airbyte-internal-ops 0.5.1__tar.gz → 0.5.2__tar.gz

{airbyte_internal_ops-0.5.1 → airbyte_internal_ops-0.5.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: airbyte-internal-ops
-Version: 0.5.1
+Version: 0.5.2
 Summary: MCP and API interfaces that let the agents do the admin work
 Author-email: Aaron Steers <aj@airbyte.io>
 Keywords: admin,airbyte,api,mcp

{airbyte_internal_ops-0.5.1 → airbyte_internal_ops-0.5.2}/src/airbyte_ops_mcp/cli/cloud.py

@@ -65,6 +65,7 @@ from airbyte_ops_mcp.regression_tests.connection_fetcher import (
     save_connection_data_to_files,
 )
 from airbyte_ops_mcp.regression_tests.connection_secret_retriever import (
+    SecretRetrievalError,
     enrich_config_with_secrets,
     should_use_secret_retriever,
 )
@@ -847,13 +848,14 @@ def regression_test(
                     retrieval_reason="Regression test with USE_CONNECTION_SECRET_RETRIEVER=true",
                 )
                 print_success("Successfully retrieved unmasked secrets from database")
-            except Exception as e:
-                print_error(f"Failed to retrieve unmasked secrets: {e}")
+            except SecretRetrievalError as e:
+                write_github_output("success", False)
+                write_github_output("error", str(e))
                 exit_with_error(
-                    f"Failed to retrieve unmasked secrets: {e}\n"
-                    f"Unset USE_CONNECTION_SECRET_RETRIEVER or verify that the "
-                    f"{ENV_GCP_PROD_DB_ACCESS_CREDENTIALS} environment variable is set "
-                    f"with valid database credentials and that the Cloud SQL Proxy is running."
+                    f"{e}\n\n"
+                    f"This connection cannot be used for regression testing. "
+                    f"Please use a connection from a non-EU workspace, or use GSM-based "
+                    f"integration test credentials instead (by omitting --connection-id)."
                 )
 
         config_file, catalog_file = save_connection_data_to_files(

{airbyte_internal_ops-0.5.1 → airbyte_internal_ops-0.5.2}/src/airbyte_ops_mcp/regression_tests/__init__.py

@@ -10,6 +10,7 @@ from airbyte_ops_mcp.regression_tests.connection_fetcher import (
     fetch_connection_data,
 )
 from airbyte_ops_mcp.regression_tests.connection_secret_retriever import (
+    SecretRetrievalError,
     enrich_config_with_secrets,
     is_secret_retriever_enabled,
     retrieve_unmasked_config,
@@ -27,6 +28,7 @@ __all__ = [
     "ConnectionData",
     "ConnectorUnderTest",
     "ExecutionResult",
+    "SecretRetrievalError",
     "TargetOrControl",
     "enrich_config_with_secrets",
     "fetch_connection_data",

{airbyte_internal_ops-0.5.1 → airbyte_internal_ops-0.5.2}/src/airbyte_ops_mcp/regression_tests/connection_secret_retriever.py

@@ -107,9 +107,18 @@ def retrieve_unmasked_config(
     return None
 
 
+class SecretRetrievalError(Exception):
+    """Raised when secret retrieval fails.
+
+    This exception is raised when USE_CONNECTION_SECRET_RETRIEVER is enabled
+    but secrets cannot be retrieved (e.g., EU data residency restrictions).
+    """
+
+
 def enrich_config_with_secrets(
     connection_data: ConnectionData,
     retrieval_reason: str = "MCP live tests",
+    raise_on_failure: bool = True,
 ) -> ConnectionData:
     """Enrich connection data with unmasked secrets from internal retriever.
 
@@ -120,10 +129,16 @@ def enrich_config_with_secrets(
     Args:
         connection_data: The connection data to enrich.
         retrieval_reason: Reason for retrieval (for audit logging).
+        raise_on_failure: If True (default), raise SecretRetrievalError when
+            secrets cannot be retrieved. If False, return the original
+            connection_data with masked secrets (legacy behavior).
 
     Returns:
-        A new ConnectionData with unmasked config, or the original if
-        retrieval fails or is not available.
+        A new ConnectionData with unmasked config.
+
+    Raises:
+        SecretRetrievalError: If raise_on_failure is True and secrets cannot
+            be retrieved (e.g., due to EU data residency restrictions).
     """
     unmasked_config = retrieve_unmasked_config(
         connection_id=connection_data.connection_id,
@@ -131,10 +146,15 @@ def enrich_config_with_secrets(
     )
 
     if unmasked_config is None:
-        logger.info(
-            f"Could not retrieve unmasked config for {connection_data.connection_id}, "
-            "using masked config from Cloud API"
+        error_msg = (
+            "Could not retrieve unmasked secrets for connection "
+            f"{connection_data.connection_id}. This may be due to EU data "
+            "residency restrictions or database connectivity issues. "
+            "The connection's credentials cannot be used for regression testing."
         )
+        logger.warning(error_msg)
+        if raise_on_failure:
+            raise SecretRetrievalError(error_msg)
         return connection_data
 
     logger.info(