Add visual feedback for API token input with asterisk masking #28

hovu96 · 2025-10-30T10:09:13Z

Summary

Replaces hidden token input with asterisk-masked input using the pwinput library to provide visual feedback when users type or paste their API token during workato init. This improves user experience by confirming input is being captured while maintaining security through character masking.

Changes Made

Code Changes

Added pwinput>=1.0.3 dependency to pyproject.toml
Updated manager.py:344 to use pwinput.pwinput() for masked token input
Replaced click.prompt(hide_input=True) with asterisk masking
Added pwinput.* to mypy overrides and pre-commit configuration

Key Implementation Details

Called pwinput.pwinput() synchronously (not wrapped in asyncio.to_thread)
This avoids terminal buffer issues when pasting long tokens
The async wrapper was causing character leakage during paste operations
Added comprehensive code comments explaining the approach and future migration path to Python 3.14's built-in solution

Test Updates

Updated 3 test functions to mock pwinput.pwinput instead of click.prompt
All 903 tests pass with 98% coverage maintained

Quality Checks ✅

Type checker (mypy): Success
Linter (ruff check): All checks passed
Formatter (ruff format): 87 files properly formatted
Pre-commit hooks: All passed
Manual testing: Confirmed asterisk masking works correctly for both typing and pasting

Acceptance Criteria Met

✅ User sees asterisks when typing/pasting API token
✅ Token validation works correctly
✅ Empty token handling works as before
✅ All unit tests pass with 100% coverage for changed code
✅ Type checker passes with no errors
✅ Linter passes with no issues
✅ Pre-commit hooks pass successfully
✅ Manual testing confirms correct behavior
✅ Backspace works correctly when editing token input
✅ Pasting long tokens works without character leakage

Test Plan

Run unit tests: uv run pytest tests/unit/config/test_manager.py -v ✅
Run full test suite: uv run pytest ✅ (903 tests passed)
Run type checker: uv run mypy ✅
Run linter: uv run ruff check ✅
Run formatter: uv run ruff format ✅
Run pre-commit: pre-commit run --all-files ✅
Manual test: workato init (interactive mode) ✅
Verified pasting long tokens works without character leakage ✅

Notes

The synchronous approach avoids terminal buffering issues that occurred with async wrappers
Added TODO comment for future migration to Python 3.14's built-in getpass.getpass(echo_char='*')
Commit: ae15bd7

🤖 Generated with Claude Code

Replace hidden token input with asterisk-masked input using pwinput library to provide visual feedback when users type or paste their API token during workato init. This improves user experience by confirming input is being captured while maintaining security through character masking. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>

github-actions · 2025-10-30T10:09:42Z

Coverage Report

File	Stmts	Miss	Cover	Missing
__init__.py	68	4	94%	10–11, 69–70
cli
__init__.py	52	3	94%	49, 51, 60
containers.py	27	0	100%
cli/commands
__init__.py	0	0	100%
api_clients.py	286	9	96%	24, 297, 442–443, 476, 486, 576, 607, 615
api_collections.py	253	3	98%	25, 178, 340
assets.py	46	2	95%	51–52
connections.py	520	5	99%	582, 584, 590, 628, 977
data_tables.py	163	5	96%	28, 248, 262, 316–317
guide.py	166	1	99%	106
init.py	89	0	100%
profiles.py	197	0	100%
properties.py	95	1	98%	18
pull.py	171	2	98%	190–191
workspace.py	38	2	94%	57, 67
cli/commands/connectors
__init__.py	0	0	100%
command.py	88	2	97%	105, 154
connector_manager.py	203	4	98%	176, 292, 300–301
cli/commands/projects
__init__.py	0	0	100%
command.py	269	10	96%	353–356, 367, 433–435, 485, 489
project_manager.py	166	7	95%	48, 66, 263–264, 276, 317, 325
cli/commands/push
__init__.py	0	0	100%
command.py	132	4	96%	105, 108, 226, 304
cli/commands/recipes
__init__.py	0	0	100%
command.py	423	9	97%	113, 129–130, 267–270, 397, 703
validator.py	706	20	97%	174, 883, 1136, 1223, 1246, 1279, 1281–1282, 1359–1361, 1457–1458, 1517–1518, 1707–1708, 1736–1738
cli/utils
__init__.py	3	0	100%
exception_handler.py	198	6	96%	137, 184, 211, 238, 295, 330
gitignore.py	14	0	100%
ignore_patterns.py	23	0	100%
spinner.py	43	0	100%
version_checker.py	135	6	95%	24, 26, 33–34, 72, 102
cli/utils/config
__init__.py	5	0	100%
manager.py	468	19	95%	126, 137–139, 142, 155, 205–206, 368, 449–450, 489, 703, 846–847, 861–862, 923, 982
models.py	33	0	100%
profiles.py	309	10	96%	93, 189–190, 193, 228–230, 255–257
workspace.py	68	0	100%
TOTAL	5457	134	97%

Copilot

Pull Request Overview

This PR replaces the password input mechanism for API tokens from click.prompt with hide_input=True to the pwinput library with visible masking characters. The change addresses terminal buffer issues when pasting long tokens, where the async wrapper in click was causing characters to leak through before being masked.

Key changes:

Adds pwinput>=1.0.3 as a new dependency across all configuration files
Updates token input in ConfigManager._create_new_profile() to use pwinput.pwinput() with asterisk masking
Updates test mocks to reflect the new pwinput-based token input mechanism

Reviewed Changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
uv.lock	Adds pwinput 1.0.3 package and updates dependency tree
pyproject.toml	Adds pwinput>=1.0.3 to dependencies and mypy ignore list
.pre-commit-config.yaml	Adds pwinput>=1.0.3 to pre-commit hook dependencies
src/workato_platform_cli/cli/utils/config/manager.py	Replaces click.prompt with pwinput.pwinput for masked token input
tests/unit/config/test_manager.py	Updates test mocks to use pwinput instead of click.prompt for token input

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

src/workato_platform_cli/cli/utils/config/manager.py

oalami

LGTM

…#28)" This reverts commit 3fd2c8b.

#29) Revert "Add visual feedback for API token input with asterisk masking (#28)" This reverts commit 3fd2c8b.

Implements a new token input utility that provides visual feedback for API token entry with intelligent paste detection: - Shows asterisks (****) for manually typed characters - Detects long paste operations (>50 chars) via bracketed paste mode - Displays inline confirmation with character count in gray text - Combines typed and pasted content seamlessly - Handles very long tokens (750+ chars) without truncation - Avoids terminal buffer limitations of character-by-character input Technical Implementation: - Uses prompt_toolkit for password input with bracketed paste support - Custom key bindings to detect and handle paste events - ANSI escape sequences for inline confirmation prompt - Proper error handling and retry logic Dependencies: - Added prompt-toolkit>=3.0.0 - Updated mypy configuration and pre-commit hooks Testing: - 13 comprehensive unit tests with 61% code coverage - Tests cover typing, pasting, confirmation, retries, and error cases - All tests pass with proper mocking of terminal interaction Related to PR #28 (reverted in #29 due to pwinput truncation issues) This solution resolves the truncation problem by using bracketed paste mode instead of character-by-character input processing. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>

* feat: Add smart token input with bracketed paste detection Implements a new token input utility that provides visual feedback for API token entry with intelligent paste detection: - Shows asterisks (****) for manually typed characters - Detects long paste operations (>50 chars) via bracketed paste mode - Displays inline confirmation with character count in gray text - Combines typed and pasted content seamlessly - Handles very long tokens (750+ chars) without truncation - Avoids terminal buffer limitations of character-by-character input Technical Implementation: - Uses prompt_toolkit for password input with bracketed paste support - Custom key bindings to detect and handle paste events - ANSI escape sequences for inline confirmation prompt - Proper error handling and retry logic Dependencies: - Added prompt-toolkit>=3.0.0 - Updated mypy configuration and pre-commit hooks Testing: - 13 comprehensive unit tests with 61% code coverage - Tests cover typing, pasting, confirmation, retries, and error cases - All tests pass with proper mocking of terminal interaction Related to PR #28 (reverted in #29 due to pwinput truncation issues) This solution resolves the truncation problem by using bracketed paste mode instead of character-by-character input processing. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> * feat: Integrate smart token input into workato init command Replaced click.prompt with get_token_with_smart_paste utility in both token prompt locations (_create_profile_with_env_vars and _create_new_profile). This provides visual feedback (asterisk masking) and handles long token pastes without truncation. Changes: - Added asyncio import and get_token_with_smart_paste import to manager.py - Replaced token prompts with asyncio.to_thread(get_token_with_smart_paste) - Updated 4 tests to mock get_token_with_smart_paste instead of click.prompt All 944 tests passing. Type checking, linting, and formatting all pass. Fixes DEVP-498 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> * Update src/workato_platform_cli/cli/utils/config/manager.py Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update src/workato_platform_cli/cli/utils/token_input.py Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * refactor: replace sys.exit with ClickException for proper error handling - Remove try-except wrapper in _prompt_and_validate_credentials that was masking UnauthorizedException, preventing proper error handling - Replace all sys.exit(1) calls with click.ClickException for validation errors and user cancellations - Remove unused sys import - Update tests to expect click.ClickException instead of SystemExit This allows @handle_api_exceptions and @handle_cli_exceptions decorators to properly catch and format all errors consistently. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> * refactor: standardize token error messages for consistency - Change "No token provided" to "API token cannot be empty" for consistency - Change prompt_text from "Workato API token" to "API token" (context is already clear from CLI name) - Update token_input.py to dynamically use prompt_text in error messages instead of hardcoded "Token" - Update tests to expect new consistent messaging All token-related error messages now consistently use "API token" across the codebase. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> --------- Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: Ossama Alami <ossama.alami@workato.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

hovu96 requested review from cmworkato and oalami October 30, 2025 10:12

Merge branch 'main' into enhancement/masked-token-input

2c186cc

oalami requested a review from Copilot October 30, 2025 21:11

Copilot AI reviewed Oct 30, 2025

View reviewed changes

src/workato_platform_cli/cli/utils/config/manager.py Show resolved Hide resolved

oalami approved these changes Oct 30, 2025

View reviewed changes

oalami merged commit 3fd2c8b into main Oct 30, 2025
11 checks passed

oalami deleted the enhancement/masked-token-input branch October 30, 2025 21:32

oalami added a commit that referenced this pull request Oct 31, 2025

Revert "Add visual feedback for API token input with asterisk masking (…

052a2fb

…#28)" This reverts commit 3fd2c8b.

oalami mentioned this pull request Oct 31, 2025

Revert "Add visual feedback for API token input with asterisk masking" #29

Merged

cmworkato pushed a commit that referenced this pull request Oct 31, 2025

Revert "Add visual feedback for API token input with asterisk masking" (

d0788bd

#29) Revert "Add visual feedback for API token input with asterisk masking (#28)" This reverts commit 3fd2c8b.

hovu96 mentioned this pull request Nov 5, 2025

DEVP-421: Add visual feedback when entering API Token #37

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Add visual feedback for API token input with asterisk masking #28

Add visual feedback for API token input with asterisk masking #28

Uh oh!

hovu96 commented Oct 30, 2025

Uh oh!

github-actions bot commented Oct 30, 2025 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

oalami left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Add visual feedback for API token input with asterisk masking #28

Add visual feedback for API token input with asterisk masking #28

Uh oh!

Conversation

hovu96 commented Oct 30, 2025

Summary

Changes Made

Code Changes

Key Implementation Details

Test Updates

Quality Checks ✅

Acceptance Criteria Met

Test Plan

Notes

Uh oh!

github-actions bot commented Oct 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

oalami left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

github-actions bot commented Oct 30, 2025 •

edited

Loading