xoople-cli 0.3.0__tar.gz → 0.5.0__tar.gz

{xoople_cli-0.3.0 → xoople_cli-0.5.0}/PKG-INFO

@@ -1,18 +1,16 @@
 Metadata-Version: 2.4
 Name: xoople-cli
-Version: 0.3.0
+Version: 0.5.0
 Summary: Command-line interface for the Xoople Products API.
 License-Expression: LicenseRef-Xoople-Proprietary
 License-File: LICENSE
 Classifier: Development Status :: 3 - Alpha
 Classifier: Programming Language :: Python :: 3.12
-Requires-Dist: xoople-sdk>=0.5.0
+Requires-Dist: xoople-sdk>=0.7.0
 Requires-Dist: cyclopts>=4.18,<5
 Requires-Dist: rich>=13.7
-Requires-Dist: xoople-sdk[entra]>=0.5.0 ; extra == 'entra'
 Requires-Python: >=3.12
 Project-URL: Homepage, https://xoople.com
-Provides-Extra: entra
 Description-Content-Type: text/markdown
 
 # xoople-cli
@@ -48,20 +46,43 @@ output pipes into `jq`.
 `auth login` signs in through the browser with PKCE and stores the session at
 `$XDG_CONFIG_HOME/xoople/session.json` (`~/.config/xoople/session.json` by
 default), readable only by you. Every later command uses that session when
-neither `--token` nor `--entra-scope` is given, and refreshes it when the
+no `--token` is given, and refreshes it when the
 access token is close to expiry.
 
 ```console
-$ export XOOPLE_API_URL=https://api.xoople.com XOOPLE_CIAM_CLIENT_ID=client_...
+$ export XOOPLE_API_URL=https://api.xoople.com
 $ xoople auth login
 $ xoople analyses list
 ```
 
-`auth status` exits `3` when there is no stored session, so a script can test
-for a sign-in. `--ciam-redirect-uri` (`XOOPLE_CIAM_REDIRECT_URI`) overrides the
+`auth login` reads the CIAM client ID from the API. `--ciam-client-id`
+(`XOOPLE_CIAM_CLIENT_ID`) overrides it. `auth status` exits `3` when there is no
+stored session, so a script can test for a sign-in. `--ciam-redirect-uri` (`XOOPLE_CIAM_REDIRECT_URI`) overrides the
 loopback URI the browser returns to; it must match a URI registered for the
 CIAM client.
 
+## API keys
+
+An API key lets a script or a CI job run the CLI without a browser sign-in.
+Create one on the **API keys** section of your Xoople profile page (`/profile`).
+The key starts with `sk_` and is shown once, so store it in a secret manager.
+
+A key belongs to one organization membership. It acts as you, in the
+organization that was active when you created it, with that membership's roles.
+To work in a different organization, create a key there.
+
+Pass the key as the token. It takes precedence over a stored session:
+
+```console
+$ export XOOPLE_API_URL=https://api.xoople.com XOOPLE_TOKEN=sk_...
+$ xoople access me
+```
+
+The API accepts at most 300 API key requests a minute from one IP address. The
+CLI retries rate-limited GETs and replay-safe writes with backoff, then exits
+`8`. Any other write exits `8` on the first 429, with no retry. Revoke a key on
+the same profile page when you no longer need it.
+
 ## Submitting an analysis
 
 The product spec is deeply nested and differs per product, so `create` and
@@ -83,4 +104,5 @@ non-zero if it does not reach `COMPLETE`.
 `3` unauthenticated, including a failed or absent sign-in · `4` forbidden ·
 `5` not found · `6` bad request or validation · `7` conflict · `8` rate limited ·
 `9` server error · `10` connection failure · `11` unreadable response ·
-`12` run finished in a non-`COMPLETE` state · `13` `--wait` timed out.
+`12` run finished in a non-`COMPLETE` state · `13` `--wait` timed out ·
+`14` the analysis was deleted.

{xoople_cli-0.3.0 → xoople_cli-0.5.0}/README.md

@@ -31,20 +31,43 @@ output pipes into `jq`.
 `auth login` signs in through the browser with PKCE and stores the session at
 `$XDG_CONFIG_HOME/xoople/session.json` (`~/.config/xoople/session.json` by
 default), readable only by you. Every later command uses that session when
-neither `--token` nor `--entra-scope` is given, and refreshes it when the
+no `--token` is given, and refreshes it when the
 access token is close to expiry.
 
 ```console
-$ export XOOPLE_API_URL=https://api.xoople.com XOOPLE_CIAM_CLIENT_ID=client_...
+$ export XOOPLE_API_URL=https://api.xoople.com
 $ xoople auth login
 $ xoople analyses list
 ```
 
-`auth status` exits `3` when there is no stored session, so a script can test
-for a sign-in. `--ciam-redirect-uri` (`XOOPLE_CIAM_REDIRECT_URI`) overrides the
+`auth login` reads the CIAM client ID from the API. `--ciam-client-id`
+(`XOOPLE_CIAM_CLIENT_ID`) overrides it. `auth status` exits `3` when there is no
+stored session, so a script can test for a sign-in. `--ciam-redirect-uri` (`XOOPLE_CIAM_REDIRECT_URI`) overrides the
 loopback URI the browser returns to; it must match a URI registered for the
 CIAM client.
 
+## API keys
+
+An API key lets a script or a CI job run the CLI without a browser sign-in.
+Create one on the **API keys** section of your Xoople profile page (`/profile`).
+The key starts with `sk_` and is shown once, so store it in a secret manager.
+
+A key belongs to one organization membership. It acts as you, in the
+organization that was active when you created it, with that membership's roles.
+To work in a different organization, create a key there.
+
+Pass the key as the token. It takes precedence over a stored session:
+
+```console
+$ export XOOPLE_API_URL=https://api.xoople.com XOOPLE_TOKEN=sk_...
+$ xoople access me
+```
+
+The API accepts at most 300 API key requests a minute from one IP address. The
+CLI retries rate-limited GETs and replay-safe writes with backoff, then exits
+`8`. Any other write exits `8` on the first 429, with no retry. Revoke a key on
+the same profile page when you no longer need it.
+
 ## Submitting an analysis
 
 The product spec is deeply nested and differs per product, so `create` and
@@ -66,4 +89,5 @@ non-zero if it does not reach `COMPLETE`.
 `3` unauthenticated, including a failed or absent sign-in · `4` forbidden ·
 `5` not found · `6` bad request or validation · `7` conflict · `8` rate limited ·
 `9` server error · `10` connection failure · `11` unreadable response ·
-`12` run finished in a non-`COMPLETE` state · `13` `--wait` timed out.
+`12` run finished in a non-`COMPLETE` state · `13` `--wait` timed out ·
+`14` the analysis was deleted.

{xoople_cli-0.3.0 → xoople_cli-0.5.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "xoople-cli"
-version = "0.3.0"
+version = "0.5.0"
 description = "Command-line interface for the Xoople Products API."
 readme = "README.md"
 requires-python = ">=3.12"
@@ -11,14 +11,11 @@ classifiers = [
     "Programming Language :: Python :: 3.12",
 ]
 dependencies = [
-    "xoople-sdk>=0.5.0",
+    "xoople-sdk>=0.7.0",
     "cyclopts>=4.18,<5",
     "rich>=13.7",
 ]
 
-[project.optional-dependencies]
-entra = ["xoople-sdk[entra]>=0.5.0"]
-
 [project.scripts]
 xoople = "xoople.cli.main:main"
 
@@ -26,7 +23,7 @@ xoople = "xoople.cli.main:main"
 Homepage = "https://xoople.com"
 
 [build-system]
-requires = ["uv_build>=0.11.6,<0.12"]
+requires = ["uv_build>=0.13.0,<0.14"]
 build-backend = "uv_build"
 
 [tool.uv.build-backend]

{xoople_cli-0.3.0 → xoople_cli-0.5.0}/pyproject.toml.orig

@@ -1,6 +1,6 @@
 [project]
 name = "xoople-cli"
-version = "0.3.0"
+version = "0.5.0"
 description = "Command-line interface for the Xoople Products API."
 readme = "README.md"
 requires-python = ">=3.12"
@@ -13,7 +13,7 @@ classifiers = [
   "Programming Language :: Python :: 3.12",
 ]
 dependencies = [
-  "xoople-sdk>=0.5.0",
+  "xoople-sdk>=0.7.0",
   # Cyclopts parses docstrings for parameter help so signatures stay plain,
   # supports union types and Pydantic models natively, and owns its parser.
   # Global options + dependency injection go through the meta-app launcher
@@ -22,13 +22,6 @@ dependencies = [
   "rich>=13.7",
 ]
 
-[project.optional-dependencies]
-# Mirrors xoople-sdk[entra]: internal callers authenticating with Entra ID via
-# `--entra-scope`. Not needed for the token path.
-entra = [
-  "xoople-sdk[entra]>=0.5.0",
-]
-
 [project.scripts]
 xoople = "xoople.cli.main:main"
 
@@ -36,7 +29,7 @@ xoople = "xoople.cli.main:main"
 Homepage = "https://xoople.com"
 
 [build-system]
-requires = ["uv_build>=0.11.6,<0.12"]
+requires = ["uv_build>=0.13.0,<0.14"]
 build-backend = "uv_build"
 
 [tool.uv.build-backend]

xoople_cli-0.5.0/src/xoople/cli/_ciam.py

@@ -0,0 +1,71 @@
+"""Which CIAM client the CLI signs in as, and how a failed sign-in is reported.
+
+The SDK owns the sign-in, browser leg included, and the session file, because
+a `xoople-cli` connection profile reads that file too.
+"""
+
+from collections.abc import Callable
+from dataclasses import dataclass
+from typing import Protocol, Self
+
+from xoople.cli._errors import LoginFailed
+from xoople.sdk.auth import CiamUserSession, ciam_sign_in
+from xoople.sdk.errors import CredentialError
+
+DEFAULT_REDIRECT_URI = "http://localhost:8976/callback"
+"""Fixed, because CIAM matches a redirect URI exactly and must hold this one."""
+
+
+class _SignIn(Protocol):
+    def __call__(
+        self, *, client_id: str, redirect_uri: str, announce: Callable[[str], None]
+    ) -> CiamUserSession: ...
+
+
+# Tests supply a lookup that makes no HTTP call.
+type ClientIdLookup = Callable[[str], str]
+
+
+@dataclass(frozen=True, slots=True)
+class CiamConfig:
+    """What a login needs: the CIAM client and the URI the browser comes back to."""
+
+    client_id: str
+    redirect_uri: str = DEFAULT_REDIRECT_URI
+
+    @classmethod
+    def resolve(
+        cls,
+        client_id: str | None,
+        redirect_uri: str | None,
+        *,
+        base_url: str | None,
+        discover: ClientIdLookup,
+    ) -> Self:
+        """An explicit client wins. Otherwise the API names its own client."""
+        if not client_id:
+            if not base_url:
+                raise LoginFailed(
+                    "no CIAM client: pass --api-url, --ciam-client-id or set XOOPLE_CIAM_CLIENT_ID"
+                )
+            try:
+                client_id = discover(base_url)
+            except CredentialError as exc:
+                raise LoginFailed(f"{exc}: check --api-url or pass --ciam-client-id") from None
+        return cls(client_id=client_id, redirect_uri=redirect_uri or DEFAULT_REDIRECT_URI)
+
+
+def login(
+    config: CiamConfig,
+    *,
+    announce: Callable[[str], None],
+    sign_in: _SignIn = ciam_sign_in,
+) -> CiamUserSession:
+    """Run one browser sign-in and return the session it produced."""
+    try:
+        return sign_in(
+            client_id=config.client_id, redirect_uri=config.redirect_uri, announce=announce
+        )
+    except CredentialError as exc:
+        # One exit code covers every sign-in failure. The SDK message says which.
+        raise LoginFailed(str(exc)) from None

{xoople_cli-0.3.0 → xoople_cli-0.5.0}/src/xoople/cli/_context.py

@@ -6,11 +6,12 @@ from cyclopts import Parameter
 from xoople.cli import _ciam
 from xoople.cli._errors import UsageError
 from xoople.sdk import Config, CredentialProvider, XoopleClient
+from xoople.sdk import session as session_file
 from xoople.sdk.auth import (
     CiamUserCredentials,
     CiamUserSession,
-    EntraCredential,
     StaticToken,
+    ciam_discover_client_id,
 )
 
 
@@ -20,7 +21,6 @@ class Credentials:
 
     base_url: str | None = None
     token: str | None = None
-    entra_scope: str | None = None
     ciam_client_id: str | None = None
     ciam_redirect_uri: str | None = None
     timeout: float = 30.0
@@ -63,6 +63,7 @@ class Settings:
     credentials: Credentials
     factory: ClientFactory
     login: LoginRunner = _ciam.login
+    discover: _ciam.ClientIdLookup = ciam_discover_client_id
     as_json: bool = False
     _client: XoopleClient | None = field(default=None, repr=False)
 
@@ -78,23 +79,18 @@ class Settings:
 
 
 def _persist_session(session: CiamUserSession) -> None:
-    _ciam.write_session(session)
+    session_file.write_session(session)
 
 
 def _credential_provider(credentials: Credentials) -> CredentialProvider:
-    if credentials.entra_scope:
-        return EntraCredential(credentials.entra_scope)
     if credentials.token:
         return StaticToken(credentials.token)
-    session = _ciam.read_session()
+    session = session_file.read_session()
     if session is not None:
         # The credential refreshes a user token itself. Store what it mints, so
         # the next run does not spend another refresh token.
         return CiamUserCredentials(session, on_refresh=_persist_session)
-    raise UsageError(
-        "no credentials: run `xoople auth login`, pass --token, set XOOPLE_TOKEN, "
-        "or pass --entra-scope"
-    )
+    raise UsageError("no credentials: run `xoople auth login`, pass --token, or set XOOPLE_TOKEN")
 
 
 def build_client(credentials: Credentials) -> XoopleClient:

{xoople_cli-0.3.0 → xoople_cli-0.5.0}/src/xoople/cli/_errors.py

@@ -4,6 +4,8 @@ from xoople.sdk import errors
 EXIT_CODES: dict[type[errors.XoopleError], int] = {
     errors.AuthenticationError: 3,
     errors.PermissionDeniedError: 4,
+    # Before its parent: `exit_code` takes the first class the error is an instance of.
+    errors.AnalysisDeletedError: 14,
     errors.NotFoundError: 5,
     errors.BadRequestError: 6,
     errors.ValidationError: 6,

{xoople_cli-0.3.0 → xoople_cli-0.5.0}/src/xoople/cli/_spec.py

@@ -25,7 +25,7 @@ def _explain(exc: ValidationError) -> str:
 
 
 def load_create_request(
-    path: Path, display_name: str | None = None
+    path: Path, display_name: str | None = None, project: str | None = None
 ) -> models.CreateAnalysisRequest:
     """Read a create/estimate body from a JSON file (``-`` for stdin).
 
@@ -40,6 +40,6 @@ def load_create_request(
     # say so in its return type.
     body: dict[str, object] = {str(key): value for key, value in document.items()}
     try:
-        return create_request_from(body, display_name)
+        return create_request_from(body, display_name, project)
     except ValidationError as exc:
         raise UsageError(_explain(exc)) from exc

{xoople_cli-0.3.0 → xoople_cli-0.5.0}/src/xoople/cli/access.py

@@ -22,7 +22,7 @@ class _FlagRow(BaseModel):
 
 @app.command(name="me")
 def me(*, settings: SettingsParam) -> None:
-    """Show your Delta Sharing recipient and the share it reads."""
+    """Show your Delta Sharing recipient and the schema of your org's shared tables."""
     emit_model(settings.client().data_access.me(), as_json=settings.as_json)
 
 

{xoople_cli-0.3.0 → xoople_cli-0.5.0}/src/xoople/cli/analyses.py

@@ -1,5 +1,5 @@
 from pathlib import Path
-from typing import Annotated, Literal
+from typing import Annotated
 
 from cyclopts import App, Parameter
 from xoople.cli._context import SettingsParam, at_least_one
@@ -30,6 +30,7 @@ FIELDS = [
     ("Display name", "display_name"),
     ("Product", "product"),
     ("Product version", "product_version"),
+    ("Output schema outdated", "output_schema_outdated"),
     ("State", "state"),
     ("State message", "state_message"),
     ("Owner", "owner"),
@@ -105,6 +106,7 @@ def create(
     settings: SettingsParam,
     spec_file: Annotated[Path, _SPEC_FILE],
     display_name: str | None = None,
+    project: str | None = None,
     idempotency_key: str | None = None,
     wait: bool = False,
     poll_interval: float = 5.0,
@@ -118,6 +120,10 @@ def create(
         JSON spec, or a whole create request. Use - for stdin.
     display_name:
         Label for the analysis; overrides the spec file's.
+    project:
+        Project that holds the analysis, as a uid or projects/{uid}; overrides the spec
+        file's. Omit it to use the organisation's default project. An M2M token always
+        gets 403 for a named project other than the default project.
     idempotency_key:
         Reuse a previous key to replay a submission instead of duplicating it.
     wait:
@@ -127,7 +133,7 @@ def create(
     wait_timeout:
         Give up waiting after this many seconds.
     """
-    body = load_create_request(spec_file, display_name)
+    body = load_create_request(spec_file, display_name, project)
     analysis = settings.client().analyses.create(body, idempotency_key=idempotency_key)
     if not wait:
         emit_one(analysis, FIELDS, as_json=settings.as_json)
@@ -173,48 +179,6 @@ def cancel(analysis: str, *, settings: SettingsParam) -> None:
     emit_one(settings.client().analyses.cancel(analysis), FIELDS, as_json=settings.as_json)
 
 
-@app.command(name="share")
-def share(
-    analysis: str,
-    *,
-    settings: SettingsParam,
-    scope: Literal["org"] = "org",
-) -> None:
-    """Let your organisation read one analysis.
-
-    Anyone in your organisation can then open it by name. It stays out of their
-    listings, and the share grants them no reuse action and no access to the
-    underlying data. Only the owner may share; repeating the call changes
-    nothing.
-
-    Parameters
-    ----------
-    analysis:
-        The analysis to share.
-    scope:
-        Who to share with. Only your own organisation may be named.
-    """
-    emit_one(settings.client().analyses.share(analysis, scope), FIELDS, as_json=settings.as_json)
-
-
-@app.command(name="unshare")
-def unshare(analysis: str, *, settings: SettingsParam, share: str = "org") -> None:
-    """Revoke one grant on an analysis.
-
-    Only the owner may unshare; repeating the call changes nothing.
-
-    Parameters
-    ----------
-    analysis:
-        The analysis to revoke a grant on.
-    share:
-        Which grant to revoke. `org` names your whole organisation, the only
-        audience an analysis can be shared with today.
-    """
-    settings.client().analyses.unshare(analysis, share)
-    note(f"[dim]{analysis} is no longer shared with {share}[/dim]")
-
-
 @app.command(name="run-again")
 def run_again(
     analysis: str,

{xoople_cli-0.3.0 → xoople_cli-0.5.0}/src/xoople/cli/auth.py

@@ -4,6 +4,8 @@ from xoople.cli import _ciam
 from xoople.cli._context import SettingsParam
 from xoople.cli._errors import LoginFailed
 from xoople.cli._output import emit_one, note
+from xoople.sdk import session as session_file
+from xoople.sdk.auth import normalize_api_url
 
 app = App(
     name="auth",
@@ -21,15 +23,30 @@ class _StatusRow(BaseModel):
     expires_at: int
 
 
+def _bound_api_url(base_url: str | None) -> str | None:
+    """The API a profile may send this session's token to. None binds it to no profile."""
+    if not base_url:
+        return None
+    try:
+        return normalize_api_url(base_url)
+    except ValueError:
+        raise LoginFailed(f"{base_url!r} is not a URL: check --api-url") from None
+
+
 @app.command(name="login")
 def login(*, settings: SettingsParam) -> None:
     """Sign in through the browser and store the session for later commands."""
     config = _ciam.CiamConfig.resolve(
-        settings.credentials.ciam_client_id, settings.credentials.ciam_redirect_uri
+        settings.credentials.ciam_client_id,
+        settings.credentials.ciam_redirect_uri,
+        base_url=settings.credentials.base_url,
+        discover=settings.discover,
     )
+    api_url = _bound_api_url(settings.credentials.base_url)
     note(f"Serving the sign-in callback on {config.redirect_uri}")
     session = settings.login(config, announce=lambda url: note(f"Opening {url}"))
-    path = _ciam.write_session(session)
+    session = session.model_copy(update={"api_url": api_url})
+    path = session_file.write_session(session)
     note(f"Signed in as {session.email or session.client_id}; session stored at {path}")
 
 
@@ -37,7 +54,7 @@ def login(*, settings: SettingsParam) -> None:
 def logout(*, settings: SettingsParam) -> None:
     """Discard the stored session."""
     del settings
-    if _ciam.clear_session():
+    if session_file.clear_session():
         note("Signed out.")
         return
     note("No stored session.")
@@ -46,7 +63,7 @@ def logout(*, settings: SettingsParam) -> None:
 @app.command(name="status")
 def status(*, settings: SettingsParam) -> None:
     """Show who the stored session belongs to, and when it expires."""
-    session = _ciam.read_session()
+    session = session_file.read_session()
     if session is None:
         raise LoginFailed("no stored session: run `xoople auth login`")
     row = _StatusRow(email=session.email, org_id=session.org_id, expires_at=session.expires_at)

{xoople_cli-0.3.0 → xoople_cli-0.5.0}/src/xoople/cli/catalog.py

@@ -32,7 +32,7 @@ def measures(
     product: str | None = None,
     domain: list[str] | None = None,
 ) -> None:
-    """List the bands, indices and contrasts you can request.
+    """List the bands, indices and indicators you can request.
 
     Parameters
     ----------
@@ -58,7 +58,6 @@ def measures(
     )
     for label, items in (
         ("indices", result.indices),
-        ("contrasts", result.contrasts),
         ("indicators", result.indicators),
     ):
         heading(label)

{xoople_cli-0.3.0 → xoople_cli-0.5.0}/src/xoople/cli/main.py

@@ -8,11 +8,13 @@ from xoople.cli import (
     catalog,
     events,
     outputs,
+    packages,
     projects,
     runs,
     schedules,
     usage,
 )
+from xoople.cli._ciam import ClientIdLookup
 from xoople.cli._ciam import login as ciam_login
 from xoople.cli._context import (
     ClientFactory,
@@ -25,14 +27,20 @@ from xoople.cli._errors import USAGE_EXIT, CliError, report
 from xoople.cli._output import note
 from xoople.cli._version import version
 from xoople.sdk import errors
+from xoople.sdk.auth import ciam_discover_client_id
 
 
-def create_app(factory: ClientFactory = build_client, login: LoginRunner = ciam_login) -> App:
+def create_app(
+    factory: ClientFactory = build_client,
+    login: LoginRunner = ciam_login,
+    discover: ClientIdLookup = ciam_discover_client_id,
+) -> App:
     """The command tree, bound to a way of building clients and signing in.
 
     Tests build the tree over a fake transport rather than reaching into module
     globals, so every command runs its real argument parsing and rendering.
-    `login` is the same seam for the sign-in, which opens a browser.
+    `login` is the same seam for the sign-in, which opens a browser, and
+    `discover` for the client ID lookup, which calls the API.
     """
     app = App(
         name="xoople",
@@ -43,6 +51,7 @@ def create_app(factory: ClientFactory = build_client, login: LoginRunner = ciam_
     app.command(projects.app)
     app.command(runs.app)
     app.command(outputs.app)
+    app.command(packages.app)
     app.command(schedules.app)
     app.command(events.app)
     app.command(usage.app)
@@ -55,7 +64,6 @@ def create_app(factory: ClientFactory = build_client, login: LoginRunner = ciam_
         *tokens: Annotated[str, Parameter(show=False, allow_leading_hyphen=True)],
         api_url: Annotated[str | None, Parameter(env_var="XOOPLE_API_URL")] = None,
         token: Annotated[str | None, Parameter(env_var="XOOPLE_TOKEN")] = None,
-        entra_scope: Annotated[str | None, Parameter(env_var="XOOPLE_ENTRA_SCOPE")] = None,
         ciam_client_id: Annotated[str | None, Parameter(env_var="XOOPLE_CIAM_CLIENT_ID")] = None,
         ciam_redirect_uri: Annotated[
             str | None, Parameter(env_var="XOOPLE_CIAM_REDIRECT_URI")
@@ -72,11 +80,9 @@ def create_app(factory: ClientFactory = build_client, login: LoginRunner = ciam_
             Base URL of the Xoople API.
         token:
             Bearer token.
-        entra_scope:
-            Authenticate with Entra ID for this scope instead of a token
-            (internal use; needs the entra extra).
         ciam_client_id:
-            Xoople CIAM client ID, used by `auth login`.
+            Xoople CIAM client ID, used by `auth login`. Without it, the CLI
+            reads the client ID from the API.
         ciam_redirect_uri:
             Loopback URI the browser returns the sign-in to. It must match the
             URI registered for the CIAM client.
@@ -96,7 +102,6 @@ def create_app(factory: ClientFactory = build_client, login: LoginRunner = ciam_
             credentials=Credentials(
                 base_url=api_url,
                 token=token,
-                entra_scope=entra_scope,
                 ciam_client_id=ciam_client_id,
                 ciam_redirect_uri=ciam_redirect_uri,
                 timeout=timeout,
@@ -104,6 +109,7 @@ def create_app(factory: ClientFactory = build_client, login: LoginRunner = ciam_
             ),
             factory=factory,
             login=login,
+            discover=discover,
             as_json=json_output,
         )
         try:

xoople_cli-0.5.0/src/xoople/cli/packages.py

@@ -0,0 +1,114 @@
+from typing import Annotated
+
+from cyclopts import App, Parameter
+from xoople.cli._context import SettingsParam, at_least_one
+from xoople.cli._output import emit, emit_model, note
+
+app = App(
+    name="packages",
+    help="Export an analysis as an immutable Parquet package and mint access links.",
+)
+
+COLUMNS = [
+    ("PACKAGE", "package_id"),
+    ("STATE", "state"),
+    ("VERSION", "delta_version"),
+    ("ROWS", "row_count"),
+    ("CREATED", "create_time"),
+]
+
+
+@app.command(name="create")
+def create(analysis: str, *, settings: SettingsParam) -> None:
+    """Package an analysis's current output, or return the package that already holds it.
+
+    Parameters
+    ----------
+    analysis:
+        The ready analysis to package. Needs its owner and the parquet_packages feature.
+    """
+    emit_model(settings.client().analyses.packages.create(analysis), as_json=settings.as_json)
+
+
+@app.command(name="list")
+def list_packages(
+    analysis: str,
+    *,
+    settings: SettingsParam,
+    limit: Annotated[int | None, Parameter(validator=at_least_one)] = None,
+) -> None:
+    """List an analysis's packages, newest first.
+
+    Parameters
+    ----------
+    analysis:
+        The analysis whose packages to list.
+    limit:
+        Stop after this many, instead of every page.
+    """
+    items = settings.client().analyses.packages.list(analysis, limit=limit)
+    emit(items, COLUMNS, as_json=settings.as_json)
+
+
+@app.command(name="get")
+def get(analysis: str, package: str, *, settings: SettingsParam) -> None:
+    """Show one package and whether it has settled.
+
+    Parameters
+    ----------
+    analysis:
+        The analysis the package belongs to.
+    package:
+        The package to show.
+    """
+    emit_model(settings.client().analyses.packages.get(analysis, package), as_json=settings.as_json)
+
+
+@app.command(name="access-url")
+def access_url(
+    analysis: str,
+    package: str,
+    *,
+    settings: SettingsParam,
+    access_ttl_hours: int | None = None,
+) -> None:
+    """Mint links to a ready package: one zip of it, and its directory.
+
+    `archive_url` downloads the whole package as one zip file. `url` opens the
+    directory; copy it with `azcopy copy "<url>" ./package --recursive`.
+
+    Parameters
+    ----------
+    analysis:
+        The analysis the package belongs to.
+    package:
+        The ready package to mint a link for.
+    access_ttl_hours:
+        How many hours the link stays valid, 1 to 168; the API picks 24.
+    """
+    result = settings.client().analyses.packages.generate_access_url(
+        analysis, package, access_ttl_hours=access_ttl_hours
+    )
+    emit_model(result, as_json=settings.as_json)
+
+
+@app.command(name="delete")
+def delete(analysis: str, package: str, *, settings: SettingsParam) -> None:
+    """Delete a package and its files; the source table and other packages stay.
+
+    Cleanup runs in the background, so the package shows as DELETING until
+    `packages get` reports DELETED. Run this again on a DELETE_FAILED package
+    to retry it.
+
+    Parameters
+    ----------
+    analysis:
+        The analysis the package belongs to.
+    package:
+        The package to delete. Needs its owner; a package still being built cannot be deleted.
+    """
+    result = settings.client().analyses.packages.delete(analysis, package)
+    if result is None:
+        note(f"[dim]{package} is already deleted[/dim]")
+        return
+    emit_model(result, as_json=settings.as_json)

{xoople_cli-0.3.0 → xoople_cli-0.5.0}/src/xoople/cli/projects.py

@@ -98,6 +98,34 @@ def update(
     )
 
 
+MEMBER_COLUMNS = [
+    ("SUBJECT", "subject_id"),
+    ("NAME", "display_name"),
+    ("EMAIL", "email"),
+    ("ROLE", "role"),
+]
+
+
+@app.command(name="members")
+def members(project: str, *, settings: SettingsParam) -> None:
+    """List a project's members and their project role.
+
+    The default project admits every organisation member, so it lists none.
+
+    Parameters
+    ----------
+    project:
+        The project to list.
+    """
+    listed = settings.client().projects.list_members(project)
+    if settings.as_json:
+        emit_model(listed, as_json=True)
+    elif listed.admits_whole_organization:
+        note(f"[dim]Every organisation member belongs to {project}[/dim]")
+    else:
+        emit(listed.members, MEMBER_COLUMNS, as_json=False)
+
+
 @app.command(name="add-member")
 def add_member(project: str, subject_id: str, *, settings: SettingsParam) -> None:
     """Add a subject to a project.
@@ -161,6 +189,22 @@ def archive(project: str, *, settings: SettingsParam) -> None:
     note(f"[dim]{project} is archived[/dim]")
 
 
+@app.command(name="delete")
+def delete(project: str, *, settings: SettingsParam) -> None:
+    """Delete an archived project and remove its stored data.
+
+    The project must hold no analyses. It counts against the project limit
+    until storage removal finishes.
+
+    Parameters
+    ----------
+    project:
+        The archived project to delete.
+    """
+    settings.client().projects.delete(project)
+    note(f"[dim]{project} is deleted; its storage is being removed[/dim]")
+
+
 @app.command(name="record-access")
 def record_access(project: str, *, settings: SettingsParam) -> None:
     """Record that you opened a project, which orders `projects recent`.

xoople_cli-0.3.0/src/xoople/cli/_ciam.py

@@ -1,190 +0,0 @@
-"""The browser half of a CIAM sign-in, and where the session is stored.
-
-The SDK owns the protocol. It holds the endpoints, PKCE, both grants and the
-refresh. This module holds what needs a terminal. It opens a browser, binds the
-loopback port and writes the session file.
-"""
-
-import os
-import secrets
-import tempfile
-import time
-import urllib.parse
-import webbrowser
-from collections.abc import Callable
-from dataclasses import dataclass
-from http.server import BaseHTTPRequestHandler, HTTPServer
-from pathlib import Path
-from typing import Protocol, Self
-
-from pydantic import ValidationError
-from xoople.cli._errors import LoginFailed
-from xoople.sdk.auth import (
-    CiamUserSession,
-    ciam_authorize_url,
-    ciam_exchange_code,
-    ciam_pkce_pair,
-)
-from xoople.sdk.errors import CredentialError
-
-DEFAULT_REDIRECT_URI = "http://localhost:8976/callback"
-"""Fixed, because CIAM matches a redirect URI exactly and must hold this one."""
-
-_CALLBACK_TIMEOUT_SECONDS = 300
-
-_DONE_PAGE = b"<html><body><p>Xoople sign-in is complete. Close this tab.</p></body></html>"
-
-
-class _Listener(Protocol):
-    def __call__(self, redirect_uri: str, timeout: float) -> dict[str, str]: ...
-
-
-class _Exchanger(Protocol):
-    def __call__(self, *, client_id: str, code: str, verifier: str) -> CiamUserSession: ...
-
-
-@dataclass(frozen=True, slots=True)
-class CiamConfig:
-    """What a login needs: the CIAM client and the URI the browser comes back to."""
-
-    client_id: str
-    redirect_uri: str = DEFAULT_REDIRECT_URI
-
-    @classmethod
-    def resolve(cls, client_id: str | None, redirect_uri: str | None) -> Self:
-        if not client_id:
-            raise LoginFailed("no CIAM client: pass --ciam-client-id or set XOOPLE_CIAM_CLIENT_ID")
-        return cls(client_id=client_id, redirect_uri=redirect_uri or DEFAULT_REDIRECT_URI)
-
-
-def session_path() -> Path:
-    """Where the session file lives, honouring `XDG_CONFIG_HOME`."""
-    root = os.environ.get("XDG_CONFIG_HOME")
-    base = Path(root) if root else Path.home() / ".config"
-    return base / "xoople" / "session.json"
-
-
-def read_session(path: Path | None = None) -> CiamUserSession | None:
-    """The stored session, or None when there is none this CLI can read."""
-    target = path or session_path()
-    try:
-        raw = target.read_bytes()
-    except OSError:
-        return None
-    try:
-        return CiamUserSession.model_validate_json(raw)
-    except ValidationError:
-        return None
-
-
-def write_session(session: CiamUserSession, path: Path | None = None) -> Path:
-    """Store the session so only this user can read it.
-
-    The mode argument of `os.open` applies to a new file only, so a rewrite of
-    an existing permissive file would keep its mode. This writes a private
-    temporary file and renames it over the target.
-    """
-    target = path or session_path()
-    target.parent.mkdir(parents=True, exist_ok=True)
-    handle, temporary = tempfile.mkstemp(dir=target.parent, prefix=".session-")
-    try:
-        os.fchmod(handle, 0o600)
-        with os.fdopen(handle, "w", encoding="utf-8") as stream:
-            stream.write(session.model_dump_json())
-        # Rename is atomic within one directory, so a reader never sees a
-        # half-written session.
-        os.replace(temporary, target)
-    except BaseException:
-        Path(temporary).unlink(missing_ok=True)
-        raise
-    return target
-
-
-def clear_session(path: Path | None = None) -> bool:
-    """Remove the stored session. False when there was nothing to remove."""
-    target = path or session_path()
-    try:
-        target.unlink()
-    except OSError:
-        return False
-    return True
-
-
-class _CallbackHandler(BaseHTTPRequestHandler):
-    """Reads the query off one browser redirect and answers with a closing page."""
-
-    captured: dict[str, str]
-    callback_path: str
-
-    def do_GET(self) -> None:
-        parsed = urllib.parse.urlsplit(self.path)
-        if parsed.path != self.callback_path:
-            self.send_error(404)
-            return
-        for key, values in urllib.parse.parse_qs(parsed.query).items():
-            self.captured[key] = values[0]
-        self.send_response(200)
-        self.send_header("Content-Type", "text/html; charset=utf-8")
-        self.send_header("Content-Length", str(len(_DONE_PAGE)))
-        self.end_headers()
-        self.wfile.write(_DONE_PAGE)
-
-    def log_message(self, format: str, *args: object) -> None:
-        del format, args  # The server must not write to the CLI's streams.
-
-
-def await_callback(redirect_uri: str, timeout: float) -> dict[str, str]:
-    """Serve the redirect URI until the browser returns, and give back its query."""
-    parsed = urllib.parse.urlsplit(redirect_uri)
-    if parsed.hostname is None or parsed.port is None:
-        raise LoginFailed(f"redirect URI needs an explicit host and port: {redirect_uri}")
-    captured: dict[str, str] = {}
-    handler = type(
-        "_BoundCallbackHandler",
-        (_CallbackHandler,),
-        {"captured": captured, "callback_path": parsed.path or "/"},
-    )
-    deadline = time.monotonic() + timeout
-    with HTTPServer((parsed.hostname, parsed.port), handler) as server:
-        # A browser also asks for /favicon.ico, so serve until the callback lands.
-        while not captured and time.monotonic() < deadline:
-            server.timeout = max(1.0, deadline - time.monotonic())
-            server.handle_request()
-    if not captured:
-        raise LoginFailed("the browser did not return a sign-in result in time")
-    return captured
-
-
-def login(
-    config: CiamConfig,
-    *,
-    announce: Callable[[str], None],
-    listener: _Listener = await_callback,
-    open_browser: Callable[[str], bool] = webbrowser.open,
-    exchange: _Exchanger = ciam_exchange_code,
-    callback_timeout: float = _CALLBACK_TIMEOUT_SECONDS,
-) -> CiamUserSession:
-    """Run one browser login and return the session it produced."""
-    verifier, challenge = ciam_pkce_pair()
-    state = secrets.token_urlsafe(16)
-    url = ciam_authorize_url(
-        client_id=config.client_id,
-        redirect_uri=config.redirect_uri,
-        challenge=challenge,
-        state=state,
-    )
-    announce(url)
-    open_browser(url)
-    captured = listener(config.redirect_uri, callback_timeout)
-    if "error" in captured:
-        raise LoginFailed(f"CIAM refused the sign-in: {captured['error']}")
-    if captured.get("state") != state:
-        raise LoginFailed("the sign-in result does not match this request")
-    code = captured.get("code")
-    if not code:
-        raise LoginFailed("the sign-in result carries no authorization code")
-    try:
-        return exchange(client_id=config.client_id, code=code, verifier=verifier)
-    except CredentialError as exc:
-        # One exit code covers every sign-in failure. The SDK message says which.
-        raise LoginFailed(str(exc)) from None