altasigma 3.12.0.dev0__tar.gz → 3.13.0__tar.gz

{altasigma-3.12.0.dev0/altasigma.egg-info → altasigma-3.13.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: altasigma
-Version: 3.12.0.dev0
+Version: 3.13.0
 Summary: Python helpers for data science and ML workflows on the AltaSigma AI platform
 Home-page: https://www.altasigma.com
 Author: AltaSigma GmbH

{altasigma-3.12.0.dev0 → altasigma-3.13.0}/altasigma/credentials/credential_utils.py

@@ -55,6 +55,95 @@ def _decode_jwt_azp(token: str) -> str:
         return ''
 
 
+class ReauthRequired(Exception):
+    """The dashboard responded that the user must (re)complete the git OAuth flow.
+
+    Headless callers (e.g. the notebook-git-api sidecar via the
+    ``ALTASIGMA_ACCESS_TOKEN`` env var) cannot perform that flow themselves —
+    they should propagate this exception to the layer that owns the user's UI
+    so it can surface ``authorize_url``. The interactive notebook path catches
+    this exception and polls until the user completes the flow in the browser.
+    """
+
+    def __init__(self, authorize_url: str):
+        self.authorize_url = authorize_url
+        super().__init__(
+            f"git OAuth required; complete the flow at {authorize_url}"
+        )
+
+
+def _fetch_git_credentials(host_url: str, access_token: str) -> tuple[str, str]:
+    """
+    Mint a fresh per-user git access token via the dashboard's git-oauth2 endpoint
+    and shape it into the (username, password) pair git's credential helper
+    protocol expects.
+
+    Pure HTTP — never blocks, never polls, never prints. The interactive
+    polling-on-reauth loop lives in ``_await_git_oauth_completion`` (used by the
+    notebook flow in ``CredentialUtils.get_git_credentials``); headless callers
+    receive ``ReauthRequired`` and decide for themselves how to surface it.
+
+    Consumers: ``CredentialUtils.get_git_credentials`` (this package, notebook
+    path) and the ``notebook-git-api`` sidecar (imports this symbol directly).
+
+    Args:
+        host_url (str): The AltaSigma installation host URL (no trailing slash needed).
+        access_token (str): A Keycloak bearer authorised for the dashboard.
+
+    Returns:
+        tuple: (username, password)
+
+    Raises:
+        ReauthRequired: User has no usable grant; carries the authorize URL.
+        Exception: Any other non-200 response.
+    """
+    headers = {'Authorization': f'Bearer {access_token}'}
+    url = f'{host_url}/api/git/oauth/access-token'
+    response = _http_session().get(url, headers=headers)
+
+    if _is_reauth_required(response):
+        # User has no usable grant (never connected, revoked, or expired refresh).
+        raise ReauthRequired(response.json()["details"]["authorizeUrl"])
+
+    if response.status_code == 200:
+        # Gitea-only for now: token goes in the password field, username can be
+        # anything non-empty. When other providers (GitLab, Bitbucket, ...) are
+        # added, the dashboard should return both fields and the helper should
+        # just forward them.
+        return "oauth2", response.json()["accessToken"]
+
+    raise Exception(
+        f"ERROR: Unexpected response from dashboard: {response.status_code}, {response.text}")
+
+
+def _is_reauth_required(response) -> bool:
+    """True if the response is the dashboard's 409 reauth-required signal."""
+    if response.status_code != 409:
+        return False
+    try:
+        return response.json().get("details", {}).get("reason") == "reauth_required"
+    except ValueError:
+        return False
+
+
+def _await_git_oauth_completion(host_url: str, access_token: str, authorize_url: str) -> tuple[str, str]:
+    """Interactive notebook helper: show the OAuth authorize URL once, then
+    poll the dashboard until the user completes the flow in the browser."""
+    # Plain URL — OSC 8 escapes show as garbage in Jupyter `!` cell output.
+    display_or_print(
+        msg_notebook=HTML(
+            f'Please authorize git access: '
+            f'<a href="{authorize_url}" target="_blank">{authorize_url}</a>'),
+        msg_other=f"Please authorize git access:\n{authorize_url}")
+
+    while True:
+        sleep(2)
+        try:
+            return _fetch_git_credentials(host_url, access_token)
+        except ReauthRequired:
+            continue
+
+
 class CredentialUtils:
     """
     Manages authentication and data source credential access.
@@ -146,43 +235,32 @@ class CredentialUtils:
             raise Exception(
                 f"ERROR: Unexpected response from dataman: {data_sources_request.status_code}, {data_sources_request.text}")
 
-    def get_git_credentials(self, host: str) -> tuple[str, str, str]:
+    def get_git_credentials(self) -> tuple[str, str]:
         """
-        Retrieve Gitea credentials for a given host from the AltaSigma dashboard.
+        Retrieve git credentials for the user's connected provider from the AltaSigma dashboard.
 
         Acquires a Keycloak bearer via the same token flow as `get_credentials`,
-        then asks the dashboard for the per-user Gitea username/password bound to
-        the requested host.
-
-        Args:
-            host (str): The git host the user wants credentials for (e.g. "gitea.altasigma.internal").
+        then asks the dashboard to mint a fresh per-user git access token for the
+        single dashboard-configured provider. If the user hasn't completed the
+        git OAuth flow yet (or their grant has expired), prints the authorize URL
+        and polls the dashboard until they complete the flow in the browser.
 
         Returns:
-            tuple: (username, password, expiresAt)
+            tuple: (username, password)
 
         Raises:
-            Exception: If the user has not connected the given git host in the dashboard (404),
-                       or if the dashboard returns any other non-2xx status.
+            Exception: If the dashboard returns any non-200 / non-reauth status.
         """
         (access_token, _refresh_token) = self._existing_token()
-        headers = {'Authorization': f'Bearer {access_token}'}
-
-        url = f'{self.dashboard_api_host}/git/{host}/credentials'
-        response = _http_session().get(url, headers=headers)
-
-        if response.status_code == 200:
-            res = response.json()
-            display_or_print(
-                msg_notebook=HTML("Successfully obtained git credentials"),
-                msg_other="Successfully obtained git credentials")
-            return res["username"], res["password"], res["expiresAt"]
-        elif response.status_code == 404:
-            raise Exception(
-                f"Git host '{host}' is not connected in the AltaSigma dashboard. "
-                f"Connect Gitea under Account → Integrations and retry.")
-        else:
-            raise Exception(
-                f"ERROR: Unexpected response from dashboard: {response.status_code}, {response.text}")
+        try:
+            username, password = _fetch_git_credentials(self.dashboard_api_host, access_token)
+        except ReauthRequired as e:
+            username, password = _await_git_oauth_completion(
+                self.dashboard_api_host, access_token, e.authorize_url)
+        display_or_print(
+            msg_notebook=HTML("Successfully obtained git credentials"),
+            msg_other="Successfully obtained git credentials")
+        return username, password
 
     def _refresh_token(self, refresh_token: str) -> tuple[str, str]:
         """
@@ -370,10 +448,11 @@ class CredentialUtils:
             device_response = response.json()
             device_code = device_response["device_code"]
             authorization_url = device_response["verification_uri_complete"]
+            # URL on its own line so terminals don't soft-wrap it mid-token.
             display_or_print(
                 msg_notebook=HTML(
                     f'Please authenticate using the following link: <a href="{authorization_url}" target="_blank">{authorization_url}</a>'),
-                msg_other=f'Please authenticate using the following link: {authorization_url}')
+                msg_other=f'Please authenticate using the following link:\n{authorization_url}')
         else:
             raise Exception(f"ERROR: Unexpected response {response.status_code}, {response.text}")
 
@@ -401,13 +480,16 @@ class CredentialUtils:
                         break
                 elif response.status_code == 400 and response.json().get('error') == 'authorization_pending':
                     if is_in_notebook():
+                        # Re-render URL + animated dots so the cell stays compact
+                        # (single output, not appended on every poll).
                         clear_output(wait=True)
-                    display_or_print(msg_notebook=HTML(
-                        f'Please authenticate using the following link: <a href="{authorization_url}" target="_blank">{authorization_url}</a>'),
-                        msg_other=f'Please authenticate using the following link: {authorization_url}')
-                    display_or_print(
-                        msg_notebook=HTML(f"Authorization pending {'.' * i}"),
-                        msg_other=f"Authorization pending {'.' * i}")
+                        display_or_print(msg_notebook=HTML(
+                            f'Please authenticate using the following link: <a href="{authorization_url}" target="_blank">{authorization_url}</a>'),
+                            msg_other=f'Please authenticate using the following link: {authorization_url}')
+                        display_or_print(
+                            msg_notebook=HTML(f"Authorization pending {'.' * i}"),
+                            msg_other=f"Authorization pending {'.' * i}")
+                    # Non-notebook: URL was printed once before the polling loop; stay quiet here.
                     i = (i + 1) % 4
                 else:
                     raise Exception(

{altasigma-3.12.0.dev0 → altasigma-3.13.0}/altasigma/git_helper.py

@@ -9,6 +9,14 @@ Installed as the console script `git-credential-altasigma`. Once a user runs
 `git config credential.helper altasigma`, git will resolve that to this script
 on PATH and invoke it with `get`, `store`, or `erase` subcommands.
 
+The helper resolves the dashboard bearer through ``CredentialUtils``
+(refresh-token cache + Keycloak refresh / device flow), so it is intended for
+interactive (notebook) callers where the device-auth URL can be shown to a
+human. Headless callers (e.g. the notebook-git-api sidecar) should call
+``altasigma.credentials.credential_utils._fetch_git_credentials`` directly from
+Python with the inbound bearer so ``ReauthRequired`` can be surfaced as a
+structured error.
+
 Stdout is reserved exclusively for the two `username=...` / `password=...` lines
 that git expects on success. Everything else (logs, errors) goes to stderr, and
 any failure exits non-zero with empty stdout so git treats it as "no credentials"
@@ -67,14 +75,22 @@ def main() -> int:
         logger.error("git credential request missing required 'host' field")
         return 1
 
+    # Redirect stdout -> stderr while fetching credentials so that any user-facing
+    # prints from CredentialUtils (e.g. the device-flow URL, "Authorization pending")
+    # don't pollute git's credential-helper input. Git parses each line on the
+    # helper's stdout as `key=value`; anything else makes git warn and close the pipe.
+    real_stdout = sys.stdout
+    sys.stdout = sys.stderr
     try:
-        username, password, _expires_at = CredentialUtils().get_git_credentials(host)
+        username, password = CredentialUtils().get_git_credentials()
     except Exception as exc:
         logger.error("failed to obtain git credentials for host %s: %s", host, exc)
         return 1
+    finally:
+        sys.stdout = real_stdout
 
-    sys.stdout.write(f"username={username}\n")
-    sys.stdout.write(f"password={password}\n")
+    real_stdout.write(f"username={username}\n")
+    real_stdout.write(f"password={password}\n")
     return 0
 
 

{altasigma-3.12.0.dev0 → altasigma-3.13.0}/altasigma/utils/notebook.py

@@ -61,4 +61,6 @@ def display_or_print(msg_notebook, msg_other):
     if is_in_notebook():
         display(msg_notebook)
     else:
-        print(msg_other)
+        # flush=True so output reaches the parent (e.g. git invoking the credential helper)
+        # immediately, instead of sitting in Python's pipe buffer until process exit.
+        print(msg_other, flush=True)

{altasigma-3.12.0.dev0 → altasigma-3.13.0/altasigma.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: altasigma
-Version: 3.12.0.dev0
+Version: 3.13.0
 Summary: Python helpers for data science and ML workflows on the AltaSigma AI platform
 Home-page: https://www.altasigma.com
 Author: AltaSigma GmbH

{altasigma-3.12.0.dev0 → altasigma-3.13.0}/setup.py

@@ -2,7 +2,7 @@ from setuptools import setup, find_packages
 
 setup(
     name="altasigma",
-    version="3.12.0-dev0",
+    version="3.13.0",
     author="AltaSigma GmbH",
     author_email="pypi@altasigma.com",
     packages=find_packages(exclude=['altasigma.test', 'altasigma.test.*']),