byteplus-python-sdk-v2 3.0.43__py2.py3-none-any.whl → 3.0.45__py2.py3-none-any.whl

byteplussdkcore/auth/providers/sts_saml_provider.py

@@ -4,10 +4,9 @@ import uuid
 from datetime import datetime
 
 import dateutil.parser
+import dateutil.tz
 
-from byteplussdkcore import UniversalApi, UniversalInfo, ApiClient, Configuration
 from .provider import Provider, CredentialValue
-import json
 
 
 class AssumeRoleSamlCredentials:
@@ -20,25 +19,46 @@ class AssumeRoleSamlCredentials:
 
 
 class StsSamlCredentialProvider(Provider):
-    def __init__(self, role_name, account_id, provider_name, saml_resp, duration_seconds=3600, scheme='https',
-                 host=None, region=None, timeout=30, expired_buffer_seconds=60, policy=None):
+    PROVIDER_NAME = "StsSamlCredentialProvider"
+
+    def __init__(self, role_name=None, account_id=None, provider_name=None, saml_resp=None,
+                 duration_seconds=3600, scheme='https',
+                 host='sts.ap-southeast-1.byteplusapi.com', region='ap-southeast-1', timeout=30, expired_buffer_seconds=60,
+                 policy=None, role_trn=None, saml_provider_trn=None, max_retries=3, retry_interval=1):
         self.role_name = role_name
         self.account_id = account_id
         self.provider_name = provider_name
         self.saml_resp = saml_resp
 
+        if role_trn:
+            self._role_trn = role_trn
+        elif role_name and account_id:
+            self._role_trn = 'trn:iam::' + account_id + ':role/' + role_name
+        else:
+            self._role_trn = None
+
+        if saml_provider_trn:
+            self._saml_provider_trn = saml_provider_trn
+        elif provider_name:
+            resolved_account_id = account_id or self._extract_account_id_from_role_trn(self._role_trn)
+            if resolved_account_id:
+                self._saml_provider_trn = 'trn:iam::' + resolved_account_id + ':saml-provider/' + provider_name
+            else:
+                self._saml_provider_trn = None
+        else:
+            self._saml_provider_trn = None
+
         self.timeout = timeout
+        self.max_retries = max(max_retries, 1)
+        self.retry_interval = retry_interval
         self.duration_seconds = duration_seconds
 
         self.host = host
         self.region = region
         self.scheme = scheme
         self.policy = policy
+
         self.expired_time = None
-        if host is None:
-            raise ValueError('host is required')
-        if region is None:
-            raise ValueError('region is required')
         if expired_buffer_seconds > 600:
             raise ValueError('expired_buffer_seconds must be less than or equal to 600')
         self.expired_buffer_seconds = expired_buffer_seconds
@@ -63,40 +83,65 @@ class StsSamlCredentialProvider(Provider):
         self.refresh()
         return self.credentials
 
+    @staticmethod
+    def _extract_account_id_from_role_trn(role_trn):
+        if not role_trn:
+            return None
+        parts = role_trn.split(':')
+        if len(parts) >= 4 and parts[0] == 'trn' and parts[1] == 'iam' and parts[3]:
+            return parts[3]
+        return None
+
     def _assume_role_saml(self):
+        if not self._role_trn:
+            raise RuntimeError(
+                "{}: role_trn not provided. Set role_trn or (role_name + account_id).".format(self.PROVIDER_NAME)
+            )
+        if not self._saml_provider_trn:
+            raise RuntimeError(
+                "{}: saml_provider_trn not provided. "
+                "Set saml_provider_trn, or (account_id + provider_name), "
+                "or (role_trn + provider_name).".format(self.PROVIDER_NAME)
+            )
+        if not self.saml_resp:
+            raise RuntimeError(
+                "{}: saml_resp is required.".format(self.PROVIDER_NAME)
+            )
+
         params = {
             'DurationSeconds': self.duration_seconds,
             'RoleSessionName': uuid.uuid4().hex,
-            'RoleTrn': 'trn:iam::' + self.account_id + ':role/' + self.role_name,
-            'SAMLProviderTrn': 'trn:iam::' + self.account_id + ':saml-provider/' + self.provider_name,
+            'RoleTrn': self._role_trn,
+            'SAMLProviderTrn': self._saml_provider_trn,
             'SAMLResp': self.saml_resp,
         }
         if self.policy is not None:
             params['Policy'] = self.policy
-        configuration = type.__call__(Configuration)
-
-        # configuration.ak = self.ak
-        # configuration.sk = self.sk
-        configuration.host = self.host
-        configuration.region = self.region
-        configuration.scheme = self.scheme
-        configuration.read_timeout = self.timeout
-        c = UniversalApi(ApiClient(configuration))
-        info = UniversalInfo(method='POST', service='sts', version='2018-01-01', action='AssumeRoleWithSAML',
-                             content_type='application/x-www-form-urlencoded')
-
-        resp, status_code, resp_header = c.do_call_with_http_info(info=info, body=params)
-        if 'Credentials' not in resp:
-            raise RuntimeError('failed to retrieve credentials from sts' + str(resp_header))
-        resp_cred = resp['Credentials']
-
-        # Parse the ISO string
-        dt = dateutil.parser.parse(resp_cred['Expiration'])
-
-        # Convert to timestamp (seconds since epoch)
+        from byteplussdkcore import ApiClient, Configuration
+        resp_result = ApiClient(Configuration())._sts_call(
+            action='AssumeRoleWithSAML',
+            version='2018-01-01',
+            params=params,
+            host=self.host,
+            scheme=self.scheme,
+            region=self.region,
+            timeout=self.timeout,
+            max_retries=self.max_retries,
+            retry_interval=self.retry_interval,
+            provider_name=self.PROVIDER_NAME,
+        )
+        if 'Credentials' not in resp_result:
+            raise RuntimeError(
+                'failed to retrieve credentials from sts: {}:{}'.format(
+                    self.PROVIDER_NAME, str(resp_result)
+                )
+            )
+        resp_cred = resp_result['Credentials']
+
+        dt = dateutil.parser.parse(resp_cred.get('Expiration', resp_cred.get('ExpiredTime')))
         self.expired_time = (dt - datetime(1970, 1, 1, tzinfo=dateutil.tz.tzutc())).total_seconds()
 
         self.credentials = CredentialValue(ak=resp_cred['AccessKeyId'],
                                            sk=resp_cred['SecretAccessKey'],
                                            session_token=resp_cred['SessionToken'],
-                                           provider_name='StsSamlCredentialProvider')
+                                           provider_name='StsSamlCredentialProvider')

byteplussdkcore/configuration.py

@@ -287,7 +287,7 @@ class Configuration(six.with_metaclass(TypeWithDefault, object)):
                "OS: {env}\n" \
                "Python Version: {pyversion}\n" \
                "Version of the API: 0.1.0\n" \
-               "SDK Package Version: 3.0.43".\
+               "SDK Package Version: 3.0.45".\
             format(env=sys.platform, pyversion=sys.version)
 
     @property

byteplussdkcore/endpoint/providers/default_provider.py

@@ -135,6 +135,34 @@ default_endpoint = {
         region_endpoint_map={},
         fallback_endpoint=fallback_endpoint,
     ),
+    'vepfs': ServiceEndpointInfo(
+        service='vepfs',
+        is_global=False,
+        global_endpoint='',
+        region_endpoint_map={},
+        fallback_endpoint=fallback_endpoint,
+    ),
+    'vke': ServiceEndpointInfo(
+        service='vke',
+        is_global=False,
+        global_endpoint='',
+        region_endpoint_map={},
+        fallback_endpoint=fallback_endpoint,
+    ),
+    'kickart': ServiceEndpointInfo(
+        service='kickart',
+        is_global=True,
+        global_endpoint='',
+        region_endpoint_map={},
+        fallback_endpoint=fallback_endpoint,
+    ),
+    'rds_mssql': ServiceEndpointInfo(
+        service='rds_mssql',
+        is_global=False,
+        global_endpoint='',
+        region_endpoint_map={},
+        fallback_endpoint=fallback_endpoint,
+    ),
 }
 
 

byteplussdkcore/endpoint/providers/standard_provider.py

@@ -4,8 +4,6 @@ import re
 from byteplussdkcore.endpoint.endpoint_provider import EndpointProvider, ResolvedEndpoint
 
 
-# -----------------------------
-# Errors (模仿 volcengineerr.New)
 # -----------------------------
 class StandProviderError(Exception):
     def __init__(self, code, message):
@@ -167,6 +165,7 @@ ServiceInfos = {
     "vms": ServiceInfo("vms", False),
     "eco_partner": ServiceInfo("eco_partner", True),
     "smc": ServiceInfo("smc", True),
+    "kickart": ServiceInfo("kickart", True),
 }
 
 
@@ -342,6 +341,6 @@ if __name__ == "__main__":
             region="cn-hongkon",
             use_dual_stack=False,
         )
-        print(ep.host)  # 例如：vpc.ap-southeast-1.volcengine-api.com
+        print(ep.host)  # 例如：vpc.ap-southeast-1.byteplus-api.com
     except Exception as e:
         e.print()

byteplussdkcore/feature/__init__.py

@@ -0,0 +1,6 @@
+# coding: utf-8
+"""
+Feature modules for specific service utilities.
+
+This package contains specialized utility modules for various BytePlus services.
+"""

byteplussdkcore/feature/rds/__init__.py

@@ -0,0 +1,4 @@
+# coding: utf-8
+from byteplussdkcore.feature.rds.connect_utils import build_auth_token
+
+__all__ = ['build_auth_token']

byteplussdkcore/feature/rds/connect_utils.py

@@ -0,0 +1,88 @@
+# coding: utf-8
+"""
+RDS MySQL connection authentication utilities.
+
+This module provides utilities for generating authentication tokens for RDS MySQL database connections.
+"""
+
+from byteplussdkcore.endpoint.providers.standard_provider import StandardEndpointResolver
+from byteplussdkcore.interceptor import InterceptorChain, InterceptorContext, SignRequestInterceptor, \
+    ResolveEndpointInterceptor
+from byteplussdkcore.interceptor import Request
+
+DEFAULT_SERVICE = 'rds_mysql'
+DEFAULT_API_VERSION = '2022-01-01'
+DEFAULT_API = 'ConnectDatabase'
+DEFAULT_EXPIRES = 900
+
+
+def build_auth_token(api_client, db_user, instance_id, expires=None):
+    """
+    Build an authentication token (presigned URL query string) for connecting to RDS MySQL database.
+
+    :param api_client: ApiClient instance
+    :param db_user: Database username
+    :param instance_id: RDS instance ID
+    :param expires: Token expiration time in seconds (default: 900, i.e., 15 minutes)
+    :return: Presigned query string for database authentication
+    :raises ValueError: If required parameters are missing or invalid
+    """
+    # Validate api_client
+    if api_client is None:
+        raise ValueError("api_client must not be None")
+
+    configuration = api_client.configuration
+    region = configuration.region
+
+    # Validate inputs
+    if not region:
+        raise ValueError("region must not be empty")
+
+    if not db_user:
+        raise ValueError("db_user must not be empty")
+
+    if not instance_id:
+        raise ValueError("instance_id must not be empty")
+
+    # Set default expiration time
+    if expires is None or expires <= 0:
+        expires = DEFAULT_EXPIRES
+
+    # Build query parameters
+    query = {
+        'Action': DEFAULT_API,
+        'Version': DEFAULT_API_VERSION,
+        'X-Expires': str(expires),
+        'DBUser': db_user,
+        'InstanceId': instance_id,
+    }
+
+    # Create Request with presign mode
+    request = Request(configuration,
+                      resource_path='/{}/{}/{}/get/text_plain/'.format(DEFAULT_API, DEFAULT_API_VERSION,
+                                                                       DEFAULT_SERVICE),
+                      method='GET',
+                      query_params=query)
+    request.endpoint_provider = StandardEndpointResolver()
+    request.service = DEFAULT_SERVICE
+    request.is_presign = True
+
+    context = InterceptorContext(request=request)
+
+    # Step 1: Resolve endpoint to get host
+    resolve_chain = InterceptorChain()
+    resolve_chain.append_request_interceptor(ResolveEndpointInterceptor())
+    context = resolve_chain.execute_request(context)
+
+    # Step 2: Save resolved host to X-Host query param, then clear host so it won't be signed
+    resolved_host = context.request.host
+    context.request.query_params['X-Host'] = '{scheme}://{host}'.format(
+        scheme=context.request.scheme, host=resolved_host)
+    context.request.host = None
+
+    # Step 3: Sign request (host is None, won't be included in signature)
+    sign_chain = InterceptorChain()
+    sign_chain.append_request_interceptor(SignRequestInterceptor())
+    context = sign_chain.execute_request(context)
+
+    return context.request.signed_query

byteplussdkcore/interceptor/interceptors/request.py

@@ -63,6 +63,10 @@ class Request(object):
         self.retryer = configuration.retryer
         self.credential_provider = configuration.credential_provider
 
+        # Presign support
+        self.is_presign = False
+        self.signed_query = None
+
         self.runtime_options = None
         if hasattr(body, '_configuration') and isinstance(body._configuration, RuntimeOption):
             self.runtime_options = body._configuration

byteplussdkcore/interceptor/interceptors/resolve_endpoint_interceptor.py

@@ -19,7 +19,14 @@ class ResolveEndpointInterceptor(RequestInterceptor):
             context.request.host = endpoint_resolver.host
             prefix = endpoint_resolver.url_for(scheme)
         else:
-            prefix = scheme + '://' + host
+            if host.startswith('https://'):
+                prefix = host
+                context.request.host = host[len('https://'):]
+            elif host.startswith('http://'):
+                prefix = host
+                context.request.host = host[len('http://'):]
+            else:
+                prefix = scheme + '://' + host
         context.request.url = prefix + context.request.true_path
         sdk_core_logger.debug_endpoint(
             "Using endpoint: %s", context.request.host

byteplussdkcore/interceptor/interceptors/sign_request_interceptor.py

@@ -1,8 +1,11 @@
 import json
+import threading
 
 from byteplussdkcore.signv4 import SignerV4
 from .interceptor import RequestInterceptor
 
+_DEFAULT_PROVIDER_INIT_LOCK = threading.Lock()
+
 
 class SignRequestInterceptor(RequestInterceptor):
 
@@ -10,25 +13,50 @@ class SignRequestInterceptor(RequestInterceptor):
         return 'byteplus-sign-request-interceptor'
 
     def intercept(self, context):
-        # 新增代码。处理assume_role和assume_role_oidc和assume_role_saml
+        # Auto-inject DefaultCredentialProvider when no credentials are configured
+        if context.request.credential_provider is None and not context.request.ak and not context.request.sk:
+            from byteplussdkcore.auth.providers.default_provider import DefaultCredentialProvider
+            provider = getattr(self, '_default_credential_provider', None)
+            if provider is None:
+                with _DEFAULT_PROVIDER_INIT_LOCK:
+                    provider = getattr(self, '_default_credential_provider', None)
+                    if provider is None:
+                        provider = DefaultCredentialProvider()
+                        self._default_credential_provider = provider
+            context.request.credential_provider = provider
+
+        # Resolve credentials from provider (STS AssumeRole / OIDC / SAML / default chain)
         if context.request.credential_provider is not None:
-            credentials = context.request.credential_provider.get_credentials() # 这会调用 _assume_role_oidc() 方法获取临时凭证
+            credentials = context.request.credential_provider.get_credentials()
             context.request.ak = credentials.ak
             context.request.sk = credentials.sk
             context.request.session_token = credentials.session_token
 
-        self.update_params_for_auth(host=context.request.host, path=context.request.true_path,
-                                    method=context.request.method,
-                                    headers=context.request.header_params,
-                                    querys=context.request.query_params,
-                                    auth_settings=context.request.auth_settings,
-                                    body=context.request.body,
-                                    post_params=context.request.post_params,
-                                    service=context.request.service,
-                                    ak=context.request.ak,
-                                    sk=context.request.sk,
-                                    session_token=context.request.session_token,
-                                    region=context.request.region)
+        if context.request.is_presign:
+            context.request.signed_query = SignerV4.sign_url(
+                path=context.request.true_path,
+                method=context.request.method,
+                query=context.request.query_params,
+                ak=context.request.ak,
+                sk=context.request.sk,
+                region=context.request.region,
+                service=context.request.service,
+                session_token=context.request.session_token,
+                host=context.request.host,
+            )
+        else:
+            self.update_params_for_auth(host=context.request.host, path=context.request.true_path,
+                                        method=context.request.method,
+                                        headers=context.request.header_params,
+                                        querys=context.request.query_params,
+                                        auth_settings=context.request.auth_settings,
+                                        body=context.request.body,
+                                        post_params=context.request.post_params,
+                                        service=context.request.service,
+                                        ak=context.request.ak,
+                                        sk=context.request.sk,
+                                        session_token=context.request.session_token,
+                                        region=context.request.region)
         return context
 
     @staticmethod

byteplussdkcore/signv4.py

@@ -92,3 +92,89 @@ class SignerV4(object):
     @staticmethod
     def hmac_sha256(key, msg):
         return hmac.new(key, msg.encode('utf-8'), hashlib.sha256).digest()
+
+    @staticmethod
+    def sign_url(path, method, query, ak, sk, region, service, session_token=None, host=None):
+        """
+        Generate presigned URL query string (AWS Signature V4)
+
+        :param path: Request path
+        :param method: HTTP method (GET, POST, etc.)
+        :param query: Query parameters dict
+        :param ak: Access Key
+        :param sk: Secret Key
+        :param region: Service region
+        :param service: Service name
+        :param session_token: Optional session token
+        :param host: Optional host header to sign
+        :return: Query string with signature
+        """
+        format_date = datetime.datetime.utcnow().strftime("%Y%m%dT%H%M%SZ")
+        date = format_date[:8]
+
+        # Build credential scope
+        credential_scope = '/'.join([date, region, service, 'request'])
+
+        # Determine if host header should be signed
+        sign_host = host is not None and host != ''
+
+        # Add required query parameters
+        query = dict(query)  # Make a copy to avoid modifying original
+        query['X-Date'] = format_date
+        query['X-NotSignBody'] = ''
+        query['X-Credential'] = ak + '/' + credential_scope
+        query['X-Algorithm'] = 'HMAC-SHA256'
+        query['X-SignedHeaders'] = 'host' if sign_host else ''
+        query['X-SignedQueries'] = ''
+
+        # Generate X-SignedQueries BEFORE adding X-Security-Token
+        query['X-SignedQueries'] = ';'.join(sorted(query.keys()))
+        signed_query_keys = set(query.keys())
+
+        # X-Security-Token must be added AFTER X-SignedQueries calculation
+        if session_token:
+            query['X-Security-Token'] = session_token
+
+        # Build canonical request
+        body_hash = hashlib.sha256(b'').hexdigest()
+        canonical_query_params = {k: v for k, v in query.items() if k in signed_query_keys}
+
+        if sign_host:
+            canonical_request = '\n'.join([
+                method,
+                path,
+                SignerV4.canonical_query(canonical_query_params),
+                'host:' + host + '\n',
+                'host',
+                body_hash
+            ])
+        else:
+            canonical_request = '\n'.join([
+                method,
+                path,
+                SignerV4.canonical_query(canonical_query_params),
+                '\n',
+                '',
+                body_hash
+            ])
+        sdk_core_logger.debug_sign("[sign_url] canonical_request:\n%s", canonical_request)
+
+        # Build string to sign
+        signing_str = '\n'.join([
+            'HMAC-SHA256',
+            format_date,
+            credential_scope,
+            hashlib.sha256(canonical_request.encode('utf-8')).hexdigest()
+        ])
+        sdk_core_logger.debug_sign("[sign_url] string_to_sign:\n%s", signing_str)
+
+        # Calculate signature
+        signing_key = SignerV4.get_signing_secret_key_v4(sk, date, region, service)
+        signature = hmac.new(signing_key, signing_str.encode('utf-8'), hashlib.sha256).hexdigest()
+        sdk_core_logger.debug_sign("[sign_url] calculated signature: %s", signature)
+
+        # Add signature to query
+        query['X-Signature'] = signature
+
+        # Return encoded query string
+        return urlencode(sorted(query.items()))

byteplussdkexamples/byteplussdkarkruntime/async_completions.py

@@ -10,8 +10,6 @@ from byteplussdkarkruntime import AsyncArk
 
 # 2.If you authorize your endpoint with Identity and Access Management（IAM), set your api key to environment variable "BYTEPLUS_ACCESSKEY", "BYTEPLUS_SECRETKEY"
 # or specify ak&sk by Ark(ak="${YOUR_AK}", sk="${YOUR_SK}").
-# To get your ak&sk, please refer to this document(https://www.volcengine.com/docs/6291/65568)
-# For more information，please check this document（https://www.volcengine.com/docs/82379/1263279）
 client = AsyncArk()
 
 

byteplussdkexamples/byteplussdkarkruntime/completions.py

@@ -6,10 +6,8 @@ from byteplussdkarkruntime import Ark
 # Note: If you use an API key, this API key will not be refreshed.
 # To prevent the API from expiring and failing after some time, choose an API key with no expiration date.
 
-# 2.If you authorize your endpoint with Volcengine Identity and Access Management（IAM), set your api key to environment variable "BYTEPLUS_ACCESSKEY", "BYTEPLUS_SECRETKEY"
+# 2.If you authorize your endpoint with BytePlus Identity and Access Management（IAM), set your api key to environment variable "BYTEPLUS_ACCESSKEY", "BYTEPLUS_SECRETKEY"
 # or specify ak&sk by Ark(ak="${YOUR_AK}", sk="${YOUR_SK}").
-# To get your ak&sk, please refer to this document(https://www.volcengine.com/docs/6291/65568)
-# For more information，please check this document（https://www.volcengine.com/docs/82379/1263279）
 client = Ark()
 
 if __name__ == "__main__":

byteplussdkexamples/byteplussdkarkruntime/context.py

@@ -7,11 +7,9 @@ from byteplussdkarkruntime import Ark
 # Note: If you use an API key, this API key will not be refreshed.
 # To prevent the API from expiring and failing after some time, choose an API key with no expiration date.
 
-# 2.If you authorize your endpoint with Volcengine Identity and Access Management（IAM),
+# 2.If you authorize your endpoint with BytePlus Identity and Access Management（IAM),
 # set your api key to environment variable "BYTEPLUS_ACCESSKEY", "BYTEPLUS_SECRETKEY"
 # or specify ak&sk by Ark(ak="${YOUR_AK}", sk="${YOUR_SK}").
-# To get your ak&sk, please refer to this document(https://www.volcengine.com/docs/6291/65568)
-# For more information，please check this document（https://www.volcengine.com/docs/82379/1263279）
 client = Ark()
 
 if __name__ == "__main__":