sovaria-cli 0.2.0__py3-none-any.whl

apps/cli/src/utils/project_context.py

@@ -0,0 +1,124 @@
+"""Discover and apply sovaria.config.json scope for CLI commands."""
+
+from __future__ import annotations
+
+import json
+from pathlib import Path
+from typing import Any
+
+from sovaria.project import DEFAULT_CONFIG_FILENAME, load_project_config
+
+from apps.cli.src.utils.config import get_scope, set_scope
+
+
+def find_project_config(start: Path | None = None) -> Path | None:
+    """Walk upward from *start* (or cwd) looking for sovaria.config.json."""
+    cwd = (start or Path.cwd()).resolve()
+    for directory in (cwd, *cwd.parents):
+        candidate = directory / DEFAULT_CONFIG_FILENAME
+        if candidate.is_file():
+            return candidate
+    return None
+
+
+def load_local_project_config(config_path: Path | None = None) -> dict[str, Any] | None:
+    """Return project config dict from disk, or None if not linked locally."""
+    path = config_path or find_project_config()
+    if path is None:
+        return None
+    try:
+        return load_project_config(path).to_dict()
+    except Exception:
+        return None
+
+
+def linked_scope(profile: str | None = None) -> dict[str, str]:
+    """Return org/project/env from local sovaria.config.json when present."""
+    path = find_project_config()
+    if path is None:
+        return {"org_id": "", "project_id": "", "env_id": ""}
+    try:
+        cfg = load_project_config(path)
+    except Exception:
+        return {"org_id": "", "project_id": "", "env_id": ""}
+    return {
+        "org_id": cfg.scope.org_id,
+        "project_id": cfg.scope.project_id,
+        "env_id": cfg.scope.env_id,
+    }
+
+
+def resolve_scope(
+    *,
+    profile: str | None,
+    org_id: str | None,
+    project_id: str | None,
+    env_id: str | None,
+    require: bool = False,
+) -> tuple[str, str, str]:
+    """Merge explicit flags, local project config, and profile defaults."""
+    local = linked_scope(profile)
+    profile_scope = get_scope(profile)
+
+    resolved_org = (org_id or local.get("org_id") or profile_scope.get("org_id") or "").strip()
+    resolved_project = (
+        project_id or local.get("project_id") or profile_scope.get("project_id") or ""
+    ).strip()
+    resolved_env = (env_id or local.get("env_id") or profile_scope.get("env_id") or "").strip()
+
+    if require and (not resolved_org or not resolved_project):
+        raise ValueError(
+            "Missing project scope. Run `sov project link`, `sov scope set`, or pass --org/--project."
+        )
+    return resolved_org, resolved_project, resolved_env
+
+
+def link_project_to_profile(
+    *,
+    org_id: str,
+    project_id: str,
+    env_id: str | None = None,
+    profile: str | None = None,
+    config_path: Path | None = None,
+) -> Path:
+    """Write scope IDs into sovaria.config.json and ~/.sovaria/config.yaml."""
+    path = config_path or find_project_config()
+    if path is None:
+        raise FileNotFoundError(
+            f"No {DEFAULT_CONFIG_FILENAME} found. Run `sov project init-config` or `sov init` first."
+        )
+
+    raw = json.loads(path.read_text())
+    if not isinstance(raw, dict):
+        raise ValueError(f"Invalid config file: {path}")
+    scope = raw.setdefault("scope", {})
+    if not isinstance(scope, dict):
+        scope = {}
+        raw["scope"] = scope
+    scope["org_id"] = org_id.strip()
+    scope["project_id"] = project_id.strip()
+    if env_id:
+        scope["env_id"] = env_id.strip()
+    path.write_text(json.dumps(raw, indent=2, sort_keys=True) + "\n")
+
+    set_scope(org_id=org_id, project_id=project_id, env_id=env_id, profile=profile)
+    return path
+
+
+def project_status() -> dict[str, Any]:
+    """Summarize local project linkage for `sov project status`."""
+    path = find_project_config()
+    if path is None:
+        return {"linked": False, "config_path": None}
+    try:
+        cfg = load_project_config(path)
+    except Exception as exc:
+        return {"linked": False, "config_path": str(path), "error": str(exc)}
+    return {
+        "linked": bool(cfg.scope.org_id and cfg.scope.project_id),
+        "config_path": str(path),
+        "project_name": cfg.name,
+        "gateway_url": cfg.gateway_url,
+        "scope": cfg.scope.to_dict(),
+        "features": cfg.features.to_dict(),
+    }

apps/cli/tests/test_auth_store_profiles.py

@@ -0,0 +1,103 @@
+"""Regression tests for profile-aware CLI token persistence."""
+
+from __future__ import annotations
+
+import sys
+import tomllib
+import types
+from pathlib import Path
+
+import pytest
+
+try:
+    import tomli_w as _tomli_w  # noqa: F401
+except ModuleNotFoundError:
+    # Minimal shim for test environments without tomli-w installed.
+    def _shim_dumps(payload: dict[object, object]) -> str:
+        lines: list[str] = []
+        if "version" in payload:
+            lines.append(f"version = {payload['version']}")
+            lines.append("")
+        profiles = payload.get("profiles")
+        if isinstance(profiles, dict):
+            for profile_name, profile_payload in profiles.items():
+                lines.append(f"[profiles.{profile_name}]")
+                if isinstance(profile_payload, dict):
+                    for key, value in profile_payload.items():
+                        lines.append(f'{key} = "{value}"')
+                lines.append("")
+            return "\n".join(lines).rstrip() + "\n"
+
+        for key, value in payload.items():
+            lines.append(f'{key} = "{value}"')
+        return "\n".join(lines).rstrip() + "\n"
+
+    _shim_module = types.ModuleType("tomli_w")
+    _shim_module.dumps = _shim_dumps  # type: ignore[attr-defined]
+    sys.modules["tomli_w"] = _shim_module
+
+from apps.cli.src.utils import auth_store
+
+
+@pytest.fixture
+def isolated_auth_store(monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> Path:
+    """Force auth_store to use file fallback in a temporary sovaria dir."""
+    sovaria_dir = tmp_path / ".sovaria"
+    cred_file = sovaria_dir / "credentials.toml"
+    monkeypatch.setattr(auth_store, "_KEYRING_AVAILABLE", False)
+    monkeypatch.setattr(auth_store, "_SOVARIA_DIR", sovaria_dir)
+    monkeypatch.setattr(auth_store, "_CRED_FILE", cred_file)
+    return cred_file
+
+
+def test_save_and_load_tokens_are_profile_scoped(isolated_auth_store: Path) -> None:
+    auth_store.save_tokens("dev_access", "dev_refresh", profile="dev")
+    auth_store.save_tokens("staging_access", "staging_refresh", profile="staging")
+
+    dev_tokens = auth_store.load_tokens(profile="dev")
+    assert dev_tokens is not None
+    assert dev_tokens["access_token"] == "dev_access"
+    assert dev_tokens["refresh_token"] == "dev_refresh"
+    assert "expires_at" in dev_tokens
+
+    staging_tokens = auth_store.load_tokens(profile="staging")
+    assert staging_tokens is not None
+    assert staging_tokens["access_token"] == "staging_access"
+    assert staging_tokens["refresh_token"] == "staging_refresh"
+    assert "expires_at" in staging_tokens
+
+    parsed = tomllib.loads(isolated_auth_store.read_text())
+    assert parsed["version"] == 1
+    assert parsed["profiles"]["dev"]["access_token"] == "dev_access"
+    assert parsed["profiles"]["staging"]["access_token"] == "staging_access"
+
+
+def test_clear_tokens_only_removes_selected_profile(isolated_auth_store: Path) -> None:
+    auth_store.save_tokens("dev_access", "dev_refresh", profile="dev")
+    auth_store.save_tokens("prod_access", "prod_refresh", profile="prod")
+
+    auth_store.clear_tokens(profile="dev")
+
+    assert auth_store.load_tokens(profile="dev") is None
+    prod_tokens = auth_store.load_tokens(profile="prod")
+    assert prod_tokens is not None
+    assert prod_tokens["access_token"] == "prod_access"
+    assert prod_tokens["refresh_token"] == "prod_refresh"
+    assert "expires_at" in prod_tokens
+    assert isolated_auth_store.exists()
+
+
+def test_load_tokens_accepts_legacy_credential_shape(isolated_auth_store: Path) -> None:
+    isolated_auth_store.parent.mkdir(parents=True, exist_ok=True)
+    isolated_auth_store.write_text(
+        'access_token = "legacy_access"\nrefresh_token = "legacy_refresh"\n',
+    )
+
+    assert auth_store.load_tokens(profile="prod") == {
+        "access_token": "legacy_access",
+        "refresh_token": "legacy_refresh",
+    }
+
+    parsed = tomllib.loads(isolated_auth_store.read_text())
+    assert parsed["version"] == 1
+    assert parsed["profiles"]["prod"]["access_token"] == "legacy_access"

apps/cli/tests/test_cli_security.py

@@ -0,0 +1,110 @@
+"""Tests for CLI MFA login handling and token refresh."""
+
+from __future__ import annotations
+
+import time
+from typing import Any
+from unittest.mock import patch
+
+import httpx
+import pytest
+
+from apps.cli.src.utils.api_client import CLIMfaRequiredError, _apply_login_response, call_api
+from apps.cli.src.utils.auth_store import clear_mfa_pending, clear_tokens, load_mfa_pending, load_tokens, save_tokens
+
+
+@pytest.fixture(autouse=True)
+def _clean_auth_store(tmp_path, monkeypatch):
+    sovaria_dir = tmp_path / ".sovaria"
+    sovaria_dir.mkdir()
+    monkeypatch.setattr("apps.cli.src.utils.auth_store._SOVARIA_DIR", sovaria_dir)
+    monkeypatch.setattr("apps.cli.src.utils.auth_store._CRED_FILE", sovaria_dir / "credentials.toml")
+    monkeypatch.setattr("apps.cli.src.utils.auth_store._KEYRING_AVAILABLE", False)
+    yield
+
+
+def test_apply_login_response_rejects_mfa_without_refresh() -> None:
+    with pytest.raises(CLIMfaRequiredError):
+        _apply_login_response(
+            {
+                "access_token": "pre-mfa-token",
+                "refresh_token": None,
+                "expires_in": 300,
+                "mfa_required": True,
+            },
+            profile=None,
+        )
+
+    pending = load_mfa_pending()
+    assert pending is not None
+    assert pending["access_token"] == "pre-mfa-token"
+
+
+def test_apply_login_response_persists_full_session() -> None:
+    _apply_login_response(
+        {
+            "access_token": "access-1",
+            "refresh_token": "refresh-1",
+            "expires_in": 3600,
+            "mfa_required": False,
+        },
+        profile=None,
+    )
+    tokens = load_tokens()
+    assert tokens is not None
+    assert tokens["access_token"] == "access-1"
+    assert tokens["refresh_token"] == "refresh-1"
+
+
+def test_call_api_refreshes_expired_token(monkeypatch) -> None:
+    save_tokens("old-access", "refresh-1", expires_in=3600)
+    monkeypatch.setattr(
+        "apps.cli.src.utils.api_client._token_needs_refresh",
+        lambda _tokens: True,
+    )
+
+    captured: dict[str, Any] = {}
+
+    def fake_post(url: str, **kwargs: Any) -> httpx.Response:
+        if url.endswith("/api/v1/auth/refresh"):
+            captured["refreshed"] = True
+            return httpx.Response(
+                200,
+                json={
+                    "access_token": "new-access",
+                    "refresh_token": "refresh-2",
+                    "expires_in": 3600,
+                },
+                request=httpx.Request("POST", url),
+            )
+        raise AssertionError(f"unexpected POST {url}")
+
+    def fake_request(method: str, url: str, **kwargs: Any) -> httpx.Response:
+        captured["authorized"] = kwargs["headers"].get("Authorization")
+        return httpx.Response(200, json={"ok": True}, request=httpx.Request(method, url))
+
+    monkeypatch.setattr("apps.cli.src.utils.api_client.httpx.request", fake_request)
+    monkeypatch.setattr("apps.cli.src.utils.api_client.httpx.post", fake_post)
+    monkeypatch.setattr("apps.cli.src.utils.api_client.get_api_url", lambda _p=None: "http://gateway.test")
+
+    result = call_api(method="GET", path="/api/v1/auth/me")
+    assert result == {"ok": True}
+    assert captured.get("refreshed") is True
+    assert captured.get("authorized") == "Bearer new-access"
+
+    stored = load_tokens()
+    assert stored is not None
+    assert stored["access_token"] == "new-access"
+
+
+def test_call_api_blocks_when_mfa_pending(monkeypatch) -> None:
+    from apps.cli.src.utils.auth_store import save_mfa_pending
+
+    save_mfa_pending("pre-mfa-token")
+    clear_tokens()
+    monkeypatch.setattr("apps.cli.src.utils.api_client.get_api_url", lambda _p=None: "http://gateway.test")
+
+    with pytest.raises(CLIMfaRequiredError):
+        call_api(method="GET", path="/api/v1/auth/me")
+
+    clear_mfa_pending()

apps/cli/tests/test_cli_smoke_paths.py

@@ -0,0 +1,279 @@
+"""Smoke tests for core CLI command paths (auth/data/storage/policy)."""
+
+from __future__ import annotations
+
+import sys
+import types
+from typing import Any
+
+import pytest
+
+if "typer" not in sys.modules:
+
+    class _TyperExit(Exception):
+        def __init__(self, code: int = 0) -> None:
+            super().__init__(code)
+            self.exit_code = code
+
+    class _TyperApp:
+        def command(self, *args: object, **kwargs: object) -> Any:
+            def _decorator(func: Any) -> Any:
+                return func
+
+            return _decorator
+
+        def add_typer(self, *args: object, **kwargs: object) -> None:
+            return None
+
+        def callback(self, *args: object, **kwargs: object) -> Any:
+            def _decorator(func: Any) -> Any:
+                return func
+
+            return _decorator
+
+    _typer_module = types.ModuleType("typer")
+    _typer_module.Typer = lambda *args, **kwargs: _TyperApp()  # type: ignore[attr-defined]
+    _typer_module.Option = lambda default=None, *args, **kwargs: default  # type: ignore[attr-defined]
+    _typer_module.Argument = lambda default=None, *args, **kwargs: default  # type: ignore[attr-defined]
+    _typer_module.echo = lambda *args, **kwargs: None  # type: ignore[attr-defined]
+    _typer_module.style = lambda text, *args, **kwargs: text  # type: ignore[attr-defined]
+    _typer_module.Exit = _TyperExit  # type: ignore[attr-defined]
+    _typer_module.Context = object  # type: ignore[attr-defined]
+    _typer_module.colors = types.SimpleNamespace(RED="red", GREEN="green")  # type: ignore[attr-defined]
+    sys.modules["typer"] = _typer_module
+
+if "tomli_w" not in sys.modules:
+
+    def _shim_tomli_w_dumps(payload: dict[object, object]) -> str:
+        lines: list[str] = []
+        if "version" in payload:
+            lines.append(f"version = {payload['version']}")
+            lines.append("")
+        profiles = payload.get("profiles")
+        if isinstance(profiles, dict):
+            for profile_name, profile_payload in profiles.items():
+                lines.append(f"[profiles.{profile_name}]")
+                if isinstance(profile_payload, dict):
+                    for key, value in profile_payload.items():
+                        lines.append(f'{key} = "{value}"')
+                lines.append("")
+            return "\n".join(lines).rstrip() + "\n"
+        for key, value in payload.items():
+            lines.append(f'{key} = "{value}"')
+        return "\n".join(lines).rstrip() + "\n"
+
+    _tomli_w_module = types.ModuleType("tomli_w")
+    _tomli_w_module.dumps = _shim_tomli_w_dumps  # type: ignore[attr-defined]
+    sys.modules["tomli_w"] = _tomli_w_module
+
+
+from apps.cli.src.utils.api_client import CLIRequestError
+from apps.cli.src.commands import auth_product, data, policy, realtime, storage
+
+
+def test_auth_users_path_smoke(monkeypatch: pytest.MonkeyPatch) -> None:
+    captured: dict[str, Any] = {}
+
+    def _fake_call_api(**kwargs: Any) -> dict[str, Any]:
+        captured.update(kwargs)
+        return {"ok": True}
+
+    monkeypatch.setattr(auth_product, "call_api", _fake_call_api)
+    auth_product.list_users(profile="staging", org_id="org-1", project_id="proj-1", env_id=None)
+
+    assert captured["method"] == "GET"
+    assert captured["path"] == "/api/v1/projects/proj-1/auth/users"
+    assert captured["profile"] == "staging"
+    assert captured["require_scope"] is True
+
+
+def test_auth_user_roles_set_path_smoke(monkeypatch: pytest.MonkeyPatch) -> None:
+    captured: dict[str, Any] = {}
+
+    def _fake_call_api(**kwargs: Any) -> dict[str, Any]:
+        captured.update(kwargs)
+        return {"ok": True}
+
+    monkeypatch.setattr(auth_product, "call_api", _fake_call_api)
+    auth_product.set_roles(
+        user_id="user-1",
+        roles=["SUPPORT"],
+        profile="staging",
+        org_id="org-1",
+        project_id="proj-1",
+        env_id=None,
+    )
+
+    assert captured["method"] == "PUT"
+    assert captured["path"] == "/api/v1/projects/proj-1/auth/users/user-1/roles"
+    assert captured["body"] == {"roles": ["SUPPORT"]}
+    assert captured["require_scope"] is True
+
+
+def test_data_sql_path_smoke(monkeypatch: pytest.MonkeyPatch) -> None:
+    captured: dict[str, Any] = {}
+
+    def _fake_call_api(**kwargs: Any) -> dict[str, Any]:
+        captured.update(kwargs)
+        return {"columns": ["x"], "rows": [[1]]}
+
+    monkeypatch.setattr(data, "call_api", _fake_call_api)
+    data.sql_query(
+        sql="select 1",
+        txid=0,
+        profile="prod",
+        org_id="org-1",
+        project_id="proj-1",
+        env_id=None,
+    )
+
+    assert captured["method"] == "POST"
+    assert captured["path"] == "/api/v1/sql/query"
+    assert captured["profile"] == "prod"
+    assert captured["require_scope"] is True
+
+
+def test_policy_list_path_smoke(monkeypatch: pytest.MonkeyPatch) -> None:
+    captured: dict[str, Any] = {}
+
+    def _fake_call_api(**kwargs: Any) -> list[dict[str, Any]]:
+        captured.update(kwargs)
+        return [{"policy_id": "p1"}]
+
+    monkeypatch.setattr(policy, "call_api", _fake_call_api)
+    policy.list_policies(profile="dev", org_id="org-1", project_id="proj-1", env_id=None)
+
+    assert captured["method"] == "GET"
+    assert captured["path"] == "/api/v1/policies/"
+    assert captured["profile"] == "dev"
+
+
+def test_policy_check_path_smoke(monkeypatch: pytest.MonkeyPatch) -> None:
+    captured: dict[str, Any] = {}
+
+    def _fake_call_api(**kwargs: Any) -> dict[str, Any]:
+        captured.update(kwargs)
+        return {"allowed": True}
+
+    monkeypatch.setattr(policy, "call_api", _fake_call_api)
+    policy.check_policy(
+        action="sql:select",
+        resource="users",
+        context='{"actor":{"roles":["SUPPORT"]}}',
+        profile="dev",
+        org_id="org-1",
+        project_id="proj-1",
+        env_id=None,
+    )
+
+    assert captured["method"] == "POST"
+    assert captured["path"] == "/api/v1/policies/check"
+    assert captured["body"] == {
+        "org_id": "org-1",
+        "project_id": "proj-1",
+        "action": "sql:select",
+        "resource": "users",
+        "context": {"actor": {"roles": ["SUPPORT"]}},
+    }
+
+
+def test_policy_upsert_surfaces_non_conflict_create_errors(monkeypatch: pytest.MonkeyPatch) -> None:
+    captured: list[tuple[str, bool]] = []
+
+    def _fake_call_api(**kwargs: Any) -> dict[str, Any]:
+        raise CLIRequestError("create failed", status_code=400)
+
+    monkeypatch.setattr(policy, "call_api", _fake_call_api)
+    monkeypatch.setattr(
+        policy.typer,
+        "echo",
+        lambda message, err=False: captured.append((str(message), err)),
+    )
+
+    with pytest.raises(policy.typer.Exit) as exc_info:
+        policy.upsert_policy(
+            policy_id="p1",
+            name="policy",
+            spl_source="allow",
+            org_id="org-1",
+            profile="dev",
+            project_id="proj-1",
+            env_id=None,
+        )
+
+    assert exc_info.value.exit_code == 1
+    assert any("create failed" in message for message, _ in captured)
+
+
+def test_policy_upsert_updates_on_create_conflict(monkeypatch: pytest.MonkeyPatch) -> None:
+    calls: list[dict[str, Any]] = []
+
+    def _fake_call_api(**kwargs: Any) -> dict[str, Any]:
+        calls.append(kwargs)
+        if kwargs["method"] == "POST":
+            raise CLIRequestError("already exists", status_code=409)
+        return {"updated": True}
+
+    monkeypatch.setattr(policy, "call_api", _fake_call_api)
+
+    policy.upsert_policy(
+        policy_id="p1",
+        name="policy",
+        spl_source="allow",
+        org_id="org-1",
+        profile="dev",
+        project_id="proj-1",
+        env_id=None,
+    )
+
+    assert [call["method"] for call in calls] == ["POST", "PUT"]
+def test_realtime_ws_url_issues_ticket_not_token_query(monkeypatch: pytest.MonkeyPatch) -> None:
+    captured: dict[str, Any] = {}
+    output: list[str] = []
+
+    def _fake_call_api(**kwargs: Any) -> dict[str, Any]:
+        captured.update(kwargs)
+        return {"ticket": "ticket-1"}
+
+    monkeypatch.setattr(realtime, "call_api", _fake_call_api)
+    monkeypatch.setattr(realtime, "get_api_url", lambda profile=None: "http://gateway:8000")
+    monkeypatch.setattr(
+        realtime,
+        "get_scope",
+        lambda profile=None: {"org_id": "org-1", "project_id": "proj-1", "env_id": ""},
+    )
+    monkeypatch.setattr(realtime.typer, "echo", lambda message, err=False: output.append(str(message)))
+
+    realtime.ws_url(channel="db.table.users", profile="dev", ticket=None, org_id=None, project_id=None, env_id=None)
+
+    assert captured["method"] == "POST"
+    assert captured["path"] == "/api/v1/auth/ws-ticket"
+    assert captured["body"] == {
+        "channel": "db.table.users",
+        "org_id": "org-1",
+        "project_id": "proj-1",
+    }
+    assert output == [
+        "ws://gateway:8000/api/v1/rt/ws/db.table.users?ticket=ticket-1&org_id=org-1&project_id=proj-1"
+    ]
+    assert "token=" not in output[0]
+
+
+def test_storage_buckets_path_smoke(monkeypatch: pytest.MonkeyPatch) -> None:
+    captured: dict[str, Any] = {}
+    output: list[str] = []
+
+    def _fake_call_api(**kwargs: Any) -> list[dict[str, Any]]:
+        captured.update(kwargs)
+        return [{"name": "bucket-a", "public": False, "object_count": 1}]
+
+    monkeypatch.setattr(storage, "call_api", _fake_call_api)
+    monkeypatch.setattr(
+        storage.typer, "echo", lambda message, err=False: output.append(str(message))
+    )
+
+    storage.list_buckets(project_id="proj-1", org_id=None, env_id=None, profile=None)
+
+    assert captured["path"] == "/api/v1/store/buckets"
+    assert captured["require_scope"] is True
+    assert any("bucket-a" in line for line in output)

apps/cli/tests/test_config_profiles.py

@@ -0,0 +1,55 @@
+"""Regression tests for CLI config profile normalization."""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+import pytest
+import yaml
+
+from apps.cli.src.utils import config
+
+
+def test_get_api_url_upgrades_unversioned_string_profile(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    config_file = tmp_path / ".sovaria" / "config.yaml"
+    config_file.parent.mkdir(parents=True, exist_ok=True)
+    config_file.write_text(
+        yaml.safe_dump(
+            {
+                "default_profile": "dev",
+                "profiles": {
+                    "dev": "http://localhost:8000",
+                },
+            }
+        )
+    )
+    monkeypatch.setattr(config, "_CONFIG_FILE", config_file)
+
+    assert config.get_api_url("dev") == "http://localhost:8000"
+
+    parsed = yaml.safe_load(config_file.read_text())
+    assert parsed["version"] == 1
+    assert parsed["profiles"]["dev"] == {"api_url": "http://localhost:8000"}
+
+
+def test_get_scope_coerces_string_profile(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    config_file = tmp_path / ".sovaria" / "config.yaml"
+    config_file.parent.mkdir(parents=True, exist_ok=True)
+    config_file.write_text(
+        yaml.safe_dump(
+            {
+                "version": 1,
+                "default_profile": "dev",
+                "profiles": {
+                    "dev": "http://localhost:8000",
+                },
+            }
+        )
+    )
+    monkeypatch.setattr(config, "_CONFIG_FILE", config_file)
+
+    assert config.get_scope("dev") == {"org_id": "", "project_id": "", "env_id": ""}