arraylake 1.0.1__tar.gz → 1.0.2__tar.gz

{arraylake-1.0.1 → arraylake-1.0.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: arraylake
-Version: 1.0.1
+Version: 1.0.2
 Summary: Python client for ArrayLake
 Project-URL: Documentation, https://docs.earthmover.io/
 Project-URL: Changelog, https://docs.earthmover.io/changelog
@@ -27,6 +27,8 @@ Requires-Dist: zarr<4.0,>=3.1.0
 Provides-Extra: maximal
 Requires-Dist: cf-xarray>=0.10.4; extra == 'maximal'
 Requires-Dist: xarray[accel,etc,io,parallel]>=2024.10.0; extra == 'maximal'
+Provides-Extra: obstore
+Requires-Dist: obstore>=0.9.2; extra == 'obstore'
 Provides-Extra: xarray
 Requires-Dist: cf-xarray>=0.10.4; extra == 'xarray'
 Requires-Dist: xarray>=2024.10.0; extra == 'xarray'

{arraylake-1.0.1 → arraylake-1.0.2}/arraylake/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '1.0.1'
-__version_tuple__ = version_tuple = (1, 0, 1)
+__version__ = version = '1.0.2'
+__version_tuple__ = version_tuple = (1, 0, 2)
 
 __commit_id__ = commit_id = None

{arraylake-1.0.1 → arraylake-1.0.2}/arraylake/client.py

@@ -18,7 +18,7 @@ import warnings
 from collections.abc import AsyncGenerator, Callable, Generator, Mapping
 from datetime import UTC
 from functools import partial
-from typing import Literal
+from typing import TYPE_CHECKING, Literal
 from urllib.parse import urlparse
 from uuid import UUID
 
@@ -83,6 +83,9 @@ from arraylake.types import (
 )
 from arraylake.types import Repo as RepoModel
 
+if TYPE_CHECKING:
+    import obstore as obs
+
 logger = get_logger(__name__)
 
 _VALID_NAME = r"(\w[\w\.\-_]+)"
@@ -243,52 +246,67 @@ class AsyncClient:
         azure_creds = await mstore.get_azure_container_credentials_from_repo(repo_name)
         return azure_creds
 
-    async def _get_s3_delegated_credentials_from_bucket(self, org: OrgName, nickname: BucketNickname) -> S3Credentials:
-        """Get delegated credentials for a S3 bucket. These credentials are scoped
-        to read-only.
+    async def _get_s3_delegated_credentials_from_bucket(
+        self, org: OrgName, nickname: BucketNickname, access: Literal["read", "write"] = "read"
+    ) -> S3Credentials:
+        """Get delegated credentials for an S3 bucket.
+
+        Defaults to read-only credentials. Pass ``access="write"`` to request read+write
+        credentials; the caller must have ``CAN_MANAGE_USERS`` on the org.
 
         Args:
             org: Name of the organization that the bucket belongs to.
             nickname: Nickname of the bucket.
+            access: ``"read"`` (default) or ``"write"``.
 
         Returns:
             S3Credentials: Temporary credentials for the S3 bucket.
         """
         mstore = self._metastore_for_org(org)
         bucket_id = await self._bucket_id_for_nickname(mstore, nickname)
-        s3_creds = await mstore.get_s3_bucket_credentials_from_bucket(bucket_id)
+        s3_creds = await mstore.get_s3_bucket_credentials_from_bucket(bucket_id, access=access)
         return s3_creds
 
-    async def _get_gcs_delegated_credentials_from_bucket(self, org: RepoName, nickname: BucketNickname) -> GSCredentials:
-        """Get delegated credentials for a GCS bucket. These credentials are scoped
-        to read-only.
+    async def _get_gcs_delegated_credentials_from_bucket(
+        self, org: RepoName, nickname: BucketNickname, access: Literal["read", "write"] = "read"
+    ) -> GSCredentials:
+        """Get delegated credentials for a GCS bucket.
+
+        Defaults to read-only credentials. Pass ``access="write"`` to request read+write
+        credentials; the caller must have ``CAN_MANAGE_USERS`` on the org.
 
         Args:
             org: Name of the organization that the bucket belongs to.
             nickname: Nickname of the bucket.
+            access: ``"read"`` (default) or ``"write"``.
 
         Returns:
             GSCredentials: Temporary credentials for the GCS bucket.
         """
         mstore = self._metastore_for_org(org)
         bucket_id = await self._bucket_id_for_nickname(mstore, nickname)
-        gcs_creds = await mstore.get_gs_bucket_credentials_from_bucket(bucket_id)
+        gcs_creds = await mstore.get_gs_bucket_credentials_from_bucket(bucket_id, access=access)
         return gcs_creds
 
-    async def _get_azure_delegated_credentials_from_bucket(self, org: RepoName, nickname: BucketNickname) -> AzureCredentials:
-        """Get delegated credentials for an Azure Blob Storage container. These credentials are scoped
-        to read-only.
+    async def _get_azure_delegated_credentials_from_bucket(
+        self, org: RepoName, nickname: BucketNickname, access: Literal["read", "write"] = "read"
+    ) -> AzureCredentials:
+        """Get delegated credentials for an Azure Blob Storage container.
+
+        Defaults to read-only credentials. Pass ``access="write"`` to request read+write
+        credentials; the caller must have ``CAN_MANAGE_USERS`` on the org.
 
         Args:
             org: Name of the organization that the bucket belongs to.
             nickname: Nickname of the bucket.
+            access: ``"read"`` (default) or ``"write"``.
 
         Returns:
             AzureCredentials: Temporary credentials for the Azure Blob Storage container.
         """
         mstore = self._metastore_for_org(org)
         bucket_id = await self._bucket_id_for_nickname(mstore, nickname)
-        azure_creds = await mstore.get_azure_container_credentials_from_bucket(bucket_id)
+        azure_creds = await mstore.get_azure_container_credentials_from_bucket(bucket_id, access=access)
         return azure_creds
 
     def _get_icechunk_s3_credentials_refresh_function_for_repo(self, org: OrgName, repo_name: RepoName) -> icechunk.S3StaticCredentials:
@@ -394,28 +412,32 @@ class AsyncClient:
         bucket: BucketResponse,
         org: OrgName,
         repo_name: RepoName | None,
+        bucket_access: Literal["read", "write"] = "read",
     ) -> TempCredentials | None:
         """Checks if the bucket is configured for delegated or HMAC credentials and gets the
         credentials if it is configured.
 
         Returns None if delegated or HMAC credentials are not configured for the bucket.
+
+        ``bucket_access`` only applies when ``repo_name`` is None (the bucket-scoped path);
+        repo-scoped credential fetches always inherit the caller's permissions on the repo.
         """
         if _use_delegated_credentials(bucket):
             if bucket.platform == "s3" or _is_r2_bucket(bucket):
                 if repo_name:
                     return await self._get_s3_delegated_credentials_from_repo(org, repo_name)
                 else:
-                    return await self._get_s3_delegated_credentials_from_bucket(org, bucket.nickname)
+                    return await self._get_s3_delegated_credentials_from_bucket(org, bucket.nickname, access=bucket_access)
             elif bucket.platform == "gs":
                 if repo_name:
                     return await self._get_gcs_delegated_credentials_from_repo(org, repo_name)
                 else:
-                    return await self._get_gcs_delegated_credentials_from_bucket(org, bucket.nickname)
+                    return await self._get_gcs_delegated_credentials_from_bucket(org, bucket.nickname, access=bucket_access)
             elif bucket.platform == "azure":
                 if repo_name:
                     return await self._get_azure_delegated_credentials_from_repo(org, repo_name)
                 else:
-                    return await self._get_azure_delegated_credentials_from_bucket(org, bucket.nickname)
+                    return await self._get_azure_delegated_credentials_from_bucket(org, bucket.nickname, access=bucket_access)
             else:
                 raise ValueError(f"Unsupported platform for delegated credentials: {bucket.platform}")
         elif _use_hmac_credentials(bucket):
@@ -1265,13 +1287,42 @@ class AsyncClient:
             raise BucketNotFoundError(nickname)
         return bucket_id
 
-    def _make_bucket_config(self, *, nickname: BucketNickname, uri: str, extra_config: dict | None, auth_config: dict | None) -> dict:
+    def _make_bucket_config(
+        self,
+        *,
+        nickname: BucketNickname,
+        uri: str,
+        region_name: str | None = None,
+        endpoint_url: str | None = None,
+        use_ssl: bool | None = None,
+        force_path_style: bool | None = None,
+        extra_config: dict | None = None,
+        auth_config: dict | None = None,
+    ) -> dict:
         if not nickname:
             raise ValueError("nickname must be specified if uri is provided.")
 
+        # Build extra_config from explicit parameters, with extra_config dict as fallback
+        # for backwards compatibility. Explicit parameters take precedence.
+        merged_extra_config: dict[str, str | bool] = {}
+        if extra_config is not None:
+            warnings.warn(
+                "Passing 'extra_config' as a dict is deprecated. "
+                "Use the explicit keyword arguments instead: region_name, endpoint_url, use_ssl, force_path_style.",
+                DeprecationWarning,
+                stacklevel=3,
+            )
+            merged_extra_config.update(extra_config)
+        if region_name is not None:
+            merged_extra_config["region_name"] = region_name
+        if endpoint_url is not None:
+            merged_extra_config["endpoint_url"] = endpoint_url
+        if use_ssl is not None:
+            merged_extra_config["use_ssl"] = use_ssl
+        if force_path_style is not None:
+            merged_extra_config["force_path_style"] = force_path_style
+
         # unpack optionals
-        if extra_config is None:
-            extra_config = {}
         if auth_config is None:
             auth_config = {"method": "anonymous"}
 
@@ -1280,7 +1331,7 @@ class AsyncClient:
         platform: Literal["s3", "gs", "s3-compatible", "azure"] | None = (
             "s3" if res.scheme == "s3" else "gs" if res.scheme == "gs" else "azure" if res.scheme == "az" else None
         )
-        if platform == "s3" and extra_config.get("endpoint_url"):
+        if platform == "s3" and merged_extra_config.get("endpoint_url"):
             platform = "s3-compatible"
         if platform not in ["s3", "gs", "s3-compatible", "azure"]:
             raise ValueError(f"Invalid platform {platform} for uri {uri}")
@@ -1314,26 +1365,62 @@ class AsyncClient:
             name=name,
             prefix=prefix,
             nickname=nickname,
-            extra_config=extra_config,
+            extra_config=merged_extra_config,
             auth_config=auth_config,
         )
 
     async def create_bucket_config(
-        self, *, org: OrgName, nickname: BucketNickname, uri: URI, extra_config: dict | None = None, auth_config: dict | None = None
+        self,
+        *,
+        org: OrgName,
+        nickname: BucketNickname,
+        uri: URI,
+        region_name: str | None = None,
+        endpoint_url: str | None = None,
+        use_ssl: bool | None = None,
+        force_path_style: bool | None = None,
+        extra_config: dict | None = None,
+        auth_config: dict | None = None,
     ) -> BucketResponse:
-        """Create a new bucket config entry
+        """Create a new bucket config entry.
 
         NOTE: This does not create any actual buckets in the object store.
 
         Args:
-            org: Name of the org
-            nickname: bucket nickname (example: ours3-bucket`)
+            org: Name of the org.
+            nickname: Bucket nickname (e.g. ``"my-s3-bucket"``).
             uri: The URI of the object store, of the form
-                platform://bucket_name[/prefix].
-            extra_config: dictionary of additional config to set on bucket config
-            auth_config: dictionary of auth parameters, must include "method" key, default is `{"method": "anonymous"}`
-        """
-        validated = NewBucket(**self._make_bucket_config(nickname=nickname, uri=uri, extra_config=extra_config, auth_config=auth_config))
+                ``platform://bucket_name[/prefix]`` (e.g. ``"s3://my-bucket/prefix"``).
+            region_name: Cloud region for the bucket (e.g. ``"us-west-2"``).
+                Required for S3 buckets.
+            endpoint_url: Custom endpoint URL for S3-compatible storage
+                (e.g. ``"https://account-id.r2.cloudflarestorage.com"``).
+                Setting this automatically marks the bucket as S3-compatible.
+            use_ssl: Whether to use HTTPS for storage connections.
+                Defaults to ``True``. Set to ``False`` for local or insecure endpoints.
+                Only applies to S3-type buckets.
+            force_path_style: Use path-style URLs (``endpoint/bucket``) instead of
+                virtual-hosted style (``bucket.endpoint``). Defaults to ``False`` when
+                ``use_ssl=True``, ``True`` when ``use_ssl=False``. Often required for
+                S3-compatible storage. Only applies to S3-type buckets.
+            extra_config: Dictionary of additional config options. Prefer using the
+                explicit parameters above when possible. Keys set here are overridden
+                by any explicit parameters that are also provided.
+            auth_config: Dictionary of auth parameters. Must include a ``"method"`` key.
+                Defaults to ``{"method": "anonymous"}``.
+        """
+        validated = NewBucket(
+            **self._make_bucket_config(
+                nickname=nickname,
+                uri=uri,
+                region_name=region_name,
+                endpoint_url=endpoint_url,
+                use_ssl=use_ssl,
+                force_path_style=force_path_style,
+                extra_config=extra_config,
+                auth_config=auth_config,
+            )
+        )
         mstore = self._metastore_for_org(org)
         bucket = await mstore.create_bucket_config(validated)
         return bucket
@@ -1360,6 +1447,42 @@ class AsyncClient:
         bucket = await mstore.get_bucket_config(bucket_id)
         return bucket
 
+    async def get_obstore_for_bucket(
+        self, *, org: OrgName, nickname: BucketNickname, access: Literal["read", "write"] = "read"
+    ) -> obs.store.ObjectStore:
+        """Get an obstore ObjectStore for the named bucket.
+
+        Resolves the bucket nickname, fetches scoped credentials, and returns an
+        ``obstore.store.S3Store``, ``GCSStore``, or ``AzureStore`` ready for use.
+
+        Defaults to read-only credentials. Pass ``access="write"`` to request a
+        read+write store; that variant requires ``CAN_MANAGE_USERS`` on the org.
+
+        Requires the optional ``obstore`` extra (``pip install arraylake[obstore]``).
+
+        Args:
+            org: Name of the org that owns the bucket.
+            nickname: Nickname of the bucket config.
+            access: ``"read"`` (default) or ``"write"``.
+
+        Returns:
+            An obstore ObjectStore scoped to the bucket and its configured prefix.
+
+        Raises:
+            ImportError: If the optional ``obstore`` extra is not installed.
+        """
+        # Fail fast before making any API calls if obstore isn't available.
+        try:
+            import obstore  # noqa: F401
+        except ImportError as e:
+            raise ImportError(
+                "The 'obstore' package is required for this functionality but is not installed. "
+                "Install it with: pip install 'arraylake[obstore]'"
+            ) from e
+        bucket = await self.get_bucket_config(org=org, nickname=nickname)
+        creds = await self._maybe_get_credentials_for_icechunk(bucket, org, repo_name=None, bucket_access=access)
+        return bucket.as_obstore_store(creds)
+
     async def list_bucket_configs(self, org: OrgName) -> list[BucketResponse]:
         """List all bucket config entries
 
@@ -1907,22 +2030,56 @@ class Client:
         return sync(self.aclient.delete_repo, name, imsure=imsure, imreallysure=imreallysure)
 
     def create_bucket_config(
-        self, *, org: OrgName, nickname: BucketNickname, uri: URI, extra_config: dict | None = None, auth_config: dict | None = None
+        self,
+        *,
+        org: OrgName,
+        nickname: BucketNickname,
+        uri: URI,
+        region_name: str | None = None,
+        endpoint_url: str | None = None,
+        use_ssl: bool | None = None,
+        force_path_style: bool | None = None,
+        extra_config: dict | None = None,
+        auth_config: dict | None = None,
     ) -> BucketResponse:
-        """Create a new bucket config entry
+        """Create a new bucket config entry.
 
         NOTE: This does not create any actual buckets in the object store.
 
         Args:
-            org: Name of the org
-            nickname: bucket nickname (example: our-s3-bucket)
+            org: Name of the org.
+            nickname: Bucket nickname (e.g. ``"my-s3-bucket"``).
             uri: The URI of the object store, of the form
-                platform://bucket_name[/prefix].
-            extra_config: dictionary of additional config to set on bucket config
-            auth_config: dictionary of auth parameters, must include "method" key, default is `{"method": "anonymous"}`
+                ``platform://bucket_name[/prefix]`` (e.g. ``"s3://my-bucket/prefix"``).
+            region_name: Cloud region for the bucket (e.g. ``"us-west-2"``).
+                Required for S3 buckets.
+            endpoint_url: Custom endpoint URL for S3-compatible storage
+                (e.g. ``"https://account-id.r2.cloudflarestorage.com"``).
+                Setting this automatically marks the bucket as S3-compatible.
+            use_ssl: Whether to use HTTPS for storage connections.
+                Defaults to ``True``. Set to ``False`` for local or insecure endpoints.
+                Only applies to S3-type buckets.
+            force_path_style: Use path-style URLs (``endpoint/bucket``) instead of
+                virtual-hosted style (``bucket.endpoint``). Defaults to ``False`` when
+                ``use_ssl=True``, ``True`` when ``use_ssl=False``. Often required for
+                S3-compatible storage. Only applies to S3-type buckets.
+            extra_config: Dictionary of additional config options. Prefer using the
+                explicit parameters above when possible. Keys set here are overridden
+                by any explicit parameters that are also provided.
+            auth_config: Dictionary of auth parameters. Must include a ``"method"`` key.
+                Defaults to ``{"method": "anonymous"}``.
         """
         return sync(
-            self.aclient.create_bucket_config, org=org, nickname=nickname, uri=uri, extra_config=extra_config, auth_config=auth_config
+            self.aclient.create_bucket_config,
+            org=org,
+            nickname=nickname,
+            uri=uri,
+            region_name=region_name,
+            endpoint_url=endpoint_url,
+            use_ssl=use_ssl,
+            force_path_style=force_path_style,
+            extra_config=extra_config,
+            auth_config=auth_config,
         )
 
     def set_default_bucket_config(self, *, org: OrgName, nickname: BucketNickname) -> None:
@@ -1943,6 +2100,26 @@ class Client:
         """
         return sync(self.aclient.get_bucket_config, org=org, nickname=nickname)
 
+    def get_obstore_for_bucket(
+        self, *, org: OrgName, nickname: BucketNickname, access: Literal["read", "write"] = "read"
+    ) -> obs.store.ObjectStore:
+        """Get an obstore ObjectStore for the named bucket.
+
+        Defaults to read-only credentials. Pass ``access="write"`` to request a
+        read+write store; that variant requires ``CAN_MANAGE_USERS`` on the org.
+
+        Requires the optional ``obstore`` extra (``pip install arraylake[obstore]``).
+
+        Args:
+            org: Name of the org that owns the bucket.
+            nickname: Nickname of the bucket config.
+            access: ``"read"`` (default) or ``"write"``.
+
+        Returns:
+            An obstore ObjectStore scoped to the bucket and its configured prefix.
+        """
+        return sync(self.aclient.get_obstore_for_bucket, org=org, nickname=nickname, access=access)
+
     def list_bucket_configs(self, org: OrgName) -> list[BucketResponse]:
         """List all buckets for the specified org
 

{arraylake-1.0.1 → arraylake-1.0.2}/arraylake/metastore/http_metastore.py

@@ -2,7 +2,7 @@ from __future__ import annotations
 
 import json
 from dataclasses import dataclass, field
-from typing import Any
+from typing import Any, Literal
 from uuid import UUID
 
 from pydantic import TypeAdapter
@@ -300,21 +300,32 @@ class HttpMetastore(ArraylakeHttpClient, Metastore):
         handle_response(response)
         return AzureCredentials.model_validate_json(response.content)
 
-    async def get_s3_bucket_credentials_from_bucket(self, bucket_id: UUID) -> S3Credentials:
-        """Gets the S3 credentials for a bucket. Credentials will be scoped to read-only."""
-        response = await self._request("GET", f"/orgs/{self._config.org}/buckets/{bucket_id}/credentials")
+    async def get_s3_bucket_credentials_from_bucket(self, bucket_id: UUID, access: Literal["read", "write"] = "read") -> S3Credentials:
+        """Gets the S3 credentials for a bucket.
+
+        Defaults to read-only credentials; pass ``access="write"`` for read+write.
+        """
+        response = await self._request("GET", f"/orgs/{self._config.org}/buckets/{bucket_id}/credentials", params={"access": access})
         handle_response(response)
         return S3Credentials.model_validate_json(response.content)
 
-    async def get_gs_bucket_credentials_from_bucket(self, bucket_id: UUID) -> GSCredentials:
-        """Gets the GCS credentials for a bucket. Credentials will be scoped to read-only."""
-        response = await self._request("GET", f"/orgs/{self._config.org}/buckets/{bucket_id}/credentials")
+    async def get_gs_bucket_credentials_from_bucket(self, bucket_id: UUID, access: Literal["read", "write"] = "read") -> GSCredentials:
+        """Gets the GCS credentials for a bucket.
+
+        Defaults to read-only credentials; pass ``access="write"`` for read+write.
+        """
+        response = await self._request("GET", f"/orgs/{self._config.org}/buckets/{bucket_id}/credentials", params={"access": access})
         handle_response(response)
         return GSCredentials.model_validate_json(response.content)
 
-    async def get_azure_container_credentials_from_bucket(self, bucket_id: UUID) -> AzureCredentials:
-        """Gets the Azure credentials for a bucket. Credentials will be scoped to read-only."""
-        response = await self._request("GET", f"/orgs/{self._config.org}/buckets/{bucket_id}/credentials")
+    async def get_azure_container_credentials_from_bucket(
+        self, bucket_id: UUID, access: Literal["read", "write"] = "read"
+    ) -> AzureCredentials:
+        """Gets the Azure credentials for a bucket.
+
+        Defaults to read-only credentials; pass ``access="write"`` for read+write.
+        """
+        response = await self._request("GET", f"/orgs/{self._config.org}/buckets/{bucket_id}/credentials", params={"access": access})
         handle_response(response)
         return AzureCredentials.model_validate_json(response.content)
 

{arraylake-1.0.1 → arraylake-1.0.2}/arraylake/types.py

@@ -5,10 +5,14 @@ from collections.abc import Mapping
 from datetime import UTC, datetime, time, timedelta
 from enum import Enum, StrEnum
 from pathlib import PurePosixPath
-from typing import Annotated, Any, Generic, Literal, TypeAlias, TypedDict, TypeVar
+from typing import TYPE_CHECKING, Annotated, Any, Generic, Literal, TypeAlias, TypedDict, TypeVar
 from uuid import UUID
 
 import icechunk
+
+if TYPE_CHECKING:
+    import obstore as obs
+    from obstore.store import AzureConfig, ClientConfig, GCSCredential, S3Config
 from pydantic import (
     BaseModel,
     ConfigDict,
@@ -546,6 +550,109 @@ class BucketModel(BaseModel):
         else:
             raise ValueError(f"Unsupported platform for VCC store config: {self.platform}")
 
+    def as_obstore_store(
+        self,
+        credentials: TempCredentials | None,
+        prefix: str | None = None,
+    ) -> obs.store.ObjectStore:
+        """Build an obstore ObjectStore for this bucket using the given credentials.
+
+        Requires the optional ``obstore`` extra (``pip install arraylake[obstore]``).
+
+        Args:
+            credentials: Temporary credentials for the bucket. Pass ``None`` for
+                anonymous access (the resulting store will use ``skip_signature``).
+            prefix: Object key prefix to scope the store to. Defaults to ``self.prefix``
+                if not provided.
+
+        Returns:
+            An ``obstore.store.S3Store``, ``GCSStore``, or ``AzureStore``
+            depending on this bucket's platform.
+
+        Raises:
+            ImportError: If the optional ``obstore`` extra is not installed.
+            ValueError: If the bucket's platform or credential type is unsupported.
+        """
+        try:
+            import obstore as obs
+        except ImportError as e:
+            raise ImportError(
+                "The 'obstore' package is required for this functionality but is not installed. "
+                "Install it with: pip install 'arraylake[obstore]'"
+            ) from e
+
+        effective_prefix = prefix if prefix is not None else self.prefix
+
+        endpoint_url = self.extra_config.get("endpoint_url")
+        s3_client_options: ClientConfig = {}
+        if endpoint_url and str(endpoint_url).startswith("http://"):
+            s3_client_options["allow_http"] = True
+
+        if self.platform in ("s3", "s3-compatible", "minio"):
+            if credentials is None:
+                s3_config: S3Config = {"skip_signature": True}
+            elif isinstance(credentials, S3Credentials):
+                s3_config = {
+                    "access_key_id": credentials.aws_access_key_id,
+                    "secret_access_key": credentials.aws_secret_access_key,
+                }
+                if credentials.aws_session_token:
+                    s3_config["session_token"] = credentials.aws_session_token
+            else:
+                raise ValueError(f"Expected S3Credentials or None for platform {self.platform!r}, got {type(credentials).__name__}")
+            if self.region_name:
+                s3_config["region"] = self.region_name
+            if endpoint_url:
+                s3_config["endpoint"] = str(endpoint_url)
+            return obs.store.S3Store(
+                bucket=self.name,
+                prefix=effective_prefix,
+                config=s3_config,
+                client_options=s3_client_options or None,
+            )
+        elif self.platform == "gs":
+            if credentials is None:
+                return obs.store.GCSStore(
+                    bucket=self.name,
+                    prefix=effective_prefix,
+                    config={"skip_signature": True},
+                )
+            elif isinstance(credentials, GSCredentials):
+                # google-auth returns naive datetimes (utcnow with tzinfo stripped) but
+                # obstore requires timezone-aware datetimes; normalize in the provider.
+                gcs_creds = credentials
+
+                def gcs_credential_provider() -> GCSCredential:
+                    expires_at = gcs_creds.expiration
+                    if expires_at is not None and expires_at.tzinfo is None:
+                        expires_at = expires_at.replace(tzinfo=UTC)
+                    return {"token": gcs_creds.access_token, "expires_at": expires_at}
+
+                return obs.store.GCSStore(
+                    bucket=self.name,
+                    prefix=effective_prefix,
+                    credential_provider=gcs_credential_provider,
+                )
+            else:
+                raise ValueError(f"Expected GSCredentials or None for platform 'gs', got {type(credentials).__name__}")
+        elif self.platform == "azure":
+            if credentials is None:
+                azure_config: AzureConfig = {"skip_signature": True}
+            elif isinstance(credentials, AzureCredentials):
+                azure_config = {
+                    "sas_key": credentials.sas_token,
+                    "account_name": credentials.storage_account,
+                }
+            else:
+                raise ValueError(f"Expected AzureCredentials or None for platform 'azure', got {type(credentials).__name__}")
+            return obs.store.AzureStore(
+                container_name=self.name,
+                prefix=effective_prefix,
+                config=azure_config,
+            )
+        else:
+            raise ValueError(f"Unsupported platform: {self.platform}")
+
 
 class Bucket(BucketModel):
     """A bucket configuration which actually exists in arraylake."""
@@ -965,6 +1072,7 @@ class MarketplaceListing(BaseModel):
     id: str
     repo_id: str | None
     org: str
+    org_display_name: str | None = None
     org_description: str | None = None
     org_avatar: str | None = None
     org_email: str | None = None

{arraylake-1.0.1 → arraylake-1.0.2}/pyproject.toml

@@ -56,6 +56,9 @@ maximal = [
   "xarray[accel,etc,io,parallel] >= 2024.10.0",
   "cf_xarray >= 0.10.4",
 ]
+obstore = [
+  "obstore >= 0.9.2",
+]
 
 [dependency-groups]
 dev = [
@@ -160,3 +163,7 @@ ignore = [
   "TRY004",
 ]
 exclude = ['**/__init__.py', '**/tests/*']
+
+[tool.uv]
+exclude-newer = "2 weeks"
+exclude-newer-package = { icechunk = false }