def switch_tenants(id, slug, default):
"""
Switch active tenant
\b
Options:
--id, -i TEXT A Prefect Cloud tenant id
--slug, -s TEXT A Prefect Cloud tenant slug
"""
# If the config specifies a tenant explicitly, it is used before this mechanism
if config.cloud.get("tenant_id"):
raise TerminalError(
"Your tenant id has been set in the Prefect config instead of with the "
"CLI. To switch tenants with the CLI, remove the config key "
" `prefect.cloud.tenant_id`")
client = Client()
# Deprecated API token check
if not client.api_key:
check_override_auth_token()
if default:
raise TerminalError(
"The default tenant flag can only be used with API keys.")
else: # Using an API key
if default:
# Clear the set tenant on disk
client.tenant_id = None
client.save_auth_to_disk()
click.secho(
"Tenant restored to the default tenant for your API key: "
f"{client.get_default_tenant()}",
fg="green",
)
return
login_success = client.login_to_tenant(tenant_slug=slug, tenant_id=id)
if not login_success:
raise TerminalError("Unable to switch tenant!")
# `login_to_tenant` will write to disk if using an API token, if using an API key
# we will write to disk manually here
if client.api_key:
client.save_auth_to_disk()
click.secho(f"Tenant switched to {client.tenant_id}", fg="green")
def login(key):
"""
Login to Prefect Cloud
Create an API key in the UI then login with it here:
$ prefect auth login -k YOUR-KEY
You will be switched to the default tenant associated with the key. After login,
your available tenants can be seen with `prefect auth list-tenants` and you can
change the default tenant on this machine using `prefect auth switch-tenants`.
The given key will be stored on disk for later access. Prefect will default to using
this key for all interaction with the API but frequently overrides can be passed to
individual commands or functions. To remove your key from disk, see
`prefect auth logout`.
"""
if not key:
raise TerminalError("You must supply an API key!")
abort_on_config_api_key(
"To log in with the CLI, remove the config key `prefect.cloud.api_key`"
)
# Ignore any tenant id that has been previously set via login
client = Client(api_key=key)
client._tenant_id = None
try:
tenant_id = client._get_auth_tenant()
except AuthorizationError:
raise TerminalError("Unauthorized. Invalid Prefect Cloud API key.")
except ClientError:
raise TerminalError(
"Error attempting to communicate with Prefect Cloud.")
else:
client.tenant_id = tenant_id
client.save_auth_to_disk()
tenant = TenantView.from_tenant_id(tenant_id)
click.secho(
f"Logged in to Prefect Cloud tenant {tenant.name!r} ({tenant.slug})",
fg="green",
)
return
def switch_tenants(id, slug, default):
"""
Switch active tenant
\b
Options:
--id, -i TEXT A Prefect Cloud tenant id
--slug, -s TEXT A Prefect Cloud tenant slug
"""
# If the config specifies a tenant explicitly, it is used before this mechanism
if config.cloud.get("tenant_id"):
raise TerminalError(
"Your tenant id has been set in the Prefect config instead of with the "
"CLI. To switch tenants with the CLI, remove the config key "
" `prefect.cloud.tenant_id`")
client = Client()
if not client.api_key:
raise TerminalError("You are not logged in!")
if default:
# Clear the set tenant on disk
client.tenant_id = None
client.save_auth_to_disk()
click.secho(
"Tenant restored to the default tenant for your API key: "
f"{client._get_auth_tenant()}",
fg="green",
)
return
try:
tenant_id = client.switch_tenant(tenant_slug=slug, tenant_id=id)
except AuthorizationError:
raise TerminalError(
"Unauthorized. Your API key is not valid for that tenant.")
client.save_auth_to_disk()
click.secho(f"Tenant switched to {tenant_id}", fg="green")
def login(key, token):
"""
Login to Prefect Cloud
Create an API key in the UI then login with it here:
$ prefect auth login -k YOUR-KEY
You will be switched to the default tenant associated with the key. After login,
your available tenants can be seen with `prefect auth list-tenants` and you can
change the default tenant on this machine using `prefect auth switch-tenants`.
The given key will be stored on disk for later access. Prefect will default to using
this key for all interaction with the API but frequently overrides can be passed to
individual commands or functions. To remove your key from disk, see
`prefect auth logout`.
This command has backwards compatibility support for API tokens, which are a
deprecated form of authentication with Prefect Cloud
"""
if not key and not token:
raise TerminalError("You must supply an API key or token!")
if key and token:
raise TerminalError("You cannot supply both an API key and token")
abort_on_config_api_key(
"To log in with the CLI, remove the config key `prefect.cloud.api_key`"
)
# Attempt to treat the input like an API key even if it is passed as a token
# Ignore any tenant id that has been previously set via login
client = Client(api_key=key or token, tenant_id=None)
try:
tenant_id = client._get_auth_tenant()
except AuthorizationError:
if key: # We'll catch an error again later if using a token
raise TerminalError("Unauthorized. Invalid Prefect Cloud API key.")
except ClientError:
raise TerminalError(
"Error attempting to communicate with Prefect Cloud.")
else:
if token:
click.secho(
"WARNING: You logged in with an API key using the `--token` flag "
"which is deprecated. Please use `--key` instead.",
fg="yellow",
)
client.tenant_id = tenant_id
client.save_auth_to_disk()
tenant = TenantView.from_tenant_id(tenant_id)
click.secho(
f"Logged in to Prefect Cloud tenant {tenant.name!r} ({tenant.slug})",
fg="green",
)
return
# If there's not a tenant id, we've been given an actual token, fallthrough to
# the backwards compatibility token auth
# Backwards compatibility for tokens
if token:
check_override_auth_token()
client = Client(api_token=token)
# Verify they're not also using an API key
if client.api_key:
raise TerminalError(
"You have already logged in with an API key and cannot use a token."
)
click.secho(
"WARNING: API tokens are deprecated. Please create an API key and use "
"`prefect auth login --key <KEY>` to login instead.",
fg="yellow",
)
# Verify login obtained a valid api token
try:
output = client.graphql(
query={"query": {
"user": {
"default_membership": "tenant_id"
}
}})
# Log into default membership
success_login = client.login_to_tenant(
tenant_id=output.data.user[0].default_membership.tenant_id)
if not success_login:
raise AuthorizationError
except AuthorizationError:
click.secho(
"Error attempting to use the given API token. "
"Please check that you are providing a USER scoped Personal Access Token "
"and consider switching API key.",
fg="red",
)
return
except ClientError:
click.secho(
"Error attempting to communicate with Prefect Cloud. "
"Please check that you are providing a USER scoped Personal Access Token "
"and consider switching API key.",
fg="red",
)
return
# save token
client.save_api_token()
click.secho("Login successful!", fg="green")
