zen-cli 0.1.5__tar.gz → 0.1.6__tar.gz

{zen_cli-0.1.5 → zen_cli-0.1.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: zen-cli
-Version: 0.1.5
+Version: 0.1.6
 Summary: CLI for Zen Desktop Service. Designed for AI and Human.
 Project-URL: Homepage, https://pypi.org/project/zen-cli/
 Author: zen-cli authors

{zen_cli-0.1.5 → zen_cli-0.1.6}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "zen-cli"
-version = "0.1.5"
+version = "0.1.6"
 description = "CLI for Zen Desktop Service. Designed for AI and Human."
 readme = "README.md"
 license = "MIT"

{zen_cli-0.1.5 → zen_cli-0.1.6}/src/zen_cli/sglib/auth.py

@@ -54,6 +54,8 @@ def refresh_oauth_token(
     refresh_token = old_oauth_token.get("refresh_token")
     if not refresh_token:
         raise Exception("CSP auth refresh failed: missing refresh_token")
+    if not client_id:
+        client_id = old_oauth_token.get("client_id")
     if not client_id:
         from .login_support import identify_client_id
 
@@ -64,16 +66,23 @@ def refresh_oauth_token(
         "refresh_token": refresh_token,
         "client_id": client_id,
     }
+    post_kwargs: dict[str, Any] = {
+        "headers": {"Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json"},
+        "timeout": 20,
+    }
     if client_secret:
         data["client_secret"] = client_secret
-    resp = httpx2.post(
-        url,
-        data=data,
-        auth=(client_id, client_secret or ""),
-        headers={"Content-Type": "application/x-www-form-urlencoded"},
-        timeout=20,
-    )
-    resp.raise_for_status()
+        # Confidential clients only. Native/device apps are OIDC_AUTH_METHOD_TYPE_NONE;
+        # HTTP Basic with an empty secret makes ZITADEL reject the refresh as invalid_client.
+        post_kwargs["auth"] = (client_id, client_secret)
+    resp = httpx2.post(url, data=data, **post_kwargs)
+    if not resp.is_success:
+        try:
+            body = resp.json()
+            desc = body.get("error_description") or body.get("error") or resp.text
+        except Exception:
+            desc = resp.text or str(resp.status_code)
+        raise Exception(f"CSP auth refresh failed: {desc}")
     new_token = resp.json()
     log.debug(f"New auth token: {new_token}")
     if not new_token or not new_token.get("access_token"):
@@ -193,7 +202,7 @@ def _populate_token_with_cache(auth_config: Any, force_refresh: bool = False, ve
                     print("Provider: csp.")
                 try:
                     csp_url = _cfg_get(auth_config, "url")
-                    client_id = _cfg_get(auth_config, "clientId", "client_id")
+                    client_id = token.get("client_id") or _cfg_get(auth_config, "clientId", "client_id")
                     if not client_id and _cfg_get(auth_config, "device"):
                         from .login_support import identify_device_client_id
 
@@ -205,7 +214,7 @@ def _populate_token_with_cache(auth_config: Any, force_refresh: bool = False, ve
                         client_secret=_cfg_get(auth_config, "clientSecret", "client_secret"),
                     )
                 except Exception as e:
-                    log.debug(f"Failed to refresh OAuth token: {e}")
+                    log.warning("Failed to refresh OAuth token: %s", e)
                     token = None
             else:
                 if verbose:

{zen_cli-0.1.5 → zen_cli-0.1.6}/src/zen_cli/sglib/login_support.py

@@ -205,6 +205,8 @@ def do_oauth2_pkce(csp_url: str, client_id: str, org_id: str) -> Any:
     )
 
     log.debug("token: %s", token)
+    if isinstance(token, dict):
+        token.setdefault("client_id", client_id)
     return token
 
 
@@ -295,6 +297,7 @@ def poll_device_access_token(
             token = resp.json()
             if not isinstance(token, dict) or not token.get("access_token"):
                 raise CtxpException("Device-code login failed: token response had no access_token.")
+            token.setdefault("client_id", client_id)
             return token
         err, desc = _oauth_error(resp)
         if err == "authorization_pending":

{zen_cli-0.1.5 → zen_cli-0.1.6}/tests/test_device_login.py

@@ -5,7 +5,7 @@ from unittest.mock import patch
 
 from zen_cli.cmds.login import _is_missing_session, _validate_auth_method
 from zen_cli.ctxp import CtxpException
-from zen_cli.sglib.auth import get_org_id_from_token, jwt_from_oauth_token
+from zen_cli.sglib.auth import get_org_id_from_token, jwt_from_oauth_token, refresh_oauth_token
 from zen_cli.sglib.login_support import (
     _device_scope,
     identify_daas_project_id,
@@ -109,6 +109,48 @@ class TestDeviceLogin(unittest.TestCase):
             poll_device_access_token("https://csp.example", "dc", interval=1, expires_in=30)
         self.assertIn("denied", str(ctx.exception).lower())
 
+    def test_public_client_refresh_does_not_send_http_basic(self) -> None:
+        captured: dict[str, object] = {}
+
+        def fake_post(url: str, **kwargs: object) -> _Resp:
+            captured["url"] = url
+            captured["data"] = kwargs.get("data")
+            captured["auth"] = kwargs.get("auth")
+            return _Resp(200, {"access_token": "new", "refresh_token": "rt2", "expires_in": 60})
+
+        with patch("httpx2.post", fake_post):
+            token = refresh_oauth_token(
+                {"refresh_token": "rt1", "client_id": "391271953115120140"},
+                "https://csp.example",
+                client_id="391271953115120140",
+            )
+        self.assertEqual(token["access_token"], "new")
+        self.assertIsNone(captured.get("auth"))
+        self.assertEqual(
+            captured.get("data"),
+            {
+                "grant_type": "refresh_token",
+                "refresh_token": "rt1",
+                "client_id": "391271953115120140",
+            },
+        )
+
+    def test_refresh_uses_client_id_stamped_on_token(self) -> None:
+        captured: dict[str, object] = {}
+
+        def fake_post(_url: str, **kwargs: object) -> _Resp:
+            captured["data"] = kwargs.get("data")
+            return _Resp(200, {"access_token": "new", "expires_in": 60})
+
+        with patch("httpx2.post", fake_post):
+            refresh_oauth_token(
+                {"refresh_token": "rt1", "client_id": "391271953115120140"},
+                "https://csp.example",
+            )
+        data = captured.get("data")
+        assert isinstance(data, dict)
+        self.assertEqual(data.get("client_id"), "391271953115120140")
+
     def test_org_id_from_opaque_access_and_id_token(self) -> None:
         oauth = {
             "access_token": "opaque-not-a-jwt",