altasigma 3.12.0.dev0__tar.gz → 3.12.0.dev2__tar.gz

{altasigma-3.12.0.dev0/altasigma.egg-info → altasigma-3.12.0.dev2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: altasigma
-Version: 3.12.0.dev0
+Version: 3.12.0.dev2
 Summary: Python helpers for data science and ML workflows on the AltaSigma AI platform
 Home-page: https://www.altasigma.com
 Author: AltaSigma GmbH

{altasigma-3.12.0.dev0 → altasigma-3.12.0.dev2}/altasigma/config/config.py

@@ -273,7 +273,10 @@ class ModuleConfig:
             except Exception as e:
                 logger.warning(f"Unexpected error deleting environment variable CLIENT_SECRET: {e}")
 
-        TokenRefresher().schedule_refresh()
+        # The job-token-manager sidecar owns the token lifecycle when present;
+        # only keep the mounted refresh_token alive when we're the refresher.
+        if not os.environ.get("AS_TOKEN_SOCKET"):
+            TokenRefresher().schedule_refresh()
 
 
 module_config = None

{altasigma-3.12.0.dev0 → altasigma-3.12.0.dev2}/altasigma/credentials/credential_utils.py

@@ -7,9 +7,11 @@ It supports both interactive authentication flows for notebooks and automated
 authentication for production environments.
 """
 import base64
+import http.client
 import json
 import logging
 import os
+import socket
 from pathlib import Path
 from time import sleep
 
@@ -21,6 +23,56 @@ from ..config.http_session import _http_session
 
 logger = logging.getLogger(__name__)
 
+# When set, the job runs alongside the job-token-manager sidecar, which performs the
+# broker token exchange. The package reads the delegated user access token from the
+# sidecar over this Unix domain socket; git credentials are fetched from the dashboard
+# with that token.
+_AS_TOKEN_SOCKET_ENV = "AS_TOKEN_SOCKET"
+_SIDECAR_TIMEOUT_SECONDS = 15
+
+
+class _UDSConnection(http.client.HTTPConnection):
+    """HTTPConnection that dials a Unix domain socket instead of a TCP host.
+
+    Lets us speak plain HTTP to the token sidecar (which listens on a local UDS)
+    using only the standard library — no extra dependency, and no TCP port is
+    ever opened.
+    """
+
+    def __init__(self, socket_path: str):
+        super().__init__("localhost", timeout=_SIDECAR_TIMEOUT_SECONDS)
+        self._socket_path = socket_path
+
+    def connect(self):
+        sock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
+        sock.settimeout(self.timeout)
+        sock.connect(self._socket_path)
+        self.sock = sock
+
+
+def _sidecar_get(path: str) -> dict:
+    """GET a JSON document from the token sidecar over the UDS."""
+    conn = _UDSConnection(os.environ[_AS_TOKEN_SOCKET_ENV])
+    try:
+        conn.request("GET", path)
+        response = conn.getresponse()
+        body = response.read()
+        if response.status != 200:
+            raise RuntimeError(
+                f"token sidecar returned {response.status} for {path}: "
+                f"{body.decode('utf-8', 'replace')}")
+        return json.loads(body)
+    finally:
+        conn.close()
+
+
+def _sidecar_access_token() -> str:
+    """Fetch the delegated user access token from the token sidecar."""
+    access_token = _sidecar_get("/user-token").get("access_token")
+    if not isinstance(access_token, str) or not access_token:
+        raise RuntimeError("token sidecar returned an empty or malformed access_token")
+    return access_token
+
 
 def _decode_jwt_azp(token: str) -> str:
     """
@@ -55,6 +107,95 @@ def _decode_jwt_azp(token: str) -> str:
         return ''
 
 
+class ReauthRequired(Exception):
+    """The dashboard responded that the user must (re)complete the git OAuth flow.
+
+    Headless callers (e.g. the notebook-git-api sidecar via the
+    ``ALTASIGMA_ACCESS_TOKEN`` env var) cannot perform that flow themselves —
+    they should propagate this exception to the layer that owns the user's UI
+    so it can surface ``authorize_url``. The interactive notebook path catches
+    this exception and polls until the user completes the flow in the browser.
+    """
+
+    def __init__(self, authorize_url: str):
+        self.authorize_url = authorize_url
+        super().__init__(
+            f"git OAuth required; complete the flow at {authorize_url}"
+        )
+
+
+def _fetch_git_credentials(host_url: str, access_token: str) -> tuple[str, str]:
+    """
+    Mint a fresh per-user git access token via the dashboard's git-oauth2 endpoint
+    and shape it into the (username, password) pair git's credential helper
+    protocol expects.
+
+    Pure HTTP — never blocks, never polls, never prints. The interactive
+    polling-on-reauth loop lives in ``_await_git_oauth_completion`` (used by the
+    notebook flow in ``CredentialUtils.get_git_credentials``); headless callers
+    receive ``ReauthRequired`` and decide for themselves how to surface it.
+
+    Consumers: ``CredentialUtils.get_git_credentials`` (this package, notebook
+    path) and the ``notebook-git-api`` sidecar (imports this symbol directly).
+
+    Args:
+        host_url (str): The AltaSigma installation host URL (no trailing slash needed).
+        access_token (str): A Keycloak bearer authorised for the dashboard.
+
+    Returns:
+        tuple: (username, password)
+
+    Raises:
+        ReauthRequired: User has no usable grant; carries the authorize URL.
+        Exception: Any other non-200 response.
+    """
+    headers = {'Authorization': f'Bearer {access_token}'}
+    url = f'{host_url}/api/git/oauth/access-token'
+    response = _http_session().get(url, headers=headers)
+
+    if _is_reauth_required(response):
+        # User has no usable grant (never connected, revoked, or expired refresh).
+        raise ReauthRequired(response.json()["details"]["authorizeUrl"])
+
+    if response.status_code == 200:
+        # Gitea-only for now: token goes in the password field, username can be
+        # anything non-empty. When other providers (GitLab, Bitbucket, ...) are
+        # added, the dashboard should return both fields and the helper should
+        # just forward them.
+        return "oauth2", response.json()["accessToken"]
+
+    raise Exception(
+        f"ERROR: Unexpected response from dashboard: {response.status_code}, {response.text}")
+
+
+def _is_reauth_required(response) -> bool:
+    """True if the response is the dashboard's 409 reauth-required signal."""
+    if response.status_code != 409:
+        return False
+    try:
+        return response.json().get("details", {}).get("reason") == "reauth_required"
+    except ValueError:
+        return False
+
+
+def _await_git_oauth_completion(host_url: str, access_token: str, authorize_url: str) -> tuple[str, str]:
+    """Interactive notebook helper: show the OAuth authorize URL once, then
+    poll the dashboard until the user completes the flow in the browser."""
+    # Plain URL — OSC 8 escapes show as garbage in Jupyter `!` cell output.
+    display_or_print(
+        msg_notebook=HTML(
+            f'Please authorize git access: '
+            f'<a href="{authorize_url}" target="_blank">{authorize_url}</a>'),
+        msg_other=f"Please authorize git access:\n{authorize_url}")
+
+    while True:
+        sleep(2)
+        try:
+            return _fetch_git_credentials(host_url, access_token)
+        except ReauthRequired:
+            continue
+
+
 class CredentialUtils:
     """
     Manages authentication and data source credential access.
@@ -114,7 +255,7 @@ class CredentialUtils:
                   - (accessKey, secretKey, expiresAt) for key-based sources
                   - (username, password, expiresAt) for password-based sources
         """
-        (access_token, refresh_token) = self._existing_token()
+        access_token = self._existing_token()
         header_get_cred = {'Authorization': f'Bearer {access_token}'}
         data_sources_request = _http_session().get(f'{self.dashboard_api_host}/dataman/datasources',
                                                    headers=header_get_cred)
@@ -146,43 +287,32 @@ class CredentialUtils:
             raise Exception(
                 f"ERROR: Unexpected response from dataman: {data_sources_request.status_code}, {data_sources_request.text}")
 
-    def get_git_credentials(self, host: str) -> tuple[str, str, str]:
+    def get_git_credentials(self) -> tuple[str, str]:
         """
-        Retrieve Gitea credentials for a given host from the AltaSigma dashboard.
+        Retrieve git credentials for the user's connected provider from the AltaSigma dashboard.
 
         Acquires a Keycloak bearer via the same token flow as `get_credentials`,
-        then asks the dashboard for the per-user Gitea username/password bound to
-        the requested host.
-
-        Args:
-            host (str): The git host the user wants credentials for (e.g. "gitea.altasigma.internal").
+        then asks the dashboard to mint a fresh per-user git access token for the
+        single dashboard-configured provider. If the user hasn't completed the
+        git OAuth flow yet (or their grant has expired), prints the authorize URL
+        and polls the dashboard until they complete the flow in the browser.
 
         Returns:
-            tuple: (username, password, expiresAt)
+            tuple: (username, password)
 
         Raises:
-            Exception: If the user has not connected the given git host in the dashboard (404),
-                       or if the dashboard returns any other non-2xx status.
+            Exception: If the dashboard returns any non-200 / non-reauth status.
         """
-        (access_token, _refresh_token) = self._existing_token()
-        headers = {'Authorization': f'Bearer {access_token}'}
-
-        url = f'{self.dashboard_api_host}/git/{host}/credentials'
-        response = _http_session().get(url, headers=headers)
-
-        if response.status_code == 200:
-            res = response.json()
-            display_or_print(
-                msg_notebook=HTML("Successfully obtained git credentials"),
-                msg_other="Successfully obtained git credentials")
-            return res["username"], res["password"], res["expiresAt"]
-        elif response.status_code == 404:
-            raise Exception(
-                f"Git host '{host}' is not connected in the AltaSigma dashboard. "
-                f"Connect Gitea under Account → Integrations and retry.")
-        else:
-            raise Exception(
-                f"ERROR: Unexpected response from dashboard: {response.status_code}, {response.text}")
+        access_token = self._existing_token()
+        try:
+            username, password = _fetch_git_credentials(self.dashboard_api_host, access_token)
+        except ReauthRequired as e:
+            username, password = _await_git_oauth_completion(
+                self.dashboard_api_host, access_token, e.authorize_url)
+        display_or_print(
+            msg_notebook=HTML("Successfully obtained git credentials"),
+            msg_other="Successfully obtained git credentials")
+        return username, password
 
     def _refresh_token(self, refresh_token: str) -> tuple[str, str]:
         """
@@ -242,7 +372,7 @@ class CredentialUtils:
         else:
             raise Exception(f"Could not obtain a new refresh token. {token_response}")
 
-    def _existing_token(self) -> tuple[str, str]:
+    def _existing_token(self) -> str:
         """
         Check for and validate existing authentication tokens.
 
@@ -255,11 +385,24 @@ class CredentialUtils:
         before refreshing to reduce unnecessary API calls.
 
         Returns:
-            tuple: A tuple containing (access_token, refresh_token)
+            str: The delegated user access token.
 
         Raises:
             Exception: If token retrieval or refresh fails, or if device auth cannot proceed
         """
+        # When running as a job with the token sidecar, the sidecar owns the
+        # token exchange and refresh. Read the delegated user token from it and
+        # never touch the mounted refresh token; the sidecar refreshes upstream.
+        #
+        # TODO: if the workbench ever runs the job-token-manager sidecar too, then
+        #   AS_TOKEN_SOCKET is always set and the self-managed *token* machinery below
+        #   becomes dead code: the device-auth flow, the mounted-refresh-token path,
+        #   `_refresh_token`, and the `TokenRefresher` thread. At that point this
+        #   function collapses to the sidecar read. (Git credentials are unaffected —
+        #   `_fetch_git_credentials` fetches them from the dashboard with the token,
+        #   whether or not the sidecar is present.)
+        if os.environ.get(_AS_TOKEN_SOCKET_ENV):
+            return _sidecar_access_token()
         current_client_id = os.environ['CLIENT_ID']
         # check if there are any saved tokens
         # For a deployment restart we expect to find a current token from the previous container (realtime module only). Normal jobs don't restart
@@ -290,10 +433,10 @@ class CredentialUtils:
                     os.remove(self._TMP_FILE_PATH)
                     if current_client_id == "altasigma-frontend":
                         raise RuntimeError("Device auth flow cannot be initiated with client ID 'altasigma-frontend'")
-                    return self._device_auth_flow()
+                    return self._device_auth_flow()[0]
 
                 try:
-                    return self._refresh_token(refresh_token)
+                    return self._refresh_token(refresh_token)[0]
                 except Exception as e:
                     os.remove(self._TMP_FILE_PATH)
                     raise e
@@ -309,11 +452,11 @@ class CredentialUtils:
                 # This is unexpected and a recovery is unlikely. Since we expect it to be a read-only mounted file, we can't delete it.
                 raise Exception(f"Refresh token is missing from {self._SECRET_FILE_PATH}")
             else:
-                return self._refresh_token(refresh_token)
+                return self._refresh_token(refresh_token)[0]
         # Expected case for the first call from the workbench with the device flow auth
         if current_client_id == "altasigma-frontend":
             raise RuntimeError("Device auth flow cannot be initiated with client ID 'altasigma-frontend'")
-        return self._device_auth_flow()
+        return self._device_auth_flow()[0]
 
     def _write_tokens_to_file(self, access_token: str, refresh_token: str):
         """
@@ -370,10 +513,11 @@ class CredentialUtils:
             device_response = response.json()
             device_code = device_response["device_code"]
             authorization_url = device_response["verification_uri_complete"]
+            # URL on its own line so terminals don't soft-wrap it mid-token.
             display_or_print(
                 msg_notebook=HTML(
                     f'Please authenticate using the following link: <a href="{authorization_url}" target="_blank">{authorization_url}</a>'),
-                msg_other=f'Please authenticate using the following link: {authorization_url}')
+                msg_other=f'Please authenticate using the following link:\n{authorization_url}')
         else:
             raise Exception(f"ERROR: Unexpected response {response.status_code}, {response.text}")
 
@@ -401,13 +545,16 @@ class CredentialUtils:
                         break
                 elif response.status_code == 400 and response.json().get('error') == 'authorization_pending':
                     if is_in_notebook():
+                        # Re-render URL + animated dots so the cell stays compact
+                        # (single output, not appended on every poll).
                         clear_output(wait=True)
-                    display_or_print(msg_notebook=HTML(
-                        f'Please authenticate using the following link: <a href="{authorization_url}" target="_blank">{authorization_url}</a>'),
-                        msg_other=f'Please authenticate using the following link: {authorization_url}')
-                    display_or_print(
-                        msg_notebook=HTML(f"Authorization pending {'.' * i}"),
-                        msg_other=f"Authorization pending {'.' * i}")
+                        display_or_print(msg_notebook=HTML(
+                            f'Please authenticate using the following link: <a href="{authorization_url}" target="_blank">{authorization_url}</a>'),
+                            msg_other=f'Please authenticate using the following link: {authorization_url}')
+                        display_or_print(
+                            msg_notebook=HTML(f"Authorization pending {'.' * i}"),
+                            msg_other=f"Authorization pending {'.' * i}")
+                    # Non-notebook: URL was printed once before the polling loop; stay quiet here.
                     i = (i + 1) % 4
                 else:
                     raise Exception(

{altasigma-3.12.0.dev0 → altasigma-3.12.0.dev2}/altasigma/git_helper.py

@@ -9,6 +9,14 @@ Installed as the console script `git-credential-altasigma`. Once a user runs
 `git config credential.helper altasigma`, git will resolve that to this script
 on PATH and invoke it with `get`, `store`, or `erase` subcommands.
 
+The helper resolves the dashboard bearer through ``CredentialUtils``
+(refresh-token cache + Keycloak refresh / device flow), so it is intended for
+interactive (notebook) callers where the device-auth URL can be shown to a
+human. Headless callers (e.g. the notebook-git-api sidecar) should call
+``altasigma.credentials.credential_utils._fetch_git_credentials`` directly from
+Python with the inbound bearer so ``ReauthRequired`` can be surfaced as a
+structured error.
+
 Stdout is reserved exclusively for the two `username=...` / `password=...` lines
 that git expects on success. Everything else (logs, errors) goes to stderr, and
 any failure exits non-zero with empty stdout so git treats it as "no credentials"
@@ -67,14 +75,22 @@ def main() -> int:
         logger.error("git credential request missing required 'host' field")
         return 1
 
+    # Redirect stdout -> stderr while fetching credentials so that any user-facing
+    # prints from CredentialUtils (e.g. the device-flow URL, "Authorization pending")
+    # don't pollute git's credential-helper input. Git parses each line on the
+    # helper's stdout as `key=value`; anything else makes git warn and close the pipe.
+    real_stdout = sys.stdout
+    sys.stdout = sys.stderr
     try:
-        username, password, _expires_at = CredentialUtils().get_git_credentials(host)
+        username, password = CredentialUtils().get_git_credentials()
     except Exception as exc:
         logger.error("failed to obtain git credentials for host %s: %s", host, exc)
         return 1
+    finally:
+        sys.stdout = real_stdout
 
-    sys.stdout.write(f"username={username}\n")
-    sys.stdout.write(f"password={password}\n")
+    real_stdout.write(f"username={username}\n")
+    real_stdout.write(f"password={password}\n")
     return 0
 
 

{altasigma-3.12.0.dev0 → altasigma-3.12.0.dev2}/altasigma/io/data_management.py

@@ -232,7 +232,7 @@ def get_datasource_by_code(datasource_code: str) -> DataSource:
     Raises:
         HTTPError: If the API request fails.
     """
-    access_token, _ = _credential_utils()._existing_token()
+    access_token = _credential_utils()._existing_token()
 
     response = _http_session().get(
         f"http://{_data_man_config().api_host}:{_data_man_config().api_port}/dataman/datasource/{datasource_code}",
@@ -255,7 +255,7 @@ def get_datasource(datasource_name: str) -> DataSource:
         ValueError: If no data source with the specified name exists.
         RuntimeError: If the API request fails.
     """
-    access_token, _ = _credential_utils()._existing_token()
+    access_token = _credential_utils()._existing_token()
 
     data_sources_request = _http_session().get(
         f"http://{_data_man_config().api_host}:{_data_man_config().api_port}/dataman/datasources",
@@ -287,7 +287,7 @@ def get_s3_credentials(datasource_code: str) -> S3Credentials:
     Raises:
         HTTPError: If the credential request fails.
     """
-    access_token, _ = _credential_utils()._existing_token()
+    access_token = _credential_utils()._existing_token()
     response = _http_session().get(
         f"http://{_data_man_config().api_host}:{_data_man_config().api_port}/dataman/s3/{datasource_code}/credentials",
         headers={"Authorization": f"Bearer {access_token}"})
@@ -311,7 +311,7 @@ def get_cassandra_credentials(datasource_code: str) -> CassandraCredentials:
         HTTPError: If the credential request fails.
         Exception: If the response contains errors.
     """
-    access_token, _ = _credential_utils()._existing_token()
+    access_token = _credential_utils()._existing_token()
     response = _http_session().get(
         f"http://{_data_man_config().api_host}:{_data_man_config().api_port}/dataman/cassandra/{datasource_code}/credentials",
         headers={"Authorization": f"Bearer {access_token}"})

{altasigma-3.12.0.dev0 → altasigma-3.12.0.dev2}/altasigma/jobsupervisor/job_supervisor_http.py

@@ -102,7 +102,7 @@ class JobSupervisorHTTP(JobSupervisorAbstract):
         }
         data = json.dumps(data_dict)
         logger.debug(f"Request body: {data}")
-        access_token, _ = _credential_utils()._existing_token()
+        access_token = _credential_utils()._existing_token()
         response = _http_session().post(
             url, data=data, headers={"Authorization": f"Bearer {access_token}", "Content-Type": "application/json"}
         )
@@ -164,7 +164,7 @@ class JobSupervisorHTTP(JobSupervisorAbstract):
             "message": reason,
         }
         data = json.dumps(data_dict)
-        access_token, _ = _credential_utils()._existing_token()
+        access_token = _credential_utils()._existing_token()
         response = _http_session().post(
             url, data=data, headers={"Authorization": f"Bearer {access_token}", "Content-Type": "application/json"}
         )
@@ -213,7 +213,7 @@ class JobSupervisorHTTP(JobSupervisorAbstract):
             data_dict, default=lambda x: x.__dict__
         )  # To decode objects as dicts
         logger.debug(f"Learning report data string: {data}")
-        access_token, _ = _credential_utils()._existing_token()
+        access_token = _credential_utils()._existing_token()
         response = _http_session().post(
             url, data=data, headers={"Authorization": f"Bearer {access_token}", "Content-Type": "application/json"}
         )
@@ -259,7 +259,7 @@ class JobSupervisorHTTP(JobSupervisorAbstract):
         data = json.dumps(data_dict)
         logger.debug(f"Request body: {data}")
 
-        access_token, _ = _credential_utils()._existing_token()
+        access_token = _credential_utils()._existing_token()
         response = _http_session().post(
             url, data=data, headers={"Authorization": f"Bearer {access_token}", "Content-Type": "application/json"}
         )

{altasigma-3.12.0.dev0 → altasigma-3.12.0.dev2}/altasigma/spark_session/spark_session_util.py

@@ -36,7 +36,7 @@ def _get_datasource_info(data_source_name: str):
         ValueError: If the datasource cannot be retrieved or does not exist.
     """
     host_url = os.environ['HOST_URL']
-    access_token, _ = _credential_utils()._existing_token()
+    access_token = _credential_utils()._existing_token()
 
     data_sources_request = _http_session().get(f"{host_url}/dataman/datasources",
                                                headers={"Authorization": f"Bearer {access_token}"})

{altasigma-3.12.0.dev0 → altasigma-3.12.0.dev2}/altasigma/utils/notebook.py

@@ -61,4 +61,6 @@ def display_or_print(msg_notebook, msg_other):
     if is_in_notebook():
         display(msg_notebook)
     else:
-        print(msg_other)
+        # flush=True so output reaches the parent (e.g. git invoking the credential helper)
+        # immediately, instead of sitting in Python's pipe buffer until process exit.
+        print(msg_other, flush=True)

{altasigma-3.12.0.dev0 → altasigma-3.12.0.dev2/altasigma.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: altasigma
-Version: 3.12.0.dev0
+Version: 3.12.0.dev2
 Summary: Python helpers for data science and ML workflows on the AltaSigma AI platform
 Home-page: https://www.altasigma.com
 Author: AltaSigma GmbH

{altasigma-3.12.0.dev0 → altasigma-3.12.0.dev2}/setup.py

@@ -2,7 +2,7 @@ from setuptools import setup, find_packages
 
 setup(
     name="altasigma",
-    version="3.12.0-dev0",
+    version="3.12.0-dev2",
     author="AltaSigma GmbH",
     author_email="pypi@altasigma.com",
     packages=find_packages(exclude=['altasigma.test', 'altasigma.test.*']),