talis-cli 0.1.0a1__py3-none-any.whl

talis/commands/auth.py

@@ -0,0 +1,580 @@
+"""
+Authentication commands: login, logout, whoami, sessions, sessions revoke.
+
+``talis login`` is the most novel command — it drives the device flow:
+
+    1. POST /auth/device/code — returns user_code + verification_uri + words
+    2. Open the URL in the user's browser; print the words for verification
+    3. Poll POST /auth/device/token until status="approved"
+    4. Persist the returned JWT to ~/.talis/credentials
+"""
+
+from __future__ import annotations
+
+import base64
+import contextlib
+import hashlib
+import http.server
+import platform
+import secrets
+import time
+import urllib.parse
+import webbrowser
+
+import typer
+
+from .. import api, config, output
+from ._shared import creds_from_jwt, jti_from_jwt, require_creds
+
+
+class _LoopbackUnavailable(Exception):
+    """Raised when the loopback flow can't run (can't bind, no browser) so the
+    caller falls back to the device-code flow."""
+
+# `sessions_app` is a real subgroup mounted at "talis sessions" by cli.py.
+# `login`/`logout`/`whoami` below are plain functions — cli.py registers them
+# directly on the root app to avoid reaching into Typer internals.
+sessions_app = typer.Typer(help="List and revoke active CLI/web/mobile sessions.")
+
+
+# --------------------------------------------------------------------------- #
+# login
+# --------------------------------------------------------------------------- #
+
+
+def login(
+    read_only: bool = typer.Option(
+        False, "--read-only",
+        help="Request a read-scope session — denied on every trade/withdraw endpoint.",
+    ),
+    client_name: str | None = typer.Option(
+        None, "--client-name",
+        help="Display name shown on the approval page. Defaults to hostname.",
+    ),
+    no_browser: bool = typer.Option(
+        False, "--no-browser",
+        help="Don't try to open the browser automatically.",
+    ),
+    device_code: bool = typer.Option(
+        False, "--device-code",
+        help=(
+            "Use the type-a-code device flow instead of the default browser "
+            "loopback login. For SSH / headless boxes where the browser can't "
+            "redirect back to this machine."
+        ),
+    ),
+    token: str | None = typer.Option(
+        None, "--token",
+        help=(
+            "Bypass the device flow with an existing Talis JWT. Intended for "
+            "non-interactive setups (CI, agents). The token is decoded "
+            "locally to populate the credentials file; the server still "
+            "validates the signature on every request."
+        ),
+        envvar="TALIS_TOKEN",  # Distinct from JARVIS_TOKEN (which is ephemeral, never persisted)
+    ),
+    json_: bool = typer.Option(False, "--json", help="JSON output."),
+):
+    """Sign in to Talis. Either via device flow (default) or via ``--token`` for non-interactive setups."""
+    scope = "read" if read_only else "trade"
+    name = client_name or _default_client_name()
+    endpoint = config.endpoint_from_env()
+
+    # Non-interactive path: caller already has a JWT (typically from
+    # ``POST /auth/tokens`` via an admin key, or another machine's
+    # ``talis login`` output piped over a secret channel). Save the
+    # bundle and exit — no device flow, no polling, no browser.
+    if token is not None:
+        token_str = token.strip()
+        if not token_str:
+            output.error("--token cannot be empty.")
+            raise typer.Exit(code=1)
+        creds = creds_from_jwt(token_str, endpoint=endpoint, client_name=name)
+        config.save(creds)
+        if output.should_render_json(json_):
+            output.emit_json({
+                "ok": True,
+                "tenant_id": creds.tenant_id,
+                "scope": creds.scope,
+                "expires_at": creds.expires_at,
+                "via": "token",
+            })
+        else:
+            output.info("[green]signed in (token).[/]")
+            output.render_kv(
+                [
+                    ("tenant", creds.tenant_id),
+                    ("scope", creds.scope),
+                    ("wallet", creds.wallet_address or "—"),
+                    ("expires", creds.expires_at or "—"),
+                ],
+                json_flag=False,
+            )
+        return
+
+    # Default: codex-style loopback login (the browser redirects straight back —
+    # no code typing). Fall back to the device-code flow for headless/SSH boxes
+    # or if the loopback listener can't run.
+    if device_code or no_browser:
+        return _device_flow_login(scope, name, endpoint, no_browser=no_browser, json_=json_)
+    try:
+        return _loopback_login(scope, name, endpoint, json_=json_)
+    except _LoopbackUnavailable as exc:
+        output.warn(f"browser login unavailable ({exc}); falling back to device-code flow.")
+        return _device_flow_login(scope, name, endpoint, no_browser=no_browser, json_=json_)
+
+
+def _device_flow_login(
+    scope: str, name: str, endpoint: str, *, no_browser: bool, json_: bool
+) -> None:
+    """RFC 8628 device-code flow (type-a-code) — the SSH/headless fallback."""
+    with api.Client(endpoint=endpoint) as c:
+        try:
+            initial = c.device_code(client_name=name, scope=scope)
+        except api.APIError as exc:
+            output.error(f"could not start login: {exc.detail}")
+            raise typer.Exit(code=1)
+
+        device_code = initial["device_code"]
+        user_code = initial["user_code"]
+        verification_uri = initial["verification_uri"]
+        verification_uri_complete = initial.get("verification_uri_complete", verification_uri)
+        words = initial.get("verification_words", [])
+        interval = max(1, int(initial.get("interval", 5)))
+        expires_in = int(initial.get("expires_in", 600))
+
+        # Show the user what to do. Always print to stderr so --json keeps
+        # stdout clean for the final token bundle.
+        output.banner([
+            "",
+            f"[bold]Open this URL[/]:  [link={verification_uri}]{verification_uri}[/link]",
+            f"[bold]Enter this code[/]:  [cyan]{user_code}[/cyan]",
+            "",
+            "[bold]Verification words[/] (these must match what the web page shows):",
+            f"   [magenta]{'  ·  '.join(words)}[/magenta]" if words else "",
+            "",
+            f"[dim]Waiting for approval … (expires in {expires_in // 60}m {expires_in % 60}s)[/]",
+            "",
+        ])
+
+        if not no_browser:
+            import contextlib
+            with contextlib.suppress(Exception):
+                webbrowser.open(verification_uri_complete)
+            # printed URL above is the fallback if open() failed
+
+        # Poll. We follow the server's interval hint AND back off on slow_down.
+        deadline = time.time() + expires_in
+        while time.time() < deadline:
+            try:
+                resp = c.device_token(device_code=device_code)
+            except api.APIError as exc:
+                output.error(f"polling failed: {exc.detail}")
+                raise typer.Exit(code=1)
+
+            status = resp.get("status")
+            if status == "approved":
+                # Extract jti from the JWT payload (unsigned decode is safe — we
+                # only inspect our own token; the server validates on receipt).
+                # Stored so `talis logout` can self-revoke without an extra
+                # /auth/sessions round trip.
+                jti = jti_from_jwt(resp["token"])
+                creds = config.Credentials(
+                    endpoint=endpoint,
+                    tenant_id=resp["tenant_id"],
+                    token=resp["token"],
+                    expires_at=resp.get("expires_at", ""),
+                    scope=scope,
+                    jti_prefix=jti[:8] if jti else "",
+                    wallet_address=resp.get("wallet_address"),
+                    wallet_id=resp.get("wallet_id"),
+                    client_name=name,
+                )
+                config.save(creds)
+                output.info("[green]signed in.[/]")
+                if output.should_render_json(json_):
+                    output.emit_json({
+                        "ok": True,
+                        "tenant_id": creds.tenant_id,
+                        "scope": creds.scope,
+                        "expires_at": creds.expires_at,
+                    })
+                else:
+                    output.render_kv(
+                        [
+                            ("tenant", creds.tenant_id),
+                            ("scope", creds.scope),
+                            ("wallet", creds.wallet_address or "—"),
+                            ("expires", creds.expires_at or "—"),
+                        ],
+                        json_flag=False,
+                    )
+                return
+
+            if status == "slow_down":
+                server_interval = int(resp.get("interval", interval + 5))
+                interval = max(interval + 5, server_interval)
+                time.sleep(interval)
+                continue
+
+            if status == "expired":
+                output.error("code expired before approval. Run `talis login` again.")
+                raise typer.Exit(code=1)
+
+            if status == "denied":
+                output.error("approval was denied.")
+                raise typer.Exit(code=1)
+
+            # status == "pending" or unknown → keep polling at the advertised interval
+            time.sleep(interval)
+
+        output.error("login timed out.")
+        raise typer.Exit(code=1)
+
+
+def _loopback_login(scope: str, name: str, endpoint: str, *, json_: bool) -> None:
+    """Codex-style loopback login (RFC 8252 + PKCE).
+
+    Open the browser to the auth page; after the user signs in (Privy) and
+    authorizes, the page redirects straight back to a ``http://127.0.0.1:<port>``
+    listener this CLI started — no code typing. We exchange the captured code
+    (proving possession with the PKCE verifier) for the Talis JWT.
+    """
+    # PKCE (RFC 7636): high-entropy verifier; S256 challenge.
+    verifier = secrets.token_urlsafe(48)  # ~64 chars, inside the 43–128 window
+    challenge = (
+        base64.urlsafe_b64encode(hashlib.sha256(verifier.encode("ascii")).digest())
+        .rstrip(b"=")
+        .decode("ascii")
+    )
+    state = secrets.token_urlsafe(24)  # CSRF: echoed back, verified below
+    captured: dict[str, str | None] = {}
+
+    class _Handler(http.server.BaseHTTPRequestHandler):
+        def do_GET(self):  # noqa: N802 — stdlib handler name
+            parsed = urllib.parse.urlparse(self.path)
+            if parsed.path != "/callback":
+                self.send_response(404)
+                self.end_headers()
+                return
+            q = urllib.parse.parse_qs(parsed.query)
+            captured["code"] = q.get("code", [None])[0]
+            captured["state"] = q.get("state", [None])[0]
+            captured["error"] = q.get("error", [None])[0]
+            ok = bool(captured["code"]) and not captured["error"]
+            self.send_response(200)
+            self.send_header("Content-Type", "text/html; charset=utf-8")
+            self.end_headers()
+            head = "✓ Signed in to Talis" if ok else "Login failed"
+            sub = (
+                "You can close this tab and return to your terminal."
+                if ok else "Return to your terminal and try again."
+            )
+            self.wfile.write(
+                (
+                    "<!doctype html><html><body style='font-family:-apple-system,"
+                    "system-ui,sans-serif;text-align:center;padding-top:80px;color:#111'>"
+                    f"<h2>{head}</h2><p style='color:#666'>{sub}</p></body></html>"
+                ).encode()
+            )
+
+        def log_message(self, *args):  # silence default stderr access logging
+            return
+
+    try:
+        server = http.server.HTTPServer(("127.0.0.1", 0), _Handler)
+    except OSError as exc:
+        raise _LoopbackUnavailable(f"cannot bind loopback listener: {exc}")
+    port = server.server_address[1]
+    redirect_uri = f"http://127.0.0.1:{port}/callback"
+
+    auth_url = config.auth_page_from_env(endpoint)
+    open_url = f"{auth_url}?" + urllib.parse.urlencode({
+        "response_type": "code",
+        "code_challenge": challenge,
+        "code_challenge_method": "S256",
+        "redirect_uri": redirect_uri,
+        "scope": scope,
+        "state": state,
+        "client_name": name,
+    })
+
+    output.banner([
+        "",
+        "[bold]Opening your browser to sign in…[/]",
+        f"[dim]If it doesn't open, visit:[/]  [link={open_url}]{open_url}[/link]",
+        "",
+        "[dim]Waiting for you to approve in the browser…[/]",
+        "",
+    ])
+    with contextlib.suppress(Exception):
+        webbrowser.open(open_url)
+
+    # Block on the single callback (or time out). handle_request() returns each
+    # second so the deadline is honored even if the browser never comes back.
+    server.timeout = 1.0
+    deadline = time.time() + 300
+    while time.time() < deadline and not captured.get("code") and not captured.get("error"):
+        server.handle_request()
+    with contextlib.suppress(Exception):
+        server.server_close()
+
+    if captured.get("error"):
+        output.error(f"login was denied or failed: {captured['error']}")
+        raise typer.Exit(code=1)
+    code = captured.get("code")
+    if not code:
+        output.error("login timed out waiting for browser approval.")
+        raise typer.Exit(code=1)
+    if captured.get("state") != state:
+        # The code came back bound to a state we didn't issue — refuse it.
+        output.error("state mismatch — possible CSRF; aborting login.")
+        raise typer.Exit(code=1)
+
+    with api.Client(endpoint=endpoint) as c:
+        try:
+            resp = c.oauth_token(code=code, code_verifier=verifier, redirect_uri=redirect_uri)
+        except api.APIError as exc:
+            output.error(f"token exchange failed: {exc.detail}")
+            raise typer.Exit(code=1)
+
+    jti = jti_from_jwt(resp["access_token"])
+    creds = config.Credentials(
+        endpoint=endpoint,
+        tenant_id=resp["tenant_id"],
+        token=resp["access_token"],
+        expires_at=resp.get("expires_at", ""),
+        scope=resp.get("scope", scope),
+        jti_prefix=jti[:8] if jti else "",
+        wallet_address=resp.get("wallet_address"),
+        wallet_id=resp.get("wallet_id"),
+        client_name=name,
+    )
+    config.save(creds)
+    output.info("[green]signed in.[/]")
+    if output.should_render_json(json_):
+        output.emit_json({
+            "ok": True,
+            "tenant_id": creds.tenant_id,
+            "scope": creds.scope,
+            "expires_at": creds.expires_at,
+            "via": "loopback",
+        })
+    else:
+        output.render_kv(
+            [
+                ("tenant", creds.tenant_id),
+                ("scope", creds.scope),
+                ("wallet", creds.wallet_address or "—"),
+                ("expires", creds.expires_at or "—"),
+            ],
+            json_flag=False,
+        )
+
+
+def approve(
+    user_code: str = typer.Argument(
+        ...,
+        help="The code printed by `talis login`, e.g. ABCD-EFGH.",
+    ),
+    read_only: bool = typer.Option(
+        False, "--read-only",
+        help="Downgrade the approved session to read scope.",
+    ),
+    json_: bool = typer.Option(False, "--json", help="JSON output."),
+):
+    """Approve a pending CLI login using this machine's current Talis session.
+
+    This is the headless sibling of the web/iOS approval screen: it lets a
+    signed-in CLI approve another `talis login` code without requiring a
+    browser. The server still verifies the current JWT and refuses scope
+    escalation.
+    """
+    creds = require_creds()
+    scope = "read" if read_only else None
+    try:
+        with api.client_from_credentials(creds) as c:
+            result = c.device_approve(user_code=user_code, scope=scope)
+    except api.APIError as exc:
+        output.error(f"approval failed: {exc.detail}")
+        raise typer.Exit(code=1)
+
+    if output.should_render_json(json_):
+        output.emit_json(result)
+    else:
+        output.info("[green]approved.[/]")
+        output.render_kv(
+            [
+                ("client", result.get("client_name", "—")),
+                ("scope", result.get("scope_granted", "—")),
+            ],
+            json_flag=False,
+        )
+
+
+def _default_client_name() -> str:
+    """Build a sensible default like "Talis CLI on MacBook-Air"."""
+    host = platform.node() or "this machine"
+    return f"Talis CLI on {host}"
+
+
+# --------------------------------------------------------------------------- #
+# logout
+# --------------------------------------------------------------------------- #
+
+
+def logout(
+    json_: bool = typer.Option(False, "--json", help="JSON output."),
+):
+    """Revoke the current session and clear local credentials.
+
+    The point of logout is to invalidate THIS JWT server-side — otherwise a
+    leaked token stays valid until expires_at even after the user runs
+    ``talis logout``. We call DELETE /auth/sessions/{jti_prefix} (self-revoke),
+    NOT DELETE /auth/sessions (which preserves the current session and would
+    leave the token usable).
+    """
+    creds = config.load()
+    if not creds:
+        output.info("no credentials on disk; nothing to do.")
+        if output.should_render_json(json_):
+            output.emit_json({"ok": True, "revoked": False})
+        return
+
+    # Identify the current session. Prefer the stored prefix; fall back to
+    # decoding the JWT (handles credentials saved by older CLI builds that
+    # didn't populate jti_prefix). If we can't identify it, refuse to silently
+    # leave the server-side session live — surface the gap so the user knows.
+    jti_prefix = creds.jti_prefix or jti_from_jwt(creds.token)[:8]
+
+    revoked = False
+    if jti_prefix:
+        try:
+            with api.client_from_credentials(creds) as c:
+                c.revoke_session(tenant_id=creds.tenant_id, jti_prefix=jti_prefix)
+            revoked = True
+        except api.APIError as exc:
+            output.warn(
+                f"server-side revoke returned {exc.status_code}: {exc.detail}. "
+                "Local credentials cleared; the session may remain valid server-side "
+                "until expires_at."
+            )
+        except Exception as exc:  # noqa: BLE001
+            output.warn(
+                f"server unreachable ({exc}). Local credentials cleared; the session "
+                "remains valid server-side until expires_at."
+            )
+    else:
+        output.warn(
+            "could not identify current session jti — local credentials cleared, "
+            "but the server-side session remains valid until expires_at. "
+            "Use `talis sessions list` from another device to revoke it."
+        )
+
+    config.clear()
+    if output.should_render_json(json_):
+        output.emit_json({"ok": True, "revoked": revoked})
+    else:
+        output.info("signed out.")
+
+
+# --------------------------------------------------------------------------- #
+# whoami
+# --------------------------------------------------------------------------- #
+
+
+def whoami(
+    json_: bool = typer.Option(False, "--json", help="JSON output."),
+):
+    """Show the active session: tenant, scope, expiry."""
+    # Goes through require_creds so JARVIS_TOKEN takes precedence — a CI
+    # runner exporting an admin-minted token can verify which tenant it
+    # was issued for without needing a saved credentials file.
+    creds = require_creds()
+
+    rows = [
+        ("tenant", creds.tenant_id),
+        ("scope", creds.scope),
+        ("endpoint", creds.endpoint),
+        ("wallet", creds.wallet_address or "—"),
+        ("expires", creds.expires_at or "—"),
+    ]
+    output.render_kv(rows, json_flag=json_)
+
+
+# --------------------------------------------------------------------------- #
+# sessions
+# --------------------------------------------------------------------------- #
+
+
+@sessions_app.command("list")
+def sessions_list(
+    json_: bool = typer.Option(False, "--json", help="JSON output."),
+):
+    """List active sessions for your account (Connected Devices)."""
+    creds = require_creds()
+    with api.client_from_credentials(creds) as c:
+        try:
+            resp = c.list_sessions(tenant_id=creds.tenant_id)
+        except api.APIError as exc:
+            output.error(f"could not list sessions: {exc.detail}")
+            raise typer.Exit(code=1)
+
+    sessions = resp.get("sessions", [])
+    if output.should_render_json(json_):
+        output.emit_json({"sessions": sessions})
+        return
+
+    rows = []
+    for s in sessions:
+        marker = "[green](this)[/]" if s.get("is_current") else ""
+        rows.append([
+            s.get("jti_prefix", ""),
+            s.get("session_kind", ""),
+            s.get("scope", ""),
+            s.get("client_name", ""),
+            s.get("last_used_ip", "") or "—",
+            marker,
+        ])
+    output.render_table(
+        ["jti", "kind", "scope", "client", "last IP", ""],
+        rows,
+        json_flag=False,
+    )
+
+
+@sessions_app.command("revoke")
+def sessions_revoke(
+    jti_prefix: str = typer.Argument(..., help="Short jti prefix (e.g. ab12cd34)."),
+    json_: bool = typer.Option(False, "--json", help="JSON output."),
+):
+    """Revoke one session by short prefix."""
+    creds = require_creds()
+    with api.client_from_credentials(creds) as c:
+        try:
+            resp = c.revoke_session(tenant_id=creds.tenant_id, jti_prefix=jti_prefix)
+        except api.APIError as exc:
+            output.error(f"revoke failed: {exc.detail}")
+            raise typer.Exit(code=1)
+    if output.should_render_json(json_):
+        output.emit_json(resp)
+    else:
+        output.info("session revoked.")
+
+
+@sessions_app.command("revoke-others")
+def sessions_revoke_others(
+    json_: bool = typer.Option(False, "--json", help="JSON output."),
+):
+    """Sign out from every other device. The current session is preserved."""
+    creds = require_creds()
+    with api.client_from_credentials(creds) as c:
+        try:
+            resp = c.revoke_other_sessions(tenant_id=creds.tenant_id)
+        except api.APIError as exc:
+            output.error(f"revoke failed: {exc.detail}")
+            raise typer.Exit(code=1)
+    if output.should_render_json(json_):
+        output.emit_json(resp)
+    else:
+        output.info(f"revoked {resp.get('revoked', 0)} other session(s).")