byteplus-python-sdk-v2 3.0.43__py2.py3-none-any.whl → 3.0.45__py2.py3-none-any.whl

{byteplus_python_sdk_v2-3.0.43.dist-info → byteplus_python_sdk_v2-3.0.45.dist-info}/top_level.txt

@@ -21,6 +21,7 @@ byteplussdkhbase
 byteplussdkiam20210801
 byteplussdkid
 byteplussdkkafka
+byteplussdkkickart
 byteplussdkkms
 byteplussdkllmshield
 byteplussdkmilvus
@@ -46,4 +47,5 @@ byteplussdkvke
 byteplussdkvmp
 byteplussdkvod20250701
 byteplussdkvpc
+byteplussdkvpc20250901
 byteplussdkvpn

byteplussdkcore/api_client.py

@@ -2,7 +2,10 @@
 
 from __future__ import absolute_import
 
+import copy
 import datetime
+import logging
+import time
 from multiprocessing.pool import ThreadPool
 from time import sleep
 
@@ -16,6 +19,8 @@ from byteplussdkcore.interceptor import BuildRequestInterceptor, RuntimeOptionsI
     Response, InterceptorChain
 from byteplussdkcore.observability.debugger import sdk_core_logger, LogLevel
 
+logger = logging.getLogger(__name__)
+
 
 class ApiClient(object):
     """Generic API client for Swagger client library builds.
@@ -63,7 +68,7 @@ class ApiClient(object):
             self.default_headers[header_name] = header_value
         self.cookie = cookie
         # Set default User-Agent.
-        self.user_agent = 'byteplus-python-sdk-v2/3.0.43'
+        self.user_agent = 'byteplus-python-sdk-v2/3.0.45'
         self.client_side_validation = configuration.client_side_validation
 
         self.interceptor_chain = InterceptorChain()
@@ -397,6 +402,219 @@ class ApiClient(object):
 
         sdk_core_logger.debug_config("".join(sb))
 
+    def _sts_call(self, action, version, params,
+                  host=None, scheme='https', region='cn-beijing',
+                  timeout=30, service='sts',
+                  max_retries=3, retry_interval=1,
+                  provider_name="ApiClient"):
+        """Invoke an STS federation endpoint (AssumeRoleWithOIDC / AssumeRoleWithSAML / etc.)
+        through the SDK's main REST stack while explicitly disabling signing.
+
+        This reuses `ApiClient.call_api` so TLS config (`verify_ssl`,
+        `ssl_ca_cert`, `cert_file`, `assert_hostname`), proxy (`http_proxy` /
+        `https_proxy` / env vars), connect/read timeouts, connection pooling
+        and observability are all honored exactly as for any other SDK API call.
+
+        NOTE: this method dispatches via a NEW `ApiClient(fresh)` (not via
+        `self`); changes to `ApiClient.__init__` / `call_api` / interceptors
+        affect this STS path too.
+
+        Signing is skipped by passing `auth_settings=None`, which causes
+        `SignRequestInterceptor.update_params_for_auth` to early-return. This
+        is correct because OIDC / SAML federation entry points are unsigned
+        by design (the OIDCToken / SAMLResp is the authentication material).
+
+        Recursion is broken by clearing `credential_provider` and setting
+        `ak` / `sk` to sentinel values on the fresh Configuration copy, so
+        the STS request does not itself invoke the provider that initiated
+        it.
+
+        `provider_name` is used only for log/error context (e.g.
+        "STSOIDCProvider") -- pass the calling provider's PROVIDER_NAME so
+        operators can trace which credential source initiated the STS call.
+
+        Returns the unwrapped `Result` dict from the STS response. Business
+        errors bubble up as `rest.ApiException` (matching master behavior).
+        """
+        # Configuration() via the TypeWithDefault metaclass returns a shallow
+        # copy of the user's default configuration, so TLS/proxy/timeout
+        # settings propagate to the STS call.
+        fresh = Configuration()
+        # Break recursion on three fronts:
+        #   1. credential_provider=None so SignRequestInterceptor won't call
+        #      back into the provider via get_credentials().
+        #   2. Non-empty ak/sk sentinel so the feature branch's
+        #      SignRequestInterceptor does NOT auto-attach a
+        #      DefaultCredentialProvider (which would recurse through the
+        #      whole credential chain). The sentinel never reaches the wire
+        #      because auth_settings=None short-circuits
+        #      update_params_for_auth before signing.
+        fresh.credential_provider = None
+        fresh.ak = "_sts_bootstrap_unsigned"
+        fresh.sk = "_sts_bootstrap_unsigned"
+        fresh.session_token = ""
+        # Per-call overrides from the caller
+        if host:
+            fresh.host = host
+        fresh.scheme = scheme
+        fresh.region = region
+        fresh.read_timeout = timeout
+
+        # Retry: apply caller-level retry semantics to this STS call only.
+        # Deep-copy the retryer so we don't mutate the caller's default
+        # retryer (DEFAULT_RETRYER is a module-level singleton shared across
+        # Configurations). Configuration exposes retryer via a getter-only
+        # property; swap the underlying __retryer via name mangling.
+        fresh._Configuration__retryer = copy.deepcopy(fresh.retryer)
+        # Caller semantics: max_retries = TOTAL attempts (legacy from
+        # _do_http_request's for-loop). Configuration semantics:
+        # num_max_retries = retries AFTER the initial attempt. Convert.
+        fresh.num_max_retries = max(max_retries - 1, 0)
+        # retry_interval is seconds; Configuration uses ms.
+        # Collapse the exponential-backoff range to a fixed delay.
+        delay_ms = int(retry_interval * 1000)
+        fresh.min_retry_delay_ms = delay_ms
+        fresh.max_retry_delay_ms = delay_ms
+
+        # NOTE: NEW ApiClient(fresh), not self -- avoids re-entering caller's provider chain.
+        client = ApiClient(fresh)
+        # BuildRequestInterceptor parses resource_path by index:
+        # [1]=Action [2]=Version [3]=service
+        resource_path = '/{}/{}/{}/post/'.format(action, version, service)
+        logger.debug(
+            "%s: STS call %s %s region=%s host=%s",
+            provider_name, action, version, region, host or fresh.host,
+        )
+        return client.call_api(
+            resource_path,
+            'POST',
+            path_params={},
+            query_params=[],
+            header_params={
+                'Accept': 'application/json',
+                'Content-Type': 'application/x-www-form-urlencoded',
+            },
+            body=params,
+            post_params=[],
+            files={},
+            response_type=object,
+            auth_settings=None,            # skip signing
+            async_req=False,
+            _return_http_data_only=True,
+            _preload_content=True,
+            collection_formats={},
+        )
+
+    def _do_http_request(self, url, method="GET", data=None, headers=None, timeout=None,
+                         max_retries=1, retry_interval=0, request_name=None,
+                         retry_on_5xx=True, provider_name="ApiClient"):
+        """Invoke an arbitrary HTTP(S) endpoint through the SDK's RESTClient.
+
+        Routing through `RESTClientObject` (constructed from `Configuration()`)
+        ensures the transport honors the same TLS/proxy settings as every
+        other SDK API call:
+          - `verify_ssl`, `ssl_ca_cert`, `cert_file`, `key_file`,
+            `assert_hostname`
+          - `proxy` / `http_proxy` / `https_proxy` (plus HTTP_PROXY /
+            HTTPS_PROXY environment variables)
+          - `connect_timeout` / `read_timeout` / connection pool sizing
+
+        Unlike `_sts_call` (which goes through `ApiClient.call_api`), this
+        path skips the OpenAPI semantics layer (signing, Action/Version
+        path parsing, response unwrapping) -- it's meant for non-OpenAPI
+        endpoints such as the SSO OAuth token endpoint, the SSO Portal,
+        and ECS IMDSv2.
+
+        Args:
+          url: Fully-qualified request URL.
+          method: HTTP method.
+          data: Request body.
+          headers: Request headers dict.
+          timeout: Total request timeout (seconds).
+          max_retries: Total number of attempts (including the first).
+          retry_interval: Seconds to sleep between retries.
+          request_name: Human-readable name used in error messages.
+          retry_on_5xx: If True (default) retry on HTTP 5xx responses.
+          provider_name: Used only for log/error context.
+
+        Returns:
+          Response body as a decoded str.
+
+        Raises:
+          RuntimeError on non-2xx HTTP response or transport failure.
+        """
+        import urllib3
+        from byteplussdkcore.rest import RESTClientObject, ApiException
+
+        attempts = max(max_retries, 1)
+        rest_client = RESTClientObject(Configuration())
+
+        last_error = None
+        for attempt in range(attempts):
+            try:
+                logger.debug(
+                    "%s: RESTClient attempt %d/%d %s %s",
+                    provider_name, attempt + 1, attempts, method, url,
+                )
+                r = rest_client.request(
+                    method=method,
+                    url=url,
+                    body=data,
+                    headers=headers,
+                    _request_timeout=timeout,
+                )
+                body = r.data
+                if isinstance(body, bytes):
+                    try:
+                        body = body.decode('utf-8')
+                    except (UnicodeDecodeError, AttributeError):
+                        pass
+                return body
+            except ApiException as e:
+                status = e.status or 0
+                err_body = e.body
+                if isinstance(err_body, bytes):
+                    try:
+                        err_body = err_body.decode('utf-8')
+                    except (UnicodeDecodeError, AttributeError):
+                        err_body = repr(err_body)
+                if status == 0:
+                    raise RuntimeError(
+                        "{}: {} failed at '{}' (transport error): {}".format(
+                            provider_name, request_name or "request", url, e.reason,
+                        )
+                    )
+                if retry_on_5xx and status >= 500:
+                    last_error = RuntimeError(
+                        "HTTP {}: {}".format(status, err_body)
+                    )
+                    logger.debug(
+                        "%s: HTTP %s on attempt %d/%d: %s",
+                        provider_name, status, attempt + 1, attempts, err_body,
+                    )
+                    if attempt < attempts - 1:
+                        time.sleep(retry_interval)
+                    continue
+                raise RuntimeError(
+                    "{}: {} failed with HTTP {}: {}".format(
+                        provider_name, request_name or "request", status, err_body,
+                    )
+                )
+            except (urllib3.exceptions.HTTPError, IOError, OSError) as e:
+                last_error = e
+                logger.debug(
+                    "%s: transport error on attempt %d/%d: %r",
+                    provider_name, attempt + 1, attempts, e,
+                )
+                if attempt < attempts - 1:
+                    time.sleep(retry_interval)
+
+        raise RuntimeError(
+            "{}: failed to call {} at '{}' after {} retries: {}".format(
+                provider_name, request_name or "request", url, attempts, last_error,
+            )
+        )
+
 
 def metadata(self):
     return self._metadata

byteplussdkcore/auth/credential.py

@@ -5,6 +5,10 @@ class Credential(object):
         self.provider = provider
 
     def get(self):
+        """
+        .. deprecated::
+            Use provider.get_credentials() instead.
+        """
         if self.provider.is_expired():
             # refresh if expired
             self.provider.refresh()

byteplussdkcore/auth/providers/__init__.py

@@ -1,4 +1,8 @@
 from .static_provider import StaticCredentialProvider
 from .sts_provider import StsCredentialProvider
 from .sts_oidc_provider import StsOidcCredentialProvider
-from .sts_saml_provider import StsSamlCredentialProvider
+from .sts_saml_provider import StsSamlCredentialProvider
+from .env_provider import EnvironmentVariableCredentialProvider
+from .cli_config_provider import CLIConfigCredentialProvider
+from .ecs_role_provider import EcsRoleCredentialProvider
+from .default_provider import DefaultCredentialProvider