boxd 0.2.0.dev40__tar.gz → 0.2.1__tar.gz

{boxd-0.2.0.dev40/src/boxd.egg-info → boxd-0.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boxd
-Version: 0.2.0.dev40
+Version: 0.2.1
 Summary: Python SDK for the boxd cloud VM platform
 Author: Azin
 License-Expression: MIT

{boxd-0.2.0.dev40 → boxd-0.2.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "boxd"
-version = "0.2.0.dev40"
+version = "0.2.1"
 description = "Python SDK for the boxd cloud VM platform"
 readme = "README.md"
 license = "MIT"

{boxd-0.2.0.dev40 → boxd-0.2.1}/src/boxd/_credentials.py

@@ -35,7 +35,6 @@ METADATA_TOKEN_PATH = "/v1/auth/token"
 # Proxy-minted, HMAC-signed identity token exposed to every guest process by
 # takeoff. Forwarded verbatim so the worker attributes the call to the acting
 # user rather than the VM owner.
-IDENTITY_HEADER = "X-Boxd-Identity"
 
 # Re-exchange an API-key JWT this long before it expires.
 EXCHANGE_SKEW_SECS = 300
@@ -78,16 +77,19 @@ def detect_gateway() -> str | None:
     return None
 
 
-def vm_id() -> str | None:
-    """`BOXD_VM_ID`, injected by takeoff at PID 1 — present in every guest process."""
-    value = os.environ.get("BOXD_VM_ID")
-    return value or None
+# Only a hint: it skips the probe in the common case of running on a laptop.
+# Deliberately permissive — which of these a shell actually has depends on how
+# the session was opened and on how old the machine is, so gating on any single
+# one silently disables in-VM auth on machines that are otherwise fine. The
+# metadata probe is the real test: nothing outside a boxd machine answers it.
+_VM_HINTS = ("BOXD_VM_ID", "BOXD_VM_NAME", "BOXD_PROXY_ENDPOINT")
+
+
+def looks_like_a_machine() -> bool:
+    """True when the environment hints we may be inside a boxd machine."""
+    return any(os.environ.get(v) for v in _VM_HINTS)
 
 
-def identity_token() -> str | None:
-    """`BOXD_IDENTITY`, the session's signed identity token (already base64)."""
-    value = os.environ.get("BOXD_IDENTITY")
-    return value or None
 
 
 def probe(host: str, port: int, timeout: float = _PROBE_TIMEOUT_SECS) -> bool:
@@ -185,9 +187,6 @@ class _CredentialsBase:
             return "exchange"
         return "auto"
 
-    def _headers(self) -> dict[str, str]:
-        identity = identity_token()
-        return {IDENTITY_HEADER: identity} if identity else {}
 
 
 class SyncCredentials(_CredentialsBase):
@@ -222,7 +221,7 @@ class SyncCredentials(_CredentialsBase):
         base = self._metadata_base()
         try:
             with httpx.Client(timeout=_HTTP_TIMEOUT_SECS) as client:
-                resp = client.get(base + METADATA_TOKEN_PATH, headers=self._headers())
+                resp = client.get(base + METADATA_TOKEN_PATH)
         except httpx.HTTPError as e:
             raise AuthenticationError(f"in-VM token request failed: {e}") from e
         token, expires_at, api_url = parse_vm_token(
@@ -234,7 +233,7 @@ class SyncCredentials(_CredentialsBase):
 
     def _metadata_base(self) -> str:
         """Detection needs BOTH signals — neither alone is sufficient."""
-        if not vm_id():
+        if not looks_like_a_machine():
             raise AuthenticationError(_NO_CREDENTIALS)
         gateway = detect_gateway()
         if not gateway or not probe(gateway, METADATA_PORT):
@@ -277,7 +276,7 @@ class AsyncCredentials(_CredentialsBase):
         try:
             async with httpx.AsyncClient(timeout=_HTTP_TIMEOUT_SECS) as client:
                 resp = await client.get(
-                    base + METADATA_TOKEN_PATH, headers=self._headers()
+                    base + METADATA_TOKEN_PATH
                 )
         except httpx.HTTPError as e:
             raise AuthenticationError(f"in-VM token request failed: {e}") from e
@@ -289,7 +288,7 @@ class AsyncCredentials(_CredentialsBase):
             self.discovered_base_url = api_url
 
     async def _metadata_base(self) -> str:
-        if not vm_id():
+        if not looks_like_a_machine():
             raise AuthenticationError(_NO_CREDENTIALS)
         gateway = detect_gateway()
         if not gateway or not await probe_async(gateway, METADATA_PORT):

{boxd-0.2.0.dev40 → boxd-0.2.1/src/boxd.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boxd
-Version: 0.2.0.dev40
+Version: 0.2.1
 Summary: Python SDK for the boxd cloud VM platform
 Author: Azin
 License-Expression: MIT

{boxd-0.2.0.dev40 → boxd-0.2.1}/tests/test_credentials.py

@@ -141,42 +141,6 @@ def test_both_signals_mint_a_token_and_report_the_cluster(monkeypatch):
     assert c.discovered_base_url == "http://boxd-stg.sh:9443"
 
 
-def test_identity_is_forwarded_when_set(monkeypatch):
-    monkeypatch.setenv("BOXD_VM_ID", "vm-123")
-    monkeypatch.setenv("BOXD_IDENTITY", "signed-identity")
-    monkeypatch.setattr("boxd._credentials.detect_gateway", lambda: "10.42.0.1")
-    monkeypatch.setattr("boxd._credentials.probe", lambda *a, **k: True)
-
-    seen = {}
-
-    class FakeResponse:
-        status_code = 200
-        text = "{}"
-
-        def json(self):
-            return {"token": "vm-jwt", "expires_at": time.time() + 900}
-
-    class FakeClient:
-        def __init__(self, **kwargs):
-            pass
-
-        def __enter__(self):
-            return self
-
-        def __exit__(self, *a):
-            return False
-
-        def get(self, url, headers=None):
-            seen.update(headers or {})
-            return FakeResponse()
-
-    monkeypatch.setattr("boxd._credentials.httpx.Client", FakeClient)
-    creds().token()
-    assert seen["X-Boxd-Identity"] == "signed-identity"
-
-
-# --- gateway parsing ---
-
 
 def test_detect_gateway_parses_the_default_route(monkeypatch, tmp_path):
     route = tmp_path / "route"
@@ -303,3 +267,19 @@ async def test_async_no_credentials_raises(monkeypatch):
     c = AsyncCredentials(api_key=None, token=None, exchange_url=EXCHANGE)
     with pytest.raises(AuthenticationError, match="no credentials"):
         await c.token()
+
+
+def test_in_vm_detection_does_not_hinge_on_one_env_var(monkeypatch):
+    # A real dev machine's shell had BOXD_IDENTITY and BOXD_PROXY_ENDPOINT but
+    # no BOXD_VM_ID — gating on BOXD_VM_ID alone disabled in-VM auth there.
+    from boxd import _credentials as c
+
+    for v in c._VM_HINTS:
+        monkeypatch.delenv(v, raising=False)
+    assert c.looks_like_a_machine() is False
+
+    for present in c._VM_HINTS:
+        for v in c._VM_HINTS:
+            monkeypatch.delenv(v, raising=False)
+        monkeypatch.setenv(present, "x")
+        assert c.looks_like_a_machine() is True, present