athena-python-docx 0.18.2__tar.gz → 0.18.3__tar.gz

{athena_python_docx-0.18.2 → athena_python_docx-0.18.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: athena-python-docx
-Version: 0.18.2
+Version: 0.18.3
 Summary: Drop-in replacement for python-docx that connects to Athena's Superdoc/Keryx collaborative document stack
 Project-URL: Homepage, https://athenaintelligence.ai
 Author-email: Athena Intelligence <engineering@athenaintelligence.ai>

{athena_python_docx-0.18.2 → athena_python_docx-0.18.3}/docx/__init__.py

@@ -6,7 +6,7 @@ See CLAUDE.md for the API parity contract.
 
 from __future__ import annotations
 
-__version__ = "0.18.2"
+__version__ = "0.18.3"
 
 from docx.api import Document
 from docx._buffer import flush_all

{athena_python_docx-0.18.2 → athena_python_docx-0.18.3}/docx/_http.py

@@ -100,11 +100,16 @@ def create_empty_document(
         DocxError: any other 4xx/5xx from the server.
     """
     resolved_base: str | None = base_url or os.environ.get(_BASE_URL_ENV)
-    # api_key falls back to ATHENA_API_KEY (the canonical Athena user API
-    # key) so code running in sandboxes that only inject ATHENA_API_KEY
-    # still authenticates without an extra env var.
+    # Create must authenticate as the REAL user so the new asset's ``created_by``
+    # is the user, not a service identity. ``ATHENA_API_KEY`` is the canonical
+    # per-user Athena key (a local API key in BYO/SSO mode that agora resolves to
+    # the real user); the docx-studio studio key (``ATHENA_DOCX_API_KEY``) is a
+    # deployment service credential used only for studio access-checks on
+    # EXISTING assets, and agora's create gate rejects it (no backing user). So
+    # prefer the user key here; only fall back to the studio key for callers that
+    # set just that.
     resolved_key: str | None = (
-        api_key or os.environ.get(_API_KEY_ENV) or os.environ.get("ATHENA_API_KEY")
+        api_key or os.environ.get("ATHENA_API_KEY") or os.environ.get(_API_KEY_ENV)
     )
 
     if not resolved_base:
@@ -263,11 +268,16 @@ def upload_document(
     import uuid
 
     resolved_docx_base: str | None = docx_base_url or os.environ.get(_BASE_URL_ENV)
-    # api_key falls back to ATHENA_API_KEY (the canonical Athena user API
-    # key) so code running in sandboxes that only inject ATHENA_API_KEY
-    # still authenticates without an extra env var.
+    # Create must authenticate as the REAL user so the new asset's ``created_by``
+    # is the user, not a service identity. ``ATHENA_API_KEY`` is the canonical
+    # per-user Athena key (a local API key in BYO/SSO mode that agora resolves to
+    # the real user); the docx-studio studio key (``ATHENA_DOCX_API_KEY``) is a
+    # deployment service credential used only for studio access-checks on
+    # EXISTING assets, and agora's create gate rejects it (no backing user). So
+    # prefer the user key here; only fall back to the studio key for callers that
+    # set just that.
     resolved_key: str | None = (
-        api_key or os.environ.get(_API_KEY_ENV) or os.environ.get("ATHENA_API_KEY")
+        api_key or os.environ.get("ATHENA_API_KEY") or os.environ.get(_API_KEY_ENV)
     )
     resolved_agora_base: str | None = (
         agora_base_url

{athena_python_docx-0.18.2 → athena_python_docx-0.18.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "athena-python-docx"
-version = "0.18.2"
+version = "0.18.3"
 description = "Drop-in replacement for python-docx that connects to Athena's Superdoc/Keryx collaborative document stack"
 readme = "README.md"
 license = "MIT"

{athena_python_docx-0.18.2 → athena_python_docx-0.18.3}/tests/test_document_create.py

@@ -163,3 +163,54 @@ def test_create_request_body_includes_optional_fields() -> None:
         "parentFolderId": "folder_abc",
         "workspaceId": "ws_explicit",
     }
+
+
+def test_create_prefers_user_key_over_studio_key(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """create() authenticates as the user, not the static studio key.
+
+    In self-hosted SSO the executor injects BOTH the static studio key
+    (``ATHENA_DOCX_API_KEY``) and the per-user key (``ATHENA_API_KEY``). create
+    must use the per-user key so the new asset's ``created_by`` is the real
+    user — the studio key is a deployment service credential that agora's
+    create gate rejects (no backing user).
+    """
+    monkeypatch.setenv(
+        "ATHENA_DOCX_BASE_URL",
+        "https://docx-studio.stg.athenaintel.com",
+    )
+    monkeypatch.setenv("ATHENA_DOCX_API_KEY", "studio-static-key")
+    monkeypatch.setenv("ATHENA_API_KEY", "user-local-key")
+    captured: dict[str, Any] = {}
+
+    def _capture(req: Any, **_kwargs: Any) -> _FakeResponse:
+        captured["headers"] = dict(req.headers)
+        return _FakeResponse(json.dumps(_FAKE_RESPONSE).encode("utf-8"))
+
+    with patch("docx._http.urllib.request.urlopen", side_effect=_capture):
+        Document.create(name="X")
+
+    assert captured["headers"]["Authorization"] == "Bearer user-local-key"
+
+
+def test_create_falls_back_to_studio_key_without_user_key(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """With only the studio key configured, create still authenticates with it."""
+    monkeypatch.setenv(
+        "ATHENA_DOCX_BASE_URL",
+        "https://docx-studio.stg.athenaintel.com",
+    )
+    monkeypatch.setenv("ATHENA_DOCX_API_KEY", "studio-static-key")
+    monkeypatch.delenv("ATHENA_API_KEY", raising=False)
+    captured: dict[str, Any] = {}
+
+    def _capture(req: Any, **_kwargs: Any) -> _FakeResponse:
+        captured["headers"] = dict(req.headers)
+        return _FakeResponse(json.dumps(_FAKE_RESPONSE).encode("utf-8"))
+
+    with patch("docx._http.urllib.request.urlopen", side_effect=_capture):
+        Document.create(name="X")
+
+    assert captured["headers"]["Authorization"] == "Bearer studio-static-key"

{athena_python_docx-0.18.2 → athena_python_docx-0.18.3}/uv.lock

@@ -21,7 +21,7 @@ wheels = [
 
 [[package]]
 name = "athena-python-docx"
-version = "0.15.2"
+version = "0.18.3"
 source = { editable = "." }
 dependencies = [
     { name = "requests" },