softmax-cli 0.26.16__tar.gz → 0.26.18__tar.gz

{softmax_cli-0.26.16/src/softmax_cli.egg-info → softmax_cli-0.26.18}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: softmax-cli
-Version: 0.26.16
+Version: 0.26.18
 Summary: Softmax CLI — authentication and account tools
 Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.11

{softmax_cli-0.26.16 → softmax_cli-0.26.18}/src/softmax/auth.py

@@ -14,11 +14,32 @@ DEFAULT_API_SERVER = "https://softmax.com/api"
 
 CREDENTIALS_FILE = "credentials.yaml"
 
+# Hosts that exchange_auth_code is willing to send a freshly minted auth code
+# to. The exchange step is the only place a real credential leaves the box, so
+# this is the trust boundary for the login flow. Other commands (status,
+# get-login-url, set-token, ...) are unrestricted so local dev against a custom
+# backend still works.
+_TRUSTED_HOST_SUFFIXES = (".softmax.com", ".softmax-research.net")
+_TRUSTED_EXACT_HOSTS = frozenset({"softmax.com", "localhost", "127.0.0.1", "::1"})
+
 
 def get_api_server() -> str:
     return os.environ.get("COGAMES_API_URL", DEFAULT_API_SERVER)
 
 
+class UntrustedApiServerError(Exception):
+    """Raised when exchange_auth_code is called against an untrusted host."""
+
+
+def _is_trusted_exchange_host(api_server: str) -> bool:
+    host = (urlsplit(api_server).hostname or "").lower()
+    if not host:
+        return False
+    if host in _TRUSTED_EXACT_HOSTS:
+        return True
+    return any(host.endswith(suffix) for suffix in _TRUSTED_HOST_SUFFIXES)
+
+
 # --- on-disk storage ---
 
 
@@ -157,6 +178,13 @@ def fetch_cogames_whoami(*, api_server: str | None = None, token: str) -> WhoAmI
 
 def exchange_auth_code(*, api_server: str, code: str) -> str:
     """Exchange a one-time auth code for a real credential token."""
+    if not _is_trusted_exchange_host(api_server):
+        host = urlsplit(api_server).hostname or api_server
+        raise UntrustedApiServerError(
+            f"Refusing to send auth code to untrusted host '{host}'. "
+            "Auth codes are only exchanged with softmax.com, *.softmax.com, "
+            "*.softmax-research.net, or loopback (localhost / 127.0.0.1)."
+        )
     response = httpx.post(
         f"{api_server.rstrip('/')}/observatory/credentials/auth-codes/exchange",
         json={"code": code},
@@ -164,3 +192,56 @@ def exchange_auth_code(*, api_server: str, code: str) -> str:
     )
     response.raise_for_status()
     return response.json()["token"]
+
+
+def _format_status_error(exc: httpx.HTTPStatusError) -> str:
+    status = exc.response.status_code
+    if status // 100 == 3:
+        return (
+            "Failed to exchange auth code due to a redirect. "
+            "You may have accidentally pointed --server to the frontend application URL.\n"
+            "If you have a valid code, you can still run the following command to exchange it for a token:\n\n"
+            "softmax exchange-code <code>"
+        )
+    if status == 410:
+        return (
+            "This auth code has already been used or expired. "
+            "If you just ran `softmax login`, your token was saved automatically — run `softmax status` to verify."
+        )
+    if status == 400:
+        return "Invalid auth code format."
+    return f"Code exchange failed (HTTP {status}): {exc.response.text}"
+
+
+class ExchangeSuccess(BaseModel):
+    token: str
+
+
+class ExchangeFailure(BaseModel):
+    message: str
+
+
+ExchangeOutcome = ExchangeSuccess | ExchangeFailure
+
+
+def try_exchange_auth_code(*, api_server: str, code: str) -> ExchangeOutcome:
+    """Exchange an auth code, returning a typed success/failure result.
+
+    Centralizes the error-classification ladder so every callsite (CLI command,
+    manual-paste loop, callback handler) gets the same message without repeating
+    try/except blocks.
+    """
+    try:
+        token = exchange_auth_code(api_server=api_server, code=code)
+    except UntrustedApiServerError as exc:
+        return ExchangeFailure(message=str(exc))
+    except httpx.HTTPStatusError as exc:
+        return ExchangeFailure(message=_format_status_error(exc))
+    except httpx.HTTPError:
+        return ExchangeFailure(
+            message=(
+                "Could not exchange auth code. Check that --server points at the API "
+                "(e.g. https://softmax.com/api) and try again."
+            ),
+        )
+    return ExchangeSuccess(token=token)

{softmax_cli-0.26.16 → softmax_cli-0.26.18}/src/softmax/cli.py

@@ -9,14 +9,15 @@ from rich.panel import Panel
 from softmax._console import console
 from softmax.auth import (
     DEFAULT_API_SERVER,
+    ExchangeFailure,
     build_browser_login_url,
     delete_all_tokens,
-    exchange_auth_code,
     fetch_cogames_whoami,
     get_api_server,
     load_current_token,
     load_user_token,
     save_user_token,
+    try_exchange_auth_code,
 )
 from softmax.perform_login import do_interactive_login_for_token
 
@@ -110,16 +111,12 @@ def login_cmd(
     try:
         do_interactive_login_for_token(
             api_server=api_server,
-            agent_hint=(
-                "If you are a coding agent, ask your human to open the URL below and give you "
-                "the auth code. Then paste the code into this window or run:\n"
-                "\n"
-                f"{_build_manual_exchange_command(server)}"
-            ),
+            agent_hint=None,
             open_browser=not no_browser,
         )
     except Exception as e:
-        console.print(f"Error: {e}")
+        console.print()
+        console.print(f"Error: {e}", style="red", highlight=False)
         console.print()
         console.print("Authentication failed.", style="red")
         raise typer.Exit(1) from e
@@ -236,6 +233,9 @@ def exchange_code_cmd(
 ) -> None:
     """Exchange a one-time auth code for a credential."""
     api_server = server or get_api_server()
-    token = exchange_auth_code(api_server=api_server, code=code)
-    save_user_token(server=api_server, token=token)
+    result = try_exchange_auth_code(api_server=api_server, code=code)
+    if isinstance(result, ExchangeFailure):
+        console.print(result.message, style="red", highlight=False)
+        raise typer.Exit(1)
+    save_user_token(server=api_server, token=result.token)
     print(f"\nToken saved for {api_server}")

{softmax_cli-0.26.16 → softmax_cli-0.26.18}/src/softmax/perform_login.py

@@ -20,7 +20,12 @@ from fastapi.responses import HTMLResponse
 from rich.panel import Panel
 
 from softmax._console import console
-from softmax.auth import build_browser_login_url, exchange_auth_code, save_user_token
+from softmax.auth import (
+    ExchangeFailure,
+    build_browser_login_url,
+    save_user_token,
+    try_exchange_auth_code,
+)
 
 
 @dataclass
@@ -257,13 +262,12 @@ def _create_app(session: _CLIAuthSession, *, api_server: str) -> FastAPI:
             _finish_authentication(session, error="No code received in callback")
             return HTMLResponse(content=_error_html(error_message="No code received"), status_code=400)
 
-        try:
-            token = exchange_auth_code(api_server=api_server, code=code)
-        except Exception as exc:
-            _finish_authentication(session, error=f"Code exchange failed: {exc}")
-            return HTMLResponse(content=_error_html(error_message=f"Code exchange failed: {exc}"), status_code=500)
+        result = try_exchange_auth_code(api_server=api_server, code=code)
+        if isinstance(result, ExchangeFailure):
+            _finish_authentication(session, error=result.message)
+            return HTMLResponse(content=_error_html(error_message=result.message), status_code=500)
 
-        _finish_authentication(session, token=token)
+        _finish_authentication(session, token=result.token)
         return HTMLResponse(content=_success_html())
 
     return app
@@ -298,13 +302,12 @@ def _start_manual_code_prompt(*, session: _CLIAuthSession, api_server: str) -> N
             if not code:
                 continue
 
-            try:
-                token = exchange_auth_code(api_server=api_server, code=code)
-            except Exception as exc:
-                console.print(f"Code exchange failed: {exc}", style="red")
-                continue
+            result = try_exchange_auth_code(api_server=api_server, code=code)
+            if isinstance(result, ExchangeFailure):
+                _finish_authentication(session, error=result.message)
+                return
 
-            _finish_authentication(session, token=token)
+            _finish_authentication(session, token=result.token)
             return
 
     threading.Thread(target=prompt_loop, daemon=True).start()

{softmax_cli-0.26.16 → softmax_cli-0.26.18/src/softmax_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: softmax-cli
-Version: 0.26.16
+Version: 0.26.18
 Summary: Softmax CLI — authentication and account tools
 Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.11