Function _wizard_server

openviking_cli/setup_wizard.py:1619–1689

Prompt for server binding, port, and auth (root API key when remote). Auth mode is auto-detected by the server from ``root_api_key``: setting a key switches to ``api_key`` mode, no key means ``dev`` mode (which the server only permits on localhost) — so this step never writes ``auth

(current: dict[str, Any] | None = None)

def _wizard_server(current: dict[str, Any] | None = None) -> dict[str, Any] | None:
    """Prompt for server binding, port, and auth (root API key when remote).

    Auth mode is auto-detected by the server from ``root_api_key``: setting a
    key switches to ``api_key`` mode, no key means ``dev`` mode (which the
    server only permits on localhost) — so this step never writes
    ``auth_mode`` explicitly. *current* (the existing server config, if any)
    seeds all defaults so an update run can keep values by pressing Enter.
    """
    current = current or {}
    _rule("Server & auth")
    if current:
        print(f"  {_dim('Current: ' + _summarize_server(current))}")
    print(f"  {_dim('Local: only this machine can reach the server (no auth, dev mode).')}")
    print(f"  {_dim('Remote: bind to 0.0.0.0 for Docker / LAN access — requires API-key auth.')}")

    is_remote_now = str(current.get("host") or "127.0.0.1") not in (
        "127.0.0.1",
        "localhost",
        "::1",
    )
    mode = _prompt_choice(
        "Bind server host to:",
        [
            ("Local (127.0.0.1)", "(default, safer — no auth needed)"),
            ("Remote (0.0.0.0)", "(Docker / remote access — root API key required)"),
        ],
        default=2 if is_remote_now else 1,
    )

    try:
        port_default = int(current.get("port") or 1933)
    except (TypeError, ValueError):
        port_default = 1933
    port = _prompt_required_int("Port", default=port_default)
    if port is None:
        port = port_default

    if mode == 1:
        return {"host": "127.0.0.1", "port": port}

    print(f"\n  {_dim('Non-local binding switches auth to api_key mode: every client must send')}")
    print(f"  {_dim('the root API key as a Bearer token (Authorization: Bearer <key>).')}")

    existing_key = str(current.get("root_api_key") or "")
    key_options: list[tuple[str, str]] = []
    if existing_key:
        key_options.append(("Keep existing key", f"({_mask_secret(existing_key)})"))
    key_options.append(
        ("Generate one for me", "(recommended — 64-char random key, shown once below)")
    )
    key_options.append(("Enter my own", ""))

    key_source = _prompt_choice("Root API key:", key_options, default=1)
    offset = 1 if existing_key else 0

    if existing_key and key_source == 1:
        root_api_key = existing_key