teardrop-cli 0.1.0__py3-none-any.whl

teardrop_cli/commands/auth.py

@@ -0,0 +1,270 @@
+"""auth commands: login, logout, whoami."""
+
+from __future__ import annotations
+
+import asyncio
+import os
+from datetime import UTC
+from typing import Annotated
+
+import typer
+
+app = typer.Typer(
+    name="auth",
+    help="Authentication — login, logout, and identity.",
+    no_args_is_help=True,
+)
+
+# ---------------------------------------------------------------------------
+# login
+# ---------------------------------------------------------------------------
+
+
+@app.command()
+def login(
+    email: Annotated[str | None, typer.Option("--email", "-e", help="Email address.")] = None,
+    secret: Annotated[
+        str | None,
+        typer.Option("--secret", "-s", help="Password / secret.", hide_input=True),
+    ] = None,
+    client_id: Annotated[str | None, typer.Option("--client-id", help="M2M client ID.")] = None,
+    client_secret: Annotated[
+        str | None,
+        typer.Option("--client-secret", help="M2M client secret.", hide_input=True),
+    ] = None,
+    token: Annotated[
+        str | None,
+        typer.Option("--token", "-t", help="Pre-existing static JWT token.", hide_input=True),
+    ] = None,
+    siwe: Annotated[bool, typer.Option("--siwe", help="Sign in with Ethereum wallet.")] = False,
+    base_url: Annotated[
+        str | None, typer.Option("--base-url", help="Override the API base URL.", hidden=True)
+    ] = None,
+) -> None:
+    """Authenticate with the Teardrop API and store credentials locally."""
+    from teardrop import AsyncTeardropClient
+
+    from teardrop_cli import config
+    from teardrop_cli.formatting import print_success, spinner
+
+    url = base_url or config.get_base_url()
+
+    # ------------------------------------------------------------------ #
+    # Static token                                                         #
+    # ------------------------------------------------------------------ #
+    if token:
+        config.store_token(token)
+        print_success("Token stored. Run [bold]teardrop auth whoami[/bold] to verify.")
+        return
+
+    # ------------------------------------------------------------------ #
+    # SIWE (Sign-In With Ethereum)                                         #
+    # ------------------------------------------------------------------ #
+    if siwe:
+        _login_siwe(url)
+        return
+
+    # ------------------------------------------------------------------ #
+    # Client credentials (M2M)                                             #
+    # ------------------------------------------------------------------ #
+    if client_id or client_secret:
+        if not client_id:
+            client_id = typer.prompt("Client ID")
+        if not client_secret:
+            client_secret = typer.prompt("Client secret", hide_input=True)
+
+        async def _fetch_client_creds():
+            try:
+                return await client.get_me()
+            finally:
+                await client.close()
+
+        with spinner("Authenticating…"):
+            client = AsyncTeardropClient(url, client_id=client_id, client_secret=client_secret)
+            try:
+                me = asyncio.run(_fetch_client_creds())
+            except Exception as exc:
+                _handle_auth_error(exc)
+                return
+
+        config.store_client_credentials(client_id, client_secret)
+        print_success(f"Authenticated as [bold]{me.sub}[/bold] (client credentials).")
+        return
+
+    # ------------------------------------------------------------------ #
+    # Email + password (interactive)                                       #
+    # ------------------------------------------------------------------ #
+    if not email:
+        email = typer.prompt("Email")
+    if not secret:
+        secret = typer.prompt("Password", hide_input=True)
+
+    async def _fetch_email():
+        try:
+            return await client.get_me()
+        finally:
+            await client.close()
+
+    with spinner("Authenticating…"):
+        client = AsyncTeardropClient(url, email=email, secret=secret)
+        try:
+            me = asyncio.run(_fetch_email())
+        except Exception as exc:
+            _handle_auth_error(exc)
+            return
+
+    config.store_email_credentials(email, secret)
+    print_success(f"Authenticated as [bold]{me.sub}[/bold].")
+
+
+# ---------------------------------------------------------------------------
+# SIWE — private key (env var)
+# ---------------------------------------------------------------------------
+
+
+def _login_siwe(url: str) -> None:
+    """SIWE login using a private key supplied via TEARDROP_SIWE_PRIVATE_KEY."""
+    import asyncio
+
+    from teardrop import AsyncTeardropClient
+
+    from teardrop_cli import config
+    from teardrop_cli.formatting import console, print_error, print_success, spinner
+
+    private_key = os.environ.get("TEARDROP_SIWE_PRIVATE_KEY")
+    if not private_key:
+        print_error(
+            "TEARDROP_SIWE_PRIVATE_KEY environment variable is not set.",
+            hint="Export your Ethereum private key: export TEARDROP_SIWE_PRIVATE_KEY=0x<key>",
+        )
+        raise typer.Exit(1)
+
+    try:
+        from eth_account import Account
+        from eth_account.messages import encode_defunct
+    except ImportError:
+        print_error(
+            "eth-account is required for SIWE login.",
+            hint="Install it with: pip install eth-account",
+        )
+        raise typer.Exit(1) from None
+
+    account = Account.from_key(private_key)
+    wallet_address = account.address
+    console.print(f"[dim]Wallet:[/dim] {wallet_address}")
+
+    async def _do_siwe() -> str:
+        client = AsyncTeardropClient(url)
+        try:
+            nonce_resp = await client.get_siwe_nonce()
+            nonce = nonce_resp.get("nonce", nonce_resp.get("value", ""))
+
+            # Construct EIP-4361 message
+            from datetime import datetime
+            from urllib.parse import urlparse
+
+            parsed = urlparse(url)
+            domain = parsed.netloc or parsed.path
+            issued_at = datetime.now(UTC).strftime("%Y-%m-%dT%H:%M:%SZ")
+            message = (
+                f"{domain} wants you to sign in with your Ethereum account:\n"
+                f"{wallet_address}\n\n"
+                f"Sign in to Teardrop\n\n"
+                f"URI: {url}\n"
+                f"Version: 1\n"
+                f"Chain ID: 1\n"
+                f"Nonce: {nonce}\n"
+                f"Issued At: {issued_at}"
+            )
+
+            signable = encode_defunct(text=message)
+            signed = account.sign_message(signable)
+            signature = signed.signature.hex()
+            if not signature.startswith("0x"):
+                signature = "0x" + signature
+
+            jwt_token = await client.authenticate_siwe(message, signature, nonce)
+            return jwt_token
+        finally:
+            await client.close()
+
+    with spinner("Signing in with Ethereum…"):
+        try:
+            jwt_token = asyncio.run(_do_siwe())
+        except Exception as exc:
+            _handle_auth_error(exc)
+            return
+
+    config.store_token(jwt_token)
+    print_success(f"Authenticated via SIWE as [bold]{wallet_address}[/bold].")
+
+
+def _handle_auth_error(exc: Exception) -> None:
+    from teardrop import APIError, AuthenticationError
+
+    from teardrop_cli.formatting import print_error
+
+    if isinstance(exc, AuthenticationError):
+        print_error("Invalid credentials.", hint="Check your email and password.")
+    elif isinstance(exc, APIError):
+        print_error(f"API error {exc.status_code}.", hint=str(exc))
+    else:
+        print_error(str(exc))
+    raise typer.Exit(1)
+
+
+# ---------------------------------------------------------------------------
+# logout
+# ---------------------------------------------------------------------------
+
+
+@app.command()
+def logout() -> None:
+    """Remove stored credentials."""
+    from teardrop_cli import config
+    from teardrop_cli.formatting import print_success
+
+    config.clear_credentials()
+    print_success("Logged out. Credentials removed.")
+
+
+# ---------------------------------------------------------------------------
+# whoami
+# ---------------------------------------------------------------------------
+
+
+@app.command()
+def whoami(
+    base_url: Annotated[
+        str | None, typer.Option("--base-url", help="Override the API base URL.", hidden=True)
+    ] = None,
+    as_json: Annotated[bool, typer.Option("--json", help="Output as JSON.")] = False,
+) -> None:
+    """Show the currently authenticated user."""
+    import asyncio
+
+    from teardrop_cli import config
+    from teardrop_cli.formatting import print_json, print_table, spinner
+
+    client = config.get_client(base_url)
+
+    async def _fetch():
+        try:
+            return await client.get_me()
+        finally:
+            await client.close()
+
+    with spinner("Fetching identity…"):
+        me = asyncio.run(_fetch())
+
+    data = me.model_dump()
+    if as_json:
+        print_json(data)
+        return
+
+    rows = [[k, v] for k, v in data.items() if v is not None]
+    print_table(
+        [("Field", {"style": "bold cyan"}), "Value"],
+        rows,
+        title="Current User",
+    )

teardrop_cli/commands/billing.py

@@ -0,0 +1,58 @@
+"""billing commands: account balance."""
+
+from __future__ import annotations
+
+import asyncio
+from typing import Annotated
+
+import typer
+
+app = typer.Typer(
+    name="billing",
+    help="Billing — account balance and usage.",
+    no_args_is_help=True,
+)
+
+
+@app.callback()
+def _callback() -> None:
+    """Billing — account balance and usage."""
+
+
+# ---------------------------------------------------------------------------
+# balance
+# ---------------------------------------------------------------------------
+
+
+@app.command()
+def balance(
+    as_json: Annotated[bool, typer.Option("--json", help="Output as JSON.")] = False,
+    base_url: Annotated[str | None, typer.Option("--base-url", hidden=True)] = None,
+) -> None:
+    """Show your account balance."""
+    from teardrop_cli import config
+    from teardrop_cli.formatting import print_json, print_table, spinner
+
+    async def _fetch():
+        try:
+            return await client.get_balance()
+        finally:
+            await client.close()
+
+    client = config.get_client(base_url)
+
+    with spinner("Fetching balance…"):
+        data = asyncio.run(_fetch())
+
+    data_dict = data.model_dump() if hasattr(data, "model_dump") else data
+
+    if as_json:
+        print_json(data_dict)
+        return
+
+    rows = [[k, v] for k, v in data_dict.items()]
+    print_table(
+        [("Field", {"style": "bold cyan"}), "Value"],
+        rows,
+        title="Account Balance",
+    )

teardrop_cli/commands/llm_config.py

@@ -0,0 +1,376 @@
+"""llm-config commands: get, set, delete."""
+
+from __future__ import annotations
+
+import asyncio
+import sys
+from typing import Annotated
+
+import typer
+
+app = typer.Typer(
+    name="llm-config",
+    help="Org LLM configuration — get, set, and delete.",
+    no_args_is_help=True,
+)
+
+_SUPPORTED_PROVIDERS = ["anthropic", "openai", "google", "openrouter"]
+_SUPPORTED_ROUTINGS = ["default", "cost", "speed", "quality"]
+
+
+def _mask_api_key(key: str) -> str:
+    """Return first 5 chars of *key* followed by bullet ellipsis."""
+    prefix = key[:5] if len(key) >= 5 else key
+    return f"{prefix}••••"
+
+
+# ---------------------------------------------------------------------------
+# get
+# ---------------------------------------------------------------------------
+
+
+@app.command()
+def get(
+    org_id: Annotated[str, typer.Argument(help="Organisation ID.")],
+    as_json: Annotated[bool, typer.Option("--json", help="Output as JSON.")] = False,
+    no_cache: Annotated[
+        bool,
+        typer.Option("--no-cache", "--force-refresh", help="Bypass the local 5-minute cache."),
+    ] = False,
+    base_url: Annotated[str | None, typer.Option("--base-url", hidden=True)] = None,
+) -> None:
+    """Display the org's current LLM configuration."""
+    from teardrop import AuthenticationError
+
+    from teardrop_cli import config
+    from teardrop_cli.formatting import print_error, print_json, print_table, spinner
+
+    client = config.get_client(base_url)
+
+    try:
+
+        async def _fetch():
+            try:
+                return await client.get_llm_config(org_id=org_id, no_cache=no_cache)
+            finally:
+                await client.close()
+
+        with spinner("Fetching LLM config…"):
+            cfg = asyncio.run(_fetch())
+    except AuthenticationError:
+        print_error(
+            "Not authenticated.",
+            hint="Run: `teardrop auth login`",
+        )
+        raise typer.Exit(1) from None
+    except Exception as exc:
+        _handle_common_error(exc)
+
+    data = cfg if isinstance(cfg, dict) else cfg.model_dump()
+
+    if as_json:
+        print_json(data)
+        return
+
+    # Check for 404-equivalent (no custom config)
+    if not data:
+        from teardrop_cli.formatting import console
+
+        console.print(
+            f"[dim]No custom LLM config found for {org_id}. Using global defaults.[/dim]"
+        )
+        return
+
+    api_key_display = "true" if data.get("has_api_key") else "false"
+
+    print_table(
+        [("Field", {"style": "bold cyan"}), "Value"],
+        [
+            ["Provider", data.get("provider", "—")],
+            ["Model", data.get("model", "—")],
+            ["API Key Set", api_key_display],
+            ["Self-Hosted URL", data.get("api_base") or "(none)"],
+            ["Max Tokens", data.get("max_tokens", "—")],
+            ["Temperature", data.get("temperature", "—")],
+            ["Timeout", f"{data.get('timeout_seconds', '—')}s"],
+            ["Routing Preference", data.get("routing_preference", "—")],
+            ["Is BYOK", str(data.get("is_byok", False))],
+            ["Created", data.get("created_at", "—")],
+            ["Updated", data.get("updated_at", "—")],
+        ],
+        title=f"LLM Config — {org_id}",
+    )
+
+
+# ---------------------------------------------------------------------------
+# set
+# ---------------------------------------------------------------------------
+
+
+@app.command(name="set")
+def set_config(
+    org_id: Annotated[str, typer.Argument(help="Organisation ID.")],
+    provider: Annotated[
+        str | None,
+        typer.Option("--provider", help="LLM provider (anthropic, openai, google, openrouter)."),
+    ] = None,
+    model: Annotated[str | None, typer.Option("--model", help="Model ID.")] = None,
+    routing: Annotated[
+        str | None,
+        typer.Option("--routing", help="Routing preference (default, cost, speed, quality)."),
+    ] = None,
+    api_base: Annotated[
+        str | None, typer.Option("--api-base", help="Self-hosted model base URL.")
+    ] = None,
+    max_tokens: Annotated[
+        int | None, typer.Option("--max-tokens", help="Max tokens (1–200,000).")
+    ] = None,
+    temperature: Annotated[
+        float | None, typer.Option("--temperature", help="Temperature (0.0–2.0).")
+    ] = None,
+    timeout_seconds: Annotated[
+        int | None, typer.Option("--timeout-seconds", help="Timeout in seconds (≥1).")
+    ] = None,
+    byok_key: Annotated[
+        str | None,
+        typer.Option("--byok-key", help="Bring-your-own API key. Pass '-' to read from stdin."),
+    ] = None,
+    rotate_key: Annotated[
+        bool,
+        typer.Option("--rotate-key", help="Rotate the existing API key (delete + re-add)."),
+    ] = False,
+    as_json: Annotated[bool, typer.Option("--json", help="Output as JSON.")] = False,
+    base_url: Annotated[str | None, typer.Option("--base-url", hidden=True)] = None,
+) -> None:
+    """Create or update the org's LLM configuration."""
+    from teardrop import AuthenticationError
+
+    from teardrop_cli import config
+    from teardrop_cli.formatting import (
+        print_error,
+        print_json,
+        print_success,
+        print_table,
+        print_warning,
+        spinner,
+    )
+
+    # ------------------------------------------------------------------
+    # Client-side validation
+    # ------------------------------------------------------------------
+    if provider is not None and provider not in _SUPPORTED_PROVIDERS:
+        print_error(
+            f"Unsupported provider: {provider!r}.",
+            hint=f"Supported: {', '.join(_SUPPORTED_PROVIDERS)}",
+        )
+        raise typer.Exit(1)
+
+    if routing is not None and routing not in _SUPPORTED_ROUTINGS:
+        print_error(
+            f"Invalid routing preference: {routing!r}.",
+            hint=f"Supported: {', '.join(_SUPPORTED_ROUTINGS)}",
+        )
+        raise typer.Exit(1)
+
+    if temperature is not None and not (0.0 <= temperature <= 2.0):
+        print_error("Temperature must be 0.0–2.0.")
+        raise typer.Exit(1)
+
+    if max_tokens is not None and not (1 <= max_tokens <= 200_000):
+        print_error("Max tokens must be 1–200,000.")
+        raise typer.Exit(1)
+
+    if timeout_seconds is not None and timeout_seconds < 1:
+        print_error("timeout-seconds must be ≥ 1.")
+        raise typer.Exit(1)
+
+    # ------------------------------------------------------------------
+    # BYOK key resolution
+    # ------------------------------------------------------------------
+    resolved_key: str | None = None
+
+    if byok_key == "-":
+        # Read from stdin
+        resolved_key = sys.stdin.read().strip()
+    elif byok_key is not None:
+        print_warning("API key passed as argument. Consider using stdin for better security.")
+        print_warning("Example: cat $key_file | teardrop llm-config set ... --byok-key -")
+        resolved_key = byok_key
+
+    # Warn if sending a key over a non-HTTPS api_base
+    if resolved_key and api_base and not api_base.startswith("https://"):
+        print_warning("api-base is not HTTPS. API keys must only be sent over TLS.")
+
+    # ------------------------------------------------------------------
+    # API call
+    # ------------------------------------------------------------------
+    client = config.get_client(base_url)
+
+    kwargs: dict = {"org_id": org_id}
+    if provider is not None:
+        kwargs["provider"] = provider
+    if model is not None:
+        kwargs["model"] = model
+    if routing is not None:
+        kwargs["routing_preference"] = routing
+    if api_base is not None:
+        kwargs["api_base"] = api_base
+    if max_tokens is not None:
+        kwargs["max_tokens"] = max_tokens
+    if temperature is not None:
+        kwargs["temperature"] = temperature
+    if timeout_seconds is not None:
+        kwargs["timeout_seconds"] = timeout_seconds
+    if rotate_key:
+        kwargs["rotate_key"] = True
+    # resolved_key may be None — server preserves existing key when omitted
+    if resolved_key is not None:
+        kwargs["api_key"] = resolved_key
+
+    try:
+
+        async def _fetch():
+            try:
+                return await client.set_llm_config(**kwargs)
+            finally:
+                await client.close()
+
+        with spinner("Updating LLM config…"):
+            cfg = asyncio.run(_fetch())
+    except AuthenticationError:
+        print_error("Not authenticated.", hint="Run: `teardrop auth login`")
+        raise typer.Exit(1) from None
+    except Exception as exc:
+        _handle_common_error(exc)
+
+    data = cfg if isinstance(cfg, dict) else cfg.model_dump()
+
+    if as_json:
+        # Never include raw api_key in output
+        data.pop("api_key", None)
+        print_json(data)
+        return
+
+    print_success(f"Updated LLM configuration for {org_id}")
+    summary_rows: list[list] = [
+        ["Provider", data.get("provider", "—")],
+        ["Model", data.get("model", "—")],
+        ["Routing", data.get("routing_preference", "—")],
+    ]
+    if data.get("api_base"):
+        summary_rows.append(["Self-Hosted URL", data["api_base"]])
+    if data.get("has_api_key"):
+        key_display = f"true ({_mask_api_key(resolved_key)})" if resolved_key else "true"
+        summary_rows.append(["API Key Set", key_display])
+    if data.get("is_byok"):
+        summary_rows.append(["Is BYOK", "true"])
+
+    print_table(
+        [("Field", {"style": "bold cyan"}), "Value"],
+        summary_rows,
+    )
+
+
+# ---------------------------------------------------------------------------
+# delete
+# ---------------------------------------------------------------------------
+
+
+@app.command()
+def delete(
+    org_id: Annotated[str, typer.Argument(help="Organisation ID.")],
+    yes: Annotated[bool, typer.Option("--yes", "-y", help="Skip confirmation prompt.")] = False,
+    base_url: Annotated[str | None, typer.Option("--base-url", hidden=True)] = None,
+) -> None:
+    """Remove org's custom LLM config and revert to global defaults."""
+    from teardrop import AuthenticationError
+
+    from teardrop_cli import config
+    from teardrop_cli.formatting import confirm, print_error, print_success, spinner
+
+    if not yes:
+        confirmed = confirm(
+            f"Delete custom LLM config for {org_id}? This will revert to global defaults."
+        )
+        if not confirmed:
+            raise typer.Abort()
+
+    client = config.get_client(base_url)
+
+    try:
+
+        async def _fetch():
+            try:
+                await client.delete_llm_config(org_id=org_id)
+            finally:
+                await client.close()
+
+        with spinner("Deleting LLM config…"):
+            asyncio.run(_fetch())
+    except AuthenticationError:
+        print_error("Not authenticated.", hint="Run: `teardrop auth login`")
+        raise typer.Exit(1) from None
+    except Exception as exc:
+        # 404 is treated as success (already using defaults)
+        _handle_common_error(exc, not_found_ok=True)
+
+    print_success("Deleted")
+
+
+# ---------------------------------------------------------------------------
+# Internal helpers
+# ---------------------------------------------------------------------------
+
+
+def _handle_common_error(exc: Exception, *, not_found_ok: bool = False) -> None:
+    """Translate SDK/HTTP exceptions to user-friendly messages."""
+    from teardrop_cli.formatting import console, print_error, print_success
+
+    exc_str = str(exc)
+    status = getattr(exc, "status_code", None) or getattr(exc, "status", None)
+
+    if not_found_ok and status == 404:
+        print_success("No config found (already using defaults).")
+        return
+
+    if status == 401:
+        print_error("Not authenticated.", hint="Run: `teardrop auth login`")
+        raise typer.Exit(1)
+
+    if status == 404:
+        console.print("[dim]No custom LLM config found. Using global defaults.[/dim]")
+        raise typer.Exit(0)
+
+    if status == 400:
+        if "ssrf" in exc_str.lower() or "private" in exc_str.lower():
+            print_error(
+                "api_base must be a public URL (e.g., https://api.provider.com).",
+                hint="Contact support for private endpoint allowlisting.",
+            )
+        elif "provider" in exc_str.lower():
+            print_error(
+                "Unsupported provider.",
+                hint=f"Supported: {', '.join(_SUPPORTED_PROVIDERS)}",
+            )
+        elif "routing" in exc_str.lower():
+            print_error(
+                "Invalid routing preference.",
+                hint=f"Supported: {', '.join(_SUPPORTED_ROUTINGS)}",
+            )
+        else:
+            print_error(f"Bad request: {exc_str}")
+        raise typer.Exit(1)
+
+    if status == 422:
+        print_error(f"Validation error: {exc_str}")
+        raise typer.Exit(1)
+
+    if status == 429:
+        print_error(
+            "Too many config updates.",
+            hint="Maximum 10 updates per hour per org.",
+        )
+        raise typer.Exit(1)
+
+    print_error(f"Unexpected error: {exc_str}")
+    raise typer.Exit(1)