sovaria-cli 0.2.1__tar.gz → 0.2.3__tar.gz

{sovaria_cli-0.2.1 → sovaria_cli-0.2.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: sovaria-cli
-Version: 0.2.1
+Version: 0.2.3
 Summary: Sovaria BaaS command-line interface (sov)
 Project-URL: Homepage, https://sovaria.in
 Project-URL: Documentation, https://docs.sovaria.in/cli

{sovaria_cli-0.2.1 → sovaria_cli-0.2.3}/apps/cli/src/__init__.py

@@ -1,3 +1,3 @@
 """Sovaria CLI — sov command."""
 
-__version__ = "0.2.1"
+__version__ = "0.2.3"

sovaria_cli-0.2.3/apps/cli/src/commands/context.py

@@ -0,0 +1,208 @@
+"""
+apps.cli.src.commands.context — Show current user/org context.
+"""
+
+from __future__ import annotations
+
+import httpx
+import typer
+
+from apps.cli.src.utils.api_client import CLIRequestError
+from apps.cli.src.utils.auth_store import load_tokens
+from apps.cli.src.utils.config import get_api_url, get_scope
+from apps.cli.src.utils.project_context import project_status
+from apps.cli.src.utils.scope_picker import (
+    fetch_orgs,
+    fetch_projects,
+    interactive_pick_scope,
+    print_access_catalog,
+    _node_id,
+    _node_name,
+)
+
+app = typer.Typer()
+
+
+def _resolve_user_id(data: dict) -> str:
+    for key in ("user_id", "id", "sub"):
+        value = str(data.get(key) or "").strip()
+        if value:
+            return value
+    return "-"
+
+
+@app.command("whoami")
+def whoami(
+    profile: str | None = typer.Option(None, "--profile"),
+) -> None:
+    """Print the authenticated user, active scope, and accessible orgs/projects."""
+    tokens = load_tokens(profile=profile)
+    if not tokens:
+        typer.echo("Not logged in. Run: sov login", err=True)
+        raise typer.Exit(1)
+
+    api_url = get_api_url(profile)
+    try:
+        resp = httpx.get(
+            f"{api_url}/api/v1/auth/me",
+            headers={"Authorization": f"Bearer {tokens['access_token']}"},
+            timeout=10,
+        )
+        resp.raise_for_status()
+        data = resp.json()
+        typer.echo(f"user_id : {_resolve_user_id(data)}")
+        typer.echo(f"email   : {data.get('email', '-')}")
+        typer.echo(f"roles   : {', '.join(data.get('roles', []))}")
+        typer.echo(f"lane    : {data.get('actor_lane', '-')}")
+        typer.echo(f"subject : {data.get('auth_subject_type', '-')}")
+
+        scope = get_scope(profile)
+        status = project_status()
+        linked_scope = status.get("scope") if isinstance(status.get("scope"), dict) else {}
+        org_id = str(scope.get("org_id") or linked_scope.get("org_id") or data.get("org_id") or "-")
+        project_id = str(
+            scope.get("project_id") or linked_scope.get("project_id") or data.get("project_id") or "-"
+        )
+        env_id = str(scope.get("env_id") or linked_scope.get("env_id") or data.get("env_id") or "-")
+        typer.echo(f"scope   : org={org_id} project={project_id} env={env_id}")
+
+        typer.echo("")
+        print_access_catalog(profile)
+    except httpx.HTTPStatusError as exc:
+        if exc.response.status_code == 401:
+            typer.echo("Session expired - run: sov login", err=True)
+        else:
+            typer.echo(f"Error: {exc.response.text}", err=True)
+        raise typer.Exit(1) from exc
+
+
+@app.command("list")
+def list_access(
+    profile: str | None = typer.Option(None, "--profile"),
+) -> None:
+    """List organisations and projects you can use with the CLI."""
+    if not load_tokens(profile=profile):
+        typer.echo("Not logged in. Run: sov login", err=True)
+        raise typer.Exit(1)
+    print_access_catalog(profile)
+
+
+@app.command("orgs")
+def list_orgs(
+    profile: str | None = typer.Option(None, "--profile"),
+) -> None:
+    """List organisations visible to the authenticated user."""
+    if not load_tokens(profile=profile):
+        typer.echo("Not logged in. Run: sov login", err=True)
+        raise typer.Exit(1)
+    orgs = fetch_orgs(profile)
+    if not orgs:
+        typer.echo("No organisations found.")
+        return
+    for index, org in enumerate(orgs, start=1):
+        typer.echo(f"{index}. {_node_name(org)}  org_id={_node_id(org)}")
+
+
+@app.command("projects")
+def list_projects(
+    org_id: str | None = typer.Argument(None, help="Organisation ID (auto-picked when only one org)"),
+    profile: str | None = typer.Option(None, "--profile"),
+) -> None:
+    """List projects under an organisation."""
+    if not load_tokens(profile=profile):
+        typer.echo("Not logged in. Run: sov login", err=True)
+        raise typer.Exit(1)
+
+    resolved_org = org_id
+    if not resolved_org:
+        orgs = fetch_orgs(profile)
+        if not orgs:
+            typer.echo("No organisations found.", err=True)
+            raise typer.Exit(1)
+        if len(orgs) == 1:
+            resolved_org = _node_id(orgs[0])
+        else:
+            typer.echo("Multiple organisations found — pass org_id:", err=True)
+            for index, org in enumerate(orgs, start=1):
+                typer.echo(f"  {index}. {_node_name(org)}  org_id={_node_id(org)}")
+            raise typer.Exit(1)
+
+    projects = fetch_projects(resolved_org, profile)
+    if not projects:
+        typer.echo("No projects found.")
+        return
+    for index, project in enumerate(projects, start=1):
+        env_hint = str(project.get("env_name") or project.get("env_id") or "").strip()
+        suffix = f"  env={env_hint}" if env_hint else ""
+        typer.echo(
+            f"{index}. {_node_name(project)}  project_id={_node_id(project)}{suffix}"
+        )
+
+
+@app.command("pick")
+def pick_scope(
+    profile: str | None = typer.Option(None, "--profile"),
+) -> None:
+    """Interactively pick default org/project scope by index."""
+    if not load_tokens(profile=profile):
+        typer.echo("Not logged in. Run: sov login", err=True)
+        raise typer.Exit(1)
+    try:
+        scope = interactive_pick_scope(profile)
+    except CLIRequestError as exc:
+        typer.echo(str(exc), err=True)
+        raise typer.Exit(1) from exc
+    if scope:
+        typer.echo(
+            f"Default scope saved: org={scope['org_id']} project={scope['project_id']}"
+            + (f" env={scope['env_id']}" if scope.get("env_id") else "")
+        )
+
+
+@app.command("context")
+def context(
+    resource_id: str = typer.Argument(..., help="Node ID of the resource (ORG / PROJECT / ENV)"),
+    profile: str | None = typer.Option(None, "--profile"),
+) -> None:
+    """
+    Show the access roles the current user has on a specific resource.
+
+    Example:
+        sov context proj-abc123
+    """
+    tokens = load_tokens(profile=profile)
+    if not tokens:
+        typer.echo("Not logged in. Run: sov login", err=True)
+        raise typer.Exit(1)
+
+    api_url = get_api_url(profile)
+    try:
+        me = httpx.get(
+            f"{api_url}/api/v1/auth/me",
+            headers={"Authorization": f"Bearer {tokens['access_token']}"},
+            timeout=10,
+        )
+        me.raise_for_status()
+        me_data = me.json()
+        user_id = _resolve_user_id(me_data)
+        if user_id == "-":
+            typer.echo("Could not determine user ID from /auth/me response", err=True)
+            raise typer.Exit(1)
+
+        resp = httpx.get(
+            f"{api_url}/api/v1/context/{user_id}/{resource_id}",
+            headers={"Authorization": f"Bearer {tokens['access_token']}"},
+            timeout=10,
+        )
+        resp.raise_for_status()
+        data = resp.json()
+        roles = data.get("roles", [])
+        if roles:
+            typer.echo(f"You have the following roles on {resource_id}:")
+            for role in roles:
+                typer.echo(f"  • {role}")
+        else:
+            typer.echo(f"No access to resource {resource_id}")
+    except httpx.HTTPStatusError as exc:
+        typer.echo(f"Error: {exc.response.text}", err=True)
+        raise typer.Exit(1) from exc

{sovaria_cli-0.2.1 → sovaria_cli-0.2.3}/apps/cli/src/commands/init_cmd.py

@@ -13,69 +13,11 @@ from apps.cli.src.utils.auth_store import load_tokens
 from apps.cli.src.utils.config import get_api_url, set_scope
 from apps.cli.src.utils.display import print_banner, print_error, print_success, print_warning
 from apps.cli.src.utils.project_context import link_project_to_profile
+from apps.cli.src.utils.scope_picker import pick_org, pick_project
 
 app = typer.Typer(help="Interactive Sovaria project bootstrap", invoke_without_command=True)
 
 
-def _pick_org(profile: str | None) -> str:
-    orgs = call_api(method="GET", path="/api/v1/org", profile=profile)
-    if not isinstance(orgs, list) or not orgs:
-        raise CLIRequestError("No organisations found. Create one in the console first.")
-
-    typer.echo("\nOrganisations:")
-    for index, org in enumerate(orgs, start=1):
-        name = org.get("name") or org.get("label") or org.get("node_id") or "?"
-        typer.echo(f"  {index}. {name}  ({org.get('node_id', '?')})")
-
-    if len(orgs) == 1:
-        chosen = orgs[0]
-        typer.echo(f"\nUsing sole organisation: {chosen.get('name') or chosen.get('node_id')}")
-    else:
-        selection = typer.prompt("Select organisation number", type=int)
-        if selection < 1 or selection > len(orgs):
-            raise CLIRequestError("Invalid organisation selection")
-        chosen = orgs[selection - 1]
-
-    org_id = str(chosen.get("node_id") or chosen.get("id") or "").strip()
-    if not org_id:
-        raise CLIRequestError("Selected organisation is missing node_id")
-    return org_id
-
-
-def _pick_project(org_id: str, profile: str | None) -> str:
-    from urllib.parse import quote
-
-    projects = call_api(
-        method="GET",
-        path=f"/api/v1/org/{quote(org_id, safe='')}/children",
-        profile=profile,
-        params={"relation": "OWNS"},
-    )
-    if not isinstance(projects, list) or not projects:
-        raise CLIRequestError(
-            "No projects under this organisation. Create one in the console or run `sov org create`."
-        )
-
-    typer.echo("\nProjects:")
-    for index, project in enumerate(projects, start=1):
-        name = project.get("name") or project.get("label") or project.get("node_id") or "?"
-        typer.echo(f"  {index}. {name}  ({project.get('node_id', '?')})")
-
-    if len(projects) == 1:
-        chosen = projects[0]
-        typer.echo(f"\nUsing sole project: {chosen.get('name') or chosen.get('node_id')}")
-    else:
-        selection = typer.prompt("Select project number", type=int)
-        if selection < 1 or selection > len(projects):
-            raise CLIRequestError("Invalid project selection")
-        chosen = projects[selection - 1]
-
-    project_id = str(chosen.get("node_id") or chosen.get("id") or "").strip()
-    if not project_id:
-        raise CLIRequestError("Selected project is missing node_id")
-    return project_id
-
-
 @app.callback()
 def init_wizard(
     name: str = typer.Option("sovaria-app", "--name", "-n", help="Project name for config"),
@@ -115,13 +57,13 @@ def init_wizard(
             raise typer.Exit(1) from exc
 
     try:
-        org_id = _pick_org(profile)
-        project_id = _pick_project(org_id, profile)
+        org_id, _ = pick_org(profile)
+        project_id, env_from_project, _ = pick_project(org_id, profile)
     except CLIRequestError as exc:
         print_error(str(exc))
         raise typer.Exit(1) from exc
 
-    env_id = typer.prompt("Environment ID (optional, press Enter to skip)", default="").strip()
+    env_id = env_from_project or typer.prompt("Environment ID (optional, press Enter to skip)", default="").strip()
 
     if link:
         try:

{sovaria_cli-0.2.1 → sovaria_cli-0.2.3}/apps/cli/src/commands/login.py

@@ -7,7 +7,7 @@ Phase 1 §9 Sprint 3.2:
 
 Flow:
   1. Generate code_verifier (43-128 random chars) + code_challenge = BASE64URL(SHA-256(verifier))
-  2. Open https://{api}/oauth/authorize?response_type=code&...&code_challenge=...
+  2. Open https://{console}/cli/oauth/authorize?response_type=code&...&code_challenge=...
     3. Start a temporary HTTP callback server (configured via env variables).
   4. Exchange authorization_code + verifier for token pair.
   5. Persist tokens via auth_store.save_tokens().
@@ -33,7 +33,8 @@ import typer
 
 from apps.cli.src.utils.api_client import CLIMfaRequiredError, _apply_login_response
 from apps.cli.src.utils.auth_store import clear_mfa_pending, clear_tokens, load_mfa_pending, load_tokens, save_tokens
-from apps.cli.src.utils.config import get_api_url
+from apps.cli.src.utils.config import get_api_url, get_console_url
+from apps.cli.src.utils.scope_picker import maybe_setup_scope_after_login
 
 app = typer.Typer()
 
@@ -168,6 +169,11 @@ def login(
     org_id: str | None = typer.Option(None, "--org", help="Organization ID scope"),
     project_id: str | None = typer.Option(None, "--project", help="Project ID scope"),
     env_id: str | None = typer.Option(None, "--env", help="Environment ID scope"),
+    pick_scope: bool | None = typer.Option(
+        None,
+        "--pick-scope/--no-pick-scope",
+        help="After login, list orgs/projects and pick default scope (default: on in a TTY)",
+    ),
 ) -> None:
     """
     Authenticate with Sovaria.
@@ -182,9 +188,12 @@ def login(
             import getpass
 
             password = getpass.getpass("Password: ")
-        _password_login(api_url, email, password, org_id, project_id, env_id, profile=profile)
+        _password_login(
+            api_url, email, password, org_id, project_id, env_id,
+            profile=profile, pick_scope=pick_scope,
+        )
     else:
-        _pkce_login(api_url, profile=profile)
+        _pkce_login(api_url, profile=profile, pick_scope=pick_scope)
 
 
 def _password_login(
@@ -195,6 +204,7 @@ def _password_login(
     project_id: str | None = None,
     env_id: str | None = None,
     profile: str | None = None,
+    pick_scope: bool | None = None,
 ) -> None:
     """Direct credential exchange — bypasses PKCE.
 
@@ -203,11 +213,10 @@ def _password_login(
     lane. End-users of customer projects must use the project login on the
     web — they have no business running ``sov`` against the platform.
     """
-    if any((org_id, project_id, env_id)):
+    if any((org_id, project_id, env_id)) and not all((org_id, project_id)):
         typer.echo(
-            "Note: --org/--project/--env are ignored on `sov login`. "
-            "The CLI authenticates as a Sovaria platform user; scope is "
-            "selected per-command via `sov scope use ...`.",
+            "Note: pass both --org and --project to set default scope on login, "
+            "or omit both to pick interactively after login.",
             err=True,
         )
 
@@ -220,7 +229,14 @@ def _password_login(
         )
         resp.raise_for_status()
         _apply_login_response(resp.json(), profile=profile)
-        typer.echo(typer.style("Logged in successfully", fg=typer.colors.GREEN))
+        typer.echo(typer.style("✓ Logged in successfully", fg=typer.colors.GREEN))
+        maybe_setup_scope_after_login(
+            profile,
+            org_id=org_id,
+            project_id=project_id,
+            env_id=env_id,
+            pick_scope=pick_scope,
+        )
     except CLIMfaRequiredError as exc:
         typer.echo(typer.style(str(exc), fg=typer.colors.YELLOW), err=True)
         raise typer.Exit(2) from exc
@@ -234,13 +250,18 @@ def _password_login(
         raise typer.Exit(1) from exc
 
 
-def _pkce_login(api_url: str, *, profile: str | None = None) -> None:
+def _pkce_login(
+    api_url: str,
+    *,
+    profile: str | None = None,
+    pick_scope: bool | None = None,
+) -> None:
     """Full OAuth2 PKCE browser flow."""
     code_verifier, code_challenge = _generate_pkce_pair()
     state = secrets.token_hex(16)
     redirect_uri = _redirect_uri()
 
-    auth_url = f"{api_url}/oauth/authorize?" + urlencode(
+    auth_url = f"{get_console_url(profile)}/cli/oauth/authorize?" + urlencode(
         {
             "response_type": "code",
             "client_id": "sovaria-cli",
@@ -279,6 +300,7 @@ def _pkce_login(api_url: str, *, profile: str | None = None) -> None:
         resp.raise_for_status()
         _apply_login_response(resp.json(), profile=profile)
         typer.echo(typer.style("✓ Logged in successfully", fg=typer.colors.GREEN))
+        maybe_setup_scope_after_login(profile, pick_scope=pick_scope)
     except CLIMfaRequiredError as exc:
         typer.echo(typer.style(str(exc), fg=typer.colors.YELLOW), err=True)
         raise typer.Exit(2) from exc
@@ -343,6 +365,7 @@ def mfa_verify(
         _apply_login_response(resp.json(), profile=profile)
         clear_mfa_pending(profile=profile)
         typer.echo(typer.style("MFA verified — full session established.", fg=typer.colors.GREEN))
+        maybe_setup_scope_after_login(profile)
     except CLIMfaRequiredError as exc:
         typer.echo(str(exc), err=True)
         raise typer.Exit(2) from exc

{sovaria_cli-0.2.1 → sovaria_cli-0.2.3}/apps/cli/src/commands/scope.py

@@ -4,7 +4,10 @@ from __future__ import annotations
 
 import typer
 
+from apps.cli.src.utils.api_client import CLIRequestError
+from apps.cli.src.utils.auth_store import load_tokens
 from apps.cli.src.utils.config import clear_scope, get_scope, set_scope
+from apps.cli.src.utils.scope_picker import interactive_pick_scope, print_access_catalog
 
 app = typer.Typer(help="Manage default org/project/env scope")
 
@@ -40,3 +43,30 @@ def clear_scope_cmd(profile: str | None = typer.Option(None, "--profile")) -> No
     """Clear default scope for the active profile."""
     clear_scope(profile)
     typer.echo("Default scope cleared.")
+
+
+@app.command("list")
+def list_scope_access(profile: str | None = typer.Option(None, "--profile")) -> None:
+    """List organisations and projects available to your account."""
+    if not load_tokens(profile=profile):
+        typer.echo("Not logged in. Run: sov login", err=True)
+        raise typer.Exit(1)
+    print_access_catalog(profile)
+
+
+@app.command("pick")
+def pick_scope_cmd(profile: str | None = typer.Option(None, "--profile")) -> None:
+    """Pick default org/project interactively by index."""
+    if not load_tokens(profile=profile):
+        typer.echo("Not logged in. Run: sov login", err=True)
+        raise typer.Exit(1)
+    try:
+        scope = interactive_pick_scope(profile)
+    except CLIRequestError as exc:
+        typer.echo(str(exc), err=True)
+        raise typer.Exit(1) from exc
+    if scope:
+        typer.echo(
+            f"Default scope saved: org={scope['org_id']} project={scope['project_id']}"
+            + (f" env={scope['env_id']}" if scope.get("env_id") else "")
+        )

{sovaria_cli-0.2.1 → sovaria_cli-0.2.3}/apps/cli/src/main.py

@@ -103,6 +103,8 @@ app.add_typer(shell_mod.app, name="shell", help="Interactive Sovaria REPL")
 app.command("login")(login_mod.login)
 app.command("logout")(login_mod.logout)
 app.command("whoami")(context_mod.whoami)
+app.command("orgs")(context_mod.list_orgs)
+app.command("projects")(context_mod.list_projects)
 app.command("context")(context_mod.context)
 app.command("deploy")(deploy_mod.deploy)
 
@@ -117,7 +119,10 @@ def _version_callback(value: bool) -> None:
 
 
 _PLAN_GATE_BYPASS_COMMANDS = frozenset(
-    {"login", "auth", "logout", "scope", "whoami", "context", "init", "project", None}
+    {
+        "login", "auth", "logout", "scope", "whoami", "context",
+        "orgs", "projects", "init", "project", None,
+    }
 )
 
 

{sovaria_cli-0.2.1 → sovaria_cli-0.2.3}/apps/cli/src/utils/config.py

@@ -76,6 +76,19 @@ def _profile_env_default(profile: str) -> str:
     return _DEFAULT_API_URL or DEFAULT_CLOUD_API_URL
 
 
+def get_console_url(profile: str | None = None) -> str:
+    """Console origin used for browser OAuth (PKCE) flows."""
+    explicit = os.getenv("SOVARIA_CLI_CONSOLE_URL", "").strip()
+    if explicit:
+        return explicit.rstrip("/")
+
+    api_url = get_api_url(profile)
+    if "://api." in api_url:
+        return api_url.replace("://api.", "://console.", 1).rstrip("/")
+
+    return "https://console.sovaria.in"
+
+
 def get_api_url(profile: str | None = None) -> str:
     cfg = _load_yaml()
     prof = profile or get_active_profile()

sovaria_cli-0.2.3/apps/cli/src/utils/scope_picker.py

@@ -0,0 +1,237 @@
+"""Interactive org/project scope selection for the CLI."""
+
+from __future__ import annotations
+
+import sys
+from typing import Any
+from urllib.parse import quote
+
+import typer
+
+from apps.cli.src.utils.api_client import CLIRequestError, call_api
+from apps.cli.src.utils.config import get_scope, set_scope
+from apps.cli.src.utils.project_context import find_project_config, link_project_to_profile
+
+
+def _node_id(item: dict[str, Any]) -> str:
+    for key in ("node_id", "id"):
+        value = str(item.get(key) or "").strip()
+        if value:
+            return value
+    return ""
+
+
+def _node_name(item: dict[str, Any]) -> str:
+    return str(item.get("name") or item.get("label") or _node_id(item) or "?")
+
+
+def fetch_orgs(profile: str | None = None) -> list[dict[str, Any]]:
+    result = call_api(method="GET", path="/api/v1/org", profile=profile)
+    if not isinstance(result, list):
+        return []
+    return [item for item in result if isinstance(item, dict)]
+
+
+def fetch_projects(org_id: str, profile: str | None = None) -> list[dict[str, Any]]:
+    result = call_api(
+        method="GET",
+        path=f"/api/v1/org/{quote(org_id, safe='')}/children",
+        profile=profile,
+        params={"relation": "OWNS"},
+    )
+    if not isinstance(result, list):
+        return []
+    return [item for item in result if isinstance(item, dict)]
+
+
+def print_access_catalog(profile: str | None = None) -> None:
+    """Print organisations and projects the signed-in user can access."""
+    orgs = fetch_orgs(profile)
+    if not orgs:
+        typer.echo("No organisations found. Create one in the console first.")
+        return
+
+    typer.echo("Your organisations and projects:\n")
+    for org_index, org in enumerate(orgs, start=1):
+        org_id = _node_id(org)
+        typer.echo(f"  [{org_index}] {_node_name(org)}")
+        typer.echo(f"      org_id: {org_id or '?'}")
+        if not org_id:
+            continue
+        projects = fetch_projects(org_id, profile)
+        if not projects:
+            typer.echo("      (no projects)")
+            continue
+        for project_index, project in enumerate(projects, start=1):
+            project_id = _node_id(project)
+            env_id = str(project.get("env_id") or "").strip()
+            env_label = str(project.get("env_name") or env_id or "").strip()
+            typer.echo(f"      [{project_index}] {_node_name(project)}")
+            typer.echo(f"          project_id: {project_id or '?'}")
+            if env_label:
+                typer.echo(f"          env: {env_label}" + (f" ({env_id})" if env_id else ""))
+
+
+def pick_org(profile: str | None = None) -> tuple[str, dict[str, Any]]:
+    orgs = fetch_orgs(profile)
+    if not orgs:
+        raise CLIRequestError("No organisations found. Create one in the console first.")
+
+    typer.echo("\nOrganisations:")
+    for index, org in enumerate(orgs, start=1):
+        typer.echo(f"  {index}. {_node_name(org)}  ({_node_id(org) or '?'})")
+
+    if len(orgs) == 1:
+        chosen = orgs[0]
+        typer.echo(f"\nUsing sole organisation: {_node_name(chosen)}")
+    else:
+        selection = typer.prompt("Select organisation number", type=int)
+        if selection < 1 or selection > len(orgs):
+            raise CLIRequestError("Invalid organisation selection")
+        chosen = orgs[selection - 1]
+
+    org_id = _node_id(chosen)
+    if not org_id:
+        raise CLIRequestError("Selected organisation is missing an ID")
+    return org_id, chosen
+
+
+def pick_project(org_id: str, profile: str | None = None) -> tuple[str, str | None, dict[str, Any]]:
+    projects = fetch_projects(org_id, profile)
+    if not projects:
+        raise CLIRequestError(
+            "No projects under this organisation. Create one in the console first."
+        )
+
+    typer.echo("\nProjects:")
+    for index, project in enumerate(projects, start=1):
+        env_hint = str(project.get("env_name") or project.get("env_id") or "").strip()
+        suffix = f"  env={env_hint}" if env_hint else ""
+        typer.echo(f"  {index}. {_node_name(project)}  ({_node_id(project) or '?'}){suffix}")
+
+    if len(projects) == 1:
+        chosen = projects[0]
+        typer.echo(f"\nUsing sole project: {_node_name(chosen)}")
+    else:
+        selection = typer.prompt("Select project number", type=int)
+        if selection < 1 or selection > len(projects):
+            raise CLIRequestError("Invalid project selection")
+        chosen = projects[selection - 1]
+
+    project_id = _node_id(chosen)
+    if not project_id:
+        raise CLIRequestError("Selected project is missing an ID")
+    env_id = str(chosen.get("env_id") or "").strip() or None
+    return project_id, env_id, chosen
+
+
+def apply_scope(
+    *,
+    org_id: str,
+    project_id: str,
+    env_id: str | None = None,
+    profile: str | None = None,
+    link_config: bool = True,
+) -> None:
+    """Persist scope to profile and local sovaria.config.json when present."""
+    set_scope(org_id=org_id, project_id=project_id, env_id=env_id, profile=profile)
+    config_path = find_project_config()
+    if link_config and config_path is not None:
+        link_project_to_profile(
+            org_id=org_id,
+            project_id=project_id,
+            env_id=env_id,
+            profile=profile,
+            config_path=config_path,
+        )
+
+
+def interactive_pick_scope(
+    profile: str | None = None,
+    *,
+    link_config: bool = True,
+) -> dict[str, str] | None:
+    """Prompt for org/project by index and save as default scope."""
+    org_id, _ = pick_org(profile)
+    project_id, env_id, _ = pick_project(org_id, profile)
+    apply_scope(
+        org_id=org_id,
+        project_id=project_id,
+        env_id=env_id,
+        profile=profile,
+        link_config=link_config,
+    )
+    return {
+        "org_id": org_id,
+        "project_id": project_id,
+        "env_id": env_id or "",
+    }
+
+
+def scope_is_configured(profile: str | None = None) -> bool:
+    scope = get_scope(profile)
+    local_path = find_project_config()
+    if local_path is not None:
+        from apps.cli.src.utils.project_context import linked_scope
+
+        local = linked_scope(profile)
+        if local.get("org_id") and local.get("project_id"):
+            return True
+    return bool(scope.get("org_id") and scope.get("project_id"))
+
+
+def maybe_setup_scope_after_login(
+    profile: str | None = None,
+    *,
+    org_id: str | None = None,
+    project_id: str | None = None,
+    env_id: str | None = None,
+    pick_scope: bool | None = None,
+) -> None:
+    """After auth, show accessible orgs/projects and optionally pick default scope."""
+    if org_id and project_id:
+        apply_scope(
+            org_id=org_id,
+            project_id=project_id,
+            env_id=env_id,
+            profile=profile,
+        )
+        typer.echo(
+            f"Active scope: org={org_id} project={project_id}"
+            + (f" env={env_id}" if env_id else "")
+        )
+        return
+
+    if scope_is_configured(profile):
+        scope = get_scope(profile)
+        typer.echo(
+            f"Active scope: org={scope.get('org_id')} project={scope.get('project_id')}"
+            + (f" env={scope.get('env_id')}" if scope.get("env_id") else "")
+        )
+        return
+
+    typer.echo("")
+    print_access_catalog(profile)
+
+    should_pick = pick_scope if pick_scope is not None else sys.stdin.isatty()
+    if not should_pick:
+        typer.echo("\nSet default scope with: sov scope pick")
+        return
+
+    if not typer.confirm("\nPick a default org/project for CLI commands now?", default=True):
+        typer.echo("Skipped. Run `sov scope pick` or `sov init` when ready.")
+        return
+
+    try:
+        scope = interactive_pick_scope(profile)
+    except CLIRequestError as exc:
+        typer.echo(str(exc), err=True)
+        return
+
+    if scope:
+        typer.echo(
+            typer.style("✓ Default scope saved.", fg=typer.colors.GREEN)
+            + f" org={scope['org_id']} project={scope['project_id']}"
+            + (f" env={scope['env_id']}" if scope.get("env_id") else "")
+        )
+        typer.echo("Try: sov db tables")

{sovaria_cli-0.2.1 → sovaria_cli-0.2.3}/apps/cli/tests/test_config_profiles.py

@@ -45,6 +45,13 @@ def test_get_api_url_defaults_to_cloud_when_unconfigured(
     assert config.get_api_url("prod") == config.DEFAULT_CLOUD_API_URL
 
 
+def test_get_console_url_defaults_from_api(monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
+    monkeypatch.setattr(config, "_CONFIG_FILE", tmp_path / "missing.yaml")
+    monkeypatch.delenv("SOVARIA_CLI_CONSOLE_URL", raising=False)
+    monkeypatch.delenv("SOVARIA_CLI_DEFAULT_API_URL", raising=False)
+    assert config.get_console_url() == "https://console.sovaria.in"
+
+
 def test_get_scope_coerces_string_profile(
     monkeypatch: pytest.MonkeyPatch, tmp_path: Path
 ) -> None:

{sovaria_cli-0.2.1 → sovaria_cli-0.2.3}/apps/cli/tests/test_main_startup.py

@@ -26,4 +26,4 @@ def test_sov_console_script_help() -> None:
     )
 
     assert result.returncode == 0
-    assert "sov version 0.2.1" in result.stdout
+    assert "sov version 0.2.3" in result.stdout

sovaria_cli-0.2.3/apps/cli/tests/test_scope_picker.py

@@ -0,0 +1,17 @@
+"""Tests for interactive scope picker helpers."""
+
+from __future__ import annotations
+
+from apps.cli.src.utils import scope_picker
+
+
+def test_node_id_prefers_node_id_field() -> None:
+    assert scope_picker._node_id({"node_id": "org-1", "id": "legacy"}) == "org-1"
+
+
+def test_node_id_falls_back_to_id() -> None:
+    assert scope_picker._node_id({"id": "proj-1"}) == "proj-1"
+
+
+def test_node_name_prefers_name() -> None:
+    assert scope_picker._node_name({"name": "Acme", "node_id": "org-1"}) == "Acme"

{sovaria_cli-0.2.1 → sovaria_cli-0.2.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sovaria-cli"
-version = "0.2.1"
+version = "0.2.3"
 description = "Sovaria BaaS command-line interface (sov)"
 readme = "apps/cli/README.md"
 requires-python = ">=3.11"

sovaria_cli-0.2.1/apps/cli/src/commands/context.py

@@ -1,99 +0,0 @@
-"""
-apps.cli.src.commands.context — Show current user/org context.
-
-Phase 1 §9 Sprint 3.2: `sov context` prints who you are and what
-resources you have access to, by querying the Axis context endpoint
-through the Gateway.
-"""
-
-from __future__ import annotations
-
-import httpx
-import typer
-
-from apps.cli.src.utils.auth_store import load_tokens
-from apps.cli.src.utils.config import get_api_url
-
-app = typer.Typer()
-
-
-@app.command("whoami")
-def whoami(
-    profile: str | None = typer.Option(None, "--profile"),
-) -> None:
-    """Print the currently authenticated user."""
-    tokens = load_tokens(profile=profile)
-    if not tokens:
-        typer.echo("Not logged in. Run: sov login", err=True)
-        raise typer.Exit(1)
-
-    api_url = get_api_url(profile)
-    try:
-        resp = httpx.get(
-            f"{api_url}/api/v1/auth/me",
-            headers={"Authorization": f"Bearer {tokens['access_token']}"},
-            timeout=10,
-        )
-        resp.raise_for_status()
-        data = resp.json()
-        typer.echo(f"user_id : {data.get('user_id', '-')}")
-        typer.echo(f"email   : {data.get('email', '-')}")
-        typer.echo(f"roles   : {', '.join(data.get('roles', []))}")
-        typer.echo(f"lane    : {data.get('actor_lane', '-')}")
-        typer.echo(f"subject : {data.get('auth_subject_type', '-')}")
-    except httpx.HTTPStatusError as exc:
-        if exc.response.status_code == 401:
-            typer.echo("Session expired - run: sov login", err=True)
-        else:
-            typer.echo(f"Error: {exc.response.text}", err=True)
-        raise typer.Exit(1) from exc
-
-
-@app.command("context")
-def context(
-    resource_id: str = typer.Argument(..., help="Node ID of the resource (ORG / PROJECT / ENV)"),
-    profile: str | None = typer.Option(None, "--profile"),
-) -> None:
-    """
-    Show the access roles the current user has on a specific resource.
-
-    Example:
-        sov context proj-abc123
-    """
-    tokens = load_tokens(profile=profile)
-    if not tokens:
-        typer.echo("Not logged in. Run: sov login", err=True)
-        raise typer.Exit(1)
-
-    api_url = get_api_url(profile)
-    try:
-        # First resolve user_id from the access token by calling whoami.
-        me = httpx.get(
-            f"{api_url}/api/v1/auth/me",
-            headers={"Authorization": f"Bearer {tokens['access_token']}"},
-            timeout=10,
-        )
-        me.raise_for_status()
-        me_data = me.json()
-        user_id = me_data.get("user_id") or me_data.get("sub") or me_data.get("id")
-        if not user_id:
-            typer.echo("Could not determine user ID from /auth/me response", err=True)
-            raise typer.Exit(1)
-
-        resp = httpx.get(
-            f"{api_url}/api/v1/context/{user_id}/{resource_id}",
-            headers={"Authorization": f"Bearer {tokens['access_token']}"},
-            timeout=10,
-        )
-        resp.raise_for_status()
-        data = resp.json()
-        roles = data.get("roles", [])
-        if roles:
-            typer.echo(f"You have the following roles on {resource_id}:")
-            for role in roles:
-                typer.echo(f"  • {role}")
-        else:
-            typer.echo(f"No access to resource {resource_id}")
-    except httpx.HTTPStatusError as exc:
-        typer.echo(f"Error: {exc.response.text}", err=True)
-        raise typer.Exit(1) from exc