ap-client 0.6.1.dev11__tar.gz → 0.6.1.dev12__tar.gz

{ap_client-0.6.1.dev11 → ap_client-0.6.1.dev12}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: ap-client
-Version: 0.6.1.dev11
+Version: 0.6.1.dev12
 Summary: Agent Platform API Client & CLI
 Requires-Python: >=3.10
 Requires-Dist: irepo-artifact==0.2.2

{ap_client-0.6.1.dev11 → ap_client-0.6.1.dev12}/ap_client/fs_transfer.py

@@ -24,6 +24,20 @@ from .ossutil_io import OssOperationError, _WriteBucket
 PART_SIZE = 8 * 1024 * 1024
 
 
+def _scope_denied(exc: Exception) -> bool:
+    """Only explicit scope refusals allow a more specific authorization request."""
+    seen = set()
+    cause = exc
+    while cause is not None and id(cause) not in seen:
+        seen.add(id(cause))
+        if getattr(cause, "biz_code", None) == 94023:  # user-data has no grant
+            return True
+        if getattr(cause, "status", None) == 403 and getattr(cause, "code", None) == "AccessDenied":
+            return True
+        cause = cause.__cause__
+    return False
+
+
 class TransferProgress:
     def __init__(self, description: str, enabled: bool | None):
         console = Console(stderr=True, markup=False, highlight=False)
@@ -125,6 +139,7 @@ class UserDataTransfer:
         from instance_repo._routing import _OperationIntent
 
         source = Path(source)
+        remote = self.repo._clean_user_data_subpath(remote)
         base = self._key(uid, remote)
         directory = source.is_dir()
         files = []
@@ -145,6 +160,7 @@ class UserDataTransfer:
         workers = min(self.concurrency, max(1, len(files)))
         part_threads = max(1, self.concurrency // workers)
         report = TransferProgress("Uploading", self.progress).start(sizes)
+        directory_scope = base.rstrip("/") + "/" if directory else None
 
         def transfer(item):
             local, key = item
@@ -170,14 +186,40 @@ class UserDataTransfer:
                 )
                 return {"key": key, "skipped": False}
 
-            # Exact object scope retains subdirectory/file ACL behavior.
-            result = self.content._execute_oss(_OperationIntent.NON_DOWNLOAD, key, None, upload)
+            scope = directory_scope or key
+            try:
+                result = self.content._execute_oss(
+                    _OperationIntent.NON_DOWNLOAD, scope, None, upload
+                )
+            except Exception as exc:
+                if scope == key or not _scope_denied(exc):
+                    raise
+                # A directory token may deny a reader subtree that contains a
+                # more specific writer grant. Re-authorize only this object;
+                # never ignore a Deny or request a broader ancestor token.
+                result = self.content._execute_oss(_OperationIntent.NON_DOWNLOAD, key, None, upload)
             report.finish(key, skipped=result["skipped"])
             return result
 
         with report:
             if not files:
                 return []
+            if directory_scope is not None:
+                try:
+                    # Prime the SDK's thread-safe, expiry-aware credential cache.
+                    # The server includes descendant reader Deny rules in this
+                    # directory policy. Never reconstruct that policy locally.
+                    credentials = self.content._credentials(directory_scope, None)
+                except Exception as exc:
+                    if not _scope_denied(exc):
+                        raise
+                    # File-only grants remain usable without a parent grant.
+                    directory_scope = None
+                else:
+                    if credentials.get("prefix") != directory_scope:
+                        raise OssOperationError(
+                            "Directory credential scope differs from the requested directory"
+                        )
             if workers == 1:
                 outcomes = [transfer(item) for item in files]
             else:

{ap_client-0.6.1.dev11 → ap_client-0.6.1.dev12}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "ap-client"
-version = "0.6.1.dev11"
+version = "0.6.1.dev12"
 description = "Agent Platform API Client & CLI"
 readme = { text = "A lightweight Python SDK and command line interface for Agent Platform. It provides helpers for configuring API access and managing templates, datasets, jobs, and groups.", content-type = "text/markdown" }
 requires-python = ">=3.10"