secflow-cli 0.1.0__tar.gz

secflow_cli-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 SecFlow contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

secflow_cli-0.1.0/PKG-INFO

@@ -0,0 +1,64 @@
+Metadata-Version: 2.4
+Name: secflow-cli
+Version: 0.1.0
+Summary: SecFlow operator CLI
+License-Expression: MIT
+Project-URL: Repository, https://github.com/yeon3724/secflow
+Project-URL: Issues, https://github.com/yeon3724/secflow/issues
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: secflow-sdk==0.1.8
+Requires-Dist: keyring<26,>=25
+Dynamic: license-file
+
+# SecFlow CLI
+
+Use Intflow browser login or an existing Slack-issued Admin session. Both distributions provide the same `secflowctl` commands.
+
+## Install and update
+
+Choose one distribution per machine; both own the same `secflowctl` command and share profiles and the OS credential store.
+
+```sh
+pipx install secflow-cli
+# Or in a Python environment:
+python -m pip install secflow-cli
+
+# Alternative: Node.js 22+; no separate Python installation required
+npm install --global @intflow/secflow-cli
+secflowctl --version
+```
+
+The Python distribution requires Python 3.10+. Installation automatically includes the Admin-capable `secflow-sdk==0.1.8` dependency.
+
+The npm distribution includes Python and the CLI dependencies in OS-specific native packages. Initial targets: Windows x64, macOS Intel/Apple Silicon, and Linux x64 with glibc 2.35+ (Ubuntu 22.04+). Alpine/musl and Linux ARM are not npm targets yet; use the Python distribution there. Keep npm optional dependencies enabled. Installation has no postinstall script or runtime download. Native binaries are not platform-signed or notarized.
+
+The bundled interpreter includes CA certificates for HTTPS. An explicit `SSL_CERT_FILE` or `SSL_CERT_DIR` takes precedence for organization-managed trust; TLS certificate verification stays enabled.
+
+```sh
+pipx upgrade secflow-cli
+# Or use the same installer as the initial installation:
+python -m pip install --upgrade secflow-cli
+npm install --global @intflow/secflow-cli@latest
+```
+
+## Connect
+
+```sh
+secflowctl login
+secflowctl auth status
+secflowctl namespaces list --help
+secflowctl namespaces list --all
+secflowctl --help
+```
+
+`secflowctl` without arguments displays a quick start. `secflowctl login` opens Intflow login and creates the `production` profile for `https://secflow.intflow.dev` on first use. Existing profiles retain their selected server. For another server, first use `secflowctl profile add staging --base-url https://secflow.example.test`, then `secflowctl --profile staging login`. Global options precede the command. Every command supports `--help`, including examples. Account and role administration still requires server authorization; token commands currently list metadata only.
+
+`auth login` remains compatible with Slack-issued Admin sessions and prompts without echo for an existing session. Sessions are stored in Windows Credential Manager, macOS Keychain, or Linux Secret Service. Linux persistent login needs an unlocked Secret Service (for example GNOME Keyring) and a D-Bus session. If secure storage is unavailable, login fails without a plaintext file fallback. Installing the CLI does not create an account or grant access.
+
+When browser login is enabled on the server, run `secflowctl auth login --browser`. Sign in to Intflow, compare the code with your terminal, and approve the SecFlow login. Use `--browser --no-browser` to open the displayed URL manually. This requires an interactive terminal, an existing authorized SecFlow account, and OS credential storage. The CLI stores only the resulting SecFlow session. If login expires or the exchange fails, start a new login.
+
+For automation use `SECFLOW_ADMIN_SESSION_TOKEN` supplied by your secret manager, or `--token-stdin` with `--non-interactive`. Never put tokens in command arguments, profiles, shell history, or tracked files. SDK tokens cannot authorize these Admin commands. `auth logout` revokes the current server session; `auth forget` only removes the local credential.
+
+To uninstall, use `pipx uninstall secflow-cli`, `python -m pip uninstall secflow-cli`, or `npm uninstall --global @intflow/secflow-cli` as appropriate. Uninstalling does not revoke server sessions or erase profiles; log out and remove unwanted profiles first.

secflow_cli-0.1.0/USAGE.md

@@ -0,0 +1,50 @@
+# SecFlow CLI
+
+Use Intflow browser login or an existing Slack-issued Admin session. Both distributions provide the same `secflowctl` commands.
+
+## Install and update
+
+Choose one distribution per machine; both own the same `secflowctl` command and share profiles and the OS credential store.
+
+```sh
+pipx install secflow-cli
+# Or in a Python environment:
+python -m pip install secflow-cli
+
+# Alternative: Node.js 22+; no separate Python installation required
+npm install --global @intflow/secflow-cli
+secflowctl --version
+```
+
+The Python distribution requires Python 3.10+. Installation automatically includes the Admin-capable `secflow-sdk==0.1.8` dependency.
+
+The npm distribution includes Python and the CLI dependencies in OS-specific native packages. Initial targets: Windows x64, macOS Intel/Apple Silicon, and Linux x64 with glibc 2.35+ (Ubuntu 22.04+). Alpine/musl and Linux ARM are not npm targets yet; use the Python distribution there. Keep npm optional dependencies enabled. Installation has no postinstall script or runtime download. Native binaries are not platform-signed or notarized.
+
+The bundled interpreter includes CA certificates for HTTPS. An explicit `SSL_CERT_FILE` or `SSL_CERT_DIR` takes precedence for organization-managed trust; TLS certificate verification stays enabled.
+
+```sh
+pipx upgrade secflow-cli
+# Or use the same installer as the initial installation:
+python -m pip install --upgrade secflow-cli
+npm install --global @intflow/secflow-cli@latest
+```
+
+## Connect
+
+```sh
+secflowctl login
+secflowctl auth status
+secflowctl namespaces list --help
+secflowctl namespaces list --all
+secflowctl --help
+```
+
+`secflowctl` without arguments displays a quick start. `secflowctl login` opens Intflow login and creates the `production` profile for `https://secflow.intflow.dev` on first use. Existing profiles retain their selected server. For another server, first use `secflowctl profile add staging --base-url https://secflow.example.test`, then `secflowctl --profile staging login`. Global options precede the command. Every command supports `--help`, including examples. Account and role administration still requires server authorization; token commands currently list metadata only.
+
+`auth login` remains compatible with Slack-issued Admin sessions and prompts without echo for an existing session. Sessions are stored in Windows Credential Manager, macOS Keychain, or Linux Secret Service. Linux persistent login needs an unlocked Secret Service (for example GNOME Keyring) and a D-Bus session. If secure storage is unavailable, login fails without a plaintext file fallback. Installing the CLI does not create an account or grant access.
+
+When browser login is enabled on the server, run `secflowctl auth login --browser`. Sign in to Intflow, compare the code with your terminal, and approve the SecFlow login. Use `--browser --no-browser` to open the displayed URL manually. This requires an interactive terminal, an existing authorized SecFlow account, and OS credential storage. The CLI stores only the resulting SecFlow session. If login expires or the exchange fails, start a new login.
+
+For automation use `SECFLOW_ADMIN_SESSION_TOKEN` supplied by your secret manager, or `--token-stdin` with `--non-interactive`. Never put tokens in command arguments, profiles, shell history, or tracked files. SDK tokens cannot authorize these Admin commands. `auth logout` revokes the current server session; `auth forget` only removes the local credential.
+
+To uninstall, use `pipx uninstall secflow-cli`, `python -m pip uninstall secflow-cli`, or `npm uninstall --global @intflow/secflow-cli` as appropriate. Uninstalling does not revoke server sessions or erase profiles; log out and remove unwanted profiles first.

secflow_cli-0.1.0/pyproject.toml

@@ -0,0 +1,23 @@
+[build-system]
+requires = ["setuptools>=69"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "secflow-cli"
+version = "0.1.0"
+description = "SecFlow operator CLI"
+readme = "USAGE.md"
+license = "MIT"
+requires-python = ">=3.10"
+dependencies = ["secflow-sdk==0.1.8", "keyring>=25,<26"]
+
+[project.scripts]
+secflowctl = "secflow_cli.main:main"
+
+[project.urls]
+Repository = "https://github.com/yeon3724/secflow"
+Issues = "https://github.com/yeon3724/secflow/issues"
+
+[tool.setuptools.packages.find]
+where = ["src"]
+include = ["secflow_cli*"]

secflow_cli-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

secflow_cli-0.1.0/src/secflow_cli/__init__.py

@@ -0,0 +1 @@
+"""Independent operator CLI; no server imports or executable replacement."""

secflow_cli-0.1.0/src/secflow_cli/__main__.py

@@ -0,0 +1,3 @@
+from secflow_cli.main import main
+
+raise SystemExit(main())

secflow_cli-0.1.0/src/secflow_cli/access_profile_commands.py

@@ -0,0 +1,94 @@
+"""Default access profile metadata through the existing org-admin API."""
+from collections.abc import Mapping
+from uuid import UUID
+from uuid import uuid4
+import re
+import sys
+
+from secflow_sdk import SecFlowConfigError, SecFlowSdkError
+from secflow_cli.account_commands import required_input
+from secflow_cli.errors import CliError
+
+FLAGS = ("allow_cli_login", "allow_api_session", "allow_namespace_request")
+FIELDS = ("profile_id", "domain", "roles", *FLAGS, "allow_audit_read", "allow_plaintext_read")
+
+
+def add_commands(groups):
+    commands = groups.add_parser("access-profile").add_subparsers(dest="action", required=True)
+    command = commands.add_parser("get")
+    command.add_argument("--token-stdin", action="store_true")
+    command = commands.add_parser("set")
+    command.add_argument("--profile-id")
+    for field in FLAGS:
+        command.add_argument("--" + field.replace("_", "-"), choices=("true", "false"))
+    command.add_argument("--token-stdin", action="store_true")
+    command.add_argument("--idempotency-key")
+    command.add_argument("--yes", action="store_true")
+
+
+def prepare(args):
+    profile_id = required_input(args, "profile_id", "profile ID")
+    try:
+        if str(UUID(profile_id)) != profile_id:
+            raise ValueError
+    except ValueError:
+        raise CliError(2, "INVALID_INPUT", "Supply a canonical profile UUID.") from None
+    profile = dict(profile_id=profile_id, domain="intflow.ai", roles=[], allow_audit_read=False, allow_plaintext_read=False)
+    for field in FLAGS:
+        value = required_input(args, field, field.replace("_", " "))
+        if value not in ("true", "false"):
+            raise CliError(2, "INVALID_INPUT", "Profile settings must be true or false.")
+        profile[field] = value == "true"
+    key = args.idempotency_key or "cli-access-profile-" + str(uuid4())
+    if not re.fullmatch(r"[A-Za-z0-9_.:-]{16,128}", key):
+        raise CliError(2, "INVALID_INPUT", "Supply a normalized idempotency key of 16-128 characters.")
+    print("Replace global default access profile: " + profile_id, file=sys.stderr)
+    for field in FLAGS:
+        print(field + ": " + str(profile[field]).lower(), file=sys.stderr)
+    print("Full replacement; concurrent changes are not protected by a server precondition. This does not grant roles or revoke existing credentials.", file=sys.stderr)
+    if not args.yes:
+        if args.non_interactive or args.token_stdin or not sys.stdin.isatty():
+            raise CliError(2, "CONFIRMATION_REQUIRED", "Supply all settings and --yes for unattended execution or when stdin carries a token.")
+        print("Type the profile ID to confirm: ", end="", file=sys.stderr, flush=True)
+        try:
+            answer = input()
+        except EOFError:
+            answer = None
+        if answer != profile_id:
+            raise CliError(2, "CONFIRMATION_CANCELLED", "Profile replacement cancelled; no mutation was sent.")
+    return dict(profile=profile, idempotency_key=key)
+
+
+def execute(client, values, *, mapped_error):
+    key = values["idempotency_key"]
+    print("Idempotency key: " + key, file=sys.stderr)
+    data = dict(idempotency_key=key, outcome="unknown", profile=None)
+    try:
+        result = metadata(client.put_default_access_profile(**values))
+        if result != values["profile"]:
+            raise CliError(7, "INVALID_RESPONSE", "The server did not confirm the requested profile.")
+        data.update(outcome="confirmed", profile=result)
+        return data, None
+    except (SecFlowSdkError, CliError) as caught:
+        error = mapped_error(caught)
+        if isinstance(caught, SecFlowConfigError):
+            data["outcome"] = "not_sent"
+        elif error.status in (2, 3, 4, 5, 6):
+            data["outcome"] = "not_confirmed"
+        else:
+            error = CliError(7, "MUTATION_OUTCOME_UNKNOWN", "Mutation completion is unknown. Inspect current state; any retry must use identical inputs and the same idempotency key.")
+        return data, error
+
+
+def metadata(value):
+    valid_id = False
+    if isinstance(value, Mapping) and isinstance(value.get("profile_id"), str):
+        try:
+            valid_id = str(UUID(value["profile_id"])) == value["profile_id"]
+        except ValueError:
+            pass
+    if (not valid_id or value.get("domain") != "intflow.ai" or value.get("roles") != []
+            or any(type(value.get(field)) is not bool for field in FLAGS)
+            or value.get("allow_audit_read") is not False or value.get("allow_plaintext_read") is not False):
+        raise CliError(7, "INVALID_RESPONSE", "The server returned an invalid default access profile.")
+    return {field: value[field] for field in FIELDS}

secflow_cli-0.1.0/src/secflow_cli/account_commands.py

@@ -0,0 +1,134 @@
+"""Additive account mutations using existing Admin API contracts."""
+from __future__ import annotations
+
+import re
+import hashlib
+import sys
+from collections.abc import Mapping
+from uuid import UUID, uuid4
+
+from secflow_sdk import SecFlowConfigError, SecFlowSdkError
+
+from secflow_cli.errors import CliError
+
+
+ACTIONS = ("create", "update", "reactivate", "suspend", "delete")
+DESTRUCTIVE_ACTIONS = frozenset({"suspend", "delete"})
+
+
+def add_commands(commands):
+    for action in ACTIONS:
+        command = commands.add_parser(action)
+        command.add_argument("--token-stdin", action="store_true")
+        command.add_argument("--idempotency-key")
+        if action == "create":
+            command.add_argument("--email")
+        else:
+            command.add_argument("--account-id")
+        if action in ("create", "update"):
+            command.add_argument("--display-name")
+        if action in DESTRUCTIVE_ACTIONS:
+            command.add_argument("--yes", action="store_true")
+
+
+def required_input(args, field, label):
+    value = getattr(args, field)
+    if value is None and not args.non_interactive and not args.token_stdin and sys.stdin.isatty():
+        print(label + ": ", end="", file=sys.stderr, flush=True)
+        try:
+            value = input()
+        except EOFError:
+            value = None
+    if not isinstance(value, str) or not value.strip() or value != value.strip():
+        raise CliError(2, "INVALID_INPUT", "Supply a non-empty normalized " + label + ".")
+    return value
+
+
+def prepare(args):
+    """Validate metadata and the retry key before any mutation is sent."""
+    key = args.idempotency_key or "cli-account-" + str(uuid4())
+    if not re.fullmatch(r"[A-Za-z0-9_.:-]{16,128}", key):
+        raise CliError(2, "INVALID_INPUT", "Idempotency keys must contain 16-128 letters, digits, dots, underscores, colons, or hyphens.")
+    values = {"idempotency_key": key}
+    if args.action == "create":
+        values["email"] = required_input(args, "email", "email")
+        # The server digests the complete request, including correlation IDs.
+        # Keep these stable when a user retries in a later CLI process.
+        operation = hashlib.sha256(key.encode("ascii")).hexdigest()
+        values["request_id"] = "cli-request-" + operation
+        values["trace_id"] = "cli-trace-" + operation
+    else:
+        values["account_id"] = required_input(args, "account_id", "account ID")
+    if args.action == "update":
+        values["display_name"] = required_input(args, "display_name", "display name")
+    elif args.action == "create" and args.display_name is not None:
+        values["display_name"] = required_input(args, "display_name", "display name")
+    if args.action == "reactivate":
+        values["status"] = "active"
+    if args.action in DESTRUCTIVE_ACTIONS:
+        confirm_destructive(args, values["account_id"])
+    return values
+
+
+def confirm_destructive(args, account_id):
+    try:
+        if str(UUID(account_id)) != account_id:
+            raise ValueError
+    except ValueError:
+        raise CliError(2, "INVALID_INPUT", "Supply an exact canonical account UUID.") from None
+    print(args.action.capitalize() + " account: " + account_id, file=sys.stderr)
+    impact = (
+        "suspension revokes active Admin sessions and SDK tokens. Reactivation does not restore revoked credentials."
+        if args.action == "suspend" else
+        "deletion removes the account, its sessions, SDK tokens, and direct role bindings."
+    )
+    print("Operation semantics, not a server impact preview: " + impact + " Affected counts are unknown.", file=sys.stderr)
+    if args.yes:
+        return
+    if args.non_interactive or not sys.stdin.isatty() or args.token_stdin:
+        raise CliError(2, "CONFIRMATION_REQUIRED", "Supply the exact account ID and --yes for unattended execution or when stdin carries a token.")
+    print("Type the account ID to confirm: ", end="", file=sys.stderr, flush=True)
+    try:
+        answer = input()
+    except EOFError:
+        answer = None
+    if answer != account_id:
+        raise CliError(2, "CONFIRMATION_CANCELLED", "Account operation cancelled; no mutation was sent.")
+
+
+def execute(args, client, values, *, account_metadata, mapped_error):
+    key = values["idempotency_key"]
+    print("Idempotency key: " + key, file=sys.stderr)
+    data = {"idempotency_key": key, "outcome": "unknown", "account": None}
+    if args.action == "delete":
+        data["deletion"] = None
+    try:
+        method = {"create": client.create_account, "update": client.patch_account,
+                  "reactivate": client.patch_account, "suspend": client.suspend_account,
+                  "delete": client.delete_account}[args.action]
+        response = method(**values)
+        if args.action == "delete":
+            if (not isinstance(response, Mapping) or response.get("kind") != "account"
+                    or response.get("id") != values["account_id"] or response.get("deleted") is not True
+                    or not isinstance(response.get("label"), str)):
+                raise CliError(7, "INVALID_RESPONSE", "The server did not confirm deletion of the selected account.")
+            data.update(outcome="confirmed", deletion={name: response[name] for name in ("kind", "id", "label", "deleted")})
+            return data, None
+        account = account_metadata(response)
+        if not isinstance(account.get("account_id"), str) or not account["account_id"]:
+            raise CliError(7, "INVALID_RESPONSE", "The server did not return confirmed account metadata.")
+        if args.action == "suspend" and (account["account_id"] != values["account_id"] or account.get("status") != "suspended"):
+            raise CliError(7, "INVALID_RESPONSE", "The server did not confirm suspension of the selected account.")
+        data.update(account=account, outcome="confirmed")
+        return data, None
+    except (SecFlowSdkError, CliError) as caught:
+        error = mapped_error(caught)
+        if isinstance(caught, SecFlowConfigError):
+            data["outcome"] = "not_sent"
+        elif error.status in (2, 3, 4, 5, 6):
+            # The final request was rejected; an earlier attempt using this
+            # key may have completed. Never imply rollback of that attempt.
+            data["outcome"] = "not_confirmed"
+        else:
+            error = CliError(7, "MUTATION_OUTCOME_UNKNOWN", "Mutation completion is unknown. Inspect current state; any retry must use identical inputs and the same idempotency key.")
+        return data, error

secflow_cli-0.1.0/src/secflow_cli/browser_login.py

@@ -0,0 +1,129 @@
+"""Human browser login; Auth credentials stay on the SecFlow server."""
+from __future__ import annotations
+
+import base64
+from datetime import datetime, timezone
+import hashlib
+import json
+import os
+import re
+import sys
+import time
+from urllib.error import HTTPError
+from urllib.request import HTTPRedirectHandler, Request, build_opener
+from uuid import UUID
+import webbrowser
+
+from secflow_sdk import SecFlowAdminClient
+from secflow_cli.errors import CliError
+
+
+def rejected():
+    return CliError(3, "BROWSER_LOGIN_FAILED", "Browser login did not complete. Start a new login; uncertain session exchanges are not retried.")
+
+
+class NoRedirect(HTTPRedirectHandler):
+    def redirect_request(self, req, fp, code, msg, headers, newurl):
+        return None
+
+
+def post(url, body, timeout):
+    request = Request(url, data=json.dumps(body).encode("utf-8"), method="POST",
+                      headers={"Content-Type": "application/json", "Accept": "application/json"})
+    try:
+        response = build_opener(NoRedirect).open(request, timeout=timeout)
+    except HTTPError as error:
+        status = error.code
+        error.close()
+        return status, {}
+    with response:
+        raw = response.read(16385)
+        if len(raw) > 16384:
+            raise rejected()
+        value = json.loads(raw)
+        if not isinstance(value, dict):
+            raise rejected()
+        return response.status, value
+
+
+def acquire_session(url, timeout, *, no_browser=False):
+    try:
+        return _acquire_session(url, timeout, no_browser=no_browser)
+    except CliError:
+        raise
+    except Exception:
+        raise rejected() from None
+
+
+def _acquire_session(url, timeout, *, no_browser):
+    proof = base64.urlsafe_b64encode(os.urandom(32)).rstrip(b"=").decode("ascii")
+    started_at = time.monotonic()
+    status, created = post(url + "/v1/auth/browser-login", {"poll_challenge": hashlib.sha256(proof.encode()).hexdigest()}, timeout)
+    if status == 404:
+        raise CliError(3, "BROWSER_LOGIN_UNAVAILABLE", "This server has not enabled browser login. Use a Slack-issued Admin session.")
+    if status != 201:
+        raise rejected()
+    identifier = created.get("transaction_id")
+    if str(UUID(identifier)) != identifier:
+        raise rejected()
+    verification_uri = url + "/auth/intflow/start?transaction_id=" + identifier
+    if (created.get("verification_uri") != verification_uri
+            or created.get("user_code") != identifier[:8].upper()
+            or type(created.get("expires_in")) is not int or not 1 <= created["expires_in"] <= 300
+            or type(created.get("interval")) is not int or not 2 <= created["interval"] <= 30):
+        raise rejected()
+    deadline = started_at + created["expires_in"]
+    print("Open " + verification_uri, file=sys.stderr)
+    print("Confirm code " + created["user_code"] + " and approve the login in your browser.", file=sys.stderr)
+    if not no_browser:
+        try:
+            opened = webbrowser.open(verification_uri)
+        except Exception:
+            opened = False
+        if not opened:
+            print("Open the URL above manually to continue.", file=sys.stderr)
+    interval = created["interval"]
+    while time.monotonic() + interval < deadline:
+        time.sleep(interval)
+        remaining = deadline - time.monotonic()
+        if remaining <= 0:
+            break
+        status, result = post(url + "/v1/auth/browser-login/redeem",
+                              {"transaction_id": identifier, "poll_secret": proof}, min(timeout, remaining))
+        if status == 202 and result == {"status": "pending"}:
+            continue
+        if status == 429:
+            interval = min(30, interval + 2)
+            continue
+        if status != 200:
+            raise rejected()
+        token = result.get("session_token")
+        if not isinstance(token, str) or not re.fullmatch(r"[A-Za-z0-9_-]{32,256}", token):
+            raise rejected()
+        if any(str(UUID(result.get(field))) != result[field] for field in ("session_id", "account_id")):
+            raise rejected()
+        expiry = datetime.fromisoformat(result["expires_at"].replace("Z", "+00:00"))
+        if expiry.tzinfo is None or expiry <= datetime.now(timezone.utc):
+            raise rejected()
+        return {field: result[field] for field in ("session_token", "session_id", "account_id", "expires_at")}
+    raise CliError(3, "BROWSER_LOGIN_EXPIRED", "Browser login expired. Start a new login.")
+
+
+def login(url, timeout, store, reference, *, no_browser=False):
+    store.check()
+    session = acquire_session(url, timeout, no_browser=no_browser)
+    client = SecFlowAdminClient(url, admin_session_token=session["session_token"], timeout=timeout)
+    try:
+        account = client.get_current_account()
+        if account.get("account_id") != session["account_id"] or account.get("status") != "active":
+            raise rejected()
+        store.set(reference, session["session_token"])
+    except BaseException:
+        # Do not erase a previously stored credential. Revoke only the session
+        # obtained by this invocation when validation/storage is unsuccessful.
+        try:
+            client.revoke_current_session()
+        except Exception:
+            pass
+        raise
+    return account, session["expires_at"]

secflow_cli-0.1.0/src/secflow_cli/config.py

@@ -0,0 +1,106 @@
+from __future__ import annotations
+
+import hashlib
+import ipaddress
+import json
+import os
+from pathlib import Path
+import re
+import sys
+import tempfile
+from urllib.parse import urlsplit
+
+from secflow_cli.errors import CliError
+
+
+def endpoint(value: str) -> str:
+    try:
+        parts = urlsplit(value)
+        host = parts.hostname
+        if (value != value.strip() or any(ord(c) < 33 for c in value) or not host
+                or parts.username is not None or parts.password is not None
+                or parts.query or parts.fragment or parts.path not in ("", "/")
+                or parts.scheme not in ("http", "https")):
+            raise ValueError
+        loopback = host == "localhost"
+        try:
+            loopback = loopback or ipaddress.ip_address(host).is_loopback
+        except ValueError:
+            pass
+        if parts.scheme == "http" and not loopback:
+            raise ValueError
+        port = parts.port
+        if port is not None and port < 1:
+            raise ValueError
+        host = host.encode("idna").decode("ascii").lower()
+        if ":" in host:
+            host = f"[{host}]"
+        suffix = f":{port}" if port and port != (443 if parts.scheme == "https" else 80) else ""
+        return f"{parts.scheme}://{host}{suffix}"
+    except (ValueError, UnicodeError):
+        raise CliError(2, "INVALID_ENDPOINT", "Use an HTTPS server origin without credentials, path, query, or fragment; loopback HTTP is allowed.") from None
+
+
+def profile_name(value: str) -> str:
+    if not re.fullmatch(r"[A-Za-z0-9][A-Za-z0-9_.-]{0,63}", value):
+        raise CliError(2, "INVALID_PROFILE", "Profile names must contain 1-64 letters, digits, dots, underscores, or hyphens.")
+    return value
+
+
+def credential_ref(name: str, url: str) -> str:
+    return "admin:" + hashlib.sha256((profile_name(name) + "\n" + endpoint(url)).encode()).hexdigest()
+
+
+class Profiles:
+    def __init__(self):
+        override = os.environ.get("SECFLOW_CLI_CONFIG_DIR")
+        if override:
+            directory = Path(override).expanduser()
+        elif sys.platform == "win32":
+            directory = Path(os.environ.get("APPDATA", str(Path.home() / "AppData/Roaming"))) / "SecFlow/cli"
+        elif sys.platform == "darwin":
+            directory = Path.home() / "Library/Application Support/SecFlow/cli"
+        else:
+            directory = Path(os.environ.get("XDG_CONFIG_HOME", str(Path.home() / ".config"))) / "secflow/cli"
+        self.path = directory.resolve() / "profiles.json"
+        if any((ancestor / ".git").exists() for ancestor in self.path.parents):
+            raise CliError(2, "INVALID_CONFIG_LOCATION", "CLI configuration must be outside a repository.")
+        self.data = {"version": 1, "current": None, "profiles": {}}
+        try:
+            if self.path.exists():
+                raw = json.loads(self.path.read_text(encoding="utf-8"))
+                if not isinstance(raw, dict) or set(raw) != {"version", "current", "profiles"} or raw["version"] != 1 or not isinstance(raw["profiles"], dict):
+                    raise ValueError
+                for name, profile in raw["profiles"].items():
+                    profile_name(name)
+                    if not isinstance(profile, dict) or set(profile) != {"base_url", "credential_ref"}:
+                        raise ValueError
+                    url = endpoint(profile["base_url"])
+                    if profile["credential_ref"] != credential_ref(name, url):
+                        raise ValueError
+                if raw["current"] is not None and raw["current"] not in raw["profiles"]:
+                    raise ValueError
+                self.data = raw
+        except (OSError, ValueError, TypeError, KeyError):
+            raise CliError(2, "INVALID_CONFIG", "Cannot read valid CLI profile configuration.") from None
+
+    def save(self):
+        self.path.parent.mkdir(parents=True, exist_ok=True, mode=0o700)
+        temporary = None
+        try:
+            with tempfile.NamedTemporaryFile(mode="w", encoding="utf-8", dir=self.path.parent, delete=False) as stream:
+                temporary = Path(stream.name)
+                json.dump(self.data, stream, indent=2)
+                stream.write("\n")
+            os.replace(temporary, self.path)
+        except OSError:
+            raise CliError(2, "CONFIG_WRITE_FAILED", "Cannot save CLI profile configuration.") from None
+        finally:
+            if temporary and temporary.exists():
+                temporary.unlink()
+
+    def select(self, name: str | None):
+        selected = name or os.environ.get("SECFLOW_PROFILE") or self.data["current"]
+        if selected is None or selected not in self.data["profiles"]:
+            raise CliError(2, "PROFILE_REQUIRED", "First use: secflowctl login. For a custom server, see secflowctl profile add --help; select an existing profile with --profile.")
+        return selected, self.data["profiles"][selected]