sovaria-cli 0.2.7__tar.gz → 0.2.9__tar.gz

sovaria_cli-0.2.9/.github/dependabot.yml

@@ -0,0 +1,12 @@
+version: 2
+updates:
+  - package-ecosystem: pip
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5

sovaria_cli-0.2.9/.github/workflows/ci.yml

@@ -0,0 +1,174 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_call:
+
+jobs:
+  secret-scan:
+    name: Secret scan
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Install Gitleaks
+        run: |
+          curl -sSfL https://github.com/gitleaks/gitleaks/releases/download/v8.24.2/gitleaks_8.24.2_linux_x64.tar.gz -o /tmp/gitleaks.tar.gz
+          tar -xzf /tmp/gitleaks.tar.gz -C /tmp
+          sudo install -m 0755 /tmp/gitleaks /usr/local/bin/gitleaks
+      - name: Run Gitleaks
+        run: |
+          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
+            RANGE="${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }}"
+          else
+            RANGE="HEAD~1..HEAD"
+          fi
+          echo "Scanning commit range: $RANGE"
+          gitleaks detect --source . --redact --no-banner --config .gitleaks.toml --log-opts="$RANGE"
+
+  lint:
+    name: Ruff
+    runs-on: ubuntu-latest
+    needs: secret-scan
+    steps:
+      - uses: actions/checkout@v4
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Install ruff
+        run: pip install "ruff>=0.9"
+      - name: Ruff check
+        run: |
+          ruff check \
+            apps/cli/src/commands/login.py \
+            apps/cli/src/commands/deploy.py \
+            apps/cli/src/commands/realtime.py \
+            apps/cli/src/utils/api_client.py \
+            apps/cli/src/utils/auth_store.py \
+            apps/cli/src/utils/config.py \
+            apps/cli/tests/test_aug18_cli_tickets.py \
+            apps/cli/tests/test_config_profiles.py
+
+  typecheck:
+    name: Mypy
+    runs-on: ubuntu-latest
+    needs: secret-scan
+    env:
+      # Fine-grained token with contents:read on sovaria/sovaria-sdk. Without it, CI installs the
+      # pinned SDK release from PyPI instead.
+      SDK_TOKEN: ${{ secrets.SOVARIA_SDK_READ_TOKEN }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Check out the matching SDK (when SOVARIA_SDK_READ_TOKEN is set)
+        if: env.SDK_TOKEN != ''
+        uses: actions/checkout@v4
+        with:
+          repository: sovaria/sovaria-sdk
+          path: sovaria-sdk
+          token: ${{ env.SDK_TOKEN }}
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Install SDK + CLI
+        run: |
+          set -euo pipefail
+          if [ -f ../sovaria-sdk/apps/sdk/python/pyproject.toml ]; then
+            pip install -e ../sovaria-sdk/apps/sdk/python
+          elif [ -f sovaria-sdk/apps/sdk/python/pyproject.toml ]; then
+            pip install -e sovaria-sdk/apps/sdk/python
+          else
+            pip install "sovaria-sdk==0.4.0"
+          fi
+          pip install -e ".[dev]"
+      - name: Mypy
+        run: |
+          mypy \
+            apps/cli/src/commands/login.py \
+            apps/cli/src/commands/deploy.py \
+            apps/cli/src/commands/realtime.py \
+            apps/cli/src/utils/api_client.py \
+            apps/cli/src/utils/auth_store.py \
+            apps/cli/src/utils/config.py
+
+  install-requirements:
+    name: requirements.txt install
+    runs-on: ubuntu-latest
+    needs: secret-scan
+    env:
+      # Fine-grained token with contents:read on sovaria/sovaria-sdk. Without it, CI installs the
+      # pinned SDK release from PyPI instead.
+      SDK_TOKEN: ${{ secrets.SOVARIA_SDK_READ_TOKEN }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Check out the matching SDK (when SOVARIA_SDK_READ_TOKEN is set)
+        if: env.SDK_TOKEN != ''
+        uses: actions/checkout@v4
+        with:
+          repository: sovaria/sovaria-sdk
+          path: sovaria-sdk
+          token: ${{ env.SDK_TOKEN }}
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Install from requirements.txt
+        run: |
+          set -euo pipefail
+          if [ -f ../sovaria-sdk/apps/sdk/python/pyproject.toml ]; then
+            pip install -e ../sovaria-sdk/apps/sdk/python
+          elif [ -f sovaria-sdk/apps/sdk/python/pyproject.toml ]; then
+            pip install -e sovaria-sdk/apps/sdk/python
+          else
+            pip install "sovaria-sdk==0.4.0"
+          fi
+          pip install -r requirements.txt
+          pip install --no-deps .
+      - name: sov --help
+        run: sov --help
+
+  test:
+    runs-on: ubuntu-latest
+    needs: secret-scan
+    env:
+      SDK_TOKEN: ${{ secrets.SOVARIA_SDK_READ_TOKEN }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Check out the matching SDK (when SOVARIA_SDK_READ_TOKEN is set)
+        if: env.SDK_TOKEN != ''
+        uses: actions/checkout@v4
+        with:
+          repository: sovaria/sovaria-sdk
+          path: sovaria-sdk
+          token: ${{ env.SDK_TOKEN }}
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install SDK + CLI
+        run: |
+          set -euo pipefail
+          if [ -f ../sovaria-sdk/apps/sdk/python/pyproject.toml ]; then
+            pip install -e ../sovaria-sdk/apps/sdk/python
+          elif [ -f sovaria-sdk/apps/sdk/python/pyproject.toml ]; then
+            pip install -e sovaria-sdk/apps/sdk/python
+          else
+            pip install "sovaria-sdk==0.4.0"
+          fi
+          pip install -e ".[dev]"
+
+      - name: Run tests
+        run: pytest apps/cli/tests -q
+
+      - name: Build wheel
+        run: python -m build
+
+      - name: Validate wheel metadata
+        run: python -m twine check dist/*

{sovaria_cli-0.2.7 → sovaria_cli-0.2.9}/.github/workflows/publish.yml

@@ -8,8 +8,13 @@ on:
         required: true
 
 jobs:
+  test:
+    if: github.event.inputs.confirm == 'publish'
+    uses: ./.github/workflows/ci.yml
+
   publish:
     if: github.event.inputs.confirm == 'publish'
+    needs: test
     runs-on: ubuntu-latest
     environment: pypi
     permissions:

{sovaria_cli-0.2.7 → sovaria_cli-0.2.9}/.gitignore

@@ -4,3 +4,7 @@ __pycache__/
 .mypy_cache/
 dist/
 *.egg-info/
+.env
+.env.*
+!.env.example
+!.env.*.example

sovaria_cli-0.2.9/.gitleaks.toml

@@ -0,0 +1,17 @@
+title = "Sovaria CLI gitleaks config"
+
+[extend]
+useDefault = true
+
+[allowlist]
+description = "Placeholder credentials and CLI test fixtures"
+paths = [
+  '''\.env\.example$''',
+  '''apps/cli/tests/''',
+]
+regexes = [
+  '''change-me''',
+  '''CHANGE_ME''',
+  '''do-not-use-in-prod''',
+  '''replace-with''',
+]

{sovaria_cli-0.2.7 → sovaria_cli-0.2.9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: sovaria-cli
-Version: 0.2.7
+Version: 0.2.9
 Summary: Sovaria BaaS command-line interface (sov)
 Project-URL: Homepage, https://sovaria.in
 Project-URL: Documentation, https://docs.sovaria.in/cli
@@ -12,14 +12,17 @@ Requires-Dist: httpx>=0.28.1
 Requires-Dist: keyring>=25.0
 Requires-Dist: pyyaml>=6.0
 Requires-Dist: rich>=13.7.0
-Requires-Dist: sovaria-sdk>=0.2.0
+Requires-Dist: sovaria-sdk==0.4.1
 Requires-Dist: tomli-w>=1.2.0
 Requires-Dist: typer>=0.17.4
 Provides-Extra: dev
 Requires-Dist: build>=1.2; extra == 'dev'
+Requires-Dist: mypy>=1.13; extra == 'dev'
 Requires-Dist: pytest>=8.0; extra == 'dev'
 Requires-Dist: ruff>=0.9; extra == 'dev'
 Requires-Dist: twine>=6.0; extra == 'dev'
+Provides-Extra: mcp
+Requires-Dist: sovaria-sdk[mcp]==0.4.1; extra == 'mcp'
 Description-Content-Type: text/markdown
 
 # Sovaria CLI
@@ -61,6 +64,43 @@ scripts/cli_sdk_happy_path.sh
 
 If you already have valid CLI tokens, omit `SOVARIA_EMAIL` and `SOVARIA_PASSWORD`.
 
+## Authentication
+
+```bash
+sov login
+sov login --email you@example.com
+sov login --file-storage          # headless: tokens in ~/.sovaria/credentials.toml
+sov logout
+sov logout --force                # clear local tokens if server revoke fails
+```
+
+- **Browser (PKCE):** authorize opens the console origin (`get_console_url`); the token exchange POSTs to the gateway `api_url` `/oauth/token` proxy. That split is intentional.
+- **Password:** never pass `--password`. Operator login prompts with `getpass`, or reads `SOVARIA_PASSWORD`.
+- **Product user create:** `sov auth-product create --email ...` prompts for the new user's password, or reads `SOVARIA_USER_PASSWORD`. Do not reuse `SOVARIA_PASSWORD` (that is the operator login secret).
+- **Magic link:** `sov auth magic-link verify` reads the token from stdin or `SOVARIA_MAGIC_TOKEN`.
+- **GitHub deploy PAT:** set `SOVARIA_GITHUB_TOKEN` or use `gh auth token`. There is no `--token` flag.
+- **OAuth callback:** binds `127.0.0.1` by default. Non-loopback `SOVARIA_CLI_CALLBACK_HOST` requires `--insecure-callback`.
+
+### Token refresh contract
+
+Axis supports two refresh modes. Do not mix them:
+
+| Client | How refresh is sent |
+|---|---|
+| **CLI / Python SDK** | JSON body: `POST /api/v1/auth/refresh` with `{"refresh_token": "<stored>"}`. The CLI keeps the refresh token in OS keyring (or `credentials.toml` with `--file-storage`). |
+| **Console / browser** | Empty JSON body `{}` plus the HttpOnly refresh cookie. The browser never puts the refresh token in the request body. |
+
+Copying the console cookie pattern into a CLI or SDK client will fail silently (no cookie jar). Copying the CLI JSON-body pattern into a browser app bypasses HttpOnly cookie storage.
+
+### Pulse WebSocket URLs
+
+`sov realtime ws-url` issues an opaque `ticket=` query parameter. Never put a JWT in `?token=` — production gateways disable `GATEWAY_WS_ALLOW_QUERY_TOKEN`. Local `.env.local` may still enable the legacy query-token path; do not copy that into clients.
+
+```bash
+sov realtime ws-url my-channel --org <org_id> --project <project_id>
+# wss://api.sovaria.in/api/v1/rt/ws/my-channel?ticket=...&org_id=...&project_id=...
+```
+
 ## Core Command Groups
 
 - `sov auth ...` auth login/logout

{sovaria_cli-0.2.7 → sovaria_cli-0.2.9}/apps/cli/README.md

@@ -37,6 +37,43 @@ scripts/cli_sdk_happy_path.sh
 
 If you already have valid CLI tokens, omit `SOVARIA_EMAIL` and `SOVARIA_PASSWORD`.
 
+## Authentication
+
+```bash
+sov login
+sov login --email you@example.com
+sov login --file-storage          # headless: tokens in ~/.sovaria/credentials.toml
+sov logout
+sov logout --force                # clear local tokens if server revoke fails
+```
+
+- **Browser (PKCE):** authorize opens the console origin (`get_console_url`); the token exchange POSTs to the gateway `api_url` `/oauth/token` proxy. That split is intentional.
+- **Password:** never pass `--password`. Operator login prompts with `getpass`, or reads `SOVARIA_PASSWORD`.
+- **Product user create:** `sov auth-product create --email ...` prompts for the new user's password, or reads `SOVARIA_USER_PASSWORD`. Do not reuse `SOVARIA_PASSWORD` (that is the operator login secret).
+- **Magic link:** `sov auth magic-link verify` reads the token from stdin or `SOVARIA_MAGIC_TOKEN`.
+- **GitHub deploy PAT:** set `SOVARIA_GITHUB_TOKEN` or use `gh auth token`. There is no `--token` flag.
+- **OAuth callback:** binds `127.0.0.1` by default. Non-loopback `SOVARIA_CLI_CALLBACK_HOST` requires `--insecure-callback`.
+
+### Token refresh contract
+
+Axis supports two refresh modes. Do not mix them:
+
+| Client | How refresh is sent |
+|---|---|
+| **CLI / Python SDK** | JSON body: `POST /api/v1/auth/refresh` with `{"refresh_token": "<stored>"}`. The CLI keeps the refresh token in OS keyring (or `credentials.toml` with `--file-storage`). |
+| **Console / browser** | Empty JSON body `{}` plus the HttpOnly refresh cookie. The browser never puts the refresh token in the request body. |
+
+Copying the console cookie pattern into a CLI or SDK client will fail silently (no cookie jar). Copying the CLI JSON-body pattern into a browser app bypasses HttpOnly cookie storage.
+
+### Pulse WebSocket URLs
+
+`sov realtime ws-url` issues an opaque `ticket=` query parameter. Never put a JWT in `?token=` — production gateways disable `GATEWAY_WS_ALLOW_QUERY_TOKEN`. Local `.env.local` may still enable the legacy query-token path; do not copy that into clients.
+
+```bash
+sov realtime ws-url my-channel --org <org_id> --project <project_id>
+# wss://api.sovaria.in/api/v1/rt/ws/my-channel?ticket=...&org_id=...&project_id=...
+```
+
 ## Core Command Groups
 
 - `sov auth ...` auth login/logout

{sovaria_cli-0.2.7 → sovaria_cli-0.2.9}/apps/cli/src/__init__.py

@@ -1,3 +1,3 @@
 """Sovaria CLI — sov command."""
 
-__version__ = "0.2.7"
+__version__ = "0.2.9"

{sovaria_cli-0.2.7 → sovaria_cli-0.2.9}/apps/cli/src/commands/auth_product.py

@@ -2,6 +2,8 @@
 
 from __future__ import annotations
 
+import getpass
+import os
 from typing import TypedDict
 from urllib.parse import quote
 
@@ -9,7 +11,7 @@ import typer
 
 from apps.cli.src.utils.api_client import CLIRequestError, call_api
 from apps.cli.src.utils.display import handle_cli_error, print_json
-from apps.cli.src.utils.premium_display import run_with_spinner
+from apps.cli.src.utils.premium_display import print_error_panel, run_with_spinner
 from apps.cli.src.utils.config import get_scope
 
 app = typer.Typer(help="Manage product users within an org/project scope")
@@ -33,6 +35,19 @@ def _scope_args(
     }
 
 
+def _read_new_user_password() -> str:
+    env = (os.getenv("SOVARIA_USER_PASSWORD") or "").strip()
+    if env:
+        return env
+    password = getpass.getpass("New user password: ")
+    if not password:
+        print_error_panel(
+            "Password is required. Enter it at the prompt or set SOVARIA_USER_PASSWORD."
+        )
+        raise typer.Exit(1)
+    return password
+
+
 def _project_auth_path(profile: str | None, project_id: str | None, suffix: str) -> str:
     resolved_project = (project_id or get_scope(profile).get("project_id") or "").strip()
     if not resolved_project:
@@ -164,7 +179,6 @@ def set_roles(
 @app.command("create")
 def create_user(
     email: str = typer.Option(..., "--email"),
-    password: str = typer.Option(..., "--password"),
     name: str | None = typer.Option(None, "--name", help="Display name (defaults to email local-part)"),
     profile: str | None = typer.Option(None, "--profile"),
     org_id: str | None = typer.Option(None, "--org"),
@@ -173,6 +187,7 @@ def create_user(
 ) -> None:
     """Create a product user in the current project scope."""
     display_name = name or email.split("@", maxsplit=1)[0]
+    password = _read_new_user_password()
     try:
         result = run_with_spinner(
             f"Creating user {email}…",

{sovaria_cli-0.2.7 → sovaria_cli-0.2.9}/apps/cli/src/commands/db.py

@@ -612,6 +612,34 @@ def migrations_list(
     print_json(result)
 
 
+def _split_migration(path: Path) -> tuple[str, str | None]:
+    """Up and optional down SQL: a ``-- migrate:down`` section in the file, or a sibling ``<name>.down.sql``."""
+    import re as _re
+
+    text = path.read_text(encoding="utf-8")
+    parts = _re.split(r"^\s*--\s*migrate:down\s*$", text, maxsplit=1, flags=_re.MULTILINE | _re.IGNORECASE)
+    up = _re.sub(r"^\s*--\s*migrate:up\s*$", "", parts[0], flags=_re.MULTILINE | _re.IGNORECASE).strip()
+    down = parts[1].strip() if len(parts) > 1 else None
+    sibling = path.with_name(f"{path.stem}.down.sql")
+    if not down and sibling.exists():
+        down = sibling.read_text(encoding="utf-8").strip() or None
+    return up, down
+
+
+def _remote_migration_names(scope: dict[str, str | None]) -> set[str]:
+    """Names of migrations currently applied on the server (pages through the whole history)."""
+    names: set[str] = set()
+    offset, page = 0, 500  # server maximum
+    while True:
+        result = call_api(method="GET", path="/api/v1/data/rel/migrations",
+                          params={"limit": str(page), "offset": str(offset)}, require_scope=True, **scope)
+        rows = result.get("migrations", []) if isinstance(result, dict) else []
+        names |= {str(r.get("name")) for r in rows if isinstance(r, dict) and r.get("status", "applied") == "applied"}
+        if len(rows) < page:
+            return names
+        offset += page
+
+
 @migrations_app.command("push")
 def migrations_push(
     directory: str | None = typer.Option(
@@ -619,60 +647,96 @@ def migrations_push(
         "--dir",
         help="Migration directory (default: sovaria/migrations under linked project)",
     ),
-    dry_run: bool = typer.Option(False, "--dry-run", help="Show pending files without executing"),
+    dry_run: bool = typer.Option(
+        False, "--dry-run", help="Run each pending migration in a transaction and roll it back (nothing is kept)"
+    ),
     profile: str | None = typer.Option(None, "--profile"),
     org_id: str | None = typer.Option(None, "--org"),
     project_id: str | None = typer.Option(None, "--project"),
     env_id: str | None = typer.Option(None, "--env"),
 ) -> None:
-    """Apply pending local .sql migration files in sorted order."""
+    """Apply pending .sql migrations through the project's migration history.
+
+    Each file is applied atomically and recorded on the server, so every teammate and CI run sees the
+    same history. Put rollback SQL under a ``-- migrate:down`` line (or in ``<name>.down.sql``) to make
+    a migration reversible with ``sov db migrations rollback``.
+    """
     from apps.cli.src.utils.migrations import (
         list_local_migrations,
         load_applied_state,
-        migration_name,
         migrations_dir,
         save_applied_state,
     )
     from apps.cli.src.utils.premium_display import _console
 
     folder = Path(directory) if directory else migrations_dir()
-    files = list_local_migrations(folder)
+    files = [p for p in list_local_migrations(folder) if not p.name.endswith(".down.sql")]
     if not files:
         print_warning(f"No .sql files in {folder}. Create migrations there first.")
         raise typer.Exit(0)
 
-    applied = load_applied_state()
-    pending = [path for path in files if migration_name(path) not in applied]
+    scope = _scope_opts(profile, org_id, project_id, env_id)
+    try:
+        remote = run_with_spinner("Reading migration history…", lambda: _remote_migration_names(scope))
+    except CLIRequestError as exc:
+        handle_cli_error(exc)
+    pending = [path for path in files if path.stem not in remote]
     if not pending:
-        print_success("All local migrations already applied.")
+        print_success("Database is up to date — every local migration is in the project history.")
         raise typer.Exit(0)
 
     _console.print(f"\n[bold]Pending migrations ({len(pending)}):[/bold]")
     for path in pending:
         _console.print(f"  • {path.name}")
 
-    if dry_run:
-        raise typer.Exit(0)
-
-    scope = _scope_opts(profile, org_id, project_id, env_id)
+    endpoint = "/api/v1/data/rel/migrations/dry-run" if dry_run else "/api/v1/data/rel/migrations/apply"
+    applied_local = load_applied_state()
     for path in pending:
-        sql = path.read_text(encoding="utf-8").strip()
-        if not sql:
+        up, down = _split_migration(path)
+        if not up:
             print_warning(f"Skipping empty file: {path.name}")
-            applied.add(migration_name(path))
             continue
+        body = {"name": path.stem[:120], "up_sql": up, **({"down_sql": down} if down else {})}
         try:
             run_with_spinner(
-                f"Applying {path.name}…",
-                lambda s=sql: _run_sql_query(s, **scope),
-                success=f"Applied {path.name}",
+                f"{'Checking' if dry_run else 'Applying'} {path.name}…",
+                lambda b=body: call_api(method="POST", path=endpoint, body=b, require_scope=True, **scope),
+                success=f"{'Would apply' if dry_run else 'Applied'} {path.name}",
             )
         except CLIRequestError as exc:
             handle_cli_error(exc)
-        applied.add(migration_name(path))
+        if not dry_run:
+            applied_local.add(path.name)
+
+    if dry_run:
+        print_success(f"All {len(pending)} pending migration(s) apply cleanly. Nothing was changed.")
+        return
+    save_applied_state(applied_local)
+    print_success(f"Applied {len(pending)} migration(s).")
 
-    state_file = save_applied_state(applied)
-    print_success(f"Applied {len(pending)} migration(s). State: {state_file}")
+
+@migrations_app.command("rollback")
+def migrations_rollback(
+    version: str | None = typer.Option(None, "--version", help="Roll back this version (needs --force if it isn't the latest)"),
+    force: bool = typer.Option(False, "--force", help="Allow rolling back a migration that isn't the most recent"),
+    profile: str | None = typer.Option(None, "--profile"),
+    org_id: str | None = typer.Option(None, "--org"),
+    project_id: str | None = typer.Option(None, "--project"),
+    env_id: str | None = typer.Option(None, "--env"),
+) -> None:
+    """Undo the most recent migration using its down SQL."""
+    scope = _scope_opts(profile, org_id, project_id, env_id)
+    params = {**({"version": version} if version else {}), **({"force": "true"} if force else {})}
+    try:
+        result = run_with_spinner(
+            "Rolling back…",
+            lambda: call_api(method="POST", path="/api/v1/data/rel/migrations/rollback", params=params,
+                             require_scope=True, **scope),
+            success="Rolled back",
+        )
+    except CLIRequestError as exc:
+        handle_cli_error(exc)
+    print_json(result)
 
 
 @migrations_app.command("pull")