fix(remote): pick-up new tokens on pre-login sessions (#213)

* chore(dep): drop unused calamus

* chore(dep): constrain minimal compatible linkml version

* sec(dep): floor pynacl>=1.6.2 to protect from CVE-2025-69277

* chore(dep): declare explicit imports

* chore(dep): cap typer for sphinx-click compat

* docs(cli): fix out of date cli path

* chore(dep): update lock file

* test(c4gh): adapt to new key-generation api

* chore(c4gh): drop unnecessary comment

* test: add check for preserved links post-removal

* fix(api): preserve links upon remove

* test(htsget): add overlap test for fully contained region

* fix(htsget): consider contained interval as overlap

* test(remote): token pickup on pre-login sessions

* fix(auth): reload cached token on each request

* refactor(remote): flatten token refresh logic

* chore(remote): drop unneeded comment

* chore(remote): better user-facing signal for token refresh

Author: cmdoret

src/modos/remote.py

@@ -7,27 +7,26 @@
 import os
 from pathlib import Path
 from typing import Any, Self
-import warnings
 
 import jwt
+from loguru import logger
 from pydantic import BaseModel, HttpUrl, validate_call
 from pydantic.dataclasses import dataclass
 import requests
 from requests.auth import AuthBase
 
 
 class BearerAuth(AuthBase):
-    def __init__(self):
-        self.jwt = JWT.from_cache()
-
     def __call__(
         self, r: requests.PreparedRequest
     ) -> requests.PreparedRequest:
-        if self.jwt:
-            if self.jwt.is_expired:
-                self.jwt = self.jwt.refresh()
-            if self.jwt:
-                r.headers["Authorization"] = f"Bearer {self.jwt.access_token}"
+        token = JWT.from_cache()
+        if not token:
+            return r
+        if token.is_expired:
+            token = token.refresh()
+        if token:
+            r.headers["Authorization"] = f"Bearer {token.access_token}"
         return r
 
 
@@ -230,7 +229,10 @@ def is_expired(self, skew: int = 30) -> bool:
         )
 
     def refresh(self) -> JWT | None:
-        warnings.warn("Token refresh is not yet implemented.")
+        # TODO: implement token refresh
+        logger.warning(
+            "Your session has expired. Run `modos login` to re-authenticate."
+        )
         return None
 
 

tests/test_remote.py

@@ -0,0 +1,31 @@
+"""Tests for remote authentication handling."""
+
+import jwt
+import pytest
+import requests
+
+from modos import remote
+from modos.remote import BearerAuth, JWT
+
+# Far-future expiry so the token is never considered expired.
+_FUTURE_EXP = 4102444800  # 2100-01-01 UTC
+
+
+@pytest.fixture
+def cache_dir(tmp_path, monkeypatch):
+    """Redirect the JWT cache to a temporary directory."""
+    monkeypatch.setattr(remote, "get_cache_dir", lambda: tmp_path)
+    return tmp_path
+
+
+def test_bearer_auth_picks_up_token_cached_after_construction(cache_dir):
+    """A session built before login must still send a token cached later."""
+    auth = BearerAuth()  # constructed while logged out
+
+    token = jwt.encode({"exp": _FUTURE_EXP}, "secret" * 8)
+    JWT(token).to_cache()  # simulate a later login
+
+    req = requests.Request("GET", "http://modos.example.org").prepare()
+    auth(req)
+
+    assert req.headers.get("Authorization") == f"Bearer {token}"