sovaria-cli 0.2.0__py3-none-any.whl

apps/cli/src/commands/org.py

@@ -0,0 +1,157 @@
+"""
+apps.cli.src.commands.org — Organisation and membership management commands.
+
+Phase 1 §7 Sprint 3.2: The "day in the life" demo walkthrough requires:
+    sov org create "Acme Corp"
+    sov org member-add <org_id> <user_id> [--role ADMIN]
+
+These commands proxy requests through the Gateway to the Axis org endpoints:
+    POST /api/v1/org                  — create any node (type=ORG, USER, ...)
+    POST /api/v1/org/{org_id}/member  — add a MEMBER_OF edge
+
+Usage:
+    sov org create "Acme Corp"
+    sov org create "Acme Corp" --type ORG --profile staging
+    sov org member-add <org_id> <user_id>
+    sov org member-add <org_id> <user_id> --role ADMIN
+"""
+
+from __future__ import annotations
+
+import json
+
+import httpx
+import typer
+
+from apps.cli.src.utils.auth_store import load_tokens
+from apps.cli.src.utils.config import get_api_url
+
+app = typer.Typer(help="Organisation management commands")
+
+
+@app.command("create")
+def create_org(
+    name: str = typer.Argument(..., help="Human-readable organisation name"),
+    node_type: str = typer.Option(
+        "ORG",
+        "--type",
+        "-t",
+        help="Node type: ORG | PROJECT | ENV",
+    ),
+    metadata: str | None = typer.Option(
+        None,
+        "--metadata",
+        "-m",
+        help='Extra metadata as a JSON string, e.g. \'{"industry": "fintech"}\'',
+    ),
+    profile: str | None = typer.Option(
+        None, "--profile", help="Config profile to use (dev/staging/prod)"
+    ),
+) -> None:
+    """
+    Create a new organisation (or PROJECT/ENV) node in the identity graph.
+
+    Example:
+        sov org create "Acme Corp"
+        sov org create "Payments" --type PROJECT --metadata '{"env": "prod"}'
+    """
+    tokens = load_tokens(profile=profile)
+    if not tokens:
+        typer.echo("Not logged in. Run: sov login", err=True)
+        raise typer.Exit(1)
+
+    # Parse optional JSON metadata
+    meta: dict = {}
+    if metadata:
+        try:
+            meta = json.loads(metadata)
+        except json.JSONDecodeError as exc:
+            typer.echo(f"--metadata must be valid JSON: {exc}", err=True)
+            raise typer.Exit(1) from exc
+
+    api_url = get_api_url(profile)
+    headers = {
+        "Authorization": f"Bearer {tokens['access_token']}",
+        "Content-Type": "application/json",
+    }
+    payload = {"type": node_type, "name": name, "metadata": meta}
+
+    try:
+        resp = httpx.post(
+            f"{api_url}/api/v1/org",
+            headers=headers,
+            json=payload,
+            timeout=30,
+        )
+        resp.raise_for_status()
+    except httpx.HTTPStatusError as exc:
+        detail = exc.response.text
+        try:
+            detail = exc.response.json().get("detail", detail)
+        except Exception:  # pylint: disable=broad-except
+            pass
+        typer.echo(f"Failed to create {node_type}: {detail}", err=True)
+        raise typer.Exit(1) from exc
+
+    data = resp.json()
+    node_id = data.get("node_id")
+    typer.echo(
+        typer.style("✓ Created", fg=typer.colors.GREEN)
+        + f" {node_type} '{name}'  node_id={node_id}"
+    )
+
+
+@app.command("member-add")
+def add_member(
+    org_id: str = typer.Argument(..., help="UUID of the ORG/PROJECT node"),
+    user_id: str = typer.Argument(..., help="UUID of the USER node to add"),
+    role: str = typer.Option(
+        "MEMBER",
+        "--role",
+        "-r",
+        help="Role to assign: ADMIN | MEMBER | VIEWER (default: MEMBER)",
+    ),
+    profile: str | None = typer.Option(
+        None, "--profile", help="Config profile to use (dev/staging/prod)"
+    ),
+) -> None:
+    """
+    Add a user as a member of an organisation (creates a MEMBER_OF edge).
+
+    Example:
+        sov org member-add <org_id> <user_id>
+        sov org member-add <org_id> <user_id> --role ADMIN
+    """
+    tokens = load_tokens(profile=profile)
+    if not tokens:
+        typer.echo("Not logged in. Run: sov login", err=True)
+        raise typer.Exit(1)
+
+    api_url = get_api_url(profile)
+    headers = {
+        "Authorization": f"Bearer {tokens['access_token']}",
+        "Content-Type": "application/json",
+    }
+    payload = {"user_id": user_id, "role": role}
+
+    try:
+        resp = httpx.post(
+            f"{api_url}/api/v1/org/{org_id}/member",
+            headers=headers,
+            json=payload,
+            timeout=30,
+        )
+        resp.raise_for_status()
+    except httpx.HTTPStatusError as exc:
+        detail = exc.response.text
+        try:
+            detail = exc.response.json().get("detail", detail)
+        except Exception:  # pylint: disable=broad-except
+            pass
+        typer.echo(f"Failed to add member: {detail}", err=True)
+        raise typer.Exit(1) from exc
+
+    typer.echo(
+        typer.style("✓ Member added", fg=typer.colors.GREEN)
+        + f"  user={user_id}  org={org_id}  role={role}"
+    )

apps/cli/src/commands/policy.py

@@ -0,0 +1,317 @@
+"""Guard policy commands."""
+
+from __future__ import annotations
+
+from typing import TypedDict
+from urllib.parse import quote
+
+import typer
+
+from apps.cli.src.utils.api_client import CLIRequestError, call_api, parse_json_arg, print_json
+
+app = typer.Typer(help="Guard policy engine commands")
+
+
+class ScopeOpts(TypedDict):
+    org_id: str | None
+    project_id: str | None
+    env_id: str | None
+
+
+def _scope_opts(org_id: str | None, project_id: str | None, env_id: str | None) -> ScopeOpts:
+    return {
+        "org_id": org_id,
+        "project_id": project_id,
+        "env_id": env_id,
+    }
+
+
+def _is_conflict_error(exc: CLIRequestError) -> bool:
+    status_code = getattr(exc, "status_code", None)
+    message = str(exc).lower()
+    return status_code == 409 or "already exists" in message
+
+
+@app.command("templates")
+def templates(
+    profile: str | None = typer.Option(None, "--profile"),
+) -> None:
+    """List built-in SPL policy templates."""
+    try:
+        result = call_api(
+            method="GET",
+            path="/api/v1/policies/templates",
+            profile=profile,
+        )
+    except CLIRequestError as exc:
+        typer.echo(str(exc), err=True)
+        raise typer.Exit(1) from exc
+    typer.echo(print_json(result))
+
+
+@app.command("list")
+def list_policies(
+    profile: str | None = typer.Option(None, "--profile"),
+    org_id: str | None = typer.Option(None, "--org"),
+    project_id: str | None = typer.Option(None, "--project"),
+    env_id: str | None = typer.Option(None, "--env"),
+) -> None:
+    """List active policies in scope."""
+    try:
+        result = call_api(
+            method="GET",
+            path="/api/v1/policies/",
+            profile=profile,
+            require_scope=False,
+            **_scope_opts(org_id, project_id, env_id),
+        )
+    except CLIRequestError as exc:
+        typer.echo(str(exc), err=True)
+        raise typer.Exit(1) from exc
+    typer.echo(print_json(result))
+
+
+@app.command("get")
+def get_policy(
+    policy_id: str = typer.Argument(...),
+    profile: str | None = typer.Option(None, "--profile"),
+    org_id: str | None = typer.Option(None, "--org"),
+    project_id: str | None = typer.Option(None, "--project"),
+    env_id: str | None = typer.Option(None, "--env"),
+) -> None:
+    """Fetch a policy by ID."""
+    safe_id = quote(policy_id, safe="")
+    try:
+        result = call_api(
+            method="GET",
+            path=f"/api/v1/policies/{safe_id}",
+            profile=profile,
+            require_scope=False,
+            **_scope_opts(org_id, project_id, env_id),
+        )
+    except CLIRequestError as exc:
+        typer.echo(str(exc), err=True)
+        raise typer.Exit(1) from exc
+    typer.echo(print_json(result))
+
+
+@app.command("upsert")
+def upsert_policy(
+    policy_id: str = typer.Argument(...),
+    name: str = typer.Option(..., "--name"),
+    spl_source: str = typer.Option(..., "--spl"),
+    org_id: str = typer.Option(..., "--org", help="Owning org UUID"),
+    profile: str | None = typer.Option(None, "--profile"),
+    project_id: str | None = typer.Option(None, "--project"),
+    env_id: str | None = typer.Option(None, "--env"),
+) -> None:
+    """Create or update a policy (tries create then update)."""
+    try:
+        create_result = call_api(
+            method="POST",
+            path="/api/v1/policies/",
+            profile=profile,
+            body={
+                "policy_id": policy_id,
+                "name": name,
+                "spl_source": spl_source,
+                "org_id": org_id,
+            },
+            require_scope=False,
+            **_scope_opts(org_id, project_id, env_id),
+        )
+        typer.echo(print_json(create_result))
+        return
+    except CLIRequestError as exc:
+        if not _is_conflict_error(exc):
+            typer.echo(str(exc), err=True)
+            raise typer.Exit(1) from exc
+
+    safe_id = quote(policy_id, safe="")
+    try:
+        update_result = call_api(
+            method="PUT",
+            path=f"/api/v1/policies/{safe_id}",
+            profile=profile,
+            body={"name": name, "spl_source": spl_source},
+            require_scope=False,
+            **_scope_opts(org_id, project_id, env_id),
+        )
+    except CLIRequestError as exc:
+        typer.echo(str(exc), err=True)
+        raise typer.Exit(1) from exc
+
+    typer.echo(print_json(update_result))
+
+
+@app.command("delete")
+def delete_policy(
+    policy_id: str = typer.Argument(...),
+    profile: str | None = typer.Option(None, "--profile"),
+    org_id: str | None = typer.Option(None, "--org"),
+    project_id: str | None = typer.Option(None, "--project"),
+    env_id: str | None = typer.Option(None, "--env"),
+) -> None:
+    """Delete (deactivate) a policy."""
+    safe_id = quote(policy_id, safe="")
+    try:
+        result = call_api(
+            method="DELETE",
+            path=f"/api/v1/policies/{safe_id}",
+            profile=profile,
+            require_scope=False,
+            **_scope_opts(org_id, project_id, env_id),
+        )
+    except CLIRequestError as exc:
+        typer.echo(str(exc), err=True)
+        raise typer.Exit(1) from exc
+    typer.echo(print_json(result))
+
+
+@app.command("history")
+def policy_history(
+    policy_id: str = typer.Argument(...),
+    profile: str | None = typer.Option(None, "--profile"),
+    org_id: str | None = typer.Option(None, "--org"),
+    project_id: str | None = typer.Option(None, "--project"),
+    env_id: str | None = typer.Option(None, "--env"),
+) -> None:
+    """List policy version history."""
+    safe_id = quote(policy_id, safe="")
+    try:
+        result = call_api(
+            method="GET",
+            path=f"/api/v1/policies/{safe_id}/history",
+            profile=profile,
+            require_scope=False,
+            **_scope_opts(org_id, project_id, env_id),
+        )
+    except CLIRequestError as exc:
+        typer.echo(str(exc), err=True)
+        raise typer.Exit(1) from exc
+    typer.echo(print_json(result))
+
+
+@app.command("rollback")
+def rollback_policy(
+    policy_id: str = typer.Argument(...),
+    version: int = typer.Option(..., "--version"),
+    profile: str | None = typer.Option(None, "--profile"),
+    org_id: str | None = typer.Option(None, "--org"),
+    project_id: str | None = typer.Option(None, "--project"),
+    env_id: str | None = typer.Option(None, "--env"),
+) -> None:
+    """Rollback policy to a historical version."""
+    safe_id = quote(policy_id, safe="")
+    try:
+        result = call_api(
+            method="POST",
+            path=f"/api/v1/policies/{safe_id}/rollback",
+            profile=profile,
+            body={"version": version},
+            require_scope=False,
+            **_scope_opts(org_id, project_id, env_id),
+        )
+    except CLIRequestError as exc:
+        typer.echo(str(exc), err=True)
+        raise typer.Exit(1) from exc
+    typer.echo(print_json(result))
+
+
+@app.command("evaluate")
+def evaluate_policy(
+    policy_id: str = typer.Argument(...),
+    context: str = typer.Option(..., "--context", help="JSON object"),
+    profile: str | None = typer.Option(None, "--profile"),
+    org_id: str | None = typer.Option(None, "--org"),
+    project_id: str | None = typer.Option(None, "--project"),
+    env_id: str | None = typer.Option(None, "--env"),
+) -> None:
+    """Evaluate policy against an explicit context."""
+    safe_id = quote(policy_id, safe="")
+    try:
+        parsed_context = parse_json_arg(context, label="--context")
+        if not isinstance(parsed_context, dict):
+            raise CLIRequestError("--context must be a JSON object")
+
+        result = call_api(
+            method="POST",
+            path=f"/api/v1/policies/{safe_id}/evaluate",
+            profile=profile,
+            body={"context": parsed_context},
+            require_scope=False,
+            **_scope_opts(org_id, project_id, env_id),
+        )
+    except CLIRequestError as exc:
+        typer.echo(str(exc), err=True)
+        raise typer.Exit(1) from exc
+
+    typer.echo(print_json(result))
+
+
+@app.command("check")
+def check_policy(
+    action: str = typer.Option(..., "--action", help="Action, e.g. sql:select or nosql:write"),
+    resource: str = typer.Option(..., "--resource", help="Resource name, table, or collection"),
+    context: str | None = typer.Option(None, "--context", help="Optional JSON context object"),
+    profile: str | None = typer.Option(None, "--profile"),
+    org_id: str | None = typer.Option(None, "--org"),
+    project_id: str | None = typer.Option(None, "--project"),
+    env_id: str | None = typer.Option(None, "--env"),
+) -> None:
+    """Preflight an action/resource against active Guard policies."""
+    try:
+        parsed_context = parse_json_arg(context, label="--context") if context else {}
+        if not isinstance(parsed_context, dict):
+            raise CLIRequestError("--context must be a JSON object")
+        if not org_id or not project_id:
+            raise CLIRequestError("--org and --project are required for policy check")
+
+        result = call_api(
+            method="POST",
+            path="/api/v1/policies/check",
+            profile=profile,
+            body={
+                "org_id": org_id,
+                "project_id": project_id,
+                "action": action,
+                "resource": resource,
+                "context": parsed_context,
+            },
+            require_scope=False,
+            **_scope_opts(org_id, project_id, env_id),
+        )
+    except CLIRequestError as exc:
+        typer.echo(str(exc), err=True)
+        raise typer.Exit(1) from exc
+
+    typer.echo(print_json(result))
+
+
+@app.command("simulate")
+def simulate_policy(
+    spl_source: str = typer.Option(..., "--spl", help="SPL policy source to dry-run"),
+    context: str = typer.Option("{}", "--context", help="JSON evaluation context"),
+    profile: str | None = typer.Option(None, "--profile"),
+    org_id: str | None = typer.Option(None, "--org"),
+    project_id: str | None = typer.Option(None, "--project"),
+    env_id: str | None = typer.Option(None, "--env"),
+) -> None:
+    """Simulate SPL policy evaluation without persisting a policy."""
+    try:
+        parsed_context = parse_json_arg(context, label="--context")
+        if parsed_context is None or not isinstance(parsed_context, dict):
+            raise CLIRequestError("--context must be a JSON object")
+        result = call_api(
+            method="POST",
+            path="/api/v1/policies/simulate",
+            profile=profile,
+            body={"spl_source": spl_source, "context": parsed_context},
+            require_scope=True,
+            **_scope_opts(org_id, project_id, env_id),
+        )
+    except CLIRequestError as exc:
+        typer.echo(str(exc), err=True)
+        raise typer.Exit(1) from exc
+
+    typer.echo(print_json(result))

apps/cli/src/commands/project.py

@@ -0,0 +1,130 @@
+"""Project scaffold and linkage commands."""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+import typer
+
+from sovaria.models import SovariaError
+from sovaria.project import (
+    DEFAULT_CONFIG_FILENAME,
+    create_project_from_config_file,
+    write_project_config_template,
+)
+
+from apps.cli.src.utils.config import set_scope
+from apps.cli.src.utils.display import print_json, print_success
+from apps.cli.src.utils.project_context import (
+    find_project_config,
+    link_project_to_profile,
+    project_status,
+)
+
+app = typer.Typer(help="Project scaffold and linkage commands")
+
+
+@app.command("init-config")
+def init_config(
+    name: str = typer.Argument("sovaria-app", help="Project name used in the generated config"),
+    output: str = typer.Option(
+        DEFAULT_CONFIG_FILENAME,
+        "--output",
+        "-o",
+        help="Path to write the template config JSON",
+    ),
+    force: bool = typer.Option(False, "--force", help="Overwrite existing config file if present"),
+) -> None:
+    """Create a template sovaria.config.json file."""
+    try:
+        path = write_project_config_template(output, name=name, overwrite=force)
+    except SovariaError as exc:
+        typer.echo(str(exc), err=True)
+        raise typer.Exit(1) from exc
+    typer.echo(f"Config template written: {path}")
+
+
+@app.command("create")
+def create(
+    config: str = typer.Option(
+        DEFAULT_CONFIG_FILENAME,
+        "--config",
+        "-c",
+        help="Path to sovaria project config JSON",
+    ),
+    directory: str = typer.Option(
+        ".",
+        "--dir",
+        help="Parent directory where the project folder will be created",
+    ),
+    force: bool = typer.Option(
+        False,
+        "--force",
+        help="Allow scaffold to overwrite existing files when possible",
+    ),
+) -> None:
+    """Create a project from sovaria.config.json."""
+    try:
+        result = create_project_from_config_file(config, target_dir=directory, force=force)
+    except SovariaError as exc:
+        typer.echo(str(exc), err=True)
+        raise typer.Exit(1) from exc
+
+    typer.echo(f"Project created: {result.project_root}")
+    typer.echo(f"Config copied: {result.config_path}")
+
+
+@app.command("status")
+def status() -> None:
+    """Show local sovaria.config.json linkage and resolved scope."""
+    print_json(project_status())
+
+
+@app.command("link")
+def link(
+    org_id: str = typer.Option(..., "--org", help="Organisation node ID"),
+    project_id: str = typer.Option(..., "--project", help="Project node ID"),
+    env_id: str | None = typer.Option(None, "--env", help="Environment ID"),
+    profile: str | None = typer.Option(None, "--profile"),
+    config: Path | None = typer.Option(
+        None,
+        "--config",
+        "-c",
+        help="Path to sovaria.config.json (auto-discovered when omitted)",
+    ),
+) -> None:
+    """Write org/project scope into sovaria.config.json and the active profile."""
+    config_path = config or find_project_config()
+    if config_path is None:
+        typer.echo(
+            f"No {DEFAULT_CONFIG_FILENAME} found. Run `sov init` or `sov project init-config` first.",
+            err=True,
+        )
+        raise typer.Exit(1)
+    try:
+        path = link_project_to_profile(
+            org_id=org_id,
+            project_id=project_id,
+            env_id=env_id,
+            profile=profile,
+            config_path=config_path,
+        )
+    except (FileNotFoundError, ValueError) as exc:
+        typer.echo(str(exc), err=True)
+        raise typer.Exit(1) from exc
+    print_success(f"Linked project scope in {path}")
+
+
+@app.command("use")
+def use(
+    org_id: str = typer.Argument(..., help="Organisation node ID"),
+    project_id: str = typer.Argument(..., help="Project node ID"),
+    env_id: str | None = typer.Option(None, "--env"),
+    profile: str | None = typer.Option(None, "--profile"),
+) -> None:
+    """Set default scope for CLI commands (profile only, no config file write)."""
+    set_scope(org_id=org_id, project_id=project_id, env_id=env_id, profile=profile)
+    print_success("Active scope updated.")
+    typer.echo(f"  org_id     : {org_id}")
+    typer.echo(f"  project_id : {project_id}")
+    typer.echo(f"  env_id     : {env_id or '-'}")