Automated SciToken acquisition in the fdp CLI

[sammuli]

Summary

Adds automated SciToken (bearer token) acquisition to the fdp CLI, so users no longer hand-manage ~/.fdp/token. A new fdp/auth.py module owns the credential lifecycle; fdp mints/refreshes tokens via the pelican GitHub-OAuth flow (pelican credentials token get) and feeds them into the existing BEARER_TOKEN path.

New behavior

• fdp login [--write] — mint/refresh a token, cached at ~/.fdp/cache/<device>.token (bare JWT, 0600, atomic write).
• fdp logout — delete the cached token.
• fdp run … — auto-acquires a token when none is valid and the session is interactive (stdin+stderr TTYs); FDP_NO_AUTO_LOGIN=1 disables it for batch jobs.
• fdp env — never launches the OAuth flow; now emits the device's declared bearer env-var name instead of a hardcoded BEARER_TOKEN.
• Token resolution order: -t/--bearer-token → $BEARER_TOKEN → managed cache → legacy ~/.fdp/token (file sources expiry-checked; an unusable legacy file warns with a migration hint).

Design notes

• Shells out to pelican (already a runtime dep) rather than reimplementing OAuth. Verified against a live client: the command emits a bare JWT on stdout, sends the device-code prompt/warnings to stderr, and requires a TTY — so the subprocess pipes stdout only and inherits stdin+stderr.
• Auth namespace URL comes from Tokamak.pelican_root; the target env var from the locator's auth.env. No catalog schema changes.

Design + plan: docs/superpowers/specs/2026-06-22-fdp-scitoken-automation-design.md, docs/superpowers/plans/2026-06-22-fdp-scitoken-automation.md.

Note on scope: main was 3 commits behind this branch's fork point, so this PR also brings main up to the already-released 0.2.4 PTData index_pattern work (db5c4a4, 732a979, 5025784) that was cut via release-0.2.4 tag but never merged. Those commits are unchanged here.

Test Plan

Automated

• Full suite green: pixi run test → 130 passed, 6 skipped (skips require toksearch_d3d installed). 65 dedicated tests across test_auth.py / test_environment.py / test_cli.py; all pelican/OAuth calls mocked.
• CI build_and_test green.

Manual

Requires a real terminal (pelican's OAuth flow needs a TTY) in an env that has both this branch's fdp and a device contributor (toksearch_d3d provides the d3d catalog entry). The bare fdp dev env has no device and fdp login errors with "No tokamak contributors are installed."

Setup — none needed. The repos/toksearch_d3d pixi env already has fdp editable-installed from repos/fdp, so it runs whatever branch that repo is checked out to:

cd repos/fdp && git checkout feat/fdp-scitoken-automation   # this branch
cd ../toksearch_d3d
pixi run fdp --help          # sanity: login/logout appear; catalog list shows d3d

Run the steps below from repos/toksearch_d3d with pixi run …. To switch back afterward, just git checkout main in repos/fdp — nothing to uninstall. (That env is Python 3.10, so a pip install -e of fdp is refused by the >=3.11 metadata floor — but the existing editable install runs fine under 3.10; the floor is about ml-metadata wheels, not fdp syntax.)

• A — fdp login mints a token. pixi run fdp login → device-code prompt on stderr; after approval prints Logged in to d3d (read); token valid until <UTC>. Verify: stat -c '%a %n' ~/.fdp/cache/d3d.token → 600, and the file starts with eyJ… (a JWT).
• B — resolution prefers the fresh cache. unset BEARER_TOKEN; pixi run fdp env | grep BEARER_TOKEN → export BEARER_TOKEN='<cached JWT>'.
• C — auto-acquire on fdp run (interactive). Force the no-valid-token state, then run:

  unset BEARER_TOKEN
  mv ~/.fdp/token ~/.fdp/token.bak 2>/dev/null
  mv ~/.fdp/cache/d3d.token /tmp/d3d.token.bak 2>/dev/null
  pixi run fdp run python -c "import os; print('BEARER_TOKEN' in os.environ)"

  → OAuth prompt appears, then prints True. (Restore later: mv ~/.fdp/token.bak ~/.fdp/token.)
• D — opt-out / non-TTY does not prompt. With sources still invalid:

  FDP_NO_AUTO_LOGIN=1 pixi run fdp run python -c "import os; print('BEARER_TOKEN' in os.environ)"
  echo | pixi run fdp run python -c "import os; print('BEARER_TOKEN' in os.environ)"

  → both print False with no OAuth prompt. Opt-out is silent; the non-TTY case warns to stderr.
• E — fdp env never launches the flow. With sources invalid + interactive TTY: pixi run fdp env >/dev/null → exports + warning, but no OAuth prompt.
• F — fdp logout. pixi run fdp logout → "Removed cached token."; a second call → "No cached token to remove."; ls ~/.fdp/cache/d3d.token → No such file.

Cleanup: mv ~/.fdp/token.bak ~/.fdp/token 2>/dev/null; then git checkout main in repos/fdp if you want the env back on the released fdp. The mv dance forces the no-valid-token state without deleting dated token files — just restore the symlink. If fdp login picks a device other than d3d, adjust the cache path (pixi run fdp catalog list shows names).

🤖 Generated with Claude Code