arraylake 1.7.0__tar.gz → 1.8.0__tar.gz

{arraylake-1.7.0 → arraylake-1.8.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: arraylake
-Version: 1.7.0
+Version: 1.8.0
 Summary: Python client for ArrayLake
 Project-URL: Documentation, https://docs.earthmover.io/
 Project-URL: Changelog, https://docs.earthmover.io/changelog
@@ -27,13 +27,14 @@ Requires-Dist: zarr<4.0,>=3.1.0
 Provides-Extra: iceberg
 Requires-Dist: pyiceberg[pyarrow]<0.13,>=0.11; extra == 'iceberg'
 Provides-Extra: maximal
-Requires-Dist: xarray[accel,etc,io,parallel]>=2024.10.0; extra == 'maximal'
+Requires-Dist: xarray[accel,etc,io,parallel]>=2025.6.0; extra == 'maximal'
 Provides-Extra: obstore
 Requires-Dist: obstore>=0.9.2; extra == 'obstore'
 Provides-Extra: openeo
-Requires-Dist: openeo<0.53,>=0.35.0; extra == 'openeo'
+Requires-Dist: openeo<0.54,>=0.35.0; extra == 'openeo'
+Requires-Dist: xarray>=2025.6.0; extra == 'openeo'
 Provides-Extra: xarray
-Requires-Dist: xarray>=2024.10.0; extra == 'xarray'
+Requires-Dist: xarray>=2025.6.0; extra == 'xarray'
 Description-Content-Type: text/markdown
 
 <p align="center">

{arraylake-1.7.0 → arraylake-1.8.0}/arraylake/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '1.7.0'
-__version_tuple__ = version_tuple = (1, 7, 0)
+__version__ = version = '1.8.0'
+__version_tuple__ = version_tuple = (1, 8, 0)
 
 __commit_id__ = commit_id = None

{arraylake-1.7.0 → arraylake-1.8.0}/arraylake/api_utils.py

@@ -30,7 +30,7 @@ from arraylake.exceptions import (
     ArraylakeValidationError,
 )
 from arraylake.log_util import get_logger
-from arraylake.types import ApiTokenInfo, OauthTokensResponse, UserInfo
+from arraylake.types import ApiTokenInfo, UserInfo
 
 logger = get_logger(__name__)
 
@@ -484,6 +484,9 @@ def _exception_log_debug(request: httpx.Request, response: httpx.Response):
     )
 
 
+# Request extension set by our auth flows on a 401, describing the credential that was rejected.
+_CREDENTIAL_EXTENSION = "arraylake_credential"
+
 _emitted_deprecation_warnings: set[str] = set()
 _emitted_user_warnings: set[str] = set()
 
@@ -526,6 +529,8 @@ def handle_response(response: httpx.Response):
         else:
             # Handle other HTTP status errors
             error_msg = f"Error response {exc.response.status_code} while requesting {exc.request.url!r}. {response}: {response.text}"
+            if credential := exc.request.extensions.get(_CREDENTIAL_EXTENSION):
+                error_msg = f"{error_msg} (Authenticated {credential}.)"
             if 400 <= exc.response.status_code < 500:
                 raise ArraylakeClientError(error_msg, request_id=request_id, status_code=exc.response.status_code) from exc
             else:
@@ -550,7 +555,12 @@ class TokenAuth(httpx.Auth):
     def auth_flow(self, request: httpx.Request) -> Generator[httpx.Request, httpx.Response, None]:
         # Send the request, with a bearer token header
         request.headers["Authorization"] = f"Bearer {self.token}"
-        yield request
+        response = yield request
+        if response.status_code == httpx.codes.UNAUTHORIZED:
+            # Import locally to avoid circular imports
+            from arraylake.token import describe_token_source
+
+            request.extensions[_CREDENTIAL_EXTENSION] = describe_token_source(self.token)
 
 
 class UserAuth(httpx.Auth):
@@ -579,11 +589,14 @@ class UserAuth(httpx.Auth):
             # Import locally to avoid circular imports
             from arraylake.token import AuthException
 
-            raise AuthException("Not logged in, please log in with `arraylake auth login`")
+            raise AuthException("Not logged in, please log in with `al auth login`")
         token = self._token_handler.tokens.id_token.get_secret_value()
         return f"Bearer {token}"
 
     async def async_auth_flow(self, request: httpx.Request) -> AsyncGenerator[httpx.Request, httpx.Response]:
+        # Import locally to avoid circular imports
+        from arraylake.token import describe_cached_login, parse_refreshed_tokens
+
         token_at_send = self._bearer_token
         request.headers["Authorization"] = token_at_send
         response = yield request
@@ -597,11 +610,12 @@ class UserAuth(httpx.Auth):
                     refresh_response = yield await self._token_handler.build_refresh_request()
                     await refresh_response.aread()
                     handle_response(refresh_response)
-                    new_tokens = OauthTokensResponse.model_validate_json(refresh_response.content)
-                    self._token_handler.update(new_tokens)
+                    self._token_handler.update(parse_refreshed_tokens(refresh_response.content))
 
             request.headers["Authorization"] = self._bearer_token
-            yield request
+            response = yield request
+            if response.status_code == httpx.codes.UNAUTHORIZED:
+                request.extensions[_CREDENTIAL_EXTENSION] = describe_cached_login(self.api_endpoint)
 
     def sync_auth_flow(self, request: httpx.Request) -> Generator[httpx.Request, httpx.Response, None]:
         # we can implement this method if we end up needing the sync httpx.Client

arraylake-1.8.0/arraylake/cli/auth.py

@@ -0,0 +1,195 @@
+import os
+
+import httpx
+import typer
+from rich.align import Align
+from rich.console import Console
+from rich.markup import escape
+from rich.panel import Panel
+
+from arraylake.cli.utils import (
+    coro,
+    error_console,
+    print_logo,
+    print_logo_mini,
+    rich_console,
+)
+from arraylake.config import default_service_uri, default_token
+from arraylake.token import AuthException, TokenHandler, describe_token, get_auth_handler
+
+auth = typer.Typer(help="Manage Arraylake authentication")
+
+NOT_LOGGED_IN_MESSAGE = "⚠️  Not logged in, please log in with: `al auth login`"
+
+# `al auth token` refreshes tokens that expire sooner than this, so the printed token stays usable for a while.
+TOKEN_MIN_VALID_SECONDS = 300
+
+# Uncolored notices on stderr, keeping stdout machine-readable.
+notice_console = Console(stderr=True)
+
+SERVICE_URI_OPTION = typer.Option(
+    None,
+    "--service-uri",
+    help=(
+        "Arraylake API endpoint to act on, e.g. **https://dev.api.earthmover.io**. Defaults to the configured "
+        "**service.uri**. Tokens are stored per endpoint, so this need not be persisted to config — unless "
+        "**service.token_path** is set, which makes all endpoints share one token file."
+    ),
+)
+
+
+def _resolve_service_uri(service_uri: str | None) -> str:
+    return service_uri if service_uri else default_service_uri()
+
+
+@auth.command()
+@coro  # type: ignore
+async def login(
+    browser: bool = typer.Option(True, "--browser/--no-browser", " /--nobrowser", help="Whether to automatically open a browser window."),
+    service_uri: str | None = SERVICE_URI_OPTION,
+):
+    """**Log in** to Arraylake
+
+    This will automatically open a browser window. If **--no-browser** is specified, a link will be printed.
+
+    **Examples**
+
+    - Log in without automatically opening a browser window
+
+        ```
+        $ al auth login --no-browser
+        ```
+
+    - Log in to a non-default Arraylake deployment
+
+        ```
+        $ al auth login --service-uri https://dev.api.earthmover.io
+        ```
+    """
+    print_logo()
+    handler = get_auth_handler(api_endpoint=_resolve_service_uri(service_uri))
+    await handler.login(browser=browser)
+
+
+@auth.command()
+@coro  # type: ignore
+async def refresh(service_uri: str | None = SERVICE_URI_OPTION) -> None:
+    """**Refresh** Arraylake's auth token"""
+    handler = get_auth_handler(api_endpoint=_resolve_service_uri(service_uri))
+    if handler.tokens is not None:
+        try:
+            await handler.refresh_token()
+        except Exception as e:
+            error_console.print(f"\n[bold red]❌  {e}[/bold red]")
+            raise typer.Exit(code=1)
+    else:
+        rich_console.print(Align(f"[yellow]{NOT_LOGGED_IN_MESSAGE}[/yellow]", align="center"))
+        raise typer.Exit(code=1)
+
+
+@auth.command()
+@coro  # type: ignore
+async def logout(service_uri: str | None = SERVICE_URI_OPTION) -> None:
+    """**Logout** of Arraylake
+
+    **Examples**
+
+    - Logout of arraylake
+
+        ```
+        $ al auth logout
+        ```
+
+    - Log out of a non-default Arraylake deployment
+
+        ```
+        $ al auth logout --service-uri https://dev.api.earthmover.io
+        ```
+    """
+    try:
+        handler = get_auth_handler(api_endpoint=_resolve_service_uri(service_uri))
+        await handler.logout()
+    except AuthException as e:
+        error_console.print(e)
+        raise typer.Exit(code=1)
+
+
+def _configured_token_name() -> str:
+    return "ARRAYLAKE_TOKEN" if os.environ.get("ARRAYLAKE_TOKEN", "").strip() else "The `token` arraylake config setting"
+
+
+async def _check_configured_token(handler: TokenHandler, token: str) -> bool:
+    """Report on a configured token, which clients use instead of the cached login. Returns whether it is valid."""
+    name = _configured_token_name()
+    rich_console.print(
+        Align(f"[yellow]{name} is set ({describe_token(token)}) and takes precedence over your cached login.[/yellow]", align="center")
+    )
+    try:
+        async with handler._create_async_client() as client:
+            response = await client.get(
+                f"{handler.api_endpoint}/user", headers={"Authorization": f"Bearer {token}", **handler.arraylake_headers}
+            )
+    except httpx.HTTPError as e:
+        rich_console.print(Align(f"[yellow]⚠️  Could not verify {name}: {escape(str(e))}[/yellow]", align="center"))
+        return False
+    if response.status_code != httpx.codes.OK:
+        hint = "`unset ARRAYLAKE_TOKEN`" if name == "ARRAYLAKE_TOKEN" else "remove it"
+        rich_console.print(
+            Align(f"[red]❌ {name} was rejected ({response.status_code}); {hint} to use your cached login.[/red]", align="center")
+        )
+        return False
+    rich_console.print(Align(f"[green][bold]🔓 {name} is valid ({response.json().get('email', 'unknown')})[/bold][/green]", align="center"))
+    return True
+
+
+@auth.command()
+@coro  # type: ignore
+async def status(service_uri: str | None = SERVICE_URI_OPTION):
+    """Verify and display information about your authentication **status**
+
+    Reports **ARRAYLAKE_TOKEN** (or the **token** config setting) first when set, since clients use it instead of
+    the cached login.
+    """
+    endpoint = _resolve_service_uri(service_uri)
+    print_logo_mini()
+    rich_console.print(Align(Panel.fit(f"[bold]Arraylake API Endpoint[/bold]: {endpoint}"), align="center"))
+
+    handler = get_auth_handler(api_endpoint=endpoint)
+    configured_token = default_token()
+    configured_token_ok = await _check_configured_token(handler, configured_token) if configured_token else None
+    try:
+        user = await handler._get_user()  # checks that the new tokens are valid
+        rich_console.print(Align(f"[green][bold]🔓 Logged in as {user.email}[/green][/bold]", align="center"))
+    except AuthException:
+        if configured_token_ok is None:
+            rich_console.print(Align(f"[yellow]{NOT_LOGGED_IN_MESSAGE}[/yellow]", align="center"))
+            raise typer.Exit(code=1)
+        rich_console.print(Align("[dim]No valid cached login (`al auth login`) for this endpoint.[/dim]", align="center"))
+    if configured_token_ok is False:
+        raise typer.Exit(code=1)
+
+
+@auth.command()
+@coro  # type: ignore
+async def token(service_uri: str | None = SERVICE_URI_OPTION):
+    """Print your login's ID **token**, refreshing it first if it has expired or is about to
+
+    Only the token goes to stdout, so it can be captured, e.g. **PGPASSWORD="$(al auth token)"**. Make sure
+    **--service-uri** matches the deployment you will send the token to.
+    """
+    endpoint = _resolve_service_uri(service_uri)
+    handler = get_auth_handler(api_endpoint=endpoint)
+    if handler.tokens is None:
+        error_console.print(NOT_LOGGED_IN_MESSAGE)
+        raise typer.Exit(code=1)
+    try:
+        token_value = await handler.get_fresh_id_token(min_valid_seconds=TOKEN_MIN_VALID_SECONDS)
+    except AuthException as e:
+        error_console.print(f"❌ {escape(str(e))}")
+        raise typer.Exit(code=1)
+    notice_console.print(f"[dim]ID token for {endpoint} ({describe_token(token_value)})[/dim]", highlight=False)
+    if default_token():
+        notice_console.print(
+            f"[yellow]Note: {_configured_token_name()} is set and takes precedence over this login in Arraylake clients.[/yellow]"
+        )
+    typer.echo(token_value)

{arraylake-1.7.0 → arraylake-1.8.0}/arraylake/cli/repo.py

@@ -1,4 +1,5 @@
 import json
+from datetime import datetime
 from enum import Enum, StrEnum
 from uuid import UUID
 
@@ -12,7 +13,7 @@ from rich.text import Text
 from arraylake import AsyncClient
 from arraylake.cli.utils import coro, rich_console, simple_progress
 from arraylake.log_util import get_logger
-from arraylake.types import RepoOperationMode
+from arraylake.types import DatasetFilter, NodeFilter, RepoOperationMode, SubscriptionType
 
 app = typer.Typer(help="Manage Arraylake repositories", no_args_is_help=True)
 logger = get_logger(__name__)
@@ -85,6 +86,8 @@ def _make_json_safe(obj):
         return "[REDACTED]"
     elif isinstance(obj, UUID):
         return str(obj)
+    elif isinstance(obj, datetime):
+        return obj.isoformat()
     else:
         return obj
 
@@ -186,6 +189,86 @@ async def import_repo(
         )
 
 
+@app.command()
+@coro  # type: ignore
+async def subscribe(
+    repo_name: str = typer.Argument(..., help="Name of the subscriber repository {ORG}/{REPO_NAME}"),
+    listing_id: str = typer.Argument(..., help="ID of the exchange listing"),
+    subscription_type: SubscriptionType = typer.Option(SubscriptionType.DIRECT, help="Subscription type"),
+    include_path: list[str] | None = typer.Option(None, help="Group or array to copy (filtered/private). Repeat for more paths."),
+    exclude_path: list[str] | None = typer.Option(None, help="Group or array to leave out (filtered/private). Repeat for more paths."),
+    bucket_config_nickname: str | None = typer.Option(None, help="Bucket for the copied data (filtered/private)"),
+    prefix: str | None = typer.Option(None, help="Optional prefix in the bucket. If not provided, one is generated."),
+    description: str | None = typer.Option(None, help="Description of the repo"),
+    metadata: str | None = typer.Option(None, help="Optional metadata for the repo"),
+):
+    """**Subscribe** to an exchange listing
+
+    **Examples**
+
+    - Subscribe to a free listing
+
+        ```
+        $ arraylake repo subscribe my-org/era5 6720f1c2a9e3b4d5e6f70812
+        ```
+
+    - Copy two arrays from a paid listing into your bucket
+
+        ```
+        $ arraylake repo subscribe my-org/era5-subset 6720f1c2a9e3b4d5e6f70812 --subscription-type filtered --include-path /t2m --include-path /u10 --bucket-config-nickname my-bucket
+        ```
+    """
+    target_filter = (
+        DatasetFilter(nodes=NodeFilter(include_paths=include_path or [], exclude_paths=exclude_path or []))
+        if include_path or exclude_path
+        else None
+    )
+    metadata_dict = json.loads(metadata) if metadata else None
+    with simple_progress(f"Subscribing [bold]{repo_name}[/bold]..."):
+        await AsyncClient().subscribe_to_listing(
+            repo_name,
+            listing_id,
+            subscription_type=subscription_type,
+            target_filter=target_filter,
+            bucket_config_nickname=bucket_config_nickname,
+            prefix=prefix,
+            description=description,
+            metadata=metadata_dict,
+        )
+
+
+@app.command()
+@coro  # type: ignore
+async def claim(
+    repo_name: str = typer.Argument(..., help="Name of the subscriber repository {ORG}/{REPO_NAME}"),
+    claim_code: str = typer.Argument(..., help="Claim code from the provider"),
+    bucket_config_nickname: str | None = typer.Option(None, help="Bucket for the copied data (filtered/private)"),
+    prefix: str | None = typer.Option(None, help="Optional prefix in the bucket. If not provided, one is generated."),
+    description: str | None = typer.Option(None, help="Description of the repo"),
+    metadata: str | None = typer.Option(None, help="Optional metadata for the repo"),
+):
+    """**Claim** a subscription with a claim code
+
+    **Examples**
+
+    - Claim a subscription
+
+        ```
+        $ arraylake repo claim my-org/era5 ABCD-1234
+        ```
+    """
+    metadata_dict = json.loads(metadata) if metadata else None
+    with simple_progress(f"Claiming [bold]{repo_name}[/bold]..."):
+        await AsyncClient().claim_subscription(
+            repo_name,
+            claim_code,
+            bucket_config_nickname=bucket_config_nickname,
+            prefix=prefix,
+            description=description,
+            metadata=metadata_dict,
+        )
+
+
 @app.command()
 @coro  # type: ignore
 async def modify(