simcon-toolkit 0.1.0__py3-none-any.whl

simcon_toolkit/_kit/packages/cadmould_cloud/auth.py

@@ -0,0 +1,681 @@
+"""Auth0 login helper for the cloud platform.
+
+[FORKED from cloud-solver-service: cloud-solver/scripts/auth_login.py. It is no longer a
+verbatim copy: the dev/prod switch is removed here because templates point at production
+only, and upstream needs both. Re-vendoring is therefore a merge, not a paste.]
+
+This module implements **Authorization Code + PKCE with a loopback redirect** - the
+flow Auth0 recommends for native/CLI clients. No client secret is required: PKCE
+replaces it.
+
+Usage
+-----
+::
+
+    # Log in (opens a browser) and cache the token; prints cache path + expiry to stderr:
+    python packages/cadmould_cloud/auth.py
+
+    # Capture the raw token for another tool (the ONLY mode that prints it to stdout):
+    export CLOUD_SOLVER_TOKEN=$(python packages/cadmould_cloud/auth.py --print-token)
+
+    # Force a fresh interactive login, ignoring any cached/env token:
+    python packages/cadmould_cloud/auth.py --force
+
+    # Log out: revoke the refresh token at Auth0 and delete the cached token, then exit:
+    python packages/cadmould_cloud/auth.py --logout
+
+Other overrides: ``--client-id``, ``--domain``, ``--audience``, ``--redirect-uri``,
+``--scope``. Most callers import ``get_access_token`` rather than running this directly.
+
+Session persistence
+--------------------
+Tokens are cached at ``~/.cache/cloud-solver/token.json`` with the directory created
+mode ``0700`` and the file ``chmod`` ed to ``0600``. A cache file (rather than an exported
+environment variable) is the correct mechanism because a child process cannot set a
+variable in its parent shell. The cached record holds ``access_token``, an optional
+``refresh_token``, the token ``exp`` (epoch seconds, decoded from the JWT - *no* signature
+verification, freshness only) and the ``audience``.
+
+Token resolution order (see ``get_access_token``)
+--------------------------------------------------
+1. ``CLOUD_SOLVER_TOKEN`` environment variable (override) - unless ``force``.
+2. Cache file: fresh ``access_token`` -> return; expired with a ``refresh_token`` -> refresh
+   grant; else fall through.
+3. Interactive browser login.
+
+Security
+--------
+The token, authorization code, and any OTP are never logged or printed. The default CLI
+output is a status line on stderr (cache path + expiry); raw-token emission is opt-in
+via ``--print-token``.
+
+The live browser round-trip (``interactive_login``) is validated manually, not in CI.
+Only the pure helpers below are unit-tested (network/browser mocked).
+"""
+
+from __future__ import annotations
+
+import argparse
+import base64
+import contextlib
+import hashlib
+import json
+import os
+import secrets
+import sys
+import threading
+import time
+import webbrowser
+from datetime import UTC, datetime
+from http.server import BaseHTTPRequestHandler, HTTPServer
+from pathlib import Path
+from typing import Any
+from urllib.parse import parse_qs, urlencode, urlparse
+
+import httpx
+
+AUTH0_DOMAIN = "auth.simcon.ai"
+AUTH0_AUDIENCE = "https://api.simcon.ai/cloud-solver"
+
+# This is the desktop *licensing* application's client id, borrowed to request the
+# cloud-solver audience because no dedicated cloud application exists yet. A client id is
+# public by design (RFC 6749 section 2.2) and authenticates nothing on its own, so this is a
+# wrong topology rather than a leaked secret. Override with --client-id, or skip the login
+# entirely by exporting CLOUD_SOLVER_TOKEN.
+AUTH0_CLIENT_ID = "YIcU4jTREmZn8SkvvsV7PxSGq2DCVV8b"
+DEFAULT_REDIRECT_URI = "http://localhost:25000/callback"
+DEFAULT_SCOPE = "openid profile email offline_access"
+TOKEN_ENV_VAR = "CLOUD_SOLVER_TOKEN"
+
+# Auth0 requires redirect_uri to EXACTLY match a registered callback, so the loopback
+# server is pinned to this host/port/path.
+_LOOPBACK_HOST = "localhost"
+_LOOPBACK_PORT = 25000
+_LOOPBACK_PATH = "/callback"
+_LOGIN_TIMEOUT_S = 300
+
+
+# --------------------------------------------------------------------------------------
+# Pure helpers (no network, no browser, no real clock unless injected) — unit-tested.
+# --------------------------------------------------------------------------------------
+
+
+def generate_pkce() -> tuple[str, str]:
+    """Return ``(code_verifier, code_challenge)`` for PKCE S256 (RFC 7636).
+
+    The verifier is 43-128 chars from the unreserved set ``[A-Za-z0-9-._~]``; the challenge
+    is base64url-no-pad of ``sha256(verifier)``.
+    """
+    # token_urlsafe uses base64url alphabet (A-Za-z0-9-_), a subset of the RFC 7636
+    # unreserved charset, so the result is always valid. 64 bytes -> ~86 chars.
+    verifier = secrets.token_urlsafe(64)
+    if len(verifier) > 128:
+        verifier = verifier[:128]
+    digest = hashlib.sha256(verifier.encode("ascii")).digest()
+    challenge = base64.urlsafe_b64encode(digest).rstrip(b"=").decode("ascii")
+    return verifier, challenge
+
+
+def build_authorize_url(
+    *,
+    domain: str,
+    client_id: str,
+    redirect_uri: str,
+    audience: str,
+    scope: str,
+    state: str,
+    code_challenge: str,
+    prompt: str | None = None,
+) -> str:
+    """Build the Auth0 ``/authorize`` URL for the Authorization Code + PKCE flow.
+
+    ``prompt`` is the OIDC ``prompt`` parameter. Pass ``"login"`` to force Auth0 to show the
+    login form even when an SSO session cookie exists — useful for demoing the flow repeatedly
+    (clearing the local token cache alone does NOT clear Auth0's browser session).
+    """
+    params = {
+        "response_type": "code",
+        "client_id": client_id,
+        "redirect_uri": redirect_uri,
+        "audience": audience,
+        "scope": scope,
+        "state": state,
+        "code_challenge": code_challenge,
+        "code_challenge_method": "S256",
+    }
+    if prompt:
+        params["prompt"] = prompt
+    return f"https://{domain}/authorize?{urlencode(params)}"
+
+
+def parse_redirect_query(query: str) -> dict[str, str]:
+    """Parse a callback query string into a flat ``{key: value}`` dict.
+
+    Used to extract ``code``/``state`` and to surface ``error``/``error_description``.
+    """
+    parsed = parse_qs(query, keep_blank_values=True)
+    return {key: values[0] for key, values in parsed.items() if values}
+
+
+def _b64url_decode(segment: str) -> bytes:
+    """base64url-decode a string, restoring missing ``=`` padding."""
+    padding = "=" * (-len(segment) % 4)
+    return base64.urlsafe_b64decode(segment + padding)
+
+
+def decode_jwt_exp(token: str) -> int | None:
+    """Return the JWT ``exp`` claim (epoch seconds) or ``None`` if absent/malformed.
+
+    NOTE: this does **not** verify the signature. It is used only to judge token freshness.
+    """
+    try:
+        parts = token.split(".")
+        if len(parts) < 2:
+            return None
+        payload = json.loads(_b64url_decode(parts[1]))
+    except (ValueError, json.JSONDecodeError):
+        return None
+    exp = payload.get("exp")
+    if isinstance(exp, bool) or not isinstance(exp, int):
+        return None
+    return exp
+
+
+def is_expired(exp: int | None, *, now: float, skew_s: int = 60) -> bool:
+    """Return True if there is no ``exp`` or the token is within ``skew_s`` of expiring."""
+    if not isinstance(exp, (int, float)) or isinstance(exp, bool):
+        return True
+    return exp - skew_s <= now
+
+
+def _record_matches(record: dict[str, Any], audience: str, domain: str, client_id: str) -> bool:
+    """Return True when a cached record was minted against exactly this configuration.
+
+    A record written before the identity was recorded has no ``domain``, so it fails here and
+    a fresh login replaces it. That is deliberate: it cannot be shown to be safe to reuse.
+    """
+    return (
+        record.get("audience") == audience and record.get("domain") == domain and record.get("client_id") == client_id
+    )
+
+
+def cache_path() -> Path:
+    """Return the token cache path."""
+    return Path.home() / ".cache" / "cloud-solver" / "token.json"
+
+
+def legacy_cache_paths() -> list[Path]:
+    """Return caches written before the environment switch was removed.
+
+    Those were named ``token-<env>.json``. Logging out has to find them: each one can hold a
+    refresh token that stays valid at Auth0 until it is revoked, so a logout that only deleted
+    the current file would report success while leaving a live credential on disk.
+    """
+    return sorted(cache_path().parent.glob("token-*.json"))
+
+
+def read_cache(path: Path) -> dict[str, Any] | None:
+    """Return the parsed cache dict, or ``None`` if missing/corrupt."""
+    try:
+        with path.open("r", encoding="utf-8") as fh:
+            data = json.load(fh)
+    except (OSError, ValueError):
+        return None
+    if not isinstance(data, dict):
+        return None
+    return data
+
+
+def write_cache(path: Path, data: dict[str, Any]) -> None:
+    """Write the cache dict, creating the dir ``0700`` and the file ``0600``."""
+    path.parent.mkdir(parents=True, exist_ok=True, mode=0o700)
+    # mkdir's mode is masked by umask and a no-op if the dir already exists; set it explicitly.
+    with contextlib.suppress(OSError):
+        path.parent.chmod(0o700)
+    # create the file with 0600 from the start (no world-readable window)
+    fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
+    with os.fdopen(fd, "w", encoding="utf-8") as fh:
+        json.dump(data, fh, indent=2)
+
+
+def exchange_code(
+    *,
+    client: httpx.Client,
+    domain: str,
+    client_id: str,
+    code: str,
+    code_verifier: str,
+    redirect_uri: str,
+) -> dict[str, Any]:
+    """Exchange an authorization code + PKCE verifier for tokens at ``/oauth/token``."""
+    resp = client.post(
+        f"https://{domain}/oauth/token",
+        data={
+            "grant_type": "authorization_code",
+            "client_id": client_id,
+            "code": code,
+            "code_verifier": code_verifier,
+            "redirect_uri": redirect_uri,
+        },
+    )
+    _raise_for_token_error(resp, context="code exchange")
+    result: dict[str, Any] = resp.json()
+    return result
+
+
+def refresh_token_grant(
+    *,
+    client: httpx.Client,
+    domain: str,
+    client_id: str,
+    refresh_token: str,
+) -> dict[str, Any]:
+    """Exchange a refresh token for fresh tokens at ``/oauth/token``."""
+    resp = client.post(
+        f"https://{domain}/oauth/token",
+        data={
+            "grant_type": "refresh_token",
+            "client_id": client_id,
+            "refresh_token": refresh_token,
+        },
+    )
+    _raise_for_token_error(resp, context="refresh")
+    result: dict[str, Any] = resp.json()
+    return result
+
+
+def revoke_token(
+    *,
+    client: httpx.Client,
+    domain: str,
+    client_id: str,
+    token: str,
+) -> None:
+    """Revoke a refresh token via the RFC 7009 ``/oauth/revoke`` endpoint.
+
+    Our CLI app is a PUBLIC client (``token_endpoint_auth_method=none``), which Auth0 lets
+    revoke with just ``client_id`` + ``token`` (no secret). This stops the refresh token from
+    minting new access tokens. NOTE: an already-issued access token is a JWT validated offline
+    via JWKS, so it stays valid until its ``exp`` and cannot be revoked here — deleting the
+    local cache is what removes the only copy of it.
+    """
+    resp = client.post(
+        f"https://{domain}/oauth/revoke",
+        data={"client_id": client_id, "token": token},
+    )
+    # RFC 7009 §2.2: 200 on success OR for an unknown/invalid token. Anything else is a real error.
+    _raise_for_token_error(resp, context="revoke")
+
+
+def logout(
+    *,
+    client_id: str | None = None,
+    domain: str | None = None,
+    revoke: bool = True,
+) -> dict[str, bool]:
+    """Invalidate the local session: revoke every refresh token found, then delete the caches.
+
+    Covers the current cache and any ``token-<env>.json`` left by an older build, so logging out
+    cannot leave a live refresh token behind. Returns ``{"cache_existed", "refresh_revoked"}``.
+    Revocation is best-effort - a network/Auth0 error never blocks deleting the local cache,
+    which is the primary goal. The access token JWT itself cannot be revoked before its ``exp``;
+    removing the cache deletes its only local copy.
+
+    ``refresh_revoked`` is only ever True for a record that named its own issuer. A record
+    written before that field existed is still sent to the default tenant, because that is
+    overwhelmingly where it came from - but RFC 7009 makes an unknown token indistinguishable
+    from a revoked one, so a success there proves nothing and must not be reported as one.
+    """
+    paths = [cache_path(), *legacy_cache_paths()]
+    existed = any(p.exists() for p in paths)
+    revoked = False
+    for p in paths:
+        cached = read_cache(p)
+        if revoke and cached and cached.get("refresh_token"):
+            try:
+                # Revoke at the tenant that minted this token: Auth0 scopes a refresh token to
+                # its own domain and client, so revoking at the wrong one leaves it live.
+                fallback_domain, _audience, fallback_client_id = resolve_config(client_id=client_id, domain=domain)
+                issuer_known = bool(cached.get("domain")) and bool(cached.get("client_id"))
+                with httpx.Client(timeout=30) as client:
+                    revoke_token(
+                        client=client,
+                        domain=str(cached.get("domain") or fallback_domain),
+                        client_id=str(cached.get("client_id") or fallback_client_id),
+                        token=str(cached["refresh_token"]),
+                    )
+                revoked = revoked or issuer_known
+            except (RuntimeError, ValueError, httpx.HTTPError):
+                pass  # best-effort: still delete the local caches below
+        p.unlink(missing_ok=True)
+    return {"cache_existed": existed, "refresh_revoked": revoked}
+
+
+def _raise_for_token_error(resp: httpx.Response, *, context: str) -> None:
+    """Raise a clear error on a non-2xx token response WITHOUT leaking any token material."""
+    if resp.is_success:
+        return
+    error = description = ""
+    try:
+        body = resp.json()
+        error = str(body.get("error", ""))
+        description = str(body.get("error_description", ""))
+    except ValueError:
+        pass
+    detail = f"{error}: {description}".strip(": ") or f"HTTP {resp.status_code}"
+    raise RuntimeError(f"Auth0 {context} failed ({detail})")
+
+
+def build_cache_record(
+    token_response: dict[str, Any],
+    *,
+    audience: str,
+    domain: str,
+    client_id: str,
+    now: float | None = None,
+) -> dict[str, Any]:
+    """Assemble the on-disk cache record from a token response.
+
+    The record stores the full identity the token was minted against - audience, Auth0
+    domain and client id - because one cache file now serves every invocation. A token
+    obtained under ``--domain`` came from a different tenant and a later default call must
+    not reuse it, nor send its refresh token to the default revoke endpoint.
+
+    The ``exp`` prefers the JWT's own ``exp`` claim; if the access token has no ``exp`` it
+    falls back to ``now + expires_in`` (``now`` defaults to the real clock).
+    """
+    access_token = token_response["access_token"]
+    exp = decode_jwt_exp(access_token)
+    if exp is None:
+        base = time.time() if now is None else now
+        expires_in = token_response.get("expires_in")
+        if isinstance(expires_in, (int, float)):
+            exp = int(base + expires_in)
+    record: dict[str, Any] = {
+        "access_token": access_token,
+        "token_type": token_response.get("token_type", "Bearer"),
+        "audience": audience,
+        "domain": domain,
+        "client_id": client_id,
+        "exp": exp,
+    }
+    refresh = token_response.get("refresh_token")
+    if refresh:
+        record["refresh_token"] = refresh
+    return record
+
+
+def resolve_config(
+    *,
+    client_id: str | None = None,
+    domain: str | None = None,
+    audience: str | None = None,
+) -> tuple[str, str, str]:
+    """Resolve ``(domain, audience, client_id)``, applying explicit overrides."""
+    resolved_client_id = client_id or AUTH0_CLIENT_ID
+    if not resolved_client_id:
+        raise ValueError("No client_id available: pass --client-id.")
+    return domain or AUTH0_DOMAIN, audience or AUTH0_AUDIENCE, resolved_client_id
+
+
+# --------------------------------------------------------------------------------------
+# Orchestration (network/browser/clock) — thin, NOT unit-tested (manual/live step).
+# --------------------------------------------------------------------------------------
+
+
+class _CallbackResult:
+    """Mutable holder for the captured callback query, shared with the handler thread."""
+
+    def __init__(self) -> None:
+        self.query: dict[str, str] | None = None
+
+
+def _make_handler(result: _CallbackResult) -> type[BaseHTTPRequestHandler]:
+    class _Handler(BaseHTTPRequestHandler):
+        # Named by http.server's API, not by our own convention.
+        def do_GET(self) -> None:
+            parsed = urlparse(self.path)
+            if parsed.path != _LOOPBACK_PATH:
+                self.send_response(404)
+                self.end_headers()
+                return
+            result.query = parse_redirect_query(parsed.query)
+            self.send_response(200)
+            self.send_header("Content-Type", "text/html; charset=utf-8")
+            self.end_headers()
+            self.wfile.write(
+                b"<html><body><h2>Login complete.</h2>"
+                b"<p>You may close this tab and return to the terminal.</p></body></html>"
+            )
+
+        def log_message(self, *_args: Any) -> None:  # noqa: ANN401
+            # Silence default stderr logging (could echo the code in the request line).
+            return
+
+    return _Handler
+
+
+def interactive_login(
+    *,
+    domain: str,
+    client_id: str,
+    redirect_uri: str,
+    audience: str,
+    scope: str,
+    prompt: str | None = None,
+) -> dict[str, Any]:
+    """Run the full browser-based Authorization Code + PKCE login and return the token response.
+
+    ``prompt="login"`` forces Auth0 to re-show the login form even with an active SSO session.
+    """
+    # The loopback callback server below is pinned to _LOOPBACK_HOST:_LOOPBACK_PORT/_LOOPBACK_PATH,
+    # so a redirect_uri pointing anywhere else would be sent to Auth0 but never received here —
+    # the login would just hang until timeout. Fail fast instead.
+    parsed = urlparse(redirect_uri)
+    if (
+        parsed.scheme != "http"
+        or parsed.hostname != _LOOPBACK_HOST
+        or parsed.port != _LOOPBACK_PORT
+        or parsed.path != _LOOPBACK_PATH
+    ):
+        raise ValueError(
+            f"redirect_uri must be http://{_LOOPBACK_HOST}:{_LOOPBACK_PORT}{_LOOPBACK_PATH} "
+            "(the loopback callback server is pinned to it)"
+        )
+
+    verifier, challenge = generate_pkce()
+    state = secrets.token_urlsafe(32)
+    authorize_url = build_authorize_url(
+        domain=domain,
+        client_id=client_id,
+        redirect_uri=redirect_uri,
+        audience=audience,
+        scope=scope,
+        state=state,
+        code_challenge=challenge,
+        prompt=prompt,
+    )
+
+    result = _CallbackResult()
+    handler = _make_handler(result)
+    try:
+        server = HTTPServer((_LOOPBACK_HOST, _LOOPBACK_PORT), handler)
+    except OSError as exc:
+        raise RuntimeError(
+            f"Cannot bind {_LOOPBACK_HOST}:{_LOOPBACK_PORT} for the login redirect "
+            f"({exc}). Free port {_LOOPBACK_PORT} and retry — the redirect_uri "
+            "is pinned by the Auth0 callback registration."
+        ) from exc
+
+    thread = threading.Thread(target=server.serve_forever, daemon=True)
+    thread.start()
+    try:
+        print("Opening browser for Auth0 login...", file=sys.stderr)
+        webbrowser.open(authorize_url)
+        deadline = time.time() + _LOGIN_TIMEOUT_S
+        while result.query is None and time.time() < deadline:
+            time.sleep(0.2)
+    finally:
+        server.shutdown()
+        server.server_close()
+        thread.join(timeout=5)
+
+    if result.query is None:
+        raise RuntimeError(f"Login timed out after {_LOGIN_TIMEOUT_S}s waiting for the redirect.")
+
+    query = result.query
+    if "error" in query:
+        raise RuntimeError(f"Auth0 login error ({query.get('error')}: {query.get('error_description', '')})")
+    if query.get("state") != state:
+        raise RuntimeError("State mismatch on callback — possible CSRF; aborting login.")
+    code = query.get("code")
+    if not code:
+        raise RuntimeError("Auth0 callback returned no authorization code.")
+
+    with httpx.Client(timeout=30) as client:
+        return exchange_code(
+            client=client,
+            domain=domain,
+            client_id=client_id,
+            code=code,
+            code_verifier=verifier,
+            redirect_uri=redirect_uri,
+        )
+
+
+def get_access_token(
+    *,
+    client_id: str | None = None,
+    domain: str | None = None,
+    audience: str | None = None,
+    redirect_uri: str = DEFAULT_REDIRECT_URI,
+    scope: str = DEFAULT_SCOPE,
+    force: bool = False,
+    prompt: str | None = None,
+) -> str:
+    """Return a token, trying CLOUD_SOLVER_TOKEN, then the cache, refresh, then login.
+
+    ``prompt`` is forwarded to the interactive login (e.g. ``"login"`` to force the Auth0 form).
+    """
+    if not force:
+        env_token = os.environ.get(TOKEN_ENV_VAR)
+        if env_token:
+            return env_token
+
+    resolved_domain, resolved_audience, resolved_client_id = resolve_config(
+        client_id=client_id, domain=domain, audience=audience
+    )
+
+    path = cache_path()
+    if not force:
+        cached = read_cache(path)
+        if cached and not _record_matches(cached, resolved_audience, resolved_domain, resolved_client_id):
+            cached = None  # minted against a different tenant or audience - don't reuse it
+        if cached:
+            access_token = cached.get("access_token")
+            if access_token and not is_expired(cached.get("exp"), now=time.time()):
+                return str(access_token)
+            refresh = cached.get("refresh_token")
+            if refresh:
+                try:
+                    with httpx.Client(timeout=30) as client:
+                        token_response = refresh_token_grant(
+                            client=client,
+                            domain=resolved_domain,
+                            client_id=resolved_client_id,
+                            refresh_token=refresh,
+                        )
+                    record = build_cache_record(
+                        token_response,
+                        audience=resolved_audience,
+                        domain=resolved_domain,
+                        client_id=resolved_client_id,
+                    )
+                    write_cache(path, record)
+                    return str(record["access_token"])
+                except (RuntimeError, httpx.HTTPError):
+                    pass  # fall through to a full login
+
+    token_response = interactive_login(
+        domain=resolved_domain,
+        client_id=resolved_client_id,
+        redirect_uri=redirect_uri,
+        audience=resolved_audience,
+        scope=scope,
+        prompt=prompt,
+    )
+    record = build_cache_record(
+        token_response,
+        audience=resolved_audience,
+        domain=resolved_domain,
+        client_id=resolved_client_id,
+    )
+    write_cache(path, record)
+    return str(record["access_token"])
+
+
+# --------------------------------------------------------------------------------------
+# CLI
+# --------------------------------------------------------------------------------------
+
+
+def _format_expiry(exp: int | None) -> str:
+    if exp is None:
+        return "unknown"
+    return datetime.fromtimestamp(exp, tz=UTC).isoformat()
+
+
+def _build_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(description="Auth0 PKCE-loopback login for cloud-solver.")
+    parser.add_argument("--client-id", default=None)
+    parser.add_argument("--domain", default=None)
+    parser.add_argument("--audience", default=None)
+    parser.add_argument("--redirect-uri", default=DEFAULT_REDIRECT_URI)
+    parser.add_argument("--scope", default=DEFAULT_SCOPE)
+    parser.add_argument("--force", action="store_true", help="Ignore cache and re-login.")
+    parser.add_argument("--print-token", action="store_true", help="Print the raw token to stdout (for piping).")
+    parser.add_argument(
+        "--logout",
+        action="store_true",
+        help="Revoke the refresh token, delete the cached token, and exit.",
+    )
+    return parser
+
+
+def main(argv: list[str] | None = None) -> int:
+    """Run the login CLI: log out, or resolve a token and report where it was cached."""
+    args = _build_parser().parse_args(argv)
+    path = cache_path()
+
+    if args.logout:
+        result = logout(client_id=args.client_id, domain=args.domain)
+        if result["cache_existed"]:
+            revoked = " (refresh token revoked)" if result["refresh_revoked"] else ""
+            print(f"Logged out: removed cached token{revoked} ({path})", file=sys.stderr)
+        else:
+            print("No cached token", file=sys.stderr)
+        return 0
+
+    try:
+        token = get_access_token(
+            client_id=args.client_id,
+            domain=args.domain,
+            audience=args.audience,
+            redirect_uri=args.redirect_uri,
+            scope=args.scope,
+            force=args.force,
+        )
+    except (RuntimeError, ValueError) as exc:
+        print(f"Login failed: {exc}", file=sys.stderr)
+        return 1
+
+    cached = read_cache(path) or {}
+    expiry = _format_expiry(cached.get("exp"))
+    print(f"logged in; token cached at {path}; expires {expiry}", file=sys.stderr)
+    if args.print_token:
+        print(token)
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())