release: v1.1.0 — application credential auth + hypervisor usage

Features
- Native v3applicationcredential auth flow in OrcaClient (id+secret or
  name+user reference, pre-scoped — no project/domain required).
- profile add/edit + setup now offer a password vs application-credential
  choice and round-trip the AC fields through to-clouds / to-openrc and
  from-clouds / import-openrc.
- Cache key for AC tokens keys on credential identity, not user/project.
- New OS_AUTH_TYPE / OS_APPLICATION_CREDENTIAL_* (and ORCA_* equivalents)
  env vars wired through config.py priority resolution.
- application-credential create --save-profile NAME persists the freshly
  minted AC as an orca profile in one shot.
- New hypervisor usage command: per-host CPU/RAM/disk fill rate with
  bars, color thresholds, sort + filter (--top / --threshold).

Fixes
- application_credential commands: resolve current user id from token
  correctly (token wrapper was being read twice, always falling back to
  the literal string "me").

Tests
- 2218 passing, coverage 85.67% (gate 85%).

Author: Kevin Allioli

orca_cli/commands/application_credential.py

@@ -4,6 +4,7 @@
 
 import click
 
+from orca_cli.core.config import save_profile
 from orca_cli.core.context import OrcaContext
 from orca_cli.core.output import console, output_options, print_detail, print_list
 
@@ -12,6 +13,21 @@ def _iam(client) -> str:
     return client.identity_url
 
 
+def _current_user_id(client) -> str:
+    """Resolve the user id from the current token.
+
+    ``client._token_data`` already holds the inner ``token`` object returned by
+    Keystone, so ``user`` is at the top level — no extra ``token`` wrapping.
+    """
+    user_id = client._token_data.get("user", {}).get("id")
+    if not user_id:
+        raise click.ClickException(
+            "Cannot determine current user id from token. "
+            "Pass --user explicitly."
+        )
+    return user_id
+
+
 @click.group(name="application-credential")
 @click.pass_context
 def application_credential(ctx: click.Context) -> None:
@@ -26,7 +42,7 @@ def application_credential(ctx: click.Context) -> None:
 def app_credential_list(ctx, user_id, output_format, columns, fit_width, max_width, noindent):
     """List application credentials."""
     client = ctx.find_object(OrcaContext).ensure_client()
-    uid = user_id or client._token_data.get("token", {}).get("user", {}).get("id", "me")
+    uid = user_id or _current_user_id(client)
     data = client.get(f"{_iam(client)}/v3/users/{uid}/application_credentials")
     print_list(
         data.get("application_credentials", []),
@@ -53,7 +69,7 @@ def app_credential_show(ctx, credential_id, user_id,
                         output_format, columns, fit_width, max_width, noindent):
     """Show application credential details."""
     client = ctx.find_object(OrcaContext).ensure_client()
-    uid = user_id or client._token_data.get("token", {}).get("user", {}).get("id", "me")
+    uid = user_id or _current_user_id(client)
     data = client.get(f"{_iam(client)}/v3/users/{uid}/application_credentials/{credential_id}")
     a = data.get("application_credential", data)
     print_detail(
@@ -77,11 +93,15 @@ def app_credential_show(ctx, credential_id, user_id,
 @click.option("--expires", "expires_at", default=None, help="Expiry (ISO 8601, e.g. 2026-12-31T00:00:00).")
 @click.option("--unrestricted", is_flag=True, help="Allow creation of other credentials (dangerous).")
 @click.option("--user", "user_id", default=None)
+@click.option("--save-profile", "save_profile_name", default=None,
+              metavar="PROFILE",
+              help="Save the new credential as an orca profile of this name.")
 @click.pass_context
-def app_credential_create(ctx, name, description, secret, expires_at, unrestricted, user_id):
+def app_credential_create(ctx, name, description, secret, expires_at,
+                          unrestricted, user_id, save_profile_name):
     """Create an application credential."""
     client = ctx.find_object(OrcaContext).ensure_client()
-    uid = user_id or client._token_data.get("token", {}).get("user", {}).get("id", "me")
+    uid = user_id or _current_user_id(client)
     body: dict = {"name": name, "unrestricted": unrestricted}
     if description:
         body["description"] = description
@@ -100,6 +120,27 @@ def app_credential_create(ctx, name, description, secret, expires_at, unrestrict
         console.print(f"  [cyan]Secret:[/cyan] {a['secret']}")
         console.print("  [bold yellow]This secret will NOT be shown again.[/bold yellow]")
 
+    if save_profile_name:
+        if not a.get("secret"):
+            raise click.ClickException(
+                "Cannot save profile: Keystone did not return the credential secret."
+            )
+        profile_cfg = {
+            "auth_url": client._auth_url,
+            "auth_type": "v3applicationcredential",
+            "application_credential_id": a["id"],
+            "application_credential_secret": a["secret"],
+        }
+        if client._region_name:
+            profile_cfg["region_name"] = client._region_name
+        path = save_profile(save_profile_name, profile_cfg)
+        console.print(
+            f"[green]Saved as orca profile '{save_profile_name}' → {path}[/green]"
+        )
+        console.print(
+            f"[dim]Activate with:[/dim] orca profile switch {save_profile_name}"
+        )
+
 
 @application_credential.command("delete")
 @click.argument("credential_id")
@@ -111,6 +152,6 @@ def app_credential_delete(ctx, credential_id, user_id, yes):
     if not yes:
         click.confirm(f"Delete application credential {credential_id}?", abort=True)
     client = ctx.find_object(OrcaContext).ensure_client()
-    uid = user_id or client._token_data.get("token", {}).get("user", {}).get("id", "me")
+    uid = user_id or _current_user_id(client)
     client.delete(f"{_iam(client)}/v3/users/{uid}/application_credentials/{credential_id}")
     console.print(f"[green]Application credential {credential_id} deleted.[/green]")

orca_cli/commands/hypervisor.py

@@ -94,3 +94,100 @@ def hypervisor_stats(ctx):
 
     from orca_cli.core.output import console as _console
     _console.print(table)
+
+
+def _pct(used: int, total: int) -> float:
+    if not total:
+        return 0.0
+    return round(100.0 * used / total, 1)
+
+
+def _color_pct(p: float) -> str:
+    if p >= 90:
+        return f"[red bold]{p}%[/red bold]"
+    if p >= 70:
+        return f"[yellow]{p}%[/yellow]"
+    return f"[green]{p}%[/green]"
+
+
+def _bar(p: float, width: int = 8) -> str:
+    filled = max(0, min(width, int(p * width / 100)))
+    color = "red" if p >= 90 else ("yellow" if p >= 70 else "green")
+    return f"[{color}]{'█' * filled}[/{color}]{'░' * (width - filled)}"
+
+
+@hypervisor.command("usage")
+@click.option("--sort-by", type=click.Choice(["cpu", "ram", "disk", "max", "vms"]),
+              default="max", show_default=True,
+              help="Metric to sort by. 'max' picks the worst of CPU/RAM/disk per host.")
+@click.option("--reverse", is_flag=True,
+              help="Sort least-loaded first (default: most-loaded first).")
+@click.option("--threshold", type=click.IntRange(0, 100), default=0, show_default=True,
+              help="Only show hypervisors whose 'max' fill rate is ≥ this percentage.")
+@click.option("--top", "top_n", type=int, default=None,
+              help="Show only the top N hypervisors after sorting.")
+@output_options
+@click.pass_context
+def hypervisor_usage(ctx, sort_by, reverse, threshold, top_n,
+                     output_format, columns, fit_width, max_width, noindent):
+    """Show fill rate per hypervisor, sorted by load.
+
+    Combines vCPU, RAM and disk usage into a per-host 'score' (the worst
+    dimension) so the most-saturated hypervisors surface at the top.
+
+    \b
+    Color thresholds:
+      Green  < 70%   — comfortable headroom
+      Yellow 70–90%  — monitor closely
+      Red    ≥ 90%   — critical
+    """
+    client = ctx.find_object(OrcaContext).ensure_client()
+    data = client.get(f"{_nova(client)}/os-hypervisors/detail")
+    hypervisors = data.get("hypervisors", [])
+
+    enriched = []
+    for h in hypervisors:
+        cpu = _pct(h.get("vcpus_used", 0), h.get("vcpus", 0))
+        ram = _pct(h.get("memory_mb_used", 0), h.get("memory_mb", 0))
+        disk = _pct(h.get("local_gb_used", 0), h.get("local_gb", 0))
+        enriched.append({
+            **h,
+            "_cpu_pct": cpu,
+            "_ram_pct": ram,
+            "_disk_pct": disk,
+            "_max_pct": max(cpu, ram, disk),
+        })
+
+    if threshold:
+        enriched = [h for h in enriched if h["_max_pct"] >= threshold]
+
+    sort_key = {"cpu": "_cpu_pct", "ram": "_ram_pct", "disk": "_disk_pct",
+                "max": "_max_pct", "vms": "running_vms"}[sort_by]
+    enriched.sort(key=lambda h: h.get(sort_key, 0) or 0, reverse=not reverse)
+
+    if top_n is not None and top_n > 0:
+        enriched = enriched[:top_n]
+
+    print_list(
+        enriched,
+        [
+            ("Hostname", "hypervisor_hostname", {"style": "bold"}),
+            ("State", lambda h: f"[green]{h.get('state')}[/green]" if h.get("state") == "up"
+                                else f"[red]{h.get('state')}[/red]"),
+            ("vCPU", lambda h: f"{h.get('vcpus_used', 0)}/{h.get('vcpus', 0)}",
+             {"justify": "right"}),
+            ("CPU%", lambda h: f"{_bar(h['_cpu_pct'])} {_color_pct(h['_cpu_pct'])}"),
+            ("RAM (GB)", lambda h: f"{h.get('memory_mb_used', 0)//1024}/{h.get('memory_mb', 0)//1024}",
+             {"justify": "right"}),
+            ("RAM%", lambda h: f"{_bar(h['_ram_pct'])} {_color_pct(h['_ram_pct'])}"),
+            ("Disk (GB)", lambda h: f"{h.get('local_gb_used', 0)}/{h.get('local_gb', 0)}",
+             {"justify": "right"}),
+            ("Disk%", lambda h: f"{_bar(h['_disk_pct'])} {_color_pct(h['_disk_pct'])}"),
+            ("VMs", "running_vms", {"justify": "right"}),
+            ("Score", lambda h: _color_pct(h["_max_pct"])),
+        ],
+        title="Hypervisor Usage (sorted by " + sort_by + ")",
+        output_format=output_format, columns=columns,
+        fit_width=fit_width, max_width=max_width, noindent=noindent,
+        empty_msg="No hypervisors match the filter.",
+    )