arraylake 1.0.1__tar.gz → 1.0.3a1__tar.gz

{arraylake-1.0.1 → arraylake-1.0.3a1}/.gitignore

@@ -149,3 +149,4 @@ client/arraylake/_version.py
 !/.claude/
 /.claude/*
 !/.claude/skills/
+.local/

{arraylake-1.0.1 → arraylake-1.0.3a1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: arraylake
-Version: 1.0.1
+Version: 1.0.3a1
 Summary: Python client for ArrayLake
 Project-URL: Documentation, https://docs.earthmover.io/
 Project-URL: Changelog, https://docs.earthmover.io/changelog
@@ -27,6 +27,8 @@ Requires-Dist: zarr<4.0,>=3.1.0
 Provides-Extra: maximal
 Requires-Dist: cf-xarray>=0.10.4; extra == 'maximal'
 Requires-Dist: xarray[accel,etc,io,parallel]>=2024.10.0; extra == 'maximal'
+Provides-Extra: obstore
+Requires-Dist: obstore>=0.9.2; extra == 'obstore'
 Provides-Extra: xarray
 Requires-Dist: cf-xarray>=0.10.4; extra == 'xarray'
 Requires-Dist: xarray>=2024.10.0; extra == 'xarray'

arraylake-1.0.3a1/arraylake/_credential_cache.py

@@ -0,0 +1,86 @@
+"""Process-wide cache for delegated bucket credentials.
+
+When users pickle an icechunk Session and ship it to many workers, every
+unpickled task can independently call the arraylake server for fresh
+credentials when the embedded ones expire. This module gives the client a
+single per-process cache so all consumers in a worker process share one
+in-flight refresh.
+
+Validity follows ``Cache-Control: max-age`` semantics: cached creds are
+served while ``expires_at - CLOCK_SKEW_SAFETY > now``. The 30s safety only
+protects against worker/server NTP-level clock drift; it is not a
+pre-refresh window.
+"""
+
+from __future__ import annotations
+
+import asyncio
+from collections.abc import Awaitable, Callable
+from dataclasses import dataclass, field
+from datetime import UTC, datetime, timedelta
+from typing import Literal
+
+from arraylake.asyn import get_background_loop
+from arraylake.log_util import get_logger
+from arraylake.types import OrgName, Platform, TempCredentials
+
+logger = get_logger(__name__)
+
+
+CLOCK_SKEW_SAFETY = timedelta(seconds=30)
+
+
+@dataclass(eq=True, frozen=True)
+class CredentialCacheKey:
+    api_url: str
+    auth_key: int
+    scope: Literal["repo", "bucket"]
+    org: OrgName
+    identifier: str
+    platform: Platform
+    access: Literal["read", "write"] = "read"
+
+
+@dataclass
+class _Entry:
+    lock: asyncio.Lock = field(default_factory=asyncio.Lock)
+    creds: TempCredentials | None = None
+    expires_at: datetime | None = None
+
+
+_CACHE: dict[CredentialCacheKey, _Entry] = {}
+
+
+async def get_or_refresh(
+    key: CredentialCacheKey,
+    fetcher: Callable[[], Awaitable[TempCredentials]],
+    *,
+    use_cache: bool = True,
+) -> TempCredentials:
+    assert asyncio.get_running_loop() is get_background_loop(), "credential cache must be used from the arraylake background loop"
+    if not use_cache:
+        return await fetcher()
+    entry = _CACHE.setdefault(key, _Entry())
+    async with entry.lock:
+        now = datetime.now(UTC)
+        if entry.creds is not None and entry.expires_at is not None and entry.expires_at - CLOCK_SKEW_SAFETY > now:
+            return entry.creds
+        creds = await fetcher()
+        exp = creds.expiration
+        if exp is not None and exp.tzinfo is None:
+            exp = exp.replace(tzinfo=UTC)
+        if exp is not None and exp - CLOCK_SKEW_SAFETY <= now:
+            logger.warning(
+                "delegated credentials returned with lifetime <= clock-skew safety; server contract violation",
+                remaining_seconds=(exp - now).total_seconds(),
+                api_url=key.api_url,
+                org=key.org,
+                identifier=key.identifier,
+            )
+        entry.creds = creds
+        entry.expires_at = exp
+        return creds
+
+
+def clear() -> None:
+    _CACHE.clear()

{arraylake-1.0.1 → arraylake-1.0.3a1}/arraylake/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '1.0.1'
-__version_tuple__ = version_tuple = (1, 0, 1)
+__version__ = version = '1.0.3a1'
+__version_tuple__ = version_tuple = (1, 0, 3, 'a1')
 
 __commit_id__ = commit_id = None