:
+    environment_key = os.environ.get("RUNTIME_API_KEY", "").strip()
+    if environment_key:
+        try:
+            RuntimeClient(base_url=config.base_url, credential=environment_key).logout()
+        except RuntimeAPIError as exc:
+            if exc.status_code != 401:
+                raise
+        return cli_output.report_success(
+            {
+                "message": "environment API key logged out; unset RUNTIME_API_KEY to remove it",
+            }
+        )
+
+    if config.api_key or config.session:
+        try:
+            authenticated_client(config).logout()
+        except RuntimeAPIError as exc:
+            if exc.status_code != 401:
+                raise
+
+    clear_credentials(config)
+    message = "logged out"
+    return cli_output.report_success({"message": message})
+
+
+def handle_api_keys_list(config: RuntimeConfig) -> int:
+    if (err := cli_output.require_interactive_session(config)) is not None:
+        return err
+    return cli_output.report_success(
+        authenticated_client(config, interactive=True).list_api_keys()
+    )
+
+
+def handle_api_keys_create(config: RuntimeConfig, name: str | None) -> int:
+    if (err := cli_output.require_interactive_session(config)) is not None:
+        return err
+    if name is None:
+        if not cli_output.interactive():
+            return cli_output.report_error("name is required")
+        name = cli_output.prompt_text("API key name")
+        if not name:
+            return cli_output.report_error("name is required")
+
+    return cli_output.report_success(
+        authenticated_client(config, interactive=True).create_api_key(name)
+    )
+
+
+def handle_api_keys_revoke(config: RuntimeConfig, key_id: str | None) -> int:
+    if (err := cli_output.require_interactive_session(config)) is not None:
+        return err
+    if key_id is None:
+        if not cli_output.interactive():
+            return cli_output.report_error("api key id is required")
+        key_id = cli_output.prompt_text("API key id")
+        if not key_id:
+            return cli_output.report_error("api key id is required")
+
+    resolved_key_id = key_id.strip()
+    if not resolved_key_id:
+        return cli_output.report_error("api key id is required")
+    authenticated_client(config, interactive=True).revoke_api_key(resolved_key_id)
+    return cli_output.report_success(
+        {"id": resolved_key_id, "message": f"api key {resolved_key_id} revoked"}
+    )

runtime_sdk/arguments.py

@@ -0,0 +1,10 @@
+from __future__ import annotations
+
+import shlex
+
+
+def command_from_remainder(parts: list[str] | None) -> str | None:
+    values = list(parts or [])
+    if values and values[0] == "--":
+        values = values[1:]
+    return shlex.join(values) if values else None

runtime_sdk/auth.py

@@ -0,0 +1,175 @@
+from __future__ import annotations
+
+import base64
+import json
+import os
+import time
+from typing import Any
+
+from runtime_sdk.client import RuntimeAPIError, RuntimeClient
+from runtime_sdk.config import (
+    RuntimeConfig,
+    RuntimeConfigError,
+    WorkOSSession,
+    _save_config_unlocked,
+    config_lock,
+    load_config,
+    save_config,
+)
+
+
+REFRESH_SKEW_SECONDS = 30
+
+
+def has_credentials(config: RuntimeConfig, *, interactive: bool = False) -> bool:
+    if os.environ.get("RUNTIME_API_KEY", "").strip() and not interactive:
+        return True
+    _reload_credentials(config)
+    return config.session is not None if interactive else bool(config.api_key or config.session)
+
+
+def authenticated_client(
+    config: RuntimeConfig, *, interactive: bool = False
+) -> RuntimeClient:
+    return RuntimeClient(
+        base_url=config.base_url,
+        credential=lambda: bearer_token(config, interactive=interactive),
+    )
+
+
+def bearer_token(config: RuntimeConfig, *, interactive: bool = False) -> str:
+    environment_key = os.environ.get("RUNTIME_API_KEY", "").strip()
+    if environment_key and not interactive:
+        return environment_key
+
+    _reload_credentials(config)
+    if interactive and config.session is None:
+        raise RuntimeAPIError("interactive WorkOS login required", status_code=401)
+    if config.api_key:
+        return config.api_key
+    if config.session:
+        return _session_access_token(config)
+    raise RuntimeAPIError("not logged in; run runtime login", status_code=401)
+
+
+def _reload_credentials(config: RuntimeConfig) -> None:
+    if not config._tracks_saved_credentials:
+        return
+    latest = load_config()
+    config.api_key = latest.api_key
+    config.session = latest.session
+
+
+def session_from_payload(payload: dict[str, Any]) -> WorkOSSession:
+    fields = (
+        "access_token",
+        "refresh_token",
+        "organization_id",
+        "session_id",
+    )
+    if any(
+        not isinstance(payload.get(field), str) or not payload[field].strip()
+        for field in fields
+    ):
+        raise RuntimeAPIError("server returned an invalid WorkOS session")
+    try:
+        session = WorkOSSession(
+            access_token=payload["access_token"],
+            refresh_token=payload["refresh_token"],
+            organization_id=payload["organization_id"],
+            session_id=payload["session_id"],
+        )
+    except (KeyError, TypeError, ValueError) as exc:
+        raise RuntimeAPIError("server returned an invalid WorkOS session") from exc
+    try:
+        fresh = _token_is_fresh(session.access_token)
+    except RuntimeConfigError as exc:
+        raise RuntimeAPIError("server returned an invalid WorkOS session") from exc
+    if not fresh:
+        raise RuntimeAPIError("server returned an expired WorkOS session")
+    return session
+
+
+def save_session(config: RuntimeConfig, session: WorkOSSession) -> None:
+    config.session = session
+    config.api_key = None
+    save_config(config)
+
+
+def save_api_key(config: RuntimeConfig, api_key: str) -> None:
+    config.api_key = api_key
+    config.session = None
+    save_config(config)
+
+
+def clear_credentials(config: RuntimeConfig) -> None:
+    config.session = None
+    config.api_key = None
+    save_config(config)
+
+
+def _session_access_token(config: RuntimeConfig) -> str:
+    if not config._tracks_saved_credentials:
+        if config.session is None:
+            raise RuntimeAPIError("not logged in; run runtime login", status_code=401)
+        if _stored_token_is_fresh(config.session.access_token):
+            return config.session.access_token
+        config.session = _refresh_workos_session(config.base_url, config.session)
+        config.api_key = None
+        return config.session.access_token
+
+    latest = load_config()
+    if latest.session is None:
+        raise RuntimeAPIError("not logged in; run runtime login", status_code=401)
+    config.session = latest.session
+    config.api_key = None
+    if _stored_token_is_fresh(latest.session.access_token):
+        return latest.session.access_token
+
+    with config_lock():
+        latest = load_config()
+        if latest.session is None:
+            raise RuntimeAPIError("WorkOS session is no longer available", status_code=401)
+        if _stored_token_is_fresh(latest.session.access_token):
+            config.session = latest.session
+            config.api_key = None
+            return latest.session.access_token
+
+        refreshed = _refresh_workos_session(config.base_url, latest.session)
+        latest.session = refreshed
+        latest.api_key = None
+        _save_config_unlocked(latest)
+        config.session = refreshed
+        config.api_key = None
+        return refreshed.access_token
+
+
+def _refresh_workos_session(base_url: str, session: WorkOSSession) -> WorkOSSession:
+    payload = RuntimeClient(base_url=base_url).refresh_session(
+        session.refresh_token,
+        session.organization_id,
+    )
+    refreshed = session_from_payload(payload)
+    if refreshed.organization_id != session.organization_id:
+        raise RuntimeAPIError("WorkOS refresh changed organizations", status_code=401)
+    return refreshed
+
+
+def _token_is_fresh(token: str) -> bool:
+    try:
+        encoded_payload = token.split(".")[1]
+        encoded_payload += "=" * (-len(encoded_payload) % 4)
+        payload = json.loads(base64.urlsafe_b64decode(encoded_payload))
+        expires_at = payload["exp"]
+    except (IndexError, KeyError, TypeError, ValueError, json.JSONDecodeError) as exc:
+        raise RuntimeConfigError("stored WorkOS access token is invalid") from exc
+    if not isinstance(expires_at, (int, float)):
+        raise RuntimeConfigError("stored WorkOS access token has an invalid expiry")
+    return float(expires_at) > time.time() + REFRESH_SKEW_SECONDS
+
+
+def _stored_token_is_fresh(token: str) -> bool:
+    try:
+        return _token_is_fresh(token)
+    except RuntimeConfigError:
+        return False