adc-streaming 2.6.0__tar.gz → 2.7.0__tar.gz

{adc_streaming-2.6.0 → adc_streaming-2.7.0}/.github/workflows/build.yml

@@ -7,7 +7,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        python-version: ["3.9", "3.10", "3.11", "3.12", "3.13"]
+        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
 
     steps:
     - name: Check out the code

{adc_streaming-2.6.0 → adc_streaming-2.7.0}/Makefile

@@ -32,7 +32,7 @@ lint :
 # stop the build if there are Python syntax errors or undefined names
 	flake8 . --count --select=E9,F63,F7,F82 --show-source --statistics
 # exit-zero treats all errors as warnings
-	flake8 . --count --exit-zero --max-complexity=10 --max-line-length=100 --statistics
+	flake8 . --count --exit-zero --max-complexity=20 --max-line-length=100 --statistics
 
 .PHONY: format
 format :

{adc_streaming-2.6.0 → adc_streaming-2.7.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: adc-streaming
-Version: 2.6.0
+Version: 2.7.0
 Summary: Astronomy Data Commons streaming client libraries
 Home-page: https://github.com/astronomy-commons/adc-streaming
 Author: Astronomy Data Commons Team

adc_streaming-2.7.0/adc/auth.py

@@ -0,0 +1,147 @@
+#!/usr/bin/env python
+
+import base64
+from collections.abc import Mapping
+from enum import Enum
+import json
+import logging
+import subprocess
+
+import certifi
+
+logger = logging.getLogger("adc-streaming.auth")
+
+
+class SASLMethod(Enum):
+    """SASL method to use for authentication.
+    """
+
+    PLAIN = 1
+    SCRAM_SHA_256 = 2
+    SCRAM_SHA_512 = 3
+    OAUTHBEARER = 4
+
+    def __str__(self):
+        return self.name.replace("_", "-")
+
+
+class SASLAuth(object):
+    """Attach SASL-based authentication to a client.
+
+    Returns client-based auth options when called.
+
+    Parameters
+    ----------
+    user : `str`
+        Username to authenticate with.
+    password : `str`
+        Password to authenticate with.
+    ssl : `bool`, optional
+        Whether to enable SSL (enabled by default).
+    method : `SASLMethod`, optional
+        The SASL method to authenticate. The default is SASLMethod.OAUTHBEARER
+        if token_endpoint is provided, or SASLMethod.PLAIN otherwise.
+        See valid SASL methods in SASLMethod.
+    ssl_ca_location : `str`, optional
+        If using SSL via a self-signed cert, a path/location
+        to the certificate.
+    ssl_endpoint_identification_algorithm : `str`, optional
+        If using SSL, the algorithm used to verify that certificate is valid for the endpoint.
+    token_endpoint : `str`, optional
+        The OpenID Connect token endpoint URL.
+        Required for OAUTHBEARER / OpenID Connect, otherwise ignored.
+
+    """
+
+    def __init__(self, user, password, ssl=True, method=None, token_endpoint=None, **kwargs):
+        if method is None:
+            if token_endpoint is not None or "token_command" in kwargs:
+                method = SASLMethod.OAUTHBEARER
+            else:
+                method = SASLMethod.PLAIN
+
+        self._method = method
+
+        # set up SSL options
+        if ssl:
+            if "ssl_ca_location" in kwargs:
+                ssl_cert = kwargs["ssl_ca_location"]
+            else:
+                ssl_cert = certifi.where()
+
+            self._config = {
+                "security.protocol": "SASL_SSL",
+                "ssl.ca.location": ssl_cert,
+                "https.ca.location": ssl_cert,
+            }
+            if "ssl_endpoint_identification_algorithm" in kwargs:
+                self._config["ssl.endpoint.identification.algorithm"] = \
+                    kwargs["ssl_endpoint_identification_algorithm"]
+        else:
+            self._config = {"security.protocol": "SASL_PLAINTEXT"}
+
+        # set up SASL options
+        self._config["sasl.mechanism"] = str(self._method)
+        if method == SASLMethod.OAUTHBEARER:
+            if token_endpoint is not None:
+                self._config["sasl.oauthbearer.client.id"] = user
+                self._config["sasl.oauthbearer.client.secret"] = password
+                self._config["sasl.oauthbearer.method"] = "oidc"
+                self._config["sasl.oauthbearer.token.endpoint.url"] = token_endpoint
+            elif "token_command" in kwargs:
+                token_command = kwargs["token_command"]
+                self._config["sasl.oauthbearer.method"] = "default"
+                self._config["oauth_cb"] = lambda c: SASLAuth.external_token_callback(token_command)
+        else:
+            self._config["sasl.username"] = user
+            self._config["sasl.password"] = password
+
+    @staticmethod
+    def external_token_callback(command):
+        try:
+            presult = subprocess.run(command, shell=True, capture_output=True)
+            if presult.returncode != 0:
+                raise RuntimeError("Token callback command failed: " + presult.stderr)
+            rawdata = presult.stdout
+            # need to parse the resulting JWT enough to extract the expiration time
+            # we do no other validation, since downstream systems should be responsible
+            # for that already
+            sections = rawdata.split(b'.')
+            if len(sections) != 3:
+                raise RuntimeError("Token callback output does not appear to be a valid JWT")
+            try:
+                # The JWT spec mandates that base 64 padding be omitted, but
+                # base64.urlsafe_b64decode requires it, so we must put it back.
+                m = len(sections[1]) % 4
+                if m == 2:
+                    sections[1] += b"=="
+                elif m == 3:
+                    sections[1] += b"="
+                elif m == 1:
+                    raise RuntimeError("Token callback output is not valid base64 data")
+                claims = json.loads(base64.urlsafe_b64decode(sections[1]).decode("utf-8"))
+            except UnicodeDecodeError:
+                raise RuntimeError("Token callback output is not valid UTF-8 after base64 decoding")
+            except json.JSONDecodeError:
+                raise RuntimeError("Token callback output is not valid JSON after base64 and "
+                                   "UTF-8 decoding")
+            if not isinstance(claims, Mapping):
+                raise RuntimeError("Token callback output does not contain valid claims")
+            if "sub" not in claims:
+                raise RuntimeError("Token callback output does not contain an subject claim")
+            if "exp" not in claims:
+                raise RuntimeError("Token callback output does not contain an expiration claim")
+            exp_value = claims["exp"]
+            if not isinstance(exp_value, int) and not isinstance(exp_value, float):
+                raise RuntimeError("Token expiration value is not a number")
+            exp_value = float(exp_value)
+            try:
+                return (rawdata.decode("utf-8").strip(), exp_value, claims["sub"], {})
+            except UnicodeDecodeError:
+                raise RuntimeError("Token callback output is not valid UTF-8 data")
+        except Exception as ex:
+            logger.error(f"Token callback error: {ex}")
+            raise
+
+    def __call__(self):
+        return self._config

{adc_streaming-2.6.0 → adc_streaming-2.7.0}/adc/kafka.py

@@ -14,12 +14,12 @@ def parse_kafka_url(val):
     if parsed.scheme != "kafka":
         raise ValueError("invalid kafka URL: must start with 'kafka://'")
 
+    group_id = parsed.username
+    # intentionally ignore passwords embedded in URLs to discourage their use
     split_netloc = parsed.netloc.split("@", maxsplit=1)
     if len(split_netloc) == 2:
-        group_id = split_netloc[0]
         broker_addresses = split_netloc[1].split(",")
     else:
-        group_id = None
         broker_addresses = split_netloc[0].split(",")
 
     topics = parsed.path.lstrip("/")

{adc_streaming-2.6.0 → adc_streaming-2.7.0}/adc_streaming.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: adc-streaming
-Version: 2.6.0
+Version: 2.7.0
 Summary: Astronomy Data Commons streaming client libraries
 Home-page: https://github.com/astronomy-commons/adc-streaming
 Author: Astronomy Data Commons Team

{adc_streaming-2.6.0 → adc_streaming-2.7.0}/adc_streaming.egg-info/SOURCES.txt

@@ -18,6 +18,8 @@ adc_streaming.egg-info/SOURCES.txt
 adc_streaming.egg-info/dependency_links.txt
 adc_streaming.egg-info/not-zip-safe
 adc_streaming.egg-info/requires.txt
+adc_streaming.egg-info/scm_file_list.json
+adc_streaming.egg-info/scm_version.json
 adc_streaming.egg-info/top_level.txt
 doc/Makefile
 doc/conf.py

adc_streaming-2.7.0/adc_streaming.egg-info/scm_file_list.json

@@ -0,0 +1,32 @@
+{
+  "files": [
+    ".github/workflows/build.yml",
+    ".gitignore",
+    "LICENSE",
+    "Makefile",
+    "README.md",
+    "adc/__init__.py",
+    "adc/auth.py",
+    "adc/consumer.py",
+    "adc/errors.py",
+    "adc/io.py",
+    "adc/kafka.py",
+    "adc/producer.py",
+    "doc/Makefile",
+    "doc/_static/css/my_theme.css",
+    "doc/_templates/layout.html",
+    "doc/api/api.rst",
+    "doc/api/streaming.rst",
+    "doc/conf.py",
+    "doc/index.rst",
+    "doc/user/installation.rst",
+    "doc/user/quickstart.rst",
+    "pyproject.toml",
+    "recipe/meta.yaml",
+    "setup.cfg",
+    "setup.py",
+    "tests/test_auth.py",
+    "tests/test_kafka.py",
+    "tests/test_kafka_integration.py"
+  ]
+}

adc_streaming-2.7.0/adc_streaming.egg-info/scm_version.json

@@ -0,0 +1,8 @@
+{
+  "tag": "2.6.0",
+  "distance": 5,
+  "node": "ge0095abe7c2bd5a1dce1a913653bdc084fcd2496",
+  "dirty": false,
+  "branch": "external-token-support",
+  "node_date": "2026-08-28"
+}

{adc_streaming-2.6.0 → adc_streaming-2.7.0}/tests/test_auth.py

@@ -28,7 +28,16 @@ from adc.auth import SASLAuth
             'sasl.password': 'test-pass',
             'security.protocol': 'SASL_SSL'
         }
-    ]
+    ],
+    [
+        SASLAuth(
+            'test', '', token_command="generate_token"
+        ),
+        {
+            'sasl.mechanism': 'OAUTHBEARER',
+            'sasl.oauthbearer.method': 'default',
+        }
+    ],
 ])
 def test_auth(auth, expected_config):
     # Check that the key/value pairs in expected_config are a subset

{adc_streaming-2.6.0 → adc_streaming-2.7.0}/tests/test_kafka_integration.py

@@ -5,7 +5,11 @@ import unittest
 from datetime import datetime, timedelta
 from typing import List, Optional
 
-import docker
+try:
+	import docker
+	have_docker = True
+except ImportError:
+	have_docker = False
 import pytest
 
 import adc.consumer
@@ -17,6 +21,7 @@ logging.getLogger("adc-streaming").setLevel(logging.DEBUG)
 logger = logging.getLogger("adc-streaming.tests")
 
 
+@pytest.mark.skipif(not have_docker, reason="requires docker")
 @pytest.mark.integration_test
 class KafkaIntegrationTestCase(unittest.TestCase):
     """This test runs a Kafka broker in a Docker container, and makes sure that

adc_streaming-2.6.0/adc/auth.py

@@ -1,87 +0,0 @@
-#!/usr/bin/env python
-
-from enum import Enum
-
-import certifi
-
-
-class SASLMethod(Enum):
-    """SASL method to use for authentication.
-    """
-
-    PLAIN = 1
-    SCRAM_SHA_256 = 2
-    SCRAM_SHA_512 = 3
-    OAUTHBEARER = 4
-
-    def __str__(self):
-        return self.name.replace("_", "-")
-
-
-class SASLAuth(object):
-    """Attach SASL-based authentication to a client.
-
-    Returns client-based auth options when called.
-
-    Parameters
-    ----------
-    user : `str`
-        Username to authenticate with.
-    password : `str`
-        Password to authenticate with.
-    ssl : `bool`, optional
-        Whether to enable SSL (enabled by default).
-    method : `SASLMethod`, optional
-        The SASL method to authenticate. The default is SASLMethod.OAUTHBEARER
-        if token_endpoint is provided, or SASLMethod.PLAIN otherwise.
-        See valid SASL methods in SASLMethod.
-    ssl_ca_location : `str`, optional
-        If using SSL via a self-signed cert, a path/location
-        to the certificate.
-    ssl_endpoint_identification_algorithm : `str`, optional
-        If using SSL, the algorithm used to verify that certificate is valid for the endpoint.
-    token_endpoint : `str`, optional
-        The OpenID Connect token endpoint URL.
-        Required for OAUTHBEARER / OpenID Connect, otherwise ignored.
-
-    """
-
-    def __init__(self, user, password, ssl=True, method=None, token_endpoint=None, **kwargs):
-        if method is None:
-            if token_endpoint is None:
-                method = SASLMethod.PLAIN
-            else:
-                method = SASLMethod.OAUTHBEARER
-        self._method = method
-
-        # set up SSL options
-        if ssl:
-            if "ssl_ca_location" in kwargs:
-                ssl_cert = kwargs["ssl_ca_location"]
-            else:
-                ssl_cert = certifi.where()
-
-            self._config = {
-                "security.protocol": "SASL_SSL",
-                "ssl.ca.location": ssl_cert,
-                "https.ca.location": ssl_cert,
-            }
-            if "ssl_endpoint_identification_algorithm" in kwargs:
-                self._config["ssl.endpoint.identification.algorithm"] = \
-                    kwargs["ssl_endpoint_identification_algorithm"]
-        else:
-            self._config = {"security.protocol": "SASL_PLAINTEXT"}
-
-        # set up SASL options
-        self._config["sasl.mechanism"] = str(self._method)
-        if token_endpoint:
-            self._config["sasl.oauthbearer.client.id"] = user
-            self._config["sasl.oauthbearer.client.secret"] = password
-            self._config["sasl.oauthbearer.method"] = "oidc"
-            self._config["sasl.oauthbearer.token.endpoint.url"] = token_endpoint
-        else:
-            self._config["sasl.username"] = user
-            self._config["sasl.password"] = password
-
-    def __call__(self):
-        return self._config