altasigma 3.18.0__tar.gz → 3.19.0.dev1__tar.gz

{altasigma-3.18.0/altasigma.egg-info → altasigma-3.19.0.dev1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: altasigma
-Version: 3.18.0
+Version: 3.19.0.dev1
 Summary: Python helpers for data science and ML workflows on the AltaSigma AI platform
 Home-page: https://www.altasigma.com
 Author: AltaSigma GmbH

{altasigma-3.18.0 → altasigma-3.19.0.dev1}/altasigma/__init__.py

@@ -35,6 +35,7 @@ from altasigma.credentials.credential_utils import (
     TokenSidecarDenied,
     TokenSidecarError,
     TokenSidecarUnavailable,
+    get_access_token,
 )
 from altasigma.initialize import AltaSigma, initialize
 from altasigma.io import inputs, outputs
@@ -78,6 +79,7 @@ __all__ = [
     "TokenSidecarError",
     "TokenSidecarUnavailable",
     "dataframe_to_table_report_data",
+    "get_access_token",
     "get_datasource",
     "initialize",
     "inputs",

{altasigma-3.18.0 → altasigma-3.19.0.dev1}/altasigma/credentials/credential_utils.py

@@ -416,11 +416,13 @@ def _fetch_git_credentials(host_url: str, access_token: str) -> tuple[str, str]:
         raise ReauthRequired(response.json()["details"]["authorizeUrl"])
 
     if response.status_code == 200:
-        # Gitea-only for now: token goes in the password field, username can be
-        # anything non-empty. When other providers (GitLab, Bitbucket, ...) are
-        # added, the dashboard should return both fields and the helper should
-        # just forward them.
-        return "oauth2", response.json()["accessToken"]
+        # The token goes in the password field. The dashboard also returns the
+        # git server username behind the grant when it knows it - forward it as
+        # the Basic-auth user (required convention on Bitbucket; any non-empty
+        # username works on Gitea). Fall back to a placeholder for older
+        # dashboards or when the dashboard could not resolve the username.
+        data = response.json()
+        return data.get("username") or "oauth2", data["accessToken"]
 
     raise Exception(
         f"ERROR: Unexpected response from dashboard: {response.status_code}, {response.text}")
@@ -580,6 +582,12 @@ class CredentialUtils:
         """
         Refresh an existing authentication token.
 
+        Called from outside this package as well: dashboard versions that predate the
+        token sidecar substitute a refresh token into the Python snippet code they
+        generate, and that generated code calls this method directly. Those call sites
+        live in user code on installations that were never upgraded, so no search of
+        this repository finds them.
+
         Uses the refresh token to obtain a new access token and refresh token pair
         from the authentication server.
 
@@ -906,3 +914,56 @@ def _credential_utils():
     else:
         _credential_utils_instance = CredentialUtils()
         return _credential_utils_instance
+
+
+def get_access_token() -> str:
+    """Return the access token for the current user.
+
+    The token authenticates requests against AltaSigma APIs on behalf of the user
+    the current job or workbench belongs to. It is short-lived and is renewed
+    elsewhere, so callers request one when they need it and neither cache nor
+    persist the value.
+
+    Returns:
+        str: The access token, to be sent as ``Authorization: Bearer <token>``.
+
+    Raises:
+        TokenSidecarUnavailable: If no token could be obtained for a reason that says
+            nothing about this user -- the service could not be reached, did not
+            answer in time, reported that it could not reach what it needs upstream,
+            or reported an error in a way that could not be understood. Retrying
+            later is the sensible response. Subclass of ``TokenSidecarError``.
+        TokenSidecarDenied: If the token service answered with a coded refusal that
+            will not change by retrying. A refusal concerning this user is the
+            typical case, but any coded terminal answer other than an upstream
+            failure is reported this way, so read the code rather than assuming the
+            user was rejected. Subclass of ``TokenSidecarError``.
+        TokenSidecarError: If a token service is in use and the token could not be
+            obtained for any other reason. Catch this one to catch all three.
+        KeyError: If ``HOST_URL`` is unset. This one applies everywhere, because it
+            is read when the credential handling is initialised -- before any of the
+            paths below is chosen -- on the first call that does so rather than on
+            every call. A ``KeyError`` can also arrive from those paths naming
+            something else, so read the missing name off the exception.
+
+    Note:
+        Apart from the ``KeyError`` above, only the ``TokenSidecar*`` exceptions are
+        a contract. They apply where a token service provides the token, which is
+        every installation running one.
+        Where none is present the token is obtained by other means, and a failure
+        then surfaces as whatever those paths raise: the types are unspecified,
+        they are not limited to the ones above, and the same type can arrive for an
+        unrelated reason.
+
+        Two further properties of that case are worth knowing before calling this
+        in a loop. Where a stored credential is available, each call spends a full
+        token refresh on it rather than reading a cached value, so asking for a
+        token per use is cheaper where a token service is present than where it is
+        not. Where none is available, the call may instead fall back to an
+        interactive authorisation flow: it then prints a URL and waits until the
+        user has confirmed access there, rather than returning promptly.
+
+        Where a token service is present but still starting up, a single call can
+        wait up to about two minutes before raising.
+    """
+    return _credential_utils()._existing_token()

{altasigma-3.18.0 → altasigma-3.19.0.dev1}/altasigma/git_helper.py

@@ -2,8 +2,9 @@
 Git credential helper for the AltaSigma workbench.
 
 Implements the git-credential-helper protocol (see `gitcredentials(7)`) so that
-git can authenticate against per-user Gitea hosts using credentials fetched on
-demand from the AltaSigma dashboard.
+git can authenticate against the git host of the AltaSigma installation — whichever
+provider it is backed by — using per-user credentials fetched on demand from the
+AltaSigma dashboard.
 
 Installed as the console script `git-credential-altasigma`. Once a user runs
 `git config credential.helper altasigma`, git will resolve that to this script

{altasigma-3.18.0 → altasigma-3.19.0.dev1/altasigma.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: altasigma
-Version: 3.18.0
+Version: 3.19.0.dev1
 Summary: Python helpers for data science and ML workflows on the AltaSigma AI platform
 Home-page: https://www.altasigma.com
 Author: AltaSigma GmbH

{altasigma-3.18.0 → altasigma-3.19.0.dev1}/setup.py

@@ -2,7 +2,7 @@ from setuptools import setup, find_packages
 
 setup(
     name="altasigma",
-    version="3.18.0",
+    version="3.19.0-dev1",
     author="AltaSigma GmbH",
     author_email="pypi@altasigma.com",
     packages=find_packages(exclude=['altasigma.test', 'altasigma.test.*']),