From feb19d01685586769754bacd85e0e81d909f9107 Mon Sep 17 00:00:00 2001 From: tejas Date: Thu, 30 Jul 2026 14:44:04 +0200 Subject: [PATCH 1/2] fix redudant login prompt from eozilla app --- CHANGES.md | 6 ++++++ cuiman/src/cuiman/app/service.py | 26 ++++++++++++++++++++--- cuiman/tests/app/test_service.py | 36 +++++++++++++++++++++++--------- 3 files changed, 55 insertions(+), 13 deletions(-) diff --git a/CHANGES.md b/CHANGES.md index 73dac3d4..bd18943c 100644 --- a/CHANGES.md +++ b/CHANGES.md @@ -46,6 +46,12 @@ no longer read the developer's real `~/.eozilla/config`, which could inject a logged-in token into the request headers and fail the assertion that an unauthenticated client sends none. (#167) +- Fixed `client.show_app()` forcing a redundant interactive OAuth2/PKCE login + in the app GUI even when the Python client had already authenticated + (`auth_type="login"` with a resolved token). The client config bridge in + `cuiman.app.service` now forwards an already-authenticated `"login"` config + to the app as `auth_type="token"`, so the app connects immediately using + the existing bearer token instead of discarding it and re-prompting. ### Other changes diff --git a/cuiman/src/cuiman/app/service.py b/cuiman/src/cuiman/app/service.py index 313947f8..348a20f4 100644 --- a/cuiman/src/cuiman/app/service.py +++ b/cuiman/src/cuiman/app/service.py @@ -68,15 +68,33 @@ def create_app_service_provider(client_config: ClientConfig) -> ServiceProvider: } +def _effective_auth_type(client_config: ClientConfig) -> str: + """ + Resolve the auth type to forward to the app. + + ``"login"`` means the *Python* client performs a username/password login + to obtain a token. By the time this is called (e.g. from ``show_app()``), + that login has already happened and ``client_config.token`` holds a + resolved access token — the app doesn't need to (and can't) repeat that + login. Forwarding ``auth_type="login"`` verbatim makes the app treat it + like an interactive OAuth2/PKCE login, discarding the already-valid + token and forcing a redundant sign-in. Once a token is resolved, forward + it as ``"token"`` instead, so the app connects immediately. + """ + auth_type = client_config.auth_type or "none" + if auth_type == "login" and client_config.token: + return "token" + return auth_type + + def _config_to_service_options(client_config: ClientConfig) -> dict[str, Any]: """ Convert a ClientConfig object to a JSON-serializable dict, which includes only keywords applicable to the given ``auth_config.auth_type``. """ auth_keys = set(AuthConfig.model_fields.keys()) - applicable_auth_keys = _AUTH_TYPE_TO_APPLICABLE_KEYS[ - client_config.auth_type or "none" - ] + effective_auth_type = _effective_auth_type(client_config) + applicable_auth_keys = _AUTH_TYPE_TO_APPLICABLE_KEYS[effective_auth_type] auth_config_dict = { k: v for k, v in client_config.model_dump( @@ -85,6 +103,8 @@ def _config_to_service_options(client_config: ClientConfig) -> dict[str, Any]: ).items() if k not in auth_keys or k in applicable_auth_keys } + if "auth_type" in auth_config_dict: + auth_config_dict["auth_type"] = effective_auth_type # Additional cleanup if "token_header" in auth_config_dict and client_config.use_bearer: del auth_config_dict["token_header"] diff --git a/cuiman/tests/app/test_service.py b/cuiman/tests/app/test_service.py index 1364beef..bf49a2f5 100644 --- a/cuiman/tests/app/test_service.py +++ b/cuiman/tests/app/test_service.py @@ -121,18 +121,13 @@ def test_create_app_service_provider(): }, { "apiUrl": "https://process.example.test/api", - "authType": "login", + "authType": "token", "authUrl": "https://auth.example.test/auth", - "grantType": "client_credentials", - "username": "user", - "password": "secret", "token": "token-123", "refreshToken": "refresh-123", - "clientId": "client-id", - "clientSecret": "client-secret", "useBearer": True, }, - id="login-bearer-removes-token-header", + id="login-with-resolved-token-forwards-as-token-removes-token-header", ), pytest.param( { @@ -145,14 +140,35 @@ def test_create_app_service_provider(): }, { "apiUrl": "https://process.example.test/api", - "authType": "login", + "authType": "token", "authUrl": "https://auth.example.test/auth", - "grantType": "password", "token": "token-123", "useBearer": False, "tokenHeader": "X-Custom-Token", }, - id="login-custom-header-keeps-token-header", + id="login-with-resolved-token-and-custom-header-forwards-as-token", + ), + pytest.param( + { + "api_url": "https://process.example.test/api", + "auth_type": "login", + "auth_url": "https://auth.example.test/auth", + "username": "user", + "password": "secret", + "client_id": "client-id", + "grant_type": "password", + }, + { + "apiUrl": "https://process.example.test/api", + "authType": "login", + "authUrl": "https://auth.example.test/auth", + "grantType": "password", + "username": "user", + "password": "secret", + "clientId": "client-id", + "useBearer": True, + }, + id="login-without-resolved-token-keeps-login", ), pytest.param( { From 122baa354caf43ebfedb498effe6a46b73fbbfad Mon Sep 17 00:00:00 2001 From: tejas Date: Thu, 30 Jul 2026 15:40:01 +0200 Subject: [PATCH 2/2] updated change log --- CHANGES.md | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/CHANGES.md b/CHANGES.md index bd18943c..fa9dcd3d 100644 --- a/CHANGES.md +++ b/CHANGES.md @@ -1,3 +1,14 @@ +## Changes in version 0.2.1 (in development) + +### Fixes + +- Fixed `client.show_app()` forcing a redundant interactive OAuth2/PKCE login + in the app GUI even when the Python client had already authenticated + (`auth_type="login"` with a resolved token). The client config bridge in + `cuiman.app.service` now forwards an already-authenticated `"login"` config + to the app as `auth_type="token"`, so the app connects immediately using + the existing bearer token instead of discarding it and re-prompting. + ## Changes in version 0.2.0 ### Enchancements @@ -46,12 +57,6 @@ no longer read the developer's real `~/.eozilla/config`, which could inject a logged-in token into the request headers and fail the assertion that an unauthenticated client sends none. (#167) -- Fixed `client.show_app()` forcing a redundant interactive OAuth2/PKCE login - in the app GUI even when the Python client had already authenticated - (`auth_type="login"` with a resolved token). The client config bridge in - `cuiman.app.service` now forwards an already-authenticated `"login"` config - to the app as `auth_type="token"`, so the app connects immediately using - the existing bearer token instead of discarding it and re-prompting. ### Other changes