altasigma 3.12.0.dev1__tar.gz → 3.13.0__tar.gz

{altasigma-3.12.0.dev1/altasigma.egg-info → altasigma-3.13.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: altasigma
-Version: 3.12.0.dev1
+Version: 3.13.0
 Summary: Python helpers for data science and ML workflows on the AltaSigma AI platform
 Home-page: https://www.altasigma.com
 Author: AltaSigma GmbH

{altasigma-3.12.0.dev1 → altasigma-3.13.0}/altasigma/config/config.py

@@ -273,10 +273,7 @@ class ModuleConfig:
             except Exception as e:
                 logger.warning(f"Unexpected error deleting environment variable CLIENT_SECRET: {e}")
 
-        # The job-token-manager sidecar owns the token lifecycle when present;
-        # only keep the mounted refresh_token alive when we're the refresher.
-        if not os.environ.get("AS_TOKEN_SOCKET"):
-            TokenRefresher().schedule_refresh()
+        TokenRefresher().schedule_refresh()
 
 
 module_config = None

{altasigma-3.12.0.dev1 → altasigma-3.13.0}/altasigma/credentials/credential_utils.py

@@ -7,11 +7,9 @@ It supports both interactive authentication flows for notebooks and automated
 authentication for production environments.
 """
 import base64
-import http.client
 import json
 import logging
 import os
-import socket
 from pathlib import Path
 from time import sleep
 
@@ -23,56 +21,6 @@ from ..config.http_session import _http_session
 
 logger = logging.getLogger(__name__)
 
-# When set, the job runs alongside the job-token-manager sidecar, which performs the
-# broker token exchange. The package reads the delegated user access token from the
-# sidecar over this Unix domain socket; git credentials are fetched from the dashboard
-# with that token.
-_AS_TOKEN_SOCKET_ENV = "AS_TOKEN_SOCKET"
-_SIDECAR_TIMEOUT_SECONDS = 15
-
-
-class _UDSConnection(http.client.HTTPConnection):
-    """HTTPConnection that dials a Unix domain socket instead of a TCP host.
-
-    Lets us speak plain HTTP to the token sidecar (which listens on a local UDS)
-    using only the standard library — no extra dependency, and no TCP port is
-    ever opened.
-    """
-
-    def __init__(self, socket_path: str):
-        super().__init__("localhost", timeout=_SIDECAR_TIMEOUT_SECONDS)
-        self._socket_path = socket_path
-
-    def connect(self):
-        sock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
-        sock.settimeout(self.timeout)
-        sock.connect(self._socket_path)
-        self.sock = sock
-
-
-def _sidecar_get(path: str) -> dict:
-    """GET a JSON document from the token sidecar over the UDS."""
-    conn = _UDSConnection(os.environ[_AS_TOKEN_SOCKET_ENV])
-    try:
-        conn.request("GET", path)
-        response = conn.getresponse()
-        body = response.read()
-        if response.status != 200:
-            raise RuntimeError(
-                f"token sidecar returned {response.status} for {path}: "
-                f"{body.decode('utf-8', 'replace')}")
-        return json.loads(body)
-    finally:
-        conn.close()
-
-
-def _sidecar_access_token() -> str:
-    """Fetch the delegated user access token from the token sidecar."""
-    access_token = _sidecar_get("/user-token").get("access_token")
-    if not isinstance(access_token, str) or not access_token:
-        raise RuntimeError("token sidecar returned an empty or malformed access_token")
-    return access_token
-
 
 def _decode_jwt_azp(token: str) -> str:
     """
@@ -150,7 +98,7 @@ def _fetch_git_credentials(host_url: str, access_token: str) -> tuple[str, str]:
         Exception: Any other non-200 response.
     """
     headers = {'Authorization': f'Bearer {access_token}'}
-    url = f'{host_url}/api/workbench/git-oauth2/access-token'
+    url = f'{host_url}/api/git/oauth/access-token'
     response = _http_session().get(url, headers=headers)
 
     if _is_reauth_required(response):
@@ -255,7 +203,7 @@ class CredentialUtils:
                   - (accessKey, secretKey, expiresAt) for key-based sources
                   - (username, password, expiresAt) for password-based sources
         """
-        access_token = self._existing_token()
+        (access_token, refresh_token) = self._existing_token()
         header_get_cred = {'Authorization': f'Bearer {access_token}'}
         data_sources_request = _http_session().get(f'{self.dashboard_api_host}/dataman/datasources',
                                                    headers=header_get_cred)
@@ -303,7 +251,7 @@ class CredentialUtils:
         Raises:
             Exception: If the dashboard returns any non-200 / non-reauth status.
         """
-        access_token = self._existing_token()
+        (access_token, _refresh_token) = self._existing_token()
         try:
             username, password = _fetch_git_credentials(self.dashboard_api_host, access_token)
         except ReauthRequired as e:
@@ -372,7 +320,7 @@ class CredentialUtils:
         else:
             raise Exception(f"Could not obtain a new refresh token. {token_response}")
 
-    def _existing_token(self) -> str:
+    def _existing_token(self) -> tuple[str, str]:
         """
         Check for and validate existing authentication tokens.
 
@@ -385,24 +333,11 @@ class CredentialUtils:
         before refreshing to reduce unnecessary API calls.
 
         Returns:
-            str: The delegated user access token.
+            tuple: A tuple containing (access_token, refresh_token)
 
         Raises:
             Exception: If token retrieval or refresh fails, or if device auth cannot proceed
         """
-        # When running as a job with the token sidecar, the sidecar owns the
-        # token exchange and refresh. Read the delegated user token from it and
-        # never touch the mounted refresh token; the sidecar refreshes upstream.
-        #
-        # TODO: if the workbench ever runs the job-token-manager sidecar too, then
-        #   AS_TOKEN_SOCKET is always set and the self-managed *token* machinery below
-        #   becomes dead code: the device-auth flow, the mounted-refresh-token path,
-        #   `_refresh_token`, and the `TokenRefresher` thread. At that point this
-        #   function collapses to the sidecar read. (Git credentials are unaffected —
-        #   `_fetch_git_credentials` fetches them from the dashboard with the token,
-        #   whether or not the sidecar is present.)
-        if os.environ.get(_AS_TOKEN_SOCKET_ENV):
-            return _sidecar_access_token()
         current_client_id = os.environ['CLIENT_ID']
         # check if there are any saved tokens
         # For a deployment restart we expect to find a current token from the previous container (realtime module only). Normal jobs don't restart
@@ -433,10 +368,10 @@ class CredentialUtils:
                     os.remove(self._TMP_FILE_PATH)
                     if current_client_id == "altasigma-frontend":
                         raise RuntimeError("Device auth flow cannot be initiated with client ID 'altasigma-frontend'")
-                    return self._device_auth_flow()[0]
+                    return self._device_auth_flow()
 
                 try:
-                    return self._refresh_token(refresh_token)[0]
+                    return self._refresh_token(refresh_token)
                 except Exception as e:
                     os.remove(self._TMP_FILE_PATH)
                     raise e
@@ -452,11 +387,11 @@ class CredentialUtils:
                 # This is unexpected and a recovery is unlikely. Since we expect it to be a read-only mounted file, we can't delete it.
                 raise Exception(f"Refresh token is missing from {self._SECRET_FILE_PATH}")
             else:
-                return self._refresh_token(refresh_token)[0]
+                return self._refresh_token(refresh_token)
         # Expected case for the first call from the workbench with the device flow auth
         if current_client_id == "altasigma-frontend":
             raise RuntimeError("Device auth flow cannot be initiated with client ID 'altasigma-frontend'")
-        return self._device_auth_flow()[0]
+        return self._device_auth_flow()
 
     def _write_tokens_to_file(self, access_token: str, refresh_token: str):
         """

{altasigma-3.12.0.dev1 → altasigma-3.13.0}/altasigma/io/data_management.py

@@ -232,7 +232,7 @@ def get_datasource_by_code(datasource_code: str) -> DataSource:
     Raises:
         HTTPError: If the API request fails.
     """
-    access_token = _credential_utils()._existing_token()
+    access_token, _ = _credential_utils()._existing_token()
 
     response = _http_session().get(
         f"http://{_data_man_config().api_host}:{_data_man_config().api_port}/dataman/datasource/{datasource_code}",
@@ -255,7 +255,7 @@ def get_datasource(datasource_name: str) -> DataSource:
         ValueError: If no data source with the specified name exists.
         RuntimeError: If the API request fails.
     """
-    access_token = _credential_utils()._existing_token()
+    access_token, _ = _credential_utils()._existing_token()
 
     data_sources_request = _http_session().get(
         f"http://{_data_man_config().api_host}:{_data_man_config().api_port}/dataman/datasources",
@@ -287,7 +287,7 @@ def get_s3_credentials(datasource_code: str) -> S3Credentials:
     Raises:
         HTTPError: If the credential request fails.
     """
-    access_token = _credential_utils()._existing_token()
+    access_token, _ = _credential_utils()._existing_token()
     response = _http_session().get(
         f"http://{_data_man_config().api_host}:{_data_man_config().api_port}/dataman/s3/{datasource_code}/credentials",
         headers={"Authorization": f"Bearer {access_token}"})
@@ -311,7 +311,7 @@ def get_cassandra_credentials(datasource_code: str) -> CassandraCredentials:
         HTTPError: If the credential request fails.
         Exception: If the response contains errors.
     """
-    access_token = _credential_utils()._existing_token()
+    access_token, _ = _credential_utils()._existing_token()
     response = _http_session().get(
         f"http://{_data_man_config().api_host}:{_data_man_config().api_port}/dataman/cassandra/{datasource_code}/credentials",
         headers={"Authorization": f"Bearer {access_token}"})

{altasigma-3.12.0.dev1 → altasigma-3.13.0}/altasigma/jobsupervisor/job_supervisor_http.py

@@ -102,7 +102,7 @@ class JobSupervisorHTTP(JobSupervisorAbstract):
         }
         data = json.dumps(data_dict)
         logger.debug(f"Request body: {data}")
-        access_token = _credential_utils()._existing_token()
+        access_token, _ = _credential_utils()._existing_token()
         response = _http_session().post(
             url, data=data, headers={"Authorization": f"Bearer {access_token}", "Content-Type": "application/json"}
         )
@@ -164,7 +164,7 @@ class JobSupervisorHTTP(JobSupervisorAbstract):
             "message": reason,
         }
         data = json.dumps(data_dict)
-        access_token = _credential_utils()._existing_token()
+        access_token, _ = _credential_utils()._existing_token()
         response = _http_session().post(
             url, data=data, headers={"Authorization": f"Bearer {access_token}", "Content-Type": "application/json"}
         )
@@ -213,7 +213,7 @@ class JobSupervisorHTTP(JobSupervisorAbstract):
             data_dict, default=lambda x: x.__dict__
         )  # To decode objects as dicts
         logger.debug(f"Learning report data string: {data}")
-        access_token = _credential_utils()._existing_token()
+        access_token, _ = _credential_utils()._existing_token()
         response = _http_session().post(
             url, data=data, headers={"Authorization": f"Bearer {access_token}", "Content-Type": "application/json"}
         )
@@ -259,7 +259,7 @@ class JobSupervisorHTTP(JobSupervisorAbstract):
         data = json.dumps(data_dict)
         logger.debug(f"Request body: {data}")
 
-        access_token = _credential_utils()._existing_token()
+        access_token, _ = _credential_utils()._existing_token()
         response = _http_session().post(
             url, data=data, headers={"Authorization": f"Bearer {access_token}", "Content-Type": "application/json"}
         )

{altasigma-3.12.0.dev1 → altasigma-3.13.0}/altasigma/spark_session/spark_session_util.py

@@ -36,7 +36,7 @@ def _get_datasource_info(data_source_name: str):
         ValueError: If the datasource cannot be retrieved or does not exist.
     """
     host_url = os.environ['HOST_URL']
-    access_token = _credential_utils()._existing_token()
+    access_token, _ = _credential_utils()._existing_token()
 
     data_sources_request = _http_session().get(f"{host_url}/dataman/datasources",
                                                headers={"Authorization": f"Bearer {access_token}"})

{altasigma-3.12.0.dev1 → altasigma-3.13.0/altasigma.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: altasigma
-Version: 3.12.0.dev1
+Version: 3.13.0
 Summary: Python helpers for data science and ML workflows on the AltaSigma AI platform
 Home-page: https://www.altasigma.com
 Author: AltaSigma GmbH

{altasigma-3.12.0.dev1 → altasigma-3.13.0}/setup.py

@@ -2,7 +2,7 @@ from setuptools import setup, find_packages
 
 setup(
     name="altasigma",
-    version="3.12.0-dev1",
+    version="3.13.0",
     author="AltaSigma GmbH",
     author_email="pypi@altasigma.com",
     packages=find_packages(exclude=['altasigma.test', 'altasigma.test.*']),