byteplus-python-sdk-v2 3.0.61__py2.py3-none-any.whl → 3.0.62__py2.py3-none-any.whl

byteplussdkcore/auth/sts_http_config.py

@@ -0,0 +1,133 @@
+# coding: utf-8
+"""Proxy / TLS customization shared by the STS credential providers.
+
+This mirrors the Go SDK's ``ProxyConfig`` (see ``byteplus/credentials/
+http_client.go``). It bundles the three public knobs used when reaching the
+STS endpoint and knows how to project them onto an SDK ``Configuration``:
+
+    proxy_url            -> configuration.proxy
+    ca_file              -> configuration.ssl_ca_cert
+    insecure_skip_verify -> configuration.verify_ssl (inverted)
+
+Unlike the Go SDK -- which builds a dedicated ``*http.Transport`` -- the
+Python SDK already routes every request (including STS federation calls)
+through ``RESTClientObject``, which reads these ``Configuration`` fields
+directly. So the only thing this helper needs to do is set the fields.
+
+An explicit provider ``proxy_url`` wins over its client-local fallback.
+When both are empty, the transport retains default configuration and
+``HTTP_PROXY`` / ``HTTPS_PROXY`` lookup; it does not implement ``NO_PROXY``.
+
+TLS priority also matches Go's ``tls.Config``: ``insecure_skip_verify``
+takes precedence over ``ca_file`` (when verification is skipped the custom
+CA is irrelevant).
+"""
+
+from __future__ import absolute_import
+
+import base64
+
+import six
+from six.moves.urllib.parse import unquote, urlparse
+
+
+class StsHttpConfig(object):
+    """Carries proxy / TLS options for a single STS request path.
+
+    :param proxy_url: Forward proxy address, ``scheme://[user:password@]host:port``.
+                      Empty preserves default configuration and environment lookup.
+    :param ca_file: Path to a custom CA bundle (PEM) used to verify the STS
+                    server certificate. Restores verification unless skipped.
+                    Empty inherits ssl_ca_cert, otherwise REST uses certifi.
+    :param insecure_skip_verify: When True, skip TLS certificate/hostname
+                    verification. For debugging only; never use in production.
+    """
+
+    def __init__(self, proxy_url=None, ca_file=None, insecure_skip_verify=False):
+        self.proxy_url = proxy_url or None
+        self.ca_file = ca_file or None
+        self.insecure_skip_verify = bool(insecure_skip_verify)
+
+    def is_empty(self):
+        """True when no proxy/TLS option is configured.
+
+        Callers use this to leave the underlying ``Configuration`` untouched,
+        so existing behavior (including BYTEPLUS env-var proxies) is
+        preserved when the user did not opt in. Mirrors Go's ``IsZero``.
+        """
+        return (not self.proxy_url) and (not self.ca_file) and (not self.insecure_skip_verify)
+
+    def apply_to_configuration(self, configuration):
+        """Project the configured options onto ``configuration`` in place.
+
+        No-op when :meth:`is_empty` is True.
+        """
+        if self.is_empty():
+            return configuration
+
+        if self.proxy_url:
+            # Highest-priority proxy source; RESTClientObject honors this over
+            # http_proxy / https_proxy / env vars.
+            configuration.proxy = self.proxy_url
+
+        # TLS: insecure_skip_verify wins over ca_file (same as Go's tls.Config,
+        # where RootCAs is ignored once InsecureSkipVerify is set).
+        if self.insecure_skip_verify:
+            configuration.verify_ssl = False
+            configuration.ssl_ca_cert = None
+        elif self.ca_file:
+            configuration.verify_ssl = True
+            configuration.ssl_ca_cert = self.ca_file
+
+        return configuration
+
+    def proxy_authorization_header(self):
+        """Return the ``Proxy-Authorization`` header value, or None.
+
+        Delegates to :func:`build_proxy_authorization_header` using this
+        config's ``proxy_url``.
+        """
+        return build_proxy_authorization_header(self.proxy_url)
+
+
+def build_proxy_authorization_header(proxy_url):
+    """Build a ``Basic`` ``Proxy-Authorization`` value from an embedded userinfo.
+
+    urllib3 (v2) does NOT automatically forward the ``user:password@`` embedded
+    in a proxy URL as a ``Proxy-Authorization`` header, whereas Go's
+    ``http.ProxyURL`` / ``http.ProxyFromEnvironment`` do. To keep behavior
+    aligned with the Go SDK, callers extract this header explicitly and pass it
+    to ``ProxyManager(proxy_headers=...)``.
+
+    Returns None when ``proxy_url`` is empty or carries no userinfo. Raises
+    ``ValueError`` when ``proxy_url`` cannot be parsed.
+    """
+    if not proxy_url:
+        return None
+
+    try:
+        parsed = urlparse(proxy_url)
+    except (ValueError, AttributeError) as e:
+        raise ValueError("invalid proxy url {0!r}: {1}".format(proxy_url, e))
+
+    username = parsed.username
+    if username is None:
+        return None
+    password = parsed.password or ""
+
+    # Go's http.Transport derives proxy Basic auth from url.Userinfo, whose
+    # Username()/Password() return the PERCENT-DECODED values. urlparse keeps
+    # userinfo raw, so decode here to stay byte-for-byte identical with the Go
+    # SDK (e.g. a "p%40ss" password must be sent as "p@ss").
+    # Python 2 unquote accepts UTF-8 bytes; Python 3 accepts text.
+    if six.PY2:
+        username = username.encode("utf-8") if isinstance(username, six.text_type) else username
+        password = password.encode("utf-8") if isinstance(password, six.text_type) else password
+    username = unquote(username)
+    password = unquote(password)
+    if isinstance(username, six.text_type):
+        username = username.encode("utf-8")
+    if isinstance(password, six.text_type):
+        password = password.encode("utf-8")
+    # urllib3.make_headers uses Latin-1, which cannot encode UTF-8 userinfo.
+    return "Basic " + base64.b64encode(username + b":" + password).decode("ascii")

byteplussdkcore/configuration.py

@@ -302,7 +302,7 @@ class Configuration(six.with_metaclass(TypeWithDefault, object)):
                "OS: {env}\n" \
                "Python Version: {pyversion}\n" \
                "Version of the API: 0.1.0\n" \
-               "SDK Package Version: 3.0.61".\
+               "SDK Package Version: 3.0.62".\
             format(env=sys.platform, pyversion=sys.version)
 
     @property

byteplussdkcore/feature/rds/connect_utils.py

@@ -6,9 +6,8 @@ This module provides utilities for generating authentication tokens for RDS MySQ
 """
 
 from byteplussdkcore.endpoint.providers.standard_provider import StandardEndpointResolver
-from byteplussdkcore.interceptor import InterceptorChain, InterceptorContext, SignRequestInterceptor, \
+from byteplussdkcore.interceptor import InterceptorChain, InterceptorContext, \
     ResolveEndpointInterceptor
-from byteplussdkcore.interceptor import Request
 
 DEFAULT_SERVICE = 'rds_mysql'
 DEFAULT_API_VERSION = '2022-01-01'
@@ -58,11 +57,10 @@ def build_auth_token(api_client, db_user, instance_id, expires=None):
     }
 
     # Create Request with presign mode
-    request = Request(configuration,
-                      resource_path='/{}/{}/{}/get/text_plain/'.format(DEFAULT_API, DEFAULT_API_VERSION,
-                                                                       DEFAULT_SERVICE),
-                      method='GET',
-                      query_params=query)
+    request = api_client._create_request(
+        resource_path='/{}/{}/{}/get/text_plain/'.format(
+            DEFAULT_API, DEFAULT_API_VERSION, DEFAULT_SERVICE),
+        method='GET', query_params=query)
     request.endpoint_provider = StandardEndpointResolver()
     request.service = DEFAULT_SERVICE
     request.is_presign = True
@@ -82,7 +80,7 @@ def build_auth_token(api_client, db_user, instance_id, expires=None):
 
     # Step 3: Sign request (host is None, won't be included in signature)
     sign_chain = InterceptorChain()
-    sign_chain.append_request_interceptor(SignRequestInterceptor())
+    sign_chain.append_request_interceptor(api_client.sign_request_interceptor)
     context = sign_chain.execute_request(context)
 
     return context.request.signed_query

byteplussdkcore/interceptor/interceptors/request.py

@@ -57,6 +57,10 @@ class Request(object):
         self.session_token = configuration.session_token
         self.region = configuration.region
         self.scheme = configuration.scheme
+        # Business proxy snapshot; credential routing belongs to ApiClient's binding.
+        self.proxy = configuration.proxy
+        self.http_proxy = configuration.http_proxy
+        self.https_proxy = configuration.https_proxy
         self.endpoint_provider = configuration.endpoint_provider
         self.custom_bootstrap_region = configuration.custom_bootstrap_region
         self.use_dual_stack = configuration.use_dual_stack
@@ -64,6 +68,7 @@ class Request(object):
         # ApiClient injects its private base retryer before interception.
         self.auto_retry = configuration.auto_retry
         self.retryer = None
+        # ApiClient replaces this with its persistent binding before signing.
         self.credential_provider = configuration.credential_provider
         self.invocation_id = str(uuid.uuid4())
         self.retry_count = 0

byteplussdkcore/rest.py

@@ -147,6 +147,11 @@ class RESTClientObject(object):
         )
 
         if proxy_url:
+            # urllib3 (v2) does not forward the ``user:password@`` embedded in
+            # the proxy URL as a Proxy-Authorization header, unlike Go's
+            # http.ProxyURL. Extract it explicitly so proxies requiring Basic
+            # auth work the same way across SDKs.
+            proxy_headers = self.__proxy_authorization_headers(proxy_url)
             self.pool_manager = urllib3.ProxyManager(
                 num_pools=pools_size,
                 maxsize=maxsize,
@@ -155,6 +160,7 @@ class RESTClientObject(object):
                 cert_file=configuration.cert_file,
                 key_file=configuration.key_file,
                 proxy_url=proxy_url,
+                proxy_headers=proxy_headers,
                 timeout=timeout,
                 retries=Retry(total=False),
                 **addition_pool_args
@@ -191,6 +197,27 @@ class RESTClientObject(object):
                     proxy_url = os.getenv('https_proxy')
         return proxy_url
 
+    @staticmethod
+    def __proxy_authorization_headers(proxy_url):
+        """Build proxy_headers carrying Proxy-Authorization, or None.
+
+        Returns a dict ``{'Proxy-Authorization': 'Basic ...'}`` when the proxy
+        URL embeds a ``user:password@`` userinfo, otherwise None (so urllib3
+        keeps its default empty proxy headers). Never raises: a malformed proxy
+        URL simply yields no auth header and lets the connection attempt (and
+        its clearer downstream error) proceed.
+        """
+        try:
+            from byteplussdkcore.auth.sts_http_config import (
+                build_proxy_authorization_header,
+            )
+            value = build_proxy_authorization_header(proxy_url)
+        except Exception:
+            return None
+        if not value:
+            return None
+        return {"Proxy-Authorization": value}
+
     def request(self, method, url, query_params=None, headers=None,
                 body=None, post_params=None, _preload_content=True,
                 _request_timeout=None):

byteplussdkcore/retryer/retry_condition.py

@@ -1,10 +1,13 @@
+import errno
 import json
 import logging
 import socket
+import ssl
 import traceback
 from abc import abstractmethod
 
 import urllib3
+from six.moves.http_client import BadStatusLine
 
 from byteplussdkcore.observability.debugger import sdk_core_logger
 from byteplussdkcore.rest import ApiException, RESTResponse
@@ -73,7 +76,7 @@ class DefaultRetryCondition(RetryCondition):
         Returns:
             bool: True if the request should be retried, False otherwise.
         """
-        if err is not None and isinstance(err, self.__retry_exceptions):
+        if err is not None and self._is_retryable_exception(err):
             sdk_core_logger.debug_retry("retry for retryable exception, err: %s", err)
             return True
 
@@ -105,6 +108,31 @@ class DefaultRetryCondition(RetryCondition):
         sdk_core_logger.debug_retry("no need to retry")
         return False
 
+    @classmethod
+    def _is_retryable_exception(cls, err):
+        # Retry the underlying connection failure, not every proxy failure.
+        # In particular, a CONNECT 407 or a TLS/configuration error must stop.
+        seen = set()
+        while isinstance(err, (urllib3.exceptions.ProxyError, urllib3.exceptions.MaxRetryError)):
+            if id(err) in seen:
+                return False
+            seen.add(id(err))
+            if isinstance(err, urllib3.exceptions.ProxyError):
+                err = err.original_error
+            else:
+                err = err.reason
+        if isinstance(err, (ssl.SSLError, urllib3.exceptions.SSLError)):
+            return False
+        if isinstance(err, cls.__retry_exceptions):
+            return True
+        # RemoteDisconnected on Python 3, empty BadStatusLine on Python 2.
+        if isinstance(err, BadStatusLine) and err.line in ("", "''"):
+            return True
+        return isinstance(err, socket.error) and err.errno in (
+            errno.ECONNRESET, errno.ECONNREFUSED, errno.ECONNABORTED,
+            errno.EPIPE, errno.ETIMEDOUT, errno.ENETUNREACH, errno.EHOSTUNREACH,
+        )
+
     @staticmethod
     def __json_loads(data):
         """

byteplussdkvpc/__init__.py

@@ -59,8 +59,12 @@ from byteplussdkvpc.models.attach_network_interface_request import AttachNetwork
 from byteplussdkvpc.models.attach_network_interface_response import AttachNetworkInterfaceResponse
 from byteplussdkvpc.models.attachment_for_describe_network_interface_attributes_output import AttachmentForDescribeNetworkInterfaceAttributesOutput
 from byteplussdkvpc.models.attachment_for_describe_network_interfaces_output import AttachmentForDescribeNetworkInterfacesOutput
+from byteplussdkvpc.models.authorize_security_group_egress_batch_request import AuthorizeSecurityGroupEgressBatchRequest
+from byteplussdkvpc.models.authorize_security_group_egress_batch_response import AuthorizeSecurityGroupEgressBatchResponse
 from byteplussdkvpc.models.authorize_security_group_egress_request import AuthorizeSecurityGroupEgressRequest
 from byteplussdkvpc.models.authorize_security_group_egress_response import AuthorizeSecurityGroupEgressResponse
+from byteplussdkvpc.models.authorize_security_group_ingress_batch_request import AuthorizeSecurityGroupIngressBatchRequest
+from byteplussdkvpc.models.authorize_security_group_ingress_batch_response import AuthorizeSecurityGroupIngressBatchResponse
 from byteplussdkvpc.models.authorize_security_group_ingress_request import AuthorizeSecurityGroupIngressRequest
 from byteplussdkvpc.models.authorize_security_group_ingress_response import AuthorizeSecurityGroupIngressResponse
 from byteplussdkvpc.models.bandwidth_package_for_describe_bandwidth_packages_output import BandwidthPackageForDescribeBandwidthPackagesOutput
@@ -384,6 +388,10 @@ from byteplussdkvpc.models.modify_route_table_attributes_request import ModifyRo
 from byteplussdkvpc.models.modify_route_table_attributes_response import ModifyRouteTableAttributesResponse
 from byteplussdkvpc.models.modify_security_group_attributes_request import ModifySecurityGroupAttributesRequest
 from byteplussdkvpc.models.modify_security_group_attributes_response import ModifySecurityGroupAttributesResponse
+from byteplussdkvpc.models.modify_security_group_egress_batch_request import ModifySecurityGroupEgressBatchRequest
+from byteplussdkvpc.models.modify_security_group_egress_batch_response import ModifySecurityGroupEgressBatchResponse
+from byteplussdkvpc.models.modify_security_group_ingress_batch_request import ModifySecurityGroupIngressBatchRequest
+from byteplussdkvpc.models.modify_security_group_ingress_batch_response import ModifySecurityGroupIngressBatchResponse
 from byteplussdkvpc.models.modify_security_group_rule_descriptions_egress_request import ModifySecurityGroupRuleDescriptionsEgressRequest
 from byteplussdkvpc.models.modify_security_group_rule_descriptions_egress_response import ModifySecurityGroupRuleDescriptionsEgressResponse
 from byteplussdkvpc.models.modify_security_group_rule_descriptions_ingress_request import ModifySecurityGroupRuleDescriptionsIngressRequest
@@ -403,7 +411,12 @@ from byteplussdkvpc.models.modify_vpc_attributes_response import ModifyVpcAttrib
 from byteplussdkvpc.models.network_acl_attribute_for_describe_network_acl_attributes_output import NetworkAclAttributeForDescribeNetworkAclAttributesOutput
 from byteplussdkvpc.models.network_acl_for_describe_network_acls_output import NetworkAclForDescribeNetworkAclsOutput
 from byteplussdkvpc.models.network_interface_set_for_describe_network_interfaces_output import NetworkInterfaceSetForDescribeNetworkInterfacesOutput
+from byteplussdkvpc.models.overlap_detail_for_describe_ipam_resource_cidrs_output import OverlapDetailForDescribeIpamResourceCidrsOutput
+from byteplussdkvpc.models.permission_for_authorize_security_group_egress_batch_input import PermissionForAuthorizeSecurityGroupEgressBatchInput
+from byteplussdkvpc.models.permission_for_authorize_security_group_ingress_batch_input import PermissionForAuthorizeSecurityGroupIngressBatchInput
 from byteplussdkvpc.models.permission_for_describe_security_group_attributes_output import PermissionForDescribeSecurityGroupAttributesOutput
+from byteplussdkvpc.models.permission_for_modify_security_group_egress_batch_input import PermissionForModifySecurityGroupEgressBatchInput
+from byteplussdkvpc.models.permission_for_modify_security_group_ingress_batch_input import PermissionForModifySecurityGroupIngressBatchInput
 from byteplussdkvpc.models.prefix_list_association_for_describe_prefix_list_associations_output import PrefixListAssociationForDescribePrefixListAssociationsOutput
 from byteplussdkvpc.models.prefix_list_entry_for_create_prefix_list_input import PrefixListEntryForCreatePrefixListInput
 from byteplussdkvpc.models.prefix_list_entry_for_describe_prefix_list_entries_output import PrefixListEntryForDescribePrefixListEntriesOutput
@@ -430,8 +443,12 @@ from byteplussdkvpc.models.resource_for_describe_network_acls_output import Reso
 from byteplussdkvpc.models.resource_for_disassociate_network_acl_input import ResourceForDisassociateNetworkAclInput
 from byteplussdkvpc.models.resource_tag_for_list_tags_for_ipam_resources_output import ResourceTagForListTagsForIpamResourcesOutput
 from byteplussdkvpc.models.resource_tag_for_list_tags_for_resources_output import ResourceTagForListTagsForResourcesOutput
+from byteplussdkvpc.models.revoke_security_group_egress_batch_request import RevokeSecurityGroupEgressBatchRequest
+from byteplussdkvpc.models.revoke_security_group_egress_batch_response import RevokeSecurityGroupEgressBatchResponse
 from byteplussdkvpc.models.revoke_security_group_egress_request import RevokeSecurityGroupEgressRequest
 from byteplussdkvpc.models.revoke_security_group_egress_response import RevokeSecurityGroupEgressResponse
+from byteplussdkvpc.models.revoke_security_group_ingress_batch_request import RevokeSecurityGroupIngressBatchRequest
+from byteplussdkvpc.models.revoke_security_group_ingress_batch_response import RevokeSecurityGroupIngressBatchResponse
 from byteplussdkvpc.models.revoke_security_group_ingress_request import RevokeSecurityGroupIngressRequest
 from byteplussdkvpc.models.revoke_security_group_ingress_response import RevokeSecurityGroupIngressResponse
 from byteplussdkvpc.models.route_entry_for_describe_route_entry_list_output import RouteEntryForDescribeRouteEntryListOutput