UncountablePythonSDK 0.0.174__py3-none-any.whl → 0.0.176__py3-none-any.whl

pkgs/type_spec/actions_registry/__main__.py

@@ -92,6 +92,7 @@ def main() -> None:
                 ]
                 if definition.visibility_scope is not None
                 else None,
+                kind=definition.kind,
                 arguments=definition.arguments,
             )
             action_definitions_with_arguments_list.append(

pkgs/type_spec/actions_registry/emit_python.py

@@ -54,6 +54,10 @@ def _emit_action_definition(
         out.write(
             f"{sub_indent}visibility_scope={_emit_visibility_scope(action.visibility_scope)},\n"
         )
+    if action.kind is not None:
+        out.write(
+            f"{sub_indent}kind=actions_registry_t.ActionDefinitionKind.{action.kind.name},\n"
+        )
     if action.arguments is not None:
         out.write(f"{sub_indent}arguments={_py_str(action.arguments)},\n")
     out.write(f"{indent}),\n")

pkgs/type_spec/actions_registry/emit_typescript.py

@@ -147,6 +147,10 @@ def _emit_action_definition(
         out.write(
             f"{sub_indent}visibilityScope: {_emit_visibility_scope(action_definition.visibility_scope)},\n"
         )
+    if action_definition.kind is not None:
+        out.write(
+            f"{sub_indent}kind: ActionsRegistryT.ActionDefinitionKind.{ts_name(action_definition.kind, name_case=builder.NameCase.convert)},\n"
+        )
     out.write(f"{indent}}} as ActionsRegistryT.ActionDefinition{argument_type},\n")
     return out.getvalue()
 

pkgs/type_spec/non_discriminated_union_exceptions.py

@@ -6,7 +6,7 @@ NON_DISCRIMINATED_UNION_EXCEPTIONS = [
     "output_parameters.AnalyticalMethodLinkedOptionValue",
     "recipes_redirect.RecipesRedirectResult",
     "value_spec.ResolvedPathAll",
-    "weighted_sum.WeightedSumEntitiesOld",
+    "deprecated_calculation_types.DeprecatedWeightedSumEntitiesV0",
     "workflows.WorkflowTotalDisplay",
     "type_info.TypeFormActionConstraint",
     "structured_loading.CompatibleFilterNode",

pkgs/type_spec/value_spec/__main__.py

@@ -173,6 +173,7 @@ key_description = "description"
 key_brief = "brief"
 key_name = "name"
 key_draft = "draft"
+key_deferred_value_spec = "deferred_value_spec"
 
 
 TypeT = TypeVar("TypeT")
@@ -236,6 +237,14 @@ def main() -> None:
                     arg_meta = get(args_meta, in_argument.ref_name)
                     arg_description = get_as(arg_meta, key_description, str)
                     arg_name = get_as(arg_meta, key_name, str)
+                    deferred_value_spec = None
+                    if (
+                        isinstance(arg_meta, dict)
+                        and arg_meta.get(key_deferred_value_spec) is not None
+                    ):
+                        deferred_value_spec = get_as(
+                            arg_meta, key_deferred_value_spec, bool
+                        )
 
                     arguments.append(
                         value_spec_t.FunctionArgument(
@@ -245,6 +254,7 @@ def main() -> None:
                             type=convert_to_value_spec_type(in_argument.type_path),
                             on_null=in_argument.on_null,
                             extant=in_argument.extant,
+                            deferred_value_spec=deferred_value_spec,
                         )
                     )
 

pkgs/type_spec/value_spec/emit_python.py

@@ -29,6 +29,7 @@ from decimal import Decimal
 
 from main.base.types import value_spec_t, base_t
 
+from . import expression
 from .function_wrapper import ExtractorArgs, WrapArgs
 """
     )
@@ -70,6 +71,12 @@ def _emit_function_wrapper(function: value_spec_t.Function) -> str:
 
 {INDENT}def get_{argument.ref_name}_at(self, at: int) -> base_t.ExtJsonValue:
 {INDENT}{INDENT}return self._extract_at({index}, at)
+"""
+            )
+        elif argument.deferred_value_spec:
+            out.write(
+                f"""{INDENT}def get_{argument.ref_name}(self) -> expression.ParseNode | None:
+{INDENT}{INDENT}return self.extract_node({index})
 """
             )
         else:
@@ -213,6 +220,8 @@ def _emit_argument(argument: value_spec_t.FunctionArgument, indent: str) -> str:
     out.write(
         f"{sub_indent}extant=value_spec_t.ArgumentExtant.{argument.extant.name},\n"
     )
+    if argument.deferred_value_spec:
+        out.write(f"{sub_indent}deferred_value_spec={argument.deferred_value_spec},\n")
     out.write(f"{sub_indent}type={_emit_type(argument.type, sub_indent)},\n")
     out.write(f"{indent})")
 

uncountable/integration/cli.py

@@ -12,6 +12,7 @@ from uncountable.integration.queue_runner.command_server.command_client import (
     send_job_cancellation_message,
     send_job_queue_message,
     send_list_queued_jobs_message,
+    send_provision_webhook_message,
     send_retry_job_message,
 )
 from uncountable.integration.queue_runner.command_server.types import (
@@ -220,6 +221,33 @@ def register_retry_job_parser(
     retry_failed_jobs_parser.set_defaults(func=_handle_retry_job)
 
 
+def register_provision_webhook_parser(
+    sub_parser_manager: argparse._SubParsersAction,
+    parents: list[argparse.ArgumentParser],
+) -> None:
+    provision_parser = sub_parser_manager.add_parser(
+        "provision-webhook",
+        parents=parents,
+        help="Provision an Uncountable webhook job by creating its webhook entity and signature key",
+        description="Provision an Uncountable webhook job by creating its webhook entity and signature key",
+    )
+    provision_parser.add_argument(
+        "job_id",
+        type=str,
+        help="The id of the Uncountable webhook job to provision",
+    )
+
+    def _handle_provision_webhook(args: argparse.Namespace) -> None:
+        profile_name = send_provision_webhook_message(
+            job_id=args.job_id,
+            host=args.host,
+            port=get_local_admin_server_port(),
+        )
+        print(f"provisioned webhook {profile_name}/{args.job_id}")
+
+    provision_parser.set_defaults(func=_handle_provision_webhook)
+
+
 def main() -> None:
     logger = Logger(get_current_span())
 
@@ -242,6 +270,7 @@ def main() -> None:
     register_retry_job_parser(subparser_action, parents=[base_parser])
     register_list_queued_jobs(subparser_action, parents=[base_parser])
     register_cancel_queued_job_parser(subparser_action, parents=[base_parser])
+    register_provision_webhook_parser(subparser_action, parents=[base_parser])
 
     args = main_parser.parse_args()
     with logger.push_scope(args.command):

uncountable/integration/construct_client.py

@@ -1,8 +1,8 @@
 from uncountable.core import AuthDetailsApiKey, Client
 from uncountable.core.client import ClientConfig
 from uncountable.core.types import AuthDetailsAll, AuthDetailsOAuth
-from uncountable.integration.secret_retrieval.retrieve_secret import retrieve_secret
-from uncountable.integration.telemetry import JobLogger
+from uncountable.integration.secret_retrieval.basic_secret import retrieve_basic_secret
+from uncountable.integration.telemetry import Logger
 from uncountable.types import auth_retrieval_t
 from uncountable.types.client_config_t import RequestContext
 from uncountable.types.job_definition_t import (
@@ -13,16 +13,16 @@ from uncountable.types.job_definition_t import (
 def _construct_auth_details(profile_meta: ProfileMetadata) -> AuthDetailsAll:
     match profile_meta.auth_retrieval:
         case auth_retrieval_t.AuthRetrievalOAuth():
-            refresh_token = retrieve_secret(
+            refresh_token = retrieve_basic_secret(
                 profile_meta.auth_retrieval.refresh_token_secret,
                 profile_metadata=profile_meta,
             )
             return AuthDetailsOAuth(refresh_token=refresh_token)
         case auth_retrieval_t.AuthRetrievalBasic():
-            api_id = retrieve_secret(
+            api_id = retrieve_basic_secret(
                 profile_meta.auth_retrieval.api_id_secret, profile_metadata=profile_meta
             )
-            api_key = retrieve_secret(
+            api_key = retrieve_basic_secret(
                 profile_meta.auth_retrieval.api_key_secret,
                 profile_metadata=profile_meta,
             )
@@ -32,7 +32,7 @@ def _construct_auth_details(profile_meta: ProfileMetadata) -> AuthDetailsAll:
 
 def construct_uncountable_client(
     profile_meta: ProfileMetadata,
-    logger: JobLogger,
+    logger: Logger,
     *,
     request_context: RequestContext | None = None,
     headers: dict[str, str] | None = None,

uncountable/integration/job.py

@@ -25,8 +25,11 @@ from uncountable.integration.queue_runner.command_server.types import (
     CommandServerException,
 )
 from uncountable.integration.request_context import extract_request_context
-from uncountable.integration.secret_retrieval.retrieve_secret import retrieve_secret
+from uncountable.integration.secret_retrieval import retrieve_secret
 from uncountable.integration.telemetry import JobLogger
+from uncountable.integration.webhook_signature_key import (
+    webhook_signature_key_retrieval,
+)
 from uncountable.types import (
     base_t,
     job_definition_t,
@@ -166,6 +169,26 @@ class CustomHttpJob(Job[GenericHttpRequest]):
         return JobResult(success=False)
 
 
+def _resolve_webhook_signature_key(
+    *,
+    job_definition: job_definition_t.HttpJobDefinitionBase,
+    profile_meta: ProfileMetadata,
+) -> str:
+    if isinstance(job_definition, job_definition_t.WebhookJobDefinition):
+        return retrieve_secret(job_definition.signature_key_secret, profile_meta)
+    if isinstance(job_definition, job_definition_t.UncountableWebhookJobDefinition):
+        return retrieve_secret(
+            webhook_signature_key_retrieval(job_id=job_definition.id),
+            profile_meta,
+        )
+    raise HttpException.configuration_error(
+        message=(
+            "[internal] non-webhook job definition passed to webhook validation: "
+            f"{profile_meta.name}/{job_definition.id}"
+        )
+    )
+
+
 class WebhookJob[WPT](Job[webhook_job_t.WebhookEventPayload]):
     @property
     def payload_type(self) -> type[webhook_job_t.WebhookEventPayload]:
@@ -182,10 +205,8 @@ class WebhookJob[WPT](Job[webhook_job_t.WebhookEventPayload]):
         job_definition: job_definition_t.HttpJobDefinitionBase,
         profile_meta: ProfileMetadata,
     ) -> None:
-        assert isinstance(job_definition, job_definition_t.WebhookJobDefinition)
-        signature_key = retrieve_secret(
-            profile_metadata=profile_meta,
-            secret_retrieval=job_definition.signature_key_secret,
+        signature_key = _resolve_webhook_signature_key(
+            job_definition=job_definition, profile_meta=profile_meta
         )
         passed_signature = request.headers.get("Uncountable-Webhook-Signature")
         if passed_signature is None:
@@ -195,7 +216,7 @@ class WebhookJob[WPT](Job[webhook_job_t.WebhookEventPayload]):
             signature_key.encode("utf-8"), msg=request.body_bytes, digestmod="sha256"
         ).hexdigest()
 
-        if request_body_signature != passed_signature:
+        if not hmac.compare_digest(request_body_signature, passed_signature):
             raise HttpException.payload_failed_signature()
 
     @staticmethod

uncountable/integration/queue_runner/command_server/command_client.py

@@ -17,6 +17,8 @@ from uncountable.integration.queue_runner.command_server.protocol.command_server
     EnqueueJobResult,
     ListQueuedJobsRequest,
     ListQueuedJobsResult,
+    ProvisionWebhookRequest,
+    ProvisionWebhookResult,
     RetryJobRequest,
     RetryJobResult,
     VaccuumQueuedJobsRequest,
@@ -33,6 +35,7 @@ from .protocol.command_server_pb2_grpc import CommandServerStub
 
 _LOCAL_RPC_HOST = "localhost"
 _DEFAULT_MESSAGE_TIMEOUT_SECS = 2
+_PROVISION_WEBHOOK_TIMEOUT_SECS = 30
 
 
 @contextmanager
@@ -171,3 +174,20 @@ def send_vaccuum_queued_jobs_message(*, host: str = "localhost", port: int) -> N
 
         assert isinstance(response, VaccuumQueuedJobsResult)
         return None
+
+
+def send_provision_webhook_message(
+    *, job_id: str, host: str = "localhost", port: int
+) -> str:
+    with command_server_connection(host=host, port=port) as stub:
+        request = ProvisionWebhookRequest(job_id=job_id)
+
+        try:
+            response = stub.ProvisionWebhook(
+                request, timeout=_PROVISION_WEBHOOK_TIMEOUT_SECS
+            )
+        except grpc.RpcError as e:
+            raise ValueError(e.details())
+
+        assert isinstance(response, ProvisionWebhookResult)
+        return response.profile_name

uncountable/integration/queue_runner/command_server/command_server.py

@@ -19,11 +19,16 @@ from uncountable.integration.queue_runner.command_server.protocol.command_server
     EnqueueJobResult,
     ListQueuedJobsRequest,
     ListQueuedJobsResult,
+    ProvisionWebhookRequest,
+    ProvisionWebhookResult,
     RetryJobRequest,
     RetryJobResult,
     VaccuumQueuedJobsRequest,
     VaccuumQueuedJobsResult,
 )
+from uncountable.integration.queue_runner.command_server.provision_webhook import (
+    provision_webhook,
+)
 from uncountable.integration.queue_runner.command_server.types import (
     CommandCancelJob,
     CommandCancelJobResponse,
@@ -199,6 +204,20 @@ async def serve(command_queue: CommandQueue, datastore: DatastoreSqlite) -> None
             )
             return VaccuumQueuedJobsResult()
 
+        async def ProvisionWebhook(
+            self, request: ProvisionWebhookRequest, context: grpc_aio.ServicerContext
+        ) -> ProvisionWebhookResult:
+            loop = asyncio.get_running_loop()
+            profile_name = await loop.run_in_executor(
+                None, lambda: provision_webhook(job_id=request.job_id)
+            )
+            if profile_name is None:
+                await context.abort(
+                    StatusCode.INVALID_ARGUMENT,
+                    f"no Uncountable webhook job found with id {request.job_id}",
+                )
+            return ProvisionWebhookResult(profile_name=profile_name)
+
     add_CommandServerServicer_to_server(CommandServerHandler(), server)
 
     listen_addr = f"[::]:{get_local_admin_server_port()}"

uncountable/integration/queue_runner/command_server/protocol/command_server.proto

@@ -8,6 +8,7 @@ service CommandServer {
 	rpc ListQueuedJobs(ListQueuedJobsRequest) returns (ListQueuedJobsResult) {}
 	rpc VaccuumQueuedJobs(VaccuumQueuedJobsRequest) returns (VaccuumQueuedJobsResult) {}
 	rpc CancelJob(CancelJobRequest) returns (CancelJobResult) {}
+	rpc ProvisionWebhook(ProvisionWebhookRequest) returns (ProvisionWebhookResult) {}
 }
 
 message EnqueueJobRequest {
@@ -75,3 +76,11 @@ enum CancelJobStatus {
 message CancelJobResult {
 	CancelJobStatus status = 1;
 }
+
+message ProvisionWebhookRequest {
+	string job_id = 1;
+}
+
+message ProvisionWebhookResult {
+	string profile_name = 1;
+}

uncountable/integration/queue_runner/command_server/protocol/command_server_pb2.py

@@ -29,7 +29,7 @@ from google.protobuf import timestamp_pb2 as google_dot_protobuf_dot_timestamp__
 
 
 DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(
-    b'\nQuncountable/integration/queue_runner/command_server/protocol/command_server.proto\x1a\x1fgoogle/protobuf/timestamp.proto"E\n\x11\x45nqueueJobRequest\x12\x14\n\x0cjob_ref_name\x18\x01 \x01(\t\x12\x1a\n\x12serialized_payload\x18\x02 \x01(\t"H\n\x10\x45nqueueJobResult\x12\x1b\n\x13successfully_queued\x18\x01 \x01(\x08\x12\x17\n\x0fqueued_job_uuid\x18\x02 \x01(\t"\x1f\n\x0fRetryJobRequest\x12\x0c\n\x04uuid\x18\x01 \x01(\t"F\n\x0eRetryJobResult\x12\x1b\n\x13successfully_queued\x18\x01 \x01(\x08\x12\x17\n\x0fqueued_job_uuid\x18\x02 \x01(\t"\x1a\n\x18VaccuumQueuedJobsRequest"\x19\n\x17VaccuumQueuedJobsResult"\x14\n\x12\x43heckHealthRequest"$\n\x11\x43heckHealthResult\x12\x0f\n\x07success\x18\x01 \x01(\x08"\xc2\x01\n\x15ListQueuedJobsRequest\x12\x0e\n\x06offset\x18\x01 \x01(\r\x12\r\n\x05limit\x18\x02 \x01(\r\x12\x0e\n\x06status\x18\x03 \x01(\t\x12\x14\n\x0cjob_ref_name\x18\x04 \x01(\t\x12\x32\n\x0esubmitted_from\x18\x05 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x30\n\x0csubmitted_to\x18\x06 \x01(\x0b\x32\x1a.google.protobuf.Timestamp"\xf4\x01\n\x14ListQueuedJobsResult\x12\x43\n\x0bqueued_jobs\x18\x01 \x03(\x0b\x32..ListQueuedJobsResult.ListQueuedJobsResultItem\x1a\x96\x01\n\x18ListQueuedJobsResultItem\x12\x0c\n\x04uuid\x18\x01 \x01(\t\x12\x14\n\x0cjob_ref_name\x18\x02 \x01(\t\x12\x14\n\x0cnum_attempts\x18\x03 \x01(\x03\x12\x30\n\x0csubmitted_at\x18\x04 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x0e\n\x06status\x18\x05 \x01(\t"$\n\x10\x43\x61ncelJobRequest\x12\x10\n\x08job_uuid\x18\x01 \x01(\t"3\n\x0f\x43\x61ncelJobResult\x12 \n\x06status\x18\x01 \x01(\x0e\x32\x10.CancelJobStatus*Z\n\x0f\x43\x61ncelJobStatus\x12\x1a\n\x16\x43\x41NCELLED_WITH_RESTART\x10\x00\x12\x10\n\x0cNO_JOB_FOUND\x10\x01\x12\x19\n\x15JOB_ALREADY_COMPLETED\x10\x02\x32\xf4\x02\n\rCommandServer\x12\x35\n\nEnqueueJob\x12\x12.EnqueueJobRequest\x1a\x11.EnqueueJobResult"\x00\x12/\n\x08RetryJob\x12\x10.RetryJobRequest\x1a\x0f.RetryJobResult"\x00\x12\x38\n\x0b\x43heckHealth\x12\x13.CheckHealthRequest\x1a\x12.CheckHealthResult"\x00\x12\x41\n\x0eListQueuedJobs\x12\x16.ListQueuedJobsRequest\x1a\x15.ListQueuedJobsResult"\x00\x12J\n\x11VaccuumQueuedJobs\x12\x19.VaccuumQueuedJobsRequest\x1a\x18.VaccuumQueuedJobsResult"\x00\x12\x32\n\tCancelJob\x12\x11.CancelJobRequest\x1a\x10.CancelJobResult"\x00\x62\x06proto3'
+    b'\nQuncountable/integration/queue_runner/command_server/protocol/command_server.proto\x1a\x1fgoogle/protobuf/timestamp.proto"E\n\x11\x45nqueueJobRequest\x12\x14\n\x0cjob_ref_name\x18\x01 \x01(\t\x12\x1a\n\x12serialized_payload\x18\x02 \x01(\t"H\n\x10\x45nqueueJobResult\x12\x1b\n\x13successfully_queued\x18\x01 \x01(\x08\x12\x17\n\x0fqueued_job_uuid\x18\x02 \x01(\t"\x1f\n\x0fRetryJobRequest\x12\x0c\n\x04uuid\x18\x01 \x01(\t"F\n\x0eRetryJobResult\x12\x1b\n\x13successfully_queued\x18\x01 \x01(\x08\x12\x17\n\x0fqueued_job_uuid\x18\x02 \x01(\t"\x1a\n\x18VaccuumQueuedJobsRequest"\x19\n\x17VaccuumQueuedJobsResult"\x14\n\x12\x43heckHealthRequest"$\n\x11\x43heckHealthResult\x12\x0f\n\x07success\x18\x01 \x01(\x08"\xc2\x01\n\x15ListQueuedJobsRequest\x12\x0e\n\x06offset\x18\x01 \x01(\r\x12\r\n\x05limit\x18\x02 \x01(\r\x12\x0e\n\x06status\x18\x03 \x01(\t\x12\x14\n\x0cjob_ref_name\x18\x04 \x01(\t\x12\x32\n\x0esubmitted_from\x18\x05 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x30\n\x0csubmitted_to\x18\x06 \x01(\x0b\x32\x1a.google.protobuf.Timestamp"\xf4\x01\n\x14ListQueuedJobsResult\x12\x43\n\x0bqueued_jobs\x18\x01 \x03(\x0b\x32..ListQueuedJobsResult.ListQueuedJobsResultItem\x1a\x96\x01\n\x18ListQueuedJobsResultItem\x12\x0c\n\x04uuid\x18\x01 \x01(\t\x12\x14\n\x0cjob_ref_name\x18\x02 \x01(\t\x12\x14\n\x0cnum_attempts\x18\x03 \x01(\x03\x12\x30\n\x0csubmitted_at\x18\x04 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x0e\n\x06status\x18\x05 \x01(\t"$\n\x10\x43\x61ncelJobRequest\x12\x10\n\x08job_uuid\x18\x01 \x01(\t"3\n\x0f\x43\x61ncelJobResult\x12 \n\x06status\x18\x01 \x01(\x0e\x32\x10.CancelJobStatus")\n\x17ProvisionWebhookRequest\x12\x0e\n\x06job_id\x18\x01 \x01(\t".\n\x16ProvisionWebhookResult\x12\x14\n\x0cprofile_name\x18\x01 \x01(\t*Z\n\x0f\x43\x61ncelJobStatus\x12\x1a\n\x16\x43\x41NCELLED_WITH_RESTART\x10\x00\x12\x10\n\x0cNO_JOB_FOUND\x10\x01\x12\x19\n\x15JOB_ALREADY_COMPLETED\x10\x02\x32\xbd\x03\n\rCommandServer\x12\x35\n\nEnqueueJob\x12\x12.EnqueueJobRequest\x1a\x11.EnqueueJobResult"\x00\x12/\n\x08RetryJob\x12\x10.RetryJobRequest\x1a\x0f.RetryJobResult"\x00\x12\x38\n\x0b\x43heckHealth\x12\x13.CheckHealthRequest\x1a\x12.CheckHealthResult"\x00\x12\x41\n\x0eListQueuedJobs\x12\x16.ListQueuedJobsRequest\x1a\x15.ListQueuedJobsResult"\x00\x12J\n\x11VaccuumQueuedJobs\x12\x19.VaccuumQueuedJobsRequest\x1a\x18.VaccuumQueuedJobsResult"\x00\x12\x32\n\tCancelJob\x12\x11.CancelJobRequest\x1a\x10.CancelJobResult"\x00\x12G\n\x10ProvisionWebhook\x12\x18.ProvisionWebhookRequest\x1a\x17.ProvisionWebhookResult"\x00\x62\x06proto3'
 )
 
 _globals = globals()
@@ -41,8 +41,8 @@ _builder.BuildTopDescriptorsAndMessages(
 )
 if not _descriptor._USE_C_DESCRIPTORS:
     DESCRIPTOR._loaded_options = None
-    _globals["_CANCELJOBSTATUS"]._serialized_start = 1018
-    _globals["_CANCELJOBSTATUS"]._serialized_end = 1108
+    _globals["_CANCELJOBSTATUS"]._serialized_start = 1109
+    _globals["_CANCELJOBSTATUS"]._serialized_end = 1199
     _globals["_ENQUEUEJOBREQUEST"]._serialized_start = 118
     _globals["_ENQUEUEJOBREQUEST"]._serialized_end = 187
     _globals["_ENQUEUEJOBRESULT"]._serialized_start = 189
@@ -69,6 +69,10 @@ if not _descriptor._USE_C_DESCRIPTORS:
     _globals["_CANCELJOBREQUEST"]._serialized_end = 963
     _globals["_CANCELJOBRESULT"]._serialized_start = 965
     _globals["_CANCELJOBRESULT"]._serialized_end = 1016
-    _globals["_COMMANDSERVER"]._serialized_start = 1111
-    _globals["_COMMANDSERVER"]._serialized_end = 1483
+    _globals["_PROVISIONWEBHOOKREQUEST"]._serialized_start = 1018
+    _globals["_PROVISIONWEBHOOKREQUEST"]._serialized_end = 1059
+    _globals["_PROVISIONWEBHOOKRESULT"]._serialized_start = 1061
+    _globals["_PROVISIONWEBHOOKRESULT"]._serialized_end = 1107
+    _globals["_COMMANDSERVER"]._serialized_start = 1202
+    _globals["_COMMANDSERVER"]._serialized_end = 1647
 # @@protoc_insertion_point(module_scope)

uncountable/integration/queue_runner/command_server/protocol/command_server_pb2.pyi

@@ -161,3 +161,15 @@ class CancelJobResult(_message.Message):
     def __init__(
         self, status: _Optional[_Union[CancelJobStatus, str]] = ...
     ) -> None: ...
+
+class ProvisionWebhookRequest(_message.Message):
+    __slots__ = ("job_id",)
+    JOB_ID_FIELD_NUMBER: _ClassVar[int]
+    job_id: str
+    def __init__(self, job_id: _Optional[str] = ...) -> None: ...
+
+class ProvisionWebhookResult(_message.Message):
+    __slots__ = ("profile_name",)
+    PROFILE_NAME_FIELD_NUMBER: _ClassVar[int]
+    profile_name: str
+    def __init__(self, profile_name: _Optional[str] = ...) -> None: ...

uncountable/integration/queue_runner/command_server/protocol/command_server_pb2_grpc.py

@@ -78,6 +78,12 @@ class CommandServerStub(object):
             response_deserializer=uncountable_dot_integration_dot_queue__runner_dot_command__server_dot_protocol_dot_command__server__pb2.CancelJobResult.FromString,
             _registered_method=True,
         )
+        self.ProvisionWebhook = channel.unary_unary(
+            "/CommandServer/ProvisionWebhook",
+            request_serializer=uncountable_dot_integration_dot_queue__runner_dot_command__server_dot_protocol_dot_command__server__pb2.ProvisionWebhookRequest.SerializeToString,
+            response_deserializer=uncountable_dot_integration_dot_queue__runner_dot_command__server_dot_protocol_dot_command__server__pb2.ProvisionWebhookResult.FromString,
+            _registered_method=True,
+        )
 
 
 class CommandServerServicer(object):
@@ -119,6 +125,12 @@ class CommandServerServicer(object):
         context.set_details("Method not implemented!")
         raise NotImplementedError("Method not implemented!")
 
+    def ProvisionWebhook(self, request, context):
+        """Missing associated documentation comment in .proto file."""
+        context.set_code(grpc.StatusCode.UNIMPLEMENTED)
+        context.set_details("Method not implemented!")
+        raise NotImplementedError("Method not implemented!")
+
 
 def add_CommandServerServicer_to_server(servicer, server):
     rpc_method_handlers = {
@@ -152,6 +164,11 @@ def add_CommandServerServicer_to_server(servicer, server):
             request_deserializer=uncountable_dot_integration_dot_queue__runner_dot_command__server_dot_protocol_dot_command__server__pb2.CancelJobRequest.FromString,
             response_serializer=uncountable_dot_integration_dot_queue__runner_dot_command__server_dot_protocol_dot_command__server__pb2.CancelJobResult.SerializeToString,
         ),
+        "ProvisionWebhook": grpc.unary_unary_rpc_method_handler(
+            servicer.ProvisionWebhook,
+            request_deserializer=uncountable_dot_integration_dot_queue__runner_dot_command__server_dot_protocol_dot_command__server__pb2.ProvisionWebhookRequest.FromString,
+            response_serializer=uncountable_dot_integration_dot_queue__runner_dot_command__server_dot_protocol_dot_command__server__pb2.ProvisionWebhookResult.SerializeToString,
+        ),
     }
     generic_handler = grpc.method_handlers_generic_handler(
         "CommandServer", rpc_method_handlers
@@ -343,3 +360,33 @@ class CommandServer(object):
             metadata,
             _registered_method=True,
         )
+
+    @staticmethod
+    def ProvisionWebhook(
+        request,
+        target,
+        options=(),
+        channel_credentials=None,
+        call_credentials=None,
+        insecure=False,
+        compression=None,
+        wait_for_ready=None,
+        timeout=None,
+        metadata=None,
+    ):
+        return grpc.experimental.unary_unary(
+            request,
+            target,
+            "/CommandServer/ProvisionWebhook",
+            uncountable_dot_integration_dot_queue__runner_dot_command__server_dot_protocol_dot_command__server__pb2.ProvisionWebhookRequest.SerializeToString,
+            uncountable_dot_integration_dot_queue__runner_dot_command__server_dot_protocol_dot_command__server__pb2.ProvisionWebhookResult.FromString,
+            options,
+            channel_credentials,
+            insecure,
+            call_credentials,
+            compression,
+            wait_for_ready,
+            timeout,
+            metadata,
+            _registered_method=True,
+        )

uncountable/integration/queue_runner/command_server/provision_webhook.py

@@ -0,0 +1,28 @@
+from opentelemetry.trace import get_current_span
+
+from uncountable.integration.construct_client import construct_uncountable_client
+from uncountable.integration.scan_profiles import load_profiles
+from uncountable.integration.telemetry import Logger
+from uncountable.integration.webhook_signature_key import (
+    bootstrap_webhook_signature_key,
+)
+from uncountable.types import job_definition_t
+
+
+def provision_webhook(*, job_id: str) -> str | None:
+    logger = Logger(get_current_span())
+    for profile_metadata in load_profiles():
+        for job in profile_metadata.jobs:
+            if (
+                isinstance(job, job_definition_t.UncountableWebhookJobDefinition)
+                and job.id == job_id
+            ):
+                client = construct_uncountable_client(profile_metadata, logger)
+                bootstrap_webhook_signature_key(
+                    client=client,
+                    profile_metadata=profile_metadata,
+                    job_id=job.id,
+                    purpose=job.purpose,
+                )
+                return profile_metadata.name
+    return None

uncountable/integration/scan_profiles.py

@@ -43,6 +43,7 @@ def load_profiles() -> list[job_definition_t.ProfileMetadata]:
                                 name=profile_name,
                                 jobs=definition.jobs,
                                 base_url=environment_config.base_url,
+                                integration_server_base_url=environment_config.integration_server_base_url,
                                 app_base_url=environment_config.app_base_url,
                                 auth_retrieval=environment_config.auth_retrieval,
                                 client_options=environment_config.client_options,
@@ -58,6 +59,7 @@ def load_profiles() -> list[job_definition_t.ProfileMetadata]:
                         name=profile_name,
                         jobs=definition.jobs,
                         base_url=definition.base_url,
+                        integration_server_base_url=definition.integration_server_base_url,
                         app_base_url=definition.app_base_url,
                         auth_retrieval=definition.auth_retrieval,
                         client_options=definition.client_options,

uncountable/integration/secret_retrieval/__init__.py

@@ -1,3 +1,7 @@
+from .basic_secret import retrieve_basic_secret
 from .retrieve_secret import retrieve_secret
 
-__all__: list[str] = ["retrieve_secret"]
+__all__: list[str] = [
+    "retrieve_basic_secret",
+    "retrieve_secret",
+]

uncountable/integration/secret_retrieval/basic_secret.py

@@ -0,0 +1,101 @@
+import base64
+import functools
+import json
+import os
+from typing import assert_never
+
+import boto3
+
+from pkgs.argument_parser import CachedParser
+from uncountable.types import overrides_t
+from uncountable.types.job_definition_t import ProfileMetadata
+from uncountable.types.secret_retrieval_t import (
+    ClientSecretRetrieval,
+    SecretRetrieval,
+    SecretRetrievalAWS,
+    SecretRetrievalEnv,
+)
+
+
+class SecretRetrievalError(Exception):
+    def __init__(
+        self, secret_retrieval: SecretRetrieval, message: str | None = None
+    ) -> None:
+        self.secret_retrieval = secret_retrieval
+        self.message = message
+
+    def __str__(self) -> str:
+        append_message = ""
+        if self.message is not None:
+            append_message = f": {self.message}"
+        return f"{self.secret_retrieval.type} secret retrieval failed{append_message}"
+
+
+@functools.cache
+def _get_aws_secret(*, secret_name: str, region_name: str, sub_key: str | None) -> str:
+    client = boto3.client("secretsmanager", region_name=region_name)
+    response = client.get_secret_value(SecretId=secret_name)
+
+    if "SecretString" in response:
+        secret = response["SecretString"]
+    else:
+        secret = base64.b64decode(response["SecretBinary"])
+
+    value = json.loads(secret)
+
+    if sub_key is not None:
+        assert isinstance(value, dict)
+        return str(value[sub_key])
+    else:
+        return str(value)
+
+
+@functools.cache
+def _load_secret_overrides(profile_name: str) -> dict[SecretRetrieval, str]:
+    overrides_parser = CachedParser(overrides_t.Overrides)
+    profiles_module = os.environ["UNC_PROFILES_MODULE"]
+    try:
+        overrides = overrides_parser.parse_yaml_resource(
+            package=f"{profiles_module}.{profile_name}",
+            resource="local_overrides.yaml",
+        )
+        return {
+            override.secret_retrieval: override.value for override in overrides.secrets
+        }
+    except FileNotFoundError:
+        return {}
+
+
+def secret_override(
+    secret_retrieval: SecretRetrieval, profile_metadata: ProfileMetadata
+) -> str | None:
+    return _load_secret_overrides(profile_metadata.name).get(secret_retrieval)
+
+
+def retrieve_basic_secret(
+    secret_retrieval: ClientSecretRetrieval, profile_metadata: ProfileMetadata
+) -> str:
+    value_from_override = secret_override(secret_retrieval, profile_metadata)
+    if value_from_override is not None:
+        return value_from_override
+
+    match secret_retrieval:
+        case SecretRetrievalEnv():
+            env_name = f"UNC_{profile_metadata.name.upper()}_{secret_retrieval.env_key.upper()}"
+            secret = os.environ.get(env_name)
+            if secret is None:
+                raise SecretRetrievalError(
+                    secret_retrieval, f"environment variable {env_name} missing"
+                )
+            return secret
+        case SecretRetrievalAWS():
+            try:
+                return _get_aws_secret(
+                    secret_name=secret_retrieval.secret_name,
+                    region_name=secret_retrieval.region,
+                    sub_key=secret_retrieval.sub_key,
+                )
+            except Exception as e:
+                raise SecretRetrievalError(secret_retrieval) from e
+        case _:
+            assert_never(secret_retrieval)