fix: deliver the device-login token after approval

The poll wrote the session with a low-level DynamoDB transaction whose keys were plain strings. The live client rejects those before the request is sent, so the browser can show Device authorized while the CLI never receives a token. Retry with AttributeValues, and include status=approved so an older CLI that waits for that field accepts the session. A new login replaces the stored account, and logout clears a browser session too.

Author: alexeygrigorev

src/dapier/auth/device_sessions.py

@@ -41,6 +41,9 @@
 import time
 from datetime import datetime, timezone
 
+from boto3.dynamodb.types import TypeSerializer
+from botocore.exceptions import ParamValidationError
+
 PREFIX = "dapd_"
 # No vowels and no confusable characters (no L/V, no 0/1): codes are read
 # aloud and retyped by hand, and must never spell a word. This is dakit's
@@ -56,6 +59,43 @@
 # Grace window for the rotated-out token after a refresh, so a CLI that
 # races itself (or two processes sharing a session file) is not locked out.
 ROTATION_GRACE_SECONDS = 120
+_SERIALIZER = TypeSerializer()
+
+
+def _typed_map(mapping):
+    """Low-level AttributeValues. The DynamoDB client rejects the plain
+    values the resource API accepts."""
+    return {key: _SERIALIZER.serialize(value) for key, value in mapping.items()}
+
+
+def _low_level_transact(items):
+    """The same TransactItems in the shape ``transact_write_items`` validates."""
+    converted = []
+    for entry in items:
+        (op, spec), = entry.items()
+        spec = dict(spec)
+        if "Key" in spec:
+            spec["Key"] = _typed_map(spec["Key"])
+        if "Item" in spec:
+            spec["Item"] = _typed_map(spec["Item"])
+        if spec.get("ExpressionAttributeValues"):
+            spec["ExpressionAttributeValues"] = _typed_map(spec["ExpressionAttributeValues"])
+        converted.append({op: spec})
+    return converted
+
+
+def _commit_delivery(store, items):
+    """Commit the delivery transaction.
+
+    Moto accepts the resource-shaped items the rest of this module writes.
+    The real client rejects them during parameter validation, before
+    DynamoDB runs, which is why an approved device never produced a token.
+    On that rejection, send the low-level attribute values.
+    """
+    try:
+        store.meta.client.transact_write_items(TransactItems=items)
+    except ParamValidationError:
+        store.meta.client.transact_write_items(TransactItems=_low_level_transact(items))
 
 
 def table():
@@ -367,7 +407,7 @@ def poll(device_code, table_ref=None):
     expires_at = int(time.time()) + SESSION_TTL_SECONDS
     now = int(time.time())
     try:
-        store.meta.client.transact_write_items(TransactItems=[
+        _commit_delivery(store, [
             {"Delete": {
                 "TableName": store.name,
                 "Key": key,
@@ -399,6 +439,10 @@ def poll(device_code, table_ref=None):
     # removed the user-code pointer.)
     return {
         "token": token,
+        # ``status`` is what CLIs that predate the shared poll loop look
+        # for on a 200. Without it they ignore the token and wait out the
+        # code. The shared loop treats any 200 without ``error`` as success.
+        "status": "approved",
         "subject": pairing.get("subject", ""),
         "email": pairing.get("email", ""),
         "expires_at": expires_at,

tests/test_cli.py

@@ -91,6 +91,45 @@ def poster(url, body, bearer=None, timeout=20):
     return poster, calls
 
 
+def test_login_device_replaces_the_stored_account(isolated_home, monkeypatch):
+    """A new device login is the stored identity. The previous account
+    does not stay behind just because its session file already exists."""
+    config.save_session({
+        "id_token": "alexey-token", "subject": "Google_alexey",
+        "email": "alexey@datatalks.club", "expires_at": 4102444800, "obtained_at": 1,
+    })
+    poster, _ = device_poster({
+        "/device/start": (200, {"device_code": "dapd_secret", "user_code": "TQ62-SD46",
+                                "expires_in": 900, "interval": 5}),
+        "/device/token": (200, {"token": "dapd_orin", "status": "approved",
+                                "subject": "Google_orin", "email": "orin@datatalks.club",
+                                "expires_at": 4102444800}),
+    })
+    monkeypatch.setattr(auth, "_post_json", poster)
+
+    session = auth.login_device("https://api.example.test/", sleeper=lambda seconds: None)
+
+    stored = config.load_session()
+    assert stored["email"] == "orin@datatalks.club"
+    assert stored["token"] == "dapd_orin"
+    assert stored is not None and "alexey-token" not in json.dumps(stored)
+    assert session["email"] == "orin@datatalks.club"
+
+
+def test_logout_forgets_a_browser_session(isolated_home, monkeypatch):
+    config.save_session({
+        "id_token": "alexey-token", "subject": "Google_alexey",
+        "email": "alexey@datatalks.club", "expires_at": 4102444800, "obtained_at": 1,
+    })
+    monkeypatch.setattr(auth, "revoke_session", lambda api_url, session: None)
+
+    import argparse
+    code = cli_auth.run(argparse.Namespace(command="logout"), "https://api.example.test")
+
+    assert code == 0
+    assert config.load_session() is None
+
+
 def test_login_device_happy_path(isolated_home, monkeypatch, capsys):
     poster, calls = device_poster({
         "/device/start": (200, {"device_code": "dapd_secret", "user_code": "ABCD-EFGH",

tests/test_device_delivery.py

@@ -106,6 +106,57 @@ def test_no_plaintext_code_or_bearer_is_ever_stored(store):
 
 # --- M7: one delivery, losers write nothing ------------------------------------
 
+def test_winning_poll_retries_with_low_level_attribute_values(store):
+    """The real DynamoDB client rejects resource-shaped transaction items.
+
+    That rejection happens before the request is sent, so the approval is
+    already stored, the browser says the device is authorized, and the CLI
+    never receives a token. The retry must be the low-level shape the
+    client validates.
+    """
+    from boto3.dynamodb.types import TypeDeserializer
+    from botocore.exceptions import ParamValidationError
+    from botocore.validate import ParamValidator
+
+    device_code, _ = approved(store)
+    client = store.meta.client
+    seen = []
+    original = client.transact_write_items
+    decoder = TypeDeserializer()
+
+    def spy(*args, **kwargs):
+        seen.append(kwargs)
+        key = kwargs["TransactItems"][0]["Delete"]["Key"]["pk"]
+        if isinstance(key, str):
+            raise ParamValidationError(report="plain values are not AttributeValues")
+        # Moto's transaction backend cannot use the low-level key as a dict
+        # key. Apply the committed effect the way DynamoDB would, after the
+        # payload has passed the same validator the client uses.
+        shape = client.meta.service_model.operation_model("TransactWriteItems").input_shape
+        report = ParamValidator().validate(kwargs, shape)
+        assert not report.has_errors(), report.generate_report()
+        pairing_key = decoder.deserialize(key)
+        item = {name: decoder.deserialize(value)
+                for name, value in kwargs["TransactItems"][1]["Put"]["Item"].items()}
+        store.delete_item(Key={"pk": pairing_key})
+        store.put_item(Item=item)
+        return {}
+
+    client.transact_write_items = spy
+    result = d.poll(device_code, table_ref=store)
+
+    assert result["status"] == "approved"
+    assert result["email"]
+    assert d.resolve(result["token"], table_ref=store)["subject"] == result["subject"]
+    assert len(seen) == 2
+    assert isinstance(seen[0]["TransactItems"][0]["Delete"]["Key"]["pk"], str)
+    delete = seen[1]["TransactItems"][0]["Delete"]
+    assert delete["Key"]["pk"]["S"].startswith("pairing#")
+    assert delete["ExpressionAttributeValues"][":approved"] == {"S": "approved"}
+    assert "N" in delete["ExpressionAttributeValues"][":now"]
+    assert original  # the resource client remains what moto tests call first
+
+
 def test_sequential_polls_deliver_once(store):
     device_code, _ = approved(store)
     first = d.poll(device_code, table_ref=store)