arraylake 0.31.0__tar.gz → 0.32.0__tar.gz

{arraylake-0.31.0 → arraylake-0.32.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: arraylake
-Version: 0.31.0
+Version: 0.32.0
 Summary: Python client for ArrayLake
 Project-URL: Documentation, https://docs.earthmover.io/
 Project-URL: Changelog, https://docs.earthmover.io/changelog

{arraylake-0.31.0 → arraylake-0.32.0}/arraylake/_version.py

@@ -28,7 +28,7 @@ version_tuple: VERSION_TUPLE
 commit_id: COMMIT_ID
 __commit_id__: COMMIT_ID
 
-__version__ = version = '0.31.0'
-__version_tuple__ = version_tuple = (0, 31, 0)
+__version__ = version = '0.32.0'
+__version_tuple__ = version_tuple = (0, 32, 0)
 
 __commit_id__ = commit_id = None

{arraylake-0.31.0 → arraylake-0.32.0}/arraylake/client.py

@@ -62,7 +62,7 @@ from arraylake.types import (
     BucketNickname,
     BucketPrefix,
     BucketResponse,
-    ExplicitVirtualChunkLocationResponse,
+    ExplicitVirtualChunkAccessPolicyResponse,
     GSCredentials,
     NewBucket,
     OptimizationConfig,
@@ -506,6 +506,13 @@ class AsyncClient:
         # Single API call to get everything needed to open the repo
         response = await mstore.open_repo(repo_name)
 
+        if response.status.mode == RepoOperationMode.OFFLINE:
+            raise ValueError(f"Repository is offline, check back after {response.status.estimated_end_time}")
+        elif response.status.mode == RepoOperationMode.MAINTENANCE:
+            warnings.warn(
+                f"Repository is in maintenance mode until {response.status.estimated_end_time}, do not attempt to write to the store"
+            )
+
         # Build icechunk storage from the response
         credential_refresh_func = self._maybe_get_credential_refresh_func_for_icechunk(
             bucket=response.repo_bucket, org=org, repo_name=repo_name
@@ -546,18 +553,23 @@ class AsyncClient:
                 forbid_configs_unsafe_for_virtual_chunks=True,
             )
         else:
-            # Use server-provided VCC credentials (currently only anonymous-access buckets)
+            # Use server-provided VCC credentials
             vcc_credentials = {}
             if response.virtual_chunk_credentials:
                 credentials_map: dict[str, icechunk.AnyS3Credential | icechunk.AnyGcsCredential | icechunk.AnyAzureCredential | None] = {}
                 for vcc_prefix, vcc_creds in response.virtual_chunk_credentials.items():
-                    # TODO: once non-anonymous VCC buckets are supported, build refresh closures here
-                    # using vcc_creds.org, vcc_creds.bucket_nickname, and vcc_creds.platform
-                    if vcc_creds.credentials is not None:
-                        raise NotImplementedError(
-                            f"Non-anonymous credentials for buckets are not yet supported for virtual chunks. (prefix: {vcc_prefix})."
-                        )
-                    credentials_map[vcc_prefix] = None
+                    # TODO: build refresh closures here using vcc_creds.org, vcc_creds.bucket_nickname,
+                    # and vcc_creds.platform so that credentials can be refreshed when they expire. (See https://github.com/earth-mover/arraylake/issues/5122)
+                    # TODO: support Azure virtual chunk credentials
+                    if isinstance(vcc_creds.credentials, AzureCredentials):
+                        raise NotImplementedError(f"Azure virtual chunk credentials are not yet supported. (prefix: {vcc_prefix}).")
+                    # TODO: fix return type of get_icechunk_container_credentials (returns GcsBearerCredential
+                    # which is not in icechunk's AnyGcsCredential union — icechunk typing gap)
+                    credentials_map[vcc_prefix] = get_icechunk_container_credentials(  # type: ignore[assignment]
+                        bucket_platform=vcc_creds.platform,
+                        credentials=vcc_creds.credentials,
+                        credential_refresh_func=None,
+                    )
                 vcc_credentials = icechunk.containers_credentials(credentials_map)
 
         ic_repo: IcechunkRepository = await IcechunkRepository.open_async(
@@ -1369,42 +1381,42 @@ class AsyncClient:
         bucket_id = await self._bucket_id_for_nickname(mstore, nickname)
         await mstore.delete_bucket_config(bucket_id)
 
-    async def set_virtual_chunk_location(
+    async def set_virtual_chunk_access_policy(
         self,
         org: OrgName,
         *,
         bucket_nickname: BucketNickname,
         subprefix: str = "",
         public: bool = False,
-    ) -> ExplicitVirtualChunkLocationResponse:
-        """Set an explicit virtual chunk location on this org.
+    ) -> ExplicitVirtualChunkAccessPolicyResponse:
+        """Set an explicit virtual chunk access policy on this org.
 
         Args:
             org: Name of the organization.
-            bucket_nickname: Nickname of the bucket config to associate with this VCL.
-            subprefix: Subprefix within the bucket for this VCL.
-            public: Whether this VCL allows public access.
+            bucket_nickname: Nickname of the bucket config to associate with this VCAP.
+            subprefix: Subprefix within the bucket for this VCAP.
+            public: Whether this VCAP allows public access.
         """
         mstore = self._metastore_for_org(org)
         bucket_id = await self._bucket_id_for_nickname(mstore, bucket_nickname)
-        vcl = await mstore.set_virtual_chunk_location(
+        vcap = await mstore.set_virtual_chunk_access_policy(
             bucket_id=str(bucket_id),
             subprefix=subprefix.strip("/"),
             public=public,
         )
-        return ExplicitVirtualChunkLocationResponse.model_validate(vcl.model_dump())
+        return ExplicitVirtualChunkAccessPolicyResponse.model_validate(vcap.model_dump())
 
-    async def list_virtual_chunk_locations(self, org: OrgName) -> list[ExplicitVirtualChunkLocationResponse]:
-        """List explicit virtual chunk locations on this org.
+    async def list_virtual_chunk_access_policies(self, org: OrgName) -> list[ExplicitVirtualChunkAccessPolicyResponse]:
+        """List explicit virtual chunk access policies on this org.
 
         Args:
             org: Name of the organization.
         """
         mstore = self._metastore_for_org(org)
-        vcls = await mstore.list_virtual_chunk_locations()
-        return [ExplicitVirtualChunkLocationResponse.model_validate(v.model_dump()) for v in vcls if v.use_case == "explicit"]
+        vcaps = await mstore.list_virtual_chunk_access_policies()
+        return [ExplicitVirtualChunkAccessPolicyResponse.model_validate(v.model_dump()) for v in vcaps if v.use_case == "explicit"]
 
-    async def delete_virtual_chunk_location(
+    async def delete_virtual_chunk_access_policy(
         self,
         org: OrgName,
         *,
@@ -1412,17 +1424,17 @@ class AsyncClient:
         subprefix: str,
         public: bool,
     ) -> None:
-        """Delete a virtual chunk location from this org (idempotent).
+        """Delete a virtual chunk access policy from this org (idempotent).
 
         Args:
             org: Name of the organization.
-            bucket_nickname: Nickname of the bucket config for the VCL.
-            subprefix: Subprefix of the VCL to delete.
-            public: Whether this VCL allows public access.
+            bucket_nickname: Nickname of the bucket config for the VCAP.
+            subprefix: Subprefix of the VCAP to delete.
+            public: Whether this VCAP allows public access.
         """
         mstore = self._metastore_for_org(org)
         bucket_id = await self._bucket_id_for_nickname(mstore, bucket_nickname)
-        await mstore.delete_virtual_chunk_location(
+        await mstore.delete_virtual_chunk_access_policy(
             bucket_id=str(bucket_id),
             subprefix=subprefix.strip("/"),
             public=public,
@@ -1940,33 +1952,33 @@ class Client:
         """
         return sync(self.aclient.delete_bucket_config, org=org, nickname=nickname, imsure=imsure, imreallysure=imreallysure)
 
-    def set_virtual_chunk_location(
+    def set_virtual_chunk_access_policy(
         self,
         org: OrgName,
         *,
         bucket_nickname: BucketNickname,
         subprefix: str,
         public: bool,
-    ) -> ExplicitVirtualChunkLocationResponse:
-        """Set an explicit virtual chunk location on this org.
+    ) -> ExplicitVirtualChunkAccessPolicyResponse:
+        """Set an explicit virtual chunk access policy on this org.
 
         Args:
             org: Name of the organization.
-            bucket_nickname: Nickname of the bucket config to associate with this VCL.
-            subprefix: Subprefix within the bucket for this VCL.
-            public: Whether this VCL allows public access.
+            bucket_nickname: Nickname of the bucket config to associate with this VCAP.
+            subprefix: Subprefix within the bucket for this VCAP.
+            public: Whether this VCAP allows public access.
         """
-        return sync(self.aclient.set_virtual_chunk_location, org, bucket_nickname=bucket_nickname, subprefix=subprefix, public=public)
+        return sync(self.aclient.set_virtual_chunk_access_policy, org, bucket_nickname=bucket_nickname, subprefix=subprefix, public=public)
 
-    def list_virtual_chunk_locations(self, org: OrgName) -> list[ExplicitVirtualChunkLocationResponse]:
-        """List explicit virtual chunk locations on this org.
+    def list_virtual_chunk_access_policies(self, org: OrgName) -> list[ExplicitVirtualChunkAccessPolicyResponse]:
+        """List explicit virtual chunk access policies on this org.
 
         Args:
             org: Name of the organization.
         """
-        return sync(self.aclient.list_virtual_chunk_locations, org)
+        return sync(self.aclient.list_virtual_chunk_access_policies, org)
 
-    def delete_virtual_chunk_location(
+    def delete_virtual_chunk_access_policy(
         self,
         org: OrgName,
         *,
@@ -1974,15 +1986,17 @@ class Client:
         subprefix: str,
         public: bool,
     ) -> None:
-        """Delete a virtual chunk location from this org.
+        """Delete a virtual chunk access policy from this org.
 
         Args:
             org: Name of the organization.
-            bucket_nickname: Nickname of the bucket config for the VCL.
-            subprefix: Subprefix of the VCL to delete.
-            public: Whether this VCL allows public access.
+            bucket_nickname: Nickname of the bucket config for the VCAP.
+            subprefix: Subprefix of the VCAP to delete.
+            public: Whether this VCAP allows public access.
         """
-        return sync(self.aclient.delete_virtual_chunk_location, org, bucket_nickname=bucket_nickname, subprefix=subprefix, public=public)
+        return sync(
+            self.aclient.delete_virtual_chunk_access_policy, org, bucket_nickname=bucket_nickname, subprefix=subprefix, public=public
+        )
 
     def login(self, *, browser: bool = False) -> None:
         """Login to ArrayLake.

{arraylake-0.31.0 → arraylake-0.32.0}/arraylake/metastore/http_metastore.py

@@ -33,7 +33,7 @@ from arraylake.types import (
     RepoOperationStatusResponse,
     S3Credentials,
     TokenAuthenticateBody,
-    VirtualChunkLocationResponse,
+    VirtualChunkAccessPolicyResponse,
 )
 
 # type adapters
@@ -41,7 +41,7 @@ LIST_DATABASES_ADAPTER = TypeAdapter(list[Repo])
 LIST_DATABASES_PAGINATED_ADAPTER = TypeAdapter(PaginatedResponse[Repo])
 LIST_BUCKETS_ADAPTER = TypeAdapter(list[BucketResponse])
 LIST_REPOS_FOR_BUCKET_ADAPTER = TypeAdapter(list[Repo])
-LIST_VCLS_PAGINATED_ADAPTER = TypeAdapter(PaginatedResponse[VirtualChunkLocationResponse])
+LIST_VCAPS_PAGINATED_ADAPTER = TypeAdapter(PaginatedResponse[VirtualChunkAccessPolicyResponse])
 
 
 @dataclass
@@ -328,19 +328,19 @@ class HttpMetastore(ArraylakeHttpClient, Metastore):
         )
         handle_response(response)
 
-    async def set_virtual_chunk_location(
+    async def set_virtual_chunk_access_policy(
         self,
         *,
         bucket_id: str,
         subprefix: str,
         public: bool,
-    ) -> VirtualChunkLocationResponse:
-        """Set an explicit virtual chunk location on this org (idempotent).
+    ) -> VirtualChunkAccessPolicyResponse:
+        """Set an explicit virtual chunk access policy on this org (idempotent).
 
         Args:
-            bucket_id: Bucket ID for this VCL.
-            subprefix: Subprefix within the bucket for this VCL.
-            public: Whether this VCL allows public access.
+            bucket_id: Bucket ID for this VCAP.
+            subprefix: Subprefix within the bucket for this VCAP.
+            public: Whether this VCAP allows public access.
         """
         payload: dict[str, str | bool] = {
             "use_case": "explicit",
@@ -350,35 +350,35 @@ class HttpMetastore(ArraylakeHttpClient, Metastore):
         }
         response = await self._request(
             "PUT",
-            f"/orgs/{self._config.org}/settings/virtual-chunk-locations",
+            f"/orgs/{self._config.org}/settings/virtual-chunk-access-policies",
             content=json.dumps(payload),
         )
         handle_response(response)
-        return VirtualChunkLocationResponse.model_validate_json(response.content)
+        return VirtualChunkAccessPolicyResponse.model_validate_json(response.content)
 
-    async def list_virtual_chunk_locations(self) -> list[VirtualChunkLocationResponse]:
-        """List all virtual chunk locations on this org."""
+    async def list_virtual_chunk_access_policies(self) -> list[VirtualChunkAccessPolicyResponse]:
+        """List all virtual chunk access policies on this org."""
         response = await self._request(
             "GET",
-            f"/orgs/{self._config.org}/settings/virtual-chunk-locations",
+            f"/orgs/{self._config.org}/settings/virtual-chunk-access-policies",
             params={"size": 100},
         )
         handle_response(response)
-        return LIST_VCLS_PAGINATED_ADAPTER.validate_json(response.content).items
+        return LIST_VCAPS_PAGINATED_ADAPTER.validate_json(response.content).items
 
-    async def delete_virtual_chunk_location(
+    async def delete_virtual_chunk_access_policy(
         self,
         *,
         bucket_id: str,
         subprefix: str,
         public: bool,
     ) -> None:
-        """Delete an explicit virtual chunk location from this org (idempotent).
+        """Delete an explicit virtual chunk access policy from this org (idempotent).
 
         Args:
-            bucket_id: Bucket ID of the VCL to delete.
-            subprefix: Subprefix of the VCL to delete.
-            public: Whether this VCL allows public access.
+            bucket_id: Bucket ID of the VCAP to delete.
+            subprefix: Subprefix of the VCAP to delete.
+            public: Whether this VCAP allows public access.
         """
         payload: dict[str, str | bool] = {
             "use_case": "explicit",
@@ -388,7 +388,7 @@ class HttpMetastore(ArraylakeHttpClient, Metastore):
         }
         response = await self._request(
             "DELETE",
-            f"/orgs/{self._config.org}/settings/virtual-chunk-locations",
+            f"/orgs/{self._config.org}/settings/virtual-chunk-access-policies",
             content=json.dumps(payload),
         )
         handle_response(response)

{arraylake-0.31.0 → arraylake-0.32.0}/arraylake/repos/icechunk/virtual.py

@@ -8,7 +8,6 @@ from arraylake.types import (
     ICECHUNK_ANY_CREDENTIAL,
     URI,
     UUID,
-    AnonymousAuth,
     BucketNickname,
     BucketPrefix,
     BucketResponse,
@@ -62,7 +61,7 @@ def get_icechunk_container_credentials(
         # https://github.com/earth-mover/icechunk/pull/776
         if credentials:
             assert isinstance(credentials, GSCredentials)
-            return icechunk.GcsBearerCredential(bearer=credentials.access_token, expires_after=credentials.expiration)
+            return icechunk.GcsCredentials.Static(icechunk.GcsStaticCredentials.BearerToken(credentials.access_token))
         else:
             return icechunk.GcsCredentials.Anonymous()
     else:
@@ -164,13 +163,6 @@ def forbid_unsafe_virtual_bucket_configs(bucket: BucketResponse, bucket_nickname
             f"But bucket {bucket_nickname} uses HMAC credentials."
         )
 
-    # TODO: in future we could relax this to allow buckets with delegated credentials
-    elif not isinstance(auth_method, AnonymousAuth):
-        raise ValueError(
-            "Cannot use virtual chunk references that refer to a bucket which does not support anonymous public access, "
-            f"But bucket {bucket_nickname} uses {auth_method.method if auth_method else 'unknown'} credentials."
-        )
-
 
 def forbid_unsafe_virtual_chunk_containers(
     container_prefixes: Iterable[BucketPrefix],
@@ -178,9 +170,6 @@ def forbid_unsafe_virtual_chunk_containers(
     """
     Raises if any virtual chunk container prefix is somehow unsafe.
     """
-    # TODO Once we allow auto-authorization of existing VCCs (needed for Flux), this fn will need to be changed.
-    # TODO It will need to actually fetch the existing VCCs, check they are all safe, and only then open the repo with authorization.
-
     for url_prefix in container_prefixes:
         if any(url_prefix.startswith(forbidden_prefix) for forbidden_prefix in FORBIDDEN_VIRTUAL_CHUNK_PREFIXES):
             raise ValueError(

{arraylake-0.31.0 → arraylake-0.32.0}/arraylake/types.py

@@ -615,8 +615,8 @@ class BucketResponse(Bucket):
     auth_config: AuthConfig | None = None
 
 
-class VirtualChunkLocationResponse(BaseModel):
-    """Response body for a virtual chunk location."""
+class VirtualChunkAccessPolicyResponse(BaseModel):
+    """Response body for a virtual chunk access policy."""
 
     use_case: str
     bucket_id: str
@@ -628,8 +628,8 @@ class VirtualChunkLocationResponse(BaseModel):
     created_by: str
 
 
-class ExplicitVirtualChunkLocationResponse(BaseModel):
-    """Response body for an explicit virtual chunk location."""
+class ExplicitVirtualChunkAccessPolicyResponse(BaseModel):
+    """Response body for an explicit virtual chunk access policy."""
 
     bucket_id: str
     subprefix: str
@@ -1162,3 +1162,5 @@ class OpenRepoResponse(BaseModel):
     author: Author
     # Principal (for user-agent string in icechunk storage)
     principal_id: str
+    # Repo operation status
+    status: RepoOperationStatusResponse

{arraylake-0.31.0 → arraylake-0.32.0}/tests/test_cli.py

@@ -119,15 +119,19 @@ def test_repo(invoke, helpers, sync_isolated_org_with_bucket) -> None:
     data = json.loads(result.stdout)
     assert data["mode"] == "online"
 
+    # set-status sets the mode via PUT (succeeds) then calls get_repo_object to
+    # display the result.  For HMAC repos, get_repo_object is now blocked when
+    # the repo is not online (409), so the CLI command exits with an error even
+    # though the mode was successfully changed.
     result = invoke(["repo", "set-status", repo_name, "offline"])
-    assert result.exit_code == 0
-    data = result.stdout
-    assert data.startswith("offline")
+    assert result.exit_code != 0
 
     result = invoke(["repo", "set-status", repo_name, "maintenance", "--output", "json"])
+    assert result.exit_code != 0
+
+    # Restore to online before deleting
+    result = invoke(["repo", "set-status", repo_name, "online"])
     assert result.exit_code == 0
-    data = json.loads(result.stdout)
-    assert data["mode"] == "maintenance"
 
     result = invoke(["repo", "delete", repo_name, "--confirm"])
     assert result.exit_code == 0

{arraylake-0.31.0 → arraylake-0.32.0}/tests/test_client.py

@@ -1017,6 +1017,42 @@ async def test_get_icechunk_container_credentials_from_bucket_delegated_sync(iso
         assert isinstance(cont_creds, icechunk.S3Credentials.Refreshable)
 
 
+@pytest.mark.asyncio
+async def test_credentials_offline_mode_raises(isolated_org, default_bucket, token, helpers):
+    """Test that repos in OFFLINE mode raise an error when requesting credentials."""
+    async with isolated_org(default_bucket()) as (org_name, buckets):
+        aclient = AsyncClient(token=token)
+        repo_name = f"{org_name}/{helpers.random_repo_id()}"
+
+        await aclient.create_repo(repo_name)
+
+        # Set repo to OFFLINE mode
+        _on, _rn = repo_name.split("/")
+        await helpers.set_repo_system_status(token, _on, _rn, RepoOperationMode.OFFLINE, "Testing offline mode", True)
+
+        # Attempting to get repo should raise due to credential fetch failure
+        with pytest.raises(ValueError, match="offline"):
+            await aclient.get_repo(repo_name)
+
+
+@pytest.mark.asyncio
+async def test_credentials_maintenance_mode_hmac_raises(isolated_org, default_bucket, token, helpers):
+    """Test that HMAC repos in MAINTENANCE mode raise an error (HMAC creds can't be scoped to read-only)."""
+    async with isolated_org(default_bucket()) as (org_name, buckets):
+        aclient = AsyncClient(token=token)
+        repo_name = f"{org_name}/{helpers.random_repo_id()}"
+
+        await aclient.create_repo(repo_name)
+
+        # Set repo to MAINTENANCE mode
+        _on, _rn = repo_name.split("/")
+        await helpers.set_repo_system_status(token, _on, _rn, RepoOperationMode.MAINTENANCE, "Testing maintenance mode", True)
+
+        # HMAC repos cannot provide read-only credentials, so the server returns 409
+        with pytest.raises(ArraylakeClientError, match="HMAC"):
+            await aclient.get_repo(repo_name)
+
+
 @pytest.mark.asyncio
 async def test_containers_credentials_for_buckets_async(isolated_org, default_bucket, token):
     bucket1 = default_bucket(nickname="mybucket1", name="bucket1")
@@ -1189,6 +1225,7 @@ def test_get_database(respx_mock, test_user) -> None:
                 "virtual_chunk_credentials": {},
                 "author": {"name": "Test User", "email": "test@example.com"},
                 "principal_id": principal_id,
+                "status": {"mode": "online", "initiated_by": {}, "estimated_end_time": None},
             },
         )
     )

{arraylake-0.31.0 → arraylake-0.32.0}/tests/test_performance.py

@@ -4,10 +4,19 @@ Performance regression tests for client operations.
 These tests track API call counts and patterns to detect performance regressions.
 """
 
+from contextlib import asynccontextmanager
+
 import pytest
 
 from arraylake import AsyncClient
 
+from tests.test_virtual_chunks import vcap_for_bucket
+
+
+@asynccontextmanager
+async def _noop_cm():
+    yield
+
 
 @pytest.mark.asyncio
 class TestGetRepoCallCount:
@@ -47,19 +56,22 @@ class TestGetRepoCallCount:
         async with isolated_org(repo_bucket, virtual_bucket) as (org_name, buckets):
             aclient = AsyncClient(token=token)
 
-            # Setup: create repo (not counted)
-            name = f"{org_name}/foo"
-            await aclient.create_repo(
-                name,
-                bucket_config_nickname=repo_bucket.nickname,
-                authorize_virtual_chunk_access=authorize_virtual_chunk_access if use_vccs else {},
-            )
-
-            # Count only get_repo calls
-            async with api_call_counter() as counter:
-                await aclient.get_repo(
-                    name, authorize_virtual_chunk_access=authorize_virtual_chunk_access if authorize_vccs_explicitly else None
+            # VCAP required for VCC validation when virtual chunks are used
+            vcap_cm = vcap_for_bucket(aclient, org_name, virtual_bucket) if use_vccs else _noop_cm()
+            async with vcap_cm:
+                # Setup: create repo (not counted)
+                name = f"{org_name}/foo"
+                await aclient.create_repo(
+                    name,
+                    bucket_config_nickname=repo_bucket.nickname,
+                    authorize_virtual_chunk_access=authorize_virtual_chunk_access if use_vccs else {},
                 )
 
+                # Count only get_repo calls
+                async with api_call_counter() as counter:
+                    await aclient.get_repo(
+                        name, authorize_virtual_chunk_access=authorize_virtual_chunk_access if authorize_vccs_explicitly else None
+                    )
+
         assert len(counter.tracked_calls) <= expected_num_calls, counter.call_log()
         assert counter.count_sequential_calls() <= expected_num_sequential_calls, counter.call_log()

{arraylake-0.31.0 → arraylake-0.32.0}/tests/test_subscriptions.py

@@ -41,6 +41,38 @@ async def create_subscription_repo(token: str, org_name: str, repo_name: str, ma
     return resp.json()
 
 
+async def create_filtered_subscription_repo(
+    token: str,
+    org_name: str,
+    repo_name: str,
+    marketplace_listing_id: str,
+    bucket_nickname: str,
+    target_filter: dict,
+):
+    """Create a filtered subscription repo in the specified org.
+
+    Filtered subscriptions have their own storage bucket and apply a target_filter
+    to select a subset of the provider's data.
+
+    Client does not yet support filtered subscription repo creation, so we use the lower-level HTTP client here.
+    """
+    client = ArraylakeHttpClient("http://localhost:8000", token=token)
+    body = {
+        "name": repo_name,
+        "description": "Filtered subscriber repo for subscription tests",
+        "create_mode": "subscribe",
+        "bucket_nickname": bucket_nickname,
+        "subscription": {
+            "marketplace_listing_id": str(marketplace_listing_id),
+            "subscription_type": "filtered",
+            "target_filter": target_filter,
+        },
+    }
+    resp = await client._request("POST", f"/orgs/{org_name}/repos", content=json.dumps(body))
+    assert resp.is_success, f"Failed to create filtered subscription repo in org {org_name}: {resp.status_code} {resp.content}"
+    return resp.json()
+
+
 async def run_subscription_workflow_test(token: str, parent_org: str, subscriber_org: str):
     """Helper function to test subscription workflow between a parent and subscriber repo.