login

Author: echarles

datalayer_core/authn/server/http_server.py

@@ -46,6 +46,20 @@
 logger = logging.getLogger(__name__)
 
 
+def _normalize_navigation_target(candidate: str | None) -> str | None:
+    if candidate is None:
+        return None
+    value = str(candidate).strip()
+    if not value:
+        return None
+    parsed = urllib.parse.urlparse(value)
+    if parsed.scheme or parsed.netloc:
+        return None
+    if not value.startswith("/") or value.startswith("//"):
+        return None
+    return value
+
+
 class LoginRequestHandler(SimpleHTTPRequestHandler):
     """
     Handle HTTP requests for authentication flow.
@@ -83,22 +97,46 @@ def _save_token(self, query: str) -> None:
 
         user_raw = arguments.get("user", [""])[0]
         token = arguments.get("token", [""])[0]
+        navigation_candidate = (
+            arguments.get("navigate_to", [""])[0]
+            or arguments.get("navigation", [""])[0]
+            or arguments.get("post_auth_redirect", [""])[0]
+            or arguments.get("redirect_url", [""])[0]
+        )
+        navigation_target = _normalize_navigation_target(navigation_candidate)
 
         if not user_raw or not token:
             self.send_error(HTTPStatus.BAD_REQUEST, "User and token must be provided.")
 
         user = json.loads(urllib.parse.unquote(user_raw))
-        content = AUTH_SUCCESS_PAGE.format(
-            user_key=DATALAYER_IAM_USER_KEY,
-            uid=user.get("uid"),
-            handle=user["handle_s"],
-            first_name=user["first_name_t"],
-            last_name=user["last_name_t"],
-            email=user["email_s"],
-            display_name=" ".join((user["first_name_t"], user["last_name_t"])).strip(),
-            token_key=DATALAYER_IAM_TOKEN_KEY,
-            token=token,
-            base_url="/",
+        content = (
+            AUTH_SUCCESS_PAGE
+            .replace("__USER_KEY__", DATALAYER_IAM_USER_KEY)
+            .replace("__TOKEN_KEY__", DATALAYER_IAM_TOKEN_KEY)
+            .replace("__UID_JSON__", json.dumps(user.get("uid", "")))
+            .replace("__HANDLE_JSON__", json.dumps(user.get("handle_s", "")))
+            .replace(
+                "__FIRST_NAME_JSON__", json.dumps(user.get("first_name_t", ""))
+            )
+            .replace(
+                "__LAST_NAME_JSON__", json.dumps(user.get("last_name_t", ""))
+            )
+            .replace("__EMAIL_JSON__", json.dumps(user.get("email_s", "")))
+            .replace(
+                "__DISPLAY_NAME_JSON__",
+                json.dumps(
+                    " ".join(
+                        (
+                            user.get("first_name_t", ""),
+                            user.get("last_name_t", ""),
+                        )
+                    ).strip()
+                ),
+            )
+            .replace("__TOKEN_JSON__", json.dumps(token))
+            .replace(
+                "__NAVIGATION_TARGET_JSON__", json.dumps(navigation_target or "")
+            )
         ).encode("UTF-8", "replace")
         self.send_response(HTTPStatus.OK)
         self.send_header("Content-type", "text/html")
@@ -112,14 +150,15 @@ def do_GET(self) -> None:
         if path.strip("/").endswith("callback"):
             self._save_token(query)
         elif path in {"/", "/datalayer/login/cli"}:
-            content = LANDING_PAGE.format(
-                config=json.dumps(
-                    {
-                        "runUrl": self.server.run_url,  # type: ignore
-                        "iamRunUrl": self.server.iam_url,  # type: ignore
-                        "whiteLabel": False,
-                    }
-                )
+            config_json = json.dumps(
+                {
+                    "runUrl": self.server.run_url,  # type: ignore
+                    "iamRunUrl": self.server.iam_url,  # type: ignore
+                    "whiteLabel": False,
+                }
+            )
+            content = LANDING_PAGE.replace(
+                "__DATALAYER_CONFIG_JSON__", config_json
             ).encode("UTF-8", "replace")
             self.send_response(HTTPStatus.OK)
             self.send_header("Content-type", "text/html")
@@ -203,16 +242,6 @@ def __init__(
         bind_and_activate : bool, default True
             Whether to bind and activate the server.
         """
-        try:
-            import datalayer_ui  # noqa: F401
-        except Exception:
-            print("Sorry, I can not show the login page...")
-            print(
-                "Check the datalayer_ui python package is available in your environment"
-            )
-            import sys
-
-            sys.exit(-1)
         # Use DatalayerURLs for proper URL configuration
         self._urls = DatalayerURLs.from_environment(run_url=run_url)
         self.run_url = self._urls.run_url
@@ -246,14 +275,12 @@ def finish_request(self, request: t.Any, client_address: str) -> None:
         client_address : str
             The client address.
         """
-        import datalayer_ui
-
-        DATALAYER_UI_PATH = Path(datalayer_ui.__file__).parent
+        datalayer_core_static_path = HERE.parent.parent / "static"
         self.RequestHandlerClass(
             request,
             client_address,
             self,  # type: ignore[arg-type]
-            directory=str(DATALAYER_UI_PATH / "static"),  # type: ignore[call-arg]
+            directory=str(datalayer_core_static_path),  # type: ignore[call-arg]
         )
 
 

datalayer_core/authn/server/pages.py

@@ -11,39 +11,120 @@
     <meta charset="UTF-8"/>
     <title>🪐 ⚪ Datalayer Login</title>
     <script id="datalayer-config-data" type="application/json">
-      {config}
+      __DATALAYER_CONFIG_JSON__
     </script>
     <link rel="shortcut icon" href="data:image/x-icon;base64,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAABHNCSVQICAgIfAhkiAAAAAlwSFlzAAAN1wAADdcBQiibeAAAABl0RVh0U29mdHdhcmUAd3d3Lmlua3NjYXBlLm9yZ5vuPBoAAAC7SURBVFiF7ZU9CgIxEIXfTHbPopfYc+pJ9AALtmJnZSOIoJWFoCTzLHazxh/Ebpt5EPIxM8XXTCKTxYyMCYwJFhOYCo4JFiMuu317PZwaqEBUIar4YMmskL73DytGjgu4gAt4PDJdzkkzMBloBhqBgcu69XW+1I+rNSQESNDuaMEhdP/Fj/7oW+ACLuACHk/3F5BAfuMLBjm8/ZnxNvNtHmY4b7Ztut0bqStoVSHfWj9Z6mr8LXABF3CBB3nvkDfEVN6PAAAAAElFTkSuQmCC" type="image/x-icon" />
-    <script defer src="/cli.datalayer-ui.js"></script>
+    <link rel="stylesheet" href="/core.css" />
+    <script>
+      globalThis.process = globalThis.process || { env: { NODE_ENV: 'production' } };
+    </script>
+    <script defer src="/cli.datalayer-core.js"></script>
   </head>
   <body>
+    <div id="root"></div>
   </body>
 </html>"""
 
 
 AUTH_SUCCESS_PAGE = """<!DOCTYPE html>
 <html>
   <head>
+    <meta charset="utf-8" />
+    <title>Datalayer CLI Login</title>
+    <style>
+      body {
+        margin: 0;
+        min-height: 100vh;
+        display: flex;
+        align-items: center;
+        justify-content: center;
+        font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif;
+        background: #f6f8fa;
+        color: #1f2328;
+      }
+      .card {
+        width: min(560px, calc(100vw - 32px));
+        border: 1px solid #d0d7de;
+        border-radius: 12px;
+        background: #ffffff;
+        box-shadow: 0 8px 24px rgba(140, 149, 159, 0.2);
+        padding: 24px;
+      }
+      h2 {
+        margin: 0 0 8px;
+        font-size: 20px;
+      }
+      p {
+        margin: 0;
+        color: #57606a;
+      }
+      .muted {
+        margin-top: 12px;
+        font-size: 13px;
+      }
+    </style>
     <script type="module">
-      // Store the user information
-      window.localStorage.setItem(
-        '{user_key}',
-        JSON.stringify({{
-          uid: '{uid}',
-          handle: '{handle}',
-          firstName: '{first_name}',
-          lastName: '{last_name}',
-          email: '{email}',
-          displayName: '{display_name}'
-        }})
-      );
-      // Store the token.
-      localStorage.setItem('{token_key}', '{token}');
-      // Redirect to login page.
-      window.location.pathname = '/datalayer/login/cli';
+      const user = {
+        uid: __UID_JSON__,
+        handle: __HANDLE_JSON__,
+        firstName: __FIRST_NAME_JSON__,
+        lastName: __LAST_NAME_JSON__,
+        email: __EMAIL_JSON__,
+        displayName: __DISPLAY_NAME_JSON__,
+      };
+      const token = __TOKEN_JSON__;
+      const userHandle = __HANDLE_JSON__ || '';
+      const navigationTarget = __NAVIGATION_TARGET_JSON__;
+
+      window.localStorage.setItem('__USER_KEY__', JSON.stringify(user));
+      window.localStorage.setItem('__TOKEN_KEY__', token);
+
+      const statusNode = document.getElementById('status');
+      const detailsNode = document.getElementById('details');
+      const whoAmINode = document.getElementById('whoami');
+
+      if (whoAmINode) {
+        whoAmINode.textContent = `Authenticated as ${userHandle || 'unknown'}.`;
+      }
+
+      const setStatus = (title, details) => {
+        if (statusNode) statusNode.textContent = title;
+        if (detailsNode) detailsNode.textContent = details;
+      };
+
+      const finalize = async () => {
+        await fetch('/', {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({
+            user_handle: userHandle,
+            token,
+          }),
+        });
+      };
+
+      if (navigationTarget) {
+        finalize()
+          .then(() => {
+            setStatus('Authentication successful', 'Redirecting to your requested page...');
+            window.location.replace(navigationTarget);
+          })
+          .catch((error) => {
+            console.error('Failed to finalize CLI authentication.', error);
+            setStatus('Authentication succeeded, but CLI finalization failed', 'You can retry login from your terminal.');
+          });
+      } else {
+        setStatus('Authentication successful', 'Redirecting to the CLI confirmation page...');
+        window.location.replace('/');
+      }
     </script>
   </head>
   <body>
+    <main class="card">
+      <h2 id="status">Finalizing authentication...</h2>
+      <p id="details">Please wait while we complete your CLI sign-in.</p>
+      <p class="muted" id="whoami"></p>
+    </main>
   </body>
 </html>"""
 

datalayer_core/cli/commands/authn.py

@@ -220,9 +220,11 @@ def login(
                 console.print("[yellow]CLI-only authentication selected[/yellow]")
                 credentials = _ask_credentials()
 
-                if credentials.get("credentials_type") == "token":
+                if credentials.get("credentials_type") == "api_key":
                     asyncio.run(
-                        _login_with_token(auth, credentials["token"], urls.run_url)
+                        _login_with_api_key(
+                            auth, credentials["api_key"], urls.run_url
+                        )
                     )
                 else:
                     asyncio.run(
@@ -236,7 +238,7 @@ def login(
             else:
                 # Browser-based OAuth
                 console.print(
-                    "[yellow]No token found. Starting browser-based authentication...[/yellow]"
+                    "[yellow]No API key found. Starting browser-based authentication...[/yellow]"
                 )
                 _authenticate_with_browser(auth, urls.run_url)
 
@@ -247,22 +249,22 @@ def login(
         raise typer.Exit(1)
 
 
-async def _login_with_token(
-    auth: AuthenticationManager, token: str, server_url: str
+async def _login_with_api_key(
+    auth: AuthenticationManager, api_key: str, server_url: str
 ) -> None:
-    """Login using token via Client."""
+    """Login using API key via Client."""
     try:
-        user, _ = await auth.login(token=token)
+        user, _ = await auth.login(token=api_key)
         user_handle = user.get("handle_s", user.get("handle", "unknown"))
 
         console.print(
             f"🎉 Successfully authenticated as [cyan]{user_handle}[/cyan] on [green]{server_url}[/green]"
         )
-        console.print("✅ Token saved for future use")
+        console.print("🔑 API key saved for future use")
 
     except Exception as e:
         console.print(f"[red]Authentication failed: {e}[/red]")
-        console.print("[yellow]Please check your token and try again.[/yellow]")
+        console.print("[yellow]Please check your API key and try again.[/yellow]")
         raise typer.Exit(1)
 
 
@@ -277,7 +279,7 @@ async def _login_with_credentials(
         console.print(
             f"🎉 Successfully authenticated as [cyan]{user_handle}[/cyan] on [green]{server_url}[/green]"
         )
-        console.print("✅ Token saved for future use")
+        console.print("🔑 API key saved for future use")
 
     except Exception as e:
         console.print(f"[red]Failed to authenticate as {handle} on {server_url}[/red]")
@@ -294,7 +296,7 @@ def _ask_credentials() -> dict[str, str]:
             "message": "How do you want to log in?",
             "choices": [
                 {"name": "Username/Password", "value": "password"},
-                {"name": "Token", "value": "token"},
+                {"name": "API key", "value": "api_key"},
             ],
         },
         {
@@ -315,11 +317,11 @@ def _ask_credentials() -> dict[str, str]:
         },
         {
             "type": "password",
-            "name": "token",
-            "message": "Token:",
-            "when": lambda x: x["credentials_type"] == "token",
+            "name": "api_key",
+            "message": "API key:",
+            "when": lambda x: x["credentials_type"] == "api_key",
             "validate": lambda x: (
-                True if len(x) >= 8 else "Token must have at least 8 characters"
+                True if len(x) >= 8 else "API key must have at least 8 characters"
             ),
         },
     ]
@@ -389,7 +391,7 @@ def _authenticate_with_browser(auth: AuthenticationManager, server_url: str) ->
         console.print(
             f"🎉 Successfully authenticated as [cyan]{user_handle}[/cyan] on [green]{server_url}[/green]"
         )
-        console.print("✅ Token saved for future use")
+        console.print("🔑 API key saved for future use")
 
     except KeyboardInterrupt:
         console.print("\n[yellow]Authentication cancelled by user[/yellow]")
@@ -420,7 +422,7 @@ def logout(
         asyncio.run(auth.logout())
 
         console.print(f"👋 Logged out from [green]{urls.run_url}[/green]")
-        console.print("✅ Stored token cleared")
+        console.print("✅ Stored API key cleared")
 
     except Exception as e:
         console.print(f"[red]Logout failed: {e}[/red]")

datalayer_core/templates/index.html

@@ -37,9 +37,13 @@
       href="data:image/x-icon;base64,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAABHNCSVQICAgIfAhkiAAAAAlwSFlzAAAN1wAADdcBQiibeAAAABl0RVh0U29mdHdhcmUAd3d3Lmlua3NjYXBlLm9yZ5vuPBoAAAC7SURBVFiF7ZU9CgIxEIXfTHbPopfYc+pJ9AALtmJnZSOIoJWFoCTzLHazxh/Ebpt5EPIxM8XXTCKTxYyMCYwJFhOYCo4JFiMuu317PZwaqEBUIar4YMmskL73DytGjgu4gAt4PDJdzkkzMBloBhqBgcu69XW+1I+rNSQESNDuaMEhdP/Fj/7oW+ACLuACHk/3F5BAfuMLBjm8/ZnxNvNtHmY4b7Ztut0bqStoVSHfWj9Z6mr8LXABF3CBB3nvkDfEVN6PAAAAAElFTkSuQmCC"
       type="image/x-icon"
     />
+    <link rel="stylesheet" href="{{ base_url }}static/datalayer_core/core.css" />
+    <script>
+      globalThis.process = globalThis.process || { env: { NODE_ENV: 'production' } };
+    </script>
     <script
       defer
-      src="{{ base_url }}static/datalayer_ui/cli.datalayer-ui.js"
+      src="{{ base_url }}static/datalayer_core/cli.datalayer-core.js"
     ></script>
   </head>
   <body>