xenfra 0.3.3__tar.gz → 0.3.4__tar.gz

{xenfra-0.3.3 → xenfra-0.3.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: xenfra
-Version: 0.3.3
+Version: 0.3.4
 Summary: A 'Zen Mode' infrastructure engine for Python developers.
 Author: xenfra-cloud
 Author-email: xenfra-cloud <xenfracloud@gmail.com>
@@ -23,6 +23,7 @@ Requires-Dist: httpx>=0.27.0
 Requires-Dist: keyring>=25.7.0
 Requires-Dist: keyrings-alt>=5.0.2
 Requires-Dist: tenacity>=8.2.3
+Requires-Dist: cryptography>=43.0.0
 Requires-Dist: pytest>=8.0.0 ; extra == 'test'
 Requires-Dist: pytest-mock>=3.12.0 ; extra == 'test'
 Requires-Python: >=3.13

{xenfra-0.3.3 → xenfra-0.3.4}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "xenfra"
-version = "0.3.3"
+version = "0.3.4"
 description = "A 'Zen Mode' infrastructure engine for Python developers."
 readme = "README.md"
 authors = [
@@ -30,6 +30,7 @@ dependencies = [
     "keyring>=25.7.0",
     "keyrings.alt>=5.0.2",
     "tenacity>=8.2.3",  # For retry logic
+    "cryptography>=43.0.0",  # For encrypted file-based token storage
 ]
 requires-python = ">=3.13"
 

{xenfra-0.3.3 → xenfra-0.3.4}/src/xenfra/commands/intelligence.py

@@ -34,40 +34,42 @@ def get_client() -> XenfraClient:
         console.print("[bold red]Not logged in. Run 'xenfra login' first.[/bold red]")
         raise click.Abort()
 
-    # DEBUG: Show token details
-    import base64
-    import json
-    try:
-        parts = token.split(".")
-        if len(parts) == 3:
-            # Decode payload
-            payload_b64 = parts[1]
-            padding = 4 - len(payload_b64) % 4
-            if padding != 4:
-                payload_b64 += "=" * padding
-            payload_bytes = base64.urlsafe_b64decode(payload_b64)
-            claims = json.loads(payload_bytes)
-
-            console.print("[dim]━━━ DEBUG: Token Info ━━━[/dim]")
-            console.print(f"[dim]  API URL: {API_BASE_URL}[/dim]")
-            console.print(f"[dim]  Token prefix: {token[:20]}...[/dim]")
-            console.print(f"[dim]  sub (email): {claims.get('sub', 'MISSING')}[/dim]")
-            console.print(f"[dim]  user_id: {claims.get('user_id', 'MISSING')}[/dim]")
-            console.print(f"[dim]  iss (issuer): {claims.get('iss', 'MISSING')}[/dim]")
-            console.print(f"[dim]  aud (audience): {claims.get('aud', 'MISSING')}[/dim]")
-
-            # Check if token is expired
-            exp = claims.get('exp')
-            if exp:
-                import time
-                is_expired = time.time() >= exp
-                from datetime import datetime, timezone
-                exp_time = datetime.fromtimestamp(exp, tz=timezone.utc)
-                console.print(f"[dim]  expires_at: {exp_time}[/dim]")
-                console.print(f"[dim]  expired: {is_expired}[/dim]")
-            console.print("[dim]━━━━━━━━━━━━━━━━━━━━━[/dim]\n")
-    except Exception as e:
-        console.print(f"[dim]DEBUG: Could not decode token: {e}[/dim]\n")
+    # DEBUG: Only show token info if XENFRA_DEBUG environment variable is set
+    import os
+    if os.getenv("XENFRA_DEBUG") == "1":
+        import base64
+        import json
+        try:
+            parts = token.split(".")
+            if len(parts) == 3:
+                # Decode payload
+                payload_b64 = parts[1]
+                padding = 4 - len(payload_b64) % 4
+                if padding != 4:
+                    payload_b64 += "=" * padding
+                payload_bytes = base64.urlsafe_b64decode(payload_b64)
+                claims = json.loads(payload_bytes)
+
+                console.print("[dim]━━━ DEBUG: Token Info ━━━[/dim]")
+                console.print(f"[dim]  API URL: {API_BASE_URL}[/dim]")
+                console.print(f"[dim]  Token prefix: {token[:20]}...[/dim]")
+                console.print(f"[dim]  sub (email): {claims.get('sub', 'MISSING')}[/dim]")
+                console.print(f"[dim]  user_id: {claims.get('user_id', 'MISSING')}[/dim]")
+                console.print(f"[dim]  iss (issuer): {claims.get('iss', 'MISSING')}[/dim]")
+                console.print(f"[dim]  aud (audience): {claims.get('aud', 'MISSING')}[/dim]")
+
+                # Check if token is expired
+                exp = claims.get('exp')
+                if exp:
+                    import time
+                    is_expired = time.time() >= exp
+                    from datetime import datetime, timezone
+                    exp_time = datetime.fromtimestamp(exp, tz=timezone.utc)
+                    console.print(f"[dim]  expires_at: {exp_time}[/dim]")
+                    console.print(f"[dim]  expired: {is_expired}[/dim]")
+                console.print("[dim]━━━━━━━━━━━━━━━━━━━━━[/dim]\n")
+        except Exception as e:
+            console.print(f"[dim]DEBUG: Could not decode token: {e}[/dim]\n")
 
     return XenfraClient(token=token, api_url=API_BASE_URL)
 

{xenfra-0.3.3 → xenfra-0.3.4}/src/xenfra/utils/auth.py

@@ -124,37 +124,89 @@ def _refresh_token_with_retry(refresh_token: str) -> dict:
         return token_data
 
 
+def _get_encryption_key() -> bytes:
+    """
+    Get or create encryption key for file-based token storage.
+
+    Uses machine-specific identifier to generate key (not perfect but better than plaintext).
+    """
+    import platform
+    import hashlib
+
+    # Use machine ID + username as seed (available on Windows/Linux/Mac)
+    machine_id = platform.node() + os.getlogin()
+    key = hashlib.sha256(machine_id.encode()).digest()[:32]  # 32 bytes for Fernet
+    return key
+
+
 def _get_token_from_file(key: str) -> str | None:
     """Fallback: Get token from file storage (for Windows if keyring fails)."""
     try:
         if TOKEN_FILE.exists():
+            with open(TOKEN_FILE, "rb") as f:
+                encrypted_data = f.read()
+
+            # Decrypt the file contents
+            from cryptography.fernet import Fernet
+            import base64
+
+            fernet_key = base64.urlsafe_b64encode(_get_encryption_key())
+            cipher = Fernet(fernet_key)
+            decrypted_data = cipher.decrypt(encrypted_data)
+            tokens = json.loads(decrypted_data.decode())
+            return tokens.get(key)
+    except Exception:
+        # If decryption fails, try reading as plaintext (for backward compatibility)
+        try:
             with open(TOKEN_FILE, "r") as f:
                 tokens = json.load(f)
                 return tokens.get(key)
-    except Exception:
-        pass
+        except Exception:
+            pass
     return None
 
 
 def _set_token_to_file(key: str, value: str):
-    """Fallback: Save token to file storage (for Windows if keyring fails)."""
+    """Fallback: Save token to file storage (encrypted for Windows if keyring fails)."""
     try:
         TOKEN_FILE.parent.mkdir(parents=True, exist_ok=True)
 
-        # Load existing tokens
+        # Load existing tokens (try encrypted first, then plaintext)
         tokens = {}
         if TOKEN_FILE.exists():
-            with open(TOKEN_FILE, "r") as f:
-                tokens = json.load(f)
+            try:
+                with open(TOKEN_FILE, "rb") as f:
+                    encrypted_data = f.read()
+                from cryptography.fernet import Fernet
+                import base64
+
+                fernet_key = base64.urlsafe_b64encode(_get_encryption_key())
+                cipher = Fernet(fernet_key)
+                decrypted_data = cipher.decrypt(encrypted_data)
+                tokens = json.loads(decrypted_data.decode())
+            except Exception:
+                # Fallback to plaintext for backward compatibility
+                try:
+                    with open(TOKEN_FILE, "r") as f:
+                        tokens = json.load(f)
+                except Exception:
+                    tokens = {}
 
         # Update token
         tokens[key] = value
 
-        # Save (with restrictive permissions on Unix-like systems)
-        with open(TOKEN_FILE, "w") as f:
-            json.dump(tokens, f)
+        # Encrypt and save
+        from cryptography.fernet import Fernet
+        import base64
+
+        fernet_key = base64.urlsafe_b64encode(_get_encryption_key())
+        cipher = Fernet(fernet_key)
+        encrypted_data = cipher.encrypt(json.dumps(tokens).encode())
+
+        with open(TOKEN_FILE, "wb") as f:
+            f.write(encrypted_data)
 
-        # Set file permissions (owner read/write only)
+        # Set file permissions (owner read/write only) - works on Unix-like systems
         if os.name != "nt":  # Not Windows
             TOKEN_FILE.chmod(0o600)
     except Exception as e:
@@ -195,9 +247,11 @@ def get_auth_token() -> str | None:
     try:
         access_token = keyring.get_password(SERVICE_ID, "access_token")
         refresh_token = keyring.get_password(SERVICE_ID, "refresh_token")
-        console.print("[dim]DEBUG: Token retrieved from keyring[/dim]")
+        if os.getenv("XENFRA_DEBUG") == "1":
+            console.print("[dim]DEBUG: Token retrieved from keyring[/dim]")
     except keyring.errors.KeyringError as e:
-        console.print(f"[dim]DEBUG: Keyring unavailable, using file storage: {e}[/dim]")
+        if os.getenv("XENFRA_DEBUG") == "1":
+            console.print(f"[dim]DEBUG: Keyring unavailable, using file storage: {e}[/dim]")
         use_file_fallback = True
         access_token = _get_token_from_file("access_token")
         refresh_token = _get_token_from_file("refresh_token")