Catalog API keys (v0.16.0)

[drernie]

Summary

• Add quiltx catalog api-key command to print, mint (--new), and store a catalog API key. Supports browser-based login, --username/--password U/P bootstrap, and --insecure for localhost.
• quiltx catalog login now mints and stores a catalog API key as part of the auth flow so downstream tools can reuse it.
• Bump to 0.16.0.

Test plan

• ./poe test
• quiltx catalog api-key prints stored key
• quiltx catalog api-key --new mints and stores a fresh key
• quiltx catalog login stores an API key on success

🤖 Generated with Claude Code

Greptile Summary

This PR adds quiltx catalog api-key — a new subcommand that prints, mints, and stores a catalog API key — and wires the same mint_api_key helper into quiltx catalog login and the interactive credential-resolution ladder in auth.py.

• New api_key.py command: prints the stored key by default; --new mints a replacement via browser SSO or --username/--password bootstrap; supports --insecure for localhost.
• login.py refactor: login logic extracted into mint_api_key()/MintedApiKey so both catalog login and catalog api-key share one implementation; SystemExit calls replaced with LoginError.
• auth.py credential ladder step 4: the old getpass paste-prompt is replaced with the full browser/SSO mint_api_key flow.

Confidence Score: 3/5

The new api-key command is functional but its stdout output is inconsistent: printing the stored key emits only the key, while minting a new one mixes an informational status line with the key on the same stream, breaking the common shell pattern of capturing command output into a variable.

The stdout-mixing issue in api_key.py affects a core use case — automating key retrieval — and leaves the two code paths in an inconsistent state that tests only partially catch (the mint tests assert 'key in out' rather than strict equality). The rest of the refactor is clean and well-structured.

quiltx/tools/catalog/api_key.py (stdout mixing) and quiltx/tools/catalog/login.py (is_usage_error string matching).

Security Review

• --password exposed in process listing (quiltx/tools/catalog/api_key.py, login.py): passing the catalog admin password as a command-line argument makes it readable via ps aux / /proc/<pid>/cmdline for the duration of the process. The interactive getpass prompt (used when --password is omitted) is the safer path; the help text for --password should warn that inline use is insecure.

Important Files Changed

Filename	Overview
quiltx/tools/catalog/api_key.py	New command: prints stored API key or mints a new one; stdout mixing issue between informational message and machine-readable key value.
quiltx/tools/catalog/login.py	Refactored login logic into reusable mint_api_key + MintedApiKey; introduces LoginError and fragile string-based is_usage_error classifier.
quiltx/auth.py	Step 4 of the credential ladder replaced from getpass prompt to browser/SSO auth flow via deferred login_tool.mint_api_key; doc comments updated to match.
quiltx/tools/catalog/init.py	Registers the new api-key subcommand; straightforward addition with no issues.
tests/test_auth.py	Tests updated to match the new auth-flow credential source; prompt tests replaced with mint-mock equivalents.
tests/test_catalog_login.py	Adds four new tests for the api-key command and updates existing login tests to reflect refactored error surface.

Sequence Diagram

sequenceDiagram
    participant User
    participant api_key_cmd as catalog api-key
    participant login_cmd as login.mint_api_key
    participant auth_py as auth.resolve_cli
    participant Catalog as Catalog API

    User->>api_key_cmd: quiltx catalog api-key [--new]
    alt stored key exists and not --new
        api_key_cmd->>User: print stored key (stdout)
    else mint new key
        api_key_cmd->>login_cmd: mint_api_key(catalog_url, dns, ...)
        alt browser flow (default TTY)
            login_cmd->>User: open browser, prompt for code
            User->>login_cmd: paste refresh_token
            login_cmd->>Catalog: bootstrap_api_key_from_refresh_token
        else U/P flow (--username given)
            login_cmd->>Catalog: bootstrap_api_key(username, password)
        end
        Catalog-->>login_cmd: "{secret, name, expires_at}"
        login_cmd->>login_cmd: credentials.store(dns, secret)
        login_cmd-->>api_key_cmd: MintedApiKey
        api_key_cmd->>User: print stored message + secret (both stdout)
    end

    User->>auth_py: any catalog command (no stored key, TTY)
    auth_py->>login_cmd: "mint_api_key(catalog_url, dns, no_prompt=False)"
    login_cmd-->>auth_py: MintedApiKey
    auth_py-->>User: ResolvedCredentials(secret, auth-flow)

Loading

_{Reviews (1): Last reviewed commit: "CHANGELOG: 0.16.0" | Re-trigger Greptile}

Greptile also left 3 inline comments on this PR.