byteplus-python-sdk-v2 3.0.43__py2.py3-none-any.whl → 3.0.45__py2.py3-none-any.whl

byteplussdkcore/auth/providers/default_provider.py

@@ -0,0 +1,103 @@
+# coding=utf-8
+import logging
+import os
+import threading
+
+from .provider import Provider
+
+logger = logging.getLogger(__name__)
+
+class DefaultCredentialProvider(Provider):
+    PROVIDER_NAME = "DefaultCredentialProvider"
+
+    def __init__(self, role_name=None,
+                 reuse_last_provider_enabled=True,
+                 providers=None):
+        if providers is not None:
+            self._providers = list(providers)
+        else:
+            from .env_provider import EnvironmentVariableCredentialProvider
+            from .sts_oidc_provider import StsOidcCredentialProvider
+            from .cli_config_provider import CLIConfigCredentialProvider
+            from .ecs_role_provider import EcsRoleCredentialProvider
+
+            self._providers = [
+                EnvironmentVariableCredentialProvider(),
+                StsOidcCredentialProvider(),
+                CLIConfigCredentialProvider(),
+            ]
+            if os.environ.get("BYTEPLUS_ECS_METADATA_DISABLED", "").lower() != "true":
+                self._providers.append(
+                    EcsRoleCredentialProvider(role_name=role_name)
+                )
+        self._reuse_last_provider_enabled = reuse_last_provider_enabled
+        self._last_provider = None
+        self._lock = threading.Lock()
+
+    @staticmethod
+    def _truncate_error_message(err):
+        err_msg = str(err)
+        if len(err_msg) > 200:
+            return err_msg[:200] + "...(truncated)"
+        return err_msg
+
+    def _drop_cached_provider(self, provider, err, action):
+        logger.warning(
+            "%s: cached provider %s failed to %s (%s: %s); falling back to full chain",
+            self.PROVIDER_NAME,
+            type(provider).__name__,
+            action,
+            type(err).__name__,
+            self._truncate_error_message(err),
+        )
+        with self._lock:
+            self._last_provider = None
+
+    def retrieve(self):
+        return self.get_credentials()
+
+    def is_expired(self):
+        provider = self._last_provider
+        if provider is not None:
+            return provider.is_expired()
+        return True
+
+    def refresh(self):
+        provider = self._last_provider
+        if provider is not None:
+            try:
+                provider.refresh()
+                return
+            except Exception as e:
+                self._drop_cached_provider(provider, e, "refresh credentials")
+        self.get_credentials()
+
+    def get_credentials(self):
+        if self._reuse_last_provider_enabled:
+            provider = self._last_provider
+            if provider is not None:
+                try:
+                    creds = provider.get_credentials()
+                    if creds is not None:
+                        return creds
+                except Exception as e:
+                    self._drop_cached_provider(provider, e, "return credentials")
+
+        errors = []
+        for provider in self._providers:
+            try:
+                creds = provider.get_credentials()
+                if creds is not None:
+                    if self._reuse_last_provider_enabled:
+                        with self._lock:
+                            self._last_provider = provider
+                    return creds
+            except Exception as e:
+                errors.append("{}: {}".format(type(provider).__name__, str(e)))
+                continue
+
+        error_details = "\n  ".join(errors) if errors else "no providers configured"
+        raise RuntimeError(
+            "{}: unable to resolve credentials from any provider in the chain.\n"
+            "Attempted providers:\n  {}".format(self.PROVIDER_NAME, error_details)
+        )

byteplussdkcore/auth/providers/ecs_role_provider.py

@@ -0,0 +1,186 @@
+# coding=utf-8
+import json
+import logging
+import os
+import threading
+import time
+from datetime import datetime
+
+import dateutil.parser
+import dateutil.tz
+
+from .provider import Provider, CredentialValue
+
+logger = logging.getLogger(__name__)
+
+# ECS IMDSv2 endpoint and protocol
+_IMDS_ENDPOINT = "http://100.96.0.96"
+_IMDS_CREDENTIALS_PATH = "/volcstack/latest/iam/security_credentials/{role_name}"  # GET
+_IMDS_ROLE_NAME_PATH = "/volcstack/latest/iam/security_credentials?type=user&format=json"  # GET
+_IMDS_TOKEN_PATH = "/latest/api/token"  # PUT
+
+# ECS IMDSv2 headers
+_IMDS_TOKEN_TTL_HEADER = "X-volc-ecs-metadata-token-ttl-seconds"
+_IMDS_TOKEN_HEADER = "X-volc-ecs-metadata-token"
+_IMDS_TOKEN_TTL_SECONDS = "21600"  # 6 hours
+
+# ECS IMDSv2 response field names
+_FIELD_AK = "AccessKeyId"
+_FIELD_SK = "SecretAccessKey"
+_FIELD_TOKEN = "SessionToken"
+_FIELD_EXPIRATION = "ExpiredTime"
+
+
+class EcsRoleCredentialProvider(Provider):
+    PROVIDER_NAME = "EcsRoleCredentialProvider"
+
+    def __init__(self, role_name=None, connect_timeout=1, read_timeout=1,
+                 max_retries=3, retry_interval=1, expired_buffer_seconds=300):
+        if os.environ.get("BYTEPLUS_ECS_METADATA_DISABLED", "").lower() == "true":
+            raise ValueError(
+                "{}: IMDS credentials are disabled via "
+                "BYTEPLUS_ECS_METADATA_DISABLED=true.".format(self.PROVIDER_NAME)
+            )
+
+        self._role_name = role_name
+        self._connect_timeout = connect_timeout
+        self._read_timeout = read_timeout
+        self._max_retries = max(max_retries, 1)
+        self._retry_interval = retry_interval
+        self._expired_buffer_seconds = expired_buffer_seconds
+
+        self._credentials = None
+        self._expired_time = None
+        self._lock = threading.Lock()
+
+    def retrieve(self):
+        return self._credentials
+
+    def is_expired(self):
+        return (self._credentials is None or
+                (self._expired_time is not None
+                 and self._expired_time < time.time() + self._expired_buffer_seconds))
+
+    def refresh(self):
+        with self._lock:
+            if self.is_expired():
+                self._refresh_credentials()
+
+    def get_credentials(self):
+        self.refresh()
+        return self._credentials
+
+    def _get_imdsv2_token(self):
+        url = _IMDS_ENDPOINT + _IMDS_TOKEN_PATH
+        headers = {_IMDS_TOKEN_TTL_HEADER: _IMDS_TOKEN_TTL_SECONDS}
+        body = self._do_request(url, method="PUT", extra_headers=headers)
+        token = body.strip()
+        if not token:
+            raise RuntimeError(
+                "{}: IMDSv2 token endpoint returned empty response.".format(
+                    self.PROVIDER_NAME
+                )
+            )
+        return token
+
+    def _resolve_role_name(self, imds_token):
+        if self._role_name:
+            return self._role_name
+
+        env_role = os.environ.get("BYTEPLUS_ECS_METADATA", "").strip()
+        if env_role:
+            return env_role
+
+        return self._auto_detect_role_name(imds_token)
+
+    def _auto_detect_role_name(self, imds_token):
+        url = _IMDS_ENDPOINT + _IMDS_ROLE_NAME_PATH
+        headers = {_IMDS_TOKEN_HEADER: imds_token}
+        body = self._do_request(url, method="GET", extra_headers=headers)
+
+        try:
+            roles = json.loads(body)
+        except ValueError:
+            roles = [r.strip() for r in body.strip().split('\n') if r.strip()]
+
+        if isinstance(roles, list):
+            roles = [r.strip() if isinstance(r, str) else str(r) for r in roles if r]
+        else:
+            raise RuntimeError(
+                "{}: unexpected role list response format: {}".format(
+                    self.PROVIDER_NAME, type(roles).__name__
+                )
+            )
+
+        if not roles:
+            raise RuntimeError(
+                "{}: no IAM roles found via IMDS.".format(self.PROVIDER_NAME)
+            )
+
+        if len(roles) > 1:
+            logger.warning(
+                "%s: multiple IAM roles found via IMDS: %s. Using the first one '%s'. "
+                "Set BYTEPLUS_ECS_METADATA or pass role_name explicitly to avoid ambiguity.",
+                self.PROVIDER_NAME, roles, roles[0],
+            )
+
+        return roles[0]
+
+    def _refresh_credentials(self):
+        imds_token = self._get_imdsv2_token()
+        role_name = self._resolve_role_name(imds_token)
+
+        url = _IMDS_ENDPOINT + _IMDS_CREDENTIALS_PATH.format(role_name=role_name)
+        headers = {_IMDS_TOKEN_HEADER: imds_token}
+        body = self._do_request(url, method="GET", extra_headers=headers)
+
+        try:
+            data = json.loads(body)
+        except ValueError as e:
+            raise RuntimeError(
+                "{}: failed to parse IMDS response: {}".format(self.PROVIDER_NAME, e)
+            )
+
+        ak = data.get(_FIELD_AK)
+        sk = data.get(_FIELD_SK)
+        token = data.get(_FIELD_TOKEN)
+        expiration_str = data.get(_FIELD_EXPIRATION)
+
+        if not ak or not sk:
+            raise RuntimeError(
+                "{}: IMDS response missing required credential fields.".format(
+                    self.PROVIDER_NAME
+                )
+            )
+
+        if expiration_str:
+            dt = dateutil.parser.parse(expiration_str)
+            self._expired_time = (
+                dt - datetime(1970, 1, 1, tzinfo=dateutil.tz.tzutc())
+            ).total_seconds()
+        else:
+            self._expired_time = None
+
+        self._credentials = CredentialValue(
+            ak=ak,
+            sk=sk,
+            session_token=token,
+            provider_name=self.PROVIDER_NAME,
+        )
+
+    def _do_request(self, url, method="GET", extra_headers=None):
+        """Perform an HTTP request with retries."""
+        # Late imports to avoid circular deps (auth.providers is imported
+        # indirectly by byteplussdkcore/__init__.py).
+        from byteplussdkcore import ApiClient, Configuration
+        timeout = self._connect_timeout + self._read_timeout
+        return ApiClient(Configuration())._do_http_request(
+            url=url,
+            method=method,
+            headers=extra_headers,
+            timeout=timeout,
+            max_retries=self._max_retries,
+            retry_interval=self._retry_interval,
+            request_name="IMDS request",
+            provider_name=self.PROVIDER_NAME,
+        )

byteplussdkcore/auth/providers/env_provider.py

@@ -0,0 +1,38 @@
+# coding=utf-8
+import os
+
+from .provider import Provider, CredentialValue
+
+
+class EnvironmentVariableCredentialProvider(Provider):
+    PROVIDER_NAME = "EnvironmentVariableCredentialProvider"
+
+    def retrieve(self):
+        return self.get_credentials()
+
+    def is_expired(self):
+        return False
+
+    def refresh(self):
+        return
+
+    def get_credentials(self):
+        ak = os.environ.get("BYTEPLUS_ACCESSKEY") or os.environ.get("BYTEPLUS_ACCESS_KEY")
+        sk = os.environ.get("BYTEPLUS_SECRETKEY") or os.environ.get("BYTEPLUS_SECRET_KEY")
+
+        if not ak or not sk:
+            raise RuntimeError(
+                "{}: unable to resolve credentials from environment variables. "
+                "Please set BYTEPLUS_ACCESSKEY and BYTEPLUS_SECRETKEY.".format(
+                    self.PROVIDER_NAME
+                )
+            )
+
+        session_token = os.environ.get("BYTEPLUS_SESSION_TOKEN")
+
+        return CredentialValue(
+            ak=ak,
+            sk=sk,
+            session_token=session_token if session_token else None,
+            provider_name=self.PROVIDER_NAME,
+        )

byteplussdkcore/auth/providers/provider.py

@@ -1,5 +1,6 @@
 # coding=utf-8
 import abc
+import json
 
 
 class CredentialValue:
@@ -11,6 +12,7 @@ class CredentialValue:
 
 
 class Provider(object):
+    PROVIDER_NAME = "Provider"
 
     @abc.abstractmethod
     def retrieve(self):
@@ -26,4 +28,37 @@ class Provider(object):
 
     @abc.abstractmethod
     def get_credentials(self):
-        raise NotImplementedError()
+        raise NotImplementedError()
+
+    def _parse_json_response(self, content, response_name="response"):
+        try:
+            resp = json.loads(content)
+        except ValueError as e:
+            raise RuntimeError(
+                "{}: failed to parse {} as JSON: {}. raw={}".format(
+                    self.PROVIDER_NAME, response_name, e, content
+                )
+            )
+
+        if not isinstance(resp, dict):
+            raise RuntimeError(
+                "{}: unexpected {} type: {}".format(
+                    self.PROVIDER_NAME, response_name, type(resp).__name__
+                )
+            )
+
+        return resp
+
+    def _unwrap_result(self, resp, response_name="response"):
+        if 'Result' not in resp:
+            return resp
+
+        result = resp['Result']
+        if not isinstance(result, dict):
+            raise RuntimeError(
+                "{}: unexpected {}.Result type: {}".format(
+                    self.PROVIDER_NAME, response_name, type(result).__name__
+                )
+            )
+
+        return result

byteplussdkcore/auth/providers/static_provider.py

@@ -4,9 +4,6 @@ from .provider import Provider, CredentialValue
 
 class StaticCredentialProvider(Provider):
 
-    def _refresh(self):
-        return
-
     def __init__(self, access_key_id, secret_access_key, session_token=None):
         self.credentials = CredentialValue(
             access_key_id,
@@ -23,3 +20,6 @@ class StaticCredentialProvider(Provider):
 
     def refresh(self):
         return
+
+    def get_credentials(self):
+        return self.credentials

byteplussdkcore/auth/providers/sts_oidc_provider.py

@@ -1,11 +1,12 @@
+import os
 import threading
 import time
 import uuid
 from datetime import datetime
 
 import dateutil.parser
+import dateutil.tz
 
-from byteplussdkcore import UniversalApi, UniversalInfo, ApiClient, Configuration
 from .provider import Provider, CredentialValue
 
 
@@ -19,30 +20,70 @@ class AssumeRoleOidcCredentials:
 
 
 class StsOidcCredentialProvider(Provider):
-    def __init__(self, role_name, account_id, oidc_token, duration_seconds=3600, scheme='https',
-                 host=None, region=None, timeout=30, expired_buffer_seconds=60, policy=None):
+    PROVIDER_NAME = "StsOidcCredentialProvider"
+
+    def __init__(self, role_name=None, account_id=None, oidc_token=None,
+                 duration_seconds=3600, scheme='https',
+                 host='sts.ap-southeast-1.byteplusapi.com', region='ap-southeast-1', timeout=30,
+                 expired_buffer_seconds=60, policy=None,
+                 role_trn=None, oidc_token_file=None, session_name=None,
+                 max_retries=3, retry_interval=1):
+
+        self._legacy_mode = oidc_token is not None
+
+        if role_trn:
+            self._role_trn = role_trn
+        elif role_name and account_id:
+            self._role_trn = 'trn:iam::' + account_id + ':role/' + role_name
+        elif not self._legacy_mode:
+            env_trn = os.environ.get("BYTEPLUS_OIDC_ROLE_TRN", "")
+            self._role_trn = env_trn if env_trn else None
+        else:
+            self._role_trn = None
+
         self.role_name = role_name
         self.account_id = account_id
-        self.oidc_token = oidc_token
+
+        self._oidc_token = oidc_token
+        if not self._legacy_mode:
+            self._oidc_token_file = oidc_token_file or os.environ.get("BYTEPLUS_OIDC_TOKEN_FILE", "") or None
+        else:
+            self._oidc_token_file = oidc_token_file
+
+        if session_name:
+            self._session_name = session_name
+        elif not self._legacy_mode:
+            self._session_name = os.environ.get("BYTEPLUS_OIDC_ROLE_SESSION_NAME", "") or None
+        else:
+            self._session_name = None
+
+        if policy is not None:
+            self.policy = policy
+        elif not self._legacy_mode:
+            self.policy = os.environ.get("BYTEPLUS_OIDC_ROLE_POLICY") or None
+        else:
+            self.policy = None
+
+        if host:
+            self.host = host
+        elif not self._legacy_mode:
+            self.host = os.environ.get("BYTEPLUS_OIDC_STS_ENDPOINT", "") or "sts.byteplusapi.com"
+        else:
+            self.host = "sts.byteplusapi.com"
 
         self.timeout = timeout
+        self.max_retries = max(max_retries, 1)
+        self.retry_interval = retry_interval
         self.duration_seconds = duration_seconds
-
-        self.host = host
         self.region = region
         self.scheme = scheme
-        self.policy = policy
-        self.expired_time = None
-        if host is None:
-            raise ValueError('host is required')
-        if region is None:
-            raise ValueError('region is required')
+
         if expired_buffer_seconds > 600:
             raise ValueError('expired_buffer_seconds must be less than or equal to 600')
         self.expired_buffer_seconds = expired_buffer_seconds
 
+        self.expired_time = None
         self.credentials = None
-
         self._lock = threading.Lock()
 
     def retrieve(self):
@@ -61,39 +102,88 @@ class StsOidcCredentialProvider(Provider):
         self.refresh()
         return self.credentials
 
+    def _resolve_oidc_token(self):
+        if self._oidc_token:
+            return self._oidc_token
+
+        token_file = self._oidc_token_file
+        if not token_file:
+            raise RuntimeError(
+                "{}: OIDC token not provided. Set oidc_token, oidc_token_file, "
+                "or BYTEPLUS_OIDC_TOKEN_FILE environment variable.".format(self.PROVIDER_NAME)
+            )
+
+        try:
+            with open(token_file, 'r') as f:
+                token = f.read().strip()
+        except (IOError, OSError) as e:
+            raise RuntimeError(
+                "{}: failed to read OIDC token file '{}': {}".format(
+                    self.PROVIDER_NAME, token_file, e
+                )
+            )
+
+        if not token:
+            raise RuntimeError(
+                "{}: OIDC token file '{}' is empty.".format(self.PROVIDER_NAME, token_file)
+            )
+
+        return token
+
     def _assume_role_oidc(self):
+        if not self._role_trn:
+            raise RuntimeError(
+                "{}: role_trn not provided. Set role_trn (or role_name+account_id), "
+                "or BYTEPLUS_OIDC_ROLE_TRN environment variable.".format(self.PROVIDER_NAME)
+            )
+
+        oidc_token = self._resolve_oidc_token()
+
+        if self._session_name:
+            session_name = self._session_name
+        elif self._legacy_mode:
+            session_name = uuid.uuid4().hex
+        else:
+            session_name = "credentials-python-" + str(int(time.time() * 1000000))
+
         params = {
             'DurationSeconds': self.duration_seconds,
-            'RoleSessionName': uuid.uuid4().hex,
-            'RoleTrn': 'trn:iam::' + self.account_id + ':role/' + self.role_name,
-            'OIDCToken': self.oidc_token,
+            'RoleSessionName': session_name,
+            'RoleTrn': self._role_trn,
+            'OIDCToken': oidc_token,
         }
-        if self.policy is not None:
+        if self.policy:
             params['Policy'] = self.policy
-        configuration = type.__call__(Configuration)
-
-        # configuration.ak = self.ak
-        # configuration.sk = self.sk
-        configuration.host = self.host
-        configuration.region = self.region
-        configuration.scheme = self.scheme
-        configuration.read_timeout = self.timeout
-        c = UniversalApi(ApiClient(configuration))
-        info = UniversalInfo(method='POST', service='sts', version='2018-01-01', action='AssumeRoleWithOIDC',
-                             content_type='application/x-www-form-urlencoded')
-
-        resp, status_code, resp_header = c.do_call_with_http_info(info=info, body=params)
-        if 'Credentials' not in resp:
-            raise RuntimeError('failed to retrieve credentials from sts' + str(resp_header))
-        resp_cred = resp['Credentials']
-
-        # Parse the ISO string
-        dt = dateutil.parser.parse(resp_cred['Expiration'])
-
-        # Convert to timestamp (seconds since epoch)
+
+        # Late imports to avoid circular deps (auth.providers is imported
+        # indirectly by byteplussdkcore/__init__.py).
+        from byteplussdkcore import ApiClient, Configuration
+        resp_result = ApiClient(Configuration())._sts_call(
+            action='AssumeRoleWithOIDC',
+            version='2018-01-01',
+            params=params,
+            host=self.host,
+            scheme=self.scheme,
+            region=self.region,
+            timeout=self.timeout,
+            max_retries=self.max_retries,
+            retry_interval=self.retry_interval,
+            provider_name=self.PROVIDER_NAME,
+        )
+        if 'Credentials' not in resp_result:
+            raise RuntimeError(
+                'failed to retrieve credentials from sts {}:{}'.format(
+                    self.PROVIDER_NAME, str(resp_result)
+                )
+            )
+        resp_cred = resp_result['Credentials']
+
+        dt = dateutil.parser.parse(resp_cred.get('Expiration', resp_cred.get('ExpiredTime')))
         self.expired_time = (dt - datetime(1970, 1, 1, tzinfo=dateutil.tz.tzutc())).total_seconds()
 
-        self.credentials = CredentialValue(ak=resp_cred['AccessKeyId'],
-                                           sk=resp_cred['SecretAccessKey'],
-                                           session_token=resp_cred['SessionToken'],
-                                           provider_name='StsOidcCredentialProvider')
+        self.credentials = CredentialValue(
+            ak=resp_cred['AccessKeyId'],
+            sk=resp_cred['SecretAccessKey'],
+            session_token=resp_cred['SessionToken'],
+            provider_name=self.PROVIDER_NAME,
+        )

byteplussdkcore/auth/providers/sts_provider.py

@@ -20,13 +20,15 @@ class AssumeRoleCredentials:
 
 class StsCredentialProvider(Provider):
     def __init__(self, ak, sk, role_name, account_id, duration_seconds=3600, scheme='https',
-                 host='open.byteplusapi.com', region='ap-singapore-1', timeout=30, expired_buffer_seconds=60,policy = None):
+                 host='sts.ap-southeast-1.byteplusapi.com', region='ap-southeast-1', timeout=30, expired_buffer_seconds=60, policy=None, max_retries=3, retry_interval=1):
         self.ak = ak
         self.sk = sk
         self.role_name = role_name
         self.account_id = account_id
 
         self.timeout = timeout
+        self.max_retries = max(max_retries, 1)
+        self.retry_interval = retry_interval
         self.duration_seconds = duration_seconds
 
         self.host = host
@@ -74,6 +76,13 @@ class StsCredentialProvider(Provider):
         configuration.region = self.region
         configuration.scheme = self.scheme
         configuration.read_timeout = self.timeout
+
+        import copy
+        configuration._Configuration__retryer = copy.deepcopy(configuration.retryer)
+        configuration.num_max_retries = max(self.max_retries - 1, 0)
+        delay_ms = int(self.retry_interval * 1000)
+        configuration.min_retry_delay_ms = delay_ms
+        configuration.max_retry_delay_ms = delay_ms
         c = UniversalApi(ApiClient(configuration))
         info = UniversalInfo(method='GET', service='sts', version='2018-01-01', action='AssumeRole',
                              content_type='text/plain')